diff --git a/.agents/skills/component-refactoring/SKILL.md b/.agents/skills/component-refactoring/SKILL.md
deleted file mode 100644
index a7cae67e8f9..00000000000
--- a/.agents/skills/component-refactoring/SKILL.md
+++ /dev/null
@@ -1,440 +0,0 @@
----
-name: component-refactoring
-description: Refactor high-complexity React components in Dify frontend. Use when `pnpm analyze-component --json` shows complexity > 50 or lineCount > 300, when the user asks for code splitting, hook extraction, or complexity reduction, or when `pnpm analyze-component` warns to refactor before testing; avoid for simple/well-structured components, third-party wrappers, or when the user explicitly wants testing without refactoring.
----
-
-# Dify Component Refactoring Skill
-
-Refactor high-complexity React components in the Dify frontend codebase with the patterns and workflow below.
-
-> **Complexity Threshold**: Components with complexity > 50 (measured by `pnpm analyze-component`) should be refactored before testing.
-
-## Quick Reference
-
-### Commands (run from `web/`)
-
-Use paths relative to `web/` (e.g., `app/components/...`).
-Use `refactor-component` for refactoring prompts and `analyze-component` for testing prompts and metrics.
-
-```bash
-cd web
-
-# Generate refactoring prompt
-pnpm refactor-component <path>
-
-# Output refactoring analysis as JSON
-pnpm refactor-component <path> --json
-
-# Generate testing prompt (after refactoring)
-pnpm analyze-component <path>
-
-# Output testing analysis as JSON
-pnpm analyze-component <path> --json
-```
-
-### Complexity Analysis
-
-```bash
-# Analyze component complexity
-pnpm analyze-component <path> --json
-
-# Key metrics to check:
-# - complexity: normalized score 0-100 (target < 50)
-# - maxComplexity: highest single function complexity
-# - lineCount: total lines (target < 300)
-```
-
-### Complexity Score Interpretation
-
-| Score | Level | Action |
-|-------|-------|--------|
-| 0-25 | 🟢 Simple | Ready for testing |
-| 26-50 | 🟡 Medium | Consider minor refactoring |
-| 51-75 | 🟠 Complex | **Refactor before testing** |
-| 76-100 | 🔴 Very Complex | **Must refactor** |
-
-## Core Refactoring Patterns
-
-### Pattern 1: Extract Custom Hooks
-
-**When**: Component has complex state management, multiple `useState`/`useEffect`, or business logic mixed with UI.
-
-**Dify Convention**: Place hooks in a `hooks/` subdirectory or alongside the component as `use-<feature>.ts`.
-
-```typescript
-// ❌ Before: Complex state logic in component
-function Configuration() {
-  const [modelConfig, setModelConfig] = useState<ModelConfig>(...)
-  const [datasetConfigs, setDatasetConfigs] = useState<DatasetConfigs>(...)
-  const [completionParams, setCompletionParams] = useState<FormValue>({})
-  
-  // 50+ lines of state management logic...
-  
-  return <div>...</div>
-}
-
-// ✅ After: Extract to custom hook
-// hooks/use-model-config.ts
-export const useModelConfig = (appId: string) => {
-  const [modelConfig, setModelConfig] = useState<ModelConfig>(...)
-  const [completionParams, setCompletionParams] = useState<FormValue>({})
-  
-  // Related state management logic here
-  
-  return { modelConfig, setModelConfig, completionParams, setCompletionParams }
-}
-
-// Component becomes cleaner
-function Configuration() {
-  const { modelConfig, setModelConfig } = useModelConfig(appId)
-  return <div>...</div>
-}
-```
-
-**Dify Examples**:
-- `web/app/components/app/configuration/hooks/use-advanced-prompt-config.ts`
-- `web/app/components/app/configuration/debug/hooks.tsx`
-- `web/app/components/workflow/hooks/use-workflow.ts`
-
-### Pattern 2: Extract Sub-Components
-
-**When**: Single component has multiple UI sections, conditional rendering blocks, or repeated patterns.
-
-**Dify Convention**: Place sub-components in subdirectories or as separate files in the same directory.
-
-```typescript
-// ❌ Before: Monolithic JSX with multiple sections
-const AppInfo = () => {
-  return (
-    <div>
-      {/* 100 lines of header UI */}
-      {/* 100 lines of operations UI */}
-      {/* 100 lines of modals */}
-    </div>
-  )
-}
-
-// ✅ After: Split into focused components
-// app-info/
-//   ├── index.tsx           (orchestration only)
-//   ├── app-header.tsx      (header UI)
-//   ├── app-operations.tsx  (operations UI)
-//   └── app-modals.tsx      (modal management)
-
-const AppInfo = () => {
-  const { showModal, setShowModal } = useAppInfoModals()
-  
-  return (
-    <div>
-      <AppHeader appDetail={appDetail} />
-      <AppOperations onAction={handleAction} />
-      <AppModals show={showModal} onClose={() => setShowModal(null)} />
-    </div>
-  )
-}
-```
-
-**Dify Examples**:
-- `web/app/components/app/configuration/` directory structure
-- `web/app/components/workflow/nodes/` per-node organization
-
-### Pattern 3: Simplify Conditional Logic
-
-**When**: Deep nesting (> 3 levels), complex ternaries, or multiple `if/else` chains.
-
-```typescript
-// ❌ Before: Deeply nested conditionals
-const Template = useMemo(() => {
-  if (appDetail?.mode === AppModeEnum.CHAT) {
-    switch (locale) {
-      case LanguagesSupported[1]:
-        return <TemplateChatZh />
-      case LanguagesSupported[7]:
-        return <TemplateChatJa />
-      default:
-        return <TemplateChatEn />
-    }
-  }
-  if (appDetail?.mode === AppModeEnum.ADVANCED_CHAT) {
-    // Another 15 lines...
-  }
-  // More conditions...
-}, [appDetail, locale])
-
-// ✅ After: Use lookup tables + early returns
-const TEMPLATE_MAP = {
-  [AppModeEnum.CHAT]: {
-    [LanguagesSupported[1]]: TemplateChatZh,
-    [LanguagesSupported[7]]: TemplateChatJa,
-    default: TemplateChatEn,
-  },
-  [AppModeEnum.ADVANCED_CHAT]: {
-    [LanguagesSupported[1]]: TemplateAdvancedChatZh,
-    // ...
-  },
-}
-
-const Template = useMemo(() => {
-  const modeTemplates = TEMPLATE_MAP[appDetail?.mode]
-  if (!modeTemplates) return null
-  
-  const TemplateComponent = modeTemplates[locale] || modeTemplates.default
-  return <TemplateComponent appDetail={appDetail} />
-}, [appDetail, locale])
-```
-
-### Pattern 4: Extract API/Data Logic
-
-**When**: Component directly handles API calls, data transformation, or complex async operations.
-
-**Dify Convention**:
-- This skill is for component decomposition, not query/mutation design.
-- Do not introduce deprecated `useInvalid` / `useReset`.
-- Do not add thin passthrough `useQuery` wrappers during refactoring; only extract a custom hook when it truly orchestrates multiple queries/mutations or shared derived state.
-
-**Dify Examples**:
-- `web/service/use-workflow.ts`
-- `web/service/use-common.ts`
-- `web/service/knowledge/use-dataset.ts`
-- `web/service/knowledge/use-document.ts`
-
-### Pattern 5: Extract Modal/Dialog Management
-
-**When**: Component manages multiple modals with complex open/close states.
-
-**Dify Convention**: Modals should be extracted with their state management.
-
-```typescript
-// ❌ Before: Multiple modal states in component
-const AppInfo = () => {
-  const [showEditModal, setShowEditModal] = useState(false)
-  const [showDuplicateModal, setShowDuplicateModal] = useState(false)
-  const [showConfirmDelete, setShowConfirmDelete] = useState(false)
-  const [showSwitchModal, setShowSwitchModal] = useState(false)
-  const [showImportDSLModal, setShowImportDSLModal] = useState(false)
-  // 5+ more modal states...
-}
-
-// ✅ After: Extract to modal management hook
-type ModalType = 'edit' | 'duplicate' | 'delete' | 'switch' | 'import' | null
-
-const useAppInfoModals = () => {
-  const [activeModal, setActiveModal] = useState<ModalType>(null)
-  
-  const openModal = useCallback((type: ModalType) => setActiveModal(type), [])
-  const closeModal = useCallback(() => setActiveModal(null), [])
-  
-  return {
-    activeModal,
-    openModal,
-    closeModal,
-    isOpen: (type: ModalType) => activeModal === type,
-  }
-}
-```
-
-### Pattern 6: Extract Form Logic
-
-**When**: Complex form validation, submission handling, or field transformation.
-
-**Dify Convention**: Use `@tanstack/react-form` patterns from `web/app/components/base/form/`.
-
-```typescript
-// ✅ Use existing form infrastructure
-import { useAppForm } from '@/app/components/base/form'
-
-const ConfigForm = () => {
-  const form = useAppForm({
-    defaultValues: { name: '', description: '' },
-    onSubmit: handleSubmit,
-  })
-  
-  return <form.Provider>...</form.Provider>
-}
-```
-
-## Dify-Specific Refactoring Guidelines
-
-### 1. Context Provider Extraction
-
-**When**: Component provides complex context values with multiple states.
-
-```typescript
-// ❌ Before: Large context value object
-const value = {
-  appId, isAPIKeySet, isTrailFinished, mode, modelModeType,
-  promptMode, isAdvancedMode, isAgent, isOpenAI, isFunctionCall,
-  // 50+ more properties...
-}
-return <ConfigContext.Provider value={value}>...</ConfigContext.Provider>
-
-// ✅ After: Split into domain-specific contexts
-<ModelConfigProvider value={modelConfigValue}>
-  <DatasetConfigProvider value={datasetConfigValue}>
-    <UIConfigProvider value={uiConfigValue}>
-      {children}
-    </UIConfigProvider>
-  </DatasetConfigProvider>
-</ModelConfigProvider>
-```
-
-**Dify Reference**: `web/context/` directory structure
-
-### 2. Workflow Node Components
-
-**When**: Refactoring workflow node components (`web/app/components/workflow/nodes/`).
-
-**Conventions**:
-- Keep node logic in `use-interactions.ts`
-- Extract panel UI to separate files
-- Use `_base` components for common patterns
-
-```
-nodes/<node-type>/
-  ├── index.tsx              # Node registration
-  ├── node.tsx               # Node visual component
-  ├── panel.tsx              # Configuration panel
-  ├── use-interactions.ts    # Node-specific hooks
-  └── types.ts               # Type definitions
-```
-
-### 3. Configuration Components
-
-**When**: Refactoring app configuration components.
-
-**Conventions**:
-- Separate config sections into subdirectories
-- Use existing patterns from `web/app/components/app/configuration/`
-- Keep feature toggles in dedicated components
-
-### 4. Tool/Plugin Components
-
-**When**: Refactoring tool-related components (`web/app/components/tools/`).
-
-**Conventions**:
-- Follow existing modal patterns
-- Use service hooks from `web/service/use-tools.ts`
-- Keep provider-specific logic isolated
-
-## Refactoring Workflow
-
-### Step 1: Generate Refactoring Prompt
-
-```bash
-pnpm refactor-component <path>
-```
-
-This command will:
-- Analyze component complexity and features
-- Identify specific refactoring actions needed
-- Generate a prompt for AI assistant (auto-copied to clipboard on macOS)
-- Provide detailed requirements based on detected patterns
-
-### Step 2: Analyze Details
-
-```bash
-pnpm analyze-component <path> --json
-```
-
-Identify:
-- Total complexity score
-- Max function complexity
-- Line count
-- Features detected (state, effects, API, etc.)
-
-### Step 3: Plan
-
-Create a refactoring plan based on detected features:
-
-| Detected Feature | Refactoring Action |
-|------------------|-------------------|
-| `hasState: true` + `hasEffects: true` | Extract custom hook |
-| `hasAPI: true` | Extract data/service hook |
-| `hasEvents: true` (many) | Extract event handlers |
-| `lineCount > 300` | Split into sub-components |
-| `maxComplexity > 50` | Simplify conditional logic |
-
-### Step 4: Execute Incrementally
-
-1. **Extract one piece at a time**
-2. **Run lint, type-check, and tests after each extraction**
-3. **Verify functionality before next step**
-
-```
-For each extraction:
-  ┌────────────────────────────────────────┐
-  │ 1. Extract code                        │
-  │ 2. Run: pnpm lint:fix                  │
-  │ 3. Run: pnpm type-check                │
-  │ 4. Run: pnpm test                      │
-  │ 5. Test functionality manually         │
-  │ 6. PASS? → Next extraction             │
-  │    FAIL? → Fix before continuing       │
-  └────────────────────────────────────────┘
-```
-
-### Step 5: Verify
-
-After refactoring:
-
-```bash
-# Re-run refactor command to verify improvements
-pnpm refactor-component <path>
-
-# If complexity < 25 and lines < 200, you'll see:
-# ✅ COMPONENT IS WELL-STRUCTURED
-
-# For detailed metrics:
-pnpm analyze-component <path> --json
-
-# Target metrics:
-# - complexity < 50
-# - lineCount < 300
-# - maxComplexity < 30
-```
-
-## Common Mistakes to Avoid
-
-### ❌ Over-Engineering
-
-```typescript
-// ❌ Too many tiny hooks
-const useButtonText = () => useState('Click')
-const useButtonDisabled = () => useState(false)
-const useButtonLoading = () => useState(false)
-
-// ✅ Cohesive hook with related state
-const useButtonState = () => {
-  const [text, setText] = useState('Click')
-  const [disabled, setDisabled] = useState(false)
-  const [loading, setLoading] = useState(false)
-  return { text, setText, disabled, setDisabled, loading, setLoading }
-}
-```
-
-### ❌ Breaking Existing Patterns
-
-- Follow existing directory structures
-- Maintain naming conventions
-- Preserve export patterns for compatibility
-
-### ❌ Premature Abstraction
-
-- Only extract when there's clear complexity benefit
-- Don't create abstractions for single-use code
-- Keep refactored code in the same domain area
-
-## References
-
-### Dify Codebase Examples
-
-- **Hook extraction**: `web/app/components/app/configuration/hooks/`
-- **Component splitting**: `web/app/components/app/configuration/`
-- **Service hooks**: `web/service/use-*.ts`
-- **Workflow patterns**: `web/app/components/workflow/hooks/`
-- **Form patterns**: `web/app/components/base/form/`
-
-### Related Skills
-
-- `frontend-testing` - For testing refactored components
-- `web/docs/test.md` - Testing specification
diff --git a/.agents/skills/component-refactoring/references/complexity-patterns.md b/.agents/skills/component-refactoring/references/complexity-patterns.md
deleted file mode 100644
index 2873630d4ba..00000000000
--- a/.agents/skills/component-refactoring/references/complexity-patterns.md
+++ /dev/null
@@ -1,495 +0,0 @@
-# Complexity Reduction Patterns
-
-This document provides patterns for reducing cognitive complexity in Dify React components.
-
-## Understanding Complexity
-
-### SonarJS Cognitive Complexity
-
-The `pnpm analyze-component` tool uses SonarJS cognitive complexity metrics:
-
-- **Total Complexity**: Sum of all functions' complexity in the file
-- **Max Complexity**: Highest single function complexity
-
-### What Increases Complexity
-
-| Pattern | Complexity Impact |
-|---------|-------------------|
-| `if/else` | +1 per branch |
-| Nested conditions | +1 per nesting level |
-| `switch/case` | +1 per case |
-| `for/while/do` | +1 per loop |
-| `&&`/`||` chains | +1 per operator |
-| Nested callbacks | +1 per nesting level |
-| `try/catch` | +1 per catch |
-| Ternary expressions | +1 per nesting |
-
-## Pattern 1: Replace Conditionals with Lookup Tables
-
-**Before** (complexity: ~15):
-
-```typescript
-const Template = useMemo(() => {
-  if (appDetail?.mode === AppModeEnum.CHAT) {
-    switch (locale) {
-      case LanguagesSupported[1]:
-        return <TemplateChatZh appDetail={appDetail} />
-      case LanguagesSupported[7]:
-        return <TemplateChatJa appDetail={appDetail} />
-      default:
-        return <TemplateChatEn appDetail={appDetail} />
-    }
-  }
-  if (appDetail?.mode === AppModeEnum.ADVANCED_CHAT) {
-    switch (locale) {
-      case LanguagesSupported[1]:
-        return <TemplateAdvancedChatZh appDetail={appDetail} />
-      case LanguagesSupported[7]:
-        return <TemplateAdvancedChatJa appDetail={appDetail} />
-      default:
-        return <TemplateAdvancedChatEn appDetail={appDetail} />
-    }
-  }
-  if (appDetail?.mode === AppModeEnum.WORKFLOW) {
-    // Similar pattern...
-  }
-  return null
-}, [appDetail, locale])
-```
-
-**After** (complexity: ~3):
-
-```typescript
-import type { ComponentType } from 'react'
-
-// Define lookup table outside component
-const TEMPLATE_MAP: Record<AppModeEnum, Record<string, ComponentType<TemplateProps>>> = {
-  [AppModeEnum.CHAT]: {
-    [LanguagesSupported[1]]: TemplateChatZh,
-    [LanguagesSupported[7]]: TemplateChatJa,
-    default: TemplateChatEn,
-  },
-  [AppModeEnum.ADVANCED_CHAT]: {
-    [LanguagesSupported[1]]: TemplateAdvancedChatZh,
-    [LanguagesSupported[7]]: TemplateAdvancedChatJa,
-    default: TemplateAdvancedChatEn,
-  },
-  [AppModeEnum.WORKFLOW]: {
-    [LanguagesSupported[1]]: TemplateWorkflowZh,
-    [LanguagesSupported[7]]: TemplateWorkflowJa,
-    default: TemplateWorkflowEn,
-  },
-  // ...
-}
-
-// Clean component logic
-const Template = useMemo(() => {
-  if (!appDetail?.mode) return null
-  
-  const templates = TEMPLATE_MAP[appDetail.mode]
-  if (!templates) return null
-  
-  const TemplateComponent = templates[locale] ?? templates.default
-  return <TemplateComponent appDetail={appDetail} />
-}, [appDetail, locale])
-```
-
-## Pattern 2: Use Early Returns
-
-**Before** (complexity: ~10):
-
-```typescript
-const handleSubmit = () => {
-  if (isValid) {
-    if (hasChanges) {
-      if (isConnected) {
-        submitData()
-      } else {
-        showConnectionError()
-      }
-    } else {
-      showNoChangesMessage()
-    }
-  } else {
-    showValidationError()
-  }
-}
-```
-
-**After** (complexity: ~4):
-
-```typescript
-const handleSubmit = () => {
-  if (!isValid) {
-    showValidationError()
-    return
-  }
-  
-  if (!hasChanges) {
-    showNoChangesMessage()
-    return
-  }
-  
-  if (!isConnected) {
-    showConnectionError()
-    return
-  }
-  
-  submitData()
-}
-```
-
-## Pattern 3: Extract Complex Conditions
-
-**Before** (complexity: high):
-
-```typescript
-const canPublish = (() => {
-  if (mode !== AppModeEnum.COMPLETION) {
-    if (!isAdvancedMode)
-      return true
-
-    if (modelModeType === ModelModeType.completion) {
-      if (!hasSetBlockStatus.history || !hasSetBlockStatus.query)
-        return false
-      return true
-    }
-    return true
-  }
-  return !promptEmpty
-})()
-```
-
-**After** (complexity: lower):
-
-```typescript
-// Extract to named functions
-const canPublishInCompletionMode = () => !promptEmpty
-
-const canPublishInChatMode = () => {
-  if (!isAdvancedMode) return true
-  if (modelModeType !== ModelModeType.completion) return true
-  return hasSetBlockStatus.history && hasSetBlockStatus.query
-}
-
-// Clean main logic
-const canPublish = mode === AppModeEnum.COMPLETION
-  ? canPublishInCompletionMode()
-  : canPublishInChatMode()
-```
-
-## Pattern 4: Replace Chained Ternaries
-
-**Before** (complexity: ~5):
-
-```typescript
-const statusText = serverActivated
-  ? t('status.running')
-  : serverPublished
-    ? t('status.inactive')
-    : appUnpublished
-      ? t('status.unpublished')
-      : t('status.notConfigured')
-```
-
-**After** (complexity: ~2):
-
-```typescript
-const getStatusText = () => {
-  if (serverActivated) return t('status.running')
-  if (serverPublished) return t('status.inactive')
-  if (appUnpublished) return t('status.unpublished')
-  return t('status.notConfigured')
-}
-
-const statusText = getStatusText()
-```
-
-Or use lookup:
-
-```typescript
-const STATUS_TEXT_MAP = {
-  running: 'status.running',
-  inactive: 'status.inactive',
-  unpublished: 'status.unpublished',
-  notConfigured: 'status.notConfigured',
-} as const
-
-const getStatusKey = (): keyof typeof STATUS_TEXT_MAP => {
-  if (serverActivated) return 'running'
-  if (serverPublished) return 'inactive'
-  if (appUnpublished) return 'unpublished'
-  return 'notConfigured'
-}
-
-const statusText = t(STATUS_TEXT_MAP[getStatusKey()])
-```
-
-## Pattern 5: Flatten Nested Loops
-
-**Before** (complexity: high):
-
-```typescript
-const processData = (items: Item[]) => {
-  const results: ProcessedItem[] = []
-  
-  for (const item of items) {
-    if (item.isValid) {
-      for (const child of item.children) {
-        if (child.isActive) {
-          for (const prop of child.properties) {
-            if (prop.value !== null) {
-              results.push({
-                itemId: item.id,
-                childId: child.id,
-                propValue: prop.value,
-              })
-            }
-          }
-        }
-      }
-    }
-  }
-  
-  return results
-}
-```
-
-**After** (complexity: lower):
-
-```typescript
-// Use functional approach
-const processData = (items: Item[]) => {
-  return items
-    .filter(item => item.isValid)
-    .flatMap(item =>
-      item.children
-        .filter(child => child.isActive)
-        .flatMap(child =>
-          child.properties
-            .filter(prop => prop.value !== null)
-            .map(prop => ({
-              itemId: item.id,
-              childId: child.id,
-              propValue: prop.value,
-            }))
-        )
-    )
-}
-```
-
-## Pattern 6: Extract Event Handler Logic
-
-**Before** (complexity: high in component):
-
-```typescript
-const Component = () => {
-  const handleSelect = (data: DataSet[]) => {
-    if (isEqual(data.map(item => item.id), dataSets.map(item => item.id))) {
-      hideSelectDataSet()
-      return
-    }
-
-    formattingChangedDispatcher()
-    let newDatasets = data
-    if (data.find(item => !item.name)) {
-      const newSelected = produce(data, (draft) => {
-        data.forEach((item, index) => {
-          if (!item.name) {
-            const newItem = dataSets.find(i => i.id === item.id)
-            if (newItem)
-              draft[index] = newItem
-          }
-        })
-      })
-      setDataSets(newSelected)
-      newDatasets = newSelected
-    }
-    else {
-      setDataSets(data)
-    }
-    hideSelectDataSet()
-    
-    // 40 more lines of logic...
-  }
-  
-  return <div>...</div>
-}
-```
-
-**After** (complexity: lower):
-
-```typescript
-// Extract to hook or utility
-const useDatasetSelection = (dataSets: DataSet[], setDataSets: SetState<DataSet[]>) => {
-  const normalizeSelection = (data: DataSet[]) => {
-    const hasUnloadedItem = data.some(item => !item.name)
-    if (!hasUnloadedItem) return data
-    
-    return produce(data, (draft) => {
-      data.forEach((item, index) => {
-        if (!item.name) {
-          const existing = dataSets.find(i => i.id === item.id)
-          if (existing) draft[index] = existing
-        }
-      })
-    })
-  }
-  
-  const hasSelectionChanged = (newData: DataSet[]) => {
-    return !isEqual(
-      newData.map(item => item.id),
-      dataSets.map(item => item.id)
-    )
-  }
-  
-  return { normalizeSelection, hasSelectionChanged }
-}
-
-// Component becomes cleaner
-const Component = () => {
-  const { normalizeSelection, hasSelectionChanged } = useDatasetSelection(dataSets, setDataSets)
-  
-  const handleSelect = (data: DataSet[]) => {
-    if (!hasSelectionChanged(data)) {
-      hideSelectDataSet()
-      return
-    }
-    
-    formattingChangedDispatcher()
-    const normalized = normalizeSelection(data)
-    setDataSets(normalized)
-    hideSelectDataSet()
-  }
-  
-  return <div>...</div>
-}
-```
-
-## Pattern 7: Reduce Boolean Logic Complexity
-
-**Before** (complexity: ~8):
-
-```typescript
-const toggleDisabled = hasInsufficientPermissions
-  || appUnpublished
-  || missingStartNode
-  || triggerModeDisabled
-  || (isAdvancedApp && !currentWorkflow?.graph)
-  || (isBasicApp && !basicAppConfig.updated_at)
-```
-
-**After** (complexity: ~3):
-
-```typescript
-// Extract meaningful boolean functions
-const isAppReady = () => {
-  if (isAdvancedApp) return !!currentWorkflow?.graph
-  return !!basicAppConfig.updated_at
-}
-
-const hasRequiredPermissions = () => {
-  return isCurrentWorkspaceEditor && !hasInsufficientPermissions
-}
-
-const canToggle = () => {
-  if (!hasRequiredPermissions()) return false
-  if (!isAppReady()) return false
-  if (missingStartNode) return false
-  if (triggerModeDisabled) return false
-  return true
-}
-
-const toggleDisabled = !canToggle()
-```
-
-## Pattern 8: Simplify useMemo/useCallback Dependencies
-
-**Before** (complexity: multiple recalculations):
-
-```typescript
-const payload = useMemo(() => {
-  let parameters: Parameter[] = []
-  let outputParameters: OutputParameter[] = []
-
-  if (!published) {
-    parameters = (inputs || []).map((item) => ({
-      name: item.variable,
-      description: '',
-      form: 'llm',
-      required: item.required,
-      type: item.type,
-    }))
-    outputParameters = (outputs || []).map((item) => ({
-      name: item.variable,
-      description: '',
-      type: item.value_type,
-    }))
-  }
-  else if (detail && detail.tool) {
-    parameters = (inputs || []).map((item) => ({
-      // Complex transformation...
-    }))
-    outputParameters = (outputs || []).map((item) => ({
-      // Complex transformation...
-    }))
-  }
-  
-  return {
-    icon: detail?.icon || icon,
-    label: detail?.label || name,
-    // ...more fields
-  }
-}, [detail, published, workflowAppId, icon, name, description, inputs, outputs])
-```
-
-**After** (complexity: separated concerns):
-
-```typescript
-// Separate transformations
-const useParameterTransform = (inputs: InputVar[], detail?: ToolDetail, published?: boolean) => {
-  return useMemo(() => {
-    if (!published) {
-      return inputs.map(item => ({
-        name: item.variable,
-        description: '',
-        form: 'llm',
-        required: item.required,
-        type: item.type,
-      }))
-    }
-    
-    if (!detail?.tool) return []
-    
-    return inputs.map(item => ({
-      name: item.variable,
-      required: item.required,
-      type: item.type === 'paragraph' ? 'string' : item.type,
-      description: detail.tool.parameters.find(p => p.name === item.variable)?.llm_description || '',
-      form: detail.tool.parameters.find(p => p.name === item.variable)?.form || 'llm',
-    }))
-  }, [inputs, detail, published])
-}
-
-// Component uses hook
-const parameters = useParameterTransform(inputs, detail, published)
-const outputParameters = useOutputTransform(outputs, detail, published)
-
-const payload = useMemo(() => ({
-  icon: detail?.icon || icon,
-  label: detail?.label || name,
-  parameters,
-  outputParameters,
-  // ...
-}), [detail, icon, name, parameters, outputParameters])
-```
-
-## Target Metrics After Refactoring
-
-| Metric | Target |
-|--------|--------|
-| Total Complexity | < 50 |
-| Max Function Complexity | < 30 |
-| Function Length | < 30 lines |
-| Nesting Depth | ≤ 3 levels |
-| Conditional Chains | ≤ 3 conditions |
diff --git a/.agents/skills/component-refactoring/references/component-splitting.md b/.agents/skills/component-refactoring/references/component-splitting.md
deleted file mode 100644
index 81c007e0050..00000000000
--- a/.agents/skills/component-refactoring/references/component-splitting.md
+++ /dev/null
@@ -1,477 +0,0 @@
-# Component Splitting Patterns
-
-This document provides detailed guidance on splitting large components into smaller, focused components in Dify.
-
-## When to Split Components
-
-Split a component when you identify:
-
-1. **Multiple UI sections** - Distinct visual areas with minimal coupling that can be composed independently
-1. **Conditional rendering blocks** - Large `{condition && <JSX />}` blocks
-1. **Repeated patterns** - Similar UI structures used multiple times
-1. **300+ lines** - Component exceeds manageable size
-1. **Modal clusters** - Multiple modals rendered in one component
-
-## Splitting Strategies
-
-### Strategy 1: Section-Based Splitting
-
-Identify visual sections and extract each as a component.
-
-```typescript
-// ❌ Before: Monolithic component (500+ lines)
-const ConfigurationPage = () => {
-  return (
-    <div>
-      {/* Header Section - 50 lines */}
-      <div className="header">
-        <h1>{t('configuration.title')}</h1>
-        <div className="actions">
-          {isAdvancedMode && <Badge>Advanced</Badge>}
-          <ModelParameterModal ... />
-          <AppPublisher ... />
-        </div>
-      </div>
-      
-      {/* Config Section - 200 lines */}
-      <div className="config">
-        <Config />
-      </div>
-      
-      {/* Debug Section - 150 lines */}
-      <div className="debug">
-        <Debug ... />
-      </div>
-      
-      {/* Modals Section - 100 lines */}
-      {showSelectDataSet && <SelectDataSet ... />}
-      {showHistoryModal && <EditHistoryModal ... />}
-      {showUseGPT4Confirm && <Confirm ... />}
-    </div>
-  )
-}
-
-// ✅ After: Split into focused components
-// configuration/
-//   ├── index.tsx              (orchestration)
-//   ├── configuration-header.tsx
-//   ├── configuration-content.tsx
-//   ├── configuration-debug.tsx
-//   └── configuration-modals.tsx
-
-// configuration-header.tsx
-interface ConfigurationHeaderProps {
-  isAdvancedMode: boolean
-  onPublish: () => void
-}
-
-function ConfigurationHeader({
-  isAdvancedMode,
-  onPublish,
-}: ConfigurationHeaderProps) {
-  const { t } = useTranslation()
-  
-  return (
-    <div className="header">
-      <h1>{t('configuration.title')}</h1>
-      <div className="actions">
-        {isAdvancedMode && <Badge>Advanced</Badge>}
-        <ModelParameterModal ... />
-        <AppPublisher onPublish={onPublish} />
-      </div>
-    </div>
-  )
-}
-
-// index.tsx (orchestration only)
-const ConfigurationPage = () => {
-  const { modelConfig, setModelConfig } = useModelConfig()
-  const { activeModal, openModal, closeModal } = useModalState()
-  
-  return (
-    <div>
-      <ConfigurationHeader
-        isAdvancedMode={isAdvancedMode}
-        onPublish={handlePublish}
-      />
-      <ConfigurationContent
-        modelConfig={modelConfig}
-        onConfigChange={setModelConfig}
-      />
-      {!isMobile && (
-        <ConfigurationDebug
-          inputs={inputs}
-          onSetting={handleSetting}
-        />
-      )}
-      <ConfigurationModals
-        activeModal={activeModal}
-        onClose={closeModal}
-      />
-    </div>
-  )
-}
-```
-
-### Strategy 2: Conditional Block Extraction
-
-Extract large conditional rendering blocks.
-
-```typescript
-// ❌ Before: Large conditional blocks
-const AppInfo = () => {
-  return (
-    <div>
-      {expand ? (
-        <div className="expanded">
-          {/* 100 lines of expanded view */}
-        </div>
-      ) : (
-        <div className="collapsed">
-          {/* 50 lines of collapsed view */}
-        </div>
-      )}
-    </div>
-  )
-}
-
-// ✅ After: Separate view components
-function AppInfoExpanded({ appDetail, onAction }: AppInfoViewProps) {
-  return (
-    <div className="expanded">
-      {/* Clean, focused expanded view */}
-    </div>
-  )
-}
-
-function AppInfoCollapsed({ appDetail, onAction }: AppInfoViewProps) {
-  return (
-    <div className="collapsed">
-      {/* Clean, focused collapsed view */}
-    </div>
-  )
-}
-
-const AppInfo = () => {
-  return (
-    <div>
-      {expand
-        ? <AppInfoExpanded appDetail={appDetail} onAction={handleAction} />
-        : <AppInfoCollapsed appDetail={appDetail} onAction={handleAction} />
-      }
-    </div>
-  )
-}
-```
-
-### Strategy 3: Modal Extraction
-
-Extract modals with their trigger logic.
-
-```typescript
-// ❌ Before: Multiple modals in one component
-const AppInfo = () => {
-  const [showEdit, setShowEdit] = useState(false)
-  const [showDuplicate, setShowDuplicate] = useState(false)
-  const [showDelete, setShowDelete] = useState(false)
-  const [showSwitch, setShowSwitch] = useState(false)
-  
-  const onEdit = async (data) => { /* 20 lines */ }
-  const onDuplicate = async (data) => { /* 20 lines */ }
-  const onDelete = async () => { /* 15 lines */ }
-  
-  return (
-    <div>
-      {/* Main content */}
-      
-      {showEdit && <EditModal onConfirm={onEdit} onClose={() => setShowEdit(false)} />}
-      {showDuplicate && <DuplicateModal onConfirm={onDuplicate} onClose={() => setShowDuplicate(false)} />}
-      {showDelete && <DeleteConfirm onConfirm={onDelete} onClose={() => setShowDelete(false)} />}
-      {showSwitch && <SwitchModal ... />}
-    </div>
-  )
-}
-
-// ✅ After: Modal manager component
-// app-info-modals.tsx
-type ModalType = 'edit' | 'duplicate' | 'delete' | 'switch' | null
-
-interface AppInfoModalsProps {
-  appDetail: AppDetail
-  activeModal: ModalType
-  onClose: () => void
-  onSuccess: () => void
-}
-
-function AppInfoModals({
-  appDetail,
-  activeModal,
-  onClose,
-  onSuccess,
-}: AppInfoModalsProps) {
-  const handleEdit = async (data) => { /* logic */ }
-  const handleDuplicate = async (data) => { /* logic */ }
-  const handleDelete = async () => { /* logic */ }
-
-  return (
-    <>
-      {activeModal === 'edit' && (
-        <EditModal
-          appDetail={appDetail}
-          onConfirm={handleEdit}
-          onClose={onClose}
-        />
-      )}
-      {activeModal === 'duplicate' && (
-        <DuplicateModal
-          appDetail={appDetail}
-          onConfirm={handleDuplicate}
-          onClose={onClose}
-        />
-      )}
-      {activeModal === 'delete' && (
-        <DeleteConfirm
-          onConfirm={handleDelete}
-          onClose={onClose}
-        />
-      )}
-      {activeModal === 'switch' && (
-        <SwitchModal
-          appDetail={appDetail}
-          onClose={onClose}
-        />
-      )}
-    </>
-  )
-}
-
-// Parent component
-const AppInfo = () => {
-  const { activeModal, openModal, closeModal } = useModalState()
-  
-  return (
-    <div>
-      {/* Main content with openModal triggers */}
-      <Button onClick={() => openModal('edit')}>Edit</Button>
-      
-      <AppInfoModals
-        appDetail={appDetail}
-        activeModal={activeModal}
-        onClose={closeModal}
-        onSuccess={handleSuccess}
-      />
-    </div>
-  )
-}
-```
-
-### Strategy 4: List Item Extraction
-
-Extract repeated item rendering.
-
-```typescript
-// ❌ Before: Inline item rendering
-const OperationsList = () => {
-  return (
-    <div>
-      {operations.map(op => (
-        <div key={op.id} className="operation-item">
-          <span className="icon">{op.icon}</span>
-          <span className="title">{op.title}</span>
-          <span className="description">{op.description}</span>
-          <button onClick={() => op.onClick()}>
-            {op.actionLabel}
-          </button>
-          {op.badge && <Badge>{op.badge}</Badge>}
-          {/* More complex rendering... */}
-        </div>
-      ))}
-    </div>
-  )
-}
-
-// ✅ After: Extracted item component
-interface OperationItemProps {
-  operation: Operation
-  onAction: (id: string) => void
-}
-
-function OperationItem({ operation, onAction }: OperationItemProps) {
-  return (
-    <div className="operation-item">
-      <span className="icon">{operation.icon}</span>
-      <span className="title">{operation.title}</span>
-      <span className="description">{operation.description}</span>
-      <button onClick={() => onAction(operation.id)}>
-        {operation.actionLabel}
-      </button>
-      {operation.badge && <Badge>{operation.badge}</Badge>}
-    </div>
-  )
-}
-
-const OperationsList = () => {
-  const handleAction = useCallback((id: string) => {
-    const op = operations.find(o => o.id === id)
-    op?.onClick()
-  }, [operations])
-
-  return (
-    <div>
-      {operations.map(op => (
-        <OperationItem
-          key={op.id}
-          operation={op}
-          onAction={handleAction}
-        />
-      ))}
-    </div>
-  )
-}
-```
-
-## Directory Structure Patterns
-
-### Pattern A: Flat Structure (Simple Components)
-
-For components with 2-3 sub-components:
-
-```
-component-name/
-  ├── index.tsx           # Main component
-  ├── sub-component-a.tsx
-  ├── sub-component-b.tsx
-  └── types.ts            # Shared types
-```
-
-### Pattern B: Nested Structure (Complex Components)
-
-For components with many sub-components:
-
-```
-component-name/
-  ├── index.tsx           # Main orchestration
-  ├── types.ts            # Shared types
-  ├── hooks/
-  │   ├── use-feature-a.ts
-  │   └── use-feature-b.ts
-  ├── components/
-  │   ├── header/
-  │   │   └── index.tsx
-  │   ├── content/
-  │   │   └── index.tsx
-  │   └── modals/
-  │       └── index.tsx
-  └── utils/
-      └── helpers.ts
-```
-
-### Pattern C: Feature-Based Structure (Dify Standard)
-
-Following Dify's existing patterns:
-
-```
-configuration/
-  ├── index.tsx           # Main page component
-  ├── base/               # Base/shared components
-  │   ├── feature-panel/
-  │   ├── group-name/
-  │   └── operation-btn/
-  ├── config/             # Config section
-  │   ├── index.tsx
-  │   ├── agent/
-  │   └── automatic/
-  ├── dataset-config/     # Dataset section
-  │   ├── index.tsx
-  │   ├── card-item/
-  │   └── params-config/
-  ├── debug/              # Debug section
-  │   ├── index.tsx
-  │   └── hooks.tsx
-  └── hooks/              # Shared hooks
-      └── use-advanced-prompt-config.ts
-```
-
-## Props Design
-
-### Minimal Props Principle
-
-Pass only what's needed:
-
-```typescript
-// ❌ Bad: Passing entire objects when only some fields needed
-<ConfigHeader appDetail={appDetail} modelConfig={modelConfig} />
-
-// ✅ Good: Destructure to minimum required
-<ConfigHeader
-  appName={appDetail.name}
-  isAdvancedMode={modelConfig.isAdvanced}
-  onPublish={handlePublish}
-/>
-```
-
-### Callback Props Pattern
-
-Use callbacks for child-to-parent communication:
-
-```typescript
-// Parent
-const Parent = () => {
-  const [value, setValue] = useState('')
-  
-  return (
-    <Child
-      value={value}
-      onChange={setValue}
-      onSubmit={handleSubmit}
-    />
-  )
-}
-
-// Child
-interface ChildProps {
-  value: string
-  onChange: (value: string) => void
-  onSubmit: () => void
-}
-
-function Child({ value, onChange, onSubmit }: ChildProps) {
-  return (
-    <div>
-      <input value={value} onChange={e => onChange(e.target.value)} />
-      <button onClick={onSubmit}>Submit</button>
-    </div>
-  )
-}
-```
-
-### Render Props for Flexibility
-
-When sub-components need parent context:
-
-```typescript
-interface ListProps<T> {
-  items: T[]
-  renderItem: (item: T, index: number) => React.ReactNode
-  renderEmpty?: () => React.ReactNode
-}
-
-function List<T>({ items, renderItem, renderEmpty }: ListProps<T>) {
-  if (items.length === 0 && renderEmpty) {
-    return <>{renderEmpty()}</>
-  }
-  
-  return (
-    <div>
-      {items.map((item, index) => renderItem(item, index))}
-    </div>
-  )
-}
-
-// Usage
-<List
-  items={operations}
-  renderItem={(op, i) => <OperationItem key={i} operation={op} />}
-  renderEmpty={() => <EmptyState message="No operations" />}
-/>
-```
diff --git a/.agents/skills/component-refactoring/references/hook-extraction.md b/.agents/skills/component-refactoring/references/hook-extraction.md
deleted file mode 100644
index 6fad2c8885e..00000000000
--- a/.agents/skills/component-refactoring/references/hook-extraction.md
+++ /dev/null
@@ -1,281 +0,0 @@
-# Hook Extraction Patterns
-
-This document provides detailed guidance on extracting custom hooks from complex components in Dify.
-
-## When to Extract Hooks
-
-Extract a custom hook when you identify:
-
-1. **Coupled state groups** - Multiple `useState` hooks that are always used together
-1. **Complex effects** - `useEffect` with multiple dependencies or cleanup logic
-1. **Business logic** - Data transformations, validations, or calculations
-1. **Reusable patterns** - Logic that appears in multiple components
-
-## Extraction Process
-
-### Step 1: Identify State Groups
-
-Look for state variables that are logically related:
-
-```typescript
-// ❌ These belong together - extract to hook
-const [modelConfig, setModelConfig] = useState<ModelConfig>(...)
-const [completionParams, setCompletionParams] = useState<FormValue>({})
-const [modelModeType, setModelModeType] = useState<ModelModeType>(...)
-
-// These are model-related state that should be in useModelConfig()
-```
-
-### Step 2: Identify Related Effects
-
-Find effects that modify the grouped state:
-
-```typescript
-// ❌ These effects belong with the state above
-useEffect(() => {
-  if (hasFetchedDetail && !modelModeType) {
-    const mode = currModel?.model_properties.mode
-    if (mode) {
-      const newModelConfig = produce(modelConfig, (draft) => {
-        draft.mode = mode
-      })
-      setModelConfig(newModelConfig)
-    }
-  }
-}, [textGenerationModelList, hasFetchedDetail, modelModeType, currModel])
-```
-
-### Step 3: Create the Hook
-
-```typescript
-// hooks/use-model-config.ts
-import type { FormValue } from '@/app/components/header/account-setting/model-provider-page/declarations'
-import type { ModelConfig } from '@/models/debug'
-import { produce } from 'immer'
-import { useEffect, useState } from 'react'
-import { ModelModeType } from '@/types/app'
-
-interface UseModelConfigParams {
-  initialConfig?: Partial<ModelConfig>
-  currModel?: { model_properties?: { mode?: ModelModeType } }
-  hasFetchedDetail: boolean
-}
-
-interface UseModelConfigReturn {
-  modelConfig: ModelConfig
-  setModelConfig: (config: ModelConfig) => void
-  completionParams: FormValue
-  setCompletionParams: (params: FormValue) => void
-  modelModeType: ModelModeType
-}
-
-export const useModelConfig = ({
-  initialConfig,
-  currModel,
-  hasFetchedDetail,
-}: UseModelConfigParams): UseModelConfigReturn => {
-  const [modelConfig, setModelConfig] = useState<ModelConfig>({
-    provider: 'langgenius/openai/openai',
-    model_id: 'gpt-3.5-turbo',
-    mode: ModelModeType.unset,
-    // ... default values
-    ...initialConfig,
-  })
-  
-  const [completionParams, setCompletionParams] = useState<FormValue>({})
-  
-  const modelModeType = modelConfig.mode
-
-  // Fill old app data missing model mode
-  useEffect(() => {
-    if (hasFetchedDetail && !modelModeType) {
-      const mode = currModel?.model_properties?.mode
-      if (mode) {
-        setModelConfig(produce(modelConfig, (draft) => {
-          draft.mode = mode
-        }))
-      }
-    }
-  }, [hasFetchedDetail, modelModeType, currModel])
-
-  return {
-    modelConfig,
-    setModelConfig,
-    completionParams,
-    setCompletionParams,
-    modelModeType,
-  }
-}
-```
-
-### Step 4: Update Component
-
-```typescript
-// Before: 50+ lines of state management
-function Configuration() {
-  const [modelConfig, setModelConfig] = useState<ModelConfig>(...)
-  // ... lots of related state and effects
-}
-
-// After: Clean component
-function Configuration() {
-  const {
-    modelConfig,
-    setModelConfig,
-    completionParams,
-    setCompletionParams,
-    modelModeType,
-  } = useModelConfig({
-    currModel,
-    hasFetchedDetail,
-  })
-  
-  // Component now focuses on UI
-}
-```
-
-## Naming Conventions
-
-### Hook Names
-
-- Use `use` prefix: `useModelConfig`, `useDatasetConfig`
-- Be specific: `useAdvancedPromptConfig` not `usePrompt`
-- Include domain: `useWorkflowVariables`, `useMCPServer`
-
-### File Names
-
-- Kebab-case: `use-model-config.ts`
-- Place in `hooks/` subdirectory when multiple hooks exist
-- Place alongside component for single-use hooks
-
-### Return Type Names
-
-- Suffix with `Return`: `UseModelConfigReturn`
-- Suffix params with `Params`: `UseModelConfigParams`
-
-## Common Hook Patterns in Dify
-
-### 1. Data Fetching / Mutation Hooks
-
-When hook extraction touches query or mutation code, do not use this reference as the source of truth for data-layer patterns.
-
-- Do not introduce deprecated `useInvalid` / `useReset`.
-- Do not extract thin passthrough `useQuery` hooks; only extract orchestration hooks.
-
-### 2. Form State Hook
-
-```typescript
-// Pattern: Form state + validation + submission
-export const useConfigForm = (initialValues: ConfigFormValues) => {
-  const [values, setValues] = useState(initialValues)
-  const [errors, setErrors] = useState<Record<string, string>>({})
-  const [isSubmitting, setIsSubmitting] = useState(false)
-
-  const validate = useCallback(() => {
-    const newErrors: Record<string, string> = {}
-    if (!values.name) newErrors.name = 'Name is required'
-    setErrors(newErrors)
-    return Object.keys(newErrors).length === 0
-  }, [values])
-
-  const handleChange = useCallback((field: string, value: any) => {
-    setValues(prev => ({ ...prev, [field]: value }))
-  }, [])
-
-  const handleSubmit = useCallback(async (onSubmit: (values: ConfigFormValues) => Promise<void>) => {
-    if (!validate()) return
-    setIsSubmitting(true)
-    try {
-      await onSubmit(values)
-    } finally {
-      setIsSubmitting(false)
-    }
-  }, [values, validate])
-
-  return { values, errors, isSubmitting, handleChange, handleSubmit }
-}
-```
-
-### 3. Modal State Hook
-
-```typescript
-// Pattern: Multiple modal management
-type ModalType = 'edit' | 'delete' | 'duplicate' | null
-
-export const useModalState = () => {
-  const [activeModal, setActiveModal] = useState<ModalType>(null)
-  const [modalData, setModalData] = useState<any>(null)
-
-  const openModal = useCallback((type: ModalType, data?: any) => {
-    setActiveModal(type)
-    setModalData(data)
-  }, [])
-
-  const closeModal = useCallback(() => {
-    setActiveModal(null)
-    setModalData(null)
-  }, [])
-
-  return {
-    activeModal,
-    modalData,
-    openModal,
-    closeModal,
-    isOpen: useCallback((type: ModalType) => activeModal === type, [activeModal]),
-  }
-}
-```
-
-### 4. Toggle/Boolean Hook
-
-```typescript
-// Pattern: Boolean state with convenience methods
-export const useToggle = (initialValue = false) => {
-  const [value, setValue] = useState(initialValue)
-
-  const toggle = useCallback(() => setValue(v => !v), [])
-  const setTrue = useCallback(() => setValue(true), [])
-  const setFalse = useCallback(() => setValue(false), [])
-
-  return [value, { toggle, setTrue, setFalse, set: setValue }] as const
-}
-
-// Usage
-const [isExpanded, { toggle, setTrue: expand, setFalse: collapse }] = useToggle()
-```
-
-## Testing Extracted Hooks
-
-After extraction, test hooks in isolation:
-
-```typescript
-// use-model-config.spec.ts
-import { renderHook, act } from '@testing-library/react'
-import { useModelConfig } from './use-model-config'
-
-describe('useModelConfig', () => {
-  it('should initialize with default values', () => {
-    const { result } = renderHook(() => useModelConfig({
-      hasFetchedDetail: false,
-    }))
-
-    expect(result.current.modelConfig.provider).toBe('langgenius/openai/openai')
-    expect(result.current.modelModeType).toBe(ModelModeType.unset)
-  })
-
-  it('should update model config', () => {
-    const { result } = renderHook(() => useModelConfig({
-      hasFetchedDetail: true,
-    }))
-
-    act(() => {
-      result.current.setModelConfig({
-        ...result.current.modelConfig,
-        model_id: 'gpt-4',
-      })
-    })
-
-    expect(result.current.modelConfig.model_id).toBe('gpt-4')
-  })
-})
-```
diff --git a/.agents/skills/how-to-write-component/SKILL.md b/.agents/skills/how-to-write-component/SKILL.md
index 55ad08941c4..738ec9de95a 100644
--- a/.agents/skills/how-to-write-component/SKILL.md
+++ b/.agents/skills/how-to-write-component/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: how-to-write-component
-description: React/TypeScript component style guide. Use when writing, refactoring, or reviewing React components, especially around props typing, state boundaries, shared local state with Jotai atoms, API types, query/mutation contracts, navigation, memoization, wrappers, and empty-state handling.
+description: React/TypeScript component style guide. Use when writing, refactoring, or reviewing React components, especially around abstraction choices, props typing, state boundaries, shared local state with Jotai atoms, API types, query/mutation contracts, navigation, memoization, wrappers, and empty-state handling.
 ---
 
 # How To Write A Component
@@ -12,26 +12,79 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 - Search before adding UI, hooks, helpers, or styling patterns. Reuse existing base components, feature components, hooks, utilities, and design styles when they fit.
 - Group code by feature workflow, route, or ownership area: components, hooks, local types, query helpers, atoms, constants, and small utilities should live near the code that changes with them.
 - Promote code to shared only when multiple verticals need the same stable primitive. Otherwise keep it local and compose shared primitives inside the owning feature.
+- Prefer local code and purpose-named helpers over catch-all utility modules; do not group workflow-specific defaults, validation, payload shaping, or metadata merging in a generic utils file just because they share a DTO.
+- Keep source/default selection, validation, and payload shaping close to the workflow that owns the behavior. Do not extract a shared helper just because two flows read the same DTO when their priority order, fallback behavior, or submit semantics differ.
+- Prefer direct, readable conditionals at the use site for small branch-specific decisions, especially form source selection and request payload assembly. Extract only when the helper name captures a stable domain rule and removes repeated complexity without hiding flow-specific behavior.
+- When fixing an invalid pattern, scan the touched feature or branch for equivalent patterns and fix them together.
 - Follow Dify's CSS-first Tailwind v4 contract from `packages/dify-ui/README.md` and `packages/dify-ui/AGENTS.md`. Prefer design-system tokens, utilities, and radius mappings over generic Tailwind guidance.
 
+## Feature Workflow Layout
+
+- State-heavy wizards, drawers, modals, and secondary workflows work best as a small feature surface with route/entry files, a single feature-local state file, and feature-local UI.
+- Keep `ui/` shallow with owner files that map to the workflow's real composition boundaries and major visual regions.
+- Owner files contain the section components, field components, skeletons, and one-off helper components that belong to their visual region.
+- Folders represent groups of related files with a shared owner and a stable reason to change together.
+- The entry file handles route integration, provider wiring, close behavior, and feature surface mounting. The composition owner handles high-level workflow branching, and the closest visual owner handles section branching.
+
 ## Ownership
 
 - Put local state, queries, mutations, handlers, and derived UI data in the lowest component that uses them. Extract a purpose-built owner component only when the logic has no natural home.
 - Repeated TanStack query calls in sibling components are acceptable when each component independently consumes the data. Do not hoist a query only because it is duplicated; TanStack Query handles deduplication and cache sharing.
 - Hoist state, queries, or callbacks to a parent only when the parent consumes the data, coordinates shared loading/error/empty UI, needs one consistent snapshot, or owns a workflow spanning children.
+- Pass stable domain identity across boundaries; avoid forwarding derived presentation state when the receiver can derive it from its own data source. A component that owns a visual surface should also own the data access, loading, empty, and error states for content rendered inside it unless a parent truly coordinates that state.
+- Loading states for visual surfaces should use skeleton placeholders scoped to the content that is actually loading, with shape, density, and dimensions close to the final UI. Avoid generic loading text or centered spinners for page sections, cards, lists, tables, forms, and drawers; reserve spinners for small inline busy indicators such as an in-progress status icon.
 - Avoid prop drilling. One pass-through layer is acceptable; repeated forwarding means ownership should move down or into feature-scoped Jotai UI state. Keep server/cache state in query and API data flow.
+- Do not replace prop drilling with one top-level hook that returns a large view model and then thread that object through section props. Move each hook, query, derived value, and handler to the concrete section that consumes it, or use feature-scoped Jotai atoms for simple shared form/UI state when siblings need the same source of truth.
+- When using feature-scoped Jotai state for a form, drawer, or other secondary surface, scope the store to that surface instance when stale cross-instance state is possible. Initialize stable config at the owning boundary, then let descendants read only the atoms or purpose-named hooks they actually need.
 - Keep callbacks in a parent only for workflow coordination such as form submission, shared selection, batch behavior, or navigation. Otherwise let the child or row own its action.
 - Prefer uncontrolled DOM state and CSS variables before adding controlled props.
 
+## Feature-Scoped Jotai State
+
+- A module's feature-local state lives in one state file for Jotai-backed features: primitive atoms, query atoms, derived atoms, write-only action atoms, mutation atoms, submission orchestration, provider exports, and optional scope configuration.
+- Atom order in the state file follows the dependency graph: types/constants, editable primitives, query atoms, query-data derived atoms, readiness/business derived atoms, write actions, mutation atoms, submission orchestration, provider exports.
+- Derived atom names read as business facts. Write atom names read as user or workflow commands.
+- UI components read and write the exact atom they use with `useAtomValue` or `useSetAtom`. Repeated workflow semantics live in named derived atoms or write atoms.
+- Non-query derived atoms return a narrow value with a clear domain name. Query atoms expose the TanStack Query result object so loading, error, fetch, and pagination state stay attached to the query contract.
+- Write-only atoms own state transitions that update multiple primitives, reset dependent state, guard stale async work, or advance the workflow.
+- `jotai-tanstack-query` atoms use the same QueryClient as the React Query provider. Query atoms belong in feature state when atoms are the feature's local state surface.
+- Jotai scope is an optional instance-isolation tool for secondary surfaces with independent local state. Query atoms keep shared cache behavior through the shared QueryClient.
+
 ## Components, Props, And Types
 
 - Type component signatures directly; do not use `FC` or `React.FC`.
 - Prefer `function` for top-level components and module helpers. Use arrow functions for local callbacks, handlers, and lambda-style APIs.
 - Prefer named exports. Use default exports only where the framework requires them, such as Next.js route files.
 - Type simple one-off props inline. Use a named `Props` type only when reused, exported, complex, or clearer.
-- Use API-generated or API-returned types at component boundaries. Keep small UI conversion helpers beside the component that needs them.
-- Name values by their domain role and backend API contract, and keep that name stable across the call chain, especially IDs like `appInstanceId`. Normalize framework or route params at the boundary.
-- Keep fallback and invariant checks at the lowest component that already handles that state; callers should pass raw values through instead of duplicating checks.
+- Use API-generated or API-returned types at component boundaries. Keep small UI conversion helpers and one-off UI extensions beside the component that needs them.
+- Do not create type aliases that only rename another type. Use an alias only when it encodes a real UI concept, refinement, or reusable local contract.
+- Name values by their domain role and backend API contract, and keep that name stable across the call chain, especially persistent IDs and route params. Normalize framework or route params at the boundary.
+- Keep fallback and invariant checks at the lowest component that already handles that state; avoid defensive fallbacks that mask impossible states.
+- Do not extract fallback helpers whose only behavior is hiding missing display data. The component that renders the surface owns the empty, disabled, hidden, or placeholder state.
+
+## Generated API Contracts
+
+- Treat generated contracts as authoritative at API, query, mutation, cache, and service boundaries. For enterprise APIs, use `packages/contracts/generated/enterprise/*`.
+- Do not hand-write local request/response/reply/page/cache-data types that mirror generated DTOs. Import or infer the generated type.
+- Do not widen generated fields or enums for compatibility. Normalize legacy input at the boundary, then return the generated field type.
+- Do not repair generated or API-returned contract fields in components unless the API contract or product requirement says they need normalization. Treat enums, statuses, and presence flags as exact contract values.
+- Use generated enum objects and union types directly in props, comparisons, status logic, and i18n keys. Do not add local enum constants or parallel frontend enum/status layers unless they model real product state not represented by the API. Presentation-only tone maps should be keyed by the generated enum.
+- Normalize or coerce only at a real boundary, such as user-entered forms, search, URL/query params, file names, DOM IDs, or legacy adapters. Preserve user-entered values when whitespace or formatting can be meaningful.
+- Do not coerce nullable or optional API strings to `''` in query, derived model, or payload-building code. Keep `undefined` or `null` until the final boundary that requires a string.
+- Local UI models are fine for presentation, form state, select options, or guarded required-field refinements. Name them as UI concepts, not generated DTO mirrors.
+- Required-value refinements are allowed only after same-branch filtering or early return. Prefer nullable-tolerant props for render-only data.
+- When a component needs a stricter shape than a generated DTO, refine once at the API/query-to-UI boundary into a purpose-named UI type instead of hiding missing fields with generic fallback or coercion helpers.
+
+## Nullable API Data
+
+- Prefer nullable-tolerant call boundaries. Pass API-returned types through for render-only rows, and let the component render fallback, disabled state, or nothing.
+- Narrow only where a real value is required, such as mutation params, route hrefs, select values, or query input. Build that target model with `flatMap`, a local loop, or an early return so the required value is captured in the same branch.
+- If design says a field is the display value, use that field. Only the final component should decide whether a nullable display value renders a placeholder, hides content, or disables an action.
+- Do not wrap required arrays or fields in null-fallback helpers. Use empty collection fallbacks only for not-yet-loaded query data or genuinely nullable collections at the owning render boundary.
+- Do not drop rows only to satisfy props or React keys; use a stable fallback key when possible.
+- Use conditional spreads or explicit pushes for conditional array items instead of `undefined` placeholders followed by a narrowing filter.
+- Avoid truthiness type guards, `filter(Boolean)`, `filter(item => item.id)`, and `!` after those filters.
+- Use type guards only for meaningful domain or runtime validation, such as enum membership, object shape, or a reusable business invariant.
 
 ## Queries And Mutations
 
@@ -39,7 +92,8 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 - Consume queries directly with `useQuery(consoleQuery.xxx.queryOptions(...))` or `useQuery(marketplaceQuery.xxx.queryOptions(...))`.
 - Avoid pass-through hooks and thin `web/service/use-*` wrappers that only rename `queryOptions()` or `mutationOptions()`. Extract a small `queryOptions` helper only when repeated call-site options justify it.
 - Keep feature hooks for real orchestration, workflow state, or shared domain behavior.
-- For missing required query input, use `input: skipToken`; use `enabled` only for extra business gating after the input is valid.
+- For TanStack cache data, use generated or query-derived types; do not create local wrappers for `getQueryData` or `getQueriesData`.
+- For generated oRPC `queryOptions()` / `infiniteOptions()`, do not pass `skipToken` as `input`; keep a valid placeholder input shape and use `enabled` to gate missing required params because the OpenAPI codec encodes input eagerly.
 - Consume mutations directly with `useMutation(consoleQuery.xxx.mutationOptions(...))` or `useMutation(marketplaceQuery.xxx.mutationOptions(...))`; use oRPC clients as `mutationFn` only for custom flows.
 - Put shared cache behavior in `createTanstackQueryUtils(...experimental_defaults...)`; components may add UI feedback callbacks, but should not own shared invalidation rules.
 - Do not use deprecated `useInvalid` or `useReset`.
@@ -48,12 +102,13 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 ## Component Boundaries
 
 - Use the first level below a page or tab to organize independent page sections when it adds real structure. This layer is layout/semantic first, not automatically the data owner.
+- Treat component names, semantic roles, and user- or design-marked visual regions as boundary constraints. Do not expand a child component's responsibility just because its data is useful nearby; keep adjacent UI as a sibling owner or introduce a correctly named broader owner.
 - Split deeper components by the data and state each layer actually needs. Each component should access only necessary data, and ownership should stay at the lowest consumer.
 - Keep cohesive forms, menu bodies, and one-off helpers local unless they need their own state, reuse, or semantic boundary.
 - Separate hidden secondary surfaces from the trigger's main flow. For dialogs, dropdowns, popovers, and similar branches, extract a small local component that owns the trigger, open state, and hidden content when it would obscure the parent flow.
 - Preserve composability by separating behavior ownership from layout ownership. A dropdown action may own its trigger, open state, and menu content; the caller owns placement such as slots, offsets, and alignment.
 - Avoid unnecessary DOM hierarchy. Do not add wrapper elements unless they provide layout, semantics, accessibility, state ownership, or integration with a library API; prefer fragments or styling an existing element when possible.
-- Avoid shallow wrappers and prop renaming unless the wrapper adds validation, orchestration, error handling, state ownership, or a real semantic boundary.
+- Avoid shallow wrappers, hook-to-props adapter components, layout-only render-prop wrappers, and prop renaming unless the wrapper adds validation, orchestration, error handling, state ownership, or a real semantic boundary. If a component only calls a hook and forwards every returned field to one child, move the hook into that child or make the wrapper own a real surface.
 
 ## You Might Not Need An Effect
 
@@ -68,4 +123,6 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 ## Navigation And Performance
 
 - Prefer `Link` for normal navigation. Use router APIs only for command-flow side effects such as mutation success, guarded redirects, or form submission.
+- Before reaching for `memo`, first try moving changing state down to the smallest component that actually uses it so unrelated sibling trees stay untouched.
+- If changing state must wrap other content, lift the unchanged content up and pass it as `children` so the stateful wrapper can update without React visiting that subtree.
 - Avoid `memo`, `useMemo`, and `useCallback` unless there is a clear performance reason.
diff --git a/.github/workflows/api-tests.yml b/.github/workflows/api-tests.yml
index bd57d973528..54226a3a839 100644
--- a/.github/workflows/api-tests.yml
+++ b/.github/workflows/api-tests.yml
@@ -29,13 +29,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -91,13 +91,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -142,13 +142,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           python-version: "3.12"
@@ -195,7 +195,7 @@ jobs:
 
       - name: Report coverage
         if: ${{ env.CODECOV_TOKEN != '' }}
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./coverage.xml
           disable_search: true
diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index 4aa39e86966..00dae047e04 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -20,7 +20,7 @@ jobs:
         run: echo "autofix.ci updates pull request branches, not merge group refs."
 
       - if: github.event_name != 'merge_group'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check Docker Compose inputs
         if: github.event_name != 'merge_group'
@@ -66,7 +66,7 @@ jobs:
           python-version: "3.11"
 
       - if: github.event_name != 'merge_group'
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Generate Docker Compose
         if: github.event_name != 'merge_group' && steps.docker-compose-changes.outputs.any_changed == 'true'
diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index d35a5ae178c..2ff4e8c2123 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -9,6 +9,7 @@ on:
       - "release/e-*"
       - "hotfix/**"
       - "feat/hitl-backend"
+      - "feat/rbac"
     tags:
       - "*"
 
@@ -21,6 +22,7 @@ env:
   DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
   DIFY_WEB_IMAGE_NAME: ${{ vars.DIFY_WEB_IMAGE_NAME || 'langgenius/dify-web' }}
   DIFY_API_IMAGE_NAME: ${{ vars.DIFY_API_IMAGE_NAME || 'langgenius/dify-api' }}
+  DIFY_AGENT_IMAGE_NAME: ${{ vars.DIFY_AGENT_IMAGE_NAME || 'langgenius/dify-agent-backend' }}
 
 jobs:
   build:
@@ -60,6 +62,20 @@ jobs:
             file: "web/Dockerfile"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
+          - service_name: "build-agent-amd64"
+            image_name_env: "DIFY_AGENT_IMAGE_NAME"
+            artifact_context: "agent"
+            build_context: "{{defaultContext}}"
+            file: "dify-agent/Dockerfile"
+            platform: linux/amd64
+            runs_on: depot-ubuntu-24.04-4
+          - service_name: "build-agent-arm64"
+            image_name_env: "DIFY_AGENT_IMAGE_NAME"
+            artifact_context: "agent"
+            build_context: "{{defaultContext}}"
+            file: "dify-agent/Dockerfile"
+            platform: linux/arm64
+            runs_on: depot-ubuntu-24.04-4
 
     steps:
       - name: Prepare
@@ -68,7 +84,7 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ env.DOCKERHUB_USER }}
           password: ${{ env.DOCKERHUB_TOKEN }}
@@ -78,13 +94,13 @@ jobs:
 
       - name: Extract metadata for Docker
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: ${{ env[matrix.image_name_env] }}
 
       - name: Build Docker image
         id: build
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: ${{ matrix.build_context }}
@@ -122,12 +138,15 @@ jobs:
           - service_name: "validate-web-amd64"
             build_context: "{{defaultContext}}"
             file: "web/Dockerfile"
+          - service_name: "validate-agent-amd64"
+            build_context: "{{defaultContext}}"
+            file: "dify-agent/Dockerfile"
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Validate Docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           push: false
           context: ${{ matrix.build_context }}
@@ -147,6 +166,9 @@ jobs:
           - service_name: "merge-web-images"
             image_name_env: "DIFY_WEB_IMAGE_NAME"
             context: "web"
+          - service_name: "merge-agent-images"
+            image_name_env: "DIFY_AGENT_IMAGE_NAME"
+            context: "agent"
     steps:
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -156,14 +178,14 @@ jobs:
           merge-multiple: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ env.DOCKERHUB_USER }}
           password: ${{ env.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata for Docker
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: ${{ env[matrix.image_name_env] }}
           tags: |
diff --git a/.github/workflows/cli-e2e.yml b/.github/workflows/cli-e2e.yml
index d7787c57334..636cc80c547 100644
--- a/.github/workflows/cli-e2e.yml
+++ b/.github/workflows/cli-e2e.yml
@@ -79,7 +79,7 @@ jobs:
       ws2_app_id:                 ${{ steps.out.outputs.DIFY_E2E_WS2_APP_ID }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -88,7 +88,7 @@ jobs:
         with:
           bun-version: latest
 
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           package_json_field: packageManager
           run_install: false
@@ -123,7 +123,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -131,7 +131,7 @@ jobs:
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
         with: { bun-version: latest }
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with: { package_json_field: packageManager, run_install: false }
       - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
@@ -170,7 +170,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -178,7 +178,7 @@ jobs:
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
         with: { bun-version: latest }
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with: { package_json_field: packageManager, run_install: false }
       - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
@@ -233,7 +233,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -241,7 +241,7 @@ jobs:
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
         with: { bun-version: latest }
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with: { package_json_field: packageManager, run_install: false }
       - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
@@ -274,7 +274,7 @@ jobs:
 
       - name: Upload results on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-run-${{ matrix.name }}-${{ github.run_id }}
           path: cli/test-results/
@@ -295,7 +295,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -303,7 +303,7 @@ jobs:
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
         with: { bun-version: latest }
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with: { package_json_field: packageManager, run_install: false }
       - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
@@ -351,7 +351,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -359,7 +359,7 @@ jobs:
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
         with: { bun-version: latest }
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with: { package_json_field: packageManager, run_install: false }
       - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
@@ -408,7 +408,7 @@ jobs:
 
       - name: Upload results on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-last-${{ github.run_id }}
           path: cli/test-results/
diff --git a/.github/workflows/cli-edge.yml b/.github/workflows/cli-edge.yml
index 159f3545e13..792c0328c54 100644
--- a/.github/workflows/cli-edge.yml
+++ b/.github/workflows/cli-edge.yml
@@ -23,7 +23,7 @@ jobs:
         working-directory: ./cli
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           fetch-depth: 0
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index 4d7de2dd2c8..a76cb234a5b 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -35,7 +35,7 @@ jobs:
       dify_tag: ${{ steps.resolve.outputs.dify_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -98,7 +98,7 @@ jobs:
       DIFY_TAG: ${{ needs.validate.outputs.dify_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           fetch-depth: 1
diff --git a/.github/workflows/cli-smoke.yml b/.github/workflows/cli-smoke.yml
index 045ff8e71a7..796b1b536cd 100644
--- a/.github/workflows/cli-smoke.yml
+++ b/.github/workflows/cli-smoke.yml
@@ -24,7 +24,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout cli ref
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
diff --git a/.github/workflows/cli-tests.yml b/.github/workflows/cli-tests.yml
index d27ab7db544..f46b662919f 100644
--- a/.github/workflows/cli-tests.yml
+++ b/.github/workflows/cli-tests.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -51,7 +51,7 @@ jobs:
 
       - name: Report coverage
         if: ${{ env.CODECOV_TOKEN != '' && matrix.os == 'depot-ubuntu-24.04' }}
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           directory: cli/coverage
           flags: cli
diff --git a/.github/workflows/db-migration-test.yml b/.github/workflows/db-migration-test.yml
index 9d3ccb34b2c..8a71903d99b 100644
--- a/.github/workflows/db-migration-test.yml
+++ b/.github/workflows/db-migration-test.yml
@@ -13,13 +13,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           python-version: "3.12"
@@ -40,7 +40,7 @@ jobs:
           cp envs/middleware.env.example middleware.env
 
       - name: Set up Middlewares
-        uses: hoverkraft-tech/compose-action@d2bee4f07e8ca410d6b196d00f90c12e7d48c33a # v2.6.0
+        uses: hoverkraft-tech/compose-action@11beaa1c2dae4e8ed7b1665aa074723b6cecb0e4 # v3.0.0
         with:
           compose-file: |
             docker/docker-compose.middleware.yaml
@@ -63,13 +63,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           python-version: "3.12"
@@ -94,7 +94,7 @@ jobs:
           sed -i 's/DB_USERNAME=postgres/DB_USERNAME=mysql/' middleware.env
 
       - name: Set up Middlewares
-        uses: hoverkraft-tech/compose-action@d2bee4f07e8ca410d6b196d00f90c12e7d48c33a # v2.6.0
+        uses: hoverkraft-tech/compose-action@11beaa1c2dae4e8ed7b1665aa074723b6cecb0e4 # v3.0.0
         with:
           compose-file: |
             docker/docker-compose.middleware.yaml
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 987edc37ef4..db38cdde716 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -53,7 +53,7 @@ jobs:
         uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1
 
       - name: Build Docker Image
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           push: false
@@ -77,10 +77,10 @@ jobs:
             file: "web/Dockerfile"
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build Docker Image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           push: false
           context: ${{ matrix.context }}
diff --git a/.github/workflows/hotfix-cherry-pick.yml b/.github/workflows/hotfix-cherry-pick.yml
index 594b10c7435..a1ff0c3bf91 100644
--- a/.github/workflows/hotfix-cherry-pick.yml
+++ b/.github/workflows/hotfix-cherry-pick.yml
@@ -24,7 +24,7 @@ jobs:
     name: Require cherry-pick provenance
     runs-on: depot-ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/main-ci.yml b/.github/workflows/main-ci.yml
index 34dda7fb149..69c540c54b4 100644
--- a/.github/workflows/main-ci.yml
+++ b/.github/workflows/main-ci.yml
@@ -48,7 +48,7 @@ jobs:
       vdb-changed: ${{ steps.changes.outputs.vdb }}
       migration-changed: ${{ steps.changes.outputs.migration }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
diff --git a/.github/workflows/pyrefly-diff.yml b/.github/workflows/pyrefly-diff.yml
index 386bd257514..cc40c1839c6 100644
--- a/.github/workflows/pyrefly-diff.yml
+++ b/.github/workflows/pyrefly-diff.yml
@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
diff --git a/.github/workflows/pyrefly-type-coverage-comment.yml b/.github/workflows/pyrefly-type-coverage-comment.yml
index 2fe9aa591de..abc14c693f5 100644
--- a/.github/workflows/pyrefly-type-coverage-comment.yml
+++ b/.github/workflows/pyrefly-type-coverage-comment.yml
@@ -21,10 +21,10 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.pull_requests[0].head.repo.full_name != github.repository }}
     steps:
       - name: Checkout default branch (trusted code)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
diff --git a/.github/workflows/pyrefly-type-coverage.yml b/.github/workflows/pyrefly-type-coverage.yml
index 915e406b571..be001a8d5e8 100644
--- a/.github/workflows/pyrefly-type-coverage.yml
+++ b/.github/workflows/pyrefly-type-coverage.yml
@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index b23648c7c61..e761feaefc1 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           days-before-issue-stale: 15
           days-before-issue-close: 3
diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
index e18607a60ea..e4c686adb31 100644
--- a/.github/workflows/style.yml
+++ b/.github/workflows/style.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -33,7 +33,7 @@ jobs:
 
       - name: Setup UV and Python
         if: steps.changed-files.outputs.any_changed == 'true'
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
           python-version: "3.12"
@@ -71,7 +71,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -114,7 +114,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -171,7 +171,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/tool-test-sdks.yaml b/.github/workflows/tool-test-sdks.yaml
index adaf99f33a5..d61f940bdbc 100644
--- a/.github/workflows/tool-test-sdks.yaml
+++ b/.github/workflows/tool-test-sdks.yaml
@@ -24,7 +24,7 @@ jobs:
         working-directory: sdks/nodejs-client
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/translate-i18n-claude.yml b/.github/workflows/translate-i18n-claude.yml
index be602cf87e5..de0725650a1 100644
--- a/.github/workflows/translate-i18n-claude.yml
+++ b/.github/workflows/translate-i18n-claude.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -158,7 +158,7 @@ jobs:
 
       - name: Run Claude Code for Translation Sync
         if: steps.context.outputs.CHANGED_FILES != ''
-        uses: anthropics/claude-code-action@1dc994ee7a008f0ecc866d9ac23ef036b7229f84 # v1.0.127
+        uses: anthropics/claude-code-action@806af32823ef69c8ef357086c573a902af641307 # v1.0.151
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/trigger-i18n-sync.yml b/.github/workflows/trigger-i18n-sync.yml
index 87c88e2023f..5b2264e8733 100644
--- a/.github/workflows/trigger-i18n-sync.yml
+++ b/.github/workflows/trigger-i18n-sync.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/vdb-tests-full.yml b/.github/workflows/vdb-tests-full.yml
index fbd073b6725..bef53100358 100644
--- a/.github/workflows/vdb-tests-full.yml
+++ b/.github/workflows/vdb-tests-full.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -36,7 +36,7 @@ jobs:
           remove_tool_cache: true
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
diff --git a/.github/workflows/vdb-tests.yml b/.github/workflows/vdb-tests.yml
index 972ab881727..bee195c2206 100644
--- a/.github/workflows/vdb-tests.yml
+++ b/.github/workflows/vdb-tests.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -33,7 +33,7 @@ jobs:
           remove_tool_cache: true
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
diff --git a/.github/workflows/web-e2e.yml b/.github/workflows/web-e2e.yml
index bdc24887dbe..2447e9033a3 100644
--- a/.github/workflows/web-e2e.yml
+++ b/.github/workflows/web-e2e.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -28,7 +28,7 @@ jobs:
         uses: ./.github/actions/setup-web
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           python-version: "3.12"
diff --git a/.github/workflows/web-tests.yml b/.github/workflows/web-tests.yml
index 56cf8d5fca4..5e95e231118 100644
--- a/.github/workflows/web-tests.yml
+++ b/.github/workflows/web-tests.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -64,7 +64,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -83,7 +83,7 @@ jobs:
 
       - name: Report coverage
         if: ${{ env.CODECOV_TOKEN != '' }}
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           directory: web/coverage
           flags: web
@@ -102,7 +102,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -117,7 +117,7 @@ jobs:
 
       - name: Report coverage
         if: ${{ env.CODECOV_TOKEN != '' }}
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           directory: packages/dify-ui/coverage
           flags: dify-ui
@@ -134,7 +134,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
diff --git a/api/clients/agent_backend/__init__.py b/api/clients/agent_backend/__init__.py
index 238c48a9de3..b9032c521eb 100644
--- a/api/clients/agent_backend/__init__.py
+++ b/api/clients/agent_backend/__init__.py
@@ -33,6 +33,7 @@ from clients.agent_backend.fake_client import FakeAgentBackendRunClient, FakeAge
 from clients.agent_backend.request_builder import (
     AGENT_SOUL_PROMPT_LAYER_ID,
     DIFY_EXECUTION_CONTEXT_LAYER_ID,
+    DIFY_KNOWLEDGE_BASE_LAYER_ID,
     DIFY_PLUGIN_TOOLS_LAYER_ID,
     WORKFLOW_NODE_JOB_PROMPT_LAYER_ID,
     WORKFLOW_USER_PROMPT_LAYER_ID,
@@ -47,6 +48,7 @@ from clients.agent_backend.request_builder import (
 __all__ = [
     "AGENT_SOUL_PROMPT_LAYER_ID",
     "DIFY_EXECUTION_CONTEXT_LAYER_ID",
+    "DIFY_KNOWLEDGE_BASE_LAYER_ID",
     "DIFY_PLUGIN_TOOLS_LAYER_ID",
     "WORKFLOW_NODE_JOB_PROMPT_LAYER_ID",
     "WORKFLOW_USER_PROMPT_LAYER_ID",
diff --git a/api/clients/agent_backend/request_builder.py b/api/clients/agent_backend/request_builder.py
index 55944929ddc..c245a09e970 100644
--- a/api/clients/agent_backend/request_builder.py
+++ b/api/clients/agent_backend/request_builder.py
@@ -32,6 +32,7 @@ from dify_agent.layers.execution_context import (
     DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID,
     DifyExecutionContextLayerConfig,
 )
+from dify_agent.layers.knowledge import DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID, DifyKnowledgeBaseLayerConfig
 from dify_agent.layers.output import DIFY_OUTPUT_LAYER_TYPE_ID, DifyOutputLayerConfig
 from dify_agent.layers.shell import DIFY_SHELL_LAYER_TYPE_ID, DifyShellLayerConfig
 from dify_agent.protocol import (
@@ -55,6 +56,7 @@ AGENT_APP_USER_PROMPT_LAYER_ID = "agent_app_user_prompt"
 DIFY_EXECUTION_CONTEXT_LAYER_ID = "execution_context"
 DIFY_DRIVE_LAYER_ID = "drive"
 DIFY_PLUGIN_TOOLS_LAYER_ID = "tools"
+DIFY_KNOWLEDGE_BASE_LAYER_ID = "knowledge"
 DIFY_ASK_HUMAN_LAYER_ID = "ask_human"
 DIFY_SHELL_LAYER_ID = "shell"
 
@@ -139,6 +141,7 @@ class AgentBackendWorkflowNodeRunInput(BaseModel):
     idempotency_key: str | None = None
     output: AgentBackendOutputConfig | None = None
     tools: DifyPluginToolsLayerConfig | None = None
+    knowledge: DifyKnowledgeBaseLayerConfig | None = None
     # Drive Skills & Files declaration (dify.drive) — an index the agent pulls
     # through the back proxy, never inline content; see AGENT_DRIVE_MANIFEST_ENABLED.
     drive_config: DifyDriveLayerConfig | None = None
@@ -185,6 +188,7 @@ class AgentBackendAgentAppRunInput(BaseModel):
     idempotency_key: str | None = None
     output: AgentBackendOutputConfig | None = None
     tools: DifyPluginToolsLayerConfig | None = None
+    knowledge: DifyKnowledgeBaseLayerConfig | None = None
     # Drive Skills & Files declaration (dify.drive) — an index the agent pulls
     # through the back proxy, never inline content; see AGENT_DRIVE_MANIFEST_ENABLED.
     drive_config: DifyDriveLayerConfig | None = None
@@ -221,7 +225,7 @@ class AgentBackendRunRequestBuilder:
 
         Layer graph: optional Agent Soul system prompt → user prompt →
         execution context → optional history (multi-turn) → LLM → optional
-        plugin tools → optional structured output. Mirrors the workflow-node
+        plugin tools / knowledge search → optional structured output. Mirrors the workflow-node
         layer ordering minus the workflow-job / previous-node prompt.
         """
         layers: list[RunLayerSpec] = []
@@ -300,6 +304,17 @@ class AgentBackendRunRequestBuilder:
                 )
             )
 
+        if run_input.knowledge is not None and run_input.knowledge.dataset_ids:
+            layers.append(
+                RunLayerSpec(
+                    name=DIFY_KNOWLEDGE_BASE_LAYER_ID,
+                    type=DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID,
+                    deps={"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID},
+                    metadata=run_input.metadata,
+                    config=run_input.knowledge,
+                )
+            )
+
         if run_input.ask_human_config is not None:
             # Human-in-the-loop ask_human deferred tool (dify.ask_human). A call ends
             # the run with a deferred_tool_call; the caller pauses (workflow HITL) and
@@ -398,7 +413,12 @@ class AgentBackendRunRequestBuilder:
         )
 
     def build_for_workflow_node(self, run_input: AgentBackendWorkflowNodeRunInput) -> CreateRunRequest:
-        """Build a workflow Agent Node run request without defining another wire schema."""
+        """Build a workflow Agent Node run request without defining another wire schema.
+
+        Layer graph mirrors the workflow surface: prompts → execution context →
+        optional drive/history → LLM → optional plugin tools / knowledge search
+        → optional auxiliary layers such as ask_human, shell, and structured output.
+        """
         layers: list[RunLayerSpec] = []
         if run_input.agent_soul_prompt:
             layers.append(
@@ -483,6 +503,17 @@ class AgentBackendRunRequestBuilder:
                 )
             )
 
+        if run_input.knowledge is not None and run_input.knowledge.dataset_ids:
+            layers.append(
+                RunLayerSpec(
+                    name=DIFY_KNOWLEDGE_BASE_LAYER_ID,
+                    type=DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID,
+                    deps={"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID},
+                    metadata=run_input.metadata,
+                    config=run_input.knowledge,
+                )
+            )
+
         if run_input.ask_human_config is not None:
             # Human-in-the-loop ask_human deferred tool (dify.ask_human). A call ends
             # the run with a deferred_tool_call; the caller pauses (workflow HITL) and
diff --git a/api/commands/__init__.py b/api/commands/__init__.py
index ea4c5aaa2a8..94321ed1e49 100644
--- a/api/commands/__init__.py
+++ b/api/commands/__init__.py
@@ -22,6 +22,7 @@ from .plugin import (
     setup_system_trigger_oauth_client,
     transform_datasource_credentials,
 )
+from .rbac import migrate_member_roles_to_rbac
 from .retention import (
     archive_workflow_runs,
     clean_expired_messages,
@@ -74,6 +75,7 @@ __all__ = [
     "migrate_annotation_vector_database",
     "migrate_data_for_plugin",
     "migrate_knowledge_vector_database",
+    "migrate_member_roles_to_rbac",
     "migrate_oss",
     "migration_data_wizard",
     "old_metadata_migration",
diff --git a/api/commands/rbac.py b/api/commands/rbac.py
new file mode 100644
index 00000000000..33eb5858da4
--- /dev/null
+++ b/api/commands/rbac.py
@@ -0,0 +1,112 @@
+from __future__ import annotations
+
+import click
+from sqlalchemy import select
+
+from core.db.session_factory import session_factory
+from models import TenantAccountJoin, TenantAccountRole
+from services.enterprise.rbac_service import ListOption, RBACService
+
+
+def _resolve_builtin_role_id(tenant_id: str, operator_account_id: str, legacy_role: str) -> str:
+    """Resolve a legacy workspace role to the current tenant's builtin RBAC role id.
+
+    The migration replays the old `TenantAccountJoin.role` values onto the
+    RBAC member-role binding API. Builtin RBAC roles are tenant-scoped and
+    identified by runtime ids, so the command must look them up per tenant.
+    """
+    expected_builtin_tag = {
+        TenantAccountRole.OWNER.value: "owner",
+        TenantAccountRole.ADMIN.value: "admin",
+        TenantAccountRole.EDITOR.value: "editor",
+        TenantAccountRole.NORMAL.value: "normal",
+        TenantAccountRole.DATASET_OPERATOR.value: "dataset_operator",
+    }.get(legacy_role)
+    if not expected_builtin_tag:
+        raise ValueError(f"Unsupported legacy workspace role: {legacy_role}")
+
+    roles = RBACService.Roles.list(
+        tenant_id=tenant_id,
+        account_id=operator_account_id,
+        options=ListOption(page_number=1, results_per_page=100),
+    ).data
+    for role in roles:
+        if role.is_builtin and role.category == "global_system_default" and role.role_tag == expected_builtin_tag:
+            return str(role.id)
+
+    raise ValueError(f"Builtin RBAC role not found for tenant={tenant_id}, legacy_role={legacy_role}")
+
+
+@click.command(
+    "rbac-migrate-member-roles", help="Migrate legacy workspace member roles into RBAC member-role bindings."
+)
+@click.option("--tenant-id", help="Only migrate a single workspace.")
+@click.option("--dry-run", is_flag=True, default=False, help="Preview the migration without writing RBAC bindings.")
+def migrate_member_roles_to_rbac(tenant_id: str | None, dry_run: bool) -> None:
+    """Backfill RBAC member-role bindings from legacy `TenantAccountJoin.role` data.
+
+    This is an offline migration command for workspaces that already have
+    members in the legacy role model but need matching records in the RBAC
+    member-role binding store.
+    """
+    click.echo(click.style("Starting RBAC member-role migration.", fg="green"))
+
+    with session_factory.create_session() as session:
+        stmt = select(TenantAccountJoin).order_by(TenantAccountJoin.tenant_id.asc(), TenantAccountJoin.id.asc())
+        if tenant_id:
+            stmt = stmt.where(TenantAccountJoin.tenant_id == tenant_id)
+
+        joins = list(session.scalars(stmt).all())
+
+    if not joins:
+        click.echo(click.style("No workspace members found for migration.", fg="yellow"))
+        return
+
+    owner_account_by_tenant: dict[str, str] = {}
+    resolved_role_ids: dict[tuple[str, str], str] = {}
+    migrated_count = 0
+
+    for join in joins:
+        workspace_id = str(join.tenant_id)
+        member_account_id = str(join.account_id)
+        legacy_role = str(join.role)
+
+        if workspace_id not in owner_account_by_tenant:
+            owner_join = next(
+                (
+                    item
+                    for item in joins
+                    if str(item.tenant_id) == workspace_id and str(item.role) == TenantAccountRole.OWNER.value
+                ),
+                None,
+            )
+            if not owner_join:
+                raise ValueError(f"Workspace owner not found for tenant={workspace_id}")
+            owner_account_by_tenant[workspace_id] = str(owner_join.account_id)
+
+        operator_account_id = owner_account_by_tenant[workspace_id]
+        cache_key = (workspace_id, legacy_role)
+        if cache_key not in resolved_role_ids:
+            resolved_role_ids[cache_key] = _resolve_builtin_role_id(workspace_id, operator_account_id, legacy_role)
+
+        resolved_role_id = resolved_role_ids[cache_key]
+        click.echo(
+            f"tenant={workspace_id} member={member_account_id} "
+            f"legacy_role={legacy_role} -> rbac_role_id={resolved_role_id}"
+        )
+
+        if dry_run:
+            continue
+
+        RBACService.MemberRoles.replace(
+            tenant_id=workspace_id,
+            account_id=operator_account_id,
+            member_account_id=member_account_id,
+            role_ids=[resolved_role_id],
+        )
+        migrated_count += 1
+
+    if dry_run:
+        click.echo(click.style("Dry run completed. No RBAC bindings were written.", fg="yellow"))
+    else:
+        click.echo(click.style(f"RBAC member-role migration completed. Migrated {migrated_count} members.", fg="green"))
diff --git a/api/configs/enterprise/__init__.py b/api/configs/enterprise/__init__.py
index 705ea67bcbc..2c0eaeeb81b 100644
--- a/api/configs/enterprise/__init__.py
+++ b/api/configs/enterprise/__init__.py
@@ -29,6 +29,11 @@ class EnterpriseFeatureConfig(BaseSettings):
         "This helps gain runtime performance by trading off consistency.",
     )
 
+    RBAC_ENABLED: bool = Field(
+        description="Enable enterprise RBAC APIs. When disabled, compatibility responses fall back to legacy roles.",
+        default=False,
+    )
+
 
 class EnterpriseTelemetryConfig(BaseSettings):
     """
diff --git a/api/controllers/common/controller_schemas.py b/api/controllers/common/controller_schemas.py
index 8eeed8f0a0a..d35fd9fe1b3 100644
--- a/api/controllers/common/controller_schemas.py
+++ b/api/controllers/common/controller_schemas.py
@@ -1,7 +1,8 @@
-from typing import Any, Literal
+from copy import deepcopy
+from typing import Annotated, Any, Literal, override
 from uuid import UUID
 
-from pydantic import BaseModel, Field, model_validator
+from pydantic import BaseModel, Field, GetJsonSchemaHandler, WithJsonSchema, model_validator
 
 from libs.helper import UUIDStrOrEmpty
 
@@ -9,8 +10,53 @@ from libs.helper import UUIDStrOrEmpty
 
 
 class ConversationRenamePayload(BaseModel):
-    name: str | None = None
-    auto_generate: bool = False
+    name: str | None = Field(
+        default=None,
+        description="Conversation name. Required when `auto_generate` is `false`.",
+    )
+    auto_generate: bool = Field(
+        default=False,
+        description="Automatically generate the conversation name. When `true`, the `name` field is ignored.",
+    )
+
+    @classmethod
+    @override
+    def __get_pydantic_json_schema__(cls, core_schema: Any, handler: GetJsonSchemaHandler) -> dict[str, Any]:
+        schema = handler.resolve_ref_schema(handler(core_schema))
+        properties = schema.get("properties")
+        if not isinstance(properties, dict):
+            return schema
+
+        auto_generate_schema = deepcopy(properties.get("auto_generate", {"type": "boolean"}))
+        name_schema = deepcopy(properties.get("name", {"type": "string"}))
+        non_blank_name_schema: dict[str, Any] = {"pattern": r".*\S.*", "type": "string"}
+        if isinstance(name_schema, dict) and isinstance(name_schema.get("title"), str):
+            non_blank_name_schema["title"] = name_schema["title"]
+
+        auto_generate_true_schema = {**auto_generate_schema, "enum": [True]}
+        auto_generate_true_schema.pop("default", None)
+
+        return {
+            **schema,
+            "anyOf": [
+                {
+                    "properties": {
+                        "auto_generate": auto_generate_true_schema,
+                        "name": name_schema,
+                    },
+                    "required": ["auto_generate"],
+                    "type": "object",
+                },
+                {
+                    "properties": {
+                        "auto_generate": {**auto_generate_schema, "enum": [False]},
+                        "name": non_blank_name_schema,
+                    },
+                    "required": ["name"],
+                    "type": "object",
+                },
+            ],
+        }
 
     @model_validator(mode="after")
     def validate_name_requirement(self):
@@ -24,14 +70,28 @@ class ConversationRenamePayload(BaseModel):
 
 
 class MessageListQuery(BaseModel):
-    conversation_id: UUIDStrOrEmpty = Field(description="Conversation UUID")
-    first_id: UUIDStrOrEmpty | None = Field(default=None, description="First message ID for pagination")
-    limit: int = Field(default=20, ge=1, le=100, description="Number of messages to return (1-100)")
+    conversation_id: UUIDStrOrEmpty = Field(description="Conversation ID.")
+    first_id: UUIDStrOrEmpty | None = Field(
+        default=None,
+        description=(
+            "The ID of the first chat record on the current page. Omit this value to fetch the latest messages; "
+            "for subsequent pages, use the first message ID from the current list to fetch older messages."
+        ),
+    )
+    limit: int = Field(
+        default=20,
+        ge=1,
+        le=100,
+        description="Number of chat history messages to return per request.",
+    )
 
 
 class MessageFeedbackPayload(BaseModel):
-    rating: Literal["like", "dislike"] | None = None
-    content: str | None = None
+    rating: Literal["like", "dislike"] | None = Field(
+        default=None,
+        description="Feedback rating. Set to `null` to revoke previously submitted feedback.",
+    )
+    content: str | None = Field(default=None, description="Optional text feedback providing additional detail.")
 
 
 # --- Saved message schemas ---
@@ -48,6 +108,39 @@ class SavedMessageCreatePayload(BaseModel):
 
 # --- Workflow schemas ---
 
+WORKFLOW_INPUT_FILE_ITEM_SCHEMA: dict[str, object] = {
+    "type": "object",
+    "required": ["type", "transfer_method"],
+    "properties": {
+        "type": {
+            "description": "File type.",
+            "enum": ["document", "image", "audio", "video", "custom"],
+            "type": "string",
+        },
+        "transfer_method": {
+            "description": "Transfer method: `remote_url` for file URL, `local_file` for uploaded file.",
+            "enum": ["remote_url", "local_file"],
+            "type": "string",
+        },
+        "url": {
+            "description": "File URL when `transfer_method` is `remote_url`.",
+            "format": "url",
+            "type": "string",
+        },
+        "upload_file_id": {
+            "description": (
+                "Uploaded file ID obtained from the [Upload File](/api-reference/files/upload-file) API when "
+                "`transfer_method` is `local_file`."
+            ),
+            "type": "string",
+        },
+    },
+}
+WORKFLOW_INPUT_FILE_LIST_SCHEMA: dict[str, object] = {
+    "anyOf": [{"items": WORKFLOW_INPUT_FILE_ITEM_SCHEMA, "type": "array"}, {"type": "null"}]
+}
+WorkflowInputFileList = Annotated[list[dict[str, Any]] | None, WithJsonSchema(WORKFLOW_INPUT_FILE_LIST_SCHEMA)]
+
 
 class DefaultBlockConfigQuery(BaseModel):
     q: str | None = None
@@ -61,8 +154,22 @@ class WorkflowListQuery(BaseModel):
 
 
 class WorkflowRunPayload(BaseModel):
-    inputs: dict[str, Any]
-    files: list[dict[str, Any]] | None = Field(default=None)
+    inputs: dict[str, Any] = Field(
+        description=(
+            "Key-value pairs for workflow input variables. Values for file-type variables should be arrays of "
+            "file objects with `type`, `transfer_method`, and either `url` or `upload_file_id`. Refer to the "
+            "`user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) "
+            "response to discover the variable names and types expected by your app."
+        )
+    )
+    files: WorkflowInputFileList = Field(
+        default=None,
+        description=(
+            "File list for workflow system file inputs. Available when file upload is enabled for the workflow. "
+            "To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use "
+            "the returned `id` as `upload_file_id` with `transfer_method: local_file`."
+        ),
+    )
 
 
 class WorkflowUpdatePayload(BaseModel):
@@ -77,28 +184,49 @@ DOCUMENT_BATCH_DOWNLOAD_ZIP_MAX_DOCS = 100
 
 
 class ChildChunkCreatePayload(BaseModel):
-    content: str
+    content: str = Field(description="Child chunk text content.")
 
 
 class ChildChunkUpdatePayload(BaseModel):
-    content: str
+    content: str = Field(description="Child chunk text content.")
 
 
 class DocumentBatchDownloadZipPayload(BaseModel):
     """Request payload for bulk downloading documents as a zip archive."""
 
-    document_ids: list[UUID] = Field(..., min_length=1, max_length=DOCUMENT_BATCH_DOWNLOAD_ZIP_MAX_DOCS)
+    document_ids: list[UUID] = Field(
+        ...,
+        min_length=1,
+        max_length=DOCUMENT_BATCH_DOWNLOAD_ZIP_MAX_DOCS,
+        description="List of document IDs to include in the ZIP download.",
+    )
 
 
 class MetadataUpdatePayload(BaseModel):
-    name: str
+    name: str = Field(description="New metadata field name.")
 
 
 # --- Audio schemas ---
 
 
+UUIDString = Annotated[str, WithJsonSchema({"format": "uuid", "type": "string"})]
+
+
 class TextToAudioPayload(BaseModel):
-    message_id: str | None = Field(default=None, description="Message ID")
-    voice: str | None = Field(default=None, description="Voice to use for TTS")
-    text: str | None = Field(default=None, description="Text to convert to audio")
-    streaming: bool | None = Field(default=None, description="Enable streaming response")
+    message_id: UUIDString | None = Field(
+        default=None,
+        description="Message ID. Takes priority over `text` when both are provided.",
+    )
+    voice: str | None = Field(
+        default=None,
+        description=(
+            "Voice to use for text-to-speech. Available voices depend on the TTS provider configured for this app. "
+            "Omit to use the app's configured voice when available; that value is exposed by "
+            "[Get App Parameters](/api-reference/applications/get-app-parameters) as `text_to_speech.voice`."
+        ),
+    )
+    text: str | None = Field(default=None, description="Speech content to convert.")
+    streaming: bool | None = Field(
+        default=None,
+        description="Reserved for compatibility; TTS response streaming is determined by the provider output.",
+    )
diff --git a/api/controllers/common/fields.py b/api/controllers/common/fields.py
index 06d68a5df16..6a0b35aa633 100644
--- a/api/controllers/common/fields.py
+++ b/api/controllers/common/fields.py
@@ -153,6 +153,7 @@ class ApiBaseUrlResponse(ResponseModel):
 
 class NewAppResponse(ResponseModel):
     new_app_id: str
+    permission_keys: list[str] = Field(default_factory=list)
 
 
 class Parameters(BaseModel):
diff --git a/api/controllers/common/human_input.py b/api/controllers/common/human_input.py
index d9b8f8f9a37..3bb2684df43 100644
--- a/api/controllers/common/human_input.py
+++ b/api/controllers/common/human_input.py
@@ -35,17 +35,23 @@ class HumanInputFormSubmitPayload(BaseModel):
         ),
         examples=[HUMAN_INPUT_FORM_INPUT_EXAMPLE],
     )
-    action: str
+    action: str = Field(
+        description=(
+            "ID of the action button the recipient selected. Must match one of the `id` values from the form's "
+            "`user_actions` list."
+        )
+    )
 
 
 def stringify_form_default_values(values: dict[str, object]) -> dict[str, str]:
     """Serialize default values into strings expected by human-input form clients."""
     result: dict[str, str] = {}
     for key, value in values.items():
-        if value is None:
-            result[key] = ""
-        elif isinstance(value, (dict, list)):
-            result[key] = json.dumps(value, ensure_ascii=False)
-        else:
-            result[key] = str(value)
+        match value:
+            case None:
+                result[key] = ""
+            case dict() | list():
+                result[key] = json.dumps(value, ensure_ascii=False)
+            case _:
+                result[key] = str(value)
     return result
diff --git a/api/controllers/common/wraps.py b/api/controllers/common/wraps.py
index c481f6eca94..7e39b4f37cd 100644
--- a/api/controllers/common/wraps.py
+++ b/api/controllers/common/wraps.py
@@ -1,7 +1,36 @@
+"""Shared decorator utilities for Dify controller layers.
+
+This module provides decorators that are not tied to any single API group (e.g.
+console, inner, service).  Currently it exposes the RBAC permission gate, which
+can be applied to any blueprint.
+
+Key exports
+-----------
+``rbac_permission_required`` – decorator that enforces enterprise RBAC access
+    control.  When ``RBAC_ENABLED`` is ``False`` it is a no-op.
+
+``RBACPermission``, ``RBACResourceScope`` – re-exported from ``core.rbac`` so
+    callers only need a single import site.
+
+Private helpers
+---------------
+``_extract_resource_id``, ``_is_resource_owned_by_current_user`` – kept module-
+    private but accessible via the module namespace for unit-test patching.
+"""
+
 from collections.abc import Callable
 from functools import wraps
 
+from sqlalchemy import select
+from werkzeug.exceptions import Forbidden, NotFound
+
+from configs import dify_config
 from core.rbac import RBACPermission, RBACResourceScope
+from extensions.ext_database import db
+from libs.login import current_account_with_tenant
+from models.dataset import Dataset
+from models.model import App
+from services.enterprise.rbac_service import RBACService
 
 __all__ = ["RBACPermission", "RBACResourceScope", "rbac_permission_required"]
 
@@ -14,17 +43,105 @@ def rbac_permission_required[**P, R](
 ) -> Callable[[Callable[P, R]], Callable[P, R]]:
     """Check enterprise RBAC permissions for the current user.
 
+    When ``RBAC_ENABLED`` is ``False`` the decorator is a no-op and the
+    request passes through unchanged. When enabled it extracts the resource ID
+    from ``request.view_args`` for resource-scoped checks, calls the RBAC
+    service ``check-access`` endpoint, and raises ``Forbidden`` if the access
+    is denied. For workspace-level checks, set ``resource_required=False`` so
+    the RBAC request omits ``resource_id``.
+
     Args:
         resource_type: The :class:`RBACResourceScope` member (app/dataset/workspace).
-        scene: The :class:`RBACPermission` permission point.
+        scene: The :class:`RBACPermission` permission point, e.g. ``RBACPermission.APP_DELETE``.
         resource_required: Whether a concrete resource ID is required.
     """
 
     def decorator(view: Callable[P, R]) -> Callable[P, R]:
         @wraps(view)
         def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
+            if not dify_config.RBAC_ENABLED:
+                return view(*args, **kwargs)
+
+            current_user, current_tenant_id = current_account_with_tenant()
+            check_resource_type = None if resource_type == RBACResourceScope.WORKSPACE else resource_type
+            resource_id = None
+            if resource_required and check_resource_type:
+                resource_id = _extract_resource_id(resource_type, kwargs)
+                if _is_resource_owned_by_current_user(current_tenant_id, current_user.id, resource_type, resource_id):
+                    return view(*args, **kwargs)
+            allowed = RBACService.CheckAccess.check(
+                current_tenant_id,
+                current_user.id,
+                scene=scene,
+                resource_type=check_resource_type,
+                resource_id=resource_id,
+            )
+
+            if not allowed:
+                raise Forbidden()
+
             return view(*args, **kwargs)
 
         return decorated
 
     return decorator
+
+
+def _is_resource_owned_by_current_user(
+    tenant_id: str, account_id: str, resource_type: RBACResourceScope, resource_id: str
+) -> bool:
+    if resource_type == RBACResourceScope.APP:
+        maintainer = db.session.scalar(
+            select(App.maintainer).where(
+                App.id == resource_id,
+                App.tenant_id == tenant_id,
+                App.status == "normal",
+            )
+        )
+        return maintainer == account_id
+
+    if resource_type == RBACResourceScope.DATASET:
+        maintainer = db.session.scalar(
+            select(Dataset.maintainer).where(
+                Dataset.id == resource_id,
+                Dataset.tenant_id == tenant_id,
+            )
+        )
+        return maintainer == account_id
+
+    return False
+
+
+def _extract_resource_id(resource_type: RBACResourceScope, path_args: dict[str, object] | None = None) -> str:
+    """Extract the resource ID from matched path arguments.
+
+    Some legacy route classes use neutral names such as ``resource_id`` for
+    app/dataset resources, and Agent App routes use ``agent_id`` as the app id.
+    Dataset endpoints behind a rag-pipeline route contain ``pipeline_id``
+    instead of ``dataset_id``. In that case we look up the associated
+    ``Dataset`` row via ``Dataset.pipeline_id``.
+    """
+    from flask import request
+
+    view_args = request.view_args or {}
+    matched_args = {**view_args, **(path_args or {})}
+
+    if resource_type == RBACResourceScope.APP:
+        app_id = matched_args.get("app_id") or matched_args.get("agent_id") or matched_args.get("resource_id")
+        if not app_id:
+            raise ValueError("Missing app_id in request path")
+        return str(app_id)
+
+    if resource_type == RBACResourceScope.DATASET:
+        dataset_id = matched_args.get("dataset_id") or matched_args.get("resource_id")
+        if dataset_id:
+            return str(dataset_id)
+
+        pipeline_id = matched_args.get("pipeline_id")
+        if pipeline_id:
+            dataset = db.session.scalar(select(Dataset).where(Dataset.pipeline_id == str(pipeline_id)))
+            if not dataset:
+                raise NotFound("Dataset not found for pipeline")
+            return str(dataset.id)
+        raise ValueError("Missing dataset_id or pipeline_id in request path")
+    raise ValueError(f"Unknown resource_type: {resource_type}")
diff --git a/api/controllers/console/__init__.py b/api/controllers/console/__init__.py
index e2bf0bd22ce..cd8d6e0ab46 100644
--- a/api/controllers/console/__init__.py
+++ b/api/controllers/console/__init__.py
@@ -139,6 +139,7 @@ from .workspace import (
     model_providers,
     models,
     plugin,
+    rbac,
     snippets,
     tool_providers,
     trigger_providers,
@@ -212,6 +213,7 @@ __all__ = [
     "rag_pipeline_draft_variable",
     "rag_pipeline_import",
     "rag_pipeline_workflow",
+    "rbac",
     "recommended_app",
     "saved_message",
     "setup",
diff --git a/api/controllers/console/agent/composer.py b/api/controllers/console/agent/composer.py
index 6915a54db93..2cd01e427f7 100644
--- a/api/controllers/console/agent/composer.py
+++ b/api/controllers/console/agent/composer.py
@@ -7,8 +7,11 @@ from controllers.console import console_ns
 from controllers.console.agent.app_helpers import resolve_agent_app_model
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user_id,
@@ -70,6 +73,7 @@ class WorkflowAgentComposerApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @get_app_model(mode=[AppMode.WORKFLOW, AppMode.ADVANCED_CHAT])
     @with_current_user_id
     @with_current_tenant_id
@@ -166,6 +170,7 @@ class WorkflowAgentComposerSaveToRosterApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @get_app_model(mode=[AppMode.WORKFLOW, AppMode.ADVANCED_CHAT])
     @with_current_user_id
     @with_current_tenant_id
@@ -203,6 +208,7 @@ class AgentComposerApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user_id
     @with_current_tenant_id
     def put(self, tenant_id: str, account_id: str, agent_id: UUID):
diff --git a/api/controllers/console/agent/roster.py b/api/controllers/console/agent/roster.py
index fc37845d63c..d4546ac88bf 100644
--- a/api/controllers/console/agent/roster.py
+++ b/api/controllers/console/agent/roster.py
@@ -1,21 +1,31 @@
 from uuid import UUID
 
-from flask import request
+from flask import abort, request
 from flask_restx import Resource
-from pydantic import BaseModel, Field
+from pydantic import AliasChoices, BaseModel, Field, field_validator
 
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
+from controllers.console.agent.app_helpers import resolve_agent_app_model
+from controllers.console.app.app import (
+    AppDetailWithSite as GenericAppDetailWithSite,
+)
 from controllers.console.app.app import (
-    AppDetailWithSite,
     AppListQuery,
-    AppPagination,
-    UpdateAppPayload,
+    CopyAppPayload,
     _normalize_app_list_query_args,
 )
+from controllers.console.app.app import (
+    AppPagination as GenericAppPagination,
+)
+from controllers.console.app.app import (
+    AppPartial as GenericAppPartial,
+)
+from controllers.console.app.app import (
+    UpdateAppPayload as GenericUpdateAppPayload,
+)
 from controllers.console.wraps import (
     account_initialization_required,
-    cloud_edition_billing_resource_check,
     edit_permission_required,
     enterprise_license_required,
     setup_required,
@@ -27,14 +37,24 @@ from fields.agent_fields import (
     AgentConfigSnapshotDetailResponse,
     AgentConfigSnapshotListResponse,
     AgentInviteOptionsResponse,
+    AgentLogListResponse,
+    AgentLogMessageListResponse,
+    AgentLogSourceListResponse,
     AgentPublishedReferenceResponse,
     AgentRosterListResponse,
+    AgentStatisticSummaryEnvelopeResponse,
 )
+from libs.datetime_utils import parse_time_range
 from libs.helper import dump_response
 from libs.login import login_required
 from models import Account
 from models.model import IconType
 from services.agent.errors import AgentNotFoundError
+from services.agent.observability_service import (
+    AgentLogQueryParams,
+    AgentObservabilityService,
+    AgentStatisticsQueryParams,
+)
 from services.agent.roster_service import AgentRosterService
 from services.app_service import AppListParams, AppService, CreateAppParams
 from services.enterprise.enterprise_service import EnterpriseService
@@ -53,35 +73,163 @@ class AgentIdPath(BaseModel):
 class AgentAppCreatePayload(BaseModel):
     name: str = Field(..., min_length=1, description="Agent name")
     description: str | None = Field(default=None, description="Agent description (max 400 chars)", max_length=400)
-    role: str = Field(default="", description="Agent role", max_length=255)
+    role: str = Field(..., min_length=1, description="Agent role", max_length=255)
     icon_type: IconType | None = Field(default=None, description="Icon type")
     icon: str | None = Field(default=None, description="Icon")
     icon_background: str | None = Field(default=None, description="Icon background color")
 
+    @field_validator("role")
+    @classmethod
+    def validate_role(cls, value: str) -> str:
+        role = value.strip()
+        if not role:
+            raise ValueError("Agent role is required.")
+        return role
 
-class AgentAppUpdatePayload(UpdateAppPayload):
-    role: str | None = Field(default=None, description="Agent role", max_length=255)
+
+# Keep agent-app roster DTOs agent-specific instead of reusing the shared
+# /apps response/request models. The roster surface needs Agent-only fields such
+# as `role`, while the generic console/apps contracts must stay unchanged.
+class AgentAppUpdatePayload(GenericUpdateAppPayload):
+    role: str = Field(..., min_length=1, description="Agent role", max_length=255)
+
+    @field_validator("role")
+    @classmethod
+    def validate_role(cls, value: str) -> str:
+        role = value.strip()
+        if not role:
+            raise ValueError("Agent role is required.")
+        return role
+
+
+class AgentAppPublishedReferenceResponse(BaseModel):
+    app_id: str
+    app_name: str
+    app_icon_type: str | None = None
+    app_icon: str | None = None
+    app_icon_background: str | None = None
+
+
+class AgentLogsQuery(BaseModel):
+    page: int = Field(default=1, ge=1, description="Page number")
+    limit: int = Field(default=20, ge=1, le=100, description="Page size")
+    keyword: str | None = Field(default=None, description="Search query, answer, or conversation name")
+    status: str | None = Field(default=None, description="Deprecated single status filter")
+    statuses: list[str] = Field(default_factory=list, description="Filter by one or more of success, failed, paused")
+    source: str | None = Field(
+        default=None,
+        description="Deprecated single source filter",
+    )
+    sources: list[str] = Field(
+        default_factory=list,
+        description=(
+            "Filter by one or more source IDs, e.g. webapp:<app_id> "
+            "or workflow:<app_id>:<workflow_id>:<version>:<node_id>"
+        ),
+    )
+    sort_by: str = Field(default="updated_at", description="Sort by created_at or updated_at")
+    sort_order: str = Field(default="desc", description="Sort order: asc or desc")
+    start: str | None = Field(default=None, description="Start date (YYYY-MM-DD HH:MM)")
+    end: str | None = Field(default=None, description="End date (YYYY-MM-DD HH:MM)")
+
+    @field_validator("keyword", "status", "source", "start", "end", mode="before")
+    @classmethod
+    def empty_string_to_none(cls, value: str | None) -> str | None:
+        if value == "":
+            return None
+        return value
+
+    @field_validator("statuses", "sources", mode="before")
+    @classmethod
+    def empty_list_values_to_list(cls, value: object) -> list[str]:
+        if value in (None, ""):
+            return []
+        if isinstance(value, str):
+            return [value]
+        if isinstance(value, list):
+            return [item for item in value if item]
+        return []
+
+    @field_validator("sort_by")
+    @classmethod
+    def validate_sort_by(cls, value: str) -> str:
+        normalized = value.strip().lower()
+        if normalized not in {"created_at", "updated_at"}:
+            raise ValueError("sort_by must be created_at or updated_at")
+        return normalized
+
+    @field_validator("sort_order")
+    @classmethod
+    def validate_sort_order(cls, value: str) -> str:
+        normalized = value.strip().lower()
+        if normalized not in {"asc", "desc"}:
+            raise ValueError("sort_order must be asc or desc")
+        return normalized
+
+
+class AgentStatisticsQuery(BaseModel):
+    source: str | None = Field(
+        default=None,
+        description="Filter by all, console/explore, api/service-api, web-app, debugger, openapi, or trigger",
+    )
+    start: str | None = Field(default=None, description="Start date (YYYY-MM-DD HH:MM)")
+    end: str | None = Field(default=None, description="End date (YYYY-MM-DD HH:MM)")
+
+    @field_validator("source", "start", "end", mode="before")
+    @classmethod
+    def empty_string_to_none(cls, value: str | None) -> str | None:
+        if value == "":
+            return None
+        return value
+
+
+class AgentAppPartial(GenericAppPartial):
+    app_id: str | None = None
+    role: str | None = None
+    active_config_is_published: bool = False
+    published_reference_count: int = 0
+    published_references: list[AgentAppPublishedReferenceResponse] = Field(default_factory=list)
+
+
+class AgentAppDetailWithSite(GenericAppDetailWithSite):
+    app_id: str | None = None
+    role: str | None = None
+    active_config_is_published: bool = False
+
+
+class AgentAppPagination(GenericAppPagination):
+    data: list[AgentAppPartial] = Field(  # type: ignore[assignment]  # pyrefly: ignore[bad-override-mutable-attribute]
+        validation_alias=AliasChoices("items", "data")
+    )
 
 
 register_schema_models(
     console_ns,
     AgentAppCreatePayload,
     AgentAppUpdatePayload,
+    CopyAppPayload,
     AgentInviteOptionsQuery,
+    AgentLogsQuery,
+    AgentStatisticsQuery,
     AgentIdPath,
     AppListQuery,
-    UpdateAppPayload,
     RosterListQuery,
 )
 register_response_schema_models(
     console_ns,
-    AppDetailWithSite,
-    AppPagination,
+    AgentAppPagination,
+    AgentAppPublishedReferenceResponse,
+    AgentAppDetailWithSite,
+    AgentAppPartial,
     AgentConfigSnapshotDetailResponse,
     AgentConfigSnapshotListResponse,
     AgentInviteOptionsResponse,
+    AgentLogListResponse,
+    AgentLogMessageListResponse,
+    AgentLogSourceListResponse,
     AgentPublishedReferenceResponse,
     AgentRosterListResponse,
+    AgentStatisticSummaryEnvelopeResponse,
 )
 
 
@@ -90,29 +238,60 @@ def _agent_roster_service() -> AgentRosterService:
 
 
 def _serialize_agent_app_detail(app_model) -> dict:
+    """Serialize an Agent App detail using roster-only DTOs.
+
+    `/agent` responses are roster-shaped rather than raw app-shaped: `id`
+    becomes the backing roster Agent id, `app_id` carries the underlying App
+    id, and `role` is injected from the backing roster Agent. Keeping that
+    remap in this serializer lets generated console/agent contracts expose the
+    roster persona fields without widening the shared /apps detail schema.
+    """
+
     app_model = AppService().get_app(app_model)
     if FeatureService.get_system_features().webapp_auth.enabled:
         app_setting = EnterpriseService.WebAppAuth.get_app_access_mode_by_id(app_id=str(app_model.id))
         app_model.access_mode = app_setting.access_mode  # type: ignore[attr-defined]
 
-    agent = _agent_roster_service().get_app_backing_agent(tenant_id=app_model.tenant_id, app_id=app_model.id)
+    roster_service = _agent_roster_service()
+    payload = AgentAppDetailWithSite.model_validate(app_model, from_attributes=True).model_dump(mode="json")
+    agent = roster_service.get_app_backing_agent(tenant_id=app_model.tenant_id, app_id=str(app_model.id))
     if not agent:
         raise AgentNotFoundError()
-    payload = AppDetailWithSite.model_validate(app_model, from_attributes=True).model_dump(mode="json")
     payload.pop("bound_agent_id", None)
     payload["app_id"] = str(app_model.id)
     payload["id"] = agent.id
     payload["role"] = agent.role or ""
+    payload["active_config_is_published"] = roster_service.active_config_is_published(
+        tenant_id=app_model.tenant_id,
+        agent=agent,
+    )
     return payload
 
 
 def _serialize_agent_app_pagination(app_pagination, *, tenant_id: str) -> dict:
+    """Serialize Agent App lists with roster-shaped items.
+
+    Each item starts from the shared App list shape, then drops
+    `bound_agent_id`, rewrites `id` to the backing roster Agent id, stores the
+    original App id in `app_id`, and injects roster-only `role` when a backing
+    Agent is present.
+    """
+
     app_ids = [str(app.id) for app in app_pagination.items]
-    agents_by_app_id = _agent_roster_service().load_app_backing_agents_by_app_id(
+    roster_service = _agent_roster_service()
+    agents_by_app_id = roster_service.load_app_backing_agents_by_app_id(
         tenant_id=tenant_id,
         app_ids=app_ids,
     )
-    payload = AppPagination.model_validate(app_pagination, from_attributes=True).model_dump(mode="json")
+    active_config_is_published_by_agent_id = roster_service.load_active_config_is_published_by_agent_id(
+        tenant_id=tenant_id,
+        agents=list(agents_by_app_id.values()),
+    )
+    published_references_by_agent_id = roster_service.load_published_references_by_agent_id(
+        tenant_id=tenant_id,
+        agent_ids=[agent.id for agent in agents_by_app_id.values()],
+    )
+    payload = AgentAppPagination.model_validate(app_pagination, from_attributes=True).model_dump(mode="json")
     for item in payload["data"]:
         app_id = item["id"]
         item.pop("bound_agent_id", None)
@@ -121,17 +300,57 @@ def _serialize_agent_app_pagination(app_pagination, *, tenant_id: str) -> dict:
             item["app_id"] = app_id
             item["id"] = agent.id
             item["role"] = agent.role or ""
-    return payload
+            item["active_config_is_published"] = active_config_is_published_by_agent_id.get(agent.id, False)
+            published_references = published_references_by_agent_id.get(agent.id, [])
+            item["published_reference_count"] = len(published_references)
+            item["published_references"] = [
+                {
+                    "app_id": reference["app_id"],
+                    "app_name": reference["app_name"],
+                    "app_icon_type": reference["app_icon_type"],
+                    "app_icon": reference["app_icon"],
+                    "app_icon_background": reference["app_icon_background"],
+                }
+                for reference in published_references
+            ]
+    return AgentAppPagination.model_validate(payload).model_dump(
+        mode="json",
+        exclude={"data": {"__all__": {"bound_agent_id"}}},
+    )
 
 
 def _resolve_agent_app_model(*, tenant_id: str, agent_id: UUID):
-    return _agent_roster_service().get_agent_app_model(tenant_id=tenant_id, agent_id=str(agent_id))
+    return resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+
+
+def _agent_observability_service() -> AgentObservabilityService:
+    return AgentObservabilityService(db.session)
+
+
+def _parse_observability_time_range(start: str | None, end: str | None, account: Account):
+    timezone = account.timezone or "UTC"
+    try:
+        return parse_time_range(start, end, timezone)
+    except ValueError as exc:
+        abort(400, description=str(exc))
+
+
+def _multi_query_values(name: str, legacy_name: str | None = None) -> list[str]:
+    values: list[str] = []
+    for query_name in (name, f"{name}[]"):
+        values.extend(request.args.getlist(query_name))
+    if legacy_name:
+        values.extend(request.args.getlist(legacy_name))
+    parsed: list[str] = []
+    for value in values:
+        parsed.extend(item.strip() for item in value.split(",") if item.strip())
+    return parsed
 
 
 @console_ns.route("/agent")
 class AgentAppListApi(Resource):
     @console_ns.doc(params=query_params_from_model(AppListQuery))
-    @console_ns.response(200, "Agent app list", console_ns.models[AppPagination.__name__])
+    @console_ns.response(200, "Agent app list", console_ns.models[AgentAppPagination.__name__])
     @setup_required
     @login_required
     @account_initialization_required
@@ -150,21 +369,20 @@ class AgentAppListApi(Resource):
             status="normal",
         )
 
-        app_pagination = AppService().get_paginate_apps(current_user.id, current_tenant_id, params)
+        app_pagination = AppService().get_paginate_apps(current_user.id, current_tenant_id, params, db.session)
         if app_pagination is None:
-            empty = AppPagination(page=args.page, limit=args.limit, total=0, has_more=False, data=[])
+            empty = AgentAppPagination(page=args.page, limit=args.limit, total=0, has_more=False, data=[])
             return empty.model_dump(mode="json")
 
         return _serialize_agent_app_pagination(app_pagination, tenant_id=current_tenant_id)
 
     @console_ns.expect(console_ns.models[AgentAppCreatePayload.__name__])
-    @console_ns.response(201, "Agent app created successfully", console_ns.models[AppDetailWithSite.__name__])
+    @console_ns.response(201, "Agent app created successfully", console_ns.models[AgentAppDetailWithSite.__name__])
     @console_ns.response(403, "Insufficient permissions")
     @console_ns.response(400, "Invalid request parameters")
     @setup_required
     @login_required
     @account_initialization_required
-    @cloud_edition_billing_resource_check("apps")
     @edit_permission_required
     @with_current_user
     @with_current_tenant_id
@@ -186,7 +404,7 @@ class AgentAppListApi(Resource):
 
 @console_ns.route("/agent/<uuid:agent_id>")
 class AgentAppApi(Resource):
-    @console_ns.response(200, "Agent app detail", console_ns.models[AppDetailWithSite.__name__])
+    @console_ns.response(200, "Agent app detail", console_ns.models[AgentAppDetailWithSite.__name__])
     @setup_required
     @login_required
     @account_initialization_required
@@ -197,7 +415,7 @@ class AgentAppApi(Resource):
         return _serialize_agent_app_detail(app_model)
 
     @console_ns.expect(console_ns.models[AgentAppUpdatePayload.__name__])
-    @console_ns.response(200, "Agent app updated successfully", console_ns.models[AppDetailWithSite.__name__])
+    @console_ns.response(200, "Agent app updated successfully", console_ns.models[AgentAppDetailWithSite.__name__])
     @console_ns.response(403, "Insufficient permissions")
     @console_ns.response(400, "Invalid request parameters")
     @setup_required
@@ -234,6 +452,33 @@ class AgentAppApi(Resource):
         return "", 204
 
 
+@console_ns.route("/agent/<uuid:agent_id>/copy")
+class AgentAppCopyApi(Resource):
+    @console_ns.expect(console_ns.models[CopyAppPayload.__name__])
+    @console_ns.response(201, "Agent app copied successfully", console_ns.models[AgentAppDetailWithSite.__name__])
+    @console_ns.response(403, "Insufficient permissions")
+    @console_ns.response(400, "Invalid request parameters")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, tenant_id: str, current_user: Account, agent_id: UUID):
+        args = CopyAppPayload.model_validate(console_ns.payload or {})
+        copied_app = _agent_roster_service().duplicate_agent_app(
+            tenant_id=tenant_id,
+            agent_id=str(agent_id),
+            account=current_user,
+            name=args.name,
+            description=args.description,
+            icon_type=args.icon_type,
+            icon=args.icon,
+            icon_background=args.icon_background,
+        )
+        return _serialize_agent_app_detail(copied_app), 201
+
+
 @console_ns.route("/agent/invite-options")
 class AgentInviteOptionsApi(Resource):
     @console_ns.doc(params=query_params_from_model(AgentInviteOptionsQuery))
@@ -256,6 +501,124 @@ class AgentInviteOptionsApi(Resource):
         )
 
 
+@console_ns.route("/agent/<uuid:agent_id>/logs")
+class AgentLogsApi(Resource):
+    @console_ns.doc(params=query_params_from_model(AgentLogsQuery))
+    @console_ns.response(200, "Agent logs", console_ns.models[AgentLogListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_user
+    @with_current_tenant_id
+    def get(self, tenant_id: str, current_user: Account, agent_id: UUID):
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        query_data: dict[str, object] = dict(request.args.to_dict(flat=True))
+        query_data["sources"] = _multi_query_values("sources", "source")
+        query_data["statuses"] = _multi_query_values("statuses", "status")
+        query = AgentLogsQuery.model_validate(query_data)
+        start, end = _parse_observability_time_range(query.start, query.end, current_user)
+        try:
+            payload = _agent_observability_service().list_logs(
+                app=app_model,
+                agent_id=str(agent_id),
+                params=AgentLogQueryParams(
+                    page=query.page,
+                    limit=query.limit,
+                    keyword=query.keyword,
+                    statuses=tuple(query.statuses),
+                    sources=tuple(query.sources),
+                    sort_by=query.sort_by,
+                    sort_order=query.sort_order,
+                    start=start,
+                    end=end,
+                ),
+            )
+        except ValueError as exc:
+            abort(400, description=str(exc))
+        return dump_response(AgentLogListResponse, payload)
+
+
+@console_ns.route("/agent/<uuid:agent_id>/logs/<uuid:conversation_id>/messages")
+class AgentLogMessagesApi(Resource):
+    @console_ns.doc(params=query_params_from_model(AgentLogsQuery))
+    @console_ns.response(200, "Agent log messages", console_ns.models[AgentLogMessageListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_user
+    @with_current_tenant_id
+    def get(self, tenant_id: str, current_user: Account, agent_id: UUID, conversation_id: UUID):
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        query_data: dict[str, object] = dict(request.args.to_dict(flat=True))
+        query_data["sources"] = _multi_query_values("sources", "source")
+        query_data["statuses"] = _multi_query_values("statuses", "status")
+        query = AgentLogsQuery.model_validate(query_data)
+        start, end = _parse_observability_time_range(query.start, query.end, current_user)
+        try:
+            payload = _agent_observability_service().list_log_messages(
+                app=app_model,
+                agent_id=str(agent_id),
+                conversation_id=str(conversation_id),
+                params=AgentLogQueryParams(
+                    page=query.page,
+                    limit=query.limit,
+                    keyword=query.keyword,
+                    statuses=tuple(query.statuses),
+                    sources=tuple(query.sources),
+                    sort_by=query.sort_by,
+                    sort_order=query.sort_order,
+                    start=start,
+                    end=end,
+                ),
+            )
+        except ValueError as exc:
+            abort(400, description=str(exc))
+        return dump_response(AgentLogMessageListResponse, payload)
+
+
+@console_ns.route("/agent/<uuid:agent_id>/log-sources")
+class AgentLogSourcesApi(Resource):
+    @console_ns.response(200, "Agent log sources", console_ns.models[AgentLogSourceListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_user
+    @with_current_tenant_id
+    def get(self, tenant_id: str, current_user: Account, agent_id: UUID):
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        payload = _agent_observability_service().list_log_sources(app=app_model, agent_id=str(agent_id))
+        return dump_response(AgentLogSourceListResponse, payload)
+
+
+@console_ns.route("/agent/<uuid:agent_id>/statistics/summary")
+class AgentStatisticsSummaryApi(Resource):
+    @console_ns.doc(params=query_params_from_model(AgentStatisticsQuery))
+    @console_ns.response(
+        200,
+        "Agent monitoring summary and chart data",
+        console_ns.models[AgentStatisticSummaryEnvelopeResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_user
+    @with_current_tenant_id
+    def get(self, tenant_id: str, current_user: Account, agent_id: UUID):
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        query = AgentStatisticsQuery.model_validate(request.args.to_dict(flat=True))
+        timezone = current_user.timezone or "UTC"
+        start, end = _parse_observability_time_range(query.start, query.end, current_user)
+        try:
+            payload = _agent_observability_service().get_statistics_summary(
+                app=app_model,
+                agent_id=str(agent_id),
+                params=AgentStatisticsQueryParams(source=query.source, start=start, end=end, timezone=timezone),
+            )
+        except ValueError as exc:
+            abort(400, description=str(exc))
+        return dump_response(AgentStatisticSummaryEnvelopeResponse, payload)
+
+
 @console_ns.route("/agent/<uuid:agent_id>/versions")
 class AgentRosterVersionsApi(Resource):
     @console_ns.response(200, "Agent versions", console_ns.models[AgentConfigSnapshotListResponse.__name__])
diff --git a/api/controllers/console/apikey.py b/api/controllers/console/apikey.py
index 57470dc9770..dcea303d7cc 100644
--- a/api/controllers/console/apikey.py
+++ b/api/controllers/console/apikey.py
@@ -9,6 +9,7 @@ from sqlalchemy import delete, func, select
 from sqlalchemy.orm import sessionmaker
 from werkzeug.exceptions import Forbidden
 
+from configs import dify_config
 from controllers.common.schema import register_response_schema_models
 from extensions.ext_database import db
 from fields.base import ResponseModel
@@ -22,8 +23,11 @@ from services.api_token_service import ApiTokenCache
 
 from . import console_ns
 from .wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -143,7 +147,7 @@ class BaseApiKeyResource(Resource):
         assert self.resource_id_field is not None, "resource_id_field must be set"
         _get_resource(resource_id, current_tenant_id, self.resource_model)
 
-        if not current_user.is_admin_or_owner:
+        if not dify_config.RBAC_ENABLED and not current_user.is_admin_or_owner:
             raise Forbidden()
 
         key = db.session.scalar(
@@ -186,6 +190,7 @@ class AppApiKeyListResource(BaseApiKeyListResource):
     @console_ns.response(400, "Maximum keys exceeded")
     @with_current_tenant_id
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     def post(self, current_tenant_id: str, resource_id: UUID) -> tuple[dict[str, object], int]:
         """Create a new API key for an app"""
         return dump_response(ApiKeyItem, self._create_api_key(str(resource_id), current_tenant_id)), 201
@@ -204,6 +209,7 @@ class AppApiKeyResource(BaseApiKeyResource):
     @console_ns.response(204, "API key deleted successfully")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     def delete(
         self, current_tenant_id: str, current_user: Account, resource_id: UUID, api_key_id: UUID
     ) -> tuple[str, int]:
@@ -234,6 +240,7 @@ class DatasetApiKeyListResource(BaseApiKeyListResource):
     @console_ns.response(400, "Maximum keys exceeded")
     @with_current_tenant_id
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_API_KEY_MANAGE)
     def post(self, current_tenant_id: str, resource_id: UUID) -> tuple[dict[str, object], int]:
         """Create a new API key for a dataset"""
         return dump_response(ApiKeyItem, self._create_api_key(str(resource_id), current_tenant_id)), 201
@@ -252,6 +259,7 @@ class DatasetApiKeyResource(BaseApiKeyResource):
     @console_ns.response(204, "API key deleted successfully")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_API_KEY_MANAGE)
     def delete(
         self, current_tenant_id: str, current_user: Account, resource_id: UUID, api_key_id: UUID
     ) -> tuple[str, int]:
diff --git a/api/controllers/console/app/agent.py b/api/controllers/console/app/agent.py
index 23ccd28ad6f..a53a174da42 100644
--- a/api/controllers/console/app/agent.py
+++ b/api/controllers/console/app/agent.py
@@ -17,7 +17,10 @@ from controllers.console import console_ns
 from controllers.console.agent.app_helpers import resolve_agent_app_model
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -30,7 +33,7 @@ from models import Account
 from models.agent_config_entities import AgentFileRefConfig, AgentSkillRefConfig
 from models.model import App, AppMode, UploadFile
 from services.agent.composer_service import AgentComposerService
-from services.agent.skill_package_service import SkillManifest, SkillPackageError, SkillPackageService
+from services.agent.skill_package_service import SkillManifest, SkillPackageError
 from services.agent.skill_standardize_service import SkillStandardizeService
 from services.agent.skill_tool_inference_service import (
     SkillToolInferenceError,
@@ -45,11 +48,18 @@ from services.agent_drive_service import (
     normalize_drive_key,
 )
 from services.agent_service import AgentService
-from services.file_service import FileService
 
 logger = logging.getLogger(__name__)
 
 _WORKFLOW_AGENT_DRIVE_APP_MODES = [AppMode.WORKFLOW, AppMode.ADVANCED_CHAT]
+_AGENT_SKILL_UPLOAD_PARAMS = {
+    "file": {
+        "in": "formData",
+        "type": "file",
+        "required": True,
+        "description": "Skill package (.zip or .skill).",
+    }
+}
 
 
 class AgentLogQuery(BaseModel):
@@ -125,11 +135,6 @@ class AgentSkillUploadResponse(ResponseModel):
     manifest: SkillManifest
 
 
-class AgentSkillStandardizeResponse(ResponseModel):
-    skill: AgentSkillRefConfig
-    manifest: SkillManifest
-
-
 class AgentDriveFileResponse(ResponseModel):
     name: str
     drive_key: str
@@ -156,7 +161,6 @@ register_response_schema_models(
     AgentDriveFileCommitResponse,
     AgentDriveFileResponse,
     AgentLogResponse,
-    AgentSkillStandardizeResponse,
     AgentSkillUploadResponse,
     SkillToolInferenceResult,
 )
@@ -174,30 +178,9 @@ def _agent_not_bound() -> tuple[dict[str, str], int]:
     return {"code": "agent_not_bound", "message": "no agent is bound for this app/node"}, 400
 
 
-def _upload_skill_for_app(*, current_user: Account):
-    if "file" not in request.files:
-        return {"code": "no_file", "message": "no skill file uploaded"}, 400
-    if len(request.files) > 1:
-        return {"code": "too_many_files", "message": "only one skill file is allowed"}, 400
+def _upload_skill_for_app(*, current_user: Account, app_model: App):
+    """Upload one skill package and commit its normalized files into the agent drive."""
 
-    upload = request.files["file"]
-    content = upload.stream.read()
-    try:
-        manifest = SkillPackageService().validate_and_extract(content=content, filename=upload.filename or "")
-    except SkillPackageError as exc:
-        return {"code": exc.code, "message": exc.message}, exc.status_code
-
-    upload_file = FileService(db.engine).upload_file(
-        filename=upload.filename or "skill.zip",
-        content=content,
-        mimetype=upload.mimetype or "application/zip",
-        user=current_user,
-    )
-    skill_ref = manifest.to_skill_ref(file_id=upload_file.id)
-    return {"skill": skill_ref.model_dump(exclude_none=True), "manifest": manifest.model_dump()}, 201
-
-
-def _standardize_skill_for_app(*, current_user: Account, app_model: App):
     query = query_params_from_request(AgentDriveMutationQuery)
     agent_id = _resolve_agent_id(app_model, query.node_id)
     if not agent_id:
@@ -371,6 +354,7 @@ class AgentLogApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.AGENT_CHAT])
     def get(self, app_model: App):
         """Get agent logs"""
@@ -382,51 +366,9 @@ class AgentLogApi(Resource):
 @console_ns.route("/agent/<uuid:agent_id>/skills/upload")
 class AgentSkillUploadByAgentApi(Resource):
     @console_ns.doc("upload_agent_skill_by_agent")
-    @console_ns.doc(description="Upload + validate a Skill package for an Agent App")
-    @console_ns.doc(params={"agent_id": "Agent ID"})
-    @console_ns.response(201, "Skill validated", console_ns.models[AgentSkillUploadResponse.__name__])
-    @console_ns.response(400, "Invalid skill package")
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @with_current_user
-    @with_current_tenant_id
-    def post(self, tenant_id: str, current_user: Account, agent_id: UUID):
-        resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
-        return _upload_skill_for_app(current_user=current_user)
-
-
-@console_ns.route("/apps/<uuid:app_id>/agent/skills/upload")
-class AgentSkillUploadApi(Resource):
-    @console_ns.doc("upload_agent_skill")
-    @console_ns.doc(description="Upload + validate a Skill package (.zip/.skill) and extract its manifest")
-    @console_ns.doc(params={"app_id": "Application ID"})
-    @console_ns.response(201, "Skill validated", console_ns.models[AgentSkillUploadResponse.__name__])
-    @console_ns.response(400, "Invalid skill package")
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @get_app_model(mode=_WORKFLOW_AGENT_DRIVE_APP_MODES)
-    @with_current_user
-    def post(self, current_user: Account, app_model: App):
-        """Validate an uploaded Skill package and persist the archive.
-
-        Returns a validated skill ref (to bind into the Agent soul config on save)
-        plus its manifest. Standardizing into the agent drive is ENG-594.
-        """
-        return _upload_skill_for_app(current_user=current_user)
-
-
-@console_ns.route("/agent/<uuid:agent_id>/skills/standardize")
-class AgentSkillStandardizeByAgentApi(Resource):
-    @console_ns.doc("standardize_agent_skill_by_agent")
-    @console_ns.doc(description="Validate + standardize a Skill into an Agent App drive")
-    @console_ns.doc(params={"agent_id": "Agent ID"})
-    @console_ns.response(
-        201,
-        "Skill standardized into drive",
-        console_ns.models[AgentSkillStandardizeResponse.__name__],
-    )
+    @console_ns.doc(description="Upload + standardize a Skill into an Agent App drive")
+    @console_ns.doc(consumes=["multipart/form-data"], params={"agent_id": "Agent ID", **_AGENT_SKILL_UPLOAD_PARAMS})
+    @console_ns.response(201, "Skill uploaded into drive", console_ns.models[AgentSkillUploadResponse.__name__])
     @console_ns.response(400, "Invalid skill package or no bound agent")
     @setup_required
     @login_required
@@ -435,19 +377,22 @@ class AgentSkillStandardizeByAgentApi(Resource):
     @with_current_tenant_id
     def post(self, tenant_id: str, current_user: Account, agent_id: UUID):
         app_model = resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
-        return _standardize_skill_for_app(current_user=current_user, app_model=app_model)
+        return _upload_skill_for_app(current_user=current_user, app_model=app_model)
 
 
-@console_ns.route("/apps/<uuid:app_id>/agent/skills/standardize")
-class AgentSkillStandardizeApi(Resource):
-    @console_ns.doc("standardize_agent_skill")
-    @console_ns.doc(description="Validate + standardize a Skill into the agent drive (ENG-594)")
-    @console_ns.doc(params={"app_id": "Application ID", **query_params_from_model(AgentDriveMutationQuery)})
-    @console_ns.response(
-        201,
-        "Skill standardized into drive",
-        console_ns.models[AgentSkillStandardizeResponse.__name__],
+@console_ns.route("/apps/<uuid:app_id>/agent/skills/upload")
+class AgentSkillUploadApi(Resource):
+    @console_ns.doc("upload_agent_skill")
+    @console_ns.doc(description="Upload + standardize a Skill into the agent drive")
+    @console_ns.doc(
+        consumes=["multipart/form-data"],
+        params={
+            "app_id": "Application ID",
+            **query_params_from_model(AgentDriveMutationQuery),
+            **_AGENT_SKILL_UPLOAD_PARAMS,
+        },
     )
+    @console_ns.response(201, "Skill uploaded into drive", console_ns.models[AgentSkillUploadResponse.__name__])
     @console_ns.response(400, "Invalid skill package or no bound agent")
     @setup_required
     @login_required
@@ -455,8 +400,8 @@ class AgentSkillStandardizeApi(Resource):
     @get_app_model(mode=_WORKFLOW_AGENT_DRIVE_APP_MODES)
     @with_current_user
     def post(self, current_user: Account, app_model: App):
-        """Upload a Skill, validate it, and standardize it into the app agent's drive."""
-        return _standardize_skill_for_app(current_user=current_user, app_model=app_model)
+        """Upload a Skill, validate it, and commit drive-backed skill files."""
+        return _upload_skill_for_app(current_user=current_user, app_model=app_model)
 
 
 @console_ns.route("/agent/<uuid:agent_id>/files")
diff --git a/api/controllers/console/app/agent_app_feature.py b/api/controllers/console/app/agent_app_feature.py
index 79d7589873c..d155dae6ac3 100644
--- a/api/controllers/console/app/agent_app_feature.py
+++ b/api/controllers/console/app/agent_app_feature.py
@@ -19,13 +19,17 @@ from controllers.common.schema import register_response_schema_models, register_
 from controllers.console import console_ns
 from controllers.console.agent.app_helpers import resolve_agent_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
 )
 from events.app_event import app_model_config_was_updated
+from extensions.ext_database import db
 from libs.helper import dump_response
 from libs.login import login_required
 from models import Account
@@ -78,6 +82,7 @@ class AgentAppFeatureConfigResource(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -86,9 +91,7 @@ class AgentAppFeatureConfigResource(Resource):
         args = AgentAppFeaturesPayload.model_validate(console_ns.payload or {})
 
         new_app_model_config = AgentAppFeatureConfigService.update_features(
-            app_model=app_model,
-            account=current_user,
-            config=args.model_dump(exclude_none=True),
+            app_model=app_model, account=current_user, config=args.model_dump(exclude_none=True), session=db.session
         )
 
         app_model_config_was_updated.send(app_model, app_model_config=new_app_model_config)
diff --git a/api/controllers/console/app/annotation.py b/api/controllers/console/app/annotation.py
index dd0b7e9ef5f..edf3a98af8c 100644
--- a/api/controllers/console/app/annotation.py
+++ b/api/controllers/console/app/annotation.py
@@ -9,11 +9,14 @@ from controllers.common.errors import NoFileUploadedError, TooManyFilesError
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     annotation_import_concurrency_limit,
     annotation_import_rate_limit,
     cloud_edition_billing_resource_check,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
 )
 from extensions.ext_redis import redis_client
@@ -155,6 +158,7 @@ class AnnotationReplyActionApi(Resource):
     @account_initialization_required
     @cloud_edition_billing_resource_check("annotation")
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     def post(self, app_id: UUID, action: Literal["enable", "disable"]):
         args = AnnotationReplyPayload.model_validate(console_ns.payload)
         match action:
@@ -185,6 +189,7 @@ class AppAnnotationSettingDetailApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, app_id: UUID):
         result = AppAnnotationService.get_app_annotation_setting_by_app_id(str(app_id))
         return result, 200
@@ -202,6 +207,7 @@ class AppAnnotationSettingUpdateApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     def post(self, app_id: UUID, annotation_setting_id: UUID):
         annotation_setting_id_str = str(annotation_setting_id)
 
@@ -230,6 +236,7 @@ class AnnotationReplyActionStatusApi(Resource):
     @account_initialization_required
     @cloud_edition_billing_resource_check("annotation")
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, app_id: UUID, job_id: UUID, action: str):
         job_id_str = str(job_id)
         app_annotation_job_key = f"{action}_app_annotation_job_{job_id_str}"
@@ -258,6 +265,7 @@ class AnnotationApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, app_id: UUID):
         args = AnnotationListQuery.model_validate(request.args.to_dict(flat=True))
         page = args.page
@@ -286,6 +294,7 @@ class AnnotationApi(Resource):
     @account_initialization_required
     @cloud_edition_billing_resource_check("annotation")
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     def post(self, app_id: UUID):
         args = CreateAnnotationPayload.model_validate(console_ns.payload)
         upsert_args: UpsertAnnotationArgs = {}
@@ -304,6 +313,7 @@ class AnnotationApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @console_ns.response(204, "Annotations deleted successfully")
     def delete(self, app_id: UUID):
 
@@ -342,6 +352,7 @@ class AnnotationExportApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, app_id: UUID):
         annotation_list = AppAnnotationService.export_annotation_list_by_app_id(str(app_id))
         annotation_models = TypeAdapter(list[Annotation]).validate_python(annotation_list, from_attributes=True)
@@ -369,6 +380,7 @@ class AnnotationUpdateDeleteApi(Resource):
     @account_initialization_required
     @cloud_edition_billing_resource_check("annotation")
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     def post(self, app_id: UUID, annotation_id: UUID):
         args = UpdateAnnotationPayload.model_validate(console_ns.payload)
         update_args: UpdateAnnotationArgs = {}
@@ -383,6 +395,7 @@ class AnnotationUpdateDeleteApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @console_ns.response(204, "Annotation deleted successfully")
     def delete(self, app_id: UUID, annotation_id: UUID):
         AppAnnotationService.delete_app_annotation(str(app_id), str(annotation_id))
@@ -410,6 +423,7 @@ class AnnotationBatchImportApi(Resource):
     @annotation_import_rate_limit
     @annotation_import_concurrency_limit
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     def post(self, app_id: UUID):
         from configs import dify_config
 
@@ -462,6 +476,7 @@ class AnnotationBatchImportStatusApi(Resource):
     @account_initialization_required
     @cloud_edition_billing_resource_check("annotation")
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, app_id: UUID, job_id: UUID):
         indexing_cache_key = f"app_annotation_batch_import_{str(job_id)}"
         cache_result = redis_client.get(indexing_cache_key)
@@ -492,6 +507,7 @@ class AnnotationHitHistoryListApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, app_id: UUID, annotation_id: UUID):
         page = request.args.get("page", default=1, type=int)
         limit = request.args.get("limit", default=20, type=int)
diff --git a/api/controllers/console/app/app.py b/api/controllers/console/app/app.py
index 5cd674e4eab..cd8d9ff3785 100644
--- a/api/controllers/console/app/app.py
+++ b/api/controllers/console/app/app.py
@@ -3,7 +3,7 @@ import re
 import uuid
 from collections.abc import Sequence
 from datetime import datetime
-from typing import Any, Literal, cast
+from typing import Any, Literal
 
 from flask import request
 from flask_restx import Resource
@@ -11,8 +11,9 @@ from pydantic import AliasChoices, BaseModel, Field, computed_field, field_valid
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 from werkzeug.datastructures import MultiDict
-from werkzeug.exceptions import BadRequest
+from werkzeug.exceptions import BadRequest, NotFound
 
+from configs import dify_config
 from controllers.common.fields import RedirectUrlResponse, SimpleResultResponse
 from controllers.common.helpers import FileInfo
 from controllers.common.schema import (
@@ -25,11 +26,14 @@ from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model, with_session
 from controllers.console.workspace.models import LoadBalancingPayload
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     cloud_edition_billing_resource_check,
     edit_permission_required,
     enterprise_license_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -48,6 +52,7 @@ from models import Account, App, DatasetPermissionEnum, Workflow
 from models.model import IconType
 from services.app_dsl_service import AppDslService
 from services.app_service import AppListParams, AppListSortBy, AppService, CreateAppParams, StarredAppListParams
+from services.enterprise import rbac_service as enterprise_rbac_service
 from services.enterprise.enterprise_service import EnterpriseService
 from services.entities.dsl_entities import ImportMode, ImportStatus
 from services.entities.knowledge_entities.knowledge_entities import (
@@ -72,12 +77,14 @@ _logger = logging.getLogger(__name__)
 _TAG_IDS_BRACKET_PATTERN = re.compile(r"^tag_ids\[(\d+)\]$")
 _CREATOR_IDS_BRACKET_PATTERN = re.compile(r"^creator_ids\[(\d+)\]$")
 AppListMode = Literal["completion", "chat", "advanced-chat", "workflow", "agent-chat", "agent", "channel", "all"]
+DEFAULT_APP_LIST_MODE: AppListMode = "all"
+APP_LIST_PERMISSION_KEYS = frozenset({"app.preview", "app.acl.preview", "app.full_access"})
 
 
 class AppListBaseQuery(BaseModel):
     page: int = Field(default=1, ge=1, le=99999, description="Page number (1-99999)")
     limit: int = Field(default=20, ge=1, le=100, description="Page size (1-100)")
-    mode: AppListMode = Field(default=cast(AppListMode, "all"), description="App mode filter")
+    mode: AppListMode = Field(default=DEFAULT_APP_LIST_MODE, description="App mode filter")
     sort_by: AppListSortBy = Field(
         default="last_modified",
         description="Sort apps by last modified, recently created, or earliest created",
@@ -160,6 +167,10 @@ def _normalize_app_list_query_args(query_args: MultiDict[str, str]) -> dict[str,
     return normalized
 
 
+def _has_app_list_permission(permission_keys: Sequence[str]) -> bool:
+    return any(permission_key in APP_LIST_PERMISSION_KEYS for permission_key in permission_keys)
+
+
 class CreateAppPayload(BaseModel):
     name: str = Field(..., min_length=1, description="App name")
     description: str | None = Field(default=None, description="App description (max 400 chars)", max_length=400)
@@ -398,12 +409,13 @@ class AppPartial(ResponseModel):
     create_user_name: str | None = None
     author_name: str | None = None
     has_draft_trigger: bool | None = None
+    permission_keys: list[str] = Field(default_factory=list)
     # For Agent App type: the roster Agent backing this app (None otherwise).
     bound_agent_id: str | None = None
     # For Agent App responses exposed through /agent.
     app_id: str | None = None
-    role: str | None = None
     is_starred: bool = False
+    maintainer: str | None = None
 
     @computed_field(return_type=str | None)  # type: ignore
     @property
@@ -439,6 +451,8 @@ class AppDetail(ResponseModel):
     updated_at: int | None = None
     access_mode: str | None = None
     tags: list[Tag] = Field(default_factory=list)
+    permission_keys: list[str] = Field(default_factory=list)
+    maintainer: str | None = None
 
     @field_validator("created_at", "updated_at", mode="before")
     @classmethod
@@ -456,7 +470,6 @@ class AppDetailWithSite(AppDetail):
     bound_agent_id: str | None = None
     # For Agent App responses exposed through /agent.
     app_id: str | None = None
-    role: str | None = None
 
     @computed_field(return_type=str | None)  # type: ignore
     @property
@@ -539,10 +552,7 @@ register_schema_models(
     ModelConfig,
     Site,
     DeletedTool,
-    AppPartial,
     AppDetail,
-    AppDetailWithSite,
-    AppPagination,
     AppExportResponse,
     Segmentation,
     PreProcessingRule,
@@ -562,6 +572,13 @@ register_schema_models(
     LoadBalancingPayload,
 )
 
+register_response_schema_models(
+    console_ns,
+    AppPartial,
+    AppDetailWithSite,
+    AppPagination,
+)
+
 
 @console_ns.route("/apps")
 class AppListApi(Resource):
@@ -590,16 +607,65 @@ class AppListApi(Resource):
             is_created_by_me=args.is_created_by_me,
         )
 
+        permissions = enterprise_rbac_service.RBACService.MyPermissions.get(
+            str(current_tenant_id),
+            current_user_id,
+        )
+        if dify_config.RBAC_ENABLED:
+            whitelist_scope = enterprise_rbac_service.RBACService.AppAccess.whitelist_resources(
+                str(current_tenant_id),
+                current_user_id,
+            )
+            can_manage_own_apps = "app.create_and_management" in permissions.workspace.permission_keys
+            has_default_preview = _has_app_list_permission(
+                permissions.app.default_permission_keys
+            ) or _has_app_list_permission(permissions.workspace.permission_keys)
+            permission_app_ids: set[str] | None = None
+            if not has_default_preview:
+                permission_app_ids = {
+                    override.resource_id
+                    for override in permissions.app.overrides
+                    if _has_app_list_permission(override.permission_keys)
+                }
+
+            if getattr(whitelist_scope, "unrestricted", False):
+                accessible_app_ids = permission_app_ids
+            else:
+                accessible_app_ids = set(whitelist_scope.resource_ids)
+                if permission_app_ids is not None:
+                    accessible_app_ids |= permission_app_ids
+                elif has_default_preview:
+                    accessible_app_ids = None
+
+            if accessible_app_ids:
+                params.accessible_app_ids = sorted(accessible_app_ids)
+                params.include_own_apps = can_manage_own_apps
+            elif accessible_app_ids is not None and can_manage_own_apps:
+                params.is_created_by_me = True
+            elif accessible_app_ids is not None:
+                params.accessible_app_ids = []
+
         # get app list
         app_service = AppService()
-        app_pagination = app_service.get_paginate_apps(current_user_id, current_tenant_id, params)
+        app_pagination = app_service.get_paginate_apps(current_user_id, current_tenant_id, params, db.session)
         if not app_pagination:
             empty = AppPagination(page=args.page, limit=args.limit, total=0, has_more=False, data=[])
             return empty.model_dump(mode="json"), 200
 
+        app_ids = [str(app.id) for app in app_pagination.items]
+        permission_keys_map = permissions.app.permission_keys_by_resource_ids(app_ids)
         _enrich_app_list_items(session, apps=app_pagination.items, tenant_id=current_tenant_id)
 
         pagination_model = AppPagination.model_validate(app_pagination, from_attributes=True)
+        if app_pagination.items:
+            pagination_model = pagination_model.model_copy(
+                update={
+                    "data": [
+                        item.model_copy(update={"permission_keys": permission_keys_map.get(str(item.id), [])})
+                        for item in pagination_model.data
+                    ]
+                }
+            )
         return pagination_model.model_dump(mode="json"), 200
 
     @console_ns.doc("create_app")
@@ -611,6 +677,7 @@ class AppListApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT, resource_required=False)
     @cloud_edition_billing_resource_check("apps")
     @edit_permission_required
     @with_current_user
@@ -629,7 +696,14 @@ class AppListApi(Resource):
 
         app_service = AppService()
         app = app_service.create_app(current_tenant_id, params, current_user)
-        app_detail = AppDetailWithSite.model_validate(app, from_attributes=True)
+        permission_keys_map = enterprise_rbac_service.RBACService.AppPermissions.batch_get(
+            str(current_tenant_id),
+            current_user.id,
+            [str(app.id)],
+        )
+        app_detail = AppDetailWithSite.model_validate(app, from_attributes=True).model_copy(
+            update={"permission_keys": permission_keys_map.get(str(app.id), [])}
+        )
         return app_detail.model_dump(mode="json"), 201
 
 
@@ -659,7 +733,7 @@ class StarredAppListApi(Resource):
             is_created_by_me=args.is_created_by_me,
         )
 
-        app_pagination = AppService().get_paginate_starred_apps(current_user_id, current_tenant_id, params)
+        app_pagination = AppService().get_paginate_starred_apps(current_user_id, current_tenant_id, params, db.session)
         if not app_pagination:
             empty = AppPagination(page=args.page, limit=args.limit, total=0, has_more=False, data=[])
             return empty.model_dump(mode="json"), 200
@@ -715,8 +789,11 @@ class AppApi(Resource):
     @login_required
     @account_initialization_required
     @enterprise_license_required
+    @with_current_user
+    @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=None)
-    def get(self, app_model: App):
+    def get(self, current_tenant_id: str, current_user: Account, app_model: App):
         """Get app detail"""
         app_service = AppService()
 
@@ -726,7 +803,16 @@ class AppApi(Resource):
             app_setting = EnterpriseService.WebAppAuth.get_app_access_mode_by_id(app_id=str(app_model.id))
             app_model.access_mode = app_setting.access_mode
 
-        response_model = AppDetailWithSite.model_validate(app_model, from_attributes=True)
+        permissions = enterprise_rbac_service.RBACService.MyPermissions.get(
+            str(current_tenant_id),
+            current_user.id,
+            app_id=str(app_model.id),
+        )
+        permission_keys_map = permissions.app.permission_keys_by_resource_ids([str(app_model.id)])
+
+        response_model = AppDetailWithSite.model_validate(app_model, from_attributes=True).model_copy(
+            update={"permission_keys": permission_keys_map.get(str(app_model.id), [])}
+        )
         return response_model.model_dump(mode="json")
 
     @console_ns.doc("update_app")
@@ -739,8 +825,9 @@ class AppApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=None)
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @get_app_model(mode=None)
     def put(self, app_model: App):
         """Update app"""
         args = UpdateAppPayload.model_validate(console_ns.payload)
@@ -765,11 +852,12 @@ class AppApi(Resource):
     @console_ns.doc(params={"app_id": "Application ID"})
     @console_ns.response(204, "App deleted successfully")
     @console_ns.response(403, "Insufficient permissions")
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_DELETE)
+    @get_app_model
     def delete(self, app_model: App):
         """Delete app"""
         app_service = AppService()
@@ -789,10 +877,12 @@ class AppCopyApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=None)
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @with_current_user
-    def post(self, current_user: Account, app_model: App):
+    @with_current_tenant_id
+    @get_app_model(mode=None)
+    def post(self, current_tenant_id: str, current_user: Account, app_model: App):
         """Copy app"""
         # The role of the current user in the ta table must be admin, owner, or editor
         args = CopyAppPayload.model_validate(console_ns.payload or {})
@@ -834,7 +924,17 @@ class AppCopyApi(Resource):
             stmt = select(App).where(App.id == result.app_id)
             app = session.scalar(stmt)
 
-        response_model = AppDetailWithSite.model_validate(app, from_attributes=True)
+        if not app:
+            raise NotFound("App not found")
+
+        permission_keys_map = enterprise_rbac_service.RBACService.AppPermissions.batch_get(
+            str(current_tenant_id),
+            current_user.id,
+            [str(app.id)],
+        )
+        response_model = AppDetailWithSite.model_validate(app, from_attributes=True).model_copy(
+            update={"permission_keys": permission_keys_map.get(str(app.id), [])}
+        )
         return response_model.model_dump(mode="json"), 201
 
 
@@ -846,11 +946,12 @@ class AppExportApi(Resource):
     @console_ns.doc(params=query_params_from_model(AppExportQuery))
     @console_ns.response(200, "App exported successfully", console_ns.models[AppExportResponse.__name__])
     @console_ns.response(403, "Insufficient permissions")
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_IMPORT_EXPORT_DSL)
+    @get_app_model
     def get(self, app_model: App):
         """Export app"""
         args = AppExportQuery.model_validate(request.args.to_dict(flat=True))
@@ -871,12 +972,12 @@ class AppPublishToCreatorsPlatformApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=None)
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_IMPORT_EXPORT_DSL)
     @with_current_user_id
+    @get_app_model(mode=None)
     def post(self, current_user_id: str, app_model: App):
         """Publish app to Creators Platform"""
-        from configs import dify_config
         from core.helper.creators import get_redirect_url, upload_dsl
 
         if not dify_config.CREATORS_PLATFORM_FEATURES_ENABLED:
@@ -901,8 +1002,9 @@ class AppNameApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=None)
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @get_app_model(mode=None)
     def post(self, app_model: App):
         args = AppNamePayload.model_validate(console_ns.payload)
 
@@ -923,8 +1025,9 @@ class AppIconApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=None)
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @get_app_model(mode=None)
     def post(self, app_model: App):
         args = AppIconPayload.model_validate(console_ns.payload or {})
 
@@ -950,8 +1053,9 @@ class AppSiteStatus(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=None)
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    @get_app_model(mode=None)
     def post(self, app_model: App):
         args = AppSiteStatusPayload.model_validate(console_ns.payload)
 
@@ -973,6 +1077,7 @@ class AppApiStatus(Resource):
     @login_required
     @is_admin_or_owner_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     @get_app_model(mode=None)
     def post(self, app_model: App):
         args = AppApiStatusPayload.model_validate(console_ns.payload)
@@ -997,6 +1102,7 @@ class AppTraceApi(Resource):
     @login_required
     @account_initialization_required
     @with_session
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model
     def get(self, session: Session, app_model: App):
         """Get app trace"""
@@ -1018,6 +1124,7 @@ class AppTraceApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
     @get_app_model
     def post(self, app_model: App):
         # add app trace
diff --git a/api/controllers/console/app/app_import.py b/api/controllers/console/app/app_import.py
index cbdcdc8f10b..d58c5df1e96 100644
--- a/api/controllers/console/app/app_import.py
+++ b/api/controllers/console/app/app_import.py
@@ -2,25 +2,36 @@ from flask_restx import Resource
 from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session
 
+from configs import dify_config
 from controllers.common.schema import register_enum_models, register_schema_models
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     cloud_edition_billing_resource_check,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_user,
 )
 from extensions.ext_database import db
-from libs.login import login_required
+from extensions.ext_redis import redis_client
+from libs.login import current_account_with_tenant, login_required
 from models.account import Account
 from models.model import App
-from services.app_dsl_service import AppDslService, Import
+from services.app_dsl_service import (
+    IMPORT_INFO_REDIS_KEY_PREFIX,
+    AppDslService,
+    Import,
+    PendingData,
+)
 from services.enterprise.enterprise_service import EnterpriseService
 from services.entities.dsl_entities import CheckDependenciesResult, ImportStatus
 from services.feature_service import FeatureService
 
 from .. import console_ns
+from .permission_keys import get_app_permission_keys
 
 
 class AppImportPayload(BaseModel):
@@ -39,6 +50,24 @@ register_enum_models(console_ns, ImportStatus)
 register_schema_models(console_ns, AppImportPayload, Import, CheckDependenciesResult)
 
 
+def _current_user_and_tenant_id(current_user: Account | None) -> tuple[Account, str | None]:
+    if current_user is None:
+        account, tenant_id = current_account_with_tenant()
+        return account, str(tenant_id) if tenant_id else None
+
+    current_tenant_id = getattr(current_user, "current_tenant_id", None)
+    if current_tenant_id:
+        return current_user, str(current_tenant_id)
+
+    current_tenant = getattr(current_user, "current_tenant", None)
+    current_tenant_object_id = getattr(current_tenant, "id", None)
+    if current_tenant_object_id:
+        return current_user, str(current_tenant_object_id)
+
+    account, fallback_tenant_id = current_account_with_tenant()
+    return account, str(fallback_tenant_id) if fallback_tenant_id else None
+
+
 @console_ns.route("/apps/imports")
 class AppImportApi(Resource):
     @console_ns.expect(console_ns.models[AppImportPayload.__name__])
@@ -50,10 +79,11 @@ class AppImportApi(Resource):
     @account_initialization_required
     @cloud_edition_billing_resource_check("apps")
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_IMPORT_EXPORT_DSL, resource_required=False)
     @with_current_user
-    def post(self, current_user: Account):
-        # Check user role first
+    def post(self, current_user: Account | None = None):
         args = AppImportPayload.model_validate(console_ns.payload)
+        current_user = current_user if current_user is not None else _current_user_and_tenant_id(None)[0]
 
         # AppDslService performs internal commits for some creation paths, so use a plain
         # Session here instead of nesting it inside sessionmaker(...).begin().
@@ -77,6 +107,20 @@ class AppImportApi(Resource):
                 session.rollback()
             else:
                 session.commit()
+
+        is_created_app = args.app_id is None and result.status in {
+            ImportStatus.COMPLETED,
+            ImportStatus.COMPLETED_WITH_WARNINGS,
+        }
+        if dify_config.RBAC_ENABLED and is_created_app and result.app_id:
+            current_user, current_tenant_id = _current_user_and_tenant_id(current_user)
+            if current_tenant_id:
+                result.permission_keys = get_app_permission_keys(
+                    current_tenant_id,
+                    current_user.id,
+                    result.app_id,
+                )
+
         if result.app_id and FeatureService.get_system_features().webapp_auth.enabled:
             # update web app setting as private
             EnterpriseService.WebAppAuth.update_app_access_mode(result.app_id, "private")
@@ -99,9 +143,16 @@ class AppImportConfirmApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_IMPORT_EXPORT_DSL, resource_required=False)
     @with_current_user
-    def post(self, current_user: Account, import_id: str):
-        # Check user role first
+    def post(self, current_user: Account | None = None, import_id: str = ""):
+        current_user = current_user if current_user is not None else _current_user_and_tenant_id(None)[0]
+        redis_key = f"{IMPORT_INFO_REDIS_KEY_PREFIX}{import_id}"
+        pending_data_raw = redis_client.get(redis_key)
+        pending_data: PendingData | None = None
+        if pending_data_raw:
+            pending_data = PendingData.model_validate_json(pending_data_raw)
+
         with Session(db.engine, expire_on_commit=False) as session:
             import_service = AppDslService(session)
             # Confirm import
@@ -112,6 +163,24 @@ class AppImportConfirmApi(Resource):
             else:
                 session.commit()
 
+        is_created_app = bool(
+            pending_data
+            and pending_data.app_id is None
+            and result.status
+            in {
+                ImportStatus.COMPLETED,
+                ImportStatus.COMPLETED_WITH_WARNINGS,
+            }
+        )
+        if dify_config.RBAC_ENABLED and is_created_app and result.app_id:
+            current_user, current_tenant_id = _current_user_and_tenant_id(current_user)
+            if current_tenant_id:
+                result.permission_keys = get_app_permission_keys(
+                    current_tenant_id,
+                    current_user.id,
+                    result.app_id,
+                )
+
         # Return appropriate status code based on result
         if result.status == ImportStatus.FAILED:
             return result.model_dump(mode="json"), 400
@@ -120,12 +189,17 @@ class AppImportConfirmApi(Resource):
 
 @console_ns.route("/apps/imports/<string:app_id>/check-dependencies")
 class AppImportCheckDependenciesApi(Resource):
-    @console_ns.response(200, "Dependencies checked", console_ns.models[CheckDependenciesResult.__name__])
+    @console_ns.response(
+        200,
+        "Dependencies checked",
+        console_ns.models[CheckDependenciesResult.__name__],
+    )
     @setup_required
     @login_required
     @get_app_model
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, app_model: App):
         with Session(db.engine, expire_on_commit=False) as session:
             import_service = AppDslService(session)
diff --git a/api/controllers/console/app/audio.py b/api/controllers/console/app/audio.py
index 7ef43570c2f..43b41903f60 100644
--- a/api/controllers/console/app/audio.py
+++ b/api/controllers/console/app/audio.py
@@ -22,7 +22,13 @@ from controllers.console.app.error import (
     UnsupportedAudioTypeError,
 )
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required
+from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    rbac_permission_required,
+    setup_required,
+)
 from core.errors.error import ModelCurrentlyNotSupportError, ProviderTokenNotInitError, QuotaExceededError
 from graphon.model_runtime.errors.invoke import InvokeError
 from libs.login import login_required
@@ -126,10 +132,10 @@ class ChatMessageTextApi(Resource):
         console_ns.models[AudioBinaryResponse.__name__],
     )
     @console_ns.response(400, "Bad request - Invalid parameters")
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
+    @get_app_model
     def post(self, app_model: App):
         try:
             payload = TextToSpeechPayload.model_validate(console_ns.payload)
@@ -180,10 +186,11 @@ class TextModesApi(Resource):
         console_ns.models[TextToSpeechVoiceListResponse.__name__],
     )
     @console_ns.response(400, "Invalid language parameter")
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model
     def get(self, app_model: App):
         try:
             args = TextToSpeechVoiceQuery.model_validate(request.args.to_dict(flat=True))
diff --git a/api/controllers/console/app/completion.py b/api/controllers/console/app/completion.py
index 853f7b023ff..62b95ad22e4 100644
--- a/api/controllers/console/app/completion.py
+++ b/api/controllers/console/app/completion.py
@@ -22,8 +22,11 @@ from controllers.console.app.error import (
 )
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -113,8 +116,9 @@ class CompletionMessageApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=AppMode.COMPLETION)
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
+    @get_app_model(mode=AppMode.COMPLETION)
     def post(self, current_user: Account, app_model: App):
         args_model = CompletionMessagePayload.model_validate(console_ns.payload)
         args = args_model.model_dump(exclude_none=True, by_alias=True)
@@ -159,8 +163,8 @@ class CompletionMessageStopApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=AppMode.COMPLETION)
     @with_current_user_id
+    @get_app_model(mode=AppMode.COMPLETION)
     def post(self, current_user_id: str, app_model: App, task_id: str):
 
         AppTaskService.stop_task(
@@ -185,9 +189,10 @@ class ChatMessageApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.AGENT])
     @edit_permission_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.AGENT])
     def post(self, current_user: Account, app_model: App):
         return _create_chat_message(current_user=current_user, app_model=app_model)
 
@@ -205,6 +210,7 @@ class AgentChatMessageApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @with_current_user
     @with_current_tenant_id
     def post(self, current_tenant_id: str, current_user: Account, agent_id: UUID):
@@ -221,8 +227,8 @@ class ChatMessageStopApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     @with_current_user_id
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     def post(self, current_user_id: str, app_model: App, task_id: str):
         return _stop_chat_message(current_user_id=current_user_id, app_model=app_model, task_id=task_id)
 
diff --git a/api/controllers/console/app/conversation.py b/api/controllers/console/app/conversation.py
index b9fcf2073d7..ec34c26fedd 100644
--- a/api/controllers/console/app/conversation.py
+++ b/api/controllers/console/app/conversation.py
@@ -13,8 +13,11 @@ from controllers.common.schema import query_params_from_model, register_schema_m
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_user,
 )
@@ -97,9 +100,10 @@ class CompletionConversationApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=AppMode.COMPLETION)
     @edit_permission_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=AppMode.COMPLETION)
     def get(self, current_user: Account, app_model: App):
         args = CompletionConversationQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -169,9 +173,10 @@ class CompletionConversationDetailApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=AppMode.COMPLETION)
     @edit_permission_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=AppMode.COMPLETION)
     def get(self, current_user: Account, app_model: App, conversation_id: UUID):
         conversation_id_str = str(conversation_id)
         return ConversationMessageDetailResponse.model_validate(
@@ -187,9 +192,10 @@ class CompletionConversationDetailApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=AppMode.COMPLETION)
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
+    @get_app_model(mode=AppMode.COMPLETION)
     def delete(self, current_user: Account, app_model: App, conversation_id: UUID):
         conversation_id_str = str(conversation_id)
 
@@ -212,9 +218,10 @@ class ChatConversationApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     @edit_permission_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     def get(self, current_user: Account, app_model: App):
         args = ChatConversationQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -323,9 +330,10 @@ class ChatConversationDetailApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     @edit_permission_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     def get(self, current_user: Account, app_model: App, conversation_id: UUID):
         conversation_id_str = str(conversation_id)
         return ConversationDetailResponse.model_validate(
@@ -340,10 +348,11 @@ class ChatConversationDetailApi(Resource):
     @console_ns.response(404, "Conversation not found")
     @setup_required
     @login_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     def delete(self, current_user: Account, app_model: App, conversation_id: UUID):
         conversation_id_str = str(conversation_id)
 
diff --git a/api/controllers/console/app/conversation_variables.py b/api/controllers/console/app/conversation_variables.py
index 9cf3f278eac..3069dd3011c 100644
--- a/api/controllers/console/app/conversation_variables.py
+++ b/api/controllers/console/app/conversation_variables.py
@@ -12,7 +12,13 @@ from sqlalchemy.orm import sessionmaker
 from controllers.common.schema import query_params_from_model, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required
+from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    rbac_permission_required,
+    setup_required,
+)
 from extensions.ext_database import db
 from fields._value_type_serializer import serialize_value_type
 from fields.base import ResponseModel
@@ -93,6 +99,7 @@ class ConversationVariablesApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @get_app_model(mode=AppMode.ADVANCED_CHAT)
     def get(self, app_model: App):
         args = ConversationVariablesQuery.model_validate(request.args.to_dict(flat=True))
diff --git a/api/controllers/console/app/mcp_server.py b/api/controllers/console/app/mcp_server.py
index 8d1eb700739..6d6a56b5e1d 100644
--- a/api/controllers/console/app/mcp_server.py
+++ b/api/controllers/console/app/mcp_server.py
@@ -12,8 +12,11 @@ from controllers.common.schema import register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
 )
@@ -83,6 +86,7 @@ class AppMCPServerController(Resource):
     @login_required
     @account_initialization_required
     @setup_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model
     def get(self, app_model: App):
         server = db.session.scalar(select(AppMCPServer).where(AppMCPServer.app_id == app_model.id).limit(1))
@@ -99,11 +103,12 @@ class AppMCPServerController(Resource):
     )
     @console_ns.response(403, "Insufficient permissions")
     @account_initialization_required
-    @get_app_model
     @login_required
     @setup_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_tenant_id
+    @get_app_model
     def post(self, current_tenant_id: str, app_model: App):
         payload = MCPServerCreatePayload.model_validate(console_ns.payload or {})
 
@@ -133,11 +138,12 @@ class AppMCPServerController(Resource):
     )
     @console_ns.response(403, "Insufficient permissions")
     @console_ns.response(404, "Server not found")
-    @get_app_model
     @login_required
     @setup_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @get_app_model
     def put(self, app_model: App):
         payload = MCPServerUpdatePayload.model_validate(console_ns.payload or {})
         server = db.session.get(AppMCPServer, payload.id)
@@ -174,6 +180,7 @@ class AppMCPServerRefreshController(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @with_current_tenant_id
     def get(self, current_tenant_id: str, server_id: UUID):
         server = db.session.scalar(
diff --git a/api/controllers/console/app/message.py b/api/controllers/console/app/message.py
index ef112b1b1e4..9944f02207f 100644
--- a/api/controllers/console/app/message.py
+++ b/api/controllers/console/app/message.py
@@ -23,8 +23,11 @@ from controllers.console.app.error import (
 from controllers.console.app.wraps import get_app_model
 from controllers.console.explore.error import AppSuggestedQuestionsAfterAnswerDisabledError
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -182,8 +185,9 @@ class ChatMessageListApi(Resource):
     @login_required
     @account_initialization_required
     @setup_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     def get(self, app_model: App):
         return _list_chat_messages(app_model=app_model)
 
@@ -200,6 +204,7 @@ class AgentChatMessageListApi(Resource):
     @account_initialization_required
     @setup_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @with_current_tenant_id
     def get(self, current_tenant_id: str, agent_id: UUID):
         app_model = resolve_agent_app_model(tenant_id=current_tenant_id, agent_id=agent_id)
@@ -215,11 +220,11 @@ class MessageFeedbackApi(Resource):
     @console_ns.response(200, "Feedback updated successfully", console_ns.models[SimpleResultResponse.__name__])
     @console_ns.response(404, "Message not found")
     @console_ns.response(403, "Insufficient permissions")
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @get_app_model
     def post(self, current_user: Account, app_model: App):
         return _update_message_feedback(current_user=current_user, app_model=app_model)
 
@@ -252,10 +257,11 @@ class MessageAnnotationCountApi(Resource):
         "Annotation count retrieved successfully",
         console_ns.models[AnnotationCountResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model
     def get(self, app_model: App):
         count = db.session.scalar(
             select(func.count(MessageAnnotation.id)).where(MessageAnnotation.app_id == app_model.id)
@@ -278,8 +284,9 @@ class MessageSuggestedQuestionApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     def get(self, current_user: Account, app_model: App, message_id: UUID):
         return _get_message_suggested_questions(current_user=current_user, app_model=app_model, message_id=message_id)
 
@@ -318,10 +325,11 @@ class MessageFeedbackExportApi(Resource):
     )
     @console_ns.response(400, "Invalid parameters")
     @console_ns.response(500, "Internal server error")
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model
     def get(self, app_model: App):
         args = FeedbackExportQuery.model_validate(request.args.to_dict())
 
@@ -330,6 +338,7 @@ class MessageFeedbackExportApi(Resource):
 
         try:
             export_data = FeedbackService.export_feedbacks(
+                db.session(),
                 app_id=app_model.id,
                 from_source=args.from_source,
                 rating=args.rating,
@@ -356,10 +365,11 @@ class MessageApi(Resource):
     @console_ns.doc(params={"app_id": "Application ID", "message_id": "Message ID"})
     @console_ns.response(200, "Message retrieved successfully", console_ns.models[MessageDetailResponse.__name__])
     @console_ns.response(404, "Message not found")
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model
     def get(self, app_model: App, message_id: UUID):
         return _get_message_detail(app_model=app_model, message_id=message_id)
 
diff --git a/api/controllers/console/app/model_config.py b/api/controllers/console/app/model_config.py
index 6e2e20c0a35..3a016e3b9b2 100644
--- a/api/controllers/console/app/model_config.py
+++ b/api/controllers/console/app/model_config.py
@@ -10,8 +10,11 @@ from controllers.common.schema import register_response_schema_models, register_
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user_id,
@@ -86,10 +89,11 @@ class ModelConfigResource(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @account_initialization_required
-    @get_app_model(mode=[AppMode.AGENT_CHAT, AppMode.CHAT, AppMode.COMPLETION])
     @with_current_user_id
     @with_current_tenant_id
+    @get_app_model(mode=[AppMode.AGENT_CHAT, AppMode.CHAT, AppMode.COMPLETION])
     def post(self, current_tenant_id: str, current_user_id: str, app_model: App):
         """Modify app model config"""
         # validate config
diff --git a/api/controllers/console/app/ops_trace.py b/api/controllers/console/app/ops_trace.py
index c9f9308c2ea..d350ff52770 100644
--- a/api/controllers/console/app/ops_trace.py
+++ b/api/controllers/console/app/ops_trace.py
@@ -9,7 +9,13 @@ from controllers.common.schema import query_params_from_model, register_response
 from controllers.console import console_ns
 from controllers.console.app.error import TracingConfigCheckError, TracingConfigIsExist, TracingConfigNotExist
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required
+from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    rbac_permission_required,
+    setup_required,
+)
 from fields.base import ResponseModel
 from libs.login import login_required
 from models import App
@@ -64,6 +70,7 @@ class TraceAppConfigApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
     @get_app_model
     def get(self, app_model: App):
         args = TraceProviderQuery.model_validate(request.args.to_dict(flat=True))  # type: ignore
diff --git a/api/controllers/console/app/permission_keys.py b/api/controllers/console/app/permission_keys.py
new file mode 100644
index 00000000000..810ea04e377
--- /dev/null
+++ b/api/controllers/console/app/permission_keys.py
@@ -0,0 +1,6 @@
+from services.enterprise import rbac_service as enterprise_rbac_service
+
+
+def get_app_permission_keys(tenant_id: str, account_id: str | None, app_id: str) -> list[str]:
+    permission_keys_map = enterprise_rbac_service.RBACService.AppPermissions.batch_get(tenant_id, account_id, [app_id])
+    return permission_keys_map.get(app_id, [])
diff --git a/api/controllers/console/app/site.py b/api/controllers/console/app/site.py
index df398fa7b9c..edc79f8fbc6 100644
--- a/api/controllers/console/app/site.py
+++ b/api/controllers/console/app/site.py
@@ -10,9 +10,12 @@ from controllers.common.schema import register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_user,
 )
@@ -85,9 +88,10 @@ class AppSite(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     @account_initialization_required
-    @get_app_model
     @with_current_user
+    @get_app_model
     def post(self, current_user: Account, app_model: App):
         args = AppSiteUpdatePayload.model_validate(console_ns.payload or {})
         site = db.session.scalar(select(Site).where(Site.app_id == app_model.id).limit(1))
@@ -134,9 +138,10 @@ class AppSiteAccessTokenReset(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     @account_initialization_required
-    @get_app_model
     @with_current_user
+    @get_app_model
     def post(self, current_user: Account, app_model: App):
         site = db.session.scalar(select(Site).where(Site.app_id == app_model.id).limit(1))
 
diff --git a/api/controllers/console/app/statistic.py b/api/controllers/console/app/statistic.py
index bc0120fe4f8..fbb6d3e987f 100644
--- a/api/controllers/console/app/statistic.py
+++ b/api/controllers/console/app/statistic.py
@@ -8,7 +8,14 @@ from pydantic import BaseModel, Field, field_validator
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required, with_current_user
+from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    rbac_permission_required,
+    setup_required,
+    with_current_user,
+)
 from core.app.entities.app_invoke_entities import InvokeFrom
 from extensions.ext_database import db
 from fields.base import ResponseModel
@@ -131,11 +138,12 @@ class DailyMessageStatistic(Resource):
         "Daily message statistics retrieved successfully",
         console_ns.models[DailyMessageStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -191,11 +199,12 @@ class DailyConversationStatistic(Resource):
         "Daily conversation statistics retrieved successfully",
         console_ns.models[DailyConversationStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -250,11 +259,12 @@ class DailyTerminalsStatistic(Resource):
         "Daily terminal statistics retrieved successfully",
         console_ns.models[DailyTerminalStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -310,11 +320,12 @@ class DailyTokenCostStatistic(Resource):
         "Daily token cost statistics retrieved successfully",
         console_ns.models[DailyTokenCostStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -376,8 +387,9 @@ class AverageSessionInteractionStatistic(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
     def get(self, account: Account, app_model: App):
         args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -452,11 +464,12 @@ class UserSatisfactionRateStatistic(Resource):
         "User satisfaction rate statistics retrieved successfully",
         console_ns.models[UserSatisfactionRateStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -524,8 +537,9 @@ class AverageResponseTimeStatistic(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=AppMode.COMPLETION)
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model(mode=AppMode.COMPLETION)
     def get(self, account: Account, app_model: App):
         args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -581,11 +595,12 @@ class TokensPerSecondStatistic(Resource):
         "Tokens per second statistics retrieved successfully",
         console_ns.models[TokensPerSecondStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = StatisticTimeRangeQuery.model_validate(request.args.to_dict(flat=True))
 
diff --git a/api/controllers/console/app/workflow.py b/api/controllers/console/app/workflow.py
index a8969f4d5ec..aff32035233 100644
--- a/api/controllers/console/app/workflow.py
+++ b/api/controllers/console/app/workflow.py
@@ -26,10 +26,14 @@ from controllers.console.app.error import (
     DraftWorkflowNotExist,
     DraftWorkflowNotSync,
 )
+from controllers.console.app.permission_keys import get_app_permission_keys
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -436,8 +440,9 @@ class DraftWorkflowApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App):
         """
         Get draft workflow
@@ -483,6 +488,7 @@ class DraftWorkflowApi(Resource):
     @console_ns.response(403, "Permission denied")
     @with_current_user
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def post(self, current_user: Account, app_model: App):
         """
         Sync draft workflow
@@ -548,6 +554,7 @@ class AdvancedChatDraftWorkflowRunApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT])
     @with_current_user
     @edit_permission_required
@@ -597,6 +604,7 @@ class AdvancedChatDraftRunIterationNodeApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT])
     @with_current_user
     @edit_permission_required
@@ -639,6 +647,7 @@ class WorkflowDraftRunIterationNodeApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -677,6 +686,7 @@ class AdvancedChatDraftRunLoopNodeApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT])
     @with_current_user
     @edit_permission_required
@@ -719,6 +729,7 @@ class WorkflowDraftRunLoopNodeApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -793,6 +804,7 @@ class AdvancedChatDraftHumanInputFormPreviewApi(Resource):
     @get_app_model(mode=[AppMode.ADVANCED_CHAT])
     @with_current_user
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def post(self, current_user: Account, app_model: App, node_id: str):
         """
         Preview human input form content and placeholders
@@ -824,6 +836,7 @@ class AdvancedChatDraftHumanInputFormRunApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT])
     @with_current_user
     @edit_permission_required
@@ -857,6 +870,7 @@ class WorkflowDraftHumanInputFormPreviewApi(Resource):
     @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def post(self, current_user: Account, app_model: App, node_id: str):
         """
         Preview human input form content and placeholders
@@ -888,6 +902,7 @@ class WorkflowDraftHumanInputFormRunApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -921,6 +936,7 @@ class WorkflowDraftHumanInputDeliveryTestApi(Resource):
     @get_app_model(mode=[AppMode.WORKFLOW, AppMode.ADVANCED_CHAT])
     @with_current_user
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     def post(self, current_user: Account, app_model: App, node_id: str):
         """
         Test human input delivery
@@ -952,6 +968,7 @@ class DraftWorkflowRunApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -990,8 +1007,9 @@ class WorkflowTaskStopApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
+    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def post(self, app_model: App, task_id: str):
         """
         Stop workflow task
@@ -1022,6 +1040,7 @@ class DraftWorkflowNodeRunApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -1072,8 +1091,9 @@ class PublishedWorkflowApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App):
         """
         Get published workflow
@@ -1093,6 +1113,7 @@ class PublishedWorkflowApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -1141,8 +1162,9 @@ class DefaultBlockConfigsApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App):
         """
         Get default block config
@@ -1167,8 +1189,9 @@ class DefaultBlockConfigApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, block_type: str):
         """
         Get default block config
@@ -1205,14 +1228,15 @@ class ConvertToWorkflowApi(Resource):
     @account_initialization_required
     @get_app_model(mode=[AppMode.CHAT, AppMode.COMPLETION])
     @with_current_user
+    @with_current_tenant_id
     @edit_permission_required
-    def post(self, current_user: Account, app_model: App):
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    def post(self, current_tenant_id: str, current_user: Account, app_model: App):
         """
         Convert basic mode of chatbot app to workflow mode
         Convert expert mode of chatbot app to workflow mode
         Convert Completion App to Workflow App
         """
-
         payload = console_ns.payload or {}
         args = ConvertToWorkflowPayload.model_validate(payload).model_dump(exclude_none=True)
 
@@ -1223,6 +1247,7 @@ class ConvertToWorkflowApi(Resource):
         # return app id
         return {
             "new_app_id": new_app_model.id,
+            "permission_keys": get_app_permission_keys(str(current_tenant_id), current_user.id, str(new_app_model.id)),
         }
 
 
@@ -1245,6 +1270,7 @@ class WorkflowFeaturesApi(Resource):
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def post(self, current_user: Account, app_model: App):
 
         args = WorkflowFeaturesPayload.model_validate(console_ns.payload or {})
@@ -1270,6 +1296,7 @@ class PublishedAllWorkflowApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -1322,6 +1349,7 @@ class DraftWorkflowRestoreApi(Resource):
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     def post(self, current_user: Account, app_model: App, workflow_id: str):
         workflow_service = WorkflowService()
 
@@ -1360,6 +1388,7 @@ class WorkflowByIdApi(Resource):
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     def patch(self, current_user: Account, app_model: App, workflow_id: str):
         """
         Update workflow attributes
@@ -1398,6 +1427,7 @@ class WorkflowByIdApi(Resource):
     @account_initialization_required
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @console_ns.response(204, "Workflow deleted successfully")
     def delete(self, app_model: App, workflow_id: str):
         """
@@ -1436,6 +1466,7 @@ class DraftWorkflowNodeLastRunApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, node_id: str):
         srv = WorkflowService()
@@ -1480,6 +1511,7 @@ class DraftWorkflowTriggerRunApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -1548,6 +1580,7 @@ class DraftWorkflowTriggerNodeApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
@@ -1631,6 +1664,7 @@ class DraftWorkflowTriggerRunAllApi(Resource):
     @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     def post(self, current_user: Account, app_model: App):
         """
         Full workflow debug when the start node is a trigger
diff --git a/api/controllers/console/app/workflow_app_log.py b/api/controllers/console/app/workflow_app_log.py
index 72bececd999..cf94ceff853 100644
--- a/api/controllers/console/app/workflow_app_log.py
+++ b/api/controllers/console/app/workflow_app_log.py
@@ -10,7 +10,13 @@ from sqlalchemy.orm import sessionmaker
 from controllers.common.schema import query_params_from_model, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required
+from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    rbac_permission_required,
+    setup_required,
+)
 from extensions.ext_database import db
 from fields.base import ResponseModel
 from fields.end_user_fields import SimpleEndUser
@@ -175,6 +181,7 @@ class WorkflowAppLogApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
     @get_app_model(mode=[AppMode.WORKFLOW])
     def get(self, app_model: App):
         """
@@ -218,6 +225,7 @@ class WorkflowArchivedLogApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
     @get_app_model(mode=[AppMode.WORKFLOW])
     def get(self, app_model: App):
         """
diff --git a/api/controllers/console/app/workflow_comment.py b/api/controllers/console/app/workflow_comment.py
index 3cecd450545..a9bf85ed36c 100644
--- a/api/controllers/console/app/workflow_comment.py
+++ b/api/controllers/console/app/workflow_comment.py
@@ -8,8 +8,11 @@ from controllers.common.schema import register_response_schema_models, register_
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -218,8 +221,9 @@ class WorkflowCommentListApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model()
     def get(self, current_tenant_id: str, app_model: App):
         """Get all comments for a workflow."""
         comments = WorkflowCommentService.get_comments(tenant_id=current_tenant_id, app_id=app_model.id)
@@ -234,10 +238,11 @@ class WorkflowCommentListApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
     @with_current_tenant_id
+    @get_app_model()
     def post(self, current_tenant_id: str, current_user: Account, app_model: App):
         """Create a new workflow comment."""
         payload = WorkflowCommentCreatePayload.model_validate(console_ns.payload or {})
@@ -266,8 +271,9 @@ class WorkflowCommentDetailApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model()
     def get(self, current_tenant_id: str, app_model: App, comment_id: str):
         """Get a specific workflow comment."""
         comment = WorkflowCommentService.get_comment(
@@ -284,10 +290,11 @@ class WorkflowCommentDetailApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
     @with_current_tenant_id
+    @get_app_model()
     def put(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str):
         """Update a workflow comment."""
         payload = WorkflowCommentUpdatePayload.model_validate(console_ns.payload or {})
@@ -312,10 +319,11 @@ class WorkflowCommentDetailApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
     @with_current_tenant_id
+    @get_app_model()
     def delete(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str):
         """Delete a workflow comment."""
         WorkflowCommentService.delete_comment(
@@ -339,10 +347,11 @@ class WorkflowCommentResolveApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
     @with_current_tenant_id
+    @get_app_model()
     def post(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str):
         """Resolve a workflow comment."""
         comment = WorkflowCommentService.resolve_comment(
@@ -367,10 +376,11 @@ class WorkflowCommentReplyApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
     @with_current_tenant_id
+    @get_app_model()
     def post(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str):
         """Add a reply to a workflow comment."""
         # Validate comment access first
@@ -402,10 +412,11 @@ class WorkflowCommentReplyDetailApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
     @with_current_tenant_id
+    @get_app_model()
     def put(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str, reply_id: str):
         """Update a comment reply."""
         # Validate comment access first
@@ -434,10 +445,11 @@ class WorkflowCommentReplyDetailApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
     @with_current_tenant_id
+    @get_app_model()
     def delete(self, current_tenant_id: str, current_user: Account, app_model: App, comment_id: str, reply_id: str):
         """Delete a comment reply."""
         # Validate comment access first
@@ -469,8 +481,9 @@ class WorkflowCommentMentionUsersApi(Resource):
     @login_required
     @setup_required
     @account_initialization_required
-    @get_app_model()
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model()
     def get(self, current_user: Account, app_model: App):
         """Get all users in current tenant for mentions."""
         current_tenant = current_user.current_tenant  # need the tenant object here
diff --git a/api/controllers/console/app/workflow_draft_variable.py b/api/controllers/console/app/workflow_draft_variable.py
index 11411115c1b..ff82572b87e 100644
--- a/api/controllers/console/app/workflow_draft_variable.py
+++ b/api/controllers/console/app/workflow_draft_variable.py
@@ -18,8 +18,11 @@ from controllers.console.app.error import (
 )
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_user,
 )
@@ -283,6 +286,7 @@ def _api_prerequisite[T, **P, R](
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @with_current_user
     @wraps(f)
@@ -304,6 +308,7 @@ class WorkflowVariableCollectionApi(Resource):
     )
     @_api_prerequisite
     @marshal_with(workflow_draft_variable_list_without_value_model)
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, current_user: Account, app_model: App):
         """
         Get draft workflow
@@ -368,6 +373,7 @@ class NodeVariableCollectionApi(Resource):
     @console_ns.response(200, "Node variables retrieved successfully", workflow_draft_variable_list_model)
     @_api_prerequisite
     @marshal_with(workflow_draft_variable_list_model)
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, current_user: Account, app_model: App, node_id: str):
         validate_node_id(node_id)
         with sessionmaker(bind=db.engine, expire_on_commit=False).begin() as session:
@@ -402,6 +408,7 @@ class VariableApi(Resource):
     @console_ns.response(404, "Variable not found")
     @_api_prerequisite
     @marshal_with(workflow_draft_variable_model)
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, current_user: Account, app_model: App, variable_id: UUID):
         draft_var_srv = WorkflowDraftVariableService(
             session=db.session(),
@@ -574,6 +581,7 @@ class ConversationVariableCollectionApi(Resource):
     @console_ns.response(404, "Draft workflow not found")
     @_api_prerequisite
     @marshal_with(workflow_draft_variable_list_model)
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, current_user: Account, app_model: App):
         # NOTE(QuantumGhost): Prefill conversation variables into the draft variables table
         # so their IDs can be returned to the caller.
@@ -599,8 +607,9 @@ class ConversationVariableCollectionApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
-    @get_app_model(mode=AppMode.ADVANCED_CHAT)
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
+    @get_app_model(mode=AppMode.ADVANCED_CHAT)
     def post(self, current_user: Account, app_model: App):
         payload = ConversationVariableUpdatePayload.model_validate(console_ns.payload or {})
 
@@ -628,6 +637,7 @@ class SystemVariableCollectionApi(Resource):
     @console_ns.response(200, "System variables retrieved successfully", workflow_draft_variable_list_model)
     @_api_prerequisite
     @marshal_with(workflow_draft_variable_list_model)
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, current_user: Account, app_model: App):
         return _get_variable_list(app_model, SYSTEM_VARIABLE_NODE_ID, current_user.id)
 
@@ -644,6 +654,7 @@ class EnvironmentVariableCollectionApi(Resource):
     )
     @console_ns.response(404, "Draft workflow not found")
     @_api_prerequisite
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     def get(self, _current_user: Account, app_model: App):
         """
         Get draft workflow
@@ -688,8 +699,9 @@ class EnvironmentVariableCollectionApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_user
+    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def post(self, current_user: Account, app_model: App):
         payload = EnvironmentVariableUpdatePayload.model_validate(console_ns.payload or {})
 
diff --git a/api/controllers/console/app/workflow_node_output_inspector.py b/api/controllers/console/app/workflow_node_output_inspector.py
index 98f86ad7cb6..6ed59d6c566 100644
--- a/api/controllers/console/app/workflow_node_output_inspector.py
+++ b/api/controllers/console/app/workflow_node_output_inspector.py
@@ -34,7 +34,13 @@ from controllers.common.fields import EventStreamResponse
 from controllers.common.schema import register_response_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required
+from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    rbac_permission_required,
+    setup_required,
+)
 from libs.exception import BaseHTTPException
 from libs.login import login_required
 from models import App, AppMode
@@ -146,6 +152,7 @@ class WorkflowDraftRunNodeOutputsApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID):
         return _serve_snapshot(app_model, run_id)
@@ -169,6 +176,7 @@ class WorkflowDraftRunNodeOutputDetailApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID, node_id: str):
         return _serve_node_detail(app_model, run_id, node_id)
@@ -195,6 +203,7 @@ class WorkflowDraftRunNodeOutputPreviewApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID, node_id: str, output_name: str):
         return _serve_output_preview(app_model, run_id, node_id, output_name)
@@ -338,6 +347,7 @@ class WorkflowDraftRunNodeOutputEventsApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID):
         return Response(
@@ -368,6 +378,7 @@ class WorkflowPublishedRunNodeOutputsApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID):
         return _serve_snapshot(app_model, run_id)
@@ -391,6 +402,7 @@ class WorkflowPublishedRunNodeOutputDetailApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID, node_id: str):
         return _serve_node_detail(app_model, run_id, node_id)
@@ -418,6 +430,7 @@ class WorkflowPublishedRunNodeOutputPreviewApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID, node_id: str, output_name: str):
         return _serve_output_preview(app_model, run_id, node_id, output_name)
@@ -439,6 +452,7 @@ class WorkflowPublishedRunNodeOutputEventsApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID):
         return Response(
diff --git a/api/controllers/console/app/workflow_run.py b/api/controllers/console/app/workflow_run.py
index 359daa12c20..374537229ca 100644
--- a/api/controllers/console/app/workflow_run.py
+++ b/api/controllers/console/app/workflow_run.py
@@ -14,7 +14,10 @@ from controllers.common.schema import query_params_from_model, register_response
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -155,6 +158,7 @@ class AdvancedChatAppWorkflowRunListApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT])
     def get(self, app_model: App):
         """
@@ -193,6 +197,7 @@ class WorkflowRunExportApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @get_app_model()
     def get(self, app_model: App, run_id: UUID):
         tenant_id = app_model.tenant_id
@@ -251,6 +256,7 @@ class AdvancedChatAppWorkflowRunCountApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT])
     def get(self, app_model: App):
         """
@@ -291,6 +297,7 @@ class WorkflowRunListApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App):
         """
@@ -332,6 +339,7 @@ class WorkflowRunCountApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App):
         """
@@ -372,6 +380,7 @@ class WorkflowRunDetailApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
     @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, app_model: App, run_id: UUID):
         """
@@ -401,8 +410,9 @@ class WorkflowRunNodeExecutionListApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
+    @get_app_model(mode=[AppMode.ADVANCED_CHAT, AppMode.WORKFLOW])
     def get(self, current_user: Account, app_model: App, run_id: UUID):
         """
         Get workflow run node execution list
diff --git a/api/controllers/console/app/workflow_statistic.py b/api/controllers/console/app/workflow_statistic.py
index ec2a5ffce11..0346d510fbc 100644
--- a/api/controllers/console/app/workflow_statistic.py
+++ b/api/controllers/console/app/workflow_statistic.py
@@ -6,7 +6,14 @@ from sqlalchemy.orm import sessionmaker
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import account_initialization_required, setup_required, with_current_user
+from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    rbac_permission_required,
+    setup_required,
+    with_current_user,
+)
 from extensions.ext_database import db
 from fields.base import ResponseModel
 from libs.datetime_utils import parse_time_range
@@ -91,11 +98,12 @@ class WorkflowDailyRunsStatistic(Resource):
         "Daily runs statistics retrieved successfully",
         console_ns.models[WorkflowDailyRunsStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = WorkflowStatisticQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -134,11 +142,12 @@ class WorkflowDailyTerminalsStatistic(Resource):
         "Daily terminals statistics retrieved successfully",
         console_ns.models[WorkflowDailyTerminalsStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = WorkflowStatisticQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -177,11 +186,12 @@ class WorkflowDailyTokenCostStatistic(Resource):
         "Daily token cost statistics retrieved successfully",
         console_ns.models[WorkflowDailyTokenCostStatisticResponse.__name__],
     )
-    @get_app_model
     @setup_required
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model
     def get(self, account: Account, app_model: App):
         args = WorkflowStatisticQuery.model_validate(request.args.to_dict(flat=True))
 
@@ -223,8 +233,9 @@ class WorkflowAverageAppInteractionStatistic(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=[AppMode.WORKFLOW])
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_MONITOR)
+    @get_app_model(mode=[AppMode.WORKFLOW])
     def get(self, account: Account, app_model: App):
         args = WorkflowStatisticQuery.model_validate(request.args.to_dict(flat=True))
 
diff --git a/api/controllers/console/app/workflow_trigger.py b/api/controllers/console/app/workflow_trigger.py
index 6a1bd843ee2..8bd41b3e429 100644
--- a/api/controllers/console/app/workflow_trigger.py
+++ b/api/controllers/console/app/workflow_trigger.py
@@ -19,7 +19,15 @@ from models.trigger import AppTrigger, WorkflowWebhookTrigger
 
 from .. import console_ns
 from ..app.wraps import get_app_model
-from ..wraps import account_initialization_required, edit_permission_required, setup_required, with_current_tenant_id
+from ..wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    edit_permission_required,
+    rbac_permission_required,
+    setup_required,
+    with_current_tenant_id,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -90,8 +98,9 @@ class WebhookTriggerApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=AppMode.WORKFLOW)
     @console_ns.response(200, "Success", console_ns.models[WebhookTriggerResponse.__name__])
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=AppMode.WORKFLOW)
     def get(self, app_model: App):
         """Get webhook trigger for a node"""
         args = Parser.model_validate(request.args.to_dict(flat=True))
@@ -122,9 +131,10 @@ class AppTriggersApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
-    @get_app_model(mode=AppMode.WORKFLOW)
     @console_ns.response(200, "Success", console_ns.models[WorkflowTriggerListResponse.__name__])
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @get_app_model(mode=AppMode.WORKFLOW)
     def get(self, current_tenant_id: str, app_model: App):
         """Get app triggers list"""
         with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
@@ -162,9 +172,10 @@ class AppTriggerEnableApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
-    @get_app_model(mode=AppMode.WORKFLOW)
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @console_ns.response(200, "Success", console_ns.models[WorkflowTriggerResponse.__name__])
     @with_current_tenant_id
+    @get_app_model(mode=AppMode.WORKFLOW)
     def post(self, current_tenant_id: str, app_model: App):
         """Update app trigger (enable/disable)"""
         args = ParserEnable.model_validate(console_ns.payload)
diff --git a/api/controllers/console/auth/activate.py b/api/controllers/console/auth/activate.py
index 7e7810d86da..c9142d85ede 100644
--- a/api/controllers/console/auth/activate.py
+++ b/api/controllers/console/auth/activate.py
@@ -1,6 +1,7 @@
 from flask import request
 from flask_restx import Resource
 from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import select
 
 from configs import dify_config
 from constants.languages import supported_language
@@ -11,7 +12,8 @@ from extensions.ext_database import db
 from libs.datetime_utils import naive_utc_now
 from libs.helper import EmailStr, timezone
 from models import AccountStatus
-from services.account_service import RegisterService
+from models.account import TenantAccountJoin, TenantAccountRole
+from services.account_service import RegisterService, TenantService
 from services.billing_service import BillingService
 
 
@@ -25,18 +27,22 @@ class ActivatePayload(BaseModel):
     workspace_id: str | None = Field(default=None)
     email: EmailStr | None = Field(default=None)
     token: str
-    name: str = Field(..., max_length=30)
-    interface_language: str = Field(...)
-    timezone: str = Field(...)
+    name: str | None = Field(default=None, max_length=30)
+    interface_language: str | None = Field(default=None)
+    timezone: str | None = Field(default=None)
 
     @field_validator("interface_language")
     @classmethod
-    def validate_lang(cls, value: str) -> str:
+    def validate_lang(cls, value: str | None) -> str | None:
+        if value is None:
+            return None
         return supported_language(value)
 
     @field_validator("timezone")
     @classmethod
-    def validate_tz(cls, value: str) -> str:
+    def validate_tz(cls, value: str | None) -> str | None:
+        if value is None:
+            return None
         return timezone(value)
 
 
@@ -48,6 +54,8 @@ class ActivationCheckData(BaseModel):
     workspace_name: str | None
     workspace_id: str | None
     email: str | None
+    account_status: str | None = None
+    requires_setup: bool | None = None
 
 
 class ActivationCheckResponse(BaseModel):
@@ -95,9 +103,20 @@ class ActivateCheckApi(Resource):
             workspace_name = tenant.name if tenant else None
             workspace_id = tenant.id if tenant else None
             invitee_email = data.get("email") if data else None
+            account = invitation.get("account")
+            account_status = account.status if account else None
+            requires_setup = data.get("requires_setup")
+            if requires_setup is None:
+                requires_setup = account_status == AccountStatus.PENDING
             return {
                 "is_valid": invitation is not None,
-                "data": {"workspace_name": workspace_name, "workspace_id": workspace_id, "email": invitee_email},
+                "data": {
+                    "workspace_name": workspace_name,
+                    "workspace_id": workspace_id,
+                    "email": invitee_email,
+                    "account_status": account_status,
+                    "requires_setup": requires_setup,
+                },
             }
         else:
             return {"is_valid": False}
@@ -126,15 +145,45 @@ class ActivateApi(Resource):
         if dify_config.BILLING_ENABLED and BillingService.is_email_in_freeze(account.email):
             raise AccountInFreezeError()
 
+        tenant = invitation["tenant"]
+        raw_role = invitation["data"].get("role")
+        try:
+            role = TenantAccountRole(raw_role) if raw_role else TenantAccountRole.NORMAL
+        except ValueError:
+            role = TenantAccountRole.NORMAL
+        if not TenantAccountRole.is_non_owner_role(role):
+            role = TenantAccountRole.NORMAL
+
+        membership_id = db.session.scalar(
+            select(TenantAccountJoin.id).where(
+                TenantAccountJoin.tenant_id == tenant.id,
+                TenantAccountJoin.account_id == account.id,
+            )
+        )
+
+        requires_setup = invitation["data"].get("requires_setup")
+        if requires_setup is None:
+            requires_setup = account.status == AccountStatus.PENDING
+
+        setup_fields: tuple[str, str, str] | None = None
+        if requires_setup:
+            if not args.name or not args.interface_language or not args.timezone:
+                raise AlreadyActivateError()
+            setup_fields = (args.name, args.interface_language, args.timezone)
+
         RegisterService.revoke_token(args.workspace_id, normalized_request_email, args.token)
 
-        account.name = args.name
+        if membership_id is None:
+            TenantService.create_tenant_member(tenant, account, db.session, role=role)
 
-        account.interface_language = args.interface_language
-        account.timezone = args.timezone
-        account.interface_theme = "light"
-        account.status = AccountStatus.ACTIVE
-        account.initialized_at = naive_utc_now()
-        db.session.commit()
+        if setup_fields:
+            account.name = setup_fields[0]
+            account.interface_language = setup_fields[1]
+            account.timezone = setup_fields[2]
+            account.interface_theme = "light"
+            account.status = AccountStatus.ACTIVE
+            account.initialized_at = naive_utc_now()
+
+        TenantService.switch_tenant(account, tenant.id)
 
         return {"result": "success"}
diff --git a/api/controllers/console/auth/data_source_bearer_auth.py b/api/controllers/console/auth/data_source_bearer_auth.py
index f06db799498..a9c97401105 100644
--- a/api/controllers/console/auth/data_source_bearer_auth.py
+++ b/api/controllers/console/auth/data_source_bearer_auth.py
@@ -11,7 +11,15 @@ from services.auth.api_key_auth_service import ApiKeyAuthService
 
 from .. import console_ns
 from ..auth.error import ApiKeyAuthFailedError
-from ..wraps import account_initialization_required, is_admin_or_owner_required, setup_required, with_current_tenant_id
+from ..wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    is_admin_or_owner_required,
+    rbac_permission_required,
+    setup_required,
+    with_current_tenant_id,
+)
 
 
 class ApiKeyAuthBindingPayload(BaseModel):
@@ -75,6 +83,7 @@ class ApiKeyAuthDataSourceBinding(Resource):
     @login_required
     @account_initialization_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @console_ns.expect(console_ns.models[ApiKeyAuthBindingPayload.__name__])
     @with_current_tenant_id
     def post(self, current_tenant_id: str):
@@ -95,6 +104,7 @@ class ApiKeyAuthDataSourceBindingDelete(Resource):
     @login_required
     @account_initialization_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @console_ns.response(204, "Binding deleted successfully")
     @with_current_tenant_id
     def delete(self, current_tenant_id: str, binding_id: UUID):
diff --git a/api/controllers/console/auth/data_source_oauth.py b/api/controllers/console/auth/data_source_oauth.py
index f1493b5e6f4..6ad2efa360a 100644
--- a/api/controllers/console/auth/data_source_oauth.py
+++ b/api/controllers/console/auth/data_source_oauth.py
@@ -13,7 +13,14 @@ from libs.login import login_required
 from libs.oauth_data_source import NotionOAuth
 
 from .. import console_ns
-from ..wraps import account_initialization_required, is_admin_or_owner_required, setup_required
+from ..wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    is_admin_or_owner_required,
+    rbac_permission_required,
+    setup_required,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -75,6 +82,7 @@ class OAuthDataSource(Resource):
     @console_ns.response(400, "Invalid provider")
     @console_ns.response(403, "Admin privileges required")
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     def get(self, provider: str):
         # The role of the current user in the table must be admin or owner
         OAUTH_DATASOURCE_PROVIDERS = get_oauth_providers()
diff --git a/api/controllers/console/auth/forgot_password.py b/api/controllers/console/auth/forgot_password.py
index c34dd1ac859..d82f63c11db 100644
--- a/api/controllers/console/auth/forgot_password.py
+++ b/api/controllers/console/auth/forgot_password.py
@@ -202,6 +202,6 @@ class ForgotPasswordResetApi(Resource):
             and FeatureService.get_system_features().is_allow_create_workspace
         ):
             tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
-            TenantService.create_tenant_member(tenant, account, role="owner")
+            TenantService.create_tenant_member(tenant, account, db.session, role="owner")
             account.current_tenant = tenant
             tenant_was_created.send(tenant)
diff --git a/api/controllers/console/auth/login.py b/api/controllers/console/auth/login.py
index 6a1b4c6769e..053f313ba53 100644
--- a/api/controllers/console/auth/login.py
+++ b/api/controllers/console/auth/login.py
@@ -35,6 +35,7 @@ from controllers.console.wraps import (
     with_current_user,
 )
 from events.tenant_event import tenant_was_created
+from extensions.ext_database import db
 from libs.helper import EmailStr, extract_remote_ip
 from libs.helper import timezone as validate_timezone_string
 from libs.token import (
@@ -299,7 +300,7 @@ class EmailCodeLoginApi(Resource):
                     raise NotAllowedCreateWorkspace()
                 else:
                     new_tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
-                    TenantService.create_tenant_member(new_tenant, account, role="owner")
+                    TenantService.create_tenant_member(new_tenant, account, db.session, role="owner")
                     account.current_tenant = new_tenant
                     tenant_was_created.send(new_tenant)
 
diff --git a/api/controllers/console/auth/oauth.py b/api/controllers/console/auth/oauth.py
index 31649812fe8..78d1583fde9 100644
--- a/api/controllers/console/auth/oauth.py
+++ b/api/controllers/console/auth/oauth.py
@@ -246,7 +246,7 @@ def _generate_account(
                 raise WorkSpaceNotAllowedCreateError()
             else:
                 new_tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
-                TenantService.create_tenant_member(new_tenant, account, role="owner")
+                TenantService.create_tenant_member(new_tenant, account, db.session, role="owner")
                 account.current_tenant = new_tenant
                 tenant_was_created.send(new_tenant)
 
diff --git a/api/controllers/console/datasets/data_source.py b/api/controllers/console/datasets/data_source.py
index 07db712fba1..6dd13b485bc 100644
--- a/api/controllers/console/datasets/data_source.py
+++ b/api/controllers/console/datasets/data_source.py
@@ -31,7 +31,15 @@ from services.datasource_provider_service import DatasourceProviderService
 from tasks.document_indexing_sync_task import document_indexing_sync_task
 
 from .. import console_ns
-from ..wraps import account_initialization_required, setup_required, with_current_tenant_id, with_current_user
+from ..wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    account_initialization_required,
+    rbac_permission_required,
+    setup_required,
+    with_current_tenant_id,
+    with_current_user,
+)
 
 
 class NotionEstimatePayload(BaseModel):
@@ -390,6 +398,7 @@ class DataSourceNotionDatasetSyncApi(Resource):
     @login_required
     @account_initialization_required
     @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, dataset_id: UUID) -> tuple[dict[str, str], int]:
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -408,6 +417,7 @@ class DataSourceNotionDocumentSyncApi(Resource):
     @login_required
     @account_initialization_required
     @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, dataset_id: UUID, document_id: UUID) -> tuple[dict[str, str], int]:
         dataset_id_str = str(dataset_id)
         document_id_str = str(document_id)
diff --git a/api/controllers/console/datasets/datasets.py b/api/controllers/console/datasets/datasets.py
index ca2ef5d6e2d..55bc85483d5 100644
--- a/api/controllers/console/datasets/datasets.py
+++ b/api/controllers/console/datasets/datasets.py
@@ -17,10 +17,13 @@ from controllers.console.apikey import ApiKeyItem, ApiKeyList
 from controllers.console.app.error import ProviderNotInitializeError
 from controllers.console.datasets.error import DatasetInUseError, DatasetNameDuplicateError, IndexingEstimateError
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     cloud_edition_billing_rate_limit_check,
     enterprise_license_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -46,9 +49,16 @@ from models.enums import ApiTokenType, SegmentStatus
 from models.provider_ids import ModelProviderID
 from services.api_token_service import ApiTokenCache
 from services.dataset_service import DatasetPermissionService, DatasetService, DocumentService
+from services.enterprise import rbac_service as enterprise_rbac_service
 
 register_response_schema_models(console_ns, ApiBaseUrlResponse, SimpleResultResponse, UsageCheckResponse)
 
+DATASET_LIST_PERMISSION_KEYS = frozenset({"dataset.preview", "dataset.acl.preview", "dataset.full_access"})
+
+
+def _has_dataset_list_permission(permission_keys: list[str]) -> bool:
+    return any(permission_key in DATASET_LIST_PERMISSION_KEYS for permission_key in permission_keys)
+
 
 def _validate_indexing_technique(value: str | None) -> str | None:
     if value is None:
@@ -402,20 +412,68 @@ class DatasetListApi(Resource):
         if "tag_ids" in request.args:
             query_params["tag_ids"] = request.args.getlist("tag_ids")
         query = ConsoleDatasetListQuery.model_validate(query_params)
-        # provider = request.args.get("provider", default="vendor")
+
+        permissions = enterprise_rbac_service.RBACService.MyPermissions.get(
+            str(current_tenant_id),
+            current_user.id,
+        )
+
+        accessible_dataset_ids: list[str] | None = None
+        include_own_datasets = False
+        if dify_config.RBAC_ENABLED:
+            whitelist_scope = enterprise_rbac_service.RBACService.DatasetAccess.whitelist_resources(
+                str(current_tenant_id),
+                current_user.id,
+            )
+            has_default_readonly = _has_dataset_list_permission(
+                permissions.dataset.default_permission_keys
+            ) or _has_dataset_list_permission(permissions.workspace.permission_keys)
+            permission_dataset_ids: set[str] | None = None
+            if not has_default_readonly:
+                permission_dataset_ids = {
+                    override.resource_id
+                    for override in permissions.dataset.overrides
+                    if _has_dataset_list_permission(override.permission_keys)
+                }
+            if getattr(whitelist_scope, "unrestricted", False):
+                filtered_dataset_ids = permission_dataset_ids
+            else:
+                filtered_dataset_ids = set(whitelist_scope.resource_ids)
+                if permission_dataset_ids is not None:
+                    filtered_dataset_ids |= permission_dataset_ids
+                elif has_default_readonly:
+                    filtered_dataset_ids = None
+            if filtered_dataset_ids is not None:
+                accessible_dataset_ids = sorted(filtered_dataset_ids)
+            include_own_datasets = "dataset.create_and_management" in permissions.workspace.permission_keys
+
         if query.ids:
-            datasets, total = DatasetService.get_datasets_by_ids(query.ids, current_tenant_id)
+            datasets, total = DatasetService.get_datasets_by_ids(
+                query.ids,
+                current_tenant_id,
+                user=current_user,
+                accessible_dataset_ids=accessible_dataset_ids,
+                include_own_datasets=include_own_datasets,
+            )
         else:
             datasets, total = DatasetService.get_datasets(
                 query.page,
                 query.limit,
+                db.session,
                 current_tenant_id,
                 current_user,
                 query.keyword,
                 query.tag_ids,
                 query.include_all,
+                accessible_dataset_ids=accessible_dataset_ids,
+                include_own_datasets=include_own_datasets,
             )
 
+        permission_keys_map = {}
+        if datasets:
+            dataset_ids = [str(dataset.id) for dataset in datasets]
+            permission_keys_map = permissions.dataset.permission_keys_by_resource_ids(dataset_ids)
+
         # check embedding setting
         provider_manager = create_plugin_provider_manager(tenant_id=current_tenant_id)
         configurations = provider_manager.get_configurations(tenant_id=current_tenant_id)
@@ -430,13 +488,13 @@ class DatasetListApi(Resource):
         dataset_ids = [item["id"] for item in data if item.get("permission") == "partial_members"]
         partial_members_map: dict[str, list[str]] = {}
         if dataset_ids:
-            permissions = db.session.execute(
+            partial_member_rows = db.session.execute(
                 select(DatasetPermission.dataset_id, DatasetPermission.account_id).where(
                     DatasetPermission.dataset_id.in_(dataset_ids)
                 )
             ).all()
 
-            for dataset_id, account_id in permissions:
+            for dataset_id, account_id in partial_member_rows:
                 partial_members_map.setdefault(dataset_id, []).append(account_id)
 
         for item in data:
@@ -455,6 +513,7 @@ class DatasetListApi(Resource):
                 item.update({"partial_member_list": partial_members_map.get(item["id"], [])})
             else:
                 item.update({"partial_member_list": []})
+            item["permission_keys"] = permission_keys_map.get(str(item["id"]), [])
 
         response = {
             "data": data,
@@ -473,6 +532,9 @@ class DatasetListApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(
+        RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT, resource_required=False
+    )
     @cloud_edition_billing_rate_limit_check("knowledge")
     @with_current_user
     @with_current_tenant_id
@@ -483,6 +545,11 @@ class DatasetListApi(Resource):
         if not current_user.is_dataset_editor:
             raise Forbidden()
 
+        if dify_config.RBAC_ENABLED:
+            permission = DatasetPermissionEnum.ALL_TEAM
+        else:
+            permission = payload.permission or DatasetPermissionEnum.ONLY_ME
+
         try:
             dataset = DatasetService.create_empty_dataset(
                 tenant_id=current_tenant_id,
@@ -490,7 +557,7 @@ class DatasetListApi(Resource):
                 description=payload.description,
                 indexing_technique=payload.indexing_technique,
                 account=current_user,
-                permission=payload.permission or DatasetPermissionEnum.ONLY_ME,
+                permission=permission,
                 provider=payload.provider,
                 external_knowledge_api_id=payload.external_knowledge_api_id,
                 external_knowledge_id=payload.external_knowledge_id,
@@ -498,7 +565,17 @@ class DatasetListApi(Resource):
         except services.errors.dataset.DatasetNameDuplicateError:
             raise DatasetNameDuplicateError()
 
-        return dump_response(DatasetDetailResponse, dataset), 201
+        permission_keys_map = enterprise_rbac_service.RBACService.DatasetPermissions.batch_get(
+            str(current_tenant_id),
+            current_user.id,
+            [str(dataset.id)],
+        )
+
+        item = DatasetDetailWithPartialMembersResponse.model_validate(dataset, from_attributes=True).model_dump(
+            mode="json"
+        )
+        item["permission_keys"] = permission_keys_map.get(str(dataset.id), [])
+        return item, 201
 
 
 @console_ns.route("/datasets/<uuid:dataset_id>")
@@ -516,6 +593,7 @@ class DatasetApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     @with_current_user
     @with_current_tenant_id
     def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID):
@@ -527,7 +605,14 @@ class DatasetApi(Resource):
             DatasetService.check_dataset_permission(dataset, current_user)
         except services.errors.account.NoPermissionError as e:
             raise Forbidden(str(e))
+        permissions = enterprise_rbac_service.RBACService.MyPermissions.get(
+            str(current_tenant_id),
+            current_user.id,
+            dataset_id=dataset_id_str,
+        )
+        permission_keys_map = permissions.dataset.permission_keys_by_resource_ids([dataset_id_str])
         data = dump_response(DatasetDetailResponse, dataset)
+        data["permission_keys"] = permission_keys_map.get(dataset_id_str, [])
         if dataset.indexing_technique == IndexTechniqueType.HIGH_QUALITY:
             if dataset.embedding_model_provider:
                 provider_id = ModelProviderID(dataset.embedding_model_provider)
@@ -573,6 +658,7 @@ class DatasetApi(Resource):
     @cloud_edition_billing_rate_limit_check("knowledge")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(self, current_tenant_id: str, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -592,16 +678,23 @@ class DatasetApi(Resource):
             payload.is_multimodal = is_multimodal
         payload_data = payload.model_dump(exclude_unset=True)
         # The role of the current user in the ta table must be admin, owner, editor, or dataset_operator
-        DatasetPermissionService.check_permission(
-            current_user, dataset, payload.permission, payload.partial_member_list
-        )
+        if not dify_config.RBAC_ENABLED:
+            DatasetPermissionService.check_permission(
+                current_user, dataset, payload.permission, payload.partial_member_list
+            )
 
         dataset = DatasetService.update_dataset(dataset_id_str, payload_data, current_user)
 
         if dataset is None:
             raise NotFound("Dataset not found.")
 
+        permission_keys_map = enterprise_rbac_service.RBACService.DatasetPermissions.batch_get(
+            str(current_tenant_id),
+            current_user.id,
+            [dataset_id_str],
+        )
         result_data = dump_response(DatasetDetailResponse, dataset)
+        result_data["permission_keys"] = permission_keys_map.get(dataset_id_str, [])
         tenant_id = current_tenant_id
 
         if payload.partial_member_list is not None and payload.permission == DatasetPermissionEnum.PARTIAL_TEAM:
@@ -621,6 +714,7 @@ class DatasetApi(Resource):
     @cloud_edition_billing_rate_limit_check("knowledge")
     @console_ns.response(204, "Dataset deleted successfully")
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def delete(self, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
 
@@ -650,6 +744,7 @@ class DatasetUseCheckApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
 
@@ -671,6 +766,7 @@ class DatasetQueryApi(Resource):
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -811,6 +907,7 @@ class DatasetRelatedAppListApi(Resource):
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -847,6 +944,7 @@ class DatasetIndexingStatusApi(Resource):
     @login_required
     @account_initialization_required
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, current_tenant_id: str, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         documents = db.session.scalars(
@@ -916,6 +1014,7 @@ class DatasetApiKeyApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_API_KEY_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str):
@@ -956,6 +1055,7 @@ class DatasetApiDeleteApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_API_KEY_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def delete(self, current_tenant_id: str, api_key_id: UUID):
@@ -990,6 +1090,7 @@ class DatasetEnableApiApi(Resource):
     @login_required
     @account_initialization_required
     @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, dataset_id: UUID, status: str):
         dataset_id_str = str(dataset_id)
 
@@ -1059,6 +1160,7 @@ class DatasetErrorDocs(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -1085,6 +1187,7 @@ class DatasetPermissionUserListApi(Resource):
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -1114,6 +1217,7 @@ class DatasetAutoDisableLogApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
diff --git a/api/controllers/console/datasets/datasets_document.py b/api/controllers/console/datasets/datasets_document.py
index d4d50600a09..07e150617bf 100644
--- a/api/controllers/console/datasets/datasets_document.py
+++ b/api/controllers/console/datasets/datasets_document.py
@@ -19,6 +19,7 @@ from controllers.common.controller_schemas import DocumentBatchDownloadZipPayloa
 from controllers.common.fields import BinaryFileResponse, SimpleResultMessageResponse, SimpleResultResponse, UrlResponse
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
+from controllers.console.wraps import RBACPermission, RBACResourceScope, rbac_permission_required
 from core.errors.error import (
     LLMBadRequestError,
     ModelCurrentlyNotSupportError,
@@ -289,6 +290,7 @@ class DatasetDocumentListApi(Resource):
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         raw_args = request.args.to_dict()
@@ -415,6 +417,7 @@ class DatasetDocumentListApi(Resource):
     @console_ns.expect(console_ns.models[KnowledgeConfig.__name__])
     @console_ns.response(200, "Documents created successfully", console_ns.models[DatasetAndDocumentResponse.__name__])
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
 
@@ -458,6 +461,7 @@ class DatasetDocumentListApi(Resource):
     @account_initialization_required
     @cloud_edition_billing_rate_limit_check("knowledge")
     @console_ns.response(204, "Documents deleted successfully")
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def delete(self, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -555,6 +559,7 @@ class DocumentIndexingEstimateApi(DocumentResource):
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
         dataset_id_str = str(dataset_id)
         document_id_str = str(document_id)
@@ -626,6 +631,7 @@ class DocumentBatchIndexingEstimateApi(DocumentResource):
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, batch: str):
         dataset_id_str = str(dataset_id)
         documents = self.get_batch_documents(dataset_id_str, batch, current_user)
@@ -726,6 +732,7 @@ class DocumentBatchIndexingStatusApi(DocumentResource):
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, current_user: Account, dataset_id: UUID, batch: str):
         dataset_id_str = str(dataset_id)
         documents = self.get_batch_documents(dataset_id_str, batch, current_user)
@@ -783,6 +790,7 @@ class DocumentIndexingStatusApi(DocumentResource):
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
         dataset_id_str = str(dataset_id)
         document_id_str = str(document_id)
@@ -846,6 +854,7 @@ class DocumentApi(DocumentResource):
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
         dataset_id_str = str(dataset_id)
         document_id_str = str(document_id)
@@ -937,6 +946,7 @@ class DocumentApi(DocumentResource):
     @console_ns.response(204, "Document deleted successfully")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def delete(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
         dataset_id_str = str(dataset_id)
         document_id_str = str(document_id)
@@ -969,6 +979,7 @@ class DocumentDownloadApi(DocumentResource):
     @cloud_edition_billing_rate_limit_check("knowledge")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_DOCUMENT_DOWNLOAD)
     def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID) -> dict[str, Any]:
         # Reuse the shared permission/tenant checks implemented in DocumentResource.
         document = self.get_document(str(dataset_id), str(document_id), current_user, current_tenant_id)
@@ -989,6 +1000,7 @@ class DocumentBatchDownloadZipApi(DocumentResource):
     @console_ns.expect(console_ns.models[DocumentBatchDownloadZipPayload.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_tenant_id: str, current_user: Account, dataset_id: UUID):
         """Stream a ZIP archive containing the requested uploaded documents."""
         # Parse and validate request payload.
@@ -1037,6 +1049,7 @@ class DocumentProcessingApi(DocumentResource):
     @cloud_edition_billing_rate_limit_check("knowledge")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(
         self,
         current_tenant_id: str,
@@ -1093,6 +1106,7 @@ class DocumentMetadataApi(DocumentResource):
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def put(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
         dataset_id_str = str(dataset_id)
         document_id_str = str(document_id)
@@ -1142,6 +1156,7 @@ class DocumentStatusApi(DocumentResource):
     @cloud_edition_billing_rate_limit_check("knowledge")
     @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(
         self, current_user: Account, dataset_id: UUID, action: Literal["enable", "disable", "archive", "un_archive"]
     ):
@@ -1181,6 +1196,7 @@ class DocumentPauseApi(DocumentResource):
     @account_initialization_required
     @cloud_edition_billing_rate_limit_check("knowledge")
     @console_ns.response(204, "Document paused successfully")
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(self, dataset_id: UUID, document_id: UUID):
         """pause document."""
         dataset_id_str = str(dataset_id)
@@ -1216,6 +1232,7 @@ class DocumentRecoverApi(DocumentResource):
     @account_initialization_required
     @cloud_edition_billing_rate_limit_check("knowledge")
     @console_ns.response(204, "Document resumed successfully")
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(self, dataset_id: UUID, document_id: UUID):
         """recover document."""
         dataset_id_str = str(dataset_id)
@@ -1249,6 +1266,7 @@ class DocumentRetryApi(DocumentResource):
     @cloud_edition_billing_rate_limit_check("knowledge")
     @console_ns.expect(console_ns.models[DocumentRetryPayload.__name__])
     @console_ns.response(204, "Documents retry started successfully")
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, dataset_id: UUID):
         """retry document."""
         payload = DocumentRetryPayload.model_validate(console_ns.payload or {})
@@ -1290,6 +1308,7 @@ class DocumentRenameApi(DocumentResource):
     @console_ns.response(200, "Document renamed successfully", console_ns.models[DocumentResponse.__name__])
     @console_ns.expect(console_ns.models[DocumentRenamePayload.__name__])
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_user: Account, dataset_id: UUID, document_id: UUID):
         # The role of the current user in the ta table must be admin, owner, editor, or dataset_operator
         if not current_user.is_dataset_editor:
@@ -1315,6 +1334,7 @@ class WebsiteDocumentSyncApi(DocumentResource):
     @account_initialization_required
     @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, current_tenant_id: str, dataset_id: UUID, document_id: UUID):
         """sync website document."""
         dataset_id_str = str(dataset_id)
@@ -1348,6 +1368,7 @@ class DocumentPipelineExecutionLogApi(DocumentResource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, dataset_id: UUID, document_id: UUID):
         dataset_id_str = str(dataset_id)
         document_id_str = str(document_id)
@@ -1398,6 +1419,7 @@ class DocumentGenerateSummaryApi(Resource):
     @account_initialization_required
     @cloud_edition_billing_rate_limit_check("knowledge")
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_user: Account, dataset_id: UUID):
         """
         Generate summary index for specified documents.
@@ -1491,6 +1513,7 @@ class DocumentSummaryStatusApi(DocumentResource):
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, current_user: Account, dataset_id: UUID, document_id: UUID):
         """
         Get summary index generation status for a document.
diff --git a/api/controllers/console/datasets/datasets_segments.py b/api/controllers/console/datasets/datasets_segments.py
index 4e521100abe..4858b5ff6b0 100644
--- a/api/controllers/console/datasets/datasets_segments.py
+++ b/api/controllers/console/datasets/datasets_segments.py
@@ -28,10 +28,13 @@ from controllers.console.datasets.error import (
     InvalidActionError,
 )
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     cloud_edition_billing_knowledge_limit_check,
     cloud_edition_billing_rate_limit_check,
     cloud_edition_billing_resource_check,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -169,6 +172,7 @@ class DatasetDocumentSegmentListApi(Resource):
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
         dataset_id_str = str(dataset_id)
         document_id_str = str(document_id)
@@ -278,6 +282,7 @@ class DatasetDocumentSegmentListApi(Resource):
     @console_ns.doc(params=query_params_from_model(SegmentIdListQuery))
     @console_ns.response(204, "Segments deleted successfully")
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def delete(self, current_user: Account, dataset_id: UUID, document_id: UUID):
         # check dataset
         dataset_id_str = str(dataset_id)
@@ -316,6 +321,7 @@ class DatasetDocumentSegmentApi(Resource):
     @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(
         self,
         current_tenant_id: str,
@@ -384,6 +390,7 @@ class DatasetDocumentSegmentAddApi(Resource):
     @console_ns.response(200, "Segment created successfully", console_ns.models[SegmentDetailResponse.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
         # check dataset
         dataset_id_str = str(dataset_id)
@@ -442,6 +449,7 @@ class DatasetDocumentSegmentUpdateApi(Resource):
     @console_ns.response(200, "Segment updated successfully", console_ns.models[SegmentDetailResponse.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(
         self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID, segment_id: UUID
     ):
@@ -513,6 +521,7 @@ class DatasetDocumentSegmentUpdateApi(Resource):
     @console_ns.response(204, "Segment deleted successfully")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def delete(
         self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID, segment_id: UUID
     ):
@@ -563,6 +572,7 @@ class DatasetDocumentSegmentBatchImportApi(Resource):
     @console_ns.expect(console_ns.models[BatchImportPayload.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID):
         # check dataset
         dataset_id_str = str(dataset_id)
@@ -608,6 +618,7 @@ class DatasetDocumentSegmentBatchImportApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, job_id=None, dataset_id: UUID | None = None, document_id: UUID | None = None):
         if job_id is None:
             raise NotFound("The job does not exist.")
@@ -634,6 +645,7 @@ class ChildChunkAddApi(Resource):
     @console_ns.response(200, "Child chunk created successfully", console_ns.models[ChildChunkDetailResponse.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(
         self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID, segment_id: UUID
     ):
@@ -693,6 +705,7 @@ class ChildChunkAddApi(Resource):
     @login_required
     @account_initialization_required
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, current_tenant_id: str, dataset_id: UUID, document_id: UUID, segment_id: UUID):
         # check dataset
         dataset_id_str = str(dataset_id)
@@ -747,6 +760,7 @@ class ChildChunkAddApi(Resource):
     @console_ns.expect(console_ns.models[ChildChunkBatchUpdatePayload.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(
         self, current_tenant_id: str, current_user: Account, dataset_id: UUID, document_id: UUID, segment_id: UUID
     ):
@@ -799,6 +813,7 @@ class ChildChunkUpdateApi(Resource):
     @console_ns.response(204, "Child chunk deleted successfully")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def delete(
         self,
         current_tenant_id: str,
@@ -866,6 +881,7 @@ class ChildChunkUpdateApi(Resource):
     @console_ns.response(200, "Child chunk updated successfully", console_ns.models[ChildChunkDetailResponse.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(
         self,
         current_tenant_id: str,
diff --git a/api/controllers/console/datasets/external.py b/api/controllers/console/datasets/external.py
index fb19ad81c67..033c9a69af6 100644
--- a/api/controllers/console/datasets/external.py
+++ b/api/controllers/console/datasets/external.py
@@ -17,8 +17,11 @@ from controllers.common.schema import (
 from controllers.console import console_ns
 from controllers.console.datasets.error import DatasetNameDuplicateError
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -40,6 +43,7 @@ from fields.dataset_fields import (
 from libs.login import login_required
 from models import Account
 from services.dataset_service import DatasetService
+from services.enterprise import rbac_service as enterprise_rbac_service
 from services.external_knowledge_service import ExternalDatasetService
 from services.hit_testing_service import HitTestingService
 from services.knowledge_service import BedrockRetrievalSetting, ExternalDatasetTestService
@@ -319,6 +323,7 @@ class ExternalDatasetCreateApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EXTERNAL_CONNECT)
     @with_current_user
     @with_current_tenant_id
     def post(self, current_tenant_id: str, current_user: Account):
@@ -339,7 +344,16 @@ class ExternalDatasetCreateApi(Resource):
         except services.errors.dataset.DatasetNameDuplicateError:
             raise DatasetNameDuplicateError()
 
-        return marshal(dataset, dataset_detail_fields), 201
+        item = marshal(dataset, dataset_detail_fields)
+        dataset_id_str = item["id"]
+        permission_keys_map = enterprise_rbac_service.RBACService.DatasetPermissions.batch_get(
+            str(current_tenant_id),
+            current_user.id,
+            [dataset_id_str],
+        )
+        item["permission_keys"] = permission_keys_map.get(dataset_id_str, [])
+
+        return item, 201
 
 
 @console_ns.route("/datasets/<uuid:dataset_id>/external-hit-testing")
@@ -359,6 +373,7 @@ class ExternalKnowledgeHitTestingApi(Resource):
     @login_required
     @account_initialization_required
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_PIPELINE_TEST)
     def post(self, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
diff --git a/api/controllers/console/datasets/hit_testing.py b/api/controllers/console/datasets/hit_testing.py
index c08ed2fe9f0..739f0250333 100644
--- a/api/controllers/console/datasets/hit_testing.py
+++ b/api/controllers/console/datasets/hit_testing.py
@@ -5,6 +5,7 @@ from uuid import UUID
 from flask_restx import Resource
 
 from controllers.common.schema import register_response_schema_models, register_schema_models
+from controllers.console.wraps import RBACPermission, RBACResourceScope, rbac_permission_required
 from fields.hit_testing_fields import HitTestingResponse
 from libs.helper import dump_response
 from libs.login import login_required
@@ -43,6 +44,7 @@ class HitTestingApi(Resource, DatasetsHitTestingBase):
     @cloud_edition_billing_rate_limit_check("knowledge")
     @with_current_tenant_id
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_PIPELINE_TEST)
     def post(self, current_user: Account, current_tenant_id: str, dataset_id: UUID) -> dict[str, object]:
         dataset_id_str = str(dataset_id)
 
diff --git a/api/controllers/console/datasets/hit_testing_base.py b/api/controllers/console/datasets/hit_testing_base.py
index e3efe804872..4e90e66eb25 100644
--- a/api/controllers/console/datasets/hit_testing_base.py
+++ b/api/controllers/console/datasets/hit_testing_base.py
@@ -23,17 +23,26 @@ from libs.login import resolve_account_fallback
 from models.account import Account
 from models.dataset import Dataset
 from services.dataset_service import DatasetService
-from services.entities.knowledge_entities.knowledge_entities import RetrievalModel
+from services.entities.knowledge_entities.knowledge_entities import ExternalRetrievalModel, RetrievalModel
 from services.hit_testing_service import HitTestingService
 
 logger = logging.getLogger(__name__)
 
 
 class HitTestingPayload(BaseModel):
-    query: str = Field(max_length=250)
-    retrieval_model: RetrievalModel | None = None
-    external_retrieval_model: dict[str, Any] | None = Field(default=None)
-    attachment_ids: list[str] | None = None
+    query: str = Field(description="Search query text.", max_length=250)
+    retrieval_model: RetrievalModel | None = Field(
+        default=None,
+        description="Retrieval model configuration. Controls how chunks are searched and ranked.",
+    )
+    external_retrieval_model: ExternalRetrievalModel = Field(
+        default=None,
+        description="Retrieval settings for external knowledge bases.",
+    )
+    attachment_ids: list[str] | None = Field(
+        default=None,
+        description="List of attachment IDs to include in the retrieval context.",
+    )
 
 
 class DatasetsHitTestingBase:
diff --git a/api/controllers/console/datasets/metadata.py b/api/controllers/console/datasets/metadata.py
index ec4c5bedb61..7195fe066fd 100644
--- a/api/controllers/console/datasets/metadata.py
+++ b/api/controllers/console/datasets/metadata.py
@@ -8,8 +8,11 @@ from controllers.common.controller_schemas import MetadataUpdatePayload
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     enterprise_license_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -52,6 +55,7 @@ class DatasetMetadataCreateApi(Resource):
     @console_ns.expect(console_ns.models[MetadataArgs.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_tenant_id: str, current_user: Account, dataset_id: UUID):
         metadata_args = MetadataArgs.model_validate(console_ns.payload or {})
 
@@ -71,6 +75,7 @@ class DatasetMetadataCreateApi(Resource):
     @console_ns.response(
         200, "Metadata retrieved successfully", console_ns.models[DatasetMetadataListResponse.__name__]
     )
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT)
     def get(self, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -90,6 +95,7 @@ class DatasetMetadataApi(Resource):
     @console_ns.expect(console_ns.models[MetadataUpdatePayload.__name__])
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def patch(self, current_tenant_id: str, current_user: Account, dataset_id: UUID, metadata_id: UUID):
         payload = MetadataUpdatePayload.model_validate(console_ns.payload or {})
         name = payload.name
@@ -112,6 +118,7 @@ class DatasetMetadataApi(Resource):
     @enterprise_license_required
     @console_ns.response(204, "Metadata deleted successfully")
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def delete(self, current_user: Account, dataset_id: UUID, metadata_id: UUID):
         dataset_id_str = str(dataset_id)
         metadata_id_str = str(metadata_id)
@@ -149,6 +156,7 @@ class DatasetMetadataBuiltInFieldActionApi(Resource):
     @enterprise_license_required
     @console_ns.response(204, "Action completed successfully")
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_user: Account, dataset_id: UUID, action: Literal["enable", "disable"]):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
@@ -177,6 +185,7 @@ class DocumentMetadataEditApi(Resource):
         "Documents metadata updated successfully",
     )
     @with_current_user
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_user: Account, dataset_id: UUID):
         dataset_id_str = str(dataset_id)
         dataset = DatasetService.get_dataset(dataset_id_str)
diff --git a/api/controllers/console/datasets/rag_pipeline/datasource_auth.py b/api/controllers/console/datasets/rag_pipeline/datasource_auth.py
index 980f116e216..c5ca1d155de 100644
--- a/api/controllers/console/datasets/rag_pipeline/datasource_auth.py
+++ b/api/controllers/console/datasets/rag_pipeline/datasource_auth.py
@@ -10,8 +10,11 @@ from controllers.common.fields import RedirectResponse, SimpleResultResponse
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -104,6 +107,7 @@ class DatasourcePluginOAuthAuthorizationUrl(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     def get(self, current_tenant_id: str, current_user: Account, provider_id: str):
@@ -218,6 +222,7 @@ class DatasourceAuth(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider_id: str):
         payload = DatasourceCredentialPayload.model_validate(console_ns.payload or {})
@@ -262,6 +267,7 @@ class DatasourceAuthDeleteApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider_id: str):
         datasource_provider_id = DatasourceProviderID(provider_id)
@@ -287,6 +293,7 @@ class DatasourceAuthUpdateApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider_id: str):
         datasource_provider_id = DatasourceProviderID(provider_id)
@@ -338,6 +345,7 @@ class DatasourceAuthOauthCustomClient(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider_id: str):
         payload = DatasourceCustomClientPayload.model_validate(console_ns.payload or {})
@@ -374,6 +382,7 @@ class DatasourceAuthDefaultApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider_id: str):
         payload = DatasourceDefaultPayload.model_validate(console_ns.payload or {})
@@ -395,6 +404,7 @@ class DatasourceUpdateProviderNameApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider_id: str):
         payload = DatasourceUpdateNamePayload.model_validate(console_ns.payload or {})
diff --git a/api/controllers/console/datasets/rag_pipeline/rag_pipeline_import.py b/api/controllers/console/datasets/rag_pipeline/rag_pipeline_import.py
index e0c8d95b766..0b83dc9312d 100644
--- a/api/controllers/console/datasets/rag_pipeline/rag_pipeline_import.py
+++ b/api/controllers/console/datasets/rag_pipeline/rag_pipeline_import.py
@@ -13,8 +13,11 @@ from controllers.common.schema import (
 from controllers.console import console_ns
 from controllers.console.datasets.wraps import get_rag_pipeline
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_user,
 )
@@ -78,6 +81,9 @@ class RagPipelineImportApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT, resource_required=False
+    )
     @with_current_user
     def post(self, current_user: Account) -> JsonResponseWithStatus:
         # Check user role first
@@ -122,6 +128,9 @@ class RagPipelineImportConfirmApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT, resource_required=False
+    )
     @with_current_user
     def post(self, current_user: Account, import_id: str) -> JsonResponseWithStatus:
         with Session(db.engine, expire_on_commit=False) as session:
@@ -151,6 +160,7 @@ class RagPipelineImportCheckDependenciesApi(Resource):
     @get_rag_pipeline
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_READONLY)
     def get(self, pipeline: Pipeline) -> JsonResponseWithStatus:
         with Session(db.engine, expire_on_commit=False) as session:
             import_service = RagPipelineDslService(session)
@@ -168,6 +178,7 @@ class RagPipelineExportApi(Resource):
     @get_rag_pipeline
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_IMPORT_EXPORT_DSL)
     def get(self, pipeline: Pipeline) -> JsonResponseWithStatus:
         # Add include_secret params
         query = IncludeSecretQuery.model_validate(request.args.to_dict())
diff --git a/api/controllers/console/datasets/rag_pipeline/rag_pipeline_workflow.py b/api/controllers/console/datasets/rag_pipeline/rag_pipeline_workflow.py
index 7c941e14368..fdc55ea9737 100644
--- a/api/controllers/console/datasets/rag_pipeline/rag_pipeline_workflow.py
+++ b/api/controllers/console/datasets/rag_pipeline/rag_pipeline_workflow.py
@@ -28,8 +28,11 @@ from controllers.console.app.workflow import (
 )
 from controllers.console.datasets.wraps import get_rag_pipeline
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -186,6 +189,7 @@ class DraftRagPipelineApi(Resource):
     @account_initialization_required
     @get_rag_pipeline
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def get(self, pipeline: Pipeline):
         """
         Get draft rag pipeline's workflow
@@ -206,6 +210,7 @@ class DraftRagPipelineApi(Resource):
     @with_current_user
     @get_rag_pipeline
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @console_ns.expect(console_ns.models[DraftWorkflowSyncPayload.__name__])
     @console_ns.response(200, "Success", console_ns.models[RagPipelineWorkflowSyncResponse.__name__])
     def post(self, current_user: Account, pipeline: Pipeline):
@@ -266,6 +271,7 @@ class RagPipelineDraftRunIterationNodeApi(Resource):
     @with_current_user
     @get_rag_pipeline
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_user: Account, pipeline: Pipeline, node_id: str):
         """
         Run draft workflow iteration node
@@ -298,6 +304,7 @@ class RagPipelineDraftRunLoopNodeApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @with_current_user
     @get_rag_pipeline
     def post(self, current_user: Account, pipeline: Pipeline, node_id: str):
@@ -332,6 +339,7 @@ class DraftRagPipelineRunApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @with_current_user
     @get_rag_pipeline
     def post(self, current_user: Account, pipeline: Pipeline):
@@ -363,6 +371,7 @@ class PublishedRagPipelineRunApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @with_current_user
     @get_rag_pipeline
     def post(self, current_user: Account, pipeline: Pipeline):
@@ -395,6 +404,7 @@ class RagPipelinePublishedDatasourceNodeRunApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @with_current_user
     @get_rag_pipeline
     def post(self, current_user: Account, pipeline: Pipeline, node_id: str):
@@ -426,6 +436,7 @@ class RagPipelineDraftDatasourceNodeRunApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @account_initialization_required
     @with_current_user
     @get_rag_pipeline
@@ -462,6 +473,7 @@ class RagPipelineDraftNodeRunApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @account_initialization_required
     @with_current_user
     @get_rag_pipeline
@@ -491,6 +503,7 @@ class RagPipelineTaskStopApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @account_initialization_required
     @with_current_user
     @get_rag_pipeline
@@ -514,6 +527,7 @@ class PublishedRagPipelineApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @get_rag_pipeline
     def get(self, pipeline: Pipeline):
         """
@@ -537,6 +551,7 @@ class PublishedRagPipelineApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @with_current_user
     @get_rag_pipeline
     def post(self, current_user: Account, pipeline: Pipeline):
@@ -571,6 +586,7 @@ class DefaultRagPipelineBlockConfigsApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @get_rag_pipeline
     def get(self, pipeline: Pipeline):
         """
@@ -593,6 +609,7 @@ class DefaultRagPipelineBlockConfigApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @get_rag_pipeline
     def get(self, pipeline: Pipeline, block_type: str):
         """
@@ -625,6 +642,7 @@ class PublishedAllRagPipelineApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @with_current_user
     @get_rag_pipeline
     def get(self, current_user: Account, pipeline: Pipeline):
@@ -670,6 +688,7 @@ class RagPipelineDraftWorkflowRestoreApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @with_current_user
     @get_rag_pipeline
     def post(self, current_user: Account, pipeline: Pipeline, workflow_id: str):
@@ -704,6 +723,7 @@ class RagPipelineByIdApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @with_current_user
     @get_rag_pipeline
     @console_ns.expect(console_ns.models[WorkflowUpdatePayload.__name__])
@@ -739,6 +759,7 @@ class RagPipelineByIdApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     @get_rag_pipeline
     def delete(self, pipeline: Pipeline, workflow_id: str):
         """
@@ -775,6 +796,7 @@ class PublishedRagPipelineSecondStepApi(Resource):
     @account_initialization_required
     @get_rag_pipeline
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def get(self, pipeline: Pipeline):
         """
         Get second step parameters of rag pipeline
@@ -797,6 +819,7 @@ class PublishedRagPipelineFirstStepApi(Resource):
     @account_initialization_required
     @get_rag_pipeline
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def get(self, pipeline: Pipeline):
         """
         Get first step parameters of rag pipeline
@@ -819,6 +842,7 @@ class DraftRagPipelineFirstStepApi(Resource):
     @account_initialization_required
     @get_rag_pipeline
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def get(self, pipeline: Pipeline):
         """
         Get first step parameters of rag pipeline
@@ -841,6 +865,7 @@ class DraftRagPipelineSecondStepApi(Resource):
     @account_initialization_required
     @get_rag_pipeline
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def get(self, pipeline: Pipeline):
         """
         Get second step parameters of rag pipeline
@@ -1012,6 +1037,7 @@ class RagPipelineDatasourceVariableApi(Resource):
     @with_current_user
     @get_rag_pipeline
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
     def post(self, current_user: Account, pipeline: Pipeline):
         """
         Set datasource variables
diff --git a/api/controllers/console/explore/installed_app.py b/api/controllers/console/explore/installed_app.py
index 14837897502..c1fa1378ffa 100644
--- a/api/controllers/console/explore/installed_app.py
+++ b/api/controllers/console/explore/installed_app.py
@@ -73,9 +73,12 @@ def _published_app_filter():
     has_published_workflow = exists(select(Workflow.id).where(Workflow.id == App.workflow_id))
     has_published_model_config = exists(select(AppModelConfig.id).where(AppModelConfig.id == App.app_model_config_id))
 
-    return or_(
-        and_(App.mode.in_(workflow_app_modes), App.workflow_id.isnot(None), has_published_workflow),
-        and_(~App.mode.in_(workflow_app_modes), App.app_model_config_id.isnot(None), has_published_model_config),
+    return and_(
+        App.mode != AppMode.AGENT,
+        or_(
+            and_(App.mode.in_(workflow_app_modes), App.workflow_id.isnot(None), has_published_workflow),
+            and_(~App.mode.in_(workflow_app_modes), App.app_model_config_id.isnot(None), has_published_model_config),
+        ),
     )
 
 
diff --git a/api/controllers/console/explore/saved_message.py b/api/controllers/console/explore/saved_message.py
index 3e8f1ce9083..ce43ff18c93 100644
--- a/api/controllers/console/explore/saved_message.py
+++ b/api/controllers/console/explore/saved_message.py
@@ -11,6 +11,7 @@ from controllers.console.app.error import AppUnavailableError
 from controllers.console.explore.error import NotCompletionAppError
 from controllers.console.explore.wraps import InstalledAppResource
 from controllers.console.wraps import with_current_user
+from extensions.ext_database import db
 from fields.conversation_fields import ResultResponse
 from fields.message_fields import SavedMessageInfiniteScrollPagination, SavedMessageItem
 from models import Account
@@ -37,6 +38,7 @@ class SavedMessageListApi(InstalledAppResource):
         args = SavedMessageListQuery.model_validate(request.args.to_dict())
 
         pagination = SavedMessageService.pagination_by_last_id(
+            db.session(),
             app_model,
             current_user,
             str(args.last_id) if args.last_id else None,
@@ -63,7 +65,7 @@ class SavedMessageListApi(InstalledAppResource):
         payload = SavedMessageCreatePayload.model_validate(console_ns.payload or {})
 
         try:
-            SavedMessageService.save(app_model, current_user, str(payload.message_id))
+            SavedMessageService.save(db.session(), app_model, current_user, str(payload.message_id))
         except MessageNotExistsError:
             raise NotFound("Message Not Exists.")
 
@@ -86,6 +88,6 @@ class SavedMessageApi(InstalledAppResource):
         if app_model.mode != "completion":
             raise NotCompletionAppError()
 
-        SavedMessageService.delete(app_model, current_user, message_id_str)
+        SavedMessageService.delete(db.session(), app_model, current_user, message_id_str)
 
         return "", 204
diff --git a/api/controllers/console/extension.py b/api/controllers/console/extension.py
index 6d9362ae0b1..ec1e01dc460 100644
--- a/api/controllers/console/extension.py
+++ b/api/controllers/console/extension.py
@@ -7,6 +7,7 @@ from flask_restx import Resource
 from pydantic import BaseModel, Field, TypeAdapter, field_validator
 
 from constants import HIDDEN_VALUE
+from extensions.ext_database import db
 from fields.base import ResponseModel
 from libs.helper import to_timestamp
 from libs.login import login_required
@@ -126,7 +127,7 @@ class APIBasedExtensionAPI(Resource):
     def get(self, current_tenant_id: str):
         return [
             _serialize_api_based_extension(extension)
-            for extension in APIBasedExtensionService.get_all_by_tenant_id(current_tenant_id)
+            for extension in APIBasedExtensionService.get_all_by_tenant_id(db.session(), current_tenant_id)
         ]
 
     @console_ns.doc("create_api_based_extension")
@@ -147,7 +148,12 @@ class APIBasedExtensionAPI(Resource):
             api_key=payload.api_key,
         )
 
-        return _serialize_saved_api_based_extension(APIBasedExtensionService.save(extension_data), payload.api_key), 201
+        return (
+            _serialize_saved_api_based_extension(
+                APIBasedExtensionService.save(db.session(), extension_data), payload.api_key
+            ),
+            201,
+        )
 
 
 @console_ns.route("/api-based-extension/<uuid:id>")
@@ -164,7 +170,7 @@ class APIBasedExtensionDetailAPI(Resource):
         api_based_extension_id = str(id)
 
         return _serialize_api_based_extension(
-            APIBasedExtensionService.get_with_tenant_id(current_tenant_id, api_based_extension_id)
+            APIBasedExtensionService.get_with_tenant_id(db.session(), current_tenant_id, api_based_extension_id)
         )
 
     @console_ns.doc("update_api_based_extension")
@@ -179,7 +185,9 @@ class APIBasedExtensionDetailAPI(Resource):
     def post(self, current_tenant_id: str, id: UUID):
         api_based_extension_id = str(id)
 
-        extension_data_from_db = APIBasedExtensionService.get_with_tenant_id(current_tenant_id, api_based_extension_id)
+        extension_data_from_db = APIBasedExtensionService.get_with_tenant_id(
+            db.session(), current_tenant_id, api_based_extension_id
+        )
 
         payload = APIBasedExtensionPayload.model_validate(console_ns.payload or {})
         api_key_for_response = extension_data_from_db.api_key
@@ -192,7 +200,7 @@ class APIBasedExtensionDetailAPI(Resource):
             api_key_for_response = payload.api_key
 
         return _serialize_saved_api_based_extension(
-            APIBasedExtensionService.save(extension_data_from_db),
+            APIBasedExtensionService.save(db.session(), extension_data_from_db),
             api_key_for_response,
         )
 
@@ -207,8 +215,10 @@ class APIBasedExtensionDetailAPI(Resource):
     def delete(self, current_tenant_id: str, id: UUID):
         api_based_extension_id = str(id)
 
-        extension_data_from_db = APIBasedExtensionService.get_with_tenant_id(current_tenant_id, api_based_extension_id)
+        extension_data_from_db = APIBasedExtensionService.get_with_tenant_id(
+            db.session(), current_tenant_id, api_based_extension_id
+        )
 
-        APIBasedExtensionService.delete(extension_data_from_db)
+        APIBasedExtensionService.delete(db.session(), extension_data_from_db)
 
         return "", 204
diff --git a/api/controllers/console/snippets/snippet_workflow.py b/api/controllers/console/snippets/snippet_workflow.py
index 243c29e6719..5af885ab91b 100644
--- a/api/controllers/console/snippets/snippet_workflow.py
+++ b/api/controllers/console/snippets/snippet_workflow.py
@@ -31,8 +31,11 @@ from controllers.console.snippets.payloads import (
     WorkflowRunQuery,
 )
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_user,
 )
@@ -154,6 +157,7 @@ class SnippetDraftWorkflowApi(Resource):
     @account_initialization_required
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_MANAGE, resource_required=False)
     def get(self, snippet: CustomizedSnippet):
         """Get draft workflow for snippet."""
         snippet_service = _snippet_service()
@@ -181,6 +185,9 @@ class SnippetDraftWorkflowApi(Resource):
     @with_current_user
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def post(self, current_user: Account, snippet: CustomizedSnippet):
         """Sync draft workflow for snippet."""
         payload = SnippetDraftSyncPayload.model_validate(console_ns.payload or {})
@@ -219,6 +226,7 @@ class SnippetDraftConfigApi(Resource):
     @account_initialization_required
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_MANAGE, resource_required=False)
     def get(self, snippet: CustomizedSnippet):
         """Get snippet draft workflow configuration limits."""
         return {
@@ -240,6 +248,7 @@ class SnippetPublishedWorkflowApi(Resource):
     @account_initialization_required
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_MANAGE, resource_required=False)
     def get(self, snippet: CustomizedSnippet):
         """Get published workflow for snippet."""
         if not snippet.is_published:
@@ -265,6 +274,9 @@ class SnippetPublishedWorkflowApi(Resource):
     @with_current_user
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def post(self, current_user: Account, snippet: CustomizedSnippet):
         """Publish snippet workflow."""
         snippet_service = _snippet_service()
@@ -301,6 +313,7 @@ class SnippetDefaultBlockConfigsApi(Resource):
     @account_initialization_required
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_MANAGE, resource_required=False)
     def get(self, snippet: CustomizedSnippet):
         """Get default block configurations for snippet workflow."""
         snippet_service = _snippet_service()
@@ -323,6 +336,7 @@ class SnippetPublishedAllWorkflowApi(Resource):
     @account_initialization_required
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_MANAGE, resource_required=False)
     def get(self, snippet: CustomizedSnippet):
         """Get all published workflow versions for snippet."""
         args = SnippetWorkflowListQuery.model_validate(request.args.to_dict(flat=True))
@@ -361,6 +375,9 @@ class SnippetDraftWorkflowRestoreApi(Resource):
     @with_current_user
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def post(self, current_user: Account, snippet: CustomizedSnippet, workflow_id: str):
         """Restore a published snippet workflow version into the draft workflow."""
         snippet_service = _snippet_service()
@@ -486,6 +503,9 @@ class SnippetDraftNodeRunApi(Resource):
     @with_current_user
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def post(self, current_user: Account, snippet: CustomizedSnippet, node_id: str):
         """
         Run a single node in snippet draft workflow.
@@ -574,6 +594,9 @@ class SnippetDraftRunIterationNodeApi(Resource):
     @with_current_user
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def post(self, current_user: Account, snippet: CustomizedSnippet, node_id: str):
         """
         Run a draft workflow iteration node for snippet.
@@ -619,6 +642,9 @@ class SnippetDraftRunLoopNodeApi(Resource):
     @with_current_user
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def post(self, current_user: Account, snippet: CustomizedSnippet, node_id: str):
         """
         Run a draft workflow loop node for snippet.
@@ -662,6 +688,9 @@ class SnippetDraftWorkflowRunApi(Resource):
     @with_current_user
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def post(self, current_user: Account, snippet: CustomizedSnippet):
         """
         Run draft workflow for snippet.
@@ -700,6 +729,9 @@ class SnippetWorkflowTaskStopApi(Resource):
     @account_initialization_required
     @get_snippet
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def post(self, snippet: CustomizedSnippet, task_id: str):
         """
         Stop a running snippet workflow task.
diff --git a/api/controllers/console/snippets/snippet_workflow_draft_variable.py b/api/controllers/console/snippets/snippet_workflow_draft_variable.py
index a28ba07b5dd..4befd259666 100644
--- a/api/controllers/console/snippets/snippet_workflow_draft_variable.py
+++ b/api/controllers/console/snippets/snippet_workflow_draft_variable.py
@@ -34,8 +34,11 @@ from controllers.console.app.workflow_draft_variable import (
 )
 from controllers.console.snippets.snippet_workflow import get_snippet
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_user,
 )
@@ -102,6 +105,7 @@ class SnippetWorkflowVariableCollectionApi(Resource):
     )
     @_snippet_draft_var_prerequisite
     @marshal_with(workflow_draft_variable_list_without_value_model)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_MANAGE, resource_required=False)
     def get(self, current_user: Account, snippet: CustomizedSnippet) -> WorkflowDraftVariableList:
         args = WorkflowDraftVariableListQuery.model_validate(request.args.to_dict(flat=True))  # type: ignore
 
@@ -125,6 +129,9 @@ class SnippetWorkflowVariableCollectionApi(Resource):
     @console_ns.doc(description="Delete all draft workflow variables for the current user (snippet scope)")
     @console_ns.response(204, "Workflow variables deleted successfully")
     @_snippet_draft_var_prerequisite
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     def delete(self, current_user: Account, snippet: CustomizedSnippet) -> Response:
         draft_var_srv = WorkflowDraftVariableService(session=db.session())
         draft_var_srv.delete_user_workflow_variables(snippet.id, user_id=current_user.id)
diff --git a/api/controllers/console/tag/tags.py b/api/controllers/console/tag/tags.py
index 82a713f1c6f..38e7395ccf8 100644
--- a/api/controllers/console/tag/tags.py
+++ b/api/controllers/console/tag/tags.py
@@ -122,7 +122,7 @@ class TagListApi(Resource):
             raise Forbidden()
 
         payload = TagBasePayload.model_validate(console_ns.payload or {})
-        tag = TagService.save_tags(SaveTagPayload(name=payload.name, type=payload.type))
+        tag = TagService.save_tags(SaveTagPayload(name=payload.name, type=payload.type), db.session)
 
         response = TagResponse.model_validate(
             {"id": tag.id, "name": tag.name, "type": tag.type, "binding_count": 0}
@@ -146,9 +146,9 @@ class TagUpdateDeleteApi(Resource):
             raise Forbidden()
 
         payload = TagUpdateRequestPayload.model_validate(console_ns.payload or {})
-        tag = TagService.update_tags(UpdateTagPayload(name=payload.name), tag_id_str)
+        tag = TagService.update_tags(UpdateTagPayload(name=payload.name), tag_id_str, db.session)
 
-        binding_count = TagService.get_tag_binding_count(tag_id_str)
+        binding_count = TagService.get_tag_binding_count(tag_id_str, db.session)
 
         response = TagResponse.model_validate(
             {"id": tag.id, "name": tag.name, "type": tag.type, "binding_count": binding_count}
@@ -164,7 +164,7 @@ class TagUpdateDeleteApi(Resource):
     def delete(self, tag_id: UUID):
         tag_id_str = str(tag_id)
 
-        TagService.delete_tag(tag_id_str)
+        TagService.delete_tag(tag_id_str, db.session)
 
         return "", 204
 
@@ -189,7 +189,8 @@ def _create_tag_bindings(current_user: Account) -> tuple[dict[str, str], int]:
             tag_ids=payload.tag_ids,
             target_id=payload.target_id,
             type=payload.type,
-        )
+        ),
+        db.session,
     )
     return {"result": "success"}, 200
 
@@ -203,7 +204,8 @@ def _remove_tag_bindings(current_user: Account) -> tuple[dict[str, str], int]:
             tag_ids=payload.tag_ids,
             target_id=payload.target_id,
             type=payload.type,
-        )
+        ),
+        db.session,
     )
     return {"result": "success"}, 200
 
diff --git a/api/controllers/console/workspace/endpoint.py b/api/controllers/console/workspace/endpoint.py
index 9c5aa166bc0..821e30ee7e3 100644
--- a/api/controllers/console/workspace/endpoint.py
+++ b/api/controllers/console/workspace/endpoint.py
@@ -15,8 +15,11 @@ from pydantic import BaseModel, Field
 from controllers.common.schema import query_params_from_model, register_schema_models
 from controllers.console import console_ns
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user_id,
@@ -166,6 +169,7 @@ class EndpointCollectionApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user_id
     @with_current_tenant_id
@@ -194,6 +198,7 @@ class DeprecatedEndpointCreateApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user_id
     @with_current_tenant_id
@@ -285,6 +290,7 @@ class EndpointItemApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user_id
     @with_current_tenant_id
@@ -304,6 +310,7 @@ class EndpointItemApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user_id
     @with_current_tenant_id
@@ -333,6 +340,7 @@ class DeprecatedEndpointDeleteApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user_id
     @with_current_tenant_id
@@ -363,6 +371,7 @@ class DeprecatedEndpointUpdateApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user_id
     @with_current_tenant_id
@@ -385,6 +394,7 @@ class EndpointEnableApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user_id
     @with_current_tenant_id
@@ -412,6 +422,7 @@ class EndpointDisableApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user_id
     @with_current_tenant_id
diff --git a/api/controllers/console/workspace/members.py b/api/controllers/console/workspace/members.py
index 6fea5417152..b3230d77e69 100644
--- a/api/controllers/console/workspace/members.py
+++ b/api/controllers/console/workspace/members.py
@@ -32,16 +32,17 @@ from extensions.ext_redis import redis_client
 from fields.base import ResponseModel
 from fields.member_fields import AccountWithRole, AccountWithRoleList
 from libs.helper import extract_remote_ip
-from libs.login import login_required
+from libs.login import current_account_with_tenant, login_required
 from models.account import Account, TenantAccountJoin, TenantAccountRole
 from services.account_service import AccountService, RegisterService, TenantService
+from services.enterprise import rbac_service as enterprise_rbac_service
 from services.errors.account import AccountAlreadyInTenantError
 from services.feature_service import FeatureService
 
 
 class MemberInvitePayload(BaseModel):
     emails: list[str] = Field(default_factory=list)
-    role: TenantAccountRole
+    role: str
     language: str | None = None
 
 
@@ -107,6 +108,22 @@ def _is_role_enabled(role: TenantAccountRole | str, tenant_id: str) -> bool:
     return FeatureService.get_features(tenant_id=tenant_id, exclude_vector_space=True).dataset_operator_enabled
 
 
+def _serialize_member_roles(
+    current_role: str | None, member_roles: list[enterprise_rbac_service.RBACRole]
+) -> list[dict[str, str]]:
+    if dify_config.RBAC_ENABLED:
+        return [{"id": role.id, "name": role.name} for role in member_roles]
+    else:
+        if current_role:
+            return [{"id": current_role, "name": current_role}]
+        return []
+
+
+def _normalize_enum_value(value: object) -> str:
+    normalized = getattr(value, "value", value)
+    return str(normalized) if normalized is not None else ""
+
+
 def _normalize_invitee_emails(emails: list[str]) -> list[str]:
     return list(dict.fromkeys(email.lower() for email in emails))
 
@@ -164,11 +181,42 @@ class MemberListApi(Resource):
     @account_initialization_required
     @console_ns.response(200, "Success", console_ns.models[AccountWithRoleList.__name__])
     @with_current_user
-    def get(self, current_user: Account):
+    def get(self, current_user: Account | None = None):
+        if current_user is None:
+            current_user, _ = current_account_with_tenant()
         if not current_user.current_tenant:
             raise ValueError("No current tenant")
         members = TenantService.get_tenant_members(current_user.current_tenant)
-        member_models = TypeAdapter(list[AccountWithRole]).validate_python(members, from_attributes=True)
+        if dify_config.RBAC_ENABLED:
+            member_ids = [member.id for member in members]
+            member_roles = enterprise_rbac_service.RBACService.MemberRoles.batch_get(
+                str(current_user.current_tenant.id),
+                current_user.id,
+                member_ids,
+            )
+            roles_map = {item.account_id: item.roles for item in member_roles}
+        else:
+            roles_map = {}
+
+        serialized_members = []
+        for member in members:
+            current_role = _normalize_enum_value(member.current_role)
+            serialized_members.append(
+                {
+                    "id": member.id,
+                    "name": member.name,
+                    "email": member.email,
+                    "avatar": member.avatar,
+                    "last_login_at": member.last_login_at,
+                    "last_active_at": member.last_active_at,
+                    "created_at": member.created_at,
+                    "role": current_role,
+                    "roles": _serialize_member_roles(current_role, roles_map.get(member.id, [])),
+                    "status": _normalize_enum_value(member.status),
+                }
+            )
+
+        member_models = TypeAdapter(list[AccountWithRole]).validate_python(serialized_members)
         response = AccountWithRoleList(accounts=member_models)
         return response.model_dump(mode="json"), 200
 
@@ -190,8 +238,11 @@ class MemberInviteEmailApi(Resource):
         invitee_emails = _normalize_invitee_emails(args.emails)
         invitee_role = args.role
         interface_language = args.language
-        if not TenantAccountRole.is_non_owner_role(invitee_role):
-            return {"code": "invalid-role", "message": "Invalid role"}, 400
+        if not dify_config.RBAC_ENABLED:
+            if not TenantAccountRole.is_valid_role(invitee_role):
+                return {"code": "invalid-role", "message": "Invalid role"}, 400
+            if not TenantAccountRole.is_non_owner_role(TenantAccountRole(invitee_role)):
+                return {"code": "invalid-role", "message": "Invalid role"}, 400
         inviter = current_user
         if not inviter.current_tenant:
             raise ValueError("No current tenant")
@@ -208,8 +259,9 @@ class MemberInviteEmailApi(Resource):
 
         tenant_id = inviter.current_tenant.id
         with redis_client.lock(f"workspace_member_invite:{tenant_id}", timeout=60):
-            new_member_count = _count_new_member_invites(tenant_id, invitee_emails)
-            _check_member_invite_limits(tenant_id, new_member_count)
+            if dify_config.ENTERPRISE_ENABLED is True or dify_config.BILLING_ENABLED is True:
+                new_member_count = _count_new_member_invites(tenant_id, invitee_emails)
+                _check_member_invite_limits(tenant_id, new_member_count)
 
             for invitee_email in invitee_emails:
                 try:
@@ -232,7 +284,11 @@ class MemberInviteEmailApi(Resource):
                     )
                 except AccountAlreadyInTenantError:
                     invitation_results.append(
-                        {"status": "success", "email": invitee_email, "url": f"{console_web_url}/signin"}
+                        {
+                            "status": "already_member",
+                            "email": invitee_email,
+                            "message": "Account already in workspace.",
+                        }
                     )
                 except Exception as e:
                     invitation_results.append({"status": "failed", "email": invitee_email, "message": str(e)})
diff --git a/api/controllers/console/workspace/model_providers.py b/api/controllers/console/workspace/model_providers.py
index 07c124890cf..8fda67f4ef8 100644
--- a/api/controllers/console/workspace/model_providers.py
+++ b/api/controllers/console/workspace/model_providers.py
@@ -9,8 +9,11 @@ from controllers.common.fields import BinaryFileResponse, SimpleResultResponse
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -166,6 +169,7 @@ class ModelProviderCredentialApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider: str):
@@ -191,6 +195,7 @@ class ModelProviderCredentialApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def put(self, current_tenant_id: str, provider: str):
@@ -217,6 +222,7 @@ class ModelProviderCredentialApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def delete(self, current_tenant_id: str, provider: str):
@@ -238,6 +244,7 @@ class ModelProviderCredentialSwitchApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider: str):
@@ -319,6 +326,7 @@ class PreferredProviderTypeUpdateApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str):
diff --git a/api/controllers/console/workspace/models.py b/api/controllers/console/workspace/models.py
index 2139d6f18e0..e82c0fbc2db 100644
--- a/api/controllers/console/workspace/models.py
+++ b/api/controllers/console/workspace/models.py
@@ -14,8 +14,11 @@ from controllers.common.schema import (
 )
 from controllers.console import console_ns
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -217,6 +220,7 @@ class DefaultModelApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -263,6 +267,7 @@ class ModelProviderModelApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str):
@@ -310,6 +315,7 @@ class ModelProviderModelApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def delete(self, tenant_id: str, provider: str):
@@ -389,6 +395,7 @@ class ModelProviderModelCredentialApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str):
@@ -421,6 +428,7 @@ class ModelProviderModelCredentialApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def put(self, current_tenant_id: str, provider: str):
@@ -448,6 +456,7 @@ class ModelProviderModelCredentialApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def delete(self, current_tenant_id: str, provider: str):
@@ -472,6 +481,7 @@ class ModelProviderModelCredentialSwitchApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider: str):
@@ -498,6 +508,7 @@ class ModelProviderModelEnableApi(Resource):
     @login_required
     @account_initialization_required
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     def patch(self, tenant_id: str, provider: str):
         args = ParserDeleteModels.model_validate(console_ns.payload)
 
@@ -519,6 +530,7 @@ class ModelProviderModelDisableApi(Resource):
     @login_required
     @account_initialization_required
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     def patch(self, tenant_id: str, provider: str):
         args = ParserDeleteModels.model_validate(console_ns.payload)
 
diff --git a/api/controllers/console/workspace/plugin.py b/api/controllers/console/workspace/plugin.py
index 94979e25b36..d599466002d 100644
--- a/api/controllers/console/workspace/plugin.py
+++ b/api/controllers/console/workspace/plugin.py
@@ -20,8 +20,11 @@ from controllers.common.schema import (
 from controllers.console import console_ns
 from controllers.console.workspace import plugin_permission_required
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -975,6 +978,7 @@ class PluginFetchDynamicSelectOptionsApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -1005,6 +1009,7 @@ class PluginFetchDynamicSelectOptionsWithCredentialsApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
diff --git a/api/controllers/console/workspace/rbac.py b/api/controllers/console/workspace/rbac.py
new file mode 100644
index 00000000000..1b213a4f741
--- /dev/null
+++ b/api/controllers/console/workspace/rbac.py
@@ -0,0 +1,939 @@
+from __future__ import annotations
+
+from enum import StrEnum
+from typing import Any
+
+from flask import request
+from flask_restx import Resource
+from pydantic import AliasChoices, BaseModel, ConfigDict, Field, ValidationError, field_validator
+from sqlalchemy import select
+from werkzeug.exceptions import NotFound
+
+from configs import dify_config
+from controllers.common.schema import register_response_schema_models
+from controllers.console import console_ns
+from controllers.console.wraps import RBACPermission, RBACResourceScope, rbac_permission_required
+from core.db.session_factory import session_factory
+from libs.login import current_account_with_tenant, login_required
+from models import Account
+from services.enterprise import rbac_service as svc
+
+
+class _RBACRoleList(svc.Paginated[svc.RBACRole]):
+    pass
+
+
+class _RBACRoleAccountList(svc.Paginated[svc.RBACRoleAccount]):
+    pass
+
+
+class _AccessPolicyList(svc.Paginated[svc.AccessPolicy]):
+    pass
+
+
+class _MembersInRoleList(svc.Paginated[svc.MembersInRole]):
+    pass
+
+
+register_response_schema_models(
+    console_ns,
+    svc.PermissionCatalogResponse,
+    svc.RBACRole,
+    _RBACRoleList,
+    _RBACRoleAccountList,
+    _MembersInRoleList,
+    svc.AccessPolicy,
+    _AccessPolicyList,
+    svc.AccessPolicyBindingState,
+    svc.MyPermissionsResponse,
+    svc.AppAccessMatrix,
+    svc.DatasetAccessMatrix,
+    svc.WorkspaceAccessMatrix,
+    svc.ResourceWhitelist,
+    svc.ResourceUserAccessPoliciesResponse,
+    svc.ReplaceUserAccessPoliciesResponse,
+    svc.RoleBindingsResponse,
+    svc.MemberBindingsResponse,
+    svc.MemberRolesResponse,
+    svc.AccessMatrixItem,
+)
+
+_LEGACY_ROLE_PERMISSION_KEYS: dict[str, list[str]] = {
+    # This is a compatibility projection from the pre-RBAC workspace roles into
+    # the 2.0 permission matrix documented in "权限整理2.0". It intentionally
+    # models the product-facing role surface for the new RBAC UI instead of the
+    # legacy backend's exact hard-authorization checks.
+    "owner": [
+        *svc._LEGACY_WORKSPACE_OWNER_KEYS,
+        *svc._LEGACY_APP_OWNER_KEYS,
+        *svc._LEGACY_DATASET_OWNER_KEYS,
+    ],
+    "admin": [
+        *svc._LEGACY_WORKSPACE_ADMIN_KEYS,
+        *svc._LEGACY_APP_ADMIN_KEYS,
+        *svc._LEGACY_DATASET_ADMIN_KEYS,
+    ],
+    "editor": [
+        *svc._LEGACY_WORKSPACE_EDITOR_KEYS,
+        *svc._LEGACY_APP_EDITOR_KEYS,
+        *svc._LEGACY_DATASET_EDITOR_KEYS,
+    ],
+    "normal": [
+        *svc._LEGACY_WORKSPACE_NORMAL_KEYS,
+        *svc._LEGACY_APP_NORMAL_KEYS,
+    ],
+    "dataset_operator": [
+        *svc._LEGACY_WORKSPACE_DATASET_OPERATOR_KEYS,
+        *svc._LEGACY_DATASET_DATASET_OPERATOR_KEYS,
+    ],
+}
+
+
+def _current_ids() -> tuple[str, str]:
+    """Return ``(tenant_id, account_id)`` for the authenticated user, or
+    raise a 404 when no tenant is associated with the session.
+    """
+
+    user, tenant_id = current_account_with_tenant()
+    if not tenant_id:
+        raise NotFound("Current workspace not found")
+    return tenant_id, user.id
+
+
+def _payload(model: type[BaseModel]) -> Any:
+    """Validate the JSON body against ``model`` or raise ``ValidationError``.
+
+    ``ValidationError`` bubbles up as HTTP 400 thanks to
+    ``controllers/common/helpers.py`` error handling.
+    """
+    try:
+        return model.model_validate(console_ns.payload or {})
+    except ValidationError as exc:
+        # Re-raise as-is so the upstream error handler renders a 400.
+        raise exc
+
+
+def _dump(model: BaseModel) -> dict[str, Any]:
+    return model.model_dump(mode="json")
+
+
+def _account_names_by_ids(account_ids: list[str]) -> dict[str, dict[str, str]]:
+    ids = sorted({account_id.strip() for account_id in account_ids if account_id and account_id.strip()})
+    if not ids:
+        return {}
+
+    with session_factory.create_session() as session:
+        rows = session.execute(
+            select(Account.id, Account.name, Account.avatar, Account.email).where(Account.id.in_(ids))
+        ).all()
+
+    return {
+        account_id: {
+            "name": name or "",
+            "avatar": avatar or "",
+            "email": email or "",
+        }
+        for account_id, name, avatar, email in rows
+    }
+
+
+def _hydrate_access_matrix_account_names(items: list[svc.AccessMatrixItem]) -> None:
+    account_ids: list[str] = []
+    for item in items:
+        for account in item.accounts:
+            account_id = account.account_id
+            if account_id and not account.account_name:
+                account_ids.append(account_id)
+
+    account_names = _account_names_by_ids(account_ids)
+    if not account_names:
+        return
+
+    for item in items:
+        for account in item.accounts:
+            account_id = str(account.account_id or "").strip()
+            if account_id and not account.account_name:
+                account.account_name = account_names.get(account_id, {}).get("name", "")
+            account.avatar = account_names.get(account_id, {}).get("avatar", "")
+            account.email = account_names.get(account_id, {}).get("email", "")
+
+
+def _hydrate_resource_user_account_names(items: list[svc.ResourceUserAccessPolicies]) -> None:
+    account_names = _account_names_by_ids([item.account.account_id for item in items])
+    for item in items:
+        account_id = item.account.account_id
+        if account_id and not item.account.account_name:
+            item.account.account_name = account_names.get(account_id, {}).get("name", "")
+            item.account.avatar = account_names.get(account_id, {}).get("avatar", "")
+            item.account.email = account_names.get(account_id, {}).get("email", "")
+
+
+class _PaginationQuery(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    page_number: int | None = Field(default=None, ge=1, validation_alias=AliasChoices("page", "page_number"))
+    results_per_page: int | None = Field(
+        default=None, ge=1, le=99999, validation_alias=AliasChoices("limit", "results_per_page")
+    )
+    reverse: bool | None = None
+
+    def to_inner_options(self) -> svc.ListOption:
+        return svc.ListOption.model_validate(self.model_dump())
+
+
+class _RolesListQuery(_PaginationQuery):
+    include_owner: int = Field(default=0, ge=0, le=1)
+
+
+class CopyRoleParam(BaseModel):
+    copy_member: bool = True
+
+
+def _pagination_options() -> svc.ListOption:
+    return _PaginationQuery.model_validate(request.args.to_dict(flat=True)).to_inner_options()
+
+
+def _legacy_workspace_roles(
+    options: svc.ListOption | None = None, *, include_owner: int = 0
+) -> svc.Paginated[svc.RBACRole]:
+    """Return the built-in legacy workspace roles in the RBAC list shape.
+
+    This keeps the new `/rbac/roles` endpoint compatible with the original
+    Dify role model when enterprise RBAC is disabled.
+    """
+
+    legacy_roles = [
+        svc.RBACRole(
+            id=role_name,
+            tenant_id="",
+            type=svc.RBACRoleType.WORKSPACE.value,
+            category="global_system_default",
+            name=role_name,
+            description="",
+            is_builtin=True,
+            permission_keys=list(_LEGACY_ROLE_PERMISSION_KEYS[role_name]),
+            role_tag="owner" if role_name == "owner" else "",
+        )
+        for role_name in ("owner", "admin", "editor", "normal", "dataset_operator")
+    ]
+
+    if not include_owner:
+        legacy_roles = [r for r in legacy_roles if r.name != "owner"]
+
+    page_number = options.page_number if options and options.page_number is not None else 1
+    results_per_page = (
+        options.results_per_page if options and options.results_per_page is not None else len(legacy_roles)
+    )
+    reverse = options.reverse if options and options.reverse is not None else False
+
+    ordered_roles = list(reversed(legacy_roles)) if reverse else legacy_roles
+    start = max(page_number - 1, 0) * results_per_page
+    end = start + results_per_page
+    paged_roles = ordered_roles[start:end]
+    total_count = len(legacy_roles)
+    total_pages = (total_count + results_per_page - 1) // results_per_page if results_per_page > 0 else 0
+
+    return svc.Paginated[svc.RBACRole](
+        data=paged_roles,
+        pagination=svc.Pagination(
+            total_count=total_count,
+            per_page=results_per_page,
+            current_page=page_number,
+            total_pages=total_pages,
+        ),
+    )
+
+
+# ---------------------------------------------------------------------------
+# Permission catalogs.
+# ---------------------------------------------------------------------------
+
+
+@console_ns.route("/workspaces/current/rbac/role-permissions/catalog")
+class RBACWorkspaceCatalogApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.PermissionCatalogResponse.__name__])
+    def get(self):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.Catalog.workspace(tenant_id, account_id))
+
+
+@console_ns.route("/workspaces/current/rbac/role-permissions/catalog/app")
+class RBACAppCatalogApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.PermissionCatalogResponse.__name__])
+    def get(self):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.Catalog.app(tenant_id, account_id))
+
+
+@console_ns.route("/workspaces/current/rbac/role-permissions/catalog/dataset")
+class RBACDatasetCatalogApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.PermissionCatalogResponse.__name__])
+    def get(self):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.Catalog.dataset(tenant_id, account_id))
+
+
+# ---------------------------------------------------------------------------
+# Roles.
+# ---------------------------------------------------------------------------
+
+
+class _RoleUpsertRequest(BaseModel):
+    """Accepts the payload sent by the Create/Edit Role dialog."""
+
+    name: str
+    description: str = ""
+    permission_keys: list[str] = []
+
+    def to_mutation(self) -> svc.RoleMutation:
+        return svc.RoleMutation(
+            name=self.name,
+            description=self.description,
+            permission_keys=list(self.permission_keys),
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/roles")
+class RBACRolesApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[_RBACRoleList.__name__])
+    def get(self):
+        tenant_id, account_id = _current_ids()
+        query = _RolesListQuery.model_validate(request.args.to_dict(flat=True))
+        options = query.to_inner_options()
+        if not dify_config.RBAC_ENABLED:
+            result = _legacy_workspace_roles(options, include_owner=query.include_owner)
+        else:
+            result = svc.RBACService.Roles.list(
+                tenant_id, account_id, include_owner=query.include_owner, options=options
+            )
+
+        return _dump(result)
+
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(201, "Role created", console_ns.models[svc.RBACRole.__name__])
+    def post(self):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_RoleUpsertRequest)
+        role = svc.RBACService.Roles.create(tenant_id, account_id, request.to_mutation())
+        return _dump(role), 201
+
+
+@console_ns.route("/workspaces/current/rbac/roles/<uuid:role_id>")
+class RBACRoleItemApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[svc.RBACRole.__name__])
+    def get(self, role_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.Roles.get(tenant_id, account_id, str(role_id)))
+
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[svc.RBACRole.__name__])
+    def put(self, role_id):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_RoleUpsertRequest)
+        role = svc.RBACService.Roles.update(tenant_id, account_id, str(role_id), request.to_mutation())
+        return _dump(role)
+
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[svc.RBACRole.__name__])
+    def delete(self, role_id):
+        tenant_id, account_id = _current_ids()
+        svc.RBACService.Roles.delete(tenant_id, account_id, str(role_id))
+        return {"result": "success"}
+
+
+@console_ns.route("/workspaces/current/rbac/roles/<uuid:role_id>/copy")
+class RBACRoleCopyApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(201, "Role copied", console_ns.models[svc.RBACRole.__name__])
+    def post(self, role_id):
+        tenant_id, account_id = _current_ids()
+        request = _payload(CopyRoleParam)
+        role = svc.RBACService.Roles.copy(tenant_id, account_id, str(role_id), copy_member=request.copy_member)
+        return _dump(role), 201
+
+
+@console_ns.route("/workspaces/current/rbac/roles/<uuid:role_id>/members")
+class RBACRoleMembersApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[_RBACRoleAccountList.__name__])
+    def get(self, role_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(
+            svc.RBACService.Roles.members(
+                tenant_id,
+                account_id,
+                str(role_id),
+                options=_pagination_options(),
+            )
+        )
+
+
+# ---------------------------------------------------------------------------
+# Access policies (tenant-level permission sets).
+# ---------------------------------------------------------------------------
+
+
+class _AccessPolicyCreateRequest(BaseModel):
+    name: str
+    resource_type: svc.RBACResourceType
+    description: str = ""
+    permission_keys: list[str] = []
+
+
+class _AccessPolicyUpdateRequest(BaseModel):
+    name: str
+    description: str = ""
+    permission_keys: list[str] = []
+
+
+@console_ns.route("/workspaces/current/rbac/access-policies")
+class RBACAccessPoliciesApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[_AccessPolicyList.__name__])
+    def get(self):
+        tenant_id, account_id = _current_ids()
+        # `resource_type` is exposed as a query argument so the UI can show
+        # only app-scoped or only dataset-scoped permission sets.
+        resource_type = request.args.get("resource_type") or None
+        return _dump(
+            svc.RBACService.AccessPolicies.list(
+                tenant_id,
+                account_id,
+                resource_type=resource_type,
+                options=_pagination_options(),
+            )
+        )
+
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(201, "Policy created", console_ns.models[svc.AccessPolicy.__name__])
+    def post(self):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_AccessPolicyCreateRequest)
+        policy = svc.RBACService.AccessPolicies.create(
+            tenant_id,
+            account_id,
+            svc.AccessPolicyCreate(
+                name=request.name,
+                resource_type=request.resource_type,
+                description=request.description,
+                permission_keys=list(request.permission_keys),
+            ),
+        )
+        return _dump(policy), 201
+
+
+@console_ns.route("/workspaces/current/rbac/access-policies/<uuid:policy_id>")
+class RBACAccessPolicyItemApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[svc.AccessPolicy.__name__])
+    def get(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.AccessPolicies.get(tenant_id, account_id, str(policy_id)))
+
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[svc.AccessPolicy.__name__])
+    def put(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_AccessPolicyUpdateRequest)
+        policy = svc.RBACService.AccessPolicies.update(
+            tenant_id,
+            account_id,
+            str(policy_id),
+            svc.AccessPolicyUpdate(
+                name=request.name,
+                description=request.description,
+                permission_keys=list(request.permission_keys),
+            ),
+        )
+        return _dump(policy)
+
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[svc.AccessPolicy.__name__])
+    def delete(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        svc.RBACService.AccessPolicies.delete(tenant_id, account_id, str(policy_id))
+        return {"result": "success"}
+
+
+@console_ns.route("/workspaces/current/rbac/access-policies/<uuid:policy_id>/copy")
+class RBACAccessPolicyCopyApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(201, "Policy copied", console_ns.models[svc.AccessPolicy.__name__])
+    def post(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        policy = svc.RBACService.AccessPolicies.copy(tenant_id, account_id, str(policy_id))
+        return _dump(policy), 201
+
+
+@console_ns.route("/workspaces/current/rbac/access-policy-bindings/<uuid:binding_id>/lock")
+class RBACAccessPolicyBindingLockApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[svc.AccessPolicyBindingState.__name__])
+    def put(self, binding_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.AccessPolicyBindings.lock(tenant_id, account_id, str(binding_id)))
+
+
+@console_ns.route("/workspaces/current/rbac/access-policy-bindings/<uuid:binding_id>/unlock")
+class RBACAccessPolicyBindingUnlockApi(Resource):
+    @login_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+    )
+    @console_ns.response(200, "Success", console_ns.models[svc.AccessPolicyBindingState.__name__])
+    def put(self, binding_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.AccessPolicyBindings.unlock(tenant_id, account_id, str(binding_id)))
+
+
+# ---------------------------------------------------------------------------
+# Per-app access (App Access Config).
+# ---------------------------------------------------------------------------
+
+
+class _AccessScope(StrEnum):
+    ALL = "all"
+    SPECIFIC = "specific"
+    ONLY_ME = "only_me"
+
+
+class _ResourceAccessScopeRequest(BaseModel):
+    scope: _AccessScope
+
+
+class _ReplaceBindingsRequest(BaseModel):
+    role_ids: list[str] = Field(default_factory=list)
+    account_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("role_ids", "account_ids", mode="before")
+    @classmethod
+    def _coerce_bindings(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class _DeleteMemberBindingsRequest(BaseModel):
+    account_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("account_ids", mode="before")
+    @classmethod
+    def _coerce_account_ids(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+@console_ns.route("/workspaces/current/rbac/my-permissions")
+class RBACMyPermissionsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MyPermissionsResponse.__name__])
+    def get(self):
+        tenant_id, account_id = _current_ids()
+        return _dump(
+            svc.RBACService.MyPermissions.get(
+                tenant_id,
+                account_id,
+                app_id=request.args.get("app_id") or None,
+                dataset_id=request.args.get("dataset_id") or None,
+            )
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/apps/<uuid:app_id>/access-policy")
+class RBACAppMatrixApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.AppAccessMatrix.__name__])
+    def get(self, app_id):
+        tenant_id, account_id = _current_ids()
+        result = svc.RBACService.AppAccess.matrix(tenant_id, account_id, str(app_id))
+        _hydrate_access_matrix_account_names(result.items)
+        return _dump(result)
+
+
+@console_ns.route("/workspaces/current/rbac/apps/<uuid:app_id>/whitelist")
+class RBACAppWhitelistApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.ResourceWhitelist.__name__])
+    def get(self, app_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.AppAccess.whitelist(tenant_id, account_id, str(app_id)))
+
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.ResourceWhitelist.__name__])
+    def put(self, app_id):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_ResourceAccessScopeRequest)
+        return _dump(
+            svc.RBACService.AppAccess.replace_whitelist(
+                tenant_id,
+                account_id,
+                str(app_id),
+                svc.ReplaceMemberBindings(scope=request.scope.value),
+            )
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/apps/<uuid:app_id>/user-access-policies")
+class RBACAppUserAccessPoliciesApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.ResourceUserAccessPoliciesResponse.__name__])
+    def get(self, app_id):
+        tenant_id, account_id = _current_ids()
+        result = svc.RBACService.AppAccess.user_access_policies(tenant_id, account_id, str(app_id))
+        _hydrate_resource_user_account_names(result.data)
+        return _dump(result)
+
+
+@console_ns.route("/workspaces/current/rbac/apps/<uuid:app_id>/users/<uuid:target_account_id>/access-policies")
+class RBACAppUserAccessPolicyAssignmentApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.ReplaceUserAccessPoliciesResponse.__name__])
+    def put(self, app_id, target_account_id):
+        tenant_id, account_id = _current_ids()
+        payload = _payload(svc.ReplaceUserAccessPolicies)
+        return _dump(
+            svc.RBACService.AppAccess.replace_user_access_policies(
+                tenant_id,
+                account_id,
+                str(app_id),
+                str(target_account_id),
+                payload,
+            )
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/apps/<uuid:app_id>/access-policies/<uuid:policy_id>/role-bindings")
+class RBACAppRoleBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.RoleBindingsResponse.__name__])
+    def get(self, app_id, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.AppAccess.list_role_bindings(tenant_id, account_id, str(app_id), str(policy_id)))
+
+
+@console_ns.route("/workspaces/current/rbac/apps/<uuid:app_id>/access-policies/<string:policy_id>/member-bindings")
+class RBACAppMemberBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MemberBindingsResponse.__name__])
+    def get(self, app_id, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.AppAccess.list_member_bindings(tenant_id, account_id, str(app_id), str(policy_id)))
+
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MemberBindingsResponse.__name__])
+    def delete(self, app_id, policy_id):
+        tenant_id, account_id = _current_ids()
+        request_body = _payload(_DeleteMemberBindingsRequest)
+        svc.RBACService.AppAccess.delete_member_bindings(
+            tenant_id,
+            account_id,
+            str(app_id),
+            str(policy_id),
+            svc.DeleteMemberBindings(account_ids=request_body.account_ids),
+        )
+        return {"result": "success"}
+
+
+# ---------------------------------------------------------------------------
+# Per-dataset access (Knowledge Base Access Config).
+# ---------------------------------------------------------------------------
+
+
+@console_ns.route("/workspaces/current/rbac/datasets/<uuid:dataset_id>/access-policy")
+class RBACDatasetMatrixApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.DatasetAccessMatrix.__name__])
+    def get(self, dataset_id):
+        tenant_id, account_id = _current_ids()
+        result = svc.RBACService.DatasetAccess.matrix(tenant_id, account_id, str(dataset_id))
+        _hydrate_access_matrix_account_names(result.items)
+        return _dump(result)
+
+
+@console_ns.route("/workspaces/current/rbac/datasets/<uuid:dataset_id>/whitelist")
+class RBACDatasetWhitelistApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.ResourceWhitelist.__name__])
+    def get(self, dataset_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.DatasetAccess.whitelist(tenant_id, account_id, str(dataset_id)))
+
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.ResourceWhitelist.__name__])
+    def put(self, dataset_id):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_ResourceAccessScopeRequest)
+        return _dump(
+            svc.RBACService.DatasetAccess.replace_whitelist(
+                tenant_id,
+                account_id,
+                str(dataset_id),
+                svc.ReplaceMemberBindings(scope=request.scope.value),
+            )
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/datasets/<uuid:dataset_id>/user-access-policies")
+class RBACDatasetUserAccessPoliciesApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.ResourceUserAccessPoliciesResponse.__name__])
+    def get(self, dataset_id):
+        tenant_id, account_id = _current_ids()
+        result = svc.RBACService.DatasetAccess.user_access_policies(tenant_id, account_id, str(dataset_id))
+        _hydrate_resource_user_account_names(result.data)
+        return _dump(result)
+
+
+@console_ns.route("/workspaces/current/rbac/datasets/<uuid:dataset_id>/users/<uuid:target_account_id>/access-policies")
+class RBACDatasetUserAccessPolicyAssignmentApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.ReplaceUserAccessPoliciesResponse.__name__])
+    def put(self, dataset_id, target_account_id):
+        tenant_id, account_id = _current_ids()
+        payload = _payload(svc.ReplaceUserAccessPolicies)
+        return _dump(
+            svc.RBACService.DatasetAccess.replace_user_access_policies(
+                tenant_id,
+                account_id,
+                str(dataset_id),
+                str(target_account_id),
+                payload,
+            )
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/datasets/<uuid:dataset_id>/access-policies/<uuid:policy_id>/role-bindings")
+class RBACDatasetRoleBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.RoleBindingsResponse.__name__])
+    def get(self, dataset_id, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(
+            svc.RBACService.DatasetAccess.list_role_bindings(tenant_id, account_id, str(dataset_id), str(policy_id))
+        )
+
+
+@console_ns.route(
+    "/workspaces/current/rbac/datasets/<uuid:dataset_id>/access-policies/<string:policy_id>/member-bindings"
+)
+class RBACDatasetMemberBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MemberBindingsResponse.__name__])
+    def get(self, dataset_id, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(
+            svc.RBACService.DatasetAccess.list_member_bindings(tenant_id, account_id, str(dataset_id), str(policy_id))
+        )
+
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MemberBindingsResponse.__name__])
+    def delete(self, dataset_id, policy_id):
+        tenant_id, account_id = _current_ids()
+        request_body = _payload(_DeleteMemberBindingsRequest)
+        svc.RBACService.DatasetAccess.delete_member_bindings(
+            tenant_id,
+            account_id,
+            str(dataset_id),
+            str(policy_id),
+            svc.DeleteMemberBindings(account_ids=request_body.account_ids),
+        )
+        return {"result": "success"}
+
+
+# ---------------------------------------------------------------------------
+# Workspace-level access (Settings > Access Rules).
+# ---------------------------------------------------------------------------
+
+
+@console_ns.route("/workspaces/current/rbac/workspace/apps/access-policy")
+class RBACWorkspaceAppMatrixApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.WorkspaceAccessMatrix.__name__])
+    def get(self):
+        tenant_id, account_id = _current_ids()
+        options = _pagination_options()
+        result = svc.RBACService.WorkspaceAccess.app_matrix(tenant_id, account_id, options=options)
+        _hydrate_access_matrix_account_names(result.items)
+        return _dump(result)
+
+
+@console_ns.route("/workspaces/current/rbac/workspace/apps/access-policies/<uuid:policy_id>/role-bindings")
+class RBACWorkspaceAppRoleBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.RoleBindingsResponse.__name__])
+    def get(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.WorkspaceAccess.list_app_role_bindings(tenant_id, account_id, str(policy_id)))
+
+
+@console_ns.route("/workspaces/current/rbac/workspace/apps/access-policies/<uuid:policy_id>/bindings")
+class RBACWorkspaceAppBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.AccessMatrixItem.__name__])
+    def put(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_ReplaceBindingsRequest)
+        return _dump(
+            svc.RBACService.WorkspaceAccess.replace_app_bindings(
+                tenant_id,
+                account_id,
+                str(policy_id),
+                svc.ReplaceBindings(role_ids=list(request.role_ids), account_ids=list(request.account_ids)),
+            )
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/workspace/apps/access-policies/<uuid:policy_id>/member-bindings")
+class RBACWorkspaceAppMemberBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MemberBindingsResponse.__name__])
+    def get(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.WorkspaceAccess.list_app_member_bindings(tenant_id, account_id, str(policy_id)))
+
+
+@console_ns.route("/workspaces/current/rbac/workspace/datasets/access-policy")
+class RBACWorkspaceDatasetMatrixApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.WorkspaceAccessMatrix.__name__])
+    def get(self):
+        tenant_id, account_id = _current_ids()
+        options = _pagination_options()
+        result = svc.RBACService.WorkspaceAccess.dataset_matrix(tenant_id, account_id, options=options)
+        _hydrate_access_matrix_account_names(result.items)
+        return _dump(result)
+
+
+@console_ns.route("/workspaces/current/rbac/workspace/datasets/access-policies/<uuid:policy_id>/role-bindings")
+class RBACWorkspaceDatasetRoleBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.RoleBindingsResponse.__name__])
+    def get(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.WorkspaceAccess.list_dataset_role_bindings(tenant_id, account_id, str(policy_id)))
+
+
+@console_ns.route("/workspaces/current/rbac/workspace/datasets/access-policies/<uuid:policy_id>/bindings")
+class RBACWorkspaceDatasetBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.AccessMatrixItem.__name__])
+    def put(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_ReplaceBindingsRequest)
+        return _dump(
+            svc.RBACService.WorkspaceAccess.replace_dataset_bindings(
+                tenant_id,
+                account_id,
+                str(policy_id),
+                svc.ReplaceBindings(role_ids=list(request.role_ids), account_ids=list(request.account_ids)),
+            )
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/workspace/datasets/access-policies/<uuid:policy_id>/member-bindings")
+class RBACWorkspaceDatasetMemberBindingsApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MemberBindingsResponse.__name__])
+    def get(self, policy_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(
+            svc.RBACService.WorkspaceAccess.list_dataset_member_bindings(tenant_id, account_id, str(policy_id))
+        )
+
+
+# ---------------------------------------------------------------------------
+# Member ↔ role bindings (Settings > Members > Assign roles).
+# ---------------------------------------------------------------------------
+
+
+class _ReplaceMemberRolesRequest(BaseModel):
+    role_ids: list[str] = []
+
+    @field_validator("role_ids", mode="before")
+    @classmethod
+    def _coerce_role_ids(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+@console_ns.route("/workspaces/current/rbac/members/<uuid:member_id>/rbac-roles")
+class RBACMemberRolesApi(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MemberRolesResponse.__name__])
+    def get(self, member_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(svc.RBACService.MemberRoles.get(tenant_id, account_id, str(member_id)))
+
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[svc.MemberRolesResponse.__name__])
+    def put(self, member_id):
+        tenant_id, account_id = _current_ids()
+        request = _payload(_ReplaceMemberRolesRequest)
+        return _dump(
+            svc.RBACService.MemberRoles.replace(
+                tenant_id,
+                account_id,
+                str(member_id),
+                role_ids=list(request.role_ids),
+            )
+        )
+
+
+@console_ns.route("/workspaces/current/rbac/roles/<uuid:role_id>/members")
+class ListMembersByRole(Resource):
+    @login_required
+    @console_ns.response(200, "Success", console_ns.models[_MembersInRoleList.__name__])
+    def get(self, role_id):
+        tenant_id, account_id = _current_ids()
+        return _dump(
+            svc.RBACService.Roles.list_members_by_role(tenant_id, role_id=role_id, options=_pagination_options())
+        )
diff --git a/api/controllers/console/workspace/snippets.py b/api/controllers/console/workspace/snippets.py
index 4bd493d25e9..e8f0b228c8b 100644
--- a/api/controllers/console/workspace/snippets.py
+++ b/api/controllers/console/workspace/snippets.py
@@ -21,8 +21,11 @@ from controllers.console.snippets.payloads import (
     UpdateSnippetPayload,
 )
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -126,6 +129,7 @@ class CustomizedSnippetsApi(Resource):
         snippet_service = _snippet_service()
         snippets, total, has_more = snippet_service.get_snippets(
             tenant_id=current_tenant_id,
+            session=db.session,
             page=query.page,
             limit=query.limit,
             keyword=query.keyword,
@@ -150,6 +154,9 @@ class CustomizedSnippetsApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     @with_current_user
     @with_current_tenant_id
     def post(self, current_tenant_id: str, current_user: Account):
@@ -212,6 +219,9 @@ class CustomizedSnippetDetailApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     @with_current_user
     @with_current_tenant_id
     def patch(self, current_tenant_id: str, current_user: Account, snippet_id: str):
@@ -256,6 +266,7 @@ class CustomizedSnippetDetailApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_MANAGE, resource_required=False)
     @with_current_tenant_id
     def delete(self, current_tenant_id: str, snippet_id: str):
         """Delete customized snippet."""
@@ -291,6 +302,9 @@ class CustomizedSnippetExportApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     @with_current_tenant_id
     def get(self, current_tenant_id: str, snippet_id: str):
         """Export snippet as DSL."""
@@ -336,6 +350,9 @@ class CustomizedSnippetImportApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     @with_current_user
     def post(self, current_user: Account):
         """Import snippet from DSL."""
@@ -374,6 +391,9 @@ class CustomizedSnippetImportConfirmApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     @with_current_user
     def post(self, current_user: Account, import_id: str):
         """Confirm a pending snippet import."""
@@ -402,6 +422,9 @@ class CustomizedSnippetCheckDependenciesApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     @with_current_tenant_id
     def get(self, current_tenant_id: str, snippet_id: str):
         """Check dependencies for a snippet."""
@@ -432,6 +455,9 @@ class CustomizedSnippetUseCountIncrementApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(
+        RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
+    )
     @with_current_tenant_id
     def post(self, current_tenant_id: str, snippet_id: str):
         """Increment snippet use count when it is inserted into a workflow."""
diff --git a/api/controllers/console/workspace/tool_providers.py b/api/controllers/console/workspace/tool_providers.py
index 94600f38860..9a92571594c 100644
--- a/api/controllers/console/workspace/tool_providers.py
+++ b/api/controllers/console/workspace/tool_providers.py
@@ -14,9 +14,12 @@ from controllers.common.fields import BinaryFileResponse, RedirectResponse, Simp
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     enterprise_license_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -369,6 +372,7 @@ class ToolBuiltinProviderDeleteApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str):
@@ -411,6 +415,7 @@ class ToolBuiltinProviderUpdateApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -471,6 +476,7 @@ class ToolApiProviderAddApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.TOOL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -540,6 +546,7 @@ class ToolApiProviderUpdateApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.TOOL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -568,6 +575,7 @@ class ToolApiProviderDeleteApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.TOOL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -659,6 +667,7 @@ class ToolWorkflowProviderCreateApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.TOOL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -686,6 +695,7 @@ class ToolWorkflowProviderUpdateApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.TOOL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -713,6 +723,7 @@ class ToolWorkflowProviderDeleteApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.TOOL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -858,6 +869,7 @@ class ToolPluginOAuthApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -959,6 +971,7 @@ class ToolBuiltinProviderSetDefaultApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider: str):
@@ -975,6 +988,7 @@ class ToolOAuthCustomClient(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str):
diff --git a/api/controllers/console/workspace/trigger_providers.py b/api/controllers/console/workspace/trigger_providers.py
index ff1a5c18bd9..b960a5eb9c3 100644
--- a/api/controllers/console/workspace/trigger_providers.py
+++ b/api/controllers/console/workspace/trigger_providers.py
@@ -27,9 +27,12 @@ from services.trigger.trigger_subscription_operator_service import TriggerSubscr
 
 from .. import console_ns
 from ..wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
     is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -143,6 +146,7 @@ class TriggerSubscriptionListApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -172,6 +176,7 @@ class TriggerSubscriptionBuilderCreateApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -201,6 +206,7 @@ class TriggerSubscriptionBuilderGetApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     def get(self, provider: str, subscription_builder_id: str):
         """Get a subscription instance for a trigger provider"""
@@ -218,6 +224,7 @@ class TriggerSubscriptionBuilderVerifyApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -250,6 +257,7 @@ class TriggerSubscriptionBuilderUpdateApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str, subscription_builder_id: str):
@@ -282,6 +290,7 @@ class TriggerSubscriptionBuilderLogsApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     def get(self, provider: str, subscription_builder_id: str):
         """Get the request logs for a subscription instance for a trigger provider"""
@@ -302,6 +311,7 @@ class TriggerSubscriptionBuilderBuildApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
@@ -336,6 +346,7 @@ class TriggerSubscriptionUpdateApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, subscription_id: str):
@@ -393,6 +404,7 @@ class TriggerSubscriptionDeleteApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, subscription_id: str):
@@ -581,6 +593,7 @@ class TriggerOAuthClientManageApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def get(self, tenant_id: str, provider: str):
@@ -626,6 +639,7 @@ class TriggerOAuthClientManageApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str):
@@ -650,6 +664,7 @@ class TriggerOAuthClientManageApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @console_ns.response(200, "Success", console_ns.models[SimpleResultResponse.__name__])
     @with_current_tenant_id
@@ -678,6 +693,7 @@ class TriggerSubscriptionVerifyApi(Resource):
     @setup_required
     @login_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @account_initialization_required
     @with_current_user
     @with_current_tenant_id
diff --git a/api/controllers/console/wraps.py b/api/controllers/console/wraps.py
index 1c0f210123a..017793ffe0b 100644
--- a/api/controllers/console/wraps.py
+++ b/api/controllers/console/wraps.py
@@ -9,9 +9,14 @@ from typing import Any, Concatenate, overload
 from flask import abort, request
 from pydantic import BaseModel, ValidationError
 from sqlalchemy import select
-from werkzeug.exceptions import UnprocessableEntity
+from werkzeug.exceptions import Forbidden, UnprocessableEntity
 
 from configs import dify_config
+from controllers.common.wraps import (
+    RBACPermission,
+    RBACResourceScope,
+    rbac_permission_required,
+)
 from controllers.console.auth.error import AuthenticationFailedError, EmailCodeError
 from controllers.console.workspace.error import AccountNotInitializedError
 from enums.cloud_plan import CloudPlan
@@ -28,6 +33,10 @@ from services.operation_service import OperationService, UtmInfo
 
 from .error import NotInitValidateError, NotSetupError, UnauthorizedAndForceLogout
 
+# Re-exported so controllers can import the RBAC enums and decorator alongside
+# other console wraps from this module.
+__all__ = ["RBACPermission", "RBACResourceScope", "rbac_permission_required"]
+
 # Field names for decryption
 FIELD_NAME_PASSWORD = "password"
 FIELD_NAME_CODE = "code"
@@ -335,15 +344,15 @@ def knowledge_pipeline_publish_enabled[**P, R](view: Callable[P, R]) -> Callable
 def edit_permission_required[**P, R](f: Callable[P, R]) -> Callable[P, R]:
     @wraps(f)
     def decorated_function(*args: P.args, **kwargs: P.kwargs):
-        from werkzeug.exceptions import Forbidden
 
         from libs.login import current_user
 
-        user = current_user._get_current_object()  # type: ignore
-        if not isinstance(user, Account):
-            raise Forbidden()
-        if not current_user.has_edit_permission:
-            raise Forbidden()
+        if not dify_config.RBAC_ENABLED:
+            user = current_user._get_current_object()  # type: ignore
+            if not isinstance(user, Account):
+                raise Forbidden()
+            if not current_user.has_edit_permission:
+                raise Forbidden()
         return f(*args, **kwargs)
 
     return decorated_function
@@ -352,13 +361,13 @@ def edit_permission_required[**P, R](f: Callable[P, R]) -> Callable[P, R]:
 def is_admin_or_owner_required[**P, R](f: Callable[P, R]) -> Callable[P, R]:
     @wraps(f)
     def decorated_function(*args: P.args, **kwargs: P.kwargs):
-        from werkzeug.exceptions import Forbidden
 
         from libs.login import current_user
 
-        user = current_user._get_current_object()
-        if not isinstance(user, Account) or not user.is_admin_or_owner:
-            raise Forbidden()
+        if not dify_config.RBAC_ENABLED:
+            user = current_user._get_current_object()
+            if not isinstance(user, Account) or not user.is_admin_or_owner:
+                raise Forbidden()
         return f(*args, **kwargs)
 
     return decorated_function
diff --git a/api/controllers/inner_api/__init__.py b/api/controllers/inner_api/__init__.py
index c782c93ffd4..20fd651b759 100644
--- a/api/controllers/inner_api/__init__.py
+++ b/api/controllers/inner_api/__init__.py
@@ -9,14 +9,16 @@ api = ExternalApi(
     bp,
     version="1.0",
     title="Inner API",
-    description="Internal APIs for enterprise features, billing, and plugin communication",
+    description="Internal APIs for enterprise features, billing, knowledge retrieval, and plugin communication",
 )
 
 # Create namespace
 inner_api_ns = Namespace("inner_api", description="Internal API operations", path="/")
 
 from . import mail as _mail
+from . import runtime_credentials as _runtime_credentials
 from .app import dsl as _app_dsl
+from .knowledge import retrieval as _knowledge_retrieval
 from .plugin import agent_drive as _agent_drive
 from .plugin import plugin as _plugin
 from .workspace import workspace as _workspace
@@ -26,8 +28,10 @@ api.add_namespace(inner_api_ns)
 __all__ = [
     "_agent_drive",
     "_app_dsl",
+    "_knowledge_retrieval",
     "_mail",
     "_plugin",
+    "_runtime_credentials",
     "_workspace",
     "api",
     "bp",
diff --git a/api/controllers/inner_api/knowledge/__init__.py b/api/controllers/inner_api/knowledge/__init__.py
new file mode 100644
index 00000000000..20c447fa778
--- /dev/null
+++ b/api/controllers/inner_api/knowledge/__init__.py
@@ -0,0 +1 @@
+"""Inner knowledge retrieval endpoints."""
diff --git a/api/controllers/inner_api/knowledge/retrieval.py b/api/controllers/inner_api/knowledge/retrieval.py
new file mode 100644
index 00000000000..ef33fbda518
--- /dev/null
+++ b/api/controllers/inner_api/knowledge/retrieval.py
@@ -0,0 +1,110 @@
+"""Inner API endpoint for tenant-scoped knowledge retrieval.
+
+This controller is a thin HTTP wrapper around
+``services.knowledge_retrieval_inner_service.InnerKnowledgeRetrievalService``.
+It intentionally keeps authorization simple: shared inner API key plus
+tenant-scoped app/dataset validation in the service layer.
+"""
+
+from flask_restx import Resource
+from pydantic import ValidationError
+
+from controllers.common.schema import register_response_schema_models, register_schema_models
+from controllers.inner_api import inner_api_ns
+from controllers.inner_api.wraps import inner_api_only
+from core.workflow.nodes.knowledge_retrieval import exc as retrieval_exc
+from libs.exception import BaseHTTPException
+from services.entities.knowledge_retrieval_inner import InnerKnowledgeRetrieveRequest, InnerKnowledgeRetrieveResponse
+from services.errors.knowledge_retrieval import ExternalKnowledgeRetrievalError, InnerKnowledgeRetrievalServiceError
+from services.knowledge_retrieval_inner_service import InnerKnowledgeRetrievalService
+
+
+class InnerKnowledgeRetrievalHttpError(BaseHTTPException):
+    error_code = "knowledge_retrieve_failed"
+    description = "Knowledge retrieval failed."
+    code = 500
+
+    def __init__(
+        self,
+        *,
+        error_code: str | None = None,
+        description: str | None = None,
+        status_code: int | None = None,
+    ) -> None:
+        if error_code is not None:
+            self.error_code = error_code
+        if description is not None:
+            self.description = description
+        if status_code is not None:
+            self.code = status_code
+        super().__init__(self.description)
+
+
+register_schema_models(inner_api_ns, InnerKnowledgeRetrieveRequest)
+register_response_schema_models(inner_api_ns, InnerKnowledgeRetrieveResponse)
+
+
+@inner_api_ns.route("/knowledge/retrieve")
+class InnerKnowledgeRetrieveApi(Resource):
+    """Retrieve knowledge from one or more datasets within the caller tenant."""
+
+    @inner_api_only
+    @inner_api_ns.doc("inner_knowledge_retrieve")
+    @inner_api_ns.doc(description="Retrieve knowledge for trusted internal callers")
+    @inner_api_ns.expect(inner_api_ns.models[InnerKnowledgeRetrieveRequest.__name__])
+    @inner_api_ns.response(
+        200,
+        "Knowledge retrieved successfully",
+        inner_api_ns.models[InnerKnowledgeRetrieveResponse.__name__],
+    )
+    @inner_api_ns.doc(
+        responses={
+            400: "Invalid request body",
+            401: "Unauthorized - invalid inner API key",
+            403: "Caller tenant does not own the requested resource",
+            404: "App or dataset not found",
+            422: "Invalid retrieval configuration",
+            429: "Knowledge retrieval rate limited",
+            502: "External knowledge retrieval failed",
+            500: "Unexpected knowledge retrieval failure",
+        }
+    )
+    def post(self) -> dict[str, object]:
+        """Validate the payload, run retrieval, and return workflow-style sources."""
+        try:
+            payload = InnerKnowledgeRetrieveRequest.model_validate(inner_api_ns.payload or {})
+        except ValidationError as exc:
+            raise InnerKnowledgeRetrievalHttpError(
+                error_code="invalid_request",
+                description=str(exc),
+                status_code=400,
+            ) from exc
+
+        try:
+            response = InnerKnowledgeRetrievalService().retrieve(payload)
+        except InnerKnowledgeRetrievalServiceError as exc:
+            raise InnerKnowledgeRetrievalHttpError(
+                error_code=exc.error_code,
+                description=exc.description,
+                status_code=exc.status_code,
+            ) from exc
+        except retrieval_exc.RateLimitExceededError as exc:
+            raise InnerKnowledgeRetrievalHttpError(
+                error_code="knowledge_rate_limited",
+                description=str(exc),
+                status_code=429,
+            ) from exc
+        except ExternalKnowledgeRetrievalError as exc:
+            raise InnerKnowledgeRetrievalHttpError(
+                error_code="external_knowledge_failed",
+                description=str(exc),
+                status_code=502,
+            ) from exc
+        except ValueError as exc:
+            raise InnerKnowledgeRetrievalHttpError(
+                error_code="retrieval_config_invalid",
+                description=str(exc),
+                status_code=422,
+            ) from exc
+
+        return response.model_dump(mode="json", by_alias=True)
diff --git a/api/controllers/inner_api/plugin/wraps.py b/api/controllers/inner_api/plugin/wraps.py
index ad369660d9a..cc68fab6c99 100644
--- a/api/controllers/inner_api/plugin/wraps.py
+++ b/api/controllers/inner_api/plugin/wraps.py
@@ -10,6 +10,7 @@ from sqlalchemy.orm import sessionmaker
 from extensions.ext_database import db
 from libs.login import current_user
 from models.account import Tenant
+from models.enums import EndUserType
 from models.model import DefaultEndUserSessionID, EndUser
 
 
@@ -75,7 +76,7 @@ def get_user(tenant_id: str, user_id: str | None) -> EndUser:
             if not user_model:
                 user_model = EndUser(
                     tenant_id=tenant_id,
-                    type="service_api",
+                    type=EndUserType.SERVICE_API,
                     is_anonymous=is_anonymous,
                     session_id=user_id,
                 )
diff --git a/api/controllers/inner_api/runtime_credentials.py b/api/controllers/inner_api/runtime_credentials.py
new file mode 100644
index 00000000000..bea65230d73
--- /dev/null
+++ b/api/controllers/inner_api/runtime_credentials.py
@@ -0,0 +1,205 @@
+"""Inner API endpoints for runtime credential resolution.
+
+Called by Enterprise while resolving AppRunner runtime artifacts. The endpoint
+returns decrypted model and tool credentials for in-memory runtime use only.
+"""
+
+import json
+import logging
+from json import JSONDecodeError
+from typing import Any
+
+from flask_restx import Resource
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from controllers.common.schema import register_schema_model
+from controllers.console.wraps import setup_required
+from controllers.inner_api import inner_api_ns
+from controllers.inner_api.wraps import enterprise_inner_api_only
+from core.helper import encrypter
+from core.helper.provider_cache import ToolProviderCredentialsCache
+from core.helper.provider_encryption import create_provider_encrypter
+from core.plugin.impl.model_runtime_factory import create_plugin_provider_manager
+from core.tools.tool_manager import ToolManager
+from extensions.ext_database import db
+from models.provider import ProviderCredential
+from models.tools import BuiltinToolProvider
+
+logger = logging.getLogger(__name__)
+
+_KIND_MODEL = "model"
+_KIND_TOOL = "tool"
+
+# (body, status) pair returned by a resolver helper when resolution fails.
+ResolveError = tuple[dict[str, str], int]
+
+
+class InnerRuntimeCredentialResolveItem(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    credential_id: str = Field(description="Credential id")
+    provider: str = Field(description="Runtime provider identifier, for example langgenius/openai/openai")
+    kind: str = Field(description="Credential kind, either 'model' or 'tool'")
+
+
+class InnerRuntimeCredentialsResolvePayload(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    tenant_id: str = Field(description="Workspace id")
+    credentials: list[InnerRuntimeCredentialResolveItem] = Field(default_factory=list)
+
+
+register_schema_model(inner_api_ns, InnerRuntimeCredentialsResolvePayload)
+
+
+@inner_api_ns.route("/enterprise/credentials/resolve")
+class EnterpriseRuntimeCredentialsResolve(Resource):
+    @setup_required
+    @enterprise_inner_api_only
+    @inner_api_ns.doc(
+        "enterprise_runtime_credentials_resolve",
+        responses={
+            200: "Credentials resolved",
+            400: "Invalid request or credential config",
+            404: "Provider or credential not found",
+        },
+    )
+    @inner_api_ns.expect(inner_api_ns.models[InnerRuntimeCredentialsResolvePayload.__name__])
+    def post(self):
+        args = InnerRuntimeCredentialsResolvePayload.model_validate(inner_api_ns.payload or {})
+        if not args.credentials:
+            return {"credentials": []}, 200
+
+        # Model resolution shares one provider configuration set; build it lazily
+        # so a tool-only request never pays for the plugin daemon round trip.
+        model_configurations = None
+
+        resolved: list[dict[str, Any]] = []
+        for item in args.credentials:
+            if item.kind == _KIND_MODEL:
+                if model_configurations is None:
+                    provider_manager = create_plugin_provider_manager(tenant_id=args.tenant_id)
+                    model_configurations = provider_manager.get_configurations(args.tenant_id)
+                values, error = _resolve_model(args.tenant_id, model_configurations, item)
+            elif item.kind == _KIND_TOOL:
+                values, error = _resolve_tool(args.tenant_id, item)
+            else:
+                return {"message": f"unsupported credential kind '{item.kind}'"}, 400
+
+            if error is not None:
+                return error
+            resolved.append(
+                {
+                    "credential_id": item.credential_id,
+                    "kind": item.kind,
+                    "provider": item.provider,
+                    "values": values,
+                }
+            )
+
+        return {"credentials": resolved}, 200
+
+
+def _resolve_model(
+    tenant_id: str, provider_configurations: Any, item: InnerRuntimeCredentialResolveItem
+) -> tuple[dict[str, Any] | None, ResolveError | None]:
+    provider_configuration = provider_configurations.get(item.provider)
+    if provider_configuration is None:
+        return None, ({"message": f"provider '{item.provider}' not found"}, 404)
+
+    provider_schema = provider_configuration.provider.provider_credential_schema
+    secret_variables = provider_configuration.extract_secret_variables(
+        provider_schema.credential_form_schemas if provider_schema else []
+    )
+
+    with Session(db.engine) as session:
+        stmt = select(ProviderCredential).where(
+            ProviderCredential.id == item.credential_id,
+            ProviderCredential.tenant_id == tenant_id,
+            ProviderCredential.provider_name.in_(provider_configuration._get_provider_names()),
+        )
+        credential = session.execute(stmt).scalar_one_or_none()
+
+    if credential is None or not credential.encrypted_config:
+        return None, ({"message": f"credential '{item.credential_id}' not found"}, 404)
+
+    try:
+        values = json.loads(credential.encrypted_config)
+    except JSONDecodeError:
+        return None, ({"message": f"credential '{item.credential_id}' has invalid config"}, 400)
+    if not isinstance(values, dict):
+        return None, ({"message": f"credential '{item.credential_id}' has invalid config"}, 400)
+
+    for key in secret_variables:
+        value = values.get(key)
+        if value is None:
+            continue
+        try:
+            values[key] = encrypter.decrypt_token(tenant_id=tenant_id, token=value)
+        except Exception as exc:
+            logger.warning(
+                "failed to resolve runtime model credential",
+                extra={
+                    "credential_id": item.credential_id,
+                    "provider": item.provider,
+                    "tenant_id": tenant_id,
+                    "error": type(exc).__name__,
+                },
+            )
+            return None, ({"message": f"credential '{item.credential_id}' decrypt failed"}, 400)
+
+    return values, None
+
+
+def _resolve_tool(
+    tenant_id: str, item: InnerRuntimeCredentialResolveItem
+) -> tuple[dict[str, Any] | None, ResolveError | None]:
+    try:
+        provider_controller = ToolManager.get_builtin_provider(item.provider, tenant_id)
+    except Exception as exc:
+        logger.warning(
+            "failed to load runtime tool provider",
+            extra={"provider": item.provider, "tenant_id": tenant_id, "error": type(exc).__name__},
+        )
+        return None, ({"message": f"tool provider '{item.provider}' not found"}, 404)
+
+    with Session(db.engine) as session:
+        stmt = select(BuiltinToolProvider).where(
+            BuiltinToolProvider.id == item.credential_id,
+            BuiltinToolProvider.provider == item.provider,
+            BuiltinToolProvider.tenant_id == tenant_id,
+        )
+        builtin_provider = session.execute(stmt).scalar_one_or_none()
+
+    if builtin_provider is None:
+        return None, ({"message": f"credential '{item.credential_id}' not found"}, 404)
+
+    try:
+        # Tool credentials are stored as a single encrypted dict; the secret
+        # fields are decided by the schema bound to this credential type.
+        provider_encrypter, _ = create_provider_encrypter(
+            tenant_id=tenant_id,
+            config=[
+                schema.to_basic_provider_config()
+                for schema in provider_controller.get_credentials_schema_by_type(builtin_provider.credential_type)
+            ],
+            cache=ToolProviderCredentialsCache(
+                tenant_id=tenant_id, provider=item.provider, credential_id=builtin_provider.id
+            ),
+        )
+        values = dict(provider_encrypter.decrypt(builtin_provider.credentials))
+    except Exception as exc:
+        logger.warning(
+            "failed to resolve runtime tool credential",
+            extra={
+                "credential_id": item.credential_id,
+                "provider": item.provider,
+                "tenant_id": tenant_id,
+                "error": type(exc).__name__,
+            },
+        )
+        return None, ({"message": f"credential '{item.credential_id}' decrypt failed"}, 400)
+
+    return values, None
diff --git a/api/controllers/inner_api/workspace/workspace.py b/api/controllers/inner_api/workspace/workspace.py
index ef0a46db63a..dd93616e6b1 100644
--- a/api/controllers/inner_api/workspace/workspace.py
+++ b/api/controllers/inner_api/workspace/workspace.py
@@ -48,7 +48,7 @@ class EnterpriseWorkspace(Resource):
             return {"message": "owner account not found."}, 404
 
         tenant = TenantService.create_tenant(args.name, is_from_dashboard=True)
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db.session, role="owner")
 
         tenant_was_created.send(tenant)
 
diff --git a/api/controllers/inner_api/wraps.py b/api/controllers/inner_api/wraps.py
index 95181b93cfa..999932c98e1 100644
--- a/api/controllers/inner_api/wraps.py
+++ b/api/controllers/inner_api/wraps.py
@@ -8,39 +8,39 @@ from flask import abort, request
 
 from configs import dify_config
 from core.db.session_factory import session_factory
+from libs.exception import BaseHTTPException
 from models.model import EndUser
 
 
-def billing_inner_api_only[**P, R](view: Callable[P, R]) -> Callable[P, R]:
+class InnerApiUnauthorizedError(BaseHTTPException):
+    error_code = "inner_api_unauthorized"
+    description = "Unauthorized."
+    code = 401
+
+
+def inner_api_only[**P, R](view: Callable[P, R]) -> Callable[P, R]:
+    """Restrict access to callers authenticated with the shared inner API key."""
+
     @wraps(view)
     def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
         if not dify_config.INNER_API:
             abort(404)
 
-        # get header 'X-Inner-Api-Key'
         inner_api_key = request.headers.get("X-Inner-Api-Key")
         if not inner_api_key or inner_api_key != dify_config.INNER_API_KEY:
-            abort(401)
+            raise InnerApiUnauthorizedError()
 
         return view(*args, **kwargs)
 
     return decorated
 
 
+def billing_inner_api_only[**P, R](view: Callable[P, R]) -> Callable[P, R]:
+    return inner_api_only(view)
+
+
 def enterprise_inner_api_only[**P, R](view: Callable[P, R]) -> Callable[P, R]:
-    @wraps(view)
-    def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
-        if not dify_config.INNER_API:
-            abort(404)
-
-        # get header 'X-Inner-Api-Key'
-        inner_api_key = request.headers.get("X-Inner-Api-Key")
-        if not inner_api_key or inner_api_key != dify_config.INNER_API_KEY:
-            abort(401)
-
-        return view(*args, **kwargs)
-
-    return decorated
+    return inner_api_only(view)
 
 
 def enterprise_inner_api_user_auth[**P, R](view: Callable[P, R]) -> Callable[P, R]:
diff --git a/api/controllers/mcp/mcp.py b/api/controllers/mcp/mcp.py
index f652bbc5814..cda6b915018 100644
--- a/api/controllers/mcp/mcp.py
+++ b/api/controllers/mcp/mcp.py
@@ -13,7 +13,7 @@ from core.mcp.server.streamable_http import handle_mcp_request
 from extensions.ext_database import db
 from graphon.variables.input_entities import VariableEntity, VariableEntityType
 from libs import helper
-from models.enums import AppMCPServerStatus
+from models.enums import AppMCPServerStatus, EndUserType
 from models.model import App, AppMCPServer, AppMode, EndUser
 
 
@@ -201,7 +201,7 @@ class MCPAppApi(Resource):
                 select(EndUser)
                 .where(EndUser.tenant_id == tenant_id)
                 .where(EndUser.session_id == mcp_server_id)
-                .where(EndUser.type == "mcp")
+                .where(EndUser.type == EndUserType.MCP)
                 .limit(1)
             )
 
@@ -212,7 +212,7 @@ class MCPAppApi(Resource):
         end_user = EndUser(
             tenant_id=tenant_id,
             app_id=app_id,
-            type="mcp",
+            type=EndUserType.MCP,
             name=client_name,
             session_id=mcp_server_id,
         )
diff --git a/api/controllers/openapi/apps.py b/api/controllers/openapi/apps.py
index 84b1610d5f5..c4796313c0b 100644
--- a/api/controllers/openapi/apps.py
+++ b/api/controllers/openapi/apps.py
@@ -174,7 +174,7 @@ class AppListApi(Resource):
 
         tag_ids: list[str] | None = None
         if query.tag:
-            tags = TagService.get_tag_by_tag_name("app", workspace_id, query.tag)
+            tags = TagService.get_tag_by_tag_name("app", workspace_id, query.tag, db.session)
             if not tags:
                 return empty
             tag_ids = [tag.id for tag in tags]
@@ -191,7 +191,7 @@ class AppListApi(Resource):
             openapi_visible=True,
         )
 
-        pagination = AppService().get_paginate_apps(str(auth_data.account_id), workspace_id, params)
+        pagination = AppService().get_paginate_apps(str(auth_data.account_id), workspace_id, params, db.session)
         if pagination is None:
             return empty
 
diff --git a/api/controllers/openapi/auth/prepare.py b/api/controllers/openapi/auth/prepare.py
index 3826f2c33cd..afded64702d 100644
--- a/api/controllers/openapi/auth/prepare.py
+++ b/api/controllers/openapi/auth/prepare.py
@@ -6,9 +6,9 @@ from flask import request
 from werkzeug.exceptions import Forbidden, InternalServerError, NotFound, Unauthorized
 
 from controllers.openapi.auth.data import AuthData
-from core.app.entities.app_invoke_entities import InvokeFrom
 from extensions.ext_database import db
 from models.account import TenantStatus
+from models.enums import EndUserType
 from services.account_service import AccountService, TenantService
 from services.app_service import AppService
 from services.end_user_service import EndUserService
@@ -85,7 +85,7 @@ def resolve_external_user(data: AuthData) -> None:
     if data.tenant is None or data.app is None or data.external_identity is None:
         raise Unauthorized("missing context for external user resolution")
     end_user = EndUserService.get_or_create_end_user_by_type(
-        InvokeFrom.OPENAPI,
+        EndUserType.OPENAPI,
         tenant_id=str(data.tenant.id),
         app_id=str(data.app.id),
         user_id=data.external_identity.email,
diff --git a/api/controllers/service_api/app/annotation.py b/api/controllers/service_api/app/annotation.py
index e99018a985d..627545d7168 100644
--- a/api/controllers/service_api/app/annotation.py
+++ b/api/controllers/service_api/app/annotation.py
@@ -23,20 +23,25 @@ from services.annotation_service import (
 
 
 class AnnotationCreatePayload(BaseModel):
-    question: str = Field(description="Annotation question")
-    answer: str = Field(description="Annotation answer")
+    question: str = Field(description="Annotation question.")
+    answer: str = Field(description="Annotation answer.")
 
 
 class AnnotationReplyActionPayload(BaseModel):
-    score_threshold: float = Field(description="Score threshold for annotation matching")
-    embedding_provider_name: str = Field(description="Embedding provider name")
-    embedding_model_name: str = Field(description="Embedding model name")
+    score_threshold: float = Field(
+        description=(
+            "Minimum similarity score for an annotation to be considered a match. Higher values require closer matches."
+        ),
+        json_schema_extra={"format": "float"},
+    )
+    embedding_provider_name: str = Field(description="Name of the embedding model provider.")
+    embedding_model_name: str = Field(description="Name of the embedding model to use for annotation matching.")
 
 
 class AnnotationListQuery(BaseModel):
-    page: int = Field(default=1, ge=1, description="Page number")
-    limit: int = Field(default=20, ge=1, description="Number of annotations per page")
-    keyword: str = Field(default="", description="Keyword to search annotations")
+    page: int = Field(default=1, ge=1, description="Page number for pagination.")
+    limit: int = Field(default=20, ge=1, description="Number of items per page.")
+    keyword: str = Field(default="", description="Keyword to filter annotations by question or answer content.")
 
 
 class AnnotationJobStatusResponse(ResponseModel):
@@ -45,6 +50,13 @@ class AnnotationJobStatusResponse(ResponseModel):
     error_msg: str | None = None
 
 
+ANNOTATION_REPLY_ACTION_PARAM = {
+    "description": "Action to perform: `enable` or `disable`.",
+    "enum": ["enable", "disable"],
+    "type": "string",
+}
+
+
 register_schema_models(
     service_api_ns,
     AnnotationCreatePayload,
@@ -58,10 +70,22 @@ register_response_schema_models(service_api_ns, AnnotationJobStatusResponse)
 
 @service_api_ns.route("/apps/annotation-reply/<string:action>")
 class AnnotationReplyActionApi(Resource):
+    @service_api_ns.doc(
+        summary="Configure Annotation Reply",
+        description=(
+            "Enables or disables the annotation reply feature. Requires embedding model configuration "
+            "when enabling. Executes asynchronously — use [Get Annotation Reply Job "
+            "Status](/api-reference/annotations/get-annotation-reply-job-status) to track progress."
+        ),
+        tags=["Annotations"],
+        responses={
+            200: "Annotation reply settings task initiated.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[AnnotationReplyActionPayload.__name__])
     @service_api_ns.doc("annotation_reply_action")
     @service_api_ns.doc(description="Enable or disable annotation reply feature")
-    @service_api_ns.doc(params={"action": "Action to perform: 'enable' or 'disable'"})
+    @service_api_ns.doc(params={"action": ANNOTATION_REPLY_ACTION_PARAM})
     @service_api_ns.doc(
         responses={
             200: "Action completed successfully",
@@ -92,9 +116,29 @@ class AnnotationReplyActionApi(Resource):
 
 @service_api_ns.route("/apps/annotation-reply/<string:action>/status/<uuid:job_id>")
 class AnnotationReplyActionStatusApi(Resource):
+    @service_api_ns.doc(
+        summary="Get Annotation Reply Job Status",
+        description=(
+            "Retrieves the status of an asynchronous annotation reply configuration job started by "
+            "[Configure Annotation Reply](/api-reference/annotations/configure-annotation-reply)."
+        ),
+        tags=["Annotations"],
+        responses={
+            200: "Successfully retrieved task status.",
+            400: "`invalid_param` : The specified job does not exist.",
+        },
+    )
     @service_api_ns.doc("get_annotation_reply_action_status")
     @service_api_ns.doc(description="Get the status of an annotation reply action job")
-    @service_api_ns.doc(params={"action": "Action type", "job_id": "Job ID"})
+    @service_api_ns.doc(
+        params={
+            "action": ANNOTATION_REPLY_ACTION_PARAM,
+            "job_id": (
+                "Job ID returned by "
+                "[Configure Annotation Reply](/api-reference/annotations/configure-annotation-reply)."
+            ),
+        }
+    )
     @service_api_ns.doc(
         responses={
             200: "Job status retrieved successfully",
@@ -127,6 +171,14 @@ class AnnotationReplyActionStatusApi(Resource):
 
 @service_api_ns.route("/apps/annotations")
 class AnnotationListApi(Resource):
+    @service_api_ns.doc(
+        summary="List Annotations",
+        description="Retrieves a paginated list of annotations for the application. Supports keyword search filtering.",
+        tags=["Annotations"],
+        responses={
+            200: "Successfully retrieved annotation list.",
+        },
+    )
     @service_api_ns.doc("list_annotations")
     @service_api_ns.doc(description="List annotations for the application")
     @service_api_ns.doc(params=query_params_from_model(AnnotationListQuery))
@@ -159,6 +211,17 @@ class AnnotationListApi(Resource):
         )
         return response.model_dump(mode="json")
 
+    @service_api_ns.doc(
+        summary="Create Annotation",
+        description=(
+            "Creates a new annotation. Annotations provide predefined question-answer pairs that the app "
+            "can match and return directly instead of generating a response."
+        ),
+        tags=["Annotations"],
+        responses={
+            201: "Annotation created successfully.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[AnnotationCreatePayload.__name__])
     @service_api_ns.doc("create_annotation")
     @service_api_ns.doc(description="Create a new annotation")
@@ -185,10 +248,20 @@ class AnnotationListApi(Resource):
 
 @service_api_ns.route("/apps/annotations/<uuid:annotation_id>")
 class AnnotationUpdateDeleteApi(Resource):
+    @service_api_ns.doc(
+        summary="Update Annotation",
+        description="Updates the question and answer of an existing annotation.",
+        tags=["Annotations"],
+        responses={
+            200: "Annotation updated successfully.",
+            403: "`forbidden` : Insufficient permissions to edit annotations.",
+            404: "`not_found` : Annotation does not exist.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[AnnotationCreatePayload.__name__])
     @service_api_ns.doc("update_annotation")
     @service_api_ns.doc(description="Update an existing annotation")
-    @service_api_ns.doc(params={"annotation_id": "Annotation ID"})
+    @service_api_ns.doc(params={"annotation_id": "The unique identifier of the annotation to update."})
     @service_api_ns.doc(
         responses={
             200: "Annotation updated successfully",
@@ -212,9 +285,19 @@ class AnnotationUpdateDeleteApi(Resource):
         response = Annotation.model_validate(annotation, from_attributes=True)
         return response.model_dump(mode="json")
 
+    @service_api_ns.doc(
+        summary="Delete Annotation",
+        description="Deletes an annotation and its associated hit history.",
+        tags=["Annotations"],
+        responses={
+            204: "Annotation deleted successfully.",
+            403: "`forbidden` : Insufficient permissions to edit annotations.",
+            404: "`not_found` : Annotation does not exist.",
+        },
+    )
     @service_api_ns.doc("delete_annotation")
     @service_api_ns.doc(description="Delete an annotation")
-    @service_api_ns.doc(params={"annotation_id": "Annotation ID"})
+    @service_api_ns.doc(params={"annotation_id": "The unique identifier of the annotation to delete."})
     @service_api_ns.doc(
         responses={
             204: "Annotation deleted successfully",
diff --git a/api/controllers/service_api/app/app.py b/api/controllers/service_api/app/app.py
index cc55876bd5a..d670c7f5a6f 100644
--- a/api/controllers/service_api/app/app.py
+++ b/api/controllers/service_api/app/app.py
@@ -33,6 +33,18 @@ register_response_schema_models(service_api_ns, Parameters, AppMetaResponse, App
 class AppParameterApi(Resource):
     """Resource for app variables."""
 
+    @service_api_ns.doc(
+        summary="Get App Parameters",
+        description=(
+            "Retrieve the application's input form configuration, including feature switches, input "
+            "parameter names, types, and default values."
+        ),
+        tags=["Applications"],
+        responses={
+            200: "Application parameters information.",
+            400: "`app_unavailable` : App unavailable or misconfigured.",
+        },
+    )
     @service_api_ns.doc("get_app_parameters")
     @service_api_ns.doc(description="Retrieve application input parameters and configuration")
     @service_api_ns.doc(
@@ -71,6 +83,14 @@ class AppParameterApi(Resource):
 
 @service_api_ns.route("/meta")
 class AppMetaApi(Resource):
+    @service_api_ns.doc(
+        summary="Get App Meta",
+        description="Retrieve metadata about this application, including tool icons and other configuration details.",
+        tags=["Applications"],
+        responses={
+            200: "Successfully retrieved application meta information.",
+        },
+    )
     @service_api_ns.doc("get_app_meta")
     @service_api_ns.doc(description="Get application metadata")
     @service_api_ns.doc(
@@ -92,6 +112,14 @@ class AppMetaApi(Resource):
 
 @service_api_ns.route("/info")
 class AppInfoApi(Resource):
+    @service_api_ns.doc(
+        summary="Get App Info",
+        description="Retrieve basic information about this application, including name, description, tags, and mode.",
+        tags=["Applications"],
+        responses={
+            200: "Basic information of the application.",
+        },
+    )
     @service_api_ns.doc("get_app_info")
     @service_api_ns.doc(description="Get basic application information")
     @service_api_ns.doc(
diff --git a/api/controllers/service_api/app/audio.py b/api/controllers/service_api/app/audio.py
index 0c2047a824e..2b5a9ba83a1 100644
--- a/api/controllers/service_api/app/audio.py
+++ b/api/controllers/service_api/app/audio.py
@@ -20,6 +20,7 @@ from controllers.service_api.app.error import (
     ProviderQuotaExceededError,
     UnsupportedAudioTypeError,
 )
+from controllers.service_api.schema import binary_response, expect_with_user, multipart_file_params
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from core.errors.error import ModelCurrentlyNotSupportError, ProviderTokenNotInitError, QuotaExceededError
 from graphon.model_runtime.errors.invoke import InvokeError
@@ -39,8 +40,40 @@ register_response_schema_models(service_api_ns, AudioBinaryResponse, AudioTransc
 
 @service_api_ns.route("/audio-to-text")
 class AudioApi(Resource):
+    @service_api_ns.doc(
+        summary="Convert Audio to Text",
+        description=(
+            "Convert audio file to text. Supported MIME types: `audio/mp3`, `audio/mpga`, `audio/m4a`, "
+            "`audio/wav`, and `audio/amr`. File size limit is `30 MB`."
+        ),
+        tags=["TTS"],
+        responses={
+            200: "Successfully converted audio to text.",
+            400: (
+                "- `app_unavailable` : App unavailable or misconfigured.\n"
+                "- `provider_not_support_speech_to_text` : Model provider does not support speech-to-text.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found.\n"
+                "- `provider_quota_exceeded` : Model provider quota exhausted.\n"
+                "- `model_currently_not_support` : Current model does not support this operation.\n"
+                "- `completion_request_error` : Speech recognition request failed."
+            ),
+            413: "`audio_too_large` : Audio file size exceeded the limit.",
+            415: "`unsupported_audio_type` : Audio type is not allowed.",
+            500: "`internal_server_error` : Internal server error.",
+        },
+    )
     @service_api_ns.doc("audio_to_text")
     @service_api_ns.doc(description="Convert audio to text using speech-to-text")
+    @service_api_ns.doc(
+        consumes=["multipart/form-data"],
+        params=multipart_file_params(
+            include_user=True,
+            file_description=(
+                "Audio file to transcribe. Supported MIME types: `audio/mp3`, `audio/mpga`, `audio/m4a`, "
+                "`audio/wav`, and `audio/amr`. File size limit is `30 MB`."
+            ),
+        ),
+    )
     @service_api_ns.doc(
         responses={
             200: "Audio successfully transcribed",
@@ -99,7 +132,27 @@ register_schema_model(service_api_ns, TextToAudioPayload)
 
 @service_api_ns.route("/text-to-audio")
 class TextApi(Resource):
-    @service_api_ns.expect(service_api_ns.models[TextToAudioPayload.__name__])
+    @service_api_ns.doc(
+        summary="Convert Text to Audio",
+        description="Convert text to speech.",
+        tags=["TTS"],
+        responses={
+            200: (
+                "Returns the generated audio. Generator responses are streamed by the service as `audio/mpeg`; "
+                "otherwise the provider output is returned directly."
+            ),
+            400: (
+                "- `app_unavailable` : App unavailable or misconfigured.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found.\n"
+                "- `provider_quota_exceeded` : Model provider quota exhausted.\n"
+                "- `model_currently_not_support` : Current model does not support this operation.\n"
+                "- `completion_request_error` : Text-to-speech request failed."
+            ),
+            500: "`internal_server_error` : Internal server error.",
+        },
+    )
+    @expect_with_user(service_api_ns, TextToAudioPayload)
+    @binary_response(service_api_ns, "audio/mpeg")
     @service_api_ns.doc("text_to_audio")
     @service_api_ns.doc(description="Convert text to audio using text-to-speech")
     @service_api_ns.doc(
@@ -110,11 +163,7 @@ class TextApi(Resource):
             500: "Internal server error",
         }
     )
-    @service_api_ns.response(
-        200,
-        "Text successfully converted to audio",
-        service_api_ns.models[AudioBinaryResponse.__name__],
-    )
+    @service_api_ns.response(200, "Text successfully converted to audio")
     @validate_app_token(fetch_user_arg=FetchUserArg(fetch_from=WhereisUserArg.JSON))
     def post(self, app_model: App, end_user: EndUser):
         """Convert text to audio using text-to-speech.
diff --git a/api/controllers/service_api/app/completion.py b/api/controllers/service_api/app/completion.py
index 7009bbfeaf6..1468f3d776f 100644
--- a/api/controllers/service_api/app/completion.py
+++ b/api/controllers/service_api/app/completion.py
@@ -5,6 +5,7 @@ from uuid import UUID
 from flask import request
 from flask_restx import Resource
 from pydantic import BaseModel, Field, field_validator
+from pydantic.json_schema import SkipJsonSchema
 from werkzeug.exceptions import BadRequest, InternalServerError, NotFound
 
 import services
@@ -20,6 +21,12 @@ from controllers.service_api.app.error import (
     ProviderNotInitializeError,
     ProviderQuotaExceededError,
 )
+from controllers.service_api.schema import (
+    InputFileList,
+    expect_user_json,
+    expect_with_user,
+    json_or_event_stream_response,
+)
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from controllers.web.error import InvokeRateLimitError as InvokeRateLimitHttpError
 from core.app.entities.app_invoke_entities import InvokeFrom
@@ -51,24 +58,84 @@ def _resolve_agent_app_streaming(*, app_mode: AppMode, response_mode: str | None
 
 
 class CompletionRequestPayload(BaseModel):
-    inputs: dict[str, Any]
-    query: str = Field(default="")
-    files: list[dict[str, Any]] | None = Field(default=None)
-    response_mode: Literal["blocking", "streaming"] | None = None
-    retriever_from: str = Field(default="dev")
-    trace_session_id: str | None = Field(default=None, description="Trace session ID for observability grouping")
+    inputs: dict[str, Any] = Field(
+        description=(
+            "Values for app-defined variables. Refer to the `user_input_form` field in the "
+            "[Get App Parameters](/api-reference/applications/get-app-parameters) response to discover expected "
+            "variable names and types."
+        )
+    )
+    query: str = Field(default="", description="User input or prompt content.")
+    files: InputFileList = Field(
+        default=None,
+        description=(
+            "File list for multimodal understanding, including images, documents, audio, and video. To attach a "
+            "local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned "
+            "`id` as `upload_file_id` with `transfer_method: local_file`."
+        ),
+    )
+    response_mode: Literal["blocking", "streaming"] | None = Field(
+        default=None,
+        description=(
+            "Response mode. `streaming` uses Server-Sent Events; `blocking` returns after completion. When omitted, "
+            "the request runs in blocking mode."
+        ),
+    )
+    retriever_from: SkipJsonSchema[str] = Field(default="dev")
+    trace_session_id: SkipJsonSchema[str | None] = Field(
+        default=None, description="Trace session ID for observability grouping"
+    )
 
 
 class ChatRequestPayload(BaseModel):
-    inputs: dict[str, Any]
-    query: str
-    files: list[dict[str, Any]] | None = Field(default=None)
-    response_mode: Literal["blocking", "streaming"] | None = None
-    conversation_id: UUIDStrOrEmpty | None = Field(default=None, description="Conversation UUID")
-    retriever_from: str = Field(default="dev")
-    auto_generate_name: bool = Field(default=True, description="Auto generate conversation name")
-    workflow_id: str | None = Field(default=None, description="Workflow ID for advanced chat")
-    trace_session_id: str | None = Field(default=None, description="Trace session ID for observability grouping")
+    inputs: dict[str, Any] = Field(
+        description=(
+            "Values for app-defined variables. Refer to the `user_input_form` field in the "
+            "[Get App Parameters](/api-reference/applications/get-app-parameters) response to discover expected "
+            "variable names and types."
+        )
+    )
+    query: str = Field(description="User input or question content.")
+    files: InputFileList = Field(
+        default=None,
+        description=(
+            "File list for multimodal understanding, including images, documents, audio, and video. To attach a "
+            "local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned "
+            "`id` as `upload_file_id` with `transfer_method: local_file`."
+        ),
+    )
+    response_mode: Literal["blocking", "streaming"] | None = Field(
+        default=None,
+        description=(
+            "Response mode. `streaming` uses Server-Sent Events; `blocking` returns after completion. New Agent app "
+            "mode supports streaming only. When omitted, non-Agent apps run in blocking mode and new Agent apps stream."
+        ),
+    )
+    conversation_id: UUIDStrOrEmpty | None = Field(
+        default=None,
+        description=(
+            "Conversation ID to continue a conversation. Omit this field or pass an empty string to start a new "
+            "conversation, then pass the returned `conversation_id` in subsequent requests."
+        ),
+    )
+    retriever_from: SkipJsonSchema[str] = Field(default="dev")
+    auto_generate_name: bool = Field(
+        default=True,
+        description=(
+            "Auto-generate the conversation title. If `false`, use the Rename Conversation API with "
+            "`auto_generate: true` to generate the title asynchronously."
+        ),
+    )
+    workflow_id: str | None = Field(
+        default=None,
+        description=(
+            "Published workflow version ID to execute for advanced chat. If omitted, the app's current published "
+            "workflow is used."
+        ),
+    )
+    trace_session_id: SkipJsonSchema[str | None] = Field(
+        default=None, description="Trace session ID for observability grouping"
+    )
 
     @field_validator("conversation_id", mode="before")
     @classmethod
@@ -92,7 +159,33 @@ register_response_schema_models(service_api_ns, GeneratedAppResponse, SimpleResu
 
 @service_api_ns.route("/completion-messages")
 class CompletionApi(Resource):
-    @service_api_ns.expect(service_api_ns.models[CompletionRequestPayload.__name__])
+    @service_api_ns.doc(
+        summary="Send Completion Message",
+        description="Send a request to the text generation application.",
+        tags=["Completions"],
+        responses={
+            200: (
+                "Successful response. The content type and structure depend on the `response_mode` parameter "
+                "in the request.\n"
+                "\n"
+                "- If `response_mode` is `blocking`, returns `application/json` with a `CompletionResponse` "
+                "object.\n"
+                "- If `response_mode` is `streaming`, returns `text/event-stream` with a stream of "
+                "`ChunkCompletionEvent` objects."
+            ),
+            400: (
+                "- `app_unavailable` : App unavailable or misconfigured.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found.\n"
+                "- `provider_quota_exceeded` : Model provider quota exhausted.\n"
+                "- `model_currently_not_support` : Current model unavailable.\n"
+                "- `completion_request_error` : Text generation failed."
+            ),
+            429: "`too_many_requests` : Too many concurrent requests for this app.",
+            500: "`internal_server_error` : Internal server error.",
+        },
+    )
+    @expect_with_user(service_api_ns, CompletionRequestPayload)
+    @json_or_event_stream_response(service_api_ns)
     @service_api_ns.doc("create_completion")
     @service_api_ns.doc(description="Create a completion for the given prompt")
     @service_api_ns.doc(
@@ -168,9 +261,20 @@ class CompletionApi(Resource):
 
 @service_api_ns.route("/completion-messages/<string:task_id>/stop")
 class CompletionStopApi(Resource):
+    @service_api_ns.doc(
+        summary="Stop Completion Message Generation",
+        description="Stops a completion message generation task. Only supported in `streaming` mode.",
+        tags=["Completions"],
+        responses={
+            400: "`app_unavailable` : App unavailable or misconfigured.",
+        },
+    )
+    @expect_user_json(service_api_ns)
     @service_api_ns.doc("stop_completion")
     @service_api_ns.doc(description="Stop a running completion task")
-    @service_api_ns.doc(params={"task_id": "The ID of the task to stop"})
+    @service_api_ns.doc(
+        params={"task_id": ("Task ID, obtained from a streaming chunk returned by the Send Completion Message API.")}
+    )
     @service_api_ns.doc(
         responses={
             200: "Task stopped successfully",
@@ -197,7 +301,39 @@ class CompletionStopApi(Resource):
 
 @service_api_ns.route("/chat-messages")
 class ChatApi(Resource):
-    @service_api_ns.expect(service_api_ns.models[ChatRequestPayload.__name__])
+    @service_api_ns.doc(
+        summary="Send Chat Message",
+        description="Send a request to the chat application.",
+        tags=["Chats", "Chatflows"],
+        responses={
+            200: (
+                "Successful response. The content type and structure depend on the `response_mode` parameter "
+                "in the request.\n"
+                "\n"
+                "- If `response_mode` is `blocking`, returns `application/json` with a "
+                "`ChatCompletionResponse` object.\n"
+                "- If `response_mode` is `streaming`, returns `text/event-stream` with a stream of "
+                "Server-Sent Events."
+            ),
+            400: (
+                "- `app_unavailable` : App unavailable or misconfigured.\n"
+                "- `not_chat_app` : App mode does not match the API route.\n"
+                "- `conversation_completed` : The conversation has ended.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found.\n"
+                "- `provider_quota_exceeded` : Model provider quota exhausted.\n"
+                "- `model_currently_not_support` : Current model unavailable.\n"
+                "- `completion_request_error` : Text generation failed."
+            ),
+            404: "`not_found` : Conversation does not exist.",
+            429: (
+                "- `too_many_requests` : Too many concurrent requests for this app.\n"
+                "- `rate_limit_error` : The upstream model provider rate limit was exceeded."
+            ),
+            500: "`internal_server_error` : Internal server error.",
+        },
+    )
+    @expect_with_user(service_api_ns, ChatRequestPayload)
+    @json_or_event_stream_response(service_api_ns)
     @service_api_ns.doc("create_chat_message")
     @service_api_ns.doc(description="Send a message in a chat conversation")
     @service_api_ns.doc(
@@ -276,9 +412,20 @@ class ChatApi(Resource):
 
 @service_api_ns.route("/chat-messages/<string:task_id>/stop")
 class ChatStopApi(Resource):
+    @service_api_ns.doc(
+        summary="Stop Chat Message Generation",
+        description="Stops a chat message generation task. Only supported in `streaming` mode.",
+        tags=["Chats", "Chatflows"],
+        responses={
+            400: "`not_chat_app` : App mode does not match the API route.",
+        },
+    )
+    @expect_user_json(service_api_ns)
     @service_api_ns.doc("stop_chat_message")
     @service_api_ns.doc(description="Stop a running chat message generation")
-    @service_api_ns.doc(params={"task_id": "The ID of the task to stop"})
+    @service_api_ns.doc(
+        params={"task_id": "Task ID, obtained from a streaming chunk returned by the Send Chat Message API."}
+    )
     @service_api_ns.doc(
         responses={
             200: "Task stopped successfully",
diff --git a/api/controllers/service_api/app/conversation.py b/api/controllers/service_api/app/conversation.py
index f6be7f74cc7..9b5533ea07a 100644
--- a/api/controllers/service_api/app/conversation.py
+++ b/api/controllers/service_api/app/conversation.py
@@ -13,6 +13,7 @@ from controllers.common.controller_schemas import ConversationRenamePayload
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.service_api import service_api_ns
 from controllers.service_api.app.error import NotChatAppError
+from controllers.service_api.schema import expect_user_json, expect_with_user
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from core.app.entities.app_invoke_entities import InvokeFrom
 from extensions.ext_database import db
@@ -29,18 +30,28 @@ from services.conversation_service import ConversationService
 
 
 class ConversationListQuery(BaseModel):
-    last_id: UUIDStrOrEmpty | None = Field(default=None, description="Last conversation ID for pagination")
-    limit: int = Field(default=20, ge=1, le=100, description="Number of conversations to return")
+    last_id: UUIDStrOrEmpty | None = Field(
+        default=None,
+        description="The ID of the last record on the current page. Used to fetch the next page.",
+    )
+    limit: int = Field(default=20, ge=1, le=100, description="Number of records to return.")
     sort_by: Literal["created_at", "-created_at", "updated_at", "-updated_at"] = Field(
-        default="-updated_at", description="Sort order for conversations"
+        default="-updated_at",
+        description="Sorting field. Use the `-` prefix for descending order.",
     )
 
 
 class ConversationVariablesQuery(BaseModel):
-    last_id: UUIDStrOrEmpty | None = Field(default=None, description="Last variable ID for pagination")
-    limit: int = Field(default=20, ge=1, le=100, description="Number of variables to return")
+    last_id: UUIDStrOrEmpty | None = Field(
+        default=None,
+        description="The ID of the last record on the current page. Used to fetch the next page.",
+    )
+    limit: int = Field(default=20, ge=1, le=100, description="Number of records to return.")
     variable_name: str | None = Field(
-        default=None, description="Filter variables by name", min_length=1, max_length=255
+        default=None,
+        description="Filter variables by a specific name.",
+        min_length=1,
+        max_length=255,
     )
 
     @field_validator("variable_name", mode="before")
@@ -68,7 +79,7 @@ class ConversationVariablesQuery(BaseModel):
 
 
 class ConversationVariableUpdatePayload(BaseModel):
-    value: Any
+    value: Any = Field(description="The new value for the variable. Must match the variable's expected type.")
 
 
 class ConversationVariableResponse(ResponseModel):
@@ -145,6 +156,16 @@ register_response_schema_models(
 
 @service_api_ns.route("/conversations")
 class ConversationApi(Resource):
+    @service_api_ns.doc(
+        summary="List Conversations",
+        description="Retrieve the conversation list for the current user, ordered by most recently active.",
+        tags=["Conversations"],
+        responses={
+            200: "Successfully retrieved conversations list.",
+            400: "`not_chat_app` : App mode does not match the API route.",
+            404: "`not_found` : Last conversation does not exist (invalid `last_id`).",
+        },
+    )
     @service_api_ns.doc(params=query_params_from_model(ConversationListQuery))
     @service_api_ns.doc("list_conversations")
     @service_api_ns.doc(description="List all conversations for the current user")
@@ -197,9 +218,20 @@ class ConversationApi(Resource):
 
 @service_api_ns.route("/conversations/<uuid:c_id>")
 class ConversationDetailApi(Resource):
+    @service_api_ns.doc(
+        summary="Delete Conversation",
+        description="Delete a conversation.",
+        tags=["Conversations"],
+        responses={
+            204: "Conversation deleted successfully.",
+            400: "`not_chat_app` : App mode does not match the API route.",
+            404: "`not_found` : Conversation does not exist.",
+        },
+    )
+    @expect_user_json(service_api_ns)
     @service_api_ns.doc("delete_conversation")
     @service_api_ns.doc(description="Delete a specific conversation")
-    @service_api_ns.doc(params={"c_id": "Conversation ID"})
+    @service_api_ns.doc(params={"c_id": "Conversation ID."})
     @service_api_ns.doc(
         responses={
             204: "Conversation deleted successfully",
@@ -225,10 +257,23 @@ class ConversationDetailApi(Resource):
 
 @service_api_ns.route("/conversations/<uuid:c_id>/name")
 class ConversationRenameApi(Resource):
-    @service_api_ns.expect(service_api_ns.models[ConversationRenamePayload.__name__])
+    @service_api_ns.doc(
+        summary="Rename Conversation",
+        description=(
+            "Rename a conversation or auto-generate a name. The conversation name is used for display on "
+            "clients that support multiple conversations."
+        ),
+        tags=["Conversations"],
+        responses={
+            200: "Conversation renamed successfully.",
+            400: "`not_chat_app` : App mode does not match the API route.",
+            404: "`not_found` : Conversation does not exist.",
+        },
+    )
+    @expect_with_user(service_api_ns, ConversationRenamePayload)
     @service_api_ns.doc("rename_conversation")
     @service_api_ns.doc(description="Rename a conversation or auto-generate a name")
-    @service_api_ns.doc(params={"c_id": "Conversation ID"})
+    @service_api_ns.doc(params={"c_id": "Conversation ID."})
     @service_api_ns.doc(
         responses={
             200: "Conversation renamed successfully",
@@ -267,10 +312,20 @@ class ConversationRenameApi(Resource):
 
 @service_api_ns.route("/conversations/<uuid:c_id>/variables")
 class ConversationVariablesApi(Resource):
+    @service_api_ns.doc(
+        summary="List Conversation Variables",
+        description="Retrieve variables from a specific conversation.",
+        tags=["Conversations"],
+        responses={
+            200: "Successfully retrieved conversation variables.",
+            400: "`not_chat_app` : App mode does not match the API route.",
+            404: "`not_found` : Conversation does not exist.",
+        },
+    )
     @service_api_ns.doc(params=query_params_from_model(ConversationVariablesQuery))
     @service_api_ns.doc("list_conversation_variables")
     @service_api_ns.doc(description="List all variables for a conversation")
-    @service_api_ns.doc(params={"c_id": "Conversation ID"})
+    @service_api_ns.doc(params={"c_id": "Conversation ID."})
     @service_api_ns.doc(
         responses={
             200: "Variables retrieved successfully",
@@ -312,10 +367,25 @@ class ConversationVariablesApi(Resource):
 
 @service_api_ns.route("/conversations/<uuid:c_id>/variables/<uuid:variable_id>")
 class ConversationVariableDetailApi(Resource):
-    @service_api_ns.expect(service_api_ns.models[ConversationVariableUpdatePayload.__name__])
+    @service_api_ns.doc(
+        summary="Update Conversation Variable",
+        description="Update the value of a specific conversation variable. The value must match the expected type.",
+        tags=["Conversations"],
+        responses={
+            200: "Variable updated successfully.",
+            400: (
+                "- `not_chat_app` : App mode does not match the API route.\n"
+                "- `bad_request` : Variable value type mismatch."
+            ),
+            404: (
+                "- `not_found` : Conversation does not exist.\n- `not_found` : Conversation variable does not exist."
+            ),
+        },
+    )
+    @expect_with_user(service_api_ns, ConversationVariableUpdatePayload)
     @service_api_ns.doc("update_conversation_variable")
     @service_api_ns.doc(description="Update a conversation variable's value")
-    @service_api_ns.doc(params={"c_id": "Conversation ID", "variable_id": "Variable ID"})
+    @service_api_ns.doc(params={"c_id": "Conversation ID.", "variable_id": "Variable ID."})
     @service_api_ns.doc(
         responses={
             200: "Variable updated successfully",
diff --git a/api/controllers/service_api/app/file.py b/api/controllers/service_api/app/file.py
index 687d34076df..9210c60adeb 100644
--- a/api/controllers/service_api/app/file.py
+++ b/api/controllers/service_api/app/file.py
@@ -12,6 +12,7 @@ from controllers.common.errors import (
 )
 from controllers.common.schema import register_schema_models
 from controllers.service_api import service_api_ns
+from controllers.service_api.schema import multipart_file_params
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from extensions.ext_database import db
 from fields.file_fields import FileResponse
@@ -23,8 +24,27 @@ register_schema_models(service_api_ns, FileResponse)
 
 @service_api_ns.route("/files/upload")
 class FileApi(Resource):
+    @service_api_ns.doc(
+        summary="Upload File",
+        description=(
+            "Upload a file for use when sending messages, enabling multimodal understanding of images, "
+            "documents, audio, and video. Uploaded files are for use by the current end-user only."
+        ),
+        tags=["Files"],
+        responses={
+            201: "File uploaded successfully.",
+            400: (
+                "- `no_file_uploaded` : No file was provided in the request.\n"
+                "- `too_many_files` : Only one file is allowed per request.\n"
+                "- `filename_not_exists_error` : The uploaded file has no filename."
+            ),
+            413: "`file_too_large` : File size exceeded.",
+            415: "`unsupported_file_type` : File type not allowed.",
+        },
+    )
     @service_api_ns.doc("upload_file")
     @service_api_ns.doc(description="Upload a file for use in conversations")
+    @service_api_ns.doc(consumes=["multipart/form-data"], params=multipart_file_params(include_user=True))
     @service_api_ns.doc(
         responses={
             201: "File uploaded successfully",
diff --git a/api/controllers/service_api/app/file_preview.py b/api/controllers/service_api/app/file_preview.py
index 7e68399fb0b..3bd0db6eb54 100644
--- a/api/controllers/service_api/app/file_preview.py
+++ b/api/controllers/service_api/app/file_preview.py
@@ -15,6 +15,7 @@ from controllers.service_api.app.error import (
     FileAccessDeniedError,
     FileNotFoundError,
 )
+from controllers.service_api.schema import binary_response
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from extensions.ext_database import db
 from extensions.ext_storage import storage
@@ -24,12 +25,35 @@ logger = logging.getLogger(__name__)
 
 
 class FilePreviewQuery(BaseModel):
-    as_attachment: bool = Field(default=False, description="Download as attachment")
+    as_attachment: bool = Field(
+        default=False,
+        description="If `true`, forces the file to download as an attachment instead of previewing in browser.",
+    )
 
 
 register_schema_model(service_api_ns, FilePreviewQuery)
 register_response_schema_model(service_api_ns, BinaryFileResponse)
 
+FILE_PREVIEW_RESPONSE_MEDIA_TYPES = [
+    "application/octet-stream",
+    "application/pdf",
+    "audio/aac",
+    "audio/flac",
+    "audio/mp4",
+    "audio/mpeg",
+    "audio/ogg",
+    "audio/wav",
+    "audio/x-m4a",
+    "image/gif",
+    "image/jpeg",
+    "image/png",
+    "image/webp",
+    "text/plain",
+    "video/mp4",
+    "video/quicktime",
+    "video/webm",
+]
+
 
 @service_api_ns.route("/files/<uuid:file_id>/preview")
 class FilePreviewApi(Resource):
@@ -40,10 +64,36 @@ class FilePreviewApi(Resource):
     Files can only be accessed if they belong to messages within the requesting app's context.
     """
 
+    @service_api_ns.doc(
+        summary="Download File",
+        description=(
+            "Preview or download uploaded files previously uploaded via the [Upload "
+            "File](/api-reference/files/upload-file) API. Files can only be accessed if they belong to "
+            "messages within the requesting application."
+        ),
+        tags=["Files"],
+        responses={
+            200: (
+                "Returns the raw file content. The `Content-Type` header is set to the file's MIME type. If "
+                "`as_attachment` is `true`, the file is returned as a download with `Content-Disposition: "
+                "attachment`."
+            ),
+            403: "`file_access_denied` : Access to the requested file is denied.",
+            404: "`file_not_found` : The requested file was not found.",
+        },
+    )
     @service_api_ns.doc(params=query_params_from_model(FilePreviewQuery))
+    @binary_response(service_api_ns, FILE_PREVIEW_RESPONSE_MEDIA_TYPES)
     @service_api_ns.doc("preview_file")
     @service_api_ns.doc(description="Preview or download a file uploaded via Service API")
-    @service_api_ns.doc(params={"file_id": "UUID of the file to preview"})
+    @service_api_ns.doc(
+        params={
+            "file_id": (
+                "The unique identifier of the file to preview, obtained from the "
+                "[Upload File](/api-reference/files/upload-file) API response."
+            )
+        }
+    )
     @service_api_ns.doc(
         responses={
             200: "File retrieved successfully",
@@ -52,11 +102,7 @@ class FilePreviewApi(Resource):
             404: "File not found",
         }
     )
-    @service_api_ns.response(
-        200,
-        "File retrieved successfully",
-        service_api_ns.models[BinaryFileResponse.__name__],
-    )
+    @service_api_ns.response(200, "File retrieved successfully")
     @validate_app_token(fetch_user_arg=FetchUserArg(fetch_from=WhereisUserArg.QUERY))
     def get(self, app_model: App, end_user: EndUser, file_id: UUID):
         """
diff --git a/api/controllers/service_api/app/human_input_form.py b/api/controllers/service_api/app/human_input_form.py
index 1dc247d7517..07cc1eeab6d 100644
--- a/api/controllers/service_api/app/human_input_form.py
+++ b/api/controllers/service_api/app/human_input_form.py
@@ -18,6 +18,7 @@ from werkzeug.exceptions import BadRequest, NotFound
 from controllers.common.human_input import HumanInputFormSubmitPayload, stringify_form_default_values
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.service_api import service_api_ns
+from controllers.service_api.schema import expect_with_user
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from core.workflow.human_input_policy import HumanInputSurface, is_recipient_type_allowed_for_surface
 from extensions.ext_database import db
@@ -72,6 +73,23 @@ def _ensure_form_is_allowed_for_service_api(form: Form) -> None:
 
 @service_api_ns.route("/form/human_input/<string:form_token>")
 class WorkflowHumanInputFormApi(Resource):
+    @service_api_ns.doc(
+        summary="Get Human Input Form",
+        description=(
+            "Retrieve a paused Human Input form's contents using the `form_token` from a "
+            "`human_input_required` event. Requires **WebApp** delivery."
+        ),
+        tags=["Human Input"],
+        responses={
+            200: "Form contents retrieved successfully.",
+            404: "`not_found` : Form not found.",
+            412: (
+                "- `human_input_form_submitted` : Form already submitted. Forms are one-shot; the first "
+                "response wins regardless of which user submits it.\n"
+                "- `human_input_form_expired` : The form's expiration time passed before submission arrived."
+            ),
+        },
+    )
     @service_api_ns.doc("get_human_input_form")
     @service_api_ns.doc(description="Get a paused human input form by token")
     @service_api_ns.doc(params={"form_token": "Human input form token"})
@@ -101,7 +119,29 @@ class WorkflowHumanInputFormApi(Resource):
         inputs = service.resolve_form_inputs(form)
         return _jsonify_form_definition(form, inputs=inputs)
 
-    @service_api_ns.expect(service_api_ns.models[HumanInputFormSubmitPayload.__name__])
+    @service_api_ns.doc(
+        summary="Submit Human Input Form",
+        description=(
+            "Submit the recipient's response to a paused Human Input form. The workflow resumes on "
+            "acceptance; use [Stream Workflow Events](/api-reference/chatflows/stream-workflow-events) "
+            "to follow subsequent events. Requires **WebApp** delivery."
+        ),
+        tags=["Human Input"],
+        responses={
+            200: "Form submitted successfully. The response body is an empty object.",
+            400: (
+                "- `bad_request` : Form recipient type is invalid.\n"
+                "- `invalid_form_data` : Submission failed validation against the form definition."
+            ),
+            404: "`not_found` : Form not found.",
+            412: (
+                "- `human_input_form_submitted` : Form already submitted. Forms are one-shot; the first "
+                "response wins regardless of which user submits it.\n"
+                "- `human_input_form_expired` : The form's expiration time passed before submission arrived."
+            ),
+        },
+    )
+    @expect_with_user(service_api_ns, HumanInputFormSubmitPayload)
     @service_api_ns.doc("submit_human_input_form")
     @service_api_ns.doc(description="Submit a paused human input form by token")
     @service_api_ns.doc(params={"form_token": "Human input form token"})
diff --git a/api/controllers/service_api/app/message.py b/api/controllers/service_api/app/message.py
index adbea6570dd..18d1c5d3254 100644
--- a/api/controllers/service_api/app/message.py
+++ b/api/controllers/service_api/app/message.py
@@ -12,6 +12,7 @@ from controllers.common.fields import SimpleResultStringListResponse
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.service_api import service_api_ns
 from controllers.service_api.app.error import NotChatAppError
+from controllers.service_api.schema import expect_with_user
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from core.app.entities.app_invoke_entities import InvokeFrom
 from fields.base import ResponseModel
@@ -30,8 +31,8 @@ logger = logging.getLogger(__name__)
 
 
 class FeedbackListQuery(BaseModel):
-    page: int = Field(default=1, ge=1, description="Page number")
-    limit: int = Field(default=20, ge=1, le=101, description="Number of feedbacks per page")
+    page: int = Field(default=1, ge=1, description="Page number for pagination.")
+    limit: int = Field(default=20, ge=1, le=101, description="Number of records per page.")
 
 
 class AppFeedbackResponse(ResponseModel):
@@ -64,6 +65,19 @@ register_response_schema_models(
 
 @service_api_ns.route("/messages")
 class MessageListApi(Resource):
+    @service_api_ns.doc(
+        summary="List Conversation Messages",
+        description=(
+            "Returns historical chat records in a scrolling load format, with the first page returning "
+            "the latest `limit` messages, i.e., in reverse order."
+        ),
+        tags=["Conversations"],
+        responses={
+            200: "Successfully retrieved conversation history.",
+            400: "`not_chat_app` : App mode does not match the API route.",
+            404: ("- `not_found` : Conversation does not exist.\n- `not_found` : First message does not exist."),
+        },
+    )
     @service_api_ns.doc(params=query_params_from_model(MessageListQuery))
     @service_api_ns.doc("list_messages")
     @service_api_ns.doc(description="List messages in a conversation")
@@ -112,11 +126,23 @@ class MessageListApi(Resource):
 
 @service_api_ns.route("/messages/<uuid:message_id>/feedbacks")
 class MessageFeedbackApi(Resource):
-    @service_api_ns.expect(service_api_ns.models[MessageFeedbackPayload.__name__])
+    @service_api_ns.doc(
+        summary="Submit Message Feedback",
+        description=(
+            "Submit feedback for a message. End users can rate messages as `like` or `dislike`, and "
+            "optionally provide text feedback. Pass `null` for `rating` to revoke previously submitted "
+            "feedback."
+        ),
+        tags=["Feedback"],
+        responses={
+            404: "`not_found` : Message does not exist.",
+        },
+    )
+    @expect_with_user(service_api_ns, MessageFeedbackPayload)
     @service_api_ns.response(200, "Feedback submitted successfully", service_api_ns.models[ResultResponse.__name__])
     @service_api_ns.doc("create_message_feedback")
     @service_api_ns.doc(description="Submit feedback for a message")
-    @service_api_ns.doc(params={"message_id": "Message ID"})
+    @service_api_ns.doc(params={"message_id": "Message ID."})
     @service_api_ns.doc(
         responses={
             200: "Feedback submitted successfully",
@@ -150,6 +176,17 @@ class MessageFeedbackApi(Resource):
 
 @service_api_ns.route("/app/feedbacks")
 class AppGetFeedbacksApi(Resource):
+    @service_api_ns.doc(
+        summary="List App Feedbacks",
+        description=(
+            "Retrieve a paginated list of all feedback submitted for messages in this application, "
+            "including both end-user and admin feedback."
+        ),
+        tags=["Feedback"],
+        responses={
+            200: "A list of application feedbacks.",
+        },
+    )
     @service_api_ns.doc(params=query_params_from_model(FeedbackListQuery))
     @service_api_ns.doc("get_app_feedbacks")
     @service_api_ns.doc(description="Get all feedbacks for the application")
@@ -177,6 +214,20 @@ class AppGetFeedbacksApi(Resource):
 
 @service_api_ns.route("/messages/<uuid:message_id>/suggested")
 class MessageSuggestedApi(Resource):
+    @service_api_ns.doc(
+        summary="Get Next Suggested Questions",
+        description="Get next questions suggestions for the current message.",
+        tags=["Chats", "Chatflows"],
+        responses={
+            200: "Successfully retrieved suggested questions.",
+            400: (
+                "- `not_chat_app` : App mode does not match the API route.\n"
+                "- `bad_request` : Suggested questions feature is disabled."
+            ),
+            404: "`not_found` : Message does not exist.",
+            500: "`internal_server_error` : Internal server error.",
+        },
+    )
     @service_api_ns.response(
         200,
         "Suggested questions retrieved successfully",
diff --git a/api/controllers/service_api/app/site.py b/api/controllers/service_api/app/site.py
index f5d1dcd283d..35098ca1367 100644
--- a/api/controllers/service_api/app/site.py
+++ b/api/controllers/service_api/app/site.py
@@ -17,6 +17,18 @@ register_response_schema_models(service_api_ns, SiteResponse)
 class AppSiteApi(Resource):
     """Resource for app sites."""
 
+    @service_api_ns.doc(
+        summary="Get App WebApp Settings",
+        description=(
+            "Retrieve the WebApp settings of this application, including site configuration, theme, and "
+            "customization options."
+        ),
+        tags=["Applications"],
+        responses={
+            200: "WebApp settings of the application.",
+            403: "`forbidden` : Site not found for this application or the workspace has been archived.",
+        },
+    )
     @service_api_ns.doc("get_app_site")
     @service_api_ns.doc(description="Get application site configuration")
     @service_api_ns.doc(
diff --git a/api/controllers/service_api/app/workflow.py b/api/controllers/service_api/app/workflow.py
index b655e0beb4a..091b79fefbd 100644
--- a/api/controllers/service_api/app/workflow.py
+++ b/api/controllers/service_api/app/workflow.py
@@ -7,6 +7,7 @@ from dateutil.parser import isoparse
 from flask import request
 from flask_restx import Resource, fields
 from pydantic import BaseModel, Field, field_validator
+from pydantic.json_schema import SkipJsonSchema
 from sqlalchemy.orm import sessionmaker
 from werkzeug.exceptions import BadRequest, InternalServerError, NotFound
 
@@ -21,6 +22,11 @@ from controllers.service_api.app.error import (
     ProviderNotInitializeError,
     ProviderQuotaExceededError,
 )
+from controllers.service_api.schema import (
+    expect_user_json,
+    expect_with_user,
+    json_or_event_stream_response,
+)
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from controllers.web.error import InvokeRateLimitError as InvokeRateLimitHttpError
 from core.app.apps.base_app_queue_manager import AppQueueManager
@@ -53,19 +59,41 @@ logger = logging.getLogger(__name__)
 
 
 class WorkflowRunPayload(WorkflowRunPayloadBase):
-    response_mode: Literal["blocking", "streaming"] | None = None
-    trace_session_id: str | None = Field(default=None, description="Trace session ID for observability grouping")
+    response_mode: Literal["blocking", "streaming"] | None = Field(
+        default=None,
+        description=(
+            "Response mode. Use `blocking` for synchronous responses or `streaming` for Server-Sent Events. "
+            "When omitted, the request runs in blocking mode."
+        ),
+    )
+    trace_session_id: SkipJsonSchema[str | None] = Field(
+        default=None, description="Trace session ID for observability grouping"
+    )
 
 
 class WorkflowLogQuery(BaseModel):
-    keyword: str | None = None
-    status: Literal["succeeded", "failed", "stopped"] | None = None
-    created_at__before: str | None = None
-    created_at__after: str | None = None
-    created_by_end_user_session_id: str | None = None
-    created_by_account: str | None = None
-    page: int = Field(default=1, ge=1, le=99999)
-    limit: int = Field(default=20, ge=1, le=100)
+    keyword: str | None = Field(default=None, description="Keyword to search in logs.")
+    status: Literal["succeeded", "failed", "stopped"] | None = Field(
+        default=None,
+        description="Filter by execution status.",
+    )
+    created_at__before: str | None = Field(
+        default=None,
+        description="Filter logs created before this ISO 8601 timestamp.",
+        json_schema_extra={"format": "date-time"},
+    )
+    created_at__after: str | None = Field(
+        default=None,
+        description="Filter logs created after this ISO 8601 timestamp.",
+        json_schema_extra={"format": "date-time"},
+    )
+    created_by_end_user_session_id: str | None = Field(
+        default=None,
+        description="Filter by end user session ID.",
+    )
+    created_by_account: str | None = Field(default=None, description="Filter by account ID.")
+    page: int = Field(default=1, ge=1, le=99999, description="Page number for pagination.")
+    limit: int = Field(default=20, ge=1, le=100, description="Number of items per page.")
 
 
 register_schema_models(service_api_ns, WorkflowRunPayload, WorkflowLogQuery)
@@ -177,14 +205,15 @@ register_response_schema_models(
 def _serialize_workflow_run(workflow_run: WorkflowRun) -> dict:
     status = _enum_value(workflow_run.status)
     raw_outputs = workflow_run.outputs_dict
-    if status == WorkflowExecutionStatus.PAUSED.value or raw_outputs is None:
-        outputs: dict = {}
-    elif isinstance(raw_outputs, dict):
-        outputs = raw_outputs
-    elif isinstance(raw_outputs, Mapping):
-        outputs = dict(raw_outputs)
-    else:
-        outputs = {}
+    match raw_outputs:
+        case _ if status == WorkflowExecutionStatus.PAUSED.value or raw_outputs is None:
+            outputs: dict = {}
+        case dict():
+            outputs = raw_outputs
+        case _ if isinstance(raw_outputs, Mapping):
+            outputs = dict(raw_outputs)
+        case _:
+            outputs = {}
     return WorkflowRunResponse.model_validate(
         {
             "id": workflow_run.id,
@@ -208,9 +237,23 @@ def _serialize_workflow_log_pagination(pagination) -> dict:
 
 @service_api_ns.route("/workflows/run/<string:workflow_run_id>")
 class WorkflowRunDetailApi(Resource):
+    @service_api_ns.doc(
+        summary="Get Workflow Run Detail",
+        description="Retrieve the current execution results of a workflow task based on the workflow execution ID.",
+        tags=["Chatflows", "Workflows"],
+        responses={
+            200: "Successfully retrieved workflow run details.",
+            400: "`not_workflow_app` : App mode does not match the API route.",
+            404: "`not_found` : Workflow run not found.",
+        },
+    )
     @service_api_ns.doc("get_workflow_run_detail")
     @service_api_ns.doc(description="Get workflow run details")
-    @service_api_ns.doc(params={"workflow_run_id": "Workflow run ID"})
+    @service_api_ns.doc(
+        params={
+            "workflow_run_id": "Workflow run ID, obtained from the workflow execution response or streaming events."
+        }
+    )
     @service_api_ns.doc(
         responses={
             200: "Workflow run details retrieved successfully",
@@ -249,7 +292,37 @@ class WorkflowRunDetailApi(Resource):
 
 @service_api_ns.route("/workflows/run")
 class WorkflowRunApi(Resource):
-    @service_api_ns.expect(service_api_ns.models[WorkflowRunPayload.__name__])
+    @service_api_ns.doc(
+        summary="Run Workflow",
+        description="Execute a workflow. Cannot be executed without a published workflow.",
+        tags=["Workflows"],
+        responses={
+            200: (
+                "Successful response. The content type and structure depend on the `response_mode` parameter "
+                "in the request.\n"
+                "\n"
+                "- If `response_mode` is `blocking`, returns `application/json` with a "
+                "`WorkflowBlockingResponse` object.\n"
+                "- If `response_mode` is `streaming`, returns `text/event-stream` with a stream of "
+                "`ChunkWorkflowEvent` objects."
+            ),
+            400: (
+                "- `not_workflow_app` : App mode does not match the API route.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found.\n"
+                "- `provider_quota_exceeded` : Model provider quota exhausted.\n"
+                "- `model_currently_not_support` : Current model unavailable.\n"
+                "- `completion_request_error` : Workflow execution request failed.\n"
+                "- `invalid_param` : Invalid parameter value."
+            ),
+            429: (
+                "- `too_many_requests` : Too many concurrent requests for this app.\n"
+                "- `rate_limit_error` : The upstream model provider rate limit was exceeded."
+            ),
+            500: "`internal_server_error` : Internal server error.",
+        },
+    )
+    @expect_with_user(service_api_ns, WorkflowRunPayload)
+    @json_or_event_stream_response(service_api_ns)
     @service_api_ns.doc("run_workflow")
     @service_api_ns.doc(description="Execute a workflow")
     @service_api_ns.doc(
@@ -313,10 +386,52 @@ class WorkflowRunApi(Resource):
 
 @service_api_ns.route("/workflows/<string:workflow_id>/run")
 class WorkflowRunByIdApi(Resource):
-    @service_api_ns.expect(service_api_ns.models[WorkflowRunPayload.__name__])
+    @service_api_ns.doc(
+        summary="Run Workflow by ID",
+        description=(
+            "Execute a specific workflow version identified by its ID. Useful for running a particular "
+            "published version of the workflow."
+        ),
+        tags=["Workflows"],
+        responses={
+            200: (
+                "Successful response. The content type and structure depend on the `response_mode` parameter "
+                "in the request.\n"
+                "\n"
+                "- If `response_mode` is `blocking`, returns `application/json` with a "
+                "`WorkflowBlockingResponse` object.\n"
+                "- If `response_mode` is `streaming`, returns `text/event-stream` with a stream of "
+                "`ChunkWorkflowEvent` objects."
+            ),
+            400: (
+                "- `not_workflow_app` : App mode does not match the API route.\n"
+                "- `bad_request` : Workflow is a draft or has an invalid ID format.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found.\n"
+                "- `provider_quota_exceeded` : Model provider quota exhausted.\n"
+                "- `model_currently_not_support` : Current model unavailable.\n"
+                "- `completion_request_error` : Workflow execution request failed.\n"
+                "- `invalid_param` : Required parameter missing or invalid."
+            ),
+            404: "`not_found` : Workflow not found.",
+            429: (
+                "- `too_many_requests` : Too many concurrent requests for this app.\n"
+                "- `rate_limit_error` : The upstream model provider rate limit was exceeded."
+            ),
+            500: "`internal_server_error` : Internal server error.",
+        },
+    )
+    @expect_with_user(service_api_ns, WorkflowRunPayload)
+    @json_or_event_stream_response(service_api_ns)
     @service_api_ns.doc("run_workflow_by_id")
     @service_api_ns.doc(description="Execute a specific workflow by ID")
-    @service_api_ns.doc(params={"workflow_id": "Workflow ID to execute"})
+    @service_api_ns.doc(
+        params={
+            "workflow_id": (
+                "Workflow ID of the specific version to execute. This value is returned in the `workflow_id` field "
+                "of workflow run responses."
+            )
+        }
+    )
     @service_api_ns.doc(
         responses={
             200: "Workflow executed successfully",
@@ -387,9 +502,23 @@ class WorkflowRunByIdApi(Resource):
 
 @service_api_ns.route("/workflows/tasks/<string:task_id>/stop")
 class WorkflowTaskStopApi(Resource):
+    @service_api_ns.doc(
+        summary="Stop Workflow Task",
+        description="Stop a running workflow task. Only supported in `streaming` mode.",
+        tags=["Workflows"],
+        responses={
+            400: (
+                "- `not_workflow_app` : App mode does not match the API route.\n"
+                "- `invalid_param` : Required parameter missing or invalid."
+            ),
+        },
+    )
+    @expect_user_json(service_api_ns)
     @service_api_ns.doc("stop_workflow_task")
     @service_api_ns.doc(description="Stop a running workflow task")
-    @service_api_ns.doc(params={"task_id": "Task ID to stop"})
+    @service_api_ns.doc(
+        params={"task_id": "Task ID, obtained from the streaming chunk returned by the Run Workflow API."}
+    )
     @service_api_ns.doc(
         responses={
             200: "Task stopped successfully",
@@ -417,6 +546,14 @@ class WorkflowTaskStopApi(Resource):
 
 @service_api_ns.route("/workflows/logs")
 class WorkflowAppLogApi(Resource):
+    @service_api_ns.doc(
+        summary="List Workflow Logs",
+        description="Retrieve paginated workflow execution logs with filtering options.",
+        tags=["Chatflows", "Workflows"],
+        responses={
+            200: "Successfully retrieved workflow logs.",
+        },
+    )
     @service_api_ns.doc(params=query_params_from_model(WorkflowLogQuery))
     @service_api_ns.doc("get_workflow_logs")
     @service_api_ns.doc(description="Get workflow execution logs")
diff --git a/api/controllers/service_api/app/workflow_events.py b/api/controllers/service_api/app/workflow_events.py
index 6dc9ef6e8dd..83a7c8227f5 100644
--- a/api/controllers/service_api/app/workflow_events.py
+++ b/api/controllers/service_api/app/workflow_events.py
@@ -15,6 +15,7 @@ from controllers.common.fields import EventStreamResponse
 from controllers.common.schema import query_params_from_model, register_response_schema_model, register_schema_models
 from controllers.service_api import service_api_ns
 from controllers.service_api.app.error import NotWorkflowAppError
+from controllers.service_api.schema import event_stream_response
 from controllers.service_api.wraps import FetchUserArg, WhereisUserArg, validate_app_token
 from core.app.apps.advanced_chat.app_generator import AdvancedChatAppGenerator
 from core.app.apps.base_app_generator import BaseAppGenerator
@@ -31,9 +32,25 @@ from services.workflow_event_snapshot_service import build_workflow_event_stream
 
 
 class WorkflowEventsQuery(BaseModel):
-    user: str = Field(..., description="End user identifier")
-    include_state_snapshot: bool = Field(default=False, description="Replay from persisted state snapshot")
-    continue_on_pause: bool = Field(default=False, description="Keep the stream open across workflow_paused events")
+    user: str = Field(
+        ...,
+        description="End-user identifier that originally triggered the run. Must match the creator of the run.",
+    )
+    include_state_snapshot: bool = Field(
+        default=False,
+        description=(
+            "When `true`, replay from the persisted state snapshot to include a status summary of already-executed "
+            "nodes before streaming new events."
+        ),
+    )
+    continue_on_pause: bool = Field(
+        default=False,
+        description=(
+            "Set to `true` to keep the stream open across multiple `workflow_paused` events, which is useful when "
+            "the workflow has more than one Human Input node in sequence. By default, the stream closes after the "
+            "first pause."
+        ),
+    )
 
 
 register_schema_models(service_api_ns, WorkflowEventsQuery)
@@ -44,9 +61,27 @@ register_response_schema_model(service_api_ns, EventStreamResponse)
 class WorkflowEventsApi(Resource):
     """Service API for getting workflow execution events after resume."""
 
+    @service_api_ns.doc(
+        summary="Stream Workflow Events",
+        description=(
+            "Resume the Server-Sent Events stream for a workflow run after a pause or a dropped SSE "
+            "connection. For runs that have already finished, the stream emits a single "
+            "`workflow_finished` event and closes."
+        ),
+        tags=["Chatflows", "Workflows"],
+        responses={
+            200: (
+                "Server-Sent Events stream. Each event is delivered as `data: {JSON}\\n\\n`. Event payloads "
+                "follow the same schemas as the original streaming response."
+            ),
+            400: "`not_workflow_app` : Please check if your app mode matches the right API route.",
+            404: "`not_found` : Workflow run not found.",
+        },
+    )
+    @event_stream_response(service_api_ns)
     @service_api_ns.doc("get_workflow_events")
     @service_api_ns.doc(description="Get workflow execution events stream after resume")
-    @service_api_ns.doc(params={"task_id": "Workflow run ID"})
+    @service_api_ns.doc(params={"task_id": "Workflow run ID returned by the original workflow run request."})
     @service_api_ns.doc(params=query_params_from_model(WorkflowEventsQuery))
     @service_api_ns.doc(
         responses={
diff --git a/api/controllers/service_api/dataset/dataset.py b/api/controllers/service_api/dataset/dataset.py
index c307063b3e5..292c39f69bc 100644
--- a/api/controllers/service_api/dataset/dataset.py
+++ b/api/controllers/service_api/dataset/dataset.py
@@ -1,11 +1,21 @@
-from typing import Any, Literal
+from typing import Annotated, Any, Literal, override
 from uuid import UUID
 
 from flask import request
-from pydantic import BaseModel, ConfigDict, Field, RootModel, field_validator, model_validator
+from pydantic import (
+    BaseModel,
+    ConfigDict,
+    Field,
+    GetJsonSchemaHandler,
+    RootModel,
+    WithJsonSchema,
+    field_validator,
+    model_validator,
+)
 from werkzeug.exceptions import Forbidden, NotFound
 
 import services
+from configs import dify_config
 from controllers.common.fields import SimpleResultResponse
 from controllers.common.schema import (
     query_params_from_model,
@@ -33,7 +43,12 @@ from models.dataset import DatasetPermissionEnum
 from models.enums import TagType
 from models.provider_ids import ModelProviderID
 from services.dataset_service import DatasetPermissionService, DatasetService, DocumentService
-from services.entities.knowledge_entities.knowledge_entities import RetrievalModel
+from services.entities.knowledge_entities.knowledge_entities import (
+    ExternalRetrievalModel,
+    KnowledgeProvider,
+    RetrievalModel,
+    SummaryIndexSetting,
+)
 from services.tag_service import (
     SaveTagPayload,
     TagBindingCreatePayload,
@@ -46,41 +61,159 @@ from services.tag_service import (
 
 register_enum_models(service_api_ns, DatasetPermissionEnum)
 
+PartialMemberList = Annotated[
+    list[dict[str, str]] | None,
+    WithJsonSchema(
+        {
+            "anyOf": [
+                {
+                    "items": {
+                        "properties": {
+                            "user_id": {
+                                "description": "ID of the team member to grant access.",
+                                "type": "string",
+                            }
+                        },
+                        "type": "object",
+                    },
+                    "type": "array",
+                },
+                {"type": "null"},
+            ]
+        }
+    ),
+]
+
+
+_SERVICE_DATASET_DETAIL_EXCLUDE = {"permission_keys"}
+_SERVICE_DATASET_LIST_EXCLUDE = {"data": {"__all__": _SERVICE_DATASET_DETAIL_EXCLUDE}}
+
+
+def _dump_service_dataset_detail(dataset: Any) -> dict[str, Any]:
+    return DatasetDetailResponse.model_validate(dataset, from_attributes=True).model_dump(
+        mode="json",
+        exclude=_SERVICE_DATASET_DETAIL_EXCLUDE,
+    )
+
+
+def _dump_service_dataset_list(response: dict[str, Any]) -> dict[str, Any]:
+    return DatasetListResponse.model_validate(response).model_dump(
+        mode="json",
+        exclude=_SERVICE_DATASET_LIST_EXCLUDE,
+    )
+
+
+def _dump_service_dataset_with_partial_members(data: dict[str, Any]) -> dict[str, Any]:
+    exclude: set[str] = set(_SERVICE_DATASET_DETAIL_EXCLUDE)
+    if "partial_member_list" not in data:
+        exclude.add("partial_member_list")
+
+    return DatasetDetailWithPartialMembersResponse.model_validate(data).model_dump(mode="json", exclude=exclude)
+
 
 class DatasetCreatePayload(BaseModel):
-    name: str = Field(..., min_length=1, max_length=40)
-    description: str = Field(default="", description="Dataset description (max 400 chars)", max_length=400)
-    indexing_technique: Literal["high_quality", "economy"] | None = None
-    permission: DatasetPermissionEnum | None = DatasetPermissionEnum.ONLY_ME
-    external_knowledge_api_id: str | None = None
-    provider: str = "vendor"
-    external_knowledge_id: str | None = None
-    retrieval_model: RetrievalModel | None = None
-    embedding_model: str | None = None
-    embedding_model_provider: str | None = None
-    summary_index_setting: dict | None = Field(default=None)
+    name: str = Field(..., min_length=1, max_length=40, description="Name of the knowledge base.")
+    description: str = Field(default="", description="Description of the knowledge base.", max_length=400)
+    indexing_technique: Literal["high_quality", "economy"] | None = Field(
+        default=None,
+        description="`high_quality` uses embedding models for precise search; `economy` uses keyword-based indexing.",
+    )
+    permission: DatasetPermissionEnum | None = Field(
+        default=DatasetPermissionEnum.ONLY_ME,
+        description=(
+            "Controls who can access this knowledge base. `only_me` restricts access to the creator, "
+            "`all_team_members` grants workspace-wide access, and `partial_members` grants access to specified "
+            "members."
+        ),
+    )
+    external_knowledge_api_id: str | None = Field(default=None, description="ID of the external knowledge API.")
+    provider: KnowledgeProvider = Field(
+        default="vendor",
+        description="Knowledge base provider: `vendor` for internal knowledge bases, `external` for external ones.",
+    )
+    external_knowledge_id: str | None = Field(default=None, description="ID of the external knowledge base.")
+    retrieval_model: RetrievalModel | None = Field(
+        default=None,
+        description="Retrieval model configuration. Controls how chunks are searched and ranked.",
+    )
+    embedding_model: str | None = Field(
+        default=None,
+        description=(
+            "Embedding model name. Use the `model` field from "
+            "[Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`."
+        ),
+    )
+    embedding_model_provider: str | None = Field(
+        default=None,
+        description=(
+            "Embedding model provider. Use the `provider` field from "
+            "[Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`."
+        ),
+    )
+    summary_index_setting: SummaryIndexSetting = Field(
+        default=None,
+        description="Summary index configuration.",
+    )
 
 
 class DatasetUpdatePayload(BaseModel):
-    name: str | None = Field(default=None, min_length=1, max_length=40)
-    description: str | None = Field(default=None, description="Dataset description (max 400 chars)", max_length=400)
-    indexing_technique: Literal["high_quality", "economy"] | None = None
-    permission: DatasetPermissionEnum | None = None
-    embedding_model: str | None = None
-    embedding_model_provider: str | None = None
-    retrieval_model: RetrievalModel | None = None
-    partial_member_list: list[dict[str, str]] | None = None
-    external_retrieval_model: dict[str, Any] | None = Field(default=None)
-    external_knowledge_id: str | None = None
-    external_knowledge_api_id: str | None = None
+    name: str | None = Field(default=None, min_length=1, max_length=40, description="Name of the knowledge base.")
+    description: str | None = Field(default=None, description="Description of the knowledge base.", max_length=400)
+    indexing_technique: Literal["high_quality", "economy"] | None = Field(
+        default=None,
+        description="`high_quality` uses embedding models for precise search; `economy` uses keyword-based indexing.",
+    )
+    permission: DatasetPermissionEnum | None = Field(
+        default=None,
+        description=(
+            "Controls who can access this knowledge base. `only_me` restricts access to the creator, "
+            "`all_team_members` grants workspace-wide access, and `partial_members` grants access to specified "
+            "members."
+        ),
+    )
+    embedding_model: str | None = Field(
+        default=None,
+        description=(
+            "Embedding model name. Use the `model` field from "
+            "[Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`."
+        ),
+    )
+    embedding_model_provider: str | None = Field(
+        default=None,
+        description=(
+            "Embedding model provider. Use the `provider` field from "
+            "[Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`."
+        ),
+    )
+    retrieval_model: RetrievalModel | None = Field(
+        default=None,
+        description="Retrieval model configuration. Controls how chunks are searched and ranked.",
+    )
+    partial_member_list: PartialMemberList = Field(
+        default=None,
+        description="List of team members with access when `permission` is `partial_members`.",
+    )
+    external_retrieval_model: ExternalRetrievalModel = Field(
+        default=None,
+        description="Retrieval settings for external knowledge bases.",
+    )
+    external_knowledge_id: str | None = Field(default=None, description="ID of the external knowledge base.")
+    external_knowledge_api_id: str | None = Field(default=None, description="ID of the external knowledge API.")
 
 
 class DocumentStatusPayload(BaseModel):
-    document_ids: list[str] = Field(default_factory=list, description="Document IDs to update")
+    document_ids: list[str] = Field(default_factory=list, description="List of document IDs to update.")
+
+
+DOCUMENT_STATUS_ACTION_PARAM = {
+    "description": "Action to perform: 'enable', 'disable', 'archive', or 'un_archive'",
+    "enum": ["enable", "disable", "archive", "un_archive"],
+    "type": "string",
+}
 
 
 class TagNamePayload(BaseModel):
-    name: str = Field(..., min_length=1, max_length=50)
+    name: str = Field(..., min_length=1, max_length=50, description="Tag name.")
 
 
 class TagCreatePayload(TagNamePayload):
@@ -88,16 +221,16 @@ class TagCreatePayload(TagNamePayload):
 
 
 class TagUpdatePayload(TagNamePayload):
-    tag_id: str
+    tag_id: str = Field(description="Tag ID to update.")
 
 
 class TagDeletePayload(BaseModel):
-    tag_id: str
+    tag_id: str = Field(description="Tag ID to delete.")
 
 
 class TagBindingPayload(BaseModel):
-    tag_ids: list[str]
-    target_id: str
+    tag_ids: list[str] = Field(description="Tag IDs to bind.")
+    target_id: str = Field(description="Knowledge base ID to bind the tags to.")
 
     @field_validator("tag_ids")
     @classmethod
@@ -112,7 +245,46 @@ class TagUnbindingPayload(BaseModel):
 
     tag_ids: list[str] = Field(default_factory=list)
     tag_id: str | None = None
-    target_id: str
+    target_id: str = Field(description="Knowledge base ID.")
+
+    @classmethod
+    @override
+    def __get_pydantic_json_schema__(cls, _core_schema: object, _handler: GetJsonSchemaHandler) -> dict[str, object]:
+        tag_id_property = {
+            "description": "Legacy single tag ID accepted by the Service API.",
+            "type": "string",
+        }
+        tag_ids_property = {
+            "description": "Tag IDs to unbind. Use this for new integrations.",
+            "items": {"type": "string"},
+            "minItems": 1,
+            "type": "array",
+        }
+        target_id_property = {"description": "Knowledge base ID.", "title": "Target Id", "type": "string"}
+        return {
+            "anyOf": [
+                {
+                    "properties": {
+                        "tag_id": tag_id_property,
+                        "tag_ids": tag_ids_property,
+                        "target_id": target_id_property,
+                    },
+                    "required": ["tag_id", "target_id"],
+                    "type": "object",
+                },
+                {
+                    "properties": {
+                        "tag_id": {**tag_id_property, "nullable": True},
+                        "tag_ids": tag_ids_property,
+                        "target_id": target_id_property,
+                    },
+                    "required": ["tag_ids", "target_id"],
+                    "type": "object",
+                },
+            ],
+            "description": "Accepts either the legacy tag_id payload or the normalized tag_ids payload.",
+            "title": cls.__name__,
+        }
 
     @model_validator(mode="before")
     @classmethod
@@ -146,11 +318,14 @@ class KnowledgeTagListResponse(RootModel[list[KnowledgeTagResponse]]):
 
 
 class DatasetListQuery(BaseModel):
-    page: int = Field(default=1, description="Page number")
-    limit: int = Field(default=20, description="Number of items per page")
-    keyword: str | None = Field(default=None, description="Search keyword")
-    include_all: bool = Field(default=False, description="Include all datasets")
-    tag_ids: list[str] = Field(default_factory=list, description="Filter by tag IDs")
+    page: int = Field(default=1, description="Page number to retrieve.")
+    limit: int = Field(default=20, description="Number of items per page. Server caps at `100`.")
+    keyword: str | None = Field(default=None, description="Search keyword to filter by name.")
+    include_all: bool = Field(
+        default=False,
+        description="Whether to include all knowledge bases regardless of permissions.",
+    )
+    tag_ids: list[str] = Field(default_factory=list, description="Tag IDs to filter by.")
 
 
 class DatasetDetailWithPartialMembersResponse(DatasetDetailResponse):
@@ -204,6 +379,14 @@ register_response_schema_models(
 class DatasetListApi(DatasetApiResource):
     """Resource for datasets."""
 
+    @service_api_ns.doc(
+        summary="List Knowledge Bases",
+        description="Returns a paginated list of knowledge bases. Supports filtering by keyword and tags.",
+        tags=["Knowledge Bases"],
+        responses={
+            200: "List of knowledge bases.",
+        },
+    )
     @service_api_ns.doc("list_datasets")
     @service_api_ns.doc(description="List all datasets")
     @service_api_ns.doc(
@@ -227,7 +410,14 @@ class DatasetListApi(DatasetApiResource):
         # provider = request.args.get("provider", default="vendor")
 
         datasets, total = DatasetService.get_datasets(
-            query.page, query.limit, tenant_id, current_user, query.keyword, query.tag_ids, query.include_all
+            query.page,
+            query.limit,
+            db.session,
+            tenant_id,
+            current_user,
+            query.keyword,
+            query.tag_ids,
+            query.include_all,
         )
         # check embedding setting
         assert isinstance(current_user, Account)
@@ -242,7 +432,7 @@ class DatasetListApi(DatasetApiResource):
         for embedding_model in embedding_models:
             model_names.append(f"{embedding_model.model}:{embedding_model.provider.provider}")
 
-        data = [dump_response(DatasetDetailResponse, dataset) for dataset in datasets]
+        data = [_dump_service_dataset_detail(dataset) for dataset in datasets]
         for item in data:
             if item["indexing_technique"] == IndexTechniqueType.HIGH_QUALITY and item["embedding_model_provider"]:
                 item["embedding_model_provider"] = str(ModelProviderID(item["embedding_model_provider"]))
@@ -260,8 +450,21 @@ class DatasetListApi(DatasetApiResource):
             "total": total,
             "page": query.page,
         }
-        return dump_response(DatasetListResponse, response), 200
+        return _dump_service_dataset_list(response), 200
 
+    @service_api_ns.doc(
+        summary="Create an Empty Knowledge Base",
+        description=(
+            "Create a new empty knowledge base. After creation, use [Create Document by "
+            "Text](/api-reference/documents/create-document-by-text) or [Create Document by "
+            "File](/api-reference/documents/create-document-by-file) to add documents."
+        ),
+        tags=["Knowledge Bases"],
+        responses={
+            200: "Knowledge base created successfully.",
+            409: "`dataset_name_duplicate` : The dataset name already exists. Please modify your dataset name.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[DatasetCreatePayload.__name__])
     @service_api_ns.doc("create_dataset")
     @service_api_ns.doc(description="Create a new dataset")
@@ -320,16 +523,29 @@ class DatasetListApi(DatasetApiResource):
         except services.errors.dataset.DatasetNameDuplicateError:
             raise DatasetNameDuplicateError()
 
-        return dump_response(DatasetDetailResponse, dataset), 200
+        return _dump_service_dataset_detail(dataset), 200
 
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>")
 class DatasetApi(DatasetApiResource):
     """Resource for dataset."""
 
+    @service_api_ns.doc(
+        summary="Get Knowledge Base",
+        description=(
+            "Retrieve detailed information about a specific knowledge base, including its embedding "
+            "model, retrieval configuration, and document statistics."
+        ),
+        tags=["Knowledge Bases"],
+        responses={
+            200: "Knowledge base details.",
+            403: "`forbidden` : Insufficient permissions to access this knowledge base.",
+            404: "`not_found` : Dataset not found.",
+        },
+    )
     @service_api_ns.doc("get_dataset")
     @service_api_ns.doc(description="Get a specific dataset by ID")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Dataset retrieved successfully",
@@ -352,7 +568,7 @@ class DatasetApi(DatasetApiResource):
             DatasetService.check_dataset_permission(dataset, current_user)
         except services.errors.account.NoPermissionError as e:
             raise Forbidden(str(e))
-        data = dump_response(DatasetDetailResponse, dataset)
+        data = _dump_service_dataset_detail(dataset)
         # check embedding setting
         assert isinstance(current_user, Account)
         cid = current_user.current_tenant_id
@@ -384,18 +600,25 @@ class DatasetApi(DatasetApiResource):
             part_users_list = DatasetPermissionService.get_dataset_partial_member_list(dataset_id_str)
             data.update({"partial_member_list": part_users_list})
 
-        return (
-            DatasetDetailWithPartialMembersResponse.model_validate(data).model_dump(
-                mode="json",
-                exclude={"partial_member_list"} if "partial_member_list" not in data else set(),
-            ),
-            200,
-        )
+        return _dump_service_dataset_with_partial_members(data), 200
 
+    @service_api_ns.doc(
+        summary="Update Knowledge Base",
+        description=(
+            "Update the name, description, permissions, or retrieval settings of an existing knowledge "
+            "base. Only the fields provided in the request body are updated."
+        ),
+        tags=["Knowledge Bases"],
+        responses={
+            200: "Knowledge base updated successfully.",
+            403: "`forbidden` : Insufficient permissions to access this knowledge base.",
+            404: "`not_found` : Dataset not found.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[DatasetUpdatePayload.__name__])
     @service_api_ns.doc("update_dataset")
     @service_api_ns.doc(description="Update an existing dataset")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Dataset updated successfully",
@@ -446,20 +669,21 @@ class DatasetApi(DatasetApiResource):
                 retrieval_model.reranking_model.reranking_model_name,
             )
 
-        # The role of the current user in the ta table must be admin, owner, editor, or dataset_operator
-        DatasetPermissionService.check_permission(
-            current_user,
-            dataset,
-            str(payload.permission) if payload.permission else None,
-            payload.partial_member_list,
-        )
+        if not dify_config.RBAC_ENABLED:
+            # The role of the current user in the ta table must be admin, owner, editor, or dataset_operator
+            DatasetPermissionService.check_permission(
+                current_user,
+                dataset,
+                str(payload.permission) if payload.permission else None,
+                payload.partial_member_list,
+            )
 
         dataset = DatasetService.update_dataset(dataset_id_str, update_data, current_user)
 
         if dataset is None:
             raise NotFound("Dataset not found.")
 
-        result_data = dump_response(DatasetDetailResponse, dataset)
+        result_data = _dump_service_dataset_detail(dataset)
         assert isinstance(current_user, Account)
         tenant_id = current_user.current_tenant_id
 
@@ -472,11 +696,27 @@ class DatasetApi(DatasetApiResource):
         partial_member_list = DatasetPermissionService.get_dataset_partial_member_list(dataset_id_str)
         result_data.update({"partial_member_list": partial_member_list})
 
-        return DatasetDetailWithPartialMembersResponse.model_validate(result_data).model_dump(mode="json"), 200
+        return _dump_service_dataset_with_partial_members(result_data), 200
 
+    @service_api_ns.doc(
+        summary="Delete Knowledge Base",
+        description=(
+            "Permanently delete a knowledge base and all its documents. The knowledge base must not be "
+            "in use by any application."
+        ),
+        tags=["Knowledge Bases"],
+        responses={
+            204: "Success.",
+            404: "`not_found` : Dataset not found.",
+            409: (
+                "`dataset_in_use` : The knowledge base is being used by some apps. Please remove it from the "
+                "apps before deleting."
+            ),
+        },
+    )
     @service_api_ns.doc("delete_dataset")
     @service_api_ns.doc(description="Delete a dataset")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             204: "Dataset deleted successfully",
@@ -519,6 +759,17 @@ class DatasetApi(DatasetApiResource):
 class DocumentStatusApi(DatasetApiResource):
     """Resource for batch document status operations."""
 
+    @service_api_ns.doc(
+        summary="Update Document Status in Batch",
+        description="Enable, disable, archive, or unarchive multiple documents at once.",
+        tags=["Documents"],
+        responses={
+            200: "Documents updated successfully.",
+            400: "`invalid_action` : Invalid action.",
+            403: "`forbidden` : Insufficient permissions.",
+            404: "`not_found` : Knowledge base not found.",
+        },
+    )
     @service_api_ns.response(
         200,
         "Document status updated successfully",
@@ -528,8 +779,8 @@ class DocumentStatusApi(DatasetApiResource):
     @service_api_ns.doc(description="Batch update document status")
     @service_api_ns.doc(
         params={
-            "dataset_id": "Dataset ID",
-            "action": "Action to perform: 'enable', 'disable', 'archive', or 'un_archive'",
+            "dataset_id": "Knowledge base ID.",
+            "action": DOCUMENT_STATUS_ACTION_PARAM,
         }
     )
     @service_api_ns.doc(
@@ -591,6 +842,14 @@ class DocumentStatusApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/tags")
 class DatasetTagsApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="List Knowledge Tags",
+        description="Returns the list of all knowledge base tags in the workspace.",
+        tags=["Tags"],
+        responses={
+            200: "List of tags.",
+        },
+    )
     @service_api_ns.doc("list_dataset_tags")
     @service_api_ns.doc(description="Get all knowledge type tags")
     @service_api_ns.doc(
@@ -612,6 +871,14 @@ class DatasetTagsApi(DatasetApiResource):
         tags = TagService.get_tags(db.session(), "knowledge", cid)
         return dump_response(KnowledgeTagListResponse, tags), 200
 
+    @service_api_ns.doc(
+        summary="Create Knowledge Tag",
+        description="Create a new tag for organizing knowledge bases.",
+        tags=["Tags"],
+        responses={
+            200: "Tag created successfully.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[TagCreatePayload.__name__])
     @service_api_ns.doc("create_dataset_tag")
     @service_api_ns.doc(description="Add a knowledge type tag")
@@ -634,7 +901,7 @@ class DatasetTagsApi(DatasetApiResource):
             raise Forbidden()
 
         payload = TagCreatePayload.model_validate(service_api_ns.payload or {})
-        tag = TagService.save_tags(SaveTagPayload(name=payload.name, type=TagType.KNOWLEDGE))
+        tag = TagService.save_tags(SaveTagPayload(name=payload.name, type=TagType.KNOWLEDGE), db.session)
 
         response = dump_response(
             KnowledgeTagResponse,
@@ -642,6 +909,14 @@ class DatasetTagsApi(DatasetApiResource):
         )
         return response, 200
 
+    @service_api_ns.doc(
+        summary="Update Knowledge Tag",
+        description="Rename an existing knowledge base tag.",
+        tags=["Tags"],
+        responses={
+            200: "Tag updated successfully.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[TagUpdatePayload.__name__])
     @service_api_ns.doc("update_dataset_tag")
     @service_api_ns.doc(description="Update a knowledge type tag")
@@ -664,9 +939,9 @@ class DatasetTagsApi(DatasetApiResource):
 
         payload = TagUpdatePayload.model_validate(service_api_ns.payload or {})
         tag_id = payload.tag_id
-        tag = TagService.update_tags(UpdateTagServicePayload(name=payload.name), tag_id)
+        tag = TagService.update_tags(UpdateTagServicePayload(name=payload.name), tag_id, db.session)
 
-        binding_count = TagService.get_tag_binding_count(tag_id)
+        binding_count = TagService.get_tag_binding_count(tag_id, db.session)
 
         response = dump_response(
             KnowledgeTagResponse,
@@ -674,6 +949,14 @@ class DatasetTagsApi(DatasetApiResource):
         )
         return response, 200
 
+    @service_api_ns.doc(
+        summary="Delete Knowledge Tag",
+        description="Permanently delete a knowledge base tag. Does not delete the knowledge bases that were tagged.",
+        tags=["Tags"],
+        responses={
+            204: "Success.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[TagDeletePayload.__name__])
     @service_api_ns.doc("delete_dataset_tag")
     @service_api_ns.doc(description="Delete a knowledge type tag")
@@ -688,13 +971,21 @@ class DatasetTagsApi(DatasetApiResource):
     def delete(self, _):
         """Delete a knowledge type tag."""
         payload = TagDeletePayload.model_validate(service_api_ns.payload or {})
-        TagService.delete_tag(payload.tag_id)
+        TagService.delete_tag(payload.tag_id, db.session)
 
         return "", 204
 
 
 @service_api_ns.route("/datasets/tags/binding")
 class DatasetTagBindingApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Create Tag Binding",
+        description="Bind one or more tags to a knowledge base. A knowledge base can have multiple tags.",
+        tags=["Tags"],
+        responses={
+            204: "Success.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[TagBindingPayload.__name__])
     @service_api_ns.doc("bind_dataset_tags")
     @service_api_ns.doc(description="Bind tags to a dataset")
@@ -713,7 +1004,8 @@ class DatasetTagBindingApi(DatasetApiResource):
 
         payload = TagBindingPayload.model_validate(service_api_ns.payload or {})
         TagService.save_tag_binding(
-            TagBindingCreatePayload(tag_ids=payload.tag_ids, target_id=payload.target_id, type=TagType.KNOWLEDGE)
+            TagBindingCreatePayload(tag_ids=payload.tag_ids, target_id=payload.target_id, type=TagType.KNOWLEDGE),
+            db.session,
         )
 
         return "", 204
@@ -721,6 +1013,14 @@ class DatasetTagBindingApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/tags/unbinding")
 class DatasetTagUnbindingApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Delete Tag Binding",
+        description="Remove one or more tags from a knowledge base.",
+        tags=["Tags"],
+        responses={
+            204: "Success.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[TagUnbindingPayload.__name__])
     @service_api_ns.doc("unbind_dataset_tags")
     @service_api_ns.doc(description="Unbind tags from a dataset")
@@ -739,7 +1039,8 @@ class DatasetTagUnbindingApi(DatasetApiResource):
 
         payload = TagUnbindingPayload.model_validate(service_api_ns.payload or {})
         TagService.delete_tag_binding(
-            TagBindingDeletePayload(tag_ids=payload.tag_ids, target_id=payload.target_id, type=TagType.KNOWLEDGE)
+            TagBindingDeletePayload(tag_ids=payload.tag_ids, target_id=payload.target_id, type=TagType.KNOWLEDGE),
+            db.session,
         )
 
         return "", 204
@@ -747,9 +1048,17 @@ class DatasetTagUnbindingApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/tags")
 class DatasetTagsBindingStatusApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Get Knowledge Base Tags",
+        description="Returns the list of tags bound to a specific knowledge base.",
+        tags=["Tags"],
+        responses={
+            200: "Tags bound to the knowledge base.",
+        },
+    )
     @service_api_ns.doc("get_dataset_tags_binding_status")
     @service_api_ns.doc(description="Get tags bound to a specific dataset")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Tags retrieved successfully",
@@ -766,6 +1075,8 @@ class DatasetTagsBindingStatusApi(DatasetApiResource):
         dataset_id = kwargs.get("dataset_id")
         assert isinstance(current_user, Account)
         assert current_user.current_tenant_id is not None
-        tags = TagService.get_tags_by_target_id("knowledge", current_user.current_tenant_id, str(dataset_id))
+        tags = TagService.get_tags_by_target_id(
+            "knowledge", current_user.current_tenant_id, str(dataset_id), db.session
+        )
         tags_list = [{"id": tag.id, "name": tag.name} for tag in tags]
         return dump_response(DatasetBoundTagListResponse, {"data": tags_list, "total": len(tags)}), 200
diff --git a/api/controllers/service_api/dataset/document.py b/api/controllers/service_api/dataset/document.py
index c71feb1aa7b..9bae862814a 100644
--- a/api/controllers/service_api/dataset/document.py
+++ b/api/controllers/service_api/dataset/document.py
@@ -8,11 +8,12 @@ deprecated in generated API docs so clients migrate toward the canonical paths.
 import json
 from collections.abc import Mapping
 from contextlib import ExitStack
-from typing import Any, Literal, Self
+from copy import deepcopy
+from typing import Annotated, Any, Literal, Self, override
 from uuid import UUID
 
 from flask import request, send_file
-from pydantic import BaseModel, Field, field_validator, model_validator
+from pydantic import BaseModel, Field, GetJsonSchemaHandler, WithJsonSchema, field_validator, model_validator
 from sqlalchemy import desc, func, select
 from werkzeug.exceptions import Forbidden, NotFound
 
@@ -39,6 +40,7 @@ from controllers.service_api.dataset.error import (
     DocumentIndexingError,
     InvalidMetadataError,
 )
+from controllers.service_api.schema import binary_response
 from controllers.service_api.wraps import (
     DatasetApiResource,
     cloud_edition_billing_rate_limit_check,
@@ -61,6 +63,8 @@ from models.dataset import Dataset, Document, DocumentSegment
 from models.enums import SegmentStatus
 from services.dataset_service import DatasetService, DocumentService
 from services.entities.knowledge_entities.knowledge_entities import (
+    DocForm,
+    IndexingTechnique,
     KnowledgeConfig,
     ProcessRule,
     RetrievalModel,
@@ -70,16 +74,44 @@ from services.summary_index_service import SummaryIndexService
 
 
 class DocumentTextCreatePayload(BaseModel):
-    name: str
-    text: str
-    process_rule: ProcessRule | None = None
-    original_document_id: str | None = None
-    doc_form: str = Field(default="text_model")
-    doc_language: str = Field(default="English")
-    indexing_technique: str | None = None
-    retrieval_model: RetrievalModel | None = None
-    embedding_model: str | None = None
-    embedding_model_provider: str | None = None
+    name: str = Field(description="Document name.")
+    text: str = Field(description="Document text content.")
+    process_rule: ProcessRule | None = Field(default=None, description="Processing rules for chunking.")
+    original_document_id: str | None = Field(default=None, description="Original document ID for replacement.")
+    doc_form: DocForm = Field(
+        default="text_model",
+        description=(
+            "`text_model` for standard text chunking, `hierarchical_model` for parent-child chunk structure, "
+            "`qa_model` for question-answer pair extraction."
+        ),
+    )
+    doc_language: str = Field(default="English", description="Language of the document for processing optimization.")
+    indexing_technique: IndexingTechnique = Field(
+        default=None,
+        description=(
+            "`high_quality` uses embedding models for precise search; `economy` uses keyword-based indexing. "
+            "Required when adding the first document to a knowledge base; subsequent documents inherit the "
+            "knowledge base's indexing technique if omitted."
+        ),
+    )
+    retrieval_model: RetrievalModel | None = Field(
+        default=None,
+        description="Retrieval model configuration. Controls how chunks are searched and ranked.",
+    )
+    embedding_model: str | None = Field(
+        default=None,
+        description=(
+            "Embedding model name. Use the `model` field from "
+            "[Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`."
+        ),
+    )
+    embedding_model_provider: str | None = Field(
+        default=None,
+        description=(
+            "Embedding model provider. Use the `provider` field from "
+            "[Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`."
+        ),
+    )
 
     @field_validator("doc_form")
     @classmethod
@@ -90,12 +122,21 @@ class DocumentTextCreatePayload(BaseModel):
 
 
 class DocumentTextUpdate(BaseModel):
-    name: str | None = None
-    text: str | None = None
-    process_rule: ProcessRule | None = None
-    doc_form: str = "text_model"
-    doc_language: str = "English"
-    retrieval_model: RetrievalModel | None = None
+    name: str | None = Field(default=None, description="Document name. Required when `text` is provided.")
+    text: str | None = Field(default=None, description="Document text content.")
+    process_rule: ProcessRule | None = Field(default=None, description="Processing rules for chunking.")
+    doc_form: DocForm = Field(
+        default="text_model",
+        description=(
+            "`text_model` for standard text chunking, `hierarchical_model` for parent-child chunk structure, "
+            "`qa_model` for question-answer pair extraction."
+        ),
+    )
+    doc_language: str = Field(default="English", description="Language of the document for processing optimization.")
+    retrieval_model: RetrievalModel | None = Field(
+        default=None,
+        description="Retrieval model configuration. Controls how chunks are searched and ranked.",
+    )
 
     @field_validator("doc_form")
     @classmethod
@@ -104,6 +145,36 @@ class DocumentTextUpdate(BaseModel):
             raise ValueError("Invalid doc_form.")
         return value
 
+    @classmethod
+    @override
+    def __get_pydantic_json_schema__(cls, core_schema: Any, handler: GetJsonSchemaHandler) -> dict[str, Any]:
+        schema = handler.resolve_ref_schema(handler(core_schema))
+        properties = schema.get("properties")
+        if not isinstance(properties, dict):
+            return schema
+
+        text_branch_properties = deepcopy(properties)
+        text_branch_properties["text"] = _non_null_property_schema(properties.get("text"))
+        text_branch_properties["name"] = _non_null_property_schema(properties.get("name"))
+
+        no_text_branch_properties = deepcopy(properties)
+        no_text_branch_properties["text"] = {"description": "Document text content.", "type": "null"}
+
+        return {
+            **schema,
+            "anyOf": [
+                {
+                    "properties": text_branch_properties,
+                    "required": ["name", "text"],
+                    "type": "object",
+                },
+                {
+                    "properties": no_text_branch_properties,
+                    "type": "object",
+                },
+            ],
+        }
+
     @model_validator(mode="after")
     def check_text_and_name(self) -> Self:
         if self.text is not None and self.name is None:
@@ -111,19 +182,59 @@ class DocumentTextUpdate(BaseModel):
         return self
 
 
+def _non_null_property_schema(property_schema: object) -> dict[str, Any]:
+    if not isinstance(property_schema, dict):
+        return {}
+
+    any_of = property_schema.get("anyOf")
+    if isinstance(any_of, list):
+        non_null_candidates = [
+            candidate for candidate in any_of if isinstance(candidate, dict) and candidate.get("type") != "null"
+        ]
+        if len(non_null_candidates) == 1:
+            return {
+                **{key: value for key, value in property_schema.items() if key != "anyOf"},
+                **deepcopy(non_null_candidates[0]),
+            }
+
+    return deepcopy(property_schema)
+
+
+DocumentDisplayStatus = Annotated[
+    str | None,
+    WithJsonSchema(
+        {
+            "anyOf": [
+                {
+                    "enum": ["queuing", "indexing", "paused", "error", "available", "disabled", "archived"],
+                    "type": "string",
+                },
+                {"type": "null"},
+            ]
+        }
+    ),
+]
+
+
 class DocumentListQuery(BaseModel):
-    page: int = Field(default=1, description="Page number")
-    limit: int = Field(default=20, description="Number of items per page")
-    keyword: str | None = Field(default=None, description="Search keyword")
-    status: str | None = Field(default=None, description="Document status filter")
+    page: int = Field(default=1, description="Page number to retrieve.")
+    limit: int = Field(default=20, description="Number of items per page. Server caps at `100`.")
+    keyword: str | None = Field(default=None, description="Search keyword to filter by document name.")
+    status: DocumentDisplayStatus = Field(default=None, description="Filter by display status.")
 
 
 class DocumentGetQuery(BaseModel):
-    metadata: Literal["all", "only", "without"] = Field(default="all", description="Metadata response mode")
+    metadata: Literal["all", "only", "without"] = Field(
+        default="all",
+        description=(
+            "`all` returns all fields including metadata. `only` returns only `id`, `doc_type`, and "
+            "`doc_metadata`. `without` returns all fields except `doc_metadata`."
+        ),
+    )
 
 
 DOCUMENT_CREATE_BY_FILE_PARAMS = {
-    "dataset_id": "Dataset ID",
+    "dataset_id": "Knowledge base ID.",
     "file": {
         "in": "formData",
         "type": "file",
@@ -134,23 +245,32 @@ DOCUMENT_CREATE_BY_FILE_PARAMS = {
         "in": "formData",
         "type": "string",
         "required": False,
-        "description": "Optional JSON string with document creation settings.",
+        "description": (
+            "JSON string containing configuration. Accepts the same fields as "
+            "[Create Document by Text](/api-reference/documents/create-document-by-text) (`indexing_technique`, "
+            "`doc_form`, `doc_language`, `process_rule`, `retrieval_model`, `embedding_model`, "
+            "`embedding_model_provider`) except `name` and `text`."
+        ),
     },
 }
 DOCUMENT_UPDATE_BY_FILE_PARAMS = {
-    "dataset_id": "Dataset ID",
-    "document_id": "Document ID",
+    "dataset_id": "Knowledge base ID.",
+    "document_id": "Document ID.",
     "file": {
         "in": "formData",
         "type": "file",
         "required": False,
-        "description": "Replacement document file.",
+        "description": "Replacement document file to upload.",
     },
     "data": {
         "in": "formData",
         "type": "string",
         "required": False,
-        "description": "Optional JSON string with document update settings.",
+        "description": (
+            "JSON string containing document update settings such as `doc_form`, `doc_language`, `process_rule`, "
+            "`retrieval_model`, `embedding_model`, and `embedding_model_provider`. `name` and `text` are not used "
+            "for file updates."
+        ),
     },
 }
 
@@ -351,10 +471,28 @@ def _update_document_by_text(tenant_id: str, dataset_id: UUID, document_id: UUID
 class DocumentAddByTextApi(DatasetApiResource):
     """Resource for the canonical text document creation route."""
 
+    @service_api_ns.doc(
+        summary="Create Document by Text",
+        description=(
+            "Create a document from raw text content. The document is processed asynchronously — use the "
+            "returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/"
+            "get-document-indexing-status) to track progress."
+        ),
+        tags=["Documents"],
+        responses={
+            200: "Document created successfully.",
+            400: (
+                "- `provider_not_initialize` : No valid model provider credentials found. Please go to "
+                "Settings -> Model Provider to complete your provider credentials.\n"
+                "- `invalid_param` : Knowledge base does not exist. / indexing_technique is required. / "
+                "Invalid doc_form (must be `text_model`, `hierarchical_model`, or `qa_model`)."
+            ),
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[DocumentTextCreatePayload.__name__])
     @service_api_ns.doc("create_document_by_text")
     @service_api_ns.doc(description="Create a new document by providing text content")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Document created successfully",
@@ -386,7 +524,7 @@ class DeprecatedDocumentAddByTextApi(DatasetApiResource):
             "Use /datasets/{dataset_id}/document/create-by-text instead."
         )
     )
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Document created successfully",
@@ -409,10 +547,29 @@ class DeprecatedDocumentAddByTextApi(DatasetApiResource):
 class DocumentUpdateByTextApi(DatasetApiResource):
     """Resource for the canonical text document update route."""
 
+    @service_api_ns.doc(
+        summary="Update Document by Text",
+        description=(
+            "Update an existing document's text content, name, or processing configuration. Re-triggers "
+            "indexing if content changes — use the returned `batch` ID with [Get Document Indexing "
+            "Status](/api-reference/documents/get-document-indexing-status) to track progress."
+        ),
+        tags=["Documents"],
+        responses={
+            200: "Document updated successfully.",
+            400: (
+                "- `provider_not_initialize` : No valid model provider credentials found. Please go to "
+                "Settings -> Model Provider to complete your provider credentials.\n"
+                "- `invalid_param` : Knowledge base does not exist, name is required when text is "
+                "provided, or invalid doc_form (must be `text_model`, `hierarchical_model`, or "
+                "`qa_model`)."
+            ),
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[DocumentTextUpdate.__name__])
     @service_api_ns.doc("update_document_by_text")
     @service_api_ns.doc(description="Update an existing document by providing text content")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "document_id": "Document ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "document_id": "Document ID."})
     @service_api_ns.doc(
         responses={
             200: "Document updated successfully",
@@ -443,7 +600,7 @@ class DeprecatedDocumentUpdateByTextApi(DatasetApiResource):
             "Use /datasets/{dataset_id}/documents/{document_id}/update-by-text instead."
         )
     )
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "document_id": "Document ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "document_id": "Document ID."})
     @service_api_ns.doc(
         responses={
             200: "Document updated successfully",
@@ -463,11 +620,42 @@ class DeprecatedDocumentUpdateByTextApi(DatasetApiResource):
 
 @service_api_ns.route(
     "/datasets/<uuid:dataset_id>/document/create_by_file",
-    "/datasets/<uuid:dataset_id>/document/create-by-file",
+    doc={
+        "post": {
+            "deprecated": True,
+            "description": (
+                "Deprecated legacy alias for creating a new document by uploading a file. "
+                "Use /datasets/{dataset_id}/document/create-by-file instead."
+            ),
+        }
+    },
 )
+@service_api_ns.route("/datasets/<uuid:dataset_id>/document/create-by-file")
 class DocumentAddByFileApi(DatasetApiResource):
     """Resource for documents."""
 
+    @service_api_ns.doc(
+        summary="Create Document by File",
+        description=(
+            "Create a document by uploading a file. Supports common document formats (PDF, TXT, DOCX, "
+            "etc.). Processing is asynchronous — use the returned `batch` ID with [Get Document "
+            "Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress."
+        ),
+        tags=["Documents"],
+        responses={
+            200: "Document created successfully.",
+            400: (
+                "- `no_file_uploaded` : Please upload your file.\n"
+                "- `too_many_files` : Only one file is allowed.\n"
+                "- `filename_not_exists_error` : The specified filename does not exist.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found. Please go to "
+                "Settings -> Model Provider to complete your provider credentials.\n"
+                "- `invalid_param` : Knowledge base does not exist, external datasets not supported, "
+                "file too large, unsupported file type, missing required fields, or invalid doc_form "
+                "(must be `text_model`, `hierarchical_model`, or `qa_model`)."
+            ),
+        },
+    )
     @service_api_ns.doc("create_document_by_file")
     @service_api_ns.doc(description="Create a new document by uploading a file")
     @service_api_ns.doc(consumes=["multipart/form-data"], params=DOCUMENT_CREATE_BY_FILE_PARAMS)
@@ -658,6 +846,27 @@ def _update_document_by_file(tenant_id: str, dataset_id: UUID, document_id: UUID
 class DeprecatedDocumentUpdateByFileApi(DatasetApiResource):
     """Deprecated resource aliases for file document updates."""
 
+    @service_api_ns.doc(
+        summary="Update Document by File",
+        description=(
+            "Update an existing document by uploading a new file. Re-triggers indexing — use the returned "
+            "`batch` ID with [Get Document Indexing Status](/api-reference/documents/"
+            "get-document-indexing-status) to track progress."
+        ),
+        tags=["Documents"],
+        responses={
+            200: "Document updated successfully.",
+            400: (
+                "- `too_many_files` : Only one file is allowed.\n"
+                "- `filename_not_exists_error` : The specified filename does not exist.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found. Please go to "
+                "Settings -> Model Provider to complete your provider credentials.\n"
+                "- `invalid_param` : Knowledge base does not exist, external datasets not supported, "
+                "file too large, unsupported file type, or invalid doc_form (must be `text_model`, "
+                "`hierarchical_model`, or `qa_model`)."
+            ),
+        },
+    )
     @service_api_ns.doc("update_document_by_file_deprecated")
     @service_api_ns.doc(deprecated=True)
     @service_api_ns.doc(
@@ -686,9 +895,21 @@ class DeprecatedDocumentUpdateByFileApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/documents")
 class DocumentListApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="List Documents",
+        description=(
+            "Returns a paginated list of documents in the knowledge base. Supports filtering by keyword "
+            "and indexing status."
+        ),
+        tags=["Documents"],
+        responses={
+            200: "List of documents.",
+            404: "`not_found` : Knowledge base not found.",
+        },
+    )
     @service_api_ns.doc("list_documents")
     @service_api_ns.doc(description="List all documents in a dataset")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", **query_params_from_model(DocumentListQuery)})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", **query_params_from_model(DocumentListQuery)})
     @service_api_ns.doc(
         responses={
             200: "Documents retrieved successfully",
@@ -746,10 +967,23 @@ class DocumentListApi(DatasetApiResource):
 class DocumentBatchDownloadZipApi(DatasetApiResource):
     """Download multiple uploaded-file documents as a single ZIP archive."""
 
+    @service_api_ns.doc(
+        summary="Download Documents as ZIP",
+        description=(
+            "Download multiple uploaded-file documents as a single ZIP archive. Accepts up to `100` document IDs."
+        ),
+        tags=["Documents"],
+        responses={
+            200: "ZIP archive containing the requested documents.",
+            403: "`forbidden` : Insufficient permissions.",
+            404: "`not_found` : Document or dataset not found.",
+        },
+    )
+    @binary_response(service_api_ns, "application/zip")
     @service_api_ns.expect(service_api_ns.models[DocumentBatchDownloadZipPayload.__name__])
     @service_api_ns.doc("download_documents_as_zip")
     @service_api_ns.doc(description="Download selected uploaded documents as a single ZIP archive")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "ZIP archive generated successfully",
@@ -758,11 +992,7 @@ class DocumentBatchDownloadZipApi(DatasetApiResource):
             404: "Document or dataset not found",
         }
     )
-    @service_api_ns.response(
-        200,
-        "ZIP archive generated successfully",
-        service_api_ns.models[BinaryFileResponse.__name__],
-    )
+    @service_api_ns.response(200, "ZIP archive generated successfully")
     @cloud_edition_billing_rate_limit_check("knowledge", "dataset")
     def post(self, tenant_id, dataset_id: UUID):
         payload = DocumentBatchDownloadZipPayload.model_validate(service_api_ns.payload or {})
@@ -789,9 +1019,23 @@ class DocumentBatchDownloadZipApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/documents/<string:batch>/indexing-status")
 class DocumentIndexingStatusApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Get Document Indexing Status",
+        description=(
+            "Check the indexing progress of documents in a batch. Returns the current processing stage "
+            "and chunk completion counts for each document. Poll this endpoint until `indexing_status` "
+            "reaches `completed` or `error`. The status progresses through: `waiting` → `parsing` → "
+            "`cleaning` → `splitting` → `indexing` → `completed`."
+        ),
+        tags=["Documents"],
+        responses={
+            200: "Indexing status for documents in the batch.",
+            404: "`not_found` : Knowledge base not found. / Documents not found.",
+        },
+    )
     @service_api_ns.doc("get_document_indexing_status")
     @service_api_ns.doc(description="Get indexing status for documents in a batch")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "batch": "Batch ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "batch": "Batch ID."})
     @service_api_ns.doc(
         responses={
             200: "Indexing status retrieved successfully",
@@ -861,9 +1105,19 @@ class DocumentIndexingStatusApi(DatasetApiResource):
 class DocumentDownloadApi(DatasetApiResource):
     """Return a signed download URL for a document's original uploaded file."""
 
+    @service_api_ns.doc(
+        summary="Download Document",
+        description="Get a signed download URL for a document's original uploaded file.",
+        tags=["Documents"],
+        responses={
+            200: "Download URL generated successfully.",
+            403: "`forbidden` : No permission to access this document.",
+            404: "`not_found` : Document not found.",
+        },
+    )
     @service_api_ns.doc("get_document_download_url")
     @service_api_ns.doc(description="Get a signed download URL for a document's original uploaded file")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "document_id": "Document ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "document_id": "Document ID."})
     @service_api_ns.doc(
         responses={
             200: "Download URL generated successfully",
@@ -895,9 +1149,27 @@ class DocumentDownloadApi(DatasetApiResource):
 class DocumentApi(DatasetApiResource):
     METADATA_CHOICES = {"all", "only", "without"}
 
+    @service_api_ns.doc(
+        summary="Get Document",
+        description=(
+            "Retrieve detailed information about a specific document, including its indexing status, "
+            "metadata, and processing statistics."
+        ),
+        tags=["Documents"],
+        responses={
+            200: (
+                "Document details. The response shape varies based on the `metadata` query parameter. When "
+                "`metadata` is `only`, only `id`, `doc_type`, and `doc_metadata` are returned. When "
+                "`metadata` is `without`, `doc_type` and `doc_metadata` are omitted."
+            ),
+            400: "`invalid_metadata` : Invalid metadata value for the specified key.",
+            403: "`forbidden` : No permission.",
+            404: "`not_found` : Document not found.",
+        },
+    )
     @service_api_ns.doc("get_document")
     @service_api_ns.doc(description="Get a specific document by ID")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "document_id": "Document ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "document_id": "Document ID."})
     @service_api_ns.doc(params=query_params_from_model(DocumentGetQuery))
     @service_api_ns.doc(
         responses={
@@ -1036,9 +1308,20 @@ class DocumentApi(DatasetApiResource):
         """Update document by file on the canonical document resource."""
         return _update_document_by_file(tenant_id=tenant_id, dataset_id=dataset_id, document_id=document_id)
 
+    @service_api_ns.doc(
+        summary="Delete Document",
+        description="Permanently delete a document and all its chunks from the knowledge base.",
+        tags=["Documents"],
+        responses={
+            204: "Success.",
+            400: "`document_indexing` : Cannot delete document during indexing.",
+            403: "`archived_document_immutable` : The archived document is not editable.",
+            404: "`not_found` : Document Not Exists.",
+        },
+    )
     @service_api_ns.doc("delete_document")
     @service_api_ns.doc(description="Delete a document")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "document_id": "Document ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "document_id": "Document ID."})
     @service_api_ns.doc(
         responses={
             204: "Document deleted successfully",
diff --git a/api/controllers/service_api/dataset/hit_testing.py b/api/controllers/service_api/dataset/hit_testing.py
index 55a1c47c425..31881e86322 100644
--- a/api/controllers/service_api/dataset/hit_testing.py
+++ b/api/controllers/service_api/dataset/hit_testing.py
@@ -13,9 +13,35 @@ register_response_schema_models(service_api_ns, HitTestingResponse)
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/hit-testing", "/datasets/<uuid:dataset_id>/retrieve")
 class HitTestingApi(DatasetApiResource, DatasetsHitTestingBase):
+    @service_api_ns.doc(
+        summary="Retrieve Chunks from a Knowledge Base / Test Retrieval",
+        description=(
+            "Performs a search query against a knowledge base to retrieve the most relevant chunks. This "
+            "endpoint can be used for both production retrieval and test retrieval."
+        ),
+        tags=["Knowledge Bases"],
+        responses={
+            200: "Retrieval results.",
+            400: (
+                "- `dataset_not_initialized` : The dataset is still being initialized or indexing. Please "
+                "wait a moment.\n"
+                "- `provider_not_initialize` : No valid model provider credentials found. Please go to "
+                "Settings -> Model Provider to complete your provider credentials.\n"
+                "- `provider_quota_exceeded` : Your quota for Dify Hosted OpenAI has been exhausted. Please "
+                "go to Settings -> Model Provider to complete your own provider credentials.\n"
+                "- `model_currently_not_support` : Dify Hosted OpenAI trial currently not support the GPT-4 "
+                "model.\n"
+                "- `completion_request_error` : Completion request failed.\n"
+                "- `invalid_param` : Invalid parameter value."
+            ),
+            403: "`forbidden` : Insufficient permissions.",
+            404: "`not_found` : Knowledge base not found.",
+            500: "`internal_server_error` : An internal error occurred during retrieval.",
+        },
+    )
     @service_api_ns.doc("dataset_hit_testing")
     @service_api_ns.doc(description="Perform hit testing on a dataset")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.response(
         200,
         "Hit testing results",
diff --git a/api/controllers/service_api/dataset/metadata.py b/api/controllers/service_api/dataset/metadata.py
index 293a77fc5ec..426d008c412 100644
--- a/api/controllers/service_api/dataset/metadata.py
+++ b/api/controllers/service_api/dataset/metadata.py
@@ -24,6 +24,12 @@ from services.entities.knowledge_entities.knowledge_entities import (
 )
 from services.metadata_service import MetadataService
 
+BUILT_IN_METADATA_ACTION_PARAM = {
+    "description": "`enable` to activate built-in metadata fields, `disable` to deactivate them.",
+    "enum": ["enable", "disable"],
+    "type": "string",
+}
+
 register_schema_model(service_api_ns, MetadataUpdatePayload)
 register_schema_models(
     service_api_ns,
@@ -43,10 +49,21 @@ register_response_schema_models(
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/metadata")
 class DatasetMetadataCreateServiceApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Create Metadata Field",
+        description=(
+            "Create a custom metadata field for the knowledge base. Metadata fields can be used to "
+            "annotate documents with structured information."
+        ),
+        tags=["Metadata"],
+        responses={
+            201: "Metadata field created successfully.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[MetadataArgs.__name__])
     @service_api_ns.doc("create_dataset_metadata")
     @service_api_ns.doc(description="Create metadata for a dataset")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             201: "Metadata created successfully",
@@ -71,9 +88,20 @@ class DatasetMetadataCreateServiceApi(DatasetApiResource):
         metadata = MetadataService.create_metadata(dataset_id_str, metadata_args)
         return dump_response(DatasetMetadataResponse, metadata), 201
 
+    @service_api_ns.doc(
+        summary="List Metadata Fields",
+        description=(
+            "Returns the list of all metadata fields (both custom and built-in) for the knowledge base, "
+            "along with the count of documents using each field."
+        ),
+        tags=["Metadata"],
+        responses={
+            200: "Metadata fields for the knowledge base.",
+        },
+    )
     @service_api_ns.doc("get_dataset_metadata")
     @service_api_ns.doc(description="Get all metadata for a dataset")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Metadata retrieved successfully",
@@ -96,10 +124,18 @@ class DatasetMetadataCreateServiceApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/metadata/<uuid:metadata_id>")
 class DatasetMetadataServiceApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Update Metadata Field",
+        description="Rename a custom metadata field.",
+        tags=["Metadata"],
+        responses={
+            200: "Metadata field updated successfully.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[MetadataUpdatePayload.__name__])
     @service_api_ns.doc("update_dataset_metadata")
     @service_api_ns.doc(description="Update metadata name")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "metadata_id": "Metadata ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "metadata_id": "Metadata field ID."})
     @service_api_ns.doc(
         responses={
             200: "Metadata updated successfully",
@@ -125,9 +161,20 @@ class DatasetMetadataServiceApi(DatasetApiResource):
         metadata = MetadataService.update_metadata_name(dataset_id_str, metadata_id_str, payload.name)
         return dump_response(DatasetMetadataResponse, metadata), 200
 
+    @service_api_ns.doc(
+        summary="Delete Metadata Field",
+        description=(
+            "Permanently delete a custom metadata field. Documents using this field will lose their "
+            "metadata values for it."
+        ),
+        tags=["Metadata"],
+        responses={
+            204: "Success.",
+        },
+    )
     @service_api_ns.doc("delete_dataset_metadata")
     @service_api_ns.doc(description="Delete metadata")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "metadata_id": "Metadata ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "metadata_id": "Metadata field ID."})
     @service_api_ns.doc(
         responses={
             204: "Metadata deleted successfully",
@@ -152,8 +199,19 @@ class DatasetMetadataServiceApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/metadata/built-in")
 class DatasetMetadataBuiltInFieldServiceApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Get Built-in Metadata Fields",
+        description=(
+            "Returns the list of built-in metadata fields provided by the system (e.g., document type, source URL)."
+        ),
+        tags=["Metadata"],
+        responses={
+            200: "Built-in metadata fields.",
+        },
+    )
     @service_api_ns.doc("get_built_in_fields")
     @service_api_ns.doc(description="Get all built-in metadata fields")
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Built-in fields retrieved successfully",
@@ -173,9 +231,17 @@ class DatasetMetadataBuiltInFieldServiceApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/metadata/built-in/<string:action>")
 class DatasetMetadataBuiltInFieldActionServiceApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Update Built-in Metadata Field",
+        description="Enable or disable built-in metadata fields for the knowledge base.",
+        tags=["Metadata"],
+        responses={
+            200: "Built-in metadata field toggled successfully.",
+        },
+    )
     @service_api_ns.doc("toggle_built_in_field")
     @service_api_ns.doc(description="Enable or disable built-in metadata field")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "action": "Action to perform: 'enable' or 'disable'"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "action": BUILT_IN_METADATA_ACTION_PARAM})
     @service_api_ns.doc(
         responses={
             200: "Action completed successfully",
@@ -205,10 +271,21 @@ class DatasetMetadataBuiltInFieldActionServiceApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/documents/metadata")
 class DocumentMetadataEditServiceApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Update Document Metadata in Batch",
+        description=(
+            "Update metadata values for multiple documents at once. Each document in the request "
+            "receives the specified metadata key-value pairs."
+        ),
+        tags=["Metadata"],
+        responses={
+            200: "Document metadata updated successfully.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[MetadataOperationData.__name__])
     @service_api_ns.doc("update_documents_metadata")
     @service_api_ns.doc(description="Update metadata for multiple documents")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Documents metadata updated successfully",
diff --git a/api/controllers/service_api/dataset/rag_pipeline/rag_pipeline_workflow.py b/api/controllers/service_api/dataset/rag_pipeline/rag_pipeline_workflow.py
index a1a8b588c42..a6a61262cdc 100644
--- a/api/controllers/service_api/dataset/rag_pipeline/rag_pipeline_workflow.py
+++ b/api/controllers/service_api/dataset/rag_pipeline/rag_pipeline_workflow.py
@@ -19,6 +19,11 @@ from controllers.common.schema import (
 from controllers.service_api import service_api_ns
 from controllers.service_api.dataset.error import PipelineRunError
 from controllers.service_api.dataset.rag_pipeline.serializers import serialize_upload_file
+from controllers.service_api.schema import (
+    event_stream_response,
+    json_or_event_stream_response,
+    multipart_file_params,
+)
 from controllers.service_api.wraps import DatasetApiResource
 from core.app.apps.pipeline.pipeline_generator import PipelineGenerator
 from core.app.entities.app_invoke_entities import InvokeFrom
@@ -32,6 +37,7 @@ from services.errors.file import FileTooLargeError, UnsupportedFileTypeError
 from services.file_service import FileService
 from services.rag_pipeline.entity.pipeline_service_api_entities import (
     DatasourceNodeRunApiEntity,
+    DatasourceType,
     PipelineRunApiEntity,
 )
 from services.rag_pipeline.pipeline_generate_service import PipelineGenerateService
@@ -39,14 +45,27 @@ from services.rag_pipeline.rag_pipeline import RagPipelineService
 
 
 class DatasourceNodeRunPayload(BaseModel):
-    inputs: dict[str, Any]
-    datasource_type: str
-    credential_id: str | None = None
-    is_published: bool
+    inputs: dict[str, Any] = Field(description="Input variables for the datasource node.")
+    datasource_type: DatasourceType = Field(description="Type of the datasource.")
+    credential_id: str | None = Field(
+        default=None, description="Datasource credential ID. Uses the default if omitted."
+    )
+    is_published: bool = Field(
+        description=(
+            "Whether to run the published or draft version of the node. `true` runs the published version, "
+            "`false` runs the draft."
+        )
+    )
 
 
 class DatasourcePluginsQuery(BaseModel):
-    is_published: bool = True
+    is_published: bool = Field(
+        default=True,
+        description=(
+            "Whether to retrieve nodes from the published or draft pipeline. `true` returns nodes from the published "
+            "version, `false` returns nodes from the draft."
+        ),
+    )
 
 
 class DatasourceCredentialInfoResponse(ResponseModel):
@@ -95,13 +114,21 @@ register_response_schema_models(
 class DatasourcePluginsApi(DatasetApiResource):
     """Resource for datasource plugins."""
 
+    @service_api_ns.doc(
+        summary="List Datasource Plugins",
+        description=(
+            "List the datasource nodes configured in the knowledge pipeline. Each node includes the "
+            "plugin it uses plus the metadata needed to run it."
+        ),
+        tags=["Knowledge Pipeline"],
+        responses={
+            200: "List of datasource nodes configured in the pipeline.",
+            404: "`not_found` : Dataset not found.",
+        },
+    )
     @service_api_ns.doc(shortcut="list_rag_pipeline_datasource_plugins")
     @service_api_ns.doc(description="List all datasource plugins for a rag pipeline")
-    @service_api_ns.doc(
-        path={
-            "dataset_id": "Dataset ID",
-        }
-    )
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(params=query_params_from_model(DatasourcePluginsQuery))
     @service_api_ns.doc(
         responses={
@@ -137,13 +164,22 @@ class DatasourcePluginsApi(DatasetApiResource):
 class DatasourceNodeRunApi(DatasetApiResource):
     """Resource for datasource node run."""
 
+    @service_api_ns.doc(
+        summary="Run Datasource Node",
+        description=(
+            "Execute a single datasource node within the knowledge pipeline. Returns a streaming "
+            "response with the node execution results."
+        ),
+        tags=["Knowledge Pipeline"],
+        responses={
+            200: "Streaming response with node execution events.",
+            404: "`not_found` : Dataset not found.",
+        },
+    )
+    @event_stream_response(service_api_ns)
     @service_api_ns.doc(shortcut="pipeline_datasource_node_run")
     @service_api_ns.doc(description="Run a datasource node for a rag pipeline")
-    @service_api_ns.doc(
-        path={
-            "dataset_id": "Dataset ID",
-        }
-    )
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID.", "node_id": "ID of the datasource node to execute."})
     @service_api_ns.doc(
         responses={
             200: "Datasource node run successfully",
@@ -195,13 +231,27 @@ class DatasourceNodeRunApi(DatasetApiResource):
 class PipelineRunApi(DatasetApiResource):
     """Resource for datasource node run."""
 
+    @service_api_ns.doc(
+        summary="Run Pipeline",
+        description=(
+            "Execute the full knowledge pipeline for a knowledge base. Supports both streaming and "
+            "blocking response modes."
+        ),
+        tags=["Knowledge Pipeline"],
+        responses={
+            200: (
+                "Pipeline execution result. Format depends on `response_mode`: streaming returns a "
+                "`text/event-stream`, blocking returns a JSON object."
+            ),
+            403: "`forbidden` : Forbidden.",
+            404: "`not_found` : Dataset not found.",
+            500: "`pipeline_run_error` : Pipeline execution failed.",
+        },
+    )
+    @json_or_event_stream_response(service_api_ns)
     @service_api_ns.doc(shortcut="pipeline_datasource_node_run")
     @service_api_ns.doc(description="Run a datasource node for a rag pipeline")
-    @service_api_ns.doc(
-        path={
-            "dataset_id": "Dataset ID",
-        }
-    )
+    @service_api_ns.doc(params={"dataset_id": "Knowledge base ID."})
     @service_api_ns.doc(
         responses={
             200: "Pipeline run successfully",
@@ -248,8 +298,24 @@ class PipelineRunApi(DatasetApiResource):
 class KnowledgebasePipelineFileUploadApi(DatasetApiResource):
     """Resource for uploading a file to a knowledgebase pipeline."""
 
+    @service_api_ns.doc(
+        summary="Upload Pipeline File",
+        description="Upload a file for use in a knowledge pipeline. Accepts a single file via `multipart/form-data`.",
+        tags=["Knowledge Pipeline"],
+        responses={
+            201: "File uploaded successfully.",
+            400: (
+                "- `no_file_uploaded` : Please upload your file.\n"
+                "- `filename_not_exists_error` : The specified filename does not exist.\n"
+                "- `too_many_files` : Only one file is allowed."
+            ),
+            413: "`file_too_large` : File size exceeded.",
+            415: "`unsupported_file_type` : File type not allowed.",
+        },
+    )
     @service_api_ns.doc(shortcut="knowledgebase_pipeline_file_upload")
     @service_api_ns.doc(description="Upload a file to a knowledgebase pipeline")
+    @service_api_ns.doc(consumes=["multipart/form-data"], params=multipart_file_params(include_user=False))
     @service_api_ns.doc(
         responses={
             201: "File uploaded successfully",
diff --git a/api/controllers/service_api/dataset/segment.py b/api/controllers/service_api/dataset/segment.py
index f93eb6a4bf1..dd8d7c76632 100644
--- a/api/controllers/service_api/dataset/segment.py
+++ b/api/controllers/service_api/dataset/segment.py
@@ -47,10 +47,10 @@ from services.summary_index_service import SummaryIndexService
 
 
 class SegmentCreateItemPayload(BaseModel):
-    content: str = Field(min_length=1)
-    answer: str | None = None
-    keywords: list[str] | None = None
-    attachment_ids: list[str] | None = None
+    content: str = Field(min_length=1, description="Chunk text content.")
+    answer: str | None = Field(default=None, description="Answer content for QA mode.")
+    keywords: list[str] | None = Field(default=None, description="Keywords for the chunk.")
+    attachment_ids: list[str] | None = Field(default=None, description="Attachment file IDs.")
 
     @field_validator("content")
     @classmethod
@@ -61,31 +61,34 @@ class SegmentCreateItemPayload(BaseModel):
 
 
 class SegmentCreatePayload(BaseModel):
-    segments: list[SegmentCreateItemPayload] = Field(min_length=1)
+    segments: list[SegmentCreateItemPayload] = Field(min_length=1, description="Array of chunk objects to create.")
 
 
 class SegmentListQuery(BaseModel):
-    limit: int = Field(default=20, ge=1)
-    page: int = Field(default=1, ge=1)
-    status: list[str] = Field(default_factory=list)
-    keyword: str | None = None
+    limit: int = Field(default=20, ge=1, description="Number of items per page. Server caps at `100`.")
+    page: int = Field(default=1, ge=1, description="Page number to retrieve.")
+    status: list[str] = Field(
+        default_factory=list,
+        description="Filter chunks by indexing status, such as `completed`, `indexing`, or `error`.",
+    )
+    keyword: str | None = Field(default=None, description="Search keyword.")
 
 
 class SegmentUpdatePayload(BaseModel):
-    segment: SegmentUpdateArgs
+    segment: SegmentUpdateArgs = Field(description="Chunk update payload.")
 
 
 class ChildChunkListQuery(BaseModel):
-    limit: int = Field(default=20, ge=1)
-    keyword: str | None = None
-    page: int = Field(default=1, ge=1)
+    limit: int = Field(default=20, ge=1, description="Number of items per page. Server caps at `100`.")
+    keyword: str | None = Field(default=None, description="Search keyword.")
+    page: int = Field(default=1, ge=1, description="Page number to retrieve.")
 
 
 class SegmentDocParams:
-    DATASET_DOCUMENT = {"dataset_id": "Dataset ID", "document_id": "Document ID"}
-    DATASET_DOCUMENT_SEGMENT = {**DATASET_DOCUMENT, "segment_id": "Segment ID"}
-    DATASET_DOCUMENT_PARENT_SEGMENT = {**DATASET_DOCUMENT, "segment_id": "Parent segment ID"}
-    DATASET_DOCUMENT_CHILD_CHUNK = {**DATASET_DOCUMENT_PARENT_SEGMENT, "child_chunk_id": "Child chunk ID"}
+    DATASET_DOCUMENT = {"dataset_id": "Knowledge base ID.", "document_id": "Document ID."}
+    DATASET_DOCUMENT_SEGMENT = {**DATASET_DOCUMENT, "segment_id": "Chunk ID."}
+    DATASET_DOCUMENT_PARENT_SEGMENT = {**DATASET_DOCUMENT, "segment_id": "Chunk ID."}
+    DATASET_DOCUMENT_CHILD_CHUNK = {**DATASET_DOCUMENT_PARENT_SEGMENT, "child_chunk_id": "Child chunk ID."}
 
 
 class SegmentCreateListResponse(ResponseModel):
@@ -128,6 +131,18 @@ register_response_schema_models(
 class SegmentApi(DatasetApiResource):
     """Resource for segments."""
 
+    @service_api_ns.doc(
+        summary="Create Chunks",
+        description=(
+            "Create one or more chunks within a document. Each chunk can include optional keywords and an "
+            "answer field (for QA-mode documents)."
+        ),
+        tags=["Chunks"],
+        responses={
+            200: "Chunks created successfully.",
+            404: "`not_found` : Document is not completed or is disabled.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[SegmentCreatePayload.__name__])
     @service_api_ns.doc("create_segments")
     @service_api_ns.doc(description="Create segments in a document")
@@ -209,6 +224,14 @@ class SegmentApi(DatasetApiResource):
         }
         return dump_response(SegmentCreateListResponse, response), 200
 
+    @service_api_ns.doc(
+        summary="List Chunks",
+        description="Returns a paginated list of chunks within a document. Supports filtering by keyword and status.",
+        tags=["Chunks"],
+        responses={
+            200: "List of chunks.",
+        },
+    )
     @service_api_ns.doc("list_segments")
     @service_api_ns.doc(description="List segments in a document")
     @service_api_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT)
@@ -294,6 +317,14 @@ class SegmentApi(DatasetApiResource):
 
 @service_api_ns.route("/datasets/<uuid:dataset_id>/documents/<uuid:document_id>/segments/<uuid:segment_id>")
 class DatasetSegmentApi(DatasetApiResource):
+    @service_api_ns.doc(
+        summary="Delete Chunk",
+        description="Permanently delete a chunk from the document.",
+        tags=["Chunks"],
+        responses={
+            204: "Success.",
+        },
+    )
     @service_api_ns.doc("delete_segment")
     @service_api_ns.doc(description="Delete a specific segment")
     @service_api_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT_SEGMENT)
@@ -329,6 +360,14 @@ class DatasetSegmentApi(DatasetApiResource):
         SegmentService.delete_segment(segment, document, dataset)
         return "", 204
 
+    @service_api_ns.doc(
+        summary="Update Chunk",
+        description="Update a chunk's content, keywords, or answer. Re-triggers indexing for the modified chunk.",
+        tags=["Chunks"],
+        responses={
+            200: "Chunk updated successfully.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[SegmentUpdatePayload.__name__])
     @service_api_ns.doc("update_segment")
     @service_api_ns.doc(description="Update a specific segment")
@@ -391,6 +430,17 @@ class DatasetSegmentApi(DatasetApiResource):
         }
         return dump_response(SegmentDetailResponse, response), 200
 
+    @service_api_ns.doc(
+        summary="Get Chunk",
+        description=(
+            "Retrieve detailed information about a specific chunk, including its content, keywords, and "
+            "indexing status."
+        ),
+        tags=["Chunks"],
+        responses={
+            200: "Chunk details.",
+        },
+    )
     @service_api_ns.doc("get_segment")
     @service_api_ns.doc(description="Get a specific segment by ID")
     @service_api_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT_SEGMENT)
@@ -442,6 +492,15 @@ class DatasetSegmentApi(DatasetApiResource):
 class ChildChunkApi(DatasetApiResource):
     """Resource for child chunks."""
 
+    @service_api_ns.doc(
+        summary="Create Child Chunk",
+        description="Create a child chunk under the specified segment.",
+        tags=["Chunks"],
+        responses={
+            200: "Child chunk created successfully.",
+            400: "`invalid_param` : Create child chunk index failed.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[ChildChunkCreatePayload.__name__])
     @service_api_ns.doc("create_child_chunk")
     @service_api_ns.doc(description="Create a new child chunk for a segment")
@@ -511,6 +570,14 @@ class ChildChunkApi(DatasetApiResource):
 
         return dump_response(ChildChunkDetailResponse, {"data": child_chunk}), 200
 
+    @service_api_ns.doc(
+        summary="List Child Chunks",
+        description="Returns a paginated list of child chunks under a specific parent chunk.",
+        tags=["Chunks"],
+        responses={
+            200: "List of child chunks.",
+        },
+    )
     @service_api_ns.doc("list_child_chunks")
     @service_api_ns.doc(description="List child chunks for a segment")
     @service_api_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT_PARENT_SEGMENT)
@@ -576,6 +643,15 @@ class ChildChunkApi(DatasetApiResource):
 class DatasetChildChunkApi(DatasetApiResource):
     """Resource for updating child chunks."""
 
+    @service_api_ns.doc(
+        summary="Delete Child Chunk",
+        description="Permanently delete a child chunk from its parent chunk.",
+        tags=["Chunks"],
+        responses={
+            204: "Success.",
+            400: "`invalid_param` : Delete child chunk index failed.",
+        },
+    )
     @service_api_ns.doc("delete_child_chunk")
     @service_api_ns.doc(description="Delete a specific child chunk")
     @service_api_ns.doc(params=SegmentDocParams.DATASET_DOCUMENT_CHILD_CHUNK)
@@ -634,6 +710,15 @@ class DatasetChildChunkApi(DatasetApiResource):
 
         return "", 204
 
+    @service_api_ns.doc(
+        summary="Update Child Chunk",
+        description="Update the content of an existing child chunk.",
+        tags=["Chunks"],
+        responses={
+            200: "Child chunk updated successfully.",
+            400: "`invalid_param` : Update child chunk index failed.",
+        },
+    )
     @service_api_ns.expect(service_api_ns.models[ChildChunkUpdatePayload.__name__])
     @service_api_ns.doc("update_child_chunk")
     @service_api_ns.doc(description="Update a specific child chunk")
diff --git a/api/controllers/service_api/end_user/end_user.py b/api/controllers/service_api/end_user/end_user.py
index d2d018492a5..607ed12e5b6 100644
--- a/api/controllers/service_api/end_user/end_user.py
+++ b/api/controllers/service_api/end_user/end_user.py
@@ -17,6 +17,18 @@ register_response_schema_models(service_api_ns, EndUserDetail)
 class EndUserApi(Resource):
     """Resource for retrieving end user details by ID."""
 
+    @service_api_ns.doc(
+        summary="Get End User Info",
+        description=(
+            "Retrieve an end user by ID. Useful when other APIs return an end-user ID (e.g., "
+            "`created_by` from [Upload File](/api-reference/files/upload-file))."
+        ),
+        tags=["End Users"],
+        responses={
+            200: "End user retrieved successfully.",
+            404: "`end_user_not_found` : End user not found.",
+        },
+    )
     @service_api_ns.doc("get_end_user")
     @service_api_ns.doc(description="Get an end user by ID")
     @service_api_ns.doc(
diff --git a/api/controllers/service_api/schema.py b/api/controllers/service_api/schema.py
new file mode 100644
index 00000000000..87f8aa54287
--- /dev/null
+++ b/api/controllers/service_api/schema.py
@@ -0,0 +1,167 @@
+"""Service API OpenAPI documentation helpers.
+
+These helpers keep documentation-only request shapes next to controller
+definitions without changing the Pydantic models used for runtime validation.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from copy import deepcopy
+from typing import Annotated, Any, cast
+
+from flask_restx import Namespace
+from pydantic import BaseModel, WithJsonSchema
+
+USER_DESCRIPTION = (
+    "User identifier, unique within the application. This identifier scopes data access; resources created with "
+    "one `user` value are only visible when queried with the same `user` value."
+)
+USER_PROPERTY_SCHEMA: dict[str, object] = {"description": USER_DESCRIPTION, "type": "string"}
+USER_QUERY_PARAM: dict[str, object] = {
+    "description": "User identifier, used for end-user context.",
+    "in": "query",
+    "type": "string",
+}
+USER_FORM_PARAM: dict[str, object] = {
+    "description": USER_DESCRIPTION,
+    "in": "formData",
+    "type": "string",
+}
+FILE_FORM_PARAM: dict[str, object] = {
+    "description": "The file to upload.",
+    "in": "formData",
+    "required": True,
+    "type": "file",
+}
+USER_FETCH_FROM_ATTR = "_dify_service_api_user_fetch_from"
+USER_REQUIRED_ATTR = "_dify_service_api_user_required"
+JSON_USER_FETCH_FROM = "JSON"
+
+INPUT_FILE_ITEM_SCHEMA: dict[str, object] = {
+    "type": "object",
+    "required": ["type", "transfer_method"],
+    "properties": {
+        "type": {
+            "description": "File type.",
+            "enum": ["document", "image", "audio", "video", "custom"],
+            "type": "string",
+        },
+        "transfer_method": {
+            "description": "Transfer method: `remote_url` for file URL, `local_file` for uploaded file.",
+            "enum": ["remote_url", "local_file"],
+            "type": "string",
+        },
+        "url": {
+            "description": "File URL when `transfer_method` is `remote_url`.",
+            "format": "url",
+            "type": "string",
+        },
+        "upload_file_id": {
+            "description": (
+                "Uploaded file ID obtained from the [Upload File](/api-reference/files/upload-file) API when "
+                "`transfer_method` is `local_file`."
+            ),
+            "type": "string",
+        },
+    },
+}
+INPUT_FILE_LIST_SCHEMA: dict[str, object] = {
+    "anyOf": [{"items": INPUT_FILE_ITEM_SCHEMA, "type": "array"}, {"type": "null"}]
+}
+InputFileList = Annotated[list[dict[str, Any]] | None, WithJsonSchema(INPUT_FILE_LIST_SCHEMA)]
+
+
+def expect_with_user(namespace: Namespace, model: type[BaseModel]):
+    """Document a JSON request body as ``model`` plus Service API ``user``."""
+
+    source_model = namespace.models[model.__name__]
+    model_name = f"{model.__name__}WithUser"
+
+    def decorator(view_func):
+        required = _json_user_required(view_func)
+        schema = cast(dict[str, object], deepcopy(source_model.__schema__))
+        _add_user_property(schema, required=required)
+        if model_name not in namespace.models:
+            namespace.schema_model(model_name, schema)
+        return namespace.expect(namespace.models[model_name], validate=False)(view_func)
+
+    return decorator
+
+
+def expect_user_json(namespace: Namespace):
+    """Document a JSON request body that only carries the Service API ``user``."""
+
+    def decorator(view_func):
+        required = _json_user_required(view_func)
+        schema: dict[str, object] = {"properties": {}, "title": "ServiceApiUserPayload", "type": "object"}
+        _add_user_property(schema, required=required)
+        model_name = "RequiredServiceApiUserPayload" if required else "OptionalServiceApiUserPayload"
+        if model_name not in namespace.models:
+            namespace.schema_model(model_name, schema)
+        return namespace.expect(namespace.models[model_name], validate=False)(view_func)
+
+    return decorator
+
+
+def multipart_file_params(*, include_user: bool, file_description: str | None = None) -> dict[str, dict[str, object]]:
+    file_param = deepcopy(FILE_FORM_PARAM)
+    if file_description is not None:
+        file_param["description"] = file_description
+
+    params: dict[str, dict[str, object]] = {"file": file_param}
+    if include_user:
+        params["user"] = USER_FORM_PARAM
+    return deepcopy(params)
+
+
+def json_or_event_stream_response(namespace: Namespace):
+    return namespace.doc(produces=["application/json", "text/event-stream"])
+
+
+def event_stream_response(namespace: Namespace):
+    return namespace.doc(produces=["text/event-stream"])
+
+
+def binary_response(namespace: Namespace, media_type: str | Sequence[str]):
+    media_types = [media_type] if isinstance(media_type, str) else list(media_type)
+    return namespace.doc(produces=media_types)
+
+
+def _json_user_required(view_func) -> bool:
+    fetch_from = getattr(view_func, USER_FETCH_FROM_ATTR, None)
+    if fetch_from != JSON_USER_FETCH_FROM:
+        raise ValueError("JSON user documentation must match validate_app_token(fetch_user_arg=WhereisUserArg.JSON)")
+
+    return bool(getattr(view_func, USER_REQUIRED_ATTR, False))
+
+
+def _add_user_property(schema: dict[str, object], *, required: bool) -> None:
+    variants: list[dict[str, object]] = []
+    for keyword in ("anyOf", "oneOf"):
+        candidates = schema.get(keyword)
+        if isinstance(candidates, list):
+            variants.extend(candidate for candidate in candidates if isinstance(candidate, dict))
+
+    if variants:
+        for variant in variants:
+            _add_user_property_to_object_schema(variant, required=required)
+
+    _add_user_property_to_object_schema(schema, required=required)
+
+
+def _add_user_property_to_object_schema(schema: dict[str, object], *, required: bool) -> None:
+    properties = schema.setdefault("properties", {})
+    if isinstance(properties, dict):
+        cast(dict[str, object], properties)["user"] = USER_PROPERTY_SCHEMA
+
+    if required:
+        required_fields = schema.setdefault("required", [])
+        if isinstance(required_fields, list) and "user" not in required_fields:
+            required_fields.append("user")
+    else:
+        required_fields = schema.get("required")
+        if isinstance(required_fields, list) and "user" in required_fields:
+            required_fields.remove("user")
+        if required_fields == []:
+            schema.pop("required", None)
diff --git a/api/controllers/service_api/workspace/models.py b/api/controllers/service_api/workspace/models.py
index 63806ab252f..c2ea1a72cf5 100644
--- a/api/controllers/service_api/workspace/models.py
+++ b/api/controllers/service_api/workspace/models.py
@@ -9,6 +9,12 @@ from graphon.model_runtime.utils.encoders import jsonable_encoder
 from services.entities.model_provider_entities import ProviderWithModelsResponse
 from services.model_provider_service import ModelProviderService
 
+MODEL_TYPE_PARAM = {
+    "description": "Type of model to retrieve.",
+    "enum": ["text-embedding", "rerank", "llm", "tts", "speech2text", "moderation"],
+    "type": "string",
+}
+
 
 class ProviderWithModelsListResponse(ResponseModel):
     data: list[ProviderWithModelsResponse]
@@ -19,9 +25,20 @@ register_response_schema_models(service_api_ns, ProviderWithModelsListResponse)
 
 @service_api_ns.route("/workspaces/current/models/model-types/<string:model_type>")
 class ModelProviderAvailableModelApi(Resource):
+    @service_api_ns.doc(
+        summary="Get Available Models",
+        description=(
+            "Retrieve the list of available models by type. Primarily used to query `text-embedding` and "
+            "`rerank` models for knowledge base configuration."
+        ),
+        tags=["Models"],
+        responses={
+            200: "Available models for the specified type.",
+        },
+    )
     @service_api_ns.doc("get_available_models")
     @service_api_ns.doc(description="Get available models by model type")
-    @service_api_ns.doc(params={"model_type": "Type of model to retrieve"})
+    @service_api_ns.doc(params={"model_type": MODEL_TYPE_PARAM})
     @service_api_ns.doc(
         responses={
             200: "Models retrieved successfully",
diff --git a/api/controllers/service_api/wraps.py b/api/controllers/service_api/wraps.py
index 013ea34a6ab..32e95b481f8 100644
--- a/api/controllers/service_api/wraps.py
+++ b/api/controllers/service_api/wraps.py
@@ -4,16 +4,23 @@ import time
 from collections.abc import Callable
 from enum import StrEnum, auto
 from functools import wraps
-from typing import cast, overload
+from typing import Protocol, cast, overload
 
 from flask import current_app, request
 from flask_login import user_logged_in
 from flask_restx import Resource
+from flask_restx.utils import merge
 from pydantic import BaseModel
 from sqlalchemy import select
 from werkzeug.exceptions import Forbidden, NotFound, Unauthorized
 
 from configs import dify_config
+from controllers.service_api.schema import (
+    USER_FETCH_FROM_ATTR,
+    USER_FORM_PARAM,
+    USER_QUERY_PARAM,
+    USER_REQUIRED_ATTR,
+)
 from enums.cloud_plan import CloudPlan
 from extensions.ext_database import db
 from extensions.ext_redis import redis_client
@@ -28,6 +35,12 @@ from services.feature_service import FeatureService
 logger = logging.getLogger(__name__)
 
 
+class _RestxDocumentedView(Protocol):
+    """Callable view object carrying Flask-RESTX documentation metadata."""
+
+    __apidoc__: dict[str, object]
+
+
 class WhereisUserArg(StrEnum):
     """
     Enum for whereis_user_arg.
@@ -43,6 +56,35 @@ class FetchUserArg(BaseModel):
     required: bool = False
 
 
+APP_TOKEN_FORBIDDEN_RESPONSE = {
+    403: "Forbidden - token scope, app, dataset, or workspace access denied",
+}
+
+DATASET_TOKEN_AUTH_RESPONSES = {
+    401: "Unauthorized - invalid API token",
+    403: "Forbidden - dataset API access or workspace access denied",
+}
+
+
+def _document_app_token_contract(view_func: Callable[..., object], fetch_user_arg: FetchUserArg | None) -> None:
+    doc: dict[str, object] = {"responses": APP_TOKEN_FORBIDDEN_RESPONSE}
+    if fetch_user_arg is not None:
+        setattr(view_func, USER_FETCH_FROM_ATTR, fetch_user_arg.fetch_from.name)
+        setattr(view_func, USER_REQUIRED_ATTR, fetch_user_arg.required)
+        match fetch_user_arg.fetch_from:
+            case WhereisUserArg.QUERY:
+                doc["params"] = {"user": {**USER_QUERY_PARAM, "required": fetch_user_arg.required}}
+            case WhereisUserArg.FORM:
+                doc["params"] = {"user": {**USER_FORM_PARAM, "required": fetch_user_arg.required}}
+            case WhereisUserArg.JSON:
+                pass
+
+    cast(_RestxDocumentedView, view_func).__apidoc__ = cast(
+        dict[str, object],
+        merge(getattr(view_func, "__apidoc__", {}), doc),
+    )
+
+
 @overload
 def validate_app_token[**P, R](view: Callable[P, R]) -> Callable[P, R]: ...
 
@@ -126,6 +168,7 @@ def validate_app_token[**P, R](
 
             return view_func(*args, **kwargs)
 
+        _document_app_token_contract(decorated_view, fetch_user_arg)
         return decorated_view
 
     if view is None:
@@ -343,6 +386,8 @@ def validate_and_get_api_token(scope: str | None = None):
 
 
 class DatasetApiResource(Resource):
+    __apidoc__ = {"responses": DATASET_TOKEN_AUTH_RESPONSES}
+
     method_decorators = [validate_dataset_token]
 
     def get_dataset(self, dataset_id: str, tenant_id: str) -> Dataset:
diff --git a/api/controllers/web/passport.py b/api/controllers/web/passport.py
index 00439ffca4e..99b75776280 100644
--- a/api/controllers/web/passport.py
+++ b/api/controllers/web/passport.py
@@ -17,6 +17,7 @@ from controllers.web.error import WebAppAuthRequiredError
 from extensions.ext_database import db
 from libs.passport import PassportService
 from libs.token import extract_webapp_access_token
+from models.enums import EndUserType
 from models.model import App, EndUser, Site
 from services.feature_service import FeatureService
 from services.webapp_auth_service import WebAppAuthService, WebAppAuthType
@@ -82,7 +83,7 @@ class PassportResource(Resource):
                 end_user = EndUser(
                     tenant_id=app_model.tenant_id,
                     app_id=app_model.id,
-                    type="browser",
+                    type=EndUserType.BROWSER,
                     is_anonymous=True,
                     session_id=user_id,
                 )
@@ -92,7 +93,7 @@ class PassportResource(Resource):
             end_user = EndUser(
                 tenant_id=app_model.tenant_id,
                 app_id=app_model.id,
-                type="browser",
+                type=EndUserType.BROWSER,
                 is_anonymous=True,
                 session_id=generate_session_id(),
             )
@@ -181,7 +182,7 @@ def exchange_token_for_existing_web_user(
         end_user = EndUser(
             tenant_id=app_model.tenant_id,
             app_id=app_model.id,
-            type="browser",
+            type=EndUserType.BROWSER,
             is_anonymous=True,
             session_id=session_id,
         )
@@ -225,7 +226,7 @@ def _exchange_for_public_app_token(app_model, site, token_decoded):
         end_user = EndUser(
             tenant_id=app_model.tenant_id,
             app_id=app_model.id,
-            type="browser",
+            type=EndUserType.BROWSER,
             is_anonymous=True,
             session_id=generate_session_id(),
         )
diff --git a/api/controllers/web/saved_message.py b/api/controllers/web/saved_message.py
index e3baa028e50..6e59a85e2b0 100644
--- a/api/controllers/web/saved_message.py
+++ b/api/controllers/web/saved_message.py
@@ -9,6 +9,7 @@ from controllers.common.schema import query_params_from_model, register_response
 from controllers.web import web_ns
 from controllers.web.error import NotCompletionAppError
 from controllers.web.wraps import WebApiResource
+from extensions.ext_database import db
 from fields.conversation_fields import ResultResponse
 from fields.message_fields import SavedMessageInfiniteScrollPagination, SavedMessageItem
 from models.model import App, EndUser
@@ -42,7 +43,9 @@ class SavedMessageListApi(WebApiResource):
         raw_args = request.args.to_dict()
         query = SavedMessageListQuery.model_validate(raw_args)
 
-        pagination = SavedMessageService.pagination_by_last_id(app_model, end_user, query.last_id, query.limit)
+        pagination = SavedMessageService.pagination_by_last_id(
+            db.session(), app_model, end_user, query.last_id, query.limit
+        )
         adapter = TypeAdapter(SavedMessageItem)
         items = [adapter.validate_python(message, from_attributes=True) for message in pagination.data]
         return SavedMessageInfiniteScrollPagination(
@@ -77,7 +80,7 @@ class SavedMessageListApi(WebApiResource):
         payload = SavedMessageCreatePayload.model_validate(web_ns.payload or {})
 
         try:
-            SavedMessageService.save(app_model, end_user, payload.message_id)
+            SavedMessageService.save(db.session(), app_model, end_user, payload.message_id)
         except MessageNotExistsError:
             raise NotFound("Message Not Exists.")
 
@@ -105,6 +108,6 @@ class SavedMessageApi(WebApiResource):
         if app_model.mode != "completion":
             raise NotCompletionAppError()
 
-        SavedMessageService.delete(app_model, end_user, message_id_str)
+        SavedMessageService.delete(db.session(), app_model, end_user, message_id_str)
 
         return "", 204
diff --git a/api/core/agent/base_agent_runner.py b/api/core/agent/base_agent_runner.py
index 694d6331483..55a31563d69 100644
--- a/api/core/agent/base_agent_runner.py
+++ b/api/core/agent/base_agent_runner.py
@@ -118,7 +118,7 @@ class BaseAgentRunner(AppRunner):
         features = model_schema.features if model_schema and model_schema.features else []
         self.stream_tool_call = ModelFeature.STREAM_TOOL_CALL in features
         self.files = application_generate_entity.files if ModelFeature.VISION in features else []
-        self.query: str | None = ""
+        self.query: str = ""
         self._current_thoughts: list[PromptMessage] = []
 
     def _repack_app_generate_entity(
diff --git a/api/core/app/app_config/easy_ui_based_app/dataset/manager.py b/api/core/app/app_config/easy_ui_based_app/dataset/manager.py
index 3d857a4e9c0..be538455afb 100644
--- a/api/core/app/app_config/easy_ui_based_app/dataset/manager.py
+++ b/api/core/app/app_config/easy_ui_based_app/dataset/manager.py
@@ -213,6 +213,11 @@ class DatasetConfigManager:
             PlanningStrategy.REACT_ROUTER,
         }:
             for tool in config.get("agent_mode", {}).get("tools", []):
+                if not tool:
+                    # Skip malformed empty tool entries; list(tool.keys())[0]
+                    # would otherwise raise IndexError. The sibling convert()
+                    # already guards this with `if len(tool) == 1`.
+                    continue
                 key = list(tool.keys())[0]
                 if key == "dataset":
                     # old style, use tool name as key
diff --git a/api/core/app/apps/agent_app/app_generator.py b/api/core/app/apps/agent_app/app_generator.py
index 92c75276e02..f816b1fa477 100644
--- a/api/core/app/apps/agent_app/app_generator.py
+++ b/api/core/app/apps/agent_app/app_generator.py
@@ -72,8 +72,12 @@ class AgentAppGenerator(MessageBasedAppGenerator):
         query = query.replace("\x00", "")
         inputs = args["inputs"]
 
-        # Resolve the bound roster Agent + its published Agent Soul snapshot.
+        # Resolve the bound roster Agent + its current Agent Soul snapshot.
         agent, snapshot, agent_soul = self._resolve_agent(app_model)
+        runtime_session_snapshot_id = self._runtime_session_snapshot_id(
+            invoke_from=invoke_from,
+            snapshot_id=snapshot.id,
+        )
 
         conversation = None
         conversation_id = args.get("conversation_id")
@@ -120,6 +124,7 @@ class AgentAppGenerator(MessageBasedAppGenerator):
             trace_manager=trace_manager,
             agent_id=agent.id,
             agent_config_snapshot_id=snapshot.id,
+            agent_runtime_session_snapshot_id=runtime_session_snapshot_id,
         )
 
         conversation, message = self._init_generate_records(application_generate_entity, conversation)
@@ -341,6 +346,7 @@ class AgentAppGenerator(MessageBasedAppGenerator):
                     message_id=message.id,
                     model_name=application_generate_entity.model_conf.model,
                     queue_manager=queue_manager,
+                    session_scope_snapshot_id=application_generate_entity.agent_runtime_session_snapshot_id,
                 )
             except GenerateTaskStoppedError:
                 pass
@@ -373,7 +379,7 @@ class AgentAppGenerator(MessageBasedAppGenerator):
 
         app_config = application_generate_entity.app_config
         model_name = application_generate_entity.model_conf.model
-        query = application_generate_entity.query
+        query = application_generate_entity.query or ""
 
         # content moderation (sensitive_word_avoidance); a blocked input yields a
         # preset answer, an "overridden" action returns a sanitized query.
@@ -388,7 +394,7 @@ class AgentAppGenerator(MessageBasedAppGenerator):
                 trace_manager=application_generate_entity.trace_manager,
             )
         except ModerationError as e:
-            publish_text_answer(queue_manager=queue_manager, model_name=model_name, answer=str(e))
+            publish_text_answer(queue_manager=queue_manager, model_name=model_name, answer=str(e), user_query=query)
             return True, query
 
         # annotation reply: a matching annotation answers the turn deterministically.
@@ -405,7 +411,12 @@ class AgentAppGenerator(MessageBasedAppGenerator):
                     QueueAnnotationReplyEvent(message_annotation_id=annotation_reply.id),
                     PublishFrom.APPLICATION_MANAGER,
                 )
-                publish_text_answer(queue_manager=queue_manager, model_name=model_name, answer=annotation_reply.content)
+                publish_text_answer(
+                    queue_manager=queue_manager,
+                    model_name=model_name,
+                    answer=annotation_reply.content,
+                    user_query=query,
+                )
                 return True, query
 
         return False, query
@@ -425,6 +436,21 @@ class AgentAppGenerator(MessageBasedAppGenerator):
             tenant_id=app_model.tenant_id, agent_id=agent.id, snapshot_id=agent.active_config_snapshot_id
         )
 
+    @staticmethod
+    def _runtime_session_snapshot_id(*, invoke_from: InvokeFrom, snapshot_id: str) -> str | None:
+        """Return the session scope snapshot id for Agent App runtime state.
+
+        Console preview/debug chat is an editing workspace: saving Agent Soul
+        creates replacement snapshots, but the user expects the same preview
+        conversation to keep context while trying prompt changes. Use a stable
+        NULL snapshot scope for debugger runs so each turn can use the latest
+        Agent Soul while reusing the conversation history. Published/web/API
+        runs keep snapshot-scoped sessions for reproducible runtime state.
+        """
+        if invoke_from == InvokeFrom.DEBUGGER:
+            return None
+        return snapshot_id
+
     @staticmethod
     def _resolve_agent_by_id(
         *, tenant_id: str, agent_id: str, snapshot_id: str | None
diff --git a/api/core/app/apps/agent_app/app_runner.py b/api/core/app/apps/agent_app/app_runner.py
index d4d2a754bfa..b482afcdf43 100644
--- a/api/core/app/apps/agent_app/app_runner.py
+++ b/api/core/app/apps/agent_app/app_runner.py
@@ -46,13 +46,32 @@ from core.repositories.human_input_repository import HumanInputFormRepository, H
 from core.workflow.nodes.agent_v2.ask_human_hitl import AskHumanFormBuildError, create_ask_human_form
 from core.workflow.nodes.agent_v2.ask_human_resume import build_deferred_tool_results, resolve_ask_human_form
 from graphon.model_runtime.entities.llm_entities import LLMResult, LLMResultChunk, LLMResultChunkDelta, LLMUsage
-from graphon.model_runtime.entities.message_entities import AssistantPromptMessage
+from graphon.model_runtime.entities.message_entities import AssistantPromptMessage, PromptMessage, UserPromptMessage
 from models.agent_config_entities import AgentSoulConfig
 
 logger = logging.getLogger(__name__)
 
 
-def publish_text_answer(*, queue_manager: AppQueueManager, model_name: str, answer: str) -> None:
+class _DefaultSessionScopeSnapshotId:
+    pass
+
+
+_DEFAULT_SESSION_SCOPE_SNAPSHOT_ID = _DefaultSessionScopeSnapshotId()
+
+
+def _prompt_messages_from_query(user_query: str | None) -> list[PromptMessage]:
+    if not user_query:
+        return []
+    return [UserPromptMessage(content=user_query)]
+
+
+def publish_text_answer(
+    *,
+    queue_manager: AppQueueManager,
+    model_name: str,
+    answer: str,
+    user_query: str | None = None,
+) -> None:
     """Publish a complete assistant answer as one chunk + message-end.
 
     The EasyUI chat task pipeline consumes a QueueLLMChunkEvent stream followed
@@ -60,17 +79,53 @@ def publish_text_answer(*, queue_manager: AppQueueManager, model_name: str, answ
     both the backend-produced answer and short-circuited answers (moderation /
     annotation reply) share the exact same persistence + SSE path.
     """
+    publish_text_delta(
+        queue_manager=queue_manager,
+        model_name=model_name,
+        delta=answer,
+        user_query=user_query,
+    )
+    publish_message_end(
+        queue_manager=queue_manager,
+        model_name=model_name,
+        answer=answer,
+        user_query=user_query,
+    )
+
+
+def publish_text_delta(
+    *,
+    queue_manager: AppQueueManager,
+    model_name: str,
+    delta: str,
+    user_query: str | None = None,
+) -> None:
+    """Publish one assistant text delta through the EasyUI chat pipeline."""
+    if not delta:
+        return
+    prompt_messages = _prompt_messages_from_query(user_query)
     chunk = LLMResultChunk(
         model=model_name,
-        prompt_messages=[],
-        delta=LLMResultChunkDelta(index=0, message=AssistantPromptMessage(content=answer)),
+        prompt_messages=prompt_messages,
+        delta=LLMResultChunkDelta(index=0, message=AssistantPromptMessage(content=delta)),
     )
     queue_manager.publish(QueueLLMChunkEvent(chunk=chunk), PublishFrom.APPLICATION_MANAGER)
+
+
+def publish_message_end(
+    *,
+    queue_manager: AppQueueManager,
+    model_name: str,
+    answer: str,
+    user_query: str | None = None,
+) -> None:
+    """Publish the terminal assistant result without emitting another delta."""
+    prompt_messages = _prompt_messages_from_query(user_query)
     queue_manager.publish(
         QueueMessageEndEvent(
             llm_result=LLMResult(
                 model=model_name,
-                prompt_messages=[],
+                prompt_messages=prompt_messages,
                 message=AssistantPromptMessage(content=answer),
                 usage=LLMUsage.empty_usage(),
             ),
@@ -107,13 +162,18 @@ class AgentAppRunner:
         message_id: str,
         model_name: str,
         queue_manager: AppQueueManager,
+        session_scope_snapshot_id: str | None | _DefaultSessionScopeSnapshotId = _DEFAULT_SESSION_SCOPE_SNAPSHOT_ID,
     ) -> None:
+        if isinstance(session_scope_snapshot_id, _DefaultSessionScopeSnapshotId):
+            effective_session_scope_snapshot_id: str | None = agent_config_snapshot_id
+        else:
+            effective_session_scope_snapshot_id = session_scope_snapshot_id
         scope = AgentAppSessionScope(
             tenant_id=dify_context.tenant_id,
             app_id=dify_context.app_id,
             conversation_id=conversation_id,
             agent_id=agent_id,
-            agent_config_snapshot_id=agent_config_snapshot_id,
+            agent_config_snapshot_id=effective_session_scope_snapshot_id,
         )
         # ENG-638: if a prior turn paused on ask_human and the form is now answered,
         # resume by threading the human's reply into this run as deferred_tool_results.
@@ -138,7 +198,12 @@ class AgentAppRunner:
         )
 
         create_response = self._agent_backend_client.create_run(runtime.request)
-        terminal = self._consume_stream(create_response.run_id, queue_manager=queue_manager)
+        terminal, streamed_answer = self._consume_stream(
+            create_response.run_id,
+            queue_manager=queue_manager,
+            model_name=model_name,
+            query=query,
+        )
 
         if isinstance(terminal, AgentBackendDeferredToolCallInternalEvent):
             # ENG-635: the agent asked a human. End this turn with the question and
@@ -153,6 +218,7 @@ class AgentAppRunner:
                 model_name=model_name,
                 runtime=runtime,
                 queue_manager=queue_manager,
+                query=query,
             )
             return
 
@@ -161,7 +227,13 @@ class AgentAppRunner:
             raise AgentBackendError(str(error))
 
         answer = self._extract_answer(terminal.output)
-        self._publish_answer(queue_manager=queue_manager, model_name=model_name, answer=answer)
+        self._publish_terminal_answer(
+            queue_manager=queue_manager,
+            model_name=model_name,
+            answer=answer,
+            query=query,
+            streamed_answer=streamed_answer,
+        )
         self._save_session(
             scope=scope,
             backend_run_id=terminal.run_id,
@@ -181,6 +253,7 @@ class AgentAppRunner:
         model_name: str,
         runtime: AgentAppRuntimeRequest,
         queue_manager: AppQueueManager,
+        query: str,
     ) -> None:
         """End the chat turn on a dify.ask_human call: create a conversation-owned
         HITL form, persist the pause correlation, and surface the question."""
@@ -214,6 +287,7 @@ class AgentAppRunner:
             queue_manager=queue_manager,
             model_name=model_name,
             answer=self._ask_human_message(created.args),
+            query=query,
         )
 
     def _resolve_pending_ask_human(
@@ -256,8 +330,16 @@ class AgentAppRunner:
             parts.append(args.markdown)
         return "\n\n".join(parts)
 
-    def _consume_stream(self, run_id: str, *, queue_manager: AppQueueManager):
+    def _consume_stream(
+        self,
+        run_id: str,
+        *,
+        queue_manager: AppQueueManager,
+        model_name: str,
+        query: str | None,
+    ):
         terminal = None
+        streamed_answer_parts: list[str] = []
         for public_event in self._agent_backend_client.stream_events(run_id):
             if queue_manager.is_stopped():
                 self._cancel_run(run_id)
@@ -270,16 +352,23 @@ class AgentAppRunner:
                     AgentBackendInternalEventType.RUN_STARTED,
                     AgentBackendInternalEventType.STREAM_EVENT,
                 ):
-                    # Stream deltas are accumulated by the backend into the
-                    # terminal output; token-level forwarding is an S3 refinement.
                     if isinstance(internal_event, AgentBackendStreamInternalEvent):
+                        text_delta = self._extract_stream_text_delta(internal_event)
+                        if text_delta:
+                            streamed_answer_parts.append(text_delta)
+                            publish_text_delta(
+                                queue_manager=queue_manager,
+                                model_name=model_name,
+                                delta=text_delta,
+                                user_query=query,
+                            )
                         continue
                     continue
                 terminal = internal_event
                 break
             if terminal is not None:
                 break
-        return terminal
+        return terminal, "".join(streamed_answer_parts)
 
     def _cancel_run(self, run_id: str) -> None:
         try:
@@ -287,10 +376,41 @@ class AgentAppRunner:
         except Exception:
             logger.warning("Failed to cancel stopped Agent App backend run: run_id=%s", run_id, exc_info=True)
 
-    def _publish_answer(self, *, queue_manager: AppQueueManager, model_name: str, answer: str) -> None:
+    def _publish_answer(
+        self, *, queue_manager: AppQueueManager, model_name: str, answer: str, query: str | None
+    ) -> None:
         # MVP: emit the full answer as a single chunk + message-end. The chat
         # task pipeline streams the chunk over SSE and persists the message.
-        publish_text_answer(queue_manager=queue_manager, model_name=model_name, answer=answer)
+        publish_text_answer(queue_manager=queue_manager, model_name=model_name, answer=answer, user_query=query)
+
+    def _publish_terminal_answer(
+        self,
+        *,
+        queue_manager: AppQueueManager,
+        model_name: str,
+        answer: str,
+        query: str | None,
+        streamed_answer: str,
+    ) -> None:
+        """Finish a successful streamed turn without duplicating the final text."""
+        if not streamed_answer:
+            self._publish_answer(queue_manager=queue_manager, model_name=model_name, answer=answer, query=query)
+            return
+
+        if answer.startswith(streamed_answer):
+            publish_text_delta(
+                queue_manager=queue_manager,
+                model_name=model_name,
+                delta=answer[len(streamed_answer) :],
+                user_query=query,
+            )
+        elif answer != streamed_answer:
+            logger.warning(
+                "Agent App streamed answer does not match terminal output; "
+                "using terminal output for message persistence."
+            )
+
+        publish_message_end(queue_manager=queue_manager, model_name=model_name, answer=answer, user_query=query)
 
     def _save_session(
         self,
@@ -339,5 +459,27 @@ class AgentAppRunner:
             return json.dumps(output, ensure_ascii=False)
         return json.dumps(output, ensure_ascii=False)
 
+    @staticmethod
+    def _extract_stream_text_delta(event: AgentBackendStreamInternalEvent) -> str | None:
+        data = event.data
+        if not isinstance(data, dict):
+            return None
 
-__all__ = ["AgentAppRunner", "publish_text_answer"]
+        if data.get("event_kind") == "part_delta":
+            delta = data.get("delta")
+            if isinstance(delta, dict) and delta.get("part_delta_kind") == "text":
+                content_delta = delta.get("content_delta")
+                if isinstance(content_delta, str):
+                    return content_delta
+
+        if data.get("event_kind") == "part_start":
+            part = data.get("part")
+            if isinstance(part, dict) and part.get("part_kind") == "text":
+                content = part.get("content")
+                if isinstance(content, str):
+                    return content
+
+        return None
+
+
+__all__ = ["AgentAppRunner", "publish_message_end", "publish_text_answer", "publish_text_delta"]
diff --git a/api/core/app/apps/agent_app/runtime_request_builder.py b/api/core/app/apps/agent_app/runtime_request_builder.py
index 71cc0385f97..01206b12db6 100644
--- a/api/core/app/apps/agent_app/runtime_request_builder.py
+++ b/api/core/app/apps/agent_app/runtime_request_builder.py
@@ -2,8 +2,10 @@
 
 Mirrors the workflow ``WorkflowAgentRuntimeRequestBuilder`` but for the Agent
 App surface: the user prompt is the chat message (no workflow-node job / no
-previous-node context), and multi-turn continuity flows through the
-conversation-keyed ``session_snapshot`` plus the history layer.
+previous-node context), multi-turn continuity flows through the
+conversation-keyed ``session_snapshot`` plus the history layer, and Agent Soul
+knowledge config is mapped into the same fixed ``dify.knowledge_base`` layer
+used by workflow runs.
 """
 
 from __future__ import annotations
@@ -36,6 +38,7 @@ from core.workflow.nodes.agent_v2.runtime_request_builder import (
     append_runtime_warnings,
     build_ask_human_layer_config,
     build_drive_layer_config,
+    build_knowledge_layer_config,
     build_shell_layer_config,
 )
 from models.agent_config_entities import AgentSoulConfig
@@ -123,6 +126,7 @@ class AgentAppRuntimeRequestBuilder:
         if dify_config.AGENT_DRIVE_MANIFEST_ENABLED:
             drive_config, drive_warnings = build_drive_layer_config(agent_soul, agent_id=context.agent_id)
             append_runtime_warnings(metadata, drive_warnings)
+        knowledge_config = build_knowledge_layer_config(agent_soul)
 
         request = self._request_builder.build_for_agent_app(
             AgentBackendAgentAppRunInput(
@@ -156,6 +160,7 @@ class AgentAppRuntimeRequestBuilder:
                 or None,
                 user_prompt=context.user_query,
                 tools=tools_layer,
+                knowledge=knowledge_config,
                 drive_config=drive_config,
                 ask_human_config=build_ask_human_layer_config(agent_soul),
                 include_shell=dify_config.AGENT_SHELL_ENABLED,
diff --git a/api/core/app/apps/agent_app/session_store.py b/api/core/app/apps/agent_app/session_store.py
index 8c68e218d1f..35213114e2f 100644
--- a/api/core/app/apps/agent_app/session_store.py
+++ b/api/core/app/apps/agent_app/session_store.py
@@ -45,7 +45,7 @@ class AgentAppSessionScope:
     app_id: str
     conversation_id: str
     agent_id: str
-    agent_config_snapshot_id: str
+    agent_config_snapshot_id: str | None
 
 
 @dataclass(frozen=True, slots=True)
@@ -194,13 +194,15 @@ class AgentAppRuntimeSessionStore:
 
     @staticmethod
     def _scope_stmt(scope: AgentAppSessionScope):
-        return select(AgentRuntimeSession).where(
+        stmt = select(AgentRuntimeSession).where(
             AgentRuntimeSession.owner_type == AgentRuntimeSessionOwnerType.CONVERSATION,
             AgentRuntimeSession.tenant_id == scope.tenant_id,
             AgentRuntimeSession.conversation_id == scope.conversation_id,
             AgentRuntimeSession.agent_id == scope.agent_id,
-            AgentRuntimeSession.agent_config_snapshot_id == scope.agent_config_snapshot_id,
         )
+        if scope.agent_config_snapshot_id is None:
+            return stmt.where(AgentRuntimeSession.agent_config_snapshot_id.is_(None))
+        return stmt.where(AgentRuntimeSession.agent_config_snapshot_id == scope.agent_config_snapshot_id)
 
     @classmethod
     def _active_stmt(cls, scope: AgentAppSessionScope):
diff --git a/api/core/app/apps/base_app_runner.py b/api/core/app/apps/base_app_runner.py
index a89a0cf70db..7b854fec34a 100644
--- a/api/core/app/apps/base_app_runner.py
+++ b/api/core/app/apps/base_app_runner.py
@@ -231,22 +231,23 @@ class AppRunner:
         :param tenant_id: tenant id for multimodal output
         :return:
         """
-        if not stream and isinstance(invoke_result, LLMResult):
-            self._handle_invoke_result_direct(
-                invoke_result=invoke_result,
-                queue_manager=queue_manager,
-            )
-        elif stream and isinstance(invoke_result, Generator):
-            self._handle_invoke_result_stream(
-                invoke_result=invoke_result,
-                queue_manager=queue_manager,
-                agent=agent,
-                message_id=message_id,
-                user_id=user_id,
-                tenant_id=tenant_id,
-            )
-        else:
-            raise NotImplementedError(f"unsupported invoke result type: {type(invoke_result)}")
+        match invoke_result:
+            case LLMResult() if not stream:
+                self._handle_invoke_result_direct(
+                    invoke_result=invoke_result,
+                    queue_manager=queue_manager,
+                )
+            case _ if stream and isinstance(invoke_result, Generator):
+                self._handle_invoke_result_stream(
+                    invoke_result=invoke_result,
+                    queue_manager=queue_manager,
+                    agent=agent,
+                    message_id=message_id,
+                    user_id=user_id,
+                    tenant_id=tenant_id,
+                )
+            case _:
+                raise NotImplementedError(f"unsupported invoke result type: {type(invoke_result)}")
 
     def _handle_invoke_result_direct(
         self,
diff --git a/api/core/app/apps/common/workflow_response_converter.py b/api/core/app/apps/common/workflow_response_converter.py
index 93493a4ad8d..67f37e78ab9 100644
--- a/api/core/app/apps/common/workflow_response_converter.py
+++ b/api/core/app/apps/common/workflow_response_converter.py
@@ -888,7 +888,7 @@ class WorkflowResponseConverter:
         return files
 
     @classmethod
-    def _get_file_var_from_value(cls, value: Union[dict, list]) -> Mapping[str, Any] | None:
+    def _get_file_var_from_value(cls, value: object) -> Mapping[str, Any] | None:
         """
         Get file var from value
         :param value: variable value
@@ -897,10 +897,11 @@ class WorkflowResponseConverter:
         if not value:
             return None
 
-        if isinstance(value, dict) and value.get("dify_model_identity") == FILE_MODEL_IDENTITY:
-            return value
-        elif isinstance(value, File):
-            return value.to_dict()
+        match value:
+            case dict() if value.get("dify_model_identity") == FILE_MODEL_IDENTITY:
+                return value
+            case File():
+                return value.to_dict()
 
         return None
 
diff --git a/api/core/app/apps/pipeline/pipeline_generator.py b/api/core/app/apps/pipeline/pipeline_generator.py
index 47b950ca086..255740b86a1 100644
--- a/api/core/app/apps/pipeline/pipeline_generator.py
+++ b/api/core/app/apps/pipeline/pipeline_generator.py
@@ -138,6 +138,10 @@ class PipelineGenerator(BaseAppGenerator):
         documents: list[Document] = []
         if invoke_from == InvokeFrom.PUBLISHED_PIPELINE and not is_retry and not args.get("original_document_id"):
             from services.dataset_service import DocumentService
+            from services.feature_service import FeatureService
+
+            features = FeatureService.get_features(pipeline.tenant_id)
+            DocumentService.check_document_creation_limits(len(datasource_info_list), features)
 
             for datasource_info in datasource_info_list:
                 position = DocumentService.get_documents_position(dataset.id)
diff --git a/api/core/app/entities/app_invoke_entities.py b/api/core/app/entities/app_invoke_entities.py
index 2153289e0e6..f588c98eefe 100644
--- a/api/core/app/entities/app_invoke_entities.py
+++ b/api/core/app/entities/app_invoke_entities.py
@@ -224,6 +224,7 @@ class AgentAppGenerateEntity(ChatAppGenerateEntity):
 
     agent_id: str
     agent_config_snapshot_id: str
+    agent_runtime_session_snapshot_id: str | None = None
 
 
 class AdvancedChatAppGenerateEntity(ConversationAppGenerateEntity):
diff --git a/api/core/app/entities/task_entities.py b/api/core/app/entities/task_entities.py
index 9cac379b7ea..3a8107e0461 100644
--- a/api/core/app/entities/task_entities.py
+++ b/api/core/app/entities/task_entities.py
@@ -241,7 +241,7 @@ class WorkflowFinishStreamResponse(StreamResponse):
         created_by: Mapping[str, object] = Field(default_factory=dict)
         created_at: int
         finished_at: int | None
-        exceptions_count: int | None = 0
+        exceptions_count: int = 0
         files: Sequence[Mapping[str, Any]] | None = []
 
     event: StreamEvent = StreamEvent.WORKFLOW_FINISHED
diff --git a/api/core/entities/provider_entities.py b/api/core/entities/provider_entities.py
index ad9a1f4a02a..4c9cd858e13 100644
--- a/api/core/entities/provider_entities.py
+++ b/api/core/entities/provider_entities.py
@@ -113,7 +113,7 @@ class CustomModelConfiguration(BaseModel):
     current_credential_id: str | None = None
     current_credential_name: str | None = None
     available_model_credentials: list[CredentialConfiguration] = []
-    unadded_to_model_list: bool | None = False
+    unadded_to_model_list: bool = False
 
     # pydantic configs
     model_config = ConfigDict(protected_namespaces=())
@@ -209,7 +209,7 @@ class ProviderConfig(BasicProviderConfig):
     required: bool = False
     default: Union[int, str, float, bool] | None = None
     options: list[Option] | None = None
-    multiple: bool | None = False
+    multiple: bool = False
     label: I18nObject | None = None
     help: I18nObject | None = None
     url: str | None = None
diff --git a/api/core/helper/trace_id_helper.py b/api/core/helper/trace_id_helper.py
index 82b5f42885a..8b022c1d065 100644
--- a/api/core/helper/trace_id_helper.py
+++ b/api/core/helper/trace_id_helper.py
@@ -144,15 +144,16 @@ def extract_parent_trace_context_from_args(args: Mapping[str, Any]) -> dict[str,
     Returns an empty dict if the context is missing or incomplete.
     """
     parent_trace_context = args.get("parent_trace_context")
-    if isinstance(parent_trace_context, ParentTraceContext):
-        context = parent_trace_context
-    elif isinstance(parent_trace_context, Mapping):
-        try:
-            context = ParentTraceContext.model_validate(parent_trace_context)
-        except ValidationError:
+    match parent_trace_context:
+        case ParentTraceContext():
+            context = parent_trace_context
+        case Mapping():
+            try:
+                context = ParentTraceContext.model_validate(parent_trace_context)
+            except ValidationError:
+                return {}
+        case _:
             return {}
-    else:
-        return {}
 
     if context.parent_node_execution_id is None:
         return {}
diff --git a/api/core/plugin/entities/parameters.py b/api/core/plugin/entities/parameters.py
index ba305690664..14ed8af3ef7 100644
--- a/api/core/plugin/entities/parameters.py
+++ b/api/core/plugin/entities/parameters.py
@@ -116,20 +116,21 @@ def cast_parameter_value(typ: StrEnum, value: Any, /):
                     return value if isinstance(value, str) else str(value)
 
             case PluginParameterType.BOOLEAN:
-                if value is None:
-                    return False
-                elif isinstance(value, str):
-                    # Allowed YAML boolean value strings: https://yaml.org/type/bool.html
-                    # and also '0' for False and '1' for True
-                    match value.lower():
-                        case "true" | "yes" | "y" | "1":
-                            return True
-                        case "false" | "no" | "n" | "0":
-                            return False
-                        case _:
-                            return bool(value)
-                else:
-                    return value if isinstance(value, bool) else bool(value)
+                match value:
+                    case None:
+                        return False
+                    case str():
+                        # Allowed YAML boolean value strings: https://yaml.org/type/bool.html
+                        # and also '0' for False and '1' for True
+                        match value.lower():
+                            case "true" | "yes" | "y" | "1":
+                                return True
+                            case "false" | "no" | "n" | "0":
+                                return False
+                            case _:
+                                return bool(value)
+                    case _:
+                        return value if isinstance(value, bool) else bool(value)
 
             case PluginParameterType.NUMBER:
                 match value:
diff --git a/api/core/plugin/entities/request.py b/api/core/plugin/entities/request.py
index d47dac9eaf5..fecad81c032 100644
--- a/api/core/plugin/entities/request.py
+++ b/api/core/plugin/entities/request.py
@@ -73,7 +73,7 @@ class RequestInvokeLLM(BaseRequestInvokeModel):
     prompt_messages: list[PromptMessage] = Field(default_factory=list)
     tools: list[PromptMessageTool] | None = Field(default_factory=list[PromptMessageTool])
     stop: list[str] | None = Field(default_factory=list[str])
-    stream: bool | None = False
+    stream: bool = False
 
     model_config = ConfigDict(protected_namespaces=())
 
diff --git a/api/core/plugin/impl/base.py b/api/core/plugin/impl/base.py
index 7a74b89cf51..6977f643859 100644
--- a/api/core/plugin/impl/base.py
+++ b/api/core/plugin/impl/base.py
@@ -20,6 +20,7 @@ from core.plugin.impl.exc import (
     PluginDaemonNotFoundError,
     PluginDaemonUnauthorizedError,
     PluginInvokeError,
+    PluginLLMPollingUnsupportedError,
     PluginNotFoundError,
     PluginPermissionDeniedError,
     PluginUniqueIdentifierError,
@@ -370,6 +371,10 @@ class BasePluginClient:
                         raise TriggerInvokeError(error_object.get("message"))
                     case EventIgnoreError.__name__:
                         raise EventIgnoreError(description=error_object.get("message"))
+                    # NOTE: current plugin sdk / plugin daemon does not raise exception with
+                    # type `PluginLLMPollingUnsupportedError`.
+                    case PluginLLMPollingUnsupportedError.__name__:
+                        raise PluginLLMPollingUnsupportedError(description=error_object.get("message"))
                     case _:
                         raise PluginInvokeError(description=message)
             case PluginDaemonInternalServerError.__name__:
diff --git a/api/core/plugin/impl/exc.py b/api/core/plugin/impl/exc.py
index 9a4f51ef121..abb9f0b1713 100644
--- a/api/core/plugin/impl/exc.py
+++ b/api/core/plugin/impl/exc.py
@@ -5,6 +5,13 @@ from pydantic import TypeAdapter
 
 from extensions.ext_logging import get_request_id
 
+# NOTE: Avoid renaming exception classes in this file, since
+# the `_handle_plugin_daemon_error` in api/core/plugin/impl/base.py
+# build exception instances based on the class name.
+#
+# Renaming of exception classes could result in incorrect exception
+# being raised.
+
 
 class PluginDaemonError(Exception):
     """Base class for all plugin daemon errors."""
@@ -75,6 +82,10 @@ class PluginInvokeError(PluginDaemonClientSideError, ValueError):
         )
 
 
+class PluginLLMPollingUnsupportedError(PluginInvokeError):
+    """Plugin-backed LLM polling is unavailable for the requested model."""
+
+
 class PluginUniqueIdentifierError(PluginDaemonClientSideError):
     description: str = "Unique Identifier Error"
 
diff --git a/api/core/plugin/impl/model.py b/api/core/plugin/impl/model.py
index 47608bdfa6e..80a83fb3f21 100644
--- a/api/core/plugin/impl/model.py
+++ b/api/core/plugin/impl/model.py
@@ -13,13 +13,17 @@ from core.plugin.entities.plugin_daemon import (
     PluginVoicesResponse,
 )
 from core.plugin.impl.base import BasePluginClient
-from graphon.model_runtime.entities.llm_entities import LLMResultChunk
+from core.plugin.impl.exc import PluginInvokeError, PluginLLMPollingUnsupportedError
+from graphon.model_runtime.entities.llm_entities import LLMPollingResult, LLMResultChunk
 from graphon.model_runtime.entities.message_entities import PromptMessage, PromptMessageTool
-from graphon.model_runtime.entities.model_entities import AIModelEntity
+from graphon.model_runtime.entities.model_entities import AIModelEntity, ModelType
 from graphon.model_runtime.entities.rerank_entities import MultimodalRerankInput, RerankResult
 from graphon.model_runtime.entities.text_embedding_entities import EmbeddingResult
 from graphon.model_runtime.utils.encoders import jsonable_encoder
 
+_POLLING_UNSUPPORTED_INVOKE_ERROR_TYPES = frozenset((NotImplementedError.__name__,))
+_POLLING_UNSUPPORTED_ERROR_MESSAGE = "does not support polling"
+
 
 class PluginModelClient(BasePluginClient):
     @staticmethod
@@ -197,6 +201,103 @@ class PluginModelClient(BasePluginClient):
         except PluginDaemonInnerError as e:
             raise ValueError(e.message + str(e.code))
 
+    def start_llm_polling(
+        self,
+        tenant_id: str,
+        user_id: str | None,
+        plugin_id: str,
+        provider: str,
+        model: str,
+        credentials: dict[str, Any],
+        prompt_messages: list[PromptMessage],
+        model_parameters: dict[str, Any] | None = None,
+        tools: list[PromptMessageTool] | None = None,
+        stop: list[str] | None = None,
+        json_schema: dict[str, Any] | None = None,
+    ) -> LLMPollingResult:
+        """Start an LLM polling request for plugin-backed long-running jobs."""
+        try:
+            return self._request_with_plugin_daemon_response(
+                method="POST",
+                path=f"plugin/{tenant_id}/dispatch/model/polling/start",
+                type_=LLMPollingResult,
+                data=jsonable_encoder(
+                    self._dispatch_payload(
+                        user_id=user_id,
+                        data={
+                            "provider": provider,
+                            "model_type": ModelType.LLM.value,
+                            "model": model,
+                            "credentials": credentials,
+                            "prompt_messages": prompt_messages,
+                            "model_parameters": model_parameters,
+                            "tools": tools,
+                            "stop": stop,
+                            "stream": False,
+                            "json_schema": json_schema,
+                        },
+                    )
+                ),
+                headers={
+                    "X-Plugin-ID": plugin_id,
+                    "Content-Type": "application/json",
+                },
+            )
+        except PluginInvokeError as error:
+            self._raise_typed_polling_unsupported_error(error)
+            raise
+
+    def check_llm_polling(
+        self,
+        tenant_id: str,
+        user_id: str | None,
+        plugin_id: str,
+        provider: str,
+        model: str,
+        credentials: dict[str, Any],
+        plugin_state: dict[str, Any],
+    ) -> LLMPollingResult:
+        """Check the latest state for a plugin-backed LLM polling job."""
+        try:
+            return self._request_with_plugin_daemon_response(
+                method="POST",
+                path=f"plugin/{tenant_id}/dispatch/model/polling/check",
+                type_=LLMPollingResult,
+                data=jsonable_encoder(
+                    self._dispatch_payload(
+                        user_id=user_id,
+                        data={
+                            "provider": provider,
+                            "model_type": ModelType.LLM.value,
+                            "model": model,
+                            "credentials": credentials,
+                            "plugin_state": plugin_state,
+                        },
+                    )
+                ),
+                headers={
+                    "X-Plugin-ID": plugin_id,
+                    "Content-Type": "application/json",
+                },
+            )
+        except PluginInvokeError as error:
+            self._raise_typed_polling_unsupported_error(error)
+            raise
+
+    @staticmethod
+    def _raise_typed_polling_unsupported_error(error: PluginInvokeError) -> None:
+        """Convert plugin polling capability failures into a dedicated Dify exception."""
+        if error.get_error_type() == PluginLLMPollingUnsupportedError.__name__:
+            raise PluginLLMPollingUnsupportedError(description=error.description) from error
+
+        if (
+            error.get_error_type() in _POLLING_UNSUPPORTED_INVOKE_ERROR_TYPES
+            # This is ugly, we should not rely on error messages while checking
+            # error types.
+            and _POLLING_UNSUPPORTED_ERROR_MESSAGE in error.get_error_message().lower()
+        ):
+            raise PluginLLMPollingUnsupportedError(description=error.description) from error
+
     def get_llm_num_tokens(
         self,
         tenant_id: str,
diff --git a/api/core/plugin/impl/model_runtime.py b/api/core/plugin/impl/model_runtime.py
index 3d5ba94f2bf..c1b976d8f4f 100644
--- a/api/core/plugin/impl/model_runtime.py
+++ b/api/core/plugin/impl/model_runtime.py
@@ -6,6 +6,7 @@ from collections.abc import Generator, Iterable, Sequence
 from typing import IO, Any, Literal, cast, overload, override
 
 from pydantic import ValidationError
+from pydantic.json_schema import JsonValue
 from redis import RedisError
 
 from configs import dify_config
@@ -17,6 +18,7 @@ from core.plugin.impl.model import PluginModelClient
 from core.plugin.plugin_service import PluginService
 from extensions.ext_redis import redis_client
 from graphon.model_runtime.entities.llm_entities import (
+    LLMPollingResult,
     LLMResult,
     LLMResultChunk,
     LLMResultChunkWithStructuredOutput,
@@ -430,6 +432,54 @@ class PluginModelRuntime(ModelRuntime):
             tools=list(tools) if tools else None,
         )
 
+    def start_llm_polling(
+        self,
+        *,
+        provider: str,
+        model: str,
+        credentials: dict[str, Any],
+        model_parameters: dict[str, Any],
+        prompt_messages: Sequence[PromptMessage],
+        tools: Sequence[PromptMessageTool] | None,
+        stop: Sequence[str] | None,
+        json_schema: dict[str, Any] | None,
+    ) -> LLMPollingResult:
+        """Start a plugin-side polling job for long-running LLM invocations."""
+        plugin_id, provider_name = self._split_provider(provider)
+        return self.client.start_llm_polling(
+            tenant_id=self.tenant_id,
+            user_id=self.user_id,
+            plugin_id=plugin_id,
+            provider=provider_name,
+            model=model,
+            credentials=credentials,
+            prompt_messages=list(prompt_messages),
+            model_parameters=model_parameters,
+            tools=list(tools) if tools else None,
+            stop=list(stop) if stop else None,
+            json_schema=json_schema,
+        )
+
+    def check_llm_polling(
+        self,
+        *,
+        provider: str,
+        model: str,
+        credentials: dict[str, Any],
+        plugin_state: dict[str, JsonValue],
+    ) -> LLMPollingResult:
+        """Check the latest plugin-side polling state for an LLM invocation."""
+        plugin_id, provider_name = self._split_provider(provider)
+        return self.client.check_llm_polling(
+            tenant_id=self.tenant_id,
+            user_id=self.user_id,
+            plugin_id=plugin_id,
+            provider=provider_name,
+            model=model,
+            credentials=credentials,
+            plugin_state=plugin_state,
+        )
+
     @override
     def invoke_text_embedding(
         self,
diff --git a/api/core/rag/entities/metadata_entities.py b/api/core/rag/entities/metadata_entities.py
index a2ac44807f8..347d5df8237 100644
--- a/api/core/rag/entities/metadata_entities.py
+++ b/api/core/rag/entities/metadata_entities.py
@@ -1,7 +1,7 @@
 from collections.abc import Sequence
-from typing import Literal
+from typing import Annotated, Literal
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, WithJsonSchema
 
 SupportedComparisonOperator = Literal[
     # for string or array
@@ -26,6 +26,19 @@ SupportedComparisonOperator = Literal[
     "before",
     "after",
 ]
+ConditionValue = Annotated[
+    str | Sequence[str] | None | int | float,
+    WithJsonSchema(
+        {
+            "anyOf": [
+                {"type": "string"},
+                {"items": {"type": "string"}, "type": "array"},
+                {"type": "number"},
+                {"type": "null"},
+            ]
+        }
+    ),
+]
 
 
 class Condition(BaseModel):
@@ -33,9 +46,23 @@ class Condition(BaseModel):
     Condition detail
     """
 
-    name: str
-    comparison_operator: SupportedComparisonOperator
-    value: str | Sequence[str] | None | int | float = None
+    name: str = Field(description="Metadata field name to compare against.")
+    comparison_operator: SupportedComparisonOperator = Field(
+        description=(
+            "Comparison to apply. String operators (`contains`, `not contains`, `start with`, `end with`, `is`, "
+            "`is not`, `empty`, `not empty`, `in`, `not in`) act on string or array metadata; numeric operators "
+            "(`=`, `≠`, `>`, `<`, `≥`, `≤`) act on numeric metadata; time operators (`before`, `after`) act on "
+            "time metadata."
+        )
+    )
+    value: ConditionValue = Field(
+        default=None,
+        description=(
+            "Value to compare against. Type depends on `comparison_operator`: string for most string operators, "
+            "array of strings for `in` and `not in`, number for numeric operators, and omit or use `null` for "
+            "`empty` and `not empty`."
+        ),
+    )
 
 
 class MetadataFilteringCondition(BaseModel):
@@ -43,5 +70,12 @@ class MetadataFilteringCondition(BaseModel):
     Metadata Filtering Condition.
     """
 
-    logical_operator: Literal["and", "or"] | None = "and"
-    conditions: list[Condition] | None = Field(default=None, deprecated=True)
+    logical_operator: Literal["and", "or"] | None = Field(
+        default="and",
+        description="How to combine multiple conditions.",
+    )
+    conditions: list[Condition] | None = Field(
+        default=None,
+        deprecated=True,
+        description="List of metadata conditions to evaluate.",
+    )
diff --git a/api/core/rag/entities/processing_entities.py b/api/core/rag/entities/processing_entities.py
index 1b54444a198..46360ec086f 100644
--- a/api/core/rag/entities/processing_entities.py
+++ b/api/core/rag/entities/processing_entities.py
@@ -1,7 +1,7 @@
 from enum import StrEnum
-from typing import Literal
+from typing import Annotated, Literal
 
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, WithJsonSchema
 
 
 class ParentMode(StrEnum):
@@ -9,19 +9,39 @@ class ParentMode(StrEnum):
     PARAGRAPH = "paragraph"
 
 
+PreProcessingRuleID = Annotated[
+    str,
+    WithJsonSchema(
+        {
+            "enum": ["remove_stopwords", "remove_extra_spaces", "remove_urls_emails"],
+            "type": "string",
+        }
+    ),
+]
+
+
 class PreProcessingRule(BaseModel):
-    id: str
-    enabled: bool
+    id: PreProcessingRuleID = Field(description="Rule identifier.")
+    enabled: bool = Field(description="Whether this preprocessing rule is enabled.")
 
 
 class Segmentation(BaseModel):
-    separator: str = "\n"
-    max_tokens: int
-    chunk_overlap: int = 0
+    separator: str = Field(default="\n", description="Custom separator for splitting text.")
+    max_tokens: int = Field(description="Maximum token count per chunk.")
+    chunk_overlap: int = Field(default=0, description="Token overlap between chunks.")
 
 
 class Rule(BaseModel):
-    pre_processing_rules: list[PreProcessingRule] | None = None
-    segmentation: Segmentation | None = None
-    parent_mode: Literal["full-doc", "paragraph"] | None = None
-    subchunk_segmentation: Segmentation | None = None
+    pre_processing_rules: list[PreProcessingRule] | None = Field(
+        default=None,
+        description="Pre-processing rules to apply before segmentation.",
+    )
+    segmentation: Segmentation | None = Field(default=None, description="Parent chunk segmentation settings.")
+    parent_mode: Literal["full-doc", "paragraph"] | None = Field(
+        default=None,
+        description="Parent-child segmentation mode.",
+    )
+    subchunk_segmentation: Segmentation | None = Field(
+        default=None,
+        description="Child chunk segmentation settings.",
+    )
diff --git a/api/core/rag/extractor/watercrawl/client.py b/api/core/rag/extractor/watercrawl/client.py
index 1f4adc0d418..b37bd38ec3e 100644
--- a/api/core/rag/extractor/watercrawl/client.py
+++ b/api/core/rag/extractor/watercrawl/client.py
@@ -12,6 +12,8 @@ from core.rag.extractor.watercrawl.exceptions import (
     WaterCrawlPermissionError,
 )
 
+WATERCRAWL_REQUEST_TIMEOUT: httpx.Timeout = httpx.Timeout(30.0, connect=5.0)
+
 
 class SpiderOptions(TypedDict):
     max_depth: int
@@ -48,7 +50,7 @@ class BaseAPIClient:
             "User-Agent": "WaterCrawl-Plugin",
             "Accept-Language": "en-US",
         }
-        return httpx.Client(headers=headers, timeout=None)
+        return httpx.Client(headers=headers, timeout=WATERCRAWL_REQUEST_TIMEOUT)
 
     def _request(
         self,
diff --git a/api/core/rag/retrieval/dataset_retrieval.py b/api/core/rag/retrieval/dataset_retrieval.py
index f4e850d34ed..474c9f90c78 100644
--- a/api/core/rag/retrieval/dataset_retrieval.py
+++ b/api/core/rag/retrieval/dataset_retrieval.py
@@ -123,7 +123,7 @@ class DatasetRetrieval:
         if not available_datasets_ids:
             return []
 
-        if not request.query:
+        if not request.query and not request.attachment_ids:
             return []
 
         metadata_filter_document_ids, metadata_condition = None, None
diff --git a/api/core/rbac/entities.py b/api/core/rbac/entities.py
index 5389e16eefc..7f08a530f57 100644
--- a/api/core/rbac/entities.py
+++ b/api/core/rbac/entities.py
@@ -25,6 +25,7 @@ class RBACPermission(StrEnum):
     APP_CREATE_AND_MANAGEMENT = "app_create_and_management"
     APP_RELEASE_AND_VERSION = "app_release_and_version"
     APP_IMPORT_EXPORT_DSL = "app_import_export_dsl"
+    APP_EDIT = "app_edit"
     APP_MONITOR = "app_monitor"
     APP_DELETE = "app_delete"
 
@@ -33,5 +34,22 @@ class RBACPermission(StrEnum):
     DATASET_CREATE_AND_MANAGEMENT = "dataset_create_and_management"
     DATASET_PIPELINE_TEST = "dataset_pipeline_test"
     DATASET_DOCUMENT_DOWNLOAD = "dataset_document_download"
+    DATASET_API_KEY_MANAGE = "dataset_api_key_manage"
+    DATASET_EXTERNAL_CONNECT = "dataset_external_connect"
+    DATASET_IMPORT_EXPORT_DSL = "dataset_import_export_dsl"
 
     WORKSPACE_ROLE_MANAGE = "workspace_role_manage"
+
+    SNIPPETS_CREATE_AND_MODIFY = "snippets_create_and_modify"
+    SNIPPETS_MANAGE = "snippets_management"
+
+    PLUGIN_INSTALL = "plugin_install"
+    PLUGIN_PREFERENCES = "plugin_preferences"
+    PLUGIN_MANAGE = "plugin_manage"
+    PLUGIN_DEBUG = "plugin_debug"
+
+    CREDENTIAL_USE = "credential_use"
+    CREDENTIAL_MANAGE = "credential_manage"
+
+    TOOL_MANAGE = "tool_manage"
+    MCP_MANAGE = "mcp_manage"
diff --git a/api/core/schemas/resolver.py b/api/core/schemas/resolver.py
index cd86aebc060..6d959e0e87a 100644
--- a/api/core/schemas/resolver.py
+++ b/api/core/schemas/resolver.py
@@ -304,22 +304,23 @@ def _has_dify_refs_recursive(schema: SchemaType) -> bool:
     Returns:
         True if any Dify $ref is found, False otherwise
     """
-    if isinstance(schema, dict):
-        # Check if this dict has a $ref field
-        ref_uri = schema.get("$ref")
-        if ref_uri and _is_dify_schema_ref(ref_uri):
-            return True
-
-        # Check nested values
-        for value in schema.values():
-            if _has_dify_refs_recursive(value):
+    match schema:
+        case dict():
+            # Check if this dict has a $ref field
+            ref_uri = schema.get("$ref")
+            if ref_uri and _is_dify_schema_ref(ref_uri):
                 return True
 
-    elif isinstance(schema, list):
-        # Check each item in the list
-        for item in schema:
-            if _has_dify_refs_recursive(item):
-                return True
+            # Check nested values
+            for value in schema.values():
+                if _has_dify_refs_recursive(value):
+                    return True
+
+        case list():
+            # Check each item in the list
+            for item in schema:
+                if _has_dify_refs_recursive(item):
+                    return True
 
     # Primitive types don't contain refs
     return False
diff --git a/api/core/tools/builtin_tool/providers/time/tools/localtime_to_timestamp.py b/api/core/tools/builtin_tool/providers/time/tools/localtime_to_timestamp.py
index 1ebb7ab3a7f..57363349458 100644
--- a/api/core/tools/builtin_tool/providers/time/tools/localtime_to_timestamp.py
+++ b/api/core/tools/builtin_tool/providers/time/tools/localtime_to_timestamp.py
@@ -1,6 +1,6 @@
 from collections.abc import Generator
-from datetime import datetime
-from typing import Any, override
+from datetime import datetime, tzinfo
+from typing import Any, cast, override
 
 import pytz  # type: ignore[import-untyped]
 
@@ -35,17 +35,26 @@ class LocaltimeToTimestampTool(BuiltinTool):
 
         yield self.create_text_message(f"{timestamp}")
 
-    # TODO: this method's type is messy
     @staticmethod
-    def localtime_to_timestamp(localtime: str, time_format: str, local_tz=None) -> int | None:
+    def localtime_to_timestamp(localtime: str, time_format: str, local_tz: str | tzinfo | None = None) -> int | None:
         try:
             local_time = datetime.strptime(localtime, time_format)
-            if local_tz is None:
-                localtime = local_time.astimezone()  # type: ignore
-            elif isinstance(local_tz, str):
-                local_tz = pytz.timezone(local_tz)
-                localtime = local_tz.localize(local_time)  # type: ignore
-            timestamp = int(localtime.timestamp())  # type: ignore
+            converted_localtime: datetime
+            match local_tz:
+                case None:
+                    converted_localtime = local_time.astimezone()
+                case str() as timezone_name:
+                    timezone = pytz.timezone(timezone_name)
+                    converted_localtime = timezone.localize(local_time)
+                case tzinfo():
+                    localize = getattr(local_tz, "localize", None)
+                    if callable(localize):
+                        converted_localtime = cast(datetime, localize(local_time))
+                    else:
+                        converted_localtime = local_time.replace(tzinfo=local_tz)
+                case _:
+                    raise ValueError("local_tz must be None, a timezone name, or a tzinfo instance")
+            timestamp = int(converted_localtime.timestamp())
             return timestamp
         except Exception as e:
             raise ToolInvokeError(str(e))
diff --git a/api/core/tools/mcp_tool/tool.py b/api/core/tools/mcp_tool/tool.py
index 7a1553a4b15..195acd6e1ad 100644
--- a/api/core/tools/mcp_tool/tool.py
+++ b/api/core/tools/mcp_tool/tool.py
@@ -122,13 +122,14 @@ class MCPTool(Tool):
 
     def _process_json_content(self, content_json: Any) -> Generator[ToolInvokeMessage, None, None]:
         """Process JSON content based on its type."""
-        if isinstance(content_json, dict):
-            yield self.create_json_message(content_json)
-        elif isinstance(content_json, list):
-            yield from self._process_json_list(content_json)
-        else:
-            # For primitive types (str, int, bool, etc.), convert to string
-            yield self.create_text_message(str(content_json))
+        match content_json:
+            case dict():
+                yield self.create_json_message(content_json)
+            case list():
+                yield from self._process_json_list(content_json)
+            case _:
+                # For primitive types (str, int, bool, etc.), convert to string
+                yield self.create_text_message(str(content_json))
 
     def _process_json_list(self, json_list: list) -> Generator[ToolInvokeMessage, None, None]:
         """Process a list of JSON items."""
@@ -222,16 +223,17 @@ class MCPTool(Tool):
 
         # Recursively search through nested structures
         for value in payload.values():
-            if isinstance(value, Mapping):
-                found = cls._extract_usage_dict(value)
-                if found is not None:
-                    return found
-            elif isinstance(value, list) and not isinstance(value, (str, bytes, bytearray)):
-                for item in value:
-                    if isinstance(item, Mapping):
-                        found = cls._extract_usage_dict(item)
-                        if found is not None:
-                            return found
+            match value:
+                case _ if isinstance(value, Mapping):
+                    found = cls._extract_usage_dict(value)
+                    if found is not None:
+                        return found
+                case list() if not isinstance(value, (str, bytes, bytearray)):
+                    for item in value:
+                        if isinstance(item, Mapping):
+                            found = cls._extract_usage_dict(item)
+                            if found is not None:
+                                return found
         return None
 
     @override
diff --git a/api/core/tools/tool_manager.py b/api/core/tools/tool_manager.py
index 99be960a200..850571c3f19 100644
--- a/api/core/tools/tool_manager.py
+++ b/api/core/tools/tool_manager.py
@@ -398,6 +398,8 @@ class ToolManager:
         user_id: str | None = None,
         invoke_from: InvokeFrom = InvokeFrom.DEBUGGER,
         variable_pool: "VariablePool | None" = None,
+        allow_file_parameters: bool = False,
+        use_default_for_missing_form_parameters: bool = False,
     ) -> Tool:
         """
         get the agent tool runtime
@@ -415,7 +417,12 @@ class ToolManager:
         runtime_parameters: dict[str, Any] = {}
         parameters = tool_entity.get_merged_runtime_parameters()
         runtime_parameters = cls._convert_tool_parameters_type(
-            parameters, variable_pool, agent_tool.tool_parameters, typ="agent"
+            parameters,
+            variable_pool,
+            agent_tool.tool_parameters,
+            typ="agent",
+            allow_file_parameters=allow_file_parameters,
+            use_default_for_missing_form_parameters=use_default_for_missing_form_parameters,
         )
         # decrypt runtime parameters
         encryption_manager = ToolParameterConfigurationManager(
@@ -1063,6 +1070,8 @@ class ToolManager:
         variable_pool: "VariablePool | None",
         tool_configurations: Mapping[str, Any],
         typ: Literal["agent", "workflow", "tool"] = "workflow",
+        allow_file_parameters: bool = False,
+        use_default_for_missing_form_parameters: bool = False,
     ) -> dict[str, Any]:
         """
         Convert tool parameters type
@@ -1081,6 +1090,7 @@ class ToolManager:
                 }
                 and parameter.required
                 and typ == "agent"
+                and not allow_file_parameters
             ):
                 raise ValueError(f"file type parameter {parameter.name} not supported in agent")
             # save tool parameter to tool entity memory
@@ -1117,7 +1127,19 @@ class ToolManager:
                     runtime_parameters[parameter.name] = parameter_value
 
                 else:
-                    value = parameter.init_frontend_parameter(tool_configurations.get(parameter.name))
+                    parameter_value = tool_configurations.get(parameter.name)
+                    if use_default_for_missing_form_parameters and parameter_value is None:
+                        if parameter.default is not None:
+                            parameter_value = parameter.default
+                        elif (
+                            parameter.required
+                            and parameter.type == ToolParameter.ToolParameterType.SELECT
+                            and parameter.options
+                        ):
+                            parameter_value = parameter.options[0].value
+                        else:
+                            continue
+                    value = parameter.init_frontend_parameter(parameter_value)
                     runtime_parameters[parameter.name] = value
         return runtime_parameters
 
diff --git a/api/core/tools/workflow_as_tool/tool.py b/api/core/tools/workflow_as_tool/tool.py
index 7e7b1e33008..97222f3cfae 100644
--- a/api/core/tools/workflow_as_tool/tool.py
+++ b/api/core/tools/workflow_as_tool/tool.py
@@ -196,16 +196,17 @@ class WorkflowTool(Tool):
                 return usage_candidate
 
         for value in payload.values():
-            if isinstance(value, Mapping):
-                found = cls._extract_usage_dict(value)
-                if found is not None:
-                    return found
-            elif isinstance(value, Sequence) and not isinstance(value, (str, bytes, bytearray)):
-                for item in value:
-                    if isinstance(item, Mapping):
-                        found = cls._extract_usage_dict(item)
-                        if found is not None:
-                            return found
+            match value:
+                case _ if isinstance(value, Mapping):
+                    found = cls._extract_usage_dict(value)
+                    if found is not None:
+                        return found
+                case _ if isinstance(value, Sequence) and not isinstance(value, (str, bytes, bytearray)):
+                    for item in value:
+                        if isinstance(item, Mapping):
+                            found = cls._extract_usage_dict(item)
+                            if found is not None:
+                                return found
         return None
 
     @override
@@ -393,24 +394,25 @@ class WorkflowTool(Tool):
         files: list[File] = []
         result = {}
         for key, value in outputs.items():
-            if isinstance(value, list):
-                for item in value:
-                    if isinstance(item, dict) and item.get("dify_model_identity") == FILE_MODEL_IDENTITY:
-                        item = self._update_file_mapping(item)
-                        file = build_from_mapping(
-                            mapping=item,
-                            tenant_id=str(self.runtime.tenant_id),
-                            access_controller=_file_access_controller,
-                        )
-                        files.append(file)
-            elif isinstance(value, dict) and value.get("dify_model_identity") == FILE_MODEL_IDENTITY:
-                value = self._update_file_mapping(value)
-                file = build_from_mapping(
-                    mapping=value,
-                    tenant_id=str(self.runtime.tenant_id),
-                    access_controller=_file_access_controller,
-                )
-                files.append(file)
+            match value:
+                case list():
+                    for item in value:
+                        if isinstance(item, dict) and item.get("dify_model_identity") == FILE_MODEL_IDENTITY:
+                            item = self._update_file_mapping(item)
+                            file = build_from_mapping(
+                                mapping=item,
+                                tenant_id=str(self.runtime.tenant_id),
+                                access_controller=_file_access_controller,
+                            )
+                            files.append(file)
+                case dict() if value.get("dify_model_identity") == FILE_MODEL_IDENTITY:
+                    value = self._update_file_mapping(value)
+                    file = build_from_mapping(
+                        mapping=value,
+                        tenant_id=str(self.runtime.tenant_id),
+                        access_controller=_file_access_controller,
+                    )
+                    files.append(file)
 
             result[key] = value
 
diff --git a/api/core/trigger/entities/entities.py b/api/core/trigger/entities/entities.py
index a922e881cdf..06a29bed111 100644
--- a/api/core/trigger/entities/entities.py
+++ b/api/core/trigger/entities/entities.py
@@ -46,8 +46,8 @@ class EventParameter(BaseModel):
     )
     template: PluginParameterTemplate | None = Field(default=None, description="The template of the parameter")
     scope: str | None = None
-    required: bool | None = False
-    multiple: bool | None = Field(
+    required: bool = False
+    multiple: bool = Field(
         default=False,
         description="Whether the parameter is multiple select, only valid for select or dynamic-select type",
     )
diff --git a/api/core/workflow/node_factory.py b/api/core/workflow/node_factory.py
index 54c6c55949e..ebeb189ab19 100644
--- a/api/core/workflow/node_factory.py
+++ b/api/core/workflow/node_factory.py
@@ -26,6 +26,7 @@ from core.workflow.node_runtime import (
     DifyFileReferenceFactory,
     DifyHumanInputNodeRuntime,
     DifyPreparedLLM,
+    DifyPreparedPollingLLM,
     DifyPromptMessageSerializer,
     DifyRetrieverAttachmentLoader,
     DifyToolFileManager,
@@ -531,7 +532,11 @@ class DifyNodeFactory(NodeFactory):
         node_init_kwargs: dict[str, object] = {
             "credentials_provider": self._llm_credentials_provider,
             "model_factory": self._llm_model_factory,
-            "model_instance": DifyPreparedLLM(model_instance) if wrap_model_instance else model_instance,
+            "model_instance": (
+                self._wrap_model_instance_for_node(node_data=validated_node_data, model_instance=model_instance)
+                if wrap_model_instance
+                else model_instance
+            ),
             "memory": self._build_memory_for_llm_node(
                 node_data=validated_node_data,
                 model_instance=model_instance,
@@ -555,6 +560,23 @@ class DifyNodeFactory(NodeFactory):
             node_init_kwargs["default_query_selector"] = system_variable_selector(SystemVariableKey.QUERY)
         return node_init_kwargs
 
+    @staticmethod
+    def _wrap_model_instance_for_node(
+        *,
+        node_data: LLMCompatibleNodeData,
+        model_instance: ModelInstance,
+    ) -> DifyPreparedLLM:
+        # Only graphon's LLM node consumes the polling protocol. Keep classifier
+        # and extractor nodes on the existing wrapper even if the same model
+        # advertises polling support.
+        if node_data.type == BuiltinNodeTypes.LLM and DifyNodeFactory._supports_plugin_llm_polling(model_instance):
+            return DifyPreparedPollingLLM(model_instance)
+        return DifyPreparedLLM(model_instance)
+
+    @staticmethod
+    def _supports_plugin_llm_polling(model_instance: ModelInstance) -> bool:
+        return model_instance.get_model_schema().support_polling
+
     def _build_retriever_attachment_loader(self, node_data: LLMNodeData) -> DifyRetrieverAttachmentLoader:
         return DifyRetrieverAttachmentLoader(
             file_reference_factory=self._file_reference_factory,
diff --git a/api/core/workflow/node_runtime.py b/api/core/workflow/node_runtime.py
index 4eced02cd10..9964f65d0b6 100644
--- a/api/core/workflow/node_runtime.py
+++ b/api/core/workflow/node_runtime.py
@@ -4,6 +4,7 @@ from collections.abc import Callable, Generator, Mapping, Sequence
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Literal, cast, overload, override
 
+from pydantic import JsonValue
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
@@ -38,6 +39,7 @@ from factories import file_factory
 from graphon.file import File, FileTransferMethod, FileType
 from graphon.model_runtime.entities import LLMMode
 from graphon.model_runtime.entities.llm_entities import (
+    LLMPollingResult,
     LLMResult,
     LLMResultChunk,
     LLMResultChunkWithStructuredOutput,
@@ -54,6 +56,7 @@ from graphon.nodes.human_input.entities import (
     HumanInputNodeData,
 )
 from graphon.nodes.llm.runtime_protocols import (
+    LLMPollingCapableProtocol,
     LLMProtocol,
     PromptMessageSerializerProtocol,
     RetrieverAttachmentLoaderProtocol,
@@ -278,6 +281,58 @@ class DifyPreparedLLM(LLMProtocol):
         return isinstance(error, OutputParserError)
 
 
+class DifyPreparedPollingLLM(DifyPreparedLLM, LLMPollingCapableProtocol):
+    """Prepared workflow LLM adapter that exposes Graphon's polling protocol."""
+
+    def __init__(self, model_instance: ModelInstance) -> None:
+        from core.plugin.impl.model_runtime import PluginModelRuntime
+
+        super().__init__(model_instance)
+        model_type_instance = model_instance.model_type_instance
+        if not isinstance(model_type_instance, LargeLanguageModel):
+            raise TypeError("Polling wrapper requires a large-language-model instance.")
+
+        plugin_model_runtime = model_type_instance.model_runtime
+        if not isinstance(plugin_model_runtime, PluginModelRuntime):
+            raise TypeError("Polling wrapper requires a plugin-backed model runtime.")
+
+        self._plugin_model_runtime = plugin_model_runtime
+
+    @override
+    def start_llm_polling(
+        self,
+        *,
+        prompt_messages: Sequence[PromptMessage],
+        model_parameters: Mapping[str, Any],
+        tools: Sequence[PromptMessageTool] | None,
+        stop: Sequence[str] | None,
+        json_schema: Mapping[str, Any] | None,
+    ) -> LLMPollingResult:
+        return self._plugin_model_runtime.start_llm_polling(
+            provider=self.provider,
+            model=self.model_name,
+            credentials=self._model_instance.credentials,
+            prompt_messages=prompt_messages,
+            model_parameters=dict(model_parameters),
+            tools=tools,
+            stop=stop,
+            json_schema=dict(json_schema) if json_schema is not None else None,
+        )
+
+    @override
+    def check_llm_polling(
+        self,
+        *,
+        plugin_state: Mapping[str, JsonValue],
+    ) -> LLMPollingResult:
+        return self._plugin_model_runtime.check_llm_polling(
+            provider=self.provider,
+            model=self.model_name,
+            credentials=self._model_instance.credentials,
+            plugin_state=dict(plugin_state),
+        )
+
+
 class DifyPromptMessageSerializer(PromptMessageSerializerProtocol):
     @override
     def serialize(
diff --git a/api/core/workflow/nodes/agent_v2/plugin_tools_builder.py b/api/core/workflow/nodes/agent_v2/plugin_tools_builder.py
index ccf8f9fa171..80366cc5193 100644
--- a/api/core/workflow/nodes/agent_v2/plugin_tools_builder.py
+++ b/api/core/workflow/nodes/agent_v2/plugin_tools_builder.py
@@ -42,6 +42,8 @@ class AgentToolRuntimeProvider(Protocol):
         user_id: str | None = None,
         invoke_from: InvokeFrom = InvokeFrom.DEBUGGER,
         variable_pool: Any | None = None,
+        allow_file_parameters: bool = False,
+        use_default_for_missing_form_parameters: bool = False,
     ) -> Tool: ...
 
 
@@ -176,6 +178,8 @@ class WorkflowAgentPluginToolsBuilder:
                 user_id=user_id,
                 invoke_from=invoke_from,
                 variable_pool=None,
+                allow_file_parameters=True,
+                use_default_for_missing_form_parameters=True,
             )
         except ToolProviderNotFoundError as exc:
             raise WorkflowAgentPluginToolsBuildError(
diff --git a/api/core/workflow/nodes/agent_v2/runtime_feature_manifest.py b/api/core/workflow/nodes/agent_v2/runtime_feature_manifest.py
index 8e0578d1a15..65c5d42e916 100644
--- a/api/core/workflow/nodes/agent_v2/runtime_feature_manifest.py
+++ b/api/core/workflow/nodes/agent_v2/runtime_feature_manifest.py
@@ -13,6 +13,7 @@ SUPPORTED_AGENT_BACKEND_FEATURES = frozenset(
         "structured_output",
         "tools.dify_tools",
         "tools.cli_tools",
+        "knowledge",
         "env",
         "sandbox",
         # ENG-623: exposed at runtime as the dify.drive declaration layer
@@ -26,7 +27,6 @@ SUPPORTED_AGENT_BACKEND_FEATURES = frozenset(
 
 RESERVED_AGENT_BACKEND_FEATURES = frozenset(
     {
-        "knowledge",
         "memory",
     }
 )
@@ -80,6 +80,9 @@ def build_runtime_feature_manifest(
             )
 
     reserved_status = dict.fromkeys(sorted(RESERVED_AGENT_BACKEND_FEATURES), "reserved_not_executed")
+    reserved_status["knowledge"] = (
+        "supported_by_knowledge_layer" if list_configured_knowledge_dataset_ids(agent_soul) else "not_configured"
+    )
     reserved_status["skills_files"] = (
         "supported_by_drive_manifest" if drive_manifest_enabled else "drive_manifest_disabled"
     )
@@ -97,6 +100,17 @@ def build_runtime_feature_manifest(
     }
 
 
+def list_configured_knowledge_dataset_ids(agent_soul: AgentSoulConfig) -> list[str]:
+    """Return the normalized knowledge dataset ids that can produce a runtime layer.
+
+    ``build_runtime_feature_manifest()`` and ``build_knowledge_layer_config()``
+    must stay aligned: both decide knowledge support from this effective,
+    non-blank dataset-id set rather than from raw
+    ``agent_soul.knowledge.datasets`` entries.
+    """
+    return [dataset_id for dataset in agent_soul.knowledge.datasets if (dataset_id := (dataset.id or "").strip())]
+
+
 def _get_nested(value: dict[str, Any], path: str) -> Any:
     current: Any = value
     for part in path.split("."):
diff --git a/api/core/workflow/nodes/agent_v2/runtime_request_builder.py b/api/core/workflow/nodes/agent_v2/runtime_request_builder.py
index d4aa43898d0..8aaa4fcc1d3 100644
--- a/api/core/workflow/nodes/agent_v2/runtime_request_builder.py
+++ b/api/core/workflow/nodes/agent_v2/runtime_request_builder.py
@@ -16,6 +16,7 @@ from dify_agent.layers.execution_context import (
     DifyExecutionContextLayerConfig,
     DifyExecutionContextUserFrom,
 )
+from dify_agent.layers.knowledge import DifyKnowledgeBaseLayerConfig, DifyKnowledgeRetrievalConfig
 from dify_agent.layers.shell import (
     DifyShellCliToolConfig,
     DifyShellEnvVarConfig,
@@ -40,8 +41,10 @@ from graphon.file import FileTransferMethod
 from graphon.variables.segments import Segment
 from models.agent import Agent, AgentConfigSnapshot, WorkflowAgentNodeBinding
 from models.agent_config_entities import (
+    AgentKnowledgeQueryConfig,
     AgentSoulConfig,
     DeclaredArrayItem,
+    DeclaredOutputChildConfig,
     DeclaredOutputConfig,
     DeclaredOutputType,
     WorkflowNodeJobConfig,
@@ -59,6 +62,7 @@ from services.agent.prompt_mentions import (
 
 from .output_failure_orchestrator import retry_idempotency_key
 from .plugin_tools_builder import WorkflowAgentPluginToolsBuilder, WorkflowAgentPluginToolsBuildError
+from .runtime_feature_manifest import build_runtime_feature_manifest, list_configured_knowledge_dataset_ids
 
 _DENIED_PERMISSION_STATUSES = frozenset({"unauthorized", "denied", "forbidden", "invalid", "unavailable"})
 _DANGEROUS_FLAG_KEYS = ("dangerous", "dangerous_command", "requires_confirmation")
@@ -68,7 +72,6 @@ _DANGEROUS_ACK_KEYS = (
     "risk_accepted",
     "approved",
 )
-from .runtime_feature_manifest import build_runtime_feature_manifest
 
 
 class WorkflowAgentRuntimeRequestBuildError(ValueError):
@@ -182,6 +185,7 @@ class WorkflowAgentRuntimeRequestBuilder:
         if dify_config.AGENT_DRIVE_MANIFEST_ENABLED:
             drive_config, drive_warnings = build_drive_layer_config(agent_soul, agent_id=context.agent.id)
             append_runtime_warnings(metadata, drive_warnings)
+        knowledge_config = build_knowledge_layer_config(agent_soul)
 
         request = self._request_builder.build_for_workflow_node(
             AgentBackendWorkflowNodeRunInput(
@@ -196,10 +200,11 @@ class WorkflowAgentRuntimeRequestBuilder:
                     model_settings=agent_soul.model.model_settings.model_dump(mode="json", exclude_none=True),
                 ),
                 # The execution-context layer is now the only public protocol
-                # carrier for Dify tenant/user/run identifiers. ``user_id`` must
-                # be forwarded here because downstream plugin-daemon provider and
-                # tool clients read it from this layer rather than from any
-                # parallel top-level request field.
+                # carrier for Dify tenant/user/run identifiers. ``user_id`` and
+                # ``user_from`` must be forwarded here because downstream plugin-
+                # daemon provider/tool clients and knowledge-base layers read
+                # caller identity from this layer rather than from any parallel
+                # top-level request field.
                 execution_context=DifyExecutionContextLayerConfig(
                     tenant_id=context.dify_context.tenant_id,
                     user_id=context.dify_context.user_id,
@@ -220,6 +225,7 @@ class WorkflowAgentRuntimeRequestBuilder:
                 user_prompt=user_prompt,
                 output=self._build_output_config(node_job.declared_outputs),
                 tools=tools_layer,
+                knowledge=knowledge_config,
                 drive_config=drive_config,
                 ask_human_config=build_ask_human_layer_config(agent_soul),
                 include_shell=dify_config.AGENT_SHELL_ENABLED,
@@ -395,7 +401,11 @@ class WorkflowAgentRuntimeRequestBuilder:
 
     @staticmethod
     def _schema_for_declared_output(output: DeclaredOutputConfig) -> dict[str, Any]:
-        schema = WorkflowAgentRuntimeRequestBuilder._schema_for_type(output.type, array_item=output.array_item)
+        schema = WorkflowAgentRuntimeRequestBuilder._schema_for_type(
+            output.type,
+            array_item=output.array_item,
+            children=output.children,
+        )
         if output.description:
             schema["description"] = output.description
         return schema
@@ -405,6 +415,7 @@ class WorkflowAgentRuntimeRequestBuilder:
         output_type: DeclaredOutputType,
         *,
         array_item: DeclaredArrayItem | None = None,
+        children: Sequence[DeclaredOutputChildConfig] | None = None,
     ) -> dict[str, Any]:
         match output_type:
             case DeclaredOutputType.STRING:
@@ -414,18 +425,23 @@ class WorkflowAgentRuntimeRequestBuilder:
             case DeclaredOutputType.BOOLEAN:
                 return {"type": "boolean"}
             case DeclaredOutputType.OBJECT:
-                return {"type": "object"}
+                object_schema: dict[str, Any] = {"type": "object"}
+                WorkflowAgentRuntimeRequestBuilder._apply_child_properties(object_schema, children or [])
+                return object_schema
             case DeclaredOutputType.ARRAY:
                 # Stage 4 §4.2: items shape mirrors the declared array_item.
                 # Validator guarantees array_item is set when type is array.
                 item_type = array_item.type if array_item else DeclaredOutputType.OBJECT
-                schema: dict[str, Any] = {
+                array_schema: dict[str, Any] = {
                     "type": "array",
-                    "items": WorkflowAgentRuntimeRequestBuilder._schema_for_type(item_type),
+                    "items": WorkflowAgentRuntimeRequestBuilder._schema_for_type(
+                        item_type,
+                        children=array_item.children if array_item else None,
+                    ),
                 }
                 if array_item is not None and array_item.description:
-                    schema["items"]["description"] = array_item.description
-                return schema
+                    array_schema["items"]["description"] = array_item.description
+                return array_schema
             case DeclaredOutputType.FILE:
                 return {
                     "oneOf": [
@@ -469,6 +485,27 @@ class WorkflowAgentRuntimeRequestBuilder:
                 }
         assert_never(output_type)
 
+    @staticmethod
+    def _apply_child_properties(schema: dict[str, Any], children: Sequence[DeclaredOutputChildConfig]) -> None:
+        if not children:
+            return
+        properties: dict[str, Any] = {}
+        required: list[str] = []
+        for child in children:
+            child_schema = WorkflowAgentRuntimeRequestBuilder._schema_for_type(
+                child.type,
+                array_item=child.array_item,
+                children=child.children,
+            )
+            if child.description:
+                child_schema["description"] = child.description
+            properties[child.name] = child_schema
+            if child.required:
+                required.append(child.name)
+        schema["properties"] = properties
+        if required:
+            schema["required"] = required
+
     @staticmethod
     def _normalize_credentials(credentials: Mapping[str, Any]) -> dict[str, str | int | float | bool | None]:
         normalized: dict[str, str | int | float | bool | None] = {}
@@ -502,6 +539,45 @@ def build_shell_layer_config(agent_soul: AgentSoulConfig) -> DifyShellLayerConfi
     )
 
 
+def build_knowledge_layer_config(agent_soul: AgentSoulConfig) -> DifyKnowledgeBaseLayerConfig | None:
+    """Map Agent Soul knowledge config into the fixed Dify knowledge-base layer.
+
+    Normalization intentionally matches the current dify-agent runtime contract:
+
+    - blank or missing dataset ids are ignored;
+    - if no valid dataset ids remain, no knowledge layer is injected;
+    - retrieval mode is always forced to ``multiple`` in this first wiring pass;
+    - ``top_k`` falls back to a stable runtime default when the soul omits it;
+    - ``score_threshold`` is only forwarded when the product config explicitly
+      enables it, otherwise the layer keeps the disabled/default ``0.0`` value;
+    - metadata filtering stays at the layer DTO default (disabled).
+    """
+    dataset_ids = list_configured_knowledge_dataset_ids(agent_soul)
+    if not dataset_ids:
+        return None
+
+    query_config = agent_soul.knowledge.query_config
+    return DifyKnowledgeBaseLayerConfig(
+        dataset_ids=dataset_ids,
+        retrieval=DifyKnowledgeRetrievalConfig(
+            mode="multiple",
+            top_k=_knowledge_top_k(query_config),
+            score_threshold=_knowledge_score_threshold(query_config),
+        ),
+    )
+
+
+def _knowledge_top_k(query_config: AgentKnowledgeQueryConfig) -> int:
+    top_k = query_config.top_k
+    return top_k if isinstance(top_k, int) and top_k >= 1 else 4
+
+
+def _knowledge_score_threshold(query_config: AgentKnowledgeQueryConfig) -> float:
+    if query_config.score_threshold_enabled and query_config.score_threshold is not None:
+        return query_config.score_threshold
+    return 0.0
+
+
 def build_ask_human_layer_config(agent_soul: AgentSoulConfig) -> DifyAskHumanLayerConfig | None:
     """Enable the dify.ask_human deferred tool when the soul configures human involvement.
 
@@ -669,7 +745,13 @@ def _shell_secret_ref(item: object) -> DifyShellSecretRefConfig | None:
     name = _name_from_mapping(data)
     if name is None:
         return None
-    ref = data.get("ref") or data.get("id") or data.get("credential_id") or data.get("provider_credential_id")
+    ref = (
+        data.get("ref")
+        or data.get("value")
+        or data.get("id")
+        or data.get("credential_id")
+        or data.get("provider_credential_id")
+    )
     return DifyShellSecretRefConfig(name=name, ref=str(ref) if ref is not None else None)
 
 
diff --git a/api/core/workflow/nodes/knowledge_retrieval/knowledge_retrieval_node.py b/api/core/workflow/nodes/knowledge_retrieval/knowledge_retrieval_node.py
index 1d938dd04c5..6f1660390d3 100644
--- a/api/core/workflow/nodes/knowledge_retrieval/knowledge_retrieval_node.py
+++ b/api/core/workflow/nodes/knowledge_retrieval/knowledge_retrieval_node.py
@@ -297,25 +297,26 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
         for cond in conditions.conditions or []:
             value = cond.value
             resolved_value: str | Sequence[str] | int | float | None
-            if isinstance(value, str):
-                segment_group = variable_pool.convert_template(value)
-                if len(segment_group.value) == 1:
-                    resolved_value = _normalize_metadata_filter_scalar(segment_group.value[0].to_object())
-                else:
-                    resolved_value = segment_group.text
-            elif isinstance(value, Sequence) and all(isinstance(v, str) for v in value):
-                resolved_values: list[str] = []
-                for v in value:
-                    segment_group = variable_pool.convert_template(v)
+            match value:
+                case str():
+                    segment_group = variable_pool.convert_template(value)
                     if len(segment_group.value) == 1:
-                        resolved_values.append(
-                            _normalize_metadata_filter_sequence_item(segment_group.value[0].to_object())
-                        )
+                        resolved_value = _normalize_metadata_filter_scalar(segment_group.value[0].to_object())
                     else:
-                        resolved_values.append(segment_group.text)
-                resolved_value = resolved_values
-            else:
-                resolved_value = value
+                        resolved_value = segment_group.text
+                case _ if isinstance(value, Sequence) and all(isinstance(v, str) for v in value):
+                    resolved_values: list[str] = []
+                    for v in value:
+                        segment_group = variable_pool.convert_template(v)
+                        if len(segment_group.value) == 1:
+                            resolved_values.append(
+                                _normalize_metadata_filter_sequence_item(segment_group.value[0].to_object())
+                            )
+                        else:
+                            resolved_values.append(segment_group.text)
+                    resolved_value = resolved_values
+                case _:
+                    resolved_value = value
             resolved_conditions.append(
                 Condition(
                     name=cond.name,
diff --git a/api/dev/generate_swagger_markdown_docs.py b/api/dev/generate_swagger_markdown_docs.py
index 7028f740e02..72bc56daf87 100644
--- a/api/dev/generate_swagger_markdown_docs.py
+++ b/api/dev/generate_swagger_markdown_docs.py
@@ -167,6 +167,12 @@ def _patch_union_schema_markdown(markdown: str, spec_path: Path) -> str:
     return markdown
 
 
+def _strip_trailing_line_whitespace(markdown: str) -> str:
+    """Remove converter-emitted trailing whitespace without changing line structure."""
+
+    return "\n".join(line.rstrip(" \t") for line in markdown.split("\n"))
+
+
 def _convert_spec_to_markdown(spec_path: Path, markdown_path: Path) -> None:
     markdown_path.parent.mkdir(parents=True, exist_ok=True)
     with tempfile.TemporaryDirectory(prefix=f"{markdown_path.stem}-") as temp_dir:
@@ -201,6 +207,7 @@ def _convert_spec_to_markdown(spec_path: Path, markdown_path: Path) -> None:
             temp_markdown_path.read_text(encoding="utf-8"),
             spec_path,
         )
+        converted_markdown = _strip_trailing_line_whitespace(converted_markdown)
         if not converted_markdown.strip():
             raise RuntimeError(f"swagger-markdown wrote an empty document for {markdown_path}")
 
diff --git a/api/dev/generate_swagger_specs.py b/api/dev/generate_swagger_specs.py
index d3b62511ea6..868f9e87776 100644
--- a/api/dev/generate_swagger_specs.py
+++ b/api/dev/generate_swagger_specs.py
@@ -104,11 +104,14 @@ def _field_signature(field: object) -> object:
         "description",
         "example",
         "max",
+        "max_items",
         "min",
+        "min_items",
         "nullable",
         "readonly",
         "required",
         "title",
+        "unique",
     ):
         if hasattr(field_instance, attr_name):
             signature[attr_name] = _jsonable_schema_value(getattr(field_instance, attr_name))
@@ -154,9 +157,9 @@ def create_spec_app() -> Flask:
 
     apply_runtime_defaults()
 
-    from libs.flask_restx_compat import patch_swagger_for_inline_nested_dicts
+    from libs.flask_restx_compat import install_swagger_compatibility
 
-    patch_swagger_for_inline_nested_dicts()
+    install_swagger_compatibility()
 
     app = Flask(__name__)
 
diff --git a/api/dev/lint_response_contracts.py b/api/dev/lint_response_contracts.py
index 4ba79e0fedb..75c5f67b8ff 100644
--- a/api/dev/lint_response_contracts.py
+++ b/api/dev/lint_response_contracts.py
@@ -354,11 +354,12 @@ def iter_method_nodes(method: MethodNode) -> Iterable[ast.AST]:
 
 
 def target_names(target: ast.AST) -> Iterable[str]:
-    if isinstance(target, ast.Name):
-        yield target.id
-    elif isinstance(target, ast.Tuple | ast.List):
-        for item in target.elts:
-            yield from target_names(item)
+    match target:
+        case ast.Name():
+            yield target.id
+        case ast.Tuple() | ast.List():
+            for item in target.elts:
+                yield from target_names(item)
 
 
 def record_assignment(
diff --git a/api/extensions/ext_commands.py b/api/extensions/ext_commands.py
index 4d60bdb5f65..6cd4b08b900 100644
--- a/api/extensions/ext_commands.py
+++ b/api/extensions/ext_commands.py
@@ -26,6 +26,7 @@ def init_app(app: DifyApp):
         install_plugins,
         install_rag_pipeline_plugins,
         migrate_data_for_plugin,
+        migrate_member_roles_to_rbac,
         migrate_oss,
         migration_data_wizard,
         old_metadata_migration,
@@ -54,6 +55,7 @@ def init_app(app: DifyApp):
         upgrade_db,
         fix_app_site_missing,
         migrate_data_for_plugin,
+        migrate_member_roles_to_rbac,
         backfill_plugin_auto_upgrade,
         extract_plugins,
         extract_unique_plugins,
diff --git a/api/extensions/ext_login.py b/api/extensions/ext_login.py
index ee469cd9a5b..0ae018f6a1d 100644
--- a/api/extensions/ext_login.py
+++ b/api/extensions/ext_login.py
@@ -14,6 +14,7 @@ from extensions.ext_database import db
 from libs.passport import PassportService
 from libs.token import extract_access_token, extract_console_cookie_token, extract_webapp_passport
 from models import Account, Tenant, TenantAccountJoin
+from models.enums import EndUserType
 from models.model import AppMCPServer, EndUser
 from services.account_service import AccountService
 
@@ -136,7 +137,7 @@ def load_user_from_request(request_from_flask_login: Request) -> LoginUser | Non
         if not app_mcp_server:
             raise NotFound("App MCP server not found.")
         end_user = db.session.scalar(
-            select(EndUser).where(EndUser.session_id == app_mcp_server.id, EndUser.type == "mcp").limit(1)
+            select(EndUser).where(EndUser.session_id == app_mcp_server.id, EndUser.type == EndUserType.MCP).limit(1)
         )
         if not end_user:
             raise NotFound("End user not found.")
diff --git a/api/fields/agent_fields.py b/api/fields/agent_fields.py
index 0f22fd9a869..ec64395d6fd 100644
--- a/api/fields/agent_fields.py
+++ b/api/fields/agent_fields.py
@@ -1,8 +1,10 @@
+from datetime import datetime
 from typing import Annotated, Literal
 
-from pydantic import Field
+from pydantic import Field, field_validator
 
 from fields.base import ResponseModel
+from libs.helper import to_timestamp
 from models.agent import (
     AgentConfigRevisionOperation,
     AgentIconType,
@@ -34,7 +36,13 @@ from services.entities.agent_entities import (
 class AgentConfigSnapshotSummaryResponse(ResponseModel):
     id: str
     agent_id: str | None = None
+    # User-facing version number among visible published versions.
     version: int
+    # Alias for the user-facing version number; kept explicit for clients that
+    # want to distinguish it from the immutable snapshot sequence.
+    display_version: int | None = None
+    # Immutable snapshot sequence number used internally for audit/history.
+    snapshot_version: int | None = None
     summary: str | None = None
     version_note: str | None = None
     created_by: str | None = None
@@ -70,6 +78,7 @@ class AgentRosterResponse(ResponseModel):
     workflow_node_id: str | None = None
     active_config_snapshot_id: str | None = None
     active_config_snapshot: AgentConfigSnapshotSummaryResponse | None = None
+    active_config_is_published: bool = False
     status: AgentStatus
     created_by: str | None = None
     updated_by: str | None = None
@@ -104,6 +113,163 @@ class AgentInviteOptionsResponse(ResponseModel):
     has_more: bool
 
 
+class AgentLogSourceResponse(ResponseModel):
+    id: str
+    type: Literal["webapp", "workflow"]
+    app_id: str
+    app_name: str
+    app_icon_type: str | None = None
+    app_icon: str | None = None
+    app_icon_background: str | None = None
+    workflow_id: str | None = None
+    workflow_version: str | None = None
+    node_id: str | None = None
+
+
+class AgentLogSourceGroupResponse(ResponseModel):
+    type: Literal["webapp", "workflow"]
+    label: str
+    sources: list[AgentLogSourceResponse] = Field(default_factory=list)
+
+
+class AgentLogSourceListResponse(ResponseModel):
+    data: list[AgentLogSourceResponse]
+    groups: list[AgentLogSourceGroupResponse]
+
+
+class AgentLogConversationItemResponse(ResponseModel):
+    id: str
+    conversation_id: str
+    title: str | None = None
+    end_user_id: str | None = None
+    message_count: int
+    user_rate: float | None = None
+    operation_rate: float | None = None
+    unread: bool
+    source: AgentLogSourceResponse | None = None
+    status: Literal["success", "failed", "paused"]
+    created_at: int | None = None
+    updated_at: int | None = None
+
+    @field_validator("created_at", "updated_at", mode="before")
+    @classmethod
+    def _normalize_timestamp(cls, value: datetime | int | None) -> int | None:
+        return to_timestamp(value)
+
+
+class AgentLogMessageItemResponse(ResponseModel):
+    id: str
+    message_id: str
+    conversation_id: str
+    query: str
+    answer: str
+    status: str
+    error: str | None = None
+    from_end_user_id: str | None = None
+    from_account_id: str | None = None
+    message_tokens: int
+    answer_tokens: int
+    total_tokens: int
+    total_price: str
+    currency: str
+    latency: float
+    created_at: int | None = None
+    updated_at: int | None = None
+
+    @field_validator("created_at", "updated_at", mode="before")
+    @classmethod
+    def _normalize_timestamp(cls, value: datetime | int | None) -> int | None:
+        return to_timestamp(value)
+
+
+class AgentLogListResponse(ResponseModel):
+    data: list[AgentLogConversationItemResponse]
+    page: int
+    limit: int
+    total: int
+    has_more: bool
+
+
+class AgentLogMessageListResponse(ResponseModel):
+    data: list[AgentLogMessageItemResponse]
+    page: int
+    limit: int
+    total: int
+    has_more: bool
+
+
+class AgentStatisticSummaryResponse(ResponseModel):
+    total_messages: int
+    total_conversations: int
+    total_end_users: int
+    total_tokens: int
+    total_price: str
+    currency: str
+    average_session_interactions: float
+    average_response_time: float
+    tokens_per_second: float
+    user_satisfaction_rate: float
+
+
+class AgentDailyMessageStatisticResponse(ResponseModel):
+    date: str
+    message_count: int
+
+
+class AgentDailyConversationStatisticResponse(ResponseModel):
+    date: str
+    conversation_count: int
+
+
+class AgentDailyEndUserStatisticResponse(ResponseModel):
+    date: str
+    terminal_count: int
+
+
+class AgentTokenUsageStatisticResponse(ResponseModel):
+    date: str
+    token_count: int
+    total_price: str
+    currency: str
+
+
+class AgentAverageSessionInteractionStatisticResponse(ResponseModel):
+    date: str
+    interactions: float
+
+
+class AgentAverageResponseTimeStatisticResponse(ResponseModel):
+    date: str
+    latency: float
+
+
+class AgentTokensPerSecondStatisticResponse(ResponseModel):
+    date: str
+    tps: float
+
+
+class AgentUserSatisfactionRateStatisticResponse(ResponseModel):
+    date: str
+    rate: float
+
+
+class AgentStatisticChartsResponse(ResponseModel):
+    daily_messages: list[AgentDailyMessageStatisticResponse] = Field(default_factory=list)
+    daily_conversations: list[AgentDailyConversationStatisticResponse] = Field(default_factory=list)
+    daily_end_users: list[AgentDailyEndUserStatisticResponse] = Field(default_factory=list)
+    token_usage: list[AgentTokenUsageStatisticResponse] = Field(default_factory=list)
+    average_session_interactions: list[AgentAverageSessionInteractionStatisticResponse] = Field(default_factory=list)
+    average_response_time: list[AgentAverageResponseTimeStatisticResponse] = Field(default_factory=list)
+    tokens_per_second: list[AgentTokensPerSecondStatisticResponse] = Field(default_factory=list)
+    user_satisfaction_rate: list[AgentUserSatisfactionRateStatisticResponse] = Field(default_factory=list)
+
+
+class AgentStatisticSummaryEnvelopeResponse(ResponseModel):
+    source: str
+    summary: AgentStatisticSummaryResponse
+    charts: AgentStatisticChartsResponse
+
+
 class AgentConfigRevisionResponse(ResponseModel):
     id: str
     previous_snapshot_id: str | None = None
diff --git a/api/fields/app_fields.py b/api/fields/app_fields.py
index 9b197da4433..96d8fbdf34c 100644
--- a/api/fields/app_fields.py
+++ b/api/fields/app_fields.py
@@ -100,6 +100,7 @@ app_detail_fields = {
     "updated_at": TimestampField,
     "access_mode": fields.String,
     "tags": fields.List(fields.Nested(tag_fields)),
+    "permission_keys": fields.List(fields.String()),
 }
 
 prompt_config_fields = {
@@ -137,6 +138,7 @@ app_partial_fields = {
     "create_user_name": fields.String,
     "author_name": fields.String,
     "has_draft_trigger": fields.Boolean,
+    "permission_keys": fields.List(fields.String()),
 }
 
 
@@ -217,6 +219,7 @@ app_detail_fields_with_site = {
     "deleted_tools": fields.List(fields.Nested(deleted_tool_fields)),
     "access_mode": fields.String,
     "tags": fields.List(fields.Nested(tag_fields)),
+    "permission_keys": fields.List(fields.String()),
     "site": fields.Nested(site_fields),
 }
 
diff --git a/api/fields/dataset_fields.py b/api/fields/dataset_fields.py
index 35a22ea4044..ea506d2a7e4 100644
--- a/api/fields/dataset_fields.py
+++ b/api/fields/dataset_fields.py
@@ -15,6 +15,7 @@ dataset_fields = {
     "indexing_technique": fields.String,
     "created_by": fields.String,
     "created_at": TimestampField,
+    "permission_keys": fields.List(fields.String()),
 }
 
 
@@ -143,6 +144,7 @@ dataset_detail_fields = {
     "total_available_documents": fields.Integer,
     "enable_api": fields.Boolean,
     "is_multimodal": fields.Boolean,
+    "permission_keys": fields.List(fields.String()),
 }
 
 
@@ -267,6 +269,8 @@ class DatasetDetailResponse(ResponseModel):
     total_available_documents: int
     enable_api: bool
     is_multimodal: bool
+    permission_keys: list[str] = Field(default_factory=list)
+    maintainer: str | None = None
 
     @field_validator("created_at", "updated_at", mode="before")
     @classmethod
diff --git a/api/fields/member_fields.py b/api/fields/member_fields.py
index 7ae5e3b652b..9bbcbef8429 100644
--- a/api/fields/member_fields.py
+++ b/api/fields/member_fields.py
@@ -3,7 +3,7 @@ from __future__ import annotations
 from datetime import datetime
 
 from flask_restx import fields
-from pydantic import computed_field, field_validator
+from pydantic import Field, computed_field, field_validator
 
 from fields.base import ResponseModel
 from libs.helper import build_avatar_url, to_timestamp
@@ -56,6 +56,7 @@ class AccountWithRole(_AccountAvatar):
     last_active_at: int | None = None
     created_at: int | None = None
     role: str
+    roles: list[dict[str, str]] = Field(default_factory=list)
     status: str
 
     @field_validator("last_login_at", "last_active_at", "created_at", mode="before")
diff --git a/api/libs/broadcast_channel/redis/_subscription.py b/api/libs/broadcast_channel/redis/_subscription.py
index 15355a77620..5af42d12538 100644
--- a/api/libs/broadcast_channel/redis/_subscription.py
+++ b/api/libs/broadcast_channel/redis/_subscription.py
@@ -94,12 +94,13 @@ class RedisSubscriptionBase(Subscription):
                 continue
 
             channel_field = raw_message.get("channel")
-            if isinstance(channel_field, bytes):
-                channel_name = channel_field.decode("utf-8")
-            elif isinstance(channel_field, str):
-                channel_name = channel_field
-            else:
-                channel_name = str(channel_field)
+            match channel_field:
+                case bytes():
+                    channel_name = channel_field.decode("utf-8")
+                case str():
+                    channel_name = channel_field
+                case _:
+                    channel_name = str(channel_field)
 
             if channel_name != self._topic:
                 _logger.warning(
diff --git a/api/libs/broadcast_channel/redis/sharded_channel.py b/api/libs/broadcast_channel/redis/sharded_channel.py
index a7303c07823..68e9f8b23ef 100644
--- a/api/libs/broadcast_channel/redis/sharded_channel.py
+++ b/api/libs/broadcast_channel/redis/sharded_channel.py
@@ -88,22 +88,23 @@ class _RedisShardedSubscription(RedisSubscriptionBase):
         #
         # Since we have already filtered at the caller's site, we can safely set
         # `ignore_subscribe_messages=False`.
-        if isinstance(self._client, RedisCluster):
-            # NOTE(QuantumGhost): due to an issue in upstream code, calling `get_sharded_message` without
-            # specifying the `target_node` argument would use busy-looping to wait
-            # for incoming message, consuming excessive CPU quota.
-            #
-            # Here we specify the `target_node` to mitigate this problem.
-            node = self._client.get_node_from_key(self._topic)
-            return self._pubsub.get_sharded_message(  # type: ignore[attr-defined]
-                ignore_subscribe_messages=False,
-                timeout=1,
-                target_node=node,
-            )
-        elif isinstance(self._client, Redis):
-            return self._pubsub.get_sharded_message(ignore_subscribe_messages=False, timeout=1)  # type: ignore[attr-defined]
-        else:
-            raise AssertionError("client should be either Redis or RedisCluster.")
+        match self._client:
+            case RedisCluster():
+                # NOTE(QuantumGhost): due to an issue in upstream code, calling `get_sharded_message` without
+                # specifying the `target_node` argument would use busy-looping to wait
+                # for incoming message, consuming excessive CPU quota.
+                #
+                # Here we specify the `target_node` to mitigate this problem.
+                node = self._client.get_node_from_key(self._topic)
+                return self._pubsub.get_sharded_message(  # type: ignore[attr-defined]
+                    ignore_subscribe_messages=False,
+                    timeout=1,
+                    target_node=node,
+                )
+            case Redis():
+                return self._pubsub.get_sharded_message(ignore_subscribe_messages=False, timeout=1)  # type: ignore[attr-defined]
+            case _:
+                raise AssertionError("client should be either Redis or RedisCluster.")
 
     @override
     def _get_message_type(self) -> str:
diff --git a/api/libs/broadcast_channel/redis/streams_channel.py b/api/libs/broadcast_channel/redis/streams_channel.py
index 30c14585793..62e58798ab3 100644
--- a/api/libs/broadcast_channel/redis/streams_channel.py
+++ b/api/libs/broadcast_channel/redis/streams_channel.py
@@ -138,10 +138,11 @@ class _StreamsSubscription(Subscription):
                         if isinstance(fields, dict):
                             data = fields.get(b"data")
                         data_bytes: bytes | None = None
-                        if isinstance(data, str):
-                            data_bytes = data.encode()
-                        elif isinstance(data, (bytes, bytearray)):
-                            data_bytes = bytes(data)
+                        match data:
+                            case str():
+                                data_bytes = data.encode()
+                            case bytes() | bytearray():
+                                data_bytes = bytes(data)
                         if data_bytes is not None:
                             self._queue.put_nowait(data_bytes)
                         last_id = entry_id
diff --git a/api/libs/external_api.py b/api/libs/external_api.py
index 43f7c409f5b..06419b16f88 100644
--- a/api/libs/external_api.py
+++ b/api/libs/external_api.py
@@ -9,7 +9,7 @@ from werkzeug.http import HTTP_STATUS_CODES
 
 from configs import dify_config
 from core.errors.error import AppInvokeQuotaExceededError
-from libs.flask_restx_compat import patch_swagger_for_inline_nested_dicts
+from libs.flask_restx_compat import install_swagger_compatibility
 from libs.token import build_force_logout_cookie_headers
 
 
@@ -127,16 +127,22 @@ def register_external_error_handlers(api: Api, body_formatter: ErrorBodyFormatte
 class ExternalApi(Api):
     _authorizations = {
         "Bearer": {
-            "type": "apiKey",
-            "in": "header",
-            "name": "Authorization",
-            "description": "Type: Bearer {your-api-key}",
+            "bearerFormat": "API_KEY",
+            "description": "Use the Service API key as a Bearer token in the Authorization header.",
+            "scheme": "bearer",
+            "type": "http",
         }
     }
 
-    def __init__(self, app: Blueprint | Flask, *args, error_body_formatter: ErrorBodyFormatter | None = None, **kwargs):
+    def __init__(
+        self,
+        app: Blueprint | Flask,
+        *args,
+        error_body_formatter: ErrorBodyFormatter | None = None,
+        **kwargs,
+    ):
         self._error_body_formatter = error_body_formatter
-        patch_swagger_for_inline_nested_dicts()
+        install_swagger_compatibility()
         kwargs.setdefault("authorizations", self._authorizations)
         kwargs.setdefault("security", "Bearer")
         kwargs["add_specs"] = dify_config.SWAGGER_UI_ENABLED
diff --git a/api/libs/flask_restx_compat.py b/api/libs/flask_restx_compat.py
index 08fd3d9055d..75f1121af00 100644
--- a/api/libs/flask_restx_compat.py
+++ b/api/libs/flask_restx_compat.py
@@ -8,12 +8,14 @@ spec export fail or succeed in the same way.
 
 import hashlib
 import json
-from typing import TypeGuard
+from typing import TypeGuard, cast
 
 from flask import current_app
 from flask_restx import fields
+from flask_restx import swagger as restx_swagger
 from flask_restx.model import Model, OrderedModel, instance
 from flask_restx.swagger import Swagger
+from flask_restx.utils import not_none
 
 
 def _is_inline_field_map(value: object) -> TypeGuard[dict[object, object]]:
@@ -98,20 +100,29 @@ def _inline_model_name(nested_fields: dict[object, object]) -> str:
     return f"_AnonymousInlineModel_{digest}"
 
 
-def patch_swagger_for_inline_nested_dicts() -> None:
-    """Allow OpenAPI generation to handle legacy inline Flask-RESTX field dicts.
+def install_swagger_compatibility() -> None:
+    """Install Dify's Flask-RESTX OpenAPI compatibility hooks.
 
     Some existing controllers use raw field mappings in `fields.Nested({...})`
     or directly in `@namespace.response(...)`. Runtime marshalling accepts that,
     but Flask-RESTX registration expects a named model. Convert those
     anonymous mappings into temporary named models during docs generation.
+
+    Flask-RESTX also drops parameter descriptions from generated schemas and
+    does not expose the Werkzeug `uuid` route converter as `format: uuid`.
     """
 
-    if getattr(Swagger, "_dify_inline_nested_dict_patch", False):
+    if getattr(Swagger, "_dify_swagger_compatibility_installed", False):
         return
 
     original_register_model = Swagger.register_model
     original_register_field = Swagger.register_field
+    original_extract_path_params = restx_swagger.extract_path_params
+    original_schema_from_parameter = Swagger.schema_from_parameter
+    original_description_for = Swagger.description_for
+    original_serialize_operation = Swagger.serialize_operation
+    original_parameters_and_request_body_for = Swagger.parameters_and_request_body_for
+    original_request_body_from_form_params = Swagger.request_body_from_form_params
     original_as_dict = Swagger.as_dict
 
     def get_or_create_inline_model(self: Swagger, nested_fields: dict[object, object]) -> object:
@@ -134,6 +145,94 @@ def patch_swagger_for_inline_nested_dicts() -> None:
 
         original_register_field(self, field)
 
+    def schema_from_parameter_with_description(self: Swagger, param: dict[str, object]) -> dict[str, object]:
+        schema = cast(dict[str, object], original_schema_from_parameter(self, param))
+        description = param.get("description")
+        if isinstance(description, str):
+            schema["description"] = description
+        return schema
+
+    def extract_path_params_with_uuid_format(path: str):
+        params = original_extract_path_params(path)
+        for converter, _arguments, variable in restx_swagger.parse_rule(path):
+            if converter == "uuid" and variable in params:
+                params[variable]["format"] = "uuid"
+        return params
+
+    def description_for_with_explicit_summary(self: Swagger, doc: dict[str, object], method: str):
+        method_doc = doc.get(method)
+        if (
+            isinstance(method_doc, dict)
+            and isinstance(method_doc.get("summary"), str)
+            and isinstance(method_doc.get("description"), str)
+        ):
+            return method_doc["description"]
+        return original_description_for(self, doc, method)
+
+    def serialize_operation_with_explicit_summary_tags(
+        self: Swagger, doc: dict[str, object], method: str, inherited_request_body=None
+    ):
+        operation = original_serialize_operation(self, doc, method, inherited_request_body)
+        method_doc = doc.get(method)
+        if not isinstance(method_doc, dict):
+            return operation
+
+        summary = method_doc.get("summary")
+        if isinstance(summary, str):
+            operation["summary"] = summary
+
+        tags = method_doc.get("tags")
+        if isinstance(tags, list) and all(isinstance(tag, str) for tag in tags):
+            operation["tags"] = tags
+
+        return operation
+
+    def serialize_resource_with_explicit_operation_tags(self: Swagger, ns, resource, url, route_doc=None, **kwargs):
+        doc = self.extract_resource_doc(resource, url, route_doc=route_doc)
+        if doc is False:
+            return None
+
+        path_params, path_request_body = original_parameters_and_request_body_for(self, doc)
+        path: dict[str, object] = {"parameters": path_params or None}
+        methods = [method.lower() for method in resource.methods or []]
+        requested_methods = [method.lower() for method in kwargs.get("methods", [])]
+        for method in methods:
+            if doc[method] is False or requested_methods and method not in requested_methods:
+                continue
+            operation = self.serialize_operation(doc, method, path_request_body)
+            operation.setdefault("tags", [ns.name])
+            path[method] = operation
+        return not_none(path)
+
+    def request_body_from_form_params_with_file_description(self: Swagger, params: list[dict[str, object]]):
+        request_body = original_request_body_from_form_params(self, params)
+        for param in params:
+            if param.get("type") != "file":
+                continue
+
+            name = param.get("name")
+            description = param.get("description")
+            if not isinstance(name, str) or not isinstance(description, str):
+                continue
+
+            content = request_body.get("content")
+            if not isinstance(content, dict):
+                continue
+            multipart = content.get("multipart/form-data")
+            if not isinstance(multipart, dict):
+                continue
+            schema = multipart.get("schema")
+            if not isinstance(schema, dict):
+                continue
+            properties = schema.get("properties")
+            if not isinstance(properties, dict):
+                continue
+            file_schema = properties.get(name)
+            if isinstance(file_schema, dict):
+                file_schema["description"] = description
+
+        return request_body
+
     def as_dict_with_inline_dict_support(self: Swagger):
         # Temporary set RESTX_INCLUDE_ALL_MODELS = false to prevent "length changed while iterating" error
         include_all_models = current_app.config.get("RESTX_INCLUDE_ALL_MODELS", False)
@@ -145,5 +244,11 @@ def patch_swagger_for_inline_nested_dicts() -> None:
 
     Swagger.register_model = register_model_with_inline_dict_support
     Swagger.register_field = register_field_with_inline_dict_support
+    restx_swagger.extract_path_params = extract_path_params_with_uuid_format
+    Swagger.schema_from_parameter = schema_from_parameter_with_description
+    Swagger.description_for = description_for_with_explicit_summary
+    Swagger.serialize_operation = serialize_operation_with_explicit_summary_tags
+    Swagger.serialize_resource = serialize_resource_with_explicit_operation_tags
+    Swagger.request_body_from_form_params = request_body_from_form_params_with_file_description
     Swagger.as_dict = as_dict_with_inline_dict_support
-    Swagger._dify_inline_nested_dict_patch = True
+    Swagger._dify_swagger_compatibility_installed = True
diff --git a/api/libs/helper.py b/api/libs/helper.py
index ac85e88ef7f..7066f9eab45 100644
--- a/api/libs/helper.py
+++ b/api/libs/helper.py
@@ -14,7 +14,7 @@ from typing import TYPE_CHECKING, Annotated, Any, Protocol, cast, overload, over
 from uuid import UUID
 from zoneinfo import available_timezones
 
-from flask import Response, stream_with_context
+from flask import Request, Response, stream_with_context
 from flask_restx import fields
 from pydantic import BaseModel, ConfigDict, TypeAdapter, with_config
 from pydantic.functional_validators import AfterValidator
@@ -167,19 +167,6 @@ def build_avatar_url(avatar: str | None) -> str | None:
     return file_helpers.get_signed_file_url(avatar)
 
 
-class AvatarUrlField(fields.Raw):
-    @override
-    def output(self, key, obj, **kwargs):
-        if obj is None:
-            return None
-
-        from models import Account
-
-        if isinstance(obj, Account) and obj.avatar is not None:
-            return build_avatar_url(obj.avatar)
-        return None
-
-
 class TimestampField(fields.Raw):
     @override
     def schema(self) -> dict[str, object]:
@@ -397,7 +384,7 @@ def generate_string(n):
     return result
 
 
-def extract_remote_ip(request) -> str:
+def extract_remote_ip(request: Request) -> str:
     if request.headers.get("CF-Connecting-IP"):
         return cast(str, request.headers.get("CF-Connecting-IP"))
     elif request.headers.getlist("X-Forwarded-For"):
diff --git a/api/libs/oauth_bearer.py b/api/libs/oauth_bearer.py
index 7433c6c177a..36de4b85ae0 100644
--- a/api/libs/oauth_bearer.py
+++ b/api/libs/oauth_bearer.py
@@ -490,7 +490,8 @@ def check_workspace_membership(
     account_id: uuid.UUID | str,
     tenant_id: str,
     token_hash: str,
-    membership_cache: dict[str, bool],
+    membership_cache: dict[str, bool] | None = None,
+    cached_verdicts: dict[str, bool] | None = None,
 ) -> None:
     """Layer-0 enforcement core. Raises `Forbidden` on deny, returns on allow.
 
@@ -499,7 +500,8 @@ def check_workspace_membership(
     short-circuiting on EE / SSO subjects before invoking — this function
     runs the membership + active-status checks unconditionally.
     """
-    cached = membership_cache.get(tenant_id)
+    cache = membership_cache if membership_cache is not None else cached_verdicts or {}
+    cached = cache.get(tenant_id)
     if cached is True:
         return
     if cached is False:
diff --git a/api/migrations/versions/2026_06_15_1200-a7c4e9d2f681_add_resource_maintainers.py b/api/migrations/versions/2026_06_15_1200-a7c4e9d2f681_add_resource_maintainers.py
new file mode 100644
index 00000000000..455d7446ca1
--- /dev/null
+++ b/api/migrations/versions/2026_06_15_1200-a7c4e9d2f681_add_resource_maintainers.py
@@ -0,0 +1,41 @@
+"""add resource maintainers
+
+Revision ID: a7c4e9d2f681
+Revises: d2f1a4b8c3e0
+Create Date: 2026-06-15 12:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+import models.types
+
+# revision identifiers, used by Alembic.
+revision = "a7c4e9d2f681"
+down_revision = "d2f1a4b8c3e0"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("apps", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("maintainer", models.types.StringUUID(), nullable=True))
+        batch_op.create_index("app_tenant_maintainer_idx", ["tenant_id", "maintainer"], unique=False)
+
+    with op.batch_alter_table("datasets", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("maintainer", models.types.StringUUID(), nullable=True))
+        batch_op.create_index("dataset_tenant_maintainer_idx", ["tenant_id", "maintainer"], unique=False)
+
+    op.execute(sa.text("UPDATE apps SET maintainer = created_by WHERE maintainer IS NULL"))
+    op.execute(sa.text("UPDATE datasets SET maintainer = created_by WHERE maintainer IS NULL"))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("datasets", schema=None) as batch_op:
+        batch_op.drop_index("dataset_tenant_maintainer_idx")
+        batch_op.drop_column("maintainer")
+
+    with op.batch_alter_table("apps", schema=None) as batch_op:
+        batch_op.drop_index("app_tenant_maintainer_idx")
+        batch_op.drop_column("maintainer")
diff --git a/api/migrations/versions/2026_06_15_1500-4f7b2c8d9a10_normalize_legacy_end_user_type.py b/api/migrations/versions/2026_06_15_1500-4f7b2c8d9a10_normalize_legacy_end_user_type.py
new file mode 100644
index 00000000000..9494d9af5f5
--- /dev/null
+++ b/api/migrations/versions/2026_06_15_1500-4f7b2c8d9a10_normalize_legacy_end_user_type.py
@@ -0,0 +1,24 @@
+"""normalize legacy end user type
+
+Revision ID: 4f7b2c8d9a10
+Revises: a7c4e9d2f681
+Create Date: 2026-06-15 15:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "4f7b2c8d9a10"
+down_revision = "a7c4e9d2f681"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute(sa.text("UPDATE end_users SET type = 'service-api' WHERE type = 'service_api'"))
+
+
+def downgrade() -> None:
+    op.execute(sa.text("UPDATE end_users SET type = 'service_api' WHERE type = 'service-api'"))
diff --git a/api/models/account.py b/api/models/account.py
index 66766693a5b..df152e1783c 100644
--- a/api/models/account.py
+++ b/api/models/account.py
@@ -11,6 +11,8 @@ from sqlalchemy import DateTime, String, func, select
 from sqlalchemy.orm import Mapped, Session, mapped_column
 from typing_extensions import deprecated
 
+from configs import dify_config
+
 from .base import TypeBase
 from .engine import db
 from .types import EnumText, LongText, StringUUID
@@ -187,10 +189,14 @@ class Account(UserMixin, TypeBase):
     # check current_user.current_tenant.current_role in ['admin', 'owner']
     @property
     def is_admin_or_owner(self):
+        if dify_config.RBAC_ENABLED:
+            return True
         return TenantAccountRole.is_privileged_role(self.role)
 
     @property
     def is_admin(self):
+        if dify_config.RBAC_ENABLED:
+            return True
         return TenantAccountRole.is_admin_role(self.role)
 
     @property
@@ -216,14 +222,20 @@ class Account(UserMixin, TypeBase):
         - `ADMIN`
         - `EDITOR`
         """
+        if dify_config.RBAC_ENABLED:
+            return True
         return TenantAccountRole.is_editing_role(self.role)
 
     @property
     def is_dataset_editor(self):
+        if dify_config.RBAC_ENABLED:
+            return True
         return TenantAccountRole.is_dataset_edit_role(self.role)
 
     @property
     def is_dataset_operator(self):
+        if dify_config.RBAC_ENABLED:
+            return True
         return self.role == TenantAccountRole.DATASET_OPERATOR
 
 
diff --git a/api/models/agent.py b/api/models/agent.py
index 649835f5220..1a13ccde77b 100644
--- a/api/models/agent.py
+++ b/api/models/agent.py
@@ -324,8 +324,10 @@ class AgentRuntimeSession(DefaultFieldsMixin, Base):
       ``workflow_id / workflow_run_id / node_id / binding_id /
       agent_config_snapshot_id / composition_layer_specs`` columns are set.
     - Agent App conversations: ``owner_type = conversation``; the
-      ``conversation_id`` and ``agent_config_snapshot_id`` columns are set and
-      the workflow columns stay NULL.
+      ``conversation_id`` column is set and the workflow columns stay NULL.
+      Published/web/API runs scope runtime state by ``agent_config_snapshot_id``;
+      console debugger runs may keep it NULL so prompt-only draft saves can reuse
+      the same preview conversation state while executing the latest Agent Soul.
 
     The snapshot is runtime state returned by Agent backend, kept separate from
     Agent Soul snapshots and workflow node-job config.
diff --git a/api/models/agent_config_entities.py b/api/models/agent_config_entities.py
index 1f50924681f..76108f271d4 100644
--- a/api/models/agent_config_entities.py
+++ b/api/models/agent_config_entities.py
@@ -2,9 +2,9 @@ from __future__ import annotations
 
 import re
 from enum import StrEnum
-from typing import Any, Final, Literal
+from typing import Annotated, Any, Final, Literal
 
-from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+from pydantic import BaseModel, ConfigDict, Field, WithJsonSchema, field_validator, model_validator
 
 from core.workflow.file_reference import is_canonical_file_reference
 from graphon.file import FileTransferMethod
@@ -29,6 +29,44 @@ class DeclaredOutputType(StrEnum):
     FILE = "file"
 
 
+_DECLARED_OUTPUT_CHILDREN_JSON_SCHEMA = {
+    "type": "array",
+    "items": {
+        "type": "object",
+        "additionalProperties": False,
+        "properties": {
+            "name": {"type": "string"},
+            "type": {
+                "type": "string",
+                "enum": [item.value for item in DeclaredOutputType],
+            },
+            "description": {"anyOf": [{"type": "string"}, {"type": "null"}]},
+            "required": {"type": "boolean"},
+            "file": {"type": "object", "additionalProperties": True},
+            "array_item": {
+                "type": "object",
+                "additionalProperties": True,
+                "properties": {
+                    "type": {
+                        "type": "string",
+                        "enum": [item.value for item in DeclaredOutputType],
+                    },
+                    "description": {"anyOf": [{"type": "string"}, {"type": "null"}]},
+                    "children": {"type": "array", "items": {"type": "object", "additionalProperties": True}},
+                },
+            },
+            "children": {"type": "array", "items": {"type": "object", "additionalProperties": True}},
+        },
+        "required": ["name", "type"],
+    },
+}
+
+DeclaredOutputChildren = Annotated[
+    list["DeclaredOutputChildConfig"],
+    WithJsonSchema(_DECLARED_OUTPUT_CHILDREN_JSON_SCHEMA),
+]
+
+
 class AgentCliToolAuthorizationStatus(StrEnum):
     """Authorization state for Agent-scoped CLI tools.
 
@@ -148,6 +186,9 @@ class AgentSecretRefConfig(AgentFlexibleConfig):
     env_name: str | None = Field(default=None, max_length=255)
     variable: str | None = Field(default=None, max_length=255)
     type: str | None = Field(default=None, max_length=64)
+    # UI-facing selected secret reference. This is a credential/ref id, not the
+    # plaintext secret value; runtime maps it to the shell-layer ``ref``.
+    value: str | None = Field(default=None, max_length=255)
     id: str | None = Field(default=None, max_length=255)
     ref: str | None = Field(default=None, max_length=255)
     credential_id: str | None = Field(default=None, max_length=255)
@@ -507,11 +548,55 @@ class DeclaredArrayItem(BaseModel):
 
     type: DeclaredOutputType
     description: str | None = None
+    children: DeclaredOutputChildren = Field(default_factory=list)
 
     @model_validator(mode="after")
     def _reject_nested_array(self) -> DeclaredArrayItem:
         if self.type == DeclaredOutputType.ARRAY:
             raise ValueError("nested arrays are not supported as array_item.type")
+        if self.children and self.type != DeclaredOutputType.OBJECT:
+            raise ValueError("array_item.children is only allowed when array_item.type is object")
+        return self
+
+
+class DeclaredOutputChildConfig(BaseModel):
+    """Nested field under an object-shaped declared output.
+
+    The first backend version keeps child fields lightweight: they describe the
+    variable-picker/schema tree but do not own independent retry/check behavior.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    name: str = Field(min_length=1, max_length=255)
+    type: DeclaredOutputType
+    description: str | None = None
+    required: bool = True
+    file: DeclaredOutputFileConfig | None = None
+    array_item: DeclaredArrayItem | None = None
+    children: DeclaredOutputChildren = Field(default_factory=list)
+
+    @model_validator(mode="after")
+    def _validate_shape(self) -> DeclaredOutputChildConfig:
+        if not _OUTPUT_NAME_PATTERN.fullmatch(self.name):
+            raise ValueError(
+                f"output child name {self.name!r} must match {_OUTPUT_NAME_PATTERN.pattern} "
+                "(JSON-schema-friendly identifier)"
+            )
+        if self.type == DeclaredOutputType.FILE:
+            if self.file is None:
+                self.file = DeclaredOutputFileConfig()
+        elif self.file is not None:
+            raise ValueError("file metadata is only allowed for file output children")
+
+        if self.type == DeclaredOutputType.ARRAY:
+            if self.array_item is None:
+                self.array_item = DeclaredArrayItem(type=DeclaredOutputType.OBJECT)
+        elif self.array_item is not None:
+            raise ValueError("array_item is only allowed when child type is array")
+
+        if self.children and self.type != DeclaredOutputType.OBJECT:
+            raise ValueError("children is only allowed for object output children")
         return self
 
 
@@ -592,6 +677,7 @@ class DeclaredOutputConfig(BaseModel):
     required: bool = True
     file: DeclaredOutputFileConfig | None = None
     array_item: DeclaredArrayItem | None = None
+    children: DeclaredOutputChildren = Field(default_factory=list)
     check: DeclaredOutputCheckConfig | None = None
     failure_strategy: DeclaredOutputFailureStrategy = Field(default_factory=DeclaredOutputFailureStrategy)
 
@@ -625,6 +711,9 @@ class DeclaredOutputConfig(BaseModel):
         elif self.array_item is not None:
             raise ValueError("array_item is only allowed when type is array")
 
+        if self.children and self.type != DeclaredOutputType.OBJECT:
+            raise ValueError("children is only allowed for object outputs")
+
         # Per PRD §OUTPUT 配置框: output check is file-only.
         if self.check is not None and self.check.enabled and self.type != DeclaredOutputType.FILE:
             raise ValueError("output check is only allowed for file outputs")
diff --git a/api/models/dataset.py b/api/models/dataset.py
index 1644551925b..998bc02ee85 100644
--- a/api/models/dataset.py
+++ b/api/models/dataset.py
@@ -167,6 +167,7 @@ class Dataset(Base):
     __table_args__ = (
         sa.PrimaryKeyConstraint("id", name="dataset_pkey"),
         sa.Index("dataset_tenant_idx", "tenant_id"),
+        sa.Index("dataset_tenant_maintainer_idx", "tenant_id", "maintainer"),
         adjusted_json_index("retrieval_model_idx", "retrieval_model"),
     )
 
@@ -188,6 +189,7 @@ class Dataset(Base):
     indexing_technique: Mapped[IndexTechniqueType | None] = mapped_column(EnumText(IndexTechniqueType, length=255))
     index_struct = mapped_column(LongText, nullable=True)
     created_by = mapped_column(StringUUID, nullable=False)
+    maintainer: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
     created_at: Mapped[datetime] = mapped_column(DateTime, nullable=False, server_default=func.current_timestamp())
     updated_by = mapped_column(StringUUID, nullable=True)
     updated_at = mapped_column(
diff --git a/api/models/enums.py b/api/models/enums.py
index cdd2b136cfd..ae05fa242be 100644
--- a/api/models/enums.py
+++ b/api/models/enums.py
@@ -205,6 +205,16 @@ class InvokeFrom(StrEnum):
         return source_mapping.get(self, "dev")
 
 
+class EndUserType(StrEnum):
+    """Persisted type values for the ``end_users.type`` column."""
+
+    BROWSER = "browser"
+    MCP = "mcp"
+    OPENAPI = "openapi"
+    SERVICE_API = "service-api"
+    TRIGGER = "trigger"
+
+
 class DocumentDocType(StrEnum):
     """Document doc_type classification"""
 
diff --git a/api/models/model.py b/api/models/model.py
index 09809b85f6b..4c73385f3aa 100644
--- a/api/models/model.py
+++ b/api/models/model.py
@@ -41,6 +41,7 @@ from .enums import (
     ConversationStatus,
     CreatorUserRole,
     CustomizeTokenStrategy,
+    EndUserType,
     FeedbackFromSource,
     FeedbackRating,
     InvokeFrom,
@@ -395,7 +396,11 @@ class IconType(StrEnum):
 
 class App(Base):
     __tablename__ = "apps"
-    __table_args__ = (sa.PrimaryKeyConstraint("id", name="app_pkey"), sa.Index("app_tenant_id_idx", "tenant_id"))
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="app_pkey"),
+        sa.Index("app_tenant_id_idx", "tenant_id"),
+        sa.Index("app_tenant_maintainer_idx", "tenant_id", "maintainer"),
+    )
 
     if TYPE_CHECKING:
         # Response-only attributes attached by app list/detail enrichers.
@@ -426,6 +431,7 @@ class App(Base):
     tracing = mapped_column(LongText, nullable=True)
     max_active_requests: Mapped[int | None]
     created_by = mapped_column(StringUUID, nullable=True)
+    maintainer: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
     created_at = mapped_column(sa.DateTime, nullable=False, server_default=func.current_timestamp())
     updated_by = mapped_column(StringUUID, nullable=True)
     updated_at: Mapped[datetime] = mapped_column(
@@ -1174,34 +1180,32 @@ class Conversation(Base):
 
         # Convert file mapping to File object
         for key, value in inputs.items():
-            if (
-                isinstance(value, dict)
-                and cast(dict[str, Any], value).get("dify_model_identity") == FILE_MODEL_IDENTITY
-            ):
-                value_dict = cast(dict[str, Any], value)
-                inputs[key] = build_file_from_input_mapping(
-                    file_mapping=value_dict,
-                    tenant_resolver=tenant_resolver,
-                )
-            elif isinstance(value, list):
-                value_list = value
-                if all(
-                    isinstance(item, dict)
-                    and cast(dict[str, Any], item).get("dify_model_identity") == FILE_MODEL_IDENTITY
-                    for item in value_list
-                ):
-                    file_list: list[File] = []
-                    for item in value_list:
-                        if not isinstance(item, dict):
-                            continue
-                        item_dict = cast(dict[str, Any], item)
-                        file_list.append(
-                            build_file_from_input_mapping(
-                                file_mapping=item_dict,
-                                tenant_resolver=tenant_resolver,
+            match value:
+                case dict() if cast(dict[str, Any], value).get("dify_model_identity") == FILE_MODEL_IDENTITY:
+                    value_dict = cast(dict[str, Any], value)
+                    inputs[key] = build_file_from_input_mapping(
+                        file_mapping=value_dict,
+                        tenant_resolver=tenant_resolver,
+                    )
+                case list():
+                    value_list = value
+                    if all(
+                        isinstance(item, dict)
+                        and cast(dict[str, Any], item).get("dify_model_identity") == FILE_MODEL_IDENTITY
+                        for item in value_list
+                    ):
+                        file_list: list[File] = []
+                        for item in value_list:
+                            if not isinstance(item, dict):
+                                continue
+                            item_dict = cast(dict[str, Any], item)
+                            file_list.append(
+                                build_file_from_input_mapping(
+                                    file_mapping=item_dict,
+                                    tenant_resolver=tenant_resolver,
+                                )
                             )
-                        )
-                    inputs[key] = file_list
+                        inputs[key] = file_list
 
         return inputs
 
@@ -1516,46 +1520,45 @@ class Message(Base):
             owner_tenant_id=cast(str | None, getattr(self, "_owner_tenant_id", None)),
         )
         for key, value in inputs.items():
-            if (
-                isinstance(value, dict)
-                and cast(dict[str, Any], value).get("dify_model_identity") == FILE_MODEL_IDENTITY
-            ):
-                value_dict = cast(dict[str, Any], value)
-                inputs[key] = build_file_from_input_mapping(
-                    file_mapping=value_dict,
-                    tenant_resolver=tenant_resolver,
-                )
-            elif isinstance(value, list):
-                value_list = value
-                if all(
-                    isinstance(item, dict)
-                    and cast(dict[str, Any], item).get("dify_model_identity") == FILE_MODEL_IDENTITY
-                    for item in value_list
-                ):
-                    file_list: list[File] = []
-                    for item in value_list:
-                        if not isinstance(item, dict):
-                            continue
-                        item_dict = cast(dict[str, Any], item)
-                        file_list.append(
-                            build_file_from_input_mapping(
-                                file_mapping=item_dict,
-                                tenant_resolver=tenant_resolver,
+            match value:
+                case dict() if cast(dict[str, Any], value).get("dify_model_identity") == FILE_MODEL_IDENTITY:
+                    value_dict = cast(dict[str, Any], value)
+                    inputs[key] = build_file_from_input_mapping(
+                        file_mapping=value_dict,
+                        tenant_resolver=tenant_resolver,
+                    )
+                case list():
+                    value_list = value
+                    if all(
+                        isinstance(item, dict)
+                        and cast(dict[str, Any], item).get("dify_model_identity") == FILE_MODEL_IDENTITY
+                        for item in value_list
+                    ):
+                        file_list: list[File] = []
+                        for item in value_list:
+                            if not isinstance(item, dict):
+                                continue
+                            item_dict = cast(dict[str, Any], item)
+                            file_list.append(
+                                build_file_from_input_mapping(
+                                    file_mapping=item_dict,
+                                    tenant_resolver=tenant_resolver,
+                                )
                             )
-                        )
-                    inputs[key] = file_list
+                        inputs[key] = file_list
         return inputs
 
     @inputs.setter
     def inputs(self, value: Mapping[str, Any]):
         inputs = dict(value)
         for k, v in inputs.items():
-            if isinstance(v, File):
-                inputs[k] = v.model_dump()
-            elif isinstance(v, list):
-                v_list = v
-                if all(isinstance(item, File) for item in v_list):
-                    inputs[k] = [item.model_dump() for item in v_list if isinstance(item, File)]
+            match v:
+                case File():
+                    inputs[k] = v.model_dump()
+                case list():
+                    v_list = v
+                    if all(isinstance(item, File) for item in v_list):
+                        inputs[k] = [item.model_dump() for item in v_list if isinstance(item, File)]
         self._inputs = inputs
 
     @property
@@ -2081,7 +2084,7 @@ class EndUser(Base, UserMixin):
     id: Mapped[str] = mapped_column(StringUUID, default=lambda: str(uuid4()))
     tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
     app_id = mapped_column(StringUUID, nullable=True)
-    type: Mapped[str] = mapped_column(String(255), nullable=False)
+    type: Mapped[EndUserType] = mapped_column(EnumText(EndUserType, length=255), nullable=False)
     external_user_id = mapped_column(String(255), nullable=True)
     name = mapped_column(String(255))
     _is_anonymous: Mapped[bool] = mapped_column(
diff --git a/api/models/types.py b/api/models/types.py
index 092db638565..c5a9231ad4a 100644
--- a/api/models/types.py
+++ b/api/models/types.py
@@ -96,12 +96,13 @@ class JSONModelColumn[T: BaseModel](TypeDecorator[T | None]):
     def process_bind_param(self, value: T | dict[str, Any] | str | None, dialect: Dialect) -> str | None:
         if value is None:
             return None
-        if isinstance(value, self._model_class):
-            model = value
-        elif isinstance(value, str):
-            model = self._model_class.model_validate_json(value)
-        else:
-            model = self._model_class.model_validate(value)
+        match value:
+            case _ if isinstance(value, self._model_class):
+                model = value
+            case str():
+                model = self._model_class.model_validate_json(value)
+            case _:
+                model = self._model_class.model_validate(value)
         return json.dumps(model.model_dump(mode="json"), ensure_ascii=False, sort_keys=True, separators=(",", ":"))
 
     @override
diff --git a/api/openapi/markdown/console-openapi.md b/api/openapi/markdown/console-openapi.md
index 688f22e0e84..123a2e6e04b 100644
--- a/api/openapi/markdown/console-openapi.md
+++ b/api/openapi/markdown/console-openapi.md
@@ -4,10 +4,9 @@ Console management APIs for app configuration, monitoring, and administration
 ## Version: 1.0
 
 ### Available authorizations
-#### Bearer (API Key Authentication)
-Type: Bearer {your-api-key}  
-**Name:** Authorization  
-**In:** header  
+#### Bearer (HTTP, bearer)
+Use the Service API key as a Bearer token in the Authorization header.
+Bearer format: API_KEY
 
 ---
 ## console
@@ -311,7 +310,7 @@ Check if activation token is valid
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Agent app list | **application/json**: [AppPagination](#apppagination)<br> |
+| 200 | Agent app list | **application/json**: [AgentAppPagination](#agentapppagination)<br> |
 
 ### [POST] /agent
 #### Request Body
@@ -324,7 +323,7 @@ Check if activation token is valid
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 201 | Agent app created successfully | **application/json**: [AppDetailWithSite](#appdetailwithsite)<br> |
+| 201 | Agent app created successfully | **application/json**: [AgentAppDetailWithSite](#agentappdetailwithsite)<br> |
 | 400 | Invalid request parameters |  |
 | 403 | Insufficient permissions |  |
 
@@ -349,7 +348,7 @@ Check if activation token is valid
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -363,20 +362,20 @@ Check if activation token is valid
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Agent app detail | **application/json**: [AppDetailWithSite](#appdetailwithsite)<br> |
+| 200 | Agent app detail | **application/json**: [AgentAppDetailWithSite](#agentappdetailwithsite)<br> |
 
 ### [PUT] /agent/{agent_id}
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -388,7 +387,7 @@ Check if activation token is valid
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Agent app updated successfully | **application/json**: [AppDetailWithSite](#appdetailwithsite)<br> |
+| 200 | Agent app updated successfully | **application/json**: [AgentAppDetailWithSite](#agentappdetailwithsite)<br> |
 | 400 | Invalid request parameters |  |
 | 403 | Insufficient permissions |  |
 
@@ -399,7 +398,7 @@ Get Agent App chat messages for a conversation with pagination
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | conversation_id | query | Conversation ID | Yes | string |
 | first_id | query | First message ID for pagination | No | string |
 | limit | query | Number of messages to return (1-100) | No | integer, <br>**Default:** 20 |
@@ -418,8 +417,8 @@ Get suggested questions for an Agent App message
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
-| message_id | path | Message ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
+| message_id | path | Message ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -435,7 +434,7 @@ Stop a running Agent App chat message generation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | task_id | path | Task ID to stop | Yes | string |
 
 #### Responses
@@ -449,7 +448,7 @@ Stop a running Agent App chat message generation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -462,7 +461,7 @@ Stop a running Agent App chat message generation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -481,7 +480,7 @@ Stop a running Agent App chat message generation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -494,7 +493,7 @@ Stop a running Agent App chat message generation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -508,6 +507,27 @@ Stop a running Agent App chat message generation
 | ---- | ----------- | ------ |
 | 200 | Agent app composer validation result | **application/json**: [AgentComposerValidateResponse](#agentcomposervalidateresponse)<br> |
 
+### [POST] /agent/{agent_id}/copy
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [CopyAppPayload](#copyapppayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Agent app copied successfully | **application/json**: [AgentAppDetailWithSite](#agentappdetailwithsite)<br> |
+| 400 | Invalid request parameters |  |
+| 403 | Insufficient permissions |  |
+
 ### [GET] /agent/{agent_id}/drive/files
 List agent drive entries for an Agent App
 
@@ -515,7 +535,7 @@ List agent drive entries for an Agent App
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | prefix | query | Key prefix filter: '<slug>/' for one skill, 'files/' for files | No | string |
 
 #### Responses
@@ -531,7 +551,7 @@ Time-limited external signed URL for one Agent App drive value
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | key | query | Drive key, e.g. tender-analyzer/SKILL.md | Yes | string |
 
 #### Responses
@@ -547,7 +567,7 @@ Truncated text preview of one Agent App drive value
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | key | query | Drive key, e.g. tender-analyzer/SKILL.md | Yes | string |
 
 #### Responses
@@ -563,7 +583,7 @@ Update an Agent App's presentation features (opener, follow-up, citations, ...)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -586,7 +606,7 @@ Create or update Agent App message feedback
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -608,7 +628,7 @@ Delete one Agent App drive file by key
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | key | query | Drive key, e.g. files/sample.pdf | Yes | string |
 
 #### Responses
@@ -624,7 +644,7 @@ Commit an uploaded file into the Agent App drive under files/<name>
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -638,6 +658,68 @@ Commit an uploaded file into the Agent App drive under files/<name>
 | ---- | ----------- | ------ |
 | 201 | File committed into the agent drive | **application/json**: [AgentDriveFileCommitResponse](#agentdrivefilecommitresponse)<br> |
 
+### [GET] /agent/{agent_id}/log-sources
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent log sources | **application/json**: [AgentLogSourceListResponse](#agentlogsourcelistresponse)<br> |
+
+### [GET] /agent/{agent_id}/logs
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| end | query | End date (YYYY-MM-DD HH:MM) | No | string |
+| keyword | query | Search query, answer, or conversation name | No | string |
+| limit | query | Page size | No | integer, <br>**Default:** 20 |
+| page | query | Page number | No | integer, <br>**Default:** 1 |
+| sort_by | query | Sort by created_at or updated_at | No | string, <br>**Default:** updated_at |
+| sort_order | query | Sort order: asc or desc | No | string, <br>**Default:** desc |
+| source | query | Deprecated single source filter | No | string |
+| sources | query | Filter by one or more source IDs, e.g. webapp:<app_id> or workflow:<app_id>:<workflow_id>:<version>:<node_id> | No | [ string ] |
+| start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
+| status | query | Deprecated single status filter | No | string |
+| statuses | query | Filter by one or more of success, failed, paused | No | [ string ] |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent logs | **application/json**: [AgentLogListResponse](#agentloglistresponse)<br> |
+
+### [GET] /agent/{agent_id}/logs/{conversation_id}/messages
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| end | query | End date (YYYY-MM-DD HH:MM) | No | string |
+| keyword | query | Search query, answer, or conversation name | No | string |
+| limit | query | Page size | No | integer, <br>**Default:** 20 |
+| page | query | Page number | No | integer, <br>**Default:** 1 |
+| sort_by | query | Sort by created_at or updated_at | No | string, <br>**Default:** updated_at |
+| sort_order | query | Sort order: asc or desc | No | string, <br>**Default:** desc |
+| source | query | Deprecated single source filter | No | string |
+| sources | query | Filter by one or more source IDs, e.g. webapp:<app_id> or workflow:<app_id>:<workflow_id>:<version>:<node_id> | No | [ string ] |
+| start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
+| status | query | Deprecated single status filter | No | string |
+| statuses | query | Filter by one or more of success, failed, paused | No | [ string ] |
+| agent_id | path |  | Yes | string (uuid) |
+| conversation_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent log messages | **application/json**: [AgentLogMessageListResponse](#agentlogmessagelistresponse)<br> |
+
 ### [GET] /agent/{agent_id}/messages/{message_id}
 Get Agent App message details by ID
 
@@ -645,8 +727,8 @@ Get Agent App message details by ID
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
-| message_id | path | Message ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
+| message_id | path | Message ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -662,7 +744,7 @@ List workflow apps that reference this Agent App's bound Agent (read-only)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -678,7 +760,7 @@ List a directory in an Agent App conversation sandbox
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | conversation_id | query | Agent App conversation ID | Yes | string |
 | path | query | Directory path relative to the sandbox workspace | No | string, <br>**Default:** . |
 
@@ -695,7 +777,7 @@ Read a text/binary preview file in an Agent App conversation sandbox
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | conversation_id | query | Agent App conversation ID | Yes | string |
 | path | query | File path relative to the sandbox workspace | Yes | string |
 
@@ -712,7 +794,7 @@ Upload one Agent App sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -726,37 +808,27 @@ Upload one Agent App sandbox file as a Dify ToolFile mapping
 | ---- | ----------- | ------ |
 | 200 | Uploaded | **application/json**: [SandboxUploadResponse](#sandboxuploadresponse)<br> |
 
-### [POST] /agent/{agent_id}/skills/standardize
-Validate + standardize a Skill into an Agent App drive
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 201 | Skill standardized into drive | **application/json**: [AgentSkillStandardizeResponse](#agentskillstandardizeresponse)<br> |
-| 400 | Invalid skill package or no bound agent |  |
-
 ### [POST] /agent/{agent_id}/skills/upload
-Upload + validate a Skill package for an Agent App
+Upload + standardize a Skill into an Agent App drive
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **multipart/form-data**: { **"file"**: binary }<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 201 | Skill validated | **application/json**: [AgentSkillUploadResponse](#agentskilluploadresponse)<br> |
-| 400 | Invalid skill package |  |
+| 201 | Skill uploaded into drive | **application/json**: [AgentSkillUploadResponse](#agentskilluploadresponse)<br> |
+| 400 | Invalid skill package or no bound agent |  |
 
 ### [DELETE] /agent/{agent_id}/skills/{slug}
 Delete a standardized skill from an Agent App drive
@@ -765,7 +837,7 @@ Delete a standardized skill from an Agent App drive
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | slug | path | Skill slug (single path segment) | Yes | string |
 
 #### Responses
@@ -781,7 +853,7 @@ Infer CLI tool + ENV suggestions from a standardized Agent App skill
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path | Agent ID | Yes | string |
+| agent_id | path | Agent ID | Yes | string (uuid) |
 | slug | path | Skill slug (single path segment) | Yes | string |
 
 #### Responses
@@ -790,12 +862,28 @@ Infer CLI tool + ENV suggestions from a standardized Agent App skill
 | ---- | ----------- | ------ |
 | 200 | Inference result (draft suggestions, nothing persisted) | **application/json**: [SkillToolInferenceResult](#skilltoolinferenceresult)<br> |
 
+### [GET] /agent/{agent_id}/statistics/summary
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| end | query | End date (YYYY-MM-DD HH:MM) | No | string |
+| source | query | Filter by all, console/explore, api/service-api, web-app, debugger, openapi, or trigger | No | string |
+| start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent monitoring summary and chart data | **application/json**: [AgentStatisticSummaryEnvelopeResponse](#agentstatisticsummaryenveloperesponse)<br> |
+
 ### [GET] /agent/{agent_id}/versions
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -808,8 +896,8 @@ Infer CLI tool + ENV suggestions from a standardized Agent App skill
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| agent_id | path |  | Yes | string |
-| version_id | path |  | Yes | string |
+| agent_id | path |  | Yes | string (uuid) |
+| version_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -862,7 +950,7 @@ Delete API-based extension
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| id | path | Extension ID | Yes | string |
+| id | path | Extension ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -877,7 +965,7 @@ Get API-based extension by ID
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| id | path | Extension ID | Yes | string |
+| id | path | Extension ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -892,7 +980,7 @@ Update API-based extension
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| id | path | Extension ID | Yes | string |
+| id | path | Extension ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -931,7 +1019,7 @@ Update API-based extension
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| binding_id | path |  | Yes | string |
+| binding_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -1100,7 +1188,7 @@ Delete application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1118,7 +1206,7 @@ Get application details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1135,7 +1223,7 @@ Update application details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1160,7 +1248,7 @@ Get advanced chat workflow run list
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | last_id | query | Last run ID for pagination | No | string |
 | limit | query | Number of items per page (1-100) | No | integer, <br>**Default:** 20 |
 | status | query | Workflow run status filter | No | string, <br>**Available values:** "failed", "partial-succeeded", "running", "stopped", "succeeded" |
@@ -1179,7 +1267,7 @@ Get advanced chat workflow run list
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | status | query | Workflow run status filter | No | string, <br>**Available values:** "failed", "partial-succeeded", "running", "stopped", "succeeded" |
 | time_range | query | Filter by time range (optional): e.g., 7d (7 days), 4h (4 hours), 30m (30 minutes), 30s (30 seconds). Filters by created_at field. | No | string |
 | triggered_from | query | Filter by trigger source: debugging or app-run. Default: debugging | No | string, <br>**Available values:** "app-run", "debugging" |
@@ -1199,7 +1287,7 @@ Get human input form preview for advanced chat workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -1223,7 +1311,7 @@ Submit human input form preview for advanced chat workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -1247,7 +1335,7 @@ Run draft workflow iteration node for advanced chat
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -1273,7 +1361,7 @@ Run draft workflow loop node for advanced chat
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -1299,7 +1387,7 @@ Run draft workflow for advanced chat application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1322,7 +1410,7 @@ List agent drive entries (read-only inspector; one endpoint for both tabs)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | query | Workflow node ID (workflow composer variant) | No | string |
 | prefix | query | Key prefix filter: '<slug>/' for one skill, 'files/' for files | No | string |
 
@@ -1339,7 +1427,7 @@ Time-limited external signed URL for one drive value (no streaming proxy)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | key | query | Drive key, e.g. tender-analyzer/SKILL.md | Yes | string |
 | node_id | query | Workflow node ID (workflow composer variant) | No | string |
 
@@ -1356,7 +1444,7 @@ Truncated text preview of one drive value (binary-safe; SKILL.md is the main cas
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | key | query | Drive key, e.g. tender-analyzer/SKILL.md | Yes | string |
 | node_id | query | Workflow node ID (workflow composer variant) | No | string |
 
@@ -1373,7 +1461,7 @@ Delete one drive file by key; soul ref first, then the KV row (ENG-625 D5)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | key | query | Drive key, e.g. files/sample.pdf | Yes | string |
 | node_id | query | Workflow node ID (workflow composer variant) | No | string |
 
@@ -1392,7 +1480,7 @@ Commit an uploaded file into the agent drive under files/<name> (ENG-625 D3)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | query | Workflow node ID (workflow composer variant) | No | string |
 
 #### Request Body
@@ -1416,7 +1504,7 @@ Get agent execution logs for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | conversation_id | query | Conversation UUID | Yes | string |
 | message_id | query | Message UUID | Yes | string |
 
@@ -1427,45 +1515,31 @@ Get agent execution logs for an application
 | 200 | Agent logs retrieved successfully | **application/json**: [AgentLogResponse](#agentlogresponse)<br> |
 | 400 | Invalid request parameters |  |
 
-### [POST] /apps/{app_id}/agent/skills/standardize
-**Upload a Skill, validate it, and standardize it into the app agent's drive**
+### [POST] /apps/{app_id}/agent/skills/upload
+**Upload a Skill, validate it, and commit drive-backed skill files**
 
-Validate + standardize a Skill into the agent drive (ENG-594)
+Upload + standardize a Skill into the agent drive
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | query | Workflow node ID (workflow composer variant) | No | string |
 
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **multipart/form-data**: { **"file"**: binary }<br> |
+
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 201 | Skill standardized into drive | **application/json**: [AgentSkillStandardizeResponse](#agentskillstandardizeresponse)<br> |
+| 201 | Skill uploaded into drive | **application/json**: [AgentSkillUploadResponse](#agentskilluploadresponse)<br> |
 | 400 | Invalid skill package or no bound agent |  |
 
-### [POST] /apps/{app_id}/agent/skills/upload
-**Validate an uploaded Skill package and persist the archive**
-
-Upload + validate a Skill package (.zip/.skill) and extract its manifest
-Returns a validated skill ref (to bind into the Agent soul config on save)
-plus its manifest. Standardizing into the agent drive is ENG-594.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 201 | Skill validated | **application/json**: [AgentSkillUploadResponse](#agentskilluploadresponse)<br> |
-| 400 | Invalid skill package |  |
-
 ### [DELETE] /apps/{app_id}/agent/skills/{slug}
 Delete a standardized skill: soul ref first, then the <slug>/ drive prefix (ENG-625 D5)
 
@@ -1473,7 +1547,7 @@ Delete a standardized skill: soul ref first, then the <slug>/ drive prefix (ENG-
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | slug | path | Skill slug (single path segment) | Yes | string |
 | node_id | query | Workflow node ID (workflow composer variant) | No | string |
 
@@ -1493,7 +1567,7 @@ Saving still goes through composer validation.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | slug | path | Skill slug (single path segment) | Yes | string |
 | node_id | query | Workflow node ID (workflow composer variant) | No | string |
 
@@ -1511,7 +1585,7 @@ Enable or disable annotation reply for an app
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | action | path | Action to perform (enable/disable) | Yes | string |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1534,8 +1608,8 @@ Get status of annotation reply action job
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | action | path | Action type | Yes | string |
-| app_id | path | Application ID | Yes | string |
-| job_id | path | Job ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| job_id | path | Job ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1551,7 +1625,7 @@ Get annotation settings for an app
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1567,8 +1641,8 @@ Update annotation settings for an app
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| annotation_setting_id | path | Annotation setting ID | Yes | string |
-| app_id | path | Application ID | Yes | string |
+| annotation_setting_id | path | Annotation setting ID | Yes | string (uuid) |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1588,7 +1662,7 @@ Update annotation settings for an app
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -1603,7 +1677,7 @@ Get annotations for an app with pagination
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | keyword | query | Search keyword | No | string |
 | limit | query | Page size | No | integer, <br>**Default:** 20 |
 | page | query | Page number | No | integer, <br>**Default:** 1 |
@@ -1622,7 +1696,7 @@ Create a new annotation for an app
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1644,7 +1718,7 @@ Batch import annotations from CSV file with rate limiting and security checks
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1663,8 +1737,8 @@ Get status of batch import job
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| job_id | path | Job ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| job_id | path | Job ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1680,7 +1754,7 @@ Get count of message annotations for the app
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1695,7 +1769,7 @@ Export all annotations for an app with CSV injection protection
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1709,8 +1783,8 @@ Export all annotations for an app with CSV injection protection
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| annotation_id | path |  | Yes | string |
-| app_id | path |  | Yes | string |
+| annotation_id | path |  | Yes | string (uuid) |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -1725,8 +1799,8 @@ Update or delete an annotation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| annotation_id | path | Annotation ID | Yes | string |
-| app_id | path | Application ID | Yes | string |
+| annotation_id | path | Annotation ID | Yes | string (uuid) |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1749,8 +1823,8 @@ Get hit histories for an annotation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| annotation_id | path | Annotation ID | Yes | string |
-| app_id | path | Application ID | Yes | string |
+| annotation_id | path | Annotation ID | Yes | string (uuid) |
+| app_id | path | Application ID | Yes | string (uuid) |
 | limit | query | Page size | No | integer, <br>**Default:** 20 |
 | page | query | Page number | No | integer, <br>**Default:** 1 |
 
@@ -1768,7 +1842,7 @@ Enable or disable app API
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1790,7 +1864,7 @@ Transcript audio to text for chat messages
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | App ID | Yes | string |
+| app_id | path | App ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1807,7 +1881,7 @@ Get chat conversations with pagination, filtering and summary
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | annotation_status | query | Annotation status filter | No | string, <br>**Available values:** "all", "annotated", "not_annotated", <br>**Default:** all |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | keyword | query | Search keyword | No | string |
@@ -1830,8 +1904,8 @@ Delete a chat conversation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| conversation_id | path | Conversation ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| conversation_id | path | Conversation ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1848,8 +1922,8 @@ Get chat conversation details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| conversation_id | path | Conversation ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| conversation_id | path | Conversation ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1866,7 +1940,7 @@ Get chat messages for a conversation with pagination
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | conversation_id | query | Conversation ID | Yes | string |
 | first_id | query | First message ID for pagination | No | string |
 | limit | query | Number of messages to return (1-100) | No | integer, <br>**Default:** 20 |
@@ -1885,8 +1959,8 @@ Get suggested questions for a message
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| message_id | path | Message ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| message_id | path | Message ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1902,7 +1976,7 @@ Stop a running chat message generation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | task_id | path | Task ID to stop | Yes | string |
 
 #### Responses
@@ -1918,7 +1992,7 @@ Get completion conversations with pagination and filtering
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | annotation_status | query | Annotation status filter | No | string, <br>**Available values:** "all", "annotated", "not_annotated", <br>**Default:** all |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | keyword | query | Search keyword | No | string |
@@ -1940,8 +2014,8 @@ Delete a completion conversation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| conversation_id | path | Conversation ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| conversation_id | path | Conversation ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1958,8 +2032,8 @@ Get completion conversation details with messages
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| conversation_id | path | Conversation ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| conversation_id | path | Conversation ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -1976,7 +2050,7 @@ Generate completion message for debugging
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1999,7 +2073,7 @@ Stop a running completion message generation
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | task_id | path | Task ID to stop | Yes | string |
 
 #### Responses
@@ -2015,7 +2089,7 @@ Get conversation variables for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | conversation_id | query | Conversation ID to filter variables | Yes | string |
 
 #### Responses
@@ -2035,7 +2109,7 @@ Convert Completion App to Workflow App
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2060,7 +2134,7 @@ Create a copy of an existing application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID to copy | Yes | string |
+| app_id | path | Application ID to copy | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2084,7 +2158,7 @@ Export application configuration as DSL
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID to export | Yes | string |
+| app_id | path | Application ID to export | Yes | string (uuid) |
 | include_secret | query | Include secrets in export | No | boolean |
 | workflow_id | query | Specific workflow ID to export | No | string |
 
@@ -2102,7 +2176,7 @@ Create or update message feedback (like/dislike)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2125,7 +2199,7 @@ Export user feedback data for Google Sheets
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end_date | query | End date (YYYY-MM-DD) | No | string |
 | format | query | Export format | No | string, <br>**Available values:** "csv", "json", <br>**Default:** csv |
 | from_source | query | Filter by feedback source | No | string, <br>**Available values:** "admin", "user" |
@@ -2148,7 +2222,7 @@ Update application icon
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2170,8 +2244,8 @@ Get message details by ID
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| message_id | path | Message ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| message_id | path | Message ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2189,7 +2263,7 @@ Update application model configuration
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2212,7 +2286,7 @@ Check if app name is available
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2233,7 +2307,7 @@ Check if app name is available
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -2248,7 +2322,7 @@ Get MCP server configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2263,7 +2337,7 @@ Create MCP server configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2285,7 +2359,7 @@ Update MCP server configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2308,7 +2382,7 @@ Update application site configuration
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2331,7 +2405,7 @@ Enable or disable app site
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2353,7 +2427,7 @@ Reset access token for application site
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2370,7 +2444,7 @@ Remove the current account's star from an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2386,7 +2460,7 @@ Star an application for the current account
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2402,7 +2476,7 @@ Get average response time statistics for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
 
@@ -2419,7 +2493,7 @@ Get average session interaction statistics for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
 
@@ -2436,7 +2510,7 @@ Get daily conversation statistics for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
 
@@ -2453,7 +2527,7 @@ Get daily terminal/end-user statistics for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
 
@@ -2470,7 +2544,7 @@ Get daily message statistics for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
 
@@ -2487,7 +2561,7 @@ Get daily token cost statistics for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
 
@@ -2504,7 +2578,7 @@ Get tokens per second statistics for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
 
@@ -2521,7 +2595,7 @@ Get user satisfaction rate statistics for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date (YYYY-MM-DD HH:MM) | No | string |
 
@@ -2538,7 +2612,7 @@ Convert text to speech for chat messages
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | App ID | Yes | string |
+| app_id | path | App ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2560,7 +2634,7 @@ Get available TTS voices for a specific language
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | App ID | Yes | string |
+| app_id | path | App ID | Yes | string (uuid) |
 | language | query | Language code | Yes | string |
 
 #### Responses
@@ -2579,7 +2653,7 @@ Get app tracing configuration
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2594,7 +2668,7 @@ Update app tracing configuration
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2618,7 +2692,7 @@ Delete an existing tracing configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | tracing_provider | query | Tracing provider name | Yes | string |
 
 #### Responses
@@ -2635,7 +2709,7 @@ Get tracing configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | tracing_provider | query | Tracing provider name | Yes | string |
 
 #### Responses
@@ -2654,7 +2728,7 @@ Update an existing tracing configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2678,7 +2752,7 @@ Create a new tracing configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2700,7 +2774,7 @@ Create a new tracing configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2721,7 +2795,7 @@ Create a new tracing configuration for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -2738,7 +2812,7 @@ Get workflow application execution logs
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | created_at__after | query | Filter logs created after this timestamp | No | dateTime |
 | created_at__before | query | Filter logs created before this timestamp | No | dateTime |
 | created_by_account | query | Filter by account | No | string |
@@ -2764,7 +2838,7 @@ Get workflow archived execution logs
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | created_at__after | query | Filter logs created after this timestamp | No | dateTime |
 | created_at__before | query | Filter logs created before this timestamp | No | dateTime |
 | created_by_account | query | Filter by account | No | string |
@@ -2788,7 +2862,7 @@ Get workflow archived execution logs
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | last_id | query | Last run ID for pagination | No | string |
 | limit | query | Number of items per page (1-100) | No | integer, <br>**Default:** 20 |
 | status | query | Workflow run status filter | No | string, <br>**Available values:** "failed", "partial-succeeded", "running", "stopped", "succeeded" |
@@ -2807,7 +2881,7 @@ Get workflow archived execution logs
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | status | query | Workflow run status filter | No | string, <br>**Available values:** "failed", "partial-succeeded", "running", "stopped", "succeeded" |
 | time_range | query | Filter by time range (optional): e.g., 7d (7 days), 4h (4 hours), 30m (30 minutes), 30s (30 seconds). Filters by created_at field. | No | string |
 | triggered_from | query | Filter by trigger source: debugging or app-run. Default: debugging | No | string, <br>**Available values:** "app-run", "debugging" |
@@ -2827,7 +2901,7 @@ Stop running workflow task
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | task_id | path | Task ID | Yes | string |
 
 #### Responses
@@ -2845,8 +2919,8 @@ Stop running workflow task
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2862,8 +2936,8 @@ Generate a download URL for an archived workflow run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2878,8 +2952,8 @@ Generate a download URL for an archived workflow run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2895,9 +2969,9 @@ List a directory in a workflow Agent node sandbox
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Workflow Agent node ID | Yes | string |
-| workflow_run_id | path | Workflow run ID | Yes | string |
+| workflow_run_id | path | Workflow run ID | Yes | string (uuid) |
 | node_execution_id | query | Optional workflow node execution ID. When omitted, the latest active session for the node is used. | No | string |
 | path | query | Directory path relative to the sandbox workspace | No | string, <br>**Default:** . |
 
@@ -2914,9 +2988,9 @@ Read a text/binary preview file in a workflow Agent node sandbox
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Workflow Agent node ID | Yes | string |
-| workflow_run_id | path | Workflow run ID | Yes | string |
+| workflow_run_id | path | Workflow run ID | Yes | string (uuid) |
 | node_execution_id | query | Optional workflow node execution ID. When omitted, the latest active session for the node is used. | No | string |
 | path | query | File path relative to the sandbox workspace | Yes | string |
 
@@ -2933,9 +3007,9 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | node_id | path |  | Yes | string |
-| workflow_run_id | path |  | Yes | string |
+| workflow_run_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2956,7 +3030,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -2971,7 +3045,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -2992,7 +3066,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3007,7 +3081,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | comment_id | path | Comment ID | Yes | string |
 
 #### Responses
@@ -3023,7 +3097,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | comment_id | path | Comment ID | Yes | string |
 
 #### Responses
@@ -3039,7 +3113,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | comment_id | path | Comment ID | Yes | string |
 
 #### Request Body
@@ -3061,7 +3135,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | comment_id | path | Comment ID | Yes | string |
 
 #### Request Body
@@ -3083,7 +3157,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | comment_id | path | Comment ID | Yes | string |
 | reply_id | path | Reply ID | Yes | string |
 
@@ -3100,7 +3174,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | comment_id | path | Comment ID | Yes | string |
 | reply_id | path | Reply ID | Yes | string |
 
@@ -3123,7 +3197,7 @@ Upload one workflow Agent sandbox file as a Dify ToolFile mapping
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | comment_id | path | Comment ID | Yes | string |
 
 #### Responses
@@ -3139,7 +3213,7 @@ Get workflow average app interaction statistics
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date and time (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date and time (YYYY-MM-DD HH:MM) | No | string |
 
@@ -3156,7 +3230,7 @@ Get workflow daily runs statistics
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date and time (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date and time (YYYY-MM-DD HH:MM) | No | string |
 
@@ -3173,7 +3247,7 @@ Get workflow daily terminals statistics
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date and time (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date and time (YYYY-MM-DD HH:MM) | No | string |
 
@@ -3190,7 +3264,7 @@ Get workflow daily token cost statistics
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | end | query | End date and time (YYYY-MM-DD HH:MM) | No | string |
 | start | query | Start date and time (YYYY-MM-DD HH:MM) | No | string |
 
@@ -3209,7 +3283,7 @@ Get all published workflows for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | limit | query |  | No | integer, <br>**Default:** 10 |
 | named_only | query |  | No | boolean |
 | page | query |  | No | integer, <br>**Default:** 1 |
@@ -3230,7 +3304,7 @@ Get default block configurations for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3247,7 +3321,7 @@ Get default block configuration by type
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | block_type | path | Block type | Yes | string |
 | q | query |  | No | string |
 
@@ -3267,7 +3341,7 @@ Get draft workflow for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3285,7 +3359,7 @@ Sync draft workflow configuration
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -3308,7 +3382,7 @@ Get conversation variables for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3324,7 +3398,7 @@ Update conversation variables for workflow draft
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -3347,7 +3421,7 @@ Get environment variables for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3363,7 +3437,7 @@ Update environment variables for workflow draft
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -3384,7 +3458,7 @@ Update draft workflow features
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -3407,7 +3481,7 @@ Test human input delivery for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -3431,7 +3505,7 @@ Get human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -3455,7 +3529,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -3477,7 +3551,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -3501,7 +3575,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -3523,7 +3597,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | node_id | path |  | Yes | string |
 
 #### Responses
@@ -3537,7 +3611,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | node_id | path |  | Yes | string |
 
 #### Request Body
@@ -3557,7 +3631,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | node_id | path |  | Yes | string |
 
 #### Responses
@@ -3571,7 +3645,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | node_id | path |  | Yes | string |
 
 #### Request Body
@@ -3591,7 +3665,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | node_id | path |  | Yes | string |
 
 #### Request Body
@@ -3611,7 +3685,7 @@ Submit human input form preview for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | node_id | path |  | Yes | string |
 
 #### Request Body
@@ -3633,7 +3707,7 @@ Get last run result for draft workflow node
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Responses
@@ -3651,7 +3725,7 @@ Get last run result for draft workflow node
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Request Body
@@ -3675,7 +3749,7 @@ Get last run result for draft workflow node
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Responses
@@ -3693,7 +3767,7 @@ Delete all variables for a specific node
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | node_id | path |  | Yes | string |
 
 #### Responses
@@ -3709,7 +3783,7 @@ Get variables for a specific node
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID | Yes | string |
 
 #### Responses
@@ -3725,7 +3799,7 @@ Get variables for a specific node
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -3747,8 +3821,8 @@ Snapshot of every node's declared outputs for a draft workflow run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3764,8 +3838,8 @@ Server-Sent Events stream of inspector deltas for a draft workflow run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3781,9 +3855,9 @@ One node's declared outputs for a draft workflow run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID inside the workflow graph | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3799,10 +3873,10 @@ Full value for one declared output, including signed download URL for files.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID inside the workflow graph | Yes | string |
 | output_name | path | Declared output name as exposed by Composer | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3818,7 +3892,7 @@ Get system variables for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3833,7 +3907,7 @@ Get system variables for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -3856,7 +3930,7 @@ Get system variables for workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -3879,7 +3953,7 @@ Delete all draft workflow variables
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -3896,7 +3970,7 @@ Get draft workflow variables
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | limit | query | Items per page | No | integer, <br>**Default:** 20 |
 | page | query | Page number | No | integer, <br>**Default:** 1 |
 
@@ -3913,8 +3987,8 @@ Delete a workflow variable
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -3930,8 +4004,8 @@ Get a specific workflow variable
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| variable_id | path | Variable ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| variable_id | path | Variable ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3947,8 +4021,8 @@ Update a workflow variable
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -3970,8 +4044,8 @@ Reset a workflow variable to its default value
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| variable_id | path | Variable ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| variable_id | path | Variable ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -3990,7 +4064,7 @@ Get published workflow for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4005,7 +4079,7 @@ Get published workflow for an application
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -4026,8 +4100,8 @@ Snapshot of every node's declared outputs for a published workflow run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4043,8 +4117,8 @@ Server-Sent Events stream of inspector deltas for a published workflow run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4060,9 +4134,9 @@ One node's declared outputs for a published workflow run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID inside the workflow graph | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4078,10 +4152,10 @@ Full value for one declared output of a published run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | node_id | path | Node ID inside the workflow graph | Yes | string |
 | output_name | path | Declared output name as exposed by Composer | Yes | string |
-| run_id | path | Workflow run ID | Yes | string |
+| run_id | path | Workflow run ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4098,7 +4172,7 @@ Full value for one declared output of a published run.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | query |  | Yes | string |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4113,7 +4187,7 @@ Full value for one declared output of a published run.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | workflow_id | path |  | Yes | string |
 
 #### Responses
@@ -4131,7 +4205,7 @@ Update workflow by ID
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | workflow_id | path | Workflow ID | Yes | string |
 
 #### Request Body
@@ -4155,7 +4229,7 @@ Restore a published workflow version into the draft workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path | Application ID | Yes | string |
+| app_id | path | Application ID | Yes | string (uuid) |
 | workflow_id | path | Published workflow ID | Yes | string |
 
 #### Responses
@@ -4173,7 +4247,7 @@ Restore a published workflow version into the draft workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| resource_id | path | App ID | Yes | string |
+| resource_id | path | App ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4188,7 +4262,7 @@ Restore a published workflow version into the draft workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| resource_id | path | App ID | Yes | string |
+| resource_id | path | App ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4204,8 +4278,8 @@ Restore a published workflow version into the draft workflow
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| api_key_id | path | API key ID | Yes | string |
-| resource_id | path | App ID | Yes | string |
+| api_key_id | path | API key ID | Yes | string (uuid) |
+| resource_id | path | App ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4220,7 +4294,7 @@ Refresh MCP server configuration and regenerate server code
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| server_id | path | Server ID | Yes | string |
+| server_id | path | Server ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4477,7 +4551,7 @@ Get compliance document download link
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | action | path |  | Yes | string |
-| binding_id | path |  | Yes | string |
+| binding_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4491,7 +4565,7 @@ Get compliance document download link
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | action | path |  | Yes | string |
-| binding_id | path |  | Yes | string |
+| binding_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4568,7 +4642,7 @@ Delete dataset API key
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| api_key_id | path | API key ID | Yes | string |
+| api_key_id | path | API key ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4581,7 +4655,7 @@ Delete dataset API key
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| job_id | path |  | Yes | string |
+| job_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4594,7 +4668,7 @@ Delete dataset API key
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| job_id | path |  | Yes | string |
+| job_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -4660,7 +4734,7 @@ Get external knowledge API templates
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| external_knowledge_api_id | path |  | Yes | string |
+| external_knowledge_api_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4675,7 +4749,7 @@ Get external knowledge API template details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| external_knowledge_api_id | path | External knowledge API ID | Yes | string |
+| external_knowledge_api_id | path | External knowledge API ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4689,7 +4763,7 @@ Get external knowledge API template details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| external_knowledge_api_id | path |  | Yes | string |
+| external_knowledge_api_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -4710,7 +4784,7 @@ Check if external knowledge API is being used
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| external_knowledge_api_id | path | External knowledge API ID | Yes | string |
+| external_knowledge_api_id | path | External knowledge API ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4813,7 +4887,7 @@ Get mock dataset retrieval settings by vector type
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4828,7 +4902,7 @@ Get dataset details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4845,7 +4919,7 @@ Update dataset details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -4866,7 +4940,7 @@ Update dataset details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 | status | path |  | Yes | string |
 
 #### Responses
@@ -4882,7 +4956,7 @@ Get dataset auto disable logs
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -4897,7 +4971,7 @@ Get dataset auto disable logs
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | batch | path |  | Yes | string |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4911,7 +4985,7 @@ Get dataset auto disable logs
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | batch | path |  | Yes | string |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4924,7 +4998,7 @@ Get dataset auto disable logs
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -4939,7 +5013,7 @@ Get documents in a dataset
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 | fetch | query | Fetch full details (default: false) | No | string |
 | keyword | query | Search keyword | No | string |
 | limit | query | Number of items per page (default: 20) | No | string |
@@ -4958,7 +5032,7 @@ Get documents in a dataset
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -4981,7 +5055,7 @@ Download selected dataset documents as a single ZIP archive (upload-file only)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5007,7 +5081,7 @@ then asynchronously generates summary indexes for the provided documents.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5029,7 +5103,7 @@ then asynchronously generates summary indexes for the provided documents.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5049,7 +5123,7 @@ then asynchronously generates summary indexes for the provided documents.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | action | path |  | Yes | string |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5062,8 +5136,8 @@ then asynchronously generates summary indexes for the provided documents.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5078,8 +5152,8 @@ Get document details
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 | metadata | query | Metadata inclusion (all/only/without) | No | string |
 
 #### Responses
@@ -5096,8 +5170,8 @@ Get a signed download URL for a dataset document's original uploaded file
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5112,8 +5186,8 @@ Estimate document indexing cost
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5130,8 +5204,8 @@ Get document indexing status
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5147,8 +5221,8 @@ Update document metadata
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5169,8 +5243,8 @@ Update document metadata
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5183,8 +5257,8 @@ Update document metadata
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5199,8 +5273,8 @@ Update document metadata
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5215,8 +5289,8 @@ Update document metadata
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5232,8 +5306,8 @@ Update document processing status (pause/resume)
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | action | path | Action to perform (pause/resume) | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5248,8 +5322,8 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5268,8 +5342,8 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5289,8 +5363,8 @@ Update document processing status (pause/resume)
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | action | path | Action | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 | segment_id | query | Segment IDs | No | [ string ] |
 
 #### Responses
@@ -5304,8 +5378,8 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 | segment_id | query | Segment IDs | No | [ string ] |
 
 #### Responses
@@ -5319,8 +5393,8 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 | enabled | query |  | No | string, <br>**Default:** all |
 | hit_count_gte | query |  | No | integer |
 | keyword | query |  | No | string |
@@ -5339,8 +5413,8 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5353,8 +5427,8 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5373,9 +5447,9 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Segment ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
+| segment_id | path | Segment ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5388,9 +5462,9 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Segment ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
+| segment_id | path | Segment ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5409,9 +5483,9 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
+| segment_id | path | Parent segment ID | Yes | string (uuid) |
 | keyword | query |  | No | string |
 | limit | query |  | No | integer, <br>**Default:** 20 |
 | page | query |  | No | integer, <br>**Default:** 1 |
@@ -5427,9 +5501,9 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
+| segment_id | path | Parent segment ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5448,9 +5522,9 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
+| segment_id | path | Parent segment ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5469,10 +5543,10 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| child_chunk_id | path | Child chunk ID | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
+| child_chunk_id | path | Child chunk ID | Yes | string (uuid) |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
+| segment_id | path | Parent segment ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5485,10 +5559,10 @@ Update document processing status (pause/resume)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| child_chunk_id | path | Child chunk ID | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
+| child_chunk_id | path | Child chunk ID | Yes | string (uuid) |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
+| segment_id | path | Parent segment ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5519,8 +5593,8 @@ Returns:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
+| document_id | path | Document ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5536,8 +5610,8 @@ Returns:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| document_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| document_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5552,7 +5626,7 @@ Get dataset error documents
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5568,7 +5642,7 @@ Test external knowledge retrieval for dataset
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5591,7 +5665,7 @@ Test dataset knowledge retrieval
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5614,7 +5688,7 @@ Get dataset indexing status
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5627,7 +5701,7 @@ Get dataset indexing status
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5640,7 +5714,7 @@ Get dataset indexing status
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5660,7 +5734,7 @@ Get dataset indexing status
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | action | path |  | Yes | string |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5673,8 +5747,8 @@ Get dataset indexing status
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| metadata_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| metadata_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5687,8 +5761,8 @@ Get dataset indexing status
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| metadata_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
+| metadata_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5707,7 +5781,7 @@ Get dataset indexing status
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5722,7 +5796,7 @@ Get dataset permission user list
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5739,7 +5813,7 @@ Get dataset query history
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5754,7 +5828,7 @@ Get applications related to dataset
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5769,7 +5843,7 @@ Get applications related to dataset
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -5790,7 +5864,7 @@ Check if dataset is in use
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5805,7 +5879,7 @@ Check if dataset is in use
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| resource_id | path | Dataset ID | Yes | string |
+| resource_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5820,7 +5894,7 @@ Check if dataset is in use
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| resource_id | path | Dataset ID | Yes | string |
+| resource_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5836,8 +5910,8 @@ Check if dataset is in use
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| api_key_id | path | API key ID | Yes | string |
-| resource_id | path | Dataset ID | Yes | string |
+| api_key_id | path | API key ID | Yes | string (uuid) |
+| resource_id | path | Dataset ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -5941,7 +6015,7 @@ Check if dataset is in use
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -5993,7 +6067,7 @@ Check if dataset is in use
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| file_id | path |  | Yes | string |
+| file_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6135,7 +6209,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6148,7 +6222,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -6167,7 +6241,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6180,7 +6254,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -6199,7 +6273,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 | task_id | path |  | Yes | string |
 
 #### Responses
@@ -6213,7 +6287,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -6232,7 +6306,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 | task_id | path |  | Yes | string |
 
 #### Responses
@@ -6249,7 +6323,7 @@ Request body:
 | last_id | query |  | No | string |
 | limit | query |  | No | integer, <br>**Default:** 20 |
 | pinned | query |  | No | boolean |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6262,8 +6336,8 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path |  | Yes | string |
-| installed_app_id | path |  | Yes | string |
+| c_id | path |  | Yes | string (uuid) |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6276,8 +6350,8 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path |  | Yes | string |
-| installed_app_id | path |  | Yes | string |
+| c_id | path |  | Yes | string (uuid) |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -6296,8 +6370,8 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path |  | Yes | string |
-| installed_app_id | path |  | Yes | string |
+| c_id | path |  | Yes | string (uuid) |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6310,8 +6384,8 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path |  | Yes | string |
-| installed_app_id | path |  | Yes | string |
+| c_id | path |  | Yes | string (uuid) |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6324,10 +6398,10 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| conversation_id | query | Conversation UUID | Yes | string |
-| first_id | query | First message ID for pagination | No | string |
-| limit | query | Number of messages to return (1-100) | No | integer, <br>**Default:** 20 |
-| installed_app_id | path |  | Yes | string |
+| conversation_id | query | Conversation ID. | Yes | string |
+| first_id | query | The ID of the first chat record on the current page. Omit this value to fetch the latest messages; for subsequent pages, use the first message ID from the current list to fetch older messages. | No | string |
+| limit | query | Number of chat history messages to return per request. | No | integer, <br>**Default:** 20 |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6340,8 +6414,8 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
-| message_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
+| message_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -6361,8 +6435,8 @@ Request body:
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | response_mode | query |  | Yes | string, <br>**Available values:** "blocking", "streaming" |
-| installed_app_id | path |  | Yes | string |
-| message_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
+| message_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6375,8 +6449,8 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
-| message_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
+| message_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6391,7 +6465,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6406,7 +6480,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6421,7 +6495,7 @@ Request body:
 | ---- | ---------- | ----------- | -------- | ------ |
 | last_id | query |  | No | string |
 | limit | query |  | No | integer, <br>**Default:** 20 |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6434,7 +6508,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -6453,8 +6527,8 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
-| message_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
+| message_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -6467,7 +6541,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -6488,7 +6562,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -6509,7 +6583,7 @@ Request body:
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| installed_app_id | path |  | Yes | string |
+| installed_app_id | path |  | Yes | string (uuid) |
 | task_id | path |  | Yes | string |
 
 #### Responses
@@ -6619,7 +6693,7 @@ Mark a notification as dismissed for the current user.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | credential_id | query | Credential ID | Yes | string |
-| page_id | path |  | Yes | string |
+| page_id | path |  | Yes | string (uuid) |
 | page_type | path |  | Yes | string |
 
 #### Responses
@@ -6719,7 +6793,7 @@ Sync data from OAuth data source
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| binding_id | path | Data source binding ID | Yes | string |
+| binding_id | path | Data source binding ID | Yes | string (uuid) |
 | provider | path | Data source provider name (notion) | Yes | string |
 
 #### Responses
@@ -7032,7 +7106,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7082,7 +7156,7 @@ Initiate OAuth login process
 | ---- | ---------- | ----------- | -------- | ------ |
 | last_id | query |  | No | string |
 | limit | query |  | No | integer, <br>**Default:** 20 |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7097,7 +7171,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 | task_id | path |  | Yes | string |
 
 #### Responses
@@ -7113,8 +7187,8 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
-| run_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
+| run_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7129,8 +7203,8 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
-| run_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
+| run_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7149,7 +7223,7 @@ Initiate OAuth login process
 | named_only | query |  | No | boolean |
 | page | query |  | No | integer, <br>**Default:** 1 |
 | user_id | query |  | No | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7165,7 +7239,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7182,7 +7256,7 @@ Initiate OAuth login process
 | ---- | ---------- | ----------- | -------- | ------ |
 | q | query |  | No | string |
 | block_type | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7197,7 +7271,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7213,7 +7287,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7235,7 +7309,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7256,7 +7330,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7277,7 +7351,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7293,7 +7367,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7315,7 +7389,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7335,7 +7409,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7351,7 +7425,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7371,7 +7445,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7385,7 +7459,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7401,7 +7475,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | query |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7417,7 +7491,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | query |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7432,7 +7506,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7451,7 +7525,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7464,7 +7538,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7481,7 +7555,7 @@ Initiate OAuth login process
 | ---- | ---------- | ----------- | -------- | ------ |
 | limit | query |  | No | integer, <br>**Default:** 20 |
 | page | query |  | No | integer, <br>**Default:** 1 |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7494,8 +7568,8 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7508,8 +7582,8 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7522,8 +7596,8 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7542,8 +7616,8 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7559,7 +7633,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7574,7 +7648,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7590,7 +7664,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7612,7 +7686,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7634,7 +7708,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | query |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7650,7 +7724,7 @@ Initiate OAuth login process
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | query |  | Yes | string |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7665,7 +7739,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7686,7 +7760,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 | workflow_id | path |  | Yes | string |
 
 #### Responses
@@ -7702,7 +7776,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 | workflow_id | path |  | Yes | string |
 
 #### Request Body
@@ -7725,7 +7799,7 @@ Initiate OAuth login process
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| pipeline_id | path |  | Yes | string |
+| pipeline_id | path |  | Yes | string (uuid) |
 | workflow_id | path |  | Yes | string |
 
 #### Responses
@@ -7840,7 +7914,7 @@ Generate structured output rules using LLM
 | ---- | ---------- | ----------- | -------- | ------ |
 | last_id | query |  | No | string |
 | limit | query |  | No | integer, <br>**Default:** 20 |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7858,7 +7932,7 @@ command channel for backward compatibility.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 | task_id | path |  | Yes | string |
 
 #### Responses
@@ -7875,8 +7949,8 @@ command channel for backward compatibility.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| run_id | path |  | Yes | string |
-| snippet_id | path |  | Yes | string |
+| run_id | path |  | Yes | string (uuid) |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7892,8 +7966,8 @@ command channel for backward compatibility.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| run_id | path |  | Yes | string |
-| snippet_id | path |  | Yes | string |
+| run_id | path |  | Yes | string (uuid) |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7910,7 +7984,7 @@ Get all published workflows for a snippet
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path | Snippet ID | Yes | string |
+| snippet_id | path | Snippet ID | Yes | string (uuid) |
 | limit | query |  | No | integer, <br>**Default:** 10 |
 | page | query |  | No | integer, <br>**Default:** 1 |
 
@@ -7927,7 +8001,7 @@ Get all published workflows for a snippet
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7942,7 +8016,7 @@ Get all published workflows for a snippet
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7958,7 +8032,7 @@ Get all published workflows for a snippet
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -7980,7 +8054,7 @@ Get all published workflows for a snippet
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -7995,7 +8069,7 @@ Conversation variables are not used in snippet workflows; returns an empty list
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8010,7 +8084,7 @@ Get environment variables from snippet draft workflow graph
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8031,7 +8105,7 @@ Returns an SSE event stream with iteration progress and results.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path | Node ID | Yes | string |
-| snippet_id | path | Snippet ID | Yes | string |
+| snippet_id | path | Snippet ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8058,7 +8132,7 @@ Returns an SSE event stream with loop progress and results.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path | Node ID | Yes | string |
-| snippet_id | path | Snippet ID | Yes | string |
+| snippet_id | path | Snippet ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8085,7 +8159,7 @@ including status, inputs, outputs, and timing information.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path | Node ID | Yes | string |
-| snippet_id | path | Snippet ID | Yes | string |
+| snippet_id | path | Snippet ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -8106,7 +8180,7 @@ Returns the node execution result including status, outputs, and timing.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path | Node ID | Yes | string |
-| snippet_id | path | Snippet ID | Yes | string |
+| snippet_id | path | Snippet ID | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8129,7 +8203,7 @@ Delete all variables for a specific node (snippet draft workflow)
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8145,7 +8219,7 @@ Get variables for a specific node (snippet draft workflow)
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | node_id | path |  | Yes | string |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8163,7 +8237,7 @@ and returns an SSE event stream with execution progress and results.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8185,7 +8259,7 @@ System variables are not used in snippet workflows; returns an empty list for AP
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8200,7 +8274,7 @@ Delete all draft workflow variables for the current user (snippet scope)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8217,7 +8291,7 @@ List draft workflow variables without values (paginated, snippet scope)
 | ---- | ---------- | ----------- | -------- | ------ |
 | limit | query | Items per page | No | integer, <br>**Default:** 20 |
 | page | query | Page number | No | integer, <br>**Default:** 1 |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8232,8 +8306,8 @@ Delete a draft workflow variable (snippet scope)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8249,8 +8323,8 @@ Get a specific draft workflow variable (snippet scope)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8266,8 +8340,8 @@ Update a draft workflow variable (snippet scope)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8289,8 +8363,8 @@ Reset a draft workflow variable to its default value (snippet scope)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
-| variable_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
+| variable_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8307,7 +8381,7 @@ Reset a draft workflow variable to its default value (snippet scope)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8323,7 +8397,7 @@ Reset a draft workflow variable to its default value (snippet scope)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8345,7 +8419,7 @@ Reset a draft workflow variable to its default value (snippet scope)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path | Snippet ID | Yes | string |
+| snippet_id | path | Snippet ID | Yes | string (uuid) |
 | workflow_id | path | Published workflow ID | Yes | string |
 
 #### Responses
@@ -8444,7 +8518,7 @@ Remove one or more tag bindings from a target.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| tag_id | path |  | Yes | string |
+| tag_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8457,7 +8531,7 @@ Remove one or more tag bindings from a target.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| tag_id | path |  | Yes | string |
+| tag_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8493,7 +8567,7 @@ Bedrock retrieval test (internal use only)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8506,7 +8580,7 @@ Bedrock retrieval test (internal use only)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8519,7 +8593,7 @@ Bedrock retrieval test (internal use only)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8538,7 +8612,7 @@ Bedrock retrieval test (internal use only)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8560,7 +8634,7 @@ Bedrock retrieval test (internal use only)
 | ids | query | Dataset IDs | No | [ string ] |
 | limit | query | Number of items per page | No | integer, <br>**Default:** 20 |
 | page | query | Page number | No | integer, <br>**Default:** 1 |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8573,8 +8647,8 @@ Bedrock retrieval test (internal use only)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
-| message_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
+| message_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8589,7 +8663,7 @@ Bedrock retrieval test (internal use only)
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8606,7 +8680,7 @@ Returns the site configuration for the application including theme, icons, and t
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8619,7 +8693,7 @@ Returns the site configuration for the application including theme, icons, and t
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8640,7 +8714,7 @@ Returns the site configuration for the application including theme, icons, and t
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8655,7 +8729,7 @@ Returns the site configuration for the application including theme, icons, and t
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8676,7 +8750,7 @@ Returns the site configuration for the application including theme, icons, and t
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| app_id | path |  | Yes | string |
+| app_id | path |  | Yes | string (uuid) |
 | task_id | path |  | Yes | string |
 
 #### Responses
@@ -8901,7 +8975,7 @@ Get list of available agent providers
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8917,7 +8991,7 @@ Get list of available agent providers
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -8933,7 +9007,7 @@ Get list of available agent providers
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path |  | Yes | string |
+| snippet_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -8956,7 +9030,7 @@ Get list of available agent providers
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path | Snippet ID | Yes | string |
+| snippet_id | path | Snippet ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -8974,7 +9048,7 @@ Export snippet configuration as DSL
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path | Snippet ID to export | Yes | string |
+| snippet_id | path | Snippet ID to export | Yes | string (uuid) |
 | include_secret | query | Whether to include secret variables | No | string, <br>**Default:** false |
 
 #### Responses
@@ -8993,7 +9067,7 @@ Increment snippet use count by 1
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| snippet_id | path | Snippet ID | Yes | string |
+| snippet_id | path | Snippet ID | Yes | string (uuid) |
 
 #### Responses
 
@@ -9262,7 +9336,7 @@ Update a plugin endpoint
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| member_id | path |  | Yes | string |
+| member_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -9275,7 +9349,7 @@ Update a plugin endpoint
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| member_id | path |  | Yes | string |
+| member_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -9294,7 +9368,7 @@ Update a plugin endpoint
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| member_id | path |  | Yes | string |
+| member_id | path |  | Yes | string (uuid) |
 
 #### Request Body
 
@@ -10128,6 +10202,539 @@ Returns permission flags that control workspace features like member invitations
 | ---- | ----------- | ------ |
 | 200 | Success | **application/json**: [PluginCategoryListResponse](#plugincategorylistresponse)<br> |
 
+### [GET] /workspaces/current/rbac/access-policies
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [_AccessPolicyList](#_accesspolicylist)<br> |
+
+### [POST] /workspaces/current/rbac/access-policies
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Policy created | **application/json**: [AccessPolicy](#accesspolicy)<br> |
+
+### [DELETE] /workspaces/current/rbac/access-policies/{policy_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [AccessPolicy](#accesspolicy)<br> |
+
+### [GET] /workspaces/current/rbac/access-policies/{policy_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [AccessPolicy](#accesspolicy)<br> |
+
+### [PUT] /workspaces/current/rbac/access-policies/{policy_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [AccessPolicy](#accesspolicy)<br> |
+
+### [POST] /workspaces/current/rbac/access-policies/{policy_id}/copy
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Policy copied | **application/json**: [AccessPolicy](#accesspolicy)<br> |
+
+### [PUT] /workspaces/current/rbac/access-policy-bindings/{binding_id}/lock
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| binding_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [AccessPolicyBindingState](#accesspolicybindingstate)<br> |
+
+### [PUT] /workspaces/current/rbac/access-policy-bindings/{binding_id}/unlock
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| binding_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [AccessPolicyBindingState](#accesspolicybindingstate)<br> |
+
+### [DELETE] /workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/member-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+| policy_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MemberBindingsResponse](#memberbindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/member-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+| policy_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MemberBindingsResponse](#memberbindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/role-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [RoleBindingsResponse](#rolebindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/apps/{app_id}/access-policy
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [AppAccessMatrix](#appaccessmatrix)<br> |
+
+### [GET] /workspaces/current/rbac/apps/{app_id}/user-access-policies
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [ResourceUserAccessPoliciesResponse](#resourceuseraccesspoliciesresponse)<br> |
+
+### [PUT] /workspaces/current/rbac/apps/{app_id}/users/{target_account_id}/access-policies
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+| target_account_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [ReplaceUserAccessPoliciesResponse](#replaceuseraccesspoliciesresponse)<br> |
+
+### [GET] /workspaces/current/rbac/apps/{app_id}/whitelist
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [ResourceWhitelist](#resourcewhitelist)<br> |
+
+### [PUT] /workspaces/current/rbac/apps/{app_id}/whitelist
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [ResourceWhitelist](#resourcewhitelist)<br> |
+
+### [DELETE] /workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/member-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path |  | Yes | string (uuid) |
+| policy_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MemberBindingsResponse](#memberbindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/member-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path |  | Yes | string (uuid) |
+| policy_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MemberBindingsResponse](#memberbindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/role-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path |  | Yes | string (uuid) |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [RoleBindingsResponse](#rolebindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/datasets/{dataset_id}/access-policy
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [DatasetAccessMatrix](#datasetaccessmatrix)<br> |
+
+### [GET] /workspaces/current/rbac/datasets/{dataset_id}/user-access-policies
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [ResourceUserAccessPoliciesResponse](#resourceuseraccesspoliciesresponse)<br> |
+
+### [PUT] /workspaces/current/rbac/datasets/{dataset_id}/users/{target_account_id}/access-policies
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path |  | Yes | string (uuid) |
+| target_account_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [ReplaceUserAccessPoliciesResponse](#replaceuseraccesspoliciesresponse)<br> |
+
+### [GET] /workspaces/current/rbac/datasets/{dataset_id}/whitelist
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [ResourceWhitelist](#resourcewhitelist)<br> |
+
+### [PUT] /workspaces/current/rbac/datasets/{dataset_id}/whitelist
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [ResourceWhitelist](#resourcewhitelist)<br> |
+
+### [GET] /workspaces/current/rbac/members/{member_id}/rbac-roles
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| member_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MemberRolesResponse](#memberrolesresponse)<br> |
+
+### [PUT] /workspaces/current/rbac/members/{member_id}/rbac-roles
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| member_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MemberRolesResponse](#memberrolesresponse)<br> |
+
+### [GET] /workspaces/current/rbac/my-permissions
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MyPermissionsResponse](#mypermissionsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/role-permissions/catalog
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [PermissionCatalogResponse](#permissioncatalogresponse)<br> |
+
+### [GET] /workspaces/current/rbac/role-permissions/catalog/app
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [PermissionCatalogResponse](#permissioncatalogresponse)<br> |
+
+### [GET] /workspaces/current/rbac/role-permissions/catalog/dataset
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [PermissionCatalogResponse](#permissioncatalogresponse)<br> |
+
+### [GET] /workspaces/current/rbac/roles
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [_RBACRoleList](#_rbacrolelist)<br> |
+
+### [POST] /workspaces/current/rbac/roles
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Role created | **application/json**: [RBACRole](#rbacrole)<br> |
+
+### [DELETE] /workspaces/current/rbac/roles/{role_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| role_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [RBACRole](#rbacrole)<br> |
+
+### [GET] /workspaces/current/rbac/roles/{role_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| role_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [RBACRole](#rbacrole)<br> |
+
+### [PUT] /workspaces/current/rbac/roles/{role_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| role_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [RBACRole](#rbacrole)<br> |
+
+### [POST] /workspaces/current/rbac/roles/{role_id}/copy
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| role_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Role copied | **application/json**: [RBACRole](#rbacrole)<br> |
+
+### [GET] /workspaces/current/rbac/roles/{role_id}/members
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| role_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [_MembersInRoleList](#_membersinrolelist)<br> |
+
+### [PUT] /workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [AccessMatrixItem](#accessmatrixitem)<br> |
+
+### [GET] /workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/member-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MemberBindingsResponse](#memberbindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/role-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [RoleBindingsResponse](#rolebindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/workspace/apps/access-policy
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [WorkspaceAccessMatrix](#workspaceaccessmatrix)<br> |
+
+### [PUT] /workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [AccessMatrixItem](#accessmatrixitem)<br> |
+
+### [GET] /workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/member-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [MemberBindingsResponse](#memberbindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/role-bindings
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| policy_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [RoleBindingsResponse](#rolebindingsresponse)<br> |
+
+### [GET] /workspaces/current/rbac/workspace/datasets/access-policy
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Success | **application/json**: [WorkspaceAccessMatrix](#workspaceaccessmatrix)<br> |
+
 ### [GET] /workspaces/current/tool-labels
 #### Responses
 
@@ -11056,6 +11663,84 @@ Default namespace
 | id | string |  | Yes |
 | name | string |  | Yes |
 
+#### AccessMatrixItem
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| accounts | [ [AccessPolicyAccount](#accesspolicyaccount) ] |  | No |
+| policy | [AccessPolicy](#accesspolicy) |  | No |
+| roles | [ [AccessPolicyRole](#accesspolicyrole) ] |  | No |
+
+#### AccessPolicy
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| category | string |  | No |
+| created_at | integer |  | No |
+| description | string |  | No |
+| id | string |  | Yes |
+| is_builtin | boolean |  | No |
+| name | string |  | Yes |
+| permission_keys | [ string ] |  | No |
+| policy_key | string |  | No |
+| resource_type | string |  | Yes |
+| tenant_id | string |  | No |
+| updated_at | integer |  | No |
+
+#### AccessPolicyAccount
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| account_id | string |  | Yes |
+| account_name | string |  | Yes |
+| avatar | string |  | No |
+| binding_id | string |  | Yes |
+| email | string |  | No |
+| is_locked | boolean |  | No |
+
+#### AccessPolicyBindingState
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| binding_id | string |  | Yes |
+| is_locked | boolean |  | No |
+
+#### AccessPolicyMemberBinding
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| access_policy_id | string |  | Yes |
+| account_id | string |  | Yes |
+| account_name | string |  | No |
+| created_at | integer |  | No |
+| id | string |  | Yes |
+| resource_id | string |  | No |
+| resource_type | string |  | Yes |
+| tenant_id | string |  | No |
+
+#### AccessPolicyRole
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| binding_id | string |  | Yes |
+| is_locked | boolean |  | No |
+| role_id | string |  | Yes |
+| role_name | string |  | Yes |
+| role_tag | string |  | No |
+
+#### AccessPolicyRoleBinding
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| access_policy_id | string |  | Yes |
+| created_at | integer |  | No |
+| id | string |  | Yes |
+| resource_id | string |  | No |
+| resource_type | string |  | Yes |
+| role_id | string |  | Yes |
+| role_name | string |  | No |
+| tenant_id | string |  | No |
+
 #### Account
 
 | Name | Type | Description | Required |
@@ -11166,6 +11851,7 @@ Default namespace
 | last_login_at | integer |  | No |
 | name | string |  | Yes |
 | role | string |  | Yes |
+| roles | [ object ] |  | No |
 | status | string |  | Yes |
 
 #### AccountWithRoleList
@@ -11187,9 +11873,9 @@ Default namespace
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | email | string |  | No |
-| interface_language | string |  | Yes |
-| name | string |  | Yes |
-| timezone | string |  | Yes |
+| interface_language | string |  | No |
+| name | string |  | No |
+| timezone | string |  | No |
 | token | string |  | Yes |
 | workspace_id | string |  | No |
 
@@ -11197,7 +11883,9 @@ Default namespace
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
+| account_status | string |  | No |
 | email | string |  | Yes |
+| requires_setup | boolean |  | No |
 | workspace_id | string |  | Yes |
 | workspace_name | string |  | Yes |
 
@@ -11286,7 +11974,42 @@ Default namespace
 | icon_background | string | Icon background color | No |
 | icon_type | [IconType](#icontype) | Icon type | No |
 | name | string | Agent name | Yes |
-| role | string | Agent role | No |
+| role | string | Agent role | Yes |
+
+#### AgentAppDetailWithSite
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| access_mode | string |  | No |
+| active_config_is_published | boolean |  | No |
+| api_base_url | string |  | No |
+| app_id | string |  | No |
+| bound_agent_id | string |  | No |
+| created_at | integer |  | No |
+| created_by | string |  | No |
+| deleted_tools | [ [DeletedTool](#deletedtool) ] |  | No |
+| description | string |  | No |
+| enable_api | boolean |  | Yes |
+| enable_site | boolean |  | Yes |
+| icon | string |  | No |
+| icon_background | string |  | No |
+| icon_type | string |  | No |
+| icon_url | string |  | Yes |
+| id | string |  | Yes |
+| maintainer | string |  | No |
+| max_active_requests | integer |  | No |
+| mode | string |  | Yes |
+| model_config | [ModelConfig](#modelconfig) |  | No |
+| name | string |  | Yes |
+| permission_keys | [ string ] |  | No |
+| role | string |  | No |
+| site | [Site](#site) |  | No |
+| tags | [ [Tag](#tag) ] |  | No |
+| tracing | [JSONValue](#jsonvalue) |  | No |
+| updated_at | integer |  | No |
+| updated_by | string |  | No |
+| use_icon_as_answer_icon | boolean |  | No |
+| workflow | [WorkflowPartial](#workflowpartial) |  | No |
 
 #### AgentAppFeaturesPayload
 
@@ -11305,6 +12028,61 @@ default (the config form sends the full desired feature state on save).
 | suggested_questions_after_answer | [AgentSuggestedQuestionsAfterAnswerFeatureConfig](#agentsuggestedquestionsafteranswerfeatureconfig) | Follow-up suggestions config, e.g. {'enabled': true} | No |
 | text_to_speech | [AgentTextToSpeechFeatureConfig](#agenttexttospeechfeatureconfig) | Text-to-speech config | No |
 
+#### AgentAppPagination
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [AgentAppPartial](#agentapppartial) ] |  | Yes |
+| has_more | boolean |  | Yes |
+| limit | integer |  | Yes |
+| page | integer |  | Yes |
+| total | integer |  | Yes |
+
+#### AgentAppPartial
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| access_mode | string |  | No |
+| active_config_is_published | boolean |  | No |
+| app_id | string |  | No |
+| author_name | string |  | No |
+| bound_agent_id | string |  | No |
+| create_user_name | string |  | No |
+| created_at | integer |  | No |
+| created_by | string |  | No |
+| description | string |  | No |
+| has_draft_trigger | boolean |  | No |
+| icon | string |  | No |
+| icon_background | string |  | No |
+| icon_type | string |  | No |
+| icon_url | string |  | Yes |
+| id | string |  | Yes |
+| is_starred | boolean |  | No |
+| maintainer | string |  | No |
+| max_active_requests | integer |  | No |
+| mode | string |  | Yes |
+| model_config | [ModelConfigPartial](#modelconfigpartial) |  | No |
+| name | string |  | Yes |
+| permission_keys | [ string ] |  | No |
+| published_reference_count | integer |  | No |
+| published_references | [ [AgentAppPublishedReferenceResponse](#agentapppublishedreferenceresponse) ] |  | No |
+| role | string |  | No |
+| tags | [ [Tag](#tag) ] |  | No |
+| updated_at | integer |  | No |
+| updated_by | string |  | No |
+| use_icon_as_answer_icon | boolean |  | No |
+| workflow | [WorkflowPartial](#workflowpartial) |  | No |
+
+#### AgentAppPublishedReferenceResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| app_icon | string |  | No |
+| app_icon_background | string |  | No |
+| app_icon_type | string |  | No |
+| app_id | string |  | Yes |
+| app_name | string |  | Yes |
+
 #### AgentAppUpdatePayload
 
 | Name | Type | Description | Required |
@@ -11315,9 +12093,23 @@ default (the config form sends the full desired feature state on save).
 | icon_type | [IconType](#icontype) | Icon type | No |
 | max_active_requests | integer | Maximum active requests | No |
 | name | string | App name | Yes |
-| role | string | Agent role | No |
+| role | string | Agent role | Yes |
 | use_icon_as_answer_icon | boolean | Use icon as answer icon | No |
 
+#### AgentAverageResponseTimeStatisticResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| date | string |  | Yes |
+| latency | number |  | Yes |
+
+#### AgentAverageSessionInteractionStatisticResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| date | string |  | Yes |
+| interactions | number |  | Yes |
+
 #### AgentCliToolAuthorizationStatus
 
 Authorization state for Agent-scoped CLI tools.
@@ -11534,8 +12326,10 @@ Audit operation recorded for Agent Soul version/revision changes.
 | config_snapshot | [AgentSoulConfig](#agentsoulconfig) |  | Yes |
 | created_at | integer |  | No |
 | created_by | string |  | No |
+| display_version | integer |  | No |
 | id | string |  | Yes |
 | revisions | [ [AgentConfigRevisionResponse](#agentconfigrevisionresponse) ] |  | No |
+| snapshot_version | integer |  | No |
 | summary | string |  | No |
 | version | integer |  | Yes |
 | version_note | string |  | No |
@@ -11553,11 +12347,34 @@ Audit operation recorded for Agent Soul version/revision changes.
 | agent_id | string |  | No |
 | created_at | integer |  | No |
 | created_by | string |  | No |
+| display_version | integer |  | No |
 | id | string |  | Yes |
+| snapshot_version | integer |  | No |
 | summary | string |  | No |
 | version | integer |  | Yes |
 | version_note | string |  | No |
 
+#### AgentDailyConversationStatisticResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| conversation_count | integer |  | Yes |
+| date | string |  | Yes |
+
+#### AgentDailyEndUserStatisticResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| date | string |  | Yes |
+| terminal_count | integer |  | Yes |
+
+#### AgentDailyMessageStatisticResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| date | string |  | Yes |
+| message_count | integer |  | Yes |
+
 #### AgentDriveDeleteFileByAgentQuery
 
 | Name | Type | Description | Required |
@@ -11703,6 +12520,7 @@ Supported icon storage formats for Agent roster entries.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
+| active_config_is_published | boolean |  | No |
 | active_config_snapshot | [AgentConfigSnapshotSummaryResponse](#agentconfigsnapshotsummaryresponse) |  | No |
 | active_config_snapshot_id | string |  | No |
 | agent_kind | [AgentKind](#agentkind) |  | Yes |
@@ -11796,6 +12614,65 @@ the current roster/workflow APIs scoped to Dify Agent.
 | ---- | ---- | ----------- | -------- |
 | AgentKnowledgeQueryMode | string |  |  |
 
+#### AgentLogConversationItemResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| conversation_id | string |  | Yes |
+| created_at | integer |  | No |
+| end_user_id | string |  | No |
+| id | string |  | Yes |
+| message_count | integer |  | Yes |
+| operation_rate | number |  | No |
+| source | [AgentLogSourceResponse](#agentlogsourceresponse) |  | No |
+| status | string, <br>**Available values:** "failed", "paused", "success" | *Enum:* `"failed"`, `"paused"`, `"success"` | Yes |
+| title | string |  | No |
+| unread | boolean |  | Yes |
+| updated_at | integer |  | No |
+| user_rate | number |  | No |
+
+#### AgentLogListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [AgentLogConversationItemResponse](#agentlogconversationitemresponse) ] |  | Yes |
+| has_more | boolean |  | Yes |
+| limit | integer |  | Yes |
+| page | integer |  | Yes |
+| total | integer |  | Yes |
+
+#### AgentLogMessageItemResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| answer | string |  | Yes |
+| answer_tokens | integer |  | Yes |
+| conversation_id | string |  | Yes |
+| created_at | integer |  | No |
+| currency | string |  | Yes |
+| error | string |  | No |
+| from_account_id | string |  | No |
+| from_end_user_id | string |  | No |
+| id | string |  | Yes |
+| latency | number |  | Yes |
+| message_id | string |  | Yes |
+| message_tokens | integer |  | Yes |
+| query | string |  | Yes |
+| status | string |  | Yes |
+| total_price | string |  | Yes |
+| total_tokens | integer |  | Yes |
+| updated_at | integer |  | No |
+
+#### AgentLogMessageListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [AgentLogMessageItemResponse](#agentlogmessageitemresponse) ] |  | Yes |
+| has_more | boolean |  | Yes |
+| limit | integer |  | Yes |
+| page | integer |  | Yes |
+| total | integer |  | Yes |
+
 #### AgentLogMetaResponse
 
 | Name | Type | Description | Required |
@@ -11823,6 +12700,52 @@ the current roster/workflow APIs scoped to Dify Agent.
 | iterations | [ [AgentIterationLogResponse](#agentiterationlogresponse) ] |  | Yes |
 | meta | [AgentLogMetaResponse](#agentlogmetaresponse) |  | Yes |
 
+#### AgentLogSourceGroupResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| label | string |  | Yes |
+| sources | [ [AgentLogSourceResponse](#agentlogsourceresponse) ] |  | No |
+| type | string, <br>**Available values:** "webapp", "workflow" | *Enum:* `"webapp"`, `"workflow"` | Yes |
+
+#### AgentLogSourceListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [AgentLogSourceResponse](#agentlogsourceresponse) ] |  | Yes |
+| groups | [ [AgentLogSourceGroupResponse](#agentlogsourcegroupresponse) ] |  | Yes |
+
+#### AgentLogSourceResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| app_icon | string |  | No |
+| app_icon_background | string |  | No |
+| app_icon_type | string |  | No |
+| app_id | string |  | Yes |
+| app_name | string |  | Yes |
+| id | string |  | Yes |
+| node_id | string |  | No |
+| type | string, <br>**Available values:** "webapp", "workflow" | *Enum:* `"webapp"`, `"workflow"` | Yes |
+| workflow_id | string |  | No |
+| workflow_version | string |  | No |
+
+#### AgentLogsQuery
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| end | string | End date (YYYY-MM-DD HH:MM) | No |
+| keyword | string | Search query, answer, or conversation name | No |
+| limit | integer, <br>**Default:** 20 | Page size | No |
+| page | integer, <br>**Default:** 1 | Page number | No |
+| sort_by | string, <br>**Default:** updated_at | Sort by created_at or updated_at | No |
+| sort_order | string, <br>**Default:** desc | Sort order: asc or desc | No |
+| source | string | Deprecated single source filter | No |
+| sources | [ string ] | Filter by one or more source IDs, e.g. webapp:<app_id> or workflow:<app_id>:<workflow_id>:<version>:<node_id> | No |
+| start | string | Start date (YYYY-MM-DD HH:MM) | No |
+| status | string | Deprecated single status filter | No |
+| statuses | [ string ] | Filter by one or more of success, failed, paused | No |
+
 #### AgentMemoryArtifactConfig
 
 | Name | Type | Description | Required |
@@ -11924,6 +12847,7 @@ the current roster/workflow APIs scoped to Dify Agent.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
+| active_config_is_published | boolean |  | No |
 | active_config_snapshot | [AgentConfigSnapshotSummaryResponse](#agentconfigsnapshotsummaryresponse) |  | No |
 | active_config_snapshot_id | string |  | No |
 | agent_kind | [AgentKind](#agentkind) |  | Yes |
@@ -11989,6 +12913,7 @@ Visibility and lifecycle scope of an Agent record.
 | provider_credential_id | string |  | No |
 | ref | string |  | No |
 | type | string |  | No |
+| value | string |  | No |
 | variable | string |  | No |
 
 #### AgentSensitiveWordAvoidanceFeatureConfig
@@ -12014,13 +12939,6 @@ Visibility and lifecycle scope of an Agent record.
 | skill_md_file_id | string |  | No |
 | skill_md_key | string |  | No |
 
-#### AgentSkillStandardizeResponse
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| manifest | [SkillManifest](#skillmanifest) |  | Yes |
-| skill | [AgentSkillRefConfig](#agentskillrefconfig) |  | Yes |
-
 #### AgentSkillUploadResponse
 
 | Name | Type | Description | Required |
@@ -12194,6 +13112,50 @@ Origin that created or imported the Agent.
 | ---- | ---- | ----------- | -------- |
 | AgentSource | string | Origin that created or imported the Agent. |  |
 
+#### AgentStatisticChartsResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| average_response_time | [ [AgentAverageResponseTimeStatisticResponse](#agentaverageresponsetimestatisticresponse) ] |  | No |
+| average_session_interactions | [ [AgentAverageSessionInteractionStatisticResponse](#agentaveragesessioninteractionstatisticresponse) ] |  | No |
+| daily_conversations | [ [AgentDailyConversationStatisticResponse](#agentdailyconversationstatisticresponse) ] |  | No |
+| daily_end_users | [ [AgentDailyEndUserStatisticResponse](#agentdailyenduserstatisticresponse) ] |  | No |
+| daily_messages | [ [AgentDailyMessageStatisticResponse](#agentdailymessagestatisticresponse) ] |  | No |
+| token_usage | [ [AgentTokenUsageStatisticResponse](#agenttokenusagestatisticresponse) ] |  | No |
+| tokens_per_second | [ [AgentTokensPerSecondStatisticResponse](#agenttokenspersecondstatisticresponse) ] |  | No |
+| user_satisfaction_rate | [ [AgentUserSatisfactionRateStatisticResponse](#agentusersatisfactionratestatisticresponse) ] |  | No |
+
+#### AgentStatisticSummaryEnvelopeResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| charts | [AgentStatisticChartsResponse](#agentstatisticchartsresponse) |  | Yes |
+| source | string |  | Yes |
+| summary | [AgentStatisticSummaryResponse](#agentstatisticsummaryresponse) |  | Yes |
+
+#### AgentStatisticSummaryResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| average_response_time | number |  | Yes |
+| average_session_interactions | number |  | Yes |
+| currency | string |  | Yes |
+| tokens_per_second | number |  | Yes |
+| total_conversations | integer |  | Yes |
+| total_end_users | integer |  | Yes |
+| total_messages | integer |  | Yes |
+| total_price | string |  | Yes |
+| total_tokens | integer |  | Yes |
+| user_satisfaction_rate | number |  | Yes |
+
+#### AgentStatisticsQuery
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| end | string | End date (YYYY-MM-DD HH:MM) | No |
+| source | string | Filter by all, console/explore, api/service-api, web-app, debugger, openapi, or trigger | No |
+| start | string | Start date (YYYY-MM-DD HH:MM) | No |
+
 #### AgentStatus
 
 Soft lifecycle state for Agent records.
@@ -12236,6 +13198,22 @@ Soft lifecycle state for Agent records.
 | tool_input | string |  | No |
 | tool_labels | [JSONValue](#jsonvalue) |  | Yes |
 
+#### AgentTokenUsageStatisticResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| currency | string |  | Yes |
+| date | string |  | Yes |
+| token_count | integer |  | Yes |
+| total_price | string |  | Yes |
+
+#### AgentTokensPerSecondStatisticResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| date | string |  | Yes |
+| tps | number |  | Yes |
+
 #### AgentToolCallResponse
 
 | Name | Type | Description | Required |
@@ -12250,6 +13228,13 @@ Soft lifecycle state for Agent records.
 | tool_output | object |  | Yes |
 | tool_parameters | object |  | Yes |
 
+#### AgentUserSatisfactionRateStatisticResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| date | string |  | Yes |
+| rate | number |  | Yes |
+
 #### AllowedExtensionsResponse
 
 | Name | Type | Description | Required |
@@ -12481,6 +13466,13 @@ Enum class for api provider schema type.
 | schema_type | [ApiProviderSchemaType](#apiproviderschematype) |  | Yes |
 | tool_name | string |  | Yes |
 
+#### AppAccessMatrix
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| app_id | string |  | No |
+| items | [ [AccessMatrixItem](#accessmatrixitem) ] |  | No |
+
 #### AppApiStatusPayload
 
 | Name | Type | Description | Required |
@@ -12501,8 +13493,10 @@ Enum class for api provider schema type.
 | icon | string |  | No |
 | icon_background | string |  | No |
 | id | string |  | Yes |
+| maintainer | string |  | No |
 | mode_compatible_with_agent | string |  | Yes |
 | name | string |  | Yes |
+| permission_keys | [ string ] |  | No |
 | tags | [ [Tag](#tag) ] |  | No |
 | tracing | [JSONValue](#jsonvalue) |  | No |
 | updated_at | integer |  | No |
@@ -12529,11 +13523,12 @@ Enum class for api provider schema type.
 | icon_type | string |  | No |
 | icon_url | string |  | Yes |
 | id | string |  | Yes |
+| maintainer | string |  | No |
 | max_active_requests | integer |  | No |
 | mode | string |  | Yes |
 | model_config | [ModelConfig](#modelconfig) |  | No |
 | name | string |  | Yes |
-| role | string |  | No |
+| permission_keys | [ string ] |  | No |
 | site | [Site](#site) |  | No |
 | tags | [ [Tag](#tag) ] |  | No |
 | tracing | [JSONValue](#jsonvalue) |  | No |
@@ -12652,11 +13647,12 @@ AppMCPServer Status Enum
 | icon_url | string |  | Yes |
 | id | string |  | Yes |
 | is_starred | boolean |  | No |
+| maintainer | string |  | No |
 | max_active_requests | integer |  | No |
 | mode | string |  | Yes |
 | model_config | [ModelConfigPartial](#modelconfigpartial) |  | No |
 | name | string |  | Yes |
-| role | string |  | No |
+| permission_keys | [ string ] |  | No |
 | tags | [ [Tag](#tag) ] |  | No |
 | updated_at | integer |  | No |
 | updated_by | string |  | No |
@@ -13001,7 +13997,7 @@ Button styles for user actions.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| content | string |  | Yes |
+| content | string | Child chunk text content. | Yes |
 
 #### ChildChunkDetailResponse
 
@@ -13044,14 +14040,14 @@ Button styles for user actions.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| content | string |  | Yes |
-| id | string |  | No |
+| content | string | Child chunk text content. | Yes |
+| id | string | Existing child chunk ID. Omit to create a new child chunk. | No |
 
 #### ChildChunkUpdatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| content | string |  | Yes |
+| content | string | Child chunk text content. | Yes |
 
 #### CliToolSuggestion
 
@@ -13209,9 +14205,9 @@ Condition detail
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| comparison_operator | string, <br>**Available values:** "<", "=", ">", "after", "before", "contains", "empty", "end with", "in", "is", "is not", "not contains", "not empty", "not in", "start with", "≠", "≤", "≥" | *Enum:* `"<"`, `"="`, `">"`, `"after"`, `"before"`, `"contains"`, `"empty"`, `"end with"`, `"in"`, `"is"`, `"is not"`, `"not contains"`, `"not empty"`, `"not in"`, `"start with"`, `"≠"`, `"≤"`, `"≥"` | Yes |
-| name | string |  | Yes |
-| value | string<br>[ string ]<br>integer<br>number |  | No |
+| comparison_operator | string, <br>**Available values:** "<", "=", ">", "after", "before", "contains", "empty", "end with", "in", "is", "is not", "not contains", "not empty", "not in", "start with", "≠", "≤", "≥" | Comparison to apply. String operators (`contains`, `not contains`, `start with`, `end with`, `is`, `is not`, `empty`, `not empty`, `in`, `not in`) act on string or array metadata; numeric operators (`=`, `≠`, `>`, `<`, `≥`, `≤`) act on numeric metadata; time operators (`before`, `after`) act on time metadata.<br>*Enum:* `"<"`, `"="`, `">"`, `"after"`, `"before"`, `"contains"`, `"empty"`, `"end with"`, `"in"`, `"is"`, `"is not"`, `"not contains"`, `"not empty"`, `"not in"`, `"start with"`, `"≠"`, `"≤"`, `"≥"` | Yes |
+| name | string | Metadata field name to compare against. | Yes |
+| value | string<br>[ string ]<br>number | Value to compare against. Type depends on `comparison_operator`: string for most string operators, array of strings for `in` and `not in`, number for numeric operators, and omit or use `null` for `empty` and `not empty`. | No |
 
 #### ConfigurateMethod
 
@@ -13353,8 +14349,8 @@ Enum class for configurate method of provider model.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| auto_generate | boolean |  | No |
-| name | string |  | No |
+| auto_generate | boolean | Automatically generate the conversation name. When `true`, the `name` field is ignored. | No |
+| name | string | Conversation name. Required when `auto_generate` is `false`. | No |
 
 #### ConversationVariableResponse
 
@@ -13652,6 +14648,13 @@ Model class for provider custom model configuration.
 | workspace_id | string |  | Yes |
 | workspace_name | string |  | Yes |
 
+#### DatasetAccessMatrix
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| dataset_id | string |  | No |
+| items | [ [AccessMatrixItem](#accessmatrixitem) ] |  | No |
+
 #### DatasetAndDocumentResponse
 
 | Name | Type | Description | Required |
@@ -13700,6 +14703,7 @@ Model class for provider custom model configuration.
 | is_published | boolean |  | No |
 | name | string |  | No |
 | permission | string |  | No |
+| permission_keys | [ string ] |  | No |
 | pipeline_id | string |  | No |
 | provider | string |  | No |
 | retrieval_model_dict | [DatasetRetrievalModel](#datasetretrievalmodel) |  | No |
@@ -13738,8 +14742,10 @@ Model class for provider custom model configuration.
 | indexing_technique | string |  | Yes |
 | is_multimodal | boolean |  | Yes |
 | is_published | boolean |  | Yes |
+| maintainer | string |  | No |
 | name | string |  | Yes |
 | permission | string |  | Yes |
+| permission_keys | [ string ] |  | No |
 | pipeline_id | string |  | Yes |
 | provider | string |  | Yes |
 | retrieval_model_dict | [DatasetRetrievalModelResponse](#datasetretrievalmodelresponse) |  | Yes |
@@ -13778,9 +14784,11 @@ Model class for provider custom model configuration.
 | indexing_technique | string |  | Yes |
 | is_multimodal | boolean |  | Yes |
 | is_published | boolean |  | Yes |
+| maintainer | string |  | No |
 | name | string |  | Yes |
 | partial_member_list | [ string ] |  | No |
 | permission | string |  | Yes |
+| permission_keys | [ string ] |  | No |
 | pipeline_id | string |  | Yes |
 | provider | string |  | Yes |
 | retrieval_model_dict | [DatasetRetrievalModelResponse](#datasetretrievalmodelresponse) |  | Yes |
@@ -13882,9 +14890,11 @@ Model class for provider custom model configuration.
 | indexing_technique | string |  | Yes |
 | is_multimodal | boolean |  | Yes |
 | is_published | boolean |  | Yes |
+| maintainer | string |  | No |
 | name | string |  | Yes |
 | partial_member_list | [ string ] |  | Yes |
 | permission | string |  | Yes |
+| permission_keys | [ string ] |  | No |
 | pipeline_id | string |  | Yes |
 | provider | string |  | Yes |
 | retrieval_model_dict | [DatasetRetrievalModelResponse](#datasetretrievalmodelresponse) |  | Yes |
@@ -14201,6 +15211,7 @@ about. Stage 4 §4.2.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
+| children | [ { **"array_item"**: { **"children"**: [ object ], **"description"**: , **"type"**: string, <br>**Available values:** "array", "boolean", "file", "number", "object", "string" }, **"children"**: [ object ], **"description"**: , **"file"**: object, **"name"**: string, **"required"**: boolean, **"type"**: string, <br>**Available values:** "array", "boolean", "file", "number", "object", "string" } ] |  | No |
 | description | string |  | No |
 | type | [DeclaredOutputType](#declaredoutputtype) |  | Yes |
 
@@ -14229,6 +15240,7 @@ code can call ``output.failure_strategy.on_failure`` without None-guards.
 | ---- | ---- | ----------- | -------- |
 | array_item | [DeclaredArrayItem](#declaredarrayitem) |  | No |
 | check | [DeclaredOutputCheckConfig](#declaredoutputcheckconfig) |  | No |
+| children | [ { **"array_item"**: { **"children"**: [ object ], **"description"**: , **"type"**: string, <br>**Available values:** "array", "boolean", "file", "number", "object", "string" }, **"children"**: [ object ], **"description"**: , **"file"**: object, **"name"**: string, **"required"**: boolean, **"type"**: string, <br>**Available values:** "array", "boolean", "file", "number", "object", "string" } ] |  | No |
 | description | string |  | No |
 | failure_strategy | [DeclaredOutputFailureStrategy](#declaredoutputfailurestrategy) |  | No |
 | file | [DeclaredOutputFileConfig](#declaredoutputfileconfig) |  | No |
@@ -14329,15 +15341,15 @@ Request payload for bulk downloading documents as a zip archive.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| document_ids | [ string (uuid) ] |  | Yes |
+| document_ids | [ string (uuid) ] | List of document IDs to include in the ZIP download. | Yes |
 
 #### DocumentMetadataOperation
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| document_id | string |  | Yes |
-| metadata_list | [ [MetadataDetail](#metadatadetail) ] |  | Yes |
-| partial_update | boolean |  | No |
+| document_id | string | Document ID whose metadata should be updated. | Yes |
+| metadata_list | [ [MetadataDetail](#metadatadetail) ] | Metadata fields to update. | Yes |
+| partial_update | boolean | Whether to partially update metadata, keeping existing values for unspecified fields. | No |
 
 #### DocumentMetadataResponse
 
@@ -15119,10 +16131,10 @@ Enum class for form type.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| attachment_ids | [ string ] |  | No |
-| external_retrieval_model | object |  | No |
-| query | string |  | Yes |
-| retrieval_model | [RetrievalModel](#retrievalmodel) |  | No |
+| attachment_ids | [ string ] | List of attachment IDs to include in the retrieval context. | No |
+| external_retrieval_model | object | Retrieval settings for external knowledge bases. | No |
+| query | string | Search query text. | Yes |
+| retrieval_model | [RetrievalModel](#retrievalmodel) | Retrieval model configuration. Controls how chunks are searched and ranked. | No |
 
 #### HitTestingQuery
 
@@ -15308,6 +16320,7 @@ How Dify forwards the end-user's identity to an MCP server.
 | error | string |  | No |
 | id | string |  | Yes |
 | imported_dsl_version | string |  | No |
+| permission_keys | [ string ] |  | No |
 | status | [ImportStatus](#importstatus) |  | Yes |
 
 #### ImportStatus
@@ -15504,19 +16517,19 @@ Input field definition for snippet parameters.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| data_source | [DataSource](#datasource) |  | No |
-| doc_form | string, <br>**Default:** text_model |  | No |
-| doc_language | string, <br>**Default:** English |  | No |
-| duplicate | boolean, <br>**Default:** true |  | No |
-| embedding_model | string |  | No |
-| embedding_model_provider | string |  | No |
-| indexing_technique | string, <br>**Available values:** "economy", "high_quality" | *Enum:* `"economy"`, `"high_quality"` | Yes |
-| is_multimodal | boolean |  | No |
-| name | string |  | No |
-| original_document_id | string |  | No |
-| process_rule | [ProcessRule](#processrule) |  | No |
-| retrieval_model | [RetrievalModel](#retrievalmodel) |  | No |
-| summary_index_setting | object |  | No |
+| data_source | [DataSource](#datasource) | Document data source configuration. | No |
+| doc_form | string, <br>**Available values:** "hierarchical_model", "qa_model", "text_model", <br>**Default:** text_model | `text_model` for standard text chunking, `hierarchical_model` for parent-child chunk structure, `qa_model` for question-answer pair extraction.<br>*Enum:* `"hierarchical_model"`, `"qa_model"`, `"text_model"` | No |
+| doc_language | string, <br>**Default:** English | Language of the document for processing optimization. | No |
+| duplicate | boolean, <br>**Default:** true | Whether duplicate document content is allowed. | No |
+| embedding_model | string | Embedding model name. Use the `model` field from [Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`. | No |
+| embedding_model_provider | string | Embedding model provider. Use the `provider` field from [Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`. | No |
+| indexing_technique | string, <br>**Available values:** "economy", "high_quality" | `high_quality` uses embedding models for precise search; `economy` uses keyword-based indexing. Required when adding the first document to a knowledge base; subsequent documents inherit the knowledge base's indexing technique if omitted.<br>*Enum:* `"economy"`, `"high_quality"` | Yes |
+| is_multimodal | boolean | Whether the document uses multimodal indexing. | No |
+| name | string | Document name. | No |
+| original_document_id | string | Original document ID for replacement updates. | No |
+| process_rule | [ProcessRule](#processrule) | Processing rules for chunking. | No |
+| retrieval_model | [RetrievalModel](#retrievalmodel) | Retrieval model configuration. Controls how chunks are searched and ranked in this knowledge base. | No |
+| summary_index_setting | object | Summary index configuration. | No |
 
 #### KnowledgePipeline
 
@@ -15697,13 +16710,19 @@ Enum class for large language model mode.
 | result | string |  | Yes |
 | tenant_id | string |  | Yes |
 
+#### MemberBindingsResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [AccessPolicyMemberBinding](#accesspolicymemberbinding) ] |  | No |
+
 #### MemberInvitePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | emails | [ string ] |  | No |
 | language | string |  | No |
-| role | [TenantAccountRole](#tenantaccountrole) |  | Yes |
+| role | string |  | Yes |
 
 #### MemberInviteResponse
 
@@ -15728,6 +16747,20 @@ Enum class for large language model mode.
 | ---- | ---- | ----------- | -------- |
 | role | string |  | Yes |
 
+#### MemberRolesResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| account_id | string |  | Yes |
+| roles | [ [RBACRole](#rbacrole) ] |  | No |
+
+#### MembersInRole
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| account_id | string |  | No |
+| account_name | string |  | No |
+
 #### MessageDetail
 
 | Name | Type | Description | Required |
@@ -15789,9 +16822,9 @@ Enum class for large language model mode.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| content | string |  | No |
+| content | string | Optional text feedback providing additional detail. | No |
 | message_id | string | Message ID | Yes |
-| rating | string |  | No |
+| rating | string | Feedback rating. Set to `null` to revoke previously submitted feedback. | No |
 
 #### MessageFile
 
@@ -15846,24 +16879,24 @@ Enum class for large language model mode.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| conversation_id | string | Conversation UUID | Yes |
-| first_id | string | First message ID for pagination | No |
-| limit | integer, <br>**Default:** 20 | Number of messages to return (1-100) | No |
+| conversation_id | string | Conversation ID. | Yes |
+| first_id | string | The ID of the first chat record on the current page. Omit this value to fetch the latest messages; for subsequent pages, use the first message ID from the current list to fetch older messages. | No |
+| limit | integer, <br>**Default:** 20 | Number of chat history messages to return per request. | No |
 
 #### MetadataArgs
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| name | string |  | Yes |
-| type | string, <br>**Available values:** "number", "string", "time" | *Enum:* `"number"`, `"string"`, `"time"` | Yes |
+| name | string | Metadata field name. | Yes |
+| type | string, <br>**Available values:** "number", "string", "time" | `string` for text values, `number` for numeric values, `time` for date/time values.<br>*Enum:* `"number"`, `"string"`, `"time"` | Yes |
 
 #### MetadataDetail
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| id | string |  | Yes |
-| name | string |  | Yes |
-| value | string<br>integer<br>number |  | No |
+| id | string | Metadata field ID. | Yes |
+| name | string | Metadata field name. | Yes |
+| value | string<br>integer<br>number | Metadata value. Can be a string, number, or `null`. | No |
 
 #### MetadataFilteringCondition
 
@@ -15871,8 +16904,8 @@ Metadata Filtering Condition.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| conditions | [ [Condition](#condition) ] |  | No |
-| logical_operator | string |  | No |
+| conditions | [ [Condition](#condition) ] | List of metadata conditions to evaluate. | No |
+| logical_operator | string | How to combine multiple conditions. | No |
 
 #### MetadataOperationData
 
@@ -15880,13 +16913,13 @@ Metadata operation data
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| operation_data | [ [DocumentMetadataOperation](#documentmetadataoperation) ] |  | Yes |
+| operation_data | [ [DocumentMetadataOperation](#documentmetadataoperation) ] | Array of document metadata update operations. Each entry maps a document ID to its metadata values. | Yes |
 
 #### MetadataUpdatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| name | string |  | Yes |
+| name | string | New metadata field name. | Yes |
 
 #### ModelConfig
 
@@ -16038,11 +17071,20 @@ Model with provider entity.
 | ---- | ---- | ----------- | -------- |
 | response_mode | string, <br>**Available values:** "blocking", "streaming" | *Enum:* `"blocking"`, `"streaming"` | Yes |
 
+#### MyPermissionsResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| app | [ResourcePermissionSnapshot](#resourcepermissionsnapshot) |  | No |
+| dataset | [ResourcePermissionSnapshot](#resourcepermissionsnapshot) |  | No |
+| workspace | [WorkspacePermissionSnapshot](#workspacepermissionsnapshot) |  | No |
+
 #### NewAppResponse
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | new_app_id | string |  | Yes |
+| permission_keys | [ string ] |  | No |
 
 #### NodeIdQuery
 
@@ -16348,6 +17390,15 @@ output check fails and any configured retry attempts have been exhausted.
 | page | integer |  | Yes |
 | total | integer |  | Yes |
 
+#### Pagination
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| current_page | integer |  | No |
+| per_page | integer |  | No |
+| total_count | integer |  | No |
+| total_pages | integer |  | No |
+
 #### PaginationQuery
 
 | Name | Type | Description | Required |
@@ -16723,6 +17774,29 @@ Enum class for parameter type.
 | node_title | string |  | Yes |
 | pause_type | [HumanInputPauseTypeResponse](#humaninputpausetyperesponse) |  | Yes |
 
+#### PermissionCatalogGroup
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| description | string |  | No |
+| group_key | string |  | Yes |
+| group_name | string |  | Yes |
+| permissions | [ [PermissionCatalogItem](#permissioncatalogitem) ] |  | No |
+
+#### PermissionCatalogItem
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| description | string |  | No |
+| key | string |  | Yes |
+| name | string |  | Yes |
+
+#### PermissionCatalogResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| groups | [ [PermissionCatalogGroup](#permissioncataloggroup) ] |  | No |
+
 #### PermissionEnum
 
 Shared permission levels for resources (datasets, credentials, etc.)
@@ -17062,8 +18136,8 @@ Shared permission levels for resources (datasets, credentials, etc.)
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| enabled | boolean |  | Yes |
-| id | string |  | Yes |
+| enabled | boolean | Whether this preprocessing rule is enabled. | Yes |
+| id | string, <br>**Available values:** "remove_extra_spaces", "remove_stopwords", "remove_urls_emails" | Rule identifier.<br>*Enum:* `"remove_extra_spaces"`, `"remove_stopwords"`, `"remove_urls_emails"` | Yes |
 
 #### PreviewDetail
 
@@ -17088,8 +18162,8 @@ Serialized pricing info with codegen-safe decimal string patterns.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| mode | [ProcessRuleMode](#processrulemode) |  | Yes |
-| rules | [Rule](#rule) |  | No |
+| mode | [ProcessRuleMode](#processrulemode) | Processing mode. `automatic` uses built-in rules, `custom` allows manual configuration, and `hierarchical` enables parent-child chunk structure for `doc_form: hierarchical_model`. | Yes |
+| rules | [Rule](#rule) | Custom processing rules. | No |
 
 #### ProcessRuleMode
 
@@ -17281,6 +18355,29 @@ Model class for provider quota configuration.
 | ---- | ---- | ----------- | -------- |
 | QuotaUnit | string |  |  |
 
+#### RBACRole
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| category | string |  | No |
+| description | string |  | No |
+| id | string |  | Yes |
+| is_builtin | boolean |  | No |
+| name | string |  | Yes |
+| permission_keys | [ string ] |  | No |
+| role_tag | string |  | No |
+| tenant_id | string |  | No |
+| type | string |  | Yes |
+
+#### RBACRoleAccount
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| account_id | string |  | Yes |
+| account_name | string |  | No |
+| avatar | string |  | No |
+| email | string |  | No |
+
 #### RagPipelineDatasetImportPayload
 
 | Name | Type | Description | Required |
@@ -17442,12 +18539,53 @@ Model class for provider quota configuration.
 | ---- | ---- | ----------- | -------- |
 | url | string | URL to fetch | Yes |
 
+#### ReplaceUserAccessPoliciesResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| access_policies | [ [AccessPolicy](#accesspolicy) ] |  | No |
+
 #### RerankingModel
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| reranking_model_name | string |  | No |
-| reranking_provider_name | string |  | No |
+| reranking_model_name | string | Name of the reranking model. | No |
+| reranking_provider_name | string | Provider name of the reranking model. | No |
+
+#### ResourcePermissionKeys
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| permission_keys | [ string ] |  | No |
+| resource_id | string |  | Yes |
+
+#### ResourcePermissionSnapshot
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| default_permission_keys | [ string ] |  | No |
+| overrides | [ [ResourcePermissionKeys](#resourcepermissionkeys) ] |  | No |
+
+#### ResourceUserAccessPolicies
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| access_policies | [ [AccessPolicy](#accesspolicy) ] |  | No |
+| account | [RBACRoleAccount](#rbacroleaccount) |  | Yes |
+| roles | [ [RBACRole](#rbacrole) ] |  | No |
+
+#### ResourceUserAccessPoliciesResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [ResourceUserAccessPolicies](#resourceuseraccesspolicies) ] |  | No |
+| scope | string |  | Yes |
+
+#### ResourceWhitelist
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| account_ids | [ string ] |  | No |
 
 #### RestrictModel
 
@@ -17473,15 +18611,15 @@ Model class for provider quota configuration.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| metadata_filtering_conditions | [MetadataFilteringCondition](#metadatafilteringcondition) |  | No |
-| reranking_enable | boolean |  | Yes |
-| reranking_mode | string |  | No |
-| reranking_model | [RerankingModel](#rerankingmodel) |  | No |
-| score_threshold | number |  | No |
-| score_threshold_enabled | boolean |  | Yes |
-| search_method | [RetrievalMethod](#retrievalmethod) |  | Yes |
-| top_k | integer |  | Yes |
-| weights | [WeightModel](#weightmodel) |  | No |
+| metadata_filtering_conditions | [MetadataFilteringCondition](#metadatafilteringcondition) | Restrict retrieval to chunks whose document metadata matches the given conditions. Conditions are evaluated server-side against document metadata fields. | No |
+| reranking_enable | boolean | Whether reranking is enabled. | Yes |
+| reranking_mode | string | Reranking mode. Required when `reranking_enable` is `true`. | No |
+| reranking_model | [RerankingModel](#rerankingmodel) | Reranking model configuration. | No |
+| score_threshold | number | Minimum similarity score for results. Only effective when score threshold filtering is enabled. | No |
+| score_threshold_enabled | boolean | Whether score threshold filtering is enabled. | Yes |
+| search_method | [RetrievalMethod](#retrievalmethod) | Search method used for retrieval. | Yes |
+| top_k | integer | Maximum number of results to return. | Yes |
+| weights | [WeightModel](#weightmodel) | Weight configuration for hybrid search. | No |
 
 #### RetrievalSettingResponse
 
@@ -17511,6 +18649,12 @@ Model class for provider quota configuration.
 | summary | string |  | No |
 | word_count | integer |  | No |
 
+#### RoleBindingsResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [AccessPolicyRoleBinding](#accesspolicyrolebinding) ] |  | No |
+
 #### RosterListQuery
 
 | Name | Type | Description | Required |
@@ -17523,10 +18667,10 @@ Model class for provider quota configuration.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| parent_mode | string |  | No |
-| pre_processing_rules | [ [PreProcessingRule](#preprocessingrule) ] |  | No |
-| segmentation | [Segmentation](#segmentation) |  | No |
-| subchunk_segmentation | [Segmentation](#segmentation) |  | No |
+| parent_mode | string | Parent-child segmentation mode. | No |
+| pre_processing_rules | [ [PreProcessingRule](#preprocessingrule) ] | Pre-processing rules to apply before segmentation. | No |
+| segmentation | [Segmentation](#segmentation) | Parent chunk segmentation settings. | No |
+| subchunk_segmentation | [Segmentation](#segmentation) | Child chunk segmentation settings. | No |
 
 #### RuleCodeGeneratePayload
 
@@ -17730,10 +18874,10 @@ Model class for provider quota configuration.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| chunk_overlap | integer |  | No |
-| max_tokens | integer |  | Yes |
-| separator | string, <br>**Default:** 
- |  | No |
+| chunk_overlap | integer | Token overlap between chunks. | No |
+| max_tokens | integer | Maximum token count per chunk. | Yes |
+| separator | string, <br>**Default:**
+ | Custom separator for splitting text. | No |
 
 #### SelectInputConfig
 
@@ -18021,7 +19165,7 @@ Payload for running a loop node in snippet draft workflow.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| data | [ [_AnonymousInlineModel_efd591151ea9](#_anonymousinlinemodel_efd591151ea9) ] |  | No |
+| data | [ [_AnonymousInlineModel_744ff9cc03e6](#_anonymousinlinemodel_744ff9cc03e6) ] |  | No |
 | has_more | boolean |  | No |
 | limit | integer |  | No |
 | page | integer |  | No |
@@ -18189,6 +19333,7 @@ Model class for provider system configuration response.
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | branding | [BrandingModel](#brandingmodel) |  | Yes |
+| enable_app_deploy | boolean |  | Yes |
 | enable_change_email | boolean, <br>**Default:** true |  | Yes |
 | enable_collaboration_mode | boolean, <br>**Default:** true |  | Yes |
 | enable_creators_platform | boolean |  | Yes |
@@ -18205,6 +19350,7 @@ Model class for provider system configuration response.
 | max_plugin_package_size | integer, <br>**Default:** 15728640 |  | Yes |
 | plugin_installation_permission | [PluginInstallationPermissionModel](#plugininstallationpermissionmodel) |  | Yes |
 | plugin_manager | [PluginManagerModel](#pluginmanagermodel) |  | Yes |
+| rbac_enabled | boolean |  | Yes |
 | sso_enforced_for_signin | boolean |  | Yes |
 | sso_enforced_for_signin_protocol | string |  | Yes |
 | webapp_auth | [WebAppAuthModel](#webappauthmodel) |  | Yes |
@@ -18336,10 +19482,10 @@ Tag type
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| message_id | string | Message ID | No |
-| streaming | boolean | Enable streaming response | No |
-| text | string | Text to convert to audio | No |
-| voice | string | Voice to use for TTS | No |
+| message_id | string | Message ID. Takes priority over `text` when both are provided. | No |
+| streaming | boolean | Reserved for compatibility; TTS response streaming is determined by the provider output. | No |
+| text | string | Speech content to convert. | No |
+| voice | string | Voice to use for text-to-speech. Available voices depend on the TTS provider configured for this app. Omit to use the app's configured voice when available; that value is exposed by [Get App Parameters](/api-reference/applications/get-app-parameters) as `text_to_speech.voice`. | No |
 
 #### TextToSpeechPayload
 
@@ -18478,6 +19624,7 @@ Enum class for tool provider
 | mode | string |  | No |
 | model_config | [TrialAppModelConfig](#trialappmodelconfig) |  | No |
 | name | string |  | No |
+| permission_keys | [ string ] |  | No |
 | site | [TrialSite](#trialsite) |  | No |
 | tags | [ [TrialTag](#trialtag) ] |  | No |
 | updated_at | long |  | No |
@@ -18536,6 +19683,7 @@ Enum class for tool provider
 | indexing_technique | string |  | No |
 | name | string |  | No |
 | permission | string |  | No |
+| permission_keys | [ string ] |  | No |
 
 #### TrialDatasetList
 
@@ -18909,23 +20057,23 @@ in form definiton, or a variable while the workflow is running.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| keyword_weight | number |  | Yes |
+| keyword_weight | number | Weight assigned to keyword search results. | Yes |
 
 #### WeightModel
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| keyword_setting | [WeightKeywordSetting](#weightkeywordsetting) |  | No |
-| vector_setting | [WeightVectorSetting](#weightvectorsetting) |  | No |
-| weight_type | string |  | No |
+| keyword_setting | [WeightKeywordSetting](#weightkeywordsetting) | Keyword search weight settings. | No |
+| vector_setting | [WeightVectorSetting](#weightvectorsetting) | Semantic search weight settings. | No |
+| weight_type | string | Strategy for balancing semantic and keyword search weights. | No |
 
 #### WeightVectorSetting
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| embedding_model_name | string |  | Yes |
-| embedding_provider_name | string |  | Yes |
-| vector_weight | number |  | Yes |
+| embedding_model_name | string | Name of the embedding model used for vector search. | Yes |
+| embedding_provider_name | string | Provider of the embedding model used for vector search. | Yes |
+| vector_weight | number | Weight assigned to semantic vector search results. | Yes |
 
 #### WorkflowAgentBindingType
 
@@ -19621,8 +20769,8 @@ can reuse its existing handler.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| files | [ object ] |  | No |
-| inputs | object |  | Yes |
+| files | [ object ] | File list for workflow system file inputs. Available when file upload is enabled for the workflow. To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned `id` as `upload_file_id` with `transfer_method: local_file`. | No |
+| inputs | object | Key-value pairs for workflow input variables. Values for file-type variables should be arrays of file objects with `type`, `transfer_method`, and either `url` or `upload_file_id`. Refer to the `user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) response to discover the variable names and types expected by your app. | Yes |
 
 #### WorkflowRunQuery
 
@@ -19737,6 +20885,13 @@ Workflow tool configuration
 | marked_comment | string |  | No |
 | marked_name | string |  | No |
 
+#### WorkspaceAccessMatrix
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| items | [ [AccessMatrixItem](#accessmatrixitem) ] |  | No |
+| pagination | [Pagination](#pagination) |  | No |
+
 #### WorkspaceCustomConfigPayload
 
 | Name | Type | Description | Required |
@@ -19804,6 +20959,38 @@ Workflow tool configuration
 | allow_owner_transfer | boolean |  | Yes |
 | workspace_id | string |  | Yes |
 
+#### WorkspacePermissionSnapshot
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| permission_keys | [ string ] |  | No |
+
+#### _AccessPolicyList
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [AccessPolicy](#accesspolicy) ] |  | No |
+| pagination | [Pagination](#pagination) |  | No |
+
+#### _AnonymousInlineModel_744ff9cc03e6
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| author_name | string |  | No |
+| created_at | long |  | No |
+| created_by | string |  | No |
+| description | string |  | No |
+| icon_info | object |  | No |
+| id | string |  | No |
+| is_published | boolean |  | No |
+| name | string |  | No |
+| tags | [ [_AnonymousInlineModel_7b8b49ca164e](#_anonymousinlinemodel_7b8b49ca164e) ] |  | No |
+| type | string |  | No |
+| updated_at | long |  | No |
+| updated_by | string |  | No |
+| use_count | integer |  | No |
+| version | integer |  | No |
+
 #### _AnonymousInlineModel_7b8b49ca164e
 
 | Name | Type | Description | Required |
@@ -19829,24 +21016,26 @@ Workflow tool configuration
 | model_provider_name | string |  | No |
 | summary_prompt | string |  | No |
 
-#### _AnonymousInlineModel_efd591151ea9
+#### _MembersInRoleList
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| author_name | string |  | No |
-| created_at | long |  | No |
-| created_by | string |  | No |
-| description | string |  | No |
-| icon_info | object |  | No |
-| id | string |  | No |
-| is_published | boolean |  | No |
-| name | string |  | No |
-| tags | [ [_AnonymousInlineModel_7b8b49ca164e](#_anonymousinlinemodel_7b8b49ca164e) ] |  | No |
-| type | string |  | No |
-| updated_at | long |  | No |
-| updated_by | string |  | No |
-| use_count | integer |  | No |
-| version | integer |  | No |
+| data | [ [MembersInRole](#membersinrole) ] |  | No |
+| pagination | [Pagination](#pagination) |  | No |
+
+#### _RBACRoleAccountList
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [RBACRoleAccount](#rbacroleaccount) ] |  | No |
+| pagination | [Pagination](#pagination) |  | No |
+
+#### _RBACRoleList
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [RBACRole](#rbacrole) ] |  | No |
+| pagination | [Pagination](#pagination) |  | No |
 
 #### core__tools__entities__common_entities__I18nObject
 
diff --git a/api/openapi/markdown/openapi-openapi.md b/api/openapi/markdown/openapi-openapi.md
index d203eaa4c97..ce0150e8e88 100644
--- a/api/openapi/markdown/openapi-openapi.md
+++ b/api/openapi/markdown/openapi-openapi.md
@@ -4,10 +4,9 @@ User-scoped programmatic API (bearer auth)
 ## Version: 1.0
 
 ### Available authorizations
-#### Bearer (API Key Authentication)
-Type: Bearer {your-api-key}  
-**Name:** Authorization  
-**In:** header  
+#### Bearer (HTTP, bearer)
+Use the Service API key as a Bearer token in the Authorization header.
+Bearer format: API_KEY
 
 ---
 ## openapi
@@ -793,7 +792,7 @@ Liveness payload for `GET /openapi/v1/_health` — no auth required.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| action | string |  | Yes |
+| action | string | ID of the action button the recipient selected. Must match one of the `id` values from the form's `user_actions` list. | Yes |
 | inputs | object | Submitted human input values keyed by output variable name. Use a string for paragraph or select input values, a file mapping for file inputs, and a list of file mappings for file-list inputs. Local file mappings use `transfer_method=local_file` with `upload_file_id`; remote file mappings use `transfer_method=remote_url` with `url` or `remote_url`. | Yes |
 
 #### Import
@@ -806,6 +805,7 @@ Liveness payload for `GET /openapi/v1/_health` — no auth required.
 | error | string |  | No |
 | id | string |  | Yes |
 | imported_dsl_version | string |  | No |
+| permission_keys | [ string ] |  | No |
 | status | [ImportStatus](#importstatus) |  | Yes |
 
 #### ImportStatus
diff --git a/api/openapi/markdown/service-openapi.md b/api/openapi/markdown/service-openapi.md
index 5a0a128b4f9..8fc5e75e3cf 100644
--- a/api/openapi/markdown/service-openapi.md
+++ b/api/openapi/markdown/service-openapi.md
@@ -4,10 +4,9 @@ API for application services
 ## Version: 1.0
 
 ### Available authorizations
-#### Bearer (API Key Authentication)
-Type: Bearer {your-api-key}  
-**Name:** Authorization  
-**In:** header  
+#### Bearer (HTTP, bearer)
+Use the Service API key as a Bearer token in the Authorization header.
+Bearer format: API_KEY
 
 ---
 ## service_api
@@ -20,648 +19,6 @@ Service operations
 | ---- | ----------- | ------ |
 | 200 | Success | **application/json**: [IndexInfoResponse](#indexinforesponse)<br> |
 
-### [GET] /app/feedbacks
-**Get all feedbacks for the application**
-
-Get all feedbacks for the application
-Returns paginated list of all feedback submitted for messages in this app.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| limit | query | Number of feedbacks per page | No | integer, <br>**Default:** 20 |
-| page | query | Page number | No | integer, <br>**Default:** 1 |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Feedbacks retrieved successfully | **application/json**: [AppFeedbackListResponse](#appfeedbacklistresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-
-### [POST] /apps/annotation-reply/{action}
-**Enable or disable annotation reply feature**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| action | path | Action to perform: 'enable' or 'disable' | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [AnnotationReplyActionPayload](#annotationreplyactionpayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Action completed successfully | **application/json**: [AnnotationJobStatusResponse](#annotationjobstatusresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-
-### [GET] /apps/annotation-reply/{action}/status/{job_id}
-**Get the status of an annotation reply action job**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| action | path | Action type | Yes | string |
-| job_id | path | Job ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Job status retrieved successfully | **application/json**: [AnnotationJobStatusResponse](#annotationjobstatusresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Job not found |  |
-
-### [GET] /apps/annotations
-**List annotations for the application**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| keyword | query | Keyword to search annotations | No | string |
-| limit | query | Number of annotations per page | No | integer, <br>**Default:** 20 |
-| page | query | Page number | No | integer, <br>**Default:** 1 |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Annotations retrieved successfully | **application/json**: [AnnotationList](#annotationlist)<br> |
-| 401 | Unauthorized - invalid API token |  |
-
-### [POST] /apps/annotations
-**Create a new annotation**
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [AnnotationCreatePayload](#annotationcreatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 201 | Annotation created successfully | **application/json**: [Annotation](#annotation)<br> |
-| 401 | Unauthorized - invalid API token |  |
-
-### [DELETE] /apps/annotations/{annotation_id}
-**Delete an annotation**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| annotation_id | path | Annotation ID | Yes | string |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Annotation deleted successfully |
-| 401 | Unauthorized - invalid API token |
-| 403 | Forbidden - insufficient permissions |
-| 404 | Annotation not found |
-
-### [PUT] /apps/annotations/{annotation_id}
-**Update an existing annotation**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| annotation_id | path | Annotation ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [AnnotationCreatePayload](#annotationcreatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Annotation updated successfully | **application/json**: [Annotation](#annotation)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-| 404 | Annotation not found |  |
-
-### [POST] /audio-to-text
-**Convert audio to text using speech-to-text**
-
-Convert audio to text using speech-to-text
-Accepts an audio file upload and returns the transcribed text.
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Audio successfully transcribed | **application/json**: [AudioTranscriptResponse](#audiotranscriptresponse)<br> |
-| 400 | Bad request - no audio or invalid audio |  |
-| 401 | Unauthorized - invalid API token |  |
-| 413 | Audio file too large |  |
-| 415 | Unsupported audio type |  |
-| 500 | Internal server error |  |
-
-### [POST] /chat-messages
-**Send a message in a chat conversation**
-
-Send a message in a chat conversation
-This endpoint handles chat messages for chat, agent chat, and advanced chat applications.
-Supports conversation management and both blocking and streaming response modes.
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [ChatRequestPayload](#chatrequestpayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Message sent successfully | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br> |
-| 400 | Bad request - invalid parameters or workflow issues |  |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Conversation or workflow not found |  |
-| 429 | Rate limit exceeded |  |
-| 500 | Internal server error |  |
-
-### [POST] /chat-messages/{task_id}/stop
-**Stop a running chat message generation**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| task_id | path | The ID of the task to stop | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Task stopped successfully | **application/json**: [SimpleResultResponse](#simpleresultresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Task not found |  |
-
-### [POST] /completion-messages
-**Create a completion for the given prompt**
-
-Create a completion for the given prompt
-This endpoint generates a completion based on the provided inputs and query.
-Supports both blocking and streaming response modes.
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [CompletionRequestPayload](#completionrequestpayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Completion created successfully | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br> |
-| 400 | Bad request - invalid parameters |  |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Conversation not found |  |
-| 500 | Internal server error |  |
-
-### [POST] /completion-messages/{task_id}/stop
-**Stop a running completion task**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| task_id | path | The ID of the task to stop | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Task stopped successfully | **application/json**: [SimpleResultResponse](#simpleresultresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Task not found |  |
-
-### [GET] /conversations
-**List all conversations for the current user**
-
-List all conversations for the current user
-Supports pagination using last_id and limit parameters.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| last_id | query | Last conversation ID for pagination | No | string |
-| limit | query | Number of conversations to return | No | integer, <br>**Default:** 20 |
-| sort_by | query | Sort order for conversations | No | string, <br>**Available values:** "-created_at", "-updated_at", "created_at", "updated_at", <br>**Default:** -updated_at |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Conversations retrieved successfully | **application/json**: [ConversationInfiniteScrollPagination](#conversationinfinitescrollpagination)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Last conversation not found |  |
-
-### [DELETE] /conversations/{c_id}
-**Delete a specific conversation**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path | Conversation ID | Yes | string |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Conversation deleted successfully |
-| 401 | Unauthorized - invalid API token |
-| 404 | Conversation not found |
-
-### [POST] /conversations/{c_id}/name
-**Rename a conversation or auto-generate a name**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path | Conversation ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [ConversationRenamePayload](#conversationrenamepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Conversation renamed successfully | **application/json**: [SimpleConversation](#simpleconversation)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Conversation not found |  |
-
-### [GET] /conversations/{c_id}/variables
-**List all variables for a conversation**
-
-List all variables for a conversation
-Conversational variables are only available for chat applications.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path | Conversation ID | Yes | string |
-| last_id | query | Last variable ID for pagination | No | string |
-| limit | query | Number of variables to return | No | integer, <br>**Default:** 20 |
-| variable_name | query | Filter variables by name | No | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Variables retrieved successfully | **application/json**: [ConversationVariableInfiniteScrollPaginationResponse](#conversationvariableinfinitescrollpaginationresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Conversation not found |  |
-
-### [PUT] /conversations/{c_id}/variables/{variable_id}
-**Update a conversation variable's value**
-
-Update a conversation variable's value
-Allows updating the value of a specific conversation variable.
-The value must match the variable's expected type.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path | Conversation ID | Yes | string |
-| variable_id | path | Variable ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [ConversationVariableUpdatePayload](#conversationvariableupdatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Variable updated successfully | **application/json**: [ConversationVariableResponse](#conversationvariableresponse)<br> |
-| 400 | Bad request - type mismatch |  |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Conversation or variable not found |  |
-
-### [GET] /datasets
-**Resource for getting datasets**
-
-List all datasets
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| include_all | query | Include all datasets | No | boolean |
-| keyword | query | Search keyword | No | string |
-| limit | query | Number of items per page | No | integer, <br>**Default:** 20 |
-| page | query | Page number | No | integer, <br>**Default:** 1 |
-| tag_ids | query | Filter by tag IDs | No | [ string ] |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Datasets retrieved successfully | **application/json**: [DatasetListResponse](#datasetlistresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-
-### [POST] /datasets
-**Resource for creating datasets**
-
-Create a new dataset
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [DatasetCreatePayload](#datasetcreatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Dataset created successfully | **application/json**: [DatasetDetailResponse](#datasetdetailresponse)<br> |
-| 400 | Bad request - invalid parameters |  |
-| 401 | Unauthorized - invalid API token |  |
-
-### [POST] /datasets/pipeline/file-upload
-**Upload a file for use in conversations**
-
-Upload a file to a knowledgebase pipeline
-Accepts a single file upload via multipart/form-data.
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 201 | File uploaded successfully | **application/json**: [PipelineUploadFileResponse](#pipelineuploadfileresponse)<br> |
-| 400 | Bad request - no file or invalid file |  |
-| 401 | Unauthorized - invalid API token |  |
-| 413 | File too large |  |
-| 415 | Unsupported file type |  |
-
-### [DELETE] /datasets/tags
-**Delete a knowledge type tag**
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [TagDeletePayload](#tagdeletepayload)<br> |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Tag deleted successfully |
-| 401 | Unauthorized - invalid API token |
-| 403 | Forbidden - insufficient permissions |
-
-### [GET] /datasets/tags
-**Get all knowledge type tags**
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Tags retrieved successfully | **application/json**: [KnowledgeTagListResponse](#knowledgetaglistresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-
-### [PATCH] /datasets/tags
-Update a knowledge type tag
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [TagUpdatePayload](#tagupdatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Tag updated successfully | **application/json**: [KnowledgeTagResponse](#knowledgetagresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-
-### [POST] /datasets/tags
-**Add a knowledge type tag**
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [TagCreatePayload](#tagcreatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Tag created successfully | **application/json**: [KnowledgeTagResponse](#knowledgetagresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-
-### [POST] /datasets/tags/binding
-Bind tags to a dataset
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [TagBindingPayload](#tagbindingpayload)<br> |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Tags bound successfully |
-| 401 | Unauthorized - invalid API token |
-| 403 | Forbidden - insufficient permissions |
-
-### [POST] /datasets/tags/unbinding
-Unbind tags from a dataset
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [TagUnbindingPayload](#tagunbindingpayload)<br> |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Tags unbound successfully |
-| 401 | Unauthorized - invalid API token |
-| 403 | Forbidden - insufficient permissions |
-
-### [DELETE] /datasets/{dataset_id}
-**Deletes a dataset given its ID**
-
-Delete a dataset
-Args:
-    _: ignore
-    dataset_id (UUID): The ID of the dataset to be deleted.
-
-Returns:
-    dict: A dictionary with a key 'result' and a value 'success'
-          if the dataset was successfully deleted. Omitted in HTTP response.
-    int: HTTP status code 204 indicating that the operation was successful.
-
-Raises:
-    NotFound: If the dataset with the given ID does not exist.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Dataset deleted successfully |
-| 401 | Unauthorized - invalid API token |
-| 404 | Dataset not found |
-| 409 | Conflict - dataset is in use |
-
-### [GET] /datasets/{dataset_id}
-Get a specific dataset by ID
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Dataset retrieved successfully | **application/json**: [DatasetDetailWithPartialMembersResponse](#datasetdetailwithpartialmembersresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-| 404 | Dataset not found |  |
-
-### [PATCH] /datasets/{dataset_id}
-Update an existing dataset
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [DatasetUpdatePayload](#datasetupdatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Dataset updated successfully | **application/json**: [DatasetDetailWithPartialMembersResponse](#datasetdetailwithpartialmembersresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-| 404 | Dataset not found |  |
-
-### [POST] /datasets/{dataset_id}/document/create-by-file
-Create a new document by uploading a file
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Document created successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
-| 400 | Bad request - invalid file or parameters |  |
-| 401 | Unauthorized - invalid API token |  |
-
-### [POST] /datasets/{dataset_id}/document/create-by-text
-Create a new document by providing text content
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [DocumentTextCreatePayload](#documenttextcreatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Document created successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
-| 400 | Bad request - invalid parameters |  |
-| 401 | Unauthorized - invalid API token |  |
-
-### [POST] /datasets/{dataset_id}/document/create_by_file
-Create a new document by uploading a file
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Document created successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
-| 400 | Bad request - invalid file or parameters |  |
-| 401 | Unauthorized - invalid API token |  |
-
 ### ~~[POST] /datasets/{dataset_id}/document/create_by_text~~
 
 ***DEPRECATED***
@@ -672,7 +29,7 @@ Deprecated legacy alias for creating a new document by providing text content. U
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
 
 #### Request Body
 
@@ -687,174 +44,52 @@ Deprecated legacy alias for creating a new document by providing text content. U
 | 200 | Document created successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
 | 400 | Bad request - invalid parameters |  |
 | 401 | Unauthorized - invalid API token |  |
-
-### [GET] /datasets/{dataset_id}/documents
-List all documents in a dataset
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| keyword | query | Search keyword | No | string |
-| limit | query | Number of items per page | No | integer, <br>**Default:** 20 |
-| page | query | Page number | No | integer, <br>**Default:** 1 |
-| status | query | Document status filter | No | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Documents retrieved successfully | **application/json**: [DocumentListResponse](#documentlistresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset not found |  |
-
-### [POST] /datasets/{dataset_id}/documents/download-zip
-Download selected uploaded documents as a single ZIP archive
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [DocumentBatchDownloadZipPayload](#documentbatchdownloadzippayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | ZIP archive generated successfully | **application/json**: [BinaryFileResponse](#binaryfileresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-| 404 | Document or dataset not found |  |
-
-### [POST] /datasets/{dataset_id}/documents/metadata
-**Update metadata for multiple documents**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [MetadataOperationData](#metadataoperationdata)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Documents metadata updated successfully | **application/json**: [DatasetMetadataActionResponse](#datasetmetadataactionresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset not found |  |
-
-### [PATCH] /datasets/{dataset_id}/documents/status/{action}
-**Batch update document status**
-
-Batch update document status
-Args:
-    tenant_id: tenant id
-    dataset_id: dataset id
-    action: action to perform (Literal["enable", "disable", "archive", "un_archive"])
-
-Returns:
-    dict: A dictionary with a key 'result' and a value 'success'
-    int: HTTP status code 200 indicating that the operation was successful.
-
-Raises:
-    NotFound: If the dataset with the given ID does not exist.
-    Forbidden: If the user does not have permission.
-    InvalidActionError: If the action is invalid or cannot be performed.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| action | path | Action to perform: 'enable', 'disable', 'archive', or 'un_archive' | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [DocumentStatusPayload](#documentstatuspayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Document status updated successfully | **application/json**: [SimpleResultResponse](#simpleresultresponse)<br> |
-| 400 | Bad request - invalid action |  |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-| 404 | Dataset not found |  |
-
-### [GET] /datasets/{dataset_id}/documents/{batch}/indexing-status
-Get indexing status for documents in a batch
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| batch | path | Batch ID | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Indexing status retrieved successfully | **application/json**: [DocumentStatusListResponse](#documentstatuslistresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset or documents not found |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
 
 ### [DELETE] /datasets/{dataset_id}/documents/{document_id}
-**Delete document**
+**Delete Document**
 
-Delete a document
+Permanently delete a document and all its chunks from the knowledge base.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
 
 #### Responses
 
 | Code | Description |
 | ---- | ----------- |
-| 204 | Document deleted successfully |
+| 204 | Success. |
+| 400 | `document_indexing` : Cannot delete document during indexing. |
 | 401 | Unauthorized - invalid API token |
-| 403 | Forbidden - document is archived |
-| 404 | Document not found |
+| 403 | `archived_document_immutable` : The archived document is not editable. |
+| 404 | `not_found` : Document Not Exists. |
 
 ### [GET] /datasets/{dataset_id}/documents/{document_id}
-Get a specific document by ID
+**Get Document**
+
+Retrieve detailed information about a specific document, including its indexing status, metadata, and processing statistics.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| metadata | query | Metadata response mode | No | string, <br>**Available values:** "all", "only", "without", <br>**Default:** all |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| metadata | query | `all` returns all fields including metadata. `only` returns only `id`, `doc_type`, and `doc_metadata`. `without` returns all fields except `doc_metadata`. | No | string, <br>**Available values:** "all", "only", "without", <br>**Default:** all |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Document retrieved successfully | **application/json**: [DocumentDetailResponse](#documentdetailresponse)<br> |
+| 200 | Document details. The response shape varies based on the `metadata` query parameter. When `metadata` is `only`, only `id`, `doc_type`, and `doc_metadata` are returned. When `metadata` is `without`, `doc_type` and `doc_metadata` are omitted. | **application/json**: [DocumentDetailResponse](#documentdetailresponse)<br> |
+| 400 | `invalid_metadata` : Invalid metadata value for the specified key. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-| 404 | Document not found |  |
+| 403 | `forbidden` : No permission. |  |
+| 404 | `not_found` : Document not found. |  |
 
 ### [PATCH] /datasets/{dataset_id}/documents/{document_id}
 Update an existing document by uploading a file
@@ -863,308 +98,8 @@ Update an existing document by uploading a file
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  No | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Document updated successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Document not found |  |
-
-### [GET] /datasets/{dataset_id}/documents/{document_id}/download
-Get a signed download URL for a document's original uploaded file
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Download URL generated successfully | **application/json**: [UrlResponse](#urlresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - insufficient permissions |  |
-| 404 | Document or upload file not found |  |
-
-### [GET] /datasets/{dataset_id}/documents/{document_id}/segments
-List segments in a document
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| keyword | query |  | No | string |
-| limit | query |  | No | integer, <br>**Default:** 20 |
-| page | query |  | No | integer, <br>**Default:** 1 |
-| status | query |  | No | [ string ] |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Segments retrieved successfully | **application/json**: [SegmentListResponse](#segmentlistresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset or document not found |  |
-
-### [POST] /datasets/{dataset_id}/documents/{document_id}/segments
-Create segments in a document
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [SegmentCreatePayload](#segmentcreatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Segments created successfully | **application/json**: [SegmentCreateListResponse](#segmentcreatelistresponse)<br> |
-| 400 | Bad request - segments data is missing |  |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset or document not found |  |
-
-### [DELETE] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}
-Delete a specific segment
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Segment ID | Yes | string |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Segment deleted successfully |
-| 401 | Unauthorized - invalid API token |
-| 404 | Dataset, document, or segment not found |
-
-### [GET] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}
-Get a specific segment by ID
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Segment ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Segment retrieved successfully | **application/json**: [SegmentDetailResponse](#segmentdetailresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset, document, or segment not found |  |
-
-### [POST] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}
-Update a specific segment
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Segment ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [SegmentUpdatePayload](#segmentupdatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Segment updated successfully | **application/json**: [SegmentDetailResponse](#segmentdetailresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset, document, or segment not found |  |
-
-### [GET] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks
-List child chunks for a segment
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
-| keyword | query |  | No | string |
-| limit | query |  | No | integer, <br>**Default:** 20 |
-| page | query |  | No | integer, <br>**Default:** 1 |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Child chunks retrieved successfully | **application/json**: [ChildChunkListResponse](#childchunklistresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset, document, or segment not found |  |
-
-### [POST] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks
-Create a new child chunk for a segment
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [ChildChunkCreatePayload](#childchunkcreatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Child chunk created successfully | **application/json**: [ChildChunkDetailResponse](#childchunkdetailresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset, document, or segment not found |  |
-
-### [DELETE] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks/{child_chunk_id}
-Delete a specific child chunk
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| child_chunk_id | path | Child chunk ID | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Child chunk deleted successfully |
-| 401 | Unauthorized - invalid API token |
-| 404 | Dataset, document, segment, or child chunk not found |
-
-### [PATCH] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks/{child_chunk_id}
-Update a specific child chunk
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| child_chunk_id | path | Child chunk ID | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-| segment_id | path | Parent segment ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [ChildChunkUpdatePayload](#childchunkupdatepayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Child chunk updated successfully | **application/json**: [ChildChunkDetailResponse](#childchunkdetailresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset, document, segment, or child chunk not found |  |
-
-### ~~[POST] /datasets/{dataset_id}/documents/{document_id}/update-by-file~~
-
-***DEPRECATED***
-
-Deprecated legacy alias for updating an existing document by uploading a file. Use PATCH /datasets/{dataset_id}/documents/{document_id} instead.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  No | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Document updated successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Document not found |  |
-
-### [POST] /datasets/{dataset_id}/documents/{document_id}/update-by-text
-Update an existing document by providing text content
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [DocumentTextUpdate](#documenttextupdate)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Document updated successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Document not found |  |
-
-### ~~[POST] /datasets/{dataset_id}/documents/{document_id}/update_by_file~~
-
-***DEPRECATED***
-
-Deprecated legacy alias for updating an existing document by uploading a file. Use PATCH /datasets/{dataset_id}/documents/{document_id} instead.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1178,6 +113,7 @@ Deprecated legacy alias for updating an existing document by uploading a file. U
 | ---- | ----------- | ------ |
 | 200 | Document updated successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
 | 404 | Document not found |  |
 
 ### ~~[POST] /datasets/{dataset_id}/documents/{document_id}/update_by_text~~
@@ -1190,8 +126,8 @@ Deprecated legacy alias for updating an existing document by providing text cont
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| document_id | path | Document ID | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1205,19 +141,799 @@ Deprecated legacy alias for updating an existing document by providing text cont
 | ---- | ----------- | ------ |
 | 200 | Document updated successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
 | 404 | Document not found |  |
 
-### [POST] /datasets/{dataset_id}/hit-testing
-**Perform hit testing on a dataset**
+---
+## default
 
-Perform hit testing on a dataset
-Tests retrieval performance for the specified dataset.
+### [GET] /app/feedbacks
+**List App Feedbacks**
+
+Retrieve a paginated list of all feedback submitted for messages in this application, including both end-user and admin feedback.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| limit | query | Number of records per page. | No | integer, <br>**Default:** 20 |
+| page | query | Page number for pagination. | No | integer, <br>**Default:** 1 |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | A list of application feedbacks. | **application/json**: [AppFeedbackListResponse](#appfeedbacklistresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+
+### [POST] /messages/{message_id}/feedbacks
+**Submit Message Feedback**
+
+Submit feedback for a message. End users can rate messages as `like` or `dislike`, and optionally provide text feedback. Pass `null` for `rating` to revoke previously submitted feedback.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| message_id | path | Message ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [MessageFeedbackPayloadWithUser](#messagefeedbackpayloadwithuser)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Feedback submitted successfully | **application/json**: [ResultResponse](#resultresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Message does not exist. |  |
+
+---
+## default
+
+### [POST] /apps/annotation-reply/{action}
+**Configure Annotation Reply**
+
+Enables or disables the annotation reply feature. Requires embedding model configuration when enabling. Executes asynchronously — use [Get Annotation Reply Job Status](/api-reference/annotations/get-annotation-reply-job-status) to track progress.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| action | path | Action to perform: `enable` or `disable`. | Yes | string, <br>**Available values:** "disable", "enable" |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [AnnotationReplyActionPayload](#annotationreplyactionpayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Annotation reply settings task initiated. | **application/json**: [AnnotationJobStatusResponse](#annotationjobstatusresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+
+### [GET] /apps/annotation-reply/{action}/status/{job_id}
+**Get Annotation Reply Job Status**
+
+Retrieves the status of an asynchronous annotation reply configuration job started by [Configure Annotation Reply](/api-reference/annotations/configure-annotation-reply).
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| action | path | Action to perform: `enable` or `disable`. | Yes | string, <br>**Available values:** "disable", "enable" |
+| job_id | path | Job ID returned by [Configure Annotation Reply](/api-reference/annotations/configure-annotation-reply). | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successfully retrieved task status. | **application/json**: [AnnotationJobStatusResponse](#annotationjobstatusresponse)<br> |
+| 400 | `invalid_param` : The specified job does not exist. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | Job not found |  |
+
+### [GET] /apps/annotations
+**List Annotations**
+
+Retrieves a paginated list of annotations for the application. Supports keyword search filtering.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| keyword | query | Keyword to filter annotations by question or answer content. | No | string |
+| limit | query | Number of items per page. | No | integer, <br>**Default:** 20 |
+| page | query | Page number for pagination. | No | integer, <br>**Default:** 1 |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successfully retrieved annotation list. | **application/json**: [AnnotationList](#annotationlist)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+
+### [POST] /apps/annotations
+**Create Annotation**
+
+Creates a new annotation. Annotations provide predefined question-answer pairs that the app can match and return directly instead of generating a response.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [AnnotationCreatePayload](#annotationcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Annotation created successfully. | **application/json**: [Annotation](#annotation)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+
+### [DELETE] /apps/annotations/{annotation_id}
+**Delete Annotation**
+
+Deletes an annotation and its associated hit history.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| annotation_id | path | The unique identifier of the annotation to delete. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Annotation deleted successfully. |
+| 401 | Unauthorized - invalid API token |
+| 403 | `forbidden` : Insufficient permissions to edit annotations. |
+| 404 | `not_found` : Annotation does not exist. |
+
+### [PUT] /apps/annotations/{annotation_id}
+**Update Annotation**
+
+Updates the question and answer of an existing annotation.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| annotation_id | path | The unique identifier of the annotation to update. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [AnnotationCreatePayload](#annotationcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Annotation updated successfully. | **application/json**: [Annotation](#annotation)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | `forbidden` : Insufficient permissions to edit annotations. |  |
+| 404 | `not_found` : Annotation does not exist. |  |
+
+---
+## default
+
+### [POST] /audio-to-text
+**Convert Audio to Text**
+
+Convert audio file to text. Supported MIME types: `audio/mp3`, `audio/mpga`, `audio/m4a`, `audio/wav`, and `audio/amr`. File size limit is `30 MB`.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **multipart/form-data**: { **"file"**: binary, **"user"**: string }<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successfully converted audio to text. | **application/json**: [AudioTranscriptResponse](#audiotranscriptresponse)<br> |
+| 400 | - `app_unavailable` : App unavailable or misconfigured. - `provider_not_support_speech_to_text` : Model provider does not support speech-to-text. - `provider_not_initialize` : No valid model provider credentials found. - `provider_quota_exceeded` : Model provider quota exhausted. - `model_currently_not_support` : Current model does not support this operation. - `completion_request_error` : Speech recognition request failed. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 413 | `audio_too_large` : Audio file size exceeded the limit. |  |
+| 415 | `unsupported_audio_type` : Audio type is not allowed. |  |
+| 500 | `internal_server_error` : Internal server error. |  |
+
+### [POST] /text-to-audio
+**Convert Text to Audio**
+
+Convert text to speech.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [TextToAudioPayloadWithUser](#texttoaudiopayloadwithuser)<br> |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 200 | Returns the generated audio. Generator responses are streamed by the service as `audio/mpeg`; otherwise the provider output is returned directly. |
+| 400 | - `app_unavailable` : App unavailable or misconfigured. - `provider_not_initialize` : No valid model provider credentials found. - `provider_quota_exceeded` : Model provider quota exhausted. - `model_currently_not_support` : Current model does not support this operation. - `completion_request_error` : Text-to-speech request failed. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |
+| 500 | `internal_server_error` : Internal server error. |
+
+---
+## default
+
+### [POST] /chat-messages
+**Send Chat Message**
+
+Send a request to the chat application.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [ChatRequestPayloadWithUser](#chatrequestpayloadwithuser)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successful response. The content type and structure depend on the `response_mode` parameter in the request.  - If `response_mode` is `blocking`, returns `application/json` with a `ChatCompletionResponse` object. - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of Server-Sent Events. | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br>**text/event-stream**: [GeneratedAppResponse](#generatedappresponse)<br> |
+| 400 | - `app_unavailable` : App unavailable or misconfigured. - `not_chat_app` : App mode does not match the API route. - `conversation_completed` : The conversation has ended. - `provider_not_initialize` : No valid model provider credentials found. - `provider_quota_exceeded` : Model provider quota exhausted. - `model_currently_not_support` : Current model unavailable. - `completion_request_error` : Text generation failed. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Conversation does not exist. |  |
+| 429 | - `too_many_requests` : Too many concurrent requests for this app. - `rate_limit_error` : The upstream model provider rate limit was exceeded. |  |
+| 500 | `internal_server_error` : Internal server error. |  |
+
+### [POST] /chat-messages/{task_id}/stop
+**Stop Chat Message Generation**
+
+Stops a chat message generation task. Only supported in `streaming` mode.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| task_id | path | Task ID, obtained from a streaming chunk returned by the Send Chat Message API. | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [RequiredServiceApiUserPayload](#requiredserviceapiuserpayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Task stopped successfully | **application/json**: [SimpleResultResponse](#simpleresultresponse)<br> |
+| 400 | `not_chat_app` : App mode does not match the API route. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | Task not found |  |
+
+### [GET] /messages/{message_id}/suggested
+**Get Next Suggested Questions**
+
+Get next questions suggestions for the current message.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| message_id | path | Message ID | Yes | string (uuid) |
+| user | query | User identifier, used for end-user context. | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Suggested questions retrieved successfully | **application/json**: [SimpleResultStringListResponse](#simpleresultstringlistresponse)<br> |
+| 400 | - `not_chat_app` : App mode does not match the API route. - `bad_request` : Suggested questions feature is disabled. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Message does not exist. |  |
+| 500 | `internal_server_error` : Internal server error. |  |
+
+### [GET] /workflow/{task_id}/events
+**Stream Workflow Events**
+
+Resume the Server-Sent Events stream for a workflow run after a pause or a dropped SSE connection. For runs that have already finished, the stream emits a single `workflow_finished` event and closes.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| task_id | path | Workflow run ID returned by the original workflow run request. | Yes | string |
+| continue_on_pause | query | Set to `true` to keep the stream open across multiple `workflow_paused` events, which is useful when the workflow has more than one Human Input node in sequence. By default, the stream closes after the first pause. | No | boolean |
+| include_state_snapshot | query | When `true`, replay from the persisted state snapshot to include a status summary of already-executed nodes before streaming new events. | No | boolean |
+| user | query | End-user identifier that originally triggered the run. Must match the creator of the run. | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Server-Sent Events stream. Each event is delivered as `data: {JSON}\\n\\n`. Event payloads follow the same schemas as the original streaming response. | **text/event-stream**: [EventStreamResponse](#eventstreamresponse)<br> |
+| 400 | `not_workflow_app` : Please check if your app mode matches the right API route. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Workflow run not found. |  |
+
+### [GET] /workflows/logs
+**List Workflow Logs**
+
+Retrieve paginated workflow execution logs with filtering options.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| created_at__after | query | Filter logs created after this ISO 8601 timestamp. | No | dateTime |
+| created_at__before | query | Filter logs created before this ISO 8601 timestamp. | No | dateTime |
+| created_by_account | query | Filter by account ID. | No | string |
+| created_by_end_user_session_id | query | Filter by end user session ID. | No | string |
+| keyword | query | Keyword to search in logs. | No | string |
+| limit | query | Number of items per page. | No | integer, <br>**Default:** 20 |
+| page | query | Page number for pagination. | No | integer, <br>**Default:** 1 |
+| status | query | Filter by execution status. | No | string, <br>**Available values:** "failed", "stopped", "succeeded" |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successfully retrieved workflow logs. | **application/json**: [WorkflowAppLogPaginationResponse](#workflowapplogpaginationresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+
+### [GET] /workflows/run/{workflow_run_id}
+**Get Workflow Run Detail**
+
+Retrieve the current execution results of a workflow task based on the workflow execution ID.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| workflow_run_id | path | Workflow run ID, obtained from the workflow execution response or streaming events. | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successfully retrieved workflow run details. | **application/json**: [WorkflowRunResponse](#workflowrunresponse)<br> |
+| 400 | `not_workflow_app` : App mode does not match the API route. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Workflow run not found. |  |
+
+---
+## default
+
+### [POST] /chat-messages
+**Send Chat Message**
+
+Send a request to the chat application.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [ChatRequestPayloadWithUser](#chatrequestpayloadwithuser)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successful response. The content type and structure depend on the `response_mode` parameter in the request.  - If `response_mode` is `blocking`, returns `application/json` with a `ChatCompletionResponse` object. - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of Server-Sent Events. | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br>**text/event-stream**: [GeneratedAppResponse](#generatedappresponse)<br> |
+| 400 | - `app_unavailable` : App unavailable or misconfigured. - `not_chat_app` : App mode does not match the API route. - `conversation_completed` : The conversation has ended. - `provider_not_initialize` : No valid model provider credentials found. - `provider_quota_exceeded` : Model provider quota exhausted. - `model_currently_not_support` : Current model unavailable. - `completion_request_error` : Text generation failed. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Conversation does not exist. |  |
+| 429 | - `too_many_requests` : Too many concurrent requests for this app. - `rate_limit_error` : The upstream model provider rate limit was exceeded. |  |
+| 500 | `internal_server_error` : Internal server error. |  |
+
+### [POST] /chat-messages/{task_id}/stop
+**Stop Chat Message Generation**
+
+Stops a chat message generation task. Only supported in `streaming` mode.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| task_id | path | Task ID, obtained from a streaming chunk returned by the Send Chat Message API. | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [RequiredServiceApiUserPayload](#requiredserviceapiuserpayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Task stopped successfully | **application/json**: [SimpleResultResponse](#simpleresultresponse)<br> |
+| 400 | `not_chat_app` : App mode does not match the API route. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | Task not found |  |
+
+### [GET] /messages/{message_id}/suggested
+**Get Next Suggested Questions**
+
+Get next questions suggestions for the current message.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| message_id | path | Message ID | Yes | string (uuid) |
+| user | query | User identifier, used for end-user context. | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Suggested questions retrieved successfully | **application/json**: [SimpleResultStringListResponse](#simpleresultstringlistresponse)<br> |
+| 400 | - `not_chat_app` : App mode does not match the API route. - `bad_request` : Suggested questions feature is disabled. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Message does not exist. |  |
+| 500 | `internal_server_error` : Internal server error. |  |
+
+---
+## default
+
+### [POST] /completion-messages
+**Send Completion Message**
+
+Send a request to the text generation application.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [CompletionRequestPayloadWithUser](#completionrequestpayloadwithuser)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successful response. The content type and structure depend on the `response_mode` parameter in the request.  - If `response_mode` is `blocking`, returns `application/json` with a `CompletionResponse` object. - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of `ChunkCompletionEvent` objects. | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br>**text/event-stream**: [GeneratedAppResponse](#generatedappresponse)<br> |
+| 400 | - `app_unavailable` : App unavailable or misconfigured. - `provider_not_initialize` : No valid model provider credentials found. - `provider_quota_exceeded` : Model provider quota exhausted. - `model_currently_not_support` : Current model unavailable. - `completion_request_error` : Text generation failed. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | Conversation not found |  |
+| 429 | `too_many_requests` : Too many concurrent requests for this app. |  |
+| 500 | `internal_server_error` : Internal server error. |  |
+
+### [POST] /completion-messages/{task_id}/stop
+**Stop Completion Message Generation**
+
+Stops a completion message generation task. Only supported in `streaming` mode.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| task_id | path | Task ID, obtained from a streaming chunk returned by the Send Completion Message API. | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [RequiredServiceApiUserPayload](#requiredserviceapiuserpayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Task stopped successfully | **application/json**: [SimpleResultResponse](#simpleresultresponse)<br> |
+| 400 | `app_unavailable` : App unavailable or misconfigured. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | Task not found |  |
+
+---
+## default
+
+### [GET] /conversations
+**List Conversations**
+
+Retrieve the conversation list for the current user, ordered by most recently active.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| last_id | query | The ID of the last record on the current page. Used to fetch the next page. | No | string |
+| limit | query | Number of records to return. | No | integer, <br>**Default:** 20 |
+| sort_by | query | Sorting field. Use the `-` prefix for descending order. | No | string, <br>**Available values:** "-created_at", "-updated_at", "created_at", "updated_at", <br>**Default:** -updated_at |
+| user | query | User identifier, used for end-user context. | No | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successfully retrieved conversations list. | **application/json**: [ConversationInfiniteScrollPagination](#conversationinfinitescrollpagination)<br> |
+| 400 | `not_chat_app` : App mode does not match the API route. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Last conversation does not exist (invalid `last_id`). |  |
+
+### [DELETE] /conversations/{c_id}
+**Delete Conversation**
+
+Delete a conversation.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| c_id | path | Conversation ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [OptionalServiceApiUserPayload](#optionalserviceapiuserpayload)<br> |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Conversation deleted successfully. |
+| 400 | `not_chat_app` : App mode does not match the API route. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |
+| 404 | `not_found` : Conversation does not exist. |
+
+### [POST] /conversations/{c_id}/name
+**Rename Conversation**
+
+Rename a conversation or auto-generate a name. The conversation name is used for display on clients that support multiple conversations.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| c_id | path | Conversation ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [ConversationRenamePayloadWithUser](#conversationrenamepayloadwithuser)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Conversation renamed successfully. | **application/json**: [SimpleConversation](#simpleconversation)<br> |
+| 400 | `not_chat_app` : App mode does not match the API route. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Conversation does not exist. |  |
+
+### [GET] /conversations/{c_id}/variables
+**List Conversation Variables**
+
+Retrieve variables from a specific conversation.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| c_id | path | Conversation ID. | Yes | string (uuid) |
+| last_id | query | The ID of the last record on the current page. Used to fetch the next page. | No | string |
+| limit | query | Number of records to return. | No | integer, <br>**Default:** 20 |
+| user | query | User identifier, used for end-user context. | No | string |
+| variable_name | query | Filter variables by a specific name. | No | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successfully retrieved conversation variables. | **application/json**: [ConversationVariableInfiniteScrollPaginationResponse](#conversationvariableinfinitescrollpaginationresponse)<br> |
+| 400 | `not_chat_app` : App mode does not match the API route. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Conversation does not exist. |  |
+
+### [PUT] /conversations/{c_id}/variables/{variable_id}
+**Update Conversation Variable**
+
+Update the value of a specific conversation variable. The value must match the expected type.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| c_id | path | Conversation ID. | Yes | string (uuid) |
+| variable_id | path | Variable ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [ConversationVariableUpdatePayloadWithUser](#conversationvariableupdatepayloadwithuser)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Variable updated successfully. | **application/json**: [ConversationVariableResponse](#conversationvariableresponse)<br> |
+| 400 | - `not_chat_app` : App mode does not match the API route. - `bad_request` : Variable value type mismatch. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | - `not_found` : Conversation does not exist. - `not_found` : Conversation variable does not exist. |  |
+
+### [GET] /messages
+**List Conversation Messages**
+
+Returns historical chat records in a scrolling load format, with the first page returning the latest `limit` messages, i.e., in reverse order.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| conversation_id | query | Conversation ID. | Yes | string |
+| first_id | query | The ID of the first chat record on the current page. Omit this value to fetch the latest messages; for subsequent pages, use the first message ID from the current list to fetch older messages. | No | string |
+| limit | query | Number of chat history messages to return per request. | No | integer, <br>**Default:** 20 |
+| user | query | User identifier, used for end-user context. | No | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Successfully retrieved conversation history. | **application/json**: [MessageInfiniteScrollPagination](#messageinfinitescrollpagination)<br> |
+| 400 | `not_chat_app` : App mode does not match the API route. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | - `not_found` : Conversation does not exist. - `not_found` : First message does not exist. |  |
+
+---
+## default
+
+### [GET] /datasets
+**List Knowledge Bases**
+
+Returns a paginated list of knowledge bases. Supports filtering by keyword and tags.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| include_all | query | Whether to include all knowledge bases regardless of permissions. | No | boolean |
+| keyword | query | Search keyword to filter by name. | No | string |
+| limit | query | Number of items per page. Server caps at `100`. | No | integer, <br>**Default:** 20 |
+| page | query | Page number to retrieve. | No | integer, <br>**Default:** 1 |
+| tag_ids | query | Tag IDs to filter by. | No | [ string ] |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | List of knowledge bases. | **application/json**: [DatasetListResponse](#datasetlistresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+
+### [POST] /datasets
+**Create an Empty Knowledge Base**
+
+Create a new empty knowledge base. After creation, use [Create Document by Text](/api-reference/documents/create-document-by-text) or [Create Document by File](/api-reference/documents/create-document-by-file) to add documents.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [DatasetCreatePayload](#datasetcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Knowledge base created successfully. | **application/json**: [DatasetDetailResponse](#datasetdetailresponse)<br> |
+| 400 | Bad request - invalid parameters |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 409 | `dataset_name_duplicate` : The dataset name already exists. Please modify your dataset name. |  |
+
+### [DELETE] /datasets/{dataset_id}
+**Delete Knowledge Base**
+
+Permanently delete a knowledge base and all its documents. The knowledge base must not be in use by any application.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Success. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - dataset API access or workspace access denied |
+| 404 | `not_found` : Dataset not found. |
+| 409 | `dataset_in_use` : The knowledge base is being used by some apps. Please remove it from the apps before deleting. |
+
+### [GET] /datasets/{dataset_id}
+**Get Knowledge Base**
+
+Retrieve detailed information about a specific knowledge base, including its embedding model, retrieval configuration, and document statistics.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Knowledge base details. | **application/json**: [DatasetDetailWithPartialMembersResponse](#datasetdetailwithpartialmembersresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | `forbidden` : Insufficient permissions to access this knowledge base. |  |
+| 404 | `not_found` : Dataset not found. |  |
+
+### [PATCH] /datasets/{dataset_id}
+**Update Knowledge Base**
+
+Update the name, description, permissions, or retrieval settings of an existing knowledge base. Only the fields provided in the request body are updated.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [DatasetUpdatePayload](#datasetupdatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Knowledge base updated successfully. | **application/json**: [DatasetDetailWithPartialMembersResponse](#datasetdetailwithpartialmembersresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | `forbidden` : Insufficient permissions to access this knowledge base. |  |
+| 404 | `not_found` : Dataset not found. |  |
+
+### [POST] /datasets/{dataset_id}/hit-testing
+**Retrieve Chunks from a Knowledge Base / Test Retrieval**
+
+Performs a search query against a knowledge base to retrieve the most relevant chunks. This endpoint can be used for both production retrieval and test retrieval.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1229,156 +945,98 @@ Tests retrieval performance for the specified dataset.
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Hit testing results | **application/json**: [HitTestingResponse](#hittestingresponse)<br> |
+| 200 | Retrieval results. | **application/json**: [HitTestingResponse](#hittestingresponse)<br> |
+| 400 | - `dataset_not_initialized` : The dataset is still being initialized or indexing. Please wait a moment. - `provider_not_initialize` : No valid model provider credentials found. Please go to Settings -> Model Provider to complete your provider credentials. - `provider_quota_exceeded` : Your quota for Dify Hosted OpenAI has been exhausted. Please go to Settings -> Model Provider to complete your own provider credentials. - `model_currently_not_support` : Dify Hosted OpenAI trial currently not support the GPT-4 model. - `completion_request_error` : Completion request failed. - `invalid_param` : Invalid parameter value. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset not found |  |
+| 403 | `forbidden` : Insufficient permissions. |  |
+| 404 | `not_found` : Knowledge base not found. |  |
+| 500 | `internal_server_error` : An internal error occurred during retrieval. |  |
 
-### [GET] /datasets/{dataset_id}/metadata
-**Get all metadata for a dataset**
+### [POST] /datasets/{dataset_id}/retrieve
+**Retrieve Chunks from a Knowledge Base / Test Retrieval**
+
+Performs a search query against a knowledge base to retrieve the most relevant chunks. This endpoint can be used for both production retrieval and test retrieval.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Metadata retrieved successfully | **application/json**: [DatasetMetadataListResponse](#datasetmetadatalistresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset not found |  |
-
-### [POST] /datasets/{dataset_id}/metadata
-**Create metadata for a dataset**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
 
 #### Request Body
 
 | Required | Schema |
 | -------- | ------ |
-|  Yes | **application/json**: [MetadataArgs](#metadataargs)<br> |
+|  Yes | **application/json**: [HitTestingPayload](#hittestingpayload)<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 201 | Metadata created successfully | **application/json**: [DatasetMetadataResponse](#datasetmetadataresponse)<br> |
+| 200 | Retrieval results. | **application/json**: [HitTestingResponse](#hittestingresponse)<br> |
+| 400 | - `dataset_not_initialized` : The dataset is still being initialized or indexing. Please wait a moment. - `provider_not_initialize` : No valid model provider credentials found. Please go to Settings -> Model Provider to complete your provider credentials. - `provider_quota_exceeded` : Your quota for Dify Hosted OpenAI has been exhausted. Please go to Settings -> Model Provider to complete your own provider credentials. - `model_currently_not_support` : Dify Hosted OpenAI trial currently not support the GPT-4 model. - `completion_request_error` : Completion request failed. - `invalid_param` : Invalid parameter value. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset not found |  |
+| 403 | `forbidden` : Insufficient permissions. |  |
+| 404 | `not_found` : Knowledge base not found. |  |
+| 500 | `internal_server_error` : An internal error occurred during retrieval. |  |
 
-### [GET] /datasets/{dataset_id}/metadata/built-in
-**Get all built-in metadata fields**
+---
+## default
 
-#### Parameters
+### [POST] /datasets/pipeline/file-upload
+**Upload Pipeline File**
 
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Built-in fields retrieved successfully | **application/json**: [DatasetMetadataBuiltInFieldsResponse](#datasetmetadatabuiltinfieldsresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-
-### [POST] /datasets/{dataset_id}/metadata/built-in/{action}
-**Enable or disable built-in metadata field**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| action | path | Action to perform: 'enable' or 'disable' | Yes | string |
-| dataset_id | path | Dataset ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Action completed successfully | **application/json**: [DatasetMetadataActionResponse](#datasetmetadataactionresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset not found |  |
-
-### [DELETE] /datasets/{dataset_id}/metadata/{metadata_id}
-**Delete metadata**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| metadata_id | path | Metadata ID | Yes | string |
-
-#### Responses
-
-| Code | Description |
-| ---- | ----------- |
-| 204 | Metadata deleted successfully |
-| 401 | Unauthorized - invalid API token |
-| 404 | Dataset or metadata not found |
-
-### [PATCH] /datasets/{dataset_id}/metadata/{metadata_id}
-**Update metadata name**
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
-| metadata_id | path | Metadata ID | Yes | string |
+Upload a file for use in a knowledge pipeline. Accepts a single file via `multipart/form-data`.
 
 #### Request Body
 
 | Required | Schema |
 | -------- | ------ |
-|  Yes | **application/json**: [MetadataUpdatePayload](#metadataupdatepayload)<br> |
+|  Yes | **multipart/form-data**: { **"file"**: binary }<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Metadata updated successfully | **application/json**: [DatasetMetadataResponse](#datasetmetadataresponse)<br> |
+| 201 | File uploaded successfully. | **application/json**: [PipelineUploadFileResponse](#pipelineuploadfileresponse)<br> |
+| 400 | - `no_file_uploaded` : Please upload your file. - `filename_not_exists_error` : The specified filename does not exist. - `too_many_files` : Only one file is allowed. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset or metadata not found |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 413 | `file_too_large` : File size exceeded. |  |
+| 415 | `unsupported_file_type` : File type not allowed. |  |
 
 ### [GET] /datasets/{dataset_id}/pipeline/datasource-plugins
-**Resource for getting datasource plugins**
+**List Datasource Plugins**
 
-List all datasource plugins for a rag pipeline
+List the datasource nodes configured in the knowledge pipeline. Each node includes the plugin it uses plus the metadata needed to run it.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| is_published | query |  | No | boolean, <br>**Default:** true |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| is_published | query | Whether to retrieve nodes from the published or draft pipeline. `true` returns nodes from the published version, `false` returns nodes from the draft. | No | boolean, <br>**Default:** true |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Datasource plugins retrieved successfully | **application/json**: [DatasourcePluginListResponse](#datasourcepluginlistresponse)<br> |
+| 200 | List of datasource nodes configured in the pipeline. | **application/json**: [DatasourcePluginListResponse](#datasourcepluginlistresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | `not_found` : Dataset not found. |  |
 
 ### [POST] /datasets/{dataset_id}/pipeline/datasource/nodes/{node_id}/run
-**Resource for getting datasource plugins**
+**Run Datasource Node**
 
-Run a datasource node for a rag pipeline
+Execute a single datasource node within the knowledge pipeline. Returns a streaming response with the node execution results.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
-| node_id | path |  | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| node_id | path | ID of the datasource node to execute. | Yes | string |
 
 #### Request Body
 
@@ -1390,19 +1048,21 @@ Run a datasource node for a rag pipeline
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Datasource node run successfully | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br> |
+| 200 | Streaming response with node execution events. | **text/event-stream**: [GeneratedAppResponse](#generatedappresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | `not_found` : Dataset not found. |  |
 
 ### [POST] /datasets/{dataset_id}/pipeline/run
-**Resource for running a rag pipeline**
+**Run Pipeline**
 
-Run a datasource node for a rag pipeline
+Execute the full knowledge pipeline for a knowledge base. Supports both streaming and blocking response modes.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path |  | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
 
 #### Request Body
 
@@ -1414,115 +1074,982 @@ Run a datasource node for a rag pipeline
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Pipeline run successfully | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br> |
+| 200 | Pipeline execution result. Format depends on `response_mode`: streaming returns a `text/event-stream`, blocking returns a JSON object. | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br>**text/event-stream**: [GeneratedAppResponse](#generatedappresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | `forbidden` : Forbidden. |  |
+| 404 | `not_found` : Dataset not found. |  |
+| 500 | `pipeline_run_error` : Pipeline execution failed. |  |
 
-### [POST] /datasets/{dataset_id}/retrieve
-**Perform hit testing on a dataset**
+---
+## default
 
-Perform hit testing on a dataset
-Tests retrieval performance for the specified dataset.
+### [DELETE] /datasets/tags
+**Delete Knowledge Tag**
 
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+Permanently delete a knowledge base tag. Does not delete the knowledge bases that were tagged.
 
 #### Request Body
 
 | Required | Schema |
 | -------- | ------ |
-|  Yes | **application/json**: [HitTestingPayload](#hittestingpayload)<br> |
+|  Yes | **application/json**: [TagDeletePayload](#tagdeletepayload)<br> |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Success. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - insufficient permissions |
+
+### [GET] /datasets/tags
+**List Knowledge Tags**
+
+Returns the list of all knowledge base tags in the workspace.
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Hit testing results | **application/json**: [HitTestingResponse](#hittestingresponse)<br> |
+| 200 | List of tags. | **application/json**: [KnowledgeTagListResponse](#knowledgetaglistresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Dataset not found |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+
+### [PATCH] /datasets/tags
+**Update Knowledge Tag**
+
+Rename an existing knowledge base tag.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [TagUpdatePayload](#tagupdatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Tag updated successfully. | **application/json**: [KnowledgeTagResponse](#knowledgetagresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - insufficient permissions |  |
+
+### [POST] /datasets/tags
+**Create Knowledge Tag**
+
+Create a new tag for organizing knowledge bases.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [TagCreatePayload](#tagcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Tag created successfully. | **application/json**: [KnowledgeTagResponse](#knowledgetagresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - insufficient permissions |  |
+
+### [POST] /datasets/tags/binding
+**Create Tag Binding**
+
+Bind one or more tags to a knowledge base. A knowledge base can have multiple tags.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [TagBindingPayload](#tagbindingpayload)<br> |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Success. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - insufficient permissions |
+
+### [POST] /datasets/tags/unbinding
+**Delete Tag Binding**
+
+Remove one or more tags from a knowledge base.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [TagUnbindingPayload](#tagunbindingpayload)<br> |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Success. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - insufficient permissions |
 
 ### [GET] /datasets/{dataset_id}/tags
-**Get all knowledge type tags**
+**Get Knowledge Base Tags**
 
-Get tags bound to a specific dataset
+Returns the list of tags bound to a specific knowledge base.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| dataset_id | path | Dataset ID | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Tags retrieved successfully | **application/json**: [DatasetBoundTagListResponse](#datasetboundtaglistresponse)<br> |
+| 200 | Tags bound to the knowledge base. | **application/json**: [DatasetBoundTagListResponse](#datasetboundtaglistresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+
+---
+## default
+
+### [POST] /datasets/{dataset_id}/document/create-by-file
+**Create Document by File**
+
+Create a document by uploading a file. Supports common document formats (PDF, TXT, DOCX, etc.). Processing is asynchronous — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document created successfully. | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
+| 400 | - `no_file_uploaded` : Please upload your file. - `too_many_files` : Only one file is allowed. - `filename_not_exists_error` : The specified filename does not exist. - `provider_not_initialize` : No valid model provider credentials found. Please go to Settings -> Model Provider to complete your provider credentials. - `invalid_param` : Knowledge base does not exist, external datasets not supported, file too large, unsupported file type, missing required fields, or invalid doc_form (must be `text_model`, `hierarchical_model`, or `qa_model`). |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+
+### [POST] /datasets/{dataset_id}/document/create-by-text
+**Create Document by Text**
+
+Create a document from raw text content. The document is processed asynchronously — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [DocumentTextCreatePayload](#documenttextcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document created successfully. | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
+| 400 | - `provider_not_initialize` : No valid model provider credentials found. Please go to Settings -> Model Provider to complete your provider credentials. - `invalid_param` : Knowledge base does not exist. / indexing_technique is required. / Invalid doc_form (must be `text_model`, `hierarchical_model`, or `qa_model`). |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+
+### ~~[POST] /datasets/{dataset_id}/document/create_by_file~~
+
+***DEPRECATED***
+
+**Create Document by File**
+
+Create a document by uploading a file. Supports common document formats (PDF, TXT, DOCX, etc.). Processing is asynchronous — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document created successfully. | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
+| 400 | - `no_file_uploaded` : Please upload your file. - `too_many_files` : Only one file is allowed. - `filename_not_exists_error` : The specified filename does not exist. - `provider_not_initialize` : No valid model provider credentials found. Please go to Settings -> Model Provider to complete your provider credentials. - `invalid_param` : Knowledge base does not exist, external datasets not supported, file too large, unsupported file type, missing required fields, or invalid doc_form (must be `text_model`, `hierarchical_model`, or `qa_model`). |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+
+### [GET] /datasets/{dataset_id}/documents
+**List Documents**
+
+Returns a paginated list of documents in the knowledge base. Supports filtering by keyword and indexing status.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| keyword | query | Search keyword to filter by document name. | No | string |
+| limit | query | Number of items per page. Server caps at `100`. | No | integer, <br>**Default:** 20 |
+| page | query | Page number to retrieve. | No | integer, <br>**Default:** 1 |
+| status | query | Filter by display status. | No | string, <br>**Available values:** "archived", "available", "disabled", "error", "indexing", "paused", "queuing" |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | List of documents. | **application/json**: [DocumentListResponse](#documentlistresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | `not_found` : Knowledge base not found. |  |
+
+### [POST] /datasets/{dataset_id}/documents/download-zip
+**Download Documents as ZIP**
+
+Download multiple uploaded-file documents as a single ZIP archive. Accepts up to `100` document IDs.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [DocumentBatchDownloadZipPayload](#documentbatchdownloadzippayload)<br> |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 200 | ZIP archive containing the requested documents. |
+| 401 | Unauthorized - invalid API token |
+| 403 | `forbidden` : Insufficient permissions. |
+| 404 | `not_found` : Document or dataset not found. |
+
+### [PATCH] /datasets/{dataset_id}/documents/status/{action}
+**Update Document Status in Batch**
+
+Enable, disable, archive, or unarchive multiple documents at once.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| action | path | Action to perform: 'enable', 'disable', 'archive', or 'un_archive' | Yes | string, <br>**Available values:** "archive", "disable", "enable", "un_archive" |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [DocumentStatusPayload](#documentstatuspayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document status updated successfully | **application/json**: [SimpleResultResponse](#simpleresultresponse)<br> |
+| 400 | `invalid_action` : Invalid action. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | `forbidden` : Insufficient permissions. |  |
+| 404 | `not_found` : Knowledge base not found. |  |
+
+### [GET] /datasets/{dataset_id}/documents/{batch}/indexing-status
+**Get Document Indexing Status**
+
+Check the indexing progress of documents in a batch. Returns the current processing stage and chunk completion counts for each document. Poll this endpoint until `indexing_status` reaches `completed` or `error`. The status progresses through: `waiting` → `parsing` → `cleaning` → `splitting` → `indexing` → `completed`.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| batch | path | Batch ID. | Yes | string |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Indexing status for documents in the batch. | **application/json**: [DocumentStatusListResponse](#documentstatuslistresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | `not_found` : Knowledge base not found. / Documents not found. |  |
+
+### [DELETE] /datasets/{dataset_id}/documents/{document_id}
+**Delete Document**
+
+Permanently delete a document and all its chunks from the knowledge base.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Success. |
+| 400 | `document_indexing` : Cannot delete document during indexing. |
+| 401 | Unauthorized - invalid API token |
+| 403 | `archived_document_immutable` : The archived document is not editable. |
+| 404 | `not_found` : Document Not Exists. |
+
+### [GET] /datasets/{dataset_id}/documents/{document_id}
+**Get Document**
+
+Retrieve detailed information about a specific document, including its indexing status, metadata, and processing statistics.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| metadata | query | `all` returns all fields including metadata. `only` returns only `id`, `doc_type`, and `doc_metadata`. `without` returns all fields except `doc_metadata`. | No | string, <br>**Available values:** "all", "only", "without", <br>**Default:** all |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document details. The response shape varies based on the `metadata` query parameter. When `metadata` is `only`, only `id`, `doc_type`, and `doc_metadata` are returned. When `metadata` is `without`, `doc_type` and `doc_metadata` are omitted. | **application/json**: [DocumentDetailResponse](#documentdetailresponse)<br> |
+| 400 | `invalid_metadata` : Invalid metadata value for the specified key. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | `forbidden` : No permission. |  |
+| 404 | `not_found` : Document not found. |  |
+
+### [PATCH] /datasets/{dataset_id}/documents/{document_id}
+Update an existing document by uploading a file
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  No | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document updated successfully | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Document not found |  |
+
+### [GET] /datasets/{dataset_id}/documents/{document_id}/download
+**Download Document**
+
+Get a signed download URL for a document's original uploaded file.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Download URL generated successfully. | **application/json**: [UrlResponse](#urlresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | `forbidden` : No permission to access this document. |  |
+| 404 | `not_found` : Document not found. |  |
+
+### ~~[POST] /datasets/{dataset_id}/documents/{document_id}/update-by-file~~
+
+***DEPRECATED***
+
+**Update Document by File**
+
+Update an existing document by uploading a new file. Re-triggers indexing — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  No | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document updated successfully. | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
+| 400 | - `too_many_files` : Only one file is allowed. - `filename_not_exists_error` : The specified filename does not exist. - `provider_not_initialize` : No valid model provider credentials found. Please go to Settings -> Model Provider to complete your provider credentials. - `invalid_param` : Knowledge base does not exist, external datasets not supported, file too large, unsupported file type, or invalid doc_form (must be `text_model`, `hierarchical_model`, or `qa_model`). |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Document not found |  |
+
+### [POST] /datasets/{dataset_id}/documents/{document_id}/update-by-text
+**Update Document by Text**
+
+Update an existing document's text content, name, or processing configuration. Re-triggers indexing if content changes — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [DocumentTextUpdate](#documenttextupdate)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document updated successfully. | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
+| 400 | - `provider_not_initialize` : No valid model provider credentials found. Please go to Settings -> Model Provider to complete your provider credentials. - `invalid_param` : Knowledge base does not exist, name is required when text is provided, or invalid doc_form (must be `text_model`, `hierarchical_model`, or `qa_model`). |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Document not found |  |
+
+### ~~[POST] /datasets/{dataset_id}/documents/{document_id}/update_by_file~~
+
+***DEPRECATED***
+
+**Update Document by File**
+
+Update an existing document by uploading a new file. Re-triggers indexing — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  No | **multipart/form-data**: { **"data"**: string, **"file"**: binary }<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document updated successfully. | **application/json**: [DocumentAndBatchResponse](#documentandbatchresponse)<br> |
+| 400 | - `too_many_files` : Only one file is allowed. - `filename_not_exists_error` : The specified filename does not exist. - `provider_not_initialize` : No valid model provider credentials found. Please go to Settings -> Model Provider to complete your provider credentials. - `invalid_param` : Knowledge base does not exist, external datasets not supported, file too large, unsupported file type, or invalid doc_form (must be `text_model`, `hierarchical_model`, or `qa_model`). |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Document not found |  |
+
+---
+## default
+
+### [POST] /datasets/{dataset_id}/documents/metadata
+**Update Document Metadata in Batch**
+
+Update metadata values for multiple documents at once. Each document in the request receives the specified metadata key-value pairs.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [MetadataOperationData](#metadataoperationdata)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Document metadata updated successfully. | **application/json**: [DatasetMetadataActionResponse](#datasetmetadataactionresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset not found |  |
+
+### [GET] /datasets/{dataset_id}/metadata
+**List Metadata Fields**
+
+Returns the list of all metadata fields (both custom and built-in) for the knowledge base, along with the count of documents using each field.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Metadata fields for the knowledge base. | **application/json**: [DatasetMetadataListResponse](#datasetmetadatalistresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset not found |  |
+
+### [POST] /datasets/{dataset_id}/metadata
+**Create Metadata Field**
+
+Create a custom metadata field for the knowledge base. Metadata fields can be used to annotate documents with structured information.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [MetadataArgs](#metadataargs)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Metadata field created successfully. | **application/json**: [DatasetMetadataResponse](#datasetmetadataresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset not found |  |
+
+### [GET] /datasets/{dataset_id}/metadata/built-in
+**Get Built-in Metadata Fields**
+
+Returns the list of built-in metadata fields provided by the system (e.g., document type, source URL).
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Built-in metadata fields. | **application/json**: [DatasetMetadataBuiltInFieldsResponse](#datasetmetadatabuiltinfieldsresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+
+### [POST] /datasets/{dataset_id}/metadata/built-in/{action}
+**Update Built-in Metadata Field**
+
+Enable or disable built-in metadata fields for the knowledge base.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| action | path | `enable` to activate built-in metadata fields, `disable` to deactivate them. | Yes | string, <br>**Available values:** "disable", "enable" |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Built-in metadata field toggled successfully. | **application/json**: [DatasetMetadataActionResponse](#datasetmetadataactionresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset not found |  |
+
+### [DELETE] /datasets/{dataset_id}/metadata/{metadata_id}
+**Delete Metadata Field**
+
+Permanently delete a custom metadata field. Documents using this field will lose their metadata values for it.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| metadata_id | path | Metadata field ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Success. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - dataset API access or workspace access denied |
+| 404 | Dataset or metadata not found |
+
+### [PATCH] /datasets/{dataset_id}/metadata/{metadata_id}
+**Update Metadata Field**
+
+Rename a custom metadata field.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| metadata_id | path | Metadata field ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [MetadataUpdatePayload](#metadataupdatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Metadata field updated successfully. | **application/json**: [DatasetMetadataResponse](#datasetmetadataresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset or metadata not found |  |
+
+---
+## default
+
+### [GET] /datasets/{dataset_id}/documents/{document_id}/segments
+**List Chunks**
+
+Returns a paginated list of chunks within a document. Supports filtering by keyword and status.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| keyword | query | Search keyword. | No | string |
+| limit | query | Number of items per page. Server caps at `100`. | No | integer, <br>**Default:** 20 |
+| page | query | Page number to retrieve. | No | integer, <br>**Default:** 1 |
+| status | query | Filter chunks by indexing status, such as `completed`, `indexing`, or `error`. | No | [ string ] |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | List of chunks. | **application/json**: [SegmentListResponse](#segmentlistresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset or document not found |  |
+
+### [POST] /datasets/{dataset_id}/documents/{document_id}/segments
+**Create Chunks**
+
+Create one or more chunks within a document. Each chunk can include optional keywords and an answer field (for QA-mode documents).
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SegmentCreatePayload](#segmentcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Chunks created successfully. | **application/json**: [SegmentCreateListResponse](#segmentcreatelistresponse)<br> |
+| 400 | Bad request - segments data is missing |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | `not_found` : Document is not completed or is disabled. |  |
+
+### [DELETE] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}
+**Delete Chunk**
+
+Permanently delete a chunk from the document.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| segment_id | path | Chunk ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Success. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - dataset API access or workspace access denied |
+| 404 | Dataset, document, or segment not found |
+
+### [GET] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}
+**Get Chunk**
+
+Retrieve detailed information about a specific chunk, including its content, keywords, and indexing status.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| segment_id | path | Chunk ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Chunk details. | **application/json**: [SegmentDetailResponse](#segmentdetailresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset, document, or segment not found |  |
+
+### [POST] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}
+**Update Chunk**
+
+Update a chunk's content, keywords, or answer. Re-triggers indexing for the modified chunk.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| segment_id | path | Chunk ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SegmentUpdatePayload](#segmentupdatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Chunk updated successfully. | **application/json**: [SegmentDetailResponse](#segmentdetailresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset, document, or segment not found |  |
+
+### [GET] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks
+**List Child Chunks**
+
+Returns a paginated list of child chunks under a specific parent chunk.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| segment_id | path | Chunk ID. | Yes | string (uuid) |
+| keyword | query | Search keyword. | No | string |
+| limit | query | Number of items per page. Server caps at `100`. | No | integer, <br>**Default:** 20 |
+| page | query | Page number to retrieve. | No | integer, <br>**Default:** 1 |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | List of child chunks. | **application/json**: [ChildChunkListResponse](#childchunklistresponse)<br> |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset, document, or segment not found |  |
+
+### [POST] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks
+**Create Child Chunk**
+
+Create a child chunk under the specified segment.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| segment_id | path | Chunk ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [ChildChunkCreatePayload](#childchunkcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Child chunk created successfully. | **application/json**: [ChildChunkDetailResponse](#childchunkdetailresponse)<br> |
+| 400 | `invalid_param` : Create child chunk index failed. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset, document, or segment not found |  |
+
+### [DELETE] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks/{child_chunk_id}
+**Delete Child Chunk**
+
+Permanently delete a child chunk from its parent chunk.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| child_chunk_id | path | Child chunk ID. | Yes | string (uuid) |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| segment_id | path | Chunk ID. | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Success. |
+| 400 | `invalid_param` : Delete child chunk index failed. |
+| 401 | Unauthorized - invalid API token |
+| 403 | Forbidden - dataset API access or workspace access denied |
+| 404 | Dataset, document, segment, or child chunk not found |
+
+### [PATCH] /datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks/{child_chunk_id}
+**Update Child Chunk**
+
+Update the content of an existing child chunk.
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| child_chunk_id | path | Child chunk ID. | Yes | string (uuid) |
+| dataset_id | path | Knowledge base ID. | Yes | string (uuid) |
+| document_id | path | Document ID. | Yes | string (uuid) |
+| segment_id | path | Chunk ID. | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [ChildChunkUpdatePayload](#childchunkupdatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Child chunk updated successfully. | **application/json**: [ChildChunkDetailResponse](#childchunkdetailresponse)<br> |
+| 400 | `invalid_param` : Update child chunk index failed. |  |
+| 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - dataset API access or workspace access denied |  |
+| 404 | Dataset, document, segment, or child chunk not found |  |
+
+---
+## default
 
 ### [GET] /end-users/{end_user_id}
-**Get end user detail**
+**Get End User Info**
 
-Get an end user by ID
-This endpoint is scoped to the current app token's tenant/app to prevent
-cross-tenant/app access when an end-user ID is known.
+Retrieve an end user by ID. Useful when other APIs return an end-user ID (e.g., `created_by` from [Upload File](/api-reference/files/upload-file)).
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| end_user_id | path | End user ID | Yes | string |
+| end_user_id | path | End user ID | Yes | string (uuid) |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | End user retrieved successfully | **application/json**: [EndUserDetail](#enduserdetail)<br> |
+| 200 | End user retrieved successfully. | **application/json**: [EndUserDetail](#enduserdetail)<br> |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | End user not found |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `end_user_not_found` : End user not found. |  |
+
+---
+## default
 
 ### [POST] /files/upload
-**Upload a file for use in conversations**
+**Upload File**
 
-Upload a file for use in conversations
-Accepts a single file upload via multipart/form-data.
+Upload a file for use when sending messages, enabling multimodal understanding of images, documents, audio, and video. Uploaded files are for use by the current end-user only.
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **multipart/form-data**: { **"file"**: binary, **"user"**: string }<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 201 | File uploaded successfully | **application/json**: [FileResponse](#fileresponse)<br> |
-| 400 | Bad request - no file or invalid file |  |
+| 201 | File uploaded successfully. | **application/json**: [FileResponse](#fileresponse)<br> |
+| 400 | - `no_file_uploaded` : No file was provided in the request. - `too_many_files` : Only one file is allowed per request. - `filename_not_exists_error` : The uploaded file has no filename. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 413 | File too large |  |
-| 415 | Unsupported file type |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 413 | `file_too_large` : File size exceeded. |  |
+| 415 | `unsupported_file_type` : File type not allowed. |  |
 
 ### [GET] /files/{file_id}/preview
-**Preview/Download a file that was uploaded via Service API**
+**Download File**
 
-Preview or download a file uploaded via Service API
-Provides secure file preview/download functionality.
-Files can only be accessed if they belong to messages within the requesting app's context.
+Preview or download uploaded files previously uploaded via the [Upload File](/api-reference/files/upload-file) API. Files can only be accessed if they belong to messages within the requesting application.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| file_id | path | UUID of the file to preview | Yes | string |
-| as_attachment | query | Download as attachment | No | boolean |
+| file_id | path | The unique identifier of the file to preview, obtained from the [Upload File](/api-reference/files/upload-file) API response. | Yes | string (uuid) |
+| as_attachment | query | If `true`, forces the file to download as an attachment instead of previewing in browser. | No | boolean |
+| user | query | User identifier, used for end-user context. | No | string |
 
 #### Responses
 
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | File retrieved successfully | **application/json**: [BinaryFileResponse](#binaryfileresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - file access denied |  |
-| 404 | File not found |  |
+| Code | Description |
+| ---- | ----------- |
+| 200 | Returns the raw file content. The `Content-Type` header is set to the file's MIME type. If `as_attachment` is `true`, the file is returned as a download with `Content-Disposition: attachment`. |
+| 401 | Unauthorized - invalid API token |
+| 403 | `file_access_denied` : Access to the requested file is denied. |
+| 404 | `file_not_found` : The requested file was not found. |
+
+---
+## default
 
 ### [GET] /form/human_input/{form_token}
-Get a paused human input form by token
+**Get Human Input Form**
+
+Retrieve a paused Human Input form's contents using the `form_token` from a `human_input_required` event. Requires **WebApp** delivery.
 
 #### Parameters
 
@@ -1534,13 +2061,16 @@ Get a paused human input form by token
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Form retrieved successfully | **application/json**: [HumanInputFormDefinitionResponse](#humaninputformdefinitionresponse)<br> |
+| 200 | Form contents retrieved successfully. | **application/json**: [HumanInputFormDefinitionResponse](#humaninputformdefinitionresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Form not found |  |
-| 412 | Form already submitted or expired |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Form not found. |  |
+| 412 | - `human_input_form_submitted` : Form already submitted. Forms are one-shot; the first response wins regardless of which user submits it. - `human_input_form_expired` : The form's expiration time passed before submission arrived. |  |
 
 ### [POST] /form/human_input/{form_token}
-Submit a paused human input form by token
+**Submit Human Input Form**
+
+Submit the recipient's response to a paused Human Input form. The workflow resumes on acceptance; use [Stream Workflow Events](/api-reference/chatflows/stream-workflow-events) to follow subsequent events. Requires **WebApp** delivery.
 
 #### Parameters
 
@@ -1552,318 +2082,250 @@ Submit a paused human input form by token
 
 | Required | Schema |
 | -------- | ------ |
-|  Yes | **application/json**: [HumanInputFormSubmitPayload](#humaninputformsubmitpayload)<br> |
+|  Yes | **application/json**: [HumanInputFormSubmitPayloadWithUser](#humaninputformsubmitpayloadwithuser)<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Form submitted successfully | **application/json**: [HumanInputFormSubmitResponse](#humaninputformsubmitresponse)<br> |
-| 400 | Bad request - invalid submission data |  |
+| 200 | Form submitted successfully. The response body is an empty object. | **application/json**: [HumanInputFormSubmitResponse](#humaninputformsubmitresponse)<br> |
+| 400 | - `bad_request` : Form recipient type is invalid. - `invalid_form_data` : Submission failed validation against the form definition. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Form not found |  |
-| 412 | Form already submitted or expired |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Form not found. |  |
+| 412 | - `human_input_form_submitted` : Form already submitted. Forms are one-shot; the first response wins regardless of which user submits it. - `human_input_form_expired` : The form's expiration time passed before submission arrived. |  |
+
+---
+## default
 
 ### [GET] /info
-**Get app information**
+**Get App Info**
 
-Get basic application information
-Returns basic information about the application including name, description, tags, and mode.
+Retrieve basic information about this application, including name, description, tags, and mode.
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Application info retrieved successfully | **application/json**: [AppInfoResponse](#appinforesponse)<br> |
+| 200 | Basic information of the application. | **application/json**: [AppInfoResponse](#appinforesponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
 | 404 | Application not found |  |
 
-### [GET] /messages
-**List messages in a conversation**
-
-List messages in a conversation
-Retrieves messages with pagination support using first_id.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| conversation_id | query | Conversation UUID | Yes | string |
-| first_id | query | First message ID for pagination | No | string |
-| limit | query | Number of messages to return (1-100) | No | integer, <br>**Default:** 20 |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Messages retrieved successfully | **application/json**: [MessageInfiniteScrollPagination](#messageinfinitescrollpagination)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Conversation or first message not found |  |
-
-### [POST] /messages/{message_id}/feedbacks
-**Submit feedback for a message**
-
-Submit feedback for a message
-Allows users to rate messages as like/dislike and provide optional feedback content.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| message_id | path | Message ID | Yes | string |
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [MessageFeedbackPayload](#messagefeedbackpayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Feedback submitted successfully | **application/json**: [ResultResponse](#resultresponse)<br> |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Message not found |  |
-
-### [GET] /messages/{message_id}/suggested
-**Get suggested follow-up questions for a message**
-
-Get suggested follow-up questions for a message
-Returns AI-generated follow-up questions based on the message content.
-
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| message_id | path | Message ID | Yes | string |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Suggested questions retrieved successfully | **application/json**: [SimpleResultStringListResponse](#simpleresultstringlistresponse)<br> |
-| 400 | Suggested questions feature is disabled |  |
-| 401 | Unauthorized - invalid API token |  |
-| 404 | Message not found |  |
-| 500 | Internal server error |  |
-
 ### [GET] /meta
-**Get app metadata**
+**Get App Meta**
 
-Get application metadata
-Returns metadata about the application including configuration and settings.
+Retrieve metadata about this application, including tool icons and other configuration details.
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Metadata retrieved successfully | **application/json**: [AppMetaResponse](#appmetaresponse)<br> |
+| 200 | Successfully retrieved application meta information. | **application/json**: [AppMetaResponse](#appmetaresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
 | 404 | Application not found |  |
 
 ### [GET] /parameters
-**Retrieve app parameters**
+**Get App Parameters**
 
-Retrieve application input parameters and configuration
-Returns the input form parameters and configuration for the application.
+Retrieve the application's input form configuration, including feature switches, input parameter names, types, and default values.
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Parameters retrieved successfully | **application/json**: [Parameters](#parameters)<br> |
+| 200 | Application parameters information. | **application/json**: [Parameters](#parameters)<br> |
+| 400 | `app_unavailable` : App unavailable or misconfigured. |  |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
 | 404 | Application not found |  |
 
 ### [GET] /site
-**Retrieve app site info**
+**Get App WebApp Settings**
 
-Get application site configuration
-Returns the site configuration for the application including theme, icons, and text.
+Retrieve the WebApp settings of this application, including site configuration, theme, and customization options.
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Site configuration retrieved successfully | **application/json**: [Site](#site)<br> |
+| 200 | WebApp settings of the application. | **application/json**: [Site](#site)<br> |
 | 401 | Unauthorized - invalid API token |  |
-| 403 | Forbidden - site not found or tenant archived |  |
+| 403 | `forbidden` : Site not found for this application or the workspace has been archived. |  |
 
-### [POST] /text-to-audio
-**Convert text to audio using text-to-speech**
-
-Convert text to audio using text-to-speech
-Converts the provided text to audio using the specified voice.
-
-#### Request Body
-
-| Required | Schema |
-| -------- | ------ |
-|  Yes | **application/json**: [TextToAudioPayload](#texttoaudiopayload)<br> |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Text successfully converted to audio | **application/json**: [AudioBinaryResponse](#audiobinaryresponse)<br> |
-| 400 | Bad request - invalid parameters |  |
-| 401 | Unauthorized - invalid API token |  |
-| 500 | Internal server error |  |
+---
+## default
 
 ### [GET] /workflow/{task_id}/events
-Get workflow execution events stream after resume
+**Stream Workflow Events**
+
+Resume the Server-Sent Events stream for a workflow run after a pause or a dropped SSE connection. For runs that have already finished, the stream emits a single `workflow_finished` event and closes.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| task_id | path | Workflow run ID | Yes | string |
-| continue_on_pause | query | Keep the stream open across workflow_paused events | No | boolean |
-| include_state_snapshot | query | Replay from persisted state snapshot | No | boolean |
-| user | query | End user identifier | Yes | string |
+| task_id | path | Workflow run ID returned by the original workflow run request. | Yes | string |
+| continue_on_pause | query | Set to `true` to keep the stream open across multiple `workflow_paused` events, which is useful when the workflow has more than one Human Input node in sequence. By default, the stream closes after the first pause. | No | boolean |
+| include_state_snapshot | query | When `true`, replay from the persisted state snapshot to include a status summary of already-executed nodes before streaming new events. | No | boolean |
+| user | query | End-user identifier that originally triggered the run. Must match the creator of the run. | Yes | string |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | SSE event stream | **application/json**: [EventStreamResponse](#eventstreamresponse)<br> |
+| 200 | Server-Sent Events stream. Each event is delivered as `data: {JSON}\\n\\n`. Event payloads follow the same schemas as the original streaming response. | **text/event-stream**: [EventStreamResponse](#eventstreamresponse)<br> |
+| 400 | `not_workflow_app` : Please check if your app mode matches the right API route. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Workflow run not found |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Workflow run not found. |  |
 
 ### [GET] /workflows/logs
-**Get workflow app logs**
+**List Workflow Logs**
 
-Get workflow execution logs
-Returns paginated workflow execution logs with filtering options.
+Retrieve paginated workflow execution logs with filtering options.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| created_at__after | query |  | No | string |
-| created_at__before | query |  | No | string |
-| created_by_account | query |  | No | string |
-| created_by_end_user_session_id | query |  | No | string |
-| keyword | query |  | No | string |
-| limit | query |  | No | integer, <br>**Default:** 20 |
-| page | query |  | No | integer, <br>**Default:** 1 |
-| status | query |  | No | string, <br>**Available values:** "failed", "stopped", "succeeded" |
+| created_at__after | query | Filter logs created after this ISO 8601 timestamp. | No | dateTime |
+| created_at__before | query | Filter logs created before this ISO 8601 timestamp. | No | dateTime |
+| created_by_account | query | Filter by account ID. | No | string |
+| created_by_end_user_session_id | query | Filter by end user session ID. | No | string |
+| keyword | query | Keyword to search in logs. | No | string |
+| limit | query | Number of items per page. | No | integer, <br>**Default:** 20 |
+| page | query | Page number for pagination. | No | integer, <br>**Default:** 1 |
+| status | query | Filter by execution status. | No | string, <br>**Available values:** "failed", "stopped", "succeeded" |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Logs retrieved successfully | **application/json**: [WorkflowAppLogPaginationResponse](#workflowapplogpaginationresponse)<br> |
+| 200 | Successfully retrieved workflow logs. | **application/json**: [WorkflowAppLogPaginationResponse](#workflowapplogpaginationresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
 
 ### [POST] /workflows/run
-**Execute a workflow**
+**Run Workflow**
 
-Execute a workflow
-Runs a workflow with the provided inputs and returns the results.
-Supports both blocking and streaming response modes.
+Execute a workflow. Cannot be executed without a published workflow.
 
 #### Request Body
 
 | Required | Schema |
 | -------- | ------ |
-|  Yes | **application/json**: [WorkflowRunPayload](#workflowrunpayload)<br> |
+|  Yes | **application/json**: [WorkflowRunPayloadWithUser](#workflowrunpayloadwithuser)<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Workflow executed successfully | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br> |
-| 400 | Bad request - invalid parameters or workflow issues |  |
+| 200 | Successful response. The content type and structure depend on the `response_mode` parameter in the request.  - If `response_mode` is `blocking`, returns `application/json` with a `WorkflowBlockingResponse` object. - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of `ChunkWorkflowEvent` objects. | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br>**text/event-stream**: [GeneratedAppResponse](#generatedappresponse)<br> |
+| 400 | - `not_workflow_app` : App mode does not match the API route. - `provider_not_initialize` : No valid model provider credentials found. - `provider_quota_exceeded` : Model provider quota exhausted. - `model_currently_not_support` : Current model unavailable. - `completion_request_error` : Workflow execution request failed. - `invalid_param` : Invalid parameter value. |  |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
 | 404 | Workflow not found |  |
-| 429 | Rate limit exceeded |  |
-| 500 | Internal server error |  |
+| 429 | - `too_many_requests` : Too many concurrent requests for this app. - `rate_limit_error` : The upstream model provider rate limit was exceeded. |  |
+| 500 | `internal_server_error` : Internal server error. |  |
 
 ### [GET] /workflows/run/{workflow_run_id}
-**Get a workflow task running detail**
+**Get Workflow Run Detail**
 
-Get workflow run details
-Returns detailed information about a specific workflow run.
+Retrieve the current execution results of a workflow task based on the workflow execution ID.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| workflow_run_id | path | Workflow run ID | Yes | string |
+| workflow_run_id | path | Workflow run ID, obtained from the workflow execution response or streaming events. | Yes | string |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Workflow run details retrieved successfully | **application/json**: [WorkflowRunResponse](#workflowrunresponse)<br> |
+| 200 | Successfully retrieved workflow run details. | **application/json**: [WorkflowRunResponse](#workflowrunresponse)<br> |
+| 400 | `not_workflow_app` : App mode does not match the API route. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Workflow run not found |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Workflow run not found. |  |
 
 ### [POST] /workflows/tasks/{task_id}/stop
-**Stop a running workflow task**
+**Stop Workflow Task**
+
+Stop a running workflow task. Only supported in `streaming` mode.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| task_id | path | Task ID to stop | Yes | string |
+| task_id | path | Task ID, obtained from the streaming chunk returned by the Run Workflow API. | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [RequiredServiceApiUserPayload](#requiredserviceapiuserpayload)<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
 | 200 | Task stopped successfully | **application/json**: [SimpleResultResponse](#simpleresultresponse)<br> |
+| 400 | - `not_workflow_app` : App mode does not match the API route. - `invalid_param` : Required parameter missing or invalid. |  |
 | 401 | Unauthorized - invalid API token |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
 | 404 | Task not found |  |
 
 ### [POST] /workflows/{workflow_id}/run
-**Run specific workflow by ID**
+**Run Workflow by ID**
 
-Execute a specific workflow by ID
-Executes a specific workflow version identified by its ID.
+Execute a specific workflow version identified by its ID. Useful for running a particular published version of the workflow.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| workflow_id | path | Workflow ID to execute | Yes | string |
+| workflow_id | path | Workflow ID of the specific version to execute. This value is returned in the `workflow_id` field of workflow run responses. | Yes | string |
 
 #### Request Body
 
 | Required | Schema |
 | -------- | ------ |
-|  Yes | **application/json**: [WorkflowRunPayload](#workflowrunpayload)<br> |
+|  Yes | **application/json**: [WorkflowRunPayloadWithUser](#workflowrunpayloadwithuser)<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Workflow executed successfully | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br> |
-| 400 | Bad request - invalid parameters or workflow issues |  |
+| 200 | Successful response. The content type and structure depend on the `response_mode` parameter in the request.  - If `response_mode` is `blocking`, returns `application/json` with a `WorkflowBlockingResponse` object. - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of `ChunkWorkflowEvent` objects. | **application/json**: [GeneratedAppResponse](#generatedappresponse)<br>**text/event-stream**: [GeneratedAppResponse](#generatedappresponse)<br> |
+| 400 | - `not_workflow_app` : App mode does not match the API route. - `bad_request` : Workflow is a draft or has an invalid ID format. - `provider_not_initialize` : No valid model provider credentials found. - `provider_quota_exceeded` : Model provider quota exhausted. - `model_currently_not_support` : Current model unavailable. - `completion_request_error` : Workflow execution request failed. - `invalid_param` : Required parameter missing or invalid. |  |
 | 401 | Unauthorized - invalid API token |  |
-| 404 | Workflow not found |  |
-| 429 | Rate limit exceeded |  |
-| 500 | Internal server error |  |
+| 403 | Forbidden - token scope, app, dataset, or workspace access denied |  |
+| 404 | `not_found` : Workflow not found. |  |
+| 429 | - `too_many_requests` : Too many concurrent requests for this app. - `rate_limit_error` : The upstream model provider rate limit was exceeded. |  |
+| 500 | `internal_server_error` : Internal server error. |  |
+
+---
+## default
 
 ### [GET] /workspaces/current/models/model-types/{model_type}
-**Get available models by model type**
+**Get Available Models**
 
-Get available models by model type
-Returns a list of available models for the specified model type.
+Retrieve the list of available models by type. Primarily used to query `text-embedding` and `rerank` models for knowledge base configuration.
 
 #### Parameters
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| model_type | path | Type of model to retrieve | Yes | string |
+| model_type | path | Type of model to retrieve. | Yes | string, <br>**Available values:** "llm", "moderation", "rerank", "speech2text", "text-embedding", "tts" |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Models retrieved successfully | **application/json**: [ProviderWithModelsListResponse](#providerwithmodelslistresponse)<br> |
+| 200 | Available models for the specified type. | **application/json**: [ProviderWithModelsListResponse](#providerwithmodelslistresponse)<br> |
 | 401 | Unauthorized - invalid API token |  |
 
 ---
@@ -1899,8 +2361,8 @@ Returns a list of available models for the specified model type.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| answer | string | Annotation answer | Yes |
-| question | string | Annotation question | Yes |
+| answer | string | Annotation answer. | Yes |
+| question | string | Annotation question. | Yes |
 
 #### AnnotationJobStatusResponse
 
@@ -1924,17 +2386,17 @@ Returns a list of available models for the specified model type.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| keyword | string | Keyword to search annotations | No |
-| limit | integer, <br>**Default:** 20 | Number of annotations per page | No |
-| page | integer, <br>**Default:** 1 | Page number | No |
+| keyword | string | Keyword to filter annotations by question or answer content. | No |
+| limit | integer, <br>**Default:** 20 | Number of items per page. | No |
+| page | integer, <br>**Default:** 1 | Page number for pagination. | No |
 
 #### AnnotationReplyActionPayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| embedding_model_name | string | Embedding model name | Yes |
-| embedding_provider_name | string | Embedding provider name | Yes |
-| score_threshold | number | Score threshold for annotation matching | Yes |
+| embedding_model_name | string | Name of the embedding model to use for annotation matching. | Yes |
+| embedding_provider_name | string | Name of the embedding model provider. | Yes |
+| score_threshold | float | Minimum similarity score for an annotation to be considered a match. Higher values require closer matches. | Yes |
 
 #### AppFeedbackListResponse
 
@@ -2004,21 +2466,32 @@ Button styles for user actions.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| auto_generate_name | boolean, <br>**Default:** true | Auto generate conversation name | No |
-| conversation_id | string | Conversation UUID | No |
-| files | [ object ] |  | No |
-| inputs | object |  | Yes |
-| query | string |  | Yes |
-| response_mode | string |  | No |
-| retriever_from | string, <br>**Default:** dev |  | No |
-| trace_session_id | string | Trace session ID for observability grouping | No |
-| workflow_id | string | Workflow ID for advanced chat | No |
+| auto_generate_name | boolean, <br>**Default:** true | Auto-generate the conversation title. If `false`, use the Rename Conversation API with `auto_generate: true` to generate the title asynchronously. | No |
+| conversation_id | string | Conversation ID to continue a conversation. Omit this field or pass an empty string to start a new conversation, then pass the returned `conversation_id` in subsequent requests. | No |
+| files | [ object ] | File list for multimodal understanding, including images, documents, audio, and video. To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned `id` as `upload_file_id` with `transfer_method: local_file`. | No |
+| inputs | object | Values for app-defined variables. Refer to the `user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) response to discover expected variable names and types. | Yes |
+| query | string | User input or question content. | Yes |
+| response_mode | string | Response mode. `streaming` uses Server-Sent Events; `blocking` returns after completion. New Agent app mode supports streaming only. When omitted, non-Agent apps run in blocking mode and new Agent apps stream. | No |
+| workflow_id | string | Published workflow version ID to execute for advanced chat. If omitted, the app's current published workflow is used. | No |
+
+#### ChatRequestPayloadWithUser
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| auto_generate_name | boolean, <br>**Default:** true | Auto-generate the conversation title. If `false`, use the Rename Conversation API with `auto_generate: true` to generate the title asynchronously. | No |
+| conversation_id | string | Conversation ID to continue a conversation. Omit this field or pass an empty string to start a new conversation, then pass the returned `conversation_id` in subsequent requests. | No |
+| files | [ object ] | File list for multimodal understanding, including images, documents, audio, and video. To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned `id` as `upload_file_id` with `transfer_method: local_file`. | No |
+| inputs | object | Values for app-defined variables. Refer to the `user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) response to discover expected variable names and types. | Yes |
+| query | string | User input or question content. | Yes |
+| response_mode | string | Response mode. `streaming` uses Server-Sent Events; `blocking` returns after completion. New Agent app mode supports streaming only. When omitted, non-Agent apps run in blocking mode and new Agent apps stream. | No |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | Yes |
+| workflow_id | string | Published workflow version ID to execute for advanced chat. If omitted, the app's current published workflow is used. | No |
 
 #### ChildChunkCreatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| content | string |  | Yes |
+| content | string | Child chunk text content. | Yes |
 
 #### ChildChunkDetailResponse
 
@@ -2030,9 +2503,9 @@ Button styles for user actions.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| keyword | string |  | No |
-| limit | integer, <br>**Default:** 20 |  | No |
-| page | integer, <br>**Default:** 1 |  | No |
+| keyword | string | Search keyword. | No |
+| limit | integer, <br>**Default:** 20 | Number of items per page. Server caps at `100`. | No |
+| page | integer, <br>**Default:** 1 | Page number to retrieve. | No |
 
 #### ChildChunkListResponse
 
@@ -2061,18 +2534,26 @@ Button styles for user actions.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| content | string |  | Yes |
+| content | string | Child chunk text content. | Yes |
 
 #### CompletionRequestPayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| files | [ object ] |  | No |
-| inputs | object |  | Yes |
-| query | string |  | No |
-| response_mode | string |  | No |
-| retriever_from | string, <br>**Default:** dev |  | No |
-| trace_session_id | string | Trace session ID for observability grouping | No |
+| files | [ object ] | File list for multimodal understanding, including images, documents, audio, and video. To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned `id` as `upload_file_id` with `transfer_method: local_file`. | No |
+| inputs | object | Values for app-defined variables. Refer to the `user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) response to discover expected variable names and types. | Yes |
+| query | string | User input or prompt content. | No |
+| response_mode | string | Response mode. `streaming` uses Server-Sent Events; `blocking` returns after completion. When omitted, the request runs in blocking mode. | No |
+
+#### CompletionRequestPayloadWithUser
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| files | [ object ] | File list for multimodal understanding, including images, documents, audio, and video. To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned `id` as `upload_file_id` with `transfer_method: local_file`. | No |
+| inputs | object | Values for app-defined variables. Refer to the `user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) response to discover expected variable names and types. | Yes |
+| query | string | User input or prompt content. | No |
+| response_mode | string | Response mode. `streaming` uses Server-Sent Events; `blocking` returns after completion. When omitted, the request runs in blocking mode. | No |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | Yes |
 
 #### Condition
 
@@ -2080,9 +2561,9 @@ Condition detail
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| comparison_operator | string, <br>**Available values:** "<", "=", ">", "after", "before", "contains", "empty", "end with", "in", "is", "is not", "not contains", "not empty", "not in", "start with", "≠", "≤", "≥" | *Enum:* `"<"`, `"="`, `">"`, `"after"`, `"before"`, `"contains"`, `"empty"`, `"end with"`, `"in"`, `"is"`, `"is not"`, `"not contains"`, `"not empty"`, `"not in"`, `"start with"`, `"≠"`, `"≤"`, `"≥"` | Yes |
-| name | string |  | Yes |
-| value | string<br>[ string ]<br>integer<br>number |  | No |
+| comparison_operator | string, <br>**Available values:** "<", "=", ">", "after", "before", "contains", "empty", "end with", "in", "is", "is not", "not contains", "not empty", "not in", "start with", "≠", "≤", "≥" | Comparison to apply. String operators (`contains`, `not contains`, `start with`, `end with`, `is`, `is not`, `empty`, `not empty`, `in`, `not in`) act on string or array metadata; numeric operators (`=`, `≠`, `>`, `<`, `≥`, `≤`) act on numeric metadata; time operators (`before`, `after`) act on time metadata.<br>*Enum:* `"<"`, `"="`, `">"`, `"after"`, `"before"`, `"contains"`, `"empty"`, `"end with"`, `"in"`, `"is"`, `"is not"`, `"not contains"`, `"not empty"`, `"not in"`, `"start with"`, `"≠"`, `"≤"`, `"≥"` | Yes |
+| name | string | Metadata field name to compare against. | Yes |
+| value | string<br>[ string ]<br>number | Value to compare against. Type depends on `comparison_operator`: string for most string operators, array of strings for `in` and `not in`, number for numeric operators, and omit or use `null` for `empty` and `not empty`. | No |
 
 #### ConversationInfiniteScrollPagination
 
@@ -2096,16 +2577,24 @@ Condition detail
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| last_id | string | Last conversation ID for pagination | No |
-| limit | integer, <br>**Default:** 20 | Number of conversations to return | No |
-| sort_by | string, <br>**Available values:** "-created_at", "-updated_at", "created_at", "updated_at", <br>**Default:** -updated_at | Sort order for conversations<br>*Enum:* `"-created_at"`, `"-updated_at"`, `"created_at"`, `"updated_at"` | No |
+| last_id | string | The ID of the last record on the current page. Used to fetch the next page. | No |
+| limit | integer, <br>**Default:** 20 | Number of records to return. | No |
+| sort_by | string, <br>**Available values:** "-created_at", "-updated_at", "created_at", "updated_at", <br>**Default:** -updated_at | Sorting field. Use the `-` prefix for descending order.<br>*Enum:* `"-created_at"`, `"-updated_at"`, `"created_at"`, `"updated_at"` | No |
 
 #### ConversationRenamePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| auto_generate | boolean |  | No |
-| name | string |  | No |
+| auto_generate | boolean | Automatically generate the conversation name. When `true`, the `name` field is ignored. | No |
+| name | string | Conversation name. Required when `auto_generate` is `false`. | No |
+
+#### ConversationRenamePayloadWithUser
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| auto_generate | boolean | Automatically generate the conversation name. When `true`, the `name` field is ignored. | No |
+| name | string | Conversation name. Required when `auto_generate` is `false`. | No |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | No |
 
 #### ConversationVariableInfiniteScrollPaginationResponse
 
@@ -2131,15 +2620,22 @@ Condition detail
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| value |  |  | Yes |
+| value |  | The new value for the variable. Must match the variable's expected type. | Yes |
+
+#### ConversationVariableUpdatePayloadWithUser
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | No |
+| value |  | The new value for the variable. Must match the variable's expected type. | Yes |
 
 #### ConversationVariablesQuery
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| last_id | string | Last variable ID for pagination | No |
-| limit | integer, <br>**Default:** 20 | Number of variables to return | No |
-| variable_name | string | Filter variables by name | No |
+| last_id | string | The ID of the last record on the current page. Used to fetch the next page. | No |
+| limit | integer, <br>**Default:** 20 | Number of records to return. | No |
+| variable_name | string | Filter variables by a specific name. | No |
 
 #### CustomConfigurationStatus
 
@@ -2167,17 +2663,17 @@ Enum class for custom configuration status.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| description | string | Dataset description (max 400 chars) | No |
-| embedding_model | string |  | No |
-| embedding_model_provider | string |  | No |
-| external_knowledge_api_id | string |  | No |
-| external_knowledge_id | string |  | No |
-| indexing_technique | string |  | No |
-| name | string |  | Yes |
-| permission | [PermissionEnum](#permissionenum) |  | No |
-| provider | string, <br>**Default:** vendor |  | No |
-| retrieval_model | [RetrievalModel](#retrievalmodel) |  | No |
-| summary_index_setting | object |  | No |
+| description | string | Description of the knowledge base. | No |
+| embedding_model | string | Embedding model name. Use the `model` field from [Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`. | No |
+| embedding_model_provider | string | Embedding model provider. Use the `provider` field from [Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`. | No |
+| external_knowledge_api_id | string | ID of the external knowledge API. | No |
+| external_knowledge_id | string | ID of the external knowledge base. | No |
+| indexing_technique | string | `high_quality` uses embedding models for precise search; `economy` uses keyword-based indexing. | No |
+| name | string | Name of the knowledge base. | Yes |
+| permission | [PermissionEnum](#permissionenum) | Controls who can access this knowledge base. `only_me` restricts access to the creator, `all_team_members` grants workspace-wide access, and `partial_members` grants access to specified members. | No |
+| provider | string, <br>**Available values:** "external", "vendor", <br>**Default:** vendor | Knowledge base provider: `vendor` for internal knowledge bases, `external` for external ones.<br>*Enum:* `"external"`, `"vendor"` | No |
+| retrieval_model | [RetrievalModel](#retrievalmodel) | Retrieval model configuration. Controls how chunks are searched and ranked. | No |
+| summary_index_setting | object | Summary index configuration. | No |
 
 #### DatasetDetailResponse
 
@@ -2205,8 +2701,10 @@ Enum class for custom configuration status.
 | indexing_technique | string |  | Yes |
 | is_multimodal | boolean |  | Yes |
 | is_published | boolean |  | Yes |
+| maintainer | string |  | No |
 | name | string |  | Yes |
 | permission | string |  | Yes |
+| permission_keys | [ string ] |  | No |
 | pipeline_id | string |  | Yes |
 | provider | string |  | Yes |
 | retrieval_model_dict | [DatasetRetrievalModelResponse](#datasetretrievalmodelresponse) |  | Yes |
@@ -2245,9 +2743,11 @@ Enum class for custom configuration status.
 | indexing_technique | string |  | Yes |
 | is_multimodal | boolean |  | Yes |
 | is_published | boolean |  | Yes |
+| maintainer | string |  | No |
 | name | string |  | Yes |
 | partial_member_list | [ string ] |  | No |
 | permission | string |  | Yes |
+| permission_keys | [ string ] |  | No |
 | pipeline_id | string |  | Yes |
 | provider | string |  | Yes |
 | retrieval_model_dict | [DatasetRetrievalModelResponse](#datasetretrievalmodelresponse) |  | Yes |
@@ -2304,11 +2804,11 @@ Enum class for custom configuration status.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| include_all | boolean | Include all datasets | No |
-| keyword | string | Search keyword | No |
-| limit | integer, <br>**Default:** 20 | Number of items per page | No |
-| page | integer, <br>**Default:** 1 | Page number | No |
-| tag_ids | [ string ] | Filter by tag IDs | No |
+| include_all | boolean | Whether to include all knowledge bases regardless of permissions. | No |
+| keyword | string | Search keyword to filter by name. | No |
+| limit | integer, <br>**Default:** 20 | Number of items per page. Server caps at `100`. | No |
+| page | integer, <br>**Default:** 1 | Page number to retrieve. | No |
+| tag_ids | [ string ] | Tag IDs to filter by. | No |
 
 #### DatasetListResponse
 
@@ -2404,17 +2904,17 @@ Enum class for custom configuration status.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| description | string | Dataset description (max 400 chars) | No |
-| embedding_model | string |  | No |
-| embedding_model_provider | string |  | No |
-| external_knowledge_api_id | string |  | No |
-| external_knowledge_id | string |  | No |
-| external_retrieval_model | object |  | No |
-| indexing_technique | string |  | No |
-| name | string |  | No |
-| partial_member_list | [ object ] |  | No |
-| permission | [PermissionEnum](#permissionenum) |  | No |
-| retrieval_model | [RetrievalModel](#retrievalmodel) |  | No |
+| description | string | Description of the knowledge base. | No |
+| embedding_model | string | Embedding model name. Use the `model` field from [Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`. | No |
+| embedding_model_provider | string | Embedding model provider. Use the `provider` field from [Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`. | No |
+| external_knowledge_api_id | string | ID of the external knowledge API. | No |
+| external_knowledge_id | string | ID of the external knowledge base. | No |
+| external_retrieval_model | object | Retrieval settings for external knowledge bases. | No |
+| indexing_technique | string | `high_quality` uses embedding models for precise search; `economy` uses keyword-based indexing. | No |
+| name | string | Name of the knowledge base. | No |
+| partial_member_list | [ object ] | List of team members with access when `permission` is `partial_members`. | No |
+| permission | [PermissionEnum](#permissionenum) | Controls who can access this knowledge base. `only_me` restricts access to the creator, `all_team_members` grants workspace-wide access, and `partial_members` grants access to specified members. | No |
+| retrieval_model | [RetrievalModel](#retrievalmodel) | Retrieval model configuration. Controls how chunks are searched and ranked. | No |
 
 #### DatasetVectorSettingResponse
 
@@ -2445,10 +2945,10 @@ Enum class for custom configuration status.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| credential_id | string |  | No |
-| datasource_type | string |  | Yes |
-| inputs | object |  | Yes |
-| is_published | boolean |  | Yes |
+| credential_id | string | Datasource credential ID. Uses the default if omitted. | No |
+| datasource_type | string, <br>**Available values:** "local_file", "online_document", "online_drive", "website_crawl" | Type of the datasource.<br>*Enum:* `"local_file"`, `"online_document"`, `"online_drive"`, `"website_crawl"` | Yes |
+| inputs | object | Input variables for the datasource node. | Yes |
+| is_published | boolean | Whether to run the published or draft version of the node. `true` runs the published version, `false` runs the draft. | Yes |
 
 #### DatasourcePluginListResponse
 
@@ -2472,7 +2972,7 @@ Enum class for custom configuration status.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| is_published | boolean, <br>**Default:** true |  | No |
+| is_published | boolean, <br>**Default:** true | Whether to retrieve nodes from the published or draft pipeline. `true` returns nodes from the published version, `false` returns nodes from the draft. | No |
 
 #### DocumentAndBatchResponse
 
@@ -2487,7 +2987,7 @@ Request payload for bulk downloading documents as a zip archive.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| document_ids | [ string (uuid) ] |  | Yes |
+| document_ids | [ string (uuid) ] | List of document IDs to include in the ZIP download. | Yes |
 
 #### DocumentDetailResponse
 
@@ -2529,16 +3029,16 @@ Request payload for bulk downloading documents as a zip archive.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| metadata | string, <br>**Available values:** "all", "only", "without", <br>**Default:** all | Metadata response mode<br>*Enum:* `"all"`, `"only"`, `"without"` | No |
+| metadata | string, <br>**Available values:** "all", "only", "without", <br>**Default:** all | `all` returns all fields including metadata. `only` returns only `id`, `doc_type`, and `doc_metadata`. `without` returns all fields except `doc_metadata`.<br>*Enum:* `"all"`, `"only"`, `"without"` | No |
 
 #### DocumentListQuery
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| keyword | string | Search keyword | No |
-| limit | integer, <br>**Default:** 20 | Number of items per page | No |
-| page | integer, <br>**Default:** 1 | Page number | No |
-| status | string | Document status filter | No |
+| keyword | string | Search keyword to filter by document name. | No |
+| limit | integer, <br>**Default:** 20 | Number of items per page. Server caps at `100`. | No |
+| page | integer, <br>**Default:** 1 | Page number to retrieve. | No |
+| status | string | Filter by display status. | No |
 
 #### DocumentListResponse
 
@@ -2554,9 +3054,9 @@ Request payload for bulk downloading documents as a zip archive.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| document_id | string |  | Yes |
-| metadata_list | [ [MetadataDetail](#metadatadetail) ] |  | Yes |
-| partial_update | boolean |  | No |
+| document_id | string | Document ID whose metadata should be updated. | Yes |
+| metadata_list | [ [MetadataDetail](#metadatadetail) ] | Metadata fields to update. | Yes |
+| partial_update | boolean | Whether to partially update metadata, keeping existing values for unspecified fields. | No |
 
 #### DocumentMetadataResponse
 
@@ -2606,7 +3106,7 @@ Request payload for bulk downloading documents as a zip archive.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| document_ids | [ string ] | Document IDs to update | No |
+| document_ids | [ string ] | List of document IDs to update. | No |
 
 #### DocumentStatusResponse
 
@@ -2629,27 +3129,27 @@ Request payload for bulk downloading documents as a zip archive.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| doc_form | string, <br>**Default:** text_model |  | No |
-| doc_language | string, <br>**Default:** English |  | No |
-| embedding_model | string |  | No |
-| embedding_model_provider | string |  | No |
-| indexing_technique | string |  | No |
-| name | string |  | Yes |
-| original_document_id | string |  | No |
-| process_rule | [ProcessRule](#processrule) |  | No |
-| retrieval_model | [RetrievalModel](#retrievalmodel) |  | No |
-| text | string |  | Yes |
+| doc_form | string, <br>**Available values:** "hierarchical_model", "qa_model", "text_model", <br>**Default:** text_model | `text_model` for standard text chunking, `hierarchical_model` for parent-child chunk structure, `qa_model` for question-answer pair extraction.<br>*Enum:* `"hierarchical_model"`, `"qa_model"`, `"text_model"` | No |
+| doc_language | string, <br>**Default:** English | Language of the document for processing optimization. | No |
+| embedding_model | string | Embedding model name. Use the `model` field from [Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`. | No |
+| embedding_model_provider | string | Embedding model provider. Use the `provider` field from [Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`. | No |
+| indexing_technique | string | `high_quality` uses embedding models for precise search; `economy` uses keyword-based indexing. Required when adding the first document to a knowledge base; subsequent documents inherit the knowledge base's indexing technique if omitted. | No |
+| name | string | Document name. | Yes |
+| original_document_id | string | Original document ID for replacement. | No |
+| process_rule | [ProcessRule](#processrule) | Processing rules for chunking. | No |
+| retrieval_model | [RetrievalModel](#retrievalmodel) | Retrieval model configuration. Controls how chunks are searched and ranked. | No |
+| text | string | Document text content. | Yes |
 
 #### DocumentTextUpdate
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| doc_form | string, <br>**Default:** text_model |  | No |
-| doc_language | string, <br>**Default:** English |  | No |
-| name | string |  | No |
-| process_rule | [ProcessRule](#processrule) |  | No |
-| retrieval_model | [RetrievalModel](#retrievalmodel) |  | No |
-| text | string |  | No |
+| doc_form | string, <br>**Available values:** "hierarchical_model", "qa_model", "text_model", <br>**Default:** text_model | `text_model` for standard text chunking, `hierarchical_model` for parent-child chunk structure, `qa_model` for question-answer pair extraction.<br>*Enum:* `"hierarchical_model"`, `"qa_model"`, `"text_model"` | No |
+| doc_language | string, <br>**Default:** English | Language of the document for processing optimization. | No |
+| name | string | Document name. Required when `text` is provided. | No |
+| process_rule | [ProcessRule](#processrule) | Processing rules for chunking. | No |
+| retrieval_model | [RetrievalModel](#retrievalmodel) | Retrieval model configuration. Controls how chunks are searched and ranked. | No |
+| text | string | Document text content. | No |
 
 #### EndUserDetail
 
@@ -2688,8 +3188,8 @@ Note: The SQLAlchemy model defines an `is_anonymous` property for Flask-Login se
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| limit | integer, <br>**Default:** 20 | Number of feedbacks per page | No |
-| page | integer, <br>**Default:** 1 | Page number | No |
+| limit | integer, <br>**Default:** 20 | Number of records per page. | No |
+| page | integer, <br>**Default:** 1 | Page number for pagination. | No |
 
 #### FetchFrom
 
@@ -2724,7 +3224,7 @@ Enum class for fetch from.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| as_attachment | boolean | Download as attachment | No |
+| as_attachment | boolean | If `true`, forces the file to download as an attachment instead of previewing in browser. | No |
 
 #### FileResponse
 
@@ -2804,10 +3304,10 @@ Enum class for fetch from.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| attachment_ids | [ string ] |  | No |
-| external_retrieval_model | object |  | No |
-| query | string |  | Yes |
-| retrieval_model | [RetrievalModel](#retrievalmodel) |  | No |
+| attachment_ids | [ string ] | List of attachment IDs to include in the retrieval context. | No |
+| external_retrieval_model | object | Retrieval settings for external knowledge bases. | No |
+| query | string | Search query text. | Yes |
+| retrieval_model | [RetrievalModel](#retrievalmodel) | Retrieval model configuration. Controls how chunks are searched and ranked. | No |
 
 #### HitTestingQuery
 
@@ -2911,9 +3411,17 @@ Enum class for fetch from.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| action | string |  | Yes |
+| action | string | ID of the action button the recipient selected. Must match one of the `id` values from the form's `user_actions` list. | Yes |
 | inputs | object | Submitted human input values keyed by output variable name. Use a string for paragraph or select input values, a file mapping for file inputs, and a list of file mappings for file-list inputs. Local file mappings use `transfer_method=local_file` with `upload_file_id`; remote file mappings use `transfer_method=remote_url` with `url` or `remote_url`. | Yes |
 
+#### HumanInputFormSubmitPayloadWithUser
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| action | string | ID of the action button the recipient selected. Must match one of the `id` values from the form's `user_actions` list. | Yes |
+| inputs | object | Submitted human input values keyed by output variable name. Use a string for paragraph or select input values, a file mapping for file inputs, and a list of file mappings for file-list inputs. Local file mappings use `transfer_method=local_file` with `upload_file_id`; remote file mappings use `transfer_method=remote_url` with `url` or `remote_url`. | Yes |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | Yes |
+
 #### HumanInputFormSubmitResponse
 
 | Name | Type | Description | Required |
@@ -2979,8 +3487,16 @@ Model class for i18n object.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| content | string |  | No |
-| rating | string |  | No |
+| content | string | Optional text feedback providing additional detail. | No |
+| rating | string | Feedback rating. Set to `null` to revoke previously submitted feedback. | No |
+
+#### MessageFeedbackPayloadWithUser
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string | Optional text feedback providing additional detail. | No |
+| rating | string | Feedback rating. Set to `null` to revoke previously submitted feedback. | No |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | Yes |
 
 #### MessageFile
 
@@ -3027,24 +3543,24 @@ Model class for i18n object.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| conversation_id | string | Conversation UUID | Yes |
-| first_id | string | First message ID for pagination | No |
-| limit | integer, <br>**Default:** 20 | Number of messages to return (1-100) | No |
+| conversation_id | string | Conversation ID. | Yes |
+| first_id | string | The ID of the first chat record on the current page. Omit this value to fetch the latest messages; for subsequent pages, use the first message ID from the current list to fetch older messages. | No |
+| limit | integer, <br>**Default:** 20 | Number of chat history messages to return per request. | No |
 
 #### MetadataArgs
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| name | string |  | Yes |
-| type | string, <br>**Available values:** "number", "string", "time" | *Enum:* `"number"`, `"string"`, `"time"` | Yes |
+| name | string | Metadata field name. | Yes |
+| type | string, <br>**Available values:** "number", "string", "time" | `string` for text values, `number` for numeric values, `time` for date/time values.<br>*Enum:* `"number"`, `"string"`, `"time"` | Yes |
 
 #### MetadataDetail
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| id | string |  | Yes |
-| name | string |  | Yes |
-| value | string<br>integer<br>number |  | No |
+| id | string | Metadata field ID. | Yes |
+| name | string | Metadata field name. | Yes |
+| value | string<br>integer<br>number | Metadata value. Can be a string, number, or `null`. | No |
 
 #### MetadataFilteringCondition
 
@@ -3052,8 +3568,8 @@ Metadata Filtering Condition.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| conditions | [ [Condition](#condition) ] |  | No |
-| logical_operator | string |  | No |
+| conditions | [ [Condition](#condition) ] | List of metadata conditions to evaluate. | No |
+| logical_operator | string | How to combine multiple conditions. | No |
 
 #### MetadataOperationData
 
@@ -3061,13 +3577,13 @@ Metadata operation data
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| operation_data | [ [DocumentMetadataOperation](#documentmetadataoperation) ] |  | Yes |
+| operation_data | [ [DocumentMetadataOperation](#documentmetadataoperation) ] | Array of document metadata update operations. Each entry maps a document ID to its metadata values. | Yes |
 
 #### MetadataUpdatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| name | string |  | Yes |
+| name | string | New metadata field name. | Yes |
 
 #### ModelFeature
 
@@ -3101,6 +3617,12 @@ Enum class for model type.
 | ---- | ---- | ----------- | -------- |
 | ModelType | string | Enum class for model type. |  |
 
+#### OptionalServiceApiUserPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | No |
+
 #### ParagraphInputConfig
 
 Form input definition.
@@ -3140,12 +3662,12 @@ Shared permission levels for resources (datasets, credentials, etc.)
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| datasource_info_list | [ object ] |  | Yes |
-| datasource_type | string |  | Yes |
-| inputs | object |  | Yes |
-| is_published | boolean |  | Yes |
-| response_mode | string |  | Yes |
-| start_node_id | string |  | Yes |
+| datasource_info_list | [  ] | List of datasource objects to process. The expected item structure depends on `datasource_type`. | Yes |
+| datasource_type | string, <br>**Available values:** "local_file", "online_document", "online_drive", "website_crawl" | Type of the datasource. Determines which fields are expected in `datasource_info_list` items.<br>*Enum:* `"local_file"`, `"online_document"`, `"online_drive"`, `"website_crawl"` | Yes |
+| inputs | object | Key-value pairs for pipeline input variables defined in the workflow. Pass `{}` if the pipeline has no input variables. | Yes |
+| is_published | boolean | Whether to run the published or draft version of the pipeline. `true` runs the latest published version; `false` runs the current draft (useful for testing unpublished changes). | Yes |
+| response_mode | string, <br>**Available values:** "blocking", "streaming" | Response mode. Use `streaming` for SSE or `blocking` for JSON.<br>*Enum:* `"blocking"`, `"streaming"` | Yes |
+| start_node_id | string | ID of the datasource node where the run starts. | Yes |
 
 #### PipelineUploadFileResponse
 
@@ -3163,15 +3685,15 @@ Shared permission levels for resources (datasets, credentials, etc.)
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| enabled | boolean |  | Yes |
-| id | string |  | Yes |
+| enabled | boolean | Whether this preprocessing rule is enabled. | Yes |
+| id | string, <br>**Available values:** "remove_extra_spaces", "remove_stopwords", "remove_urls_emails" | Rule identifier.<br>*Enum:* `"remove_extra_spaces"`, `"remove_stopwords"`, `"remove_urls_emails"` | Yes |
 
 #### ProcessRule
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| mode | [ProcessRuleMode](#processrulemode) |  | Yes |
-| rules | [Rule](#rule) |  | No |
+| mode | [ProcessRuleMode](#processrulemode) | Processing mode. `automatic` uses built-in rules, `custom` allows manual configuration, and `hierarchical` enables parent-child chunk structure for `doc_form: hierarchical_model`. | Yes |
+| rules | [Rule](#rule) | Custom processing rules. | No |
 
 #### ProcessRuleMode
 
@@ -3218,12 +3740,18 @@ Model class for provider with models response.
 | status | [CustomConfigurationStatus](#customconfigurationstatus) |  | Yes |
 | tenant_id | string |  | Yes |
 
+#### RequiredServiceApiUserPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | Yes |
+
 #### RerankingModel
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| reranking_model_name | string |  | No |
-| reranking_provider_name | string |  | No |
+| reranking_model_name | string | Name of the reranking model. | No |
+| reranking_provider_name | string | Provider name of the reranking model. | No |
 
 #### ResultResponse
 
@@ -3241,15 +3769,15 @@ Model class for provider with models response.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| metadata_filtering_conditions | [MetadataFilteringCondition](#metadatafilteringcondition) |  | No |
-| reranking_enable | boolean |  | Yes |
-| reranking_mode | string |  | No |
-| reranking_model | [RerankingModel](#rerankingmodel) |  | No |
-| score_threshold | number |  | No |
-| score_threshold_enabled | boolean |  | Yes |
-| search_method | [RetrievalMethod](#retrievalmethod) |  | Yes |
-| top_k | integer |  | Yes |
-| weights | [WeightModel](#weightmodel) |  | No |
+| metadata_filtering_conditions | [MetadataFilteringCondition](#metadatafilteringcondition) | Restrict retrieval to chunks whose document metadata matches the given conditions. Conditions are evaluated server-side against document metadata fields. | No |
+| reranking_enable | boolean | Whether reranking is enabled. | Yes |
+| reranking_mode | string | Reranking mode. Required when `reranking_enable` is `true`. | No |
+| reranking_model | [RerankingModel](#rerankingmodel) | Reranking model configuration. | No |
+| score_threshold | number | Minimum similarity score for results. Only effective when score threshold filtering is enabled. | No |
+| score_threshold_enabled | boolean | Whether score threshold filtering is enabled. | Yes |
+| search_method | [RetrievalMethod](#retrievalmethod) | Search method used for retrieval. | Yes |
+| top_k | integer | Maximum number of results to return. | Yes |
+| weights | [WeightModel](#weightmodel) | Weight configuration for hybrid search. | No |
 
 #### RetrieverResource
 
@@ -3277,10 +3805,10 @@ Model class for provider with models response.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| parent_mode | string |  | No |
-| pre_processing_rules | [ [PreProcessingRule](#preprocessingrule) ] |  | No |
-| segmentation | [Segmentation](#segmentation) |  | No |
-| subchunk_segmentation | [Segmentation](#segmentation) |  | No |
+| parent_mode | string | Parent-child segmentation mode. | No |
+| pre_processing_rules | [ [PreProcessingRule](#preprocessingrule) ] | Pre-processing rules to apply before segmentation. | No |
+| segmentation | [Segmentation](#segmentation) | Parent chunk segmentation settings. | No |
+| subchunk_segmentation | [Segmentation](#segmentation) | Child chunk segmentation settings. | No |
 
 #### SegmentAttachmentResponse
 
@@ -3297,10 +3825,10 @@ Model class for provider with models response.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| answer | string |  | No |
-| attachment_ids | [ string ] |  | No |
-| content | string |  | Yes |
-| keywords | [ string ] |  | No |
+| answer | string | Answer content for QA mode. | No |
+| attachment_ids | [ string ] | Attachment file IDs. | No |
+| content | string | Chunk text content. | Yes |
+| keywords | [ string ] | Keywords for the chunk. | No |
 
 #### SegmentCreateListResponse
 
@@ -3313,7 +3841,7 @@ Model class for provider with models response.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| segments | [ [SegmentCreateItemPayload](#segmentcreateitempayload) ] |  | Yes |
+| segments | [ [SegmentCreateItemPayload](#segmentcreateitempayload) ] | Array of chunk objects to create. | Yes |
 
 #### SegmentDetailResponse
 
@@ -3326,10 +3854,10 @@ Model class for provider with models response.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| keyword | string |  | No |
-| limit | integer, <br>**Default:** 20 |  | No |
-| page | integer, <br>**Default:** 1 |  | No |
-| status | [ string ] |  | No |
+| keyword | string | Search keyword. | No |
+| limit | integer, <br>**Default:** 20 | Number of items per page. Server caps at `100`. | No |
+| page | integer, <br>**Default:** 1 | Page number to retrieve. | No |
+| status | [ string ] | Filter chunks by indexing status, such as `completed`, `indexing`, or `error`. | No |
 
 #### SegmentListResponse
 
@@ -3378,28 +3906,28 @@ Model class for provider with models response.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| answer | string |  | No |
-| attachment_ids | [ string ] |  | No |
-| content | string |  | No |
-| enabled | boolean |  | No |
-| keywords | [ string ] |  | No |
-| regenerate_child_chunks | boolean |  | No |
-| summary | string |  | No |
+| answer | string | Updated answer content for QA mode. | No |
+| attachment_ids | [ string ] | Attachment file IDs. | No |
+| content | string | Updated chunk text content. | No |
+| enabled | boolean | Whether the chunk is enabled. | No |
+| keywords | [ string ] | Updated keywords for the chunk. | No |
+| regenerate_child_chunks | boolean | Whether to regenerate child chunks after updating a parent chunk. | No |
+| summary | string | Summary content for summary index. | No |
 
 #### SegmentUpdatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| segment | [SegmentUpdateArgs](#segmentupdateargs) |  | Yes |
+| segment | [SegmentUpdateArgs](#segmentupdateargs) | Chunk update payload. | Yes |
 
 #### Segmentation
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| chunk_overlap | integer |  | No |
-| max_tokens | integer |  | Yes |
-| separator | string, <br>**Default:** 
- |  | No |
+| chunk_overlap | integer | Token overlap between chunks. | No |
+| max_tokens | integer | Maximum token count per chunk. | Yes |
+| separator | string, <br>**Default:**
+ | Custom separator for splitting text. | No |
 
 #### SelectInputConfig
 
@@ -3508,46 +4036,54 @@ Default configuration for form inputs.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| tag_ids | [ string ] |  | Yes |
-| target_id | string |  | Yes |
+| tag_ids | [ string ] | Tag IDs to bind. | Yes |
+| target_id | string | Knowledge base ID to bind the tags to. | Yes |
 
 #### TagCreatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| name | string |  | Yes |
+| name | string | Tag name. | Yes |
 
 #### TagDeletePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| tag_id | string |  | Yes |
+| tag_id | string | Tag ID to delete. | Yes |
 
 #### TagUnbindingPayload
 
-Accept the legacy single-tag Service API payload while exposing a normalized tag_ids list internally.
+Accepts either the legacy tag_id payload or the normalized tag_ids payload.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| tag_id | string |  | No |
-| tag_ids | [ string ] |  | No |
-| target_id | string |  | Yes |
+| TagUnbindingPayload | object<br>object | Accepts either the legacy tag_id payload or the normalized tag_ids payload. |  |
 
 #### TagUpdatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| name | string |  | Yes |
-| tag_id | string |  | Yes |
+| name | string | Tag name. | Yes |
+| tag_id | string | Tag ID to update. | Yes |
 
 #### TextToAudioPayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| message_id | string | Message ID | No |
-| streaming | boolean | Enable streaming response | No |
-| text | string | Text to convert to audio | No |
-| voice | string | Voice to use for TTS | No |
+| message_id | string | Message ID. Takes priority over `text` when both are provided. | No |
+| streaming | boolean | Reserved for compatibility; TTS response streaming is determined by the provider output. | No |
+| text | string | Speech content to convert. | No |
+| voice | string | Voice to use for text-to-speech. Available voices depend on the TTS provider configured for this app. Omit to use the app's configured voice when available; that value is exposed by [Get App Parameters](/api-reference/applications/get-app-parameters) as `text_to_speech.voice`. | No |
+
+#### TextToAudioPayloadWithUser
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| message_id | string | Message ID. Takes priority over `text` when both are provided. | No |
+| streaming | boolean | Reserved for compatibility; TTS response streaming is determined by the provider output. | No |
+| text | string | Speech content to convert. | No |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | No |
+| voice | string | Voice to use for text-to-speech. Available voices depend on the TTS provider configured for this app. Omit to use the app's configured voice when available; that value is exposed by [Get App Parameters](/api-reference/applications/get-app-parameters) as `text_to_speech.voice`. | No |
 
 #### UrlResponse
 
@@ -3578,23 +4114,23 @@ in form definiton, or a variable while the workflow is running.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| keyword_weight | number |  | Yes |
+| keyword_weight | number | Weight assigned to keyword search results. | Yes |
 
 #### WeightModel
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| keyword_setting | [WeightKeywordSetting](#weightkeywordsetting) |  | No |
-| vector_setting | [WeightVectorSetting](#weightvectorsetting) |  | No |
-| weight_type | string |  | No |
+| keyword_setting | [WeightKeywordSetting](#weightkeywordsetting) | Keyword search weight settings. | No |
+| vector_setting | [WeightVectorSetting](#weightvectorsetting) | Semantic search weight settings. | No |
+| weight_type | string | Strategy for balancing semantic and keyword search weights. | No |
 
 #### WeightVectorSetting
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| embedding_model_name | string |  | Yes |
-| embedding_provider_name | string |  | Yes |
-| vector_weight | number |  | Yes |
+| embedding_model_name | string | Name of the embedding model used for vector search. | Yes |
+| embedding_provider_name | string | Provider of the embedding model used for vector search. | Yes |
+| vector_weight | number | Weight assigned to semantic vector search results. | Yes |
 
 #### WorkflowAppLogPaginationResponse
 
@@ -3623,22 +4159,22 @@ in form definiton, or a variable while the workflow is running.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| continue_on_pause | boolean | Keep the stream open across workflow_paused events | No |
-| include_state_snapshot | boolean | Replay from persisted state snapshot | No |
-| user | string | End user identifier | Yes |
+| continue_on_pause | boolean | Set to `true` to keep the stream open across multiple `workflow_paused` events, which is useful when the workflow has more than one Human Input node in sequence. By default, the stream closes after the first pause. | No |
+| include_state_snapshot | boolean | When `true`, replay from the persisted state snapshot to include a status summary of already-executed nodes before streaming new events. | No |
+| user | string | End-user identifier that originally triggered the run. Must match the creator of the run. | Yes |
 
 #### WorkflowLogQuery
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| created_at__after | string |  | No |
-| created_at__before | string |  | No |
-| created_by_account | string |  | No |
-| created_by_end_user_session_id | string |  | No |
-| keyword | string |  | No |
-| limit | integer, <br>**Default:** 20 |  | No |
-| page | integer, <br>**Default:** 1 |  | No |
-| status | string |  | No |
+| created_at__after | string | Filter logs created after this ISO 8601 timestamp. | No |
+| created_at__before | string | Filter logs created before this ISO 8601 timestamp. | No |
+| created_by_account | string | Filter by account ID. | No |
+| created_by_end_user_session_id | string | Filter by end user session ID. | No |
+| keyword | string | Keyword to search in logs. | No |
+| limit | integer, <br>**Default:** 20 | Number of items per page. | No |
+| page | integer, <br>**Default:** 1 | Page number for pagination. | No |
+| status | string | Filter by execution status. | No |
 
 #### WorkflowRunForLogResponse
 
@@ -3660,10 +4196,18 @@ in form definiton, or a variable while the workflow is running.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| files | [ object ] |  | No |
-| inputs | object |  | Yes |
-| response_mode | string |  | No |
-| trace_session_id | string | Trace session ID for observability grouping | No |
+| files | [ object ] | File list for workflow system file inputs. Available when file upload is enabled for the workflow. To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned `id` as `upload_file_id` with `transfer_method: local_file`. | No |
+| inputs | object | Key-value pairs for workflow input variables. Values for file-type variables should be arrays of file objects with `type`, `transfer_method`, and either `url` or `upload_file_id`. Refer to the `user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) response to discover the variable names and types expected by your app. | Yes |
+| response_mode | string | Response mode. Use `blocking` for synchronous responses or `streaming` for Server-Sent Events. When omitted, the request runs in blocking mode. | No |
+
+#### WorkflowRunPayloadWithUser
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| files | [ object ] | File list for workflow system file inputs. Available when file upload is enabled for the workflow. To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned `id` as `upload_file_id` with `transfer_method: local_file`. | No |
+| inputs | object | Key-value pairs for workflow input variables. Values for file-type variables should be arrays of file objects with `type`, `transfer_method`, and either `url` or `upload_file_id`. Refer to the `user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) response to discover the variable names and types expected by your app. | Yes |
+| response_mode | string | Response mode. Use `blocking` for synchronous responses or `streaming` for Server-Sent Events. When omitted, the request runs in blocking mode. | No |
+| user | string | User identifier, unique within the application. This identifier scopes data access; resources created with one `user` value are only visible when queried with the same `user` value. | Yes |
 
 #### WorkflowRunResponse
 
diff --git a/api/openapi/markdown/web-openapi.md b/api/openapi/markdown/web-openapi.md
index 302c2a55e43..569e3706caa 100644
--- a/api/openapi/markdown/web-openapi.md
+++ b/api/openapi/markdown/web-openapi.md
@@ -4,10 +4,9 @@ Public APIs for web applications including file uploads, chat interactions, and
 ## Version: 1.0
 
 ### Available authorizations
-#### Bearer (API Key Authentication)
-Type: Bearer {your-api-key}  
-**Name:** Authorization  
-**In:** header  
+#### Bearer (HTTP, bearer)
+Use the Service API key as a Bearer token in the Authorization header.
+Bearer format: API_KEY
 
 ---
 ## web
@@ -140,7 +139,7 @@ Delete a specific conversation.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path | Conversation UUID | Yes | string |
+| c_id | path | Conversation UUID | Yes | string (uuid) |
 
 #### Responses
 
@@ -160,7 +159,7 @@ Rename a specific conversation with a custom name or auto-generate one.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path | Conversation UUID | Yes | string |
+| c_id | path | Conversation UUID | Yes | string (uuid) |
 | auto_generate | query | Auto-generate conversation name | No | boolean |
 | name | query | New conversation name | No | string |
 
@@ -188,7 +187,7 @@ Pin a specific conversation to keep it at the top of the list.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path | Conversation UUID | Yes | string |
+| c_id | path | Conversation UUID | Yes | string (uuid) |
 
 #### Responses
 
@@ -208,7 +207,7 @@ Unpin a specific conversation to remove it from the top of the list.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| c_id | path | Conversation UUID | Yes | string |
+| c_id | path | Conversation UUID | Yes | string (uuid) |
 
 #### Responses
 
@@ -472,9 +471,9 @@ Retrieve paginated list of messages from a conversation in a chat application.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| conversation_id | query | Conversation UUID | Yes | string |
-| first_id | query | First message ID for pagination | No | string |
-| limit | query | Number of messages to return (1-100) | No | integer, <br>**Default:** 20 |
+| conversation_id | query | Conversation ID. | Yes | string |
+| first_id | query | The ID of the first chat record on the current page. Omit this value to fetch the latest messages; for subsequent pages, use the first message ID from the current list to fetch older messages. | No | string |
+| limit | query | Number of chat history messages to return per request. | No | integer, <br>**Default:** 20 |
 
 #### Responses
 
@@ -494,7 +493,7 @@ Submit feedback (like/dislike) for a specific message.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| message_id | path | Message UUID | Yes | string |
+| message_id | path | Message UUID | Yes | string (uuid) |
 | content | query | Feedback content | No | string |
 | rating | query | Feedback rating | No | string, <br>**Available values:** "dislike", "like" |
 
@@ -523,7 +522,7 @@ Generate a new completion similar to an existing message (completion apps only).
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | response_mode | query | Response mode | Yes | string, <br>**Available values:** "blocking", "streaming" |
-| message_id | path |  | Yes | string |
+| message_id | path |  | Yes | string (uuid) |
 
 #### Responses
 
@@ -543,7 +542,7 @@ Get suggested follow-up questions after a message (chat apps only).
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| message_id | path | Message UUID | Yes | string |
+| message_id | path | Message UUID | Yes | string (uuid) |
 
 #### Responses
 
@@ -731,7 +730,7 @@ Remove a message from saved messages.
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| message_id | path | Message UUID to delete | Yes | string |
+| message_id | path | Message UUID to delete | Yes | string (uuid) |
 
 #### Responses
 
@@ -1092,8 +1091,8 @@ Button styles for user actions.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| auto_generate | boolean |  | No |
-| name | string |  | No |
+| auto_generate | boolean | Automatically generate the conversation name. When `true`, the `name` field is ignored. | No |
+| name | string | Conversation name. Required when `auto_generate` is `false`. | No |
 
 #### EmailCodeLoginSendPayload
 
@@ -1282,7 +1281,7 @@ Parsed multipart form fields for HITL uploads.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| action | string |  | Yes |
+| action | string | ID of the action button the recipient selected. Must match one of the `id` values from the form's `user_actions` list. | Yes |
 | inputs | object | Submitted human input values keyed by output variable name. Use a string for paragraph or select input values, a file mapping for file inputs, and a list of file mappings for file-list inputs. Local file mappings use `transfer_method=local_file` with `upload_file_id`; remote file mappings use `transfer_method=remote_url` with `url` or `remote_url`. | Yes |
 
 #### HumanInputFormSubmitResponse
@@ -1372,8 +1371,8 @@ Parsed multipart form fields for HITL uploads.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| content | string |  | No |
-| rating | string |  | No |
+| content | string | Optional text feedback providing additional detail. | No |
+| rating | string | Feedback rating. Set to `null` to revoke previously submitted feedback. | No |
 
 #### MessageFile
 
@@ -1393,9 +1392,9 @@ Parsed multipart form fields for HITL uploads.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| conversation_id | string | Conversation UUID | Yes |
-| first_id | string | First message ID for pagination | No |
-| limit | integer, <br>**Default:** 20 | Number of messages to return (1-100) | No |
+| conversation_id | string | Conversation ID. | Yes |
+| first_id | string | The ID of the first chat record on the current page. Omit this value to fetch the latest messages; for subsequent pages, use the first message ID from the current list to fetch older messages. | No |
+| limit | integer, <br>**Default:** 20 | Number of chat history messages to return per request. | No |
 
 #### MessageMoreLikeThisQuery
 
@@ -1597,6 +1596,7 @@ Default configuration for form inputs.
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | branding | [BrandingModel](#brandingmodel) |  | Yes |
+| enable_app_deploy | boolean |  | Yes |
 | enable_change_email | boolean, <br>**Default:** true |  | Yes |
 | enable_collaboration_mode | boolean, <br>**Default:** true |  | Yes |
 | enable_creators_platform | boolean |  | Yes |
@@ -1613,6 +1613,7 @@ Default configuration for form inputs.
 | max_plugin_package_size | integer, <br>**Default:** 15728640 |  | Yes |
 | plugin_installation_permission | [PluginInstallationPermissionModel](#plugininstallationpermissionmodel) |  | Yes |
 | plugin_manager | [PluginManagerModel](#pluginmanagermodel) |  | Yes |
+| rbac_enabled | boolean |  | Yes |
 | sso_enforced_for_signin | boolean |  | Yes |
 | sso_enforced_for_signin_protocol | string |  | Yes |
 | webapp_auth | [WebAppAuthModel](#webappauthmodel) |  | Yes |
@@ -1631,10 +1632,10 @@ Default configuration for form inputs.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| message_id | string | Message ID | No |
-| streaming | boolean | Enable streaming response | No |
-| text | string | Text to convert to audio | No |
-| voice | string | Voice to use for TTS | No |
+| message_id | string | Message ID. Takes priority over `text` when both are provided. | No |
+| streaming | boolean | Reserved for compatibility; TTS response streaming is determined by the provider output. | No |
+| text | string | Speech content to convert. | No |
+| voice | string | Voice to use for text-to-speech. Available voices depend on the TTS provider configured for this app. Omit to use the app's configured voice when available; that value is exposed by [Get App Parameters](/api-reference/applications/get-app-parameters) as `text_to_speech.voice`. | No |
 
 #### UserActionConfig
 
@@ -1711,5 +1712,5 @@ in form definiton, or a variable while the workflow is running.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| files | [ object ] |  | No |
-| inputs | object |  | Yes |
+| files | [ object ] | File list for workflow system file inputs. Available when file upload is enabled for the workflow. To attach a local file, first upload it via [Upload File](/api-reference/files/upload-file) and use the returned `id` as `upload_file_id` with `transfer_method: local_file`. | No |
+| inputs | object | Key-value pairs for workflow input variables. Values for file-type variables should be arrays of file objects with `type`, `transfer_method`, and either `url` or `upload_file_id`. Refer to the `user_input_form` field in the [Get App Parameters](/api-reference/applications/get-app-parameters) response to discover the variable names and types expected by your app. | Yes |
diff --git a/api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/data_exporter/test_traceclient.py b/api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/data_exporter/test_traceclient.py
index ac09060e9d4..12f91212c1f 100644
--- a/api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/data_exporter/test_traceclient.py
+++ b/api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/data_exporter/test_traceclient.py
@@ -42,7 +42,9 @@ def trace_client_factory():
 class TestTraceClient:
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
     @patch("dify_trace_aliyun.data_exporter.traceclient.socket.gethostname")
-    def test_init(self, mock_gethostname, mock_exporter_class, trace_client_factory):
+    def test_init(
+        self, mock_gethostname: MagicMock, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]
+    ):
         mock_gethostname.return_value = "test-host"
         client = trace_client_factory(service_name="test-service", endpoint="http://test-endpoint")
 
@@ -56,7 +58,7 @@ class TestTraceClient:
         assert client.done is True
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_export(self, mock_exporter_class, trace_client_factory):
+    def test_export(self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]):
         mock_exporter = mock_exporter_class.return_value
         client = trace_client_factory(service_name="test-service", endpoint="http://test-endpoint")
         spans = [MagicMock(spec=ReadableSpan)]
@@ -65,7 +67,9 @@ class TestTraceClient:
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.httpx.head")
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_api_check_success(self, mock_exporter_class, mock_head, trace_client_factory):
+    def test_api_check_success(
+        self, mock_exporter_class: MagicMock, mock_head: MagicMock, trace_client_factory: type[TraceClient]
+    ):
         mock_response = MagicMock()
         mock_response.status_code = 405
         mock_head.return_value = mock_response
@@ -75,7 +79,9 @@ class TestTraceClient:
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.httpx.head")
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_api_check_failure_status(self, mock_exporter_class, mock_head, trace_client_factory):
+    def test_api_check_failure_status(
+        self, mock_exporter_class: MagicMock, mock_head: MagicMock, trace_client_factory: type[TraceClient]
+    ):
         mock_response = MagicMock()
         mock_response.status_code = 500
         mock_head.return_value = mock_response
@@ -85,7 +91,9 @@ class TestTraceClient:
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.httpx.head")
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_api_check_exception(self, mock_exporter_class, mock_head, trace_client_factory):
+    def test_api_check_exception(
+        self, mock_exporter_class: MagicMock, mock_head: MagicMock, trace_client_factory: type[TraceClient]
+    ):
         mock_head.side_effect = httpx.RequestError("Connection error")
 
         client = trace_client_factory(service_name="test-service", endpoint="http://test-endpoint")
@@ -93,12 +101,12 @@ class TestTraceClient:
             client.api_check()
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_get_project_url(self, mock_exporter_class, trace_client_factory):
+    def test_get_project_url(self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]):
         client = trace_client_factory(service_name="test-service", endpoint="http://test-endpoint")
         assert client.get_project_url() == "https://arms.console.aliyun.com/#/llm"
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_add_span(self, mock_exporter_class, trace_client_factory):
+    def test_add_span(self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]):
         client = trace_client_factory(
             service_name="test-service",
             endpoint="http://test-endpoint",
@@ -135,7 +143,9 @@ class TestTraceClient:
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
     @patch("dify_trace_aliyun.data_exporter.traceclient.logger")
-    def test_add_span_queue_full(self, mock_logger, mock_exporter_class, trace_client_factory):
+    def test_add_span_queue_full(
+        self, mock_logger: MagicMock, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]
+    ):
         client = trace_client_factory(service_name="test-service", endpoint="http://test-endpoint", max_queue_size=1)
 
         span_data = SpanData(
@@ -159,7 +169,7 @@ class TestTraceClient:
         mock_logger.warning.assert_called_with("Queue is full, likely spans will be dropped.")
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_export_batch_error(self, mock_exporter_class, trace_client_factory):
+    def test_export_batch_error(self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]):
         mock_exporter = mock_exporter_class.return_value
         mock_exporter.export.side_effect = Exception("Export failed")
 
@@ -172,13 +182,13 @@ class TestTraceClient:
             mock_logger.warning.assert_called()
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_worker_loop(self, mock_exporter_class, trace_client_factory):
+    def test_worker_loop(self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]):
         # We need to test the wait timeout in _worker
         # But _worker runs in a thread. Let's mock condition.wait.
         client = trace_client_factory(
             service_name="test-service",
             endpoint="http://test-endpoint",
-            schedule_delay_sec=0.1,
+            schedule_delay_sec=1,
         )
 
         with patch.object(client.condition, "wait") as mock_wait:
@@ -189,7 +199,7 @@ class TestTraceClient:
             assert mock_wait.called or client.done
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_shutdown_flushes(self, mock_exporter_class, trace_client_factory):
+    def test_shutdown_flushes(self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]):
         mock_exporter = mock_exporter_class.return_value
         client = trace_client_factory(service_name="test-service", endpoint="http://test-endpoint")
 
diff --git a/api/providers/trace/trace-arize-phoenix/src/dify_trace_arize_phoenix/arize_phoenix_trace.py b/api/providers/trace/trace-arize-phoenix/src/dify_trace_arize_phoenix/arize_phoenix_trace.py
index 0f24adfd92e..9f779fc43de 100644
--- a/api/providers/trace/trace-arize-phoenix/src/dify_trace_arize_phoenix/arize_phoenix_trace.py
+++ b/api/providers/trace/trace-arize-phoenix/src/dify_trace_arize_phoenix/arize_phoenix_trace.py
@@ -1150,13 +1150,14 @@ class ArizePhoenixDataTrace(BaseTraceInstance):
         try:
             # Convert outputs to string based on type
             outputs_mime_type = OpenInferenceMimeTypeValues.TEXT.value
-            if isinstance(trace_info.outputs, dict | list):
-                outputs_str = safe_json_dumps(trace_info.outputs)
-                outputs_mime_type = OpenInferenceMimeTypeValues.JSON.value
-            elif isinstance(trace_info.outputs, str):
-                outputs_str = trace_info.outputs
-            else:
-                outputs_str = str(trace_info.outputs)
+            match trace_info.outputs:
+                case dict() | list():
+                    outputs_str = safe_json_dumps(trace_info.outputs)
+                    outputs_mime_type = OpenInferenceMimeTypeValues.JSON.value
+                case str():
+                    outputs_str = trace_info.outputs
+                case _:
+                    outputs_str = str(trace_info.outputs)
 
             llm_attributes: dict[str, Any] = {
                 SpanAttributes.OPENINFERENCE_SPAN_KIND: OpenInferenceSpanKindValues.LLM.value,
@@ -1553,25 +1554,26 @@ class ArizePhoenixDataTrace(BaseTraceInstance):
             set_attribute(f"{base_path}.{ToolCallAttributes.TOOL_CALL_ID}", call_id)
 
         # Handle list of messages
-        if isinstance(prompts, list):
-            for message_index, message in enumerate(prompts):
-                if not isinstance(message, dict):
-                    continue
+        match prompts:
+            case list():
+                for message_index, message in enumerate(prompts):
+                    if not isinstance(message, dict):
+                        continue
 
-                role = message.get("role", "user")
-                content = message.get("text") or message.get("content") or ""
+                    role = message.get("role", "user")
+                    content = message.get("text") or message.get("content") or ""
 
-                set_message_attribute(message_index, MessageAttributes.MESSAGE_ROLE, role)
-                set_message_attribute(message_index, MessageAttributes.MESSAGE_CONTENT, content)
+                    set_message_attribute(message_index, MessageAttributes.MESSAGE_ROLE, role)
+                    set_message_attribute(message_index, MessageAttributes.MESSAGE_CONTENT, content)
 
-                tool_calls = message.get("tool_calls") or []
-                if isinstance(tool_calls, list):
-                    for tool_index, tool_call in enumerate(tool_calls):
-                        set_tool_call_attributes(message_index, tool_index, tool_call)
+                    tool_calls = message.get("tool_calls") or []
+                    if isinstance(tool_calls, list):
+                        for tool_index, tool_call in enumerate(tool_calls):
+                            set_tool_call_attributes(message_index, tool_index, tool_call)
 
-        # Handle single dict or plain string prompt
-        elif isinstance(prompts, (dict, str)):
-            set_message_attribute(0, MessageAttributes.MESSAGE_CONTENT, prompts)
-            set_message_attribute(0, MessageAttributes.MESSAGE_ROLE, "user")
+            # Handle single dict or plain string prompt
+            case dict() | str():
+                set_message_attribute(0, MessageAttributes.MESSAGE_CONTENT, prompts)
+                set_message_attribute(0, MessageAttributes.MESSAGE_ROLE, "user")
 
         return attributes
diff --git a/api/providers/trace/trace-arize-phoenix/tests/unit_tests/arize_phoenix_trace/test_arize_phoenix_trace.py b/api/providers/trace/trace-arize-phoenix/tests/unit_tests/arize_phoenix_trace/test_arize_phoenix_trace.py
index 0c2ead2bccc..9e3cac2255b 100644
--- a/api/providers/trace/trace-arize-phoenix/tests/unit_tests/arize_phoenix_trace/test_arize_phoenix_trace.py
+++ b/api/providers/trace/trace-arize-phoenix/tests/unit_tests/arize_phoenix_trace/test_arize_phoenix_trace.py
@@ -456,7 +456,7 @@ class TestPhoenixParentSpanBridgeHelpers:
         assert error.parent_node_execution_id == "outer-node-execution-1"
         assert "outer-node-execution-1" in str(error)
 
-    def test_resolve_parent_span_context_rejects_payload_without_traceparent(self, monkeypatch):
+    def test_resolve_parent_span_context_rejects_payload_without_traceparent(self, monkeypatch: pytest.MonkeyPatch):
         mock_redis = MagicMock()
         mock_redis.get.return_value = '{"tracestate": "vendor=value"}'
         monkeypatch.setattr(arize_phoenix_trace_module, "redis_client", mock_redis)
diff --git a/api/providers/trace/trace-langfuse/src/dify_trace_langfuse/entities/langfuse_trace_entity.py b/api/providers/trace/trace-langfuse/src/dify_trace_langfuse/entities/langfuse_trace_entity.py
index 76755bf7693..742938f09f4 100644
--- a/api/providers/trace/trace-langfuse/src/dify_trace_langfuse/entities/langfuse_trace_entity.py
+++ b/api/providers/trace/trace-langfuse/src/dify_trace_langfuse/entities/langfuse_trace_entity.py
@@ -18,24 +18,25 @@ def validate_input_output(v, field_name):
     """
     if v == {} or v is None:
         return v
-    if isinstance(v, str):
-        return [
-            {
-                "role": "assistant" if field_name == "output" else "user",
-                "content": v,
-            }
-        ]
-    elif isinstance(v, list):
-        if len(v) > 0 and isinstance(v[0], dict):
-            v = replace_text_with_content(data=v)
-            return v
-        else:
+    match v:
+        case str():
             return [
                 {
                     "role": "assistant" if field_name == "output" else "user",
-                    "content": str(v),
+                    "content": v,
                 }
             ]
+        case list():
+            if len(v) > 0 and isinstance(v[0], dict):
+                v = replace_text_with_content(data=v)
+                return v
+            else:
+                return [
+                    {
+                        "role": "assistant" if field_name == "output" else "user",
+                        "content": str(v),
+                    }
+                ]
 
     return v
 
diff --git a/api/providers/trace/trace-langfuse/tests/unit_tests/langfuse_trace/test_langfuse_trace.py b/api/providers/trace/trace-langfuse/tests/unit_tests/langfuse_trace/test_langfuse_trace.py
index 3bac908deb8..8da2dc9fa0d 100644
--- a/api/providers/trace/trace-langfuse/tests/unit_tests/langfuse_trace/test_langfuse_trace.py
+++ b/api/providers/trace/trace-langfuse/tests/unit_tests/langfuse_trace/test_langfuse_trace.py
@@ -709,7 +709,9 @@ def test_langfuse_trace_entity_with_list_dict_input():
     assert data.input[0]["content"] == "hello"
 
 
-def test_workflow_trace_handles_usage_extraction_error(trace_instance, monkeypatch: pytest.MonkeyPatch, caplog):
+def test_workflow_trace_handles_usage_extraction_error(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+):
     # Setup trace info to trigger LLM node usage extraction
     trace_info = WorkflowTraceInfo(
         workflow_id="wf-1",
diff --git a/api/providers/trace/trace-langsmith/src/dify_trace_langsmith/entities/langsmith_trace_entity.py b/api/providers/trace/trace-langsmith/src/dify_trace_langsmith/entities/langsmith_trace_entity.py
index be9d64ae018..07159d8a7e3 100644
--- a/api/providers/trace/trace-langsmith/src/dify_trace_langsmith/entities/langsmith_trace_entity.py
+++ b/api/providers/trace/trace-langsmith/src/dify_trace_langsmith/entities/langsmith_trace_entity.py
@@ -64,40 +64,20 @@ class LangSmithRunModel(LangSmithTokenUsage, LangSmithMultiModel):
             "total_tokens": values.get("total_tokens", 0),
         }
         file_list = values.get("file_list", [])
-        if isinstance(v, str):
-            match field_name:
-                case "inputs":
-                    return {
-                        "messages": {
-                            "role": "user",
-                            "content": v,
-                            "usage_metadata": usage_metadata,
-                            "file_list": file_list,
-                        },
-                    }
-                case "outputs":
-                    return {
-                        "choices": {
-                            "role": "ai",
-                            "content": v,
-                            "usage_metadata": usage_metadata,
-                            "file_list": file_list,
-                        },
-                    }
-                case _:
-                    pass
-        elif isinstance(v, list):
-            data = {}
-            if len(v) > 0 and isinstance(v[0], dict):
-                # rename text to content
-                v = replace_text_with_content(data=v)
+        match v:
+            case str():
                 match field_name:
                     case "inputs":
-                        data = {
-                            "messages": v,
+                        return {
+                            "messages": {
+                                "role": "user",
+                                "content": v,
+                                "usage_metadata": usage_metadata,
+                                "file_list": file_list,
+                            },
                         }
                     case "outputs":
-                        data = {
+                        return {
                             "choices": {
                                 "role": "ai",
                                 "content": v,
@@ -107,16 +87,37 @@ class LangSmithRunModel(LangSmithTokenUsage, LangSmithMultiModel):
                         }
                     case _:
                         pass
-                return data
-            else:
-                return {
-                    "choices": {
-                        "role": "ai" if field_name == "outputs" else "user",
-                        "content": str(v),
-                        "usage_metadata": usage_metadata,
-                        "file_list": file_list,
-                    },
-                }
+            case list():
+                data = {}
+                if len(v) > 0 and isinstance(v[0], dict):
+                    # rename text to content
+                    v = replace_text_with_content(data=v)
+                    match field_name:
+                        case "inputs":
+                            data = {
+                                "messages": v,
+                            }
+                        case "outputs":
+                            data = {
+                                "choices": {
+                                    "role": "ai",
+                                    "content": v,
+                                    "usage_metadata": usage_metadata,
+                                    "file_list": file_list,
+                                },
+                            }
+                        case _:
+                            pass
+                    return data
+                else:
+                    return {
+                        "choices": {
+                            "role": "ai" if field_name == "outputs" else "user",
+                            "content": str(v),
+                            "usage_metadata": usage_metadata,
+                            "file_list": file_list,
+                        },
+                    }
         if isinstance(v, dict):
             v["usage_metadata"] = usage_metadata
             v["file_list"] = file_list
diff --git a/api/providers/trace/trace-langsmith/tests/unit_tests/langsmith_trace/test_langsmith_trace.py b/api/providers/trace/trace-langsmith/tests/unit_tests/langsmith_trace/test_langsmith_trace.py
index 8336f8f51f8..76d4c99caf7 100644
--- a/api/providers/trace/trace-langsmith/tests/unit_tests/langsmith_trace/test_langsmith_trace.py
+++ b/api/providers/trace/trace-langsmith/tests/unit_tests/langsmith_trace/test_langsmith_trace.py
@@ -521,7 +521,9 @@ def test_update_run_error(trace_instance):
         trace_instance.update_run(update_data)
 
 
-def test_workflow_trace_usage_extraction_error(trace_instance, monkeypatch: pytest.MonkeyPatch, caplog):
+def test_workflow_trace_usage_extraction_error(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+):
     workflow_data = MagicMock()
     workflow_data.created_at = _dt()
     workflow_data.finished_at = _dt() + timedelta(seconds=1)
@@ -654,7 +656,7 @@ def _patch_workflow_trace_deps(monkeypatch, trace_instance):
     trace_instance.add_run = MagicMock()
 
 
-def test_workflow_trace_id_uses_message_id_not_external(trace_instance, monkeypatch):
+def test_workflow_trace_id_uses_message_id_not_external(trace_instance, monkeypatch: pytest.MonkeyPatch):
     """Chatflow with external trace_id: LangSmith trace_id must be message_id, not external."""
     trace_info = _make_workflow_trace_info(
         message_id="msg-abc",
@@ -675,7 +677,7 @@ def test_workflow_trace_id_uses_message_id_not_external(trace_instance, monkeypa
     assert trace_info.metadata.get("external_trace_id") == "external-999"
 
 
-def test_workflow_trace_id_pure_workflow_uses_run_id(trace_instance, monkeypatch):
+def test_workflow_trace_id_pure_workflow_uses_run_id(trace_instance, monkeypatch: pytest.MonkeyPatch):
     """Pure workflow (no message_id) with external trace_id: trace_id must be workflow_run_id."""
     trace_info = _make_workflow_trace_info(
         message_id=None,
diff --git a/api/providers/trace/trace-opik/tests/unit_tests/opik_trace/test_opik_trace.py b/api/providers/trace/trace-opik/tests/unit_tests/opik_trace/test_opik_trace.py
index 3f1fef2c7dc..ab20a783748 100644
--- a/api/providers/trace/trace-opik/tests/unit_tests/opik_trace/test_opik_trace.py
+++ b/api/providers/trace/trace-opik/tests/unit_tests/opik_trace/test_opik_trace.py
@@ -615,7 +615,9 @@ def test_get_project_url_error(trace_instance):
         trace_instance.get_project_url()
 
 
-def test_workflow_trace_usage_extraction_error_fixed(trace_instance, monkeypatch: pytest.MonkeyPatch, caplog):
+def test_workflow_trace_usage_extraction_error_fixed(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+):
     trace_info = WorkflowTraceInfo(
         workflow_id="86a52565-4a6b-4a1b-9bfd-98e4595e70de",
         tenant_id="66e8e918-472e-4b69-8051-12502c34fc07",
diff --git a/api/providers/trace/trace-weave/src/dify_trace_weave/entities/weave_trace_entity.py b/api/providers/trace/trace-weave/src/dify_trace_weave/entities/weave_trace_entity.py
index ed6a7dabbb0..98180c80a2c 100644
--- a/api/providers/trace/trace-weave/src/dify_trace_weave/entities/weave_trace_entity.py
+++ b/api/providers/trace/trace-weave/src/dify_trace_weave/entities/weave_trace_entity.py
@@ -40,41 +40,19 @@ class WeaveTraceModel(WeaveTokenUsage, WeaveMultiModel):
             "total_tokens": values.get("total_tokens", 0),
         }
         file_list = values.get("file_list", [])
-        if isinstance(v, str):
-            if field_name == "inputs":
-                return {
-                    "messages": {
-                        "role": "user",
-                        "content": v,
-                        "usage_metadata": usage_metadata,
-                        "file_list": file_list,
-                    },
-                }
-            elif field_name == "outputs":
-                return {
-                    "choices": {
-                        "role": "ai",
-                        "content": v,
-                        "usage_metadata": usage_metadata,
-                        "file_list": file_list,
-                    },
-                }
-        elif isinstance(v, list):
-            data = {}
-            if len(v) > 0 and isinstance(v[0], dict):
-                # rename text to content
-                v = replace_text_with_content(data=v)
+        match v:
+            case str():
                 if field_name == "inputs":
-                    data = {
-                        "messages": [
-                            dict(msg, **{"usage_metadata": usage_metadata, "file_list": file_list})  # type: ignore
-                            for msg in v
-                        ]
-                        if isinstance(v, list)
-                        else v,
+                    return {
+                        "messages": {
+                            "role": "user",
+                            "content": v,
+                            "usage_metadata": usage_metadata,
+                            "file_list": file_list,
+                        },
                     }
                 elif field_name == "outputs":
-                    data = {
+                    return {
                         "choices": {
                             "role": "ai",
                             "content": v,
@@ -82,16 +60,39 @@ class WeaveTraceModel(WeaveTokenUsage, WeaveMultiModel):
                             "file_list": file_list,
                         },
                     }
-                return data
-            else:
-                return {
-                    "choices": {
-                        "role": "ai" if field_name == "outputs" else "user",
-                        "content": str(v),
-                        "usage_metadata": usage_metadata,
-                        "file_list": file_list,
-                    },
-                }
+            case list():
+                data = {}
+                if len(v) > 0 and isinstance(v[0], dict):
+                    # rename text to content
+                    v = replace_text_with_content(data=v)
+                    if field_name == "inputs":
+                        data = {
+                            "messages": [
+                                dict(msg, **{"usage_metadata": usage_metadata, "file_list": file_list})  # type: ignore
+                                for msg in v
+                            ]
+                            if isinstance(v, list)
+                            else v,
+                        }
+                    elif field_name == "outputs":
+                        data = {
+                            "choices": {
+                                "role": "ai",
+                                "content": v,
+                                "usage_metadata": usage_metadata,
+                                "file_list": file_list,
+                            },
+                        }
+                    return data
+                else:
+                    return {
+                        "choices": {
+                            "role": "ai" if field_name == "outputs" else "user",
+                            "content": str(v),
+                            "usage_metadata": usage_metadata,
+                            "file_list": file_list,
+                        },
+                    }
         if isinstance(v, dict):
             v["usage_metadata"] = usage_metadata
             v["file_list"] = file_list
diff --git a/api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py b/api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py
index 6231b9a9fad..6e80c6efa2c 100644
--- a/api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py
+++ b/api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py
@@ -361,12 +361,13 @@ class ClickzettaVector(BaseVector):
                 first_pass = json.loads(raw_metadata)
 
                 # Handle double-encoded JSON
-                if isinstance(first_pass, str):
-                    metadata = parse_metadata_json(first_pass)
-                elif isinstance(first_pass, dict):
-                    metadata = first_pass
-                else:
-                    metadata = {}
+                match first_pass:
+                    case str():
+                        metadata = parse_metadata_json(first_pass)
+                    case dict():
+                        metadata = first_pass
+                    case _:
+                        metadata = {}
             else:
                 metadata = {}
         except (json.JSONDecodeError, ValueError, TypeError):
@@ -942,12 +943,13 @@ class ClickzettaVector(BaseVector):
                                 # First parse may yield a string (double-encoded JSON)
                                 first_pass = json.loads(row[2])
 
-                                if isinstance(first_pass, str):
-                                    metadata = parse_metadata_json(first_pass)
-                                elif isinstance(first_pass, dict):
-                                    metadata = first_pass
-                                else:
-                                    metadata = {}
+                                match first_pass:
+                                    case str():
+                                        metadata = parse_metadata_json(first_pass)
+                                    case dict():
+                                        metadata = first_pass
+                                    case _:
+                                        metadata = {}
                             else:
                                 metadata = {}
                         except (json.JSONDecodeError, ValueError, TypeError):
diff --git a/api/providers/vdb/vdb-hologres/tests/integration_tests/conftest.py b/api/providers/vdb/vdb-hologres/tests/integration_tests/conftest.py
index d28ded01873..290eda67e94 100644
--- a/api/providers/vdb/vdb-hologres/tests/integration_tests/conftest.py
+++ b/api/providers/vdb/vdb-hologres/tests/integration_tests/conftest.py
@@ -98,14 +98,15 @@ def _extract_identifiers_and_literals(query) -> list[Any]:
     values: list[Any] = []
     if isinstance(query, psql.Composed):
         for part in query:
-            if isinstance(part, psql.Identifier):
-                values.append(("ident", part._obj[0] if part._obj else ""))
-            elif isinstance(part, psql.Literal):
-                values.append(("literal", part._obj))
-            elif isinstance(part, psql.Composed):
-                for sub in part:
-                    if isinstance(sub, psql.Literal):
-                        values.append(("literal", sub._obj))
+            match part:
+                case psql.Identifier():
+                    values.append(("ident", part._obj[0] if part._obj else ""))
+                case psql.Literal():
+                    values.append(("literal", part._obj))
+                case psql.Composed():
+                    for sub in part:
+                        if isinstance(sub, psql.Literal):
+                            values.append(("literal", sub._obj))
     return values
 
 
diff --git a/api/pyproject.toml b/api/pyproject.toml
index 8e4ebe4112e..17efcef9db0 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -44,7 +44,7 @@ dependencies = [
     "resend>=2.27.0,<3.0.0",
     # Emerging: newer and fast-moving, use compatible pins
     "fastopenapi[flask]==0.7.0",
-    "graphon==0.5.1",
+    "graphon==0.5.2",
     "httpx-sse==0.4.3",
     "json-repair==0.59.4",
 ]
diff --git a/api/repositories/api_workflow_run_repository.py b/api/repositories/api_workflow_run_repository.py
index 72b38e79068..2659e550552 100644
--- a/api/repositories/api_workflow_run_repository.py
+++ b/api/repositories/api_workflow_run_repository.py
@@ -35,6 +35,7 @@ Example:
 """
 
 from collections.abc import Callable, Sequence
+from dataclasses import dataclass
 from datetime import datetime
 from typing import Protocol, TypedDict
 
@@ -65,6 +66,21 @@ class RunsWithRelatedCountsDict(TypedDict):
     pause_reasons: int
 
 
+@dataclass(frozen=True)
+class WorkflowRunCleanupRef:
+    """
+    Lightweight workflow run reference for retention cleanup scans.
+
+    Cleanup jobs use this DTO when they only need cursor, tenant eligibility, and run-id deletion data. Keeping the
+    query shape explicit prevents free-plan cleanup from hydrating full WorkflowRun models for rows that may be skipped
+    after billing checks.
+    """
+
+    id: str
+    tenant_id: str
+    created_at: datetime
+
+
 class APIWorkflowRunRepository(WorkflowExecutionRepository, Protocol):
     """
     Protocol for service-layer WorkflowRun repository operations.
@@ -286,6 +302,36 @@ class APIWorkflowRunRepository(WorkflowExecutionRepository, Protocol):
         """
         ...
 
+    def get_cleanup_refs_batch_by_time_range(
+        self,
+        start_from: datetime | None,
+        end_before: datetime,
+        last_seen: tuple[datetime, str] | None,
+        batch_size: int,
+        run_types: Sequence[WorkflowType] | None = None,
+        tenant_ids: Sequence[str] | None = None,
+        workflow_ids: Sequence[str] | None = None,
+        upper_bound: tuple[datetime, str] | None = None,
+    ) -> Sequence[WorkflowRunCleanupRef]:
+        """
+        Fetch lightweight ended workflow run refs in a time window for cleanup batching.
+
+        Args:
+            start_from: Optional inclusive lower time boundary.
+            end_before: Exclusive upper time boundary.
+            last_seen: Optional exclusive `(created_at, id)` cursor lower bound.
+            batch_size: Maximum number of refs to return.
+            run_types: Optional workflow type filter.
+            tenant_ids: Optional tenant filter.
+            workflow_ids: Optional workflow ID filter.
+            upper_bound: Optional inclusive `(created_at, id)` cursor upper bound. Cleanup uses this for a second,
+                tenant-filtered target query that must stay within the candidate page high-water cursor.
+
+        Returns:
+            Ordered lightweight cleanup refs containing only id, tenant_id, and created_at.
+        """
+        ...
+
     def get_archived_run_ids(
         self,
         session: Session,
@@ -370,6 +416,19 @@ class APIWorkflowRunRepository(WorkflowExecutionRepository, Protocol):
         """
         ...
 
+    def delete_runs_with_related_by_ids(
+        self,
+        run_ids: Sequence[str],
+        delete_node_executions: Callable[[Session, Sequence[str]], tuple[int, int]] | None = None,
+        delete_trigger_logs: Callable[[Session, Sequence[str]], int] | None = None,
+    ) -> RunsWithRelatedCountsDict:
+        """
+        Delete workflow runs and cleanup-owned related records by workflow run IDs.
+
+        This mirrors delete_runs_with_related() for cleanup callers that do not need full WorkflowRun models.
+        """
+        ...
+
     def get_app_logs_by_run_id(
         self,
         session: Session,
@@ -417,6 +476,19 @@ class APIWorkflowRunRepository(WorkflowExecutionRepository, Protocol):
         """
         ...
 
+    def count_runs_with_related_by_ids(
+        self,
+        run_ids: Sequence[str],
+        count_node_executions: Callable[[Session, Sequence[str]], tuple[int, int]] | None = None,
+        count_trigger_logs: Callable[[Session, Sequence[str]], int] | None = None,
+    ) -> RunsWithRelatedCountsDict:
+        """
+        Count workflow runs and cleanup-owned related records by workflow run IDs.
+
+        This mirrors count_runs_with_related() for dry-run cleanup callers that do not need full WorkflowRun models.
+        """
+        ...
+
     def create_workflow_pause(
         self,
         workflow_run_id: str,
diff --git a/api/repositories/sqlalchemy_api_workflow_run_repository.py b/api/repositories/sqlalchemy_api_workflow_run_repository.py
index cbc9d03e5eb..b40eb4bdd8a 100644
--- a/api/repositories/sqlalchemy_api_workflow_run_repository.py
+++ b/api/repositories/sqlalchemy_api_workflow_run_repository.py
@@ -44,7 +44,11 @@ from libs.time_parser import get_time_threshold
 from models.enums import WorkflowRunTriggeredFrom
 from models.human_input import HumanInputForm, HumanInputFormRecipient
 from models.workflow import WorkflowAppLog, WorkflowArchiveLog, WorkflowPause, WorkflowPauseReason, WorkflowRun
-from repositories.api_workflow_run_repository import APIWorkflowRunRepository, RunsWithRelatedCountsDict
+from repositories.api_workflow_run_repository import (
+    APIWorkflowRunRepository,
+    RunsWithRelatedCountsDict,
+    WorkflowRunCleanupRef,
+)
 from repositories.entities.workflow_pause import WorkflowPauseEntity
 from repositories.types import (
     AverageInteractionStats,
@@ -420,6 +424,71 @@ class DifyAPISQLAlchemyWorkflowRunRepository(APIWorkflowRunRepository):
 
             return session.scalars(stmt).all()
 
+    @override
+    def get_cleanup_refs_batch_by_time_range(
+        self,
+        start_from: datetime | None,
+        end_before: datetime,
+        last_seen: tuple[datetime, str] | None,
+        batch_size: int,
+        run_types: Sequence[WorkflowType] | None = None,
+        tenant_ids: Sequence[str] | None = None,
+        workflow_ids: Sequence[str] | None = None,
+        upper_bound: tuple[datetime, str] | None = None,
+    ) -> Sequence[WorkflowRunCleanupRef]:
+        """
+        Fetch lightweight ended workflow run refs in a time window for cleanup batching.
+
+        The optional upper_bound is inclusive and is paired with last_seen by free-plan cleanup so a second,
+        tenant-filtered target query stays within the candidate page already checked against billing.
+        """
+        with self._session_maker() as session:
+            stmt = (
+                select(WorkflowRun.id, WorkflowRun.tenant_id, WorkflowRun.created_at)
+                .where(
+                    WorkflowRun.created_at < end_before,
+                    WorkflowRun.status.in_(WorkflowExecutionStatus.ended_values()),
+                )
+                .order_by(WorkflowRun.created_at.asc(), WorkflowRun.id.asc())
+                .limit(batch_size)
+            )
+            if run_types is not None:
+                if not run_types:
+                    return []
+                stmt = stmt.where(WorkflowRun.type.in_(run_types))
+
+            if start_from:
+                stmt = stmt.where(WorkflowRun.created_at >= start_from)
+
+            if tenant_ids:
+                stmt = stmt.where(WorkflowRun.tenant_id.in_(tenant_ids))
+
+            if workflow_ids:
+                stmt = stmt.where(WorkflowRun.workflow_id.in_(workflow_ids))
+
+            if last_seen:
+                stmt = stmt.where(
+                    tuple_(WorkflowRun.created_at, WorkflowRun.id)
+                    > tuple_(
+                        sa.literal(last_seen[0], type_=sa.DateTime()),
+                        sa.literal(last_seen[1], type_=WorkflowRun.id.type),
+                    )
+                )
+
+            if upper_bound:
+                stmt = stmt.where(
+                    tuple_(WorkflowRun.created_at, WorkflowRun.id)
+                    <= tuple_(
+                        sa.literal(upper_bound[0], type_=sa.DateTime()),
+                        sa.literal(upper_bound[1], type_=WorkflowRun.id.type),
+                    )
+                )
+
+            return [
+                WorkflowRunCleanupRef(id=run_id, tenant_id=tenant_id, created_at=created_at)
+                for run_id, tenant_id, created_at in session.execute(stmt).all()
+            ]
+
     @override
     def get_archived_run_ids(
         self,
@@ -530,6 +599,56 @@ class DifyAPISQLAlchemyWorkflowRunRepository(APIWorkflowRunRepository):
                 "pause_reasons": pause_reasons_deleted,
             }
 
+    @override
+    def delete_runs_with_related_by_ids(
+        self,
+        run_ids: Sequence[str],
+        delete_node_executions: Callable[[Session, Sequence[str]], tuple[int, int]] | None = None,
+        delete_trigger_logs: Callable[[Session, Sequence[str]], int] | None = None,
+    ) -> RunsWithRelatedCountsDict:
+        if not run_ids:
+            return self._empty_runs_with_related_counts()
+
+        run_ids = list(run_ids)
+        with self._session_maker() as session:
+            if delete_node_executions:
+                node_executions_deleted, offloads_deleted = delete_node_executions(session, run_ids)
+            else:
+                node_executions_deleted, offloads_deleted = 0, 0
+
+            app_logs_result = session.execute(delete(WorkflowAppLog).where(WorkflowAppLog.workflow_run_id.in_(run_ids)))
+            app_logs_deleted = cast(CursorResult, app_logs_result).rowcount or 0
+
+            pause_stmt = select(WorkflowPause.id).where(WorkflowPause.workflow_run_id.in_(run_ids))
+            pause_ids = session.scalars(pause_stmt).all()
+            pause_reasons_deleted = 0
+            pauses_deleted = 0
+
+            if pause_ids:
+                pause_reasons_result = session.execute(
+                    delete(WorkflowPauseReason).where(WorkflowPauseReason.pause_id.in_(pause_ids))
+                )
+                pause_reasons_deleted = cast(CursorResult, pause_reasons_result).rowcount or 0
+                pauses_result = session.execute(delete(WorkflowPause).where(WorkflowPause.id.in_(pause_ids)))
+                pauses_deleted = cast(CursorResult, pauses_result).rowcount or 0
+
+            trigger_logs_deleted = delete_trigger_logs(session, run_ids) if delete_trigger_logs else 0
+
+            runs_result = session.execute(delete(WorkflowRun).where(WorkflowRun.id.in_(run_ids)))
+            runs_deleted = cast(CursorResult, runs_result).rowcount or 0
+
+            session.commit()
+
+            return {
+                "runs": runs_deleted,
+                "node_executions": node_executions_deleted,
+                "offloads": offloads_deleted,
+                "app_logs": app_logs_deleted,
+                "trigger_logs": trigger_logs_deleted,
+                "pauses": pauses_deleted,
+                "pause_reasons": pause_reasons_deleted,
+            }
+
     @override
     def get_app_logs_by_run_id(
         self,
@@ -711,6 +830,72 @@ class DifyAPISQLAlchemyWorkflowRunRepository(APIWorkflowRunRepository):
                 "pause_reasons": int(pause_reasons_count),
             }
 
+    @override
+    def count_runs_with_related_by_ids(
+        self,
+        run_ids: Sequence[str],
+        count_node_executions: Callable[[Session, Sequence[str]], tuple[int, int]] | None = None,
+        count_trigger_logs: Callable[[Session, Sequence[str]], int] | None = None,
+    ) -> RunsWithRelatedCountsDict:
+        if not run_ids:
+            return self._empty_runs_with_related_counts()
+
+        run_ids = list(run_ids)
+        with self._session_maker() as session:
+            if count_node_executions:
+                node_executions_count, offloads_count = count_node_executions(session, run_ids)
+            else:
+                node_executions_count, offloads_count = 0, 0
+
+            runs_count = (
+                session.scalar(select(func.count()).select_from(WorkflowRun).where(WorkflowRun.id.in_(run_ids))) or 0
+            )
+            app_logs_count = (
+                session.scalar(
+                    select(func.count()).select_from(WorkflowAppLog).where(WorkflowAppLog.workflow_run_id.in_(run_ids))
+                )
+                or 0
+            )
+
+            pause_ids = session.scalars(
+                select(WorkflowPause.id).where(WorkflowPause.workflow_run_id.in_(run_ids))
+            ).all()
+            pauses_count = len(pause_ids)
+            pause_reasons_count = 0
+            if pause_ids:
+                pause_reasons_count = (
+                    session.scalar(
+                        select(func.count())
+                        .select_from(WorkflowPauseReason)
+                        .where(WorkflowPauseReason.pause_id.in_(pause_ids))
+                    )
+                    or 0
+                )
+
+            trigger_logs_count = count_trigger_logs(session, run_ids) if count_trigger_logs else 0
+
+            return {
+                "runs": int(runs_count),
+                "node_executions": node_executions_count,
+                "offloads": offloads_count,
+                "app_logs": int(app_logs_count),
+                "trigger_logs": trigger_logs_count,
+                "pauses": pauses_count,
+                "pause_reasons": int(pause_reasons_count),
+            }
+
+    @staticmethod
+    def _empty_runs_with_related_counts() -> RunsWithRelatedCountsDict:
+        return {
+            "runs": 0,
+            "node_executions": 0,
+            "offloads": 0,
+            "app_logs": 0,
+            "trigger_logs": 0,
+            "pauses": 0,
+            "pause_reasons": 0,
+        }
+
     @override
     def create_workflow_pause(
         self,
@@ -772,21 +957,22 @@ class DifyAPISQLAlchemyWorkflowRunRepository(APIWorkflowRunRepository):
             )
             pause_reason_models = []
             for reason in pause_reasons:
-                if isinstance(reason, HumanInputRequired):
-                    # TODO(QuantumGhost): record node_id for `WorkflowPauseReason`
-                    pause_reason_model = WorkflowPauseReason(
-                        pause_id=pause_model.id,
-                        type_=reason.TYPE,
-                        form_id=reason.form_id,
-                    )
-                elif isinstance(reason, SchedulingPause):
-                    pause_reason_model = WorkflowPauseReason(
-                        pause_id=pause_model.id,
-                        type_=reason.TYPE,
-                        message=reason.message,
-                    )
-                else:
-                    raise AssertionError(f"unkown reason type: {type(reason)}")
+                match reason:
+                    case HumanInputRequired():
+                        # TODO(QuantumGhost): record node_id for `WorkflowPauseReason`
+                        pause_reason_model = WorkflowPauseReason(
+                            pause_id=pause_model.id,
+                            type_=reason.TYPE,
+                            form_id=reason.form_id,
+                        )
+                    case SchedulingPause():
+                        pause_reason_model = WorkflowPauseReason(
+                            pause_id=pause_model.id,
+                            type_=reason.TYPE,
+                            message=reason.message,
+                        )
+                    case _:
+                        raise AssertionError(f"unknown reason type: {type(reason)}")
 
                 pause_reason_models.append(pause_reason_model)
 
diff --git a/api/services/account_service.py b/api/services/account_service.py
index e39d13a3929..21b5f1eedba 100644
--- a/api/services/account_service.py
+++ b/api/services/account_service.py
@@ -5,26 +5,16 @@ import secrets
 import uuid
 from datetime import UTC, datetime, timedelta
 from hashlib import sha256
-from typing import Any, TypedDict, cast
+from typing import Any, NotRequired, TypedDict, cast
 
 from pydantic import BaseModel, TypeAdapter, ValidationError
 from sqlalchemy import Row, delete, func, select, update
 from sqlalchemy.orm import Session, scoped_session
-
-from core.db.session_factory import session_factory
-
-
-class InvitationData(TypedDict):
-    account_id: str
-    email: str
-    workspace_id: str
-
-
-_invitation_adapter: TypeAdapter[InvitationData] = TypeAdapter(InvitationData)
 from werkzeug.exceptions import Unauthorized
 
 from configs import dify_config
 from constants.languages import get_valid_language, language_timezone_mapping
+from core.db.session_factory import session_factory
 from events.tenant_event import tenant_was_created
 from extensions.ext_database import db
 from extensions.ext_redis import redis_client, redis_fallback
@@ -45,8 +35,10 @@ from models.account import (
     TenantPluginAutoUpgradeStrategy,
     TenantStatus,
 )
-from models.model import DifySetup
+from models.dataset import Dataset
+from models.model import App, DifySetup
 from services.billing_service import BillingService
+from services.enterprise.rbac_service import ListOption, RBACService
 from services.entities.auth_entities import (
     ChangeEmailNewEmailToken,
     ChangeEmailOldEmailToken,
@@ -90,6 +82,17 @@ from tasks.mail_reset_password_task import (
     send_reset_password_mail_task_when_account_not_exist,
 )
 
+
+class InvitationData(TypedDict):
+    account_id: str
+    email: str
+    workspace_id: str
+    role: NotRequired[str]
+    requires_setup: NotRequired[bool]
+
+
+_invitation_adapter: TypeAdapter[InvitationData] = TypeAdapter(InvitationData)
+
 logger = logging.getLogger(__name__)
 
 _change_email_token_adapter: TypeAdapter[ChangeEmailTokenData] = TypeAdapter(ChangeEmailTokenData)
@@ -147,6 +150,67 @@ class AccountService:
     OWNER_TRANSFER_MAX_ERROR_LIMITS = 5
     EMAIL_REGISTER_MAX_ERROR_LIMITS = 5
 
+    @staticmethod
+    def _resolve_legacy_role_id(tenant_id: str, account_id: str, role: TenantAccountRole) -> str:
+        """Resolve a legacy workspace role to the corresponding RBAC role id.
+
+        Looks up the builtin RBAC role whose tag matches the legacy role name
+        (e.g. ``TenantAccountRole.ADMIN`` → builtin role with tag ``"admin"``).
+        """
+        options = ListOption(page_number=1, results_per_page=100)
+        roles = RBACService.Roles.list(tenant_id, account_id, options=options).data
+
+        expected_tag = {
+            TenantAccountRole.OWNER: "owner",
+            TenantAccountRole.ADMIN: "admin",
+            TenantAccountRole.EDITOR: "editor",
+            TenantAccountRole.NORMAL: "normal",
+            TenantAccountRole.DATASET_OPERATOR: "dataset_operator",
+        }[role]
+        for rbac_role in roles:
+            if (
+                rbac_role.is_builtin
+                and rbac_role.category == "global_system_default"
+                and rbac_role.role_tag == expected_tag
+            ):
+                return str(rbac_role.id)
+
+        raise ValueError(f"Builtin RBAC role not found for {role.value} in tenant {tenant_id}")
+
+    @staticmethod
+    def get_workspace_permission_keys(tenant_id: str, account_id: str) -> set[str]:
+        permissions = RBACService.MyPermissions.get(tenant_id, account_id)
+        return set(getattr(getattr(permissions, "workspace", None), "permission_keys", []) or [])
+
+    @staticmethod
+    def get_rbac_workspace_owner_account_id(tenant_id: str, actor_account_id: str) -> str:
+        """Return the account id bound to the workspace owner RBAC role."""
+        owner_role_id = AccountService._resolve_legacy_role_id(
+            tenant_id=tenant_id,
+            account_id=actor_account_id,
+            role=TenantAccountRole.OWNER,
+        )
+        owner_members = RBACService.Roles.members(
+            tenant_id=tenant_id,
+            account_id=actor_account_id,
+            role_id=owner_role_id,
+            options=ListOption(page_number=1, results_per_page=1),
+        ).data
+        if not owner_members:
+            raise ValueError(f"Workspace RBAC owner not found for tenant {tenant_id}.")
+        return owner_members[0].account_id
+
+    @staticmethod
+    def is_rbac_workspace_owner(tenant_id: str, actor_account_id: str, member_account_id: str) -> bool:
+        roles = RBACService.MemberRoles.get(
+            tenant_id=tenant_id,
+            account_id=actor_account_id,
+            member_account_id=member_account_id,
+        ).roles
+        return any(
+            role.is_builtin and role.category == "global_system_default" and role.role_tag == "owner" for role in roles
+        )
+
     @staticmethod
     def _get_refresh_token_key(refresh_token: str) -> str:
         return f"{REFRESH_TOKEN_PREFIX}{refresh_token}"
@@ -1216,20 +1280,30 @@ class TenantService:
             tenant = TenantService.create_tenant(name=name, is_setup=is_setup)
         else:
             tenant = TenantService.create_tenant(name=f"{account.name}'s Workspace", is_setup=is_setup)
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db.session, role="owner")
+        if dify_config.RBAC_ENABLED:
+            owner_role_id = AccountService._resolve_legacy_role_id(str(tenant.id), account.id, TenantAccountRole.OWNER)
+            RBACService.MemberRoles.replace(
+                tenant_id=str(tenant.id),
+                account_id=account.id,
+                member_account_id=account.id,
+                role_ids=[owner_role_id],
+            )
         account.current_tenant = tenant
         db.session.commit()
         tenant_was_created.send(tenant)
 
     @staticmethod
-    def create_tenant_member(tenant: Tenant, account: Account, role: str = "normal") -> TenantAccountJoin:
+    def create_tenant_member(
+        tenant: Tenant, account: Account, session: scoped_session, role: str = "normal"
+    ) -> TenantAccountJoin:
         """Create tenant member"""
         if role == TenantAccountRole.OWNER:
             if TenantService.has_roles(tenant, [TenantAccountRole.OWNER]):
                 logger.error("Tenant %s has already an owner.", tenant.id)
                 raise Exception("Tenant already has an owner.")
 
-        ta = db.session.scalar(
+        ta = session.scalar(
             select(TenantAccountJoin)
             .where(TenantAccountJoin.tenant_id == tenant.id, TenantAccountJoin.account_id == account.id)
             .limit(1)
@@ -1238,9 +1312,9 @@ class TenantService:
             ta.role = TenantAccountRole(role)
         else:
             ta = TenantAccountJoin(tenant_id=tenant.id, account_id=account.id, role=TenantAccountRole(role))
-            db.session.add(ta)
+            session.add(ta)
 
-        db.session.commit()
+        session.commit()
         if dify_config.BILLING_ENABLED:
             BillingService.clean_billing_info_cache(tenant.id)
         return ta
@@ -1345,6 +1419,7 @@ class TenantService:
         """
         if not account_id:
             return None
+
         role = session.execute(
             select(TenantAccountJoin.role).where(
                 TenantAccountJoin.tenant_id == tenant_id,
@@ -1531,11 +1606,6 @@ class TenantService:
     @staticmethod
     def check_member_permission(tenant: Tenant, operator: Account, member: Account | None, action: str):
         """Check member permission"""
-        perms = {
-            "add": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
-            "remove": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
-            "update": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
-        }
         if action not in {"add", "remove", "update"}:
             raise InvalidActionError("Invalid action.")
 
@@ -1543,6 +1613,31 @@ class TenantService:
             if operator.id == member.id:
                 raise CannotOperateSelfError("Cannot operate self.")
 
+        if dify_config.RBAC_ENABLED:
+            workspace_permission_keys = AccountService.get_workspace_permission_keys(
+                str(tenant.id),
+                str(operator.id),
+            )
+            required_permission_key = (
+                "workspace.member.manage" if action in {"add", "remove"} else "workspace.role.manage"
+            )
+            if required_permission_key not in workspace_permission_keys:
+                raise NoPermissionError(f"No permission to {action} member.")
+
+            if (
+                action == "remove"
+                and member
+                and AccountService.is_rbac_workspace_owner(str(tenant.id), str(operator.id), str(member.id))
+            ):
+                raise NoPermissionError(f"No permission to {action} member.")
+            return
+
+        perms = {
+            "add": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
+            "remove": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
+            "update": [TenantAccountRole.OWNER, TenantAccountRole.ADMIN],
+        }
+
         ta_operator = db.session.scalar(
             select(TenantAccountJoin)
             .where(TenantAccountJoin.tenant_id == tenant.id, TenantAccountJoin.account_id == operator.id)
@@ -1565,6 +1660,8 @@ class TenantService:
     def remove_member_from_tenant(tenant: Tenant, account: Account, operator: Account):
         """Remove member from tenant.
 
+        Apps and datasets maintained by the removed member are reassigned to
+        the workspace owner without changing their immutable creator records.
         If the removed member has ``AccountStatus.PENDING`` (invited but never
         activated) and no remaining workspace memberships, the orphaned account
         record is deleted as well.
@@ -1587,6 +1684,37 @@ class TenantService:
         account_id = account.id
         account_email = account.email
 
+        owner_id: str | None
+        if dify_config.RBAC_ENABLED:
+            owner_id = AccountService.get_rbac_workspace_owner_account_id(str(tenant.id), str(operator.id))
+        else:
+            owner_id = db.session.scalar(
+                select(TenantAccountJoin.account_id)
+                .where(
+                    TenantAccountJoin.tenant_id == tenant.id,
+                    TenantAccountJoin.role == TenantAccountRole.OWNER,
+                )
+                .limit(1)
+            )
+        if owner_id is None:
+            raise ValueError(f"Workspace owner not found for tenant {tenant.id}.")
+
+        db.session.execute(
+            update(App)
+            .where(
+                App.tenant_id == tenant.id,
+                App.maintainer == account_id,
+            )
+            .values(maintainer=owner_id)
+        )
+        db.session.execute(
+            update(Dataset)
+            .where(
+                Dataset.tenant_id == tenant.id,
+                Dataset.maintainer == account_id,
+            )
+            .values(maintainer=owner_id)
+        )
         db.session.delete(ta)
 
         # Clean up orphaned pending accounts (invited but never activated)
@@ -1658,11 +1786,37 @@ class TenantService:
                 .where(TenantAccountJoin.tenant_id == tenant.id, TenantAccountJoin.role == "owner")
                 .limit(1)
             )
-            if current_owner_join:
-                current_owner_join.role = TenantAccountRole.ADMIN
+            if not dify_config.RBAC_ENABLED:
+                if current_owner_join:
+                    current_owner_join.role = TenantAccountRole.ADMIN
+            elif current_owner_join:
+                admin_role_id = AccountService._resolve_legacy_role_id(
+                    tenant_id=str(tenant.id),
+                    account_id=operator.id,
+                    role=TenantAccountRole.ADMIN,
+                )
+                RBACService.MemberRoles.replace(
+                    tenant_id=str(tenant.id),
+                    account_id=operator.id,
+                    member_account_id=str(current_owner_join.account_id),
+                    role_ids=[admin_role_id],
+                )
 
         # Update the role of the target member
-        target_member_join.role = new_tenant_role
+        if dify_config.RBAC_ENABLED:
+            resolved_role_id = AccountService._resolve_legacy_role_id(
+                tenant_id=str(tenant.id),
+                account_id=operator.id,
+                role=TenantAccountRole.OWNER,
+            )
+            RBACService.MemberRoles.replace(
+                tenant_id=str(tenant.id),
+                account_id=operator.id,
+                member_account_id=member.id,
+                role_ids=[resolved_role_id],
+            )
+        else:
+            target_member_join.role = new_tenant_role
         db.session.commit()
 
     @staticmethod
@@ -1763,7 +1917,7 @@ class RegisterService:
             ):
                 try:
                     tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
-                    TenantService.create_tenant_member(tenant, account, role="owner")
+                    TenantService.create_tenant_member(tenant, account, db.session, role="owner")
                     account.current_tenant = tenant
                     tenant_was_created.send(tenant)
                 except Exception:
@@ -1796,6 +1950,7 @@ class RegisterService:
             raise ValueError("Inviter is required")
 
         normalized_email = email.lower()
+        tenant_join_role = TenantAccountRole.NORMAL.value if dify_config.RBAC_ENABLED else role
 
         """Invite new member"""
         # Check workspace permission for member invitations
@@ -1805,6 +1960,7 @@ class RegisterService:
 
         account = AccountService.get_account_by_email_with_case_fallback(email)
 
+        requires_setup = False
         if not account:
             TenantService.check_member_permission(tenant, inviter, None, "add")
             name = normalized_email.split("@")[0]
@@ -1816,9 +1972,9 @@ class RegisterService:
                 status=AccountStatus.PENDING,
                 is_setup=True,
             )
-            # Create new tenant member for invited tenant
-            TenantService.create_tenant_member(tenant, account, role)
+            TenantService.create_tenant_member(tenant, account, db.session, tenant_join_role)
             TenantService.switch_tenant(account, tenant.id)
+            requires_setup = True
         else:
             TenantService.check_member_permission(tenant, inviter, account, "add")
             ta = db.session.scalar(
@@ -1826,15 +1982,33 @@ class RegisterService:
                 .where(TenantAccountJoin.tenant_id == tenant.id, TenantAccountJoin.account_id == account.id)
                 .limit(1)
             )
+            requires_setup = account.status == AccountStatus.PENDING
 
-            if not ta:
-                TenantService.create_tenant_member(tenant, account, role)
+            if not ta and (account.status == AccountStatus.PENDING or dify_config.RBAC_ENABLED):
+                TenantService.create_tenant_member(tenant, account, db.session, tenant_join_role)
 
             # Support resend invitation email when the account is pending status
             if account.status != AccountStatus.PENDING:
-                raise AccountAlreadyInTenantError("Account already in tenant.")
+                if dify_config.RBAC_ENABLED and not ta:
+                    RBACService.MemberRoles.replace(
+                        tenant_id=str(tenant.id),
+                        account_id=inviter.id,
+                        member_account_id=account.id,
+                        role_ids=[role],
+                    )
+                if ta or dify_config.RBAC_ENABLED:
+                    raise AccountAlreadyInTenantError("Account already in tenant.")
 
-        token = cls.generate_invite_token(tenant, account)
+        # Assign RBAC role if RBAC is enabled
+        if dify_config.RBAC_ENABLED:
+            RBACService.MemberRoles.replace(
+                tenant_id=str(tenant.id),
+                account_id=inviter.id,
+                member_account_id=account.id,
+                role_ids=[role],
+            )
+
+        token = cls.generate_invite_token(tenant, account, role, requires_setup=requires_setup)
         language = account.interface_language or "en-US"
 
         # send email
@@ -1849,12 +2023,16 @@ class RegisterService:
         return token
 
     @classmethod
-    def generate_invite_token(cls, tenant: Tenant, account: Account) -> str:
+    def generate_invite_token(
+        cls, tenant: Tenant, account: Account, role: str = "normal", *, requires_setup: bool = False
+    ) -> str:
         token = str(uuid.uuid4())
         invitation_data = {
             "account_id": account.id,
             "email": account.email,
             "workspace_id": tenant.id,
+            "role": str(role),
+            "requires_setup": requires_setup,
         }
         expiry_hours = dify_config.INVITE_EXPIRY_HOURS
         redis_client.setex(cls._get_invitation_token_key(token), expiry_hours * 60 * 60, json.dumps(invitation_data))
@@ -1889,16 +2067,7 @@ class RegisterService:
         if not tenant:
             return None
 
-        tenant_account = db.session.execute(
-            select(Account, TenantAccountJoin.role)
-            .join(TenantAccountJoin, Account.id == TenantAccountJoin.account_id)
-            .where(Account.email == invitation_data["email"], TenantAccountJoin.tenant_id == tenant.id)
-        ).first()
-
-        if not tenant_account:
-            return None
-
-        account = tenant_account[0]
+        account = db.session.scalar(select(Account).where(Account.email == invitation_data["email"]).limit(1))
         if not account:
             return None
 
diff --git a/api/services/agent/composer_service.py b/api/services/agent/composer_service.py
index 3f544e9438b..16ab3627929 100644
--- a/api/services/agent/composer_service.py
+++ b/api/services/agent/composer_service.py
@@ -115,7 +115,15 @@ class AgentComposerService:
             and binding is not None
             and binding.agent_id
             and payload.save_strategy
-            in (ComposerSaveStrategy.SAVE_TO_CURRENT_VERSION, ComposerSaveStrategy.SAVE_AS_NEW_VERSION)
+            in (
+                ComposerSaveStrategy.NODE_JOB_ONLY,
+                ComposerSaveStrategy.SAVE_TO_CURRENT_VERSION,
+                ComposerSaveStrategy.SAVE_AS_NEW_VERSION,
+            )
+            and (
+                payload.save_strategy != ComposerSaveStrategy.NODE_JOB_ONLY
+                or binding.binding_type == WorkflowAgentBindingType.INLINE_AGENT
+            )
         ):
             cls._require_drive_refs_resolved(
                 tenant_id=tenant_id, agent_id=binding.agent_id, agent_soul=payload.agent_soul
@@ -823,6 +831,26 @@ class AgentComposerService:
         node_job = payload.node_job or WorkflowNodeJobConfig()
         if binding:
             binding.node_job_config = node_job
+            if payload.agent_soul is not None and binding.binding_type == WorkflowAgentBindingType.INLINE_AGENT:
+                current_snapshot = cls._require_version(
+                    tenant_id=tenant_id,
+                    agent_id=binding.agent_id,
+                    version_id=binding.current_snapshot_id,
+                )
+                version = cls._update_current_version(
+                    current_snapshot=current_snapshot,
+                    account_id=account_id,
+                    agent_soul=payload.agent_soul,
+                    operation=AgentConfigRevisionOperation.SAVE_CURRENT_VERSION,
+                    version_note=payload.version_note,
+                )
+                agent = cls._require_agent(tenant_id=tenant_id, agent_id=binding.agent_id)
+                if agent.scope != AgentScope.WORKFLOW_ONLY:
+                    raise ValueError("Inline workflow agent binding must point to a workflow-only agent")
+                agent.active_config_snapshot_id = version.id
+                agent.active_config_has_model = agent_soul_has_model(payload.agent_soul)
+                agent.updated_by = account_id
+                binding.current_snapshot_id = version.id
             binding.updated_by = account_id
             return binding
 
diff --git a/api/services/agent/composer_validator.py b/api/services/agent/composer_validator.py
index 47c255aae2d..b9519272c4a 100644
--- a/api/services/agent/composer_validator.py
+++ b/api/services/agent/composer_validator.py
@@ -18,6 +18,7 @@ from services.agent.prompt_mentions import (
 from services.entities.agent_entities import (
     AgentSoulConfig,
     ComposerSavePayload,
+    ComposerSaveStrategy,
     ComposerVariant,
     WorkflowNodeJobConfig,
 )
@@ -50,7 +51,12 @@ _DANGEROUS_ACK_KEYS = (
 class ComposerConfigValidator:
     @classmethod
     def validate_save_payload(cls, payload: ComposerSavePayload) -> None:
-        if payload.variant == ComposerVariant.WORKFLOW and payload.soul_lock.locked and payload.agent_soul is not None:
+        if (
+            payload.variant == ComposerVariant.WORKFLOW
+            and payload.soul_lock.locked
+            and payload.agent_soul is not None
+            and payload.save_strategy != ComposerSaveStrategy.NODE_JOB_ONLY
+        ):
             raise AgentSoulLockedError()
 
         if payload.agent_soul is not None:
@@ -328,16 +334,17 @@ class ComposerConfigValidator:
 
     @classmethod
     def _reject_plaintext_secrets(cls, value: Any, *, path: str) -> None:
-        if isinstance(value, dict):
-            for key, nested in value.items():
-                normalized_key = key.lower().replace("-", "_")
-                nested_path = f"{path}.{key}"
-                if normalized_key in _PLAINTEXT_SECRET_KEYS and isinstance(nested, str) and nested:
-                    raise PlaintextSecretNotAllowedError(f"Plaintext secret is not allowed at {nested_path}")
-                cls._reject_plaintext_secrets(nested, path=nested_path)
-        elif isinstance(value, list):
-            for index, nested in enumerate(value):
-                cls._reject_plaintext_secrets(nested, path=f"{path}[{index}]")
+        match value:
+            case dict():
+                for key, nested in value.items():
+                    normalized_key = key.lower().replace("-", "_")
+                    nested_path = f"{path}.{key}"
+                    if normalized_key in _PLAINTEXT_SECRET_KEYS and isinstance(nested, str) and nested:
+                        raise PlaintextSecretNotAllowedError(f"Plaintext secret is not allowed at {nested_path}")
+                    cls._reject_plaintext_secrets(nested, path=nested_path)
+            case list():
+                for index, nested in enumerate(value):
+                    cls._reject_plaintext_secrets(nested, path=f"{path}[{index}]")
 
     @classmethod
     def _has_install_command(cls, entry: dict[str, Any]) -> bool:
diff --git a/api/services/agent/observability_service.py b/api/services/agent/observability_service.py
new file mode 100644
index 00000000000..76b36abed2a
--- /dev/null
+++ b/api/services/agent/observability_service.py
@@ -0,0 +1,739 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime
+from decimal import Decimal
+from typing import Any
+
+import sqlalchemy as sa
+from sqlalchemy import and_, func, or_, select
+from sqlalchemy.orm import aliased
+
+from core.app.entities.app_invoke_entities import InvokeFrom
+from libs.helper import convert_datetime_to_date, escape_like_pattern, to_timestamp
+from models.agent import WorkflowAgentNodeBinding
+from models.enums import MessageStatus
+from models.model import App, Conversation, Message
+from models.workflow import WorkflowNodeExecutionModel, WorkflowRun
+
+
+@dataclass(frozen=True)
+class AgentLogQueryParams:
+    page: int = 1
+    limit: int = 20
+    keyword: str | None = None
+    statuses: tuple[str, ...] = ()
+    sources: tuple[str, ...] = ()
+    sort_by: str = "updated_at"
+    sort_order: str = "desc"
+    start: datetime | None = None
+    end: datetime | None = None
+
+
+@dataclass(frozen=True)
+class AgentStatisticsQueryParams:
+    source: str | None = None
+    start: datetime | None = None
+    end: datetime | None = None
+    timezone: str = "UTC"
+
+
+@dataclass(frozen=True)
+class AgentSourceFilter:
+    kind: str
+    app_id: str | None = None
+    workflow_id: str | None = None
+    workflow_version: str | None = None
+    node_id: str | None = None
+    invoke_from: InvokeFrom | None = None
+
+
+class AgentObservabilityService:
+    _SOURCE_ALIASES: dict[str, InvokeFrom] = {
+        "api": InvokeFrom.SERVICE_API,
+        "service-api": InvokeFrom.SERVICE_API,
+        "service_api": InvokeFrom.SERVICE_API,
+        "console": InvokeFrom.EXPLORE,
+        "explore": InvokeFrom.EXPLORE,
+        "explore-app": InvokeFrom.EXPLORE,
+        "explore_app": InvokeFrom.EXPLORE,
+        "web": InvokeFrom.WEB_APP,
+        "web-app": InvokeFrom.WEB_APP,
+        "web_app": InvokeFrom.WEB_APP,
+        "debugger": InvokeFrom.DEBUGGER,
+        "dev": InvokeFrom.DEBUGGER,
+        "openapi": InvokeFrom.OPENAPI,
+        "trigger": InvokeFrom.TRIGGER,
+    }
+
+    def __init__(self, session: Any):
+        self._session = session
+
+    @classmethod
+    def resolve_source(cls, source: str | None) -> InvokeFrom | None:
+        if not source or source == "all":
+            return None
+        normalized = source.strip().lower()
+        if not normalized or normalized == "all":
+            return None
+        try:
+            return cls._SOURCE_ALIASES[normalized]
+        except KeyError as exc:
+            raise ValueError(f"Unsupported source: {source}") from exc
+
+    @classmethod
+    def resolve_source_filter(cls, source: str | None) -> AgentSourceFilter:
+        if not source or source.strip().lower() == "all":
+            return AgentSourceFilter(kind="all")
+        normalized = source.strip()
+        lowered = normalized.lower()
+        if lowered == "webapp":
+            return AgentSourceFilter(kind="webapp")
+        if lowered.startswith("webapp:"):
+            return AgentSourceFilter(kind="webapp", app_id=normalized.split(":", 1)[1] or None)
+        if lowered == "workflow":
+            return AgentSourceFilter(kind="workflow")
+        if lowered.startswith("workflow:"):
+            parts = normalized.split(":", 4)
+            if len(parts) != 5 or not all(parts[1:]):
+                raise ValueError(f"Unsupported source: {source}")
+            return AgentSourceFilter(
+                kind="workflow",
+                app_id=parts[1],
+                workflow_id=parts[2],
+                workflow_version=parts[3],
+                node_id=parts[4],
+            )
+        return AgentSourceFilter(kind="webapp", invoke_from=cls.resolve_source(source))
+
+    @classmethod
+    def resolve_source_filters(cls, sources: tuple[str, ...]) -> list[AgentSourceFilter]:
+        if not sources:
+            return [AgentSourceFilter(kind="all")]
+        filters: list[AgentSourceFilter] = []
+        for source in sources:
+            source_filter = cls.resolve_source_filter(source)
+            if source_filter.kind == "all":
+                return [source_filter]
+            filters.append(source_filter)
+        return filters
+
+    @staticmethod
+    def _message_status(message: Message) -> str:
+        if message.error or message.status == MessageStatus.ERROR:
+            return "failed"
+        if message.status == MessageStatus.PAUSED:
+            return "paused"
+        return "success"
+
+    @staticmethod
+    def _total_tokens(message: Message) -> int:
+        return int(message.message_tokens or 0) + int(message.answer_tokens or 0)
+
+    @classmethod
+    def serialize_log_message(cls, message: Message, conversation: Conversation | None = None) -> dict[str, Any]:
+        invoke_from = message.invoke_from.value if message.invoke_from else None
+        return {
+            "id": message.id,
+            "message_id": message.id,
+            "conversation_id": message.conversation_id,
+            "conversation_name": conversation.name if conversation else None,
+            "query": message.query,
+            "answer": message.answer,
+            "status": cls._message_status(message),
+            "error": message.error,
+            "source": invoke_from,
+            "from_source": message.from_source.value if message.from_source else None,
+            "from_end_user_id": message.from_end_user_id,
+            "from_account_id": message.from_account_id,
+            "message_tokens": int(message.message_tokens or 0),
+            "answer_tokens": int(message.answer_tokens or 0),
+            "total_tokens": cls._total_tokens(message),
+            "total_price": str(message.total_price or Decimal(0)),
+            "currency": message.currency,
+            "latency": float(message.provider_response_latency or 0),
+            "created_at": to_timestamp(message.created_at),
+            "updated_at": to_timestamp(message.updated_at),
+        }
+
+    def list_logs(self, *, app: App, agent_id: str, params: AgentLogQueryParams) -> dict[str, Any]:
+        source_filters = self.resolve_source_filters(params.sources)
+        rows: list[dict[str, Any]] = []
+        for source_filter in source_filters:
+            if source_filter.kind in {"all", "webapp"}:
+                rows.extend(self._list_webapp_conversation_logs(app=app, params=params, source_filter=source_filter))
+            if source_filter.kind in {"all", "workflow"}:
+                rows.extend(
+                    self._list_workflow_conversation_logs(
+                        app=app,
+                        agent_id=agent_id,
+                        params=params,
+                        source_filter=source_filter,
+                    )
+                )
+        rows_by_scope = {(row["id"], row["source"]["id"] if row.get("source") else ""): row for row in rows}
+        rows = list(rows_by_scope.values())
+        sort_by = "created_at" if params.sort_by == "created_at" else "updated_at"
+        rows.sort(key=lambda row: (row[sort_by] or 0, row["id"]), reverse=params.sort_order != "asc")
+
+        total = len(rows)
+        start = (params.page - 1) * params.limit
+        end = start + params.limit
+        return {
+            "data": rows[start:end],
+            "page": params.page,
+            "limit": params.limit,
+            "total": total,
+            "has_more": end < total,
+        }
+
+    def list_log_messages(
+        self, *, app: App, agent_id: str, conversation_id: str, params: AgentLogQueryParams
+    ) -> dict[str, Any]:
+        source_filters = self.resolve_source_filters(params.sources)
+        rows: list[Message] = []
+        for source_filter in source_filters:
+            if source_filter.kind in {"all", "webapp"}:
+                rows.extend(
+                    self._list_webapp_messages(
+                        app=app,
+                        conversation_id=conversation_id,
+                        params=params,
+                        source_filter=source_filter,
+                    )
+                )
+            if source_filter.kind in {"all", "workflow"}:
+                rows.extend(
+                    self._list_workflow_messages(
+                        app=app,
+                        agent_id=agent_id,
+                        conversation_id=conversation_id,
+                        params=params,
+                        source_filter=source_filter,
+                    )
+                )
+
+        deduped = {message.id: message for message in rows}
+        sort_column = Message.created_at if params.sort_by == "created_at" else Message.updated_at
+        sorted_rows = sorted(
+            deduped.values(),
+            key=lambda message: (getattr(message, sort_column.key), message.id),
+            reverse=params.sort_order != "asc",
+        )
+        total = len(sorted_rows)
+        start = (params.page - 1) * params.limit
+        end = start + params.limit
+        return {
+            "data": [self.serialize_log_message(message) for message in sorted_rows[start:end]],
+            "page": params.page,
+            "limit": params.limit,
+            "total": total,
+            "has_more": end < total,
+        }
+
+    def list_log_sources(self, *, app: App, agent_id: str) -> dict[str, Any]:
+        webapp_source = self._serialize_webapp_source(app)
+        workflow_sources = self._list_workflow_sources(app=app, agent_id=agent_id)
+        return {
+            "data": [webapp_source, *workflow_sources],
+            "groups": [
+                {"type": "webapp", "label": "WEBAPP", "sources": [webapp_source]},
+                {"type": "workflow", "label": "WORKFLOW", "sources": workflow_sources},
+            ],
+        }
+
+    def _list_webapp_conversation_logs(
+        self, *, app: App, params: AgentLogQueryParams, source_filter: AgentSourceFilter
+    ) -> list[dict[str, Any]]:
+        stmt = (
+            select(
+                Conversation,
+                func.count(Message.id).label("message_count"),
+                func.max(Message.created_at).label("created_at"),
+                func.max(Message.updated_at).label("updated_at"),
+                func.sum(sa.case((Message.status == MessageStatus.PAUSED, 1), else_=0)).label("paused_count"),
+                func.sum(
+                    sa.case((or_(Message.error.is_not(None), Message.status == MessageStatus.ERROR), 1), else_=0)
+                ).label("failed_count"),
+            )
+            .join(Message, Message.conversation_id == Conversation.id)
+            .where(Message.app_id == app.id, Conversation.app_id == app.id)
+            .group_by(Conversation.id)
+        )
+        stmt = self._apply_observability_filters(stmt, params=params, source_filter=source_filter)
+        rows = list(self._session.execute(stmt).all())
+        return [
+            self._serialize_conversation_log(
+                conversation=row[0],
+                message_count=row.message_count,
+                paused_count=row.paused_count,
+                failed_count=row.failed_count,
+                source=self._serialize_webapp_source(app),
+                created_at=row.created_at,
+                updated_at=row.updated_at,
+            )
+            for row in rows
+        ]
+
+    def _list_workflow_conversation_logs(
+        self, *, app: App, agent_id: str, params: AgentLogQueryParams, source_filter: AgentSourceFilter
+    ) -> list[dict[str, Any]]:
+        workflow_app = aliased(App)
+        stmt = (
+            select(
+                Conversation,
+                workflow_app,
+                WorkflowAgentNodeBinding.workflow_id,
+                WorkflowAgentNodeBinding.workflow_version,
+                WorkflowAgentNodeBinding.node_id,
+                func.count(sa.distinct(Message.id)).label("message_count"),
+                func.max(Message.created_at).label("created_at"),
+                func.max(Message.updated_at).label("updated_at"),
+                func.sum(sa.case((Message.status == MessageStatus.PAUSED, 1), else_=0)).label("paused_count"),
+                func.sum(
+                    sa.case((or_(Message.error.is_not(None), Message.status == MessageStatus.ERROR), 1), else_=0)
+                ).label("failed_count"),
+            )
+            .select_from(Message)
+            .join(Conversation, Conversation.id == Message.conversation_id)
+            .join(WorkflowRun, WorkflowRun.id == Message.workflow_run_id)
+            .join(
+                WorkflowAgentNodeBinding,
+                and_(
+                    WorkflowAgentNodeBinding.tenant_id == app.tenant_id,
+                    WorkflowAgentNodeBinding.agent_id == agent_id,
+                    WorkflowAgentNodeBinding.app_id == WorkflowRun.app_id,
+                    WorkflowAgentNodeBinding.workflow_id == WorkflowRun.workflow_id,
+                    WorkflowAgentNodeBinding.workflow_version == WorkflowRun.version,
+                ),
+            )
+            .join(
+                WorkflowNodeExecutionModel,
+                and_(
+                    WorkflowNodeExecutionModel.workflow_run_id == WorkflowRun.id,
+                    WorkflowNodeExecutionModel.node_id == WorkflowAgentNodeBinding.node_id,
+                ),
+            )
+            .join(workflow_app, workflow_app.id == WorkflowAgentNodeBinding.app_id)
+            .where(Message.workflow_run_id.is_not(None), Conversation.app_id == WorkflowAgentNodeBinding.app_id)
+            .group_by(
+                Conversation.id,
+                workflow_app.id,
+                WorkflowAgentNodeBinding.workflow_id,
+                WorkflowAgentNodeBinding.workflow_version,
+                WorkflowAgentNodeBinding.node_id,
+            )
+        )
+        stmt = self._apply_observability_filters(stmt, params=params, source_filter=source_filter)
+        stmt = self._apply_workflow_source_filter(stmt, source_filter)
+        rows = list(self._session.execute(stmt).all())
+        return [
+            self._serialize_conversation_log(
+                conversation=row[0],
+                message_count=row.message_count,
+                paused_count=row.paused_count,
+                failed_count=row.failed_count,
+                source=self._serialize_workflow_source(
+                    app=row[1],
+                    workflow_id=row.workflow_id,
+                    workflow_version=row.workflow_version,
+                    node_id=row.node_id,
+                ),
+                created_at=row.created_at,
+                updated_at=row.updated_at,
+            )
+            for row in rows
+        ]
+
+    def _list_webapp_messages(
+        self, *, app: App, conversation_id: str, params: AgentLogQueryParams, source_filter: AgentSourceFilter
+    ) -> list[Message]:
+        stmt = select(Message).where(Message.app_id == app.id, Message.conversation_id == conversation_id)
+        stmt = self._apply_message_filters(stmt, params=params, source_filter=source_filter)
+        return list(self._session.scalars(stmt.order_by(Message.created_at.desc(), Message.id.desc())).all())
+
+    def _list_workflow_messages(
+        self,
+        *,
+        app: App,
+        agent_id: str,
+        conversation_id: str,
+        params: AgentLogQueryParams,
+        source_filter: AgentSourceFilter,
+    ) -> list[Message]:
+        stmt = (
+            select(Message)
+            .join(WorkflowRun, WorkflowRun.id == Message.workflow_run_id)
+            .join(
+                WorkflowAgentNodeBinding,
+                and_(
+                    WorkflowAgentNodeBinding.tenant_id == app.tenant_id,
+                    WorkflowAgentNodeBinding.agent_id == agent_id,
+                    WorkflowAgentNodeBinding.app_id == WorkflowRun.app_id,
+                    WorkflowAgentNodeBinding.workflow_id == WorkflowRun.workflow_id,
+                    WorkflowAgentNodeBinding.workflow_version == WorkflowRun.version,
+                ),
+            )
+            .join(
+                WorkflowNodeExecutionModel,
+                and_(
+                    WorkflowNodeExecutionModel.workflow_run_id == WorkflowRun.id,
+                    WorkflowNodeExecutionModel.node_id == WorkflowAgentNodeBinding.node_id,
+                ),
+            )
+            .where(Message.conversation_id == conversation_id)
+        )
+        stmt = self._apply_message_filters(stmt, params=params, source_filter=source_filter)
+        stmt = self._apply_workflow_source_filter(stmt, source_filter)
+        return list(self._session.scalars(stmt.order_by(Message.created_at.desc(), Message.id.desc())).all())
+
+    def _list_workflow_sources(self, *, app: App, agent_id: str) -> list[dict[str, Any]]:
+        workflow_app = aliased(App)
+        stmt = (
+            select(
+                workflow_app,
+                WorkflowAgentNodeBinding.workflow_id,
+                WorkflowAgentNodeBinding.workflow_version,
+                WorkflowAgentNodeBinding.node_id,
+            )
+            .join(workflow_app, workflow_app.id == WorkflowAgentNodeBinding.app_id)
+            .where(WorkflowAgentNodeBinding.tenant_id == app.tenant_id, WorkflowAgentNodeBinding.agent_id == agent_id)
+            .order_by(workflow_app.name.asc(), WorkflowAgentNodeBinding.node_id.asc())
+        )
+        rows = self._session.execute(stmt).all()
+        deduped: dict[str, dict[str, Any]] = {}
+        for row in rows:
+            source = self._serialize_workflow_source(
+                app=row[0],
+                workflow_id=row.workflow_id,
+                workflow_version=row.workflow_version,
+                node_id=row.node_id,
+            )
+            deduped[source["id"]] = source
+        return list(deduped.values())
+
+    @classmethod
+    def _apply_observability_filters(cls, stmt, *, params: AgentLogQueryParams, source_filter: AgentSourceFilter):
+        stmt = cls._apply_message_filters(stmt, params=params, source_filter=source_filter, include_keyword=False)
+        if params.keyword:
+            escaped_keyword = escape_like_pattern(params.keyword)
+            pattern = f"%{escaped_keyword}%"
+            stmt = stmt.where(
+                or_(
+                    Message.query.ilike(pattern, escape="\\"),
+                    Message.answer.ilike(pattern, escape="\\"),
+                    Conversation.name.ilike(pattern, escape="\\"),
+                )
+            )
+        return stmt
+
+    @classmethod
+    def _apply_message_filters(
+        cls, stmt, *, params: AgentLogQueryParams, source_filter: AgentSourceFilter, include_keyword: bool = True
+    ):
+        stmt = cls._apply_source_filter(stmt, source_filter.invoke_from)
+        if params.start:
+            stmt = stmt.where(Message.created_at >= params.start)
+        if params.end:
+            stmt = stmt.where(Message.created_at < params.end)
+        if include_keyword and params.keyword:
+            escaped_keyword = escape_like_pattern(params.keyword)
+            pattern = f"%{escaped_keyword}%"
+            stmt = stmt.where(
+                or_(
+                    Message.query.ilike(pattern, escape="\\"),
+                    Message.answer.ilike(pattern, escape="\\"),
+                )
+            )
+        if params.statuses:
+            stmt = cls._apply_status_filter(stmt, params.statuses)
+        return stmt
+
+    @staticmethod
+    def _apply_workflow_source_filter(stmt, source_filter: AgentSourceFilter):
+        if source_filter.app_id:
+            stmt = stmt.where(WorkflowAgentNodeBinding.app_id == source_filter.app_id)
+        if source_filter.workflow_id:
+            stmt = stmt.where(WorkflowAgentNodeBinding.workflow_id == source_filter.workflow_id)
+        if source_filter.workflow_version:
+            stmt = stmt.where(WorkflowAgentNodeBinding.workflow_version == source_filter.workflow_version)
+        if source_filter.node_id:
+            stmt = stmt.where(WorkflowAgentNodeBinding.node_id == source_filter.node_id)
+        return stmt
+
+    @classmethod
+    def _apply_source_filter(cls, stmt, source: InvokeFrom | None):
+        if source is None:
+            return stmt.where(Message.invoke_from != InvokeFrom.DEBUGGER)
+        return stmt.where(Message.invoke_from == source)
+
+    @staticmethod
+    def _apply_status_filter(stmt, statuses: tuple[str, ...]):
+        conditions = []
+        for status in statuses:
+            normalized = status.strip().lower()
+            if normalized in {"success", "normal"}:
+                conditions.append(and_(Message.error.is_(None), Message.status == MessageStatus.NORMAL))
+            elif normalized in {"failed", "error"}:
+                conditions.append(or_(Message.error.is_not(None), Message.status == MessageStatus.ERROR))
+            elif normalized == "paused":
+                conditions.append(Message.status == MessageStatus.PAUSED)
+            else:
+                raise ValueError(f"Unsupported status: {status}")
+        if not conditions:
+            return stmt
+        return stmt.where(or_(*conditions))
+
+    @classmethod
+    def _serialize_conversation_log(
+        cls,
+        *,
+        conversation: Conversation,
+        message_count: int,
+        paused_count: int,
+        failed_count: int,
+        source: dict[str, Any],
+        created_at: datetime | None,
+        updated_at: datetime | None,
+    ) -> dict[str, Any]:
+        return {
+            "id": conversation.id,
+            "conversation_id": conversation.id,
+            "title": conversation.name,
+            "end_user_id": conversation.from_end_user_id,
+            "message_count": int(message_count or 0),
+            "user_rate": None,
+            "operation_rate": None,
+            "unread": conversation.read_at is None,
+            "source": source,
+            "status": cls._conversation_status(paused_count=paused_count, failed_count=failed_count),
+            "created_at": to_timestamp(created_at or conversation.created_at),
+            "updated_at": to_timestamp(updated_at or conversation.updated_at),
+        }
+
+    @staticmethod
+    def _conversation_status(*, paused_count: int, failed_count: int) -> str:
+        if paused_count:
+            return "paused"
+        if failed_count:
+            return "failed"
+        return "success"
+
+    @staticmethod
+    def _serialize_webapp_source(app: App) -> dict[str, Any]:
+        icon_type = app.icon_type.value if app.icon_type else None
+        return {
+            "id": f"webapp:{app.id}",
+            "type": "webapp",
+            "app_id": app.id,
+            "app_name": app.name,
+            "app_icon_type": icon_type,
+            "app_icon": app.icon,
+            "app_icon_background": app.icon_background,
+            "workflow_id": None,
+            "workflow_version": None,
+            "node_id": None,
+        }
+
+    @staticmethod
+    def _serialize_workflow_source(
+        *,
+        app: App,
+        workflow_id: str,
+        workflow_version: str,
+        node_id: str,
+    ) -> dict[str, Any]:
+        icon_type = app.icon_type.value if app.icon_type else None
+        return {
+            "id": f"workflow:{app.id}:{workflow_id}:{workflow_version}:{node_id}",
+            "type": "workflow",
+            "app_id": app.id,
+            "app_name": app.name,
+            "app_icon_type": icon_type,
+            "app_icon": app.icon,
+            "app_icon_background": app.icon_background,
+            "workflow_id": workflow_id,
+            "workflow_version": workflow_version,
+            "node_id": node_id,
+        }
+
+    def get_statistics_summary(self, *, app: App, agent_id: str, params: AgentStatisticsQueryParams) -> dict[str, Any]:
+        source_filter = self.resolve_source_filter(params.source)
+        rows = self._load_daily_statistics(app=app, agent_id=agent_id, params=params, source_filter=source_filter)
+        charts = self._build_charts(rows)
+        summary = self._build_summary(rows)
+        return {
+            "source": params.source or "all",
+            "summary": summary,
+            "charts": charts,
+        }
+
+    def _load_daily_statistics(
+        self, *, app: App, agent_id: str, params: AgentStatisticsQueryParams, source_filter: AgentSourceFilter
+    ) -> list[dict[str, Any]]:
+        converted_created_at = convert_datetime_to_date("m.created_at")
+        message_scope = self._statistics_message_scope_sql(source_filter)
+        sql_query = f"""SELECT
+    {converted_created_at} AS date,
+    COUNT(m.id) AS message_count,
+    COUNT(DISTINCT m.conversation_id) AS conversation_count,
+    COUNT(DISTINCT m.from_end_user_id) AS end_user_count,
+    COALESCE(SUM(COALESCE(m.message_tokens, 0) + COALESCE(m.answer_tokens, 0)), 0) AS token_count,
+    COALESCE(SUM(COALESCE(m.total_price, 0)), 0) AS total_price,
+    COALESCE(AVG(m.provider_response_latency), 0) AS avg_latency,
+    COALESCE(SUM(m.provider_response_latency), 0) AS latency_sum,
+    COALESCE(SUM(m.answer_tokens), 0) AS answer_tokens,
+    COUNT(mf.id) AS like_count
+FROM messages m
+LEFT JOIN message_feedbacks mf
+    ON mf.message_id = m.id AND mf.rating = 'like'
+WHERE
+    {message_scope}"""
+        args: dict[str, Any] = {
+            "tz": params.timezone,
+            "app_id": app.id,
+            "tenant_id": app.tenant_id,
+            "agent_id": agent_id,
+            "debugger": InvokeFrom.DEBUGGER,
+        }
+        if source_filter.invoke_from is not None:
+            args["source"] = source_filter.invoke_from
+        if source_filter.app_id:
+            args["source_app_id"] = source_filter.app_id
+        if source_filter.workflow_id:
+            args["workflow_id"] = source_filter.workflow_id
+        if source_filter.workflow_version:
+            args["workflow_version"] = source_filter.workflow_version
+        if source_filter.node_id:
+            args["node_id"] = source_filter.node_id
+        if params.start:
+            sql_query += " AND m.created_at >= :start"
+            args["start"] = params.start
+        if params.end:
+            sql_query += " AND m.created_at < :end"
+            args["end"] = params.end
+        sql_query += " GROUP BY date ORDER BY date"
+
+        return [dict(row._mapping) for row in self._session.execute(sa.text(sql_query), args).all()]
+
+    @staticmethod
+    def _statistics_message_scope_sql(source_filter: AgentSourceFilter) -> str:
+        app_scope = "m.app_id = :app_id"
+        if source_filter.invoke_from is None:
+            app_scope += " AND m.invoke_from != :debugger"
+        else:
+            app_scope += " AND m.invoke_from = :source"
+        workflow_binding_filters = []
+        if source_filter.app_id:
+            workflow_binding_filters.append("wanb.app_id = :source_app_id")
+        if source_filter.workflow_id:
+            workflow_binding_filters.append("wanb.workflow_id = :workflow_id")
+        if source_filter.workflow_version:
+            workflow_binding_filters.append("wanb.workflow_version = :workflow_version")
+        if source_filter.node_id:
+            workflow_binding_filters.append("wanb.node_id = :node_id")
+        extra_workflow_filters = f"AND {' AND '.join(workflow_binding_filters)}" if workflow_binding_filters else ""
+        workflow_scope = f"""m.workflow_run_id IS NOT NULL
+        AND EXISTS (
+            SELECT 1
+            FROM workflow_runs wr
+            JOIN workflow_agent_node_bindings wanb
+                ON wanb.tenant_id = :tenant_id
+                AND wanb.agent_id = :agent_id
+                AND wanb.app_id = wr.app_id
+                AND wanb.workflow_id = wr.workflow_id
+                AND wanb.workflow_version = wr.version
+                {extra_workflow_filters}
+            JOIN workflow_node_executions wne
+                ON wne.workflow_run_id = wr.id
+                AND wne.node_id = wanb.node_id
+            WHERE wr.id = m.workflow_run_id
+        )"""
+        if source_filter.kind == "webapp":
+            return app_scope
+        if source_filter.kind == "workflow":
+            return workflow_scope
+        return f"(({app_scope}) OR ({workflow_scope}))"
+
+    @staticmethod
+    def _build_charts(rows: list[dict[str, Any]]) -> dict[str, list[dict[str, Any]]]:
+        messages = []
+        conversations = []
+        end_users = []
+        token_usage = []
+        average_session_interactions = []
+        average_response_time = []
+        tokens_per_second = []
+        user_satisfaction_rate = []
+
+        for row in rows:
+            date = str(row["date"])
+            message_count = int(row["message_count"] or 0)
+            conversation_count = int(row["conversation_count"] or 0)
+            token_count = int(row["token_count"] or 0)
+            total_price = row["total_price"] or Decimal(0)
+            avg_latency = float(row["avg_latency"] or 0)
+            latency_sum = float(row["latency_sum"] or 0)
+            answer_tokens = int(row["answer_tokens"] or 0)
+            like_count = int(row["like_count"] or 0)
+
+            messages.append({"date": date, "message_count": message_count})
+            conversations.append({"date": date, "conversation_count": conversation_count})
+            end_users.append({"date": date, "terminal_count": int(row["end_user_count"] or 0)})
+            token_usage.append(
+                {
+                    "date": date,
+                    "token_count": token_count,
+                    "total_price": str(total_price),
+                    "currency": "USD",
+                }
+            )
+            average_session_interactions.append(
+                {
+                    "date": date,
+                    "interactions": round(message_count / conversation_count, 2) if conversation_count else 0,
+                }
+            )
+            average_response_time.append({"date": date, "latency": round(avg_latency * 1000, 4)})
+            tokens_per_second.append({"date": date, "tps": round(answer_tokens / latency_sum, 4) if latency_sum else 0})
+            user_satisfaction_rate.append(
+                {"date": date, "rate": round(like_count * 100 / message_count, 2) if message_count else 0}
+            )
+
+        return {
+            "daily_messages": messages,
+            "daily_conversations": conversations,
+            "daily_end_users": end_users,
+            "token_usage": token_usage,
+            "average_session_interactions": average_session_interactions,
+            "average_response_time": average_response_time,
+            "tokens_per_second": tokens_per_second,
+            "user_satisfaction_rate": user_satisfaction_rate,
+        }
+
+    @staticmethod
+    def _build_summary(rows: list[dict[str, Any]]) -> dict[str, Any]:
+        total_messages = sum(int(row["message_count"] or 0) for row in rows)
+        total_conversations = sum(int(row["conversation_count"] or 0) for row in rows)
+        total_end_users = sum(int(row["end_user_count"] or 0) for row in rows)
+        total_tokens = sum(int(row["token_count"] or 0) for row in rows)
+        total_price = sum(Decimal(str(row["total_price"] or 0)) for row in rows)
+        total_answer_tokens = sum(int(row["answer_tokens"] or 0) for row in rows)
+        total_latency = sum(float(row["latency_sum"] or 0) for row in rows)
+        weighted_latency = sum(float(row["avg_latency"] or 0) * int(row["message_count"] or 0) for row in rows)
+        total_likes = sum(int(row["like_count"] or 0) for row in rows)
+
+        return {
+            "total_messages": total_messages,
+            "total_conversations": total_conversations,
+            "total_end_users": total_end_users,
+            "total_tokens": total_tokens,
+            "total_price": str(total_price),
+            "currency": "USD",
+            "average_session_interactions": round(total_messages / total_conversations, 2)
+            if total_conversations
+            else 0,
+            "average_response_time": round((weighted_latency / total_messages) * 1000, 4) if total_messages else 0,
+            "tokens_per_second": round(total_answer_tokens / total_latency, 4) if total_latency else 0,
+            "user_satisfaction_rate": round(total_likes * 100 / total_messages, 2) if total_messages else 0,
+        }
diff --git a/api/services/agent/roster_service.py b/api/services/agent/roster_service.py
index 21641b2965e..ca8428b4f7c 100644
--- a/api/services/agent/roster_service.py
+++ b/api/services/agent/roster_service.py
@@ -1,6 +1,6 @@
 from typing import Any, TypedDict
 
-from sqlalchemy import func, select
+from sqlalchemy import and_, func, or_, select
 from sqlalchemy.exc import IntegrityError
 
 from libs.datetime_utils import naive_utc_now
@@ -19,7 +19,7 @@ from models.agent import (
 )
 from models.agent_config_entities import AgentSoulConfig
 from models.enums import AppStatus
-from models.model import App, AppMode
+from models.model import App, AppMode, IconType
 from models.workflow import Workflow
 from services.agent.agent_soul_state import agent_soul_has_model
 from services.agent.composer_validator import ComposerConfigValidator
@@ -29,7 +29,10 @@ from services.agent.errors import (
     AgentNotFoundError,
     AgentVersionNotFoundError,
 )
+from services.app_service import AppService, CreateAppParams
+from services.enterprise.enterprise_service import EnterpriseService
 from services.entities.agent_entities import RosterAgentCreatePayload, RosterAgentUpdatePayload
+from services.feature_service import FeatureService
 
 
 class AgentReferencingWorkflow(TypedDict):
@@ -48,6 +51,28 @@ class AgentReferencingWorkflow(TypedDict):
 
 
 class AgentRosterService:
+    _APP_MODEL_CONFIG_COPY_FIELDS = (
+        "opening_statement",
+        "suggested_questions",
+        "suggested_questions_after_answer",
+        "speech_to_text",
+        "text_to_speech",
+        "more_like_this",
+        "model",
+        "user_input_form",
+        "dataset_query_variable",
+        "pre_prompt",
+        "agent_mode",
+        "sensitive_word_avoidance",
+        "retriever_resource",
+        "prompt_type",
+        "chat_prompt_config",
+        "completion_prompt_config",
+        "dataset_configs",
+        "external_data_tools",
+        "file_upload",
+    )
+
     def __init__(self, session: Any):
         self._session = session
 
@@ -56,6 +81,7 @@ class AgentRosterService:
         agent: Agent,
         active_version: AgentConfigSnapshot | None = None,
         published_references: list[AgentReferencingWorkflow] | None = None,
+        active_config_is_published: bool = False,
     ) -> dict[str, Any]:
         published_references = published_references or []
         return {
@@ -74,6 +100,7 @@ class AgentRosterService:
             "workflow_node_id": agent.workflow_node_id,
             "active_config_snapshot_id": agent.active_config_snapshot_id,
             "active_config_snapshot": AgentRosterService.serialize_version(active_version) if active_version else None,
+            "active_config_is_published": active_config_is_published,
             "status": agent.status.value,
             "created_by": agent.created_by,
             "updated_by": agent.updated_by,
@@ -94,12 +121,27 @@ class AgentRosterService:
             "id": version.id,
             "agent_id": version.agent_id,
             "version": version.version,
+            "display_version": version.version,
+            "snapshot_version": version.version,
             "summary": version.summary,
             "version_note": version.version_note,
             "created_by": version.created_by,
             "created_at": to_timestamp(version.created_at),
         }
 
+    @classmethod
+    def _serialize_visible_version(
+        cls,
+        version: AgentConfigSnapshot,
+        *,
+        display_version: int,
+    ) -> dict[str, Any]:
+        payload = cls.serialize_version(version) or {}
+        payload["version"] = display_version
+        payload["display_version"] = display_version
+        payload["snapshot_version"] = version.version
+        return payload
+
     @staticmethod
     def _build_roster_agents_stmt(*, tenant_id: str, keyword: str | None = None):
         stmt = select(Agent).where(
@@ -128,6 +170,10 @@ class AgentRosterService:
             tenant_id=tenant_id,
             agent_ids=[agent.id for agent in agents],
         )
+        active_config_is_published_by_agent_id = self.load_active_config_is_published_by_agent_id(
+            tenant_id=tenant_id,
+            agents=agents,
+        )
 
         data = []
         for agent in agents:
@@ -139,6 +185,7 @@ class AgentRosterService:
                     agent,
                     active_version,
                     published_references_by_agent_id.get(agent.id, []),
+                    active_config_is_published_by_agent_id.get(agent.id, False),
                 )
             )
 
@@ -165,11 +212,16 @@ class AgentRosterService:
             tenant_id=tenant_id,
             agent_ids=[agent.id for agent in agents],
         )
+        active_config_is_published_by_agent_id = self.load_active_config_is_published_by_agent_id(
+            tenant_id=tenant_id,
+            agents=agents,
+        )
         data = [
             self.serialize_agent(
                 agent,
                 versions_by_id.get(agent.active_config_snapshot_id) if agent.active_config_snapshot_id else None,
                 published_references_by_agent_id.get(agent.id, []),
+                active_config_is_published_by_agent_id.get(agent.id, False),
             )
             for agent in agents
         ]
@@ -406,6 +458,142 @@ class AgentRosterService:
             raise AgentNotFoundError()
         return app
 
+    def duplicate_agent_app(
+        self,
+        *,
+        tenant_id: str,
+        agent_id: str,
+        account: Any,
+        name: str | None = None,
+        description: str | None = None,
+        icon_type: Any = None,
+        icon: str | None = None,
+        icon_background: str | None = None,
+    ) -> App:
+        source_app = self.get_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        source_agent = self.get_app_backing_agent(tenant_id=tenant_id, app_id=source_app.id)
+        if source_agent is None:
+            raise AgentNotFoundError()
+
+        copied_name = name or self._next_duplicate_agent_name(tenant_id=tenant_id, base_name=source_app.name)
+        copied_description = description if description is not None else source_app.description
+        copied_icon_type = icon_type if icon_type is not None else source_app.icon_type
+        copied_icon = icon if icon is not None else source_app.icon
+        copied_icon_background = icon_background if icon_background is not None else source_app.icon_background
+
+        target_app = AppService().create_app(
+            tenant_id,
+            CreateAppParams(
+                name=copied_name,
+                description=copied_description,
+                mode="agent",
+                agent_role=source_agent.role or "",
+                icon_type=self._normalize_app_icon_type(copied_icon_type),
+                icon=copied_icon,
+                icon_background=copied_icon_background,
+                api_rph=source_app.api_rph or 0,
+                api_rpm=source_app.api_rpm or 0,
+                max_active_requests=source_app.max_active_requests,
+            ),
+            account,
+        )
+
+        target_app.enable_site = source_app.enable_site
+        target_app.enable_api = source_app.enable_api
+        target_app.use_icon_as_answer_icon = source_app.use_icon_as_answer_icon
+        target_app.tracing = source_app.tracing
+
+        self._copy_app_model_config(source_app=source_app, target_app=target_app, account_id=account.id)
+        self._copy_agent_active_snapshot(
+            tenant_id=tenant_id,
+            source_agent=source_agent,
+            target_app_id=target_app.id,
+            account_id=account.id,
+        )
+        self._session.commit()
+
+        if FeatureService.get_system_features().webapp_auth.enabled:
+            try:
+                original_settings = EnterpriseService.WebAppAuth.get_app_access_mode_by_id(source_app.id)
+                access_mode = original_settings.access_mode
+            except Exception:
+                access_mode = "public"
+            EnterpriseService.WebAppAuth.update_app_access_mode(target_app.id, access_mode)
+
+        return target_app
+
+    @staticmethod
+    def _normalize_app_icon_type(icon_type: IconType | str | None) -> str | None:
+        if icon_type is None:
+            return None
+        if isinstance(icon_type, IconType):
+            return icon_type.value
+        return icon_type
+
+    def _copy_app_model_config(self, *, source_app: App, target_app: App, account_id: str) -> None:
+        source_config = source_app.app_model_config
+        target_config = target_app.app_model_config
+        if source_config is None or target_config is None:
+            return
+
+        for field_name in self._APP_MODEL_CONFIG_COPY_FIELDS:
+            setattr(target_config, field_name, getattr(source_config, field_name))
+        target_config.updated_by = account_id
+
+    def _copy_agent_active_snapshot(
+        self,
+        *,
+        tenant_id: str,
+        source_agent: Agent,
+        target_app_id: str,
+        account_id: str,
+    ) -> None:
+        target_agent = self.get_app_backing_agent(tenant_id=tenant_id, app_id=target_app_id)
+        if target_agent is None:
+            raise AgentNotFoundError()
+
+        source_version = self._get_version(
+            tenant_id=tenant_id,
+            agent_id=source_agent.id,
+            version_id=source_agent.active_config_snapshot_id,
+        )
+        target_version = self._get_version(
+            tenant_id=tenant_id,
+            agent_id=target_agent.id,
+            version_id=target_agent.active_config_snapshot_id,
+        )
+
+        target_version.config_snapshot = AgentSoulConfig.model_validate(source_version.config_snapshot_dict)
+        target_version.summary = source_version.summary
+        target_version.version_note = source_version.version_note
+        target_version.created_by = account_id
+        target_agent.active_config_has_model = agent_soul_has_model(target_version.config_snapshot)
+        target_agent.updated_by = account_id
+
+    def _next_duplicate_agent_name(self, *, tenant_id: str, base_name: str) -> str:
+        suffix = " copy"
+        max_base_len = 255 - len(suffix)
+        first_candidate = f"{base_name[:max_base_len]}{suffix}"
+        candidates = [first_candidate]
+        for index in range(2, 100):
+            numbered_suffix = f" copy {index}"
+            candidates.append(f"{base_name[: 255 - len(numbered_suffix)]}{numbered_suffix}")
+
+        existing_names = set(
+            self._session.scalars(
+                select(Agent.name).where(
+                    Agent.tenant_id == tenant_id,
+                    Agent.scope == AgentScope.ROSTER,
+                    Agent.status == AgentStatus.ACTIVE,
+                    Agent.name.in_(candidates),
+                )
+            ).all()
+        )
+        for candidate in candidates:
+            if candidate not in existing_names:
+                return candidate
+        return f"{base_name[:245]} copy {int(naive_utc_now().timestamp())}"
+
     def list_workflows_referencing_app_agent(self, *, tenant_id: str, app_id: str) -> list[AgentReferencingWorkflow]:
         """List the workflow apps that reference this Agent App's bound Agent.
 
@@ -420,6 +608,12 @@ class AgentRosterService:
 
         return self._load_published_references_by_agent_id(tenant_id=tenant_id, agent_ids=[agent.id]).get(agent.id, [])
 
+    def load_published_references_by_agent_id(
+        self, *, tenant_id: str, agent_ids: list[str]
+    ) -> dict[str, list[AgentReferencingWorkflow]]:
+        """Return published workflow references grouped by roster Agent id."""
+        return self._load_published_references_by_agent_id(tenant_id=tenant_id, agent_ids=agent_ids)
+
     def get_roster_agent_detail(self, *, tenant_id: str, agent_id: str) -> dict[str, Any]:
         agent = self._get_agent(tenant_id=tenant_id, agent_id=agent_id, roster_only=True)
         active_version = self._get_version(
@@ -429,7 +623,16 @@ class AgentRosterService:
             tenant_id=tenant_id,
             agent_ids=[agent.id],
         )
-        return self.serialize_agent(agent, active_version, published_references_by_agent_id.get(agent.id, []))
+        active_config_is_published_by_agent_id = self.load_active_config_is_published_by_agent_id(
+            tenant_id=tenant_id,
+            agents=[agent],
+        )
+        return self.serialize_agent(
+            agent,
+            active_version,
+            published_references_by_agent_id.get(agent.id, []),
+            active_config_is_published_by_agent_id.get(agent.id, False),
+        )
 
     def update_roster_agent(
         self, *, tenant_id: str, agent_id: str, account_id: str, payload: RosterAgentUpdatePayload
@@ -471,17 +674,21 @@ class AgentRosterService:
             AgentConfigRevisionOperation.SAVE_TO_ROSTER,
         }
 
+    def active_config_is_published(self, *, tenant_id: str, agent: Agent) -> bool:
+        """Return whether the Agent's current active snapshot is a visible published version."""
+        return self.load_active_config_is_published_by_agent_id(tenant_id=tenant_id, agents=[agent]).get(
+            agent.id,
+            False,
+        )
+
+    def load_active_config_is_published_by_agent_id(self, *, tenant_id: str, agents: list[Agent]) -> dict[str, bool]:
+        """Return publish-state flags for the active config snapshots of the given Agents."""
+        published_agent_ids = self._load_published_active_snapshot_agent_ids(tenant_id=tenant_id, agents=agents)
+        return {agent.id: agent.id in published_agent_ids for agent in agents}
+
     def list_agent_versions(self, *, tenant_id: str, agent_id: str) -> list[dict[str, Any]]:
         agent = self._get_agent(tenant_id=tenant_id, agent_id=agent_id, roster_only=True)
-        visible_version_ids = (
-            select(AgentConfigRevision.current_snapshot_id)
-            .where(
-                AgentConfigRevision.tenant_id == tenant_id,
-                AgentConfigRevision.agent_id == agent_id,
-                AgentConfigRevision.operation.in_(self._visible_version_operations(agent)),
-            )
-            .subquery()
-        )
+        visible_version_ids = self._visible_version_ids_stmt(tenant_id=tenant_id, agent_id=agent_id, agent=agent)
         versions = list(
             self._session.scalars(
                 select(AgentConfigSnapshot)
@@ -493,25 +700,39 @@ class AgentRosterService:
                 .order_by(AgentConfigSnapshot.version.desc())
             ).all()
         )
+        total = len(versions)
         return [
-            serialized_version
-            for version in versions
-            if (serialized_version := self.serialize_version(version)) is not None
+            self._serialize_visible_version(version, display_version=total - index)
+            for index, version in enumerate(versions)
         ]
 
-    def get_agent_version_detail(self, *, tenant_id: str, agent_id: str, version_id: str) -> dict[str, Any]:
-        agent = self._get_agent(tenant_id=tenant_id, agent_id=agent_id, roster_only=True)
-        visible_revision_id = self._session.scalar(
-            select(AgentConfigRevision.id)
+    def _visible_version_ids_stmt(self, *, tenant_id: str, agent_id: str, agent: Agent):
+        return (
+            select(AgentConfigRevision.current_snapshot_id)
             .where(
                 AgentConfigRevision.tenant_id == tenant_id,
                 AgentConfigRevision.agent_id == agent_id,
-                AgentConfigRevision.current_snapshot_id == version_id,
                 AgentConfigRevision.operation.in_(self._visible_version_operations(agent)),
             )
-            .limit(1)
+            .subquery()
         )
-        if not visible_revision_id:
+
+    def get_agent_version_detail(self, *, tenant_id: str, agent_id: str, version_id: str) -> dict[str, Any]:
+        agent = self._get_agent(tenant_id=tenant_id, agent_id=agent_id, roster_only=True)
+        visible_version_ids = self._visible_version_ids_stmt(tenant_id=tenant_id, agent_id=agent_id, agent=agent)
+        visible_versions = list(
+            self._session.scalars(
+                select(AgentConfigSnapshot)
+                .where(
+                    AgentConfigSnapshot.tenant_id == tenant_id,
+                    AgentConfigSnapshot.agent_id == agent_id,
+                    AgentConfigSnapshot.id.in_(select(visible_version_ids.c.current_snapshot_id)),
+                )
+                .order_by(AgentConfigSnapshot.version.asc())
+            ).all()
+        )
+        display_versions_by_id = {version.id: index for index, version in enumerate(visible_versions, start=1)}
+        if version_id not in display_versions_by_id:
             raise AgentVersionNotFoundError()
         version = self._get_version(tenant_id=tenant_id, agent_id=agent_id, version_id=version_id)
         revisions = list(
@@ -525,7 +746,7 @@ class AgentRosterService:
                 .order_by(AgentConfigRevision.revision.desc())
             ).all()
         )
-        result = self.serialize_version(version) or {}
+        result = self._serialize_visible_version(version, display_version=display_versions_by_id[version_id])
         result["config_snapshot"] = version.config_snapshot_dict
         result["revisions"] = [
             {
@@ -568,6 +789,29 @@ class AgentRosterService:
             raise AgentVersionNotFoundError()
         return version
 
+    def _load_published_active_snapshot_agent_ids(self, *, tenant_id: str, agents: list[Agent]) -> set[str]:
+        predicates = [
+            and_(
+                AgentConfigRevision.agent_id == agent.id,
+                AgentConfigRevision.current_snapshot_id == agent.active_config_snapshot_id,
+                AgentConfigRevision.operation.in_(self._visible_version_operations(agent)),
+            )
+            for agent in agents
+            if agent.active_config_snapshot_id
+        ]
+        if not predicates:
+            return set()
+
+        agent_ids = self._session.scalars(
+            select(AgentConfigRevision.agent_id)
+            .where(
+                AgentConfigRevision.tenant_id == tenant_id,
+                or_(*predicates),
+            )
+            .distinct()
+        ).all()
+        return set(agent_ids)
+
     def _load_published_references_by_agent_id(
         self, *, tenant_id: str, agent_ids: list[str]
     ) -> dict[str, list[AgentReferencingWorkflow]]:
diff --git a/api/services/agent/skill_standardize_service.py b/api/services/agent/skill_standardize_service.py
index 71bb8daded9..b83004f3c4b 100644
--- a/api/services/agent/skill_standardize_service.py
+++ b/api/services/agent/skill_standardize_service.py
@@ -10,7 +10,9 @@ to the agent drive (Agent Files §5.4 / §4):
 Both are stored as ``ToolFile`` records and bound via ``AgentDriveService.commit``
 with ``value_owned_by_drive=True`` (the drive owns their lifecycle). The returned
 skill ref records the stable drive paths + file ids (not just the raw upload id),
-so the Composer can reload the bound skill list.
+so the Composer can reload the bound skill list. The console ``/skills/upload``
+endpoints delegate to this service so "upload" now always means drive-backed skill
+normalization.
 """
 
 from __future__ import annotations
@@ -34,7 +36,7 @@ def slugify_skill_name(name: str) -> str:
 
 
 class SkillStandardizeService:
-    """Validate + standardize a Skill package into a per-agent drive."""
+    """Validate + standardize a Skill package into a per-agent drive upload result."""
 
     def __init__(
         self,
diff --git a/api/services/agent_app_feature_service.py b/api/services/agent_app_feature_service.py
index cc0fe67802d..b8e98653c8e 100644
--- a/api/services/agent_app_feature_service.py
+++ b/api/services/agent_app_feature_service.py
@@ -13,6 +13,8 @@ from __future__ import annotations
 
 from typing import Any, cast
 
+from sqlalchemy.orm import scoped_session
+
 from core.app.app_config.common.sensitive_word_avoidance.manager import SensitiveWordAvoidanceConfigManager
 from core.app.app_config.features.opening_statement.manager import OpeningStatementConfigManager
 from core.app.app_config.features.retrieval_resource.manager import RetrievalResourceConfigManager
@@ -21,7 +23,6 @@ from core.app.app_config.features.suggested_questions_after_answer.manager impor
     SuggestedQuestionsAfterAnswerConfigManager,
 )
 from core.app.app_config.features.text_to_speech.manager import TextToSpeechConfigManager
-from extensions.ext_database import db
 from libs.datetime_utils import naive_utc_now
 from models.account import Account
 from models.model import App, AppModelConfig, AppModelConfigDict
@@ -67,7 +68,9 @@ class AgentAppFeatureConfigService:
         return cast(AppModelConfigDict, filtered)
 
     @classmethod
-    def update_features(cls, *, app_model: App, account: Account, config: dict[str, Any]) -> AppModelConfig:
+    def update_features(
+        cls, *, app_model: App, account: Account, config: dict[str, Any], session: scoped_session
+    ) -> AppModelConfig:
         """Persist the presentation features as a new app_model_config version.
 
         Returns the new ``AppModelConfig`` row (now referenced by the app); the
@@ -82,13 +85,13 @@ class AgentAppFeatureConfigService:
             updated_by=account.id,
         ).from_model_config_dict(validated)
 
-        db.session.add(new_config)
-        db.session.flush()
+        session.add(new_config)
+        session.flush()
 
         app_model.app_model_config_id = new_config.id
         app_model.updated_by = account.id
         app_model.updated_at = naive_utc_now()
-        db.session.commit()
+        session.commit()
 
         return new_config
 
diff --git a/api/services/agent_drive_service.py b/api/services/agent_drive_service.py
index 276f6339b8f..bb3f8ca69e3 100644
--- a/api/services/agent_drive_service.py
+++ b/api/services/agent_drive_service.py
@@ -19,6 +19,7 @@ from __future__ import annotations
 
 import logging
 import re
+import urllib.parse
 from typing import Any, Literal
 
 from pydantic import BaseModel
@@ -386,7 +387,12 @@ class AgentDriveService:
 
     @staticmethod
     def _resolve_download_url(
-        *, tenant_id: str, file_kind: AgentDriveFileKind, file_id: str, for_external: bool = False
+        *,
+        tenant_id: str,
+        file_kind: AgentDriveFileKind,
+        file_id: str,
+        for_external: bool = False,
+        as_attachment: bool = False,
     ) -> str | None:
         """Signed URL for a drive value. ``for_external`` selects the audience:
         the inner manifest hands agents *internal* URLs, while the console
@@ -398,10 +404,22 @@ class AgentDriveService:
         controller = DatabaseFileAccessController()
         runtime = DifyWorkflowFileRuntime(file_access_controller=controller)
         try:
+            if file_kind == AgentDriveFileKind.UPLOAD_FILE:
+                return runtime.resolve_upload_file_url(
+                    upload_file_id=file_id,
+                    for_external=for_external,
+                    as_attachment=as_attachment,
+                )
             # No FileAccessScope bound -> drive-owned: the builders still filter by
             # tenant_id, so resolution is tenant-scoped without user-level checks.
             file = file_factory.build_from_mapping(mapping=mapping, tenant_id=tenant_id, access_controller=controller)
-            return runtime.resolve_file_url(file=file, for_external=for_external)
+            url = runtime.resolve_file_url(file=file, for_external=for_external)
+            if as_attachment and url:
+                parsed = urllib.parse.urlsplit(url)
+                query = urllib.parse.parse_qsl(parsed.query, keep_blank_values=True)
+                query.append(("as_attachment", "true"))
+                return urllib.parse.urlunsplit(parsed._replace(query=urllib.parse.urlencode(query)))
+            return url
         except ValueError:
             return None
 
@@ -475,7 +493,11 @@ class AgentDriveService:
             self._assert_agent_belongs_to_tenant(session, tenant_id=tenant_id, agent_id=agent_id)
             row = self._require_row(session, tenant_id=tenant_id, agent_id=agent_id, key=key)
             url = self._resolve_download_url(
-                tenant_id=tenant_id, file_kind=row.file_kind, file_id=row.file_id, for_external=True
+                tenant_id=tenant_id,
+                file_kind=row.file_kind,
+                file_id=row.file_id,
+                for_external=True,
+                as_attachment=True,
             )
         if url is None:
             raise AgentDriveError("drive_key_not_found", "drive value cannot be resolved", status_code=404)
diff --git a/api/services/api_based_extension_service.py b/api/services/api_based_extension_service.py
index fdb377694bb..25f554b6bdc 100644
--- a/api/services/api_based_extension_service.py
+++ b/api/services/api_based_extension_service.py
@@ -1,16 +1,16 @@
 from sqlalchemy import select
+from sqlalchemy.orm import Session
 
 from core.extension.api_based_extension_requestor import APIBasedExtensionRequestor
 from core.helper.encrypter import decrypt_token, encrypt_token
-from extensions.ext_database import db
 from models.api_based_extension import APIBasedExtension, APIBasedExtensionPoint
 
 
 class APIBasedExtensionService:
     @staticmethod
-    def get_all_by_tenant_id(tenant_id: str) -> list[APIBasedExtension]:
+    def get_all_by_tenant_id(session: Session, tenant_id: str) -> list[APIBasedExtension]:
         extension_list = list(
-            db.session.scalars(
+            session.scalars(
                 select(APIBasedExtension)
                 .where(APIBasedExtension.tenant_id == tenant_id)
                 .order_by(APIBasedExtension.created_at.desc())
@@ -23,23 +23,23 @@ class APIBasedExtensionService:
         return extension_list
 
     @classmethod
-    def save(cls, extension_data: APIBasedExtension) -> APIBasedExtension:
-        cls._validation(extension_data)
+    def save(cls, session: Session, extension_data: APIBasedExtension) -> APIBasedExtension:
+        cls._validation(session, extension_data)
 
         extension_data.api_key = encrypt_token(extension_data.tenant_id, extension_data.api_key)
 
-        db.session.add(extension_data)
-        db.session.commit()
+        session.add(extension_data)
+        session.commit()
         return extension_data
 
     @staticmethod
-    def delete(extension_data: APIBasedExtension):
-        db.session.delete(extension_data)
-        db.session.commit()
+    def delete(session: Session, extension_data: APIBasedExtension):
+        session.delete(extension_data)
+        session.commit()
 
     @staticmethod
-    def get_with_tenant_id(tenant_id: str, api_based_extension_id: str) -> APIBasedExtension:
-        extension = db.session.scalar(
+    def get_with_tenant_id(session: Session, tenant_id: str, api_based_extension_id: str) -> APIBasedExtension:
+        extension = session.scalar(
             select(APIBasedExtension)
             .where(APIBasedExtension.tenant_id == tenant_id, APIBasedExtension.id == api_based_extension_id)
             .limit(1)
@@ -53,14 +53,14 @@ class APIBasedExtensionService:
         return extension
 
     @classmethod
-    def _validation(cls, extension_data: APIBasedExtension):
+    def _validation(cls, session: Session, extension_data: APIBasedExtension):
         # name
         if not extension_data.name:
             raise ValueError("name must not be empty")
 
         if not extension_data.id:
             # case one: check new data, name must be unique
-            is_name_existed = db.session.scalar(
+            is_name_existed = session.scalar(
                 select(APIBasedExtension)
                 .where(
                     APIBasedExtension.tenant_id == extension_data.tenant_id,
@@ -73,7 +73,7 @@ class APIBasedExtensionService:
                 raise ValueError("name must be unique, it is already existed")
         else:
             # case two: check existing data, name must be unique
-            is_name_existed = db.session.scalar(
+            is_name_existed = session.scalar(
                 select(APIBasedExtension)
                 .where(
                     APIBasedExtension.tenant_id == extension_data.tenant_id,
diff --git a/api/services/app_dsl_service.py b/api/services/app_dsl_service.py
index e69cff6a294..52e936bf1ee 100644
--- a/api/services/app_dsl_service.py
+++ b/api/services/app_dsl_service.py
@@ -11,7 +11,7 @@ import yaml
 from Crypto.Cipher import AES
 from Crypto.Util.Padding import pad, unpad
 from packaging.version import parse as parse_version
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
@@ -60,6 +60,7 @@ class Import(BaseModel):
     status: ImportStatus
     app_id: str | None = None
     app_mode: str | None = None
+    permission_keys: list[str] = Field(default_factory=list)
     current_dsl_version: str = CURRENT_DSL_VERSION
     imported_dsl_version: str = ""
     error: str = ""
@@ -433,6 +434,7 @@ class AppDslService:
             app.enable_api = True
             app.use_icon_as_answer_icon = app_data.get("use_icon_as_answer_icon", False)
             app.created_by = account.id
+            app.maintainer = account.id
             app.updated_by = account.id
 
             self._session.add(app)
diff --git a/api/services/app_service.py b/api/services/app_service.py
index c435a672520..941855b8321 100644
--- a/api/services/app_service.py
+++ b/api/services/app_service.py
@@ -7,7 +7,8 @@ from typing import Any, Literal, NotRequired, TypedDict, cast, override
 import sqlalchemy as sa
 from flask_sqlalchemy.pagination import Pagination
 from pydantic import BaseModel, Field
-from sqlalchemy import select
+from sqlalchemy import ColumnElement, select
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session, scoped_session
 
 from configs import dify_config
@@ -27,7 +28,9 @@ from models import Account, AppStar
 from models.agent import Agent, AgentIconType, AgentScope, AgentSource, AgentStatus
 from models.model import App, AppMode, AppModelConfig, IconType, Site
 from models.tools import ApiToolProvider
+from services.agent.errors import AgentNameConflictError
 from services.billing_service import BillingService
+from services.enterprise import rbac_service as enterprise_rbac_service
 from services.enterprise.enterprise_service import EnterpriseService
 from services.feature_service import FeatureService
 from services.openapi.visibility import apply_openapi_gate, is_openapi_visible
@@ -48,6 +51,8 @@ class AppListBaseParams(BaseModel):
     tag_ids: list[str] | None = None
     creator_ids: list[str] | None = None
     is_created_by_me: bool | None = None
+    accessible_app_ids: list[str] | None = None
+    include_own_apps: bool = False
 
 
 class AppListParams(AppListBaseParams):
@@ -75,7 +80,7 @@ class CreateAppParams(BaseModel):
 class AppService:
     @staticmethod
     def _build_app_list_filters(
-        user_id: str, tenant_id: str, params: AppListBaseParams
+        user_id: str, tenant_id: str, params: AppListBaseParams, session: scoped_session
     ) -> list[sa.ColumnElement[bool]]:
         filters = [App.tenant_id == tenant_id, App.is_universal == False]
 
@@ -106,6 +111,11 @@ class AppService:
 
         if params.is_created_by_me:
             filters.append(App.created_by == user_id)
+        elif params.accessible_app_ids is not None:
+            accessible_filter: ColumnElement[bool] = App.id.in_(params.accessible_app_ids)
+            if params.include_own_apps:
+                accessible_filter = sa.or_(App.maintainer == user_id, accessible_filter)
+            filters.append(accessible_filter)
         if params.creator_ids:
             filters.append(App.created_by.in_(params.creator_ids))
         if params.name:
@@ -115,7 +125,7 @@ class AppService:
             escaped_name = escape_like_pattern(name)
             filters.append(App.name.ilike(f"%{escaped_name}%", escape="\\"))
         if params.tag_ids and len(params.tag_ids) > 0:
-            target_ids = TagService.get_target_ids_by_tag_ids("app", tenant_id, params.tag_ids, match_all=True)
+            target_ids = TagService.get_target_ids_by_tag_ids("app", tenant_id, params.tag_ids, session, match_all=True)
             if target_ids and len(target_ids) > 0:
                 filters.append(App.id.in_(target_ids))
             else:
@@ -197,7 +207,9 @@ class AppService:
             ).scalars()
         )
 
-    def get_paginate_apps(self, user_id: str, tenant_id: str, params: AppListParams) -> Pagination | None:
+    def get_paginate_apps(
+        self, user_id: str, tenant_id: str, params: AppListParams, session: scoped_session
+    ) -> Pagination | None:
         """
         Get app list with pagination, filters, and explicit sort order.
         :param user_id: user id
@@ -205,7 +217,7 @@ class AppService:
         :param params: query parameters
         :return:
         """
-        filters = self._build_app_list_filters(user_id, tenant_id, params)
+        filters = self._build_app_list_filters(user_id, tenant_id, params, session)
         if not filters:
             return None
 
@@ -231,12 +243,12 @@ class AppService:
         return app_models
 
     def get_paginate_starred_apps(
-        self, user_id: str, tenant_id: str, params: StarredAppListParams
+        self, user_id: str, tenant_id: str, params: StarredAppListParams, session: scoped_session
     ) -> Pagination | None:
         """
         Get apps starred by the current account with pagination, filters, and explicit sort order.
         """
-        filters = self._build_app_list_filters(user_id, tenant_id, params)
+        filters = self._build_app_list_filters(user_id, tenant_id, params, session)
         if not filters:
             return None
 
@@ -373,6 +385,7 @@ class AppService:
         app.api_rpm = params.api_rpm
         app.max_active_requests = params.max_active_requests
         app.created_by = account.id
+        app.maintainer = account.id
         app.updated_by = account.id
 
         db.session.add(app)
@@ -424,6 +437,12 @@ class AppService:
         db.session.commit()
 
         app_was_created.send(app, account=account)
+        enterprise_rbac_service.try_sync_creator_access_policy_member_bindings(
+            tenant_id,
+            account.id,
+            enterprise_rbac_service.RBACResourceType.APP,
+            app.id,
+        )
 
         if FeatureService.get_system_features().webapp_auth.enabled:
             # update web app setting as private
@@ -540,17 +559,21 @@ class AppService:
         *,
         name: str | None = None,
         description: str | None = None,
+        role: str | None = None,
         icon_type: IconType | str | None = None,
         icon: str | None = None,
         icon_background: str | None = None,
-        role: str | None = None,
         account_id: str | None = None,
         updated_at: datetime | None = None,
     ) -> None:
         """Keep the Roster identity aligned with its Agent App shell.
 
         Agent Soul remains versioned through Composer. This helper only mirrors
-        user-facing identity fields so Roster and Agent Console do not drift.
+        user-facing identity fields, including the roster role/persona label,
+        so Roster and Agent Console do not drift.
+
+        Role omission is intentional: ``role=None`` preserves the backing
+        Agent's current role, while ``role=""`` explicitly clears it.
         """
         agent = self._get_backing_agent_for_update(app)
         if agent is None:
@@ -560,18 +583,28 @@ class AppService:
             agent.name = name
         if description is not None:
             agent.description = description
+        if role is not None:
+            agent.role = role
         if icon_type is not None:
             agent.icon_type = self._to_agent_icon_type(icon_type)
         if icon is not None:
             agent.icon = icon
         if icon_background is not None:
             agent.icon_background = icon_background
-        if role is not None:
-            agent.role = role
         agent.updated_by = account_id
         if updated_at is not None:
             agent.updated_at = updated_at
 
+    @staticmethod
+    def _commit_app_identity_update(app: App) -> None:
+        try:
+            db.session.commit()
+        except IntegrityError as exc:
+            db.session.rollback()
+            if app.mode == AppMode.AGENT:
+                raise AgentNameConflictError() from exc
+            raise
+
     def update_app(self, app: App, args: ArgsDict) -> App:
         """
         Update app
@@ -599,14 +632,16 @@ class AppService:
             app,
             name=app.name,
             description=app.description,
+            # Omitted role must stay omitted here: None means "preserve current
+            # backing-agent role", while an empty string is an explicit clear.
+            role=args.get("role"),
             icon_type=app.icon_type,
             icon=app.icon,
             icon_background=app.icon_background,
-            role=args.get("role"),
             account_id=current_user.id,
             updated_at=app.updated_at,
         )
-        db.session.commit()
+        self._commit_app_identity_update(app)
 
         app_was_updated.send(app)
 
@@ -629,7 +664,7 @@ class AppService:
             account_id=current_user.id,
             updated_at=app.updated_at,
         )
-        db.session.commit()
+        self._commit_app_identity_update(app)
 
         app_was_updated.send(app)
 
diff --git a/api/services/attachment_service.py b/api/services/attachment_service.py
index dad7163739f..4129613b2fe 100644
--- a/api/services/attachment_service.py
+++ b/api/services/attachment_service.py
@@ -14,12 +14,13 @@ class AttachmentService:
     _session_maker: sessionmaker
 
     def __init__(self, session_factory: sessionmaker | Engine | None = None):
-        if isinstance(session_factory, Engine):
-            self._session_maker = sessionmaker(bind=session_factory)
-        elif isinstance(session_factory, sessionmaker):
-            self._session_maker = session_factory
-        else:
-            raise AssertionError("must be a sessionmaker or an Engine.")
+        match session_factory:
+            case Engine():
+                self._session_maker = sessionmaker(bind=session_factory)
+            case sessionmaker():
+                self._session_maker = session_factory
+            case _:
+                raise AssertionError("must be a sessionmaker or an Engine.")
 
     def get_file_base64(self, file_id: str) -> str:
         with self._session_maker(expire_on_commit=False) as session:
diff --git a/api/services/dataset_service.py b/api/services/dataset_service.py
index af50a0e3180..a8f341fdd04 100644
--- a/api/services/dataset_service.py
+++ b/api/services/dataset_service.py
@@ -12,8 +12,8 @@ from typing import Annotated, Any, Literal, TypedDict, cast
 import sqlalchemy as sa
 from pydantic import BaseModel, ConfigDict, Field, ValidationError, field_validator
 from redis.exceptions import LockNotOwnedError
-from sqlalchemy import delete, exists, func, select, update
-from sqlalchemy.orm import Session, sessionmaker
+from sqlalchemy import ColumnElement, delete, exists, func, select, update
+from sqlalchemy.orm import Session, scoped_session, sessionmaker
 from werkzeug.exceptions import Forbidden, NotFound
 
 from configs import dify_config
@@ -67,6 +67,7 @@ from models.source import DataSourceOauthBinding
 from models.workflow import Workflow
 from services.document_indexing_proxy.document_indexing_task_proxy import DocumentIndexingTaskProxy
 from services.document_indexing_proxy.duplicate_document_indexing_task_proxy import DuplicateDocumentIndexingTaskProxy
+from services.enterprise import rbac_service as enterprise_rbac_service
 from services.entities.knowledge_entities.knowledge_entities import (
     ChildChunkUpdateArgs,
     KnowledgeConfig,
@@ -235,9 +236,36 @@ class _EstimateArgs(BaseModel):
 
 class DatasetService:
     @staticmethod
-    def get_datasets(page, per_page, tenant_id=None, user=None, search=None, tag_ids=None, include_all=False):
+    def _can_manage_all_datasets(tenant_id: str, account_id: str) -> bool:
+        if not dify_config.RBAC_ENABLED:
+            return False
+
+        permissions = enterprise_rbac_service.RBACService.MyPermissions.get(tenant_id, account_id)
+        workspace_permission_keys = getattr(getattr(permissions, "workspace", None), "permission_keys", []) or []
+        return "dataset.create_and_management" in workspace_permission_keys
+
+    @staticmethod
+    def get_datasets(
+        page,
+        per_page,
+        session: scoped_session | Session | None = None,
+        tenant_id=None,
+        user=None,
+        search=None,
+        tag_ids=None,
+        include_all=False,
+        accessible_dataset_ids: list[str] | None = None,
+        include_own_datasets: bool = False,
+    ):
+        session = session or db.session
         query = select(Dataset).where(Dataset.tenant_id == tenant_id).order_by(Dataset.created_at.desc(), Dataset.id)
 
+        if dify_config.RBAC_ENABLED and accessible_dataset_ids is not None:
+            accessible_filter: ColumnElement[bool] = Dataset.id.in_(accessible_dataset_ids)
+            if include_own_datasets and user:
+                accessible_filter = sa.or_(Dataset.maintainer == user.id, accessible_filter)
+            query = query.where(accessible_filter)
+
         if user:
             # get permitted dataset ids
             dataset_permission = db.session.scalars(
@@ -246,8 +274,7 @@ class DatasetService:
                 )
             ).all()
             permitted_dataset_ids = {dp.dataset_id for dp in dataset_permission} if dataset_permission else None
-
-            if user.current_role == TenantAccountRole.DATASET_OPERATOR:
+            if not dify_config.RBAC_ENABLED and user.current_role == TenantAccountRole.DATASET_OPERATOR:
                 # only show datasets that the user has permission to access
                 # Check if permitted_dataset_ids is not empty to avoid WHERE false condition
                 if permitted_dataset_ids and len(permitted_dataset_ids) > 0:
@@ -255,34 +282,50 @@ class DatasetService:
                 else:
                     return [], 0
             else:
-                if user.current_role != TenantAccountRole.OWNER or not include_all:
-                    # show all datasets that the user has permission to access
-                    # Check if permitted_dataset_ids is not empty to avoid WHERE false condition
-                    if permitted_dataset_ids and len(permitted_dataset_ids) > 0:
-                        query = query.where(
-                            sa.or_(
-                                Dataset.permission == DatasetPermissionEnum.ALL_TEAM,
-                                sa.and_(
-                                    Dataset.permission == DatasetPermissionEnum.ONLY_ME, Dataset.created_by == user.id
-                                ),
-                                sa.and_(
-                                    Dataset.permission == DatasetPermissionEnum.PARTIAL_TEAM,
-                                    Dataset.id.in_(permitted_dataset_ids),
-                                ),
-                            )
-                        )
+                if dify_config.RBAC_ENABLED:
+                    can_manage_all_datasets = DatasetService._can_manage_all_datasets(str(tenant_id), str(user.id))
+                    should_show_all_datasets = include_all and can_manage_all_datasets
+                else:
+                    should_show_all_datasets = user.current_role == TenantAccountRole.OWNER and include_all
+
+                if not should_show_all_datasets:
+                    if dify_config.RBAC_ENABLED:
+                        # RBAC mode: show all datasets.  Permission control is enforced
+                        # via permission_keys on each item and @rbac_permission_required decorators.
+                        pass
                     else:
-                        query = query.where(
-                            sa.or_(
-                                Dataset.permission == DatasetPermissionEnum.ALL_TEAM,
-                                sa.and_(
-                                    Dataset.permission == DatasetPermissionEnum.ONLY_ME, Dataset.created_by == user.id
-                                ),
+                        # Keep legacy visibility rules when RBAC is disabled.
+                        if permitted_dataset_ids and len(permitted_dataset_ids) > 0:
+                            query = query.where(
+                                sa.or_(
+                                    Dataset.permission == DatasetPermissionEnum.ALL_TEAM,
+                                    sa.and_(
+                                        Dataset.permission == DatasetPermissionEnum.ONLY_ME,
+                                        Dataset.maintainer == user.id,
+                                    ),
+                                    sa.and_(
+                                        Dataset.permission == DatasetPermissionEnum.PARTIAL_TEAM,
+                                        Dataset.id.in_(permitted_dataset_ids),
+                                    ),
+                                )
+                            )
+                        else:
+                            query = query.where(
+                                sa.or_(
+                                    Dataset.permission == DatasetPermissionEnum.ALL_TEAM,
+                                    sa.and_(
+                                        Dataset.permission == DatasetPermissionEnum.ONLY_ME,
+                                        Dataset.maintainer == user.id,
+                                    ),
+                                )
                             )
-                        )
         else:
-            # if no user, only show datasets that are shared with all team members
-            query = query.where(Dataset.permission == DatasetPermissionEnum.ALL_TEAM)
+            if dify_config.RBAC_ENABLED:
+                # Without an account we cannot resolve RBAC resource visibility.
+                query = query.where(sa.false())
+            else:
+                # if no user, only show datasets that are shared with all team members
+                query = query.where(Dataset.permission == DatasetPermissionEnum.ALL_TEAM)
 
         if search:
             escaped_search = helper.escape_like_pattern(search)
@@ -295,6 +338,7 @@ class DatasetService:
                     "knowledge",
                     tenant_id,
                     tag_ids,
+                    session,
                     match_all=True,
                 )
             else:
@@ -326,12 +370,28 @@ class DatasetService:
         return {"mode": mode, "rules": rules}
 
     @staticmethod
-    def get_datasets_by_ids(ids, tenant_id):
+    def get_datasets_by_ids(
+        ids,
+        tenant_id,
+        user=None,
+        accessible_dataset_ids: list[str] | None = None,
+        include_own_datasets: bool = False,
+    ):
         # Check if ids is not empty to avoid WHERE false condition
         if not ids or len(ids) == 0:
             return [], 0
         stmt = select(Dataset).where(Dataset.id.in_(ids), Dataset.tenant_id == tenant_id)
 
+        if dify_config.RBAC_ENABLED and accessible_dataset_ids is not None:
+            requested_dataset_ids = set(ids)
+            accessible_dataset_ids = [
+                dataset_id for dataset_id in accessible_dataset_ids if dataset_id in requested_dataset_ids
+            ]
+            accessible_filter: ColumnElement[bool] = Dataset.id.in_(accessible_dataset_ids)
+            if include_own_datasets and user:
+                accessible_filter = sa.or_(Dataset.maintainer == user.id, accessible_filter)
+            stmt = stmt.where(accessible_filter)
+
         datasets = db.paginate(select=stmt, page=1, per_page=len(ids), max_per_page=len(ids), error_out=False)
 
         return datasets.items, datasets.total
@@ -389,6 +449,7 @@ class DatasetService:
         # dataset = Dataset(name=name, provider=provider, config=config)
         dataset.description = description
         dataset.created_by = account.id
+        dataset.maintainer = account.id
         dataset.updated_by = account.id
         dataset.tenant_id = tenant_id
         dataset.embedding_model_provider = embedding_model.provider if embedding_model else None
@@ -419,6 +480,12 @@ class DatasetService:
             db.session.add(external_knowledge_binding)
 
         db.session.commit()
+        enterprise_rbac_service.try_sync_creator_access_policy_member_bindings(
+            tenant_id,
+            account.id,
+            enterprise_rbac_service.RBACResourceType.DATASET,
+            dataset.id,
+        )
         return dataset
 
     @staticmethod
@@ -464,6 +531,7 @@ class DatasetService:
             runtime_mode=DatasetRuntimeMode.RAG_PIPELINE,
             icon_info=rag_pipeline_dataset_create_entity.icon_info.model_dump(),
             created_by=current_user.id,
+            maintainer=current_user.id,
             pipeline_id=pipeline.id,
         )
         db.session.add(dataset)
@@ -1262,12 +1330,12 @@ class DatasetService:
             logger.debug("User %s does not have permission to access dataset %s", user.id, dataset.id)
             raise NoPermissionError("You do not have permission to access this dataset.")
         if user.current_role != TenantAccountRole.OWNER:
-            if dataset.permission == DatasetPermissionEnum.ONLY_ME and dataset.created_by != user.id:
+            if dataset.permission == DatasetPermissionEnum.ONLY_ME and dataset.maintainer != user.id:
                 logger.debug("User %s does not have permission to access dataset %s", user.id, dataset.id)
                 raise NoPermissionError("You do not have permission to access this dataset.")
             if dataset.permission == DatasetPermissionEnum.PARTIAL_TEAM:
-                # For partial team permission, user needs explicit permission or be the creator
-                if dataset.created_by != user.id:
+                # For partial team permission, user needs explicit permission or be the maintainer.
+                if dataset.maintainer != user.id:
                     user_permission = db.session.scalar(
                         select(DatasetPermission)
                         .where(DatasetPermission.dataset_id == dataset.id, DatasetPermission.account_id == user.id)
@@ -1287,7 +1355,7 @@ class DatasetService:
 
         if user.current_role != TenantAccountRole.OWNER:
             if dataset.permission == DatasetPermissionEnum.ONLY_ME:
-                if dataset.created_by != user.id:
+                if dataset.maintainer != user.id:
                     raise NoPermissionError("You do not have permission to access this dataset.")
 
             elif dataset.permission == DatasetPermissionEnum.PARTIAL_TEAM:
@@ -1710,7 +1778,7 @@ class DocumentService:
             invalid_source_message="Document does not have an uploaded file to download.",
             missing_file_message="Uploaded file not found.",
         )
-        upload_files_by_id = FileService.get_upload_files_by_ids(document.tenant_id, [upload_file_id])
+        upload_files_by_id = FileService.get_upload_files_by_ids(db.session(), document.tenant_id, [upload_file_id])
         upload_file = upload_files_by_id.get(upload_file_id)
         if not upload_file:
             raise NotFound("Uploaded file not found.")
@@ -1749,7 +1817,7 @@ class DocumentService:
             upload_file_ids.append(upload_file_id)
             upload_file_ids_by_document_id[document_id] = upload_file_id
 
-        upload_files_by_id = FileService.get_upload_files_by_ids(tenant_id, upload_file_ids)
+        upload_files_by_id = FileService.get_upload_files_by_ids(db.session(), tenant_id, upload_file_ids)
         missing_upload_file_ids: set[str] = set(upload_file_ids) - set(upload_files_by_id.keys())
         if missing_upload_file_ids:
             raise NotFound("Only uploaded-file documents can be downloaded as ZIP.")
@@ -2032,14 +2100,7 @@ class DocumentService:
                         website_info = knowledge_config.data_source.info_list.website_info_list
                         assert website_info
                         count = len(website_info.urls)
-                    batch_upload_limit = int(dify_config.BATCH_UPLOAD_LIMIT)
-
-                    if features.billing.subscription.plan == CloudPlan.SANDBOX and count > 1:
-                        raise ValueError("Your current plan does not support batch upload, please upgrade your plan.")
-                    if count > batch_upload_limit:
-                        raise ValueError(f"You have reached the batch upload limit of {batch_upload_limit}.")
-
-                    DocumentService.check_documents_upload_quota(count, features)
+                    DocumentService.check_document_creation_limits(count, features)
 
         # if dataset is empty, update dataset data_source_type
         if not dataset.data_source_type and knowledge_config.data_source:
@@ -2603,6 +2664,21 @@ class DocumentService:
                 f"You have reached the limit of your subscription. Only {can_upload_size} documents can be uploaded."
             )
 
+    @staticmethod
+    def check_document_creation_limits(count: int, features: FeatureModel):
+        """Validate billing-backed document creation limits before document rows are created."""
+        if not features.billing.enabled:
+            return
+
+        if features.billing.subscription.plan == CloudPlan.SANDBOX and count > 1:
+            raise ValueError("Your current plan does not support batch upload, please upgrade your plan.")
+
+        batch_upload_limit = int(dify_config.BATCH_UPLOAD_LIMIT)
+        if count > batch_upload_limit:
+            raise ValueError(f"You have reached the batch upload limit of {batch_upload_limit}.")
+
+        DocumentService.check_documents_upload_quota(count, features)
+
     @staticmethod
     def build_document(
         dataset: Dataset,
@@ -2824,13 +2900,7 @@ class DocumentService:
                 website_info = knowledge_config.data_source.info_list.website_info_list
                 if website_info:
                     count = len(website_info.urls)
-            if features.billing.subscription.plan == CloudPlan.SANDBOX and count > 1:
-                raise ValueError("Your current plan does not support batch upload, please upgrade your plan.")
-            batch_upload_limit = int(dify_config.BATCH_UPLOAD_LIMIT)
-            if count > batch_upload_limit:
-                raise ValueError(f"You have reached the batch upload limit of {batch_upload_limit}.")
-
-            DocumentService.check_documents_upload_quota(count, features)
+            DocumentService.check_document_creation_limits(count, features)
 
         dataset_collection_binding_id = None
         retrieval_model = None
@@ -2859,6 +2929,7 @@ class DocumentService:
             data_source_type=knowledge_config.data_source.info_list.data_source_type,
             indexing_technique=IndexTechniqueType(knowledge_config.indexing_technique),
             created_by=account.id,
+            maintainer=account.id,
             embedding_model=knowledge_config.embedding_model,
             embedding_model_provider=knowledge_config.embedding_model_provider,
             collection_binding_id=dataset_collection_binding_id,
diff --git a/api/services/end_user_service.py b/api/services/end_user_service.py
index 749d8dbc30e..c15e9949abb 100644
--- a/api/services/end_user_service.py
+++ b/api/services/end_user_service.py
@@ -4,8 +4,8 @@ from collections.abc import Mapping
 from sqlalchemy import case, select
 from sqlalchemy.orm import sessionmaker
 
-from core.app.entities.app_invoke_entities import InvokeFrom
 from extensions.ext_database import db
+from models.enums import EndUserType
 from models.model import App, DefaultEndUserSessionID, EndUser
 
 logger = logging.getLogger(__name__)
@@ -41,11 +41,11 @@ class EndUserService:
         Get or create an end user for a given app.
         """
 
-        return cls.get_or_create_end_user_by_type(InvokeFrom.SERVICE_API, app_model.tenant_id, app_model.id, user_id)
+        return cls.get_or_create_end_user_by_type(EndUserType.SERVICE_API, app_model.tenant_id, app_model.id, user_id)
 
     @classmethod
     def get_or_create_end_user_by_type(
-        cls, type: InvokeFrom, tenant_id: str, app_id: str, user_id: str | None = None
+        cls, type: EndUserType, tenant_id: str, app_id: str, user_id: str | None = None
     ) -> EndUser:
         """
         Get or create an end user for a given app and type.
@@ -98,7 +98,7 @@ class EndUserService:
 
     @classmethod
     def create_end_user_batch(
-        cls, type: InvokeFrom, tenant_id: str, app_ids: list[str], user_id: str
+        cls, type: EndUserType, tenant_id: str, app_ids: list[str], user_id: str
     ) -> Mapping[str, EndUser]:
         """Create end users in batch.
 
diff --git a/api/services/enterprise/base.py b/api/services/enterprise/base.py
index c1637847e25..71deec752e5 100644
--- a/api/services/enterprise/base.py
+++ b/api/services/enterprise/base.py
@@ -36,6 +36,11 @@ class MCPIdentityRefreshError(MCPTokenError):
 
 logger = logging.getLogger(__name__)
 
+# Headers recognised by dify-enterprise's /inner/api/rbac/* endpoints.
+# Keep in sync with pkg/enterprise/service/rbac_inner_handlers.go.
+INNER_TENANT_ID_HEADER = "X-Inner-Tenant-Id"
+INNER_ACCOUNT_ID_HEADER = "X-Inner-Account-Id"
+
 
 class BaseRequest:
     proxies: Mapping[str, str] | None = {
@@ -69,8 +74,16 @@ class BaseRequest:
         *,
         timeout: float | httpx.Timeout | None = None,
         raise_for_status: bool = False,
+        extra_headers: Mapping[str, str] | None = None,
     ) -> Any:
         headers = {"Content-Type": "application/json", cls.secret_key_header: cls.secret_key}
+        if extra_headers:
+            # Explicitly ignore empty values so callers can pass optional
+            # headers (e.g. `X-Inner-Account-Id`) without having to branch.
+            for key, value in extra_headers.items():
+                if value is None or value == "":
+                    continue
+                headers[key] = value
         url = f"{cls.base_url}{endpoint}"
         mounts = cls._build_mounts()
 
@@ -139,9 +152,60 @@ class BaseRequest:
 
 class EnterpriseRequest(BaseRequest):
     base_url = os.environ.get("ENTERPRISE_API_URL", "ENTERPRISE_API_URL")
+    rbac_base_url = os.environ.get("ENTERPRISE_RBAC_API_URL", base_url)
     secret_key = os.environ.get("ENTERPRISE_API_SECRET_KEY", "ENTERPRISE_API_SECRET_KEY")
     secret_key_header = "Enterprise-Api-Secret-Key"
 
+    @classmethod
+    def send_inner_rbac_request(
+        cls,
+        method: str,
+        endpoint: str,
+        *,
+        tenant_id: str,
+        account_id: str | None = None,
+        json: Any | None = None,
+        params: Mapping[str, Any] | None = None,
+        timeout: float | httpx.Timeout | None = None,
+    ) -> Any:
+        """Call an /inner/api/rbac/* endpoint on dify-enterprise.
+
+        Inner RBAC endpoints require three headers on top of the standard
+        Enterprise-Api-Secret-Key: the tenant the call targets and (optionally)
+        the account acting on behalf of the workspace. This helper centralises
+        both the assertions and the header wiring so callers only have to
+        supply business payload.
+        """
+        if not tenant_id:
+            raise ValueError("tenant_id must be provided for inner RBAC requests")
+
+        inner_headers: dict[str, str] = {INNER_TENANT_ID_HEADER: tenant_id}
+        if account_id:
+            inner_headers[INNER_ACCOUNT_ID_HEADER] = account_id
+        url = f"{cls.rbac_base_url}{endpoint}"
+        mounts = cls._build_mounts()
+
+        try:
+            traceparent = generate_traceparent_header()
+            if traceparent:
+                inner_headers = dict(inner_headers)
+                inner_headers["traceparent"] = traceparent
+        except Exception:
+            logger.debug("Failed to generate traceparent header", exc_info=True)
+
+        with httpx.Client(mounts=mounts) as client:
+            request_kwargs: dict[str, Any] = {
+                "json": json,
+                "params": params,
+                "headers": {"Content-Type": "application/json", cls.secret_key_header: cls.secret_key, **inner_headers},
+            }
+            if timeout is not None:
+                request_kwargs["timeout"] = timeout
+            response = client.request(method, url, **request_kwargs)
+            if not response.is_success:
+                cls._handle_error_response(response)
+        return response.json()
+
 
 class EnterprisePluginManagerRequest(BaseRequest):
     base_url = os.environ.get("ENTERPRISE_PLUGIN_MANAGER_API_URL", "ENTERPRISE_PLUGIN_MANAGER_API_URL")
diff --git a/api/services/enterprise/rbac_service.py b/api/services/enterprise/rbac_service.py
new file mode 100644
index 00000000000..39a3a61a781
--- /dev/null
+++ b/api/services/enterprise/rbac_service.py
@@ -0,0 +1,1713 @@
+from __future__ import annotations
+
+import logging
+from collections.abc import Sequence
+from enum import StrEnum
+from typing import Any, TypeVar
+
+from flask import has_request_context, request
+from pydantic import AliasChoices, BaseModel, ConfigDict, Field, field_validator
+from sqlalchemy import select
+from sqlalchemy.exc import SQLAlchemyError
+
+from configs import dify_config
+from core.db.session_factory import session_factory
+from models import TenantAccountJoin, TenantAccountRole
+from services.enterprise.base import EnterpriseRequest
+
+T = TypeVar("T")
+logger = logging.getLogger(__name__)
+
+
+class _RBACModel(BaseModel):
+    model_config = ConfigDict(populate_by_name=True, extra="ignore")
+
+
+class Pagination(_RBACModel):
+    total_count: int = 0
+    per_page: int = 0
+    current_page: int = 0
+    total_pages: int = 0
+
+
+class Paginated[T](_RBACModel):
+    data: list[T] = Field(default_factory=list)
+    pagination: Pagination | None = None
+
+
+class MembersInRole(_RBACModel):
+    account_id: str = ""
+    account_name: str = ""
+
+
+class RBACResourceType(StrEnum):
+    """Resource types understood by access policies."""
+
+    APP = "app"
+    DATASET = "dataset"
+
+
+class RBACRoleType(StrEnum):
+    """The only concrete role type after the access-policy refactor."""
+
+    WORKSPACE = "workspace"
+
+
+class PermissionCatalogItem(_RBACModel):
+    key: str
+    name: str
+    description: str = ""
+
+
+class PermissionCatalogGroup(_RBACModel):
+    group_key: str
+    group_name: str
+    description: str = ""
+    permissions: list[PermissionCatalogItem] = Field(default_factory=list)
+
+
+class PermissionCatalogResponse(_RBACModel):
+    groups: list[PermissionCatalogGroup] = Field(default_factory=list)
+
+
+class RBACRole(_RBACModel):
+    id: str
+    tenant_id: str | None = None
+    type: str
+    category: str = ""
+    name: str
+    description: str = ""
+    is_builtin: bool = False
+    permission_keys: list[str] = Field(default_factory=list)
+    role_tag: str = ""
+
+    @field_validator("permission_keys", mode="before")
+    @classmethod
+    def _coerce_permission_keys(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class RBACRoleAccount(_RBACModel):
+    account_id: str
+    account_name: str = ""
+    email: str = ""
+    avatar: str = ""
+
+
+class MemberRoleSummary(_RBACModel):
+    id: str
+    name: str
+
+
+class ResourcePermissionKeys(_RBACModel):
+    resource_id: str
+    permission_keys: list[str] = Field(default_factory=list)
+
+
+class ResourcePermissionKeysBatchResponse(_RBACModel):
+    data: list[ResourcePermissionKeys] = Field(default_factory=list)
+
+
+class AccessPolicy(_RBACModel):
+    id: str
+    tenant_id: str = ""
+    resource_type: str
+    policy_key: str = ""
+    name: str
+    description: str = ""
+    permission_keys: list[str] = Field(default_factory=list)
+    is_builtin: bool = False
+    category: str = ""
+    created_at: int = 0
+    updated_at: int = 0
+
+    @field_validator("permission_keys", mode="before")
+    @classmethod
+    def _coerce_permission_keys(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class AccessPolicyRoleBinding(_RBACModel):
+    id: str
+    tenant_id: str = ""
+    access_policy_id: str
+    resource_type: str
+    resource_id: str = ""
+    role_id: str
+    role_name: str = ""
+    created_at: int = 0
+
+
+class AccessPolicyMemberBinding(_RBACModel):
+    id: str
+    tenant_id: str = ""
+    access_policy_id: str
+    resource_type: str
+    resource_id: str = ""
+    account_id: str
+    account_name: str = ""
+    created_at: int = 0
+
+
+class AccessPolicyBindingState(_RBACModel):
+    binding_id: str
+    is_locked: bool = False
+
+
+class AccessPolicyRole(BaseModel):
+    role_id: str
+    role_name: str
+    binding_id: str
+    is_locked: bool = False
+    role_tag: str = ""
+
+
+class AccessPolicyAccount(BaseModel):
+    account_id: str
+    account_name: str
+    binding_id: str
+    is_locked: bool = False
+    avatar: str = ""
+    email: str = ""
+
+
+class AccessMatrixItem(_RBACModel):
+    policy: AccessPolicy | None = None
+    roles: list[AccessPolicyRole] = Field(default_factory=list)
+    accounts: list[AccessPolicyAccount] = Field(default_factory=list)
+
+    @field_validator("roles", "accounts", mode="before")
+    @classmethod
+    def _coerce_empty_lists(cls, value: Any) -> list[dict[str, Any]]:
+        if value is None:
+            return []
+        return value
+
+
+class AppAccessMatrix(_RBACModel):
+    app_id: str = Field(default="", validation_alias=AliasChoices("app_id", "resource_id"))
+    items: list[AccessMatrixItem] = Field(default_factory=list)
+
+
+class DatasetAccessMatrix(_RBACModel):
+    dataset_id: str = Field(default="", validation_alias=AliasChoices("dataset_id", "resource_id"))
+    items: list[AccessMatrixItem] = Field(default_factory=list)
+
+
+class WorkspaceAccessMatrix(_RBACModel):
+    items: list[AccessMatrixItem] = Field(default_factory=list)
+    pagination: Pagination | None = None
+
+
+class RoleBindingsResponse(_RBACModel):
+    data: list[AccessPolicyRoleBinding] = Field(default_factory=list)
+
+
+class MemberBindingsResponse(_RBACModel):
+    data: list[AccessPolicyMemberBinding] = Field(default_factory=list)
+
+
+class ResourceWhitelist(_RBACModel):
+    account_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("account_ids", mode="before")
+    @classmethod
+    def _coerce_account_ids(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class ResourceWhitelistResources(_RBACModel):
+    unrestricted: bool = False
+    resource_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("resource_ids", mode="before")
+    @classmethod
+    def _coerce_resource_ids(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class ResourceUserAccessPolicies(_RBACModel):
+    account: RBACRoleAccount
+    roles: list[RBACRole] = Field(default_factory=list)
+    access_policies: list[AccessPolicy] = Field(default_factory=list)
+
+    @field_validator("access_policies", "roles", mode="before")
+    @classmethod
+    def _coerce_none_to_list(cls, value: Any) -> Any:
+        if value is None:
+            return []
+        return value
+
+
+class ResourceUserAccessPoliciesResponse(_RBACModel):
+    scope: str
+    data: list[ResourceUserAccessPolicies] = Field(default_factory=list)
+
+
+class ReplaceUserAccessPolicies(_RBACModel):
+    access_policy_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("access_policy_ids", mode="before")
+    @classmethod
+    def _coerce_access_policy_ids(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class ReplaceUserAccessPoliciesResponse(_RBACModel):
+    access_policies: list[AccessPolicy] = Field(default_factory=list)
+
+
+class MemberRolesResponse(_RBACModel):
+    account_id: str
+    roles: list[RBACRole] = Field(default_factory=list)
+
+
+class MemberRolesBatchResponse(_RBACModel):
+    data: list[MemberRolesResponse] = Field(default_factory=list)
+
+
+class WorkspacePermissionSnapshot(_RBACModel):
+    permission_keys: list[str] = Field(default_factory=list)
+
+
+class ResourcePermissionSnapshot(_RBACModel):
+    default_permission_keys: list[str] = Field(default_factory=list)
+    overrides: list[ResourcePermissionKeys] = Field(default_factory=list)
+
+    def permission_keys_by_resource_ids(self, resource_ids: list[str]) -> dict[str, list[str]]:
+        result = {str(resource_id): list(self.default_permission_keys) for resource_id in resource_ids}
+        for override in self.overrides:
+            resource_id = str(override.resource_id)
+            if resource_id in result:
+                result[resource_id] = list(override.permission_keys)
+        return result
+
+
+class MyPermissionsResponse(_RBACModel):
+    workspace: WorkspacePermissionSnapshot = Field(default_factory=WorkspacePermissionSnapshot)
+    app: ResourcePermissionSnapshot = Field(default_factory=ResourcePermissionSnapshot)
+    dataset: ResourcePermissionSnapshot = Field(default_factory=ResourcePermissionSnapshot)
+
+
+# Fallback permission snapshots for legacy Dify tenant roles when external RBAC is disabled.
+# Keep these keys aligned with langgenius/rbac's built-in workspace roles and access policies.
+_LEGACY_WORKSPACE_OWNER_KEYS: list[str] = [
+    "workspace.member.manage",
+    "workspace.role.manage",
+    "data_source.manage",
+    "api_extension.manage",
+    "customization.manage",
+    "plugin.install",
+    "plugin.plugin_preferences",
+    "plugin.manage",
+    "plugin.debug",
+    "credential.use",
+    "credential.manage",
+    "app_library.access",
+    "app.create_and_management",
+    "app.tag.manage",
+    "dataset.create_and_management",
+    "dataset.tag.manage",
+    "dataset.external.connect",
+    "tool.manage",
+    "mcp.manage",
+]
+
+_LEGACY_WORKSPACE_ADMIN_KEYS: list[str] = [
+    "workspace.member.manage",
+    "workspace.role.manage",
+    "data_source.manage",
+    "api_extension.manage",
+    "customization.manage",
+    "plugin.install",
+    "plugin.plugin_preferences",
+    "plugin.manage",
+    "plugin.debug",
+    "credential.use",
+    "credential.manage",
+    "app_library.access",
+    "app.create_and_management",
+    "app.tag.manage",
+    "dataset.create_and_management",
+    "dataset.tag.manage",
+    "dataset.external.connect",
+    "tool.manage",
+    "mcp.manage",
+]
+
+_LEGACY_WORKSPACE_EDITOR_KEYS: list[str] = [
+    "workspace.member.manage",
+    "api_extension.manage",
+    "plugin.install",
+    "credential.use",
+    "app_library.access",
+    "app.create_and_management",
+    "app.tag.manage",
+    "dataset.create_and_management",
+    "dataset.tag.manage",
+    "dataset.external.connect",
+    "tool.manage",
+]
+
+_LEGACY_WORKSPACE_NORMAL_KEYS: list[str] = [
+    "api_extension.manage",
+    "plugin.install",
+    "credential.use",
+    "app_library.access",
+]
+
+_LEGACY_WORKSPACE_DATASET_OPERATOR_KEYS: list[str] = [
+    "plugin.install",
+    "dataset.create_and_management",
+    "dataset.external.connect",
+]
+
+_LEGACY_APP_OWNER_KEYS: list[str] = [
+    "app.acl.view_layout",
+    "app.acl.test_and_run",
+    "app.acl.edit",
+    "app.acl.import_export_dsl",
+    "app.acl.delete",
+    "app.acl.release_and_version",
+    "app.acl.monitor",
+    "app.acl.access_config",
+]
+
+_LEGACY_APP_ADMIN_KEYS: list[str] = [
+    "app.acl.view_layout",
+    "app.acl.test_and_run",
+    "app.acl.edit",
+    "app.acl.import_export_dsl",
+    "app.acl.delete",
+    "app.acl.release_and_version",
+    "app.acl.monitor",
+    "app.acl.access_config",
+]
+
+_LEGACY_APP_EDITOR_KEYS: list[str] = [
+    "app.acl.view_layout",
+    "app.acl.test_and_run",
+    "app.acl.edit",
+    "app.acl.import_export_dsl",
+    "app.acl.delete",
+    "app.acl.release_and_version",
+    "app.acl.monitor",
+    "app.acl.access_config",
+]
+
+_LEGACY_APP_NORMAL_KEYS: list[str] = [
+    "app.acl.view_layout",
+    "app.acl.test_and_run",
+    "app.acl.monitor",
+]
+
+_LEGACY_DATASET_OWNER_KEYS: list[str] = [
+    "dataset.acl.readonly",
+    "dataset.acl.edit",
+    "dataset.acl.import_export_dsl",
+    "dataset.acl.pipeline_test",
+    "dataset.acl.document_download",
+    "dataset.acl.retrieval_recall",
+    "dataset.acl.use",
+    "dataset.acl.delete_file",
+    "dataset.acl.pipeline_release",
+    "dataset.acl.delete",
+    "dataset.acl.access_config",
+    "dataset.api_key.manage",
+]
+
+_LEGACY_DATASET_ADMIN_KEYS: list[str] = [
+    "dataset.acl.readonly",
+    "dataset.acl.edit",
+    "dataset.acl.import_export_dsl",
+    "dataset.acl.pipeline_test",
+    "dataset.acl.document_download",
+    "dataset.acl.retrieval_recall",
+    "dataset.acl.use",
+    "dataset.acl.delete_file",
+    "dataset.acl.pipeline_release",
+    "dataset.acl.delete",
+    "dataset.acl.access_config",
+    "dataset.api_key.manage",
+]
+
+_LEGACY_DATASET_EDITOR_KEYS: list[str] = [
+    "dataset.acl.readonly",
+    "dataset.acl.edit",
+    "dataset.acl.import_export_dsl",
+    "dataset.acl.pipeline_test",
+    "dataset.acl.document_download",
+    "dataset.acl.retrieval_recall",
+    "dataset.acl.use",
+    "dataset.acl.delete_file",
+    "dataset.acl.pipeline_release",
+]
+
+_LEGACY_DATASET_DATASET_OPERATOR_KEYS: list[str] = [
+    "dataset.acl.readonly",
+    "dataset.acl.edit",
+    "dataset.acl.import_export_dsl",
+    "dataset.acl.pipeline_test",
+    "dataset.acl.document_download",
+    "dataset.acl.retrieval_recall",
+    "dataset.acl.use",
+    "dataset.acl.delete_file",
+    "dataset.acl.pipeline_release",
+]
+
+_LEGACY_MY_PERMISSIONS: dict[TenantAccountRole, dict[str, list[str]]] = {
+    TenantAccountRole.OWNER: {
+        "workspace": _LEGACY_WORKSPACE_OWNER_KEYS,
+        "app": _LEGACY_APP_OWNER_KEYS,
+        "dataset": _LEGACY_DATASET_OWNER_KEYS,
+    },
+    TenantAccountRole.ADMIN: {
+        "workspace": _LEGACY_WORKSPACE_ADMIN_KEYS,
+        "app": _LEGACY_APP_ADMIN_KEYS,
+        "dataset": _LEGACY_DATASET_ADMIN_KEYS,
+    },
+    TenantAccountRole.EDITOR: {
+        "workspace": _LEGACY_WORKSPACE_EDITOR_KEYS,
+        "app": _LEGACY_APP_EDITOR_KEYS,
+        "dataset": _LEGACY_DATASET_EDITOR_KEYS,
+    },
+    TenantAccountRole.NORMAL: {
+        "workspace": _LEGACY_WORKSPACE_NORMAL_KEYS,
+        "app": _LEGACY_APP_NORMAL_KEYS,
+    },
+    TenantAccountRole.DATASET_OPERATOR: {
+        "workspace": _LEGACY_WORKSPACE_DATASET_OPERATOR_KEYS,
+        "dataset": _LEGACY_DATASET_DATASET_OPERATOR_KEYS,
+    },
+}
+
+
+def _legacy_my_permissions(tenant_id: str, account_id: str | None) -> MyPermissionsResponse:
+    if not account_id:
+        return MyPermissionsResponse()
+
+    try:
+        with session_factory.create_session() as session:
+            role = session.scalar(
+                select(TenantAccountJoin.role).where(
+                    TenantAccountJoin.tenant_id == tenant_id,
+                    TenantAccountJoin.account_id == account_id,
+                )
+            )
+            if not role:
+                return MyPermissionsResponse()
+
+            try:
+                tenant_role = TenantAccountRole(role)
+            except ValueError:
+                return MyPermissionsResponse()
+    except SQLAlchemyError:
+        return MyPermissionsResponse()
+
+    permissions = _LEGACY_MY_PERMISSIONS.get(tenant_role, {})
+    return MyPermissionsResponse(
+        workspace=WorkspacePermissionSnapshot(permission_keys=list(permissions.get("workspace", []))),
+        app=ResourcePermissionSnapshot(default_permission_keys=list(permissions.get("app", []))),
+        dataset=ResourcePermissionSnapshot(default_permission_keys=list(permissions.get("dataset", []))),
+    )
+
+
+def _legacy_resource_permission_keys_batch(
+    tenant_id: str,
+    account_id: str | None,
+    resource_ids: list[str],
+    resource_type: RBACResourceType,
+) -> dict[str, list[str]]:
+    snapshot = _legacy_my_permissions(tenant_id, account_id)
+    if resource_type == RBACResourceType.APP:
+        permission_keys = snapshot.app.default_permission_keys
+    else:
+        permission_keys = snapshot.dataset.default_permission_keys
+    return {str(resource_id): list(permission_keys) for resource_id in resource_ids}
+
+
+# ---------- Mutation request models ----------
+
+
+class RoleMutation(_RBACModel):
+    """Payload shared by role create & update.
+
+    ``type`` defaults to ``workspace`` because that is the only concrete role
+    type supported by the enterprise backend today (see biz.RBACRoleType).
+    """
+
+    name: str
+    description: str = ""
+    permission_keys: list[str] = Field(default_factory=list)
+    type: RBACRoleType = RBACRoleType.WORKSPACE
+
+
+class AccessPolicyCreate(_RBACModel):
+    name: str
+    resource_type: RBACResourceType
+    description: str = ""
+    permission_keys: list[str] = Field(default_factory=list)
+
+
+class AccessPolicyUpdate(_RBACModel):
+    name: str
+    description: str = ""
+    permission_keys: list[str] = Field(default_factory=list)
+
+
+class ReplaceRoleBindings(_RBACModel):
+    role_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("role_ids", mode="before")
+    @classmethod
+    def _coerce_role_ids(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class ReplaceMemberBindings(_RBACModel):
+    scope: str = "specific"
+
+    @field_validator("scope")
+    @classmethod
+    def _normalize_scope(cls, value: Any) -> str:
+        scope = str(value or "").strip().lower()
+        if scope in {"", "specific"}:
+            return "specific"
+        if scope in {"all", "only_me"}:
+            return scope
+        raise ValueError(f"invalid scope: {value}")
+
+
+class DeleteMemberBindings(_RBACModel):
+    account_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("account_ids", mode="before")
+    @classmethod
+    def _coerce_account_ids(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class ReplaceBindings(_RBACModel):
+    role_ids: list[str] = Field(default_factory=list)
+    account_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("role_ids", "account_ids", mode="before")
+    @classmethod
+    def _coerce_bindings(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
+
+class ListOption(_RBACModel):
+    page_number: int | None = None
+    results_per_page: int | None = None
+    reverse: bool | None = None
+
+    def to_params(self, extra: dict[str, Any] | None = None) -> dict[str, Any]:
+        params: dict[str, Any] = {}
+        if self.page_number is not None:
+            params["page_number"] = self.page_number
+        if self.results_per_page is not None:
+            params["results_per_page"] = self.results_per_page
+        if self.reverse is not None:
+            # httpx renders `True` as the string "True"; we want the inner
+            # handler to match on the lowercase form it compares against.
+            params["reverse"] = "true" if self.reverse else "false"
+        if extra:
+            params.update({k: v for k, v in extra.items() if v is not None})
+        return params
+
+
+_INNER_PREFIX = "/rbac"
+
+
+def _request_language_param() -> str | None:
+    if not has_request_context():
+        return None
+    language = (request.args.get("language") or "").strip().lower()
+    if language in {"en", "ja", "zh"}:
+        return language
+    return None
+
+
+def _inner_call(
+    method: str,
+    endpoint: str,
+    *,
+    tenant_id: str,
+    account_id: str | None = None,
+    json: Any | None = None,
+    params: dict[str, Any] | None = None,
+) -> Any:
+    """Thin wrapper around `EnterpriseRequest.send_inner_rbac_request`.
+
+    Kept as a module-level helper (rather than a nested-class method) so that
+    unit tests can monkey-patch this single entry point instead of every
+    individual `Roles.*`, `AccessPolicies.*`, … method.
+    """
+    language = _request_language_param()
+    if language and (not params or "language" not in params):
+        params = dict(params or {})
+        params["language"] = language
+    return EnterpriseRequest.send_inner_rbac_request(
+        method,
+        endpoint,
+        tenant_id=tenant_id,
+        account_id=account_id,
+        json=json,
+        params=params,
+    )
+
+
+def _resource_id_params(resource_type: RBACResourceType | str, resource_id: str) -> dict[str, str]:
+    resource_type_value = resource_type.value if isinstance(resource_type, RBACResourceType) else str(resource_type)
+    resource_id = resource_id.strip()
+    if resource_type_value == RBACResourceType.APP.value:
+        return {"resource_type": resource_type_value, "app_id": resource_id}
+    if resource_type_value == RBACResourceType.DATASET.value:
+        return {"resource_type": resource_type_value, "dataset_id": resource_id}
+    raise ValueError(f"unsupported resource_type: {resource_type_value}")
+
+
+def try_sync_creator_access_policy_member_bindings(
+    tenant_id: str,
+    account_id: str,
+    resource_type: RBACResourceType | str,
+    resource_id: str,
+) -> None:
+    if not dify_config.RBAC_ENABLED:
+        return
+    try:
+        RBACService.AccessPolicies.sync_creator_access_policy_member_bindings(
+            tenant_id,
+            account_id,
+            resource_type=resource_type,
+            resource_id=resource_id,
+        )
+    except Exception:
+        logger.warning(
+            "Failed to sync creator access policy member binding for "
+            "tenant_id=%s resource_type=%s resource_id=%s account_id=%s",
+            tenant_id,
+            resource_type.value if isinstance(resource_type, RBACResourceType) else resource_type,
+            resource_id,
+            account_id,
+            exc_info=True,
+        )
+
+
+class RBACService:
+    """Single entry point grouping every inner RBAC call by feature area.
+
+    Each nested class keeps the classmethods tightly scoped to one URL family
+    so call sites read naturally (e.g. ``RBACService.Roles.create(tenant_id,
+    account_id, payload)``).
+    """
+
+    # ------------------------------------------------------------------
+    # Permission catalog (screenshot 3: 新增/编辑角色 弹窗内的权限列表).
+    # ------------------------------------------------------------------
+    class Catalog:
+        @staticmethod
+        def workspace(tenant_id: str, account_id: str | None = None) -> PermissionCatalogResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/role-permissions/catalog",
+                tenant_id=tenant_id,
+                account_id=account_id,
+            )
+            return PermissionCatalogResponse.model_validate(data or {})
+
+        @staticmethod
+        def app(tenant_id: str, account_id: str | None = None) -> PermissionCatalogResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/role-permissions/catalog/app",
+                tenant_id=tenant_id,
+                account_id=account_id,
+            )
+            return PermissionCatalogResponse.model_validate(data or {})
+
+        @staticmethod
+        def dataset(tenant_id: str, account_id: str | None = None) -> PermissionCatalogResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/role-permissions/catalog/dataset",
+                tenant_id=tenant_id,
+                account_id=account_id,
+            )
+            return PermissionCatalogResponse.model_validate(data or {})
+
+    # ------------------------------------------------------------------
+    # Role CRUD (Settings > Permissions).
+    # ------------------------------------------------------------------
+    class Roles:
+        @staticmethod
+        def list(
+            tenant_id: str,
+            account_id: str | None = None,
+            include_owner: int | None = None,
+            *,
+            options: ListOption | None = None,
+        ) -> Paginated[RBACRole]:
+            params = (options or ListOption()).to_params({"include_owner": include_owner})
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/roles",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params=params or None,
+            )
+            data = data or {}
+            return Paginated[RBACRole](
+                data=[RBACRole.model_validate(item) for item in data.get("data") or []],
+                pagination=Pagination.model_validate(data["pagination"]) if data.get("pagination") else None,
+            )
+
+        @staticmethod
+        def list_members_by_role(
+            tenant_id: str,
+            role_id: str | None = None,
+            *,
+            options: ListOption | None = None,
+        ) -> Paginated[MembersInRole]:
+            params = (options or ListOption()).to_params({"role_id": role_id})
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/roles/members",
+                tenant_id=tenant_id,
+                params=params or None,
+            )
+            data = data or {}
+            return Paginated[MembersInRole](
+                data=[MembersInRole.model_validate(item) for item in data.get("data") or []],
+                pagination=Pagination.model_validate(data["pagination"]) if data.get("pagination") else None,
+            )
+
+        @staticmethod
+        def get(tenant_id: str, account_id: str | None, role_id: str) -> RBACRole:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/roles/item",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"id": role_id},
+            )
+            return RBACRole.model_validate(data or {})
+
+        @staticmethod
+        def create(tenant_id: str, account_id: str | None, payload: RoleMutation) -> RBACRole:
+            data = _inner_call(
+                "POST",
+                f"{_INNER_PREFIX}/roles",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json=payload.model_dump(mode="json"),
+            )
+            return RBACRole.model_validate(data or {})
+
+        @staticmethod
+        def update(tenant_id: str, account_id: str | None, role_id: str, payload: RoleMutation) -> RBACRole:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/roles/item",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"id": role_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return RBACRole.model_validate(data or {})
+
+        @staticmethod
+        def delete(tenant_id: str, account_id: str | None, role_id: str) -> None:
+            _inner_call(
+                "DELETE",
+                f"{_INNER_PREFIX}/roles/item",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"id": role_id},
+            )
+
+        @staticmethod
+        def copy(tenant_id: str, account_id: str | None, role_id: str, copy_member: bool = True) -> RBACRole:
+            data = _inner_call(
+                "POST",
+                f"{_INNER_PREFIX}/roles/copy",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json={"copy_member": copy_member},
+                params={"id": role_id},
+            )
+
+            return RBACRole.model_validate(data or {})
+
+        @staticmethod
+        def members(
+            tenant_id: str,
+            account_id: str | None,
+            role_id: str,
+            *,
+            options: ListOption | None = None,
+        ) -> Paginated[RBACRoleAccount]:
+            params = (options or ListOption()).to_params({"role_id": role_id})
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/roles/members",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params=params,
+            )
+            data = data or {}
+            return Paginated[RBACRoleAccount](
+                data=[RBACRoleAccount.model_validate(item) for item in data.get("data") or []],
+                pagination=Pagination.model_validate(data["pagination"]) if data.get("pagination") else None,
+            )
+
+    # ------------------------------------------------------------------
+    # Access policies (Settings > Access Rules: create/edit permission sets).
+    # ------------------------------------------------------------------
+    class AccessPolicies:
+        @staticmethod
+        def list(
+            tenant_id: str,
+            account_id: str | None = None,
+            *,
+            resource_type: RBACResourceType | str | None = None,
+            options: ListOption | None = None,
+        ) -> Paginated[AccessPolicy]:
+            extra: dict[str, Any] = {}
+            if resource_type is not None:
+                extra["resource_type"] = (
+                    resource_type.value if isinstance(resource_type, RBACResourceType) else resource_type
+                )
+            params = (options or ListOption()).to_params(extra)
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/access-policies",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params=params or None,
+            )
+            data = data or {}
+            return Paginated[AccessPolicy](
+                data=[AccessPolicy.model_validate(item) for item in data.get("data") or []],
+                pagination=Pagination.model_validate(data["pagination"]) if data.get("pagination") else None,
+            )
+
+        @staticmethod
+        def get(tenant_id: str, account_id: str | None, policy_id: str) -> AccessPolicy:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/access-policies/item",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"id": policy_id},
+            )
+            return AccessPolicy.model_validate(data or {})
+
+        @staticmethod
+        def create(tenant_id: str, account_id: str | None, payload: AccessPolicyCreate) -> AccessPolicy:
+            data = _inner_call(
+                "POST",
+                f"{_INNER_PREFIX}/access-policies",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json=payload.model_dump(mode="json"),
+            )
+            return AccessPolicy.model_validate(data or {})
+
+        @staticmethod
+        def update(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+            payload: AccessPolicyUpdate,
+        ) -> AccessPolicy:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/access-policies/item",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return AccessPolicy.model_validate(data or {})
+
+        @staticmethod
+        def copy(tenant_id: str, account_id: str | None, policy_id: str) -> AccessPolicy:
+            data = _inner_call(
+                "POST",
+                f"{_INNER_PREFIX}/access-policies/copy",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"id": policy_id},
+            )
+            return AccessPolicy.model_validate(data or {})
+
+        @staticmethod
+        def delete(tenant_id: str, account_id: str | None, policy_id: str) -> None:
+            _inner_call(
+                "DELETE",
+                f"{_INNER_PREFIX}/access-policies/item",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"id": policy_id},
+            )
+
+        @staticmethod
+        def sync_creator_access_policy_member_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            *,
+            resource_type: RBACResourceType | str,
+            resource_id: str,
+        ) -> Sequence[AccessPolicyMemberBinding]:
+            params = _resource_id_params(resource_type, resource_id)
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/access-policies/creator-member-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params=params,
+            )
+            items: list[Any] = []
+            if isinstance(data, dict):
+                items = data.get("data") or []
+            return [AccessPolicyMemberBinding.model_validate(item) for item in items]
+
+    # ------------------------------------------------------------------
+    # Access-policy bindings (lock / unlock a single binding).
+    # ------------------------------------------------------------------
+    class AccessPolicyBindings:
+        @staticmethod
+        def lock(tenant_id: str, account_id: str | None, binding_id: str) -> AccessPolicyBindingState:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/access-policy-bindings/lock",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json={"binding_id": binding_id},
+            )
+            return AccessPolicyBindingState.model_validate(data or {})
+
+        @staticmethod
+        def unlock(tenant_id: str, account_id: str | None, binding_id: str) -> AccessPolicyBindingState:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/access-policy-bindings/unlock",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json={"binding_id": binding_id},
+            )
+            return AccessPolicyBindingState.model_validate(data or {})
+
+    # ------------------------------------------------------------------
+    # Per-app access (screenshot 1: App Access Config).
+    # ------------------------------------------------------------------
+    class AppAccess:
+        @staticmethod
+        def whitelist_resources(tenant_id: str, account_id: str | None) -> ResourceWhitelistResources:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/apps/whitelist/resources",
+                tenant_id=tenant_id,
+                account_id=account_id,
+            )
+            return ResourceWhitelistResources.model_validate(data or {})
+
+        @staticmethod
+        def user_access_policies(
+            tenant_id: str, account_id: str | None, app_id: str
+        ) -> ResourceUserAccessPoliciesResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/apps/user-access-policies",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id},
+            )
+            return ResourceUserAccessPoliciesResponse.model_validate(data or {})
+
+        @staticmethod
+        def replace_user_access_policies(
+            tenant_id: str,
+            account_id: str | None,
+            app_id: str,
+            target_account_id: str,
+            payload: ReplaceUserAccessPolicies,
+        ) -> ReplaceUserAccessPoliciesResponse:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/apps/user-access-policies",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id, "account_id": target_account_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return ReplaceUserAccessPoliciesResponse.model_validate(data or {})
+
+        @staticmethod
+        def whitelist(tenant_id: str, account_id: str | None, app_id: str) -> ResourceWhitelist:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/apps/whitelist",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id},
+            )
+            return ResourceWhitelist.model_validate(data or {})
+
+        @staticmethod
+        def replace_whitelist(
+            tenant_id: str,
+            account_id: str | None,
+            app_id: str,
+            payload: ReplaceMemberBindings,
+        ) -> ResourceWhitelist:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/apps/whitelist",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return ResourceWhitelist.model_validate(data or {})
+
+        @staticmethod
+        def matrix(tenant_id: str, account_id: str | None, app_id: str) -> AppAccessMatrix:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/apps/access-policy",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id},
+            )
+            return AppAccessMatrix.model_validate(data or {})
+
+        @staticmethod
+        def list_role_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            app_id: str,
+            policy_id: str,
+        ) -> RoleBindingsResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/apps/access-policy/role-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id, "policy_id": policy_id},
+            )
+            return RoleBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def replace_role_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            app_id: str,
+            policy_id: str,
+            payload: ReplaceRoleBindings,
+        ) -> RoleBindingsResponse:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/apps/access-policy/role-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id, "policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return RoleBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def list_member_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            app_id: str,
+            policy_id: str,
+        ) -> MemberBindingsResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/apps/access-policy/member-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id, "policy_id": policy_id},
+            )
+            return MemberBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def delete_member_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            app_id: str,
+            policy_id: str,
+            payload: DeleteMemberBindings,
+        ) -> None:
+            _inner_call(
+                "DELETE",
+                f"{_INNER_PREFIX}/apps/access-policy/member-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id, "policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+
+        @staticmethod
+        def replace_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            app_id: str,
+            policy_id: str,
+            payload: ReplaceBindings,
+        ) -> AccessMatrixItem:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/apps/access-policy/bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"app_id": app_id, "policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return AccessMatrixItem.model_validate(data or {})
+
+    # ------------------------------------------------------------------
+    # Per-dataset access (screenshot 1: Knowledge Base Access Config).
+    # ------------------------------------------------------------------
+    class DatasetAccess:
+        @staticmethod
+        def whitelist_resources(tenant_id: str, account_id: str | None) -> ResourceWhitelistResources:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/datasets/whitelist/resources",
+                tenant_id=tenant_id,
+                account_id=account_id,
+            )
+            return ResourceWhitelistResources.model_validate(data or {})
+
+        @staticmethod
+        def user_access_policies(
+            tenant_id: str, account_id: str | None, dataset_id: str
+        ) -> ResourceUserAccessPoliciesResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/datasets/user-access-policies",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id},
+            )
+            return ResourceUserAccessPoliciesResponse.model_validate(data or {})
+
+        @staticmethod
+        def replace_user_access_policies(
+            tenant_id: str,
+            account_id: str | None,
+            dataset_id: str,
+            target_account_id: str,
+            payload: ReplaceUserAccessPolicies,
+        ) -> ReplaceUserAccessPoliciesResponse:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/datasets/user-access-policies",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id, "account_id": target_account_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return ReplaceUserAccessPoliciesResponse.model_validate(data or {})
+
+        @staticmethod
+        def whitelist(tenant_id: str, account_id: str | None, dataset_id: str) -> ResourceWhitelist:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/datasets/whitelist",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id},
+            )
+            return ResourceWhitelist.model_validate(data or {})
+
+        @staticmethod
+        def replace_whitelist(
+            tenant_id: str,
+            account_id: str | None,
+            dataset_id: str,
+            payload: ReplaceMemberBindings,
+        ) -> ResourceWhitelist:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/datasets/whitelist",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return ResourceWhitelist.model_validate(data or {})
+
+        @staticmethod
+        def matrix(tenant_id: str, account_id: str | None, dataset_id: str) -> DatasetAccessMatrix:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/datasets/access-policy",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id},
+            )
+            return DatasetAccessMatrix.model_validate(data or {})
+
+        @staticmethod
+        def list_role_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            dataset_id: str,
+            policy_id: str,
+        ) -> RoleBindingsResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/datasets/access-policy/role-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id, "policy_id": policy_id},
+            )
+            return RoleBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def replace_role_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            dataset_id: str,
+            policy_id: str,
+            payload: ReplaceRoleBindings,
+        ) -> RoleBindingsResponse:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/datasets/access-policy/role-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id, "policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return RoleBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def list_member_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            dataset_id: str,
+            policy_id: str,
+        ) -> MemberBindingsResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/datasets/access-policy/member-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id, "policy_id": policy_id},
+            )
+            return MemberBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def delete_member_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            dataset_id: str,
+            policy_id: str,
+            payload: DeleteMemberBindings,
+        ) -> None:
+            _inner_call(
+                "DELETE",
+                f"{_INNER_PREFIX}/datasets/access-policy/member-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id, "policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+
+        @staticmethod
+        def replace_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            dataset_id: str,
+            policy_id: str,
+            payload: ReplaceBindings,
+        ) -> AccessMatrixItem:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/datasets/access-policy/bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"dataset_id": dataset_id, "policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return AccessMatrixItem.model_validate(data or {})
+
+    # ------------------------------------------------------------------
+    # Workspace-level access (screenshot 2: Settings > Access Rules).
+    # ------------------------------------------------------------------
+    class WorkspaceAccess:
+        @staticmethod
+        def app_matrix(
+            tenant_id: str,
+            account_id: str | None = None,
+            *,
+            options: ListOption | None = None,
+        ) -> WorkspaceAccessMatrix:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/workspace/apps/access-policy",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params=(options or ListOption()).to_params() or None,
+            )
+            return WorkspaceAccessMatrix.model_validate(data or {})
+
+        @staticmethod
+        def dataset_matrix(
+            tenant_id: str,
+            account_id: str | None = None,
+            *,
+            options: ListOption | None = None,
+        ) -> WorkspaceAccessMatrix:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/workspace/datasets/access-policy",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params=(options or ListOption()).to_params() or None,
+            )
+            return WorkspaceAccessMatrix.model_validate(data or {})
+
+        @staticmethod
+        def list_app_role_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+        ) -> RoleBindingsResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/workspace/apps/access-policy/role-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"policy_id": policy_id},
+            )
+            return RoleBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def replace_app_role_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+            payload: ReplaceRoleBindings,
+        ) -> RoleBindingsResponse:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/workspace/apps/access-policy/role-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return RoleBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def list_app_member_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+        ) -> MemberBindingsResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/workspace/apps/access-policy/member-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"policy_id": policy_id},
+            )
+            return MemberBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def replace_app_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+            payload: ReplaceBindings,
+        ) -> AccessMatrixItem:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/workspace/apps/access-policy/bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return AccessMatrixItem.model_validate(data or {})
+
+        @staticmethod
+        def list_dataset_role_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+        ) -> RoleBindingsResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/workspace/datasets/access-policy/role-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"policy_id": policy_id},
+            )
+            return RoleBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def replace_dataset_role_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+            payload: ReplaceRoleBindings,
+        ) -> RoleBindingsResponse:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/workspace/datasets/access-policy/role-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return RoleBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def list_dataset_member_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+        ) -> MemberBindingsResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/workspace/datasets/access-policy/member-bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"policy_id": policy_id},
+            )
+            return MemberBindingsResponse.model_validate(data or {})
+
+        @staticmethod
+        def replace_dataset_bindings(
+            tenant_id: str,
+            account_id: str | None,
+            policy_id: str,
+            payload: ReplaceBindings,
+        ) -> AccessMatrixItem:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/workspace/datasets/access-policy/bindings",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"policy_id": policy_id},
+                json=payload.model_dump(mode="json"),
+            )
+            return AccessMatrixItem.model_validate(data or {})
+
+    # ------------------------------------------------------------------
+    # Member ↔ role bindings (screenshot 3: Settings > Members > Assign roles).
+    # ------------------------------------------------------------------
+    class MemberRoles:
+        @staticmethod
+        def get(tenant_id: str, account_id: str | None, member_account_id: str) -> MemberRolesResponse:
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/members/rbac-roles",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"account_id": member_account_id},
+            )
+            rst = MemberRolesResponse.model_validate(data or {})
+            return rst
+
+        @staticmethod
+        def batch_get(
+            tenant_id: str,
+            account_id: str | None,
+            member_account_ids: list[str],
+        ) -> list[MemberRolesResponse]:
+            data = _inner_call(
+                "POST",
+                f"{_INNER_PREFIX}/members/rbac-roles/batch",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json={"member_ids": member_account_ids},
+            )
+            items = []
+            if isinstance(data, dict):
+                items = [{"account_id": account_id, "roles": roles} for account_id, roles in data.items()]
+            rst = []
+            for item in items:
+                tmp = MemberRolesResponse.model_validate(item)
+                rst.append(tmp)
+            return rst
+
+        @staticmethod
+        def replace(
+            tenant_id: str,
+            account_id: str | None,
+            member_account_id: str,
+            role_ids: list[str],
+        ) -> MemberRolesResponse:
+            data = _inner_call(
+                "PUT",
+                f"{_INNER_PREFIX}/members/rbac-roles",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={"account_id": member_account_id},
+                json={"role_ids": role_ids},
+            )
+            return MemberRolesResponse.model_validate(data or {})
+
+    class CheckAccess:
+        """Call the ``/inner/api/rbac/check-access`` endpoint."""
+
+        @staticmethod
+        def check(
+            tenant_id: str,
+            account_id: str | None,
+            *,
+            scene: str,
+            resource_type: str | None = None,
+            resource_id: str | None = None,
+        ) -> bool:
+            """Return ``True`` if the account is allowed, ``False`` otherwise."""
+            if not dify_config.RBAC_ENABLED:
+                return True
+
+            payload: dict[str, Any] = {
+                "account_id": account_id or "",
+                "tenant_id": tenant_id,
+                "scene": scene,
+            }
+            if resource_type:
+                payload["resource_type"] = resource_type
+            if resource_id:
+                payload["resource_id"] = resource_id
+
+            data = _inner_call(
+                "POST",
+                f"{_INNER_PREFIX}/check-access",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json=payload,
+            )
+            return bool(data.get("allowed", False))
+
+    class AppPermissions:
+        @staticmethod
+        def batch_get(
+            tenant_id: str,
+            account_id: str | None,
+            app_ids: list[str],
+        ) -> dict[str, list[str]]:
+            if not app_ids:
+                return {}
+            if not dify_config.RBAC_ENABLED:
+                return _legacy_resource_permission_keys_batch(tenant_id, account_id, app_ids, RBACResourceType.APP)
+            data = _inner_call(
+                "POST",
+                f"{_INNER_PREFIX}/apps/permission-keys/batch",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json={"app_ids": app_ids},
+            )
+            return _parse_resource_permission_keys_batch(data, resource_id_key="app_id")
+
+    class DatasetPermissions:
+        @staticmethod
+        def batch_get(
+            tenant_id: str,
+            account_id: str | None,
+            dataset_ids: list[str],
+        ) -> dict[str, list[str]]:
+            if not dataset_ids:
+                return {}
+            if not dify_config.RBAC_ENABLED:
+                return _legacy_resource_permission_keys_batch(
+                    tenant_id, account_id, dataset_ids, RBACResourceType.DATASET
+                )
+            data = _inner_call(
+                "POST",
+                f"{_INNER_PREFIX}/datasets/permission-keys/batch",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                json={"dataset_ids": dataset_ids},
+            )
+            return _parse_resource_permission_keys_batch(data, resource_id_key="dataset_id")
+
+    class MyPermissions:
+        @staticmethod
+        def get(
+            tenant_id: str,
+            account_id: str | None,
+            *,
+            app_id: str | None = None,
+            dataset_id: str | None = None,
+        ) -> MyPermissionsResponse:
+            if not dify_config.RBAC_ENABLED:
+                return _legacy_my_permissions(tenant_id, account_id)
+
+            data = _inner_call(
+                "GET",
+                f"{_INNER_PREFIX}/my-permissions",
+                tenant_id=tenant_id,
+                account_id=account_id,
+                params={
+                    k: v
+                    for k, v in {
+                        "app_id": app_id,
+                        "dataset_id": dataset_id,
+                    }.items()
+                    if v is not None
+                }
+                or None,
+            )
+            return MyPermissionsResponse.model_validate(data or {})
+
+
+def _parse_resource_permission_keys_batch(data: Any, *, resource_id_key: str) -> dict[str, list[str]]:
+    if not data:
+        return {}
+
+    if isinstance(data, dict):
+        permissions = data.get("permissions")
+        if isinstance(permissions, dict):
+            return {str(key): [str(item) for item in (value or [])] for key, value in permissions.items()}
+
+        items = data.get("data")
+        if items is None:
+            items = data.get("items")
+        if items is None:
+            items = data.get("apps") if resource_id_key == "app_id" else data.get("datasets")
+        if isinstance(items, dict):
+            items = [{"resource_id": key, "permission_keys": value} for key, value in items.items()]
+    elif isinstance(data, list):
+        items = data
+    else:
+        items = []
+
+    result: dict[str, list[str]] = {}
+    for item in items or []:
+        if not isinstance(item, dict):
+            continue
+        resource_id = item.get("resource_id") or item.get(resource_id_key)
+        if not resource_id:
+            continue
+        permission_keys = item.get("permission_keys") or []
+        result[str(resource_id)] = [str(permission_key) for permission_key in permission_keys]
+    return result
diff --git a/api/services/entities/agent_entities.py b/api/services/entities/agent_entities.py
index 63ae101533d..e7b5cbd7c6d 100644
--- a/api/services/entities/agent_entities.py
+++ b/api/services/entities/agent_entities.py
@@ -60,6 +60,7 @@ class ComposerSavePayload(BaseModel):
 
 class RosterAgentCreatePayload(BaseModel):
     name: str = Field(min_length=1, max_length=255)
+    mode: Literal["agent"] = "agent"
     description: str = ""
     role: str = Field(default="", max_length=255)
     icon_type: AgentIconType | None = None
diff --git a/api/services/entities/knowledge_entities/knowledge_entities.py b/api/services/entities/knowledge_entities/knowledge_entities.py
index 1b233076927..8cd99c4a98d 100644
--- a/api/services/entities/knowledge_entities/knowledge_entities.py
+++ b/api/services/entities/knowledge_entities/knowledge_entities.py
@@ -1,6 +1,6 @@
-from typing import Any, Literal
+from typing import Annotated, Any, Literal
 
-from pydantic import BaseModel, Field, field_validator
+from pydantic import BaseModel, Field, WithJsonSchema, field_validator
 
 from core.rag.entities import Rule
 from core.rag.entities.metadata_entities import MetadataFilteringCondition
@@ -8,10 +8,79 @@ from core.rag.index_processor.constant.index_type import IndexStructureType
 from core.rag.retrieval.retrieval_methods import RetrievalMethod
 from models.enums import ProcessRuleMode
 
+DocForm = Annotated[
+    str,
+    WithJsonSchema({"enum": ["text_model", "hierarchical_model", "qa_model"], "type": "string"}),
+]
+IndexingTechnique = Annotated[
+    str | None,
+    WithJsonSchema({"anyOf": [{"enum": ["high_quality", "economy"], "type": "string"}, {"type": "null"}]}),
+]
+KnowledgeProvider = Annotated[
+    str,
+    WithJsonSchema({"enum": ["vendor", "external"], "type": "string"}),
+]
+RerankingMode = Annotated[
+    str | None,
+    WithJsonSchema({"anyOf": [{"enum": ["reranking_model", "weighted_score"], "type": "string"}, {"type": "null"}]}),
+]
+SummaryIndexSetting = Annotated[
+    dict[str, Any] | None,
+    WithJsonSchema(
+        {
+            "anyOf": [
+                {
+                    "properties": {
+                        "enable": {"description": "Whether to enable summary indexing.", "type": "boolean"},
+                        "model_name": {
+                            "description": "Name of the model used for generating summaries.",
+                            "type": "string",
+                        },
+                        "model_provider_name": {
+                            "description": "Provider of the summary generation model.",
+                            "type": "string",
+                        },
+                        "summary_prompt": {
+                            "description": "Custom prompt template for summary generation.",
+                            "type": "string",
+                        },
+                    },
+                    "type": "object",
+                },
+                {"type": "null"},
+            ]
+        }
+    ),
+]
+ExternalRetrievalModel = Annotated[
+    dict[str, Any] | None,
+    WithJsonSchema(
+        {
+            "anyOf": [
+                {
+                    "properties": {
+                        "top_k": {"description": "Maximum number of results to return.", "type": "integer"},
+                        "score_threshold": {
+                            "description": "Minimum similarity score threshold for filtering results.",
+                            "type": "number",
+                        },
+                        "score_threshold_enabled": {
+                            "description": "Whether score threshold filtering is enabled.",
+                            "type": "boolean",
+                        },
+                    },
+                    "type": "object",
+                },
+                {"type": "null"},
+            ]
+        }
+    ),
+]
+
 
 class RerankingModel(BaseModel):
-    reranking_provider_name: str | None = None
-    reranking_model_name: str | None = None
+    reranking_provider_name: str | None = Field(default=None, description="Provider name of the reranking model.")
+    reranking_model_name: str | None = Field(default=None, description="Name of the reranking model.")
 
 
 class NotionIcon(BaseModel):
@@ -56,36 +125,56 @@ class DataSource(BaseModel):
 
 
 class ProcessRule(BaseModel):
-    mode: ProcessRuleMode
-    rules: Rule | None = None
+    mode: ProcessRuleMode = Field(
+        description=(
+            "Processing mode. `automatic` uses built-in rules, `custom` allows manual configuration, and "
+            "`hierarchical` enables parent-child chunk structure for `doc_form: hierarchical_model`."
+        )
+    )
+    rules: Rule | None = Field(default=None, description="Custom processing rules.")
 
 
 class WeightVectorSetting(BaseModel):
-    vector_weight: float
-    embedding_provider_name: str
-    embedding_model_name: str
+    vector_weight: float = Field(description="Weight assigned to semantic vector search results.")
+    embedding_provider_name: str = Field(description="Provider of the embedding model used for vector search.")
+    embedding_model_name: str = Field(description="Name of the embedding model used for vector search.")
 
 
 class WeightKeywordSetting(BaseModel):
-    keyword_weight: float
+    keyword_weight: float = Field(description="Weight assigned to keyword search results.")
 
 
 class WeightModel(BaseModel):
-    weight_type: Literal["semantic_first", "keyword_first", "customized"] | None = None
-    vector_setting: WeightVectorSetting | None = None
-    keyword_setting: WeightKeywordSetting | None = None
+    weight_type: Literal["semantic_first", "keyword_first", "customized"] | None = Field(
+        default=None,
+        description="Strategy for balancing semantic and keyword search weights.",
+    )
+    vector_setting: WeightVectorSetting | None = Field(default=None, description="Semantic search weight settings.")
+    keyword_setting: WeightKeywordSetting | None = Field(default=None, description="Keyword search weight settings.")
 
 
 class RetrievalModel(BaseModel):
-    search_method: RetrievalMethod
-    reranking_enable: bool
-    reranking_model: RerankingModel | None = None
-    reranking_mode: str | None = None
-    top_k: int
-    score_threshold_enabled: bool
-    score_threshold: float | None = None
-    weights: WeightModel | None = None
-    metadata_filtering_conditions: MetadataFilteringCondition | None = None
+    search_method: RetrievalMethod = Field(description="Search method used for retrieval.")
+    reranking_enable: bool = Field(description="Whether reranking is enabled.")
+    reranking_model: RerankingModel | None = Field(default=None, description="Reranking model configuration.")
+    reranking_mode: RerankingMode = Field(
+        default=None,
+        description="Reranking mode. Required when `reranking_enable` is `true`.",
+    )
+    top_k: int = Field(description="Maximum number of results to return.")
+    score_threshold_enabled: bool = Field(description="Whether score threshold filtering is enabled.")
+    score_threshold: float | None = Field(
+        default=None,
+        description="Minimum similarity score for results. Only effective when score threshold filtering is enabled.",
+    )
+    weights: WeightModel | None = Field(default=None, description="Weight configuration for hybrid search.")
+    metadata_filtering_conditions: MetadataFilteringCondition | None = Field(
+        default=None,
+        description=(
+            "Restrict retrieval to chunks whose document metadata matches the given conditions. Conditions are "
+            "evaluated server-side against document metadata fields."
+        ),
+    )
 
 
 class MetaDataConfig(BaseModel):
@@ -94,19 +183,51 @@ class MetaDataConfig(BaseModel):
 
 
 class KnowledgeConfig(BaseModel):
-    original_document_id: str | None = None
-    duplicate: bool = True
-    indexing_technique: Literal["high_quality", "economy"]
-    data_source: DataSource | None = None
-    process_rule: ProcessRule | None = None
-    retrieval_model: RetrievalModel | None = None
-    summary_index_setting: dict[str, Any] | None = Field(default=None)
-    doc_form: str = "text_model"
-    doc_language: str = "English"
-    embedding_model: str | None = None
-    embedding_model_provider: str | None = None
-    name: str | None = None
-    is_multimodal: bool = False
+    original_document_id: str | None = Field(default=None, description="Original document ID for replacement updates.")
+    duplicate: bool = Field(default=True, description="Whether duplicate document content is allowed.")
+    indexing_technique: Literal["high_quality", "economy"] = Field(
+        description=(
+            "`high_quality` uses embedding models for precise search; `economy` uses keyword-based indexing. "
+            "Required when adding the first document to a knowledge base; subsequent documents inherit the "
+            "knowledge base's indexing technique if omitted."
+        )
+    )
+    data_source: DataSource | None = Field(default=None, description="Document data source configuration.")
+    process_rule: ProcessRule | None = Field(default=None, description="Processing rules for chunking.")
+    retrieval_model: RetrievalModel | None = Field(
+        default=None,
+        description=(
+            "Retrieval model configuration. Controls how chunks are searched and ranked in this knowledge base."
+        ),
+    )
+    summary_index_setting: SummaryIndexSetting = Field(
+        default=None,
+        description="Summary index configuration.",
+    )
+    doc_form: DocForm = Field(
+        default="text_model",
+        description=(
+            "`text_model` for standard text chunking, `hierarchical_model` for parent-child chunk structure, "
+            "`qa_model` for question-answer pair extraction."
+        ),
+    )
+    doc_language: str = Field(default="English", description="Language of the document for processing optimization.")
+    embedding_model: str | None = Field(
+        default=None,
+        description=(
+            "Embedding model name. Use the `model` field from "
+            "[Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`."
+        ),
+    )
+    embedding_model_provider: str | None = Field(
+        default=None,
+        description=(
+            "Embedding model provider. Use the `provider` field from "
+            "[Get Available Models](/api-reference/models/get-available-models) with `model_type=text-embedding`."
+        ),
+    )
+    name: str | None = Field(default=None, description="Document name.")
+    is_multimodal: bool = Field(default=False, description="Whether the document uses multimodal indexing.")
 
     @field_validator("doc_form")
     @classmethod
@@ -122,47 +243,61 @@ class KnowledgeConfig(BaseModel):
 
 
 class SegmentCreateArgs(BaseModel):
-    content: str | None = None
-    answer: str | None = None
-    keywords: list[str] | None = None
-    attachment_ids: list[str] | None = None
+    content: str | None = Field(default=None, description="Chunk text content.")
+    answer: str | None = Field(default=None, description="Answer content for QA mode.")
+    keywords: list[str] | None = Field(default=None, description="Keywords for the chunk.")
+    attachment_ids: list[str] | None = Field(default=None, description="Attachment file IDs.")
 
 
 class SegmentUpdateArgs(BaseModel):
-    content: str | None = None
-    answer: str | None = None
-    keywords: list[str] | None = None
-    regenerate_child_chunks: bool = False
-    enabled: bool | None = None
-    attachment_ids: list[str] | None = None
-    summary: str | None = None  # Summary content for summary index
+    content: str | None = Field(default=None, description="Updated chunk text content.")
+    answer: str | None = Field(default=None, description="Updated answer content for QA mode.")
+    keywords: list[str] | None = Field(default=None, description="Updated keywords for the chunk.")
+    regenerate_child_chunks: bool = Field(
+        default=False,
+        description="Whether to regenerate child chunks after updating a parent chunk.",
+    )
+    enabled: bool | None = Field(default=None, description="Whether the chunk is enabled.")
+    attachment_ids: list[str] | None = Field(default=None, description="Attachment file IDs.")
+    summary: str | None = Field(default=None, description="Summary content for summary index.")
 
 
 class ChildChunkUpdateArgs(BaseModel):
-    id: str | None = None
-    content: str
+    id: str | None = Field(default=None, description="Existing child chunk ID. Omit to create a new child chunk.")
+    content: str = Field(description="Child chunk text content.")
 
 
 class MetadataArgs(BaseModel):
-    type: Literal["string", "number", "time"]
-    name: str
+    type: Literal["string", "number", "time"] = Field(
+        description="`string` for text values, `number` for numeric values, `time` for date/time values."
+    )
+    name: str = Field(description="Metadata field name.")
 
 
 class MetadataUpdateArgs(BaseModel):
-    name: str
-    value: str | int | float | None = None
+    name: str = Field(description="Metadata field name.")
+    value: str | int | float | None = Field(
+        default=None,
+        description="Metadata value. Can be a string, number, or `null`.",
+    )
 
 
 class MetadataDetail(BaseModel):
-    id: str
-    name: str
-    value: str | int | float | None = None
+    id: str = Field(description="Metadata field ID.")
+    name: str = Field(description="Metadata field name.")
+    value: str | int | float | None = Field(
+        default=None,
+        description="Metadata value. Can be a string, number, or `null`.",
+    )
 
 
 class DocumentMetadataOperation(BaseModel):
-    document_id: str
-    metadata_list: list[MetadataDetail]
-    partial_update: bool = False
+    document_id: str = Field(description="Document ID whose metadata should be updated.")
+    metadata_list: list[MetadataDetail] = Field(description="Metadata fields to update.")
+    partial_update: bool = Field(
+        default=False,
+        description="Whether to partially update metadata, keeping existing values for unspecified fields.",
+    )
 
 
 class MetadataOperationData(BaseModel):
@@ -170,4 +305,8 @@ class MetadataOperationData(BaseModel):
     Metadata operation data
     """
 
-    operation_data: list[DocumentMetadataOperation]
+    operation_data: list[DocumentMetadataOperation] = Field(
+        description=(
+            "Array of document metadata update operations. Each entry maps a document ID to its metadata values."
+        )
+    )
diff --git a/api/services/entities/knowledge_retrieval_inner.py b/api/services/entities/knowledge_retrieval_inner.py
new file mode 100644
index 00000000000..86276b80177
--- /dev/null
+++ b/api/services/entities/knowledge_retrieval_inner.py
@@ -0,0 +1,210 @@
+"""DTOs for the inner knowledge retrieval API.
+
+These models define the stable HTTP contract for trusted internal callers and
+the response shape returned by the workflow knowledge retrieval stack.
+
+Key cross-field invariants live here because callers cannot infer them from
+scalar field types alone: ``dataset_ids`` must be non-empty, either ``query``
+or ``attachment_ids`` is required, ``single`` retrieval requires both ``query``
+and ``retrieval.model``, ``automatic`` metadata filtering requires
+``model_config``, and ``manual`` metadata filtering requires conditions. The
+response reuses workflow ``Source`` items plus serialized ``llm_usage``.
+"""
+
+from __future__ import annotations
+
+from typing import Literal
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+
+from core.rag.data_post_processor.data_post_processor import WeightsDict
+from core.rag.entities.metadata_entities import SupportedComparisonOperator
+from core.workflow.nodes.knowledge_retrieval.retrieval import Source
+from fields.base import ResponseModel
+
+type JsonScalar = str | int | float | bool | None
+type JsonValue = JsonScalar | list[JsonScalar] | dict[str, JsonScalar]
+type MetadataValue = str | list[str] | int | float | None
+
+
+class InnerKnowledgeRetrieveCaller(BaseModel):
+    """Execution context provided by the trusted internal caller."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    tenant_id: str = Field(min_length=1)
+    user_id: str = Field(min_length=1)
+    app_id: str = Field(min_length=1)
+    user_from: Literal["account", "end-user"]
+    invoke_from: str = Field(min_length=1)
+
+
+class InnerKnowledgeRetrieveModelConfig(BaseModel):
+    """Model configuration used by single-retrieval or metadata filtering."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    provider: str = Field(min_length=1)
+    name: str = Field(min_length=1)
+    mode: str = Field(min_length=1)
+    completion_params: dict[str, JsonValue] = Field(default_factory=dict)
+
+
+class InnerKnowledgeRetrieveRerankingModelConfig(BaseModel):
+    """Reranking model configuration for multiple retrieval mode."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    provider: str = Field(min_length=1)
+    model: str = Field(min_length=1)
+
+
+class InnerKnowledgeRetrieveRetrievalConfig(BaseModel):
+    """Retrieval strategy and its mode-specific configuration."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    mode: Literal["multiple", "single"]
+    top_k: int | None = Field(default=None, ge=1)
+    score_threshold: float = 0.0
+    reranking_mode: str = "reranking_model"
+    reranking_enable: bool = True
+    reranking_model: InnerKnowledgeRetrieveRerankingModelConfig | None = None
+    weights: WeightsDict | None = None
+    model: InnerKnowledgeRetrieveModelConfig | None = None
+
+    @model_validator(mode="after")
+    def validate_mode_specific_fields(self) -> InnerKnowledgeRetrieveRetrievalConfig:
+        if self.mode == "single" and self.model is None:
+            raise ValueError("retrieval.model is required for single mode")
+        if self.mode == "multiple" and self.top_k is None:
+            raise ValueError("retrieval.top_k is required for multiple mode")
+        return self
+
+
+class InnerKnowledgeRetrieveMetadataCondition(BaseModel):
+    """Single metadata filter condition."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    name: str = Field(min_length=1)
+    comparison_operator: SupportedComparisonOperator
+    value: MetadataValue = None
+
+
+class InnerKnowledgeRetrieveMetadataConditions(BaseModel):
+    """Boolean composition for metadata filter conditions."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    logical_operator: Literal["and", "or"] | None = "and"
+    conditions: list[InnerKnowledgeRetrieveMetadataCondition] | None = None
+
+
+class InnerKnowledgeRetrieveMetadataFilteringConfig(BaseModel):
+    """Metadata filtering configuration forwarded to workflow retrieval.
+
+    ``automatic`` mode requires ``model_config`` so downstream metadata model
+    planning has the necessary LLM settings. ``manual`` mode requires
+    non-empty conditions because workflow retrieval expects explicit filters
+    instead of a bare mode switch.
+    """
+
+    model_config = ConfigDict(extra="forbid", populate_by_name=True)
+
+    mode: Literal["disabled", "automatic", "manual"] = "disabled"
+    metadata_model_config: InnerKnowledgeRetrieveModelConfig | None = Field(default=None, alias="model_config")
+    conditions: InnerKnowledgeRetrieveMetadataConditions | None = None
+
+    @model_validator(mode="after")
+    def validate_mode_specific_fields(self) -> InnerKnowledgeRetrieveMetadataFilteringConfig:
+        if self.mode == "automatic" and self.metadata_model_config is None:
+            raise ValueError("metadata_filtering.model_config is required for automatic mode")
+        if self.mode == "manual" and (self.conditions is None or not self.conditions.conditions):
+            raise ValueError("metadata_filtering.conditions is required for manual mode")
+        return self
+
+
+class InnerKnowledgeRetrieveRequest(BaseModel):
+    """Top-level request payload for the inner knowledge retrieval endpoint.
+
+    Request validation enforces the endpoint's behavioral contract: callers
+    must provide at least one dataset ID, at least one of ``query`` or
+    ``attachment_ids``, and a text query for ``single`` retrieval mode.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    caller: InnerKnowledgeRetrieveCaller
+    dataset_ids: list[str]
+    query: str | None = None
+    retrieval: InnerKnowledgeRetrieveRetrievalConfig
+    metadata_filtering: InnerKnowledgeRetrieveMetadataFilteringConfig = Field(
+        default_factory=InnerKnowledgeRetrieveMetadataFilteringConfig
+    )
+    attachment_ids: list[str] = Field(default_factory=list)
+
+    @field_validator("dataset_ids", "attachment_ids")
+    @classmethod
+    def validate_non_empty_items(cls, value: list[str]) -> list[str]:
+        if any(not item.strip() for item in value):
+            raise ValueError("list items must not be empty")
+        return value
+
+    @field_validator("query")
+    @classmethod
+    def normalize_query(cls, value: str | None) -> str | None:
+        if value is None:
+            return None
+        normalized = value.strip()
+        return normalized or None
+
+    @model_validator(mode="after")
+    def validate_request(self) -> InnerKnowledgeRetrieveRequest:
+        if not self.dataset_ids:
+            raise ValueError("dataset_ids must contain at least one item")
+        if not self.query and not self.attachment_ids:
+            raise ValueError("query or attachment_ids is required")
+        if self.retrieval.mode == "single" and not self.query:
+            raise ValueError("query is required for single mode")
+        return self
+
+
+class InnerKnowledgeRetrieveUsage(ResponseModel):
+    """Serialized LLM usage payload returned by dataset retrieval."""
+
+    model_config = ConfigDict(
+        from_attributes=True,
+        extra="forbid",
+        populate_by_name=True,
+        serialize_by_alias=True,
+        protected_namespaces=(),
+    )
+
+    prompt_tokens: int
+    completion_tokens: int
+    total_tokens: int
+    prompt_unit_price: str
+    completion_unit_price: str
+    prompt_price_unit: str
+    completion_price_unit: str
+    prompt_price: str
+    completion_price: str
+    total_price: str
+    currency: str | None = None
+    latency: float | int
+
+
+class InnerKnowledgeRetrieveResponse(ResponseModel):
+    """Workflow-style retrieval results plus accumulated usage."""
+
+    model_config = ConfigDict(
+        from_attributes=True,
+        extra="forbid",
+        populate_by_name=True,
+        serialize_by_alias=True,
+        protected_namespaces=(),
+    )
+
+    results: list[Source]
+    usage: InnerKnowledgeRetrieveUsage
diff --git a/api/services/errors/knowledge_retrieval.py b/api/services/errors/knowledge_retrieval.py
new file mode 100644
index 00000000000..4e00641e340
--- /dev/null
+++ b/api/services/errors/knowledge_retrieval.py
@@ -0,0 +1,49 @@
+"""Service errors for the inner knowledge retrieval API."""
+
+from services.errors.base import BaseServiceError
+
+
+class InnerKnowledgeRetrievalServiceError(BaseServiceError):
+    """Base service error with a stable HTTP mapping contract."""
+
+    error_code = "knowledge_retrieve_failed"
+    status_code = 500
+    default_description = "Knowledge retrieval failed."
+
+    def __init__(self, description: str | None = None):
+        self.description = description or self.default_description
+        ValueError.__init__(self, self.description)
+
+
+class InnerKnowledgeRetrieveAppNotFoundError(InnerKnowledgeRetrievalServiceError):
+    error_code = "app_not_found"
+    status_code = 404
+    default_description = "App not found."
+
+
+class InnerKnowledgeRetrieveAppTenantMismatchError(InnerKnowledgeRetrievalServiceError):
+    error_code = "app_tenant_mismatch"
+    status_code = 403
+    default_description = "App does not belong to caller tenant."
+
+
+class InnerKnowledgeRetrieveDatasetNotFoundError(InnerKnowledgeRetrievalServiceError):
+    error_code = "dataset_not_found"
+    status_code = 404
+    default_description = "Dataset not found."
+
+
+class InnerKnowledgeRetrieveDatasetTenantMismatchError(InnerKnowledgeRetrievalServiceError):
+    error_code = "dataset_tenant_mismatch"
+    status_code = 403
+    default_description = "Dataset does not belong to caller tenant."
+
+
+class ExternalKnowledgeRetrievalError(ValueError):
+    """Raised when an external dataset retrieval dependency fails.
+
+    This stays a ``ValueError`` subclass for compatibility with existing callers
+    that already treat external retrieval failures as generic retrieval errors,
+    while still giving inner API controllers a dedicated error type to map to
+    ``502 external_knowledge_failed``.
+    """
diff --git a/api/services/external_knowledge_service.py b/api/services/external_knowledge_service.py
index 60b457ecd03..c0aedfaceea 100644
--- a/api/services/external_knowledge_service.py
+++ b/api/services/external_knowledge_service.py
@@ -22,6 +22,7 @@ from services.entities.external_knowledge_entities.external_knowledge_entities i
     ExternalKnowledgeApiSetting,
 )
 from services.errors.dataset import DatasetNameDuplicateError
+from services.errors.knowledge_retrieval import ExternalKnowledgeRetrievalError
 
 
 class ExternalDatasetService:
@@ -279,6 +280,7 @@ class ExternalDatasetService:
             provider="external",
             retrieval_model=args.get("external_retrieval_model"),
             created_by=user_id,
+            maintainer=user_id,
         )
 
         db.session.add(dataset)
@@ -309,13 +311,22 @@ class ExternalDatasetService:
         external_retrieval_parameters: dict[str, Any],
         metadata_condition: MetadataFilteringCondition | None = None,
     ):
+        """Fetch retrieval records from an external knowledge provider.
+
+        Success requires a tenant-scoped binding plus API template and a ``200``
+        response body shaped like ``{"records": [...]}``. All dependency
+        failures, non-200 responses, and malformed success payloads must be
+        normalized to ``ExternalKnowledgeRetrievalError`` so callers—especially
+        the inner knowledge retrieval API—can consistently expose
+        ``502 external_knowledge_failed``.
+        """
         external_knowledge_binding = db.session.scalar(
             select(ExternalKnowledgeBindings)
             .where(ExternalKnowledgeBindings.dataset_id == dataset_id, ExternalKnowledgeBindings.tenant_id == tenant_id)
             .limit(1)
         )
         if not external_knowledge_binding:
-            raise ValueError("external knowledge binding not found")
+            raise ExternalKnowledgeRetrievalError("external knowledge binding not found")
 
         external_knowledge_api = db.session.scalar(
             select(ExternalKnowledgeApis)
@@ -326,7 +337,7 @@ class ExternalDatasetService:
             .limit(1)
         )
         if external_knowledge_api is None or external_knowledge_api.settings is None:
-            raise ValueError("external api template not found")
+            raise ExternalKnowledgeRetrievalError("external api template not found")
 
         settings = json.loads(external_knowledge_api.settings)
         headers = {"Content-Type": "application/json"}
@@ -344,16 +355,34 @@ class ExternalDatasetService:
             "metadata_condition": metadata_condition.model_dump() if metadata_condition else None,
         }
 
-        response = ExternalDatasetService.process_external_api(
-            ExternalKnowledgeApiSetting(
-                url=f"{settings.get('endpoint')}/retrieval",
-                request_method="post",
-                headers=headers,
-                params=request_params,
-            ),
-            None,
-        )
+        try:
+            response = ExternalDatasetService.process_external_api(
+                ExternalKnowledgeApiSetting(
+                    url=f"{settings.get('endpoint')}/retrieval",
+                    request_method="post",
+                    headers=headers,
+                    params=request_params,
+                ),
+                None,
+            )
+        except ExternalKnowledgeRetrievalError:
+            raise
+        except Exception as exc:
+            raise ExternalKnowledgeRetrievalError(str(exc)) from exc
+
         if response.status_code == 200:
-            return cast(list[Any], response.json().get("records", []))
+            try:
+                response_payload = response.json()
+            except Exception as exc:
+                raise ExternalKnowledgeRetrievalError("invalid external knowledge response") from exc
+
+            if not isinstance(response_payload, dict):
+                raise ExternalKnowledgeRetrievalError("invalid external knowledge response")
+
+            records = response_payload.get("records", [])
+            if not isinstance(records, list):
+                raise ExternalKnowledgeRetrievalError("invalid external knowledge response")
+
+            return cast(list[Any], records)
         else:
-            raise ValueError(response.text)
+            raise ExternalKnowledgeRetrievalError(response.text)
diff --git a/api/services/feature_service.py b/api/services/feature_service.py
index 4d460c288ac..2ae0c63ff75 100644
--- a/api/services/feature_service.py
+++ b/api/services/feature_service.py
@@ -160,6 +160,7 @@ class PluginManagerModel(FeatureResponseModel):
 
 
 class SystemFeatureModel(FeatureResponseModel):
+    enable_app_deploy: bool = False
     sso_enforced_for_signin: bool = False
     sso_enforced_for_signin_protocol: str = ""
     enable_marketplace: bool = False
@@ -180,6 +181,7 @@ class SystemFeatureModel(FeatureResponseModel):
     enable_creators_platform: bool = False
     enable_trial_app: bool = False
     enable_explore_banner: bool = False
+    rbac_enabled: bool = False
 
 
 class FeatureService:
@@ -246,6 +248,7 @@ class FeatureService:
     @classmethod
     def get_system_features(cls, is_authenticated: bool = False) -> SystemFeatureModel:
         system_features = SystemFeatureModel()
+        system_features.rbac_enabled = dify_config.RBAC_ENABLED
 
         cls._fulfill_system_params_from_env(system_features)
 
@@ -419,6 +422,9 @@ class FeatureService:
         if "IsAllowCreateWorkspace" in enterprise_info:
             features.is_allow_create_workspace = enterprise_info["IsAllowCreateWorkspace"]
 
+        if "EnableAppDeploy" in enterprise_info:
+            features.enable_app_deploy = enterprise_info["EnableAppDeploy"]
+
         if "Branding" in enterprise_info:
             features.branding.application_title = enterprise_info["Branding"].get("applicationTitle", "")
             features.branding.login_page_logo = enterprise_info["Branding"].get("loginPageLogo", "")
diff --git a/api/services/feedback_service.py b/api/services/feedback_service.py
index d6c338a830d..24cfb8aa852 100644
--- a/api/services/feedback_service.py
+++ b/api/services/feedback_service.py
@@ -5,8 +5,8 @@ from datetime import datetime
 
 from flask import Response
 from sqlalchemy import or_, select
+from sqlalchemy.orm import Session
 
-from extensions.ext_database import db
 from models.enums import FeedbackRating
 from models.model import Account, App, Conversation, Message, MessageFeedback
 
@@ -14,6 +14,7 @@ from models.model import Account, App, Conversation, Message, MessageFeedback
 class FeedbackService:
     @staticmethod
     def export_feedbacks(
+        session: Session,
         app_id: str,
         from_source: str | None = None,
         rating: str | None = None,
@@ -81,7 +82,7 @@ class FeedbackService:
         stmt = stmt.order_by(MessageFeedback.created_at.desc())
 
         # Execute query
-        results = db.session.execute(stmt).all()
+        results = session.execute(stmt).all()
 
         # Prepare data for export
         export_data = []
diff --git a/api/services/file_service.py b/api/services/file_service.py
index 4d3afcc9ad4..e41d74ad3eb 100644
--- a/api/services/file_service.py
+++ b/api/services/file_service.py
@@ -20,7 +20,6 @@ from constants import (
     VIDEO_EXTENSIONS,
 )
 from core.rag.extractor.extract_processor import ExtractProcessor
-from extensions.ext_database import db
 from extensions.ext_storage import storage
 from extensions.storage.storage_type import StorageType
 from graphon.file import helpers as file_helpers
@@ -39,12 +38,13 @@ class FileService:
     _session_maker: sessionmaker[Session]
 
     def __init__(self, session_factory: sessionmaker | Engine | None = None):
-        if isinstance(session_factory, Engine):
-            self._session_maker = sessionmaker(bind=session_factory)
-        elif isinstance(session_factory, sessionmaker):
-            self._session_maker = session_factory
-        else:
-            raise AssertionError("must be a sessionmaker or an Engine.")
+        match session_factory:
+            case Engine():
+                self._session_maker = sessionmaker(bind=session_factory)
+            case sessionmaker():
+                self._session_maker = session_factory
+            case _:
+                raise AssertionError("must be a sessionmaker or an Engine.")
 
     def upload_file(
         self,
@@ -267,7 +267,9 @@ class FileService:
             session.delete(upload_file)
 
     @staticmethod
-    def get_upload_files_by_ids(tenant_id: str, upload_file_ids: Sequence[str]) -> dict[str, UploadFile]:
+    def get_upload_files_by_ids(
+        session: Session, tenant_id: str, upload_file_ids: Sequence[str]
+    ) -> dict[str, UploadFile]:
         """
         Fetch `UploadFile` rows for a tenant in a single batch query.
 
@@ -281,7 +283,7 @@ class FileService:
         unique_upload_file_ids: list[str] = list(set(upload_file_id_list))
 
         # Fetch upload files in one query for efficient batch access.
-        upload_files: Sequence[UploadFile] = db.session.scalars(
+        upload_files: Sequence[UploadFile] = session.scalars(
             select(UploadFile).where(
                 UploadFile.tenant_id == tenant_id,
                 UploadFile.id.in_(unique_upload_file_ids),
diff --git a/api/services/human_input_delivery_test_service.py b/api/services/human_input_delivery_test_service.py
index c266d4f9586..995cb94c633 100644
--- a/api/services/human_input_delivery_test_service.py
+++ b/api/services/human_input_delivery_test_service.py
@@ -119,10 +119,11 @@ class HumanInputDeliveryTestService:
 
 class EmailDeliveryTestHandler:
     def __init__(self, session_factory: sessionmaker | Engine | None = None) -> None:
-        if session_factory is None:
-            session_factory = sessionmaker(bind=db.engine)
-        elif isinstance(session_factory, Engine):
-            session_factory = sessionmaker(bind=session_factory)
+        match session_factory:
+            case None:
+                session_factory = sessionmaker(bind=db.engine)
+            case Engine():
+                session_factory = sessionmaker(bind=session_factory)
         self._session_factory = session_factory
 
     def supports(self, method: DeliveryChannelConfig) -> bool:
@@ -179,11 +180,12 @@ class EmailDeliveryTestHandler:
         emails: list[str] = []
         bound_reference_ids: list[str] = []
         for recipient in recipients.items:
-            if isinstance(recipient, MemberRecipient):
-                bound_reference_ids.append(recipient.reference_id)
-            elif isinstance(recipient, ExternalRecipient):
-                if recipient.email:
-                    emails.append(recipient.email)
+            match recipient:
+                case MemberRecipient():
+                    bound_reference_ids.append(recipient.reference_id)
+                case ExternalRecipient():
+                    if recipient.email:
+                        emails.append(recipient.email)
 
         if recipients.include_bound_group:
             bound_reference_ids = []
diff --git a/api/services/knowledge_retrieval_inner_service.py b/api/services/knowledge_retrieval_inner_service.py
new file mode 100644
index 00000000000..fccc81c4a29
--- /dev/null
+++ b/api/services/knowledge_retrieval_inner_service.py
@@ -0,0 +1,145 @@
+"""Service wrapper for the inner knowledge retrieval API.
+
+This service keeps the internal HTTP contract small while reusing the workflow
+retrieval stack in ``core.rag.retrieval.dataset_retrieval.DatasetRetrieval``.
+The only authorization enforced here is tenant ownership of the caller app and
+requested datasets.
+
+It intentionally does not check ``dataset.enable_api`` or user-level dataset
+permissions. After the caller app and requested datasets pass tenant-scoped
+prechecks, dataset availability and "no usable document" cases are delegated to
+``DatasetRetrieval`` and may legitimately produce an empty result list instead
+of a separate validation error.
+"""
+
+from sqlalchemy import select
+
+from core.rag.entities.metadata_entities import Condition, MetadataFilteringCondition
+from core.rag.retrieval.dataset_retrieval import DatasetRetrieval
+from core.workflow.nodes.knowledge_retrieval.retrieval import KnowledgeRetrievalRequest
+from extensions.ext_database import db
+from graphon.model_runtime.utils.encoders import jsonable_encoder
+from graphon.nodes.llm.entities import ModelConfig
+from models.dataset import Dataset
+from models.model import App
+from services.entities.knowledge_retrieval_inner import (
+    InnerKnowledgeRetrieveRequest,
+    InnerKnowledgeRetrieveResponse,
+    InnerKnowledgeRetrieveUsage,
+)
+from services.errors.knowledge_retrieval import (
+    InnerKnowledgeRetrieveAppNotFoundError,
+    InnerKnowledgeRetrieveAppTenantMismatchError,
+    InnerKnowledgeRetrieveDatasetNotFoundError,
+    InnerKnowledgeRetrieveDatasetTenantMismatchError,
+)
+
+
+class InnerKnowledgeRetrievalService:
+    """Validate inner caller scope and delegate to workflow dataset retrieval."""
+
+    def retrieve(self, request: InnerKnowledgeRetrieveRequest) -> InnerKnowledgeRetrieveResponse:
+        """Run tenant-scoped retrieval for a trusted internal caller.
+
+        This method only rejects caller app existence/tenant mismatches and
+        requested dataset existence/tenant mismatches. It deliberately leaves
+        ``dataset.enable_api``, user-level dataset permissions, and
+        availability/no-usable-document handling to ``DatasetRetrieval`` so the
+        inner API stays aligned with workflow retrieval semantics, including
+        returning ``[]`` when datasets are present but yield no retrievable
+        content.
+
+        Raises:
+            InnerKnowledgeRetrieveAppNotFoundError: The caller app does not exist.
+            InnerKnowledgeRetrieveAppTenantMismatchError: The caller app is outside the caller tenant.
+            InnerKnowledgeRetrieveDatasetNotFoundError: At least one requested dataset does not exist.
+            InnerKnowledgeRetrieveDatasetTenantMismatchError:
+                At least one requested dataset is outside the caller tenant.
+        """
+        self._validate_caller_app(tenant_id=request.caller.tenant_id, app_id=request.caller.app_id)
+        self._validate_datasets(tenant_id=request.caller.tenant_id, dataset_ids=request.dataset_ids)
+
+        rag = DatasetRetrieval()
+        results = rag.knowledge_retrieval(request=self._to_rag_request(request))
+        return InnerKnowledgeRetrieveResponse(
+            results=results,
+            usage=InnerKnowledgeRetrieveUsage.model_validate(jsonable_encoder(rag.llm_usage)),
+        )
+
+    def _validate_caller_app(self, *, tenant_id: str, app_id: str) -> None:
+        app = db.session.scalar(select(App).where(App.id == app_id).limit(1))
+        if app is None:
+            raise InnerKnowledgeRetrieveAppNotFoundError(f"App '{app_id}' not found")
+        if app.tenant_id != tenant_id:
+            raise InnerKnowledgeRetrieveAppTenantMismatchError(
+                f"App '{app_id}' does not belong to tenant '{tenant_id}'"
+            )
+
+    def _validate_datasets(self, *, tenant_id: str, dataset_ids: list[str]) -> None:
+        datasets = db.session.scalars(select(Dataset).where(Dataset.id.in_(dataset_ids))).all()
+
+        found_ids = {dataset.id for dataset in datasets}
+        missing_ids = sorted(set(dataset_ids) - found_ids)
+        if missing_ids:
+            raise InnerKnowledgeRetrieveDatasetNotFoundError(f"Datasets not found: {', '.join(missing_ids)}")
+
+        mismatched_ids = sorted(dataset.id for dataset in datasets if dataset.tenant_id != tenant_id)
+        if mismatched_ids:
+            raise InnerKnowledgeRetrieveDatasetTenantMismatchError(
+                f"Datasets do not belong to tenant '{tenant_id}': {', '.join(mismatched_ids)}"
+            )
+
+    def _to_rag_request(self, request: InnerKnowledgeRetrieveRequest) -> KnowledgeRetrievalRequest:
+        metadata_model_config = request.metadata_filtering.metadata_model_config
+        metadata_conditions = request.metadata_filtering.conditions
+
+        return KnowledgeRetrievalRequest(
+            tenant_id=request.caller.tenant_id,
+            user_id=request.caller.user_id,
+            app_id=request.caller.app_id,
+            user_from=request.caller.user_from,
+            dataset_ids=request.dataset_ids,
+            query=request.query,
+            retrieval_mode=request.retrieval.mode,
+            model_provider=request.retrieval.model.provider if request.retrieval.model else None,
+            completion_params=request.retrieval.model.completion_params if request.retrieval.model else None,
+            model_mode=request.retrieval.model.mode if request.retrieval.model else None,
+            model_name=request.retrieval.model.name if request.retrieval.model else None,
+            metadata_model_config=ModelConfig.model_validate(metadata_model_config.model_dump(mode="python"))
+            if metadata_model_config
+            else None,
+            metadata_filtering_conditions=(
+                MetadataFilteringCondition(
+                    logical_operator=metadata_conditions.logical_operator,
+                    conditions=(
+                        [
+                            Condition(
+                                name=condition.name,
+                                comparison_operator=condition.comparison_operator,
+                                value=condition.value,
+                            )
+                            for condition in metadata_conditions.conditions
+                        ]
+                        if metadata_conditions.conditions is not None
+                        else None
+                    ),
+                )
+                if metadata_conditions is not None
+                else None
+            ),
+            metadata_filtering_mode=request.metadata_filtering.mode,
+            top_k=request.retrieval.top_k or 0,
+            score_threshold=request.retrieval.score_threshold,
+            reranking_mode=request.retrieval.reranking_mode,
+            reranking_model=(
+                {
+                    "reranking_provider_name": request.retrieval.reranking_model.provider,
+                    "reranking_model_name": request.retrieval.reranking_model.model,
+                }
+                if request.retrieval.reranking_model is not None
+                else None
+            ),
+            weights=request.retrieval.weights,
+            reranking_enable=request.retrieval.reranking_enable,
+            attachment_ids=request.attachment_ids or None,
+        )
diff --git a/api/services/rag_pipeline/entity/pipeline_service_api_entities.py b/api/services/rag_pipeline/entity/pipeline_service_api_entities.py
index ec25adac8bf..c80b7604099 100644
--- a/api/services/rag_pipeline/entity/pipeline_service_api_entities.py
+++ b/api/services/rag_pipeline/entity/pipeline_service_api_entities.py
@@ -1,22 +1,142 @@
 from collections.abc import Mapping
-from typing import Any
+from typing import Annotated, Any
 
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, WithJsonSchema
+
+DatasourceType = Annotated[
+    str,
+    WithJsonSchema({"enum": ["local_file", "online_document", "website_crawl", "online_drive"], "type": "string"}),
+]
+PipelineResponseMode = Annotated[
+    str,
+    WithJsonSchema({"enum": ["streaming", "blocking"], "type": "string"}),
+]
+DatasourceInfoList = Annotated[
+    list[Mapping[str, Any]],
+    WithJsonSchema(
+        {
+            "items": {
+                "oneOf": [
+                    {
+                        "properties": {
+                            "reference": {
+                                "description": (
+                                    "Use the `id` returned by the "
+                                    "[Upload Pipeline File](/api-reference/knowledge-pipeline/upload-pipeline-file) "
+                                    "endpoint. `related_id` is accepted as an alias."
+                                ),
+                                "type": "string",
+                            },
+                            "name": {"description": "Document title. Defaults to `untitled`.", "type": "string"},
+                        },
+                        "required": ["reference"],
+                        "title": "Local File",
+                        "type": "object",
+                    },
+                    {
+                        "properties": {
+                            "workspace_id": {
+                                "description": "ID of the workspace or database in the external platform.",
+                                "type": "string",
+                            },
+                            "page": {
+                                "description": "Page details.",
+                                "properties": {
+                                    "page_id": {"description": "Page identifier.", "type": "string"},
+                                    "type": {
+                                        "description": "Page type defined by the datasource plugin.",
+                                        "type": "string",
+                                    },
+                                    "page_name": {
+                                        "description": "Display name. Defaults to `untitled`.",
+                                        "type": "string",
+                                    },
+                                },
+                                "required": ["page_id", "type"],
+                                "type": "object",
+                            },
+                            "credential_id": {
+                                "description": (
+                                    "Credential for authenticating with the external platform. If omitted, the "
+                                    "provider's default credential is used."
+                                ),
+                                "type": "string",
+                            },
+                        },
+                        "required": ["workspace_id", "page"],
+                        "title": "Online Document",
+                        "type": "object",
+                    },
+                    {
+                        "properties": {
+                            "url": {"description": "URL to crawl.", "type": "string"},
+                            "title": {
+                                "description": "Used as the document name. Defaults to `untitled`.",
+                                "type": "string",
+                            },
+                        },
+                        "required": ["url"],
+                        "title": "Website Crawl",
+                        "type": "object",
+                    },
+                    {
+                        "properties": {
+                            "id": {"description": "File or folder ID.", "type": "string"},
+                            "type": {
+                                "description": "Whether this entry is a single file or a folder to expand.",
+                                "enum": ["file", "folder"],
+                                "type": "string",
+                            },
+                            "bucket": {
+                                "description": (
+                                    "Storage bucket name. Required by some drive providers, such as S3-compatible "
+                                    "stores; omit if the provider does not use buckets."
+                                ),
+                                "type": "string",
+                            },
+                            "name": {"description": "File name. Defaults to `untitled`.", "type": "string"},
+                        },
+                        "required": ["id", "type"],
+                        "title": "Online Drive",
+                        "type": "object",
+                    },
+                ]
+            },
+            "type": "array",
+        }
+    ),
+]
 
 
 class DatasourceNodeRunApiEntity(BaseModel):
     pipeline_id: str
     node_id: str
     inputs: dict[str, Any]
-    datasource_type: str
+    datasource_type: DatasourceType
     credential_id: str | None = None
     is_published: bool
 
 
 class PipelineRunApiEntity(BaseModel):
-    inputs: Mapping[str, Any]
-    datasource_type: str
-    datasource_info_list: list[Mapping[str, Any]]
-    start_node_id: str
-    is_published: bool
-    response_mode: str
+    inputs: Mapping[str, Any] = Field(
+        description=(
+            "Key-value pairs for pipeline input variables defined in the workflow. Pass `{}` if the pipeline has "
+            "no input variables."
+        )
+    )
+    datasource_type: DatasourceType = Field(
+        description="Type of the datasource. Determines which fields are expected in `datasource_info_list` items."
+    )
+    datasource_info_list: DatasourceInfoList = Field(
+        description="List of datasource objects to process. The expected item structure depends on `datasource_type`."
+    )
+    start_node_id: str = Field(description="ID of the datasource node where the run starts.")
+    is_published: bool = Field(
+        description=(
+            "Whether to run the published or draft version of the pipeline. `true` runs the latest published "
+            "version; `false` runs the current draft (useful for testing unpublished changes)."
+        )
+    )
+    response_mode: PipelineResponseMode = Field(
+        description="Response mode. Use `streaming` for SSE or `blocking` for JSON."
+    )
diff --git a/api/services/rag_pipeline/rag_pipeline_dsl_service.py b/api/services/rag_pipeline/rag_pipeline_dsl_service.py
index 52fe9108907..bdbf3e080e9 100644
--- a/api/services/rag_pipeline/rag_pipeline_dsl_service.py
+++ b/api/services/rag_pipeline/rag_pipeline_dsl_service.py
@@ -283,6 +283,7 @@ class RagPipelineDslService:
                             },
                             indexing_technique=IndexTechniqueType(knowledge_configuration.indexing_technique),
                             created_by=account.id,
+                            maintainer=account.id,
                             retrieval_model=knowledge_configuration.retrieval_model.model_dump(),
                             runtime_mode=DatasetRuntimeMode.RAG_PIPELINE,
                             chunk_structure=knowledge_configuration.chunk_structure,
@@ -415,6 +416,7 @@ class RagPipelineDslService:
                             },
                             indexing_technique=IndexTechniqueType(knowledge_configuration.indexing_technique),
                             created_by=account.id,
+                            maintainer=account.id,
                             retrieval_model=knowledge_configuration.retrieval_model.model_dump(),
                             runtime_mode=DatasetRuntimeMode.RAG_PIPELINE,
                             chunk_structure=knowledge_configuration.chunk_structure,
diff --git a/api/services/retention/workflow_run/clear_free_plan_expired_workflow_run_logs.py b/api/services/retention/workflow_run/clear_free_plan_expired_workflow_run_logs.py
index 58e8ac57a8f..3652997f8af 100644
--- a/api/services/retention/workflow_run/clear_free_plan_expired_workflow_run_logs.py
+++ b/api/services/retention/workflow_run/clear_free_plan_expired_workflow_run_logs.py
@@ -1,3 +1,10 @@
+"""Cleanup expired workflow run logs for free-plan tenants.
+
+The cleanup service owns billing eligibility decisions while repositories own database-efficient batch selection and
+deletion. Free-plan cleanup intentionally scans lightweight workflow run references first, then re-queries the same
+candidate cursor slice with eligible tenant IDs so paid tenants are skipped without hydrating full WorkflowRun models.
+"""
+
 import datetime
 import logging
 import random
@@ -11,8 +18,11 @@ from sqlalchemy.orm import Session, sessionmaker
 from configs import dify_config
 from enums.cloud_plan import CloudPlan
 from extensions.ext_database import db
-from models.workflow import WorkflowRun
-from repositories.api_workflow_run_repository import APIWorkflowRunRepository, RunsWithRelatedCountsDict
+from repositories.api_workflow_run_repository import (
+    APIWorkflowRunRepository,
+    RunsWithRelatedCountsDict,
+    WorkflowRunCleanupRef,
+)
 from repositories.factory import DifyAPIRepositoryFactory
 from repositories.sqlalchemy_workflow_trigger_log_repository import SQLAlchemyWorkflowTriggerLogRepository
 from services.billing_service import BillingService, SubscriptionPlan
@@ -186,6 +196,13 @@ _RELATED_RECORD_KEYS = ("node_executions", "offloads", "app_logs", "trigger_logs
 
 
 class WorkflowRunCleanup:
+    """
+    Coordinates free-plan workflow run retention cleanup.
+
+    The cleanup cursor advances by candidate refs, not target refs. This keeps pagination stable
+    when billing filters out paid or unknown tenants before the repository performs the target lookup.
+    """
+
     def __init__(
         self,
         days: int,
@@ -254,26 +271,28 @@ class WorkflowRunCleanup:
                 batch_start = time.monotonic()
 
                 fetch_start = time.monotonic()
-                run_rows = self.workflow_run_repo.get_runs_batch_by_time_range(
+                candidate_last_seen = last_seen
+                candidate_refs = self.workflow_run_repo.get_cleanup_refs_batch_by_time_range(
                     start_from=self.window_start,
                     end_before=self.window_end,
-                    last_seen=last_seen,
+                    last_seen=candidate_last_seen,
                     batch_size=self.batch_size,
                 )
-                if not run_rows:
+                if not candidate_refs:
                     logger.info("workflow_run_cleanup (batch #%s): no more rows to process", batch_index + 1)
                     break
 
                 batch_index += 1
-                last_seen = (run_rows[-1].created_at, run_rows[-1].id)
+                candidate_high_water = self._cursor_from_ref(candidate_refs[-1])
+                last_seen = candidate_high_water
                 logger.info(
-                    "workflow_run_cleanup (batch #%s): fetched %s rows in %sms",
+                    "workflow_run_cleanup (batch #%s): fetched %s candidate refs in %sms",
                     batch_index,
-                    len(run_rows),
+                    len(candidate_refs),
                     int((time.monotonic() - fetch_start) * 1000),
                 )
 
-                tenant_ids = {row.tenant_id for row in run_rows}
+                tenant_ids = {ref.tenant_id for ref in candidate_refs}
 
                 filter_start = time.monotonic()
                 free_tenants = self._filter_free_tenants(tenant_ids)
@@ -285,10 +304,28 @@ class WorkflowRunCleanup:
                     int((time.monotonic() - filter_start) * 1000),
                 )
 
-                free_runs = [row for row in run_rows if row.tenant_id in free_tenants]
-                paid_or_skipped = len(run_rows) - len(free_runs)
+                target_refs: Sequence[WorkflowRunCleanupRef] = []
+                if free_tenants:
+                    target_fetch_start = time.monotonic()
+                    target_refs = self.workflow_run_repo.get_cleanup_refs_batch_by_time_range(
+                        start_from=self.window_start,
+                        end_before=self.window_end,
+                        last_seen=candidate_last_seen,
+                        batch_size=self.batch_size,
+                        tenant_ids=sorted(free_tenants),
+                        upper_bound=candidate_high_water,
+                    )
+                    logger.info(
+                        "workflow_run_cleanup (batch #%s): fetched %s target refs in %sms",
+                        batch_index,
+                        len(target_refs),
+                        int((time.monotonic() - target_fetch_start) * 1000),
+                    )
 
-                if not free_runs:
+                target_run_ids = [ref.id for ref in target_refs]
+                paid_or_skipped = max(len(candidate_refs) - len(target_run_ids), 0)
+
+                if not target_run_ids:
                     skipped_message = (
                         f"[batch #{batch_index}] skipped (no sandbox runs in batch, {paid_or_skipped} paid/unknown)"
                     )
@@ -299,7 +336,7 @@ class WorkflowRunCleanup:
                         )
                     )
                     self._metrics.record_batch(
-                        batch_rows=len(run_rows),
+                        batch_rows=len(candidate_refs),
                         targeted_runs=0,
                         skipped_runs=paid_or_skipped,
                         deleted_runs=0,
@@ -309,13 +346,13 @@ class WorkflowRunCleanup:
                     )
                     continue
 
-                total_runs_targeted += len(free_runs)
+                total_runs_targeted += len(target_run_ids)
 
                 if self.dry_run:
                     count_start = time.monotonic()
-                    batch_counts = self.workflow_run_repo.count_runs_with_related(
-                        free_runs,
-                        count_node_executions=self._count_node_executions,
+                    batch_counts = self.workflow_run_repo.count_runs_with_related_by_ids(
+                        target_run_ids,
+                        count_node_executions=self._count_node_executions_by_run_ids,
                         count_trigger_logs=self._count_trigger_logs,
                     )
                     logger.info(
@@ -325,10 +362,10 @@ class WorkflowRunCleanup:
                     )
                     if related_totals is not None:
                         self._accumulate_related_counts(related_totals, batch_counts)
-                    sample_ids = ", ".join(run.id for run in free_runs[:5])
+                    sample_ids = ", ".join(target_run_ids[:5])
                     click.echo(
                         click.style(
-                            f"[batch #{batch_index}] would delete {len(free_runs)} runs "
+                            f"[batch #{batch_index}] would delete {len(target_run_ids)} runs "
                             f"(sample ids: {sample_ids}) and skip {paid_or_skipped} paid/unknown",
                             fg="yellow",
                         )
@@ -339,8 +376,8 @@ class WorkflowRunCleanup:
                         int((time.monotonic() - batch_start) * 1000),
                     )
                     self._metrics.record_batch(
-                        batch_rows=len(run_rows),
-                        targeted_runs=len(free_runs),
+                        batch_rows=len(candidate_refs),
+                        targeted_runs=len(target_run_ids),
                         skipped_runs=paid_or_skipped,
                         deleted_runs=0,
                         related_counts={
@@ -354,14 +391,14 @@ class WorkflowRunCleanup:
 
                 try:
                     delete_start = time.monotonic()
-                    counts = self.workflow_run_repo.delete_runs_with_related(
-                        free_runs,
-                        delete_node_executions=self._delete_node_executions,
+                    counts = self.workflow_run_repo.delete_runs_with_related_by_ids(
+                        target_run_ids,
+                        delete_node_executions=self._delete_node_executions_by_run_ids,
                         delete_trigger_logs=self._delete_trigger_logs,
                     )
                     delete_ms = int((time.monotonic() - delete_start) * 1000)
                 except Exception:
-                    logger.exception("Failed to delete workflow runs batch ending at %s", last_seen[0])
+                    logger.exception("Failed to delete workflow runs batch ending at %s", candidate_high_water[0])
                     raise
 
                 total_runs_deleted += counts["runs"]
@@ -382,8 +419,8 @@ class WorkflowRunCleanup:
                     int((time.monotonic() - batch_start) * 1000),
                 )
                 self._metrics.record_batch(
-                    batch_rows=len(run_rows),
-                    targeted_runs=len(free_runs),
+                    batch_rows=len(candidate_refs),
+                    targeted_runs=len(target_run_ids),
                     skipped_runs=paid_or_skipped,
                     deleted_runs=counts["runs"],
                     related_counts={
@@ -439,7 +476,7 @@ class WorkflowRunCleanup:
             )
 
     def _filter_free_tenants(self, tenant_ids: Iterable[str]) -> set[str]:
-        tenant_id_list = list(tenant_ids)
+        tenant_id_list = sorted(set(tenant_ids))
 
         if not dify_config.BILLING_ENABLED:
             return set(tenant_id_list)
@@ -553,15 +590,17 @@ class WorkflowRunCleanup:
         totals["pauses"] += batch.get("pauses", 0)
         totals["pause_reasons"] += batch.get("pause_reasons", 0)
 
-    def _count_node_executions(self, session: Session, runs: Sequence[WorkflowRun]) -> tuple[int, int]:
-        run_ids = [run.id for run in runs]
+    @staticmethod
+    def _cursor_from_ref(ref: WorkflowRunCleanupRef) -> tuple[datetime.datetime, str]:
+        return ref.created_at, ref.id
+
+    def _count_node_executions_by_run_ids(self, session: Session, run_ids: Sequence[str]) -> tuple[int, int]:
         repo = DifyAPIRepositoryFactory.create_api_workflow_node_execution_repository(
             session_maker=sessionmaker(bind=session.get_bind(), expire_on_commit=False)
         )
         return repo.count_by_runs(session, run_ids)
 
-    def _delete_node_executions(self, session: Session, runs: Sequence[WorkflowRun]) -> tuple[int, int]:
-        run_ids = [run.id for run in runs]
+    def _delete_node_executions_by_run_ids(self, session: Session, run_ids: Sequence[str]) -> tuple[int, int]:
         repo = DifyAPIRepositoryFactory.create_api_workflow_node_execution_repository(
             session_maker=sessionmaker(bind=session.get_bind(), expire_on_commit=False)
         )
diff --git a/api/services/saved_message_service.py b/api/services/saved_message_service.py
index 90f01377123..9a65429748e 100644
--- a/api/services/saved_message_service.py
+++ b/api/services/saved_message_service.py
@@ -1,6 +1,6 @@
 from sqlalchemy import select
+from sqlalchemy.orm import Session
 
-from extensions.ext_database import db
 from libs.infinite_scroll_pagination import InfiniteScrollPagination
 from models import Account
 from models.enums import CreatorUserRole
@@ -12,11 +12,11 @@ from services.message_service import MessageService
 class SavedMessageService:
     @classmethod
     def pagination_by_last_id(
-        cls, app_model: App, user: Account | EndUser | None, last_id: str | None, limit: int
+        cls, session: Session, app_model: App, user: Account | EndUser | None, last_id: str | None, limit: int
     ) -> InfiniteScrollPagination:
         if not user:
             raise ValueError("User is required")
-        saved_messages = db.session.scalars(
+        saved_messages = session.scalars(
             select(SavedMessage)
             .where(
                 SavedMessage.app_id == app_model.id,
@@ -32,10 +32,10 @@ class SavedMessageService:
         )
 
     @classmethod
-    def save(cls, app_model: App, user: Account | EndUser | None, message_id: str):
+    def save(cls, session: Session, app_model: App, user: Account | EndUser | None, message_id: str):
         if not user:
             return
-        saved_message = db.session.scalar(
+        saved_message = session.scalar(
             select(SavedMessage)
             .where(
                 SavedMessage.app_id == app_model.id,
@@ -58,14 +58,14 @@ class SavedMessageService:
             created_by=user.id,
         )
 
-        db.session.add(saved_message)
-        db.session.commit()
+        session.add(saved_message)
+        session.commit()
 
     @classmethod
-    def delete(cls, app_model: App, user: Account | EndUser | None, message_id: str):
+    def delete(cls, session: Session, app_model: App, user: Account | EndUser | None, message_id: str):
         if not user:
             return
-        saved_message = db.session.scalar(
+        saved_message = session.scalar(
             select(SavedMessage)
             .where(
                 SavedMessage.app_id == app_model.id,
@@ -79,5 +79,5 @@ class SavedMessageService:
         if not saved_message:
             return
 
-        db.session.delete(saved_message)
-        db.session.commit()
+        session.delete(saved_message)
+        session.commit()
diff --git a/api/services/snippet_service.py b/api/services/snippet_service.py
index 9f16d412040..75282db9d4c 100644
--- a/api/services/snippet_service.py
+++ b/api/services/snippet_service.py
@@ -6,7 +6,7 @@ from datetime import UTC, datetime
 from typing import Any
 
 from sqlalchemy import delete, func, select
-from sqlalchemy.orm import Session, sessionmaker
+from sqlalchemy.orm import Session, scoped_session, sessionmaker
 
 from core.db import session_factory
 from core.workflow.node_factory import LATEST_VERSION, NODE_TYPE_CLASSES_MAPPING
@@ -192,6 +192,7 @@ class SnippetService:
         self,
         *,
         tenant_id: str,
+        session: scoped_session,
         page: int = 1,
         limit: int = 20,
         keyword: str | None = None,
@@ -229,20 +230,19 @@ class SnippetService:
             stmt = stmt.where(CustomizedSnippet.created_by.in_(creators))
 
         if tag_ids:
-            target_ids = TagService.get_target_ids_by_tag_ids("snippet", tenant_id, tag_ids, match_all=True)
+            target_ids = TagService.get_target_ids_by_tag_ids("snippet", tenant_id, tag_ids, session, match_all=True)
             if target_ids:
                 stmt = stmt.where(CustomizedSnippet.id.in_(target_ids))
             else:
                 return [], 0, False
 
-        with self._session_scope() as session:
-            # Get total count
-            count_stmt = select(func.count()).select_from(stmt.subquery())
-            total = session.scalar(count_stmt) or 0
+        # Get total count
+        count_stmt = select(func.count()).select_from(stmt.subquery())
+        total = session.scalar(count_stmt) or 0
 
-            # Apply pagination
-            stmt = stmt.limit(limit + 1).offset((page - 1) * limit)
-            snippets = list(session.scalars(stmt).all())
+        # Apply pagination
+        stmt = stmt.limit(limit + 1).offset((page - 1) * limit)
+        snippets = list(session.scalars(stmt).all())
 
         has_more = len(snippets) > limit
         if has_more:
diff --git a/api/services/tag_service.py b/api/services/tag_service.py
index 20f9a2c73d5..b144c15e85e 100644
--- a/api/services/tag_service.py
+++ b/api/services/tag_service.py
@@ -6,10 +6,9 @@ from flask_login import current_user
 from pydantic import BaseModel, Field
 from sqlalchemy import delete, func, select
 from sqlalchemy.engine import CursorResult
-from sqlalchemy.orm import Session
+from sqlalchemy.orm import Session, scoped_session
 from werkzeug.exceptions import NotFound
 
-from extensions.ext_database import db
 from models.dataset import Dataset
 from models.enums import TagType
 from models.model import App, Tag, TagBinding
@@ -56,7 +55,12 @@ class TagService:
 
     @staticmethod
     def get_target_ids_by_tag_ids(
-        tag_type: str, current_tenant_id: str, tag_ids: list[str], *, match_all: bool = False
+        tag_type: str,
+        current_tenant_id: str,
+        tag_ids: list[str],
+        session: scoped_session | Session,
+        *,
+        match_all: bool = False,
     ):
         """
         Return target IDs bound to tags for the given tenant and resource type.
@@ -70,7 +74,7 @@ class TagService:
             return []
         # Deduplicate repeated query params so match_all counts each requested tag once.
         requested_tag_ids = list(dict.fromkeys(tag_ids))
-        tags = db.session.scalars(
+        tags = session.scalars(
             select(Tag.id).where(
                 Tag.id.in_(requested_tag_ids),
                 Tag.tenant_id == current_tenant_id,
@@ -86,13 +90,13 @@ class TagService:
         if match_all:
             if len(tag_ids) != len(requested_tag_ids):
                 return []
-            return db.session.scalars(
+            return session.scalars(
                 select(TagBinding.target_id)
                 .where(TagBinding.tag_id.in_(tag_ids), TagBinding.tenant_id == current_tenant_id)
                 .group_by(TagBinding.target_id)
                 .having(func.count(sa.distinct(TagBinding.tag_id)) == len(tag_ids))
             ).all()
-        tag_bindings = db.session.scalars(
+        tag_bindings = session.scalars(
             select(TagBinding.target_id).where(
                 TagBinding.tag_id.in_(tag_ids), TagBinding.tenant_id == current_tenant_id
             )
@@ -100,11 +104,11 @@ class TagService:
         return tag_bindings
 
     @staticmethod
-    def get_tag_by_tag_name(tag_type: str, current_tenant_id: str, tag_name: str):
+    def get_tag_by_tag_name(tag_type: str, current_tenant_id: str, tag_name: str, session: scoped_session):
         if not tag_type or not tag_name:
             return []
         tags = list(
-            db.session.scalars(
+            session.scalars(
                 select(Tag).where(Tag.name == tag_name, Tag.tenant_id == current_tenant_id, Tag.type == tag_type)
             ).all()
         )
@@ -113,8 +117,8 @@ class TagService:
         return tags
 
     @staticmethod
-    def get_tags_by_target_id(tag_type: str, current_tenant_id: str, target_id: str):
-        tags = db.session.scalars(
+    def get_tags_by_target_id(tag_type: str, current_tenant_id: str, target_id: str, session: scoped_session):
+        tags = session.scalars(
             select(Tag)
             .join(TagBinding, Tag.id == TagBinding.tag_id)
             .where(
@@ -128,8 +132,8 @@ class TagService:
         return tags or []
 
     @staticmethod
-    def save_tags(payload: SaveTagPayload) -> Tag:
-        if TagService.get_tag_by_tag_name(payload.type, current_user.current_tenant_id, payload.name):
+    def save_tags(payload: SaveTagPayload, session: scoped_session) -> Tag:
+        if TagService.get_tag_by_tag_name(payload.type, current_user.current_tenant_id, payload.name, session):
             raise ValueError("Tag name already exists")
         tag = Tag(
             name=payload.name,
@@ -138,17 +142,17 @@ class TagService:
             tenant_id=current_user.current_tenant_id,
         )
         tag.id = str(uuid.uuid4())
-        db.session.add(tag)
-        db.session.commit()
+        session.add(tag)
+        session.commit()
         return tag
 
     @staticmethod
-    def update_tags(payload: UpdateTagPayload, tag_id: str) -> Tag:
-        tag = db.session.scalar(select(Tag).where(Tag.id == tag_id).limit(1))
+    def update_tags(payload: UpdateTagPayload, tag_id: str, session: scoped_session) -> Tag:
+        tag = session.scalar(select(Tag).where(Tag.id == tag_id).limit(1))
         if not tag:
             raise NotFound("Tag not found")
         if payload.name != tag.name:
-            existing = db.session.scalar(
+            existing = session.scalar(
                 select(Tag)
                 .where(
                     Tag.name == payload.name,
@@ -161,31 +165,31 @@ class TagService:
             if existing:
                 raise ValueError("Tag name already exists")
         tag.name = payload.name
-        db.session.commit()
+        session.commit()
         return tag
 
     @staticmethod
-    def get_tag_binding_count(tag_id: str) -> int:
-        count = db.session.scalar(select(func.count(TagBinding.id)).where(TagBinding.tag_id == tag_id)) or 0
+    def get_tag_binding_count(tag_id: str, session: scoped_session) -> int:
+        count = session.scalar(select(func.count(TagBinding.id)).where(TagBinding.tag_id == tag_id)) or 0
         return count
 
     @staticmethod
-    def delete_tag(tag_id: str):
-        tag = db.session.scalar(select(Tag).where(Tag.id == tag_id).limit(1))
+    def delete_tag(tag_id: str, session: scoped_session):
+        tag = session.scalar(select(Tag).where(Tag.id == tag_id).limit(1))
         if not tag:
             raise NotFound("Tag not found")
-        db.session.delete(tag)
+        session.delete(tag)
         # delete tag binding
-        tag_bindings = db.session.scalars(select(TagBinding).where(TagBinding.tag_id == tag_id)).all()
+        tag_bindings = session.scalars(select(TagBinding).where(TagBinding.tag_id == tag_id)).all()
         if tag_bindings:
             for tag_binding in tag_bindings:
-                db.session.delete(tag_binding)
-        db.session.commit()
+                session.delete(tag_binding)
+        session.commit()
 
     @staticmethod
-    def save_tag_binding(payload: TagBindingCreatePayload):
-        TagService.check_target_exists(payload.type, payload.target_id)
-        valid_tag_ids = db.session.scalars(
+    def save_tag_binding(payload: TagBindingCreatePayload, session: scoped_session):
+        TagService.check_target_exists(payload.type, payload.target_id, session)
+        valid_tag_ids = session.scalars(
             select(Tag.id).where(
                 Tag.id.in_(payload.tag_ids),
                 Tag.tenant_id == current_user.current_tenant_id,
@@ -193,7 +197,7 @@ class TagService:
             )
         ).all()
         for tag_id in valid_tag_ids:
-            tag_binding = db.session.scalar(
+            tag_binding = session.scalar(
                 select(TagBinding)
                 .where(TagBinding.tag_id == tag_id, TagBinding.target_id == payload.target_id)
                 .limit(1)
@@ -206,15 +210,15 @@ class TagService:
                 tenant_id=current_user.current_tenant_id,
                 created_by=current_user.id,
             )
-            db.session.add(new_tag_binding)
-        db.session.commit()
+            session.add(new_tag_binding)
+        session.commit()
 
     @staticmethod
-    def delete_tag_binding(payload: TagBindingDeletePayload):
-        TagService.check_target_exists(payload.type, payload.target_id)
+    def delete_tag_binding(payload: TagBindingDeletePayload, session: scoped_session):
+        TagService.check_target_exists(payload.type, payload.target_id, session)
         result = cast(
             CursorResult,
-            db.session.execute(
+            session.execute(
                 delete(TagBinding).where(
                     TagBinding.target_id == payload.target_id,
                     TagBinding.tag_id.in_(payload.tag_ids),
@@ -230,12 +234,12 @@ class TagService:
         )
 
         if result.rowcount:
-            db.session.commit()
+            session.commit()
 
     @staticmethod
-    def check_target_exists(type: str, target_id: str):
+    def check_target_exists(type: str, target_id: str, session: scoped_session):
         if type == "knowledge":
-            dataset = db.session.scalar(
+            dataset = session.scalar(
                 select(Dataset)
                 .where(Dataset.tenant_id == current_user.current_tenant_id, Dataset.id == target_id)
                 .limit(1)
@@ -243,13 +247,13 @@ class TagService:
             if not dataset:
                 raise NotFound("Dataset not found")
         elif type == "app":
-            app = db.session.scalar(
+            app = session.scalar(
                 select(App).where(App.tenant_id == current_user.current_tenant_id, App.id == target_id).limit(1)
             )
             if not app:
                 raise NotFound("App not found")
         elif type == "snippet":
-            snippet = db.session.scalar(
+            snippet = session.scalar(
                 select(CustomizedSnippet)
                 .where(CustomizedSnippet.tenant_id == current_user.current_tenant_id, CustomizedSnippet.id == target_id)
                 .limit(1)
diff --git a/api/services/trigger/trigger_provider_service.py b/api/services/trigger/trigger_provider_service.py
index d5d258aeabc..b0a3de1cee8 100644
--- a/api/services/trigger/trigger_provider_service.py
+++ b/api/services/trigger/trigger_provider_service.py
@@ -475,7 +475,7 @@ class TriggerProviderService:
                 tenant_id=tenant_id, provider_id=provider_id
             )
             # Create encrypter
-            encrypter, cache = create_provider_encrypter(
+            encrypter, _ = create_provider_encrypter(
                 tenant_id=tenant_id,
                 config=[x.to_basic_provider_config() for x in provider_controller.get_oauth_client_schema()],
                 cache=NoOpProviderCredentialCache(),
@@ -506,14 +506,20 @@ class TriggerProviderService:
             subscription.credentials = dict(encrypter.encrypt(dict(refreshed_credentials.credentials)))
             subscription.credential_expires_at = refreshed_credentials.expires_at
 
-            # Clear cache
-            cache.delete()
-
-            return {
+            provider_id_value = subscription.provider_id
+            result = {
                 "result": "success",
                 "expires_at": refreshed_credentials.expires_at,
             }
 
+        # Clear the trigger runtime credential cache after the DB commit so dispatch uses the refreshed token.
+        delete_cache_for_subscription(
+            tenant_id=tenant_id,
+            provider_id=provider_id_value,
+            subscription_id=subscription_id,
+        )
+        return result
+
     @classmethod
     def refresh_subscription(
         cls,
diff --git a/api/services/trigger/webhook_service.py b/api/services/trigger/webhook_service.py
index 592f6784217..ac7f6a468eb 100644
--- a/api/services/trigger/webhook_service.py
+++ b/api/services/trigger/webhook_service.py
@@ -14,7 +14,6 @@ from werkzeug.datastructures import FileStorage
 from werkzeug.exceptions import RequestEntityTooLarge
 
 from configs import dify_config
-from core.app.entities.app_invoke_entities import InvokeFrom
 from core.app.file_access import DatabaseFileAccessController
 from core.tools.tool_file_manager import ToolFileManager
 from core.trigger.constants import TRIGGER_WEBHOOK_NODE_TYPE
@@ -31,7 +30,7 @@ from factories import file_factory
 from graphon.entities.graph_config import NodeConfigDict
 from graphon.file import FileTransferMethod
 from graphon.variables.types import ArrayValidation, SegmentType
-from models.enums import AppTriggerStatus, AppTriggerType
+from models.enums import AppTriggerStatus, AppTriggerType, EndUserType
 from models.model import App
 from models.trigger import AppTrigger, WorkflowWebhookTrigger
 from models.workflow import Workflow
@@ -810,7 +809,7 @@ class WebhookService:
             )
 
             end_user = EndUserService.get_or_create_end_user_by_type(
-                type=InvokeFrom.TRIGGER,
+                type=EndUserType.TRIGGER,
                 tenant_id=webhook_trigger.tenant_id,
                 app_id=webhook_trigger.app_id,
                 user_id=None,
diff --git a/api/services/webapp_auth_service.py b/api/services/webapp_auth_service.py
index 834d78011ac..2b63d9171e9 100644
--- a/api/services/webapp_auth_service.py
+++ b/api/services/webapp_auth_service.py
@@ -12,6 +12,7 @@ from libs.helper import TokenManager
 from libs.passport import PassportService
 from libs.password import compare_password
 from models import Account, AccountStatus
+from models.enums import EndUserType
 from models.model import App, EndUser, Site
 from services.account_service import AccountService
 from services.app_service import AppService
@@ -102,7 +103,7 @@ class WebAppAuthService:
         end_user = EndUser(
             tenant_id=app_model.tenant_id,
             app_id=app_model.id,
-            type="browser",
+            type=EndUserType.BROWSER,
             is_anonymous=False,
             session_id=email,
             name="enterpriseuser",
diff --git a/api/services/workflow/workflow_converter.py b/api/services/workflow/workflow_converter.py
index 5dedb9e3729..e279f1daaa3 100644
--- a/api/services/workflow/workflow_converter.py
+++ b/api/services/workflow/workflow_converter.py
@@ -95,6 +95,7 @@ class WorkflowConverter:
         new_app.is_demo = False
         new_app.is_public = app_model.is_public
         new_app.created_by = account.id
+        new_app.maintainer = account.id
         new_app.updated_by = account.id
         db.session.add(new_app)
         db.session.flush()
diff --git a/api/services/workflow_draft_variable_service.py b/api/services/workflow_draft_variable_service.py
index 7c9bd489bda..9c30f32a7ad 100644
--- a/api/services/workflow_draft_variable_service.py
+++ b/api/services/workflow_draft_variable_service.py
@@ -125,10 +125,11 @@ class DraftVarLoader(VariableLoader):
         # can be safely accessed before any offloading logic is applied.
         for draft_var in draft_vars:
             value = draft_var.get_value()
-            if isinstance(value, FileSegment):
-                files.append(value.value)
-            elif isinstance(value, ArrayFileSegment):
-                files.extend(value.value)
+            match value:
+                case FileSegment():
+                    files.append(value.value)
+                case ArrayFileSegment():
+                    files.extend(value.value)
         with Session(bind=self._engine) as session:
             storage_key_loader = StorageKeyLoader(
                 session,
diff --git a/api/services/workflow_run_service.py b/api/services/workflow_run_service.py
index 29b9e72a009..2499e6cc094 100644
--- a/api/services/workflow_run_service.py
+++ b/api/services/workflow_run_service.py
@@ -34,10 +34,11 @@ class WorkflowRunService:
 
     def __init__(self, session_factory: Engine | sessionmaker | None = None):
         """Initialize WorkflowRunService with repository dependencies."""
-        if session_factory is None:
-            session_factory = sessionmaker(bind=db.engine, expire_on_commit=False)
-        elif isinstance(session_factory, Engine):
-            session_factory = sessionmaker(bind=session_factory, expire_on_commit=False)
+        match session_factory:
+            case None:
+                session_factory = sessionmaker(bind=db.engine, expire_on_commit=False)
+            case Engine():
+                session_factory = sessionmaker(bind=session_factory, expire_on_commit=False)
 
         self._session_factory = session_factory
         self._node_execution_service_repo = DifyAPIRepositoryFactory.create_api_workflow_node_execution_repository(
diff --git a/api/tasks/async_workflow_tasks.py b/api/tasks/async_workflow_tasks.py
index 58092689929..9f6dfc93f4c 100644
--- a/api/tasks/async_workflow_tasks.py
+++ b/api/tasks/async_workflow_tasks.py
@@ -237,14 +237,12 @@ def resume_workflow_execution(task_data_dict: dict[str, Any]) -> None:
         workflow = session.scalar(select(Workflow).where(Workflow.id == workflow_run.workflow_id))
         if workflow is None:
             raise WorkflowNotFoundError(
-                "Workflow not found: workflow_run_id=%s, workflow_id=%s", workflow_run.id, workflow_run.workflow_id
+                f"Workflow not found: workflow_run_id={workflow_run.id}, workflow_id={workflow_run.workflow_id}"
             )
         user = _get_user(session, workflow_run)
         app_model = session.scalar(select(App).where(App.id == workflow_run.app_id))
         if app_model is None:
-            raise _AppNotFoundError(
-                "App not found: app_id=%s, workflow_run_id=%s", workflow_run.app_id, workflow_run.id
-            )
+            raise _AppNotFoundError(f"App not found: app_id={workflow_run.app_id}, workflow_run_id={workflow_run.id}")
 
     workflow_execution_repository = DifyCoreRepositoryFactory.create_workflow_execution_repository(
         session_factory=session_factory,
diff --git a/api/tasks/trigger_processing_tasks.py b/api/tasks/trigger_processing_tasks.py
index 8505375b6a6..4bd45a42ead 100644
--- a/api/tasks/trigger_processing_tasks.py
+++ b/api/tasks/trigger_processing_tasks.py
@@ -15,7 +15,6 @@ from celery import shared_task
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
-from core.app.entities.app_invoke_entities import InvokeFrom
 from core.db.session_factory import session_factory
 from core.plugin.entities.plugin_daemon import CredentialType
 from core.plugin.entities.request import TriggerInvokeEventResponse
@@ -32,6 +31,7 @@ from graphon.enums import WorkflowExecutionStatus
 from models.enums import (
     AppTriggerType,
     CreatorUserRole,
+    EndUserType,
     WorkflowRunTriggeredFrom,
     WorkflowTriggerStatus,
 )
@@ -265,7 +265,7 @@ def dispatch_triggered_workflow(
         workflows: Mapping[str, Workflow] = _get_latest_workflows_by_app_ids(session, subscribers)
 
     end_users: Mapping[str, EndUser] = EndUserService.create_end_user_batch(
-        type=InvokeFrom.TRIGGER,
+        type=EndUserType.TRIGGER,
         tenant_id=subscription.tenant_id,
         app_ids=[plugin_trigger.app_id for plugin_trigger in subscribers],
         user_id=user_id,
diff --git a/api/tests/helpers/legacy_model_type_migration.py b/api/tests/helpers/legacy_model_type_migration.py
index 12f092a0fe3..4140119f326 100644
--- a/api/tests/helpers/legacy_model_type_migration.py
+++ b/api/tests/helpers/legacy_model_type_migration.py
@@ -131,10 +131,11 @@ def fetch_table_rows(
     for row in rows:
         normalized = dict(row)
         for key, value in normalized.items():
-            if isinstance(value, datetime):
-                normalized[key] = value.isoformat()
-            elif isinstance(value, uuid.UUID):
-                normalized[key] = str(value)
+            match value:
+                case datetime():
+                    normalized[key] = value.isoformat()
+                case uuid.UUID():
+                    normalized[key] = str(value)
         result.append(normalized)
     return result
 
diff --git a/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py b/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py
index 93310ad3805..f30abb4ed05 100644
--- a/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py
+++ b/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py
@@ -289,6 +289,7 @@ class TestFeedbackExportApi:
 
         # Verify service was called with correct parameters
         mock_export_feedbacks.assert_called_once_with(
+            mock.ANY,
             app_id=mock_app_model.id,
             from_source=FeedbackFromSource.USER,
             rating=FeedbackRating.DISLIKE,
diff --git a/api/tests/integration_tests/controllers/openapi/test_app_run.py b/api/tests/integration_tests/controllers/openapi/test_app_run.py
index 92e2e993dbf..b4f383a7cea 100644
--- a/api/tests/integration_tests/controllers/openapi/test_app_run.py
+++ b/api/tests/integration_tests/controllers/openapi/test_app_run.py
@@ -13,7 +13,9 @@ from extensions.ext_database import db
 from models import App
 
 
-def test_run_chat_dispatches_to_chat_handler(flask_app, account_token, app_in_workspace, monkeypatch):
+def test_run_chat_dispatches_to_chat_handler(
+    flask_app: Flask, account_token, app_in_workspace, monkeypatch: pytest.MonkeyPatch
+):
     captured = {}
 
     def _fake_generate(*, app_model, user, args, invoke_from, streaming):
@@ -78,7 +80,9 @@ def app_with_mode(flask_app: Flask, workspace_account):
         db.session.commit()
 
 
-def test_run_chat_without_query_returns_422(flask_app, account_token, app_in_workspace, monkeypatch):
+def test_run_chat_without_query_returns_422(
+    flask_app: Flask, account_token, app_in_workspace, monkeypatch: pytest.MonkeyPatch
+):
     client = flask_app.test_client()
     res = client.post(
         f"/openapi/v1/apps/{app_in_workspace.id}/run",
@@ -89,7 +93,9 @@ def test_run_chat_without_query_returns_422(flask_app, account_token, app_in_wor
     assert b"query_required_for_chat" in res.data
 
 
-def test_run_completion_dispatches_to_completion_handler(flask_app, account_token, app_with_mode, monkeypatch):
+def test_run_completion_dispatches_to_completion_handler(
+    flask_app: Flask, account_token, app_with_mode, monkeypatch: pytest.MonkeyPatch
+):
     app = app_with_mode("completion")
 
     captured: dict = {}
@@ -119,7 +125,9 @@ def test_run_completion_dispatches_to_completion_handler(flask_app, account_toke
     assert captured["mode"] == "completion"
 
 
-def test_run_workflow_with_query_returns_422(flask_app, account_token, app_with_mode, monkeypatch):
+def test_run_workflow_with_query_returns_422(
+    flask_app: Flask, account_token, app_with_mode, monkeypatch: pytest.MonkeyPatch
+):
     app = app_with_mode("workflow")
     client = flask_app.test_client()
     res = client.post(
@@ -131,7 +139,9 @@ def test_run_workflow_with_query_returns_422(flask_app, account_token, app_with_
     assert b"query_not_supported_for_workflow" in res.data
 
 
-def test_run_workflow_no_query_dispatches_to_workflow_handler(flask_app, account_token, app_with_mode, monkeypatch):
+def test_run_workflow_no_query_dispatches_to_workflow_handler(
+    flask_app: Flask, account_token, app_with_mode, monkeypatch: pytest.MonkeyPatch
+):
     app = app_with_mode("workflow")
 
     def _fake_generate(*, app_model, user, args, invoke_from, streaming):
@@ -154,7 +164,9 @@ def test_run_workflow_no_query_dispatches_to_workflow_handler(flask_app, account
     assert body["workflow_run_id"] == "wfr"
 
 
-def test_run_unsupported_mode_returns_422(flask_app, account_token, app_with_mode, monkeypatch):
+def test_run_unsupported_mode_returns_422(
+    flask_app: Flask, account_token, app_with_mode, monkeypatch: pytest.MonkeyPatch
+):
     app = app_with_mode("channel")
     client = flask_app.test_client()
     res = client.post(
@@ -166,7 +178,7 @@ def test_run_unsupported_mode_returns_422(flask_app, account_token, app_with_mod
     assert b"mode_not_runnable" in res.data
 
 
-def test_run_without_bearer_returns_401(flask_app, app_in_workspace):
+def test_run_without_bearer_returns_401(flask_app: Flask, app_in_workspace):
     client = flask_app.test_client()
     res = client.post(
         f"/openapi/v1/apps/{app_in_workspace.id}/run",
@@ -175,7 +187,9 @@ def test_run_without_bearer_returns_401(flask_app, app_in_workspace):
     assert res.status_code == 401
 
 
-def test_run_with_insufficient_scope_returns_403(flask_app, account_token, app_in_workspace, monkeypatch):
+def test_run_with_insufficient_scope_returns_403(
+    flask_app: Flask, account_token, app_in_workspace, monkeypatch: pytest.MonkeyPatch
+):
     """Stub the authenticator to return an AuthContext with empty scopes."""
     from libs import oauth_bearer
 
@@ -198,7 +212,7 @@ def test_run_with_insufficient_scope_returns_403(flask_app, account_token, app_i
     assert res.status_code == 403
 
 
-def test_run_with_unknown_app_returns_404(flask_app, account_token):
+def test_run_with_unknown_app_returns_404(flask_app: Flask, account_token):
     client = flask_app.test_client()
     res = client.post(
         f"/openapi/v1/apps/{uuid.uuid4()}/run",
@@ -208,7 +222,9 @@ def test_run_with_unknown_app_returns_404(flask_app, account_token):
     assert res.status_code == 404
 
 
-def test_run_streaming_returns_event_stream(flask_app, account_token, app_in_workspace, monkeypatch):
+def test_run_streaming_returns_event_stream(
+    flask_app: Flask, account_token, app_in_workspace, monkeypatch: pytest.MonkeyPatch
+):
     def _stream() -> Generator[str, None, None]:
         yield 'event: message\ndata: {"x": 1}\n\n'
 
@@ -228,7 +244,7 @@ def test_run_streaming_returns_event_stream(flask_app, account_token, app_in_wor
     assert b"event: message" in res.data
 
 
-def test_run_without_inputs_returns_422(flask_app, account_token, app_in_workspace):
+def test_run_without_inputs_returns_422(flask_app: Flask, account_token, app_in_workspace):
     client = flask_app.test_client()
     res = client.post(
         f"/openapi/v1/apps/{app_in_workspace.id}/run",
diff --git a/api/tests/integration_tests/workflow/nodes/test_llm.py b/api/tests/integration_tests/workflow/nodes/test_llm.py
index 5b7790f6f44..d8a0a713f12 100644
--- a/api/tests/integration_tests/workflow/nodes/test_llm.py
+++ b/api/tests/integration_tests/workflow/nodes/test_llm.py
@@ -4,6 +4,8 @@ import uuid
 from collections.abc import Generator
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 from core.app.entities.app_invoke_entities import InvokeFrom, UserFrom
 from core.llm_generator.output_parser.structured_output import _parse_structured_output
 from core.model_manager import ModelInstance
@@ -91,7 +93,7 @@ def init_llm_node(config: dict) -> LLMNode:
     return node
 
 
-def _mock_db_session_close(monkeypatch) -> None:
+def _mock_db_session_close(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(db.session, "close", MagicMock())
 
 
diff --git a/api/tests/integration_tests/workflow/nodes/test_parameter_extractor.py b/api/tests/integration_tests/workflow/nodes/test_parameter_extractor.py
index fc230a2a68d..44708285037 100644
--- a/api/tests/integration_tests/workflow/nodes/test_parameter_extractor.py
+++ b/api/tests/integration_tests/workflow/nodes/test_parameter_extractor.py
@@ -3,6 +3,8 @@ import time
 import uuid
 from unittest.mock import MagicMock
 
+import pytest
+
 from core.app.entities.app_invoke_entities import InvokeFrom, UserFrom
 from core.model_manager import ModelInstance
 from core.workflow.node_runtime import DifyPromptMessageSerializer
@@ -83,11 +85,11 @@ def init_parameter_extractor_node(config: dict, memory=None):
     return node
 
 
-def _mock_db_session_close(monkeypatch) -> None:
+def _mock_db_session_close(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(db.session, "close", MagicMock())
 
 
-def test_function_calling_parameter_extractor(setup_model_mock, monkeypatch):
+def test_function_calling_parameter_extractor(setup_model_mock, monkeypatch: pytest.MonkeyPatch):
     """
     Test function calling for parameter extractor.
     """
@@ -128,7 +130,7 @@ def test_function_calling_parameter_extractor(setup_model_mock, monkeypatch):
     assert result.outputs.get("__reason") == None
 
 
-def test_instructions(setup_model_mock, monkeypatch):
+def test_instructions(setup_model_mock, monkeypatch: pytest.MonkeyPatch):
     """
     Test chat parameter extractor.
     """
@@ -178,7 +180,7 @@ def test_instructions(setup_model_mock, monkeypatch):
             assert "what's the weather in SF" in prompt.get("text")
 
 
-def test_chat_parameter_extractor(setup_model_mock, monkeypatch):
+def test_chat_parameter_extractor(setup_model_mock, monkeypatch: pytest.MonkeyPatch):
     """
     Test chat parameter extractor.
     """
@@ -229,7 +231,7 @@ def test_chat_parameter_extractor(setup_model_mock, monkeypatch):
                 assert '<structure>\n{"type": "object"' in prompt.get("text")
 
 
-def test_completion_parameter_extractor(setup_model_mock, monkeypatch):
+def test_completion_parameter_extractor(setup_model_mock, monkeypatch: pytest.MonkeyPatch):
     """
     Test completion parameter extractor.
     """
@@ -354,7 +356,7 @@ def test_extract_json_from_tool_call():
     assert result["location"] == "kawaii"
 
 
-def test_chat_parameter_extractor_with_memory(setup_model_mock, monkeypatch):
+def test_chat_parameter_extractor_with_memory(setup_model_mock, monkeypatch: pytest.MonkeyPatch):
     """
     Test chat parameter extractor with memory.
     """
diff --git a/api/tests/test_containers_integration_tests/.ruff.toml b/api/tests/test_containers_integration_tests/.ruff.toml
index 250cf103ab9..68e3f9af4bd 100644
--- a/api/tests/test_containers_integration_tests/.ruff.toml
+++ b/api/tests/test_containers_integration_tests/.ruff.toml
@@ -9,7 +9,6 @@ extend-select = ["ANN401", "ARG", "TID251"]
 "models/test_types_enum_text.py" = ["ANN401", "TID251"]
 "services/test_app_dsl_service.py" = ["ANN401", "TID251", "ARG"]
 "services/test_file_service_zip_and_lookup.py" = ["ANN401", "TID251", "ARG"]
-"services/test_hit_testing_service.py" = ["ANN401", "TID251"]
 "trigger/conftest.py" = ["ANN401", "TID251"]
 "trigger/test_trigger_e2e.py" = ["ANN401", "TID251", "ARG"]
 "controllers/console/app/test_app_apis.py" = ["ARG"]
diff --git a/api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth.py b/api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth.py
index 3c496d1fc8c..d043c0d413a 100644
--- a/api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth.py
+++ b/api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from unittest.mock import MagicMock, patch
+from unittest.mock import ANY, MagicMock, patch
 
 import pytest
 from flask import Flask
@@ -517,11 +517,11 @@ class TestAccountGeneration:
     @patch("controllers.console.auth.oauth.TenantService")
     def test_should_handle_account_generation_scenarios(
         self,
-        mock_tenant_service,
-        mock_account_service,
-        mock_register_service,
-        mock_feature_service,
-        mock_get_account,
+        mock_tenant_service: MagicMock,
+        mock_account_service: MagicMock,
+        mock_register_service: MagicMock,
+        mock_feature_service: MagicMock,
+        mock_get_account: MagicMock,
         app: Flask,
         user_info: OAuthUserInfo,
         mock_account,
@@ -562,11 +562,11 @@ class TestAccountGeneration:
     @patch("controllers.console.auth.oauth.TenantService")
     def test_should_register_with_lowercase_email(
         self,
-        mock_tenant_service,
-        mock_account_service,
-        mock_register_service,
-        mock_feature_service,
-        mock_get_account,
+        mock_tenant_service: MagicMock,
+        mock_account_service: MagicMock,
+        mock_register_service: MagicMock,
+        mock_feature_service: MagicMock,
+        mock_get_account: MagicMock,
         app: Flask,
     ):
         user_info = OAuthUserInfo(id="123", name="Test User", email="Upper@Example.com")
@@ -593,11 +593,11 @@ class TestAccountGeneration:
     @patch("controllers.console.auth.oauth.TenantService")
     def test_should_register_with_browser_timezone(
         self,
-        mock_tenant_service,
-        mock_account_service,
-        mock_register_service,
-        mock_feature_service,
-        mock_get_account,
+        mock_tenant_service: MagicMock,
+        mock_account_service: MagicMock,
+        mock_register_service: MagicMock,
+        mock_feature_service: MagicMock,
+        mock_get_account: MagicMock,
         app: Flask,
         user_info: OAuthUserInfo,
     ):
@@ -624,11 +624,11 @@ class TestAccountGeneration:
     @patch("controllers.console.auth.oauth.TenantService")
     def test_should_register_with_state_language(
         self,
-        mock_tenant_service,
-        mock_account_service,
-        mock_register_service,
-        mock_feature_service,
-        mock_get_account,
+        mock_tenant_service: MagicMock,
+        mock_account_service: MagicMock,
+        mock_register_service: MagicMock,
+        mock_feature_service: MagicMock,
+        mock_get_account: MagicMock,
         app: Flask,
         user_info: OAuthUserInfo,
     ):
@@ -655,11 +655,11 @@ class TestAccountGeneration:
     @patch("controllers.console.auth.oauth.tenant_was_created")
     def test_should_create_workspace_for_account_without_tenant(
         self,
-        mock_event,
-        mock_account_service,
-        mock_feature_service,
-        mock_tenant_service,
-        mock_get_account,
+        mock_event: MagicMock,
+        mock_account_service: MagicMock,
+        mock_feature_service: MagicMock,
+        mock_tenant_service: MagicMock,
+        mock_get_account: MagicMock,
         app: Flask,
         user_info: OAuthUserInfo,
         mock_account,
@@ -678,6 +678,6 @@ class TestAccountGeneration:
             assert oauth_new_user is False
             mock_tenant_service.create_tenant.assert_called_once_with("Test User's Workspace")
             mock_tenant_service.create_tenant_member.assert_called_once_with(
-                mock_new_tenant, mock_account, role="owner"
+                mock_new_tenant, mock_account, ANY, role="owner"
             )
             mock_event.send.assert_called_once_with(mock_new_tenant)
diff --git a/api/tests/test_containers_integration_tests/controllers/console/test_api_based_extension.py b/api/tests/test_containers_integration_tests/controllers/console/test_api_based_extension.py
index 058f4e5fa34..e60558040a5 100644
--- a/api/tests/test_containers_integration_tests/controllers/console/test_api_based_extension.py
+++ b/api/tests/test_containers_integration_tests/controllers/console/test_api_based_extension.py
@@ -97,12 +97,13 @@ def test_list_scopes_api_based_extensions_to_authenticated_tenant(
     assert account_create_response.status_code == 201
 
     APIBasedExtensionService.save(
+        db_session_with_containers,
         APIBasedExtension(
             tenant_id=foreign_tenant_id,
             name="Foreign API",
             api_endpoint="https://foreign.example.com/hook",
             api_key="foreign-secret-12345",
-        )
+        ),
     )
 
     response = test_client_with_containers.get(
diff --git a/api/tests/test_containers_integration_tests/controllers/mcp/test_mcp.py b/api/tests/test_containers_integration_tests/controllers/mcp/test_mcp.py
index 21b395a04c6..c281f071560 100644
--- a/api/tests/test_containers_integration_tests/controllers/mcp/test_mcp.py
+++ b/api/tests/test_containers_integration_tests/controllers/mcp/test_mcp.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import types
+from inspect import unwrap
 from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
@@ -13,12 +14,6 @@ from pydantic import ValidationError
 import controllers.mcp.mcp as module
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 @pytest.fixture(autouse=True)
 def mock_mcp_ns():
     fake_ns = types.SimpleNamespace()
diff --git a/api/tests/test_containers_integration_tests/controllers/openapi/conftest.py b/api/tests/test_containers_integration_tests/controllers/openapi/conftest.py
index d961479f55b..5fe0f787524 100644
--- a/api/tests/test_containers_integration_tests/controllers/openapi/conftest.py
+++ b/api/tests/test_containers_integration_tests/controllers/openapi/conftest.py
@@ -12,6 +12,7 @@ from flask import Flask
 from sqlalchemy.orm import Session
 
 from controllers.openapi.auth.data import AuthData
+from extensions.ext_database import db
 from libs.oauth_bearer import AuthContext, Scope, SubjectType, TokenType, reset_auth_ctx, set_auth_ctx
 from models import Account, Tenant
 from services.account_service import AccountService, TenantService
@@ -58,7 +59,7 @@ def add_tenant_for_account(account: Account, *, role: str = "normal", name: str
     with patch("services.account_service.FeatureService") as mock_feature_service:
         mock_feature_service.get_system_features.return_value.is_allow_create_workspace = True
         tenant = TenantService.create_tenant(name=name)
-    TenantService.create_tenant_member(tenant, account, role=role)
+    TenantService.create_tenant_member(tenant, account, db.session, role=role)
     return tenant
 
 
diff --git a/api/tests/test_containers_integration_tests/controllers/service_api/dataset/test_dataset.py b/api/tests/test_containers_integration_tests/controllers/service_api/dataset/test_dataset.py
index 642dd3ab62d..1717fea789f 100644
--- a/api/tests/test_containers_integration_tests/controllers/service_api/dataset/test_dataset.py
+++ b/api/tests/test_containers_integration_tests/controllers/service_api/dataset/test_dataset.py
@@ -16,17 +16,17 @@ since these test controller-level behavior.
 import uuid
 from contextlib import ExitStack
 from datetime import UTC, datetime
-from unittest.mock import Mock, PropertyMock, patch
+from unittest.mock import ANY, Mock, PropertyMock, patch
 
 import pytest
 from flask import Flask
-from sqlalchemy.orm import Session
+from sqlalchemy.orm import Session, scoped_session
 from werkzeug.exceptions import Forbidden, NotFound
 
 
 class SessionMatcher:
     def __eq__(self, other):
-        return isinstance(other, Session)
+        return isinstance(other, (Session, scoped_session))
 
 
 import services
@@ -366,6 +366,7 @@ DATASET_DETAIL_KEYS = {
     "total_available_documents",
     "enable_api",
     "is_multimodal",
+    "maintainer",
 }
 
 
@@ -468,6 +469,7 @@ class TestDatasetListApiGet:
         mock_dataset_svc.get_datasets.assert_called_once_with(
             1,
             20,
+            SessionMatcher(),
             mock_tenant.id,
             mock_current_user,
             None,
@@ -1129,7 +1131,7 @@ class TestDatasetTagsApiPatch:
         assert status == 200
         assert response == {"id": "tag-1", "name": "Updated Tag", "type": "knowledge", "binding_count": "5"}
         mock_tag_svc.update_tags.assert_called_once()
-        update_payload, tag_id = mock_tag_svc.update_tags.call_args.args
+        update_payload, tag_id, session = mock_tag_svc.update_tags.call_args.args
         assert update_payload.name == "Updated Tag"
         assert tag_id == "tag-1"
 
@@ -1184,7 +1186,7 @@ class TestDatasetTagsApiDelete:
             result = api.delete(_=None)
 
         assert result == ("", 204)
-        mock_tag_svc.delete_tag.assert_called_once_with("tag-1")
+        mock_tag_svc.delete_tag.assert_called_once_with("tag-1", ANY)
 
     @patch("libs.login.current_user")
     def test_delete_tag_forbidden(self, mock_current_user, app: Flask):
@@ -1233,7 +1235,7 @@ class TestDatasetTagsBindingStatusApi:
         assert status_code == 200
         assert response["data"] == [{"id": "tag_1", "name": "Test Tag"}]
         assert response["total"] == 1
-        mock_tag_svc.get_tags_by_target_id.assert_called_once_with("knowledge", "tenant_123", "dataset_123")
+        mock_tag_svc.get_tags_by_target_id.assert_called_once_with("knowledge", "tenant_123", "dataset_123", ANY)
 
 
 class TestDatasetTagBindingApiPost:
@@ -1266,7 +1268,8 @@ class TestDatasetTagBindingApiPost:
         from services.tag_service import TagBindingCreatePayload
 
         mock_tag_svc.save_tag_binding.assert_called_once_with(
-            TagBindingCreatePayload(tag_ids=["tag-1"], target_id="ds-1", type=TagType.KNOWLEDGE)
+            TagBindingCreatePayload(tag_ids=["tag-1"], target_id="ds-1", type=TagType.KNOWLEDGE),
+            ANY,
         )
 
     @patch("controllers.service_api.dataset.dataset.current_user")
@@ -1317,7 +1320,8 @@ class TestDatasetTagUnbindingApiPost:
         from services.tag_service import TagBindingDeletePayload
 
         mock_tag_svc.delete_tag_binding.assert_called_once_with(
-            TagBindingDeletePayload(tag_ids=["tag-1"], target_id="ds-1", type=TagType.KNOWLEDGE)
+            TagBindingDeletePayload(tag_ids=["tag-1"], target_id="ds-1", type=TagType.KNOWLEDGE),
+            ANY,
         )
 
     @patch("controllers.service_api.dataset.dataset.TagService")
@@ -1347,7 +1351,8 @@ class TestDatasetTagUnbindingApiPost:
         from services.tag_service import TagBindingDeletePayload
 
         mock_tag_svc.delete_tag_binding.assert_called_once_with(
-            TagBindingDeletePayload(tag_ids=["tag-1"], target_id="ds-1", type=TagType.KNOWLEDGE)
+            TagBindingDeletePayload(tag_ids=["tag-1"], target_id="ds-1", type=TagType.KNOWLEDGE),
+            ANY,
         )
 
     @patch("controllers.service_api.dataset.dataset.current_user")
diff --git a/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py b/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
index 1bc4253cb90..3eab8ccbee5 100644
--- a/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
+++ b/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
@@ -187,6 +187,7 @@ class TestDecodeJwtToken:
         return flask_app_with_containers
 
     def _create_app_site_enduser(self, db_session: Session, *, enable_site: bool = True):
+        from models.enums import EndUserType
         from models.model import App, AppMode, CustomizeTokenStrategy, EndUser, Site
 
         tenant_id = str(uuid4())
@@ -215,7 +216,7 @@ class TestDecodeJwtToken:
         end_user = EndUser(
             tenant_id=tenant_id,
             app_id=app_model.id,
-            type="browser",
+            type=EndUserType.BROWSER,
             session_id="sess-1",
         )
         db_session.add(end_user)
diff --git a/api/tests/test_containers_integration_tests/models/test_workflow_node_execution_model.py b/api/tests/test_containers_integration_tests/models/test_workflow_node_execution_model.py
index 14c2263110c..ecf0af43025 100644
--- a/api/tests/test_containers_integration_tests/models/test_workflow_node_execution_model.py
+++ b/api/tests/test_containers_integration_tests/models/test_workflow_node_execution_model.py
@@ -13,7 +13,7 @@ import pytest
 from sqlalchemy.orm import Session
 
 from models.account import Account
-from models.enums import CreatorUserRole
+from models.enums import CreatorUserRole, EndUserType
 from models.model import App, AppMode, EndUser
 from models.workflow import WorkflowNodeExecutionModel, WorkflowNodeExecutionTriggeredFrom
 
@@ -44,7 +44,7 @@ class TestWorkflowNodeExecutionModelCreatedBy:
         end_user = EndUser(
             tenant_id=tenant_id,
             app_id=app_id,
-            type="service_api",
+            type=EndUserType.SERVICE_API,
             external_user_id=f"ext-{uuid4()}",
             name="End User",
             session_id=f"session-{uuid4()}",
diff --git a/api/tests/test_containers_integration_tests/pyrefly.toml b/api/tests/test_containers_integration_tests/pyrefly.toml
index 06ea10036f5..92c84320d9a 100644
--- a/api/tests/test_containers_integration_tests/pyrefly.toml
+++ b/api/tests/test_containers_integration_tests/pyrefly.toml
@@ -100,7 +100,6 @@ project-excludes = [
   "services/test_feature_service.py",
   "services/test_feedback_service.py",
   "services/test_file_service.py",
-  "services/test_hit_testing_service.py",
   "services/test_human_input_delivery_test.py",
   "services/test_human_input_delivery_test_service.py",
   "services/test_message_export_service.py",
diff --git a/api/tests/test_containers_integration_tests/repositories/test_sqlalchemy_workflow_run_cleanup_repository.py b/api/tests/test_containers_integration_tests/repositories/test_sqlalchemy_workflow_run_cleanup_repository.py
new file mode 100644
index 00000000000..be659fac184
--- /dev/null
+++ b/api/tests/test_containers_integration_tests/repositories/test_sqlalchemy_workflow_run_cleanup_repository.py
@@ -0,0 +1,320 @@
+"""Integration tests for workflow run cleanup repository queries."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta
+from typing import override
+from uuid import uuid4
+
+from sqlalchemy import Engine, select
+from sqlalchemy.orm import Session, sessionmaker
+
+from graphon.entities import WorkflowExecution
+from graphon.entities.pause_reason import PauseReasonType
+from graphon.enums import WorkflowExecutionStatus, WorkflowType
+from models.enums import CreatorUserRole, WorkflowRunTriggeredFrom
+from models.workflow import WorkflowAppLog, WorkflowAppLogCreatedFrom, WorkflowPause, WorkflowPauseReason, WorkflowRun
+from repositories.sqlalchemy_api_workflow_run_repository import DifyAPISQLAlchemyWorkflowRunRepository
+
+
+class _TestWorkflowRunRepository(DifyAPISQLAlchemyWorkflowRunRepository):
+    """Concrete repository for tests where save() is not under test."""
+
+    @override
+    def save(self, execution: WorkflowExecution) -> None:
+        return None
+
+
+@dataclass
+class _TestScope:
+    """Per-test identifiers for rows created by cleanup repository tests."""
+
+    tenant_id: str = field(default_factory=lambda: str(uuid4()))
+    app_id: str = field(default_factory=lambda: str(uuid4()))
+    workflow_id: str = field(default_factory=lambda: str(uuid4()))
+    user_id: str = field(default_factory=lambda: str(uuid4()))
+
+
+def _repository(db_session_with_containers: Session) -> DifyAPISQLAlchemyWorkflowRunRepository:
+    engine = db_session_with_containers.get_bind()
+    assert isinstance(engine, Engine)
+    return _TestWorkflowRunRepository(session_maker=sessionmaker(bind=engine, expire_on_commit=False))
+
+
+def _create_workflow_run(
+    session: Session,
+    scope: _TestScope,
+    *,
+    status: WorkflowExecutionStatus = WorkflowExecutionStatus.SUCCEEDED,
+    created_at: datetime,
+    tenant_id: str | None = None,
+    workflow_id: str | None = None,
+    workflow_type: str = WorkflowType.WORKFLOW,
+) -> WorkflowRun:
+    workflow_run = WorkflowRun(
+        id=str(uuid4()),
+        tenant_id=tenant_id or scope.tenant_id,
+        app_id=scope.app_id,
+        workflow_id=workflow_id or scope.workflow_id,
+        type=workflow_type,
+        triggered_from=WorkflowRunTriggeredFrom.DEBUGGING,
+        version="draft",
+        graph="{}",
+        inputs="{}",
+        status=status,
+        created_by_role=CreatorUserRole.ACCOUNT,
+        created_by=scope.user_id,
+        created_at=created_at,
+    )
+    session.add(workflow_run)
+    session.commit()
+    return workflow_run
+
+
+def _add_app_log(session: Session, scope: _TestScope, workflow_run: WorkflowRun) -> None:
+    session.add(
+        WorkflowAppLog(
+            tenant_id=workflow_run.tenant_id,
+            app_id=scope.app_id,
+            workflow_id=workflow_run.workflow_id,
+            workflow_run_id=workflow_run.id,
+            created_from=WorkflowAppLogCreatedFrom.SERVICE_API,
+            created_by_role=CreatorUserRole.ACCOUNT,
+            created_by=scope.user_id,
+        )
+    )
+    session.commit()
+
+
+def _add_pause_with_reason(session: Session, workflow_run: WorkflowRun) -> WorkflowPause:
+    pause = WorkflowPause(
+        workflow_id=workflow_run.workflow_id,
+        workflow_run_id=workflow_run.id,
+        state_object_key=f"workflow-state-{uuid4()}.json",
+    )
+    pause_reason = WorkflowPauseReason(
+        pause_id=pause.id,
+        type_=PauseReasonType.SCHEDULED_PAUSE,
+        message="scheduled pause",
+    )
+    session.add_all([pause, pause_reason])
+    session.commit()
+    return pause
+
+
+class TestGetCleanupRefsBatchByTimeRange:
+    def test_applies_cursor_window_and_cleanup_filters(self, db_session_with_containers: Session) -> None:
+        repository = _repository(db_session_with_containers)
+        scope = _TestScope()
+        base = datetime(2024, 1, 1, 12, 0, 0)
+
+        _create_workflow_run(db_session_with_containers, scope, created_at=base - timedelta(minutes=1))
+        cursor_run = _create_workflow_run(db_session_with_containers, scope, created_at=base)
+        first_target = _create_workflow_run(db_session_with_containers, scope, created_at=base + timedelta(minutes=1))
+        second_target = _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            status=WorkflowExecutionStatus.FAILED,
+            created_at=base + timedelta(minutes=2),
+        )
+        _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            status=WorkflowExecutionStatus.RUNNING,
+            created_at=base + timedelta(minutes=1),
+        )
+        _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            created_at=base + timedelta(minutes=1),
+            tenant_id=str(uuid4()),
+        )
+        _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            created_at=base + timedelta(minutes=1),
+            workflow_id=str(uuid4()),
+        )
+        _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            created_at=base + timedelta(minutes=1),
+            workflow_type=WorkflowType.CHAT,
+        )
+        _create_workflow_run(db_session_with_containers, scope, created_at=base + timedelta(minutes=3))
+
+        refs = repository.get_cleanup_refs_batch_by_time_range(
+            start_from=base,
+            end_before=base + timedelta(minutes=4),
+            last_seen=(cursor_run.created_at, cursor_run.id),
+            batch_size=10,
+            run_types=[WorkflowType.WORKFLOW],
+            tenant_ids=[scope.tenant_id],
+            workflow_ids=[scope.workflow_id],
+            upper_bound=(second_target.created_at, second_target.id),
+        )
+
+        assert [(ref.id, ref.tenant_id, ref.created_at) for ref in refs] == [
+            (first_target.id, scope.tenant_id, first_target.created_at),
+            (second_target.id, scope.tenant_id, second_target.created_at),
+        ]
+
+    def test_returns_empty_when_run_type_filter_is_empty(self, db_session_with_containers: Session) -> None:
+        repository = _repository(db_session_with_containers)
+
+        refs = repository.get_cleanup_refs_batch_by_time_range(
+            start_from=None,
+            end_before=datetime(2024, 1, 2),
+            last_seen=None,
+            batch_size=10,
+            run_types=[],
+        )
+
+        assert refs == []
+
+
+class TestCountRunsWithRelatedByIds:
+    def test_counts_existing_runs_and_related_rows(self, db_session_with_containers: Session) -> None:
+        repository = _repository(db_session_with_containers)
+        scope = _TestScope()
+        workflow_run = _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            created_at=datetime(2024, 1, 1, 12, 0, 0),
+        )
+        missing_run_id = str(uuid4())
+        _add_app_log(db_session_with_containers, scope, workflow_run)
+        _add_pause_with_reason(db_session_with_containers, workflow_run)
+        counted_node_run_ids: list[str] = []
+        counted_trigger_run_ids: list[str] = []
+
+        counts = repository.count_runs_with_related_by_ids(
+            [workflow_run.id, missing_run_id],
+            count_node_executions=lambda _session, run_ids: counted_node_run_ids.extend(run_ids) or (2, 1),
+            count_trigger_logs=lambda _session, run_ids: counted_trigger_run_ids.extend(run_ids) or 3,
+        )
+
+        assert counted_node_run_ids == [workflow_run.id, missing_run_id]
+        assert counted_trigger_run_ids == [workflow_run.id, missing_run_id]
+        assert counts == {
+            "runs": 1,
+            "node_executions": 2,
+            "offloads": 1,
+            "app_logs": 1,
+            "trigger_logs": 3,
+            "pauses": 1,
+            "pause_reasons": 1,
+        }
+
+    def test_defaults_optional_related_counts(self, db_session_with_containers: Session) -> None:
+        repository = _repository(db_session_with_containers)
+        scope = _TestScope()
+        workflow_run = _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            created_at=datetime(2024, 1, 1, 12, 0, 0),
+        )
+
+        counts = repository.count_runs_with_related_by_ids([workflow_run.id])
+
+        assert counts == {
+            "runs": 1,
+            "node_executions": 0,
+            "offloads": 0,
+            "app_logs": 0,
+            "trigger_logs": 0,
+            "pauses": 0,
+            "pause_reasons": 0,
+        }
+
+
+class TestDeleteRunsWithRelatedByIds:
+    def test_deletes_runs_and_related_rows(self, db_session_with_containers: Session) -> None:
+        repository = _repository(db_session_with_containers)
+        scope = _TestScope()
+        workflow_run = _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            created_at=datetime(2024, 1, 1, 12, 0, 0),
+        )
+        _add_app_log(db_session_with_containers, scope, workflow_run)
+        pause = _add_pause_with_reason(db_session_with_containers, workflow_run)
+        pause_id = pause.id
+        deleted_node_run_ids: list[str] = []
+        deleted_trigger_run_ids: list[str] = []
+
+        counts = repository.delete_runs_with_related_by_ids(
+            [workflow_run.id],
+            delete_node_executions=lambda _session, run_ids: deleted_node_run_ids.extend(run_ids) or (2, 1),
+            delete_trigger_logs=lambda _session, run_ids: deleted_trigger_run_ids.extend(run_ids) or 3,
+        )
+
+        assert deleted_node_run_ids == [workflow_run.id]
+        assert deleted_trigger_run_ids == [workflow_run.id]
+        assert counts == {
+            "runs": 1,
+            "node_executions": 2,
+            "offloads": 1,
+            "app_logs": 1,
+            "trigger_logs": 3,
+            "pauses": 1,
+            "pause_reasons": 1,
+        }
+        verification_session = Session(bind=db_session_with_containers.get_bind())
+        with verification_session:
+            assert verification_session.get(WorkflowRun, workflow_run.id) is None
+            assert verification_session.get(WorkflowPause, pause_id) is None
+            assert (
+                verification_session.scalar(
+                    select(WorkflowAppLog).where(WorkflowAppLog.workflow_run_id == workflow_run.id)
+                )
+                is None
+            )
+            assert (
+                verification_session.scalar(select(WorkflowPauseReason).where(WorkflowPauseReason.pause_id == pause_id))
+                is None
+            )
+
+    def test_defaults_optional_related_counts(self, db_session_with_containers: Session) -> None:
+        repository = _repository(db_session_with_containers)
+        scope = _TestScope()
+        workflow_run = _create_workflow_run(
+            db_session_with_containers,
+            scope,
+            created_at=datetime(2024, 1, 1, 12, 0, 0),
+        )
+
+        counts = repository.delete_runs_with_related_by_ids([workflow_run.id])
+
+        assert counts == {
+            "runs": 1,
+            "node_executions": 0,
+            "offloads": 0,
+            "app_logs": 0,
+            "trigger_logs": 0,
+            "pauses": 0,
+            "pause_reasons": 0,
+        }
+
+    def test_empty_ids_return_empty_counts(self, db_session_with_containers: Session) -> None:
+        repository = _repository(db_session_with_containers)
+
+        assert repository.count_runs_with_related_by_ids([]) == {
+            "runs": 0,
+            "node_executions": 0,
+            "offloads": 0,
+            "app_logs": 0,
+            "trigger_logs": 0,
+            "pauses": 0,
+            "pause_reasons": 0,
+        }
+        assert repository.delete_runs_with_related_by_ids([]) == {
+            "runs": 0,
+            "node_executions": 0,
+            "offloads": 0,
+            "app_logs": 0,
+            "trigger_logs": 0,
+            "pauses": 0,
+            "pause_reasons": 0,
+        }
diff --git a/api/tests/test_containers_integration_tests/services/auth/test_api_key_auth_service.py b/api/tests/test_containers_integration_tests/services/auth/test_api_key_auth_service.py
index 9d588d4c73f..c93e61b2bfb 100644
--- a/api/tests/test_containers_integration_tests/services/auth/test_api_key_auth_service.py
+++ b/api/tests/test_containers_integration_tests/services/auth/test_api_key_auth_service.py
@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import json
-from unittest.mock import Mock, patch
+from unittest.mock import MagicMock, Mock, patch
 from uuid import uuid4
 
 import pytest
@@ -83,8 +83,8 @@ class TestApiKeyAuthService:
     @patch("services.auth.api_key_auth_service.encrypter")
     def test_create_provider_auth_success(
         self,
-        mock_encrypter,
-        mock_factory,
+        mock_encrypter: MagicMock,
+        mock_factory: MagicMock,
         flask_app_with_containers: Flask,
         db_session_with_containers: Session,
         tenant_id,
@@ -107,7 +107,12 @@ class TestApiKeyAuthService:
 
     @patch("services.auth.api_key_auth_service.ApiKeyAuthFactory")
     def test_create_provider_auth_validation_failed(
-        self, mock_factory, flask_app_with_containers: Flask, db_session_with_containers: Session, tenant_id, mock_args
+        self,
+        mock_factory: MagicMock,
+        flask_app_with_containers: Flask,
+        db_session_with_containers: Session,
+        tenant_id,
+        mock_args,
     ):
         mock_auth_instance = Mock()
         mock_auth_instance.validate_credentials.return_value = False
@@ -123,8 +128,8 @@ class TestApiKeyAuthService:
     @patch("services.auth.api_key_auth_service.encrypter")
     def test_create_provider_auth_encrypts_api_key(
         self,
-        mock_encrypter,
-        mock_factory,
+        mock_encrypter: MagicMock,
+        mock_factory: MagicMock,
         flask_app_with_containers: Flask,
         db_session_with_containers: Session,
         tenant_id,
@@ -289,7 +294,7 @@ class TestApiKeyAuthService:
                 ApiKeyAuthService.create_provider_auth(tenant_id, mock_args)
 
     @patch("services.auth.api_key_auth_service.ApiKeyAuthFactory")
-    def test_create_provider_auth_factory_exception(self, mock_factory, tenant_id, mock_args):
+    def test_create_provider_auth_factory_exception(self, mock_factory: MagicMock, tenant_id, mock_args):
         mock_factory.side_effect = Exception("Factory error")
         with pytest.raises(Exception, match="Factory error"):
             ApiKeyAuthService.create_provider_auth(tenant_id, mock_args)
diff --git a/api/tests/test_containers_integration_tests/services/enterprise/test_account_deletion_sync.py b/api/tests/test_containers_integration_tests/services/enterprise/test_account_deletion_sync.py
index 075f43d63a3..646a0592630 100644
--- a/api/tests/test_containers_integration_tests/services/enterprise/test_account_deletion_sync.py
+++ b/api/tests/test_containers_integration_tests/services/enterprise/test_account_deletion_sync.py
@@ -45,7 +45,7 @@ class TestQueueTask:
         assert "task_id" in task_data
         assert "created_at" in task_data
 
-    def test_queue_task_redis_error(self, caplog):
+    def test_queue_task_redis_error(self, caplog: pytest.LogCaptureFixture):
         with patch("services.enterprise.account_deletion_sync.redis_client") as mock_redis:
             mock_redis.lpush.side_effect = RedisError("Connection failed")
 
@@ -54,7 +54,7 @@ class TestQueueTask:
             assert result is False
             assert "Failed to queue account deletion sync" in caplog.text
 
-    def test_queue_task_type_error(self, caplog):
+    def test_queue_task_type_error(self, caplog: pytest.LogCaptureFixture):
         with patch("services.enterprise.account_deletion_sync.redis_client") as mock_redis:
             mock_redis.lpush.side_effect = TypeError("Cannot serialize")
 
diff --git a/api/tests/test_containers_integration_tests/services/plugin/test_plugin_parameter_service.py b/api/tests/test_containers_integration_tests/services/plugin/test_plugin_parameter_service.py
index 48830c0f43b..398c5979ef2 100644
--- a/api/tests/test_containers_integration_tests/services/plugin/test_plugin_parameter_service.py
+++ b/api/tests/test_containers_integration_tests/services/plugin/test_plugin_parameter_service.py
@@ -47,8 +47,8 @@ class TestGetDynamicSelectOptionsTool:
     @patch("services.plugin.plugin_parameter_service.ToolManager")
     def test_fetches_credentials_with_credential_id(
         self,
-        mock_tool_mgr,
-        mock_encrypter_fn,
+        mock_tool_mgr: MagicMock,
+        mock_encrypter_fn: MagicMock,
         mock_client_cls,
         flask_app_with_containers: Flask,
         db_session_with_containers: Session,
@@ -90,8 +90,8 @@ class TestGetDynamicSelectOptionsTool:
     @patch("services.plugin.plugin_parameter_service.ToolManager")
     def test_raises_when_tool_provider_not_found(
         self,
-        mock_tool_mgr,
-        mock_encrypter_fn,
+        mock_tool_mgr: MagicMock,
+        mock_encrypter_fn: MagicMock,
         flask_app_with_containers: Flask,
         db_session_with_containers: Session,
     ):
diff --git a/api/tests/test_containers_integration_tests/services/plugin/test_plugin_service.py b/api/tests/test_containers_integration_tests/services/plugin/test_plugin_service.py
index 66ff24f3741..5d2f4f709f1 100644
--- a/api/tests/test_containers_integration_tests/services/plugin/test_plugin_service.py
+++ b/api/tests/test_containers_integration_tests/services/plugin/test_plugin_service.py
@@ -258,7 +258,7 @@ class TestUpgradePluginWithMarketplace:
 class TestUpgradePluginWithGithub:
     @patch("core.plugin.plugin_service.FeatureService")
     @patch("core.plugin.plugin_service.PluginInstaller")
-    def test_checks_marketplace_permission_and_delegates(self, mock_installer_cls, mock_fs):
+    def test_checks_marketplace_permission_and_delegates(self, mock_installer_cls: MagicMock, mock_fs: MagicMock):
         mock_fs.get_system_features.return_value = _make_features()
         installer = mock_installer_cls.return_value
         installer.upgrade_plugin.return_value = MagicMock()
@@ -273,7 +273,7 @@ class TestUpgradePluginWithGithub:
 class TestUploadPkg:
     @patch("core.plugin.plugin_service.FeatureService")
     @patch("core.plugin.plugin_service.PluginInstaller")
-    def test_runs_permission_and_scope_checks(self, mock_installer_cls, mock_fs):
+    def test_runs_permission_and_scope_checks(self, mock_installer_cls: MagicMock, mock_fs: MagicMock):
         mock_fs.get_system_features.return_value = _make_features()
         upload_resp = MagicMock()
         upload_resp.verification = None
@@ -318,7 +318,7 @@ class TestInstallFromMarketplacePkg:
     @patch("core.plugin.plugin_service.FeatureService")
     @patch("core.plugin.plugin_service.PluginInstaller")
     @patch("core.plugin.plugin_service.dify_config")
-    def test_uses_cached_when_already_downloaded(self, mock_config, mock_installer_cls, mock_fs):
+    def test_uses_cached_when_already_downloaded(self, mock_config, mock_installer_cls: MagicMock, mock_fs: MagicMock):
         mock_config.MARKETPLACE_ENABLED = True
         mock_fs.get_system_features.return_value = _make_features()
         installer = mock_installer_cls.return_value
diff --git a/api/tests/test_containers_integration_tests/services/test_account_service.py b/api/tests/test_containers_integration_tests/services/test_account_service.py
index 9a53ff087c5..a2f5370cb76 100644
--- a/api/tests/test_containers_integration_tests/services/test_account_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_account_service.py
@@ -9,7 +9,7 @@ from werkzeug.exceptions import Unauthorized
 
 from configs import dify_config
 from controllers.console.error import AccountNotFound, NotAllowedCreateWorkspace
-from models import AccountStatus, TenantAccountJoin, TenantStatus
+from models import AccountStatus, App, Dataset, TenantAccountJoin, TenantStatus
 from services.account_service import AccountService, RegisterService, TenantService, TokenPair
 from services.errors.account import (
     AccountAlreadyInTenantError,
@@ -1276,7 +1276,7 @@ class TestTenantService:
         )
 
         # Create tenant member
-        tenant_member = TenantService.create_tenant_member(tenant, account, role="admin")
+        tenant_member = TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="admin")
 
         assert tenant_member.tenant_id == tenant.id
         assert tenant_member.account_id == account.id
@@ -1317,11 +1317,11 @@ class TestTenantService:
         )
 
         # Create first owner
-        TenantService.create_tenant_member(tenant, account1, role="owner")
+        TenantService.create_tenant_member(tenant, account1, db_session_with_containers, role="owner")
 
         # Try to create second owner (should fail)
         with pytest.raises(Exception, match="Tenant already has an owner"):
-            TenantService.create_tenant_member(tenant, account2, role="owner")
+            TenantService.create_tenant_member(tenant, account2, db_session_with_containers, role="owner")
 
     def test_create_tenant_member_existing_member(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -1349,11 +1349,11 @@ class TestTenantService:
         )
 
         # Create member with initial role
-        tenant_member1 = TenantService.create_tenant_member(tenant, account, role="normal")
+        tenant_member1 = TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="normal")
         assert tenant_member1.role == "normal"
 
         # Update member role
-        tenant_member2 = TenantService.create_tenant_member(tenant, account, role="editor")
+        tenant_member2 = TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="editor")
         assert tenant_member2.tenant_id == tenant_member1.tenant_id
         assert tenant_member2.account_id == tenant_member1.account_id
         assert tenant_member2.role == "editor"
@@ -1384,8 +1384,8 @@ class TestTenantService:
         tenant2 = TenantService.create_tenant(name=tenant2_name)
 
         # Add account to both tenants
-        TenantService.create_tenant_member(tenant1, account, role="normal")
-        TenantService.create_tenant_member(tenant2, account, role="admin")
+        TenantService.create_tenant_member(tenant1, account, db_session_with_containers, role="normal")
+        TenantService.create_tenant_member(tenant2, account, db_session_with_containers, role="admin")
 
         # Get join tenants
         join_tenants = TenantService.get_join_tenants(account)
@@ -1421,7 +1421,7 @@ class TestTenantService:
         tenant = TenantService.create_tenant(name=tenant_name)
 
         # Add account to tenant and set as current
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="owner")
         account.current_tenant = tenant
 
         db_session_with_containers.commit()
@@ -1486,8 +1486,8 @@ class TestTenantService:
         tenant2 = TenantService.create_tenant(name=tenant2_name)
 
         # Add account to both tenants
-        TenantService.create_tenant_member(tenant1, account, role="owner")
-        TenantService.create_tenant_member(tenant2, account, role="admin")
+        TenantService.create_tenant_member(tenant1, account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant2, account, db_session_with_containers, role="admin")
 
         # Set initial current tenant
         account.current_tenant = tenant1
@@ -1588,8 +1588,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, admin_account, role="admin")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, admin_account, db_session_with_containers, role="admin")
 
         # Check if tenant has owner role
         from models.account import TenantAccountRole
@@ -1648,7 +1648,7 @@ class TestTenantService:
         )
 
         # Add account to tenant with specific role
-        TenantService.create_tenant_member(tenant, account, role="editor")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="editor")
 
         # Get user role
         user_role = TenantService.get_user_role(account, tenant)
@@ -1690,8 +1690,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="normal")
 
         # Check owner permission to add member (should succeed)
         TenantService.check_member_permission(tenant, owner_account, member_account, "add")
@@ -1723,7 +1723,7 @@ class TestTenantService:
         )
 
         # Add account to tenant
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="owner")
 
         # Try to check permission with invalid action
         with pytest.raises(Exception, match="Invalid action"):
@@ -1755,7 +1755,7 @@ class TestTenantService:
         )
 
         # Add account to tenant
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="owner")
 
         # Try to check permission to operate self
         with pytest.raises(Exception, match="Cannot operate self"):
@@ -1796,11 +1796,35 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="normal")
+
+        app = App(
+            tenant_id=tenant.id,
+            name="Member app",
+            mode="chat",
+            enable_site=True,
+            enable_api=True,
+            created_by=member_account.id,
+            maintainer=member_account.id,
+        )
+        dataset = Dataset(
+            tenant_id=tenant.id,
+            name="Member dataset",
+            created_by=member_account.id,
+            maintainer=member_account.id,
+        )
+        db_session_with_containers.add_all([app, dataset])
+        db_session_with_containers.commit()
 
         # Remove member
-        with patch("services.enterprise.account_deletion_sync.sync_workspace_member_removal") as mock_sync:
+        with (
+            patch("services.enterprise.account_deletion_sync.sync_workspace_member_removal") as mock_sync,
+            patch(
+                "services.account_service.AccountService.get_rbac_workspace_owner_account_id",
+                return_value=owner_account.id,
+            ),
+        ):
             mock_sync.return_value = True
 
             TenantService.remove_member_from_tenant(tenant, member_account, owner_account)
@@ -1819,6 +1843,12 @@ class TestTenantService:
             .first()
         )
         assert member_join is None
+        db_session_with_containers.refresh(app)
+        db_session_with_containers.refresh(dataset)
+        assert app.created_by == member_account.id
+        assert app.maintainer == owner_account.id
+        assert dataset.created_by == member_account.id
+        assert dataset.maintainer == owner_account.id
 
     def test_remove_member_from_tenant_operate_self(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -1846,7 +1876,7 @@ class TestTenantService:
         )
 
         # Add account to tenant
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="owner")
 
         # Try to remove self
         with pytest.raises(Exception, match="Cannot operate self"):
@@ -1887,7 +1917,7 @@ class TestTenantService:
         )
 
         # Add only owner to tenant
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
 
         # Try to remove non-member
         with pytest.raises(Exception, match="Member not in tenant"):
@@ -1926,8 +1956,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="normal")
 
         # Update member role
         TenantService.update_member_role(tenant, member_account, "admin", owner_account)
@@ -1975,8 +2005,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="admin")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="admin")
 
         # Update member role to owner
         TenantService.update_member_role(tenant, member_account, "owner", owner_account)
@@ -2032,8 +2062,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="admin")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="admin")
 
         # Try to update member role to already assigned role
         with pytest.raises(Exception, match="The provided role is already assigned to the member"):
@@ -2130,7 +2160,7 @@ class TestTenantService:
             password=password,
         )
         existing_tenant = TenantService.create_tenant(name=existing_tenant_name)
-        TenantService.create_tenant_member(existing_tenant, account, role="owner")
+        TenantService.create_tenant_member(existing_tenant, account, db_session_with_containers, role="owner")
         account.current_tenant = existing_tenant
 
         db_session_with_containers.commit()
@@ -2213,9 +2243,9 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, admin_account, role="admin")
-        TenantService.create_tenant_member(tenant, normal_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, admin_account, db_session_with_containers, role="admin")
+        TenantService.create_tenant_member(tenant, normal_account, db_session_with_containers, role="normal")
 
         # Get tenant members
         members = TenantService.get_tenant_members(tenant)
@@ -2279,9 +2309,11 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, dataset_operator_account, role="dataset_operator")
-        TenantService.create_tenant_member(tenant, normal_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(
+            tenant, dataset_operator_account, db_session_with_containers, role="dataset_operator"
+        )
+        TenantService.create_tenant_member(tenant, normal_account, db_session_with_containers, role="normal")
 
         # Get dataset operator members
         dataset_operators = TenantService.get_dataset_operator_members(tenant)
@@ -2712,7 +2744,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=inviter_password,
         )
-        TenantService.create_tenant_member(tenant, inviter, role="owner")
+        TenantService.create_tenant_member(tenant, inviter, db_session_with_containers, role="owner")
 
         # Mock the email task
         with patch("services.account_service.send_invite_member_mail_task") as mock_send_mail:
@@ -2755,7 +2787,7 @@ class TestRegisterService:
         self, db_session_with_containers: Session, mock_external_service_dependencies
     ):
         """
-        Test inviting an existing member who is not in the tenant yet.
+        Test inviting an existing active account who is not in the tenant yet.
         """
         fake = Faker()
         tenant_name = fake.company()
@@ -2778,7 +2810,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=inviter_password,
         )
-        TenantService.create_tenant_member(tenant, inviter, role="owner")
+        TenantService.create_tenant_member(tenant, inviter, db_session_with_containers, role="owner")
 
         # Create existing account
         existing_account = AccountService.create_account(
@@ -2791,20 +2823,20 @@ class TestRegisterService:
         # Mock the email task
         with patch("services.account_service.send_invite_member_mail_task") as mock_send_mail:
             mock_send_mail.delay.return_value = None
-            with pytest.raises(AccountAlreadyInTenantError, match="Account already in tenant."):
-                # Execute invitation
-                token = RegisterService.invite_new_member(
-                    tenant=tenant,
-                    email=existing_member_email,
-                    language=language,
-                    role="admin",
-                    inviter=inviter,
-                )
 
-            # Verify email task was not called
-            mock_send_mail.delay.assert_not_called()
+            token = RegisterService.invite_new_member(
+                tenant=tenant,
+                email=existing_member_email,
+                language=language,
+                role="admin",
+                inviter=inviter,
+            )
 
-        # Verify tenant member was created for existing account
+            assert token is not None
+            assert len(token) > 0
+            mock_send_mail.delay.assert_called_once()
+
+        # Existing active accounts must accept the invite before becoming workspace members.
         from models.account import TenantAccountJoin
 
         tenant_join = (
@@ -2812,8 +2844,13 @@ class TestRegisterService:
             .filter_by(tenant_id=tenant.id, account_id=existing_account.id)
             .first()
         )
-        assert tenant_join is not None
-        assert tenant_join.role == "admin"
+        assert tenant_join is None
+
+        invitation = RegisterService.get_invitation_if_token_valid(None, None, token)
+        assert invitation is not None
+        assert invitation["account"].id == existing_account.id
+        assert invitation["data"]["role"] == "admin"
+        assert invitation["data"]["requires_setup"] is False
 
     def test_invite_new_member_existing_member(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -2842,7 +2879,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=inviter_password,
         )
-        TenantService.create_tenant_member(tenant, inviter, role="owner")
+        TenantService.create_tenant_member(tenant, inviter, db_session_with_containers, role="owner")
 
         # Create existing account with pending status
         existing_account = AccountService.create_account(
@@ -2856,7 +2893,7 @@ class TestRegisterService:
         db_session_with_containers.commit()
 
         # Add existing account to tenant
-        TenantService.create_tenant_member(tenant, existing_account, role="normal")
+        TenantService.create_tenant_member(tenant, existing_account, db_session_with_containers, role="normal")
 
         # Mock the email task
         with patch("services.account_service.send_invite_member_mail_task") as mock_send_mail:
@@ -2932,7 +2969,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=inviter_password,
         )
-        TenantService.create_tenant_member(tenant, inviter, role="owner")
+        TenantService.create_tenant_member(tenant, inviter, db_session_with_containers, role="owner")
 
         # Create existing account with active status
         existing_account = AccountService.create_account(
@@ -2946,7 +2983,7 @@ class TestRegisterService:
         db_session_with_containers.commit()
 
         # Add existing account to tenant
-        TenantService.create_tenant_member(tenant, existing_account, role="normal")
+        TenantService.create_tenant_member(tenant, existing_account, db_session_with_containers, role="normal")
 
         # Execute invitation (should fail for active member)
         with pytest.raises(AccountAlreadyInTenantError, match="Account already in tenant."):
@@ -3158,7 +3195,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=password,
         )
-        TenantService.create_tenant_member(tenant, account, role="normal")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="normal")
 
         # Generate a real token
         token = RegisterService.generate_invite_token(tenant, account)
@@ -3278,7 +3315,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=password,
         )
-        TenantService.create_tenant_member(tenant, account, role="normal")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="normal")
 
         # Create a real token but with mismatched account ID
         from extensions.ext_redis import redis_client
@@ -3328,7 +3365,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=password,
         )
-        TenantService.create_tenant_member(tenant, account, role="normal")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="normal")
 
         # Change tenant status to non-normal
         tenant.status = TenantStatus.ARCHIVE
diff --git a/api/tests/test_containers_integration_tests/services/test_agent_service.py b/api/tests/test_containers_integration_tests/services/test_agent_service.py
index 27e793915ab..21a768e3446 100644
--- a/api/tests/test_containers_integration_tests/services/test_agent_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_agent_service.py
@@ -7,7 +7,7 @@ from sqlalchemy.orm import Session
 
 from core.plugin.impl.exc import PluginDaemonClientSideError
 from models import Account, AppMode, CreatorUserRole
-from models.enums import ConversationFromSource, MessageFileBelongsTo
+from models.enums import ConversationFromSource, EndUserType, MessageFileBelongsTo
 from models.model import AppModelConfig, Conversation, EndUser, Message, MessageAgentThought
 from services.account_service import AccountService, TenantService
 from services.agent_service import AgentService
@@ -388,7 +388,7 @@ class TestAgentService:
             id=fake.uuid4(),
             tenant_id=app.tenant_id,
             app_id=app.id,
-            type="web_app",
+            type=EndUserType.BROWSER,
             is_anonymous=False,
             session_id=fake.uuid4(),
             name=fake.name(),
diff --git a/api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py b/api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py
index b8e022503fd..8bd4069639f 100644
--- a/api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py
@@ -81,7 +81,7 @@ class TestAPIBasedExtensionService:
         )
 
         # Save extension
-        saved_extension = APIBasedExtensionService.save(extension_data)
+        saved_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Verify extension was saved correctly
         assert saved_extension.id is not None
@@ -119,21 +119,21 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="name must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Test empty api_endpoint
         extension_data.name = fake.company()
         extension_data.api_endpoint = ""
 
         with pytest.raises(ValueError, match="api_endpoint must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Test empty api_key
         extension_data.api_endpoint = f"https://{fake.domain_name()}/api"
         extension_data.api_key = ""
 
         with pytest.raises(ValueError, match="api_key must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_get_all_by_tenant_id_success(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -157,11 +157,11 @@ class TestAPIBasedExtensionService:
                 api_key=fake.password(length=20),
             )
 
-            saved_extension = APIBasedExtensionService.save(extension_data)
+            saved_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
             extensions.append(saved_extension)
 
         # Get all extensions for tenant
-        extension_list = APIBasedExtensionService.get_all_by_tenant_id(tenant.id)
+        extension_list = APIBasedExtensionService.get_all_by_tenant_id(db_session_with_containers, tenant.id)
 
         # Verify results
         assert len(extension_list) == 3
@@ -191,10 +191,12 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        created_extension = APIBasedExtensionService.save(extension_data)
+        created_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Get extension by ID
-        retrieved_extension = APIBasedExtensionService.get_with_tenant_id(tenant.id, created_extension.id)
+        retrieved_extension = APIBasedExtensionService.get_with_tenant_id(
+            db_session_with_containers, tenant.id, created_extension.id
+        )
 
         # Verify extension was retrieved correctly
         assert retrieved_extension is not None
@@ -219,7 +221,9 @@ class TestAPIBasedExtensionService:
 
         # Try to get non-existent extension
         with pytest.raises(ValueError, match="API based extension is not found"):
-            APIBasedExtensionService.get_with_tenant_id(tenant.id, non_existent_extension_id)
+            APIBasedExtensionService.get_with_tenant_id(
+                db_session_with_containers, tenant.id, non_existent_extension_id
+            )
 
     def test_delete_extension_success(self, db_session_with_containers: Session, mock_external_service_dependencies):
         """
@@ -238,11 +242,11 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        created_extension = APIBasedExtensionService.save(extension_data)
+        created_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
         extension_id = created_extension.id
 
         # Delete the extension
-        APIBasedExtensionService.delete(created_extension)
+        APIBasedExtensionService.delete(db_session_with_containers, created_extension)
 
         # Verify extension was deleted
 
@@ -270,7 +274,7 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        APIBasedExtensionService.save(extension_data1)
+        APIBasedExtensionService.save(db_session_with_containers, extension_data1)
         # Try to create second extension with same name
         extension_data2 = APIBasedExtension(
             tenant_id=tenant.id,
@@ -280,7 +284,7 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="name must be unique, it is already existed"):
-            APIBasedExtensionService.save(extension_data2)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data2)
 
     def test_save_extension_update_existing(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -301,7 +305,7 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        created_extension = APIBasedExtensionService.save(extension_data)
+        created_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Save original values for later comparison
         original_name = created_extension.name
@@ -320,7 +324,7 @@ class TestAPIBasedExtensionService:
         created_extension.api_endpoint = new_endpoint
         created_extension.api_key = new_api_key
 
-        updated_extension = APIBasedExtensionService.save(created_extension)
+        updated_extension = APIBasedExtensionService.save(db_session_with_containers, created_extension)
 
         # Verify extension was updated correctly
         assert updated_extension.id == created_extension.id
@@ -336,7 +340,9 @@ class TestAPIBasedExtensionService:
         assert mock_external_service_dependencies["requestor_instance"].request.call_count == 2
 
         # Verify the update by retrieving the extension again
-        retrieved_extension = APIBasedExtensionService.get_with_tenant_id(tenant.id, created_extension.id)
+        retrieved_extension = APIBasedExtensionService.get_with_tenant_id(
+            db_session_with_containers, tenant.id, created_extension.id
+        )
         assert retrieved_extension.name == new_name
         assert retrieved_extension.api_endpoint == new_endpoint
         assert retrieved_extension.api_key == new_api_key  # Should be decrypted when retrieved
@@ -367,7 +373,7 @@ class TestAPIBasedExtensionService:
 
         # Try to save extension with connection error
         with pytest.raises(ValueError, match="connection error: request timeout"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_invalid_api_key_length(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -390,7 +396,7 @@ class TestAPIBasedExtensionService:
 
         # Try to save extension with short API key
         with pytest.raises(ValueError, match="api_key must be at least 5 characters"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_empty_fields(self, db_session_with_containers: Session, mock_external_service_dependencies):
         """
@@ -410,21 +416,21 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="name must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Test with None api_endpoint
         extension_data.name = fake.company()
         extension_data.api_endpoint = None
 
         with pytest.raises(ValueError, match="api_endpoint must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Test with None api_key
         extension_data.api_endpoint = f"https://{fake.domain_name()}/api"
         extension_data.api_key = None
 
         with pytest.raises(ValueError, match="api_key must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_get_all_by_tenant_id_empty_list(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -438,7 +444,7 @@ class TestAPIBasedExtensionService:
         )
 
         # Get all extensions for tenant (none exist)
-        extension_list = APIBasedExtensionService.get_all_by_tenant_id(tenant.id)
+        extension_list = APIBasedExtensionService.get_all_by_tenant_id(db_session_with_containers, tenant.id)
 
         # Verify empty list is returned
         assert len(extension_list) == 0
@@ -468,7 +474,7 @@ class TestAPIBasedExtensionService:
 
         # Try to save extension with invalid ping response
         with pytest.raises(ValueError, match="{'result': 'invalid'}"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_missing_ping_result(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -494,7 +500,7 @@ class TestAPIBasedExtensionService:
 
         # Try to save extension with missing ping result
         with pytest.raises(ValueError, match="{'status': 'ok'}"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_get_with_tenant_id_wrong_tenant(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -520,11 +526,11 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        created_extension = APIBasedExtensionService.save(extension_data)
+        created_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Try to get extension with wrong tenant ID
         with pytest.raises(ValueError, match="API based extension is not found"):
-            APIBasedExtensionService.get_with_tenant_id(tenant2.id, created_extension.id)
+            APIBasedExtensionService.get_with_tenant_id(db_session_with_containers, tenant2.id, created_extension.id)
 
     def test_save_extension_api_key_exactly_four_chars_rejected(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -544,7 +550,7 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="api_key must be at least 5 characters"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_api_key_exactly_five_chars_accepted(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -563,7 +569,7 @@ class TestAPIBasedExtensionService:
             api_key="12345",
         )
 
-        saved = APIBasedExtensionService.save(extension_data)
+        saved = APIBasedExtensionService.save(db_session_with_containers, extension_data)
         assert saved.id is not None
 
     def test_save_extension_requestor_constructor_error(
@@ -586,7 +592,7 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="connection error: bad config"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_network_exception(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -610,7 +616,7 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="connection error: network failure"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_update_duplicate_name_rejected(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -623,26 +629,28 @@ class TestAPIBasedExtensionService:
         assert tenant is not None
 
         ext1 = APIBasedExtensionService.save(
+            db_session_with_containers,
             APIBasedExtension(
                 tenant_id=tenant.id,
                 name="Extension Alpha",
                 api_endpoint=f"https://{fake.domain_name()}/api",
                 api_key=fake.password(length=20),
-            )
+            ),
         )
         ext2 = APIBasedExtensionService.save(
+            db_session_with_containers,
             APIBasedExtension(
                 tenant_id=tenant.id,
                 name="Extension Beta",
                 api_endpoint=f"https://{fake.domain_name()}/api",
                 api_key=fake.password(length=20),
-            )
+            ),
         )
 
         # Try to rename ext2 to ext1's name
         ext2.name = "Extension Alpha"
         with pytest.raises(ValueError, match="name must be unique, it is already existed"):
-            APIBasedExtensionService.save(ext2)
+            APIBasedExtensionService.save(db_session_with_containers, ext2)
 
     def test_get_all_returns_empty_for_different_tenant(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -658,14 +666,15 @@ class TestAPIBasedExtensionService:
         assert tenant1 is not None
 
         APIBasedExtensionService.save(
+            db_session_with_containers,
             APIBasedExtension(
                 tenant_id=tenant1.id,
                 name=fake.company(),
                 api_endpoint=f"https://{fake.domain_name()}/api",
                 api_key=fake.password(length=20),
-            )
+            ),
         )
 
         assert tenant2 is not None
-        result = APIBasedExtensionService.get_all_by_tenant_id(tenant2.id)
+        result = APIBasedExtensionService.get_all_by_tenant_id(db_session_with_containers, tenant2.id)
         assert result == []
diff --git a/api/tests/test_containers_integration_tests/services/test_app_generate_service.py b/api/tests/test_containers_integration_tests/services/test_app_generate_service.py
index 1bc3e559651..f8482f99c00 100644
--- a/api/tests/test_containers_integration_tests/services/test_app_generate_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_app_generate_service.py
@@ -9,6 +9,7 @@ from sqlalchemy.orm import Session
 
 from core.app.entities.app_invoke_entities import InvokeFrom
 from models import App
+from models.enums import EndUserType
 from models.model import EndUser
 from models.workflow import Workflow
 from services.app_generate_service import AppGenerateService
@@ -446,7 +447,7 @@ class TestAppGenerateService:
         end_user = EndUser(
             tenant_id=account.current_tenant.id,
             app_id=app.id,
-            type="normal",
+            type=EndUserType.BROWSER,
             external_user_id=fake.uuid4(),
             name=fake.name(),
             is_anonymous=False,
@@ -831,7 +832,7 @@ class TestAppGenerateService:
         end_user = EndUser(
             tenant_id=account.current_tenant.id,
             app_id=app.id,
-            type="normal",
+            type=EndUserType.BROWSER,
             external_user_id=fake.uuid4(),
             name=fake.name(),
             is_anonymous=False,
diff --git a/api/tests/test_containers_integration_tests/services/test_app_service.py b/api/tests/test_containers_integration_tests/services/test_app_service.py
index 384f83fce3e..0f5cd184430 100644
--- a/api/tests/test_containers_integration_tests/services/test_app_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_app_service.py
@@ -96,6 +96,7 @@ class TestAppService:
         assert app.api_rph == app_params.api_rph
         assert app.api_rpm == app_params.api_rpm
         assert app.created_by == account.id
+        assert app.maintainer == account.id
         assert app.updated_by == account.id
         assert app.status == "normal"
         assert app.enable_site is True
@@ -234,7 +235,7 @@ class TestAppService:
         # Get paginated apps
         params = AppListParams(page=1, limit=10, mode="chat")
 
-        paginated_apps = app_service.get_paginate_apps(account.id, tenant.id, params)
+        paginated_apps = app_service.get_paginate_apps(account.id, tenant.id, params, db_session_with_containers)
 
         # Verify pagination results
         assert paginated_apps is not None
@@ -295,7 +296,7 @@ class TestAppService:
         db_session_with_containers.commit()
 
         last_modified_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat")
+            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat"), db_session_with_containers
         )
         assert last_modified_apps is not None
         assert [app.name for app in last_modified_apps.items] == [
@@ -305,7 +306,10 @@ class TestAppService:
         ]
 
         recently_created_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat", sort_by="recently_created")
+            account.id,
+            tenant.id,
+            AppListParams(page=1, limit=10, mode="chat", sort_by="recently_created"),
+            db_session_with_containers,
         )
         assert recently_created_apps is not None
         assert [app.name for app in recently_created_apps.items] == [
@@ -315,7 +319,10 @@ class TestAppService:
         ]
 
         earliest_created_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat", sort_by="earliest_created")
+            account.id,
+            tenant.id,
+            AppListParams(page=1, limit=10, mode="chat", sort_by="earliest_created"),
+            db_session_with_containers,
         )
         assert earliest_created_apps is not None
         assert [app.name for app in earliest_created_apps.items] == [
@@ -366,7 +373,7 @@ class TestAppService:
         assert star_count == 1
 
         paginated_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat")
+            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat"), db_session_with_containers
         )
         assert paginated_apps is not None
         starred_by_app_id = {app.id: app.is_starred for app in paginated_apps.items}
@@ -377,7 +384,7 @@ class TestAppService:
         db_session_with_containers.commit()
 
         paginated_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat")
+            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat"), db_session_with_containers
         )
         assert paginated_apps is not None
         starred_by_app_id = {app.id: app.is_starred for app in paginated_apps.items}
@@ -442,7 +449,7 @@ class TestAppService:
         db_session_with_containers.commit()
 
         last_modified_apps = app_service.get_paginate_starred_apps(
-            account.id, tenant.id, StarredAppListParams(page=1, limit=10, mode="chat")
+            account.id, tenant.id, StarredAppListParams(page=1, limit=10, mode="chat"), db_session_with_containers
         )
         assert last_modified_apps is not None
         assert [app.name for app in last_modified_apps.items] == [
@@ -457,6 +464,7 @@ class TestAppService:
             account.id,
             tenant.id,
             StarredAppListParams(page=1, limit=10, mode="chat", sort_by="recently_created"),
+            db_session_with_containers,
         )
         assert recently_created_apps is not None
         assert [app.name for app in recently_created_apps.items] == [
@@ -469,6 +477,7 @@ class TestAppService:
             account.id,
             tenant.id,
             StarredAppListParams(page=1, limit=10, mode="chat", sort_by="earliest_created"),
+            db_session_with_containers,
         )
         assert earliest_created_apps is not None
         assert [app.name for app in earliest_created_apps.items] == [
@@ -522,20 +531,25 @@ class TestAppService:
         completion_app = app_service.create_app(tenant.id, completion_app_params, account)
 
         # Test filter by mode
-        chat_apps = app_service.get_paginate_apps(account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat"))
+        chat_apps = app_service.get_paginate_apps(
+            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat"), db_session_with_containers
+        )
         assert len(chat_apps.items) == 1
         assert chat_apps.items[0].mode == "chat"
 
         # Test filter by name
         filtered_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat", name="Chat")
+            account.id, tenant.id, AppListParams(page=1, limit=10, mode="chat", name="Chat"), db_session_with_containers
         )
         assert len(filtered_apps.items) == 1
         assert "Chat" in filtered_apps.items[0].name
 
         # Test filter by created_by_me
         my_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(page=1, limit=10, mode="completion", is_created_by_me=True)
+            account.id,
+            tenant.id,
+            AppListParams(page=1, limit=10, mode="completion", is_created_by_me=True),
+            db_session_with_containers,
         )
         assert len(my_apps.items) == 1
 
@@ -588,6 +602,7 @@ class TestAppService:
             first_account.id,
             tenant.id,
             AppListParams(page=1, limit=10, mode="chat", creator_ids=[second_account.id]),
+            db_session_with_containers,
         )
 
         assert filtered_apps is not None
@@ -635,10 +650,12 @@ class TestAppService:
             # Test with tag filter
             params = AppListParams(page=1, limit=10, mode="chat", tag_ids=["tag1", "tag2"])
 
-            paginated_apps = app_service.get_paginate_apps(account.id, tenant.id, params)
+            paginated_apps = app_service.get_paginate_apps(account.id, tenant.id, params, db_session_with_containers)
 
             # Verify tag service was called
-            mock_tag_service.assert_called_once_with("app", tenant.id, ["tag1", "tag2"], match_all=True)
+            mock_tag_service.assert_called_once_with(
+                "app", tenant.id, ["tag1", "tag2"], db_session_with_containers, match_all=True
+            )
 
             # Verify results
             assert paginated_apps is not None
@@ -651,7 +668,7 @@ class TestAppService:
 
             params = AppListParams(page=1, limit=10, mode="chat", tag_ids=["nonexistent_tag"])
 
-            paginated_apps = app_service.get_paginate_apps(account.id, tenant.id, params)
+            paginated_apps = app_service.get_paginate_apps(account.id, tenant.id, params, db_session_with_containers)
 
             # Should return None when no apps match tag filter
             assert paginated_apps is None
@@ -1467,7 +1484,7 @@ class TestAppService:
 
         # Test 1: Search with % character
         paginated_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(name="50%", mode="chat", page=1, limit=10)
+            account.id, tenant.id, AppListParams(name="50%", mode="chat", page=1, limit=10), db_session_with_containers
         )
         assert paginated_apps is not None
         assert paginated_apps.total == 1
@@ -1476,7 +1493,10 @@ class TestAppService:
 
         # Test 2: Search with _ character
         paginated_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(name="test_data", mode="chat", page=1, limit=10)
+            account.id,
+            tenant.id,
+            AppListParams(name="test_data", mode="chat", page=1, limit=10),
+            db_session_with_containers,
         )
         assert paginated_apps is not None
         assert paginated_apps.total == 1
@@ -1485,7 +1505,10 @@ class TestAppService:
 
         # Test 3: Search with \ character
         paginated_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(name="path\\to\\app", mode="chat", page=1, limit=10)
+            account.id,
+            tenant.id,
+            AppListParams(name="path\\to\\app", mode="chat", page=1, limit=10),
+            db_session_with_containers,
         )
         assert paginated_apps is not None
         assert paginated_apps.total == 1
@@ -1494,7 +1517,7 @@ class TestAppService:
 
         # Test 4: Search with % should NOT match 100% (verifies escaping works)
         paginated_apps = app_service.get_paginate_apps(
-            account.id, tenant.id, AppListParams(name="50%", mode="chat", page=1, limit=10)
+            account.id, tenant.id, AppListParams(name="50%", mode="chat", page=1, limit=10), db_session_with_containers
         )
         assert paginated_apps is not None
         assert paginated_apps.total == 1
diff --git a/api/tests/test_containers_integration_tests/services/test_conversation_service.py b/api/tests/test_containers_integration_tests/services/test_conversation_service.py
index 5f3914eb19d..b19b6b9c984 100644
--- a/api/tests/test_containers_integration_tests/services/test_conversation_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_conversation_service.py
@@ -12,7 +12,7 @@ from sqlalchemy.orm import Session
 from core.app.entities.app_invoke_entities import InvokeFrom
 from models import TenantAccountRole
 from models.account import Account, Tenant, TenantAccountJoin
-from models.enums import ConversationFromSource
+from models.enums import ConversationFromSource, EndUserType
 from models.model import App, Conversation, EndUser, Message, MessageAnnotation
 from services.annotation_service import AppAnnotationService
 from services.conversation_service import ConversationService
@@ -76,7 +76,7 @@ class ConversationServiceIntegrationTestDataFactory:
         end_user = EndUser(
             tenant_id=app.tenant_id,
             app_id=app.id,
-            type=InvokeFrom.SERVICE_API,
+            type=EndUserType.SERVICE_API,
             external_user_id=f"external-{uuid4()}",
             name="End User",
             is_anonymous=False,
diff --git a/api/tests/test_containers_integration_tests/services/test_conversation_service_variables.py b/api/tests/test_containers_integration_tests/services/test_conversation_service_variables.py
index 853630ad65c..33d4563904e 100644
--- a/api/tests/test_containers_integration_tests/services/test_conversation_service_variables.py
+++ b/api/tests/test_containers_integration_tests/services/test_conversation_service_variables.py
@@ -12,7 +12,7 @@ from core.app.entities.app_invoke_entities import InvokeFrom
 from extensions.ext_database import db
 from graphon.variables import FloatVariable, IntegerVariable, StringVariable
 from models.account import Account, Tenant, TenantAccountJoin
-from models.enums import ConversationFromSource
+from models.enums import ConversationFromSource, EndUserType
 from models.model import App, Conversation, EndUser
 from models.workflow import ConversationVariable
 from services.conversation_service import ConversationService
@@ -78,7 +78,7 @@ class ConversationServiceVariableIntegrationFactory:
         end_user = EndUser(
             tenant_id=app.tenant_id,
             app_id=app.id,
-            type=InvokeFrom.SERVICE_API.value,
+            type=EndUserType.SERVICE_API,
             external_user_id=f"external-{uuid4()}",
             name=f"End User {uuid4()}",
             is_anonymous=False,
diff --git a/api/tests/test_containers_integration_tests/services/test_dataset_permission_service.py b/api/tests/test_containers_integration_tests/services/test_dataset_permission_service.py
index f9898e2cfac..1ea1b10a15d 100644
--- a/api/tests/test_containers_integration_tests/services/test_dataset_permission_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_dataset_permission_service.py
@@ -73,6 +73,7 @@ class DatasetPermissionTestDataFactory:
             data_source_type=DataSourceType.UPLOAD_FILE,
             indexing_technique=IndexTechniqueType.HIGH_QUALITY,
             created_by=created_by,
+            maintainer=created_by,
             permission=permission,
             provider="vendor",
             retrieval_model={"top_k": 2},
diff --git a/api/tests/test_containers_integration_tests/services/test_dataset_service.py b/api/tests/test_containers_integration_tests/services/test_dataset_service.py
index e6ee896a525..201b65b30d0 100644
--- a/api/tests/test_containers_integration_tests/services/test_dataset_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_dataset_service.py
@@ -441,6 +441,7 @@ class TestDatasetServiceCreateRagPipelineDataset:
         assert created_dataset.name == entity.name
         assert created_dataset.runtime_mode == DatasetRuntimeMode.RAG_PIPELINE
         assert created_dataset.created_by == account.id
+        assert created_dataset.maintainer == account.id
         assert created_dataset.permission == DatasetPermissionEnum.ONLY_ME
         assert created_pipeline is not None
         assert created_pipeline.name == entity.name
diff --git a/api/tests/test_containers_integration_tests/services/test_dataset_service_document.py b/api/tests/test_containers_integration_tests/services/test_dataset_service_document.py
index 0c089e506bf..946ac661940 100644
--- a/api/tests/test_containers_integration_tests/services/test_dataset_service_document.py
+++ b/api/tests/test_containers_integration_tests/services/test_dataset_service_document.py
@@ -30,11 +30,13 @@ class DocumentServiceIntegrationFactory:
         created_by: str | None = None,
         name: str | None = None,
     ) -> Dataset:
+        resolved_created_by = created_by or str(uuid4())
         dataset = Dataset(
             tenant_id=tenant_id or str(uuid4()),
             name=name or f"dataset-{uuid4()}",
             data_source_type=DataSourceType.UPLOAD_FILE,
-            created_by=created_by or str(uuid4()),
+            created_by=resolved_created_by,
+            maintainer=resolved_created_by,
         )
         db_session_with_containers.add(dataset)
         db_session_with_containers.commit()
diff --git a/api/tests/test_containers_integration_tests/services/test_dataset_service_permissions.py b/api/tests/test_containers_integration_tests/services/test_dataset_service_permissions.py
index 0603a1e27f1..d97c16668fd 100644
--- a/api/tests/test_containers_integration_tests/services/test_dataset_service_permissions.py
+++ b/api/tests/test_containers_integration_tests/services/test_dataset_service_permissions.py
@@ -100,6 +100,7 @@ class DatasetPermissionIntegrationFactory:
             data_source_type=DataSourceType.UPLOAD_FILE,
             indexing_technique=indexing_technique,
             created_by=created_by,
+            maintainer=created_by,
             provider="vendor",
             permission=permission,
             retrieval_model={"top_k": 2},
diff --git a/api/tests/test_containers_integration_tests/services/test_dataset_service_retrieval.py b/api/tests/test_containers_integration_tests/services/test_dataset_service_retrieval.py
index 4e2bf9fc103..05632b1ec2a 100644
--- a/api/tests/test_containers_integration_tests/services/test_dataset_service_retrieval.py
+++ b/api/tests/test_containers_integration_tests/services/test_dataset_service_retrieval.py
@@ -106,6 +106,7 @@ class DatasetRetrievalTestDataFactory:
             data_source_type=DataSourceType.UPLOAD_FILE,
             indexing_technique=IndexTechniqueType.HIGH_QUALITY,
             created_by=created_by,
+            maintainer=created_by,
             permission=permission,
             provider="vendor",
             retrieval_model={"top_k": 2},
@@ -227,7 +228,7 @@ class TestDatasetServiceGetDatasets:
             )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page, per_page, tenant_id=tenant.id)
+        datasets, total = DatasetService.get_datasets(page, per_page, db_session_with_containers, tenant_id=tenant.id)
 
         # Assert
         assert len(datasets) == 5
@@ -257,7 +258,9 @@ class TestDatasetServiceGetDatasets:
         )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page, per_page, tenant_id=tenant.id, search=search)
+        datasets, total = DatasetService.get_datasets(
+            page, per_page, db_session_with_containers, tenant_id=tenant.id, search=search
+        )
 
         # Assert
         assert len(datasets) == 1
@@ -301,7 +304,9 @@ class TestDatasetServiceGetDatasets:
         tag_ids = [tag_1.id, tag_2.id]
 
         # Act
-        datasets, total = DatasetService.get_datasets(page, per_page, tenant_id=tenant.id, tag_ids=tag_ids)
+        datasets, total = DatasetService.get_datasets(
+            page, per_page, db_session_with_containers, tenant_id=tenant.id, tag_ids=tag_ids
+        )
 
         # Assert
         assert len(datasets) == 1
@@ -326,7 +331,9 @@ class TestDatasetServiceGetDatasets:
             )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page, per_page, tenant_id=tenant.id, tag_ids=tag_ids)
+        datasets, total = DatasetService.get_datasets(
+            page, per_page, db_session_with_containers, tenant_id=tenant.id, tag_ids=tag_ids
+        )
 
         # Assert
         # When tag_ids is empty, tag filtering is skipped, so normal query results are returned
@@ -356,7 +363,9 @@ class TestDatasetServiceGetDatasets:
         )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page, per_page, tenant_id=tenant.id, user=None)
+        datasets, total = DatasetService.get_datasets(
+            page, per_page, db_session_with_containers, tenant_id=tenant.id, user=None
+        )
 
         # Assert
         assert len(datasets) == 1
@@ -384,6 +393,7 @@ class TestDatasetServiceGetDatasets:
         datasets, total = DatasetService.get_datasets(
             page=1,
             per_page=20,
+            session=db_session_with_containers,
             tenant_id=tenant.id,
             user=owner,
             include_all=True,
@@ -408,7 +418,9 @@ class TestDatasetServiceGetDatasets:
         )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page=1, per_page=20, tenant_id=tenant.id, user=user)
+        datasets, total = DatasetService.get_datasets(
+            page=1, per_page=20, session=db_session_with_containers, tenant_id=tenant.id, user=user
+        )
 
         # Assert
         assert len(datasets) == 1
@@ -432,7 +444,9 @@ class TestDatasetServiceGetDatasets:
         )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page=1, per_page=20, tenant_id=tenant.id, user=user)
+        datasets, total = DatasetService.get_datasets(
+            page=1, per_page=20, session=db_session_with_containers, tenant_id=tenant.id, user=user
+        )
 
         # Assert
         assert len(datasets) == 1
@@ -459,7 +473,9 @@ class TestDatasetServiceGetDatasets:
         )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page=1, per_page=20, tenant_id=tenant.id, user=user)
+        datasets, total = DatasetService.get_datasets(
+            page=1, per_page=20, session=db_session_with_containers, tenant_id=tenant.id, user=user
+        )
 
         # Assert
         assert len(datasets) == 1
@@ -486,7 +502,9 @@ class TestDatasetServiceGetDatasets:
         )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page=1, per_page=20, tenant_id=tenant.id, user=operator)
+        datasets, total = DatasetService.get_datasets(
+            page=1, per_page=20, session=db_session_with_containers, tenant_id=tenant.id, user=operator
+        )
 
         # Assert
         assert len(datasets) == 1
@@ -509,7 +527,9 @@ class TestDatasetServiceGetDatasets:
         )
 
         # Act
-        datasets, total = DatasetService.get_datasets(page=1, per_page=20, tenant_id=tenant.id, user=operator)
+        datasets, total = DatasetService.get_datasets(
+            page=1, per_page=20, session=db_session_with_containers, tenant_id=tenant.id, user=operator
+        )
 
         # Assert
         assert datasets == []
diff --git a/api/tests/test_containers_integration_tests/services/test_end_user_service.py b/api/tests/test_containers_integration_tests/services/test_end_user_service.py
index 998b3378e2c..b6104f94f21 100644
--- a/api/tests/test_containers_integration_tests/services/test_end_user_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_end_user_service.py
@@ -1,15 +1,14 @@
 from __future__ import annotations
 
 import logging
-from unittest.mock import patch
 from uuid import uuid4
 
 import pytest
 from sqlalchemy.orm import Session
 
-from core.app.entities.app_invoke_entities import InvokeFrom
 from models import TenantAccountRole
 from models.account import Account, Tenant, TenantAccountJoin
+from models.enums import EndUserType
 from models.model import App, DefaultEndUserSessionID, EndUser
 from services.end_user_service import EndUserService
 
@@ -72,7 +71,7 @@ class TestEndUserServiceFactory:
         tenant_id: str,
         app_id: str,
         session_id: str,
-        invoke_type: InvokeFrom,
+        invoke_type: EndUserType,
         is_anonymous: bool = False,
     ):
         end_user = EndUser(
@@ -120,7 +119,7 @@ class TestEndUserServiceGetOrCreateEndUser:
         assert result.tenant_id == app.tenant_id
         assert result.app_id == app.id
         assert result.session_id == user_id
-        assert result.type == InvokeFrom.SERVICE_API
+        assert result.type == EndUserType.SERVICE_API
         assert result.is_anonymous is False
 
     def test_get_or_create_end_user_without_user_id(
@@ -148,7 +147,7 @@ class TestEndUserServiceGetOrCreateEndUser:
             tenant_id=app.tenant_id,
             app_id=app.id,
             session_id=user_id,
-            invoke_type=InvokeFrom.SERVICE_API,
+            invoke_type=EndUserType.SERVICE_API,
         )
 
         # Act
@@ -163,7 +162,7 @@ class TestEndUserServiceGetOrCreateEndUserByType:
     Unit tests for EndUserService.get_or_create_end_user_by_type method.
 
     This test suite covers:
-    - Creating end users with different InvokeFrom types
+    - Creating end users with different EndUserType values
     - Type migration for legacy users
     - Query ordering and prioritization
     - Session management
@@ -186,22 +185,22 @@ class TestEndUserServiceGetOrCreateEndUserByType:
 
         # Act
         result = EndUserService.get_or_create_end_user_by_type(
-            type=InvokeFrom.SERVICE_API,
+            type=EndUserType.SERVICE_API,
             tenant_id=tenant_id,
             app_id=app_id,
             user_id=user_id,
         )
 
         # Assert
-        assert result.type == InvokeFrom.SERVICE_API
+        assert result.type == EndUserType.SERVICE_API
         assert result.tenant_id == tenant_id
         assert result.app_id == app_id
         assert result.session_id == user_id
 
-    def test_create_end_user_web_app_type(
+    def test_create_end_user_browser_type(
         self, db_session_with_containers: Session, factory: TestEndUserServiceFactory
     ):
-        """Test creating new end user with WEB_APP type."""
+        """Test creating new end user with BROWSER type."""
         # Arrange
         app = factory.create_app_and_account(db_session_with_containers)
         tenant_id = app.tenant_id
@@ -210,14 +209,14 @@ class TestEndUserServiceGetOrCreateEndUserByType:
 
         # Act
         result = EndUserService.get_or_create_end_user_by_type(
-            type=InvokeFrom.WEB_APP,
+            type=EndUserType.BROWSER,
             tenant_id=tenant_id,
             app_id=app_id,
             user_id=user_id,
         )
 
         # Assert
-        assert result.type == InvokeFrom.WEB_APP
+        assert result.type == EndUserType.BROWSER
 
     def test_upgrade_legacy_end_user_type(
         self, caplog: pytest.LogCaptureFixture, db_session_with_containers: Session, factory: TestEndUserServiceFactory
@@ -235,12 +234,12 @@ class TestEndUserServiceGetOrCreateEndUserByType:
             tenant_id=tenant_id,
             app_id=app_id,
             session_id=user_id,
-            invoke_type=InvokeFrom.SERVICE_API,
+            invoke_type=EndUserType.SERVICE_API,
         )
         with caplog.at_level(logging.INFO, logger="services.end_user_service"):
             # Act - Request with different type
             result = EndUserService.get_or_create_end_user_by_type(
-                type=InvokeFrom.WEB_APP,
+                type=EndUserType.BROWSER,
                 tenant_id=tenant_id,
                 app_id=app_id,
                 user_id=user_id,
@@ -248,7 +247,7 @@ class TestEndUserServiceGetOrCreateEndUserByType:
 
         # Assert
         assert result.id == existing_user.id
-        assert result.type == InvokeFrom.WEB_APP  # Type should be updated
+        assert result.type == EndUserType.BROWSER  # Type should be updated
         matching_logs = [
             record
             for record in caplog.records
@@ -259,9 +258,8 @@ class TestEndUserServiceGetOrCreateEndUserByType:
 
         assert len(matching_logs) == 1
 
-    @patch("services.end_user_service.logger")
     def test_get_existing_end_user_matching_type(
-        self, mock_logger, db_session_with_containers: Session, factory: TestEndUserServiceFactory
+        self, db_session_with_containers: Session, factory: TestEndUserServiceFactory, caplog
     ):
         """Test retrieving existing end user with matching type."""
         # Arrange
@@ -275,21 +273,23 @@ class TestEndUserServiceGetOrCreateEndUserByType:
             tenant_id=tenant_id,
             app_id=app_id,
             session_id=user_id,
-            invoke_type=InvokeFrom.SERVICE_API,
+            invoke_type=EndUserType.SERVICE_API,
         )
 
         # Act - Request with same type
-        result = EndUserService.get_or_create_end_user_by_type(
-            type=InvokeFrom.SERVICE_API,
-            tenant_id=tenant_id,
-            app_id=app_id,
-            user_id=user_id,
-        )
+        with caplog.at_level(logging.INFO, logger="services.end_user_service"):
+            result = EndUserService.get_or_create_end_user_by_type(
+                type=EndUserType.SERVICE_API,
+                tenant_id=tenant_id,
+                app_id=app_id,
+                user_id=user_id,
+            )
 
         # Assert
         assert result.id == existing_user.id
-        assert result.type == InvokeFrom.SERVICE_API
-        mock_logger.info.assert_not_called()
+        assert result.type == EndUserType.SERVICE_API
+        # No legacy-upgrade log should be emitted when the existing user's type already matches.
+        assert [record for record in caplog.records if record.levelno == logging.INFO] == []
 
     def test_create_anonymous_user_with_default_session(
         self, db_session_with_containers: Session, factory: TestEndUserServiceFactory
@@ -302,7 +302,7 @@ class TestEndUserServiceGetOrCreateEndUserByType:
 
         # Act
         result = EndUserService.get_or_create_end_user_by_type(
-            type=InvokeFrom.SERVICE_API,
+            type=EndUserType.SERVICE_API,
             tenant_id=tenant_id,
             app_id=app_id,
             user_id=None,
@@ -329,19 +329,19 @@ class TestEndUserServiceGetOrCreateEndUserByType:
             tenant_id=tenant_id,
             app_id=app_id,
             session_id=user_id,
-            invoke_type=InvokeFrom.WEB_APP,
+            invoke_type=EndUserType.BROWSER,
         )
         matching = factory.create_end_user(
             db_session_with_containers,
             tenant_id=tenant_id,
             app_id=app_id,
             session_id=user_id,
-            invoke_type=InvokeFrom.SERVICE_API,
+            invoke_type=EndUserType.SERVICE_API,
         )
 
         # Act
         result = EndUserService.get_or_create_end_user_by_type(
-            type=InvokeFrom.SERVICE_API,
+            type=EndUserType.SERVICE_API,
             tenant_id=tenant_id,
             app_id=app_id,
             user_id=user_id,
@@ -363,7 +363,7 @@ class TestEndUserServiceGetOrCreateEndUserByType:
 
         # Act
         result = EndUserService.get_or_create_end_user_by_type(
-            type=InvokeFrom.SERVICE_API,
+            type=EndUserType.SERVICE_API,
             tenant_id=tenant_id,
             app_id=app_id,
             user_id=user_id,
@@ -376,16 +376,16 @@ class TestEndUserServiceGetOrCreateEndUserByType:
     @pytest.mark.parametrize(
         "invoke_type",
         [
-            InvokeFrom.SERVICE_API,
-            InvokeFrom.WEB_APP,
-            InvokeFrom.EXPLORE,
-            InvokeFrom.DEBUGGER,
+            EndUserType.SERVICE_API,
+            EndUserType.BROWSER,
+            EndUserType.OPENAPI,
+            EndUserType.TRIGGER,
         ],
     )
     def test_create_end_user_with_different_invoke_types(
-        self, db_session_with_containers: Session, invoke_type: InvokeFrom, factory: TestEndUserServiceFactory
+        self, db_session_with_containers: Session, invoke_type: EndUserType, factory: TestEndUserServiceFactory
     ):
-        """Test creating end users with different InvokeFrom types."""
+        """Test creating end users with different EndUserType values."""
         # Arrange
         app = factory.create_app_and_account(db_session_with_containers)
         tenant_id = app.tenant_id
@@ -421,7 +421,7 @@ class TestEndUserServiceGetEndUserById:
             tenant_id=app.tenant_id,
             app_id=app.id,
             session_id=f"session-{uuid4()}",
-            invoke_type=InvokeFrom.SERVICE_API,
+            invoke_type=EndUserType.SERVICE_API,
         )
 
         result = EndUserService.get_end_user_by_id(
@@ -487,7 +487,7 @@ class TestEndUserServiceCreateBatch:
 
     def test_create_batch_empty_app_ids(self, db_session_with_containers: Session):
         result = EndUserService.create_end_user_batch(
-            type=InvokeFrom.SERVICE_API, tenant_id=str(uuid4()), app_ids=[], user_id="user-1"
+            type=EndUserType.SERVICE_API, tenant_id=str(uuid4()), app_ids=[], user_id="user-1"
         )
         assert result == {}
 
@@ -499,14 +499,14 @@ class TestEndUserServiceCreateBatch:
         user_id = f"user-{uuid4()}"
 
         result = EndUserService.create_end_user_batch(
-            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
+            type=EndUserType.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
         )
 
         assert len(result) == 3
         for app_id in app_ids:
             assert app_id in result
             assert result[app_id].session_id == user_id
-            assert result[app_id].type == InvokeFrom.SERVICE_API
+            assert result[app_id].type == EndUserType.SERVICE_API
 
     def test_create_batch_default_session_id(
         self, db_session_with_containers: Session, factory: TestEndUserServiceFactory
@@ -515,7 +515,7 @@ class TestEndUserServiceCreateBatch:
         app_ids = [a.id for a in apps]
 
         result = EndUserService.create_end_user_batch(
-            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=""
+            type=EndUserType.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=""
         )
 
         assert len(result) == 2
@@ -531,7 +531,7 @@ class TestEndUserServiceCreateBatch:
         user_id = f"user-{uuid4()}"
 
         result = EndUserService.create_end_user_batch(
-            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
+            type=EndUserType.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
         )
 
         assert len(result) == 2
@@ -545,12 +545,12 @@ class TestEndUserServiceCreateBatch:
 
         # Create batch first time
         first_result = EndUserService.create_end_user_batch(
-            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
+            type=EndUserType.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
         )
 
         # Create batch second time — should return existing users
         second_result = EndUserService.create_end_user_batch(
-            type=InvokeFrom.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
+            type=EndUserType.SERVICE_API, tenant_id=tenant_id, app_ids=app_ids, user_id=user_id
         )
 
         assert len(second_result) == 2
@@ -565,7 +565,7 @@ class TestEndUserServiceCreateBatch:
 
         # Create for first 2 apps
         first_result = EndUserService.create_end_user_batch(
-            type=InvokeFrom.SERVICE_API,
+            type=EndUserType.SERVICE_API,
             tenant_id=tenant_id,
             app_ids=[apps[0].id, apps[1].id],
             user_id=user_id,
@@ -573,7 +573,7 @@ class TestEndUserServiceCreateBatch:
 
         # Create for all 3 apps — should reuse first 2, create 3rd
         all_result = EndUserService.create_end_user_batch(
-            type=InvokeFrom.SERVICE_API,
+            type=EndUserType.SERVICE_API,
             tenant_id=tenant_id,
             app_ids=[a.id for a in apps],
             user_id=user_id,
@@ -586,10 +586,10 @@ class TestEndUserServiceCreateBatch:
 
     @pytest.mark.parametrize(
         "invoke_type",
-        [InvokeFrom.SERVICE_API, InvokeFrom.WEB_APP, InvokeFrom.EXPLORE, InvokeFrom.DEBUGGER],
+        [EndUserType.SERVICE_API, EndUserType.BROWSER, EndUserType.OPENAPI, EndUserType.TRIGGER],
     )
     def test_create_batch_all_invoke_types(
-        self, db_session_with_containers: Session, invoke_type: InvokeFrom, factory: TestEndUserServiceFactory
+        self, db_session_with_containers: Session, invoke_type: EndUserType, factory: TestEndUserServiceFactory
     ):
         tenant_id, apps = self._create_multiple_apps(db_session_with_containers, factory, count=1)
         user_id = f"user-{uuid4()}"
diff --git a/api/tests/test_containers_integration_tests/services/test_feature_service.py b/api/tests/test_containers_integration_tests/services/test_feature_service.py
index a678e37b41d..4e5bfc6ac1d 100644
--- a/api/tests/test_containers_integration_tests/services/test_feature_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_feature_service.py
@@ -61,6 +61,7 @@ class TestFeatureService:
                 },
                 "WebAppAuth": {"allowSso": True, "allowEmailCodeLogin": True, "allowEmailPasswordLogin": False},
                 "SSOEnforcedForWebProtocol": "oidc",
+                "EnableAppDeploy": True,
                 "License": {
                     "status": "active",
                     "expiredAt": "2025-12-31",
@@ -291,6 +292,7 @@ class TestFeatureService:
         assert isinstance(result, SystemFeatureModel)
 
         # Verify enterprise features
+        assert result.enable_app_deploy is True
         assert result.branding.enabled is True
         assert result.webapp_auth.enabled is True
         assert result.enable_change_email is False
@@ -377,6 +379,7 @@ class TestFeatureService:
         # Ensure that data required for frontend rendering remains accessible.
 
         # Branding should match the mock data
+        assert result.enable_app_deploy is True
         assert result.branding.enabled is True
         assert result.branding.application_title == "Test Enterprise"
         assert result.branding.login_page_logo == "https://example.com/logo.png"
@@ -424,6 +427,7 @@ class TestFeatureService:
             assert isinstance(result, SystemFeatureModel)
 
             # Verify basic configuration
+            assert result.enable_app_deploy is False
             assert result.branding.enabled is False
             assert result.webapp_auth.enabled is False
             assert result.enable_change_email is True
@@ -625,6 +629,7 @@ class TestFeatureService:
             assert isinstance(result, SystemFeatureModel)
 
             # Verify enterprise features are disabled
+            assert result.enable_app_deploy is False
             assert result.branding.enabled is False
             assert result.webapp_auth.enabled is False
             assert result.enable_change_email is True
diff --git a/api/tests/test_containers_integration_tests/services/test_feedback_service.py b/api/tests/test_containers_integration_tests/services/test_feedback_service.py
index a4663450d49..e4fd81b53e7 100644
--- a/api/tests/test_containers_integration_tests/services/test_feedback_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_feedback_service.py
@@ -7,7 +7,6 @@ from unittest import mock
 
 import pytest
 
-from extensions.ext_database import db
 from models.enums import FeedbackFromSource, FeedbackRating
 from models.model import App, Conversation, Message
 from services.feedback_service import FeedbackService
@@ -23,11 +22,9 @@ class TestFeedbackService:
     """Test FeedbackService methods."""
 
     @pytest.fixture
-    def mock_db_session(self, monkeypatch: pytest.MonkeyPatch):
-        """Mock database session."""
-        mock_session = mock.Mock()
-        monkeypatch.setattr(db, "session", mock_session)
-        return mock_session
+    def mock_db_session(self):
+        """Mock database session passed explicitly to the service."""
+        return mock.Mock()
 
     @pytest.fixture
     def sample_data(self):
@@ -100,7 +97,7 @@ class TestFeedbackService:
         )
 
         # Test CSV export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="csv")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="csv")
 
         # Verify response structure
         assert hasattr(result, "headers")
@@ -131,7 +128,7 @@ class TestFeedbackService:
         )
 
         # Test JSON export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="json")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="json")
 
         # Verify response structure
         assert hasattr(result, "headers")
@@ -161,6 +158,7 @@ class TestFeedbackService:
 
         # Test with filters
         result = FeedbackService.export_feedbacks(
+            mock_db_session,
             app_id=sample_data["app"].id,
             from_source=FeedbackFromSource.ADMIN,
             rating=FeedbackRating.DISLIKE,
@@ -177,7 +175,7 @@ class TestFeedbackService:
         """Test exporting feedback when no data exists."""
         mock_db_session.execute.return_value = _execute_result([])
 
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="csv")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="csv")
 
         # Should return an empty CSV with headers only
         assert hasattr(result, "headers")
@@ -195,17 +193,22 @@ class TestFeedbackService:
 
         # Test with invalid start_date
         with pytest.raises(ValueError, match="Invalid start_date format"):
-            FeedbackService.export_feedbacks(app_id=sample_data["app"].id, start_date="invalid-date-format")
+            FeedbackService.export_feedbacks(
+                mock_db_session, app_id=sample_data["app"].id, start_date="invalid-date-format"
+            )
 
         # Test with invalid end_date
         with pytest.raises(ValueError, match="Invalid end_date format"):
-            FeedbackService.export_feedbacks(app_id=sample_data["app"].id, end_date="invalid-date-format")
+            FeedbackService.export_feedbacks(
+                mock_db_session, app_id=sample_data["app"].id, end_date="invalid-date-format"
+            )
 
     def test_export_feedbacks_invalid_format(self, mock_db_session, sample_data):
         """Test exporting feedback with unsupported format."""
 
         with pytest.raises(ValueError, match="Unsupported format"):
             FeedbackService.export_feedbacks(
+                mock_db_session,
                 app_id=sample_data["app"].id,
                 format_type="xml",  # Unsupported format
             )
@@ -236,7 +239,7 @@ class TestFeedbackService:
         )
 
         # Test export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="json")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="json")
 
         # Check JSON content
         json_content = json.loads(result.get_data(as_text=True))
@@ -287,7 +290,7 @@ class TestFeedbackService:
         )
 
         # Test export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="csv")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="csv")
 
         # Check that unicode content is preserved
         csv_content = result.get_data(as_text=True)
@@ -317,7 +320,7 @@ class TestFeedbackService:
         )
 
         # Test export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="json")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="json")
 
         # Check JSON content for emoji ratings
         json_content = json.loads(result.get_data(as_text=True))
diff --git a/api/tests/test_containers_integration_tests/services/test_file_service.py b/api/tests/test_containers_integration_tests/services/test_file_service.py
index 4532005836a..deb0d9d7d08 100644
--- a/api/tests/test_containers_integration_tests/services/test_file_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_file_service.py
@@ -11,7 +11,7 @@ from werkzeug.exceptions import NotFound
 from configs import dify_config
 from extensions.storage.storage_type import StorageType
 from models import Account, Tenant
-from models.enums import CreatorUserRole
+from models.enums import CreatorUserRole, EndUserType
 from models.model import EndUser, UploadFile
 from services.errors.file import BlockedFileExtensionError, FileTooLargeError, UnsupportedFileTypeError
 from services.file_service import FileService
@@ -112,7 +112,7 @@ class TestFileService:
 
         end_user = EndUser(
             tenant_id=str(fake.uuid4()),
-            type="web",
+            type=EndUserType.BROWSER,
             name=fake.name(),
             is_anonymous=False,
             session_id=fake.uuid4(),
diff --git a/api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py b/api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py
index 1101d834a0d..5eb84f805aa 100644
--- a/api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py
+++ b/api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py
@@ -69,7 +69,7 @@ def test_build_upload_files_zip_tempfile_sanitizes_and_dedupes_names(monkeypatch
 
 def test_get_upload_files_by_ids_returns_empty_when_no_ids(db_session_with_containers: Session) -> None:
     """Ensure empty input returns an empty mapping without hitting the database."""
-    assert FileService.get_upload_files_by_ids(str(uuid4()), []) == {}
+    assert FileService.get_upload_files_by_ids(db_session_with_containers, str(uuid4()), []) == {}
 
 
 def test_get_upload_files_by_ids_returns_id_keyed_mapping(db_session_with_containers: Session) -> None:
@@ -78,7 +78,7 @@ def test_get_upload_files_by_ids_returns_id_keyed_mapping(db_session_with_contai
     file1 = _create_upload_file(db_session_with_containers, tenant_id=tenant_id, key="k1", name="file1.txt")
     file2 = _create_upload_file(db_session_with_containers, tenant_id=tenant_id, key="k2", name="file2.txt")
 
-    result = FileService.get_upload_files_by_ids(tenant_id, [file1.id, file1.id, file2.id])
+    result = FileService.get_upload_files_by_ids(db_session_with_containers, tenant_id, [file1.id, file1.id, file2.id])
 
     assert set(result.keys()) == {file1.id, file2.id}
     assert result[file1.id].id == file1.id
@@ -92,6 +92,6 @@ def test_get_upload_files_by_ids_filters_by_tenant(db_session_with_containers: S
     file_a = _create_upload_file(db_session_with_containers, tenant_id=tenant_a, key="ka", name="a.txt")
     _create_upload_file(db_session_with_containers, tenant_id=tenant_b, key="kb", name="b.txt")
 
-    result = FileService.get_upload_files_by_ids(tenant_a, [file_a.id])
+    result = FileService.get_upload_files_by_ids(db_session_with_containers, tenant_a, [file_a.id])
 
     assert set(result.keys()) == {file_a.id}
diff --git a/api/tests/test_containers_integration_tests/services/test_hit_testing_service.py b/api/tests/test_containers_integration_tests/services/test_hit_testing_service.py
index f332ba05ec2..2d23ae8f68f 100644
--- a/api/tests/test_containers_integration_tests/services/test_hit_testing_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_hit_testing_service.py
@@ -1,26 +1,79 @@
 from __future__ import annotations
 
 import json
-from typing import Any, cast
-from unittest.mock import ANY, MagicMock, patch
+from datetime import datetime
+from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
 import pytest
+from pydantic import BaseModel, ConfigDict, TypeAdapter
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
+from core.rag.embedding.retrieval import RetrievalSegments
 from core.rag.models.document import Document
-from models.dataset import Dataset, DatasetQuery
+from core.rag.retrieval.retrieval_methods import RetrievalMethod
+from models.dataset import Dataset, DatasetQuery, DocumentSegment
+from models.dataset import Document as DatasetDocument
+from models.enums import DataSourceType, DocumentCreatedFrom, SegmentStatus
 from services.hit_testing_service import HitTestingService
 
 
-def _create_dataset(db_session: Session, *, provider: str = "vendor", **kwargs: Any) -> Dataset:
-    tenant_id = str(uuid4())
-    created_by = str(uuid4())
+class _QueryResponse(BaseModel):
+    content: str
+
+
+class _RetrieveRecordResponse(BaseModel):
+    content: str | None = None
+    title: str | None = None
+
+    model_config = ConfigDict(extra="allow")
+
+
+class _RetrieveResponse(BaseModel):
+    query: _QueryResponse
+    records: list[_RetrieveRecordResponse]
+
+
+class _DumpedDocumentResponse(BaseModel):
+    id: str
+    data_source_type: str
+    name: str
+    doc_type: str | None
+    doc_metadata: dict[str, object] | None
+
+
+class _DumpedSegmentResponse(BaseModel):
+    id: str
+    document_id: str
+    created_at: datetime | None = None
+    document: _DumpedDocumentResponse | None = None
+
+    model_config = ConfigDict(extra="allow")
+
+
+class _DumpedRetrievalRecordResponse(BaseModel):
+    segment: _DumpedSegmentResponse
+    score: float
+
+    model_config = ConfigDict(extra="allow")
+
+
+_DUMPED_RETRIEVAL_RECORDS = TypeAdapter(list[_DumpedRetrievalRecordResponse])
+
+
+def _create_dataset(
+    db_session: Session,
+    *,
+    provider: str = "vendor",
+    tenant_id: str | None = None,
+    created_by: str | None = None,
+    name: str = "test-dataset",
+) -> Dataset:
     ds = Dataset(
-        tenant_id=kwargs.get("tenant_id", tenant_id),
-        name=kwargs.get("name", "test-dataset"),
-        created_by=kwargs.get("created_by", created_by),
+        tenant_id=tenant_id or str(uuid4()),
+        name=name,
+        created_by=created_by or str(uuid4()),
         provider=provider,
     )
     db_session.add(ds)
@@ -29,36 +82,106 @@ def _create_dataset(db_session: Session, *, provider: str = "vendor", **kwargs:
     return ds
 
 
+def _create_dataset_document(
+    db_session: Session,
+    *,
+    name: str = "guide.md",
+    data_source_type: str = DataSourceType.UPLOAD_FILE,
+    doc_type: str | None = None,
+    doc_metadata: dict[str, object] | None = None,
+) -> DatasetDocument:
+    tenant_id = str(uuid4())
+    created_by = str(uuid4())
+    dataset = Dataset(
+        tenant_id=tenant_id,
+        name=f"dataset-{uuid4()}",
+        data_source_type=DataSourceType.UPLOAD_FILE,
+        created_by=created_by,
+    )
+    db_session.add(dataset)
+    db_session.flush()
+
+    document = DatasetDocument(
+        tenant_id=tenant_id,
+        dataset_id=dataset.id,
+        position=1,
+        data_source_type=data_source_type,
+        batch=f"batch-{uuid4()}",
+        name=name,
+        created_from=DocumentCreatedFrom.WEB,
+        created_by=created_by,
+        doc_type=doc_type,
+        doc_metadata=doc_metadata,
+    )
+    db_session.add(document)
+    db_session.commit()
+    db_session.refresh(document)
+    return document
+
+
+def _build_segment(
+    *,
+    document_id: str,
+    tenant_id: str | None = None,
+    dataset_id: str | None = None,
+    created_by: str | None = None,
+) -> DocumentSegment:
+    return DocumentSegment(
+        tenant_id=tenant_id or str(uuid4()),
+        dataset_id=dataset_id or str(uuid4()),
+        document_id=document_id,
+        created_by=created_by or str(uuid4()),
+        position=1,
+        content="segment content",
+        word_count=2,
+        tokens=2,
+        status=SegmentStatus.COMPLETED,
+    )
+
+
+def _create_segment(db_session: Session, *, document: DatasetDocument | None = None) -> DocumentSegment:
+    segment = _build_segment(
+        tenant_id=document.tenant_id if document else None,
+        dataset_id=document.dataset_id if document else None,
+        document_id=document.id if document else str(uuid4()),
+        created_by=document.created_by if document else None,
+    )
+    db_session.add(segment)
+    db_session.commit()
+    db_session.refresh(segment)
+    return segment
+
+
 class TestHitTestingService:
     # ── Utility methods (pure logic, no DB) ────────────────────────────
 
-    def test_escape_query_for_search_should_escape_double_quotes(self):
+    def test_escape_query_for_search_should_escape_double_quotes(self) -> None:
         query = 'test "query" with quotes'
         result = HitTestingService.escape_query_for_search(query)
         assert result == 'test \\"query\\" with quotes'
 
-    def test_hit_testing_args_check_should_pass_with_valid_query(self):
+    def test_hit_testing_args_check_should_pass_with_valid_query(self) -> None:
         HitTestingService.hit_testing_args_check({"query": "valid query"})
 
-    def test_hit_testing_args_check_should_pass_with_valid_attachments(self):
+    def test_hit_testing_args_check_should_pass_with_valid_attachments(self) -> None:
         HitTestingService.hit_testing_args_check({"attachment_ids": ["id1", "id2"]})
 
-    def test_hit_testing_args_check_should_raise_error_when_no_query_or_attachments(self):
+    def test_hit_testing_args_check_should_raise_error_when_no_query_or_attachments(self) -> None:
         with pytest.raises(ValueError, match="Query or attachment_ids is required"):
             HitTestingService.hit_testing_args_check({})
 
-    def test_hit_testing_args_check_should_raise_error_when_query_too_long(self):
+    def test_hit_testing_args_check_should_raise_error_when_query_too_long(self) -> None:
         with pytest.raises(ValueError, match="Query cannot exceed 250 characters"):
             HitTestingService.hit_testing_args_check({"query": "a" * 251})
 
-    def test_hit_testing_args_check_should_raise_error_when_attachments_not_list(self):
+    def test_hit_testing_args_check_should_raise_error_when_attachments_not_list(self) -> None:
         with pytest.raises(ValueError, match="Attachment_ids must be a list"):
             HitTestingService.hit_testing_args_check({"attachment_ids": "not a list"})
 
     # ── Response formatting ────────────────────────────────────────────
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.format_retrieval_documents")
-    def test_compact_retrieve_response_should_format_correctly(self, mock_format):
+    def test_compact_retrieve_response_should_format_correctly(self, mock_format: MagicMock) -> None:
         query = "test query"
         mock_doc = MagicMock(spec=Document)
 
@@ -66,50 +189,49 @@ class TestHitTestingService:
         mock_record.model_dump.return_value = {"content": "formatted content"}
         mock_format.return_value = [mock_record]
 
-        result = cast(dict[str, Any], HitTestingService.compact_retrieve_response(query, [mock_doc]))
+        response = _RetrieveResponse.model_validate(HitTestingService.compact_retrieve_response(query, [mock_doc]))
 
-        assert cast(dict[str, Any], result["query"])["content"] == query
-        assert len(result["records"]) == 1
-        assert cast(dict[str, Any], result["records"][0])["content"] == "formatted content"
+        assert response.query.content == query
+        assert len(response.records) == 1
+        assert response.records[0].content == "formatted content"
         mock_format.assert_called_once_with([mock_doc])
 
     def test_compact_external_retrieve_response_should_return_records_for_external_provider(
         self, db_session_with_containers: Session
-    ):
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers, provider="external")
         documents = [
             {"content": "c1", "title": "t1", "score": 0.9, "metadata": {"m1": "v1"}},
             {"content": "c2", "title": "t2", "score": 0.8, "metadata": {"m2": "v2"}},
         ]
 
-        result = cast(
-            dict[str, Any], HitTestingService.compact_external_retrieve_response(dataset, "test query", documents)
+        response = _RetrieveResponse.model_validate(
+            HitTestingService.compact_external_retrieve_response(dataset, "test query", documents)
         )
 
-        assert cast(dict[str, Any], result["query"])["content"] == "test query"
-        assert len(result["records"]) == 2
-        assert cast(dict[str, Any], result["records"][0])["content"] == "c1"
-        assert cast(dict[str, Any], result["records"][1])["title"] == "t2"
+        assert response.query.content == "test query"
+        assert len(response.records) == 2
+        assert response.records[0].content == "c1"
+        assert response.records[1].title == "t2"
 
     def test_compact_external_retrieve_response_should_return_empty_for_non_external_provider(
         self, db_session_with_containers: Session
-    ):
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers, provider="vendor")
 
-        result = cast(
-            dict[str, Any],
-            HitTestingService.compact_external_retrieve_response(dataset, "test query", [{"content": "c1"}]),
+        response = _RetrieveResponse.model_validate(
+            HitTestingService.compact_external_retrieve_response(dataset, "test query", [{"content": "c1"}])
         )
 
-        assert cast(dict[str, Any], result["query"])["content"] == "test query"
-        assert result["records"] == []
+        assert response.query.content == "test query"
+        assert response.records == []
 
     # ── External retrieve (real DB) ────────────────────────────────────
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.external_retrieve")
     def test_external_retrieve_should_succeed_for_external_provider(
-        self, mock_ext_retrieve, db_session_with_containers: Session
-    ):
+        self, mock_ext_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers, provider="external")
         account_id = str(uuid4())
         account = MagicMock()
@@ -118,19 +240,18 @@ class TestHitTestingService:
 
         before_count = db_session_with_containers.scalar(select(func.count()).select_from(DatasetQuery)) or 0
 
-        result = cast(
-            dict[str, Any],
+        response = _RetrieveResponse.model_validate(
             HitTestingService.external_retrieve(
                 dataset=dataset,
                 query='test "query"',
                 account=account,
                 external_retrieval_model={"model": "test"},
                 metadata_filtering_conditions={"key": "val"},
-            ),
+            )
         )
 
-        assert cast(dict[str, Any], result["query"])["content"] == 'test "query"'
-        assert cast(dict[str, Any], result["records"][0])["content"] == "ext content"
+        assert response.query.content == 'test "query"'
+        assert response.records[0].content == "ext content"
         mock_ext_retrieve.assert_called_once_with(
             dataset_id=dataset.id,
             query='test \\"query\\"',
@@ -142,37 +263,44 @@ class TestHitTestingService:
         after_count = db_session_with_containers.scalar(select(func.count()).select_from(DatasetQuery)) or 0
         assert after_count == before_count + 1
 
-    def test_external_retrieve_should_return_empty_for_non_external_provider(self, db_session_with_containers: Session):
+    def test_external_retrieve_should_return_empty_for_non_external_provider(
+        self, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers, provider="vendor")
         account = MagicMock()
 
-        result = cast(dict[str, Any], HitTestingService.external_retrieve(dataset, "test query", account))
+        response = _RetrieveResponse.model_validate(HitTestingService.external_retrieve(dataset, "test query", account))
 
-        assert cast(dict[str, Any], result["query"])["content"] == "test query"
-        assert result["records"] == []
+        assert response.query.content == "test query"
+        assert response.records == []
 
     # ── Retrieve (real DB) ─────────────────────────────────────────────
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
     def test_retrieve_should_use_default_model_when_none_provided(
-        self, mock_retrieve, db_session_with_containers: Session
-    ):
+        self, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         dataset.retrieval_model = None
         account = MagicMock()
         account.id = str(uuid4())
-        mock_retrieve.return_value = []
+        retrieved_documents: list[Document] = []
+        mock_retrieve.return_value = retrieved_documents
+        external_retrieval_model: dict[str, object] = {}
 
         before_count = db_session_with_containers.scalar(select(func.count()).select_from(DatasetQuery)) or 0
 
-        result = cast(
-            dict[str, Any],
+        response = _RetrieveResponse.model_validate(
             HitTestingService.retrieve(
-                dataset=dataset, query="test query", account=account, retrieval_model=None, external_retrieval_model={}
-            ),
+                dataset=dataset,
+                query="test query",
+                account=account,
+                retrieval_model=None,
+                external_retrieval_model=external_retrieval_model,
+            )
         )
 
-        assert cast(dict[str, Any], result["query"])["content"] == "test query"
+        assert response.query.content == "test query"
         mock_retrieve.assert_called_once()
         assert mock_retrieve.call_args.kwargs["top_k"] == 4
 
@@ -183,11 +311,12 @@ class TestHitTestingService:
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
     @patch("core.rag.retrieval.dataset_retrieval.DatasetRetrieval.get_metadata_filter_condition")
     def test_retrieve_should_handle_metadata_filtering(
-        self, mock_get_meta, mock_retrieve, db_session_with_containers: Session
-    ):
+        self, mock_get_meta: MagicMock, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         account = MagicMock()
         account.id = str(uuid4())
+        external_retrieval_model: dict[str, object] = {}
 
         retrieval_model = {
             "search_method": "semantic_search",
@@ -197,14 +326,15 @@ class TestHitTestingService:
             "score_threshold_enabled": False,
         }
         mock_get_meta.return_value = ({dataset.id: ["doc_id1"]}, "condition_string")
-        mock_retrieve.return_value = []
+        retrieved_documents: list[Document] = []
+        mock_retrieve.return_value = retrieved_documents
 
         HitTestingService.retrieve(
             dataset=dataset,
             query="test query",
             account=account,
             retrieval_model=retrieval_model,
-            external_retrieval_model={},
+            external_retrieval_model=external_retrieval_model,
         )
 
         mock_get_meta.assert_called_once()
@@ -214,10 +344,11 @@ class TestHitTestingService:
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
     @patch("core.rag.retrieval.dataset_retrieval.DatasetRetrieval.get_metadata_filter_condition")
     def test_retrieve_should_return_empty_if_metadata_filtering_fails(
-        self, mock_get_meta, mock_retrieve, db_session_with_containers: Session
-    ):
+        self, mock_get_meta: MagicMock, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         account = MagicMock()
+        external_retrieval_model: dict[str, object] = {}
 
         retrieval_model = {
             "search_method": "semantic_search",
@@ -226,28 +357,31 @@ class TestHitTestingService:
             "reranking_enable": False,
             "score_threshold_enabled": False,
         }
-        mock_get_meta.return_value = ({}, "condition_string")
+        empty_document_ids: dict[str, list[str]] = {}
+        mock_get_meta.return_value = (empty_document_ids, "condition_string")
 
-        result = cast(
-            dict[str, Any],
+        response = _RetrieveResponse.model_validate(
             HitTestingService.retrieve(
                 dataset=dataset,
                 query="test query",
                 account=account,
                 retrieval_model=retrieval_model,
-                external_retrieval_model={},
-            ),
+                external_retrieval_model=external_retrieval_model,
+            )
         )
 
-        assert result["records"] == []
+        assert response.records == []
         mock_retrieve.assert_not_called()
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
-    def test_retrieve_should_handle_attachments(self, mock_retrieve, db_session_with_containers: Session):
+    def test_retrieve_should_handle_attachments(
+        self, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         account = MagicMock()
         account.id = str(uuid4())
         attachment_ids = ["att1", "att2"]
+        external_retrieval_model: dict[str, object] = {}
 
         retrieval_model = {
             "search_method": "semantic_search",
@@ -255,19 +389,20 @@ class TestHitTestingService:
             "reranking_enable": False,
             "score_threshold_enabled": False,
         }
-        mock_retrieve.return_value = []
+        retrieved_documents: list[Document] = []
+        mock_retrieve.return_value = retrieved_documents
 
         HitTestingService.retrieve(
             dataset=dataset,
             query="test query",
             account=account,
             retrieval_model=retrieval_model,
-            external_retrieval_model={},
+            external_retrieval_model=external_retrieval_model,
             attachment_ids=attachment_ids,
         )
 
         mock_retrieve.assert_called_once_with(
-            retrieval_method=ANY,
+            retrieval_method=RetrievalMethod.SEMANTIC_SEARCH,
             dataset_id=dataset.id,
             query="test query",
             attachment_ids=attachment_ids,
@@ -295,10 +430,13 @@ class TestHitTestingService:
         assert query_content[1]["content"] == "att1"
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
-    def test_retrieve_should_handle_reranking_and_threshold(self, mock_retrieve, db_session_with_containers: Session):
+    def test_retrieve_should_handle_reranking_and_threshold(
+        self, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         account = MagicMock()
         account.id = str(uuid4())
+        external_retrieval_model: dict[str, object] = {}
 
         retrieval_model = {
             "search_method": "hybrid_search",
@@ -310,14 +448,15 @@ class TestHitTestingService:
             "score_threshold": 0.5,
             "weights": {"vector": 0.5, "keyword": 0.5},
         }
-        mock_retrieve.return_value = []
+        retrieved_documents: list[Document] = []
+        mock_retrieve.return_value = retrieved_documents
 
         HitTestingService.retrieve(
             dataset=dataset,
             query="test query",
             account=account,
             retrieval_model=retrieval_model,
-            external_retrieval_model={},
+            external_retrieval_model=external_retrieval_model,
         )
 
         mock_retrieve.assert_called_once()
@@ -326,3 +465,57 @@ class TestHitTestingService:
         assert kwargs["reranking_model"] == {"provider": "test"}
         assert kwargs["reranking_mode"] == "weighted_sum"
         assert kwargs["weights"] == {"vector": 0.5, "keyword": 0.5}
+
+    def test_dump_dataset_document_returns_frontend_required_fields(self, db_session_with_containers: Session) -> None:
+        document = _create_dataset_document(db_session_with_containers, doc_metadata={"source": "manual"})
+
+        assert HitTestingService._dump_dataset_document(document) == {
+            "id": document.id,
+            "data_source_type": "upload_file",
+            "name": "guide.md",
+            "doc_type": None,
+            "doc_metadata": {"source": "manual"},
+        }
+
+    def test_dump_retrieval_records_returns_dumped_records_without_document_ids(self) -> None:
+        segment = _build_segment(document_id="")
+        record = RetrievalSegments.model_validate({"segment": segment, "score": 0.95})
+
+        records = _DUMPED_RETRIEVAL_RECORDS.validate_python(HitTestingService._dump_retrieval_records([record]))
+
+        assert len(records) == 1
+        assert records[0].segment.id == segment.id
+        assert records[0].segment.document_id == ""
+        assert records[0].score == 0.95
+
+    def test_dump_retrieval_records_injects_documents(self, db_session_with_containers: Session) -> None:
+        document = _create_dataset_document(db_session_with_containers)
+        segment = _create_segment(db_session_with_containers, document=document)
+        record = RetrievalSegments.model_validate({"segment": segment, "score": 0.9})
+
+        records = _DUMPED_RETRIEVAL_RECORDS.validate_python(HitTestingService._dump_retrieval_records([record]))
+
+        assert len(records) == 1
+        dumped_segment = records[0].segment
+        assert dumped_segment.id == segment.id
+        assert dumped_segment.document_id == document.id
+        assert dumped_segment.created_at == segment.created_at
+        assert dumped_segment.document == _DumpedDocumentResponse(
+            id=document.id,
+            data_source_type="upload_file",
+            name="guide.md",
+            doc_type=None,
+            doc_metadata=None,
+        )
+        assert records[0].score == 0.9
+
+    def test_dump_retrieval_records_skips_records_with_missing_documents(
+        self, db_session_with_containers: Session, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        segment = _create_segment(db_session_with_containers)
+        record = RetrievalSegments.model_validate({"segment": segment, "score": 0.95})
+
+        result = HitTestingService._dump_retrieval_records([record])
+
+        assert result == []
+        assert "Skipping hit-testing records with missing documents" in caplog.text
diff --git a/api/tests/test_containers_integration_tests/services/test_saved_message_service.py b/api/tests/test_containers_integration_tests/services/test_saved_message_service.py
index 7368ad42493..ad85ac67bc5 100644
--- a/api/tests/test_containers_integration_tests/services/test_saved_message_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_saved_message_service.py
@@ -5,7 +5,7 @@ from faker import Faker
 from sqlalchemy.orm import Session
 
 from models import App, CreatorUserRole
-from models.enums import ConversationFromSource
+from models.enums import ConversationFromSource, EndUserType
 from models.model import EndUser, Message
 from models.web import SavedMessage
 from services.app_service import AppService, CreateAppParams
@@ -107,7 +107,7 @@ class TestSavedMessageService:
             app_id=app.id,
             external_user_id=fake.uuid4(),
             name=fake.name(),
-            type="normal",
+            type=EndUserType.BROWSER,
             session_id=fake.uuid4(),
             is_anonymous=False,
         )
@@ -220,7 +220,9 @@ class TestSavedMessageService:
         mock_external_service_dependencies["message_service"].pagination_by_last_id.return_value = mock_pagination
 
         # Act: Execute the method under test
-        result = SavedMessageService.pagination_by_last_id(app_model=app, user=account, last_id=None, limit=10)
+        result = SavedMessageService.pagination_by_last_id(
+            db_session_with_containers, app_model=app, user=account, last_id=None, limit=10
+        )
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -294,7 +296,7 @@ class TestSavedMessageService:
 
         # Act: Execute the method under test
         result = SavedMessageService.pagination_by_last_id(
-            app_model=app, user=end_user, last_id="test_last_id", limit=5
+            db_session_with_containers, app_model=app, user=end_user, last_id="test_last_id", limit=5
         )
 
         # Assert: Verify the expected outcomes
@@ -344,7 +346,7 @@ class TestSavedMessageService:
         mock_external_service_dependencies["message_service"].get_message.return_value = message
 
         # Act: Execute the method under test
-        SavedMessageService.save(app_model=app, user=account, message_id=message.id)
+        SavedMessageService.save(db_session_with_containers, app_model=app, user=account, message_id=message.id)
 
         # Assert: Verify the expected outcomes
         # Check if saved message was created in database
@@ -393,7 +395,9 @@ class TestSavedMessageService:
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(ValueError) as exc_info:
-            SavedMessageService.pagination_by_last_id(app_model=app, user=None, last_id=None, limit=10)
+            SavedMessageService.pagination_by_last_id(
+                db_session_with_containers, app_model=app, user=None, last_id=None, limit=10
+            )
 
         assert "User is required" in str(exc_info.value)
 
@@ -412,7 +416,7 @@ class TestSavedMessageService:
         message = self._create_test_message(db_session_with_containers, app, account)
 
         # Act: Execute the method under test with None user
-        result = SavedMessageService.save(app_model=app, user=None, message_id=message.id)
+        result = SavedMessageService.save(db_session_with_containers, app_model=app, user=None, message_id=message.id)
 
         # Assert: Verify the expected outcomes
         assert result is None
@@ -471,7 +475,7 @@ class TestSavedMessageService:
         )
 
         # Act: Execute the method under test
-        SavedMessageService.delete(app_model=app, user=account, message_id=message.id)
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=account, message_id=message.id)
 
         # Assert: Verify the expected outcomes
         # Check if saved message was deleted from database
@@ -501,7 +505,7 @@ class TestSavedMessageService:
 
         mock_external_service_dependencies["message_service"].get_message.return_value = message
 
-        SavedMessageService.save(app_model=app, user=end_user, message_id=message.id)
+        SavedMessageService.save(db_session_with_containers, app_model=app, user=end_user, message_id=message.id)
 
         saved = (
             db_session_with_containers.query(SavedMessage)
@@ -522,9 +526,9 @@ class TestSavedMessageService:
         mock_external_service_dependencies["message_service"].get_message.return_value = message
 
         # Save once
-        SavedMessageService.save(app_model=app, user=account, message_id=message.id)
+        SavedMessageService.save(db_session_with_containers, app_model=app, user=account, message_id=message.id)
         # Save again
-        SavedMessageService.save(app_model=app, user=account, message_id=message.id)
+        SavedMessageService.save(db_session_with_containers, app_model=app, user=account, message_id=message.id)
 
         count = (
             db_session_with_containers.query(SavedMessage)
@@ -547,7 +551,7 @@ class TestSavedMessageService:
         db_session_with_containers.add(saved)
         db_session_with_containers.commit()
 
-        SavedMessageService.delete(app_model=app, user=None, message_id=message.id)
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=None, message_id=message.id)
 
         # Should still exist
         assert (
@@ -566,7 +570,7 @@ class TestSavedMessageService:
         # Should not raise — use a valid UUID that doesn't exist in DB
         from uuid import uuid4
 
-        SavedMessageService.delete(app_model=app, user=account, message_id=str(uuid4()))
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=account, message_id=str(uuid4()))
 
     def test_delete_for_end_user(self, db_session_with_containers: Session, mock_external_service_dependencies):
         """Test deleting a saved message for an EndUser."""
@@ -580,7 +584,7 @@ class TestSavedMessageService:
         db_session_with_containers.add(saved)
         db_session_with_containers.commit()
 
-        SavedMessageService.delete(app_model=app, user=end_user, message_id=message.id)
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=end_user, message_id=message.id)
 
         assert (
             db_session_with_containers.query(SavedMessage)
@@ -610,7 +614,7 @@ class TestSavedMessageService:
         db_session_with_containers.commit()
 
         # Delete only account1's saved message
-        SavedMessageService.delete(app_model=app, user=account1, message_id=message.id)
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=account1, message_id=message.id)
 
         # Account's saved message should be gone
         assert (
diff --git a/api/tests/test_containers_integration_tests/services/test_tag_service.py b/api/tests/test_containers_integration_tests/services/test_tag_service.py
index 517d5d2ed4c..197415ee6bd 100644
--- a/api/tests/test_containers_integration_tests/services/test_tag_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_tag_service.py
@@ -449,7 +449,7 @@ class TestTagService:
 
         # Act: Execute the method under test
         tag_ids = [tag.id for tag in tags]
-        result = TagService.get_target_ids_by_tag_ids("knowledge", tenant.id, tag_ids)
+        result = TagService.get_target_ids_by_tag_ids("knowledge", tenant.id, tag_ids, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -485,7 +485,7 @@ class TestTagService:
         )
 
         # Act: Execute the method under test with empty tag IDs
-        result = TagService.get_target_ids_by_tag_ids("knowledge", tenant.id, [])
+        result = TagService.get_target_ids_by_tag_ids("knowledge", tenant.id, [], db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -533,13 +533,19 @@ class TestTagService:
 
         # Act: Execute the method under test
         tag_ids = [tag.id for tag in tags]
-        result = TagService.get_target_ids_by_tag_ids("knowledge", tenant.id, tag_ids, match_all=True)
+        result = TagService.get_target_ids_by_tag_ids(
+            "knowledge", tenant.id, tag_ids, db_session_with_containers, match_all=True
+        )
 
         # Assert: Verify the expected outcomes
         assert result == [dataset_with_all_tags.id]
 
         missing_tag_result = TagService.get_target_ids_by_tag_ids(
-            "knowledge", tenant.id, [tags[0].id, str(uuid.uuid4())], match_all=True
+            "knowledge",
+            tenant.id,
+            [tags[0].id, str(uuid.uuid4())],
+            db_session_with_containers,
+            match_all=True,
         )
         assert missing_tag_result == []
 
@@ -565,7 +571,9 @@ class TestTagService:
         non_existent_tag_ids = [str(uuid.uuid4()), str(uuid.uuid4())]
 
         # Act: Execute the method under test
-        result = TagService.get_target_ids_by_tag_ids("knowledge", tenant.id, non_existent_tag_ids)
+        result = TagService.get_target_ids_by_tag_ids(
+            "knowledge", tenant.id, non_existent_tag_ids, db_session_with_containers
+        )
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -599,7 +607,7 @@ class TestTagService:
         db_session_with_containers.commit()
 
         # Act: Execute the method under test
-        result = TagService.get_tag_by_tag_name("app", tenant.id, "python_tag")
+        result = TagService.get_tag_by_tag_name("app", tenant.id, "python_tag", db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -625,7 +633,7 @@ class TestTagService:
         )
 
         # Act: Execute the method under test with non-existent tag name
-        result = TagService.get_tag_by_tag_name("knowledge", tenant.id, "nonexistent_tag")
+        result = TagService.get_tag_by_tag_name("knowledge", tenant.id, "nonexistent_tag", db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -650,8 +658,8 @@ class TestTagService:
         )
 
         # Act: Execute the method under test with empty parameters
-        result_empty_type = TagService.get_tag_by_tag_name("", tenant.id, "test_tag")
-        result_empty_name = TagService.get_tag_by_tag_name("knowledge", tenant.id, "")
+        result_empty_type = TagService.get_tag_by_tag_name("", tenant.id, "test_tag", db_session_with_containers)
+        result_empty_name = TagService.get_tag_by_tag_name("knowledge", tenant.id, "", db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result_empty_type is not None
@@ -688,7 +696,7 @@ class TestTagService:
         )
 
         # Act: Execute the method under test
-        result = TagService.get_tags_by_target_id("app", tenant.id, app.id)
+        result = TagService.get_tags_by_target_id("app", tenant.id, app.id, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -720,7 +728,7 @@ class TestTagService:
         app = self._create_test_app(db_session_with_containers, mock_external_service_dependencies, tenant.id)
 
         # Act: Execute the method under test
-        result = TagService.get_tags_by_target_id("app", tenant.id, app.id)
+        result = TagService.get_tags_by_target_id("app", tenant.id, app.id, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -745,7 +753,7 @@ class TestTagService:
         tag_args = SaveTagPayload(name="test_tag_name", type="knowledge")
 
         # Act: Execute the method under test
-        result = TagService.save_tags(tag_args)
+        result = TagService.save_tags(tag_args, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -783,11 +791,11 @@ class TestTagService:
 
         # Create first tag
         tag_args = SaveTagPayload(name="duplicate_tag", type="app")
-        TagService.save_tags(tag_args)
+        TagService.save_tags(tag_args, db_session_with_containers)
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(ValueError) as exc_info:
-            TagService.save_tags(tag_args)
+            TagService.save_tags(tag_args, db_session_with_containers)
         assert "Tag name already exists" in str(exc_info.value)
 
     def test_update_tags_success(self, db_session_with_containers: Session, mock_external_service_dependencies):
@@ -807,13 +815,13 @@ class TestTagService:
 
         # Create a tag to update
         tag_args = SaveTagPayload(name="original_name", type="knowledge")
-        tag = TagService.save_tags(tag_args)
+        tag = TagService.save_tags(tag_args, db_session_with_containers)
 
         # Update args
         update_args = UpdateTagPayload(name="updated_name")
 
         # Act: Execute the method under test
-        result = TagService.update_tags(update_args, tag.id)
+        result = TagService.update_tags(update_args, tag.id, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -854,7 +862,7 @@ class TestTagService:
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(NotFound) as exc_info:
-            TagService.update_tags(update_args, non_existent_tag_id)
+            TagService.update_tags(update_args, non_existent_tag_id, db_session_with_containers)
         assert "Tag not found" in str(exc_info.value)
 
     def test_update_tags_duplicate_name_error(
@@ -875,17 +883,17 @@ class TestTagService:
 
         # Create two tags
         tag1_args = SaveTagPayload(name="first_tag", type="app")
-        tag1 = TagService.save_tags(tag1_args)
+        tag1 = TagService.save_tags(tag1_args, db_session_with_containers)
 
         tag2_args = SaveTagPayload(name="second_tag", type="app")
-        tag2 = TagService.save_tags(tag2_args)
+        tag2 = TagService.save_tags(tag2_args, db_session_with_containers)
 
         # Try to update second tag with first tag's name
         update_args = UpdateTagPayload(name="first_tag")
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(ValueError) as exc_info:
-            TagService.update_tags(update_args, tag2.id)
+            TagService.update_tags(update_args, tag2.id, db_session_with_containers)
         assert "Tag name already exists" in str(exc_info.value)
 
     def test_get_tag_binding_count_success(
@@ -917,8 +925,8 @@ class TestTagService:
         )
 
         # Act: Execute the method under test
-        result_tag_with_bindings = TagService.get_tag_binding_count(tags[0].id)
-        result_tag_without_bindings = TagService.get_tag_binding_count(tags[1].id)
+        result_tag_with_bindings = TagService.get_tag_binding_count(tags[0].id, db_session_with_containers)
+        result_tag_without_bindings = TagService.get_tag_binding_count(tags[1].id, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result_tag_with_bindings == 1
@@ -946,7 +954,7 @@ class TestTagService:
         non_existent_tag_id = str(uuid.uuid4())
 
         # Act: Execute the method under test
-        result = TagService.get_tag_binding_count(non_existent_tag_id)
+        result = TagService.get_tag_binding_count(non_existent_tag_id, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         assert result == 0
@@ -986,7 +994,7 @@ class TestTagService:
         assert binding_before is not None
 
         # Act: Execute the method under test
-        TagService.delete_tag(tag.id)
+        TagService.delete_tag(tag.id, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         # Verify tag was deleted
@@ -1018,7 +1026,7 @@ class TestTagService:
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(NotFound) as exc_info:
-            TagService.delete_tag(non_existent_tag_id)
+            TagService.delete_tag(non_existent_tag_id, db_session_with_containers)
         assert "Tag not found" in str(exc_info.value)
 
     def test_save_tag_binding_success(self, db_session_with_containers: Session, mock_external_service_dependencies):
@@ -1048,7 +1056,7 @@ class TestTagService:
         binding_payload = TagBindingCreatePayload(
             type="knowledge", target_id=dataset.id, tag_ids=[tag.id for tag in tags]
         )
-        TagService.save_tag_binding(binding_payload)
+        TagService.save_tag_binding(binding_payload, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
 
@@ -1090,10 +1098,10 @@ class TestTagService:
 
         # Create first binding
         binding_payload = TagBindingCreatePayload(type="app", target_id=app.id, tag_ids=[tag.id])
-        TagService.save_tag_binding(binding_payload)
+        TagService.save_tag_binding(binding_payload, db_session_with_containers)
 
         # Act: Try to create duplicate binding
-        TagService.save_tag_binding(binding_payload)
+        TagService.save_tag_binding(binding_payload, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
 
@@ -1173,7 +1181,7 @@ class TestTagService:
         delete_payload = TagBindingDeletePayload(
             type="knowledge", target_id=dataset.id, tag_ids=[tag.id for tag in tags]
         )
-        TagService.delete_tag_binding(delete_payload)
+        TagService.delete_tag_binding(delete_payload, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         # Verify tag bindings were deleted
@@ -1209,7 +1217,7 @@ class TestTagService:
 
         # Act: Try to delete non-existent binding
         delete_payload = TagBindingDeletePayload(type="app", target_id=app.id, tag_ids=[tag.id])
-        TagService.delete_tag_binding(delete_payload)
+        TagService.delete_tag_binding(delete_payload, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         # No error should be raised, and database state should remain unchanged
@@ -1240,7 +1248,7 @@ class TestTagService:
         dataset = self._create_test_dataset(db_session_with_containers, mock_external_service_dependencies, tenant.id)
 
         # Act: Execute the method under test
-        TagService.check_target_exists("knowledge", dataset.id)
+        TagService.check_target_exists("knowledge", dataset.id, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         # No exception should be raised for existing dataset
@@ -1268,7 +1276,7 @@ class TestTagService:
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(NotFound) as exc_info:
-            TagService.check_target_exists("knowledge", non_existent_dataset_id)
+            TagService.check_target_exists("knowledge", non_existent_dataset_id, db_session_with_containers)
         assert "Dataset not found" in str(exc_info.value)
 
     def test_check_target_exists_app_success(
@@ -1292,7 +1300,7 @@ class TestTagService:
         app = self._create_test_app(db_session_with_containers, mock_external_service_dependencies, tenant.id)
 
         # Act: Execute the method under test
-        TagService.check_target_exists("app", app.id)
+        TagService.check_target_exists("app", app.id, db_session_with_containers)
 
         # Assert: Verify the expected outcomes
         # No exception should be raised for existing app
@@ -1320,7 +1328,7 @@ class TestTagService:
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(NotFound) as exc_info:
-            TagService.check_target_exists("app", non_existent_app_id)
+            TagService.check_target_exists("app", non_existent_app_id, db_session_with_containers)
         assert "App not found" in str(exc_info.value)
 
     def test_check_target_exists_invalid_type(
@@ -1346,5 +1354,5 @@ class TestTagService:
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(NotFound) as exc_info:
-            TagService.check_target_exists("invalid_type", non_existent_target_id)
+            TagService.check_target_exists("invalid_type", non_existent_target_id, db_session_with_containers)
         assert "Invalid binding type" in str(exc_info.value)
diff --git a/api/tests/test_containers_integration_tests/services/test_web_conversation_service.py b/api/tests/test_containers_integration_tests/services/test_web_conversation_service.py
index 8e53a2d6cd7..8651636616c 100644
--- a/api/tests/test_containers_integration_tests/services/test_web_conversation_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_web_conversation_service.py
@@ -7,7 +7,7 @@ from sqlalchemy.orm import Session
 
 from core.app.entities.app_invoke_entities import InvokeFrom
 from models import Account, App
-from models.enums import ConversationFromSource
+from models.enums import ConversationFromSource, EndUserType
 from models.model import Conversation, EndUser
 from models.web import PinnedConversation
 from services.account_service import AccountService, TenantService
@@ -109,7 +109,7 @@ class TestWebConversationService:
         end_user = EndUser(
             session_id=fake.uuid4(),
             app_id=app.id,
-            type="normal",
+            type=EndUserType.BROWSER,
             is_anonymous=False,
             tenant_id=app.tenant_id,
         )
diff --git a/api/tests/test_containers_integration_tests/services/test_workflow_app_service.py b/api/tests/test_containers_integration_tests/services/test_workflow_app_service.py
index 07a49130d06..fbbf255c581 100644
--- a/api/tests/test_containers_integration_tests/services/test_workflow_app_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_workflow_app_service.py
@@ -12,7 +12,7 @@ from sqlalchemy.orm import Session
 
 from graphon.enums import WorkflowExecutionStatus
 from models import EndUser, Workflow, WorkflowAppLog, WorkflowArchiveLog, WorkflowRun
-from models.enums import AppTriggerType, CreatorUserRole, WorkflowRunTriggeredFrom
+from models.enums import AppTriggerType, CreatorUserRole, EndUserType, WorkflowRunTriggeredFrom
 from models.workflow import WorkflowAppLogCreatedFrom
 from services.account_service import AccountService, TenantService
 
@@ -821,7 +821,7 @@ class TestWorkflowAppService:
             id=str(uuid.uuid4()),
             tenant_id=app.tenant_id,
             app_id=app.id,
-            type="web",
+            type=EndUserType.BROWSER,
             is_anonymous=False,
             session_id="test_session_123",
             created_at=datetime.now(UTC),
@@ -1567,7 +1567,7 @@ class TestWorkflowAppService:
         end_user = EndUser(
             tenant_id=app.tenant_id,
             app_id=app.id,
-            type="browser",
+            type=EndUserType.BROWSER,
             is_anonymous=False,
             session_id="session-1",
         )
diff --git a/api/tests/test_containers_integration_tests/services/test_workflow_run_service.py b/api/tests/test_containers_integration_tests/services/test_workflow_run_service.py
index 09fe1570bcf..e065e5df1c3 100644
--- a/api/tests/test_containers_integration_tests/services/test_workflow_run_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_workflow_run_service.py
@@ -7,7 +7,7 @@ import pytest
 from faker import Faker
 from sqlalchemy.orm import Session
 
-from models.enums import ConversationFromSource, CreatorUserRole
+from models.enums import ConversationFromSource, CreatorUserRole, EndUserType
 from models.model import (
     Message,
 )
@@ -684,7 +684,7 @@ class TestWorkflowRunService:
         end_user = EndUser(
             tenant_id=app.tenant_id,
             app_id=app.id,
-            type="web_app",
+            type=EndUserType.BROWSER,
             is_anonymous=False,
             session_id=str(uuid.uuid4()),
             external_user_id=str(uuid.uuid4()),
diff --git a/api/tests/test_containers_integration_tests/tasks/test_remove_app_and_related_data_task.py b/api/tests/test_containers_integration_tests/tasks/test_remove_app_and_related_data_task.py
index 204f5339785..3e9a7859030 100644
--- a/api/tests/test_containers_integration_tests/tasks/test_remove_app_and_related_data_task.py
+++ b/api/tests/test_containers_integration_tests/tasks/test_remove_app_and_related_data_task.py
@@ -1,5 +1,6 @@
+import logging
 import uuid
-from unittest.mock import ANY, call, patch
+from unittest.mock import call, patch
 
 import pytest
 from sqlalchemy import delete, func, select
@@ -146,9 +147,8 @@ class TestDeleteDraftVariablesBatch:
         assert db_session_with_containers.scalar(select(func.count()).select_from(WorkflowDraftVariable)) == 0
 
     @patch("tasks.remove_app_and_related_data_task._delete_draft_variable_offload_data")
-    @patch("tasks.remove_app_and_related_data_task.logger")
     def test_delete_draft_variables_batch_logs_progress(
-        self, mock_logger, mock_offload_cleanup, db_session_with_containers
+        self, mock_offload_cleanup, db_session_with_containers, caplog: pytest.LogCaptureFixture
     ):
         """Test that batch deletion logs progress correctly."""
         tenant, app = _create_tenant_and_app(db_session_with_containers)
@@ -163,14 +163,15 @@ class TestDeleteDraftVariablesBatch:
 
         mock_offload_cleanup.return_value = len(file_id_by_index)
 
-        result = delete_draft_variables_batch(app.id, 50)
+        with caplog.at_level(logging.INFO, logger="tasks.remove_app_and_related_data_task"):
+            result = delete_draft_variables_batch(app.id, 50)
 
         assert result == 30
         mock_offload_cleanup.assert_called_once()
         _, called_file_ids = mock_offload_cleanup.call_args.args
         assert {str(file_id) for file_id in called_file_ids} == {str(file_id) for file_id in file_id_by_index.values()}
-        assert mock_logger.info.call_count == 2
-        mock_logger.info.assert_any_call(ANY)
+        info_records = [record for record in caplog.records if record.levelno == logging.INFO]
+        assert len(info_records) == 2
 
 
 class TestDeleteDraftVariableOffloadData:
@@ -204,9 +205,8 @@ class TestDeleteDraftVariableOffloadData:
         assert remaining_upload_files_count == 0
 
     @patch("extensions.ext_storage.storage")
-    @patch("tasks.remove_app_and_related_data_task.logging")
     def test_delete_draft_variable_offload_data_storage_failure(
-        self, mock_logging, mock_storage, db_session_with_containers
+        self, mock_storage, db_session_with_containers, caplog: pytest.LogCaptureFixture
     ):
         """Test handling of storage deletion failures."""
         tenant, app = _create_tenant_and_app(db_session_with_containers)
@@ -217,11 +217,12 @@ class TestDeleteDraftVariableOffloadData:
 
         mock_storage.delete.side_effect = [Exception("Storage error"), None]
 
-        with session_factory.create_session() as session, session.begin():
-            result = _delete_draft_variable_offload_data(session, file_ids)
+        with caplog.at_level(logging.ERROR):
+            with session_factory.create_session() as session, session.begin():
+                result = _delete_draft_variable_offload_data(session, file_ids)
 
         assert result == 1
-        mock_logging.exception.assert_called_once_with("Failed to delete storage object %s", storage_keys[0])
+        assert f"Failed to delete storage object {storage_keys[0]}" in caplog.text
 
         remaining_var_files_count = db_session_with_containers.scalar(
             select(func.count())
diff --git a/api/tests/unit_tests/clients/agent_backend/test_request_builder.py b/api/tests/unit_tests/clients/agent_backend/test_request_builder.py
index 0fa4d3261bc..c0b308a5cb5 100644
--- a/api/tests/unit_tests/clients/agent_backend/test_request_builder.py
+++ b/api/tests/unit_tests/clients/agent_backend/test_request_builder.py
@@ -15,6 +15,7 @@ from dify_agent.layers.dify_plugin import (
     DifyPluginToolsLayerConfig,
 )
 from dify_agent.layers.execution_context import DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID, DifyExecutionContextLayerConfig
+from dify_agent.layers.knowledge import DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID, DifyKnowledgeBaseLayerConfig
 from dify_agent.layers.output import DIFY_OUTPUT_LAYER_TYPE_ID
 from dify_agent.layers.shell import DIFY_SHELL_LAYER_TYPE_ID, DifyShellEnvVarConfig, DifyShellLayerConfig
 from dify_agent.protocol import (
@@ -28,6 +29,7 @@ from pydantic import ValidationError
 from clients.agent_backend import (
     AGENT_SOUL_PROMPT_LAYER_ID,
     DIFY_EXECUTION_CONTEXT_LAYER_ID,
+    DIFY_KNOWLEDGE_BASE_LAYER_ID,
     DIFY_PLUGIN_TOOLS_LAYER_ID,
     WORKFLOW_NODE_JOB_PROMPT_LAYER_ID,
     WORKFLOW_USER_PROMPT_LAYER_ID,
@@ -155,6 +157,25 @@ def test_request_builder_adds_dify_plugin_tools_layer_when_configured():
     assert tools_config.tools[0].tool_name == "current_time"
 
 
+def test_request_builder_adds_knowledge_layer_when_configured():
+    run_input = _run_input()
+    run_input.knowledge = DifyKnowledgeBaseLayerConfig.model_validate(
+        {
+            "dataset_ids": ["dataset-1"],
+            "retrieval": {"mode": "multiple", "top_k": 4},
+        }
+    )
+
+    request = AgentBackendRunRequestBuilder().build_for_workflow_node(run_input)
+    layers = {layer.name: layer for layer in request.composition.layers}
+
+    assert DIFY_KNOWLEDGE_BASE_LAYER_ID in layers
+    assert layers[DIFY_KNOWLEDGE_BASE_LAYER_ID].type == DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID
+    assert layers[DIFY_KNOWLEDGE_BASE_LAYER_ID].deps == {"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID}
+    knowledge_config = cast(DifyKnowledgeBaseLayerConfig, layers[DIFY_KNOWLEDGE_BASE_LAYER_ID].config)
+    assert knowledge_config.dataset_ids == ["dataset-1"]
+
+
 def test_request_builder_can_delete_on_exit_for_cleanup_paths():
     run_input = _run_input()
     run_input.suspend_on_exit = False
@@ -329,6 +350,25 @@ def test_agent_app_request_builder_adds_shell_layer_when_include_shell():
     assert shell_config.env[0].name == "APP_ENV"
 
 
+def test_agent_app_request_builder_adds_knowledge_layer_when_configured():
+    run_input = _agent_app_input()
+    run_input.knowledge = DifyKnowledgeBaseLayerConfig.model_validate(
+        {
+            "dataset_ids": ["dataset-1", "dataset-2"],
+            "retrieval": {"mode": "multiple", "top_k": 2},
+        }
+    )
+
+    request = AgentBackendRunRequestBuilder().build_for_agent_app(run_input)
+    layers = {layer.name: layer for layer in request.composition.layers}
+
+    assert DIFY_KNOWLEDGE_BASE_LAYER_ID in layers
+    assert layers[DIFY_KNOWLEDGE_BASE_LAYER_ID].type == DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID
+    assert layers[DIFY_KNOWLEDGE_BASE_LAYER_ID].deps == {"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID}
+    knowledge_config = cast(DifyKnowledgeBaseLayerConfig, layers[DIFY_KNOWLEDGE_BASE_LAYER_ID].config)
+    assert knowledge_config.dataset_ids == ["dataset-1", "dataset-2"]
+
+
 # ── ENG-635 / ENG-638: ask_human layer injection + deferred_tool_results ─────
 
 
diff --git a/api/tests/unit_tests/commands/test_generate_swagger_markdown_docs.py b/api/tests/unit_tests/commands/test_generate_swagger_markdown_docs.py
index 8444af741fb..e989d54a965 100644
--- a/api/tests/unit_tests/commands/test_generate_swagger_markdown_docs.py
+++ b/api/tests/unit_tests/commands/test_generate_swagger_markdown_docs.py
@@ -5,6 +5,8 @@ import json
 import sys
 from pathlib import Path
 
+import pytest
+
 
 def _load_generate_swagger_markdown_docs_module():
     api_dir = Path(__file__).resolve().parents[3]
@@ -20,7 +22,9 @@ def _load_generate_swagger_markdown_docs_module():
     return module
 
 
-def test_generate_markdown_docs_keeps_split_docs_and_merges_fastopenapi_into_console(tmp_path, monkeypatch):
+def test_generate_markdown_docs_keeps_split_docs_and_merges_fastopenapi_into_console(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
     module = _load_generate_swagger_markdown_docs_module()
     openapi_dir = tmp_path / "openapi"
     markdown_dir = tmp_path / "markdown"
@@ -69,7 +73,9 @@ def test_generate_markdown_docs_keeps_split_docs_and_merges_fastopenapi_into_con
     assert "FastOpenAPI Preview" not in (markdown_dir / "service-openapi.md").read_text(encoding="utf-8")
 
 
-def test_generate_markdown_docs_only_removes_generated_specs_from_separate_swagger_dir(tmp_path, monkeypatch):
+def test_generate_markdown_docs_only_removes_generated_specs_from_separate_swagger_dir(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
     module = _load_generate_swagger_markdown_docs_module()
     swagger_dir = tmp_path / "swagger"
     markdown_dir = tmp_path / "markdown"
@@ -105,7 +111,7 @@ def test_generate_markdown_docs_only_removes_generated_specs_from_separate_swagg
     assert not list(swagger_dir.glob("*.json"))
 
 
-def test_patch_union_schema_markdown_fills_converter_blank_schema_types(tmp_path):
+def test_patch_union_schema_markdown_fills_converter_blank_schema_types(tmp_path: Path):
     module = _load_generate_swagger_markdown_docs_module()
     spec_path = tmp_path / "console-openapi.json"
     spec_path.write_text(
@@ -239,7 +245,7 @@ def test_patch_union_schema_markdown_ignores_specs_without_schemas(tmp_path):
     assert module._patch_union_schema_markdown("unchanged", spec_path) == "unchanged"
 
 
-def test_patch_union_schema_markdown_ignores_unrenderable_shapes(tmp_path):
+def test_patch_union_schema_markdown_ignores_unrenderable_shapes(tmp_path: Path):
     module = _load_generate_swagger_markdown_docs_module()
     spec_path = tmp_path / "console-openapi.json"
     spec_path.write_text(
@@ -266,6 +272,7 @@ def test_patch_union_schema_markdown_ignores_unrenderable_shapes(tmp_path):
     assert module._schema_ref_name(None) is None
     assert module._schema_markdown_type(None) == ""
     assert module._schema_markdown_type({"anyOf": [{"type": "null"}]}) == ""
+    assert module._strip_trailing_line_whitespace("line  \ncell\t \n") == "line\ncell\n"
     assert module._replace_schema_table_type("unchanged", "Definition", "field", "") == "unchanged"
     assert (
         module._replace_schema_table_type(
@@ -284,7 +291,7 @@ def test_patch_union_schema_markdown_ignores_unrenderable_shapes(tmp_path):
     assert module._patch_union_schema_markdown("#### BrokenUnion\n", spec_path) == "#### BrokenUnion\n"
 
 
-def test_convert_spec_to_markdown_patches_generated_union_tables(tmp_path, monkeypatch):
+def test_convert_spec_to_markdown_patches_generated_union_tables(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
     module = _load_generate_swagger_markdown_docs_module()
     spec_path = tmp_path / "console-openapi.json"
     output_path = tmp_path / "console-openapi.md"
@@ -319,7 +326,10 @@ def test_convert_spec_to_markdown_patches_generated_union_tables(tmp_path, monke
         assert kwargs["check"] is False
         markdown_path = Path(args[args.index("-o") + 1])
         markdown_path.write_text(
-            """#### FormInputConfig
+            "Intro line"
+            + "  \n"
+            + """
+#### FormInputConfig
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
@@ -340,5 +350,7 @@ def test_convert_spec_to_markdown_patches_generated_union_tables(tmp_path, monke
     module._convert_spec_to_markdown(spec_path, output_path)
 
     converted = output_path.read_text(encoding="utf-8")
+    assert "Intro line  \n" not in converted
+    assert "Intro line\n" in converted
     assert "| FormInputConfig | [ParagraphInputConfig](#paragraphinputconfig) |  |  |" in converted
     assert "| default | [StringSource](#stringsource) |  | No |" in converted
diff --git a/api/tests/unit_tests/commands/test_generate_swagger_specs.py b/api/tests/unit_tests/commands/test_generate_swagger_specs.py
index 03af7643f3c..c30386c9d65 100644
--- a/api/tests/unit_tests/commands/test_generate_swagger_specs.py
+++ b/api/tests/unit_tests/commands/test_generate_swagger_specs.py
@@ -8,12 +8,13 @@ from pathlib import Path
 
 def _walk_values(value):
     yield value
-    if isinstance(value, dict):
-        for child in value.values():
-            yield from _walk_values(child)
-    elif isinstance(value, list):
-        for child in value:
-            yield from _walk_values(child)
+    match value:
+        case dict():
+            for child in value.values():
+                yield from _walk_values(child)
+        case list():
+            for child in value:
+                yield from _walk_values(child)
 
 
 def _load_generate_swagger_specs_module():
@@ -106,6 +107,39 @@ def test_generate_specs_writes_get_operations_without_request_bodies(tmp_path):
         assert all("requestBody" not in operation for operation in _get_operations(payload))
 
 
+def test_generate_specs_writes_service_api_reference_descriptions(tmp_path):
+    module = _load_generate_swagger_specs_module()
+
+    written_paths = module.generate_specs(tmp_path)
+    service_path = next(path for path in written_paths if path.name == "service-openapi.json")
+    payload = json.loads(service_path.read_text(encoding="utf-8"))
+
+    chat_operation = payload["paths"]["/chat-messages"]["post"]
+    assert chat_operation["summary"] == "Send Chat Message"
+    assert chat_operation["description"] == "Send a request to the chat application."
+    assert chat_operation["tags"] == ["Chatflows", "Chats"]
+
+    rename_operation = payload["paths"]["/conversations/{c_id}/name"]["post"]
+    assert rename_operation["summary"] == "Rename Conversation"
+
+
+def test_standalone_inline_model_name_includes_list_constraints():
+    module = _load_generate_swagger_specs_module()
+
+    from flask_restx import fields
+
+    cases = (
+        ({"min_items": 1}, {"min_items": 2}),
+        ({"max_items": 1}, {"max_items": 2}),
+        ({"unique": True}, {"unique": False}),
+    )
+    for first_kwargs, second_kwargs in cases:
+        first_inline_model = {"items": fields.List(fields.String, **first_kwargs)}
+        second_inline_model = {"items": fields.List(fields.String, **second_kwargs)}
+
+        assert module._inline_model_name(first_inline_model) != module._inline_model_name(second_inline_model)
+
+
 def test_generate_specs_is_idempotent(tmp_path):
     module = _load_generate_swagger_specs_module()
 
diff --git a/api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py b/api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py
index d9bc08920bb..8b77772a36d 100644
--- a/api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py
+++ b/api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py
@@ -1,4 +1,4 @@
-from inspect import unwrap
+from inspect import getsource, unwrap
 from types import SimpleNamespace
 from typing import Any, cast
 
@@ -21,10 +21,15 @@ from controllers.console.agent.composer import (
 )
 from controllers.console.agent.roster import (
     AgentAppApi,
+    AgentAppCopyApi,
     AgentAppListApi,
     AgentInviteOptionsApi,
+    AgentLogMessagesApi,
+    AgentLogsApi,
+    AgentLogSourcesApi,
     AgentRosterVersionDetailApi,
     AgentRosterVersionsApi,
+    AgentStatisticsSummaryApi,
 )
 from controllers.console.app import completion as completion_controller
 from controllers.console.app import message as message_controller
@@ -90,6 +95,7 @@ def _agent_app_composer_response() -> dict:
 def _app_detail_obj(**overrides):
     data = {
         "id": "app-1",
+        "tenant_id": "tenant-1",
         "name": "Iris",
         "description": "Agent app",
         "mode_compatible_with_agent": "agent",
@@ -113,7 +119,6 @@ def _app_detail_obj(**overrides):
         "deleted_tools": [],
         "site": None,
         "bound_agent_id": "00000000-0000-0000-0000-000000000001",
-        "tenant_id": "tenant-1",
     }
     data.update(overrides)
     return SimpleNamespace(**data)
@@ -138,6 +143,7 @@ def test_agent_v2_console_routes_are_agent_id_first() -> None:
         "/agent/<uuid:agent_id>/composer/validate",
         "/agent/<uuid:agent_id>/composer/candidates",
         "/agent/<uuid:agent_id>/features",
+        "/agent/<uuid:agent_id>/copy",
         "/agent/<uuid:agent_id>/referencing-workflows",
         "/agent/<uuid:agent_id>/drive/files",
         "/agent/<uuid:agent_id>/sandbox/files",
@@ -148,6 +154,10 @@ def test_agent_v2_console_routes_are_agent_id_first() -> None:
         "/agent/<uuid:agent_id>/feedbacks",
         "/agent/<uuid:agent_id>/chat-messages/<uuid:message_id>/suggested-questions",
         "/agent/<uuid:agent_id>/messages/<uuid:message_id>",
+        "/agent/<uuid:agent_id>/logs",
+        "/agent/<uuid:agent_id>/logs/<uuid:conversation_id>/messages",
+        "/agent/<uuid:agent_id>/log-sources",
+        "/agent/<uuid:agent_id>/statistics/summary",
         "/agent/invite-options",
     ):
         assert route in paths
@@ -167,6 +177,11 @@ def test_agent_v2_console_routes_are_agent_id_first() -> None:
         assert route not in paths
 
 
+def test_agent_app_write_routes_do_not_reuse_app_billing_quota() -> None:
+    for route_class in (AgentAppListApi, AgentAppCopyApi):
+        assert '@cloud_edition_billing_resource_check("apps")' not in getsource(route_class)
+
+
 @pytest.fixture
 def account_id() -> str:
     return "account-1"
@@ -181,7 +196,7 @@ def test_agent_app_list_and_create_use_agent_route(
         def get_app(self, app_obj: object) -> object:
             return app_obj
 
-        def get_paginate_apps(self, user_id: str, tenant_id: str, params) -> object:
+        def get_paginate_apps(self, user_id: str, tenant_id: str, params, session) -> object:
             captured["list"] = {"user_id": user_id, "tenant_id": tenant_id, "params": params}
             return SimpleNamespace(
                 page=1,
@@ -199,12 +214,36 @@ def test_agent_app_list_and_create_use_agent_route(
     monkeypatch.setattr(
         roster_controller.AgentRosterService,
         "load_app_backing_agents_by_app_id",
-        lambda _self, **kwargs: {"app-list": SimpleNamespace(id="agent-list", role="List role")},
+        lambda _self, **kwargs: {
+            "app-list": SimpleNamespace(id="agent-list", role="List role", active_config_snapshot_id=None)
+        },
     )
     monkeypatch.setattr(
         roster_controller.AgentRosterService,
         "get_app_backing_agent",
-        lambda _self, **kwargs: SimpleNamespace(id="agent-created", role="Created role"),
+        lambda _self, **kwargs: SimpleNamespace(
+            id="agent-created", role="Created role", active_config_snapshot_id=None
+        ),
+    )
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService,
+        "load_published_references_by_agent_id",
+        lambda _self, **kwargs: {
+            "agent-list": [
+                {
+                    "app_id": "workflow-app-id",
+                    "app_name": "RFP Review Flow",
+                    "app_icon_type": "emoji",
+                    "app_icon": "A",
+                    "app_icon_background": "#fff",
+                    "app_mode": "workflow",
+                    "app_updated_at": 1781660000,
+                    "workflow_id": "workflow-1",
+                    "workflow_version": "v1",
+                    "node_ids": ["node-1", "node-2"],
+                }
+            ]
+        },
     )
     monkeypatch.setattr(
         roster_controller.FeatureService,
@@ -221,6 +260,17 @@ def test_agent_app_list_and_create_use_agent_route(
     assert listed["data"][0]["id"] == "agent-list"
     assert listed["data"][0]["app_id"] == "app-list"
     assert listed["data"][0]["role"] == "List role"
+    assert listed["data"][0]["active_config_is_published"] is False
+    assert listed["data"][0]["published_reference_count"] == 1
+    assert listed["data"][0]["published_references"] == [
+        {
+            "app_id": "workflow-app-id",
+            "app_name": "RFP Review Flow",
+            "app_icon_type": "emoji",
+            "app_icon": "A",
+            "app_icon_background": "#fff",
+        }
+    ]
     assert "bound_agent_id" not in listed["data"][0]
     list_call = cast(dict[str, object], captured["list"])
     list_params = cast(Any, list_call["params"])
@@ -229,7 +279,13 @@ def test_agent_app_list_and_create_use_agent_route(
 
     with app.test_request_context(
         "/console/api/agent",
-        json={"name": "Iris", "description": "Agent app", "icon_type": "emoji", "icon": "robot"},
+        json={
+            "name": "Iris",
+            "description": "Agent app",
+            "role": "Coordinator",
+            "icon_type": "emoji",
+            "icon": "robot",
+        },
     ):
         created, status = unwrap(AgentAppListApi.post)(AgentAppListApi(), "tenant-1", SimpleNamespace(id=account_id))
 
@@ -237,10 +293,28 @@ def test_agent_app_list_and_create_use_agent_route(
     assert created["id"] == "agent-created"
     assert created["app_id"] == "app-created"
     assert created["role"] == "Created role"
+    assert created["active_config_is_published"] is False
     assert "bound_agent_id" not in created
     create_call = cast(dict[str, object], captured["create"])
     create_params = cast(Any, create_call["params"])
     assert create_params.mode == "agent"
+    assert create_params.agent_role == "Coordinator"
+
+
+def test_agent_app_create_requires_role(app: Flask, account_id: str) -> None:
+    with app.test_request_context(
+        "/console/api/agent",
+        json={"name": "Iris", "description": "Agent app", "icon_type": "emoji", "icon": "robot"},
+    ):
+        with pytest.raises(ValueError, match="Field required"):
+            unwrap(AgentAppListApi.post)(AgentAppListApi(), "tenant-1", SimpleNamespace(id=account_id))
+
+    with app.test_request_context(
+        "/console/api/agent",
+        json={"name": "Iris", "description": "Agent app", "role": "   ", "icon_type": "emoji", "icon": "robot"},
+    ):
+        with pytest.raises(ValueError, match="Agent role is required"):
+            unwrap(AgentAppListApi.post)(AgentAppListApi(), "tenant-1", SimpleNamespace(id=account_id))
 
 
 def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
@@ -258,7 +332,7 @@ def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
     monkeypatch.setattr(
         roster_controller.AgentRosterService,
         "get_app_backing_agent",
-        lambda _self, **kwargs: SimpleNamespace(id=agent_id, role="Resolved role"),
+        lambda _self, **kwargs: SimpleNamespace(id=agent_id, role="Resolved role", active_config_snapshot_id=None),
     )
     monkeypatch.setattr(
         roster_controller.FeatureService,
@@ -284,11 +358,12 @@ def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
     assert detail["id"] == agent_id
     assert detail["app_id"] == "app-1"
     assert detail["role"] == "Resolved role"
+    assert detail["active_config_is_published"] is False
     assert "bound_agent_id" not in detail
 
     with app.test_request_context(
         "/console/api/agent/00000000-0000-0000-0000-000000000001",
-        json={"name": "Renamed", "description": "", "icon_type": "emoji", "icon": "R"},
+        json={"name": "Renamed", "description": "", "role": "Reviewer", "icon_type": "emoji", "icon": "R"},
     ):
         updated = unwrap(AgentAppApi.put)(AgentAppApi(), "tenant-1", agent_id)
 
@@ -296,15 +371,102 @@ def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
     assert updated["id"] == agent_id
     assert updated["app_id"] == "app-1"
     assert updated["role"] == "Resolved role"
+    assert updated["active_config_is_published"] is False
     assert "bound_agent_id" not in updated
     update_call = cast(dict[str, object], captured["update"])
     assert update_call["app"] is app_model
+    assert cast(dict[str, object], update_call["args"])["role"] == "Reviewer"
 
     deleted, status = unwrap(AgentAppApi.delete)(AgentAppApi(), "tenant-1", agent_id)
     assert (deleted, status) == ("", 204)
     assert captured["delete"] is app_model
 
 
+def test_agent_app_copy_uses_agent_id_and_returns_agent_detail(
+    app: Flask, monkeypatch: pytest.MonkeyPatch, account_id: str
+) -> None:
+    agent_id = "00000000-0000-0000-0000-000000000001"
+    current_user = SimpleNamespace(id=account_id)
+    copied_app = _app_detail_obj(id="copied-app", bound_agent_id="copied-agent")
+    captured: dict[str, object] = {}
+
+    class FakeRosterService:
+        def duplicate_agent_app(self, **kwargs: object) -> object:
+            captured.update(kwargs)
+            return copied_app
+
+    monkeypatch.setattr(roster_controller, "_agent_roster_service", lambda: FakeRosterService())
+    monkeypatch.setattr(
+        roster_controller,
+        "_serialize_agent_app_detail",
+        lambda app_model: {"id": "copied-agent", "app_id": app_model.id, "name": app_model.name},
+    )
+
+    with app.test_request_context(
+        "/console/api/agent/00000000-0000-0000-0000-000000000001/copy",
+        json={
+            "name": "Iris copy",
+            "description": "Copied",
+            "icon_type": "emoji",
+            "icon": "sparkles",
+            "icon_background": "#fff",
+        },
+    ):
+        copied, status = unwrap(AgentAppCopyApi.post)(AgentAppCopyApi(), "tenant-1", current_user, agent_id)
+
+    assert status == 201
+    assert copied == {"id": "copied-agent", "app_id": "copied-app", "name": "Iris"}
+    assert captured == {
+        "tenant_id": "tenant-1",
+        "agent_id": agent_id,
+        "account": current_user,
+        "name": "Iris copy",
+        "description": "Copied",
+        "icon_type": "emoji",
+        "icon": "sparkles",
+        "icon_background": "#fff",
+    }
+
+
+def test_agent_app_update_rejects_empty_role(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
+    agent_id = "00000000-0000-0000-0000-000000000001"
+    app_model = _app_detail_obj(id="app-1", bound_agent_id=agent_id)
+    captured: dict[str, object] = {}
+
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService,
+        "get_agent_app_model",
+        lambda _self, **kwargs: app_model,
+    )
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService,
+        "get_app_backing_agent",
+        lambda _self, **kwargs: SimpleNamespace(id=agent_id, role="", active_config_snapshot_id=None),
+    )
+    monkeypatch.setattr(
+        roster_controller.FeatureService,
+        "get_system_features",
+        lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False)),
+    )
+
+    class FakeAppService:
+        def get_app(self, app_obj: object) -> object:
+            return app_obj
+
+        def update_app(self, app_obj: object, args: dict[str, object]) -> object:
+            captured["update"] = {"app": app_obj, "args": args}
+            return _app_detail_obj(id="app-1", name=args["name"], bound_agent_id=agent_id)
+
+    monkeypatch.setattr(roster_controller, "AppService", FakeAppService)
+
+    with app.test_request_context(
+        "/console/api/agent/00000000-0000-0000-0000-000000000001",
+        json={"name": "Renamed", "description": "", "role": "", "icon_type": "emoji", "icon": "R"},
+    ):
+        with pytest.raises(ValueError, match="String should have at least 1 character"):
+            unwrap(AgentAppApi.put)(AgentAppApi(), "tenant-1", agent_id)
+
+
 def test_invite_options_get_parses_app_id(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     captured: dict[str, object] = {}
 
@@ -363,6 +525,200 @@ def test_agent_versions_call_services(app: Flask, monkeypatch: pytest.MonkeyPatc
     assert version_detail["agent_id"] == agent_id
 
 
+def test_agent_observability_routes_resolve_app_from_agent_id(
+    app: Flask, monkeypatch: pytest.MonkeyPatch, account_id: str
+) -> None:
+    agent_id = "00000000-0000-0000-0000-000000000001"
+    app_model = SimpleNamespace(id="app-1")
+    captured: dict[str, object] = {}
+
+    class FakeObservabilityService:
+        def list_logs(self, *, app, agent_id, params):
+            captured["logs"] = {"app": app, "agent_id": agent_id, "params": params}
+            return {
+                "data": [
+                    {
+                        "conversation_id": "conversation-1",
+                        "id": "conversation-1",
+                        "title": "Debug",
+                        "end_user_id": "end-user-1",
+                        "message_count": 2,
+                        "user_rate": None,
+                        "operation_rate": None,
+                        "unread": True,
+                        "source": {
+                            "id": "webapp:app-1",
+                            "type": "webapp",
+                            "app_id": "app-1",
+                            "app_name": "Iris",
+                            "app_icon_type": "emoji",
+                            "app_icon": "robot",
+                            "app_icon_background": "#fff",
+                            "workflow_id": None,
+                            "workflow_version": None,
+                            "node_id": None,
+                        },
+                        "status": "success",
+                        "created_at": 1,
+                        "updated_at": 2,
+                    }
+                ],
+                "page": 2,
+                "limit": 5,
+                "total": 6,
+                "has_more": False,
+            }
+
+        def list_log_messages(self, *, app, agent_id, conversation_id, params):
+            captured["messages"] = {
+                "app": app,
+                "agent_id": agent_id,
+                "conversation_id": conversation_id,
+                "params": params,
+            }
+            return {
+                "data": [
+                    {
+                        "id": "message-1",
+                        "message_id": "message-1",
+                        "conversation_id": "conversation-1",
+                        "query": "hello",
+                        "answer": "hi",
+                        "status": "success",
+                        "error": None,
+                        "from_end_user_id": None,
+                        "from_account_id": account_id,
+                        "message_tokens": 1,
+                        "answer_tokens": 2,
+                        "total_tokens": 3,
+                        "total_price": "0",
+                        "currency": "USD",
+                        "latency": 1.2,
+                        "created_at": 1,
+                        "updated_at": 2,
+                    }
+                ],
+                "page": 1,
+                "limit": 20,
+                "total": 1,
+                "has_more": False,
+            }
+
+        def list_log_sources(self, *, app, agent_id):
+            captured["sources"] = {"app": app, "agent_id": agent_id}
+            return {
+                "data": [
+                    {
+                        "id": "webapp:app-1",
+                        "type": "webapp",
+                        "app_id": "app-1",
+                        "app_name": "Iris",
+                        "app_icon_type": "emoji",
+                        "app_icon": "robot",
+                        "app_icon_background": "#fff",
+                        "workflow_id": None,
+                        "workflow_version": None,
+                        "node_id": None,
+                    }
+                ],
+                "groups": [{"type": "webapp", "label": "WEBAPP", "sources": []}],
+            }
+
+        def get_statistics_summary(self, *, app, agent_id, params):
+            captured["statistics"] = {"app": app, "agent_id": agent_id, "params": params}
+            return {
+                "source": "all",
+                "summary": {
+                    "total_messages": 1,
+                    "total_conversations": 1,
+                    "total_end_users": 1,
+                    "total_tokens": 3,
+                    "total_price": "0",
+                    "currency": "USD",
+                    "average_session_interactions": 1,
+                    "average_response_time": 1200,
+                    "tokens_per_second": 2,
+                    "user_satisfaction_rate": 100,
+                },
+                "charts": {
+                    "daily_messages": [{"date": "2026-06-17", "message_count": 1}],
+                    "daily_conversations": [{"date": "2026-06-17", "conversation_count": 1}],
+                    "daily_end_users": [{"date": "2026-06-17", "terminal_count": 1}],
+                    "token_usage": [{"date": "2026-06-17", "token_count": 3, "total_price": "0", "currency": "USD"}],
+                    "average_session_interactions": [{"date": "2026-06-17", "interactions": 1}],
+                    "average_response_time": [{"date": "2026-06-17", "latency": 1200}],
+                    "tokens_per_second": [{"date": "2026-06-17", "tps": 2}],
+                    "user_satisfaction_rate": [{"date": "2026-06-17", "rate": 100}],
+                },
+            }
+
+    monkeypatch.setattr(roster_controller, "_resolve_agent_app_model", lambda **kwargs: app_model)
+    monkeypatch.setattr(roster_controller, "_agent_observability_service", lambda: FakeObservabilityService())
+
+    account = SimpleNamespace(id=account_id, timezone="UTC")
+    with app.test_request_context(
+        "/console/api/agent/00000000-0000-0000-0000-000000000001/logs"
+        "?page=2&limit=5&keyword=hello&statuses[]=success&statuses[]=failed&sources[]=webapp:app-1"
+        "&sources[]=workflow:app-2:workflow-1:v1:node-1&sort_by=created_at&sort_order=asc"
+    ):
+        logs = unwrap(AgentLogsApi.get)(AgentLogsApi(), "tenant-1", account, agent_id)
+
+    assert logs["data"][0]["id"] == "conversation-1"
+    assert logs["data"][0]["source"]["id"] == "webapp:app-1"
+    logs_call = cast(dict[str, object], captured["logs"])
+    assert logs_call["app"] is app_model
+    assert logs_call["agent_id"] == agent_id
+    logs_params = cast(Any, logs_call["params"])
+    assert logs_params.page == 2
+    assert logs_params.limit == 5
+    assert logs_params.keyword == "hello"
+    assert logs_params.statuses == ("success", "failed")
+    assert logs_params.sources == ("webapp:app-1", "workflow:app-2:workflow-1:v1:node-1")
+    assert logs_params.sort_by == "created_at"
+    assert logs_params.sort_order == "asc"
+
+    with app.test_request_context(
+        "/console/api/agent/00000000-0000-0000-0000-000000000001/logs/00000000-0000-0000-0000-000000000002/messages"
+    ):
+        messages = unwrap(AgentLogMessagesApi.get)(
+            AgentLogMessagesApi(),
+            "tenant-1",
+            account,
+            agent_id,
+            "00000000-0000-0000-0000-000000000002",
+        )
+
+    assert messages["data"][0]["id"] == "message-1"
+    messages_call = cast(dict[str, object], captured["messages"])
+    assert messages_call["app"] is app_model
+    assert messages_call["agent_id"] == agent_id
+    assert messages_call["conversation_id"] == "00000000-0000-0000-0000-000000000002"
+    messages_params = cast(Any, messages_call["params"])
+    assert messages_params.sources == ()
+    assert messages_params.statuses == ()
+
+    with app.test_request_context("/console/api/agent/00000000-0000-0000-0000-000000000001/log-sources"):
+        sources = unwrap(AgentLogSourcesApi.get)(AgentLogSourcesApi(), "tenant-1", account, agent_id)
+
+    assert sources["data"][0]["id"] == "webapp:app-1"
+    sources_call = cast(dict[str, object], captured["sources"])
+    assert sources_call["app"] is app_model
+    assert sources_call["agent_id"] == agent_id
+
+    with app.test_request_context(
+        "/console/api/agent/00000000-0000-0000-0000-000000000001/statistics/summary?source=api"
+    ):
+        statistics = unwrap(AgentStatisticsSummaryApi.get)(AgentStatisticsSummaryApi(), "tenant-1", account, agent_id)
+
+    assert statistics["summary"]["total_messages"] == 1
+    stats_call = cast(dict[str, object], captured["statistics"])
+    assert stats_call["app"] is app_model
+    assert stats_call["agent_id"] == agent_id
+    stats_params = cast(Any, stats_call["params"])
+    assert stats_params.source == "api"
+    assert stats_params.timezone == "UTC"
+
+
 def test_workflow_composer_get_put_validate_candidates_impact_and_save(
     app: Flask, monkeypatch: pytest.MonkeyPatch, account_id: str
 ) -> None:
diff --git a/api/tests/unit_tests/controllers/console/app/test_agent_skills.py b/api/tests/unit_tests/controllers/console/app/test_agent_skills.py
index bcb4aeab462..e94536aa012 100644
--- a/api/tests/unit_tests/controllers/console/app/test_agent_skills.py
+++ b/api/tests/unit_tests/controllers/console/app/test_agent_skills.py
@@ -10,7 +10,7 @@ from __future__ import annotations
 import inspect
 import io
 from types import SimpleNamespace
-from unittest.mock import MagicMock, patch
+from unittest.mock import patch
 
 from flask import Flask
 
@@ -18,8 +18,6 @@ from controllers.console.app.agent import (
     AgentDriveFilesByAgentApi,
     AgentSkillByAgentApi,
     AgentSkillInferToolsByAgentApi,
-    AgentSkillStandardizeApi,
-    AgentSkillStandardizeByAgentApi,
     AgentSkillUploadApi,
     AgentSkillUploadByAgentApi,
 )
@@ -45,47 +43,39 @@ _APP = SimpleNamespace(id="app-1", tenant_id="tenant-1", mode=AppMode.AGENT, bou
 _WORKFLOW_APP = SimpleNamespace(id="app-1", tenant_id="tenant-1", mode=AppMode.WORKFLOW, bound_agent_id=None)
 
 
-def test_upload_validates_and_returns_skill_ref():
+def test_upload_standardizes_into_drive_and_returns_skill_ref():
     raw = _raw(AgentSkillUploadApi.post)
-    manifest = MagicMock()
-    manifest.to_skill_ref.return_value.model_dump.return_value = {"name": "S", "file_id": "uf-1"}
-    manifest.model_dump.return_value = {"name": "S"}
 
     with _file_ctx(files={"file": b"zip-bytes"}):
         with (
-            patch(f"{_MOD}.SkillPackageService") as pkg,
-            patch(f"{_MOD}.FileService") as fs,
-            patch(f"{_MOD}.db"),
+            patch(f"{_MOD}.SkillStandardizeService") as svc,
         ):
-            pkg.return_value.validate_and_extract.return_value = manifest
-            fs.return_value.upload_file.return_value = SimpleNamespace(id="uf-1")
+            svc.return_value.standardize.return_value = {
+                "skill": {"path": "skill-a", "skill_md_key": "skill-a/SKILL.md"},
+                "manifest": {"name": "Skill A"},
+            }
             body, status = raw(AgentSkillUploadApi(), _USER, _APP)
 
     assert status == 201
-    assert body["skill"] == {"name": "S", "file_id": "uf-1"}
-    manifest.to_skill_ref.assert_called_once_with(file_id="uf-1")
+    assert body["skill"] == {"path": "skill-a", "skill_md_key": "skill-a/SKILL.md"}
+    assert svc.return_value.standardize.call_args.kwargs["agent_id"] == "agent-1"
 
 
-def test_upload_by_agent_resolves_app_and_returns_skill_ref():
+def test_upload_by_agent_resolves_app_and_standardizes_into_drive():
     raw = _raw(AgentSkillUploadByAgentApi.post)
-    manifest = MagicMock()
-    manifest.to_skill_ref.return_value.model_dump.return_value = {"name": "S", "file_id": "uf-1"}
-    manifest.model_dump.return_value = {"name": "S"}
 
     with _file_ctx(files={"file": b"zip-bytes"}):
         with (
             patch(f"{_MOD}.resolve_agent_app_model", return_value=_APP) as resolve_app,
-            patch(f"{_MOD}.SkillPackageService") as pkg,
-            patch(f"{_MOD}.FileService") as fs,
-            patch(f"{_MOD}.db"),
+            patch(f"{_MOD}.SkillStandardizeService") as svc,
         ):
-            pkg.return_value.validate_and_extract.return_value = manifest
-            fs.return_value.upload_file.return_value = SimpleNamespace(id="uf-1")
+            svc.return_value.standardize.return_value = {"skill": {"path": "skill-a"}, "manifest": {}}
             body, status = raw(AgentSkillUploadByAgentApi(), "tenant-1", _USER, "agent-1")
 
     assert status == 201
-    assert body["skill"] == {"name": "S", "file_id": "uf-1"}
+    assert body["skill"] == {"path": "skill-a"}
     resolve_app.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
+    assert svc.return_value.standardize.call_args.kwargs["agent_id"] == "agent-1"
 
 
 def test_upload_no_file_is_400():
@@ -99,8 +89,8 @@ def test_upload_no_file_is_400():
 def test_upload_maps_package_error():
     raw = _raw(AgentSkillUploadApi.post)
     with _file_ctx(files={"file": b"bad"}):
-        with patch(f"{_MOD}.SkillPackageService") as pkg:
-            pkg.return_value.validate_and_extract.side_effect = SkillPackageError(
+        with patch(f"{_MOD}.SkillStandardizeService") as svc:
+            svc.return_value.standardize.side_effect = SkillPackageError(
                 "missing_skill_md", "no SKILL.md", status_code=400
             )
             body, status = raw(AgentSkillUploadApi(), _USER, _APP)
@@ -108,44 +98,17 @@ def test_upload_maps_package_error():
     assert body["code"] == "missing_skill_md"
 
 
-def test_standardize_returns_result():
-    raw = _raw(AgentSkillStandardizeApi.post)
-    with _file_ctx(files={"file": b"zip"}):
-        with patch(f"{_MOD}.SkillStandardizeService") as svc:
-            svc.return_value.standardize.return_value = {"skill": {"path": "s"}, "manifest": {}}
-            body, status = raw(AgentSkillStandardizeApi(), _USER, _APP)
-    assert status == 201
-    assert body["skill"] == {"path": "s"}
-    assert svc.return_value.standardize.call_args.kwargs["agent_id"] == "agent-1"
-
-
-def test_standardize_by_agent_resolves_app():
-    raw = _raw(AgentSkillStandardizeByAgentApi.post)
-    with _file_ctx(files={"file": b"zip"}):
-        with (
-            patch(f"{_MOD}.resolve_agent_app_model", return_value=_APP) as resolve_app,
-            patch(f"{_MOD}.SkillStandardizeService") as svc,
-        ):
-            svc.return_value.standardize.return_value = {"skill": {"path": "s"}, "manifest": {}}
-            body, status = raw(AgentSkillStandardizeByAgentApi(), "tenant-1", _USER, "agent-1")
-
-    assert status == 201
-    assert body["skill"] == {"path": "s"}
-    resolve_app.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
-    assert svc.return_value.standardize.call_args.kwargs["agent_id"] == "agent-1"
-
-
-def test_standardize_no_bound_agent_is_400():
-    raw = _raw(AgentSkillStandardizeApi.post)
+def test_upload_no_bound_agent_is_400():
+    raw = _raw(AgentSkillUploadApi.post)
     app_without_agent = SimpleNamespace(id="app-1", tenant_id="tenant-1", mode=AppMode.AGENT, bound_agent_id=None)
     with _file_ctx(files={"file": b"zip"}):
-        body, status = raw(AgentSkillStandardizeApi(), _USER, app_without_agent)
+        body, status = raw(AgentSkillUploadApi(), _USER, app_without_agent)
     assert status == 400
     assert body["code"] == "agent_not_bound"
 
 
-def test_standardize_resolves_workflow_node_agent():
-    raw = _raw(AgentSkillStandardizeApi.post)
+def test_upload_resolves_workflow_node_agent():
+    raw = _raw(AgentSkillUploadApi.post)
     with app.test_request_context(
         "/?node_id=agent-node-1", method="POST", data={"file": (io.BytesIO(b"zip"), "skill.zip")}
     ):
@@ -155,19 +118,19 @@ def test_standardize_resolves_workflow_node_agent():
         ):
             composer.resolve_workflow_node_agent_id.return_value = "wf-agent-1"
             svc.return_value.standardize.return_value = {"skill": {"path": "s"}, "manifest": {}}
-            body, status = raw(AgentSkillStandardizeApi(), _USER, _WORKFLOW_APP)
+            body, status = raw(AgentSkillUploadApi(), _USER, _WORKFLOW_APP)
 
     assert status == 201
     assert body["skill"] == {"path": "s"}
     assert svc.return_value.standardize.call_args.kwargs["agent_id"] == "wf-agent-1"
 
 
-def test_standardize_maps_drive_error():
-    raw = _raw(AgentSkillStandardizeApi.post)
+def test_upload_maps_drive_error():
+    raw = _raw(AgentSkillUploadApi.post)
     with _file_ctx(files={"file": b"zip"}):
         with patch(f"{_MOD}.SkillStandardizeService") as svc:
             svc.return_value.standardize.side_effect = AgentDriveError("source_not_found", "nope", status_code=404)
-            body, status = raw(AgentSkillStandardizeApi(), _USER, _APP)
+            body, status = raw(AgentSkillUploadApi(), _USER, _APP)
     assert status == 404
     assert body["code"] == "source_not_found"
 
diff --git a/api/tests/unit_tests/controllers/console/app/test_app_import_api.py b/api/tests/unit_tests/controllers/console/app/test_app_import_api.py
index 0cccb34b08d..08273a6e1f7 100644
--- a/api/tests/unit_tests/controllers/console/app/test_app_import_api.py
+++ b/api/tests/unit_tests/controllers/console/app/test_app_import_api.py
@@ -13,13 +13,28 @@ from controllers.console.app import app_import as app_import_module
 from services.app_dsl_service import ImportStatus
 
 
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
 class _Result:
-    def __init__(self, status: ImportStatus, app_id: str | None = "app-1"):
+    def __init__(
+        self,
+        status: ImportStatus,
+        app_id: str | None = "app-1",
+        permission_keys: list[str] | None = None,
+    ):
         self.status = status
         self.app_id = app_id
+        self.permission_keys = permission_keys or []
 
     def model_dump(self, mode: str = "json"):
-        return {"status": self.status, "app_id": self.app_id}
+        return {"status": self.status, "app_id": self.app_id, "permission_keys": self.permission_keys}
 
 
 def _install_features(monkeypatch: pytest.MonkeyPatch, enabled: bool) -> None:
@@ -107,6 +122,72 @@ class TestAppImportApi:
         assert status == 200
         assert response["status"] == ImportStatus.COMPLETED
 
+    def test_import_post_attaches_permission_keys_when_creating_new_app_and_rbac_enabled(
+        self, api, app: Flask, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        method = _unwrap(api.post)
+
+        _install_features(monkeypatch, enabled=False)
+        session = _mock_session(monkeypatch)
+        monkeypatch.setattr(
+            app_import_module,
+            "current_account_with_tenant",
+            lambda: (SimpleNamespace(id="u1"), "tenant-1"),
+        )
+        monkeypatch.setattr(app_import_module.dify_config, "RBAC_ENABLED", True)
+        monkeypatch.setattr(
+            app_import_module.AppDslService,
+            "import_app",
+            lambda *_args, **_kwargs: _Result(ImportStatus.COMPLETED, app_id="app-123"),
+        )
+        monkeypatch.setattr(
+            app_import_module,
+            "get_app_permission_keys",
+            lambda tenant_id, account_id, app_id: ["app.acl.view_layout", "app.acl.edit"],
+        )
+
+        with app.test_request_context("/console/api/apps/imports", method="POST", json={"mode": "yaml-content"}):
+            response, status = method()
+
+        session.commit.assert_called_once_with()
+        assert status == 200
+        assert response["permission_keys"] == ["app.acl.view_layout", "app.acl.edit"]
+
+    def test_import_post_does_not_attach_permission_keys_when_overwriting_existing_app(
+        self, api, app: Flask, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        method = _unwrap(api.post)
+
+        _install_features(monkeypatch, enabled=False)
+        session = _mock_session(monkeypatch)
+        monkeypatch.setattr(
+            app_import_module,
+            "current_account_with_tenant",
+            lambda: (SimpleNamespace(id="u1"), "tenant-1"),
+        )
+        monkeypatch.setattr(app_import_module.dify_config, "RBAC_ENABLED", True)
+        monkeypatch.setattr(
+            app_import_module.AppDslService,
+            "import_app",
+            lambda *_args, **_kwargs: _Result(ImportStatus.COMPLETED, app_id="app-123"),
+        )
+        monkeypatch.setattr(
+            app_import_module,
+            "get_app_permission_keys",
+            lambda *_args, **_kwargs: ["app.acl.view_layout", "app.acl.edit"],
+        )
+
+        with app.test_request_context(
+            "/console/api/apps/imports",
+            method="POST",
+            json={"mode": "yaml-content", "app_id": "existing-app"},
+        ):
+            response, status = method()
+
+        session.commit.assert_called_once_with()
+        assert status == 200
+        assert response["permission_keys"] == []
+
 
 class TestAppImportConfirmApi:
     @pytest.fixture
@@ -132,3 +213,79 @@ class TestAppImportConfirmApi:
         session.commit.assert_not_called()
         assert status == 400
         assert response["status"] == ImportStatus.FAILED
+
+    def test_import_confirm_attaches_permission_keys_when_creating_new_app_and_rbac_enabled(
+        self, api, app: Flask, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        method = _unwrap(api.post)
+
+        session = _mock_session(monkeypatch)
+        monkeypatch.setattr(
+            app_import_module,
+            "current_account_with_tenant",
+            lambda: (SimpleNamespace(id="u1"), "tenant-1"),
+        )
+        monkeypatch.setattr(
+            app_import_module.redis_client,
+            "get",
+            lambda *_args, **_kwargs: (
+                b'{"import_mode":"yaml-content","yaml_content":"app: {}","app_id":null,'
+                b'"name":null,"description":null,"icon_type":null,"icon":null,"icon_background":null}'
+            ),
+        )
+        monkeypatch.setattr(app_import_module.dify_config, "RBAC_ENABLED", True)
+        monkeypatch.setattr(
+            app_import_module.AppDslService,
+            "confirm_import",
+            lambda *_args, **_kwargs: _Result(ImportStatus.COMPLETED, app_id="app-456"),
+        )
+        monkeypatch.setattr(
+            app_import_module,
+            "get_app_permission_keys",
+            lambda tenant_id, account_id, app_id: ["app.acl.view_layout", "app.acl.edit"],
+        )
+
+        with app.test_request_context("/console/api/apps/imports/import-1/confirm", method="POST"):
+            response, status = method(import_id="import-1")
+
+        session.commit.assert_called_once_with()
+        assert status == 200
+        assert response["permission_keys"] == ["app.acl.view_layout", "app.acl.edit"]
+
+    def test_import_confirm_does_not_attach_permission_keys_when_overwriting_existing_app(
+        self, api, app: Flask, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        method = _unwrap(api.post)
+
+        session = _mock_session(monkeypatch)
+        monkeypatch.setattr(
+            app_import_module,
+            "current_account_with_tenant",
+            lambda: (SimpleNamespace(id="u1"), "tenant-1"),
+        )
+        monkeypatch.setattr(
+            app_import_module.redis_client,
+            "get",
+            lambda *_args, **_kwargs: (
+                b'{"import_mode":"yaml-content","yaml_content":"app: {}","app_id":"existing-app",'
+                b'"name":null,"description":null,"icon_type":null,"icon":null,"icon_background":null}'
+            ),
+        )
+        monkeypatch.setattr(app_import_module.dify_config, "RBAC_ENABLED", True)
+        monkeypatch.setattr(
+            app_import_module.AppDslService,
+            "confirm_import",
+            lambda *_args, **_kwargs: _Result(ImportStatus.COMPLETED, app_id="app-456"),
+        )
+        monkeypatch.setattr(
+            app_import_module,
+            "get_app_permission_keys",
+            lambda *_args, **_kwargs: ["app.acl.view_layout", "app.acl.edit"],
+        )
+
+        with app.test_request_context("/console/api/apps/imports/import-1/confirm", method="POST"):
+            response, status = method(import_id="import-1")
+
+        session.commit.assert_called_once_with()
+        assert status == 200
+        assert response["permission_keys"] == []
diff --git a/api/tests/unit_tests/controllers/console/app/test_app_response_models.py b/api/tests/unit_tests/controllers/console/app/test_app_response_models.py
index ef8f90e5c9c..48a19bb0364 100644
--- a/api/tests/unit_tests/controllers/console/app/test_app_response_models.py
+++ b/api/tests/unit_tests/controllers/console/app/test_app_response_models.py
@@ -14,6 +14,8 @@ from flask.views import MethodView
 from pydantic import ValidationError
 from werkzeug.datastructures import MultiDict
 
+from configs import dify_config
+
 # kombu references MethodView as a global when importing celery/kombu pools.
 if not hasattr(builtins, "MethodView"):
     builtins.MethodView = MethodView  # type: ignore[attr-defined]
@@ -351,6 +353,8 @@ def test_app_partial_serialization_uses_aliases(app_models):
         create_user_name="Creator",
         author_name="Author",
         has_draft_trigger=True,
+        permission_keys=["app.acl.view_layout"],
+        role="Should stay agent-only",
     )
 
     serialized = AppPartial.model_validate(app_obj, from_attributes=True).model_dump(mode="json")
@@ -363,6 +367,8 @@ def test_app_partial_serialization_uses_aliases(app_models):
     assert serialized["model_config"]["model"] == {"provider": "openai", "name": "gpt-4o"}
     assert serialized["workflow"]["id"] == "wf-1"
     assert serialized["tags"][0]["name"] == "Utilities"
+    assert serialized["permission_keys"] == ["app.acl.view_layout"]
+    assert "role" not in serialized
 
 
 def test_app_detail_with_site_includes_nested_serialization(app_models):
@@ -400,11 +406,13 @@ def test_app_detail_with_site_includes_nested_serialization(app_models):
         updated_at=timestamp,
         access_mode="public",
         tags=[SimpleNamespace(id="tag-2", name="Prod", type="app")],
+        permission_keys=["app.acl.view_layout", "app.acl.edit"],
         api_base_url="https://api.example.com/v1",
         max_active_requests=5,
         deleted_tools=[{"type": "api", "tool_name": "search", "provider_id": "prov"}],
         site=site,
         bound_agent_id="agent-1",
+        role="Should stay agent-only",
     )
 
     serialized = AppDetailWithSite.model_validate(app_obj, from_attributes=True).model_dump(mode="json")
@@ -414,7 +422,9 @@ def test_app_detail_with_site_includes_nested_serialization(app_models):
     assert serialized["deleted_tools"][0]["tool_name"] == "search"
     assert serialized["site"]["icon_url"] == "signed:site-icon"
     assert serialized["site"]["created_at"] == int(timestamp.timestamp())
+    assert serialized["permission_keys"] == ["app.acl.view_layout", "app.acl.edit"]
     assert serialized["bound_agent_id"] == "agent-1"
+    assert "role" not in serialized
 
 
 def test_app_pagination_aliases_per_page_and_has_next(app_models):
@@ -428,6 +438,7 @@ def test_app_pagination_aliases_per_page_and_has_next(app_models):
         icon="first-icon",
         created_at=_ts(15),
         updated_at=_ts(15),
+        permission_keys=["app.acl.edit"],
     )
     item_two = SimpleNamespace(
         id="app-11",
@@ -489,6 +500,20 @@ def test_app_list_uses_injected_session_for_draft_workflows(
         "FeatureService",
         SimpleNamespace(get_system_features=lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False))),
     )
+    monkeypatch.setattr(
+        app_module.enterprise_rbac_service.RBACService.MyPermissions,
+        "get",
+        lambda tenant_id, account_id: app_module.enterprise_rbac_service.MyPermissionsResponse(
+            app=app_module.enterprise_rbac_service.ResourcePermissionSnapshot(
+                overrides=[
+                    app_module.enterprise_rbac_service.ResourcePermissionKeys(
+                        resource_id="app-1",
+                        permission_keys=["app.acl.edit"],
+                    )
+                ]
+            )
+        ),
+    )
     monkeypatch.setattr(app_module, "db", SimpleNamespace(session=scoped_session))
 
     with app.test_request_context("/console/api/apps?page=1&limit=20", method="GET"):
@@ -498,3 +523,351 @@ def test_app_list_uses_injected_session_for_draft_workflows(
     assert response["data"][0]["has_draft_trigger"] is True
     session.execute.assert_called_once()
     scoped_session.execute.assert_not_called()
+    assert response["data"][0]["permission_keys"] == ["app.acl.edit"]
+
+
+def test_app_create_api_attaches_permission_keys(app, app_module):
+    method = app_module.AppListApi.post
+    while hasattr(method, "__wrapped__"):
+        method = method.__wrapped__
+
+    app_obj = SimpleNamespace(
+        id="app-new",
+        name="Created App",
+        description="Summary",
+        mode_compatible_with_agent="advanced-chat",
+        enable_site=True,
+        enable_api=True,
+        permission_keys=[],
+    )
+
+    with app.test_request_context("/apps", method="POST", json={}):
+        with pytest.MonkeyPatch.context() as monkeypatch:
+            app_module.console_ns.payload = {
+                "name": "Created App",
+                "description": "Summary",
+                "mode": "advanced-chat",
+            }
+            monkeypatch.setattr(
+                app_module,
+                "AppService",
+                lambda: SimpleNamespace(create_app=lambda tenant_id, params, user: app_obj),
+            )
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.AppPermissions,
+                "batch_get",
+                lambda tenant_id, account_id, app_ids: {"app-new": ["app.acl.view_layout", "app.acl.edit"]},
+            )
+
+            resp, status = method(app_module.AppListApi(), "tenant-1", SimpleNamespace(id="acct-1"))
+
+    assert status == 201
+    assert resp["permission_keys"] == ["app.acl.view_layout", "app.acl.edit"]
+
+
+def test_app_list_api_attaches_permission_keys(app, app_module):
+    method = app_module.AppListApi.get
+    while hasattr(method, "__wrapped__"):
+        method = method.__wrapped__
+
+    app_obj = SimpleNamespace(
+        id="app-1",
+        name="List App",
+        desc_or_prompt="Summary",
+        mode_compatible_with_agent="chat",
+        mode="chat",
+        created_at=_ts(15),
+        updated_at=_ts(15),
+        permission_keys=[],
+    )
+    pagination = SimpleNamespace(page=1, per_page=20, total=1, has_next=False, items=[app_obj])
+    get_paginate_apps = MagicMock(return_value=pagination)
+
+    with app.test_request_context("/apps"):
+        with pytest.MonkeyPatch.context() as monkeypatch:
+            monkeypatch.setattr(dify_config, "RBAC_ENABLED", True)
+            monkeypatch.setattr(
+                app_module.AppService,
+                "get_paginate_apps",
+                get_paginate_apps,
+            )
+            monkeypatch.setattr(
+                app_module.FeatureService,
+                "get_system_features",
+                lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False)),
+            )
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.MyPermissions,
+                "get",
+                lambda tenant_id, account_id: app_module.enterprise_rbac_service.MyPermissionsResponse(
+                    app=app_module.enterprise_rbac_service.ResourcePermissionSnapshot(
+                        default_permission_keys=["app.preview", "app.acl.view_layout"],
+                        overrides=[
+                            app_module.enterprise_rbac_service.ResourcePermissionKeys(
+                                resource_id="app-1",
+                                permission_keys=["app.acl.view_layout", "app.acl.edit"],
+                            )
+                        ],
+                    )
+                ),
+            )
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.AppAccess,
+                "whitelist_resources",
+                lambda tenant_id, account_id: SimpleNamespace(unrestricted=True, resource_ids=[]),
+            )
+
+            session = MagicMock()
+            session.execute.return_value.scalars.return_value.all.return_value = []
+            resp, status = method(app_module.AppListApi(), "tenant-1", "acct-1", session)
+
+    assert status == 200
+    params = get_paginate_apps.call_args.args[2]
+    assert params.accessible_app_ids is None
+    assert params.is_created_by_me is None
+    assert resp["data"][0]["permission_keys"] == ["app.acl.view_layout", "app.acl.edit"]
+
+
+def test_app_list_api_limits_to_apps_created_by_current_user_without_view_permission(app, app_module):
+    method = app_module.AppListApi.get
+    while hasattr(method, "__wrapped__"):
+        method = method.__wrapped__
+
+    pagination = SimpleNamespace(page=1, per_page=20, total=0, has_next=False, items=[])
+    get_paginate_apps = MagicMock(return_value=pagination)
+
+    with app.test_request_context("/apps"):
+        with pytest.MonkeyPatch.context() as monkeypatch:
+            monkeypatch.setattr(app_module.AppService, "get_paginate_apps", get_paginate_apps)
+            monkeypatch.setattr(app_module.dify_config, "RBAC_ENABLED", True)
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.MyPermissions,
+                "get",
+                lambda tenant_id, account_id: app_module.enterprise_rbac_service.MyPermissionsResponse(
+                    workspace=app_module.enterprise_rbac_service.WorkspacePermissionSnapshot(
+                        permission_keys=["app.create_and_management"]
+                    )
+                ),
+            )
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.AppAccess,
+                "whitelist_resources",
+                lambda tenant_id, account_id: SimpleNamespace(resource_ids=["app-shared", "app-not-permitted"]),
+            )
+            monkeypatch.setattr(
+                app_module.FeatureService,
+                "get_system_features",
+                lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False)),
+            )
+
+            session = MagicMock()
+            resp, status = method(app_module.AppListApi(), "tenant-1", "acct-1", session)
+
+    assert status == 200
+    assert resp["data"] == []
+    params = get_paginate_apps.call_args.args[2]
+    assert params.accessible_app_ids == ["app-not-permitted", "app-shared"]
+    assert params.include_own_apps is True
+    assert params.is_created_by_me is None
+
+
+def test_app_list_api_limits_to_preview_overrides_without_manage_own_permission(app, app_module):
+    method = app_module.AppListApi.get
+    while hasattr(method, "__wrapped__"):
+        method = method.__wrapped__
+
+    pagination = SimpleNamespace(page=1, per_page=20, total=0, has_next=False, items=[])
+    get_paginate_apps = MagicMock(return_value=pagination)
+
+    with app.test_request_context("/apps"):
+        with pytest.MonkeyPatch.context() as monkeypatch:
+            monkeypatch.setattr(app_module.AppService, "get_paginate_apps", get_paginate_apps)
+            monkeypatch.setattr(app_module.dify_config, "RBAC_ENABLED", True)
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.MyPermissions,
+                "get",
+                lambda tenant_id, account_id: app_module.enterprise_rbac_service.MyPermissionsResponse(
+                    app=app_module.enterprise_rbac_service.ResourcePermissionSnapshot(
+                        overrides=[
+                            app_module.enterprise_rbac_service.ResourcePermissionKeys(
+                                resource_id="app-acl-shared",
+                                permission_keys=["app.acl.preview"],
+                            ),
+                            app_module.enterprise_rbac_service.ResourcePermissionKeys(
+                                resource_id="app-full",
+                                permission_keys=["app.full_access"],
+                            ),
+                            app_module.enterprise_rbac_service.ResourcePermissionKeys(
+                                resource_id="app-shared",
+                                permission_keys=["app.preview"],
+                            ),
+                        ]
+                    )
+                ),
+            )
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.AppAccess,
+                "whitelist_resources",
+                lambda tenant_id, account_id: SimpleNamespace(
+                    resource_ids=["app-shared", "app-acl-shared", "app-full", "app-whitelist-only"]
+                ),
+            )
+            monkeypatch.setattr(
+                app_module.FeatureService,
+                "get_system_features",
+                lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False)),
+            )
+
+            session = MagicMock()
+            method(app_module.AppListApi(), "tenant-1", "acct-1", session)
+
+    params = get_paginate_apps.call_args.args[2]
+    assert params.accessible_app_ids == ["app-acl-shared", "app-full", "app-shared", "app-whitelist-only"]
+    assert params.include_own_apps is False
+    assert params.is_created_by_me is None
+
+
+def test_app_list_api_returns_no_apps_without_workspace_or_resource_view_permission(app, app_module):
+    method = app_module.AppListApi.get
+    while hasattr(method, "__wrapped__"):
+        method = method.__wrapped__
+
+    pagination = SimpleNamespace(page=1, per_page=20, total=0, has_next=False, items=[])
+    get_paginate_apps = MagicMock(return_value=pagination)
+
+    with app.test_request_context("/apps"):
+        with pytest.MonkeyPatch.context() as monkeypatch:
+            monkeypatch.setattr(app_module.AppService, "get_paginate_apps", get_paginate_apps)
+            monkeypatch.setattr(app_module.dify_config, "RBAC_ENABLED", True)
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.MyPermissions,
+                "get",
+                lambda tenant_id, account_id: app_module.enterprise_rbac_service.MyPermissionsResponse(),
+            )
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.AppAccess,
+                "whitelist_resources",
+                lambda tenant_id, account_id: SimpleNamespace(resource_ids=["app-not-permitted"]),
+            )
+            monkeypatch.setattr(
+                app_module.FeatureService,
+                "get_system_features",
+                lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False)),
+            )
+
+            session = MagicMock()
+            method(app_module.AppListApi(), "tenant-1", "acct-1", session)
+
+    params = get_paginate_apps.call_args.args[2]
+    assert params.accessible_app_ids == ["app-not-permitted"]
+    assert params.include_own_apps is False
+    assert params.is_created_by_me is None
+
+
+def test_app_detail_api_attaches_current_user_permission_keys(app, app_module):
+    method = app_module.AppApi.get
+    while hasattr(method, "__wrapped__"):
+        method = method.__wrapped__
+
+    app_obj = SimpleNamespace(
+        id="app-1",
+        name="Detail App",
+        description="Summary",
+        mode_compatible_with_agent="chat",
+        enable_site=True,
+        enable_api=True,
+        permission_keys=[],
+    )
+
+    with app.test_request_context("/apps/app-1"):
+        with pytest.MonkeyPatch.context() as monkeypatch:
+            monkeypatch.setattr(dify_config, "RBAC_ENABLED", True)
+            monkeypatch.setattr(app_module, "AppService", lambda: SimpleNamespace(get_app=lambda app_model: app_obj))
+            monkeypatch.setattr(
+                app_module.FeatureService,
+                "get_system_features",
+                lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False)),
+            )
+            get_permissions = MagicMock(
+                return_value=app_module.enterprise_rbac_service.MyPermissionsResponse(
+                    app=app_module.enterprise_rbac_service.ResourcePermissionSnapshot(
+                        overrides=[
+                            app_module.enterprise_rbac_service.ResourcePermissionKeys(
+                                resource_id="app-1",
+                                permission_keys=["app.acl.view_layout", "app.acl.edit", "app.acl.monitor"],
+                            )
+                        ]
+                    )
+                )
+            )
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.MyPermissions,
+                "get",
+                get_permissions,
+            )
+
+            resp = method(app_module.AppApi(), "tenant-1", SimpleNamespace(id="acct-1"), app_model=app_obj)
+
+    get_permissions.assert_called_once_with("tenant-1", "acct-1", app_id="app-1")
+    assert resp["permission_keys"] == ["app.acl.view_layout", "app.acl.edit", "app.acl.monitor"]
+
+
+def test_app_copy_api_attaches_permission_keys(app, app_module):
+    method = app_module.AppCopyApi.post
+    while hasattr(method, "__wrapped__"):
+        method = method.__wrapped__
+
+    app_obj = SimpleNamespace(
+        id="app-new",
+        name="Copied App",
+        description="Summary",
+        mode_compatible_with_agent="workflow",
+        enable_site=True,
+        enable_api=True,
+        permission_keys=[],
+    )
+
+    import_result = SimpleNamespace(status=app_module.ImportStatus.COMPLETED, app_id="app-new")
+    fake_session = MagicMock()
+    fake_session.__enter__.return_value = fake_session
+    fake_session.__exit__.return_value = None
+    fake_session.scalar.return_value = app_obj
+
+    with app.test_request_context("/apps/app-original/copy", method="POST", json={}):
+        with pytest.MonkeyPatch.context() as monkeypatch:
+            monkeypatch.setattr(dify_config, "RBAC_ENABLED", True)
+            monkeypatch.setattr(
+                app_module,
+                "AppDslService",
+                lambda *_args, **_kwargs: SimpleNamespace(
+                    export_dsl=lambda **_kwargs: "dsl",
+                    import_app=lambda **_kwargs: import_result,
+                ),
+            )
+            monkeypatch.setattr(
+                app_module.FeatureService,
+                "get_system_features",
+                lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False)),
+            )
+            monkeypatch.setattr(app_module, "db", SimpleNamespace(engine=object()))
+            monkeypatch.setattr(
+                app_module,
+                "Session",
+                lambda *_args, **_kwargs: fake_session,
+            )
+            monkeypatch.setattr(
+                app_module.enterprise_rbac_service.RBACService.AppPermissions,
+                "batch_get",
+                lambda tenant_id, account_id, app_ids: {"app-new": ["app.acl.view_layout", "app.acl.edit"]},
+            )
+
+            resp, status = method(
+                app_module.AppCopyApi(),
+                "tenant-1",
+                SimpleNamespace(id="acct-1"),
+                app_model=SimpleNamespace(id="app-original"),
+            )
+
+    assert status == 201
+    assert fake_session.scalar.called
+    assert resp["permission_keys"] == ["app.acl.view_layout", "app.acl.edit"]
diff --git a/api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py b/api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py
index c7dba152162..aa248180bca 100644
--- a/api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py
+++ b/api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py
@@ -1,4 +1,5 @@
 import datetime
+from inspect import unwrap
 from types import SimpleNamespace
 from unittest.mock import PropertyMock, patch
 
@@ -8,12 +9,6 @@ from controllers.console import console_ns
 from controllers.console.app.mcp_server import AppMCPServerController, AppMCPServerResponse
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 class _ValidatedResponse:
     def __init__(self, payload):
         self._payload = payload
diff --git a/api/tests/unit_tests/controllers/console/app/test_message_api.py b/api/tests/unit_tests/controllers/console/app/test_message_api.py
index 27bc5e341e9..067edc6fd68 100644
--- a/api/tests/unit_tests/controllers/console/app/test_message_api.py
+++ b/api/tests/unit_tests/controllers/console/app/test_message_api.py
@@ -3,11 +3,12 @@ from __future__ import annotations
 from datetime import UTC, datetime
 
 import pytest
+from flask import Flask
 
 from controllers.console.app import message as message_module
 
 
-def test_chat_messages_query_valid(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_chat_messages_query_valid(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test valid ChatMessagesQuery with all fields."""
     query = message_module.ChatMessagesQuery(
         conversation_id="550e8400-e29b-41d4-a716-446655440000",
@@ -17,14 +18,14 @@ def test_chat_messages_query_valid(app, monkeypatch: pytest.MonkeyPatch) -> None
     assert query.limit == 50
 
 
-def test_chat_messages_query_defaults(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_chat_messages_query_defaults(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test ChatMessagesQuery with defaults."""
     query = message_module.ChatMessagesQuery(conversation_id="550e8400-e29b-41d4-a716-446655440000")
     assert query.first_id is None
     assert query.limit == 20
 
 
-def test_chat_messages_query_empty_first_id(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_chat_messages_query_empty_first_id(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test ChatMessagesQuery converts empty first_id to None."""
     query = message_module.ChatMessagesQuery(
         conversation_id="550e8400-e29b-41d4-a716-446655440000",
@@ -33,7 +34,7 @@ def test_chat_messages_query_empty_first_id(app, monkeypatch: pytest.MonkeyPatch
     assert query.first_id is None
 
 
-def test_message_feedback_payload_valid_like(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_message_feedback_payload_valid_like(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test MessageFeedbackPayload with like rating."""
     payload = message_module.MessageFeedbackPayload(
         message_id="550e8400-e29b-41d4-a716-446655440000",
@@ -44,7 +45,7 @@ def test_message_feedback_payload_valid_like(app, monkeypatch: pytest.MonkeyPatc
     assert payload.content == "Good answer"
 
 
-def test_message_feedback_payload_valid_dislike(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_message_feedback_payload_valid_dislike(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test MessageFeedbackPayload with dislike rating."""
     payload = message_module.MessageFeedbackPayload(
         message_id="550e8400-e29b-41d4-a716-446655440000",
@@ -53,69 +54,69 @@ def test_message_feedback_payload_valid_dislike(app, monkeypatch: pytest.MonkeyP
     assert payload.rating == "dislike"
 
 
-def test_message_feedback_payload_no_rating(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_message_feedback_payload_no_rating(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test MessageFeedbackPayload without rating."""
     payload = message_module.MessageFeedbackPayload(message_id="550e8400-e29b-41d4-a716-446655440000")
     assert payload.rating is None
 
 
-def test_feedback_export_query_defaults(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_feedback_export_query_defaults(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test FeedbackExportQuery with default format."""
     query = message_module.FeedbackExportQuery()
     assert query.format == "csv"
     assert query.from_source is None
 
 
-def test_feedback_export_query_json_format(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_feedback_export_query_json_format(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test FeedbackExportQuery with JSON format."""
     query = message_module.FeedbackExportQuery(format="json")
     assert query.format == "json"
 
 
-def test_feedback_export_query_has_comment_true(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_feedback_export_query_has_comment_true(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test FeedbackExportQuery with has_comment as true string."""
     query = message_module.FeedbackExportQuery(has_comment="true")
     assert query.has_comment is True
 
 
-def test_feedback_export_query_has_comment_false(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_feedback_export_query_has_comment_false(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test FeedbackExportQuery with has_comment as false string."""
     query = message_module.FeedbackExportQuery(has_comment="false")
     assert query.has_comment is False
 
 
-def test_feedback_export_query_has_comment_1(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_feedback_export_query_has_comment_1(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test FeedbackExportQuery with has_comment as 1."""
     query = message_module.FeedbackExportQuery(has_comment="1")
     assert query.has_comment is True
 
 
-def test_feedback_export_query_has_comment_0(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_feedback_export_query_has_comment_0(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test FeedbackExportQuery with has_comment as 0."""
     query = message_module.FeedbackExportQuery(has_comment="0")
     assert query.has_comment is False
 
 
-def test_feedback_export_query_rating_filter(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_feedback_export_query_rating_filter(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test FeedbackExportQuery with rating filter."""
     query = message_module.FeedbackExportQuery(rating="like")
     assert query.rating == "like"
 
 
-def test_annotation_count_response(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_annotation_count_response(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test AnnotationCountResponse creation."""
     response = message_module.AnnotationCountResponse(count=10)
     assert response.count == 10
 
 
-def test_suggested_questions_response(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_suggested_questions_response(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test SuggestedQuestionsResponse creation."""
     response = message_module.SuggestedQuestionsResponse(data=["What is AI?", "How does ML work?"])
     assert len(response.data) == 2
     assert response.data[0] == "What is AI?"
 
 
-def test_message_detail_response_normalizes_aliases_and_timestamp(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_message_detail_response_normalizes_aliases_and_timestamp(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test MessageDetailResponse normalizes alias fields and datetime timestamps."""
     created_at = datetime(2026, 1, 2, 3, 4, 5, tzinfo=UTC)
     response = message_module.MessageDetailResponse.model_validate(
diff --git a/api/tests/unit_tests/controllers/console/app/test_statistic_api.py b/api/tests/unit_tests/controllers/console/app/test_statistic_api.py
index b31dccd034f..b0506e348fc 100644
--- a/api/tests/unit_tests/controllers/console/app/test_statistic_api.py
+++ b/api/tests/unit_tests/controllers/console/app/test_statistic_api.py
@@ -5,6 +5,7 @@ from inspect import unwrap
 from types import SimpleNamespace
 
 import pytest
+from flask import Flask
 from werkzeug.exceptions import BadRequest
 
 from controllers.console.app import statistic as statistic_module
@@ -38,7 +39,7 @@ def _install_common(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(statistic_module, "convert_datetime_to_date", lambda field: field)
 
 
-def test_daily_message_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_message_statistic_returns_rows(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyMessageStatistic()
     method = unwrap(api.get)
 
@@ -52,7 +53,7 @@ def test_daily_message_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPat
     assert response.get_json() == {"data": [{"date": "2024-01-01", "message_count": 3}]}
 
 
-def test_daily_conversation_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_conversation_statistic_returns_rows(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyConversationStatistic()
     method = unwrap(api.get)
 
@@ -66,7 +67,7 @@ def test_daily_conversation_statistic_returns_rows(app, monkeypatch: pytest.Monk
     assert response.get_json() == {"data": [{"date": "2024-01-02", "conversation_count": 5}]}
 
 
-def test_daily_token_cost_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_token_cost_statistic_returns_rows(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyTokenCostStatistic()
     method = unwrap(api.get)
 
@@ -84,7 +85,7 @@ def test_daily_token_cost_statistic_returns_rows(app, monkeypatch: pytest.Monkey
     assert data["data"][0]["total_price"] == 0.25
 
 
-def test_daily_terminals_statistic_returns_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_terminals_statistic_returns_rows(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyTerminalsStatistic()
     method = unwrap(api.get)
 
@@ -98,7 +99,7 @@ def test_daily_terminals_statistic_returns_rows(app, monkeypatch: pytest.MonkeyP
     assert response.get_json() == {"data": [{"date": "2024-01-04", "terminal_count": 7}]}
 
 
-def test_average_session_interaction_statistic_requires_chat_mode(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_average_session_interaction_statistic_requires_chat_mode(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     """Test that AverageSessionInteractionStatistic is limited to chat/agent modes."""
     # This just verifies the decorator is applied correctly
     # Actual endpoint testing would require complex JOIN mocking
@@ -107,7 +108,7 @@ def test_average_session_interaction_statistic_requires_chat_mode(app, monkeypat
     assert callable(method)
 
 
-def test_daily_message_statistic_with_invalid_time_range(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_message_statistic_with_invalid_time_range(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyMessageStatistic()
     method = unwrap(api.get)
 
@@ -123,7 +124,7 @@ def test_daily_message_statistic_with_invalid_time_range(app, monkeypatch: pytes
             method(api, SimpleNamespace(timezone="UTC"), app_model=SimpleNamespace(id="app-1"))
 
 
-def test_daily_message_statistic_multiple_rows(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_message_statistic_multiple_rows(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyMessageStatistic()
     method = unwrap(api.get)
 
@@ -142,7 +143,7 @@ def test_daily_message_statistic_multiple_rows(app, monkeypatch: pytest.MonkeyPa
     assert len(data["data"]) == 3
 
 
-def test_daily_message_statistic_empty_result(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_message_statistic_empty_result(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyMessageStatistic()
     method = unwrap(api.get)
 
@@ -155,7 +156,7 @@ def test_daily_message_statistic_empty_result(app, monkeypatch: pytest.MonkeyPat
     assert response.get_json() == {"data": []}
 
 
-def test_daily_conversation_statistic_with_time_range(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_conversation_statistic_with_time_range(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyConversationStatistic()
     method = unwrap(api.get)
 
@@ -174,7 +175,7 @@ def test_daily_conversation_statistic_with_time_range(app, monkeypatch: pytest.M
     assert response.get_json() == {"data": [{"date": "2024-01-02", "conversation_count": 5}]}
 
 
-def test_daily_token_cost_with_multiple_currencies(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_daily_token_cost_with_multiple_currencies(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = statistic_module.DailyTokenCostStatistic()
     method = unwrap(api.get)
 
diff --git a/api/tests/unit_tests/controllers/console/app/test_workflow_convert_api.py b/api/tests/unit_tests/controllers/console/app/test_workflow_convert_api.py
new file mode 100644
index 00000000000..dd254a31f63
--- /dev/null
+++ b/api/tests/unit_tests/controllers/console/app/test_workflow_convert_api.py
@@ -0,0 +1,55 @@
+"""Unit tests for convert-to-workflow endpoint."""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+from flask import Flask
+
+from controllers.console.app import workflow as workflow_module
+
+
+def _unwrap(func):
+    bound_self = getattr(func, "__self__", None)
+    while hasattr(func, "__wrapped__"):
+        func = func.__wrapped__
+    if bound_self is not None:
+        return func.__get__(bound_self, bound_self.__class__)
+    return func
+
+
+class TestConvertToWorkflowApi:
+    @pytest.fixture
+    def api(self):
+        return workflow_module.ConvertToWorkflowApi()
+
+    def test_convert_to_workflow_attaches_permission_keys_when_rbac_enabled(
+        self, api, app: Flask, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        method = _unwrap(api.post)
+
+        monkeypatch.setattr(
+            workflow_module,
+            "WorkflowService",
+            lambda: SimpleNamespace(convert_to_workflow=lambda **_kwargs: SimpleNamespace(id="new-app-1")),
+        )
+        monkeypatch.setattr(
+            workflow_module,
+            "get_app_permission_keys",
+            lambda tenant_id, account_id, app_id: ["app.acl.view_layout", "app.acl.edit"],
+        )
+
+        with app.test_request_context(
+            "/console/api/apps/app-1/convert-to-workflow",
+            method="POST",
+            json={},
+        ):
+            response = method(
+                current_tenant_id="tenant-1",
+                current_user=SimpleNamespace(id="u1"),
+                app_model=SimpleNamespace(id="app-1"),
+            )
+
+        assert response["new_app_id"] == "new-app-1"
+        assert response["permission_keys"] == ["app.acl.view_layout", "app.acl.edit"]
diff --git a/api/tests/unit_tests/controllers/console/auth/test_account_activation.py b/api/tests/unit_tests/controllers/console/auth/test_account_activation.py
index 79169cfce7e..6ef7f442591 100644
--- a/api/tests/unit_tests/controllers/console/auth/test_account_activation.py
+++ b/api/tests/unit_tests/controllers/console/auth/test_account_activation.py
@@ -15,7 +15,7 @@ from flask import Flask
 
 from controllers.console.auth.activate import ActivateApi, ActivateCheckApi
 from controllers.console.error import AccountInFreezeError, AlreadyActivateError
-from models.account import AccountStatus
+from models.account import AccountStatus, TenantAccountRole
 
 
 class TestActivateCheckApi:
@@ -66,6 +66,20 @@ class TestActivateCheckApi:
         assert response["data"]["workspace_id"] == "workspace-123"
         assert response["data"]["email"] == "invitee@example.com"
 
+    @patch("controllers.console.auth.activate.RegisterService.get_invitation_with_case_fallback")
+    def test_check_valid_invitation_token_includes_account_status(self, mock_get_invitation, app, mock_invitation):
+        mock_account = MagicMock()
+        mock_account.status = AccountStatus.ACTIVE
+        mock_invitation["account"] = mock_account
+        mock_get_invitation.return_value = mock_invitation
+
+        with app.test_request_context("/activate/check?email=invitee@example.com&token=valid_token"):
+            response = ActivateCheckApi().get()
+
+        assert response["is_valid"] is True
+        assert response["data"]["account_status"] == AccountStatus.ACTIVE
+        assert response["data"]["requires_setup"] is False
+
     @patch("controllers.console.auth.activate.RegisterService.get_invitation_with_case_fallback")
     def test_check_invalid_invitation_token(self, mock_get_invitation, app: Flask):
         """
@@ -177,16 +191,21 @@ class TestActivateApi:
             "account": mock_account,
         }
 
+    @pytest.fixture(autouse=True)
+    def mock_switch_tenant(self):
+        with patch("controllers.console.auth.activate.TenantService.switch_tenant") as mock:
+            yield mock
+
     @patch("controllers.console.auth.activate.RegisterService.get_invitation_if_token_valid")
     @patch("controllers.console.auth.activate.RegisterService.revoke_token")
     @patch("controllers.console.auth.activate.db")
     def test_successful_account_activation(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
         app: Flask,
-        mock_invitation,
+        mock_invitation: MagicMock,
         mock_account,
     ):
         """
@@ -224,7 +243,40 @@ class TestActivateApi:
         assert mock_account.status == AccountStatus.ACTIVE
         assert mock_account.initialized_at is not None
         mock_revoke_token.assert_called_once_with("workspace-123", "invitee@example.com", "valid_token")
-        mock_db.session.commit.assert_called_once()
+
+    @patch("controllers.console.auth.activate.TenantService.create_tenant_member")
+    @patch("controllers.console.auth.activate.RegisterService.get_invitation_with_case_fallback")
+    @patch("controllers.console.auth.activate.RegisterService.revoke_token")
+    @patch("controllers.console.auth.activate.db")
+    def test_activation_rejects_missing_setup_fields_before_consuming_invitation(
+        self,
+        mock_db,
+        mock_revoke_token,
+        mock_get_invitation,
+        mock_create_tenant_member,
+        app: Flask,
+        mock_invitation,
+        mock_switch_tenant,
+    ):
+        mock_invitation["data"]["requires_setup"] = True
+        mock_get_invitation.return_value = mock_invitation
+        mock_db.session.scalar.return_value = None
+
+        with app.test_request_context(
+            "/activate",
+            method="POST",
+            json={
+                "workspace_id": "workspace-123",
+                "email": "invitee@example.com",
+                "token": "valid_token",
+            },
+        ):
+            with pytest.raises(AlreadyActivateError):
+                ActivateApi().post()
+
+        mock_revoke_token.assert_not_called()
+        mock_create_tenant_member.assert_not_called()
+        mock_switch_tenant.assert_not_called()
 
     @patch("controllers.console.auth.activate.RegisterService.get_invitation_with_case_fallback")
     def test_activation_with_invalid_token(self, mock_get_invitation, app: Flask):
@@ -396,11 +448,11 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_activation_returns_success_response(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
         app: Flask,
-        mock_invitation,
+        mock_invitation: MagicMock,
     ):
         """
         Test that activation returns a success response without authentication tokens.
@@ -436,11 +488,11 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_activation_without_workspace_id(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
         app: Flask,
-        mock_invitation,
+        mock_invitation: MagicMock,
     ):
         """
         Test account activation without workspace_id.
@@ -476,12 +528,12 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_activation_normalizes_email_before_lookup(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
         app: Flask,
-        mock_invitation,
-        mock_account,
+        mock_invitation: MagicMock,
+        mock_account: MagicMock,
     ):
         """Ensure uppercase emails are normalized before lookup and revocation."""
         mock_get_invitation.return_value = mock_invitation
@@ -504,3 +556,77 @@ class TestActivateApi:
         assert response["result"] == "success"
         mock_get_invitation.assert_called_once_with("workspace-123", "Invitee@Example.com", "valid_token")
         mock_revoke_token.assert_called_once_with("workspace-123", "invitee@example.com", "valid_token")
+
+    @patch("controllers.console.auth.activate.TenantService.create_tenant_member")
+    @patch("controllers.console.auth.activate.RegisterService.get_invitation_with_case_fallback")
+    @patch("controllers.console.auth.activate.RegisterService.revoke_token")
+    @patch("controllers.console.auth.activate.db")
+    def test_activation_for_existing_active_account_creates_membership_on_acceptance(
+        self,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
+        mock_create_tenant_member: MagicMock,
+        app: Flask,
+        mock_invitation: MagicMock,
+        mock_account: MagicMock,
+        mock_switch_tenant: MagicMock,
+    ):
+        mock_account.status = AccountStatus.ACTIVE
+        mock_invitation["data"]["role"] = "admin"
+        mock_invitation["data"]["requires_setup"] = False
+        mock_get_invitation.return_value = mock_invitation
+        mock_db.session.scalar.return_value = None
+
+        with app.test_request_context(
+            "/activate",
+            method="POST",
+            json={
+                "workspace_id": "workspace-123",
+                "email": "invitee@example.com",
+                "token": "valid_token",
+            },
+        ):
+            response = ActivateApi().post()
+
+        assert response["result"] == "success"
+        mock_create_tenant_member.assert_called_once_with(
+            mock_invitation["tenant"], mock_account, mock_db.session, role=TenantAccountRole.ADMIN
+        )
+        mock_switch_tenant.assert_called_once_with(mock_account, mock_invitation["tenant"].id)
+        mock_revoke_token.assert_called_once_with("workspace-123", "invitee@example.com", "valid_token")
+
+    @patch("controllers.console.auth.activate.TenantService.create_tenant_member")
+    @patch("controllers.console.auth.activate.RegisterService.get_invitation_with_case_fallback")
+    @patch("controllers.console.auth.activate.RegisterService.revoke_token")
+    @patch("controllers.console.auth.activate.db")
+    def test_activation_legacy_active_member_invitation_does_not_require_setup(
+        self,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
+        mock_create_tenant_member: MagicMock,
+        app: Flask,
+        mock_invitation: MagicMock,
+        mock_account: MagicMock,
+        mock_switch_tenant: MagicMock,
+    ):
+        mock_account.status = AccountStatus.ACTIVE
+        mock_get_invitation.return_value = mock_invitation
+        mock_db.session.scalar.return_value = "membership-id"
+
+        with app.test_request_context(
+            "/activate",
+            method="POST",
+            json={
+                "workspace_id": "workspace-123",
+                "email": "invitee@example.com",
+                "token": "valid_token",
+            },
+        ):
+            response = ActivateApi().post()
+
+        assert response["result"] == "success"
+        mock_create_tenant_member.assert_not_called()
+        mock_switch_tenant.assert_called_once_with(mock_account, mock_invitation["tenant"].id)
+        mock_revoke_token.assert_called_once_with("workspace-123", "invitee@example.com", "valid_token")
diff --git a/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_datasource_content_preview.py b/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_datasource_content_preview.py
index 2cf8947014b..eccf5ed56d1 100644
--- a/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_datasource_content_preview.py
+++ b/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_datasource_content_preview.py
@@ -1,3 +1,4 @@
+from inspect import unwrap
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -11,12 +12,6 @@ from models import Account
 from models.dataset import Pipeline
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 def make_account() -> Account:
     account = Account(name="Test User", email="user@example.com")
     account.id = "account-1"
diff --git a/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_rag_pipeline_draft_variable.py b/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_rag_pipeline_draft_variable.py
index f51b1ae1da4..0d18120b715 100644
--- a/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_rag_pipeline_draft_variable.py
+++ b/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_rag_pipeline_draft_variable.py
@@ -1,3 +1,4 @@
+from inspect import unwrap
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -19,12 +20,6 @@ from graphon.variables.types import SegmentType
 from models.account import Account, TenantAccountRole
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 @pytest.fixture
 def fake_db():
     db = MagicMock()
diff --git a/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_rag_pipeline_workflow.py b/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_rag_pipeline_workflow.py
index a2748ad323e..5cc5af9592b 100644
--- a/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_rag_pipeline_workflow.py
+++ b/api/tests/unit_tests/controllers/console/datasets/rag_pipeline/test_rag_pipeline_workflow.py
@@ -6,6 +6,7 @@ from types import SimpleNamespace
 from unittest.mock import PropertyMock, patch
 
 import pytest
+from flask import Flask
 
 from controllers.console.datasets.rag_pipeline import rag_pipeline_workflow as module
 from models.account import Account, TenantAccountRole
@@ -117,7 +118,7 @@ def test_published_rag_pipeline_workflows_serialize_items_before_session_closes(
     assert response["has_more"] is False
 
 
-def test_rag_pipeline_workflow_patch_serializes_response_model(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_rag_pipeline_workflow_patch_serializes_response_model(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     workflow = _make_workflow(marked_name="Updated release")
 
     class _SessionContext:
diff --git a/api/tests/unit_tests/controllers/console/datasets/test_datasets.py b/api/tests/unit_tests/controllers/console/datasets/test_datasets.py
index 101a640699f..76a09558987 100644
--- a/api/tests/unit_tests/controllers/console/datasets/test_datasets.py
+++ b/api/tests/unit_tests/controllers/console/datasets/test_datasets.py
@@ -2,6 +2,7 @@ import datetime
 import json
 from contextlib import ExitStack
 from inspect import unwrap
+from types import SimpleNamespace
 from unittest.mock import MagicMock, PropertyMock, patch
 
 import pytest
@@ -39,6 +40,7 @@ from models.dataset import Dataset, DatasetQuery, Document
 from models.enums import CreatorUserRole, DataSourceType, DocumentCreatedFrom, IndexingStatus
 from models.model import ApiToken, App, AppMode, IconType, UploadFile
 from services.dataset_service import DatasetPermissionService, DatasetService
+from services.enterprise import rbac_service as enterprise_rbac_service
 
 
 @pytest.fixture(autouse=True)
@@ -211,6 +213,201 @@ class TestDatasetList:
         assert status == 200
         assert resp["total"] == 2
 
+    def test_get_attaches_current_user_permission_keys(self, app: Flask):
+        api = DatasetListApi()
+        method = unwrap(api.get)
+        current_user = self._mock_user()
+        dataset = make_dataset(id="dataset-1")
+        permissions = enterprise_rbac_service.MyPermissionsResponse(
+            dataset=enterprise_rbac_service.ResourcePermissionSnapshot(
+                default_permission_keys=["dataset.acl.readonly"],
+                overrides=[
+                    enterprise_rbac_service.ResourcePermissionKeys(
+                        resource_id="dataset-1",
+                        permission_keys=["dataset.acl.readonly", "dataset.acl.edit"],
+                    )
+                ],
+            )
+        )
+
+        with app.test_request_context("/datasets"):
+            with (
+                patch.object(DatasetService, "get_datasets", return_value=([dataset], 1)),
+                patch.object(
+                    ProviderManager,
+                    "get_configurations",
+                    return_value=MagicMock(get_models=lambda **_: []),
+                ),
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.MyPermissions.get",
+                    return_value=permissions,
+                ) as get_permissions,
+            ):
+                resp, status = method(api, "tenant-1", current_user)
+
+        get_permissions.assert_called_once_with("tenant-1", current_user.id)
+        assert status == 200
+        assert resp["data"][0]["permission_keys"] == ["dataset.acl.readonly", "dataset.acl.edit"]
+
+    def test_get_limits_to_own_datasets_without_default_read_permission(self, app: Flask):
+        api = DatasetListApi()
+        method = unwrap(api.get)
+        current_user = self._mock_user()
+        permissions = enterprise_rbac_service.MyPermissionsResponse(
+            workspace=enterprise_rbac_service.WorkspacePermissionSnapshot(
+                permission_keys=["dataset.create_and_management"]
+            )
+        )
+
+        with app.test_request_context("/datasets"):
+            with (
+                patch("controllers.console.datasets.datasets.dify_config.RBAC_ENABLED", True),
+                patch.object(DatasetService, "get_datasets", return_value=([], 0)) as get_datasets,
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.MyPermissions.get",
+                    return_value=permissions,
+                ),
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.DatasetAccess.whitelist_resources",
+                    return_value=SimpleNamespace(resource_ids=[]),
+                ),
+                patch.object(
+                    ProviderManager,
+                    "get_configurations",
+                    return_value=MagicMock(get_models=lambda **_: []),
+                ),
+            ):
+                method(api, "tenant-1", current_user)
+
+        assert get_datasets.call_args.kwargs["accessible_dataset_ids"] == []
+        assert get_datasets.call_args.kwargs["include_own_datasets"] is True
+
+    def test_get_workspace_owner_bypasses_dataset_whitelist(self, app: Flask):
+        api = DatasetListApi()
+        method = unwrap(api.get)
+        current_user = self._mock_user()
+        permissions = enterprise_rbac_service.MyPermissionsResponse(
+            dataset=enterprise_rbac_service.ResourcePermissionSnapshot(default_permission_keys=["dataset.preview"])
+        )
+
+        with app.test_request_context("/datasets"):
+            with (
+                patch("controllers.console.datasets.datasets.dify_config.RBAC_ENABLED", True),
+                patch.object(DatasetService, "get_datasets", return_value=([], 0)) as get_datasets,
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.MyPermissions.get",
+                    return_value=permissions,
+                ),
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.DatasetAccess.whitelist_resources",
+                    return_value=SimpleNamespace(unrestricted=True, resource_ids=[]),
+                ),
+                patch.object(
+                    ProviderManager,
+                    "get_configurations",
+                    return_value=MagicMock(get_models=lambda **_: []),
+                ),
+            ):
+                method(api, "tenant-1", current_user)
+
+        assert get_datasets.call_args.kwargs["accessible_dataset_ids"] is None
+
+    def test_get_limits_to_dataset_read_overrides(self, app: Flask):
+        api = DatasetListApi()
+        method = unwrap(api.get)
+        current_user = self._mock_user()
+        permissions = enterprise_rbac_service.MyPermissionsResponse(
+            dataset=enterprise_rbac_service.ResourcePermissionSnapshot(
+                overrides=[
+                    enterprise_rbac_service.ResourcePermissionKeys(
+                        resource_id="dataset-acl-shared",
+                        permission_keys=["dataset.acl.preview"],
+                    ),
+                    enterprise_rbac_service.ResourcePermissionKeys(
+                        resource_id="dataset-full",
+                        permission_keys=["dataset.full_access"],
+                    ),
+                    enterprise_rbac_service.ResourcePermissionKeys(
+                        resource_id="dataset-shared",
+                        permission_keys=["dataset.preview"],
+                    ),
+                    enterprise_rbac_service.ResourcePermissionKeys(
+                        resource_id="dataset-hidden",
+                        permission_keys=[],
+                    ),
+                ]
+            )
+        )
+
+        with app.test_request_context("/datasets"):
+            with (
+                patch("controllers.console.datasets.datasets.dify_config.RBAC_ENABLED", True),
+                patch.object(DatasetService, "get_datasets", return_value=([], 0)) as get_datasets,
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.MyPermissions.get",
+                    return_value=permissions,
+                ),
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.DatasetAccess.whitelist_resources",
+                    return_value=SimpleNamespace(
+                        resource_ids=[
+                            "dataset-shared",
+                            "dataset-acl-shared",
+                            "dataset-full",
+                            "dataset-whitelist-only",
+                        ]
+                    ),
+                ),
+                patch.object(
+                    ProviderManager,
+                    "get_configurations",
+                    return_value=MagicMock(get_models=lambda **_: []),
+                ),
+            ):
+                method(api, "tenant-1", current_user)
+
+        assert get_datasets.call_args.kwargs["accessible_dataset_ids"] == [
+            "dataset-acl-shared",
+            "dataset-full",
+            "dataset-shared",
+            "dataset-whitelist-only",
+        ]
+        assert get_datasets.call_args.kwargs["include_own_datasets"] is False
+
+    def test_get_with_ids_applies_dataset_visibility(self, app: Flask):
+        api = DatasetListApi()
+        method = unwrap(api.get)
+        current_user = self._mock_user()
+        permissions = enterprise_rbac_service.MyPermissionsResponse()
+
+        with app.test_request_context("/datasets?ids=dataset-1"):
+            with (
+                patch("controllers.console.datasets.datasets.dify_config.RBAC_ENABLED", True),
+                patch.object(DatasetService, "get_datasets_by_ids", return_value=([], 0)) as get_datasets_by_ids,
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.MyPermissions.get",
+                    return_value=permissions,
+                ),
+                patch(
+                    "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.DatasetAccess.whitelist_resources",
+                    return_value=SimpleNamespace(resource_ids=[]),
+                ),
+                patch.object(
+                    ProviderManager,
+                    "get_configurations",
+                    return_value=MagicMock(get_models=lambda **_: []),
+                ),
+            ):
+                method(api, "tenant-1", current_user)
+
+        get_datasets_by_ids.assert_called_once_with(
+            ["dataset-1"],
+            "tenant-1",
+            user=current_user,
+            accessible_dataset_ids=[],
+            include_own_datasets=False,
+        )
+
     def test_get_with_tag_ids(self, app: Flask):
         api = DatasetListApi()
         method = unwrap(api.get)
@@ -504,6 +701,51 @@ class TestDatasetApiGet:
         assert status == 200
         assert data["embedding_available"] is True
 
+    def test_get_attaches_permission_keys_when_rbac_enabled(self, app: Flask):
+        api = DatasetApi()
+        method = unwrap(api.get)
+
+        dataset_id = "123e4567-e89b-12d3-a456-426614174000"
+        user = MagicMock(id="account-1")
+        tenant_id = "tenant-1"
+        dataset = make_dataset(id=dataset_id)
+
+        with (
+            app.test_request_context(f"/datasets/{dataset_id}"),
+            patch("controllers.console.datasets.datasets.dify_config.RBAC_ENABLED", True),
+            patch.object(
+                DatasetService,
+                "get_dataset",
+                return_value=dataset,
+            ),
+            patch.object(
+                DatasetService,
+                "check_dataset_permission",
+                return_value=None,
+            ),
+            patch(
+                "controllers.console.datasets.datasets.enterprise_rbac_service.RBACService.MyPermissions.get",
+                return_value=enterprise_rbac_service.MyPermissionsResponse(
+                    dataset=enterprise_rbac_service.ResourcePermissionSnapshot(
+                        overrides=[
+                            enterprise_rbac_service.ResourcePermissionKeys(
+                                resource_id=dataset_id,
+                                permission_keys=["dataset.acl.readonly", "dataset.acl.edit"],
+                            )
+                        ]
+                    )
+                ),
+            ) as get_permissions,
+            patch("controllers.console.datasets.datasets.create_plugin_provider_manager") as provider_manager_mock,
+        ):
+            provider_manager_mock.return_value.get_configurations.return_value.get_models.return_value = []
+
+            data, status = method(api, tenant_id, user, dataset_id)
+
+        get_permissions.assert_called_once_with(tenant_id, user.id, dataset_id=dataset_id)
+        assert status == 200
+        assert data["permission_keys"] == ["dataset.acl.readonly", "dataset.acl.edit"]
+
     def test_get_uses_default_external_retrieval_model(self, app: Flask):
         api = DatasetApi()
         method = unwrap(api.get)
diff --git a/api/tests/unit_tests/controllers/console/datasets/test_external.py b/api/tests/unit_tests/controllers/console/datasets/test_external.py
index 7cb41dc99cd..b7e16b91fb7 100644
--- a/api/tests/unit_tests/controllers/console/datasets/test_external.py
+++ b/api/tests/unit_tests/controllers/console/datasets/test_external.py
@@ -171,6 +171,7 @@ class TestExternalDatasetCreateApi:
         dataset.external_retrieval_model = None
         dataset.doc_metadata = []
         dataset.icon_info = None
+        dataset.permission_keys = []
 
         dataset.summary_index_setting = MagicMock()
         dataset.summary_index_setting.enable = False
diff --git a/api/tests/unit_tests/controllers/console/explore/test_banner.py b/api/tests/unit_tests/controllers/console/explore/test_banner.py
index d1cb6b6a03d..552dc7d8217 100644
--- a/api/tests/unit_tests/controllers/console/explore/test_banner.py
+++ b/api/tests/unit_tests/controllers/console/explore/test_banner.py
@@ -1,4 +1,5 @@
 from datetime import datetime
+from inspect import unwrap
 from unittest.mock import MagicMock, patch
 
 from flask import Flask
@@ -7,12 +8,6 @@ import controllers.console.explore.banner as banner_module
 from models.enums import BannerStatus
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 class TestBannerApi:
     def test_get_banners_with_requested_language(self, app: Flask):
         api = banner_module.BannerApi()
diff --git a/api/tests/unit_tests/controllers/console/explore/test_installed_app.py b/api/tests/unit_tests/controllers/console/explore/test_installed_app.py
index be6275b5cb8..c5780e46ede 100644
--- a/api/tests/unit_tests/controllers/console/explore/test_installed_app.py
+++ b/api/tests/unit_tests/controllers/console/explore/test_installed_app.py
@@ -13,10 +13,7 @@ type Payload = dict[str, object]
 type PayloadPatch = Callable[[Payload], AbstractContextManager[object]]
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
+from inspect import unwrap
 
 
 @pytest.fixture
@@ -64,6 +61,7 @@ class TestInstalledAppsListApi:
         assert "app_model_configs" in compiled_filter
         assert "workflow_id" in compiled_filter
         assert "app_model_config_id" in compiled_filter
+        assert "apps.mode != 'agent'" in compiled_filter
 
     def test_get_installed_apps(
         self, app: Flask, current_user: MagicMock, tenant_id: str, installed_app: MagicMock
diff --git a/api/tests/unit_tests/controllers/console/explore/test_parameter.py b/api/tests/unit_tests/controllers/console/explore/test_parameter.py
index 7aaecbff14f..9ee9403baaf 100644
--- a/api/tests/unit_tests/controllers/console/explore/test_parameter.py
+++ b/api/tests/unit_tests/controllers/console/explore/test_parameter.py
@@ -1,3 +1,4 @@
+from inspect import unwrap
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -7,12 +8,6 @@ from controllers.console.app.error import AppUnavailableError
 from models.model import AppMode
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 class TestAppParameterApi:
     def test_get_app_none(self):
         api = module.AppParameterApi()
diff --git a/api/tests/unit_tests/controllers/console/explore/test_recommended_app.py b/api/tests/unit_tests/controllers/console/explore/test_recommended_app.py
index ef08aa1b36a..8a2e14cce9b 100644
--- a/api/tests/unit_tests/controllers/console/explore/test_recommended_app.py
+++ b/api/tests/unit_tests/controllers/console/explore/test_recommended_app.py
@@ -1,3 +1,4 @@
+from inspect import unwrap
 from unittest.mock import ANY, patch
 
 from flask import Flask
@@ -7,12 +8,6 @@ from models import Account
 from models.model import AppMode, IconType
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 def make_account(interface_language: str | None) -> Account:
     account = Account(name="Test User", email="user@example.com")
     account.id = "account-1"
diff --git a/api/tests/unit_tests/controllers/console/explore/test_saved_message.py b/api/tests/unit_tests/controllers/console/explore/test_saved_message.py
index 07e674afad6..ae05b8f6a0e 100644
--- a/api/tests/unit_tests/controllers/console/explore/test_saved_message.py
+++ b/api/tests/unit_tests/controllers/console/explore/test_saved_message.py
@@ -1,3 +1,4 @@
+from inspect import unwrap
 from unittest.mock import MagicMock, PropertyMock, patch
 from uuid import uuid4
 
@@ -10,12 +11,6 @@ from controllers.console.explore.error import NotCompletionAppError
 from services.errors.message import MessageNotExistsError
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 def make_saved_message():
     msg = MagicMock()
     msg.id = str(uuid4())
@@ -68,7 +63,7 @@ class TestSavedMessageListApi:
             result = method(api, current_user, installed_app)
 
         pagination_mock.assert_called_once()
-        assert pagination_mock.call_args.args[1] is current_user
+        assert pagination_mock.call_args.args[2] is current_user
         assert result["limit"] == 20
         assert result["has_more"] is False
         assert len(result["data"]) == 2
@@ -101,7 +96,7 @@ class TestSavedMessageListApi:
             result = method(api, current_user, installed_app)
 
         save_mock.assert_called_once()
-        assert save_mock.call_args.args[1] is current_user
+        assert save_mock.call_args.args[2] is current_user
         assert result == {"result": "success"}
 
     def test_post_message_not_exists(self, app: Flask, payload_patch):
@@ -141,7 +136,7 @@ class TestSavedMessageApi:
             result, status = method(api, current_user, installed_app, str(uuid4()))
 
         delete_mock.assert_called_once()
-        assert delete_mock.call_args.args[1] is current_user
+        assert delete_mock.call_args.args[2] is current_user
         assert status == 204
         assert result == ""
 
diff --git a/api/tests/unit_tests/controllers/console/explore/test_workflow.py b/api/tests/unit_tests/controllers/console/explore/test_workflow.py
index c5b2f0bd9ba..83cfcadd093 100644
--- a/api/tests/unit_tests/controllers/console/explore/test_workflow.py
+++ b/api/tests/unit_tests/controllers/console/explore/test_workflow.py
@@ -1,3 +1,4 @@
+from inspect import unwrap
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -14,12 +15,6 @@ from models.model import AppMode
 from services.errors.llm import InvokeRateLimitError
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 @pytest.fixture
 def app():
     app = Flask(__name__)
diff --git a/api/tests/unit_tests/controllers/console/explore/test_wraps.py b/api/tests/unit_tests/controllers/console/explore/test_wraps.py
index 2c1acfc3d65..69c380487ed 100644
--- a/api/tests/unit_tests/controllers/console/explore/test_wraps.py
+++ b/api/tests/unit_tests/controllers/console/explore/test_wraps.py
@@ -18,12 +18,6 @@ from controllers.console.explore.wraps import (
 )
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 def test_installed_app_required_not_found():
     @installed_app_required
     def view(installed_app):
diff --git a/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow.py b/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow.py
index cfc0299cc2c..11916c87b68 100644
--- a/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow.py
+++ b/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow.py
@@ -6,6 +6,7 @@ from types import SimpleNamespace
 from unittest.mock import Mock
 
 import pytest
+from flask import Flask
 from werkzeug.exceptions import HTTPException, NotFound
 
 from controllers.console.snippets import snippet_workflow as snippet_workflow_module
@@ -52,7 +53,7 @@ def test_get_snippet_requires_snippet_id(app):
             view()
 
 
-def test_get_snippet_injects_resolved_snippet(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_get_snippet_injects_resolved_snippet(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     snippet = _snippet()
 
     @snippet_workflow_module.get_snippet
@@ -72,7 +73,7 @@ def test_get_snippet_injects_resolved_snippet(app, monkeypatch: pytest.MonkeyPat
     assert result is snippet
 
 
-def test_get_snippet_raises_not_found_when_snippet_missing(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_get_snippet_raises_not_found_when_snippet_missing(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     @snippet_workflow_module.get_snippet
     def view(**kwargs):
         return kwargs
@@ -89,7 +90,7 @@ def test_get_snippet_raises_not_found_when_snippet_missing(app, monkeypatch: pyt
             view(snippet_id="snippet-1")
 
 
-def test_draft_workflow_get_raises_when_missing(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_draft_workflow_get_raises_when_missing(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     snippet = _snippet()
     monkeypatch.setattr(
         snippet_workflow_module,
@@ -105,7 +106,7 @@ def test_draft_workflow_get_raises_when_missing(app, monkeypatch: pytest.MonkeyP
             handler(api, snippet=snippet)
 
 
-def test_draft_workflow_post_returns_400_for_invalid_graph(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_draft_workflow_post_returns_400_for_invalid_graph(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     user = _account("account-1")
     snippet = _snippet()
     sync_draft_workflow = Mock(side_effect=ValueError("invalid graph"))
@@ -145,7 +146,7 @@ def test_published_workflow_get_returns_none_when_not_published(app) -> None:
         assert handler(api, snippet=SimpleNamespace(id="snippet-1", is_published=False)) is None
 
 
-def test_published_workflow_post_returns_400_when_publish_fails(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_published_workflow_post_returns_400_when_publish_fails(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     user = _account("account-1")
     snippet = _snippet()
     merged_snippet = _snippet()
@@ -180,7 +181,7 @@ def test_published_workflow_post_returns_400_when_publish_fails(app, monkeypatch
     session.commit.assert_not_called()
 
 
-def test_default_block_configs_delegates_to_service(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_default_block_configs_delegates_to_service(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     get_default_block_configs = Mock(return_value=[{"type": "llm"}])
     monkeypatch.setattr(
         snippet_workflow_module,
@@ -198,7 +199,7 @@ def test_default_block_configs_delegates_to_service(app, monkeypatch: pytest.Mon
     get_default_block_configs.assert_called_once()
 
 
-def test_restore_published_snippet_workflow_to_draft_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_restore_published_snippet_workflow_to_draft_success(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     workflow = SimpleNamespace(
         unique_hash="restored-hash",
         updated_at=None,
@@ -226,7 +227,7 @@ def test_restore_published_snippet_workflow_to_draft_success(app, monkeypatch: p
     assert response["hash"] == "restored-hash"
 
 
-def test_restore_published_snippet_workflow_to_draft_not_found(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_restore_published_snippet_workflow_to_draft_not_found(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     user = _account("account-1")
     snippet = _snippet()
 
@@ -311,7 +312,7 @@ def test_restore_published_snippet_workflow_to_draft_returns_400_for_invalid_gra
     assert exc.value.description == "invalid snippet workflow graph"
 
 
-def test_workflow_run_detail_raises_not_found_when_run_missing(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_workflow_run_detail_raises_not_found_when_run_missing(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     snippet = _snippet()
     monkeypatch.setattr(
         snippet_workflow_module,
@@ -327,7 +328,9 @@ def test_workflow_run_detail_raises_not_found_when_run_missing(app, monkeypatch:
             handler(api, snippet=snippet, run_id="run-1")
 
 
-def test_draft_node_last_run_raises_not_found_when_execution_missing(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_draft_node_last_run_raises_not_found_when_execution_missing(
+    app: Flask, monkeypatch: pytest.MonkeyPatch
+) -> None:
     snippet = _snippet()
     draft_workflow = SimpleNamespace(id="workflow-1")
     monkeypatch.setattr(
@@ -347,7 +350,7 @@ def test_draft_node_last_run_raises_not_found_when_execution_missing(app, monkey
             handler(api, snippet=snippet, node_id="llm-1")
 
 
-def test_workflow_task_stop_uses_queue_flag_and_graph_command(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_workflow_task_stop_uses_queue_flag_and_graph_command(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     set_stop_flag = Mock()
     send_stop_command = Mock()
     monkeypatch.setattr(
diff --git a/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow_draft_variable.py b/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow_draft_variable.py
index b885b9d601f..e6bee6fe1d3 100644
--- a/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow_draft_variable.py
+++ b/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow_draft_variable.py
@@ -27,7 +27,7 @@ def _make_account() -> Account:
 
 
 @pytest.fixture(autouse=True)
-def _patch_snippet_service_factory(monkeypatch):
+def _patch_snippet_service_factory(monkeypatch: pytest.MonkeyPatch):
     def factory():
         service_factory = module.SnippetService
         if isinstance(service_factory, type):
@@ -64,7 +64,7 @@ def test_ensure_snippet_draft_variable_row_allowed_accepts_canvas_node_variable(
     module._ensure_snippet_draft_variable_row_allowed(variable=variable, variable_id="var-1")
 
 
-def test_conversation_variables_returns_empty_list(app):
+def test_conversation_variables_returns_empty_list(app: Flask):
     api = module.SnippetConversationVariableCollectionApi()
     handler = _unwrap(api.get)
 
@@ -74,7 +74,7 @@ def test_conversation_variables_returns_empty_list(app):
     assert result == WorkflowDraftVariableList(variables=[])
 
 
-def test_system_variables_returns_empty_list(app):
+def test_system_variables_returns_empty_list(app: Flask):
     api = module.SnippetSystemVariableCollectionApi()
     handler = _unwrap(api.get)
 
@@ -84,7 +84,7 @@ def test_system_variables_returns_empty_list(app):
     assert result == WorkflowDraftVariableList(variables=[])
 
 
-def test_delete_variable_collection_deletes_current_user_variables(app, monkeypatch):
+def test_delete_variable_collection_deletes_current_user_variables(app: Flask, monkeypatch: pytest.MonkeyPatch):
     draft_var_service = SimpleNamespace(delete_user_workflow_variables=Mock())
     monkeypatch.setattr(module, "WorkflowDraftVariableService", Mock(return_value=draft_var_service))
     db_session = Mock()
@@ -101,7 +101,7 @@ def test_delete_variable_collection_deletes_current_user_variables(app, monkeypa
     db_session.commit.assert_called_once()
 
 
-def test_variable_collection_get_raises_when_draft_workflow_missing(app, monkeypatch):
+def test_variable_collection_get_raises_when_draft_workflow_missing(app: Flask, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr(
         module,
         "SnippetService",
@@ -116,7 +116,7 @@ def test_variable_collection_get_raises_when_draft_workflow_missing(app, monkeyp
             handler(api, _make_account(), snippet=SimpleNamespace(id="snippet-1"))
 
 
-def test_node_variable_collection_get_lists_node_variables(app, monkeypatch):
+def test_node_variable_collection_get_lists_node_variables(app: Flask, monkeypatch: pytest.MonkeyPatch):
     variables = WorkflowDraftVariableList(variables=[SimpleNamespace(id="var-1")])
     list_node_variables = Mock(return_value=variables)
 
@@ -149,7 +149,7 @@ def test_node_variable_collection_get_lists_node_variables(app, monkeypatch):
     list_node_variables.assert_called_once_with("snippet-1", "llm-1", user_id="user-1")
 
 
-def test_node_variable_collection_delete_deletes_node_variables(app, monkeypatch):
+def test_node_variable_collection_delete_deletes_node_variables(app: Flask, monkeypatch: pytest.MonkeyPatch):
     delete_node_variables = Mock()
     draft_var_service = SimpleNamespace(delete_node_variables=delete_node_variables)
     monkeypatch.setattr(module, "WorkflowDraftVariableService", Mock(return_value=draft_var_service))
@@ -168,7 +168,7 @@ def test_node_variable_collection_delete_deletes_node_variables(app, monkeypatch
     db_session.commit.assert_called_once()
 
 
-def test_variable_patch_returns_variable_when_no_changes(app, monkeypatch):
+def test_variable_patch_returns_variable_when_no_changes(app: Flask, monkeypatch: pytest.MonkeyPatch):
     variable = SimpleNamespace(id="var-1", app_id="snippet-1", user_id="user-1", node_id="llm-1")
     draft_var_service = SimpleNamespace(get_variable=Mock(return_value=variable), update_variable=Mock())
     db_session = Mock()
@@ -192,7 +192,7 @@ def test_variable_patch_returns_variable_when_no_changes(app, monkeypatch):
     db_session.commit.assert_not_called()
 
 
-def test_variable_delete_deletes_variable(app, monkeypatch):
+def test_variable_delete_deletes_variable(app: Flask, monkeypatch: pytest.MonkeyPatch):
     variable = SimpleNamespace(id="var-1", app_id="snippet-1", user_id="user-1", node_id="llm-1")
     delete_variable = Mock()
     draft_var_service = SimpleNamespace(get_variable=Mock(return_value=variable), delete_variable=delete_variable)
@@ -212,7 +212,7 @@ def test_variable_delete_deletes_variable(app, monkeypatch):
     db_session.commit.assert_called_once()
 
 
-def test_variable_reset_returns_no_content_when_reset_result_is_none(app, monkeypatch):
+def test_variable_reset_returns_no_content_when_reset_result_is_none(app: Flask, monkeypatch: pytest.MonkeyPatch):
     variable = SimpleNamespace(id="var-1", app_id="snippet-1", user_id="user-1", node_id="llm-1")
     draft_workflow = SimpleNamespace(id="workflow-1")
     draft_var_service = SimpleNamespace(
@@ -240,7 +240,7 @@ def test_variable_reset_returns_no_content_when_reset_result_is_none(app, monkey
     db_session.commit.assert_called_once()
 
 
-def test_environment_variables_returns_workflow_environment_variables(app, monkeypatch):
+def test_environment_variables_returns_workflow_environment_variables(app: Flask, monkeypatch: pytest.MonkeyPatch):
     env_var = SimpleNamespace(
         id="env-1",
         name="API_KEY",
diff --git a/api/tests/unit_tests/controllers/console/tag/test_tags.py b/api/tests/unit_tests/controllers/console/tag/test_tags.py
index dc3dd00a6c0..84a70835437 100644
--- a/api/tests/unit_tests/controllers/console/tag/test_tags.py
+++ b/api/tests/unit_tests/controllers/console/tag/test_tags.py
@@ -2,15 +2,8 @@ from types import SimpleNamespace
 from unittest.mock import MagicMock, PropertyMock, patch
 
 import pytest
-from sqlalchemy.orm import Session
-
-
-class SessionMatcher:
-    def __eq__(self, other):
-        return isinstance(other, Session)
-
-
 from flask import Flask
+from sqlalchemy.orm import Session, scoped_session
 from werkzeug.exceptions import Forbidden
 
 import controllers.console.tag.tags as module
@@ -27,6 +20,11 @@ from models.enums import TagType
 from services.tag_service import UpdateTagPayload
 
 
+class SessionMatcher:
+    def __eq__(self, other):
+        return isinstance(other, Session | scoped_session)
+
+
 def unwrap(func):
     """
     Recursively unwrap decorated functions.
@@ -193,9 +191,10 @@ class TestTagUpdateDeleteApi:
                 result, status = method(api, admin_user, "tag-1")
 
         assert status == 200
-        update_payload, tag_id = update_tags_mock.call_args.args
+        update_payload, tag_id, session = update_tags_mock.call_args.args
         assert update_payload == UpdateTagPayload(name="updated")
         assert tag_id == "tag-1"
+        assert session == module.db.session
         assert result["binding_count"] == "3"
 
     def test_patch_forbidden(self, app: Flask, readonly_user, payload_patch):
@@ -221,7 +220,7 @@ class TestTagUpdateDeleteApi:
         ):
             result, status = method(api, "tag-1")
 
-        delete_mock.assert_called_once_with("tag-1")
+        delete_mock.assert_called_once_with("tag-1", module.db.session)
         assert status == 204
 
 
diff --git a/api/tests/unit_tests/controllers/console/test_extension.py b/api/tests/unit_tests/controllers/console/test_extension.py
index 487cf8f54fd..bab825ca6f0 100644
--- a/api/tests/unit_tests/controllers/console/test_extension.py
+++ b/api/tests/unit_tests/controllers/console/test_extension.py
@@ -3,7 +3,7 @@ from __future__ import annotations
 import builtins
 import uuid
 from datetime import UTC, datetime
-from unittest.mock import MagicMock
+from unittest.mock import ANY, MagicMock
 
 import pytest
 from flask import Flask
@@ -114,7 +114,7 @@ def test_api_based_extension_get_returns_tenant_extensions(app: Flask, monkeypat
     assert response[0]["name"] == "Weather API"
     assert response[0]["api_endpoint"] == extension.api_endpoint
     assert response[0]["api_key"].startswith(extension.api_key[:3])
-    service_mock.assert_called_once_with("tenant-123")
+    service_mock.assert_called_once_with(ANY, "tenant-123")
 
 
 def test_api_based_extension_post_creates_extension(app: Flask, monkeypatch: pytest.MonkeyPatch):
@@ -132,7 +132,7 @@ def test_api_based_extension_post_creates_extension(app: Flask, monkeypatch: pyt
         response, status = APIBasedExtensionAPI().post()
 
     args, _ = save_mock.call_args
-    created_extension: APIBasedExtension = args[0]
+    created_extension: APIBasedExtension = args[1]
     assert created_extension.tenant_id == "tenant-123"
     assert created_extension.name == payload["name"]
     assert created_extension.api_endpoint == payload["api_endpoint"]
@@ -157,7 +157,7 @@ def test_api_based_extension_detail_get_fetches_extension(app: Flask, monkeypatc
 
     assert response["id"] == extension.id
     assert response["name"] == extension.name
-    service_mock.assert_called_once_with("tenant-123", str(extension_id))
+    service_mock.assert_called_once_with(ANY, "tenant-123", str(extension_id))
 
 
 def test_api_based_extension_detail_post_keeps_hidden_api_key(app: Flask, monkeypatch: pytest.MonkeyPatch):
@@ -187,7 +187,7 @@ def test_api_based_extension_detail_post_keeps_hidden_api_key(app: Flask, monkey
     assert existing_extension.name == payload["name"]
     assert existing_extension.api_endpoint == payload["api_endpoint"]
     assert existing_extension.api_key == "keep-me"
-    save_mock.assert_called_once_with(existing_extension)
+    save_mock.assert_called_once_with(ANY, existing_extension)
     assert response["name"] == payload["name"]
     assert response["api_key"] == _masked_api_key("keep-me")
 
@@ -217,7 +217,7 @@ def test_api_based_extension_detail_post_updates_api_key_when_provided(app: Flas
         response = APIBasedExtensionDetailAPI().post(extension_id)
 
     assert existing_extension.api_key == "new-secret"
-    save_mock.assert_called_once_with(existing_extension)
+    save_mock.assert_called_once_with(ANY, existing_extension)
     assert response["name"] == payload["name"]
     assert response["api_key"] == _masked_api_key(payload["api_key"])
 
@@ -239,6 +239,6 @@ def test_api_based_extension_detail_delete_removes_extension(app: Flask, monkeyp
     ):
         response, status = APIBasedExtensionDetailAPI().delete(extension_id)
 
-    delete_mock.assert_called_once_with(existing_extension)
+    delete_mock.assert_called_once_with(ANY, existing_extension)
     assert status == 204
     assert response == ""
diff --git a/api/tests/unit_tests/controllers/console/test_init_validate.py b/api/tests/unit_tests/controllers/console/test_init_validate.py
index 3077304cbed..4954e0dc96a 100644
--- a/api/tests/unit_tests/controllers/console/test_init_validate.py
+++ b/api/tests/unit_tests/controllers/console/test_init_validate.py
@@ -4,6 +4,7 @@ from types import SimpleNamespace
 from unittest.mock import Mock
 
 import pytest
+from flask import Flask
 
 from controllers.console import init_validate
 from controllers.console.error import AlreadySetupError, InitValidateFailedError
@@ -35,7 +36,7 @@ def test_get_init_status_not_started(monkeypatch: pytest.MonkeyPatch) -> None:
     assert result.status == "not_started"
 
 
-def test_validate_init_password_already_setup(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_validate_init_password_already_setup(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(init_validate.dify_config, "EDITION", "SELF_HOSTED")
     monkeypatch.setattr(init_validate.TenantService, "get_tenant_count", lambda: 1)
     app.secret_key = "test-secret"
@@ -45,7 +46,7 @@ def test_validate_init_password_already_setup(app, monkeypatch: pytest.MonkeyPat
             init_validate.validate_init_password(init_validate.InitValidatePayload(password="pw"))
 
 
-def test_validate_init_password_wrong_password(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_validate_init_password_wrong_password(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(init_validate.dify_config, "EDITION", "SELF_HOSTED")
     monkeypatch.setattr(init_validate.TenantService, "get_tenant_count", lambda: 0)
     monkeypatch.setenv("INIT_PASSWORD", "expected")
@@ -57,7 +58,7 @@ def test_validate_init_password_wrong_password(app, monkeypatch: pytest.MonkeyPa
         assert init_validate.session.get("is_init_validated") is False
 
 
-def test_validate_init_password_success(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_validate_init_password_success(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(init_validate.dify_config, "EDITION", "SELF_HOSTED")
     monkeypatch.setattr(init_validate.TenantService, "get_tenant_count", lambda: 0)
     monkeypatch.setenv("INIT_PASSWORD", "expected")
@@ -74,7 +75,7 @@ def test_get_init_validate_status_not_self_hosted(monkeypatch: pytest.MonkeyPatc
     assert init_validate.get_init_validate_status() is True
 
 
-def test_get_init_validate_status_validated_session(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_get_init_validate_status_validated_session(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(init_validate.dify_config, "EDITION", "SELF_HOSTED")
     monkeypatch.setenv("INIT_PASSWORD", "expected")
     app.secret_key = "test-secret"
@@ -84,7 +85,7 @@ def test_get_init_validate_status_validated_session(app, monkeypatch: pytest.Mon
         assert init_validate.get_init_validate_status() is True
 
 
-def test_get_init_validate_status_setup_exists(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_get_init_validate_status_setup_exists(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(init_validate.dify_config, "EDITION", "SELF_HOSTED")
     monkeypatch.setenv("INIT_PASSWORD", "expected")
     monkeypatch.setattr(init_validate, "Session", lambda *_args, **_kwargs: _SessionStub(True))
@@ -96,7 +97,7 @@ def test_get_init_validate_status_setup_exists(app, monkeypatch: pytest.MonkeyPa
         assert init_validate.get_init_validate_status() is True
 
 
-def test_get_init_validate_status_not_validated(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_get_init_validate_status_not_validated(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(init_validate.dify_config, "EDITION", "SELF_HOSTED")
     monkeypatch.setenv("INIT_PASSWORD", "expected")
     monkeypatch.setattr(init_validate, "Session", lambda *_args, **_kwargs: _SessionStub(False))
diff --git a/api/tests/unit_tests/controllers/console/test_remote_files.py b/api/tests/unit_tests/controllers/console/test_remote_files.py
index e7127aef236..25245e743c5 100644
--- a/api/tests/unit_tests/controllers/console/test_remote_files.py
+++ b/api/tests/unit_tests/controllers/console/test_remote_files.py
@@ -8,6 +8,7 @@ from unittest.mock import MagicMock
 
 import httpx
 import pytest
+from flask import Flask
 
 from controllers.common.errors import FileTooLargeError, RemoteFileUploadError, UnsupportedFileTypeError
 from controllers.console import remote_files as remote_files_module
@@ -82,7 +83,7 @@ def _mock_upload_dependencies(
     return file_service_cls, current_user
 
 
-def test_get_remote_file_info_uses_head_when_successful(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_get_remote_file_info_uses_head_when_successful(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = remote_files_module.GetRemoteFileInfo()
     handler = unwrap(api.get)
     decoded_url = "https://example.com/test.txt"
@@ -103,7 +104,7 @@ def test_get_remote_file_info_uses_head_when_successful(app, monkeypatch: pytest
     make_request.assert_called_once_with("HEAD", decoded_url)
 
 
-def test_get_remote_file_info_preserves_unencoded_target_query(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_get_remote_file_info_preserves_unencoded_target_query(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = remote_files_module.GetRemoteFileInfo()
     handler = unwrap(api.get)
     target_url = "http://example.com/api/aiagent/httpview/txt"
@@ -124,7 +125,9 @@ def test_get_remote_file_info_preserves_unencoded_target_query(app, monkeypatch:
     make_request.assert_called_once_with("HEAD", f"{target_url}?{query}")
 
 
-def test_get_remote_file_info_falls_back_to_get_and_uses_default_headers(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_get_remote_file_info_falls_back_to_get_and_uses_default_headers(
+    app: Flask, monkeypatch: pytest.MonkeyPatch
+) -> None:
     api = remote_files_module.GetRemoteFileInfo()
     handler = unwrap(api.get)
     decoded_url = "https://example.com/test.txt"
@@ -147,7 +150,7 @@ def test_get_remote_file_info_falls_back_to_get_and_uses_default_headers(app, mo
     assert make_request.call_args_list[1].kwargs == {"timeout": 3}
 
 
-def test_remote_file_upload_success_when_fetch_falls_back_to_get(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_remote_file_upload_success_when_fetch_falls_back_to_get(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = remote_files_module.RemoteFileUpload()
     handler = unwrap(api.post)
     url = "https://example.com/report.txt"
@@ -220,7 +223,7 @@ def test_remote_file_upload_fetches_content_with_second_get_when_head_succeeds(
     assert file_service_cls.return_value.upload_file.call_args.kwargs["content"] == b"downloaded-content"
 
 
-def test_remote_file_upload_raises_when_fallback_get_still_not_ok(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_remote_file_upload_raises_when_fallback_get_still_not_ok(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = remote_files_module.RemoteFileUpload()
     handler = unwrap(api.post)
     url = "https://example.com/fail.txt"
@@ -238,7 +241,7 @@ def test_remote_file_upload_raises_when_fallback_get_still_not_ok(app, monkeypat
             handler(api, _make_account())
 
 
-def test_remote_file_upload_raises_on_httpx_request_error(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_remote_file_upload_raises_on_httpx_request_error(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = remote_files_module.RemoteFileUpload()
     handler = unwrap(api.post)
     url = "https://example.com/fail.txt"
@@ -252,7 +255,7 @@ def test_remote_file_upload_raises_on_httpx_request_error(app, monkeypatch: pyte
             handler(api, _make_account())
 
 
-def test_remote_file_upload_rejects_oversized_file(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_remote_file_upload_rejects_oversized_file(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     api = remote_files_module.RemoteFileUpload()
     handler = unwrap(api.post)
     url = "https://example.com/large.bin"
@@ -267,7 +270,9 @@ def test_remote_file_upload_rejects_oversized_file(app, monkeypatch: pytest.Monk
             handler(api, current_user)
 
 
-def test_remote_file_upload_translates_service_file_too_large_error(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_remote_file_upload_translates_service_file_too_large_error(
+    app: Flask, monkeypatch: pytest.MonkeyPatch
+) -> None:
     api = remote_files_module.RemoteFileUpload()
     handler = unwrap(api.post)
     url = "https://example.com/large.bin"
@@ -282,7 +287,9 @@ def test_remote_file_upload_translates_service_file_too_large_error(app, monkeyp
             handler(api, current_user)
 
 
-def test_remote_file_upload_translates_service_unsupported_type_error(app, monkeypatch: pytest.MonkeyPatch) -> None:
+def test_remote_file_upload_translates_service_unsupported_type_error(
+    app: Flask, monkeypatch: pytest.MonkeyPatch
+) -> None:
     api = remote_files_module.RemoteFileUpload()
     handler = unwrap(api.post)
     url = "https://example.com/file.exe"
diff --git a/api/tests/unit_tests/controllers/console/test_spec.py b/api/tests/unit_tests/controllers/console/test_spec.py
index 05a4befaa83..84c2004ec70 100644
--- a/api/tests/unit_tests/controllers/console/test_spec.py
+++ b/api/tests/unit_tests/controllers/console/test_spec.py
@@ -1,14 +1,9 @@
+from inspect import unwrap
 from unittest.mock import patch
 
 import controllers.console.spec as spec_module
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 class TestSpecSchemaDefinitionsApi:
     def test_get_success(self):
         api = spec_module.SpecSchemaDefinitionsApi()
diff --git a/api/tests/unit_tests/controllers/console/test_version.py b/api/tests/unit_tests/controllers/console/test_version.py
index 8d8d324be1f..667e4f6f415 100644
--- a/api/tests/unit_tests/controllers/console/test_version.py
+++ b/api/tests/unit_tests/controllers/console/test_version.py
@@ -1,5 +1,8 @@
+import logging
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 import controllers.console.version as version_module
 
 
@@ -18,15 +21,15 @@ class TestHasNewVersion:
         )
         assert result is False
 
-    def test_has_new_version_invalid_version(self):
-        with patch.object(version_module.logger, "warning") as log_warning:
+    def test_has_new_version_invalid_version(self, caplog: pytest.LogCaptureFixture):
+        with caplog.at_level(logging.WARNING, logger="controllers.console.version"):
             result = version_module._has_new_version(
                 latest_version="invalid",
                 current_version="1.0.0",
             )
 
         assert result is False
-        log_warning.assert_called_once()
+        assert "Invalid version format" in caplog.text
 
 
 class TestCheckVersionUpdate:
diff --git a/api/tests/unit_tests/controllers/console/test_workspace_account.py b/api/tests/unit_tests/controllers/console/test_workspace_account.py
index c39d0930bec..e419428ca66 100644
--- a/api/tests/unit_tests/controllers/console/test_workspace_account.py
+++ b/api/tests/unit_tests/controllers/console/test_workspace_account.py
@@ -102,10 +102,10 @@ class TestChangeEmailSend:
     @patch("controllers.console.workspace.account.extract_remote_ip", return_value="127.0.0.1")
     def test_should_normalize_new_email_phase(
         self,
-        mock_extract_ip,
-        mock_is_ip_limit,
-        mock_send_email,
-        mock_get_change_data,
+        mock_extract_ip: MagicMock,
+        mock_is_ip_limit: MagicMock,
+        mock_send_email: MagicMock,
+        mock_get_change_data: MagicMock,
         app: Flask,
     ):
         mock_account = _build_account("current@example.com", "acc1")
@@ -143,10 +143,10 @@ class TestChangeEmailSend:
     @patch("controllers.console.workspace.account.extract_remote_ip", return_value="127.0.0.1")
     def test_should_reject_new_email_phase_when_token_phase_is_not_old_verified(
         self,
-        mock_extract_ip,
-        mock_is_ip_limit,
-        mock_send_email,
-        mock_get_change_data,
+        mock_extract_ip: MagicMock,
+        mock_is_ip_limit: MagicMock,
+        mock_send_email: MagicMock,
+        mock_get_change_data: MagicMock,
         app: Flask,
     ):
         """GHSA-4q3w-q5mc-45rq: a phase-1 token must not unlock the new-email send step."""
@@ -178,10 +178,10 @@ class TestChangeEmailSend:
     @patch("controllers.console.workspace.account.extract_remote_ip", return_value="127.0.0.1")
     def test_should_reject_new_email_phase_when_token_account_id_does_not_match_current_user(
         self,
-        mock_extract_ip,
-        mock_is_ip_limit,
-        mock_send_email,
-        mock_get_change_data,
+        mock_extract_ip: MagicMock,
+        mock_is_ip_limit: MagicMock,
+        mock_send_email: MagicMock,
+        mock_get_change_data: MagicMock,
         app: Flask,
     ):
         from controllers.console.auth.error import InvalidTokenError
diff --git a/api/tests/unit_tests/controllers/console/test_workspace_members.py b/api/tests/unit_tests/controllers/console/test_workspace_members.py
index d8d1d02a169..cb06dbc27cd 100644
--- a/api/tests/unit_tests/controllers/console/test_workspace_members.py
+++ b/api/tests/unit_tests/controllers/console/test_workspace_members.py
@@ -49,6 +49,7 @@ class TestMemberInviteEmailApi:
         inviter = SimpleNamespace(email="Owner@Example.com", current_tenant=tenant, status="active")
 
         with (
+            patch("controllers.console.workspace.members.dify_config.RBAC_ENABLED", False),
             patch("controllers.console.workspace.members.dify_config.CONSOLE_WEB_URL", "https://console.example.com"),
             patch("controllers.console.workspace.members._count_new_member_invites", return_value=1),
             patch("controllers.console.workspace.members.dify_config.ENTERPRISE_ENABLED", False),
@@ -76,3 +77,116 @@ class TestMemberInviteEmailApi:
         assert call_args.kwargs["role"] == TenantAccountRole.EDITOR
         assert call_args.kwargs["inviter"] == account
         mock_csrf.assert_called_once_with(ANY, account.id)
+
+    @patch("controllers.console.workspace.members.FeatureService.get_features")
+    @patch("controllers.console.workspace.members.RegisterService.invite_new_member")
+    @patch("controllers.console.workspace.members.current_account_with_tenant")
+    @patch("controllers.console.wraps.db")
+    @patch("libs.login.check_csrf_token", return_value=None)
+    def test_invite_rbac_enabled_accepts_rbac_role_id(
+        self,
+        mock_csrf,
+        mock_db,
+        mock_current_account,
+        mock_invite_member,
+        mock_get_features,
+        app,
+    ):
+        """When RBAC is enabled, any non-empty role string should be accepted."""
+        mock_get_features.return_value = _build_feature_flags()
+        mock_invite_member.return_value = "rbac-token"
+
+        tenant = SimpleNamespace(id="tenant-1", name="Test Tenant")
+        inviter = SimpleNamespace(email="inviter@example.com", current_tenant=tenant, status="active")
+        mock_current_account.return_value = (inviter, tenant.id)
+
+        with patch("controllers.console.workspace.members.dify_config") as mock_config:
+            mock_config.RBAC_ENABLED = True
+            mock_config.CONSOLE_WEB_URL = "https://console.example.com"
+            with app.test_request_context(
+                "/workspaces/current/members/invite-email",
+                method="POST",
+                json={"emails": ["user@example.com"], "role": "rbac-role-id-abc", "language": "en-US"},
+            ):
+                account = Account(name="tester", email="tester@example.com")
+                account._current_tenant = tenant
+                g._login_user = account
+                g._current_tenant = tenant
+                response, status_code = MemberInviteEmailApi().post()
+
+        assert status_code == 201
+        mock_invite_member.assert_called_once()
+        call_args = mock_invite_member.call_args
+        assert call_args.kwargs["role"] == "rbac-role-id-abc"
+
+    @patch("controllers.console.workspace.members.FeatureService.get_features")
+    @patch("controllers.console.workspace.members.current_account_with_tenant")
+    @patch("controllers.console.wraps.db")
+    @patch("libs.login.check_csrf_token", return_value=None)
+    def test_invite_rbac_disabled_rejects_invalid_role(
+        self,
+        mock_csrf,
+        mock_db,
+        mock_current_account,
+        mock_get_features,
+        app,
+    ):
+        """When RBAC is disabled, an invalid role string should be rejected."""
+        mock_get_features.return_value = _build_feature_flags()
+
+        tenant = SimpleNamespace(id="tenant-1", name="Test Tenant")
+        inviter = SimpleNamespace(email="inviter@example.com", current_tenant=tenant, status="active")
+        mock_current_account.return_value = (inviter, tenant.id)
+
+        with patch("controllers.console.workspace.members.dify_config") as mock_config:
+            mock_config.RBAC_ENABLED = False
+            mock_config.CONSOLE_WEB_URL = "https://console.example.com"
+            with app.test_request_context(
+                "/workspaces/current/members/invite-email",
+                method="POST",
+                json={"emails": ["user@example.com"], "role": "invalid-role", "language": "en-US"},
+            ):
+                account = Account(name="tester", email="tester@example.com")
+                account._current_tenant = tenant
+                g._login_user = account
+                g._current_tenant = tenant
+                response, status_code = MemberInviteEmailApi().post()
+
+        assert status_code == 400
+        assert response["code"] == "invalid-role"
+
+    @patch("controllers.console.workspace.members.FeatureService.get_features")
+    @patch("controllers.console.workspace.members.current_account_with_tenant")
+    @patch("controllers.console.wraps.db")
+    @patch("libs.login.check_csrf_token", return_value=None)
+    def test_invite_rbac_disabled_rejects_owner_role(
+        self,
+        mock_csrf,
+        mock_db,
+        mock_current_account,
+        mock_get_features,
+        app,
+    ):
+        """When RBAC is disabled, owner role should be rejected for invite."""
+        mock_get_features.return_value = _build_feature_flags()
+
+        tenant = SimpleNamespace(id="tenant-1", name="Test Tenant")
+        inviter = SimpleNamespace(email="inviter@example.com", current_tenant=tenant, status="active")
+        mock_current_account.return_value = (inviter, tenant.id)
+
+        with patch("controllers.console.workspace.members.dify_config") as mock_config:
+            mock_config.RBAC_ENABLED = False
+            mock_config.CONSOLE_WEB_URL = "https://console.example.com"
+            with app.test_request_context(
+                "/workspaces/current/members/invite-email",
+                method="POST",
+                json={"emails": ["user@example.com"], "role": "owner", "language": "en-US"},
+            ):
+                account = Account(name="tester", email="tester@example.com")
+                account._current_tenant = tenant
+                g._login_user = account
+                g._current_tenant = tenant
+                response, status_code = MemberInviteEmailApi().post()
+
+        assert status_code == 400
+        assert response["code"] == "invalid-role"
diff --git a/api/tests/unit_tests/controllers/console/test_wraps.py b/api/tests/unit_tests/controllers/console/test_wraps.py
index 937505dab28..618a1f52180 100644
--- a/api/tests/unit_tests/controllers/console/test_wraps.py
+++ b/api/tests/unit_tests/controllers/console/test_wraps.py
@@ -2,24 +2,29 @@ from typing import override
 from unittest.mock import MagicMock, patch
 
 import pytest
-from flask import Flask
+from flask import Flask, request
 from flask_login import LoginManager, UserMixin
 from pydantic import BaseModel
 from werkzeug.exceptions import HTTPException
 
+from controllers.common.wraps import _extract_resource_id
 from controllers.console.error import NotInitValidateError, NotSetupError, UnauthorizedAndForceLogout
 from controllers.console.workspace.error import AccountNotInitializedError
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     cloud_edition_billing_enabled,
     cloud_edition_billing_rate_limit_check,
     cloud_edition_billing_resource_check,
     cloud_utm_record,
     enterprise_license_required,
+    is_admin_or_owner_required,
     model_validate,
     only_edition_cloud,
     only_edition_enterprise,
     only_edition_self_hosted,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -165,6 +170,165 @@ class TestCurrentContextInjection:
             assert Handler().get() == ("user-99", "tenant-456")
 
 
+class TestRbacPermissionRequired:
+    """Test enterprise RBAC decorator."""
+
+    def test_resource_scoped_check_uses_resource_id(self):
+        current_user = make_account("account-1")
+
+        @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_DELETE)
+        def protected_view(**kwargs):
+            return "ok"
+
+        with (
+            patch("controllers.common.wraps.dify_config.RBAC_ENABLED", True),
+            patch("controllers.common.wraps.current_account_with_tenant", return_value=(current_user, "tenant-1")),
+            patch("controllers.common.wraps._extract_resource_id", return_value="app-123") as mock_extract,
+            patch("controllers.common.wraps._is_resource_owned_by_current_user", return_value=False) as mock_owned,
+            patch("controllers.common.wraps.RBACService.CheckAccess.check", return_value=True) as mock_check,
+        ):
+            assert protected_view(app_id="app-123") == "ok"
+
+        mock_extract.assert_called_once_with("app", {"app_id": "app-123"})
+        mock_owned.assert_called_once_with("tenant-1", "account-1", "app", "app-123")
+        mock_check.assert_called_once_with(
+            "tenant-1",
+            "account-1",
+            scene="app_delete",
+            resource_type="app",
+            resource_id="app-123",
+        )
+
+    def test_workspace_scoped_check_skips_resource_id_extraction(self):
+        current_user = make_account("account-2")
+
+        @rbac_permission_required(
+            RBACResourceScope.DATASET, RBACPermission.DATASET_CREATE_AND_MANAGEMENT, resource_required=False
+        )
+        def protected_view():
+            return "ok"
+
+        with (
+            patch("controllers.common.wraps.dify_config.RBAC_ENABLED", True),
+            patch("controllers.common.wraps.current_account_with_tenant", return_value=(current_user, "tenant-2")),
+            patch("controllers.common.wraps._extract_resource_id") as mock_extract,
+            patch("controllers.common.wraps._is_resource_owned_by_current_user", return_value=False) as mock_owned,
+            patch("controllers.common.wraps.RBACService.CheckAccess.check", return_value=True) as mock_check,
+        ):
+            assert protected_view() == "ok"
+
+        mock_extract.assert_not_called()
+        mock_owned.assert_not_called()
+        mock_check.assert_called_once_with(
+            "tenant-2",
+            "account-2",
+            scene="dataset_create_and_management",
+            resource_type="dataset",
+            resource_id=None,
+        )
+
+    def test_workspace_scene_omits_resource_type(self):
+        current_user = make_account("account-3")
+
+        @rbac_permission_required(
+            RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
+        )
+        def protected_view():
+            return "ok"
+
+        with (
+            patch("controllers.common.wraps.dify_config.RBAC_ENABLED", True),
+            patch("controllers.common.wraps.current_account_with_tenant", return_value=(current_user, "tenant-3")),
+            patch("controllers.common.wraps.RBACService.CheckAccess.check", return_value=True) as mock_check,
+        ):
+            assert protected_view() == "ok"
+
+        mock_check.assert_called_once_with(
+            "tenant-3",
+            "account-3",
+            scene="workspace_role_manage",
+            resource_type=None,
+            resource_id=None,
+        )
+
+    def test_resource_owned_app_skips_rbac_check(self):
+        current_user = make_account("account-4")
+
+        @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_DELETE)
+        def protected_view(**kwargs):
+            return "ok"
+
+        with (
+            patch("controllers.common.wraps.dify_config.RBAC_ENABLED", True),
+            patch("controllers.common.wraps.current_account_with_tenant", return_value=(current_user, "tenant-4")),
+            patch("controllers.common.wraps._extract_resource_id", return_value="app-123"),
+            patch("controllers.common.wraps._is_resource_owned_by_current_user", return_value=True) as mock_owned,
+            patch("controllers.common.wraps.RBACService.CheckAccess.check") as mock_check,
+        ):
+            assert protected_view(app_id="app-123") == "ok"
+
+        mock_owned.assert_called_once_with("tenant-4", "account-4", "app", "app-123")
+        mock_check.assert_not_called()
+
+    def test_resource_owned_dataset_skips_rbac_check(self):
+        current_user = make_account("account-5")
+
+        @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.DATASET_EDIT)
+        def protected_view(**kwargs):
+            return "ok"
+
+        with (
+            patch("controllers.common.wraps.dify_config.RBAC_ENABLED", True),
+            patch("controllers.common.wraps.current_account_with_tenant", return_value=(current_user, "tenant-5")),
+            patch("controllers.common.wraps._extract_resource_id", return_value="dataset-123"),
+            patch("controllers.common.wraps._is_resource_owned_by_current_user", return_value=True) as mock_owned,
+            patch("controllers.common.wraps.RBACService.CheckAccess.check") as mock_check,
+        ):
+            assert protected_view(dataset_id="dataset-123") == "ok"
+
+        mock_owned.assert_called_once_with("tenant-5", "account-5", "dataset", "dataset-123")
+        mock_check.assert_not_called()
+
+    def test_extract_resource_id_prefers_path_args(self):
+        app = Flask(__name__)
+
+        with app.test_request_context("/"):
+            request.view_args = {"app_id": "view-app"}
+
+            assert _extract_resource_id("app", {"app_id": "path-app"}) == "path-app"
+
+    def test_extract_resource_id_falls_back_to_request_view_args(self):
+        app = Flask(__name__)
+
+        with app.test_request_context("/"):
+            request.view_args = {"app_id": "view-app"}
+
+            assert _extract_resource_id("app") == "view-app"
+
+    def test_extract_resource_id_supports_legacy_route_aliases(self):
+        app = Flask(__name__)
+
+        with app.test_request_context("/apps/app-1/api-keys"):
+            request.view_args = {"resource_id": "app-1"}
+            assert _extract_resource_id(RBACResourceScope.APP) == "app-1"
+
+        with app.test_request_context("/agent/agent-1/features"):
+            request.view_args = {"agent_id": "agent-1"}
+            assert _extract_resource_id(RBACResourceScope.APP) == "agent-1"
+
+        with app.test_request_context("/datasets/dataset-1/api-keys"):
+            request.view_args = {"resource_id": "dataset-1"}
+            assert _extract_resource_id(RBACResourceScope.DATASET) == "dataset-1"
+
+    def test_legacy_admin_decorator_noops_when_rbac_enabled(self):
+        @is_admin_or_owner_required
+        def protected_view():
+            return "ok"
+
+        with patch("controllers.console.wraps.dify_config.RBAC_ENABLED", True):
+            assert protected_view() == "ok"
+
+
 class TestModelValidationInjection:
     """Test request model validation decorator."""
 
@@ -439,7 +603,7 @@ class TestRateLimiting:
 
     @patch("controllers.console.wraps.redis_client")
     @patch("controllers.console.wraps.db")
-    def test_should_allow_requests_within_rate_limit(self, mock_db, mock_redis):
+    def test_should_allow_requests_within_rate_limit(self, mock_db: MagicMock, mock_redis: MagicMock):
         """Test that requests within rate limit are allowed"""
         # Arrange
         mock_rate_limit = MagicMock()
@@ -467,7 +631,7 @@ class TestRateLimiting:
 
     @patch("controllers.console.wraps.redis_client")
     @patch("controllers.console.wraps.db")
-    def test_should_reject_requests_over_rate_limit(self, mock_db, mock_redis):
+    def test_should_reject_requests_over_rate_limit(self, mock_db: MagicMock, mock_redis: MagicMock):
         """Test that requests over rate limit are rejected and logged"""
         # Arrange
         app = create_app_with_login()
@@ -556,7 +720,7 @@ class TestSystemSetup:
     """Test system setup decorator"""
 
     @patch("controllers.console.wraps.db")
-    def test_should_allow_when_setup_complete(self, mock_db):
+    def test_should_allow_when_setup_complete(self, mock_db: MagicMock):
         """Test that requests are allowed when setup is complete"""
         # Arrange
 
@@ -573,7 +737,7 @@ class TestSystemSetup:
 
     @patch("controllers.console.wraps.db")
     @patch("controllers.console.wraps.os.environ.get")
-    def test_should_raise_not_init_validate_error_with_init_password(self, mock_environ_get, mock_db):
+    def test_should_raise_not_init_validate_error_with_init_password(self, mock_environ_get, mock_db: MagicMock):
         """Test NotInitValidateError when INIT_PASSWORD is set but setup not complete"""
         # Arrange
         mock_db.session.scalar.return_value = None  # No setup
@@ -590,7 +754,7 @@ class TestSystemSetup:
 
     @patch("controllers.console.wraps.db")
     @patch("controllers.console.wraps.os.environ.get")
-    def test_should_raise_not_setup_error_without_init_password(self, mock_environ_get, mock_db):
+    def test_should_raise_not_setup_error_without_init_password(self, mock_environ_get, mock_db: MagicMock):
         """Test NotSetupError when no INIT_PASSWORD and setup not complete"""
         # Arrange
         mock_db.session.scalar.return_value = None  # No setup
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_agent_providers.py b/api/tests/unit_tests/controllers/console/workspace/test_agent_providers.py
index f70450955a4..f7310b5fec8 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_agent_providers.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_agent_providers.py
@@ -1,3 +1,4 @@
+from inspect import unwrap
 from unittest.mock import MagicMock, patch
 
 from flask import Flask
@@ -8,12 +9,6 @@ from controllers.console.workspace.agent_providers import (
 )
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 class TestAgentProviderListApi:
     def test_get_success(self, app: Flask):
         api = AgentProviderListApi()
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_members.py b/api/tests/unit_tests/controllers/console/workspace/test_members.py
index 494cbbf0c37..321e2a68f39 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_members.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_members.py
@@ -1,4 +1,6 @@
 from contextlib import nullcontext
+from inspect import unwrap
+from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -25,12 +27,6 @@ from controllers.console.workspace.members import (
 from services.errors.account import AccountAlreadyInTenantError
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 class TestMemberListApi:
     def test_get_success(self, app: Flask):
         api = MemberListApi()
@@ -43,8 +39,8 @@ class TestMemberListApi:
         member.name = "Member"
         member.email = "member@test.com"
         member.avatar = "avatar.png"
-        member.role = "admin"
-        member.status = "active"
+        member.current_role = SimpleNamespace(value="admin")
+        member.status = SimpleNamespace(value="active")
         members = [member]
 
         with (
@@ -55,6 +51,53 @@ class TestMemberListApi:
 
         assert status == 200
         assert len(result["accounts"]) == 1
+        assert result["accounts"][0]["role"] == "admin"
+        assert result["accounts"][0]["roles"] == [{"id": "admin", "name": "admin"}]
+
+    def test_get_with_rbac_enabled_fetches_roles_in_batch(self, app):
+        api = MemberListApi()
+        method = unwrap(api.get)
+
+        tenant = MagicMock(id="tenant-1")
+        user = MagicMock(id="acct-1", current_tenant=tenant)
+        member = SimpleNamespace(
+            id="m1",
+            name="Member",
+            email="member@test.com",
+            avatar=None,
+            last_login_at=1,
+            last_active_at=2,
+            created_at=3,
+            current_role=SimpleNamespace(value="editor"),
+            status=SimpleNamespace(value="active"),
+        )
+        role_item = SimpleNamespace(
+            account_id="m1",
+            roles=[
+                SimpleNamespace(id="workspace.owner", name="Owner"),
+                SimpleNamespace(id="workspace.editor", name="Editor"),
+            ],
+        )
+
+        with (
+            app.test_request_context("/"),
+            patch("controllers.console.workspace.members.current_account_with_tenant", return_value=(user, "tenant-1")),
+            patch("controllers.console.workspace.members.dify_config.RBAC_ENABLED", True),
+            patch("controllers.console.workspace.members.TenantService.get_tenant_members", return_value=[member]),
+            patch(
+                "controllers.console.workspace.members.enterprise_rbac_service.RBACService.MemberRoles.batch_get",
+                return_value=[role_item],
+            ) as mock_batch_get,
+        ):
+            result, status = method(api)
+
+        assert status == 200
+        assert result["accounts"][0]["role"] == "editor"
+        assert result["accounts"][0]["roles"] == [
+            {"id": "workspace.owner", "name": "Owner"},
+            {"id": "workspace.editor", "name": "Editor"},
+        ]
+        mock_batch_get.assert_called_once_with("tenant-1", "acct-1", ["m1"])
 
     def test_get_no_tenant(self, app: Flask):
         api = MemberListApi()
@@ -190,7 +233,9 @@ class TestMemberInviteEmailApi:
         ):
             result, status = method(api, user)
 
-        assert result["invitation_results"][0]["status"] == "success"
+        assert status == 201
+        assert result["invitation_results"][0]["status"] == "already_member"
+        assert result["invitation_results"][0]["message"] == "Account already in workspace."
 
     def test_invite_invalid_role(self, app: Flask):
         api = MemberInviteEmailApi()
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_model_providers.py b/api/tests/unit_tests/controllers/console/workspace/test_model_providers.py
index d938558806f..21055390362 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_model_providers.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_model_providers.py
@@ -20,10 +20,7 @@ VALID_UUID = "123e4567-e89b-12d3-a456-426614174000"
 INVALID_UUID = "123"
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
+from inspect import unwrap
 
 
 class TestModelProviderListApi:
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_models.py b/api/tests/unit_tests/controllers/console/workspace/test_models.py
index 00977e6d7b6..3374c49caff 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_models.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_models.py
@@ -1,3 +1,4 @@
+from inspect import unwrap
 from types import SimpleNamespace
 from unittest.mock import patch
 
@@ -19,12 +20,6 @@ from graphon.model_runtime.entities.model_entities import ModelType
 from graphon.model_runtime.errors.validate import CredentialsValidateFailedError
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 class TestDefaultModelApi:
     def test_get_success(self, app: Flask):
         api = DefaultModelApi()
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_rbac.py b/api/tests/unit_tests/controllers/console/workspace/test_rbac.py
new file mode 100644
index 00000000000..1ad9637b7bb
--- /dev/null
+++ b/api/tests/unit_tests/controllers/console/workspace/test_rbac.py
@@ -0,0 +1,503 @@
+"""Controller tests for ``controllers.console.workspace.rbac``.
+
+The controllers here are thin: almost every non-trivial behaviour lives in
+``services.enterprise.rbac_service`` (covered by its own suite). These tests
+therefore focus on the Flask-layer concerns the service layer cannot exercise:
+
+* ``_current_ids`` raises 404 when the session has no tenant.
+* The pydantic request models accept / reject bodies as expected.
+
+We explicitly avoid "happy-path" integration tests through the full
+decorator stack — those belong in e2e tests where a real Dify session is
+available — to keep this suite fast and resilient to ancillary auth wiring
+changes.
+"""
+
+from __future__ import annotations
+
+import inspect
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+from flask import Flask
+from pydantic import ValidationError
+from werkzeug.exceptions import Forbidden, NotFound
+
+from controllers.console.workspace import rbac as rbac_mod
+
+
+@pytest.fixture
+def app():
+    flask_app = Flask(__name__)
+    flask_app.config["TESTING"] = True
+    return flask_app
+
+
+def _enabled(enabled: bool):
+    return patch("controllers.console.workspace.rbac.dify_config.ENTERPRISE_ENABLED", enabled)
+
+
+class TestCurrentIds:
+    def test_rejects_missing_tenant(self):
+        with patch("controllers.console.workspace.rbac.current_account_with_tenant") as mock_user:
+            mock_user.return_value = (SimpleNamespace(id="acct-1"), None)
+            with pytest.raises(NotFound):
+                rbac_mod._current_ids()
+
+    def test_returns_tuple(self):
+        with patch("controllers.console.workspace.rbac.current_account_with_tenant") as mock_user:
+            mock_user.return_value = (SimpleNamespace(id="acct-1"), "tenant-1")
+            assert rbac_mod._current_ids() == ("tenant-1", "acct-1")
+
+
+class TestAccessMatrixAccountNames:
+    def test_hydrates_missing_account_names(self):
+        items = [
+            rbac_mod.svc.AccessMatrixItem(
+                accounts=[
+                    {"account_id": "acct-1", "account_name": "Alice", "binding_id": "binding-1"},
+                    {"account_id": "acct-2", "account_name": "", "binding_id": "binding-2"},
+                ]
+            )
+        ]
+
+        with patch(
+            "controllers.console.workspace.rbac._account_names_by_ids",
+            return_value={"acct-2": {"name": "Bob", "avatar": "ava"}},
+        ) as mock_names:
+            rbac_mod._hydrate_access_matrix_account_names(items)
+
+        mock_names.assert_called_once_with(["acct-2"])
+        assert items[0].accounts[0].account_id == "acct-1"
+        assert items[0].accounts[0].account_name == "Alice"
+        assert items[0].accounts[1].account_id == "acct-2"
+        assert items[0].accounts[1].account_name == "Bob"
+        assert items[0].accounts[1].avatar == "ava"
+
+    def test_hydrates_resource_user_account_names(self):
+        items = [
+            rbac_mod.svc.ResourceUserAccessPolicies(
+                account={"account_id": "acct-1", "account_name": ""},
+                roles=[],
+                access_policies=[],
+            )
+        ]
+
+        with patch(
+            "controllers.console.workspace.rbac._account_names_by_ids",
+            return_value={"acct-1": {"name": "Alice", "avatar": ""}},
+        ):
+            rbac_mod._hydrate_resource_user_account_names(items)
+
+        assert items[0].account.account_name == "Alice"
+
+
+class TestPydanticModels:
+    """The internal `_…Request` models are the contract between the browser
+    and the controllers. We only check non-obvious branches (enum parsing,
+    missing required fields) — trivial `str` fields are not worth asserting.
+    """
+
+    def test_role_upsert_requires_name(self):
+        with pytest.raises(ValidationError):
+            rbac_mod._RoleUpsertRequest.model_validate({})
+
+    def test_role_upsert_to_mutation_preserves_fields(self):
+        payload = rbac_mod._RoleUpsertRequest.model_validate(
+            {
+                "name": "Owner",
+                "description": "full access",
+                "permission_keys": ["workspace.member.manage"],
+            }
+        )
+        mutation = payload.to_mutation()
+        assert mutation.description == "full access"
+        assert mutation.permission_keys == ["workspace.member.manage"]
+
+    def test_access_policy_create_parses_resource_type_enum(self):
+        parsed = rbac_mod._AccessPolicyCreateRequest.model_validate(
+            {
+                "name": "Full access",
+                "resource_type": "app",
+                "description": "",
+                "permission_keys": [],
+            }
+        )
+        assert parsed.resource_type is rbac_mod.svc.RBACResourceType.APP
+
+    def test_access_policy_create_rejects_unknown_resource_type(self):
+        with pytest.raises(ValidationError):
+            rbac_mod._AccessPolicyCreateRequest.model_validate({"name": "bad", "resource_type": "unknown"})
+
+    def test_resource_access_scope_requires_scope(self):
+        with pytest.raises(ValidationError):
+            rbac_mod._ResourceAccessScopeRequest.model_validate({})
+
+    def test_resource_access_scope_defaults_empty_account_ids(self):
+        parsed = rbac_mod._ResourceAccessScopeRequest.model_validate({"scope": "specific"})
+        assert parsed.scope is rbac_mod._AccessScope.SPECIFIC
+
+    def test_resource_access_scope_coerce_null_account_ids(self):
+        rbac_mod._ResourceAccessScopeRequest.model_validate({"scope": "all"})
+
+    def test_resource_access_scope_rejects_unknown_scope(self):
+        with pytest.raises(ValidationError):
+            rbac_mod._ResourceAccessScopeRequest.model_validate({"scope": "team"})
+
+    def test_replace_bindings_keeps_role_binding_contract(self):
+        parsed = rbac_mod._ReplaceBindingsRequest.model_validate({"role_ids": None})
+        assert parsed.role_ids == []
+
+    def test_replace_member_roles_coerce_null_list(self):
+        parsed = rbac_mod._ReplaceMemberRolesRequest.model_validate({"role_ids": None})
+        assert parsed.role_ids == []
+
+    def test_pagination_query_accepts_page_and_limit_aliases(self):
+        parsed = rbac_mod._PaginationQuery.model_validate({"page": 3, "limit": 25, "reverse": True})
+        assert parsed.page_number == 3
+        assert parsed.results_per_page == 25
+        assert parsed.reverse is True
+
+    def test_pagination_query_accepts_legacy_inner_names(self):
+        parsed = rbac_mod._PaginationQuery.model_validate({"page_number": 4, "results_per_page": 30, "reverse": False})
+        assert parsed.page_number == 4
+        assert parsed.results_per_page == 30
+        assert parsed.reverse is False
+
+
+class TestPaginationMapping:
+    def test_roles_get_returns_legacy_compatible_roles_when_rbac_disabled(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/roles?page=1&limit=2&include_owner=1"),
+            patch("controllers.console.workspace.rbac.dify_config.RBAC_ENABLED", False),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.list") as mock_list,
+        ):
+            response = inspect.unwrap(rbac_mod.RBACRolesApi.get)(rbac_mod.RBACRolesApi())
+
+        assert response["data"] == [
+            {
+                "id": "owner",
+                "tenant_id": "",
+                "type": "workspace",
+                "category": "global_system_default",
+                "name": "owner",
+                "description": "",
+                "is_builtin": True,
+                "permission_keys": list(rbac_mod._LEGACY_ROLE_PERMISSION_KEYS["owner"]),
+                "role_tag": "owner",
+            },
+            {
+                "id": "admin",
+                "tenant_id": "",
+                "type": "workspace",
+                "category": "global_system_default",
+                "name": "admin",
+                "description": "",
+                "is_builtin": True,
+                "permission_keys": list(rbac_mod._LEGACY_ROLE_PERMISSION_KEYS["admin"]),
+                "role_tag": "",
+            },
+        ]
+        assert response["pagination"] == {
+            "total_count": 5,
+            "per_page": 2,
+            "current_page": 1,
+            "total_pages": 3,
+        }
+        mock_list.assert_not_called()
+
+    def test_roles_get_filters_out_owner_when_include_owner_is_zero(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/roles?include_owner=0"),
+            patch("controllers.console.workspace.rbac.dify_config.RBAC_ENABLED", False),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.list"),
+        ):
+            response = inspect.unwrap(rbac_mod.RBACRolesApi.get)(rbac_mod.RBACRolesApi())
+
+        names = [r["name"] for r in response["data"]]
+        assert "owner" not in names
+
+    def test_roles_get_keeps_owner_when_include_owner_is_one(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/roles?include_owner=1"),
+            patch("controllers.console.workspace.rbac.dify_config.RBAC_ENABLED", False),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.list"),
+        ):
+            response = inspect.unwrap(rbac_mod.RBACRolesApi.get)(rbac_mod.RBACRolesApi())
+
+        names = [r["name"] for r in response["data"]]
+        assert "owner" in names
+
+    def test_roles_get_filters_out_owner_by_default(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/roles"),
+            patch("controllers.console.workspace.rbac.dify_config.RBAC_ENABLED", False),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.list"),
+        ):
+            response = inspect.unwrap(rbac_mod.RBACRolesApi.get)(rbac_mod.RBACRolesApi())
+
+        names = [r["name"] for r in response["data"]]
+        assert "owner" not in names
+
+    def test_roles_get_forwards_outer_pagination_params(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/roles?page=2&limit=50&reverse=true&include_owner=1"),
+            patch("controllers.console.workspace.rbac.dify_config.RBAC_ENABLED", True),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.list") as mock_list,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACRolesApi.get)(rbac_mod.RBACRolesApi())
+
+        _, kwargs = mock_list.call_args
+        options = kwargs["options"]
+        assert options.page_number == 2
+        assert options.results_per_page == 50
+        assert options.reverse is True
+
+
+class TestResourceAccessScopeBindings:
+    def test_app_user_access_policy_assignment_forwards_ids(self, app):
+        with (
+            app.test_request_context(
+                "/workspaces/current/rbac/apps/app-1/users/acct-target/access-policies",
+                method="PUT",
+                json={"access_policy_ids": ["policy-1", "policy-2"]},
+            ),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-actor")),
+            patch(
+                "controllers.console.workspace.rbac.svc.RBACService.AppAccess.replace_user_access_policies"
+            ) as mock_replace,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACAppUserAccessPolicyAssignmentApi.put)(
+                rbac_mod.RBACAppUserAccessPolicyAssignmentApi(),
+                "app-1",
+                "acct-target",
+            )
+
+        tenant_id, actor_id, app_id, target_id, payload = mock_replace.call_args.args
+        assert (tenant_id, actor_id, app_id, target_id) == (
+            "tenant-1",
+            "acct-actor",
+            "app-1",
+            "acct-target",
+        )
+        assert payload.access_policy_ids == ["policy-1", "policy-2"]
+
+    def test_app_member_bindings_delete_forwards_account_ids(self, app):
+        with (
+            app.test_request_context(
+                "/workspaces/current/rbac/apps/app-1/access-policies/policy-1/member-bindings",
+                method="DELETE",
+                json={"account_ids": ["acct-2", "acct-3"]},
+            ),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-actor")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.AppAccess.delete_member_bindings") as mock_delete,
+        ):
+            response = inspect.unwrap(rbac_mod.RBACAppMemberBindingsApi.delete)(
+                rbac_mod.RBACAppMemberBindingsApi(),
+                "app-1",
+                "policy-1",
+            )
+
+        assert response == {"result": "success"}
+        tenant_id, actor_id, app_id, policy_id, payload = mock_delete.call_args.args
+        assert (tenant_id, actor_id, app_id, policy_id) == ("tenant-1", "acct-actor", "app-1", "policy-1")
+        assert payload.account_ids == ["acct-2", "acct-3"]
+
+    def test_dataset_member_bindings_delete_forwards_account_ids(self, app):
+        with (
+            app.test_request_context(
+                "/workspaces/current/rbac/datasets/dataset-1/access-policies/policy-1/member-bindings",
+                method="DELETE",
+                json={"account_ids": ["acct-2"]},
+            ),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-actor")),
+            patch(
+                "controllers.console.workspace.rbac.svc.RBACService.DatasetAccess.delete_member_bindings"
+            ) as mock_delete,
+        ):
+            response = inspect.unwrap(rbac_mod.RBACDatasetMemberBindingsApi.delete)(
+                rbac_mod.RBACDatasetMemberBindingsApi(),
+                "dataset-1",
+                "policy-1",
+            )
+
+        assert response == {"result": "success"}
+        tenant_id, actor_id, dataset_id, policy_id, payload = mock_delete.call_args.args
+        assert (tenant_id, actor_id, dataset_id, policy_id) == ("tenant-1", "acct-actor", "dataset-1", "policy-1")
+        assert payload.account_ids == ["acct-2"]
+
+
+class TestPaginationForwarding:
+    def test_role_members_get_forwards_outer_pagination_params(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/roles/role-1/members?page=2&limit=50&reverse=true"),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.members") as mock_members,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACRoleMembersApi.get)(rbac_mod.RBACRoleMembersApi(), "role-1")
+
+        _, _, role_id = mock_members.call_args.args
+        _, kwargs = mock_members.call_args
+        assert role_id == "role-1"
+        options = kwargs["options"]
+        assert options.page_number == 2
+        assert options.results_per_page == 50
+        assert options.reverse is True
+
+    def test_access_policies_get_forwards_outer_pagination_params(self, app):
+        with (
+            app.test_request_context(
+                "/workspaces/current/rbac/access-policies?resource_type=app&page=3&limit=25&reverse=false"
+            ),
+            _enabled(True),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.AccessPolicies.list") as mock_list,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACAccessPoliciesApi.get)(rbac_mod.RBACAccessPoliciesApi())
+
+        _, kwargs = mock_list.call_args
+        assert kwargs["resource_type"] == "app"
+        options = kwargs["options"]
+        assert options.page_number == 3
+        assert options.results_per_page == 25
+        assert options.reverse is False
+
+    def test_workspace_app_matrix_forwards_outer_pagination_params(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/workspace/apps/access-policy?page=4&limit=10"),
+            _enabled(True),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.WorkspaceAccess.app_matrix") as mock_list,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACWorkspaceAppMatrixApi.get)(rbac_mod.RBACWorkspaceAppMatrixApi())
+
+        _, kwargs = mock_list.call_args
+        options = kwargs["options"]
+        assert options.page_number == 4
+        assert options.results_per_page == 10
+        assert options.reverse is None
+
+    def test_workspace_dataset_matrix_forwards_outer_pagination_params(self, app):
+        with (
+            app.test_request_context(
+                "/workspaces/current/rbac/workspace/datasets/access-policy?page=5&limit=15&reverse=true"
+            ),
+            _enabled(True),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.WorkspaceAccess.dataset_matrix") as mock_list,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACWorkspaceDatasetMatrixApi.get)(rbac_mod.RBACWorkspaceDatasetMatrixApi())
+
+        _, kwargs = mock_list.call_args
+        options = kwargs["options"]
+        assert options.page_number == 5
+        assert options.results_per_page == 15
+        assert options.reverse is True
+
+
+class TestAccessPolicyBindingLockUnlock:
+    def test_lock_forwards_binding_id(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/access-policy-bindings/binding-1/lock", method="PUT"),
+            _enabled(True),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.AccessPolicyBindings.lock") as mock_lock,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACAccessPolicyBindingLockApi.put)(
+                rbac_mod.RBACAccessPolicyBindingLockApi(), "binding-1"
+            )
+
+        mock_lock.assert_called_once_with("tenant-1", "acct-1", "binding-1")
+
+    def test_unlock_forwards_binding_id(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/access-policy-bindings/binding-1/unlock", method="PUT"),
+            _enabled(True),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.AccessPolicyBindings.unlock") as mock_unlock,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACAccessPolicyBindingUnlockApi.put)(
+                rbac_mod.RBACAccessPolicyBindingUnlockApi(), "binding-1"
+            )
+
+        mock_unlock.assert_called_once_with("tenant-1", "acct-1", "binding-1")
+
+
+class TestRoleCopy:
+    def test_role_copy_forwards_path_id(self, app):
+        with (
+            app.test_request_context("/workspaces/current/rbac/roles/role-1/copy", method="POST", json={}),
+            _enabled(True),
+            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
+            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.copy") as mock_copy,
+            patch("controllers.console.workspace.rbac._dump", return_value={}),
+        ):
+            inspect.unwrap(rbac_mod.RBACRoleCopyApi.post)(rbac_mod.RBACRoleCopyApi(), "role-1")
+
+        mock_copy.assert_called_once_with("tenant-1", "acct-1", "role-1", copy_member=True)
+
+
+class TestWorkspaceRbacGuards:
+    def test_role_create_requires_workspace_role_manage(self, app):
+        with (
+            app.test_request_context(
+                "/workspaces/current/rbac/roles",
+                method="POST",
+                json={"name": "test_role", "permission_keys": []},
+            ),
+            patch("libs.login.dify_config.LOGIN_DISABLED", True),
+            patch("controllers.console.wraps.dify_config.RBAC_ENABLED", True),
+            patch(
+                "controllers.common.wraps.current_account_with_tenant",
+                return_value=(SimpleNamespace(id="acct-1"), "tenant-1"),
+            ),
+            patch("controllers.common.wraps.RBACService.CheckAccess.check", return_value=False),
+            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.create") as mock_create,
+        ):
+            with pytest.raises(Forbidden):
+                rbac_mod.RBACRolesApi().post()
+
+        mock_create.assert_not_called()
+
+    def test_access_policy_create_requires_workspace_role_manage(self, app):
+        with (
+            app.test_request_context(
+                "/workspaces/current/rbac/access-policies",
+                method="POST",
+                json={"name": "full_access", "resource_type": "app", "permission_keys": []},
+            ),
+            patch("libs.login.dify_config.LOGIN_DISABLED", True),
+            patch("controllers.console.wraps.dify_config.RBAC_ENABLED", True),
+            patch(
+                "controllers.common.wraps.current_account_with_tenant",
+                return_value=(SimpleNamespace(id="acct-1"), "tenant-1"),
+            ),
+            patch("controllers.common.wraps.RBACService.CheckAccess.check", return_value=False),
+            patch("controllers.console.workspace.rbac.svc.RBACService.AccessPolicies.create") as mock_create,
+        ):
+            with pytest.raises(Forbidden):
+                rbac_mod.RBACAccessPoliciesApi().post()
+
+        mock_create.assert_not_called()
+
+
+class TestDumpHelper:
+    def test_dump_returns_plain_dict(self):
+        role = rbac_mod.svc.RBACRole(id="role-1", type="workspace", name="Owner")
+        dumped = rbac_mod._dump(role)
+        assert isinstance(dumped, dict)
+        assert "role_id" not in dumped
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_snippets.py b/api/tests/unit_tests/controllers/console/workspace/test_snippets.py
index b8914fc26cb..e8e005a1b83 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_snippets.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_snippets.py
@@ -1,8 +1,9 @@
 from inspect import unwrap
 from types import SimpleNamespace
-from unittest.mock import Mock
+from unittest.mock import ANY, Mock
 
 import pytest
+from flask import Flask
 from werkzeug.exceptions import NotFound
 
 from controllers.console.workspace import snippets as snippets_module
@@ -69,7 +70,7 @@ def test_normalize_snippet_list_query_args_sorts_indexed_values():
     }
 
 
-def test_list_snippets_returns_pagination(app, monkeypatch):
+def test_list_snippets_returns_pagination(app: Flask, monkeypatch: pytest.MonkeyPatch):
     snippets = [_snippet()]
     tag_id = "11111111-1111-1111-1111-111111111111"
     get_snippets = Mock(return_value=(snippets, 1, False))
@@ -94,6 +95,7 @@ def test_list_snippets_returns_pagination(app, monkeypatch):
     }
     get_snippets.assert_called_once_with(
         tenant_id="tenant-1",
+        session=ANY,
         page=2,
         limit=10,
         keyword=None,
@@ -103,7 +105,7 @@ def test_list_snippets_returns_pagination(app, monkeypatch):
     )
 
 
-def test_create_snippet_defaults_unknown_type_and_returns_created(app, monkeypatch):
+def test_create_snippet_defaults_unknown_type_and_returns_created(app: Flask, monkeypatch: pytest.MonkeyPatch):
     user = _account("account-1")
     snippet = _snippet()
     create_snippet = Mock(return_value=snippet)
@@ -139,7 +141,7 @@ def test_create_snippet_defaults_unknown_type_and_returns_created(app, monkeypat
     assert create_snippet.call_args.kwargs["snippet_type"] == snippets_module.SnippetType.NODE
 
 
-def test_create_snippet_rejects_forbidden_nodes(app, monkeypatch):
+def test_create_snippet_rejects_forbidden_nodes(app: Flask, monkeypatch: pytest.MonkeyPatch):
     user = _account("account-1")
     create_snippet = Mock()
     monkeypatch.setattr(snippets_module.SnippetService, "create_snippet", create_snippet)
@@ -168,7 +170,7 @@ def test_create_snippet_rejects_forbidden_nodes(app, monkeypatch):
     create_snippet.assert_not_called()
 
 
-def test_get_snippet_detail_raises_when_missing(app, monkeypatch):
+def test_get_snippet_detail_raises_when_missing(app: Flask, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr(snippets_module.SnippetService, "get_snippet_by_id", Mock(return_value=None))
 
     api = snippets_module.CustomizedSnippetDetailApi()
@@ -179,7 +181,7 @@ def test_get_snippet_detail_raises_when_missing(app, monkeypatch):
             handler(api, "tenant-1", snippet_id="snippet-1")
 
 
-def test_get_snippet_detail_returns_snippet(app, monkeypatch):
+def test_get_snippet_detail_returns_snippet(app: Flask, monkeypatch: pytest.MonkeyPatch):
     snippet = _snippet()
     monkeypatch.setattr(snippets_module.SnippetService, "get_snippet_by_id", Mock(return_value=snippet))
     monkeypatch.setattr(snippets_module, "marshal", Mock(return_value={"id": "snippet-1"}))
@@ -194,7 +196,7 @@ def test_get_snippet_detail_returns_snippet(app, monkeypatch):
     assert response == {"id": "snippet-1"}
 
 
-def test_patch_snippet_returns_400_for_empty_payload(app, monkeypatch):
+def test_patch_snippet_returns_400_for_empty_payload(app: Flask, monkeypatch: pytest.MonkeyPatch):
     snippet = _snippet()
     user = _account("user-1")
     monkeypatch.setattr(snippets_module.SnippetService, "get_snippet_by_id", Mock(return_value=snippet))
@@ -213,7 +215,7 @@ def test_patch_snippet_returns_400_for_empty_payload(app, monkeypatch):
     assert response == {"message": "No valid fields to update"}
 
 
-def test_patch_snippet_updates_and_commits(app, monkeypatch):
+def test_patch_snippet_updates_and_commits(app: Flask, monkeypatch: pytest.MonkeyPatch):
     user = _account("account-1")
     snippet = _snippet()
     updated_snippet = _snippet(name="New")
@@ -250,7 +252,7 @@ def test_patch_snippet_updates_and_commits(app, monkeypatch):
     session.commit.assert_called_once()
 
 
-def test_delete_snippet_deletes_and_commits(app, monkeypatch):
+def test_delete_snippet_deletes_and_commits(app: Flask, monkeypatch: pytest.MonkeyPatch):
     snippet = _snippet()
     session = SimpleNamespace(merge=Mock(return_value=snippet), commit=Mock())
     delete_snippet = Mock()
@@ -276,7 +278,7 @@ def test_delete_snippet_deletes_and_commits(app, monkeypatch):
     session.commit.assert_called_once()
 
 
-def test_export_snippet_returns_yaml_attachment(app, monkeypatch):
+def test_export_snippet_returns_yaml_attachment(app: Flask, monkeypatch: pytest.MonkeyPatch):
     snippet = _snippet(name="Snippet One")
     export_snippet_dsl = Mock(return_value="version: 0.1.0\nkind: snippet\n")
     session = SimpleNamespace()
@@ -307,7 +309,7 @@ def test_export_snippet_returns_yaml_attachment(app, monkeypatch):
     export_snippet_dsl.assert_called_once_with(snippet=snippet, include_secret=True)
 
 
-def test_import_snippet_returns_202_for_pending_confirmation(app, monkeypatch):
+def test_import_snippet_returns_202_for_pending_confirmation(app: Flask, monkeypatch: pytest.MonkeyPatch):
     user = _account("account-1")
     result = SnippetImportInfo(id="import-1", status=ImportStatus.PENDING, imported_dsl_version="999.0.0")
     import_snippet = Mock(return_value=result)
@@ -347,7 +349,7 @@ def test_import_snippet_returns_202_for_pending_confirmation(app, monkeypatch):
     session.commit.assert_called_once()
 
 
-def test_import_snippet_returns_400_for_failed_import(app, monkeypatch):
+def test_import_snippet_returns_400_for_failed_import(app: Flask, monkeypatch: pytest.MonkeyPatch):
     user = _account("account-1")
     result = SnippetImportInfo(id="import-1", status=ImportStatus.FAILED, error="Invalid DSL")
     import_snippet = Mock(return_value=result)
@@ -380,7 +382,7 @@ def test_import_snippet_returns_400_for_failed_import(app, monkeypatch):
     session.commit.assert_called_once()
 
 
-def test_import_confirm_returns_200_for_completed_import(app, monkeypatch):
+def test_import_confirm_returns_200_for_completed_import(app: Flask, monkeypatch: pytest.MonkeyPatch):
     user = _account("account-1")
     result = SnippetImportInfo(id="import-1", status=ImportStatus.COMPLETED, snippet_id="snippet-1")
     confirm_import = Mock(return_value=result)
@@ -413,7 +415,7 @@ def test_import_confirm_returns_200_for_completed_import(app, monkeypatch):
     session.commit.assert_called_once()
 
 
-def test_check_dependencies_raises_when_snippet_missing(app, monkeypatch):
+def test_check_dependencies_raises_when_snippet_missing(app: Flask, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr(snippets_module.SnippetService, "get_snippet_by_id", Mock(return_value=None))
 
     api = snippets_module.CustomizedSnippetCheckDependenciesApi()
@@ -424,7 +426,7 @@ def test_check_dependencies_raises_when_snippet_missing(app, monkeypatch):
             handler(api, "tenant-1", snippet_id="snippet-1")
 
 
-def test_check_dependencies_returns_dependency_result(app, monkeypatch):
+def test_check_dependencies_returns_dependency_result(app: Flask, monkeypatch: pytest.MonkeyPatch):
     snippet = _snippet()
     check_dependencies = Mock(
         return_value=SimpleNamespace(model_dump=Mock(return_value={"dependencies": [], "missing_dependencies": []}))
@@ -455,7 +457,7 @@ def test_check_dependencies_returns_dependency_result(app, monkeypatch):
     check_dependencies.assert_called_once_with(snippet=snippet)
 
 
-def test_increment_use_count_raises_when_snippet_missing(app, monkeypatch):
+def test_increment_use_count_raises_when_snippet_missing(app: Flask, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr(snippets_module.SnippetService, "get_snippet_by_id", Mock(return_value=None))
 
     api = snippets_module.CustomizedSnippetUseCountIncrementApi()
@@ -469,7 +471,7 @@ def test_increment_use_count_raises_when_snippet_missing(app, monkeypatch):
             handler(api, "tenant-1", snippet_id="snippet-1")
 
 
-def test_increment_use_count_returns_refreshed_count(app, monkeypatch):
+def test_increment_use_count_returns_refreshed_count(app: Flask, monkeypatch: pytest.MonkeyPatch):
     snippet = SimpleNamespace(id="snippet-1", tenant_id="tenant-1", use_count=2)
     merged_snippet = SimpleNamespace(id="snippet-1", tenant_id="tenant-1", use_count=3)
     session = SimpleNamespace(merge=Mock(return_value=merged_snippet), commit=Mock(), refresh=Mock())
diff --git a/api/tests/unit_tests/controllers/files/test_image_preview.py b/api/tests/unit_tests/controllers/files/test_image_preview.py
index 49846b89ee9..9ad7120c30f 100644
--- a/api/tests/unit_tests/controllers/files/test_image_preview.py
+++ b/api/tests/unit_tests/controllers/files/test_image_preview.py
@@ -1,4 +1,5 @@
 import types
+from inspect import unwrap
 from unittest.mock import patch
 
 import pytest
@@ -7,12 +8,6 @@ from werkzeug.exceptions import NotFound
 import controllers.files.image_preview as module
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 @pytest.fixture(autouse=True)
 def mock_db():
     """
diff --git a/api/tests/unit_tests/controllers/files/test_tool_files.py b/api/tests/unit_tests/controllers/files/test_tool_files.py
index edb91c3f262..a41e2a056b1 100644
--- a/api/tests/unit_tests/controllers/files/test_tool_files.py
+++ b/api/tests/unit_tests/controllers/files/test_tool_files.py
@@ -1,4 +1,5 @@
 import types
+from inspect import unwrap
 from unittest.mock import patch
 
 import pytest
@@ -7,12 +8,6 @@ from werkzeug.exceptions import Forbidden, NotFound
 import controllers.files.tool_files as module
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 def fake_request(args: dict):
     return types.SimpleNamespace(args=types.SimpleNamespace(to_dict=lambda flat=True: args))
 
diff --git a/api/tests/unit_tests/controllers/files/test_upload.py b/api/tests/unit_tests/controllers/files/test_upload.py
index 7c98b088ce3..5281dcf0645 100644
--- a/api/tests/unit_tests/controllers/files/test_upload.py
+++ b/api/tests/unit_tests/controllers/files/test_upload.py
@@ -1,5 +1,6 @@
 import io
 import types
+from inspect import unwrap
 from unittest.mock import patch
 
 import pytest
@@ -9,12 +10,6 @@ import controllers.files.upload as module
 from core.workflow.file_reference import build_file_reference
 
 
-def unwrap(func):
-    while hasattr(func, "__wrapped__"):
-        func = func.__wrapped__
-    return func
-
-
 def fake_request(args: dict, file=None):
     return types.SimpleNamespace(
         args=types.SimpleNamespace(to_dict=lambda flat=True: args),
diff --git a/api/tests/unit_tests/controllers/inner_api/plugin/test_plugin_wraps.py b/api/tests/unit_tests/controllers/inner_api/plugin/test_plugin_wraps.py
index cc581c0c759..c958034126d 100644
--- a/api/tests/unit_tests/controllers/inner_api/plugin/test_plugin_wraps.py
+++ b/api/tests/unit_tests/controllers/inner_api/plugin/test_plugin_wraps.py
@@ -237,9 +237,10 @@ class TestGetUserTenant:
             monkeypatch.setattr(app, "login_manager", MagicMock(), raising=False)
             with patch("controllers.inner_api.plugin.wraps.db.session.get") as mock_get:
                 with patch("controllers.inner_api.plugin.wraps.get_user") as mock_get_user:
-                    mock_get.return_value = mock_tenant
-                    mock_get_user.return_value = mock_user
-                    result = protected_view()
+                    with patch("controllers.inner_api.plugin.wraps.user_logged_in"):
+                        mock_get.return_value = mock_tenant
+                        mock_get_user.return_value = mock_user
+                        result = protected_view()
 
         # Assert
         assert result["tenant"] == mock_tenant
@@ -293,9 +294,10 @@ class TestGetUserTenant:
             monkeypatch.setattr(app, "login_manager", MagicMock(), raising=False)
             with patch("controllers.inner_api.plugin.wraps.db.session.get") as mock_get:
                 with patch("controllers.inner_api.plugin.wraps.get_user") as mock_get_user:
-                    mock_get.return_value = mock_tenant
-                    mock_get_user.return_value = mock_user
-                    result = protected_view()
+                    with patch("controllers.inner_api.plugin.wraps.user_logged_in"):
+                        mock_get.return_value = mock_tenant
+                        mock_get_user.return_value = mock_user
+                        result = protected_view()
 
         # Assert
         assert result["tenant"] == mock_tenant
diff --git a/api/tests/unit_tests/controllers/inner_api/test_auth_wraps.py b/api/tests/unit_tests/controllers/inner_api/test_auth_wraps.py
index ffe0c4e6b34..96f1dcaed56 100644
--- a/api/tests/unit_tests/controllers/inner_api/test_auth_wraps.py
+++ b/api/tests/unit_tests/controllers/inner_api/test_auth_wraps.py
@@ -13,6 +13,7 @@ from controllers.inner_api.wraps import (
     billing_inner_api_only,
     enterprise_inner_api_only,
     enterprise_inner_api_user_auth,
+    inner_api_only,
     plugin_inner_api_only,
 )
 from models.model import EndUser
@@ -154,6 +155,57 @@ class TestEnterpriseInnerApiOnly:
                     assert exc_info.value.code == 401
 
 
+class TestInnerApiOnly:
+    """Test inner_api_only decorator."""
+
+    def test_should_allow_when_inner_api_enabled_and_valid_key(self, app: Flask):
+        @inner_api_only
+        def protected_view():
+            return "success"
+
+        with app.test_request_context(headers={"X-Inner-Api-Key": "valid_key"}):
+            with patch.object(dify_config, "INNER_API", True):
+                with patch.object(dify_config, "INNER_API_KEY", "valid_key"):
+                    result = protected_view()
+
+        assert result == "success"
+
+    def test_should_return_404_when_inner_api_disabled(self, app: Flask):
+        @inner_api_only
+        def protected_view():
+            return "success"
+
+        with app.test_request_context():
+            with patch.object(dify_config, "INNER_API", False):
+                with pytest.raises(HTTPException) as exc_info:
+                    protected_view()
+                assert exc_info.value.code == 404
+
+    def test_should_return_401_when_api_key_missing(self, app: Flask):
+        @inner_api_only
+        def protected_view():
+            return "success"
+
+        with app.test_request_context(headers={}):
+            with patch.object(dify_config, "INNER_API", True):
+                with patch.object(dify_config, "INNER_API_KEY", "valid_key"):
+                    with pytest.raises(HTTPException) as exc_info:
+                        protected_view()
+                    assert exc_info.value.code == 401
+
+    def test_should_return_401_when_api_key_invalid(self, app: Flask):
+        @inner_api_only
+        def protected_view():
+            return "success"
+
+        with app.test_request_context(headers={"X-Inner-Api-Key": "invalid_key"}):
+            with patch.object(dify_config, "INNER_API", True):
+                with patch.object(dify_config, "INNER_API_KEY", "valid_key"):
+                    with pytest.raises(HTTPException) as exc_info:
+                        protected_view()
+                    assert exc_info.value.code == 401
+
+
 class TestEnterpriseInnerApiUserAuth:
     """Test enterprise_inner_api_user_auth decorator for HMAC-based user authentication"""
 
diff --git a/api/tests/unit_tests/controllers/inner_api/test_knowledge_retrieval.py b/api/tests/unit_tests/controllers/inner_api/test_knowledge_retrieval.py
new file mode 100644
index 00000000000..fa648e0335c
--- /dev/null
+++ b/api/tests/unit_tests/controllers/inner_api/test_knowledge_retrieval.py
@@ -0,0 +1,233 @@
+"""Unit tests for the inner knowledge retrieval controller."""
+
+from unittest.mock import patch
+
+import pytest
+from flask import Flask
+
+from controllers.inner_api import bp as inner_api_bp
+from core.workflow.nodes.knowledge_retrieval.exc import RateLimitExceededError
+from core.workflow.nodes.knowledge_retrieval.retrieval import Source, SourceMetadata
+from services.entities.knowledge_retrieval_inner import InnerKnowledgeRetrieveResponse, InnerKnowledgeRetrieveUsage
+from services.errors.knowledge_retrieval import (
+    ExternalKnowledgeRetrievalError,
+    InnerKnowledgeRetrieveAppNotFoundError,
+    InnerKnowledgeRetrieveDatasetTenantMismatchError,
+)
+
+
+@pytest.fixture
+def inner_api_app() -> Flask:
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.register_blueprint(inner_api_bp)
+    return app
+
+
+def _headers(api_key: str | None = "inner-key") -> dict[str, str]:
+    headers = {"Content-Type": "application/json"}
+    if api_key is not None:
+        headers["X-Inner-Api-Key"] = api_key
+    return headers
+
+
+def _payload() -> dict[str, object]:
+    return {
+        "caller": {
+            "tenant_id": "tenant-1",
+            "user_id": "user-1",
+            "app_id": "app-1",
+            "user_from": "account",
+            "invoke_from": "workflow",
+        },
+        "dataset_ids": ["dataset-1"],
+        "query": "reset password",
+        "retrieval": {
+            "mode": "multiple",
+            "top_k": 4,
+        },
+        "metadata_filtering": {
+            "mode": "disabled",
+        },
+        "attachment_ids": [],
+    }
+
+
+class TestInnerKnowledgeRetrieveApi:
+    def test_post_returns_401_when_api_key_missing(self, inner_api_app: Flask):
+        with patch("configs.dify_config.INNER_API", True):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=_payload(),
+                headers=_headers(api_key=None),
+            )
+
+        assert response.status_code == 401
+        assert response.get_json()["code"] == "inner_api_unauthorized"
+
+    def test_post_returns_401_when_api_key_invalid(self, inner_api_app: Flask):
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=_payload(),
+                headers=_headers(api_key="wrong-key"),
+            )
+
+        assert response.status_code == 401
+        assert response.get_json()["code"] == "inner_api_unauthorized"
+
+    def test_post_returns_400_for_invalid_body(self, inner_api_app: Flask):
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json={"caller": {"tenant_id": "tenant-1"}},
+                headers=_headers(),
+            )
+
+        assert response.status_code == 400
+        assert response.get_json()["code"] == "invalid_request"
+
+    @patch("controllers.inner_api.knowledge.retrieval.InnerKnowledgeRetrievalService.retrieve")
+    def test_post_returns_404_for_service_not_found_error(self, mock_retrieve, inner_api_app: Flask):
+        mock_retrieve.side_effect = InnerKnowledgeRetrieveAppNotFoundError("app missing")
+
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=_payload(),
+                headers=_headers(),
+            )
+
+        assert response.status_code == 404
+        assert response.get_json()["code"] == "app_not_found"
+
+    @patch("controllers.inner_api.knowledge.retrieval.InnerKnowledgeRetrievalService.retrieve")
+    def test_post_returns_403_for_service_forbidden_error(self, mock_retrieve, inner_api_app: Flask):
+        mock_retrieve.side_effect = InnerKnowledgeRetrieveDatasetTenantMismatchError("wrong tenant")
+
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=_payload(),
+                headers=_headers(),
+            )
+
+        assert response.status_code == 403
+        assert response.get_json()["code"] == "dataset_tenant_mismatch"
+
+    @patch("controllers.inner_api.knowledge.retrieval.InnerKnowledgeRetrievalService.retrieve")
+    def test_post_returns_422_for_retrieval_config_value_error(self, mock_retrieve, inner_api_app: Flask):
+        mock_retrieve.side_effect = ValueError("invalid reranking config")
+
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=_payload(),
+                headers=_headers(),
+            )
+
+        assert response.status_code == 422
+        assert response.get_json()["code"] == "retrieval_config_invalid"
+
+    @patch("controllers.inner_api.knowledge.retrieval.InnerKnowledgeRetrievalService.retrieve")
+    def test_post_returns_429_for_rate_limit_error(self, mock_retrieve, inner_api_app: Flask):
+        mock_retrieve.side_effect = RateLimitExceededError("knowledge rate limited")
+
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=_payload(),
+                headers=_headers(),
+            )
+
+        assert response.status_code == 429
+        assert response.get_json()["code"] == "knowledge_rate_limited"
+
+    def test_post_returns_400_for_manual_metadata_without_conditions(self, inner_api_app: Flask):
+        payload = _payload()
+        payload["metadata_filtering"] = {"mode": "manual"}
+
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=payload,
+                headers=_headers(),
+            )
+
+        assert response.status_code == 400
+        assert response.get_json()["code"] == "invalid_request"
+
+    def test_post_returns_400_for_automatic_metadata_without_model_config(self, inner_api_app: Flask):
+        payload = _payload()
+        payload["metadata_filtering"] = {"mode": "automatic"}
+
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=payload,
+                headers=_headers(),
+            )
+
+        assert response.status_code == 400
+        assert response.get_json()["code"] == "invalid_request"
+
+    @patch("controllers.inner_api.knowledge.retrieval.InnerKnowledgeRetrievalService.retrieve")
+    def test_post_returns_502_for_external_knowledge_failure(self, mock_retrieve, inner_api_app: Flask):
+        mock_retrieve.side_effect = ExternalKnowledgeRetrievalError("upstream failed")
+
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=_payload(),
+                headers=_headers(),
+            )
+
+        assert response.status_code == 502
+        assert response.get_json()["code"] == "external_knowledge_failed"
+
+    @patch("controllers.inner_api.knowledge.retrieval.InnerKnowledgeRetrievalService.retrieve")
+    def test_post_returns_service_response(self, mock_retrieve, inner_api_app: Flask):
+        mock_retrieve.return_value = InnerKnowledgeRetrieveResponse(
+            results=[
+                Source(
+                    metadata=SourceMetadata(
+                        dataset_id="dataset-1",
+                        dataset_name="Docs",
+                        document_id="document-1",
+                        document_name="FAQ.md",
+                        data_source_type="upload_file",
+                    ),
+                    title="FAQ.md",
+                    files=[],
+                    content="Reset your password from settings.",
+                    summary=None,
+                )
+            ],
+            usage=InnerKnowledgeRetrieveUsage(
+                prompt_tokens=0,
+                completion_tokens=0,
+                total_tokens=0,
+                prompt_unit_price="0",
+                completion_unit_price="0",
+                prompt_price_unit="0.001",
+                completion_price_unit="0.001",
+                prompt_price="0",
+                completion_price="0",
+                total_price="0",
+                currency="USD",
+                latency=0,
+            ),
+        )
+
+        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+            response = inner_api_app.test_client().post(
+                "/inner/api/knowledge/retrieve",
+                json=_payload(),
+                headers=_headers(),
+            )
+
+        assert response.status_code == 200
+        data = response.get_json()
+        assert data["results"][0]["metadata"]["_source"] == "knowledge"
+        assert data["results"][0]["title"] == "FAQ.md"
+        assert data["usage"]["total_tokens"] == 0
diff --git a/api/tests/unit_tests/controllers/inner_api/test_runtime_credentials.py b/api/tests/unit_tests/controllers/inner_api/test_runtime_credentials.py
new file mode 100644
index 00000000000..87511a32b8c
--- /dev/null
+++ b/api/tests/unit_tests/controllers/inner_api/test_runtime_credentials.py
@@ -0,0 +1,208 @@
+"""Unit tests for runtime credential inner API."""
+
+import inspect
+from unittest.mock import MagicMock, patch
+
+from flask import Flask
+
+from controllers.inner_api.runtime_credentials import (
+    EnterpriseRuntimeCredentialsResolve,
+    InnerRuntimeCredentialsResolvePayload,
+)
+
+
+def test_runtime_credentials_payload_accepts_items():
+    payload = InnerRuntimeCredentialsResolvePayload.model_validate(
+        {
+            "tenant_id": "tenant-1",
+            "credentials": [
+                {
+                    "credential_id": "credential-1",
+                    "provider": "langgenius/openai/openai",
+                    "kind": "model",
+                }
+            ],
+        }
+    )
+
+    assert payload.tenant_id == "tenant-1"
+    assert payload.credentials[0].provider == "langgenius/openai/openai"
+    assert payload.credentials[0].kind == "model"
+
+
+@patch("controllers.inner_api.runtime_credentials.encrypter.decrypt_token")
+@patch("controllers.inner_api.runtime_credentials.db")
+@patch("controllers.inner_api.runtime_credentials.Session")
+@patch("controllers.inner_api.runtime_credentials.create_plugin_provider_manager")
+def test_runtime_model_credentials_resolve_returns_decrypted_values(
+    mock_provider_manager_factory,
+    mock_session_cls,
+    mock_db,
+    mock_decrypt_token,
+    app: Flask,
+):
+    provider_configuration = MagicMock()
+    provider_configuration.provider.provider_credential_schema.credential_form_schemas = []
+    provider_configuration.extract_secret_variables.return_value = ["openai_api_key"]
+    provider_configuration._get_provider_names.return_value = ["langgenius/openai/openai", "openai"]
+
+    provider_configurations = MagicMock()
+    provider_configurations.get.return_value = provider_configuration
+    provider_manager = MagicMock()
+    provider_manager.get_configurations.return_value = provider_configurations
+    mock_provider_manager_factory.return_value = provider_manager
+
+    credential = MagicMock()
+    credential.encrypted_config = '{"openai_api_key":"encrypted","api_base":"https://api.openai.com/v1"}'
+    session = MagicMock()
+    session.__enter__.return_value = session
+    session.__exit__.return_value = False
+    session.execute.return_value.scalar_one_or_none.return_value = credential
+    mock_session_cls.return_value = session
+    mock_db.engine = MagicMock()
+    mock_decrypt_token.return_value = "sk-test"
+
+    handler = EnterpriseRuntimeCredentialsResolve()
+    unwrapped = inspect.unwrap(handler.post)
+    with app.test_request_context():
+        with patch("controllers.inner_api.runtime_credentials.inner_api_ns") as mock_ns:
+            mock_ns.payload = {
+                "tenant_id": "tenant-1",
+                "credentials": [
+                    {
+                        "credential_id": "credential-1",
+                        "provider": "langgenius/openai/openai",
+                        "kind": "model",
+                    }
+                ],
+            }
+            body, status_code = unwrapped(handler)
+
+    assert status_code == 200
+    assert body["credentials"][0]["kind"] == "model"
+    assert body["credentials"][0]["values"]["openai_api_key"] == "sk-test"
+    assert body["credentials"][0]["values"]["api_base"] == "https://api.openai.com/v1"
+    mock_decrypt_token.assert_called_once_with(tenant_id="tenant-1", token="encrypted")
+
+
+@patch("controllers.inner_api.runtime_credentials.create_plugin_provider_manager")
+def test_runtime_model_credentials_resolve_rejects_unknown_provider(mock_provider_manager_factory, app: Flask):
+    provider_configurations = MagicMock()
+    provider_configurations.get.return_value = None
+    provider_manager = MagicMock()
+    provider_manager.get_configurations.return_value = provider_configurations
+    mock_provider_manager_factory.return_value = provider_manager
+
+    handler = EnterpriseRuntimeCredentialsResolve()
+    unwrapped = inspect.unwrap(handler.post)
+    with app.test_request_context():
+        with patch("controllers.inner_api.runtime_credentials.inner_api_ns") as mock_ns:
+            mock_ns.payload = {
+                "tenant_id": "tenant-1",
+                "credentials": [{"credential_id": "credential-1", "provider": "missing", "kind": "model"}],
+            }
+            body, status_code = unwrapped(handler)
+
+    assert status_code == 404
+    assert "provider" in body["message"]
+
+
+@patch("controllers.inner_api.runtime_credentials.create_provider_encrypter")
+@patch("controllers.inner_api.runtime_credentials.ToolProviderCredentialsCache")
+@patch("controllers.inner_api.runtime_credentials.db")
+@patch("controllers.inner_api.runtime_credentials.Session")
+@patch("controllers.inner_api.runtime_credentials.ToolManager")
+def test_runtime_tool_credentials_resolve_returns_decrypted_values(
+    mock_tool_manager,
+    mock_session_cls,
+    mock_db,
+    mock_cache_cls,
+    mock_create_encrypter,
+    app: Flask,
+):
+    provider_controller = MagicMock()
+    provider_controller.get_credentials_schema_by_type.return_value = []
+    mock_tool_manager.get_builtin_provider.return_value = provider_controller
+
+    builtin_provider = MagicMock()
+    builtin_provider.id = "credential-1"
+    session = MagicMock()
+    session.__enter__.return_value = session
+    session.__exit__.return_value = False
+    session.execute.return_value.scalar_one_or_none.return_value = builtin_provider
+    mock_session_cls.return_value = session
+    mock_db.engine = MagicMock()
+
+    provider_encrypter = MagicMock()
+    provider_encrypter.decrypt.return_value = {"tavily_api_key": "tvly-secret"}
+    mock_create_encrypter.return_value = (provider_encrypter, MagicMock())
+
+    handler = EnterpriseRuntimeCredentialsResolve()
+    unwrapped = inspect.unwrap(handler.post)
+    with app.test_request_context():
+        with patch("controllers.inner_api.runtime_credentials.inner_api_ns") as mock_ns:
+            mock_ns.payload = {
+                "tenant_id": "tenant-1",
+                "credentials": [
+                    {
+                        "credential_id": "credential-1",
+                        "provider": "langgenius/tavily/tavily",
+                        "kind": "tool",
+                    }
+                ],
+            }
+            body, status_code = unwrapped(handler)
+
+    assert status_code == 200
+    assert body["credentials"][0]["kind"] == "tool"
+    assert body["credentials"][0]["provider"] == "langgenius/tavily/tavily"
+    assert body["credentials"][0]["values"]["tavily_api_key"] == "tvly-secret"
+    compiled = str(session.execute.call_args.args[0].compile(compile_kwargs={"literal_binds": True}))
+    assert "tool_builtin_providers.provider = 'langgenius/tavily/tavily'" in compiled
+
+
+@patch("controllers.inner_api.runtime_credentials.db")
+@patch("controllers.inner_api.runtime_credentials.Session")
+@patch("controllers.inner_api.runtime_credentials.ToolManager")
+def test_runtime_tool_credentials_resolve_rejects_unknown_credential(
+    mock_tool_manager,
+    mock_session_cls,
+    mock_db,
+    app: Flask,
+):
+    mock_tool_manager.get_builtin_provider.return_value = MagicMock()
+
+    session = MagicMock()
+    session.__enter__.return_value = session
+    session.__exit__.return_value = False
+    session.execute.return_value.scalar_one_or_none.return_value = None
+    mock_session_cls.return_value = session
+    mock_db.engine = MagicMock()
+
+    handler = EnterpriseRuntimeCredentialsResolve()
+    unwrapped = inspect.unwrap(handler.post)
+    with app.test_request_context():
+        with patch("controllers.inner_api.runtime_credentials.inner_api_ns") as mock_ns:
+            mock_ns.payload = {
+                "tenant_id": "tenant-1",
+                "credentials": [{"credential_id": "missing", "provider": "langgenius/tavily/tavily", "kind": "tool"}],
+            }
+            body, status_code = unwrapped(handler)
+
+    assert status_code == 404
+    assert "credential" in body["message"]
+
+
+def test_runtime_credentials_resolve_rejects_unknown_kind(app: Flask):
+    handler = EnterpriseRuntimeCredentialsResolve()
+    unwrapped = inspect.unwrap(handler.post)
+    with app.test_request_context():
+        with patch("controllers.inner_api.runtime_credentials.inner_api_ns") as mock_ns:
+            mock_ns.payload = {
+                "tenant_id": "tenant-1",
+                "credentials": [{"credential_id": "credential-1", "provider": "x", "kind": "secret"}],
+            }
+            body, status_code = unwrapped(handler)
+
+    assert status_code == 400
+    assert "kind" in body["message"]
diff --git a/api/tests/unit_tests/controllers/inner_api/workspace/test_workspace.py b/api/tests/unit_tests/controllers/inner_api/workspace/test_workspace.py
index 7d2193adc69..25ae0778d4b 100644
--- a/api/tests/unit_tests/controllers/inner_api/workspace/test_workspace.py
+++ b/api/tests/unit_tests/controllers/inner_api/workspace/test_workspace.py
@@ -116,7 +116,9 @@ class TestEnterpriseWorkspace:
         assert result["tenant"]["id"] == "tenant-id"
         assert result["tenant"]["name"] == "My Workspace"
         mock_tenant_svc.create_tenant.assert_called_once_with("My Workspace", is_from_dashboard=True)
-        mock_tenant_svc.create_tenant_member.assert_called_once_with(mock_tenant, mock_account, role="owner")
+        mock_tenant_svc.create_tenant_member.assert_called_once_with(
+            mock_tenant, mock_account, mock_db.session, role="owner"
+        )
         mock_event.send.assert_called_once_with(mock_tenant)
 
     @patch("controllers.inner_api.workspace.workspace.db")
diff --git a/api/tests/unit_tests/controllers/openapi/conftest.py b/api/tests/unit_tests/controllers/openapi/conftest.py
index 70302810d2c..d79b5bd642c 100644
--- a/api/tests/unit_tests/controllers/openapi/conftest.py
+++ b/api/tests/unit_tests/controllers/openapi/conftest.py
@@ -35,7 +35,7 @@ def _stub_execute(
 
 
 @pytest.fixture
-def bypass_pipeline(monkeypatch):
+def bypass_pipeline(monkeypatch: pytest.MonkeyPatch):
     """Stub PipelineRouter._execute so endpoints skip real auth at request time.
 
     Module-level @auth_router.guard(...) captures the real router at import
diff --git a/api/tests/unit_tests/controllers/openapi/test_account.py b/api/tests/unit_tests/controllers/openapi/test_account.py
index 5bab035e457..b4af7dda4a6 100644
--- a/api/tests/unit_tests/controllers/openapi/test_account.py
+++ b/api/tests/unit_tests/controllers/openapi/test_account.py
@@ -167,14 +167,14 @@ def _session_auth_data() -> AuthData:
     )
 
 
-def _stub_session_deps(monkeypatch, rows):
+def _stub_session_deps(monkeypatch: pytest.MonkeyPatch, rows):
     mod = sys.modules[_ACCOUNT_MOD]
     monkeypatch.setattr(mod, "get_auth_ctx", lambda: SimpleNamespace())
     monkeypatch.setattr(mod, "list_active_sessions", lambda *args, **kwargs: rows)
     monkeypatch.setattr(mod, "db", MagicMock())
 
 
-def test_sessions_list_valid_query_parses_page_and_limit(app, monkeypatch):
+def test_sessions_list_valid_query_parses_page_and_limit(app: Flask, monkeypatch: pytest.MonkeyPatch):
     """A valid ?page&limit round-trips through SessionListQuery into the response envelope."""
     api = AccountSessionsApi()
     _stub_session_deps(monkeypatch, [])
@@ -187,7 +187,7 @@ def test_sessions_list_valid_query_parses_page_and_limit(app, monkeypatch):
     assert body["data"] == []
 
 
-def test_sessions_list_defaults_when_query_omitted(app, monkeypatch):
+def test_sessions_list_defaults_when_query_omitted(app: Flask, monkeypatch: pytest.MonkeyPatch):
     """No query → the model's defaults (page=1, limit=100) drive the envelope."""
     api = AccountSessionsApi()
     _stub_session_deps(monkeypatch, [])
@@ -209,7 +209,7 @@ def test_sessions_list_defaults_when_query_omitted(app, monkeypatch):
         "foo=bar",  # extra='forbid'
     ],
 )
-def test_sessions_list_rejects_out_of_bounds_query(app, monkeypatch, query):
+def test_sessions_list_rejects_out_of_bounds_query(app: Flask, monkeypatch: pytest.MonkeyPatch, query):
     """Out-of-range / unknown query params raise 422 instead of being silently coerced."""
     api = AccountSessionsApi()
     _stub_session_deps(monkeypatch, [])
diff --git a/api/tests/unit_tests/controllers/openapi/test_app_run_streaming.py b/api/tests/unit_tests/controllers/openapi/test_app_run_streaming.py
index 0dbb595ba11..ddd72f604d6 100644
--- a/api/tests/unit_tests/controllers/openapi/test_app_run_streaming.py
+++ b/api/tests/unit_tests/controllers/openapi/test_app_run_streaming.py
@@ -6,6 +6,9 @@ import sys
 from types import SimpleNamespace
 from unittest.mock import Mock
 
+import pytest
+from flask import Flask
+
 from controllers.openapi._models import AppRunRequest
 
 
@@ -30,7 +33,9 @@ def test_app_run_request_with_query():
     assert req.query == "hello"
 
 
-def test_run_chat_always_calls_generate_with_streaming_true(app, bypass_pipeline, monkeypatch):
+def test_run_chat_always_calls_generate_with_streaming_true(
+    app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+):
     """_run_chat must always invoke AppGenerateService.generate with streaming=True."""
     from controllers.openapi.app_run import _run_chat
 
@@ -56,7 +61,7 @@ def test_stop_task_endpoint_registered(openapi_app):
     assert "/openapi/v1/apps/<string:app_id>/tasks/<string:task_id>/stop" in rules
 
 
-def test_stop_task_calls_queue_manager_and_graph_engine(app, bypass_pipeline, monkeypatch):
+def test_stop_task_calls_queue_manager_and_graph_engine(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     import uuid
 
     from controllers.openapi.app_run import AppRunTaskStopApi
diff --git a/api/tests/unit_tests/controllers/openapi/test_audit_app_run.py b/api/tests/unit_tests/controllers/openapi/test_audit_app_run.py
index b2a115f955d..6e2b909e494 100644
--- a/api/tests/unit_tests/controllers/openapi/test_audit_app_run.py
+++ b/api/tests/unit_tests/controllers/openapi/test_audit_app_run.py
@@ -1,13 +1,26 @@
 import logging
+from typing import Protocol, cast
+
+import pytest
 
 from controllers.openapi._audit import EVENT_APP_RUN_OPENAPI, emit_app_run
 
 
+class _AuditLogRecord(Protocol):
+    audit: bool
+    event: str
+    app_id: str
+    tenant_id: str
+    caller_kind: str
+    mode: str
+    surface: str
+
+
 def test_event_constant():
     assert EVENT_APP_RUN_OPENAPI == "app.run.openapi"
 
 
-def test_emit_app_run_logs_with_audit_extra(caplog):
+def test_emit_app_run_logs_with_audit_extra(caplog: pytest.LogCaptureFixture):
     with caplog.at_level(logging.INFO, logger="controllers.openapi._audit"):
         emit_app_run(
             app_id="app1",
@@ -16,7 +29,7 @@ def test_emit_app_run_logs_with_audit_extra(caplog):
             mode="chat",
             surface="apps",
         )
-    record = next(r for r in caplog.records if r.message and "app.run.openapi" in r.message)
+    record = cast(_AuditLogRecord, next(r for r in caplog.records if r.message and "app.run.openapi" in r.message))
     assert record.audit is True
     assert record.event == EVENT_APP_RUN_OPENAPI
     assert record.app_id == "app1"
diff --git a/api/tests/unit_tests/controllers/openapi/test_meta_version.py b/api/tests/unit_tests/controllers/openapi/test_meta_version.py
index 8f9e1016e8e..57de0c517f4 100644
--- a/api/tests/unit_tests/controllers/openapi/test_meta_version.py
+++ b/api/tests/unit_tests/controllers/openapi/test_meta_version.py
@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import pytest
+
 
 def test_version_endpoint_returns_200_without_auth(openapi_app):
     client = openapi_app.test_client()
@@ -30,7 +32,7 @@ def test_version_endpoint_ignores_bearer_header(openapi_app):
     assert "edition" in payload
 
 
-def test_version_endpoint_reflects_edition_config(openapi_app, monkeypatch):
+def test_version_endpoint_reflects_edition_config(openapi_app, monkeypatch: pytest.MonkeyPatch):
     from configs import dify_config
 
     monkeypatch.setattr(dify_config, "EDITION", "CLOUD")
@@ -42,7 +44,7 @@ def test_version_endpoint_reflects_edition_config(openapi_app, monkeypatch):
     assert response.get_json()["edition"] == "CLOUD"
 
 
-def test_version_endpoint_falls_back_to_self_hosted_on_unexpected_edition(openapi_app, monkeypatch):
+def test_version_endpoint_falls_back_to_self_hosted_on_unexpected_edition(openapi_app, monkeypatch: pytest.MonkeyPatch):
     from configs import dify_config
 
     monkeypatch.setattr(dify_config, "EDITION", "EXPERIMENTAL")
diff --git a/api/tests/unit_tests/controllers/openapi/test_workflow_events_openapi.py b/api/tests/unit_tests/controllers/openapi/test_workflow_events_openapi.py
index 78f2d0f20d0..51d5ecdd36f 100644
--- a/api/tests/unit_tests/controllers/openapi/test_workflow_events_openapi.py
+++ b/api/tests/unit_tests/controllers/openapi/test_workflow_events_openapi.py
@@ -8,6 +8,7 @@ from types import SimpleNamespace
 from unittest.mock import Mock
 
 import pytest
+from flask import Flask
 from werkzeug.exceptions import NotFound
 
 from controllers.openapi.auth.data import AuthData
@@ -51,7 +52,7 @@ class TestOpenApiWorkflowEventsApi:
 
         return OpenApiWorkflowEventsApi()
 
-    def test_not_found_when_run_missing(self, app, bypass_pipeline, monkeypatch):
+    def test_not_found_when_run_missing(self, app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
         module = sys.modules["controllers.openapi.workflow_events"]
         repo_mock = Mock()
         repo_mock.get_workflow_run_by_id_and_tenant_id.return_value = None
@@ -76,7 +77,9 @@ class TestOpenApiWorkflowEventsApi:
                     auth_data=_make_auth_data(app_model, caller, "account"),
                 )
 
-    def test_not_found_when_run_belongs_to_different_app(self, app, bypass_pipeline, monkeypatch):
+    def test_not_found_when_run_belongs_to_different_app(
+        self, app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+    ):
         module = sys.modules["controllers.openapi.workflow_events"]
         run = _make_workflow_run(app_id="other-app")
         repo_mock = Mock()
@@ -102,7 +105,9 @@ class TestOpenApiWorkflowEventsApi:
                     auth_data=_make_auth_data(app_model, caller, "account"),
                 )
 
-    def test_account_caller_checks_created_by_account(self, app, bypass_pipeline, monkeypatch):
+    def test_account_caller_checks_created_by_account(
+        self, app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+    ):
         """Account caller must match created_by == caller.id and role == ACCOUNT."""
         module = sys.modules["controllers.openapi.workflow_events"]
         run = _make_workflow_run(created_by_role=CreatorUserRole.ACCOUNT, created_by="acct-1")
@@ -141,7 +146,9 @@ class TestOpenApiWorkflowEventsApi:
             )
         assert resp.mimetype == "text/event-stream"
 
-    def test_account_caller_rejected_for_end_user_run(self, app, bypass_pipeline, monkeypatch):
+    def test_account_caller_rejected_for_end_user_run(
+        self, app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+    ):
         module = sys.modules["controllers.openapi.workflow_events"]
         run = _make_workflow_run(created_by_role=CreatorUserRole.END_USER, created_by="eu-1")
         repo_mock = Mock()
@@ -167,7 +174,9 @@ class TestOpenApiWorkflowEventsApi:
                     auth_data=_make_auth_data(app_model, caller, "account"),
                 )
 
-    def test_end_user_caller_checks_created_by_end_user(self, app, bypass_pipeline, monkeypatch):
+    def test_end_user_caller_checks_created_by_end_user(
+        self, app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+    ):
         """End-user caller must match created_by == caller.id and role == END_USER."""
         module = sys.modules["controllers.openapi.workflow_events"]
         run = _make_workflow_run(created_by_role=CreatorUserRole.END_USER, created_by="eu-1")
@@ -202,7 +211,7 @@ class TestOpenApiWorkflowEventsApi:
             )
         assert resp.mimetype == "text/event-stream"
 
-    def test_finished_run_returns_single_sse_event(self, app, bypass_pipeline, monkeypatch):
+    def test_finished_run_returns_single_sse_event(self, app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
         """A finished run returns a single done-event SSE response without streaming."""
         from datetime import UTC, datetime
 
diff --git a/api/tests/unit_tests/controllers/openapi/test_workspaces_members.py b/api/tests/unit_tests/controllers/openapi/test_workspaces_members.py
index 4c09491ab59..cf9fa671987 100644
--- a/api/tests/unit_tests/controllers/openapi/test_workspaces_members.py
+++ b/api/tests/unit_tests/controllers/openapi/test_workspaces_members.py
@@ -34,6 +34,7 @@ from werkzeug.exceptions import BadRequest, NotFound, UnprocessableEntity
 from controllers.openapi import bp as openapi_bp
 from controllers.openapi._errors import MemberLicenseExceeded, MemberLimitExceeded
 from controllers.openapi._models import MemberInvitePayload, MemberRoleUpdatePayload
+from controllers.openapi.auth.data import AuthData
 from controllers.openapi.workspaces import (
     WorkspaceMemberApi,
     WorkspaceMemberRoleApi,
@@ -228,7 +229,7 @@ def test_role_payload_rejects_extra_field():
         MemberRoleUpdatePayload.model_validate({"role": "normal", "extra": "x"})
 
 
-def test_invite_rejects_invalid_body_with_422(app, bypass_pipeline):
+def test_invite_rejects_invalid_body_with_422(app: Flask, bypass_pipeline):
     """Invalid invite body → 422 via @accepts (was 400 through _validate_body)."""
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
@@ -245,7 +246,7 @@ def test_invite_rejects_invalid_body_with_422(app, bypass_pipeline):
             api.post.__wrapped__(api, workspace_id=ws_id, auth_data=_auth_data(acct_id))
 
 
-def test_update_role_rejects_invalid_body_with_422(app, bypass_pipeline):
+def test_update_role_rejects_invalid_body_with_422(app: Flask, bypass_pipeline):
     """Invalid role-update body surfaces as 422 through @accepts (was 400)."""
     ws_id, member_id = str(uuid.uuid4()), str(uuid.uuid4())
     acct_id = uuid.uuid4()
@@ -267,7 +268,9 @@ def test_update_role_rejects_invalid_body_with_422(app, bypass_pipeline):
 # ---------------------------------------------------------------------------
 
 
-def test_switch_returns_workspace_detail_with_current_true(app, bypass_pipeline, monkeypatch):
+def test_switch_returns_workspace_detail_with_current_true(
+    app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+):
     """Happy path: switch service is called, then the workspace+membership
     row is re-queried so the returned `current` reflects post-commit state.
     """
@@ -298,7 +301,9 @@ def test_switch_returns_workspace_detail_with_current_true(app, bypass_pipeline,
     assert switch_mock.called
 
 
-def test_switch_404s_when_service_raises_account_not_link_tenant(app, bypass_pipeline, monkeypatch):
+def test_switch_404s_when_service_raises_account_not_link_tenant(
+    app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+):
     """If switch_tenant raises (e.g. Tenant.status != NORMAL), the body
     surfaces as NotFound, not 500."""
     ws_id = str(uuid.uuid4())
@@ -326,7 +331,7 @@ def test_switch_404s_when_service_raises_account_not_link_tenant(app, bypass_pip
 # ---------------------------------------------------------------------------
 
 
-def test_members_list_returns_normalized_rows(app, bypass_pipeline, monkeypatch):
+def test_members_list_returns_normalized_rows(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
     api = WorkspaceMembersApi()
@@ -364,7 +369,7 @@ def test_members_list_returns_normalized_rows(app, bypass_pipeline, monkeypatch)
     assert body["data"][0]["status"] == "active"
 
 
-def test_members_list_paginates_with_query_params(app, bypass_pipeline, monkeypatch):
+def test_members_list_paginates_with_query_params(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     """`?page=2&limit=2` slices service output and reports total/has_more."""
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
@@ -404,7 +409,7 @@ def test_members_list_paginates_with_query_params(app, bypass_pipeline, monkeypa
     assert [d["id"] for d in body["data"]] == ["m-2", "m-3"]
 
 
-def test_members_list_rejects_unknown_query_param(app, bypass_pipeline, monkeypatch):
+def test_members_list_rejects_unknown_query_param(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     """Strict (`extra='forbid'`) — typos like `?pg=2` surface as 422 (unified via @accepts)."""
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
@@ -425,7 +430,9 @@ def test_members_list_rejects_unknown_query_param(app, bypass_pipeline, monkeypa
 # ---------------------------------------------------------------------------
 
 
-def test_invite_happy_path_returns_invite_url_and_member_id(app, bypass_pipeline, monkeypatch):
+def test_invite_happy_path_returns_invite_url_and_member_id(
+    app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+):
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
     api = WorkspaceMembersApi()
@@ -507,7 +514,7 @@ def _invite_request(app, ws_id: str, acct_id: uuid.UUID):
     )
 
 
-def test_invite_blocked_by_saas_members_cap(app, bypass_pipeline, monkeypatch):
+def test_invite_blocked_by_saas_members_cap(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     """SaaS billing plan member cap → MemberLimitExceeded (403)."""
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
@@ -541,7 +548,7 @@ def test_invite_blocked_by_saas_members_cap(app, bypass_pipeline, monkeypatch):
     invite_mock.assert_not_called()
 
 
-def test_invite_blocked_by_ee_workspace_members_license(app, bypass_pipeline, monkeypatch):
+def test_invite_blocked_by_ee_workspace_members_license(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     """EE License workspace_members cap → MemberLicenseExceeded (403).
 
     Note: billing.enabled is False (EE without SaaS billing); only the
@@ -583,7 +590,7 @@ def test_invite_blocked_by_ee_workspace_members_license(app, bypass_pipeline, mo
     invite_mock.assert_not_called()
 
 
-def test_invite_ce_passes_when_both_caps_disabled(app, bypass_pipeline, monkeypatch):
+def test_invite_ce_passes_when_both_caps_disabled(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     """CE deployment (no billing, no license) → quota gate is a no-op,
     invite proceeds normally."""
     ws_id = str(uuid.uuid4())
@@ -619,7 +626,7 @@ def test_invite_ce_passes_when_both_caps_disabled(app, bypass_pipeline, monkeypa
     assert body["email"] == "new@example.com"
 
 
-def test_invite_400_when_already_in_tenant(app, bypass_pipeline, monkeypatch):
+def test_invite_400_when_already_in_tenant(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
     api = WorkspaceMembersApi()
@@ -650,7 +657,7 @@ def test_invite_400_when_already_in_tenant(app, bypass_pipeline, monkeypatch):
 # ---------------------------------------------------------------------------
 
 
-def test_delete_member_happy_path(app, bypass_pipeline, monkeypatch):
+def test_delete_member_happy_path(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     ws_id, member_id = str(uuid.uuid4()), str(uuid.uuid4())
     acct_id = uuid.uuid4()
     api = WorkspaceMemberApi()
@@ -692,7 +699,7 @@ def test_delete_member_happy_path(app, bypass_pipeline, monkeypatch):
         (MemberNotInTenantError("not in tenant"), NotFound),
     ],
 )
-def test_delete_member_exception_mapping(app, bypass_pipeline, monkeypatch, exc, expected):
+def test_delete_member_exception_mapping(app: Flask, bypass_pipeline, monkeypatch, exc, expected):
     ws_id, member_id = str(uuid.uuid4()), str(uuid.uuid4())
     acct_id = uuid.uuid4()
     api = WorkspaceMemberApi()
@@ -725,7 +732,7 @@ def test_delete_member_exception_mapping(app, bypass_pipeline, monkeypatch, exc,
             )
 
 
-def test_delete_member_404_when_member_missing(app, bypass_pipeline, monkeypatch):
+def test_delete_member_404_when_member_missing(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     ws_id, member_id = str(uuid.uuid4()), str(uuid.uuid4())
     acct_id = uuid.uuid4()
     api = WorkspaceMemberApi()
@@ -757,7 +764,7 @@ def test_delete_member_404_when_member_missing(app, bypass_pipeline, monkeypatch
 # ---------------------------------------------------------------------------
 
 
-def test_update_role_happy_path(app, bypass_pipeline, monkeypatch):
+def test_update_role_happy_path(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     ws_id, member_id = str(uuid.uuid4()), str(uuid.uuid4())
     acct_id = uuid.uuid4()
     api = WorkspaceMemberRoleApi()
@@ -801,7 +808,7 @@ def test_update_role_happy_path(app, bypass_pipeline, monkeypatch):
         (MemberNotInTenantError("not in tenant"), NotFound),
     ],
 )
-def test_update_role_exception_mapping(app, bypass_pipeline, monkeypatch, exc, expected):
+def test_update_role_exception_mapping(app: Flask, bypass_pipeline, monkeypatch, exc, expected):
     ws_id, member_id = str(uuid.uuid4()), str(uuid.uuid4())
     acct_id = uuid.uuid4()
     api = WorkspaceMemberRoleApi()
@@ -841,7 +848,7 @@ def test_update_role_exception_mapping(app, bypass_pipeline, monkeypatch, exc, e
 # ---------------------------------------------------------------------------
 
 
-def test_load_tenant_rejects_archived_workspace(app, bypass_pipeline, monkeypatch):
+def test_load_tenant_rejects_archived_workspace(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     """Member management against an archived workspace → 404."""
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
@@ -869,7 +876,7 @@ def test_load_tenant_rejects_archived_workspace(app, bypass_pipeline, monkeypatc
 # ---------------------------------------------------------------------------
 
 
-def test_invite_400_when_register_error(app, bypass_pipeline, monkeypatch):
+def test_invite_400_when_register_error(app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch):
     """AccountRegisterError (frozen email, workspace creation blocked) → 400."""
     ws_id = str(uuid.uuid4())
     acct_id = uuid.uuid4()
diff --git a/api/tests/unit_tests/controllers/service_api/app/test_file_preview.py b/api/tests/unit_tests/controllers/service_api/app/test_file_preview.py
index f5e8453c5cd..14a00a9af82 100644
--- a/api/tests/unit_tests/controllers/service_api/app/test_file_preview.py
+++ b/api/tests/unit_tests/controllers/service_api/app/test_file_preview.py
@@ -2,7 +2,9 @@
 Unit tests for Service API File Preview endpoint
 """
 
+import logging
 import uuid
+from typing import Protocol, cast
 from unittest.mock import Mock, patch
 
 import pytest
@@ -12,6 +14,12 @@ from controllers.service_api.app.file_preview import FilePreviewApi
 from models.model import App, EndUser, Message, MessageFile, UploadFile
 
 
+class _FilePreviewLogRecord(Protocol):
+    file_id: str
+    app_id: str
+    error: str
+
+
 class TestFilePreviewApi:
     """Test suite for FilePreviewApi"""
 
@@ -348,8 +356,9 @@ class TestFilePreviewApi:
 
             assert "Storage error" in str(exc_info.value)
 
-    @patch("controllers.service_api.app.file_preview.logger")
-    def test_validate_file_ownership_unexpected_error_logging(self, mock_logger, file_preview_api: FilePreviewApi):
+    def test_validate_file_ownership_unexpected_error_logging(
+        self, file_preview_api: FilePreviewApi, caplog: pytest.LogCaptureFixture
+    ):
         """Test that unexpected errors are logged properly"""
         file_id = str(uuid.uuid4())
         app_id = str(uuid.uuid4())
@@ -359,14 +368,19 @@ class TestFilePreviewApi:
             mock_db.session.scalar.side_effect = Exception("Unexpected database error")
 
             # Execute and assert exception
-            with pytest.raises(FileAccessDeniedError) as exc_info:
-                file_preview_api._validate_file_ownership(file_id, app_id)
+            with caplog.at_level(logging.ERROR, logger="controllers.service_api.app.file_preview"):
+                with pytest.raises(FileAccessDeniedError) as exc_info:
+                    file_preview_api._validate_file_ownership(file_id, app_id)
 
             # Verify error message
             assert "File access validation failed" in str(exc_info.value)
 
-            # Verify logging was called
-            mock_logger.exception.assert_called_once_with(
-                "Unexpected error during file ownership validation",
-                extra={"file_id": file_id, "app_id": app_id, "error": "Unexpected database error"},
-            )
+            # Verify logging was called with the structured context fields. The ``extra`` keys
+            # are attached to the LogRecord as attributes, so they are not in ``caplog.text``.
+            assert len(caplog.records) == 1
+            log_record = caplog.records[0]
+            assert log_record.getMessage() == "Unexpected error during file ownership validation"
+            record = cast(_FilePreviewLogRecord, log_record)
+            assert record.file_id == file_id
+            assert record.app_id == app_id
+            assert record.error == "Unexpected database error"
diff --git a/api/tests/unit_tests/controllers/service_api/end_user/test_end_user.py b/api/tests/unit_tests/controllers/service_api/end_user/test_end_user.py
index 9c310a4f456..687c1a67b1a 100644
--- a/api/tests/unit_tests/controllers/service_api/end_user/test_end_user.py
+++ b/api/tests/unit_tests/controllers/service_api/end_user/test_end_user.py
@@ -7,6 +7,7 @@ from pytest_mock import MockerFixture
 
 from controllers.service_api.end_user.end_user import EndUserApi
 from controllers.service_api.end_user.error import EndUserNotFoundError
+from models.enums import EndUserType
 from models.model import App, EndUser
 
 
@@ -29,7 +30,7 @@ class TestEndUserApi:
         end_user.id = str(uuid4())
         end_user.tenant_id = app_model.tenant_id
         end_user.app_id = app_model.id
-        end_user.type = "service_api"
+        end_user.type = EndUserType.SERVICE_API
         end_user.external_user_id = "external-123"
         end_user.name = "Alice"
         end_user._is_anonymous = True
diff --git a/api/tests/unit_tests/controllers/test_swagger.py b/api/tests/unit_tests/controllers/test_swagger.py
index 898eb2e86b7..3667c8ef2df 100644
--- a/api/tests/unit_tests/controllers/test_swagger.py
+++ b/api/tests/unit_tests/controllers/test_swagger.py
@@ -6,6 +6,32 @@ from collections.abc import Iterator
 import pytest
 from flask import Flask
 
+USER_PROPERTY_SCHEMA = {
+    "description": (
+        "User identifier, unique within the application. This identifier scopes data access; resources created with "
+        "one `user` value are only visible when queried with the same `user` value."
+    ),
+    "type": "string",
+}
+GENERIC_FILE_SCHEMA = {"description": "The file to upload.", "format": "binary", "type": "string"}
+DOCUMENT_CREATE_DATA_SCHEMA = {
+    "description": (
+        "JSON string containing configuration. Accepts the same fields as "
+        "[Create Document by Text](/api-reference/documents/create-document-by-text) (`indexing_technique`, "
+        "`doc_form`, `doc_language`, `process_rule`, `retrieval_model`, `embedding_model`, "
+        "`embedding_model_provider`) except `name` and `text`."
+    ),
+    "type": "string",
+}
+DOCUMENT_UPDATE_DATA_SCHEMA = {
+    "description": (
+        "JSON string containing document update settings such as `doc_form`, `doc_language`, `process_rule`, "
+        "`retrieval_model`, `embedding_model`, and `embedding_model_provider`. `name` and `text` are not used "
+        "for file updates."
+    ),
+    "type": "string",
+}
+
 
 def _schema_refs(value: object) -> set[str]:
     refs: set[str] = set()
@@ -57,6 +83,36 @@ def _multipart_form_schema(operation: dict[str, object]) -> dict[str, object]:
     return schema
 
 
+def _json_body_schema(payload: dict[str, object], operation: dict[str, object]) -> dict[str, object]:
+    request_body = operation.get("requestBody")
+    assert isinstance(request_body, dict)
+    content = request_body.get("content")
+    assert isinstance(content, dict)
+    json_media = content.get("application/json")
+    assert isinstance(json_media, dict)
+    schema = json_media.get("schema")
+    assert isinstance(schema, dict)
+
+    ref = schema.get("$ref")
+    if isinstance(ref, str):
+        schema_name = ref.removeprefix("#/components/schemas/")
+        resolved = payload["components"]["schemas"][schema_name]
+        assert isinstance(resolved, dict)
+        return resolved
+
+    return schema
+
+
+def _response_content_types(operation: dict[str, object], status_code: str = "200") -> set[str]:
+    responses = operation.get("responses")
+    assert isinstance(responses, dict)
+    response = responses.get(status_code)
+    assert isinstance(response, dict)
+    content = response.get("content")
+    assert isinstance(content, dict)
+    return set(content)
+
+
 @pytest.mark.parametrize(
     ("first_kwargs", "second_kwargs"),
     [
@@ -79,6 +135,25 @@ def test_inline_model_name_includes_list_constraints(
     assert _inline_model_name(first_inline_model) != _inline_model_name(second_inline_model)
 
 
+def test_uuid_path_format_is_derived_from_route_converter():
+    from flask_restx import swagger as restx_swagger
+
+    from libs.flask_restx_compat import install_swagger_compatibility
+
+    app = Flask(__name__)
+    with app.app_context():
+        install_swagger_compatibility()
+        params = restx_swagger.extract_path_params("/resources/<uuid:custom_resource_uuid>")
+
+    assert params["custom_resource_uuid"] == {
+        "format": "uuid",
+        "in": "path",
+        "name": "custom_resource_uuid",
+        "required": True,
+        "type": "string",
+    }
+
+
 def test_openapi_json_endpoints_render(monkeypatch: pytest.MonkeyPatch):
     from configs import dify_config
     from controllers.console import bp as console_bp
@@ -131,8 +206,12 @@ def test_service_document_file_routes_document_multipart_form_data(monkeypatch:
     create_schema = _multipart_form_schema(create_operation)
     create_properties = create_schema["properties"]
     assert isinstance(create_properties, dict)
-    assert create_properties["file"] == {"type": "string", "format": "binary"}
-    assert create_properties["data"] == {"type": "string"}
+    assert create_properties["file"] == {
+        "description": "Document file to upload.",
+        "format": "binary",
+        "type": "string",
+    }
+    assert create_properties["data"] == DOCUMENT_CREATE_DATA_SCHEMA
     assert create_schema["required"] == ["file"]
     assert create_operation["requestBody"]["required"] is True
 
@@ -145,12 +224,41 @@ def test_service_document_file_routes_document_multipart_form_data(monkeypatch:
         update_schema = _multipart_form_schema(update_operation)
         update_properties = update_schema["properties"]
         assert isinstance(update_properties, dict)
-        assert update_properties["file"] == {"type": "string", "format": "binary"}
-        assert update_properties["data"] == {"type": "string"}
+        assert update_properties["file"] == {
+            "description": "Replacement document file to upload.",
+            "format": "binary",
+            "type": "string",
+        }
+        assert update_properties["data"] == DOCUMENT_UPDATE_DATA_SCHEMA
         assert "required" not in update_schema
         assert update_operation["requestBody"]["required"] is False
 
 
+def test_service_openapi_merges_public_api_reference_descriptions(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+
+    chat_operation = payload["paths"]["/chat-messages"]["post"]
+    assert chat_operation["summary"] == "Send Chat Message"
+    assert chat_operation["description"] == "Send a request to the chat application."
+    assert chat_operation["tags"] == ["Chats", "Chatflows"]
+    assert chat_operation["responses"]["200"]["description"].startswith("Successful response.")
+
+    rename_operation = payload["paths"]["/conversations/{c_id}/name"]["post"]
+    assert rename_operation["summary"] == "Rename Conversation"
+    assert rename_operation["tags"] == ["Conversations"]
+    assert _parameters_by_name(rename_operation)["c_id"]["description"] == "Conversation ID."
+
+
 def test_service_document_list_documents_query_params_render(monkeypatch: pytest.MonkeyPatch):
     from configs import dify_config
     from controllers.service_api import bp as service_api_bp
@@ -170,6 +278,282 @@ def test_service_document_list_documents_query_params_render(monkeypatch: pytest
         assert params[name]["in"] == "query"
 
 
+def test_service_openapi_documents_decorator_user_contracts(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+    paths = payload["paths"]
+
+    required_json_user_operations = (
+        ("/completion-messages", "post"),
+        ("/completion-messages/{task_id}/stop", "post"),
+        ("/chat-messages", "post"),
+        ("/chat-messages/{task_id}/stop", "post"),
+        ("/messages/{message_id}/feedbacks", "post"),
+        ("/form/human_input/{form_token}", "post"),
+        ("/workflows/run", "post"),
+        ("/workflows/{workflow_id}/run", "post"),
+        ("/workflows/tasks/{task_id}/stop", "post"),
+    )
+    for path, method in required_json_user_operations:
+        schema = _json_body_schema(payload, paths[path][method])
+        assert schema["properties"]["user"] == USER_PROPERTY_SCHEMA
+        assert "user" in schema["required"]
+
+    optional_json_user_operations = (
+        ("/text-to-audio", "post"),
+        ("/conversations/{c_id}", "delete"),
+        ("/conversations/{c_id}/name", "post"),
+        ("/conversations/{c_id}/variables/{variable_id}", "put"),
+    )
+    for path, method in optional_json_user_operations:
+        schema = _json_body_schema(payload, paths[path][method])
+        assert schema["properties"]["user"] == USER_PROPERTY_SCHEMA
+        assert "user" not in schema.get("required", [])
+
+    messages_params = _parameters_by_name(paths["/messages"]["get"])
+    assert messages_params["user"]["in"] == "query"
+    assert messages_params["user"]["required"] is False
+
+    events_params = _parameters_by_name(paths["/workflow/{task_id}/events"]["get"])
+    assert events_params["user"]["in"] == "query"
+    assert events_params["user"]["required"] is True
+
+
+def test_service_openapi_documents_app_multipart_contracts(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+    paths = payload["paths"]
+
+    for path in ("/files/upload", "/audio-to-text"):
+        schema = _multipart_form_schema(paths[path]["post"])
+        if path == "/audio-to-text":
+            assert schema["properties"]["file"] == {
+                "description": (
+                    "Audio file to transcribe. Supported MIME types: `audio/mp3`, `audio/mpga`, `audio/m4a`, "
+                    "`audio/wav`, and `audio/amr`. File size limit is `30 MB`."
+                ),
+                "format": "binary",
+                "type": "string",
+            }
+        else:
+            assert schema["properties"]["file"] == GENERIC_FILE_SCHEMA
+        assert schema["properties"]["user"] == USER_PROPERTY_SCHEMA
+        assert schema["required"] == ["file"]
+
+    pipeline_schema = _multipart_form_schema(paths["/datasets/pipeline/file-upload"]["post"])
+    assert pipeline_schema["properties"]["file"] == GENERIC_FILE_SCHEMA
+    assert pipeline_schema["required"] == ["file"]
+
+
+def test_service_openapi_documents_non_json_response_media_types(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+    paths = payload["paths"]
+
+    assert _response_content_types(paths["/chat-messages"]["post"]) == {
+        "application/json",
+        "text/event-stream",
+    }
+    assert _response_content_types(paths["/workflow/{task_id}/events"]["get"]) == {"text/event-stream"}
+    assert _response_content_types(paths["/text-to-audio"]["post"]) == {"audio/mpeg"}
+    assert _response_content_types(paths["/files/{file_id}/preview"]["get"]) == {
+        "application/octet-stream",
+        "application/pdf",
+        "audio/aac",
+        "audio/flac",
+        "audio/mp4",
+        "audio/mpeg",
+        "audio/ogg",
+        "audio/wav",
+        "audio/x-m4a",
+        "image/gif",
+        "image/jpeg",
+        "image/png",
+        "image/webp",
+        "text/plain",
+        "video/mp4",
+        "video/quicktime",
+        "video/webm",
+    }
+    assert _response_content_types(paths["/datasets/{dataset_id}/documents/download-zip"]["post"]) == {
+        "application/zip"
+    }
+
+
+def test_service_openapi_documents_uuid_params_and_deprecated_routes(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+    paths = payload["paths"]
+
+    dataset_params = _parameters_by_name(paths["/datasets/{dataset_id}"]["get"])
+    assert dataset_params["dataset_id"]["schema"] == {
+        "description": "Knowledge base ID.",
+        "format": "uuid",
+        "type": "string",
+    }
+
+    conversation_params = _parameters_by_name(paths["/conversations/{c_id}"]["delete"])
+    assert conversation_params["c_id"]["schema"] == {
+        "description": "Conversation ID.",
+        "format": "uuid",
+        "type": "string",
+    }
+
+    assert paths["/datasets/{dataset_id}/document/create_by_file"]["post"]["deprecated"] is True
+    assert paths["/datasets/{dataset_id}/documents/{document_id}/update_by_text"]["post"]["deprecated"] is True
+
+
+def test_service_openapi_documents_path_action_enums(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+    paths = payload["paths"]
+
+    annotation_params = _parameters_by_name(paths["/apps/annotation-reply/{action}"]["post"])
+    assert annotation_params["action"]["schema"]["enum"] == ["enable", "disable"]
+
+    document_status_params = _parameters_by_name(paths["/datasets/{dataset_id}/documents/status/{action}"]["patch"])
+    assert document_status_params["action"]["schema"]["enum"] == ["enable", "disable", "archive", "un_archive"]
+
+    metadata_params = _parameters_by_name(paths["/datasets/{dataset_id}/metadata/built-in/{action}"]["post"])
+    assert metadata_params["action"]["schema"]["enum"] == ["enable", "disable"]
+
+
+def test_service_openapi_documents_conditional_payload_schemas(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+    paths = payload["paths"]
+
+    rename_schema = _json_body_schema(payload, paths["/conversations/{c_id}/name"]["post"])
+    auto_generate_branch, manual_name_branch = rename_schema["anyOf"]
+    assert auto_generate_branch["properties"]["auto_generate"]["enum"] == [True]
+    assert auto_generate_branch["required"] == ["auto_generate"]
+    assert manual_name_branch["properties"]["auto_generate"]["enum"] == [False]
+    assert manual_name_branch["properties"]["name"]["pattern"] == r".*\S.*"
+    assert manual_name_branch["required"] == ["name"]
+    for branch in rename_schema["anyOf"]:
+        assert branch["properties"]["user"] == USER_PROPERTY_SCHEMA
+
+    document_update_schema = payload["components"]["schemas"]["DocumentTextUpdate"]
+    with_text_branch, without_text_branch = document_update_schema["anyOf"]
+    assert with_text_branch["properties"]["text"]["type"] == "string"
+    assert with_text_branch["properties"]["name"]["type"] == "string"
+    assert with_text_branch["required"] == ["name", "text"]
+    assert without_text_branch["properties"]["text"]["type"] == "null"
+
+
+def test_service_openapi_does_not_encode_docs_coverage_boundaries(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+    paths = payload["paths"]
+
+    for path_item in paths.values():
+        assert isinstance(path_item, dict)
+        for method in ("delete", "get", "patch", "post", "put"):
+            operation = path_item.get(method)
+            if not isinstance(operation, dict):
+                continue
+            assert "x-dify-api-reference-visibility" not in operation
+            assert "x-dify-api-lifecycle" not in operation
+
+    assert paths["/datasets/{dataset_id}/document/create_by_text"]["post"]["deprecated"] is True
+    assert paths["/datasets/{dataset_id}/document/create_by_file"]["post"]["deprecated"] is True
+    assert paths["/datasets/{dataset_id}/documents/{document_id}/update-by-file"]["post"]["deprecated"] is True
+
+
+def test_service_openapi_documents_auth_and_compatibility_payloads(monkeypatch: pytest.MonkeyPatch):
+    from configs import dify_config
+    from controllers.service_api import bp as service_api_bp
+
+    monkeypatch.setattr(dify_config, "SWAGGER_UI_ENABLED", True)
+
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    app.config["RESTX_INCLUDE_ALL_MODELS"] = True
+    app.register_blueprint(service_api_bp)
+
+    payload = app.test_client().get("/v1/openapi.json").get_json()
+
+    assert payload["components"]["securitySchemes"]["Bearer"] == {
+        "bearerFormat": "API_KEY",
+        "description": "Use the Service API key as a Bearer token in the Authorization header.",
+        "scheme": "bearer",
+        "type": "http",
+    }
+
+    tag_unbinding_schema = payload["components"]["schemas"]["TagUnbindingPayload"]
+    assert tag_unbinding_schema["description"] == (
+        "Accepts either the legacy tag_id payload or the normalized tag_ids payload."
+    )
+    tag_id_schema, tag_ids_schema = tag_unbinding_schema["anyOf"]
+    assert tag_id_schema["properties"]["tag_id"]["description"] == ("Legacy single tag ID accepted by the Service API.")
+    assert tag_id_schema["required"] == ["tag_id", "target_id"]
+    assert tag_ids_schema["properties"]["tag_ids"]["minItems"] == 1
+    assert tag_ids_schema["required"] == ["tag_ids", "target_id"]
+
+
 def test_console_account_avatar_query_param_renders_as_query(monkeypatch: pytest.MonkeyPatch):
     from configs import dify_config
     from controllers.console import bp as console_bp
diff --git a/api/tests/unit_tests/core/agent/strategy/test_plugin.py b/api/tests/unit_tests/core/agent/strategy/test_plugin.py
index 0fea04845d2..15c441e5876 100644
--- a/api/tests/unit_tests/core/agent/strategy/test_plugin.py
+++ b/api/tests/unit_tests/core/agent/strategy/test_plugin.py
@@ -81,7 +81,7 @@ class TestPluginAgentStrategyInitialization:
 
 
 class TestGetParameters:
-    def test_get_parameters_returns_parameters(self, strategy, mock_declaration) -> None:
+    def test_get_parameters_returns_parameters(self, strategy: PluginAgentStrategy, mock_declaration) -> None:
         result = strategy.get_parameters()
         assert result == mock_declaration.parameters
 
@@ -92,7 +92,7 @@ class TestGetParameters:
 
 
 class TestInitializeParameters:
-    def test_initialize_parameters_success(self, strategy, mock_declaration) -> None:
+    def test_initialize_parameters_success(self, strategy: PluginAgentStrategy, mock_declaration) -> None:
         params = {"param1": "value1"}
 
         result = strategy.initialize_parameters(params.copy())
@@ -114,13 +114,13 @@ class TestInitializeParameters:
             {"param1": {}, "param2": "value"},
         ],
     )
-    def test_initialize_parameters_edge_cases(self, strategy, input_params) -> None:
+    def test_initialize_parameters_edge_cases(self, strategy: PluginAgentStrategy, input_params) -> None:
         result = strategy.initialize_parameters(input_params.copy())
 
         for param in strategy.declaration.parameters:
             assert param.name in result
 
-    def test_initialize_parameters_invalid_input_type(self, strategy) -> None:
+    def test_initialize_parameters_invalid_input_type(self, strategy: PluginAgentStrategy) -> None:
         with pytest.raises(AttributeError):
             strategy.initialize_parameters(None)
 
@@ -131,7 +131,7 @@ class TestInitializeParameters:
 
 
 class TestInvoke:
-    def test_invoke_success_all_arguments(self, strategy, mocker) -> None:
+    def test_invoke_success_all_arguments(self, strategy: PluginAgentStrategy, mocker: MockerFixture) -> None:
         mock_manager = MagicMock()
         mock_manager.invoke = MagicMock(return_value=iter(["msg1", "msg2"]))
 
@@ -171,7 +171,7 @@ class TestInvoke:
         assert call_kwargs["message_id"] == "msg_1"
         assert call_kwargs["context"] is not None
 
-    def test_invoke_with_credentials(self, strategy, mocker) -> None:
+    def test_invoke_with_credentials(self, strategy: PluginAgentStrategy, mocker: MockerFixture) -> None:
         mock_manager = MagicMock()
         mock_manager.invoke = MagicMock(return_value=iter([]))
 
@@ -243,7 +243,7 @@ class TestInvoke:
         assert result == []
         mock_manager.invoke.assert_called_once()
 
-    def test_invoke_convert_raises_exception(self, strategy, mocker) -> None:
+    def test_invoke_convert_raises_exception(self, strategy: PluginAgentStrategy, mocker: MockerFixture) -> None:
         mocker.patch(
             "core.agent.strategy.plugin.PluginAgentClient",
             return_value=MagicMock(),
@@ -257,7 +257,7 @@ class TestInvoke:
         with pytest.raises(ValueError):
             list(strategy._invoke(params={}, user_id="user_1"))
 
-    def test_invoke_manager_raises_exception(self, strategy, mocker) -> None:
+    def test_invoke_manager_raises_exception(self, strategy: PluginAgentStrategy, mocker: MockerFixture) -> None:
         mock_manager = MagicMock()
         mock_manager.invoke.side_effect = RuntimeError("invoke failed")
 
diff --git a/api/tests/unit_tests/core/agent/test_base_agent_runner.py b/api/tests/unit_tests/core/agent/test_base_agent_runner.py
index f5e4b099936..b983a945ad5 100644
--- a/api/tests/unit_tests/core/agent/test_base_agent_runner.py
+++ b/api/tests/unit_tests/core/agent/test_base_agent_runner.py
@@ -21,7 +21,7 @@ def mock_db_session(mocker: MockerFixture):
 
 
 @pytest.fixture
-def runner(mocker, mock_db_session):
+def runner(mocker: MockerFixture, mock_db_session):
     r = BaseAgentRunner.__new__(BaseAgentRunner)
     r.tenant_id = "tenant"
     r.user_id = "user"
@@ -42,13 +42,13 @@ def runner(mocker, mock_db_session):
 
 
 class TestRepack:
-    def test_sets_empty_if_none(self, runner, mocker: MockerFixture):
+    def test_sets_empty_if_none(self, runner: BaseAgentRunner, mocker: MockerFixture):
         entity = mocker.MagicMock()
         entity.app_config.prompt_template.simple_prompt_template = None
         result = runner._repack_app_generate_entity(entity)
         assert result.app_config.prompt_template.simple_prompt_template == ""
 
-    def test_keeps_existing(self, runner, mocker: MockerFixture):
+    def test_keeps_existing(self, runner: BaseAgentRunner, mocker: MockerFixture):
         entity = mocker.MagicMock()
         entity.app_config.prompt_template.simple_prompt_template = "abc"
         result = runner._repack_app_generate_entity(entity)
@@ -61,7 +61,7 @@ class TestRepack:
 
 
 class TestUpdatePromptTool:
-    def test_replaces_prompt_tool_parameters_with_tool_schema(self, runner, mocker: MockerFixture):
+    def test_replaces_prompt_tool_parameters_with_tool_schema(self, runner: BaseAgentRunner, mocker: MockerFixture):
         tool = mocker.MagicMock()
         schema = {
             "type": "object",
@@ -83,7 +83,7 @@ class TestUpdatePromptTool:
 
 
 class TestCreateAgentThought:
-    def test_with_files(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_with_files(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         mock_thought = mocker.MagicMock(id=10)
         mocker.patch.object(module, "MessageAgentThought", return_value=mock_thought)
 
@@ -91,7 +91,7 @@ class TestCreateAgentThought:
         assert result == "10"
         assert runner.agent_thought_count == 1
 
-    def test_without_files(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_without_files(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         mock_thought = mocker.MagicMock(id=11)
         mocker.patch.object(module, "MessageAgentThought", return_value=mock_thought)
 
@@ -112,12 +112,12 @@ class TestSaveAgentThought:
         agent.thought = ""
         return agent
 
-    def test_not_found(self, runner, mock_db_session):
+    def test_not_found(self, runner: BaseAgentRunner, mock_db_session):
         mock_db_session.scalar.return_value = None
         with pytest.raises(ValueError):
             runner.save_agent_thought("id", None, None, None, None, None, None, [], None)
 
-    def test_full_update(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_full_update(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         agent = self.setup_agent(mocker)
         mock_db_session.scalar.return_value = agent
 
@@ -152,7 +152,7 @@ class TestSaveAgentThought:
         assert agent.tokens == 3
         assert "tool1" in json.loads(agent.tool_labels_str)
 
-    def test_label_fallback_when_none(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_label_fallback_when_none(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         agent = self.setup_agent(mocker)
         agent.tool = "unknown_tool"
         mock_db_session.scalar.return_value = agent
@@ -162,7 +162,7 @@ class TestSaveAgentThought:
         labels = json.loads(agent.tool_labels_str)
         assert "unknown_tool" in labels
 
-    def test_json_failure_paths(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_json_failure_paths(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         agent = self.setup_agent(mocker)
         mock_db_session.scalar.return_value = agent
 
@@ -183,13 +183,13 @@ class TestSaveAgentThought:
 
         assert mock_db_session.commit.called
 
-    def test_messages_ids_none(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_messages_ids_none(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         agent = self.setup_agent(mocker)
         mock_db_session.scalar.return_value = agent
         runner.save_agent_thought("id", None, None, None, None, None, None, None, None)
         assert mock_db_session.commit.called
 
-    def test_success_dict_serialization(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_success_dict_serialization(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         agent = self.setup_agent(mocker)
         mock_db_session.scalar.return_value = agent
 
@@ -215,19 +215,19 @@ class TestSaveAgentThought:
 
 
 class TestOrganizeUserPrompt:
-    def test_no_files(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_no_files(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         mock_db_session.scalars.return_value.all.return_value = []
         msg = mocker.MagicMock(id="1", query="hello", app_model_config=None)
         result = runner.organize_agent_user_prompt(msg)
         assert result.content == "hello"
 
-    def test_with_files_no_config(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_with_files_no_config(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         mock_db_session.scalars.return_value.all.return_value = [mocker.MagicMock()]
         msg = mocker.MagicMock(id="1", query="hello", app_model_config=None)
         result = runner.organize_agent_user_prompt(msg)
         assert result.content == "hello"
 
-    def test_image_detail_low_fallback(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_image_detail_low_fallback(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         mock_db_session.scalars.return_value.all.return_value = [mocker.MagicMock()]
         file_config = mocker.MagicMock()
         file_config.image_config = mocker.MagicMock(detail=None)
@@ -247,27 +247,27 @@ class TestOrganizeUserPrompt:
 
 
 class TestOrganizeHistory:
-    def test_empty(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_empty(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         mock_db_session.execute.return_value.scalars.return_value.all.return_value = []
         mocker.patch.object(module, "extract_thread_messages", return_value=[])
         result = runner.organize_agent_history([])
         assert result == []
 
-    def test_with_answer_only(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_with_answer_only(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         msg = mocker.MagicMock(id="m1", answer="ans", agent_thoughts=[], app_model_config=None)
         mock_db_session.execute.return_value.scalars.return_value.all.return_value = [msg]
         mocker.patch.object(module, "extract_thread_messages", return_value=[msg])
         result = runner.organize_agent_history([])
         assert any(isinstance(x, module.AssistantPromptMessage) for x in result)
 
-    def test_skip_current_message(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_skip_current_message(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         msg = mocker.MagicMock(id="msg_current", agent_thoughts=[], answer="ans", app_model_config=None)
         mock_db_session.execute.return_value.scalars.return_value.all.return_value = [msg]
         mocker.patch.object(module, "extract_thread_messages", return_value=[msg])
         result = runner.organize_agent_history([])
         assert result == []
 
-    def test_with_tool_calls_invalid_json(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_with_tool_calls_invalid_json(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         thought = mocker.MagicMock(
             tool="tool1",
             tool_input="invalid",
@@ -283,7 +283,7 @@ class TestOrganizeHistory:
         result = runner.organize_agent_history([])
         assert isinstance(result, list)
 
-    def test_empty_tool_name_split(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_empty_tool_name_split(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         thought = mocker.MagicMock(tool=";", thought="thinking")
         msg = mocker.MagicMock(id="m5", agent_thoughts=[thought], answer=None, app_model_config=None)
 
@@ -292,7 +292,7 @@ class TestOrganizeHistory:
         result = runner.organize_agent_history([])
         assert isinstance(result, list)
 
-    def test_valid_json_tool_flow(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_valid_json_tool_flow(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         thought = mocker.MagicMock(
             tool="tool1",
             tool_input=json.dumps({"tool1": {"x": 1}}),
@@ -321,7 +321,7 @@ class TestOrganizeHistory:
 
 
 class TestConvertToolToPromptMessageTool:
-    def test_basic_conversion(self, runner, mocker: MockerFixture):
+    def test_basic_conversion(self, runner: BaseAgentRunner, mocker: MockerFixture):
         tool = mocker.MagicMock(tool_name="tool1")
 
         tool_entity = mocker.MagicMock()
@@ -347,7 +347,7 @@ class TestConvertToolToPromptMessageTool:
 
 
 class TestInitPromptToolsExtended:
-    def test_agent_tool_branch(self, runner, mocker: MockerFixture):
+    def test_agent_tool_branch(self, runner: BaseAgentRunner, mocker: MockerFixture):
         agent_tool = mocker.MagicMock(tool_name="agent_tool")
         runner.app_config.agent = mocker.MagicMock(tools=[agent_tool])
         mocker.patch.object(runner, "_convert_tool_to_prompt_message_tool", return_value=(MagicMock(), "entity"))
@@ -355,7 +355,7 @@ class TestInitPromptToolsExtended:
         tools, prompts = runner._init_prompt_tools()
         assert "agent_tool" in tools
 
-    def test_exception_in_conversion(self, runner, mocker: MockerFixture):
+    def test_exception_in_conversion(self, runner: BaseAgentRunner, mocker: MockerFixture):
         agent_tool = mocker.MagicMock(tool_name="bad_tool")
         runner.app_config.agent = mocker.MagicMock(tools=[agent_tool])
         mocker.patch.object(runner, "_convert_tool_to_prompt_message_tool", side_effect=Exception)
@@ -370,7 +370,7 @@ class TestInitPromptToolsExtended:
 
 
 class TestAdditionalCoverage:
-    def test_save_agent_thought_existing_labels(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_save_agent_thought_existing_labels(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         agent = mocker.MagicMock()
         agent.tool = "tool1"
         agent.tool_labels = {"tool1": {"en_US": "existing"}}
@@ -381,7 +381,7 @@ class TestAdditionalCoverage:
         labels = json.loads(agent.tool_labels_str)
         assert labels["tool1"]["en_US"] == "existing"
 
-    def test_save_agent_thought_tool_meta_string(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_save_agent_thought_tool_meta_string(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         agent = mocker.MagicMock()
         agent.tool = "tool1"
         agent.tool_labels = {}
@@ -391,7 +391,7 @@ class TestAdditionalCoverage:
         runner.save_agent_thought("id", None, None, None, None, "meta_string", None, [], None)
         assert agent.tool_meta_str == "meta_string"
 
-    def test_convert_dataset_retriever_tool(self, runner, mocker: MockerFixture):
+    def test_convert_dataset_retriever_tool(self, runner: BaseAgentRunner, mocker: MockerFixture):
         ds_tool = mocker.MagicMock()
         ds_tool.entity.identity.name = "ds"
         ds_tool.entity.description.llm = "desc"
@@ -408,7 +408,9 @@ class TestAdditionalCoverage:
         prompt = runner._convert_dataset_retriever_tool_to_prompt_message_tool(ds_tool)
         assert prompt is not None
 
-    def test_organize_user_prompt_with_file_objects(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_organize_user_prompt_with_file_objects(
+        self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture
+    ):
         mock_db_session.scalars.return_value.all.return_value = [mocker.MagicMock()]
 
         file_config = mocker.MagicMock()
@@ -427,7 +429,7 @@ class TestAdditionalCoverage:
         result = runner.organize_agent_user_prompt(msg)
         assert result is not None
 
-    def test_organize_history_without_tool_names(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_organize_history_without_tool_names(self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture):
         thought = mocker.MagicMock(tool=None, thought="thinking")
         msg = mocker.MagicMock(id="m3", agent_thoughts=[thought], answer=None, app_model_config=None)
 
@@ -437,7 +439,9 @@ class TestAdditionalCoverage:
         result = runner.organize_agent_history([])
         assert isinstance(result, list)
 
-    def test_organize_history_multiple_tools_split(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_organize_history_multiple_tools_split(
+        self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture
+    ):
         thought = mocker.MagicMock(
             tool="tool1;tool2",
             tool_input=json.dumps({"tool1": {}, "tool2": {}}),
@@ -455,7 +459,7 @@ class TestAdditionalCoverage:
 
 
 class TestConvertDatasetRetrieverTool:
-    def test_required_param_added(self, runner, mocker: MockerFixture):
+    def test_required_param_added(self, runner: BaseAgentRunner, mocker: MockerFixture):
         ds_tool = mocker.MagicMock()
         ds_tool.entity.identity.name = "ds"
         ds_tool.entity.description.llm = "desc"
@@ -518,7 +522,7 @@ class TestBaseAgentRunnerInit:
 
 
 class TestBaseAgentRunnerCoverage:
-    def test_init_prompt_tools_adds_dataset_tools(self, runner, mocker: MockerFixture):
+    def test_init_prompt_tools_adds_dataset_tools(self, runner: BaseAgentRunner, mocker: MockerFixture):
         dataset_tool = mocker.MagicMock()
         dataset_tool.entity.identity.name = "ds"
         runner.dataset_tools = [dataset_tool]
@@ -530,7 +534,9 @@ class TestBaseAgentRunnerCoverage:
         assert tools["ds"] == dataset_tool
         assert len(prompt_tools) == 1
 
-    def test_save_agent_thought_json_dumps_fallbacks(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_save_agent_thought_json_dumps_fallbacks(
+        self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture
+    ):
         agent = mocker.MagicMock()
         agent.tool = "tool1"
         agent.tool_labels = {}
@@ -568,7 +574,9 @@ class TestBaseAgentRunnerCoverage:
         assert isinstance(agent.observation, str)
         assert isinstance(agent.tool_meta_str, str)
 
-    def test_save_agent_thought_skips_empty_tool_name(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_save_agent_thought_skips_empty_tool_name(
+        self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture
+    ):
         agent = mocker.MagicMock()
         agent.tool = "tool1;;"
         agent.tool_labels = {}
@@ -582,7 +590,9 @@ class TestBaseAgentRunnerCoverage:
         labels = json.loads(agent.tool_labels_str)
         assert "" not in labels
 
-    def test_organize_history_includes_system_prompt(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_organize_history_includes_system_prompt(
+        self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture
+    ):
         mock_db_session.execute.return_value.scalars.return_value.all.return_value = []
         mocker.patch.object(module, "extract_thread_messages", return_value=[])
 
@@ -592,7 +602,9 @@ class TestBaseAgentRunnerCoverage:
 
         assert system_message in result
 
-    def test_organize_history_tool_inputs_and_observation_none(self, runner, mock_db_session, mocker: MockerFixture):
+    def test_organize_history_tool_inputs_and_observation_none(
+        self, runner: BaseAgentRunner, mock_db_session, mocker: MockerFixture
+    ):
         thought = mocker.MagicMock(
             tool="tool1",
             tool_input=None,
diff --git a/api/tests/unit_tests/core/agent/test_cot_agent_runner.py b/api/tests/unit_tests/core/agent/test_cot_agent_runner.py
index 314305d371a..a6cae351b17 100644
--- a/api/tests/unit_tests/core/agent/test_cot_agent_runner.py
+++ b/api/tests/unit_tests/core/agent/test_cot_agent_runner.py
@@ -95,25 +95,25 @@ class TestFillInputs:
             ("", {"x": "y"}, ""),
         ],
     )
-    def test_fill_in_inputs(self, runner, instruction, inputs, expected):
+    def test_fill_in_inputs(self, runner: DummyRunner, instruction, inputs, expected):
         result = runner._fill_in_inputs_from_external_data_tools(instruction, inputs)
         assert result == expected
 
 
 class TestConvertDictToAction:
-    def test_convert_valid_dict(self, runner):
+    def test_convert_valid_dict(self, runner: DummyRunner):
         action_dict = {"action": "test", "action_input": {"a": 1}}
         action = runner._convert_dict_to_action(action_dict)
         assert action.action_name == "test"
         assert action.action_input == {"a": 1}
 
-    def test_convert_missing_keys(self, runner):
+    def test_convert_missing_keys(self, runner: DummyRunner):
         with pytest.raises(KeyError):
             runner._convert_dict_to_action({"invalid": 1})
 
 
 class TestFormatAssistantMessage:
-    def test_format_assistant_message_multiple_scratchpads(self, runner):
+    def test_format_assistant_message_multiple_scratchpads(self, runner: DummyRunner):
         sp1 = AgentScratchpadUnit(
             agent_response="resp1",
             thought="thought1",
@@ -131,7 +131,7 @@ class TestFormatAssistantMessage:
         result = runner._format_assistant_message([sp1, sp2])
         assert "Final Answer:" in result
 
-    def test_format_with_final(self, runner):
+    def test_format_with_final(self, runner: DummyRunner):
         scratchpad = AgentScratchpadUnit(
             agent_response="Done",
             thought="",
@@ -144,7 +144,7 @@ class TestFormatAssistantMessage:
         result = runner._format_assistant_message([scratchpad])
         assert "Final Answer" in result
 
-    def test_format_with_action_and_observation(self, runner):
+    def test_format_with_action_and_observation(self, runner: DummyRunner):
         scratchpad = AgentScratchpadUnit(
             agent_response="resp",
             thought="thinking",
@@ -161,12 +161,12 @@ class TestFormatAssistantMessage:
 
 
 class TestHandleInvokeAction:
-    def test_handle_invoke_action_tool_not_present(self, runner):
+    def test_handle_invoke_action_tool_not_present(self, runner: DummyRunner):
         action = AgentScratchpadUnit.Action(action_name="missing", action_input={})
         response, meta = runner._handle_invoke_action(action, {}, [])
         assert "there is not a tool named" in response
 
-    def test_tool_with_json_string_args(self, runner, mocker: MockerFixture):
+    def test_tool_with_json_string_args(self, runner: DummyRunner, mocker: MockerFixture):
         action = AgentScratchpadUnit.Action(action_name="tool", action_input=json.dumps({"a": 1}))
         tool_instance = MagicMock()
         tool_instances = {"tool": tool_instance}
@@ -181,7 +181,7 @@ class TestHandleInvokeAction:
 
 
 class TestOrganizeHistoricPromptMessages:
-    def test_empty_history(self, runner, mocker: MockerFixture):
+    def test_empty_history(self, runner: DummyRunner, mocker: MockerFixture):
         mocker.patch(
             "core.agent.cot_agent_runner.AgentHistoryPromptTransform.get_prompt",
             return_value=[],
@@ -191,7 +191,7 @@ class TestOrganizeHistoricPromptMessages:
 
 
 class TestRun:
-    def test_run_handles_empty_parser_output(self, runner, mocker: MockerFixture):
+    def test_run_handles_empty_parser_output(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -203,7 +203,7 @@ class TestRun:
         results = list(runner.run(message, "query", {}))
         assert isinstance(results, list)
 
-    def test_run_with_action_and_tool_invocation(self, runner, mocker: MockerFixture):
+    def test_run_with_action_and_tool_invocation(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -224,7 +224,7 @@ class TestRun:
         with pytest.raises(AgentMaxIterationError):
             list(runner.run(message, "query", {"tool": MagicMock()}))
 
-    def test_run_respects_max_iteration_boundary(self, runner, mocker: MockerFixture):
+    def test_run_respects_max_iteration_boundary(self, runner: DummyRunner, mocker: MockerFixture):
         runner.app_config.agent.max_iteration = 1
         message = MagicMock()
         message.id = "msg-id"
@@ -246,7 +246,7 @@ class TestRun:
         with pytest.raises(AgentMaxIterationError):
             list(runner.run(message, "query", {"tool": MagicMock()}))
 
-    def test_run_basic_flow(self, runner, mocker: MockerFixture):
+    def test_run_basic_flow(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -258,7 +258,7 @@ class TestRun:
         results = list(runner.run(message, "query", {"name": "John"}))
         assert results
 
-    def test_run_max_iteration_error(self, runner, mocker: MockerFixture):
+    def test_run_max_iteration_error(self, runner: DummyRunner, mocker: MockerFixture):
         runner.app_config.agent.max_iteration = 0
         message = MagicMock()
         message.id = "msg-id"
@@ -273,7 +273,7 @@ class TestRun:
         with pytest.raises(AgentMaxIterationError):
             list(runner.run(message, "query", {}))
 
-    def test_run_increase_usage_aggregation(self, runner, mocker: MockerFixture):
+    def test_run_increase_usage_aggregation(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
         runner.app_config.agent.max_iteration = 2
@@ -330,7 +330,7 @@ class TestRun:
         assert final_usage.completion_price == 2
         assert final_usage.total_price == 4
 
-    def test_run_when_no_action_branch(self, runner, mocker: MockerFixture):
+    def test_run_when_no_action_branch(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -342,7 +342,7 @@ class TestRun:
         results = list(runner.run(message, "query", {}))
         assert results[-1].delta.message.content == ""
 
-    def test_run_usage_missing_key_branch(self, runner, mocker: MockerFixture):
+    def test_run_usage_missing_key_branch(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -355,7 +355,7 @@ class TestRun:
 
         list(runner.run(message, "query", {}))
 
-    def test_run_prompt_tool_update_branch(self, runner, mocker: MockerFixture):
+    def test_run_prompt_tool_update_branch(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -387,7 +387,7 @@ class TestRun:
 
         runner.update_prompt_message_tool.assert_called_once()
 
-    def test_historic_with_assistant_and_tool_calls(self, runner):
+    def test_historic_with_assistant_and_tool_calls(self, runner: DummyRunner):
         from graphon.model_runtime.entities.message_entities import AssistantPromptMessage, ToolPromptMessage
 
         assistant = AssistantPromptMessage(content="thinking")
@@ -400,7 +400,7 @@ class TestRun:
         result = runner._organize_historic_prompt_messages([])
         assert isinstance(result, list)
 
-    def test_historic_final_flush_branch(self, runner):
+    def test_historic_final_flush_branch(self, runner: DummyRunner):
         from graphon.model_runtime.entities.message_entities import AssistantPromptMessage
 
         assistant = AssistantPromptMessage(content="final")
@@ -411,7 +411,7 @@ class TestRun:
 
 
 class TestInitReactState:
-    def test_init_react_state_resets_state(self, runner, mocker: MockerFixture):
+    def test_init_react_state_resets_state(self, runner: DummyRunner, mocker: MockerFixture):
         mocker.patch.object(runner, "_organize_historic_prompt_messages", return_value=["historic"])
         runner._agent_scratchpad = ["old"]
         runner._query = "old"
@@ -424,7 +424,7 @@ class TestInitReactState:
 
 
 class TestHandleInvokeActionExtended:
-    def test_tool_with_invalid_json_string_args(self, runner, mocker: MockerFixture):
+    def test_tool_with_invalid_json_string_args(self, runner: DummyRunner, mocker: MockerFixture):
         action = AgentScratchpadUnit.Action(action_name="tool", action_input="not-json")
         tool_instance = MagicMock()
         tool_instances = {"tool": tool_instance}
@@ -443,11 +443,11 @@ class TestHandleInvokeActionExtended:
 
 
 class TestFillInputsEdgeCases:
-    def test_fill_inputs_with_empty_inputs(self, runner):
+    def test_fill_inputs_with_empty_inputs(self, runner: DummyRunner):
         result = runner._fill_in_inputs_from_external_data_tools("Hello {{x}}", {})
         assert result == "Hello {{x}}"
 
-    def test_fill_inputs_with_exception_in_replace(self, runner):
+    def test_fill_inputs_with_exception_in_replace(self, runner: DummyRunner):
         class BadValue:
             def __str__(self):
                 raise Exception("fail")
@@ -458,7 +458,7 @@ class TestFillInputsEdgeCases:
 
 
 class TestOrganizeHistoricPromptMessagesExtended:
-    def test_user_message_flushes_scratchpad(self, runner, mocker: MockerFixture):
+    def test_user_message_flushes_scratchpad(self, runner: DummyRunner, mocker: MockerFixture):
         from graphon.model_runtime.entities.message_entities import UserPromptMessage
 
         user_message = UserPromptMessage(content="Hi")
@@ -473,7 +473,7 @@ class TestOrganizeHistoricPromptMessagesExtended:
         result = runner._organize_historic_prompt_messages([])
         assert result == ["final"]
 
-    def test_tool_message_without_scratchpad_raises(self, runner):
+    def test_tool_message_without_scratchpad_raises(self, runner: DummyRunner):
         from graphon.model_runtime.entities.message_entities import ToolPromptMessage
 
         runner.history_prompt_messages = [ToolPromptMessage(content="obs", tool_call_id="1")]
@@ -481,7 +481,7 @@ class TestOrganizeHistoricPromptMessagesExtended:
         with pytest.raises(NotImplementedError):
             runner._organize_historic_prompt_messages([])
 
-    def test_agent_history_transform_invocation(self, runner, mocker: MockerFixture):
+    def test_agent_history_transform_invocation(self, runner: DummyRunner, mocker: MockerFixture):
         mock_transform = MagicMock()
         mock_transform.get_prompt.return_value = []
 
@@ -496,7 +496,7 @@ class TestOrganizeHistoricPromptMessagesExtended:
 
 
 class TestRunAdditionalBranches:
-    def test_run_with_no_action_final_answer_empty(self, runner, mocker: MockerFixture):
+    def test_run_with_no_action_final_answer_empty(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -508,7 +508,7 @@ class TestRunAdditionalBranches:
         results = list(runner.run(message, "query", {}))
         assert any(hasattr(r, "delta") for r in results)
 
-    def test_run_with_final_answer_action_string(self, runner, mocker: MockerFixture):
+    def test_run_with_final_answer_action_string(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -522,7 +522,7 @@ class TestRunAdditionalBranches:
         results = list(runner.run(message, "query", {}))
         assert results[-1].delta.message.content == "done"
 
-    def test_run_with_final_answer_action_dict(self, runner, mocker: MockerFixture):
+    def test_run_with_final_answer_action_dict(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
@@ -536,7 +536,7 @@ class TestRunAdditionalBranches:
         results = list(runner.run(message, "query", {}))
         assert json.loads(results[-1].delta.message.content) == {"a": 1}
 
-    def test_run_with_string_final_answer(self, runner, mocker: MockerFixture):
+    def test_run_with_string_final_answer(self, runner: DummyRunner, mocker: MockerFixture):
         message = MagicMock()
         message.id = "msg-id"
 
diff --git a/api/tests/unit_tests/core/agent/test_cot_completion_agent_runner.py b/api/tests/unit_tests/core/agent/test_cot_completion_agent_runner.py
index 0d949c357dc..e910c59d368 100644
--- a/api/tests/unit_tests/core/agent/test_cot_completion_agent_runner.py
+++ b/api/tests/unit_tests/core/agent/test_cot_completion_agent_runner.py
@@ -17,7 +17,7 @@ from graphon.model_runtime.entities.message_entities import (
 
 
 @pytest.fixture
-def runner(mocker, dummy_tool_factory):
+def runner(mocker: MockerFixture, dummy_tool_factory):
     runner = CotCompletionAgentRunner.__new__(CotCompletionAgentRunner)
 
     runner._instruction = "Test instruction"
@@ -40,7 +40,11 @@ def runner(mocker, dummy_tool_factory):
 
 class TestOrganizeInstructionPrompt:
     def test_success_all_placeholders(
-        self, runner, dummy_app_config_factory, dummy_agent_config_factory, dummy_prompt_entity_factory
+        self,
+        runner: CotCompletionAgentRunner,
+        dummy_app_config_factory,
+        dummy_agent_config_factory,
+        dummy_prompt_entity_factory,
     ):
         template = (
             "{{instruction}} | {{tools}} | {{tool_names}} | {{historic_messages}} | {{agent_scratchpad}} | {{query}}"
@@ -58,12 +62,14 @@ class TestOrganizeInstructionPrompt:
         tools_payload = json.loads(result.split(" | ")[1])
         assert {item["name"] for item in tools_payload} == {"toolA", "toolB"}
 
-    def test_agent_none_raises(self, runner, dummy_app_config_factory):
+    def test_agent_none_raises(self, runner: CotCompletionAgentRunner, dummy_app_config_factory):
         runner.app_config = dummy_app_config_factory(agent=None)
         with pytest.raises(ValueError, match="Agent configuration is not set"):
             runner._organize_instruction_prompt()
 
-    def test_prompt_entity_none_raises(self, runner, dummy_app_config_factory, dummy_agent_config_factory):
+    def test_prompt_entity_none_raises(
+        self, runner: CotCompletionAgentRunner, dummy_app_config_factory, dummy_agent_config_factory
+    ):
         runner.app_config = dummy_app_config_factory(agent=dummy_agent_config_factory(prompt_entity=None))
         with pytest.raises(ValueError, match="prompt entity is not set"):
             runner._organize_instruction_prompt()
@@ -75,7 +81,7 @@ class TestOrganizeInstructionPrompt:
 
 
 class TestOrganizeHistoricPrompt:
-    def test_with_user_and_assistant_string(self, runner, mocker: MockerFixture):
+    def test_with_user_and_assistant_string(self, runner: CotCompletionAgentRunner, mocker: MockerFixture):
         user_msg = UserPromptMessage(content="Hello")
         assistant_msg = AssistantPromptMessage(content="Hi there")
 
@@ -90,7 +96,7 @@ class TestOrganizeHistoricPrompt:
         assert "Question: Hello" in result
         assert "Hi there" in result
 
-    def test_assistant_list_with_text_content(self, runner, mocker: MockerFixture):
+    def test_assistant_list_with_text_content(self, runner: CotCompletionAgentRunner, mocker: MockerFixture):
         text_content = TextPromptMessageContent(data="Partial answer")
         assistant_msg = AssistantPromptMessage(content=[text_content])
 
@@ -104,7 +110,9 @@ class TestOrganizeHistoricPrompt:
 
         assert "Partial answer" in result
 
-    def test_assistant_list_with_non_text_content_ignored(self, runner, mocker: MockerFixture):
+    def test_assistant_list_with_non_text_content_ignored(
+        self, runner: CotCompletionAgentRunner, mocker: MockerFixture
+    ):
         non_text_content = ImagePromptMessageContent(format="url", mime_type="image/png")
         assistant_msg = AssistantPromptMessage(content=[non_text_content])
 
@@ -117,7 +125,7 @@ class TestOrganizeHistoricPrompt:
         result = runner._organize_historic_prompt()
         assert result == ""
 
-    def test_empty_history(self, runner, mocker: MockerFixture):
+    def test_empty_history(self, runner: CotCompletionAgentRunner, mocker: MockerFixture):
         mocker.patch.object(
             runner,
             "_organize_historic_prompt_messages",
diff --git a/api/tests/unit_tests/core/agent/test_fc_agent_runner.py b/api/tests/unit_tests/core/agent/test_fc_agent_runner.py
index 3a4347e7239..9b2a1d70fdf 100644
--- a/api/tests/unit_tests/core/agent/test_fc_agent_runner.py
+++ b/api/tests/unit_tests/core/agent/test_fc_agent_runner.py
@@ -147,12 +147,12 @@ def runner(mocker: MockerFixture):
 
 class TestToolCallChecks:
     @pytest.mark.parametrize(("tool_calls", "expected"), [([], False), ([MagicMock()], True)])
-    def test_check_tool_calls(self, runner, tool_calls, expected):
+    def test_check_tool_calls(self, runner: FunctionCallAgentRunner, tool_calls, expected):
         chunk = DummyChunk(message=DummyMessage(tool_calls=tool_calls))
         assert runner.check_tool_calls(chunk) is expected
 
     @pytest.mark.parametrize(("tool_calls", "expected"), [([], False), ([MagicMock()], True)])
-    def test_check_blocking_tool_calls(self, runner, tool_calls, expected):
+    def test_check_blocking_tool_calls(self, runner: FunctionCallAgentRunner, tool_calls, expected):
         result = DummyResult(message=DummyMessage(tool_calls=tool_calls))
         assert runner.check_blocking_tool_calls(result) is expected
 
@@ -163,7 +163,7 @@ class TestToolCallChecks:
 
 
 class TestExtractToolCalls:
-    def test_extract_tool_calls_with_valid_json(self, runner):
+    def test_extract_tool_calls_with_valid_json(self, runner: FunctionCallAgentRunner):
         tool_call = MagicMock()
         tool_call.id = "1"
         tool_call.function.name = "tool"
@@ -174,7 +174,7 @@ class TestExtractToolCalls:
 
         assert calls == [("1", "tool", {"a": 1})]
 
-    def test_extract_tool_calls_empty_arguments(self, runner):
+    def test_extract_tool_calls_empty_arguments(self, runner: FunctionCallAgentRunner):
         tool_call = MagicMock()
         tool_call.id = "1"
         tool_call.function.name = "tool"
@@ -185,7 +185,7 @@ class TestExtractToolCalls:
 
         assert calls == [("1", "tool", {})]
 
-    def test_extract_blocking_tool_calls(self, runner):
+    def test_extract_blocking_tool_calls(self, runner: FunctionCallAgentRunner):
         tool_call = MagicMock()
         tool_call.id = "2"
         tool_call.function.name = "block"
@@ -203,16 +203,16 @@ class TestExtractToolCalls:
 
 
 class TestInitSystemMessage:
-    def test_init_system_message_empty_prompt_messages(self, runner):
+    def test_init_system_message_empty_prompt_messages(self, runner: FunctionCallAgentRunner):
         result = runner._init_system_message("system", [])
         assert len(result) == 1
 
-    def test_init_system_message_insert_at_start(self, runner):
+    def test_init_system_message_insert_at_start(self, runner: FunctionCallAgentRunner):
         msgs = [MagicMock()]
         result = runner._init_system_message("system", msgs)
         assert result[0].content == "system"
 
-    def test_init_system_message_no_template(self, runner):
+    def test_init_system_message_no_template(self, runner: FunctionCallAgentRunner):
         result = runner._init_system_message("", [])
         assert result == []
 
@@ -223,15 +223,15 @@ class TestInitSystemMessage:
 
 
 class TestOrganizeUserQuery:
-    def test_without_files(self, runner):
+    def test_without_files(self, runner: FunctionCallAgentRunner):
         result = runner._organize_user_query("query", [])
         assert len(result) == 1
 
-    def test_with_none_query(self, runner):
+    def test_with_none_query(self, runner: FunctionCallAgentRunner):
         result = runner._organize_user_query(None, [])
         assert len(result) == 1
 
-    def test_with_files_uses_image_detail_config(self, runner, mocker: MockerFixture):
+    def test_with_files_uses_image_detail_config(self, runner: FunctionCallAgentRunner, mocker: MockerFixture):
         file_content = TextPromptMessageContent(data="file-content")
         mock_to_prompt = mocker.patch(
             "core.agent.fc_agent_runner.file_manager.to_prompt_message_content",
@@ -255,7 +255,7 @@ class TestOrganizeUserQuery:
 
 
 class TestClearUserPromptImageMessages:
-    def test_clear_text_and_image_content(self, runner):
+    def test_clear_text_and_image_content(self, runner: FunctionCallAgentRunner):
         text = MagicMock()
         text.type = "text"
         text.data = "hello"
@@ -271,7 +271,7 @@ class TestClearUserPromptImageMessages:
         result = runner._clear_user_prompt_image_messages([user_msg])
         assert isinstance(result, list)
 
-    def test_clear_includes_file_placeholder(self, runner):
+    def test_clear_includes_file_placeholder(self, runner: FunctionCallAgentRunner):
         text = TextPromptMessageContent(data="hello")
         image = ImagePromptMessageContent(format="url", mime_type="image/png")
         document = DocumentPromptMessageContent(format="url", mime_type="application/pdf")
@@ -289,7 +289,7 @@ class TestClearUserPromptImageMessages:
 
 
 class TestRunMethod:
-    def test_run_non_streaming_no_tool_calls(self, runner):
+    def test_run_non_streaming_no_tool_calls(self, runner: FunctionCallAgentRunner):
         message = MagicMock(id="m1")
         dummy_message = DummyMessage(content="hello")
         result = DummyResult(message=dummy_message, usage=build_usage())
@@ -303,7 +303,7 @@ class TestRunMethod:
         queue_calls = runner.queue_manager.publish.call_args_list
         assert any(call.args and call.args[0].__class__.__name__ == "QueueMessageEndEvent" for call in queue_calls)
 
-    def test_run_streaming_branch(self, runner):
+    def test_run_streaming_branch(self, runner: FunctionCallAgentRunner):
         message = MagicMock(id="m1")
         runner.stream_tool_call = True
 
@@ -318,7 +318,7 @@ class TestRunMethod:
         outputs = list(runner.run(message, "query"))
         assert len(outputs) == 1
 
-    def test_run_streaming_tool_calls_list_content(self, runner):
+    def test_run_streaming_tool_calls_list_content(self, runner: FunctionCallAgentRunner):
         message = MagicMock(id="m1")
         runner.stream_tool_call = True
 
@@ -341,7 +341,7 @@ class TestRunMethod:
         outputs = list(runner.run(message, "query"))
         assert len(outputs) >= 1
 
-    def test_run_non_streaming_list_content(self, runner):
+    def test_run_non_streaming_list_content(self, runner: FunctionCallAgentRunner):
         message = MagicMock(id="m1")
         content = [TextPromptMessageContent(data="hi")]
         dummy_message = DummyMessage(content=content)
@@ -353,7 +353,7 @@ class TestRunMethod:
         assert len(outputs) == 1
         assert runner.save_agent_thought.call_args.kwargs["thought"] == "hi"
 
-    def test_run_streaming_tool_call_inputs_type_error(self, runner, mocker: MockerFixture):
+    def test_run_streaming_tool_call_inputs_type_error(self, runner: FunctionCallAgentRunner, mocker: MockerFixture):
         message = MagicMock(id="m1")
         runner.stream_tool_call = True
 
@@ -381,7 +381,7 @@ class TestRunMethod:
         outputs = list(runner.run(message, "query"))
         assert len(outputs) == 1
 
-    def test_run_with_missing_tool_instance(self, runner):
+    def test_run_with_missing_tool_instance(self, runner: FunctionCallAgentRunner):
         message = MagicMock(id="m1")
 
         tool_call = MagicMock()
@@ -399,7 +399,7 @@ class TestRunMethod:
         outputs = list(runner.run(message, "query"))
         assert len(outputs) >= 1
 
-    def test_run_with_tool_instance_and_files(self, runner, mocker: MockerFixture):
+    def test_run_with_tool_instance_and_files(self, runner: FunctionCallAgentRunner, mocker: MockerFixture):
         message = MagicMock(id="m1")
 
         tool_call = MagicMock()
@@ -434,7 +434,7 @@ class TestRunMethod:
             for call in runner.queue_manager.publish.call_args_list
         )
 
-    def test_run_max_iteration_error(self, runner):
+    def test_run_max_iteration_error(self, runner: FunctionCallAgentRunner):
         runner.app_config.agent.max_iteration = 0
 
         message = MagicMock(id="m1")
diff --git a/api/tests/unit_tests/core/app/app_config/easy_ui_based_app/test_dataset_manager.py b/api/tests/unit_tests/core/app/app_config/easy_ui_based_app/test_dataset_manager.py
index 3a239eac0e7..e4e4f99c6d4 100644
--- a/api/tests/unit_tests/core/app/app_config/easy_ui_based_app/test_dataset_manager.py
+++ b/api/tests/unit_tests/core/app/app_config/easy_ui_based_app/test_dataset_manager.py
@@ -32,7 +32,7 @@ def base_config(valid_uuid):
 
 
 @pytest.fixture
-def mock_dataset_service(mocker, valid_uuid):
+def mock_dataset_service(mocker: MockerFixture, valid_uuid):
     mock_dataset = MagicMock()
     mock_dataset.tenant_id = "tenant1"
 
@@ -318,3 +318,26 @@ class TestIsDatasetExists:
             return_value=mock_dataset,
         )
         assert not DatasetConfigManager.is_dataset_exists("tenant1", valid_uuid)
+
+
+# ==============================
+# extract_dataset_config_for_legacy_compatibility tests
+# ==============================
+
+
+class TestExtractDatasetConfigForLegacyCompatibility:
+    def test_skips_empty_tool_entry(self):
+        # A malformed empty tool dict in agent_mode.tools must be skipped, not
+        # crash with `IndexError` on `list(tool.keys())[0]`. The sibling
+        # convert() already guards this with `if len(tool) == 1`.
+        config = {
+            "agent_mode": {
+                "enabled": True,
+                "strategy": PlanningStrategy.ROUTER,
+                "tools": [{}],
+            }
+        }
+
+        result = DatasetConfigManager.extract_dataset_config_for_legacy_compatibility("tenant1", AppMode.CHAT, config)
+
+        assert result["agent_mode"]["tools"] == [{}]
diff --git a/api/tests/unit_tests/core/app/apps/agent_app/test_app_generator.py b/api/tests/unit_tests/core/app/apps/agent_app/test_app_generator.py
index 6c36815753e..b8cdf471ca3 100644
--- a/api/tests/unit_tests/core/app/apps/agent_app/test_app_generator.py
+++ b/api/tests/unit_tests/core/app/apps/agent_app/test_app_generator.py
@@ -36,7 +36,7 @@ def generator(mocker: MockerFixture) -> AgentAppGenerator:
 
 
 class TestGenerateGuards:
-    def test_rejects_blocking_mode(self, generator, mocker: MockerFixture):
+    def test_rejects_blocking_mode(self, generator: AgentAppGenerator, mocker: MockerFixture):
         with pytest.raises(AgentAppGeneratorError, match="only supports streaming"):
             generator.generate(
                 app_model=mocker.MagicMock(),
@@ -46,7 +46,7 @@ class TestGenerateGuards:
                 streaming=False,
             )
 
-    def test_requires_query(self, generator, mocker: MockerFixture):
+    def test_requires_query(self, generator: AgentAppGenerator, mocker: MockerFixture):
         with pytest.raises(AgentAppGeneratorError, match="query is required"):
             generator.generate(
                 app_model=mocker.MagicMock(),
@@ -55,7 +55,7 @@ class TestGenerateGuards:
                 invoke_from=InvokeFrom.WEB_APP,
             )
 
-    def test_rejects_blank_query(self, generator, mocker: MockerFixture):
+    def test_rejects_blank_query(self, generator: AgentAppGenerator, mocker: MockerFixture):
         with pytest.raises(AgentAppGeneratorError, match="query is required"):
             generator.generate(
                 app_model=mocker.MagicMock(),
@@ -66,6 +66,16 @@ class TestGenerateGuards:
 
 
 class TestGenerateSuccess:
+    def test_runtime_session_snapshot_id_is_stable_for_debugger_only(self):
+        assert (
+            AgentAppGenerator._runtime_session_snapshot_id(invoke_from=InvokeFrom.DEBUGGER, snapshot_id="snap-1")
+            is None
+        )
+        assert (
+            AgentAppGenerator._runtime_session_snapshot_id(invoke_from=InvokeFrom.WEB_APP, snapshot_id="snap-1")
+            == "snap-1"
+        )
+
     def test_generate_orchestrates_and_starts_worker(self, generator, mocker: MockerFixture):
         app_model = mocker.MagicMock(id="app1", tenant_id="tenant", mode="agent")
         user = DummyAccount("user")
@@ -103,7 +113,7 @@ class TestGenerateSuccess:
         thread_obj.start.assert_called_once()
         generator._resolve_agent.assert_called_once_with(app_model)
 
-    def test_generate_loads_existing_conversation(self, generator, mocker: MockerFixture):
+    def test_generate_loads_existing_conversation(self, generator: AgentAppGenerator, mocker: MockerFixture):
         app_model = mocker.MagicMock(id="app1", tenant_id="tenant", mode="agent")
         generator._resolve_agent = mocker.MagicMock(
             return_value=(mocker.MagicMock(id="a"), mocker.MagicMock(id="s"), mocker.MagicMock())
@@ -134,7 +144,9 @@ class TestGenerateSuccess:
 
         get_conv.assert_called_once()
 
-    def test_generate_does_not_include_trace_session_id_in_extras(self, generator, mocker: MockerFixture):
+    def test_generate_does_not_include_trace_session_id_in_extras(
+        self, generator: AgentAppGenerator, mocker: MockerFixture
+    ):
         app_model = mocker.MagicMock(id="app1", tenant_id="tenant", mode="agent")
         user = DummyAccount("user")
 
@@ -180,7 +192,7 @@ class TestGenerateWorker:
 
         mocker.patch("libs.flask_utils.preserve_flask_contexts", ctx_manager)
 
-    def _wire(self, generator, mocker: MockerFixture, *, run_side_effect=None, handled=False):
+    def _wire(self, generator: AgentAppGenerator, mocker: MockerFixture, *, run_side_effect=None, handled=False):
         generator._get_conversation = mocker.MagicMock(return_value=mocker.MagicMock(id="conv"))
         generator._get_message = mocker.MagicMock(return_value=mocker.MagicMock(id="msg"))
         generator._run_input_guards = mocker.MagicMock(return_value=(handled, "query"))
@@ -201,12 +213,25 @@ class TestGenerateWorker:
         mocker.patch(f"{MODULE}.AgentAppRunner", return_value=runner)
         return runner
 
-    def _call(self, generator, mocker: MockerFixture, queue_manager, *, is_resume=False, query="query"):
+    def _call(
+        self,
+        generator,
+        mocker: MockerFixture,
+        queue_manager,
+        *,
+        is_resume=False,
+        query="query",
+        runtime_session_snapshot_id="s",
+    ):
         generator._generate_worker(
             flask_app=mocker.MagicMock(),
             context=mocker.MagicMock(),
             application_generate_entity=mocker.MagicMock(
-                agent_id="a", agent_config_snapshot_id="s", model_conf=mocker.MagicMock(model="m"), query=query
+                agent_id="a",
+                agent_config_snapshot_id="s",
+                agent_runtime_session_snapshot_id=runtime_session_snapshot_id,
+                model_conf=mocker.MagicMock(model="m"),
+                query=query,
             ),
             queue_manager=queue_manager,
             conversation_id="conv",
@@ -215,13 +240,22 @@ class TestGenerateWorker:
             is_resume=is_resume,
         )
 
-    def test_happy_path_runs_backend(self, generator, mocker: MockerFixture):
+    def test_happy_path_runs_backend(self, generator: AgentAppGenerator, mocker: MockerFixture):
         runner = self._wire(generator, mocker)
         queue_manager = mocker.MagicMock()
         self._call(generator, mocker, queue_manager)
         runner.run.assert_called_once()
         queue_manager.publish_error.assert_not_called()
 
+    def test_worker_passes_runtime_session_scope_to_runner(self, generator, mocker: MockerFixture):
+        runner = self._wire(generator, mocker)
+        queue_manager = mocker.MagicMock()
+
+        self._call(generator, mocker, queue_manager, runtime_session_snapshot_id=None)
+
+        assert runner.run.call_args.kwargs["agent_config_snapshot_id"] == "s"
+        assert runner.run.call_args.kwargs["session_scope_snapshot_id"] is None
+
     def test_input_guard_short_circuit_skips_backend(self, generator, mocker: MockerFixture):
         runner = self._wire(generator, mocker, handled=True)
         queue_manager = mocker.MagicMock()
@@ -248,7 +282,7 @@ class TestGenerateWorker:
         self._call(generator, mocker, queue_manager)
         queue_manager.publish_error.assert_not_called()
 
-    def test_unexpected_error_is_published(self, generator, mocker: MockerFixture):
+    def test_unexpected_error_is_published(self, generator: AgentAppGenerator, mocker: MockerFixture):
         self._wire(generator, mocker, run_side_effect=ValueError("boom"))
         queue_manager = mocker.MagicMock()
         self._call(generator, mocker, queue_manager)
diff --git a/api/tests/unit_tests/core/app/apps/agent_app/test_app_runner.py b/api/tests/unit_tests/core/app/apps/agent_app/test_app_runner.py
index 48dea5583c0..4f920df0ec6 100644
--- a/api/tests/unit_tests/core/app/apps/agent_app/test_app_runner.py
+++ b/api/tests/unit_tests/core/app/apps/agent_app/test_app_runner.py
@@ -4,6 +4,8 @@ saved, using the deterministic fake backend client (no live stack)."""
 
 from __future__ import annotations
 
+from collections.abc import Iterator
+from datetime import UTC, datetime
 from types import SimpleNamespace
 from typing import Any, override
 from unittest.mock import MagicMock
@@ -11,7 +13,17 @@ from unittest.mock import MagicMock
 import pytest
 from agenton.compositor import CompositorSessionSnapshot
 from dify_agent.layers.ask_human import AskHumanToolResult
-from dify_agent.protocol import CancelRunRequest, CancelRunResponse, RuntimeLayerSpec
+from dify_agent.protocol import (
+    CancelRunRequest,
+    CancelRunResponse,
+    PydanticAIStreamRunEvent,
+    RunEvent,
+    RunStartedEvent,
+    RunSucceededEvent,
+    RunSucceededEventData,
+    RuntimeLayerSpec,
+)
+from pydantic_ai.messages import PartDeltaEvent, PartStartEvent, TextPart, TextPartDelta
 
 from clients.agent_backend import (
     AgentBackendError,
@@ -67,6 +79,58 @@ class _RecordingFakeAgentBackendRunClient(FakeAgentBackendRunClient):
         return super().cancel_run(run_id, request=request)
 
 
+class _StreamingFakeAgentBackendRunClient(FakeAgentBackendRunClient):
+    @override
+    def stream_events(self, run_id: str, *, after: str | None = None) -> Iterator[RunEvent]:
+        del after
+        created_at = datetime(2026, 1, 1, tzinfo=UTC)
+        yield RunStartedEvent(id="1-0", run_id=run_id, created_at=created_at)
+        yield PydanticAIStreamRunEvent(
+            id="2-0",
+            run_id=run_id,
+            created_at=created_at,
+            data=PartDeltaEvent(index=0, delta=TextPartDelta(content_delta="hello ")),
+        )
+        yield PydanticAIStreamRunEvent(
+            id="3-0",
+            run_id=run_id,
+            created_at=created_at,
+            data=PartDeltaEvent(index=0, delta=TextPartDelta(content_delta="agent")),
+        )
+        yield RunSucceededEvent(
+            id="4-0",
+            run_id=run_id,
+            created_at=created_at,
+            data=RunSucceededEventData(
+                output={"text": "hello agent"},
+                session_snapshot=CompositorSessionSnapshot(layers=[]),
+            ),
+        )
+
+
+class _StreamingPartStartFakeAgentBackendRunClient(FakeAgentBackendRunClient):
+    @override
+    def stream_events(self, run_id: str, *, after: str | None = None) -> Iterator[RunEvent]:
+        del after
+        created_at = datetime(2026, 1, 1, tzinfo=UTC)
+        yield RunStartedEvent(id="1-0", run_id=run_id, created_at=created_at)
+        yield PydanticAIStreamRunEvent(
+            id="2-0",
+            run_id=run_id,
+            created_at=created_at,
+            data=PartStartEvent(index=0, part=TextPart(content="hello")),
+        )
+        yield RunSucceededEvent(
+            id="3-0",
+            run_id=run_id,
+            created_at=created_at,
+            data=RunSucceededEventData(
+                output={"text": "hello agent"},
+                session_snapshot=CompositorSessionSnapshot(layers=[]),
+            ),
+        )
+
+
 class _FakeSessionStore:
     def __init__(
         self,
@@ -75,6 +139,7 @@ class _FakeSessionStore:
     ) -> None:
         self.loaded = loaded
         self._loaded_session = loaded_session
+        self.loaded_scopes: list[AgentAppSessionScope] = []
         self.saved: list[
             tuple[
                 AgentAppSessionScope,
@@ -87,9 +152,11 @@ class _FakeSessionStore:
         ] = []
 
     def load_active_snapshot(self, scope: AgentAppSessionScope) -> CompositorSessionSnapshot | None:
+        self.loaded_scopes.append(scope)
         return self.loaded
 
     def load_active_session(self, scope: AgentAppSessionScope) -> StoredAgentAppSession | None:
+        self.loaded_scopes.append(scope)
         if self._loaded_session is not None:
             return self._loaded_session
         if self.loaded is None:
@@ -160,6 +227,20 @@ def _run(runner: AgentAppRunner, qm: _FakeQueueManager) -> None:
     )
 
 
+def _message_end(qm: _FakeQueueManager) -> QueueMessageEndEvent:
+    return next(e for e in qm.events if isinstance(e, QueueMessageEndEvent))
+
+
+def _saved_user_query(qm: _FakeQueueManager) -> str:
+    llm_result = _message_end(qm).llm_result
+    assert llm_result is not None
+    prompt_messages = llm_result.prompt_messages
+    assert len(prompt_messages) == 1
+    content = prompt_messages[0].content
+    assert isinstance(content, str)
+    return content
+
+
 def test_successful_turn_publishes_chunk_and_message_end_and_saves_session():
     client = FakeAgentBackendRunClient()  # SUCCESS: output {"text": "hello agent"}
     store = _FakeSessionStore()
@@ -175,6 +256,7 @@ def test_successful_turn_publishes_chunk_and_message_end_and_saves_session():
     assert chunk_events[0].chunk.delta.message.content == "hello agent"
     assert end_events[0].llm_result.message.content == "hello agent"
     assert end_events[0].llm_result.model == "gpt-4o-mini"
+    assert _saved_user_query(qm) == "hello"
     # The conversation session snapshot is persisted for multi-turn continuity.
     assert store.saved
     saved_scope, saved_run_id, saved_snapshot, saved_specs, pending_form_id, pending_tool_call_id = store.saved[0]
@@ -193,6 +275,35 @@ def test_successful_turn_publishes_chunk_and_message_end_and_saves_session():
     ]
 
 
+def test_successful_turn_forwards_agent_backend_stream_text_deltas_without_duplicate_terminal_chunk():
+    client = _StreamingFakeAgentBackendRunClient()
+    store = _FakeSessionStore()
+    qm = _FakeQueueManager()
+
+    _run(_runner(client, store), qm)
+
+    chunk_events = [e for e in qm.events if isinstance(e, QueueLLMChunkEvent)]
+    end_events = [e for e in qm.events if isinstance(e, QueueMessageEndEvent)]
+    assert [event.chunk.delta.message.content for event in chunk_events] == ["hello ", "agent"]
+    assert len(end_events) == 1
+    assert end_events[0].llm_result.message.content == "hello agent"
+    assert store.saved
+
+
+def test_successful_turn_forwards_part_start_text_and_publishes_missing_terminal_suffix():
+    client = _StreamingPartStartFakeAgentBackendRunClient()
+    store = _FakeSessionStore()
+    qm = _FakeQueueManager()
+
+    _run(_runner(client, store), qm)
+
+    chunk_events = [e for e in qm.events if isinstance(e, QueueLLMChunkEvent)]
+    end_events = [e for e in qm.events if isinstance(e, QueueMessageEndEvent)]
+    assert [event.chunk.delta.message.content for event in chunk_events] == ["hello", " agent"]
+    assert len(end_events) == 1
+    assert end_events[0].llm_result.message.content == "hello agent"
+
+
 def test_prior_session_snapshot_is_threaded_into_request():
     prior = CompositorSessionSnapshot(layers=[])
     client = FakeAgentBackendRunClient()
@@ -205,6 +316,31 @@ def test_prior_session_snapshot_is_threaded_into_request():
     assert client.request.session_snapshot is prior
 
 
+def test_debug_session_scope_can_reuse_conversation_across_config_snapshots():
+    prior = CompositorSessionSnapshot(layers=[])
+    client = FakeAgentBackendRunClient()
+    store = _FakeSessionStore(loaded=prior)
+    qm = _FakeQueueManager()
+
+    _runner(client, store).run(
+        dify_context=_dify_ctx(),
+        agent_id="agent-1",
+        agent_config_snapshot_id="snap-new",
+        agent_soul=_soul(),
+        conversation_id="conv-1",
+        query="hello",
+        message_id="msg-1",
+        model_name="gpt-4o-mini",
+        queue_manager=qm,  # type: ignore[arg-type]
+        session_scope_snapshot_id=None,
+    )
+
+    assert client.request is not None
+    assert client.request.session_snapshot is prior
+    assert store.loaded_scopes[0].agent_config_snapshot_id is None
+    assert store.saved[0][0].agent_config_snapshot_id is None
+
+
 def test_failed_run_raises_agent_backend_error():
     client = FakeAgentBackendRunClient(scenario=FakeAgentBackendScenario.FAILED)
     store = _FakeSessionStore()
@@ -256,6 +392,7 @@ def test_ask_human_pauses_turn_creates_form_and_persists_correlation():
     assert created_params.conversation_id == "conv-1"
     assert created_params.workflow_execution_id is None
     assert [e for e in qm.events if isinstance(e, QueueMessageEndEvent)]
+    assert _saved_user_query(qm) == "hello"
     # The pause correlation is persisted so a form submission can resume the run.
     assert store.saved
     assert store.saved[0][4] == "form-1"
diff --git a/api/tests/unit_tests/core/app/apps/agent_app/test_input_guards.py b/api/tests/unit_tests/core/app/apps/agent_app/test_input_guards.py
index e1c8d51b0d9..24dd61cb951 100644
--- a/api/tests/unit_tests/core/app/apps/agent_app/test_input_guards.py
+++ b/api/tests/unit_tests/core/app/apps/agent_app/test_input_guards.py
@@ -11,6 +11,8 @@ from __future__ import annotations
 from types import SimpleNamespace
 from typing import Any
 
+import pytest
+
 import core.app.features.annotation_reply.annotation_reply as annotation_mod
 import core.moderation.input_moderation as input_moderation_mod
 from core.app.apps.agent_app.app_generator import AgentAppGenerator
@@ -42,7 +44,7 @@ def _make_entity(query: str = "hello") -> SimpleNamespace:
     )
 
 
-def _patch_moderation(monkeypatch, *, returns=None, raises: Exception | None = None) -> None:
+def _patch_moderation(monkeypatch: pytest.MonkeyPatch, *, returns=None, raises: Exception | None = None) -> None:
     class _FakeModeration:
         def check(self, **kwargs: Any):
             if raises is not None:
@@ -52,7 +54,7 @@ def _patch_moderation(monkeypatch, *, returns=None, raises: Exception | None = N
     monkeypatch.setattr(input_moderation_mod, "InputModeration", _FakeModeration)
 
 
-def _patch_annotation(monkeypatch, *, reply=None) -> None:
+def _patch_annotation(monkeypatch: pytest.MonkeyPatch, *, reply=None) -> None:
     class _FakeAnnotation:
         def query(self, **kwargs: Any):
             return reply
@@ -65,8 +67,15 @@ def _answer_text(events: list[Any]) -> str:
     return end.llm_result.message.content
 
 
+def _saved_user_query(events: list[Any]) -> str:
+    end = next(e for e in events if isinstance(e, QueueMessageEndEvent))
+    prompt_messages = end.llm_result.prompt_messages
+    assert len(prompt_messages) == 1
+    return prompt_messages[0].content
+
+
 class TestRunInputGuards:
-    def test_no_guards_passes_through(self, monkeypatch):
+    def test_no_guards_passes_through(self, monkeypatch: pytest.MonkeyPatch):
         _patch_moderation(monkeypatch, returns=(False, {}, "hello"))
         _patch_annotation(monkeypatch, reply=None)
         qm = _FakeQueueManager()
@@ -82,7 +91,7 @@ class TestRunInputGuards:
         assert query == "hello"
         assert qm.events == []
 
-    def test_moderation_override_sanitizes_query(self, monkeypatch):
+    def test_moderation_override_sanitizes_query(self, monkeypatch: pytest.MonkeyPatch):
         _patch_moderation(monkeypatch, returns=(True, {}, "[redacted]"))
         _patch_annotation(monkeypatch, reply=None)
         qm = _FakeQueueManager()
@@ -98,7 +107,7 @@ class TestRunInputGuards:
         assert query == "[redacted]"
         assert qm.events == []
 
-    def test_moderation_block_short_circuits(self, monkeypatch):
+    def test_moderation_block_short_circuits(self, monkeypatch: pytest.MonkeyPatch):
         _patch_moderation(monkeypatch, raises=ModerationError("blocked preset answer"))
         _patch_annotation(monkeypatch, reply=None)
         qm = _FakeQueueManager()
@@ -113,8 +122,9 @@ class TestRunInputGuards:
         assert handled is True
         assert any(isinstance(e, QueueLLMChunkEvent) for e in qm.events)
         assert _answer_text(qm.events) == "blocked preset answer"
+        assert _saved_user_query(qm.events) == "forbidden"
 
-    def test_annotation_hit_short_circuits(self, monkeypatch):
+    def test_annotation_hit_short_circuits(self, monkeypatch: pytest.MonkeyPatch):
         _patch_moderation(monkeypatch, returns=(False, {}, "what is your name"))
         _patch_annotation(monkeypatch, reply=SimpleNamespace(id="anno-1", content="I am the annotated Iris."))
         qm = _FakeQueueManager()
@@ -131,3 +141,4 @@ class TestRunInputGuards:
         assert len(annotation_events) == 1
         assert annotation_events[0].message_annotation_id == "anno-1"
         assert _answer_text(qm.events) == "I am the annotated Iris."
+        assert _saved_user_query(qm.events) == "what is your name"
diff --git a/api/tests/unit_tests/core/app/apps/agent_app/test_resolve_agent.py b/api/tests/unit_tests/core/app/apps/agent_app/test_resolve_agent.py
index 637c0fad5d2..c0a226ad575 100644
--- a/api/tests/unit_tests/core/app/apps/agent_app/test_resolve_agent.py
+++ b/api/tests/unit_tests/core/app/apps/agent_app/test_resolve_agent.py
@@ -44,7 +44,7 @@ def _snapshot() -> SimpleNamespace:
 
 
 class TestResolveAgentById:
-    def test_success_returns_agent_snapshot_soul(self, monkeypatch):
+    def test_success_returns_agent_snapshot_soul(self, monkeypatch: pytest.MonkeyPatch):
         agent = SimpleNamespace(id="agent-1")
         snapshot = _snapshot()
         _patch_session(monkeypatch, [agent, snapshot])
@@ -59,24 +59,24 @@ class TestResolveAgentById:
         assert soul.model is not None
         assert soul.model.model == "gpt-4o-mini"
 
-    def test_agent_missing_raises(self, monkeypatch):
+    def test_agent_missing_raises(self, monkeypatch: pytest.MonkeyPatch):
         _patch_session(monkeypatch, [None])
         with pytest.raises(AgentAppGeneratorError, match="Agent not found"):
             AgentAppGenerator._resolve_agent_by_id(tenant_id="t1", agent_id="x", snapshot_id="snap-1")
 
-    def test_no_published_version_raises(self, monkeypatch):
+    def test_no_published_version_raises(self, monkeypatch: pytest.MonkeyPatch):
         _patch_session(monkeypatch, [SimpleNamespace(id="agent-1")])
         with pytest.raises(AgentAppGeneratorError, match="no published version"):
             AgentAppGenerator._resolve_agent_by_id(tenant_id="t1", agent_id="agent-1", snapshot_id=None)
 
-    def test_snapshot_missing_raises(self, monkeypatch):
+    def test_snapshot_missing_raises(self, monkeypatch: pytest.MonkeyPatch):
         _patch_session(monkeypatch, [SimpleNamespace(id="agent-1"), None])
         with pytest.raises(AgentAppGeneratorError, match="published version not found"):
             AgentAppGenerator._resolve_agent_by_id(tenant_id="t1", agent_id="agent-1", snapshot_id="snap-1")
 
 
 class TestResolveAgent:
-    def test_success_chains_to_resolve_by_id(self, monkeypatch):
+    def test_success_chains_to_resolve_by_id(self, monkeypatch: pytest.MonkeyPatch):
         bound_agent = SimpleNamespace(id="agent-1", active_config_snapshot_id="snap-1")
         inner_agent = SimpleNamespace(id="agent-1")
         snapshot = _snapshot()
@@ -90,7 +90,7 @@ class TestResolveAgent:
         assert snap is snapshot
         assert soul.model is not None
 
-    def test_unbound_app_raises(self, monkeypatch):
+    def test_unbound_app_raises(self, monkeypatch: pytest.MonkeyPatch):
         _patch_session(monkeypatch, [None])
         app_model = SimpleNamespace(id="app-1", tenant_id="t1")
         with pytest.raises(AgentAppGeneratorError, match="has no bound Agent"):
diff --git a/api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py b/api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py
index 83f9b697b75..85a2423f6b1 100644
--- a/api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py
+++ b/api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py
@@ -144,6 +144,40 @@ class TestAgentAppRuntimeRequestBuilder:
         assert result.redacted_request["composition"]["layers"][-1]["config"]["credentials"] == "[REDACTED]"
         assert result.metadata["conversation_id"] == "conv-1"
 
+    def test_build_maps_agent_soul_knowledge_to_knowledge_layer(self):
+        soul = AgentSoulConfig.model_validate(
+            {
+                "model": {
+                    "plugin_id": "langgenius/openai",
+                    "model_provider": "langgenius/openai/openai",
+                    "model": "gpt-4o-mini",
+                },
+                "knowledge": {
+                    "datasets": [{"id": "dataset-1"}, {"id": "dataset-2"}],
+                    "query_config": {
+                        "top_k": 3,
+                        "score_threshold": 0.5,
+                        "score_threshold_enabled": False,
+                    },
+                },
+            }
+        )
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            plugin_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(soul))
+
+        knowledge = next(layer for layer in result.request.composition.layers if layer.name == "knowledge")
+        assert knowledge.type == "dify.knowledge_base"
+        assert knowledge.deps == {"execution_context": "execution_context"}
+        dumped_config = knowledge.config.model_dump(mode="json", by_alias=True)
+        assert dumped_config["dataset_ids"] == ["dataset-1", "dataset-2"]
+        assert dumped_config["retrieval"]["mode"] == "multiple"
+        assert dumped_config["retrieval"]["top_k"] == 3
+        assert dumped_config["retrieval"]["score_threshold"] == 0.0
+
     def test_build_raises_when_model_missing(self):
         builder = AgentAppRuntimeRequestBuilder(
             credentials_provider=_FakeCredentialsProvider(),
diff --git a/api/tests/unit_tests/core/app/apps/agent_app/test_session_store.py b/api/tests/unit_tests/core/app/apps/agent_app/test_session_store.py
index 65a7e0bc8ec..458b0a26dbe 100644
--- a/api/tests/unit_tests/core/app/apps/agent_app/test_session_store.py
+++ b/api/tests/unit_tests/core/app/apps/agent_app/test_session_store.py
@@ -22,7 +22,7 @@ from models.agent import AgentRuntimeSession, AgentRuntimeSessionOwnerType, Agen
 
 
 def _scope(
-    conversation_id: str = "conv-1", agent_id: str = "agent-1", agent_config_snapshot_id: str = "snap-1"
+    conversation_id: str = "conv-1", agent_id: str = "agent-1", agent_config_snapshot_id: str | None = "snap-1"
 ) -> AgentAppSessionScope:
     return AgentAppSessionScope(
         tenant_id="tenant-1",
@@ -125,6 +125,36 @@ def test_second_turn_updates_same_conversation_row():
         assert rows[0].backend_run_id == "run-2"
 
 
+def test_debug_scope_with_null_snapshot_id_updates_same_conversation_row():
+    store = AgentAppRuntimeSessionStore()
+    scope = _scope(agent_config_snapshot_id=None)
+    store.save_active_snapshot(
+        scope=scope,
+        backend_run_id="run-1",
+        snapshot=_snapshot(messages=1),
+        runtime_layer_specs=_runtime_layer_specs(),
+    )
+    store.save_active_snapshot(
+        scope=scope,
+        backend_run_id="run-2",
+        snapshot=_snapshot(messages=3),
+        runtime_layer_specs=_runtime_layer_specs(),
+    )
+
+    loaded = store.load_active_snapshot(scope)
+
+    assert loaded is not None
+    assert loaded.layers[0].runtime_state["messages"] == [
+        {"role": "user", "content": "m0"},
+        {"role": "user", "content": "m1"},
+        {"role": "user", "content": "m2"},
+    ]
+    with session_factory.create_session() as session:
+        row = session.query(AgentRuntimeSession).one()
+        assert row.agent_config_snapshot_id is None
+        assert row.backend_run_id == "run-2"
+
+
 def test_mark_cleaned_then_load_returns_none_and_save_resurrects():
     store = AgentAppRuntimeSessionStore()
     store.save_active_snapshot(
diff --git a/api/tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py b/api/tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py
index 0260235b03a..d7988cbf74d 100644
--- a/api/tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py
+++ b/api/tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py
@@ -14,7 +14,7 @@ def runner():
 
 
 class TestAgentChatAppRunnerRun:
-    def test_run_app_not_found(self, runner, mocker: MockerFixture):
+    def test_run_app_not_found(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", agent=mocker.MagicMock())
         generate_entity = mocker.MagicMock(app_config=app_config, inputs={}, query="q", files=[], stream=True)
 
@@ -23,7 +23,7 @@ class TestAgentChatAppRunnerRun:
         with pytest.raises(ValueError):
             runner.run(generate_entity, mocker.MagicMock(), mocker.MagicMock(), mocker.MagicMock())
 
-    def test_run_moderation_error_direct_output(self, runner, mocker: MockerFixture):
+    def test_run_moderation_error_direct_output(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = mocker.MagicMock()
@@ -46,7 +46,7 @@ class TestAgentChatAppRunnerRun:
 
         runner.direct_output.assert_called_once()
 
-    def test_run_annotation_reply_short_circuits(self, runner, mocker: MockerFixture):
+    def test_run_annotation_reply_short_circuits(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = mocker.MagicMock()
@@ -75,7 +75,7 @@ class TestAgentChatAppRunnerRun:
         queue_manager.publish.assert_called_once()
         runner.direct_output.assert_called_once()
 
-    def test_run_hosting_moderation_short_circuits(self, runner, mocker: MockerFixture):
+    def test_run_hosting_moderation_short_circuits(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = mocker.MagicMock()
@@ -99,7 +99,7 @@ class TestAgentChatAppRunnerRun:
 
         runner.run(generate_entity, mocker.MagicMock(), mocker.MagicMock(), mocker.MagicMock())
 
-    def test_run_model_schema_missing(self, runner, mocker: MockerFixture):
+    def test_run_model_schema_missing(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = AgentEntity(provider="p", model="m", strategy=AgentEntity.Strategy.CHAIN_OF_THOUGHT)
@@ -141,7 +141,7 @@ class TestAgentChatAppRunnerRun:
             (LLMMode.COMPLETION, "CotCompletionAgentRunner"),
         ],
     )
-    def test_run_chain_of_thought_modes(self, runner, mocker: MockerFixture, mode, expected_runner):
+    def test_run_chain_of_thought_modes(self, runner: AgentChatAppRunner, mocker: MockerFixture, mode, expected_runner):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = AgentEntity(provider="p", model="m", strategy=AgentEntity.Strategy.CHAIN_OF_THOUGHT)
@@ -197,7 +197,7 @@ class TestAgentChatAppRunnerRun:
         runner_instance.run.assert_called_once()
         runner._handle_invoke_result.assert_called_once()
 
-    def test_run_invalid_llm_mode_raises(self, runner, mocker: MockerFixture):
+    def test_run_invalid_llm_mode_raises(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = AgentEntity(provider="p", model="m", strategy=AgentEntity.Strategy.CHAIN_OF_THOUGHT)
@@ -243,7 +243,9 @@ class TestAgentChatAppRunnerRun:
         with pytest.raises(ValueError):
             runner.run(generate_entity, mocker.MagicMock(), conversation, message)
 
-    def test_run_function_calling_strategy_selected_by_features(self, runner, mocker: MockerFixture):
+    def test_run_function_calling_strategy_selected_by_features(
+        self, runner: AgentChatAppRunner, mocker: MockerFixture
+    ):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = AgentEntity(provider="p", model="m", strategy=AgentEntity.Strategy.CHAIN_OF_THOUGHT)
@@ -299,7 +301,7 @@ class TestAgentChatAppRunnerRun:
         assert app_config.agent.strategy == AgentEntity.Strategy.FUNCTION_CALLING
         runner_instance.run.assert_called_once()
 
-    def test_run_conversation_not_found(self, runner, mocker: MockerFixture):
+    def test_run_conversation_not_found(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = AgentEntity(provider="p", model="m", strategy=AgentEntity.Strategy.FUNCTION_CALLING)
@@ -333,7 +335,7 @@ class TestAgentChatAppRunnerRun:
         with pytest.raises(ValueError):
             runner.run(generate_entity, mocker.MagicMock(), mocker.MagicMock(id="conv"), mocker.MagicMock(id="msg"))
 
-    def test_run_message_not_found(self, runner, mocker: MockerFixture):
+    def test_run_message_not_found(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = AgentEntity(provider="p", model="m", strategy=AgentEntity.Strategy.FUNCTION_CALLING)
@@ -367,7 +369,7 @@ class TestAgentChatAppRunnerRun:
         with pytest.raises(ValueError):
             runner.run(generate_entity, mocker.MagicMock(), mocker.MagicMock(id="conv"), mocker.MagicMock(id="msg"))
 
-    def test_run_invalid_agent_strategy_raises(self, runner, mocker: MockerFixture):
+    def test_run_invalid_agent_strategy_raises(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_record = mocker.MagicMock(id="app1", tenant_id="tenant")
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", prompt_template=mocker.MagicMock())
         app_config.agent = mocker.MagicMock(strategy="invalid", provider="p", model="m")
diff --git a/api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_generator.py b/api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_generator.py
index 06fd9e48064..67cea557118 100644
--- a/api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_generator.py
+++ b/api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_generator.py
@@ -173,6 +173,9 @@ def test_generate_published_pipeline_creates_documents_and_delay(generator, mock
     mocker.patch.object(generator, "_prepare_user_inputs", return_value={"k": "v"})
 
     mocker.patch("services.dataset_service.DocumentService.get_documents_position", return_value=1)
+    features = SimpleNamespace()
+    mocker.patch("services.feature_service.FeatureService.get_features", return_value=features)
+    check_limits = mocker.patch("services.dataset_service.DocumentService.check_document_creation_limits")
 
     document1 = SimpleNamespace(
         id="doc1",
@@ -226,9 +229,53 @@ def test_generate_published_pipeline_creates_documents_and_delay(generator, mock
 
     assert result["batch"]
     assert len(result["documents"]) == 2
+    check_limits.assert_called_once_with(len(datasource_info_list), features)
     task_proxy.delay.assert_called_once()
 
 
+def test_generate_published_pipeline_rejects_when_document_creation_limits_exceeded(generator, mocker: MockerFixture):
+    pipeline = _build_pipeline()
+    workflow = _build_workflow()
+
+    session = DummySession()
+    _patch_session(mocker, session)
+
+    datasource_info_list = [{"name": "file1"}, {"name": "file2"}]
+    mocker.patch.object(
+        generator,
+        "_format_datasource_info_list",
+        return_value=datasource_info_list,
+    )
+    mocker.patch.object(
+        module.PipelineConfigManager,
+        "get_pipeline_config",
+        return_value=SimpleNamespace(app_id="pipe", rag_pipeline_variables=[]),
+    )
+
+    features = SimpleNamespace()
+    mocker.patch("services.feature_service.FeatureService.get_features", return_value=features)
+    check_limits = mocker.patch(
+        "services.dataset_service.DocumentService.check_document_creation_limits",
+        side_effect=ValueError("document limit exceeded"),
+    )
+
+    db_session = MagicMock()
+    mocker.patch.object(module.db, "session", db_session)
+
+    with pytest.raises(ValueError, match="document limit exceeded"):
+        generator.generate(
+            pipeline=pipeline,
+            workflow=workflow,
+            user=_build_user(),
+            args=_build_args(),
+            invoke_from=InvokeFrom.PUBLISHED_PIPELINE,
+            streaming=False,
+        )
+
+    check_limits.assert_called_once_with(len(datasource_info_list), features)
+    db_session.add.assert_not_called()
+
+
 def test_generate_is_retry_calls_generate(generator, mocker: MockerFixture):
     pipeline = _build_pipeline()
     workflow = _build_workflow()
diff --git a/api/tests/unit_tests/core/app/apps/test_pause_resume.py b/api/tests/unit_tests/core/app/apps/test_pause_resume.py
index 5f13c6aff64..30961051a75 100644
--- a/api/tests/unit_tests/core/app/apps/test_pause_resume.py
+++ b/api/tests/unit_tests/core/app/apps/test_pause_resume.py
@@ -288,7 +288,7 @@ def test_advanced_chat_pause_resume_matches_baseline(mocker: MockerFixture):
     assert resumed_state.outputs == baseline_outputs
 
 
-def test_resume_emits_resumption_start_reason(mocker) -> None:
+def test_resume_emits_resumption_start_reason(mocker: MockerFixture) -> None:
     _patch_tool_node(mocker)
 
     paused_state = _build_runtime_state("resume-reason")
diff --git a/api/tests/unit_tests/core/app/apps/test_workflow_app_runner_single_node.py b/api/tests/unit_tests/core/app/apps/test_workflow_app_runner_single_node.py
index c02683e13f4..f02994fd61c 100644
--- a/api/tests/unit_tests/core/app/apps/test_workflow_app_runner_single_node.py
+++ b/api/tests/unit_tests/core/app/apps/test_workflow_app_runner_single_node.py
@@ -112,7 +112,7 @@ def test_run_uses_single_node_execution_branch(
     assert entry_kwargs["graph_runtime_state"] is graph_runtime_state
 
 
-def test_single_node_run_validates_target_node_config(monkeypatch) -> None:
+def test_single_node_run_validates_target_node_config(monkeypatch: pytest.MonkeyPatch) -> None:
     runner = WorkflowBasedAppRunner(
         queue_manager=MagicMock(spec=AppQueueManager),
         variable_loader=MagicMock(),
diff --git a/api/tests/unit_tests/core/app/features/test_annotation_reply.py b/api/tests/unit_tests/core/app/features/test_annotation_reply.py
index e721a77079f..ef4ee0dca6b 100644
--- a/api/tests/unit_tests/core/app/features/test_annotation_reply.py
+++ b/api/tests/unit_tests/core/app/features/test_annotation_reply.py
@@ -2,6 +2,8 @@ import logging
 from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
+import pytest
+
 from core.app.entities.app_invoke_entities import InvokeFrom
 from core.app.features.annotation_reply.annotation_reply import AnnotationReplyFeature
 
@@ -132,7 +134,7 @@ class TestAnnotationReplyFeature:
         _, _, _, _, _, _, _, from_source, _ = mock_annotation_service.add_annotation_history.call_args[0]
         assert from_source == "console"
 
-    def test_query_logs_and_returns_none_on_exception(self, caplog):
+    def test_query_logs_and_returns_none_on_exception(self, caplog: pytest.LogCaptureFixture):
         feature = AnnotationReplyFeature()
         annotation_setting = SimpleNamespace(
             score_threshold=None,
diff --git a/api/tests/unit_tests/core/app/layers/test_timeslice_layer.py b/api/tests/unit_tests/core/app/layers/test_timeslice_layer.py
index 1ac9a4d8c0c..61ced61d8c8 100644
--- a/api/tests/unit_tests/core/app/layers/test_timeslice_layer.py
+++ b/api/tests/unit_tests/core/app/layers/test_timeslice_layer.py
@@ -1,5 +1,8 @@
+import logging
 from unittest.mock import Mock, patch
 
+import pytest
+
 from core.app.layers.timeslice_layer import TimeSliceLayer
 from graphon.graph_engine.entities.commands import CommandType, GraphEngineCommand
 from services.workflow.entities import WorkflowScheduleCFSPlanEntity
@@ -64,21 +67,19 @@ class TestTimeSliceLayer:
 
         scheduler.remove_job.assert_called_once_with("job-1")
 
-    def test_checker_job_handles_resource_limit_without_command_channel(self):
+    def test_checker_job_handles_resource_limit_without_command_channel(self, caplog: pytest.LogCaptureFixture):
         scheduler = Mock()
         scheduler.running = True
         cfs_plan_scheduler = Mock(plan=Mock())
         cfs_plan_scheduler.can_schedule.return_value = SchedulerCommand.RESOURCE_LIMIT_REACHED
 
-        with (
-            patch("core.app.layers.timeslice_layer.TimeSliceLayer.scheduler", scheduler),
-            patch("core.app.layers.timeslice_layer.logger") as mock_logger,
-        ):
+        with patch("core.app.layers.timeslice_layer.TimeSliceLayer.scheduler", scheduler):
             layer = TimeSliceLayer(cfs_plan_scheduler=cfs_plan_scheduler)
-            layer._checker_job("job-1")
+            with caplog.at_level(logging.ERROR, logger="core.app.layers.timeslice_layer"):
+                layer._checker_job("job-1")
 
         scheduler.remove_job.assert_called_once_with("job-1")
-        mock_logger.exception.assert_called_once()
+        assert any(record.levelno == logging.ERROR for record in caplog.records)
 
     def test_checker_job_sends_pause_command(self):
         scheduler = Mock()
diff --git a/api/tests/unit_tests/core/app/layers/test_trigger_post_layer.py b/api/tests/unit_tests/core/app/layers/test_trigger_post_layer.py
index f82cf201422..ccdb658b491 100644
--- a/api/tests/unit_tests/core/app/layers/test_trigger_post_layer.py
+++ b/api/tests/unit_tests/core/app/layers/test_trigger_post_layer.py
@@ -1,7 +1,10 @@
+import logging
 from datetime import UTC, datetime, timedelta
 from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
+import pytest
+
 from core.app.layers.trigger_post_layer import TriggerPostLayer
 from core.workflow.system_variables import build_system_variables
 from graphon.graph_events import (
@@ -114,7 +117,7 @@ class TestTriggerPostLayer:
         repo.update.assert_called_once_with(trigger_log)
         session.commit.assert_called_once()
 
-    def test_on_event_handles_missing_trigger_log(self):
+    def test_on_event_handles_missing_trigger_log(self, caplog: pytest.LogCaptureFixture):
         runtime_state = SimpleNamespace(
             outputs={},
             variable_pool=VariablePool.from_bootstrap(
@@ -126,7 +129,6 @@ class TestTriggerPostLayer:
         with (
             patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory,
             patch("core.app.layers.trigger_post_layer.SQLAlchemyWorkflowTriggerLogRepository") as mock_repo_cls,
-            patch("core.app.layers.trigger_post_layer.logger") as mock_logger,
         ):
             session = Mock()
             mock_session_factory.create_session.return_value.__enter__.return_value = session
@@ -142,9 +144,10 @@ class TestTriggerPostLayer:
             )
             layer.initialize(runtime_state, Mock())
 
-            layer.on_event(GraphRunFailedEvent(error="boom"))
+            with caplog.at_level(logging.ERROR, logger="core.app.layers.trigger_post_layer"):
+                layer.on_event(GraphRunFailedEvent(error="boom"))
 
-        mock_logger.exception.assert_called_once()
+        assert any(record.levelno == logging.ERROR for record in caplog.records)
         session.commit.assert_not_called()
 
     def test_on_event_ignores_non_status_events(self):
diff --git a/api/tests/unit_tests/core/app/task_pipeline/test_message_cycle_manager_optimization.py b/api/tests/unit_tests/core/app/task_pipeline/test_message_cycle_manager_optimization.py
index 92fe3cbec67..0863d5a8f73 100644
--- a/api/tests/unit_tests/core/app/task_pipeline/test_message_cycle_manager_optimization.py
+++ b/api/tests/unit_tests/core/app/task_pipeline/test_message_cycle_manager_optimization.py
@@ -1,5 +1,6 @@
 """Unit tests for the message cycle manager optimization."""
 
+import logging
 from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
@@ -344,7 +345,9 @@ class TestMessageCycleManagerOptimization:
         db_session.close.assert_called_once()
         mock_redis.setex.assert_called_once()
 
-    def test_generate_conversation_name_worker_falls_back_when_generation_fails(self, message_cycle_manager):
+    def test_generate_conversation_name_worker_falls_back_when_generation_fails(
+        self, message_cycle_manager, caplog: pytest.LogCaptureFixture
+    ):
         """Fallback to truncated query when LLM generation fails."""
         flask_app = Flask(__name__)
         conversation = SimpleNamespace(
@@ -362,19 +365,19 @@ class TestMessageCycleManagerOptimization:
             patch("core.app.task_pipeline.message_cycle_manager.redis_client") as mock_redis,
             patch("core.app.task_pipeline.message_cycle_manager.LLMGenerator") as mock_llm_generator,
             patch("core.app.task_pipeline.message_cycle_manager.dify_config") as mock_dify_config,
-            patch("core.app.task_pipeline.message_cycle_manager.logger") as mock_logger,
         ):
             mock_db.session = db_session
             mock_redis.get.return_value = None
             mock_llm_generator.generate_conversation_name.side_effect = RuntimeError("generation failed")
             mock_dify_config.DEBUG = True
 
-            message_cycle_manager._generate_conversation_name_worker(flask_app, "conv-1", long_query)
+            with caplog.at_level(logging.ERROR, logger="core.app.task_pipeline.message_cycle_manager"):
+                message_cycle_manager._generate_conversation_name_worker(flask_app, "conv-1", long_query)
 
         assert conversation.name == (long_query[:47] + "...")
         db_session.commit.assert_called_once()
         db_session.close.assert_called_once()
-        mock_logger.exception.assert_called_once()
+        assert any(record.levelno == logging.ERROR for record in caplog.records)
 
     def test_handle_annotation_reply_sets_metadata(self, message_cycle_manager):
         """Populate task metadata from annotation reply events.
diff --git a/api/tests/unit_tests/core/app/workflow/test_node_factory.py b/api/tests/unit_tests/core/app/workflow/test_node_factory.py
index addce649d56..f74c2d48814 100644
--- a/api/tests/unit_tests/core/app/workflow/test_node_factory.py
+++ b/api/tests/unit_tests/core/app/workflow/test_node_factory.py
@@ -40,7 +40,7 @@ class DummyDocumentExtractorNode(DummyNode):
 
 class TestDifyNodeFactory:
     @staticmethod
-    def _stub_node_resolution(monkeypatch, node_class):
+    def _stub_node_resolution(monkeypatch: pytest.MonkeyPatch, node_class):
         monkeypatch.setattr(
             "core.workflow.node_factory.resolve_workflow_node_class",
             lambda **_kwargs: node_class,
diff --git a/api/tests/unit_tests/core/app/workflow/test_observability_layer_extra.py b/api/tests/unit_tests/core/app/workflow/test_observability_layer_extra.py
index 04ce5249049..b283f8a211d 100644
--- a/api/tests/unit_tests/core/app/workflow/test_observability_layer_extra.py
+++ b/api/tests/unit_tests/core/app/workflow/test_observability_layer_extra.py
@@ -20,7 +20,9 @@ class TestObservabilityLayerExtras:
         assert layer._is_disabled is False
         assert layer._tracer is tracer
 
-    def test_init_tracer_disables_when_get_tracer_fails(self, monkeypatch: pytest.MonkeyPatch, caplog):
+    def test_init_tracer_disables_when_get_tracer_fails(
+        self, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+    ):
         monkeypatch.setattr("core.app.workflow.layers.observability.dify_config.ENABLE_OTEL", True)
         monkeypatch.setattr("core.app.workflow.layers.observability.is_instrument_flag_enabled", lambda: False)
 
@@ -70,7 +72,7 @@ class TestObservabilityLayerExtras:
 
         layer.on_event(object())
 
-    def test_on_graph_end_clears_unfinished_contexts(self, caplog):
+    def test_on_graph_end_clears_unfinished_contexts(self, caplog: pytest.LogCaptureFixture):
         layer = ObservabilityLayer()
         layer._node_contexts["exec"] = SimpleNamespace(span=object(), token="token")
 
@@ -107,7 +109,7 @@ class TestObservabilityLayerExtras:
 
         assert calls == []
 
-    def test_on_node_run_start_logs_warning_when_span_creation_fails(self, caplog):
+    def test_on_node_run_start_logs_warning_when_span_creation_fails(self, caplog: pytest.LogCaptureFixture):
         layer = ObservabilityLayer()
         layer._is_disabled = False
 
@@ -166,7 +168,9 @@ class TestObservabilityLayerExtras:
         assert ended == ["ended"]
         assert "exec" not in layer._node_contexts
 
-    def test_on_node_run_end_logs_detach_failure(self, monkeypatch: pytest.MonkeyPatch, caplog):
+    def test_on_node_run_end_logs_detach_failure(
+        self, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+    ):
         layer = ObservabilityLayer()
         layer._is_disabled = False
 
diff --git a/api/tests/unit_tests/core/app/workflow/test_persistence_layer.py b/api/tests/unit_tests/core/app/workflow/test_persistence_layer.py
index f8e13ca8083..c8efaec33dc 100644
--- a/api/tests/unit_tests/core/app/workflow/test_persistence_layer.py
+++ b/api/tests/unit_tests/core/app/workflow/test_persistence_layer.py
@@ -218,7 +218,7 @@ class TestWorkflowPersistenceLayer:
         assert exec_repo.saved[-1].status == WorkflowExecutionStatus.FAILED
         assert trace_tasks
 
-    def test_handle_graph_run_succeeded_enqueues_parent_trace_context(self, monkeypatch):
+    def test_handle_graph_run_succeeded_enqueues_parent_trace_context(self, monkeypatch: pytest.MonkeyPatch):
         trace_tasks: list[TraceTask] = []
         trace_manager = SimpleNamespace(user_id="user", add_trace_task=lambda task: trace_tasks.append(task))
         layer, _, _, _ = _make_layer(
diff --git a/api/tests/unit_tests/core/datasource/test_datasource_manager.py b/api/tests/unit_tests/core/datasource/test_datasource_manager.py
index 8842d678c7a..baf51489dfb 100644
--- a/api/tests/unit_tests/core/datasource/test_datasource_manager.py
+++ b/api/tests/unit_tests/core/datasource/test_datasource_manager.py
@@ -89,7 +89,9 @@ def test_get_datasource_runtime_delegates_to_provider_controller(mocker: MockerF
         ),
     ],
 )
-def test_get_datasource_plugin_provider_creates_controller_and_caches(mocker, datasource_type, controller_path):
+def test_get_datasource_plugin_provider_creates_controller_and_caches(
+    mocker: MockerFixture, datasource_type, controller_path
+):
     _invalidate_recyclable_contextvars()
 
     provider_entity = types.SimpleNamespace(declaration=object(), plugin_id="plugin", plugin_unique_identifier="uniq")
diff --git a/api/tests/unit_tests/core/file/test_remote_fetcher.py b/api/tests/unit_tests/core/file/test_remote_fetcher.py
index ec377e8dc43..c9612a062ac 100644
--- a/api/tests/unit_tests/core/file/test_remote_fetcher.py
+++ b/api/tests/unit_tests/core/file/test_remote_fetcher.py
@@ -36,7 +36,7 @@ def _signed_url(*, base_url: str, path: str, payload: str, secret: str = "test-s
     return f"{base_url}{path}?{query}"
 
 
-def _patch_file_fetcher_config(monkeypatch):
+def _patch_file_fetcher_config(monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr(remote_fetcher.dify_config, "FILES_URL", "http://localhost:5001")
     monkeypatch.setattr(remote_fetcher.dify_config, "INTERNAL_FILES_URL", "http://api:5001")
     monkeypatch.setattr(remote_fetcher.dify_config, "SECRET_KEY", "test-secret")
@@ -44,7 +44,7 @@ def _patch_file_fetcher_config(monkeypatch):
     monkeypatch.setattr(remote_fetcher.time, "time", lambda: 1700000100)
 
 
-def _patch_session(monkeypatch):
+def _patch_session(monkeypatch: pytest.MonkeyPatch):
     session = MagicMock()
     session_cm = MagicMock()
     session_cm.__enter__.return_value = session
@@ -53,19 +53,19 @@ def _patch_session(monkeypatch):
     return session
 
 
-def _patch_ssrf_make_request(monkeypatch, response=None):
+def _patch_ssrf_make_request(monkeypatch: pytest.MonkeyPatch, response=None):
     make_request = MagicMock(return_value=response) if response is not None else MagicMock()
     monkeypatch.setattr(remote_fetcher.ssrf_proxy, "make_request", make_request)
     return make_request
 
 
-def _patch_signer_times(monkeypatch):
+def _patch_signer_times(monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr("core.datasource.datasource_file_manager.time.time", lambda: 1700000000)
     monkeypatch.setattr("core.tools.signature.time.time", lambda: 1700000000)
     monkeypatch.setattr("core.tools.tool_file_manager.time.time", lambda: 1700000000)
 
 
-def test_get_signed_upload_file_url_reads_storage_without_ssrf(monkeypatch):
+def test_get_signed_upload_file_url_reads_storage_without_ssrf(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     session = _patch_session(monkeypatch)
     upload_file = SimpleNamespace(
@@ -102,7 +102,7 @@ def test_get_signed_upload_file_url_reads_storage_without_ssrf(monkeypatch):
     ssrf_make_request.assert_not_called()
 
 
-def test_make_request_resolves_upload_preview_url_generated_by_signer(monkeypatch):
+def test_make_request_resolves_upload_preview_url_generated_by_signer(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_signer_times(monkeypatch)
     session = _patch_session(monkeypatch)
@@ -132,7 +132,7 @@ def test_make_request_resolves_upload_preview_url_generated_by_signer(monkeypatc
     ssrf_make_request.assert_not_called()
 
 
-def test_make_request_resolves_sign_tool_file_url_with_empty_extension(monkeypatch):
+def test_make_request_resolves_sign_tool_file_url_with_empty_extension(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_signer_times(monkeypatch)
     session = _patch_session(monkeypatch)
@@ -161,7 +161,7 @@ def test_make_request_resolves_sign_tool_file_url_with_empty_extension(monkeypat
     ssrf_make_request.assert_not_called()
 
 
-def test_make_request_resolves_tool_manager_url_with_empty_extension(monkeypatch):
+def test_make_request_resolves_tool_manager_url_with_empty_extension(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_signer_times(monkeypatch)
     session = _patch_session(monkeypatch)
@@ -189,7 +189,7 @@ def test_make_request_resolves_tool_manager_url_with_empty_extension(monkeypatch
     ssrf_make_request.assert_not_called()
 
 
-def test_make_request_resolves_datasource_manager_url_with_empty_extension(monkeypatch):
+def test_make_request_resolves_datasource_manager_url_with_empty_extension(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_signer_times(monkeypatch)
     _patch_session(monkeypatch)
@@ -222,7 +222,7 @@ def test_make_request_resolves_datasource_manager_url_with_empty_extension(monke
     ssrf_make_request.assert_not_called()
 
 
-def test_head_signed_upload_file_url_returns_metadata_without_storage_content(monkeypatch):
+def test_head_signed_upload_file_url_returns_metadata_without_storage_content(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     session = _patch_session(monkeypatch)
     upload_file = SimpleNamespace(
@@ -259,7 +259,7 @@ def test_head_signed_upload_file_url_returns_metadata_without_storage_content(mo
     ssrf_make_request.assert_not_called()
 
 
-def test_make_request_get_signed_upload_file_url_reads_storage_without_ssrf(monkeypatch):
+def test_make_request_get_signed_upload_file_url_reads_storage_without_ssrf(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_session(monkeypatch)
     upload_file = SimpleNamespace(
@@ -291,7 +291,7 @@ def test_make_request_get_signed_upload_file_url_reads_storage_without_ssrf(monk
     ssrf_make_request.assert_not_called()
 
 
-def test_make_request_head_signed_upload_file_url_returns_metadata_without_ssrf(monkeypatch):
+def test_make_request_head_signed_upload_file_url_returns_metadata_without_ssrf(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_session(monkeypatch)
     upload_file = SimpleNamespace(
@@ -325,7 +325,7 @@ def test_make_request_head_signed_upload_file_url_returns_metadata_without_ssrf(
     ssrf_make_request.assert_not_called()
 
 
-def test_make_request_get_unsigned_dify_url_delegates_to_ssrf_proxy(monkeypatch):
+def test_make_request_get_unsigned_dify_url_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     get_upload_file = MagicMock()
     monkeypatch.setattr(remote_fetcher._file_access_controller, "get_upload_file", get_upload_file)
@@ -345,7 +345,7 @@ def test_make_request_get_unsigned_dify_url_delegates_to_ssrf_proxy(monkeypatch)
     )
 
 
-def test_make_request_post_signed_upload_file_url_delegates_to_ssrf_proxy(monkeypatch):
+def test_make_request_post_signed_upload_file_url_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     get_upload_file = MagicMock()
     monkeypatch.setattr(remote_fetcher._file_access_controller, "get_upload_file", get_upload_file)
@@ -369,7 +369,7 @@ def test_make_request_post_signed_upload_file_url_delegates_to_ssrf_proxy(monkey
     )
 
 
-def test_get_signed_image_preview_url_uses_image_preview_signature(monkeypatch):
+def test_get_signed_image_preview_url_uses_image_preview_signature(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_session(monkeypatch)
     upload_file = SimpleNamespace(
@@ -401,7 +401,7 @@ def test_get_signed_image_preview_url_uses_image_preview_signature(monkeypatch):
     ssrf_make_request.assert_not_called()
 
 
-def test_image_preview_url_with_file_preview_signature_delegates_to_ssrf_proxy(monkeypatch):
+def test_image_preview_url_with_file_preview_signature_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     proxy_response = httpx.Response(403, request=httpx.Request("GET", "http://localhost:5001/bad"))
     ssrf_make_request = _patch_ssrf_make_request(monkeypatch, proxy_response)
@@ -421,7 +421,7 @@ def test_image_preview_url_with_file_preview_signature_delegates_to_ssrf_proxy(m
     )
 
 
-def test_duplicate_signature_query_value_delegates_to_ssrf_proxy(monkeypatch):
+def test_duplicate_signature_query_value_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     url = (
         _signed_url(
@@ -444,7 +444,7 @@ def test_duplicate_signature_query_value_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_malformed_timestamp_delegates_to_ssrf_proxy(monkeypatch):
+def test_malformed_timestamp_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     url = _signed_url(
         base_url="http://localhost:5001",
@@ -464,7 +464,7 @@ def test_malformed_timestamp_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_expired_signature_delegates_to_ssrf_proxy(monkeypatch):
+def test_expired_signature_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     monkeypatch.setattr(remote_fetcher.time, "time", lambda: 1700004001)
     url = _signed_url(
@@ -485,7 +485,7 @@ def test_expired_signature_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_invalid_signature_delegates_to_ssrf_proxy(monkeypatch):
+def test_invalid_signature_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     proxy_response = httpx.Response(403, request=httpx.Request("GET", "http://localhost:5001/bad"))
     ssrf_make_request = _patch_ssrf_make_request(monkeypatch, proxy_response)
@@ -502,7 +502,7 @@ def test_invalid_signature_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_host_mismatch_delegates_to_ssrf_proxy(monkeypatch):
+def test_host_mismatch_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     url = _signed_url(
         base_url="http://example.com",
@@ -522,7 +522,7 @@ def test_host_mismatch_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_unsupported_dify_path_delegates_to_ssrf_proxy(monkeypatch):
+def test_unsupported_dify_path_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     url = _signed_url(
         base_url="http://localhost:5001",
@@ -543,7 +543,7 @@ def test_unsupported_dify_path_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_invalid_url_scheme_delegates_to_ssrf_proxy(monkeypatch):
+def test_invalid_url_scheme_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     url = f"file:///tmp/files/{UPLOAD_FILE_ID}/file-preview?timestamp=1700000000&nonce=nonce&sign=ignored"
     proxy_response = httpx.Response(403, request=httpx.Request("GET", url))
@@ -559,7 +559,7 @@ def test_invalid_url_scheme_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_invalid_url_port_delegates_to_ssrf_proxy(monkeypatch):
+def test_invalid_url_port_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     url = f"http://localhost:invalid/files/{UPLOAD_FILE_ID}/file-preview?timestamp=1700000000&nonce=nonce&sign=ignored"
     proxy_response = httpx.Response(403, request=httpx.Request("GET", "http://proxy.example/fallback"))
@@ -575,7 +575,7 @@ def test_invalid_url_port_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_invalid_configured_file_origin_delegates_to_ssrf_proxy(monkeypatch):
+def test_invalid_configured_file_origin_delegates_to_ssrf_proxy(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     monkeypatch.setattr(remote_fetcher.dify_config, "FILES_URL", "")
     monkeypatch.setattr(remote_fetcher.dify_config, "INTERNAL_FILES_URL", "file:///tmp/files")
@@ -597,7 +597,7 @@ def test_invalid_configured_file_origin_delegates_to_ssrf_proxy(monkeypatch):
     )
 
 
-def test_signed_upload_file_url_returns_404_when_record_missing(monkeypatch):
+def test_signed_upload_file_url_returns_404_when_record_missing(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_session(monkeypatch)
     get_upload_file = MagicMock(return_value=None)
@@ -617,7 +617,7 @@ def test_signed_upload_file_url_returns_404_when_record_missing(monkeypatch):
     ssrf_make_request.assert_not_called()
 
 
-def test_get_signed_tool_file_url_reads_storage_without_ssrf(monkeypatch):
+def test_get_signed_tool_file_url_reads_storage_without_ssrf(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     session = _patch_session(monkeypatch)
     tool_file = SimpleNamespace(
@@ -651,7 +651,7 @@ def test_get_signed_tool_file_url_reads_storage_without_ssrf(monkeypatch):
     ssrf_make_request.assert_not_called()
 
 
-def test_signed_tool_file_url_returns_404_when_record_missing(monkeypatch):
+def test_signed_tool_file_url_returns_404_when_record_missing(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_session(monkeypatch)
     get_tool_file = MagicMock(return_value=None)
@@ -671,7 +671,7 @@ def test_signed_tool_file_url_returns_404_when_record_missing(monkeypatch):
     ssrf_make_request.assert_not_called()
 
 
-def test_get_signed_datasource_file_url_reads_upload_storage_without_ssrf(monkeypatch):
+def test_get_signed_datasource_file_url_reads_upload_storage_without_ssrf(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_session(monkeypatch)
     upload_file = SimpleNamespace(
@@ -705,7 +705,7 @@ def test_get_signed_datasource_file_url_reads_upload_storage_without_ssrf(monkey
     ssrf_make_request.assert_not_called()
 
 
-def test_get_signed_datasource_file_url_reads_tool_storage_when_upload_missing(monkeypatch):
+def test_get_signed_datasource_file_url_reads_tool_storage_when_upload_missing(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_session(monkeypatch)
     tool_file = SimpleNamespace(
@@ -740,7 +740,7 @@ def test_get_signed_datasource_file_url_reads_tool_storage_when_upload_missing(m
     ssrf_make_request.assert_not_called()
 
 
-def test_signed_datasource_file_url_returns_404_when_records_missing(monkeypatch):
+def test_signed_datasource_file_url_returns_404_when_records_missing(monkeypatch: pytest.MonkeyPatch):
     _patch_file_fetcher_config(monkeypatch)
     _patch_session(monkeypatch)
     get_upload_file = MagicMock(return_value=None)
diff --git a/api/tests/unit_tests/core/mcp/session/test_base_session.py b/api/tests/unit_tests/core/mcp/session/test_base_session.py
index 1dd916bcf12..ca090eeda4d 100644
--- a/api/tests/unit_tests/core/mcp/session/test_base_session.py
+++ b/api/tests/unit_tests/core/mcp/session/test_base_session.py
@@ -1,3 +1,4 @@
+import logging
 import queue
 import time
 from concurrent.futures import Future, ThreadPoolExecutor
@@ -511,10 +512,8 @@ def test_receive_loop_http_error_unknown_id(streams):
 
 
 @pytest.mark.timeout(10)
-def test_receive_loop_validation_error_notification(streams):
-    from core.mcp.session.base_session import logger
-
-    with patch.object(logger, "warning") as mock_warning:
+def test_receive_loop_validation_error_notification(streams, caplog: pytest.LogCaptureFixture):
+    with caplog.at_level(logging.WARNING, logger="core.mcp.session.base_session"):
         read_stream, write_stream = streams
         session = MockSession(read_stream, write_stream, ReceiveRequest, RootModel[MockNotification])
 
@@ -523,7 +522,7 @@ def test_receive_loop_validation_error_notification(streams):
             read_stream.put(SessionMessage(message=JSONRPCMessage.model_validate(notif_payload)))
             time.sleep(1.0)
 
-        assert mock_warning.called
+    assert "Failed to validate notification" in caplog.text
 
 
 @pytest.mark.timeout(5)
@@ -571,16 +570,16 @@ def test_session_exit_timeout(streams):
 
 
 @pytest.mark.timeout(10)
-def test_receive_loop_fatal_exception(streams):
+def test_receive_loop_fatal_exception(streams, caplog: pytest.LogCaptureFixture):
     read_stream, write_stream = streams
     session = MockSession(read_stream, write_stream, ReceiveRequest, ReceiveNotification)
 
     with patch.object(read_stream, "get", side_effect=RuntimeError("Fatal loop error")):
-        with patch("core.mcp.session.base_session.logger") as mock_logger:
+        with caplog.at_level(logging.ERROR, logger="core.mcp.session.base_session"):
             with pytest.raises(RuntimeError, match="Fatal loop error"):
                 with session:
                     pass
-            mock_logger.exception.assert_called_with("Error in message processing loop")
+            assert "Error in message processing loop" in caplog.text
 
 
 @pytest.mark.timeout(5)
diff --git a/api/tests/unit_tests/core/plugin/impl/test_base_client_impl.py b/api/tests/unit_tests/core/plugin/impl/test_base_client_impl.py
index bea808516d7..613982f9c03 100644
--- a/api/tests/unit_tests/core/plugin/impl/test_base_client_impl.py
+++ b/api/tests/unit_tests/core/plugin/impl/test_base_client_impl.py
@@ -7,6 +7,7 @@ from pytest_mock import MockerFixture
 from core.plugin.endpoint.exc import EndpointSetupFailedError
 from core.plugin.entities.plugin_daemon import PluginDaemonInnerError
 from core.plugin.impl.base import PLUGIN_DAEMON_MAX_PATH_LENGTH, BasePluginClient
+from core.plugin.impl.exc import PluginLLMPollingUnsupportedError
 from core.trigger.errors import (
     EventIgnoreError,
     TriggerInvokeError,
@@ -167,3 +168,10 @@ class TestBasePluginClientImpl:
 
         with pytest.raises(expected):
             client._handle_plugin_daemon_error("PluginInvokeError", message)
+
+    def test_handle_plugin_daemon_error_maps_unsupported_polling_to_typed_exception(self):
+        client = BasePluginClient()
+        message = json.dumps({"error_type": PluginLLMPollingUnsupportedError.__name__, "message": "m"})
+
+        with pytest.raises(PluginLLMPollingUnsupportedError):
+            client._handle_plugin_daemon_error("PluginInvokeError", message)
diff --git a/api/tests/unit_tests/core/plugin/impl/test_model_client.py b/api/tests/unit_tests/core/plugin/impl/test_model_client.py
index 6dc572310c3..ac3df1e56fc 100644
--- a/api/tests/unit_tests/core/plugin/impl/test_model_client.py
+++ b/api/tests/unit_tests/core/plugin/impl/test_model_client.py
@@ -1,13 +1,17 @@
 from __future__ import annotations
 
 import io
+import json
 from types import SimpleNamespace
 
 import pytest
 from pytest_mock import MockerFixture
 
 from core.plugin.entities.plugin_daemon import PluginDaemonInnerError
+from core.plugin.impl.exc import PluginInvokeError, PluginLLMPollingUnsupportedError
 from core.plugin.impl.model import PluginModelClient
+from graphon.model_runtime.entities.llm_entities import LLMPollingResult, LLMPollingStatus, LLMResult, LLMUsage
+from graphon.model_runtime.entities.message_entities import AssistantPromptMessage
 
 
 class TestPluginModelClient:
@@ -183,6 +187,113 @@ class TestPluginModelClient:
                 )
             )
 
+    def test_start_llm_polling(self, mocker: MockerFixture):
+        client = PluginModelClient()
+        polling_result = LLMPollingResult(
+            status=LLMPollingStatus.RUNNING,
+            plugin_state={"task_id": "poll-1"},
+            next_check_after_seconds=3,
+        )
+        request_mock = mocker.patch.object(
+            client,
+            "_request_with_plugin_daemon_response",
+            return_value=polling_result,
+        )
+
+        result = client.start_llm_polling(
+            tenant_id="tenant-1",
+            user_id="user-1",
+            plugin_id="org/plugin:1",
+            provider="provider-a",
+            model="gpt-test",
+            credentials={"api_key": "key"},
+            prompt_messages=[],
+            model_parameters={"temperature": 0.1},
+            tools=[],
+            stop=["STOP"],
+            json_schema={"type": "object"},
+        )
+
+        assert result == polling_result
+        call_kwargs = request_mock.call_args.kwargs
+        assert call_kwargs["path"] == "plugin/tenant-1/dispatch/model/polling/start"
+        assert call_kwargs["data"]["data"] == {
+            "provider": "provider-a",
+            "model_type": "llm",
+            "model": "gpt-test",
+            "credentials": {"api_key": "key"},
+            "prompt_messages": [],
+            "model_parameters": {"temperature": 0.1},
+            "tools": [],
+            "stop": ["STOP"],
+            "stream": False,
+            "json_schema": {"type": "object"},
+        }
+
+    def test_check_llm_polling(self, mocker: MockerFixture):
+        client = PluginModelClient()
+        polling_result = LLMPollingResult(
+            status=LLMPollingStatus.SUCCEEDED,
+            result=LLMResult(
+                model="gpt-test",
+                prompt_messages=[],
+                message=AssistantPromptMessage(content="done"),
+                usage=LLMUsage.empty_usage(),
+            ),
+        )
+        request_mock = mocker.patch.object(
+            client,
+            "_request_with_plugin_daemon_response",
+            return_value=polling_result,
+        )
+
+        result = client.check_llm_polling(
+            tenant_id="tenant-1",
+            user_id="user-1",
+            plugin_id="org/plugin:1",
+            provider="provider-a",
+            model="gpt-test",
+            credentials={"api_key": "key"},
+            plugin_state={"task_id": "poll-1"},
+        )
+
+        assert result == polling_result
+        call_kwargs = request_mock.call_args.kwargs
+        assert call_kwargs["path"] == "plugin/tenant-1/dispatch/model/polling/check"
+        assert call_kwargs["data"]["data"] == {
+            "provider": "provider-a",
+            "model_type": "llm",
+            "model": "gpt-test",
+            "credentials": {"api_key": "key"},
+            "plugin_state": {"task_id": "poll-1"},
+        }
+
+    def test_start_llm_polling_maps_unsupported_polling_invoke_error(self, mocker: MockerFixture):
+        client = PluginModelClient()
+        mocker.patch.object(
+            client,
+            "_request_with_plugin_daemon_response",
+            side_effect=PluginInvokeError(
+                json.dumps(
+                    {
+                        "error_type": PluginLLMPollingUnsupportedError.__name__,
+                        "message": "Model `gpt-test` does not support polling.",
+                    }
+                )
+            ),
+        )
+
+        with pytest.raises(PluginLLMPollingUnsupportedError):
+            client.start_llm_polling(
+                tenant_id="tenant-1",
+                user_id="user-1",
+                plugin_id="org/plugin:1",
+                provider="provider-a",
+                model="gpt-test",
+                credentials={"api_key": "key"},
+                prompt_messages=[],
+            )
+
     def test_get_llm_num_tokens(self, mocker: MockerFixture):
         client = PluginModelClient()
         mocker.patch.object(
diff --git a/api/tests/unit_tests/core/plugin/test_model_runtime_adapter.py b/api/tests/unit_tests/core/plugin/test_model_runtime_adapter.py
index 3fd885b28fb..17973916779 100644
--- a/api/tests/unit_tests/core/plugin/test_model_runtime_adapter.py
+++ b/api/tests/unit_tests/core/plugin/test_model_runtime_adapter.py
@@ -14,7 +14,13 @@ from core.plugin.impl.model_runtime import TENANT_SCOPE_SCHEMA_CACHE_USER_ID, Pl
 from core.plugin.impl.model_runtime_factory import create_plugin_model_runtime
 from core.plugin.plugin_service import PluginService
 from graphon.model_runtime.entities.common_entities import I18nObject
-from graphon.model_runtime.entities.llm_entities import LLMResultChunk, LLMResultChunkDelta, LLMUsage
+from graphon.model_runtime.entities.llm_entities import (
+    LLMPollingResult,
+    LLMPollingStatus,
+    LLMResultChunk,
+    LLMResultChunkDelta,
+    LLMUsage,
+)
 from graphon.model_runtime.entities.message_entities import AssistantPromptMessage
 from graphon.model_runtime.entities.model_entities import AIModelEntity, FetchFrom, ModelType
 from graphon.model_runtime.entities.provider_entities import ConfigurateMethod, ProviderEntity
@@ -282,6 +288,74 @@ class TestPluginModelRuntime:
             stream=True,
         )
 
+    def test_start_llm_polling_resolves_plugin_fields(self) -> None:
+        client = Mock(spec=PluginModelClient)
+        polling_result = LLMPollingResult(
+            status=LLMPollingStatus.RUNNING,
+            plugin_state={"task_id": "poll-1"},
+            next_check_after_seconds=2,
+        )
+        client.start_llm_polling.return_value = polling_result
+        runtime = PluginModelRuntime(tenant_id="tenant", user_id="user", client=client, plugin_service=PluginService)
+
+        result = runtime.start_llm_polling(
+            provider="langgenius/openai/openai",
+            model="gpt-4o-mini",
+            credentials={"api_key": "secret"},
+            model_parameters={"temperature": 0.2},
+            prompt_messages=[],
+            tools=None,
+            stop=("END",),
+            json_schema={"type": "object"},
+        )
+
+        assert result == polling_result
+        client.start_llm_polling.assert_called_once_with(
+            tenant_id="tenant",
+            user_id="user",
+            plugin_id="langgenius/openai",
+            provider="openai",
+            model="gpt-4o-mini",
+            credentials={"api_key": "secret"},
+            prompt_messages=[],
+            model_parameters={"temperature": 0.2},
+            tools=None,
+            stop=["END"],
+            json_schema={"type": "object"},
+        )
+
+    def test_check_llm_polling_resolves_plugin_fields(self) -> None:
+        client = Mock(spec=PluginModelClient)
+        polling_result = LLMPollingResult(
+            status=LLMPollingStatus.SUCCEEDED,
+            result=model_runtime_module.LLMResult(
+                model="gpt-4o-mini",
+                prompt_messages=[],
+                message=AssistantPromptMessage(content="done"),
+                usage=LLMUsage.empty_usage(),
+            ),
+        )
+        client.check_llm_polling.return_value = polling_result
+        runtime = PluginModelRuntime(tenant_id="tenant", user_id="user", client=client, plugin_service=PluginService)
+
+        result = runtime.check_llm_polling(
+            provider="langgenius/openai/openai",
+            model="gpt-4o-mini",
+            credentials={"api_key": "secret"},
+            plugin_state={"task_id": "poll-1"},
+        )
+
+        assert result == polling_result
+        client.check_llm_polling.assert_called_once_with(
+            tenant_id="tenant",
+            user_id="user",
+            plugin_id="langgenius/openai",
+            provider="openai",
+            model="gpt-4o-mini",
+            credentials={"api_key": "secret"},
+            plugin_state={"task_id": "poll-1"},
+        )
+
     def test_invoke_llm_rejects_per_call_user_override(self) -> None:
         client = Mock(spec=PluginModelClient)
         client.invoke_llm.return_value = sentinel.result
diff --git a/api/tests/unit_tests/core/rag/datasource/keyword/jieba/test_jieba.py b/api/tests/unit_tests/core/rag/datasource/keyword/jieba/test_jieba.py
index e233bd2ef07..9224d6c88e8 100644
--- a/api/tests/unit_tests/core/rag/datasource/keyword/jieba/test_jieba.py
+++ b/api/tests/unit_tests/core/rag/datasource/keyword/jieba/test_jieba.py
@@ -81,7 +81,7 @@ def patched_runtime(monkeypatch: pytest.MonkeyPatch):
     return SimpleNamespace(session=session, storage=storage, lock=lock)
 
 
-def test_create_indexes_documents_and_returns_self(monkeypatch, patched_runtime):
+def test_create_indexes_documents_and_returns_self(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     dataset = _dataset(_dataset_keyword_table(), keyword_number=2)
     keyword = Jieba(dataset)
     handler = MagicMock()
@@ -111,7 +111,7 @@ def test_create_indexes_documents_and_returns_self(monkeypatch, patched_runtime)
     patched_runtime.lock.assert_called_once_with("keyword_indexing_lock_dataset-1", timeout=600)
 
 
-def test_add_texts_supports_keywords_list_and_extract_fallback(monkeypatch, patched_runtime):
+def test_add_texts_supports_keywords_list_and_extract_fallback(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     keyword = Jieba(_dataset(_dataset_keyword_table(), keyword_number=3))
     handler = MagicMock()
     handler.extract_keywords.return_value = {"auto"}
@@ -135,7 +135,7 @@ def test_add_texts_supports_keywords_list_and_extract_fallback(monkeypatch, patc
     keyword._save_dataset_keyword_table.assert_called_once()
 
 
-def test_add_texts_without_keywords_list_always_uses_extractor(monkeypatch, patched_runtime):
+def test_add_texts_without_keywords_list_always_uses_extractor(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     keyword = Jieba(_dataset(_dataset_keyword_table(), keyword_number=1))
     handler = MagicMock()
     handler.extract_keywords.return_value = {"from-extractor"}
@@ -162,7 +162,7 @@ def test_text_exists_handles_missing_and_existing_keyword_table(monkeypatch: pyt
     assert keyword.text_exists("node-x") is False
 
 
-def test_delete_by_ids_updates_table_when_present(monkeypatch, patched_runtime):
+def test_delete_by_ids_updates_table_when_present(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     keyword = Jieba(_dataset(_dataset_keyword_table()))
     monkeypatch.setattr(keyword, "_get_dataset_keyword_table", MagicMock(return_value={"k": {"node-1", "node-2"}}))
     monkeypatch.setattr(keyword, "_delete_ids_from_keyword_table", MagicMock(return_value={"k": {"node-2"}}))
@@ -174,7 +174,7 @@ def test_delete_by_ids_updates_table_when_present(monkeypatch, patched_runtime):
     keyword._save_dataset_keyword_table.assert_called_once_with({"k": {"node-2"}})
 
 
-def test_delete_by_ids_saves_none_when_keyword_table_is_missing(monkeypatch, patched_runtime):
+def test_delete_by_ids_saves_none_when_keyword_table_is_missing(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     keyword = Jieba(_dataset(_dataset_keyword_table()))
     monkeypatch.setattr(keyword, "_get_dataset_keyword_table", MagicMock(return_value=None))
     monkeypatch.setattr(keyword, "_delete_ids_from_keyword_table", MagicMock())
@@ -186,7 +186,7 @@ def test_delete_by_ids_saves_none_when_keyword_table_is_missing(monkeypatch, pat
     keyword._save_dataset_keyword_table.assert_called_once_with(None)
 
 
-def test_search_returns_documents_in_rank_order_and_applies_filter(monkeypatch, patched_runtime):
+def test_search_returns_documents_in_rank_order_and_applies_filter(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     class _FakeDocumentSegment:
         dataset_id = _Field("dataset_id")
         index_node_id = _Field("index_node_id")
@@ -216,7 +216,7 @@ def test_search_returns_documents_in_rank_order_and_applies_filter(monkeypatch,
     assert documents[0].metadata["doc_hash"] == "hash-2"
 
 
-def test_delete_removes_keyword_table_and_optional_file(monkeypatch, patched_runtime):
+def test_delete_removes_keyword_table_and_optional_file(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     db_keyword = _dataset_keyword_table(data_source_type="database")
     file_keyword = _dataset_keyword_table(data_source_type="object_storage")
 
@@ -232,7 +232,7 @@ def test_delete_removes_keyword_table_and_optional_file(monkeypatch, patched_run
     assert patched_runtime.session.commit.call_count == 2
 
 
-def test_save_dataset_keyword_table_to_database(monkeypatch, patched_runtime):
+def test_save_dataset_keyword_table_to_database(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     dataset_keyword_table = _dataset_keyword_table(data_source_type="database")
     keyword = Jieba(_dataset(dataset_keyword_table))
 
@@ -243,7 +243,7 @@ def test_save_dataset_keyword_table_to_database(monkeypatch, patched_runtime):
     patched_runtime.session.commit.assert_called_once()
 
 
-def test_save_dataset_keyword_table_to_file_storage(monkeypatch, patched_runtime):
+def test_save_dataset_keyword_table_to_file_storage(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     dataset_keyword_table = _dataset_keyword_table(data_source_type="file")
     keyword = Jieba(_dataset(dataset_keyword_table))
     patched_runtime.storage.exists.return_value = True
@@ -257,7 +257,7 @@ def test_save_dataset_keyword_table_to_file_storage(monkeypatch, patched_runtime
     assert isinstance(save_args[1], bytes)
 
 
-def test_get_dataset_keyword_table_returns_existing_table_data(monkeypatch, patched_runtime):
+def test_get_dataset_keyword_table_returns_existing_table_data(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     existing = _dataset_keyword_table(
         keyword_table_dict={"__type__": "keyword_table", "__data__": {"table": {"kw": ["node-1"]}}}
     )
@@ -269,7 +269,7 @@ def test_get_dataset_keyword_table_returns_existing_table_data(monkeypatch, patc
     assert keyword_with_missing_payload._get_dataset_keyword_table() == {}
 
 
-def test_get_dataset_keyword_table_creates_table_when_missing(monkeypatch, patched_runtime):
+def test_get_dataset_keyword_table_creates_table_when_missing(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     created_tables: list[SimpleNamespace] = []
 
     def _fake_dataset_keyword_table(**kwargs):
@@ -323,7 +323,7 @@ def test_retrieve_ids_by_query_ranks_by_keyword_frequency(monkeypatch: pytest.Mo
     assert ranked_ids == ["node-2"]
 
 
-def test_update_segment_keywords_updates_when_segment_exists(monkeypatch, patched_runtime):
+def test_update_segment_keywords_updates_when_segment_exists(monkeypatch: pytest.MonkeyPatch, patched_runtime):
     class _FakeDocumentSegment:
         dataset_id = _Field("dataset_id")
         index_node_id = _Field("index_node_id")
diff --git a/api/tests/unit_tests/core/rag/datasource/test_retrieval_attachment_access.py b/api/tests/unit_tests/core/rag/datasource/test_retrieval_attachment_access.py
index 426ffc498b2..a0d047f6eda 100644
--- a/api/tests/unit_tests/core/rag/datasource/test_retrieval_attachment_access.py
+++ b/api/tests/unit_tests/core/rag/datasource/test_retrieval_attachment_access.py
@@ -3,6 +3,7 @@ from __future__ import annotations
 from types import SimpleNamespace
 from uuid import uuid4
 
+import pytest
 from sqlalchemy import select
 
 from core.app.entities.app_invoke_entities import InvokeFrom, UserFrom
@@ -112,7 +113,7 @@ def test_segment_attachment_lookup_grants_returned_upload_files_to_current_scope
     assert "upload_files.id IN" in whereclause
 
 
-def test_knowledge_retrieval_grants_returned_segments_to_current_scope(monkeypatch) -> None:
+def test_knowledge_retrieval_grants_returned_segments_to_current_scope(monkeypatch: pytest.MonkeyPatch) -> None:
     tenant_id = str(uuid4())
     dataset_id = str(uuid4())
     document_id = str(uuid4())
diff --git a/api/tests/unit_tests/core/rag/datasource/vdb/test_vector_factory.py b/api/tests/unit_tests/core/rag/datasource/vdb/test_vector_factory.py
index 067159398d2..d86ffd26478 100644
--- a/api/tests/unit_tests/core/rag/datasource/vdb/test_vector_factory.py
+++ b/api/tests/unit_tests/core/rag/datasource/vdb/test_vector_factory.py
@@ -9,7 +9,7 @@ import pytest
 from core.rag.models.document import Document
 
 
-def _register_fake_factory_module(monkeypatch, module_path: str, class_name: str):
+def _register_fake_factory_module(monkeypatch: pytest.MonkeyPatch, module_path: str, class_name: str):
     fake_module = types.ModuleType(module_path)
     fake_cls = type(class_name, (), {})
     setattr(fake_module, class_name, fake_cls)
diff --git a/api/tests/unit_tests/core/rag/embedding/test_cached_embedding.py b/api/tests/unit_tests/core/rag/embedding/test_cached_embedding.py
index 051a1455aef..b33a7ba725c 100644
--- a/api/tests/unit_tests/core/rag/embedding/test_cached_embedding.py
+++ b/api/tests/unit_tests/core/rag/embedding/test_cached_embedding.py
@@ -7,6 +7,7 @@ This test file covers the methods not fully tested in test_embedding_service.py:
 """
 
 import base64
+import logging
 from decimal import Decimal
 from unittest.mock import Mock, patch
 
@@ -63,7 +64,9 @@ class TestCacheEmbeddingMultimodalDocuments:
             usage=usage,
         )
 
-    def test_embed_single_multimodal_document_cache_miss(self, mock_model_instance, sample_multimodal_result):
+    def test_embed_single_multimodal_document_cache_miss(
+        self, mock_model_instance, sample_multimodal_result: EmbeddingResult
+    ):
         """Test embedding a single multimodal document when cache is empty."""
         cache_embedding = CacheEmbedding(mock_model_instance)
         documents = [{"file_id": "file123", "content": "test content"}]
@@ -188,7 +191,7 @@ class TestCacheEmbeddingMultimodalDocuments:
             assert len(result) == 3
             assert result[0] == normalized_cached
 
-    def test_embed_multimodal_documents_nan_handling(self, mock_model_instance):
+    def test_embed_multimodal_documents_nan_handling(self, mock_model_instance, caplog: pytest.LogCaptureFixture):
         """Test handling of NaN values in multimodal embeddings."""
         cache_embedding = CacheEmbedding(mock_model_instance)
         documents = [{"file_id": "valid"}, {"file_id": "nan"}]
@@ -216,14 +219,14 @@ class TestCacheEmbeddingMultimodalDocuments:
             mock_session.scalar.return_value = None
             mock_model_instance.invoke_multimodal_embedding.return_value = embedding_result
 
-            with patch("core.rag.embedding.cached_embedding.logger") as mock_logger:
+            with caplog.at_level(logging.WARNING, logger="core.rag.embedding.cached_embedding"):
                 result = cache_embedding.embed_multimodal_documents(documents)
 
                 assert len(result) == 2
                 assert result[0] is not None
                 assert result[1] is None
 
-                mock_logger.warning.assert_called_once()
+                assert any(record.levelno == logging.WARNING for record in caplog.records)
 
     def test_embed_multimodal_documents_large_batch(self, mock_model_instance):
         """Test embedding large batch of multimodal documents respecting MAX_CHUNKS."""
@@ -463,7 +466,7 @@ class TestCacheEmbeddingQueryErrors:
         model_instance.credentials = {"api_key": "test-key"}
         return model_instance
 
-    def test_embed_query_api_error_debug_mode(self, mock_model_instance):
+    def test_embed_query_api_error_debug_mode(self, mock_model_instance, caplog: pytest.LogCaptureFixture):
         """Test handling of API errors in debug mode."""
         cache_embedding = CacheEmbedding(mock_model_instance)
         query = "test query"
@@ -475,14 +478,14 @@ class TestCacheEmbeddingQueryErrors:
             with patch("core.rag.embedding.cached_embedding.dify_config") as mock_config:
                 mock_config.DEBUG = True
 
-                with patch("core.rag.embedding.cached_embedding.logger") as mock_logger:
+                with caplog.at_level(logging.ERROR, logger="core.rag.embedding.cached_embedding"):
                     with pytest.raises(RuntimeError) as exc_info:
                         cache_embedding.embed_query(query)
 
                     assert "API Error" in str(exc_info.value)
-                    mock_logger.exception.assert_called()
+                    assert any(record.levelno == logging.ERROR for record in caplog.records)
 
-    def test_embed_query_redis_set_error_debug_mode(self, mock_model_instance):
+    def test_embed_query_redis_set_error_debug_mode(self, mock_model_instance, caplog: pytest.LogCaptureFixture):
         """Test handling of Redis set errors in debug mode."""
         cache_embedding = CacheEmbedding(mock_model_instance)
         query = "test query"
@@ -514,11 +517,11 @@ class TestCacheEmbeddingQueryErrors:
             with patch("core.rag.embedding.cached_embedding.dify_config") as mock_config:
                 mock_config.DEBUG = True
 
-                with patch("core.rag.embedding.cached_embedding.logger") as mock_logger:
+                with caplog.at_level(logging.ERROR, logger="core.rag.embedding.cached_embedding"):
                     with pytest.raises(RuntimeError):
                         cache_embedding.embed_query(query)
 
-                    mock_logger.exception.assert_called()
+                    assert any(record.levelno == logging.ERROR for record in caplog.records)
 
 
 class TestCacheEmbeddingInitialization:
diff --git a/api/tests/unit_tests/core/rag/embedding/test_embedding_service.py b/api/tests/unit_tests/core/rag/embedding/test_embedding_service.py
index 4b8175b0b42..42d5ea4a393 100644
--- a/api/tests/unit_tests/core/rag/embedding/test_embedding_service.py
+++ b/api/tests/unit_tests/core/rag/embedding/test_embedding_service.py
@@ -44,6 +44,7 @@ Tests follow the Arrange-Act-Assert pattern for clarity.
 """
 
 import base64
+import logging
 from decimal import Decimal
 from unittest.mock import Mock, patch
 
@@ -406,7 +407,7 @@ class TestCacheEmbeddingDocuments:
             assert len(calls[1].kwargs["texts"]) == 10
             assert len(calls[2].kwargs["texts"]) == 5
 
-    def test_embed_documents_nan_handling(self, mock_model_instance):
+    def test_embed_documents_nan_handling(self, mock_model_instance, caplog):
         """Test handling of NaN values in embeddings.
 
         Verifies:
@@ -446,7 +447,7 @@ class TestCacheEmbeddingDocuments:
             mock_session.scalar.return_value = None
             mock_model_instance.invoke_text_embedding.return_value = embedding_result
 
-            with patch("core.rag.embedding.cached_embedding.logger") as mock_logger:
+            with caplog.at_level(logging.WARNING, logger="core.rag.embedding.cached_embedding"):
                 # Act
                 result = cache_embedding.embed_documents(texts)
 
@@ -461,8 +462,8 @@ class TestCacheEmbeddingDocuments:
                 assert result[1] is None
 
                 # Verify warning was logged
-                mock_logger.warning.assert_called_once()
-                assert "Normalized embedding is nan" in str(mock_logger.warning.call_args)
+                assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) >= 1
+                assert any("Normalized embedding is nan" in record.message for record in caplog.records)
 
     def test_embed_documents_api_connection_error(self, mock_model_instance):
         """Test handling of API connection errors during embedding.
diff --git a/api/tests/unit_tests/core/rag/extractor/test_word_extractor.py b/api/tests/unit_tests/core/rag/extractor/test_word_extractor.py
index 45d6fc1cd07..51763ec5f36 100644
--- a/api/tests/unit_tests/core/rag/extractor/test_word_extractor.py
+++ b/api/tests/unit_tests/core/rag/extractor/test_word_extractor.py
@@ -1,6 +1,7 @@
 """Primarily used for testing merged cell scenarios"""
 
 import io
+import logging
 import os
 import tempfile
 from collections import UserDict
@@ -548,7 +549,9 @@ def test_parse_docx_reads_real_paragraph_table_order(monkeypatch: pytest.MonkeyP
             os.remove(tmp_path)
 
 
-def test_parse_docx_covers_drawing_shapes_hyperlink_error_and_table_branch(monkeypatch: pytest.MonkeyPatch):
+def test_parse_docx_covers_drawing_shapes_hyperlink_error_and_table_branch(
+    monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+):
     extractor = object.__new__(WordExtractor)
 
     ext_image_id = "ext-image"
@@ -709,10 +712,9 @@ def test_parse_docx_covers_drawing_shapes_hyperlink_error_and_table_branch(monke
     monkeypatch.setattr(we, "Run", FakeRun)
     monkeypatch.setattr(extractor, "_extract_images_from_docx", lambda doc: image_map)
     monkeypatch.setattr(extractor, "_table_to_markdown", lambda table, image_map: "TABLE-MARKDOWN")
-    logger_exception = MagicMock()
-    monkeypatch.setattr(we.logger, "exception", logger_exception)
 
-    content = extractor.parse_docx("dummy.docx")
+    with caplog.at_level(logging.ERROR, logger="core.rag.extractor.word_extractor"):
+        content = extractor.parse_docx("dummy.docx")
 
     assert "[EXT]" in content
     assert "[INT]" in content
@@ -720,7 +722,7 @@ def test_parse_docx_covers_drawing_shapes_hyperlink_error_and_table_branch(monke
     assert "[LinkText](https://example.com)" in content
     assert "BrokenLink" in content
     assert "TABLE-MARKDOWN" in content
-    logger_exception.assert_called_once()
+    assert any(record.levelno == logging.ERROR for record in caplog.records)
 
 
 def test_parse_cell_paragraph_hyperlink_in_table_cell_http():
diff --git a/api/tests/unit_tests/core/rag/extractor/watercrawl/test_watercrawl.py b/api/tests/unit_tests/core/rag/extractor/watercrawl/test_watercrawl.py
index 35e581ccc15..05985d30985 100644
--- a/api/tests/unit_tests/core/rag/extractor/watercrawl/test_watercrawl.py
+++ b/api/tests/unit_tests/core/rag/extractor/watercrawl/test_watercrawl.py
@@ -73,6 +73,9 @@ class TestBaseAPIClient:
         assert client.session == "session"
         assert captured["headers"]["X-API-Key"] == "k"
         assert captured["headers"]["User-Agent"] == "WaterCrawl-Plugin"
+        assert captured["timeout"] is not None
+        assert captured["timeout"].connect is not None
+        assert captured["timeout"].read is not None
 
     def test_request_stream_and_non_stream_paths(self, monkeypatch: pytest.MonkeyPatch):
         class FakeSession:
diff --git a/api/tests/unit_tests/core/rag/indexing/processor/test_paragraph_index_processor.py b/api/tests/unit_tests/core/rag/indexing/processor/test_paragraph_index_processor.py
index 182930b19d1..d2154f138a7 100644
--- a/api/tests/unit_tests/core/rag/indexing/processor/test_paragraph_index_processor.py
+++ b/api/tests/unit_tests/core/rag/indexing/processor/test_paragraph_index_processor.py
@@ -1,3 +1,4 @@
+import logging
 from types import SimpleNamespace
 from typing import Any
 from unittest.mock import Mock, patch
@@ -384,7 +385,7 @@ class TestParagraphIndexProcessor:
         with pytest.raises(ValueError, match="model_name and model_provider_name"):
             ParagraphIndexProcessor.generate_summary("tenant-1", "text", {"enable": True})
 
-    def test_generate_summary_text_only_flow(self) -> None:
+    def test_generate_summary_text_only_flow(self, caplog) -> None:
         model_instance = Mock()
         model_instance.credentials = {"k": "v"}
         model_instance.model_type_instance.get_model_schema.return_value = SimpleNamespace(features=[])
@@ -402,19 +403,22 @@ class TestParagraphIndexProcessor:
                 "core.rag.index_processor.processor.paragraph_index_processor.deduct_llm_quota",
                 side_effect=RuntimeError("quota"),
             ),
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
         ):
             mock_provider_manager.return_value.get_provider_model_bundle.return_value = Mock()
-            summary, usage = ParagraphIndexProcessor.generate_summary(
-                "tenant-1",
-                "text content",
-                {"enable": True, "model_name": "model-a", "model_provider_name": "provider-a"},
-                document_language="English",
-            )
+            with caplog.at_level(
+                logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"
+            ):
+                summary, usage = ParagraphIndexProcessor.generate_summary(
+                    "tenant-1",
+                    "text content",
+                    {"enable": True, "model_name": "model-a", "model_provider_name": "provider-a"},
+                    document_language="English",
+                )
 
         assert summary == "text summary"
         assert isinstance(usage, LLMUsage)
-        mock_logger.warning.assert_called_with("Failed to deduct quota for summary generation: %s", "quota")
+        assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) == 1
+        assert any("Failed to deduct quota for summary generation" in record.message for record in caplog.records)
 
     def test_generate_summary_handles_vision_and_image_conversion(self) -> None:
         model_instance = Mock()
@@ -455,7 +459,7 @@ class TestParagraphIndexProcessor:
         assert summary == "vision summary"
         mock_extract_text.assert_not_called()
 
-    def test_generate_summary_fallbacks_for_prompt_and_result_types(self) -> None:
+    def test_generate_summary_fallbacks_for_prompt_and_result_types(self, caplog) -> None:
         model_instance = Mock()
         model_instance.credentials = {"k": "v"}
         model_instance.model_type_instance.get_model_schema.return_value = SimpleNamespace(
@@ -482,21 +486,24 @@ class TestParagraphIndexProcessor:
                 "core.rag.index_processor.processor.paragraph_index_processor.file_manager.to_prompt_message_content",
                 side_effect=RuntimeError("bad image"),
             ),
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
         ):
             mock_provider_manager.return_value.get_provider_model_bundle.return_value = Mock()
             with pytest.raises(ValueError, match="Expected LLMResult"):
-                ParagraphIndexProcessor.generate_summary(
-                    "tenant-1",
-                    "text content",
-                    {"enable": True, "model_name": "model-a", "model_provider_name": "provider-a"},
-                )
+                with caplog.at_level(
+                    logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"
+                ):
+                    ParagraphIndexProcessor.generate_summary(
+                        "tenant-1",
+                        "text content",
+                        {"enable": True, "model_name": "model-a", "model_provider_name": "provider-a"},
+                    )
 
-        mock_logger.warning.assert_called_with(
-            "Failed to convert image file to prompt message content: %s", "bad image"
+        assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) == 1
+        assert any(
+            "Failed to convert image file to prompt message content" in record.message for record in caplog.records
         )
 
-    def test_extract_images_from_text_handles_patterns_and_build_errors(self) -> None:
+    def test_extract_images_from_text_handles_patterns_and_build_errors(self, caplog) -> None:
         text = (
             "![img](/files/11111111-1111-1111-1111-111111111111/image-preview) "
             "![img2](/files/22222222-2222-2222-2222-222222222222/file-preview) "
@@ -532,13 +539,13 @@ class TestParagraphIndexProcessor:
                 "core.rag.index_processor.processor.paragraph_index_processor.build_from_mapping",
                 return_value=SimpleNamespace(id="file-1"),
             ) as mock_builder,
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
+            caplog.at_level(logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"),
         ):
             files = ParagraphIndexProcessor._extract_images_from_text("tenant-1", text, session)
 
         assert len(files) == 1
         assert mock_builder.call_count == 1
-        mock_logger.warning.assert_not_called()
+        assert not any(record.levelno == logging.WARNING for record in caplog.records)
 
     def test_extract_images_from_text_returns_empty_when_no_matches(self) -> None:
         scalars_result = Mock()
@@ -547,7 +554,7 @@ class TestParagraphIndexProcessor:
         session.scalars.return_value = scalars_result
         assert ParagraphIndexProcessor._extract_images_from_text("tenant-1", "no images here", session) == []
 
-    def test_extract_images_from_text_logs_when_build_fails(self) -> None:
+    def test_extract_images_from_text_logs_when_build_fails(self, caplog) -> None:
         text = "![img](/files/11111111-1111-1111-1111-111111111111/image-preview)"
         image_upload = SimpleNamespace(
             id="11111111-1111-1111-1111-111111111111",
@@ -569,14 +576,14 @@ class TestParagraphIndexProcessor:
                 "core.rag.index_processor.processor.paragraph_index_processor.build_from_mapping",
                 side_effect=RuntimeError("build failed"),
             ),
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
+            caplog.at_level(logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"),
         ):
             files = ParagraphIndexProcessor._extract_images_from_text("tenant-1", text, session)
 
         assert files == []
-        mock_logger.warning.assert_called_once()
+        assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) == 1
 
-    def test_extract_images_from_segment_attachments(self) -> None:
+    def test_extract_images_from_segment_attachments(self, caplog) -> None:
         image_upload = SimpleNamespace(
             id="file-1",
             name="image",
@@ -609,13 +616,11 @@ class TestParagraphIndexProcessor:
         session = Mock()
         session.execute.return_value = execute_result
 
-        with (
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
-        ):
+        with caplog.at_level(logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"):
             files = ParagraphIndexProcessor._extract_images_from_segment_attachments("tenant-1", "seg-1", session)
 
         assert len(files) == 1
-        mock_logger.warning.assert_called_once()
+        assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) == 1
 
     def test_extract_images_from_segment_attachments_empty(self) -> None:
         execute_result = Mock()
diff --git a/api/tests/unit_tests/core/rag/indexing/processor/test_qa_index_processor.py b/api/tests/unit_tests/core/rag/indexing/processor/test_qa_index_processor.py
index 30600e64651..4ffd0a76433 100644
--- a/api/tests/unit_tests/core/rag/indexing/processor/test_qa_index_processor.py
+++ b/api/tests/unit_tests/core/rag/indexing/processor/test_qa_index_processor.py
@@ -1,3 +1,4 @@
+import logging
 from types import SimpleNamespace
 from typing import Any
 from unittest.mock import MagicMock, Mock, patch
@@ -350,7 +351,7 @@ class TestQAIndexProcessor:
         assert all_qa_documents[0].metadata["answer"] == "A test."
         assert all_qa_documents[1].metadata["answer"] == "Coverage."
 
-    def test_format_qa_document_logs_errors(self, processor: QAIndexProcessor, fake_flask_app) -> None:
+    def test_format_qa_document_logs_errors(self, processor: QAIndexProcessor, fake_flask_app, caplog) -> None:
         all_qa_documents: list[Document] = []
         source_document = Document(page_content="source text", metadata={"origin": "doc-1"})
 
@@ -359,12 +360,14 @@ class TestQAIndexProcessor:
                 "core.rag.index_processor.processor.qa_index_processor.LLMGenerator.generate_qa_document",
                 side_effect=RuntimeError("llm failure"),
             ),
-            patch("core.rag.index_processor.processor.qa_index_processor.logger") as mock_logger,
+            caplog.at_level(logging.ERROR, logger="core.rag.index_processor.processor.qa_index_processor"),
         ):
             processor._format_qa_document(fake_flask_app, "tenant-1", source_document, all_qa_documents, "English")
 
         assert all_qa_documents == []
-        mock_logger.exception.assert_called_once_with("Failed to format qa document")
+        assert len(caplog.records) == 1
+        assert caplog.records[0].levelname == "ERROR"
+        assert "Failed to format qa document" in caplog.records[0].message
 
     def test_format_split_text_extracts_question_answer_pairs(self, processor: QAIndexProcessor) -> None:
         parsed = processor._format_split_text("Q1: First?\nA1: One.\nQ2: Second?\nA2: Two.\n")
diff --git a/api/tests/unit_tests/core/rag/rerank/test_reranker.py b/api/tests/unit_tests/core/rag/rerank/test_reranker.py
index 8bc7dbf70db..565bb85b634 100644
--- a/api/tests/unit_tests/core/rag/rerank/test_reranker.py
+++ b/api/tests/unit_tests/core/rag/rerank/test_reranker.py
@@ -97,7 +97,9 @@ class TestRerankModelRunner:
             ),
         ]
 
-    def test_basic_reranking(self, rerank_runner, mock_model_instance, sample_documents):
+    def test_basic_reranking(
+        self, rerank_runner: RerankModelRunner, mock_model_instance, sample_documents: list[Document]
+    ):
         """Test basic reranking with cross-encoder model.
 
         Verifies:
@@ -135,7 +137,9 @@ class TestRerankModelRunner:
         assert result[3].metadata["score"] == 0.65
         assert result[0].page_content == sample_documents[2].page_content
 
-    def test_score_threshold_filtering(self, rerank_runner, mock_model_instance, sample_documents):
+    def test_score_threshold_filtering(
+        self, rerank_runner: RerankModelRunner, mock_model_instance, sample_documents: list[Document]
+    ):
         """Test score threshold filtering.
 
         Verifies:
@@ -163,7 +167,9 @@ class TestRerankModelRunner:
         assert result[0].metadata["score"] == 0.90
         assert result[1].metadata["score"] == 0.70
 
-    def test_top_k_selection(self, rerank_runner, mock_model_instance, sample_documents):
+    def test_top_k_selection(
+        self, rerank_runner: RerankModelRunner, mock_model_instance, sample_documents: list[Document]
+    ):
         """Test top-k selection functionality.
 
         Verifies:
@@ -191,7 +197,7 @@ class TestRerankModelRunner:
         assert result[0].metadata["score"] == 0.95
         assert result[1].metadata["score"] == 0.85
 
-    def test_document_deduplication_dify_provider(self, rerank_runner, mock_model_instance):
+    def test_document_deduplication_dify_provider(self, rerank_runner: RerankModelRunner, mock_model_instance):
         """Test document deduplication for dify provider.
 
         Verifies:
@@ -235,7 +241,7 @@ class TestRerankModelRunner:
         assert len(call_kwargs["docs"]) == 2  # Duplicate removed
         assert len(result) == 2
 
-    def test_document_deduplication_external_provider(self, rerank_runner, mock_model_instance):
+    def test_document_deduplication_external_provider(self, rerank_runner: RerankModelRunner, mock_model_instance):
         """Test document deduplication for external provider.
 
         Verifies:
@@ -273,7 +279,9 @@ class TestRerankModelRunner:
         assert len(call_kwargs["docs"]) == 2
         assert len(result) == 2
 
-    def test_combined_threshold_and_top_k(self, rerank_runner, mock_model_instance, sample_documents):
+    def test_combined_threshold_and_top_k(
+        self, rerank_runner: RerankModelRunner, mock_model_instance, sample_documents: list[Document]
+    ):
         """Test combined score threshold and top-k selection.
 
         Verifies:
@@ -307,7 +315,9 @@ class TestRerankModelRunner:
         assert result[0].metadata["score"] == 0.95
         assert result[1].metadata["score"] == 0.85
 
-    def test_metadata_preservation(self, rerank_runner, mock_model_instance, sample_documents):
+    def test_metadata_preservation(
+        self, rerank_runner: RerankModelRunner, mock_model_instance, sample_documents: list[Document]
+    ):
         """Test that original metadata is preserved after reranking.
 
         Verifies:
@@ -334,7 +344,7 @@ class TestRerankModelRunner:
         assert result[0].metadata["score"] == 0.90
         assert result[0].provider == "dify"
 
-    def test_empty_documents_list(self, rerank_runner, mock_model_instance):
+    def test_empty_documents_list(self, rerank_runner: RerankModelRunner, mock_model_instance):
         """Test handling of empty documents list.
 
         Verifies:
@@ -523,7 +533,9 @@ class TestRerankModelRunnerMultimodal:
         docs_arg = mock_text_rerank.call_args.args[1]
         assert len(docs_arg) == 1
 
-    def test_fetch_multimodal_rerank_image_query_invokes_multimodal_model(self, rerank_runner, mock_model_instance):
+    def test_fetch_multimodal_rerank_image_query_invokes_multimodal_model(
+        self, rerank_runner: RerankModelRunner, mock_model_instance
+    ):
         text_doc = Document(
             page_content="text-content",
             metadata={"doc_id": "txt-1", "doc_type": DocType.TEXT},
diff --git a/api/tests/unit_tests/core/rag/retrieval/test_dataset_retrieval_attachment_entry.py b/api/tests/unit_tests/core/rag/retrieval/test_dataset_retrieval_attachment_entry.py
new file mode 100644
index 00000000000..adcf5585d39
--- /dev/null
+++ b/api/tests/unit_tests/core/rag/retrieval/test_dataset_retrieval_attachment_entry.py
@@ -0,0 +1,36 @@
+"""Focused tests for attachment-aware dataset retrieval entry behavior."""
+
+from unittest.mock import MagicMock, patch
+
+from core.rag.retrieval.dataset_retrieval import DatasetRetrieval
+from core.workflow.nodes.knowledge_retrieval.retrieval import KnowledgeRetrievalRequest
+
+
+def test_knowledge_retrieval_allows_attachment_only_requests() -> None:
+    retrieval = DatasetRetrieval()
+    available_dataset = MagicMock(id="dataset-1")
+
+    request = KnowledgeRetrievalRequest(
+        tenant_id="tenant-1",
+        user_id="user-1",
+        app_id="app-1",
+        user_from="account",
+        dataset_ids=["dataset-1"],
+        query=None,
+        retrieval_mode="multiple",
+        top_k=4,
+        score_threshold=0.0,
+        reranking_mode="reranking_model",
+        reranking_enable=True,
+        attachment_ids=["attachment-1"],
+    )
+
+    with (
+        patch.object(retrieval, "_check_knowledge_rate_limit"),
+        patch.object(retrieval, "_get_available_datasets", return_value=[available_dataset]),
+        patch.object(retrieval, "multiple_retrieve", return_value=[]) as mock_multiple,
+    ):
+        result = retrieval.knowledge_retrieval(request)
+
+    assert result == []
+    mock_multiple.assert_called_once()
diff --git a/api/tests/unit_tests/core/rag/splitter/test_text_splitter.py b/api/tests/unit_tests/core/rag/splitter/test_text_splitter.py
index 976de10d89d..12117241b5d 100644
--- a/api/tests/unit_tests/core/rag/splitter/test_text_splitter.py
+++ b/api/tests/unit_tests/core/rag/splitter/test_text_splitter.py
@@ -126,6 +126,7 @@ Run with coverage:
 """
 
 import asyncio
+import logging
 import string
 import sys
 import types
@@ -644,13 +645,13 @@ class TestTextSplitterBasePaths:
         with pytest.raises(NotImplementedError):
             asyncio.run(splitter.atransform_documents([Document(page_content="x", metadata={})]))
 
-    def test_merge_splits_logs_warning_for_oversized_total(self):
+    def test_merge_splits_logs_warning_for_oversized_total(self, caplog: pytest.LogCaptureFixture):
         """Cover logger.warning path in _merge_splits."""
         splitter = RecursiveCharacterTextSplitter(chunk_size=5, chunk_overlap=1)
-        with patch("core.rag.splitter.text_splitter.logger.warning") as mock_warning:
+        with caplog.at_level(logging.WARNING, logger="core.rag.splitter.text_splitter"):
             merged = splitter._merge_splits(["abcdefghij", "b"], "", [10, 1])
         assert merged
-        mock_warning.assert_called_once()
+        assert any(record.levelno == logging.WARNING for record in caplog.records)
 
 
 # ============================================================================
diff --git a/api/tests/unit_tests/core/schemas/test_registry.py b/api/tests/unit_tests/core/schemas/test_registry.py
index 6174b66f470..8a3aa5030e2 100644
--- a/api/tests/unit_tests/core/schemas/test_registry.py
+++ b/api/tests/unit_tests/core/schemas/test_registry.py
@@ -2,6 +2,8 @@ import json
 from pathlib import Path
 from unittest.mock import patch
 
+import pytest
+
 from core.schemas.registry import SchemaRegistry
 
 
@@ -71,7 +73,7 @@ class TestSchemaRegistry:
         assert registry.metadata[uri]["title"] == "Test Schema"
         assert registry.metadata[uri]["version"] == "v1"
 
-    def test_load_schema_invalid_json(self, tmp_path, caplog):
+    def test_load_schema_invalid_json(self, tmp_path: Path, caplog: pytest.LogCaptureFixture):
         schema_path = tmp_path / "invalid.json"
         schema_path.write_text("invalid json")
 
@@ -81,7 +83,7 @@ class TestSchemaRegistry:
 
         assert "Failed to load schema v1/invalid" in caplog.text
 
-    def test_load_schema_os_error(self, tmp_path, caplog):
+    def test_load_schema_os_error(self, tmp_path: Path, caplog: pytest.LogCaptureFixture):
         schema_path = tmp_path / "error.json"
         schema_path.write_text("{}")
 
diff --git a/api/tests/unit_tests/core/schemas/test_resolver.py b/api/tests/unit_tests/core/schemas/test_resolver.py
index ba6fa0d5365..d53b01364eb 100644
--- a/api/tests/unit_tests/core/schemas/test_resolver.py
+++ b/api/tests/unit_tests/core/schemas/test_resolver.py
@@ -703,9 +703,12 @@ class TestSchemaResolverClass:
 
             # For schemas without refs, hybrid should be competitive or better
             if not expected:  # No refs case
-                # Hybrid might be slightly slower due to JSON serialization overhead,
-                # but should not be dramatically worse
-                assert avg_hybrid < avg_recursive * 5  # At most 5x slower
+                relative_slowdown_limit = 5.0
+                absolute_noise_budget_seconds = 2e-4
+
+                # JSON serialization has a fixed overhead that dominates tiny schemas,
+                # so allow a small absolute noise budget on top of the relative limit.
+                assert avg_hybrid < (avg_recursive * relative_slowdown_limit) + absolute_noise_budget_seconds
 
     def test_string_matching_edge_cases(self):
         """Test edge cases for string-based detection"""
diff --git a/api/tests/unit_tests/core/tools/test_builtin_tools_extra.py b/api/tests/unit_tests/core/tools/test_builtin_tools_extra.py
index 3f6b1ec1545..a99fd1f248f 100644
--- a/api/tests/unit_tests/core/tools/test_builtin_tools_extra.py
+++ b/api/tests/unit_tests/core/tools/test_builtin_tools_extra.py
@@ -4,6 +4,7 @@ import calendar
 import math
 from datetime import date
 from types import SimpleNamespace
+from zoneinfo import ZoneInfo
 
 import pytest
 
@@ -66,6 +67,20 @@ def test_localtime_to_timestamp_tool():
     ts_value = float(ts_message.strip())
     assert math.isfinite(ts_value)
     assert ts_value >= 0
+    assert (
+        LocaltimeToTimestampTool.localtime_to_timestamp(
+            "2024-01-01 10:00:00",
+            "%Y-%m-%d %H:%M:%S",
+            ZoneInfo("UTC"),
+        )
+        == 1704103200
+    )
+    with pytest.raises(ToolInvokeError, match="local_tz must be"):
+        LocaltimeToTimestampTool.localtime_to_timestamp(
+            "2024-01-01 10:00:00",
+            "%Y-%m-%d %H:%M:%S",
+            object(),  # type: ignore[arg-type]
+        )
     with pytest.raises(ToolInvokeError):
         LocaltimeToTimestampTool.localtime_to_timestamp("bad", "%Y-%m-%d %H:%M:%S", "UTC")
 
diff --git a/api/tests/unit_tests/core/tools/utils/test_tool_engine_serialization.py b/api/tests/unit_tests/core/tools/utils/test_tool_engine_serialization.py
index 4029edfb686..da699ef6101 100644
--- a/api/tests/unit_tests/core/tools/utils/test_tool_engine_serialization.py
+++ b/api/tests/unit_tests/core/tools/utils/test_tool_engine_serialization.py
@@ -459,23 +459,24 @@ class TestEndToEndSerialization:
 
     def _verify_all_complex_types_converted(self, data):
         """Helper method to verify all complex types were properly converted"""
-        if isinstance(data, dict):
-            for key, value in data.items():
-                if key in ["id", "checksum"]:
-                    # These should be strings (UUID/bytes converted)
-                    assert isinstance(value, str)
-                elif key in ["created_at", "last_login", "timestamp", "uploaded_at"]:
-                    # These should be strings (datetime converted)
-                    assert isinstance(value, str)
-                elif key in ["total_time", "duration"]:
-                    # These should be floats (Decimal converted)
-                    assert isinstance(value, float)
-                elif key == "metrics":
-                    # This should be a list (ndarray converted)
-                    assert isinstance(value, list)
-                else:
-                    # Recursively check nested structures
-                    self._verify_all_complex_types_converted(value)
-        elif isinstance(data, list):
-            for item in data:
-                self._verify_all_complex_types_converted(item)
+        match data:
+            case dict():
+                for key, value in data.items():
+                    if key in ["id", "checksum"]:
+                        # These should be strings (UUID/bytes converted)
+                        assert isinstance(value, str)
+                    elif key in ["created_at", "last_login", "timestamp", "uploaded_at"]:
+                        # These should be strings (datetime converted)
+                        assert isinstance(value, str)
+                    elif key in ["total_time", "duration"]:
+                        # These should be floats (Decimal converted)
+                        assert isinstance(value, float)
+                    elif key == "metrics":
+                        # This should be a list (ndarray converted)
+                        assert isinstance(value, list)
+                    else:
+                        # Recursively check nested structures
+                        self._verify_all_complex_types_converted(value)
+            case list():
+                for item in data:
+                    self._verify_all_complex_types_converted(item)
diff --git a/api/tests/unit_tests/core/workflow/generator/test_runner.py b/api/tests/unit_tests/core/workflow/generator/test_runner.py
index 067fb1cf950..ec7a8f32dfc 100644
--- a/api/tests/unit_tests/core/workflow/generator/test_runner.py
+++ b/api/tests/unit_tests/core/workflow/generator/test_runner.py
@@ -413,7 +413,7 @@ class TestWorkflowGeneratorTransientRetry:
             }
         )
 
-    def test_retries_transient_invoke_error_then_succeeds(self, monkeypatch):
+    def test_retries_transient_invoke_error_then_succeeds(self, monkeypatch: pytest.MonkeyPatch):
         # The planner's first invoke raises a transient connection error; the
         # retry succeeds and the pipeline completes normally. Sleep is patched
         # out so the test doesn't actually wait for the backoff.
@@ -443,7 +443,7 @@ class TestWorkflowGeneratorTransientRetry:
         # planner (failed once + retried) + builder = 3 invocations total.
         assert model_instance.invoke_llm.call_count == 3
 
-    def test_gives_up_after_exhausting_transient_retries(self, monkeypatch):
+    def test_gives_up_after_exhausting_transient_retries(self, monkeypatch: pytest.MonkeyPatch):
         # Every attempt hits the transient error — once we exhaust the retry
         # budget the failure surfaces as a normal error envelope rather than
         # hanging or looping forever.
@@ -471,7 +471,7 @@ class TestWorkflowGeneratorTransientRetry:
 
         assert model_instance.invoke_llm.call_count == _INVOKE_MAX_ATTEMPTS
 
-    def test_does_not_retry_permanent_invoke_error(self, monkeypatch):
+    def test_does_not_retry_permanent_invoke_error(self, monkeypatch: pytest.MonkeyPatch):
         # An auth error is permanent — retrying just burns latency and quota.
         # The runner must fail on the first attempt.
         # If the code wrongly slept here we'd want the test to still be fast;
diff --git a/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_plugin_tools_builder.py b/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_plugin_tools_builder.py
index 1a2e09fd817..1ff87614b08 100644
--- a/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_plugin_tools_builder.py
+++ b/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_plugin_tools_builder.py
@@ -17,6 +17,7 @@ from core.tools.entities.tool_entities import (
     ToolInvokeMessage,
     ToolParameter,
 )
+from core.tools.tool_manager import ToolManager
 from core.workflow.nodes.agent_v2.plugin_tools_builder import (
     WorkflowAgentPluginToolsBuilder,
     WorkflowAgentPluginToolsBuildError,
@@ -32,6 +33,8 @@ class FakeRuntimeProvider:
         self.tool = tool
         self.last_agent_tool: AgentToolEntity | None = None
         self.last_invoke_from: InvokeFrom | None = None
+        self.last_allow_file_parameters: bool | None = None
+        self.last_use_default_for_missing_form_parameters: bool | None = None
 
     def get_agent_tool_runtime(
         self,
@@ -41,11 +44,25 @@ class FakeRuntimeProvider:
         user_id: str | None = None,
         invoke_from: InvokeFrom = InvokeFrom.DEBUGGER,
         variable_pool: Any | None = None,
+        allow_file_parameters: bool = False,
+        use_default_for_missing_form_parameters: bool = False,
     ) -> Tool:
         self.last_agent_tool = agent_tool
         self.last_invoke_from = invoke_from
+        self.last_allow_file_parameters = allow_file_parameters
+        self.last_use_default_for_missing_form_parameters = use_default_for_missing_form_parameters
         if isinstance(self.tool, Exception):
             raise self.tool
+        if self.tool.runtime is not None:
+            runtime_parameters = ToolManager._convert_tool_parameters_type(
+                self.tool.get_merged_runtime_parameters(),
+                variable_pool,
+                agent_tool.tool_parameters,
+                typ="agent",
+                allow_file_parameters=allow_file_parameters,
+                use_default_for_missing_form_parameters=use_default_for_missing_form_parameters,
+            )
+            self.tool.runtime.runtime_parameters.update(runtime_parameters)
         return self.tool
 
 
@@ -103,6 +120,67 @@ def _tool(*, runtime_parameters: dict[str, Any] | None = None) -> FakeTool:
     return FakeTool(entity=entity, runtime=runtime)
 
 
+def _file_tool() -> FakeTool:
+    parameters = [
+        ToolParameter(
+            name="audio_file",
+            label=I18nObject(en_US="Audio File"),
+            type=ToolParameter.ToolParameterType.FILE,
+            form=ToolParameter.ToolParameterForm.LLM,
+            required=True,
+            llm_description="The audio file to be converted.",
+        )
+    ]
+    entity = ToolEntity(
+        identity=ToolIdentity(
+            author="langgenius",
+            name="asr",
+            label=I18nObject(en_US="Speech To Text"),
+            provider="audio",
+        ),
+        description=ToolDescription(human=I18nObject(en_US="Speech To Text"), llm="Convert audio file to text."),
+        parameters=parameters,
+    )
+    runtime = ToolRuntime(tenant_id="tenant-1", user_id="user-1", credentials={}, runtime_parameters={})
+    return FakeTool(entity=entity, runtime=runtime)
+
+
+def _tts_tool() -> FakeTool:
+    parameters = [
+        ToolParameter(
+            name="text",
+            label=I18nObject(en_US="Text"),
+            type=ToolParameter.ToolParameterType.STRING,
+            form=ToolParameter.ToolParameterForm.LLM,
+            required=True,
+            llm_description="The text to be converted.",
+        ),
+        ToolParameter(
+            name="model",
+            label=I18nObject(en_US="Model"),
+            type=ToolParameter.ToolParameterType.SELECT,
+            form=ToolParameter.ToolParameterForm.FORM,
+            required=True,
+            options=[
+                {"value": "provider-a#model-a", "label": {"en_US": "model-a(provider-a)"}},
+                {"value": "provider-b#model-b", "label": {"en_US": "model-b(provider-b)"}},
+            ],
+        ),
+    ]
+    entity = ToolEntity(
+        identity=ToolIdentity(
+            author="langgenius",
+            name="tts",
+            label=I18nObject(en_US="Text To Speech"),
+            provider="audio",
+        ),
+        description=ToolDescription(human=I18nObject(en_US="Text To Speech"), llm="Convert text to audio file."),
+        parameters=parameters,
+    )
+    runtime = ToolRuntime(tenant_id="tenant-1", user_id="user-1", credentials={}, runtime_parameters={})
+    return FakeTool(entity=entity, runtime=runtime)
+
+
 def _build(
     builder: WorkflowAgentPluginToolsBuilder,
     tools: AgentSoulToolsConfig,
@@ -157,6 +235,62 @@ def test_builds_dify_plugin_tools_layer_from_existing_tool_runtime():
     assert runtime_provider.last_agent_tool.provider_type.value == "plugin"
 
 
+def test_builds_dify_plugin_tool_with_file_llm_parameter():
+    runtime_provider = FakeRuntimeProvider(_file_tool())
+    builder = WorkflowAgentPluginToolsBuilder(tool_runtime_provider=runtime_provider)
+    tools = AgentSoulToolsConfig.model_validate(
+        {
+            "dify_tools": [
+                {
+                    "provider_id": "audio",
+                    "provider_type": "builtin",
+                    "tool_name": "asr",
+                    "credential_type": "unauthorized",
+                }
+            ]
+        }
+    )
+
+    result = _build(builder, tools)
+
+    assert result is not None
+    prepared = result.tools[0]
+    assert prepared.tool_name == "asr"
+    assert prepared.runtime_parameters == {}
+    assert prepared.parameters[0].name == "audio_file"
+    assert prepared.parameters[0].type == "file"
+    # The public Agent backend DTO carries non-scalar tool inputs in
+    # ``parameters``; legacy JSON schema generation omits file fields.
+    assert prepared.parameters_json_schema == {"type": "object", "properties": {}, "required": []}
+    assert runtime_provider.last_allow_file_parameters is True
+    assert runtime_provider.last_use_default_for_missing_form_parameters is True
+
+
+def test_builds_dify_plugin_tool_with_missing_required_select_default():
+    runtime_provider = FakeRuntimeProvider(_tts_tool())
+    builder = WorkflowAgentPluginToolsBuilder(tool_runtime_provider=runtime_provider)
+    tools = AgentSoulToolsConfig.model_validate(
+        {
+            "dify_tools": [
+                {
+                    "provider_id": "audio",
+                    "provider_type": "builtin",
+                    "tool_name": "tts",
+                    "credential_type": "unauthorized",
+                }
+            ]
+        }
+    )
+
+    result = _build(builder, tools)
+
+    assert result is not None
+    prepared = result.tools[0]
+    assert prepared.tool_name == "tts"
+    assert prepared.runtime_parameters == {"model": "provider-a#model-a"}
+    assert runtime_provider.last_use_default_for_missing_form_parameters is True
+
+
 def test_rejects_duplicate_exposed_tool_names():
     builder = WorkflowAgentPluginToolsBuilder(tool_runtime_provider=FakeRuntimeProvider(_tool()))
     tools = AgentSoulToolsConfig.model_validate(
diff --git a/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py b/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py
index 3cd77f7f2ea..9313aea51e6 100644
--- a/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py
+++ b/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py
@@ -21,6 +21,9 @@ from models.agent import Agent, AgentConfigSnapshot, WorkflowAgentNodeBinding
 from models.agent_config_entities import (
     AgentSoulConfig,
     AgentSoulModelConfig,
+    DeclaredArrayItem,
+    DeclaredOutputChildConfig,
+    DeclaredOutputConfig,
     DeclaredOutputType,
     WorkflowNodeJobConfig,
 )
@@ -321,6 +324,7 @@ def test_build_shell_layer_config_accepts_legacy_fallback_keys():
                 "secret_refs": [
                     {"variable": "TOKEN", "credential_id": "credential-1"},
                     {"name": "API_KEY", "provider_credential_id": "credential-2"},
+                    {"name": "EDITABLE_TOKEN", "value": "credential-3"},
                     {"ref": "missing-name"},
                 ],
             },
@@ -341,6 +345,7 @@ def test_build_shell_layer_config_accepts_legacy_fallback_keys():
     assert config["secret_refs"] == [
         {"name": "TOKEN", "ref": "credential-1"},
         {"name": "API_KEY", "ref": "credential-2"},
+        {"name": "EDITABLE_TOKEN", "ref": "credential-3"},
     ]
     assert config["sandbox"] is None
 
@@ -491,6 +496,119 @@ def test_builds_workflow_run_request_with_dify_plugin_tools_layer():
     assert plugin_tools_builder.last_invoke_from == context.dify_context.invoke_from
 
 
+def test_build_maps_agent_soul_knowledge_to_knowledge_layer_config():
+    context = _context()
+    snapshot = AgentConfigSnapshot(
+        id="snapshot-1",
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        version=1,
+        config_snapshot=AgentSoulConfig.model_validate(
+            {
+                "prompt": {"system_prompt": "You are careful."},
+                "model": {
+                    "plugin_id": "langgenius/openai",
+                    "model_provider": "openai",
+                    "model": "gpt-test",
+                },
+                "knowledge": {
+                    "datasets": [{"id": "dataset-1"}, {"id": "  "}, {"id": "dataset-2"}],
+                    "query_config": {
+                        "top_k": 6,
+                        "score_threshold": 0.4,
+                        "score_threshold_enabled": True,
+                    },
+                },
+            }
+        ),
+    )
+    context = replace(context, snapshot=snapshot)
+
+    result = WorkflowAgentRuntimeRequestBuilder(credentials_provider=FakeCredentialsProvider()).build(context)
+
+    dumped = result.request.model_dump(mode="json")
+    layers = {layer["name"]: layer for layer in dumped["composition"]["layers"]}
+    knowledge_layer = layers["knowledge"]
+    assert knowledge_layer["type"] == "dify.knowledge_base"
+    assert knowledge_layer["deps"] == {"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID}
+    assert knowledge_layer["config"] == {
+        "dataset_ids": ["dataset-1", "dataset-2"],
+        "retrieval": {
+            "mode": "multiple",
+            "top_k": 6,
+            "score_threshold": 0.4,
+            "reranking_mode": "reranking_model",
+            "reranking_enable": True,
+            "reranking_model": None,
+            "weights": None,
+            "model": None,
+        },
+        "metadata_filtering": {"mode": "disabled", "metadata_model_config": None, "conditions": None},
+        "max_result_content_chars": 2000,
+        "max_observation_chars": 12000,
+    }
+
+
+def test_build_knowledge_layer_uses_stable_default_top_k_when_query_config_omits_it():
+    context = _context()
+    snapshot = AgentConfigSnapshot(
+        id="snapshot-1",
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        version=1,
+        config_snapshot=AgentSoulConfig.model_validate(
+            {
+                "prompt": {"system_prompt": "You are careful."},
+                "model": {
+                    "plugin_id": "langgenius/openai",
+                    "model_provider": "openai",
+                    "model": "gpt-test",
+                },
+                "knowledge": {
+                    "datasets": [{"id": "dataset-1"}],
+                    "query_config": {},
+                },
+            }
+        ),
+    )
+    context = replace(context, snapshot=snapshot)
+
+    result = WorkflowAgentRuntimeRequestBuilder(credentials_provider=FakeCredentialsProvider()).build(context)
+
+    dumped = result.request.model_dump(mode="json")
+    knowledge_layer = next(layer for layer in dumped["composition"]["layers"] if layer["name"] == "knowledge")
+    assert knowledge_layer["config"]["retrieval"]["top_k"] == 4
+
+
+def test_build_skips_knowledge_layer_when_agent_soul_has_no_valid_dataset_ids():
+    context = _context()
+    snapshot = AgentConfigSnapshot(
+        id="snapshot-1",
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        version=1,
+        config_snapshot=AgentSoulConfig.model_validate(
+            {
+                "prompt": {"system_prompt": "You are careful."},
+                "model": {
+                    "plugin_id": "langgenius/openai",
+                    "model_provider": "openai",
+                    "model": "gpt-test",
+                },
+                "knowledge": {
+                    "datasets": [{"id": "  "}, {}],
+                },
+            }
+        ),
+    )
+    context = replace(context, snapshot=snapshot)
+
+    result = WorkflowAgentRuntimeRequestBuilder(credentials_provider=FakeCredentialsProvider()).build(context)
+
+    dumped = result.request.model_dump(mode="json")
+    assert all(layer["name"] != "knowledge" for layer in dumped["composition"]["layers"])
+
+
 def test_build_passes_saved_session_snapshot_to_agent_backend_request():
     session_snapshot = CompositorSessionSnapshot(layers=[])
     context = replace(_context(), session_snapshot=session_snapshot)
@@ -630,6 +748,40 @@ def test_array_output_emits_typed_items_per_array_item():
     assert output_schema["required"] == ["tags"]
 
 
+def test_nested_declared_output_emits_object_and_array_child_schema():
+    profile_output = DeclaredOutputConfig(
+        name="profile",
+        type=DeclaredOutputType.OBJECT,
+        children=[
+            DeclaredOutputChildConfig(name="email", type=DeclaredOutputType.STRING),
+            DeclaredOutputChildConfig(
+                name="nickname",
+                type=DeclaredOutputType.STRING,
+                required=False,
+                description="Optional display name",
+            ),
+            DeclaredOutputChildConfig(
+                name="addresses",
+                type=DeclaredOutputType.ARRAY,
+                array_item=DeclaredArrayItem(
+                    type=DeclaredOutputType.OBJECT,
+                    description="Address item",
+                    children=[DeclaredOutputChildConfig(name="city", type=DeclaredOutputType.STRING)],
+                ),
+            ),
+        ],
+    )
+
+    schema = WorkflowAgentRuntimeRequestBuilder._schema_for_declared_output(profile_output)
+
+    assert schema["properties"]["email"] == {"type": "string"}
+    assert schema["properties"]["nickname"] == {"type": "string", "description": "Optional display name"}
+    assert schema["properties"]["addresses"]["items"]["properties"]["city"] == {"type": "string"}
+    assert schema["properties"]["addresses"]["items"]["description"] == "Address item"
+    assert schema["properties"]["addresses"]["items"]["required"] == ["city"]
+    assert schema["required"] == ["email", "addresses"]
+
+
 def test_effective_declared_outputs_passthrough_when_user_declared():
     """effective_declared_outputs() must return user-provided outputs verbatim
     when non-empty; only empty input gets PRD defaults injected."""
@@ -829,3 +981,36 @@ def test_feature_manifest_marks_human_supported_when_configured():
     assert manifest["reserved_status"]["human"] == "supported_by_ask_human_hitl"
     # configured human no longer produces a "not executed" warning
     assert all("human" not in w["section"] for w in manifest["unsupported_runtime_warnings"])
+
+
+def test_feature_manifest_marks_knowledge_supported_without_warning_when_configured():
+    from core.workflow.nodes.agent_v2.runtime_feature_manifest import build_runtime_feature_manifest
+
+    soul = AgentSoulConfig.model_validate(
+        {
+            "knowledge": {
+                "datasets": [{"id": "dataset-1", "name": "Product Docs"}],
+            }
+        }
+    )
+
+    manifest = build_runtime_feature_manifest(soul)
+    assert "knowledge" in manifest["supported"]
+    assert "knowledge" not in manifest["reserved"]
+    assert manifest["reserved_status"]["knowledge"] == "supported_by_knowledge_layer"
+    assert all("knowledge" not in w["section"] for w in manifest["unsupported_runtime_warnings"])
+
+
+def test_feature_manifest_treats_blank_knowledge_dataset_ids_as_not_configured():
+    from core.workflow.nodes.agent_v2.runtime_feature_manifest import build_runtime_feature_manifest
+
+    soul = AgentSoulConfig.model_validate(
+        {
+            "knowledge": {
+                "datasets": [{"id": "  "}, {}],
+            }
+        }
+    )
+
+    manifest = build_runtime_feature_manifest(soul)
+    assert manifest["reserved_status"]["knowledge"] == "not_configured"
diff --git a/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_session_cleanup_layer.py b/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_session_cleanup_layer.py
index bb7947ce656..67e7bfafca7 100644
--- a/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_session_cleanup_layer.py
+++ b/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_session_cleanup_layer.py
@@ -315,7 +315,7 @@ def test_cleanup_layer_fans_out_to_every_active_session():
     assert {entry[1] for entry in session_store.cleaned} == {"cleanup-run-many"}
 
 
-def test_cleanup_layer_warns_when_http_enabled_but_client_missing(caplog):
+def test_cleanup_layer_warns_when_http_enabled_but_client_missing(caplog: pytest.LogCaptureFixture):
     """The HTTP cleanup branch must defensively skip when no client was wired.
 
     This is the deployment-misconfig path: ``_HTTP_CLEANUP_SUPPORTED`` was
@@ -347,7 +347,7 @@ def test_cleanup_layer_warns_when_http_enabled_but_client_missing(caplog):
     assert any("no agent backend client is wired in" in record.message for record in caplog.records)
 
 
-def test_cleanup_layer_skips_workflow_terminal_when_workflow_run_id_missing(caplog):
+def test_cleanup_layer_skips_workflow_terminal_when_workflow_run_id_missing(caplog: pytest.LogCaptureFixture):
     """``workflow_run_id`` is the keying field; without it the fanout cannot
     target a row, so the layer logs a warning and bails."""
     import logging
diff --git a/api/tests/unit_tests/core/workflow/nodes/llm/test_node.py b/api/tests/unit_tests/core/workflow/nodes/llm/test_node.py
index 909de623d82..79581cc8811 100644
--- a/api/tests/unit_tests/core/workflow/nodes/llm/test_node.py
+++ b/api/tests/unit_tests/core/workflow/nodes/llm/test_node.py
@@ -1396,7 +1396,7 @@ class TestSaveMultimodalOutputAndConvertResultToMarkdown:
         mock_file_saver.save_binary_string.assert_not_called()
         mock_file_saver.save_remote_url.assert_not_called()
 
-    def test_unknown_item_type(self, llm_node_for_multimodal, caplog):
+    def test_unknown_item_type(self, llm_node_for_multimodal, caplog: pytest.LogCaptureFixture):
         llm_node, mock_file_saver = llm_node_for_multimodal
         unknown_item = self._UnknownItem()
 
diff --git a/api/tests/unit_tests/core/workflow/test_human_input_adapter.py b/api/tests/unit_tests/core/workflow/test_human_input_adapter.py
index 51049f87923..7a6328ffb4b 100644
--- a/api/tests/unit_tests/core/workflow/test_human_input_adapter.py
+++ b/api/tests/unit_tests/core/workflow/test_human_input_adapter.py
@@ -332,7 +332,9 @@ def test_email_delivery_method_extracts_variable_selectors() -> None:
     assert method.extract_variable_selectors() == [["start", "name"]]
 
 
-def test_email_delivery_method_extracts_variable_selectors_skips_short_selectors(monkeypatch) -> None:
+def test_email_delivery_method_extracts_variable_selectors_skips_short_selectors(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
     method = EmailDeliveryMethod(
         enabled=True,
         config=EmailDeliveryConfig(
diff --git a/api/tests/unit_tests/core/workflow/test_node_factory.py b/api/tests/unit_tests/core/workflow/test_node_factory.py
index bd18402c583..0baee47665c 100644
--- a/api/tests/unit_tests/core/workflow/test_node_factory.py
+++ b/api/tests/unit_tests/core/workflow/test_node_factory.py
@@ -1,18 +1,26 @@
 from collections.abc import Mapping
 from types import SimpleNamespace
-from unittest.mock import MagicMock, patch, sentinel
+from unittest.mock import MagicMock, Mock, patch, sentinel
 
 import pytest
 
 from core.app.entities.app_invoke_entities import DIFY_RUN_CONTEXT_KEY, DifyRunContext, InvokeFrom, UserFrom
+from core.plugin.impl.model import PluginModelClient
+from core.plugin.impl.model_runtime import PluginModelRuntime
+from core.plugin.plugin_service import PluginService
 from core.workflow import node_factory
 from core.workflow import template_rendering as workflow_template_rendering
+from core.workflow.node_runtime import DifyPreparedLLM
 from core.workflow.nodes.knowledge_index import KNOWLEDGE_INDEX_NODE_TYPE
 from graphon.entities.base_node_data import BaseNodeData
 from graphon.enums import BuiltinNodeTypes, NodeType
+from graphon.model_runtime.entities.common_entities import I18nObject
+from graphon.model_runtime.entities.model_entities import AIModelEntity, FetchFrom, ModelFeature, ModelType
+from graphon.model_runtime.model_providers.base.large_language_model import LargeLanguageModel
 from graphon.nodes.code.entities import CodeLanguage
 from graphon.nodes.llm.entities import LLMNodeData
 from graphon.nodes.llm.node import LLMNode
+from graphon.nodes.llm.runtime_protocols import LLMPollingCapableProtocol
 from graphon.nodes.parameter_extractor.entities import ParameterExtractorNodeData
 from graphon.variables.segments import ArrayObjectSegment, StringSegment
 
@@ -35,6 +43,41 @@ def _node_constructor(*, return_value):
     return constructor
 
 
+def _build_llm_model_schema(*, features: list[ModelFeature] | None = None) -> AIModelEntity:
+    return AIModelEntity(
+        model="model",
+        label=I18nObject(en_US="Model"),
+        model_type=ModelType.LLM,
+        fetch_from=FetchFrom.PREDEFINED_MODEL,
+        model_properties={},
+        features=features,
+    )
+
+
+class _ModelTypeInstanceStub(LargeLanguageModel):
+    def __init__(self, *, model_runtime: object) -> None:
+        self.model_runtime = model_runtime
+
+
+class _ModelInstanceStub:
+    def __init__(
+        self,
+        *,
+        model_runtime: object,
+        model_schema: AIModelEntity,
+    ) -> None:
+        self.provider = "langgenius/openai/openai"
+        self.model_name = "model"
+        self.credentials = {"api_key": "secret"}
+        self.parameters = {}
+        self.stop = ()
+        self.model_type_instance = _ModelTypeInstanceStub(model_runtime=model_runtime)
+        self._model_schema = model_schema
+
+    def get_model_schema(self) -> AIModelEntity:
+        return self._model_schema
+
+
 class TestResolveWorkflowNodeClass:
     def test_matching_version_uses_registry_mapping(self, monkeypatch) -> None:
         document_extractor_class = sentinel.document_extractor_class
@@ -667,7 +710,7 @@ class TestDifyNodeFactoryCreateNode:
         memory = sentinel.memory
         factory._build_model_instance_for_llm_node = MagicMock(return_value=sentinel.model_instance)
         factory._build_memory_for_llm_node = MagicMock(return_value=memory)
-        with patch.object(node_factory, "DifyPreparedLLM", return_value=wrapped_model_instance) as prepared_llm:
+        with patch.object(factory, "_wrap_model_instance_for_node", return_value=wrapped_model_instance) as wrap_model:
             kwargs = factory._build_llm_compatible_node_init_kwargs(
                 node_class=sentinel.node_class,
                 node_data=node_data,
@@ -686,9 +729,70 @@ class TestDifyNodeFactoryCreateNode:
             node_data=node_data,
             model_instance=sentinel.model_instance,
         )
-        prepared_llm.assert_called_once_with(sentinel.model_instance)
+        wrap_model.assert_called_once_with(
+            node_data=node_data,
+            model_instance=sentinel.model_instance,
+        )
         assert kwargs["model_instance"] is wrapped_model_instance
 
+    def test_build_llm_compatible_node_init_kwargs_uses_polling_wrapper_for_polling_llm_node(self, factory):
+        node_data = LLMNodeData.model_validate(
+            {
+                "type": BuiltinNodeTypes.LLM,
+                "title": "LLM",
+                "model": {"provider": "provider", "name": "model", "mode": "chat", "completion_params": {}},
+                "prompt_template": [{"role": "system", "text": "x"}],
+                "context": {"enabled": False, "variable_selector": []},
+                "vision": {"enabled": False},
+            }
+        )
+        plugin_runtime = PluginModelRuntime(
+            tenant_id="tenant-id",
+            user_id="user-id",
+            client=Mock(spec=PluginModelClient),
+            plugin_service=PluginService,
+        )
+        model_instance = _ModelInstanceStub(
+            model_runtime=plugin_runtime,
+            model_schema=_build_llm_model_schema(features=[ModelFeature.POLLING]),
+        )
+        factory._build_model_instance_for_llm_node = MagicMock(return_value=model_instance)
+        factory._build_memory_for_llm_node = MagicMock(return_value=sentinel.memory)
+
+        kwargs = factory._build_llm_compatible_node_init_kwargs(
+            node_class=sentinel.node_class,
+            node_data=node_data,
+            wrap_model_instance=True,
+            include_http_client=False,
+            include_llm_file_saver=False,
+            include_prompt_message_serializer=False,
+            include_retriever_attachment_loader=False,
+            include_jinja2_template_renderer=False,
+        )
+
+        assert isinstance(kwargs["model_instance"], LLMPollingCapableProtocol)
+
+    @pytest.mark.parametrize("node_type", [BuiltinNodeTypes.QUESTION_CLASSIFIER, BuiltinNodeTypes.PARAMETER_EXTRACTOR])
+    def test_wrap_model_instance_keeps_non_llm_graph_nodes_on_plain_wrapper(self, node_type):
+        plugin_runtime = PluginModelRuntime(
+            tenant_id="tenant-id",
+            user_id="user-id",
+            client=Mock(spec=PluginModelClient),
+            plugin_service=PluginService,
+        )
+        model_instance = _ModelInstanceStub(
+            model_runtime=plugin_runtime,
+            model_schema=_build_llm_model_schema(features=[ModelFeature.POLLING]),
+        )
+
+        wrapped = node_factory.DifyNodeFactory._wrap_model_instance_for_node(
+            node_data=SimpleNamespace(type=node_type),
+            model_instance=model_instance,
+        )
+
+        assert type(wrapped) is DifyPreparedLLM
+        assert not isinstance(wrapped, LLMPollingCapableProtocol)
+
     def test_create_node_passes_alias_preserving_llm_data_to_constructor(self, monkeypatch, factory):
         created_node = object()
         constructor = _node_constructor(return_value=created_node)
diff --git a/api/tests/unit_tests/core/workflow/test_node_runtime.py b/api/tests/unit_tests/core/workflow/test_node_runtime.py
index bdccea478d9..b32b9f74df7 100644
--- a/api/tests/unit_tests/core/workflow/test_node_runtime.py
+++ b/api/tests/unit_tests/core/workflow/test_node_runtime.py
@@ -7,6 +7,10 @@ import pytest
 from core.app.entities.app_invoke_entities import DIFY_RUN_CONTEXT_KEY, DifyRunContext, InvokeFrom, UserFrom
 from core.app.file_access import FileAccessScope, bind_file_access_scope, grant_retriever_segment_access
 from core.llm_generator.output_parser.errors import OutputParserError
+from core.plugin.impl.exc import PluginLLMPollingUnsupportedError
+from core.plugin.impl.model import PluginModelClient
+from core.plugin.impl.model_runtime import PluginModelRuntime
+from core.plugin.plugin_service import PluginService
 from core.workflow import node_runtime
 from core.workflow.file_reference import parse_file_reference
 from core.workflow.human_input_adapter import (
@@ -21,6 +25,7 @@ from core.workflow.node_runtime import (
     DifyFileReferenceFactory,
     DifyHumanInputNodeRuntime,
     DifyPreparedLLM,
+    DifyPreparedPollingLLM,
     DifyPromptMessageSerializer,
     DifyRetrieverAttachmentLoader,
     DifyToolFileManager,
@@ -31,23 +36,61 @@ from core.workflow.node_runtime import (
 )
 from graphon.file import File, FileTransferMethod, FileType
 from graphon.model_runtime.entities.common_entities import I18nObject
-from graphon.model_runtime.entities.model_entities import AIModelEntity, FetchFrom, ModelType
+from graphon.model_runtime.entities.llm_entities import LLMPollingResult, LLMPollingStatus
+from graphon.model_runtime.entities.message_entities import AssistantPromptMessage
+from graphon.model_runtime.entities.model_entities import AIModelEntity, FetchFrom, ModelFeature, ModelType
+from graphon.model_runtime.model_providers.base.large_language_model import LargeLanguageModel
 from graphon.nodes.human_input.entities import FileInputConfig, FileListInputConfig, HumanInputNodeData
+from graphon.nodes.llm.runtime_protocols import LLMPollingCapableProtocol
 from graphon.nodes.tool.entities import ToolNodeData, ToolProviderType
 from graphon.variables.segments import ArrayFileSegment, FileSegment
 from tests.workflow_test_utils import build_test_run_context
 
 
-def _build_model_schema() -> AIModelEntity:
+def _build_model_schema(*, features: list[ModelFeature] | None = None) -> AIModelEntity:
     return AIModelEntity(
         model="gpt-4o-mini",
         label=I18nObject(en_US="GPT-4o mini"),
         model_type=ModelType.LLM,
         fetch_from=FetchFrom.PREDEFINED_MODEL,
         model_properties={},
+        features=features,
     )
 
 
+class _ModelTypeInstanceStub(LargeLanguageModel):
+    def __init__(
+        self,
+        *,
+        model_schema: AIModelEntity | None,
+        model_runtime: object | None = None,
+    ) -> None:
+        self.model_runtime = model_runtime
+        self.get_model_schema = Mock(return_value=model_schema)
+
+
+class _ModelInstanceStub:
+    def __init__(
+        self,
+        *,
+        model_schema: AIModelEntity | None,
+        model_runtime: object | None = None,
+        invoke_llm_result: object = sentinel.result,
+        get_llm_num_tokens_result: int = 32,
+    ) -> None:
+        self.provider = "langgenius/openai/openai"
+        self.model_name = "gpt-4o-mini"
+        self.parameters = {"temperature": 0.2}
+        self.stop = ("stop",)
+        self.credentials = {"api_key": "secret"}
+        self.model_type_instance = _ModelTypeInstanceStub(
+            model_schema=model_schema,
+            model_runtime=model_runtime,
+        )
+        self.get_llm_num_tokens = Mock(return_value=get_llm_num_tokens_result)
+        self.invoke_llm = Mock(return_value=invoke_llm_result)
+
+
 def _build_run_context(*, invoke_from: InvokeFrom | str = InvokeFrom.DEBUGGER) -> dict[str, object]:
     return build_test_run_context(
         tenant_id="tenant-id",
@@ -126,17 +169,8 @@ def test_dify_file_reference_factory_passes_tenant_id(monkeypatch: pytest.Monkey
 
 def test_dify_prepared_llm_wraps_model_instance_calls() -> None:
     model_schema = _build_model_schema()
-    model_type_instance = SimpleNamespace(get_model_schema=Mock(return_value=model_schema))
-    model_instance = SimpleNamespace(
-        provider="langgenius/openai/openai",
-        model_name="gpt-4o-mini",
-        parameters={"temperature": 0.2},
-        stop=("stop",),
-        credentials={"api_key": "secret"},
-        model_type_instance=model_type_instance,
-        get_llm_num_tokens=Mock(return_value=32),
-        invoke_llm=Mock(return_value=sentinel.result),
-    )
+    model_instance = _ModelInstanceStub(model_schema=model_schema)
+    model_type_instance = model_instance.model_type_instance
     prepared = DifyPreparedLLM(model_instance)
 
     assert prepared.provider == "langgenius/openai/openai"
@@ -167,11 +201,8 @@ def test_dify_prepared_llm_wraps_model_instance_calls() -> None:
 
 
 def test_dify_prepared_llm_requires_model_schema() -> None:
-    model_instance = SimpleNamespace(
-        model_name="gpt-4o-mini",
-        credentials={},
-        model_type_instance=SimpleNamespace(get_model_schema=Mock(return_value=None)),
-    )
+    model_instance = _ModelInstanceStub(model_schema=None)
+    model_instance.credentials = {}
     prepared = DifyPreparedLLM(model_instance)
 
     with pytest.raises(ValueError, match="Model schema not found"):
@@ -179,12 +210,7 @@ def test_dify_prepared_llm_requires_model_schema() -> None:
 
 
 def test_dify_prepared_llm_delegates_structured_output_helper(monkeypatch: pytest.MonkeyPatch) -> None:
-    model_instance = SimpleNamespace(
-        provider="langgenius/openai/openai",
-        model_name="gpt-4o-mini",
-        credentials={"api_key": "secret"},
-        model_type_instance=SimpleNamespace(get_model_schema=Mock(return_value=_build_model_schema())),
-    )
+    model_instance = _ModelInstanceStub(model_schema=_build_model_schema())
     prepared = DifyPreparedLLM(model_instance)
     invoke_structured = MagicMock(return_value=sentinel.structured)
     monkeypatch.setattr(node_runtime, "invoke_llm_with_structured_output", invoke_structured)
@@ -217,6 +243,94 @@ def test_dify_prepared_llm_identifies_structured_output_errors() -> None:
     assert prepared.is_structured_output_parse_error(ValueError("other")) is False
 
 
+def test_dify_prepared_polling_llm_delegates_to_plugin_runtime() -> None:
+    polling_result = LLMPollingResult(
+        status=LLMPollingStatus.RUNNING,
+        plugin_state={"task_id": "poll-1"},
+        next_check_after_seconds=2,
+    )
+    plugin_runtime = PluginModelRuntime(
+        tenant_id="tenant-id",
+        user_id="user-id",
+        client=Mock(spec=PluginModelClient),
+        plugin_service=PluginService,
+    )
+    plugin_runtime.start_llm_polling = Mock(return_value=polling_result)  # type: ignore[method-assign]
+    plugin_runtime.check_llm_polling = Mock(return_value=polling_result)  # type: ignore[method-assign]
+    model_instance = _ModelInstanceStub(
+        model_schema=_build_model_schema(features=[ModelFeature.POLLING]),
+        model_runtime=plugin_runtime,
+    )
+
+    prepared = DifyPreparedPollingLLM(model_instance)
+
+    assert isinstance(prepared, LLMPollingCapableProtocol)
+    assert (
+        prepared.start_llm_polling(
+            prompt_messages=[],
+            model_parameters={"temperature": 0.1},
+            tools=[],
+            stop=("END",),
+            json_schema={"type": "object"},
+        )
+        == polling_result
+    )
+    assert (
+        prepared.check_llm_polling(
+            plugin_state={"task_id": "poll-1"},
+        )
+        == polling_result
+    )
+    plugin_runtime.start_llm_polling.assert_called_once_with(
+        provider="langgenius/openai/openai",
+        model="gpt-4o-mini",
+        credentials={"api_key": "secret"},
+        prompt_messages=[],
+        model_parameters={"temperature": 0.1},
+        tools=[],
+        stop=("END",),
+        json_schema={"type": "object"},
+    )
+    plugin_runtime.check_llm_polling.assert_called_once_with(
+        provider="langgenius/openai/openai",
+        model="gpt-4o-mini",
+        credentials={"api_key": "secret"},
+        plugin_state={"task_id": "poll-1"},
+    )
+
+
+def test_dify_prepared_polling_llm_raise_exception_when_polling_is_unsupported() -> None:
+    llm_result = node_runtime.LLMResult(
+        model="gpt-4o-mini",
+        prompt_messages=[],
+        message=AssistantPromptMessage(content="sync-result"),
+        usage=node_runtime.LLMUsage.empty_usage(),
+    )
+    plugin_runtime = PluginModelRuntime(
+        tenant_id="tenant-id",
+        user_id="user-id",
+        client=Mock(),
+        plugin_service=Mock(),
+    )
+    plugin_runtime.start_llm_polling = Mock(side_effect=PluginLLMPollingUnsupportedError("Polling unsupported"))  # type: ignore[method-assign]
+    model_instance = _ModelInstanceStub(
+        model_schema=_build_model_schema(features=[ModelFeature.POLLING]),
+        model_runtime=plugin_runtime,
+        invoke_llm_result=llm_result,
+    )
+
+    prepared = DifyPreparedPollingLLM(model_instance)
+
+    with pytest.raises(PluginLLMPollingUnsupportedError):
+        prepared.start_llm_polling(
+            prompt_messages=[],
+            model_parameters={"temperature": 0.1},
+            tools=None,
+            stop=None,
+            json_schema=None,
+        )
+
+
 def test_dify_prompt_message_serializer_delegates(monkeypatch: pytest.MonkeyPatch) -> None:
     serialize = MagicMock(return_value={"prompt": "value"})
     monkeypatch.setattr(node_runtime.PromptMessageUtil, "prompt_messages_to_prompt_for_saving", serialize)
diff --git a/api/tests/unit_tests/enterprise/telemetry/test_exporter.py b/api/tests/unit_tests/enterprise/telemetry/test_exporter.py
index 6bdae139237..674a2026131 100644
--- a/api/tests/unit_tests/enterprise/telemetry/test_exporter.py
+++ b/api/tests/unit_tests/enterprise/telemetry/test_exporter.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 from datetime import UTC, datetime
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
@@ -88,11 +89,10 @@ def test_api_key_and_custom_headers_merge(mock_metric_exporter: MagicMock, mock_
     assert ("x-custom", "foo") in headers
 
 
-@patch("enterprise.telemetry.exporter.logger")
 @patch("enterprise.telemetry.exporter.GRPCSpanExporter")
 @patch("enterprise.telemetry.exporter.GRPCMetricExporter")
 def test_api_key_overrides_conflicting_header(
-    mock_metric_exporter: MagicMock, mock_span_exporter: MagicMock, mock_logger: MagicMock
+    mock_metric_exporter: MagicMock, mock_span_exporter: MagicMock, caplog
 ) -> None:
     """Test that API key overrides conflicting authorization header and logs warning."""
     mock_config = SimpleNamespace(
@@ -105,7 +105,8 @@ def test_api_key_overrides_conflicting_header(
         ENTERPRISE_OTLP_API_KEY="test-key",
     )
 
-    EnterpriseExporter(mock_config)
+    with caplog.at_level(logging.WARNING, logger="enterprise.telemetry.exporter"):
+        EnterpriseExporter(mock_config)
 
     # Verify Bearer header takes precedence
     assert mock_span_exporter.call_args is not None
@@ -116,11 +117,8 @@ def test_api_key_overrides_conflicting_header(
     assert ("authorization", "Basic old") not in headers
 
     # Verify warning was logged
-    mock_logger.warning.assert_called_once()
-    assert mock_logger.warning.call_args is not None
-    warning_message = mock_logger.warning.call_args[0][0]
-    assert "ENTERPRISE_OTLP_API_KEY is set" in warning_message
-    assert "authorization" in warning_message
+    assert "ENTERPRISE_OTLP_API_KEY is set" in caplog.text
+    assert "authorization" in caplog.text
 
 
 @patch("enterprise.telemetry.exporter.GRPCSpanExporter")
@@ -535,33 +533,33 @@ def test_export_span_cross_workflow_parent_context() -> None:
     assert kwargs["context"] is not None
 
 
-@patch("enterprise.telemetry.exporter.logger")
-def test_export_span_logs_exception_on_error(mock_logger: MagicMock) -> None:
+def test_export_span_logs_exception_on_error(caplog) -> None:
     """If the span block raises, the exception is logged and context is still cleared."""
     exporter, mock_tracer, mock_span = _make_exporter_with_mock_tracer()
 
     mock_tracer.start_as_current_span.side_effect = RuntimeError("boom")
 
-    exporter.export_span(name="bad.span", attributes={})  # must not raise
+    with caplog.at_level(logging.ERROR, logger="enterprise.telemetry.exporter"):
+        exporter.export_span(name="bad.span", attributes={})  # must not raise
 
-    mock_logger.exception.assert_called_once()
-    assert "bad.span" in mock_logger.exception.call_args[0][1]
+    assert "Failed to export span" in caplog.text
+    assert "bad.span" in caplog.text
 
 
-@patch("enterprise.telemetry.exporter.logger")
-def test_export_span_invalid_trace_correlation_logs_warning(mock_logger: MagicMock) -> None:
+def test_export_span_invalid_trace_correlation_logs_warning(caplog) -> None:
     """Invalid UUID for trace_correlation_override triggers a warning log."""
     exporter, mock_tracer, mock_span = _make_exporter_with_mock_tracer()
 
     parent_uid = "987fbc97-4bed-5078-9f07-9141ba07c9f3"
-    exporter.export_span(
-        name="link.span",
-        attributes={},
-        correlation_id="not-a-valid-uuid",
-        parent_span_id_source=parent_uid,
-    )
+    with caplog.at_level(logging.WARNING, logger="enterprise.telemetry.exporter"):
+        exporter.export_span(
+            name="link.span",
+            attributes={},
+            correlation_id="not-a-valid-uuid",
+            parent_span_id_source=parent_uid,
+        )
 
-    mock_logger.warning.assert_called()
+    assert "Invalid trace correlation UUID for cross-workflow link" in caplog.text
 
 
 # ---------------------------------------------------------------------------
diff --git a/api/tests/unit_tests/enterprise/telemetry/test_metric_handler.py b/api/tests/unit_tests/enterprise/telemetry/test_metric_handler.py
index 56c42a57d5d..9a04841e390 100644
--- a/api/tests/unit_tests/enterprise/telemetry/test_metric_handler.py
+++ b/api/tests/unit_tests/enterprise/telemetry/test_metric_handler.py
@@ -222,7 +222,7 @@ def test_idempotency_first_seen(sample_envelope, mock_redis):
     )
 
 
-def test_idempotency_redis_failure_fails_open(sample_envelope, mock_redis, caplog):
+def test_idempotency_redis_failure_fails_open(sample_envelope, mock_redis, caplog: pytest.LogCaptureFixture):
     mock_redis.set.side_effect = Exception("Redis unavailable")
 
     handler = EnterpriseMetricHandler()
diff --git a/api/tests/unit_tests/enterprise/telemetry/test_telemetry_log.py b/api/tests/unit_tests/enterprise/telemetry/test_telemetry_log.py
index 0edd0ace27e..791c665d93c 100644
--- a/api/tests/unit_tests/enterprise/telemetry/test_telemetry_log.py
+++ b/api/tests/unit_tests/enterprise/telemetry/test_telemetry_log.py
@@ -2,8 +2,10 @@
 
 from __future__ import annotations
 
+import logging
 import uuid
-from unittest.mock import MagicMock, patch
+
+import pytest
 
 # ---------------------------------------------------------------------------
 # compute_trace_id_hex
@@ -135,134 +137,128 @@ class TestEmitTelemetryLog:
         compute_trace_id_hex.cache_clear()
         compute_span_id_hex.cache_clear()
 
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_logs_info_with_event_name_and_signal(self, mock_logger: MagicMock) -> None:
+    def test_logs_info_with_event_name_and_signal(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(
+                event_name="dify.workflow.run",
+                attributes={"tenant_id": "t1"},
+                signal="metric_only",
+            )
 
-        emit_telemetry_log(
-            event_name="dify.workflow.run",
-            attributes={"tenant_id": "t1"},
-            signal="metric_only",
-        )
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert record.levelno == logging.INFO
+        assert record.getMessage() == "telemetry.metric_only"
+        assert hasattr(record, "attributes")
+        assert record.attributes["dify.event.name"] == "dify.workflow.run"
+        assert record.attributes["dify.event.signal"] == "metric_only"
+        assert record.attributes["tenant_id"] == "t1"
 
-        mock_logger.info.assert_called_once()
-        args, kwargs = mock_logger.info.call_args
-        assert args[0] == "telemetry.%s"
-        assert args[1] == "metric_only"
-        extra = kwargs["extra"]
-        assert extra["attributes"]["dify.event.name"] == "dify.workflow.run"
-        assert extra["attributes"]["dify.event.signal"] == "metric_only"
-
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_no_log_when_info_disabled(self, mock_logger: MagicMock) -> None:
+    def test_no_log_when_info_disabled(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = False
+        with caplog.at_level(logging.WARNING, logger="dify.telemetry"):
+            emit_telemetry_log(event_name="dify.workflow.run", attributes={})
 
-        emit_telemetry_log(event_name="dify.workflow.run", attributes={})
+        assert len(caplog.records) == 0
 
-        mock_logger.info.assert_not_called()
-
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_trace_id_added_to_extra_when_valid_uuid(self, mock_logger: MagicMock) -> None:
+    def test_trace_id_added_to_extra_when_valid_uuid(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
         uid = "123e4567-e89b-12d3-a456-426614174000"
 
-        emit_telemetry_log(event_name="test.event", attributes={}, trace_id_source=uid)
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(event_name="test.event", attributes={}, trace_id_source=uid)
 
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert "trace_id" in extra
-        assert len(extra["trace_id"]) == 32
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert hasattr(record, "trace_id")
+        assert len(record.trace_id) == 32
 
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_trace_id_absent_when_invalid_source(self, mock_logger: MagicMock) -> None:
+    def test_trace_id_absent_when_invalid_source(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(event_name="test.event", attributes={}, trace_id_source="bad-id")
 
-        emit_telemetry_log(event_name="test.event", attributes={}, trace_id_source="bad-id")
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert not hasattr(record, "trace_id")
 
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert "trace_id" not in extra
-
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_span_id_added_to_extra_when_valid_uuid(self, mock_logger: MagicMock) -> None:
+    def test_span_id_added_to_extra_when_valid_uuid(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
         uid = "123e4567-e89b-12d3-a456-426614174000"
 
-        emit_telemetry_log(event_name="test.event", attributes={}, span_id_source=uid)
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(event_name="test.event", attributes={}, span_id_source=uid)
 
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert "span_id" in extra
-        assert len(extra["span_id"]) == 16
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert hasattr(record, "span_id")
+        assert len(record.span_id) == 16
 
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_tenant_id_added_when_provided(self, mock_logger: MagicMock) -> None:
+    def test_tenant_id_added_when_provided(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(event_name="test.event", attributes={}, tenant_id="tenant-99")
 
-        emit_telemetry_log(event_name="test.event", attributes={}, tenant_id="tenant-99")
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert hasattr(record, "tenant_id")
+        assert record.tenant_id == "tenant-99"
 
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert extra["tenant_id"] == "tenant-99"
-
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_user_id_added_when_provided(self, mock_logger: MagicMock) -> None:
+    def test_user_id_added_when_provided(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(event_name="test.event", attributes={}, user_id="user-42")
 
-        emit_telemetry_log(event_name="test.event", attributes={}, user_id="user-42")
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert hasattr(record, "user_id")
+        assert record.user_id == "user-42"
 
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert extra["user_id"] == "user-42"
-
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_tenant_and_user_id_absent_when_not_provided(self, mock_logger: MagicMock) -> None:
+    def test_tenant_and_user_id_absent_when_not_provided(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(event_name="test.event", attributes={})
 
-        emit_telemetry_log(event_name="test.event", attributes={})
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert not hasattr(record, "tenant_id")
+        assert not hasattr(record, "user_id")
 
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert "tenant_id" not in extra
-        assert "user_id" not in extra
-
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_caller_attributes_merged_into_attrs(self, mock_logger: MagicMock) -> None:
+    def test_caller_attributes_merged_into_attrs(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(
+                event_name="dify.node.run",
+                attributes={"node_type": "code", "elapsed": 0.5},
+            )
 
-        emit_telemetry_log(
-            event_name="dify.node.run",
-            attributes={"node_type": "code", "elapsed": 0.5},
-        )
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert hasattr(record, "attributes")
+        assert record.attributes["node_type"] == "code"
+        assert record.attributes["elapsed"] == 0.5
 
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert extra["attributes"]["node_type"] == "code"
-        assert extra["attributes"]["elapsed"] == 0.5
-
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_signal_span_detail_forwarded(self, mock_logger: MagicMock) -> None:
+    def test_signal_span_detail_forwarded(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_telemetry_log
 
-        mock_logger.isEnabledFor.return_value = True
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_telemetry_log(event_name="test.event", attributes={}, signal="span_detail")
 
-        emit_telemetry_log(event_name="test.event", attributes={}, signal="span_detail")
-
-        args = mock_logger.info.call_args[0]
-        assert args[1] == "span_detail"
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert extra["attributes"]["dify.event.signal"] == "span_detail"
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert record.getMessage() == "telemetry.span_detail"
+        assert hasattr(record, "attributes")
+        assert record.attributes["dify.event.signal"] == "span_detail"
 
 
 # ---------------------------------------------------------------------------
@@ -277,51 +273,50 @@ class TestEmitMetricOnlyEvent:
         compute_trace_id_hex.cache_clear()
         compute_span_id_hex.cache_clear()
 
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_delegates_to_emit_telemetry_log_with_metric_only_signal(self, mock_logger: MagicMock) -> None:
+    def test_delegates_to_emit_telemetry_log_with_metric_only_signal(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_metric_only_event
 
-        mock_logger.isEnabledFor.return_value = True
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_metric_only_event(
+                event_name="dify.app.created",
+                attributes={"app_id": "app-1"},
+                tenant_id="t1",
+                user_id="u1",
+            )
 
-        emit_metric_only_event(
-            event_name="dify.app.created",
-            attributes={"app_id": "app-1"},
-            tenant_id="t1",
-            user_id="u1",
-        )
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert hasattr(record, "attributes")
+        assert record.attributes["dify.event.signal"] == "metric_only"
+        assert record.attributes["dify.event.name"] == "dify.app.created"
+        assert record.attributes["app_id"] == "app-1"
+        assert hasattr(record, "tenant_id")
+        assert record.tenant_id == "t1"
+        assert hasattr(record, "user_id")
+        assert record.user_id == "u1"
 
-        mock_logger.info.assert_called_once()
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert extra["attributes"]["dify.event.signal"] == "metric_only"
-        assert extra["attributes"]["dify.event.name"] == "dify.app.created"
-        assert extra["attributes"]["app_id"] == "app-1"
-        assert extra["tenant_id"] == "t1"
-        assert extra["user_id"] == "u1"
-
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_trace_and_span_ids_passed_through(self, mock_logger: MagicMock) -> None:
+    def test_trace_and_span_ids_passed_through(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_metric_only_event
 
-        mock_logger.isEnabledFor.return_value = True
         uid = "123e4567-e89b-12d3-a456-426614174000"
 
-        emit_metric_only_event(
-            event_name="dify.workflow.run",
-            attributes={},
-            trace_id_source=uid,
-            span_id_source=uid,
-        )
+        with caplog.at_level(logging.INFO, logger="dify.telemetry"):
+            emit_metric_only_event(
+                event_name="dify.workflow.run",
+                attributes={},
+                trace_id_source=uid,
+                span_id_source=uid,
+            )
 
-        extra = mock_logger.info.call_args.kwargs["extra"]
-        assert "trace_id" in extra
-        assert "span_id" in extra
+        assert len(caplog.records) == 1
+        record = caplog.records[0]
+        assert hasattr(record, "trace_id")
+        assert hasattr(record, "span_id")
 
-    @patch("enterprise.telemetry.telemetry_log.logger")
-    def test_no_log_emitted_when_logger_disabled(self, mock_logger: MagicMock) -> None:
+    def test_no_log_emitted_when_logger_disabled(self, caplog: pytest.LogCaptureFixture) -> None:
         from enterprise.telemetry.telemetry_log import emit_metric_only_event
 
-        mock_logger.isEnabledFor.return_value = False
+        with caplog.at_level(logging.WARNING, logger="dify.telemetry"):
+            emit_metric_only_event(event_name="dify.workflow.run", attributes={})
 
-        emit_metric_only_event(event_name="dify.workflow.run", attributes={})
-
-        mock_logger.info.assert_not_called()
+        assert len(caplog.records) == 0
diff --git a/api/tests/unit_tests/events/event_handlers/test_delete_tool_parameters_cache_when_sync_draft_workflow.py b/api/tests/unit_tests/events/event_handlers/test_delete_tool_parameters_cache_when_sync_draft_workflow.py
index 75b61901b21..27f162de75e 100644
--- a/api/tests/unit_tests/events/event_handlers/test_delete_tool_parameters_cache_when_sync_draft_workflow.py
+++ b/api/tests/unit_tests/events/event_handlers/test_delete_tool_parameters_cache_when_sync_draft_workflow.py
@@ -1,11 +1,16 @@
 import logging
 from types import SimpleNamespace
 
+import pytest
+
 from core.tools.errors import ToolProviderNotFoundError
 from events.event_handlers import delete_tool_parameters_cache_when_sync_draft_workflow as handler_module
 
 
-def test_missing_tool_provider_does_not_log_error_traceback(monkeypatch, caplog):
+def test_missing_tool_provider_does_not_log_error_traceback(
+    monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+):
     app = SimpleNamespace(id="workflow-id", tenant_id="tenant-id")
     workflow = SimpleNamespace(
         graph_dict={
diff --git a/api/tests/unit_tests/extensions/test_ext_request_logging.py b/api/tests/unit_tests/extensions/test_ext_request_logging.py
index 03479686bbe..3d2f8541f63 100644
--- a/api/tests/unit_tests/extensions/test_ext_request_logging.py
+++ b/api/tests/unit_tests/extensions/test_ext_request_logging.py
@@ -301,7 +301,9 @@ class TestRequestFinishedInfoAccessLine:
             assert "123.456" in msg  # rounded to 3 decimals
             assert "trace-xyz" in msg
 
-    def test_info_access_log_uses_dash_without_start_timestamp(self, monkeypatch: pytest.MonkeyPatch, caplog):
+    def test_info_access_log_uses_dash_without_start_timestamp(
+        self, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+    ):
         app = _get_test_app()
         with app.test_request_context("/bar", method="POST"):
             # No g.__request_started_ts set -> duration should be '-'
diff --git a/api/tests/unit_tests/fields/test_dataset_fields.py b/api/tests/unit_tests/fields/test_dataset_fields.py
index 125bcb26cf6..921e3882a96 100644
--- a/api/tests/unit_tests/fields/test_dataset_fields.py
+++ b/api/tests/unit_tests/fields/test_dataset_fields.py
@@ -82,6 +82,14 @@ def _dump_dataset_detail(payload):
     return DatasetDetailResponse.model_validate(payload).model_dump(mode="json")
 
 
+def test_dataset_detail_preserves_permission_keys():
+    response = _dump_dataset_detail(
+        _dataset_detail_payload(permission_keys=["dataset.acl.readonly", "dataset.acl.edit"])
+    )
+
+    assert response["permission_keys"] == ["dataset.acl.readonly", "dataset.acl.edit"]
+
+
 def test_dataset_detail_expands_legacy_null_nested_fields():
     response = _dump_dataset_detail(
         _dataset_detail_payload(
diff --git a/api/tests/unit_tests/libs/test_archive_storage.py b/api/tests/unit_tests/libs/test_archive_storage.py
index 4363c235716..966e75f1f9e 100644
--- a/api/tests/unit_tests/libs/test_archive_storage.py
+++ b/api/tests/unit_tests/libs/test_archive_storage.py
@@ -16,7 +16,7 @@ from libs.archive_storage import (
 BUCKET_NAME = "archive-bucket"
 
 
-def _configure_storage(monkeypatch, **overrides):
+def _configure_storage(monkeypatch: pytest.MonkeyPatch, **overrides):
     defaults = {
         "ARCHIVE_STORAGE_ENABLED": True,
         "ARCHIVE_STORAGE_ENDPOINT": "https://storage.example.com",
diff --git a/api/tests/unit_tests/libs/test_pandas.py b/api/tests/unit_tests/libs/test_pandas.py
index a4739dbbc2b..3eec25815a1 100644
--- a/api/tests/unit_tests/libs/test_pandas.py
+++ b/api/tests/unit_tests/libs/test_pandas.py
@@ -1,8 +1,10 @@
+from pathlib import Path
+
 import pandas as pd
 import pytest
 
 
-def test_pandas_csv(tmp_path, monkeypatch: pytest.MonkeyPatch):
+def test_pandas_csv(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.chdir(tmp_path)
     data = {"col1": [1, 2.2, -3.3, 4.0, 5], "col2": ["A", "B", "C", "D", "E"]}
     df1 = pd.DataFrame(data)
@@ -17,7 +19,7 @@ def test_pandas_csv(tmp_path, monkeypatch: pytest.MonkeyPatch):
     assert df2[df2.columns[1]].to_list() == data["col2"]
 
 
-def test_pandas_xlsx(tmp_path, monkeypatch: pytest.MonkeyPatch):
+def test_pandas_xlsx(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.chdir(tmp_path)
     data = {"col1": [1, 2.2, -3.3, 4.0, 5], "col2": ["A", "B", "C", "D", "E"]}
     df1 = pd.DataFrame(data)
@@ -32,7 +34,7 @@ def test_pandas_xlsx(tmp_path, monkeypatch: pytest.MonkeyPatch):
     assert df2[df2.columns[1]].to_list() == data["col2"]
 
 
-def test_pandas_xlsx_with_sheets(tmp_path, monkeypatch: pytest.MonkeyPatch):
+def test_pandas_xlsx_with_sheets(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
     monkeypatch.chdir(tmp_path)
     data1 = {"col1": [1, 2, 3, 4, 5], "col2": ["A", "B", "C", "D", "E"]}
     df1 = pd.DataFrame(data1)
diff --git a/api/tests/unit_tests/libs/test_rate_limit_bearer.py b/api/tests/unit_tests/libs/test_rate_limit_bearer.py
index 62363f5f600..f286bfd875d 100644
--- a/api/tests/unit_tests/libs/test_rate_limit_bearer.py
+++ b/api/tests/unit_tests/libs/test_rate_limit_bearer.py
@@ -75,7 +75,7 @@ def test_enforce_bearer_rate_limit_raises_429_with_retry_after(mock_build):
 
 
 @patch("libs.rate_limit._build_limiter")
-def test_enforce_bearer_rate_limit_disabled_when_limit_is_zero(mock_build, monkeypatch):
+def test_enforce_bearer_rate_limit_disabled_when_limit_is_zero(mock_build, monkeypatch: pytest.MonkeyPatch):
     # 0 disables the limit — short-circuit before building/consulting a limiter.
     monkeypatch.setattr(
         "libs.rate_limit.LIMIT_BEARER_PER_TOKEN",
diff --git a/api/tests/unit_tests/libs/test_workspace_permission.py b/api/tests/unit_tests/libs/test_workspace_permission.py
index 93e69e11c4b..e0c425e7c1e 100644
--- a/api/tests/unit_tests/libs/test_workspace_permission.py
+++ b/api/tests/unit_tests/libs/test_workspace_permission.py
@@ -127,7 +127,9 @@ class TestWorkspacePermissionHelper:
 
     @patch("libs.workspace_permission.EnterpriseService")
     @patch("libs.workspace_permission.dify_config")
-    def test_enterprise_service_error_fails_open(self, mock_config, mock_enterprise_service, caplog):
+    def test_enterprise_service_error_fails_open(
+        self, mock_config, mock_enterprise_service, caplog: pytest.LogCaptureFixture
+    ):
         """On enterprise service error, should fail-open (allow) and log error."""
         mock_config.ENTERPRISE_ENABLED = True
 
diff --git a/api/tests/unit_tests/models/test_account_models.py b/api/tests/unit_tests/models/test_account_models.py
index 25933dd15b6..512c043b0c8 100644
--- a/api/tests/unit_tests/models/test_account_models.py
+++ b/api/tests/unit_tests/models/test_account_models.py
@@ -12,6 +12,7 @@ This test suite covers:
 import base64
 import secrets
 from datetime import UTC, datetime
+from unittest.mock import patch
 from uuid import uuid4
 
 import pytest
@@ -347,7 +348,15 @@ class TestAccountRolePermissions:
         account.role = TenantAccountRole.ADMIN
 
         # Act & Assert
-        assert account.is_admin_or_owner
+        with patch("models.account.dify_config.RBAC_ENABLED", False):
+            assert account.is_admin_or_owner
+
+    def test_is_admin_or_owner_with_rbac_enabled(self):
+        account = Account(name="Test User", email="test@example.com")
+        account.role = TenantAccountRole.NORMAL
+
+        with patch("models.account.dify_config.RBAC_ENABLED", True):
+            assert account.is_admin_or_owner
 
     def test_is_admin_or_owner_with_owner_role(self):
         """Test is_admin_or_owner property with owner role."""
@@ -383,8 +392,16 @@ class TestAccountRolePermissions:
         owner_account.role = TenantAccountRole.OWNER
 
         # Act & Assert
-        assert admin_account.is_admin
-        assert not owner_account.is_admin
+        with patch("models.account.dify_config.RBAC_ENABLED", False):
+            assert admin_account.is_admin
+            assert not owner_account.is_admin
+
+    def test_is_admin_with_rbac_enabled(self):
+        account = Account(name="Test User", email="test@example.com")
+        account.role = TenantAccountRole.NORMAL
+
+        with patch("models.account.dify_config.RBAC_ENABLED", True):
+            assert account.is_admin
 
     def test_has_edit_permission_with_editing_roles(self):
         """Test has_edit_permission property with roles that have edit permission."""
@@ -400,7 +417,15 @@ class TestAccountRolePermissions:
             account.role = role
 
             # Act & Assert
-            assert account.has_edit_permission, f"Role {role} should have edit permission"
+            with patch("models.account.dify_config.RBAC_ENABLED", False):
+                assert account.has_edit_permission, f"Role {role} should have edit permission"
+
+    def test_has_edit_permission_with_rbac_enabled(self):
+        account = Account(name="Test User", email="test@example.com")
+        account.role = TenantAccountRole.NORMAL
+
+        with patch("models.account.dify_config.RBAC_ENABLED", True):
+            assert account.has_edit_permission
 
     def test_has_edit_permission_without_editing_roles(self):
         """Test has_edit_permission property with roles that don't have edit permission."""
@@ -415,7 +440,8 @@ class TestAccountRolePermissions:
             account.role = role
 
             # Act & Assert
-            assert not account.has_edit_permission, f"Role {role} should not have edit permission"
+            with patch("models.account.dify_config.RBAC_ENABLED", False):
+                assert not account.has_edit_permission, f"Role {role} should not have edit permission"
 
     def test_is_dataset_editor_property(self):
         """Test is_dataset_editor property."""
@@ -432,12 +458,21 @@ class TestAccountRolePermissions:
             account.role = role
 
             # Act & Assert
-            assert account.is_dataset_editor, f"Role {role} should have dataset edit permission"
+            with patch("models.account.dify_config.RBAC_ENABLED", False):
+                assert account.is_dataset_editor, f"Role {role} should have dataset edit permission"
 
         # Test normal role doesn't have dataset edit permission
         normal_account = Account(name="Normal User", email="normal@example.com")
         normal_account.role = TenantAccountRole.NORMAL
-        assert not normal_account.is_dataset_editor
+        with patch("models.account.dify_config.RBAC_ENABLED", False):
+            assert not normal_account.is_dataset_editor
+
+    def test_is_dataset_editor_with_rbac_enabled(self):
+        account = Account(name="Test User", email="test@example.com")
+        account.role = TenantAccountRole.NORMAL
+
+        with patch("models.account.dify_config.RBAC_ENABLED", True):
+            assert account.is_dataset_editor
 
     def test_is_dataset_operator_property(self):
         """Test is_dataset_operator property."""
@@ -449,8 +484,16 @@ class TestAccountRolePermissions:
         normal_account.role = TenantAccountRole.NORMAL
 
         # Act & Assert
-        assert dataset_operator.is_dataset_operator
-        assert not normal_account.is_dataset_operator
+        with patch("models.account.dify_config.RBAC_ENABLED", False):
+            assert dataset_operator.is_dataset_operator
+            assert not normal_account.is_dataset_operator
+
+    def test_is_dataset_operator_with_rbac_enabled(self):
+        account = Account(name="Test User", email="test@example.com")
+        account.role = TenantAccountRole.NORMAL
+
+        with patch("models.account.dify_config.RBAC_ENABLED", True):
+            assert account.is_dataset_operator
 
     def test_current_role_property(self):
         """Test current_role property."""
diff --git a/api/tests/unit_tests/models/test_agent_config_entities.py b/api/tests/unit_tests/models/test_agent_config_entities.py
index 51e51fb6d46..5538a1981de 100644
--- a/api/tests/unit_tests/models/test_agent_config_entities.py
+++ b/api/tests/unit_tests/models/test_agent_config_entities.py
@@ -1,7 +1,12 @@
 import pytest
 
 from core.workflow.file_reference import build_file_reference
-from models.agent_config_entities import DeclaredOutputConfig, DeclaredOutputType
+from models.agent_config_entities import (
+    DeclaredArrayItem,
+    DeclaredOutputChildConfig,
+    DeclaredOutputConfig,
+    DeclaredOutputType,
+)
 
 
 def test_file_default_value_accepts_canonical_reference_mapping() -> None:
@@ -92,3 +97,90 @@ def test_array_file_default_value_rejects_legacy_item_shape() -> None:
                 },
             }
         )
+
+
+def test_declared_array_item_rejects_nested_arrays_and_non_object_children() -> None:
+    with pytest.raises(ValueError, match="nested arrays"):
+        DeclaredArrayItem(type=DeclaredOutputType.ARRAY)
+
+    with pytest.raises(ValueError, match="array_item.children"):
+        DeclaredArrayItem(
+            type=DeclaredOutputType.STRING,
+            children=[DeclaredOutputChildConfig(name="label", type=DeclaredOutputType.STRING)],
+        )
+
+
+def test_declared_output_child_validates_shape_and_defaults() -> None:
+    file_child = DeclaredOutputChildConfig(name="report", type=DeclaredOutputType.FILE)
+    assert file_child.file is not None
+
+    array_child = DeclaredOutputChildConfig(name="items", type=DeclaredOutputType.ARRAY)
+    assert array_child.array_item is not None
+    assert array_child.array_item.type == DeclaredOutputType.OBJECT
+
+    with pytest.raises(ValueError, match="output child name"):
+        DeclaredOutputChildConfig(name="bad-name", type=DeclaredOutputType.STRING)
+
+    with pytest.raises(ValueError, match="file metadata"):
+        DeclaredOutputChildConfig(name="title", type=DeclaredOutputType.STRING, file={})
+
+    with pytest.raises(ValueError, match="array_item is only allowed"):
+        DeclaredOutputChildConfig(
+            name="title",
+            type=DeclaredOutputType.STRING,
+            array_item={"type": DeclaredOutputType.STRING},
+        )
+
+    with pytest.raises(ValueError, match="children is only allowed"):
+        DeclaredOutputChildConfig(
+            name="title",
+            type=DeclaredOutputType.STRING,
+            children=[DeclaredOutputChildConfig(name="label", type=DeclaredOutputType.STRING)],
+        )
+
+
+def test_declared_output_validates_shape_and_defaults() -> None:
+    file_output = DeclaredOutputConfig(name="report", type=DeclaredOutputType.FILE)
+    assert file_output.file is not None
+
+    array_output = DeclaredOutputConfig(name="items", type=DeclaredOutputType.ARRAY)
+    assert array_output.array_item is not None
+    assert array_output.array_item.type == DeclaredOutputType.OBJECT
+
+    default_failure_strategy = DeclaredOutputConfig.model_validate(
+        {"name": "summary", "type": "string", "failure_strategy": None}
+    )
+    assert default_failure_strategy.failure_strategy.on_failure == "stop"
+
+    with pytest.raises(ValueError, match="output name"):
+        DeclaredOutputConfig(name="bad-name", type=DeclaredOutputType.STRING)
+
+    with pytest.raises(ValueError, match="file metadata"):
+        DeclaredOutputConfig(name="summary", type=DeclaredOutputType.STRING, file={})
+
+    with pytest.raises(ValueError, match="array_item is only allowed"):
+        DeclaredOutputConfig(
+            name="summary",
+            type=DeclaredOutputType.STRING,
+            array_item={"type": DeclaredOutputType.STRING},
+        )
+
+    with pytest.raises(ValueError, match="children is only allowed"):
+        DeclaredOutputConfig(
+            name="summary",
+            type=DeclaredOutputType.STRING,
+            children=[DeclaredOutputChildConfig(name="title", type=DeclaredOutputType.STRING)],
+        )
+
+    with pytest.raises(ValueError, match="output check is only allowed"):
+        DeclaredOutputConfig.model_validate(
+            {
+                "name": "summary",
+                "type": "string",
+                "check": {
+                    "enabled": True,
+                    "prompt": "Compare output",
+                    "benchmark_file_ref": {"name": "expected.pdf"},
+                },
+            }
+        )
diff --git a/api/tests/unit_tests/models/test_dataset_models.py b/api/tests/unit_tests/models/test_dataset_models.py
index 44a4e6af98b..bbfd411ca38 100644
--- a/api/tests/unit_tests/models/test_dataset_models.py
+++ b/api/tests/unit_tests/models/test_dataset_models.py
@@ -17,6 +17,8 @@ from unittest.mock import Mock, patch
 from urllib.parse import parse_qs, urlparse
 from uuid import uuid4
 
+import pytest
+
 from core.rag.index_processor.constant.index_type import IndexTechniqueType
 from models.dataset import (
     AppDatasetJoin,
@@ -703,7 +705,7 @@ class TestDocumentSegmentIndexing:
         # Assert
         assert segment.hit_count == 5
 
-    def test_document_segment_attachments_prefers_files_url_for_source_url(self, monkeypatch):
+    def test_document_segment_attachments_prefers_files_url_for_source_url(self, monkeypatch: pytest.MonkeyPatch):
         """Test attachment source URLs use FILES_URL before falling back to CONSOLE_API_URL."""
         # Arrange
         segment = DocumentSegment(
diff --git a/api/tests/unit_tests/models/test_end_user_type.py b/api/tests/unit_tests/models/test_end_user_type.py
new file mode 100644
index 00000000000..55a4d35cbb9
--- /dev/null
+++ b/api/tests/unit_tests/models/test_end_user_type.py
@@ -0,0 +1,101 @@
+import ast
+import inspect
+from pathlib import Path
+
+from models.enums import EndUserType
+from models.model import EndUser
+from models.types import EnumText
+from services.end_user_service import EndUserService
+
+API_ROOT = Path(__file__).resolve().parents[3]
+
+
+def test_end_user_type_covers_persisted_creation_values():
+    assert {member.value for member in EndUserType} == {
+        "browser",
+        "mcp",
+        "openapi",
+        "service-api",
+        "trigger",
+    }
+
+
+def test_end_user_type_is_plain_persisted_value_enum():
+    assert not hasattr(EndUserType, "from_invoke_from")
+
+
+def test_end_user_service_creation_methods_accept_end_user_type():
+    assert inspect.signature(EndUserService.get_or_create_end_user_by_type).parameters["type"].annotation is EndUserType
+    assert inspect.signature(EndUserService.create_end_user_batch).parameters["type"].annotation is EndUserType
+
+
+def test_end_user_service_callers_pass_end_user_type():
+    violations: list[str] = []
+    method_names = {"get_or_create_end_user_by_type", "create_end_user_batch"}
+
+    for source_path in API_ROOT.rglob("*.py"):
+        if "tests" in source_path.parts or ".venv" in source_path.parts:
+            continue
+
+        tree = ast.parse(source_path.read_text(), filename=str(source_path))
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            if not isinstance(node.func, ast.Attribute) or node.func.attr not in method_names:
+                continue
+            if not isinstance(node.func.value, ast.Name) or node.func.value.id != "EndUserService":
+                continue
+
+            type_arg = next((keyword.value for keyword in node.keywords if keyword.arg == "type"), None)
+            if type_arg is None and node.args:
+                type_arg = node.args[0]
+
+            if not (
+                isinstance(type_arg, ast.Attribute)
+                and isinstance(type_arg.value, ast.Name)
+                and type_arg.value.id == "EndUserType"
+            ):
+                violations.append(f"{source_path.relative_to(API_ROOT)}:{node.lineno}")
+
+    assert violations == []
+
+
+def test_end_user_type_column_uses_enum_text():
+    column_type = EndUser.__table__.c.type.type
+
+    assert isinstance(column_type, EnumText)
+    assert column_type._enum_class is EndUserType
+
+
+def test_production_end_user_constructors_use_end_user_type_enum():
+    violations: list[str] = []
+
+    for source_path in API_ROOT.rglob("*.py"):
+        if "tests" in source_path.parts or ".venv" in source_path.parts:
+            continue
+
+        tree = ast.parse(source_path.read_text(), filename=str(source_path))
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            if not isinstance(node.func, ast.Name) or node.func.id != "EndUser":
+                continue
+
+            for keyword in node.keywords:
+                if keyword.arg != "type":
+                    continue
+                value = keyword.value
+                uses_end_user_type_member = (
+                    isinstance(value, ast.Attribute)
+                    and isinstance(value.value, ast.Name)
+                    and value.value.id == "EndUserType"
+                )
+                uses_end_user_service_type_parameter = (
+                    source_path.relative_to(API_ROOT) == Path("services/end_user_service.py")
+                    and isinstance(value, ast.Name)
+                    and value.id == "type"
+                )
+                if not (uses_end_user_type_member or uses_end_user_service_type_parameter):
+                    violations.append(f"{source_path.relative_to(API_ROOT)}:{node.lineno}")
+
+    assert violations == []
diff --git a/api/tests/unit_tests/models/test_file_input_compat.py b/api/tests/unit_tests/models/test_file_input_compat.py
index 1a41ccec9ea..6d6f2b42201 100644
--- a/api/tests/unit_tests/models/test_file_input_compat.py
+++ b/api/tests/unit_tests/models/test_file_input_compat.py
@@ -125,7 +125,9 @@ def test_rebuild_serialized_graph_files_without_lookup_preserves_scalar_values()
     assert rebuild_serialized_graph_files_without_lookup("plain-text") == "plain-text"
 
 
-def test_build_file_from_stored_mapping_rebuilds_remote_urls_without_record_lookup(monkeypatch) -> None:
+def test_build_file_from_stored_mapping_rebuilds_remote_urls_without_record_lookup(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
     rebuilt_file = File(
         file_type=FileType.IMAGE,
         transfer_method=FileTransferMethod.REMOTE_URL,
diff --git a/api/tests/unit_tests/models/test_snippet.py b/api/tests/unit_tests/models/test_snippet.py
index f7a22f48f89..17f7cb3c9d4 100644
--- a/api/tests/unit_tests/models/test_snippet.py
+++ b/api/tests/unit_tests/models/test_snippet.py
@@ -2,6 +2,8 @@ import json
 from types import SimpleNamespace
 from unittest.mock import Mock
 
+import pytest
+
 from models.snippet import CustomizedSnippet
 
 
@@ -11,7 +13,7 @@ def test_graph_dict_returns_empty_without_workflow_id() -> None:
     assert snippet.graph_dict == {}
 
 
-def test_graph_dict_loads_published_workflow_graph(monkeypatch) -> None:
+def test_graph_dict_loads_published_workflow_graph(monkeypatch: pytest.MonkeyPatch) -> None:
     workflow = SimpleNamespace(graph=json.dumps({"nodes": [{"id": "llm-1"}], "edges": []}))
     session = SimpleNamespace(get=Mock(return_value=workflow))
     monkeypatch.setattr("models.snippet.db.session", session)
@@ -21,7 +23,7 @@ def test_graph_dict_loads_published_workflow_graph(monkeypatch) -> None:
     session.get.assert_called_once()
 
 
-def test_graph_dict_returns_empty_when_workflow_missing(monkeypatch) -> None:
+def test_graph_dict_returns_empty_when_workflow_missing(monkeypatch: pytest.MonkeyPatch) -> None:
     session = SimpleNamespace(get=Mock(return_value=None))
     monkeypatch.setattr("models.snippet.db.session", session)
     snippet = CustomizedSnippet(workflow_id="missing-workflow")
@@ -36,7 +38,7 @@ def test_input_fields_list_parses_json_or_returns_empty() -> None:
     ]
 
 
-def test_tags_returns_query_results_or_empty(monkeypatch) -> None:
+def test_tags_returns_query_results_or_empty(monkeypatch: pytest.MonkeyPatch) -> None:
     tags = [SimpleNamespace(id="tag-1")]
     session = SimpleNamespace(scalars=Mock(return_value=SimpleNamespace(all=Mock(return_value=tags))))
     monkeypatch.setattr("models.snippet.db.session", session)
@@ -48,7 +50,7 @@ def test_tags_returns_query_results_or_empty(monkeypatch) -> None:
     assert snippet.tags == []
 
 
-def test_account_properties_and_author_name(monkeypatch) -> None:
+def test_account_properties_and_author_name(monkeypatch: pytest.MonkeyPatch) -> None:
     account = SimpleNamespace(id="account-1", name="Ada")
     updated_account = SimpleNamespace(id="account-2", name="Grace")
     session = SimpleNamespace(
diff --git a/api/tests/unit_tests/oss/__mock/aliyun_oss.py b/api/tests/unit_tests/oss/__mock/aliyun_oss.py
index 27e1c0ad850..59434e072fa 100644
--- a/api/tests/unit_tests/oss/__mock/aliyun_oss.py
+++ b/api/tests/unit_tests/oss/__mock/aliyun_oss.py
@@ -3,7 +3,6 @@ import posixpath
 from unittest.mock import MagicMock
 
 import pytest
-from _pytest.monkeypatch import MonkeyPatch
 from oss2 import Bucket
 from oss2.models import GetObjectResult, PutObjectResult
 
@@ -85,7 +84,7 @@ MOCK = os.getenv("MOCK_SWITCH", "false").lower() == "true"
 
 
 @pytest.fixture
-def setup_aliyun_oss_mock(monkeypatch: MonkeyPatch):
+def setup_aliyun_oss_mock(monkeypatch: pytest.MonkeyPatch):
     if MOCK:
         monkeypatch.setattr(Bucket, "__init__", MockAliyunOssClass.__init__)
         monkeypatch.setattr(Bucket, "put_object", MockAliyunOssClass.put_object)
diff --git a/api/tests/unit_tests/oss/__mock/baidu_obs.py b/api/tests/unit_tests/oss/__mock/baidu_obs.py
index d70a7c2eaab..49c0830cdfb 100644
--- a/api/tests/unit_tests/oss/__mock/baidu_obs.py
+++ b/api/tests/unit_tests/oss/__mock/baidu_obs.py
@@ -5,7 +5,6 @@ from io import BytesIO
 from types import SimpleNamespace
 
 import pytest
-from _pytest.monkeypatch import MonkeyPatch
 from baidubce.services.bos.bos_client import BosClient
 
 from tests.unit_tests.oss.__mock.base import (
@@ -55,7 +54,7 @@ MOCK = os.getenv("MOCK_SWITCH", "false").lower() == "true"
 
 
 @pytest.fixture
-def setup_baidu_obs_mock(monkeypatch: MonkeyPatch):
+def setup_baidu_obs_mock(monkeypatch: pytest.MonkeyPatch):
     if MOCK:
         monkeypatch.setattr(BosClient, "__init__", MockBaiduObsClass.__init__)
         monkeypatch.setattr(BosClient, "put_object", MockBaiduObsClass.put_object)
diff --git a/api/tests/unit_tests/oss/__mock/local.py b/api/tests/unit_tests/oss/__mock/local.py
index 95cc06958c6..ee01ab2a6ae 100644
--- a/api/tests/unit_tests/oss/__mock/local.py
+++ b/api/tests/unit_tests/oss/__mock/local.py
@@ -4,7 +4,6 @@ from pathlib import Path
 from unittest.mock import MagicMock, mock_open, patch
 
 import pytest
-from _pytest.monkeypatch import MonkeyPatch
 
 from tests.unit_tests.oss.__mock.base import (
     get_example_data,
@@ -40,7 +39,7 @@ MOCK = os.getenv("MOCK_SWITCH", "false").lower() == "true"
 
 
 @pytest.fixture
-def setup_local_fs_mock(monkeypatch: MonkeyPatch):
+def setup_local_fs_mock(monkeypatch: pytest.MonkeyPatch):
     if MOCK:
         monkeypatch.setattr(Path, "write_bytes", MockLocalFSClass.write_bytes)
         monkeypatch.setattr(Path, "read_bytes", MockLocalFSClass.read_bytes)
diff --git a/api/tests/unit_tests/oss/__mock/tencent_cos.py b/api/tests/unit_tests/oss/__mock/tencent_cos.py
index 5189b68e871..65b5bf31329 100644
--- a/api/tests/unit_tests/oss/__mock/tencent_cos.py
+++ b/api/tests/unit_tests/oss/__mock/tencent_cos.py
@@ -2,7 +2,6 @@ import os
 from unittest.mock import MagicMock
 
 import pytest
-from _pytest.monkeypatch import MonkeyPatch
 from qcloud_cos import CosS3Client
 from qcloud_cos.streambody import StreamBody
 
@@ -67,7 +66,7 @@ MOCK = os.getenv("MOCK_SWITCH", "false").lower() == "true"
 
 
 @pytest.fixture
-def setup_tencent_cos_mock(monkeypatch: MonkeyPatch):
+def setup_tencent_cos_mock(monkeypatch: pytest.MonkeyPatch):
     if MOCK:
         monkeypatch.setattr(CosS3Client, "__init__", MockTencentCosClass.__init__)
         monkeypatch.setattr(CosS3Client, "put_object", MockTencentCosClass.put_object)
diff --git a/api/tests/unit_tests/oss/__mock/volcengine_tos.py b/api/tests/unit_tests/oss/__mock/volcengine_tos.py
index 649d93a2026..af35fdeb2d0 100644
--- a/api/tests/unit_tests/oss/__mock/volcengine_tos.py
+++ b/api/tests/unit_tests/oss/__mock/volcengine_tos.py
@@ -3,7 +3,6 @@ from collections import UserDict
 from unittest.mock import MagicMock
 
 import pytest
-from _pytest.monkeypatch import MonkeyPatch
 from tos import TosClientV2
 from tos.clientv2 import DeleteObjectOutput, GetObjectOutput, HeadObjectOutput, PutObjectOutput
 
@@ -76,7 +75,7 @@ MOCK = os.getenv("MOCK_SWITCH", "false").lower() == "true"
 
 
 @pytest.fixture
-def setup_volcengine_tos_mock(monkeypatch: MonkeyPatch):
+def setup_volcengine_tos_mock(monkeypatch: pytest.MonkeyPatch):
     if MOCK:
         monkeypatch.setattr(TosClientV2, "__init__", MockVolcengineTosClass.__init__)
         monkeypatch.setattr(TosClientV2, "put_object", MockVolcengineTosClass.put_object)
diff --git a/api/tests/unit_tests/services/agent/test_agent_composer_entities.py b/api/tests/unit_tests/services/agent/test_agent_composer_entities.py
index dbdf37a9053..089a5c74f3a 100644
--- a/api/tests/unit_tests/services/agent/test_agent_composer_entities.py
+++ b/api/tests/unit_tests/services/agent/test_agent_composer_entities.py
@@ -51,6 +51,19 @@ def test_locked_workflow_soul_rejects_soul_changes():
         ComposerConfigValidator.validate_save_payload(payload)
 
 
+def test_locked_workflow_node_job_only_allows_inline_soul_payload():
+    payload = ComposerSavePayload.model_validate(
+        {
+            "variant": ComposerVariant.WORKFLOW,
+            "save_strategy": ComposerSaveStrategy.NODE_JOB_ONLY,
+            "soul_lock": {"locked": True},
+            "agent_soul": {"prompt": {"system_prompt": "changed"}},
+        }
+    )
+
+    ComposerConfigValidator.validate_save_payload(payload)
+
+
 def test_agent_app_soul_allows_app_features_and_variables():
     payload = ComposerSavePayload.model_validate(
         {
diff --git a/api/tests/unit_tests/services/agent/test_agent_observability_service.py b/api/tests/unit_tests/services/agent/test_agent_observability_service.py
new file mode 100644
index 00000000000..f98c548d176
--- /dev/null
+++ b/api/tests/unit_tests/services/agent/test_agent_observability_service.py
@@ -0,0 +1,225 @@
+from datetime import UTC, datetime
+from decimal import Decimal
+from types import SimpleNamespace
+
+import pytest
+
+from core.app.entities.app_invoke_entities import InvokeFrom
+from models.enums import ConversationFromSource, MessageStatus
+from services.agent.observability_service import AgentLogQueryParams, AgentObservabilityService
+
+
+def test_resolve_source_accepts_frontend_aliases() -> None:
+    assert AgentObservabilityService.resolve_source(None) is None
+    assert AgentObservabilityService.resolve_source("all") is None
+    assert AgentObservabilityService.resolve_source("console") == InvokeFrom.EXPLORE
+    assert AgentObservabilityService.resolve_source("api") == InvokeFrom.SERVICE_API
+    assert AgentObservabilityService.resolve_source("web_app") == InvokeFrom.WEB_APP
+
+    with pytest.raises(ValueError, match="Unsupported source"):
+        AgentObservabilityService.resolve_source("unknown")
+
+
+def test_resolve_source_filter_accepts_structured_sources() -> None:
+    assert AgentObservabilityService.resolve_source_filter(None).kind == "all"
+    assert AgentObservabilityService.resolve_source_filter("webapp").kind == "webapp"
+    assert AgentObservabilityService.resolve_source_filter("webapp:app-1").app_id == "app-1"
+
+    workflow_filter = AgentObservabilityService.resolve_source_filter("workflow:app-2:workflow-1:v1:node-1")
+    assert workflow_filter.kind == "workflow"
+    assert workflow_filter.app_id == "app-2"
+    assert workflow_filter.workflow_id == "workflow-1"
+    assert workflow_filter.workflow_version == "v1"
+    assert workflow_filter.node_id == "node-1"
+
+    legacy_filter = AgentObservabilityService.resolve_source_filter("console")
+    assert legacy_filter.kind == "webapp"
+    assert legacy_filter.invoke_from == InvokeFrom.EXPLORE
+
+    with pytest.raises(ValueError, match="Unsupported source"):
+        AgentObservabilityService.resolve_source_filter("workflow:broken")
+
+
+def test_resolve_source_filters_accepts_multiple_structured_sources() -> None:
+    filters = AgentObservabilityService.resolve_source_filters(("webapp:app-1", "workflow:app-2:workflow-1:v1:node-1"))
+
+    assert [source_filter.kind for source_filter in filters] == ["webapp", "workflow"]
+    assert filters[0].app_id == "app-1"
+    assert filters[1].node_id == "node-1"
+    assert AgentObservabilityService.resolve_source_filters(())[0].kind == "all"
+    assert AgentObservabilityService.resolve_source_filters(("all", "webapp:app-1"))[0].kind == "all"
+
+
+def test_apply_status_filter_accepts_multiple_statuses() -> None:
+    class FakeStmt:
+        def __init__(self):
+            self.conditions = []
+
+        def where(self, *conditions):
+            self.conditions.extend(conditions)
+            return self
+
+    stmt = FakeStmt()
+
+    result = AgentObservabilityService._apply_status_filter(stmt, ("success", "failed", "paused"))
+
+    assert result is stmt
+    assert len(stmt.conditions) == 1
+    with pytest.raises(ValueError, match="Unsupported status"):
+        AgentObservabilityService._apply_status_filter(FakeStmt(), ("unknown",))
+
+
+def test_list_logs_sorts_by_requested_field(monkeypatch: pytest.MonkeyPatch) -> None:
+    service = AgentObservabilityService(session=None)
+    app = SimpleNamespace(id="app-1")
+    rows = [
+        {"id": "old", "source": {"id": "webapp:app-1"}, "created_at": 10, "updated_at": 100},
+        {"id": "new", "source": {"id": "webapp:app-1"}, "created_at": 20, "updated_at": 50},
+    ]
+    monkeypatch.setattr(service, "_list_webapp_conversation_logs", lambda **kwargs: rows)
+    monkeypatch.setattr(service, "_list_workflow_conversation_logs", lambda **kwargs: [])
+
+    payload = service.list_logs(
+        app=app,  # type: ignore[arg-type]
+        agent_id="agent-1",
+        params=AgentLogQueryParams(sources=("webapp:app-1",), sort_by="created_at", sort_order="asc"),
+    )
+
+    assert [item["id"] for item in payload["data"]] == ["old", "new"]
+
+
+def test_source_serializers_return_structured_frontend_shape() -> None:
+    app = SimpleNamespace(
+        id="app-1",
+        name="Iris",
+        icon_type=SimpleNamespace(value="emoji"),
+        icon="robot",
+        icon_background="#fff",
+    )
+
+    webapp_source = AgentObservabilityService._serialize_webapp_source(app)  # type: ignore[arg-type]
+    workflow_source = AgentObservabilityService._serialize_workflow_source(
+        app=app,  # type: ignore[arg-type]
+        workflow_id="workflow-1",
+        workflow_version="v1",
+        node_id="node-1",
+    )
+
+    assert webapp_source == {
+        "id": "webapp:app-1",
+        "type": "webapp",
+        "app_id": "app-1",
+        "app_name": "Iris",
+        "app_icon_type": "emoji",
+        "app_icon": "robot",
+        "app_icon_background": "#fff",
+        "workflow_id": None,
+        "workflow_version": None,
+        "node_id": None,
+    }
+    assert workflow_source["id"] == "workflow:app-1:workflow-1:v1:node-1"
+    assert workflow_source["type"] == "workflow"
+    assert workflow_source["workflow_id"] == "workflow-1"
+
+
+def test_serialize_log_message_returns_frontend_log_shape() -> None:
+    created_at = datetime(2026, 6, 17, 1, 2, 3, tzinfo=UTC)
+    updated_at = datetime(2026, 6, 17, 1, 3, 3, tzinfo=UTC)
+    message = SimpleNamespace(
+        id="message-1",
+        conversation_id="conversation-1",
+        query="hello",
+        answer="hi",
+        error=None,
+        status=MessageStatus.NORMAL,
+        invoke_from=InvokeFrom.EXPLORE,
+        from_source=ConversationFromSource.CONSOLE,
+        from_end_user_id=None,
+        from_account_id="account-1",
+        message_tokens=3,
+        answer_tokens=4,
+        total_price=Decimal("0.0001"),
+        currency="USD",
+        provider_response_latency=1.25,
+        created_at=created_at,
+        updated_at=updated_at,
+    )
+    conversation = SimpleNamespace(name="Debug conversation")
+
+    payload = AgentObservabilityService.serialize_log_message(message, conversation)  # type: ignore[arg-type]
+
+    assert payload == {
+        "id": "message-1",
+        "message_id": "message-1",
+        "conversation_id": "conversation-1",
+        "conversation_name": "Debug conversation",
+        "query": "hello",
+        "answer": "hi",
+        "status": "success",
+        "error": None,
+        "source": "explore",
+        "from_source": "console",
+        "from_end_user_id": None,
+        "from_account_id": "account-1",
+        "message_tokens": 3,
+        "answer_tokens": 4,
+        "total_tokens": 7,
+        "total_price": "0.0001",
+        "currency": "USD",
+        "latency": 1.25,
+        "created_at": int(created_at.timestamp()),
+        "updated_at": int(updated_at.timestamp()),
+    }
+
+
+def test_build_charts_and_summary_match_monitoring_metrics() -> None:
+    rows = [
+        {
+            "date": "2026-06-16",
+            "message_count": 2,
+            "conversation_count": 1,
+            "end_user_count": 1,
+            "token_count": 30,
+            "total_price": Decimal("0.003"),
+            "avg_latency": 1.5,
+            "latency_sum": 3,
+            "answer_tokens": 12,
+            "like_count": 1,
+        },
+        {
+            "date": "2026-06-17",
+            "message_count": 1,
+            "conversation_count": 1,
+            "end_user_count": 1,
+            "token_count": 20,
+            "total_price": Decimal("0.002"),
+            "avg_latency": 2,
+            "latency_sum": 2,
+            "answer_tokens": 8,
+            "like_count": 1,
+        },
+    ]
+
+    charts = AgentObservabilityService._build_charts(rows)
+    summary = AgentObservabilityService._build_summary(rows)
+
+    assert charts["token_usage"] == [
+        {"date": "2026-06-16", "token_count": 30, "total_price": "0.003", "currency": "USD"},
+        {"date": "2026-06-17", "token_count": 20, "total_price": "0.002", "currency": "USD"},
+    ]
+    assert charts["average_response_time"] == [
+        {"date": "2026-06-16", "latency": 1500.0},
+        {"date": "2026-06-17", "latency": 2000.0},
+    ]
+    assert summary == {
+        "total_messages": 3,
+        "total_conversations": 2,
+        "total_end_users": 2,
+        "total_tokens": 50,
+        "total_price": "0.005",
+        "currency": "USD",
+        "average_session_interactions": 1.5,
+        "average_response_time": 1666.6667,
+        "tokens_per_second": 4.0,
+        "user_satisfaction_rate": 66.67,
+    }
diff --git a/api/tests/unit_tests/services/agent/test_agent_services.py b/api/tests/unit_tests/services/agent/test_agent_services.py
index bd2d2899e23..2c077e20b46 100644
--- a/api/tests/unit_tests/services/agent/test_agent_services.py
+++ b/api/tests/unit_tests/services/agent/test_agent_services.py
@@ -17,10 +17,13 @@ from models.agent import (
 )
 from models.agent_config_entities import (
     AgentFileRefConfig,
+    DeclaredArrayItem,
+    DeclaredOutputChildConfig,
     DeclaredOutputConfig,
     DeclaredOutputType,
     WorkflowNodeJobConfig,
 )
+from models.model import IconType
 from models.workflow import Workflow
 from services.agent import composer_service, roster_service
 from services.agent.agent_soul_state import agent_soul_has_model
@@ -97,7 +100,7 @@ def test_agent_soul_has_model():
     assert agent_soul_has_model(AgentSoulConfig()) is False
 
 
-def test_load_workflow_composer_returns_empty_state(monkeypatch):
+def test_load_workflow_composer_returns_empty_state(monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setattr(AgentComposerService, "_get_draft_workflow", lambda **kwargs: SimpleNamespace(id="workflow-1"))
     monkeypatch.setattr(AgentComposerService, "_get_workflow_binding", lambda **kwargs: None)
 
@@ -112,10 +115,10 @@ def test_load_workflow_composer_returns_empty_state(monkeypatch):
     effective = result["effective_declared_outputs"]
     assert [o["name"] for o in effective] == ["text", "files", "json"]
     files_output = next(o for o in effective if o["name"] == "files")
-    assert files_output["array_item"] == {"type": "file", "description": None}
+    assert files_output["array_item"] == {"type": "file", "description": None, "children": []}
 
 
-def test_load_workflow_composer_serializes_existing_binding(monkeypatch):
+def test_load_workflow_composer_serializes_existing_binding(monkeypatch: pytest.MonkeyPatch):
     binding = SimpleNamespace(
         agent_id="agent-1",
         binding_type=WorkflowAgentBindingType.ROSTER_AGENT,
@@ -217,7 +220,7 @@ def test_save_workflow_composer_rejects_agent_app_variant():
         )
 
 
-def test_save_agent_app_composer_creates_agent_when_missing(monkeypatch):
+def test_save_agent_app_composer_creates_agent_when_missing(monkeypatch: pytest.MonkeyPatch):
     fake_session = FakeSession(scalar=[None])
     created_version = SimpleNamespace(id="version-1")
 
@@ -246,7 +249,7 @@ def test_save_agent_app_composer_creates_agent_when_missing(monkeypatch):
     assert fake_session.commits == 1
 
 
-def test_save_agent_app_composer_updates_current_version(monkeypatch):
+def test_save_agent_app_composer_updates_current_version(monkeypatch: pytest.MonkeyPatch):
     agent = SimpleNamespace(id="agent-1", active_config_snapshot_id="version-1", updated_by=None)
     fake_session = FakeSession(scalar=[agent])
     updated = {}
@@ -280,7 +283,7 @@ def test_save_agent_app_composer_updates_current_version(monkeypatch):
     assert fake_session.commits == 1
 
 
-def test_agent_app_composer_candidates_and_impact(monkeypatch):
+def test_agent_app_composer_candidates_and_impact(monkeypatch: pytest.MonkeyPatch):
     bindings = [
         SimpleNamespace(app_id="app-1", workflow_id="workflow-1", node_id="node-1"),
         SimpleNamespace(app_id="app-1", workflow_id="workflow-1", node_id="node-2"),
@@ -313,7 +316,7 @@ def test_agent_app_composer_candidates_and_impact(monkeypatch):
     assert impact["bindings"][1]["node_id"] == "node-2"
 
 
-def test_serialize_workflow_state_changes_lock_and_save_options(monkeypatch):
+def test_serialize_workflow_state_changes_lock_and_save_options(monkeypatch: pytest.MonkeyPatch):
     binding = WorkflowAgentNodeBinding(
         id="binding-1",
         tenant_id="tenant-1",
@@ -339,7 +342,7 @@ def test_serialize_workflow_state_changes_lock_and_save_options(monkeypatch):
     assert effective_names == ["text", "files", "json"]
 
 
-def test_serialize_workflow_state_passes_user_declared_outputs_through_effective(monkeypatch):
+def test_serialize_workflow_state_passes_user_declared_outputs_through_effective(monkeypatch: pytest.MonkeyPatch):
     binding = WorkflowAgentNodeBinding(
         id="binding-1",
         tenant_id="tenant-1",
@@ -366,7 +369,7 @@ def test_serialize_workflow_state_passes_user_declared_outputs_through_effective
     assert effective[0]["required"] is True
 
 
-def test_composer_save_helpers_create_and_rebind_agents(monkeypatch):
+def test_composer_save_helpers_create_and_rebind_agents(monkeypatch: pytest.MonkeyPatch):
     fake_session = FakeSession()
     monkeypatch.setattr(composer_service.db, "session", fake_session)
     workflow_agent = SimpleNamespace(id="inline-agent-1", active_config_snapshot_id="inline-version-1")
@@ -457,7 +460,126 @@ def test_composer_save_helpers_create_and_rebind_agents(monkeypatch):
     assert new_version_binding.current_snapshot_id == "new-version-1"
 
 
-def test_composer_create_agents_syncs_active_config_has_model(monkeypatch):
+def test_node_job_only_updates_inline_agent_soul(monkeypatch: pytest.MonkeyPatch):
+    fake_session = FakeSession()
+    monkeypatch.setattr(composer_service.db, "session", fake_session)
+    inline_agent = SimpleNamespace(
+        id="inline-agent-1",
+        scope=AgentScope.WORKFLOW_ONLY,
+        active_config_snapshot_id="inline-version-1",
+        active_config_has_model=False,
+        updated_by=None,
+    )
+    current_snapshot = AgentConfigSnapshot(
+        id="inline-version-1",
+        tenant_id="tenant-1",
+        agent_id="inline-agent-1",
+        version=1,
+        config_snapshot='{"prompt":{"system_prompt":"old"}}',
+    )
+    next_snapshot = AgentConfigSnapshot(
+        id="inline-version-2",
+        tenant_id="tenant-1",
+        agent_id="inline-agent-1",
+        version=2,
+    )
+
+    monkeypatch.setattr(AgentComposerService, "_require_version", lambda **kwargs: current_snapshot)
+    monkeypatch.setattr(AgentComposerService, "_update_current_version", lambda **kwargs: next_snapshot)
+    monkeypatch.setattr(AgentComposerService, "_require_agent", lambda **kwargs: inline_agent)
+
+    binding = WorkflowAgentNodeBinding(
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+        workflow_version="draft",
+        node_id="node-1",
+        binding_type=WorkflowAgentBindingType.INLINE_AGENT,
+        agent_id="inline-agent-1",
+        current_snapshot_id="inline-version-1",
+    )
+    payload = ComposerSavePayload.model_validate(
+        {
+            "variant": ComposerVariant.WORKFLOW.value,
+            "save_strategy": ComposerSaveStrategy.NODE_JOB_ONLY.value,
+            "agent_soul": {
+                "model": {
+                    "plugin_id": "langgenius/openai/openai",
+                    "model_provider": "openai",
+                    "model": "gpt-4o",
+                },
+                "prompt": {"system_prompt": "new"},
+            },
+            "node_job": {"workflow_prompt": "use prior output"},
+        }
+    )
+
+    updated_binding = AgentComposerService._save_node_job_only(
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+        node_id="node-1",
+        account_id="account-1",
+        binding=binding,
+        payload=payload,
+    )
+
+    assert updated_binding.current_snapshot_id == "inline-version-2"
+    assert updated_binding.node_job_config_dict["workflow_prompt"] == "use prior output"
+    assert updated_binding.updated_by == "account-1"
+    assert inline_agent.active_config_snapshot_id == "inline-version-2"
+    assert inline_agent.active_config_has_model is True
+    assert inline_agent.updated_by == "account-1"
+
+
+def test_node_job_only_rejects_inline_binding_pointing_to_roster_agent(monkeypatch: pytest.MonkeyPatch):
+    fake_session = FakeSession()
+    monkeypatch.setattr(composer_service.db, "session", fake_session)
+    current_snapshot = AgentConfigSnapshot(
+        id="inline-version-1",
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        version=1,
+        config_snapshot='{"prompt":{"system_prompt":"old"}}',
+    )
+    next_snapshot = AgentConfigSnapshot(id="inline-version-2", tenant_id="tenant-1", agent_id="agent-1", version=2)
+    roster_agent = SimpleNamespace(id="agent-1", scope=AgentScope.ROSTER)
+
+    monkeypatch.setattr(AgentComposerService, "_require_version", lambda **kwargs: current_snapshot)
+    monkeypatch.setattr(AgentComposerService, "_update_current_version", lambda **kwargs: next_snapshot)
+    monkeypatch.setattr(AgentComposerService, "_require_agent", lambda **kwargs: roster_agent)
+
+    binding = WorkflowAgentNodeBinding(
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+        workflow_version="draft",
+        node_id="node-1",
+        binding_type=WorkflowAgentBindingType.INLINE_AGENT,
+        agent_id="agent-1",
+        current_snapshot_id="inline-version-1",
+    )
+    payload = ComposerSavePayload.model_validate(
+        {
+            "variant": ComposerVariant.WORKFLOW.value,
+            "save_strategy": ComposerSaveStrategy.NODE_JOB_ONLY.value,
+            "agent_soul": {"prompt": {"system_prompt": "new"}},
+        }
+    )
+
+    with pytest.raises(ValueError, match="workflow-only agent"):
+        AgentComposerService._save_node_job_only(
+            tenant_id="tenant-1",
+            app_id="app-1",
+            workflow_id="workflow-1",
+            node_id="node-1",
+            account_id="account-1",
+            binding=binding,
+            payload=payload,
+        )
+
+
+def test_composer_create_agents_syncs_active_config_has_model(monkeypatch: pytest.MonkeyPatch):
     fake_session = FakeSession()
     monkeypatch.setattr(composer_service.db, "session", fake_session)
     monkeypatch.setattr(
@@ -489,7 +611,7 @@ def test_composer_create_agents_syncs_active_config_has_model(monkeypatch):
     assert roster_agent.active_config_has_model is True
 
 
-def test_composer_version_helpers_and_lookup_errors(monkeypatch):
+def test_composer_version_helpers_and_lookup_errors(monkeypatch: pytest.MonkeyPatch):
     fake_session = FakeSession(
         scalar=[
             1,
@@ -548,7 +670,7 @@ def test_composer_version_helpers_and_lookup_errors(monkeypatch):
     assert workflow.id == "workflow-1"
 
 
-def test_composer_current_version_and_error_paths(monkeypatch):
+def test_composer_current_version_and_error_paths(monkeypatch: pytest.MonkeyPatch):
     fake_session = FakeSession(scalar=[2])
     monkeypatch.setattr(composer_service.db, "session", fake_session)
     payload = ComposerSavePayload.model_validate(
@@ -595,7 +717,7 @@ def test_composer_current_version_and_error_paths(monkeypatch):
         )
 
 
-def test_roster_list_and_invite_options(monkeypatch):
+def test_roster_list_and_invite_options(monkeypatch: pytest.MonkeyPatch):
     created_at = datetime(2026, 1, 2, 3, 4, 5, tzinfo=UTC)
     updated_at = datetime(2026, 1, 3, 3, 4, 5, tzinfo=UTC)
     version_created_at = datetime(2026, 1, 4, 3, 4, 5, tzinfo=UTC)
@@ -649,6 +771,7 @@ def test_roster_list_and_invite_options(monkeypatch):
         lambda version_ids: {"version-1": version, "version-2": unconfigured_version},
     )
     monkeypatch.setattr(service, "_load_published_references_by_agent_id", lambda **kwargs: {})
+    monkeypatch.setattr(service, "_load_published_active_snapshot_agent_ids", lambda **kwargs: {"agent-1"})
 
     listed = service.list_roster_agents(tenant_id="tenant-1", page=1, limit=20)
     invited = service.list_invite_options(tenant_id="tenant-1", page=1, limit=20, app_id="app-1")
@@ -661,11 +784,13 @@ def test_roster_list_and_invite_options(monkeypatch):
     assert listed["data"][0]["created_at"] == int(created_at.timestamp())
     assert listed["data"][0]["updated_at"] == int(updated_at.timestamp())
     assert listed["data"][0]["active_config_snapshot"]["created_at"] == int(version_created_at.timestamp())
+    assert listed["data"][0]["active_config_is_published"] is True
+    assert listed["data"][1]["active_config_is_published"] is False
     assert invited["data"][0]["is_in_current_workflow"] is True
     assert invited["data"][0]["existing_node_ids"] == ["node-1"]
 
 
-def test_invite_options_uses_db_filtered_pagination(monkeypatch):
+def test_invite_options_uses_db_filtered_pagination(monkeypatch: pytest.MonkeyPatch):
     configured_agent = Agent(
         id="agent-2",
         tenant_id="tenant-1",
@@ -690,6 +815,7 @@ def test_invite_options_uses_db_filtered_pagination(monkeypatch):
         },
     )
     monkeypatch.setattr(service, "_load_published_references_by_agent_id", lambda **kwargs: {})
+    monkeypatch.setattr(service, "_load_published_active_snapshot_agent_ids", lambda **kwargs: set())
 
     result = service.list_invite_options(tenant_id="tenant-1", page=1, limit=1)
 
@@ -698,6 +824,41 @@ def test_invite_options_uses_db_filtered_pagination(monkeypatch):
     assert [item["id"] for item in result["data"]] == ["agent-2"]
 
 
+def test_active_config_is_published_flags_handle_matching_and_empty_snapshots():
+    agent = Agent(
+        id="agent-1",
+        tenant_id="tenant-1",
+        name="Published",
+        description="",
+        agent_kind=AgentKind.DIFY_AGENT,
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        status=AgentStatus.ACTIVE,
+        active_config_snapshot_id="version-1",
+    )
+    draft_agent = Agent(
+        id="agent-2",
+        tenant_id="tenant-1",
+        name="Draft",
+        description="",
+        agent_kind=AgentKind.DIFY_AGENT,
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        status=AgentStatus.ACTIVE,
+        active_config_snapshot_id=None,
+    )
+    service = AgentRosterService(FakeSession(scalars=[["agent-1"], ["agent-1"]]))
+
+    flags = service.load_active_config_is_published_by_agent_id(tenant_id="tenant-1", agents=[agent, draft_agent])
+
+    assert flags == {"agent-1": True, "agent-2": False}
+    assert service.active_config_is_published(tenant_id="tenant-1", agent=agent) is True
+    assert AgentRosterService(FakeSession()).load_active_config_is_published_by_agent_id(
+        tenant_id="tenant-1",
+        agents=[draft_agent],
+    ) == {"agent-2": False}
+
+
 def test_published_references_include_app_display_fields_and_sort_by_updated_at():
     recent_updated_at = datetime(2026, 1, 7, 3, 4, 5, tzinfo=UTC)
     stale_updated_at = datetime(2026, 1, 6, 3, 4, 5, tzinfo=UTC)
@@ -754,15 +915,17 @@ def test_published_references_include_app_display_fields_and_sort_by_updated_at(
     assert references[0]["workflow_version"] == "published-recent"
 
 
-def test_roster_update_archive_versions_and_detail(monkeypatch):
-    listed_version = AgentConfigSnapshot(id="version-2", agent_id="agent-1", version=2)
+def test_roster_update_archive_versions_and_detail(monkeypatch: pytest.MonkeyPatch):
+    listed_version = AgentConfigSnapshot(id="version-4", agent_id="agent-1", version=4)
     listed_version_created_at = datetime(2026, 1, 5, 3, 4, 5, tzinfo=UTC)
     listed_version.created_at = listed_version_created_at
+    older_listed_version = AgentConfigSnapshot(id="version-2", agent_id="agent-1", version=2)
+    older_listed_version.created_at = datetime(2026, 1, 4, 3, 4, 5, tzinfo=UTC)
     revision_created_at = datetime(2026, 1, 6, 3, 4, 5, tzinfo=UTC)
     revision = SimpleNamespace(
         id="revision-1",
         previous_snapshot_id=None,
-        current_snapshot_id="version-1",
+        current_snapshot_id="version-2",
         revision=1,
         operation=AgentConfigRevisionOperation.CREATE_VERSION,
         summary=None,
@@ -770,7 +933,10 @@ def test_roster_update_archive_versions_and_detail(monkeypatch):
         created_by="account-1",
         created_at=revision_created_at,
     )
-    fake_session = FakeSession(scalar=["visible-revision"], scalars=[[listed_version], [revision]])
+    fake_session = FakeSession(
+        scalar=["visible-revision"],
+        scalars=[[listed_version, older_listed_version], [older_listed_version, listed_version], [revision]],
+    )
     agent = Agent(
         id="agent-1",
         tenant_id="tenant-1",
@@ -781,7 +947,7 @@ def test_roster_update_archive_versions_and_detail(monkeypatch):
         source=AgentSource.AGENT_APP,
         status=AgentStatus.ACTIVE,
     )
-    version = AgentConfigSnapshot(id="version-1", agent_id="agent-1", version=1, config_snapshot='{"prompt":{}}')
+    version = AgentConfigSnapshot(id="version-2", agent_id="agent-1", version=2, config_snapshot='{"prompt":{}}')
     version.created_at = datetime(2026, 1, 4, 3, 4, 5, tzinfo=UTC)
 
     service = AgentRosterService(fake_session)
@@ -801,18 +967,27 @@ def test_roster_update_archive_versions_and_detail(monkeypatch):
     )
     service.archive_roster_agent(tenant_id="tenant-1", agent_id="agent-1", account_id="account-1")
     versions = service.list_agent_versions(tenant_id="tenant-1", agent_id="agent-1")
-    detail = service.get_agent_version_detail(tenant_id="tenant-1", agent_id="agent-1", version_id="version-1")
+    detail = service.get_agent_version_detail(tenant_id="tenant-1", agent_id="agent-1", version_id="version-2")
 
     assert updated["description"] == "new"
     assert agent.status == AgentStatus.ARCHIVED
-    assert versions[0]["id"] == "version-2"
+    assert versions[0]["id"] == "version-4"
+    assert versions[0]["version"] == 2
+    assert versions[0]["display_version"] == 2
+    assert versions[0]["snapshot_version"] == 4
+    assert versions[1]["id"] == "version-2"
+    assert versions[1]["version"] == 1
+    assert versions[1]["snapshot_version"] == 2
     assert versions[0]["created_at"] == int(listed_version_created_at.timestamp())
+    assert detail["version"] == 1
+    assert detail["display_version"] == 1
+    assert detail["snapshot_version"] == 2
     assert detail["config_snapshot"] == {"prompt": {}}
     assert detail["created_at"] == int(version.created_at.timestamp())
     assert detail["revisions"][0]["created_at"] == int(revision_created_at.timestamp())
 
 
-def test_roster_create_detail_and_lookup_helpers(monkeypatch):
+def test_roster_create_detail_and_lookup_helpers(monkeypatch: pytest.MonkeyPatch):
     fake_session = FakeSession(
         scalar=[
             SimpleNamespace(id="agent-1"),
@@ -879,9 +1054,7 @@ def test_agent_app_visible_versions_exclude_draft_saves():
 
 def test_app_list_all_excludes_agent_apps_by_default():
     filters = AppService._build_app_list_filters(
-        "account-1",
-        "tenant-1",
-        AppListParams(mode="all"),
+        "account-1", "tenant-1", AppListParams(mode="all"), FakeSession(scalar=None, scalars=None)
     )
     sql = " ".join(str(filter_) for filter_ in filters)
 
@@ -1042,7 +1215,7 @@ def test_composer_validator_accepts_valid_shell_env_and_cli():
         {
             "env": {
                 "variables": [{"name": "MY_VAR", "value": "v"}],
-                "secret_refs": [{"name": "API_TOKEN", "id": "credential-1"}],
+                "secret_refs": [{"name": "API_TOKEN", "value": "credential-1"}],
             },
             "tools": {
                 "cli_tools": [
@@ -1051,7 +1224,7 @@ def test_composer_validator_accepts_valid_shell_env_and_cli():
                         "command": "apt-get install -y jq",
                         "env": {
                             "variables": [{"name": "JQ_COLOR", "value": "1"}],
-                            "secret_refs": [{"name": "JQ_TOKEN", "id": "credential-2"}],
+                            "secret_refs": [{"name": "JQ_TOKEN", "value": "credential-2"}],
                         },
                     },
                     {
@@ -1067,8 +1240,10 @@ def test_composer_validator_accepts_valid_shell_env_and_cli():
     )
     assert {variable.name for variable in config.env.variables} == {"MY_VAR"}
     assert {secret.name for secret in config.env.secret_refs} == {"API_TOKEN"}
+    assert config.env.secret_refs[0].value == "credential-1"
     assert config.tools.cli_tools[0].env.variables[0].name == "JQ_COLOR"
     assert config.tools.cli_tools[0].env.secret_refs[0].name == "JQ_TOKEN"
+    assert config.tools.cli_tools[0].env.secret_refs[0].value == "credential-2"
 
 
 class TestAgentAppBackingAgent:
@@ -1086,6 +1261,7 @@ class TestAgentAppBackingAgent:
             app_id="app-1",
             name="Iris",
             description="clarifier",
+            role="research assistant",
         )
 
         # Agent is bound to the app and is a roster/agent_app entry.
@@ -1095,6 +1271,7 @@ class TestAgentAppBackingAgent:
         assert agent.status == AgentStatus.ACTIVE
         assert agent.agent_kind == AgentKind.DIFY_AGENT
         assert agent.name == "Iris"
+        assert agent.role == "research assistant"
         # A v1 snapshot + revision are seeded and wired as the active version.
         snapshots = [a for a in session.added if isinstance(a, AgentConfigSnapshot)]
         assert len(snapshots) == 1
@@ -1147,6 +1324,267 @@ class TestAgentAppBackingAgent:
         with pytest.raises(roster_service.AgentNotFoundError):
             service.get_agent_app_model(tenant_id="tenant-1", agent_id="agent-x")
 
+    def test_duplicate_agent_app_copies_app_config_and_active_soul(self, monkeypatch: pytest.MonkeyPatch):
+        source_config = SimpleNamespace(
+            opening_statement="hello",
+            suggested_questions='["q1"]',
+            suggested_questions_after_answer='{"enabled": true}',
+            speech_to_text='{"enabled": false}',
+            text_to_speech='{"enabled": false}',
+            more_like_this='{"enabled": false}',
+            model=None,
+            user_input_form=None,
+            dataset_query_variable=None,
+            pre_prompt=None,
+            agent_mode=None,
+            sensitive_word_avoidance=None,
+            retriever_resource='{"enabled": true}',
+            prompt_type="simple",
+            chat_prompt_config=None,
+            completion_prompt_config=None,
+            dataset_configs=None,
+            external_data_tools=None,
+            file_upload='{"image": {"enabled": true}}',
+        )
+        target_config = SimpleNamespace(**dict.fromkeys(AgentRosterService._APP_MODEL_CONFIG_COPY_FIELDS))
+        source_app = SimpleNamespace(
+            id="source-app",
+            tenant_id="tenant-1",
+            name="Iris",
+            description="source desc",
+            icon_type="emoji",
+            icon="robot",
+            icon_background="#fff",
+            api_rph=1,
+            api_rpm=2,
+            max_active_requests=3,
+            enable_site=False,
+            enable_api=True,
+            use_icon_as_answer_icon=True,
+            tracing="{}",
+            app_model_config=source_config,
+        )
+        target_app = SimpleNamespace(
+            id="target-app",
+            app_model_config=target_config,
+            enable_site=True,
+            enable_api=True,
+            use_icon_as_answer_icon=False,
+            tracing=None,
+        )
+        source_agent = Agent(
+            id="source-agent",
+            tenant_id="tenant-1",
+            name="Iris",
+            description="source desc",
+            role="Analyst",
+            agent_kind=AgentKind.DIFY_AGENT,
+            scope=AgentScope.ROSTER,
+            source=AgentSource.AGENT_APP,
+            status=AgentStatus.ACTIVE,
+            app_id="source-app",
+            active_config_snapshot_id="source-version",
+            active_config_has_model=True,
+        )
+        target_agent = Agent(
+            id="target-agent",
+            tenant_id="tenant-1",
+            name="Iris copy",
+            description="source desc",
+            role="Analyst",
+            agent_kind=AgentKind.DIFY_AGENT,
+            scope=AgentScope.ROSTER,
+            source=AgentSource.AGENT_APP,
+            status=AgentStatus.ACTIVE,
+            app_id="target-app",
+            active_config_snapshot_id="target-version",
+        )
+        source_version = AgentConfigSnapshot(
+            id="source-version",
+            tenant_id="tenant-1",
+            agent_id="source-agent",
+            version=1,
+            config_snapshot=_agent_soul_with_model(),
+            summary="configured",
+            version_note="v1",
+            created_by="account-1",
+        )
+        target_version = AgentConfigSnapshot(
+            id="target-version",
+            tenant_id="tenant-1",
+            agent_id="target-agent",
+            version=1,
+            config_snapshot=AgentSoulConfig(),
+            created_by="account-1",
+        )
+        session = FakeSession(
+            scalar=[source_agent, source_app, source_agent, target_agent, source_version, target_version],
+            scalars=[[]],
+        )
+        captured: dict[str, object] = {}
+
+        class FakeAppService:
+            def create_app(self, tenant_id: str, params, account: object) -> object:
+                captured["tenant_id"] = tenant_id
+                captured["params"] = params
+                captured["account"] = account
+                return target_app
+
+        monkeypatch.setattr(roster_service, "AppService", FakeAppService)
+        monkeypatch.setattr(
+            roster_service.FeatureService,
+            "get_system_features",
+            lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=False)),
+        )
+
+        account = SimpleNamespace(id="account-1")
+        duplicated = AgentRosterService(session).duplicate_agent_app(
+            tenant_id="tenant-1",
+            agent_id="source-agent",
+            account=account,
+        )
+
+        assert duplicated is target_app
+        params = captured["params"]
+        assert params.name == "Iris copy"
+        assert params.mode == "agent"
+        assert params.agent_role == "Analyst"
+        assert target_app.enable_site is False
+        assert target_app.enable_api is True
+        assert target_app.use_icon_as_answer_icon is True
+        assert target_app.tracing == "{}"
+        assert target_config.opening_statement == "hello"
+        assert target_config.file_upload == '{"image": {"enabled": true}}'
+        assert target_config.updated_by == "account-1"
+        assert target_version.config_snapshot.model.model == "gpt-4o"
+        assert target_version.summary == "configured"
+        assert target_version.version_note == "v1"
+        assert target_agent.active_config_has_model is True
+        assert target_agent.updated_by == "account-1"
+        assert session.commits == 1
+
+    def test_duplicate_agent_app_inherits_webapp_access_mode(self, monkeypatch: pytest.MonkeyPatch):
+        source_app = SimpleNamespace(
+            id="source-app",
+            tenant_id="tenant-1",
+            name="Iris",
+            description="source desc",
+            icon_type=None,
+            icon="robot",
+            icon_background="#fff",
+            api_rph=1,
+            api_rpm=2,
+            max_active_requests=3,
+            enable_site=True,
+            enable_api=True,
+            use_icon_as_answer_icon=False,
+            tracing=None,
+        )
+        source_agent = SimpleNamespace(id="source-agent", role="Analyst")
+        target_app = SimpleNamespace(id="target-app")
+        session = FakeSession()
+        service = AgentRosterService(session)
+        monkeypatch.setattr(service, "get_agent_app_model", lambda **_: source_app)
+        monkeypatch.setattr(service, "get_app_backing_agent", lambda **_: source_agent)
+        monkeypatch.setattr(service, "_copy_app_model_config", lambda **_: None)
+        monkeypatch.setattr(service, "_copy_agent_active_snapshot", lambda **_: None)
+        monkeypatch.setattr(service, "_next_duplicate_agent_name", lambda **_: "Iris copy")
+
+        class FakeAppService:
+            def create_app(self, tenant_id: str, params, account: object) -> object:
+                return target_app
+
+        access_mode_updates = []
+
+        class FakeWebAppAuth:
+            @classmethod
+            def get_app_access_mode_by_id(cls, app_id: str) -> object:
+                return SimpleNamespace(access_mode="private")
+
+            @classmethod
+            def update_app_access_mode(cls, app_id: str, access_mode: str) -> None:
+                access_mode_updates.append((app_id, access_mode))
+
+        monkeypatch.setattr(roster_service, "AppService", FakeAppService)
+        monkeypatch.setattr(
+            roster_service.FeatureService,
+            "get_system_features",
+            lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=True)),
+        )
+        monkeypatch.setattr(roster_service.EnterpriseService, "WebAppAuth", FakeWebAppAuth)
+
+        duplicated = service.duplicate_agent_app(
+            tenant_id="tenant-1",
+            agent_id="source-agent",
+            account=SimpleNamespace(id="account-1"),
+        )
+
+        assert duplicated is target_app
+        assert access_mode_updates == [("target-app", "private")]
+
+    def test_duplicate_agent_app_falls_back_to_public_access_mode(self, monkeypatch: pytest.MonkeyPatch):
+        source_app = SimpleNamespace(
+            id="source-app",
+            tenant_id="tenant-1",
+            name="Iris",
+            description="source desc",
+            icon_type=IconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            api_rph=1,
+            api_rpm=2,
+            max_active_requests=3,
+            enable_site=True,
+            enable_api=True,
+            use_icon_as_answer_icon=False,
+            tracing=None,
+        )
+        source_agent = SimpleNamespace(id="source-agent", role="Analyst")
+        target_app = SimpleNamespace(id="target-app")
+        session = FakeSession()
+        service = AgentRosterService(session)
+        monkeypatch.setattr(service, "get_agent_app_model", lambda **_: source_app)
+        monkeypatch.setattr(service, "get_app_backing_agent", lambda **_: source_agent)
+        monkeypatch.setattr(service, "_copy_app_model_config", lambda **_: None)
+        monkeypatch.setattr(service, "_copy_agent_active_snapshot", lambda **_: None)
+        monkeypatch.setattr(service, "_next_duplicate_agent_name", lambda **_: "Iris copy")
+
+        class FakeAppService:
+            def create_app(self, tenant_id: str, params, account: object) -> object:
+                return target_app
+
+        access_mode_updates = []
+
+        class FakeWebAppAuth:
+            @classmethod
+            def get_app_access_mode_by_id(cls, app_id: str) -> object:
+                raise ValueError("not found")
+
+            @classmethod
+            def update_app_access_mode(cls, app_id: str, access_mode: str) -> None:
+                access_mode_updates.append((app_id, access_mode))
+
+        monkeypatch.setattr(roster_service, "AppService", FakeAppService)
+        monkeypatch.setattr(
+            roster_service.FeatureService,
+            "get_system_features",
+            lambda: SimpleNamespace(webapp_auth=SimpleNamespace(enabled=True)),
+        )
+        monkeypatch.setattr(roster_service.EnterpriseService, "WebAppAuth", FakeWebAppAuth)
+
+        service.duplicate_agent_app(
+            tenant_id="tenant-1",
+            agent_id="source-agent",
+            account=SimpleNamespace(id="account-1"),
+        )
+
+        assert access_mode_updates == [("target-app", "public")]
+
+    def test_normalize_app_icon_type(self):
+        assert AgentRosterService._normalize_app_icon_type(None) is None
+        assert AgentRosterService._normalize_app_icon_type(IconType.EMOJI) == "emoji"
+        assert AgentRosterService._normalize_app_icon_type("image") == "image"
+
 
 class TestListWorkflowsReferencingAppAgent:
     def test_groups_bindings_by_workflow_app_and_sorts_by_name(self):
@@ -1263,7 +1701,22 @@ class TestWorkflowAgentDraftBindingSync:
             node_job_config=WorkflowNodeJobConfig(
                 workflow_prompt="Summarize the upstream result.",
                 declared_outputs=[
-                    DeclaredOutputConfig(name="summary", type=DeclaredOutputType.STRING, description="Short summary")
+                    DeclaredOutputConfig(name="summary", type=DeclaredOutputType.STRING, description="Short summary"),
+                    DeclaredOutputConfig(
+                        name="profile",
+                        type=DeclaredOutputType.OBJECT,
+                        children=[
+                            DeclaredOutputChildConfig(name="email", type=DeclaredOutputType.STRING),
+                            DeclaredOutputChildConfig(
+                                name="addresses",
+                                type=DeclaredOutputType.ARRAY,
+                                array_item=DeclaredArrayItem(
+                                    type=DeclaredOutputType.OBJECT,
+                                    children=[DeclaredOutputChildConfig(name="city", type=DeclaredOutputType.STRING)],
+                                ),
+                            ),
+                        ],
+                    ),
                 ],
             ),
         )
@@ -1279,6 +1732,9 @@ class TestWorkflowAgentDraftBindingSync:
         assert node_data["agent_declared_outputs"][0]["name"] == "summary"
         assert node_data["agent_declared_outputs"][0]["type"] == "string"
         assert node_data["agent_declared_outputs"][0]["description"] == "Short summary"
+        profile_output = node_data["agent_declared_outputs"][1]
+        assert profile_output["children"][0]["name"] == "email"
+        assert profile_output["children"][1]["array_item"]["children"][0]["name"] == "city"
         assert "agent_declared_outputs" not in workflow.graph_dict["nodes"][0]["data"]
 
     def test_creates_roster_binding_from_agent_node_graph(self):
@@ -1731,7 +2187,7 @@ class TestWorkflowAgentDraftBindingSync:
         assert session.deleted == [stale_binding]
 
 
-def test_dataset_rows_filters_malformed_ids(monkeypatch):
+def test_dataset_rows_filters_malformed_ids(monkeypatch: pytest.MonkeyPatch):
     """Mention ids are user-editable text: a non-UUID id must read as missing
     (placeholder semantics), never reach the UUID-typed dataset query (E2E 500)."""
     captured = {}
@@ -1755,7 +2211,7 @@ def test_dataset_rows_filters_malformed_ids(monkeypatch):
     assert captured == {}
 
 
-def test_workspace_dify_tools_returns_provider_and_tool_granularities(monkeypatch):
+def test_workspace_dify_tools_returns_provider_and_tool_granularities(monkeypatch: pytest.MonkeyPatch):
     """The slash-menu Tools tab needs both selection granularities: a provider
     hosts many tools (like an MCP server), so candidates return one
     provider-level entry (id = <provider>/*, = all tools) plus one per tool."""
@@ -1826,7 +2282,7 @@ def _patch_drive_keys(monkeypatch, existing_keys):
     return captured
 
 
-def test_drive_ref_findings_reports_missing_keys(monkeypatch):
+def test_drive_ref_findings_reports_missing_keys(monkeypatch: pytest.MonkeyPatch):
     _patch_drive_keys(monkeypatch, existing_keys=["tender-analyzer/SKILL.md"])
 
     findings = AgentComposerService._drive_ref_findings(
@@ -1837,7 +2293,7 @@ def test_drive_ref_findings_reports_missing_keys(monkeypatch):
     assert str(findings[0]["message"]).startswith("file_ref_dangling: ")
 
 
-def test_drive_ref_findings_clean_when_all_keys_exist(monkeypatch):
+def test_drive_ref_findings_clean_when_all_keys_exist(monkeypatch: pytest.MonkeyPatch):
     _patch_drive_keys(monkeypatch, existing_keys=["tender-analyzer/SKILL.md", "files/sample.pdf"])
 
     assert (
@@ -1846,7 +2302,7 @@ def test_drive_ref_findings_clean_when_all_keys_exist(monkeypatch):
     )
 
 
-def test_drive_ref_findings_skips_refs_without_drive_keys(monkeypatch):
+def test_drive_ref_findings_skips_refs_without_drive_keys(monkeypatch: pytest.MonkeyPatch):
     # No drive-backed ref at all -> no DB roundtrip, no findings.
     soul = _drive_soul(
         skills_files={"skills": [{"id": "legacy", "name": "Legacy"}], "files": [{"name": "u.pdf", "file_id": "u-1"}]}
@@ -1855,7 +2311,7 @@ def test_drive_ref_findings_skips_refs_without_drive_keys(monkeypatch):
     assert findings == []
 
 
-def test_require_drive_refs_resolved_raises_with_stable_code(monkeypatch):
+def test_require_drive_refs_resolved_raises_with_stable_code(monkeypatch: pytest.MonkeyPatch):
     from services.agent.errors import InvalidComposerConfigError
 
     _patch_drive_keys(monkeypatch, existing_keys=[])
@@ -1866,7 +2322,7 @@ def test_require_drive_refs_resolved_raises_with_stable_code(monkeypatch):
         )
 
 
-def test_collect_validation_findings_appends_drive_findings_with_agent_context(monkeypatch):
+def test_collect_validation_findings_appends_drive_findings_with_agent_context(monkeypatch: pytest.MonkeyPatch):
     from services.entities.agent_entities import ComposerSavePayload
 
     _patch_drive_keys(monkeypatch, existing_keys=[])
@@ -1892,7 +2348,7 @@ def test_collect_validation_findings_appends_drive_findings_with_agent_context(m
 # ── ENG-625 D5: soul-first ref removal ───────────────────────────────────────
 
 
-def _patch_remove_drive_refs_env(monkeypatch, *, soul_dict):
+def _patch_remove_drive_refs_env(monkeypatch: pytest.MonkeyPatch, *, soul_dict):
     """Wire the classmethod's collaborators so soul editing + versioning is observable."""
     from types import SimpleNamespace
 
@@ -1917,7 +2373,7 @@ def _patch_remove_drive_refs_env(monkeypatch, *, soul_dict):
     return agent, captured, committed
 
 
-def test_remove_drive_refs_drops_skill_by_slug_and_versions(monkeypatch):
+def test_remove_drive_refs_drops_skill_by_slug_and_versions(monkeypatch: pytest.MonkeyPatch):
     soul_dict = {
         "skills_files": {
             "skills": [
@@ -1941,7 +2397,7 @@ def test_remove_drive_refs_drops_skill_by_slug_and_versions(monkeypatch):
     assert committed.get("committed") is True
 
 
-def test_remove_drive_refs_is_noop_when_ref_absent(monkeypatch):
+def test_remove_drive_refs_is_noop_when_ref_absent(monkeypatch: pytest.MonkeyPatch):
     soul_dict = {"skills_files": {"skills": [], "files": []}}
     agent, captured, committed = _patch_remove_drive_refs_env(monkeypatch, soul_dict=soul_dict)
 
@@ -1955,7 +2411,7 @@ def test_remove_drive_refs_is_noop_when_ref_absent(monkeypatch):
     assert committed == {}
 
 
-def test_remove_drive_refs_drops_file_by_key(monkeypatch):
+def test_remove_drive_refs_drops_file_by_key(monkeypatch: pytest.MonkeyPatch):
     soul_dict = {
         "skills_files": {
             "skills": [],
@@ -1975,7 +2431,7 @@ def test_remove_drive_refs_drops_file_by_key(monkeypatch):
     assert [f.drive_key for f in captured["agent_soul"].skills_files.files] == ["files/keep.pdf"]
 
 
-def test_add_drive_file_ref_adds_or_replaces_file_and_versions(monkeypatch):
+def test_add_drive_file_ref_adds_or_replaces_file_and_versions(monkeypatch: pytest.MonkeyPatch):
     soul_dict = {
         "skills_files": {
             "skills": [],
@@ -2002,7 +2458,7 @@ def test_add_drive_file_ref_adds_or_replaces_file_and_versions(monkeypatch):
     assert committed.get("committed") is True
 
 
-def test_add_drive_file_ref_syncs_workflow_binding_snapshot(monkeypatch):
+def test_add_drive_file_ref_syncs_workflow_binding_snapshot(monkeypatch: pytest.MonkeyPatch):
     binding = SimpleNamespace(agent_id="agent-1", current_snapshot_id="snap-1", updated_by=None)
     _patch_remove_drive_refs_env(monkeypatch, soul_dict={"skills_files": {"skills": [], "files": []}})
     monkeypatch.setattr(
@@ -2031,7 +2487,7 @@ def test_remove_drive_refs_requires_exactly_one_scope():
 # ── ENG-623/625: resolver helpers + save-path drive guard ────────────────────
 
 
-def test_resolve_bound_agent_id_queries_active_roster_agent(monkeypatch):
+def test_resolve_bound_agent_id_queries_active_roster_agent(monkeypatch: pytest.MonkeyPatch):
     from types import SimpleNamespace
 
     import services.agent.composer_service as module
@@ -2040,7 +2496,7 @@ def test_resolve_bound_agent_id_queries_active_roster_agent(monkeypatch):
     assert AgentComposerService.resolve_bound_agent_id(tenant_id="t-1", app_id="app-1") == "agent-9"
 
 
-def test_resolve_workflow_node_agent_id_degrades_without_workflow_or_binding(monkeypatch):
+def test_resolve_workflow_node_agent_id_degrades_without_workflow_or_binding(monkeypatch: pytest.MonkeyPatch):
     from types import SimpleNamespace
 
     def boom(cls, **kwargs):
@@ -2063,7 +2519,7 @@ def test_resolve_workflow_node_agent_id_degrades_without_workflow_or_binding(mon
     assert AgentComposerService.resolve_workflow_node_agent_id(tenant_id="t", app_id="a", node_id="n") == "agent-7"
 
 
-def test_remove_drive_refs_returns_none_without_agent_or_snapshot(monkeypatch):
+def test_remove_drive_refs_returns_none_without_agent_or_snapshot(monkeypatch: pytest.MonkeyPatch):
     from types import SimpleNamespace
 
     import services.agent.composer_service as module
@@ -2076,7 +2532,7 @@ def test_remove_drive_refs_returns_none_without_agent_or_snapshot(monkeypatch):
     assert AgentComposerService.remove_drive_refs(tenant_id="t", agent_id="a", account_id="u", skill_slug="s") is None
 
 
-def test_save_workflow_composer_guards_drive_refs_for_existing_agent_strategies(monkeypatch):
+def test_save_workflow_composer_guards_drive_refs_for_existing_agent_strategies(monkeypatch: pytest.MonkeyPatch):
     from types import SimpleNamespace
 
     from services.entities.agent_entities import ComposerSavePayload
@@ -2114,7 +2570,118 @@ def test_save_workflow_composer_guards_drive_refs_for_existing_agent_strategies(
     assert guarded["agent_id"] == "agent-1"
 
 
-def test_remove_drive_refs_noop_when_skill_slug_unmatched(monkeypatch):
+def test_save_workflow_composer_guards_drive_refs_for_inline_node_job_only(monkeypatch: pytest.MonkeyPatch):
+    payload = ComposerSavePayload.model_validate(
+        {
+            "variant": "workflow",
+            "save_strategy": "node_job_only",
+            "agent_soul": _drive_soul().model_dump(mode="json"),
+            "soul_lock": {"locked": False},
+        }
+    )
+    binding = WorkflowAgentNodeBinding(
+        tenant_id="t-1",
+        app_id="app-1",
+        workflow_id="wf-1",
+        workflow_version="draft",
+        node_id="n-1",
+        binding_type=WorkflowAgentBindingType.INLINE_AGENT,
+        agent_id="agent-1",
+        current_snapshot_id="version-1",
+    )
+    monkeypatch.setattr(composer_service.db, "session", FakeSession())
+    monkeypatch.setattr(
+        AgentComposerService, "_get_draft_workflow", classmethod(lambda cls, **kwargs: SimpleNamespace(id="wf-1"))
+    )
+    monkeypatch.setattr(AgentComposerService, "_get_workflow_binding", classmethod(lambda cls, **kwargs: binding))
+    monkeypatch.setattr(AgentComposerService, "_save_node_job_only", classmethod(lambda cls, **kwargs: binding))
+    monkeypatch.setattr(
+        AgentComposerService,
+        "_get_agent_if_present",
+        classmethod(lambda cls, **kwargs: SimpleNamespace(id="agent-1", active_config_snapshot_id="version-1")),
+    )
+    monkeypatch.setattr(
+        AgentComposerService,
+        "_get_version_if_present",
+        classmethod(lambda cls, **kwargs: SimpleNamespace(id="version-1")),
+    )
+    monkeypatch.setattr(
+        AgentComposerService, "_serialize_workflow_state", classmethod(lambda cls, **kwargs: {"state": "ok"})
+    )
+    monkeypatch.setattr(
+        AgentComposerService, "collect_validation_findings", classmethod(lambda cls, **kwargs: {"warnings": []})
+    )
+    guarded: dict[str, str] = {}
+
+    def fake_guard(cls, *, tenant_id, agent_id, agent_soul):
+        guarded["tenant_id"] = tenant_id
+        guarded["agent_id"] = agent_id
+
+    monkeypatch.setattr(AgentComposerService, "_require_drive_refs_resolved", classmethod(fake_guard))
+
+    result = AgentComposerService.save_workflow_composer(
+        tenant_id="t-1", app_id="app-1", node_id="n-1", account_id="acc-1", payload=payload
+    )
+
+    assert result == {"state": "ok", "validation": {"warnings": []}}
+    assert guarded == {"tenant_id": "t-1", "agent_id": "agent-1"}
+
+
+def test_save_workflow_composer_skips_drive_refs_for_roster_node_job_only(monkeypatch: pytest.MonkeyPatch):
+    payload = ComposerSavePayload.model_validate(
+        {
+            "variant": "workflow",
+            "save_strategy": "node_job_only",
+            "agent_soul": _drive_soul().model_dump(mode="json"),
+            "soul_lock": {"locked": False},
+        }
+    )
+    binding = WorkflowAgentNodeBinding(
+        tenant_id="t-1",
+        app_id="app-1",
+        workflow_id="wf-1",
+        workflow_version="draft",
+        node_id="n-1",
+        binding_type=WorkflowAgentBindingType.ROSTER_AGENT,
+        agent_id="agent-1",
+        current_snapshot_id="version-1",
+    )
+    monkeypatch.setattr(composer_service.db, "session", FakeSession())
+    monkeypatch.setattr(
+        AgentComposerService, "_get_draft_workflow", classmethod(lambda cls, **kwargs: SimpleNamespace(id="wf-1"))
+    )
+    monkeypatch.setattr(AgentComposerService, "_get_workflow_binding", classmethod(lambda cls, **kwargs: binding))
+    monkeypatch.setattr(AgentComposerService, "_save_node_job_only", classmethod(lambda cls, **kwargs: binding))
+    monkeypatch.setattr(
+        AgentComposerService,
+        "_get_agent_if_present",
+        classmethod(lambda cls, **kwargs: SimpleNamespace(id="agent-1", active_config_snapshot_id="version-1")),
+    )
+    monkeypatch.setattr(
+        AgentComposerService,
+        "_get_version_if_present",
+        classmethod(lambda cls, **kwargs: SimpleNamespace(id="version-1")),
+    )
+    monkeypatch.setattr(
+        AgentComposerService, "_serialize_workflow_state", classmethod(lambda cls, **kwargs: {"state": "ok"})
+    )
+    monkeypatch.setattr(
+        AgentComposerService, "collect_validation_findings", classmethod(lambda cls, **kwargs: {"warnings": []})
+    )
+
+    def fail_guard(cls, *, tenant_id, agent_id, agent_soul):
+        raise AssertionError("roster node-job-only saves must not validate agent drive refs")
+
+    monkeypatch.setattr(AgentComposerService, "_require_drive_refs_resolved", classmethod(fail_guard))
+
+    result = AgentComposerService.save_workflow_composer(
+        tenant_id="t-1", app_id="app-1", node_id="n-1", account_id="acc-1", payload=payload
+    )
+
+    assert result == {"state": "ok", "validation": {"warnings": []}}
+
+
+def test_remove_drive_refs_noop_when_skill_slug_unmatched(monkeypatch: pytest.MonkeyPatch):
     soul_dict = {"skills_files": {"skills": [{"name": "Other", "skill_md_key": "other/SKILL.md"}], "files": []}}
     _, captured, committed = _patch_remove_drive_refs_env(monkeypatch, soul_dict=soul_dict)
     assert (
diff --git a/api/tests/unit_tests/services/agent/test_skill_tool_inference_service.py b/api/tests/unit_tests/services/agent/test_skill_tool_inference_service.py
index cd708127ae7..c0b6e6490f4 100644
--- a/api/tests/unit_tests/services/agent/test_skill_tool_inference_service.py
+++ b/api/tests/unit_tests/services/agent/test_skill_tool_inference_service.py
@@ -33,7 +33,7 @@ def _patch_soul_files(monkeypatch, files):
     monkeypatch.setattr(SkillToolInferenceService, "_manifest_files_from_soul", staticmethod(lambda **kwargs: files))
 
 
-def test_infer_returns_suggestions_with_inferred_from(monkeypatch):
+def test_infer_returns_suggestions_with_inferred_from(monkeypatch: pytest.MonkeyPatch):
     service, drive = _service()
     _patch_soul_files(monkeypatch, ["SKILL.md", "scripts/transcribe.sh"])
     raw = (
@@ -53,7 +53,7 @@ def test_infer_returns_suggestions_with_inferred_from(monkeypatch):
     drive.preview.assert_called_once_with(tenant_id="t-1", agent_id="a-1", key="audio-transcribe/SKILL.md")
 
 
-def test_infer_threads_manifest_files_into_the_prompt(monkeypatch):
+def test_infer_threads_manifest_files_into_the_prompt(monkeypatch: pytest.MonkeyPatch):
     service, _ = _service()
     _patch_soul_files(monkeypatch, ["scripts/run.sh"])
     captured: dict[str, str] = {}
@@ -69,7 +69,7 @@ def test_infer_threads_manifest_files_into_the_prompt(monkeypatch):
     assert "ffmpeg" in captured["prompt"]  # SKILL.md body present
 
 
-def test_infer_not_inferable_passes_reason_through(monkeypatch):
+def test_infer_not_inferable_passes_reason_through(monkeypatch: pytest.MonkeyPatch):
     service, _ = _service()
     _patch_soul_files(monkeypatch, [])
     raw = '{"inferable": false, "cli_tools": [], "reason": "SKILL.md 未描述任何外部命令依赖"}'
@@ -78,7 +78,7 @@ def test_infer_not_inferable_passes_reason_through(monkeypatch):
     assert result == {"inferable": False, "cli_tools": [], "reason": "SKILL.md 未描述任何外部命令依赖"}
 
 
-def test_infer_retries_once_then_422(monkeypatch):
+def test_infer_retries_once_then_422(monkeypatch: pytest.MonkeyPatch):
     service, _ = _service()
     _patch_soul_files(monkeypatch, [])
     calls: list[int] = []
@@ -96,7 +96,7 @@ def test_infer_retries_once_then_422(monkeypatch):
     assert exc_info.value.status_code == 422
 
 
-def test_infer_repairs_slightly_malformed_json(monkeypatch):
+def test_infer_repairs_slightly_malformed_json(monkeypatch: pytest.MonkeyPatch):
     service, _ = _service()
     _patch_soul_files(monkeypatch, [])
     raw = 'Here you go: {"inferable": true, "cli_tools": [], "reason": null,}'
@@ -126,7 +126,7 @@ def test_binary_skill_md_maps_to_404():
 # ── real-path coverage: _invoke / _manifest_files_from_soul / passthrough ────
 
 
-def test_invoke_maps_missing_default_model_to_400(monkeypatch):
+def test_invoke_maps_missing_default_model_to_400(monkeypatch: pytest.MonkeyPatch):
     import services.agent.skill_tool_inference_service as module
     from core.errors.error import ProviderTokenNotInitError
 
@@ -140,7 +140,7 @@ def test_invoke_maps_missing_default_model_to_400(monkeypatch):
     assert exc_info.value.status_code == 400
 
 
-def test_invoke_maps_model_failure_to_422_and_success_returns_text(monkeypatch):
+def test_invoke_maps_model_failure_to_422_and_success_returns_text(monkeypatch: pytest.MonkeyPatch):
     import services.agent.skill_tool_inference_service as module
 
     fake_manager = MagicMock()
@@ -173,7 +173,7 @@ def test_load_skill_md_passes_through_non_missing_drive_errors():
     assert exc_info.value.code == "agent_not_found"
 
 
-def _patch_inference_db(monkeypatch, *, agent, snapshot):
+def _patch_inference_db(monkeypatch: pytest.MonkeyPatch, *, agent, snapshot):
     from types import SimpleNamespace
 
     import services.agent.skill_tool_inference_service as module
@@ -182,7 +182,7 @@ def _patch_inference_db(monkeypatch, *, agent, snapshot):
     monkeypatch.setattr(module.db, "session", SimpleNamespace(scalar=lambda stmt: next(results)))
 
 
-def test_manifest_files_from_soul_reads_active_snapshot(monkeypatch):
+def test_manifest_files_from_soul_reads_active_snapshot(monkeypatch: pytest.MonkeyPatch):
     from types import SimpleNamespace
 
     soul_dict = {
@@ -203,7 +203,7 @@ def test_manifest_files_from_soul_reads_active_snapshot(monkeypatch):
     assert files == ["scripts/a.sh"]
 
 
-def test_manifest_files_from_soul_degrades_when_agent_or_snapshot_missing(monkeypatch):
+def test_manifest_files_from_soul_degrades_when_agent_or_snapshot_missing(monkeypatch: pytest.MonkeyPatch):
     _patch_inference_db(monkeypatch, agent=None, snapshot=None)
     assert SkillToolInferenceService._manifest_files_from_soul(tenant_id="t", agent_id="a", slug="s") == []
 
@@ -213,7 +213,7 @@ def test_manifest_files_from_soul_degrades_when_agent_or_snapshot_missing(monkey
     assert SkillToolInferenceService._manifest_files_from_soul(tenant_id="t", agent_id="a", slug="s") == []
 
 
-def test_manifest_files_from_soul_empty_when_slug_not_in_soul(monkeypatch):
+def test_manifest_files_from_soul_empty_when_slug_not_in_soul(monkeypatch: pytest.MonkeyPatch):
     from types import SimpleNamespace
 
     soul_dict = {"skills_files": {"skills": [{"name": "Other", "skill_md_key": "other/SKILL.md"}]}}
diff --git a/api/tests/unit_tests/services/auth/test_firecrawl_auth.py b/api/tests/unit_tests/services/auth/test_firecrawl_auth.py
index 1458180570d..1369ff2ba05 100644
--- a/api/tests/unit_tests/services/auth/test_firecrawl_auth.py
+++ b/api/tests/unit_tests/services/auth/test_firecrawl_auth.py
@@ -66,7 +66,7 @@ class TestFirecrawlAuth:
         assert str(exc_info.value) == expected_error
 
     @patch("services.auth.firecrawl.firecrawl.httpx.post", autospec=True)
-    def test_should_validate_valid_credentials_successfully(self, mock_post, auth_instance):
+    def test_should_validate_valid_credentials_successfully(self, mock_post: MagicMock, auth_instance: FirecrawlAuth):
         """Test successful credential validation"""
         mock_response = MagicMock()
         mock_response.status_code = 200
@@ -97,7 +97,9 @@ class TestFirecrawlAuth:
         ],
     )
     @patch("services.auth.firecrawl.firecrawl.httpx.post", autospec=True)
-    def test_should_handle_http_errors(self, mock_post, status_code, error_message, auth_instance):
+    def test_should_handle_http_errors(
+        self, mock_post: MagicMock, status_code, error_message, auth_instance: FirecrawlAuth
+    ):
         """Test handling of various HTTP error codes"""
         mock_response = MagicMock()
         mock_response.status_code = status_code
@@ -120,7 +122,13 @@ class TestFirecrawlAuth:
     )
     @patch("services.auth.firecrawl.firecrawl.httpx.post", autospec=True)
     def test_should_handle_unexpected_errors(
-        self, mock_post, status_code, response_text, has_json_error, expected_error_contains, auth_instance
+        self,
+        mock_post: MagicMock,
+        status_code,
+        response_text,
+        has_json_error,
+        expected_error_contains,
+        auth_instance: FirecrawlAuth,
     ):
         """Test handling of unexpected errors with various response formats"""
         mock_response = MagicMock()
@@ -146,7 +154,9 @@ class TestFirecrawlAuth:
         ],
     )
     @patch("services.auth.firecrawl.firecrawl.httpx.post", autospec=True)
-    def test_should_handle_network_errors(self, mock_post, exception_type, exception_message, auth_instance):
+    def test_should_handle_network_errors(
+        self, mock_post: MagicMock, exception_type, exception_message, auth_instance: FirecrawlAuth
+    ):
         """Test handling of various network-related errors including timeouts"""
         mock_post.side_effect = exception_type(exception_message)
 
@@ -186,7 +196,7 @@ class TestFirecrawlAuth:
             assert mock_post.call_args[0][0] == "https://custom.firecrawl.dev/v1/crawl"
 
     @patch("services.auth.firecrawl.firecrawl.httpx.post", autospec=True)
-    def test_should_handle_timeout_with_retry_suggestion(self, mock_post, auth_instance):
+    def test_should_handle_timeout_with_retry_suggestion(self, mock_post: MagicMock, auth_instance: FirecrawlAuth):
         """Test that timeout errors are handled gracefully with appropriate error message"""
         mock_post.side_effect = httpx.TimeoutException("The request timed out after 30 seconds")
 
diff --git a/api/tests/unit_tests/services/auth/test_jina_auth.py b/api/tests/unit_tests/services/auth/test_jina_auth.py
index eb409c61d4e..e9a1035da29 100644
--- a/api/tests/unit_tests/services/auth/test_jina_auth.py
+++ b/api/tests/unit_tests/services/auth/test_jina_auth.py
@@ -36,7 +36,7 @@ class TestJinaAuth:
         assert str(exc_info.value) == "No API key provided"
 
     @patch("services.auth.jina.jina._http_client.post", autospec=True)
-    def test_should_validate_valid_credentials_successfully(self, mock_post):
+    def test_should_validate_valid_credentials_successfully(self, mock_post: MagicMock):
         """Test successful credential validation"""
         mock_response = MagicMock()
         mock_response.status_code = 200
@@ -54,7 +54,7 @@ class TestJinaAuth:
         )
 
     @patch("services.auth.jina.jina._http_client.post", autospec=True)
-    def test_should_handle_http_402_error(self, mock_post):
+    def test_should_handle_http_402_error(self, mock_post: MagicMock):
         """Test handling of 402 Payment Required error"""
         mock_response = MagicMock()
         mock_response.status_code = 402
@@ -100,7 +100,7 @@ class TestJinaAuth:
         assert str(exc_info.value) == "Failed to authorize. Status code: 409. Error: Conflict error"
 
     @patch("services.auth.jina.jina._http_client.post", autospec=True)
-    def test_should_handle_http_500_error(self, mock_post):
+    def test_should_handle_http_500_error(self, mock_post: MagicMock):
         """Test handling of 500 Internal Server Error"""
         mock_response = MagicMock()
         mock_response.status_code = 500
@@ -115,7 +115,7 @@ class TestJinaAuth:
         assert str(exc_info.value) == "Failed to authorize. Status code: 500. Error: Internal server error"
 
     @patch("services.auth.jina.jina._http_client.post", autospec=True)
-    def test_should_handle_unexpected_error_with_text_response(self, mock_post):
+    def test_should_handle_unexpected_error_with_text_response(self, mock_post: MagicMock):
         """Test handling of unexpected errors with text response"""
         mock_response = MagicMock()
         mock_response.status_code = 403
@@ -163,7 +163,7 @@ class TestJinaAuth:
         assert str(exc_info.value) == "Unexpected error occurred while trying to authorize. Status code: 404"
 
     @patch("services.auth.jina.jina._http_client.post", autospec=True)
-    def test_should_handle_network_errors(self, mock_post):
+    def test_should_handle_network_errors(self, mock_post: MagicMock):
         """Test handling of network connection errors"""
         mock_post.side_effect = httpx.ConnectError("Network error")
 
diff --git a/api/tests/unit_tests/services/data_migration/test_import_service.py b/api/tests/unit_tests/services/data_migration/test_import_service.py
index 3fcc6c7ef88..bd130cdd78b 100644
--- a/api/tests/unit_tests/services/data_migration/test_import_service.py
+++ b/api/tests/unit_tests/services/data_migration/test_import_service.py
@@ -385,7 +385,7 @@ def test_workflow_tool_import_publishes_referenced_app_before_create(monkeypatch
         (IdStrategy.GENERATE_NEW_ID, ""),
     ],
 )
-def test_workflow_tool_import_id_follows_id_strategy(monkeypatch, id_strategy, expected_import_id):
+def test_workflow_tool_import_id_follows_id_strategy(monkeypatch: pytest.MonkeyPatch, id_strategy, expected_import_id):
     created_kwargs = []
     target_provider = type("WorkflowToolProvider", (), {"id": "target-workflow-tool-id"})()
     account = type("Account", (), {"id": "account-1"})()
diff --git a/api/tests/unit_tests/services/enterprise/test_rbac_service.py b/api/tests/unit_tests/services/enterprise/test_rbac_service.py
new file mode 100644
index 00000000000..aa4780af0b4
--- /dev/null
+++ b/api/tests/unit_tests/services/enterprise/test_rbac_service.py
@@ -0,0 +1,797 @@
+"""Unit tests for services.enterprise.rbac_service.
+
+The enterprise RBAC client is almost pure glue: each method turns a single
+``EnterpriseRequest.send_inner_rbac_request`` call into a pydantic response
+model. Rather than spinning up an HTTP server we monkeypatch that helper and
+assert on the arguments it received; that catches both routing regressions
+(wrong method / wrong path / wrong params) and model-shape regressions in
+one place.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+from flask import Flask
+
+from services.enterprise import rbac_service as svc
+
+MODULE = "services.enterprise.rbac_service"
+
+
+@pytest.fixture
+def mock_send():
+    with patch(f"{MODULE}.EnterpriseRequest.send_inner_rbac_request") as send:
+        yield send
+
+
+def _call_args(send: MagicMock) -> SimpleNamespace:
+    """Return the most recent (method, endpoint, kwargs) sent to the mock."""
+    send.assert_called_once()
+    args, kwargs = send.call_args
+    return SimpleNamespace(method=args[0], endpoint=args[1], **kwargs)
+
+
+class TestCatalog:
+    def test_workspace_catalog(self, mock_send: MagicMock):
+        mock_send.return_value = {"groups": [{"group_key": "workspace", "group_name": "工作空间", "permissions": []}]}
+
+        out = svc.RBACService.Catalog.workspace("tenant-1", account_id="acct-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/role-permissions/catalog"
+        assert call.tenant_id == "tenant-1"
+        assert call.account_id == "acct-1"
+        assert call.json is None
+        assert call.params is None
+        assert len(out.groups) == 1
+        assert out.groups[0].group_key == "workspace"
+
+    def test_app_catalog_endpoint(self, mock_send: MagicMock):
+        mock_send.return_value = {"groups": []}
+        svc.RBACService.Catalog.app("tenant-1")
+        assert mock_send.call_args.args[1] == "/rbac/role-permissions/catalog/app"
+
+    def test_dataset_catalog_endpoint(self, mock_send: MagicMock):
+        mock_send.return_value = {"groups": []}
+        svc.RBACService.Catalog.dataset("tenant-1")
+        assert mock_send.call_args.args[1] == "/rbac/role-permissions/catalog/dataset"
+
+
+class TestRoles:
+    def test_list_forwards_pagination_options(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "data": [
+                {
+                    "id": "role-1",
+                    "tenant_id": "tenant-1",
+                    "type": "workspace",
+                    "category": "global_custom",
+                    "name": "Owner",
+                    "permission_keys": ["workspace.member.manage"],
+                }
+            ],
+            "pagination": {"total_count": 1, "per_page": 20, "current_page": 1, "total_pages": 1},
+        }
+
+        out = svc.RBACService.Roles.list(
+            "tenant-1",
+            "acct-1",
+            options=svc.ListOption(page_number=2, results_per_page=50, reverse=True),
+        )
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/roles"
+        assert call.params == {"page_number": 2, "results_per_page": 50, "reverse": "true"}
+        assert out.pagination
+        assert out.pagination.total_count == 1
+
+    def test_list_omits_params_when_default(self, mock_send: MagicMock):
+        mock_send.return_value = {"data": [], "pagination": None}
+        svc.RBACService.Roles.list("tenant-1")
+        assert _call_args(mock_send).params is None
+
+    def test_list_forwards_include_owner(self, mock_send: MagicMock):
+        mock_send.return_value = {"data": [], "pagination": None}
+
+        svc.RBACService.Roles.list("tenant-1", include_owner=1)
+
+        assert _call_args(mock_send).params == {"include_owner": 1}
+
+    def test_list_coerces_null_permission_keys(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "data": [
+                {
+                    "id": "role-1",
+                    "tenant_id": "tenant-1",
+                    "type": "workspace",
+                    "category": "global_custom",
+                    "name": "Owner",
+                    "permission_keys": None,
+                }
+            ],
+            "pagination": None,
+        }
+
+        out = svc.RBACService.Roles.list("tenant-1")
+
+        assert out.data[0].permission_keys == []
+
+    def test_get_passes_id_query_param(self, mock_send: MagicMock):
+        mock_send.return_value = {"id": "role-1", "type": "workspace", "name": "Owner"}
+        svc.RBACService.Roles.get("tenant-1", "acct-1", "role-1")
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/roles/item"
+        assert call.params == {"id": "role-1"}
+
+    def test_members_forwards_role_id_and_pagination(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "role_id": "role-1",
+            "data": [{"account_id": "acct-2", "account_name": "Alice"}],
+            "pagination": {"total_count": 1, "per_page": 20, "current_page": 1, "total_pages": 1},
+        }
+
+        out = svc.RBACService.Roles.members(
+            "tenant-1",
+            "acct-1",
+            "role-1",
+            options=svc.ListOption(page_number=1, results_per_page=20),
+        )
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/roles/members"
+        assert call.params == {"page_number": 1, "results_per_page": 20, "role_id": "role-1"}
+        assert out.data[0].account_id == "acct-2"
+        assert out.data[0].account_name == "Alice"
+        assert out.pagination is not None
+        assert out.pagination.total_count == 1
+
+    def test_create_sends_body(self, mock_send: MagicMock):
+        mock_send.return_value = {"id": "role-1", "type": "workspace", "name": "Owner"}
+        payload = svc.RoleMutation(name="Owner", description="full access", permission_keys=["workspace.member.manage"])
+        svc.RBACService.Roles.create("tenant-1", "acct-1", payload)
+
+        call = _call_args(mock_send)
+        assert call.method == "POST"
+        assert call.endpoint == "/rbac/roles"
+        assert call.json == {
+            "name": "Owner",
+            "description": "full access",
+            "permission_keys": ["workspace.member.manage"],
+            "type": "workspace",
+        }
+
+    def test_update_sends_id_param_and_body(self, mock_send: MagicMock):
+        mock_send.return_value = {"id": "role-1", "type": "workspace", "name": "Owner"}
+        payload = svc.RoleMutation(name="Owner", permission_keys=["x"])
+        svc.RBACService.Roles.update("tenant-1", "acct-1", "role-1", payload)
+
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/roles/item"
+        assert call.params == {"id": "role-1"}
+        assert call.json == {"name": "Owner", "description": "", "permission_keys": ["x"], "type": "workspace"}
+
+    def test_delete_uses_delete_method(self, mock_send: MagicMock):
+        mock_send.return_value = {"message": "success"}
+        svc.RBACService.Roles.delete("tenant-1", None, "role-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "DELETE"
+        assert call.endpoint == "/rbac/roles/item"
+        assert call.params == {"id": "role-1"}
+        assert call.account_id is None
+
+    def test_copy_sends_post_with_id_param(self, mock_send: MagicMock):
+        mock_send.return_value = {"id": "role-1-copy", "type": "workspace", "name": "Owner copy"}
+        svc.RBACService.Roles.copy("tenant-1", "acct-1", "role-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "POST"
+        assert call.endpoint == "/rbac/roles/copy"
+        assert call.params == {"id": "role-1"}
+        assert call.account_id == "acct-1"
+
+
+class TestAccessPolicyBindings:
+    def test_lock_sends_put_with_binding_id(self, mock_send: MagicMock):
+        mock_send.return_value = {"binding_id": "binding-1", "is_locked": True}
+
+        out = svc.RBACService.AccessPolicyBindings.lock("tenant-1", "acct-1", "binding-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/access-policy-bindings/lock"
+        assert call.json == {"binding_id": "binding-1"}
+        assert out.binding_id == "binding-1"
+        assert out.is_locked is True
+
+    def test_unlock_sends_put_with_binding_id(self, mock_send: MagicMock):
+        mock_send.return_value = {"binding_id": "binding-1", "is_locked": False}
+
+        out = svc.RBACService.AccessPolicyBindings.unlock("tenant-1", "acct-1", "binding-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/access-policy-bindings/unlock"
+        assert call.json == {"binding_id": "binding-1"}
+        assert out.binding_id == "binding-1"
+        assert out.is_locked is False
+
+
+class TestAccessPolicies:
+    def test_list_filters_by_resource_type(self, mock_send: MagicMock):
+        mock_send.return_value = {"data": [], "pagination": None}
+        svc.RBACService.AccessPolicies.list(
+            "tenant-1",
+            "acct-1",
+            resource_type=svc.RBACResourceType.APP,
+            options=svc.ListOption(page_number=1),
+        )
+        call = _call_args(mock_send)
+        assert call.endpoint == "/rbac/access-policies"
+        assert call.params == {"page_number": 1, "resource_type": "app"}
+
+    def test_copy_sends_post_with_id_param(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "id": "policy-1-copy",
+            "resource_type": "app",
+            "name": "Full access copy",
+        }
+        svc.RBACService.AccessPolicies.copy("tenant-1", "acct-1", "policy-1")
+        call = _call_args(mock_send)
+        assert call.method == "POST"
+        assert call.endpoint == "/rbac/access-policies/copy"
+        assert call.params == {"id": "policy-1"}
+
+    def test_create_serialises_resource_type_enum(self, mock_send: MagicMock):
+        mock_send.return_value = {"id": "policy-1", "resource_type": "dataset", "name": "KB only"}
+        payload = svc.AccessPolicyCreate(
+            name="KB only",
+            resource_type=svc.RBACResourceType.DATASET,
+            permission_keys=["dataset.acl.readonly"],
+        )
+        svc.RBACService.AccessPolicies.create("tenant-1", "acct-1", payload)
+        call = _call_args(mock_send)
+        assert call.method == "POST"
+        assert call.json == {
+            "name": "KB only",
+            "resource_type": "dataset",
+            "description": "",
+            "permission_keys": ["dataset.acl.readonly"],
+        }
+
+
+class TestResourceAccess:
+    def test_app_whitelist_resources(self, mock_send: MagicMock):
+        mock_send.return_value = {"unrestricted": True, "resource_ids": ["app-1", "app-2"]}
+
+        out = svc.RBACService.AppAccess.whitelist_resources("tenant-1", "acct-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/apps/whitelist/resources"
+        assert call.params is None
+        assert out.unrestricted is True
+        assert out.resource_ids == ["app-1", "app-2"]
+
+    def test_dataset_whitelist_resources(self, mock_send: MagicMock):
+        mock_send.return_value = {"resource_ids": ["dataset-1"]}
+
+        out = svc.RBACService.DatasetAccess.whitelist_resources("tenant-1", "acct-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/datasets/whitelist/resources"
+        assert call.params is None
+        assert out.resource_ids == ["dataset-1"]
+
+    def test_app_user_access_policies(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "scope": "app",
+            "data": [
+                {
+                    "account": {"account_id": "acct-1", "account_name": "Alice"},
+                    "roles": [
+                        {
+                            "id": "role-1",
+                            "type": "workspace",
+                            "name": "Editor",
+                            "permission_keys": [],
+                        }
+                    ],
+                    "access_policies": [
+                        {
+                            "id": "policy-1",
+                            "resource_type": "app",
+                            "name": "Can edit",
+                        }
+                    ],
+                }
+            ],
+        }
+
+        out = svc.RBACService.AppAccess.user_access_policies("tenant-1", "acct-1", "app-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/apps/user-access-policies"
+        assert call.params == {"app_id": "app-1"}
+        assert out.data[0].account.account_name == "Alice"
+        assert out.data[0].roles[0].id == "role-1"
+        assert out.data[0].access_policies[0].id == "policy-1"
+
+    def test_dataset_replace_user_access_policies(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "access_policies": [{"id": "policy-1", "resource_type": "dataset", "name": "Can edit"}]
+        }
+        payload = svc.ReplaceUserAccessPolicies(access_policy_ids=["policy-1"])
+
+        out = svc.RBACService.DatasetAccess.replace_user_access_policies(
+            "tenant-1", "acct-actor", "dataset-1", "acct-target", payload
+        )
+
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/datasets/user-access-policies"
+        assert call.params == {"dataset_id": "dataset-1", "account_id": "acct-target"}
+        assert call.json == {"access_policy_ids": ["policy-1"]}
+        assert out.access_policies[0].id == "policy-1"
+
+    def test_dataset_whitelist(self, mock_send: MagicMock):
+        mock_send.return_value = {"account_ids": ["acct-2"]}
+
+        out = svc.RBACService.DatasetAccess.whitelist("tenant-1", "acct-1", "dataset-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/datasets/whitelist"
+        assert call.params == {"dataset_id": "dataset-1"}
+        assert out.account_ids == ["acct-2"]
+
+    def test_app_matrix(self, mock_send: MagicMock):
+        mock_send.return_value = {"resource_id": "app-1", "items": []}
+        out = svc.RBACService.AppAccess.matrix("tenant-1", "acct-1", "app-1")
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/apps/access-policy"
+        assert call.params == {"app_id": "app-1"}
+        assert out.app_id == "app-1"
+
+    def test_dataset_matrix(self, mock_send: MagicMock):
+        mock_send.return_value = {"resource_id": "dataset-1", "items": []}
+        out = svc.RBACService.DatasetAccess.matrix("tenant-1", "acct-1", "dataset-1")
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/datasets/access-policy"
+        assert call.params == {"dataset_id": "dataset-1"}
+        assert out.dataset_id == "dataset-1"
+
+    def test_app_role_bindings_preserve_role_name(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "data": [
+                {
+                    "id": "binding-1",
+                    "tenant_id": "tenant-1",
+                    "access_policy_id": "policy-1",
+                    "resource_type": "app",
+                    "resource_id": "app-1",
+                    "role_id": "role-1",
+                    "role_name": "Owner",
+                }
+            ]
+        }
+
+        out = svc.RBACService.AppAccess.list_role_bindings("tenant-1", "acct-1", "app-1", "policy-1")
+
+        assert out.data[0].role_name == "Owner"
+
+    def test_app_member_bindings_preserve_account_name(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "data": [
+                {
+                    "id": "binding-1",
+                    "tenant_id": "tenant-1",
+                    "access_policy_id": "policy-1",
+                    "resource_type": "app",
+                    "resource_id": "app-1",
+                    "account_id": "acct-1",
+                    "account_name": "Alice",
+                }
+            ]
+        }
+
+        out = svc.RBACService.AppAccess.list_member_bindings("tenant-1", "acct-1", "app-1", "policy-1")
+
+        assert out.data[0].account_name == "Alice"
+
+    def test_app_delete_member_bindings_uses_delete_method(self, mock_send: MagicMock):
+        mock_send.return_value = None
+        payload = svc.DeleteMemberBindings(account_ids=["acct-2", "acct-3"])
+        svc.RBACService.AppAccess.delete_member_bindings("tenant-1", "acct-1", "app-1", "policy-1", payload)
+        call = _call_args(mock_send)
+        assert call.method == "DELETE"
+        assert call.endpoint == "/rbac/apps/access-policy/member-bindings"
+        assert call.params == {"app_id": "app-1", "policy_id": "policy-1"}
+        assert call.json == {"account_ids": ["acct-2", "acct-3"]}
+
+    def test_app_replace_bindings(self, mock_send: MagicMock):
+        mock_send.return_value = {"data": []}
+        payload = svc.ReplaceBindings(role_ids=["workspace.owner"], account_ids=["acct-2"])
+        svc.RBACService.AppAccess.replace_bindings("tenant-1", "acct-1", "app-1", "policy-1", payload)
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/apps/access-policy/bindings"
+        assert call.params == {"app_id": "app-1", "policy_id": "policy-1"}
+        assert call.json == {"role_ids": ["workspace.owner"], "account_ids": ["acct-2"]}
+
+    def test_dataset_replace_bindings(self, mock_send: MagicMock):
+        mock_send.return_value = {"data": []}
+        payload = svc.ReplaceBindings(role_ids=["workspace.editor"], account_ids=["acct-2"])
+        svc.RBACService.DatasetAccess.replace_bindings("tenant-1", "acct-1", "ds-1", "policy-1", payload)
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/datasets/access-policy/bindings"
+        assert call.params == {"dataset_id": "ds-1", "policy_id": "policy-1"}
+        assert call.json == {"role_ids": ["workspace.editor"], "account_ids": ["acct-2"]}
+
+    def test_dataset_delete_member_bindings_uses_delete_method(self, mock_send: MagicMock):
+        mock_send.return_value = None
+        payload = svc.DeleteMemberBindings(account_ids=["acct-2"])
+        svc.RBACService.DatasetAccess.delete_member_bindings("tenant-1", "acct-1", "ds-1", "policy-1", payload)
+        call = _call_args(mock_send)
+        assert call.method == "DELETE"
+        assert call.endpoint == "/rbac/datasets/access-policy/member-bindings"
+        assert call.params == {"dataset_id": "ds-1", "policy_id": "policy-1"}
+        assert call.json == {"account_ids": ["acct-2"]}
+
+
+class TestWorkspaceAccess:
+    def test_app_matrix(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "items": [],
+            "pagination": {"total_count": 1, "per_page": 20, "current_page": 2, "total_pages": 1},
+        }
+        out = svc.RBACService.WorkspaceAccess.app_matrix(
+            "tenant-1",
+            options=svc.ListOption(page_number=2, results_per_page=20),
+        )
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/workspace/apps/access-policy"
+        assert call.params == {"page_number": 2, "results_per_page": 20}
+        assert out.pagination
+        assert out.pagination.current_page == 2
+
+    def test_dataset_matrix(self, mock_send: MagicMock):
+        mock_send.return_value = {"items": []}
+        svc.RBACService.WorkspaceAccess.dataset_matrix("tenant-1")
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/workspace/datasets/access-policy"
+        assert call.params is None
+
+    def test_workspace_matrix_coerces_null_bindings(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "items": [
+                {
+                    "policy": {
+                        "id": "policy-1",
+                        "resource_type": "app",
+                        "name": "Workspace App Access",
+                    },
+                    "roles": None,
+                    "accounts": None,
+                }
+            ],
+            "pagination": None,
+        }
+
+        out = svc.RBACService.WorkspaceAccess.app_matrix("tenant-1")
+
+        assert out.items[0].roles == []
+        assert out.items[0].accounts == []
+
+    def test_workspace_app_replace_bindings(self, mock_send: MagicMock):
+        mock_send.return_value = {"data": []}
+        payload = svc.ReplaceBindings(role_ids=["workspace.editor"], account_ids=["acct-2"])
+        svc.RBACService.WorkspaceAccess.replace_app_bindings("tenant-1", "acct-1", "policy-1", payload)
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/workspace/apps/access-policy/bindings"
+        assert call.params == {"policy_id": "policy-1"}
+        assert call.json == {"role_ids": ["workspace.editor"], "account_ids": ["acct-2"]}
+
+    def test_workspace_dataset_replace_bindings(self, mock_send: MagicMock):
+        mock_send.return_value = {"data": []}
+        payload = svc.ReplaceBindings(role_ids=["workspace.editor"], account_ids=["acct-2"])
+        svc.RBACService.WorkspaceAccess.replace_dataset_bindings("tenant-1", "acct-1", "policy-1", payload)
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/workspace/datasets/access-policy/bindings"
+        assert call.params == {"policy_id": "policy-1"}
+        assert call.json == {"role_ids": ["workspace.editor"], "account_ids": ["acct-2"]}
+
+    def test_workspace_app_matrix_forwards_language_query_param(self, mock_send: MagicMock):
+        mock_send.return_value = {"items": [], "pagination": None}
+        app = Flask(__name__)
+        with app.test_request_context("/?language=en"):
+            svc.RBACService.WorkspaceAccess.app_matrix("tenant-1")
+
+        call = _call_args(mock_send)
+        assert call.params == {"language": "en"}
+
+
+class TestMyPermissions:
+    def test_resource_snapshot_maps_defaults_and_overrides(self):
+        snapshot = svc.ResourcePermissionSnapshot(
+            default_permission_keys=["app.acl.view_layout"],
+            overrides=[
+                svc.ResourcePermissionKeys(
+                    resource_id="app-2",
+                    permission_keys=["app.acl.view_layout", "app.acl.edit"],
+                )
+            ],
+        )
+
+        assert snapshot.permission_keys_by_resource_ids(["app-1", "app-2"]) == {
+            "app-1": ["app.acl.view_layout"],
+            "app-2": ["app.acl.view_layout", "app.acl.edit"],
+        }
+
+    def test_get_without_payload_uses_get(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "workspace": {"permission_keys": ["workspace.member.manage"]},
+            "app": {"default_permission_keys": ["app.acl.view_layout", "app.acl.test_and_run"], "overrides": []},
+            "dataset": {"default_permission_keys": [], "overrides": []},
+        }
+
+        with patch(f"{MODULE}.dify_config.RBAC_ENABLED", True):
+            out = svc.RBACService.MyPermissions.get("tenant-1", "acct-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/my-permissions"
+        assert call.json is None
+        assert call.params is None
+        assert out.workspace.permission_keys == ["workspace.member.manage"]
+
+    @pytest.mark.parametrize(
+        ("role", "workspace_keys", "app_keys", "dataset_keys"),
+        [
+            (
+                "owner",
+                svc._LEGACY_WORKSPACE_OWNER_KEYS,
+                svc._LEGACY_APP_OWNER_KEYS,
+                svc._LEGACY_DATASET_OWNER_KEYS,
+            ),
+            (
+                "admin",
+                svc._LEGACY_WORKSPACE_ADMIN_KEYS,
+                svc._LEGACY_APP_ADMIN_KEYS,
+                svc._LEGACY_DATASET_ADMIN_KEYS,
+            ),
+            (
+                "editor",
+                svc._LEGACY_WORKSPACE_EDITOR_KEYS,
+                svc._LEGACY_APP_EDITOR_KEYS,
+                svc._LEGACY_DATASET_EDITOR_KEYS,
+            ),
+            (
+                "normal",
+                svc._LEGACY_WORKSPACE_NORMAL_KEYS,
+                svc._LEGACY_APP_NORMAL_KEYS,
+                [],
+            ),
+            (
+                "dataset_operator",
+                svc._LEGACY_WORKSPACE_DATASET_OPERATOR_KEYS,
+                [],
+                svc._LEGACY_DATASET_DATASET_OPERATOR_KEYS,
+            ),
+        ],
+    )
+    def test_get_uses_legacy_role_permissions_when_rbac_disabled(
+        self,
+        mock_send: MagicMock,
+        role: str,
+        workspace_keys: list[str],
+        app_keys: list[str],
+        dataset_keys: list[str],
+    ):
+        mock_session = MagicMock()
+        mock_session.__enter__.return_value = mock_session
+        mock_session.scalar.return_value = role
+        with (
+            patch(f"{MODULE}.dify_config.RBAC_ENABLED", False),
+            patch(f"{MODULE}.session_factory.create_session", return_value=mock_session),
+        ):
+            out = svc.RBACService.MyPermissions.get("tenant-1", "acct-1")
+
+        mock_send.assert_not_called()
+        assert out.workspace.permission_keys == workspace_keys
+        assert out.app.default_permission_keys == app_keys
+        assert out.dataset.default_permission_keys == dataset_keys
+        assert out.app.overrides == []
+        assert out.dataset.overrides == []
+
+    def test_get_returns_empty_when_role_missing_and_rbac_disabled(self, mock_send: MagicMock):
+        mock_session = MagicMock()
+        mock_session.__enter__.return_value = mock_session
+        mock_session.scalar.return_value = None
+        with (
+            patch(f"{MODULE}.dify_config.RBAC_ENABLED", False),
+            patch(f"{MODULE}.session_factory.create_session", return_value=mock_session),
+        ):
+            out = svc.RBACService.MyPermissions.get("tenant-1", "acct-1")
+
+        mock_send.assert_not_called()
+        assert out.workspace.permission_keys == []
+        assert out.app.default_permission_keys == []
+        assert out.dataset.default_permission_keys == []
+
+    def test_get_with_single_resource_filters(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "workspace": {"permission_keys": []},
+            "app": {
+                "default_permission_keys": [],
+                "overrides": [{"resource_id": "app-1", "permission_keys": ["app.acl.edit"]}],
+            },
+            "dataset": {"default_permission_keys": [], "overrides": []},
+        }
+
+        with patch(f"{MODULE}.dify_config.RBAC_ENABLED", True):
+            out = svc.RBACService.MyPermissions.get("tenant-1", "acct-1", app_id="app-1")
+
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/my-permissions"
+        assert call.params == {"app_id": "app-1"}
+        assert out.app.overrides[0].resource_id == "app-1"
+
+
+class TestMemberRoles:
+    def test_get(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "account_id": "acct-2",
+            "roles": [
+                {
+                    "id": "role-1",
+                    "type": "workspace",
+                    "name": "Member",
+                }
+            ],
+        }
+        out = svc.RBACService.MemberRoles.get("tenant-1", "acct-1", "acct-2")
+        call = _call_args(mock_send)
+        assert call.method == "GET"
+        assert call.endpoint == "/rbac/members/rbac-roles"
+        assert call.params == {"account_id": "acct-2"}
+        assert out.account_id == "acct-2"
+        assert out.roles[0].name == "Member"
+
+    def test_replace(self, mock_send: MagicMock):
+        mock_send.return_value = {"account_id": "acct-2", "roles": []}
+        svc.RBACService.MemberRoles.replace(
+            "tenant-1", "acct-1", "acct-2", role_ids=["workspace.owner", "workspace.editor"]
+        )
+        call = _call_args(mock_send)
+        assert call.method == "PUT"
+        assert call.endpoint == "/rbac/members/rbac-roles"
+        assert call.params == {"account_id": "acct-2"}
+        assert call.json == {"role_ids": ["workspace.owner", "workspace.editor"]}
+
+    def test_batch_get(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "acct-2": [
+                {"id": "role-1", "name": "Admin", "type": "workspace"},
+                {"id": "role-2", "name": "Editor", "type": "workspace"},
+            ],
+            "acct-3": [],
+        }
+
+        out = svc.RBACService.MemberRoles.batch_get("tenant-1", "acct-1", ["acct-2", "acct-3"])
+
+        call = _call_args(mock_send)
+        assert call.method == "POST"
+        assert call.endpoint == "/rbac/members/rbac-roles/batch"
+        assert call.json == {"member_ids": ["acct-2", "acct-3"]}
+        assert out[0].account_id == "acct-2"
+        assert len(out[0].roles) == 2
+        assert out[1].account_id == "acct-3"
+        assert out[1].roles == []
+
+
+class TestResourcePermissions:
+    def test_app_permissions_batch_get(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "data": [
+                {"resource_id": "app-1", "permission_keys": ["app.acl.view_layout", "app.acl.edit"]},
+                {"resource_id": "app-2", "permission_keys": []},
+            ]
+        }
+
+        with patch(f"{MODULE}.dify_config.RBAC_ENABLED", True):
+            out = svc.RBACService.AppPermissions.batch_get("tenant-1", "acct-1", ["app-1", "app-2"])
+
+        call = _call_args(mock_send)
+        assert call.method == "POST"
+        assert call.endpoint == "/rbac/apps/permission-keys/batch"
+        assert call.json == {"app_ids": ["app-1", "app-2"]}
+        assert out == {
+            "app-1": ["app.acl.view_layout", "app.acl.edit"],
+            "app-2": [],
+        }
+
+    def test_app_permissions_batch_get_uses_legacy_role_permissions_when_rbac_disabled(self, mock_send: MagicMock):
+        mock_session = MagicMock()
+        mock_session.__enter__.return_value = mock_session
+        mock_session.scalar.return_value = "editor"
+        with (
+            patch(f"{MODULE}.dify_config.RBAC_ENABLED", False),
+            patch(f"{MODULE}.session_factory.create_session", return_value=mock_session),
+        ):
+            out = svc.RBACService.AppPermissions.batch_get("tenant-1", "acct-1", ["app-1", "app-2"])
+
+        mock_send.assert_not_called()
+        assert out == {
+            "app-1": svc._LEGACY_APP_EDITOR_KEYS,
+            "app-2": svc._LEGACY_APP_EDITOR_KEYS,
+        }
+
+    def test_dataset_permissions_batch_get(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "data": [
+                {"resource_id": "ds-1", "permission_keys": ["dataset.acl.readonly"]},
+                {"resource_id": "ds-2", "permission_keys": ["dataset.acl.edit"]},
+            ]
+        }
+
+        with patch(f"{MODULE}.dify_config.RBAC_ENABLED", True):
+            out = svc.RBACService.DatasetPermissions.batch_get("tenant-1", "acct-1", ["ds-1", "ds-2"])
+
+        call = _call_args(mock_send)
+        assert call.method == "POST"
+        assert call.endpoint == "/rbac/datasets/permission-keys/batch"
+        assert call.json == {"dataset_ids": ["ds-1", "ds-2"]}
+        assert out == {
+            "ds-1": ["dataset.acl.readonly"],
+            "ds-2": ["dataset.acl.edit"],
+        }
+
+    def test_dataset_permissions_batch_get_uses_legacy_role_permissions_when_rbac_disabled(self, mock_send: MagicMock):
+        mock_session = MagicMock()
+        mock_session.__enter__.return_value = mock_session
+        mock_session.scalar.return_value = "dataset_operator"
+        with (
+            patch(f"{MODULE}.dify_config.RBAC_ENABLED", False),
+            patch(f"{MODULE}.session_factory.create_session", return_value=mock_session),
+        ):
+            out = svc.RBACService.DatasetPermissions.batch_get("tenant-1", "acct-1", ["ds-1", "ds-2"])
+
+        mock_send.assert_not_called()
+        assert out == {
+            "ds-1": svc._LEGACY_DATASET_DATASET_OPERATOR_KEYS,
+            "ds-2": svc._LEGACY_DATASET_DATASET_OPERATOR_KEYS,
+        }
+
+
+class TestListOption:
+    def test_empty_produces_empty_params(self):
+        assert svc.ListOption().to_params() == {}
+
+    def test_reverse_serialises_as_lowercase_bool(self):
+        assert svc.ListOption(reverse=False).to_params()["reverse"] == "false"
+        assert svc.ListOption(reverse=True).to_params()["reverse"] == "true"
+
+    def test_extra_overrides_merge(self):
+        assert svc.ListOption(page_number=1).to_params({"resource_type": "app", "skip": None}) == {
+            "page_number": 1,
+            "resource_type": "app",
+        }
diff --git a/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_built_in_retrieval.py b/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_built_in_retrieval.py
index 1928958ea4a..441a914ee62 100644
--- a/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_built_in_retrieval.py
+++ b/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_built_in_retrieval.py
@@ -1,3 +1,5 @@
+from pytest_mock import MockerFixture
+
 from services.rag_pipeline.pipeline_template.built_in.built_in_retrieval import BuiltInPipelineTemplateRetrieval
 from services.rag_pipeline.pipeline_template.pipeline_template_type import PipelineTemplateType
 
@@ -8,7 +10,7 @@ def test_get_type() -> None:
     assert retrieval.get_type() == PipelineTemplateType.BUILTIN
 
 
-def test_get_pipeline_templates(mocker) -> None:
+def test_get_pipeline_templates(mocker: MockerFixture) -> None:
     mocker.patch.object(
         BuiltInPipelineTemplateRetrieval,
         "_get_builtin_data",
@@ -26,7 +28,7 @@ def test_get_pipeline_templates(mocker) -> None:
     assert templates == {"pipeline_templates": [{"id": "tpl-1"}]}
 
 
-def test_get_pipeline_template_detail(mocker) -> None:
+def test_get_pipeline_template_detail(mocker: MockerFixture) -> None:
     mocker.patch.object(
         BuiltInPipelineTemplateRetrieval,
         "_get_builtin_data",
@@ -43,7 +45,7 @@ def test_get_pipeline_template_detail(mocker) -> None:
     assert detail == {"id": "tpl-1", "name": "Template 1"}
 
 
-def test_get_pipeline_templates_missing_language_returns_empty_dict(mocker) -> None:
+def test_get_pipeline_templates_missing_language_returns_empty_dict(mocker: MockerFixture) -> None:
     mocker.patch.object(
         BuiltInPipelineTemplateRetrieval,
         "_get_builtin_data",
@@ -56,7 +58,7 @@ def test_get_pipeline_templates_missing_language_returns_empty_dict(mocker) -> N
     assert result == {}
 
 
-def test_get_pipeline_template_detail_returns_none_for_unknown_id(mocker) -> None:
+def test_get_pipeline_template_detail_returns_none_for_unknown_id(mocker: MockerFixture) -> None:
     mocker.patch.object(
         BuiltInPipelineTemplateRetrieval,
         "_get_builtin_data",
@@ -69,7 +71,7 @@ def test_get_pipeline_template_detail_returns_none_for_unknown_id(mocker) -> Non
     assert result is None
 
 
-def test_get_builtin_data_reads_from_file_and_caches(mocker) -> None:
+def test_get_builtin_data_reads_from_file_and_caches(mocker: MockerFixture) -> None:
     import json
 
     # Ensure no cached data
@@ -98,7 +100,7 @@ def test_get_builtin_data_reads_from_file_and_caches(mocker) -> None:
     BuiltInPipelineTemplateRetrieval.builtin_data = None
 
 
-def test_get_builtin_data_returns_cache_on_second_call(mocker) -> None:
+def test_get_builtin_data_returns_cache_on_second_call(mocker: MockerFixture) -> None:
     cached_data = {"pipeline_templates": {"en-US": {}}}
     BuiltInPipelineTemplateRetrieval.builtin_data = cached_data
 
diff --git a/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_customized_retrieval.py b/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_customized_retrieval.py
index 106b959a78b..168ec8fce3c 100644
--- a/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_customized_retrieval.py
+++ b/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_customized_retrieval.py
@@ -1,10 +1,12 @@
 from types import SimpleNamespace
 
+from pytest_mock import MockerFixture
+
 from services.rag_pipeline.pipeline_template.customized.customized_retrieval import CustomizedPipelineTemplateRetrieval
 from services.rag_pipeline.pipeline_template.pipeline_template_type import PipelineTemplateType
 
 
-def test_get_pipeline_templates(mocker) -> None:
+def test_get_pipeline_templates(mocker: MockerFixture) -> None:
     customized_template = SimpleNamespace(
         id="tpl-1",
         name="Custom Template",
@@ -40,7 +42,7 @@ def test_get_pipeline_templates(mocker) -> None:
     }
 
 
-def test_get_pipeline_template_detail_returns_detail(mocker) -> None:
+def test_get_pipeline_template_detail_returns_detail(mocker: MockerFixture) -> None:
     session_mock = mocker.Mock()
     session_mock.get.return_value = SimpleNamespace(
         id="tpl-1",
@@ -71,7 +73,7 @@ def test_get_pipeline_template_detail_returns_detail(mocker) -> None:
     }
 
 
-def test_get_pipeline_template_detail_returns_none_when_not_found(mocker) -> None:
+def test_get_pipeline_template_detail_returns_none_when_not_found(mocker: MockerFixture) -> None:
     session_mock = mocker.Mock()
     session_mock.get.return_value = None
     mocker.patch(
diff --git a/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_database_retrieval.py b/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_database_retrieval.py
index 0175f66808b..41f60e45755 100644
--- a/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_database_retrieval.py
+++ b/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_database_retrieval.py
@@ -1,10 +1,12 @@
 from types import SimpleNamespace
 
+from pytest_mock import MockerFixture
+
 from services.rag_pipeline.pipeline_template.database.database_retrieval import DatabasePipelineTemplateRetrieval
 from services.rag_pipeline.pipeline_template.pipeline_template_type import PipelineTemplateType
 
 
-def test_get_pipeline_templates(mocker) -> None:
+def test_get_pipeline_templates(mocker: MockerFixture) -> None:
     built_in_template = SimpleNamespace(
         id="tpl-1",
         name="Template 1",
@@ -44,7 +46,7 @@ def test_get_pipeline_templates(mocker) -> None:
     }
 
 
-def test_get_pipeline_template_detail_returns_detail(mocker) -> None:
+def test_get_pipeline_template_detail_returns_detail(mocker: MockerFixture) -> None:
     session_mock = mocker.Mock()
     session_mock.get.return_value = SimpleNamespace(
         id="tpl-1",
@@ -73,7 +75,7 @@ def test_get_pipeline_template_detail_returns_detail(mocker) -> None:
     }
 
 
-def test_get_pipeline_template_detail_returns_none_when_not_found(mocker) -> None:
+def test_get_pipeline_template_detail_returns_none_when_not_found(mocker: MockerFixture) -> None:
     session_mock = mocker.Mock()
     session_mock.get.return_value = None
     mocker.patch(
diff --git a/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_remote_retrieval.py b/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_remote_retrieval.py
index 10b5bc7cf67..5da6684926c 100644
--- a/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_remote_retrieval.py
+++ b/api/tests/unit_tests/services/rag_pipeline/pipeline_template/test_remote_retrieval.py
@@ -1,11 +1,12 @@
 import pytest
+from pytest_mock import MockerFixture
 
 from services.rag_pipeline.pipeline_template.database.database_retrieval import DatabasePipelineTemplateRetrieval
 from services.rag_pipeline.pipeline_template.pipeline_template_type import PipelineTemplateType
 from services.rag_pipeline.pipeline_template.remote.remote_retrieval import RemotePipelineTemplateRetrieval
 
 
-def test_get_pipeline_templates_fallbacks_to_database_on_error(mocker) -> None:
+def test_get_pipeline_templates_fallbacks_to_database_on_error(mocker: MockerFixture) -> None:
     fetch_mock = mocker.patch.object(
         RemotePipelineTemplateRetrieval,
         "fetch_pipeline_templates_from_dify_official",
@@ -26,7 +27,7 @@ def test_get_pipeline_templates_fallbacks_to_database_on_error(mocker) -> None:
     fallback_mock.assert_called_once_with("en-US")
 
 
-def test_get_pipeline_template_detail_fallbacks_to_database_on_error(mocker) -> None:
+def test_get_pipeline_template_detail_fallbacks_to_database_on_error(mocker: MockerFixture) -> None:
     fetch_mock = mocker.patch.object(
         RemotePipelineTemplateRetrieval,
         "fetch_pipeline_template_detail_from_dify_official",
@@ -46,7 +47,7 @@ def test_get_pipeline_template_detail_fallbacks_to_database_on_error(mocker) ->
     fallback_mock.assert_called_once_with("tpl-1")
 
 
-def test_fetch_pipeline_templates_from_dify_official(mocker) -> None:
+def test_fetch_pipeline_templates_from_dify_official(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.pipeline_template.remote.remote_retrieval"
         ".dify_config.HOSTED_FETCH_PIPELINE_TEMPLATES_REMOTE_DOMAIN",
@@ -72,7 +73,7 @@ def test_fetch_pipeline_templates_from_dify_official(mocker) -> None:
     assert http_get_mock.call_count == 2
 
 
-def test_fetch_pipeline_template_detail_from_dify_official(mocker) -> None:
+def test_fetch_pipeline_template_detail_from_dify_official(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.pipeline_template.remote.remote_retrieval"
         ".dify_config.HOSTED_FETCH_PIPELINE_TEMPLATES_REMOTE_DOMAIN",
diff --git a/api/tests/unit_tests/services/rag_pipeline/test_pipeline_generate_service.py b/api/tests/unit_tests/services/rag_pipeline/test_pipeline_generate_service.py
index 82a5598b13d..178f4595359 100644
--- a/api/tests/unit_tests/services/rag_pipeline/test_pipeline_generate_service.py
+++ b/api/tests/unit_tests/services/rag_pipeline/test_pipeline_generate_service.py
@@ -2,6 +2,7 @@ from types import SimpleNamespace
 from typing import cast
 
 import pytest
+from pytest_mock import MockerFixture
 
 from core.app.entities.app_invoke_entities import InvokeFrom
 from models.dataset import Pipeline
@@ -9,7 +10,7 @@ from models.model import Account, App, EndUser
 from services.rag_pipeline.pipeline_generate_service import PipelineGenerateService
 
 
-def test_get_max_active_requests_uses_smallest_non_zero_limit(mocker) -> None:
+def test_get_max_active_requests_uses_smallest_non_zero_limit(mocker: MockerFixture) -> None:
     mocker.patch("services.rag_pipeline.pipeline_generate_service.dify_config.APP_DEFAULT_ACTIVE_REQUESTS", 5)
     mocker.patch("services.rag_pipeline.pipeline_generate_service.dify_config.APP_MAX_ACTIVE_REQUESTS", 3)
 
@@ -20,7 +21,7 @@ def test_get_max_active_requests_uses_smallest_non_zero_limit(mocker) -> None:
     assert result == 3
 
 
-def test_get_max_active_requests_returns_zero_when_all_unlimited(mocker) -> None:
+def test_get_max_active_requests_returns_zero_when_all_unlimited(mocker: MockerFixture) -> None:
     mocker.patch("services.rag_pipeline.pipeline_generate_service.dify_config.APP_DEFAULT_ACTIVE_REQUESTS", 0)
     mocker.patch("services.rag_pipeline.pipeline_generate_service.dify_config.APP_MAX_ACTIVE_REQUESTS", 0)
 
@@ -39,7 +40,7 @@ def test_get_max_active_requests_returns_zero_when_all_unlimited(mocker) -> None
         (InvokeFrom.DEBUGGER, SimpleNamespace(id="wf-1"), None),
     ],
 )
-def test_get_workflow(mocker, invoke_from, workflow, expected_error) -> None:
+def test_get_workflow(mocker: MockerFixture, invoke_from, workflow, expected_error) -> None:
     rag_pipeline_service_cls = mocker.patch("services.rag_pipeline.pipeline_generate_service.RagPipelineService")
     rag_pipeline_service = rag_pipeline_service_cls.return_value
     rag_pipeline_service.get_draft_workflow.return_value = workflow
@@ -55,7 +56,7 @@ def test_get_workflow(mocker, invoke_from, workflow, expected_error) -> None:
         assert result == workflow
 
 
-def test_generate_updates_document_status_and_returns_event_stream(mocker) -> None:
+def test_generate_updates_document_status_and_returns_event_stream(mocker: MockerFixture) -> None:
     pipeline = cast(Pipeline, SimpleNamespace(id="pipeline-1"))
     user = cast(Account | EndUser, SimpleNamespace(id="user-1"))
     args = {"original_document_id": "doc-1", "query": "hello"}
@@ -80,7 +81,7 @@ def test_generate_updates_document_status_and_returns_event_stream(mocker) -> No
     update_status_mock.assert_called_once_with("doc-1")
 
 
-def test_update_document_status_updates_existing_document(mocker) -> None:
+def test_update_document_status_updates_existing_document(mocker: MockerFixture) -> None:
     document = SimpleNamespace(indexing_status="completed")
 
     session_mock = mocker.Mock()
@@ -99,7 +100,7 @@ def test_update_document_status_updates_existing_document(mocker) -> None:
     commit_mock.assert_called_once()
 
 
-def test_update_document_status_skips_when_document_missing(mocker) -> None:
+def test_update_document_status_skips_when_document_missing(mocker: MockerFixture) -> None:
     session_mock = mocker.Mock()
     session_mock.get.return_value = None
     add_mock = session_mock.add
@@ -118,7 +119,7 @@ def test_update_document_status_skips_when_document_missing(mocker) -> None:
 # --- generate_single_iteration ---
 
 
-def test_generate_single_iteration_delegates(mocker) -> None:
+def test_generate_single_iteration_delegates(mocker: MockerFixture) -> None:
     mocker.patch.object(PipelineGenerateService, "_get_workflow", return_value=SimpleNamespace(id="wf-1"))
 
     generator_cls = mocker.patch("services.rag_pipeline.pipeline_generate_service.PipelineGenerator")
@@ -138,7 +139,7 @@ def test_generate_single_iteration_delegates(mocker) -> None:
 # --- generate_single_loop ---
 
 
-def test_generate_single_loop_delegates(mocker) -> None:
+def test_generate_single_loop_delegates(mocker: MockerFixture) -> None:
     mocker.patch.object(PipelineGenerateService, "_get_workflow", return_value=SimpleNamespace(id="wf-1"))
 
     generator_cls = mocker.patch("services.rag_pipeline.pipeline_generate_service.PipelineGenerator")
diff --git a/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_dsl_service.py b/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_dsl_service.py
index dba5711795f..55ae8144d55 100644
--- a/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_dsl_service.py
+++ b/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_dsl_service.py
@@ -4,6 +4,7 @@ from unittest.mock import MagicMock, Mock
 
 import pytest
 import yaml
+from pytest_mock import MockerFixture
 from sqlalchemy.orm import Session
 
 from core.workflow.nodes.knowledge_index import KNOWLEDGE_INDEX_NODE_TYPE
@@ -55,7 +56,7 @@ def test_get_leaked_dependencies_returns_empty_list_for_empty_input() -> None:
     assert result == []
 
 
-def test_get_leaked_dependencies_delegates_to_analysis_service(mocker) -> None:
+def test_get_leaked_dependencies_delegates_to_analysis_service(mocker: MockerFixture) -> None:
     expected = [Mock()]
     get_leaked_mock = mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DependenciesAnalysisService.get_leaked_dependencies",
@@ -72,7 +73,7 @@ def test_get_leaked_dependencies_delegates_to_analysis_service(mocker) -> None:
 # --- check_dependencies ---
 
 
-def test_check_dependencies_returns_empty_when_no_redis_data(mocker) -> None:
+def test_check_dependencies_returns_empty_when_no_redis_data(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.redis_client.get",
         return_value=None,
@@ -85,7 +86,7 @@ def test_check_dependencies_returns_empty_when_no_redis_data(mocker) -> None:
     assert result.leaked_dependencies == []
 
 
-def test_check_dependencies_returns_leaked_deps_from_redis(mocker) -> None:
+def test_check_dependencies_returns_leaked_deps_from_redis(mocker: MockerFixture) -> None:
     from core.plugin.entities.plugin import PluginDependency
     from services.rag_pipeline.rag_pipeline_dsl_service import CheckDependenciesPendingData
 
@@ -117,7 +118,7 @@ def test_check_dependencies_returns_leaked_deps_from_redis(mocker) -> None:
 # --- _extract_dependencies_from_model_config ---
 
 
-def test_extract_dependencies_from_model_config_extracts_model(mocker) -> None:
+def test_extract_dependencies_from_model_config_extracts_model(mocker: MockerFixture) -> None:
     analyze_mock = mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DependenciesAnalysisService.analyze_model_provider_dependency",
         return_value="langgenius/openai",
@@ -130,7 +131,7 @@ def test_extract_dependencies_from_model_config_extracts_model(mocker) -> None:
     analyze_mock.assert_called_with("openai")
 
 
-def test_extract_dependencies_from_model_config_extracts_tools(mocker) -> None:
+def test_extract_dependencies_from_model_config_extracts_tools(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DependenciesAnalysisService.analyze_model_provider_dependency",
         return_value="x",
@@ -159,7 +160,7 @@ def test_extract_dependencies_from_model_config_empty_config() -> None:
 # --- _extract_dependencies_from_workflow_graph ---
 
 
-def test_extract_dependencies_from_workflow_graph_ignores_unknown_types(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_ignores_unknown_types(mocker: MockerFixture) -> None:
     service = RagPipelineDslService(session=Mock())
     graph = {"nodes": [{"data": {"type": "some-unknown-type"}}]}
 
@@ -176,7 +177,7 @@ def test_extract_dependencies_from_workflow_graph_handles_empty_graph() -> None:
     assert result == []
 
 
-def test_extract_dependencies_from_workflow_graph_handles_malformed_node(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_handles_malformed_node(mocker: MockerFixture) -> None:
     service = RagPipelineDslService(session=Mock())
     # Node with TOOL type but invalid data should be caught by exception handler
     from graphon.enums import BuiltinNodeTypes
@@ -205,7 +206,7 @@ def test_export_rag_pipeline_dsl_raises_when_dataset_missing() -> None:
 # --- import_rag_pipeline ---
 
 
-def test_import_rag_pipeline_url_fetch_error(mocker) -> None:
+def test_import_rag_pipeline_url_fetch_error(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.remote_fetcher.make_request",
         side_effect=Exception("fetch failed"),
@@ -221,7 +222,7 @@ def test_import_rag_pipeline_url_fetch_error(mocker) -> None:
     assert "fetch failed" in result.error
 
 
-def test_import_rag_pipeline_yaml_content_success(mocker) -> None:
+def test_import_rag_pipeline_yaml_content_success(mocker: MockerFixture) -> None:
     yaml_content = """
 version: 0.1.0
 kind: rag_pipeline
@@ -269,7 +270,7 @@ workflow:
     session.flush.assert_called()
 
 
-def test_import_rag_pipeline_flushes_new_collection_binding_without_commit(mocker) -> None:
+def test_import_rag_pipeline_flushes_new_collection_binding_without_commit(mocker: MockerFixture) -> None:
     yaml_content = """
 version: 0.1.0
 kind: rag_pipeline
@@ -321,7 +322,7 @@ workflow:
     assert session.flush.call_count >= 2
 
 
-def test_import_rag_pipeline_pending_version(mocker) -> None:
+def test_import_rag_pipeline_pending_version(mocker: MockerFixture) -> None:
     yaml_content = "version: 1.0.0\nkind: rag_pipeline\nrag_pipeline: {name: x}"
     mocker.patch("services.rag_pipeline.rag_pipeline_dsl_service.redis_client.setex")
     service = RagPipelineDslService(session=Mock())
@@ -336,7 +337,7 @@ def test_import_rag_pipeline_pending_version(mocker) -> None:
 # --- confirm_import ---
 
 
-def test_confirm_import_success(mocker) -> None:
+def test_confirm_import_success(mocker: MockerFixture) -> None:
     from services.rag_pipeline.rag_pipeline_dsl_service import RagPipelinePendingData
 
     yaml_content = """
@@ -398,7 +399,7 @@ workflow:
     assert result.dataset_id == "d1"
 
 
-def test_confirm_import_flushes_new_collection_binding_without_commit(mocker) -> None:
+def test_confirm_import_flushes_new_collection_binding_without_commit(mocker: MockerFixture) -> None:
     from services.rag_pipeline.rag_pipeline_dsl_service import RagPipelinePendingData
 
     yaml_content = """
@@ -518,7 +519,7 @@ def test_extract_dependencies_from_workflow_graph_types(mocker, node_type) -> No
 # --- _create_or_update_pipeline ---
 
 
-def test_create_or_update_pipeline_create_new(mocker) -> None:
+def test_create_or_update_pipeline_create_new(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     account = Mock(current_tenant_id="t1", id="u1")
@@ -549,7 +550,7 @@ def test_create_or_update_pipeline_create_new(mocker) -> None:
 # --- export_rag_pipeline_dsl comprehensive ---
 
 
-def test_export_rag_pipeline_dsl_with_workflow(mocker) -> None:
+def test_export_rag_pipeline_dsl_with_workflow(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     pipeline = Mock()
@@ -591,7 +592,7 @@ def test_export_rag_pipeline_dsl_with_workflow(mocker) -> None:
 # --- _extract_dependencies_from_workflow_graph more types ---
 
 
-def test_extract_dependencies_from_workflow_graph_datasource(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_datasource(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DatasourceNodeData.model_validate",
         return_value=Mock(provider_type="online", plugin_id="ds1"),
@@ -642,7 +643,7 @@ def test_import_rag_pipeline_yaml_content_requires_mapping() -> None:
     assert "content must be a mapping" in result.error
 
 
-def test_confirm_import_returns_failed_when_pending_data_is_invalid_type(mocker) -> None:
+def test_confirm_import_returns_failed_when_pending_data_is_invalid_type(mocker: MockerFixture) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline_dsl_service.redis_client.get", return_value=object())
     service = RagPipelineDslService(session=Mock())
     account = Mock(current_tenant_id="t1")
@@ -653,7 +654,7 @@ def test_confirm_import_returns_failed_when_pending_data_is_invalid_type(mocker)
     assert "Invalid import information" in result.error
 
 
-def test_append_workflow_export_data_filters_credentials(mocker) -> None:
+def test_append_workflow_export_data_filters_credentials(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     workflow = Mock()
@@ -691,7 +692,7 @@ def test_append_workflow_export_data_filters_credentials(mocker) -> None:
     assert "credential_id" not in nodes[1]["data"]["agent_parameters"]["tools"]["value"][0]
 
 
-def test_create_rag_pipeline_dataset_raises_when_name_conflicts(mocker) -> None:
+def test_create_rag_pipeline_dataset_raises_when_name_conflicts(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     session.scalar.return_value = Mock()
@@ -707,7 +708,7 @@ def test_create_rag_pipeline_dataset_raises_when_name_conflicts(mocker) -> None:
         service.create_rag_pipeline_dataset("tenant-1", create_entity)
 
 
-def test_create_rag_pipeline_dataset_generates_name_when_missing(mocker) -> None:
+def test_create_rag_pipeline_dataset_generates_name_when_missing(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     session.scalar.return_value = None
@@ -741,7 +742,7 @@ def test_create_rag_pipeline_dataset_generates_name_when_missing(mocker) -> None
     assert result["status"] == ImportStatus.COMPLETED
 
 
-def test_append_workflow_export_data_encrypts_knowledge_retrieval_dataset_ids(mocker) -> None:
+def test_append_workflow_export_data_encrypts_knowledge_retrieval_dataset_ids(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     workflow = Mock()
@@ -773,7 +774,7 @@ def test_append_workflow_export_data_encrypts_knowledge_retrieval_dataset_ids(mo
     assert ids == ["enc-d1", "enc-d2"]
 
 
-def test_confirm_import_updates_existing_dataset(mocker) -> None:
+def test_confirm_import_updates_existing_dataset(mocker: MockerFixture) -> None:
     from services.rag_pipeline.rag_pipeline_dsl_service import RagPipelinePendingData
 
     yaml_content = (
@@ -812,7 +813,7 @@ def test_confirm_import_updates_existing_dataset(mocker) -> None:
     assert dataset.indexing_technique == "economy"
 
 
-def test_import_rag_pipeline_yaml_url_handles_empty_content_after_github_rewrite(mocker) -> None:
+def test_import_rag_pipeline_yaml_url_handles_empty_content_after_github_rewrite(mocker: MockerFixture) -> None:
     response = Mock()
     response.raise_for_status.return_value = None
     response.content = b""
@@ -835,7 +836,7 @@ def test_import_rag_pipeline_yaml_url_handles_empty_content_after_github_rewrite
     assert "raw.githubusercontent.com" in called_url
 
 
-def test_create_or_update_pipeline_decrypts_knowledge_retrieval_dataset_ids(mocker) -> None:
+def test_create_or_update_pipeline_decrypts_knowledge_retrieval_dataset_ids(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     account = Mock(id="u1", current_tenant_id="t1")
@@ -866,7 +867,7 @@ def test_create_or_update_pipeline_decrypts_knowledge_retrieval_dataset_ids(mock
     assert draft_workflow.graph is not None
 
 
-def test_create_or_update_pipeline_creates_draft_when_missing(mocker) -> None:
+def test_create_or_update_pipeline_creates_draft_when_missing(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     account = Mock(id="u1", current_tenant_id="t1")
@@ -882,7 +883,7 @@ def test_create_or_update_pipeline_creates_draft_when_missing(mocker) -> None:
     assert pipeline.workflow_id == "wf-new"
 
 
-def test_import_rag_pipeline_url_size_exceeds_limit(mocker) -> None:
+def test_import_rag_pipeline_url_size_exceeds_limit(mocker: MockerFixture) -> None:
     response = Mock()
     response.raise_for_status.return_value = None
     response.content = b"x" * (10 * 1024 * 1024 + 1)
@@ -953,7 +954,7 @@ def test_append_workflow_export_data_raises_when_draft_workflow_missing() -> Non
         service._append_workflow_export_data(export_data={}, pipeline=Mock(tenant_id="t1"), include_secret=False)
 
 
-def test_append_workflow_export_data_keeps_secret_fields_when_include_secret_true(mocker) -> None:
+def test_append_workflow_export_data_keeps_secret_fields_when_include_secret_true(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     workflow = Mock()
@@ -992,7 +993,7 @@ def test_append_workflow_export_data_keeps_secret_fields_when_include_secret_tru
     assert tool_values[0]["credential_id"] == "agent-secret"
 
 
-def test_extract_dependencies_from_workflow_graph_skips_local_file_datasource(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_skips_local_file_datasource(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DatasourceNodeData.model_validate",
         return_value=Mock(provider_type="local_file", plugin_id="plugin-x"),
@@ -1006,7 +1007,7 @@ def test_extract_dependencies_from_workflow_graph_skips_local_file_datasource(mo
     assert result == []
 
 
-def test_extract_dependencies_from_workflow_graph_knowledge_index_reranking(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_knowledge_index_reranking(mocker: MockerFixture) -> None:
     analyze = mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DependenciesAnalysisService.analyze_model_provider_dependency",
         side_effect=lambda provider: f"dep:{provider}",
@@ -1031,7 +1032,7 @@ def test_extract_dependencies_from_workflow_graph_knowledge_index_reranking(mock
     assert analyze.call_count == 2
 
 
-def test_extract_dependencies_from_workflow_graph_multiple_retrieval_weighted_score(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_multiple_retrieval_weighted_score(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DependenciesAnalysisService.analyze_model_provider_dependency",
         return_value="dep:weighted",
@@ -1053,7 +1054,7 @@ def test_extract_dependencies_from_workflow_graph_multiple_retrieval_weighted_sc
     assert result == ["dep:weighted"]
 
 
-def test_extract_dependencies_from_workflow_graph_multiple_retrieval_reranking_model(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_multiple_retrieval_reranking_model(mocker: MockerFixture) -> None:
     mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DependenciesAnalysisService.analyze_model_provider_dependency",
         return_value="dep:rerank",
@@ -1075,7 +1076,7 @@ def test_extract_dependencies_from_workflow_graph_multiple_retrieval_reranking_m
     assert result == ["dep:rerank"]
 
 
-def test_extract_dependencies_from_model_config_includes_dataset_reranking_and_tools(mocker) -> None:
+def test_extract_dependencies_from_model_config_includes_dataset_reranking_and_tools(mocker: MockerFixture) -> None:
     model_analyze = mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DependenciesAnalysisService.analyze_model_provider_dependency",
         side_effect=["dep:model", "dep:rerank"],
@@ -1107,7 +1108,7 @@ def test_extract_dependencies_from_model_config_includes_dataset_reranking_and_t
     tool_analyze.assert_called_once_with("google")
 
 
-def test_check_version_compatibility_hits_major_older_branch(mocker) -> None:
+def test_check_version_compatibility_hits_major_older_branch(mocker: MockerFixture) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline_dsl_service.CURRENT_DSL_VERSION", "1.0.0")
 
     status = check_version_compatibility("0.9.0", rag_pipeline_dsl_service.CURRENT_DSL_VERSION)
@@ -1115,7 +1116,7 @@ def test_check_version_compatibility_hits_major_older_branch(mocker) -> None:
     assert status == ImportStatus.PENDING
 
 
-def test_import_rag_pipeline_sets_default_version_and_kind(mocker) -> None:
+def test_import_rag_pipeline_sets_default_version_and_kind(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     account = Mock(current_tenant_id="t1")
@@ -1147,7 +1148,7 @@ def test_import_rag_pipeline_sets_default_version_and_kind(mocker) -> None:
     assert result.imported_dsl_version == "0.1.0"
 
 
-def test_import_rag_pipeline_creates_pending_for_dependencies(mocker) -> None:
+def test_import_rag_pipeline_creates_pending_for_dependencies(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     account = Mock(current_tenant_id="t1")
@@ -1169,7 +1170,7 @@ workflow: {graph: {nodes: []}}
     setex.assert_called_once()
 
 
-def test_confirm_import_returns_failed_when_pending_pipeline_missing(mocker) -> None:
+def test_confirm_import_returns_failed_when_pending_pipeline_missing(mocker: MockerFixture) -> None:
     from services.rag_pipeline.rag_pipeline_dsl_service import RagPipelinePendingData
 
     pending = RagPipelinePendingData(import_mode="yaml-content", yaml_content="version: 0.1.0", pipeline_id="p1")
@@ -1186,7 +1187,7 @@ def test_confirm_import_returns_failed_when_pending_pipeline_missing(mocker) ->
     assert result.status == ImportStatus.FAILED
 
 
-def test_append_workflow_export_data_skips_empty_node_data(mocker) -> None:
+def test_append_workflow_export_data_skips_empty_node_data(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     workflow = Mock()
@@ -1204,7 +1205,7 @@ def test_append_workflow_export_data_skips_empty_node_data(mocker) -> None:
     assert "workflow" in export_data
 
 
-def test_extract_dependencies_from_workflow_graph_multiple_config_none(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_multiple_config_none(mocker: MockerFixture) -> None:
     retrieval = Mock()
     retrieval.retrieval_mode = "multiple"
     retrieval.multiple_retrieval_config = None
@@ -1221,7 +1222,7 @@ def test_extract_dependencies_from_workflow_graph_multiple_config_none(mocker) -
     assert result == []
 
 
-def test_extract_dependencies_from_workflow_graph_single_config_none(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_single_config_none(mocker: MockerFixture) -> None:
     retrieval = Mock()
     retrieval.retrieval_mode = "single"
     retrieval.single_retrieval_config = None
@@ -1246,7 +1247,7 @@ def test_create_or_update_pipeline_raises_when_workflow_missing() -> None:
         service._create_or_update_pipeline(pipeline=None, data={"rag_pipeline": {"name": "x"}}, account=account)
 
 
-def test_import_rag_pipeline_with_pipeline_id_uses_existing_dataset(mocker) -> None:
+def test_import_rag_pipeline_with_pipeline_id_uses_existing_dataset(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     existing_dataset = Mock(id="d1", chunk_structure="text_model")
@@ -1282,7 +1283,7 @@ def test_import_rag_pipeline_with_pipeline_id_uses_existing_dataset(mocker) -> N
     assert result.dataset_id == "d1"
 
 
-def test_import_rag_pipeline_raises_for_chunk_structure_mismatch_on_published(mocker) -> None:
+def test_import_rag_pipeline_raises_for_chunk_structure_mismatch_on_published(mocker: MockerFixture) -> None:
     session = cast(MagicMock, Mock())
     service = RagPipelineDslService(session=cast(Session, session))
     existing_dataset = Mock(id="d1", chunk_structure="hierarchical_model")
@@ -1318,7 +1319,7 @@ def test_import_rag_pipeline_raises_for_chunk_structure_mismatch_on_published(mo
     assert "Chunk structure is not compatible" in result.error
 
 
-def test_import_rag_pipeline_fails_when_no_knowledge_index_node(mocker) -> None:
+def test_import_rag_pipeline_fails_when_no_knowledge_index_node(mocker: MockerFixture) -> None:
     service = RagPipelineDslService(session=Mock())
     pipeline = Mock(id="p1", name="P", description="D", is_published=False)
     mocker.patch.object(service, "_create_or_update_pipeline", return_value=pipeline)
@@ -1340,7 +1341,7 @@ def test_import_rag_pipeline_fails_when_no_knowledge_index_node(mocker) -> None:
     assert "Knowledge Index node" in result.error
 
 
-def test_confirm_import_fails_when_no_knowledge_index_node(mocker) -> None:
+def test_confirm_import_fails_when_no_knowledge_index_node(mocker: MockerFixture) -> None:
     from services.rag_pipeline.rag_pipeline_dsl_service import RagPipelinePendingData
 
     yaml_content = (
@@ -1369,7 +1370,7 @@ def test_confirm_import_fails_when_no_knowledge_index_node(mocker) -> None:
     assert "Knowledge Index node" in result.error
 
 
-def test_create_or_update_pipeline_saves_dependencies_to_redis(mocker) -> None:
+def test_create_or_update_pipeline_saves_dependencies_to_redis(mocker: MockerFixture) -> None:
     from core.plugin.entities.plugin import PluginDependency
 
     session = cast(MagicMock, Mock())
@@ -1399,7 +1400,9 @@ def test_create_or_update_pipeline_saves_dependencies_to_redis(mocker) -> None:
     setex.assert_called_once()
 
 
-def test_extract_dependencies_from_workflow_graph_knowledge_index_without_embedding_provider(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_knowledge_index_without_embedding_provider(
+    mocker: MockerFixture,
+) -> None:
     mocker.patch(
         "services.rag_pipeline.rag_pipeline_dsl_service.DependenciesAnalysisService.analyze_model_provider_dependency",
         return_value="dep",
@@ -1421,7 +1424,7 @@ def test_extract_dependencies_from_workflow_graph_knowledge_index_without_embedd
     assert result == []
 
 
-def test_extract_dependencies_from_workflow_graph_multiple_reranking_without_model(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_multiple_reranking_without_model(mocker: MockerFixture) -> None:
     retrieval = Mock()
     retrieval.retrieval_mode = "multiple"
     retrieval.multiple_retrieval_config.reranking_mode = "reranking_model"
@@ -1439,7 +1442,7 @@ def test_extract_dependencies_from_workflow_graph_multiple_reranking_without_mod
     assert result == []
 
 
-def test_extract_dependencies_from_workflow_graph_multiple_weighted_without_weights(mocker) -> None:
+def test_extract_dependencies_from_workflow_graph_multiple_weighted_without_weights(mocker: MockerFixture) -> None:
     retrieval = Mock()
     retrieval.retrieval_mode = "multiple"
     retrieval.multiple_retrieval_config.reranking_mode = "weighted_score"
diff --git a/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_manage_service.py b/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_manage_service.py
index bd75e699dc8..faf93f0ce8e 100644
--- a/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_manage_service.py
+++ b/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_manage_service.py
@@ -1,9 +1,11 @@
 from types import SimpleNamespace
 
+from pytest_mock import MockerFixture
+
 from services.rag_pipeline.rag_pipeline_manage_service import RagPipelineManageService
 
 
-def test_list_rag_pipeline_datasources_marks_authorized(mocker) -> None:
+def test_list_rag_pipeline_datasources_marks_authorized(mocker: MockerFixture) -> None:
     datasource_1 = SimpleNamespace(provider="notion", plugin_id="plugin-1", is_authorized=False)
     datasource_2 = SimpleNamespace(provider="jina", plugin_id="plugin-2", is_authorized=False)
 
diff --git a/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_service.py b/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_service.py
index b255595047d..669794ac6d4 100644
--- a/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_service.py
+++ b/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_service.py
@@ -4,6 +4,7 @@ from datetime import datetime
 from types import SimpleNamespace
 
 import pytest
+from pytest_mock import MockerFixture
 from sqlalchemy.orm import sessionmaker
 
 from models import Account, Tenant
@@ -113,7 +114,7 @@ def _make_recommended_plugin(plugin_id: str) -> PipelineRecommendedPlugin:
     return PipelineRecommendedPlugin(plugin_id=plugin_id, provider_name=plugin_id, type="tool", position=0, active=True)
 
 
-def test_get_pipeline_templates_fallbacks_to_builtin_for_non_english_empty_result(mocker) -> None:
+def test_get_pipeline_templates_fallbacks_to_builtin_for_non_english_empty_result(mocker: MockerFixture) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.dify_config.HOSTED_FETCH_PIPELINE_TEMPLATES_MODE", "remote")
 
     remote_retrieval = mocker.Mock()
@@ -132,7 +133,7 @@ def test_get_pipeline_templates_fallbacks_to_builtin_for_non_english_empty_resul
     builtin_retrieval.fetch_pipeline_templates_from_builtin.assert_called_once_with("en-US")
 
 
-def test_get_pipeline_templates_customized_mode_uses_customized_factory(mocker) -> None:
+def test_get_pipeline_templates_customized_mode_uses_customized_factory(mocker: MockerFixture) -> None:
     retrieval = mocker.Mock()
     retrieval.get_pipeline_templates.return_value = {"pipeline_templates": [{"id": "custom-1"}]}
 
@@ -146,7 +147,7 @@ def test_get_pipeline_templates_customized_mode_uses_customized_factory(mocker)
 
 
 @pytest.mark.parametrize("template_type", ["built-in", "customized"])
-def test_get_pipeline_template_detail_uses_expected_mode(mocker, template_type: str) -> None:
+def test_get_pipeline_template_detail_uses_expected_mode(mocker: MockerFixture, template_type: str) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.dify_config.HOSTED_FETCH_PIPELINE_TEMPLATES_MODE", "remote")
     retrieval = mocker.Mock()
     retrieval.get_pipeline_template_detail.return_value = {"id": "tpl-1"}
@@ -161,7 +162,9 @@ def test_get_pipeline_template_detail_uses_expected_mode(mocker, template_type:
     factory_mock.get_pipeline_template_factory.assert_called_with(expected_mode)
 
 
-def test_get_published_workflow_returns_none_when_pipeline_has_no_workflow_id(rag_pipeline_service) -> None:
+def test_get_published_workflow_returns_none_when_pipeline_has_no_workflow_id(
+    rag_pipeline_service: RagPipelineService,
+) -> None:
     pipeline = _make_pipeline(workflow_id=None)
 
     result = rag_pipeline_service.get_published_workflow(pipeline)
@@ -169,7 +172,9 @@ def test_get_published_workflow_returns_none_when_pipeline_has_no_workflow_id(ra
     assert result is None
 
 
-def test_get_all_published_workflow_returns_empty_for_unpublished_pipeline(rag_pipeline_service) -> None:
+def test_get_all_published_workflow_returns_empty_for_unpublished_pipeline(
+    rag_pipeline_service: RagPipelineService,
+) -> None:
     pipeline = _make_pipeline(workflow_id=None)
     session = SimpleNamespace()
 
@@ -186,7 +191,7 @@ def test_get_all_published_workflow_returns_empty_for_unpublished_pipeline(rag_p
     assert has_more is False
 
 
-def test_get_all_published_workflow_applies_limit_and_has_more(rag_pipeline_service) -> None:
+def test_get_all_published_workflow_applies_limit_and_has_more(rag_pipeline_service: RagPipelineService) -> None:
     scalars_result = SimpleNamespace(all=lambda: ["wf1", "wf2", "wf3"])
     session = SimpleNamespace(scalars=lambda stmt: scalars_result)
     pipeline = _make_pipeline(pipeline_id="pipeline-1", workflow_id="wf-live")
@@ -207,7 +212,9 @@ def test_get_all_published_workflow_applies_limit_and_has_more(rag_pipeline_serv
 # --- sync_draft_workflow ---
 
 
-def test_sync_draft_workflow_creates_new_when_none_exists(mocker, rag_pipeline_service) -> None:
+def test_sync_draft_workflow_creates_new_when_none_exists(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch.object(rag_pipeline_service, "get_draft_workflow", return_value=None)
 
     class FakeWorkflow:
@@ -238,7 +245,9 @@ def test_sync_draft_workflow_creates_new_when_none_exists(mocker, rag_pipeline_s
     assert pipeline.workflow_id == "wf-new"
 
 
-def test_sync_draft_workflow_raises_on_hash_mismatch(mocker, rag_pipeline_service) -> None:
+def test_sync_draft_workflow_raises_on_hash_mismatch(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from services.errors.app import WorkflowHashNotEqualError
 
     existing_wf = _make_workflow(graph={"nodes": [{"id": "old"}]})
@@ -259,7 +268,7 @@ def test_sync_draft_workflow_raises_on_hash_mismatch(mocker, rag_pipeline_servic
         )
 
 
-def test_sync_draft_workflow_updates_existing(mocker, rag_pipeline_service) -> None:
+def test_sync_draft_workflow_updates_existing(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     existing_wf = SimpleNamespace(
         unique_hash="hash-1",
         graph=None,
@@ -293,7 +302,9 @@ def test_sync_draft_workflow_updates_existing(mocker, rag_pipeline_service) -> N
 # --- get_default_block_config ---
 
 
-def test_get_default_block_config_returns_config_for_valid_type(mocker, rag_pipeline_service) -> None:
+def test_get_default_block_config_returns_config_for_valid_type(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     fake_node_class = mocker.Mock()
     fake_node_class.get_default_config.return_value = {"type": "start", "config": {}}
 
@@ -311,14 +322,16 @@ def test_get_default_block_config_returns_config_for_valid_type(mocker, rag_pipe
     assert result == {"type": "start", "config": {}}
 
 
-def test_get_default_block_config_returns_none_for_unmapped_type(rag_pipeline_service) -> None:
+def test_get_default_block_config_returns_none_for_unmapped_type(rag_pipeline_service: RagPipelineService) -> None:
     assert rag_pipeline_service.get_default_block_config("nonexistent-type") is None
 
 
 # --- update_workflow ---
 
 
-def test_update_workflow_updates_allowed_fields(mocker, rag_pipeline_service) -> None:
+def test_update_workflow_updates_allowed_fields(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     workflow = SimpleNamespace(
         id="wf-1", marked_name="", marked_comment="", updated_by=None, updated_at=None, disallowed="original"
     )
@@ -339,7 +352,9 @@ def test_update_workflow_updates_allowed_fields(mocker, rag_pipeline_service) ->
     assert result.updated_by == "u1"
 
 
-def test_update_workflow_returns_none_when_not_found(mocker, rag_pipeline_service) -> None:
+def test_update_workflow_returns_none_when_not_found(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     session = mocker.Mock()
     session.scalar.return_value = None
 
@@ -357,7 +372,9 @@ def test_update_workflow_returns_none_when_not_found(mocker, rag_pipeline_servic
 # --- get_rag_pipeline_paginate_workflow_runs ---
 
 
-def test_get_rag_pipeline_paginate_workflow_runs_delegates(mocker, rag_pipeline_service) -> None:
+def test_get_rag_pipeline_paginate_workflow_runs_delegates(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     expected = mocker.Mock()
     repo_mock = mocker.Mock()
     repo_mock.get_paginated_workflow_runs.return_value = expected
@@ -379,7 +396,9 @@ def test_get_rag_pipeline_paginate_workflow_runs_delegates(mocker, rag_pipeline_
 # --- get_rag_pipeline_workflow_run ---
 
 
-def test_get_rag_pipeline_workflow_run_delegates(mocker, rag_pipeline_service) -> None:
+def test_get_rag_pipeline_workflow_run_delegates(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     expected = mocker.Mock()
     repo_mock = mocker.Mock()
     repo_mock.get_workflow_run_by_id.return_value = expected
@@ -395,14 +414,18 @@ def test_get_rag_pipeline_workflow_run_delegates(mocker, rag_pipeline_service) -
 # --- is_workflow_exist ---
 
 
-def test_is_workflow_exist_returns_true_when_draft_exists(mocker, rag_pipeline_service) -> None:
+def test_is_workflow_exist_returns_true_when_draft_exists(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", return_value=1)
 
     pipeline = _make_pipeline()
     assert rag_pipeline_service.is_workflow_exist(pipeline) is True
 
 
-def test_is_workflow_exist_returns_false_when_no_draft(mocker, rag_pipeline_service) -> None:
+def test_is_workflow_exist_returns_false_when_no_draft(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", return_value=0)
 
     pipeline = _make_pipeline()
@@ -412,7 +435,7 @@ def test_is_workflow_exist_returns_false_when_no_draft(mocker, rag_pipeline_serv
 # --- publish_workflow ---
 
 
-def test_publish_workflow_success(mocker, rag_pipeline_service) -> None:
+def test_publish_workflow_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     # Don't import Workflow from rag_pipeline to avoid confusion during patching
 
     # 1. Mock select to bypass SQLAlchemy validation
@@ -483,7 +506,9 @@ def test_publish_workflow_success(mocker, rag_pipeline_service) -> None:
 # --- run_datasource_workflow_node ---
 
 
-def test_run_datasource_workflow_node_website_crawl(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_workflow_node_website_crawl(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceProviderType
 
     # 1. Setup workflow and node
@@ -559,7 +584,9 @@ def test_run_datasource_workflow_node_website_crawl(mocker, rag_pipeline_service
 # --- run_datasource_node_preview ---
 
 
-def test_run_datasource_node_preview_online_document(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_node_preview_online_document(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceMessage, DatasourceProviderType
 
     # 1. Setup workflow and node
@@ -632,7 +659,7 @@ def test_run_datasource_node_preview_online_document(mocker, rag_pipeline_servic
 # --- _handle_node_run_result ---
 
 
-def test_handle_node_run_result_success(mocker, rag_pipeline_service) -> None:
+def test_handle_node_run_result_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     from graphon.enums import WorkflowNodeExecutionMetadataKey, WorkflowNodeExecutionStatus
     from graphon.graph_events import NodeRunSucceededEvent
     from graphon.node_events.base import NodeRunResult
@@ -676,7 +703,7 @@ def test_handle_node_run_result_success(mocker, rag_pipeline_service) -> None:
 # --- get_first_step_parameters / get_second_step_parameters ---
 
 
-def test_get_first_step_parameters_success(mocker, rag_pipeline_service) -> None:
+def test_get_first_step_parameters_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     # 1. Setup mock workflow
     pipeline = mocker.Mock()
     workflow = mocker.Mock()
@@ -694,7 +721,7 @@ def test_get_first_step_parameters_success(mocker, rag_pipeline_service) -> None
     assert result[0]["variable"] == "url"
 
 
-def test_get_second_step_parameters_success(mocker, rag_pipeline_service) -> None:
+def test_get_second_step_parameters_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     # 1. Setup mock workflow
     pipeline = mocker.Mock()
     workflow = mocker.Mock()
@@ -722,7 +749,9 @@ def test_get_second_step_parameters_success(mocker, rag_pipeline_service) -> Non
 # --- publish_customized_pipeline_template ---
 
 
-def test_publish_customized_pipeline_template_success(mocker, rag_pipeline_service) -> None:
+def test_publish_customized_pipeline_template_success(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     # 1. Setup mocks
     pipeline = _make_pipeline(workflow_id="wf-1", is_published=True)
 
@@ -765,7 +794,7 @@ def test_publish_customized_pipeline_template_success(mocker, rag_pipeline_servi
 # --- get_datasource_plugins ---
 
 
-def test_get_datasource_plugins_success(mocker, rag_pipeline_service) -> None:
+def test_get_datasource_plugins_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     # 1. Setup mocks
     dataset = _make_dataset()
 
@@ -812,7 +841,7 @@ def test_get_datasource_plugins_success(mocker, rag_pipeline_service) -> None:
 # --- retry_error_document ---
 
 
-def test_retry_error_document_success(mocker, rag_pipeline_service) -> None:
+def test_retry_error_document_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     from models.dataset import Document, DocumentPipelineExecutionLog, Pipeline
 
     # 1. Setup mocks
@@ -850,7 +879,7 @@ def test_retry_error_document_success(mocker, rag_pipeline_service) -> None:
 # --- set_datasource_variables ---
 
 
-def test_set_datasource_variables_success(mocker, rag_pipeline_service) -> None:
+def test_set_datasource_variables_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     from graphon.entities.workflow_node_execution import WorkflowNodeExecution
     from models.dataset import Pipeline
 
@@ -909,7 +938,7 @@ def test_set_datasource_variables_success(mocker, rag_pipeline_service) -> None:
 # --- Utility Methods ---
 
 
-def test_get_draft_workflow_success(mocker, rag_pipeline_service) -> None:
+def test_get_draft_workflow_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     # 1. Setup mocks
     pipeline = _make_pipeline()
 
@@ -925,7 +954,7 @@ def test_get_draft_workflow_success(mocker, rag_pipeline_service) -> None:
     assert result == workflow
 
 
-def test_get_published_workflow_success(mocker, rag_pipeline_service) -> None:
+def test_get_published_workflow_success(mocker: MockerFixture, rag_pipeline_service: RagPipelineService) -> None:
     # 1. Setup mocks
     pipeline = _make_pipeline(workflow_id="wf-pub")
 
@@ -941,7 +970,7 @@ def test_get_published_workflow_success(mocker, rag_pipeline_service) -> None:
     assert result == workflow
 
 
-def test_get_default_block_configs_success(rag_pipeline_service) -> None:
+def test_get_default_block_configs_success(rag_pipeline_service: RagPipelineService) -> None:
     # This calls static methods on node classes, should be safe with default mocks or as-is
     # unless they access db.
     result = rag_pipeline_service.get_default_block_configs()
@@ -949,7 +978,7 @@ def test_get_default_block_configs_success(rag_pipeline_service) -> None:
     assert len(result) > 0
 
 
-def test_get_default_block_config_success(rag_pipeline_service) -> None:
+def test_get_default_block_config_success(rag_pipeline_service: RagPipelineService) -> None:
     from graphon.enums import BuiltinNodeTypes
 
     result = rag_pipeline_service.get_default_block_config(BuiltinNodeTypes.LLM)
@@ -957,7 +986,9 @@ def test_get_default_block_config_success(rag_pipeline_service) -> None:
     assert result["type"] == "llm"
 
 
-def test_publish_workflow_raises_when_draft_workflow_missing(mocker, rag_pipeline_service) -> None:
+def test_publish_workflow_raises_when_draft_workflow_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     session = mocker.Mock()
     session.scalar.return_value = None
     pipeline = _make_pipeline()
@@ -967,7 +998,9 @@ def test_publish_workflow_raises_when_draft_workflow_missing(mocker, rag_pipelin
         rag_pipeline_service.publish_workflow(session=session, pipeline=pipeline, account=account)
 
 
-def test_get_default_block_config_returns_none_when_mapped_type_missing(mocker, rag_pipeline_service) -> None:
+def test_get_default_block_config_returns_none_when_mapped_type_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from graphon.enums import BuiltinNodeTypes
 
     mocker.patch("services.rag_pipeline.rag_pipeline.get_node_type_classes_mapping", return_value={})
@@ -975,7 +1008,9 @@ def test_get_default_block_config_returns_none_when_mapped_type_missing(mocker,
     assert rag_pipeline_service.get_default_block_config(BuiltinNodeTypes.START) is None
 
 
-def test_get_default_block_config_injects_http_request_filter(mocker, rag_pipeline_service) -> None:
+def test_get_default_block_config_injects_http_request_filter(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from graphon.enums import BuiltinNodeTypes
 
     fake_node_cls = mocker.Mock()
@@ -992,7 +1027,9 @@ def test_get_default_block_config_injects_http_request_filter(mocker, rag_pipeli
     assert "http_request_config" in called_filters
 
 
-def test_run_draft_workflow_node_raises_when_workflow_missing(mocker, rag_pipeline_service) -> None:
+def test_run_draft_workflow_node_raises_when_workflow_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = _make_pipeline()
     account = _make_account()
     mocker.patch.object(rag_pipeline_service, "get_draft_workflow", return_value=None)
@@ -1001,7 +1038,9 @@ def test_run_draft_workflow_node_raises_when_workflow_missing(mocker, rag_pipeli
         rag_pipeline_service.run_draft_workflow_node(pipeline, "node-1", {}, account)
 
 
-def test_run_draft_workflow_node_saves_execution_and_variables(mocker, rag_pipeline_service) -> None:
+def test_run_draft_workflow_node_saves_execution_and_variables(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.db", mocker.Mock(engine=mocker.Mock()))
     pipeline = _make_pipeline()
     account = _make_account()
@@ -1035,7 +1074,9 @@ def test_run_draft_workflow_node_saves_execution_and_variables(mocker, rag_pipel
     saver.save.assert_called_once()
 
 
-def test_run_datasource_workflow_node_returns_error_when_workflow_missing(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_workflow_node_returns_error_when_workflow_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
     mocker.patch.object(rag_pipeline_service, "get_draft_workflow", return_value=None)
 
@@ -1053,7 +1094,9 @@ def test_run_datasource_workflow_node_returns_error_when_workflow_missing(mocker
     assert events[0]["event"] == "datasource_error"
 
 
-def test_run_datasource_workflow_node_online_document_success(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_workflow_node_online_document_success(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceProviderType
 
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
@@ -1099,7 +1142,9 @@ def test_run_datasource_workflow_node_online_document_success(mocker, rag_pipeli
     assert events[1]["event"] == "datasource_completed"
 
 
-def test_run_datasource_workflow_node_online_drive_success(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_workflow_node_online_drive_success(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceProviderType
 
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
@@ -1145,7 +1190,9 @@ def test_run_datasource_workflow_node_online_drive_success(mocker, rag_pipeline_
     assert events[1]["event"] == "datasource_completed"
 
 
-def test_handle_node_run_result_default_value_strategy(mocker, rag_pipeline_service) -> None:
+def test_handle_node_run_result_default_value_strategy(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from datetime import datetime
 
     from graphon.enums import BuiltinNodeTypes, ErrorStrategy, WorkflowNodeExecutionStatus
@@ -1190,7 +1237,9 @@ def test_handle_node_run_result_default_value_strategy(mocker, rag_pipeline_serv
     assert result.outputs["fallback"] == "ok"
 
 
-def test_get_first_step_parameters_raises_when_datasource_node_missing(mocker, rag_pipeline_service) -> None:
+def test_get_first_step_parameters_raises_when_datasource_node_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     workflow = SimpleNamespace(graph_dict={"nodes": []}, rag_pipeline_variables=[{"variable": "url"}])
     mocker.patch.object(rag_pipeline_service, "get_published_workflow", return_value=workflow)
 
@@ -1198,7 +1247,9 @@ def test_get_first_step_parameters_raises_when_datasource_node_missing(mocker, r
         rag_pipeline_service.get_first_step_parameters(SimpleNamespace(), "missing-node")
 
 
-def test_get_second_step_parameters_handles_string_and_list_variable_references(mocker, rag_pipeline_service) -> None:
+def test_get_second_step_parameters_handles_string_and_list_variable_references(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     workflow = SimpleNamespace(
         rag_pipeline_variables=[
             {"variable": "url", "belong_to_node_id": "node-1"},
@@ -1226,7 +1277,9 @@ def test_get_second_step_parameters_handles_string_and_list_variable_references(
     assert result == [{"variable": "keep", "belong_to_node_id": "node-1"}]
 
 
-def test_get_rag_pipeline_workflow_run_node_executions_empty_when_run_missing(mocker, rag_pipeline_service) -> None:
+def test_get_rag_pipeline_workflow_run_node_executions_empty_when_run_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = _make_pipeline()
     mocker.patch.object(rag_pipeline_service, "get_rag_pipeline_workflow_run", return_value=None)
 
@@ -1237,7 +1290,9 @@ def test_get_rag_pipeline_workflow_run_node_executions_empty_when_run_missing(mo
     assert result == []
 
 
-def test_get_rag_pipeline_workflow_run_node_executions_returns_sorted_executions(mocker, rag_pipeline_service) -> None:
+def test_get_rag_pipeline_workflow_run_node_executions_returns_sorted_executions(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.db", mocker.Mock(engine=mocker.Mock()))
     pipeline = _make_pipeline()
     mocker.patch.object(rag_pipeline_service, "get_rag_pipeline_workflow_run", return_value=SimpleNamespace(id="run-1"))
@@ -1252,7 +1307,9 @@ def test_get_rag_pipeline_workflow_run_node_executions_returns_sorted_executions
     assert result == ["n1", "n2"]
 
 
-def test_get_recommended_plugins_returns_empty_when_no_active_plugins(mocker, rag_pipeline_service) -> None:
+def test_get_recommended_plugins_returns_empty_when_no_active_plugins(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mock_db = mocker.patch("services.rag_pipeline.rag_pipeline.db")
     mock_db.session.scalars.return_value.all.return_value = []
 
@@ -1264,7 +1321,9 @@ def test_get_recommended_plugins_returns_empty_when_no_active_plugins(mocker, ra
     }
 
 
-def test_get_recommended_plugins_returns_installed_and_uninstalled(mocker, rag_pipeline_service) -> None:
+def test_get_recommended_plugins_returns_installed_and_uninstalled(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     plugin_a = _make_recommended_plugin("plugin-a")
     plugin_b = _make_recommended_plugin("plugin-b")
     mock_db = mocker.patch("services.rag_pipeline.rag_pipeline.db")
@@ -1284,7 +1343,9 @@ def test_get_recommended_plugins_returns_installed_and_uninstalled(mocker, rag_p
     assert result["uninstalled_recommended_plugins"] == [{"plugin_id": "plugin-b", "name": "Plugin B"}]
 
 
-def test_get_node_last_run_delegates_to_repository(mocker, rag_pipeline_service) -> None:
+def test_get_node_last_run_delegates_to_repository(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.db", mocker.Mock(engine=mocker.Mock()))
     repo = mocker.Mock()
     repo.get_node_last_execution.return_value = "node-exec"
@@ -1300,7 +1361,9 @@ def test_get_node_last_run_delegates_to_repository(mocker, rag_pipeline_service)
     assert result == "node-exec"
 
 
-def test_set_datasource_variables_raises_when_node_id_missing(mocker, rag_pipeline_service) -> None:
+def test_set_datasource_variables_raises_when_node_id_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
     workflow = mocker.Mock()
     mocker.patch.object(rag_pipeline_service, "get_draft_workflow", return_value=workflow)
@@ -1309,7 +1372,9 @@ def test_set_datasource_variables_raises_when_node_id_missing(mocker, rag_pipeli
         rag_pipeline_service.set_datasource_variables(pipeline, {"start_node_id": ""}, SimpleNamespace(id="u1"))
 
 
-def test_get_default_block_configs_skips_empty_configs(mocker, rag_pipeline_service) -> None:
+def test_get_default_block_configs_skips_empty_configs(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from graphon.enums import BuiltinNodeTypes
 
     http_node = mocker.Mock()
@@ -1333,7 +1398,9 @@ def test_get_default_block_configs_skips_empty_configs(mocker, rag_pipeline_serv
     empty_node.get_default_config.assert_called_once()
 
 
-def test_run_datasource_workflow_node_returns_error_when_node_missing(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_workflow_node_returns_error_when_node_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
     workflow = SimpleNamespace(graph_dict={"nodes": []})
     mocker.patch.object(rag_pipeline_service, "get_published_workflow", return_value=workflow)
@@ -1353,7 +1420,9 @@ def test_run_datasource_workflow_node_returns_error_when_node_missing(mocker, ra
     assert "Datasource node data not found" in events[0]["error"]
 
 
-def test_run_datasource_workflow_node_online_document_exception(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_workflow_node_online_document_exception(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
     workflow = SimpleNamespace(
         graph_dict={
@@ -1405,7 +1474,9 @@ def test_run_datasource_workflow_node_online_document_exception(mocker, rag_pipe
     assert "doc failed" in events[1]["error"]
 
 
-def test_run_datasource_node_preview_raises_for_stream_non_string(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_node_preview_raises_for_stream_non_string(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceMessage
 
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
@@ -1453,7 +1524,9 @@ def test_run_datasource_node_preview_raises_for_stream_non_string(mocker, rag_pi
         )
 
 
-def test_get_first_step_parameters_returns_empty_when_no_rag_variables(mocker, rag_pipeline_service) -> None:
+def test_get_first_step_parameters_returns_empty_when_no_rag_variables(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     workflow = SimpleNamespace(
         graph_dict={"nodes": [{"id": "node-1", "data": {"datasource_parameters": {"url": {"value": "literal"}}}}]},
         rag_pipeline_variables=[],
@@ -1465,7 +1538,9 @@ def test_get_first_step_parameters_returns_empty_when_no_rag_variables(mocker, r
     assert result == []
 
 
-def test_get_second_step_parameters_filters_first_step_variables(mocker, rag_pipeline_service) -> None:
+def test_get_second_step_parameters_filters_first_step_variables(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     workflow = SimpleNamespace(
         graph_dict={
             "nodes": [
@@ -1494,7 +1569,9 @@ def test_get_second_step_parameters_filters_first_step_variables(mocker, rag_pip
     assert result == [{"variable": "keep", "belong_to_node_id": "shared"}]
 
 
-def test_retry_error_document_raises_when_execution_log_not_found(mocker, rag_pipeline_service) -> None:
+def test_retry_error_document_raises_when_execution_log_not_found(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", return_value=None)
 
     with pytest.raises(ValueError, match="Document pipeline execution log not found"):
@@ -1503,7 +1580,9 @@ def test_retry_error_document_raises_when_execution_log_not_found(mocker, rag_pi
         )
 
 
-def test_get_datasource_plugins_raises_when_workflow_not_found(mocker, rag_pipeline_service) -> None:
+def test_get_datasource_plugins_raises_when_workflow_not_found(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     dataset = SimpleNamespace(pipeline_id="p1")
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", side_effect=[dataset, pipeline])
@@ -1513,7 +1592,9 @@ def test_get_datasource_plugins_raises_when_workflow_not_found(mocker, rag_pipel
         rag_pipeline_service.get_datasource_plugins("t1", "d1", True)
 
 
-def test_handle_node_run_result_raises_when_no_terminal_event(mocker, rag_pipeline_service) -> None:
+def test_handle_node_run_result_raises_when_no_terminal_event(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     node_instance = SimpleNamespace(
         workflow_id="wf-1",
         node_type="start",
@@ -1534,7 +1615,9 @@ def test_handle_node_run_result_raises_when_no_terminal_event(mocker, rag_pipeli
         )
 
 
-def test_handle_node_run_result_marks_document_error_for_published_invoke(mocker, rag_pipeline_service) -> None:
+def test_handle_node_run_result_marks_document_error_for_published_invoke(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.app.entities.app_invoke_entities import InvokeFrom
     from graphon.enums import WorkflowNodeExecutionStatus
     from graphon.graph_events import NodeRunFailedEvent
@@ -1595,7 +1678,9 @@ def test_handle_node_run_result_marks_document_error_for_published_invoke(mocker
     commit_mock.assert_called_once()
 
 
-def test_run_datasource_node_preview_raises_for_unsupported_provider(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_node_preview_raises_for_unsupported_provider(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = SimpleNamespace(id="p1", tenant_id="t1")
     workflow = SimpleNamespace(
         graph_dict={
@@ -1631,14 +1716,18 @@ def test_run_datasource_node_preview_raises_for_unsupported_provider(mocker, rag
         )
 
 
-def test_publish_customized_pipeline_template_raises_for_missing_pipeline(mocker, rag_pipeline_service) -> None:
+def test_publish_customized_pipeline_template_raises_for_missing_pipeline(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.get", return_value=None)
 
     with pytest.raises(ValueError, match="Pipeline not found"):
         rag_pipeline_service.publish_customized_pipeline_template("p1", {}, _make_account(), "t1")
 
 
-def test_publish_customized_pipeline_template_raises_for_missing_workflow_id(mocker, rag_pipeline_service) -> None:
+def test_publish_customized_pipeline_template_raises_for_missing_workflow_id(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = _make_pipeline(workflow_id=None)
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.get", return_value=pipeline)
 
@@ -1648,14 +1737,18 @@ def test_publish_customized_pipeline_template_raises_for_missing_workflow_id(moc
         )
 
 
-def test_get_pipeline_raises_when_dataset_missing(mocker, rag_pipeline_service) -> None:
+def test_get_pipeline_raises_when_dataset_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", return_value=None)
 
     with pytest.raises(ValueError, match="Dataset not found"):
         rag_pipeline_service.get_pipeline("t1", "d1")
 
 
-def test_get_pipeline_raises_when_pipeline_missing(mocker, rag_pipeline_service) -> None:
+def test_get_pipeline_raises_when_pipeline_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     dataset = SimpleNamespace(pipeline_id="p1")
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", side_effect=[dataset, None])
 
@@ -1663,7 +1756,7 @@ def test_get_pipeline_raises_when_pipeline_missing(mocker, rag_pipeline_service)
         rag_pipeline_service.get_pipeline("t1", "d1")
 
 
-def test_init_uses_default_sessionmaker_when_none(mocker) -> None:
+def test_init_uses_default_sessionmaker_when_none(mocker: MockerFixture) -> None:
     default_session_maker = mocker.Mock()
     mocker.patch("services.rag_pipeline.rag_pipeline.sessionmaker", return_value=default_session_maker)
     mocker.patch("services.rag_pipeline.rag_pipeline.db", SimpleNamespace(engine=mocker.Mock()))
@@ -1680,7 +1773,7 @@ def test_init_uses_default_sessionmaker_when_none(mocker) -> None:
     create_run_repo.assert_called_once_with(default_session_maker)
 
 
-def test_get_pipeline_templates_builtin_en_us_no_fallback(mocker) -> None:
+def test_get_pipeline_templates_builtin_en_us_no_fallback(mocker: MockerFixture) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline.dify_config.HOSTED_FETCH_PIPELINE_TEMPLATES_MODE", "remote")
     retrieval = mocker.Mock()
     retrieval.get_pipeline_templates.return_value = {"pipeline_templates": []}
@@ -1694,7 +1787,7 @@ def test_get_pipeline_templates_builtin_en_us_no_fallback(mocker) -> None:
     builtin.fetch_pipeline_templates_from_builtin.assert_not_called()
 
 
-def test_update_customized_pipeline_template_commits_when_name_empty(mocker) -> None:
+def test_update_customized_pipeline_template_commits_when_name_empty(mocker: MockerFixture) -> None:
     template = _make_customized_template()
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", return_value=template)
     commit = mocker.patch("services.rag_pipeline.rag_pipeline.db.session.commit")
@@ -1706,7 +1799,7 @@ def test_update_customized_pipeline_template_commits_when_name_empty(mocker) ->
     commit.assert_called_once()
 
 
-def test_get_all_published_workflow_without_filters_has_no_more(rag_pipeline_service) -> None:
+def test_get_all_published_workflow_without_filters_has_no_more(rag_pipeline_service: RagPipelineService) -> None:
     session = SimpleNamespace(scalars=lambda stmt: SimpleNamespace(all=lambda: ["wf1"]))
     pipeline = _make_pipeline(workflow_id="wf-live")
 
@@ -1723,7 +1816,9 @@ def test_get_all_published_workflow_without_filters_has_no_more(rag_pipeline_ser
     assert has_more is False
 
 
-def test_publish_workflow_skips_dataset_update_for_non_knowledge_nodes(mocker, rag_pipeline_service) -> None:
+def test_publish_workflow_skips_dataset_update_for_non_knowledge_nodes(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     draft = SimpleNamespace(
         type="workflow",
         graph={"nodes": [{"data": {"type": "start"}}]},
@@ -1747,7 +1842,9 @@ def test_publish_workflow_skips_dataset_update_for_non_knowledge_nodes(mocker, r
     assert result is published
 
 
-def test_get_default_block_config_returns_none_when_default_empty(mocker, rag_pipeline_service) -> None:
+def test_get_default_block_config_returns_none_when_default_empty(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from graphon.enums import BuiltinNodeTypes
 
     node_cls = mocker.Mock()
@@ -1761,7 +1858,9 @@ def test_get_default_block_config_returns_none_when_default_empty(mocker, rag_pi
     assert rag_pipeline_service.get_default_block_config("start") is None
 
 
-def test_run_datasource_workflow_node_handles_variable_parameter_types(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_workflow_node_handles_variable_parameter_types(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceProviderType
 
     workflow = SimpleNamespace(
@@ -1811,7 +1910,9 @@ def test_run_datasource_workflow_node_handles_variable_parameter_types(mocker, r
     assert events[0]["data"] == []
 
 
-def test_run_datasource_workflow_node_online_drive_branch(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_workflow_node_online_drive_branch(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceProviderType
 
     workflow = SimpleNamespace(
@@ -1857,7 +1958,9 @@ def test_run_datasource_workflow_node_online_drive_branch(mocker, rag_pipeline_s
     assert events[1]["data"] == {"items": [1]}
 
 
-def test_run_datasource_node_preview_not_published_uses_draft(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_node_preview_not_published_uses_draft(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceMessage
 
     workflow = SimpleNamespace(
@@ -1903,7 +2006,9 @@ def test_run_datasource_node_preview_not_published_uses_draft(mocker, rag_pipeli
     get_draft.assert_called_once()
 
 
-def test_run_free_workflow_node_delegates_to_handle_result(mocker, rag_pipeline_service) -> None:
+def test_run_free_workflow_node_delegates_to_handle_result(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     expected = SimpleNamespace(id="exec-1")
     handle = mocker.patch.object(rag_pipeline_service, "_handle_node_run_result", return_value=expected)
 
@@ -1919,7 +2024,9 @@ def test_run_free_workflow_node_delegates_to_handle_result(mocker, rag_pipeline_
     handle.assert_called_once()
 
 
-def test_publish_customized_pipeline_template_raises_when_workflow_missing(mocker, rag_pipeline_service) -> None:
+def test_publish_customized_pipeline_template_raises_when_workflow_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = _make_pipeline(workflow_id="wf-1")
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.get", side_effect=[pipeline, None])
 
@@ -1927,7 +2034,9 @@ def test_publish_customized_pipeline_template_raises_when_workflow_missing(mocke
         rag_pipeline_service.publish_customized_pipeline_template("p1", {}, _make_account(), "t1")
 
 
-def test_publish_customized_pipeline_template_raises_when_dataset_missing(mocker, rag_pipeline_service) -> None:
+def test_publish_customized_pipeline_template_raises_when_dataset_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     pipeline = _make_pipeline(workflow_id="wf-1")
     workflow = _make_workflow(workflow_id="wf-1")
     mock_db = mocker.patch("services.rag_pipeline.rag_pipeline.db")
@@ -1940,7 +2049,9 @@ def test_publish_customized_pipeline_template_raises_when_dataset_missing(mocker
         rag_pipeline_service.publish_customized_pipeline_template("p1", {}, _make_account(), "t1")
 
 
-def test_get_recommended_plugins_skips_manifest_when_missing(mocker, rag_pipeline_service) -> None:
+def test_get_recommended_plugins_skips_manifest_when_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     plugin = _make_recommended_plugin("plugin-a")
     mock_db = mocker.patch("services.rag_pipeline.rag_pipeline.db")
     mock_db.session.scalars.return_value.all.return_value = [plugin]
@@ -1953,7 +2064,9 @@ def test_get_recommended_plugins_skips_manifest_when_missing(mocker, rag_pipelin
     assert result["uninstalled_recommended_plugins"] == []
 
 
-def test_retry_error_document_raises_when_pipeline_missing(mocker, rag_pipeline_service) -> None:
+def test_retry_error_document_raises_when_pipeline_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     exec_log = SimpleNamespace(pipeline_id="p1")
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", return_value=exec_log)
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.get", return_value=None)
@@ -1964,7 +2077,9 @@ def test_retry_error_document_raises_when_pipeline_missing(mocker, rag_pipeline_
         )
 
 
-def test_retry_error_document_raises_when_workflow_missing(mocker, rag_pipeline_service) -> None:
+def test_retry_error_document_raises_when_workflow_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     exec_log = SimpleNamespace(pipeline_id="p1")
     pipeline = SimpleNamespace(id="p1")
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", return_value=exec_log)
@@ -1977,7 +2092,9 @@ def test_retry_error_document_raises_when_workflow_missing(mocker, rag_pipeline_
         )
 
 
-def test_get_datasource_plugins_returns_empty_for_non_datasource_nodes(mocker, rag_pipeline_service) -> None:
+def test_get_datasource_plugins_returns_empty_for_non_datasource_nodes(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     dataset = _make_dataset()
     pipeline = _make_pipeline()
     workflow = SimpleNamespace(
@@ -1989,7 +2106,9 @@ def test_get_datasource_plugins_returns_empty_for_non_datasource_nodes(mocker, r
     assert rag_pipeline_service.get_datasource_plugins("t1", "d1", True) == []
 
 
-def test_publish_workflow_raises_when_knowledge_index_dataset_missing(mocker, rag_pipeline_service) -> None:
+def test_publish_workflow_raises_when_knowledge_index_dataset_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     draft = SimpleNamespace(
         type="workflow",
         graph={"nodes": [{"data": {"type": "knowledge-index"}}]},
@@ -2012,7 +2131,9 @@ def test_publish_workflow_raises_when_knowledge_index_dataset_missing(mocker, ra
         rag_pipeline_service.publish_workflow(session=session, pipeline=pipeline, account=SimpleNamespace(id="u1"))
 
 
-def test_run_datasource_node_preview_raises_when_workflow_missing(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_node_preview_raises_when_workflow_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch.object(rag_pipeline_service, "get_published_workflow", return_value=None)
 
     with pytest.raises(RuntimeError, match="Workflow not initialized"):
@@ -2026,7 +2147,9 @@ def test_run_datasource_node_preview_raises_when_workflow_missing(mocker, rag_pi
         )
 
 
-def test_run_datasource_node_preview_raises_when_node_missing(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_node_preview_raises_when_node_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch.object(
         rag_pipeline_service, "get_published_workflow", return_value=SimpleNamespace(graph_dict={"nodes": []})
     )
@@ -2042,7 +2165,9 @@ def test_run_datasource_node_preview_raises_when_node_missing(mocker, rag_pipeli
         )
 
 
-def test_run_datasource_node_preview_keeps_existing_user_input(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_node_preview_keeps_existing_user_input(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     from core.datasource.entities.datasource_entities import DatasourceMessage
 
     workflow = SimpleNamespace(
@@ -2088,7 +2213,9 @@ def test_run_datasource_node_preview_keeps_existing_user_input(mocker, rag_pipel
     assert result == {"ok": "1"}
 
 
-def test_run_datasource_node_preview_ignores_non_variable_messages(mocker, rag_pipeline_service) -> None:
+def test_run_datasource_node_preview_ignores_non_variable_messages(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     workflow = SimpleNamespace(
         graph_dict={
             "nodes": [
@@ -2127,7 +2254,9 @@ def test_run_datasource_node_preview_ignores_non_variable_messages(mocker, rag_p
     assert result == {}
 
 
-def test_set_datasource_variables_raises_when_workflow_missing(mocker, rag_pipeline_service) -> None:
+def test_set_datasource_variables_raises_when_workflow_missing(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     mocker.patch.object(rag_pipeline_service, "get_draft_workflow", return_value=None)
 
     with pytest.raises(ValueError, match="Workflow not initialized"):
@@ -2138,7 +2267,9 @@ def test_set_datasource_variables_raises_when_workflow_missing(mocker, rag_pipel
         )
 
 
-def test_get_datasource_plugins_handles_empty_datasource_data_and_non_published(mocker, rag_pipeline_service) -> None:
+def test_get_datasource_plugins_handles_empty_datasource_data_and_non_published(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     dataset = _make_dataset()
     pipeline = _make_pipeline()
     workflow = SimpleNamespace(
@@ -2156,7 +2287,9 @@ def test_get_datasource_plugins_handles_empty_datasource_data_and_non_published(
     assert len(result) == 1
 
 
-def test_get_datasource_plugins_extracts_user_inputs_and_credentials(mocker, rag_pipeline_service) -> None:
+def test_get_datasource_plugins_extracts_user_inputs_and_credentials(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     dataset = _make_dataset()
     pipeline = _make_pipeline()
     workflow = SimpleNamespace(
@@ -2198,7 +2331,9 @@ def test_get_datasource_plugins_extracts_user_inputs_and_credentials(mocker, rag
     assert result[0]["credentials"][0]["id"] == "c1"
 
 
-def test_get_pipeline_returns_pipeline_when_found(mocker, rag_pipeline_service) -> None:
+def test_get_pipeline_returns_pipeline_when_found(
+    mocker: MockerFixture, rag_pipeline_service: RagPipelineService
+) -> None:
     dataset = _make_dataset()
     pipeline = _make_pipeline()
     mocker.patch("services.rag_pipeline.rag_pipeline.db.session.scalar", side_effect=[dataset, pipeline])
diff --git a/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_task_proxy.py b/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_task_proxy.py
index 287391c24c4..a05930c73ce 100644
--- a/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_task_proxy.py
+++ b/api/tests/unit_tests/services/rag_pipeline/test_rag_pipeline_task_proxy.py
@@ -23,7 +23,7 @@ def proxy(mocker: MockerFixture):
 # --- delay ---
 
 
-def test_delay_with_empty_entities_logs_warning_and_returns(mocker) -> None:
+def test_delay_with_empty_entities_logs_warning_and_returns(mocker: MockerFixture) -> None:
     mocker.patch("services.rag_pipeline.rag_pipeline_task_proxy.TenantIsolatedTaskQueue")
     proxy = RagPipelineTaskProxy(
         dataset_tenant_id="tenant-1",
@@ -37,7 +37,7 @@ def test_delay_with_empty_entities_logs_warning_and_returns(mocker) -> None:
     dispatch_mock.assert_not_called()
 
 
-def test_delay_with_entities_calls_dispatch(mocker, proxy) -> None:
+def test_delay_with_entities_calls_dispatch(mocker: MockerFixture, proxy) -> None:
     dispatch_mock = mocker.patch.object(proxy, "_dispatch")
 
     proxy.delay()
@@ -48,7 +48,7 @@ def test_delay_with_entities_calls_dispatch(mocker, proxy) -> None:
 # --- _dispatch ---
 
 
-def test_dispatch_billing_sandbox_uses_default_tenant_queue(mocker, proxy) -> None:
+def test_dispatch_billing_sandbox_uses_default_tenant_queue(mocker: MockerFixture, proxy) -> None:
     upload_mock = mocker.patch.object(proxy, "_upload_invoke_entities", return_value="file-1")
     send_mock = mocker.patch.object(proxy, "_send_to_default_tenant_queue")
 
@@ -65,7 +65,7 @@ def test_dispatch_billing_sandbox_uses_default_tenant_queue(mocker, proxy) -> No
     send_mock.assert_called_once_with("file-1")
 
 
-def test_dispatch_billing_non_sandbox_uses_priority_tenant_queue(mocker, proxy) -> None:
+def test_dispatch_billing_non_sandbox_uses_priority_tenant_queue(mocker: MockerFixture, proxy) -> None:
     upload_mock = mocker.patch.object(proxy, "_upload_invoke_entities", return_value="file-1")
     send_mock = mocker.patch.object(proxy, "_send_to_priority_tenant_queue")
 
@@ -82,7 +82,7 @@ def test_dispatch_billing_non_sandbox_uses_priority_tenant_queue(mocker, proxy)
     send_mock.assert_called_once_with("file-1")
 
 
-def test_dispatch_no_billing_uses_priority_direct_queue(mocker, proxy) -> None:
+def test_dispatch_no_billing_uses_priority_direct_queue(mocker: MockerFixture, proxy) -> None:
     upload_mock = mocker.patch.object(proxy, "_upload_invoke_entities", return_value="file-1")
     send_mock = mocker.patch.object(proxy, "_send_to_priority_direct_queue")
 
@@ -95,7 +95,7 @@ def test_dispatch_no_billing_uses_priority_direct_queue(mocker, proxy) -> None:
     send_mock.assert_called_once_with("file-1")
 
 
-def test_dispatch_raises_on_empty_upload_file_id(mocker, proxy) -> None:
+def test_dispatch_raises_on_empty_upload_file_id(mocker: MockerFixture, proxy) -> None:
     mocker.patch.object(proxy, "_upload_invoke_entities", return_value="")
 
     features = SimpleNamespace(billing=SimpleNamespace(enabled=False, subscription=SimpleNamespace(plan="free")))
@@ -108,7 +108,7 @@ def test_dispatch_raises_on_empty_upload_file_id(mocker, proxy) -> None:
 # --- _send_to_direct_queue ---
 
 
-def test_send_to_direct_queue_calls_task_func_delay(mocker, proxy) -> None:
+def test_send_to_direct_queue_calls_task_func_delay(mocker: MockerFixture, proxy) -> None:
     task_func = Mock()
 
     proxy._send_to_direct_queue("file-1", task_func)
@@ -122,7 +122,7 @@ def test_send_to_direct_queue_calls_task_func_delay(mocker, proxy) -> None:
 # --- _send_to_tenant_queue ---
 
 
-def test_send_to_tenant_queue_pushes_when_task_key_exists(mocker, proxy) -> None:
+def test_send_to_tenant_queue_pushes_when_task_key_exists(mocker: MockerFixture, proxy) -> None:
     proxy._tenant_isolated_task_queue.get_task_key.return_value = "existing-key"
     task_func = Mock()
 
@@ -132,7 +132,7 @@ def test_send_to_tenant_queue_pushes_when_task_key_exists(mocker, proxy) -> None
     task_func.delay.assert_not_called()
 
 
-def test_send_to_tenant_queue_sets_waiting_time_and_calls_delay(mocker, proxy) -> None:
+def test_send_to_tenant_queue_sets_waiting_time_and_calls_delay(mocker: MockerFixture, proxy) -> None:
     proxy._tenant_isolated_task_queue.get_task_key.return_value = None
     task_func = Mock()
 
@@ -148,7 +148,7 @@ def test_send_to_tenant_queue_sets_waiting_time_and_calls_delay(mocker, proxy) -
 # --- _upload_invoke_entities ---
 
 
-def test_upload_invoke_entities_returns_file_id(mocker, proxy) -> None:
+def test_upload_invoke_entities_returns_file_id(mocker: MockerFixture, proxy) -> None:
     upload_file = SimpleNamespace(id="uploaded-file-1")
     file_service_cls = mocker.patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     file_service_cls.return_value.upload_text.return_value = upload_file
diff --git a/api/tests/unit_tests/services/retention/workflow_run/test_clear_free_plan_expired_workflow_run_logs.py b/api/tests/unit_tests/services/retention/workflow_run/test_clear_free_plan_expired_workflow_run_logs.py
index 7d30645d38a..1e15a72f476 100644
--- a/api/tests/unit_tests/services/retention/workflow_run/test_clear_free_plan_expired_workflow_run_logs.py
+++ b/api/tests/unit_tests/services/retention/workflow_run/test_clear_free_plan_expired_workflow_run_logs.py
@@ -7,15 +7,16 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 
+from repositories.api_workflow_run_repository import WorkflowRunCleanupRef
 from services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs import WorkflowRunCleanup
 
 
-def make_run(tenant_id: str = "t1", run_id: str = "r1", created_at: datetime.datetime | None = None):
-    run = MagicMock()
-    run.tenant_id = tenant_id
-    run.id = run_id
-    run.created_at = created_at or datetime.datetime(2024, 1, 1, tzinfo=datetime.UTC)
-    return run
+def make_ref(tenant_id: str = "t1", run_id: str = "r1", created_at: datetime.datetime | None = None):
+    return WorkflowRunCleanupRef(
+        id=run_id,
+        tenant_id=tenant_id,
+        created_at=created_at or datetime.datetime(2024, 1, 1, tzinfo=datetime.UTC),
+    )
 
 
 @pytest.fixture
@@ -341,28 +342,28 @@ class TestRunDeleteMode:
             return WorkflowRunCleanup(days=30, batch_size=10, workflow_run_repo=mock_repo)
 
     def test_no_rows_stops_immediately(self, mock_repo):
-        mock_repo.get_runs_batch_by_time_range.return_value = []
+        mock_repo.get_cleanup_refs_batch_by_time_range.return_value = []
         c = self._make_cleanup(mock_repo)
         with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.dify_config") as cfg:
             cfg.BILLING_ENABLED = False
             c.run()
-        mock_repo.delete_runs_with_related.assert_not_called()
+        mock_repo.delete_runs_with_related_by_ids.assert_not_called()
 
     def test_all_paid_skips_delete(self, mock_repo):
-        run = make_run("t1")
-        mock_repo.get_runs_batch_by_time_range.side_effect = [[run], []]
+        ref = make_ref("t1")
+        mock_repo.get_cleanup_refs_batch_by_time_range.side_effect = [[ref], []]
         c = self._make_cleanup(mock_repo)
         # billing disabled -> all free; but let's override _filter_free_tenants to return empty
         c._filter_free_tenants = MagicMock(return_value=set())
         with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.dify_config") as cfg:
             cfg.BILLING_ENABLED = False
             c.run()
-        mock_repo.delete_runs_with_related.assert_not_called()
+        mock_repo.delete_runs_with_related_by_ids.assert_not_called()
 
     def test_runs_deleted_successfully(self, mock_repo):
-        run = make_run("t1")
-        mock_repo.get_runs_batch_by_time_range.side_effect = [[run], []]
-        mock_repo.delete_runs_with_related.return_value = {
+        ref = make_ref("t1")
+        mock_repo.get_cleanup_refs_batch_by_time_range.side_effect = [[ref], [ref], []]
+        mock_repo.delete_runs_with_related_by_ids.return_value = {
             "runs": 1,
             "node_executions": 0,
             "offloads": 0,
@@ -376,12 +377,12 @@ class TestRunDeleteMode:
             cfg.BILLING_ENABLED = False
             with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.time.sleep"):
                 c.run()
-        mock_repo.delete_runs_with_related.assert_called_once()
+        mock_repo.delete_runs_with_related_by_ids.assert_called_once()
 
     def test_delete_exception_reraises(self, mock_repo):
-        run = make_run("t1")
-        mock_repo.get_runs_batch_by_time_range.side_effect = [[run], []]
-        mock_repo.delete_runs_with_related.side_effect = RuntimeError("db error")
+        ref = make_ref("t1")
+        mock_repo.get_cleanup_refs_batch_by_time_range.side_effect = [[ref], [ref]]
+        mock_repo.delete_runs_with_related_by_ids.side_effect = RuntimeError("db error")
         c = self._make_cleanup(mock_repo)
         with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.dify_config") as cfg:
             cfg.BILLING_ENABLED = False
@@ -389,7 +390,7 @@ class TestRunDeleteMode:
                 c.run()
 
     def test_summary_with_window_start(self, mock_repo):
-        mock_repo.get_runs_batch_by_time_range.return_value = []
+        mock_repo.get_cleanup_refs_batch_by_time_range.return_value = []
         with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.dify_config") as cfg:
             cfg.SANDBOX_EXPIRED_RECORDS_CLEAN_GRACEFUL_PERIOD = 0
             cfg.BILLING_ENABLED = False
@@ -421,9 +422,10 @@ class TestRunDryRunMode:
             )
 
     def test_dry_run_no_delete_called(self, mock_repo):
-        run = make_run("t1")
-        mock_repo.get_runs_batch_by_time_range.side_effect = [[run], []]
-        mock_repo.count_runs_with_related.return_value = {
+        ref = make_ref("t1")
+        mock_repo.get_cleanup_refs_batch_by_time_range.side_effect = [[ref], [ref], []]
+        mock_repo.count_runs_with_related_by_ids.return_value = {
+            "runs": 1,
             "node_executions": 2,
             "offloads": 0,
             "app_logs": 0,
@@ -435,11 +437,11 @@ class TestRunDryRunMode:
         with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.dify_config") as cfg:
             cfg.BILLING_ENABLED = False
             c.run()
-        mock_repo.delete_runs_with_related.assert_not_called()
-        mock_repo.count_runs_with_related.assert_called_once()
+        mock_repo.delete_runs_with_related_by_ids.assert_not_called()
+        mock_repo.count_runs_with_related_by_ids.assert_called_once()
 
     def test_dry_run_summary_with_window_start(self, mock_repo):
-        mock_repo.get_runs_batch_by_time_range.return_value = []
+        mock_repo.get_cleanup_refs_batch_by_time_range.return_value = []
         with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.dify_config") as cfg:
             cfg.SANDBOX_EXPIRED_RECORDS_CLEAN_GRACEFUL_PERIOD = 0
             cfg.BILLING_ENABLED = False
@@ -454,14 +456,14 @@ class TestRunDryRunMode:
             c.run()
 
     def test_dry_run_all_paid_skips_count(self, mock_repo):
-        run = make_run("t1")
-        mock_repo.get_runs_batch_by_time_range.side_effect = [[run], []]
+        ref = make_ref("t1")
+        mock_repo.get_cleanup_refs_batch_by_time_range.side_effect = [[ref], []]
         c = self._make_dry_cleanup(mock_repo)
         c._filter_free_tenants = MagicMock(return_value=set())
         with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.dify_config") as cfg:
             cfg.BILLING_ENABLED = False
             c.run()
-        mock_repo.count_runs_with_related.assert_not_called()
+        mock_repo.count_runs_with_related_by_ids.assert_not_called()
 
 
 # ---------------------------------------------------------------------------
@@ -492,7 +494,7 @@ class TestTriggerLogMethods:
 
 
 # ---------------------------------------------------------------------------
-# _count_node_executions / _delete_node_executions
+# _count_node_executions_by_run_ids / _delete_node_executions_by_run_ids
 # ---------------------------------------------------------------------------
 
 
@@ -500,25 +502,23 @@ class TestNodeExecutionMethods:
     def test_count_node_executions(self, cleanup):
         session = MagicMock()
         session.get_bind.return_value = MagicMock()
-        runs = [make_run("t1", "r1")]
         with patch(
             "services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.DifyAPIRepositoryFactory"
         ) as factory:
             repo = factory.create_api_workflow_node_execution_repository.return_value
             repo.count_by_runs.return_value = (10, 2)
             with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.sessionmaker"):
-                result = cleanup._count_node_executions(session, runs)
+                result = cleanup._count_node_executions_by_run_ids(session, ["r1"])
         assert result == (10, 2)
 
     def test_delete_node_executions(self, cleanup):
         session = MagicMock()
         session.get_bind.return_value = MagicMock()
-        runs = [make_run("t1", "r1")]
         with patch(
             "services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.DifyAPIRepositoryFactory"
         ) as factory:
             repo = factory.create_api_workflow_node_execution_repository.return_value
             repo.delete_by_runs.return_value = (5, 1)
             with patch("services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs.sessionmaker"):
-                result = cleanup._delete_node_executions(session, runs)
+                result = cleanup._delete_node_executions_by_run_ids(session, ["r1"])
         assert result == (5, 1)
diff --git a/api/tests/unit_tests/services/test_account_service.py b/api/tests/unit_tests/services/test_account_service.py
index db79cf4cb55..3b5c6cc9bd6 100644
--- a/api/tests/unit_tests/services/test_account_service.py
+++ b/api/tests/unit_tests/services/test_account_service.py
@@ -1,5 +1,6 @@
 import json
 from datetime import datetime, timedelta
+from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -793,7 +794,9 @@ class TestTenantService:
         mock_db_dependencies["db"].session.add = MagicMock()
 
         # Execute test
-        result = TenantService.create_tenant_member(mock_tenant, mock_account, "normal")
+        result = TenantService.create_tenant_member(
+            mock_tenant, mock_account, mock_db_dependencies["db"].session, "normal"
+        )
 
         # Verify member was created with correct parameters
         assert result is not None
@@ -828,8 +831,8 @@ class TestTenantService:
                 tenant_id="tenant-456", account_id="operator-123", role="owner"
             )
 
-            # scalar calls: permission check, ta lookup, remaining count
-            mock_db.session.scalar.side_effect = [mock_operator_join, mock_ta, 0]
+            # scalar calls: permission check, ta lookup, owner_id lookup, remaining count
+            mock_db.session.scalar.side_effect = [mock_operator_join, mock_ta, "operator-123", 0]
 
             with patch("services.enterprise.account_deletion_sync.sync_workspace_member_removal") as mock_sync:
                 mock_sync.return_value = True
@@ -868,8 +871,8 @@ class TestTenantService:
                 tenant_id="tenant-456", account_id="operator-123", role="owner"
             )
 
-            # scalar calls: permission check, ta lookup, remaining count = 1
-            mock_db.session.scalar.side_effect = [mock_operator_join, mock_ta, 1]
+            # scalar calls: permission check, ta lookup, owner_id lookup, remaining count = 1
+            mock_db.session.scalar.side_effect = [mock_operator_join, mock_ta, "operator-123", 1]
 
             with patch("services.enterprise.account_deletion_sync.sync_workspace_member_removal") as mock_sync:
                 mock_sync.return_value = True
@@ -899,8 +902,8 @@ class TestTenantService:
                 tenant_id="tenant-456", account_id="operator-123", role="owner"
             )
 
-            # scalar calls: permission check, ta lookup (no count needed for active member)
-            mock_db.session.scalar.side_effect = [mock_operator_join, mock_ta]
+            # scalar calls: permission check, ta lookup, owner_id lookup (no count for active member)
+            mock_db.session.scalar.side_effect = [mock_operator_join, mock_ta, "operator-123"]
 
             with patch("services.enterprise.account_deletion_sync.sync_workspace_member_removal") as mock_sync:
                 mock_sync.return_value = True
@@ -974,6 +977,43 @@ class TestTenantService:
             assert mock_target_join.role == "admin"
             self._assert_database_operations_called(mock_db)
 
+    def test_create_owner_tenant_if_not_exist_rbac_enabled_assigns_owner_role(
+        self, mock_db_dependencies, mock_external_service_dependencies
+    ):
+        mock_account = TestAccountAssociatedDataFactory.create_account_mock(account_id="user-rbac", name="RBAC User")
+        mock_external_service_dependencies[
+            "feature_service"
+        ].get_system_features.return_value.is_allow_create_workspace = True
+        mock_external_service_dependencies[
+            "feature_service"
+        ].get_system_features.return_value.license.workspaces.is_available.return_value = True
+
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-rbac"
+        mock_tenant.name = "RBAC User's Workspace"
+
+        with (
+            patch("services.account_service.dify_config.RBAC_ENABLED", True),
+            patch("services.account_service.TenantService.create_tenant", return_value=mock_tenant),
+            patch("services.account_service.TenantService.create_tenant_member"),
+            patch(
+                "services.account_service.AccountService._resolve_legacy_role_id",
+                return_value="rbac-owner-id",
+            ),
+            patch("services.account_service.RBACService") as mock_rbac_service,
+            patch("services.account_service.tenant_was_created.send"),
+        ):
+            mock_db_dependencies["db"].session.scalar.return_value = None
+
+            TenantService.create_owner_tenant_if_not_exist(mock_account, is_setup=True)
+
+        mock_rbac_service.MemberRoles.replace.assert_called_once_with(
+            tenant_id="tenant-rbac",
+            account_id="user-rbac",
+            member_account_id="user-rbac",
+            role_ids=["rbac-owner-id"],
+        )
+
     def test_admin_can_update_admin_member_role(self):
         """Test admin can update another non-owner member, including an admin."""
         mock_tenant = MagicMock()
@@ -1103,6 +1143,81 @@ class TestTenantService:
         with pytest.raises(NoPermissionError):
             TenantService.check_member_permission(mock_tenant, mock_operator, mock_member, "remove")
 
+    def test_rbac_member_can_remove_non_owner_member(self):
+        """Test RBAC workspace.member.manage allows removing a non-owner member."""
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-456"
+        mock_operator = TestAccountAssociatedDataFactory.create_account_mock(account_id="operator-123")
+        mock_member = TestAccountAssociatedDataFactory.create_account_mock(account_id="member-789")
+
+        mock_permissions = MagicMock()
+        mock_permissions.workspace = MagicMock(permission_keys=["workspace.member.manage"])
+
+        with (
+            patch("services.account_service.dify_config.RBAC_ENABLED", True),
+            patch("services.account_service.RBACService.MyPermissions.get", return_value=mock_permissions),
+            patch("services.account_service.AccountService.is_rbac_workspace_owner", return_value=False),
+        ):
+            TenantService.check_member_permission(mock_tenant, mock_operator, mock_member, "remove")
+
+    def test_rbac_member_cannot_remove_without_permission(self):
+        """Test RBAC permission check rejects removal without workspace.member.manage."""
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-456"
+        mock_operator = TestAccountAssociatedDataFactory.create_account_mock(account_id="operator-123")
+        mock_member = TestAccountAssociatedDataFactory.create_account_mock(account_id="member-789")
+
+        mock_permissions = MagicMock()
+        mock_permissions.workspace = MagicMock(permission_keys=["workspace.role.manage"])
+
+        with (
+            patch("services.account_service.dify_config.RBAC_ENABLED", True),
+            patch("services.account_service.RBACService.MyPermissions.get", return_value=mock_permissions),
+        ):
+            with pytest.raises(NoPermissionError):
+                TenantService.check_member_permission(mock_tenant, mock_operator, mock_member, "remove")
+
+    def test_rbac_member_cannot_remove_owner_member(self):
+        """Test RBAC permission check rejects removing an owner member."""
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-456"
+        mock_operator = TestAccountAssociatedDataFactory.create_account_mock(account_id="operator-123")
+        mock_member = TestAccountAssociatedDataFactory.create_account_mock(account_id="member-789")
+
+        mock_permissions = MagicMock()
+        mock_permissions.workspace = MagicMock(permission_keys=["workspace.member.manage"])
+
+        with (
+            patch("services.account_service.dify_config.RBAC_ENABLED", True),
+            patch("services.account_service.RBACService.MyPermissions.get", return_value=mock_permissions),
+            patch("services.account_service.AccountService.is_rbac_workspace_owner", return_value=True),
+        ):
+            with pytest.raises(NoPermissionError):
+                TenantService.check_member_permission(mock_tenant, mock_operator, mock_member, "remove")
+
+    def test_get_rbac_workspace_owner_account_id(self):
+        mock_roles = MagicMock()
+        mock_roles.data = [SimpleNamespace(account_id="owner-account")]
+        mock_rbac_roles = MagicMock()
+        mock_rbac_roles.members.return_value = mock_roles
+
+        with (
+            patch(
+                "services.account_service.AccountService._resolve_legacy_role_id",
+                return_value="owner-role-id",
+            ),
+            patch("services.account_service.RBACService.Roles", mock_rbac_roles),
+        ):
+            owner_account_id = AccountService.get_rbac_workspace_owner_account_id("tenant-1", "acct-1")
+
+        assert owner_account_id == "owner-account"
+        call = mock_rbac_roles.members.call_args
+        assert call.kwargs["tenant_id"] == "tenant-1"
+        assert call.kwargs["account_id"] == "acct-1"
+        assert call.kwargs["role_id"] == "owner-role-id"
+        assert call.kwargs["options"].page_number == 1
+        assert call.kwargs["options"].results_per_page == 1
+
 
 class TestRegisterService:
     """
@@ -1370,7 +1485,9 @@ class TestRegisterService:
                     timezone=None,
                 )
                 mock_create_tenant.assert_called_once_with("Test User's Workspace")
-                mock_create_member.assert_called_once_with(mock_tenant, mock_account, role="owner")
+                mock_create_member.assert_called_once_with(
+                    mock_tenant, mock_account, mock_db_dependencies["db"].session, role="owner"
+                )
                 mock_event.send.assert_called_once_with(mock_tenant)
                 self._assert_database_operations_called(mock_db_dependencies["db"])
 
@@ -1750,15 +1867,19 @@ class TestRegisterService:
                     )
                     mock_lookup.assert_called_once_with(mixed_email)
                     mock_check_permission.assert_called_once_with(mock_tenant, mock_inviter, None, "add")
-                    mock_create_member.assert_called_once_with(mock_tenant, mock_new_account, "normal")
+                    mock_create_member.assert_called_once_with(
+                        mock_tenant, mock_new_account, mock_db_dependencies["db"].session, "normal"
+                    )
                     mock_switch_tenant.assert_called_once_with(mock_new_account, mock_tenant.id)
-                    mock_generate_token.assert_called_once_with(mock_tenant, mock_new_account)
+                    mock_generate_token.assert_called_once_with(
+                        mock_tenant, mock_new_account, "normal", requires_setup=True
+                    )
                     mock_task_dependencies.delay.assert_called_once()
 
     def test_invite_new_member_existing_account(
         self, mock_db_dependencies, mock_redis_dependencies, mock_task_dependencies
     ):
-        """Test inviting a new member who already has an account."""
+        """Test inviting a pending account that is not in the tenant yet."""
         # Setup test data
         mock_tenant = MagicMock()
         mock_tenant.id = "tenant-456"
@@ -1795,11 +1916,54 @@ class TestRegisterService:
 
                 # Verify results
                 assert result == "invite-token-123"
-                mock_create_member.assert_called_once_with(mock_tenant, mock_existing_account, "normal")
-                mock_generate_token.assert_called_once_with(mock_tenant, mock_existing_account)
+                mock_create_member.assert_called_once_with(
+                    mock_tenant, mock_existing_account, mock_db_dependencies["db"].session, "normal"
+                )
+                mock_generate_token.assert_called_once_with(
+                    mock_tenant, mock_existing_account, "normal", requires_setup=True
+                )
                 mock_task_dependencies.delay.assert_called_once()
                 mock_lookup.assert_called_once_with("existing@example.com")
 
+    def test_invite_existing_active_account_requires_acceptance_before_joining(
+        self, mock_db_dependencies, mock_redis_dependencies, mock_task_dependencies
+    ):
+        """Existing active accounts outside the tenant receive an invite without immediate membership."""
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-456"
+        mock_tenant.name = "Test Workspace"
+        mock_inviter = TestAccountAssociatedDataFactory.create_account_mock(account_id="inviter-123", name="Inviter")
+        mock_existing_account = TestAccountAssociatedDataFactory.create_account_mock(
+            account_id="existing-user-456", email="existing@example.com", status="active"
+        )
+
+        with patch("services.account_service.AccountService.get_account_by_email_with_case_fallback") as mock_lookup:
+            mock_lookup.return_value = mock_existing_account
+            mock_db_dependencies["db"].session.scalar.return_value = None
+
+            with (
+                patch("services.account_service.TenantService.check_member_permission") as mock_check_permission,
+                patch("services.account_service.TenantService.create_tenant_member") as mock_create_member,
+                patch("services.account_service.RegisterService.generate_invite_token") as mock_generate_token,
+            ):
+                mock_generate_token.return_value = "invite-token-123"
+
+                result = RegisterService.invite_new_member(
+                    tenant=mock_tenant,
+                    email="existing@example.com",
+                    language="en-US",
+                    role="admin",
+                    inviter=mock_inviter,
+                )
+
+                assert result == "invite-token-123"
+                mock_check_permission.assert_called_once_with(mock_tenant, mock_inviter, mock_existing_account, "add")
+                mock_create_member.assert_not_called()
+                mock_generate_token.assert_called_once_with(
+                    mock_tenant, mock_existing_account, "admin", requires_setup=False
+                )
+                mock_task_dependencies.delay.assert_called_once()
+
     def test_invite_new_member_already_in_tenant(self, mock_db_dependencies, mock_redis_dependencies):
         """Test inviting a member who is already in the tenant."""
         # Setup test data
@@ -1848,6 +2012,193 @@ class TestRegisterService:
             inviter=None,
         )
 
+    # ==================== RBAC Member Invitation Tests ====================
+
+    def test_invite_new_member_rbac_enabled_new_account(
+        self, mock_db_dependencies, mock_redis_dependencies, mock_task_dependencies
+    ):
+        """When RBAC is enabled, create the member join and replace RBAC member roles."""
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-789"
+        mock_inviter = TestAccountAssociatedDataFactory.create_account_mock(account_id="inviter-456", name="Inviter")
+
+        with (
+            patch("services.account_service.AccountService.get_account_by_email_with_case_fallback") as mock_lookup,
+            patch("services.account_service.dify_config") as mock_config,
+        ):
+            mock_lookup.return_value = None
+            mock_config.RBAC_ENABLED = True
+
+            mock_new_account = TestAccountAssociatedDataFactory.create_account_mock(
+                account_id="new-user-rbac", email="rbac@example.com", name="rbacuser", status="pending"
+            )
+            with (
+                patch("services.account_service.RegisterService.register") as mock_register,
+                patch("services.account_service.TenantService.check_member_permission"),
+                patch("services.account_service.TenantService.create_tenant_member") as mock_create_member,
+                patch("services.account_service.TenantService.switch_tenant"),
+                patch("services.account_service.RegisterService.generate_invite_token", return_value="rbac-token"),
+                patch("services.account_service.RBACService") as mock_rbac_service,
+            ):
+                mock_register.return_value = mock_new_account
+
+                result = RegisterService.invite_new_member(
+                    tenant=mock_tenant,
+                    email="rbac@example.com",
+                    language="en-US",
+                    role="rbac-role-id-123",
+                    inviter=mock_inviter,
+                )
+
+                assert result == "rbac-token"
+                mock_create_member.assert_called_once_with(
+                    mock_tenant, mock_new_account, mock_db_dependencies["db"].session, TenantAccountRole.NORMAL.value
+                )
+                mock_rbac_service.MemberRoles.replace.assert_called_once_with(
+                    tenant_id=str(mock_tenant.id),
+                    account_id=mock_inviter.id,
+                    member_account_id=mock_new_account.id,
+                    role_ids=["rbac-role-id-123"],
+                )
+
+    def test_invite_new_member_rbac_enabled_existing_account(
+        self, mock_db_dependencies, mock_redis_dependencies, mock_task_dependencies
+    ):
+        """When RBAC is enabled and account exists, create the member join and replace RBAC member roles."""
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-789"
+        mock_inviter = TestAccountAssociatedDataFactory.create_account_mock(account_id="inviter-456", name="Inviter")
+        mock_existing_account = TestAccountAssociatedDataFactory.create_account_mock(
+            account_id="existing-rbac", email="existing-rbac@example.com", status="pending"
+        )
+
+        mock_db_dependencies["db"].session.scalar.return_value = None
+
+        with (
+            patch("services.account_service.AccountService.get_account_by_email_with_case_fallback") as mock_lookup,
+            patch("services.account_service.dify_config") as mock_config,
+        ):
+            mock_lookup.return_value = mock_existing_account
+            mock_config.RBAC_ENABLED = True
+
+            with (
+                patch("services.account_service.TenantService.check_member_permission"),
+                patch("services.account_service.TenantService.create_tenant_member") as mock_create_member,
+                patch("services.account_service.RegisterService.generate_invite_token", return_value="rbac-token"),
+                patch("services.account_service.RBACService") as mock_rbac_service,
+            ):
+                result = RegisterService.invite_new_member(
+                    tenant=mock_tenant,
+                    email="existing-rbac@example.com",
+                    language="en-US",
+                    role="rbac-role-id-456",
+                    inviter=mock_inviter,
+                )
+
+                assert result == "rbac-token"
+                mock_create_member.assert_called_once_with(
+                    mock_tenant,
+                    mock_existing_account,
+                    mock_db_dependencies["db"].session,
+                    TenantAccountRole.NORMAL.value,
+                )
+                mock_rbac_service.MemberRoles.replace.assert_called_once_with(
+                    tenant_id=str(mock_tenant.id),
+                    account_id=mock_inviter.id,
+                    member_account_id=mock_existing_account.id,
+                    role_ids=["rbac-role-id-456"],
+                )
+
+    def test_invite_new_member_rbac_enabled_existing_active_account_adds_role_before_signin_response(
+        self, mock_db_dependencies, mock_redis_dependencies, mock_task_dependencies
+    ):
+        """Existing active accounts still need an RBAC membership before the API returns the signin URL."""
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-789"
+        mock_inviter = TestAccountAssociatedDataFactory.create_account_mock(account_id="inviter-456", name="Inviter")
+        mock_existing_account = TestAccountAssociatedDataFactory.create_account_mock(
+            account_id="existing-rbac", email="existing-rbac@example.com", status=AccountStatus.ACTIVE
+        )
+
+        mock_db_dependencies["db"].session.scalar.return_value = None
+
+        with (
+            patch("services.account_service.AccountService.get_account_by_email_with_case_fallback") as mock_lookup,
+            patch("services.account_service.dify_config") as mock_config,
+        ):
+            mock_lookup.return_value = mock_existing_account
+            mock_config.RBAC_ENABLED = True
+
+            with (
+                patch("services.account_service.TenantService.check_member_permission"),
+                patch("services.account_service.TenantService.create_tenant_member") as mock_create_member,
+                patch("services.account_service.RBACService") as mock_rbac_service,
+            ):
+                with pytest.raises(AccountAlreadyInTenantError):
+                    RegisterService.invite_new_member(
+                        tenant=mock_tenant,
+                        email="existing-rbac@example.com",
+                        language="en-US",
+                        role="rbac-role-id-456",
+                        inviter=mock_inviter,
+                    )
+
+                mock_create_member.assert_called_once_with(
+                    mock_tenant,
+                    mock_existing_account,
+                    mock_db_dependencies["db"].session,
+                    TenantAccountRole.NORMAL.value,
+                )
+                mock_rbac_service.MemberRoles.replace.assert_called_once_with(
+                    tenant_id=str(mock_tenant.id),
+                    account_id=mock_inviter.id,
+                    member_account_id=mock_existing_account.id,
+                    role_ids=["rbac-role-id-456"],
+                )
+                mock_task_dependencies.delay.assert_not_called()
+
+    def test_invite_new_member_rbac_disabled_uses_legacy_role(
+        self, mock_db_dependencies, mock_redis_dependencies, mock_task_dependencies
+    ):
+        """When RBAC is disabled, create_tenant_member should be called and MemberRoles.replace should NOT."""
+        mock_tenant = MagicMock()
+        mock_tenant.id = "tenant-legacy"
+        mock_inviter = TestAccountAssociatedDataFactory.create_account_mock(account_id="inviter-789", name="Inviter")
+
+        with (
+            patch("services.account_service.AccountService.get_account_by_email_with_case_fallback") as mock_lookup,
+            patch("services.account_service.dify_config") as mock_config,
+        ):
+            mock_lookup.return_value = None
+            mock_config.RBAC_ENABLED = False
+
+            mock_new_account = TestAccountAssociatedDataFactory.create_account_mock(
+                account_id="legacy-user", email="legacy@example.com", name="legacyuser", status="pending"
+            )
+            with (
+                patch("services.account_service.RegisterService.register") as mock_register,
+                patch("services.account_service.TenantService.check_member_permission"),
+                patch("services.account_service.TenantService.create_tenant_member") as mock_create_member,
+                patch("services.account_service.TenantService.switch_tenant"),
+                patch("services.account_service.RegisterService.generate_invite_token", return_value="legacy-token"),
+                patch("services.account_service.RBACService") as mock_rbac_service,
+            ):
+                mock_register.return_value = mock_new_account
+
+                result = RegisterService.invite_new_member(
+                    tenant=mock_tenant,
+                    email="legacy@example.com",
+                    language="en-US",
+                    role="editor",
+                    inviter=mock_inviter,
+                )
+
+                assert result == "legacy-token"
+                mock_create_member.assert_called_once_with(
+                    mock_tenant, mock_new_account, mock_db_dependencies["db"].session, "editor"
+                )
+                mock_rbac_service.MemberRoles.replace.assert_not_called()
+
     # ==================== Token Management Tests ====================
 
     def test_generate_invite_token_success(self, mock_redis_dependencies):
@@ -1864,7 +2215,7 @@ class TestRegisterService:
             mock_uuid.return_value = "test-uuid-123"
 
             # Execute test
-            result = RegisterService.generate_invite_token(mock_tenant, mock_account)
+            result = RegisterService.generate_invite_token(mock_tenant, mock_account, "admin", requires_setup=True)
 
             # Verify results
             assert result == "test-uuid-123"
@@ -1877,6 +2228,8 @@ class TestRegisterService:
             assert stored_data["account_id"] == "user-123"
             assert stored_data["email"] == "test@example.com"
             assert stored_data["workspace_id"] == "tenant-456"
+            assert stored_data["role"] == "admin"
+            assert stored_data["requires_setup"] is True
 
     def test_is_valid_invite_token_valid(self, mock_redis_dependencies):
         """Test checking valid invite token."""
@@ -1943,9 +2296,8 @@ class TestRegisterService:
             }
             mock_get_invitation_by_token.return_value = invitation_data
 
-            # Mock scalar for tenant lookup, execute for account+role lookup
-            mock_db_dependencies["db"].session.scalar.return_value = mock_tenant
-            mock_db_dependencies["db"].session.execute.return_value.first.return_value = (mock_account, "normal")
+            # Mock scalar for tenant lookup, then account lookup.
+            mock_db_dependencies["db"].session.scalar.side_effect = [mock_tenant, mock_account]
 
             # Execute test
             result = RegisterService.get_invitation_if_token_valid("tenant-456", "test@example.com", "token-123")
@@ -2001,9 +2353,8 @@ class TestRegisterService:
         }
         mock_redis_dependencies.get.return_value = json.dumps(invitation_data).encode()
 
-        # Mock scalar for tenant, execute for account+role
-        mock_db_dependencies["db"].session.scalar.return_value = mock_tenant
-        mock_db_dependencies["db"].session.execute.return_value.first.return_value = None  # No account found
+        # Mock scalar for tenant lookup, then account lookup.
+        mock_db_dependencies["db"].session.scalar.side_effect = [mock_tenant, None]
 
         # Execute test
         result = RegisterService.get_invitation_if_token_valid("tenant-456", "test@example.com", "token-123")
@@ -2029,9 +2380,8 @@ class TestRegisterService:
         }
         mock_redis_dependencies.get.return_value = json.dumps(invitation_data).encode()
 
-        # Mock scalar for tenant, execute for account+role
-        mock_db_dependencies["db"].session.scalar.return_value = mock_tenant
-        mock_db_dependencies["db"].session.execute.return_value.first.return_value = (mock_account, "normal")
+        # Mock scalar for tenant lookup, then account lookup.
+        mock_db_dependencies["db"].session.scalar.side_effect = [mock_tenant, mock_account]
 
         # Execute test
         result = RegisterService.get_invitation_if_token_valid("tenant-456", "test@example.com", "token-123")
diff --git a/api/tests/unit_tests/services/test_agent_app_feature_service.py b/api/tests/unit_tests/services/test_agent_app_feature_service.py
index a8553b62a86..3d9337d79fb 100644
--- a/api/tests/unit_tests/services/test_agent_app_feature_service.py
+++ b/api/tests/unit_tests/services/test_agent_app_feature_service.py
@@ -12,7 +12,6 @@ from typing import Any
 
 import pytest
 
-from services import agent_app_feature_service as svc_mod
 from services.agent_app_feature_service import AgentAppFeatureConfigService
 
 TENANT_ID = "11111111-1111-1111-1111-111111111111"
@@ -89,9 +88,8 @@ class _FakeWriteSession:
 
 
 class TestUpdateFeatures:
-    def test_persists_new_app_model_config_version(self, monkeypatch):
+    def test_persists_new_app_model_config_version(self):
         session = _FakeWriteSession()
-        monkeypatch.setattr(svc_mod.db, "session", session)
         app_model = SimpleNamespace(
             tenant_id=TENANT_ID, id="app-1", app_model_config_id=None, updated_by=None, updated_at=None
         )
@@ -101,6 +99,7 @@ class TestUpdateFeatures:
             app_model=app_model,  # type: ignore[arg-type]
             account=account,  # type: ignore[arg-type]
             config={"opening_statement": "Hi!", "suggested_questions_after_answer": {"enabled": True}},
+            session=session,
         )
 
         # New row carries the features but no Soul-owned model/prompt/agent_mode.
diff --git a/api/tests/unit_tests/services/test_agent_drive_service.py b/api/tests/unit_tests/services/test_agent_drive_service.py
index 9f8170bfd11..09cde917946 100644
--- a/api/tests/unit_tests/services/test_agent_drive_service.py
+++ b/api/tests/unit_tests/services/test_agent_drive_service.py
@@ -66,6 +66,7 @@ def _tables() -> Generator[None, None, None]:
     yield
     with session_factory.create_session() as session:
         session.execute(delete(AgentDriveFile))
+        session.execute(delete(UploadFile))
         session.execute(delete(ToolFile))
         session.execute(delete(Agent))
         session.commit()
@@ -493,6 +494,20 @@ def test_download_url_signs_external_audience():
     assert url == "https://signed.example/x"
     # console downloads are for browsers: external signing, never the internal URL
     assert resolver.call_args.kwargs["for_external"] is True
+    assert resolver.call_args.kwargs["as_attachment"] is True
+
+
+def test_upload_file_download_url_uses_attachment_filename():
+    upload_file_id = _seed_upload_file(name="report.pdf")
+    _commit_upload("files/report.pdf", upload_file_id)
+
+    with patch("services.agent_drive_service.DifyWorkflowFileRuntime") as runtime_cls:
+        runtime_cls.return_value.resolve_upload_file_url.return_value = "https://files.example/report.pdf"
+        url = AgentDriveService().download_url(tenant_id=TENANT, agent_id=AGENT, key="files/report.pdf")
+
+    assert url == "https://files.example/report.pdf"
+    assert runtime_cls.return_value.resolve_upload_file_url.call_args.kwargs["for_external"] is True
+    assert runtime_cls.return_value.resolve_upload_file_url.call_args.kwargs["as_attachment"] is True
 
 
 def test_manifest_items_carry_created_at_for_inspector():
diff --git a/api/tests/unit_tests/services/test_annotation_service.py b/api/tests/unit_tests/services/test_annotation_service.py
index 5054010e89d..55912cc1c1f 100644
--- a/api/tests/unit_tests/services/test_annotation_service.py
+++ b/api/tests/unit_tests/services/test_annotation_service.py
@@ -2,6 +2,7 @@
 Unit tests for services.annotation_service
 """
 
+import logging
 from io import BytesIO
 from types import SimpleNamespace
 from typing import Any, cast
@@ -1049,7 +1050,9 @@ class TestAppAnnotationServiceBatchImport:
             mock_redis.setnx.assert_called_once_with("app_annotation_batch_import_uuid-3", "waiting")
             mock_task.delay.assert_called_once()
 
-    def test_batch_import_app_annotations_should_cleanup_active_job_on_unexpected_exception(self) -> None:
+    def test_batch_import_app_annotations_should_cleanup_active_job_on_unexpected_exception(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
         """Test unexpected runtime errors trigger cleanup and return wrapped error."""
         # Arrange
         file = _make_file(b"question,answer\nq,a\n")
@@ -1067,7 +1070,6 @@ class TestAppAnnotationServiceBatchImport:
             patch("services.annotation_service.redis_client") as mock_redis,
             patch("services.annotation_service.uuid.uuid4", return_value="uuid-4"),
             patch("services.annotation_service.naive_utc_now", return_value=SimpleNamespace(timestamp=lambda: 1)),
-            patch("services.annotation_service.logger") as mock_logger,
             patch(
                 "configs.dify_config",
                 new=SimpleNamespace(ANNOTATION_IMPORT_MAX_RECORDS=5, ANNOTATION_IMPORT_MIN_RECORDS=1),
@@ -1078,12 +1080,15 @@ class TestAppAnnotationServiceBatchImport:
             mock_redis.zrem.side_effect = RuntimeError("cleanup-failed")
 
             # Act
-            result = AppAnnotationService.batch_import_app_annotations(app.id, file)
+            with caplog.at_level(logging.DEBUG):
+                result = AppAnnotationService.batch_import_app_annotations(app.id, file)
 
             # Assert
             assert result["error_msg"] == "An error occurred while processing the file: boom"
             mock_redis.zrem.assert_called_once_with(f"annotation_import_active:{tenant_id}", "uuid-4")
-            mock_logger.debug.assert_called_once()
+            assert len(caplog.records) == 1
+            assert caplog.records[0].levelname == "DEBUG"
+            assert "Failed to clean up active job tracking during error handling" in caplog.records[0].message
 
 
 class TestAppAnnotationServiceHitHistoryAndSettings:
diff --git a/api/tests/unit_tests/services/test_app_service.py b/api/tests/unit_tests/services/test_app_service.py
index bb764112640..c57fb6ed775 100644
--- a/api/tests/unit_tests/services/test_app_service.py
+++ b/api/tests/unit_tests/services/test_app_service.py
@@ -3,7 +3,11 @@ from __future__ import annotations
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
+import pytest
+from sqlalchemy.exc import IntegrityError
+
 from models.model import App
+from services.agent.errors import AgentNameConflictError
 from services.app_service import AppService
 
 
@@ -168,6 +172,7 @@ class TestAgentAppType:
             mode=AppMode.AGENT,
             name="Old",
             description="old",
+            role="draft",
             icon_type=IconType.EMOJI,
             icon="robot",
             icon_background="#fff",
@@ -178,6 +183,7 @@ class TestAgentAppType:
         backing_agent = SimpleNamespace(
             name="Old",
             description="old",
+            role="draft",
             icon_type=AgentIconType.EMOJI,
             icon="robot",
             icon_background="#fff",
@@ -195,6 +201,7 @@ class TestAgentAppType:
                 {
                     "name": "Iris",
                     "description": "agent app",
+                    "role": "research assistant",
                     "icon_type": "image",
                     "icon": "file-id",
                     "icon_background": "#123456",
@@ -206,12 +213,167 @@ class TestAgentAppType:
         assert updated_app.name == "Iris"
         assert backing_agent.name == "Iris"
         assert backing_agent.description == "agent app"
+        assert backing_agent.role == "research assistant"
         assert backing_agent.icon_type == AgentIconType.IMAGE
         assert backing_agent.icon == "file-id"
         assert backing_agent.icon_background == "#123456"
         assert backing_agent.updated_by == "account-2"
         assert backing_agent.updated_at == updated_app.updated_at
 
+    def test_update_agent_app_preserves_role_when_args_omit_it(self):
+        from models.agent import AgentIconType
+        from models.model import AppMode, IconType
+        from services.app_service import AppService
+
+        app = SimpleNamespace(
+            id="app-1",
+            tenant_id="tenant-1",
+            mode=AppMode.AGENT,
+            name="Old",
+            description="old",
+            role="draft",
+            icon_type=IconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            use_icon_as_answer_icon=False,
+            max_active_requests=None,
+            created_by="account-1",
+        )
+        backing_agent = SimpleNamespace(
+            name="Old",
+            description="old",
+            role="research assistant",
+            icon_type=AgentIconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            updated_by=None,
+            updated_at=None,
+        )
+
+        with (
+            patch("services.app_service.db") as mock_db,
+            patch("services.app_service.current_user", SimpleNamespace(id="account-2")),
+        ):
+            mock_db.session.scalar.return_value = backing_agent
+            AppService().update_app(
+                app,  # type: ignore[arg-type]
+                {
+                    "name": "Iris",
+                    "description": "agent app",
+                    "icon_type": "image",
+                    "icon": "file-id",
+                    "icon_background": "#123456",
+                    "use_icon_as_answer_icon": False,
+                    "max_active_requests": 0,
+                },
+            )
+
+        assert backing_agent.role == "research assistant"
+
+    def test_update_agent_app_clears_role_when_args_set_empty_string(self):
+        from models.agent import AgentIconType
+        from models.model import AppMode, IconType
+        from services.app_service import AppService
+
+        app = SimpleNamespace(
+            id="app-1",
+            tenant_id="tenant-1",
+            mode=AppMode.AGENT,
+            name="Old",
+            description="old",
+            role="draft",
+            icon_type=IconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            use_icon_as_answer_icon=False,
+            max_active_requests=None,
+            created_by="account-1",
+        )
+        backing_agent = SimpleNamespace(
+            name="Old",
+            description="old",
+            role="research assistant",
+            icon_type=AgentIconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            updated_by=None,
+            updated_at=None,
+        )
+
+        with (
+            patch("services.app_service.db") as mock_db,
+            patch("services.app_service.current_user", SimpleNamespace(id="account-2")),
+        ):
+            mock_db.session.scalar.return_value = backing_agent
+            AppService().update_app(
+                app,  # type: ignore[arg-type]
+                {
+                    "name": "Iris",
+                    "description": "agent app",
+                    "role": "",
+                    "icon_type": "image",
+                    "icon": "file-id",
+                    "icon_background": "#123456",
+                    "use_icon_as_answer_icon": False,
+                    "max_active_requests": 0,
+                },
+            )
+
+        assert backing_agent.role == ""
+
+    def test_update_agent_app_duplicate_name_rolls_back_and_raises_conflict(self):
+        from models.agent import AgentIconType
+        from models.model import AppMode, IconType
+        from services.app_service import AppService
+
+        app = SimpleNamespace(
+            id="app-1",
+            tenant_id="tenant-1",
+            mode=AppMode.AGENT,
+            name="Old",
+            description="old",
+            role="draft",
+            icon_type=IconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            use_icon_as_answer_icon=False,
+            max_active_requests=None,
+            created_by="account-1",
+        )
+        backing_agent = SimpleNamespace(
+            name="Old",
+            description="old",
+            role="research assistant",
+            icon_type=AgentIconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            updated_by=None,
+            updated_at=None,
+        )
+
+        with (
+            patch("services.app_service.db") as mock_db,
+            patch("services.app_service.current_user", SimpleNamespace(id="account-2")),
+        ):
+            mock_db.session.scalar.return_value = backing_agent
+            mock_db.session.commit.side_effect = IntegrityError("duplicate", None, None)
+            with pytest.raises(AgentNameConflictError):
+                AppService().update_app(
+                    app,  # type: ignore[arg-type]
+                    {
+                        "name": "Existing Agent",
+                        "description": "agent app",
+                        "role": "research assistant",
+                        "icon_type": "emoji",
+                        "icon": "robot",
+                        "icon_background": "#fff",
+                        "use_icon_as_answer_icon": False,
+                        "max_active_requests": 0,
+                    },
+                )
+
+        mock_db.session.rollback.assert_called_once()
+
     def test_delete_agent_app_archives_backing_agent(self):
         from models.agent import AgentStatus
         from models.model import AppMode
diff --git a/api/tests/unit_tests/services/test_billing_service.py b/api/tests/unit_tests/services/test_billing_service.py
index 67d1cc02913..f244b69407f 100644
--- a/api/tests/unit_tests/services/test_billing_service.py
+++ b/api/tests/unit_tests/services/test_billing_service.py
@@ -14,6 +14,7 @@ Tests follow the Arrange-Act-Assert pattern for clarity.
 """
 
 import json
+import logging
 from unittest.mock import MagicMock, patch
 
 import httpx
@@ -170,7 +171,9 @@ class TestBillingServiceSendRequest:
     @pytest.mark.parametrize(
         "status_code", [httpx.codes.BAD_REQUEST, httpx.codes.INTERNAL_SERVER_ERROR, httpx.codes.NOT_FOUND]
     )
-    def test_delete_request_non_200_with_valid_json(self, mock_httpx_request, mock_billing_config, status_code):
+    def test_delete_request_non_200_with_valid_json(
+        self, mock_httpx_request, mock_billing_config, status_code, caplog: pytest.LogCaptureFixture
+    ):
         """Test DELETE request with non-200 status code raises ValueError.
 
         DELETE now checks status code and raises ValueError for non-200 responses.
@@ -184,13 +187,11 @@ class TestBillingServiceSendRequest:
         mock_httpx_request.return_value = mock_response
 
         # Act & Assert
-        with patch("services.billing_service.logger") as mock_logger:
+        with caplog.at_level(logging.ERROR, logger="services.billing_service"):
             with pytest.raises(ValueError) as exc_info:
                 BillingService._send_request("DELETE", "/test", json={"key": "value"})
             assert "Unable to process delete request" in str(exc_info.value)
-            # Verify error logging
-            mock_logger.error.assert_called_once()
-            assert "DELETE response" in str(mock_logger.error.call_args)
+            assert "DELETE response" in caplog.text
 
     @pytest.mark.parametrize(
         "status_code", [httpx.codes.BAD_REQUEST, httpx.codes.INTERNAL_SERVER_ERROR, httpx.codes.NOT_FOUND]
@@ -213,7 +214,9 @@ class TestBillingServiceSendRequest:
     @pytest.mark.parametrize(
         "status_code", [httpx.codes.BAD_REQUEST, httpx.codes.INTERNAL_SERVER_ERROR, httpx.codes.NOT_FOUND]
     )
-    def test_delete_request_non_200_with_invalid_json(self, mock_httpx_request, mock_billing_config, status_code):
+    def test_delete_request_non_200_with_invalid_json(
+        self, mock_httpx_request, mock_billing_config, status_code, caplog: pytest.LogCaptureFixture
+    ):
         """Test DELETE request with non-200 status code raises ValueError before JSON parsing.
 
         DELETE now checks status code before calling response.json(), so ValueError is raised
@@ -227,13 +230,11 @@ class TestBillingServiceSendRequest:
         mock_httpx_request.return_value = mock_response
 
         # Act & Assert
-        with patch("services.billing_service.logger") as mock_logger:
+        with caplog.at_level(logging.ERROR, logger="services.billing_service"):
             with pytest.raises(ValueError) as exc_info:
                 BillingService._send_request("DELETE", "/test", json={"key": "value"})
             assert "Unable to process delete request" in str(exc_info.value)
-            # Verify error logging
-            mock_logger.error.assert_called_once()
-            assert "DELETE response" in str(mock_logger.error.call_args)
+            assert "DELETE response" in caplog.text
 
     def test_retry_on_request_error(self, mock_httpx_request, mock_billing_config):
         """Test that _send_request retries on httpx.RequestError."""
@@ -1511,7 +1512,7 @@ class TestBillingServiceSubscriptionOperations:
         assert isinstance(result["tenant-1"]["expiration_date"], int)
         assert result["tenant-1"]["expiration_date"] == 1735689600
 
-    def test_get_plan_bulk_with_invalid_tenant_plan_skipped(self, mock_send_request):
+    def test_get_plan_bulk_with_invalid_tenant_plan_skipped(self, mock_send_request, caplog: pytest.LogCaptureFixture):
         """Test bulk plan retrieval when one tenant has invalid plan data (should skip that tenant)."""
         # Arrange
         tenant_ids = ["tenant-valid-1", "tenant-invalid", "tenant-valid-2"]
@@ -1526,7 +1527,7 @@ class TestBillingServiceSubscriptionOperations:
         }
 
         # Act
-        with patch("services.billing_service.logger") as mock_logger:
+        with caplog.at_level(logging.ERROR, logger="services.billing_service"):
             result = BillingService.get_plan_bulk(tenant_ids)
 
         # Assert - should only contain valid tenants
@@ -1542,10 +1543,11 @@ class TestBillingServiceSubscriptionOperations:
         assert result["tenant-valid-2"]["expiration_date"] == 1767225600
 
         # Verify exception was logged for the invalid tenant
-        mock_logger.exception.assert_called_once()
-        log_call_args = mock_logger.exception.call_args[0]
-        assert "get_plan_bulk: failed to validate subscription plan for tenant" in log_call_args[0]
-        assert "tenant-invalid" in log_call_args[1]
+        exception_records = [r for r in caplog.records if r.levelname == "ERROR"]
+        assert len(exception_records) == 1
+        formatted = exception_records[0].getMessage()
+        assert "get_plan_bulk: failed to validate subscription plan for tenant" in formatted
+        assert "tenant-invalid" in formatted
 
     def test_get_expired_subscription_cleanup_whitelist_success(self, mock_send_request):
         """Test successful retrieval of expired subscription cleanup whitelist."""
diff --git a/api/tests/unit_tests/services/test_clear_free_plan_expired_workflow_run_logs.py b/api/tests/unit_tests/services/test_clear_free_plan_expired_workflow_run_logs.py
index 6bf78d34117..60488beb248 100644
--- a/api/tests/unit_tests/services/test_clear_free_plan_expired_workflow_run_logs.py
+++ b/api/tests/unit_tests/services/test_clear_free_plan_expired_workflow_run_logs.py
@@ -3,38 +3,27 @@ from typing import Any
 
 import pytest
 
+from repositories.api_workflow_run_repository import WorkflowRunCleanupRef
 from services.billing_service import SubscriptionPlan
 from services.retention.workflow_run import clear_free_plan_expired_workflow_run_logs as cleanup_module
 from services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs import WorkflowRunCleanup
 
 
-class FakeRun:
-    def __init__(
-        self,
-        run_id: str,
-        tenant_id: str,
-        created_at: datetime.datetime,
-        app_id: str = "app-1",
-        workflow_id: str = "wf-1",
-        triggered_from: str = "workflow-run",
-    ) -> None:
-        self.id = run_id
-        self.tenant_id = tenant_id
-        self.app_id = app_id
-        self.workflow_id = workflow_id
-        self.triggered_from = triggered_from
-        self.created_at = created_at
+def make_ref(run_id: str, tenant_id: str, created_at: datetime.datetime) -> WorkflowRunCleanupRef:
+    return WorkflowRunCleanupRef(id=run_id, tenant_id=tenant_id, created_at=created_at)
 
 
 class FakeRepo:
     def __init__(
         self,
-        batches: list[list[FakeRun]],
+        batches: list[list[WorkflowRunCleanupRef]],
         delete_result: dict[str, int] | None = None,
         count_result: dict[str, int] | None = None,
     ) -> None:
         self.batches = batches
-        self.call_idx = 0
+        self.candidate_call_idx = 0
+        self.last_candidate_batch: list[WorkflowRunCleanupRef] = []
+        self.cleanup_ref_calls: list[dict[str, object]] = []
         self.deleted: list[list[str]] = []
         self.counted: list[list[str]] = []
         self.delete_result = delete_result or {
@@ -56,7 +45,7 @@ class FakeRepo:
             "pause_reasons": 0,
         }
 
-    def get_runs_batch_by_time_range(
+    def get_cleanup_refs_batch_by_time_range(
         self,
         start_from: datetime.datetime | None,
         end_before: datetime.datetime,
@@ -65,27 +54,50 @@ class FakeRepo:
         run_types=None,
         tenant_ids=None,
         workflow_ids=None,
-    ) -> list[FakeRun]:
-        if self.call_idx >= len(self.batches):
+        upper_bound: tuple[datetime.datetime, str] | None = None,
+    ) -> list[WorkflowRunCleanupRef]:
+        self.cleanup_ref_calls.append(
+            {
+                "start_from": start_from,
+                "end_before": end_before,
+                "last_seen": last_seen,
+                "batch_size": batch_size,
+                "run_types": run_types,
+                "tenant_ids": tenant_ids,
+                "workflow_ids": workflow_ids,
+                "upper_bound": upper_bound,
+            }
+        )
+        if tenant_ids is not None or upper_bound is not None:
+            refs = self.last_candidate_batch
+            if tenant_ids is not None:
+                tenant_id_set = set(tenant_ids)
+                refs = [ref for ref in refs if ref.tenant_id in tenant_id_set]
+            if upper_bound is not None:
+                refs = [ref for ref in refs if (ref.created_at, ref.id) <= upper_bound]
+            return refs[:batch_size]
+
+        if self.candidate_call_idx >= len(self.batches):
             return []
-        batch = self.batches[self.call_idx]
-        self.call_idx += 1
+        batch = self.batches[self.candidate_call_idx]
+        self.candidate_call_idx += 1
+        self.last_candidate_batch = batch
         return batch
 
-    def delete_runs_with_related(
-        self, runs: list[FakeRun], delete_node_executions=None, delete_trigger_logs=None
+    def delete_runs_with_related_by_ids(
+        self, run_ids: list[str], delete_node_executions=None, delete_trigger_logs=None
     ) -> dict[str, int]:
-        self.deleted.append([run.id for run in runs])
+        self.deleted.append(list(run_ids))
         result = self.delete_result.copy()
-        result["runs"] = len(runs)
+        result["runs"] = len(run_ids)
         return result
 
-    def count_runs_with_related(
-        self, runs: list[FakeRun], count_node_executions=None, count_trigger_logs=None
+    def count_runs_with_related_by_ids(
+        self, run_ids: list[str], count_node_executions=None, count_trigger_logs=None
     ) -> dict[str, int]:
-        self.counted.append([run.id for run in runs])
+        self.counted.append(list(run_ids))
         result = self.count_result.copy()
-        result["runs"] = len(runs)
+        result["runs"] = len(run_ids)
         return result
 
 
@@ -218,8 +230,8 @@ def test_run_deletes_only_free_tenants(monkeypatch: pytest.MonkeyPatch) -> None:
     repo = FakeRepo(
         batches=[
             [
-                FakeRun("run-free", "t_free", cutoff),
-                FakeRun("run-paid", "t_paid", cutoff),
+                make_ref("run-free", "t_free", cutoff),
+                make_ref("run-paid", "t_paid", cutoff),
             ]
         ]
     )
@@ -240,11 +252,43 @@ def test_run_deletes_only_free_tenants(monkeypatch: pytest.MonkeyPatch) -> None:
     cleanup.run()
 
     assert repo.deleted == [["run-free"]]
+    assert repo.cleanup_ref_calls[1]["tenant_ids"] == ["t_free"]
+
+
+def test_run_filters_candidate_tenants_before_target_query(monkeypatch: pytest.MonkeyPatch) -> None:
+    cutoff = datetime.datetime.now()
+    repo = FakeRepo(
+        batches=[
+            [
+                make_ref("run-free", "t_free", cutoff),
+                make_ref("run-paid", "t_paid", cutoff),
+            ]
+        ]
+    )
+    cleanup = create_cleanup(monkeypatch, repo=repo, days=30, batch_size=10)
+
+    monkeypatch.setattr(cleanup_module.dify_config, "BILLING_ENABLED", True)
+    billing_calls: list[list[str]] = []
+
+    def fake_bulk(tenant_ids: list[str]) -> dict[str, SubscriptionPlan]:
+        billing_calls.append(tenant_ids)
+        return {
+            "t_free": plan_info("sandbox", -1),
+            "t_paid": plan_info("team", -1),
+        }
+
+    monkeypatch.setattr(cleanup_module.BillingService, "get_plan_bulk_with_cache", staticmethod(fake_bulk))
+
+    cleanup.run()
+
+    assert billing_calls == [["t_free", "t_paid"]]
+    assert repo.cleanup_ref_calls[1]["tenant_ids"] == ["t_free"]
+    assert repo.deleted == [["run-free"]]
 
 
 def test_run_skips_when_no_free_tenants(monkeypatch: pytest.MonkeyPatch) -> None:
     cutoff = datetime.datetime.now()
-    repo = FakeRepo(batches=[[FakeRun("run-paid", "t_paid", cutoff)]])
+    repo = FakeRepo(batches=[[make_ref("run-paid", "t_paid", cutoff)]])
     cleanup = create_cleanup(monkeypatch, repo=repo, days=30, batch_size=10)
 
     monkeypatch.setattr(cleanup_module.dify_config, "BILLING_ENABLED", True)
@@ -257,6 +301,53 @@ def test_run_skips_when_no_free_tenants(monkeypatch: pytest.MonkeyPatch) -> None
     cleanup.run()
 
     assert repo.deleted == []
+    assert len(repo.cleanup_ref_calls) == 2
+
+
+def test_run_paid_only_records_skipped_metrics(monkeypatch: pytest.MonkeyPatch) -> None:
+    cutoff = datetime.datetime.now()
+    repo = FakeRepo(batches=[[make_ref("run-paid", "t_paid", cutoff)]])
+    cleanup = create_cleanup(monkeypatch, repo=repo, days=30, batch_size=10)
+
+    monkeypatch.setattr(cleanup_module.dify_config, "BILLING_ENABLED", True)
+    monkeypatch.setattr(
+        cleanup_module.BillingService,
+        "get_plan_bulk_with_cache",
+        staticmethod(lambda tenant_ids: {tenant_id: plan_info("team", 1893456000) for tenant_id in tenant_ids}),
+    )
+    batch_calls: list[dict[str, object]] = []
+    monkeypatch.setattr(cleanup._metrics, "record_batch", lambda **kwargs: batch_calls.append(kwargs))
+
+    cleanup.run()
+
+    assert repo.deleted == []
+    assert repo.counted == []
+    assert batch_calls[0]["batch_rows"] == 1
+    assert batch_calls[0]["targeted_runs"] == 0
+    assert batch_calls[0]["skipped_runs"] == 1
+    assert batch_calls[0]["deleted_runs"] == 0
+
+
+def test_run_target_query_is_bounded_by_candidate_high_water(monkeypatch: pytest.MonkeyPatch) -> None:
+    first_created_at = datetime.datetime(2024, 1, 1, 0, 0, 0)
+    second_created_at = datetime.datetime(2024, 1, 1, 0, 1, 0)
+    repo = FakeRepo(
+        batches=[
+            [
+                make_ref("run-free-1", "t_free", first_created_at),
+                make_ref("run-free-2", "t_free", second_created_at),
+            ]
+        ]
+    )
+    cleanup = create_cleanup(monkeypatch, repo=repo, days=30, batch_size=2)
+
+    monkeypatch.setattr(cleanup_module.dify_config, "BILLING_ENABLED", False)
+
+    cleanup.run()
+
+    assert repo.cleanup_ref_calls[1]["last_seen"] is None
+    assert repo.cleanup_ref_calls[1]["upper_bound"] == (second_created_at, "run-free-2")
+    assert repo.cleanup_ref_calls[2]["last_seen"] == (second_created_at, "run-free-2")
 
 
 def test_run_exits_on_empty_batch(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -268,7 +359,7 @@ def test_run_exits_on_empty_batch(monkeypatch: pytest.MonkeyPatch) -> None:
 def test_run_records_metrics_on_success(monkeypatch: pytest.MonkeyPatch) -> None:
     cutoff = datetime.datetime.now()
     repo = FakeRepo(
-        batches=[[FakeRun("run-free", "t_free", cutoff)]],
+        batches=[[make_ref("run-free", "t_free", cutoff)]],
         delete_result={
             "runs": 0,
             "node_executions": 2,
@@ -300,13 +391,13 @@ def test_run_records_metrics_on_success(monkeypatch: pytest.MonkeyPatch) -> None
 
 def test_run_records_failed_metrics(monkeypatch: pytest.MonkeyPatch) -> None:
     class FailingRepo(FakeRepo):
-        def delete_runs_with_related(
-            self, runs: list[FakeRun], delete_node_executions=None, delete_trigger_logs=None
+        def delete_runs_with_related_by_ids(
+            self, run_ids: list[str], delete_node_executions=None, delete_trigger_logs=None
         ) -> dict[str, int]:
             raise RuntimeError("delete failed")
 
     cutoff = datetime.datetime.now()
-    repo = FailingRepo(batches=[[FakeRun("run-free", "t_free", cutoff)]])
+    repo = FailingRepo(batches=[[make_ref("run-free", "t_free", cutoff)]])
     cleanup = create_cleanup(monkeypatch, repo=repo, days=30, batch_size=10)
     monkeypatch.setattr(cleanup_module.dify_config, "BILLING_ENABLED", False)
 
@@ -323,7 +414,7 @@ def test_run_records_failed_metrics(monkeypatch: pytest.MonkeyPatch) -> None:
 def test_run_dry_run_skips_deletions(monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]) -> None:
     cutoff = datetime.datetime.now()
     repo = FakeRepo(
-        batches=[[FakeRun("run-free", "t_free", cutoff)]],
+        batches=[[make_ref("run-free", "t_free", cutoff)]],
         count_result={
             "runs": 0,
             "node_executions": 2,
diff --git a/api/tests/unit_tests/services/test_dataset_service_dataset.py b/api/tests/unit_tests/services/test_dataset_service_dataset.py
index 3d08b6fd096..46f32f93e8a 100644
--- a/api/tests/unit_tests/services/test_dataset_service_dataset.py
+++ b/api/tests/unit_tests/services/test_dataset_service_dataset.py
@@ -15,6 +15,7 @@ from .dataset_service_test_helpers import (
     ProviderTokenNotInitError,
     RagPipelineDatasetCreateEntity,
     SimpleNamespace,
+    TenantAccountRole,
     _make_knowledge_configuration,
     _make_retrieval_model,
     _make_session_context,
@@ -167,6 +168,154 @@ class TestDatasetServiceValidation:
                 DatasetService.check_is_multimodal_model("tenant-1", "provider", "embedding-model")
 
 
+class TestDatasetServiceRetrievalPermissions:
+    """Unit tests for dataset list permission branching."""
+
+    def test_get_datasets_filters_by_maintainer_and_rbac_overrides(self):
+        mock_db = MagicMock()
+        mock_db.session.scalars.return_value.all.return_value = []
+        mock_db.paginate.return_value.items = []
+        mock_db.paginate.return_value.total = 0
+        user = DatasetServiceUnitDataFactory.create_user_mock(role=TenantAccountRole.NORMAL)
+
+        with (
+            patch("services.dataset_service.db", mock_db),
+            patch("services.dataset_service.dify_config.RBAC_ENABLED", True),
+            patch(
+                "services.dataset_service.enterprise_rbac_service.RBACService.MyPermissions.get",
+                return_value=SimpleNamespace(workspace=SimpleNamespace(permission_keys=[])),
+            ),
+        ):
+            DatasetService.get_datasets(
+                page=1,
+                per_page=20,
+                tenant_id="tenant-1",
+                user=user,
+                accessible_dataset_ids=["dataset-shared"],
+                include_own_datasets=True,
+            )
+
+        select_stmt = mock_db.paginate.call_args.kwargs["select"]
+        visibility_clause = str(select_stmt._where_criteria[1])
+        assert "maintainer" in visibility_clause
+        assert "IN" in visibility_clause
+
+    def test_get_datasets_filters_only_by_rbac_overrides_without_manage_own_permission(self):
+        mock_db = MagicMock()
+        mock_db.session.scalars.return_value.all.return_value = []
+        mock_db.paginate.return_value.items = []
+        mock_db.paginate.return_value.total = 0
+        user = DatasetServiceUnitDataFactory.create_user_mock(role=TenantAccountRole.NORMAL)
+
+        with (
+            patch("services.dataset_service.db", mock_db),
+            patch("services.dataset_service.dify_config.RBAC_ENABLED", True),
+            patch(
+                "services.dataset_service.enterprise_rbac_service.RBACService.MyPermissions.get",
+                return_value=SimpleNamespace(workspace=SimpleNamespace(permission_keys=[])),
+            ),
+        ):
+            DatasetService.get_datasets(
+                page=1,
+                per_page=20,
+                tenant_id="tenant-1",
+                user=user,
+                accessible_dataset_ids=["dataset-shared"],
+            )
+
+        select_stmt = mock_db.paginate.call_args.kwargs["select"]
+        visibility_clause = str(select_stmt._where_criteria[1])
+        assert "maintainer" not in visibility_clause
+        assert "IN" in visibility_clause
+
+    def test_get_datasets_by_ids_applies_rbac_visibility(self):
+        mock_db = MagicMock()
+        mock_db.paginate.return_value.items = []
+        mock_db.paginate.return_value.total = 0
+        user = DatasetServiceUnitDataFactory.create_user_mock(role=TenantAccountRole.NORMAL)
+
+        with (
+            patch("services.dataset_service.db", mock_db),
+            patch("services.dataset_service.dify_config.RBAC_ENABLED", True),
+        ):
+            DatasetService.get_datasets_by_ids(
+                ["dataset-requested", "dataset-shared"],
+                "tenant-1",
+                user=user,
+                accessible_dataset_ids=["dataset-shared", "dataset-not-requested"],
+                include_own_datasets=True,
+            )
+
+        select_stmt = mock_db.paginate.call_args.kwargs["select"]
+        visibility_clause = str(select_stmt._where_criteria[-1])
+        assert "maintainer" in visibility_clause
+        assert "IN" in visibility_clause
+        visibility_params = select_stmt._where_criteria[-1].compile().params
+        assert ["dataset-shared"] in visibility_params.values()
+        list_params = [value for value in visibility_params.values() if isinstance(value, list)]
+        assert all("dataset-not-requested" not in value for value in list_params)
+
+    def test_get_datasets_rbac_include_all_uses_workspace_permission(self):
+        mock_db = MagicMock()
+        mock_db.session.scalars.return_value.all.return_value = []
+        mock_db.paginate.return_value.items = []
+        mock_db.paginate.return_value.total = 0
+
+        user = DatasetServiceUnitDataFactory.create_user_mock(role=TenantAccountRole.NORMAL)
+        mock_permissions = SimpleNamespace(workspace=SimpleNamespace(permission_keys=["dataset.create_and_management"]))
+
+        with (
+            patch("services.dataset_service.db", mock_db),
+            patch("services.dataset_service.dify_config.RBAC_ENABLED", True),
+            patch(
+                "services.dataset_service.enterprise_rbac_service.RBACService.MyPermissions.get",
+                return_value=mock_permissions,
+            ),
+        ):
+            DatasetService.get_datasets(page=1, per_page=20, tenant_id="tenant-1", user=user, include_all=True)
+
+        mock_db.session.scalars.assert_called_once()
+        mock_db.paginate.assert_called_once()
+        select_stmt = mock_db.paginate.call_args.kwargs["select"]
+        assert len(select_stmt._where_criteria) == 1
+
+    def test_get_datasets_rbac_without_user_returns_empty_result(self):
+        mock_db = MagicMock()
+        mock_db.session.scalars.return_value.all.return_value = []
+        mock_db.paginate.return_value.items = []
+        mock_db.paginate.return_value.total = 0
+
+        with (
+            patch("services.dataset_service.db", mock_db),
+            patch("services.dataset_service.dify_config.RBAC_ENABLED", True),
+        ):
+            DatasetService.get_datasets(page=1, per_page=20, tenant_id="tenant-1", user=None)
+
+        mock_db.session.scalars.assert_not_called()
+        mock_db.paginate.assert_called_once()
+        select_stmt = mock_db.paginate.call_args.kwargs["select"]
+        assert len(select_stmt._where_criteria) == 2
+
+    def test_get_datasets_legacy_owner_include_all_keeps_full_access(self):
+        mock_db = MagicMock()
+        mock_db.session.scalars.return_value.all.return_value = []
+        mock_db.paginate.return_value.items = []
+        mock_db.paginate.return_value.total = 0
+
+        user = DatasetServiceUnitDataFactory.create_user_mock(role=TenantAccountRole.OWNER)
+
+        with (
+            patch("services.dataset_service.db", mock_db),
+            patch("services.dataset_service.dify_config.RBAC_ENABLED", False),
+        ):
+            DatasetService.get_datasets(page=1, per_page=20, tenant_id="tenant-1", user=user, include_all=True)
+
+        mock_db.session.scalars.assert_called_once()
+        mock_db.paginate.assert_called_once()
+        select_stmt = mock_db.paginate.call_args.kwargs["select"]
+        assert len(select_stmt._where_criteria) == 1
+
+
 class TestDatasetServiceCreationAndUpdate:
     """Unit tests for dataset creation and update helpers."""
 
diff --git a/api/tests/unit_tests/services/test_external_dataset_service.py b/api/tests/unit_tests/services/test_external_dataset_service.py
index fdea0ba8690..248a2b1f68a 100644
--- a/api/tests/unit_tests/services/test_external_dataset_service.py
+++ b/api/tests/unit_tests/services/test_external_dataset_service.py
@@ -21,6 +21,7 @@ from services.entities.external_knowledge_entities.external_knowledge_entities i
     ExternalKnowledgeApiSetting,
 )
 from services.errors.dataset import DatasetNameDuplicateError
+from services.errors.knowledge_retrieval import ExternalKnowledgeRetrievalError
 from services.external_knowledge_service import ExternalDatasetService
 
 
@@ -136,14 +137,14 @@ class ExternalDatasetServiceTestDataFactory:
 @pytest.fixture
 def factory():
     """Provide the test data factory to all tests."""
-    return ExternalDatasetServiceTestDataFactory
+    return ExternalDatasetServiceTestDataFactory()
 
 
 class TestExternalDatasetServiceGetAPIs:
     """Test get_external_knowledge_apis operations - comprehensive coverage."""
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_success_basic(self, mock_db, factory):
+    def test_get_external_knowledge_apis_success_basic(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful retrieval of external knowledge APIs with pagination."""
         # Arrange
         tenant_id = "tenant-123"
@@ -170,7 +171,9 @@ class TestExternalDatasetServiceGetAPIs:
         mock_db.paginate.assert_called_once()
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_with_search_filter(self, mock_db, factory):
+    def test_get_external_knowledge_apis_with_search_filter(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test retrieval with search filter."""
         # Arrange
         tenant_id = "tenant-123"
@@ -194,7 +197,7 @@ class TestExternalDatasetServiceGetAPIs:
         assert result_items[0].name == "Production API"
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_empty_results(self, mock_db, factory):
+    def test_get_external_knowledge_apis_empty_results(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test retrieval with no results."""
         # Arrange
         mock_pagination = MagicMock()
@@ -212,7 +215,9 @@ class TestExternalDatasetServiceGetAPIs:
         assert result_total == 0
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_large_result_set(self, mock_db, factory):
+    def test_get_external_knowledge_apis_large_result_set(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test retrieval with large result set."""
         # Arrange
         apis = [factory.create_external_knowledge_api_mock(api_id=f"api-{i}") for i in range(100)]
@@ -232,7 +237,9 @@ class TestExternalDatasetServiceGetAPIs:
         assert result_total == 100
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_pagination_last_page(self, mock_db, factory):
+    def test_get_external_knowledge_apis_pagination_last_page(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test last page pagination with partial results."""
         # Arrange
         apis = [factory.create_external_knowledge_api_mock(api_id=f"api-{i}") for i in range(95, 100)]
@@ -252,7 +259,9 @@ class TestExternalDatasetServiceGetAPIs:
         assert result_total == 100
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_case_insensitive_search(self, mock_db, factory):
+    def test_get_external_knowledge_apis_case_insensitive_search(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test case-insensitive search functionality."""
         # Arrange
         apis = [
@@ -275,7 +284,9 @@ class TestExternalDatasetServiceGetAPIs:
         assert result_total == 2
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_special_characters_search(self, mock_db, factory):
+    def test_get_external_knowledge_apis_special_characters_search(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test search with special characters."""
         # Arrange
         apis = [factory.create_external_knowledge_api_mock(name="API-v2.0 (beta)")]
@@ -294,7 +305,9 @@ class TestExternalDatasetServiceGetAPIs:
         assert len(result_items) == 1
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_max_per_page_limit(self, mock_db, factory):
+    def test_get_external_knowledge_apis_max_per_page_limit(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test that max_per_page limit is enforced."""
         # Arrange
         apis = [factory.create_external_knowledge_api_mock(api_id=f"api-{i}") for i in range(100)]
@@ -314,7 +327,9 @@ class TestExternalDatasetServiceGetAPIs:
         assert call_args.kwargs["max_per_page"] == 100
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_apis_ordered_by_created_at_desc(self, mock_db, factory):
+    def test_get_external_knowledge_apis_ordered_by_created_at_desc(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test that results are ordered by created_at descending."""
         # Arrange
         apis = [
@@ -339,7 +354,7 @@ class TestExternalDatasetServiceGetAPIs:
 class TestExternalDatasetServiceValidateAPIList:
     """Test validate_api_list operations."""
 
-    def test_validate_api_list_success_with_all_fields(self, factory):
+    def test_validate_api_list_success_with_all_fields(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful validation with all required fields."""
         # Arrange
         api_settings = {"endpoint": "https://api.example.com", "api_key": "test-key-123"}
@@ -347,7 +362,7 @@ class TestExternalDatasetServiceValidateAPIList:
         # Act & Assert - should not raise
         ExternalDatasetService.validate_api_list(api_settings)
 
-    def test_validate_api_list_missing_endpoint(self, factory):
+    def test_validate_api_list_missing_endpoint(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when endpoint is missing."""
         # Arrange
         api_settings = {"api_key": "test-key"}
@@ -356,7 +371,7 @@ class TestExternalDatasetServiceValidateAPIList:
         with pytest.raises(ValueError, match="endpoint is required"):
             ExternalDatasetService.validate_api_list(api_settings)
 
-    def test_validate_api_list_empty_endpoint(self, factory):
+    def test_validate_api_list_empty_endpoint(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when endpoint is empty string."""
         # Arrange
         api_settings = {"endpoint": "", "api_key": "test-key"}
@@ -365,7 +380,7 @@ class TestExternalDatasetServiceValidateAPIList:
         with pytest.raises(ValueError, match="endpoint is required"):
             ExternalDatasetService.validate_api_list(api_settings)
 
-    def test_validate_api_list_missing_api_key(self, factory):
+    def test_validate_api_list_missing_api_key(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when API key is missing."""
         # Arrange
         api_settings = {"endpoint": "https://api.example.com"}
@@ -374,7 +389,7 @@ class TestExternalDatasetServiceValidateAPIList:
         with pytest.raises(ValueError, match="api_key is required"):
             ExternalDatasetService.validate_api_list(api_settings)
 
-    def test_validate_api_list_empty_api_key(self, factory):
+    def test_validate_api_list_empty_api_key(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when API key is empty string."""
         # Arrange
         api_settings = {"endpoint": "https://api.example.com", "api_key": ""}
@@ -383,7 +398,7 @@ class TestExternalDatasetServiceValidateAPIList:
         with pytest.raises(ValueError, match="api_key is required"):
             ExternalDatasetService.validate_api_list(api_settings)
 
-    def test_validate_api_list_empty_dict(self, factory):
+    def test_validate_api_list_empty_dict(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when settings are empty dict."""
         # Arrange
         api_settings = {}
@@ -392,7 +407,7 @@ class TestExternalDatasetServiceValidateAPIList:
         with pytest.raises(ValueError, match="api list is empty"):
             ExternalDatasetService.validate_api_list(api_settings)
 
-    def test_validate_api_list_none_value(self, factory):
+    def test_validate_api_list_none_value(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when settings are None."""
         # Arrange
         api_settings = None
@@ -401,7 +416,7 @@ class TestExternalDatasetServiceValidateAPIList:
         with pytest.raises(ValueError, match="api list is empty"):
             ExternalDatasetService.validate_api_list(api_settings)
 
-    def test_validate_api_list_with_extra_fields(self, factory):
+    def test_validate_api_list_with_extra_fields(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation succeeds with extra fields present."""
         # Arrange
         api_settings = {
@@ -420,7 +435,9 @@ class TestExternalDatasetServiceCreateAPI:
 
     @patch("services.external_knowledge_service.db")
     @patch("services.external_knowledge_service.ExternalDatasetService.check_endpoint_and_api_key")
-    def test_create_external_knowledge_api_success_full(self, mock_check, mock_db, factory):
+    def test_create_external_knowledge_api_success_full(
+        self, mock_check, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test successful creation with all fields."""
         # Arrange
         tenant_id = "tenant-123"
@@ -446,7 +463,9 @@ class TestExternalDatasetServiceCreateAPI:
 
     @patch("services.external_knowledge_service.db")
     @patch("services.external_knowledge_service.ExternalDatasetService.check_endpoint_and_api_key")
-    def test_create_external_knowledge_api_minimal_fields(self, mock_check, mock_db, factory):
+    def test_create_external_knowledge_api_minimal_fields(
+        self, mock_check, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test creation with minimal required fields."""
         # Arrange
         args = {
@@ -462,7 +481,9 @@ class TestExternalDatasetServiceCreateAPI:
         assert result.description == ""
 
     @patch("services.external_knowledge_service.db")
-    def test_create_external_knowledge_api_missing_settings(self, mock_db, factory):
+    def test_create_external_knowledge_api_missing_settings(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test creation fails when settings are missing."""
         # Arrange
         args = {"name": "Test API", "description": "Test"}
@@ -472,7 +493,7 @@ class TestExternalDatasetServiceCreateAPI:
             ExternalDatasetService.create_external_knowledge_api("tenant-123", "user-123", args)
 
     @patch("services.external_knowledge_service.db")
-    def test_create_external_knowledge_api_none_settings(self, mock_db, factory):
+    def test_create_external_knowledge_api_none_settings(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test creation fails when settings are explicitly None."""
         # Arrange
         args = {"name": "Test API", "settings": None}
@@ -483,7 +504,9 @@ class TestExternalDatasetServiceCreateAPI:
 
     @patch("services.external_knowledge_service.db")
     @patch("services.external_knowledge_service.ExternalDatasetService.check_endpoint_and_api_key")
-    def test_create_external_knowledge_api_settings_json_serialization(self, mock_check, mock_db, factory):
+    def test_create_external_knowledge_api_settings_json_serialization(
+        self, mock_check, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test that settings are properly JSON serialized."""
         # Arrange
         settings = {
@@ -503,7 +526,9 @@ class TestExternalDatasetServiceCreateAPI:
 
     @patch("services.external_knowledge_service.db")
     @patch("services.external_knowledge_service.ExternalDatasetService.check_endpoint_and_api_key")
-    def test_create_external_knowledge_api_unicode_handling(self, mock_check, mock_db, factory):
+    def test_create_external_knowledge_api_unicode_handling(
+        self, mock_check, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test proper handling of Unicode characters in name and description."""
         # Arrange
         args = {
@@ -521,7 +546,9 @@ class TestExternalDatasetServiceCreateAPI:
 
     @patch("services.external_knowledge_service.db")
     @patch("services.external_knowledge_service.ExternalDatasetService.check_endpoint_and_api_key")
-    def test_create_external_knowledge_api_long_description(self, mock_check, mock_db, factory):
+    def test_create_external_knowledge_api_long_description(
+        self, mock_check, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test creation with very long description."""
         # Arrange
         long_description = "A" * 1000
@@ -543,7 +570,7 @@ class TestExternalDatasetServiceCheckEndpoint:
     """Test check_endpoint_and_api_key operations - extensive coverage."""
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_success_https(self, mock_proxy, factory):
+    def test_check_endpoint_success_https(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful validation with HTTPS endpoint."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "test-key"}
@@ -557,7 +584,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         mock_proxy.post.assert_called_once()
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_success_http(self, mock_proxy, factory):
+    def test_check_endpoint_success_http(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful validation with HTTP endpoint."""
         # Arrange
         settings = {"endpoint": "http://api.example.com", "api_key": "test-key"}
@@ -569,7 +596,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         # Act & Assert - should not raise
         ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_missing_endpoint_key(self, factory):
+    def test_check_endpoint_missing_endpoint_key(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when endpoint key is missing."""
         # Arrange
         settings = {"api_key": "test-key"}
@@ -578,7 +605,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         with pytest.raises(ValueError, match="endpoint is required"):
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_empty_endpoint_string(self, factory):
+    def test_check_endpoint_empty_endpoint_string(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when endpoint is empty string."""
         # Arrange
         settings = {"endpoint": "", "api_key": "test-key"}
@@ -587,7 +614,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         with pytest.raises(ValueError, match="endpoint is required"):
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_whitespace_endpoint(self, factory):
+    def test_check_endpoint_whitespace_endpoint(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when endpoint is only whitespace."""
         # Arrange
         settings = {"endpoint": "   ", "api_key": "test-key"}
@@ -596,7 +623,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         with pytest.raises(ValueError, match="invalid endpoint"):
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_missing_api_key_key(self, factory):
+    def test_check_endpoint_missing_api_key_key(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when api_key key is missing."""
         # Arrange
         settings = {"endpoint": "https://api.example.com"}
@@ -605,7 +632,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         with pytest.raises(ValueError, match="api_key is required"):
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_empty_api_key_string(self, factory):
+    def test_check_endpoint_empty_api_key_string(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when api_key is empty string."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": ""}
@@ -614,7 +641,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         with pytest.raises(ValueError, match="api_key is required"):
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_no_scheme_url(self, factory):
+    def test_check_endpoint_no_scheme_url(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails for URL without http:// or https://."""
         # Arrange
         settings = {"endpoint": "api.example.com", "api_key": "test-key"}
@@ -623,7 +650,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         with pytest.raises(ValueError, match="invalid endpoint.*must start with http"):
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_invalid_scheme(self, factory):
+    def test_check_endpoint_invalid_scheme(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails for URL with invalid scheme."""
         # Arrange
         settings = {"endpoint": "ftp://api.example.com", "api_key": "test-key"}
@@ -632,7 +659,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         with pytest.raises(ValueError, match="failed to connect to the endpoint"):
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_no_netloc(self, factory):
+    def test_check_endpoint_no_netloc(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails for URL without network location."""
         # Arrange
         settings = {"endpoint": "http://", "api_key": "test-key"}
@@ -641,7 +668,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         with pytest.raises(ValueError, match="invalid endpoint"):
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
-    def test_check_endpoint_malformed_url(self, factory):
+    def test_check_endpoint_malformed_url(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails for malformed URL."""
         # Arrange
         settings = {"endpoint": "https:///invalid", "api_key": "test-key"}
@@ -651,7 +678,7 @@ class TestExternalDatasetServiceCheckEndpoint:
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_connection_timeout(self, mock_proxy, factory):
+    def test_check_endpoint_connection_timeout(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails on connection timeout."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "test-key"}
@@ -662,7 +689,7 @@ class TestExternalDatasetServiceCheckEndpoint:
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_network_error(self, mock_proxy, factory):
+    def test_check_endpoint_network_error(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails on network error."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "test-key"}
@@ -673,7 +700,7 @@ class TestExternalDatasetServiceCheckEndpoint:
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_502_bad_gateway(self, mock_proxy, factory):
+    def test_check_endpoint_502_bad_gateway(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails with 502 Bad Gateway."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "test-key"}
@@ -687,7 +714,7 @@ class TestExternalDatasetServiceCheckEndpoint:
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_404_not_found(self, mock_proxy, factory):
+    def test_check_endpoint_404_not_found(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails with 404 Not Found."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "test-key"}
@@ -701,7 +728,7 @@ class TestExternalDatasetServiceCheckEndpoint:
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_403_forbidden(self, mock_proxy, factory):
+    def test_check_endpoint_403_forbidden(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails with 403 Forbidden (auth failure)."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "wrong-key"}
@@ -715,7 +742,7 @@ class TestExternalDatasetServiceCheckEndpoint:
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_other_4xx_codes_pass(self, mock_proxy, factory):
+    def test_check_endpoint_other_4xx_codes_pass(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test that other 4xx codes don't raise exceptions."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "test-key"}
@@ -729,7 +756,7 @@ class TestExternalDatasetServiceCheckEndpoint:
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_5xx_codes_except_502_pass(self, mock_proxy, factory):
+    def test_check_endpoint_5xx_codes_except_502_pass(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test that 5xx codes except 502 don't raise exceptions."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "test-key"}
@@ -743,7 +770,7 @@ class TestExternalDatasetServiceCheckEndpoint:
             ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_with_port_number(self, mock_proxy, factory):
+    def test_check_endpoint_with_port_number(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation with endpoint including port number."""
         # Arrange
         settings = {"endpoint": "https://api.example.com:8443", "api_key": "test-key"}
@@ -756,7 +783,7 @@ class TestExternalDatasetServiceCheckEndpoint:
         ExternalDatasetService.check_endpoint_and_api_key(settings)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_with_path(self, mock_proxy, factory):
+    def test_check_endpoint_with_path(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation with endpoint including path."""
         # Arrange
         settings = {"endpoint": "https://api.example.com/v1/api", "api_key": "test-key"}
@@ -772,7 +799,9 @@ class TestExternalDatasetServiceCheckEndpoint:
         assert "/retrieval" in call_args[0][0]
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_check_endpoint_authorization_header_format(self, mock_proxy, factory):
+    def test_check_endpoint_authorization_header_format(
+        self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test that Authorization header is properly formatted."""
         # Arrange
         settings = {"endpoint": "https://api.example.com", "api_key": "test-key-123"}
@@ -794,7 +823,7 @@ class TestExternalDatasetServiceGetAPI:
     """Test get_external_knowledge_api operations."""
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_api_success(self, mock_db, factory):
+    def test_get_external_knowledge_api_success(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful retrieval of external knowledge API."""
         # Arrange
         api_id = "api-123"
@@ -810,7 +839,7 @@ class TestExternalDatasetServiceGetAPI:
         assert result.id == api_id
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_api_not_found(self, mock_db, factory):
+    def test_get_external_knowledge_api_not_found(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test error when API is not found."""
         # Arrange
         mock_db.session.scalar.return_value = None
@@ -825,7 +854,9 @@ class TestExternalDatasetServiceUpdateAPI:
 
     @patch("services.external_knowledge_service.naive_utc_now")
     @patch("services.external_knowledge_service.db")
-    def test_update_external_knowledge_api_success_all_fields(self, mock_db, mock_now, factory):
+    def test_update_external_knowledge_api_success_all_fields(
+        self, mock_db, mock_now, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test successful update with all fields."""
         # Arrange
         api_id = "api-123"
@@ -855,7 +886,9 @@ class TestExternalDatasetServiceUpdateAPI:
         mock_db.session.commit.assert_called_once()
 
     @patch("services.external_knowledge_service.db")
-    def test_update_external_knowledge_api_preserve_hidden_api_key(self, mock_db, factory):
+    def test_update_external_knowledge_api_preserve_hidden_api_key(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test that hidden API key is preserved from existing settings."""
         # Arrange
         api_id = "api-123"
@@ -882,7 +915,7 @@ class TestExternalDatasetServiceUpdateAPI:
         assert settings["api_key"] == "original-secret-key"
 
     @patch("services.external_knowledge_service.db")
-    def test_update_external_knowledge_api_not_found(self, mock_db, factory):
+    def test_update_external_knowledge_api_not_found(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test error when API is not found."""
         # Arrange
         mock_db.session.scalar.return_value = None
@@ -894,7 +927,9 @@ class TestExternalDatasetServiceUpdateAPI:
             ExternalDatasetService.update_external_knowledge_api("tenant-123", "user-123", "api-123", args)
 
     @patch("services.external_knowledge_service.db")
-    def test_update_external_knowledge_api_tenant_mismatch(self, mock_db, factory):
+    def test_update_external_knowledge_api_tenant_mismatch(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test error when tenant ID doesn't match."""
         # Arrange
         mock_db.session.scalar.return_value = None
@@ -906,7 +941,7 @@ class TestExternalDatasetServiceUpdateAPI:
             ExternalDatasetService.update_external_knowledge_api("wrong-tenant", "user-123", "api-123", args)
 
     @patch("services.external_knowledge_service.db")
-    def test_update_external_knowledge_api_name_only(self, mock_db, factory):
+    def test_update_external_knowledge_api_name_only(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test updating only the name field."""
         # Arrange
         existing_api = factory.create_external_knowledge_api_mock(
@@ -929,7 +964,7 @@ class TestExternalDatasetServiceDeleteAPI:
     """Test delete_external_knowledge_api operations."""
 
     @patch("services.external_knowledge_service.db")
-    def test_delete_external_knowledge_api_success(self, mock_db, factory):
+    def test_delete_external_knowledge_api_success(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful deletion of external knowledge API."""
         # Arrange
         api_id = "api-123"
@@ -947,7 +982,7 @@ class TestExternalDatasetServiceDeleteAPI:
         mock_db.session.commit.assert_called_once()
 
     @patch("services.external_knowledge_service.db")
-    def test_delete_external_knowledge_api_not_found(self, mock_db, factory):
+    def test_delete_external_knowledge_api_not_found(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test error when API is not found."""
         # Arrange
         mock_db.session.scalar.return_value = None
@@ -957,7 +992,9 @@ class TestExternalDatasetServiceDeleteAPI:
             ExternalDatasetService.delete_external_knowledge_api("tenant-123", "api-123")
 
     @patch("services.external_knowledge_service.db")
-    def test_delete_external_knowledge_api_tenant_mismatch(self, mock_db, factory):
+    def test_delete_external_knowledge_api_tenant_mismatch(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test error when tenant ID doesn't match."""
         # Arrange
         mock_db.session.scalar.return_value = None
@@ -971,7 +1008,9 @@ class TestExternalDatasetServiceAPIUseCheck:
     """Test external_knowledge_api_use_check operations."""
 
     @patch("services.external_knowledge_service.db")
-    def test_external_knowledge_api_use_check_in_use_single(self, mock_db, factory):
+    def test_external_knowledge_api_use_check_in_use_single(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test API use check when API has one binding."""
         # Arrange
         api_id = "api-123"
@@ -988,7 +1027,9 @@ class TestExternalDatasetServiceAPIUseCheck:
         assert "tenant_id" in str(mock_db.session.scalar.call_args.args[0])
 
     @patch("services.external_knowledge_service.db")
-    def test_external_knowledge_api_use_check_in_use_multiple(self, mock_db, factory):
+    def test_external_knowledge_api_use_check_in_use_multiple(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test API use check with multiple bindings."""
         # Arrange
         api_id = "api-123"
@@ -1004,7 +1045,7 @@ class TestExternalDatasetServiceAPIUseCheck:
         assert count == 10
 
     @patch("services.external_knowledge_service.db")
-    def test_external_knowledge_api_use_check_not_in_use(self, mock_db, factory):
+    def test_external_knowledge_api_use_check_not_in_use(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test API use check when API is not in use."""
         # Arrange
         api_id = "api-123"
@@ -1024,7 +1065,7 @@ class TestExternalDatasetServiceGetBinding:
     """Test get_external_knowledge_binding_with_dataset_id operations."""
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_binding_success(self, mock_db, factory):
+    def test_get_external_knowledge_binding_success(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful retrieval of external knowledge binding."""
         # Arrange
         tenant_id = "tenant-123"
@@ -1042,7 +1083,7 @@ class TestExternalDatasetServiceGetBinding:
         assert result.tenant_id == tenant_id
 
     @patch("services.external_knowledge_service.db")
-    def test_get_external_knowledge_binding_not_found(self, mock_db, factory):
+    def test_get_external_knowledge_binding_not_found(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test error when binding is not found."""
         # Arrange
         mock_db.session.scalar.return_value = None
@@ -1056,7 +1097,9 @@ class TestExternalDatasetServiceDocumentValidate:
     """Test document_create_args_validate operations."""
 
     @patch("services.external_knowledge_service.db")
-    def test_document_create_args_validate_success_all_params(self, mock_db, factory):
+    def test_document_create_args_validate_success_all_params(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test successful validation with all required parameters."""
         # Arrange
         tenant_id = "tenant-123"
@@ -1080,7 +1123,9 @@ class TestExternalDatasetServiceDocumentValidate:
         ExternalDatasetService.document_create_args_validate(tenant_id, api_id, process_parameter)
 
     @patch("services.external_knowledge_service.db")
-    def test_document_create_args_validate_missing_required_param(self, mock_db, factory):
+    def test_document_create_args_validate_missing_required_param(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test validation fails when required parameter is missing."""
         # Arrange
         tenant_id = "tenant-123"
@@ -1099,7 +1144,7 @@ class TestExternalDatasetServiceDocumentValidate:
             ExternalDatasetService.document_create_args_validate(tenant_id, api_id, process_parameter)
 
     @patch("services.external_knowledge_service.db")
-    def test_document_create_args_validate_api_not_found(self, mock_db, factory):
+    def test_document_create_args_validate_api_not_found(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test validation fails when API is not found."""
         # Arrange
         mock_db.session.scalar.return_value = None
@@ -1109,7 +1154,9 @@ class TestExternalDatasetServiceDocumentValidate:
             ExternalDatasetService.document_create_args_validate("tenant-123", "api-123", {})
 
     @patch("services.external_knowledge_service.db")
-    def test_document_create_args_validate_no_custom_parameters(self, mock_db, factory):
+    def test_document_create_args_validate_no_custom_parameters(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test validation succeeds when no custom parameters defined."""
         # Arrange
         settings = {}
@@ -1121,7 +1168,9 @@ class TestExternalDatasetServiceDocumentValidate:
         ExternalDatasetService.document_create_args_validate("tenant-123", "api-123", {})
 
     @patch("services.external_knowledge_service.db")
-    def test_document_create_args_validate_optional_params_not_required(self, mock_db, factory):
+    def test_document_create_args_validate_optional_params_not_required(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test that optional parameters don't cause validation failure."""
         # Arrange
         settings = {
@@ -1145,7 +1194,7 @@ class TestExternalDatasetServiceProcessAPI:
     """Test process_external_api operations - comprehensive HTTP method coverage."""
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_process_external_api_get_request(self, mock_proxy, factory):
+    def test_process_external_api_get_request(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test processing GET request."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="get")
@@ -1161,7 +1210,9 @@ class TestExternalDatasetServiceProcessAPI:
         mock_proxy.get.assert_called_once()
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_process_external_api_post_request_with_data(self, mock_proxy, factory):
+    def test_process_external_api_post_request_with_data(
+        self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test processing POST request with data."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="post", params={"key": "value", "data": "test"})
@@ -1179,7 +1230,7 @@ class TestExternalDatasetServiceProcessAPI:
         assert "data" in call_kwargs
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_process_external_api_put_request(self, mock_proxy, factory):
+    def test_process_external_api_put_request(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test processing PUT request."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="put")
@@ -1195,7 +1246,7 @@ class TestExternalDatasetServiceProcessAPI:
         mock_proxy.put.assert_called_once()
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_process_external_api_delete_request(self, mock_proxy, factory):
+    def test_process_external_api_delete_request(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test processing DELETE request."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="delete")
@@ -1211,7 +1262,7 @@ class TestExternalDatasetServiceProcessAPI:
         mock_proxy.delete.assert_called_once()
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_process_external_api_patch_request(self, mock_proxy, factory):
+    def test_process_external_api_patch_request(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test processing PATCH request."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="patch")
@@ -1227,7 +1278,7 @@ class TestExternalDatasetServiceProcessAPI:
         mock_proxy.patch.assert_called_once()
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_process_external_api_head_request(self, mock_proxy, factory):
+    def test_process_external_api_head_request(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test processing HEAD request."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="head")
@@ -1242,7 +1293,7 @@ class TestExternalDatasetServiceProcessAPI:
         assert result == mock_response
         mock_proxy.head.assert_called_once()
 
-    def test_process_external_api_invalid_method(self, factory):
+    def test_process_external_api_invalid_method(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test error for invalid HTTP method."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="INVALID")
@@ -1252,7 +1303,7 @@ class TestExternalDatasetServiceProcessAPI:
             ExternalDatasetService.process_external_api(settings, None)
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_process_external_api_with_files(self, mock_proxy, factory):
+    def test_process_external_api_with_files(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test processing request with file uploads."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="post")
@@ -1271,7 +1322,7 @@ class TestExternalDatasetServiceProcessAPI:
         assert call_kwargs["files"] == files
 
     @patch("services.external_knowledge_service.ssrf_proxy")
-    def test_process_external_api_follow_redirects(self, mock_proxy, factory):
+    def test_process_external_api_follow_redirects(self, mock_proxy, factory: ExternalDatasetServiceTestDataFactory):
         """Test that follow_redirects is enabled."""
         # Arrange
         settings = factory.create_api_setting_mock(request_method="get")
@@ -1290,7 +1341,7 @@ class TestExternalDatasetServiceProcessAPI:
 class TestExternalDatasetServiceAssemblingHeaders:
     """Test assembling_headers operations - comprehensive authorization coverage."""
 
-    def test_assembling_headers_bearer_token(self, factory):
+    def test_assembling_headers_bearer_token(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test assembling headers with Bearer token."""
         # Arrange
         authorization = factory.create_authorization_mock(token_type="bearer", api_key="secret-key-123")
@@ -1301,7 +1352,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
         # Assert
         assert result["Authorization"] == "Bearer secret-key-123"
 
-    def test_assembling_headers_basic_auth(self, factory):
+    def test_assembling_headers_basic_auth(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test assembling headers with Basic authentication."""
         # Arrange
         authorization = factory.create_authorization_mock(token_type="basic", api_key="credentials")
@@ -1312,7 +1363,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
         # Assert
         assert result["Authorization"] == "Basic credentials"
 
-    def test_assembling_headers_custom_auth(self, factory):
+    def test_assembling_headers_custom_auth(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test assembling headers with custom authentication."""
         # Arrange
         authorization = factory.create_authorization_mock(token_type="custom", api_key="custom-token")
@@ -1323,7 +1374,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
         # Assert
         assert result["Authorization"] == "custom-token"
 
-    def test_assembling_headers_custom_header_name(self, factory):
+    def test_assembling_headers_custom_header_name(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test assembling headers with custom header name."""
         # Arrange
         authorization = factory.create_authorization_mock(token_type="bearer", api_key="key-123", header="X-API-Key")
@@ -1335,7 +1386,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
         assert result["X-API-Key"] == "Bearer key-123"
         assert "Authorization" not in result
 
-    def test_assembling_headers_with_existing_headers(self, factory):
+    def test_assembling_headers_with_existing_headers(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test assembling headers preserves existing headers."""
         # Arrange
         authorization = factory.create_authorization_mock(token_type="bearer", api_key="key")
@@ -1354,7 +1405,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
         assert result["X-Custom"] == "value"
         assert result["User-Agent"] == "TestAgent/1.0"
 
-    def test_assembling_headers_empty_existing_headers(self, factory):
+    def test_assembling_headers_empty_existing_headers(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test assembling headers with empty existing headers dict."""
         # Arrange
         authorization = factory.create_authorization_mock(token_type="bearer", api_key="key")
@@ -1367,7 +1418,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
         assert result["Authorization"] == "Bearer key"
         assert len(result) == 1
 
-    def test_assembling_headers_missing_api_key(self, factory):
+    def test_assembling_headers_missing_api_key(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test error when API key is missing."""
         # Arrange
         config = AuthorizationConfig(api_key=None, type="bearer", header="Authorization")
@@ -1377,7 +1428,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
         with pytest.raises(ValueError, match="api_key is required"):
             ExternalDatasetService.assembling_headers(authorization)
 
-    def test_assembling_headers_missing_config(self, factory):
+    def test_assembling_headers_missing_config(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test error when config is missing."""
         # Arrange
         authorization = Authorization(type="api-key", config=None)
@@ -1386,7 +1437,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
         with pytest.raises(ValueError, match="authorization config is required"):
             ExternalDatasetService.assembling_headers(authorization)
 
-    def test_assembling_headers_default_header_name(self, factory):
+    def test_assembling_headers_default_header_name(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test that default header name is Authorization when not specified."""
         # Arrange
         config = AuthorizationConfig(api_key="key", type="bearer", header=None)
@@ -1402,7 +1453,7 @@ class TestExternalDatasetServiceAssemblingHeaders:
 class TestExternalDatasetServiceGetSettings:
     """Test get_external_knowledge_api_settings operations."""
 
-    def test_get_external_knowledge_api_settings_success(self, factory):
+    def test_get_external_knowledge_api_settings_success(self, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful parsing of API settings."""
         # Arrange
         settings = {
@@ -1427,7 +1478,7 @@ class TestExternalDatasetServiceCreateDataset:
     """Test create_external_dataset operations."""
 
     @patch("services.external_knowledge_service.db")
-    def test_create_external_dataset_success_full(self, mock_db, factory):
+    def test_create_external_dataset_success_full(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test successful creation of external dataset with all fields."""
         # Arrange
         tenant_id = "tenant-123"
@@ -1456,7 +1507,9 @@ class TestExternalDatasetServiceCreateDataset:
         mock_db.session.commit.assert_called_once()
 
     @patch("services.external_knowledge_service.db")
-    def test_create_external_dataset_duplicate_name_error(self, mock_db, factory):
+    def test_create_external_dataset_duplicate_name_error(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test error when dataset name already exists."""
         # Arrange
         existing_dataset = factory.create_dataset_mock(name="Duplicate Dataset")
@@ -1470,7 +1523,7 @@ class TestExternalDatasetServiceCreateDataset:
             ExternalDatasetService.create_external_dataset("tenant-123", "user-123", args)
 
     @patch("services.external_knowledge_service.db")
-    def test_create_external_dataset_api_not_found_error(self, mock_db, factory):
+    def test_create_external_dataset_api_not_found_error(self, mock_db, factory: ExternalDatasetServiceTestDataFactory):
         """Test error when external knowledge API is not found."""
         # Arrange
         mock_db.session.scalar.side_effect = [None, None]
@@ -1482,7 +1535,9 @@ class TestExternalDatasetServiceCreateDataset:
             ExternalDatasetService.create_external_dataset("tenant-123", "user-123", args)
 
     @patch("services.external_knowledge_service.db")
-    def test_create_external_dataset_missing_knowledge_id_error(self, mock_db, factory):
+    def test_create_external_dataset_missing_knowledge_id_error(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test error when external_knowledge_id is missing."""
         # Arrange
         api = factory.create_external_knowledge_api_mock()
@@ -1496,7 +1551,9 @@ class TestExternalDatasetServiceCreateDataset:
             ExternalDatasetService.create_external_dataset("tenant-123", "user-123", args)
 
     @patch("services.external_knowledge_service.db")
-    def test_create_external_dataset_missing_api_id_error(self, mock_db, factory):
+    def test_create_external_dataset_missing_api_id_error(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test error when external_knowledge_api_id is missing."""
         # Arrange
         api = factory.create_external_knowledge_api_mock()
@@ -1515,7 +1572,9 @@ class TestExternalDatasetServiceFetchRetrieval:
 
     @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
     @patch("services.external_knowledge_service.db")
-    def test_fetch_external_knowledge_retrieval_success_with_results(self, mock_db, mock_process, factory):
+    def test_fetch_external_knowledge_retrieval_success_with_results(
+        self, mock_db, mock_process, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test successful external knowledge retrieval with results."""
         # Arrange
         tenant_id = "tenant-123"
@@ -1552,29 +1611,35 @@ class TestExternalDatasetServiceFetchRetrieval:
         assert result[1]["score"] == 0.8
 
     @patch("services.external_knowledge_service.db")
-    def test_fetch_external_knowledge_retrieval_binding_not_found_error(self, mock_db, factory):
+    def test_fetch_external_knowledge_retrieval_binding_not_found_error(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test error when external knowledge binding is not found."""
         # Arrange
         mock_db.session.scalar.return_value = None
 
         # Act & Assert
-        with pytest.raises(ValueError, match="external knowledge binding not found"):
+        with pytest.raises(ExternalKnowledgeRetrievalError, match="external knowledge binding not found"):
             ExternalDatasetService.fetch_external_knowledge_retrieval("tenant-123", "dataset-123", "query", {})
 
     @patch("services.external_knowledge_service.db")
-    def test_fetch_external_knowledge_retrieval_cross_tenant_api_template_error(self, mock_db, factory):
+    def test_fetch_external_knowledge_retrieval_cross_tenant_api_template_error(
+        self, mock_db, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test error when a binding points to an API template outside the dataset tenant."""
         # Arrange
         binding = factory.create_external_knowledge_binding_mock()
         mock_db.session.scalar.side_effect = [binding, None]
 
         # Act & Assert
-        with pytest.raises(ValueError, match="external api template not found"):
+        with pytest.raises(ExternalKnowledgeRetrievalError, match="external api template not found"):
             ExternalDatasetService.fetch_external_knowledge_retrieval("tenant-123", "dataset-123", "query", {})
 
     @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
     @patch("services.external_knowledge_service.db")
-    def test_fetch_external_knowledge_retrieval_empty_results(self, mock_db, mock_process, factory):
+    def test_fetch_external_knowledge_retrieval_empty_results(
+        self, mock_db, mock_process, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test retrieval with empty results."""
         # Arrange
         binding = factory.create_external_knowledge_binding_mock()
@@ -1597,7 +1662,9 @@ class TestExternalDatasetServiceFetchRetrieval:
 
     @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
     @patch("services.external_knowledge_service.db")
-    def test_fetch_external_knowledge_retrieval_with_score_threshold(self, mock_db, mock_process, factory):
+    def test_fetch_external_knowledge_retrieval_with_score_threshold(
+        self, mock_db, mock_process, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test retrieval with score threshold enabled."""
         # Arrange
         binding = factory.create_external_knowledge_binding_mock()
@@ -1629,7 +1696,9 @@ class TestExternalDatasetServiceFetchRetrieval:
 
     @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
     @patch("services.external_knowledge_service.db")
-    def test_fetch_external_knowledge_retrieval_non_200_status_raises_exception(self, mock_db, mock_process, factory):
+    def test_fetch_external_knowledge_retrieval_non_200_status_raises_exception(
+        self, mock_db, mock_process, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test that non-200 status code raises Exception with response text."""
         # Arrange
         binding = factory.create_external_knowledge_binding_mock()
@@ -1643,7 +1712,7 @@ class TestExternalDatasetServiceFetchRetrieval:
         mock_process.return_value = mock_response
 
         # Act & Assert
-        with pytest.raises(Exception, match="Internal Server Error: Database connection failed"):
+        with pytest.raises(ExternalKnowledgeRetrievalError, match="Internal Server Error: Database connection failed"):
             ExternalDatasetService.fetch_external_knowledge_retrieval(
                 "tenant-123", "dataset-123", "query", {"top_k": 5}
             )
@@ -1664,7 +1733,7 @@ class TestExternalDatasetServiceFetchRetrieval:
     @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
     @patch("services.external_knowledge_service.db")
     def test_fetch_external_knowledge_retrieval_various_error_status_codes(
-        self, mock_db, mock_process, factory, status_code, error_message
+        self, mock_db, mock_process, factory: ExternalDatasetServiceTestDataFactory, status_code, error_message
     ):
         """Test that various error status codes raise exceptions with response text."""
         # Arrange
@@ -1684,12 +1753,14 @@ class TestExternalDatasetServiceFetchRetrieval:
         mock_process.return_value = mock_response
 
         # Act & Assert
-        with pytest.raises(ValueError, match=re.escape(error_message)):
+        with pytest.raises(ExternalKnowledgeRetrievalError, match=re.escape(error_message)):
             ExternalDatasetService.fetch_external_knowledge_retrieval(tenant_id, dataset_id, "query", {"top_k": 5})
 
     @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
     @patch("services.external_knowledge_service.db")
-    def test_fetch_external_knowledge_retrieval_empty_response_text(self, mock_db, mock_process, factory):
+    def test_fetch_external_knowledge_retrieval_empty_response_text(
+        self, mock_db, mock_process, factory: ExternalDatasetServiceTestDataFactory
+    ):
         """Test exception with empty response text."""
         # Arrange
         binding = factory.create_external_knowledge_binding_mock()
@@ -1703,7 +1774,79 @@ class TestExternalDatasetServiceFetchRetrieval:
         mock_process.return_value = mock_response
 
         # Act & Assert
-        with pytest.raises(ValueError):
+        with pytest.raises(ExternalKnowledgeRetrievalError):
+            ExternalDatasetService.fetch_external_knowledge_retrieval(
+                "tenant-123", "dataset-123", "query", {"top_k": 5}
+            )
+
+    @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
+    @patch("services.external_knowledge_service.db")
+    def test_fetch_external_knowledge_retrieval_invalid_json_response(self, mock_db, mock_process, factory):
+        """Test malformed JSON success responses are normalized to external retrieval errors."""
+        binding = factory.create_external_knowledge_binding_mock()
+        api = factory.create_external_knowledge_api_mock()
+
+        mock_db.session.scalar.side_effect = [binding, api]
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.side_effect = json.JSONDecodeError("Expecting value", "", 0)
+        mock_process.return_value = mock_response
+
+        with pytest.raises(ExternalKnowledgeRetrievalError, match="invalid external knowledge response"):
+            ExternalDatasetService.fetch_external_knowledge_retrieval(
+                "tenant-123", "dataset-123", "query", {"top_k": 5}
+            )
+
+    @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
+    @patch("services.external_knowledge_service.db")
+    def test_fetch_external_knowledge_retrieval_invalid_success_payload_shape(self, mock_db, mock_process, factory):
+        """Test malformed success payload shapes are normalized to external retrieval errors."""
+        binding = factory.create_external_knowledge_binding_mock()
+        api = factory.create_external_knowledge_api_mock()
+
+        mock_db.session.scalar.side_effect = [binding, api]
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = ["not-a-dict"]
+        mock_process.return_value = mock_response
+
+        with pytest.raises(ExternalKnowledgeRetrievalError, match="invalid external knowledge response"):
+            ExternalDatasetService.fetch_external_knowledge_retrieval(
+                "tenant-123", "dataset-123", "query", {"top_k": 5}
+            )
+
+    @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
+    @patch("services.external_knowledge_service.db")
+    def test_fetch_external_knowledge_retrieval_invalid_records_shape(self, mock_db, mock_process, factory):
+        """Test non-list records payloads are normalized to external retrieval errors."""
+        binding = factory.create_external_knowledge_binding_mock()
+        api = factory.create_external_knowledge_api_mock()
+
+        mock_db.session.scalar.side_effect = [binding, api]
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"records": {"unexpected": "shape"}}
+        mock_process.return_value = mock_response
+
+        with pytest.raises(ExternalKnowledgeRetrievalError, match="invalid external knowledge response"):
+            ExternalDatasetService.fetch_external_knowledge_retrieval(
+                "tenant-123", "dataset-123", "query", {"top_k": 5}
+            )
+
+    @patch("services.external_knowledge_service.ExternalDatasetService.process_external_api")
+    @patch("services.external_knowledge_service.db")
+    def test_fetch_external_knowledge_retrieval_wraps_transport_errors(self, mock_db, mock_process, factory):
+        """Test transport/runtime failures are normalized to external retrieval errors."""
+        binding = factory.create_external_knowledge_binding_mock()
+        api = factory.create_external_knowledge_api_mock()
+
+        mock_db.session.scalar.side_effect = [binding, api]
+        mock_process.side_effect = RuntimeError("connection reset by peer")
+
+        with pytest.raises(ExternalKnowledgeRetrievalError, match="connection reset by peer"):
             ExternalDatasetService.fetch_external_knowledge_retrieval(
                 "tenant-123", "dataset-123", "query", {"top_k": 5}
             )
diff --git a/api/tests/unit_tests/services/test_feature_service_enable_app_deploy.py b/api/tests/unit_tests/services/test_feature_service_enable_app_deploy.py
new file mode 100644
index 00000000000..1c3b4fdbc1f
--- /dev/null
+++ b/api/tests/unit_tests/services/test_feature_service_enable_app_deploy.py
@@ -0,0 +1,37 @@
+import pytest
+
+from services import feature_service as feature_service_module
+from services.feature_service import FeatureService, SystemFeatureModel
+
+
+@pytest.mark.parametrize(
+    ("enterprise_info", "initial", "expected"),
+    [
+        # Enterprise reports the feature on -> mirrored through.
+        ({"EnableAppDeploy": True}, False, True),
+        # Enterprise may turn it off; the read runs after the hardcoded default
+        # and overrides it (forward-compat with a future entitlement gate).
+        ({"EnableAppDeploy": False}, True, False),
+        # Old enterprise without the key -> the existing value is left untouched.
+        ({}, True, True),
+    ],
+    ids=["enabled", "override_off", "missing_keeps_default"],
+)
+def test_fulfill_params_from_enterprise_enable_app_deploy(
+    monkeypatch: pytest.MonkeyPatch,
+    enterprise_info: dict,
+    initial: bool,
+    expected: bool,
+):
+    monkeypatch.setattr(
+        feature_service_module.EnterpriseService,
+        "get_info",
+        staticmethod(lambda: enterprise_info),
+    )
+
+    features = SystemFeatureModel()
+    features.enable_app_deploy = initial
+
+    FeatureService._fulfill_params_from_enterprise(features)
+
+    assert features.enable_app_deploy is expected
diff --git a/api/tests/unit_tests/services/test_file_service.py b/api/tests/unit_tests/services/test_file_service.py
index 2e6ca7dbb9c..b81fb823949 100644
--- a/api/tests/unit_tests/services/test_file_service.py
+++ b/api/tests/unit_tests/services/test_file_service.py
@@ -375,19 +375,19 @@ class TestFileService:
         file_service.delete_file("file_id")
         # Should return without doing anything
 
-    @patch("services.file_service.db")
-    def test_get_upload_files_by_ids_empty(self, mock_db):
-        result = FileService.get_upload_files_by_ids("tenant_id", [])
+    def test_get_upload_files_by_ids_empty(self):
+        session = MagicMock()
+        result = FileService.get_upload_files_by_ids(session, "tenant_id", [])
         assert result == {}
 
-    @patch("services.file_service.db")
-    def test_get_upload_files_by_ids(self, mock_db):
+    def test_get_upload_files_by_ids(self):
         upload_file = MagicMock(spec=UploadFile)
         upload_file.id = "550e8400-e29b-41d4-a716-446655440000"
         upload_file.tenant_id = "tenant_id"
-        mock_db.session.scalars().all.return_value = [upload_file]
+        session = MagicMock()
+        session.scalars().all.return_value = [upload_file]
 
-        result = FileService.get_upload_files_by_ids("tenant_id", ["550e8400-e29b-41d4-a716-446655440000"])
+        result = FileService.get_upload_files_by_ids(session, "tenant_id", ["550e8400-e29b-41d4-a716-446655440000"])
         assert result["550e8400-e29b-41d4-a716-446655440000"] == upload_file
 
     def test_sanitize_zip_entry_name(self):
diff --git a/api/tests/unit_tests/services/test_hit_testing_service_dump_records.py b/api/tests/unit_tests/services/test_hit_testing_service_dump_records.py
deleted file mode 100644
index fa0a6552042..00000000000
--- a/api/tests/unit_tests/services/test_hit_testing_service_dump_records.py
+++ /dev/null
@@ -1,100 +0,0 @@
-from datetime import datetime
-from unittest.mock import Mock, patch
-
-from services.hit_testing_service import HitTestingService
-
-
-def _retrieval_record(payload: dict):
-    record = Mock()
-    record.model_dump.return_value = payload
-    segment = payload.get("segment")
-    if isinstance(segment, dict):
-        record.segment = Mock()
-        record.segment.id = segment.get("id")
-        record.segment.document_id = segment.get("document_id")
-        record.segment.created_at = datetime(2024, 1, 1, 0, 0, 0)
-    else:
-        record.segment = None
-    return record
-
-
-def _dataset_document(
-    document_id: str = "document-1",
-    name: str = "guide.md",
-    data_source_type: str = "upload_file",
-    doc_type: str | None = None,
-    doc_metadata: dict | None = None,
-):
-    document = Mock()
-    document.id = document_id
-    document.name = name
-    document.data_source_type = data_source_type
-    document.doc_type = doc_type
-    document.doc_metadata = doc_metadata
-    return document
-
-
-class TestHitTestingServiceDumpRecords:
-    def test_dump_dataset_document_returns_frontend_required_fields(self):
-        document = _dataset_document(doc_metadata={"source": "manual"})
-
-        assert HitTestingService._dump_dataset_document(document) == {
-            "id": "document-1",
-            "data_source_type": "upload_file",
-            "name": "guide.md",
-            "doc_type": None,
-            "doc_metadata": {"source": "manual"},
-        }
-
-    def test_dump_retrieval_records_returns_dumped_records_without_document_ids(self):
-        record = _retrieval_record({"segment": {"id": "segment-1", "document_id": None}, "score": 0.95})
-        record.segment.document_id = None
-
-        assert HitTestingService._dump_retrieval_records([record]) == [
-            {"segment": {"id": "segment-1", "document_id": None}, "score": 0.95}
-        ]
-
-    def test_dump_retrieval_records_injects_documents(self):
-        record_with_document = _retrieval_record(
-            {
-                "segment": {
-                    "id": "segment-1",
-                    "document_id": "document-1",
-                },
-                "score": 0.9,
-            }
-        )
-        scalars_result = Mock()
-        scalars_result.all.return_value = [_dataset_document()]
-
-        with patch("services.hit_testing_service.db.session.scalars", return_value=scalars_result):
-            result = HitTestingService._dump_retrieval_records([record_with_document])
-
-        assert result[0]["segment"]["document"] == {
-            "id": "document-1",
-            "data_source_type": "upload_file",
-            "name": "guide.md",
-            "doc_type": None,
-            "doc_metadata": None,
-        }
-
-        assert result[0]["segment"]["created_at"] == datetime(2024, 1, 1, 0, 0, 0)
-
-    def test_dump_retrieval_records_skips_records_with_missing_documents(self, caplog):
-        record = _retrieval_record(
-            {
-                "segment": {
-                    "id": "segment-1",
-                    "document_id": "missing-document",
-                },
-                "score": 0.95,
-            }
-        )
-        scalars_result = Mock()
-        scalars_result.all.return_value = []
-
-        with patch("services.hit_testing_service.db.session.scalars", return_value=scalars_result):
-            result = HitTestingService._dump_retrieval_records([record])
-
-        assert result == []
-        assert "Skipping hit-testing records with missing documents" in caplog.text
diff --git a/api/tests/unit_tests/services/test_human_input_file_upload_service.py b/api/tests/unit_tests/services/test_human_input_file_upload_service.py
index c39453557cd..08e0ad139c8 100644
--- a/api/tests/unit_tests/services/test_human_input_file_upload_service.py
+++ b/api/tests/unit_tests/services/test_human_input_file_upload_service.py
@@ -15,7 +15,7 @@ from graphon.nodes.human_input.enums import HumanInputFormKind, HumanInputFormSt
 from libs.datetime_utils import naive_utc_now
 from models.account import Account, Tenant, TenantAccountJoin
 from models.base import Base
-from models.enums import CreatorUserRole, WorkflowRunTriggeredFrom
+from models.enums import CreatorUserRole, EndUserType, WorkflowRunTriggeredFrom
 from models.human_input import (
     HumanInputForm,
     HumanInputFormRecipient,
@@ -107,7 +107,7 @@ def _create_waiting_form(
             end_user = EndUser(
                 tenant_id=tenant_id,
                 app_id=app_id,
-                type="web_app",
+                type=EndUserType.BROWSER,
                 is_anonymous=False,
                 session_id="session-1",
                 external_user_id="external-1",
@@ -210,7 +210,7 @@ def test_issue_upload_token_persists_token_without_technical_end_user(
         assert token_model.form_id == form_id
         assert token_model.recipient_id == recipient_id
         assert token_model.token == token.upload_token
-        assert session.scalar(select(EndUser).where(EndUser.type == "human-input")) is None
+        assert session.scalar(select(EndUser).limit(1)) is None
 
 
 def test_validate_upload_token_returns_account_owner_and_record_file_link(session_maker) -> None:
diff --git a/api/tests/unit_tests/services/test_human_input_service.py b/api/tests/unit_tests/services/test_human_input_service.py
index 01d918cd897..4c4abbbb8ec 100644
--- a/api/tests/unit_tests/services/test_human_input_service.py
+++ b/api/tests/unit_tests/services/test_human_input_service.py
@@ -81,7 +81,7 @@ def sample_form_record():
     )
 
 
-def test_enqueue_resume_dispatches_task_for_workflow(mocker, mock_session_factory):
+def test_enqueue_resume_dispatches_task_for_workflow(mocker: MockerFixture, mock_session_factory):
     session_factory, session = mock_session_factory
     service = HumanInputService(session_factory)
 
@@ -108,7 +108,9 @@ def test_enqueue_resume_dispatches_task_for_workflow(mocker, mock_session_factor
     assert call_kwargs["kwargs"]["payload"]["workflow_run_id"] == "workflow-run-id"
 
 
-def test_ensure_form_active_respects_global_timeout(monkeypatch, sample_form_record, mock_session_factory):
+def test_ensure_form_active_respects_global_timeout(
+    monkeypatch, sample_form_record: HumanInputFormRecord, mock_session_factory
+):
     session_factory, _ = mock_session_factory
     service = HumanInputService(session_factory)
     expired_record = dataclasses.replace(
@@ -122,7 +124,7 @@ def test_ensure_form_active_respects_global_timeout(monkeypatch, sample_form_rec
         service.ensure_form_active(Form(expired_record))
 
 
-def test_enqueue_resume_dispatches_task_for_advanced_chat(mocker, mock_session_factory):
+def test_enqueue_resume_dispatches_task_for_advanced_chat(mocker: MockerFixture, mock_session_factory):
     session_factory, session = mock_session_factory
     service = HumanInputService(session_factory)
 
@@ -149,7 +151,7 @@ def test_enqueue_resume_dispatches_task_for_advanced_chat(mocker, mock_session_f
     assert call_kwargs["kwargs"]["payload"]["workflow_run_id"] == "workflow-run-id"
 
 
-def test_enqueue_resume_skips_unsupported_app_mode(mocker, mock_session_factory):
+def test_enqueue_resume_skips_unsupported_app_mode(mocker: MockerFixture, mock_session_factory):
     session_factory, session = mock_session_factory
     service = HumanInputService(session_factory)
 
@@ -174,7 +176,9 @@ def test_enqueue_resume_skips_unsupported_app_mode(mocker, mock_session_factory)
     resume_task.apply_async.assert_not_called()
 
 
-def test_get_form_definition_by_token_for_console_uses_repository(sample_form_record, mock_session_factory):
+def test_get_form_definition_by_token_for_console_uses_repository(
+    sample_form_record: HumanInputFormRecord, mock_session_factory
+):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     console_record = dataclasses.replace(sample_form_record, recipient_type=RecipientType.CONSOLE)
@@ -215,7 +219,9 @@ def _build_resumption_context_state(*, options: list[str], workflow_run_id: str)
     return context.dumps().encode()
 
 
-def test_resolve_form_inputs_uses_runtime_select_options(sample_form_record, mock_session_factory, mocker):
+def test_resolve_form_inputs_uses_runtime_select_options(
+    sample_form_record: HumanInputFormRecord, mock_session_factory, mocker: MockerFixture
+):
     session_factory, _ = mock_session_factory
     configured_input = SelectInputConfig(
         output_variable_name="decision",
@@ -253,7 +259,7 @@ def test_resolve_form_inputs_uses_runtime_select_options(sample_form_record, moc
 
 
 def test_submit_form_by_token_calls_repository_and_enqueue(
-    sample_form_record, mock_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, mock_session_factory, mocker: MockerFixture
 ):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
@@ -312,7 +318,7 @@ def test_submit_form_by_token_enqueues_agent_app_resume_for_conversation_form(
 
 
 def test_submit_form_by_token_skips_enqueue_for_delivery_test(
-    sample_form_record, mock_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, mock_session_factory, mocker: MockerFixture
 ):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
@@ -337,7 +343,7 @@ def test_submit_form_by_token_skips_enqueue_for_delivery_test(
 
 
 def test_submit_form_by_token_passes_submission_user_id(
-    sample_form_record, mock_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, mock_session_factory, mocker: MockerFixture
 ):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
@@ -360,7 +366,7 @@ def test_submit_form_by_token_passes_submission_user_id(
     enqueue_spy.assert_called_once_with(sample_form_record.workflow_run_id)
 
 
-def test_submit_form_by_token_invalid_action(sample_form_record, mock_session_factory):
+def test_submit_form_by_token_invalid_action(sample_form_record: HumanInputFormRecord, mock_session_factory):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = dataclasses.replace(sample_form_record)
@@ -378,7 +384,7 @@ def test_submit_form_by_token_invalid_action(sample_form_record, mock_session_fa
     repo.mark_submitted.assert_not_called()
 
 
-def test_submit_form_by_token_missing_inputs(sample_form_record, mock_session_factory):
+def test_submit_form_by_token_missing_inputs(sample_form_record: HumanInputFormRecord, mock_session_factory):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
 
@@ -522,7 +528,7 @@ def test_validate_human_input_submission_rejects_invalid_select_and_file_payload
     repo.mark_submitted.assert_not_called()
 
 
-def test_form_properties(sample_form_record):
+def test_form_properties(sample_form_record: HumanInputFormRecord):
     form = Form(sample_form_record)
     assert form.id == "form-id"
     assert form.workflow_run_id == "workflow-run-id"
@@ -559,7 +565,7 @@ def test_get_form_by_token_none(mock_session_factory):
     assert service.get_form_by_token("invalid") is None
 
 
-def test_get_form_definition_by_token_mismatch(sample_form_record, mock_session_factory):
+def test_get_form_definition_by_token_mismatch(sample_form_record: HumanInputFormRecord, mock_session_factory):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record
@@ -569,7 +575,7 @@ def test_get_form_definition_by_token_mismatch(sample_form_record, mock_session_
     assert service.get_form_definition_by_token(RecipientType.CONSOLE, "token") is None
 
 
-def test_get_form_definition_by_token_success(sample_form_record, mock_session_factory):
+def test_get_form_definition_by_token_success(sample_form_record: HumanInputFormRecord, mock_session_factory):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record
@@ -580,7 +586,9 @@ def test_get_form_definition_by_token_success(sample_form_record, mock_session_f
     assert form.id == sample_form_record.form_id
 
 
-def test_get_form_definition_by_token_for_console_mismatch(sample_form_record, mock_session_factory):
+def test_get_form_definition_by_token_for_console_mismatch(
+    sample_form_record: HumanInputFormRecord, mock_session_factory
+):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record  # is STANDALONE_WEB_APP
@@ -599,7 +607,9 @@ def test_submit_form_by_token_delivery_not_enabled(mock_session_factory):
         service.submit_form_by_token(RecipientType.STANDALONE_WEB_APP, "token", "action", {})
 
 
-def test_submit_form_by_token_no_workflow_run_id(sample_form_record, mock_session_factory, mocker: MockerFixture):
+def test_submit_form_by_token_no_workflow_run_id(
+    sample_form_record: HumanInputFormRecord, mock_session_factory, mocker: MockerFixture
+):
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record
@@ -615,7 +625,7 @@ def test_submit_form_by_token_no_workflow_run_id(sample_form_record, mock_sessio
     enqueue_spy.assert_not_called()
 
 
-def test_ensure_form_active_errors(sample_form_record, mock_session_factory):
+def test_ensure_form_active_errors(sample_form_record: HumanInputFormRecord, mock_session_factory):
     session_factory, _ = mock_session_factory
     service = HumanInputService(session_factory)
 
@@ -637,7 +647,7 @@ def test_ensure_form_active_errors(sample_form_record, mock_session_factory):
         service.ensure_form_active(Form(expired_time_record))
 
 
-def test_ensure_not_submitted_raises(sample_form_record, mock_session_factory):
+def test_ensure_not_submitted_raises(sample_form_record: HumanInputFormRecord, mock_session_factory):
     session_factory, _ = mock_session_factory
     service = HumanInputService(session_factory)
     submitted_record = dataclasses.replace(sample_form_record, submitted_at=naive_utc_now())
@@ -646,7 +656,7 @@ def test_ensure_not_submitted_raises(sample_form_record, mock_session_factory):
         service._ensure_not_submitted(Form(submitted_record))
 
 
-def test_enqueue_resume_workflow_not_found(mocker, mock_session_factory):
+def test_enqueue_resume_workflow_not_found(mocker: MockerFixture, mock_session_factory):
     session_factory, _ = mock_session_factory
     service = HumanInputService(session_factory)
 
@@ -662,7 +672,7 @@ def test_enqueue_resume_workflow_not_found(mocker, mock_session_factory):
     assert "WorkflowRun not found" in str(excinfo.value)
 
 
-def test_enqueue_resume_app_not_found(mocker, mock_session_factory):
+def test_enqueue_resume_app_not_found(mocker: MockerFixture, mock_session_factory):
     session_factory, session = mock_session_factory
     service = HumanInputService(session_factory)
 
@@ -683,7 +693,9 @@ def test_enqueue_resume_app_not_found(mocker, mock_session_factory):
     logger_spy.error.assert_called_once()
 
 
-def test_is_globally_expired_zero_timeout(monkeypatch, sample_form_record, mock_session_factory):
+def test_is_globally_expired_zero_timeout(
+    monkeypatch: pytest.MonkeyPatch, sample_form_record: HumanInputFormRecord, mock_session_factory
+):
     session_factory, _ = mock_session_factory
     service = HumanInputService(session_factory)
 
@@ -691,7 +703,9 @@ def test_is_globally_expired_zero_timeout(monkeypatch, sample_form_record, mock_
     assert service._is_globally_expired(Form(sample_form_record)) is False
 
 
-def test_submit_form_by_token_normalizes_select_and_files(sample_form_record, mock_session_factory, mocker) -> None:
+def test_submit_form_by_token_normalizes_select_and_files(
+    sample_form_record: HumanInputFormRecord, mock_session_factory, mocker: MockerFixture
+) -> None:
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
@@ -772,7 +786,9 @@ def test_submit_form_by_token_normalizes_select_and_files(sample_form_record, mo
     enqueue_spy.assert_called_once_with(sample_form_record.workflow_run_id)
 
 
-def test_submit_form_by_token_invalid_select_value(sample_form_record, mock_session_factory) -> None:
+def test_submit_form_by_token_invalid_select_value(
+    sample_form_record: HumanInputFormRecord, mock_session_factory
+) -> None:
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
@@ -799,7 +815,9 @@ def test_submit_form_by_token_invalid_select_value(sample_form_record, mock_sess
         )
 
 
-def test_submit_form_by_token_invalid_file_list_item(sample_form_record, mock_session_factory) -> None:
+def test_submit_form_by_token_invalid_file_list_item(
+    sample_form_record: HumanInputFormRecord, mock_session_factory
+) -> None:
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
@@ -824,7 +842,9 @@ def test_submit_form_by_token_invalid_file_list_item(sample_form_record, mock_se
         )
 
 
-def test_submit_form_by_token_rejects_cross_tenant_file(sample_form_record, mock_session_factory, mocker) -> None:
+def test_submit_form_by_token_rejects_cross_tenant_file(
+    sample_form_record: HumanInputFormRecord, mock_session_factory, mocker: MockerFixture
+) -> None:
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
@@ -855,7 +875,9 @@ def test_submit_form_by_token_rejects_cross_tenant_file(sample_form_record, mock
     repo.mark_submitted.assert_not_called()
 
 
-def test_submit_form_by_token_rejects_cross_tenant_file_list(sample_form_record, mock_session_factory, mocker) -> None:
+def test_submit_form_by_token_rejects_cross_tenant_file_list(
+    sample_form_record: HumanInputFormRecord, mock_session_factory, mocker: MockerFixture
+) -> None:
     session_factory, _ = mock_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
diff --git a/api/tests/unit_tests/services/test_knowledge_retrieval_inner_service.py b/api/tests/unit_tests/services/test_knowledge_retrieval_inner_service.py
new file mode 100644
index 00000000000..287d787ad70
--- /dev/null
+++ b/api/tests/unit_tests/services/test_knowledge_retrieval_inner_service.py
@@ -0,0 +1,218 @@
+"""Unit tests for the inner knowledge retrieval service."""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from core.workflow.nodes.knowledge_retrieval.retrieval import Source, SourceMetadata
+from services.entities.knowledge_retrieval_inner import InnerKnowledgeRetrieveRequest
+from services.errors.knowledge_retrieval import (
+    InnerKnowledgeRetrieveAppNotFoundError,
+    InnerKnowledgeRetrieveAppTenantMismatchError,
+    InnerKnowledgeRetrieveDatasetNotFoundError,
+    InnerKnowledgeRetrieveDatasetTenantMismatchError,
+)
+from services.knowledge_retrieval_inner_service import InnerKnowledgeRetrievalService
+
+
+def _build_request(**overrides):
+    payload = {
+        "caller": {
+            "tenant_id": "tenant-1",
+            "user_id": "user-1",
+            "app_id": "app-1",
+            "user_from": "account",
+            "invoke_from": "workflow",
+        },
+        "dataset_ids": ["dataset-1", "dataset-2"],
+        "query": "how to reset password",
+        "retrieval": {
+            "mode": "multiple",
+            "top_k": 4,
+            "score_threshold": 0.25,
+            "reranking_mode": "reranking_model",
+            "reranking_enable": True,
+            "reranking_model": {
+                "provider": "cohere",
+                "model": "rerank-english-v3.0",
+            },
+        },
+        "metadata_filtering": {
+            "mode": "manual",
+            "conditions": {
+                "logical_operator": "and",
+                "conditions": [
+                    {
+                        "name": "category",
+                        "comparison_operator": "contains",
+                        "value": "pricing",
+                    }
+                ],
+            },
+        },
+        "attachment_ids": ["attachment-1"],
+    }
+    payload.update(overrides)
+    return InnerKnowledgeRetrieveRequest.model_validate(payload)
+
+
+def _build_source() -> Source:
+    return Source(
+        metadata=SourceMetadata(
+            dataset_id="dataset-1",
+            dataset_name="Docs",
+            document_id="document-1",
+            document_name="FAQ.md",
+            data_source_type="upload_file",
+        ),
+        title="FAQ.md",
+        files=[],
+        content="Reset your password from settings.",
+        summary=None,
+    )
+
+
+class TestInnerKnowledgeRetrievalService:
+    @patch("services.knowledge_retrieval_inner_service.DatasetRetrieval")
+    @patch("services.knowledge_retrieval_inner_service.db")
+    def test_retrieve_maps_multiple_request_and_skips_enable_api_check(self, mock_db, mock_rag_cls):
+        request = _build_request()
+        mock_app = MagicMock(id="app-1", tenant_id="tenant-1")
+        dataset_1 = MagicMock(id="dataset-1", tenant_id="tenant-1", enable_api=False)
+        dataset_2 = MagicMock(id="dataset-2", tenant_id="tenant-1", enable_api=True)
+        mock_db.session.scalar.return_value = mock_app
+        mock_db.session.scalars.return_value.all.return_value = [dataset_1, dataset_2]
+
+        rag = MagicMock()
+        rag.knowledge_retrieval.return_value = [_build_source()]
+        rag.llm_usage = {
+            "prompt_tokens": 0,
+            "completion_tokens": 0,
+            "total_tokens": 0,
+            "prompt_unit_price": "0",
+            "completion_unit_price": "0",
+            "prompt_price_unit": "0.001",
+            "completion_price_unit": "0.001",
+            "prompt_price": "0",
+            "completion_price": "0",
+            "total_price": "0",
+            "currency": "USD",
+            "latency": 0,
+        }
+        mock_rag_cls.return_value = rag
+
+        response = InnerKnowledgeRetrievalService().retrieve(request)
+
+        rag_request = rag.knowledge_retrieval.call_args.kwargs["request"]
+        assert rag_request.tenant_id == "tenant-1"
+        assert rag_request.app_id == "app-1"
+        assert rag_request.user_id == "user-1"
+        assert rag_request.dataset_ids == ["dataset-1", "dataset-2"]
+        assert rag_request.query == "how to reset password"
+        assert rag_request.retrieval_mode == "multiple"
+        assert rag_request.top_k == 4
+        assert rag_request.score_threshold == 0.25
+        assert rag_request.reranking_model == {
+            "reranking_provider_name": "cohere",
+            "reranking_model_name": "rerank-english-v3.0",
+        }
+        assert rag_request.metadata_filtering_mode == "manual"
+        assert rag_request.metadata_filtering_conditions is not None
+        metadata_conditions = rag_request.metadata_filtering_conditions.model_dump(mode="python")
+        assert metadata_conditions["logical_operator"] == "and"
+        assert metadata_conditions["conditions"] is not None
+        assert metadata_conditions["conditions"][0]["name"] == "category"
+        assert rag_request.attachment_ids == ["attachment-1"]
+        assert response.results[0].title == "FAQ.md"
+        assert response.usage.currency == "USD"
+
+    @patch("services.knowledge_retrieval_inner_service.DatasetRetrieval")
+    @patch("services.knowledge_retrieval_inner_service.db")
+    def test_retrieve_maps_single_request(self, mock_db, mock_rag_cls):
+        request = _build_request(
+            dataset_ids=["dataset-1"],
+            retrieval={
+                "mode": "single",
+                "model": {
+                    "provider": "openai",
+                    "name": "gpt-4o-mini",
+                    "mode": "chat",
+                    "completion_params": {"temperature": 0},
+                },
+            },
+            metadata_filtering={
+                "mode": "automatic",
+                "model_config": {
+                    "provider": "openai",
+                    "name": "gpt-4o-mini",
+                    "mode": "chat",
+                    "completion_params": {"temperature": 0},
+                },
+            },
+            attachment_ids=[],
+        )
+        mock_db.session.scalar.return_value = MagicMock(id="app-1", tenant_id="tenant-1")
+        mock_db.session.scalars.return_value.all.return_value = [MagicMock(id="dataset-1", tenant_id="tenant-1")]
+
+        rag = MagicMock()
+        rag.knowledge_retrieval.return_value = []
+        rag.llm_usage = {
+            "prompt_tokens": 1,
+            "completion_tokens": 2,
+            "total_tokens": 3,
+            "prompt_unit_price": "0",
+            "completion_unit_price": "0",
+            "prompt_price_unit": "0.001",
+            "completion_price_unit": "0.001",
+            "prompt_price": "0",
+            "completion_price": "0",
+            "total_price": "0",
+            "currency": "USD",
+            "latency": 1,
+        }
+        mock_rag_cls.return_value = rag
+
+        InnerKnowledgeRetrievalService().retrieve(request)
+
+        rag_request = rag.knowledge_retrieval.call_args.kwargs["request"]
+        assert rag_request.retrieval_mode == "single"
+        assert rag_request.model_provider == "openai"
+        assert rag_request.model_name == "gpt-4o-mini"
+        assert rag_request.model_mode == "chat"
+        assert rag_request.completion_params == {"temperature": 0}
+        assert rag_request.metadata_filtering_mode == "automatic"
+        assert rag_request.metadata_model_config is not None
+        assert rag_request.metadata_model_config.provider == "openai"
+
+    @patch("services.knowledge_retrieval_inner_service.db")
+    def test_retrieve_raises_when_app_missing(self, mock_db):
+        mock_db.session.scalar.return_value = None
+
+        with pytest.raises(InnerKnowledgeRetrieveAppNotFoundError):
+            InnerKnowledgeRetrievalService().retrieve(_build_request())
+
+    @patch("services.knowledge_retrieval_inner_service.db")
+    def test_retrieve_raises_when_app_belongs_to_other_tenant(self, mock_db):
+        mock_db.session.scalar.return_value = MagicMock(id="app-1", tenant_id="tenant-2")
+
+        with pytest.raises(InnerKnowledgeRetrieveAppTenantMismatchError):
+            InnerKnowledgeRetrievalService().retrieve(_build_request())
+
+    @patch("services.knowledge_retrieval_inner_service.db")
+    def test_retrieve_raises_when_dataset_missing(self, mock_db):
+        mock_db.session.scalar.return_value = MagicMock(id="app-1", tenant_id="tenant-1")
+        mock_db.session.scalars.return_value.all.return_value = [MagicMock(id="dataset-1", tenant_id="tenant-1")]
+
+        with pytest.raises(InnerKnowledgeRetrieveDatasetNotFoundError):
+            InnerKnowledgeRetrievalService().retrieve(_build_request())
+
+    @patch("services.knowledge_retrieval_inner_service.db")
+    def test_retrieve_raises_when_dataset_belongs_to_other_tenant(self, mock_db):
+        mock_db.session.scalar.return_value = MagicMock(id="app-1", tenant_id="tenant-1")
+        mock_db.session.scalars.return_value.all.return_value = [
+            MagicMock(id="dataset-1", tenant_id="tenant-1"),
+            MagicMock(id="dataset-2", tenant_id="tenant-2"),
+        ]
+
+        with pytest.raises(InnerKnowledgeRetrieveDatasetTenantMismatchError):
+            InnerKnowledgeRetrievalService().retrieve(_build_request())
diff --git a/api/tests/unit_tests/services/test_message_service.py b/api/tests/unit_tests/services/test_message_service.py
index 005dcec886e..6588c8a8de6 100644
--- a/api/tests/unit_tests/services/test_message_service.py
+++ b/api/tests/unit_tests/services/test_message_service.py
@@ -90,7 +90,7 @@ class TestMessageServicePaginationByFirstId:
         return TestMessageServiceFactory()
 
     # Test 01: No user provided
-    def test_pagination_by_first_id_no_user(self, factory):
+    def test_pagination_by_first_id_no_user(self, factory: TestMessageServiceFactory):
         """Test pagination returns empty result when no user is provided."""
         # Arrange
         app = factory.create_app_mock()
@@ -111,7 +111,7 @@ class TestMessageServicePaginationByFirstId:
         assert result.has_more is False
 
     # Test 02: No conversation_id provided
-    def test_pagination_by_first_id_no_conversation(self, factory):
+    def test_pagination_by_first_id_no_conversation(self, factory: TestMessageServiceFactory):
         """Test pagination returns empty result when no conversation_id is provided."""
         # Arrange
         app = factory.create_app_mock()
@@ -137,7 +137,7 @@ class TestMessageServicePaginationByFirstId:
     @patch("services.message_service.db")
     @patch("services.message_service.ConversationService")
     def test_pagination_by_first_id_without_first_id_desc(
-        self, mock_conversation_service, mock_db, mock_create_repo, factory
+        self, mock_conversation_service, mock_db, mock_create_repo, factory: TestMessageServiceFactory
     ):
         """Test basic pagination without first_id in descending order."""
         # Arrange
@@ -180,7 +180,7 @@ class TestMessageServicePaginationByFirstId:
     @patch("services.message_service.db")
     @patch("services.message_service.ConversationService")
     def test_pagination_by_first_id_without_first_id_asc(
-        self, mock_conversation_service, mock_db, mock_create_repo, factory
+        self, mock_conversation_service, mock_db, mock_create_repo, factory: TestMessageServiceFactory
     ):
         """Test basic pagination without first_id in ascending order."""
         # Arrange
@@ -222,7 +222,9 @@ class TestMessageServicePaginationByFirstId:
     @patch("services.message_service._create_execution_extra_content_repository")
     @patch("services.message_service.db")
     @patch("services.message_service.ConversationService")
-    def test_pagination_by_first_id_with_first_id(self, mock_conversation_service, mock_db, mock_create_repo, factory):
+    def test_pagination_by_first_id_with_first_id(
+        self, mock_conversation_service, mock_db, mock_create_repo, factory: TestMessageServiceFactory
+    ):
         """Test pagination with first_id to get messages before a specific message."""
         # Arrange
         app = factory.create_app_mock()
@@ -265,7 +267,9 @@ class TestMessageServicePaginationByFirstId:
     # Test 06: First message not found
     @patch("services.message_service.db")
     @patch("services.message_service.ConversationService")
-    def test_pagination_by_first_id_first_message_not_exists(self, mock_conversation_service, mock_db, factory):
+    def test_pagination_by_first_id_first_message_not_exists(
+        self, mock_conversation_service, mock_db, factory: TestMessageServiceFactory
+    ):
         """Test error handling when first_id doesn't exist."""
         # Arrange
         app = factory.create_app_mock()
@@ -290,7 +294,9 @@ class TestMessageServicePaginationByFirstId:
     @patch("services.message_service._create_execution_extra_content_repository")
     @patch("services.message_service.db")
     @patch("services.message_service.ConversationService")
-    def test_pagination_by_first_id_has_more_true(self, mock_conversation_service, mock_db, mock_create_repo, factory):
+    def test_pagination_by_first_id_has_more_true(
+        self, mock_conversation_service, mock_db, mock_create_repo, factory: TestMessageServiceFactory
+    ):
         """Test has_more flag is True when results exceed limit."""
         # Arrange
         app = factory.create_app_mock()
@@ -327,7 +333,9 @@ class TestMessageServicePaginationByFirstId:
     # Test 08: Empty conversation
     @patch("services.message_service.db")
     @patch("services.message_service.ConversationService")
-    def test_pagination_by_first_id_empty_conversation(self, mock_conversation_service, mock_db, factory):
+    def test_pagination_by_first_id_empty_conversation(
+        self, mock_conversation_service, mock_db, factory: TestMessageServiceFactory
+    ):
         """Test pagination with conversation that has no messages."""
         # Arrange
         app = factory.create_app_mock()
@@ -370,7 +378,7 @@ class TestMessageServicePaginationByLastId:
         return TestMessageServiceFactory()
 
     # Test 09: No user provided
-    def test_pagination_by_last_id_no_user(self, factory):
+    def test_pagination_by_last_id_no_user(self, factory: TestMessageServiceFactory):
         """Test pagination returns empty result when no user is provided."""
         # Arrange
         app = factory.create_app_mock()
@@ -391,7 +399,7 @@ class TestMessageServicePaginationByLastId:
 
     # Test 10: Basic pagination without last_id
     @patch("services.message_service.db")
-    def test_pagination_by_last_id_without_last_id(self, mock_db, factory):
+    def test_pagination_by_last_id_without_last_id(self, mock_db, factory: TestMessageServiceFactory):
         """Test basic pagination without last_id."""
         # Arrange
         app = factory.create_app_mock()
@@ -422,7 +430,7 @@ class TestMessageServicePaginationByLastId:
 
     # Test 11: Pagination with last_id
     @patch("services.message_service.db")
-    def test_pagination_by_last_id_with_last_id(self, mock_db, factory):
+    def test_pagination_by_last_id_with_last_id(self, mock_db, factory: TestMessageServiceFactory):
         """Test pagination with last_id to get messages after a specific message."""
         # Arrange
         app = factory.create_app_mock()
@@ -459,7 +467,7 @@ class TestMessageServicePaginationByLastId:
 
     # Test 12: Last message not found
     @patch("services.message_service.db")
-    def test_pagination_by_last_id_last_message_not_exists(self, mock_db, factory):
+    def test_pagination_by_last_id_last_message_not_exists(self, mock_db, factory: TestMessageServiceFactory):
         """Test error handling when last_id doesn't exist."""
         # Arrange
         app = factory.create_app_mock()
@@ -479,7 +487,9 @@ class TestMessageServicePaginationByLastId:
     # Test 13: Pagination with conversation_id filter
     @patch("services.message_service.ConversationService")
     @patch("services.message_service.db")
-    def test_pagination_by_last_id_with_conversation_filter(self, mock_db, mock_conversation_service, factory):
+    def test_pagination_by_last_id_with_conversation_filter(
+        self, mock_db, mock_conversation_service, factory: TestMessageServiceFactory
+    ):
         """Test pagination filtered by conversation_id."""
         # Arrange
         app = factory.create_app_mock()
@@ -515,7 +525,7 @@ class TestMessageServicePaginationByLastId:
 
     # Test 14: Pagination with include_ids filter
     @patch("services.message_service.db")
-    def test_pagination_by_last_id_with_include_ids(self, mock_db, factory):
+    def test_pagination_by_last_id_with_include_ids(self, mock_db, factory: TestMessageServiceFactory):
         """Test pagination filtered by include_ids."""
         # Arrange
         app = factory.create_app_mock()
@@ -545,7 +555,7 @@ class TestMessageServicePaginationByLastId:
 
     # Test 15: Has_more flag when results exceed limit
     @patch("services.message_service.db")
-    def test_pagination_by_last_id_has_more_true(self, mock_db, factory):
+    def test_pagination_by_last_id_has_more_true(self, mock_db, factory: TestMessageServiceFactory):
         """Test has_more flag is True when results exceed limit."""
         # Arrange
         app = factory.create_app_mock()
@@ -592,7 +602,7 @@ class TestMessageServiceUtilities:
 
     # Test 17: attach_message_extra_contents with messages
     @patch("services.message_service._create_execution_extra_content_repository")
-    def test_attach_message_extra_contents_with_messages(self, mock_create_repo, factory):
+    def test_attach_message_extra_contents_with_messages(self, mock_create_repo, factory: TestMessageServiceFactory):
         """Test attach_message_extra_contents correctly attaches content."""
         # Arrange
         messages = [factory.create_message_mock(message_id="msg-1"), factory.create_message_mock(message_id="msg-2")]
@@ -618,7 +628,9 @@ class TestMessageServiceUtilities:
 
     # Test 18: attach_message_extra_contents with index out of bounds
     @patch("services.message_service._create_execution_extra_content_repository")
-    def test_attach_message_extra_contents_index_out_of_bounds(self, mock_create_repo, factory):
+    def test_attach_message_extra_contents_index_out_of_bounds(
+        self, mock_create_repo, factory: TestMessageServiceFactory
+    ):
         """Test attach_message_extra_contents handles missing content lists."""
         # Arrange
         messages = [factory.create_message_mock(message_id="msg-1")]
@@ -659,7 +671,7 @@ class TestMessageServiceGetMessage:
 
     # Test 20: get_message success for EndUser
     @patch("services.message_service.db")
-    def test_get_message_end_user_success(self, mock_db, factory):
+    def test_get_message_end_user_success(self, mock_db, factory: TestMessageServiceFactory):
         """Test get_message returns message for EndUser."""
         # Arrange
         app = factory.create_app_mock()
@@ -676,7 +688,7 @@ class TestMessageServiceGetMessage:
 
     # Test 21: get_message success for Account (Admin)
     @patch("services.message_service.db")
-    def test_get_message_account_success(self, mock_db, factory):
+    def test_get_message_account_success(self, mock_db, factory: TestMessageServiceFactory):
         """Test get_message returns message for Account."""
         # Arrange
         from models import Account
@@ -696,7 +708,7 @@ class TestMessageServiceGetMessage:
 
     # Test 22: get_message not found
     @patch("services.message_service.db")
-    def test_get_message_not_found(self, mock_db, factory):
+    def test_get_message_not_found(self, mock_db, factory: TestMessageServiceFactory):
         """Test get_message raises MessageNotExistsError when not found."""
         # Arrange
         app = factory.create_app_mock()
@@ -720,7 +732,7 @@ class TestMessageServiceFeedback:
     # Test 23: create_feedback - new feedback for EndUser
     @patch("services.message_service.db")
     @patch.object(MessageService, "get_message")
-    def test_create_feedback_new_end_user(self, mock_get_message, mock_db, factory):
+    def test_create_feedback_new_end_user(self, mock_get_message, mock_db, factory: TestMessageServiceFactory):
         """Test creating new feedback for an end user."""
         # Arrange
         app = factory.create_app_mock()
@@ -748,7 +760,7 @@ class TestMessageServiceFeedback:
     # Test 24: create_feedback - update feedback for Account
     @patch("services.message_service.db")
     @patch.object(MessageService, "get_message")
-    def test_create_feedback_update_account(self, mock_get_message, mock_db, factory):
+    def test_create_feedback_update_account(self, mock_get_message, mock_db, factory: TestMessageServiceFactory):
         """Test updating existing feedback for an account."""
         # Arrange
         from models import Account, MessageFeedback
@@ -779,7 +791,7 @@ class TestMessageServiceFeedback:
     # Test 25: create_feedback - delete feedback (rating is None)
     @patch("services.message_service.db")
     @patch.object(MessageService, "get_message")
-    def test_create_feedback_delete(self, mock_get_message, mock_db, factory):
+    def test_create_feedback_delete(self, mock_get_message, mock_db, factory: TestMessageServiceFactory):
         """Test deleting feedback by passing rating=None."""
         # Arrange
         app = factory.create_app_mock()
@@ -805,7 +817,7 @@ class TestMessageServiceFeedback:
 
     # Test 26: get_all_messages_feedbacks
     @patch("services.message_service.db")
-    def test_get_all_messages_feedbacks(self, mock_db, factory):
+    def test_get_all_messages_feedbacks(self, mock_db, factory: TestMessageServiceFactory):
         """Test get_all_messages_feedbacks returns list of dicts."""
         # Arrange
         app = factory.create_app_mock()
@@ -830,7 +842,7 @@ class TestMessageServiceSuggestedQuestions:
         return TestMessageServiceFactory()
 
     # Test 27: get_suggested_questions_after_answer - user is None
-    def test_get_suggested_questions_user_none(self, factory):
+    def test_get_suggested_questions_user_none(self, factory: TestMessageServiceFactory):
         app = factory.create_app_mock()
         with pytest.raises(ValueError, match="user cannot be None"):
             MessageService.get_suggested_questions_after_answer(
@@ -856,7 +868,7 @@ class TestMessageServiceSuggestedQuestions:
         mock_config_manager,
         mock_workflow_service,
         mock_model_manager,
-        factory,
+        factory: TestMessageServiceFactory,
     ):
         """Test successful suggested questions generation in Advanced Chat mode."""
         from core.app.entities.app_invoke_entities import InvokeFrom
@@ -896,14 +908,14 @@ class TestMessageServiceSuggestedQuestions:
     @patch("services.message_service.ConversationService")
     def test_get_suggested_questions_chat_app_success(
         self,
-        mock_conversation_service,
-        mock_get_message,
-        mock_trace_manager,
-        mock_llm_gen,
-        mock_memory,
-        mock_model_manager,
-        mock_db,
-        factory,
+        mock_conversation_service: MagicMock,
+        mock_get_message: MagicMock,
+        mock_trace_manager: MagicMock,
+        mock_llm_gen: MagicMock,
+        mock_memory: MagicMock,
+        mock_model_manager: MagicMock,
+        mock_db: MagicMock,
+        factory: TestMessageServiceFactory,
     ):
         """Test successful suggested questions generation in basic Chat mode."""
         # Arrange
@@ -942,14 +954,14 @@ class TestMessageServiceSuggestedQuestions:
     @patch("services.message_service.ConversationService")
     def test_get_suggested_questions_chat_app_uses_frontend_model_and_prompt(
         self,
-        mock_conversation_service,
-        mock_get_message,
-        mock_trace_manager,
-        mock_llm_gen,
-        mock_memory,
-        mock_model_manager,
-        mock_db,
-        factory,
+        mock_conversation_service: MagicMock,
+        mock_get_message: MagicMock,
+        mock_trace_manager: MagicMock,
+        mock_llm_gen: MagicMock,
+        mock_memory: MagicMock,
+        mock_model_manager: MagicMock,
+        mock_db: MagicMock,
+        factory: TestMessageServiceFactory,
     ):
         """Test suggested question generation uses frontend configured model and prompt."""
         from core.app.entities.app_invoke_entities import InvokeFrom
@@ -1015,14 +1027,14 @@ class TestMessageServiceSuggestedQuestions:
     @patch("services.message_service.ConversationService")
     def test_get_suggested_questions_chat_app_invalid_frontend_model_fallback_to_default(
         self,
-        mock_conversation_service,
-        mock_get_message,
-        mock_trace_manager,
-        mock_llm_gen,
-        mock_memory,
-        mock_model_manager,
-        mock_db,
-        factory,
+        mock_conversation_service: MagicMock,
+        mock_get_message: MagicMock,
+        mock_trace_manager: MagicMock,
+        mock_llm_gen: MagicMock,
+        mock_memory: MagicMock,
+        mock_model_manager: MagicMock,
+        mock_db: MagicMock,
+        factory: TestMessageServiceFactory,
     ):
         """Test invalid frontend configured model falls back to tenant default model."""
         app = factory.create_app_mock(mode=AppMode.CHAT)
@@ -1066,14 +1078,14 @@ class TestMessageServiceSuggestedQuestions:
     @patch("services.message_service.ConversationService")
     def test_get_suggested_questions_chat_app_uses_compatible_override_model_config(
         self,
-        mock_conversation_service,
-        mock_get_message,
-        mock_trace_manager,
-        mock_llm_gen,
-        mock_memory,
-        mock_model_manager,
-        mock_db,
-        factory,
+        mock_conversation_service: MagicMock,
+        mock_get_message: MagicMock,
+        mock_trace_manager: MagicMock,
+        mock_llm_gen: MagicMock,
+        mock_memory: MagicMock,
+        mock_model_manager: MagicMock,
+        mock_db: MagicMock,
+        factory: TestMessageServiceFactory,
     ):
         """Test legacy override configs are normalized before suggested questions reads them."""
         app = factory.create_app_mock(mode=AppMode.CHAT)
@@ -1174,7 +1186,12 @@ class TestMessageServiceSuggestedQuestions:
     @patch.object(MessageService, "get_message")
     @patch("services.message_service.ConversationService")
     def test_get_suggested_questions_disabled_error(
-        self, mock_conversation_service, mock_get_message, mock_config_manager, mock_workflow_service, factory
+        self,
+        mock_conversation_service,
+        mock_get_message,
+        mock_config_manager,
+        mock_workflow_service,
+        factory: TestMessageServiceFactory,
     ):
         """Test SuggestedQuestionsAfterAnswerDisabledError is raised when feature is disabled."""
         # Arrange
diff --git a/api/tests/unit_tests/services/test_model_provider_service.py b/api/tests/unit_tests/services/test_model_provider_service.py
index 806be013497..a8a976f4b07 100644
--- a/api/tests/unit_tests/services/test_model_provider_service.py
+++ b/api/tests/unit_tests/services/test_model_provider_service.py
@@ -215,12 +215,13 @@ class TestModelProviderServiceDelegation:
 
         get_provider_config_mock.assert_called_once_with("tenant-1", "openai")
         provider_method = getattr(provider_configuration, provider_method_name)
-        if isinstance(provider_call_kwargs, tuple):
-            provider_method.assert_called_once_with(*provider_call_kwargs)
-        elif isinstance(provider_call_kwargs, dict):
-            provider_method.assert_called_once_with(**provider_call_kwargs)
-        else:
-            provider_method.assert_called_once_with(provider_call_kwargs)
+        match provider_call_kwargs:
+            case tuple():
+                provider_method.assert_called_once_with(*provider_call_kwargs)
+            case dict():
+                provider_method.assert_called_once_with(**provider_call_kwargs)
+            case _:
+                provider_method.assert_called_once_with(provider_call_kwargs)
         if method_name == "get_provider_credential":
             assert result == {"token": "abc"}
 
diff --git a/api/tests/unit_tests/services/test_rag_pipeline_task_proxy.py b/api/tests/unit_tests/services/test_rag_pipeline_task_proxy.py
index cfc685e4cbd..305045cb6ee 100644
--- a/api/tests/unit_tests/services/test_rag_pipeline_task_proxy.py
+++ b/api/tests/unit_tests/services/test_rag_pipeline_task_proxy.py
@@ -1,5 +1,6 @@
 import json
-from unittest.mock import Mock, patch
+import logging
+from unittest.mock import MagicMock, Mock, patch
 
 import pytest
 
@@ -129,7 +130,7 @@ class TestRagPipelineTaskProxy:
         assert proxy._rag_pipeline_invoke_entities[2].pipeline_id == "pipeline-3"
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FeatureService")
-    def test_features_property(self, mock_feature_service):
+    def test_features_property(self, mock_feature_service: MagicMock):
         """Test cached_property features."""
         # Arrange
         mock_features = RagPipelineTaskProxyTestDataFactory.create_mock_features()
@@ -148,7 +149,7 @@ class TestRagPipelineTaskProxy:
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.db")
-    def test_upload_invoke_entities(self, mock_db, mock_file_service_class):
+    def test_upload_invoke_entities(self, mock_db: MagicMock, mock_file_service_class: MagicMock):
         """Test _upload_invoke_entities method."""
         # Arrange
         proxy = RagPipelineTaskProxyTestDataFactory.create_rag_pipeline_task_proxy()
@@ -180,7 +181,9 @@ class TestRagPipelineTaskProxy:
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.db")
-    def test_upload_invoke_entities_with_multiple_entities(self, mock_db, mock_file_service_class):
+    def test_upload_invoke_entities_with_multiple_entities(
+        self, mock_db: MagicMock, mock_file_service_class: MagicMock
+    ):
         """Test _upload_invoke_entities method with multiple entities."""
         # Arrange
         entities = [
@@ -208,7 +211,7 @@ class TestRagPipelineTaskProxy:
         assert parsed_json[1]["pipeline_id"] == "pipeline-2"
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.rag_pipeline_run_task")
-    def test_send_to_direct_queue(self, mock_task):
+    def test_send_to_direct_queue(self, mock_task: MagicMock):
         """Test _send_to_direct_queue method."""
         # Arrange
         proxy = RagPipelineTaskProxyTestDataFactory.create_rag_pipeline_task_proxy()
@@ -228,7 +231,7 @@ class TestRagPipelineTaskProxy:
         )
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.rag_pipeline_run_task")
-    def test_send_to_tenant_queue_with_existing_task_key(self, mock_task):
+    def test_send_to_tenant_queue_with_existing_task_key(self, mock_task: MagicMock):
         """Test _send_to_tenant_queue when task key exists."""
         # Arrange
         proxy = RagPipelineTaskProxyTestDataFactory.create_rag_pipeline_task_proxy()
@@ -247,7 +250,7 @@ class TestRagPipelineTaskProxy:
         mock_task.delay.assert_not_called()
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.rag_pipeline_run_task")
-    def test_send_to_tenant_queue_without_task_key(self, mock_task):
+    def test_send_to_tenant_queue_without_task_key(self, mock_task: MagicMock):
         """Test _send_to_tenant_queue when no task key exists."""
         # Arrange
         proxy = RagPipelineTaskProxyTestDataFactory.create_rag_pipeline_task_proxy()
@@ -270,7 +273,7 @@ class TestRagPipelineTaskProxy:
         proxy._tenant_isolated_task_queue.push_tasks.assert_not_called()
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.rag_pipeline_run_task")
-    def test_send_to_default_tenant_queue(self, mock_task):
+    def test_send_to_default_tenant_queue(self, mock_task: MagicMock):
         """Test _send_to_default_tenant_queue method."""
         # Arrange
         proxy = RagPipelineTaskProxyTestDataFactory.create_rag_pipeline_task_proxy()
@@ -284,7 +287,7 @@ class TestRagPipelineTaskProxy:
         proxy._send_to_tenant_queue.assert_called_once_with(upload_file_id, mock_task)
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.priority_rag_pipeline_run_task")
-    def test_send_to_priority_tenant_queue(self, mock_task):
+    def test_send_to_priority_tenant_queue(self, mock_task: MagicMock):
         """Test _send_to_priority_tenant_queue method."""
         # Arrange
         proxy = RagPipelineTaskProxyTestDataFactory.create_rag_pipeline_task_proxy()
@@ -298,7 +301,7 @@ class TestRagPipelineTaskProxy:
         proxy._send_to_tenant_queue.assert_called_once_with(upload_file_id, mock_task)
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.priority_rag_pipeline_run_task")
-    def test_send_to_priority_direct_queue(self, mock_task):
+    def test_send_to_priority_direct_queue(self, mock_task: MagicMock):
         """Test _send_to_priority_direct_queue method."""
         # Arrange
         proxy = RagPipelineTaskProxyTestDataFactory.create_rag_pipeline_task_proxy()
@@ -314,7 +317,9 @@ class TestRagPipelineTaskProxy:
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FeatureService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.db")
-    def test_dispatch_with_billing_enabled_sandbox_plan(self, mock_db, mock_file_service_class, mock_feature_service):
+    def test_dispatch_with_billing_enabled_sandbox_plan(
+        self, mock_db: MagicMock, mock_file_service_class: MagicMock, mock_feature_service: MagicMock
+    ):
         """Test _dispatch method when billing is enabled with sandbox plan."""
         # Arrange
         mock_features = RagPipelineTaskProxyTestDataFactory.create_mock_features(
@@ -364,7 +369,9 @@ class TestRagPipelineTaskProxy:
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FeatureService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.db")
-    def test_dispatch_with_billing_disabled(self, mock_db, mock_file_service_class, mock_feature_service):
+    def test_dispatch_with_billing_disabled(
+        self, mock_db: MagicMock, mock_file_service_class: MagicMock, mock_feature_service: MagicMock
+    ):
         """Test _dispatch method when billing is disabled."""
         # Arrange
         mock_features = RagPipelineTaskProxyTestDataFactory.create_mock_features(billing_enabled=False)
@@ -385,7 +392,7 @@ class TestRagPipelineTaskProxy:
 
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.db")
-    def test_dispatch_with_empty_upload_file_id(self, mock_db, mock_file_service_class):
+    def test_dispatch_with_empty_upload_file_id(self, mock_db: MagicMock, mock_file_service_class: MagicMock):
         """Test _dispatch method when upload_file_id is empty."""
         # Arrange
         proxy = RagPipelineTaskProxyTestDataFactory.create_rag_pipeline_task_proxy()
@@ -403,7 +410,9 @@ class TestRagPipelineTaskProxy:
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FeatureService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.db")
-    def test_dispatch_edge_case_empty_plan(self, mock_db, mock_file_service_class, mock_feature_service):
+    def test_dispatch_edge_case_empty_plan(
+        self, mock_db: MagicMock, mock_file_service_class: MagicMock, mock_feature_service: MagicMock
+    ):
         """Test _dispatch method with empty plan string."""
         # Arrange
         mock_features = RagPipelineTaskProxyTestDataFactory.create_mock_features(billing_enabled=True, plan="")
@@ -425,7 +434,9 @@ class TestRagPipelineTaskProxy:
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FeatureService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.db")
-    def test_dispatch_edge_case_none_plan(self, mock_db, mock_file_service_class, mock_feature_service):
+    def test_dispatch_edge_case_none_plan(
+        self, mock_db: MagicMock, mock_file_service_class: MagicMock, mock_feature_service: MagicMock
+    ):
         """Test _dispatch method with None plan."""
         # Arrange
         mock_features = RagPipelineTaskProxyTestDataFactory.create_mock_features(billing_enabled=True, plan=None)
@@ -447,7 +458,9 @@ class TestRagPipelineTaskProxy:
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FeatureService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.FileService")
     @patch("services.rag_pipeline.rag_pipeline_task_proxy.db")
-    def test_delay_method(self, mock_db, mock_file_service_class, mock_feature_service):
+    def test_delay_method(
+        self, mock_db: MagicMock, mock_file_service_class: MagicMock, mock_feature_service: MagicMock
+    ):
         """Test delay method integration."""
         # Arrange
         mock_features = RagPipelineTaskProxyTestDataFactory.create_mock_features(
@@ -468,16 +481,14 @@ class TestRagPipelineTaskProxy:
         # Assert
         proxy._dispatch.assert_called_once()
 
-    @patch("services.rag_pipeline.rag_pipeline_task_proxy.logger")
-    def test_delay_method_with_empty_entities(self, mock_logger):
+    def test_delay_method_with_empty_entities(self, caplog: pytest.LogCaptureFixture):
         """Test delay method with empty rag_pipeline_invoke_entities."""
         # Arrange
         proxy = RagPipelineTaskProxy("tenant-123", "user-456", [])
 
         # Act
-        proxy.delay()
+        with caplog.at_level(logging.WARNING, logger="services.rag_pipeline.rag_pipeline_task_proxy"):
+            proxy.delay()
 
         # Assert
-        mock_logger.warning.assert_called_once_with(
-            "Received empty rag pipeline invoke entities, no tasks delivered: %s %s", "tenant-123", "user-456"
-        )
+        assert "Received empty rag pipeline invoke entities, no tasks delivered: tenant-123 user-456" in caplog.text
diff --git a/api/tests/unit_tests/services/test_snippet_dsl_service.py b/api/tests/unit_tests/services/test_snippet_dsl_service.py
index 4866c570fdf..c155d3f8330 100644
--- a/api/tests/unit_tests/services/test_snippet_dsl_service.py
+++ b/api/tests/unit_tests/services/test_snippet_dsl_service.py
@@ -73,7 +73,7 @@ def test_import_snippet_rejects_invalid_yaml_url_scheme() -> None:
     assert result.error == "Invalid URL scheme, only http and https are allowed"
 
 
-def test_import_snippet_returns_failed_when_yaml_url_fetch_fails(monkeypatch) -> None:
+def test_import_snippet_returns_failed_when_yaml_url_fetch_fails(monkeypatch: pytest.MonkeyPatch) -> None:
     service = SnippetDslService(session=SimpleNamespace())
     monkeypatch.setattr(
         "services.snippet_dsl_service.ssrf_proxy.get",
@@ -90,7 +90,7 @@ def test_import_snippet_returns_failed_when_yaml_url_fetch_fails(monkeypatch) ->
     assert result.error == "Failed to fetch YAML from URL: 404"
 
 
-def test_import_snippet_rejects_oversized_yaml_url_content(monkeypatch) -> None:
+def test_import_snippet_rejects_oversized_yaml_url_content(monkeypatch: pytest.MonkeyPatch) -> None:
     service = SnippetDslService(session=SimpleNamespace())
     monkeypatch.setattr("services.snippet_dsl_service.DSL_MAX_SIZE", 3)
     monkeypatch.setattr(
@@ -108,7 +108,7 @@ def test_import_snippet_rejects_oversized_yaml_url_content(monkeypatch) -> None:
     assert "YAML content size exceeds maximum limit" in result.error
 
 
-def test_import_snippet_returns_failed_when_yaml_url_fetch_raises(monkeypatch) -> None:
+def test_import_snippet_returns_failed_when_yaml_url_fetch_raises(monkeypatch: pytest.MonkeyPatch) -> None:
     service = SnippetDslService(session=SimpleNamespace())
     monkeypatch.setattr(
         "services.snippet_dsl_service.ssrf_proxy.get",
@@ -125,7 +125,7 @@ def test_import_snippet_returns_failed_when_yaml_url_fetch_raises(monkeypatch) -
     assert result.error == "Failed to fetch YAML from URL: network down"
 
 
-def test_import_snippet_rejects_oversized_yaml_content(monkeypatch) -> None:
+def test_import_snippet_rejects_oversized_yaml_content(monkeypatch: pytest.MonkeyPatch) -> None:
     service = SnippetDslService(session=SimpleNamespace())
     monkeypatch.setattr("services.snippet_dsl_service.DSL_MAX_SIZE", 3)
 
diff --git a/api/tests/unit_tests/services/test_snippet_service.py b/api/tests/unit_tests/services/test_snippet_service.py
index 7cbe773e419..16e1e58baae 100644
--- a/api/tests/unit_tests/services/test_snippet_service.py
+++ b/api/tests/unit_tests/services/test_snippet_service.py
@@ -94,14 +94,15 @@ def test_validate_snippet_graph_forbidden_nodes_raises_with_node_details() -> No
 
 
 def test_get_snippets_returns_empty_when_tag_filter_has_no_targets(monkeypatch: pytest.MonkeyPatch) -> None:
+    session = _SessionWithoutNameLookup()
     get_target_ids = Mock(return_value=[])
     monkeypatch.setattr("services.snippet_service.TagService.get_target_ids_by_tag_ids", get_target_ids)
     service = SnippetService.__new__(SnippetService)
 
-    result = service.get_snippets(tenant_id="tenant-1", tag_ids=["tag-1"])
+    result = service.get_snippets(tenant_id="tenant-1", session=session, tag_ids=["tag-1"])
 
     assert result == ([], 0, False)
-    get_target_ids.assert_called_once_with("snippet", "tenant-1", ["tag-1"], match_all=True)
+    get_target_ids.assert_called_once_with("snippet", "tenant-1", ["tag-1"], session, match_all=True)
 
 
 def test_get_snippets_applies_filters_and_paginates(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -124,6 +125,7 @@ def test_get_snippets_applies_filters_and_paginates(monkeypatch: pytest.MonkeyPa
 
     result, total, has_more = service.get_snippets(
         tenant_id="tenant-1",
+        session=session,
         page=2,
         limit=2,
         keyword="search",
@@ -135,7 +137,7 @@ def test_get_snippets_applies_filters_and_paginates(monkeypatch: pytest.MonkeyPa
     assert result == snippets[:2]
     assert total == 3
     assert has_more is True
-    get_target_ids.assert_called_once_with("snippet", "tenant-1", ["tag-1"], match_all=True)
+    get_target_ids.assert_called_once_with("snippet", "tenant-1", ["tag-1"], session, match_all=True)
     session.scalar.assert_called_once()
     session.scalars.assert_called_once()
 
@@ -527,7 +529,7 @@ def test_delete_snippet_removes_related_records() -> None:
     session.delete.assert_called_once_with(snippet)
 
 
-def test_delete_draft_variable_files_removes_storage_objects(monkeypatch) -> None:
+def test_delete_draft_variable_files_removes_storage_objects(monkeypatch: pytest.MonkeyPatch) -> None:
     from extensions.ext_storage import storage
 
     snippet = SimpleNamespace(id="snippet-1", tenant_id="tenant-1")
@@ -552,7 +554,7 @@ def test_delete_draft_variable_files_removes_storage_objects(monkeypatch) -> Non
     assert "workflow_draft_variable_files" in executed_sql
 
 
-def test_delete_archived_workflow_run_files_removes_prefixed_objects(monkeypatch) -> None:
+def test_delete_archived_workflow_run_files_removes_prefixed_objects(monkeypatch: pytest.MonkeyPatch) -> None:
     from configs import dify_config
 
     snippet = SimpleNamespace(id="snippet-1", tenant_id="tenant-1")
diff --git a/api/tests/unit_tests/services/test_tag_service.py b/api/tests/unit_tests/services/test_tag_service.py
index 282b32a7e55..73df7cc2673 100644
--- a/api/tests/unit_tests/services/test_tag_service.py
+++ b/api/tests/unit_tests/services/test_tag_service.py
@@ -1,6 +1,7 @@
 from types import SimpleNamespace
 
 import pytest
+from pytest_mock import MockerFixture
 from werkzeug.exceptions import NotFound
 
 from models.enums import TagType
@@ -8,19 +9,19 @@ from services.tag_service import TagBindingCreatePayload, TagBindingDeletePayloa
 
 
 @pytest.fixture
-def current_user(mocker):
+def current_user(mocker: MockerFixture):
     user = SimpleNamespace(id="user-1", current_tenant_id="tenant-1")
     mocker.patch("services.tag_service.current_user", user)
     return user
 
 
 @pytest.fixture
-def db_session(mocker):
-    mock_db = mocker.patch("services.tag_service.db")
+def db_session(mocker: MockerFixture):
+    mock_db = mocker.Mock()
     return mock_db.session
 
 
-def test_save_tag_binding_only_creates_bindings_for_valid_snippet_tags(mocker, current_user, db_session):
+def test_save_tag_binding_only_creates_bindings_for_valid_snippet_tags(mocker: MockerFixture, current_user, db_session):
     mocker.patch("services.tag_service.TagService.check_target_exists")
     db_session.scalars.return_value.all.return_value = ["tag-1"]
     db_session.scalar.return_value = None
@@ -30,7 +31,8 @@ def test_save_tag_binding_only_creates_bindings_for_valid_snippet_tags(mocker, c
             tag_ids=["tag-1", "tag-from-other-tenant"],
             target_id="snippet-1",
             type=TagType.SNIPPET,
-        )
+        ),
+        db_session,
     )
 
     db_session.add.assert_called_once()
@@ -42,7 +44,7 @@ def test_save_tag_binding_only_creates_bindings_for_valid_snippet_tags(mocker, c
     db_session.commit.assert_called_once()
 
 
-def test_delete_tag_binding_limits_deletion_to_valid_snippet_tags(mocker, current_user, db_session):
+def test_delete_tag_binding_limits_deletion_to_valid_snippet_tags(mocker: MockerFixture, current_user, db_session):
     mocker.patch("services.tag_service.TagService.check_target_exists")
     db_session.execute.return_value = SimpleNamespace(rowcount=1)
 
@@ -51,14 +53,15 @@ def test_delete_tag_binding_limits_deletion_to_valid_snippet_tags(mocker, curren
             tag_ids=["tag-1", "tag-from-other-tenant"],
             target_id="snippet-1",
             type=TagType.SNIPPET,
-        )
+        ),
+        db_session,
     )
 
     db_session.execute.assert_called_once()
     db_session.commit.assert_called_once()
 
 
-def test_delete_tag_binding_does_not_commit_when_no_rows_deleted(mocker, current_user, db_session):
+def test_delete_tag_binding_does_not_commit_when_no_rows_deleted(mocker: MockerFixture, current_user, db_session):
     mocker.patch("services.tag_service.TagService.check_target_exists")
     db_session.execute.return_value = SimpleNamespace(rowcount=0)
 
@@ -67,7 +70,8 @@ def test_delete_tag_binding_does_not_commit_when_no_rows_deleted(mocker, current
             tag_ids=["tag-1"],
             target_id="snippet-1",
             type=TagType.SNIPPET,
-        )
+        ),
+        db_session,
     )
 
     db_session.execute.assert_called_once()
@@ -75,7 +79,7 @@ def test_delete_tag_binding_does_not_commit_when_no_rows_deleted(mocker, current
 
 
 def test_get_target_ids_by_tag_ids_returns_empty_without_query_for_empty_input(db_session):
-    result = TagService.get_target_ids_by_tag_ids(TagType.SNIPPET, "tenant-1", [])
+    result = TagService.get_target_ids_by_tag_ids(TagType.SNIPPET, "tenant-1", [], db_session)
 
     assert result == []
     db_session.scalars.assert_not_called()
@@ -84,7 +88,7 @@ def test_get_target_ids_by_tag_ids_returns_empty_without_query_for_empty_input(d
 def test_check_target_exists_accepts_existing_snippet(current_user, db_session):
     db_session.scalar.return_value = SimpleNamespace(id="snippet-1")
 
-    TagService.check_target_exists("snippet", "snippet-1")
+    TagService.check_target_exists("snippet", "snippet-1", db_session)
 
     db_session.scalar.assert_called_once()
 
@@ -93,11 +97,11 @@ def test_check_target_exists_raises_when_snippet_missing(current_user, db_sessio
     db_session.scalar.return_value = None
 
     with pytest.raises(NotFound, match="Snippet not found"):
-        TagService.check_target_exists("snippet", "missing-snippet")
+        TagService.check_target_exists("snippet", "missing-snippet", db_session)
 
 
 def test_check_target_exists_raises_for_invalid_binding_type(current_user, db_session):
     with pytest.raises(NotFound, match="Invalid binding type"):
-        TagService.check_target_exists("unknown", "target-1")
+        TagService.check_target_exists("unknown", "target-1", db_session)
 
     db_session.scalar.assert_not_called()
diff --git a/api/tests/unit_tests/services/test_trigger_provider_service.py b/api/tests/unit_tests/services/test_trigger_provider_service.py
index 4da4af2d939..a47d946bab0 100644
--- a/api/tests/unit_tests/services/test_trigger_provider_service.py
+++ b/api/tests/unit_tests/services/test_trigger_provider_service.py
@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import contextlib
 import json
+import logging
 from types import SimpleNamespace
 from typing import Any
 from unittest.mock import MagicMock
@@ -252,27 +253,28 @@ def test_add_trigger_subscription_should_raise_error_when_provider_limit_reached
     mock_session: MagicMock,
     provider_id: TriggerProviderID,
     provider_controller: MagicMock,
+    caplog,
 ) -> None:
     # Arrange
     _patch_redis_lock(mocker)
     mock_session.scalar.return_value = TriggerProviderService.__MAX_TRIGGER_PROVIDER_COUNT__
     _mock_get_trigger_provider(mocker, provider_controller)
-    mock_logger = mocker.patch("services.trigger.trigger_provider_service.logger")
 
     # Act + Assert
-    with pytest.raises(ValueError, match="Maximum number of providers"):
-        TriggerProviderService.add_trigger_subscription(
-            tenant_id="tenant-1",
-            user_id="user-1",
-            name="main",
-            provider_id=provider_id,
-            endpoint_id="endpoint-1",
-            credential_type=CredentialType.API_KEY,
-            parameters={},
-            properties={},
-            credentials={},
-        )
-    mock_logger.exception.assert_called_once()
+    with caplog.at_level(logging.ERROR, logger="services.trigger.trigger_provider_service"):
+        with pytest.raises(ValueError, match="Maximum number of providers"):
+            TriggerProviderService.add_trigger_subscription(
+                tenant_id="tenant-1",
+                user_id="user-1",
+                name="main",
+                provider_id=provider_id,
+                endpoint_id="endpoint-1",
+                credential_type=CredentialType.API_KEY,
+                parameters={},
+                properties={},
+                credentials={},
+            )
+    assert sum(1 for r in caplog.records if r.levelno >= logging.ERROR) == 1
 
 
 def test_add_trigger_subscription_should_raise_error_when_name_exists(
@@ -558,6 +560,7 @@ def test_refresh_oauth_token_should_refresh_and_persist_new_credentials(
         return_value=(cred_enc, cache),
     )
     mocker.patch.object(TriggerProviderService, "get_oauth_client", return_value={"client_id": "id"})
+    mock_delete_cache = mocker.patch("services.trigger.trigger_provider_service.delete_cache_for_subscription")
     refreshed = SimpleNamespace(credentials={"access_token": "new"}, expires_at=12345)
     oauth_handler = MagicMock()
     oauth_handler.refresh_credentials.return_value = refreshed
@@ -571,7 +574,12 @@ def test_refresh_oauth_token_should_refresh_and_persist_new_credentials(
     assert subscription.credentials == {"access_token": "new"}
     assert subscription.credential_expires_at == 12345
 
-    cache.delete.assert_called_once()
+    cache.delete.assert_not_called()
+    mock_delete_cache.assert_called_once_with(
+        tenant_id="tenant-1",
+        provider_id=str(provider_id),
+        subscription_id="sub-1",
+    )
 
 
 def test_refresh_subscription_should_raise_error_when_subscription_missing(
diff --git a/api/tests/unit_tests/services/test_vector_service.py b/api/tests/unit_tests/services/test_vector_service.py
index a78a033f4d3..e6cc59144b3 100644
--- a/api/tests/unit_tests/services/test_vector_service.py
+++ b/api/tests/unit_tests/services/test_vector_service.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 from dataclasses import dataclass
 from typing import Any
 from unittest.mock import MagicMock
@@ -268,7 +269,7 @@ def test_create_segments_vector_parent_child_uses_default_embedding_model_when_p
 
 
 def test_create_segments_vector_parent_child_missing_document_logs_warning_and_continues(
-    monkeypatch: pytest.MonkeyPatch,
+    monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
 ) -> None:
     dataset = _make_dataset(doc_form=vector_service_module.IndexStructureType.PARENT_CHILD_INDEX)
     segment = _make_segment()
@@ -280,18 +281,16 @@ def test_create_segments_vector_parent_child_missing_document_logs_warning_and_c
         _mock_parent_child_queries(dataset_document=None, processing_rule=processing_rule),
     )
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(vector_service_module, "logger", logger_mock)
-
     index_processor = MagicMock()
     factory_instance = MagicMock()
     factory_instance.init_index_processor.return_value = index_processor
     monkeypatch.setattr(vector_service_module, "IndexProcessorFactory", MagicMock(return_value=factory_instance))
 
-    VectorService.create_segments_vector(
-        None, [segment], dataset, vector_service_module.IndexStructureType.PARENT_CHILD_INDEX
-    )
-    logger_mock.warning.assert_called_once()
+    with caplog.at_level(logging.WARNING, logger="services.vector_service"):
+        VectorService.create_segments_vector(
+            None, [segment], dataset, vector_service_module.IndexStructureType.PARENT_CHILD_INDEX
+        )
+    assert "Expected DatasetDocument record to exist, but none was found" in caplog.text
     index_processor.load.assert_not_called()
 
 
@@ -615,7 +614,7 @@ def test_update_multimodel_vector_commits_when_no_upload_files_found(monkeypatch
 
 
 def test_update_multimodel_vector_adds_bindings_and_vectors_and_skips_missing_upload_files(
-    monkeypatch: pytest.MonkeyPatch,
+    monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
 ) -> None:
     dataset = _make_dataset(indexing_technique=IndexTechniqueType.HIGH_QUALITY, is_multimodal=True)
     segment = _make_segment(segment_id="seg-1", tenant_id="tenant-1", attachments=[{"id": "old-1"}])
@@ -630,12 +629,10 @@ def test_update_multimodel_vector_adds_bindings_and_vectors_and_skips_missing_up
     monkeypatch.setattr(vector_service_module, "delete", MagicMock())
     monkeypatch.setattr(vector_service_module, "select", MagicMock())
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(vector_service_module, "logger", logger_mock)
+    with caplog.at_level(logging.WARNING, logger="services.vector_service"):
+        VectorService.update_multimodel_vector(segment=segment, attachment_ids=["file-1", "missing"], dataset=dataset)
 
-    VectorService.update_multimodel_vector(segment=segment, attachment_ids=["file-1", "missing"], dataset=dataset)
-
-    logger_mock.warning.assert_called_once()
+    assert "Upload file not found for attachment_id" in caplog.text
     db_mock.session.add_all.assert_called_once()
     bindings = db_mock.session.add_all.call_args.args[0]
     assert len(bindings) == 1
@@ -673,7 +670,9 @@ def test_update_multimodel_vector_updates_bindings_without_multimodal_vector_ops
     db_mock.session.commit.assert_called_once()
 
 
-def test_update_multimodel_vector_rolls_back_and_reraises_on_error(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_update_multimodel_vector_rolls_back_and_reraises_on_error(
+    monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+) -> None:
     dataset = _make_dataset(indexing_technique=IndexTechniqueType.HIGH_QUALITY, is_multimodal=True)
     segment = _make_segment(segment_id="seg-1", tenant_id="tenant-1", attachments=[{"id": "old-1"}])
 
@@ -688,11 +687,11 @@ def test_update_multimodel_vector_rolls_back_and_reraises_on_error(monkeypatch:
     monkeypatch.setattr(vector_service_module, "delete", MagicMock())
     monkeypatch.setattr(vector_service_module, "select", MagicMock())
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(vector_service_module, "logger", logger_mock)
+    with caplog.at_level(logging.ERROR, logger="services.vector_service"):
+        with pytest.raises(RuntimeError, match="boom"):
+            VectorService.update_multimodel_vector(segment=segment, attachment_ids=["file-1"], dataset=dataset)
 
-    with pytest.raises(RuntimeError, match="boom"):
-        VectorService.update_multimodel_vector(segment=segment, attachment_ids=["file-1"], dataset=dataset)
-
-    logger_mock.exception.assert_called_once()
+    exception_records = [r for r in caplog.records if r.levelname == "ERROR"]
+    assert len(exception_records) == 1
+    assert "Failed to update multimodal vector for segment" in exception_records[0].getMessage()
     db_mock.session.rollback.assert_called_once()
diff --git a/api/tests/unit_tests/services/test_workflow_generator_service.py b/api/tests/unit_tests/services/test_workflow_generator_service.py
index e1d3a488be3..184cd5f29e5 100644
--- a/api/tests/unit_tests/services/test_workflow_generator_service.py
+++ b/api/tests/unit_tests/services/test_workflow_generator_service.py
@@ -30,10 +30,10 @@ class TestWorkflowGeneratorService:
     @patch("services.workflow_generator_service.format_tool_catalogue")
     def test_forwards_model_instance_and_catalogue_text_to_generator(
         self,
-        mock_format_catalogue,
-        mock_build_catalogue,
-        mock_model_manager,
-        mock_workflow_generator,
+        mock_format_catalogue: MagicMock,
+        mock_build_catalogue: MagicMock,
+        mock_model_manager: MagicMock,
+        mock_workflow_generator: MagicMock,
     ):
         """Happy path: model_instance + catalogue text + payload flow through."""
         # Arrange
@@ -110,10 +110,10 @@ class TestWorkflowGeneratorService:
     @patch("services.workflow_generator_service.format_tool_catalogue")
     def test_defaults_ideal_output_to_empty_string(
         self,
-        mock_format_catalogue,
-        mock_build_catalogue,
-        mock_model_manager,
-        mock_workflow_generator,
+        mock_format_catalogue: MagicMock,
+        mock_build_catalogue: MagicMock,
+        mock_model_manager: MagicMock,
+        mock_workflow_generator: MagicMock,
     ):
         """Callers can omit ideal_output; the runner should still receive ""."""
         mock_model_manager.for_tenant.return_value.get_model_instance.return_value = MagicMock()
@@ -142,10 +142,10 @@ class TestWorkflowGeneratorService:
     @patch("services.workflow_generator_service.format_tool_catalogue")
     def test_forwards_current_graph_for_refine(
         self,
-        mock_format_catalogue,
-        mock_build_catalogue,
-        mock_model_manager,
-        mock_workflow_generator,
+        mock_format_catalogue: MagicMock,
+        mock_build_catalogue: MagicMock,
+        mock_model_manager: MagicMock,
+        mock_workflow_generator: MagicMock,
     ):
         """The cmd+k `/refine` path passes the existing draft graph through to the runner."""
         mock_model_manager.for_tenant.return_value.get_model_instance.return_value = MagicMock()
@@ -175,10 +175,10 @@ class TestWorkflowGeneratorService:
     @patch("services.workflow_generator_service.format_tool_catalogue")
     def test_defaults_current_graph_to_none_for_create(
         self,
-        mock_format_catalogue,
-        mock_build_catalogue,
-        mock_model_manager,
-        mock_workflow_generator,
+        mock_format_catalogue: MagicMock,
+        mock_build_catalogue: MagicMock,
+        mock_model_manager: MagicMock,
+        mock_workflow_generator: MagicMock,
     ):
         """Omitting current_graph (the `/create` path) forwards None to the runner."""
         mock_model_manager.for_tenant.return_value.get_model_instance.return_value = MagicMock()
diff --git a/api/tests/unit_tests/tasks/test_enterprise_telemetry_task.py b/api/tests/unit_tests/tasks/test_enterprise_telemetry_task.py
index b48c69a146b..02131445eb6 100644
--- a/api/tests/unit_tests/tasks/test_enterprise_telemetry_task.py
+++ b/api/tests/unit_tests/tasks/test_enterprise_telemetry_task.py
@@ -35,7 +35,7 @@ def test_process_enterprise_telemetry_success(sample_envelope_json):
         assert call_args.event_id == "test-event-123"
 
 
-def test_process_enterprise_telemetry_invalid_json(caplog):
+def test_process_enterprise_telemetry_invalid_json(caplog: pytest.LogCaptureFixture):
     invalid_json = "not valid json"
 
     process_enterprise_telemetry(invalid_json)
@@ -43,7 +43,7 @@ def test_process_enterprise_telemetry_invalid_json(caplog):
     assert "Failed to process enterprise telemetry envelope" in caplog.text
 
 
-def test_process_enterprise_telemetry_handler_exception(sample_envelope_json, caplog):
+def test_process_enterprise_telemetry_handler_exception(sample_envelope_json, caplog: pytest.LogCaptureFixture):
     with patch("tasks.enterprise_telemetry_task.EnterpriseMetricHandler") as mock_handler_class:
         mock_handler = MagicMock()
         mock_handler.handle.side_effect = Exception("Handler error")
@@ -54,7 +54,7 @@ def test_process_enterprise_telemetry_handler_exception(sample_envelope_json, ca
         assert "Failed to process enterprise telemetry envelope" in caplog.text
 
 
-def test_process_enterprise_telemetry_validation_error(caplog):
+def test_process_enterprise_telemetry_validation_error(caplog: pytest.LogCaptureFixture):
     invalid_envelope = json.dumps(
         {
             "case": "INVALID_CASE",
diff --git a/api/tests/unit_tests/tasks/test_mail_send_task.py b/api/tests/unit_tests/tasks/test_mail_send_task.py
index 2b14deaf6df..a7af192d3a7 100644
--- a/api/tests/unit_tests/tasks/test_mail_send_task.py
+++ b/api/tests/unit_tests/tasks/test_mail_send_task.py
@@ -372,7 +372,7 @@ class TestMailTaskRetryLogic:
 
     @patch("tasks.mail_register_task.get_email_i18n_service")
     @patch("tasks.mail_register_task.mail")
-    def test_mail_task_logs_success(self, mock_mail, mock_email_service, caplog):
+    def test_mail_task_logs_success(self, mock_mail, mock_email_service, caplog: pytest.LogCaptureFixture):
         """Test that successful mail sends are logged properly."""
         # Arrange
         mock_mail.is_inited.return_value = True
@@ -398,7 +398,7 @@ class TestMailTaskRetryLogic:
 
     @patch("tasks.mail_register_task.get_email_i18n_service")
     @patch("tasks.mail_register_task.mail")
-    def test_mail_task_logs_failure(self, mock_mail, mock_email_service, caplog):
+    def test_mail_task_logs_failure(self, mock_mail, mock_email_service, caplog: pytest.LogCaptureFixture):
         """Test that failed mail sends are logged with exception details."""
         # Arrange
         mock_mail.is_inited.return_value = True
@@ -580,7 +580,9 @@ class TestInnerEmailTask:
     @patch("tasks.mail_inner_task.get_email_i18n_service")
     @patch("tasks.mail_inner_task.mail")
     @patch("tasks.mail_inner_task._render_template_with_strategy")
-    def test_inner_email_task_logs_failure(self, mock_render, mock_mail, mock_email_service, caplog):
+    def test_inner_email_task_logs_failure(
+        self, mock_render, mock_mail, mock_email_service, caplog: pytest.LogCaptureFixture
+    ):
         """Test inner email task logs failures properly."""
         # Arrange
         mock_mail.is_inited.return_value = True
@@ -899,7 +901,9 @@ class TestPerformanceAndTiming:
     @patch("tasks.mail_register_task.get_email_i18n_service")
     @patch("tasks.mail_register_task.mail")
     @patch("tasks.mail_register_task.time")
-    def test_mail_task_tracks_execution_time(self, mock_time, mock_mail, mock_email_service, caplog):
+    def test_mail_task_tracks_execution_time(
+        self, mock_time, mock_mail, mock_email_service, caplog: pytest.LogCaptureFixture
+    ):
         """Test that mail tasks track and log execution time."""
         # Arrange
         mock_mail.is_inited.return_value = True
@@ -1465,7 +1469,9 @@ class TestLoggingAndMonitoring:
 
     @patch("tasks.mail_register_task.get_email_i18n_service")
     @patch("tasks.mail_register_task.mail")
-    def test_mail_task_logs_recipient_information(self, mock_mail, mock_email_service, caplog):
+    def test_mail_task_logs_recipient_information(
+        self, mock_mail, mock_email_service, caplog: pytest.LogCaptureFixture
+    ):
         """
         Test that mail tasks log recipient information for audit trails.
 
@@ -1487,7 +1493,9 @@ class TestLoggingAndMonitoring:
 
     @patch("tasks.mail_inner_task.get_email_i18n_service")
     @patch("tasks.mail_inner_task.mail")
-    def test_inner_email_task_logs_subject_for_tracking(self, mock_mail, mock_email_service, caplog):
+    def test_inner_email_task_logs_subject_for_tracking(
+        self, mock_mail, mock_email_service, caplog: pytest.LogCaptureFixture
+    ):
         """
         Test that inner email task logs subject for tracking purposes.
 
diff --git a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
index 3fb673198b3..9fc94547468 100644
--- a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
+++ b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
@@ -50,8 +50,7 @@ class TestDeleteDraftVariableOffloadData:
         assert result == 0
         mock_conn.execute.assert_not_called()
 
-    @patch("tasks.remove_app_and_related_data_task.logging")
-    def test_delete_draft_variable_offload_data_database_failure(self, mock_logging):
+    def test_delete_draft_variable_offload_data_database_failure(self, caplog: pytest.LogCaptureFixture):
         """Test handling of database operation failures."""
         mock_conn = MagicMock()
         file_ids = ["file-1"]
@@ -60,13 +59,14 @@ class TestDeleteDraftVariableOffloadData:
         mock_conn.execute.side_effect = Exception("Database error")
 
         # Execute function - should not raise, but log error
-        result = _delete_draft_variable_offload_data(mock_conn, file_ids)
+        with caplog.at_level(logging.ERROR):
+            result = _delete_draft_variable_offload_data(mock_conn, file_ids)
 
         # Should return 0 when error occurs
         assert result == 0
 
         # Verify error was logged
-        mock_logging.exception.assert_called_once_with("Error deleting draft variable offload data:")
+        assert "Error deleting draft variable offload data:" in caplog.text
 
 
 class TestDeleteWorkflowArchiveLogs:
@@ -114,7 +114,9 @@ class TestDeleteAppStars:
 
 class TestDeleteArchivedWorkflowRunFiles:
     @patch("tasks.remove_app_and_related_data_task.get_archive_storage")
-    def test_delete_archived_workflow_run_files_not_configured(self, mock_get_storage, caplog):
+    def test_delete_archived_workflow_run_files_not_configured(
+        self, mock_get_storage, caplog: pytest.LogCaptureFixture
+    ):
         mock_get_storage.side_effect = ArchiveStorageNotConfiguredError("missing config")
 
         with caplog.at_level(logging.INFO, logger="tasks.remove_app_and_related_data_task"):
@@ -123,7 +125,7 @@ class TestDeleteArchivedWorkflowRunFiles:
         assert caplog.text.count("Archive storage not configured") == 1
 
     @patch("tasks.remove_app_and_related_data_task.get_archive_storage")
-    def test_delete_archived_workflow_run_files_list_failure(self, mock_get_storage, caplog):
+    def test_delete_archived_workflow_run_files_list_failure(self, mock_get_storage, caplog: pytest.LogCaptureFixture):
         storage = MagicMock()
         storage.list_objects.side_effect = Exception("list failed")
         mock_get_storage.return_value = storage
@@ -136,7 +138,7 @@ class TestDeleteArchivedWorkflowRunFiles:
         assert "Failed to list archive files for app app-1" in caplog.text
 
     @patch("tasks.remove_app_and_related_data_task.get_archive_storage")
-    def test_delete_archived_workflow_run_files_success(self, mock_get_storage, caplog):
+    def test_delete_archived_workflow_run_files_success(self, mock_get_storage, caplog: pytest.LogCaptureFixture):
         storage = MagicMock()
         storage.list_objects.return_value = ["key-1", "key-2"]
         mock_get_storage.return_value = storage
diff --git a/api/tests/unit_tests/utils/position_helper/test_position_helper.py b/api/tests/unit_tests/utils/position_helper/test_position_helper.py
index dbd8f05098a..dc94dbdb3d0 100644
--- a/api/tests/unit_tests/utils/position_helper/test_position_helper.py
+++ b/api/tests/unit_tests/utils/position_helper/test_position_helper.py
@@ -1,3 +1,4 @@
+from pathlib import Path
 from textwrap import dedent
 
 import pytest
@@ -6,7 +7,7 @@ from core.helper.position_helper import get_position_map, is_filtered, pin_posit
 
 
 @pytest.fixture
-def prepare_example_positions_yaml(tmp_path, monkeypatch) -> str:
+def prepare_example_positions_yaml(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> str:
     monkeypatch.chdir(tmp_path)
     tmp_path.joinpath("example_positions.yaml").write_text(
         dedent(
@@ -25,7 +26,7 @@ def prepare_example_positions_yaml(tmp_path, monkeypatch) -> str:
 
 
 @pytest.fixture
-def prepare_empty_commented_positions_yaml(tmp_path, monkeypatch) -> str:
+def prepare_empty_commented_positions_yaml(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> str:
     monkeypatch.chdir(tmp_path)
     tmp_path.joinpath("example_positions_all_commented.yaml").write_text(
         dedent(
diff --git a/api/tests/unit_tests/utils/yaml/test_yaml_utils.py b/api/tests/unit_tests/utils/yaml/test_yaml_utils.py
index 9e2b0659c04..fd4e4a3664d 100644
--- a/api/tests/unit_tests/utils/yaml/test_yaml_utils.py
+++ b/api/tests/unit_tests/utils/yaml/test_yaml_utils.py
@@ -1,3 +1,4 @@
+from pathlib import Path
 from textwrap import dedent
 
 import pytest
@@ -11,7 +12,7 @@ NON_EXISTING_YAML_FILE = "non_existing_file.yaml"
 
 
 @pytest.fixture
-def prepare_example_yaml_file(tmp_path, monkeypatch) -> str:
+def prepare_example_yaml_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> str:
     monkeypatch.chdir(tmp_path)
     file_path = tmp_path.joinpath(EXAMPLE_YAML_FILE)
     file_path.write_text(
@@ -34,7 +35,7 @@ def prepare_example_yaml_file(tmp_path, monkeypatch) -> str:
 
 
 @pytest.fixture
-def prepare_invalid_yaml_file(tmp_path, monkeypatch) -> str:
+def prepare_invalid_yaml_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> str:
     monkeypatch.chdir(tmp_path)
     file_path = tmp_path.joinpath(INVALID_YAML_FILE)
     file_path.write_text(
diff --git a/api/uv.lock b/api/uv.lock
index 3445ec78321..048d991a49e 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -1293,7 +1293,7 @@ dependencies = [
 [package.metadata]
 requires-dist = [
     { name = "fastapi", marker = "extra == 'server'", specifier = "==0.136.0" },
-    { name = "graphon", marker = "extra == 'server'", specifier = "==0.5.1" },
+    { name = "graphon", marker = "extra == 'server'", specifier = "==0.5.2" },
     { name = "grpclib", extras = ["protobuf"], marker = "extra == 'grpc'", specifier = ">=0.4.9,<0.5.0" },
     { name = "httpx", specifier = "==0.28.1" },
     { name = "jsonschema", marker = "extra == 'server'", specifier = ">=4.23.0,<5.0.0" },
@@ -1636,7 +1636,7 @@ requires-dist = [
     { name = "gmpy2", specifier = ">=2.3.0,<3.0.0" },
     { name = "google-api-python-client", specifier = ">=2.196.0,<3.0.0" },
     { name = "google-cloud-aiplatform", specifier = ">=1.151.0,<2.0.0" },
-    { name = "graphon", specifier = "==0.5.1" },
+    { name = "graphon", specifier = "==0.5.2" },
     { name = "gunicorn", specifier = ">=26.0.0,<27.0.0" },
     { name = "httpx", extras = ["socks"], specifier = "==0.28.1" },
     { name = "httpx-sse", specifier = "==0.4.3" },
@@ -2987,7 +2987,7 @@ httpx = [
 
 [[package]]
 name = "graphon"
-version = "0.5.1"
+version = "0.5.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "charset-normalizer" },
@@ -3008,9 +3008,9 @@ dependencies = [
     { name = "unstructured", extra = ["docx", "epub", "md", "ppt", "pptx"] },
     { name = "webvtt-py" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a2/fa/432fa802bcb13f7f51dc323ddef92594b15333eafef181d937ffa554116e/graphon-0.5.1.tar.gz", hash = "sha256:ca38cc62ef3fbc2f3072b68235bcb41e32a6369a1753b46418c1d761c57125fe", size = 269741, upload-time = "2026-06-11T03:01:38.197Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c2/16/f183da187414c335be67f52f6a1b7c2a33bf0b1d5090eda7e6c92d42d94a/graphon-0.5.2.tar.gz", hash = "sha256:d66a9edcd883766bd50e94f84a691c92ce536ea60e721552089e83ac8e94bf68", size = 269773, upload-time = "2026-06-16T04:06:22.074Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e9/c5/61e8634b89c320af9453083213e8be436071634dbc69cb14b5fe646763e4/graphon-0.5.1-py3-none-any.whl", hash = "sha256:70b49c244a46fb6e338905210cc895bd67584d9ab1412f6ba3cd4ed284010091", size = 381866, upload-time = "2026-06-11T03:01:36.693Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/e6/36a3981cd44e7a40a7cd7d374e26f01e02dd49410c5fbbd7df248750d5fb/graphon-0.5.2-py3-none-any.whl", hash = "sha256:11f89399e67ed1ddd2ce1c336accd9c4ad5b8fe2741f9167e6085af0b325cd14", size = 381908, upload-time = "2026-06-16T04:06:20.453Z" },
 ]
 
 [[package]]
diff --git a/cli/test/e2e/suites/error-handling/error-messages.e2e.ts b/cli/test/e2e/suites/error-handling/error-messages.e2e.ts
index 30a5d213b7d..932998d9afe 100644
--- a/cli/test/e2e/suites/error-handling/error-messages.e2e.ts
+++ b/cli/test/e2e/suites/error-handling/error-messages.e2e.ts
@@ -37,6 +37,7 @@ import { afterEach, beforeEach, describe, expect, inject, it } from 'vitest'
 import { ZERO } from '@/util/uuid.js'
 import {
   assertErrorEnvelope,
+  assertExitCode,
   assertNoAnsi,
   assertNonZeroExit,
 } from '../../helpers/assert.js'
@@ -215,6 +216,147 @@ describe('E2E / error message standards (spec 5.3)', () => {
     expect(result.stderr).not.toContain(sentValue)
   })
 
+  // ── 5.70d-h  ErrorBody contract — error.server structure and rendering priorities ──
+  // PR #37285 introduces canonical ErrorBody on every /openapi/v1 non-2xx response.
+  // CLI strict-parses via zErrorBody.safeParse; success → full struct at error.server.
+  //
+  // V2 rendering priorities (format.ts, verified against codebase):
+  //   header code : server?.code ?? cliCode   — server wins, CLI fallback
+  //   hint        : cliHint ?? server?.hint   — CLI wins, server fallback (V2 correction)
+  //   details     : server?.details[]         — "  - loc: msg (type)" per entry, no -v
+
+  it('[P0] 5.70d JSON envelope contains error.server with canonical code/status/message', async () => {
+    // Trigger: describe app ZERO — server returns canonical 404 ErrorBody
+    // { code:"not_found", status:404, message:"app not found" }.
+    // zErrorBody.safeParse succeeds → error.server is populated on the current server.
+    const result = await fx.r(['describe', 'app', ZERO, '-o', 'json'])
+    assertNonZeroExit(result)
+    const envelope = JSON.parse(result.stderr.trim()) as {
+      error: { code: string, server?: { code: string, status: number, message: string } }
+    }
+    expect(envelope.error.server, 'error.server must be present when server returns canonical ErrorBody').toBeDefined()
+    expect(typeof envelope.error.server?.code, 'error.server.code must be a string').toBe('string')
+    expect(envelope.error.server?.code.length).toBeGreaterThan(0)
+    expect(typeof envelope.error.server?.status, 'error.server.status must be a number').toBe('number')
+    expect(typeof envelope.error.server?.message, 'error.server.message must be a string').toBe('string')
+    expect(envelope.error.server?.message.length).toBeGreaterThan(0)
+  })
+
+  it('[P1] 5.70e @accepts query validation returns canonical 422 with details array', async () => {
+    // Trigger: direct fetch to GET /apps?page=not-integer — @accepts(query=AppListQuery)
+    // validates page as int and emits canonical 422 ErrorBody with details[].
+    // Direct fetch is used because the CLI validates --page as integer client-side
+    // (would exit 2 before hitting the server); this pins the server-side contract.
+    const res = await fetch(
+      `${E.host.replace(/\/$/, '')}/openapi/v1/apps?workspace_id=${E.workspaceId}&page=not-an-integer`,
+      { headers: { Authorization: `Bearer ${E.token}` }, signal: AbortSignal.timeout(8_000) },
+    )
+    expect(res.status).toBe(422)
+    const body = await res.json() as {
+      code?: string
+      status?: number
+      details?: Array<{ type: string, loc: Array<string | number>, msg: string }>
+    }
+    expect(body.code).toBe('invalid_param')
+    expect(body.status).toBe(422)
+    expect(Array.isArray(body.details), 'details must be an array').toBe(true)
+    expect(body.details!.length).toBeGreaterThan(0)
+    const entry = body.details![0]!
+    expect(typeof entry.type).toBe('string')
+    expect(typeof entry.msg).toBe('string')
+    expect(Array.isArray(entry.loc)).toBe(true)
+  })
+
+  it('[P1] 5.70g rendering priority — header code: server code wins over CLI classification code', async () => {
+    // renderHuman: headerCode = server?.code ?? e.code  (server wins, V2 unchanged)
+    // When canonical ErrorBody is parsed, the server semantic code replaces the CLI
+    // classification code ("server_4xx_other") in the human-readable output header.
+    // Trigger: describe app ZERO → canonical 404; header starts with "not_found:".
+    const result = await fx.r(['describe', 'app', ZERO])
+    assertNonZeroExit(result)
+    expect(result.stderr.trimStart()).not.toMatch(/^server_4xx_other:/)
+    expect(result.stderr.trimStart()).toMatch(/^not_found:/)
+  })
+
+  it('[P1] 5.70g2 rendering priority — hint: CLI hint wins over server hint (V2 correction)', async () => {
+    // renderHuman: hint = cliHint ?? server?.hint  (CLI wins — V2 spec correction)
+    // V1 incorrectly documented "server wins"; V2 aligns with codebase: CLI wins.
+    // Test: 401 AuthExpired — classifyResponse sets c.hint = AUTH_LOGIN_HINT before
+    // serverError is parsed; CLI hint takes precedence over any server-provided hint.
+    // Verified on current server (no @accepts deployment required).
+    const unauthTmp = await withTempConfig()
+    try {
+      const result = await run(['get', 'app', '-o', 'json'], { configDir: unauthTmp.configDir })
+      assertExitCode(result, 4)
+      const envelope = JSON.parse(result.stderr.trim()) as { error: { hint?: string } }
+      expect(envelope.error.hint, 'CLI login hint must appear for auth error').toMatch(/auth login/i)
+    }
+    finally {
+      await unauthTmp.cleanup()
+    }
+  })
+
+  it('[P1] 5.70h JSON envelope: error.code = CLI classification; error.server.code = server semantic code', async () => {
+    // toEnvelope() sets error.code from HTTP status bucket (e.g. "server_4xx_other")
+    // while the server's semantic code is separate in error.server.code.
+    // Agents can branch on error.server.code without parsing human-readable text.
+    // Trigger: describe app ZERO → canonical 404; error.code="server_4xx_other",
+    // error.server.code="not_found" — always distinct when ErrorBody is present.
+    const result = await fx.r(['describe', 'app', ZERO, '-o', 'json'])
+    assertNonZeroExit(result)
+    const envelope = JSON.parse(result.stderr.trim()) as {
+      error: { code: string, server?: { code: string } }
+    }
+    expect(envelope.error.code).toBe('server_4xx_other')
+    expect(envelope.error.server?.code).toBeDefined()
+    expect(envelope.error.server?.code).not.toBe('server_4xx_other')
+  })
+  // ── 5.70i / 5.70j  PR #37285 boundary contract ───────────────────────────
+
+  it('[P1] 5.70i unknown /openapi/v1 route returns canonical 404 ErrorBody without route suggestions', async () => {
+    // PR #37285: ExternalApi._help_on_404 suppresses flask-restx route enumeration.
+    // Previously, an unknown path under /openapi/v1/ returned flask-restx's default
+    // 404 with a "Did you mean /openapi/v1/apps?" suggestion, leaking the route table.
+    // After the fix it must return a canonical ErrorBody and contain no suggestions.
+    const res = await fetch(`${E.host.replace(/\/$/, '')}/openapi/v1/this-path-does-not-exist-e2e`, {
+      headers: { Authorization: `Bearer ${E.token}` },
+      signal: AbortSignal.timeout(8_000),
+    })
+    expect(res.status).toBe(404)
+    const body = await res.json() as Record<string, unknown>
+    // canonical ErrorBody fields must be present
+    expect(typeof body.code, '404 body must have a string code field').toBe('string')
+    expect(body.status, '404 body must have status: 404').toBe(404)
+    // no flask-restx route enumeration in the response
+    const raw = JSON.stringify(body)
+    expect(raw).not.toMatch(/did you mean/i)
+    expect(raw).not.toMatch(/you might want/i)
+  })
+
+  it('[P1] 5.70j device-flow 4xx uses RFC 8628 format, not ErrorBody — zErrorBody parse fails gracefully', async () => {
+    // PR #37285 explicitly excludes RFC 8628 device-flow endpoints from the
+    // ErrorBody contract. This test pins that contract:
+    //   - The device/token endpoint returns RFC 8628 {error: string} on failure,
+    //     not the canonical {code, status, message} shape.
+    //   - When the CLI's classifyResponse encounters this, zErrorBody.safeParse
+    //     returns failure → serverError = undefined → generic status-based message,
+    //     no error.server field, no crash.
+    const res = await fetch(`${E.host.replace(/\/$/, '')}/openapi/v1/oauth/device/token`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ device_code: 'fake-invalid-device-code-e2e-test', client_id: 'difyctl' }),
+      signal: AbortSignal.timeout(8_000),
+    })
+    // device flow errors are 4xx (400 bad_request or 401 expired_token etc.)
+    expect(res.status).toBeGreaterThanOrEqual(400)
+    expect(res.status).toBeLessThan(500)
+    const body = await res.json() as Record<string, unknown>
+    // RFC 8628 shape: has 'error' string, must NOT have ErrorBody 'code'/'status' pair
+    expect(typeof body.error, 'RFC 8628 body must have a string error field').toBe('string')
+    expect(body).not.toHaveProperty('status')
+    // zErrorBody.safeParse would fail → CLI sets serverError = undefined → generic message
+  })
+
   // ── 5.76  Failed command + -o yaml → stderr is still JSON envelope ────────
 
   it('[P1] 5.76 failed command with -o yaml still outputs a JSON error envelope on stderr', async () => {
diff --git a/dify-agent/Dockerfile b/dify-agent/Dockerfile
new file mode 100644
index 00000000000..6d56811981d
--- /dev/null
+++ b/dify-agent/Dockerfile
@@ -0,0 +1,68 @@
+# Dedicated image for the standalone Dify Agent backend server.
+#
+# It is laid out to match how the service is deployed today (see the
+# agent_backend compose service): the virtualenv lives at /app/api/.venv and
+# the server is started with
+#   cd /app/api && .venv/bin/uvicorn dify_agent.server.app:app --host 0.0.0.0 --port 5050
+#
+# Unlike the dify-api image (which only installs the base `dify-agent`
+# dependency), this image installs the `[server]` extra, so jwcrypto,
+# shell-session-manager, fastapi, uvicorn, etc. are present and the server can
+# actually start. dify-api is intentionally left lean.
+
+# base image
+FROM python:3.12-slim-bookworm AS base
+
+WORKDIR /app/api
+
+# Install uv
+ENV UV_VERSION=0.8.9
+
+RUN pip install --no-cache-dir uv==${UV_VERSION}
+
+
+FROM base AS packages
+
+# The build context is the repository root (see build-push.yml), so paths are
+# repo-root relative. dify-agent ships its own uv.lock that resolves the server
+# extra, so this builds standalone without the api project.
+COPY dify-agent/pyproject.toml dify-agent/uv.lock dify-agent/README.md ./
+COPY dify-agent/src ./src
+# Trust the checked-in lock during image builds and install the server extra.
+RUN uv sync --frozen --no-dev --no-editable --extra server
+
+
+# production stage
+FROM base AS production
+
+ENV TZ=UTC
+ENV LANG=C.UTF-8
+ENV LC_ALL=C.UTF-8
+ENV PYTHONIOENCODING=utf-8
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+
+WORKDIR /app/api
+
+# Create non-root user (uid matches the dify-api image convention)
+ARG dify_uid=1001
+RUN groupadd -r -g ${dify_uid} dify && \
+    useradd -r -u ${dify_uid} -g ${dify_uid} -s /bin/bash dify
+
+# Copy the resolved virtualenv. The dify-agent package is installed
+# non-editable, so the source is already baked into site-packages.
+ENV VIRTUAL_ENV=/app/api/.venv
+COPY --from=packages --chown=dify:dify ${VIRTUAL_ENV} ${VIRTUAL_ENV}
+ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
+
+# storage is bind-mounted at runtime; pre-create it so the dify user can write.
+RUN mkdir -p /app/api/storage && chown -R dify:dify /app/api
+
+ARG COMMIT_SHA
+ENV COMMIT_SHA=${COMMIT_SHA}
+
+EXPOSE 5050
+
+USER dify
+
+CMD ["uvicorn", "dify_agent.server.app:app", "--host", "0.0.0.0", "--port", "5050"]
diff --git a/dify-agent/pyproject.toml b/dify-agent/pyproject.toml
index 915114d2338..03f2525ace7 100644
--- a/dify-agent/pyproject.toml
+++ b/dify-agent/pyproject.toml
@@ -20,7 +20,7 @@ dify-agent-stub-server = "dify_agent.agent_stub.server.cli:main"
 grpc = ["grpclib[protobuf]>=0.4.9,<0.5.0", "protobuf>=6.33.5,<7.0.0"]
 server = [
     "fastapi==0.136.0",
-    "graphon==0.5.1",
+    "graphon==0.5.2",
     "jsonschema>=4.23.0,<5.0.0",
     "jwcrypto>=1.5.6,<2",
     "pydantic-ai-slim[anthropic,google,openai]>=1.85.1,<2.0.0",
diff --git a/dify-agent/src/dify_agent/agent_stub/cli/_drive.py b/dify-agent/src/dify_agent/agent_stub/cli/_drive.py
new file mode 100644
index 00000000000..19611592c0e
--- /dev/null
+++ b/dify-agent/src/dify_agent/agent_stub/cli/_drive.py
@@ -0,0 +1,380 @@
+"""CLI helpers for sandbox-visible Agent Stub drive commands.
+
+Drive commands stay in the sandbox-facing CLI because they orchestrate existing
+control-plane and signed data-plane helpers. The Agent Stub server authenticates
+and injects trusted drive scope; this module only formats manifest output,
+downloads signed URLs into a local drive base (including safe auto-extraction of
+downloaded skill archives), and uploads local files before committing their
+ToolFile ids back into the drive.
+"""
+
+from __future__ import annotations
+
+import stat
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+from tempfile import TemporaryDirectory
+from uuid import uuid4
+from zipfile import BadZipFile, ZIP_DEFLATED, ZipFile, ZipInfo
+
+from dify_agent.agent_stub.cli._env import read_agent_stub_environment
+from dify_agent.agent_stub.cli._files import upload_tool_file_resource_from_environment
+from dify_agent.agent_stub.client._agent_stub import (
+    download_file_bytes_from_signed_url_sync,
+    request_agent_stub_drive_commit_sync,
+    request_agent_stub_drive_manifest_sync,
+)
+from dify_agent.agent_stub.client._errors import AgentStubTransferError, AgentStubValidationError
+from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitItem,
+    AgentStubDriveCommitRequest,
+    AgentStubDriveCommitResponse,
+    AgentStubDriveFileRef,
+    AgentStubDriveItem,
+    AgentStubDriveManifestResponse,
+)
+
+_SKILL_MD_FILENAME = "SKILL.md"
+_SKILL_ARCHIVE_FILENAME = ".DIFY-SKILL-FULL.zip"
+_SKIP_DIR_NAMES = frozenset(
+    {".git", "__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache", ".venv", "node_modules"}
+)
+_SKIP_FILE_NAMES = frozenset({".DS_Store", _SKILL_ARCHIVE_FILENAME})
+
+
+@dataclass(frozen=True, slots=True)
+class _DriveUploadItem:
+    """Prepared local upload paired with its destination drive key."""
+
+    local_path: Path
+    drive_key: str
+
+
+def list_drive_from_environment(prefix: str, json_output: bool) -> str | AgentStubDriveManifestResponse:
+    """List drive items through the Agent Stub using the current environment.
+
+    Args:
+        prefix: Optional drive-key prefix forwarded to the manifest request.
+        json_output: When ``True``, return the validated manifest response model.
+            When ``False``, return one human-readable tab-separated line per item
+            containing size, mime type, hash, and key.
+
+    Returns:
+        Either ``AgentStubDriveManifestResponse`` for JSON callers or a formatted
+        string for human-facing CLI output.
+
+    Side effects:
+        Calls the Agent Stub drive manifest control-plane endpoint with
+        ``include_download_url=False`` so list output does not allocate signed
+        download URLs.
+    """
+
+    environment = read_agent_stub_environment()
+    response = request_agent_stub_drive_manifest_sync(
+        url=environment.url,
+        auth_jwe=environment.auth_jwe,
+        prefix=prefix,
+        include_download_url=False,
+    )
+    if json_output:
+        return response
+    return _format_manifest(response)
+
+
+def pull_drive_from_environment(prefix: str, drive_base: str = "/mnt/drive") -> list[Path]:
+    """Pull drive files into one local drive base via signed download URLs.
+
+    Args:
+        prefix: Optional drive-key prefix forwarded to the manifest request.
+        drive_base: Local base directory that receives downloaded drive files.
+
+    Returns:
+        A list of written local paths under ``drive_base``.
+
+    Observable behavior:
+        Requests a manifest with ``include_download_url=True``, requires every
+        returned item to include ``download_url``, downloads bytes directly from
+        those signed URLs, blocks path traversal by resolving each destination
+        under the resolved drive base, writes through a temporary sibling file
+        before replacing the final path, validates byte length when the manifest
+        includes ``size``, and automatically extracts
+        ``.DIFY-SKILL-FULL.zip`` archives into their containing skill
+        directory with the same path-safety checks. Archive extraction is staged
+        under a temporary directory and only moved into place after the full
+        archive validates successfully.
+
+        The return value remains the list of downloaded paths only; extracted
+        files are materialized on disk but are not added to the returned list.
+
+    Raises:
+        AgentStubValidationError: if a manifest item omits ``download_url``, a
+            destination would escape the drive base, or a downloaded skill
+            archive contains unsafe entries such as absolute paths, traversal
+            entries, or symlink entries.
+        AgentStubTransferError: if a downloaded payload does not match declared
+            size metadata or a downloaded skill archive is corrupt / not a valid
+            zip file.
+    """
+
+    environment = read_agent_stub_environment()
+    response = request_agent_stub_drive_manifest_sync(
+        url=environment.url,
+        auth_jwe=environment.auth_jwe,
+        prefix=prefix,
+        include_download_url=True,
+    )
+    base_path = Path(drive_base).expanduser().resolve()
+    base_path.mkdir(parents=True, exist_ok=True)
+    written_paths: list[Path] = []
+    for item in response.items:
+        download_url = item.download_url
+        if not isinstance(download_url, str) or not download_url:
+            raise AgentStubValidationError(f"drive manifest item is missing download_url: {item.key}")
+        destination = _resolve_drive_destination(base_path, item.key)
+        payload = download_file_bytes_from_signed_url_sync(download_url=download_url)
+        if item.size is not None and len(payload) != item.size:
+            raise AgentStubTransferError(f"downloaded drive file size mismatch for {item.key}")
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        temp_path = destination.with_name(f"{destination.name}.tmp-{uuid4().hex}")
+        temp_path.write_bytes(payload)
+        temp_path.replace(destination)
+        written_paths.append(destination)
+        if destination.name == _SKILL_ARCHIVE_FILENAME:
+            _extract_skill_archive(destination)
+    return written_paths
+
+
+def push_drive_from_environment(local_path: str, drive_path: str, recursive: bool) -> AgentStubDriveCommitResponse:
+    """Upload local files through the Agent Stub and commit them into the drive.
+
+    Args:
+        local_path: Source file or directory in the sandbox filesystem.
+        drive_path: Destination drive key or drive-key prefix.
+        recursive: Select directory mode. ``False`` standardizes skill
+            directories, while ``True`` uploads raw directory contents.
+
+    Returns:
+        The validated drive commit response returned by the Agent Stub.
+
+    Mode split:
+        * If ``local_path`` is a file, upload that file and commit exactly one
+          ``tool_file`` binding to ``drive_path``.
+        * If ``local_path`` is a directory and ``recursive`` is ``False``,
+          require ``SKILL.md`` and standardize the upload into
+          ``<drive_path>/SKILL.md`` plus ``<drive_path>/.DIFY-SKILL-FULL.zip``.
+        * If ``local_path`` is a directory and ``recursive`` is ``True``, upload
+          each regular file under ``drive_path/<relative_path>`` without skill
+          standardization.
+
+    Observable safety behavior:
+        Rejects missing local paths, rejects recursive directory pushes with no
+        regular files, and rejects symlinked or escaping paths while preparing
+        directory uploads or skill archives.
+    """
+
+    source_path = Path(local_path).expanduser().resolve()
+    if source_path.is_file():
+        return _commit_uploaded_items([_prepare_uploaded_file(source_path, drive_path)])
+    if not source_path.is_dir():
+        raise AgentStubValidationError(f"local path not found: {source_path}")
+    if recursive:
+        upload_items = [
+            _prepare_uploaded_file(path, _join_drive_key(drive_path, relative_path))
+            for path, relative_path in _iter_regular_files(source_path)
+        ]
+        if not upload_items:
+            raise AgentStubValidationError(f"directory has no regular files: {source_path}")
+        return _commit_uploaded_items(upload_items)
+    return _push_skill_directory(source_path, drive_path)
+
+
+def _push_skill_directory(source_path: Path, drive_path: str) -> AgentStubDriveCommitResponse:
+    skill_md_path = source_path / _SKILL_MD_FILENAME
+    if not skill_md_path.is_file():
+        raise AgentStubValidationError(f"non-recursive drive push requires {_SKILL_MD_FILENAME}: {source_path}")
+    with TemporaryDirectory() as temp_dir:
+        archive_path = Path(temp_dir) / _SKILL_ARCHIVE_FILENAME
+        _build_skill_archive(source_path, archive_path)
+        return _commit_uploaded_items(
+            [
+                _prepare_uploaded_file(skill_md_path.resolve(), _join_drive_key(drive_path, _SKILL_MD_FILENAME)),
+                _prepare_uploaded_file(archive_path, _join_drive_key(drive_path, _SKILL_ARCHIVE_FILENAME)),
+            ]
+        )
+
+
+def _prepare_uploaded_file(local_path: Path, drive_key: str) -> _DriveUploadItem:
+    return _DriveUploadItem(local_path=local_path, drive_key=drive_key)
+
+
+def _commit_uploaded_items(items: list[_DriveUploadItem]) -> AgentStubDriveCommitResponse:
+    environment = read_agent_stub_environment()
+    commit_items: list[AgentStubDriveCommitItem] = []
+    for item in items:
+        uploaded_file = upload_tool_file_resource_from_environment(path=str(item.local_path))
+        commit_items.append(
+            AgentStubDriveCommitItem(
+                key=item.drive_key,
+                file_ref=AgentStubDriveFileRef(kind="tool_file", id=uploaded_file.tool_file_id),
+            )
+        )
+    return request_agent_stub_drive_commit_sync(
+        url=environment.url,
+        auth_jwe=environment.auth_jwe,
+        request=AgentStubDriveCommitRequest(items=commit_items),
+    )
+
+
+def _format_manifest(response: AgentStubDriveManifestResponse) -> str:
+    return "\n".join(_format_manifest_item(item) for item in response.items)
+
+
+def _format_manifest_item(item: AgentStubDriveItem) -> str:
+    size = str(item.size) if item.size is not None else "-"
+    mime_type = item.mime_type or "-"
+    item_hash = item.hash or "-"
+    return f"{size}\t{mime_type}\t{item_hash}\t{item.key}"
+
+
+def _resolve_drive_destination(base_path: Path, drive_key: str) -> Path:
+    destination = (base_path / Path(drive_key)).resolve()
+    try:
+        destination.relative_to(base_path)
+    except ValueError as exc:
+        raise AgentStubValidationError(f"drive key resolves outside the drive base: {drive_key}") from exc
+    return destination
+
+
+def _iter_regular_files(root_path: Path) -> list[tuple[Path, str]]:
+    """Return all regular files under one directory, rejecting unsafe symlinks."""
+
+    return _iter_regular_files_with_skip_filter(root_path, skip_filtered=False)
+
+
+def _iter_skill_archive_files(root_path: Path) -> list[tuple[Path, str]]:
+    """Return regular files for skill packaging, excluding transient content."""
+
+    return _iter_regular_files_with_skip_filter(root_path, skip_filtered=True)
+
+
+def _iter_regular_files_with_skip_filter(root_path: Path, *, skip_filtered: bool) -> list[tuple[Path, str]]:
+    root_resolved = root_path.resolve()
+    collected: list[tuple[Path, str]] = []
+    for candidate in sorted(root_path.rglob("*")):
+        if skip_filtered and _should_skip_path(candidate, root_path):
+            continue
+        if candidate.is_symlink():
+            raise AgentStubValidationError(f"drive push does not support symlinked files: {candidate}")
+        if not candidate.is_file():
+            continue
+        resolved_candidate = candidate.resolve()
+        try:
+            relative_path = resolved_candidate.relative_to(root_resolved)
+        except ValueError as exc:
+            raise AgentStubValidationError(
+                f"drive push file resolves outside the source directory: {candidate}"
+            ) from exc
+        collected.append((resolved_candidate, relative_path.as_posix()))
+    return collected
+
+
+def _should_skip_path(candidate: Path, root_path: Path) -> bool:
+    relative_path = candidate.relative_to(root_path)
+    if any(part in _SKIP_DIR_NAMES for part in relative_path.parts):
+        return True
+    return candidate.name in _SKIP_FILE_NAMES
+
+
+def _build_skill_archive(source_path: Path, archive_path: Path) -> None:
+    with ZipFile(archive_path, mode="w", compression=ZIP_DEFLATED) as archive:
+        for file_path, relative_path in _iter_skill_archive_files(source_path):
+            archive.write(file_path, arcname=relative_path)
+
+
+def _extract_skill_archive(archive_path: Path) -> None:
+    """Safely extract one downloaded skill archive into its containing directory.
+
+    Extraction is staged under a temporary directory created inside the target
+    skill directory. Every entry is validated and materialized into staging
+    first, and only after the full archive succeeds are staged files moved into
+    their final locations under the skill directory. Existing files at those
+    final locations are overwritten in place by the extracted archive content.
+
+    Error mapping is intentionally stable for CLI callers: unsafe archive entry
+    names raise ``AgentStubValidationError``, while malformed archives and zip
+    parsing / archive I/O failures are translated into ``AgentStubTransferError``.
+    """
+
+    target_dir = archive_path.parent.resolve()
+    try:
+        with TemporaryDirectory(dir=target_dir, prefix=".dify-skill-extract-") as staging_dir_name:
+            staging_dir = Path(staging_dir_name).resolve()
+            with ZipFile(archive_path) as archive:
+                for zip_info in archive.infolist():
+                    destination = _resolve_zip_entry_destination(staging_dir, zip_info.filename)
+                    if _is_zip_symlink(zip_info):
+                        raise AgentStubValidationError(
+                            f"skill archive contains unsupported symlink entry: {zip_info.filename}"
+                        )
+                    if zip_info.is_dir():
+                        destination.mkdir(parents=True, exist_ok=True)
+                        continue
+                    destination.parent.mkdir(parents=True, exist_ok=True)
+                    with archive.open(zip_info) as source_file:
+                        temp_path = destination.with_name(f"{destination.name}.tmp-{uuid4().hex}")
+                        temp_path.write_bytes(source_file.read())
+                        temp_path.replace(destination)
+            for staged_path in sorted(staging_dir.rglob("*")):
+                if staged_path.is_dir():
+                    continue
+                relative_path = staged_path.relative_to(staging_dir)
+                destination = (target_dir / relative_path).resolve()
+                destination.parent.mkdir(parents=True, exist_ok=True)
+                staged_path.replace(destination)
+    except AgentStubValidationError:
+        raise
+    except (BadZipFile, OSError) as exc:
+        raise AgentStubTransferError(f"downloaded skill archive is invalid: {archive_path.name}") from exc
+
+
+def _resolve_zip_entry_destination(target_dir: Path, entry_name: str) -> Path:
+    """Resolve one zip entry path under a target skill directory.
+
+    Zip metadata may contain POSIX or backslash-separated names, so entry names
+    are normalized to forward slashes before validation. The resolved entry must
+    not be absolute, empty, ``.`` / ``..`` based, or otherwise escape the target
+    skill directory after resolution.
+    """
+
+    normalized_name = entry_name.replace("\\", "/")
+    pure_path = PurePosixPath(normalized_name)
+    if not normalized_name or normalized_name.startswith("/") or pure_path.is_absolute():
+        raise AgentStubValidationError(f"skill archive contains unsafe absolute path: {entry_name}")
+    if any(part in {"", ".", ".."} for part in pure_path.parts):
+        raise AgentStubValidationError(f"skill archive contains unsafe path traversal entry: {entry_name}")
+    destination = (target_dir / Path(*pure_path.parts)).resolve()
+    try:
+        destination.relative_to(target_dir)
+    except ValueError as exc:
+        raise AgentStubValidationError(
+            f"skill archive entry resolves outside the skill directory: {entry_name}"
+        ) from exc
+    return destination
+
+
+def _is_zip_symlink(zip_info: ZipInfo) -> bool:
+    file_mode = zip_info.external_attr >> 16
+    return stat.S_ISLNK(file_mode)
+
+
+def _join_drive_key(base_key: str, child_key: str) -> str:
+    stripped_base = base_key.rstrip("/")
+    stripped_child = child_key.lstrip("/")
+    return f"{stripped_base}/{stripped_child}" if stripped_base else stripped_child
+
+
+__all__ = [
+    "list_drive_from_environment",
+    "pull_drive_from_environment",
+    "push_drive_from_environment",
+]
diff --git a/dify-agent/src/dify_agent/agent_stub/cli/_files.py b/dify-agent/src/dify_agent/agent_stub/cli/_files.py
index b46bc7409c2..dccc6d36c44 100644
--- a/dify-agent/src/dify_agent/agent_stub/cli/_files.py
+++ b/dify-agent/src/dify_agent/agent_stub/cli/_files.py
@@ -36,6 +36,14 @@ class DownloadedFileResult:
     path: Path
 
 
+@dataclass(frozen=True, slots=True)
+class UploadedToolFileResource:
+    """Lower-level upload result carrying both public mapping and ToolFile id."""
+
+    mapping: UploadedToolFileMapping
+    tool_file_id: str
+
+
 def upload_file_from_environment(*, path: str) -> UploadedToolFileMapping:
     """Upload one sandbox-local file through the Agent Stub control plane.
 
@@ -44,6 +52,23 @@ def upload_file_from_environment(*, path: str) -> UploadedToolFileMapping:
     canonical Agent output file mapping without synthesizing reference format.
     """
 
+    return upload_tool_file_resource_from_environment(path=path).mapping
+
+
+def upload_tool_file_resource_from_environment(*, path: str) -> UploadedToolFileResource:
+    """Upload one sandbox-local file and preserve both reference and ToolFile id.
+
+    This lower-level helper backs ``drive push``. The signed upload data-plane
+    response must include both the canonical Dify ``reference`` used by public
+    CLI output and the raw ToolFile ``id`` required by drive commit payloads.
+
+    Raises:
+        AgentStubValidationError: if ``path`` does not resolve to a local file.
+        AgentStubTransferError: if the signed upload response omits either the
+            canonical ``reference`` or the raw ToolFile ``id``, or if the
+            canonical reference is malformed.
+    """
+
     source_path = Path(path).expanduser().resolve()
     if not source_path.is_file():
         raise AgentStubValidationError(f"local file not found: {source_path}")
@@ -64,7 +89,7 @@ def upload_file_from_environment(*, path: str) -> UploadedToolFileMapping:
             file_obj=file_obj,
             mimetype=mime_type,
         )
-    return _normalize_uploaded_tool_file(payload)
+    return _normalize_uploaded_tool_file_resource(payload)
 
 
 def download_file_from_environment(
@@ -101,13 +126,19 @@ def download_file_from_environment(
     return DownloadedFileResult(path=destination)
 
 
-def _normalize_uploaded_tool_file(payload: dict[str, object]) -> UploadedToolFileMapping:
+def _normalize_uploaded_tool_file_resource(payload: dict[str, object]) -> UploadedToolFileResource:
     reference = payload.get("reference")
     if not isinstance(reference, str) or not reference:
         raise AgentStubTransferError("signed file upload response is missing reference")
     if not is_canonical_dify_file_reference(reference):
         raise AgentStubTransferError("signed file upload response has invalid canonical reference")
-    return UploadedToolFileMapping(reference=reference)
+    tool_file_id = payload.get("id")
+    if not isinstance(tool_file_id, str) or not tool_file_id:
+        raise AgentStubTransferError("signed file upload response is missing id")
+    return UploadedToolFileResource(
+        mapping=UploadedToolFileMapping(reference=reference),
+        tool_file_id=tool_file_id,
+    )
 
 
 def _deduplicate_destination_path(path: Path) -> Path:
@@ -134,6 +165,8 @@ def _sanitize_download_filename(filename: str) -> str:
 __all__ = [
     "DownloadedFileResult",
     "UploadedToolFileMapping",
+    "UploadedToolFileResource",
     "download_file_from_environment",
     "upload_file_from_environment",
+    "upload_tool_file_resource_from_environment",
 ]
diff --git a/dify-agent/src/dify_agent/agent_stub/cli/main.py b/dify-agent/src/dify_agent/agent_stub/cli/main.py
index 87bf870f7cd..466a53339e7 100644
--- a/dify-agent/src/dify_agent/agent_stub/cli/main.py
+++ b/dify-agent/src/dify_agent/agent_stub/cli/main.py
@@ -1,11 +1,11 @@
 """Typer entry point for the client-safe ``dify-agent`` console script.
 
-The CLI supports an explicit ``connect`` command and treats unknown bare
-commands as Agent Stub forwards. When the injected Agent Stub environment
-variables are missing, that path intentionally surfaces a clear missing-env
-error instead of Typer's generic unknown-command message. The module depends
-only on client-safe code so importing the console entry point does not pull in
-FastAPI, Redis, shellctl, or JWE runtime dependencies.
+The CLI supports explicit ``connect``, ``file``, and ``drive`` commands and
+treats unknown bare commands as Agent Stub forwards. When the injected Agent
+Stub environment variables are missing, that path intentionally surfaces a
+clear missing-env error instead of Typer's generic unknown-command message. The
+module depends only on client-safe code so importing the console entry point
+does not pull in FastAPI, Redis, shellctl, or JWE runtime dependencies.
 """
 
 from __future__ import annotations
@@ -16,6 +16,11 @@ import typer
 from typer.main import get_command
 
 from dify_agent.agent_stub.cli._agent_stub import connect_from_environment
+from dify_agent.agent_stub.cli._drive import (
+    list_drive_from_environment,
+    pull_drive_from_environment,
+    push_drive_from_environment,
+)
 from dify_agent.agent_stub.cli._env import MissingAgentStubEnvironmentError, has_agent_stub_environment
 from dify_agent.agent_stub.cli._files import download_file_from_environment, upload_file_from_environment
 from dify_agent.agent_stub.client._errors import AgentStubClientError
@@ -27,8 +32,10 @@ app = typer.Typer(
     no_args_is_help=True,
 )
 file_app = typer.Typer(help="Upload or download workflow files through the Agent Stub.")
+drive_app = typer.Typer(help="List, pull, or push agent drive files through the Agent Stub.")
 app.add_typer(file_app, name="file")
-_KNOWN_ROOT_COMMANDS = frozenset({"connect", "file"})
+app.add_typer(drive_app, name="drive")
+_KNOWN_ROOT_COMMANDS = frozenset({"connect", "drive", "file"})
 
 
 @app.command(context_settings={"allow_extra_args": True, "ignore_unknown_options": True})
@@ -60,6 +67,34 @@ def download(
     )
 
 
+@drive_app.command("list")
+def drive_list(
+    path_prefix: str = typer.Argument("", metavar="PATH_PREFIX"),
+    json_output: bool = typer.Option(False, "--json", help="Emit the drive manifest as JSON."),
+) -> None:
+    """List drive files visible to the current sandbox execution."""
+    _run_drive_list(path_prefix=path_prefix, json_output=json_output)
+
+
+@drive_app.command("pull")
+def drive_pull(
+    path_prefix: str = typer.Argument("", metavar="PATH_PREFIX"),
+    drive_base: str = typer.Option("/mnt/drive", "--drive-base", help="Local base directory for pulled drive files."),
+) -> None:
+    """Pull drive files into one local directory tree."""
+    _run_drive_pull(path_prefix=path_prefix, drive_base=drive_base)
+
+
+@drive_app.command("push")
+def drive_push(
+    local_path: str = typer.Argument(..., metavar="LOCAL_PATH"),
+    drive_path: str = typer.Argument(..., metavar="DRIVE_PATH"),
+    recursive: bool = typer.Option(False, "-r", "--recursive", help="Recursively upload directory contents."),
+) -> None:
+    """Upload one local file or directory into the agent drive."""
+    _run_drive_push(local_path=local_path, drive_path=drive_path, recursive=recursive)
+
+
 def main(argv: list[str] | None = None) -> None:
     """Run the ``dify-agent`` CLI with optional argv injection for tests."""
     args = list(sys.argv[1:] if argv is None else argv)
@@ -155,4 +190,46 @@ def _run_file_download(*, transfer_method: str, reference_or_url: str, directory
     typer.echo(str(response.path))
 
 
+def _run_drive_list(*, path_prefix: str, json_output: bool) -> None:
+    try:
+        response = list_drive_from_environment(prefix=path_prefix, json_output=json_output)
+    except MissingAgentStubEnvironmentError as exc:
+        typer.echo(str(exc), err=True)
+        raise SystemExit(2) from exc
+    except AgentStubClientError as exc:
+        typer.echo(str(exc), err=True)
+        raise SystemExit(1) from exc
+    if json_output:
+        if isinstance(response, str):
+            raise RuntimeError("drive list JSON output expected a manifest response")
+        typer.echo(response.model_dump_json())
+        return
+    typer.echo(response)
+
+
+def _run_drive_pull(*, path_prefix: str, drive_base: str) -> None:
+    try:
+        response = pull_drive_from_environment(prefix=path_prefix, drive_base=drive_base)
+    except MissingAgentStubEnvironmentError as exc:
+        typer.echo(str(exc), err=True)
+        raise SystemExit(2) from exc
+    except AgentStubClientError as exc:
+        typer.echo(str(exc), err=True)
+        raise SystemExit(1) from exc
+    for path in response:
+        typer.echo(str(path))
+
+
+def _run_drive_push(*, local_path: str, drive_path: str, recursive: bool) -> None:
+    try:
+        response = push_drive_from_environment(local_path=local_path, drive_path=drive_path, recursive=recursive)
+    except MissingAgentStubEnvironmentError as exc:
+        typer.echo(str(exc), err=True)
+        raise SystemExit(2) from exc
+    except AgentStubClientError as exc:
+        typer.echo(str(exc), err=True)
+        raise SystemExit(1) from exc
+    typer.echo(response.model_dump_json())
+
+
 __all__ = ["app", "main"]
diff --git a/dify-agent/src/dify_agent/agent_stub/client/_agent_stub.py b/dify-agent/src/dify_agent/agent_stub/client/_agent_stub.py
index 9c546cdbd05..34b54cabaca 100644
--- a/dify-agent/src/dify_agent/agent_stub/client/_agent_stub.py
+++ b/dify-agent/src/dify_agent/agent_stub/client/_agent_stub.py
@@ -8,12 +8,18 @@ from pydantic import JsonValue
 from dify_agent.agent_stub.client._agent_stub_http import (
     connect_agent_stub_http_sync,
     download_file_bytes_from_signed_url_sync,
+    request_agent_stub_drive_commit_http_sync,
+    request_agent_stub_drive_manifest_http_sync,
     request_agent_stub_file_download_http_sync,
     request_agent_stub_file_upload_http_sync,
     upload_file_to_signed_url_sync,
 )
 from dify_agent.agent_stub.client._errors import AgentStubValidationError
-from dify_agent.agent_stub.protocol.agent_stub import AgentStubFileMapping, parse_agent_stub_endpoint
+from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitRequest,
+    AgentStubFileMapping,
+    parse_agent_stub_endpoint,
+)
 
 
 def connect_agent_stub_sync(
@@ -106,6 +112,60 @@ def request_agent_stub_file_download_sync(
     )
 
 
+def request_agent_stub_drive_manifest_sync(
+    *,
+    url: str,
+    auth_jwe: str,
+    prefix: str,
+    include_download_url: bool,
+    timeout: float | httpx.Timeout = 30.0,
+    sync_http_client: httpx.Client | None = None,
+):
+    """Request one drive manifest through the HTTP Agent Stub transport.
+
+    Drive operations are intentionally HTTP-only in this stage. Callers must
+    provide an ``http://`` or ``https://`` Agent Stub URL; ``grpc://`` endpoints
+    raise ``AgentStubValidationError`` instead of attempting transport fallback.
+    """
+    endpoint = _parse_endpoint(url)
+    if endpoint.is_grpc:
+        raise AgentStubValidationError("Agent Stub drive operations require an HTTP Agent Stub URL")
+    return request_agent_stub_drive_manifest_http_sync(
+        base_url=endpoint.url,
+        auth_jwe=auth_jwe,
+        prefix=prefix,
+        include_download_url=include_download_url,
+        timeout=timeout,
+        sync_http_client=sync_http_client,
+    )
+
+
+def request_agent_stub_drive_commit_sync(
+    *,
+    url: str,
+    auth_jwe: str,
+    request: AgentStubDriveCommitRequest,
+    timeout: float | httpx.Timeout = 30.0,
+    sync_http_client: httpx.Client | None = None,
+):
+    """Commit one drive batch through the HTTP Agent Stub transport.
+
+    Drive operations are intentionally HTTP-only in this stage. Callers must
+    provide an ``http://`` or ``https://`` Agent Stub URL; ``grpc://`` endpoints
+    raise ``AgentStubValidationError`` instead of attempting transport fallback.
+    """
+    endpoint = _parse_endpoint(url)
+    if endpoint.is_grpc:
+        raise AgentStubValidationError("Agent Stub drive operations require an HTTP Agent Stub URL")
+    return request_agent_stub_drive_commit_http_sync(
+        base_url=endpoint.url,
+        auth_jwe=auth_jwe,
+        request=request,
+        timeout=timeout,
+        sync_http_client=sync_http_client,
+    )
+
+
 def _parse_endpoint(url: str):
     try:
         return parse_agent_stub_endpoint(url)
@@ -116,6 +176,8 @@ def _parse_endpoint(url: str):
 __all__ = [
     "connect_agent_stub_sync",
     "download_file_bytes_from_signed_url_sync",
+    "request_agent_stub_drive_commit_sync",
+    "request_agent_stub_drive_manifest_sync",
     "request_agent_stub_file_download_sync",
     "request_agent_stub_file_upload_sync",
     "upload_file_to_signed_url_sync",
diff --git a/dify-agent/src/dify_agent/agent_stub/client/_agent_stub_http.py b/dify-agent/src/dify_agent/agent_stub/client/_agent_stub_http.py
index f3ea57d3cd6..9c80e2d060d 100644
--- a/dify-agent/src/dify_agent/agent_stub/client/_agent_stub_http.py
+++ b/dify-agent/src/dify_agent/agent_stub/client/_agent_stub_http.py
@@ -24,12 +24,17 @@ from dify_agent.agent_stub.client._errors import (
 from dify_agent.agent_stub.protocol.agent_stub import (
     AgentStubConnectRequest,
     AgentStubConnectResponse,
+    AgentStubDriveCommitRequest,
+    AgentStubDriveCommitResponse,
+    AgentStubDriveManifestResponse,
     AgentStubFileDownloadRequest,
     AgentStubFileDownloadResponse,
     AgentStubFileMapping,
     AgentStubFileUploadRequest,
     AgentStubFileUploadResponse,
     agent_stub_connections_url,
+    agent_stub_drive_commit_url,
+    agent_stub_drive_manifest_url,
     agent_stub_file_download_request_url,
     agent_stub_file_upload_request_url,
 )
@@ -124,6 +129,56 @@ def request_agent_stub_file_download_http_sync(
     )
 
 
+def request_agent_stub_drive_manifest_http_sync(
+    *,
+    base_url: str,
+    auth_jwe: str,
+    prefix: str,
+    include_download_url: bool,
+    timeout: float | httpx.Timeout = 30.0,
+    sync_http_client: httpx.Client | None = None,
+) -> AgentStubDriveManifestResponse:
+    """Request one drive manifest from the HTTP Agent Stub endpoint."""
+
+    response = _get_agent_stub_json(
+        base_url=base_url,
+        auth_jwe=auth_jwe,
+        endpoint_name="drive manifest request",
+        endpoint_url_factory=agent_stub_drive_manifest_url,
+        params={
+            "prefix": prefix,
+            "include_download_url": str(include_download_url).lower(),
+        },
+        timeout=timeout,
+        sync_http_client=sync_http_client,
+    )
+    return _parse_success_response(
+        response=response, response_model=AgentStubDriveManifestResponse, label="drive manifest"
+    )
+
+
+def request_agent_stub_drive_commit_http_sync(
+    *,
+    base_url: str,
+    auth_jwe: str,
+    request: AgentStubDriveCommitRequest,
+    timeout: float | httpx.Timeout = 30.0,
+    sync_http_client: httpx.Client | None = None,
+) -> AgentStubDriveCommitResponse:
+    """Commit one drive batch through the HTTP Agent Stub endpoint."""
+
+    response = _post_agent_stub_json(
+        base_url=base_url,
+        auth_jwe=auth_jwe,
+        endpoint_name="drive commit request",
+        endpoint_url_factory=agent_stub_drive_commit_url,
+        request_body=request.model_dump_json(exclude_none=True),
+        timeout=timeout,
+        sync_http_client=sync_http_client,
+    )
+    return _parse_success_response(response=response, response_model=AgentStubDriveCommitResponse, label="drive commit")
+
+
 def upload_file_to_signed_url_sync(
     *,
     upload_url: str,
@@ -229,6 +284,38 @@ def _post_agent_stub_json(
             client.close()
 
 
+def _get_agent_stub_json(
+    *,
+    base_url: str,
+    auth_jwe: str,
+    endpoint_name: str,
+    endpoint_url_factory: Callable[[str], str],
+    params: dict[str, str],
+    timeout: float | httpx.Timeout,
+    sync_http_client: httpx.Client | None,
+) -> httpx.Response:
+    try:
+        endpoint_url = endpoint_url_factory(base_url)
+    except ValueError as exc:
+        raise AgentStubValidationError("invalid Agent Stub base URL") from exc
+    owns_client = sync_http_client is None
+    client = sync_http_client or httpx.Client(timeout=timeout, follow_redirects=True)
+    try:
+        return client.get(
+            endpoint_url,
+            params=params,
+            headers={"Authorization": f"Bearer {auth_jwe}"},
+            timeout=timeout,
+        )
+    except httpx.TimeoutException as exc:
+        raise AgentStubClientError(f"Agent Stub {endpoint_name} timed out") from exc
+    except httpx.RequestError as exc:
+        raise AgentStubClientError(f"Agent Stub {endpoint_name} request failed: {exc}") from exc
+    finally:
+        if owns_client:
+            client.close()
+
+
 def _parse_success_response[T: BaseModel](
     *,
     response: httpx.Response,
@@ -257,6 +344,8 @@ def _parse_json_payload(response: httpx.Response, *, invalid_json_message: str)
 __all__ = [
     "connect_agent_stub_http_sync",
     "download_file_bytes_from_signed_url_sync",
+    "request_agent_stub_drive_commit_http_sync",
+    "request_agent_stub_drive_manifest_http_sync",
     "request_agent_stub_file_download_http_sync",
     "request_agent_stub_file_upload_http_sync",
     "upload_file_to_signed_url_sync",
diff --git a/dify-agent/src/dify_agent/agent_stub/protocol/__init__.py b/dify-agent/src/dify_agent/agent_stub/protocol/__init__.py
index c9b4d429e14..18ea874a2a6 100644
--- a/dify-agent/src/dify_agent/agent_stub/protocol/__init__.py
+++ b/dify-agent/src/dify_agent/agent_stub/protocol/__init__.py
@@ -6,6 +6,12 @@ from .agent_stub import (
     AGENT_STUB_URL_ENV_VAR,
     AgentStubConnectRequest,
     AgentStubConnectResponse,
+    AgentStubDriveCommitItem,
+    AgentStubDriveCommitRequest,
+    AgentStubDriveCommitResponse,
+    AgentStubDriveFileRef,
+    AgentStubDriveItem,
+    AgentStubDriveManifestResponse,
     AgentStubEndpoint,
     AgentStubFileDownloadRequest,
     AgentStubFileDownloadResponse,
@@ -14,6 +20,8 @@ from .agent_stub import (
     AgentStubFileUploadResponse,
     AgentStubURLScheme,
     agent_stub_connections_url,
+    agent_stub_drive_commit_url,
+    agent_stub_drive_manifest_url,
     agent_stub_file_download_request_url,
     agent_stub_file_upload_request_url,
     is_canonical_dify_file_reference,
@@ -27,6 +35,12 @@ __all__ = [
     "AGENT_STUB_URL_ENV_VAR",
     "AgentStubConnectRequest",
     "AgentStubConnectResponse",
+    "AgentStubDriveCommitItem",
+    "AgentStubDriveCommitRequest",
+    "AgentStubDriveCommitResponse",
+    "AgentStubDriveFileRef",
+    "AgentStubDriveItem",
+    "AgentStubDriveManifestResponse",
     "AgentStubEndpoint",
     "AgentStubFileDownloadRequest",
     "AgentStubFileDownloadResponse",
@@ -35,6 +49,8 @@ __all__ = [
     "AgentStubFileUploadResponse",
     "AgentStubURLScheme",
     "agent_stub_connections_url",
+    "agent_stub_drive_commit_url",
+    "agent_stub_drive_manifest_url",
     "agent_stub_file_download_request_url",
     "agent_stub_file_upload_request_url",
     "is_canonical_dify_file_reference",
diff --git a/dify-agent/src/dify_agent/agent_stub/protocol/agent_stub.py b/dify-agent/src/dify_agent/agent_stub/protocol/agent_stub.py
index 1a98778f9e0..16d5fa79532 100644
--- a/dify-agent/src/dify_agent/agent_stub/protocol/agent_stub.py
+++ b/dify-agent/src/dify_agent/agent_stub/protocol/agent_stub.py
@@ -115,6 +115,16 @@ def agent_stub_file_download_request_url(base_url: str) -> str:
     return f"{_require_http_base_url(base_url)}/files/download-request"
 
 
+def agent_stub_drive_manifest_url(base_url: str) -> str:
+    """Return the stable HTTP drive-manifest endpoint URL for one base URL."""
+    return f"{_require_http_base_url(base_url)}/drive/manifest"
+
+
+def agent_stub_drive_commit_url(base_url: str) -> str:
+    """Return the stable HTTP drive-commit endpoint URL for one base URL."""
+    return f"{_require_http_base_url(base_url)}/drive/commit"
+
+
 def is_canonical_dify_file_reference(reference: str) -> bool:
     """Return whether one string matches Dify's opaque file reference format."""
     prefix = "dify-file-ref:"
@@ -210,6 +220,65 @@ class AgentStubFileDownloadResponse(BaseModel):
     model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
 
 
+class AgentStubDriveFileRef(BaseModel):
+    """Trusted file reference used by Agent Stub drive commit requests."""
+
+    kind: Literal["upload_file", "tool_file"]
+    id: str
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class AgentStubDriveCommitItem(BaseModel):
+    """One drive key to file binding committed through the Agent Stub."""
+
+    key: str
+    file_ref: AgentStubDriveFileRef
+    value_owned_by_drive: bool = True
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class AgentStubDriveCommitRequest(BaseModel):
+    """Request body for one Agent Stub drive commit batch."""
+
+    items: list[AgentStubDriveCommitItem]
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class AgentStubDriveItem(BaseModel):
+    """One manifest or commit item returned by the Agent Stub drive API."""
+
+    key: str
+    size: int | None = None
+    hash: str | None = None
+    mime_type: str | None = None
+    file_kind: Literal["upload_file", "tool_file"]
+    file_id: str
+    created_at: int | None = None
+    download_url: str | None = None
+    value_owned_by_drive: bool | None = None
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class AgentStubDriveManifestResponse(BaseModel):
+    """Response body for one Agent Stub drive manifest request."""
+
+    items: list[AgentStubDriveItem]
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class AgentStubDriveCommitResponse(BaseModel):
+    """Response body for one Agent Stub drive commit request."""
+
+    items: list[AgentStubDriveItem]
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
 def _require_http_base_url(base_url: str) -> str:
     endpoint = parse_agent_stub_endpoint(base_url)
     if not endpoint.is_http:
@@ -228,6 +297,12 @@ __all__ = [
     "AgentStubConnectRequest",
     "AgentStubConnectResponse",
     "AgentStubEndpoint",
+    "AgentStubDriveCommitItem",
+    "AgentStubDriveCommitRequest",
+    "AgentStubDriveCommitResponse",
+    "AgentStubDriveFileRef",
+    "AgentStubDriveItem",
+    "AgentStubDriveManifestResponse",
     "AgentStubFileDownloadRequest",
     "AgentStubFileDownloadResponse",
     "AgentStubFileMapping",
@@ -235,6 +310,8 @@ __all__ = [
     "AgentStubFileUploadResponse",
     "AgentStubURLScheme",
     "agent_stub_connections_url",
+    "agent_stub_drive_commit_url",
+    "agent_stub_drive_manifest_url",
     "agent_stub_file_download_request_url",
     "agent_stub_file_upload_request_url",
     "is_canonical_dify_file_reference",
diff --git a/dify-agent/src/dify_agent/agent_stub/server/agent_stub_drive.py b/dify-agent/src/dify_agent/agent_stub/server/agent_stub_drive.py
new file mode 100644
index 00000000000..463cbd4a706
--- /dev/null
+++ b/dify-agent/src/dify_agent/agent_stub/server/agent_stub_drive.py
@@ -0,0 +1,190 @@
+"""Server-side Dify API client for Agent Stub drive endpoints.
+
+The Agent Stub drive API is an HTTP-only control plane over the existing Dify
+agent drive inner APIs. Sandbox callers never send trusted tenant, agent, or
+user ids directly; this module receives an authenticated ``AgentStubPrincipal``,
+derives ``agent-<agent_id>`` from execution context, injects trusted identity
+fields into the Dify inner request, and normalizes transport, HTTP, JSON, and
+schema failures into ``AgentStubDriveRequestError`` for the route layer.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Any, Protocol
+
+import httpx
+from pydantic import ValidationError
+
+from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitRequest,
+    AgentStubDriveCommitResponse,
+    AgentStubDriveManifestResponse,
+)
+from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubPrincipal
+from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
+
+
+class AgentStubDriveRequestHandler(Protocol):
+    """Trusted control-plane bridge from sandbox drive calls to Dify inner APIs."""
+
+    async def get_manifest(
+        self,
+        *,
+        principal: AgentStubPrincipal,
+        prefix: str,
+        include_download_url: bool,
+    ) -> AgentStubDriveManifestResponse: ...
+
+    async def commit(
+        self,
+        *,
+        principal: AgentStubPrincipal,
+        request: AgentStubDriveCommitRequest,
+    ) -> AgentStubDriveCommitResponse: ...
+
+
+class AgentStubDriveRequestError(RuntimeError):
+    """Raised when the Agent Stub cannot complete one drive control-plane call."""
+
+    status_code: int
+    detail: object
+
+    def __init__(self, status_code: int, detail: object) -> None:
+        self.status_code = status_code
+        self.detail = detail
+        super().__init__(str(detail))
+
+
+@dataclass(slots=True)
+class DifyApiAgentStubDriveRequestHandler:
+    """Call Dify API inner drive endpoints on behalf of authenticated sandboxes.
+
+    Manifest requests require ``tenant_id`` and ``agent_id`` from execution
+    context and forward query parameters to
+    ``/inner/api/drive/agent-<agent_id>/manifest``. Commit requests additionally
+    require ``user_id`` and post a raw JSON payload to
+    ``/inner/api/drive/agent-<agent_id>/commit``. Dify drive endpoints return
+    raw ``{"items": [...]}`` payloads instead of plugin-style ``data`` envelopes,
+    so this module validates the raw success payload directly.
+    """
+
+    dify_api_base_url: str
+    dify_api_inner_api_key: str
+    timeout: httpx.Timeout | float = 30.0
+
+    async def get_manifest(
+        self,
+        *,
+        principal: AgentStubPrincipal,
+        prefix: str,
+        include_download_url: bool,
+    ) -> AgentStubDriveManifestResponse:
+        """Request one drive manifest from Dify's inner drive manifest endpoint."""
+        execution_context = self._require_agent_context(principal.execution_context)
+        payload = await self._get_inner_api(
+            f"/inner/api/drive/{self._drive_ref(execution_context)}/manifest",
+            {
+                "tenant_id": execution_context.tenant_id,
+                "prefix": prefix,
+                "include_download_url": str(include_download_url).lower(),
+            },
+        )
+        try:
+            return AgentStubDriveManifestResponse.model_validate(payload)
+        except ValidationError as exc:
+            raise AgentStubDriveRequestError(502, "Dify API drive manifest response is invalid") from exc
+
+    async def commit(
+        self,
+        *,
+        principal: AgentStubPrincipal,
+        request: AgentStubDriveCommitRequest,
+    ) -> AgentStubDriveCommitResponse:
+        """Commit one drive batch through Dify's inner drive commit endpoint."""
+        execution_context = self._require_user_context(self._require_agent_context(principal.execution_context))
+        payload = await self._post_inner_api(
+            f"/inner/api/drive/{self._drive_ref(execution_context)}/commit",
+            {
+                "tenant_id": execution_context.tenant_id,
+                "user_id": execution_context.user_id,
+                "items": [item.model_dump(mode="json", exclude_none=True) for item in request.items],
+            },
+        )
+        try:
+            return AgentStubDriveCommitResponse.model_validate(payload)
+        except ValidationError as exc:
+            raise AgentStubDriveRequestError(502, "Dify API drive commit response is invalid") from exc
+
+    def _require_agent_context(
+        self, execution_context: DifyExecutionContextLayerConfig
+    ) -> DifyExecutionContextLayerConfig:
+        if execution_context.agent_id is None:
+            raise AgentStubDriveRequestError(400, "execution context agent_id is required for drive operations")
+        return execution_context
+
+    def _require_user_context(
+        self, execution_context: DifyExecutionContextLayerConfig
+    ) -> DifyExecutionContextLayerConfig:
+        if execution_context.user_id is None:
+            raise AgentStubDriveRequestError(400, "execution context user_id is required for drive commit")
+        return execution_context
+
+    @staticmethod
+    def _drive_ref(execution_context: DifyExecutionContextLayerConfig) -> str:
+        agent_id = execution_context.agent_id
+        if agent_id is None:
+            raise AgentStubDriveRequestError(400, "execution context agent_id is required for drive operations")
+        return f"agent-{agent_id}"
+
+    async def _get_inner_api(self, path: str, params: Mapping[str, str]) -> object:
+        url = f"{self.dify_api_base_url.rstrip('/')}{path}"
+        async with httpx.AsyncClient(timeout=self.timeout, follow_redirects=True, trust_env=False) as client:
+            try:
+                response = await client.get(
+                    url,
+                    params=dict(params),
+                    headers={"X-Inner-Api-Key": self.dify_api_inner_api_key},
+                )
+            except httpx.TimeoutException as exc:
+                raise AgentStubDriveRequestError(504, "Dify API drive request timed out") from exc
+            except httpx.RequestError as exc:
+                raise AgentStubDriveRequestError(502, f"Dify API drive request failed: {exc}") from exc
+        return self._normalize_payload(response)
+
+    async def _post_inner_api(self, path: str, payload: Mapping[str, Any]) -> object:
+        url = f"{self.dify_api_base_url.rstrip('/')}{path}"
+        async with httpx.AsyncClient(timeout=self.timeout, follow_redirects=True, trust_env=False) as client:
+            try:
+                response = await client.post(
+                    url,
+                    json=dict(payload),
+                    headers={"X-Inner-Api-Key": self.dify_api_inner_api_key},
+                )
+            except httpx.TimeoutException as exc:
+                raise AgentStubDriveRequestError(504, "Dify API drive request timed out") from exc
+            except httpx.RequestError as exc:
+                raise AgentStubDriveRequestError(502, f"Dify API drive request failed: {exc}") from exc
+        return self._normalize_payload(response)
+
+    def _normalize_payload(self, response: httpx.Response) -> object:
+        raw_payload = self._parse_json(response)
+        if response.is_error:
+            detail = raw_payload.get("detail", raw_payload) if isinstance(raw_payload, dict) else raw_payload
+            raise AgentStubDriveRequestError(response.status_code, detail)
+        return raw_payload
+
+    @staticmethod
+    def _parse_json(response: httpx.Response) -> object:
+        try:
+            return response.json()
+        except ValueError as exc:
+            raise AgentStubDriveRequestError(502, "Dify API drive request returned invalid JSON") from exc
+
+
+__all__ = [
+    "AgentStubDriveRequestError",
+    "AgentStubDriveRequestHandler",
+    "DifyApiAgentStubDriveRequestHandler",
+]
diff --git a/dify-agent/src/dify_agent/agent_stub/server/app.py b/dify-agent/src/dify_agent/agent_stub/server/app.py
index fa329cd4765..8467dea79f4 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/app.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/app.py
@@ -2,8 +2,9 @@
 
 The standalone stub server is only a convenience wrapper around the shared
 router. It reuses the main ``ServerSettings`` model and derives the Agent Stub
-token codec and optional file-request bridge from the same helper methods that
-the standard run server uses before mounting ``create_agent_stub_router(...)``.
+token codec plus optional file and drive request bridges from the same helper
+methods that the standard run server uses before mounting
+``create_agent_stub_router(...)``.
 """
 
 from __future__ import annotations
@@ -22,6 +23,7 @@ def create_agent_stub_app(settings: ServerSettings | None = None) -> FastAPI:
         create_agent_stub_router(
             token_codec=resolved_settings.create_agent_stub_token_codec(),
             file_request_handler=resolved_settings.create_agent_stub_file_request_handler(),
+            drive_request_handler=resolved_settings.create_agent_stub_drive_request_handler(),
         )
     )
     return app
diff --git a/dify-agent/src/dify_agent/agent_stub/server/control_plane.py b/dify-agent/src/dify_agent/agent_stub/server/control_plane.py
index 89c9b2e42da..ef747bd6d0e 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/control_plane.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/control_plane.py
@@ -8,11 +8,15 @@ from uuid import uuid4
 
 from dify_agent.agent_stub.protocol.agent_stub import (
     AgentStubConnectResponse,
+    AgentStubDriveCommitRequest,
+    AgentStubDriveCommitResponse,
+    AgentStubDriveManifestResponse,
     AgentStubFileDownloadRequest,
     AgentStubFileDownloadResponse,
     AgentStubFileUploadRequest,
     AgentStubFileUploadResponse,
 )
+from dify_agent.agent_stub.server.agent_stub_drive import AgentStubDriveRequestError, AgentStubDriveRequestHandler
 from dify_agent.agent_stub.server.agent_stub_files import AgentStubFileRequestError, AgentStubFileRequestHandler
 from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubPrincipal, AgentStubTokenCodec, AgentStubTokenError
 
@@ -43,11 +47,12 @@ class AgentStubControlPlaneService:
 
     HTTP and gRPC adapters validate or decode transport payloads before calling
     this service, so this layer focuses only on shared auth, connection-id
-    generation, and file-request delegation.
+    generation, plus file and drive request delegation.
     """
 
     token_codec: AgentStubTokenCodec | None
     file_request_handler: AgentStubFileRequestHandler | None = None
+    drive_request_handler: AgentStubDriveRequestHandler | None = None
     connection_id_factory: Callable[[], str] = field(default=lambda: str(uuid4()))
 
     async def connect(self, *, authorization: str | None) -> AgentStubConnectResponse:
@@ -83,6 +88,39 @@ class AgentStubControlPlaneService:
         except AgentStubFileRequestError as exc:
             raise AgentStubControlPlaneError(exc.status_code, exc.detail) from exc
 
+    async def get_drive_manifest(
+        self,
+        *,
+        prefix: str,
+        include_download_url: bool,
+        authorization: str | None,
+    ) -> AgentStubDriveManifestResponse:
+        """Authenticate and delegate one drive manifest request."""
+        principal = self._authenticate(authorization)
+        handler = self._require_drive_request_handler()
+        try:
+            return await handler.get_manifest(
+                principal=principal,
+                prefix=prefix,
+                include_download_url=include_download_url,
+            )
+        except AgentStubDriveRequestError as exc:
+            raise AgentStubControlPlaneError(exc.status_code, exc.detail) from exc
+
+    async def commit_drive(
+        self,
+        *,
+        request: AgentStubDriveCommitRequest,
+        authorization: str | None,
+    ) -> AgentStubDriveCommitResponse:
+        """Authenticate and delegate one drive commit request."""
+        principal = self._authenticate(authorization)
+        handler = self._require_drive_request_handler()
+        try:
+            return await handler.commit(principal=principal, request=request)
+        except AgentStubDriveRequestError as exc:
+            raise AgentStubControlPlaneError(exc.status_code, exc.detail) from exc
+
     def _authenticate(self, authorization: str | None) -> AgentStubPrincipal:
         token_codec = self.token_codec
         if token_codec is None:
@@ -97,6 +135,11 @@ class AgentStubControlPlaneService:
             raise AgentStubConfigurationError(503, "Agent Stub file API is not configured")
         return self.file_request_handler
 
+    def _require_drive_request_handler(self) -> AgentStubDriveRequestHandler:
+        if self.drive_request_handler is None:
+            raise AgentStubConfigurationError(503, "Agent Stub drive API is not configured")
+        return self.drive_request_handler
+
 
 __all__ = [
     "AgentStubAuthenticationError",
diff --git a/dify-agent/src/dify_agent/agent_stub/server/router.py b/dify-agent/src/dify_agent/agent_stub/server/router.py
index dadde9b053a..fa506ab0188 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/router.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/router.py
@@ -1,17 +1,18 @@
 """Embeddable router factory for Dify Agent stub endpoints.
 
 Both the standalone stub server and the standard run server mount the same
-router so the Agent Stub protocol, token validation, and file-control-plane
-behavior stay identical regardless of hosting mode. The factory is intentionally
-settings-agnostic: callers must pass already constructed token-codec and file
-handler dependencies rather than having this module read environment variables
-or import server settings directly.
+router so the Agent Stub protocol, token validation, and file/drive
+control-plane behavior stay identical regardless of hosting mode. The factory is
+intentionally settings-agnostic: callers must pass already constructed
+token-codec and request-handler dependencies rather than having this module read
+environment variables or import server settings directly.
 """
 
 from __future__ import annotations
 
 from fastapi import APIRouter
 
+from dify_agent.agent_stub.server.agent_stub_drive import AgentStubDriveRequestHandler
 from dify_agent.agent_stub.server.agent_stub_files import AgentStubFileRequestHandler
 from dify_agent.agent_stub.server.routes.agent_stub import create_agent_stub_http_router
 from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubTokenCodec
@@ -21,9 +22,10 @@ def create_agent_stub_router(
     *,
     token_codec: AgentStubTokenCodec | None,
     file_request_handler: AgentStubFileRequestHandler | None = None,
+    drive_request_handler: AgentStubDriveRequestHandler | None = None,
 ) -> APIRouter:
     """Build the embeddable stub router from pre-built server dependencies."""
-    return create_agent_stub_http_router(token_codec, file_request_handler)
+    return create_agent_stub_http_router(token_codec, file_request_handler, drive_request_handler)
 
 
 __all__ = ["create_agent_stub_router"]
diff --git a/dify-agent/src/dify_agent/agent_stub/server/routes/agent_stub.py b/dify-agent/src/dify_agent/agent_stub/server/routes/agent_stub.py
index cdadb738642..72077c88545 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/routes/agent_stub.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/routes/agent_stub.py
@@ -2,8 +2,8 @@
 
 The router is a thin HTTP adapter around ``AgentStubControlPlaneService``. It
 keeps FastAPI-specific request parsing and HTTPException translation here while
-sharing auth, DTO validation, connection-id generation, and file delegation with
-the gRPC transport.
+sharing auth, DTO validation, connection-id generation, and file/drive
+delegation with the gRPC transport.
 """
 
 from __future__ import annotations
@@ -13,11 +13,15 @@ from fastapi import APIRouter, Header, HTTPException
 from dify_agent.agent_stub.protocol.agent_stub import (
     AgentStubConnectRequest,
     AgentStubConnectResponse,
+    AgentStubDriveCommitRequest,
+    AgentStubDriveCommitResponse,
+    AgentStubDriveManifestResponse,
     AgentStubFileDownloadRequest,
     AgentStubFileDownloadResponse,
     AgentStubFileUploadRequest,
     AgentStubFileUploadResponse,
 )
+from dify_agent.agent_stub.server.agent_stub_drive import AgentStubDriveRequestHandler
 from dify_agent.agent_stub.server.agent_stub_files import AgentStubFileRequestHandler
 from dify_agent.agent_stub.server.control_plane import AgentStubControlPlaneError, AgentStubControlPlaneService
 from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubTokenCodec
@@ -26,10 +30,11 @@ from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubTokenCodec
 def create_agent_stub_http_router(
     token_codec: AgentStubTokenCodec | None,
     file_request_handler: AgentStubFileRequestHandler | None = None,
+    drive_request_handler: AgentStubDriveRequestHandler | None = None,
 ) -> APIRouter:
     """Create HTTP routes bound to the application's Agent Stub dependencies."""
     router = APIRouter(prefix="/agent-stub", tags=["agent-stub"])
-    service = AgentStubControlPlaneService(token_codec, file_request_handler)
+    service = AgentStubControlPlaneService(token_codec, file_request_handler, drive_request_handler)
 
     @router.post("/connections", response_model=AgentStubConnectResponse)
     async def create_connection(
@@ -62,6 +67,31 @@ def create_agent_stub_http_router(
         except AgentStubControlPlaneError as exc:
             raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
 
+    @router.get("/drive/manifest", response_model=AgentStubDriveManifestResponse)
+    async def get_drive_manifest(
+        prefix: str = "",
+        include_download_url: bool = False,
+        authorization: str | None = Header(default=None, alias="Authorization"),
+    ) -> AgentStubDriveManifestResponse:
+        try:
+            return await service.get_drive_manifest(
+                prefix=prefix,
+                include_download_url=include_download_url,
+                authorization=authorization,
+            )
+        except AgentStubControlPlaneError as exc:
+            raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
+
+    @router.post("/drive/commit", response_model=AgentStubDriveCommitResponse)
+    async def commit_drive(
+        request: AgentStubDriveCommitRequest,
+        authorization: str | None = Header(default=None, alias="Authorization"),
+    ) -> AgentStubDriveCommitResponse:
+        try:
+            return await service.commit_drive(request=request, authorization=authorization)
+        except AgentStubControlPlaneError as exc:
+            raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
+
     return router
 
 
diff --git a/dify-agent/src/dify_agent/client/_client.py b/dify-agent/src/dify_agent/client/_client.py
index 0ab8dc0dcf3..7c9a76e604f 100644
--- a/dify-agent/src/dify_agent/client/_client.py
+++ b/dify-agent/src/dify_agent/client/_client.py
@@ -46,7 +46,7 @@ from dify_agent.protocol import (
 _ResponseModelT = TypeVar("_ResponseModelT", bound=BaseModel)
 _TERMINAL_EVENT_TYPES = {"run_succeeded", "run_failed", "run_cancelled"}
 _TERMINAL_RUN_STATUSES = {"succeeded", "failed", "cancelled"}
-_FUNCTION_TOOL_RESULT_PAYLOAD_KEY: str | None = None
+_function_tool_result_payload_key_cache: str | None = None
 
 
 class DifyAgentClientError(RuntimeError):
@@ -176,13 +176,13 @@ def _function_tool_result_payload_key() -> str:
     during local development or rolling deploys, so the client normalizes the
     remote frame into the local schema before Pydantic validation.
     """
-    global _FUNCTION_TOOL_RESULT_PAYLOAD_KEY
-    if _FUNCTION_TOOL_RESULT_PAYLOAD_KEY is not None:
-        return _FUNCTION_TOOL_RESULT_PAYLOAD_KEY
+    global _function_tool_result_payload_key_cache
+    if _function_tool_result_payload_key_cache is not None:
+        return _function_tool_result_payload_key_cache
 
     parameters = list(inspect.signature(FunctionToolResultEvent).parameters)
-    _FUNCTION_TOOL_RESULT_PAYLOAD_KEY = "part" if parameters and parameters[0] == "part" else "result"
-    return _FUNCTION_TOOL_RESULT_PAYLOAD_KEY
+    _function_tool_result_payload_key_cache = "part" if parameters and parameters[0] == "part" else "result"
+    return _function_tool_result_payload_key_cache
 
 
 def _normalize_run_event_payload_for_local_pydantic_ai(payload: Any) -> Any:
diff --git a/dify-agent/src/dify_agent/layers/dify_plugin/llm_layer.py b/dify-agent/src/dify_agent/layers/dify_plugin/llm_layer.py
index 48e6c5508d8..bdd9d947565 100644
--- a/dify-agent/src/dify_agent/layers/dify_plugin/llm_layer.py
+++ b/dify-agent/src/dify_agent/layers/dify_plugin/llm_layer.py
@@ -32,7 +32,7 @@ class DifyPluginLLMDeps(LayerDeps):
 class DifyPluginLLMLayer(PlainLayer[DifyPluginLLMDeps, DifyPluginLLMLayerConfig]):
     """Layer that creates the Dify plugin-daemon Pydantic AI model."""
 
-    type_id: ClassVar[str] = DIFY_PLUGIN_LLM_LAYER_TYPE_ID
+    type_id: ClassVar[str | None] = DIFY_PLUGIN_LLM_LAYER_TYPE_ID
 
     config: DifyPluginLLMLayerConfig
 
diff --git a/dify-agent/src/dify_agent/layers/dify_plugin/tools_layer.py b/dify-agent/src/dify_agent/layers/dify_plugin/tools_layer.py
index 5ed4a5ea330..dd6c0c3cfb2 100644
--- a/dify-agent/src/dify_agent/layers/dify_plugin/tools_layer.py
+++ b/dify-agent/src/dify_agent/layers/dify_plugin/tools_layer.py
@@ -58,7 +58,7 @@ class DifyPluginToolsDeps(LayerDeps):
 class DifyPluginToolsLayer(PlainLayer[DifyPluginToolsDeps, DifyPluginToolsLayerConfig]):
     """Layer that resolves Dify plugin tools into Pydantic AI tools."""
 
-    type_id: ClassVar[str] = DIFY_PLUGIN_TOOLS_LAYER_TYPE_ID
+    type_id: ClassVar[str | None] = DIFY_PLUGIN_TOOLS_LAYER_TYPE_ID
 
     config: DifyPluginToolsLayerConfig
 
diff --git a/dify-agent/src/dify_agent/layers/drive/layer.py b/dify-agent/src/dify_agent/layers/drive/layer.py
index 3d5efb23d40..42f7011a51c 100644
--- a/dify-agent/src/dify_agent/layers/drive/layer.py
+++ b/dify-agent/src/dify_agent/layers/drive/layer.py
@@ -21,7 +21,7 @@ from dify_agent.layers.drive.configs import DIFY_DRIVE_LAYER_TYPE_ID, DifyDriveL
 class DifyDriveLayer(PlainLayer[NoLayerDeps, DifyDriveLayerConfig, EmptyRuntimeState]):
     """Config-only carrier of the drive Skills & Files manifest."""
 
-    type_id: ClassVar[str] = DIFY_DRIVE_LAYER_TYPE_ID
+    type_id: ClassVar[str | None] = DIFY_DRIVE_LAYER_TYPE_ID
 
     config: DifyDriveLayerConfig
 
diff --git a/dify-agent/src/dify_agent/layers/execution_context/__init__.py b/dify-agent/src/dify_agent/layers/execution_context/__init__.py
index f1534bceffd..aaf031501b3 100644
--- a/dify-agent/src/dify_agent/layers/execution_context/__init__.py
+++ b/dify-agent/src/dify_agent/layers/execution_context/__init__.py
@@ -2,7 +2,8 @@
 
 Implementation layers live in sibling modules and require server-side runtime
 dependencies. Keep this package root import-safe for client code that only
-needs to build run requests.
+needs to build run requests. Knowledge layers read ``user_from`` from the same
+DTO, but that runtime implementation still lives in sibling modules.
 """
 
 from dify_agent.layers.execution_context.configs import (
diff --git a/dify-agent/src/dify_agent/layers/execution_context/configs.py b/dify-agent/src/dify_agent/layers/execution_context/configs.py
index 2b042add7b5..21abe9b9481 100644
--- a/dify-agent/src/dify_agent/layers/execution_context/configs.py
+++ b/dify-agent/src/dify_agent/layers/execution_context/configs.py
@@ -4,9 +4,11 @@ This layer carries both Dify product execution context (tenant, user, workflow,
 invoke source) and Agent backend runtime mode. The product-facing fields are
 used by trusted server-side boundaries such as the Agent Stub when they
 need to reconstruct Dify API file-access scope without granting the sandbox any
-direct inner-API credentials. Server-only plugin-daemon settings are injected
-by the runtime provider factory and therefore do not appear in this public
-schema.
+direct inner-API credentials. Knowledge-base layers also read ``user_from`` from
+this shared config so the inner Dify API can distinguish platform-user and
+end-user searches without making that caller identity model-controlled.
+Server-only plugin-daemon settings are injected by the runtime provider factory
+and therefore do not appear in this public schema.
 """
 
 from typing import ClassVar, Final, Literal, TypeAlias
@@ -42,7 +44,7 @@ class DifyExecutionContextLayerConfig(LayerConfig):
 
     tenant_id: str
     user_id: str | None = None
-    user_from: DifyExecutionContextUserFrom
+    user_from: DifyExecutionContextUserFrom | None = None
     app_id: str | None = None
     workflow_id: str | None = None
     workflow_run_id: str | None = None
diff --git a/dify-agent/src/dify_agent/layers/execution_context/layer.py b/dify-agent/src/dify_agent/layers/execution_context/layer.py
index 06ef41ecf42..55a1920f535 100644
--- a/dify-agent/src/dify_agent/layers/execution_context/layer.py
+++ b/dify-agent/src/dify_agent/layers/execution_context/layer.py
@@ -1,7 +1,8 @@
 """Runtime Dify execution-context layer.
 
 The public config carries Dify-owned execution identifiers plus the tenant/user
-daemon context needed by plugin-backed business layers. Server-only daemon URL
+daemon context needed by plugin-backed business layers and the caller identity
+needed by knowledge-base layers. Server-only daemon URL
 and API key are injected by the provider factory. The layer is intentionally
 config/settings-only under Agenton's state-only core: it does not open, cache,
 close, or snapshot HTTP clients, and its lifecycle hooks remain the inherited
@@ -29,7 +30,7 @@ from dify_agent.layers.execution_context.configs import (
 class DifyExecutionContextLayer(PlainLayer[NoLayerDeps, DifyExecutionContextLayerConfig, EmptyRuntimeState]):
     """Layer that carries Dify execution context without owning live resources."""
 
-    type_id: ClassVar[str] = DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID
+    type_id: ClassVar[str | None] = DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID
 
     config: DifyExecutionContextLayerConfig
     daemon_url: str
diff --git a/dify-agent/src/dify_agent/layers/knowledge/__init__.py b/dify-agent/src/dify_agent/layers/knowledge/__init__.py
new file mode 100644
index 00000000000..569512d8004
--- /dev/null
+++ b/dify-agent/src/dify_agent/layers/knowledge/__init__.py
@@ -0,0 +1,27 @@
+"""Client-safe exports for Dify knowledge-base layer DTOs and type ids.
+
+Implementation layers and HTTP clients live in sibling modules so this package
+root stays import-safe for callers that only need to construct run requests.
+"""
+
+from dify_agent.layers.knowledge.configs import (
+    DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID,
+    DifyKnowledgeBaseLayerConfig,
+    DifyKnowledgeMetadataCondition,
+    DifyKnowledgeMetadataConditions,
+    DifyKnowledgeMetadataFilteringConfig,
+    DifyKnowledgeModelConfig,
+    DifyKnowledgeRerankingModelConfig,
+    DifyKnowledgeRetrievalConfig,
+)
+
+__all__ = [
+    "DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID",
+    "DifyKnowledgeBaseLayerConfig",
+    "DifyKnowledgeMetadataCondition",
+    "DifyKnowledgeMetadataConditions",
+    "DifyKnowledgeMetadataFilteringConfig",
+    "DifyKnowledgeModelConfig",
+    "DifyKnowledgeRerankingModelConfig",
+    "DifyKnowledgeRetrievalConfig",
+]
diff --git a/dify-agent/src/dify_agent/layers/knowledge/client.py b/dify-agent/src/dify_agent/layers/knowledge/client.py
new file mode 100644
index 00000000000..b80e363190a
--- /dev/null
+++ b/dify-agent/src/dify_agent/layers/knowledge/client.py
@@ -0,0 +1,214 @@
+"""Async client for the Dify API inner knowledge retrieval endpoint.
+
+This wrapper owns only request/response mapping and error normalization for
+``POST /inner/api/knowledge/retrieve``. The shared ``httpx.AsyncClient`` is
+supplied by the FastAPI lifespan/runtime and must stay open for the caller.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass, field
+from typing import ClassVar
+
+import httpx
+from pydantic import BaseModel, ConfigDict, Field, JsonValue, ValidationError
+
+from dify_agent.layers.knowledge.configs import (
+    DifyKnowledgeMetadataFilteringConfig,
+    DifyKnowledgeRetrievalConfig,
+)
+
+
+class DifyKnowledgeBaseClientError(RuntimeError):
+    """Raised when the inner knowledge retrieval HTTP boundary fails."""
+
+    status_code: int | None
+    error_code: str | None
+    retryable: bool
+
+    def __init__(
+        self,
+        message: str,
+        *,
+        status_code: int | None = None,
+        error_code: str | None = None,
+        retryable: bool,
+    ) -> None:
+        self.status_code = status_code
+        self.error_code = error_code
+        self.retryable = retryable
+        super().__init__(message)
+
+
+class _DifyKnowledgeCaller(BaseModel):
+    tenant_id: str
+    user_id: str
+    app_id: str
+    user_from: str
+    invoke_from: str
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class _DifyKnowledgeRetrieveRequest(BaseModel):
+    caller: _DifyKnowledgeCaller
+    dataset_ids: list[str]
+    query: str
+    retrieval: dict[str, JsonValue]
+    metadata_filtering: dict[str, JsonValue]
+    attachment_ids: list[str] = Field(default_factory=list)
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class DifyKnowledgeResultMetadata(BaseModel):
+    source: str | None = Field(default=None, alias="_source")
+    dataset_id: str | None = None
+    dataset_name: str | None = None
+    document_id: str | None = None
+    document_name: str | None = None
+    score: float | int | str | None = None
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="allow", populate_by_name=True)
+
+
+class DifyKnowledgeResult(BaseModel):
+    metadata: DifyKnowledgeResultMetadata
+    title: str | None = None
+    files: list[JsonValue] | None = None
+    content: str | None = None
+    summary: str | None = None
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class DifyKnowledgeRetrieveResponse(BaseModel):
+    results: list[DifyKnowledgeResult]
+    usage: dict[str, JsonValue] = Field(default_factory=dict)
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+@dataclass(slots=True)
+class DifyKnowledgeBaseClient:
+    """Boundary client for the Dify API inner knowledge retrieval endpoint."""
+
+    base_url: str
+    api_key: str = field(repr=False)
+    http_client: httpx.AsyncClient = field(repr=False)
+
+    def __post_init__(self) -> None:
+        self.base_url = self.base_url.rstrip("/")
+
+    async def retrieve(
+        self,
+        *,
+        tenant_id: str,
+        user_id: str,
+        app_id: str,
+        user_from: str,
+        invoke_from: str,
+        dataset_ids: list[str],
+        query: str,
+        retrieval: DifyKnowledgeRetrievalConfig,
+        metadata_filtering: DifyKnowledgeMetadataFilteringConfig,
+    ) -> DifyKnowledgeRetrieveResponse:
+        """Call the inner API and return parsed retrieval results.
+
+        Raises:
+            DifyKnowledgeBaseClientError: For HTTP, transport, or response-shape
+                failures. Only ``429``, ``502``, and transport/timeout failures
+                are marked retryable because the model may continue gracefully in
+                those temporary-unavailable cases.
+        """
+        request_payload = _DifyKnowledgeRetrieveRequest(
+            caller=_DifyKnowledgeCaller(
+                tenant_id=tenant_id,
+                user_id=user_id,
+                app_id=app_id,
+                user_from=user_from,
+                invoke_from=invoke_from,
+            ),
+            dataset_ids=dataset_ids,
+            query=query,
+            retrieval=retrieval.to_request_payload(),
+            metadata_filtering=metadata_filtering.to_request_payload(),
+        )
+
+        try:
+            response = await self.http_client.post(
+                f"{self.base_url}/inner/api/knowledge/retrieve",
+                headers={
+                    "X-Inner-Api-Key": self.api_key,
+                    "Content-Type": "application/json",
+                },
+                json=request_payload.model_dump(mode="json", by_alias=True),
+            )
+        except (httpx.InvalidURL, httpx.UnsupportedProtocol) as exc:
+            raise DifyKnowledgeBaseClientError(
+                f"Knowledge base search is misconfigured: {exc}",
+                retryable=False,
+            ) from exc
+        except httpx.TimeoutException as exc:
+            raise DifyKnowledgeBaseClientError(
+                "Knowledge base search timed out.",
+                retryable=True,
+            ) from exc
+        except httpx.RequestError as exc:
+            raise DifyKnowledgeBaseClientError(
+                f"Knowledge base search request failed: {exc}",
+                retryable=True,
+            ) from exc
+
+        if response.status_code >= 400:
+            raise _build_http_error(response)
+
+        try:
+            return DifyKnowledgeRetrieveResponse.model_validate_json(response.text)
+        except ValidationError as exc:
+            raise DifyKnowledgeBaseClientError(
+                "Invalid knowledge retrieval response from Dify API.",
+                status_code=response.status_code,
+                error_code="invalid_response",
+                retryable=False,
+            ) from exc
+
+
+def _build_http_error(response: httpx.Response) -> DifyKnowledgeBaseClientError:
+    detail = _decode_error_detail(response)
+    retryable = response.status_code in {429, 502}
+    message = detail["message"] or f"HTTP {response.status_code}"
+    return DifyKnowledgeBaseClientError(
+        message,
+        status_code=response.status_code,
+        error_code=detail["error_code"],
+        retryable=retryable,
+    )
+
+
+def _decode_error_detail(response: httpx.Response) -> dict[str, str | None]:
+    raw_body = response.text
+    try:
+        payload = response.json()
+    except json.JSONDecodeError:
+        payload = None
+
+    if isinstance(payload, dict):
+        error_code = payload.get("code")
+        message = payload.get("message")
+        return {
+            "error_code": error_code if isinstance(error_code, str) else None,
+            "message": message if isinstance(message, str) and message else raw_body or f"HTTP {response.status_code}",
+        }
+
+    return {"error_code": None, "message": raw_body or f"HTTP {response.status_code}"}
+
+
+__all__ = [
+    "DifyKnowledgeBaseClient",
+    "DifyKnowledgeBaseClientError",
+    "DifyKnowledgeResult",
+    "DifyKnowledgeResultMetadata",
+    "DifyKnowledgeRetrieveResponse",
+]
diff --git a/dify-agent/src/dify_agent/layers/knowledge/configs.py b/dify-agent/src/dify_agent/layers/knowledge/configs.py
new file mode 100644
index 00000000000..9ada075d1cc
--- /dev/null
+++ b/dify-agent/src/dify_agent/layers/knowledge/configs.py
@@ -0,0 +1,200 @@
+"""Client-safe DTOs for the Dify knowledge-base Agenton layer.
+
+The public layer config exposes only static retrieval controls: dataset ids,
+retrieval strategy, metadata filtering, and observation-size limits. The agent
+model itself should only ever see a single ``query`` tool argument; tenant/
+app/user context comes from the execution-context layer and the actual
+retrieval is delegated to the Dify API inner endpoint. Tool naming is not
+caller-configurable: the runtime always exposes the same stable knowledge-base
+search tool.
+"""
+
+from __future__ import annotations
+
+from typing import ClassVar, Final, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, JsonValue, field_validator, model_validator
+
+from agenton.layers import LayerConfig
+
+type DifyKnowledgeMetadataComparisonOperator = Literal[
+    "contains",
+    "not contains",
+    "start with",
+    "end with",
+    "is",
+    "is not",
+    "empty",
+    "not empty",
+    "in",
+    "not in",
+    "=",
+    "≠",
+    ">",
+    "<",
+    "≥",
+    "≤",
+    "before",
+    "after",
+]
+
+DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID: Final[str] = "dify.knowledge_base"
+
+
+class DifyKnowledgeModelConfig(BaseModel):
+    """Static model configuration forwarded to the inner retrieval API."""
+
+    provider: str
+    name: str
+    mode: str
+    completion_params: dict[str, JsonValue] = Field(default_factory=dict)
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class DifyKnowledgeRerankingModelConfig(BaseModel):
+    """Reranking model settings for multiple-mode retrieval."""
+
+    provider: str
+    model: str
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class DifyKnowledgeRetrievalConfig(BaseModel):
+    """Static retrieval controls mirrored into the inner API request."""
+
+    mode: Literal["multiple", "single"]
+    top_k: int | None = Field(default=None, ge=1)
+    score_threshold: float = 0.0
+    reranking_mode: str = "reranking_model"
+    reranking_enable: bool = True
+    reranking_model: DifyKnowledgeRerankingModelConfig | None = None
+    weights: dict[str, JsonValue] | None = None
+    model: DifyKnowledgeModelConfig | None = None
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+    @model_validator(mode="after")
+    def validate_mode_specific_fields(self) -> DifyKnowledgeRetrievalConfig:
+        if self.mode == "multiple" and self.top_k is None:
+            raise ValueError("retrieval.top_k is required for multiple mode")
+        if self.mode == "single" and self.model is None:
+            raise ValueError("retrieval.model is required for single mode")
+        return self
+
+    def to_request_payload(self) -> dict[str, JsonValue]:
+        """Serialize the retrieval config into the inner API request shape."""
+        payload: dict[str, JsonValue] = {
+            "mode": self.mode,
+            "score_threshold": self.score_threshold,
+            "reranking_mode": self.reranking_mode,
+            "reranking_enable": self.reranking_enable,
+        }
+        if self.mode == "multiple":
+            payload["top_k"] = self.top_k
+            payload["reranking_model"] = (
+                self.reranking_model.model_dump(mode="json") if self.reranking_model is not None else None
+            )
+            payload["weights"] = self.weights
+        else:
+            payload["model"] = self.model.model_dump(mode="json") if self.model is not None else None
+        return payload
+
+
+class DifyKnowledgeMetadataCondition(BaseModel):
+    """One manual metadata filter clause."""
+
+    name: str
+    comparison_operator: DifyKnowledgeMetadataComparisonOperator
+    value: str | list[str] | int | float | None = None
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class DifyKnowledgeMetadataConditions(BaseModel):
+    """Boolean composition for manual metadata filtering."""
+
+    logical_operator: Literal["and", "or"] = "and"
+    conditions: list[DifyKnowledgeMetadataCondition]
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+
+class DifyKnowledgeMetadataFilteringConfig(BaseModel):
+    """Static metadata filtering controls for the inner API request."""
+
+    mode: Literal["disabled", "automatic", "manual"] = "disabled"
+    metadata_model_config: DifyKnowledgeModelConfig | None = Field(default=None, alias="model_config")
+    conditions: DifyKnowledgeMetadataConditions | None = None
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid", populate_by_name=True)
+
+    @model_validator(mode="after")
+    def validate_mode_specific_fields(self) -> DifyKnowledgeMetadataFilteringConfig:
+        if self.mode == "automatic" and self.metadata_model_config is None:
+            raise ValueError("metadata_filtering.model_config is required for automatic mode")
+        if self.mode == "manual" and (self.conditions is None or not self.conditions.conditions):
+            raise ValueError("metadata_filtering.conditions is required for manual mode")
+        return self
+
+    def to_request_payload(self) -> dict[str, JsonValue]:
+        """Serialize metadata filtering using the inner API request field names."""
+        if self.mode == "disabled":
+            return {"mode": self.mode}
+
+        payload: dict[str, JsonValue] = {"mode": self.mode}
+        if self.metadata_model_config is not None:
+            payload["model_config"] = self.metadata_model_config.model_dump(mode="json")
+        if self.conditions is not None:
+            payload["conditions"] = self.conditions.model_dump(mode="json")
+        return payload
+
+
+class DifyKnowledgeBaseLayerConfig(LayerConfig):
+    """Public config for one model-visible knowledge search tool.
+
+    The model only gets to choose whether to call the tool and what ``query``
+    to send. Dataset ids, retrieval settings, metadata filtering, and caller
+    context remain config/runtime concerns outside the model-visible tool
+    schema. The tool name and description are fixed by the layer runtime and do
+    not appear in the public config DTO.
+    """
+
+    dataset_ids: list[str]
+    retrieval: DifyKnowledgeRetrievalConfig
+    metadata_filtering: DifyKnowledgeMetadataFilteringConfig = Field(
+        default_factory=DifyKnowledgeMetadataFilteringConfig
+    )
+    max_result_content_chars: int = Field(default=2000, ge=1)
+    max_observation_chars: int = Field(default=12000, ge=1)
+
+    model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
+
+    @field_validator("dataset_ids")
+    @classmethod
+    def validate_dataset_ids(cls, value: list[str]) -> list[str]:
+        if not value:
+            raise ValueError("dataset_ids must contain at least one item")
+        normalized_ids = [item.strip() for item in value]
+        if any(not item for item in normalized_ids):
+            raise ValueError("dataset_ids must not contain blank items")
+        return normalized_ids
+
+    @model_validator(mode="after")
+    def validate_observation_limits(self) -> DifyKnowledgeBaseLayerConfig:
+        if self.max_observation_chars < self.max_result_content_chars:
+            raise ValueError("max_observation_chars must be greater than or equal to max_result_content_chars")
+        return self
+
+
+__all__ = [
+    "DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID",
+    "DifyKnowledgeBaseLayerConfig",
+    "DifyKnowledgeMetadataCondition",
+    "DifyKnowledgeMetadataConditions",
+    "DifyKnowledgeMetadataFilteringConfig",
+    "DifyKnowledgeModelConfig",
+    "DifyKnowledgeRerankingModelConfig",
+    "DifyKnowledgeRetrievalConfig",
+]
diff --git a/dify-agent/src/dify_agent/layers/knowledge/layer.py b/dify-agent/src/dify_agent/layers/knowledge/layer.py
new file mode 100644
index 00000000000..16605a9ceb3
--- /dev/null
+++ b/dify-agent/src/dify_agent/layers/knowledge/layer.py
@@ -0,0 +1,285 @@
+"""Dify knowledge-base layer exposing one model-visible search tool.
+
+The layer depends on ``DifyExecutionContextLayer`` for tenant/app/user/invoke
+identity, keeps retrieval controls in config only, and borrows a lifespan-owned
+HTTP client for each tool invocation. It never owns live clients or stores
+retrieved source content in layer state. Tool identity is intentionally fixed at
+runtime: callers cannot rename the knowledge tool or override its description
+through public layer config because the model-visible surface must stay stable
+across API-side Agent Soul mappings.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+import logging
+from typing import ClassVar, cast
+
+import httpx
+from pydantic_ai import RunContext, Tool
+from pydantic_ai.tools import ToolDefinition
+from typing_extensions import Self, override
+
+from agenton.layers import LayerDeps, PlainLayer
+from dify_agent.layers.execution_context.layer import DifyExecutionContextLayer
+from dify_agent.layers.knowledge.client import (
+    DifyKnowledgeBaseClient,
+    DifyKnowledgeBaseClientError,
+    DifyKnowledgeRetrieveResponse,
+)
+from dify_agent.layers.knowledge.configs import DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID, DifyKnowledgeBaseLayerConfig
+
+logger = logging.getLogger(__name__)
+
+# Fixed model-visible tool identity. These stay module-private on purpose so the
+# public DTO cannot grow a parallel naming contract that diverges from the
+# runtime knowledge-search surface.
+_KNOWLEDGE_BASE_TOOL_NAME = "knowledge_base_search"
+_KNOWLEDGE_BASE_TOOL_DESCRIPTION = "Search configured knowledge bases for information relevant to the query."
+BLANK_QUERY_OBSERVATION = "knowledge base search requires a non-empty query"
+NO_RESULTS_OBSERVATION = "No relevant knowledge base results were found."
+TEMPORARY_UNAVAILABLE_OBSERVATION = (
+    "Knowledge base search is temporarily unavailable. Please continue without it if possible."
+)
+QUERY_TOOL_SCHEMA = {
+    "type": "object",
+    "properties": {
+        "query": {
+            "type": "string",
+            "description": "Search query for the configured knowledge bases.",
+        }
+    },
+    "required": ["query"],
+    "additionalProperties": False,
+}
+
+
+class DifyKnowledgeBaseDeps(LayerDeps):
+    """Dependencies required by ``DifyKnowledgeBaseLayer``."""
+
+    execution_context: DifyExecutionContextLayer  # pyright: ignore[reportUninitializedInstanceVariable]
+
+
+@dataclass(slots=True)
+class DifyKnowledgeBaseLayer(PlainLayer[DifyKnowledgeBaseDeps, DifyKnowledgeBaseLayerConfig]):
+    """Layer that resolves one config-scoped knowledge search tool."""
+
+    type_id: ClassVar[str | None] = DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID
+
+    config: DifyKnowledgeBaseLayerConfig
+    dify_api_inner_url: str
+    dify_api_inner_api_key: str
+
+    @classmethod
+    @override
+    def from_config(cls, config: DifyKnowledgeBaseLayerConfig) -> Self:
+        """Reject construction without server-injected Dify API settings."""
+        del config
+        raise TypeError(
+            "DifyKnowledgeBaseLayer requires server-side Dify API settings and must use a provider factory."
+        )
+
+    @classmethod
+    def from_config_with_settings(
+        cls,
+        config: DifyKnowledgeBaseLayerConfig,
+        *,
+        dify_api_inner_url: str,
+        dify_api_inner_api_key: str,
+    ) -> Self:
+        """Create the layer from public config plus server-only API settings."""
+        return cls(
+            config=DifyKnowledgeBaseLayerConfig.model_validate(config),
+            dify_api_inner_url=dify_api_inner_url,
+            dify_api_inner_api_key=dify_api_inner_api_key,
+        )
+
+    async def get_tools(self, *, http_client: httpx.AsyncClient) -> list[Tool[object]]:
+        """Build one Pydantic AI tool that exposes only ``query`` to the model.
+
+        Knowledge tools depend on execution-context identity that is optional for
+        other run types but mandatory here: ``tenant_id``, ``user_id``,
+        ``user_from``, ``app_id``, and ``invoke_from`` must all be present before
+        any HTTP request is attempted. Tool execution then follows a strict
+        observation policy:
+
+        - blank ``query`` returns a local validation observation;
+        - retryable client failures (timeouts, connection failures, HTTP
+          ``429``/``502``) become a temporary-unavailable observation;
+        - non-retryable client failures are raised so the run fails fast.
+        """
+        if http_client.is_closed:
+            raise RuntimeError("DifyKnowledgeBaseLayer.get_tools() requires an open shared HTTP client.")
+
+        execution_context = self.deps.execution_context.config
+        caller = _build_caller_context(execution_context)
+        client = DifyKnowledgeBaseClient(
+            base_url=self.dify_api_inner_url,
+            api_key=self.dify_api_inner_api_key,
+            http_client=http_client,
+        )
+
+        async def knowledge_base_search(_ctx: RunContext[object], query: str) -> str:
+            normalized_query = query.strip()
+            if not normalized_query:
+                return BLANK_QUERY_OBSERVATION
+            try:
+                response = await client.retrieve(
+                    tenant_id=caller["tenant_id"],
+                    user_id=caller["user_id"],
+                    app_id=caller["app_id"],
+                    user_from=caller["user_from"],
+                    invoke_from=caller["invoke_from"],
+                    dataset_ids=list(self.config.dataset_ids),
+                    query=normalized_query,
+                    retrieval=self.config.retrieval,
+                    metadata_filtering=self.config.metadata_filtering,
+                )
+            except DifyKnowledgeBaseClientError as exc:
+                if exc.retryable:
+                    logger.warning(
+                        "knowledge base search temporarily unavailable",
+                        extra={
+                            "tenant_id": caller["tenant_id"],
+                            "app_id": caller["app_id"],
+                            "invoke_from": caller["invoke_from"],
+                            "error_code": exc.error_code,
+                            "status_code": exc.status_code,
+                        },
+                    )
+                    return TEMPORARY_UNAVAILABLE_OBSERVATION
+                logger.error(
+                    "knowledge base search failed",
+                    extra={
+                        "tenant_id": caller["tenant_id"],
+                        "app_id": caller["app_id"],
+                        "invoke_from": caller["invoke_from"],
+                        "error_code": exc.error_code,
+                        "status_code": exc.status_code,
+                    },
+                )
+                raise
+            return _format_observation(response, self.config)
+
+        async def prepare_tool_definition(_ctx: RunContext[object], tool_def: ToolDefinition) -> ToolDefinition:
+            return ToolDefinition(
+                name=tool_def.name,
+                description=tool_def.description,
+                parameters_json_schema=QUERY_TOOL_SCHEMA,
+                strict=tool_def.strict,
+                sequential=tool_def.sequential,
+                metadata=tool_def.metadata,
+                timeout=tool_def.timeout,
+                defer_loading=tool_def.defer_loading,
+                kind=tool_def.kind,
+                return_schema=tool_def.return_schema,
+                include_return_schema=tool_def.include_return_schema,
+            )
+
+        return [
+            Tool(
+                knowledge_base_search,
+                takes_ctx=True,
+                name=_KNOWLEDGE_BASE_TOOL_NAME,
+                description=_KNOWLEDGE_BASE_TOOL_DESCRIPTION,
+                prepare=prepare_tool_definition,
+            )
+        ]
+
+
+def _build_caller_context(execution_context: object) -> dict[str, str]:
+    """Extract the inner-API caller identity from execution-context config.
+
+    The public execution-context DTO keeps several fields optional for general
+    runs, but knowledge retrieval requires all of ``tenant_id``, ``user_id``,
+    ``user_from``, ``app_id``, and ``invoke_from``. Missing or blank values are
+    rejected here so misconfigured runs fail before transport rather than being
+    softened into tool observations.
+    """
+    tenant_id = getattr(execution_context, "tenant_id", None)
+    user_id = getattr(execution_context, "user_id", None)
+    user_from = getattr(execution_context, "user_from", None)
+    app_id = getattr(execution_context, "app_id", None)
+    invoke_from = getattr(execution_context, "invoke_from", None)
+
+    missing_fields = [
+        field_name
+        for field_name, value in (
+            ("tenant_id", tenant_id),
+            ("user_id", user_id),
+            ("user_from", user_from),
+            ("app_id", app_id),
+            ("invoke_from", invoke_from),
+        )
+        if not isinstance(value, str) or not value.strip()
+    ]
+    if missing_fields:
+        joined_fields = ", ".join(missing_fields)
+        raise ValueError(f"Dify knowledge base layer requires execution context fields: {joined_fields}")
+
+    normalized_tenant_id = cast(str, tenant_id).strip()
+    normalized_user_id = cast(str, user_id).strip()
+    normalized_user_from = cast(str, user_from).strip()
+    normalized_app_id = cast(str, app_id).strip()
+    normalized_invoke_from = cast(str, invoke_from).strip()
+
+    return {
+        "tenant_id": normalized_tenant_id,
+        "user_id": normalized_user_id,
+        "user_from": normalized_user_from,
+        "app_id": normalized_app_id,
+        "invoke_from": normalized_invoke_from,
+    }
+
+
+def _format_observation(response: DifyKnowledgeRetrieveResponse, config: DifyKnowledgeBaseLayerConfig) -> str:
+    """Render inner-API retrieval results into the model-visible tool response.
+
+    The formatting contract is intentionally simple and stable for the model:
+
+    - empty ``results`` returns ``NO_RESULTS_OBSERVATION``;
+    - non-empty results become a numbered list headed by
+      ``"Knowledge base search results:"``;
+    - each item includes title plus dataset/document/score metadata when those
+      fields are present;
+    - each content snippet is truncated by ``max_result_content_chars``;
+    - the final observation is truncated by ``max_observation_chars``.
+    """
+    if not response.results:
+        return NO_RESULTS_OBSERVATION
+
+    lines = ["Knowledge base search results:"]
+    for index, result in enumerate(response.results, start=1):
+        metadata = result.metadata
+        title = result.title or metadata.document_name or "Untitled"
+        lines.append(f"{index}. Title: {title}")
+        if metadata.dataset_name:
+            lines.append(f"   Dataset: {metadata.dataset_name}")
+        if metadata.document_name:
+            lines.append(f"   Document: {metadata.document_name}")
+        if metadata.score is not None:
+            lines.append(f"   Score: {metadata.score}")
+        content = _truncate_text(result.content or result.summary or "", config.max_result_content_chars)
+        if content:
+            lines.append(f"   Content: {content}")
+        lines.append("")
+
+    return _truncate_text("\n".join(lines).rstrip(), config.max_observation_chars)
+
+
+def _truncate_text(text: str, max_chars: int) -> str:
+    if len(text) <= max_chars:
+        return text
+    if max_chars <= 3:
+        return text[:max_chars]
+    return f"{text[: max_chars - 3]}..."
+
+
+__all__ = [
+    "BLANK_QUERY_OBSERVATION",
+    "DifyKnowledgeBaseDeps",
+    "DifyKnowledgeBaseLayer",
+    "NO_RESULTS_OBSERVATION",
+    "QUERY_TOOL_SCHEMA",
+    "TEMPORARY_UNAVAILABLE_OBSERVATION",
+]
diff --git a/dify-agent/src/dify_agent/runtime/compositor_factory.py b/dify-agent/src/dify_agent/runtime/compositor_factory.py
index 81bfcd48e2f..a637dce7767 100644
--- a/dify-agent/src/dify_agent/runtime/compositor_factory.py
+++ b/dify-agent/src/dify_agent/runtime/compositor_factory.py
@@ -4,23 +4,23 @@ Only explicitly allowed provider type ids are constructible here. The default
 provider set contains prompt layers, the optional pydantic-ai history layer, the
 state-free Dify structured output layer, the optional Dify ask-human layer, the
 Dify execution-context layer, the stateful Dify shell layer, and the Dify
-plugin business-layer family:
+plugin/knowledge business-layer family:
 
 - ``dify.drive`` for the inert Skills & Files drive declaration,
 - ``dify.execution_context`` for shared tenant/user/run daemon context,
 - ``dify.shell`` for shellctl-backed shell job control,
-- ``dify.plugin.llm`` for plugin-backed model selection, and
-- ``dify.plugin.tools`` for prepared plugin tool exposure.
+- ``dify.plugin.llm`` for plugin-backed model selection,
+- ``dify.plugin.tools`` for prepared plugin tool exposure, and
+- ``dify.knowledge_base`` for inner-API-backed knowledge search tools.
 
 Public DTOs provide Dify context plus plugin/model/tool data, while server-only
-plugin daemon settings are injected through the provider factory for
-``DifyExecutionContextLayer`` and the optional shellctl entrypoint/auth token plus
-client factory plus optional Agent Stub URL/token issuer are injected for
-``DifyShellLayer``. The resulting ``Compositor``
-remains Agenton state-only at the snapshot boundary: live resources such as
-HTTP clients are injected by runtime-owned providers, may be held on active
-layer instances inside ``resource_context()``, and never enter session
-snapshots.
+plugin daemon settings and Dify API inner settings are injected through provider
+factories. Optional shellctl entrypoint/auth token, client factory, and Agent
+Stub URL/token issuer are injected for ``DifyShellLayer``. The resulting
+``Compositor`` remains Agenton state-only at the snapshot boundary: live
+resources such as HTTP clients are injected by runtime-owned providers, may be
+held on active layer instances inside ``resource_context()``, and never enter
+session snapshots.
 """
 
 from collections.abc import Mapping, Sequence
@@ -41,6 +41,8 @@ from dify_agent.layers.dify_plugin.tools_layer import DifyPluginToolsLayer
 from dify_agent.layers.drive.layer import DifyDriveLayer
 from dify_agent.layers.execution_context.configs import DifyExecutionContextLayerConfig
 from dify_agent.layers.execution_context.layer import DifyExecutionContextLayer
+from dify_agent.layers.knowledge.configs import DifyKnowledgeBaseLayerConfig
+from dify_agent.layers.knowledge.layer import DifyKnowledgeBaseLayer
 from dify_agent.layers.output.output_layer import DifyOutputLayer
 from dify_agent.layers.shell.configs import DifyShellLayerConfig
 from dify_agent.layers.shell.layer import DifyShellLayer, create_shellctl_client_factory
@@ -52,6 +54,8 @@ def create_default_layer_providers(
     *,
     plugin_daemon_url: str = "http://localhost:5002",
     plugin_daemon_api_key: str = "",
+    dify_api_inner_url: str = "http://localhost:5001",
+    dify_api_inner_api_key: str = "",
     shellctl_entrypoint: str | None = None,
     shellctl_auth_token: str | None = None,
     agent_stub_url: str | None = None,
@@ -109,6 +113,14 @@ def create_default_layer_providers(
         ),
         LayerProvider.from_layer_type(DifyPluginLLMLayer),
         LayerProvider.from_layer_type(DifyPluginToolsLayer),
+        LayerProvider.from_factory(
+            layer_type=DifyKnowledgeBaseLayer,
+            create=lambda config: DifyKnowledgeBaseLayer.from_config_with_settings(
+                DifyKnowledgeBaseLayerConfig.model_validate(config),
+                dify_api_inner_url=dify_api_inner_url,
+                dify_api_inner_api_key=dify_api_inner_api_key,
+            ),
+        ),
     )
 
 
diff --git a/dify-agent/src/dify_agent/runtime/run_scheduler.py b/dify-agent/src/dify_agent/runtime/run_scheduler.py
index 9dfc93b8465..4186b6afd76 100644
--- a/dify-agent/src/dify_agent/runtime/run_scheduler.py
+++ b/dify-agent/src/dify_agent/runtime/run_scheduler.py
@@ -69,6 +69,7 @@ class RunScheduler:
     runner_factory: RunRunnerFactory
     layer_providers: tuple[LayerProviderInput, ...]
     plugin_daemon_http_client: httpx.AsyncClient
+    dify_api_http_client: httpx.AsyncClient
     _lifecycle_lock: asyncio.Lock
 
     def __init__(
@@ -76,6 +77,7 @@ class RunScheduler:
         *,
         store: RunStore,
         plugin_daemon_http_client: httpx.AsyncClient,
+        dify_api_http_client: httpx.AsyncClient,
         shutdown_grace_seconds: float = 30,
         layer_providers: tuple[LayerProviderInput, ...] | None = None,
         runner_factory: RunRunnerFactory | None = None,
@@ -85,6 +87,7 @@ class RunScheduler:
         self.active_tasks = {}
         self.stopping = False
         self.plugin_daemon_http_client = plugin_daemon_http_client
+        self.dify_api_http_client = dify_api_http_client
         self.layer_providers = layer_providers if layer_providers is not None else create_default_layer_providers()
         self.runner_factory = runner_factory or self._default_runner_factory
         self._lifecycle_lock = asyncio.Lock()
@@ -141,6 +144,7 @@ class RunScheduler:
             request=request,
             run_id=record.run_id,
             plugin_daemon_http_client=self.plugin_daemon_http_client,
+            dify_api_http_client=self.dify_api_http_client,
             layer_providers=self.layer_providers,
         )
 
diff --git a/dify-agent/src/dify_agent/runtime/runner.py b/dify-agent/src/dify_agent/runtime/runner.py
index 8a6d7b9bd91..d10b1843e9a 100644
--- a/dify-agent/src/dify_agent/runtime/runner.py
+++ b/dify-agent/src/dify_agent/runtime/runner.py
@@ -19,7 +19,9 @@ publishes that deferred request through the normal ``run_succeeded`` event as
 ``deferred_tool_call`` instead of a final ``output``. Invalid structured outputs
 or invalid deferred-tool behavior still trigger normal retries/failures before
 Dify Agent emits success. Layers still never own the FastAPI lifespan-owned
-plugin daemon HTTP client.
+plugin daemon or Dify API inner HTTP clients. Successful terminal events contain
+both the JSON-safe final output or deferred tool call and the session snapshot;
+there are no separate output or snapshot events to correlate.
 """
 
 from collections.abc import AsyncIterable
@@ -38,6 +40,7 @@ from agenton.layers.types import PydanticAITool
 from dify_agent.layers.ask_human.layer import get_ask_human_layer, validate_ask_human_layer_composition
 from dify_agent.layers.dify_plugin.llm_layer import DifyPluginLLMLayer
 from dify_agent.layers.dify_plugin.tools_layer import DifyPluginToolsLayer
+from dify_agent.layers.knowledge.layer import DifyKnowledgeBaseLayer
 from dify_agent.protocol.schemas import (
     CreateRunRequest,
     DIFY_AGENT_MODEL_LAYER_ID,
@@ -91,6 +94,7 @@ class AgentRunRunner:
     run_id: str
     layer_providers: tuple[LayerProviderInput, ...]
     plugin_daemon_http_client: httpx.AsyncClient
+    dify_api_http_client: httpx.AsyncClient
 
     def __init__(
         self,
@@ -99,12 +103,14 @@ class AgentRunRunner:
         request: CreateRunRequest,
         run_id: str,
         plugin_daemon_http_client: httpx.AsyncClient,
+        dify_api_http_client: httpx.AsyncClient,
         layer_providers: tuple[LayerProviderInput, ...] | None = None,
     ) -> None:
         self.sink = sink
         self.request = request
         self.run_id = run_id
         self.plugin_daemon_http_client = plugin_daemon_http_client
+        self.dify_api_http_client = dify_api_http_client
         self.layer_providers = layer_providers if layer_providers is not None else create_default_layer_providers()
 
     async def run(self) -> None:
@@ -187,7 +193,11 @@ class AgentRunRunner:
                     ask_human_layer = get_ask_human_layer(run)
                     llm_layer = run.get_layer(DIFY_AGENT_MODEL_LAYER_ID, DifyPluginLLMLayer)
                     model = llm_layer.get_model(http_client=self.plugin_daemon_http_client)
-                    tools = await _resolve_run_tools(run, http_client=self.plugin_daemon_http_client)
+                    tools = await _resolve_run_tools(
+                        run,
+                        plugin_daemon_http_client=self.plugin_daemon_http_client,
+                        dify_api_http_client=self.dify_api_http_client,
+                    )
                 except (KeyError, TypeError, RuntimeError, ValueError) as exc:
                     raise AgentRunValidationError(str(exc)) from exc
 
@@ -266,14 +276,17 @@ def _resolve_deferred_tool_results(request: CreateRunRequest) -> DeferredToolRes
 async def _resolve_run_tools(
     run: Any,
     *,
-    http_client: httpx.AsyncClient,
+    plugin_daemon_http_client: httpx.AsyncClient,
+    dify_api_http_client: httpx.AsyncClient,
 ) -> list[PydanticAITool[object]]:
-    """Return the static compositor tools plus any Dify plugin runtime tools."""
+    """Return the static compositor tools plus any Dify runtime tools."""
     resolved_tools = list(cast(list[PydanticAITool[object]], run.tools))
     for slot in run.slots.values():
         layer = slot.layer
         if isinstance(layer, DifyPluginToolsLayer):
-            resolved_tools.extend(await layer.get_tools(http_client=http_client))
+            resolved_tools.extend(await layer.get_tools(http_client=plugin_daemon_http_client))
+        if isinstance(layer, DifyKnowledgeBaseLayer):
+            resolved_tools.extend(await layer.get_tools(http_client=dify_api_http_client))
     _validate_unique_tool_names(resolved_tools)
     return resolved_tools
 
diff --git a/dify-agent/src/dify_agent/server/app.py b/dify-agent/src/dify_agent/server/app.py
index f4eab601a2e..42b406799bb 100644
--- a/dify-agent/src/dify_agent/server/app.py
+++ b/dify-agent/src/dify_agent/server/app.py
@@ -1,15 +1,16 @@
 """FastAPI application factory for the Dify Agent run server.
 
-The HTTP process owns Redis clients, one shared plugin daemon ``httpx.AsyncClient``,
-route wiring, and a process-local scheduler. Run execution happens in background
-``asyncio`` tasks rather than request handlers, so client disconnects do not
-cancel the agent runtime. Redis persists run records and per-run event streams
-with configured retention only; it is not used as a job queue. Agenton layers and
-providers stay state-only: they borrow the lifespan-owned plugin daemon client
-through the runner and receive shell-layer server settings through provider
-construction rather than reading environment variables themselves. The standard
-server always mounts the HTTP Agent Stub router and additionally starts the
-optional grpclib Agent Stub server when ``DIFY_AGENT_STUB_URL`` uses ``grpc://``.
+The HTTP process owns Redis clients plus separate shared ``httpx.AsyncClient``
+instances for plugin-daemon and Dify API inner calls, route wiring, and a
+process-local scheduler. Run execution happens in background ``asyncio`` tasks
+rather than request handlers, so client disconnects do not cancel the agent
+runtime. Redis persists run records and per-run event streams with configured
+retention only; it is not used as a job queue. Agenton layers and providers
+stay state-only: they borrow the lifespan-owned clients through the runner and
+receive shell-layer server settings through provider construction rather than
+reading environment variables themselves. The standard server always mounts the
+HTTP Agent Stub router and additionally starts the optional grpclib Agent Stub
+server when ``DIFY_AGENT_STUB_URL`` uses ``grpc://``.
 """
 
 from collections.abc import AsyncGenerator
@@ -36,9 +37,12 @@ def create_app(settings: ServerSettings | None = None) -> FastAPI:
     resolved_settings = settings or ServerSettings()
     agent_stub_token_codec = resolved_settings.create_agent_stub_token_codec()
     agent_stub_file_request_handler = resolved_settings.create_agent_stub_file_request_handler()
+    agent_stub_drive_request_handler = resolved_settings.create_agent_stub_drive_request_handler()
     layer_providers = create_default_layer_providers(
         plugin_daemon_url=resolved_settings.plugin_daemon_url,
         plugin_daemon_api_key=resolved_settings.plugin_daemon_api_key,
+        dify_api_inner_url=resolved_settings.dify_api_inner_url,
+        dify_api_inner_api_key=resolved_settings.dify_api_inner_api_key or "",
         shellctl_entrypoint=resolved_settings.shellctl_entrypoint,
         shellctl_auth_token=resolved_settings.shellctl_auth_token,
         agent_stub_url=resolved_settings.agent_stub_url,
@@ -53,6 +57,7 @@ def create_app(settings: ServerSettings | None = None) -> FastAPI:
     async def lifespan(_app: FastAPI) -> AsyncGenerator[None, None]:
         redis = Redis.from_url(resolved_settings.redis_url)
         plugin_daemon_http_client = create_plugin_daemon_http_client(resolved_settings)
+        dify_api_inner_http_client = create_dify_api_inner_http_client(resolved_settings)
         store = RedisRunStore(
             redis,
             prefix=resolved_settings.redis_prefix,
@@ -61,6 +66,7 @@ def create_app(settings: ServerSettings | None = None) -> FastAPI:
         scheduler = RunScheduler(
             store=store,
             plugin_daemon_http_client=plugin_daemon_http_client,
+            dify_api_http_client=dify_api_inner_http_client,
             shutdown_grace_seconds=resolved_settings.shutdown_grace_seconds,
             layer_providers=layer_providers,
         )
@@ -83,6 +89,7 @@ def create_app(settings: ServerSettings | None = None) -> FastAPI:
             if grpc_server is not None:
                 await grpc_server.aclose()
             await scheduler.shutdown()
+            await dify_api_inner_http_client.aclose()
             await plugin_daemon_http_client.aclose()
             await redis.aclose()
 
@@ -100,6 +107,7 @@ def create_app(settings: ServerSettings | None = None) -> FastAPI:
         create_agent_stub_router(
             token_codec=agent_stub_token_codec,
             file_request_handler=agent_stub_file_request_handler,
+            drive_request_handler=agent_stub_drive_request_handler,
         )
     )
     return app
@@ -112,17 +120,28 @@ def create_plugin_daemon_http_client(settings: ServerSettings) -> httpx.AsyncCli
     process and must be closed by the app lifespan after the scheduler has stopped
     using it.
     """
+    return _create_shared_http_client(settings)
+
+
+def create_dify_api_inner_http_client(settings: ServerSettings) -> httpx.AsyncClient:
+    """Create the lifespan-owned Dify API inner HTTP client.
+
+    The Dify API inner client intentionally shares the generic outbound HTTP
+    timeout and connection-pool settings with the plugin daemon client so
+    operational tuning stays in one place while endpoint URL/API keys remain
+    distinct server settings.
+    """
+    return _create_shared_http_client(settings)
+
+
+def _create_shared_http_client(settings: ServerSettings) -> httpx.AsyncClient:
+    """Build one shared HTTP client using generic outbound timeout/pool settings."""
     return httpx.AsyncClient(
-        timeout=httpx.Timeout(
-            connect=settings.plugin_daemon_connect_timeout,
-            read=settings.plugin_daemon_read_timeout,
-            write=settings.plugin_daemon_write_timeout,
-            pool=settings.plugin_daemon_pool_timeout,
-        ),
+        timeout=settings.create_outbound_http_timeout(),
         limits=httpx.Limits(
-            max_connections=settings.plugin_daemon_max_connections,
-            max_keepalive_connections=settings.plugin_daemon_max_keepalive_connections,
-            keepalive_expiry=settings.plugin_daemon_keepalive_expiry,
+            max_connections=settings.outbound_http_max_connections,
+            max_keepalive_connections=settings.outbound_http_max_keepalive_connections,
+            keepalive_expiry=settings.outbound_http_keepalive_expiry,
         ),
         trust_env=False,
     )
@@ -131,4 +150,4 @@ def create_plugin_daemon_http_client(settings: ServerSettings) -> httpx.AsyncCli
 app = create_app()
 
 
-__all__ = ["app", "create_app", "create_plugin_daemon_http_client"]
+__all__ = ["app", "create_app", "create_dify_api_inner_http_client", "create_plugin_daemon_http_client"]
diff --git a/dify-agent/src/dify_agent/server/settings.py b/dify-agent/src/dify_agent/server/settings.py
index 7c24fbb9f9b..b85fcffdc36 100644
--- a/dify-agent/src/dify_agent/server/settings.py
+++ b/dify-agent/src/dify_agent/server/settings.py
@@ -1,20 +1,24 @@
 """Configuration for the FastAPI run server.
 
-Plugin daemon HTTP client settings describe the single FastAPI lifespan-owned
-``httpx.AsyncClient`` shared by local run tasks. Layers and Agenton providers do
-not own that client, so these settings are process resource limits rather than
-per-run lifecycle knobs. The Agent Stub now also uses this main server settings
-model directly: the public Agent Stub URL, server secret, optional gRPC bind
-override, and optional Dify inner API file-request settings all live here under
-the longstanding ``DIFY_AGENT_...`` environment-variable namespace.
+Outbound HTTP client settings describe the FastAPI lifespan-owned
+``httpx.AsyncClient`` instances shared by local run tasks for plugin-daemon and
+Dify API inner calls. Layers and Agenton providers do not own those clients, so
+these settings are process resource limits rather than per-run lifecycle knobs.
+Endpoint URLs and API keys stay service-specific. The Agent Stub also uses this
+settings model directly: the public Agent Stub URL, server secret, optional gRPC
+bind override, and optional Dify inner API file/drive request settings all live
+here under the longstanding ``DIFY_AGENT_...`` environment-variable namespace.
 """
 
+import httpx
+
 from typing import ClassVar
 
 from pydantic import AnyHttpUrl, Field, TypeAdapter, field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 from dify_agent.agent_stub.protocol.agent_stub import normalize_agent_stub_url, parse_agent_stub_endpoint
+from dify_agent.agent_stub.server.agent_stub_drive import DifyApiAgentStubDriveRequestHandler
 from dify_agent.agent_stub.server.agent_stub_files import DifyApiAgentStubFileRequestHandler
 from dify_agent.agent_stub.server.grpc_bind import normalize_agent_stub_grpc_bind_address
 from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubTokenCodec, decode_server_secret_key
@@ -23,7 +27,7 @@ DEFAULT_RUN_RETENTION_SECONDS = 3 * 24 * 60 * 60
 
 
 class ServerSettings(BaseSettings):
-    """Environment-backed settings for Redis, scheduling, plugin, and shell access."""
+    """Environment-backed settings for Redis, scheduling, outbound HTTP, and shell access."""
 
     redis_url: str = "redis://localhost:6379/0"
     redis_prefix: str = "dify-agent"
@@ -31,6 +35,7 @@ class ServerSettings(BaseSettings):
     run_retention_seconds: int = Field(default=DEFAULT_RUN_RETENTION_SECONDS, ge=1)
     plugin_daemon_url: str = "http://localhost:5002"
     plugin_daemon_api_key: str = ""
+    dify_api_inner_url: str = "http://localhost:5001"
     dify_api_base_url: str | None = None
     dify_api_inner_api_key: str | None = None
     shellctl_entrypoint: str | None = None
@@ -38,13 +43,13 @@ class ServerSettings(BaseSettings):
     agent_stub_url: str | None = Field(default=None, validation_alias="DIFY_AGENT_STUB_URL")
     agent_stub_grpc_bind_address: str | None = Field(default=None, validation_alias="DIFY_AGENT_STUB_GRPC_BIND_ADDRESS")
     server_secret_key: str | None = None
-    plugin_daemon_connect_timeout: float = Field(default=10.0, ge=0)
-    plugin_daemon_read_timeout: float = Field(default=600.0, ge=0)
-    plugin_daemon_write_timeout: float = Field(default=30.0, ge=0)
-    plugin_daemon_pool_timeout: float = Field(default=10.0, ge=0)
-    plugin_daemon_max_connections: int = Field(default=100, ge=1)
-    plugin_daemon_max_keepalive_connections: int = Field(default=20, ge=0)
-    plugin_daemon_keepalive_expiry: float = Field(default=30.0, ge=0)
+    outbound_http_connect_timeout: float = Field(default=10.0, ge=0)
+    outbound_http_read_timeout: float = Field(default=600.0, ge=0)
+    outbound_http_write_timeout: float = Field(default=30.0, ge=0)
+    outbound_http_pool_timeout: float = Field(default=10.0, ge=0)
+    outbound_http_max_connections: int = Field(default=100, ge=1)
+    outbound_http_max_keepalive_connections: int = Field(default=20, ge=0)
+    outbound_http_keepalive_expiry: float = Field(default=30.0, ge=0)
 
     model_config: ClassVar[SettingsConfigDict] = SettingsConfigDict(
         env_prefix="DIFY_AGENT_",
@@ -116,7 +121,7 @@ class ServerSettings(BaseSettings):
 
     @model_validator(mode="after")
     def validate_agent_stub_requirements(self) -> "ServerSettings":
-        """Require the server secret and Dify API file settings in valid pairs."""
+        """Require Agent Stub settings while allowing knowledge-only inner API keys."""
         if self.agent_stub_url is not None and self.server_secret_key is None:
             raise ValueError("DIFY_AGENT_SERVER_SECRET_KEY is required when DIFY_AGENT_STUB_URL is set.")
         if self.agent_stub_grpc_bind_address is not None:
@@ -124,8 +129,8 @@ class ServerSettings(BaseSettings):
                 raise ValueError("DIFY_AGENT_STUB_URL is required when DIFY_AGENT_STUB_GRPC_BIND_ADDRESS is set.")
             if not parse_agent_stub_endpoint(self.agent_stub_url).is_grpc:
                 raise ValueError("DIFY_AGENT_STUB_GRPC_BIND_ADDRESS requires a grpc:// DIFY_AGENT_STUB_URL.")
-        if (self.dify_api_base_url is None) != (self.dify_api_inner_api_key is None):
-            raise ValueError("DIFY_AGENT_DIFY_API_BASE_URL and DIFY_AGENT_DIFY_API_INNER_API_KEY must be set together.")
+        if self.dify_api_base_url is not None and self.dify_api_inner_api_key is None:
+            raise ValueError("DIFY_AGENT_DIFY_API_INNER_API_KEY is required when DIFY_AGENT_DIFY_API_BASE_URL is set.")
         return self
 
     def create_agent_stub_token_codec(self) -> AgentStubTokenCodec | None:
@@ -143,5 +148,28 @@ class ServerSettings(BaseSettings):
             dify_api_inner_api_key=self.dify_api_inner_api_key,
         )
 
+    def create_agent_stub_drive_request_handler(self) -> DifyApiAgentStubDriveRequestHandler | None:
+        """Return the Dify API drive bridge when both Dify API settings are configured.
+
+        Drive manifest and commit requests should honor the same outbound timeout
+        settings as the server's other trusted Dify API HTTP calls.
+        """
+        if self.dify_api_base_url is None or self.dify_api_inner_api_key is None:
+            return None
+        return DifyApiAgentStubDriveRequestHandler(
+            dify_api_base_url=self.dify_api_base_url,
+            dify_api_inner_api_key=self.dify_api_inner_api_key,
+            timeout=self.create_outbound_http_timeout(),
+        )
+
+    def create_outbound_http_timeout(self) -> httpx.Timeout:
+        """Build one shared outbound HTTP timeout object from server settings."""
+        return httpx.Timeout(
+            connect=self.outbound_http_connect_timeout,
+            read=self.outbound_http_read_timeout,
+            write=self.outbound_http_write_timeout,
+            pool=self.outbound_http_pool_timeout,
+        )
+
 
 __all__ = ["DEFAULT_RUN_RETENTION_SECONDS", "ServerSettings"]
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_drive.py b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_drive.py
new file mode 100644
index 00000000000..ff52bb6b4f8
--- /dev/null
+++ b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_drive.py
@@ -0,0 +1,651 @@
+from __future__ import annotations
+
+from io import BytesIO
+from pathlib import Path
+import stat
+from zipfile import ZipFile, ZipInfo
+
+import pytest
+
+from dify_agent.agent_stub.cli._drive import (
+    list_drive_from_environment,
+    pull_drive_from_environment,
+    push_drive_from_environment,
+)
+from dify_agent.agent_stub.cli._files import UploadedToolFileMapping, UploadedToolFileResource
+from dify_agent.agent_stub.client._errors import AgentStubTransferError, AgentStubValidationError
+from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitRequest,
+    AgentStubDriveCommitResponse,
+    AgentStubDriveItem,
+    AgentStubDriveManifestResponse,
+)
+
+
+def test_list_drive_from_environment_returns_manifest_json_model(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    captured: dict[str, object] = {}
+
+    def fake_manifest(**kwargs):
+        captured.update(kwargs)
+        return AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/example/SKILL.md",
+                    size=12,
+                    hash="sha256:abc",
+                    mime_type="text/markdown",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                )
+            ]
+        )
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        fake_manifest,
+    )
+
+    result = list_drive_from_environment(prefix="skills/", json_output=True)
+
+    assert isinstance(result, AgentStubDriveManifestResponse)
+    assert result.items[0].key == "skills/example/SKILL.md"
+    assert captured["prefix"] == "skills/"
+    assert captured["include_download_url"] is False
+
+
+def test_list_drive_from_environment_returns_human_readable_listing(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    captured: dict[str, object] = {}
+
+    def fake_manifest(**kwargs):
+        captured.update(kwargs)
+        return AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/example/SKILL.md",
+                    size=12,
+                    hash=None,
+                    mime_type="text/markdown",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                ),
+                AgentStubDriveItem(
+                    key="skills/example/helper.py",
+                    size=None,
+                    hash="sha256:abc",
+                    mime_type=None,
+                    file_kind="tool_file",
+                    file_id="tool-file-2",
+                ),
+            ]
+        )
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        fake_manifest,
+    )
+
+    result = list_drive_from_environment(prefix="skills/", json_output=False)
+
+    assert result == ("12\ttext/markdown\t-\tskills/example/SKILL.md\n-\t-\tsha256:abc\tskills/example/helper.py")
+    assert captured["prefix"] == "skills/"
+    assert captured["include_download_url"] is False
+
+
+def test_pull_drive_from_environment_writes_files_under_drive_base(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    captured: dict[str, object] = {}
+
+    def fake_manifest(**kwargs):
+        captured.update(kwargs)
+        return AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/example/SKILL.md",
+                    size=11,
+                    hash=None,
+                    mime_type="text/markdown",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/download",
+                )
+            ]
+        )
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        fake_manifest,
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.download_file_bytes_from_signed_url_sync",
+        lambda **_kwargs: b"hello world",
+    )
+
+    results = pull_drive_from_environment(prefix="skills/", drive_base=str(tmp_path))
+
+    assert results == [tmp_path / "skills" / "example" / "SKILL.md"]
+    assert results[0].read_bytes() == b"hello world"
+    assert captured["prefix"] == "skills/"
+    assert captured["include_download_url"] is True
+
+
+def test_pull_drive_from_environment_auto_extracts_skill_archive(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    archive_buffer = BytesIO()
+    with ZipFile(archive_buffer, mode="w") as archive:
+        archive.writestr("SKILL.md", "# Example\n")
+        archive.writestr("nested/helper.py", "print('x')\n")
+    archive_bytes = archive_buffer.getvalue()
+
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **_kwargs: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/foo/.DIFY-SKILL-FULL.zip",
+                    size=len(archive_bytes),
+                    hash=None,
+                    mime_type="application/zip",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/download",
+                )
+            ]
+        ),
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.download_file_bytes_from_signed_url_sync",
+        lambda **_kwargs: archive_bytes,
+    )
+
+    results = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+
+    archive_path = tmp_path / "skills" / "foo" / ".DIFY-SKILL-FULL.zip"
+    assert results == [archive_path]
+    assert archive_path.read_bytes() == archive_bytes
+    assert (tmp_path / "skills" / "foo" / "SKILL.md").read_text(encoding="utf-8") == "# Example\n"
+    assert (tmp_path / "skills" / "foo" / "nested" / "helper.py").read_text(encoding="utf-8") == "print('x')\n"
+
+
+def test_pull_drive_from_environment_rejects_traversal_keys(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **_kwargs: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="../escape.txt",
+                    size=4,
+                    hash=None,
+                    mime_type="text/plain",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/download",
+                )
+            ]
+        ),
+    )
+
+    with pytest.raises(AgentStubValidationError, match="outside the drive base"):
+        _ = pull_drive_from_environment(prefix="", drive_base=str(tmp_path))
+
+
+def test_pull_drive_from_environment_rejects_skill_archive_path_traversal(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    archive_buffer = BytesIO()
+    with ZipFile(archive_buffer, mode="w") as archive:
+        archive.writestr("SKILL.md", "# Example\n")
+        archive.writestr("../escape.txt", "escape")
+    archive_bytes = archive_buffer.getvalue()
+
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **_kwargs: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/foo/.DIFY-SKILL-FULL.zip",
+                    size=len(archive_bytes),
+                    hash=None,
+                    mime_type="application/zip",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/download",
+                )
+            ]
+        ),
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.download_file_bytes_from_signed_url_sync",
+        lambda **_kwargs: archive_bytes,
+    )
+
+    with pytest.raises(AgentStubValidationError, match="path traversal"):
+        _ = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+    assert not (tmp_path / "skills" / "foo" / "SKILL.md").exists()
+
+
+def test_pull_drive_from_environment_rejects_skill_archive_absolute_entry(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    archive_buffer = BytesIO()
+    with ZipFile(archive_buffer, mode="w") as archive:
+        archive.writestr("/escape.txt", "escape")
+    archive_bytes = archive_buffer.getvalue()
+
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **_kwargs: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/foo/.DIFY-SKILL-FULL.zip",
+                    size=len(archive_bytes),
+                    hash=None,
+                    mime_type="application/zip",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/download",
+                )
+            ]
+        ),
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.download_file_bytes_from_signed_url_sync",
+        lambda **_kwargs: archive_bytes,
+    )
+
+    with pytest.raises(AgentStubValidationError, match="absolute path"):
+        _ = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+
+
+def test_pull_drive_from_environment_rejects_skill_archive_symlink_entry(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    archive_buffer = BytesIO()
+    with ZipFile(archive_buffer, mode="w") as archive:
+        symlink_info = ZipInfo("linked.txt")
+        symlink_info.external_attr = (stat.S_IFLNK | 0o777) << 16
+        archive.writestr(symlink_info, "outside.txt")
+    archive_bytes = archive_buffer.getvalue()
+
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **_kwargs: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/foo/.DIFY-SKILL-FULL.zip",
+                    size=len(archive_bytes),
+                    hash=None,
+                    mime_type="application/zip",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/download",
+                )
+            ]
+        ),
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.download_file_bytes_from_signed_url_sync",
+        lambda **_kwargs: archive_bytes,
+    )
+
+    with pytest.raises(AgentStubValidationError, match="symlink entry"):
+        _ = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+
+
+def test_pull_drive_from_environment_rejects_invalid_skill_archive(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    archive_bytes = b"not-a-zip"
+
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **_kwargs: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/foo/.DIFY-SKILL-FULL.zip",
+                    size=len(archive_bytes),
+                    hash=None,
+                    mime_type="application/zip",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/download",
+                )
+            ]
+        ),
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.download_file_bytes_from_signed_url_sync",
+        lambda **_kwargs: archive_bytes,
+    )
+
+    with pytest.raises(AgentStubTransferError, match="downloaded skill archive is invalid"):
+        _ = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+
+
+def test_pull_drive_from_environment_rejects_missing_download_url(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **_kwargs: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/example/SKILL.md",
+                    size=11,
+                    hash=None,
+                    mime_type="text/markdown",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                )
+            ]
+        ),
+    )
+
+    with pytest.raises(AgentStubValidationError, match="missing download_url"):
+        _ = pull_drive_from_environment(prefix="skills/", drive_base=str(tmp_path))
+
+
+def test_pull_drive_from_environment_rejects_size_mismatch(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **_kwargs: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/example/SKILL.md",
+                    size=99,
+                    hash=None,
+                    mime_type="text/markdown",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/download",
+                )
+            ]
+        ),
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.download_file_bytes_from_signed_url_sync",
+        lambda **_kwargs: b"hello world",
+    )
+
+    with pytest.raises(AgentStubTransferError, match="size mismatch"):
+        _ = pull_drive_from_environment(prefix="skills/", drive_base=str(tmp_path))
+
+
+def test_push_drive_from_environment_commits_single_file(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    source = tmp_path / "report.pdf"
+    source.write_bytes(b"report")
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.upload_tool_file_resource_from_environment",
+        lambda *, path: UploadedToolFileResource(
+            mapping=UploadedToolFileMapping(reference="dify-file-ref:tool-file-1"),
+            tool_file_id="tool-file-1",
+        ),
+    )
+    captured: dict[str, object] = {}
+
+    def fake_commit(**kwargs):
+        captured.update(kwargs)
+        return AgentStubDriveCommitResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="files/report.pdf",
+                    size=6,
+                    hash=None,
+                    mime_type="application/pdf",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    value_owned_by_drive=True,
+                )
+            ]
+        )
+
+    monkeypatch.setattr("dify_agent.agent_stub.cli._drive.request_agent_stub_drive_commit_sync", fake_commit)
+
+    response = push_drive_from_environment(local_path=str(source), drive_path="files/report.pdf", recursive=False)
+
+    assert response.items[0].key == "files/report.pdf"
+    request = captured["request"]
+    assert isinstance(request, AgentStubDriveCommitRequest)
+    assert request.items[0].model_dump(mode="json") == {
+        "key": "files/report.pdf",
+        "file_ref": {"kind": "tool_file", "id": "tool-file-1"},
+        "value_owned_by_drive": True,
+    }
+
+
+def test_push_drive_from_environment_requires_skill_md_for_non_recursive_directory(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    skill_dir = tmp_path / "skill"
+    skill_dir.mkdir()
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+
+    with pytest.raises(AgentStubValidationError, match="SKILL.md"):
+        _ = push_drive_from_environment(local_path=str(skill_dir), drive_path="skills/example", recursive=False)
+
+
+def test_push_drive_from_environment_standardizes_non_recursive_skill_directory(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    skill_dir = tmp_path / "skill"
+    skill_dir.mkdir()
+    (skill_dir / "SKILL.md").write_text("# Example\n", encoding="utf-8")
+    (skill_dir / "helper.py").write_text("print('x')\n", encoding="utf-8")
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+
+    uploaded_paths: list[str] = []
+
+    def fake_upload(*, path: str) -> UploadedToolFileResource:
+        uploaded_paths.append(Path(path).name)
+        return UploadedToolFileResource(
+            mapping=UploadedToolFileMapping(reference=f"dify-file-ref:{Path(path).name}"),
+            tool_file_id=Path(path).name,
+        )
+
+    monkeypatch.setattr("dify_agent.agent_stub.cli._drive.upload_tool_file_resource_from_environment", fake_upload)
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_commit_sync",
+        lambda **kwargs: AgentStubDriveCommitResponse(
+            items=[
+                AgentStubDriveItem(
+                    key=item.key,
+                    size=None,
+                    hash=None,
+                    mime_type=None,
+                    file_kind=item.file_ref.kind,
+                    file_id=item.file_ref.id,
+                    value_owned_by_drive=item.value_owned_by_drive,
+                )
+                for item in kwargs["request"].items
+            ]
+        ),
+    )
+
+    response = push_drive_from_environment(local_path=str(skill_dir), drive_path="skills/example", recursive=False)
+
+    assert set(uploaded_paths) == {"SKILL.md", ".DIFY-SKILL-FULL.zip"}
+    assert {item.key for item in response.items} == {
+        "skills/example/SKILL.md",
+        "skills/example/.DIFY-SKILL-FULL.zip",
+    }
+
+
+def test_push_drive_from_environment_non_recursive_archive_excludes_transient_entries(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    skill_dir = tmp_path / "skill"
+    skill_dir.mkdir()
+    (skill_dir / "SKILL.md").write_text("# Example\n", encoding="utf-8")
+    (skill_dir / "helper.py").write_text("print('x')\n", encoding="utf-8")
+    (skill_dir / ".DIFY-SKILL-FULL.zip").write_bytes(b"old-archive")
+    git_dir = skill_dir / ".git"
+    git_dir.mkdir()
+    (git_dir / "config").write_text("[core]\n", encoding="utf-8")
+    pycache_dir = skill_dir / "__pycache__"
+    pycache_dir.mkdir()
+    (pycache_dir / "helper.pyc").write_bytes(b"compiled")
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+
+    archive_entries: list[str] = []
+
+    def fake_upload(*, path: str) -> UploadedToolFileResource:
+        if Path(path).name == ".DIFY-SKILL-FULL.zip":
+            with ZipFile(path) as archive:
+                archive_entries.extend(sorted(archive.namelist()))
+        return UploadedToolFileResource(
+            mapping=UploadedToolFileMapping(reference=f"dify-file-ref:{Path(path).name}"),
+            tool_file_id=Path(path).name,
+        )
+
+    monkeypatch.setattr("dify_agent.agent_stub.cli._drive.upload_tool_file_resource_from_environment", fake_upload)
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_commit_sync",
+        lambda **kwargs: AgentStubDriveCommitResponse(
+            items=[
+                AgentStubDriveItem(
+                    key=item.key,
+                    size=None,
+                    hash=None,
+                    mime_type=None,
+                    file_kind=item.file_ref.kind,
+                    file_id=item.file_ref.id,
+                    value_owned_by_drive=item.value_owned_by_drive,
+                )
+                for item in kwargs["request"].items
+            ]
+        ),
+    )
+
+    _ = push_drive_from_environment(local_path=str(skill_dir), drive_path="skills/example", recursive=False)
+
+    assert {"SKILL.md", "helper.py"}.issubset(archive_entries)
+    assert ".git/config" not in archive_entries
+    assert "__pycache__/helper.pyc" not in archive_entries
+    assert ".DIFY-SKILL-FULL.zip" not in archive_entries
+
+
+def test_push_drive_from_environment_non_recursive_rejects_symlinked_archive_entries(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    skill_dir = tmp_path / "skill"
+    skill_dir.mkdir()
+    (skill_dir / "SKILL.md").write_text("# Example\n", encoding="utf-8")
+    outside = tmp_path / "outside.txt"
+    outside.write_text("outside", encoding="utf-8")
+    (skill_dir / "linked.txt").symlink_to(outside)
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+
+    with pytest.raises(AgentStubValidationError, match="symlink"):
+        _ = push_drive_from_environment(local_path=str(skill_dir), drive_path="skills/example", recursive=False)
+
+
+def test_push_drive_from_environment_rejects_symlinked_recursive_files(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    root = tmp_path / "skill"
+    root.mkdir()
+    outside = tmp_path / "outside.txt"
+    outside.write_text("outside", encoding="utf-8")
+    (root / "linked.txt").symlink_to(outside)
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+
+    with pytest.raises(AgentStubValidationError, match="symlink"):
+        _ = push_drive_from_environment(local_path=str(root), drive_path="skills/example", recursive=True)
+
+
+def test_push_drive_from_environment_recursive_keeps_user_files_that_skill_packaging_skips(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    root = tmp_path / "skill"
+    root.mkdir()
+    (root / ".DIFY-SKILL-FULL.zip").write_bytes(b"archive")
+    node_modules_dir = root / "node_modules"
+    node_modules_dir.mkdir()
+    (node_modules_dir / "module.js").write_text("export default 1\n", encoding="utf-8")
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+
+    uploaded_paths: list[str] = []
+
+    def fake_upload(*, path: str) -> UploadedToolFileResource:
+        uploaded_paths.append(Path(path).relative_to(root).as_posix())
+        return UploadedToolFileResource(
+            mapping=UploadedToolFileMapping(reference=f"dify-file-ref:{Path(path).name}"),
+            tool_file_id=Path(path).name,
+        )
+
+    monkeypatch.setattr("dify_agent.agent_stub.cli._drive.upload_tool_file_resource_from_environment", fake_upload)
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_commit_sync",
+        lambda **kwargs: AgentStubDriveCommitResponse(
+            items=[
+                AgentStubDriveItem(
+                    key=item.key,
+                    size=None,
+                    hash=None,
+                    mime_type=None,
+                    file_kind=item.file_ref.kind,
+                    file_id=item.file_ref.id,
+                    value_owned_by_drive=item.value_owned_by_drive,
+                )
+                for item in kwargs["request"].items
+            ]
+        ),
+    )
+
+    response = push_drive_from_environment(local_path=str(root), drive_path="skills/example", recursive=True)
+
+    assert set(uploaded_paths) == {".DIFY-SKILL-FULL.zip", "node_modules/module.js"}
+    assert {item.key for item in response.items} == {
+        "skills/example/.DIFY-SKILL-FULL.zip",
+        "skills/example/node_modules/module.js",
+    }
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_files.py b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_files.py
index 3f2e044be5d..c5b093128fd 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_files.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_files.py
@@ -6,7 +6,11 @@ from pathlib import Path
 
 import pytest
 
-from dify_agent.agent_stub.cli._files import download_file_from_environment, upload_file_from_environment
+from dify_agent.agent_stub.cli._files import (
+    download_file_from_environment,
+    upload_file_from_environment,
+    upload_tool_file_resource_from_environment,
+)
 from dify_agent.agent_stub.client._errors import AgentStubTransferError
 
 
@@ -36,6 +40,7 @@ def test_upload_file_from_environment_requests_signed_url_and_normalizes_output(
         captured["file_bytes"] = kwargs["file_obj"].read()
         kwargs["file_obj"].seek(0)
         return {
+            "id": "tool-file-1",
             "reference": _reference("tool-file-1"),
         }
 
@@ -57,6 +62,33 @@ def test_upload_file_from_environment_requests_signed_url_and_normalizes_output(
     }
 
 
+def test_upload_tool_file_resource_from_environment_preserves_tool_file_id(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    source = tmp_path / "report.pdf"
+    source.write_bytes(b"report-bytes")
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._files.request_agent_stub_file_upload_sync",
+        lambda **_kwargs: type("Response", (), {"upload_url": "https://files.example.com/upload"})(),
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._files.upload_file_to_signed_url_sync",
+        lambda **_kwargs: {"id": "tool-file-1", "reference": _reference("tool-file-1")},
+    )
+
+    result = upload_tool_file_resource_from_environment(path=str(source))
+
+    assert result.mapping.model_dump() == {
+        "transfer_method": "tool_file",
+        "reference": _reference("tool-file-1"),
+    }
+    assert result.tool_file_id == "tool-file-1"
+
+
 def test_download_file_from_environment_saves_bytes_and_renames_on_collision(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
@@ -148,8 +180,30 @@ def test_upload_file_from_environment_rejects_non_canonical_reference(
     )
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._files.upload_file_to_signed_url_sync",
-        lambda **_kwargs: {"reference": "raw-tool-file-uuid"},
+        lambda **_kwargs: {"id": "tool-file-1", "reference": "raw-tool-file-uuid"},
     )
 
     with pytest.raises(AgentStubTransferError, match="invalid canonical reference"):
         _ = upload_file_from_environment(path=str(source))
+
+
+def test_upload_tool_file_resource_from_environment_rejects_missing_id(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    source = tmp_path / "report.pdf"
+    source.write_bytes(b"report-bytes")
+    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._files.request_agent_stub_file_upload_sync",
+        lambda **_kwargs: type("Response", (), {"upload_url": "https://files.example.com/upload"})(),
+    )
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._files.upload_file_to_signed_url_sync",
+        lambda **_kwargs: {"reference": _reference("tool-file-1")},
+    )
+
+    with pytest.raises(AgentStubTransferError, match="missing id"):
+        _ = upload_tool_file_resource_from_environment(path=str(source))
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_main.py b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_main.py
index b6fa85049b3..8699ac99e13 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_main.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_main.py
@@ -7,6 +7,11 @@ from pathlib import Path
 import pytest
 
 from dify_agent.agent_stub.cli.main import main
+from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitResponse,
+    AgentStubDriveItem,
+    AgentStubDriveManifestResponse,
+)
 from dify_agent.agent_stub.protocol.agent_stub import AgentStubConnectResponse
 
 
@@ -194,3 +199,97 @@ def test_cli_file_download_prints_saved_path(
     captured = capsys.readouterr()
     assert exc_info.value.code == 0
     assert captured.out.strip() == "/tmp/report.pdf"
+
+
+def test_cli_drive_list_prints_manifest_json(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli.main.list_drive_from_environment",
+        lambda *, prefix, json_output: AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key=prefix + "example/SKILL.md",
+                    size=12,
+                    hash="sha256:abc",
+                    mime_type="text/markdown",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                )
+            ]
+        ),
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["drive", "list", "skills/", "--json"])
+
+    captured = capsys.readouterr()
+    assert exc_info.value.code == 0
+    assert json.loads(captured.out)["items"][0]["key"] == "skills/example/SKILL.md"
+
+
+def test_cli_drive_list_prints_human_readable_listing(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli.main.list_drive_from_environment",
+        lambda *, prefix, json_output: f"12\ttext/markdown\t-\t{prefix}example/SKILL.md",
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["drive", "list", "skills/"])
+
+    captured = capsys.readouterr()
+    assert exc_info.value.code == 0
+    assert captured.out.strip() == "12\ttext/markdown\t-\tskills/example/SKILL.md"
+
+
+def test_cli_drive_pull_prints_downloaded_paths(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli.main.pull_drive_from_environment",
+        lambda *, prefix, drive_base: [Path(drive_base) / prefix / "SKILL.md", Path(drive_base) / prefix / "helper.py"],
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["drive", "pull", "skills/example", "--drive-base", "/tmp/drive"])
+
+    captured = capsys.readouterr()
+    assert exc_info.value.code == 0
+    assert captured.out.strip().splitlines() == [
+        "/tmp/drive/skills/example/SKILL.md",
+        "/tmp/drive/skills/example/helper.py",
+    ]
+
+
+def test_cli_drive_push_prints_commit_json(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli.main.push_drive_from_environment",
+        lambda *, local_path, drive_path, recursive: AgentStubDriveCommitResponse(
+            items=[
+                AgentStubDriveItem(
+                    key=drive_path,
+                    size=12,
+                    hash=None,
+                    mime_type="text/markdown",
+                    file_kind="tool_file",
+                    file_id=Path(local_path).name,
+                    value_owned_by_drive=recursive is False,
+                )
+            ]
+        ),
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["drive", "push", "/tmp/report.md", "skills/example/SKILL.md"])
+
+    captured = capsys.readouterr()
+    assert exc_info.value.code == 0
+    assert json.loads(captured.out)["items"][0]["key"] == "skills/example/SKILL.md"
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/client/test_agent_stub_client.py b/dify-agent/tests/local/dify_agent/agent_stub/client/test_agent_stub_client.py
index b97dff3e3ec..f62cc4564e9 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/client/test_agent_stub_client.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/client/test_agent_stub_client.py
@@ -11,6 +11,8 @@ import pytest
 from dify_agent.agent_stub.client._agent_stub import (
     connect_agent_stub_sync,
     download_file_bytes_from_signed_url_sync,
+    request_agent_stub_drive_commit_sync,
+    request_agent_stub_drive_manifest_sync,
     request_agent_stub_file_download_sync,
     request_agent_stub_file_upload_sync,
     upload_file_to_signed_url_sync,
@@ -23,7 +25,12 @@ from dify_agent.agent_stub.client._errors import (
     AgentStubTransferError,
     AgentStubValidationError,
 )
-from dify_agent.agent_stub.protocol.agent_stub import AgentStubFileMapping
+from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitItem,
+    AgentStubDriveCommitRequest,
+    AgentStubDriveFileRef,
+    AgentStubFileMapping,
+)
 
 
 def _reference(record_id: str) -> str:
@@ -174,6 +181,140 @@ def test_request_agent_stub_file_download_sync_posts_download_request() -> None:
     assert response.download_url == "https://files.example.com/download"
 
 
+def test_request_agent_stub_drive_manifest_sync_gets_manifest_request() -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.method == "GET"
+        assert str(request.url) == (
+            "https://agent.example.com/agent-stub/drive/manifest?prefix=skills%2F&include_download_url=true"
+        )
+        assert request.headers["Authorization"] == "Bearer test-jwe"
+        return httpx.Response(
+            200,
+            json={
+                "items": [
+                    {
+                        "key": "skills/example/SKILL.md",
+                        "size": 12,
+                        "hash": "sha256:abc",
+                        "mime_type": "text/markdown",
+                        "file_kind": "tool_file",
+                        "file_id": "tool-file-1",
+                        "created_at": 123,
+                    }
+                ]
+            },
+        )
+
+    http_client = httpx.Client(transport=httpx.MockTransport(handler))
+    try:
+        response = request_agent_stub_drive_manifest_sync(
+            url="https://agent.example.com/agent-stub",
+            auth_jwe="test-jwe",
+            prefix="skills/",
+            include_download_url=True,
+            sync_http_client=http_client,
+        )
+    finally:
+        http_client.close()
+
+    assert response.items[0].key == "skills/example/SKILL.md"
+
+
+def test_request_agent_stub_drive_commit_sync_posts_commit_request() -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.method == "POST"
+        assert str(request.url) == "https://agent.example.com/agent-stub/drive/commit"
+        assert request.headers["Authorization"] == "Bearer test-jwe"
+        assert json.loads(request.content) == {
+            "items": [
+                {
+                    "key": "skills/example/SKILL.md",
+                    "file_ref": {"kind": "tool_file", "id": "tool-file-1"},
+                    "value_owned_by_drive": True,
+                }
+            ]
+        }
+        return httpx.Response(
+            200,
+            json={
+                "items": [
+                    {
+                        "key": "skills/example/SKILL.md",
+                        "size": 12,
+                        "mime_type": "text/markdown",
+                        "file_kind": "tool_file",
+                        "file_id": "tool-file-1",
+                        "value_owned_by_drive": True,
+                    }
+                ]
+            },
+        )
+
+    http_client = httpx.Client(transport=httpx.MockTransport(handler))
+    try:
+        response = request_agent_stub_drive_commit_sync(
+            url="https://agent.example.com/agent-stub",
+            auth_jwe="test-jwe",
+            request=AgentStubDriveCommitRequest(
+                items=[
+                    AgentStubDriveCommitItem(
+                        key="skills/example/SKILL.md",
+                        file_ref=AgentStubDriveFileRef(kind="tool_file", id="tool-file-1"),
+                    )
+                ]
+            ),
+            sync_http_client=http_client,
+        )
+    finally:
+        http_client.close()
+
+    assert response.items[0].file_id == "tool-file-1"
+
+
+def test_request_agent_stub_drive_manifest_sync_maps_invalid_json_to_client_error() -> None:
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, text="not-json", headers={"Content-Type": "application/json"})
+
+    http_client = httpx.Client(transport=httpx.MockTransport(handler))
+    try:
+        with pytest.raises(AgentStubClientError, match="invalid JSON"):
+            _ = request_agent_stub_drive_manifest_sync(
+                url="https://agent.example.com/agent-stub",
+                auth_jwe="test-jwe",
+                prefix="",
+                include_download_url=False,
+                sync_http_client=http_client,
+            )
+    finally:
+        http_client.close()
+
+
+def test_request_agent_stub_drive_commit_sync_maps_non_2xx_to_http_error() -> None:
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(403, json={"detail": "forbidden"})
+
+    http_client = httpx.Client(transport=httpx.MockTransport(handler))
+    try:
+        with pytest.raises(AgentStubHTTPError, match="403") as exc_info:
+            _ = request_agent_stub_drive_commit_sync(
+                url="https://agent.example.com/agent-stub",
+                auth_jwe="test-jwe",
+                request=AgentStubDriveCommitRequest(
+                    items=[
+                        AgentStubDriveCommitItem(
+                            key="skills/example/SKILL.md",
+                            file_ref=AgentStubDriveFileRef(kind="tool_file", id="tool-file-1"),
+                        )
+                    ]
+                ),
+                sync_http_client=http_client,
+            )
+    finally:
+        http_client.close()
+
+    assert exc_info.value.detail == "forbidden"
+
+
 def test_upload_file_to_signed_url_sync_posts_multipart_file() -> None:
     def handler(request: httpx.Request) -> httpx.Response:
         assert request.method == "POST"
@@ -322,6 +463,32 @@ def test_request_agent_stub_file_download_sync_dispatches_grpc_urls(monkeypatch:
     assert response.download_url == "https://files.example.com/download"
 
 
+def test_request_agent_stub_drive_manifest_sync_rejects_grpc_urls() -> None:
+    with pytest.raises(AgentStubValidationError, match="require an HTTP Agent Stub URL"):
+        _ = request_agent_stub_drive_manifest_sync(
+            url="grpc://agent.example.com:9091",
+            auth_jwe="token",
+            prefix="skills/",
+            include_download_url=False,
+        )
+
+
+def test_request_agent_stub_drive_commit_sync_rejects_grpc_urls() -> None:
+    with pytest.raises(AgentStubValidationError, match="require an HTTP Agent Stub URL"):
+        _ = request_agent_stub_drive_commit_sync(
+            url="grpc://agent.example.com:9091",
+            auth_jwe="token",
+            request=AgentStubDriveCommitRequest(
+                items=[
+                    AgentStubDriveCommitItem(
+                        key="skills/example/SKILL.md",
+                        file_ref=AgentStubDriveFileRef(kind="tool_file", id="tool-file-1"),
+                    )
+                ]
+            ),
+        )
+
+
 def test_request_agent_stub_file_upload_grpc_sync_attaches_bearer_metadata(monkeypatch: pytest.MonkeyPatch) -> None:
     import dify_agent.agent_stub.client._agent_stub_grpc as grpc_module
 
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/protocol/test_agent_stub_protocol.py b/dify-agent/tests/local/dify_agent/agent_stub/protocol/test_agent_stub_protocol.py
index b2dd3629c10..dccde1b42b5 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/protocol/test_agent_stub_protocol.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/protocol/test_agent_stub_protocol.py
@@ -5,10 +5,16 @@ import json
 from typing import Literal
 
 import pytest
+from pydantic import ValidationError
 
 from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitItem,
+    AgentStubDriveCommitRequest,
+    AgentStubDriveFileRef,
     AgentStubFileMapping,
     agent_stub_connections_url,
+    agent_stub_drive_commit_url,
+    agent_stub_drive_manifest_url,
     agent_stub_file_download_request_url,
     agent_stub_file_upload_request_url,
     normalize_agent_stub_url,
@@ -39,6 +45,15 @@ def test_agent_stub_file_request_urls_handle_trailing_slash() -> None:
     )
 
 
+def test_agent_stub_drive_request_urls_handle_trailing_slash() -> None:
+    assert agent_stub_drive_manifest_url("https://agent.example.com/agent-stub/") == (
+        "https://agent.example.com/agent-stub/drive/manifest"
+    )
+    assert agent_stub_drive_commit_url("https://agent.example.com/agent-stub") == (
+        "https://agent.example.com/agent-stub/drive/commit"
+    )
+
+
 def test_normalize_agent_stub_url_rejects_query_and_fragment() -> None:
     with pytest.raises(ValueError, match="query string or fragment"):
         _ = normalize_agent_stub_url("https://agent.example.com/agent-stub?x=1")
@@ -98,6 +113,25 @@ def test_agent_stub_file_mapping_rejects_remote_url_with_reference() -> None:
         )
 
 
+def test_agent_stub_drive_commit_request_validates_file_refs() -> None:
+    request = AgentStubDriveCommitRequest(
+        items=[
+            AgentStubDriveCommitItem(
+                key="skills/example/SKILL.md",
+                file_ref=AgentStubDriveFileRef(kind="tool_file", id="tool-file-1"),
+            )
+        ]
+    )
+
+    assert request.items[0].file_ref.kind == "tool_file"
+
+    with pytest.raises(ValidationError, match="tool_file"):
+        _ = AgentStubDriveFileRef(kind="bad_kind", id="tool-file-1")  # pyright: ignore[reportArgumentType]
+
+    with pytest.raises(ValidationError, match="file_ref"):
+        _ = AgentStubDriveCommitItem.model_validate({"key": "skills/example/SKILL.md"})
+
+
 @pytest.mark.parametrize("transfer_method", ["tool_file", "local_file", "datasource_file"])
 def test_agent_stub_file_mapping_rejects_non_remote_with_url(
     transfer_method: Literal["tool_file", "local_file", "datasource_file"],
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_app.py b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_app.py
index be8d9e4031c..e1a53a11bb4 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_app.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_app.py
@@ -39,6 +39,8 @@ def test_create_agent_stub_app_exposes_same_stub_routes_as_module_app() -> None:
     assert "/agent-stub/connections" in created_paths
     assert "/agent-stub/files/upload-request" in created_paths
     assert "/agent-stub/files/download-request" in created_paths
+    assert "/agent-stub/drive/manifest" in created_paths
+    assert "/agent-stub/drive/commit" in created_paths
     assert created_paths == module_paths
 
 
@@ -88,3 +90,56 @@ def test_create_agent_stub_app_wires_configured_file_handler_for_upload_requests
 
     assert response.status_code == 200
     assert response.json() == {"upload_url": "https://files.example.com/upload"}
+
+
+def test_create_agent_stub_app_wires_configured_drive_handler_for_manifest_requests(monkeypatch) -> None:
+    settings = ServerSettings(
+        agent_stub_url="https://agent.example.com/agent-stub",
+        server_secret_key=_base64url_secret(b"1" * 32),
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+    token_codec = settings.create_agent_stub_token_codec()
+    assert token_codec is not None
+    token = token_codec.encode_connection_token(
+        _execution_context().model_copy(update={"agent_id": "agent-1"}), now=int(time.time()) - 1
+    )
+
+    original_async_client = httpx.AsyncClient
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert str(request.url) == (
+            "https://api.example.com/inner/api/drive/agent-agent-1/manifest"
+            "?tenant_id=tenant-1&prefix=skills%2F&include_download_url=false"
+        )
+        assert request.headers["X-Inner-Api-Key"] == "inner-secret"
+        return httpx.Response(
+            200,
+            json={
+                "items": [
+                    {
+                        "key": "skills/example/SKILL.md",
+                        "size": 12,
+                        "hash": "sha256:abc",
+                        "mime_type": "text/markdown",
+                        "file_kind": "tool_file",
+                        "file_id": "tool-file-1",
+                    }
+                ]
+            },
+        )
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.server.agent_stub_drive.httpx.AsyncClient",
+        lambda **kwargs: original_async_client(transport=httpx.MockTransport(handler), **kwargs),
+    )
+
+    client = TestClient(create_agent_stub_app(settings))
+    response = client.get(
+        "/agent-stub/drive/manifest",
+        headers={"Authorization": f"Bearer {token}"},
+        params={"prefix": "skills/"},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["items"][0]["key"] == "skills/example/SKILL.md"
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_drive.py b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_drive.py
new file mode 100644
index 00000000000..b0d07f68e00
--- /dev/null
+++ b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_drive.py
@@ -0,0 +1,266 @@
+from __future__ import annotations
+
+import asyncio
+import json
+
+import httpx
+
+from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitItem,
+    AgentStubDriveCommitRequest,
+    AgentStubDriveFileRef,
+)
+from dify_agent.agent_stub.server.agent_stub_drive import (
+    AgentStubDriveRequestError,
+    DifyApiAgentStubDriveRequestHandler,
+)
+from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubPrincipal
+from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
+
+
+def _principal() -> AgentStubPrincipal:
+    return AgentStubPrincipal(
+        execution_context=DifyExecutionContextLayerConfig(
+            tenant_id="tenant-1",
+            user_id="user-1",
+            user_from="account",
+            workflow_id="workflow-1",
+            agent_id="agent-1",
+            agent_mode="workflow_run",
+            invoke_from="service-api",
+        ),
+        session_id="session-1",
+        scope=["agent_stub:connect"],
+        token_id="token-1",
+    )
+
+
+def _patch_async_client(monkeypatch, handler) -> None:
+    original_async_client = httpx.AsyncClient
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.server.agent_stub_drive.httpx.AsyncClient",
+        lambda **kwargs: original_async_client(transport=httpx.MockTransport(handler), **kwargs),
+    )
+
+
+def test_dify_api_agent_stub_drive_handler_injects_execution_context_for_manifest(monkeypatch) -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.method == "GET"
+        assert str(request.url) == (
+            "https://api.example.com/inner/api/drive/agent-agent-1/manifest"
+            "?tenant_id=tenant-1&prefix=skills%2F&include_download_url=true"
+        )
+        assert request.headers["X-Inner-Api-Key"] == "inner-secret"
+        return httpx.Response(
+            200,
+            json={
+                "items": [
+                    {
+                        "key": "skills/example/SKILL.md",
+                        "size": 12,
+                        "hash": "sha256:abc",
+                        "mime_type": "text/markdown",
+                        "file_kind": "tool_file",
+                        "file_id": "tool-file-1",
+                        "created_at": 123,
+                        "download_url": "https://files.example.com/download",
+                    }
+                ]
+            },
+        )
+
+    _patch_async_client(monkeypatch, handler)
+    drive_handler = DifyApiAgentStubDriveRequestHandler(
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+
+    async def scenario() -> None:
+        response = await drive_handler.get_manifest(
+            principal=_principal(),
+            prefix="skills/",
+            include_download_url=True,
+        )
+        assert response.items[0].download_url == "https://files.example.com/download"
+
+    asyncio.run(scenario())
+
+
+def test_dify_api_agent_stub_drive_handler_injects_execution_context_for_commit(monkeypatch) -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.method == "POST"
+        assert str(request.url) == "https://api.example.com/inner/api/drive/agent-agent-1/commit"
+        assert json.loads(request.content) == {
+            "tenant_id": "tenant-1",
+            "user_id": "user-1",
+            "items": [
+                {
+                    "key": "skills/example/SKILL.md",
+                    "file_ref": {"kind": "tool_file", "id": "tool-file-1"},
+                    "value_owned_by_drive": True,
+                }
+            ],
+        }
+        return httpx.Response(
+            200,
+            json={
+                "items": [
+                    {
+                        "key": "skills/example/SKILL.md",
+                        "size": 12,
+                        "mime_type": "text/markdown",
+                        "file_kind": "tool_file",
+                        "file_id": "tool-file-1",
+                        "value_owned_by_drive": True,
+                    }
+                ]
+            },
+        )
+
+    _patch_async_client(monkeypatch, handler)
+    drive_handler = DifyApiAgentStubDriveRequestHandler(
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+
+    async def scenario() -> None:
+        response = await drive_handler.commit(
+            principal=_principal(),
+            request=AgentStubDriveCommitRequest(
+                items=[
+                    AgentStubDriveCommitItem(
+                        key="skills/example/SKILL.md",
+                        file_ref=AgentStubDriveFileRef(kind="tool_file", id="tool-file-1"),
+                    )
+                ]
+            ),
+        )
+        assert response.items[0].value_owned_by_drive is True
+
+    asyncio.run(scenario())
+
+
+def test_dify_api_agent_stub_drive_handler_rejects_missing_agent_id() -> None:
+    drive_handler = DifyApiAgentStubDriveRequestHandler(
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+    principal = _principal()
+    principal.execution_context = principal.execution_context.model_copy(update={"agent_id": None})
+
+    async def scenario() -> None:
+        try:
+            await drive_handler.get_manifest(principal=principal, prefix="", include_download_url=False)
+        except AgentStubDriveRequestError as exc:
+            assert exc.status_code == 400
+            assert "agent_id" in str(exc)
+        else:
+            raise AssertionError("expected AgentStubDriveRequestError")
+
+    asyncio.run(scenario())
+
+
+def test_dify_api_agent_stub_drive_handler_rejects_missing_user_id_for_commit() -> None:
+    drive_handler = DifyApiAgentStubDriveRequestHandler(
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+    principal = _principal()
+    principal.execution_context = principal.execution_context.model_copy(update={"user_id": None})
+
+    async def scenario() -> None:
+        try:
+            await drive_handler.commit(
+                principal=principal,
+                request=AgentStubDriveCommitRequest(
+                    items=[
+                        AgentStubDriveCommitItem(
+                            key="skills/example/SKILL.md",
+                            file_ref=AgentStubDriveFileRef(kind="tool_file", id="tool-file-1"),
+                        )
+                    ]
+                ),
+            )
+        except AgentStubDriveRequestError as exc:
+            assert exc.status_code == 400
+            assert "user_id" in str(exc)
+        else:
+            raise AssertionError("expected AgentStubDriveRequestError")
+
+    asyncio.run(scenario())
+
+
+def test_dify_api_agent_stub_drive_handler_maps_invalid_json_response(monkeypatch) -> None:
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, text="not-json", headers={"Content-Type": "application/json"})
+
+    _patch_async_client(monkeypatch, handler)
+    drive_handler = DifyApiAgentStubDriveRequestHandler(
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+
+    async def scenario() -> None:
+        try:
+            await drive_handler.get_manifest(principal=_principal(), prefix="skills/", include_download_url=False)
+        except AgentStubDriveRequestError as exc:
+            assert exc.status_code == 502
+            assert exc.detail == "Dify API drive request returned invalid JSON"
+        else:
+            raise AssertionError("expected AgentStubDriveRequestError")
+
+    asyncio.run(scenario())
+
+
+def test_dify_api_agent_stub_drive_handler_rejects_malformed_success_payload(monkeypatch) -> None:
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json={"unexpected": []})
+
+    _patch_async_client(monkeypatch, handler)
+    drive_handler = DifyApiAgentStubDriveRequestHandler(
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+
+    async def scenario() -> None:
+        try:
+            await drive_handler.get_manifest(principal=_principal(), prefix="skills/", include_download_url=False)
+        except AgentStubDriveRequestError as exc:
+            assert exc.status_code == 502
+            assert exc.detail == "Dify API drive manifest response is invalid"
+        else:
+            raise AssertionError("expected AgentStubDriveRequestError")
+
+    asyncio.run(scenario())
+
+
+def test_dify_api_agent_stub_drive_handler_preserves_non_2xx_detail(monkeypatch) -> None:
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(404, json={"code": "source_not_found", "message": "missing file"})
+
+    _patch_async_client(monkeypatch, handler)
+    drive_handler = DifyApiAgentStubDriveRequestHandler(
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+
+    async def scenario() -> None:
+        try:
+            await drive_handler.commit(
+                principal=_principal(),
+                request=AgentStubDriveCommitRequest(
+                    items=[
+                        AgentStubDriveCommitItem(
+                            key="skills/example/SKILL.md",
+                            file_ref=AgentStubDriveFileRef(kind="tool_file", id="tool-file-1"),
+                        )
+                    ]
+                ),
+            )
+        except AgentStubDriveRequestError as exc:
+            assert exc.status_code == 404
+            assert exc.detail == {"code": "source_not_found", "message": "missing file"}
+        else:
+            raise AssertionError("expected AgentStubDriveRequestError")
+
+    asyncio.run(scenario())
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_routes.py b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_routes.py
index fb3fd264f29..ab285cc681a 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_routes.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_routes.py
@@ -8,7 +8,14 @@ from typing import cast
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
 
-from dify_agent.agent_stub.protocol.agent_stub import AgentStubFileDownloadResponse, AgentStubFileUploadResponse
+from dify_agent.agent_stub.protocol.agent_stub import (
+    AgentStubDriveCommitResponse,
+    AgentStubDriveItem,
+    AgentStubDriveManifestResponse,
+    AgentStubFileDownloadResponse,
+    AgentStubFileUploadResponse,
+)
+from dify_agent.agent_stub.server.agent_stub_drive import AgentStubDriveRequestError, AgentStubDriveRequestHandler
 from dify_agent.agent_stub.server.agent_stub_files import AgentStubFileRequestError, AgentStubFileRequestHandler
 from dify_agent.agent_stub.server.routes.agent_stub import create_agent_stub_http_router
 from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubTokenCodec
@@ -261,3 +268,137 @@ def test_agent_stub_file_route_preserves_structured_handler_error_details() -> N
 
     assert response.status_code == 400
     assert response.json()["detail"] == {"detail": "bad request", "code": "inner_api_error"}
+
+
+def test_agent_stub_drive_manifest_route_forwards_authenticated_request() -> None:
+    codec = _token_codec()
+    token = codec.encode_connection_token(_execution_context(), now=int(time.time()) - 1)
+
+    class FakeDriveHandler:
+        async def get_manifest(self, *, principal, prefix, include_download_url):
+            assert principal.execution_context.user_id == "user-1"
+            assert prefix == "skills/"
+            assert include_download_url is True
+            return AgentStubDriveManifestResponse(
+                items=[
+                    AgentStubDriveItem(
+                        key="skills/example/SKILL.md",
+                        size=12,
+                        hash="sha256:abc",
+                        mime_type="text/markdown",
+                        file_kind="tool_file",
+                        file_id="tool-file-1",
+                        created_at=123,
+                        download_url="https://files.example.com/download",
+                    )
+                ]
+            )
+
+        async def commit(self, *, principal, request):
+            del principal, request
+            raise AssertionError("unexpected commit request")
+
+    drive_handler = cast(AgentStubDriveRequestHandler, cast(object, FakeDriveHandler()))
+    app = FastAPI()
+    app.include_router(create_agent_stub_http_router(codec, None, drive_handler))
+    client = TestClient(app)
+
+    response = client.get(
+        "/agent-stub/drive/manifest",
+        headers={"Authorization": f"Bearer {token}"},
+        params={"prefix": "skills/", "include_download_url": "true"},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["items"][0]["key"] == "skills/example/SKILL.md"
+
+
+def test_agent_stub_drive_commit_route_forwards_authenticated_request() -> None:
+    codec = _token_codec()
+    token = codec.encode_connection_token(_execution_context(), now=int(time.time()) - 1)
+
+    class FakeDriveHandler:
+        async def commit(self, *, principal, request):
+            assert principal.execution_context.user_id == "user-1"
+            assert request.items[0].file_ref.id == "tool-file-1"
+            return AgentStubDriveCommitResponse(
+                items=[
+                    AgentStubDriveItem(
+                        key="skills/example/SKILL.md",
+                        size=12,
+                        hash=None,
+                        mime_type="text/markdown",
+                        file_kind="tool_file",
+                        file_id="tool-file-1",
+                        value_owned_by_drive=True,
+                    )
+                ]
+            )
+
+        async def get_manifest(self, *, principal, prefix, include_download_url):
+            del principal, prefix, include_download_url
+            raise AssertionError("unexpected manifest request")
+
+    drive_handler = cast(AgentStubDriveRequestHandler, cast(object, FakeDriveHandler()))
+    app = FastAPI()
+    app.include_router(create_agent_stub_http_router(codec, None, drive_handler))
+    client = TestClient(app)
+
+    response = client.post(
+        "/agent-stub/drive/commit",
+        headers={"Authorization": f"Bearer {token}"},
+        json={"items": [{"key": "skills/example/SKILL.md", "file_ref": {"kind": "tool_file", "id": "tool-file-1"}}]},
+    )
+
+    assert response.status_code == 200
+    assert response.json()["items"][0]["file_id"] == "tool-file-1"
+
+
+def test_agent_stub_drive_routes_return_503_when_drive_api_is_unconfigured() -> None:
+    codec = _token_codec()
+    token = codec.encode_connection_token(_execution_context(), now=int(time.time()) - 1)
+    app = FastAPI()
+    app.include_router(create_agent_stub_http_router(codec, None, None))
+    client = TestClient(app)
+
+    manifest_response = client.get(
+        "/agent-stub/drive/manifest",
+        headers={"Authorization": f"Bearer {token}"},
+    )
+    commit_response = client.post(
+        "/agent-stub/drive/commit",
+        headers={"Authorization": f"Bearer {token}"},
+        json={"items": [{"key": "skills/example/SKILL.md", "file_ref": {"kind": "tool_file", "id": "tool-file-1"}}]},
+    )
+
+    assert manifest_response.status_code == 503
+    assert commit_response.status_code == 503
+    assert manifest_response.json()["detail"] == "Agent Stub drive API is not configured"
+    assert commit_response.json()["detail"] == "Agent Stub drive API is not configured"
+
+
+def test_agent_stub_drive_route_preserves_structured_handler_error_details() -> None:
+    codec = _token_codec()
+    token = codec.encode_connection_token(_execution_context(), now=int(time.time()) - 1)
+
+    class FakeDriveHandler:
+        async def get_manifest(self, *, principal, prefix, include_download_url):
+            del principal, prefix, include_download_url
+            raise AgentStubDriveRequestError(400, {"code": "invalid_key", "message": "bad request"})
+
+        async def commit(self, *, principal, request):
+            del principal, request
+            raise AssertionError("unexpected commit request")
+
+    drive_handler = cast(AgentStubDriveRequestHandler, cast(object, FakeDriveHandler()))
+    app = FastAPI()
+    app.include_router(create_agent_stub_http_router(codec, None, drive_handler))
+    client = TestClient(app)
+
+    response = client.get(
+        "/agent-stub/drive/manifest",
+        headers={"Authorization": f"Bearer {token}"},
+    )
+
+    assert response.status_code == 400
+    assert response.json()["detail"] == {"code": "invalid_key", "message": "bad request"}
diff --git a/api/tests/unit_tests/controllers/openapi/__init__.py b/dify-agent/tests/local/dify_agent/layers/knowledge/__init__.py
similarity index 100%
rename from api/tests/unit_tests/controllers/openapi/__init__.py
rename to dify-agent/tests/local/dify_agent/layers/knowledge/__init__.py
diff --git a/dify-agent/tests/local/dify_agent/layers/knowledge/test_client.py b/dify-agent/tests/local/dify_agent/layers/knowledge/test_client.py
new file mode 100644
index 00000000000..9e2ca5462f8
--- /dev/null
+++ b/dify-agent/tests/local/dify_agent/layers/knowledge/test_client.py
@@ -0,0 +1,248 @@
+import json
+from unittest.mock import AsyncMock
+
+import httpx
+import pytest
+
+from dify_agent.layers.knowledge.client import DifyKnowledgeBaseClient, DifyKnowledgeBaseClientError
+from dify_agent.layers.knowledge.configs import (
+    DifyKnowledgeMetadataFilteringConfig,
+    DifyKnowledgeRetrievalConfig,
+)
+
+
+def _retrieval_config() -> DifyKnowledgeRetrievalConfig:
+    return DifyKnowledgeRetrievalConfig(mode="multiple", top_k=4, score_threshold=0.2)
+
+
+def _metadata_filtering() -> DifyKnowledgeMetadataFilteringConfig:
+    return DifyKnowledgeMetadataFilteringConfig(mode="disabled")
+
+
+def test_knowledge_client_posts_inner_api_request_with_static_controls() -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert str(request.url) == "http://dify-api/inner/api/knowledge/retrieve"
+        assert request.headers["X-Inner-Api-Key"] == "inner-secret"
+        payload = json.loads(request.content.decode("utf-8"))
+        assert payload == {
+            "caller": {
+                "tenant_id": "tenant-1",
+                "user_id": "user-1",
+                "app_id": "app-1",
+                "user_from": "account",
+                "invoke_from": "agent_app",
+            },
+            "dataset_ids": ["dataset-1"],
+            "query": "reset password",
+            "retrieval": {
+                "mode": "multiple",
+                "top_k": 4,
+                "score_threshold": 0.2,
+                "reranking_mode": "reranking_model",
+                "reranking_enable": True,
+                "reranking_model": None,
+                "weights": None,
+            },
+            "metadata_filtering": {"mode": "disabled"},
+            "attachment_ids": [],
+        }
+        return httpx.Response(
+            200,
+            json={
+                "results": [
+                    {
+                        "metadata": {
+                            "_source": "knowledge",
+                            "dataset_name": "Docs",
+                            "document_name": "FAQ.md",
+                            "score": 0.9,
+                        },
+                        "title": "FAQ",
+                        "files": [],
+                        "content": "Use the reset link.",
+                        "summary": None,
+                    }
+                ],
+                "usage": {},
+            },
+        )
+
+    async def scenario() -> None:
+        async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as http_client:
+            client = DifyKnowledgeBaseClient(
+                base_url="http://dify-api",
+                api_key="inner-secret",
+                http_client=http_client,
+            )
+            response = await client.retrieve(
+                tenant_id="tenant-1",
+                user_id="user-1",
+                app_id="app-1",
+                user_from="account",
+                invoke_from="agent_app",
+                dataset_ids=["dataset-1"],
+                query="reset password",
+                retrieval=_retrieval_config(),
+                metadata_filtering=_metadata_filtering(),
+            )
+            assert response.results[0].metadata.dataset_name == "Docs"
+
+    import asyncio
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_client_marks_retryable_http_failures() -> None:
+    async def scenario() -> None:
+        async with httpx.AsyncClient(
+            transport=httpx.MockTransport(
+                lambda _request: httpx.Response(
+                    502, json={"code": "external_knowledge_failed", "message": "bad gateway"}
+                )
+            )
+        ) as http_client:
+            client = DifyKnowledgeBaseClient(
+                base_url="http://dify-api", api_key="inner-secret", http_client=http_client
+            )
+            with pytest.raises(DifyKnowledgeBaseClientError) as exc_info:
+                _ = await client.retrieve(
+                    tenant_id="tenant-1",
+                    user_id="user-1",
+                    app_id="app-1",
+                    user_from="account",
+                    invoke_from="agent_app",
+                    dataset_ids=["dataset-1"],
+                    query="reset password",
+                    retrieval=_retrieval_config(),
+                    metadata_filtering=_metadata_filtering(),
+                )
+            assert exc_info.value.status_code == 502
+            assert exc_info.value.error_code == "external_knowledge_failed"
+            assert exc_info.value.retryable is True
+
+    import asyncio
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_client_marks_non_retryable_http_failures() -> None:
+    async def scenario() -> None:
+        async with httpx.AsyncClient(
+            transport=httpx.MockTransport(
+                lambda _request: httpx.Response(
+                    403,
+                    json={"code": "dataset_tenant_mismatch", "message": "forbidden"},
+                )
+            )
+        ) as http_client:
+            client = DifyKnowledgeBaseClient(
+                base_url="http://dify-api", api_key="inner-secret", http_client=http_client
+            )
+            with pytest.raises(DifyKnowledgeBaseClientError) as exc_info:
+                _ = await client.retrieve(
+                    tenant_id="tenant-1",
+                    user_id="user-1",
+                    app_id="app-1",
+                    user_from="account",
+                    invoke_from="agent_app",
+                    dataset_ids=["dataset-1"],
+                    query="reset password",
+                    retrieval=_retrieval_config(),
+                    metadata_filtering=_metadata_filtering(),
+                )
+            assert exc_info.value.status_code == 403
+            assert exc_info.value.error_code == "dataset_tenant_mismatch"
+            assert exc_info.value.retryable is False
+
+    import asyncio
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_client_rejects_malformed_success_response() -> None:
+    async def scenario() -> None:
+        async with httpx.AsyncClient(
+            transport=httpx.MockTransport(lambda _request: httpx.Response(200, json={"bad": []}))
+        ) as http_client:
+            client = DifyKnowledgeBaseClient(
+                base_url="http://dify-api", api_key="inner-secret", http_client=http_client
+            )
+            with pytest.raises(DifyKnowledgeBaseClientError) as exc_info:
+                _ = await client.retrieve(
+                    tenant_id="tenant-1",
+                    user_id="user-1",
+                    app_id="app-1",
+                    user_from="account",
+                    invoke_from="agent_app",
+                    dataset_ids=["dataset-1"],
+                    query="reset password",
+                    retrieval=_retrieval_config(),
+                    metadata_filtering=_metadata_filtering(),
+                )
+            assert exc_info.value.error_code == "invalid_response"
+            assert exc_info.value.retryable is False
+
+    import asyncio
+
+    asyncio.run(scenario())
+
+
+@pytest.mark.parametrize(
+    "error_factory",
+    [
+        lambda request: httpx.ReadTimeout("timed out", request=request),
+        lambda request: httpx.ConnectError("connection failed", request=request),
+    ],
+)
+def test_knowledge_client_marks_transport_failures_retryable(error_factory) -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        raise error_factory(request)
+
+    async def scenario() -> None:
+        async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as http_client:
+            client = DifyKnowledgeBaseClient(
+                base_url="http://dify-api", api_key="inner-secret", http_client=http_client
+            )
+            with pytest.raises(DifyKnowledgeBaseClientError) as exc_info:
+                _ = await client.retrieve(
+                    tenant_id="tenant-1",
+                    user_id="user-1",
+                    app_id="app-1",
+                    user_from="account",
+                    invoke_from="agent_app",
+                    dataset_ids=["dataset-1"],
+                    query="reset password",
+                    retrieval=_retrieval_config(),
+                    metadata_filtering=_metadata_filtering(),
+                )
+            assert exc_info.value.retryable is True
+
+    import asyncio
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_client_treats_invalid_url_errors_as_non_retryable_configuration_error() -> None:
+    async def scenario() -> None:
+        async with httpx.AsyncClient() as http_client:
+            http_client.post = AsyncMock(side_effect=httpx.UnsupportedProtocol("unsupported protocol"))
+            client = DifyKnowledgeBaseClient(
+                base_url="http://dify-api", api_key="inner-secret", http_client=http_client
+            )
+            with pytest.raises(DifyKnowledgeBaseClientError) as exc_info:
+                _ = await client.retrieve(
+                    tenant_id="tenant-1",
+                    user_id="user-1",
+                    app_id="app-1",
+                    user_from="account",
+                    invoke_from="agent_app",
+                    dataset_ids=["dataset-1"],
+                    query="reset password",
+                    retrieval=_retrieval_config(),
+                    metadata_filtering=_metadata_filtering(),
+                )
+            assert exc_info.value.retryable is False
+
+    import asyncio
+
+    asyncio.run(scenario())
diff --git a/dify-agent/tests/local/dify_agent/layers/knowledge/test_configs.py b/dify-agent/tests/local/dify_agent/layers/knowledge/test_configs.py
new file mode 100644
index 00000000000..f28939e329b
--- /dev/null
+++ b/dify-agent/tests/local/dify_agent/layers/knowledge/test_configs.py
@@ -0,0 +1,65 @@
+import pytest
+from pydantic import ValidationError
+
+from dify_agent.layers.knowledge import DifyKnowledgeBaseLayerConfig
+
+
+def _valid_config() -> dict[str, object]:
+    return {
+        "dataset_ids": ["dataset-1"],
+        "retrieval": {
+            "mode": "multiple",
+            "top_k": 4,
+        },
+    }
+
+
+def test_knowledge_base_config_accepts_valid_multiple_mode() -> None:
+    config = DifyKnowledgeBaseLayerConfig.model_validate(_valid_config())
+
+    assert config.dataset_ids == ["dataset-1"]
+    assert config.retrieval.top_k == 4
+    assert config.metadata_filtering.mode == "disabled"
+
+
+@pytest.mark.parametrize(
+    "payload, expected_message",
+    [
+        ({"dataset_ids": [], "retrieval": {"mode": "multiple", "top_k": 4}}, "dataset_ids"),
+        ({"tool_name": "knowledge_base_search", **_valid_config()}, "Extra inputs are not permitted"),
+        ({"tool_description": "Search knowledge", **_valid_config()}, "Extra inputs are not permitted"),
+        ({"dataset_ids": ["dataset-1"], "retrieval": {"mode": "multiple"}}, "top_k"),
+        ({"dataset_ids": ["dataset-1"], "retrieval": {"mode": "single"}}, "retrieval.model"),
+        (
+            {
+                "dataset_ids": ["dataset-1"],
+                "retrieval": {"mode": "multiple", "top_k": 4},
+                "metadata_filtering": {"mode": "automatic"},
+            },
+            "metadata_filtering.model_config",
+        ),
+        (
+            {
+                "dataset_ids": ["dataset-1"],
+                "retrieval": {"mode": "multiple", "top_k": 4},
+                "metadata_filtering": {"mode": "manual"},
+            },
+            "metadata_filtering.conditions",
+        ),
+    ],
+)
+def test_knowledge_base_config_rejects_invalid_inputs(payload: dict[str, object], expected_message: str) -> None:
+    with pytest.raises(ValidationError, match=expected_message):
+        _ = DifyKnowledgeBaseLayerConfig.model_validate(payload)
+
+
+def test_knowledge_base_config_rejects_observation_limit_smaller_than_result_limit() -> None:
+    with pytest.raises(ValidationError, match="max_observation_chars"):
+        _ = DifyKnowledgeBaseLayerConfig.model_validate(
+            {
+                "dataset_ids": ["dataset-1"],
+                "retrieval": {"mode": "multiple", "top_k": 4},
+                "max_result_content_chars": 50,
+                "max_observation_chars": 20,
+            }
+        )
diff --git a/dify-agent/tests/local/dify_agent/layers/knowledge/test_layer.py b/dify-agent/tests/local/dify_agent/layers/knowledge/test_layer.py
new file mode 100644
index 00000000000..5db74d6f452
--- /dev/null
+++ b/dify-agent/tests/local/dify_agent/layers/knowledge/test_layer.py
@@ -0,0 +1,417 @@
+import asyncio
+import json
+
+import httpx
+import pytest
+from pydantic_ai import Tool
+
+from agenton.compositor import Compositor, LayerNode, LayerProvider
+from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
+from dify_agent.layers.execution_context.layer import DifyExecutionContextLayer
+from dify_agent.layers.knowledge.client import DifyKnowledgeBaseClientError
+from dify_agent.layers.knowledge.configs import DifyKnowledgeBaseLayerConfig
+from dify_agent.layers.knowledge.layer import (
+    BLANK_QUERY_OBSERVATION,
+    DifyKnowledgeBaseLayer,
+    NO_RESULTS_OBSERVATION,
+    TEMPORARY_UNAVAILABLE_OBSERVATION,
+)
+
+
+def _execution_context_config(**overrides: object) -> DifyExecutionContextLayerConfig:
+    payload: dict[str, object] = {
+        "tenant_id": "tenant-1",
+        "user_id": "user-1",
+        "user_from": "account",
+        "app_id": "app-1",
+        "agent_mode": "agent_app",
+        "invoke_from": "web-app",
+    }
+    payload.update(overrides)
+    return DifyExecutionContextLayerConfig.model_validate(payload)
+
+
+def _knowledge_config(**overrides: object) -> DifyKnowledgeBaseLayerConfig:
+    payload: dict[str, object] = {
+        "dataset_ids": ["dataset-1"],
+        "retrieval": {"mode": "multiple", "top_k": 4},
+    }
+    payload.update(overrides)
+    return DifyKnowledgeBaseLayerConfig.model_validate(payload)
+
+
+def _execution_context_provider() -> LayerProvider[DifyExecutionContextLayer]:
+    return LayerProvider.from_factory(
+        layer_type=DifyExecutionContextLayer,
+        create=lambda config: DifyExecutionContextLayer.from_config_with_settings(
+            DifyExecutionContextLayerConfig.model_validate(config),
+            daemon_url="http://plugin-daemon",
+            daemon_api_key="daemon-secret",
+        ),
+    )
+
+
+def _knowledge_provider() -> LayerProvider[DifyKnowledgeBaseLayer]:
+    return LayerProvider.from_factory(
+        layer_type=DifyKnowledgeBaseLayer,
+        create=lambda config: DifyKnowledgeBaseLayer.from_config_with_settings(
+            DifyKnowledgeBaseLayerConfig.model_validate(config),
+            dify_api_inner_url="http://dify-api",
+            dify_api_inner_api_key="inner-secret",
+        ),
+    )
+
+
+def test_knowledge_layer_exposes_one_query_only_tool_definition() -> None:
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient() as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                tool_def = await tool.prepare_tool_def(None)  # pyright: ignore[reportArgumentType]
+                assert isinstance(tool, Tool)
+                assert tool.name == "knowledge_base_search"
+                assert tool.description == "Search configured knowledge bases for information relevant to the query."
+                assert tool_def is not None
+                assert (
+                    tool_def.description == "Search configured knowledge bases for information relevant to the query."
+                )
+                assert tool_def.parameters_json_schema == {
+                    "type": "object",
+                    "properties": {
+                        "query": {
+                            "type": "string",
+                            "description": "Search query for the configured knowledge bases.",
+                        }
+                    },
+                    "required": ["query"],
+                    "additionalProperties": False,
+                }
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_layer_rejects_blank_query_locally() -> None:
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient() as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                result = await tool.function_schema.call({"query": "   "}, None)  # pyright: ignore[reportArgumentType]
+                assert result == BLANK_QUERY_OBSERVATION
+
+    asyncio.run(scenario())
+
+
+@pytest.mark.parametrize(
+    ("field_name", "field_value"),
+    [
+        ("user_id", None),
+        ("user_from", None),
+        ("app_id", None),
+    ],
+)
+def test_knowledge_layer_fails_fast_when_execution_context_is_missing_required_fields(
+    field_name: str,
+    field_value: object,
+) -> None:
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient() as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(),
+                }
+            ) as run:
+                execution_context_layer = run.get_layer("execution_context", DifyExecutionContextLayer)
+                setattr(execution_context_layer.config, field_name, field_value)
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                with pytest.raises(ValueError, match=field_name):
+                    _ = await knowledge_layer.get_tools(http_client=http_client)
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_layer_formats_results_and_truncates_observation() -> None:
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json={
+                "results": [
+                    {
+                        "metadata": {
+                            "_source": "knowledge",
+                            "dataset_name": "Docs",
+                            "document_name": "Guide.md",
+                            "score": 0.9,
+                        },
+                        "title": "Guide",
+                        "files": [],
+                        "content": "ABCDEFGHIJKL",
+                        "summary": None,
+                    }
+                ],
+                "usage": {},
+            },
+        )
+
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(max_result_content_chars=8, max_observation_chars=160),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                result = await tool.function_schema.call({"query": "reset"}, None)  # pyright: ignore[reportArgumentType]
+                assert result.startswith("Knowledge base search results:\n1. Title: Guide")
+                assert "Dataset: Docs" in result
+                assert "Document: Guide.md" in result
+                assert "Score: 0.9" in result
+                assert "Content: ABCDE..." in result
+                assert len(result) <= 160
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_layer_returns_no_results_observation() -> None:
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient(
+            transport=httpx.MockTransport(lambda _request: httpx.Response(200, json={"results": [], "usage": {}}))
+        ) as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                result = await tool.function_schema.call({"query": "reset"}, None)  # pyright: ignore[reportArgumentType]
+                assert result == NO_RESULTS_OBSERVATION
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_layer_converts_retryable_failures_into_observation() -> None:
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient(
+            transport=httpx.MockTransport(
+                lambda _request: httpx.Response(429, json={"code": "knowledge_rate_limited", "message": "slow down"})
+            )
+        ) as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                result = await tool.function_schema.call({"query": "reset"}, None)  # pyright: ignore[reportArgumentType]
+                assert result == TEMPORARY_UNAVAILABLE_OBSERVATION
+
+    asyncio.run(scenario())
+
+
+@pytest.mark.parametrize(
+    "transport_error",
+    [
+        lambda request: httpx.ReadTimeout("timed out", request=request),
+        lambda request: httpx.ConnectError("connection failed", request=request),
+    ],
+)
+def test_knowledge_layer_converts_retryable_transport_failures_into_observation(transport_error) -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        raise transport_error(request)
+
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                result = await tool.function_schema.call({"query": "reset"}, None)  # pyright: ignore[reportArgumentType]
+                assert result == TEMPORARY_UNAVAILABLE_OBSERVATION
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_layer_raises_non_retryable_client_errors() -> None:
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient(
+            transport=httpx.MockTransport(
+                lambda _request: httpx.Response(403, json={"code": "dataset_tenant_mismatch", "message": "forbidden"})
+            )
+        ) as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                with pytest.raises(DifyKnowledgeBaseClientError) as exc_info:
+                    await tool.function_schema.call({"query": "reset"}, None)  # pyright: ignore[reportArgumentType]
+                assert exc_info.value.status_code == 403
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_layer_raises_for_malformed_success_responses() -> None:
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient(
+            transport=httpx.MockTransport(lambda _request: httpx.Response(200, json={"bad": []}))
+        ) as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                with pytest.raises(DifyKnowledgeBaseClientError) as exc_info:
+                    await tool.function_schema.call({"query": "reset"}, None)  # pyright: ignore[reportArgumentType]
+                assert exc_info.value.error_code == "invalid_response"
+                assert exc_info.value.retryable is False
+
+    asyncio.run(scenario())
+
+
+def test_knowledge_layer_sends_execution_context_and_static_config_to_inner_api() -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        payload = json.loads(request.content.decode("utf-8"))
+        assert request.headers["X-Inner-Api-Key"] == "inner-secret"
+        assert payload["caller"] == {
+            "tenant_id": "tenant-1",
+            "user_id": "user-1",
+            "app_id": "app-1",
+            "user_from": "account",
+            "invoke_from": "web-app",
+        }
+        assert payload["dataset_ids"] == ["dataset-1", "dataset-2"]
+        assert payload["query"] == "reset"
+        assert payload["retrieval"]["top_k"] == 2
+        assert payload["metadata_filtering"] == {
+            "mode": "manual",
+            "conditions": {
+                "logical_operator": "and",
+                "conditions": [
+                    {
+                        "name": "category",
+                        "comparison_operator": "contains",
+                        "value": "auth",
+                    }
+                ],
+            },
+        }
+        return httpx.Response(200, json={"results": [], "usage": {}})
+
+    async def scenario() -> None:
+        compositor = Compositor(
+            [
+                LayerNode("execution_context", _execution_context_provider()),
+                LayerNode("knowledge", _knowledge_provider(), deps={"execution_context": "execution_context"}),
+            ]
+        )
+        async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as http_client:
+            async with compositor.enter(
+                configs={
+                    "execution_context": _execution_context_config(),
+                    "knowledge": _knowledge_config(
+                        dataset_ids=["dataset-1", "dataset-2"],
+                        retrieval={"mode": "multiple", "top_k": 2},
+                        metadata_filtering={
+                            "mode": "manual",
+                            "conditions": {
+                                "logical_operator": "and",
+                                "conditions": [
+                                    {
+                                        "name": "category",
+                                        "comparison_operator": "contains",
+                                        "value": "auth",
+                                    }
+                                ],
+                            },
+                        },
+                    ),
+                }
+            ) as run:
+                knowledge_layer = run.get_layer("knowledge", DifyKnowledgeBaseLayer)
+                tool = (await knowledge_layer.get_tools(http_client=http_client))[0]
+                result = await tool.function_schema.call({"query": "reset"}, None)  # pyright: ignore[reportArgumentType]
+                assert result == NO_RESULTS_OBSERVATION
+
+    asyncio.run(scenario())
diff --git a/dify-agent/tests/local/dify_agent/runtime/test_run_scheduler.py b/dify-agent/tests/local/dify_agent/runtime/test_run_scheduler.py
index a4a5ad8429b..e1124560ac6 100644
--- a/dify-agent/tests/local/dify_agent/runtime/test_run_scheduler.py
+++ b/dify-agent/tests/local/dify_agent/runtime/test_run_scheduler.py
@@ -120,6 +120,7 @@ def test_create_run_starts_background_task_and_returns_running() -> None:
             scheduler = RunScheduler(
                 store=store,
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
                 runner_factory=lambda _record, _request: ControlledRunner(started=started, release=release),
             )
 
@@ -144,6 +145,7 @@ def test_shutdown_marks_unfinished_runs_failed_and_appends_event() -> None:
             scheduler = RunScheduler(
                 store=store,
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
                 shutdown_grace_seconds=0,
                 runner_factory=lambda _record, _request: ControlledRunner(started=started, release=asyncio.Event()),
             )
@@ -165,7 +167,7 @@ def test_create_run_accepts_blank_prompt_and_runner_fails_asynchronously() -> No
     async def scenario() -> None:
         store = FakeStore()
         async with httpx.AsyncClient() as client:
-            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client)
+            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client, dify_api_http_client=client)
 
             record = await scheduler.create_run(_request(["", "   "]))
             await asyncio.wait_for(scheduler.active_tasks[record.run_id], timeout=1)
@@ -182,7 +184,7 @@ def test_create_run_accepts_invalid_output_schema_and_runner_fails_asynchronousl
     async def scenario() -> None:
         store = FakeStore()
         async with httpx.AsyncClient() as client:
-            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client)
+            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client, dify_api_http_client=client)
 
             record = await scheduler.create_run(
                 _request(
@@ -205,7 +207,12 @@ def test_create_run_honors_explicit_empty_layer_providers_by_failing_after_persi
     async def scenario() -> None:
         store = FakeStore()
         async with httpx.AsyncClient() as client:
-            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client, layer_providers=())
+            scheduler = RunScheduler(
+                store=store,
+                plugin_daemon_http_client=client,
+                dify_api_http_client=client,
+                layer_providers=(),
+            )
 
             record = await scheduler.create_run(_request())
             await asyncio.wait_for(scheduler.active_tasks[record.run_id], timeout=1)
@@ -222,7 +229,7 @@ def test_create_run_accepts_closed_session_snapshot_and_runner_fails_asynchronou
     async def scenario() -> None:
         store = FakeStore()
         async with httpx.AsyncClient() as client:
-            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client)
+            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client, dify_api_http_client=client)
             request = _request()
             request.session_snapshot = CompositorSessionSnapshot(
                 layers=[
@@ -248,7 +255,7 @@ def test_create_run_accepts_closed_session_snapshot_and_runner_fails_asynchronou
 def test_create_run_rejects_after_shutdown_starts() -> None:
     async def scenario() -> None:
         async with httpx.AsyncClient() as client:
-            scheduler = RunScheduler(store=FakeStore(), plugin_daemon_http_client=client)
+            scheduler = RunScheduler(store=FakeStore(), plugin_daemon_http_client=client, dify_api_http_client=client)
             await scheduler.shutdown()
 
             with pytest.raises(SchedulerStoppingError):
@@ -261,7 +268,7 @@ def test_create_run_rejects_invalid_request_after_shutdown_without_persisting()
     async def scenario() -> None:
         store = FakeStore()
         async with httpx.AsyncClient() as client:
-            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client)
+            scheduler = RunScheduler(store=store, plugin_daemon_http_client=client, dify_api_http_client=client)
             await scheduler.shutdown()
 
             with pytest.raises(SchedulerStoppingError):
@@ -282,6 +289,7 @@ def test_shutdown_waits_for_in_flight_create_to_register_before_cancelling() ->
             scheduler = RunScheduler(
                 store=store,
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
                 shutdown_grace_seconds=0,
                 runner_factory=lambda _record, _request: ControlledRunner(
                     started=runner_started, release=asyncio.Event()
diff --git a/dify-agent/tests/local/dify_agent/runtime/test_runner.py b/dify-agent/tests/local/dify_agent/runtime/test_runner.py
index c910b7c3dd9..f5ddeb72367 100644
--- a/dify-agent/tests/local/dify_agent/runtime/test_runner.py
+++ b/dify-agent/tests/local/dify_agent/runtime/test_runner.py
@@ -41,6 +41,8 @@ from dify_agent.layers.dify_plugin.configs import (
 )
 from dify_agent.layers.dify_plugin.llm_layer import DifyPluginLLMLayer
 from dify_agent.layers.dify_plugin.tools_layer import DifyPluginToolsLayer
+from dify_agent.layers.knowledge.configs import DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID, DifyKnowledgeBaseLayerConfig
+from dify_agent.layers.knowledge.layer import DifyKnowledgeBaseLayer
 from dify_agent.layers.output import DIFY_OUTPUT_LAYER_TYPE_ID, DifyOutputLayerConfig
 from dify_agent.protocol import DIFY_AGENT_HISTORY_LAYER_ID, DIFY_AGENT_MODEL_LAYER_ID, DIFY_AGENT_OUTPUT_LAYER_ID
 from dify_agent.protocol.schemas import (
@@ -357,6 +359,7 @@ def test_runner_emits_terminal_success_and_snapshot(monkeypatch: pytest.MonkeyPa
                 request=request,
                 run_id="run-1",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
             assert seen_clients == [client]
             assert client.is_closed is False
@@ -406,6 +409,7 @@ def test_runner_preserves_explicit_json_null_output(monkeypatch: pytest.MonkeyPa
                 request=request,
                 run_id="run-null-output",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -462,6 +466,7 @@ def test_runner_emits_deferred_tool_call_and_persists_pending_history(monkeypatc
                 request=request,
                 run_id="run-ask-human",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -558,6 +563,7 @@ def test_runner_resumes_with_deferred_tool_results_and_no_user_prompt(monkeypatc
                 request=request,
                 run_id="run-ask-human-initial",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
             initial_terminal = sink.events["run-ask-human-initial"][-1]
@@ -582,6 +588,7 @@ def test_runner_resumes_with_deferred_tool_results_and_no_user_prompt(monkeypatc
                 request=resumed_request,
                 run_id="run-ask-human-resume",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -657,6 +664,7 @@ def test_runner_can_emit_second_deferred_tool_call_after_resume(monkeypatch: pyt
                 request=request,
                 run_id="run-ask-human-turn-1",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
             first_terminal = sink.events["run-ask-human-turn-1"][-1]
@@ -681,6 +689,7 @@ def test_runner_can_emit_second_deferred_tool_call_after_resume(monkeypatch: pyt
                 request=resumed_request,
                 run_id="run-ask-human-turn-2",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -736,6 +745,7 @@ def test_runner_rejects_deferred_tool_call_without_history_layer(monkeypatch: py
                     request=request,
                     run_id="run-ask-human-no-history",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -785,6 +795,7 @@ def test_runner_rejects_resume_with_deferred_tool_results_without_history_layer(
                     request=request,
                     run_id="run-ask-human-resume-no-history",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -823,6 +834,7 @@ def test_runner_rejects_multiple_deferred_tool_calls(monkeypatch: pytest.MonkeyP
                     request=request,
                     run_id="run-ask-human-multi",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -861,6 +873,7 @@ def test_runner_rejects_deferred_approval_requests(monkeypatch: pytest.MonkeyPat
                     request=request,
                     run_id="run-ask-human-approval",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -960,6 +973,7 @@ def test_runner_passes_dynamic_dify_plugin_tools_to_agent(monkeypatch: pytest.Mo
                 request=request,
                 run_id="run-tools",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -970,6 +984,105 @@ def test_runner_passes_dynamic_dify_plugin_tools_to_agent(monkeypatch: pytest.Mo
     assert terminal.data.output == "done"
 
 
+def test_runner_passes_dynamic_dify_knowledge_tools_to_agent(monkeypatch: pytest.MonkeyPatch) -> None:
+    seen_tools: list[Tool[object]] = []
+
+    async def knowledge_tool() -> str:
+        return "knowledge"
+
+    def fake_get_model(_self: DifyPluginLLMLayer, *, http_client: httpx.AsyncClient):
+        assert http_client.is_closed is False
+        return TestModel(custom_output_text="done")  # pyright: ignore[reportReturnType]
+
+    async def fake_get_tools(self: DifyKnowledgeBaseLayer, *, http_client: httpx.AsyncClient) -> list[Tool[object]]:
+        assert self.config.dataset_ids == ["dataset-1"]
+        assert http_client.headers.get("X-Test-Client") == "dify-api"
+        return [Tool(knowledge_tool, name="knowledge_base_search")]
+
+    class FakeResult:
+        output: str = "done"
+
+        def new_messages(self) -> list[ModelMessage]:
+            return []
+
+    class FakeAgent:
+        async def run(self, *_args: object, **_kwargs: object) -> FakeResult:
+            return FakeResult()
+
+    def fake_create_agent(model: object, *, tools: list[Tool[object]], output_type: object) -> FakeAgent:
+        del model, output_type
+        seen_tools.extend(tools)
+        return FakeAgent()
+
+    monkeypatch.setattr(DifyPluginLLMLayer, "get_model", fake_get_model)
+    monkeypatch.setattr(DifyKnowledgeBaseLayer, "get_tools", fake_get_tools)
+    monkeypatch.setattr("dify_agent.runtime.runner.create_agent", fake_create_agent)
+
+    request = CreateRunRequest(
+        composition=RunComposition(
+            layers=[
+                RunLayerSpec(
+                    name="prompt",
+                    type="plain.prompt",
+                    config=PromptLayerConfig(prefix="system", user="hello"),
+                ),
+                RunLayerSpec(
+                    name="execution_context",
+                    type=DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID,
+                    config=DifyExecutionContextLayerConfig(
+                        tenant_id="tenant-1",
+                        user_id="user-1",
+                        user_from="account",
+                        app_id="app-1",
+                        agent_mode="workflow_run",
+                        invoke_from="service-api",
+                    ),
+                ),
+                RunLayerSpec(
+                    name=DIFY_AGENT_MODEL_LAYER_ID,
+                    type="dify.plugin.llm",
+                    deps={"execution_context": "execution_context"},
+                    config=DifyPluginLLMLayerConfig(
+                        plugin_id="langgenius/openai",
+                        model_provider="openai",
+                        model="demo-model",
+                        credentials={"api_key": "secret"},
+                    ),
+                ),
+                RunLayerSpec(
+                    name="knowledge",
+                    type=DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID,
+                    deps={"execution_context": "execution_context"},
+                    config=DifyKnowledgeBaseLayerConfig.model_validate(
+                        {
+                            "dataset_ids": ["dataset-1"],
+                            "retrieval": {"mode": "multiple", "top_k": 4},
+                        }
+                    ),
+                ),
+            ]
+        )
+    )
+    sink = InMemoryRunEventSink()
+
+    async def scenario() -> None:
+        async with (
+            httpx.AsyncClient() as plugin_client,
+            httpx.AsyncClient(headers={"X-Test-Client": "dify-api"}) as dify_api_client,
+        ):
+            await AgentRunRunner(
+                sink=sink,
+                request=request,
+                run_id="run-knowledge-tools",
+                plugin_daemon_http_client=plugin_client,
+                dify_api_http_client=dify_api_client,
+            ).run()
+
+    asyncio.run(scenario())
+
+    assert [tool.name for tool in seen_tools] == ["knowledge_base_search"]
+
+
 def test_runner_rejects_duplicate_tool_names_across_dynamic_tool_layers(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
@@ -1075,6 +1188,7 @@ def test_runner_rejects_duplicate_tool_names_across_dynamic_tool_layers(
                     request=request,
                     run_id="run-duplicate-tools",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -1182,6 +1296,7 @@ def test_runner_rejects_duplicate_tool_names_between_static_and_dynamic_tools(
                     request=request,
                     run_id="run-static-dynamic-duplicate-tools",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                     layer_providers=layer_providers,
                 ).run()
 
@@ -1297,6 +1412,7 @@ def test_runner_rejects_duplicate_tool_names_between_shell_and_other_layers(
                     request=request,
                     run_id="run-shell-duplicate-tools",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                     layer_providers=layer_providers,
                 ).run()
 
@@ -1325,6 +1441,7 @@ def test_runner_passes_temporary_system_prompt_prefix_without_history_layer(monk
                 request=_request("current user"),
                 run_id="run-no-history",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -1368,6 +1485,7 @@ def test_runner_prepends_current_system_prompt_to_stored_history_and_appends_onl
                 request=request,
                 run_id="run-history",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -1418,6 +1536,7 @@ def test_runner_with_empty_history_layer_still_sends_system_prompt_and_saves_onl
                 request=request,
                 run_id="run-empty-history",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -1468,6 +1587,7 @@ def test_runner_failure_with_history_layer_emits_failed_terminal_event_without_s
                     request=request,
                     run_id="run-history-failure",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -1499,6 +1619,7 @@ def test_runner_applies_on_exit_overrides_to_success_snapshot(monkeypatch: pytes
                 request=request,
                 run_id="run-exit",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -1559,6 +1680,7 @@ def test_runner_passes_output_layer_spec_to_agent_and_serializes_structured_resu
                 request=request,
                 run_id="run-structured-output",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
             first_terminal = sink.events["run-structured-output"][-1]
@@ -1572,6 +1694,7 @@ def test_runner_passes_output_layer_spec_to_agent_and_serializes_structured_resu
                 request=resumed_request,
                 run_id="run-structured-output-resume",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -1645,6 +1768,7 @@ def test_runner_retries_invalid_structured_output_and_eventually_succeeds(monkey
                 request=request,
                 run_id="run-output-retry-success",
                 plugin_daemon_http_client=client,
+                dify_api_http_client=client,
             ).run()
 
     asyncio.run(scenario())
@@ -1698,6 +1822,7 @@ def test_runner_fails_when_invalid_structured_output_exhausts_retries(monkeypatc
                     request=request,
                     run_id="run-output-retry-failed",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -1734,6 +1859,7 @@ def test_runner_rejects_invalid_output_layer_before_model_resolution(monkeypatch
                     request=request,
                     run_id="run-invalid-output",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -1808,6 +1934,7 @@ def test_runner_rejects_misnamed_output_layer_before_model_resolution(monkeypatc
                     request=request,
                     run_id="run-misnamed-output",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -1894,6 +2021,7 @@ def test_runner_rejects_multiple_output_layers_before_model_resolution(monkeypat
                     request=request,
                     run_id="run-duplicate-output",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -1965,6 +2093,7 @@ def test_runner_rejects_reserved_output_name_with_wrong_layer_type_before_model_
                     request=request,
                     run_id="run-wrong-output-type",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -2009,6 +2138,7 @@ def test_runner_rejects_misnamed_output_layer_before_provider_checks() -> None:
                     request=request,
                     run_id="run-misnamed-output-before-providers",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                     layer_providers=(),
                 ).run()
 
@@ -2033,6 +2163,7 @@ def test_runner_rejects_unknown_on_exit_layer_id() -> None:
                     request=request,
                     run_id="run-unknown-signal",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -2053,6 +2184,7 @@ def test_runner_honors_explicit_empty_layer_providers() -> None:
                     request=request,
                     run_id="run-empty-providers",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                     layer_providers=(),
                 ).run()
 
@@ -2074,6 +2206,7 @@ def test_runner_fails_empty_user_prompts() -> None:
                     request=request,
                     run_id="run-2",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -2094,6 +2227,7 @@ def test_runner_fails_blank_string_user_prompt_list() -> None:
                     request=request,
                     run_id="run-3",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -2114,6 +2248,7 @@ def test_runner_requires_llm_layer_id() -> None:
                     request=request,
                     run_id="run-4",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -2153,6 +2288,7 @@ def test_runner_rejects_closed_session_snapshot_as_validation_error() -> None:
                     request=request,
                     run_id="run-closed-snapshot",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -2205,6 +2341,7 @@ def test_runner_treats_missing_shell_entrypoint_as_validation_error() -> None:
                     request=request,
                     run_id="run-missing-shell-entrypoint",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                 ).run()
 
     asyncio.run(scenario())
@@ -2282,6 +2419,7 @@ def test_runner_treats_invalid_shell_snapshot_offsets_as_validation_error() -> N
                     request=request,
                     run_id="run-invalid-shell-offset",
                     plugin_daemon_http_client=client,
+                    dify_api_http_client=client,
                     layer_providers=create_default_layer_providers(shellctl_entrypoint="http://shellctl"),
                 ).run()
 
diff --git a/dify-agent/tests/local/dify_agent/server/test_app.py b/dify-agent/tests/local/dify_agent/server/test_app.py
index 534b42e764e..3983ef43506 100644
--- a/dify-agent/tests/local/dify_agent/server/test_app.py
+++ b/dify-agent/tests/local/dify_agent/server/test_app.py
@@ -13,10 +13,12 @@ from shell_session_manager.shellctl.client import ShellctlClient
 import dify_agent.server.app as app_module
 from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
 from dify_agent.layers.execution_context.layer import DifyExecutionContextLayer
+from dify_agent.layers.knowledge.configs import DifyKnowledgeBaseLayerConfig
+from dify_agent.layers.knowledge.layer import DifyKnowledgeBaseLayer
 from dify_agent.layers.shell import DifyShellLayerConfig
 from dify_agent.layers.shell.layer import DifyShellLayer
 from dify_agent.runtime.compositor_factory import DifyAgentLayerProvider
-from dify_agent.server.app import create_app, create_plugin_daemon_http_client
+from dify_agent.server.app import create_app, create_dify_api_inner_http_client, create_plugin_daemon_http_client
 from dify_agent.server.settings import ServerSettings
 from dify_agent.storage.redis_run_store import RedisRunStore
 
@@ -67,6 +69,7 @@ class FakeRunScheduler:
     shutdown_grace_seconds: float
     layer_providers: tuple[DifyAgentLayerProvider, ...]
     plugin_daemon_http_client: FakePluginDaemonHttpClient
+    dify_api_http_client: FakePluginDaemonHttpClient
     shutdown_called: bool
 
     def __init__(
@@ -74,6 +77,7 @@ class FakeRunScheduler:
         *,
         store: object,
         plugin_daemon_http_client: FakePluginDaemonHttpClient,
+        dify_api_http_client: FakePluginDaemonHttpClient,
         shutdown_grace_seconds: float,
         layer_providers: tuple[DifyAgentLayerProvider, ...],
     ) -> None:
@@ -81,6 +85,7 @@ class FakeRunScheduler:
         self.shutdown_grace_seconds = shutdown_grace_seconds
         self.layer_providers = layer_providers
         self.plugin_daemon_http_client = plugin_daemon_http_client
+        self.dify_api_http_client = dify_api_http_client
         self.shutdown_called = False
         self.created.append(self)
 
@@ -160,7 +165,22 @@ class FakeHttpxModule:
 
 
 def test_create_app_creates_scheduler_and_closes_after_shutdown(monkeypatch: pytest.MonkeyPatch) -> None:
-    fake_redis, fake_http_client = _patch_app_lifecycle(monkeypatch)
+    fake_redis = FakeRedis()
+    fake_http_client = FakePluginDaemonHttpClient()
+    fake_dify_api_http_client = FakePluginDaemonHttpClient()
+    FakeRunScheduler.created.clear()
+    FakeRedisModule.fake_redis = fake_redis
+    monkeypatch.setattr(app_module, "Redis", FakeRedisModule)
+    monkeypatch.setattr(app_module, "RunScheduler", FakeRunScheduler)
+
+    def fake_create_plugin_daemon_http_client(_settings: ServerSettings) -> FakePluginDaemonHttpClient:
+        return fake_http_client
+
+    def fake_create_dify_api_inner_http_client(_settings: ServerSettings) -> FakePluginDaemonHttpClient:
+        return fake_dify_api_http_client
+
+    monkeypatch.setattr(app_module, "create_plugin_daemon_http_client", fake_create_plugin_daemon_http_client)
+    monkeypatch.setattr(app_module, "create_dify_api_inner_http_client", fake_create_dify_api_inner_http_client)
 
     settings = ServerSettings(
         redis_url="redis://example.invalid/0",
@@ -169,19 +189,20 @@ def test_create_app_creates_scheduler_and_closes_after_shutdown(monkeypatch: pyt
         run_retention_seconds=7,
         plugin_daemon_url="http://plugin-daemon",
         plugin_daemon_api_key="daemon-secret",
+        dify_api_inner_url="http://dify-api",
         shellctl_entrypoint="http://shellctl",
         shellctl_auth_token="shell-secret",
         agent_stub_url="https://agent.example.com/agent-stub",
         server_secret_key=_base64url_secret(b"1" * 32),
         dify_api_base_url="https://api.example.com",
         dify_api_inner_api_key="inner-secret",
-        plugin_daemon_connect_timeout=1,
-        plugin_daemon_read_timeout=2,
-        plugin_daemon_write_timeout=3,
-        plugin_daemon_pool_timeout=4,
-        plugin_daemon_max_connections=5,
-        plugin_daemon_max_keepalive_connections=3,
-        plugin_daemon_keepalive_expiry=6,
+        outbound_http_connect_timeout=1,
+        outbound_http_read_timeout=2,
+        outbound_http_write_timeout=3,
+        outbound_http_pool_timeout=4,
+        outbound_http_max_connections=5,
+        outbound_http_max_keepalive_connections=3,
+        outbound_http_keepalive_expiry=6,
     )
 
     with TestClient(create_app(settings)):
@@ -207,6 +228,18 @@ def test_create_app_creates_scheduler_and_closes_after_shutdown(monkeypatch: pyt
         assert isinstance(shell_layer, DifyShellLayer)
         assert execution_context_layer.daemon_url == "http://plugin-daemon"
         assert execution_context_layer.daemon_api_key == "daemon-secret"
+        knowledge_provider = next(provider for provider in layer_providers if provider.type_id == "dify.knowledge_base")
+        knowledge_layer = knowledge_provider.create_layer(
+            DifyKnowledgeBaseLayerConfig.model_validate(
+                {
+                    "dataset_ids": ["dataset-1"],
+                    "retrieval": {"mode": "multiple", "top_k": 2},
+                }
+            )
+        )
+        assert isinstance(knowledge_layer, DifyKnowledgeBaseLayer)
+        assert knowledge_layer.dify_api_inner_url == "http://dify-api"
+        assert knowledge_layer.dify_api_inner_api_key == "inner-secret"
         assert shell_layer.shellctl_entrypoint == "http://shellctl"
         assert shell_layer.agent_stub_url == "https://agent.example.com/agent-stub"
         shellctl_client = shell_layer.shellctl_client_factory("http://shellctl")
@@ -216,6 +249,8 @@ def test_create_app_creates_scheduler_and_closes_after_shutdown(monkeypatch: pyt
         http_client = scheduler.plugin_daemon_http_client
         assert http_client is fake_http_client
         assert http_client.is_closed is False
+        assert scheduler.dify_api_http_client is fake_dify_api_http_client
+        assert scheduler.dify_api_http_client.is_closed is False
         store = scheduler.store
         assert isinstance(store, RedisRunStore)
         assert store.run_retention_seconds == 7
@@ -227,8 +262,13 @@ def test_create_app_creates_scheduler_and_closes_after_shutdown(monkeypatch: pyt
             getattr(route, "path", None) == "/agent-stub/files/download-request"
             for route in create_app(settings).routes
         )
+        assert any(
+            getattr(route, "path", None) == "/agent-stub/drive/manifest" for route in create_app(settings).routes
+        )
+        assert any(getattr(route, "path", None) == "/agent-stub/drive/commit" for route in create_app(settings).routes)
 
     assert FakeRunScheduler.created[0].shutdown_called is True
+    assert FakeRunScheduler.created[0].dify_api_http_client.is_closed is True
     assert FakeRunScheduler.created[0].plugin_daemon_http_client.is_closed is True
     assert fake_redis.closed is True
 
@@ -298,6 +338,64 @@ def test_create_app_wires_authenticated_agent_stub_file_upload_route(monkeypatch
     assert fake_redis.closed is True
 
 
+def test_create_app_wires_authenticated_agent_stub_drive_manifest_route(monkeypatch: pytest.MonkeyPatch) -> None:
+    fake_redis, fake_http_client = _patch_app_lifecycle(monkeypatch)
+    settings = ServerSettings(
+        redis_url="redis://example.invalid/0",
+        agent_stub_url="https://agent.example.com/agent-stub",
+        server_secret_key=_base64url_secret(b"1" * 32),
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+    )
+    token_codec = settings.create_agent_stub_token_codec()
+    assert token_codec is not None
+    token = token_codec.encode_connection_token(
+        _execution_context().model_copy(update={"agent_id": "agent-1"}), now=int(time.time()) - 1
+    )
+
+    original_async_client = httpx.AsyncClient
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert str(request.url) == (
+            "https://api.example.com/inner/api/drive/agent-agent-1/manifest"
+            "?tenant_id=tenant-1&prefix=skills%2F&include_download_url=false"
+        )
+        assert request.headers["X-Inner-Api-Key"] == "inner-secret"
+        return httpx.Response(
+            200,
+            json={
+                "items": [
+                    {
+                        "key": "skills/example/SKILL.md",
+                        "size": 12,
+                        "hash": "sha256:abc",
+                        "mime_type": "text/markdown",
+                        "file_kind": "tool_file",
+                        "file_id": "tool-file-1",
+                    }
+                ]
+            },
+        )
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.server.agent_stub_drive.httpx.AsyncClient",
+        lambda **kwargs: original_async_client(transport=httpx.MockTransport(handler), **kwargs),
+    )
+
+    with TestClient(create_app(settings)) as client:
+        response = client.get(
+            "/agent-stub/drive/manifest",
+            headers={"Authorization": f"Bearer {token}"},
+            params={"prefix": "skills/"},
+        )
+
+    assert response.status_code == 200
+    assert response.json()["items"][0]["key"] == "skills/example/SKILL.md"
+    assert FakeRunScheduler.created[0].shutdown_called is True
+    assert fake_http_client.is_closed is True
+    assert fake_redis.closed is True
+
+
 def test_create_app_starts_and_stops_agent_stub_grpc_server_for_grpc_url(monkeypatch: pytest.MonkeyPatch) -> None:
     fake_redis, fake_http_client = _patch_app_lifecycle(monkeypatch)
     started: dict[str, object] = {}
@@ -326,21 +424,73 @@ def test_create_app_starts_and_stops_agent_stub_grpc_server_for_grpc_url(monkeyp
     assert fake_redis.closed is True
 
 
-def test_create_plugin_daemon_http_client_uses_configured_httpx_construction_args(
+def test_create_plugin_daemon_http_client_uses_generic_outbound_httpx_construction_args(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     monkeypatch.setattr(app_module, "httpx", FakeHttpxModule)
 
-    client = create_plugin_daemon_http_client(ServerSettings())
+    client = create_plugin_daemon_http_client(
+        ServerSettings(
+            outbound_http_connect_timeout=1,
+            outbound_http_read_timeout=2,
+            outbound_http_write_timeout=3,
+            outbound_http_pool_timeout=4,
+            outbound_http_max_connections=5,
+            outbound_http_max_keepalive_connections=3,
+            outbound_http_keepalive_expiry=6,
+        )
+    )
 
     assert isinstance(client, FakePluginDaemonHttpClient)
-    assert isinstance(client.timeout, FakeTimeout)
-    assert client.timeout.connect == 10
-    assert client.timeout.read == 600
-    assert client.timeout.write == 30
-    assert client.timeout.pool == 10
+    assert client.timeout.connect == 1
+    assert client.timeout.read == 2
+    assert client.timeout.write == 3
+    assert client.timeout.pool == 4
     assert isinstance(client.limits, FakeLimits)
-    assert client.limits.max_connections == 100
-    assert client.limits.max_keepalive_connections == 20
-    assert client.limits.keepalive_expiry == 30
+    assert client.limits.max_connections == 5
+    assert client.limits.max_keepalive_connections == 3
+    assert client.limits.keepalive_expiry == 6
     assert client.trust_env is False
+
+
+def test_create_dify_api_inner_http_client_uses_generic_outbound_httpx_construction_args(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(app_module, "httpx", FakeHttpxModule)
+
+    client = create_dify_api_inner_http_client(
+        ServerSettings(
+            outbound_http_connect_timeout=1,
+            outbound_http_read_timeout=2,
+            outbound_http_write_timeout=3,
+            outbound_http_pool_timeout=4,
+            outbound_http_max_connections=5,
+            outbound_http_max_keepalive_connections=3,
+            outbound_http_keepalive_expiry=6,
+        )
+    )
+
+    assert isinstance(client, FakePluginDaemonHttpClient)
+    assert client.timeout.connect == 1
+    assert client.timeout.read == 2
+    assert client.timeout.write == 3
+    assert client.timeout.pool == 4
+    assert isinstance(client.limits, FakeLimits)
+    assert client.limits.max_connections == 5
+    assert client.limits.max_keepalive_connections == 3
+    assert client.limits.keepalive_expiry == 6
+    assert client.trust_env is False
+
+
+def test_server_settings_use_generic_outbound_http_args_for_shared_clients() -> None:
+    model_fields = ServerSettings.model_fields
+
+    assert "dify_api_inner_url" in model_fields
+    assert "dify_api_inner_api_key" in model_fields
+    assert "outbound_http_connect_timeout" in model_fields
+    assert "outbound_http_read_timeout" in model_fields
+    assert "outbound_http_write_timeout" in model_fields
+    assert "outbound_http_pool_timeout" in model_fields
+    assert "outbound_http_max_connections" in model_fields
+    assert "outbound_http_max_keepalive_connections" in model_fields
+    assert "outbound_http_keepalive_expiry" in model_fields
diff --git a/dify-agent/tests/local/dify_agent/server/test_settings.py b/dify-agent/tests/local/dify_agent/server/test_settings.py
index 07b8e09f53d..1862e5995e2 100644
--- a/dify-agent/tests/local/dify_agent/server/test_settings.py
+++ b/dify-agent/tests/local/dify_agent/server/test_settings.py
@@ -2,10 +2,13 @@ from __future__ import annotations
 
 from pathlib import Path
 import secrets
+from typing import cast
 
+import httpx
 import pytest
 from pydantic import ValidationError
 
+from dify_agent.agent_stub.server.agent_stub_drive import DifyApiAgentStubDriveRequestHandler
 from dify_agent.agent_stub.server.agent_stub_files import DifyApiAgentStubFileRequestHandler
 from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubTokenCodec
 from dify_agent.server.settings import ServerSettings
@@ -129,12 +132,13 @@ def test_server_settings_normalizes_dify_api_base_url_from_env(monkeypatch: pyte
     assert settings.dify_api_inner_api_key == "inner-secret"
 
 
-def test_server_settings_requires_dify_api_base_url_and_key_together() -> None:
-    with pytest.raises(ValidationError, match="DIFY_AGENT_DIFY_API_BASE_URL"):
+def test_server_settings_requires_inner_api_key_when_dify_api_base_url_is_set() -> None:
+    with pytest.raises(ValidationError, match="DIFY_AGENT_DIFY_API_INNER_API_KEY"):
         _ = ServerSettings(dify_api_base_url="https://api.example.com")
 
-    with pytest.raises(ValidationError, match="DIFY_AGENT_DIFY_API_BASE_URL"):
-        _ = ServerSettings(dify_api_inner_api_key="inner-secret")
+    settings = ServerSettings(dify_api_inner_api_key="inner-secret")
+    assert settings.dify_api_inner_api_key == "inner-secret"
+    assert settings.dify_api_base_url is None
 
 
 def test_server_settings_rejects_dify_api_base_url_with_query_or_fragment() -> None:
@@ -178,3 +182,29 @@ def test_server_settings_create_agent_stub_file_request_handler_returns_handler_
     assert isinstance(handler, DifyApiAgentStubFileRequestHandler)
     assert handler.dify_api_base_url == "https://api.example.com"
     assert handler.dify_api_inner_api_key == "inner-secret"
+
+
+def test_server_settings_create_agent_stub_drive_request_handler_returns_none_without_full_settings() -> None:
+    assert ServerSettings().create_agent_stub_drive_request_handler() is None
+
+
+def test_server_settings_create_agent_stub_drive_request_handler_returns_handler_when_configured() -> None:
+    settings = ServerSettings(
+        dify_api_base_url="https://api.example.com",
+        dify_api_inner_api_key="inner-secret",
+        outbound_http_connect_timeout=11,
+        outbound_http_read_timeout=22,
+        outbound_http_write_timeout=33,
+        outbound_http_pool_timeout=44,
+    )
+
+    handler = settings.create_agent_stub_drive_request_handler()
+
+    assert isinstance(handler, DifyApiAgentStubDriveRequestHandler)
+    assert handler.dify_api_base_url == "https://api.example.com"
+    assert handler.dify_api_inner_api_key == "inner-secret"
+    timeout = cast(httpx.Timeout, handler.timeout)
+    assert timeout.connect == 11
+    assert timeout.read == 22
+    assert timeout.write == 33
+    assert timeout.pool == 44
diff --git a/dify-agent/tests/local/dify_agent/test_import_boundaries.py b/dify-agent/tests/local/dify_agent/test_import_boundaries.py
index 0ac1d77615b..ecc2d548574 100644
--- a/dify-agent/tests/local/dify_agent/test_import_boundaries.py
+++ b/dify-agent/tests/local/dify_agent/test_import_boundaries.py
@@ -84,6 +84,8 @@ def test_protocol_and_dify_plugin_exports_do_not_import_server_only_modules() ->
             "dify_agent.layers.ask_human.layer",
             "dify_agent.layers.dify_plugin.llm_layer",
             "dify_agent.layers.dify_plugin.tools_layer",
+            "dify_agent.layers.knowledge.client",
+            "dify_agent.layers.knowledge.layer",
             "dify_agent.layers.output.output_layer",
             "dify_agent.layers.shell.layer",
             "dify_agent.runtime",
@@ -103,6 +105,7 @@ def test_protocol_and_dify_plugin_exports_do_not_import_server_only_modules() ->
             "dify_agent.layers.execution_context",
             "dify_agent.layers.ask_human",
             "dify_agent.layers.dify_plugin",
+            "dify_agent.layers.knowledge",
             "dify_agent.layers.output",
             "dify_agent.layers.shell",
         ],
@@ -112,6 +115,7 @@ def test_protocol_and_dify_plugin_exports_do_not_import_server_only_modules() ->
             "assert dify_agent_layers_execution_context.__all__ == ['DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID', 'DifyExecutionContextAgentMode', 'DifyExecutionContextInvokeFrom', 'DifyExecutionContextLayerConfig', 'DifyExecutionContextUserFrom']",
             "assert dify_agent_layers_ask_human.__all__ == ['AskHumanAction', 'AskHumanActionStyle', 'AskHumanField', 'AskHumanFieldType', 'AskHumanFileField', 'AskHumanFileListField', 'AskHumanParagraphField', 'AskHumanResultStatus', 'AskHumanSelectField', 'AskHumanSelectOption', 'AskHumanSelectedAction', 'AskHumanToolArgs', 'AskHumanToolResult', 'AskHumanUrgency', 'DEFAULT_ASK_HUMAN_TOOL_DESCRIPTION', 'DIFY_ASK_HUMAN_LAYER_TYPE_ID', 'DifyAskHumanLayerConfig']",
             "assert dify_agent_layers_dify_plugin.__all__ == ['DIFY_PLUGIN_LLM_LAYER_TYPE_ID', 'DIFY_PLUGIN_TOOLS_LAYER_TYPE_ID', 'DifyPluginCredentialValue', 'DifyPluginLLMLayerConfig', 'DifyPluginToolCredentialType', 'DifyPluginToolConfig', 'DifyPluginToolOption', 'DifyPluginToolParameter', 'DifyPluginToolParameterForm', 'DifyPluginToolParameterType', 'DifyPluginToolsLayerConfig', 'DifyPluginToolValue']",
+            "assert dify_agent_layers_knowledge.__all__ == ['DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID', 'DifyKnowledgeBaseLayerConfig', 'DifyKnowledgeMetadataCondition', 'DifyKnowledgeMetadataConditions', 'DifyKnowledgeMetadataFilteringConfig', 'DifyKnowledgeModelConfig', 'DifyKnowledgeRerankingModelConfig', 'DifyKnowledgeRetrievalConfig']",
             "assert dify_agent_layers_output.__all__ == ['DIFY_OUTPUT_LAYER_TYPE_ID', 'DifyOutputLayerConfig']",
             "assert dify_agent_layers_shell.__all__ == ['DIFY_SHELL_LAYER_TYPE_ID', 'DifyShellCliToolConfig', 'DifyShellEnvVarConfig', 'DifyShellLayerConfig', 'DifyShellSandboxConfig', 'DifyShellSecretRefConfig']",
         ],
diff --git a/dify-agent/tests/local/test_packaging.py b/dify-agent/tests/local/test_packaging.py
index 23ae6e65e8b..bc76ede8ed7 100644
--- a/dify-agent/tests/local/test_packaging.py
+++ b/dify-agent/tests/local/test_packaging.py
@@ -16,7 +16,7 @@ CLIENT_SHARED_DTO_DEPENDENCIES = {
 
 SERVER_RUNTIME_DEPENDENCIES = {
     "fastapi==0.136.0",
-    "graphon==0.5.1",
+    "graphon==0.5.2",
     "jsonschema>=4.23.0,<5.0.0",
     "jwcrypto>=1.5.6,<2",
     "pydantic-ai-slim[anthropic,google,openai]>=1.85.1,<2.0.0",
diff --git a/dify-agent/uv.lock b/dify-agent/uv.lock
index 0ee1bf4f8bf..bd99e89a439 100644
--- a/dify-agent/uv.lock
+++ b/dify-agent/uv.lock
@@ -628,7 +628,7 @@ docs = [
 [package.metadata]
 requires-dist = [
     { name = "fastapi", marker = "extra == 'server'", specifier = "==0.136.0" },
-    { name = "graphon", marker = "extra == 'server'", specifier = "==0.5.1" },
+    { name = "graphon", marker = "extra == 'server'", specifier = "==0.5.2" },
     { name = "grpclib", extras = ["protobuf"], marker = "extra == 'grpc'", specifier = ">=0.4.9,<0.5.0" },
     { name = "httpx", specifier = "==0.28.1" },
     { name = "jsonschema", marker = "extra == 'server'", specifier = ">=4.23.0,<5.0.0" },
@@ -808,7 +808,7 @@ wheels = [
 
 [[package]]
 name = "graphon"
-version = "0.5.1"
+version = "0.5.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "charset-normalizer" },
@@ -829,9 +829,9 @@ dependencies = [
     { name = "unstructured", extra = ["docx", "epub", "md", "ppt", "pptx"] },
     { name = "webvtt-py" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a2/fa/432fa802bcb13f7f51dc323ddef92594b15333eafef181d937ffa554116e/graphon-0.5.1.tar.gz", hash = "sha256:ca38cc62ef3fbc2f3072b68235bcb41e32a6369a1753b46418c1d761c57125fe", size = 269741, upload-time = "2026-06-11T03:01:38.197Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c2/16/f183da187414c335be67f52f6a1b7c2a33bf0b1d5090eda7e6c92d42d94a/graphon-0.5.2.tar.gz", hash = "sha256:d66a9edcd883766bd50e94f84a691c92ce536ea60e721552089e83ac8e94bf68", size = 269773, upload-time = "2026-06-16T04:06:22.074Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e9/c5/61e8634b89c320af9453083213e8be436071634dbc69cb14b5fe646763e4/graphon-0.5.1-py3-none-any.whl", hash = "sha256:70b49c244a46fb6e338905210cc895bd67584d9ab1412f6ba3cd4ed284010091", size = 381866, upload-time = "2026-06-11T03:01:36.693Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/e6/36a3981cd44e7a40a7cd7d374e26f01e02dd49410c5fbbd7df248750d5fb/graphon-0.5.2-py3-none-any.whl", hash = "sha256:11f89399e67ed1ddd2ce1c336accd9c4ad5b8fe2741f9167e6085af0b325cd14", size = 381908, upload-time = "2026-06-16T04:06:20.453Z" },
 ]
 
 [[package]]
diff --git a/docker/.env.example b/docker/.env.example
index 8daa82d05a1..5e13db9cbc4 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -1,6 +1,7 @@
 # ------------------------------------------------------------------
 # Essential defaults for Docker Compose deployments.
 # Only include variables required for services to start.
+# Do not add optional variables to this file.
 #
 # For a default deployment, copy this file to .env and run:
 #   docker compose up -d
@@ -150,6 +151,7 @@ NEXT_PUBLIC_ENABLE_SINGLE_DOLLAR_LATEX=false
 # Enable preview features still in development (currently the /create and
 # /refine slash commands in the "Go to Anything" command palette).
 NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW=false
+ENABLE_AGENT_V2=false
 EXPERIMENTAL_ENABLE_VINEXT=false
 
 # Storage and default vector store
@@ -199,8 +201,6 @@ SSRF_PROXY_HTTP_URL=http://ssrf_proxy:3128
 SSRF_PROXY_HTTPS_URL=http://ssrf_proxy:3128
 SSRF_HTTP_PORT=3128
 SSRF_COREDUMP_DIR=/var/spool/squid
-SSRF_REVERSE_PROXY_PORT=8194
-SSRF_SANDBOX_HOST=sandbox
 SSRF_DEFAULT_TIME_OUT=5
 SSRF_DEFAULT_CONNECT_TIME_OUT=5
 SSRF_DEFAULT_READ_TIME_OUT=5
diff --git a/docker/docker-compose-template.yaml b/docker/docker-compose-template.yaml
index 9987483156f..1fbd0ec1169 100644
--- a/docker/docker-compose-template.yaml
+++ b/docker/docker-compose-template.yaml
@@ -622,9 +622,8 @@ services:
       # pls clearly modify the squid env vars to fit your network environment.
       HTTP_PORT: ${SSRF_HTTP_PORT:-3128}
       COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid}
-      REVERSE_PROXY_PORT: ${SSRF_REVERSE_PROXY_PORT:-8194}
-      SANDBOX_HOST: ${SSRF_SANDBOX_HOST:-sandbox}
-      SANDBOX_PORT: ${SANDBOX_PORT:-8194}
+      SSRF_PROXY_ALLOW_PRIVATE_IPS: ${SSRF_PROXY_ALLOW_PRIVATE_IPS:-}
+      SSRF_PROXY_ALLOW_PRIVATE_DOMAINS: ${SSRF_PROXY_ALLOW_PRIVATE_DOMAINS:-}
     networks:
       - ssrf_proxy_network
       - default
diff --git a/docker/docker-compose.middleware.yaml b/docker/docker-compose.middleware.yaml
index 170e1718565..f9d15675aa0 100644
--- a/docker/docker-compose.middleware.yaml
+++ b/docker/docker-compose.middleware.yaml
@@ -212,12 +212,13 @@ services:
       # pls clearly modify the squid env vars to fit your network environment.
       HTTP_PORT: ${SSRF_HTTP_PORT:-3128}
       COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid}
-      REVERSE_PROXY_PORT: ${SSRF_REVERSE_PROXY_PORT:-8194}
-      SANDBOX_HOST: ${SSRF_SANDBOX_HOST:-sandbox}
-      SANDBOX_PORT: ${SANDBOX_PORT:-8194}
+      SSRF_PROXY_ALLOW_PRIVATE_IPS: ${SSRF_PROXY_ALLOW_PRIVATE_IPS:-}
+      SSRF_PROXY_ALLOW_PRIVATE_DOMAINS: ${SSRF_PROXY_ALLOW_PRIVATE_DOMAINS:-}
+      SSRF_SANDBOX_PROXY_PORT: ${SSRF_SANDBOX_PROXY_PORT:-8194}
+      SSRF_SANDBOX_PROXY_HOST: ${SSRF_SANDBOX_PROXY_HOST:-sandbox}
     ports:
       - "${EXPOSE_SSRF_PROXY_PORT:-3128}:${SSRF_HTTP_PORT:-3128}"
-      - "${EXPOSE_SANDBOX_PORT:-8194}:${SANDBOX_PORT:-8194}"
+      - "${EXPOSE_SANDBOX_PORT:-8194}:${SSRF_SANDBOX_PROXY_PORT:-8194}"
     networks:
       - ssrf_proxy_network
       - default
diff --git a/docker/docker-compose.yaml b/docker/docker-compose.yaml
index 2b9f91492eb..af9ccdfd9c2 100644
--- a/docker/docker-compose.yaml
+++ b/docker/docker-compose.yaml
@@ -628,9 +628,8 @@ services:
       # pls clearly modify the squid env vars to fit your network environment.
       HTTP_PORT: ${SSRF_HTTP_PORT:-3128}
       COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid}
-      REVERSE_PROXY_PORT: ${SSRF_REVERSE_PROXY_PORT:-8194}
-      SANDBOX_HOST: ${SSRF_SANDBOX_HOST:-sandbox}
-      SANDBOX_PORT: ${SANDBOX_PORT:-8194}
+      SSRF_PROXY_ALLOW_PRIVATE_IPS: ${SSRF_PROXY_ALLOW_PRIVATE_IPS:-}
+      SSRF_PROXY_ALLOW_PRIVATE_DOMAINS: ${SSRF_PROXY_ALLOW_PRIVATE_DOMAINS:-}
     networks:
       - ssrf_proxy_network
       - default
diff --git a/docker/envs/core-services/shared.env.example b/docker/envs/core-services/shared.env.example
index 0cc840d2a4d..26274fe87d2 100644
--- a/docker/envs/core-services/shared.env.example
+++ b/docker/envs/core-services/shared.env.example
@@ -188,8 +188,6 @@ WEBHOOK_REQUEST_BODY_MAX_SIZE=10485760
 RESPECT_XFORWARD_HEADERS_ENABLED=false
 SSRF_HTTP_PORT=3128
 SSRF_COREDUMP_DIR=/var/spool/squid
-SSRF_REVERSE_PROXY_PORT=8194
-SSRF_SANDBOX_HOST=sandbox
 SSRF_DEFAULT_TIME_OUT=5
 SSRF_DEFAULT_CONNECT_TIME_OUT=5
 SSRF_DEFAULT_READ_TIME_OUT=5
diff --git a/docker/envs/core-services/web.env.example b/docker/envs/core-services/web.env.example
index 4c119106316..bd788a1b16c 100644
--- a/docker/envs/core-services/web.env.example
+++ b/docker/envs/core-services/web.env.example
@@ -25,6 +25,7 @@ ENABLE_WEBSITE_FIRECRAWL=true
 ENABLE_WEBSITE_WATERCRAWL=true
 NEXT_PUBLIC_ENABLE_SINGLE_DOLLAR_LATEX=false
 NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW=false
+ENABLE_AGENT_V2=false
 NEXT_PUBLIC_COOKIE_DOMAIN=
 NEXT_PUBLIC_BATCH_CONCURRENCY=5
 CSP_WHITELIST=
diff --git a/docker/envs/infrastructure/ssrf-proxy.env.example b/docker/envs/infrastructure/ssrf-proxy.env.example
index 210a7824944..3624bd9fbb4 100644
--- a/docker/envs/infrastructure/ssrf-proxy.env.example
+++ b/docker/envs/infrastructure/ssrf-proxy.env.example
@@ -6,8 +6,8 @@ SSRF_PROXY_HTTP_URL=http://ssrf_proxy:3128
 SSRF_PROXY_HTTPS_URL=http://ssrf_proxy:3128
 SSRF_HTTP_PORT=3128
 SSRF_COREDUMP_DIR=/var/spool/squid
-SSRF_REVERSE_PROXY_PORT=8194
-SSRF_SANDBOX_HOST=sandbox
+SSRF_PROXY_ALLOW_PRIVATE_IPS=
+SSRF_PROXY_ALLOW_PRIVATE_DOMAINS=
 SSRF_DEFAULT_TIME_OUT=5
 SSRF_DEFAULT_CONNECT_TIME_OUT=5
 SSRF_DEFAULT_READ_TIME_OUT=5
diff --git a/docker/envs/middleware.env.example b/docker/envs/middleware.env.example
index 7b28a77fe3e..3ff8139ad16 100644
--- a/docker/envs/middleware.env.example
+++ b/docker/envs/middleware.env.example
@@ -111,8 +111,10 @@ SANDBOX_PORT=8194
 # ------------------------------
 SSRF_HTTP_PORT=3128
 SSRF_COREDUMP_DIR=/var/spool/squid
-SSRF_REVERSE_PROXY_PORT=8194
-SSRF_SANDBOX_HOST=sandbox
+SSRF_PROXY_ALLOW_PRIVATE_IPS=
+SSRF_PROXY_ALLOW_PRIVATE_DOMAINS=
+SSRF_SANDBOX_PROXY_PORT=8194
+SSRF_SANDBOX_PROXY_HOST=sandbox
 
 # ------------------------------
 # Environment Variables for weaviate Service
@@ -240,4 +242,4 @@ LOGSTORE_DUAL_READ_ENABLED=true
 # Control flag for whether to write the `graph` field to LogStore.
 # If LOGSTORE_ENABLE_PUT_GRAPH_FIELD is "true", write the full `graph` field;
 # otherwise write an empty {} instead. Defaults to writing the `graph` field.
-LOGSTORE_ENABLE_PUT_GRAPH_FIELD=true
\ No newline at end of file
+LOGSTORE_ENABLE_PUT_GRAPH_FIELD=true
diff --git a/docker/ssrf_proxy/docker-entrypoint.sh b/docker/ssrf_proxy/docker-entrypoint.sh
index 613897bb7db..a19f9818b24 100755
--- a/docker/ssrf_proxy/docker-entrypoint.sh
+++ b/docker/ssrf_proxy/docker-entrypoint.sh
@@ -26,6 +26,54 @@ tail -F /var/log/squid/error.log 2>/dev/null &
 tail -F /var/log/squid/store.log 2>/dev/null &
 tail -F /var/log/squid/cache.log 2>/dev/null &
 
+ALLOW_PRIVATE_CONF=/etc/squid/dify_allow_private.conf
+SANDBOX_PROXY_CONF=/etc/squid/dify_sandbox_proxy.conf
+
+write_optional_private_allowlist() {
+    local env_name="$1"
+    local acl_name="$2"
+    local acl_type="$3"
+    local raw_values="${!env_name:-}"
+
+    raw_values="${raw_values//,/ }"
+
+    if [ -z "${raw_values//[[:space:]]/}" ]; then
+        return
+    fi
+
+    printf 'acl %s %s' "$acl_name" "$acl_type" >> "$ALLOW_PRIVATE_CONF"
+    for value in $raw_values; do
+        printf ' %s' "$value" >> "$ALLOW_PRIVATE_CONF"
+    done
+    printf '\nhttp_access allow client_localnet %s\n' "$acl_name" >> "$ALLOW_PRIVATE_CONF"
+}
+
+{
+    echo "# Generated by docker-entrypoint.sh."
+    echo "# Allows selected private targets before the default private-network deny rule."
+} > "$ALLOW_PRIVATE_CONF"
+write_optional_private_allowlist "SSRF_PROXY_ALLOW_PRIVATE_IPS" "dify_allowed_private_networks" "dst"
+write_optional_private_allowlist "SSRF_PROXY_ALLOW_PRIVATE_DOMAINS" "dify_allowed_private_domains" "dstdomain"
+
+{
+    echo "# Generated by docker-entrypoint.sh."
+    echo "# Enables the middleware-only sandbox host bridge when configured."
+} > "$SANDBOX_PROXY_CONF"
+
+if [ -n "${SSRF_SANDBOX_PROXY_PORT:-}" ]; then
+    sandbox_proxy_host="${SSRF_SANDBOX_PROXY_HOST:-sandbox}"
+    sandbox_proxy_target_port="${SANDBOX_PORT:-8194}"
+
+    {
+        printf 'http_port %s accel vhost\n' "$SSRF_SANDBOX_PROXY_PORT"
+        printf 'cache_peer %s parent %s 0 no-query originserver name=dify_sandbox\n' \
+            "$sandbox_proxy_host" \
+            "$sandbox_proxy_target_port"
+        printf 'acl dify_sandbox_proxy_port localport %s\n' "$SSRF_SANDBOX_PROXY_PORT"
+        printf 'http_access allow dify_sandbox_proxy_port\n'
+    } >> "$SANDBOX_PROXY_CONF"
+fi
+
 # Replace environment variables in the template and output to the squid.conf
 echo "[ENTRYPOINT] replacing environment variables in the template"
 awk '{
diff --git a/docker/ssrf_proxy/squid.conf.template b/docker/ssrf_proxy/squid.conf.template
index fbe9ebc448b..6e30cdba928 100644
--- a/docker/ssrf_proxy/squid.conf.template
+++ b/docker/ssrf_proxy/squid.conf.template
@@ -1,11 +1,26 @@
-acl localnet src 0.0.0.1-0.255.255.255	# RFC 1122 "this" network (LAN)
-acl localnet src 10.0.0.0/8		# RFC 1918 local private network (LAN)
-acl localnet src 100.64.0.0/10		# RFC 6598 shared address space (CGN)
-acl localnet src 169.254.0.0/16 	# RFC 3927 link-local (directly plugged) machines
-acl localnet src 172.16.0.0/12		# RFC 1918 local private network (LAN)
-acl localnet src 192.168.0.0/16		# RFC 1918 local private network (LAN)
-acl localnet src fc00::/7       	# RFC 4193 local private network range
-acl localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines
+acl client_localnet src 0.0.0.1-0.255.255.255	# RFC 1122 "this" network (LAN)
+acl client_localnet src 10.0.0.0/8		# RFC 1918 local private network (LAN)
+acl client_localnet src 100.64.0.0/10		# RFC 6598 shared address space (CGN)
+acl client_localnet src 169.254.0.0/16 	# RFC 3927 link-local (directly plugged) machines
+acl client_localnet src 172.16.0.0/12		# RFC 1918 local private network (LAN)
+acl client_localnet src 192.168.0.0/16		# RFC 1918 local private network (LAN)
+acl client_localnet src fc00::/7       	# RFC 4193 local private network range
+acl client_localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines
+acl to_private_networks dst 0.0.0.0/8
+acl to_private_networks dst 10.0.0.0/8
+acl to_private_networks dst 100.64.0.0/10
+acl to_private_networks dst 127.0.0.0/8
+acl to_private_networks dst 169.254.0.0/16
+acl to_private_networks dst 172.16.0.0/12
+acl to_private_networks dst 192.168.0.0/16
+acl to_private_networks dst 224.0.0.0/4
+acl to_private_networks dst 240.0.0.0/4
+acl to_private_networks dst ::/128
+acl to_private_networks dst ::1/128
+acl to_private_networks dst ::ffff:0:0/96    # IPv4-mapped
+acl to_private_networks dst ::/96            # deprecated IPv4-compatible
+acl to_private_networks dst fc00::/7
+acl to_private_networks dst fe80::/10
 acl SSL_ports port 443
 # acl SSL_ports port 1025-65535   # Enable the configuration to resolve this issue: https://github.com/langgenius/dify/issues/12792
 acl Safe_ports port 80		# http
@@ -20,18 +35,23 @@ acl Safe_ports port 591		# filemaker
 acl Safe_ports port 777		# multiling http
 acl CONNECT method CONNECT
 acl allowed_domains dstdomain .marketplace.dify.ai
-http_access allow allowed_domains
+
+http_port ${HTTP_PORT}
+
 http_access deny !Safe_ports
 http_access deny CONNECT !SSL_ports
 http_access allow localhost manager
 http_access deny manager
+include /etc/squid/dify_sandbox_proxy.conf
+include /etc/squid/dify_allow_private.conf
+http_access deny to_private_networks
+http_access allow allowed_domains
+http_access allow client_localnet
 http_access allow localhost
-include /etc/squid/conf.d/*.conf
 http_access deny all
 tcp_outgoing_address 0.0.0.0
 
 ################################## Proxy Server ################################
-http_port ${HTTP_PORT}
 coredump_dir ${COREDUMP_DIR}
 refresh_pattern ^ftp:		1440	20%	10080
 refresh_pattern ^gopher:	1440	0%	1440
@@ -47,11 +67,7 @@ refresh_pattern .		0	20%	4320
 # upstream proxy, set to your own upstream proxy IP to avoid SSRF attacks
 # cache_peer 172.1.1.1 parent 3128 0 no-query no-digest no-netdb-exchange default
 
-################################## Reverse Proxy To Sandbox ################################
-http_port ${REVERSE_PROXY_PORT} accel vhost
-cache_peer ${SANDBOX_HOST} parent ${SANDBOX_PORT} 0 no-query originserver
-acl src_all src all
-http_access allow src_all
+################################## Request Buffer ################################
 
 # Unless the option's size is increased, an error will occur when uploading more than two files.
 client_request_buffer_max_size 100 MB
@@ -103,4 +119,3 @@ access_log daemon:/var/log/squid/access.log dify_log
 
 # Access log to track concurrent requests and timeouts
 logfile_rotate 10
-
diff --git a/docker/ssrf_proxy/test_ssrf_proxy_config.sh b/docker/ssrf_proxy/test_ssrf_proxy_config.sh
new file mode 100755
index 00000000000..21206a96b7f
--- /dev/null
+++ b/docker/ssrf_proxy/test_ssrf_proxy_config.sh
@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+IMAGE="${SSRF_PROXY_TEST_IMAGE:-ubuntu/squid:latest}"
+CLIENT_IMAGE="${SSRF_PROXY_TEST_CLIENT_IMAGE:-busybox:latest}"
+CONTAINER_NAME="${SSRF_PROXY_TEST_CONTAINER:-dify-ssrf-proxy-test-$$}"
+SANDBOX_CONTAINER_NAME="${CONTAINER_NAME}-sandbox"
+NETWORK_NAME="${SSRF_PROXY_TEST_NETWORK:-dify-ssrf-proxy-test-$$}"
+RUN_PUBLIC_CHECK="${SSRF_PROXY_TEST_PUBLIC_CHECK:-true}"
+
+cleanup() {
+  docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+  docker rm -f "$SANDBOX_CONTAINER_NAME" >/dev/null 2>&1 || true
+  docker network rm "$NETWORK_NAME" >/dev/null 2>&1 || true
+}
+
+http_code_for() {
+  local proxy_url="$1"
+  local target_url="$2"
+  local output
+
+  output="$(
+    docker run \
+      --rm \
+      --network "$NETWORK_NAME" \
+      --env "http_proxy=$proxy_url" \
+      --env "https_proxy=$proxy_url" \
+      "$CLIENT_IMAGE" \
+      wget -S -O /dev/null -T 10 "$target_url" 2>&1 || true
+  )"
+
+  printf '%s\n' "$output" | awk '$1 ~ /^HTTP\// { code = $2 } END { print code }'
+}
+
+direct_http_code_for() {
+  local target_url="$1"
+  local output
+
+  output="$(
+    docker run \
+      --rm \
+      --network "$NETWORK_NAME" \
+      "$CLIENT_IMAGE" \
+      wget -S -O /dev/null -T 10 "$target_url" 2>&1 || true
+  )"
+
+  printf '%s\n' "$output" | awk '$1 ~ /^HTTP\// { code = $2 } END { print code }'
+}
+
+assert_private_target_blocked() {
+  local proxy_url="$1"
+  local target_url="$2"
+  local status_code
+
+  status_code="$(http_code_for "$proxy_url" "$target_url")"
+  if [[ "$status_code" != "403" ]]; then
+    echo "Expected $target_url to be blocked with HTTP 403, got ${status_code:-no response}."
+    docker logs "$CONTAINER_NAME" >&2 || true
+    exit 1
+  fi
+}
+
+assert_public_target_allowed() {
+  local proxy_url="$1"
+  local target_url="$2"
+  local status_code
+
+  status_code="$(http_code_for "$proxy_url" "$target_url")"
+  if [[ ! "$status_code" =~ ^[234][0-9][0-9]$ || "$status_code" == "403" ]]; then
+    echo "Expected $target_url to remain reachable, got ${status_code:-no response}."
+    docker logs "$CONTAINER_NAME" >&2 || true
+    exit 1
+  fi
+}
+
+assert_sandbox_bridge_allowed() {
+  local target_url="$1"
+  local status_code
+
+  status_code="$(direct_http_code_for "$target_url")"
+  if [[ ! "$status_code" =~ ^2[0-9][0-9]$ ]]; then
+    echo "Expected sandbox host bridge $target_url to remain reachable, got ${status_code:-no response}."
+    docker logs "$CONTAINER_NAME" >&2 || true
+    docker logs "$SANDBOX_CONTAINER_NAME" >&2 || true
+    exit 1
+  fi
+}
+
+trap cleanup EXIT
+cleanup
+docker network create "$NETWORK_NAME" >/dev/null
+
+docker run \
+  --detach \
+  --name "$SANDBOX_CONTAINER_NAME" \
+  --network "$NETWORK_NAME" \
+  --network-alias sandbox \
+  "$CLIENT_IMAGE" \
+  sh -c "mkdir -p /www && echo ok > /www/health && httpd -f -p 8194 -h /www" \
+  >/dev/null
+
+docker run \
+  --detach \
+  --name "$CONTAINER_NAME" \
+  --entrypoint sh \
+  --network "$NETWORK_NAME" \
+  --volume "$ROOT_DIR/docker/ssrf_proxy/squid.conf.template:/etc/squid/squid.conf.template:ro" \
+  --volume "$ROOT_DIR/docker/ssrf_proxy/docker-entrypoint.sh:/docker-entrypoint-mount.sh:ro" \
+  --env HTTP_PORT=3128 \
+  --env COREDUMP_DIR=/var/spool/squid \
+  --env SSRF_SANDBOX_PROXY_PORT=8194 \
+  --env SSRF_SANDBOX_PROXY_HOST=sandbox \
+  --env "SSRF_PROXY_ALLOW_PRIVATE_IPS=${SSRF_PROXY_ALLOW_PRIVATE_IPS:-}" \
+  --env "SSRF_PROXY_ALLOW_PRIVATE_DOMAINS=${SSRF_PROXY_ALLOW_PRIVATE_DOMAINS:-}" \
+  "$IMAGE" \
+  -c "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh" \
+  >/dev/null
+
+proxy_url="http://$CONTAINER_NAME:3128"
+for _ in {1..30}; do
+  probe_status="$(http_code_for "$proxy_url" "http://127.0.0.1:80/")"
+  if [[ -n "$probe_status" ]]; then
+    break
+  fi
+  sleep 1
+done
+
+if [[ -z "${probe_status:-}" ]]; then
+  echo "Squid proxy did not respond to probes."
+  docker logs "$CONTAINER_NAME" >&2 || true
+  exit 1
+fi
+
+assert_private_target_blocked "$proxy_url" "http://127.0.0.1:80/"
+assert_private_target_blocked "$proxy_url" "http://0.1.2.3:80/"
+assert_private_target_blocked "$proxy_url" "http://169.254.169.254/latest/meta-data/"
+
+if [[ "$RUN_PUBLIC_CHECK" == "true" ]]; then
+  assert_public_target_allowed "$proxy_url" "http://example.com/"
+fi
+
+assert_sandbox_bridge_allowed "http://$CONTAINER_NAME:8194/health"
diff --git a/e2e/support/apps.ts b/e2e/support/apps.ts
index f035b5f4a1b..3c3af547a35 100644
--- a/e2e/support/apps.ts
+++ b/e2e/support/apps.ts
@@ -19,6 +19,6 @@ export const openBlankAppCreation = async (page: Page) => {
     return
   }
 
-  await page.getByRole('button', { name: 'Create' }).click()
+  await page.getByRole('button', { name: 'Create', exact: true }).click()
   await page.getByRole('menuitem', { name: 'Create from Blank' }).click()
 }
diff --git a/eslint-suppressions.json b/eslint-suppressions.json
index 87230e947ef..7e4521f51cb 100644
--- a/eslint-suppressions.json
+++ b/eslint-suppressions.json
@@ -228,9 +228,6 @@
     }
   },
   "web/app/(shareLayout)/webapp-reset-password/page.tsx": {
-    "no-restricted-globals": {
-      "count": 1
-    },
     "no-restricted-imports": {
       "count": 1
     }
@@ -252,9 +249,6 @@
     }
   },
   "web/app/(shareLayout)/webapp-signin/components/mail-and-code-auth.tsx": {
-    "no-restricted-globals": {
-      "count": 1
-    },
     "no-restricted-imports": {
       "count": 1
     }
@@ -321,11 +315,6 @@
       "count": 1
     }
   },
-  "web/app/account/(commonLayout)/delete-account/index.tsx": {
-    "no-restricted-globals": {
-      "count": 1
-    }
-  },
   "web/app/account/oauth/authorize/layout.tsx": {
     "ts/no-explicit-any": {
       "count": 1
@@ -378,11 +367,6 @@
       "count": 1
     }
   },
-  "web/app/components/app-sidebar/index.tsx": {
-    "no-restricted-globals": {
-      "count": 1
-    }
-  },
   "web/app/components/app/annotation/add-annotation-modal/edit-item/index.tsx": {
     "erasable-syntax-only/enums": {
       "count": 1
@@ -487,14 +471,6 @@
       "count": 1
     }
   },
-  "web/app/components/app/app-access-control/access-control-item.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 1
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 1
-    }
-  },
   "web/app/components/app/app-publisher/sections.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -658,9 +634,6 @@
     "jsx-a11y/no-static-element-interactions": {
       "count": 1
     },
-    "no-restricted-globals": {
-      "count": 6
-    },
     "react/set-state-in-effect": {
       "count": 4
     },
@@ -728,11 +701,6 @@
       "count": 1
     }
   },
-  "web/app/components/app/configuration/dataset-config/index.tsx": {
-    "ts/no-explicit-any": {
-      "count": 1
-    }
-  },
   "web/app/components/app/configuration/dataset-config/params-config/__tests__/config-content.spec.tsx": {
     "ts/no-explicit-any": {
       "count": 1
@@ -845,14 +813,6 @@
       "count": 1
     }
   },
-  "web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 1
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 1
-    }
-  },
   "web/app/components/app/create-app-dialog/app-list/index.tsx": {
     "no-restricted-imports": {
       "count": 1
@@ -973,11 +933,6 @@
       "count": 1
     }
   },
-  "web/app/components/app/overview/trigger-card.tsx": {
-    "ts/no-explicit-any": {
-      "count": 1
-    }
-  },
   "web/app/components/app/overview/workflow-hidden-input-fields.tsx": {
     "no-restricted-imports": {
       "count": 1
@@ -1043,6 +998,11 @@
       "count": 1
     }
   },
+  "web/app/components/apps/new-app-card.tsx": {
+    "react/set-state-in-effect": {
+      "count": 3
+    }
+  },
   "web/app/components/base/action-button/index.tsx": {
     "erasable-syntax-only/enums": {
       "count": 1
@@ -1097,14 +1057,6 @@
       "count": 1
     }
   },
-  "web/app/components/base/app-icon/index.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 1
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 1
-    }
-  },
   "web/app/components/base/audio-btn/audio.ts": {
     "node/prefer-global/buffer": {
       "count": 1
@@ -1537,17 +1489,6 @@
       "count": 1
     }
   },
-  "web/app/components/base/features/new-feature-panel/moderation/moderation-setting-modal.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 2
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 2
-    },
-    "ts/no-explicit-any": {
-      "count": 2
-    }
-  },
   "web/app/components/base/features/types.ts": {
     "erasable-syntax-only/enums": {
       "count": 2
@@ -1948,7 +1889,7 @@
   },
   "web/app/components/base/icons/src/vender/solid/arrows/index.ts": {
     "no-barrel-files/no-barrel-files": {
-      "count": 3
+      "count": 1
     }
   },
   "web/app/components/base/icons/src/vender/solid/communication/index.ts": {
@@ -2510,11 +2451,6 @@
       "count": 2
     }
   },
-  "web/app/components/base/prompt-editor/utils.ts": {
-    "ts/no-explicit-any": {
-      "count": 4
-    }
-  },
   "web/app/components/base/prompt-log-modal/index.stories.tsx": {
     "no-console": {
       "count": 1
@@ -2671,11 +2607,6 @@
       "count": 4
     }
   },
-  "web/app/components/billing/billing-page/__tests__/index.spec.tsx": {
-    "ts/no-explicit-any": {
-      "count": 4
-    }
-  },
   "web/app/components/billing/header-billing-btn/index.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -2961,14 +2892,6 @@
       "count": 3
     }
   },
-  "web/app/components/datasets/create/step-two/index.tsx": {
-    "no-barrel-files/no-barrel-files": {
-      "count": 1
-    },
-    "react-hooks/exhaustive-deps": {
-      "count": 1
-    }
-  },
   "web/app/components/datasets/create/step-two/preview-item/index.tsx": {
     "erasable-syntax-only/enums": {
       "count": 1
@@ -3038,14 +2961,6 @@
       "count": 1
     }
   },
-  "web/app/components/datasets/documents/components/document-list/components/document-table-row.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 2
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 2
-    }
-  },
   "web/app/components/datasets/documents/components/document-list/components/index.ts": {
     "no-barrel-files/no-barrel-files": {
       "count": 2
@@ -3069,14 +2984,6 @@
       "count": 1
     }
   },
-  "web/app/components/datasets/documents/components/operations.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 1
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 1
-    }
-  },
   "web/app/components/datasets/documents/components/rename-modal.tsx": {
     "no-restricted-imports": {
       "count": 1
@@ -3326,10 +3233,10 @@
   },
   "web/app/components/datasets/documents/detail/metadata/hooks/use-metadata-state.ts": {
     "react-hooks-extra/no-direct-set-state-in-use-effect": {
-      "count": 4
+      "count": 6
     },
     "react/set-state-in-effect": {
-      "count": 4
+      "count": 6
     }
   },
   "web/app/components/datasets/documents/detail/metadata/index.tsx": {
@@ -3441,11 +3348,6 @@
       "count": 1
     }
   },
-  "web/app/components/datasets/list/__tests__/header.spec.tsx": {
-    "jsx-a11y/label-has-associated-control": {
-      "count": 1
-    }
-  },
   "web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -3558,11 +3460,6 @@
       "count": 1
     }
   },
-  "web/app/components/datasets/settings/permission-selector/index.tsx": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "web/app/components/datasets/settings/permission-selector/member-item.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -3600,6 +3497,14 @@
       "count": 2
     }
   },
+  "web/app/components/develop/secret-key/secret-key-modal.tsx": {
+    "jsx-a11y/click-events-have-key-events": {
+      "count": 1
+    },
+    "jsx-a11y/no-static-element-interactions": {
+      "count": 1
+    }
+  },
   "web/app/components/explore/banner/__tests__/indicator-button.spec.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -3835,11 +3740,6 @@
       "count": 1
     }
   },
-  "web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx": {
-    "ts/no-explicit-any": {
-      "count": 4
-    }
-  },
   "web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 2
@@ -3862,9 +3762,6 @@
     },
     "jsx-a11y/no-static-element-interactions": {
       "count": 1
-    },
-    "no-restricted-imports": {
-      "count": 1
     }
   },
   "web/app/components/header/account-setting/model-provider-page/model-auth/config-model.tsx": {
@@ -3908,11 +3805,6 @@
       "count": 7
     }
   },
-  "web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx": {
-    "ts/no-explicit-any": {
-      "count": 2
-    }
-  },
   "web/app/components/header/account-setting/model-provider-page/model-modal/Input.tsx": {
     "unicorn/prefer-number-properties": {
       "count": 2
@@ -4013,12 +3905,7 @@
       "count": 2
     }
   },
-  "web/app/components/header/account-setting/plugin-page/utils.ts": {
-    "ts/no-explicit-any": {
-      "count": 4
-    }
-  },
-  "web/app/components/header/nav/index.tsx": {
+  "web/app/components/header/account-setting/permission-group-list.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
     },
@@ -4026,8 +3913,11 @@
       "count": 1
     }
   },
-  "web/app/components/main-nav/components/web-apps-section.tsx": {
-    "jsx-a11y/no-autofocus": {
+  "web/app/components/header/nav/index.tsx": {
+    "jsx-a11y/click-events-have-key-events": {
+      "count": 1
+    },
+    "jsx-a11y/no-static-element-interactions": {
       "count": 1
     }
   },
@@ -4254,11 +4144,6 @@
       "count": 1
     }
   },
-  "web/app/components/plugins/plugin-detail-panel/operation-dropdown.tsx": {
-    "jsx-a11y/anchor-has-content": {
-      "count": 1
-    }
-  },
   "web/app/components/plugins/plugin-detail-panel/strategy-detail.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -4342,10 +4227,10 @@
   },
   "web/app/components/plugins/plugin-detail-panel/tool-selector/__tests__/index.spec.tsx": {
     "jsx-a11y/click-events-have-key-events": {
-      "count": 4
+      "count": 5
     },
     "jsx-a11y/no-static-element-interactions": {
-      "count": 4
+      "count": 5
     }
   },
   "web/app/components/plugins/plugin-detail-panel/tool-selector/components/index.ts": {
@@ -4762,11 +4647,6 @@
       "count": 2
     }
   },
-  "web/app/components/signin/countdown.tsx": {
-    "no-restricted-globals": {
-      "count": 4
-    }
-  },
   "web/app/components/snippet-list/components/snippet-card.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -4852,30 +4732,11 @@
       "count": 1
     }
   },
-  "web/app/components/tools/mcp/__tests__/index.spec.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 2
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 2
-    }
-  },
   "web/app/components/tools/mcp/mcp-server-param-item.tsx": {
     "ts/no-explicit-any": {
       "count": 1
     }
   },
-  "web/app/components/tools/mcp/provider-card.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 2
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 2
-    },
-    "ts/no-explicit-any": {
-      "count": 3
-    }
-  },
   "web/app/components/tools/provider/detail.tsx": {
     "jsx-a11y/anchor-has-content": {
       "count": 1
@@ -5020,14 +4881,6 @@
       "count": 1
     }
   },
-  "web/app/components/workflow/block-selector/blocks.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 1
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 1
-    }
-  },
   "web/app/components/workflow/block-selector/featured-tools.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -5068,11 +4921,6 @@
       "count": 2
     }
   },
-  "web/app/components/workflow/block-selector/market-place-plugin/item.tsx": {
-    "erasable-syntax-only/enums": {
-      "count": 1
-    }
-  },
   "web/app/components/workflow/block-selector/market-place-plugin/list.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -5160,11 +5008,6 @@
       "count": 1
     }
   },
-  "web/app/components/workflow/candidate-node-main.tsx": {
-    "ts/no-explicit-any": {
-      "count": 2
-    }
-  },
   "web/app/components/workflow/comment/comment-input.tsx": {
     "jsx-a11y/no-autofocus": {
       "count": 1
@@ -5217,14 +5060,6 @@
       "count": 2
     }
   },
-  "web/app/components/workflow/header/run-and-history.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 1
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 1
-    }
-  },
   "web/app/components/workflow/header/scroll-to-selected-node-button.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -5308,11 +5143,6 @@
       "count": 1
     }
   },
-  "web/app/components/workflow/hooks/use-nodes-interactions.ts": {
-    "ts/no-explicit-any": {
-      "count": 8
-    }
-  },
   "web/app/components/workflow/hooks/use-serial-async-callback.ts": {
     "ts/no-explicit-any": {
       "count": 1
@@ -5712,7 +5542,7 @@
       "count": 2
     },
     "ts/no-explicit-any": {
-      "count": 6
+      "count": 4
     }
   },
   "web/app/components/workflow/nodes/_base/components/workflow-panel/last-run/index.tsx": {
@@ -5893,11 +5723,6 @@
       "count": 5
     }
   },
-  "web/app/components/workflow/nodes/components.ts": {
-    "ts/no-explicit-any": {
-      "count": 2
-    }
-  },
   "web/app/components/workflow/nodes/data-source-empty/hooks.ts": {
     "ts/no-explicit-any": {
       "count": 1
@@ -6351,11 +6176,6 @@
       "count": 2
     }
   },
-  "web/app/components/workflow/nodes/llm/components/json-schema-config-modal/json-schema-generator/index.tsx": {
-    "no-restricted-properties": {
-      "count": 3
-    }
-  },
   "web/app/components/workflow/nodes/llm/components/json-schema-config-modal/visual-editor/context.tsx": {
     "react-refresh/only-export-components": {
       "count": 2
@@ -7068,19 +6888,6 @@
       "count": 1
     }
   },
-  "web/app/components/workflow/run/agent-log/agent-log-trigger.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 1
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 1
-    }
-  },
-  "web/app/components/workflow/run/agent-log/index.tsx": {
-    "no-barrel-files/no-barrel-files": {
-      "count": 2
-    }
-  },
   "web/app/components/workflow/run/hooks.ts": {
     "ts/no-explicit-any": {
       "count": 1
@@ -7490,9 +7297,6 @@
     }
   },
   "web/app/reset-password/page.tsx": {
-    "no-restricted-globals": {
-      "count": 1
-    },
     "no-restricted-imports": {
       "count": 1
     }
@@ -7513,24 +7317,11 @@
       "count": 1
     }
   },
-  "web/app/signin/invite-settings/page.tsx": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "web/app/signin/layout.tsx": {
     "ts/no-explicit-any": {
       "count": 1
     }
   },
-  "web/app/signin/normal-form.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 2
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 2
-    }
-  },
   "web/app/signin/one-more-step.tsx": {
     "no-restricted-imports": {
       "count": 1
@@ -7649,11 +7440,6 @@
       "count": 1
     }
   },
-  "web/models/access-control.ts": {
-    "erasable-syntax-only/enums": {
-      "count": 2
-    }
-  },
   "web/models/app.ts": {
     "erasable-syntax-only/enums": {
       "count": 2
@@ -7716,10 +7502,62 @@
       "count": 1
     }
   },
-  "web/service/access-control.ts": {
-    "@tanstack/query/exhaustive-deps": {
+  "web/service/__tests__/use-tools.spec.tsx": {
+    "no-restricted-imports": {
       "count": 1
-    },
+    }
+  },
+  "web/service/access-control/__tests__/use-app-access-control.spec.tsx": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/__tests__/use-member-roles.spec.tsx": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/__tests__/use-permission-catalog.spec.tsx": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/__tests__/use-permission-keys.spec.tsx": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/__tests__/use-workspace-access-rules.spec.tsx": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/use-app-access-control.ts": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/use-member-roles.ts": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/use-permission-catalog.ts": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/use-permission-keys.ts": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/use-workspace-access-rules.ts": {
+    "no-restricted-imports": {
+      "count": 1
+    }
+  },
+  "web/service/access-control/use-workspace-roles.ts": {
     "no-restricted-imports": {
       "count": 1
     }
@@ -7763,17 +7601,12 @@
       "count": 1
     }
   },
-  "web/service/client.ts": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "web/service/common.ts": {
     "no-restricted-imports": {
       "count": 1
     },
     "ts/no-explicit-any": {
-      "count": 27
+      "count": 26
     }
   },
   "web/service/datasets.ts": {
@@ -7977,9 +7810,6 @@
   "web/service/use-tools.ts": {
     "no-restricted-imports": {
       "count": 1
-    },
-    "ts/no-explicit-any": {
-      "count": 1
     }
   },
   "web/service/use-triggers.ts": {
@@ -8051,11 +7881,6 @@
       "count": 17
     }
   },
-  "web/utils/clipboard.ts": {
-    "ts/no-explicit-any": {
-      "count": 1
-    }
-  },
   "web/utils/completion-params.spec.ts": {
     "ts/no-explicit-any": {
       "count": 3
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 1380ed67d2e..880ef4cdc56 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -7,6 +7,7 @@ import markdownPreferences from 'eslint-plugin-markdown-preferences'
 const GENERATED_IGNORES = [
   '**/storybook-static/',
   '**/.next/',
+  '**/.vinext/',
   'web/next/',
   'web/next-env.d.ts',
   '**/dist/',
diff --git a/packages/contracts/generated/api/console/activate/types.gen.ts b/packages/contracts/generated/api/console/activate/types.gen.ts
index 92370b5a75c..6591aba3996 100644
--- a/packages/contracts/generated/api/console/activate/types.gen.ts
+++ b/packages/contracts/generated/api/console/activate/types.gen.ts
@@ -6,9 +6,9 @@ export type ClientOptions = {
 
 export type ActivatePayload = {
   email?: string | null
-  interface_language: string
-  name: string
-  timezone: string
+  interface_language?: string | null
+  name?: string | null
+  timezone?: string | null
   token: string
   workspace_id?: string | null
 }
@@ -23,7 +23,9 @@ export type ActivationCheckResponse = {
 }
 
 export type ActivationCheckData = {
+  account_status?: string | null
   email: string | null
+  requires_setup?: boolean | null
   workspace_id: string | null
   workspace_name: string | null
 }
diff --git a/packages/contracts/generated/api/console/activate/zod.gen.ts b/packages/contracts/generated/api/console/activate/zod.gen.ts
index 00f85767b7c..40aff1f934f 100644
--- a/packages/contracts/generated/api/console/activate/zod.gen.ts
+++ b/packages/contracts/generated/api/console/activate/zod.gen.ts
@@ -7,9 +7,9 @@ import * as z from 'zod'
  */
 export const zActivatePayload = z.object({
   email: z.string().nullish(),
-  interface_language: z.string(),
-  name: z.string().max(30),
-  timezone: z.string(),
+  interface_language: z.string().nullish(),
+  name: z.string().max(30).nullish(),
+  timezone: z.string().nullish(),
   token: z.string(),
   workspace_id: z.string().nullish(),
 })
@@ -25,7 +25,9 @@ export const zActivationResponse = z.object({
  * ActivationCheckData
  */
 export const zActivationCheckData = z.object({
+  account_status: z.string().nullish(),
   email: z.string().nullable(),
+  requires_setup: z.boolean().nullish(),
   workspace_id: z.string().nullable(),
   workspace_name: z.string().nullable(),
 })
diff --git a/packages/contracts/generated/api/console/agent/orpc.gen.ts b/packages/contracts/generated/api/console/agent/orpc.gen.ts
index b749f644532..fbfca3be118 100644
--- a/packages/contracts/generated/api/console/agent/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/agent/orpc.gen.ts
@@ -29,6 +29,14 @@ import {
   zGetAgentByAgentIdDriveFilesPreviewResponse,
   zGetAgentByAgentIdDriveFilesQuery,
   zGetAgentByAgentIdDriveFilesResponse,
+  zGetAgentByAgentIdLogsByConversationIdMessagesPath,
+  zGetAgentByAgentIdLogsByConversationIdMessagesQuery,
+  zGetAgentByAgentIdLogsByConversationIdMessagesResponse,
+  zGetAgentByAgentIdLogSourcesPath,
+  zGetAgentByAgentIdLogSourcesResponse,
+  zGetAgentByAgentIdLogsPath,
+  zGetAgentByAgentIdLogsQuery,
+  zGetAgentByAgentIdLogsResponse,
   zGetAgentByAgentIdMessagesByMessageIdPath,
   zGetAgentByAgentIdMessagesByMessageIdResponse,
   zGetAgentByAgentIdPath,
@@ -41,6 +49,9 @@ import {
   zGetAgentByAgentIdSandboxFilesReadQuery,
   zGetAgentByAgentIdSandboxFilesReadResponse,
   zGetAgentByAgentIdSandboxFilesResponse,
+  zGetAgentByAgentIdStatisticsSummaryPath,
+  zGetAgentByAgentIdStatisticsSummaryQuery,
+  zGetAgentByAgentIdStatisticsSummaryResponse,
   zGetAgentByAgentIdVersionsByVersionIdPath,
   zGetAgentByAgentIdVersionsByVersionIdResponse,
   zGetAgentByAgentIdVersionsPath,
@@ -55,6 +66,9 @@ import {
   zPostAgentByAgentIdComposerValidateBody,
   zPostAgentByAgentIdComposerValidatePath,
   zPostAgentByAgentIdComposerValidateResponse,
+  zPostAgentByAgentIdCopyBody,
+  zPostAgentByAgentIdCopyPath,
+  zPostAgentByAgentIdCopyResponse,
   zPostAgentByAgentIdFeaturesBody,
   zPostAgentByAgentIdFeaturesPath,
   zPostAgentByAgentIdFeaturesResponse,
@@ -69,8 +83,7 @@ import {
   zPostAgentByAgentIdSandboxFilesUploadResponse,
   zPostAgentByAgentIdSkillsBySlugInferToolsPath,
   zPostAgentByAgentIdSkillsBySlugInferToolsResponse,
-  zPostAgentByAgentIdSkillsStandardizePath,
-  zPostAgentByAgentIdSkillsStandardizeResponse,
+  zPostAgentByAgentIdSkillsUploadBody,
   zPostAgentByAgentIdSkillsUploadPath,
   zPostAgentByAgentIdSkillsUploadResponse,
   zPostAgentResponse,
@@ -233,6 +246,22 @@ export const composer = {
   validate,
 }
 
+export const post3 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postAgentByAgentIdCopy',
+    path: '/agent/{agent_id}/copy',
+    successStatus: 201,
+    tags: ['console'],
+  })
+  .input(z.object({ body: zPostAgentByAgentIdCopyBody, params: zPostAgentByAgentIdCopyPath }))
+  .output(zPostAgentByAgentIdCopyResponse)
+
+export const copy = {
+  post: post3,
+}
+
 /**
  * Time-limited external signed URL for one Agent App drive value
  */
@@ -314,7 +343,7 @@ export const drive = {
 /**
  * Update an Agent App's presentation features (opener, follow-up, citations, ...)
  */
-export const post3 = oc
+export const post4 = oc
   .route({
     description: 'Update an Agent App\'s presentation features (opener, follow-up, citations, ...)',
     inputStructure: 'detailed',
@@ -329,13 +358,13 @@ export const post3 = oc
   .output(zPostAgentByAgentIdFeaturesResponse)
 
 export const features = {
-  post: post3,
+  post: post4,
 }
 
 /**
  * Create or update Agent App message feedback
  */
-export const post4 = oc
+export const post5 = oc
   .route({
     description: 'Create or update Agent App message feedback',
     inputStructure: 'detailed',
@@ -350,7 +379,7 @@ export const post4 = oc
   .output(zPostAgentByAgentIdFeedbacksResponse)
 
 export const feedbacks = {
-  post: post4,
+  post: post5,
 }
 
 /**
@@ -373,7 +402,7 @@ export const delete_ = oc
 /**
  * Commit an uploaded file into the Agent App drive under files/<name>
  */
-export const post5 = oc
+export const post6 = oc
   .route({
     description: 'Commit an uploaded file into the Agent App drive under files/<name>',
     inputStructure: 'detailed',
@@ -388,13 +417,70 @@ export const post5 = oc
 
 export const files2 = {
   delete: delete_,
-  post: post5,
+  post: post6,
+}
+
+export const get9 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAgentByAgentIdLogSources',
+    path: '/agent/{agent_id}/log-sources',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetAgentByAgentIdLogSourcesPath }))
+  .output(zGetAgentByAgentIdLogSourcesResponse)
+
+export const logSources = {
+  get: get9,
+}
+
+export const get10 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAgentByAgentIdLogsByConversationIdMessages',
+    path: '/agent/{agent_id}/logs/{conversation_id}/messages',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetAgentByAgentIdLogsByConversationIdMessagesPath,
+      query: zGetAgentByAgentIdLogsByConversationIdMessagesQuery.optional(),
+    }),
+  )
+  .output(zGetAgentByAgentIdLogsByConversationIdMessagesResponse)
+
+export const messages = {
+  get: get10,
+}
+
+export const byConversationId = {
+  messages,
+}
+
+export const get11 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAgentByAgentIdLogs',
+    path: '/agent/{agent_id}/logs',
+    tags: ['console'],
+  })
+  .input(
+    z.object({ params: zGetAgentByAgentIdLogsPath, query: zGetAgentByAgentIdLogsQuery.optional() }),
+  )
+  .output(zGetAgentByAgentIdLogsResponse)
+
+export const logs = {
+  get: get11,
+  byConversationId,
 }
 
 /**
  * Get Agent App message details by ID
  */
-export const get9 = oc
+export const get12 = oc
   .route({
     description: 'Get Agent App message details by ID',
     inputStructure: 'detailed',
@@ -407,17 +493,17 @@ export const get9 = oc
   .output(zGetAgentByAgentIdMessagesByMessageIdResponse)
 
 export const byMessageId2 = {
-  get: get9,
+  get: get12,
 }
 
-export const messages = {
+export const messages2 = {
   byMessageId: byMessageId2,
 }
 
 /**
  * List workflow apps that reference this Agent App's bound Agent (read-only)
  */
-export const get10 = oc
+export const get13 = oc
   .route({
     description: 'List workflow apps that reference this Agent App\'s bound Agent (read-only)',
     inputStructure: 'detailed',
@@ -430,13 +516,13 @@ export const get10 = oc
   .output(zGetAgentByAgentIdReferencingWorkflowsResponse)
 
 export const referencingWorkflows = {
-  get: get10,
+  get: get13,
 }
 
 /**
  * Read a text/binary preview file in an Agent App conversation sandbox
  */
-export const get11 = oc
+export const get14 = oc
   .route({
     description: 'Read a text/binary preview file in an Agent App conversation sandbox',
     inputStructure: 'detailed',
@@ -454,13 +540,13 @@ export const get11 = oc
   .output(zGetAgentByAgentIdSandboxFilesReadResponse)
 
 export const read = {
-  get: get11,
+  get: get14,
 }
 
 /**
  * Upload one Agent App sandbox file as a Dify ToolFile mapping
  */
-export const post6 = oc
+export const post7 = oc
   .route({
     description: 'Upload one Agent App sandbox file as a Dify ToolFile mapping',
     inputStructure: 'detailed',
@@ -478,13 +564,13 @@ export const post6 = oc
   .output(zPostAgentByAgentIdSandboxFilesUploadResponse)
 
 export const upload = {
-  post: post6,
+  post: post7,
 }
 
 /**
  * List a directory in an Agent App conversation sandbox
  */
-export const get12 = oc
+export const get15 = oc
   .route({
     description: 'List a directory in an Agent App conversation sandbox',
     inputStructure: 'detailed',
@@ -502,7 +588,7 @@ export const get12 = oc
   .output(zGetAgentByAgentIdSandboxFilesResponse)
 
 export const files3 = {
-  get: get12,
+  get: get15,
   read,
   upload,
 }
@@ -512,31 +598,11 @@ export const sandbox = {
 }
 
 /**
- * Validate + standardize a Skill into an Agent App drive
- */
-export const post7 = oc
-  .route({
-    description: 'Validate + standardize a Skill into an Agent App drive',
-    inputStructure: 'detailed',
-    method: 'POST',
-    operationId: 'postAgentByAgentIdSkillsStandardize',
-    path: '/agent/{agent_id}/skills/standardize',
-    successStatus: 201,
-    tags: ['console'],
-  })
-  .input(z.object({ params: zPostAgentByAgentIdSkillsStandardizePath }))
-  .output(zPostAgentByAgentIdSkillsStandardizeResponse)
-
-export const standardize = {
-  post: post7,
-}
-
-/**
- * Upload + validate a Skill package for an Agent App
+ * Upload + standardize a Skill into an Agent App drive
  */
 export const post8 = oc
   .route({
-    description: 'Upload + validate a Skill package for an Agent App',
+    description: 'Upload + standardize a Skill into an Agent App drive',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postAgentByAgentIdSkillsUpload',
@@ -544,7 +610,12 @@ export const post8 = oc
     successStatus: 201,
     tags: ['console'],
   })
-  .input(z.object({ params: zPostAgentByAgentIdSkillsUploadPath }))
+  .input(
+    z.object({
+      body: zPostAgentByAgentIdSkillsUploadBody,
+      params: zPostAgentByAgentIdSkillsUploadPath,
+    }),
+  )
   .output(zPostAgentByAgentIdSkillsUploadResponse)
 
 export const upload2 = {
@@ -591,12 +662,35 @@ export const bySlug = {
 }
 
 export const skills = {
-  standardize,
   upload: upload2,
   bySlug,
 }
 
-export const get13 = oc
+export const get16 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAgentByAgentIdStatisticsSummary',
+    path: '/agent/{agent_id}/statistics/summary',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetAgentByAgentIdStatisticsSummaryPath,
+      query: zGetAgentByAgentIdStatisticsSummaryQuery.optional(),
+    }),
+  )
+  .output(zGetAgentByAgentIdStatisticsSummaryResponse)
+
+export const summary = {
+  get: get16,
+}
+
+export const statistics = {
+  summary,
+}
+
+export const get17 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -608,10 +702,10 @@ export const get13 = oc
   .output(zGetAgentByAgentIdVersionsByVersionIdResponse)
 
 export const byVersionId = {
-  get: get13,
+  get: get17,
 }
 
-export const get14 = oc
+export const get18 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -623,7 +717,7 @@ export const get14 = oc
   .output(zGetAgentByAgentIdVersionsResponse)
 
 export const versions = {
-  get: get14,
+  get: get18,
   byVersionId,
 }
 
@@ -639,7 +733,7 @@ export const delete3 = oc
   .input(z.object({ params: zDeleteAgentByAgentIdPath }))
   .output(zDeleteAgentByAgentIdResponse)
 
-export const get15 = oc
+export const get19 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -663,22 +757,26 @@ export const put2 = oc
 
 export const byAgentId = {
   delete: delete3,
-  get: get15,
+  get: get19,
   put: put2,
   chatMessages,
   composer,
+  copy,
   drive,
   features,
   feedbacks,
   files: files2,
-  messages,
+  logSources,
+  logs,
+  messages: messages2,
   referencingWorkflows,
   sandbox,
   skills,
+  statistics,
   versions,
 }
 
-export const get16 = oc
+export const get20 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -702,7 +800,7 @@ export const post10 = oc
   .output(zPostAgentResponse)
 
 export const agent = {
-  get: get16,
+  get: get20,
   post: post10,
   inviteOptions,
   byAgentId,
diff --git a/packages/contracts/generated/api/console/agent/types.gen.ts b/packages/contracts/generated/api/console/agent/types.gen.ts
index a1779531706..64afc442406 100644
--- a/packages/contracts/generated/api/console/agent/types.gen.ts
+++ b/packages/contracts/generated/api/console/agent/types.gen.ts
@@ -4,8 +4,8 @@ export type ClientOptions = {
   baseUrl: `${string}://${string}/console/api` | (string & {})
 }
 
-export type AppPagination = {
-  data: Array<AppPartial>
+export type AgentAppPagination = {
+  data: Array<AgentAppPartial>
   has_more: boolean
   limit: number
   page: number
@@ -18,11 +18,12 @@ export type AgentAppCreatePayload = {
   icon_background?: string | null
   icon_type?: IconType | null
   name: string
-  role?: string
+  role: string
 }
 
-export type AppDetailWithSite = {
+export type AgentAppDetailWithSite = {
   access_mode?: string | null
+  active_config_is_published?: boolean
   api_base_url?: string | null
   app_id?: string | null
   bound_agent_id?: string | null
@@ -37,10 +38,12 @@ export type AppDetailWithSite = {
   icon_type?: string | null
   readonly icon_url: string | null
   id: string
+  maintainer?: string | null
   max_active_requests?: number | null
   mode: string
   model_config?: ModelConfig | null
   name: string
+  permission_keys?: Array<string>
   role?: string | null
   site?: Site | null
   tags?: Array<Tag>
@@ -66,7 +69,7 @@ export type AgentAppUpdatePayload = {
   icon_type?: IconType | null
   max_active_requests?: number | null
   name: string
-  role?: string | null
+  role: string
   use_icon_as_answer_icon?: boolean | null
 }
 
@@ -121,6 +124,14 @@ export type AgentComposerValidateResponse = {
   warnings?: Array<ComposerValidationWarningResponse>
 }
 
+export type CopyAppPayload = {
+  description?: string | null
+  icon?: string | null
+  icon_background?: string | null
+  icon_type?: IconType | null
+  name?: string | null
+}
+
 export type AgentDriveListResponse = {
   items?: Array<AgentDriveItemResponse>
 }
@@ -168,6 +179,27 @@ export type AgentDriveFileCommitResponse = {
   file: AgentDriveFileResponse
 }
 
+export type AgentLogSourceListResponse = {
+  data: Array<AgentLogSourceResponse>
+  groups: Array<AgentLogSourceGroupResponse>
+}
+
+export type AgentLogListResponse = {
+  data: Array<AgentLogConversationItemResponse>
+  has_more: boolean
+  limit: number
+  page: number
+  total: number
+}
+
+export type AgentLogMessageListResponse = {
+  data: Array<AgentLogMessageItemResponse>
+  has_more: boolean
+  limit: number
+  page: number
+  total: number
+}
+
 export type MessageDetailResponse = {
   agent_thoughts?: Array<AgentThought>
   annotation?: ConversationAnnotation | null
@@ -225,11 +257,6 @@ export type SandboxUploadResponse = {
   path: string
 }
 
-export type AgentSkillStandardizeResponse = {
-  manifest: SkillManifest
-  skill: AgentSkillRefConfig
-}
-
 export type AgentSkillUploadResponse = {
   manifest: SkillManifest
   skill: AgentSkillRefConfig
@@ -241,6 +268,12 @@ export type SkillToolInferenceResult = {
   reason?: string | null
 }
 
+export type AgentStatisticSummaryEnvelopeResponse = {
+  charts: AgentStatisticChartsResponse
+  source: string
+  summary: AgentStatisticSummaryResponse
+}
+
 export type AgentConfigSnapshotListResponse = {
   data: Array<AgentConfigSnapshotSummaryResponse>
 }
@@ -250,15 +283,18 @@ export type AgentConfigSnapshotDetailResponse = {
   config_snapshot: AgentSoulConfig
   created_at?: number | null
   created_by?: string | null
+  display_version?: number | null
   id: string
   revisions?: Array<AgentConfigRevisionResponse>
+  snapshot_version?: number | null
   summary?: string | null
   version: number
   version_note?: string | null
 }
 
-export type AppPartial = {
+export type AgentAppPartial = {
   access_mode?: string | null
+  active_config_is_published?: boolean
   app_id?: string | null
   author_name?: string | null
   bound_agent_id?: string | null
@@ -273,10 +309,14 @@ export type AppPartial = {
   readonly icon_url: string | null
   id: string
   is_starred?: boolean
+  maintainer?: string | null
   max_active_requests?: number | null
   mode: string
   model_config?: ModelConfigPartial | null
   name: string
+  permission_keys?: Array<string>
+  published_reference_count?: number
+  published_references?: Array<AgentAppPublishedReferenceResponse>
   role?: string | null
   tags?: Array<Tag>
   updated_at?: number | null
@@ -345,6 +385,7 @@ export type WorkflowPartial = {
 }
 
 export type AgentInviteOptionResponse = {
+  active_config_is_published?: boolean
   active_config_snapshot?: AgentConfigSnapshotSummaryResponse | null
   active_config_snapshot_id?: string | null
   agent_kind: AgentKind
@@ -379,7 +420,9 @@ export type AgentConfigSnapshotSummaryResponse = {
   agent_id?: string | null
   created_at?: number | null
   created_by?: string | null
+  display_version?: number | null
   id: string
+  snapshot_version?: number | null
   summary?: string | null
   version: number
   version_note?: string | null
@@ -527,6 +570,60 @@ export type AgentDriveFileResponse = {
   size?: number | null
 }
 
+export type AgentLogSourceResponse = {
+  app_icon?: string | null
+  app_icon_background?: string | null
+  app_icon_type?: string | null
+  app_id: string
+  app_name: string
+  id: string
+  node_id?: string | null
+  type: 'webapp' | 'workflow'
+  workflow_id?: string | null
+  workflow_version?: string | null
+}
+
+export type AgentLogSourceGroupResponse = {
+  label: string
+  sources?: Array<AgentLogSourceResponse>
+  type: 'webapp' | 'workflow'
+}
+
+export type AgentLogConversationItemResponse = {
+  conversation_id: string
+  created_at?: number | null
+  end_user_id?: string | null
+  id: string
+  message_count: number
+  operation_rate?: number | null
+  source?: AgentLogSourceResponse | null
+  status: 'failed' | 'paused' | 'success'
+  title?: string | null
+  unread: boolean
+  updated_at?: number | null
+  user_rate?: number | null
+}
+
+export type AgentLogMessageItemResponse = {
+  answer: string
+  answer_tokens: number
+  conversation_id: string
+  created_at?: number | null
+  currency: string
+  error?: string | null
+  from_account_id?: string | null
+  from_end_user_id?: string | null
+  id: string
+  latency: number
+  message_id: string
+  message_tokens: number
+  query: string
+  status: string
+  total_price: string
+  total_tokens: number
+  updated_at?: number | null
+}
+
 export type AgentThought = {
   chain_id?: string | null
   created_at?: number | null
@@ -641,6 +738,30 @@ export type CliToolSuggestion = {
   name: string
 }
 
+export type AgentStatisticChartsResponse = {
+  average_response_time?: Array<AgentAverageResponseTimeStatisticResponse>
+  average_session_interactions?: Array<AgentAverageSessionInteractionStatisticResponse>
+  daily_conversations?: Array<AgentDailyConversationStatisticResponse>
+  daily_end_users?: Array<AgentDailyEndUserStatisticResponse>
+  daily_messages?: Array<AgentDailyMessageStatisticResponse>
+  token_usage?: Array<AgentTokenUsageStatisticResponse>
+  tokens_per_second?: Array<AgentTokensPerSecondStatisticResponse>
+  user_satisfaction_rate?: Array<AgentUserSatisfactionRateStatisticResponse>
+}
+
+export type AgentStatisticSummaryResponse = {
+  average_response_time: number
+  average_session_interactions: number
+  currency: string
+  tokens_per_second: number
+  total_conversations: number
+  total_end_users: number
+  total_messages: number
+  total_price: string
+  total_tokens: number
+  user_satisfaction_rate: number
+}
+
 export type AgentConfigRevisionResponse = {
   created_at?: number | null
   created_by?: string | null
@@ -662,6 +783,14 @@ export type ModelConfigPartial = {
   updated_by?: string | null
 }
 
+export type AgentAppPublishedReferenceResponse = {
+  app_icon?: string | null
+  app_icon_background?: string | null
+  app_icon_type?: string | null
+  app_id: string
+  app_name: string
+}
+
 export type LlmMode = 'chat' | 'completion'
 
 export type AgentKind = 'dify_agent'
@@ -757,6 +886,26 @@ export type AgentSoulToolsConfig = {
 export type DeclaredOutputConfig = {
   array_item?: DeclaredArrayItem | null
   check?: DeclaredOutputCheckConfig | null
+  children?: Array<{
+    array_item?: {
+      children?: Array<{
+        [key: string]: unknown
+      }>
+      description?: string | null
+      type?: 'array' | 'boolean' | 'file' | 'number' | 'object' | 'string'
+      [key: string]: unknown
+    }
+    children?: Array<{
+      [key: string]: unknown
+    }>
+    description?: string | null
+    file?: {
+      [key: string]: unknown
+    }
+    name: string
+    required?: boolean
+    type: 'array' | 'boolean' | 'file' | 'number' | 'object' | 'string'
+  }>
   description?: string | null
   failure_strategy?: DeclaredOutputFailureStrategy
   file?: DeclaredOutputFileConfig | null
@@ -930,6 +1079,48 @@ export type EnvSuggestion = {
   secret_likely?: boolean
 }
 
+export type AgentAverageResponseTimeStatisticResponse = {
+  date: string
+  latency: number
+}
+
+export type AgentAverageSessionInteractionStatisticResponse = {
+  date: string
+  interactions: number
+}
+
+export type AgentDailyConversationStatisticResponse = {
+  conversation_count: number
+  date: string
+}
+
+export type AgentDailyEndUserStatisticResponse = {
+  date: string
+  terminal_count: number
+}
+
+export type AgentDailyMessageStatisticResponse = {
+  date: string
+  message_count: number
+}
+
+export type AgentTokenUsageStatisticResponse = {
+  currency: string
+  date: string
+  token_count: number
+  total_price: string
+}
+
+export type AgentTokensPerSecondStatisticResponse = {
+  date: string
+  tps: number
+}
+
+export type AgentUserSatisfactionRateStatisticResponse = {
+  date: string
+  rate: number
+}
+
 export type AgentConfigRevisionOperation
   = | 'create_version'
     | 'save_current_version'
@@ -949,6 +1140,7 @@ export type AgentSecretRefConfig = {
   provider_credential_id?: string | null
   ref?: string | null
   type?: string | null
+  value?: string | null
   variable?: string | null
   [key: string]: unknown
 }
@@ -1073,6 +1265,26 @@ export type AgentSoulDifyToolConfig = {
 }
 
 export type DeclaredArrayItem = {
+  children?: Array<{
+    array_item?: {
+      children?: Array<{
+        [key: string]: unknown
+      }>
+      description?: string | null
+      type?: 'array' | 'boolean' | 'file' | 'number' | 'object' | 'string'
+      [key: string]: unknown
+    }
+    children?: Array<{
+      [key: string]: unknown
+    }>
+    description?: string | null
+    file?: {
+      [key: string]: unknown
+    }
+    name: string
+    required?: boolean
+    type: 'array' | 'boolean' | 'file' | 'number' | 'object' | 'string'
+  }>
   description?: string | null
   type: DeclaredOutputType
 }
@@ -1214,16 +1426,17 @@ export type FileTransferMethod = 'datasource_file' | 'local_file' | 'remote_url'
 
 export type ValueSourceType = 'constant' | 'variable'
 
-export type AppPaginationWritable = {
-  data: Array<AppPartialWritable>
+export type AgentAppPaginationWritable = {
+  data: Array<AgentAppPartialWritable>
   has_more: boolean
   limit: number
   page: number
   total: number
 }
 
-export type AppDetailWithSiteWritable = {
+export type AgentAppDetailWithSiteWritable = {
   access_mode?: string | null
+  active_config_is_published?: boolean
   api_base_url?: string | null
   app_id?: string | null
   bound_agent_id?: string | null
@@ -1237,10 +1450,12 @@ export type AppDetailWithSiteWritable = {
   icon_background?: string | null
   icon_type?: string | null
   id: string
+  maintainer?: string | null
   max_active_requests?: number | null
   mode: string
   model_config?: ModelConfig | null
   name: string
+  permission_keys?: Array<string>
   role?: string | null
   site?: SiteWritable | null
   tags?: Array<Tag>
@@ -1251,8 +1466,9 @@ export type AppDetailWithSiteWritable = {
   workflow?: WorkflowPartial | null
 }
 
-export type AppPartialWritable = {
+export type AgentAppPartialWritable = {
   access_mode?: string | null
+  active_config_is_published?: boolean
   app_id?: string | null
   author_name?: string | null
   bound_agent_id?: string | null
@@ -1266,10 +1482,14 @@ export type AppPartialWritable = {
   icon_type?: string | null
   id: string
   is_starred?: boolean
+  maintainer?: string | null
   max_active_requests?: number | null
   mode: string
   model_config?: ModelConfigPartial | null
   name: string
+  permission_keys?: Array<string>
+  published_reference_count?: number
+  published_references?: Array<AgentAppPublishedReferenceResponse>
   role?: string | null
   tags?: Array<Tag>
   updated_at?: number | null
@@ -1319,7 +1539,7 @@ export type GetAgentData = {
 }
 
 export type GetAgentResponses = {
-  200: AppPagination
+  200: AgentAppPagination
 }
 
 export type GetAgentResponse = GetAgentResponses[keyof GetAgentResponses]
@@ -1337,7 +1557,7 @@ export type PostAgentErrors = {
 }
 
 export type PostAgentResponses = {
-  201: AppDetailWithSite
+  201: AgentAppDetailWithSite
 }
 
 export type PostAgentResponse = PostAgentResponses[keyof PostAgentResponses]
@@ -1391,7 +1611,7 @@ export type GetAgentByAgentIdData = {
 }
 
 export type GetAgentByAgentIdResponses = {
-  200: AppDetailWithSite
+  200: AgentAppDetailWithSite
 }
 
 export type GetAgentByAgentIdResponse = GetAgentByAgentIdResponses[keyof GetAgentByAgentIdResponses]
@@ -1411,7 +1631,7 @@ export type PutAgentByAgentIdErrors = {
 }
 
 export type PutAgentByAgentIdResponses = {
-  200: AppDetailWithSite
+  200: AgentAppDetailWithSite
 }
 
 export type PutAgentByAgentIdResponse = PutAgentByAgentIdResponses[keyof PutAgentByAgentIdResponses]
@@ -1542,6 +1762,27 @@ export type PostAgentByAgentIdComposerValidateResponses = {
 export type PostAgentByAgentIdComposerValidateResponse
   = PostAgentByAgentIdComposerValidateResponses[keyof PostAgentByAgentIdComposerValidateResponses]
 
+export type PostAgentByAgentIdCopyData = {
+  body: CopyAppPayload
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/copy'
+}
+
+export type PostAgentByAgentIdCopyErrors = {
+  400: unknown
+  403: unknown
+}
+
+export type PostAgentByAgentIdCopyResponses = {
+  201: AgentAppDetailWithSite
+}
+
+export type PostAgentByAgentIdCopyResponse
+  = PostAgentByAgentIdCopyResponses[keyof PostAgentByAgentIdCopyResponses]
+
 export type GetAgentByAgentIdDriveFilesData = {
   body?: never
   path: {
@@ -1671,6 +1912,79 @@ export type PostAgentByAgentIdFilesResponses = {
 export type PostAgentByAgentIdFilesResponse
   = PostAgentByAgentIdFilesResponses[keyof PostAgentByAgentIdFilesResponses]
 
+export type GetAgentByAgentIdLogSourcesData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/log-sources'
+}
+
+export type GetAgentByAgentIdLogSourcesResponses = {
+  200: AgentLogSourceListResponse
+}
+
+export type GetAgentByAgentIdLogSourcesResponse
+  = GetAgentByAgentIdLogSourcesResponses[keyof GetAgentByAgentIdLogSourcesResponses]
+
+export type GetAgentByAgentIdLogsData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: {
+    end?: string
+    keyword?: string
+    limit?: number
+    page?: number
+    sort_by?: string
+    sort_order?: string
+    source?: string
+    sources?: Array<string>
+    start?: string
+    status?: string
+    statuses?: Array<string>
+  }
+  url: '/agent/{agent_id}/logs'
+}
+
+export type GetAgentByAgentIdLogsResponses = {
+  200: AgentLogListResponse
+}
+
+export type GetAgentByAgentIdLogsResponse
+  = GetAgentByAgentIdLogsResponses[keyof GetAgentByAgentIdLogsResponses]
+
+export type GetAgentByAgentIdLogsByConversationIdMessagesData = {
+  body?: never
+  path: {
+    agent_id: string
+    conversation_id: string
+  }
+  query?: {
+    end?: string
+    keyword?: string
+    limit?: number
+    page?: number
+    sort_by?: string
+    sort_order?: string
+    source?: string
+    sources?: Array<string>
+    start?: string
+    status?: string
+    statuses?: Array<string>
+  }
+  url: '/agent/{agent_id}/logs/{conversation_id}/messages'
+}
+
+export type GetAgentByAgentIdLogsByConversationIdMessagesResponses = {
+  200: AgentLogMessageListResponse
+}
+
+export type GetAgentByAgentIdLogsByConversationIdMessagesResponse
+  = GetAgentByAgentIdLogsByConversationIdMessagesResponses[keyof GetAgentByAgentIdLogsByConversationIdMessagesResponses]
+
 export type GetAgentByAgentIdMessagesByMessageIdData = {
   body?: never
   path: {
@@ -1766,28 +2080,10 @@ export type PostAgentByAgentIdSandboxFilesUploadResponses = {
 export type PostAgentByAgentIdSandboxFilesUploadResponse
   = PostAgentByAgentIdSandboxFilesUploadResponses[keyof PostAgentByAgentIdSandboxFilesUploadResponses]
 
-export type PostAgentByAgentIdSkillsStandardizeData = {
-  body?: never
-  path: {
-    agent_id: string
-  }
-  query?: never
-  url: '/agent/{agent_id}/skills/standardize'
-}
-
-export type PostAgentByAgentIdSkillsStandardizeErrors = {
-  400: unknown
-}
-
-export type PostAgentByAgentIdSkillsStandardizeResponses = {
-  201: AgentSkillStandardizeResponse
-}
-
-export type PostAgentByAgentIdSkillsStandardizeResponse
-  = PostAgentByAgentIdSkillsStandardizeResponses[keyof PostAgentByAgentIdSkillsStandardizeResponses]
-
 export type PostAgentByAgentIdSkillsUploadData = {
-  body?: never
+  body: {
+    file: Blob | File
+  }
   path: {
     agent_id: string
   }
@@ -1840,6 +2136,26 @@ export type PostAgentByAgentIdSkillsBySlugInferToolsResponses = {
 export type PostAgentByAgentIdSkillsBySlugInferToolsResponse
   = PostAgentByAgentIdSkillsBySlugInferToolsResponses[keyof PostAgentByAgentIdSkillsBySlugInferToolsResponses]
 
+export type GetAgentByAgentIdStatisticsSummaryData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: {
+    end?: string
+    source?: string
+    start?: string
+  }
+  url: '/agent/{agent_id}/statistics/summary'
+}
+
+export type GetAgentByAgentIdStatisticsSummaryResponses = {
+  200: AgentStatisticSummaryEnvelopeResponse
+}
+
+export type GetAgentByAgentIdStatisticsSummaryResponse
+  = GetAgentByAgentIdStatisticsSummaryResponses[keyof GetAgentByAgentIdStatisticsSummaryResponses]
+
 export type GetAgentByAgentIdVersionsData = {
   body?: never
   path: {
diff --git a/packages/contracts/generated/api/console/agent/zod.gen.ts b/packages/contracts/generated/api/console/agent/zod.gen.ts
index 41e16de3b31..7d6bd6f5eb2 100644
--- a/packages/contracts/generated/api/console/agent/zod.gen.ts
+++ b/packages/contracts/generated/api/console/agent/zod.gen.ts
@@ -92,7 +92,7 @@ export const zAgentAppCreatePayload = z.object({
   icon_background: z.string().nullish(),
   icon_type: zIconType.nullish(),
   name: z.string().min(1),
-  role: z.string().max(255).optional().default(''),
+  role: z.string().min(1).max(255),
 })
 
 /**
@@ -105,10 +105,21 @@ export const zAgentAppUpdatePayload = z.object({
   icon_type: zIconType.nullish(),
   max_active_requests: z.int().nullish(),
   name: z.string().min(1),
-  role: z.string().max(255).nullish(),
+  role: z.string().min(1).max(255),
   use_icon_as_answer_icon: z.boolean().nullish(),
 })
 
+/**
+ * CopyAppPayload
+ */
+export const zCopyAppPayload = z.object({
+  description: z.string().max(400).nullish(),
+  icon: z.string().nullish(),
+  icon_background: z.string().nullish(),
+  icon_type: zIconType.nullish(),
+  name: z.string().nullish(),
+})
+
 /**
  * DeletedTool
  */
@@ -176,7 +187,9 @@ export const zAgentConfigSnapshotSummaryResponse = z.object({
   agent_id: z.string().nullish(),
   created_at: z.int().nullish(),
   created_by: z.string().nullish(),
+  display_version: z.int().nullish(),
   id: z.string(),
+  snapshot_version: z.int().nullish(),
   summary: z.string().nullish(),
   version: z.int(),
   version_note: z.string().nullish(),
@@ -321,6 +334,102 @@ export const zAgentDriveFileCommitResponse = z.object({
   file: zAgentDriveFileResponse,
 })
 
+/**
+ * AgentLogSourceResponse
+ */
+export const zAgentLogSourceResponse = z.object({
+  app_icon: z.string().nullish(),
+  app_icon_background: z.string().nullish(),
+  app_icon_type: z.string().nullish(),
+  app_id: z.string(),
+  app_name: z.string(),
+  id: z.string(),
+  node_id: z.string().nullish(),
+  type: z.enum(['webapp', 'workflow']),
+  workflow_id: z.string().nullish(),
+  workflow_version: z.string().nullish(),
+})
+
+/**
+ * AgentLogSourceGroupResponse
+ */
+export const zAgentLogSourceGroupResponse = z.object({
+  label: z.string(),
+  sources: z.array(zAgentLogSourceResponse).optional(),
+  type: z.enum(['webapp', 'workflow']),
+})
+
+/**
+ * AgentLogSourceListResponse
+ */
+export const zAgentLogSourceListResponse = z.object({
+  data: z.array(zAgentLogSourceResponse),
+  groups: z.array(zAgentLogSourceGroupResponse),
+})
+
+/**
+ * AgentLogConversationItemResponse
+ */
+export const zAgentLogConversationItemResponse = z.object({
+  conversation_id: z.string(),
+  created_at: z.int().nullish(),
+  end_user_id: z.string().nullish(),
+  id: z.string(),
+  message_count: z.int(),
+  operation_rate: z.number().nullish(),
+  source: zAgentLogSourceResponse.nullish(),
+  status: z.enum(['failed', 'paused', 'success']),
+  title: z.string().nullish(),
+  unread: z.boolean(),
+  updated_at: z.int().nullish(),
+  user_rate: z.number().nullish(),
+})
+
+/**
+ * AgentLogListResponse
+ */
+export const zAgentLogListResponse = z.object({
+  data: z.array(zAgentLogConversationItemResponse),
+  has_more: z.boolean(),
+  limit: z.int(),
+  page: z.int(),
+  total: z.int(),
+})
+
+/**
+ * AgentLogMessageItemResponse
+ */
+export const zAgentLogMessageItemResponse = z.object({
+  answer: z.string(),
+  answer_tokens: z.int(),
+  conversation_id: z.string(),
+  created_at: z.int().nullish(),
+  currency: z.string(),
+  error: z.string().nullish(),
+  from_account_id: z.string().nullish(),
+  from_end_user_id: z.string().nullish(),
+  id: z.string(),
+  latency: z.number(),
+  message_id: z.string(),
+  message_tokens: z.int(),
+  query: z.string(),
+  status: z.string(),
+  total_price: z.string(),
+  total_tokens: z.int(),
+  updated_at: z.int().nullish(),
+})
+
+/**
+ * AgentLogMessageListResponse
+ */
+export const zAgentLogMessageListResponse = z.object({
+  data: z.array(zAgentLogMessageItemResponse),
+  has_more: z.boolean(),
+  limit: z.int(),
+  page: z.int(),
+  total: z.int(),
+})
+
 /**
  * AgentThought
  */
@@ -442,14 +551,6 @@ export const zAgentSkillRefConfig = z.object({
   skill_md_key: z.string().max(512).nullish(),
 })
 
-/**
- * AgentSkillStandardizeResponse
- */
-export const zAgentSkillStandardizeResponse = z.object({
-  manifest: zSkillManifest,
-  skill: zAgentSkillRefConfig,
-})
-
 /**
  * AgentSkillUploadResponse
  */
@@ -458,6 +559,22 @@ export const zAgentSkillUploadResponse = z.object({
   skill: zAgentSkillRefConfig,
 })
 
+/**
+ * AgentStatisticSummaryResponse
+ */
+export const zAgentStatisticSummaryResponse = z.object({
+  average_response_time: z.number(),
+  average_session_interactions: z.number(),
+  currency: z.string(),
+  tokens_per_second: z.number(),
+  total_conversations: z.int(),
+  total_end_users: z.int(),
+  total_messages: z.int(),
+  total_price: z.string(),
+  total_tokens: z.int(),
+  user_satisfaction_rate: z.number(),
+})
+
 /**
  * ModelConfigPartial
  */
@@ -471,10 +588,22 @@ export const zModelConfigPartial = z.object({
 })
 
 /**
- * AppPartial
+ * AgentAppPublishedReferenceResponse
  */
-export const zAppPartial = z.object({
+export const zAgentAppPublishedReferenceResponse = z.object({
+  app_icon: z.string().nullish(),
+  app_icon_background: z.string().nullish(),
+  app_icon_type: z.string().nullish(),
+  app_id: z.string(),
+  app_name: z.string(),
+})
+
+/**
+ * AgentAppPartial
+ */
+export const zAgentAppPartial = z.object({
   access_mode: z.string().nullish(),
+  active_config_is_published: z.boolean().optional().default(false),
   app_id: z.string().nullish(),
   author_name: z.string().nullish(),
   bound_agent_id: z.string().nullish(),
@@ -489,10 +618,14 @@ export const zAppPartial = z.object({
   icon_url: z.string().nullable(),
   id: z.string(),
   is_starred: z.boolean().optional().default(false),
+  maintainer: z.string().nullish(),
   max_active_requests: z.int().nullish(),
   mode: z.string(),
   model_config: zModelConfigPartial.nullish(),
   name: z.string(),
+  permission_keys: z.array(z.string()).optional(),
+  published_reference_count: z.int().optional().default(0),
+  published_references: z.array(zAgentAppPublishedReferenceResponse).optional(),
   role: z.string().nullish(),
   tags: z.array(zTag).optional(),
   updated_at: z.int().nullish(),
@@ -502,10 +635,10 @@ export const zAppPartial = z.object({
 })
 
 /**
- * AppPagination
+ * AgentAppPagination
  */
-export const zAppPagination = z.object({
-  data: z.array(zAppPartial),
+export const zAgentAppPagination = z.object({
+  data: z.array(zAgentAppPartial),
   has_more: z.boolean(),
   limit: z.int(),
   page: z.int(),
@@ -530,10 +663,11 @@ export const zModelConfig = z.object({
 })
 
 /**
- * AppDetailWithSite
+ * AgentAppDetailWithSite
  */
-export const zAppDetailWithSite = z.object({
+export const zAgentAppDetailWithSite = z.object({
   access_mode: z.string().nullish(),
+  active_config_is_published: z.boolean().optional().default(false),
   api_base_url: z.string().nullish(),
   app_id: z.string().nullish(),
   bound_agent_id: z.string().nullish(),
@@ -548,10 +682,12 @@ export const zAppDetailWithSite = z.object({
   icon_type: z.string().nullish(),
   icon_url: z.string().nullable(),
   id: z.string(),
+  maintainer: z.string().nullish(),
   max_active_requests: z.int().nullish(),
   mode: z.string(),
   model_config: zModelConfig.nullish(),
   name: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   role: z.string().nullish(),
   site: zSite.nullish(),
   tags: z.array(zTag).optional(),
@@ -620,6 +756,7 @@ export const zAgentStatus = z.enum(['active', 'archived'])
  * AgentInviteOptionResponse
  */
 export const zAgentInviteOptionResponse = z.object({
+  active_config_is_published: z.boolean().optional().default(false),
   active_config_snapshot: zAgentConfigSnapshotSummaryResponse.nullish(),
   active_config_snapshot_id: z.string().nullish(),
   agent_kind: zAgentKind,
@@ -882,6 +1019,97 @@ export const zSkillToolInferenceResult = z.object({
   reason: z.string().nullish(),
 })
 
+/**
+ * AgentAverageResponseTimeStatisticResponse
+ */
+export const zAgentAverageResponseTimeStatisticResponse = z.object({
+  date: z.string(),
+  latency: z.number(),
+})
+
+/**
+ * AgentAverageSessionInteractionStatisticResponse
+ */
+export const zAgentAverageSessionInteractionStatisticResponse = z.object({
+  date: z.string(),
+  interactions: z.number(),
+})
+
+/**
+ * AgentDailyConversationStatisticResponse
+ */
+export const zAgentDailyConversationStatisticResponse = z.object({
+  conversation_count: z.int(),
+  date: z.string(),
+})
+
+/**
+ * AgentDailyEndUserStatisticResponse
+ */
+export const zAgentDailyEndUserStatisticResponse = z.object({
+  date: z.string(),
+  terminal_count: z.int(),
+})
+
+/**
+ * AgentDailyMessageStatisticResponse
+ */
+export const zAgentDailyMessageStatisticResponse = z.object({
+  date: z.string(),
+  message_count: z.int(),
+})
+
+/**
+ * AgentTokenUsageStatisticResponse
+ */
+export const zAgentTokenUsageStatisticResponse = z.object({
+  currency: z.string(),
+  date: z.string(),
+  token_count: z.int(),
+  total_price: z.string(),
+})
+
+/**
+ * AgentTokensPerSecondStatisticResponse
+ */
+export const zAgentTokensPerSecondStatisticResponse = z.object({
+  date: z.string(),
+  tps: z.number(),
+})
+
+/**
+ * AgentUserSatisfactionRateStatisticResponse
+ */
+export const zAgentUserSatisfactionRateStatisticResponse = z.object({
+  date: z.string(),
+  rate: z.number(),
+})
+
+/**
+ * AgentStatisticChartsResponse
+ */
+export const zAgentStatisticChartsResponse = z.object({
+  average_response_time: z.array(zAgentAverageResponseTimeStatisticResponse).optional(),
+  average_session_interactions: z
+    .array(zAgentAverageSessionInteractionStatisticResponse)
+    .optional(),
+  daily_conversations: z.array(zAgentDailyConversationStatisticResponse).optional(),
+  daily_end_users: z.array(zAgentDailyEndUserStatisticResponse).optional(),
+  daily_messages: z.array(zAgentDailyMessageStatisticResponse).optional(),
+  token_usage: z.array(zAgentTokenUsageStatisticResponse).optional(),
+  tokens_per_second: z.array(zAgentTokensPerSecondStatisticResponse).optional(),
+  user_satisfaction_rate: z.array(zAgentUserSatisfactionRateStatisticResponse).optional(),
+})
+
+/**
+ * AgentStatisticSummaryEnvelopeResponse
+ */
+export const zAgentStatisticSummaryEnvelopeResponse = z.object({
+  charts: zAgentStatisticChartsResponse,
+  source: z.string(),
+  summary: zAgentStatisticSummaryResponse,
+})
+
 /**
  * AgentConfigRevisionOperation
  *
@@ -1078,6 +1306,25 @@ export const zWorkflowNodeJobMetadata = z.object({
  * about. Stage 4 §4.2.
  */
 export const zDeclaredArrayItem = z.object({
+  children: z
+    .array(
+      z.object({
+        array_item: z
+          .object({
+            children: z.array(z.record(z.string(), z.unknown())).optional(),
+            description: z.string().nullish(),
+            type: z.enum(['array', 'boolean', 'file', 'number', 'object', 'string']).optional(),
+          })
+          .optional(),
+        children: z.array(z.record(z.string(), z.unknown())).optional(),
+        description: z.string().nullish(),
+        file: z.record(z.string(), z.unknown()).optional(),
+        name: z.string(),
+        required: z.boolean().optional(),
+        type: z.enum(['array', 'boolean', 'file', 'number', 'object', 'string']),
+      }),
+    )
+    .optional(),
   description: z.string().nullish(),
   type: zDeclaredOutputType,
 })
@@ -1136,6 +1383,7 @@ export const zAgentSecretRefConfig = z.object({
   provider_credential_id: z.string().max(255).nullish(),
   ref: z.string().max(255).nullish(),
   type: z.string().max(64).nullish(),
+  value: z.string().max(255).nullish(),
   variable: z.string().max(255).nullish(),
 })
 
@@ -1460,8 +1708,10 @@ export const zAgentConfigSnapshotDetailResponse = z.object({
   config_snapshot: zAgentSoulConfig,
   created_at: z.int().nullish(),
   created_by: z.string().nullish(),
+  display_version: z.int().nullish(),
   id: z.string(),
   revisions: z.array(zAgentConfigRevisionResponse).optional(),
+  snapshot_version: z.int().nullish(),
   summary: z.string().nullish(),
   version: z.int(),
   version_note: z.string().nullish(),
@@ -1515,6 +1765,25 @@ export const zDeclaredOutputFailureStrategy = z.object({
 export const zDeclaredOutputConfig = z.object({
   array_item: zDeclaredArrayItem.nullish(),
   check: zDeclaredOutputCheckConfig.nullish(),
+  children: z
+    .array(
+      z.object({
+        array_item: z
+          .object({
+            children: z.array(z.record(z.string(), z.unknown())).optional(),
+            description: z.string().nullish(),
+            type: z.enum(['array', 'boolean', 'file', 'number', 'object', 'string']).optional(),
+          })
+          .optional(),
+        children: z.array(z.record(z.string(), z.unknown())).optional(),
+        description: z.string().nullish(),
+        file: z.record(z.string(), z.unknown()).optional(),
+        name: z.string(),
+        required: z.boolean().optional(),
+        type: z.enum(['array', 'boolean', 'file', 'number', 'object', 'string']),
+      }),
+    )
+    .optional(),
   description: z.string().nullish(),
   failure_strategy: zDeclaredOutputFailureStrategy.optional(),
   file: zDeclaredOutputFileConfig.nullish(),
@@ -1731,10 +2000,11 @@ export const zMessageInfiniteScrollPaginationResponse = z.object({
 })
 
 /**
- * AppPartial
+ * AgentAppPartial
  */
-export const zAppPartialWritable = z.object({
+export const zAgentAppPartialWritable = z.object({
   access_mode: z.string().nullish(),
+  active_config_is_published: z.boolean().optional().default(false),
   app_id: z.string().nullish(),
   author_name: z.string().nullish(),
   bound_agent_id: z.string().nullish(),
@@ -1748,10 +2018,14 @@ export const zAppPartialWritable = z.object({
   icon_type: z.string().nullish(),
   id: z.string(),
   is_starred: z.boolean().optional().default(false),
+  maintainer: z.string().nullish(),
   max_active_requests: z.int().nullish(),
   mode: z.string(),
   model_config: zModelConfigPartial.nullish(),
   name: z.string(),
+  permission_keys: z.array(z.string()).optional(),
+  published_reference_count: z.int().optional().default(0),
+  published_references: z.array(zAgentAppPublishedReferenceResponse).optional(),
   role: z.string().nullish(),
   tags: z.array(zTag).optional(),
   updated_at: z.int().nullish(),
@@ -1761,10 +2035,10 @@ export const zAppPartialWritable = z.object({
 })
 
 /**
- * AppPagination
+ * AgentAppPagination
  */
-export const zAppPaginationWritable = z.object({
-  data: z.array(zAppPartialWritable),
+export const zAgentAppPaginationWritable = z.object({
+  data: z.array(zAgentAppPartialWritable),
   has_more: z.boolean(),
   limit: z.int(),
   page: z.int(),
@@ -1791,10 +2065,11 @@ export const zSiteWritable = z.object({
 })
 
 /**
- * AppDetailWithSite
+ * AgentAppDetailWithSite
  */
-export const zAppDetailWithSiteWritable = z.object({
+export const zAgentAppDetailWithSiteWritable = z.object({
   access_mode: z.string().nullish(),
+  active_config_is_published: z.boolean().optional().default(false),
   api_base_url: z.string().nullish(),
   app_id: z.string().nullish(),
   bound_agent_id: z.string().nullish(),
@@ -1808,10 +2083,12 @@ export const zAppDetailWithSiteWritable = z.object({
   icon_background: z.string().nullish(),
   icon_type: z.string().nullish(),
   id: z.string(),
+  maintainer: z.string().nullish(),
   max_active_requests: z.int().nullish(),
   mode: z.string(),
   model_config: zModelConfig.nullish(),
   name: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   role: z.string().nullish(),
   site: zSiteWritable.nullish(),
   tags: z.array(zTag).optional(),
@@ -1851,14 +2128,14 @@ export const zGetAgentQuery = z.object({
 /**
  * Agent app list
  */
-export const zGetAgentResponse = zAppPagination
+export const zGetAgentResponse = zAgentAppPagination
 
 export const zPostAgentBody = zAgentAppCreatePayload
 
 /**
  * Agent app created successfully
  */
-export const zPostAgentResponse = zAppDetailWithSite
+export const zPostAgentResponse = zAgentAppDetailWithSite
 
 export const zGetAgentInviteOptionsQuery = z.object({
   app_id: z.string().optional(),
@@ -1873,7 +2150,7 @@ export const zGetAgentInviteOptionsQuery = z.object({
 export const zGetAgentInviteOptionsResponse = zAgentInviteOptionsResponse
 
 export const zDeleteAgentByAgentIdPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -1882,27 +2159,27 @@ export const zDeleteAgentByAgentIdPath = z.object({
 export const zDeleteAgentByAgentIdResponse = z.void()
 
 export const zGetAgentByAgentIdPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
  * Agent app detail
  */
-export const zGetAgentByAgentIdResponse = zAppDetailWithSite
+export const zGetAgentByAgentIdResponse = zAgentAppDetailWithSite
 
 export const zPutAgentByAgentIdBody = zAgentAppUpdatePayload
 
 export const zPutAgentByAgentIdPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
  * Agent app updated successfully
  */
-export const zPutAgentByAgentIdResponse = zAppDetailWithSite
+export const zPutAgentByAgentIdResponse = zAgentAppDetailWithSite
 
 export const zGetAgentByAgentIdChatMessagesPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 export const zGetAgentByAgentIdChatMessagesQuery = z.object({
@@ -1917,8 +2194,8 @@ export const zGetAgentByAgentIdChatMessagesQuery = z.object({
 export const zGetAgentByAgentIdChatMessagesResponse = zMessageInfiniteScrollPaginationResponse
 
 export const zGetAgentByAgentIdChatMessagesByMessageIdSuggestedQuestionsPath = z.object({
-  agent_id: z.string(),
-  message_id: z.string(),
+  agent_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -1928,7 +2205,7 @@ export const zGetAgentByAgentIdChatMessagesByMessageIdSuggestedQuestionsResponse
   = zSuggestedQuestionsResponse
 
 export const zPostAgentByAgentIdChatMessagesByTaskIdStopPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
   task_id: z.string(),
 })
 
@@ -1938,7 +2215,7 @@ export const zPostAgentByAgentIdChatMessagesByTaskIdStopPath = z.object({
 export const zPostAgentByAgentIdChatMessagesByTaskIdStopResponse = zSimpleResultResponse
 
 export const zGetAgentByAgentIdComposerPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -1949,7 +2226,7 @@ export const zGetAgentByAgentIdComposerResponse = zAgentAppComposerResponse
 export const zPutAgentByAgentIdComposerBody = zComposerSavePayload
 
 export const zPutAgentByAgentIdComposerPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -1958,7 +2235,7 @@ export const zPutAgentByAgentIdComposerPath = z.object({
 export const zPutAgentByAgentIdComposerResponse = zAgentAppComposerResponse
 
 export const zGetAgentByAgentIdComposerCandidatesPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -1969,7 +2246,7 @@ export const zGetAgentByAgentIdComposerCandidatesResponse = zAgentComposerCandid
 export const zPostAgentByAgentIdComposerValidateBody = zComposerSavePayload
 
 export const zPostAgentByAgentIdComposerValidatePath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -1977,8 +2254,19 @@ export const zPostAgentByAgentIdComposerValidatePath = z.object({
  */
 export const zPostAgentByAgentIdComposerValidateResponse = zAgentComposerValidateResponse
 
+export const zPostAgentByAgentIdCopyBody = zCopyAppPayload
+
+export const zPostAgentByAgentIdCopyPath = z.object({
+  agent_id: z.uuid(),
+})
+
+/**
+ * Agent app copied successfully
+ */
+export const zPostAgentByAgentIdCopyResponse = zAgentAppDetailWithSite
+
 export const zGetAgentByAgentIdDriveFilesPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 export const zGetAgentByAgentIdDriveFilesQuery = z.object({
@@ -1991,7 +2279,7 @@ export const zGetAgentByAgentIdDriveFilesQuery = z.object({
 export const zGetAgentByAgentIdDriveFilesResponse = zAgentDriveListResponse
 
 export const zGetAgentByAgentIdDriveFilesDownloadPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 export const zGetAgentByAgentIdDriveFilesDownloadQuery = z.object({
@@ -2004,7 +2292,7 @@ export const zGetAgentByAgentIdDriveFilesDownloadQuery = z.object({
 export const zGetAgentByAgentIdDriveFilesDownloadResponse = zAgentDriveDownloadResponse
 
 export const zGetAgentByAgentIdDriveFilesPreviewPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 export const zGetAgentByAgentIdDriveFilesPreviewQuery = z.object({
@@ -2019,7 +2307,7 @@ export const zGetAgentByAgentIdDriveFilesPreviewResponse = zAgentDrivePreviewRes
 export const zPostAgentByAgentIdFeaturesBody = zAgentAppFeaturesPayload
 
 export const zPostAgentByAgentIdFeaturesPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -2030,7 +2318,7 @@ export const zPostAgentByAgentIdFeaturesResponse = zSimpleResultResponse
 export const zPostAgentByAgentIdFeedbacksBody = zMessageFeedbackPayload
 
 export const zPostAgentByAgentIdFeedbacksPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -2039,7 +2327,7 @@ export const zPostAgentByAgentIdFeedbacksPath = z.object({
 export const zPostAgentByAgentIdFeedbacksResponse = zSimpleResultResponse
 
 export const zDeleteAgentByAgentIdFilesPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 export const zDeleteAgentByAgentIdFilesQuery = z.object({
@@ -2054,7 +2342,7 @@ export const zDeleteAgentByAgentIdFilesResponse = zAgentDriveDeleteResponse
 export const zPostAgentByAgentIdFilesBody = zAgentDriveFilePayload
 
 export const zPostAgentByAgentIdFilesPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -2062,9 +2350,65 @@ export const zPostAgentByAgentIdFilesPath = z.object({
  */
 export const zPostAgentByAgentIdFilesResponse = zAgentDriveFileCommitResponse
 
+export const zGetAgentByAgentIdLogSourcesPath = z.object({
+  agent_id: z.uuid(),
+})
+
+/**
+ * Agent log sources
+ */
+export const zGetAgentByAgentIdLogSourcesResponse = zAgentLogSourceListResponse
+
+export const zGetAgentByAgentIdLogsPath = z.object({
+  agent_id: z.uuid(),
+})
+
+export const zGetAgentByAgentIdLogsQuery = z.object({
+  end: z.string().optional(),
+  keyword: z.string().optional(),
+  limit: z.int().gte(1).lte(100).optional().default(20),
+  page: z.int().gte(1).optional().default(1),
+  sort_by: z.string().optional().default('updated_at'),
+  sort_order: z.string().optional().default('desc'),
+  source: z.string().optional(),
+  sources: z.array(z.string()).optional(),
+  start: z.string().optional(),
+  status: z.string().optional(),
+  statuses: z.array(z.string()).optional(),
+})
+
+/**
+ * Agent logs
+ */
+export const zGetAgentByAgentIdLogsResponse = zAgentLogListResponse
+
+export const zGetAgentByAgentIdLogsByConversationIdMessagesPath = z.object({
+  agent_id: z.uuid(),
+  conversation_id: z.uuid(),
+})
+
+export const zGetAgentByAgentIdLogsByConversationIdMessagesQuery = z.object({
+  end: z.string().optional(),
+  keyword: z.string().optional(),
+  limit: z.int().gte(1).lte(100).optional().default(20),
+  page: z.int().gte(1).optional().default(1),
+  sort_by: z.string().optional().default('updated_at'),
+  sort_order: z.string().optional().default('desc'),
+  source: z.string().optional(),
+  sources: z.array(z.string()).optional(),
+  start: z.string().optional(),
+  status: z.string().optional(),
+  statuses: z.array(z.string()).optional(),
+})
+
+/**
+ * Agent log messages
+ */
+export const zGetAgentByAgentIdLogsByConversationIdMessagesResponse = zAgentLogMessageListResponse
+
 export const zGetAgentByAgentIdMessagesByMessageIdPath = z.object({
-  agent_id: z.string(),
-  message_id: z.string(),
+  agent_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -2073,7 +2417,7 @@ export const zGetAgentByAgentIdMessagesByMessageIdPath = z.object({
 export const zGetAgentByAgentIdMessagesByMessageIdResponse = zMessageDetailResponse
 
 export const zGetAgentByAgentIdReferencingWorkflowsPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -2082,7 +2426,7 @@ export const zGetAgentByAgentIdReferencingWorkflowsPath = z.object({
 export const zGetAgentByAgentIdReferencingWorkflowsResponse = zAgentReferencingWorkflowsResponse
 
 export const zGetAgentByAgentIdSandboxFilesPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 export const zGetAgentByAgentIdSandboxFilesQuery = z.object({
@@ -2096,7 +2440,7 @@ export const zGetAgentByAgentIdSandboxFilesQuery = z.object({
 export const zGetAgentByAgentIdSandboxFilesResponse = zSandboxListResponse
 
 export const zGetAgentByAgentIdSandboxFilesReadPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 export const zGetAgentByAgentIdSandboxFilesReadQuery = z.object({
@@ -2112,7 +2456,7 @@ export const zGetAgentByAgentIdSandboxFilesReadResponse = zSandboxReadResponse
 export const zPostAgentByAgentIdSandboxFilesUploadBody = zAgentSandboxUploadPayload
 
 export const zPostAgentByAgentIdSandboxFilesUploadPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -2120,26 +2464,21 @@ export const zPostAgentByAgentIdSandboxFilesUploadPath = z.object({
  */
 export const zPostAgentByAgentIdSandboxFilesUploadResponse = zSandboxUploadResponse
 
-export const zPostAgentByAgentIdSkillsStandardizePath = z.object({
-  agent_id: z.string(),
+export const zPostAgentByAgentIdSkillsUploadBody = z.object({
+  file: z.custom<Blob | File>(),
 })
 
-/**
- * Skill standardized into drive
- */
-export const zPostAgentByAgentIdSkillsStandardizeResponse = zAgentSkillStandardizeResponse
-
 export const zPostAgentByAgentIdSkillsUploadPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
- * Skill validated
+ * Skill uploaded into drive
  */
 export const zPostAgentByAgentIdSkillsUploadResponse = zAgentSkillUploadResponse
 
 export const zDeleteAgentByAgentIdSkillsBySlugPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
   slug: z.string(),
 })
 
@@ -2149,7 +2488,7 @@ export const zDeleteAgentByAgentIdSkillsBySlugPath = z.object({
 export const zDeleteAgentByAgentIdSkillsBySlugResponse = zAgentDriveDeleteResponse
 
 export const zPostAgentByAgentIdSkillsBySlugInferToolsPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
   slug: z.string(),
 })
 
@@ -2158,8 +2497,23 @@ export const zPostAgentByAgentIdSkillsBySlugInferToolsPath = z.object({
  */
 export const zPostAgentByAgentIdSkillsBySlugInferToolsResponse = zSkillToolInferenceResult
 
+export const zGetAgentByAgentIdStatisticsSummaryPath = z.object({
+  agent_id: z.uuid(),
+})
+
+export const zGetAgentByAgentIdStatisticsSummaryQuery = z.object({
+  end: z.string().optional(),
+  source: z.string().optional(),
+  start: z.string().optional(),
+})
+
+/**
+ * Agent monitoring summary and chart data
+ */
+export const zGetAgentByAgentIdStatisticsSummaryResponse = zAgentStatisticSummaryEnvelopeResponse
+
 export const zGetAgentByAgentIdVersionsPath = z.object({
-  agent_id: z.string(),
+  agent_id: z.uuid(),
 })
 
 /**
@@ -2168,8 +2522,8 @@ export const zGetAgentByAgentIdVersionsPath = z.object({
 export const zGetAgentByAgentIdVersionsResponse = zAgentConfigSnapshotListResponse
 
 export const zGetAgentByAgentIdVersionsByVersionIdPath = z.object({
-  agent_id: z.string(),
-  version_id: z.string(),
+  agent_id: z.uuid(),
+  version_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/api-based-extension/zod.gen.ts b/packages/contracts/generated/api/console/api-based-extension/zod.gen.ts
index 9bb0f67728f..468e9d09efc 100644
--- a/packages/contracts/generated/api/console/api-based-extension/zod.gen.ts
+++ b/packages/contracts/generated/api/console/api-based-extension/zod.gen.ts
@@ -37,7 +37,7 @@ export const zPostApiBasedExtensionBody = zApiBasedExtensionPayload
 export const zPostApiBasedExtensionResponse = zApiBasedExtensionResponse
 
 export const zDeleteApiBasedExtensionByIdPath = z.object({
-  id: z.string(),
+  id: z.uuid(),
 })
 
 /**
@@ -46,7 +46,7 @@ export const zDeleteApiBasedExtensionByIdPath = z.object({
 export const zDeleteApiBasedExtensionByIdResponse = z.void()
 
 export const zGetApiBasedExtensionByIdPath = z.object({
-  id: z.string(),
+  id: z.uuid(),
 })
 
 /**
@@ -57,7 +57,7 @@ export const zGetApiBasedExtensionByIdResponse = zApiBasedExtensionResponse
 export const zPostApiBasedExtensionByIdBody = zApiBasedExtensionPayload
 
 export const zPostApiBasedExtensionByIdPath = z.object({
-  id: z.string(),
+  id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/api-key-auth/zod.gen.ts b/packages/contracts/generated/api/console/api-key-auth/zod.gen.ts
index 0ebff4365b3..a55ba309823 100644
--- a/packages/contracts/generated/api/console/api-key-auth/zod.gen.ts
+++ b/packages/contracts/generated/api/console/api-key-auth/zod.gen.ts
@@ -50,7 +50,7 @@ export const zPostApiKeyAuthDataSourceBindingBody = zApiKeyAuthBindingPayload
 export const zPostApiKeyAuthDataSourceBindingResponse = zSimpleResultResponse
 
 export const zDeleteApiKeyAuthDataSourceByBindingIdPath = z.object({
-  binding_id: z.string(),
+  binding_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/apps/orpc.gen.ts b/packages/contracts/generated/api/console/apps/orpc.gen.ts
index 3952812a5a8..eab3c17eb43 100644
--- a/packages/contracts/generated/api/console/apps/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/apps/orpc.gen.ts
@@ -271,10 +271,9 @@ import {
   zPostAppsByAppIdAgentSkillsBySlugInferToolsPath,
   zPostAppsByAppIdAgentSkillsBySlugInferToolsQuery,
   zPostAppsByAppIdAgentSkillsBySlugInferToolsResponse,
-  zPostAppsByAppIdAgentSkillsStandardizePath,
-  zPostAppsByAppIdAgentSkillsStandardizeQuery,
-  zPostAppsByAppIdAgentSkillsStandardizeResponse,
+  zPostAppsByAppIdAgentSkillsUploadBody,
   zPostAppsByAppIdAgentSkillsUploadPath,
+  zPostAppsByAppIdAgentSkillsUploadQuery,
   zPostAppsByAppIdAgentSkillsUploadResponse,
   zPostAppsByAppIdAnnotationReplyByActionBody,
   zPostAppsByAppIdAnnotationReplyByActionPath,
@@ -939,57 +938,32 @@ export const logs = {
 }
 
 /**
- * Upload a Skill, validate it, and standardize it into the app agent's drive
+ * Upload a Skill, validate it, and commit drive-backed skill files
  *
- * Validate + standardize a Skill into the agent drive (ENG-594)
+ * Upload + standardize a Skill into the agent drive
  */
 export const post10 = oc
   .route({
-    description: 'Validate + standardize a Skill into the agent drive (ENG-594)',
-    inputStructure: 'detailed',
-    method: 'POST',
-    operationId: 'postAppsByAppIdAgentSkillsStandardize',
-    path: '/apps/{app_id}/agent/skills/standardize',
-    successStatus: 201,
-    summary: 'Upload a Skill, validate it, and standardize it into the app agent\'s drive',
-    tags: ['console'],
-  })
-  .input(
-    z.object({
-      params: zPostAppsByAppIdAgentSkillsStandardizePath,
-      query: zPostAppsByAppIdAgentSkillsStandardizeQuery.optional(),
-    }),
-  )
-  .output(zPostAppsByAppIdAgentSkillsStandardizeResponse)
-
-export const standardize = {
-  post: post10,
-}
-
-/**
- * Validate an uploaded Skill package and persist the archive
- *
- * Upload + validate a Skill package (.zip/.skill) and extract its manifest
- * Returns a validated skill ref (to bind into the Agent soul config on save)
- * plus its manifest. Standardizing into the agent drive is ENG-594.
- */
-export const post11 = oc
-  .route({
-    description:
-      'Upload + validate a Skill package (.zip/.skill) and extract its manifest\nReturns a validated skill ref (to bind into the Agent soul config on save)\nplus its manifest. Standardizing into the agent drive is ENG-594.',
+    description: 'Upload + standardize a Skill into the agent drive',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postAppsByAppIdAgentSkillsUpload',
     path: '/apps/{app_id}/agent/skills/upload',
     successStatus: 201,
-    summary: 'Validate an uploaded Skill package and persist the archive',
+    summary: 'Upload a Skill, validate it, and commit drive-backed skill files',
     tags: ['console'],
   })
-  .input(z.object({ params: zPostAppsByAppIdAgentSkillsUploadPath }))
+  .input(
+    z.object({
+      body: zPostAppsByAppIdAgentSkillsUploadBody,
+      params: zPostAppsByAppIdAgentSkillsUploadPath,
+      query: zPostAppsByAppIdAgentSkillsUploadQuery.optional(),
+    }),
+  )
   .output(zPostAppsByAppIdAgentSkillsUploadResponse)
 
 export const upload = {
-  post: post11,
+  post: post10,
 }
 
 /**
@@ -998,7 +972,7 @@ export const upload = {
  * Infer CLI tool + ENV suggestions from a standardized skill's SKILL.md (draft only, ENG-371)
  * Saving still goes through composer validation.
  */
-export const post12 = oc
+export const post11 = oc
   .route({
     description:
       'Infer CLI tool + ENV suggestions from a standardized skill\'s SKILL.md (draft only, ENG-371)\nSaving still goes through composer validation.',
@@ -1018,7 +992,7 @@ export const post12 = oc
   .output(zPostAppsByAppIdAgentSkillsBySlugInferToolsResponse)
 
 export const inferTools = {
-  post: post12,
+  post: post11,
 }
 
 /**
@@ -1048,7 +1022,6 @@ export const bySlug = {
 }
 
 export const skills = {
-  standardize,
   upload,
   bySlug,
 }
@@ -1086,7 +1059,7 @@ export const status = {
 /**
  * Enable or disable annotation reply for an app
  */
-export const post13 = oc
+export const post12 = oc
   .route({
     description: 'Enable or disable annotation reply for an app',
     inputStructure: 'detailed',
@@ -1104,7 +1077,7 @@ export const post13 = oc
   .output(zPostAppsByAppIdAnnotationReplyByActionResponse)
 
 export const byAction = {
-  post: post13,
+  post: post12,
   status,
 }
 
@@ -1134,7 +1107,7 @@ export const annotationSetting = {
 /**
  * Update annotation settings for an app
  */
-export const post14 = oc
+export const post13 = oc
   .route({
     description: 'Update annotation settings for an app',
     inputStructure: 'detailed',
@@ -1152,7 +1125,7 @@ export const post14 = oc
   .output(zPostAppsByAppIdAnnotationSettingsByAnnotationSettingIdResponse)
 
 export const byAnnotationSettingId = {
-  post: post14,
+  post: post13,
 }
 
 export const annotationSettings = {
@@ -1162,7 +1135,7 @@ export const annotationSettings = {
 /**
  * Batch import annotations from CSV file with rate limiting and security checks
  */
-export const post15 = oc
+export const post14 = oc
   .route({
     description: 'Batch import annotations from CSV file with rate limiting and security checks',
     inputStructure: 'detailed',
@@ -1175,7 +1148,7 @@ export const post15 = oc
   .output(zPostAppsByAppIdAnnotationsBatchImportResponse)
 
 export const batchImport = {
-  post: post15,
+  post: post14,
 }
 
 /**
@@ -1278,7 +1251,7 @@ export const delete3 = oc
 /**
  * Update or delete an annotation
  */
-export const post16 = oc
+export const post15 = oc
   .route({
     description: 'Update or delete an annotation',
     inputStructure: 'detailed',
@@ -1297,7 +1270,7 @@ export const post16 = oc
 
 export const byAnnotationId = {
   delete: delete3,
-  post: post16,
+  post: post15,
   hitHistories,
 }
 
@@ -1336,7 +1309,7 @@ export const get15 = oc
 /**
  * Create a new annotation for an app
  */
-export const post17 = oc
+export const post16 = oc
   .route({
     description: 'Create a new annotation for an app',
     inputStructure: 'detailed',
@@ -1354,7 +1327,7 @@ export const post17 = oc
 export const annotations = {
   delete: delete4,
   get: get15,
-  post: post17,
+  post: post16,
   batchImport,
   batchImportStatus,
   count: count2,
@@ -1365,7 +1338,7 @@ export const annotations = {
 /**
  * Enable or disable app API
  */
-export const post18 = oc
+export const post17 = oc
   .route({
     description: 'Enable or disable app API',
     inputStructure: 'detailed',
@@ -1378,13 +1351,13 @@ export const post18 = oc
   .output(zPostAppsByAppIdApiEnableResponse)
 
 export const apiEnable = {
-  post: post18,
+  post: post17,
 }
 
 /**
  * Transcript audio to text for chat messages
  */
-export const post19 = oc
+export const post18 = oc
   .route({
     description: 'Transcript audio to text for chat messages',
     inputStructure: 'detailed',
@@ -1397,7 +1370,7 @@ export const post19 = oc
   .output(zPostAppsByAppIdAudioToTextResponse)
 
 export const audioToText = {
-  post: post19,
+  post: post18,
 }
 
 /**
@@ -1487,7 +1460,7 @@ export const byMessageId = {
 /**
  * Stop a running chat message generation
  */
-export const post20 = oc
+export const post19 = oc
   .route({
     description: 'Stop a running chat message generation',
     inputStructure: 'detailed',
@@ -1500,7 +1473,7 @@ export const post20 = oc
   .output(zPostAppsByAppIdChatMessagesByTaskIdStopResponse)
 
 export const stop = {
-  post: post20,
+  post: post19,
 }
 
 export const byTaskId = {
@@ -1594,7 +1567,7 @@ export const completionConversations = {
 /**
  * Stop a running completion message generation
  */
-export const post21 = oc
+export const post20 = oc
   .route({
     description: 'Stop a running completion message generation',
     inputStructure: 'detailed',
@@ -1607,7 +1580,7 @@ export const post21 = oc
   .output(zPostAppsByAppIdCompletionMessagesByTaskIdStopResponse)
 
 export const stop2 = {
-  post: post21,
+  post: post20,
 }
 
 export const byTaskId2 = {
@@ -1617,7 +1590,7 @@ export const byTaskId2 = {
 /**
  * Generate completion message for debugging
  */
-export const post22 = oc
+export const post21 = oc
   .route({
     description: 'Generate completion message for debugging',
     inputStructure: 'detailed',
@@ -1635,7 +1608,7 @@ export const post22 = oc
   .output(zPostAppsByAppIdCompletionMessagesResponse)
 
 export const completionMessages = {
-  post: post22,
+  post: post21,
   byTaskId: byTaskId2,
 }
 
@@ -1670,7 +1643,7 @@ export const conversationVariables = {
  * Convert expert mode of chatbot app to workflow mode
  * Convert Completion App to Workflow App
  */
-export const post23 = oc
+export const post22 = oc
   .route({
     description:
       'Convert application to workflow mode\nConvert expert mode of chatbot app to workflow mode\nConvert Completion App to Workflow App',
@@ -1690,7 +1663,7 @@ export const post23 = oc
   .output(zPostAppsByAppIdConvertToWorkflowResponse)
 
 export const convertToWorkflow = {
-  post: post23,
+  post: post22,
 }
 
 /**
@@ -1698,7 +1671,7 @@ export const convertToWorkflow = {
  *
  * Create a copy of an existing application
  */
-export const post24 = oc
+export const post23 = oc
   .route({
     description: 'Create a copy of an existing application',
     inputStructure: 'detailed',
@@ -1713,7 +1686,7 @@ export const post24 = oc
   .output(zPostAppsByAppIdCopyResponse)
 
 export const copy = {
-  post: post24,
+  post: post23,
 }
 
 /**
@@ -1767,7 +1740,7 @@ export const export3 = {
 /**
  * Create or update message feedback (like/dislike)
  */
-export const post25 = oc
+export const post24 = oc
   .route({
     description: 'Create or update message feedback (like/dislike)',
     inputStructure: 'detailed',
@@ -1780,14 +1753,14 @@ export const post25 = oc
   .output(zPostAppsByAppIdFeedbacksResponse)
 
 export const feedbacks = {
-  post: post25,
+  post: post24,
   export: export3,
 }
 
 /**
  * Update application icon
  */
-export const post26 = oc
+export const post25 = oc
   .route({
     description: 'Update application icon',
     inputStructure: 'detailed',
@@ -1800,7 +1773,7 @@ export const post26 = oc
   .output(zPostAppsByAppIdIconResponse)
 
 export const icon = {
-  post: post26,
+  post: post25,
 }
 
 /**
@@ -1831,7 +1804,7 @@ export const messages = {
  *
  * Update application model configuration
  */
-export const post27 = oc
+export const post26 = oc
   .route({
     description: 'Update application model configuration',
     inputStructure: 'detailed',
@@ -1847,13 +1820,13 @@ export const post27 = oc
   .output(zPostAppsByAppIdModelConfigResponse)
 
 export const modelConfig = {
-  post: post27,
+  post: post26,
 }
 
 /**
  * Check if app name is available
  */
-export const post28 = oc
+export const post27 = oc
   .route({
     description: 'Check if app name is available',
     inputStructure: 'detailed',
@@ -1866,13 +1839,13 @@ export const post28 = oc
   .output(zPostAppsByAppIdNameResponse)
 
 export const name = {
-  post: post28,
+  post: post27,
 }
 
 /**
  * Publish app to Creators Platform
  */
-export const post29 = oc
+export const post28 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1885,7 +1858,7 @@ export const post29 = oc
   .output(zPostAppsByAppIdPublishToCreatorsPlatformResponse)
 
 export const publishToCreatorsPlatform = {
-  post: post29,
+  post: post28,
 }
 
 /**
@@ -1906,7 +1879,7 @@ export const get26 = oc
 /**
  * Create MCP server configuration for an application
  */
-export const post30 = oc
+export const post29 = oc
   .route({
     description: 'Create MCP server configuration for an application',
     inputStructure: 'detailed',
@@ -1936,14 +1909,14 @@ export const put = oc
 
 export const server = {
   get: get26,
-  post: post30,
+  post: post29,
   put,
 }
 
 /**
  * Reset access token for application site
  */
-export const post31 = oc
+export const post30 = oc
   .route({
     description: 'Reset access token for application site',
     inputStructure: 'detailed',
@@ -1956,13 +1929,13 @@ export const post31 = oc
   .output(zPostAppsByAppIdSiteAccessTokenResetResponse)
 
 export const accessTokenReset = {
-  post: post31,
+  post: post30,
 }
 
 /**
  * Update application site configuration
  */
-export const post32 = oc
+export const post31 = oc
   .route({
     description: 'Update application site configuration',
     inputStructure: 'detailed',
@@ -1975,14 +1948,14 @@ export const post32 = oc
   .output(zPostAppsByAppIdSiteResponse)
 
 export const site = {
-  post: post32,
+  post: post31,
   accessTokenReset,
 }
 
 /**
  * Enable or disable app site
  */
-export const post33 = oc
+export const post32 = oc
   .route({
     description: 'Enable or disable app site',
     inputStructure: 'detailed',
@@ -1995,7 +1968,7 @@ export const post33 = oc
   .output(zPostAppsByAppIdSiteEnableResponse)
 
 export const siteEnable = {
-  post: post33,
+  post: post32,
 }
 
 /**
@@ -2016,7 +1989,7 @@ export const delete7 = oc
 /**
  * Star an application for the current account
  */
-export const post34 = oc
+export const post33 = oc
   .route({
     description: 'Star an application for the current account',
     inputStructure: 'detailed',
@@ -2030,7 +2003,7 @@ export const post34 = oc
 
 export const star = {
   delete: delete7,
-  post: post34,
+  post: post33,
 }
 
 /**
@@ -2263,7 +2236,7 @@ export const voices = {
 /**
  * Convert text to speech for chat messages
  */
-export const post35 = oc
+export const post34 = oc
   .route({
     description: 'Convert text to speech for chat messages',
     inputStructure: 'detailed',
@@ -2278,7 +2251,7 @@ export const post35 = oc
   .output(zPostAppsByAppIdTextToAudioResponse)
 
 export const textToAudio = {
-  post: post35,
+  post: post34,
   voices,
 }
 
@@ -2303,7 +2276,7 @@ export const get36 = oc
 /**
  * Update app tracing configuration
  */
-export const post36 = oc
+export const post35 = oc
   .route({
     description: 'Update app tracing configuration',
     inputStructure: 'detailed',
@@ -2317,7 +2290,7 @@ export const post36 = oc
 
 export const trace = {
   get: get36,
-  post: post36,
+  post: post35,
 }
 
 /**
@@ -2386,7 +2359,7 @@ export const patch = oc
  *
  * Create a new tracing configuration for an application
  */
-export const post37 = oc
+export const post36 = oc
   .route({
     description: 'Create a new tracing configuration for an application',
     inputStructure: 'detailed',
@@ -2406,13 +2379,13 @@ export const traceConfig = {
   delete: delete8,
   get: get37,
   patch,
-  post: post37,
+  post: post36,
 }
 
 /**
  * Update app trigger (enable/disable)
  */
-export const post38 = oc
+export const post37 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2430,7 +2403,7 @@ export const post38 = oc
   .output(zPostAppsByAppIdTriggerEnableResponse)
 
 export const triggerEnable = {
-  post: post38,
+  post: post37,
 }
 
 /**
@@ -2538,7 +2511,7 @@ export const count3 = {
  *
  * Stop running workflow task
  */
-export const post39 = oc
+export const post38 = oc
   .route({
     description: 'Stop running workflow task',
     inputStructure: 'detailed',
@@ -2552,7 +2525,7 @@ export const post39 = oc
   .output(zPostAppsByAppIdWorkflowRunsTasksByTaskIdStopResponse)
 
 export const stop3 = {
-  post: post39,
+  post: post38,
 }
 
 export const byTaskId3 = {
@@ -2655,7 +2628,7 @@ export const read = {
 /**
  * Upload one workflow Agent sandbox file as a Dify ToolFile mapping
  */
-export const post40 = oc
+export const post39 = oc
   .route({
     description: 'Upload one workflow Agent sandbox file as a Dify ToolFile mapping',
     inputStructure: 'detailed',
@@ -2673,7 +2646,7 @@ export const post40 = oc
   .output(zPostAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesUploadResponse)
 
 export const upload2 = {
-  post: post40,
+  post: post39,
 }
 
 /**
@@ -2824,7 +2797,7 @@ export const byReplyId = {
  *
  * Add a reply to a workflow comment
  */
-export const post41 = oc
+export const post40 = oc
   .route({
     description: 'Add a reply to a workflow comment',
     inputStructure: 'detailed',
@@ -2844,7 +2817,7 @@ export const post41 = oc
   .output(zPostAppsByAppIdWorkflowCommentsByCommentIdRepliesResponse)
 
 export const replies = {
-  post: post41,
+  post: post40,
   byReplyId,
 }
 
@@ -2853,7 +2826,7 @@ export const replies = {
  *
  * Resolve a workflow comment
  */
-export const post42 = oc
+export const post41 = oc
   .route({
     description: 'Resolve a workflow comment',
     inputStructure: 'detailed',
@@ -2867,7 +2840,7 @@ export const post42 = oc
   .output(zPostAppsByAppIdWorkflowCommentsByCommentIdResolveResponse)
 
 export const resolve = {
-  post: post42,
+  post: post41,
 }
 
 /**
@@ -2961,7 +2934,7 @@ export const get50 = oc
  *
  * Create a new workflow comment
  */
-export const post43 = oc
+export const post42 = oc
   .route({
     description: 'Create a new workflow comment',
     inputStructure: 'detailed',
@@ -2982,7 +2955,7 @@ export const post43 = oc
 
 export const comments = {
   get: get50,
-  post: post43,
+  post: post42,
   mentionUsers,
   byCommentId,
 }
@@ -3163,7 +3136,7 @@ export const get57 = oc
 /**
  * Update conversation variables for workflow draft
  */
-export const post44 = oc
+export const post43 = oc
   .route({
     description: 'Update conversation variables for workflow draft',
     inputStructure: 'detailed',
@@ -3182,7 +3155,7 @@ export const post44 = oc
 
 export const conversationVariables2 = {
   get: get57,
-  post: post44,
+  post: post43,
 }
 
 /**
@@ -3206,7 +3179,7 @@ export const get58 = oc
 /**
  * Update environment variables for workflow draft
  */
-export const post45 = oc
+export const post44 = oc
   .route({
     description: 'Update environment variables for workflow draft',
     inputStructure: 'detailed',
@@ -3225,13 +3198,13 @@ export const post45 = oc
 
 export const environmentVariables = {
   get: get58,
-  post: post45,
+  post: post44,
 }
 
 /**
  * Update draft workflow features
  */
-export const post46 = oc
+export const post45 = oc
   .route({
     description: 'Update draft workflow features',
     inputStructure: 'detailed',
@@ -3249,7 +3222,7 @@ export const post46 = oc
   .output(zPostAppsByAppIdWorkflowsDraftFeaturesResponse)
 
 export const features = {
-  post: post46,
+  post: post45,
 }
 
 /**
@@ -3257,7 +3230,7 @@ export const features = {
  *
  * Test human input delivery for workflow
  */
-export const post47 = oc
+export const post46 = oc
   .route({
     description: 'Test human input delivery for workflow',
     inputStructure: 'detailed',
@@ -3276,7 +3249,7 @@ export const post47 = oc
   .output(zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdDeliveryTestResponse)
 
 export const deliveryTest = {
-  post: post47,
+  post: post46,
 }
 
 /**
@@ -3284,7 +3257,7 @@ export const deliveryTest = {
  *
  * Get human input form preview for workflow
  */
-export const post48 = oc
+export const post47 = oc
   .route({
     description: 'Get human input form preview for workflow',
     inputStructure: 'detailed',
@@ -3303,7 +3276,7 @@ export const post48 = oc
   .output(zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdFormPreviewResponse)
 
 export const preview3 = {
-  post: post48,
+  post: post47,
 }
 
 /**
@@ -3311,7 +3284,7 @@ export const preview3 = {
  *
  * Submit human input form preview for workflow
  */
-export const post49 = oc
+export const post48 = oc
   .route({
     description: 'Submit human input form preview for workflow',
     inputStructure: 'detailed',
@@ -3330,7 +3303,7 @@ export const post49 = oc
   .output(zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdFormRunResponse)
 
 export const run5 = {
-  post: post49,
+  post: post48,
 }
 
 export const form2 = {
@@ -3356,7 +3329,7 @@ export const humanInput2 = {
  *
  * Run draft workflow iteration node
  */
-export const post50 = oc
+export const post49 = oc
   .route({
     description: 'Run draft workflow iteration node',
     inputStructure: 'detailed',
@@ -3375,7 +3348,7 @@ export const post50 = oc
   .output(zPostAppsByAppIdWorkflowsDraftIterationNodesByNodeIdRunResponse)
 
 export const run6 = {
-  post: post50,
+  post: post49,
 }
 
 export const byNodeId6 = {
@@ -3395,7 +3368,7 @@ export const iteration2 = {
  *
  * Run draft workflow loop node
  */
-export const post51 = oc
+export const post50 = oc
   .route({
     description: 'Run draft workflow loop node',
     inputStructure: 'detailed',
@@ -3414,7 +3387,7 @@ export const post51 = oc
   .output(zPostAppsByAppIdWorkflowsDraftLoopNodesByNodeIdRunResponse)
 
 export const run7 = {
-  post: post51,
+  post: post50,
 }
 
 export const byNodeId7 = {
@@ -3446,7 +3419,7 @@ export const candidates = {
   get: get59,
 }
 
-export const post52 = oc
+export const post51 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3463,10 +3436,10 @@ export const post52 = oc
   .output(zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerImpactResponse)
 
 export const impact = {
-  post: post52,
+  post: post51,
 }
 
-export const post53 = oc
+export const post52 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3483,10 +3456,10 @@ export const post53 = oc
   .output(zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerSaveToRosterResponse)
 
 export const saveToRoster = {
-  post: post53,
+  post: post52,
 }
 
-export const post54 = oc
+export const post53 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3503,7 +3476,7 @@ export const post54 = oc
   .output(zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerValidateResponse)
 
 export const validate = {
-  post: post54,
+  post: post53,
 }
 
 export const get60 = oc
@@ -3566,7 +3539,7 @@ export const lastRun = {
  *
  * Run draft workflow node
  */
-export const post55 = oc
+export const post54 = oc
   .route({
     description: 'Run draft workflow node',
     inputStructure: 'detailed',
@@ -3585,7 +3558,7 @@ export const post55 = oc
   .output(zPostAppsByAppIdWorkflowsDraftNodesByNodeIdRunResponse)
 
 export const run8 = {
-  post: post55,
+  post: post54,
 }
 
 /**
@@ -3593,7 +3566,7 @@ export const run8 = {
  *
  * Poll for trigger events and execute single node when event arrives
  */
-export const post56 = oc
+export const post55 = oc
   .route({
     description: 'Poll for trigger events and execute single node when event arrives',
     inputStructure: 'detailed',
@@ -3607,7 +3580,7 @@ export const post56 = oc
   .output(zPostAppsByAppIdWorkflowsDraftNodesByNodeIdTriggerRunResponse)
 
 export const run9 = {
-  post: post56,
+  post: post55,
 }
 
 export const trigger = {
@@ -3667,7 +3640,7 @@ export const nodes7 = {
  *
  * Run draft workflow
  */
-export const post57 = oc
+export const post56 = oc
   .route({
     description: 'Run draft workflow',
     inputStructure: 'detailed',
@@ -3686,7 +3659,7 @@ export const post57 = oc
   .output(zPostAppsByAppIdWorkflowsDraftRunResponse)
 
 export const run10 = {
-  post: post57,
+  post: post56,
 }
 
 /**
@@ -3808,7 +3781,7 @@ export const systemVariables = {
  *
  * Poll for trigger events and execute full workflow when event arrives
  */
-export const post58 = oc
+export const post57 = oc
   .route({
     description: 'Poll for trigger events and execute full workflow when event arrives',
     inputStructure: 'detailed',
@@ -3827,7 +3800,7 @@ export const post58 = oc
   .output(zPostAppsByAppIdWorkflowsDraftTriggerRunResponse)
 
 export const run11 = {
-  post: post58,
+  post: post57,
 }
 
 /**
@@ -3835,7 +3808,7 @@ export const run11 = {
  *
  * Full workflow debug when the start node is a trigger
  */
-export const post59 = oc
+export const post58 = oc
   .route({
     description: 'Full workflow debug when the start node is a trigger',
     inputStructure: 'detailed',
@@ -3854,7 +3827,7 @@ export const post59 = oc
   .output(zPostAppsByAppIdWorkflowsDraftTriggerRunAllResponse)
 
 export const runAll = {
-  post: post59,
+  post: post58,
 }
 
 export const trigger2 = {
@@ -4007,7 +3980,7 @@ export const get70 = oc
  *
  * Sync draft workflow configuration
  */
-export const post60 = oc
+export const post59 = oc
   .route({
     description: 'Sync draft workflow configuration',
     inputStructure: 'detailed',
@@ -4027,7 +4000,7 @@ export const post60 = oc
 
 export const draft2 = {
   get: get70,
-  post: post60,
+  post: post59,
   conversationVariables: conversationVariables2,
   environmentVariables,
   features,
@@ -4063,7 +4036,7 @@ export const get71 = oc
 /**
  * Publish workflow
  */
-export const post61 = oc
+export const post60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4082,7 +4055,7 @@ export const post61 = oc
 
 export const publish = {
   get: get71,
-  post: post61,
+  post: post60,
 }
 
 /**
@@ -4219,7 +4192,7 @@ export const triggers2 = {
 /**
  * Restore a published workflow version into the draft workflow
  */
-export const post62 = oc
+export const post61 = oc
   .route({
     description: 'Restore a published workflow version into the draft workflow',
     inputStructure: 'detailed',
@@ -4232,7 +4205,7 @@ export const post62 = oc
   .output(zPostAppsByAppIdWorkflowsByWorkflowIdRestoreResponse)
 
 export const restore = {
-  post: post62,
+  post: post61,
 }
 
 /**
@@ -4457,7 +4430,7 @@ export const get79 = oc
  *
  * Create a new API key for an app
  */
-export const post63 = oc
+export const post62 = oc
   .route({
     description: 'Create a new API key for an app',
     inputStructure: 'detailed',
@@ -4473,7 +4446,7 @@ export const post63 = oc
 
 export const apiKeys = {
   get: get79,
-  post: post63,
+  post: post62,
   byApiKeyId,
 }
 
@@ -4531,7 +4504,7 @@ export const get81 = oc
  *
  * Create a new application
  */
-export const post64 = oc
+export const post63 = oc
   .route({
     description: 'Create a new application',
     inputStructure: 'detailed',
@@ -4547,7 +4520,7 @@ export const post64 = oc
 
 export const apps = {
   get: get81,
-  post: post64,
+  post: post63,
   imports,
   starred,
   workflows,
diff --git a/packages/contracts/generated/api/console/apps/types.gen.ts b/packages/contracts/generated/api/console/apps/types.gen.ts
index 81842742f5c..904252c77eb 100644
--- a/packages/contracts/generated/api/console/apps/types.gen.ts
+++ b/packages/contracts/generated/api/console/apps/types.gen.ts
@@ -37,11 +37,12 @@ export type AppDetailWithSite = {
   icon_type?: string | null
   readonly icon_url: string | null
   id: string
+  maintainer?: string | null
   max_active_requests?: number | null
   mode: string
   model_config?: ModelConfig | null
   name: string
-  role?: string | null
+  permission_keys?: Array<string>
   site?: Site | null
   tags?: Array<Tag>
   tracing?: JsonValue | null
@@ -70,6 +71,7 @@ export type Import = {
   error?: string
   id: string
   imported_dsl_version?: string
+  permission_keys?: Array<string>
   status: ImportStatus
 }
 
@@ -212,11 +214,6 @@ export type AgentLogResponse = {
   meta: AgentLogMetaResponse
 }
 
-export type AgentSkillStandardizeResponse = {
-  manifest: SkillManifest
-  skill: AgentSkillRefConfig
-}
-
 export type AgentSkillUploadResponse = {
   manifest: SkillManifest
   skill: AgentSkillRefConfig
@@ -318,8 +315,10 @@ export type AppDetail = {
   icon?: string | null
   icon_background?: string | null
   id: string
+  maintainer?: string | null
   mode_compatible_with_agent: string
   name: string
+  permission_keys?: Array<string>
   tags?: Array<Tag>
   tracing?: JsonValue | null
   updated_at?: number | null
@@ -419,6 +418,7 @@ export type ConvertToWorkflowPayload = {
 
 export type NewAppResponse = {
   new_app_id: string
+  permission_keys?: Array<string>
 }
 
 export type CopyAppPayload = {
@@ -1169,11 +1169,12 @@ export type AppPartial = {
   readonly icon_url: string | null
   id: string
   is_starred?: boolean
+  maintainer?: string | null
   max_active_requests?: number | null
   mode: string
   model_config?: ModelConfigPartial | null
   name: string
-  role?: string | null
+  permission_keys?: Array<string>
   tags?: Array<Tag>
   updated_at?: number | null
   updated_by?: string | null
@@ -1623,6 +1624,9 @@ export type AccountWithRole = {
   last_login_at?: number | null
   name: string
   role: string
+  roles?: Array<{
+    [key: string]: string
+  }>
   status: string
 }
 
@@ -1717,7 +1721,9 @@ export type AgentConfigSnapshotSummaryResponse = {
   agent_id?: string | null
   created_at?: number | null
   created_by?: string | null
+  display_version?: number | null
   id: string
+  snapshot_version?: number | null
   summary?: string | null
   version: number
   version_note?: string | null
@@ -1760,6 +1766,26 @@ export type AgentComposerBindingResponse = {
 export type DeclaredOutputConfig = {
   array_item?: DeclaredArrayItem | null
   check?: DeclaredOutputCheckConfig | null
+  children?: Array<{
+    array_item?: {
+      children?: Array<{
+        [key: string]: unknown
+      }>
+      description?: string | null
+      type?: 'array' | 'boolean' | 'file' | 'number' | 'object' | 'string'
+      [key: string]: unknown
+    }
+    children?: Array<{
+      [key: string]: unknown
+    }>
+    description?: string | null
+    file?: {
+      [key: string]: unknown
+    }
+    name: string
+    required?: boolean
+    type: 'array' | 'boolean' | 'file' | 'number' | 'object' | 'string'
+  }>
   description?: string | null
   failure_strategy?: DeclaredOutputFailureStrategy
   file?: DeclaredOutputFileConfig | null
@@ -2103,6 +2129,26 @@ export type AgentSoulToolsConfig = {
 export type WorkflowAgentBindingType = 'inline_agent' | 'roster_agent'
 
 export type DeclaredArrayItem = {
+  children?: Array<{
+    array_item?: {
+      children?: Array<{
+        [key: string]: unknown
+      }>
+      description?: string | null
+      type?: 'array' | 'boolean' | 'file' | 'number' | 'object' | 'string'
+      [key: string]: unknown
+    }
+    children?: Array<{
+      [key: string]: unknown
+    }>
+    description?: string | null
+    file?: {
+      [key: string]: unknown
+    }
+    name: string
+    required?: boolean
+    type: 'array' | 'boolean' | 'file' | 'number' | 'object' | 'string'
+  }>
   description?: string | null
   type: DeclaredOutputType
 }
@@ -2305,6 +2351,7 @@ export type AgentSecretRefConfig = {
   provider_credential_id?: string | null
   ref?: string | null
   type?: string | null
+  value?: string | null
   variable?: string | null
   [key: string]: unknown
 }
@@ -2556,11 +2603,12 @@ export type AppDetailWithSiteWritable = {
   icon_background?: string | null
   icon_type?: string | null
   id: string
+  maintainer?: string | null
   max_active_requests?: number | null
   mode: string
   model_config?: ModelConfig | null
   name: string
-  role?: string | null
+  permission_keys?: Array<string>
   site?: SiteWritable | null
   tags?: Array<Tag>
   tracing?: JsonValue | null
@@ -2608,11 +2656,12 @@ export type AppPartialWritable = {
   icon_type?: string | null
   id: string
   is_starred?: boolean
+  maintainer?: string | null
   max_active_requests?: number | null
   mode: string
   model_config?: ModelConfigPartial | null
   name: string
-  role?: string | null
+  permission_keys?: Array<string>
   tags?: Array<Tag>
   updated_at?: number | null
   updated_by?: string | null
@@ -3136,34 +3185,16 @@ export type GetAppsByAppIdAgentLogsResponses = {
 export type GetAppsByAppIdAgentLogsResponse
   = GetAppsByAppIdAgentLogsResponses[keyof GetAppsByAppIdAgentLogsResponses]
 
-export type PostAppsByAppIdAgentSkillsStandardizeData = {
-  body?: never
+export type PostAppsByAppIdAgentSkillsUploadData = {
+  body: {
+    file: Blob | File
+  }
   path: {
     app_id: string
   }
   query?: {
     node_id?: string
   }
-  url: '/apps/{app_id}/agent/skills/standardize'
-}
-
-export type PostAppsByAppIdAgentSkillsStandardizeErrors = {
-  400: unknown
-}
-
-export type PostAppsByAppIdAgentSkillsStandardizeResponses = {
-  201: AgentSkillStandardizeResponse
-}
-
-export type PostAppsByAppIdAgentSkillsStandardizeResponse
-  = PostAppsByAppIdAgentSkillsStandardizeResponses[keyof PostAppsByAppIdAgentSkillsStandardizeResponses]
-
-export type PostAppsByAppIdAgentSkillsUploadData = {
-  body?: never
-  path: {
-    app_id: string
-  }
-  query?: never
   url: '/apps/{app_id}/agent/skills/upload'
 }
 
diff --git a/packages/contracts/generated/api/console/apps/zod.gen.ts b/packages/contracts/generated/api/console/apps/zod.gen.ts
index 94e4a8a3aad..4a6f397bcbd 100644
--- a/packages/contracts/generated/api/console/apps/zod.gen.ts
+++ b/packages/contracts/generated/api/console/apps/zod.gen.ts
@@ -270,6 +270,7 @@ export const zConvertToWorkflowPayload = z.object({
  */
 export const zNewAppResponse = z.object({
   new_app_id: z.string(),
+  permission_keys: z.array(z.string()).optional(),
 })
 
 /**
@@ -906,6 +907,7 @@ export const zImport = z.object({
   error: z.string().optional().default(''),
   id: z.string(),
   imported_dsl_version: z.string().optional().default(''),
+  permission_keys: z.array(z.string()).optional(),
   status: zImportStatus,
 })
 
@@ -990,14 +992,6 @@ export const zAgentSkillRefConfig = z.object({
   skill_md_key: z.string().max(512).nullish(),
 })
 
-/**
- * AgentSkillStandardizeResponse
- */
-export const zAgentSkillStandardizeResponse = z.object({
-  manifest: zSkillManifest,
-  skill: zAgentSkillRefConfig,
-})
-
 /**
  * AgentSkillUploadResponse
  */
@@ -1493,6 +1487,7 @@ export const zAccountWithRole = z.object({
   last_login_at: z.int().nullish(),
   name: z.string(),
   role: z.string(),
+  roles: z.array(z.record(z.string(), z.string())).optional(),
   status: z.string(),
 })
 
@@ -1744,7 +1739,9 @@ export const zAgentConfigSnapshotSummaryResponse = z.object({
   agent_id: z.string().nullish(),
   created_at: z.int().nullish(),
   created_by: z.string().nullish(),
+  display_version: z.int().nullish(),
   id: z.string(),
+  snapshot_version: z.int().nullish(),
   summary: z.string().nullish(),
   version: z.int(),
   version_note: z.string().nullish(),
@@ -1960,11 +1957,12 @@ export const zAppPartial = z.object({
   icon_url: z.string().nullable(),
   id: z.string(),
   is_starred: z.boolean().optional().default(false),
+  maintainer: z.string().nullish(),
   max_active_requests: z.int().nullish(),
   mode: z.string(),
   model_config: zModelConfigPartial.nullish(),
   name: z.string(),
-  role: z.string().nullish(),
+  permission_keys: z.array(z.string()).optional(),
   tags: z.array(zTag).optional(),
   updated_at: z.int().nullish(),
   updated_by: z.string().nullish(),
@@ -2019,11 +2017,12 @@ export const zAppDetailWithSite = z.object({
   icon_type: z.string().nullish(),
   icon_url: z.string().nullable(),
   id: z.string(),
+  maintainer: z.string().nullish(),
   max_active_requests: z.int().nullish(),
   mode: z.string(),
   model_config: zModelConfig.nullish(),
   name: z.string(),
-  role: z.string().nullish(),
+  permission_keys: z.array(z.string()).optional(),
   site: zSite.nullish(),
   tags: z.array(zTag).optional(),
   tracing: zJsonValue.nullish(),
@@ -2047,8 +2046,10 @@ export const zAppDetail = z.object({
   icon: z.string().nullish(),
   icon_background: z.string().nullish(),
   id: z.string(),
+  maintainer: z.string().nullish(),
   mode_compatible_with_agent: z.string(),
   name: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   tags: z.array(zTag).optional(),
   tracing: zJsonValue.nullish(),
   updated_at: z.int().nullish(),
@@ -2475,6 +2476,25 @@ export const zAgentComposerBindingResponse = z.object({
  * about. Stage 4 §4.2.
  */
 export const zDeclaredArrayItem = z.object({
+  children: z
+    .array(
+      z.object({
+        array_item: z
+          .object({
+            children: z.array(z.record(z.string(), z.unknown())).optional(),
+            description: z.string().nullish(),
+            type: z.enum(['array', 'boolean', 'file', 'number', 'object', 'string']).optional(),
+          })
+          .optional(),
+        children: z.array(z.record(z.string(), z.unknown())).optional(),
+        description: z.string().nullish(),
+        file: z.record(z.string(), z.unknown()).optional(),
+        name: z.string(),
+        required: z.boolean().optional(),
+        type: z.enum(['array', 'boolean', 'file', 'number', 'object', 'string']),
+      }),
+    )
+    .optional(),
   description: z.string().nullish(),
   type: zDeclaredOutputType,
 })
@@ -2908,6 +2928,7 @@ export const zAgentSecretRefConfig = z.object({
   provider_credential_id: z.string().max(255).nullish(),
   ref: z.string().max(255).nullish(),
   type: z.string().max(64).nullish(),
+  value: z.string().max(255).nullish(),
   variable: z.string().max(255).nullish(),
 })
 
@@ -3079,6 +3100,25 @@ export const zDeclaredOutputCheckConfig = z.object({
 export const zDeclaredOutputConfig = z.object({
   array_item: zDeclaredArrayItem.nullish(),
   check: zDeclaredOutputCheckConfig.nullish(),
+  children: z
+    .array(
+      z.object({
+        array_item: z
+          .object({
+            children: z.array(z.record(z.string(), z.unknown())).optional(),
+            description: z.string().nullish(),
+            type: z.enum(['array', 'boolean', 'file', 'number', 'object', 'string']).optional(),
+          })
+          .optional(),
+        children: z.array(z.record(z.string(), z.unknown())).optional(),
+        description: z.string().nullish(),
+        file: z.record(z.string(), z.unknown()).optional(),
+        name: z.string(),
+        required: z.boolean().optional(),
+        type: z.enum(['array', 'boolean', 'file', 'number', 'object', 'string']),
+      }),
+    )
+    .optional(),
   description: z.string().nullish(),
   failure_strategy: zDeclaredOutputFailureStrategy.optional(),
   file: zDeclaredOutputFileConfig.nullish(),
@@ -3450,11 +3490,12 @@ export const zAppPartialWritable = z.object({
   icon_type: z.string().nullish(),
   id: z.string(),
   is_starred: z.boolean().optional().default(false),
+  maintainer: z.string().nullish(),
   max_active_requests: z.int().nullish(),
   mode: z.string(),
   model_config: zModelConfigPartial.nullish(),
   name: z.string(),
-  role: z.string().nullish(),
+  permission_keys: z.array(z.string()).optional(),
   tags: z.array(zTag).optional(),
   updated_at: z.int().nullish(),
   updated_by: z.string().nullish(),
@@ -3510,11 +3551,12 @@ export const zAppDetailWithSiteWritable = z.object({
   icon_background: z.string().nullish(),
   icon_type: z.string().nullish(),
   id: z.string(),
+  maintainer: z.string().nullish(),
   max_active_requests: z.int().nullish(),
   mode: z.string(),
   model_config: zModelConfig.nullish(),
   name: z.string(),
-  role: z.string().nullish(),
+  permission_keys: z.array(z.string()).optional(),
   site: zSiteWritable.nullish(),
   tags: z.array(zTag).optional(),
   tracing: zJsonValue.nullish(),
@@ -3703,7 +3745,7 @@ export const zPostAppsWorkflowsOnlineUsersBody = zWorkflowOnlineUsersPayload
 export const zPostAppsWorkflowsOnlineUsersResponse = zWorkflowOnlineUsersResponse
 
 export const zDeleteAppsByAppIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -3712,7 +3754,7 @@ export const zDeleteAppsByAppIdPath = z.object({
 export const zDeleteAppsByAppIdResponse = z.void()
 
 export const zGetAppsByAppIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -3723,7 +3765,7 @@ export const zGetAppsByAppIdResponse = zAppDetailWithSite
 export const zPutAppsByAppIdBody = zUpdateAppPayload
 
 export const zPutAppsByAppIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -3732,7 +3774,7 @@ export const zPutAppsByAppIdPath = z.object({
 export const zPutAppsByAppIdResponse = zAppDetailWithSite
 
 export const zGetAppsByAppIdAdvancedChatWorkflowRunsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdAdvancedChatWorkflowRunsQuery = z.object({
@@ -3749,7 +3791,7 @@ export const zGetAppsByAppIdAdvancedChatWorkflowRunsResponse
   = zAdvancedChatWorkflowRunPaginationResponse
 
 export const zGetAppsByAppIdAdvancedChatWorkflowRunsCountPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdAdvancedChatWorkflowRunsCountQuery = z.object({
@@ -3768,7 +3810,7 @@ export const zPostAppsByAppIdAdvancedChatWorkflowsDraftHumanInputNodesByNodeIdFo
 
 export const zPostAppsByAppIdAdvancedChatWorkflowsDraftHumanInputNodesByNodeIdFormPreviewPath
   = z.object({
-    app_id: z.string(),
+    app_id: z.uuid(),
     node_id: z.string(),
   })
 
@@ -3783,7 +3825,7 @@ export const zPostAppsByAppIdAdvancedChatWorkflowsDraftHumanInputNodesByNodeIdFo
 
 export const zPostAppsByAppIdAdvancedChatWorkflowsDraftHumanInputNodesByNodeIdFormRunPath
   = z.object({
-    app_id: z.string(),
+    app_id: z.uuid(),
     node_id: z.string(),
   })
 
@@ -3797,7 +3839,7 @@ export const zPostAppsByAppIdAdvancedChatWorkflowsDraftIterationNodesByNodeIdRun
   = zIterationNodeRunPayload
 
 export const zPostAppsByAppIdAdvancedChatWorkflowsDraftIterationNodesByNodeIdRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -3811,7 +3853,7 @@ export const zPostAppsByAppIdAdvancedChatWorkflowsDraftLoopNodesByNodeIdRunBody
   = zLoopNodeRunPayload
 
 export const zPostAppsByAppIdAdvancedChatWorkflowsDraftLoopNodesByNodeIdRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -3824,7 +3866,7 @@ export const zPostAppsByAppIdAdvancedChatWorkflowsDraftLoopNodesByNodeIdRunRespo
 export const zPostAppsByAppIdAdvancedChatWorkflowsDraftRunBody = zAdvancedChatWorkflowRunPayload
 
 export const zPostAppsByAppIdAdvancedChatWorkflowsDraftRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -3833,7 +3875,7 @@ export const zPostAppsByAppIdAdvancedChatWorkflowsDraftRunPath = z.object({
 export const zPostAppsByAppIdAdvancedChatWorkflowsDraftRunResponse = zGeneratedAppResponse
 
 export const zGetAppsByAppIdAgentDriveFilesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdAgentDriveFilesQuery = z.object({
@@ -3847,7 +3889,7 @@ export const zGetAppsByAppIdAgentDriveFilesQuery = z.object({
 export const zGetAppsByAppIdAgentDriveFilesResponse = zAgentDriveListResponse
 
 export const zGetAppsByAppIdAgentDriveFilesDownloadPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdAgentDriveFilesDownloadQuery = z.object({
@@ -3861,7 +3903,7 @@ export const zGetAppsByAppIdAgentDriveFilesDownloadQuery = z.object({
 export const zGetAppsByAppIdAgentDriveFilesDownloadResponse = zAgentDriveDownloadResponse
 
 export const zGetAppsByAppIdAgentDriveFilesPreviewPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdAgentDriveFilesPreviewQuery = z.object({
@@ -3875,7 +3917,7 @@ export const zGetAppsByAppIdAgentDriveFilesPreviewQuery = z.object({
 export const zGetAppsByAppIdAgentDriveFilesPreviewResponse = zAgentDrivePreviewResponse
 
 export const zDeleteAppsByAppIdAgentFilesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zDeleteAppsByAppIdAgentFilesQuery = z.object({
@@ -3891,7 +3933,7 @@ export const zDeleteAppsByAppIdAgentFilesResponse = zAgentDriveDeleteResponse
 export const zPostAppsByAppIdAgentFilesBody = zAgentDriveFilePayload
 
 export const zPostAppsByAppIdAgentFilesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zPostAppsByAppIdAgentFilesQuery = z.object({
@@ -3904,7 +3946,7 @@ export const zPostAppsByAppIdAgentFilesQuery = z.object({
 export const zPostAppsByAppIdAgentFilesResponse = zAgentDriveFileCommitResponse
 
 export const zGetAppsByAppIdAgentLogsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdAgentLogsQuery = z.object({
@@ -3917,30 +3959,25 @@ export const zGetAppsByAppIdAgentLogsQuery = z.object({
  */
 export const zGetAppsByAppIdAgentLogsResponse = zAgentLogResponse
 
-export const zPostAppsByAppIdAgentSkillsStandardizePath = z.object({
-  app_id: z.string(),
+export const zPostAppsByAppIdAgentSkillsUploadBody = z.object({
+  file: z.custom<Blob | File>(),
 })
 
-export const zPostAppsByAppIdAgentSkillsStandardizeQuery = z.object({
+export const zPostAppsByAppIdAgentSkillsUploadPath = z.object({
+  app_id: z.uuid(),
+})
+
+export const zPostAppsByAppIdAgentSkillsUploadQuery = z.object({
   node_id: z.string().optional(),
 })
 
 /**
- * Skill standardized into drive
- */
-export const zPostAppsByAppIdAgentSkillsStandardizeResponse = zAgentSkillStandardizeResponse
-
-export const zPostAppsByAppIdAgentSkillsUploadPath = z.object({
-  app_id: z.string(),
-})
-
-/**
- * Skill validated
+ * Skill uploaded into drive
  */
 export const zPostAppsByAppIdAgentSkillsUploadResponse = zAgentSkillUploadResponse
 
 export const zDeleteAppsByAppIdAgentSkillsBySlugPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   slug: z.string(),
 })
 
@@ -3954,7 +3991,7 @@ export const zDeleteAppsByAppIdAgentSkillsBySlugQuery = z.object({
 export const zDeleteAppsByAppIdAgentSkillsBySlugResponse = zAgentDriveDeleteResponse
 
 export const zPostAppsByAppIdAgentSkillsBySlugInferToolsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   slug: z.string(),
 })
 
@@ -3971,7 +4008,7 @@ export const zPostAppsByAppIdAnnotationReplyByActionBody = zAnnotationReplyPaylo
 
 export const zPostAppsByAppIdAnnotationReplyByActionPath = z.object({
   action: z.string(),
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -3981,8 +4018,8 @@ export const zPostAppsByAppIdAnnotationReplyByActionResponse = zAnnotationJobSta
 
 export const zGetAppsByAppIdAnnotationReplyByActionStatusByJobIdPath = z.object({
   action: z.string(),
-  app_id: z.string(),
-  job_id: z.string(),
+  app_id: z.uuid(),
+  job_id: z.uuid(),
 })
 
 /**
@@ -3992,7 +4029,7 @@ export const zGetAppsByAppIdAnnotationReplyByActionStatusByJobIdResponse
   = zAnnotationJobStatusResponse
 
 export const zGetAppsByAppIdAnnotationSettingPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4004,8 +4041,8 @@ export const zPostAppsByAppIdAnnotationSettingsByAnnotationSettingIdBody
   = zAnnotationSettingUpdatePayload
 
 export const zPostAppsByAppIdAnnotationSettingsByAnnotationSettingIdPath = z.object({
-  annotation_setting_id: z.string(),
-  app_id: z.string(),
+  annotation_setting_id: z.uuid(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4015,7 +4052,7 @@ export const zPostAppsByAppIdAnnotationSettingsByAnnotationSettingIdResponse
   = zAnnotationSettingResponse
 
 export const zDeleteAppsByAppIdAnnotationsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4024,7 +4061,7 @@ export const zDeleteAppsByAppIdAnnotationsPath = z.object({
 export const zDeleteAppsByAppIdAnnotationsResponse = z.void()
 
 export const zGetAppsByAppIdAnnotationsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdAnnotationsQuery = z.object({
@@ -4041,7 +4078,7 @@ export const zGetAppsByAppIdAnnotationsResponse = zAnnotationList
 export const zPostAppsByAppIdAnnotationsBody = zCreateAnnotationPayload
 
 export const zPostAppsByAppIdAnnotationsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4050,7 +4087,7 @@ export const zPostAppsByAppIdAnnotationsPath = z.object({
 export const zPostAppsByAppIdAnnotationsResponse = zAnnotation
 
 export const zPostAppsByAppIdAnnotationsBatchImportPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4059,8 +4096,8 @@ export const zPostAppsByAppIdAnnotationsBatchImportPath = z.object({
 export const zPostAppsByAppIdAnnotationsBatchImportResponse = zAnnotationJobStatusResponse
 
 export const zGetAppsByAppIdAnnotationsBatchImportStatusByJobIdPath = z.object({
-  app_id: z.string(),
-  job_id: z.string(),
+  app_id: z.uuid(),
+  job_id: z.uuid(),
 })
 
 /**
@@ -4070,7 +4107,7 @@ export const zGetAppsByAppIdAnnotationsBatchImportStatusByJobIdResponse
   = zAnnotationJobStatusResponse
 
 export const zGetAppsByAppIdAnnotationsCountPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4079,7 +4116,7 @@ export const zGetAppsByAppIdAnnotationsCountPath = z.object({
 export const zGetAppsByAppIdAnnotationsCountResponse = zAnnotationCountResponse
 
 export const zGetAppsByAppIdAnnotationsExportPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4088,8 +4125,8 @@ export const zGetAppsByAppIdAnnotationsExportPath = z.object({
 export const zGetAppsByAppIdAnnotationsExportResponse = zAnnotationExportList
 
 export const zDeleteAppsByAppIdAnnotationsByAnnotationIdPath = z.object({
-  annotation_id: z.string(),
-  app_id: z.string(),
+  annotation_id: z.uuid(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4100,15 +4137,15 @@ export const zDeleteAppsByAppIdAnnotationsByAnnotationIdResponse = z.void()
 export const zPostAppsByAppIdAnnotationsByAnnotationIdBody = zUpdateAnnotationPayload
 
 export const zPostAppsByAppIdAnnotationsByAnnotationIdPath = z.object({
-  annotation_id: z.string(),
-  app_id: z.string(),
+  annotation_id: z.uuid(),
+  app_id: z.uuid(),
 })
 
 export const zPostAppsByAppIdAnnotationsByAnnotationIdResponse = z.union([zAnnotation, z.void()])
 
 export const zGetAppsByAppIdAnnotationsByAnnotationIdHitHistoriesPath = z.object({
-  annotation_id: z.string(),
-  app_id: z.string(),
+  annotation_id: z.uuid(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdAnnotationsByAnnotationIdHitHistoriesQuery = z.object({
@@ -4125,7 +4162,7 @@ export const zGetAppsByAppIdAnnotationsByAnnotationIdHitHistoriesResponse
 export const zPostAppsByAppIdApiEnableBody = zAppApiStatusPayload
 
 export const zPostAppsByAppIdApiEnablePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4134,7 +4171,7 @@ export const zPostAppsByAppIdApiEnablePath = z.object({
 export const zPostAppsByAppIdApiEnableResponse = zAppDetail
 
 export const zPostAppsByAppIdAudioToTextPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4143,7 +4180,7 @@ export const zPostAppsByAppIdAudioToTextPath = z.object({
 export const zPostAppsByAppIdAudioToTextResponse = zAudioTranscriptResponse
 
 export const zGetAppsByAppIdChatConversationsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdChatConversationsQuery = z.object({
@@ -4165,8 +4202,8 @@ export const zGetAppsByAppIdChatConversationsQuery = z.object({
 export const zGetAppsByAppIdChatConversationsResponse = zConversationWithSummaryPagination
 
 export const zDeleteAppsByAppIdChatConversationsByConversationIdPath = z.object({
-  app_id: z.string(),
-  conversation_id: z.string(),
+  app_id: z.uuid(),
+  conversation_id: z.uuid(),
 })
 
 /**
@@ -4175,8 +4212,8 @@ export const zDeleteAppsByAppIdChatConversationsByConversationIdPath = z.object(
 export const zDeleteAppsByAppIdChatConversationsByConversationIdResponse = z.void()
 
 export const zGetAppsByAppIdChatConversationsByConversationIdPath = z.object({
-  app_id: z.string(),
-  conversation_id: z.string(),
+  app_id: z.uuid(),
+  conversation_id: z.uuid(),
 })
 
 /**
@@ -4185,7 +4222,7 @@ export const zGetAppsByAppIdChatConversationsByConversationIdPath = z.object({
 export const zGetAppsByAppIdChatConversationsByConversationIdResponse = zConversationDetail
 
 export const zGetAppsByAppIdChatMessagesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdChatMessagesQuery = z.object({
@@ -4200,8 +4237,8 @@ export const zGetAppsByAppIdChatMessagesQuery = z.object({
 export const zGetAppsByAppIdChatMessagesResponse = zMessageInfiniteScrollPaginationResponse
 
 export const zGetAppsByAppIdChatMessagesByMessageIdSuggestedQuestionsPath = z.object({
-  app_id: z.string(),
-  message_id: z.string(),
+  app_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -4211,7 +4248,7 @@ export const zGetAppsByAppIdChatMessagesByMessageIdSuggestedQuestionsResponse
   = zSuggestedQuestionsResponse
 
 export const zPostAppsByAppIdChatMessagesByTaskIdStopPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   task_id: z.string(),
 })
 
@@ -4221,7 +4258,7 @@ export const zPostAppsByAppIdChatMessagesByTaskIdStopPath = z.object({
 export const zPostAppsByAppIdChatMessagesByTaskIdStopResponse = zSimpleResultResponse
 
 export const zGetAppsByAppIdCompletionConversationsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdCompletionConversationsQuery = z.object({
@@ -4239,8 +4276,8 @@ export const zGetAppsByAppIdCompletionConversationsQuery = z.object({
 export const zGetAppsByAppIdCompletionConversationsResponse = zConversationPagination
 
 export const zDeleteAppsByAppIdCompletionConversationsByConversationIdPath = z.object({
-  app_id: z.string(),
-  conversation_id: z.string(),
+  app_id: z.uuid(),
+  conversation_id: z.uuid(),
 })
 
 /**
@@ -4249,8 +4286,8 @@ export const zDeleteAppsByAppIdCompletionConversationsByConversationIdPath = z.o
 export const zDeleteAppsByAppIdCompletionConversationsByConversationIdResponse = z.void()
 
 export const zGetAppsByAppIdCompletionConversationsByConversationIdPath = z.object({
-  app_id: z.string(),
-  conversation_id: z.string(),
+  app_id: z.uuid(),
+  conversation_id: z.uuid(),
 })
 
 /**
@@ -4262,7 +4299,7 @@ export const zGetAppsByAppIdCompletionConversationsByConversationIdResponse
 export const zPostAppsByAppIdCompletionMessagesBody = zCompletionMessagePayload
 
 export const zPostAppsByAppIdCompletionMessagesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4271,7 +4308,7 @@ export const zPostAppsByAppIdCompletionMessagesPath = z.object({
 export const zPostAppsByAppIdCompletionMessagesResponse = zGeneratedAppResponse
 
 export const zPostAppsByAppIdCompletionMessagesByTaskIdStopPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   task_id: z.string(),
 })
 
@@ -4281,7 +4318,7 @@ export const zPostAppsByAppIdCompletionMessagesByTaskIdStopPath = z.object({
 export const zPostAppsByAppIdCompletionMessagesByTaskIdStopResponse = zSimpleResultResponse
 
 export const zGetAppsByAppIdConversationVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdConversationVariablesQuery = z.object({
@@ -4296,7 +4333,7 @@ export const zGetAppsByAppIdConversationVariablesResponse = zPaginatedConversati
 export const zPostAppsByAppIdConvertToWorkflowBody = zConvertToWorkflowPayload
 
 export const zPostAppsByAppIdConvertToWorkflowPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4307,7 +4344,7 @@ export const zPostAppsByAppIdConvertToWorkflowResponse = zNewAppResponse
 export const zPostAppsByAppIdCopyBody = zCopyAppPayload
 
 export const zPostAppsByAppIdCopyPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4316,7 +4353,7 @@ export const zPostAppsByAppIdCopyPath = z.object({
 export const zPostAppsByAppIdCopyResponse = zAppDetailWithSite
 
 export const zGetAppsByAppIdExportPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdExportQuery = z.object({
@@ -4332,7 +4369,7 @@ export const zGetAppsByAppIdExportResponse = zAppExportResponse
 export const zPostAppsByAppIdFeedbacksBody = zMessageFeedbackPayload
 
 export const zPostAppsByAppIdFeedbacksPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4341,7 +4378,7 @@ export const zPostAppsByAppIdFeedbacksPath = z.object({
 export const zPostAppsByAppIdFeedbacksResponse = zSimpleResultResponse
 
 export const zGetAppsByAppIdFeedbacksExportPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdFeedbacksExportQuery = z.object({
@@ -4361,7 +4398,7 @@ export const zGetAppsByAppIdFeedbacksExportResponse = zTextFileResponse
 export const zPostAppsByAppIdIconBody = zAppIconPayload
 
 export const zPostAppsByAppIdIconPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4370,8 +4407,8 @@ export const zPostAppsByAppIdIconPath = z.object({
 export const zPostAppsByAppIdIconResponse = zAppDetail
 
 export const zGetAppsByAppIdMessagesByMessageIdPath = z.object({
-  app_id: z.string(),
-  message_id: z.string(),
+  app_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -4382,7 +4419,7 @@ export const zGetAppsByAppIdMessagesByMessageIdResponse = zMessageDetailResponse
 export const zPostAppsByAppIdModelConfigBody = zModelConfigRequest
 
 export const zPostAppsByAppIdModelConfigPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4393,7 +4430,7 @@ export const zPostAppsByAppIdModelConfigResponse = zSimpleResultResponse
 export const zPostAppsByAppIdNameBody = zAppNamePayload
 
 export const zPostAppsByAppIdNamePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4402,7 +4439,7 @@ export const zPostAppsByAppIdNamePath = z.object({
 export const zPostAppsByAppIdNameResponse = zAppDetail
 
 export const zPostAppsByAppIdPublishToCreatorsPlatformPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4411,7 +4448,7 @@ export const zPostAppsByAppIdPublishToCreatorsPlatformPath = z.object({
 export const zPostAppsByAppIdPublishToCreatorsPlatformResponse = zRedirectUrlResponse
 
 export const zGetAppsByAppIdServerPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4422,7 +4459,7 @@ export const zGetAppsByAppIdServerResponse = zAppMcpServerResponse
 export const zPostAppsByAppIdServerBody = zMcpServerCreatePayload
 
 export const zPostAppsByAppIdServerPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4433,7 +4470,7 @@ export const zPostAppsByAppIdServerResponse = zAppMcpServerResponse
 export const zPutAppsByAppIdServerBody = zMcpServerUpdatePayload
 
 export const zPutAppsByAppIdServerPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4444,7 +4481,7 @@ export const zPutAppsByAppIdServerResponse = zAppMcpServerResponse
 export const zPostAppsByAppIdSiteBody = zAppSiteUpdatePayload
 
 export const zPostAppsByAppIdSitePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4455,7 +4492,7 @@ export const zPostAppsByAppIdSiteResponse = zAppSiteResponse
 export const zPostAppsByAppIdSiteEnableBody = zAppSiteStatusPayload
 
 export const zPostAppsByAppIdSiteEnablePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4464,7 +4501,7 @@ export const zPostAppsByAppIdSiteEnablePath = z.object({
 export const zPostAppsByAppIdSiteEnableResponse = zAppDetail
 
 export const zPostAppsByAppIdSiteAccessTokenResetPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4473,7 +4510,7 @@ export const zPostAppsByAppIdSiteAccessTokenResetPath = z.object({
 export const zPostAppsByAppIdSiteAccessTokenResetResponse = zAppSiteResponse
 
 export const zDeleteAppsByAppIdStarPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4482,7 +4519,7 @@ export const zDeleteAppsByAppIdStarPath = z.object({
 export const zDeleteAppsByAppIdStarResponse = zSimpleResultResponse
 
 export const zPostAppsByAppIdStarPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4491,7 +4528,7 @@ export const zPostAppsByAppIdStarPath = z.object({
 export const zPostAppsByAppIdStarResponse = zSimpleResultResponse
 
 export const zGetAppsByAppIdStatisticsAverageResponseTimePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdStatisticsAverageResponseTimeQuery = z.object({
@@ -4506,7 +4543,7 @@ export const zGetAppsByAppIdStatisticsAverageResponseTimeResponse
   = zAverageResponseTimeStatisticResponse
 
 export const zGetAppsByAppIdStatisticsAverageSessionInteractionsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdStatisticsAverageSessionInteractionsQuery = z.object({
@@ -4521,7 +4558,7 @@ export const zGetAppsByAppIdStatisticsAverageSessionInteractionsResponse
   = zAverageSessionInteractionStatisticResponse
 
 export const zGetAppsByAppIdStatisticsDailyConversationsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdStatisticsDailyConversationsQuery = z.object({
@@ -4536,7 +4573,7 @@ export const zGetAppsByAppIdStatisticsDailyConversationsResponse
   = zDailyConversationStatisticResponse
 
 export const zGetAppsByAppIdStatisticsDailyEndUsersPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdStatisticsDailyEndUsersQuery = z.object({
@@ -4550,7 +4587,7 @@ export const zGetAppsByAppIdStatisticsDailyEndUsersQuery = z.object({
 export const zGetAppsByAppIdStatisticsDailyEndUsersResponse = zDailyTerminalStatisticResponse
 
 export const zGetAppsByAppIdStatisticsDailyMessagesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdStatisticsDailyMessagesQuery = z.object({
@@ -4564,7 +4601,7 @@ export const zGetAppsByAppIdStatisticsDailyMessagesQuery = z.object({
 export const zGetAppsByAppIdStatisticsDailyMessagesResponse = zDailyMessageStatisticResponse
 
 export const zGetAppsByAppIdStatisticsTokenCostsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdStatisticsTokenCostsQuery = z.object({
@@ -4578,7 +4615,7 @@ export const zGetAppsByAppIdStatisticsTokenCostsQuery = z.object({
 export const zGetAppsByAppIdStatisticsTokenCostsResponse = zDailyTokenCostStatisticResponse
 
 export const zGetAppsByAppIdStatisticsTokensPerSecondPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdStatisticsTokensPerSecondQuery = z.object({
@@ -4592,7 +4629,7 @@ export const zGetAppsByAppIdStatisticsTokensPerSecondQuery = z.object({
 export const zGetAppsByAppIdStatisticsTokensPerSecondResponse = zTokensPerSecondStatisticResponse
 
 export const zGetAppsByAppIdStatisticsUserSatisfactionRatePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdStatisticsUserSatisfactionRateQuery = z.object({
@@ -4609,7 +4646,7 @@ export const zGetAppsByAppIdStatisticsUserSatisfactionRateResponse
 export const zPostAppsByAppIdTextToAudioBody = zTextToSpeechPayload
 
 export const zPostAppsByAppIdTextToAudioPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4618,7 +4655,7 @@ export const zPostAppsByAppIdTextToAudioPath = z.object({
 export const zPostAppsByAppIdTextToAudioResponse = zAudioBinaryResponse
 
 export const zGetAppsByAppIdTextToAudioVoicesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdTextToAudioVoicesQuery = z.object({
@@ -4631,7 +4668,7 @@ export const zGetAppsByAppIdTextToAudioVoicesQuery = z.object({
 export const zGetAppsByAppIdTextToAudioVoicesResponse = zTextToSpeechVoiceListResponse
 
 export const zGetAppsByAppIdTracePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4642,7 +4679,7 @@ export const zGetAppsByAppIdTraceResponse = zAppTraceResponse
 export const zPostAppsByAppIdTraceBody = zAppTracePayload
 
 export const zPostAppsByAppIdTracePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4651,7 +4688,7 @@ export const zPostAppsByAppIdTracePath = z.object({
 export const zPostAppsByAppIdTraceResponse = zSimpleResultResponse
 
 export const zDeleteAppsByAppIdTraceConfigPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zDeleteAppsByAppIdTraceConfigQuery = z.object({
@@ -4664,7 +4701,7 @@ export const zDeleteAppsByAppIdTraceConfigQuery = z.object({
 export const zDeleteAppsByAppIdTraceConfigResponse = z.void()
 
 export const zGetAppsByAppIdTraceConfigPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdTraceConfigQuery = z.object({
@@ -4679,7 +4716,7 @@ export const zGetAppsByAppIdTraceConfigResponse = zTraceAppConfigResponse
 export const zPatchAppsByAppIdTraceConfigBody = zTraceConfigPayload
 
 export const zPatchAppsByAppIdTraceConfigPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4690,7 +4727,7 @@ export const zPatchAppsByAppIdTraceConfigResponse = zTraceAppConfigResponse
 export const zPostAppsByAppIdTraceConfigBody = zTraceConfigPayload
 
 export const zPostAppsByAppIdTraceConfigPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4701,7 +4738,7 @@ export const zPostAppsByAppIdTraceConfigResponse = zTraceAppConfigResponse
 export const zPostAppsByAppIdTriggerEnableBody = zParserEnable
 
 export const zPostAppsByAppIdTriggerEnablePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4710,7 +4747,7 @@ export const zPostAppsByAppIdTriggerEnablePath = z.object({
 export const zPostAppsByAppIdTriggerEnableResponse = zWorkflowTriggerResponse
 
 export const zGetAppsByAppIdTriggersPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4719,7 +4756,7 @@ export const zGetAppsByAppIdTriggersPath = z.object({
 export const zGetAppsByAppIdTriggersResponse = zWorkflowTriggerListResponse
 
 export const zGetAppsByAppIdWorkflowAppLogsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowAppLogsQuery = z.object({
@@ -4742,7 +4779,7 @@ export const zGetAppsByAppIdWorkflowAppLogsQuery = z.object({
 export const zGetAppsByAppIdWorkflowAppLogsResponse = zWorkflowAppLogPaginationResponse
 
 export const zGetAppsByAppIdWorkflowArchivedLogsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowArchivedLogsQuery = z.object({
@@ -4765,7 +4802,7 @@ export const zGetAppsByAppIdWorkflowArchivedLogsQuery = z.object({
 export const zGetAppsByAppIdWorkflowArchivedLogsResponse = zWorkflowArchivedLogPaginationResponse
 
 export const zGetAppsByAppIdWorkflowRunsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowRunsQuery = z.object({
@@ -4781,7 +4818,7 @@ export const zGetAppsByAppIdWorkflowRunsQuery = z.object({
 export const zGetAppsByAppIdWorkflowRunsResponse = zWorkflowRunPaginationResponse
 
 export const zGetAppsByAppIdWorkflowRunsCountPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowRunsCountQuery = z.object({
@@ -4796,7 +4833,7 @@ export const zGetAppsByAppIdWorkflowRunsCountQuery = z.object({
 export const zGetAppsByAppIdWorkflowRunsCountResponse = zWorkflowRunCountResponse
 
 export const zPostAppsByAppIdWorkflowRunsTasksByTaskIdStopPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   task_id: z.string(),
 })
 
@@ -4806,8 +4843,8 @@ export const zPostAppsByAppIdWorkflowRunsTasksByTaskIdStopPath = z.object({
 export const zPostAppsByAppIdWorkflowRunsTasksByTaskIdStopResponse = zSimpleResultResponse
 
 export const zGetAppsByAppIdWorkflowRunsByRunIdPath = z.object({
-  app_id: z.string(),
-  run_id: z.string(),
+  app_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -4816,8 +4853,8 @@ export const zGetAppsByAppIdWorkflowRunsByRunIdPath = z.object({
 export const zGetAppsByAppIdWorkflowRunsByRunIdResponse = zWorkflowRunDetailResponse
 
 export const zGetAppsByAppIdWorkflowRunsByRunIdExportPath = z.object({
-  app_id: z.string(),
-  run_id: z.string(),
+  app_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -4826,8 +4863,8 @@ export const zGetAppsByAppIdWorkflowRunsByRunIdExportPath = z.object({
 export const zGetAppsByAppIdWorkflowRunsByRunIdExportResponse = zWorkflowRunExportResponse
 
 export const zGetAppsByAppIdWorkflowRunsByRunIdNodeExecutionsPath = z.object({
-  app_id: z.string(),
-  run_id: z.string(),
+  app_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -4838,9 +4875,9 @@ export const zGetAppsByAppIdWorkflowRunsByRunIdNodeExecutionsResponse
 
 export const zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesPath
   = z.object({
-    app_id: z.string(),
+    app_id: z.uuid(),
     node_id: z.string(),
-    workflow_run_id: z.string(),
+    workflow_run_id: z.uuid(),
   })
 
 export const zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesQuery
@@ -4857,9 +4894,9 @@ export const zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandbox
 
 export const zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesReadPath
   = z.object({
-    app_id: z.string(),
+    app_id: z.uuid(),
     node_id: z.string(),
-    workflow_run_id: z.string(),
+    workflow_run_id: z.uuid(),
   })
 
 export const zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesReadQuery
@@ -4879,9 +4916,9 @@ export const zPostAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandbo
 
 export const zPostAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesUploadPath
   = z.object({
-    app_id: z.string(),
+    app_id: z.uuid(),
     node_id: z.string(),
-    workflow_run_id: z.string(),
+    workflow_run_id: z.uuid(),
   })
 
 /**
@@ -4891,7 +4928,7 @@ export const zPostAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandbo
   = zSandboxUploadResponse
 
 export const zGetAppsByAppIdWorkflowCommentsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4902,7 +4939,7 @@ export const zGetAppsByAppIdWorkflowCommentsResponse = zWorkflowCommentBasicList
 export const zPostAppsByAppIdWorkflowCommentsBody = zWorkflowCommentCreatePayload
 
 export const zPostAppsByAppIdWorkflowCommentsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4911,7 +4948,7 @@ export const zPostAppsByAppIdWorkflowCommentsPath = z.object({
 export const zPostAppsByAppIdWorkflowCommentsResponse = zWorkflowCommentCreate
 
 export const zGetAppsByAppIdWorkflowCommentsMentionUsersPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -4921,7 +4958,7 @@ export const zGetAppsByAppIdWorkflowCommentsMentionUsersResponse
   = zWorkflowCommentMentionUsersPayload
 
 export const zDeleteAppsByAppIdWorkflowCommentsByCommentIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   comment_id: z.string(),
 })
 
@@ -4931,7 +4968,7 @@ export const zDeleteAppsByAppIdWorkflowCommentsByCommentIdPath = z.object({
 export const zDeleteAppsByAppIdWorkflowCommentsByCommentIdResponse = z.void()
 
 export const zGetAppsByAppIdWorkflowCommentsByCommentIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   comment_id: z.string(),
 })
 
@@ -4943,7 +4980,7 @@ export const zGetAppsByAppIdWorkflowCommentsByCommentIdResponse = zWorkflowComme
 export const zPutAppsByAppIdWorkflowCommentsByCommentIdBody = zWorkflowCommentUpdatePayload
 
 export const zPutAppsByAppIdWorkflowCommentsByCommentIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   comment_id: z.string(),
 })
 
@@ -4955,7 +4992,7 @@ export const zPutAppsByAppIdWorkflowCommentsByCommentIdResponse = zWorkflowComme
 export const zPostAppsByAppIdWorkflowCommentsByCommentIdRepliesBody = zWorkflowCommentReplyPayload
 
 export const zPostAppsByAppIdWorkflowCommentsByCommentIdRepliesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   comment_id: z.string(),
 })
 
@@ -4966,7 +5003,7 @@ export const zPostAppsByAppIdWorkflowCommentsByCommentIdRepliesResponse
   = zWorkflowCommentReplyCreate
 
 export const zDeleteAppsByAppIdWorkflowCommentsByCommentIdRepliesByReplyIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   comment_id: z.string(),
   reply_id: z.string(),
 })
@@ -4980,7 +5017,7 @@ export const zPutAppsByAppIdWorkflowCommentsByCommentIdRepliesByReplyIdBody
   = zWorkflowCommentReplyPayload
 
 export const zPutAppsByAppIdWorkflowCommentsByCommentIdRepliesByReplyIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   comment_id: z.string(),
   reply_id: z.string(),
 })
@@ -4992,7 +5029,7 @@ export const zPutAppsByAppIdWorkflowCommentsByCommentIdRepliesByReplyIdResponse
   = zWorkflowCommentReplyUpdate
 
 export const zPostAppsByAppIdWorkflowCommentsByCommentIdResolvePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   comment_id: z.string(),
 })
 
@@ -5002,7 +5039,7 @@ export const zPostAppsByAppIdWorkflowCommentsByCommentIdResolvePath = z.object({
 export const zPostAppsByAppIdWorkflowCommentsByCommentIdResolveResponse = zWorkflowCommentResolve
 
 export const zGetAppsByAppIdWorkflowStatisticsAverageAppInteractionsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowStatisticsAverageAppInteractionsQuery = z.object({
@@ -5017,7 +5054,7 @@ export const zGetAppsByAppIdWorkflowStatisticsAverageAppInteractionsResponse
   = zWorkflowAverageAppInteractionStatisticResponse
 
 export const zGetAppsByAppIdWorkflowStatisticsDailyConversationsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowStatisticsDailyConversationsQuery = z.object({
@@ -5032,7 +5069,7 @@ export const zGetAppsByAppIdWorkflowStatisticsDailyConversationsResponse
   = zWorkflowDailyRunsStatisticResponse
 
 export const zGetAppsByAppIdWorkflowStatisticsDailyTerminalsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowStatisticsDailyTerminalsQuery = z.object({
@@ -5047,7 +5084,7 @@ export const zGetAppsByAppIdWorkflowStatisticsDailyTerminalsResponse
   = zWorkflowDailyTerminalsStatisticResponse
 
 export const zGetAppsByAppIdWorkflowStatisticsTokenCostsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowStatisticsTokenCostsQuery = z.object({
@@ -5062,7 +5099,7 @@ export const zGetAppsByAppIdWorkflowStatisticsTokenCostsResponse
   = zWorkflowDailyTokenCostStatisticResponse
 
 export const zGetAppsByAppIdWorkflowsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowsQuery = z.object({
@@ -5078,7 +5115,7 @@ export const zGetAppsByAppIdWorkflowsQuery = z.object({
 export const zGetAppsByAppIdWorkflowsResponse = zWorkflowPaginationResponse
 
 export const zGetAppsByAppIdWorkflowsDefaultWorkflowBlockConfigsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5088,7 +5125,7 @@ export const zGetAppsByAppIdWorkflowsDefaultWorkflowBlockConfigsResponse
   = zDefaultBlockConfigsResponse
 
 export const zGetAppsByAppIdWorkflowsDefaultWorkflowBlockConfigsByBlockTypePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   block_type: z.string(),
 })
 
@@ -5103,7 +5140,7 @@ export const zGetAppsByAppIdWorkflowsDefaultWorkflowBlockConfigsByBlockTypeRespo
   = zDefaultBlockConfigResponse
 
 export const zGetAppsByAppIdWorkflowsDraftPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5114,7 +5151,7 @@ export const zGetAppsByAppIdWorkflowsDraftResponse = zWorkflowResponse
 export const zPostAppsByAppIdWorkflowsDraftBody = zSyncDraftWorkflowPayload
 
 export const zPostAppsByAppIdWorkflowsDraftPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5123,7 +5160,7 @@ export const zPostAppsByAppIdWorkflowsDraftPath = z.object({
 export const zPostAppsByAppIdWorkflowsDraftResponse = zSyncDraftWorkflowResponse
 
 export const zGetAppsByAppIdWorkflowsDraftConversationVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5135,7 +5172,7 @@ export const zPostAppsByAppIdWorkflowsDraftConversationVariablesBody
   = zConversationVariableUpdatePayload
 
 export const zPostAppsByAppIdWorkflowsDraftConversationVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5144,7 +5181,7 @@ export const zPostAppsByAppIdWorkflowsDraftConversationVariablesPath = z.object(
 export const zPostAppsByAppIdWorkflowsDraftConversationVariablesResponse = zSimpleResultResponse
 
 export const zGetAppsByAppIdWorkflowsDraftEnvironmentVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5157,7 +5194,7 @@ export const zPostAppsByAppIdWorkflowsDraftEnvironmentVariablesBody
   = zEnvironmentVariableUpdatePayload
 
 export const zPostAppsByAppIdWorkflowsDraftEnvironmentVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5168,7 +5205,7 @@ export const zPostAppsByAppIdWorkflowsDraftEnvironmentVariablesResponse = zSimpl
 export const zPostAppsByAppIdWorkflowsDraftFeaturesBody = zWorkflowFeaturesPayload
 
 export const zPostAppsByAppIdWorkflowsDraftFeaturesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5180,7 +5217,7 @@ export const zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdDeliveryTestBo
   = zHumanInputDeliveryTestPayload
 
 export const zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdDeliveryTestPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5194,7 +5231,7 @@ export const zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdFormPreviewBod
   = zHumanInputFormPreviewPayload
 
 export const zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdFormPreviewPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5208,7 +5245,7 @@ export const zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdFormRunBody
   = zHumanInputFormSubmitPayload
 
 export const zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdFormRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5221,7 +5258,7 @@ export const zPostAppsByAppIdWorkflowsDraftHumanInputNodesByNodeIdFormRunRespons
 export const zPostAppsByAppIdWorkflowsDraftIterationNodesByNodeIdRunBody = zIterationNodeRunPayload
 
 export const zPostAppsByAppIdWorkflowsDraftIterationNodesByNodeIdRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5233,7 +5270,7 @@ export const zPostAppsByAppIdWorkflowsDraftIterationNodesByNodeIdRunResponse = z
 export const zPostAppsByAppIdWorkflowsDraftLoopNodesByNodeIdRunBody = zLoopNodeRunPayload
 
 export const zPostAppsByAppIdWorkflowsDraftLoopNodesByNodeIdRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5243,7 +5280,7 @@ export const zPostAppsByAppIdWorkflowsDraftLoopNodesByNodeIdRunPath = z.object({
 export const zPostAppsByAppIdWorkflowsDraftLoopNodesByNodeIdRunResponse = zGeneratedAppResponse
 
 export const zGetAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5256,7 +5293,7 @@ export const zGetAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerResponse
 export const zPutAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerBody = zComposerSavePayload
 
 export const zPutAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5267,7 +5304,7 @@ export const zPutAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerResponse
   = zWorkflowAgentComposerResponse
 
 export const zGetAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerCandidatesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5281,7 +5318,7 @@ export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerImpactBody
   = zComposerSavePayload
 
 export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerImpactPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5295,7 +5332,7 @@ export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerSaveToRoste
   = zComposerSavePayload
 
 export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerSaveToRosterPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5309,7 +5346,7 @@ export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerValidateBod
   = zComposerSavePayload
 
 export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerValidatePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5320,7 +5357,7 @@ export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerValidateRes
   = zAgentComposerValidateResponse
 
 export const zGetAppsByAppIdWorkflowsDraftNodesByNodeIdLastRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5333,7 +5370,7 @@ export const zGetAppsByAppIdWorkflowsDraftNodesByNodeIdLastRunResponse
 export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdRunBody = zDraftWorkflowNodeRunPayload
 
 export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5344,7 +5381,7 @@ export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdRunResponse
   = zWorkflowRunNodeExecutionResponse
 
 export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdTriggerRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5354,7 +5391,7 @@ export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdTriggerRunPath = z.objec
 export const zPostAppsByAppIdWorkflowsDraftNodesByNodeIdTriggerRunResponse = zGeneratedAppResponse
 
 export const zDeleteAppsByAppIdWorkflowsDraftNodesByNodeIdVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5364,7 +5401,7 @@ export const zDeleteAppsByAppIdWorkflowsDraftNodesByNodeIdVariablesPath = z.obje
 export const zDeleteAppsByAppIdWorkflowsDraftNodesByNodeIdVariablesResponse = z.void()
 
 export const zGetAppsByAppIdWorkflowsDraftNodesByNodeIdVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
 })
 
@@ -5377,7 +5414,7 @@ export const zGetAppsByAppIdWorkflowsDraftNodesByNodeIdVariablesResponse
 export const zPostAppsByAppIdWorkflowsDraftRunBody = zDraftWorkflowRunPayload
 
 export const zPostAppsByAppIdWorkflowsDraftRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5386,8 +5423,8 @@ export const zPostAppsByAppIdWorkflowsDraftRunPath = z.object({
 export const zPostAppsByAppIdWorkflowsDraftRunResponse = zGeneratedAppResponse
 
 export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsPath = z.object({
-  app_id: z.string(),
-  run_id: z.string(),
+  app_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -5396,8 +5433,8 @@ export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsPath = z.object(
 export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsResponse = zWorkflowRunSnapshotView
 
 export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsEventsPath = z.object({
-  app_id: z.string(),
-  run_id: z.string(),
+  app_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -5407,9 +5444,9 @@ export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsEventsResponse
   = zEventStreamResponse
 
 export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsByNodeIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
-  run_id: z.string(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -5419,10 +5456,10 @@ export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsByNodeIdResponse
 
 export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsByNodeIdByOutputNamePreviewPath
   = z.object({
-    app_id: z.string(),
+    app_id: z.uuid(),
     node_id: z.string(),
     output_name: z.string(),
-    run_id: z.string(),
+    run_id: z.uuid(),
   })
 
 /**
@@ -5432,7 +5469,7 @@ export const zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsByNodeIdByOutput
   = zOutputPreviewView
 
 export const zGetAppsByAppIdWorkflowsDraftSystemVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5443,7 +5480,7 @@ export const zGetAppsByAppIdWorkflowsDraftSystemVariablesResponse = zWorkflowDra
 export const zPostAppsByAppIdWorkflowsDraftTriggerRunBody = zDraftWorkflowTriggerRunRequest
 
 export const zPostAppsByAppIdWorkflowsDraftTriggerRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5454,7 +5491,7 @@ export const zPostAppsByAppIdWorkflowsDraftTriggerRunResponse = zGeneratedAppRes
 export const zPostAppsByAppIdWorkflowsDraftTriggerRunAllBody = zDraftWorkflowTriggerRunAllPayload
 
 export const zPostAppsByAppIdWorkflowsDraftTriggerRunAllPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5463,7 +5500,7 @@ export const zPostAppsByAppIdWorkflowsDraftTriggerRunAllPath = z.object({
 export const zPostAppsByAppIdWorkflowsDraftTriggerRunAllResponse = zGeneratedAppResponse
 
 export const zDeleteAppsByAppIdWorkflowsDraftVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5472,7 +5509,7 @@ export const zDeleteAppsByAppIdWorkflowsDraftVariablesPath = z.object({
 export const zDeleteAppsByAppIdWorkflowsDraftVariablesResponse = z.void()
 
 export const zGetAppsByAppIdWorkflowsDraftVariablesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowsDraftVariablesQuery = z.object({
@@ -5486,8 +5523,8 @@ export const zGetAppsByAppIdWorkflowsDraftVariablesQuery = z.object({
 export const zGetAppsByAppIdWorkflowsDraftVariablesResponse = zWorkflowDraftVariableListWithoutValue
 
 export const zDeleteAppsByAppIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  app_id: z.string(),
-  variable_id: z.string(),
+  app_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -5496,8 +5533,8 @@ export const zDeleteAppsByAppIdWorkflowsDraftVariablesByVariableIdPath = z.objec
 export const zDeleteAppsByAppIdWorkflowsDraftVariablesByVariableIdResponse = z.void()
 
 export const zGetAppsByAppIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  app_id: z.string(),
-  variable_id: z.string(),
+  app_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -5509,8 +5546,8 @@ export const zPatchAppsByAppIdWorkflowsDraftVariablesByVariableIdBody
   = zWorkflowDraftVariableUpdatePayload
 
 export const zPatchAppsByAppIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  app_id: z.string(),
-  variable_id: z.string(),
+  app_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -5519,8 +5556,8 @@ export const zPatchAppsByAppIdWorkflowsDraftVariablesByVariableIdPath = z.object
 export const zPatchAppsByAppIdWorkflowsDraftVariablesByVariableIdResponse = zWorkflowDraftVariable
 
 export const zPutAppsByAppIdWorkflowsDraftVariablesByVariableIdResetPath = z.object({
-  app_id: z.string(),
-  variable_id: z.string(),
+  app_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 export const zPutAppsByAppIdWorkflowsDraftVariablesByVariableIdResetResponse = z.union([
@@ -5529,7 +5566,7 @@ export const zPutAppsByAppIdWorkflowsDraftVariablesByVariableIdResetResponse = z
 ])
 
 export const zGetAppsByAppIdWorkflowsPublishPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5540,7 +5577,7 @@ export const zGetAppsByAppIdWorkflowsPublishResponse = zWorkflowResponse
 export const zPostAppsByAppIdWorkflowsPublishBody = zPublishWorkflowPayload
 
 export const zPostAppsByAppIdWorkflowsPublishPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -5549,8 +5586,8 @@ export const zPostAppsByAppIdWorkflowsPublishPath = z.object({
 export const zPostAppsByAppIdWorkflowsPublishResponse = zWorkflowPublishResponse
 
 export const zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsPath = z.object({
-  app_id: z.string(),
-  run_id: z.string(),
+  app_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -5560,8 +5597,8 @@ export const zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsResponse
   = zWorkflowRunSnapshotView
 
 export const zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsEventsPath = z.object({
-  app_id: z.string(),
-  run_id: z.string(),
+  app_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -5571,9 +5608,9 @@ export const zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsEventsRespon
   = zEventStreamResponse
 
 export const zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsByNodeIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   node_id: z.string(),
-  run_id: z.string(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -5584,10 +5621,10 @@ export const zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsByNodeIdResp
 
 export const zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsByNodeIdByOutputNamePreviewPath
   = z.object({
-    app_id: z.string(),
+    app_id: z.uuid(),
     node_id: z.string(),
     output_name: z.string(),
-    run_id: z.string(),
+    run_id: z.uuid(),
   })
 
 /**
@@ -5597,7 +5634,7 @@ export const zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsByNodeIdByOu
   = zOutputPreviewView
 
 export const zGetAppsByAppIdWorkflowsTriggersWebhookPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetAppsByAppIdWorkflowsTriggersWebhookQuery = z.object({
@@ -5610,7 +5647,7 @@ export const zGetAppsByAppIdWorkflowsTriggersWebhookQuery = z.object({
 export const zGetAppsByAppIdWorkflowsTriggersWebhookResponse = zWebhookTriggerResponse
 
 export const zDeleteAppsByAppIdWorkflowsByWorkflowIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   workflow_id: z.string(),
 })
 
@@ -5622,7 +5659,7 @@ export const zDeleteAppsByAppIdWorkflowsByWorkflowIdResponse = z.void()
 export const zPatchAppsByAppIdWorkflowsByWorkflowIdBody = zWorkflowUpdatePayload
 
 export const zPatchAppsByAppIdWorkflowsByWorkflowIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   workflow_id: z.string(),
 })
 
@@ -5632,7 +5669,7 @@ export const zPatchAppsByAppIdWorkflowsByWorkflowIdPath = z.object({
 export const zPatchAppsByAppIdWorkflowsByWorkflowIdResponse = zWorkflowResponse
 
 export const zPostAppsByAppIdWorkflowsByWorkflowIdRestorePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   workflow_id: z.string(),
 })
 
@@ -5642,7 +5679,7 @@ export const zPostAppsByAppIdWorkflowsByWorkflowIdRestorePath = z.object({
 export const zPostAppsByAppIdWorkflowsByWorkflowIdRestoreResponse = zWorkflowRestoreResponse
 
 export const zGetAppsByResourceIdApiKeysPath = z.object({
-  resource_id: z.string(),
+  resource_id: z.uuid(),
 })
 
 /**
@@ -5651,7 +5688,7 @@ export const zGetAppsByResourceIdApiKeysPath = z.object({
 export const zGetAppsByResourceIdApiKeysResponse = zApiKeyList
 
 export const zPostAppsByResourceIdApiKeysPath = z.object({
-  resource_id: z.string(),
+  resource_id: z.uuid(),
 })
 
 /**
@@ -5660,8 +5697,8 @@ export const zPostAppsByResourceIdApiKeysPath = z.object({
 export const zPostAppsByResourceIdApiKeysResponse = zApiKeyItem
 
 export const zDeleteAppsByResourceIdApiKeysByApiKeyIdPath = z.object({
-  api_key_id: z.string(),
-  resource_id: z.string(),
+  api_key_id: z.uuid(),
+  resource_id: z.uuid(),
 })
 
 /**
@@ -5670,7 +5707,7 @@ export const zDeleteAppsByResourceIdApiKeysByApiKeyIdPath = z.object({
 export const zDeleteAppsByResourceIdApiKeysByApiKeyIdResponse = z.void()
 
 export const zGetAppsByServerIdServerRefreshPath = z.object({
-  server_id: z.string(),
+  server_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/data-source/zod.gen.ts b/packages/contracts/generated/api/console/data-source/zod.gen.ts
index e5cf1735c3f..e2774d10f42 100644
--- a/packages/contracts/generated/api/console/data-source/zod.gen.ts
+++ b/packages/contracts/generated/api/console/data-source/zod.gen.ts
@@ -72,7 +72,7 @@ export const zPatchDataSourceIntegratesResponse = zSimpleResultResponse
 
 export const zGetDataSourceIntegratesByBindingIdByActionPath = z.object({
   action: z.string(),
-  binding_id: z.string(),
+  binding_id: z.uuid(),
 })
 
 /**
@@ -82,7 +82,7 @@ export const zGetDataSourceIntegratesByBindingIdByActionResponse = zDataSourceIn
 
 export const zPatchDataSourceIntegratesByBindingIdByActionPath = z.object({
   action: z.string(),
-  binding_id: z.string(),
+  binding_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/datasets/types.gen.ts b/packages/contracts/generated/api/console/datasets/types.gen.ts
index a24c6cf92ae..f904ea7d717 100644
--- a/packages/contracts/generated/api/console/datasets/types.gen.ts
+++ b/packages/contracts/generated/api/console/datasets/types.gen.ts
@@ -45,8 +45,10 @@ export type DatasetDetailResponse = {
   indexing_technique: string | null
   is_multimodal: boolean
   is_published: boolean
+  maintainer?: string | null
   name: string
   permission: string
+  permission_keys?: Array<string>
   pipeline_id: string | null
   provider: string
   retrieval_model_dict: DatasetRetrievalModelResponse
@@ -120,6 +122,7 @@ export type DatasetDetail = {
   is_published?: boolean
   name?: string
   permission?: string
+  permission_keys?: Array<string>
   pipeline_id?: string
   provider?: string
   retrieval_model_dict?: DatasetRetrievalModel
@@ -187,7 +190,7 @@ export type IndexingEstimateResponse = {
 
 export type KnowledgeConfig = {
   data_source?: DataSource | null
-  doc_form?: string
+  doc_form?: 'hierarchical_model' | 'qa_model' | 'text_model'
   doc_language?: string
   duplicate?: boolean
   embedding_model?: string | null
@@ -199,7 +202,10 @@ export type KnowledgeConfig = {
   process_rule?: ProcessRule | null
   retrieval_model?: RetrievalModel | null
   summary_index_setting?: {
-    [key: string]: unknown
+    enable?: boolean
+    model_name?: string
+    model_provider_name?: string
+    summary_prompt?: string
   } | null
 }
 
@@ -261,9 +267,11 @@ export type DatasetDetailWithPartialMembersResponse = {
   indexing_technique: string | null
   is_multimodal: boolean
   is_published: boolean
+  maintainer?: string | null
   name: string
   partial_member_list?: Array<string> | null
   permission: string
+  permission_keys?: Array<string>
   pipeline_id: string | null
   provider: string
   retrieval_model_dict: DatasetRetrievalModelResponse
@@ -482,7 +490,9 @@ export type ExternalRetrievalTestResponse
 export type HitTestingPayload = {
   attachment_ids?: Array<string> | null
   external_retrieval_model?: {
-    [key: string]: unknown
+    score_threshold?: number
+    score_threshold_enabled?: boolean
+    top_k?: number
   } | null
   query: string
   retrieval_model?: RetrievalModel | null
@@ -561,9 +571,11 @@ export type DatasetListItemResponse = {
   indexing_technique: string | null
   is_multimodal: boolean
   is_published: boolean
+  maintainer?: string | null
   name: string
   partial_member_list: Array<string>
   permission: string
+  permission_keys?: Array<string>
   pipeline_id: string | null
   provider: string
   retrieval_model_dict: DatasetRetrievalModelResponse
@@ -707,7 +719,7 @@ export type ProcessRule = {
 export type RetrievalModel = {
   metadata_filtering_conditions?: MetadataFilteringCondition | null
   reranking_enable: boolean
-  reranking_mode?: string | null
+  reranking_mode?: 'reranking_model' | 'weighted_score' | null
   reranking_model?: RerankingModel | null
   score_threshold?: number | null
   score_threshold_enabled: boolean
@@ -1035,7 +1047,7 @@ export type WebsiteInfo = {
 
 export type PreProcessingRule = {
   enabled: boolean
-  id: string
+  id: 'remove_extra_spaces' | 'remove_stopwords' | 'remove_urls_emails'
 }
 
 export type Segmentation = {
@@ -1065,7 +1077,7 @@ export type Condition = {
     | '≤'
     | '≥'
   name: string
-  value?: string | Array<string> | number | number | null
+  value?: string | Array<string> | number | null
 }
 
 export type WeightKeywordSetting = {
diff --git a/packages/contracts/generated/api/console/datasets/zod.gen.ts b/packages/contracts/generated/api/console/datasets/zod.gen.ts
index 5a5f9282794..10ceb11cb5d 100644
--- a/packages/contracts/generated/api/console/datasets/zod.gen.ts
+++ b/packages/contracts/generated/api/console/datasets/zod.gen.ts
@@ -963,8 +963,10 @@ export const zDatasetDetailResponse = z.object({
   indexing_technique: z.string().nullable(),
   is_multimodal: z.boolean(),
   is_published: z.boolean(),
+  maintainer: z.string().nullish(),
   name: z.string(),
   permission: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   pipeline_id: z.string().nullable(),
   provider: z.string(),
   retrieval_model_dict: zDatasetRetrievalModelResponse,
@@ -1004,9 +1006,11 @@ export const zDatasetDetailWithPartialMembersResponse = z.object({
   indexing_technique: z.string().nullable(),
   is_multimodal: z.boolean(),
   is_published: z.boolean(),
+  maintainer: z.string().nullish(),
   name: z.string(),
   partial_member_list: z.array(z.string()).nullish(),
   permission: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   pipeline_id: z.string().nullable(),
   provider: z.string(),
   retrieval_model_dict: zDatasetRetrievalModelResponse,
@@ -1046,9 +1050,11 @@ export const zDatasetListItemResponse = z.object({
   indexing_technique: z.string().nullable(),
   is_multimodal: z.boolean(),
   is_published: z.boolean(),
+  maintainer: z.string().nullish(),
   name: z.string(),
   partial_member_list: z.array(z.string()),
   permission: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   pipeline_id: z.string().nullable(),
   provider: z.string(),
   retrieval_model_dict: zDatasetRetrievalModelResponse,
@@ -1133,6 +1139,7 @@ export const zDatasetDetail = z.object({
   is_published: z.boolean().optional(),
   name: z.string().optional(),
   permission: z.string().optional(),
+  permission_keys: z.array(z.string()).optional(),
   pipeline_id: z.string().optional(),
   provider: z.string().optional(),
   retrieval_model_dict: zDatasetRetrievalModel.optional(),
@@ -1176,7 +1183,7 @@ export const zWebsiteInfo = z.object({
  */
 export const zPreProcessingRule = z.object({
   enabled: z.boolean(),
-  id: z.string(),
+  id: z.enum(['remove_extra_spaces', 'remove_stopwords', 'remove_urls_emails']),
 })
 
 /**
@@ -1233,7 +1240,7 @@ export const zCondition = z.object({
     '≥',
   ]),
   name: z.string(),
-  value: z.union([z.string(), z.array(z.string()), z.int(), z.number()]).nullish(),
+  value: z.union([z.string(), z.array(z.string()), z.number()]).nullish(),
 })
 
 /**
@@ -1277,7 +1284,7 @@ export const zWeightModel = z.object({
 export const zRetrievalModel = z.object({
   metadata_filtering_conditions: zMetadataFilteringCondition.nullish(),
   reranking_enable: z.boolean(),
-  reranking_mode: z.string().nullish(),
+  reranking_mode: z.enum(['reranking_model', 'weighted_score']).nullish(),
   reranking_model: zRerankingModel.nullish(),
   score_threshold: z.number().nullish(),
   score_threshold_enabled: z.boolean(),
@@ -1291,7 +1298,13 @@ export const zRetrievalModel = z.object({
  */
 export const zHitTestingPayload = z.object({
   attachment_ids: z.array(z.string()).nullish(),
-  external_retrieval_model: z.record(z.string(), z.unknown()).nullish(),
+  external_retrieval_model: z
+    .object({
+      score_threshold: z.number().optional(),
+      score_threshold_enabled: z.boolean().optional(),
+      top_k: z.int().optional(),
+    })
+    .nullish(),
   query: z.string().max(250),
   retrieval_model: zRetrievalModel.nullish(),
 })
@@ -1451,7 +1464,10 @@ export const zDataSource = z.object({
  */
 export const zKnowledgeConfig = z.object({
   data_source: zDataSource.nullish(),
-  doc_form: z.string().optional().default('text_model'),
+  doc_form: z
+    .enum(['hierarchical_model', 'qa_model', 'text_model'])
+    .optional()
+    .default('text_model'),
   doc_language: z.string().optional().default('English'),
   duplicate: z.boolean().optional().default(true),
   embedding_model: z.string().nullish(),
@@ -1462,7 +1478,14 @@ export const zKnowledgeConfig = z.object({
   original_document_id: z.string().nullish(),
   process_rule: zProcessRule.nullish(),
   retrieval_model: zRetrievalModel.nullish(),
-  summary_index_setting: z.record(z.string(), z.unknown()).nullish(),
+  summary_index_setting: z
+    .object({
+      enable: z.boolean().optional(),
+      model_name: z.string().optional(),
+      model_provider_name: z.string().optional(),
+      summary_prompt: z.string().optional(),
+    })
+    .nullish(),
 })
 
 export const zGetDatasetsQuery = z.object({
@@ -1502,7 +1525,7 @@ export const zGetDatasetsApiKeysResponse = zApiKeyList
 export const zPostDatasetsApiKeysResponse = zApiKeyItem
 
 export const zDeleteDatasetsApiKeysByApiKeyIdPath = z.object({
-  api_key_id: z.string(),
+  api_key_id: z.uuid(),
 })
 
 /**
@@ -1511,7 +1534,7 @@ export const zDeleteDatasetsApiKeysByApiKeyIdPath = z.object({
 export const zDeleteDatasetsApiKeysByApiKeyIdResponse = z.void()
 
 export const zGetDatasetsBatchImportStatusByJobIdPath = z.object({
-  job_id: z.string(),
+  job_id: z.uuid(),
 })
 
 /**
@@ -1522,7 +1545,7 @@ export const zGetDatasetsBatchImportStatusByJobIdResponse = zSegmentBatchImportS
 export const zPostDatasetsBatchImportStatusByJobIdBody = zBatchImportPayload
 
 export const zPostDatasetsBatchImportStatusByJobIdPath = z.object({
-  job_id: z.string(),
+  job_id: z.uuid(),
 })
 
 /**
@@ -1556,7 +1579,7 @@ export const zPostDatasetsExternalKnowledgeApiBody = zExternalKnowledgeApiPayloa
 export const zPostDatasetsExternalKnowledgeApiResponse = zExternalKnowledgeApiResponse
 
 export const zDeleteDatasetsExternalKnowledgeApiByExternalKnowledgeApiIdPath = z.object({
-  external_knowledge_api_id: z.string(),
+  external_knowledge_api_id: z.uuid(),
 })
 
 /**
@@ -1565,7 +1588,7 @@ export const zDeleteDatasetsExternalKnowledgeApiByExternalKnowledgeApiIdPath = z
 export const zDeleteDatasetsExternalKnowledgeApiByExternalKnowledgeApiIdResponse = z.void()
 
 export const zGetDatasetsExternalKnowledgeApiByExternalKnowledgeApiIdPath = z.object({
-  external_knowledge_api_id: z.string(),
+  external_knowledge_api_id: z.uuid(),
 })
 
 /**
@@ -1578,7 +1601,7 @@ export const zPatchDatasetsExternalKnowledgeApiByExternalKnowledgeApiIdBody
   = zExternalKnowledgeApiPayload
 
 export const zPatchDatasetsExternalKnowledgeApiByExternalKnowledgeApiIdPath = z.object({
-  external_knowledge_api_id: z.string(),
+  external_knowledge_api_id: z.uuid(),
 })
 
 /**
@@ -1588,7 +1611,7 @@ export const zPatchDatasetsExternalKnowledgeApiByExternalKnowledgeApiIdResponse
   = zExternalKnowledgeApiResponse
 
 export const zGetDatasetsExternalKnowledgeApiByExternalKnowledgeApiIdUseCheckPath = z.object({
-  external_knowledge_api_id: z.string(),
+  external_knowledge_api_id: z.uuid(),
 })
 
 /**
@@ -1647,7 +1670,7 @@ export const zGetDatasetsRetrievalSettingByVectorTypePath = z.object({
 export const zGetDatasetsRetrievalSettingByVectorTypeResponse = zRetrievalSettingResponse
 
 export const zDeleteDatasetsByDatasetIdPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1656,7 +1679,7 @@ export const zDeleteDatasetsByDatasetIdPath = z.object({
 export const zDeleteDatasetsByDatasetIdResponse = z.void()
 
 export const zGetDatasetsByDatasetIdPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1667,7 +1690,7 @@ export const zGetDatasetsByDatasetIdResponse = zDatasetDetailWithPartialMembersR
 export const zPatchDatasetsByDatasetIdBody = zDatasetUpdatePayload
 
 export const zPatchDatasetsByDatasetIdPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1676,7 +1699,7 @@ export const zPatchDatasetsByDatasetIdPath = z.object({
 export const zPatchDatasetsByDatasetIdResponse = zDatasetDetailWithPartialMembersResponse
 
 export const zPostDatasetsByDatasetIdApiKeysByStatusPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
   status: z.string(),
 })
 
@@ -1686,7 +1709,7 @@ export const zPostDatasetsByDatasetIdApiKeysByStatusPath = z.object({
 export const zPostDatasetsByDatasetIdApiKeysByStatusResponse = zSimpleResultResponse
 
 export const zGetDatasetsByDatasetIdAutoDisableLogsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1696,7 +1719,7 @@ export const zGetDatasetsByDatasetIdAutoDisableLogsResponse = zAutoDisableLogsRe
 
 export const zGetDatasetsByDatasetIdBatchByBatchIndexingEstimatePath = z.object({
   batch: z.string(),
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1706,7 +1729,7 @@ export const zGetDatasetsByDatasetIdBatchByBatchIndexingEstimateResponse = zOpaq
 
 export const zGetDatasetsByDatasetIdBatchByBatchIndexingStatusPath = z.object({
   batch: z.string(),
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1715,7 +1738,7 @@ export const zGetDatasetsByDatasetIdBatchByBatchIndexingStatusPath = z.object({
 export const zGetDatasetsByDatasetIdBatchByBatchIndexingStatusResponse = zDocumentStatusListResponse
 
 export const zDeleteDatasetsByDatasetIdDocumentsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1724,7 +1747,7 @@ export const zDeleteDatasetsByDatasetIdDocumentsPath = z.object({
 export const zDeleteDatasetsByDatasetIdDocumentsResponse = z.void()
 
 export const zGetDatasetsByDatasetIdDocumentsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 export const zGetDatasetsByDatasetIdDocumentsQuery = z.object({
@@ -1744,7 +1767,7 @@ export const zGetDatasetsByDatasetIdDocumentsResponse = zDocumentWithSegmentsLis
 export const zPostDatasetsByDatasetIdDocumentsBody = zKnowledgeConfig
 
 export const zPostDatasetsByDatasetIdDocumentsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1755,7 +1778,7 @@ export const zPostDatasetsByDatasetIdDocumentsResponse = zDatasetAndDocumentResp
 export const zPostDatasetsByDatasetIdDocumentsDownloadZipBody = zDocumentBatchDownloadZipPayload
 
 export const zPostDatasetsByDatasetIdDocumentsDownloadZipPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1766,7 +1789,7 @@ export const zPostDatasetsByDatasetIdDocumentsDownloadZipResponse = zBinaryFileR
 export const zPostDatasetsByDatasetIdDocumentsGenerateSummaryBody = zGenerateSummaryPayload
 
 export const zPostDatasetsByDatasetIdDocumentsGenerateSummaryPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1777,7 +1800,7 @@ export const zPostDatasetsByDatasetIdDocumentsGenerateSummaryResponse = zSimpleR
 export const zPostDatasetsByDatasetIdDocumentsMetadataBody = zMetadataOperationData
 
 export const zPostDatasetsByDatasetIdDocumentsMetadataPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1787,7 +1810,7 @@ export const zPostDatasetsByDatasetIdDocumentsMetadataResponse = z.void()
 
 export const zPatchDatasetsByDatasetIdDocumentsStatusByActionBatchPath = z.object({
   action: z.string(),
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -1796,8 +1819,8 @@ export const zPatchDatasetsByDatasetIdDocumentsStatusByActionBatchPath = z.objec
 export const zPatchDatasetsByDatasetIdDocumentsStatusByActionBatchResponse = zSimpleResultResponse
 
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1806,8 +1829,8 @@ export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdPath = z.object({
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdResponse = z.void()
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdQuery = z.object({
@@ -1820,8 +1843,8 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdQuery = z.object({
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdResponse = zOpaqueObjectResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdDownloadPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1830,8 +1853,8 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdDownloadPath = z.object
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdDownloadResponse = zUrlResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdIndexingEstimatePath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1841,8 +1864,8 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdIndexingEstimateRespons
   = zOpaqueObjectResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdIndexingStatusPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1855,8 +1878,8 @@ export const zPutDatasetsByDatasetIdDocumentsByDocumentIdMetadataBody
   = zDocumentMetadataUpdatePayload
 
 export const zPutDatasetsByDatasetIdDocumentsByDocumentIdMetadataPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1866,8 +1889,8 @@ export const zPutDatasetsByDatasetIdDocumentsByDocumentIdMetadataResponse
   = zSimpleResultMessageResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdNotionSyncPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1876,8 +1899,8 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdNotionSyncPath = z.obje
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdNotionSyncResponse = zSimpleResultResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdPipelineExecutionLogPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1887,8 +1910,8 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdPipelineExecutionLogRes
   = zOpaqueObjectResponse
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdProcessingPausePath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1897,8 +1920,8 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdProcessingPausePath =
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdProcessingPauseResponse = z.void()
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdProcessingResumePath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1908,8 +1931,8 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdProcessingResumeRespo
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdProcessingByActionPath = z.object({
   action: z.string(),
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1921,8 +1944,8 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdProcessingByActionRes
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdRenameBody = zDocumentRenamePayload
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdRenamePath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1933,8 +1956,8 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdRenameResponse = zDocu
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentBody = zSegmentCreatePayload
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -1944,8 +1967,8 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentResponse = zSeg
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentByActionPath = z.object({
   action: z.string(),
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentByActionQuery = z.object({
@@ -1959,8 +1982,8 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentByActionRespon
   = zSimpleResultResponse
 
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsQuery = z.object({
@@ -1973,8 +1996,8 @@ export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsQuery = z.ob
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsResponse = z.void()
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsQuery = z.object({
@@ -1993,8 +2016,8 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsResponse
   = zConsoleSegmentListResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBatchImportPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -2007,8 +2030,8 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBatchImportBod
   = zBatchImportPayload
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBatchImportPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -2018,9 +2041,9 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBatchImportRes
   = zSegmentBatchImportStatusResponse
 
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
-  segment_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
+  segment_id: z.uuid(),
 })
 
 /**
@@ -2032,9 +2055,9 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdBo
   = zSegmentUpdatePayload
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
-  segment_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
+  segment_id: z.uuid(),
 })
 
 /**
@@ -2045,9 +2068,9 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdRe
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksPath
   = z.object({
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksQuery
@@ -2068,9 +2091,9 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdCh
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksPath
   = z.object({
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 /**
@@ -2084,9 +2107,9 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChi
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksPath
   = z.object({
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 /**
@@ -2097,10 +2120,10 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChi
 
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkIdPath
   = z.object({
-    child_chunk_id: z.string(),
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    child_chunk_id: z.uuid(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 /**
@@ -2114,10 +2137,10 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdCh
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkIdPath
   = z.object({
-    child_chunk_id: z.string(),
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    child_chunk_id: z.uuid(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 /**
@@ -2127,8 +2150,8 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdCh
   = zChildChunkDetailResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSummaryStatusPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -2138,8 +2161,8 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSummaryStatusResponse
   = zOpaqueObjectResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdWebsiteSyncPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -2148,7 +2171,7 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdWebsiteSyncPath = z.obj
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdWebsiteSyncResponse = zSimpleResultResponse
 
 export const zGetDatasetsByDatasetIdErrorDocsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2159,7 +2182,7 @@ export const zGetDatasetsByDatasetIdErrorDocsResponse = zErrorDocsResponse
 export const zPostDatasetsByDatasetIdExternalHitTestingBody = zExternalHitTestingPayload
 
 export const zPostDatasetsByDatasetIdExternalHitTestingPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2170,7 +2193,7 @@ export const zPostDatasetsByDatasetIdExternalHitTestingResponse = zExternalRetri
 export const zPostDatasetsByDatasetIdHitTestingBody = zHitTestingPayload
 
 export const zPostDatasetsByDatasetIdHitTestingPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2179,7 +2202,7 @@ export const zPostDatasetsByDatasetIdHitTestingPath = z.object({
 export const zPostDatasetsByDatasetIdHitTestingResponse = zHitTestingResponse
 
 export const zGetDatasetsByDatasetIdIndexingStatusPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2188,7 +2211,7 @@ export const zGetDatasetsByDatasetIdIndexingStatusPath = z.object({
 export const zGetDatasetsByDatasetIdIndexingStatusResponse = zDocumentStatusListResponse
 
 export const zGetDatasetsByDatasetIdMetadataPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2199,7 +2222,7 @@ export const zGetDatasetsByDatasetIdMetadataResponse = zDatasetMetadataListRespo
 export const zPostDatasetsByDatasetIdMetadataBody = zMetadataArgs
 
 export const zPostDatasetsByDatasetIdMetadataPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2209,7 +2232,7 @@ export const zPostDatasetsByDatasetIdMetadataResponse = zDatasetMetadataResponse
 
 export const zPostDatasetsByDatasetIdMetadataBuiltInByActionPath = z.object({
   action: z.string(),
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2218,8 +2241,8 @@ export const zPostDatasetsByDatasetIdMetadataBuiltInByActionPath = z.object({
 export const zPostDatasetsByDatasetIdMetadataBuiltInByActionResponse = z.void()
 
 export const zDeleteDatasetsByDatasetIdMetadataByMetadataIdPath = z.object({
-  dataset_id: z.string(),
-  metadata_id: z.string(),
+  dataset_id: z.uuid(),
+  metadata_id: z.uuid(),
 })
 
 /**
@@ -2230,8 +2253,8 @@ export const zDeleteDatasetsByDatasetIdMetadataByMetadataIdResponse = z.void()
 export const zPatchDatasetsByDatasetIdMetadataByMetadataIdBody = zMetadataUpdatePayload
 
 export const zPatchDatasetsByDatasetIdMetadataByMetadataIdPath = z.object({
-  dataset_id: z.string(),
-  metadata_id: z.string(),
+  dataset_id: z.uuid(),
+  metadata_id: z.uuid(),
 })
 
 /**
@@ -2240,7 +2263,7 @@ export const zPatchDatasetsByDatasetIdMetadataByMetadataIdPath = z.object({
 export const zPatchDatasetsByDatasetIdMetadataByMetadataIdResponse = zDatasetMetadataResponse
 
 export const zGetDatasetsByDatasetIdNotionSyncPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2249,7 +2272,7 @@ export const zGetDatasetsByDatasetIdNotionSyncPath = z.object({
 export const zGetDatasetsByDatasetIdNotionSyncResponse = zSimpleResultResponse
 
 export const zGetDatasetsByDatasetIdPermissionPartUsersPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2258,7 +2281,7 @@ export const zGetDatasetsByDatasetIdPermissionPartUsersPath = z.object({
 export const zGetDatasetsByDatasetIdPermissionPartUsersResponse = zPartialMemberListResponse
 
 export const zGetDatasetsByDatasetIdQueriesPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2267,7 +2290,7 @@ export const zGetDatasetsByDatasetIdQueriesPath = z.object({
 export const zGetDatasetsByDatasetIdQueriesResponse = zDatasetQueryListResponse
 
 export const zGetDatasetsByDatasetIdRelatedAppsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2278,7 +2301,7 @@ export const zGetDatasetsByDatasetIdRelatedAppsResponse = zRelatedAppListRespons
 export const zPostDatasetsByDatasetIdRetryBody = zDocumentRetryPayload
 
 export const zPostDatasetsByDatasetIdRetryPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2287,7 +2310,7 @@ export const zPostDatasetsByDatasetIdRetryPath = z.object({
 export const zPostDatasetsByDatasetIdRetryResponse = z.void()
 
 export const zGetDatasetsByDatasetIdUseCheckPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2296,7 +2319,7 @@ export const zGetDatasetsByDatasetIdUseCheckPath = z.object({
 export const zGetDatasetsByDatasetIdUseCheckResponse = zUsageCheckResponse
 
 export const zGetDatasetsByResourceIdApiKeysPath = z.object({
-  resource_id: z.string(),
+  resource_id: z.uuid(),
 })
 
 /**
@@ -2305,7 +2328,7 @@ export const zGetDatasetsByResourceIdApiKeysPath = z.object({
 export const zGetDatasetsByResourceIdApiKeysResponse = zApiKeyList
 
 export const zPostDatasetsByResourceIdApiKeysPath = z.object({
-  resource_id: z.string(),
+  resource_id: z.uuid(),
 })
 
 /**
@@ -2314,8 +2337,8 @@ export const zPostDatasetsByResourceIdApiKeysPath = z.object({
 export const zPostDatasetsByResourceIdApiKeysResponse = zApiKeyItem
 
 export const zDeleteDatasetsByResourceIdApiKeysByApiKeyIdPath = z.object({
-  api_key_id: z.string(),
-  resource_id: z.string(),
+  api_key_id: z.uuid(),
+  resource_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/explore/zod.gen.ts b/packages/contracts/generated/api/console/explore/zod.gen.ts
index 9346796a86b..fa29f0ac13e 100644
--- a/packages/contracts/generated/api/console/explore/zod.gen.ts
+++ b/packages/contracts/generated/api/console/explore/zod.gen.ts
@@ -86,7 +86,7 @@ export const zGetExploreAppsLearnDifyQuery = z.object({
 export const zGetExploreAppsLearnDifyResponse = zLearnDifyAppListResponse
 
 export const zGetExploreAppsByAppIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/files/zod.gen.ts b/packages/contracts/generated/api/console/files/zod.gen.ts
index 389c79558e3..4454afcdc86 100644
--- a/packages/contracts/generated/api/console/files/zod.gen.ts
+++ b/packages/contracts/generated/api/console/files/zod.gen.ts
@@ -69,7 +69,7 @@ export const zGetFilesUploadResponse = zUploadConfig
 export const zPostFilesUploadResponse = zFileResponse
 
 export const zGetFilesByFileIdPreviewPath = z.object({
-  file_id: z.string(),
+  file_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/installed-apps/types.gen.ts b/packages/contracts/generated/api/console/installed-apps/types.gen.ts
index 6111cf7e104..75cc4efa2c4 100644
--- a/packages/contracts/generated/api/console/installed-apps/types.gen.ts
+++ b/packages/contracts/generated/api/console/installed-apps/types.gen.ts
@@ -68,7 +68,16 @@ export type ConversationInfiniteScrollPagination = {
   limit: number
 }
 
-export type ConversationRenamePayload = {
+export type ConversationRenamePayload = (
+  | {
+    auto_generate: true
+    name?: string | null
+  }
+  | {
+    auto_generate?: false
+    name: string
+  }
+) & {
   auto_generate?: boolean
   name?: string | null
 }
@@ -147,7 +156,10 @@ export type AudioBinaryResponse = Blob | File
 
 export type WorkflowRunPayload = {
   files?: Array<{
-    [key: string]: unknown
+    transfer_method: 'local_file' | 'remote_url'
+    type: 'audio' | 'custom' | 'document' | 'image' | 'video'
+    upload_file_id?: string
+    url?: string
   }> | null
   inputs: {
     [key: string]: unknown
diff --git a/packages/contracts/generated/api/console/installed-apps/zod.gen.ts b/packages/contracts/generated/api/console/installed-apps/zod.gen.ts
index 055b53936bf..a9a06fe3f7e 100644
--- a/packages/contracts/generated/api/console/installed-apps/zod.gen.ts
+++ b/packages/contracts/generated/api/console/installed-apps/zod.gen.ts
@@ -70,13 +70,22 @@ export const zCompletionMessageExplorePayload = z.object({
   retriever_from: z.string().optional().default('explore_app'),
 })
 
-/**
- * ConversationRenamePayload
- */
-export const zConversationRenamePayload = z.object({
-  auto_generate: z.boolean().optional().default(false),
-  name: z.string().nullish(),
-})
+export const zConversationRenamePayload = z.intersection(
+  z.union([
+    z.object({
+      auto_generate: z.literal(true),
+      name: z.string().nullish(),
+    }),
+    z.object({
+      auto_generate: z.literal(false).optional().default(false),
+      name: z.string().regex(/.*\S.*/),
+    }),
+  ]),
+  z.object({
+    auto_generate: z.boolean().optional().default(false),
+    name: z.string().nullish(),
+  }),
+)
 
 /**
  * ResultResponse
@@ -119,7 +128,7 @@ export const zSavedMessageCreatePayload = z.object({
  * TextToAudioPayload
  */
 export const zTextToAudioPayload = z.object({
-  message_id: z.string().nullish(),
+  message_id: z.uuid().nullish(),
   streaming: z.boolean().nullish(),
   text: z.string().nullish(),
   voice: z.string().nullish(),
@@ -134,7 +143,16 @@ export const zAudioBinaryResponse = z.custom<Blob | File>()
  * WorkflowRunPayload
  */
 export const zWorkflowRunPayload = z.object({
-  files: z.array(z.record(z.string(), z.unknown())).nullish(),
+  files: z
+    .array(
+      z.object({
+        transfer_method: z.enum(['local_file', 'remote_url']),
+        type: z.enum(['audio', 'custom', 'document', 'image', 'video']),
+        upload_file_id: z.string().optional(),
+        url: z.string().optional(),
+      }),
+    )
+    .nullish(),
   inputs: z.record(z.string(), z.unknown()),
 })
 
@@ -530,7 +548,7 @@ export const zPostInstalledAppsBody = zInstalledAppCreatePayload
 export const zPostInstalledAppsResponse = zSimpleMessageResponse
 
 export const zDeleteInstalledAppsByInstalledAppIdPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -541,7 +559,7 @@ export const zDeleteInstalledAppsByInstalledAppIdResponse = z.void()
 export const zPatchInstalledAppsByInstalledAppIdBody = zInstalledAppUpdatePayload
 
 export const zPatchInstalledAppsByInstalledAppIdPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -550,7 +568,7 @@ export const zPatchInstalledAppsByInstalledAppIdPath = z.object({
 export const zPatchInstalledAppsByInstalledAppIdResponse = zSimpleResultMessageResponse
 
 export const zPostInstalledAppsByInstalledAppIdAudioToTextPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -561,7 +579,7 @@ export const zPostInstalledAppsByInstalledAppIdAudioToTextResponse = zAudioTrans
 export const zPostInstalledAppsByInstalledAppIdChatMessagesBody = zChatMessagePayload
 
 export const zPostInstalledAppsByInstalledAppIdChatMessagesPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -570,7 +588,7 @@ export const zPostInstalledAppsByInstalledAppIdChatMessagesPath = z.object({
 export const zPostInstalledAppsByInstalledAppIdChatMessagesResponse = zGeneratedAppResponse
 
 export const zPostInstalledAppsByInstalledAppIdChatMessagesByTaskIdStopPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
   task_id: z.string(),
 })
 
@@ -584,7 +602,7 @@ export const zPostInstalledAppsByInstalledAppIdCompletionMessagesBody
   = zCompletionMessageExplorePayload
 
 export const zPostInstalledAppsByInstalledAppIdCompletionMessagesPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -593,7 +611,7 @@ export const zPostInstalledAppsByInstalledAppIdCompletionMessagesPath = z.object
 export const zPostInstalledAppsByInstalledAppIdCompletionMessagesResponse = zGeneratedAppResponse
 
 export const zPostInstalledAppsByInstalledAppIdCompletionMessagesByTaskIdStopPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
   task_id: z.string(),
 })
 
@@ -604,7 +622,7 @@ export const zPostInstalledAppsByInstalledAppIdCompletionMessagesByTaskIdStopRes
   = zSimpleResultResponse
 
 export const zGetInstalledAppsByInstalledAppIdConversationsPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 export const zGetInstalledAppsByInstalledAppIdConversationsQuery = z.object({
@@ -620,8 +638,8 @@ export const zGetInstalledAppsByInstalledAppIdConversationsResponse
   = zConversationInfiniteScrollPagination
 
 export const zDeleteInstalledAppsByInstalledAppIdConversationsByCIdPath = z.object({
-  c_id: z.string(),
-  installed_app_id: z.string(),
+  c_id: z.uuid(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -633,8 +651,8 @@ export const zPostInstalledAppsByInstalledAppIdConversationsByCIdNameBody
   = zConversationRenamePayload
 
 export const zPostInstalledAppsByInstalledAppIdConversationsByCIdNamePath = z.object({
-  c_id: z.string(),
-  installed_app_id: z.string(),
+  c_id: z.uuid(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -643,8 +661,8 @@ export const zPostInstalledAppsByInstalledAppIdConversationsByCIdNamePath = z.ob
 export const zPostInstalledAppsByInstalledAppIdConversationsByCIdNameResponse = zSimpleConversation
 
 export const zPatchInstalledAppsByInstalledAppIdConversationsByCIdPinPath = z.object({
-  c_id: z.string(),
-  installed_app_id: z.string(),
+  c_id: z.uuid(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -653,8 +671,8 @@ export const zPatchInstalledAppsByInstalledAppIdConversationsByCIdPinPath = z.ob
 export const zPatchInstalledAppsByInstalledAppIdConversationsByCIdPinResponse = zResultResponse
 
 export const zPatchInstalledAppsByInstalledAppIdConversationsByCIdUnpinPath = z.object({
-  c_id: z.string(),
-  installed_app_id: z.string(),
+  c_id: z.uuid(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -663,7 +681,7 @@ export const zPatchInstalledAppsByInstalledAppIdConversationsByCIdUnpinPath = z.
 export const zPatchInstalledAppsByInstalledAppIdConversationsByCIdUnpinResponse = zResultResponse
 
 export const zGetInstalledAppsByInstalledAppIdMessagesPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 export const zGetInstalledAppsByInstalledAppIdMessagesQuery = z.object({
@@ -681,8 +699,8 @@ export const zPostInstalledAppsByInstalledAppIdMessagesByMessageIdFeedbacksBody
   = zMessageFeedbackPayload
 
 export const zPostInstalledAppsByInstalledAppIdMessagesByMessageIdFeedbacksPath = z.object({
-  installed_app_id: z.string(),
-  message_id: z.string(),
+  installed_app_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -692,8 +710,8 @@ export const zPostInstalledAppsByInstalledAppIdMessagesByMessageIdFeedbacksRespo
   = zResultResponse
 
 export const zGetInstalledAppsByInstalledAppIdMessagesByMessageIdMoreLikeThisPath = z.object({
-  installed_app_id: z.string(),
-  message_id: z.string(),
+  installed_app_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 export const zGetInstalledAppsByInstalledAppIdMessagesByMessageIdMoreLikeThisQuery = z.object({
@@ -707,8 +725,8 @@ export const zGetInstalledAppsByInstalledAppIdMessagesByMessageIdMoreLikeThisRes
   = zGeneratedAppResponse
 
 export const zGetInstalledAppsByInstalledAppIdMessagesByMessageIdSuggestedQuestionsPath = z.object({
-  installed_app_id: z.string(),
-  message_id: z.string(),
+  installed_app_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -718,7 +736,7 @@ export const zGetInstalledAppsByInstalledAppIdMessagesByMessageIdSuggestedQuesti
   = zSuggestedQuestionsResponse
 
 export const zGetInstalledAppsByInstalledAppIdMetaPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -727,7 +745,7 @@ export const zGetInstalledAppsByInstalledAppIdMetaPath = z.object({
 export const zGetInstalledAppsByInstalledAppIdMetaResponse = zExploreAppMetaResponse
 
 export const zGetInstalledAppsByInstalledAppIdParametersPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -736,7 +754,7 @@ export const zGetInstalledAppsByInstalledAppIdParametersPath = z.object({
 export const zGetInstalledAppsByInstalledAppIdParametersResponse = zParameters
 
 export const zGetInstalledAppsByInstalledAppIdSavedMessagesPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 export const zGetInstalledAppsByInstalledAppIdSavedMessagesQuery = z.object({
@@ -753,7 +771,7 @@ export const zGetInstalledAppsByInstalledAppIdSavedMessagesResponse
 export const zPostInstalledAppsByInstalledAppIdSavedMessagesBody = zSavedMessageCreatePayload
 
 export const zPostInstalledAppsByInstalledAppIdSavedMessagesPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -762,8 +780,8 @@ export const zPostInstalledAppsByInstalledAppIdSavedMessagesPath = z.object({
 export const zPostInstalledAppsByInstalledAppIdSavedMessagesResponse = zResultResponse
 
 export const zDeleteInstalledAppsByInstalledAppIdSavedMessagesByMessageIdPath = z.object({
-  installed_app_id: z.string(),
-  message_id: z.string(),
+  installed_app_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -774,7 +792,7 @@ export const zDeleteInstalledAppsByInstalledAppIdSavedMessagesByMessageIdRespons
 export const zPostInstalledAppsByInstalledAppIdTextToAudioBody = zTextToAudioPayload
 
 export const zPostInstalledAppsByInstalledAppIdTextToAudioPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -785,7 +803,7 @@ export const zPostInstalledAppsByInstalledAppIdTextToAudioResponse = zAudioBinar
 export const zPostInstalledAppsByInstalledAppIdWorkflowsRunBody = zWorkflowRunPayload
 
 export const zPostInstalledAppsByInstalledAppIdWorkflowsRunPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
 })
 
 /**
@@ -794,7 +812,7 @@ export const zPostInstalledAppsByInstalledAppIdWorkflowsRunPath = z.object({
 export const zPostInstalledAppsByInstalledAppIdWorkflowsRunResponse = zGeneratedAppResponse
 
 export const zPostInstalledAppsByInstalledAppIdWorkflowsTasksByTaskIdStopPath = z.object({
-  installed_app_id: z.string(),
+  installed_app_id: z.uuid(),
   task_id: z.string(),
 })
 
diff --git a/packages/contracts/generated/api/console/notion/zod.gen.ts b/packages/contracts/generated/api/console/notion/zod.gen.ts
index 633ae90be35..7f228414f19 100644
--- a/packages/contracts/generated/api/console/notion/zod.gen.ts
+++ b/packages/contracts/generated/api/console/notion/zod.gen.ts
@@ -48,7 +48,7 @@ export const zNotionIntegrateInfoListResponse = z.object({
 })
 
 export const zGetNotionPagesByPageIdByPageTypePreviewPath = z.object({
-  page_id: z.string(),
+  page_id: z.uuid(),
   page_type: z.string(),
 })
 
diff --git a/packages/contracts/generated/api/console/oauth/zod.gen.ts b/packages/contracts/generated/api/console/oauth/zod.gen.ts
index 569b35ec4d0..f38227c2b26 100644
--- a/packages/contracts/generated/api/console/oauth/zod.gen.ts
+++ b/packages/contracts/generated/api/console/oauth/zod.gen.ts
@@ -117,7 +117,7 @@ export const zGetOauthDataSourceByProviderPath = z.object({
 export const zGetOauthDataSourceByProviderResponse = zOAuthDataSourceResponse
 
 export const zGetOauthDataSourceByProviderByBindingIdSyncPath = z.object({
-  binding_id: z.string(),
+  binding_id: z.uuid(),
   provider: z.string(),
 })
 
diff --git a/packages/contracts/generated/api/console/rag/types.gen.ts b/packages/contracts/generated/api/console/rag/types.gen.ts
index 49572f971b7..b9862a8d1e8 100644
--- a/packages/contracts/generated/api/console/rag/types.gen.ts
+++ b/packages/contracts/generated/api/console/rag/types.gen.ts
@@ -53,8 +53,10 @@ export type DatasetDetailResponse = {
   indexing_technique: string | null
   is_multimodal: boolean
   is_published: boolean
+  maintainer?: string | null
   name: string
   permission: string
+  permission_keys?: Array<string>
   pipeline_id: string | null
   provider: string
   retrieval_model_dict: DatasetRetrievalModelResponse
diff --git a/packages/contracts/generated/api/console/rag/zod.gen.ts b/packages/contracts/generated/api/console/rag/zod.gen.ts
index 31120fab148..717db30baa7 100644
--- a/packages/contracts/generated/api/console/rag/zod.gen.ts
+++ b/packages/contracts/generated/api/console/rag/zod.gen.ts
@@ -656,8 +656,10 @@ export const zDatasetDetailResponse = z.object({
   indexing_technique: z.string().nullable(),
   is_multimodal: z.boolean(),
   is_published: z.boolean(),
+  maintainer: z.string().nullish(),
   name: z.string(),
   permission: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   pipeline_id: z.string().nullable(),
   provider: z.string(),
   retrieval_model_dict: zDatasetRetrievalModelResponse,
@@ -777,7 +779,7 @@ export const zGetRagPipelinesRecommendedPluginsQuery = z.object({
 export const zGetRagPipelinesRecommendedPluginsResponse = zRagPipelineOpaqueResponse
 
 export const zPostRagPipelinesTransformDatasetsByDatasetIdPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -810,7 +812,7 @@ export const zGetRagPipelinesByPipelineIdExportsQuery = z.object({
 export const zGetRagPipelinesByPipelineIdExportsResponse = zSimpleDataResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowRunsPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 export const zGetRagPipelinesByPipelineIdWorkflowRunsQuery = z.object({
@@ -824,7 +826,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowRunsQuery = z.object({
 export const zGetRagPipelinesByPipelineIdWorkflowRunsResponse = zWorkflowRunPaginationResponse
 
 export const zPostRagPipelinesByPipelineIdWorkflowRunsTasksByTaskIdStopPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
   task_id: z.string(),
 })
 
@@ -835,8 +837,8 @@ export const zPostRagPipelinesByPipelineIdWorkflowRunsTasksByTaskIdStopResponse
   = zSimpleResultResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowRunsByRunIdPath = z.object({
-  pipeline_id: z.string(),
-  run_id: z.string(),
+  pipeline_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -845,8 +847,8 @@ export const zGetRagPipelinesByPipelineIdWorkflowRunsByRunIdPath = z.object({
 export const zGetRagPipelinesByPipelineIdWorkflowRunsByRunIdResponse = zWorkflowRunDetailResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowRunsByRunIdNodeExecutionsPath = z.object({
-  pipeline_id: z.string(),
-  run_id: z.string(),
+  pipeline_id: z.uuid(),
+  run_id: z.uuid(),
 })
 
 /**
@@ -856,7 +858,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowRunsByRunIdNodeExecutionsRespon
   = zWorkflowRunNodeExecutionListResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowsPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 export const zGetRagPipelinesByPipelineIdWorkflowsQuery = z.object({
@@ -872,7 +874,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsQuery = z.object({
 export const zGetRagPipelinesByPipelineIdWorkflowsResponse = zWorkflowPaginationResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDefaultWorkflowBlockConfigsPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -884,7 +886,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsDefaultWorkflowBlockConfigsRes
 export const zGetRagPipelinesByPipelineIdWorkflowsDefaultWorkflowBlockConfigsByBlockTypePath
   = z.object({
     block_type: z.string(),
-    pipeline_id: z.string(),
+    pipeline_id: z.uuid(),
   })
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDefaultWorkflowBlockConfigsByBlockTypeQuery
@@ -899,7 +901,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsDefaultWorkflowBlockConfigsByB
   = zDefaultBlockConfigResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -910,7 +912,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsDraftResponse = zWorkflowRespo
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftBody = zDraftWorkflowSyncPayload
 
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -923,7 +925,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftDatasourceNodesByNodeIdR
 
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftDatasourceNodesByNodeIdRunPath = z.object({
   node_id: z.string(),
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -936,7 +938,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftDatasourceVariablesInspe
   = zDatasourceVariablesPayload
 
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftDatasourceVariablesInspectPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -946,7 +948,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftDatasourceVariablesInspe
   = zWorkflowRunNodeExecutionResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftEnvironmentVariablesPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -960,7 +962,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftIterationNodesByNodeIdRu
 
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftIterationNodesByNodeIdRunPath = z.object({
   node_id: z.string(),
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -973,7 +975,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftLoopNodesByNodeIdRunBody
 
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftLoopNodesByNodeIdRunPath = z.object({
   node_id: z.string(),
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -984,7 +986,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftLoopNodesByNodeIdRunResp
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftNodesByNodeIdLastRunPath = z.object({
   node_id: z.string(),
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -998,7 +1000,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftNodesByNodeIdRunBody
 
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftNodesByNodeIdRunPath = z.object({
   node_id: z.string(),
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1009,7 +1011,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftNodesByNodeIdRunResponse
 
 export const zDeleteRagPipelinesByPipelineIdWorkflowsDraftNodesByNodeIdVariablesPath = z.object({
   node_id: z.string(),
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1019,7 +1021,7 @@ export const zDeleteRagPipelinesByPipelineIdWorkflowsDraftNodesByNodeIdVariables
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftNodesByNodeIdVariablesPath = z.object({
   node_id: z.string(),
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1029,7 +1031,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsDraftNodesByNodeIdVariablesRes
   = zWorkflowDraftVariableList
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftPreProcessingParametersPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftPreProcessingParametersQuery = z.object({
@@ -1043,7 +1045,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsDraftPreProcessingParametersRe
   = zRagPipelineStepParametersResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftProcessingParametersPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftProcessingParametersQuery = z.object({
@@ -1059,7 +1061,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsDraftProcessingParametersRespo
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftRunBody = zDraftWorkflowRunPayload
 
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftRunPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1068,7 +1070,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsDraftRunPath = z.object({
 export const zPostRagPipelinesByPipelineIdWorkflowsDraftRunResponse = zRagPipelineOpaqueResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftSystemVariablesPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1078,7 +1080,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsDraftSystemVariablesResponse
   = zWorkflowDraftVariableList
 
 export const zDeleteRagPipelinesByPipelineIdWorkflowsDraftVariablesPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1087,7 +1089,7 @@ export const zDeleteRagPipelinesByPipelineIdWorkflowsDraftVariablesPath = z.obje
 export const zDeleteRagPipelinesByPipelineIdWorkflowsDraftVariablesResponse = z.void()
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftVariablesPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftVariablesQuery = z.object({
@@ -1102,8 +1104,8 @@ export const zGetRagPipelinesByPipelineIdWorkflowsDraftVariablesResponse
   = zWorkflowDraftVariableListWithoutValue
 
 export const zDeleteRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  pipeline_id: z.string(),
-  variable_id: z.string(),
+  pipeline_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -1112,8 +1114,8 @@ export const zDeleteRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdP
 export const zDeleteRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdResponse = z.void()
 
 export const zGetRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  pipeline_id: z.string(),
-  variable_id: z.string(),
+  pipeline_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -1126,8 +1128,8 @@ export const zPatchRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdBo
   = zWorkflowDraftVariablePatchPayload
 
 export const zPatchRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  pipeline_id: z.string(),
-  variable_id: z.string(),
+  pipeline_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -1137,8 +1139,8 @@ export const zPatchRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdRe
   = zWorkflowDraftVariable
 
 export const zPutRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdResetPath = z.object({
-  pipeline_id: z.string(),
-  variable_id: z.string(),
+  pipeline_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 export const zPutRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdResetResponse = z.union(
@@ -1146,7 +1148,7 @@ export const zPutRagPipelinesByPipelineIdWorkflowsDraftVariablesByVariableIdRese
 )
 
 export const zGetRagPipelinesByPipelineIdWorkflowsPublishPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1155,7 +1157,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsPublishPath = z.object({
 export const zGetRagPipelinesByPipelineIdWorkflowsPublishResponse = zWorkflowResponse
 
 export const zPostRagPipelinesByPipelineIdWorkflowsPublishPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1170,7 +1172,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsPublishedDatasourceNodesByNod
 export const zPostRagPipelinesByPipelineIdWorkflowsPublishedDatasourceNodesByNodeIdPreviewPath
   = z.object({
     node_id: z.string(),
-    pipeline_id: z.string(),
+    pipeline_id: z.uuid(),
   })
 
 /**
@@ -1185,7 +1187,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsPublishedDatasourceNodesByNod
 export const zPostRagPipelinesByPipelineIdWorkflowsPublishedDatasourceNodesByNodeIdRunPath
   = z.object({
     node_id: z.string(),
-    pipeline_id: z.string(),
+    pipeline_id: z.uuid(),
   })
 
 /**
@@ -1195,7 +1197,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsPublishedDatasourceNodesByNod
   = zRagPipelineOpaqueResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowsPublishedPreProcessingParametersPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 export const zGetRagPipelinesByPipelineIdWorkflowsPublishedPreProcessingParametersQuery = z.object({
@@ -1209,7 +1211,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsPublishedPreProcessingParamete
   = zRagPipelineStepParametersResponse
 
 export const zGetRagPipelinesByPipelineIdWorkflowsPublishedProcessingParametersPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 export const zGetRagPipelinesByPipelineIdWorkflowsPublishedProcessingParametersQuery = z.object({
@@ -1225,7 +1227,7 @@ export const zGetRagPipelinesByPipelineIdWorkflowsPublishedProcessingParametersR
 export const zPostRagPipelinesByPipelineIdWorkflowsPublishedRunBody = zPublishedWorkflowRunPayload
 
 export const zPostRagPipelinesByPipelineIdWorkflowsPublishedRunPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
 })
 
 /**
@@ -1234,7 +1236,7 @@ export const zPostRagPipelinesByPipelineIdWorkflowsPublishedRunPath = z.object({
 export const zPostRagPipelinesByPipelineIdWorkflowsPublishedRunResponse = zRagPipelineOpaqueResponse
 
 export const zDeleteRagPipelinesByPipelineIdWorkflowsByWorkflowIdPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
   workflow_id: z.string(),
 })
 
@@ -1246,7 +1248,7 @@ export const zDeleteRagPipelinesByPipelineIdWorkflowsByWorkflowIdResponse = z.vo
 export const zPatchRagPipelinesByPipelineIdWorkflowsByWorkflowIdBody = zWorkflowUpdatePayload
 
 export const zPatchRagPipelinesByPipelineIdWorkflowsByWorkflowIdPath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
   workflow_id: z.string(),
 })
 
@@ -1256,7 +1258,7 @@ export const zPatchRagPipelinesByPipelineIdWorkflowsByWorkflowIdPath = z.object(
 export const zPatchRagPipelinesByPipelineIdWorkflowsByWorkflowIdResponse = zWorkflowResponse
 
 export const zPostRagPipelinesByPipelineIdWorkflowsByWorkflowIdRestorePath = z.object({
-  pipeline_id: z.string(),
+  pipeline_id: z.uuid(),
   workflow_id: z.string(),
 })
 
diff --git a/packages/contracts/generated/api/console/snippets/zod.gen.ts b/packages/contracts/generated/api/console/snippets/zod.gen.ts
index 8f1756ba499..1c861084434 100644
--- a/packages/contracts/generated/api/console/snippets/zod.gen.ts
+++ b/packages/contracts/generated/api/console/snippets/zod.gen.ts
@@ -387,7 +387,7 @@ export const zWorkflowDraftVariableListWithoutValue = z.object({
 })
 
 export const zGetSnippetsBySnippetIdWorkflowRunsPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 export const zGetSnippetsBySnippetIdWorkflowRunsQuery = z.object({
@@ -401,7 +401,7 @@ export const zGetSnippetsBySnippetIdWorkflowRunsQuery = z.object({
 export const zGetSnippetsBySnippetIdWorkflowRunsResponse = zWorkflowRunPaginationResponse
 
 export const zPostSnippetsBySnippetIdWorkflowRunsTasksByTaskIdStopPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
   task_id: z.string(),
 })
 
@@ -411,8 +411,8 @@ export const zPostSnippetsBySnippetIdWorkflowRunsTasksByTaskIdStopPath = z.objec
 export const zPostSnippetsBySnippetIdWorkflowRunsTasksByTaskIdStopResponse = zSimpleResultResponse
 
 export const zGetSnippetsBySnippetIdWorkflowRunsByRunIdPath = z.object({
-  run_id: z.string(),
-  snippet_id: z.string(),
+  run_id: z.uuid(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -421,8 +421,8 @@ export const zGetSnippetsBySnippetIdWorkflowRunsByRunIdPath = z.object({
 export const zGetSnippetsBySnippetIdWorkflowRunsByRunIdResponse = zWorkflowRunDetailResponse
 
 export const zGetSnippetsBySnippetIdWorkflowRunsByRunIdNodeExecutionsPath = z.object({
-  run_id: z.string(),
-  snippet_id: z.string(),
+  run_id: z.uuid(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -432,7 +432,7 @@ export const zGetSnippetsBySnippetIdWorkflowRunsByRunIdNodeExecutionsResponse
   = zWorkflowRunNodeExecutionListResponse
 
 export const zGetSnippetsBySnippetIdWorkflowsPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 export const zGetSnippetsBySnippetIdWorkflowsQuery = z.object({
@@ -446,7 +446,7 @@ export const zGetSnippetsBySnippetIdWorkflowsQuery = z.object({
 export const zGetSnippetsBySnippetIdWorkflowsResponse = zWorkflowPaginationResponse
 
 export const zGetSnippetsBySnippetIdWorkflowsDefaultWorkflowBlockConfigsPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -456,7 +456,7 @@ export const zGetSnippetsBySnippetIdWorkflowsDefaultWorkflowBlockConfigsResponse
   = zDefaultBlockConfigsResponse
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -467,7 +467,7 @@ export const zGetSnippetsBySnippetIdWorkflowsDraftResponse = zSnippetWorkflowRes
 export const zPostSnippetsBySnippetIdWorkflowsDraftBody = zSnippetDraftSyncPayload
 
 export const zPostSnippetsBySnippetIdWorkflowsDraftPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -476,7 +476,7 @@ export const zPostSnippetsBySnippetIdWorkflowsDraftPath = z.object({
 export const zPostSnippetsBySnippetIdWorkflowsDraftResponse = zWorkflowRestoreResponse
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftConfigPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -485,7 +485,7 @@ export const zGetSnippetsBySnippetIdWorkflowsDraftConfigPath = z.object({
 export const zGetSnippetsBySnippetIdWorkflowsDraftConfigResponse = zSnippetDraftConfigResponse
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftConversationVariablesPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -495,7 +495,7 @@ export const zGetSnippetsBySnippetIdWorkflowsDraftConversationVariablesResponse
   = zWorkflowDraftVariableList
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftEnvironmentVariablesPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -509,7 +509,7 @@ export const zPostSnippetsBySnippetIdWorkflowsDraftIterationNodesByNodeIdRunBody
 
 export const zPostSnippetsBySnippetIdWorkflowsDraftIterationNodesByNodeIdRunPath = z.object({
   node_id: z.string(),
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -523,7 +523,7 @@ export const zPostSnippetsBySnippetIdWorkflowsDraftLoopNodesByNodeIdRunBody
 
 export const zPostSnippetsBySnippetIdWorkflowsDraftLoopNodesByNodeIdRunPath = z.object({
   node_id: z.string(),
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -534,7 +534,7 @@ export const zPostSnippetsBySnippetIdWorkflowsDraftLoopNodesByNodeIdRunResponse
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftNodesByNodeIdLastRunPath = z.object({
   node_id: z.string(),
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -548,7 +548,7 @@ export const zPostSnippetsBySnippetIdWorkflowsDraftNodesByNodeIdRunBody
 
 export const zPostSnippetsBySnippetIdWorkflowsDraftNodesByNodeIdRunPath = z.object({
   node_id: z.string(),
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -559,7 +559,7 @@ export const zPostSnippetsBySnippetIdWorkflowsDraftNodesByNodeIdRunResponse
 
 export const zDeleteSnippetsBySnippetIdWorkflowsDraftNodesByNodeIdVariablesPath = z.object({
   node_id: z.string(),
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -569,7 +569,7 @@ export const zDeleteSnippetsBySnippetIdWorkflowsDraftNodesByNodeIdVariablesRespo
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftNodesByNodeIdVariablesPath = z.object({
   node_id: z.string(),
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -581,7 +581,7 @@ export const zGetSnippetsBySnippetIdWorkflowsDraftNodesByNodeIdVariablesResponse
 export const zPostSnippetsBySnippetIdWorkflowsDraftRunBody = zSnippetDraftRunPayload
 
 export const zPostSnippetsBySnippetIdWorkflowsDraftRunPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -590,7 +590,7 @@ export const zPostSnippetsBySnippetIdWorkflowsDraftRunPath = z.object({
 export const zPostSnippetsBySnippetIdWorkflowsDraftRunResponse = zGeneratedAppResponse
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftSystemVariablesPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -600,7 +600,7 @@ export const zGetSnippetsBySnippetIdWorkflowsDraftSystemVariablesResponse
   = zWorkflowDraftVariableList
 
 export const zDeleteSnippetsBySnippetIdWorkflowsDraftVariablesPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -609,7 +609,7 @@ export const zDeleteSnippetsBySnippetIdWorkflowsDraftVariablesPath = z.object({
 export const zDeleteSnippetsBySnippetIdWorkflowsDraftVariablesResponse = z.void()
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftVariablesPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftVariablesQuery = z.object({
@@ -624,8 +624,8 @@ export const zGetSnippetsBySnippetIdWorkflowsDraftVariablesResponse
   = zWorkflowDraftVariableListWithoutValue
 
 export const zDeleteSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  snippet_id: z.string(),
-  variable_id: z.string(),
+  snippet_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -634,8 +634,8 @@ export const zDeleteSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdPath =
 export const zDeleteSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdResponse = z.void()
 
 export const zGetSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  snippet_id: z.string(),
-  variable_id: z.string(),
+  snippet_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -648,8 +648,8 @@ export const zPatchSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdBody
   = zWorkflowDraftVariableUpdatePayload
 
 export const zPatchSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdPath = z.object({
-  snippet_id: z.string(),
-  variable_id: z.string(),
+  snippet_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
@@ -659,8 +659,8 @@ export const zPatchSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdRespons
   = zWorkflowDraftVariable
 
 export const zPutSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdResetPath = z.object({
-  snippet_id: z.string(),
-  variable_id: z.string(),
+  snippet_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 export const zPutSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdResetResponse = z.union([
@@ -669,7 +669,7 @@ export const zPutSnippetsBySnippetIdWorkflowsDraftVariablesByVariableIdResetResp
 ])
 
 export const zGetSnippetsBySnippetIdWorkflowsPublishPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -680,7 +680,7 @@ export const zGetSnippetsBySnippetIdWorkflowsPublishResponse = zSnippetWorkflowR
 export const zPostSnippetsBySnippetIdWorkflowsPublishBody = zPublishWorkflowPayload
 
 export const zPostSnippetsBySnippetIdWorkflowsPublishPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -689,7 +689,7 @@ export const zPostSnippetsBySnippetIdWorkflowsPublishPath = z.object({
 export const zPostSnippetsBySnippetIdWorkflowsPublishResponse = zWorkflowPublishResponse
 
 export const zPostSnippetsBySnippetIdWorkflowsByWorkflowIdRestorePath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
   workflow_id: z.string(),
 })
 
diff --git a/packages/contracts/generated/api/console/system-features/types.gen.ts b/packages/contracts/generated/api/console/system-features/types.gen.ts
index 4f2ef2fa94e..f1dcc7fc4b4 100644
--- a/packages/contracts/generated/api/console/system-features/types.gen.ts
+++ b/packages/contracts/generated/api/console/system-features/types.gen.ts
@@ -6,6 +6,7 @@ export type ClientOptions = {
 
 export type SystemFeatureModel = {
   branding: BrandingModel
+  enable_app_deploy: boolean
   enable_change_email: boolean
   enable_collaboration_mode: boolean
   enable_creators_platform: boolean
@@ -22,6 +23,7 @@ export type SystemFeatureModel = {
   max_plugin_package_size: number
   plugin_installation_permission: PluginInstallationPermissionModel
   plugin_manager: PluginManagerModel
+  rbac_enabled: boolean
   sso_enforced_for_signin: boolean
   sso_enforced_for_signin_protocol: string
   webapp_auth: WebAppAuthModel
diff --git a/packages/contracts/generated/api/console/system-features/zod.gen.ts b/packages/contracts/generated/api/console/system-features/zod.gen.ts
index 7464057a391..80b27e7843a 100644
--- a/packages/contracts/generated/api/console/system-features/zod.gen.ts
+++ b/packages/contracts/generated/api/console/system-features/zod.gen.ts
@@ -98,6 +98,7 @@ export const zSystemFeatureModel = z.object({
     login_page_logo: '',
     workspace_logo: '',
   }),
+  enable_app_deploy: z.boolean().default(false),
   enable_change_email: z.boolean().default(true),
   enable_collaboration_mode: z.boolean().default(true),
   enable_creators_platform: z.boolean().default(false),
@@ -125,6 +126,7 @@ export const zSystemFeatureModel = z.object({
     restrict_to_marketplace_only: false,
   }),
   plugin_manager: zPluginManagerModel.default({ enabled: false }),
+  rbac_enabled: z.boolean().default(false),
   sso_enforced_for_signin: z.boolean().default(false),
   sso_enforced_for_signin_protocol: z.string().default(''),
   webapp_auth: zWebAppAuthModel.default({
diff --git a/packages/contracts/generated/api/console/tags/zod.gen.ts b/packages/contracts/generated/api/console/tags/zod.gen.ts
index 0e7d7bd1c60..20f28eaa059 100644
--- a/packages/contracts/generated/api/console/tags/zod.gen.ts
+++ b/packages/contracts/generated/api/console/tags/zod.gen.ts
@@ -52,7 +52,7 @@ export const zPostTagsBody = zTagBasePayload
 export const zPostTagsResponse = zTagResponse
 
 export const zDeleteTagsByTagIdPath = z.object({
-  tag_id: z.string(),
+  tag_id: z.uuid(),
 })
 
 /**
@@ -63,7 +63,7 @@ export const zDeleteTagsByTagIdResponse = z.void()
 export const zPatchTagsByTagIdBody = zTagUpdateRequestPayload
 
 export const zPatchTagsByTagIdPath = z.object({
-  tag_id: z.string(),
+  tag_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/trial-apps/types.gen.ts b/packages/contracts/generated/api/console/trial-apps/types.gen.ts
index 5021da0afdf..894da1102ee 100644
--- a/packages/contracts/generated/api/console/trial-apps/types.gen.ts
+++ b/packages/contracts/generated/api/console/trial-apps/types.gen.ts
@@ -22,6 +22,7 @@ export type TrialAppDetailWithSite = {
   mode?: string
   model_config?: TrialAppModelConfig
   name?: string
+  permission_keys?: Array<string>
   site?: TrialSite
   tags?: Array<TrialTag>
   updated_at?: number
@@ -269,6 +270,7 @@ export type TrialDataset = {
   indexing_technique?: string
   name?: string
   permission?: string
+  permission_keys?: Array<string>
 }
 
 export type JsonObject = {
diff --git a/packages/contracts/generated/api/console/trial-apps/zod.gen.ts b/packages/contracts/generated/api/console/trial-apps/zod.gen.ts
index 8f284cda862..b8768790ef9 100644
--- a/packages/contracts/generated/api/console/trial-apps/zod.gen.ts
+++ b/packages/contracts/generated/api/console/trial-apps/zod.gen.ts
@@ -237,6 +237,7 @@ export const zTrialAppDetailWithSite = z.object({
   mode: z.string().optional(),
   model_config: zTrialAppModelConfig.optional(),
   name: z.string().optional(),
+  permission_keys: z.array(z.string()).optional(),
   site: zTrialSite.optional(),
   tags: z.array(zTrialTag).optional(),
   updated_at: z.coerce
@@ -286,6 +287,7 @@ export const zTrialDataset = z.object({
   indexing_technique: z.string().optional(),
   name: z.string().optional(),
   permission: z.string().optional(),
+  permission_keys: z.array(z.string()).optional(),
 })
 
 export const zTrialDatasetList = z.object({
@@ -435,7 +437,7 @@ export const zSiteWritable = z.object({
 })
 
 export const zGetTrialAppsByAppIdPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -444,7 +446,7 @@ export const zGetTrialAppsByAppIdPath = z.object({
 export const zGetTrialAppsByAppIdResponse = zTrialAppDetailWithSite
 
 export const zPostTrialAppsByAppIdAudioToTextPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -455,7 +457,7 @@ export const zPostTrialAppsByAppIdAudioToTextResponse = zAudioTranscriptResponse
 export const zPostTrialAppsByAppIdChatMessagesBody = zChatRequest
 
 export const zPostTrialAppsByAppIdChatMessagesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -466,7 +468,7 @@ export const zPostTrialAppsByAppIdChatMessagesResponse = zGeneratedAppResponse
 export const zPostTrialAppsByAppIdCompletionMessagesBody = zCompletionRequest
 
 export const zPostTrialAppsByAppIdCompletionMessagesPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -475,7 +477,7 @@ export const zPostTrialAppsByAppIdCompletionMessagesPath = z.object({
 export const zPostTrialAppsByAppIdCompletionMessagesResponse = zGeneratedAppResponse
 
 export const zGetTrialAppsByAppIdDatasetsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 export const zGetTrialAppsByAppIdDatasetsQuery = z.object({
@@ -490,8 +492,8 @@ export const zGetTrialAppsByAppIdDatasetsQuery = z.object({
 export const zGetTrialAppsByAppIdDatasetsResponse = zTrialDatasetList
 
 export const zGetTrialAppsByAppIdMessagesByMessageIdSuggestedQuestionsPath = z.object({
-  app_id: z.string(),
-  message_id: z.string(),
+  app_id: z.uuid(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -501,7 +503,7 @@ export const zGetTrialAppsByAppIdMessagesByMessageIdSuggestedQuestionsResponse
   = zSuggestedQuestionsResponse
 
 export const zGetTrialAppsByAppIdParametersPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -510,7 +512,7 @@ export const zGetTrialAppsByAppIdParametersPath = z.object({
 export const zGetTrialAppsByAppIdParametersResponse = zParameters
 
 export const zGetTrialAppsByAppIdSitePath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -521,7 +523,7 @@ export const zGetTrialAppsByAppIdSiteResponse = zSite
 export const zPostTrialAppsByAppIdTextToAudioBody = zTextToSpeechRequest
 
 export const zPostTrialAppsByAppIdTextToAudioPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -530,7 +532,7 @@ export const zPostTrialAppsByAppIdTextToAudioPath = z.object({
 export const zPostTrialAppsByAppIdTextToAudioResponse = zAudioBinaryResponse
 
 export const zGetTrialAppsByAppIdWorkflowsPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -541,7 +543,7 @@ export const zGetTrialAppsByAppIdWorkflowsResponse = zTrialWorkflow
 export const zPostTrialAppsByAppIdWorkflowsRunBody = zWorkflowRunRequest
 
 export const zPostTrialAppsByAppIdWorkflowsRunPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
 })
 
 /**
@@ -550,7 +552,7 @@ export const zPostTrialAppsByAppIdWorkflowsRunPath = z.object({
 export const zPostTrialAppsByAppIdWorkflowsRunResponse = zGeneratedAppResponse
 
 export const zPostTrialAppsByAppIdWorkflowsTasksByTaskIdStopPath = z.object({
-  app_id: z.string(),
+  app_id: z.uuid(),
   task_id: z.string(),
 })
 
diff --git a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
index 630e8f6b354..7e676564999 100644
--- a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
@@ -19,6 +19,14 @@ import {
   zDeleteWorkspacesCurrentModelProvidersByProviderModelsCredentialsResponse,
   zDeleteWorkspacesCurrentModelProvidersByProviderModelsPath,
   zDeleteWorkspacesCurrentModelProvidersByProviderModelsResponse,
+  zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath,
+  zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse,
+  zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsPath,
+  zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse,
+  zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsPath,
+  zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
+  zDeleteWorkspacesCurrentRbacRolesByRoleIdPath,
+  zDeleteWorkspacesCurrentRbacRolesByRoleIdResponse,
   zDeleteWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientPath,
   zDeleteWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse,
   zDeleteWorkspacesCurrentToolProviderMcpBody,
@@ -90,6 +98,50 @@ import {
   zGetWorkspacesCurrentPluginTasksByTaskIdResponse,
   zGetWorkspacesCurrentPluginTasksQuery,
   zGetWorkspacesCurrentPluginTasksResponse,
+  zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath,
+  zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse,
+  zGetWorkspacesCurrentRbacAccessPoliciesResponse,
+  zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsPath,
+  zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse,
+  zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsPath,
+  zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse,
+  zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyPath,
+  zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse,
+  zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesPath,
+  zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse,
+  zGetWorkspacesCurrentRbacAppsByAppIdWhitelistPath,
+  zGetWorkspacesCurrentRbacAppsByAppIdWhitelistResponse,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsPath,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsPath,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyPath,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesPath,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistPath,
+  zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse,
+  zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesPath,
+  zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse,
+  zGetWorkspacesCurrentRbacMyPermissionsResponse,
+  zGetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse,
+  zGetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse,
+  zGetWorkspacesCurrentRbacRolePermissionsCatalogResponse,
+  zGetWorkspacesCurrentRbacRolesByRoleIdMembersPath,
+  zGetWorkspacesCurrentRbacRolesByRoleIdMembersResponse,
+  zGetWorkspacesCurrentRbacRolesByRoleIdPath,
+  zGetWorkspacesCurrentRbacRolesByRoleIdResponse,
+  zGetWorkspacesCurrentRbacRolesResponse,
+  zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsPath,
+  zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse,
+  zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsPath,
+  zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse,
+  zGetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse,
+  zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsPath,
+  zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse,
+  zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsPath,
+  zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse,
+  zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse,
   zGetWorkspacesCurrentToolLabelsResponse,
   zGetWorkspacesCurrentToolProviderApiGetQuery,
   zGetWorkspacesCurrentToolProviderApiGetResponse,
@@ -251,6 +303,12 @@ import {
   zPostWorkspacesCurrentPluginUploadGithubBody,
   zPostWorkspacesCurrentPluginUploadGithubResponse,
   zPostWorkspacesCurrentPluginUploadPkgResponse,
+  zPostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyPath,
+  zPostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyResponse,
+  zPostWorkspacesCurrentRbacAccessPoliciesResponse,
+  zPostWorkspacesCurrentRbacRolesByRoleIdCopyPath,
+  zPostWorkspacesCurrentRbacRolesByRoleIdCopyResponse,
+  zPostWorkspacesCurrentRbacRolesResponse,
   zPostWorkspacesCurrentResponse,
   zPostWorkspacesCurrentToolProviderApiAddBody,
   zPostWorkspacesCurrentToolProviderApiAddResponse,
@@ -326,6 +384,28 @@ import {
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsBody,
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsPath,
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsResponse,
+  zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath,
+  zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse,
+  zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockPath,
+  zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponse,
+  zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockPath,
+  zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponse,
+  zPutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesPath,
+  zPutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponse,
+  zPutWorkspacesCurrentRbacAppsByAppIdWhitelistPath,
+  zPutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse,
+  zPutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesPath,
+  zPutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponse,
+  zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistPath,
+  zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse,
+  zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesPath,
+  zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse,
+  zPutWorkspacesCurrentRbacRolesByRoleIdPath,
+  zPutWorkspacesCurrentRbacRolesByRoleIdResponse,
+  zPutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsPath,
+  zPutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponse,
+  zPutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsPath,
+  zPutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponse,
   zPutWorkspacesCurrentToolProviderMcpBody,
   zPutWorkspacesCurrentToolProviderMcpResponse,
 } from './zod.gen'
@@ -2017,7 +2097,840 @@ export const plugin2 = {
   byCategory,
 }
 
+export const post44 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopy',
+    path: '/workspaces/current/rbac/access-policies/{policy_id}/copy',
+    successStatus: 201,
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyPath }))
+  .output(zPostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyResponse)
+
+export const copy = {
+  post: post44,
+}
+
+export const delete9 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId: 'deleteWorkspacesCurrentRbacAccessPoliciesByPolicyId',
+    path: '/workspaces/current/rbac/access-policies/{policy_id}',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
+  .output(zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
+
 export const get33 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacAccessPoliciesByPolicyId',
+    path: '/workspaces/current/rbac/access-policies/{policy_id}',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
+  .output(zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
+
+export const put4 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacAccessPoliciesByPolicyId',
+    path: '/workspaces/current/rbac/access-policies/{policy_id}',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
+  .output(zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
+
+export const byPolicyId = {
+  delete: delete9,
+  get: get33,
+  put: put4,
+  copy,
+}
+
+export const get34 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacAccessPolicies',
+    path: '/workspaces/current/rbac/access-policies',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentRbacAccessPoliciesResponse)
+
+export const post45 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postWorkspacesCurrentRbacAccessPolicies',
+    path: '/workspaces/current/rbac/access-policies',
+    successStatus: 201,
+    tags: ['console'],
+  })
+  .output(zPostWorkspacesCurrentRbacAccessPoliciesResponse)
+
+export const accessPolicies = {
+  get: get34,
+  post: post45,
+  byPolicyId,
+}
+
+export const put5 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLock',
+    path: '/workspaces/current/rbac/access-policy-bindings/{binding_id}/lock',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockPath }))
+  .output(zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponse)
+
+export const lock = {
+  put: put5,
+}
+
+export const put6 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlock',
+    path: '/workspaces/current/rbac/access-policy-bindings/{binding_id}/unlock',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockPath }))
+  .output(zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponse)
+
+export const unlock = {
+  put: put6,
+}
+
+export const byBindingId = {
+  lock,
+  unlock,
+}
+
+export const accessPolicyBindings = {
+  byBindingId,
+}
+
+export const delete10 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId: 'deleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindings',
+    path: '/workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/member-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsPath,
+    }),
+  )
+  .output(zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse)
+
+export const get35 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindings',
+    path: '/workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/member-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsPath,
+    }),
+  )
+  .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse)
+
+export const memberBindings = {
+  delete: delete10,
+  get: get35,
+}
+
+export const get36 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindings',
+    path: '/workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/role-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsPath,
+    }),
+  )
+  .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse)
+
+export const roleBindings = {
+  get: get36,
+}
+
+export const byPolicyId2 = {
+  memberBindings,
+  roleBindings,
+}
+
+export const accessPolicies2 = {
+  byPolicyId: byPolicyId2,
+}
+
+export const get37 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacAppsByAppIdAccessPolicy',
+    path: '/workspaces/current/rbac/apps/{app_id}/access-policy',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyPath }))
+  .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse)
+
+export const accessPolicy = {
+  get: get37,
+}
+
+export const get38 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacAppsByAppIdUserAccessPolicies',
+    path: '/workspaces/current/rbac/apps/{app_id}/user-access-policies',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesPath }))
+  .output(zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse)
+
+export const userAccessPolicies = {
+  get: get38,
+}
+
+export const put7 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPolicies',
+    path: '/workspaces/current/rbac/apps/{app_id}/users/{target_account_id}/access-policies',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zPutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesPath,
+    }),
+  )
+  .output(zPutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponse)
+
+export const accessPolicies3 = {
+  put: put7,
+}
+
+export const byTargetAccountId = {
+  accessPolicies: accessPolicies3,
+}
+
+export const users = {
+  byTargetAccountId,
+}
+
+export const get39 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacAppsByAppIdWhitelist',
+    path: '/workspaces/current/rbac/apps/{app_id}/whitelist',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacAppsByAppIdWhitelistPath }))
+  .output(zGetWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
+
+export const put8 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacAppsByAppIdWhitelist',
+    path: '/workspaces/current/rbac/apps/{app_id}/whitelist',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPutWorkspacesCurrentRbacAppsByAppIdWhitelistPath }))
+  .output(zPutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
+
+export const whitelist = {
+  get: get39,
+  put: put8,
+}
+
+export const byAppId = {
+  accessPolicies: accessPolicies2,
+  accessPolicy,
+  userAccessPolicies,
+  users,
+  whitelist,
+}
+
+export const apps = {
+  byAppId,
+}
+
+export const delete11 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId:
+      'deleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindings',
+    path: '/workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/member-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params:
+        zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsPath,
+    }),
+  )
+  .output(
+    zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
+  )
+
+export const get40 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId:
+      'getWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindings',
+    path: '/workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/member-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params:
+        zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsPath,
+    }),
+  )
+  .output(
+    zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
+  )
+
+export const memberBindings2 = {
+  delete: delete11,
+  get: get40,
+}
+
+export const get41 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindings',
+    path: '/workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/role-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsPath,
+    }),
+  )
+  .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse)
+
+export const roleBindings2 = {
+  get: get41,
+}
+
+export const byPolicyId3 = {
+  memberBindings: memberBindings2,
+  roleBindings: roleBindings2,
+}
+
+export const accessPolicies4 = {
+  byPolicyId: byPolicyId3,
+}
+
+export const get42 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicy',
+    path: '/workspaces/current/rbac/datasets/{dataset_id}/access-policy',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyPath }))
+  .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse)
+
+export const accessPolicy2 = {
+  get: get42,
+}
+
+export const get43 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPolicies',
+    path: '/workspaces/current/rbac/datasets/{dataset_id}/user-access-policies',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesPath }))
+  .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse)
+
+export const userAccessPolicies2 = {
+  get: get43,
+}
+
+export const put9 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPolicies',
+    path: '/workspaces/current/rbac/datasets/{dataset_id}/users/{target_account_id}/access-policies',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zPutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesPath,
+    }),
+  )
+  .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponse)
+
+export const accessPolicies5 = {
+  put: put9,
+}
+
+export const byTargetAccountId2 = {
+  accessPolicies: accessPolicies5,
+}
+
+export const users2 = {
+  byTargetAccountId: byTargetAccountId2,
+}
+
+export const get44 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacDatasetsByDatasetIdWhitelist',
+    path: '/workspaces/current/rbac/datasets/{dataset_id}/whitelist',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistPath }))
+  .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
+
+export const put10 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacDatasetsByDatasetIdWhitelist',
+    path: '/workspaces/current/rbac/datasets/{dataset_id}/whitelist',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistPath }))
+  .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
+
+export const whitelist2 = {
+  get: get44,
+  put: put10,
+}
+
+export const byDatasetId = {
+  accessPolicies: accessPolicies4,
+  accessPolicy: accessPolicy2,
+  userAccessPolicies: userAccessPolicies2,
+  users: users2,
+  whitelist: whitelist2,
+}
+
+export const datasets = {
+  byDatasetId,
+}
+
+export const get45 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacMembersByMemberIdRbacRoles',
+    path: '/workspaces/current/rbac/members/{member_id}/rbac-roles',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesPath }))
+  .output(zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
+
+export const put11 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacMembersByMemberIdRbacRoles',
+    path: '/workspaces/current/rbac/members/{member_id}/rbac-roles',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesPath }))
+  .output(zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
+
+export const rbacRoles = {
+  get: get45,
+  put: put11,
+}
+
+export const byMemberId2 = {
+  rbacRoles,
+}
+
+export const members2 = {
+  byMemberId: byMemberId2,
+}
+
+export const get46 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacMyPermissions',
+    path: '/workspaces/current/rbac/my-permissions',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentRbacMyPermissionsResponse)
+
+export const myPermissions = {
+  get: get46,
+}
+
+export const get47 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacRolePermissionsCatalogApp',
+    path: '/workspaces/current/rbac/role-permissions/catalog/app',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse)
+
+export const app = {
+  get: get47,
+}
+
+export const get48 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacRolePermissionsCatalogDataset',
+    path: '/workspaces/current/rbac/role-permissions/catalog/dataset',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse)
+
+export const dataset = {
+  get: get48,
+}
+
+export const get49 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacRolePermissionsCatalog',
+    path: '/workspaces/current/rbac/role-permissions/catalog',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogResponse)
+
+export const catalog = {
+  get: get49,
+  app,
+  dataset,
+}
+
+export const rolePermissions = {
+  catalog,
+}
+
+export const post46 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postWorkspacesCurrentRbacRolesByRoleIdCopy',
+    path: '/workspaces/current/rbac/roles/{role_id}/copy',
+    successStatus: 201,
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPostWorkspacesCurrentRbacRolesByRoleIdCopyPath }))
+  .output(zPostWorkspacesCurrentRbacRolesByRoleIdCopyResponse)
+
+export const copy2 = {
+  post: post46,
+}
+
+export const get50 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacRolesByRoleIdMembers',
+    path: '/workspaces/current/rbac/roles/{role_id}/members',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacRolesByRoleIdMembersPath }))
+  .output(zGetWorkspacesCurrentRbacRolesByRoleIdMembersResponse)
+
+export const members3 = {
+  get: get50,
+}
+
+export const delete12 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId: 'deleteWorkspacesCurrentRbacRolesByRoleId',
+    path: '/workspaces/current/rbac/roles/{role_id}',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zDeleteWorkspacesCurrentRbacRolesByRoleIdPath }))
+  .output(zDeleteWorkspacesCurrentRbacRolesByRoleIdResponse)
+
+export const get51 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacRolesByRoleId',
+    path: '/workspaces/current/rbac/roles/{role_id}',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentRbacRolesByRoleIdPath }))
+  .output(zGetWorkspacesCurrentRbacRolesByRoleIdResponse)
+
+export const put12 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacRolesByRoleId',
+    path: '/workspaces/current/rbac/roles/{role_id}',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPutWorkspacesCurrentRbacRolesByRoleIdPath }))
+  .output(zPutWorkspacesCurrentRbacRolesByRoleIdResponse)
+
+export const byRoleId = {
+  delete: delete12,
+  get: get51,
+  put: put12,
+  copy: copy2,
+  members: members3,
+}
+
+export const get52 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacRoles',
+    path: '/workspaces/current/rbac/roles',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentRbacRolesResponse)
+
+export const post47 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postWorkspacesCurrentRbacRoles',
+    path: '/workspaces/current/rbac/roles',
+    successStatus: 201,
+    tags: ['console'],
+  })
+  .output(zPostWorkspacesCurrentRbacRolesResponse)
+
+export const roles = {
+  get: get52,
+  post: post47,
+  byRoleId,
+}
+
+export const put13 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindings',
+    path: '/workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zPutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsPath,
+    }),
+  )
+  .output(zPutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponse)
+
+export const bindings = {
+  put: put13,
+}
+
+export const get53 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindings',
+    path: '/workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/member-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsPath,
+    }),
+  )
+  .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse)
+
+export const memberBindings3 = {
+  get: get53,
+}
+
+export const get54 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindings',
+    path: '/workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/role-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsPath,
+    }),
+  )
+  .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse)
+
+export const roleBindings3 = {
+  get: get54,
+}
+
+export const byPolicyId4 = {
+  bindings,
+  memberBindings: memberBindings3,
+  roleBindings: roleBindings3,
+}
+
+export const accessPolicies6 = {
+  byPolicyId: byPolicyId4,
+}
+
+export const get55 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacWorkspaceAppsAccessPolicy',
+    path: '/workspaces/current/rbac/workspace/apps/access-policy',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse)
+
+export const accessPolicy3 = {
+  get: get55,
+}
+
+export const apps2 = {
+  accessPolicies: accessPolicies6,
+  accessPolicy: accessPolicy3,
+}
+
+export const put14 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindings',
+    path: '/workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zPutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsPath,
+    }),
+  )
+  .output(zPutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponse)
+
+export const bindings2 = {
+  put: put14,
+}
+
+export const get56 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindings',
+    path: '/workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/member-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsPath,
+    }),
+  )
+  .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse)
+
+export const memberBindings4 = {
+  get: get56,
+}
+
+export const get57 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindings',
+    path: '/workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/role-bindings',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsPath,
+    }),
+  )
+  .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse)
+
+export const roleBindings4 = {
+  get: get57,
+}
+
+export const byPolicyId5 = {
+  bindings: bindings2,
+  memberBindings: memberBindings4,
+  roleBindings: roleBindings4,
+}
+
+export const accessPolicies7 = {
+  byPolicyId: byPolicyId5,
+}
+
+export const get58 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicy',
+    path: '/workspaces/current/rbac/workspace/datasets/access-policy',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse)
+
+export const accessPolicy4 = {
+  get: get58,
+}
+
+export const datasets2 = {
+  accessPolicies: accessPolicies7,
+  accessPolicy: accessPolicy4,
+}
+
+export const workspace = {
+  apps: apps2,
+  datasets: datasets2,
+}
+
+export const rbac = {
+  accessPolicies,
+  accessPolicyBindings,
+  apps,
+  datasets,
+  members: members2,
+  myPermissions,
+  rolePermissions,
+  roles,
+  workspace,
+}
+
+export const get59 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2028,10 +2941,10 @@ export const get33 = oc
   .output(zGetWorkspacesCurrentToolLabelsResponse)
 
 export const toolLabels = {
-  get: get33,
+  get: get59,
 }
 
-export const post44 = oc
+export const post48 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2043,10 +2956,10 @@ export const post44 = oc
   .output(zPostWorkspacesCurrentToolProviderApiAddResponse)
 
 export const add = {
-  post: post44,
+  post: post48,
 }
 
-export const post45 = oc
+export const post49 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2057,11 +2970,11 @@ export const post45 = oc
   .input(z.object({ body: zPostWorkspacesCurrentToolProviderApiDeleteBody }))
   .output(zPostWorkspacesCurrentToolProviderApiDeleteResponse)
 
-export const delete9 = {
-  post: post45,
+export const delete13 = {
+  post: post49,
 }
 
-export const get34 = oc
+export const get60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2072,11 +2985,11 @@ export const get34 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderApiGetQuery }))
   .output(zGetWorkspacesCurrentToolProviderApiGetResponse)
 
-export const get35 = {
-  get: get34,
+export const get61 = {
+  get: get60,
 }
 
-export const get36 = oc
+export const get62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2088,10 +3001,10 @@ export const get36 = oc
   .output(zGetWorkspacesCurrentToolProviderApiRemoteResponse)
 
 export const remote = {
-  get: get36,
+  get: get62,
 }
 
-export const post46 = oc
+export const post50 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2103,10 +3016,10 @@ export const post46 = oc
   .output(zPostWorkspacesCurrentToolProviderApiSchemaResponse)
 
 export const schema = {
-  post: post46,
+  post: post50,
 }
 
-export const post47 = oc
+export const post51 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2118,14 +3031,14 @@ export const post47 = oc
   .output(zPostWorkspacesCurrentToolProviderApiTestPreResponse)
 
 export const pre = {
-  post: post47,
+  post: post51,
 }
 
 export const test = {
   pre,
 }
 
-export const get37 = oc
+export const get63 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2137,10 +3050,10 @@ export const get37 = oc
   .output(zGetWorkspacesCurrentToolProviderApiToolsResponse)
 
 export const tools = {
-  get: get37,
+  get: get63,
 }
 
-export const post48 = oc
+export const post52 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2152,13 +3065,13 @@ export const post48 = oc
   .output(zPostWorkspacesCurrentToolProviderApiUpdateResponse)
 
 export const update2 = {
-  post: post48,
+  post: post52,
 }
 
 export const api = {
   add,
-  delete: delete9,
-  get: get35,
+  delete: delete13,
+  get: get61,
   remote,
   schema,
   test,
@@ -2166,7 +3079,7 @@ export const api = {
   update: update2,
 }
 
-export const post49 = oc
+export const post53 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2183,10 +3096,10 @@ export const post49 = oc
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderAddResponse)
 
 export const add2 = {
-  post: post49,
+  post: post53,
 }
 
-export const get38 = oc
+export const get64 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2203,10 +3116,10 @@ export const get38 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialInfoResponse)
 
 export const info = {
-  get: get38,
+  get: get64,
 }
 
-export const get39 = oc
+export const get65 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2226,7 +3139,7 @@ export const get39 = oc
   )
 
 export const byCredentialType = {
-  get: get39,
+  get: get65,
 }
 
 export const schema2 = {
@@ -2238,7 +3151,7 @@ export const credential = {
   schema: schema2,
 }
 
-export const get40 = oc
+export const get66 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2255,10 +3168,10 @@ export const get40 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialsResponse)
 
 export const credentials3 = {
-  get: get40,
+  get: get66,
 }
 
-export const post50 = oc
+export const post54 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2275,10 +3188,10 @@ export const post50 = oc
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderDefaultCredentialResponse)
 
 export const defaultCredential = {
-  post: post50,
+  post: post54,
 }
 
-export const post51 = oc
+export const post55 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2294,11 +3207,11 @@ export const post51 = oc
   )
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderDeleteResponse)
 
-export const delete10 = {
-  post: post51,
+export const delete14 = {
+  post: post55,
 }
 
-export const get41 = oc
+export const get67 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2310,10 +3223,10 @@ export const get41 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderIconResponse)
 
 export const icon2 = {
-  get: get41,
+  get: get67,
 }
 
-export const get42 = oc
+export const get68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2325,10 +3238,10 @@ export const get42 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderInfoResponse)
 
 export const info2 = {
-  get: get42,
+  get: get68,
 }
 
-export const get43 = oc
+export const get69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2342,10 +3255,10 @@ export const get43 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderOauthClientSchemaResponse)
 
 export const clientSchema = {
-  get: get43,
+  get: get69,
 }
 
-export const delete11 = oc
+export const delete15 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -2360,7 +3273,7 @@ export const delete11 = oc
   )
   .output(zDeleteWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
-export const get44 = oc
+export const get70 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2373,7 +3286,7 @@ export const get44 = oc
   )
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
-export const post52 = oc
+export const post56 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2390,9 +3303,9 @@ export const post52 = oc
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
 export const customClient = {
-  delete: delete11,
-  get: get44,
-  post: post52,
+  delete: delete15,
+  get: get70,
+  post: post56,
 }
 
 export const oauth = {
@@ -2400,7 +3313,7 @@ export const oauth = {
   customClient,
 }
 
-export const get45 = oc
+export const get71 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2412,10 +3325,10 @@ export const get45 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderToolsResponse)
 
 export const tools2 = {
-  get: get45,
+  get: get71,
 }
 
-export const post53 = oc
+export const post57 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2432,7 +3345,7 @@ export const post53 = oc
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderUpdateResponse)
 
 export const update3 = {
-  post: post53,
+  post: post57,
 }
 
 export const byProvider2 = {
@@ -2440,7 +3353,7 @@ export const byProvider2 = {
   credential,
   credentials: credentials3,
   defaultCredential,
-  delete: delete10,
+  delete: delete14,
   icon: icon2,
   info: info2,
   oauth,
@@ -2452,7 +3365,7 @@ export const builtin = {
   byProvider: byProvider2,
 }
 
-export const post54 = oc
+export const post58 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2464,10 +3377,10 @@ export const post54 = oc
   .output(zPostWorkspacesCurrentToolProviderMcpAuthResponse)
 
 export const auth = {
-  post: post54,
+  post: post58,
 }
 
-export const get46 = oc
+export const get72 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2479,14 +3392,14 @@ export const get46 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpToolsByProviderIdResponse)
 
 export const byProviderId = {
-  get: get46,
+  get: get72,
 }
 
 export const tools3 = {
   byProviderId,
 }
 
-export const get47 = oc
+export const get73 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2498,14 +3411,14 @@ export const get47 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpUpdateByProviderIdResponse)
 
 export const byProviderId2 = {
-  get: get47,
+  get: get73,
 }
 
 export const update4 = {
   byProviderId: byProviderId2,
 }
 
-export const delete12 = oc
+export const delete16 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -2516,7 +3429,7 @@ export const delete12 = oc
   .input(z.object({ body: zDeleteWorkspacesCurrentToolProviderMcpBody }))
   .output(zDeleteWorkspacesCurrentToolProviderMcpResponse)
 
-export const post55 = oc
+export const post59 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2527,7 +3440,7 @@ export const post55 = oc
   .input(z.object({ body: zPostWorkspacesCurrentToolProviderMcpBody }))
   .output(zPostWorkspacesCurrentToolProviderMcpResponse)
 
-export const put4 = oc
+export const put15 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2539,15 +3452,15 @@ export const put4 = oc
   .output(zPutWorkspacesCurrentToolProviderMcpResponse)
 
 export const mcp = {
-  delete: delete12,
-  post: post55,
-  put: put4,
+  delete: delete16,
+  post: post59,
+  put: put15,
   auth,
   tools: tools3,
   update: update4,
 }
 
-export const post56 = oc
+export const post60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2559,10 +3472,10 @@ export const post56 = oc
   .output(zPostWorkspacesCurrentToolProviderWorkflowCreateResponse)
 
 export const create2 = {
-  post: post56,
+  post: post60,
 }
 
-export const post57 = oc
+export const post61 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2573,11 +3486,11 @@ export const post57 = oc
   .input(z.object({ body: zPostWorkspacesCurrentToolProviderWorkflowDeleteBody }))
   .output(zPostWorkspacesCurrentToolProviderWorkflowDeleteResponse)
 
-export const delete13 = {
-  post: post57,
+export const delete17 = {
+  post: post61,
 }
 
-export const get48 = oc
+export const get74 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2588,11 +3501,11 @@ export const get48 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderWorkflowGetQuery.optional() }))
   .output(zGetWorkspacesCurrentToolProviderWorkflowGetResponse)
 
-export const get49 = {
-  get: get48,
+export const get75 = {
+  get: get74,
 }
 
-export const get50 = oc
+export const get76 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2604,10 +3517,10 @@ export const get50 = oc
   .output(zGetWorkspacesCurrentToolProviderWorkflowToolsResponse)
 
 export const tools4 = {
-  get: get50,
+  get: get76,
 }
 
-export const post58 = oc
+export const post62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2619,13 +3532,13 @@ export const post58 = oc
   .output(zPostWorkspacesCurrentToolProviderWorkflowUpdateResponse)
 
 export const update5 = {
-  post: post58,
+  post: post62,
 }
 
 export const workflow = {
   create: create2,
-  delete: delete13,
-  get: get49,
+  delete: delete17,
+  get: get75,
   tools: tools4,
   update: update5,
 }
@@ -2637,7 +3550,7 @@ export const toolProvider = {
   workflow,
 }
 
-export const get51 = oc
+export const get77 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2649,10 +3562,10 @@ export const get51 = oc
   .output(zGetWorkspacesCurrentToolProvidersResponse)
 
 export const toolProviders = {
-  get: get51,
+  get: get77,
 }
 
-export const get52 = oc
+export const get78 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2663,10 +3576,10 @@ export const get52 = oc
   .output(zGetWorkspacesCurrentToolsApiResponse)
 
 export const api2 = {
-  get: get52,
+  get: get78,
 }
 
-export const get53 = oc
+export const get79 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2677,10 +3590,10 @@ export const get53 = oc
   .output(zGetWorkspacesCurrentToolsBuiltinResponse)
 
 export const builtin2 = {
-  get: get53,
+  get: get79,
 }
 
-export const get54 = oc
+export const get80 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2691,10 +3604,10 @@ export const get54 = oc
   .output(zGetWorkspacesCurrentToolsMcpResponse)
 
 export const mcp2 = {
-  get: get54,
+  get: get80,
 }
 
-export const get55 = oc
+export const get81 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2705,7 +3618,7 @@ export const get55 = oc
   .output(zGetWorkspacesCurrentToolsWorkflowResponse)
 
 export const workflow2 = {
-  get: get55,
+  get: get81,
 }
 
 export const tools5 = {
@@ -2715,7 +3628,7 @@ export const tools5 = {
   workflow: workflow2,
 }
 
-export const get56 = oc
+export const get82 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2727,13 +3640,13 @@ export const get56 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderIconResponse)
 
 export const icon3 = {
-  get: get56,
+  get: get82,
 }
 
 /**
  * Get info for a trigger provider
  */
-export const get57 = oc
+export const get83 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2746,13 +3659,13 @@ export const get57 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderInfoResponse)
 
 export const info3 = {
-  get: get57,
+  get: get83,
 }
 
 /**
  * Remove custom OAuth client configuration
  */
-export const delete14 = oc
+export const delete18 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -2767,7 +3680,7 @@ export const delete14 = oc
 /**
  * Get OAuth client configuration for a provider
  */
-export const get58 = oc
+export const get84 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2782,7 +3695,7 @@ export const get58 = oc
 /**
  * Configure custom OAuth client for a provider
  */
-export const post59 = oc
+export const post63 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2800,9 +3713,9 @@ export const post59 = oc
   .output(zPostWorkspacesCurrentTriggerProviderByProviderOauthClientResponse)
 
 export const client = {
-  delete: delete14,
-  get: get58,
-  post: post59,
+  delete: delete18,
+  get: get84,
+  post: post63,
 }
 
 export const oauth2 = {
@@ -2812,7 +3725,7 @@ export const oauth2 = {
 /**
  * Build a subscription instance for a trigger provider
  */
-export const post60 = oc
+export const post64 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2834,7 +3747,7 @@ export const post60 = oc
   )
 
 export const bySubscriptionBuilderId = {
-  post: post60,
+  post: post64,
 }
 
 export const build = {
@@ -2844,7 +3757,7 @@ export const build = {
 /**
  * Add a new subscription instance for a trigger provider
  */
-export const post61 = oc
+export const post65 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2862,13 +3775,13 @@ export const post61 = oc
   .output(zPostWorkspacesCurrentTriggerProviderByProviderSubscriptionsBuilderCreateResponse)
 
 export const create3 = {
-  post: post61,
+  post: post65,
 }
 
 /**
  * Get the request logs for a subscription instance for a trigger provider
  */
-export const get59 = oc
+export const get85 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2889,7 +3802,7 @@ export const get59 = oc
   )
 
 export const bySubscriptionBuilderId2 = {
-  get: get59,
+  get: get85,
 }
 
 export const logs = {
@@ -2899,7 +3812,7 @@ export const logs = {
 /**
  * Update a subscription instance for a trigger provider
  */
-export const post62 = oc
+export const post66 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2921,7 +3834,7 @@ export const post62 = oc
   )
 
 export const bySubscriptionBuilderId3 = {
-  post: post62,
+  post: post66,
 }
 
 export const update6 = {
@@ -2931,7 +3844,7 @@ export const update6 = {
 /**
  * Verify and update a subscription instance for a trigger provider
  */
-export const post63 = oc
+export const post67 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2953,7 +3866,7 @@ export const post63 = oc
   )
 
 export const bySubscriptionBuilderId4 = {
-  post: post63,
+  post: post67,
 }
 
 export const verifyAndUpdate = {
@@ -2963,7 +3876,7 @@ export const verifyAndUpdate = {
 /**
  * Get a subscription instance for a trigger provider
  */
-export const get60 = oc
+export const get86 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2984,7 +3897,7 @@ export const get60 = oc
   )
 
 export const bySubscriptionBuilderId5 = {
-  get: get60,
+  get: get86,
 }
 
 export const builder = {
@@ -2999,7 +3912,7 @@ export const builder = {
 /**
  * List all trigger subscriptions for the current tenant's provider
  */
-export const get61 = oc
+export const get87 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3012,13 +3925,13 @@ export const get61 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsListResponse)
 
 export const list4 = {
-  get: get61,
+  get: get87,
 }
 
 /**
  * Initiate OAuth authorization flow for a trigger provider
  */
-export const get62 = oc
+export const get88 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3035,7 +3948,7 @@ export const get62 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsOauthAuthorizeResponse)
 
 export const authorize = {
-  get: get62,
+  get: get88,
 }
 
 export const oauth3 = {
@@ -3045,7 +3958,7 @@ export const oauth3 = {
 /**
  * Verify credentials for an existing subscription (edit mode only)
  */
-export const post64 = oc
+export const post68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3067,7 +3980,7 @@ export const post64 = oc
   )
 
 export const bySubscriptionId = {
-  post: post64,
+  post: post68,
 }
 
 export const verify = {
@@ -3091,7 +4004,7 @@ export const byProvider3 = {
 /**
  * Delete a subscription instance
  */
-export const post65 = oc
+export const post69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3107,14 +4020,14 @@ export const post65 = oc
   )
   .output(zPostWorkspacesCurrentTriggerProviderBySubscriptionIdSubscriptionsDeleteResponse)
 
-export const delete15 = {
-  post: post65,
+export const delete19 = {
+  post: post69,
 }
 
 /**
  * Update a subscription instance
  */
-export const post66 = oc
+export const post70 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3132,11 +4045,11 @@ export const post66 = oc
   .output(zPostWorkspacesCurrentTriggerProviderBySubscriptionIdSubscriptionsUpdateResponse)
 
 export const update7 = {
-  post: post66,
+  post: post70,
 }
 
 export const subscriptions2 = {
-  delete: delete15,
+  delete: delete19,
   update: update7,
 }
 
@@ -3152,7 +4065,7 @@ export const triggerProvider = {
 /**
  * List all trigger providers for the current tenant
  */
-export const get63 = oc
+export const get89 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3164,10 +4077,10 @@ export const get63 = oc
   .output(zGetWorkspacesCurrentTriggersResponse)
 
 export const triggers = {
-  get: get63,
+  get: get89,
 }
 
-export const post67 = oc
+export const post71 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3178,7 +4091,7 @@ export const post67 = oc
   .output(zPostWorkspacesCurrentResponse)
 
 export const current = {
-  post: post67,
+  post: post71,
   agentProvider,
   agentProviders,
   customizedSnippets,
@@ -3190,6 +4103,7 @@ export const current = {
   models: models2,
   permission,
   plugin: plugin2,
+  rbac,
   toolLabels,
   toolProvider,
   toolProviders,
@@ -3198,7 +4112,7 @@ export const current = {
   triggers,
 }
 
-export const post68 = oc
+export const post72 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3210,14 +4124,14 @@ export const post68 = oc
   .output(zPostWorkspacesCustomConfigWebappLogoUploadResponse)
 
 export const upload2 = {
-  post: post68,
+  post: post72,
 }
 
 export const webappLogo = {
   upload: upload2,
 }
 
-export const post69 = oc
+export const post73 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3229,11 +4143,11 @@ export const post69 = oc
   .output(zPostWorkspacesCustomConfigResponse)
 
 export const customConfig = {
-  post: post69,
+  post: post73,
   webappLogo,
 }
 
-export const post70 = oc
+export const post74 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3245,10 +4159,10 @@ export const post70 = oc
   .output(zPostWorkspacesInfoResponse)
 
 export const info4 = {
-  post: post70,
+  post: post74,
 }
 
-export const post71 = oc
+export const post75 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3260,10 +4174,10 @@ export const post71 = oc
   .output(zPostWorkspacesSwitchResponse)
 
 export const switch3 = {
-  post: post71,
+  post: post75,
 }
 
-export const get64 = oc
+export const get90 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3275,7 +4189,7 @@ export const get64 = oc
   .output(zGetWorkspacesByTenantIdModelProvidersByProviderByIconTypeByLangResponse)
 
 export const byLang = {
-  get: get64,
+  get: get90,
 }
 
 export const byIconType = {
@@ -3294,7 +4208,7 @@ export const byTenantId = {
   modelProviders: modelProviders2,
 }
 
-export const get65 = oc
+export const get91 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3305,7 +4219,7 @@ export const get65 = oc
   .output(zGetWorkspacesResponse)
 
 export const workspaces = {
-  get: get65,
+  get: get91,
   current,
   customConfig,
   info: info4,
diff --git a/packages/contracts/generated/api/console/workspaces/types.gen.ts b/packages/contracts/generated/api/console/workspaces/types.gen.ts
index 8b6f34b18ff..29f23567e95 100644
--- a/packages/contracts/generated/api/console/workspaces/types.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/types.gen.ts
@@ -32,7 +32,7 @@ export type AgentProviderListResponse = Array<{
 }>
 
 export type SnippetPagination = {
-  data?: Array<AnonymousInlineModelEfd591151Ea9>
+  data?: Array<AnonymousInlineModel744Ff9Cc03E6>
   has_more?: boolean
   limit?: number
   page?: number
@@ -182,7 +182,7 @@ export type EndpointUpdatePayload = {
 export type MemberInvitePayload = {
   emails?: Array<string>
   language?: string | null
-  role: TenantAccountRole
+  role: string
 }
 
 export type MemberInviteResponse = {
@@ -506,6 +506,109 @@ export type PluginCategoryListResponse = {
   plugins: Array<PluginCategoryInstalledPluginResponse>
 }
 
+export type AccessPolicyList = {
+  data?: Array<AccessPolicy>
+  pagination?: Pagination | null
+}
+
+export type AccessPolicy = {
+  category?: string
+  created_at?: number
+  description?: string
+  id: string
+  is_builtin?: boolean
+  name: string
+  permission_keys?: Array<string>
+  policy_key?: string
+  resource_type: string
+  tenant_id?: string
+  updated_at?: number
+}
+
+export type AccessPolicyBindingState = {
+  binding_id: string
+  is_locked?: boolean
+}
+
+export type MemberBindingsResponse = {
+  data?: Array<AccessPolicyMemberBinding>
+}
+
+export type RoleBindingsResponse = {
+  data?: Array<AccessPolicyRoleBinding>
+}
+
+export type AppAccessMatrix = {
+  app_id?: string
+  items?: Array<AccessMatrixItem>
+}
+
+export type ResourceUserAccessPoliciesResponse = {
+  data?: Array<ResourceUserAccessPolicies>
+  scope: string
+}
+
+export type ReplaceUserAccessPoliciesResponse = {
+  access_policies?: Array<AccessPolicy>
+}
+
+export type ResourceWhitelist = {
+  account_ids?: Array<string>
+}
+
+export type DatasetAccessMatrix = {
+  dataset_id?: string
+  items?: Array<AccessMatrixItem>
+}
+
+export type MemberRolesResponse = {
+  account_id: string
+  roles?: Array<RbacRole>
+}
+
+export type MyPermissionsResponse = {
+  app?: ResourcePermissionSnapshot
+  dataset?: ResourcePermissionSnapshot
+  workspace?: WorkspacePermissionSnapshot
+}
+
+export type PermissionCatalogResponse = {
+  groups?: Array<PermissionCatalogGroup>
+}
+
+export type RbacRoleList = {
+  data?: Array<RbacRole>
+  pagination?: Pagination | null
+}
+
+export type RbacRole = {
+  category?: string
+  description?: string
+  id: string
+  is_builtin?: boolean
+  name: string
+  permission_keys?: Array<string>
+  role_tag?: string
+  tenant_id?: string | null
+  type: string
+}
+
+export type MembersInRoleList = {
+  data?: Array<MembersInRole>
+  pagination?: Pagination | null
+}
+
+export type AccessMatrixItem = {
+  accounts?: Array<AccessPolicyAccount>
+  policy?: AccessPolicy | null
+  roles?: Array<AccessPolicyRole>
+}
+
+export type WorkspaceAccessMatrix = {
+  items?: Array<AccessMatrixItem>
+  pagination?: Pagination | null
+}
+
 export type ToolProviderOpaqueResponse = unknown
 
 export type ApiToolProviderAddPayload = {
@@ -769,7 +872,7 @@ export type WorkspaceCustomConfigResponse = {
   replace_webapp_logo?: string | null
 }
 
-export type AnonymousInlineModelEfd591151Ea9 = {
+export type AnonymousInlineModel744Ff9Cc03E6 = {
   author_name?: string
   created_at?: number
   created_by?: string
@@ -827,6 +930,9 @@ export type AccountWithRole = {
   last_login_at?: number | null
   name: string
   role: string
+  roles?: Array<{
+    [key: string]: string
+  }>
   status: string
 }
 
@@ -842,8 +948,6 @@ export type Inner = {
   provider?: string | null
 }
 
-export type TenantAccountRole = 'admin' | 'dataset_operator' | 'editor' | 'normal' | 'owner'
-
 export type MemberInviteResultResponse = {
   email: string
   message?: string | null
@@ -1009,6 +1113,79 @@ export type PluginCategoryInstalledPluginResponse = {
   version: string
 }
 
+export type Pagination = {
+  current_page?: number
+  per_page?: number
+  total_count?: number
+  total_pages?: number
+}
+
+export type AccessPolicyMemberBinding = {
+  access_policy_id: string
+  account_id: string
+  account_name?: string
+  created_at?: number
+  id: string
+  resource_id?: string
+  resource_type: string
+  tenant_id?: string
+}
+
+export type AccessPolicyRoleBinding = {
+  access_policy_id: string
+  created_at?: number
+  id: string
+  resource_id?: string
+  resource_type: string
+  role_id: string
+  role_name?: string
+  tenant_id?: string
+}
+
+export type ResourceUserAccessPolicies = {
+  access_policies?: Array<AccessPolicy>
+  account: RbacRoleAccount
+  roles?: Array<RbacRole>
+}
+
+export type ResourcePermissionSnapshot = {
+  default_permission_keys?: Array<string>
+  overrides?: Array<ResourcePermissionKeys>
+}
+
+export type WorkspacePermissionSnapshot = {
+  permission_keys?: Array<string>
+}
+
+export type PermissionCatalogGroup = {
+  description?: string
+  group_key: string
+  group_name: string
+  permissions?: Array<PermissionCatalogItem>
+}
+
+export type MembersInRole = {
+  account_id?: string
+  account_name?: string
+}
+
+export type AccessPolicyAccount = {
+  account_id: string
+  account_name: string
+  avatar?: string
+  binding_id: string
+  email?: string
+  is_locked?: boolean
+}
+
+export type AccessPolicyRole = {
+  binding_id: string
+  is_locked?: boolean
+  role_id: string
+  role_name: string
+  role_tag?: string
+}
+
 export type ApiProviderSchemaType = 'openai_actions' | 'openai_plugin' | 'openapi' | 'swagger'
 
 export type CredentialType = 'api-key' | 'oauth2' | 'unauthorized'
@@ -1208,6 +1385,24 @@ export type PluginDeclarationResponse = {
 
 export type PluginInstallationSource = 'github' | 'marketplace' | 'package' | 'remote'
 
+export type RbacRoleAccount = {
+  account_id: string
+  account_name?: string
+  avatar?: string
+  email?: string
+}
+
+export type ResourcePermissionKeys = {
+  permission_keys?: Array<string>
+  resource_id: string
+}
+
+export type PermissionCatalogItem = {
+  description?: string
+  key: string
+  name: string
+}
+
 export type ToolParameterForm = 'form' | 'llm' | 'schema'
 
 export type AiModelEntityResponse = {
@@ -1238,7 +1433,7 @@ export type CustomModelConfiguration = {
   current_credential_name?: string | null
   model: string
   model_type: ModelType
-  unadded_to_model_list?: boolean | null
+  unadded_to_model_list?: boolean
 }
 
 export type CredentialFormSchema = {
@@ -2791,6 +2986,723 @@ export type GetWorkspacesCurrentPluginByCategoryListResponses = {
 export type GetWorkspacesCurrentPluginByCategoryListResponse
   = GetWorkspacesCurrentPluginByCategoryListResponses[keyof GetWorkspacesCurrentPluginByCategoryListResponses]
 
+export type GetWorkspacesCurrentRbacAccessPoliciesData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/access-policies'
+}
+
+export type GetWorkspacesCurrentRbacAccessPoliciesResponses = {
+  200: AccessPolicyList
+}
+
+export type GetWorkspacesCurrentRbacAccessPoliciesResponse
+  = GetWorkspacesCurrentRbacAccessPoliciesResponses[keyof GetWorkspacesCurrentRbacAccessPoliciesResponses]
+
+export type PostWorkspacesCurrentRbacAccessPoliciesData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/access-policies'
+}
+
+export type PostWorkspacesCurrentRbacAccessPoliciesResponses = {
+  201: AccessPolicy
+}
+
+export type PostWorkspacesCurrentRbacAccessPoliciesResponse
+  = PostWorkspacesCurrentRbacAccessPoliciesResponses[keyof PostWorkspacesCurrentRbacAccessPoliciesResponses]
+
+export type DeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/access-policies/{policy_id}'
+}
+
+export type DeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses = {
+  200: AccessPolicy
+}
+
+export type DeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse
+  = DeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses[keyof DeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses]
+
+export type GetWorkspacesCurrentRbacAccessPoliciesByPolicyIdData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/access-policies/{policy_id}'
+}
+
+export type GetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses = {
+  200: AccessPolicy
+}
+
+export type GetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse
+  = GetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses[keyof GetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses]
+
+export type PutWorkspacesCurrentRbacAccessPoliciesByPolicyIdData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/access-policies/{policy_id}'
+}
+
+export type PutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses = {
+  200: AccessPolicy
+}
+
+export type PutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse
+  = PutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses[keyof PutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponses]
+
+export type PostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/access-policies/{policy_id}/copy'
+}
+
+export type PostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyResponses = {
+  201: AccessPolicy
+}
+
+export type PostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyResponse
+  = PostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyResponses[keyof PostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyResponses]
+
+export type PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockData = {
+  body?: never
+  path: {
+    binding_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/access-policy-bindings/{binding_id}/lock'
+}
+
+export type PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponses = {
+  200: AccessPolicyBindingState
+}
+
+export type PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponse
+  = PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponses[keyof PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponses]
+
+export type PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockData = {
+  body?: never
+  path: {
+    binding_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/access-policy-bindings/{binding_id}/unlock'
+}
+
+export type PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponses = {
+  200: AccessPolicyBindingState
+}
+
+export type PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponse
+  = PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponses[keyof PutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponses]
+
+export type DeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsData = {
+  body?: never
+  path: {
+    app_id: string
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/member-bindings'
+}
+
+export type DeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponses
+  = {
+    200: MemberBindingsResponse
+  }
+
+export type DeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse
+  = DeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponses[keyof DeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponses]
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsData = {
+  body?: never
+  path: {
+    app_id: string
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/member-bindings'
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponses = {
+  200: MemberBindingsResponse
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse
+  = GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponses[keyof GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponses]
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsData = {
+  body?: never
+  path: {
+    app_id: string
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/apps/{app_id}/access-policies/{policy_id}/role-bindings'
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponses = {
+  200: RoleBindingsResponse
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse
+  = GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponses[keyof GetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponses]
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPolicyData = {
+  body?: never
+  path: {
+    app_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/apps/{app_id}/access-policy'
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponses = {
+  200: AppAccessMatrix
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse
+  = GetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponses[keyof GetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponses]
+
+export type GetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesData = {
+  body?: never
+  path: {
+    app_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/apps/{app_id}/user-access-policies'
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponses = {
+  200: ResourceUserAccessPoliciesResponse
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse
+  = GetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponses[keyof GetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponses]
+
+export type PutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesData = {
+  body?: never
+  path: {
+    app_id: string
+    target_account_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/apps/{app_id}/users/{target_account_id}/access-policies'
+}
+
+export type PutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponses = {
+  200: ReplaceUserAccessPoliciesResponse
+}
+
+export type PutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponse
+  = PutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponses[keyof PutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponses]
+
+export type GetWorkspacesCurrentRbacAppsByAppIdWhitelistData = {
+  body?: never
+  path: {
+    app_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/apps/{app_id}/whitelist'
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdWhitelistResponses = {
+  200: ResourceWhitelist
+}
+
+export type GetWorkspacesCurrentRbacAppsByAppIdWhitelistResponse
+  = GetWorkspacesCurrentRbacAppsByAppIdWhitelistResponses[keyof GetWorkspacesCurrentRbacAppsByAppIdWhitelistResponses]
+
+export type PutWorkspacesCurrentRbacAppsByAppIdWhitelistData = {
+  body?: never
+  path: {
+    app_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/apps/{app_id}/whitelist'
+}
+
+export type PutWorkspacesCurrentRbacAppsByAppIdWhitelistResponses = {
+  200: ResourceWhitelist
+}
+
+export type PutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse
+  = PutWorkspacesCurrentRbacAppsByAppIdWhitelistResponses[keyof PutWorkspacesCurrentRbacAppsByAppIdWhitelistResponses]
+
+export type DeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsData
+  = {
+    body?: never
+    path: {
+      dataset_id: string
+      policy_id: string
+    }
+    query?: never
+    url: '/workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/member-bindings'
+  }
+
+export type DeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponses
+  = {
+    200: MemberBindingsResponse
+  }
+
+export type DeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse
+  = DeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponses[keyof DeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponses]
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsData
+  = {
+    body?: never
+    path: {
+      dataset_id: string
+      policy_id: string
+    }
+    query?: never
+    url: '/workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/member-bindings'
+  }
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponses
+  = {
+    200: MemberBindingsResponse
+  }
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse
+  = GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponses[keyof GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponses]
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsData = {
+  body?: never
+  path: {
+    dataset_id: string
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/datasets/{dataset_id}/access-policies/{policy_id}/role-bindings'
+}
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponses
+  = {
+    200: RoleBindingsResponse
+  }
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse
+  = GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponses[keyof GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponses]
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyData = {
+  body?: never
+  path: {
+    dataset_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/datasets/{dataset_id}/access-policy'
+}
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponses = {
+  200: DatasetAccessMatrix
+}
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse
+  = GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponses[keyof GetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponses]
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesData = {
+  body?: never
+  path: {
+    dataset_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/datasets/{dataset_id}/user-access-policies'
+}
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponses = {
+  200: ResourceUserAccessPoliciesResponse
+}
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse
+  = GetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponses[keyof GetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponses]
+
+export type PutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesData = {
+  body?: never
+  path: {
+    dataset_id: string
+    target_account_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/datasets/{dataset_id}/users/{target_account_id}/access-policies'
+}
+
+export type PutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponses
+  = {
+    200: ReplaceUserAccessPoliciesResponse
+  }
+
+export type PutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponse
+  = PutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponses[keyof PutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponses]
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistData = {
+  body?: never
+  path: {
+    dataset_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/datasets/{dataset_id}/whitelist'
+}
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponses = {
+  200: ResourceWhitelist
+}
+
+export type GetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse
+  = GetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponses[keyof GetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponses]
+
+export type PutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistData = {
+  body?: never
+  path: {
+    dataset_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/datasets/{dataset_id}/whitelist'
+}
+
+export type PutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponses = {
+  200: ResourceWhitelist
+}
+
+export type PutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse
+  = PutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponses[keyof PutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponses]
+
+export type GetWorkspacesCurrentRbacMembersByMemberIdRbacRolesData = {
+  body?: never
+  path: {
+    member_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/members/{member_id}/rbac-roles'
+}
+
+export type GetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponses = {
+  200: MemberRolesResponse
+}
+
+export type GetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse
+  = GetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponses[keyof GetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponses]
+
+export type PutWorkspacesCurrentRbacMembersByMemberIdRbacRolesData = {
+  body?: never
+  path: {
+    member_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/members/{member_id}/rbac-roles'
+}
+
+export type PutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponses = {
+  200: MemberRolesResponse
+}
+
+export type PutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse
+  = PutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponses[keyof PutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponses]
+
+export type GetWorkspacesCurrentRbacMyPermissionsData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/my-permissions'
+}
+
+export type GetWorkspacesCurrentRbacMyPermissionsResponses = {
+  200: MyPermissionsResponse
+}
+
+export type GetWorkspacesCurrentRbacMyPermissionsResponse
+  = GetWorkspacesCurrentRbacMyPermissionsResponses[keyof GetWorkspacesCurrentRbacMyPermissionsResponses]
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/role-permissions/catalog'
+}
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogResponses = {
+  200: PermissionCatalogResponse
+}
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogResponse
+  = GetWorkspacesCurrentRbacRolePermissionsCatalogResponses[keyof GetWorkspacesCurrentRbacRolePermissionsCatalogResponses]
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogAppData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/role-permissions/catalog/app'
+}
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogAppResponses = {
+  200: PermissionCatalogResponse
+}
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse
+  = GetWorkspacesCurrentRbacRolePermissionsCatalogAppResponses[keyof GetWorkspacesCurrentRbacRolePermissionsCatalogAppResponses]
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogDatasetData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/role-permissions/catalog/dataset'
+}
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponses = {
+  200: PermissionCatalogResponse
+}
+
+export type GetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse
+  = GetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponses[keyof GetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponses]
+
+export type GetWorkspacesCurrentRbacRolesData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/roles'
+}
+
+export type GetWorkspacesCurrentRbacRolesResponses = {
+  200: RbacRoleList
+}
+
+export type GetWorkspacesCurrentRbacRolesResponse
+  = GetWorkspacesCurrentRbacRolesResponses[keyof GetWorkspacesCurrentRbacRolesResponses]
+
+export type PostWorkspacesCurrentRbacRolesData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/roles'
+}
+
+export type PostWorkspacesCurrentRbacRolesResponses = {
+  201: RbacRole
+}
+
+export type PostWorkspacesCurrentRbacRolesResponse
+  = PostWorkspacesCurrentRbacRolesResponses[keyof PostWorkspacesCurrentRbacRolesResponses]
+
+export type DeleteWorkspacesCurrentRbacRolesByRoleIdData = {
+  body?: never
+  path: {
+    role_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/roles/{role_id}'
+}
+
+export type DeleteWorkspacesCurrentRbacRolesByRoleIdResponses = {
+  200: RbacRole
+}
+
+export type DeleteWorkspacesCurrentRbacRolesByRoleIdResponse
+  = DeleteWorkspacesCurrentRbacRolesByRoleIdResponses[keyof DeleteWorkspacesCurrentRbacRolesByRoleIdResponses]
+
+export type GetWorkspacesCurrentRbacRolesByRoleIdData = {
+  body?: never
+  path: {
+    role_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/roles/{role_id}'
+}
+
+export type GetWorkspacesCurrentRbacRolesByRoleIdResponses = {
+  200: RbacRole
+}
+
+export type GetWorkspacesCurrentRbacRolesByRoleIdResponse
+  = GetWorkspacesCurrentRbacRolesByRoleIdResponses[keyof GetWorkspacesCurrentRbacRolesByRoleIdResponses]
+
+export type PutWorkspacesCurrentRbacRolesByRoleIdData = {
+  body?: never
+  path: {
+    role_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/roles/{role_id}'
+}
+
+export type PutWorkspacesCurrentRbacRolesByRoleIdResponses = {
+  200: RbacRole
+}
+
+export type PutWorkspacesCurrentRbacRolesByRoleIdResponse
+  = PutWorkspacesCurrentRbacRolesByRoleIdResponses[keyof PutWorkspacesCurrentRbacRolesByRoleIdResponses]
+
+export type PostWorkspacesCurrentRbacRolesByRoleIdCopyData = {
+  body?: never
+  path: {
+    role_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/roles/{role_id}/copy'
+}
+
+export type PostWorkspacesCurrentRbacRolesByRoleIdCopyResponses = {
+  201: RbacRole
+}
+
+export type PostWorkspacesCurrentRbacRolesByRoleIdCopyResponse
+  = PostWorkspacesCurrentRbacRolesByRoleIdCopyResponses[keyof PostWorkspacesCurrentRbacRolesByRoleIdCopyResponses]
+
+export type GetWorkspacesCurrentRbacRolesByRoleIdMembersData = {
+  body?: never
+  path: {
+    role_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/roles/{role_id}/members'
+}
+
+export type GetWorkspacesCurrentRbacRolesByRoleIdMembersResponses = {
+  200: MembersInRoleList
+}
+
+export type GetWorkspacesCurrentRbacRolesByRoleIdMembersResponse
+  = GetWorkspacesCurrentRbacRolesByRoleIdMembersResponses[keyof GetWorkspacesCurrentRbacRolesByRoleIdMembersResponses]
+
+export type PutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/bindings'
+}
+
+export type PutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponses = {
+  200: AccessMatrixItem
+}
+
+export type PutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponse
+  = PutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponses[keyof PutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponses]
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/member-bindings'
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponses = {
+  200: MemberBindingsResponse
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse
+  = GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponses[keyof GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponses]
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/workspace/apps/access-policies/{policy_id}/role-bindings'
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponses = {
+  200: RoleBindingsResponse
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse
+  = GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponses[keyof GetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponses]
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/workspace/apps/access-policy'
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponses = {
+  200: WorkspaceAccessMatrix
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse
+  = GetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponses[keyof GetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponses]
+
+export type PutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/bindings'
+}
+
+export type PutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponses = {
+  200: AccessMatrixItem
+}
+
+export type PutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponse
+  = PutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponses[keyof PutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponses]
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/member-bindings'
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponses
+  = {
+    200: MemberBindingsResponse
+  }
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse
+  = GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponses[keyof GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponses]
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsData = {
+  body?: never
+  path: {
+    policy_id: string
+  }
+  query?: never
+  url: '/workspaces/current/rbac/workspace/datasets/access-policies/{policy_id}/role-bindings'
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponses
+  = {
+    200: RoleBindingsResponse
+  }
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse
+  = GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponses[keyof GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponses]
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/rbac/workspace/datasets/access-policy'
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses = {
+  200: WorkspaceAccessMatrix
+}
+
+export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse
+  = GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses[keyof GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses]
+
 export type GetWorkspacesCurrentToolLabelsData = {
   body?: never
   path?: never
diff --git a/packages/contracts/generated/api/console/workspaces/zod.gen.ts b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
index b342c586594..fb6f643d7a9 100644
--- a/packages/contracts/generated/api/console/workspaces/zod.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
@@ -138,6 +138,15 @@ export const zEndpointUpdatePayload = z.object({
   settings: z.record(z.string(), z.unknown()),
 })
 
+/**
+ * MemberInvitePayload
+ */
+export const zMemberInvitePayload = z.object({
+  emails: z.array(z.string()).optional(),
+  language: z.string().nullish(),
+  role: z.string(),
+})
+
 /**
  * OwnerTransferCheckPayload
  */
@@ -446,6 +455,68 @@ export const zParserGithubUpload = z.object({
   version: z.string(),
 })
 
+/**
+ * AccessPolicy
+ */
+export const zAccessPolicy = z.object({
+  category: z.string().optional().default(''),
+  created_at: z.int().optional().default(0),
+  description: z.string().optional().default(''),
+  id: z.string(),
+  is_builtin: z.boolean().optional().default(false),
+  name: z.string(),
+  permission_keys: z.array(z.string()).optional(),
+  policy_key: z.string().optional().default(''),
+  resource_type: z.string(),
+  tenant_id: z.string().optional().default(''),
+  updated_at: z.int().optional().default(0),
+})
+
+/**
+ * AccessPolicyBindingState
+ */
+export const zAccessPolicyBindingState = z.object({
+  binding_id: z.string(),
+  is_locked: z.boolean().optional().default(false),
+})
+
+/**
+ * ReplaceUserAccessPoliciesResponse
+ */
+export const zReplaceUserAccessPoliciesResponse = z.object({
+  access_policies: z.array(zAccessPolicy).optional(),
+})
+
+/**
+ * ResourceWhitelist
+ */
+export const zResourceWhitelist = z.object({
+  account_ids: z.array(z.string()).optional(),
+})
+
+/**
+ * RBACRole
+ */
+export const zRbacRole = z.object({
+  category: z.string().optional().default(''),
+  description: z.string().optional().default(''),
+  id: z.string(),
+  is_builtin: z.boolean().optional().default(false),
+  name: z.string(),
+  permission_keys: z.array(z.string()).optional(),
+  role_tag: z.string().optional().default(''),
+  tenant_id: z.string().nullish(),
+  type: z.string(),
+})
+
+/**
+ * MemberRolesResponse
+ */
+export const zMemberRolesResponse = z.object({
+  account_id: z.string(),
+  roles: z.array(zRbacRole).optional(),
+})
+
 /**
  * ToolProviderOpaqueResponse
  */
@@ -776,7 +847,7 @@ export const zSnippet = z.object({
   version: z.int().optional(),
 })
 
-export const zAnonymousInlineModelEfd591151Ea9 = z.object({
+export const zAnonymousInlineModel744Ff9Cc03E6 = z.object({
   author_name: z.string().optional(),
   created_at: z.coerce
     .bigint()
@@ -810,7 +881,7 @@ export const zAnonymousInlineModelEfd591151Ea9 = z.object({
 })
 
 export const zSnippetPagination = z.object({
-  data: z.array(zAnonymousInlineModelEfd591151Ea9).optional(),
+  data: z.array(zAnonymousInlineModel744Ff9Cc03E6).optional(),
   has_more: z.boolean().optional(),
   limit: z.int().optional(),
   page: z.int().optional(),
@@ -829,6 +900,7 @@ export const zAccountWithRole = z.object({
   last_login_at: z.int().nullish(),
   name: z.string(),
   role: z.string(),
+  roles: z.array(z.record(z.string(), z.string())).optional(),
   status: z.string(),
 })
 
@@ -839,20 +911,6 @@ export const zAccountWithRoleList = z.object({
   accounts: z.array(zAccountWithRole),
 })
 
-/**
- * TenantAccountRole
- */
-export const zTenantAccountRole = z.enum(['admin', 'dataset_operator', 'editor', 'normal', 'owner'])
-
-/**
- * MemberInvitePayload
- */
-export const zMemberInvitePayload = z.object({
-  emails: z.array(z.string()).optional(),
-  language: z.string().nullish(),
-  role: zTenantAccountRole,
-})
-
 /**
  * MemberInviteResultResponse
  */
@@ -1061,6 +1119,153 @@ export const zPluginPermissionResponse = z.object({
   install_permission: zInstallPermission,
 })
 
+/**
+ * Pagination
+ */
+export const zPagination = z.object({
+  current_page: z.int().optional().default(0),
+  per_page: z.int().optional().default(0),
+  total_count: z.int().optional().default(0),
+  total_pages: z.int().optional().default(0),
+})
+
+/**
+ * _AccessPolicyList
+ */
+export const zAccessPolicyList = z.object({
+  data: z.array(zAccessPolicy).optional(),
+  pagination: zPagination.nullish(),
+})
+
+/**
+ * _RBACRoleList
+ */
+export const zRbacRoleList = z.object({
+  data: z.array(zRbacRole).optional(),
+  pagination: zPagination.nullish(),
+})
+
+/**
+ * AccessPolicyMemberBinding
+ */
+export const zAccessPolicyMemberBinding = z.object({
+  access_policy_id: z.string(),
+  account_id: z.string(),
+  account_name: z.string().optional().default(''),
+  created_at: z.int().optional().default(0),
+  id: z.string(),
+  resource_id: z.string().optional().default(''),
+  resource_type: z.string(),
+  tenant_id: z.string().optional().default(''),
+})
+
+/**
+ * MemberBindingsResponse
+ */
+export const zMemberBindingsResponse = z.object({
+  data: z.array(zAccessPolicyMemberBinding).optional(),
+})
+
+/**
+ * AccessPolicyRoleBinding
+ */
+export const zAccessPolicyRoleBinding = z.object({
+  access_policy_id: z.string(),
+  created_at: z.int().optional().default(0),
+  id: z.string(),
+  resource_id: z.string().optional().default(''),
+  resource_type: z.string(),
+  role_id: z.string(),
+  role_name: z.string().optional().default(''),
+  tenant_id: z.string().optional().default(''),
+})
+
+/**
+ * RoleBindingsResponse
+ */
+export const zRoleBindingsResponse = z.object({
+  data: z.array(zAccessPolicyRoleBinding).optional(),
+})
+
+/**
+ * WorkspacePermissionSnapshot
+ */
+export const zWorkspacePermissionSnapshot = z.object({
+  permission_keys: z.array(z.string()).optional(),
+})
+
+/**
+ * MembersInRole
+ */
+export const zMembersInRole = z.object({
+  account_id: z.string().optional().default(''),
+  account_name: z.string().optional().default(''),
+})
+
+/**
+ * _MembersInRoleList
+ */
+export const zMembersInRoleList = z.object({
+  data: z.array(zMembersInRole).optional(),
+  pagination: zPagination.nullish(),
+})
+
+/**
+ * AccessPolicyAccount
+ */
+export const zAccessPolicyAccount = z.object({
+  account_id: z.string(),
+  account_name: z.string(),
+  avatar: z.string().optional().default(''),
+  binding_id: z.string(),
+  email: z.string().optional().default(''),
+  is_locked: z.boolean().optional().default(false),
+})
+
+/**
+ * AccessPolicyRole
+ */
+export const zAccessPolicyRole = z.object({
+  binding_id: z.string(),
+  is_locked: z.boolean().optional().default(false),
+  role_id: z.string(),
+  role_name: z.string(),
+  role_tag: z.string().optional().default(''),
+})
+
+/**
+ * AccessMatrixItem
+ */
+export const zAccessMatrixItem = z.object({
+  accounts: z.array(zAccessPolicyAccount).optional(),
+  policy: zAccessPolicy.nullish(),
+  roles: z.array(zAccessPolicyRole).optional(),
+})
+
+/**
+ * AppAccessMatrix
+ */
+export const zAppAccessMatrix = z.object({
+  app_id: z.string().optional().default(''),
+  items: z.array(zAccessMatrixItem).optional(),
+})
+
+/**
+ * DatasetAccessMatrix
+ */
+export const zDatasetAccessMatrix = z.object({
+  dataset_id: z.string().optional().default(''),
+  items: z.array(zAccessMatrixItem).optional(),
+})
+
+/**
+ * WorkspaceAccessMatrix
+ */
+export const zWorkspaceAccessMatrix = z.object({
+  items: z.array(zAccessMatrixItem).optional(),
+  pagination: zPagination.nullish(),
+})
+
 /**
  * ApiProviderSchemaType
  *
@@ -1465,6 +1670,84 @@ export const zPluginCategoryBuiltinToolProviderResponse = z.object({
  */
 export const zPluginInstallationSource = z.enum(['github', 'marketplace', 'package', 'remote'])
 
+/**
+ * RBACRoleAccount
+ */
+export const zRbacRoleAccount = z.object({
+  account_id: z.string(),
+  account_name: z.string().optional().default(''),
+  avatar: z.string().optional().default(''),
+  email: z.string().optional().default(''),
+})
+
+/**
+ * ResourceUserAccessPolicies
+ */
+export const zResourceUserAccessPolicies = z.object({
+  access_policies: z.array(zAccessPolicy).optional(),
+  account: zRbacRoleAccount,
+  roles: z.array(zRbacRole).optional(),
+})
+
+/**
+ * ResourceUserAccessPoliciesResponse
+ */
+export const zResourceUserAccessPoliciesResponse = z.object({
+  data: z.array(zResourceUserAccessPolicies).optional(),
+  scope: z.string(),
+})
+
+/**
+ * ResourcePermissionKeys
+ */
+export const zResourcePermissionKeys = z.object({
+  permission_keys: z.array(z.string()).optional(),
+  resource_id: z.string(),
+})
+
+/**
+ * ResourcePermissionSnapshot
+ */
+export const zResourcePermissionSnapshot = z.object({
+  default_permission_keys: z.array(z.string()).optional(),
+  overrides: z.array(zResourcePermissionKeys).optional(),
+})
+
+/**
+ * MyPermissionsResponse
+ */
+export const zMyPermissionsResponse = z.object({
+  app: zResourcePermissionSnapshot.optional(),
+  dataset: zResourcePermissionSnapshot.optional(),
+  workspace: zWorkspacePermissionSnapshot.optional(),
+})
+
+/**
+ * PermissionCatalogItem
+ */
+export const zPermissionCatalogItem = z.object({
+  description: z.string().optional().default(''),
+  key: z.string(),
+  name: z.string(),
+})
+
+/**
+ * PermissionCatalogGroup
+ */
+export const zPermissionCatalogGroup = z.object({
+  description: z.string().optional().default(''),
+  group_key: z.string(),
+  group_name: z.string(),
+  permissions: z.array(zPermissionCatalogItem).optional(),
+})
+
+/**
+ * PermissionCatalogResponse
+ */
+export const zPermissionCatalogResponse = z.object({
+  groups: z.array(zPermissionCatalogGroup).optional(),
+})
+
 /**
  * ToolParameterForm
  */
@@ -1531,7 +1814,7 @@ export const zCustomModelConfiguration = z.object({
   current_credential_name: z.string().nullish(),
   model: z.string(),
   model_type: zModelType,
-  unadded_to_model_list: z.boolean().nullish().default(false),
+  unadded_to_model_list: z.boolean().optional().default(false),
 })
 
 /**
@@ -1927,7 +2210,7 @@ export const zPostWorkspacesCurrentCustomizedSnippetsImportsByImportIdConfirmRes
   = zSnippetImportResponse
 
 export const zDeleteWorkspacesCurrentCustomizedSnippetsBySnippetIdPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -1936,7 +2219,7 @@ export const zDeleteWorkspacesCurrentCustomizedSnippetsBySnippetIdPath = z.objec
 export const zDeleteWorkspacesCurrentCustomizedSnippetsBySnippetIdResponse = z.void()
 
 export const zGetWorkspacesCurrentCustomizedSnippetsBySnippetIdPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -1947,7 +2230,7 @@ export const zGetWorkspacesCurrentCustomizedSnippetsBySnippetIdResponse = zSnipp
 export const zPatchWorkspacesCurrentCustomizedSnippetsBySnippetIdBody = zUpdateSnippetPayload
 
 export const zPatchWorkspacesCurrentCustomizedSnippetsBySnippetIdPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -1956,7 +2239,7 @@ export const zPatchWorkspacesCurrentCustomizedSnippetsBySnippetIdPath = z.object
 export const zPatchWorkspacesCurrentCustomizedSnippetsBySnippetIdResponse = zSnippet
 
 export const zGetWorkspacesCurrentCustomizedSnippetsBySnippetIdCheckDependenciesPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -1966,7 +2249,7 @@ export const zGetWorkspacesCurrentCustomizedSnippetsBySnippetIdCheckDependencies
   = zSnippetDependencyCheckResponse
 
 export const zGetWorkspacesCurrentCustomizedSnippetsBySnippetIdExportPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 export const zGetWorkspacesCurrentCustomizedSnippetsBySnippetIdExportQuery = z.object({
@@ -1979,7 +2262,7 @@ export const zGetWorkspacesCurrentCustomizedSnippetsBySnippetIdExportQuery = z.o
 export const zGetWorkspacesCurrentCustomizedSnippetsBySnippetIdExportResponse = zTextFileResponse
 
 export const zPostWorkspacesCurrentCustomizedSnippetsBySnippetIdUseCountIncrementPath = z.object({
-  snippet_id: z.string(),
+  snippet_id: z.uuid(),
 })
 
 /**
@@ -2121,7 +2404,7 @@ export const zPostWorkspacesCurrentMembersSendOwnerTransferConfirmEmailResponse
   = zSimpleResultDataResponse
 
 export const zDeleteWorkspacesCurrentMembersByMemberIdPath = z.object({
-  member_id: z.string(),
+  member_id: z.uuid(),
 })
 
 /**
@@ -2132,7 +2415,7 @@ export const zDeleteWorkspacesCurrentMembersByMemberIdResponse = zMemberActionTe
 export const zPostWorkspacesCurrentMembersByMemberIdOwnerTransferBody = zOwnerTransferPayload
 
 export const zPostWorkspacesCurrentMembersByMemberIdOwnerTransferPath = z.object({
-  member_id: z.string(),
+  member_id: z.uuid(),
 })
 
 /**
@@ -2143,7 +2426,7 @@ export const zPostWorkspacesCurrentMembersByMemberIdOwnerTransferResponse = zSim
 export const zPutWorkspacesCurrentMembersByMemberIdUpdateRoleBody = zMemberRoleUpdatePayload
 
 export const zPutWorkspacesCurrentMembersByMemberIdUpdateRolePath = z.object({
-  member_id: z.string(),
+  member_id: z.uuid(),
 })
 
 /**
@@ -2711,6 +2994,411 @@ export const zGetWorkspacesCurrentPluginByCategoryListQuery = z.object({
  */
 export const zGetWorkspacesCurrentPluginByCategoryListResponse = zPluginCategoryListResponse
 
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacAccessPoliciesResponse = zAccessPolicyList
+
+/**
+ * Policy created
+ */
+export const zPostWorkspacesCurrentRbacAccessPoliciesResponse = zAccessPolicy
+
+export const zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath = z.object({
+  policy_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse = zAccessPolicy
+
+export const zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath = z.object({
+  policy_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse = zAccessPolicy
+
+export const zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath = z.object({
+  policy_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse = zAccessPolicy
+
+export const zPostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyPath = z.object({
+  policy_id: z.uuid(),
+})
+
+/**
+ * Policy copied
+ */
+export const zPostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyResponse = zAccessPolicy
+
+export const zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockPath = z.object({
+  binding_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponse
+  = zAccessPolicyBindingState
+
+export const zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockPath = z.object({
+  binding_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponse
+  = zAccessPolicyBindingState
+
+export const zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsPath
+  = z.object({
+    app_id: z.uuid(),
+    policy_id: z.string(),
+  })
+
+/**
+ * Success
+ */
+export const zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse
+  = zMemberBindingsResponse
+
+export const zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsPath
+  = z.object({
+    app_id: z.uuid(),
+    policy_id: z.string(),
+  })
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse
+  = zMemberBindingsResponse
+
+export const zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsPath
+  = z.object({
+    app_id: z.uuid(),
+    policy_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse
+  = zRoleBindingsResponse
+
+export const zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyPath = z.object({
+  app_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse = zAppAccessMatrix
+
+export const zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesPath = z.object({
+  app_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse
+  = zResourceUserAccessPoliciesResponse
+
+export const zPutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesPath
+  = z.object({
+    app_id: z.uuid(),
+    target_account_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponse
+  = zReplaceUserAccessPoliciesResponse
+
+export const zGetWorkspacesCurrentRbacAppsByAppIdWhitelistPath = z.object({
+  app_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacAppsByAppIdWhitelistResponse = zResourceWhitelist
+
+export const zPutWorkspacesCurrentRbacAppsByAppIdWhitelistPath = z.object({
+  app_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse = zResourceWhitelist
+
+export const zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsPath
+  = z.object({
+    dataset_id: z.uuid(),
+    policy_id: z.string(),
+  })
+
+/**
+ * Success
+ */
+export const zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse
+  = zMemberBindingsResponse
+
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsPath
+  = z.object({
+    dataset_id: z.uuid(),
+    policy_id: z.string(),
+  })
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse
+  = zMemberBindingsResponse
+
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsPath
+  = z.object({
+    dataset_id: z.uuid(),
+    policy_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse
+  = zRoleBindingsResponse
+
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyPath = z.object({
+  dataset_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse = zDatasetAccessMatrix
+
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesPath = z.object({
+  dataset_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse
+  = zResourceUserAccessPoliciesResponse
+
+export const zPutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesPath
+  = z.object({
+    dataset_id: z.uuid(),
+    target_account_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponse
+  = zReplaceUserAccessPoliciesResponse
+
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistPath = z.object({
+  dataset_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse = zResourceWhitelist
+
+export const zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistPath = z.object({
+  dataset_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse = zResourceWhitelist
+
+export const zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesPath = z.object({
+  member_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse = zMemberRolesResponse
+
+export const zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesPath = z.object({
+  member_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse = zMemberRolesResponse
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacMyPermissionsResponse = zMyPermissionsResponse
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacRolePermissionsCatalogResponse = zPermissionCatalogResponse
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse = zPermissionCatalogResponse
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse
+  = zPermissionCatalogResponse
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacRolesResponse = zRbacRoleList
+
+/**
+ * Role created
+ */
+export const zPostWorkspacesCurrentRbacRolesResponse = zRbacRole
+
+export const zDeleteWorkspacesCurrentRbacRolesByRoleIdPath = z.object({
+  role_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zDeleteWorkspacesCurrentRbacRolesByRoleIdResponse = zRbacRole
+
+export const zGetWorkspacesCurrentRbacRolesByRoleIdPath = z.object({
+  role_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacRolesByRoleIdResponse = zRbacRole
+
+export const zPutWorkspacesCurrentRbacRolesByRoleIdPath = z.object({
+  role_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacRolesByRoleIdResponse = zRbacRole
+
+export const zPostWorkspacesCurrentRbacRolesByRoleIdCopyPath = z.object({
+  role_id: z.uuid(),
+})
+
+/**
+ * Role copied
+ */
+export const zPostWorkspacesCurrentRbacRolesByRoleIdCopyResponse = zRbacRole
+
+export const zGetWorkspacesCurrentRbacRolesByRoleIdMembersPath = z.object({
+  role_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacRolesByRoleIdMembersResponse = zMembersInRoleList
+
+export const zPutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsPath = z.object({
+  policy_id: z.uuid(),
+})
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponse
+  = zAccessMatrixItem
+
+export const zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsPath
+  = z.object({
+    policy_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse
+  = zMemberBindingsResponse
+
+export const zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsPath
+  = z.object({
+    policy_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse
+  = zRoleBindingsResponse
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse = zWorkspaceAccessMatrix
+
+export const zPutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsPath
+  = z.object({
+    policy_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zPutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponse
+  = zAccessMatrixItem
+
+export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsPath
+  = z.object({
+    policy_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse
+  = zMemberBindingsResponse
+
+export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsPath
+  = z.object({
+    policy_id: z.uuid(),
+  })
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse
+  = zRoleBindingsResponse
+
+/**
+ * Success
+ */
+export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse = zWorkspaceAccessMatrix
+
 /**
  * Success
  */
diff --git a/packages/contracts/generated/api/openapi/types.gen.ts b/packages/contracts/generated/api/openapi/types.gen.ts
index 244ce92417c..e1217f3f6d7 100644
--- a/packages/contracts/generated/api/openapi/types.gen.ts
+++ b/packages/contracts/generated/api/openapi/types.gen.ts
@@ -257,6 +257,7 @@ export type Import = {
   error?: string
   id: string
   imported_dsl_version?: string
+  permission_keys?: Array<string>
   status: ImportStatus
 }
 
diff --git a/packages/contracts/generated/api/openapi/zod.gen.ts b/packages/contracts/generated/api/openapi/zod.gen.ts
index df0d82117a0..51a3cb8f480 100644
--- a/packages/contracts/generated/api/openapi/zod.gen.ts
+++ b/packages/contracts/generated/api/openapi/zod.gen.ts
@@ -263,6 +263,7 @@ export const zImport = z.object({
   error: z.string().optional().default(''),
   id: z.string(),
   imported_dsl_version: z.string().optional().default(''),
+  permission_keys: z.array(z.string()).optional(),
   status: zImportStatus,
 })
 
diff --git a/packages/contracts/generated/api/service/orpc.gen.ts b/packages/contracts/generated/api/service/orpc.gen.ts
index 518b44e06ea..b15cc78d07d 100644
--- a/packages/contracts/generated/api/service/orpc.gen.ts
+++ b/packages/contracts/generated/api/service/orpc.gen.ts
@@ -6,6 +6,7 @@ import * as z from 'zod'
 import {
   zDeleteAppsAnnotationsByAnnotationIdPath,
   zDeleteAppsAnnotationsByAnnotationIdResponse,
+  zDeleteConversationsByCIdBody,
   zDeleteConversationsByCIdPath,
   zDeleteConversationsByCIdResponse,
   zDeleteDatasetsByDatasetIdDocumentsByDocumentIdPath,
@@ -72,6 +73,7 @@ import {
   zGetFormHumanInputByFormTokenResponse,
   zGetInfoResponse,
   zGetMessagesByMessageIdSuggestedPath,
+  zGetMessagesByMessageIdSuggestedQuery,
   zGetMessagesByMessageIdSuggestedResponse,
   zGetMessagesQuery,
   zGetMessagesResponse,
@@ -110,12 +112,15 @@ import {
   zPostAppsAnnotationReplyByActionResponse,
   zPostAppsAnnotationsBody,
   zPostAppsAnnotationsResponse,
+  zPostAudioToTextBody,
   zPostAudioToTextResponse,
   zPostChatMessagesBody,
+  zPostChatMessagesByTaskIdStopBody,
   zPostChatMessagesByTaskIdStopPath,
   zPostChatMessagesByTaskIdStopResponse,
   zPostChatMessagesResponse,
   zPostCompletionMessagesBody,
+  zPostCompletionMessagesByTaskIdStopBody,
   zPostCompletionMessagesByTaskIdStopPath,
   zPostCompletionMessagesByTaskIdStopResponse,
   zPostCompletionMessagesResponse,
@@ -179,6 +184,7 @@ import {
   zPostDatasetsByDatasetIdRetrieveBody,
   zPostDatasetsByDatasetIdRetrievePath,
   zPostDatasetsByDatasetIdRetrieveResponse,
+  zPostDatasetsPipelineFileUploadBody,
   zPostDatasetsPipelineFileUploadResponse,
   zPostDatasetsResponse,
   zPostDatasetsTagsBindingBody,
@@ -187,6 +193,7 @@ import {
   zPostDatasetsTagsResponse,
   zPostDatasetsTagsUnbindingBody,
   zPostDatasetsTagsUnbindingResponse,
+  zPostFilesUploadBody,
   zPostFilesUploadResponse,
   zPostFormHumanInputByFormTokenBody,
   zPostFormHumanInputByFormTokenPath,
@@ -201,6 +208,7 @@ import {
   zPostWorkflowsByWorkflowIdRunResponse,
   zPostWorkflowsRunBody,
   zPostWorkflowsRunResponse,
+  zPostWorkflowsTasksByTaskIdStopBody,
   zPostWorkflowsTasksByTaskIdStopPath,
   zPostWorkflowsTasksByTaskIdStopResponse,
   zPutAppsAnnotationsByAnnotationIdBody,
@@ -226,21 +234,20 @@ export const root = {
 }
 
 /**
- * Get all feedbacks for the application
+ * List App Feedbacks
  *
- * Get all feedbacks for the application
- * Returns paginated list of all feedback submitted for messages in this app.
+ * Retrieve a paginated list of all feedback submitted for messages in this application, including both end-user and admin feedback.
  */
 export const get2 = oc
   .route({
     description:
-      'Get all feedbacks for the application\nReturns paginated list of all feedback submitted for messages in this app.',
+      'Retrieve a paginated list of all feedback submitted for messages in this application, including both end-user and admin feedback.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getAppFeedbacks',
     path: '/app/feedbacks',
-    summary: 'Get all feedbacks for the application',
-    tags: ['service_api'],
+    summary: 'List App Feedbacks',
+    tags: ['Feedback'],
   })
   .input(z.object({ query: zGetAppFeedbacksQuery.optional() }))
   .output(zGetAppFeedbacksResponse)
@@ -254,19 +261,20 @@ export const app = {
 }
 
 /**
- * Get the status of an annotation reply action job
+ * Get Annotation Reply Job Status
  *
- * Get the status of an annotation reply action job
+ * Retrieves the status of an asynchronous annotation reply configuration job started by [Configure Annotation Reply](/api-reference/annotations/configure-annotation-reply).
  */
 export const get3 = oc
   .route({
-    description: 'Get the status of an annotation reply action job',
+    description:
+      'Retrieves the status of an asynchronous annotation reply configuration job started by [Configure Annotation Reply](/api-reference/annotations/configure-annotation-reply).',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getAppsAnnotationReplyByActionStatusByJobId',
     path: '/apps/annotation-reply/{action}/status/{job_id}',
-    summary: 'Get the status of an annotation reply action job',
-    tags: ['service_api'],
+    summary: 'Get Annotation Reply Job Status',
+    tags: ['Annotations'],
   })
   .input(z.object({ params: zGetAppsAnnotationReplyByActionStatusByJobIdPath }))
   .output(zGetAppsAnnotationReplyByActionStatusByJobIdResponse)
@@ -280,19 +288,20 @@ export const status = {
 }
 
 /**
- * Enable or disable annotation reply feature
+ * Configure Annotation Reply
  *
- * Enable or disable annotation reply feature
+ * Enables or disables the annotation reply feature. Requires embedding model configuration when enabling. Executes asynchronously — use [Get Annotation Reply Job Status](/api-reference/annotations/get-annotation-reply-job-status) to track progress.
  */
 export const post = oc
   .route({
-    description: 'Enable or disable annotation reply feature',
+    description:
+      'Enables or disables the annotation reply feature. Requires embedding model configuration when enabling. Executes asynchronously — use [Get Annotation Reply Job Status](/api-reference/annotations/get-annotation-reply-job-status) to track progress.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postAppsAnnotationReplyByAction',
     path: '/apps/annotation-reply/{action}',
-    summary: 'Enable or disable annotation reply feature',
-    tags: ['service_api'],
+    summary: 'Configure Annotation Reply',
+    tags: ['Annotations'],
   })
   .input(
     z.object({
@@ -312,38 +321,38 @@ export const annotationReply = {
 }
 
 /**
- * Delete an annotation
+ * Delete Annotation
  *
- * Delete an annotation
+ * Deletes an annotation and its associated hit history.
  */
 export const delete_ = oc
   .route({
-    description: 'Delete an annotation',
+    description: 'Deletes an annotation and its associated hit history.',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteAppsAnnotationsByAnnotationId',
     path: '/apps/annotations/{annotation_id}',
     successStatus: 204,
-    summary: 'Delete an annotation',
-    tags: ['service_api'],
+    summary: 'Delete Annotation',
+    tags: ['Annotations'],
   })
   .input(z.object({ params: zDeleteAppsAnnotationsByAnnotationIdPath }))
   .output(zDeleteAppsAnnotationsByAnnotationIdResponse)
 
 /**
- * Update an existing annotation
+ * Update Annotation
  *
- * Update an existing annotation
+ * Updates the question and answer of an existing annotation.
  */
 export const put = oc
   .route({
-    description: 'Update an existing annotation',
+    description: 'Updates the question and answer of an existing annotation.',
     inputStructure: 'detailed',
     method: 'PUT',
     operationId: 'putAppsAnnotationsByAnnotationId',
     path: '/apps/annotations/{annotation_id}',
-    summary: 'Update an existing annotation',
-    tags: ['service_api'],
+    summary: 'Update Annotation',
+    tags: ['Annotations'],
   })
   .input(
     z.object({
@@ -359,38 +368,40 @@ export const byAnnotationId = {
 }
 
 /**
- * List annotations for the application
+ * List Annotations
  *
- * List annotations for the application
+ * Retrieves a paginated list of annotations for the application. Supports keyword search filtering.
  */
 export const get4 = oc
   .route({
-    description: 'List annotations for the application',
+    description:
+      'Retrieves a paginated list of annotations for the application. Supports keyword search filtering.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getAppsAnnotations',
     path: '/apps/annotations',
-    summary: 'List annotations for the application',
-    tags: ['service_api'],
+    summary: 'List Annotations',
+    tags: ['Annotations'],
   })
   .input(z.object({ query: zGetAppsAnnotationsQuery.optional() }))
   .output(zGetAppsAnnotationsResponse)
 
 /**
- * Create a new annotation
+ * Create Annotation
  *
- * Create a new annotation
+ * Creates a new annotation. Annotations provide predefined question-answer pairs that the app can match and return directly instead of generating a response.
  */
 export const post2 = oc
   .route({
-    description: 'Create a new annotation',
+    description:
+      'Creates a new annotation. Annotations provide predefined question-answer pairs that the app can match and return directly instead of generating a response.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postAppsAnnotations',
     path: '/apps/annotations',
     successStatus: 201,
-    summary: 'Create a new annotation',
-    tags: ['service_api'],
+    summary: 'Create Annotation',
+    tags: ['Annotations'],
   })
   .input(z.object({ body: zPostAppsAnnotationsBody }))
   .output(zPostAppsAnnotationsResponse)
@@ -407,22 +418,22 @@ export const apps = {
 }
 
 /**
- * Convert audio to text using speech-to-text
+ * Convert Audio to Text
  *
- * Convert audio to text using speech-to-text
- * Accepts an audio file upload and returns the transcribed text.
+ * Convert audio file to text. Supported MIME types: `audio/mp3`, `audio/mpga`, `audio/m4a`, `audio/wav`, and `audio/amr`. File size limit is `30 MB`.
  */
 export const post3 = oc
   .route({
     description:
-      'Convert audio to text using speech-to-text\nAccepts an audio file upload and returns the transcribed text.',
+      'Convert audio file to text. Supported MIME types: `audio/mp3`, `audio/mpga`, `audio/m4a`, `audio/wav`, and `audio/amr`. File size limit is `30 MB`.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postAudioToText',
     path: '/audio-to-text',
-    summary: 'Convert audio to text using speech-to-text',
-    tags: ['service_api'],
+    summary: 'Convert Audio to Text',
+    tags: ['TTS'],
   })
+  .input(z.object({ body: zPostAudioToTextBody }))
   .output(zPostAudioToTextResponse)
 
 export const audioToText = {
@@ -430,21 +441,26 @@ export const audioToText = {
 }
 
 /**
- * Stop a running chat message generation
+ * Stop Chat Message Generation
  *
- * Stop a running chat message generation
+ * Stops a chat message generation task. Only supported in `streaming` mode.
  */
 export const post4 = oc
   .route({
-    description: 'Stop a running chat message generation',
+    description: 'Stops a chat message generation task. Only supported in `streaming` mode.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postChatMessagesByTaskIdStop',
     path: '/chat-messages/{task_id}/stop',
-    summary: 'Stop a running chat message generation',
-    tags: ['service_api'],
+    summary: 'Stop Chat Message Generation',
+    tags: ['Chatflows', 'Chats'],
   })
-  .input(z.object({ params: zPostChatMessagesByTaskIdStopPath }))
+  .input(
+    z.object({
+      body: zPostChatMessagesByTaskIdStopBody,
+      params: zPostChatMessagesByTaskIdStopPath,
+    }),
+  )
   .output(zPostChatMessagesByTaskIdStopResponse)
 
 export const stop = {
@@ -456,22 +472,19 @@ export const byTaskId = {
 }
 
 /**
- * Send a message in a chat conversation
+ * Send Chat Message
  *
- * Send a message in a chat conversation
- * This endpoint handles chat messages for chat, agent chat, and advanced chat applications.
- * Supports conversation management and both blocking and streaming response modes.
+ * Send a request to the chat application.
  */
 export const post5 = oc
   .route({
-    description:
-      'Send a message in a chat conversation\nThis endpoint handles chat messages for chat, agent chat, and advanced chat applications.\nSupports conversation management and both blocking and streaming response modes.',
+    description: 'Send a request to the chat application.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postChatMessages',
     path: '/chat-messages',
-    summary: 'Send a message in a chat conversation',
-    tags: ['service_api'],
+    summary: 'Send Chat Message',
+    tags: ['Chatflows', 'Chats'],
   })
   .input(z.object({ body: zPostChatMessagesBody }))
   .output(zPostChatMessagesResponse)
@@ -482,21 +495,26 @@ export const chatMessages = {
 }
 
 /**
- * Stop a running completion task
+ * Stop Completion Message Generation
  *
- * Stop a running completion task
+ * Stops a completion message generation task. Only supported in `streaming` mode.
  */
 export const post6 = oc
   .route({
-    description: 'Stop a running completion task',
+    description: 'Stops a completion message generation task. Only supported in `streaming` mode.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postCompletionMessagesByTaskIdStop',
     path: '/completion-messages/{task_id}/stop',
-    summary: 'Stop a running completion task',
-    tags: ['service_api'],
+    summary: 'Stop Completion Message Generation',
+    tags: ['Completions'],
   })
-  .input(z.object({ params: zPostCompletionMessagesByTaskIdStopPath }))
+  .input(
+    z.object({
+      body: zPostCompletionMessagesByTaskIdStopBody,
+      params: zPostCompletionMessagesByTaskIdStopPath,
+    }),
+  )
   .output(zPostCompletionMessagesByTaskIdStopResponse)
 
 export const stop2 = {
@@ -508,22 +526,19 @@ export const byTaskId2 = {
 }
 
 /**
- * Create a completion for the given prompt
+ * Send Completion Message
  *
- * Create a completion for the given prompt
- * This endpoint generates a completion based on the provided inputs and query.
- * Supports both blocking and streaming response modes.
+ * Send a request to the text generation application.
  */
 export const post7 = oc
   .route({
-    description:
-      'Create a completion for the given prompt\nThis endpoint generates a completion based on the provided inputs and query.\nSupports both blocking and streaming response modes.',
+    description: 'Send a request to the text generation application.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postCompletionMessages',
     path: '/completion-messages',
-    summary: 'Create a completion for the given prompt',
-    tags: ['service_api'],
+    summary: 'Send Completion Message',
+    tags: ['Completions'],
   })
   .input(z.object({ body: zPostCompletionMessagesBody }))
   .output(zPostCompletionMessagesResponse)
@@ -534,19 +549,20 @@ export const completionMessages = {
 }
 
 /**
- * Rename a conversation or auto-generate a name
+ * Rename Conversation
  *
- * Rename a conversation or auto-generate a name
+ * Rename a conversation or auto-generate a name. The conversation name is used for display on clients that support multiple conversations.
  */
 export const post8 = oc
   .route({
-    description: 'Rename a conversation or auto-generate a name',
+    description:
+      'Rename a conversation or auto-generate a name. The conversation name is used for display on clients that support multiple conversations.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postConversationsByCIdName',
     path: '/conversations/{c_id}/name',
-    summary: 'Rename a conversation or auto-generate a name',
-    tags: ['service_api'],
+    summary: 'Rename Conversation',
+    tags: ['Conversations'],
   })
   .input(
     z.object({ body: zPostConversationsByCIdNameBody, params: zPostConversationsByCIdNamePath }),
@@ -558,22 +574,20 @@ export const name = {
 }
 
 /**
- * Update a conversation variable's value
+ * Update Conversation Variable
  *
- * Update a conversation variable's value
- * Allows updating the value of a specific conversation variable.
- * The value must match the variable's expected type.
+ * Update the value of a specific conversation variable. The value must match the expected type.
  */
 export const put2 = oc
   .route({
     description:
-      'Update a conversation variable\'s value\nAllows updating the value of a specific conversation variable.\nThe value must match the variable\'s expected type.',
+      'Update the value of a specific conversation variable. The value must match the expected type.',
     inputStructure: 'detailed',
     method: 'PUT',
     operationId: 'putConversationsByCIdVariablesByVariableId',
     path: '/conversations/{c_id}/variables/{variable_id}',
-    summary: 'Update a conversation variable\'s value',
-    tags: ['service_api'],
+    summary: 'Update Conversation Variable',
+    tags: ['Conversations'],
   })
   .input(
     z.object({
@@ -588,21 +602,19 @@ export const byVariableId = {
 }
 
 /**
- * List all variables for a conversation
+ * List Conversation Variables
  *
- * List all variables for a conversation
- * Conversational variables are only available for chat applications.
+ * Retrieve variables from a specific conversation.
  */
 export const get5 = oc
   .route({
-    description:
-      'List all variables for a conversation\nConversational variables are only available for chat applications.',
+    description: 'Retrieve variables from a specific conversation.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getConversationsByCIdVariables',
     path: '/conversations/{c_id}/variables',
-    summary: 'List all variables for a conversation',
-    tags: ['service_api'],
+    summary: 'List Conversation Variables',
+    tags: ['Conversations'],
   })
   .input(
     z.object({
@@ -618,22 +630,22 @@ export const variables = {
 }
 
 /**
- * Delete a specific conversation
+ * Delete Conversation
  *
- * Delete a specific conversation
+ * Delete a conversation.
  */
 export const delete2 = oc
   .route({
-    description: 'Delete a specific conversation',
+    description: 'Delete a conversation.',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteConversationsByCId',
     path: '/conversations/{c_id}',
     successStatus: 204,
-    summary: 'Delete a specific conversation',
-    tags: ['service_api'],
+    summary: 'Delete Conversation',
+    tags: ['Conversations'],
   })
-  .input(z.object({ params: zDeleteConversationsByCIdPath }))
+  .input(z.object({ body: zDeleteConversationsByCIdBody, params: zDeleteConversationsByCIdPath }))
   .output(zDeleteConversationsByCIdResponse)
 
 export const byCId = {
@@ -643,21 +655,20 @@ export const byCId = {
 }
 
 /**
- * List all conversations for the current user
+ * List Conversations
  *
- * List all conversations for the current user
- * Supports pagination using last_id and limit parameters.
+ * Retrieve the conversation list for the current user, ordered by most recently active.
  */
 export const get6 = oc
   .route({
     description:
-      'List all conversations for the current user\nSupports pagination using last_id and limit parameters.',
+      'Retrieve the conversation list for the current user, ordered by most recently active.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getConversations',
     path: '/conversations',
-    summary: 'List all conversations for the current user',
-    tags: ['service_api'],
+    summary: 'List Conversations',
+    tags: ['Conversations'],
   })
   .input(z.object({ query: zGetConversationsQuery.optional() }))
   .output(zGetConversationsResponse)
@@ -668,23 +679,23 @@ export const conversations = {
 }
 
 /**
- * Upload a file for use in conversations
+ * Upload Pipeline File
  *
- * Upload a file to a knowledgebase pipeline
- * Accepts a single file upload via multipart/form-data.
+ * Upload a file for use in a knowledge pipeline. Accepts a single file via `multipart/form-data`.
  */
 export const post9 = oc
   .route({
     description:
-      'Upload a file to a knowledgebase pipeline\nAccepts a single file upload via multipart/form-data.',
+      'Upload a file for use in a knowledge pipeline. Accepts a single file via `multipart/form-data`.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsPipelineFileUpload',
     path: '/datasets/pipeline/file-upload',
     successStatus: 201,
-    summary: 'Upload a file for use in conversations',
-    tags: ['service_api'],
+    summary: 'Upload Pipeline File',
+    tags: ['Knowledge Pipeline'],
   })
+  .input(z.object({ body: zPostDatasetsPipelineFileUploadBody }))
   .output(zPostDatasetsPipelineFileUploadResponse)
 
 export const fileUpload = {
@@ -696,17 +707,21 @@ export const pipeline = {
 }
 
 /**
- * Bind tags to a dataset
+ * Create Tag Binding
+ *
+ * Bind one or more tags to a knowledge base. A knowledge base can have multiple tags.
  */
 export const post10 = oc
   .route({
-    description: 'Bind tags to a dataset',
+    description:
+      'Bind one or more tags to a knowledge base. A knowledge base can have multiple tags.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsTagsBinding',
     path: '/datasets/tags/binding',
     successStatus: 204,
-    tags: ['service_api'],
+    summary: 'Create Tag Binding',
+    tags: ['Tags'],
   })
   .input(z.object({ body: zPostDatasetsTagsBindingBody }))
   .output(zPostDatasetsTagsBindingResponse)
@@ -716,17 +731,20 @@ export const binding = {
 }
 
 /**
- * Unbind tags from a dataset
+ * Delete Tag Binding
+ *
+ * Remove one or more tags from a knowledge base.
  */
 export const post11 = oc
   .route({
-    description: 'Unbind tags from a dataset',
+    description: 'Remove one or more tags from a knowledge base.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsTagsUnbinding',
     path: '/datasets/tags/unbinding',
     successStatus: 204,
-    tags: ['service_api'],
+    summary: 'Delete Tag Binding',
+    tags: ['Tags'],
   })
   .input(z.object({ body: zPostDatasetsTagsUnbindingBody }))
   .output(zPostDatasetsTagsUnbindingResponse)
@@ -736,70 +754,74 @@ export const unbinding = {
 }
 
 /**
- * Delete a knowledge type tag
+ * Delete Knowledge Tag
  *
- * Delete a knowledge type tag
+ * Permanently delete a knowledge base tag. Does not delete the knowledge bases that were tagged.
  */
 export const delete3 = oc
   .route({
-    description: 'Delete a knowledge type tag',
+    description:
+      'Permanently delete a knowledge base tag. Does not delete the knowledge bases that were tagged.',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteDatasetsTags',
     path: '/datasets/tags',
     successStatus: 204,
-    summary: 'Delete a knowledge type tag',
-    tags: ['service_api'],
+    summary: 'Delete Knowledge Tag',
+    tags: ['Tags'],
   })
   .input(z.object({ body: zDeleteDatasetsTagsBody }))
   .output(zDeleteDatasetsTagsResponse)
 
 /**
- * Get all knowledge type tags
+ * List Knowledge Tags
  *
- * Get all knowledge type tags
+ * Returns the list of all knowledge base tags in the workspace.
  */
 export const get7 = oc
   .route({
-    description: 'Get all knowledge type tags',
+    description: 'Returns the list of all knowledge base tags in the workspace.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsTags',
     path: '/datasets/tags',
-    summary: 'Get all knowledge type tags',
-    tags: ['service_api'],
+    summary: 'List Knowledge Tags',
+    tags: ['Tags'],
   })
   .output(zGetDatasetsTagsResponse)
 
 /**
- * Update a knowledge type tag
+ * Update Knowledge Tag
+ *
+ * Rename an existing knowledge base tag.
  */
 export const patch = oc
   .route({
-    description: 'Update a knowledge type tag',
+    description: 'Rename an existing knowledge base tag.',
     inputStructure: 'detailed',
     method: 'PATCH',
     operationId: 'patchDatasetsTags',
     path: '/datasets/tags',
-    tags: ['service_api'],
+    summary: 'Update Knowledge Tag',
+    tags: ['Tags'],
   })
   .input(z.object({ body: zPatchDatasetsTagsBody }))
   .output(zPatchDatasetsTagsResponse)
 
 /**
- * Add a knowledge type tag
+ * Create Knowledge Tag
  *
- * Add a knowledge type tag
+ * Create a new tag for organizing knowledge bases.
  */
 export const post12 = oc
   .route({
-    description: 'Add a knowledge type tag',
+    description: 'Create a new tag for organizing knowledge bases.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsTags',
     path: '/datasets/tags',
-    summary: 'Add a knowledge type tag',
-    tags: ['service_api'],
+    summary: 'Create Knowledge Tag',
+    tags: ['Tags'],
   })
   .input(z.object({ body: zPostDatasetsTagsBody }))
   .output(zPostDatasetsTagsResponse)
@@ -814,16 +836,20 @@ export const tags = {
 }
 
 /**
- * Create a new document by uploading a file
+ * Create Document by File
+ *
+ * Create a document by uploading a file. Supports common document formats (PDF, TXT, DOCX, etc.). Processing is asynchronous — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
  */
 export const post13 = oc
   .route({
-    description: 'Create a new document by uploading a file',
+    description:
+      'Create a document by uploading a file. Supports common document formats (PDF, TXT, DOCX, etc.). Processing is asynchronous — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentCreateByFile',
     path: '/datasets/{dataset_id}/document/create-by-file',
-    tags: ['service_api'],
+    summary: 'Create Document by File',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -834,16 +860,23 @@ export const post13 = oc
   .output(zPostDatasetsByDatasetIdDocumentCreateByFileResponse)
 
 /**
- * Create a new document by uploading a file
+ * Create Document by File
+ *
+ * Create a document by uploading a file. Supports common document formats (PDF, TXT, DOCX, etc.). Processing is asynchronous — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
+ *
+ * @deprecated
  */
 export const post14 = oc
   .route({
-    description: 'Create a new document by uploading a file',
+    deprecated: true,
+    description:
+      'Create a document by uploading a file. Supports common document formats (PDF, TXT, DOCX, etc.). Processing is asynchronous — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentCreateByFile',
     path: '/datasets/{dataset_id}/document/create_by_file',
-    tags: ['service_api'],
+    summary: 'Create Document by File',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -858,16 +891,20 @@ export const createByFile = {
 }
 
 /**
- * Create a new document by providing text content
+ * Create Document by Text
+ *
+ * Create a document from raw text content. The document is processed asynchronously — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
  */
 export const post15 = oc
   .route({
-    description: 'Create a new document by providing text content',
+    description:
+      'Create a document from raw text content. The document is processed asynchronously — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentCreateByText',
     path: '/datasets/{dataset_id}/document/create-by-text',
-    tags: ['service_api'],
+    summary: 'Create Document by Text',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -911,16 +948,20 @@ export const document_ = {
 }
 
 /**
- * Download selected uploaded documents as a single ZIP archive
+ * Download Documents as ZIP
+ *
+ * Download multiple uploaded-file documents as a single ZIP archive. Accepts up to `100` document IDs.
  */
 export const post17 = oc
   .route({
-    description: 'Download selected uploaded documents as a single ZIP archive',
+    description:
+      'Download multiple uploaded-file documents as a single ZIP archive. Accepts up to `100` document IDs.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentsDownloadZip',
     path: '/datasets/{dataset_id}/documents/download-zip',
-    tags: ['service_api'],
+    summary: 'Download Documents as ZIP',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -935,19 +976,20 @@ export const downloadZip = {
 }
 
 /**
- * Update metadata for multiple documents
+ * Update Document Metadata in Batch
  *
- * Update metadata for multiple documents
+ * Update metadata values for multiple documents at once. Each document in the request receives the specified metadata key-value pairs.
  */
 export const post18 = oc
   .route({
-    description: 'Update metadata for multiple documents',
+    description:
+      'Update metadata values for multiple documents at once. Each document in the request receives the specified metadata key-value pairs.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentsMetadata',
     path: '/datasets/{dataset_id}/documents/metadata',
-    summary: 'Update metadata for multiple documents',
-    tags: ['service_api'],
+    summary: 'Update Document Metadata in Batch',
+    tags: ['Metadata'],
   })
   .input(
     z.object({
@@ -962,33 +1004,19 @@ export const metadata = {
 }
 
 /**
- * Batch update document status
+ * Update Document Status in Batch
  *
- * Batch update document status
- * Args:
- * tenant_id: tenant id
- * dataset_id: dataset id
- * action: action to perform (Literal["enable", "disable", "archive", "un_archive"])
- *
- * Returns:
- * dict: A dictionary with a key 'result' and a value 'success'
- * int: HTTP status code 200 indicating that the operation was successful.
- *
- * Raises:
- * NotFound: If the dataset with the given ID does not exist.
- * Forbidden: If the user does not have permission.
- * InvalidActionError: If the action is invalid or cannot be performed.
+ * Enable, disable, archive, or unarchive multiple documents at once.
  */
 export const patch2 = oc
   .route({
-    description:
-      'Batch update document status\nArgs:\n    tenant_id: tenant id\n    dataset_id: dataset id\n    action: action to perform (Literal["enable", "disable", "archive", "un_archive"])\n\nReturns:\n    dict: A dictionary with a key \'result\' and a value \'success\'\n    int: HTTP status code 200 indicating that the operation was successful.\n\nRaises:\n    NotFound: If the dataset with the given ID does not exist.\n    Forbidden: If the user does not have permission.\n    InvalidActionError: If the action is invalid or cannot be performed.',
+    description: 'Enable, disable, archive, or unarchive multiple documents at once.',
     inputStructure: 'detailed',
     method: 'PATCH',
     operationId: 'patchDatasetsByDatasetIdDocumentsStatusByAction',
     path: '/datasets/{dataset_id}/documents/status/{action}',
-    summary: 'Batch update document status',
-    tags: ['service_api'],
+    summary: 'Update Document Status in Batch',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -1007,16 +1035,20 @@ export const status2 = {
 }
 
 /**
- * Get indexing status for documents in a batch
+ * Get Document Indexing Status
+ *
+ * Check the indexing progress of documents in a batch. Returns the current processing stage and chunk completion counts for each document. Poll this endpoint until `indexing_status` reaches `completed` or `error`. The status progresses through: `waiting` → `parsing` → `cleaning` → `splitting` → `indexing` → `completed`.
  */
 export const get8 = oc
   .route({
-    description: 'Get indexing status for documents in a batch',
+    description:
+      'Check the indexing progress of documents in a batch. Returns the current processing stage and chunk completion counts for each document. Poll this endpoint until `indexing_status` reaches `completed` or `error`. The status progresses through: `waiting` → `parsing` → `cleaning` → `splitting` → `indexing` → `completed`.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdDocumentsByBatchIndexingStatus',
     path: '/datasets/{dataset_id}/documents/{batch}/indexing-status',
-    tags: ['service_api'],
+    summary: 'Get Document Indexing Status',
+    tags: ['Documents'],
   })
   .input(z.object({ params: zGetDatasetsByDatasetIdDocumentsByBatchIndexingStatusPath }))
   .output(zGetDatasetsByDatasetIdDocumentsByBatchIndexingStatusResponse)
@@ -1030,16 +1062,19 @@ export const byBatch = {
 }
 
 /**
- * Get a signed download URL for a document's original uploaded file
+ * Download Document
+ *
+ * Get a signed download URL for a document's original uploaded file.
  */
 export const get9 = oc
   .route({
-    description: 'Get a signed download URL for a document\'s original uploaded file',
+    description: 'Get a signed download URL for a document\'s original uploaded file.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdDocumentsByDocumentIdDownload',
     path: '/datasets/{dataset_id}/documents/{document_id}/download',
-    tags: ['service_api'],
+    summary: 'Download Document',
+    tags: ['Documents'],
   })
   .input(z.object({ params: zGetDatasetsByDatasetIdDocumentsByDocumentIdDownloadPath }))
   .output(zGetDatasetsByDatasetIdDocumentsByDocumentIdDownloadResponse)
@@ -1049,18 +1084,21 @@ export const download = {
 }
 
 /**
- * Delete a specific child chunk
+ * Delete Child Chunk
+ *
+ * Permanently delete a child chunk from its parent chunk.
  */
 export const delete4 = oc
   .route({
-    description: 'Delete a specific child chunk',
+    description: 'Permanently delete a child chunk from its parent chunk.',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId:
       'deleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkId',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks/{child_chunk_id}',
     successStatus: 204,
-    tags: ['service_api'],
+    summary: 'Delete Child Chunk',
+    tags: ['Chunks'],
   })
   .input(
     z.object({
@@ -1073,17 +1111,20 @@ export const delete4 = oc
   )
 
 /**
- * Update a specific child chunk
+ * Update Child Chunk
+ *
+ * Update the content of an existing child chunk.
  */
 export const patch3 = oc
   .route({
-    description: 'Update a specific child chunk',
+    description: 'Update the content of an existing child chunk.',
     inputStructure: 'detailed',
     method: 'PATCH',
     operationId:
       'patchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkId',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks/{child_chunk_id}',
-    tags: ['service_api'],
+    summary: 'Update Child Chunk',
+    tags: ['Chunks'],
   })
   .input(
     z.object({
@@ -1102,16 +1143,19 @@ export const byChildChunkId = {
 }
 
 /**
- * List child chunks for a segment
+ * List Child Chunks
+ *
+ * Returns a paginated list of child chunks under a specific parent chunk.
  */
 export const get10 = oc
   .route({
-    description: 'List child chunks for a segment',
+    description: 'Returns a paginated list of child chunks under a specific parent chunk.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunks',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks',
-    tags: ['service_api'],
+    summary: 'List Child Chunks',
+    tags: ['Chunks'],
   })
   .input(
     z.object({
@@ -1123,16 +1167,19 @@ export const get10 = oc
   .output(zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksResponse)
 
 /**
- * Create a new child chunk for a segment
+ * Create Child Chunk
+ *
+ * Create a child chunk under the specified segment.
  */
 export const post19 = oc
   .route({
-    description: 'Create a new child chunk for a segment',
+    description: 'Create a child chunk under the specified segment.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunks',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}/child_chunks',
-    tags: ['service_api'],
+    summary: 'Create Child Chunk',
+    tags: ['Chunks'],
   })
   .input(
     z.object({
@@ -1149,17 +1196,20 @@ export const childChunks = {
 }
 
 /**
- * Delete a specific segment
+ * Delete Chunk
+ *
+ * Permanently delete a chunk from the document.
  */
 export const delete5 = oc
   .route({
-    description: 'Delete a specific segment',
+    description: 'Permanently delete a chunk from the document.',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentId',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}',
     successStatus: 204,
-    tags: ['service_api'],
+    summary: 'Delete Chunk',
+    tags: ['Chunks'],
   })
   .input(
     z.object({ params: zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdPath }),
@@ -1167,31 +1217,39 @@ export const delete5 = oc
   .output(zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdResponse)
 
 /**
- * Get a specific segment by ID
+ * Get Chunk
+ *
+ * Retrieve detailed information about a specific chunk, including its content, keywords, and indexing status.
  */
 export const get11 = oc
   .route({
-    description: 'Get a specific segment by ID',
+    description:
+      'Retrieve detailed information about a specific chunk, including its content, keywords, and indexing status.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentId',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}',
-    tags: ['service_api'],
+    summary: 'Get Chunk',
+    tags: ['Chunks'],
   })
   .input(z.object({ params: zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdPath }))
   .output(zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdResponse)
 
 /**
- * Update a specific segment
+ * Update Chunk
+ *
+ * Update a chunk's content, keywords, or answer. Re-triggers indexing for the modified chunk.
  */
 export const post20 = oc
   .route({
-    description: 'Update a specific segment',
+    description:
+      'Update a chunk\'s content, keywords, or answer. Re-triggers indexing for the modified chunk.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentId',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments/{segment_id}',
-    tags: ['service_api'],
+    summary: 'Update Chunk',
+    tags: ['Chunks'],
   })
   .input(
     z.object({
@@ -1209,16 +1267,20 @@ export const bySegmentId = {
 }
 
 /**
- * List segments in a document
+ * List Chunks
+ *
+ * Returns a paginated list of chunks within a document. Supports filtering by keyword and status.
  */
 export const get12 = oc
   .route({
-    description: 'List segments in a document',
+    description:
+      'Returns a paginated list of chunks within a document. Supports filtering by keyword and status.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdDocumentsByDocumentIdSegments',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments',
-    tags: ['service_api'],
+    summary: 'List Chunks',
+    tags: ['Chunks'],
   })
   .input(
     z.object({
@@ -1229,16 +1291,20 @@ export const get12 = oc
   .output(zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsResponse)
 
 /**
- * Create segments in a document
+ * Create Chunks
+ *
+ * Create one or more chunks within a document. Each chunk can include optional keywords and an answer field (for QA-mode documents).
  */
 export const post21 = oc
   .route({
-    description: 'Create segments in a document',
+    description:
+      'Create one or more chunks within a document. Each chunk can include optional keywords and an answer field (for QA-mode documents).',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentsByDocumentIdSegments',
     path: '/datasets/{dataset_id}/documents/{document_id}/segments',
-    tags: ['service_api'],
+    summary: 'Create Chunks',
+    tags: ['Chunks'],
   })
   .input(
     z.object({
@@ -1255,7 +1321,9 @@ export const segments = {
 }
 
 /**
- * Deprecated legacy alias for updating an existing document by uploading a file. Use PATCH /datasets/{dataset_id}/documents/{document_id} instead.
+ * Update Document by File
+ *
+ * Update an existing document by uploading a new file. Re-triggers indexing — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
  *
  * @deprecated
  */
@@ -1263,12 +1331,13 @@ export const post22 = oc
   .route({
     deprecated: true,
     description:
-      'Deprecated legacy alias for updating an existing document by uploading a file. Use PATCH /datasets/{dataset_id}/documents/{document_id} instead.',
+      'Update an existing document by uploading a new file. Re-triggers indexing — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFile',
     path: '/datasets/{dataset_id}/documents/{document_id}/update-by-file',
-    tags: ['service_api'],
+    summary: 'Update Document by File',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -1279,7 +1348,9 @@ export const post22 = oc
   .output(zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFileResponse)
 
 /**
- * Deprecated legacy alias for updating an existing document by uploading a file. Use PATCH /datasets/{dataset_id}/documents/{document_id} instead.
+ * Update Document by File
+ *
+ * Update an existing document by uploading a new file. Re-triggers indexing — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
  *
  * @deprecated
  */
@@ -1287,12 +1358,13 @@ export const post23 = oc
   .route({
     deprecated: true,
     description:
-      'Deprecated legacy alias for updating an existing document by uploading a file. Use PATCH /datasets/{dataset_id}/documents/{document_id} instead.',
+      'Update an existing document by uploading a new file. Re-triggers indexing — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFile',
     path: '/datasets/{dataset_id}/documents/{document_id}/update_by_file',
-    tags: ['service_api'],
+    summary: 'Update Document by File',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -1307,16 +1379,20 @@ export const updateByFile = {
 }
 
 /**
- * Update an existing document by providing text content
+ * Update Document by Text
+ *
+ * Update an existing document's text content, name, or processing configuration. Re-triggers indexing if content changes — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.
  */
 export const post24 = oc
   .route({
-    description: 'Update an existing document by providing text content',
+    description:
+      'Update an existing document\'s text content, name, or processing configuration. Re-triggers indexing if content changes — use the returned `batch` ID with [Get Document Indexing Status](/api-reference/documents/get-document-indexing-status) to track progress.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdDocumentsByDocumentIdUpdateByText',
     path: '/datasets/{dataset_id}/documents/{document_id}/update-by-text',
-    tags: ['service_api'],
+    summary: 'Update Document by Text',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -1355,35 +1431,39 @@ export const updateByText = {
 }
 
 /**
- * Delete document
+ * Delete Document
  *
- * Delete a document
+ * Permanently delete a document and all its chunks from the knowledge base.
  */
 export const delete6 = oc
   .route({
-    description: 'Delete a document',
+    description: 'Permanently delete a document and all its chunks from the knowledge base.',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteDatasetsByDatasetIdDocumentsByDocumentId',
     path: '/datasets/{dataset_id}/documents/{document_id}',
     successStatus: 204,
-    summary: 'Delete document',
-    tags: ['service_api'],
+    summary: 'Delete Document',
+    tags: ['Documents'],
   })
   .input(z.object({ params: zDeleteDatasetsByDatasetIdDocumentsByDocumentIdPath }))
   .output(zDeleteDatasetsByDatasetIdDocumentsByDocumentIdResponse)
 
 /**
- * Get a specific document by ID
+ * Get Document
+ *
+ * Retrieve detailed information about a specific document, including its indexing status, metadata, and processing statistics.
  */
 export const get13 = oc
   .route({
-    description: 'Get a specific document by ID',
+    description:
+      'Retrieve detailed information about a specific document, including its indexing status, metadata, and processing statistics.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdDocumentsByDocumentId',
     path: '/datasets/{dataset_id}/documents/{document_id}',
-    tags: ['service_api'],
+    summary: 'Get Document',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -1424,16 +1504,20 @@ export const byDocumentId = {
 }
 
 /**
- * List all documents in a dataset
+ * List Documents
+ *
+ * Returns a paginated list of documents in the knowledge base. Supports filtering by keyword and indexing status.
  */
 export const get14 = oc
   .route({
-    description: 'List all documents in a dataset',
+    description:
+      'Returns a paginated list of documents in the knowledge base. Supports filtering by keyword and indexing status.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdDocuments',
     path: '/datasets/{dataset_id}/documents',
-    tags: ['service_api'],
+    summary: 'List Documents',
+    tags: ['Documents'],
   })
   .input(
     z.object({
@@ -1453,21 +1537,20 @@ export const documents = {
 }
 
 /**
- * Perform hit testing on a dataset
+ * Retrieve Chunks from a Knowledge Base / Test Retrieval
  *
- * Perform hit testing on a dataset
- * Tests retrieval performance for the specified dataset.
+ * Performs a search query against a knowledge base to retrieve the most relevant chunks. This endpoint can be used for both production retrieval and test retrieval.
  */
 export const post26 = oc
   .route({
     description:
-      'Perform hit testing on a dataset\nTests retrieval performance for the specified dataset.',
+      'Performs a search query against a knowledge base to retrieve the most relevant chunks. This endpoint can be used for both production retrieval and test retrieval.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdHitTesting',
     path: '/datasets/{dataset_id}/hit-testing',
-    summary: 'Perform hit testing on a dataset',
-    tags: ['service_api'],
+    summary: 'Retrieve Chunks from a Knowledge Base / Test Retrieval',
+    tags: ['Knowledge Bases'],
   })
   .input(
     z.object({
@@ -1482,19 +1565,19 @@ export const hitTesting = {
 }
 
 /**
- * Enable or disable built-in metadata field
+ * Update Built-in Metadata Field
  *
- * Enable or disable built-in metadata field
+ * Enable or disable built-in metadata fields for the knowledge base.
  */
 export const post27 = oc
   .route({
-    description: 'Enable or disable built-in metadata field',
+    description: 'Enable or disable built-in metadata fields for the knowledge base.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdMetadataBuiltInByAction',
     path: '/datasets/{dataset_id}/metadata/built-in/{action}',
-    summary: 'Enable or disable built-in metadata field',
-    tags: ['service_api'],
+    summary: 'Update Built-in Metadata Field',
+    tags: ['Metadata'],
   })
   .input(z.object({ params: zPostDatasetsByDatasetIdMetadataBuiltInByActionPath }))
   .output(zPostDatasetsByDatasetIdMetadataBuiltInByActionResponse)
@@ -1504,19 +1587,20 @@ export const byAction3 = {
 }
 
 /**
- * Get all built-in metadata fields
+ * Get Built-in Metadata Fields
  *
- * Get all built-in metadata fields
+ * Returns the list of built-in metadata fields provided by the system (e.g., document type, source URL).
  */
 export const get15 = oc
   .route({
-    description: 'Get all built-in metadata fields',
+    description:
+      'Returns the list of built-in metadata fields provided by the system (e.g., document type, source URL).',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdMetadataBuiltIn',
     path: '/datasets/{dataset_id}/metadata/built-in',
-    summary: 'Get all built-in metadata fields',
-    tags: ['service_api'],
+    summary: 'Get Built-in Metadata Fields',
+    tags: ['Metadata'],
   })
   .input(z.object({ params: zGetDatasetsByDatasetIdMetadataBuiltInPath }))
   .output(zGetDatasetsByDatasetIdMetadataBuiltInResponse)
@@ -1527,38 +1611,39 @@ export const builtIn = {
 }
 
 /**
- * Delete metadata
+ * Delete Metadata Field
  *
- * Delete metadata
+ * Permanently delete a custom metadata field. Documents using this field will lose their metadata values for it.
  */
 export const delete7 = oc
   .route({
-    description: 'Delete metadata',
+    description:
+      'Permanently delete a custom metadata field. Documents using this field will lose their metadata values for it.',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteDatasetsByDatasetIdMetadataByMetadataId',
     path: '/datasets/{dataset_id}/metadata/{metadata_id}',
     successStatus: 204,
-    summary: 'Delete metadata',
-    tags: ['service_api'],
+    summary: 'Delete Metadata Field',
+    tags: ['Metadata'],
   })
   .input(z.object({ params: zDeleteDatasetsByDatasetIdMetadataByMetadataIdPath }))
   .output(zDeleteDatasetsByDatasetIdMetadataByMetadataIdResponse)
 
 /**
- * Update metadata name
+ * Update Metadata Field
  *
- * Update metadata name
+ * Rename a custom metadata field.
  */
 export const patch5 = oc
   .route({
-    description: 'Update metadata name',
+    description: 'Rename a custom metadata field.',
     inputStructure: 'detailed',
     method: 'PATCH',
     operationId: 'patchDatasetsByDatasetIdMetadataByMetadataId',
     path: '/datasets/{dataset_id}/metadata/{metadata_id}',
-    summary: 'Update metadata name',
-    tags: ['service_api'],
+    summary: 'Update Metadata Field',
+    tags: ['Metadata'],
   })
   .input(
     z.object({
@@ -1574,38 +1659,40 @@ export const byMetadataId = {
 }
 
 /**
- * Get all metadata for a dataset
+ * List Metadata Fields
  *
- * Get all metadata for a dataset
+ * Returns the list of all metadata fields (both custom and built-in) for the knowledge base, along with the count of documents using each field.
  */
 export const get16 = oc
   .route({
-    description: 'Get all metadata for a dataset',
+    description:
+      'Returns the list of all metadata fields (both custom and built-in) for the knowledge base, along with the count of documents using each field.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdMetadata',
     path: '/datasets/{dataset_id}/metadata',
-    summary: 'Get all metadata for a dataset',
-    tags: ['service_api'],
+    summary: 'List Metadata Fields',
+    tags: ['Metadata'],
   })
   .input(z.object({ params: zGetDatasetsByDatasetIdMetadataPath }))
   .output(zGetDatasetsByDatasetIdMetadataResponse)
 
 /**
- * Create metadata for a dataset
+ * Create Metadata Field
  *
- * Create metadata for a dataset
+ * Create a custom metadata field for the knowledge base. Metadata fields can be used to annotate documents with structured information.
  */
 export const post28 = oc
   .route({
-    description: 'Create metadata for a dataset',
+    description:
+      'Create a custom metadata field for the knowledge base. Metadata fields can be used to annotate documents with structured information.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdMetadata',
     path: '/datasets/{dataset_id}/metadata',
     successStatus: 201,
-    summary: 'Create metadata for a dataset',
-    tags: ['service_api'],
+    summary: 'Create Metadata Field',
+    tags: ['Metadata'],
   })
   .input(
     z.object({
@@ -1623,19 +1710,20 @@ export const metadata2 = {
 }
 
 /**
- * Resource for getting datasource plugins
+ * List Datasource Plugins
  *
- * List all datasource plugins for a rag pipeline
+ * List the datasource nodes configured in the knowledge pipeline. Each node includes the plugin it uses plus the metadata needed to run it.
  */
 export const get17 = oc
   .route({
-    description: 'List all datasource plugins for a rag pipeline',
+    description:
+      'List the datasource nodes configured in the knowledge pipeline. Each node includes the plugin it uses plus the metadata needed to run it.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdPipelineDatasourcePlugins',
     path: '/datasets/{dataset_id}/pipeline/datasource-plugins',
-    summary: 'Resource for getting datasource plugins',
-    tags: ['service_api'],
+    summary: 'List Datasource Plugins',
+    tags: ['Knowledge Pipeline'],
   })
   .input(
     z.object({
@@ -1650,19 +1738,20 @@ export const datasourcePlugins = {
 }
 
 /**
- * Resource for getting datasource plugins
+ * Run Datasource Node
  *
- * Run a datasource node for a rag pipeline
+ * Execute a single datasource node within the knowledge pipeline. Returns a streaming response with the node execution results.
  */
 export const post29 = oc
   .route({
-    description: 'Run a datasource node for a rag pipeline',
+    description:
+      'Execute a single datasource node within the knowledge pipeline. Returns a streaming response with the node execution results.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdPipelineDatasourceNodesByNodeIdRun',
     path: '/datasets/{dataset_id}/pipeline/datasource/nodes/{node_id}/run',
-    summary: 'Resource for getting datasource plugins',
-    tags: ['service_api'],
+    summary: 'Run Datasource Node',
+    tags: ['Knowledge Pipeline'],
   })
   .input(
     z.object({
@@ -1689,19 +1778,20 @@ export const datasource = {
 }
 
 /**
- * Resource for running a rag pipeline
+ * Run Pipeline
  *
- * Run a datasource node for a rag pipeline
+ * Execute the full knowledge pipeline for a knowledge base. Supports both streaming and blocking response modes.
  */
 export const post30 = oc
   .route({
-    description: 'Run a datasource node for a rag pipeline',
+    description:
+      'Execute the full knowledge pipeline for a knowledge base. Supports both streaming and blocking response modes.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdPipelineRun',
     path: '/datasets/{dataset_id}/pipeline/run',
-    summary: 'Resource for running a rag pipeline',
-    tags: ['service_api'],
+    summary: 'Run Pipeline',
+    tags: ['Knowledge Pipeline'],
   })
   .input(
     z.object({
@@ -1722,21 +1812,20 @@ export const pipeline2 = {
 }
 
 /**
- * Perform hit testing on a dataset
+ * Retrieve Chunks from a Knowledge Base / Test Retrieval
  *
- * Perform hit testing on a dataset
- * Tests retrieval performance for the specified dataset.
+ * Performs a search query against a knowledge base to retrieve the most relevant chunks. This endpoint can be used for both production retrieval and test retrieval.
  */
 export const post31 = oc
   .route({
     description:
-      'Perform hit testing on a dataset\nTests retrieval performance for the specified dataset.',
+      'Performs a search query against a knowledge base to retrieve the most relevant chunks. This endpoint can be used for both production retrieval and test retrieval.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasetsByDatasetIdRetrieve',
     path: '/datasets/{dataset_id}/retrieve',
-    summary: 'Perform hit testing on a dataset',
-    tags: ['service_api'],
+    summary: 'Retrieve Chunks from a Knowledge Base / Test Retrieval',
+    tags: ['Knowledge Bases'],
   })
   .input(
     z.object({
@@ -1751,19 +1840,19 @@ export const retrieve = {
 }
 
 /**
- * Get all knowledge type tags
+ * Get Knowledge Base Tags
  *
- * Get tags bound to a specific dataset
+ * Returns the list of tags bound to a specific knowledge base.
  */
 export const get18 = oc
   .route({
-    description: 'Get tags bound to a specific dataset',
+    description: 'Returns the list of tags bound to a specific knowledge base.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetIdTags',
     path: '/datasets/{dataset_id}/tags',
-    summary: 'Get all knowledge type tags',
-    tags: ['service_api'],
+    summary: 'Get Knowledge Base Tags',
+    tags: ['Tags'],
   })
   .input(z.object({ params: zGetDatasetsByDatasetIdTagsPath }))
   .output(zGetDatasetsByDatasetIdTagsResponse)
@@ -1773,62 +1862,59 @@ export const tags2 = {
 }
 
 /**
- * Deletes a dataset given its ID
+ * Delete Knowledge Base
  *
- * Delete a dataset
- * Args:
- * _: ignore
- * dataset_id (UUID): The ID of the dataset to be deleted.
- *
- * Returns:
- * dict: A dictionary with a key 'result' and a value 'success'
- * if the dataset was successfully deleted. Omitted in HTTP response.
- * int: HTTP status code 204 indicating that the operation was successful.
- *
- * Raises:
- * NotFound: If the dataset with the given ID does not exist.
+ * Permanently delete a knowledge base and all its documents. The knowledge base must not be in use by any application.
  */
 export const delete8 = oc
   .route({
     description:
-      'Delete a dataset\nArgs:\n    _: ignore\n    dataset_id (UUID): The ID of the dataset to be deleted.\n\nReturns:\n    dict: A dictionary with a key \'result\' and a value \'success\'\n          if the dataset was successfully deleted. Omitted in HTTP response.\n    int: HTTP status code 204 indicating that the operation was successful.\n\nRaises:\n    NotFound: If the dataset with the given ID does not exist.',
+      'Permanently delete a knowledge base and all its documents. The knowledge base must not be in use by any application.',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteDatasetsByDatasetId',
     path: '/datasets/{dataset_id}',
     successStatus: 204,
-    summary: 'Deletes a dataset given its ID',
-    tags: ['service_api'],
+    summary: 'Delete Knowledge Base',
+    tags: ['Knowledge Bases'],
   })
   .input(z.object({ params: zDeleteDatasetsByDatasetIdPath }))
   .output(zDeleteDatasetsByDatasetIdResponse)
 
 /**
- * Get a specific dataset by ID
+ * Get Knowledge Base
+ *
+ * Retrieve detailed information about a specific knowledge base, including its embedding model, retrieval configuration, and document statistics.
  */
 export const get19 = oc
   .route({
-    description: 'Get a specific dataset by ID',
+    description:
+      'Retrieve detailed information about a specific knowledge base, including its embedding model, retrieval configuration, and document statistics.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasetsByDatasetId',
     path: '/datasets/{dataset_id}',
-    tags: ['service_api'],
+    summary: 'Get Knowledge Base',
+    tags: ['Knowledge Bases'],
   })
   .input(z.object({ params: zGetDatasetsByDatasetIdPath }))
   .output(zGetDatasetsByDatasetIdResponse)
 
 /**
- * Update an existing dataset
+ * Update Knowledge Base
+ *
+ * Update the name, description, permissions, or retrieval settings of an existing knowledge base. Only the fields provided in the request body are updated.
  */
 export const patch6 = oc
   .route({
-    description: 'Update an existing dataset',
+    description:
+      'Update the name, description, permissions, or retrieval settings of an existing knowledge base. Only the fields provided in the request body are updated.',
     inputStructure: 'detailed',
     method: 'PATCH',
     operationId: 'patchDatasetsByDatasetId',
     path: '/datasets/{dataset_id}',
-    tags: ['service_api'],
+    summary: 'Update Knowledge Base',
+    tags: ['Knowledge Bases'],
   })
   .input(z.object({ body: zPatchDatasetsByDatasetIdBody, params: zPatchDatasetsByDatasetIdPath }))
   .output(zPatchDatasetsByDatasetIdResponse)
@@ -1847,37 +1933,39 @@ export const byDatasetId = {
 }
 
 /**
- * Resource for getting datasets
+ * List Knowledge Bases
  *
- * List all datasets
+ * Returns a paginated list of knowledge bases. Supports filtering by keyword and tags.
  */
 export const get20 = oc
   .route({
-    description: 'List all datasets',
+    description:
+      'Returns a paginated list of knowledge bases. Supports filtering by keyword and tags.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getDatasets',
     path: '/datasets',
-    summary: 'Resource for getting datasets',
-    tags: ['service_api'],
+    summary: 'List Knowledge Bases',
+    tags: ['Knowledge Bases'],
   })
   .input(z.object({ query: zGetDatasetsQuery.optional() }))
   .output(zGetDatasetsResponse)
 
 /**
- * Resource for creating datasets
+ * Create an Empty Knowledge Base
  *
- * Create a new dataset
+ * Create a new empty knowledge base. After creation, use [Create Document by Text](/api-reference/documents/create-document-by-text) or [Create Document by File](/api-reference/documents/create-document-by-file) to add documents.
  */
 export const post32 = oc
   .route({
-    description: 'Create a new dataset',
+    description:
+      'Create a new empty knowledge base. After creation, use [Create Document by Text](/api-reference/documents/create-document-by-text) or [Create Document by File](/api-reference/documents/create-document-by-file) to add documents.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postDatasets',
     path: '/datasets',
-    summary: 'Resource for creating datasets',
-    tags: ['service_api'],
+    summary: 'Create an Empty Knowledge Base',
+    tags: ['Knowledge Bases'],
   })
   .input(z.object({ body: zPostDatasetsBody }))
   .output(zPostDatasetsResponse)
@@ -1891,22 +1979,20 @@ export const datasets = {
 }
 
 /**
- * Get end user detail
+ * Get End User Info
  *
- * Get an end user by ID
- * This endpoint is scoped to the current app token's tenant/app to prevent
- * cross-tenant/app access when an end-user ID is known.
+ * Retrieve an end user by ID. Useful when other APIs return an end-user ID (e.g., `created_by` from [Upload File](/api-reference/files/upload-file)).
  */
 export const get21 = oc
   .route({
     description:
-      'Get an end user by ID\nThis endpoint is scoped to the current app token\'s tenant/app to prevent\ncross-tenant/app access when an end-user ID is known.',
+      'Retrieve an end user by ID. Useful when other APIs return an end-user ID (e.g., `created_by` from [Upload File](/api-reference/files/upload-file)).',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getEndUsersByEndUserId',
     path: '/end-users/{end_user_id}',
-    summary: 'Get end user detail',
-    tags: ['service_api'],
+    summary: 'Get End User Info',
+    tags: ['End Users'],
   })
   .input(z.object({ params: zGetEndUsersByEndUserIdPath }))
   .output(zGetEndUsersByEndUserIdResponse)
@@ -1920,23 +2006,23 @@ export const endUsers = {
 }
 
 /**
- * Upload a file for use in conversations
+ * Upload File
  *
- * Upload a file for use in conversations
- * Accepts a single file upload via multipart/form-data.
+ * Upload a file for use when sending messages, enabling multimodal understanding of images, documents, audio, and video. Uploaded files are for use by the current end-user only.
  */
 export const post33 = oc
   .route({
     description:
-      'Upload a file for use in conversations\nAccepts a single file upload via multipart/form-data.',
+      'Upload a file for use when sending messages, enabling multimodal understanding of images, documents, audio, and video. Uploaded files are for use by the current end-user only.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postFilesUpload',
     path: '/files/upload',
     successStatus: 201,
-    summary: 'Upload a file for use in conversations',
-    tags: ['service_api'],
+    summary: 'Upload File',
+    tags: ['Files'],
   })
+  .input(z.object({ body: zPostFilesUploadBody }))
   .output(zPostFilesUploadResponse)
 
 export const upload = {
@@ -1944,22 +2030,20 @@ export const upload = {
 }
 
 /**
- * Preview/Download a file that was uploaded via Service API
+ * Download File
  *
- * Preview or download a file uploaded via Service API
- * Provides secure file preview/download functionality.
- * Files can only be accessed if they belong to messages within the requesting app's context.
+ * Preview or download uploaded files previously uploaded via the [Upload File](/api-reference/files/upload-file) API. Files can only be accessed if they belong to messages within the requesting application.
  */
 export const get22 = oc
   .route({
     description:
-      'Preview or download a file uploaded via Service API\nProvides secure file preview/download functionality.\nFiles can only be accessed if they belong to messages within the requesting app\'s context.',
+      'Preview or download uploaded files previously uploaded via the [Upload File](/api-reference/files/upload-file) API. Files can only be accessed if they belong to messages within the requesting application.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getFilesByFileIdPreview',
     path: '/files/{file_id}/preview',
-    summary: 'Preview/Download a file that was uploaded via Service API',
-    tags: ['service_api'],
+    summary: 'Download File',
+    tags: ['Files'],
   })
   .input(
     z.object({
@@ -1983,31 +2067,39 @@ export const files = {
 }
 
 /**
- * Get a paused human input form by token
+ * Get Human Input Form
+ *
+ * Retrieve a paused Human Input form's contents using the `form_token` from a `human_input_required` event. Requires **WebApp** delivery.
  */
 export const get23 = oc
   .route({
-    description: 'Get a paused human input form by token',
+    description:
+      'Retrieve a paused Human Input form\'s contents using the `form_token` from a `human_input_required` event. Requires **WebApp** delivery.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getFormHumanInputByFormToken',
     path: '/form/human_input/{form_token}',
-    tags: ['service_api'],
+    summary: 'Get Human Input Form',
+    tags: ['Human Input'],
   })
   .input(z.object({ params: zGetFormHumanInputByFormTokenPath }))
   .output(zGetFormHumanInputByFormTokenResponse)
 
 /**
- * Submit a paused human input form by token
+ * Submit Human Input Form
+ *
+ * Submit the recipient's response to a paused Human Input form. The workflow resumes on acceptance; use [Stream Workflow Events](/api-reference/chatflows/stream-workflow-events) to follow subsequent events. Requires **WebApp** delivery.
  */
 export const post34 = oc
   .route({
-    description: 'Submit a paused human input form by token',
+    description:
+      'Submit the recipient\'s response to a paused Human Input form. The workflow resumes on acceptance; use [Stream Workflow Events](/api-reference/chatflows/stream-workflow-events) to follow subsequent events. Requires **WebApp** delivery.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postFormHumanInputByFormToken',
     path: '/form/human_input/{form_token}',
-    tags: ['service_api'],
+    summary: 'Submit Human Input Form',
+    tags: ['Human Input'],
   })
   .input(
     z.object({
@@ -2031,21 +2123,20 @@ export const form = {
 }
 
 /**
- * Get app information
+ * Get App Info
  *
- * Get basic application information
- * Returns basic information about the application including name, description, tags, and mode.
+ * Retrieve basic information about this application, including name, description, tags, and mode.
  */
 export const get24 = oc
   .route({
     description:
-      'Get basic application information\nReturns basic information about the application including name, description, tags, and mode.',
+      'Retrieve basic information about this application, including name, description, tags, and mode.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getInfo',
     path: '/info',
-    summary: 'Get app information',
-    tags: ['service_api'],
+    summary: 'Get App Info',
+    tags: ['Applications'],
   })
   .output(zGetInfoResponse)
 
@@ -2054,21 +2145,20 @@ export const info = {
 }
 
 /**
- * Submit feedback for a message
+ * Submit Message Feedback
  *
- * Submit feedback for a message
- * Allows users to rate messages as like/dislike and provide optional feedback content.
+ * Submit feedback for a message. End users can rate messages as `like` or `dislike`, and optionally provide text feedback. Pass `null` for `rating` to revoke previously submitted feedback.
  */
 export const post35 = oc
   .route({
     description:
-      'Submit feedback for a message\nAllows users to rate messages as like/dislike and provide optional feedback content.',
+      'Submit feedback for a message. End users can rate messages as `like` or `dislike`, and optionally provide text feedback. Pass `null` for `rating` to revoke previously submitted feedback.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postMessagesByMessageIdFeedbacks',
     path: '/messages/{message_id}/feedbacks',
-    summary: 'Submit feedback for a message',
-    tags: ['service_api'],
+    summary: 'Submit Message Feedback',
+    tags: ['Feedback'],
   })
   .input(
     z.object({
@@ -2083,23 +2173,26 @@ export const feedbacks2 = {
 }
 
 /**
- * Get suggested follow-up questions for a message
+ * Get Next Suggested Questions
  *
- * Get suggested follow-up questions for a message
- * Returns AI-generated follow-up questions based on the message content.
+ * Get next questions suggestions for the current message.
  */
 export const get25 = oc
   .route({
-    description:
-      'Get suggested follow-up questions for a message\nReturns AI-generated follow-up questions based on the message content.',
+    description: 'Get next questions suggestions for the current message.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getMessagesByMessageIdSuggested',
     path: '/messages/{message_id}/suggested',
-    summary: 'Get suggested follow-up questions for a message',
-    tags: ['service_api'],
+    summary: 'Get Next Suggested Questions',
+    tags: ['Chatflows', 'Chats'],
   })
-  .input(z.object({ params: zGetMessagesByMessageIdSuggestedPath }))
+  .input(
+    z.object({
+      params: zGetMessagesByMessageIdSuggestedPath,
+      query: zGetMessagesByMessageIdSuggestedQuery,
+    }),
+  )
   .output(zGetMessagesByMessageIdSuggestedResponse)
 
 export const suggested = {
@@ -2112,21 +2205,20 @@ export const byMessageId = {
 }
 
 /**
- * List messages in a conversation
+ * List Conversation Messages
  *
- * List messages in a conversation
- * Retrieves messages with pagination support using first_id.
+ * Returns historical chat records in a scrolling load format, with the first page returning the latest `limit` messages, i.e., in reverse order.
  */
 export const get26 = oc
   .route({
     description:
-      'List messages in a conversation\nRetrieves messages with pagination support using first_id.',
+      'Returns historical chat records in a scrolling load format, with the first page returning the latest `limit` messages, i.e., in reverse order.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getMessages',
     path: '/messages',
-    summary: 'List messages in a conversation',
-    tags: ['service_api'],
+    summary: 'List Conversation Messages',
+    tags: ['Conversations'],
   })
   .input(z.object({ query: zGetMessagesQuery }))
   .output(zGetMessagesResponse)
@@ -2137,21 +2229,20 @@ export const messages = {
 }
 
 /**
- * Get app metadata
+ * Get App Meta
  *
- * Get application metadata
- * Returns metadata about the application including configuration and settings.
+ * Retrieve metadata about this application, including tool icons and other configuration details.
  */
 export const get27 = oc
   .route({
     description:
-      'Get application metadata\nReturns metadata about the application including configuration and settings.',
+      'Retrieve metadata about this application, including tool icons and other configuration details.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getMeta',
     path: '/meta',
-    summary: 'Get app metadata',
-    tags: ['service_api'],
+    summary: 'Get App Meta',
+    tags: ['Applications'],
   })
   .output(zGetMetaResponse)
 
@@ -2160,21 +2251,20 @@ export const meta = {
 }
 
 /**
- * Retrieve app parameters
+ * Get App Parameters
  *
- * Retrieve application input parameters and configuration
- * Returns the input form parameters and configuration for the application.
+ * Retrieve the application's input form configuration, including feature switches, input parameter names, types, and default values.
  */
 export const get28 = oc
   .route({
     description:
-      'Retrieve application input parameters and configuration\nReturns the input form parameters and configuration for the application.',
+      'Retrieve the application\'s input form configuration, including feature switches, input parameter names, types, and default values.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getParameters',
     path: '/parameters',
-    summary: 'Retrieve app parameters',
-    tags: ['service_api'],
+    summary: 'Get App Parameters',
+    tags: ['Applications'],
   })
   .output(zGetParametersResponse)
 
@@ -2183,21 +2273,20 @@ export const parameters = {
 }
 
 /**
- * Retrieve app site info
+ * Get App WebApp Settings
  *
- * Get application site configuration
- * Returns the site configuration for the application including theme, icons, and text.
+ * Retrieve the WebApp settings of this application, including site configuration, theme, and customization options.
  */
 export const get29 = oc
   .route({
     description:
-      'Get application site configuration\nReturns the site configuration for the application including theme, icons, and text.',
+      'Retrieve the WebApp settings of this application, including site configuration, theme, and customization options.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getSite',
     path: '/site',
-    summary: 'Retrieve app site info',
-    tags: ['service_api'],
+    summary: 'Get App WebApp Settings',
+    tags: ['Applications'],
   })
   .output(zGetSiteResponse)
 
@@ -2206,21 +2295,19 @@ export const site = {
 }
 
 /**
- * Convert text to audio using text-to-speech
+ * Convert Text to Audio
  *
- * Convert text to audio using text-to-speech
- * Converts the provided text to audio using the specified voice.
+ * Convert text to speech.
  */
 export const post36 = oc
   .route({
-    description:
-      'Convert text to audio using text-to-speech\nConverts the provided text to audio using the specified voice.',
+    description: 'Convert text to speech.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postTextToAudio',
     path: '/text-to-audio',
-    summary: 'Convert text to audio using text-to-speech',
-    tags: ['service_api'],
+    summary: 'Convert Text to Audio',
+    tags: ['TTS'],
   })
   .input(z.object({ body: zPostTextToAudioBody }))
   .output(zPostTextToAudioResponse)
@@ -2230,16 +2317,20 @@ export const textToAudio = {
 }
 
 /**
- * Get workflow execution events stream after resume
+ * Stream Workflow Events
+ *
+ * Resume the Server-Sent Events stream for a workflow run after a pause or a dropped SSE connection. For runs that have already finished, the stream emits a single `workflow_finished` event and closes.
  */
 export const get30 = oc
   .route({
-    description: 'Get workflow execution events stream after resume',
+    description:
+      'Resume the Server-Sent Events stream for a workflow run after a pause or a dropped SSE connection. For runs that have already finished, the stream emits a single `workflow_finished` event and closes.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getWorkflowByTaskIdEvents',
     path: '/workflow/{task_id}/events',
-    tags: ['service_api'],
+    summary: 'Stream Workflow Events',
+    tags: ['Chatflows', 'Workflows'],
   })
   .input(
     z.object({ params: zGetWorkflowByTaskIdEventsPath, query: zGetWorkflowByTaskIdEventsQuery }),
@@ -2259,21 +2350,19 @@ export const workflow = {
 }
 
 /**
- * Get workflow app logs
+ * List Workflow Logs
  *
- * Get workflow execution logs
- * Returns paginated workflow execution logs with filtering options.
+ * Retrieve paginated workflow execution logs with filtering options.
  */
 export const get31 = oc
   .route({
-    description:
-      'Get workflow execution logs\nReturns paginated workflow execution logs with filtering options.',
+    description: 'Retrieve paginated workflow execution logs with filtering options.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getWorkflowsLogs',
     path: '/workflows/logs',
-    summary: 'Get workflow app logs',
-    tags: ['service_api'],
+    summary: 'List Workflow Logs',
+    tags: ['Chatflows', 'Workflows'],
   })
   .input(z.object({ query: zGetWorkflowsLogsQuery.optional() }))
   .output(zGetWorkflowsLogsResponse)
@@ -2283,21 +2372,20 @@ export const logs = {
 }
 
 /**
- * Get a workflow task running detail
+ * Get Workflow Run Detail
  *
- * Get workflow run details
- * Returns detailed information about a specific workflow run.
+ * Retrieve the current execution results of a workflow task based on the workflow execution ID.
  */
 export const get32 = oc
   .route({
     description:
-      'Get workflow run details\nReturns detailed information about a specific workflow run.',
+      'Retrieve the current execution results of a workflow task based on the workflow execution ID.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getWorkflowsRunByWorkflowRunId',
     path: '/workflows/run/{workflow_run_id}',
-    summary: 'Get a workflow task running detail',
-    tags: ['service_api'],
+    summary: 'Get Workflow Run Detail',
+    tags: ['Chatflows', 'Workflows'],
   })
   .input(z.object({ params: zGetWorkflowsRunByWorkflowRunIdPath }))
   .output(zGetWorkflowsRunByWorkflowRunIdResponse)
@@ -2307,22 +2395,19 @@ export const byWorkflowRunId = {
 }
 
 /**
- * Execute a workflow
+ * Run Workflow
  *
- * Execute a workflow
- * Runs a workflow with the provided inputs and returns the results.
- * Supports both blocking and streaming response modes.
+ * Execute a workflow. Cannot be executed without a published workflow.
  */
 export const post37 = oc
   .route({
-    description:
-      'Execute a workflow\nRuns a workflow with the provided inputs and returns the results.\nSupports both blocking and streaming response modes.',
+    description: 'Execute a workflow. Cannot be executed without a published workflow.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postWorkflowsRun',
     path: '/workflows/run',
-    summary: 'Execute a workflow',
-    tags: ['service_api'],
+    summary: 'Run Workflow',
+    tags: ['Workflows'],
   })
   .input(z.object({ body: zPostWorkflowsRunBody }))
   .output(zPostWorkflowsRunResponse)
@@ -2333,21 +2418,26 @@ export const run3 = {
 }
 
 /**
- * Stop a running workflow task
+ * Stop Workflow Task
  *
- * Stop a running workflow task
+ * Stop a running workflow task. Only supported in `streaming` mode.
  */
 export const post38 = oc
   .route({
-    description: 'Stop a running workflow task',
+    description: 'Stop a running workflow task. Only supported in `streaming` mode.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postWorkflowsTasksByTaskIdStop',
     path: '/workflows/tasks/{task_id}/stop',
-    summary: 'Stop a running workflow task',
-    tags: ['service_api'],
+    summary: 'Stop Workflow Task',
+    tags: ['Workflows'],
   })
-  .input(z.object({ params: zPostWorkflowsTasksByTaskIdStopPath }))
+  .input(
+    z.object({
+      body: zPostWorkflowsTasksByTaskIdStopBody,
+      params: zPostWorkflowsTasksByTaskIdStopPath,
+    }),
+  )
   .output(zPostWorkflowsTasksByTaskIdStopResponse)
 
 export const stop3 = {
@@ -2363,21 +2453,20 @@ export const tasks = {
 }
 
 /**
- * Run specific workflow by ID
+ * Run Workflow by ID
  *
- * Execute a specific workflow by ID
- * Executes a specific workflow version identified by its ID.
+ * Execute a specific workflow version identified by its ID. Useful for running a particular published version of the workflow.
  */
 export const post39 = oc
   .route({
     description:
-      'Execute a specific workflow by ID\nExecutes a specific workflow version identified by its ID.',
+      'Execute a specific workflow version identified by its ID. Useful for running a particular published version of the workflow.',
     inputStructure: 'detailed',
     method: 'POST',
     operationId: 'postWorkflowsByWorkflowIdRun',
     path: '/workflows/{workflow_id}/run',
-    summary: 'Run specific workflow by ID',
-    tags: ['service_api'],
+    summary: 'Run Workflow by ID',
+    tags: ['Workflows'],
   })
   .input(
     z.object({
@@ -2403,21 +2492,20 @@ export const workflows = {
 }
 
 /**
- * Get available models by model type
+ * Get Available Models
  *
- * Get available models by model type
- * Returns a list of available models for the specified model type.
+ * Retrieve the list of available models by type. Primarily used to query `text-embedding` and `rerank` models for knowledge base configuration.
  */
 export const get33 = oc
   .route({
     description:
-      'Get available models by model type\nReturns a list of available models for the specified model type.',
+      'Retrieve the list of available models by type. Primarily used to query `text-embedding` and `rerank` models for knowledge base configuration.',
     inputStructure: 'detailed',
     method: 'GET',
     operationId: 'getWorkspacesCurrentModelsModelTypesByModelType',
     path: '/workspaces/current/models/model-types/{model_type}',
-    summary: 'Get available models by model type',
-    tags: ['service_api'],
+    summary: 'Get Available Models',
+    tags: ['Models'],
   })
   .input(z.object({ params: zGetWorkspacesCurrentModelsModelTypesByModelTypePath }))
   .output(zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse)
diff --git a/packages/contracts/generated/api/service/types.gen.ts b/packages/contracts/generated/api/service/types.gen.ts
index a3cea1127da..97921643514 100644
--- a/packages/contracts/generated/api/service/types.gen.ts
+++ b/packages/contracts/generated/api/service/types.gen.ts
@@ -103,15 +103,34 @@ export type ChatRequestPayload = {
   auto_generate_name?: boolean
   conversation_id?: string | null
   files?: Array<{
-    [key: string]: unknown
+    transfer_method: 'local_file' | 'remote_url'
+    type: 'audio' | 'custom' | 'document' | 'image' | 'video'
+    upload_file_id?: string
+    url?: string
   }> | null
   inputs: {
     [key: string]: unknown
   }
   query: string
   response_mode?: 'blocking' | 'streaming' | null
-  retriever_from?: string
-  trace_session_id?: string | null
+  workflow_id?: string | null
+}
+
+export type ChatRequestPayloadWithUser = {
+  auto_generate_name?: boolean
+  conversation_id?: string | null
+  files?: Array<{
+    transfer_method: 'local_file' | 'remote_url'
+    type: 'audio' | 'custom' | 'document' | 'image' | 'video'
+    upload_file_id?: string
+    url?: string
+  }> | null
+  inputs: {
+    [key: string]: unknown
+  }
+  query: string
+  response_mode?: 'blocking' | 'streaming' | null
+  user: string
   workflow_id?: string | null
 }
 
@@ -154,15 +173,31 @@ export type ChildChunkUpdatePayload = {
 
 export type CompletionRequestPayload = {
   files?: Array<{
-    [key: string]: unknown
+    transfer_method: 'local_file' | 'remote_url'
+    type: 'audio' | 'custom' | 'document' | 'image' | 'video'
+    upload_file_id?: string
+    url?: string
   }> | null
   inputs: {
     [key: string]: unknown
   }
   query?: string
   response_mode?: 'blocking' | 'streaming' | null
-  retriever_from?: string
-  trace_session_id?: string | null
+}
+
+export type CompletionRequestPayloadWithUser = {
+  files?: Array<{
+    transfer_method: 'local_file' | 'remote_url'
+    type: 'audio' | 'custom' | 'document' | 'image' | 'video'
+    upload_file_id?: string
+    url?: string
+  }> | null
+  inputs: {
+    [key: string]: unknown
+  }
+  query?: string
+  response_mode?: 'blocking' | 'streaming' | null
+  user: string
 }
 
 export type Condition = {
@@ -186,7 +221,7 @@ export type Condition = {
     | '≤'
     | '≥'
   name: string
-  value?: string | Array<string> | number | number | null
+  value?: string | Array<string> | number | null
 }
 
 export type ConversationInfiniteScrollPagination = {
@@ -201,11 +236,37 @@ export type ConversationListQuery = {
   sort_by?: '-created_at' | '-updated_at' | 'created_at' | 'updated_at'
 }
 
-export type ConversationRenamePayload = {
+export type ConversationRenamePayload = (
+  | {
+    auto_generate: true
+    name?: string | null
+  }
+  | {
+    auto_generate?: false
+    name: string
+  }
+) & {
   auto_generate?: boolean
   name?: string | null
 }
 
+export type ConversationRenamePayloadWithUser = (
+  | {
+    auto_generate: true
+    name?: string | null
+    user?: string
+  }
+  | {
+    auto_generate?: false
+    name: string
+    user?: string
+  }
+) & {
+  auto_generate?: boolean
+  name?: string | null
+  user?: string
+}
+
 export type ConversationVariableInfiniteScrollPaginationResponse = {
   data: Array<ConversationVariableResponse>
   has_more: boolean
@@ -226,6 +287,11 @@ export type ConversationVariableUpdatePayload = {
   value: unknown
 }
 
+export type ConversationVariableUpdatePayloadWithUser = {
+  user?: string
+  value: unknown
+}
+
 export type ConversationVariablesQuery = {
   last_id?: string | null
   limit?: number
@@ -253,10 +319,13 @@ export type DatasetCreatePayload = {
   indexing_technique?: 'economy' | 'high_quality' | null
   name: string
   permission?: PermissionEnum | null
-  provider?: string
+  provider?: 'external' | 'vendor'
   retrieval_model?: RetrievalModel | null
   summary_index_setting?: {
-    [key: string]: unknown
+    enable?: boolean
+    model_name?: string
+    model_provider_name?: string
+    summary_prompt?: string
   } | null
 }
 
@@ -283,8 +352,10 @@ export type DatasetDetailResponse = {
   indexing_technique: string | null
   is_multimodal: boolean
   is_published: boolean
+  maintainer?: string | null
   name: string
   permission: string
+  permission_keys?: Array<string>
   pipeline_id: string | null
   provider: string
   retrieval_model_dict: DatasetRetrievalModelResponse
@@ -321,9 +392,11 @@ export type DatasetDetailWithPartialMembersResponse = {
   indexing_technique: string | null
   is_multimodal: boolean
   is_published: boolean
+  maintainer?: string | null
   name: string
   partial_member_list?: Array<string> | null
   permission: string
+  permission_keys?: Array<string>
   pipeline_id: string | null
   provider: string
   retrieval_model_dict: DatasetRetrievalModelResponse
@@ -450,12 +523,14 @@ export type DatasetUpdatePayload = {
   external_knowledge_api_id?: string | null
   external_knowledge_id?: string | null
   external_retrieval_model?: {
-    [key: string]: unknown
+    score_threshold?: number
+    score_threshold_enabled?: boolean
+    top_k?: number
   } | null
   indexing_technique?: 'economy' | 'high_quality' | null
   name?: string | null
   partial_member_list?: Array<{
-    [key: string]: string
+    user_id?: string
   }> | null
   permission?: PermissionEnum | null
   retrieval_model?: RetrievalModel | null
@@ -482,7 +557,7 @@ export type DatasourceCredentialInfoResponse = {
 
 export type DatasourceNodeRunPayload = {
   credential_id?: string | null
-  datasource_type: string
+  datasource_type: 'local_file' | 'online_document' | 'online_drive' | 'website_crawl'
   inputs: {
     [key: string]: unknown
   }
@@ -564,7 +639,15 @@ export type DocumentListQuery = {
   keyword?: string | null
   limit?: number
   page?: number
-  status?: string | null
+  status?:
+    | 'archived'
+    | 'available'
+    | 'disabled'
+    | 'error'
+    | 'indexing'
+    | 'paused'
+    | 'queuing'
+    | null
 }
 
 export type DocumentListResponse = {
@@ -639,11 +722,11 @@ export type DocumentStatusResponse = {
 }
 
 export type DocumentTextCreatePayload = {
-  doc_form?: string
+  doc_form?: 'hierarchical_model' | 'qa_model' | 'text_model'
   doc_language?: string
   embedding_model?: string | null
   embedding_model_provider?: string | null
-  indexing_technique?: string | null
+  indexing_technique?: 'economy' | 'high_quality' | null
   name: string
   original_document_id?: string | null
   process_rule?: ProcessRule | null
@@ -651,8 +734,25 @@ export type DocumentTextCreatePayload = {
   text: string
 }
 
-export type DocumentTextUpdate = {
-  doc_form?: string
+export type DocumentTextUpdate = (
+  | {
+    doc_form?: 'hierarchical_model' | 'qa_model' | 'text_model'
+    doc_language?: string
+    name: string
+    process_rule?: ProcessRule | null
+    retrieval_model?: RetrievalModel | null
+    text: string
+  }
+  | {
+    doc_form?: 'hierarchical_model' | 'qa_model' | 'text_model'
+    doc_language?: string
+    name?: string | null
+    process_rule?: ProcessRule | null
+    retrieval_model?: RetrievalModel | null
+    text?: null
+  }
+) & {
+  doc_form?: 'hierarchical_model' | 'qa_model' | 'text_model'
   doc_language?: string
   name?: string | null
   process_rule?: ProcessRule | null
@@ -770,7 +870,9 @@ export type HitTestingFile = {
 export type HitTestingPayload = {
   attachment_ids?: Array<string> | null
   external_retrieval_model?: {
-    [key: string]: unknown
+    score_threshold?: number
+    score_threshold_enabled?: boolean
+    top_k?: number
   } | null
   query: string
   retrieval_model?: RetrievalModel | null
@@ -875,6 +977,14 @@ export type HumanInputFormSubmitPayload = {
   }
 }
 
+export type HumanInputFormSubmitPayloadWithUser = {
+  action: string
+  inputs: {
+    [key: string]: JsonValue2
+  }
+  user: string
+}
+
 export type HumanInputFormSubmitResponse = {
   [key: string]: never
 }
@@ -923,6 +1033,12 @@ export type MessageFeedbackPayload = {
   rating?: 'dislike' | 'like' | null
 }
 
+export type MessageFeedbackPayloadWithUser = {
+  content?: string | null
+  rating?: 'dislike' | 'like' | null
+  user: string
+}
+
 export type MessageFile = {
   belongs_to?: string | null
   filename: string
@@ -1025,6 +1141,10 @@ export type ModelStatus
 
 export type ModelType = 'llm' | 'moderation' | 'rerank' | 'speech2text' | 'text-embedding' | 'tts'
 
+export type OptionalServiceApiUserPayload = {
+  user?: string
+}
+
 export type ParagraphInputConfig = {
   default?: StringSource | null
   output_variable_name: string
@@ -1049,15 +1169,37 @@ export type Parameters = {
 export type PermissionEnum = 'all_team_members' | 'only_me' | 'partial_members'
 
 export type PipelineRunApiEntity = {
-  datasource_info_list: Array<{
-    [key: string]: unknown
-  }>
-  datasource_type: string
+  datasource_info_list: Array<
+    | {
+      name?: string
+      reference: string
+    }
+    | {
+      credential_id?: string
+      page: {
+        page_id: string
+        page_name?: string
+        type: string
+      }
+      workspace_id: string
+    }
+    | {
+      title?: string
+      url: string
+    }
+    | {
+      bucket?: string
+      id: string
+      name?: string
+      type: 'file' | 'folder'
+    }
+  >
+  datasource_type: 'local_file' | 'online_document' | 'online_drive' | 'website_crawl'
   inputs: {
     [key: string]: unknown
   }
   is_published: boolean
-  response_mode: string
+  response_mode: 'blocking' | 'streaming'
   start_node_id: string
 }
 
@@ -1073,7 +1215,7 @@ export type PipelineUploadFileResponse = {
 
 export type PreProcessingRule = {
   enabled: boolean
-  id: string
+  id: 'remove_extra_spaces' | 'remove_stopwords' | 'remove_urls_emails'
 }
 
 export type ProcessRule = {
@@ -1112,6 +1254,10 @@ export type ProviderWithModelsResponse = {
   tenant_id: string
 }
 
+export type RequiredServiceApiUserPayload = {
+  user: string
+}
+
 export type RerankingModel = {
   reranking_model_name?: string | null
   reranking_provider_name?: string | null
@@ -1130,7 +1276,7 @@ export type RetrievalMethod
 export type RetrievalModel = {
   metadata_filtering_conditions?: MetadataFilteringCondition | null
   reranking_enable: boolean
-  reranking_mode?: string | null
+  reranking_mode?: 'reranking_model' | 'weighted_score' | null
   reranking_model?: RerankingModel | null
   score_threshold?: number | null
   score_threshold_enabled: boolean
@@ -1356,11 +1502,17 @@ export type TagDeletePayload = {
   tag_id: string
 }
 
-export type TagUnbindingPayload = {
-  tag_id?: string | null
-  tag_ids?: Array<string>
-  target_id: string
-}
+export type TagUnbindingPayload
+  = | {
+    tag_id: string
+    tag_ids?: Array<string>
+    target_id: string
+  }
+  | {
+    tag_id?: string
+    tag_ids: Array<string>
+    target_id: string
+  }
 
 export type TagUpdatePayload = {
   name: string
@@ -1374,6 +1526,14 @@ export type TextToAudioPayload = {
   voice?: string | null
 }
 
+export type TextToAudioPayloadWithUser = {
+  message_id?: string | null
+  streaming?: boolean | null
+  text?: string | null
+  user?: string
+  voice?: string | null
+}
+
 export type UrlResponse = {
   url: string
 }
@@ -1463,13 +1623,29 @@ export type WorkflowRunForLogResponse = {
 
 export type WorkflowRunPayload = {
   files?: Array<{
-    [key: string]: unknown
+    transfer_method: 'local_file' | 'remote_url'
+    type: 'audio' | 'custom' | 'document' | 'image' | 'video'
+    upload_file_id?: string
+    url?: string
   }> | null
   inputs: {
     [key: string]: unknown
   }
   response_mode?: 'blocking' | 'streaming' | null
-  trace_session_id?: string | null
+}
+
+export type WorkflowRunPayloadWithUser = {
+  files?: Array<{
+    transfer_method: 'local_file' | 'remote_url'
+    type: 'audio' | 'custom' | 'document' | 'image' | 'video'
+    upload_file_id?: string
+    url?: string
+  }> | null
+  inputs: {
+    [key: string]: unknown
+  }
+  response_mode?: 'blocking' | 'streaming' | null
+  user: string
 }
 
 export type WorkflowRunResponse = {
@@ -1544,6 +1720,7 @@ export type GetAppFeedbacksData = {
 
 export type GetAppFeedbacksErrors = {
   401: unknown
+  403: unknown
 }
 
 export type GetAppFeedbacksResponses = {
@@ -1555,7 +1732,7 @@ export type GetAppFeedbacksResponse = GetAppFeedbacksResponses[keyof GetAppFeedb
 export type PostAppsAnnotationReplyByActionData = {
   body: AnnotationReplyActionPayload
   path: {
-    action: string
+    action: 'disable' | 'enable'
   }
   query?: never
   url: '/apps/annotation-reply/{action}'
@@ -1563,6 +1740,7 @@ export type PostAppsAnnotationReplyByActionData = {
 
 export type PostAppsAnnotationReplyByActionErrors = {
   401: unknown
+  403: unknown
 }
 
 export type PostAppsAnnotationReplyByActionResponses = {
@@ -1575,7 +1753,7 @@ export type PostAppsAnnotationReplyByActionResponse
 export type GetAppsAnnotationReplyByActionStatusByJobIdData = {
   body?: never
   path: {
-    action: string
+    action: 'disable' | 'enable'
     job_id: string
   }
   query?: never
@@ -1583,7 +1761,9 @@ export type GetAppsAnnotationReplyByActionStatusByJobIdData = {
 }
 
 export type GetAppsAnnotationReplyByActionStatusByJobIdErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -1607,6 +1787,7 @@ export type GetAppsAnnotationsData = {
 
 export type GetAppsAnnotationsErrors = {
   401: unknown
+  403: unknown
 }
 
 export type GetAppsAnnotationsResponses = {
@@ -1625,6 +1806,7 @@ export type PostAppsAnnotationsData = {
 
 export type PostAppsAnnotationsErrors = {
   401: unknown
+  403: unknown
 }
 
 export type PostAppsAnnotationsResponses = {
@@ -1679,7 +1861,10 @@ export type PutAppsAnnotationsByAnnotationIdResponse
   = PutAppsAnnotationsByAnnotationIdResponses[keyof PutAppsAnnotationsByAnnotationIdResponses]
 
 export type PostAudioToTextData = {
-  body?: never
+  body: {
+    file: Blob | File
+    user?: string
+  }
   path?: never
   query?: never
   url: '/audio-to-text'
@@ -1688,6 +1873,7 @@ export type PostAudioToTextData = {
 export type PostAudioToTextErrors = {
   400: unknown
   401: unknown
+  403: unknown
   413: unknown
   415: unknown
   500: unknown
@@ -1700,7 +1886,7 @@ export type PostAudioToTextResponses = {
 export type PostAudioToTextResponse = PostAudioToTextResponses[keyof PostAudioToTextResponses]
 
 export type PostChatMessagesData = {
-  body: ChatRequestPayload
+  body: ChatRequestPayloadWithUser
   path?: never
   query?: never
   url: '/chat-messages'
@@ -1709,6 +1895,7 @@ export type PostChatMessagesData = {
 export type PostChatMessagesErrors = {
   400: unknown
   401: unknown
+  403: unknown
   404: unknown
   429: unknown
   500: unknown
@@ -1721,7 +1908,7 @@ export type PostChatMessagesResponses = {
 export type PostChatMessagesResponse = PostChatMessagesResponses[keyof PostChatMessagesResponses]
 
 export type PostChatMessagesByTaskIdStopData = {
-  body?: never
+  body: RequiredServiceApiUserPayload
   path: {
     task_id: string
   }
@@ -1730,7 +1917,9 @@ export type PostChatMessagesByTaskIdStopData = {
 }
 
 export type PostChatMessagesByTaskIdStopErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -1742,7 +1931,7 @@ export type PostChatMessagesByTaskIdStopResponse
   = PostChatMessagesByTaskIdStopResponses[keyof PostChatMessagesByTaskIdStopResponses]
 
 export type PostCompletionMessagesData = {
-  body: CompletionRequestPayload
+  body: CompletionRequestPayloadWithUser
   path?: never
   query?: never
   url: '/completion-messages'
@@ -1751,7 +1940,9 @@ export type PostCompletionMessagesData = {
 export type PostCompletionMessagesErrors = {
   400: unknown
   401: unknown
+  403: unknown
   404: unknown
+  429: unknown
   500: unknown
 }
 
@@ -1763,7 +1954,7 @@ export type PostCompletionMessagesResponse
   = PostCompletionMessagesResponses[keyof PostCompletionMessagesResponses]
 
 export type PostCompletionMessagesByTaskIdStopData = {
-  body?: never
+  body: RequiredServiceApiUserPayload
   path: {
     task_id: string
   }
@@ -1772,7 +1963,9 @@ export type PostCompletionMessagesByTaskIdStopData = {
 }
 
 export type PostCompletionMessagesByTaskIdStopErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -1790,12 +1983,15 @@ export type GetConversationsData = {
     last_id?: string
     limit?: number
     sort_by?: '-created_at' | '-updated_at' | 'created_at' | 'updated_at'
+    user?: string
   }
   url: '/conversations'
 }
 
 export type GetConversationsErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -1806,7 +2002,7 @@ export type GetConversationsResponses = {
 export type GetConversationsResponse = GetConversationsResponses[keyof GetConversationsResponses]
 
 export type DeleteConversationsByCIdData = {
-  body?: never
+  body: OptionalServiceApiUserPayload
   path: {
     c_id: string
   }
@@ -1815,7 +2011,9 @@ export type DeleteConversationsByCIdData = {
 }
 
 export type DeleteConversationsByCIdErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -1827,7 +2025,7 @@ export type DeleteConversationsByCIdResponse
   = DeleteConversationsByCIdResponses[keyof DeleteConversationsByCIdResponses]
 
 export type PostConversationsByCIdNameData = {
-  body: ConversationRenamePayload
+  body: ConversationRenamePayloadWithUser
   path: {
     c_id: string
   }
@@ -1836,7 +2034,9 @@ export type PostConversationsByCIdNameData = {
 }
 
 export type PostConversationsByCIdNameErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -1855,13 +2055,16 @@ export type GetConversationsByCIdVariablesData = {
   query?: {
     last_id?: string
     limit?: number
+    user?: string
     variable_name?: string
   }
   url: '/conversations/{c_id}/variables'
 }
 
 export type GetConversationsByCIdVariablesErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -1873,7 +2076,7 @@ export type GetConversationsByCIdVariablesResponse
   = GetConversationsByCIdVariablesResponses[keyof GetConversationsByCIdVariablesResponses]
 
 export type PutConversationsByCIdVariablesByVariableIdData = {
-  body: ConversationVariableUpdatePayload
+  body: ConversationVariableUpdatePayloadWithUser
   path: {
     c_id: string
     variable_id: string
@@ -1885,6 +2088,7 @@ export type PutConversationsByCIdVariablesByVariableIdData = {
 export type PutConversationsByCIdVariablesByVariableIdErrors = {
   400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -1910,6 +2114,7 @@ export type GetDatasetsData = {
 
 export type GetDatasetsErrors = {
   401: unknown
+  403: unknown
 }
 
 export type GetDatasetsResponses = {
@@ -1928,6 +2133,8 @@ export type PostDatasetsData = {
 export type PostDatasetsErrors = {
   400: unknown
   401: unknown
+  403: unknown
+  409: unknown
 }
 
 export type PostDatasetsResponses = {
@@ -1937,7 +2144,9 @@ export type PostDatasetsResponses = {
 export type PostDatasetsResponse = PostDatasetsResponses[keyof PostDatasetsResponses]
 
 export type PostDatasetsPipelineFileUploadData = {
-  body?: never
+  body: {
+    file: Blob | File
+  }
   path?: never
   query?: never
   url: '/datasets/pipeline/file-upload'
@@ -1946,6 +2155,7 @@ export type PostDatasetsPipelineFileUploadData = {
 export type PostDatasetsPipelineFileUploadErrors = {
   400: unknown
   401: unknown
+  403: unknown
   413: unknown
   415: unknown
 }
@@ -1985,6 +2195,7 @@ export type GetDatasetsTagsData = {
 
 export type GetDatasetsTagsErrors = {
   401: unknown
+  403: unknown
 }
 
 export type GetDatasetsTagsResponses = {
@@ -2078,6 +2289,7 @@ export type DeleteDatasetsByDatasetIdData = {
 
 export type DeleteDatasetsByDatasetIdErrors = {
   401: unknown
+  403: unknown
   404: unknown
   409: unknown
 }
@@ -2148,6 +2360,7 @@ export type PostDatasetsByDatasetIdDocumentCreateByFileData = {
 export type PostDatasetsByDatasetIdDocumentCreateByFileErrors = {
   400: unknown
   401: unknown
+  403: unknown
 }
 
 export type PostDatasetsByDatasetIdDocumentCreateByFileResponses = {
@@ -2169,6 +2382,7 @@ export type PostDatasetsByDatasetIdDocumentCreateByTextData = {
 export type PostDatasetsByDatasetIdDocumentCreateByTextErrors = {
   400: unknown
   401: unknown
+  403: unknown
 }
 
 export type PostDatasetsByDatasetIdDocumentCreateByTextResponses = {
@@ -2193,6 +2407,7 @@ export type PostDatasetsByDatasetIdDocumentCreateByFile2Data = {
 export type PostDatasetsByDatasetIdDocumentCreateByFile2Errors = {
   400: unknown
   401: unknown
+  403: unknown
 }
 
 export type PostDatasetsByDatasetIdDocumentCreateByFile2Responses = {
@@ -2214,6 +2429,7 @@ export type PostDatasetsByDatasetIdDocumentCreateByText2Data = {
 export type PostDatasetsByDatasetIdDocumentCreateByText2Errors = {
   400: unknown
   401: unknown
+  403: unknown
 }
 
 export type PostDatasetsByDatasetIdDocumentCreateByText2Responses = {
@@ -2232,13 +2448,14 @@ export type GetDatasetsByDatasetIdDocumentsData = {
     keyword?: string
     limit?: number
     page?: number
-    status?: string
+    status?: 'archived' | 'available' | 'disabled' | 'error' | 'indexing' | 'paused' | 'queuing'
   }
   url: '/datasets/{dataset_id}/documents'
 }
 
 export type GetDatasetsByDatasetIdDocumentsErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2259,13 +2476,16 @@ export type PostDatasetsByDatasetIdDocumentsDownloadZipData = {
 }
 
 export type PostDatasetsByDatasetIdDocumentsDownloadZipErrors = {
-  401: unknown
-  403: unknown
-  404: unknown
+  401: Blob | File
+  403: Blob | File
+  404: Blob | File
 }
 
+export type PostDatasetsByDatasetIdDocumentsDownloadZipError
+  = PostDatasetsByDatasetIdDocumentsDownloadZipErrors[keyof PostDatasetsByDatasetIdDocumentsDownloadZipErrors]
+
 export type PostDatasetsByDatasetIdDocumentsDownloadZipResponses = {
-  200: BinaryFileResponse
+  200: Blob | File
 }
 
 export type PostDatasetsByDatasetIdDocumentsDownloadZipResponse
@@ -2282,6 +2502,7 @@ export type PostDatasetsByDatasetIdDocumentsMetadataData = {
 
 export type PostDatasetsByDatasetIdDocumentsMetadataErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2295,7 +2516,7 @@ export type PostDatasetsByDatasetIdDocumentsMetadataResponse
 export type PatchDatasetsByDatasetIdDocumentsStatusByActionData = {
   body: DocumentStatusPayload
   path: {
-    action: string
+    action: 'archive' | 'disable' | 'enable' | 'un_archive'
     dataset_id: string
   }
   query?: never
@@ -2328,6 +2549,7 @@ export type GetDatasetsByDatasetIdDocumentsByBatchIndexingStatusData = {
 
 export type GetDatasetsByDatasetIdDocumentsByBatchIndexingStatusErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2349,6 +2571,7 @@ export type DeleteDatasetsByDatasetIdDocumentsByDocumentIdData = {
 }
 
 export type DeleteDatasetsByDatasetIdDocumentsByDocumentIdErrors = {
+  400: unknown
   401: unknown
   403: unknown
   404: unknown
@@ -2374,6 +2597,7 @@ export type GetDatasetsByDatasetIdDocumentsByDocumentIdData = {
 }
 
 export type GetDatasetsByDatasetIdDocumentsByDocumentIdErrors = {
+  400: unknown
   401: unknown
   403: unknown
   404: unknown
@@ -2401,6 +2625,7 @@ export type PatchDatasetsByDatasetIdDocumentsByDocumentIdData = {
 
 export type PatchDatasetsByDatasetIdDocumentsByDocumentIdErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2451,6 +2676,7 @@ export type GetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsData = {
 
 export type GetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2474,6 +2700,7 @@ export type PostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsData = {
 export type PostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsErrors = {
   400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2497,6 +2724,7 @@ export type DeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdDat
 
 export type DeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2520,6 +2748,7 @@ export type GetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdData =
 
 export type GetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2543,6 +2772,7 @@ export type PostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdData
 
 export type PostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2570,6 +2800,7 @@ export type GetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildC
 
 export type GetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2592,7 +2823,9 @@ export type PostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChild
 }
 
 export type PostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2618,7 +2851,9 @@ export type DeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChi
 
 export type DeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkIdErrors
   = {
+    400: unknown
     401: unknown
+    403: unknown
     404: unknown
   }
 
@@ -2645,7 +2880,9 @@ export type PatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChil
 
 export type PatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkIdErrors
   = {
+    400: unknown
     401: unknown
+    403: unknown
     404: unknown
   }
 
@@ -2671,7 +2908,9 @@ export type PostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFileData = {
 }
 
 export type PostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFileErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2693,7 +2932,9 @@ export type PostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByTextData = {
 }
 
 export type PostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByTextErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2718,7 +2959,9 @@ export type PostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFile2Data = {
 }
 
 export type PostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFile2Errors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2741,6 +2984,7 @@ export type PostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByText2Data = {
 
 export type PostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByText2Errors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2761,8 +3005,11 @@ export type PostDatasetsByDatasetIdHitTestingData = {
 }
 
 export type PostDatasetsByDatasetIdHitTestingErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
+  500: unknown
 }
 
 export type PostDatasetsByDatasetIdHitTestingResponses = {
@@ -2783,6 +3030,7 @@ export type GetDatasetsByDatasetIdMetadataData = {
 
 export type GetDatasetsByDatasetIdMetadataErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2804,6 +3052,7 @@ export type PostDatasetsByDatasetIdMetadataData = {
 
 export type PostDatasetsByDatasetIdMetadataErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2825,6 +3074,7 @@ export type GetDatasetsByDatasetIdMetadataBuiltInData = {
 
 export type GetDatasetsByDatasetIdMetadataBuiltInErrors = {
   401: unknown
+  403: unknown
 }
 
 export type GetDatasetsByDatasetIdMetadataBuiltInResponses = {
@@ -2837,7 +3087,7 @@ export type GetDatasetsByDatasetIdMetadataBuiltInResponse
 export type PostDatasetsByDatasetIdMetadataBuiltInByActionData = {
   body?: never
   path: {
-    action: string
+    action: 'disable' | 'enable'
     dataset_id: string
   }
   query?: never
@@ -2846,6 +3096,7 @@ export type PostDatasetsByDatasetIdMetadataBuiltInByActionData = {
 
 export type PostDatasetsByDatasetIdMetadataBuiltInByActionErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2868,6 +3119,7 @@ export type DeleteDatasetsByDatasetIdMetadataByMetadataIdData = {
 
 export type DeleteDatasetsByDatasetIdMetadataByMetadataIdErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2890,6 +3142,7 @@ export type PatchDatasetsByDatasetIdMetadataByMetadataIdData = {
 
 export type PatchDatasetsByDatasetIdMetadataByMetadataIdErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -2913,6 +3166,8 @@ export type GetDatasetsByDatasetIdPipelineDatasourcePluginsData = {
 
 export type GetDatasetsByDatasetIdPipelineDatasourcePluginsErrors = {
   401: unknown
+  403: unknown
+  404: unknown
 }
 
 export type GetDatasetsByDatasetIdPipelineDatasourcePluginsResponses = {
@@ -2934,6 +3189,8 @@ export type PostDatasetsByDatasetIdPipelineDatasourceNodesByNodeIdRunData = {
 
 export type PostDatasetsByDatasetIdPipelineDatasourceNodesByNodeIdRunErrors = {
   401: unknown
+  403: unknown
+  404: unknown
 }
 
 export type PostDatasetsByDatasetIdPipelineDatasourceNodesByNodeIdRunResponses = {
@@ -2954,6 +3211,9 @@ export type PostDatasetsByDatasetIdPipelineRunData = {
 
 export type PostDatasetsByDatasetIdPipelineRunErrors = {
   401: unknown
+  403: unknown
+  404: unknown
+  500: unknown
 }
 
 export type PostDatasetsByDatasetIdPipelineRunResponses = {
@@ -2973,8 +3233,11 @@ export type PostDatasetsByDatasetIdRetrieveData = {
 }
 
 export type PostDatasetsByDatasetIdRetrieveErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
+  500: unknown
 }
 
 export type PostDatasetsByDatasetIdRetrieveResponses = {
@@ -2995,6 +3258,7 @@ export type GetDatasetsByDatasetIdTagsData = {
 
 export type GetDatasetsByDatasetIdTagsErrors = {
   401: unknown
+  403: unknown
 }
 
 export type GetDatasetsByDatasetIdTagsResponses = {
@@ -3015,6 +3279,7 @@ export type GetEndUsersByEndUserIdData = {
 
 export type GetEndUsersByEndUserIdErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3026,7 +3291,10 @@ export type GetEndUsersByEndUserIdResponse
   = GetEndUsersByEndUserIdResponses[keyof GetEndUsersByEndUserIdResponses]
 
 export type PostFilesUploadData = {
-  body?: never
+  body: {
+    file: Blob | File
+    user?: string
+  }
   path?: never
   query?: never
   url: '/files/upload'
@@ -3035,6 +3303,7 @@ export type PostFilesUploadData = {
 export type PostFilesUploadErrors = {
   400: unknown
   401: unknown
+  403: unknown
   413: unknown
   415: unknown
 }
@@ -3052,18 +3321,22 @@ export type GetFilesByFileIdPreviewData = {
   }
   query?: {
     as_attachment?: boolean
+    user?: string
   }
   url: '/files/{file_id}/preview'
 }
 
 export type GetFilesByFileIdPreviewErrors = {
-  401: unknown
-  403: unknown
-  404: unknown
+  401: Blob | File
+  403: Blob | File
+  404: Blob | File
 }
 
+export type GetFilesByFileIdPreviewError
+  = GetFilesByFileIdPreviewErrors[keyof GetFilesByFileIdPreviewErrors]
+
 export type GetFilesByFileIdPreviewResponses = {
-  200: BinaryFileResponse
+  200: Blob | File
 }
 
 export type GetFilesByFileIdPreviewResponse
@@ -3080,6 +3353,7 @@ export type GetFormHumanInputByFormTokenData = {
 
 export type GetFormHumanInputByFormTokenErrors = {
   401: unknown
+  403: unknown
   404: unknown
   412: unknown
 }
@@ -3092,7 +3366,7 @@ export type GetFormHumanInputByFormTokenResponse
   = GetFormHumanInputByFormTokenResponses[keyof GetFormHumanInputByFormTokenResponses]
 
 export type PostFormHumanInputByFormTokenData = {
-  body: HumanInputFormSubmitPayload
+  body: HumanInputFormSubmitPayloadWithUser
   path: {
     form_token: string
   }
@@ -3103,6 +3377,7 @@ export type PostFormHumanInputByFormTokenData = {
 export type PostFormHumanInputByFormTokenErrors = {
   400: unknown
   401: unknown
+  403: unknown
   404: unknown
   412: unknown
 }
@@ -3123,6 +3398,7 @@ export type GetInfoData = {
 
 export type GetInfoErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3139,12 +3415,15 @@ export type GetMessagesData = {
     conversation_id: string
     first_id?: string
     limit?: number
+    user?: string
   }
   url: '/messages'
 }
 
 export type GetMessagesErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3155,7 +3434,7 @@ export type GetMessagesResponses = {
 export type GetMessagesResponse = GetMessagesResponses[keyof GetMessagesResponses]
 
 export type PostMessagesByMessageIdFeedbacksData = {
-  body: MessageFeedbackPayload
+  body: MessageFeedbackPayloadWithUser
   path: {
     message_id: string
   }
@@ -3165,6 +3444,7 @@ export type PostMessagesByMessageIdFeedbacksData = {
 
 export type PostMessagesByMessageIdFeedbacksErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3180,13 +3460,16 @@ export type GetMessagesByMessageIdSuggestedData = {
   path: {
     message_id: string
   }
-  query?: never
+  query: {
+    user: string
+  }
   url: '/messages/{message_id}/suggested'
 }
 
 export type GetMessagesByMessageIdSuggestedErrors = {
   400: unknown
   401: unknown
+  403: unknown
   404: unknown
   500: unknown
 }
@@ -3207,6 +3490,7 @@ export type GetMetaData = {
 
 export type GetMetaErrors = {
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3224,7 +3508,9 @@ export type GetParametersData = {
 }
 
 export type GetParametersErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3253,20 +3539,23 @@ export type GetSiteResponses = {
 export type GetSiteResponse = GetSiteResponses[keyof GetSiteResponses]
 
 export type PostTextToAudioData = {
-  body: TextToAudioPayload
+  body: TextToAudioPayloadWithUser
   path?: never
   query?: never
   url: '/text-to-audio'
 }
 
 export type PostTextToAudioErrors = {
-  400: unknown
-  401: unknown
-  500: unknown
+  400: Blob | File
+  401: Blob | File
+  403: Blob | File
+  500: Blob | File
 }
 
+export type PostTextToAudioError = PostTextToAudioErrors[keyof PostTextToAudioErrors]
+
 export type PostTextToAudioResponses = {
-  200: AudioBinaryResponse
+  200: Blob | File
 }
 
 export type PostTextToAudioResponse = PostTextToAudioResponses[keyof PostTextToAudioResponses]
@@ -3285,7 +3574,9 @@ export type GetWorkflowByTaskIdEventsData = {
 }
 
 export type GetWorkflowByTaskIdEventsErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3314,6 +3605,7 @@ export type GetWorkflowsLogsData = {
 
 export type GetWorkflowsLogsErrors = {
   401: unknown
+  403: unknown
 }
 
 export type GetWorkflowsLogsResponses = {
@@ -3323,7 +3615,7 @@ export type GetWorkflowsLogsResponses = {
 export type GetWorkflowsLogsResponse = GetWorkflowsLogsResponses[keyof GetWorkflowsLogsResponses]
 
 export type PostWorkflowsRunData = {
-  body: WorkflowRunPayload
+  body: WorkflowRunPayloadWithUser
   path?: never
   query?: never
   url: '/workflows/run'
@@ -3332,6 +3624,7 @@ export type PostWorkflowsRunData = {
 export type PostWorkflowsRunErrors = {
   400: unknown
   401: unknown
+  403: unknown
   404: unknown
   429: unknown
   500: unknown
@@ -3353,7 +3646,9 @@ export type GetWorkflowsRunByWorkflowRunIdData = {
 }
 
 export type GetWorkflowsRunByWorkflowRunIdErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3365,7 +3660,7 @@ export type GetWorkflowsRunByWorkflowRunIdResponse
   = GetWorkflowsRunByWorkflowRunIdResponses[keyof GetWorkflowsRunByWorkflowRunIdResponses]
 
 export type PostWorkflowsTasksByTaskIdStopData = {
-  body?: never
+  body: RequiredServiceApiUserPayload
   path: {
     task_id: string
   }
@@ -3374,7 +3669,9 @@ export type PostWorkflowsTasksByTaskIdStopData = {
 }
 
 export type PostWorkflowsTasksByTaskIdStopErrors = {
+  400: unknown
   401: unknown
+  403: unknown
   404: unknown
 }
 
@@ -3386,7 +3683,7 @@ export type PostWorkflowsTasksByTaskIdStopResponse
   = PostWorkflowsTasksByTaskIdStopResponses[keyof PostWorkflowsTasksByTaskIdStopResponses]
 
 export type PostWorkflowsByWorkflowIdRunData = {
-  body: WorkflowRunPayload
+  body: WorkflowRunPayloadWithUser
   path: {
     workflow_id: string
   }
@@ -3397,6 +3694,7 @@ export type PostWorkflowsByWorkflowIdRunData = {
 export type PostWorkflowsByWorkflowIdRunErrors = {
   400: unknown
   401: unknown
+  403: unknown
   404: unknown
   429: unknown
   500: unknown
@@ -3412,7 +3710,7 @@ export type PostWorkflowsByWorkflowIdRunResponse
 export type GetWorkspacesCurrentModelsModelTypesByModelTypeData = {
   body?: never
   path: {
-    model_type: string
+    model_type: 'llm' | 'moderation' | 'rerank' | 'speech2text' | 'text-embedding' | 'tts'
   }
   query?: never
   url: '/workspaces/current/models/model-types/{model_type}'
diff --git a/packages/contracts/generated/api/service/zod.gen.ts b/packages/contracts/generated/api/service/zod.gen.ts
index ce31666d074..6ccc5671cb2 100644
--- a/packages/contracts/generated/api/service/zod.gen.ts
+++ b/packages/contracts/generated/api/service/zod.gen.ts
@@ -131,12 +131,42 @@ export const zButtonStyle = z.enum(['accent', 'default', 'ghost', 'primary'])
 export const zChatRequestPayload = z.object({
   auto_generate_name: z.boolean().optional().default(true),
   conversation_id: z.string().nullish(),
-  files: z.array(z.record(z.string(), z.unknown())).nullish(),
+  files: z
+    .array(
+      z.object({
+        transfer_method: z.enum(['local_file', 'remote_url']),
+        type: z.enum(['audio', 'custom', 'document', 'image', 'video']),
+        upload_file_id: z.string().optional(),
+        url: z.string().optional(),
+      }),
+    )
+    .nullish(),
   inputs: z.record(z.string(), z.unknown()),
   query: z.string(),
   response_mode: z.enum(['blocking', 'streaming']).nullish(),
-  retriever_from: z.string().optional().default('dev'),
-  trace_session_id: z.string().nullish(),
+  workflow_id: z.string().nullish(),
+})
+
+/**
+ * ChatRequestPayload
+ */
+export const zChatRequestPayloadWithUser = z.object({
+  auto_generate_name: z.boolean().optional().default(true),
+  conversation_id: z.string().nullish(),
+  files: z
+    .array(
+      z.object({
+        transfer_method: z.enum(['local_file', 'remote_url']),
+        type: z.enum(['audio', 'custom', 'document', 'image', 'video']),
+        upload_file_id: z.string().optional(),
+        url: z.string().optional(),
+      }),
+    )
+    .nullish(),
+  inputs: z.record(z.string(), z.unknown()),
+  query: z.string(),
+  response_mode: z.enum(['blocking', 'streaming']).nullish(),
+  user: z.string(),
   workflow_id: z.string().nullish(),
 })
 
@@ -199,12 +229,39 @@ export const zChildChunkUpdatePayload = z.object({
  * CompletionRequestPayload
  */
 export const zCompletionRequestPayload = z.object({
-  files: z.array(z.record(z.string(), z.unknown())).nullish(),
+  files: z
+    .array(
+      z.object({
+        transfer_method: z.enum(['local_file', 'remote_url']),
+        type: z.enum(['audio', 'custom', 'document', 'image', 'video']),
+        upload_file_id: z.string().optional(),
+        url: z.string().optional(),
+      }),
+    )
+    .nullish(),
   inputs: z.record(z.string(), z.unknown()),
   query: z.string().optional().default(''),
   response_mode: z.enum(['blocking', 'streaming']).nullish(),
-  retriever_from: z.string().optional().default('dev'),
-  trace_session_id: z.string().nullish(),
+})
+
+/**
+ * CompletionRequestPayload
+ */
+export const zCompletionRequestPayloadWithUser = z.object({
+  files: z
+    .array(
+      z.object({
+        transfer_method: z.enum(['local_file', 'remote_url']),
+        type: z.enum(['audio', 'custom', 'document', 'image', 'video']),
+        upload_file_id: z.string().optional(),
+        url: z.string().optional(),
+      }),
+    )
+    .nullish(),
+  inputs: z.record(z.string(), z.unknown()),
+  query: z.string().optional().default(''),
+  response_mode: z.enum(['blocking', 'streaming']).nullish(),
+  user: z.string(),
 })
 
 /**
@@ -234,7 +291,7 @@ export const zCondition = z.object({
     '≥',
   ]),
   name: z.string(),
-  value: z.union([z.string(), z.array(z.string()), z.int(), z.number()]).nullish(),
+  value: z.union([z.string(), z.array(z.string()), z.number()]).nullish(),
 })
 
 /**
@@ -249,13 +306,42 @@ export const zConversationListQuery = z.object({
     .default('-updated_at'),
 })
 
-/**
- * ConversationRenamePayload
- */
-export const zConversationRenamePayload = z.object({
-  auto_generate: z.boolean().optional().default(false),
-  name: z.string().nullish(),
-})
+export const zConversationRenamePayload = z.intersection(
+  z.union([
+    z.object({
+      auto_generate: z.literal(true),
+      name: z.string().nullish(),
+    }),
+    z.object({
+      auto_generate: z.literal(false).optional().default(false),
+      name: z.string().regex(/.*\S.*/),
+    }),
+  ]),
+  z.object({
+    auto_generate: z.boolean().optional().default(false),
+    name: z.string().nullish(),
+  }),
+)
+
+export const zConversationRenamePayloadWithUser = z.intersection(
+  z.union([
+    z.object({
+      auto_generate: z.literal(true),
+      name: z.string().nullish(),
+      user: z.string().optional(),
+    }),
+    z.object({
+      auto_generate: z.literal(false).optional().default(false),
+      name: z.string().regex(/.*\S.*/),
+      user: z.string().optional(),
+    }),
+  ]),
+  z.object({
+    auto_generate: z.boolean().optional().default(false),
+    name: z.string().nullish(),
+    user: z.string().optional(),
+  }),
+)
 
 /**
  * ConversationVariableResponse
@@ -286,6 +372,14 @@ export const zConversationVariableUpdatePayload = z.object({
   value: z.unknown(),
 })
 
+/**
+ * ConversationVariableUpdatePayload
+ */
+export const zConversationVariableUpdatePayloadWithUser = z.object({
+  user: z.string().optional(),
+  value: z.unknown(),
+})
+
 /**
  * ConversationVariablesQuery
  */
@@ -508,8 +602,10 @@ export const zDatasetDetailResponse = z.object({
   indexing_technique: z.string().nullable(),
   is_multimodal: z.boolean(),
   is_published: z.boolean(),
+  maintainer: z.string().nullish(),
   name: z.string(),
   permission: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   pipeline_id: z.string().nullable(),
   provider: z.string(),
   retrieval_model_dict: zDatasetRetrievalModelResponse,
@@ -549,9 +645,11 @@ export const zDatasetDetailWithPartialMembersResponse = z.object({
   indexing_technique: z.string().nullable(),
   is_multimodal: z.boolean(),
   is_published: z.boolean(),
+  maintainer: z.string().nullish(),
   name: z.string(),
   partial_member_list: z.array(z.string()).nullish(),
   permission: z.string(),
+  permission_keys: z.array(z.string()).optional(),
   pipeline_id: z.string().nullable(),
   provider: z.string(),
   retrieval_model_dict: zDatasetRetrievalModelResponse,
@@ -591,7 +689,7 @@ export const zDatasourceCredentialInfoResponse = z.object({
  */
 export const zDatasourceNodeRunPayload = z.object({
   credential_id: z.string().nullish(),
-  datasource_type: z.string(),
+  datasource_type: z.enum(['local_file', 'online_document', 'online_drive', 'website_crawl']),
   inputs: z.record(z.string(), z.unknown()),
   is_published: z.boolean(),
 })
@@ -644,7 +742,9 @@ export const zDocumentListQuery = z.object({
   keyword: z.string().nullish(),
   limit: z.int().optional().default(20),
   page: z.int().optional().default(1),
-  status: z.string().nullish(),
+  status: z
+    .enum(['archived', 'available', 'disabled', 'error', 'indexing', 'paused', 'queuing'])
+    .nullish(),
 })
 
 /**
@@ -1071,6 +1171,15 @@ export const zHumanInputFormSubmitPayload = z.object({
   inputs: z.record(z.string(), zJsonValue2),
 })
 
+/**
+ * HumanInputFormSubmitPayload
+ */
+export const zHumanInputFormSubmitPayloadWithUser = z.object({
+  action: z.string(),
+  inputs: z.record(z.string(), zJsonValue2),
+  user: z.string(),
+})
+
 /**
  * KnowledgeTagResponse
  */
@@ -1094,6 +1203,15 @@ export const zMessageFeedbackPayload = z.object({
   rating: z.enum(['dislike', 'like']).nullish(),
 })
 
+/**
+ * MessageFeedbackPayload
+ */
+export const zMessageFeedbackPayloadWithUser = z.object({
+  content: z.string().nullish(),
+  rating: z.enum(['dislike', 'like']).nullish(),
+  user: z.string(),
+})
+
 /**
  * MessageFile
  */
@@ -1235,6 +1353,13 @@ export const zModelType = z.enum([
   'tts',
 ])
 
+/**
+ * ServiceApiUserPayload
+ */
+export const zOptionalServiceApiUserPayload = z.object({
+  user: z.string().optional(),
+})
+
 /**
  * PermissionEnum
  *
@@ -1246,11 +1371,37 @@ export const zPermissionEnum = z.enum(['all_team_members', 'only_me', 'partial_m
  * PipelineRunApiEntity
  */
 export const zPipelineRunApiEntity = z.object({
-  datasource_info_list: z.array(z.record(z.string(), z.unknown())),
-  datasource_type: z.string(),
+  datasource_info_list: z.array(
+    z.union([
+      z.object({
+        name: z.string().optional(),
+        reference: z.string(),
+      }),
+      z.object({
+        credential_id: z.string().optional(),
+        page: z.object({
+          page_id: z.string(),
+          page_name: z.string().optional(),
+          type: z.string(),
+        }),
+        workspace_id: z.string(),
+      }),
+      z.object({
+        title: z.string().optional(),
+        url: z.string(),
+      }),
+      z.object({
+        bucket: z.string().optional(),
+        id: z.string(),
+        name: z.string().optional(),
+        type: z.enum(['file', 'folder']),
+      }),
+    ]),
+  ),
+  datasource_type: z.enum(['local_file', 'online_document', 'online_drive', 'website_crawl']),
   inputs: z.record(z.string(), z.unknown()),
   is_published: z.boolean(),
-  response_mode: z.string(),
+  response_mode: z.enum(['blocking', 'streaming']),
   start_node_id: z.string(),
 })
 
@@ -1272,7 +1423,7 @@ export const zPipelineUploadFileResponse = z.object({
  */
 export const zPreProcessingRule = z.object({
   enabled: z.boolean(),
-  id: z.string(),
+  id: z.enum(['remove_extra_spaces', 'remove_stopwords', 'remove_urls_emails']),
 })
 
 /**
@@ -1322,6 +1473,13 @@ export const zProviderWithModelsListResponse = z.object({
   data: z.array(zProviderWithModelsResponse),
 })
 
+/**
+ * ServiceApiUserPayload
+ */
+export const zRequiredServiceApiUserPayload = z.object({
+  user: z.string(),
+})
+
 /**
  * RerankingModel
  */
@@ -1654,13 +1812,20 @@ export const zTagDeletePayload = z.object({
 /**
  * TagUnbindingPayload
  *
- * Accept the legacy single-tag Service API payload while exposing a normalized tag_ids list internally.
+ * Accepts either the legacy tag_id payload or the normalized tag_ids payload.
  */
-export const zTagUnbindingPayload = z.object({
-  tag_id: z.string().nullish(),
-  tag_ids: z.array(z.string()).optional(),
-  target_id: z.string(),
-})
+export const zTagUnbindingPayload = z.union([
+  z.object({
+    tag_id: z.string(),
+    tag_ids: z.array(z.string()).min(1).optional(),
+    target_id: z.string(),
+  }),
+  z.object({
+    tag_id: z.string().optional(),
+    tag_ids: z.array(z.string()).min(1),
+    target_id: z.string(),
+  }),
+])
 
 /**
  * TagUpdatePayload
@@ -1674,12 +1839,23 @@ export const zTagUpdatePayload = z.object({
  * TextToAudioPayload
  */
 export const zTextToAudioPayload = z.object({
-  message_id: z.string().nullish(),
+  message_id: z.uuid().nullish(),
   streaming: z.boolean().nullish(),
   text: z.string().nullish(),
   voice: z.string().nullish(),
 })
 
+/**
+ * TextToAudioPayload
+ */
+export const zTextToAudioPayloadWithUser = z.object({
+  message_id: z.uuid().nullish(),
+  streaming: z.boolean().nullish(),
+  text: z.string().nullish(),
+  user: z.string().optional(),
+  voice: z.string().nullish(),
+})
+
 /**
  * UrlResponse
  */
@@ -1840,7 +2016,7 @@ export const zWeightModel = z.object({
 export const zRetrievalModel = z.object({
   metadata_filtering_conditions: zMetadataFilteringCondition.nullish(),
   reranking_enable: z.boolean(),
-  reranking_mode: z.string().nullish(),
+  reranking_mode: z.enum(['reranking_model', 'weighted_score']).nullish(),
   reranking_model: zRerankingModel.nullish(),
   score_threshold: z.number().nullish(),
   score_threshold_enabled: z.boolean(),
@@ -1861,9 +2037,16 @@ export const zDatasetCreatePayload = z.object({
   indexing_technique: z.enum(['economy', 'high_quality']).nullish(),
   name: z.string().min(1).max(40),
   permission: zPermissionEnum.nullish().default('only_me'),
-  provider: z.string().optional().default('vendor'),
+  provider: z.enum(['external', 'vendor']).optional().default('vendor'),
   retrieval_model: zRetrievalModel.nullish(),
-  summary_index_setting: z.record(z.string(), z.unknown()).nullish(),
+  summary_index_setting: z
+    .object({
+      enable: z.boolean().optional(),
+      model_name: z.string().optional(),
+      model_provider_name: z.string().optional(),
+      summary_prompt: z.string().optional(),
+    })
+    .nullish(),
 })
 
 /**
@@ -1875,10 +2058,22 @@ export const zDatasetUpdatePayload = z.object({
   embedding_model_provider: z.string().nullish(),
   external_knowledge_api_id: z.string().nullish(),
   external_knowledge_id: z.string().nullish(),
-  external_retrieval_model: z.record(z.string(), z.unknown()).nullish(),
+  external_retrieval_model: z
+    .object({
+      score_threshold: z.number().optional(),
+      score_threshold_enabled: z.boolean().optional(),
+      top_k: z.int().optional(),
+    })
+    .nullish(),
   indexing_technique: z.enum(['economy', 'high_quality']).nullish(),
   name: z.string().min(1).max(40).nullish(),
-  partial_member_list: z.array(z.record(z.string(), z.string())).nullish(),
+  partial_member_list: z
+    .array(
+      z.object({
+        user_id: z.string().optional(),
+      }),
+    )
+    .nullish(),
   permission: zPermissionEnum.nullish(),
   retrieval_model: zRetrievalModel.nullish(),
 })
@@ -1887,11 +2082,14 @@ export const zDatasetUpdatePayload = z.object({
  * DocumentTextCreatePayload
  */
 export const zDocumentTextCreatePayload = z.object({
-  doc_form: z.string().optional().default('text_model'),
+  doc_form: z
+    .enum(['hierarchical_model', 'qa_model', 'text_model'])
+    .optional()
+    .default('text_model'),
   doc_language: z.string().optional().default('English'),
   embedding_model: z.string().nullish(),
   embedding_model_provider: z.string().nullish(),
-  indexing_technique: z.string().nullish(),
+  indexing_technique: z.enum(['economy', 'high_quality']).nullish(),
   name: z.string(),
   original_document_id: z.string().nullish(),
   process_rule: zProcessRule.nullish(),
@@ -1899,24 +2097,56 @@ export const zDocumentTextCreatePayload = z.object({
   text: z.string(),
 })
 
-/**
- * DocumentTextUpdate
- */
-export const zDocumentTextUpdate = z.object({
-  doc_form: z.string().optional().default('text_model'),
-  doc_language: z.string().optional().default('English'),
-  name: z.string().nullish(),
-  process_rule: zProcessRule.nullish(),
-  retrieval_model: zRetrievalModel.nullish(),
-  text: z.string().nullish(),
-})
+export const zDocumentTextUpdate = z.intersection(
+  z.union([
+    z.object({
+      doc_form: z
+        .enum(['hierarchical_model', 'qa_model', 'text_model'])
+        .optional()
+        .default('text_model'),
+      doc_language: z.string().optional().default('English'),
+      name: z.string(),
+      process_rule: zProcessRule.nullish(),
+      retrieval_model: zRetrievalModel.nullish(),
+      text: z.string(),
+    }),
+    z.object({
+      doc_form: z
+        .enum(['hierarchical_model', 'qa_model', 'text_model'])
+        .optional()
+        .default('text_model'),
+      doc_language: z.string().optional().default('English'),
+      name: z.string().nullish(),
+      process_rule: zProcessRule.nullish(),
+      retrieval_model: zRetrievalModel.nullish(),
+      text: z.null().optional(),
+    }),
+  ]),
+  z.object({
+    doc_form: z
+      .enum(['hierarchical_model', 'qa_model', 'text_model'])
+      .optional()
+      .default('text_model'),
+    doc_language: z.string().optional().default('English'),
+    name: z.string().nullish(),
+    process_rule: zProcessRule.nullish(),
+    retrieval_model: zRetrievalModel.nullish(),
+    text: z.string().nullish(),
+  }),
+)
 
 /**
  * HitTestingPayload
  */
 export const zHitTestingPayload = z.object({
   attachment_ids: z.array(z.string()).nullish(),
-  external_retrieval_model: z.record(z.string(), z.unknown()).nullish(),
+  external_retrieval_model: z
+    .object({
+      score_threshold: z.number().optional(),
+      score_threshold_enabled: z.boolean().optional(),
+      top_k: z.int().optional(),
+    })
+    .nullish(),
   query: z.string().max(250),
   retrieval_model: zRetrievalModel.nullish(),
 })
@@ -1999,10 +2229,37 @@ export const zWorkflowAppLogPaginationResponse = z.object({
  * WorkflowRunPayload
  */
 export const zWorkflowRunPayload = z.object({
-  files: z.array(z.record(z.string(), z.unknown())).nullish(),
+  files: z
+    .array(
+      z.object({
+        transfer_method: z.enum(['local_file', 'remote_url']),
+        type: z.enum(['audio', 'custom', 'document', 'image', 'video']),
+        upload_file_id: z.string().optional(),
+        url: z.string().optional(),
+      }),
+    )
+    .nullish(),
   inputs: z.record(z.string(), z.unknown()),
   response_mode: z.enum(['blocking', 'streaming']).nullish(),
-  trace_session_id: z.string().nullish(),
+})
+
+/**
+ * WorkflowRunPayload
+ */
+export const zWorkflowRunPayloadWithUser = z.object({
+  files: z
+    .array(
+      z.object({
+        transfer_method: z.enum(['local_file', 'remote_url']),
+        type: z.enum(['audio', 'custom', 'document', 'image', 'video']),
+        upload_file_id: z.string().optional(),
+        url: z.string().optional(),
+      }),
+    )
+    .nullish(),
+  inputs: z.record(z.string(), z.unknown()),
+  response_mode: z.enum(['blocking', 'streaming']).nullish(),
+  user: z.string(),
 })
 
 /**
@@ -2071,28 +2328,28 @@ export const zGetAppFeedbacksQuery = z.object({
 })
 
 /**
- * Feedbacks retrieved successfully
+ * A list of application feedbacks.
  */
 export const zGetAppFeedbacksResponse = zAppFeedbackListResponse
 
 export const zPostAppsAnnotationReplyByActionBody = zAnnotationReplyActionPayload
 
 export const zPostAppsAnnotationReplyByActionPath = z.object({
-  action: z.string(),
+  action: z.enum(['disable', 'enable']),
 })
 
 /**
- * Action completed successfully
+ * Annotation reply settings task initiated.
  */
 export const zPostAppsAnnotationReplyByActionResponse = zAnnotationJobStatusResponse
 
 export const zGetAppsAnnotationReplyByActionStatusByJobIdPath = z.object({
-  action: z.string(),
-  job_id: z.string(),
+  action: z.enum(['disable', 'enable']),
+  job_id: z.uuid(),
 })
 
 /**
- * Job status retrieved successfully
+ * Successfully retrieved task status.
  */
 export const zGetAppsAnnotationReplyByActionStatusByJobIdResponse = zAnnotationJobStatusResponse
 
@@ -2103,49 +2360,59 @@ export const zGetAppsAnnotationsQuery = z.object({
 })
 
 /**
- * Annotations retrieved successfully
+ * Successfully retrieved annotation list.
  */
 export const zGetAppsAnnotationsResponse = zAnnotationList
 
 export const zPostAppsAnnotationsBody = zAnnotationCreatePayload
 
 /**
- * Annotation created successfully
+ * Annotation created successfully.
  */
 export const zPostAppsAnnotationsResponse = zAnnotation
 
 export const zDeleteAppsAnnotationsByAnnotationIdPath = z.object({
-  annotation_id: z.string(),
+  annotation_id: z.uuid(),
 })
 
 /**
- * Annotation deleted successfully
+ * Annotation deleted successfully.
  */
 export const zDeleteAppsAnnotationsByAnnotationIdResponse = z.void()
 
 export const zPutAppsAnnotationsByAnnotationIdBody = zAnnotationCreatePayload
 
 export const zPutAppsAnnotationsByAnnotationIdPath = z.object({
-  annotation_id: z.string(),
+  annotation_id: z.uuid(),
 })
 
 /**
- * Annotation updated successfully
+ * Annotation updated successfully.
  */
 export const zPutAppsAnnotationsByAnnotationIdResponse = zAnnotation
 
+export const zPostAudioToTextBody = z.object({
+  file: z.custom<Blob | File>(),
+  user: z.string().optional(),
+})
+
 /**
- * Audio successfully transcribed
+ * Successfully converted audio to text.
  */
 export const zPostAudioToTextResponse = zAudioTranscriptResponse
 
-export const zPostChatMessagesBody = zChatRequestPayload
+export const zPostChatMessagesBody = zChatRequestPayloadWithUser
 
 /**
- * Message sent successfully
+ * Successful response. The content type and structure depend on the `response_mode` parameter in the request.
+ *
+ * - If `response_mode` is `blocking`, returns `application/json` with a `ChatCompletionResponse` object.
+ * - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of Server-Sent Events.
  */
 export const zPostChatMessagesResponse = zGeneratedAppResponse
 
+export const zPostChatMessagesByTaskIdStopBody = zRequiredServiceApiUserPayload
+
 export const zPostChatMessagesByTaskIdStopPath = z.object({
   task_id: z.string(),
 })
@@ -2155,13 +2422,18 @@ export const zPostChatMessagesByTaskIdStopPath = z.object({
  */
 export const zPostChatMessagesByTaskIdStopResponse = zSimpleResultResponse
 
-export const zPostCompletionMessagesBody = zCompletionRequestPayload
+export const zPostCompletionMessagesBody = zCompletionRequestPayloadWithUser
 
 /**
- * Completion created successfully
+ * Successful response. The content type and structure depend on the `response_mode` parameter in the request.
+ *
+ * - If `response_mode` is `blocking`, returns `application/json` with a `CompletionResponse` object.
+ * - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of `ChunkCompletionEvent` objects.
  */
 export const zPostCompletionMessagesResponse = zGeneratedAppResponse
 
+export const zPostCompletionMessagesByTaskIdStopBody = zRequiredServiceApiUserPayload
+
 export const zPostCompletionMessagesByTaskIdStopPath = z.object({
   task_id: z.string(),
 })
@@ -2178,58 +2450,63 @@ export const zGetConversationsQuery = z.object({
     .enum(['-created_at', '-updated_at', 'created_at', 'updated_at'])
     .optional()
     .default('-updated_at'),
+  user: z.string().optional(),
 })
 
 /**
- * Conversations retrieved successfully
+ * Successfully retrieved conversations list.
  */
 export const zGetConversationsResponse = zConversationInfiniteScrollPagination
 
+export const zDeleteConversationsByCIdBody = zOptionalServiceApiUserPayload
+
 export const zDeleteConversationsByCIdPath = z.object({
-  c_id: z.string(),
+  c_id: z.uuid(),
 })
 
 /**
- * Conversation deleted successfully
+ * Conversation deleted successfully.
  */
 export const zDeleteConversationsByCIdResponse = z.void()
 
-export const zPostConversationsByCIdNameBody = zConversationRenamePayload
+export const zPostConversationsByCIdNameBody = zConversationRenamePayloadWithUser
 
 export const zPostConversationsByCIdNamePath = z.object({
-  c_id: z.string(),
+  c_id: z.uuid(),
 })
 
 /**
- * Conversation renamed successfully
+ * Conversation renamed successfully.
  */
 export const zPostConversationsByCIdNameResponse = zSimpleConversation
 
 export const zGetConversationsByCIdVariablesPath = z.object({
-  c_id: z.string(),
+  c_id: z.uuid(),
 })
 
 export const zGetConversationsByCIdVariablesQuery = z.object({
   last_id: z.string().optional(),
   limit: z.int().gte(1).lte(100).optional().default(20),
+  user: z.string().optional(),
   variable_name: z.string().min(1).max(255).optional(),
 })
 
 /**
- * Variables retrieved successfully
+ * Successfully retrieved conversation variables.
  */
 export const zGetConversationsByCIdVariablesResponse
   = zConversationVariableInfiniteScrollPaginationResponse
 
-export const zPutConversationsByCIdVariablesByVariableIdBody = zConversationVariableUpdatePayload
+export const zPutConversationsByCIdVariablesByVariableIdBody
+  = zConversationVariableUpdatePayloadWithUser
 
 export const zPutConversationsByCIdVariablesByVariableIdPath = z.object({
-  c_id: z.string(),
-  variable_id: z.string(),
+  c_id: z.uuid(),
+  variable_id: z.uuid(),
 })
 
 /**
- * Variable updated successfully
+ * Variable updated successfully.
  */
 export const zPutConversationsByCIdVariablesByVariableIdResponse = zConversationVariableResponse
 
@@ -2242,88 +2519,92 @@ export const zGetDatasetsQuery = z.object({
 })
 
 /**
- * Datasets retrieved successfully
+ * List of knowledge bases.
  */
 export const zGetDatasetsResponse = zDatasetListResponse
 
 export const zPostDatasetsBody = zDatasetCreatePayload
 
 /**
- * Dataset created successfully
+ * Knowledge base created successfully.
  */
 export const zPostDatasetsResponse = zDatasetDetailResponse
 
+export const zPostDatasetsPipelineFileUploadBody = z.object({
+  file: z.custom<Blob | File>(),
+})
+
 /**
- * File uploaded successfully
+ * File uploaded successfully.
  */
 export const zPostDatasetsPipelineFileUploadResponse = zPipelineUploadFileResponse
 
 export const zDeleteDatasetsTagsBody = zTagDeletePayload
 
 /**
- * Tag deleted successfully
+ * Success.
  */
 export const zDeleteDatasetsTagsResponse = z.void()
 
 /**
- * Tags retrieved successfully
+ * List of tags.
  */
 export const zGetDatasetsTagsResponse = zKnowledgeTagListResponse
 
 export const zPatchDatasetsTagsBody = zTagUpdatePayload
 
 /**
- * Tag updated successfully
+ * Tag updated successfully.
  */
 export const zPatchDatasetsTagsResponse = zKnowledgeTagResponse
 
 export const zPostDatasetsTagsBody = zTagCreatePayload
 
 /**
- * Tag created successfully
+ * Tag created successfully.
  */
 export const zPostDatasetsTagsResponse = zKnowledgeTagResponse
 
 export const zPostDatasetsTagsBindingBody = zTagBindingPayload
 
 /**
- * Tags bound successfully
+ * Success.
  */
 export const zPostDatasetsTagsBindingResponse = z.void()
 
 export const zPostDatasetsTagsUnbindingBody = zTagUnbindingPayload
 
 /**
- * Tags unbound successfully
+ * Success.
  */
 export const zPostDatasetsTagsUnbindingResponse = z.void()
 
 export const zDeleteDatasetsByDatasetIdPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Dataset deleted successfully
+ * Success.
  */
 export const zDeleteDatasetsByDatasetIdResponse = z.void()
 
 export const zGetDatasetsByDatasetIdPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Dataset retrieved successfully
+ * Knowledge base details.
  */
 export const zGetDatasetsByDatasetIdResponse = zDatasetDetailWithPartialMembersResponse
 
 export const zPatchDatasetsByDatasetIdBody = zDatasetUpdatePayload
 
 export const zPatchDatasetsByDatasetIdPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Dataset updated successfully
+ * Knowledge base updated successfully.
  */
 export const zPatchDatasetsByDatasetIdResponse = zDatasetDetailWithPartialMembersResponse
 
@@ -2333,22 +2614,22 @@ export const zPostDatasetsByDatasetIdDocumentCreateByFileBody = z.object({
 })
 
 export const zPostDatasetsByDatasetIdDocumentCreateByFilePath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Document created successfully
+ * Document created successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentCreateByFileResponse = zDocumentAndBatchResponse
 
 export const zPostDatasetsByDatasetIdDocumentCreateByTextBody = zDocumentTextCreatePayload
 
 export const zPostDatasetsByDatasetIdDocumentCreateByTextPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Document created successfully
+ * Document created successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentCreateByTextResponse = zDocumentAndBatchResponse
 
@@ -2358,18 +2639,18 @@ export const zPostDatasetsByDatasetIdDocumentCreateByFile2Body = z.object({
 })
 
 export const zPostDatasetsByDatasetIdDocumentCreateByFile2Path = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Document created successfully
+ * Document created successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentCreateByFile2Response = zDocumentAndBatchResponse
 
 export const zPostDatasetsByDatasetIdDocumentCreateByText2Body = zDocumentTextCreatePayload
 
 export const zPostDatasetsByDatasetIdDocumentCreateByText2Path = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2378,48 +2659,50 @@ export const zPostDatasetsByDatasetIdDocumentCreateByText2Path = z.object({
 export const zPostDatasetsByDatasetIdDocumentCreateByText2Response = zDocumentAndBatchResponse
 
 export const zGetDatasetsByDatasetIdDocumentsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 export const zGetDatasetsByDatasetIdDocumentsQuery = z.object({
   keyword: z.string().optional(),
   limit: z.int().optional().default(20),
   page: z.int().optional().default(1),
-  status: z.string().optional(),
+  status: z
+    .enum(['archived', 'available', 'disabled', 'error', 'indexing', 'paused', 'queuing'])
+    .optional(),
 })
 
 /**
- * Documents retrieved successfully
+ * List of documents.
  */
 export const zGetDatasetsByDatasetIdDocumentsResponse = zDocumentListResponse
 
 export const zPostDatasetsByDatasetIdDocumentsDownloadZipBody = zDocumentBatchDownloadZipPayload
 
 export const zPostDatasetsByDatasetIdDocumentsDownloadZipPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * ZIP archive generated successfully
+ * ZIP archive containing the requested documents.
  */
-export const zPostDatasetsByDatasetIdDocumentsDownloadZipResponse = zBinaryFileResponse
+export const zPostDatasetsByDatasetIdDocumentsDownloadZipResponse = z.custom<Blob | File>()
 
 export const zPostDatasetsByDatasetIdDocumentsMetadataBody = zMetadataOperationData
 
 export const zPostDatasetsByDatasetIdDocumentsMetadataPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Documents metadata updated successfully
+ * Document metadata updated successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentsMetadataResponse = zDatasetMetadataActionResponse
 
 export const zPatchDatasetsByDatasetIdDocumentsStatusByActionBody = zDocumentStatusPayload
 
 export const zPatchDatasetsByDatasetIdDocumentsStatusByActionPath = z.object({
-  action: z.string(),
-  dataset_id: z.string(),
+  action: z.enum(['archive', 'disable', 'enable', 'un_archive']),
+  dataset_id: z.uuid(),
 })
 
 /**
@@ -2429,28 +2712,28 @@ export const zPatchDatasetsByDatasetIdDocumentsStatusByActionResponse = zSimpleR
 
 export const zGetDatasetsByDatasetIdDocumentsByBatchIndexingStatusPath = z.object({
   batch: z.string(),
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Indexing status retrieved successfully
+ * Indexing status for documents in the batch.
  */
 export const zGetDatasetsByDatasetIdDocumentsByBatchIndexingStatusResponse
   = zDocumentStatusListResponse
 
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
- * Document deleted successfully
+ * Success.
  */
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdResponse = z.void()
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdQuery = z.object({
@@ -2458,7 +2741,7 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdQuery = z.object({
 })
 
 /**
- * Document retrieved successfully
+ * Document details. The response shape varies based on the `metadata` query parameter. When `metadata` is `only`, only `id`, `doc_type`, and `doc_metadata` are returned. When `metadata` is `without`, `doc_type` and `doc_metadata` are omitted.
  */
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdResponse = zDocumentDetailResponse
 
@@ -2468,8 +2751,8 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdBody = z.object({
 })
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -2478,18 +2761,18 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdPath = z.object({
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdResponse = zDocumentAndBatchResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdDownloadPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
- * Download URL generated successfully
+ * Download URL generated successfully.
  */
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdDownloadResponse = zUrlResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsQuery = z.object({
@@ -2500,42 +2783,42 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsQuery = z.objec
 })
 
 /**
- * Segments retrieved successfully
+ * List of chunks.
  */
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsResponse = zSegmentListResponse
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBody = zSegmentCreatePayload
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
- * Segments created successfully
+ * Chunks created successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsResponse
   = zSegmentCreateListResponse
 
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
-  segment_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
+  segment_id: z.uuid(),
 })
 
 /**
- * Segment deleted successfully
+ * Success.
  */
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdResponse = z.void()
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
-  segment_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
+  segment_id: z.uuid(),
 })
 
 /**
- * Segment retrieved successfully
+ * Chunk details.
  */
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdResponse
   = zSegmentDetailResponse
@@ -2544,22 +2827,22 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdBod
   = zSegmentUpdatePayload
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
-  segment_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
+  segment_id: z.uuid(),
 })
 
 /**
- * Segment updated successfully
+ * Chunk updated successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdResponse
   = zSegmentDetailResponse
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksPath
   = z.object({
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksQuery
@@ -2570,7 +2853,7 @@ export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChil
   })
 
 /**
- * Child chunks retrieved successfully
+ * List of child chunks.
  */
 export const zGetDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksResponse
   = zChildChunkListResponse
@@ -2580,27 +2863,27 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChi
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksPath
   = z.object({
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 /**
- * Child chunk created successfully
+ * Child chunk created successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksResponse
   = zChildChunkDetailResponse
 
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkIdPath
   = z.object({
-    child_chunk_id: z.string(),
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    child_chunk_id: z.uuid(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 /**
- * Child chunk deleted successfully
+ * Success.
  */
 export const zDeleteDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkIdResponse
   = z.void()
@@ -2610,14 +2893,14 @@ export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdCh
 
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkIdPath
   = z.object({
-    child_chunk_id: z.string(),
-    dataset_id: z.string(),
-    document_id: z.string(),
-    segment_id: z.string(),
+    child_chunk_id: z.uuid(),
+    dataset_id: z.uuid(),
+    document_id: z.uuid(),
+    segment_id: z.uuid(),
   })
 
 /**
- * Child chunk updated successfully
+ * Child chunk updated successfully.
  */
 export const zPatchDatasetsByDatasetIdDocumentsByDocumentIdSegmentsBySegmentIdChildChunksByChildChunkIdResponse
   = zChildChunkDetailResponse
@@ -2628,12 +2911,12 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFileBody = z.o
 })
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFilePath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
- * Document updated successfully
+ * Document updated successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFileResponse
   = zDocumentAndBatchResponse
@@ -2641,12 +2924,12 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFileResponse
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByTextBody = zDocumentTextUpdate
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByTextPath = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
- * Document updated successfully
+ * Document updated successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByTextResponse
   = zDocumentAndBatchResponse
@@ -2657,12 +2940,12 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFile2Body = z.
 })
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFile2Path = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
- * Document updated successfully
+ * Document updated successfully.
  */
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFile2Response
   = zDocumentAndBatchResponse
@@ -2670,8 +2953,8 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByFile2Response
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByText2Body = zDocumentTextUpdate
 
 export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByText2Path = z.object({
-  dataset_id: z.string(),
-  document_id: z.string(),
+  dataset_id: z.uuid(),
+  document_id: z.uuid(),
 })
 
 /**
@@ -2683,78 +2966,78 @@ export const zPostDatasetsByDatasetIdDocumentsByDocumentIdUpdateByText2Response
 export const zPostDatasetsByDatasetIdHitTestingBody = zHitTestingPayload
 
 export const zPostDatasetsByDatasetIdHitTestingPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Hit testing results
+ * Retrieval results.
  */
 export const zPostDatasetsByDatasetIdHitTestingResponse = zHitTestingResponse
 
 export const zGetDatasetsByDatasetIdMetadataPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Metadata retrieved successfully
+ * Metadata fields for the knowledge base.
  */
 export const zGetDatasetsByDatasetIdMetadataResponse = zDatasetMetadataListResponse
 
 export const zPostDatasetsByDatasetIdMetadataBody = zMetadataArgs
 
 export const zPostDatasetsByDatasetIdMetadataPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Metadata created successfully
+ * Metadata field created successfully.
  */
 export const zPostDatasetsByDatasetIdMetadataResponse = zDatasetMetadataResponse
 
 export const zGetDatasetsByDatasetIdMetadataBuiltInPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Built-in fields retrieved successfully
+ * Built-in metadata fields.
  */
 export const zGetDatasetsByDatasetIdMetadataBuiltInResponse = zDatasetMetadataBuiltInFieldsResponse
 
 export const zPostDatasetsByDatasetIdMetadataBuiltInByActionPath = z.object({
-  action: z.string(),
-  dataset_id: z.string(),
+  action: z.enum(['disable', 'enable']),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Action completed successfully
+ * Built-in metadata field toggled successfully.
  */
 export const zPostDatasetsByDatasetIdMetadataBuiltInByActionResponse
   = zDatasetMetadataActionResponse
 
 export const zDeleteDatasetsByDatasetIdMetadataByMetadataIdPath = z.object({
-  dataset_id: z.string(),
-  metadata_id: z.string(),
+  dataset_id: z.uuid(),
+  metadata_id: z.uuid(),
 })
 
 /**
- * Metadata deleted successfully
+ * Success.
  */
 export const zDeleteDatasetsByDatasetIdMetadataByMetadataIdResponse = z.void()
 
 export const zPatchDatasetsByDatasetIdMetadataByMetadataIdBody = zMetadataUpdatePayload
 
 export const zPatchDatasetsByDatasetIdMetadataByMetadataIdPath = z.object({
-  dataset_id: z.string(),
-  metadata_id: z.string(),
+  dataset_id: z.uuid(),
+  metadata_id: z.uuid(),
 })
 
 /**
- * Metadata updated successfully
+ * Metadata field updated successfully.
  */
 export const zPatchDatasetsByDatasetIdMetadataByMetadataIdResponse = zDatasetMetadataResponse
 
 export const zGetDatasetsByDatasetIdPipelineDatasourcePluginsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 export const zGetDatasetsByDatasetIdPipelineDatasourcePluginsQuery = z.object({
@@ -2762,7 +3045,7 @@ export const zGetDatasetsByDatasetIdPipelineDatasourcePluginsQuery = z.object({
 })
 
 /**
- * Datasource plugins retrieved successfully
+ * List of datasource nodes configured in the pipeline.
  */
 export const zGetDatasetsByDatasetIdPipelineDatasourcePluginsResponse
   = zDatasourcePluginListResponse
@@ -2771,12 +3054,12 @@ export const zPostDatasetsByDatasetIdPipelineDatasourceNodesByNodeIdRunBody
   = zDatasourceNodeRunPayload
 
 export const zPostDatasetsByDatasetIdPipelineDatasourceNodesByNodeIdRunPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
   node_id: z.string(),
 })
 
 /**
- * Datasource node run successfully
+ * Streaming response with node execution events.
  */
 export const zPostDatasetsByDatasetIdPipelineDatasourceNodesByNodeIdRunResponse
   = zGeneratedAppResponse
@@ -2784,83 +3067,89 @@ export const zPostDatasetsByDatasetIdPipelineDatasourceNodesByNodeIdRunResponse
 export const zPostDatasetsByDatasetIdPipelineRunBody = zPipelineRunApiEntity
 
 export const zPostDatasetsByDatasetIdPipelineRunPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Pipeline run successfully
+ * Pipeline execution result. Format depends on `response_mode`: streaming returns a `text/event-stream`, blocking returns a JSON object.
  */
 export const zPostDatasetsByDatasetIdPipelineRunResponse = zGeneratedAppResponse
 
 export const zPostDatasetsByDatasetIdRetrieveBody = zHitTestingPayload
 
 export const zPostDatasetsByDatasetIdRetrievePath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Hit testing results
+ * Retrieval results.
  */
 export const zPostDatasetsByDatasetIdRetrieveResponse = zHitTestingResponse
 
 export const zGetDatasetsByDatasetIdTagsPath = z.object({
-  dataset_id: z.string(),
+  dataset_id: z.uuid(),
 })
 
 /**
- * Tags retrieved successfully
+ * Tags bound to the knowledge base.
  */
 export const zGetDatasetsByDatasetIdTagsResponse = zDatasetBoundTagListResponse
 
 export const zGetEndUsersByEndUserIdPath = z.object({
-  end_user_id: z.string(),
+  end_user_id: z.uuid(),
 })
 
 /**
- * End user retrieved successfully
+ * End user retrieved successfully.
  */
 export const zGetEndUsersByEndUserIdResponse = zEndUserDetail
 
+export const zPostFilesUploadBody = z.object({
+  file: z.custom<Blob | File>(),
+  user: z.string().optional(),
+})
+
 /**
- * File uploaded successfully
+ * File uploaded successfully.
  */
 export const zPostFilesUploadResponse = zFileResponse
 
 export const zGetFilesByFileIdPreviewPath = z.object({
-  file_id: z.string(),
+  file_id: z.uuid(),
 })
 
 export const zGetFilesByFileIdPreviewQuery = z.object({
   as_attachment: z.boolean().optional().default(false),
+  user: z.string().optional(),
 })
 
 /**
- * File retrieved successfully
+ * Returns the raw file content. The `Content-Type` header is set to the file's MIME type. If `as_attachment` is `true`, the file is returned as a download with `Content-Disposition: attachment`.
  */
-export const zGetFilesByFileIdPreviewResponse = zBinaryFileResponse
+export const zGetFilesByFileIdPreviewResponse = z.custom<Blob | File>()
 
 export const zGetFormHumanInputByFormTokenPath = z.object({
   form_token: z.string(),
 })
 
 /**
- * Form retrieved successfully
+ * Form contents retrieved successfully.
  */
 export const zGetFormHumanInputByFormTokenResponse = zHumanInputFormDefinitionResponse
 
-export const zPostFormHumanInputByFormTokenBody = zHumanInputFormSubmitPayload
+export const zPostFormHumanInputByFormTokenBody = zHumanInputFormSubmitPayloadWithUser
 
 export const zPostFormHumanInputByFormTokenPath = z.object({
   form_token: z.string(),
 })
 
 /**
- * Form submitted successfully
+ * Form submitted successfully. The response body is an empty object.
  */
 export const zPostFormHumanInputByFormTokenResponse = zHumanInputFormSubmitResponse
 
 /**
- * Application info retrieved successfully
+ * Basic information of the application.
  */
 export const zGetInfoResponse = zAppInfoResponse
 
@@ -2868,17 +3157,18 @@ export const zGetMessagesQuery = z.object({
   conversation_id: z.string(),
   first_id: z.string().optional(),
   limit: z.int().gte(1).lte(100).optional().default(20),
+  user: z.string().optional(),
 })
 
 /**
- * Messages retrieved successfully
+ * Successfully retrieved conversation history.
  */
 export const zGetMessagesResponse = zMessageInfiniteScrollPagination
 
-export const zPostMessagesByMessageIdFeedbacksBody = zMessageFeedbackPayload
+export const zPostMessagesByMessageIdFeedbacksBody = zMessageFeedbackPayloadWithUser
 
 export const zPostMessagesByMessageIdFeedbacksPath = z.object({
-  message_id: z.string(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -2887,7 +3177,11 @@ export const zPostMessagesByMessageIdFeedbacksPath = z.object({
 export const zPostMessagesByMessageIdFeedbacksResponse = zResultResponse
 
 export const zGetMessagesByMessageIdSuggestedPath = z.object({
-  message_id: z.string(),
+  message_id: z.uuid(),
+})
+
+export const zGetMessagesByMessageIdSuggestedQuery = z.object({
+  user: z.string(),
 })
 
 /**
@@ -2896,26 +3190,26 @@ export const zGetMessagesByMessageIdSuggestedPath = z.object({
 export const zGetMessagesByMessageIdSuggestedResponse = zSimpleResultStringListResponse
 
 /**
- * Metadata retrieved successfully
+ * Successfully retrieved application meta information.
  */
 export const zGetMetaResponse = zAppMetaResponse
 
 /**
- * Parameters retrieved successfully
+ * Application parameters information.
  */
 export const zGetParametersResponse = zParameters
 
 /**
- * Site configuration retrieved successfully
+ * WebApp settings of the application.
  */
 export const zGetSiteResponse = zSite
 
-export const zPostTextToAudioBody = zTextToAudioPayload
+export const zPostTextToAudioBody = zTextToAudioPayloadWithUser
 
 /**
- * Text successfully converted to audio
+ * Returns the generated audio. Generator responses are streamed by the service as `audio/mpeg`; otherwise the provider output is returned directly.
  */
-export const zPostTextToAudioResponse = zAudioBinaryResponse
+export const zPostTextToAudioResponse = z.custom<Blob | File>()
 
 export const zGetWorkflowByTaskIdEventsPath = z.object({
   task_id: z.string(),
@@ -2928,13 +3222,13 @@ export const zGetWorkflowByTaskIdEventsQuery = z.object({
 })
 
 /**
- * SSE event stream
+ * Server-Sent Events stream. Each event is delivered as `data: {JSON}\n\n`. Event payloads follow the same schemas as the original streaming response.
  */
 export const zGetWorkflowByTaskIdEventsResponse = zEventStreamResponse
 
 export const zGetWorkflowsLogsQuery = z.object({
-  created_at__after: z.string().optional(),
-  created_at__before: z.string().optional(),
+  created_at__after: z.iso.datetime().optional(),
+  created_at__before: z.iso.datetime().optional(),
   created_by_account: z.string().optional(),
   created_by_end_user_session_id: z.string().optional(),
   keyword: z.string().optional(),
@@ -2944,14 +3238,17 @@ export const zGetWorkflowsLogsQuery = z.object({
 })
 
 /**
- * Logs retrieved successfully
+ * Successfully retrieved workflow logs.
  */
 export const zGetWorkflowsLogsResponse = zWorkflowAppLogPaginationResponse
 
-export const zPostWorkflowsRunBody = zWorkflowRunPayload
+export const zPostWorkflowsRunBody = zWorkflowRunPayloadWithUser
 
 /**
- * Workflow executed successfully
+ * Successful response. The content type and structure depend on the `response_mode` parameter in the request.
+ *
+ * - If `response_mode` is `blocking`, returns `application/json` with a `WorkflowBlockingResponse` object.
+ * - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of `ChunkWorkflowEvent` objects.
  */
 export const zPostWorkflowsRunResponse = zGeneratedAppResponse
 
@@ -2960,10 +3257,12 @@ export const zGetWorkflowsRunByWorkflowRunIdPath = z.object({
 })
 
 /**
- * Workflow run details retrieved successfully
+ * Successfully retrieved workflow run details.
  */
 export const zGetWorkflowsRunByWorkflowRunIdResponse = zWorkflowRunResponse
 
+export const zPostWorkflowsTasksByTaskIdStopBody = zRequiredServiceApiUserPayload
+
 export const zPostWorkflowsTasksByTaskIdStopPath = z.object({
   task_id: z.string(),
 })
@@ -2973,23 +3272,26 @@ export const zPostWorkflowsTasksByTaskIdStopPath = z.object({
  */
 export const zPostWorkflowsTasksByTaskIdStopResponse = zSimpleResultResponse
 
-export const zPostWorkflowsByWorkflowIdRunBody = zWorkflowRunPayload
+export const zPostWorkflowsByWorkflowIdRunBody = zWorkflowRunPayloadWithUser
 
 export const zPostWorkflowsByWorkflowIdRunPath = z.object({
   workflow_id: z.string(),
 })
 
 /**
- * Workflow executed successfully
+ * Successful response. The content type and structure depend on the `response_mode` parameter in the request.
+ *
+ * - If `response_mode` is `blocking`, returns `application/json` with a `WorkflowBlockingResponse` object.
+ * - If `response_mode` is `streaming`, returns `text/event-stream` with a stream of `ChunkWorkflowEvent` objects.
  */
 export const zPostWorkflowsByWorkflowIdRunResponse = zGeneratedAppResponse
 
 export const zGetWorkspacesCurrentModelsModelTypesByModelTypePath = z.object({
-  model_type: z.string(),
+  model_type: z.enum(['llm', 'moderation', 'rerank', 'speech2text', 'text-embedding', 'tts']),
 })
 
 /**
- * Models retrieved successfully
+ * Available models for the specified type.
  */
 export const zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse
   = zProviderWithModelsListResponse
diff --git a/packages/contracts/generated/api/web/types.gen.ts b/packages/contracts/generated/api/web/types.gen.ts
index 9d16cb99524..61c9cf103be 100644
--- a/packages/contracts/generated/api/web/types.gen.ts
+++ b/packages/contracts/generated/api/web/types.gen.ts
@@ -146,7 +146,16 @@ export type ConversationListQuery = {
   sort_by?: '-created_at' | '-updated_at' | 'created_at' | 'updated_at'
 }
 
-export type ConversationRenamePayload = {
+export type ConversationRenamePayload = (
+  | {
+    auto_generate: true
+    name?: string | null
+  }
+  | {
+    auto_generate?: false
+    name: string
+  }
+) & {
   auto_generate?: boolean
   name?: string | null
 }
@@ -540,6 +549,7 @@ export type SuggestedQuestionsResponse = {
 
 export type SystemFeatureModel = {
   branding: BrandingModel
+  enable_app_deploy: boolean
   enable_change_email: boolean
   enable_collaboration_mode: boolean
   enable_creators_platform: boolean
@@ -556,6 +566,7 @@ export type SystemFeatureModel = {
   max_plugin_package_size: number
   plugin_installation_permission: PluginInstallationPermissionModel
   plugin_manager: PluginManagerModel
+  rbac_enabled: boolean
   sso_enforced_for_signin: boolean
   sso_enforced_for_signin_protocol: string
   webapp_auth: WebAppAuthModel
@@ -630,7 +641,10 @@ export type WebMessageListItem = {
 
 export type WorkflowRunPayload = {
   files?: Array<{
-    [key: string]: unknown
+    transfer_method: 'local_file' | 'remote_url'
+    type: 'audio' | 'custom' | 'document' | 'image' | 'video'
+    upload_file_id?: string
+    url?: string
   }> | null
   inputs: {
     [key: string]: unknown
diff --git a/packages/contracts/generated/api/web/zod.gen.ts b/packages/contracts/generated/api/web/zod.gen.ts
index cb731344ab6..8045ad341e3 100644
--- a/packages/contracts/generated/api/web/zod.gen.ts
+++ b/packages/contracts/generated/api/web/zod.gen.ts
@@ -168,13 +168,22 @@ export const zConversationListQuery = z.object({
     .default('-updated_at'),
 })
 
-/**
- * ConversationRenamePayload
- */
-export const zConversationRenamePayload = z.object({
-  auto_generate: z.boolean().optional().default(false),
-  name: z.string().nullish(),
-})
+export const zConversationRenamePayload = z.intersection(
+  z.union([
+    z.object({
+      auto_generate: z.literal(true),
+      name: z.string().nullish(),
+    }),
+    z.object({
+      auto_generate: z.literal(false).optional().default(false),
+      name: z.string().regex(/.*\S.*/),
+    }),
+  ]),
+  z.object({
+    auto_generate: z.boolean().optional().default(false),
+    name: z.string().nullish(),
+  }),
+)
 
 /**
  * EmailCodeLoginSendPayload
@@ -687,7 +696,7 @@ export const zParameters = z.object({
  * TextToAudioPayload
  */
 export const zTextToAudioPayload = z.object({
-  message_id: z.string().nullish(),
+  message_id: z.uuid().nullish(),
   streaming: z.boolean().nullish(),
   text: z.string().nullish(),
   voice: z.string().nullish(),
@@ -824,6 +833,7 @@ export const zSystemFeatureModel = z.object({
     login_page_logo: '',
     workspace_logo: '',
   }),
+  enable_app_deploy: z.boolean().default(false),
   enable_change_email: z.boolean().default(true),
   enable_collaboration_mode: z.boolean().default(true),
   enable_creators_platform: z.boolean().default(false),
@@ -851,6 +861,7 @@ export const zSystemFeatureModel = z.object({
     restrict_to_marketplace_only: false,
   }),
   plugin_manager: zPluginManagerModel.default({ enabled: false }),
+  rbac_enabled: z.boolean().default(false),
   sso_enforced_for_signin: z.boolean().default(false),
   sso_enforced_for_signin_protocol: z.string().default(''),
   webapp_auth: zWebAppAuthModel.default({
@@ -896,7 +907,16 @@ export const zWebMessageInfiniteScrollPagination = z.object({
  * WorkflowRunPayload
  */
 export const zWorkflowRunPayload = z.object({
-  files: z.array(z.record(z.string(), z.unknown())).nullish(),
+  files: z
+    .array(
+      z.object({
+        transfer_method: z.enum(['local_file', 'remote_url']),
+        type: z.enum(['audio', 'custom', 'document', 'image', 'video']),
+        upload_file_id: z.string().optional(),
+        url: z.string().optional(),
+      }),
+    )
+    .nullish(),
   inputs: z.record(z.string(), z.unknown()),
 })
 
@@ -953,7 +973,7 @@ export const zGetConversationsQuery = z.object({
 export const zGetConversationsResponse = zConversationInfiniteScrollPagination
 
 export const zDeleteConversationsByCIdPath = z.object({
-  c_id: z.string(),
+  c_id: z.uuid(),
 })
 
 /**
@@ -964,7 +984,7 @@ export const zDeleteConversationsByCIdResponse = z.void()
 export const zPostConversationsByCIdNameBody = zConversationRenamePayload
 
 export const zPostConversationsByCIdNamePath = z.object({
-  c_id: z.string(),
+  c_id: z.uuid(),
 })
 
 export const zPostConversationsByCIdNameQuery = z.object({
@@ -978,7 +998,7 @@ export const zPostConversationsByCIdNameQuery = z.object({
 export const zPostConversationsByCIdNameResponse = zSimpleConversation
 
 export const zPatchConversationsByCIdPinPath = z.object({
-  c_id: z.string(),
+  c_id: z.uuid(),
 })
 
 /**
@@ -987,7 +1007,7 @@ export const zPatchConversationsByCIdPinPath = z.object({
 export const zPatchConversationsByCIdPinResponse = zResultResponse
 
 export const zPatchConversationsByCIdUnpinPath = z.object({
-  c_id: z.string(),
+  c_id: z.uuid(),
 })
 
 /**
@@ -1105,7 +1125,7 @@ export const zGetMessagesResponse = zWebMessageInfiniteScrollPagination
 export const zPostMessagesByMessageIdFeedbacksBody = zMessageFeedbackPayload
 
 export const zPostMessagesByMessageIdFeedbacksPath = z.object({
-  message_id: z.string(),
+  message_id: z.uuid(),
 })
 
 export const zPostMessagesByMessageIdFeedbacksQuery = z.object({
@@ -1119,7 +1139,7 @@ export const zPostMessagesByMessageIdFeedbacksQuery = z.object({
 export const zPostMessagesByMessageIdFeedbacksResponse = zResultResponse
 
 export const zGetMessagesByMessageIdMoreLikeThisPath = z.object({
-  message_id: z.string(),
+  message_id: z.uuid(),
 })
 
 export const zGetMessagesByMessageIdMoreLikeThisQuery = z.object({
@@ -1132,7 +1152,7 @@ export const zGetMessagesByMessageIdMoreLikeThisQuery = z.object({
 export const zGetMessagesByMessageIdMoreLikeThisResponse = zGeneratedAppResponse
 
 export const zGetMessagesByMessageIdSuggestedQuestionsPath = z.object({
-  message_id: z.string(),
+  message_id: z.uuid(),
 })
 
 /**
@@ -1197,7 +1217,7 @@ export const zPostSavedMessagesQuery = z.object({
 export const zPostSavedMessagesResponse = zResultResponse
 
 export const zDeleteSavedMessagesByMessageIdPath = z.object({
-  message_id: z.string(),
+  message_id: z.uuid(),
 })
 
 /**
diff --git a/packages/contracts/generated/enterprise/orpc.gen.ts b/packages/contracts/generated/enterprise/orpc.gen.ts
index 6b9b76470aa..61503a7f742 100644
--- a/packages/contracts/generated/enterprise/orpc.gen.ts
+++ b/packages/contracts/generated/enterprise/orpc.gen.ts
@@ -4,9 +4,97 @@ import { oc } from '@orpc/contract'
 import * as z from 'zod'
 
 import {
+  zAccessServiceCreateApiKeyBody,
+  zAccessServiceCreateApiKeyPath,
+  zAccessServiceCreateApiKeyResponse,
+  zAccessServiceDeleteApiKeyPath,
+  zAccessServiceDeleteApiKeyResponse,
+  zAccessServiceGetAccessChannelsPath,
+  zAccessServiceGetAccessChannelsResponse,
+  zAccessServiceGetAccessPolicyPath,
+  zAccessServiceGetAccessPolicyResponse,
+  zAccessServiceGetAccessSettingsPath,
+  zAccessServiceGetAccessSettingsResponse,
+  zAccessServiceGetDeveloperApiSettingsPath,
+  zAccessServiceGetDeveloperApiSettingsResponse,
+  zAccessServiceListApiKeysPath,
+  zAccessServiceListApiKeysResponse,
+  zAccessServiceUpdateAccessChannelsBody,
+  zAccessServiceUpdateAccessChannelsPath,
+  zAccessServiceUpdateAccessChannelsResponse,
+  zAccessServiceUpdateAccessPolicyBody,
+  zAccessServiceUpdateAccessPolicyPath,
+  zAccessServiceUpdateAccessPolicyResponse,
+  zAccessSubjectServiceListAccessSubjectsQuery,
+  zAccessSubjectServiceListAccessSubjectsResponse,
+  zAppInstanceServiceCreateAppInstanceBody,
+  zAppInstanceServiceCreateAppInstanceResponse,
+  zAppInstanceServiceDeleteAppInstancePath,
+  zAppInstanceServiceDeleteAppInstanceResponse,
+  zAppInstanceServiceGetAppInstanceOverviewPath,
+  zAppInstanceServiceGetAppInstanceOverviewResponse,
+  zAppInstanceServiceGetAppInstancePath,
+  zAppInstanceServiceGetAppInstanceResponse,
+  zAppInstanceServiceListAppInstancesQuery,
+  zAppInstanceServiceListAppInstancesResponse,
+  zAppInstanceServiceListAppInstanceSummariesQuery,
+  zAppInstanceServiceListAppInstanceSummariesResponse,
+  zAppInstanceServiceUpdateAppInstanceBody,
+  zAppInstanceServiceUpdateAppInstancePath,
+  zAppInstanceServiceUpdateAppInstanceResponse,
   zConsoleSsoOAuth2LoginResponse,
   zConsoleSsoOidcLoginResponse,
   zConsoleSsoSamlLoginResponse,
+  zDeploymentServiceCancelDeploymentBody,
+  zDeploymentServiceCancelDeploymentPath,
+  zDeploymentServiceCancelDeploymentResponse,
+  zDeploymentServiceDeployBody,
+  zDeploymentServiceDeployResponse,
+  zDeploymentServiceListDeploymentsPath,
+  zDeploymentServiceListDeploymentsQuery,
+  zDeploymentServiceListDeploymentsResponse,
+  zDeploymentServiceListEnvironmentDeploymentsPath,
+  zDeploymentServiceListEnvironmentDeploymentsResponse,
+  zDeploymentServiceListRollbackTargetsPath,
+  zDeploymentServiceListRollbackTargetsQuery,
+  zDeploymentServiceListRollbackTargetsResponse,
+  zDeploymentServicePromoteBody,
+  zDeploymentServicePromotePath,
+  zDeploymentServicePromoteResponse,
+  zDeploymentServiceRollbackBody,
+  zDeploymentServiceRollbackPath,
+  zDeploymentServiceRollbackResponse,
+  zDeploymentServiceUndeployBody,
+  zDeploymentServiceUndeployPath,
+  zDeploymentServiceUndeployResponse,
+  zEnvironmentServiceListEnvironmentsQuery,
+  zEnvironmentServiceListEnvironmentsResponse,
+  zReleaseServiceComputeDeploymentOptionsBody,
+  zReleaseServiceComputeDeploymentOptionsResponse,
+  zReleaseServiceComputeReleaseDeploymentViewPath,
+  zReleaseServiceComputeReleaseDeploymentViewQuery,
+  zReleaseServiceComputeReleaseDeploymentViewResponse,
+  zReleaseServiceCreateReleaseBody,
+  zReleaseServiceCreateReleaseResponse,
+  zReleaseServiceDeleteReleasePath,
+  zReleaseServiceDeleteReleaseResponse,
+  zReleaseServiceExportReleaseDslPath,
+  zReleaseServiceExportReleaseDslResponse,
+  zReleaseServiceGetReleasePath,
+  zReleaseServiceGetReleaseResponse,
+  zReleaseServiceListReleaseCredentialCandidatesPath,
+  zReleaseServiceListReleaseCredentialCandidatesResponse,
+  zReleaseServiceListReleasesPath,
+  zReleaseServiceListReleasesQuery,
+  zReleaseServiceListReleasesResponse,
+  zReleaseServiceListReleaseSummariesPath,
+  zReleaseServiceListReleaseSummariesQuery,
+  zReleaseServiceListReleaseSummariesResponse,
+  zReleaseServicePrecheckReleaseBody,
+  zReleaseServicePrecheckReleaseResponse,
+  zReleaseServiceUpdateReleaseBody,
+  zReleaseServiceUpdateReleasePath,
+  zReleaseServiceUpdateReleaseResponse,
   zWebAppAuthGetGroupSubjectsQuery,
   zWebAppAuthGetGroupSubjectsResponse,
   zWebAppAuthGetWebAppAccessModeQuery,
@@ -21,6 +109,524 @@ import {
   zWebAppAuthUpdateWebAppWhitelistSubjectsResponse,
 } from './zod.gen'
 
+export const listAccessSubjects = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AccessSubjectService_ListAccessSubjects',
+    path: '/enterprise/access-subjects',
+    tags: ['AccessSubjectService'],
+  })
+  .input(z.object({ query: zAccessSubjectServiceListAccessSubjectsQuery.optional() }))
+  .output(zAccessSubjectServiceListAccessSubjectsResponse)
+
+export const accessSubjectService = {
+  listAccessSubjects,
+}
+
+export const listAppInstanceSummaries = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AppInstanceService_ListAppInstanceSummaries',
+    path: '/enterprise/app-deploy/appInstanceSummaries',
+    tags: ['AppInstanceService'],
+  })
+  .input(z.object({ query: zAppInstanceServiceListAppInstanceSummariesQuery.optional() }))
+  .output(zAppInstanceServiceListAppInstanceSummariesResponse)
+
+export const listAppInstances = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AppInstanceService_ListAppInstances',
+    path: '/enterprise/app-deploy/appInstances',
+    tags: ['AppInstanceService'],
+  })
+  .input(z.object({ query: zAppInstanceServiceListAppInstancesQuery.optional() }))
+  .output(zAppInstanceServiceListAppInstancesResponse)
+
+export const createAppInstance = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'AppInstanceService_CreateAppInstance',
+    path: '/enterprise/app-deploy/appInstances',
+    tags: ['AppInstanceService'],
+  })
+  .input(z.object({ body: zAppInstanceServiceCreateAppInstanceBody }))
+  .output(zAppInstanceServiceCreateAppInstanceResponse)
+
+export const deleteAppInstance = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId: 'AppInstanceService_DeleteAppInstance',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}',
+    tags: ['AppInstanceService'],
+  })
+  .input(z.object({ params: zAppInstanceServiceDeleteAppInstancePath }))
+  .output(zAppInstanceServiceDeleteAppInstanceResponse)
+
+export const getAppInstance = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AppInstanceService_GetAppInstance',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}',
+    tags: ['AppInstanceService'],
+  })
+  .input(z.object({ params: zAppInstanceServiceGetAppInstancePath }))
+  .output(zAppInstanceServiceGetAppInstanceResponse)
+
+export const updateAppInstance = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PATCH',
+    operationId: 'AppInstanceService_UpdateAppInstance',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}',
+    tags: ['AppInstanceService'],
+  })
+  .input(
+    z.object({
+      body: zAppInstanceServiceUpdateAppInstanceBody,
+      params: zAppInstanceServiceUpdateAppInstancePath,
+    }),
+  )
+  .output(zAppInstanceServiceUpdateAppInstanceResponse)
+
+export const getAppInstanceOverview = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AppInstanceService_GetAppInstanceOverview',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}:getOverview',
+    tags: ['AppInstanceService'],
+  })
+  .input(z.object({ params: zAppInstanceServiceGetAppInstanceOverviewPath }))
+  .output(zAppInstanceServiceGetAppInstanceOverviewResponse)
+
+export const appInstanceService = {
+  listAppInstanceSummaries,
+  listAppInstances,
+  createAppInstance,
+  deleteAppInstance,
+  getAppInstance,
+  updateAppInstance,
+  getAppInstanceOverview,
+}
+
+export const getAccessChannels = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AccessService_GetAccessChannels',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/accessChannels',
+    tags: ['AccessService'],
+  })
+  .input(z.object({ params: zAccessServiceGetAccessChannelsPath }))
+  .output(zAccessServiceGetAccessChannelsResponse)
+
+export const updateAccessChannels = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'AccessService_UpdateAccessChannels',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/accessChannels',
+    tags: ['AccessService'],
+  })
+  .input(
+    z.object({
+      body: zAccessServiceUpdateAccessChannelsBody,
+      params: zAccessServiceUpdateAccessChannelsPath,
+    }),
+  )
+  .output(zAccessServiceUpdateAccessChannelsResponse)
+
+export const getAccessSettings = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AccessService_GetAccessSettings',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/accessSettings',
+    tags: ['AccessService'],
+  })
+  .input(z.object({ params: zAccessServiceGetAccessSettingsPath }))
+  .output(zAccessServiceGetAccessSettingsResponse)
+
+export const getDeveloperApiSettings = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AccessService_GetDeveloperApiSettings',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/developerApiSettings',
+    tags: ['AccessService'],
+  })
+  .input(z.object({ params: zAccessServiceGetDeveloperApiSettingsPath }))
+  .output(zAccessServiceGetDeveloperApiSettingsResponse)
+
+export const getAccessPolicy = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AccessService_GetAccessPolicy',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/accessPolicy',
+    tags: ['AccessService'],
+  })
+  .input(z.object({ params: zAccessServiceGetAccessPolicyPath }))
+  .output(zAccessServiceGetAccessPolicyResponse)
+
+export const updateAccessPolicy = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'AccessService_UpdateAccessPolicy',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/accessPolicy',
+    tags: ['AccessService'],
+  })
+  .input(
+    z.object({
+      body: zAccessServiceUpdateAccessPolicyBody,
+      params: zAccessServiceUpdateAccessPolicyPath,
+    }),
+  )
+  .output(zAccessServiceUpdateAccessPolicyResponse)
+
+export const listApiKeys = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'AccessService_ListApiKeys',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/apiKeys',
+    tags: ['AccessService'],
+  })
+  .input(z.object({ params: zAccessServiceListApiKeysPath }))
+  .output(zAccessServiceListApiKeysResponse)
+
+export const createApiKey = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'AccessService_CreateApiKey',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/apiKeys',
+    tags: ['AccessService'],
+  })
+  .input(z.object({ body: zAccessServiceCreateApiKeyBody, params: zAccessServiceCreateApiKeyPath }))
+  .output(zAccessServiceCreateApiKeyResponse)
+
+export const deleteApiKey = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId: 'AccessService_DeleteApiKey',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/apiKeys/{apiKeyId}',
+    tags: ['AccessService'],
+  })
+  .input(z.object({ params: zAccessServiceDeleteApiKeyPath }))
+  .output(zAccessServiceDeleteApiKeyResponse)
+
+export const accessService = {
+  getAccessChannels,
+  updateAccessChannels,
+  getAccessSettings,
+  getDeveloperApiSettings,
+  getAccessPolicy,
+  updateAccessPolicy,
+  listApiKeys,
+  createApiKey,
+  deleteApiKey,
+}
+
+export const listDeployments = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'DeploymentService_ListDeployments',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/deployments',
+    tags: ['DeploymentService'],
+  })
+  .input(
+    z.object({
+      params: zDeploymentServiceListDeploymentsPath,
+      query: zDeploymentServiceListDeploymentsQuery.optional(),
+    }),
+  )
+  .output(zDeploymentServiceListDeploymentsResponse)
+
+export const listEnvironmentDeployments = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'DeploymentService_ListEnvironmentDeployments',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environmentDeployments',
+    tags: ['DeploymentService'],
+  })
+  .input(z.object({ params: zDeploymentServiceListEnvironmentDeploymentsPath }))
+  .output(zDeploymentServiceListEnvironmentDeploymentsResponse)
+
+export const listRollbackTargets = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'DeploymentService_ListRollbackTargets',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/rollbackTargets',
+    tags: ['DeploymentService'],
+  })
+  .input(
+    z.object({
+      params: zDeploymentServiceListRollbackTargetsPath,
+      query: zDeploymentServiceListRollbackTargetsQuery.optional(),
+    }),
+  )
+  .output(zDeploymentServiceListRollbackTargetsResponse)
+
+/**
+ * CancelDeployment cancels the in-flight deployment on the environment.
+ */
+export const cancelDeployment = oc
+  .route({
+    description: 'CancelDeployment cancels the in-flight deployment on the environment.',
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'DeploymentService_CancelDeployment',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}:cancelDeployment',
+    tags: ['DeploymentService'],
+  })
+  .input(
+    z.object({
+      body: zDeploymentServiceCancelDeploymentBody,
+      params: zDeploymentServiceCancelDeploymentPath,
+    }),
+  )
+  .output(zDeploymentServiceCancelDeploymentResponse)
+
+export const promote = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'DeploymentService_Promote',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}:promote',
+    tags: ['DeploymentService'],
+  })
+  .input(z.object({ body: zDeploymentServicePromoteBody, params: zDeploymentServicePromotePath }))
+  .output(zDeploymentServicePromoteResponse)
+
+export const rollback = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'DeploymentService_Rollback',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}:rollback',
+    tags: ['DeploymentService'],
+  })
+  .input(z.object({ body: zDeploymentServiceRollbackBody, params: zDeploymentServiceRollbackPath }))
+  .output(zDeploymentServiceRollbackResponse)
+
+export const undeploy = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'DeploymentService_Undeploy',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}:undeploy',
+    tags: ['DeploymentService'],
+  })
+  .input(z.object({ body: zDeploymentServiceUndeployBody, params: zDeploymentServiceUndeployPath }))
+  .output(zDeploymentServiceUndeployResponse)
+
+export const deploy = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'DeploymentService_Deploy',
+    path: '/enterprise/app-deploy/appInstances:deploy',
+    tags: ['DeploymentService'],
+  })
+  .input(z.object({ body: zDeploymentServiceDeployBody }))
+  .output(zDeploymentServiceDeployResponse)
+
+export const deploymentService = {
+  listDeployments,
+  listEnvironmentDeployments,
+  listRollbackTargets,
+  cancelDeployment,
+  promote,
+  rollback,
+  undeploy,
+  deploy,
+}
+
+export const listReleaseSummaries = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'ReleaseService_ListReleaseSummaries',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/releaseSummaries',
+    tags: ['ReleaseService'],
+  })
+  .input(
+    z.object({
+      params: zReleaseServiceListReleaseSummariesPath,
+      query: zReleaseServiceListReleaseSummariesQuery.optional(),
+    }),
+  )
+  .output(zReleaseServiceListReleaseSummariesResponse)
+
+export const listReleases = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'ReleaseService_ListReleases',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}/releases',
+    tags: ['ReleaseService'],
+  })
+  .input(
+    z.object({
+      params: zReleaseServiceListReleasesPath,
+      query: zReleaseServiceListReleasesQuery.optional(),
+    }),
+  )
+  .output(zReleaseServiceListReleasesResponse)
+
+export const computeReleaseDeploymentView = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'ReleaseService_ComputeReleaseDeploymentView',
+    path: '/enterprise/app-deploy/appInstances/{appInstanceId}:computeReleaseDeploymentView',
+    tags: ['ReleaseService'],
+  })
+  .input(
+    z.object({
+      params: zReleaseServiceComputeReleaseDeploymentViewPath,
+      query: zReleaseServiceComputeReleaseDeploymentViewQuery.optional(),
+    }),
+  )
+  .output(zReleaseServiceComputeReleaseDeploymentViewResponse)
+
+export const createRelease = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'ReleaseService_CreateRelease',
+    path: '/enterprise/app-deploy/releases',
+    tags: ['ReleaseService'],
+  })
+  .input(z.object({ body: zReleaseServiceCreateReleaseBody }))
+  .output(zReleaseServiceCreateReleaseResponse)
+
+export const deleteRelease = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId: 'ReleaseService_DeleteRelease',
+    path: '/enterprise/app-deploy/releases/{releaseId}',
+    tags: ['ReleaseService'],
+  })
+  .input(z.object({ params: zReleaseServiceDeleteReleasePath }))
+  .output(zReleaseServiceDeleteReleaseResponse)
+
+export const getRelease = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'ReleaseService_GetRelease',
+    path: '/enterprise/app-deploy/releases/{releaseId}',
+    tags: ['ReleaseService'],
+  })
+  .input(z.object({ params: zReleaseServiceGetReleasePath }))
+  .output(zReleaseServiceGetReleaseResponse)
+
+export const updateRelease = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PATCH',
+    operationId: 'ReleaseService_UpdateRelease',
+    path: '/enterprise/app-deploy/releases/{releaseId}',
+    tags: ['ReleaseService'],
+  })
+  .input(
+    z.object({ body: zReleaseServiceUpdateReleaseBody, params: zReleaseServiceUpdateReleasePath }),
+  )
+  .output(zReleaseServiceUpdateReleaseResponse)
+
+export const exportReleaseDsl = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'ReleaseService_ExportReleaseDSL',
+    path: '/enterprise/app-deploy/releases/{releaseId}:exportDsl',
+    tags: ['ReleaseService'],
+  })
+  .input(z.object({ params: zReleaseServiceExportReleaseDslPath }))
+  .output(zReleaseServiceExportReleaseDslResponse)
+
+export const listReleaseCredentialCandidates = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'ReleaseService_ListReleaseCredentialCandidates',
+    path: '/enterprise/app-deploy/releases/{releaseId}:listCredentialCandidates',
+    tags: ['ReleaseService'],
+  })
+  .input(z.object({ params: zReleaseServiceListReleaseCredentialCandidatesPath }))
+  .output(zReleaseServiceListReleaseCredentialCandidatesResponse)
+
+export const computeDeploymentOptions = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'ReleaseService_ComputeDeploymentOptions',
+    path: '/enterprise/app-deploy/releases:computeDeploymentOptions',
+    tags: ['ReleaseService'],
+  })
+  .input(z.object({ body: zReleaseServiceComputeDeploymentOptionsBody }))
+  .output(zReleaseServiceComputeDeploymentOptionsResponse)
+
+export const precheckRelease = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'ReleaseService_PrecheckRelease',
+    path: '/enterprise/app-deploy/releases:precheck',
+    tags: ['ReleaseService'],
+  })
+  .input(z.object({ body: zReleaseServicePrecheckReleaseBody }))
+  .output(zReleaseServicePrecheckReleaseResponse)
+
+export const releaseService = {
+  listReleaseSummaries,
+  listReleases,
+  computeReleaseDeploymentView,
+  createRelease,
+  deleteRelease,
+  getRelease,
+  updateRelease,
+  exportReleaseDsl,
+  listReleaseCredentialCandidates,
+  computeDeploymentOptions,
+  precheckRelease,
+}
+
+/**
+ * ListEnvironments returns only the environments the current user can
+ * deploy to.
+ */
+export const listEnvironments = oc
+  .route({
+    description: 'ListEnvironments returns only the environments the current user can\n deploy to.',
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'EnvironmentService_ListEnvironments',
+    path: '/enterprise/app-deploy/environments',
+    tags: ['EnvironmentService'],
+  })
+  .input(z.object({ query: zEnvironmentServiceListEnvironmentsQuery.optional() }))
+  .output(zEnvironmentServiceListEnvironmentsResponse)
+
+export const environmentService = {
+  listEnvironments,
+}
+
 export const oAuth2Login = oc
   .route({
     inputStructure: 'detailed',
@@ -133,6 +739,12 @@ export const webAppAuth = {
 }
 
 export const contract = {
+  accessSubjectService,
+  appInstanceService,
+  accessService,
+  deploymentService,
+  releaseService,
+  environmentService,
   consoleSso,
   webAppAuth,
 }
diff --git a/packages/contracts/generated/enterprise/types.gen.ts b/packages/contracts/generated/enterprise/types.gen.ts
index b747c4baa89..600f8975678 100644
--- a/packages/contracts/generated/enterprise/types.gen.ts
+++ b/packages/contracts/generated/enterprise/types.gen.ts
@@ -4,6 +4,1051 @@ export type ClientOptions = {
   baseUrl: `${string}://${string}` | (string & {})
 }
 
+export const AccessMode = {
+  ACCESS_MODE_UNSPECIFIED: 'ACCESS_MODE_UNSPECIFIED',
+  ACCESS_MODE_PUBLIC: 'ACCESS_MODE_PUBLIC',
+  ACCESS_MODE_PRIVATE: 'ACCESS_MODE_PRIVATE',
+  ACCESS_MODE_PRIVATE_ALL: 'ACCESS_MODE_PRIVATE_ALL',
+} as const
+
+export type AccessMode = (typeof AccessMode)[keyof typeof AccessMode]
+
+export const SubjectType = {
+  SUBJECT_TYPE_UNSPECIFIED: 'SUBJECT_TYPE_UNSPECIFIED',
+  SUBJECT_TYPE_ACCOUNT: 'SUBJECT_TYPE_ACCOUNT',
+  SUBJECT_TYPE_GROUP: 'SUBJECT_TYPE_GROUP',
+} as const
+
+export type SubjectType = (typeof SubjectType)[keyof typeof SubjectType]
+
+export const AppRunnerLogStatus = {
+  APP_RUNNER_LOG_STATUS_UNSPECIFIED: 'APP_RUNNER_LOG_STATUS_UNSPECIFIED',
+  APP_RUNNER_LOG_STATUS_RUNNING: 'APP_RUNNER_LOG_STATUS_RUNNING',
+  APP_RUNNER_LOG_STATUS_SUCCEEDED: 'APP_RUNNER_LOG_STATUS_SUCCEEDED',
+  APP_RUNNER_LOG_STATUS_FAILED: 'APP_RUNNER_LOG_STATUS_FAILED',
+  APP_RUNNER_LOG_STATUS_PARTIAL_SUCCEEDED: 'APP_RUNNER_LOG_STATUS_PARTIAL_SUCCEEDED',
+} as const
+
+export type AppRunnerLogStatus = (typeof AppRunnerLogStatus)[keyof typeof AppRunnerLogStatus]
+
+export const AssignmentOperation = {
+  ASSIGNMENT_OPERATION_UNSPECIFIED: 'ASSIGNMENT_OPERATION_UNSPECIFIED',
+  ASSIGNMENT_OPERATION_LOAD: 'ASSIGNMENT_OPERATION_LOAD',
+  ASSIGNMENT_OPERATION_UNLOAD: 'ASSIGNMENT_OPERATION_UNLOAD',
+} as const
+
+export type AssignmentOperation = (typeof AssignmentOperation)[keyof typeof AssignmentOperation]
+
+export const EnvironmentMode = {
+  ENVIRONMENT_MODE_UNSPECIFIED: 'ENVIRONMENT_MODE_UNSPECIFIED',
+  ENVIRONMENT_MODE_SHARED: 'ENVIRONMENT_MODE_SHARED',
+  ENVIRONMENT_MODE_ISOLATED: 'ENVIRONMENT_MODE_ISOLATED',
+} as const
+
+export type EnvironmentMode = (typeof EnvironmentMode)[keyof typeof EnvironmentMode]
+
+export const RuntimeBackend = {
+  RUNTIME_BACKEND_UNSPECIFIED: 'RUNTIME_BACKEND_UNSPECIFIED',
+  RUNTIME_BACKEND_K8S: 'RUNTIME_BACKEND_K8S',
+  RUNTIME_BACKEND_EXTERNAL: 'RUNTIME_BACKEND_EXTERNAL',
+} as const
+
+export type RuntimeBackend = (typeof RuntimeBackend)[keyof typeof RuntimeBackend]
+
+export const PluginCategory = {
+  PLUGIN_CATEGORY_UNSPECIFIED: 'PLUGIN_CATEGORY_UNSPECIFIED',
+  PLUGIN_CATEGORY_MODEL: 'PLUGIN_CATEGORY_MODEL',
+  PLUGIN_CATEGORY_TOOL: 'PLUGIN_CATEGORY_TOOL',
+} as const
+
+export type PluginCategory = (typeof PluginCategory)[keyof typeof PluginCategory]
+
+export const DeploymentStatus = {
+  DEPLOYMENT_STATUS_UNSPECIFIED: 'DEPLOYMENT_STATUS_UNSPECIFIED',
+  DEPLOYMENT_STATUS_DEPLOYING: 'DEPLOYMENT_STATUS_DEPLOYING',
+  DEPLOYMENT_STATUS_READY: 'DEPLOYMENT_STATUS_READY',
+  DEPLOYMENT_STATUS_FAILED: 'DEPLOYMENT_STATUS_FAILED',
+  DEPLOYMENT_STATUS_CANCELLED: 'DEPLOYMENT_STATUS_CANCELLED',
+} as const
+
+export type DeploymentStatus = (typeof DeploymentStatus)[keyof typeof DeploymentStatus]
+
+export const DeploymentAction = {
+  DEPLOYMENT_ACTION_UNSPECIFIED: 'DEPLOYMENT_ACTION_UNSPECIFIED',
+  DEPLOYMENT_ACTION_DEPLOY: 'DEPLOYMENT_ACTION_DEPLOY',
+  DEPLOYMENT_ACTION_PROMOTE: 'DEPLOYMENT_ACTION_PROMOTE',
+  DEPLOYMENT_ACTION_ROLLBACK: 'DEPLOYMENT_ACTION_ROLLBACK',
+  DEPLOYMENT_ACTION_UNDEPLOY: 'DEPLOYMENT_ACTION_UNDEPLOY',
+} as const
+
+export type DeploymentAction = (typeof DeploymentAction)[keyof typeof DeploymentAction]
+
+export const DeveloperApiUrlStatus = {
+  DEVELOPER_API_URL_STATUS_UNSPECIFIED: 'DEVELOPER_API_URL_STATUS_UNSPECIFIED',
+  DEVELOPER_API_URL_STATUS_CONFIGURED: 'DEVELOPER_API_URL_STATUS_CONFIGURED',
+  DEVELOPER_API_URL_STATUS_NOT_CONFIGURED: 'DEVELOPER_API_URL_STATUS_NOT_CONFIGURED',
+} as const
+
+export type DeveloperApiUrlStatus
+  = (typeof DeveloperApiUrlStatus)[keyof typeof DeveloperApiUrlStatus]
+
+export const EnvVarValueSource = {
+  ENV_VAR_VALUE_SOURCE_UNSPECIFIED: 'ENV_VAR_VALUE_SOURCE_UNSPECIFIED',
+  ENV_VAR_VALUE_SOURCE_LITERAL: 'ENV_VAR_VALUE_SOURCE_LITERAL',
+  ENV_VAR_VALUE_SOURCE_DSL_DEFAULT: 'ENV_VAR_VALUE_SOURCE_DSL_DEFAULT',
+  ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT: 'ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT',
+} as const
+
+export type EnvVarValueSource = (typeof EnvVarValueSource)[keyof typeof EnvVarValueSource]
+
+export const EnvVarValueType = {
+  ENV_VAR_VALUE_TYPE_UNSPECIFIED: 'ENV_VAR_VALUE_TYPE_UNSPECIFIED',
+  ENV_VAR_VALUE_TYPE_STRING: 'ENV_VAR_VALUE_TYPE_STRING',
+  ENV_VAR_VALUE_TYPE_NUMBER: 'ENV_VAR_VALUE_TYPE_NUMBER',
+  ENV_VAR_VALUE_TYPE_SECRET: 'ENV_VAR_VALUE_TYPE_SECRET',
+} as const
+
+export type EnvVarValueType = (typeof EnvVarValueType)[keyof typeof EnvVarValueType]
+
+export const EnvironmentStatus = {
+  ENVIRONMENT_STATUS_UNSPECIFIED: 'ENVIRONMENT_STATUS_UNSPECIFIED',
+  ENVIRONMENT_STATUS_ADMISSION: 'ENVIRONMENT_STATUS_ADMISSION',
+  ENVIRONMENT_STATUS_BOOTSTRAPPING: 'ENVIRONMENT_STATUS_BOOTSTRAPPING',
+  ENVIRONMENT_STATUS_READY: 'ENVIRONMENT_STATUS_READY',
+  ENVIRONMENT_STATUS_FAILED: 'ENVIRONMENT_STATUS_FAILED',
+  ENVIRONMENT_STATUS_DELETING: 'ENVIRONMENT_STATUS_DELETING',
+} as const
+
+export type EnvironmentStatus = (typeof EnvironmentStatus)[keyof typeof EnvironmentStatus]
+
+export const RuntimeInstanceStatus = {
+  RUNTIME_INSTANCE_STATUS_UNSPECIFIED: 'RUNTIME_INSTANCE_STATUS_UNSPECIFIED',
+  RUNTIME_INSTANCE_STATUS_UNDEPLOYED: 'RUNTIME_INSTANCE_STATUS_UNDEPLOYED',
+  RUNTIME_INSTANCE_STATUS_DEPLOYING: 'RUNTIME_INSTANCE_STATUS_DEPLOYING',
+  RUNTIME_INSTANCE_STATUS_READY: 'RUNTIME_INSTANCE_STATUS_READY',
+  RUNTIME_INSTANCE_STATUS_FAILED: 'RUNTIME_INSTANCE_STATUS_FAILED',
+  RUNTIME_INSTANCE_STATUS_DRIFTED: 'RUNTIME_INSTANCE_STATUS_DRIFTED',
+  RUNTIME_INSTANCE_STATUS_INVALID: 'RUNTIME_INSTANCE_STATUS_INVALID',
+  RUNTIME_INSTANCE_STATUS_UNDEPLOYING: 'RUNTIME_INSTANCE_STATUS_UNDEPLOYING',
+} as const
+
+export type RuntimeInstanceStatus
+  = (typeof RuntimeInstanceStatus)[keyof typeof RuntimeInstanceStatus]
+
+export const AppRunnerLaunchProfileMode = {
+  APP_RUNNER_LAUNCH_PROFILE_MODE_UNSPECIFIED: 'APP_RUNNER_LAUNCH_PROFILE_MODE_UNSPECIFIED',
+  APP_RUNNER_LAUNCH_PROFILE_MODE_DEBUG: 'APP_RUNNER_LAUNCH_PROFILE_MODE_DEBUG',
+} as const
+
+export type AppRunnerLaunchProfileMode
+  = (typeof AppRunnerLaunchProfileMode)[keyof typeof AppRunnerLaunchProfileMode]
+
+export const OperatorType = {
+  OPERATOR_TYPE_UNSPECIFIED: 'OPERATOR_TYPE_UNSPECIFIED',
+  OPERATOR_TYPE_END_USER: 'OPERATOR_TYPE_END_USER',
+  OPERATOR_TYPE_ACCOUNT: 'OPERATOR_TYPE_ACCOUNT',
+  OPERATOR_TYPE_SERVICE_ACCOUNT: 'OPERATOR_TYPE_SERVICE_ACCOUNT',
+  OPERATOR_TYPE_SYSTEM: 'OPERATOR_TYPE_SYSTEM',
+} as const
+
+export type OperatorType = (typeof OperatorType)[keyof typeof OperatorType]
+
+export const ReleaseSource = {
+  RELEASE_SOURCE_UNSPECIFIED: 'RELEASE_SOURCE_UNSPECIFIED',
+  RELEASE_SOURCE_SOURCE_APP: 'RELEASE_SOURCE_SOURCE_APP',
+  RELEASE_SOURCE_UPLOAD: 'RELEASE_SOURCE_UPLOAD',
+} as const
+
+export type ReleaseSource = (typeof ReleaseSource)[keyof typeof ReleaseSource]
+
+export const ReleaseEnvironmentActionKind = {
+  RELEASE_ENVIRONMENT_ACTION_KIND_UNSPECIFIED: 'RELEASE_ENVIRONMENT_ACTION_KIND_UNSPECIFIED',
+  RELEASE_ENVIRONMENT_ACTION_KIND_PROMOTE: 'RELEASE_ENVIRONMENT_ACTION_KIND_PROMOTE',
+  RELEASE_ENVIRONMENT_ACTION_KIND_ROLLBACK: 'RELEASE_ENVIRONMENT_ACTION_KIND_ROLLBACK',
+  RELEASE_ENVIRONMENT_ACTION_KIND_CURRENT: 'RELEASE_ENVIRONMENT_ACTION_KIND_CURRENT',
+  RELEASE_ENVIRONMENT_ACTION_KIND_DEPLOYING: 'RELEASE_ENVIRONMENT_ACTION_KIND_DEPLOYING',
+  RELEASE_ENVIRONMENT_ACTION_KIND_BLOCKED: 'RELEASE_ENVIRONMENT_ACTION_KIND_BLOCKED',
+} as const
+
+export type ReleaseEnvironmentActionKind
+  = (typeof ReleaseEnvironmentActionKind)[keyof typeof ReleaseEnvironmentActionKind]
+
+export const AckStatus = {
+  ACK_STATUS_UNSPECIFIED: 'ACK_STATUS_UNSPECIFIED',
+  ACK_STATUS_READY: 'ACK_STATUS_READY',
+  ACK_STATUS_FAILED: 'ACK_STATUS_FAILED',
+} as const
+
+export type AckStatus = (typeof AckStatus)[keyof typeof AckStatus]
+
+export const SlotType = {
+  SLOT_TYPE_UNSPECIFIED: 'SLOT_TYPE_UNSPECIFIED',
+  SLOT_TYPE_PLUGIN_CREDENTIAL: 'SLOT_TYPE_PLUGIN_CREDENTIAL',
+  SLOT_TYPE_ENV_VAR: 'SLOT_TYPE_ENV_VAR',
+} as const
+
+export type SlotType = (typeof SlotType)[keyof typeof SlotType]
+
+export const RouteTargetKind = {
+  ROUTE_TARGET_KIND_UNSPECIFIED: 'ROUTE_TARGET_KIND_UNSPECIFIED',
+  ROUTE_TARGET_KIND_K8S_SERVICE: 'ROUTE_TARGET_KIND_K8S_SERVICE',
+  ROUTE_TARGET_KIND_DIRECT_UPSTREAM: 'ROUTE_TARGET_KIND_DIRECT_UPSTREAM',
+} as const
+
+export type RouteTargetKind = (typeof RouteTargetKind)[keyof typeof RouteTargetKind]
+
+export const PasswordChangeReason = {
+  PASSWORD_CHANGE_REASON_UNSPECIFIED: 'PASSWORD_CHANGE_REASON_UNSPECIFIED',
+  PASSWORD_CHANGE_REASON_TEMP: 'PASSWORD_CHANGE_REASON_TEMP',
+  PASSWORD_CHANGE_REASON_EXPIRED: 'PASSWORD_CHANGE_REASON_EXPIRED',
+  PASSWORD_CHANGE_REASON_POLICY: 'PASSWORD_CHANGE_REASON_POLICY',
+} as const
+
+export type PasswordChangeReason = (typeof PasswordChangeReason)[keyof typeof PasswordChangeReason]
+
+export const OtelEndpointMode = {
+  OTEL_ENDPOINT_MODE_UNIFIED: 'OTEL_ENDPOINT_MODE_UNIFIED',
+  OTEL_ENDPOINT_MODE_DEDICATED: 'OTEL_ENDPOINT_MODE_DEDICATED',
+} as const
+
+export type OtelEndpointMode = (typeof OtelEndpointMode)[keyof typeof OtelEndpointMode]
+
+export const AppStatus = {
+  APP_STATUS_UNSPECIFIED: 'APP_STATUS_UNSPECIFIED',
+  APP_STATUS_PUBLISHED: 'APP_STATUS_PUBLISHED',
+  APP_STATUS_UNPUBLISHED: 'APP_STATUS_UNPUBLISHED',
+  APP_STATUS_DELETED: 'APP_STATUS_DELETED',
+} as const
+
+export type AppStatus = (typeof AppStatus)[keyof typeof AppStatus]
+
+export const LimitType = {
+  LIMIT_TYPE_UNSPECIFIED: 'LIMIT_TYPE_UNSPECIFIED',
+  LIMIT_TYPE_RPM: 'LIMIT_TYPE_RPM',
+  LIMIT_TYPE_CONCURRENCY: 'LIMIT_TYPE_CONCURRENCY',
+  LIMIT_TYPE_TOKEN: 'LIMIT_TYPE_TOKEN',
+} as const
+
+export type LimitType = (typeof LimitType)[keyof typeof LimitType]
+
+export const LimitAction = {
+  LIMIT_ACTION_UNSPECIFIED: 'LIMIT_ACTION_UNSPECIFIED',
+  LIMIT_ACTION_BLOCK: 'LIMIT_ACTION_BLOCK',
+  LIMIT_ACTION_TRACK: 'LIMIT_ACTION_TRACK',
+} as const
+
+export type LimitAction = (typeof LimitAction)[keyof typeof LimitAction]
+
+export const PasswordStrengthLevel = {
+  PASSWORD_STRENGTH_LEVEL_UNSPECIFIED: 'PASSWORD_STRENGTH_LEVEL_UNSPECIFIED',
+  PASSWORD_STRENGTH_LEVEL_WEAK: 'PASSWORD_STRENGTH_LEVEL_WEAK',
+  PASSWORD_STRENGTH_LEVEL_MEDIUM: 'PASSWORD_STRENGTH_LEVEL_MEDIUM',
+  PASSWORD_STRENGTH_LEVEL_STRONG: 'PASSWORD_STRENGTH_LEVEL_STRONG',
+} as const
+
+export type PasswordStrengthLevel
+  = (typeof PasswordStrengthLevel)[keyof typeof PasswordStrengthLevel]
+
+export const PluginInstallationScope = {
+  PLUGIN_INSTALLATION_SCOPE_ALL: 'PLUGIN_INSTALLATION_SCOPE_ALL',
+  PLUGIN_INSTALLATION_SCOPE_OFFICIAL_ONLY: 'PLUGIN_INSTALLATION_SCOPE_OFFICIAL_ONLY',
+  PLUGIN_INSTALLATION_SCOPE_OFFICIAL_AND_SPECIFIC_PARTNERS:
+    'PLUGIN_INSTALLATION_SCOPE_OFFICIAL_AND_SPECIFIC_PARTNERS',
+  PLUGIN_INSTALLATION_SCOPE_NONE: 'PLUGIN_INSTALLATION_SCOPE_NONE',
+} as const
+
+export type PluginInstallationScope
+  = (typeof PluginInstallationScope)[keyof typeof PluginInstallationScope]
+
+export const LimitStatus = {
+  LIMIT_STATUS_UNSPECIFIED: 'LIMIT_STATUS_UNSPECIFIED',
+  LIMIT_STATUS_NA: 'LIMIT_STATUS_NA',
+  LIMIT_STATUS_NORMAL: 'LIMIT_STATUS_NORMAL',
+  LIMIT_STATUS_THROTTLED: 'LIMIT_STATUS_THROTTLED',
+} as const
+
+export type LimitStatus = (typeof LimitStatus)[keyof typeof LimitStatus]
+
+export type AccessChannels = {
+  id: string
+  appInstanceId: string
+  webAppEnabled: boolean
+  developerApiEnabled: boolean
+  updatedBy: Actor
+  createdAt: string
+  updatedAt: string
+}
+
+export type AccessEndpoint = {
+  environment?: Environment
+  endpointUrl: string
+}
+
+export type AccessPolicy = {
+  id: string
+  appInstanceId: string
+  environmentId: string
+  mode: AccessMode
+  subjects: Array<AccessSubject>
+  createdAt: string
+  updatedAt: string
+}
+
+export type AccessSubject = {
+  subjectType: SubjectType
+  subjectId: string
+}
+
+export type Actor = {
+  id: string
+  displayName: string
+}
+
+export type ApiKey = {
+  id: string
+  appInstanceId: string
+  environmentId: string
+  displayName: string
+  maskedToken: string
+  createdBy: Actor
+  createdAt: string
+  lastUsedAt?: string
+}
+
+export type ApiKeySummary = {
+  apiKeyCount: number
+  environmentCount: number
+  developerApiEnabled: boolean
+  developerApiUrl: DeveloperApiUrl
+}
+
+export type AppInstance = {
+  id: string
+  tenantId: string
+  displayName: string
+  description: string
+  createdBy: Actor
+  updatedBy: Actor
+  createdAt: string
+  updatedAt: string
+}
+
+export type AppInstanceSummary = {
+  appInstance: AppInstance
+  environmentDeployments: Array<EnvironmentDeployment>
+  latestRelease?: Release
+  accessChannels: AccessChannels
+  apiKeySummary: ApiKeySummary
+}
+
+export type AppRunnerLog = {
+  id: string
+  timestamp: string
+  workflowRunId: string
+  status: AppRunnerLogStatus
+  durationSeconds: number
+  totalTokens: string
+  workspace: NamedRef
+  environment: NamedRef
+  appInstance: NamedRef
+  operator: Operator
+  invokeFrom: string
+  traceId: string
+  difyTraceId: string
+  gateCommitId: string
+  body?: string
+  attributesJson?: string
+  resourceAttributesJson?: string
+}
+
+export type BatchResolveRuntimeArtifactsRequest = {
+  requests?: Array<RuntimeArtifactRequest>
+}
+
+export type BatchResolveRuntimeArtifactsResponse = {
+  results?: Array<RuntimeArtifactResult>
+}
+
+export type BootstrapAssignment = {
+  appId?: string
+  environmentId?: string
+  workflowId?: string
+  runtimeInstanceId?: string
+  workspaceId?: string
+  runtimeInstanceVersion?: string
+  bindingSnapshotVersion?: string
+  executionTokenVersion?: string
+  executionToken?: string
+  releaseId?: string
+  operation?: AssignmentOperation
+  deploymentId?: string
+  requiresStatusReport?: boolean
+}
+
+export type BootstrapRunnerRequest = {
+  runner?: RunnerInfo
+}
+
+export type BootstrapRunnerResponse = {
+  runnerId?: string
+  assignmentRevision?: string
+  assignments?: Array<BootstrapAssignment>
+}
+
+export type CancelDeploymentRequest = {
+  appInstanceId?: string
+  environmentId?: string
+}
+
+export type CancelDeploymentResponse = {
+  deployment: Deployment
+}
+
+export type ComputeDeploymentOptionsRequest = {
+  environmentId?: string
+  appInstanceId?: string
+  dsl?: string
+  sourceAppId?: string
+  releaseId?: string
+}
+
+export type ComputeDeploymentOptionsResponse = {
+  options: DeploymentOptions
+}
+
+export type ComputeReleaseDeploymentViewResponse = {
+  releases: Array<Release>
+  environmentDeployments: Array<EnvironmentDeployment>
+  environmentActions: Array<ReleaseEnvironmentAction>
+  options?: DeploymentOptions
+}
+
+export type CreateApiKeyRequest = {
+  appInstanceId?: string
+  environmentId?: string
+  displayName: string
+}
+
+export type CreateApiKeyResponse = {
+  apiKey: ApiKey
+  token: string
+}
+
+export type CreateAppInstanceRequest = {
+  displayName: string
+  description?: string
+}
+
+export type CreateAppInstanceResponse = {
+  appInstance: AppInstance
+}
+
+export type CreateEnvironmentRequest = {
+  displayName: string
+  description?: string
+  mode?: EnvironmentMode
+  backend?: RuntimeBackend
+  k8s?: K8sEnvironmentConfig
+  external?: ExternalAppRunnerConfig
+  cpuCount?: number
+  idempotencyKey: string
+}
+
+export type CreateEnvironmentResponse = {
+  environment?: Environment
+}
+
+export type CreateReleaseRequest = {
+  createAppInstance?: boolean
+  appInstanceId?: string
+  displayName?: string
+  description?: string
+  dsl?: string
+  sourceAppId?: string
+}
+
+export type CreateReleaseResponse = {
+  release: Release
+  appInstance: AppInstance
+}
+
+export type CredentialCandidate = {
+  credentialId: string
+  providerId: string
+  category: PluginCategory
+  displayName: string
+  fromEnterprise: boolean
+}
+
+export type CredentialSelectionInput = {
+  providerId: string
+  category?: PluginCategory
+  credentialId: string
+}
+
+export type CredentialSlot = {
+  providerId: string
+  category: PluginCategory
+  candidates: Array<CredentialCandidate>
+  lastCredentialId: string
+}
+
+export type DashboardListAppInstancesResponse = {
+  appInstances: Array<AppInstance>
+  pagination: Pagination
+}
+
+export type DashboardListEnvironmentDeploymentsResponse = {
+  deployments?: Array<EnvironmentDeploymentHistoryItem>
+  pagination?: Pagination
+}
+
+export type DeleteApiKeyResponse = {
+  [key: string]: unknown
+}
+
+export type DeleteAppInstanceResponse = {
+  [key: string]: unknown
+}
+
+export type DeleteEnvironmentResponse = {
+  [key: string]: unknown
+}
+
+export type DeleteReleaseResponse = {
+  [key: string]: unknown
+}
+
+export type DeployRequest = {
+  dsl?: string
+  sourceAppId?: string
+  newAppInstance?: NewAppInstance
+  environmentId: string
+  releaseName?: string
+  releaseDescription?: string
+  credentials?: Array<CredentialSelectionInput>
+  envVars?: Array<EnvVarInput>
+  idempotencyKey: string
+  expectedDslDigest?: string
+}
+
+export type DeployResponse = {
+  appInstance: AppInstance
+  release: Release
+  deployment: Deployment
+}
+
+export type Deployment = {
+  id: string
+  appInstanceId: string
+  status: DeploymentStatus
+  action: DeploymentAction
+  environment: Environment
+  release: Release
+  error?: Error
+  createdBy: Actor
+  createdAt: string
+  finalizedAt?: string
+}
+
+export type DeploymentOptions = {
+  dslDigest: string
+  appInstanceDefaults: DeploymentOptionsAppInstanceDefaults
+  releaseDefaults: DeploymentOptionsReleaseDefaults
+  credentialSlots: Array<CredentialSlot>
+  envVarSlots: Array<EnvVarSlot>
+}
+
+export type DeploymentOptionsAppInstanceDefaults = {
+  displayName: string
+  description: string
+}
+
+export type DeploymentOptionsReleaseDefaults = {
+  displayName: string
+  description: string
+}
+
+export type DeveloperApiUrl = {
+  apiUrl: string
+  status: DeveloperApiUrlStatus
+  error?: Error
+}
+
+export type EnvVarInput = {
+  key: string
+  value?: string
+  valueSource?: EnvVarValueSource
+}
+
+export type EnvVarSlot = {
+  key: string
+  valueType: EnvVarValueType
+  description: string
+  defaultValue?: string
+  lastValue?: string
+}
+
+export type Environment = {
+  id: string
+  displayName: string
+  description: string
+  mode: EnvironmentMode
+  backend: RuntimeBackend
+  status: EnvironmentStatus
+  statusMessage: string
+  lastError?: Error
+  apiServer?: string
+  namespace?: string
+  managedBy?: string
+  runtimeEndpoint?: string
+  cpuCount: number
+  createdAt: string
+  updatedAt: string
+}
+
+export type EnvironmentAccessPolicy = {
+  environment: Environment
+  policy?: AccessPolicy
+  resolvedSubjects: Array<Subject>
+}
+
+export type EnvironmentAppInstance = {
+  appInstance?: AppInstance
+  currentRelease?: Release
+  status?: RuntimeInstanceStatus
+  lastError?: Error
+  workspaceId?: string
+  workspaceName?: string
+}
+
+export type EnvironmentDeployment = {
+  appInstanceId: string
+  environment: Environment
+  status: RuntimeInstanceStatus
+  currentRelease?: Release
+  desiredRelease?: Release
+  currentDeployment?: EnvironmentDeploymentRecord
+  error?: Error
+  updatedAt: string
+  releasesBehind?: number
+}
+
+export type EnvironmentDeploymentHistoryItem = {
+  deployment?: Deployment
+  appInstanceId?: string
+  appInstanceName?: string
+  workspaceId?: string
+  workspaceName?: string
+}
+
+export type EnvironmentDeploymentRecord = {
+  id: string
+  status: DeploymentStatus
+  createdAt: string
+  finalizedAt?: string
+}
+
+export type Error = {
+  code?: string
+  message?: string
+  phase?: string
+  occurredAt?: string
+}
+
+export type ExchangeControlTokenRequest = {
+  joinToken?: string
+}
+
+export type ExchangeControlTokenResponse = {
+  accessToken?: string
+  expiresAt?: string
+}
+
+export type ExportReleaseDslResponse = {
+  dsl: string
+}
+
+export type ExternalAppRunnerConfig = {
+  runtimeEndpoint?: string
+}
+
+export type GenerateAppRunnerLaunchProfileRequest = {
+  environmentId?: string
+  mode?: AppRunnerLaunchProfileMode
+  controlEndpoint: string
+  pluginDaemonBaseUrl: string
+  runtimeListenAddr: string
+  debugListenAddr?: string
+}
+
+export type GenerateAppRunnerLaunchProfileResponse = {
+  environmentId?: string
+  joinToken?: string
+  configYaml?: string
+  runtimeEndpoint?: string
+  sourceCommands?: Array<string>
+  dockerCommands?: Array<string>
+}
+
+export type GetAccessChannelsResponse = {
+  accessChannels: AccessChannels
+}
+
+export type GetAccessPolicyResponse = {
+  policy: AccessPolicy
+}
+
+export type GetAccessSettingsResponse = {
+  accessChannels: AccessChannels
+  environmentPolicies: Array<EnvironmentAccessPolicy>
+  webAppEndpoints?: Array<AccessEndpoint>
+  cliEndpoint?: AccessEndpoint
+}
+
+export type GetAppInstanceOverviewResponse = {
+  appInstance: AppInstance
+  environmentDeployments: Array<EnvironmentDeployment>
+  recentReleases: Array<Release>
+  accessChannels: AccessChannels
+  apiKeySummary: ApiKeySummary
+  totalReleaseCount: number
+}
+
+export type GetAppInstanceResponse = {
+  appInstance: AppInstance
+}
+
+export type GetAppRunnerLogResponse = {
+  appRunnerLog: AppRunnerLog
+  lastArchived?: string
+}
+
+export type GetDeveloperApiSettingsResponse = {
+  accessChannels: AccessChannels
+  environments: Array<Environment>
+  apiKeys: Array<ApiKey>
+  developerApiUrl: DeveloperApiUrl
+}
+
+export type GetEnvironmentResponse = {
+  environment?: Environment
+}
+
+export type GetReleaseResponse = {
+  release: Release
+}
+
+export type K8sEnvironmentConfig = {
+  namespace?: string
+  apiServer?: string
+  caBundle?: string
+  bearerToken?: string
+}
+
+export type ListApiKeysResponse = {
+  apiKeys: Array<ApiKey>
+  apiUrl: string
+}
+
+export type ListAppInstanceSummariesResponse = {
+  appInstanceSummaries: Array<AppInstanceSummary>
+  pagination: Pagination
+}
+
+export type ListAppInstancesResponse = {
+  appInstances: Array<AppInstance>
+  pagination: Pagination
+}
+
+export type ListAppRunnerLogsResponse = {
+  appRunnerLogs: Array<AppRunnerLog>
+  pagination: CursorPagination
+  lastArchived?: string
+}
+
+export type ListDeploymentsResponse = {
+  deployments: Array<Deployment>
+  pagination: Pagination
+}
+
+export type ListEnvironmentAppInstancesResponse = {
+  appInstances?: Array<EnvironmentAppInstance>
+  pagination?: Pagination
+}
+
+export type ListEnvironmentDeploymentsResponse = {
+  environmentDeployments: Array<EnvironmentDeployment>
+}
+
+export type ListEnvironmentsResponse = {
+  environments: Array<Environment>
+  pagination: Pagination
+}
+
+export type ListReleaseCredentialCandidatesResponse = {
+  slots: Array<CredentialSlot>
+}
+
+export type ListReleaseSummariesResponse = {
+  releaseSummaries: Array<ReleaseSummary>
+  pagination: Pagination
+}
+
+export type ListReleasesResponse = {
+  releases: Array<Release>
+  pagination: Pagination
+}
+
+export type ListRollbackTargetsResponse = {
+  rollbackTargets: Array<RollbackTarget>
+  pagination: Pagination
+}
+
+export type NamedRef = {
+  id: string
+  displayName: string
+}
+
+export type NewAppInstance = {
+  displayName?: string
+  description?: string
+}
+
+export type Operator = {
+  type: OperatorType
+  id: string
+  displayName: string
+}
+
+export type PrecheckReleaseRequest = {
+  appInstanceId?: string
+  dsl?: string
+  sourceAppId?: string
+}
+
+export type PrecheckReleaseResponse = {
+  gateCommitId: string
+  canCreate: boolean
+  matchedRelease?: ReleaseContentMatch
+  unsupportedNodes: Array<UnsupportedDslNode>
+}
+
+export type PromoteRequest = {
+  appInstanceId?: string
+  releaseId: string
+  environmentId?: string
+  credentials?: Array<CredentialSelectionInput>
+  envVars?: Array<EnvVarInput>
+  idempotencyKey: string
+}
+
+export type PromoteResponse = {
+  deployment: Deployment
+}
+
+export type Release = {
+  id: string
+  appInstanceId: string
+  displayName: string
+  description: string
+  source: ReleaseSource
+  sourceAppId?: string
+  gateCommitId: string
+  requiredSlots: Array<RequiredSlot>
+  createdBy: Actor
+  createdAt: string
+}
+
+export type ReleaseContentMatch = {
+  releaseId: string
+  displayName: string
+  createdAt: string
+}
+
+export type ReleaseEnvironmentAction = {
+  environment: Environment
+  kind: ReleaseEnvironmentActionKind
+  disabledReason?: string
+  requiresRuntimeInputs: boolean
+  currentReleaseId: string
+}
+
+export type ReleaseEnvironmentDeployment = {
+  environment: Environment
+  status: RuntimeInstanceStatus
+}
+
+export type ReleaseSummary = {
+  release: Release
+  deployedEnvironments: Array<ReleaseEnvironmentDeployment>
+  environmentActions: Array<ReleaseEnvironmentAction>
+  activeEnvironmentCount: number
+}
+
+export type ReportRuntimeAssignmentStatusRequest = {
+  deploymentId?: string
+  runtimeInstanceId?: string
+  releaseId?: string
+  status?: AckStatus
+  lastError?: Error
+  runnerId?: string
+  assignmentRevision?: string
+}
+
+export type ReportRuntimeAssignmentStatusResponse = {
+  accepted?: boolean
+  stale?: boolean
+}
+
+export type RequiredSlot = {
+  type: SlotType
+  providerId: string
+  category: PluginCategory
+  key: string
+}
+
+export type ResolveApiTokenRouteRequest = {
+  token?: string
+}
+
+export type ResolveApiTokenRouteResponse = {
+  environmentId?: string
+  namespace?: string
+  serviceName?: string
+  servicePort?: number
+  environmentStatus?: EnvironmentStatus
+  appId?: string
+  tenantId?: string
+  runtimeInstanceId?: string
+  observedReleaseId?: string
+  runtimeInstanceStatus?: RuntimeInstanceStatus
+  revoked?: boolean
+  unavailableReason?: string
+  targetKind?: RouteTargetKind
+  directUpstream?: string
+}
+
+export type RollbackRequest = {
+  appInstanceId?: string
+  environmentId?: string
+  targetReleaseId: string
+  idempotencyKey: string
+}
+
+export type RollbackResponse = {
+  deployment: Deployment
+}
+
+export type RollbackTarget = {
+  release: Release
+  resolvedDeploymentId: string
+  deployedAt: string
+  isCurrent: boolean
+}
+
+export type RunnerInfo = {
+  hostname?: string
+}
+
+export type RuntimeArtifact = {
+  dslYaml?: string
+  bindingSnapshotVersion?: string
+  bindingSnapshot?: {
+    [key: string]: unknown
+  }
+}
+
+export type RuntimeArtifactRequest = {
+  runtimeInstanceId?: string
+  releaseId?: string
+  deploymentId?: string
+  bindingSnapshotVersion?: string
+}
+
+export type RuntimeArtifactResult = {
+  runtimeInstanceId?: string
+  releaseId?: string
+  artifact?: RuntimeArtifact
+  error?: Error
+  deploymentId?: string
+}
+
+export type TestConnectionRequest = {
+  environmentId?: string
+}
+
+export type TestConnectionResponse = {
+  reachable?: boolean
+  message?: string
+}
+
+export type UndeployRequest = {
+  appInstanceId?: string
+  environmentId?: string
+  idempotencyKey: string
+}
+
+export type UndeployResponse = {
+  deployment: Deployment
+}
+
+export type UnsupportedDslNode = {
+  id: string
+  type: string
+}
+
+export type UpdateAccessChannelsRequest = {
+  appInstanceId?: string
+  webAppEnabled?: boolean
+  developerApiEnabled?: boolean
+}
+
+export type UpdateAccessChannelsResponse = {
+  accessChannels: AccessChannels
+}
+
+export type UpdateAccessPolicyRequest = {
+  appInstanceId?: string
+  environmentId?: string
+  mode: AccessMode
+  subjects?: Array<AccessSubject>
+}
+
+export type UpdateAccessPolicyResponse = {
+  policy: AccessPolicy
+}
+
+export type UpdateAppInstanceRequest = {
+  appInstanceId?: string
+  displayName: string
+  description?: string
+}
+
+export type UpdateAppInstanceResponse = {
+  appInstance: AppInstance
+}
+
+export type UpdateEnvironmentRequest = {
+  environmentId?: string
+  displayName: string
+  description?: string
+}
+
+export type UpdateEnvironmentResponse = {
+  environment?: Environment
+}
+
+export type UpdateReleaseRequest = {
+  releaseId?: string
+  displayName: string
+  description?: string
+}
+
+export type UpdateReleaseResponse = {
+  release: Release
+}
+
 export type Account = {
   id?: string
   email?: string
@@ -68,7 +1113,7 @@ export type BrandingInfo = {
 
 export type CheckPasswordStatusReply = {
   requirePasswordChange?: boolean
-  changeReason?: number
+  changeReason?: PasswordChangeReason
   daysToExpire?: number
   message?: string
 }
@@ -185,7 +1230,7 @@ export type DeleteWorkspaceReply = {
 }
 
 export type EndpointReply = {
-  mode?: number
+  mode?: OtelEndpointMode
   metricsEndpoint?: OtelExporterEndpoint
   tracesEndpoint?: OtelExporterEndpoint
 }
@@ -196,6 +1241,14 @@ export type EnterpriseSystemUserSettingReply = {
   enableEmailPasswordLogin?: boolean
 }
 
+export type ExternallyAccessibleApp = {
+  appId?: string
+  tenantId?: string
+  mode?: string
+  name?: string
+  updatedAt?: string
+}
+
 export type GetBearerTokenResponse = {
   maskedToken?: string
 }
@@ -237,6 +1290,11 @@ export type GetMfaInfoReply = {
   globalEnabled?: boolean
 }
 
+export type GetMemberRbacRolesReply = {
+  accountId?: string
+  roles?: Array<RbacRole>
+}
+
 export type GetMemberReply = {
   account?: AccountDetail
 }
@@ -280,7 +1338,7 @@ export type GroupAppItem = {
   app_name?: string
   workspace_id?: string
   workspace_name?: string
-  app_status?: number
+  app_status?: AppStatus
   token_usage?: string
   rpm?: string
   concurrency?: string
@@ -304,6 +1362,7 @@ export type InfoConfigReply = {
   Branding?: BrandingInfo
   WebAppAuth?: WebAppAuthInfo
   PluginInstallationPermission?: PluginInstallationPermissionInfo
+  EnableAppDeploy?: boolean
 }
 
 export type InnerAdmission = {
@@ -355,6 +1414,19 @@ export type InnerIsUserAllowedToAccessWebAppRes = {
   result?: boolean
 }
 
+export type InnerListExternallyAccessibleAppsReq = {
+  page?: number
+  limit?: number
+  mode?: string
+  name?: string
+}
+
+export type InnerListExternallyAccessibleAppsRes = {
+  data?: Array<ExternallyAccessibleApp>
+  total?: number
+  hasMore?: boolean
+}
+
 export type InnerReleaseAdmissionRequest = {
   admission?: InnerAdmission
 }
@@ -411,15 +1483,21 @@ export type LicenseStatus = {
 }
 
 export type LimitConfig = {
-  type?: number
+  type?: LimitType
   threshold?: string
-  action?: number
+  action?: LimitAction
   reached?: boolean
 }
 
 export type LimitFields = {
   workspaceMembers?: number
   workspaces?: ResourceQuota
+  appRunnerEnvCpus?: ResourceQuota
+}
+
+export type ListAccessSubjectsReply = {
+  subjects?: Array<Subject>
+  pagination?: Pagination
 }
 
 export type ListGroupAppsResponse = {
@@ -442,6 +1520,11 @@ export type ListSecretKeysReply = {
   pagination?: Pagination
 }
 
+export type ListTraceProvidersReply = {
+  providers?: Array<TraceProvider>
+  catalog?: Array<TraceProviderDescriptor>
+}
+
 export type ListUsersReply = {
   data?: Array<AccountDetail>
   pagination?: Pagination
@@ -531,7 +1614,7 @@ export type OidcReply = {
 export type OtelExporterEndpoint = {
   endpoint?: string
   compression?: string
-  protocol?: number
+  protocol?: 'HTTP_PROTOBUF' | 'HTTP_JSON' | 'GRPC'
   timeout?: string
   headers?: {
     [key: string]: string
@@ -549,7 +1632,7 @@ export type OtelExporterStatusReply = {
   bytesPushed?: string
   itemsInQueue?: string
   logs?: string
-  status?: number
+  status?: 'RUNNING' | 'ERROR' | 'STOPPED'
 }
 
 export type PasswordPolicyConfig = {
@@ -565,7 +1648,7 @@ export type PasswordPolicyConfig = {
 }
 
 export type PasswordStrengthReply = {
-  level?: number
+  level?: PasswordStrengthLevel
 }
 
 export type PasswordStrengthReq = {
@@ -578,10 +1661,20 @@ export type PluginInstallationPermissionInfo = {
 }
 
 export type PluginInstallationSettingsReply = {
-  pluginInstallationScope?: number
+  pluginInstallationScope?: PluginInstallationScope
   restrictToMarketplaceOnly?: boolean
 }
 
+export type RbacRole = {
+  id?: string
+  type?: string
+  name?: string
+  description?: string
+  isBuiltin?: boolean
+  category?: string
+  permissionKeys?: Array<string>
+}
+
 export type ResetMemberPasswordReply = {
   id?: string
   password?: string
@@ -616,11 +1709,11 @@ export type ResourceGroupDetail = {
   description?: string
   enabled?: boolean
   rpm_limit?: number
-  rpm_action?: number
+  rpm_action?: LimitAction
   concurrency_limit?: number
-  concurrency_action?: number
+  concurrency_action?: LimitAction
   token_quota?: string
-  token_action?: number
+  token_action?: LimitAction
   created_at?: string
   updated_at?: string
 }
@@ -635,8 +1728,8 @@ export type ResourceGroupItem = {
   token_quota?: string
   token_usage?: string
   app_count?: string
-  rpm_status?: number
-  conc_status?: number
+  rpm_status?: LimitStatus
+  conc_status?: LimitStatus
   created_at?: string
   updated_at?: string
 }
@@ -684,7 +1777,7 @@ export type SearchAppItem = {
   app_name?: string
   workspace_id?: string
   workspace_name?: string
-  app_status?: number
+  app_status?: AppStatus
   icon?: string
   icon_type?: string
   icon_background?: string
@@ -720,7 +1813,7 @@ export type SetDefaultWorkspaceReq = {
 
 export type Subject = {
   subjectId?: string
-  subjectType?: string
+  subjectType?: SubjectType
   accountData?: SubjectAccountData
   groupData?: SubjectGroupData
 }
@@ -753,10 +1846,50 @@ export type TestConnectionReply = {
   error?: string
 }
 
+export type TestTraceProviderRequest = {
+  provider?: TraceProvider
+}
+
 export type ToggleEndpointRequest = {
   enabled?: boolean
 }
 
+export type ToggleTraceProviderRequest = {
+  id?: string
+  enabled?: boolean
+}
+
+export type TraceProvider = {
+  id?: string
+  name?: string
+  provider?: string
+  endpoint?: string
+  protocol?: string
+  credentials?: {
+    [key: string]: string
+  }
+  settings?: {
+    [key: string]: string
+  }
+  enabled?: boolean
+}
+
+export type TraceProviderDescriptor = {
+  provider?: string
+  displayName?: string
+  credentialFields?: Array<TraceProviderField>
+  settingFields?: Array<TraceProviderField>
+  defaultProtocol?: string
+  supportedProtocols?: Array<string>
+}
+
+export type TraceProviderField = {
+  key?: string
+  displayName?: string
+  required?: boolean
+  secret?: boolean
+}
+
 export type UpdateAccessModeReq = {
   appId?: string
   accessMode?: string
@@ -821,6 +1954,16 @@ export type UpdateMfaStatusRes = {
   message?: string
 }
 
+export type UpdateMemberRbacRolesReply = {
+  accountId?: string
+  roles?: Array<RbacRole>
+}
+
+export type UpdateMemberRbacRolesReq = {
+  id?: string
+  roleIds?: Array<string>
+}
+
 export type UpdateMemberReply = {
   account?: Account
 }
@@ -850,7 +1993,7 @@ export type UpdateOfflineLicenseReq = {
 }
 
 export type UpdatePluginInstallationSettingsRequest = {
-  pluginInstallationScope?: number
+  pluginInstallationScope?: PluginInstallationScope
   restrictToMarketplaceOnly?: boolean
 }
 
@@ -860,11 +2003,11 @@ export type UpdateResourceGroupRequest = {
   description?: string
   enabled?: boolean
   rpm_limit?: number
-  rpm_action?: number
+  rpm_action?: LimitAction
   concurrency_limit?: number
-  concurrency_action?: number
+  concurrency_action?: LimitAction
   token_quota?: string
-  token_action?: number
+  token_action?: LimitAction
 }
 
 export type UpdateUserReply = {
@@ -919,6 +2062,14 @@ export type UpdateWorkspaceReq = {
   status?: string
 }
 
+export type UpsertTraceProviderReply = {
+  provider?: TraceProvider
+}
+
+export type UpsertTraceProviderRequest = {
+  provider?: TraceProvider
+}
+
 export type WebAppAuthInfo = {
   allowSso?: boolean
   allowEmailCodeLogin?: boolean
@@ -956,6 +2107,15 @@ export type WorkspacePermission = {
   allowOwnerTransfer?: boolean
 }
 
+export type CursorPagination = {
+  pageSize?: number
+  nextCursor?: string
+  prevCursor?: string
+  hasNextPage?: boolean
+  hasPrevPage?: boolean
+  totalCount?: string
+}
+
 export type Pagination = {
   totalCount?: number
   perPage?: number
@@ -963,6 +2123,633 @@ export type Pagination = {
   totalPages?: number
 }
 
+export type AccessSubjectServiceListAccessSubjectsData = {
+  body?: never
+  path?: never
+  query?: {
+    keyword?: string
+    groupId?: string
+    pageNumber?: number
+    resultsPerPage?: number
+  }
+  url: '/enterprise/access-subjects'
+}
+
+export type AccessSubjectServiceListAccessSubjectsResponses = {
+  200: ListAccessSubjectsReply
+}
+
+export type AccessSubjectServiceListAccessSubjectsResponse
+  = AccessSubjectServiceListAccessSubjectsResponses[keyof AccessSubjectServiceListAccessSubjectsResponses]
+
+export type AppInstanceServiceListAppInstanceSummariesData = {
+  body?: never
+  path?: never
+  query?: {
+    pageNumber?: number
+    resultsPerPage?: number
+    displayName?: string
+    environmentId?: string
+  }
+  url: '/enterprise/app-deploy/appInstanceSummaries'
+}
+
+export type AppInstanceServiceListAppInstanceSummariesResponses = {
+  200: ListAppInstanceSummariesResponse
+}
+
+export type AppInstanceServiceListAppInstanceSummariesResponse
+  = AppInstanceServiceListAppInstanceSummariesResponses[keyof AppInstanceServiceListAppInstanceSummariesResponses]
+
+export type AppInstanceServiceListAppInstancesData = {
+  body?: never
+  path?: never
+  query?: {
+    pageNumber?: number
+    resultsPerPage?: number
+    displayName?: string
+    environmentId?: string
+  }
+  url: '/enterprise/app-deploy/appInstances'
+}
+
+export type AppInstanceServiceListAppInstancesResponses = {
+  200: ListAppInstancesResponse
+}
+
+export type AppInstanceServiceListAppInstancesResponse
+  = AppInstanceServiceListAppInstancesResponses[keyof AppInstanceServiceListAppInstancesResponses]
+
+export type AppInstanceServiceCreateAppInstanceData = {
+  body: CreateAppInstanceRequest
+  path?: never
+  query?: never
+  url: '/enterprise/app-deploy/appInstances'
+}
+
+export type AppInstanceServiceCreateAppInstanceResponses = {
+  200: CreateAppInstanceResponse
+}
+
+export type AppInstanceServiceCreateAppInstanceResponse
+  = AppInstanceServiceCreateAppInstanceResponses[keyof AppInstanceServiceCreateAppInstanceResponses]
+
+export type AppInstanceServiceDeleteAppInstanceData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}'
+}
+
+export type AppInstanceServiceDeleteAppInstanceResponses = {
+  200: DeleteAppInstanceResponse
+}
+
+export type AppInstanceServiceDeleteAppInstanceResponse
+  = AppInstanceServiceDeleteAppInstanceResponses[keyof AppInstanceServiceDeleteAppInstanceResponses]
+
+export type AppInstanceServiceGetAppInstanceData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}'
+}
+
+export type AppInstanceServiceGetAppInstanceResponses = {
+  200: GetAppInstanceResponse
+}
+
+export type AppInstanceServiceGetAppInstanceResponse
+  = AppInstanceServiceGetAppInstanceResponses[keyof AppInstanceServiceGetAppInstanceResponses]
+
+export type AppInstanceServiceUpdateAppInstanceData = {
+  body: UpdateAppInstanceRequest
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}'
+}
+
+export type AppInstanceServiceUpdateAppInstanceResponses = {
+  200: UpdateAppInstanceResponse
+}
+
+export type AppInstanceServiceUpdateAppInstanceResponse
+  = AppInstanceServiceUpdateAppInstanceResponses[keyof AppInstanceServiceUpdateAppInstanceResponses]
+
+export type AccessServiceGetAccessChannelsData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/accessChannels'
+}
+
+export type AccessServiceGetAccessChannelsResponses = {
+  200: GetAccessChannelsResponse
+}
+
+export type AccessServiceGetAccessChannelsResponse
+  = AccessServiceGetAccessChannelsResponses[keyof AccessServiceGetAccessChannelsResponses]
+
+export type AccessServiceUpdateAccessChannelsData = {
+  body: UpdateAccessChannelsRequest
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/accessChannels'
+}
+
+export type AccessServiceUpdateAccessChannelsResponses = {
+  200: UpdateAccessChannelsResponse
+}
+
+export type AccessServiceUpdateAccessChannelsResponse
+  = AccessServiceUpdateAccessChannelsResponses[keyof AccessServiceUpdateAccessChannelsResponses]
+
+export type AccessServiceGetAccessSettingsData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/accessSettings'
+}
+
+export type AccessServiceGetAccessSettingsResponses = {
+  200: GetAccessSettingsResponse
+}
+
+export type AccessServiceGetAccessSettingsResponse
+  = AccessServiceGetAccessSettingsResponses[keyof AccessServiceGetAccessSettingsResponses]
+
+export type DeploymentServiceListDeploymentsData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: {
+    pageNumber?: number
+    resultsPerPage?: number
+    environmentId?: string
+  }
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/deployments'
+}
+
+export type DeploymentServiceListDeploymentsResponses = {
+  200: ListDeploymentsResponse
+}
+
+export type DeploymentServiceListDeploymentsResponse
+  = DeploymentServiceListDeploymentsResponses[keyof DeploymentServiceListDeploymentsResponses]
+
+export type AccessServiceGetDeveloperApiSettingsData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/developerApiSettings'
+}
+
+export type AccessServiceGetDeveloperApiSettingsResponses = {
+  200: GetDeveloperApiSettingsResponse
+}
+
+export type AccessServiceGetDeveloperApiSettingsResponse
+  = AccessServiceGetDeveloperApiSettingsResponses[keyof AccessServiceGetDeveloperApiSettingsResponses]
+
+export type DeploymentServiceListEnvironmentDeploymentsData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environmentDeployments'
+}
+
+export type DeploymentServiceListEnvironmentDeploymentsResponses = {
+  200: ListEnvironmentDeploymentsResponse
+}
+
+export type DeploymentServiceListEnvironmentDeploymentsResponse
+  = DeploymentServiceListEnvironmentDeploymentsResponses[keyof DeploymentServiceListEnvironmentDeploymentsResponses]
+
+export type AccessServiceGetAccessPolicyData = {
+  body?: never
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/accessPolicy'
+}
+
+export type AccessServiceGetAccessPolicyResponses = {
+  200: GetAccessPolicyResponse
+}
+
+export type AccessServiceGetAccessPolicyResponse
+  = AccessServiceGetAccessPolicyResponses[keyof AccessServiceGetAccessPolicyResponses]
+
+export type AccessServiceUpdateAccessPolicyData = {
+  body: UpdateAccessPolicyRequest
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/accessPolicy'
+}
+
+export type AccessServiceUpdateAccessPolicyResponses = {
+  200: UpdateAccessPolicyResponse
+}
+
+export type AccessServiceUpdateAccessPolicyResponse
+  = AccessServiceUpdateAccessPolicyResponses[keyof AccessServiceUpdateAccessPolicyResponses]
+
+export type AccessServiceListApiKeysData = {
+  body?: never
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/apiKeys'
+}
+
+export type AccessServiceListApiKeysResponses = {
+  200: ListApiKeysResponse
+}
+
+export type AccessServiceListApiKeysResponse
+  = AccessServiceListApiKeysResponses[keyof AccessServiceListApiKeysResponses]
+
+export type AccessServiceCreateApiKeyData = {
+  body: CreateApiKeyRequest
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/apiKeys'
+}
+
+export type AccessServiceCreateApiKeyResponses = {
+  200: CreateApiKeyResponse
+}
+
+export type AccessServiceCreateApiKeyResponse
+  = AccessServiceCreateApiKeyResponses[keyof AccessServiceCreateApiKeyResponses]
+
+export type AccessServiceDeleteApiKeyData = {
+  body?: never
+  path: {
+    appInstanceId: string
+    environmentId: string
+    apiKeyId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/apiKeys/{apiKeyId}'
+}
+
+export type AccessServiceDeleteApiKeyResponses = {
+  200: DeleteApiKeyResponse
+}
+
+export type AccessServiceDeleteApiKeyResponse
+  = AccessServiceDeleteApiKeyResponses[keyof AccessServiceDeleteApiKeyResponses]
+
+export type DeploymentServiceListRollbackTargetsData = {
+  body?: never
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: {
+    pageNumber?: number
+    resultsPerPage?: number
+  }
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}/rollbackTargets'
+}
+
+export type DeploymentServiceListRollbackTargetsResponses = {
+  200: ListRollbackTargetsResponse
+}
+
+export type DeploymentServiceListRollbackTargetsResponse
+  = DeploymentServiceListRollbackTargetsResponses[keyof DeploymentServiceListRollbackTargetsResponses]
+
+export type DeploymentServiceCancelDeploymentData = {
+  body: CancelDeploymentRequest
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}:cancelDeployment'
+}
+
+export type DeploymentServiceCancelDeploymentResponses = {
+  200: CancelDeploymentResponse
+}
+
+export type DeploymentServiceCancelDeploymentResponse
+  = DeploymentServiceCancelDeploymentResponses[keyof DeploymentServiceCancelDeploymentResponses]
+
+export type DeploymentServicePromoteData = {
+  body: PromoteRequest
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}:promote'
+}
+
+export type DeploymentServicePromoteResponses = {
+  200: PromoteResponse
+}
+
+export type DeploymentServicePromoteResponse
+  = DeploymentServicePromoteResponses[keyof DeploymentServicePromoteResponses]
+
+export type DeploymentServiceRollbackData = {
+  body: RollbackRequest
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}:rollback'
+}
+
+export type DeploymentServiceRollbackResponses = {
+  200: RollbackResponse
+}
+
+export type DeploymentServiceRollbackResponse
+  = DeploymentServiceRollbackResponses[keyof DeploymentServiceRollbackResponses]
+
+export type DeploymentServiceUndeployData = {
+  body: UndeployRequest
+  path: {
+    appInstanceId: string
+    environmentId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/environments/{environmentId}:undeploy'
+}
+
+export type DeploymentServiceUndeployResponses = {
+  200: UndeployResponse
+}
+
+export type DeploymentServiceUndeployResponse
+  = DeploymentServiceUndeployResponses[keyof DeploymentServiceUndeployResponses]
+
+export type ReleaseServiceListReleaseSummariesData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: {
+    releaseId?: string
+    displayName?: string
+    pageNumber?: number
+    resultsPerPage?: number
+    environmentId?: string
+  }
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/releaseSummaries'
+}
+
+export type ReleaseServiceListReleaseSummariesResponses = {
+  200: ListReleaseSummariesResponse
+}
+
+export type ReleaseServiceListReleaseSummariesResponse
+  = ReleaseServiceListReleaseSummariesResponses[keyof ReleaseServiceListReleaseSummariesResponses]
+
+export type ReleaseServiceListReleasesData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: {
+    releaseId?: string
+    displayName?: string
+    pageNumber?: number
+    resultsPerPage?: number
+    environmentId?: string
+  }
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}/releases'
+}
+
+export type ReleaseServiceListReleasesResponses = {
+  200: ListReleasesResponse
+}
+
+export type ReleaseServiceListReleasesResponse
+  = ReleaseServiceListReleasesResponses[keyof ReleaseServiceListReleasesResponses]
+
+export type ReleaseServiceComputeReleaseDeploymentViewData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: {
+    releaseId?: string
+    environmentId?: string
+  }
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}:computeReleaseDeploymentView'
+}
+
+export type ReleaseServiceComputeReleaseDeploymentViewResponses = {
+  200: ComputeReleaseDeploymentViewResponse
+}
+
+export type ReleaseServiceComputeReleaseDeploymentViewResponse
+  = ReleaseServiceComputeReleaseDeploymentViewResponses[keyof ReleaseServiceComputeReleaseDeploymentViewResponses]
+
+export type AppInstanceServiceGetAppInstanceOverviewData = {
+  body?: never
+  path: {
+    appInstanceId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/appInstances/{appInstanceId}:getOverview'
+}
+
+export type AppInstanceServiceGetAppInstanceOverviewResponses = {
+  200: GetAppInstanceOverviewResponse
+}
+
+export type AppInstanceServiceGetAppInstanceOverviewResponse
+  = AppInstanceServiceGetAppInstanceOverviewResponses[keyof AppInstanceServiceGetAppInstanceOverviewResponses]
+
+export type DeploymentServiceDeployData = {
+  body: DeployRequest
+  path?: never
+  query?: never
+  url: '/enterprise/app-deploy/appInstances:deploy'
+}
+
+export type DeploymentServiceDeployResponses = {
+  200: DeployResponse
+}
+
+export type DeploymentServiceDeployResponse
+  = DeploymentServiceDeployResponses[keyof DeploymentServiceDeployResponses]
+
+export type EnvironmentServiceListEnvironmentsData = {
+  body?: never
+  path?: never
+  query?: {
+    environmentId?: string
+    displayName?: string
+    pageNumber?: number
+    resultsPerPage?: number
+  }
+  url: '/enterprise/app-deploy/environments'
+}
+
+export type EnvironmentServiceListEnvironmentsResponses = {
+  200: ListEnvironmentsResponse
+}
+
+export type EnvironmentServiceListEnvironmentsResponse
+  = EnvironmentServiceListEnvironmentsResponses[keyof EnvironmentServiceListEnvironmentsResponses]
+
+export type ReleaseServiceCreateReleaseData = {
+  body: CreateReleaseRequest
+  path?: never
+  query?: never
+  url: '/enterprise/app-deploy/releases'
+}
+
+export type ReleaseServiceCreateReleaseResponses = {
+  200: CreateReleaseResponse
+}
+
+export type ReleaseServiceCreateReleaseResponse
+  = ReleaseServiceCreateReleaseResponses[keyof ReleaseServiceCreateReleaseResponses]
+
+export type ReleaseServiceDeleteReleaseData = {
+  body?: never
+  path: {
+    releaseId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/releases/{releaseId}'
+}
+
+export type ReleaseServiceDeleteReleaseResponses = {
+  200: DeleteReleaseResponse
+}
+
+export type ReleaseServiceDeleteReleaseResponse
+  = ReleaseServiceDeleteReleaseResponses[keyof ReleaseServiceDeleteReleaseResponses]
+
+export type ReleaseServiceGetReleaseData = {
+  body?: never
+  path: {
+    releaseId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/releases/{releaseId}'
+}
+
+export type ReleaseServiceGetReleaseResponses = {
+  200: GetReleaseResponse
+}
+
+export type ReleaseServiceGetReleaseResponse
+  = ReleaseServiceGetReleaseResponses[keyof ReleaseServiceGetReleaseResponses]
+
+export type ReleaseServiceUpdateReleaseData = {
+  body: UpdateReleaseRequest
+  path: {
+    releaseId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/releases/{releaseId}'
+}
+
+export type ReleaseServiceUpdateReleaseResponses = {
+  200: UpdateReleaseResponse
+}
+
+export type ReleaseServiceUpdateReleaseResponse
+  = ReleaseServiceUpdateReleaseResponses[keyof ReleaseServiceUpdateReleaseResponses]
+
+export type ReleaseServiceExportReleaseDslData = {
+  body?: never
+  path: {
+    releaseId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/releases/{releaseId}:exportDsl'
+}
+
+export type ReleaseServiceExportReleaseDslResponses = {
+  200: ExportReleaseDslResponse
+}
+
+export type ReleaseServiceExportReleaseDslResponse
+  = ReleaseServiceExportReleaseDslResponses[keyof ReleaseServiceExportReleaseDslResponses]
+
+export type ReleaseServiceListReleaseCredentialCandidatesData = {
+  body?: never
+  path: {
+    releaseId: string
+  }
+  query?: never
+  url: '/enterprise/app-deploy/releases/{releaseId}:listCredentialCandidates'
+}
+
+export type ReleaseServiceListReleaseCredentialCandidatesResponses = {
+  200: ListReleaseCredentialCandidatesResponse
+}
+
+export type ReleaseServiceListReleaseCredentialCandidatesResponse
+  = ReleaseServiceListReleaseCredentialCandidatesResponses[keyof ReleaseServiceListReleaseCredentialCandidatesResponses]
+
+export type ReleaseServiceComputeDeploymentOptionsData = {
+  body: ComputeDeploymentOptionsRequest
+  path?: never
+  query?: never
+  url: '/enterprise/app-deploy/releases:computeDeploymentOptions'
+}
+
+export type ReleaseServiceComputeDeploymentOptionsResponses = {
+  200: ComputeDeploymentOptionsResponse
+}
+
+export type ReleaseServiceComputeDeploymentOptionsResponse
+  = ReleaseServiceComputeDeploymentOptionsResponses[keyof ReleaseServiceComputeDeploymentOptionsResponses]
+
+export type ReleaseServicePrecheckReleaseData = {
+  body: PrecheckReleaseRequest
+  path?: never
+  query?: never
+  url: '/enterprise/app-deploy/releases:precheck'
+}
+
+export type ReleaseServicePrecheckReleaseResponses = {
+  200: PrecheckReleaseResponse
+}
+
+export type ReleaseServicePrecheckReleaseResponse
+  = ReleaseServicePrecheckReleaseResponses[keyof ReleaseServicePrecheckReleaseResponses]
+
 export type ConsoleSsoOAuth2LoginData = {
   body?: never
   path?: never
diff --git a/packages/contracts/generated/enterprise/zod.gen.ts b/packages/contracts/generated/enterprise/zod.gen.ts
index cef500a9064..d7a42b35d4c 100644
--- a/packages/contracts/generated/enterprise/zod.gen.ts
+++ b/packages/contracts/generated/enterprise/zod.gen.ts
@@ -2,6 +2,975 @@
 
 import * as z from 'zod'
 
+export const zAccessMode = z.enum([
+  'ACCESS_MODE_UNSPECIFIED',
+  'ACCESS_MODE_PUBLIC',
+  'ACCESS_MODE_PRIVATE',
+  'ACCESS_MODE_PRIVATE_ALL',
+])
+
+export const zSubjectType = z.enum([
+  'SUBJECT_TYPE_UNSPECIFIED',
+  'SUBJECT_TYPE_ACCOUNT',
+  'SUBJECT_TYPE_GROUP',
+])
+
+export const zAppRunnerLogStatus = z.enum([
+  'APP_RUNNER_LOG_STATUS_UNSPECIFIED',
+  'APP_RUNNER_LOG_STATUS_RUNNING',
+  'APP_RUNNER_LOG_STATUS_SUCCEEDED',
+  'APP_RUNNER_LOG_STATUS_FAILED',
+  'APP_RUNNER_LOG_STATUS_PARTIAL_SUCCEEDED',
+])
+
+export const zAssignmentOperation = z.enum([
+  'ASSIGNMENT_OPERATION_UNSPECIFIED',
+  'ASSIGNMENT_OPERATION_LOAD',
+  'ASSIGNMENT_OPERATION_UNLOAD',
+])
+
+export const zEnvironmentMode = z.enum([
+  'ENVIRONMENT_MODE_UNSPECIFIED',
+  'ENVIRONMENT_MODE_SHARED',
+  'ENVIRONMENT_MODE_ISOLATED',
+])
+
+export const zRuntimeBackend = z.enum([
+  'RUNTIME_BACKEND_UNSPECIFIED',
+  'RUNTIME_BACKEND_K8S',
+  'RUNTIME_BACKEND_EXTERNAL',
+])
+
+export const zPluginCategory = z.enum([
+  'PLUGIN_CATEGORY_UNSPECIFIED',
+  'PLUGIN_CATEGORY_MODEL',
+  'PLUGIN_CATEGORY_TOOL',
+])
+
+export const zDeploymentStatus = z.enum([
+  'DEPLOYMENT_STATUS_UNSPECIFIED',
+  'DEPLOYMENT_STATUS_DEPLOYING',
+  'DEPLOYMENT_STATUS_READY',
+  'DEPLOYMENT_STATUS_FAILED',
+  'DEPLOYMENT_STATUS_CANCELLED',
+])
+
+export const zDeploymentAction = z.enum([
+  'DEPLOYMENT_ACTION_UNSPECIFIED',
+  'DEPLOYMENT_ACTION_DEPLOY',
+  'DEPLOYMENT_ACTION_PROMOTE',
+  'DEPLOYMENT_ACTION_ROLLBACK',
+  'DEPLOYMENT_ACTION_UNDEPLOY',
+])
+
+export const zDeveloperApiUrlStatus = z.enum([
+  'DEVELOPER_API_URL_STATUS_UNSPECIFIED',
+  'DEVELOPER_API_URL_STATUS_CONFIGURED',
+  'DEVELOPER_API_URL_STATUS_NOT_CONFIGURED',
+])
+
+export const zEnvVarValueSource = z.enum([
+  'ENV_VAR_VALUE_SOURCE_UNSPECIFIED',
+  'ENV_VAR_VALUE_SOURCE_LITERAL',
+  'ENV_VAR_VALUE_SOURCE_DSL_DEFAULT',
+  'ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT',
+])
+
+export const zEnvVarValueType = z.enum([
+  'ENV_VAR_VALUE_TYPE_UNSPECIFIED',
+  'ENV_VAR_VALUE_TYPE_STRING',
+  'ENV_VAR_VALUE_TYPE_NUMBER',
+  'ENV_VAR_VALUE_TYPE_SECRET',
+])
+
+export const zEnvironmentStatus = z.enum([
+  'ENVIRONMENT_STATUS_UNSPECIFIED',
+  'ENVIRONMENT_STATUS_ADMISSION',
+  'ENVIRONMENT_STATUS_BOOTSTRAPPING',
+  'ENVIRONMENT_STATUS_READY',
+  'ENVIRONMENT_STATUS_FAILED',
+  'ENVIRONMENT_STATUS_DELETING',
+])
+
+export const zRuntimeInstanceStatus = z.enum([
+  'RUNTIME_INSTANCE_STATUS_UNSPECIFIED',
+  'RUNTIME_INSTANCE_STATUS_UNDEPLOYED',
+  'RUNTIME_INSTANCE_STATUS_DEPLOYING',
+  'RUNTIME_INSTANCE_STATUS_READY',
+  'RUNTIME_INSTANCE_STATUS_FAILED',
+  'RUNTIME_INSTANCE_STATUS_DRIFTED',
+  'RUNTIME_INSTANCE_STATUS_INVALID',
+  'RUNTIME_INSTANCE_STATUS_UNDEPLOYING',
+])
+
+export const zAppRunnerLaunchProfileMode = z.enum([
+  'APP_RUNNER_LAUNCH_PROFILE_MODE_UNSPECIFIED',
+  'APP_RUNNER_LAUNCH_PROFILE_MODE_DEBUG',
+])
+
+export const zOperatorType = z.enum([
+  'OPERATOR_TYPE_UNSPECIFIED',
+  'OPERATOR_TYPE_END_USER',
+  'OPERATOR_TYPE_ACCOUNT',
+  'OPERATOR_TYPE_SERVICE_ACCOUNT',
+  'OPERATOR_TYPE_SYSTEM',
+])
+
+export const zReleaseSource = z.enum([
+  'RELEASE_SOURCE_UNSPECIFIED',
+  'RELEASE_SOURCE_SOURCE_APP',
+  'RELEASE_SOURCE_UPLOAD',
+])
+
+export const zReleaseEnvironmentActionKind = z.enum([
+  'RELEASE_ENVIRONMENT_ACTION_KIND_UNSPECIFIED',
+  'RELEASE_ENVIRONMENT_ACTION_KIND_PROMOTE',
+  'RELEASE_ENVIRONMENT_ACTION_KIND_ROLLBACK',
+  'RELEASE_ENVIRONMENT_ACTION_KIND_CURRENT',
+  'RELEASE_ENVIRONMENT_ACTION_KIND_DEPLOYING',
+  'RELEASE_ENVIRONMENT_ACTION_KIND_BLOCKED',
+])
+
+export const zAckStatus = z.enum([
+  'ACK_STATUS_UNSPECIFIED',
+  'ACK_STATUS_READY',
+  'ACK_STATUS_FAILED',
+])
+
+export const zSlotType = z.enum([
+  'SLOT_TYPE_UNSPECIFIED',
+  'SLOT_TYPE_PLUGIN_CREDENTIAL',
+  'SLOT_TYPE_ENV_VAR',
+])
+
+export const zRouteTargetKind = z.enum([
+  'ROUTE_TARGET_KIND_UNSPECIFIED',
+  'ROUTE_TARGET_KIND_K8S_SERVICE',
+  'ROUTE_TARGET_KIND_DIRECT_UPSTREAM',
+])
+
+export const zPasswordChangeReason = z.enum([
+  'PASSWORD_CHANGE_REASON_UNSPECIFIED',
+  'PASSWORD_CHANGE_REASON_TEMP',
+  'PASSWORD_CHANGE_REASON_EXPIRED',
+  'PASSWORD_CHANGE_REASON_POLICY',
+])
+
+export const zOtelEndpointMode = z.enum([
+  'OTEL_ENDPOINT_MODE_UNIFIED',
+  'OTEL_ENDPOINT_MODE_DEDICATED',
+])
+
+export const zAppStatus = z.enum([
+  'APP_STATUS_UNSPECIFIED',
+  'APP_STATUS_PUBLISHED',
+  'APP_STATUS_UNPUBLISHED',
+  'APP_STATUS_DELETED',
+])
+
+export const zLimitType = z.enum([
+  'LIMIT_TYPE_UNSPECIFIED',
+  'LIMIT_TYPE_RPM',
+  'LIMIT_TYPE_CONCURRENCY',
+  'LIMIT_TYPE_TOKEN',
+])
+
+export const zLimitAction = z.enum([
+  'LIMIT_ACTION_UNSPECIFIED',
+  'LIMIT_ACTION_BLOCK',
+  'LIMIT_ACTION_TRACK',
+])
+
+export const zPasswordStrengthLevel = z.enum([
+  'PASSWORD_STRENGTH_LEVEL_UNSPECIFIED',
+  'PASSWORD_STRENGTH_LEVEL_WEAK',
+  'PASSWORD_STRENGTH_LEVEL_MEDIUM',
+  'PASSWORD_STRENGTH_LEVEL_STRONG',
+])
+
+export const zPluginInstallationScope = z.enum([
+  'PLUGIN_INSTALLATION_SCOPE_ALL',
+  'PLUGIN_INSTALLATION_SCOPE_OFFICIAL_ONLY',
+  'PLUGIN_INSTALLATION_SCOPE_OFFICIAL_AND_SPECIFIC_PARTNERS',
+  'PLUGIN_INSTALLATION_SCOPE_NONE',
+])
+
+export const zLimitStatus = z.enum([
+  'LIMIT_STATUS_UNSPECIFIED',
+  'LIMIT_STATUS_NA',
+  'LIMIT_STATUS_NORMAL',
+  'LIMIT_STATUS_THROTTLED',
+])
+
+export const zAccessSubject = z.object({
+  subjectType: zSubjectType,
+  subjectId: z.string(),
+})
+
+export const zAccessPolicy = z.object({
+  id: z.string(),
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+  mode: zAccessMode,
+  subjects: z.array(zAccessSubject),
+  createdAt: z.iso.datetime(),
+  updatedAt: z.iso.datetime(),
+})
+
+export const zActor = z.object({
+  id: z.string(),
+  displayName: z.string(),
+})
+
+export const zAccessChannels = z.object({
+  id: z.string(),
+  appInstanceId: z.string(),
+  webAppEnabled: z.boolean(),
+  developerApiEnabled: z.boolean(),
+  updatedBy: zActor,
+  createdAt: z.iso.datetime(),
+  updatedAt: z.iso.datetime(),
+})
+
+export const zApiKey = z.object({
+  id: z.string(),
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+  displayName: z.string(),
+  maskedToken: z.string(),
+  createdBy: zActor,
+  createdAt: z.iso.datetime(),
+  lastUsedAt: z.iso.datetime().optional(),
+})
+
+export const zAppInstance = z.object({
+  id: z.string(),
+  tenantId: z.string(),
+  displayName: z.string(),
+  description: z.string(),
+  createdBy: zActor,
+  updatedBy: zActor,
+  createdAt: z.iso.datetime(),
+  updatedAt: z.iso.datetime(),
+})
+
+/**
+ * BootstrapAssignment is one runtime_instance assignment in a runner's startup
+ * baseline.
+ */
+export const zBootstrapAssignment = z.object({
+  appId: z.string().optional(),
+  environmentId: z.string().optional(),
+  workflowId: z.string().optional(),
+  runtimeInstanceId: z.string().optional(),
+  workspaceId: z.string().optional(),
+  runtimeInstanceVersion: z.string().optional(),
+  bindingSnapshotVersion: z.string().optional(),
+  executionTokenVersion: z.string().optional(),
+  executionToken: z.string().optional(),
+  releaseId: z.string().optional(),
+  operation: zAssignmentOperation.optional(),
+  deploymentId: z.string().optional(),
+  requiresStatusReport: z.boolean().optional(),
+})
+
+export const zBootstrapRunnerResponse = z.object({
+  runnerId: z.string().optional(),
+  assignmentRevision: z.string().optional(),
+  assignments: z.array(zBootstrapAssignment).optional(),
+})
+
+export const zCancelDeploymentRequest = z.object({
+  appInstanceId: z.string().optional(),
+  environmentId: z.string().optional(),
+})
+
+export const zComputeDeploymentOptionsRequest = z.object({
+  environmentId: z.string().optional(),
+  appInstanceId: z.string().optional(),
+  dsl: z.string().optional(),
+  sourceAppId: z.string().optional(),
+  releaseId: z.string().optional(),
+})
+
+export const zCreateApiKeyRequest = z.object({
+  appInstanceId: z.string().optional(),
+  environmentId: z.string().optional(),
+  displayName: z.string(),
+})
+
+export const zCreateApiKeyResponse = z.object({
+  apiKey: zApiKey,
+  token: z.string(),
+})
+
+export const zCreateAppInstanceRequest = z.object({
+  displayName: z.string(),
+  description: z.string().optional(),
+})
+
+export const zCreateAppInstanceResponse = z.object({
+  appInstance: zAppInstance,
+})
+
+export const zCreateReleaseRequest = z.object({
+  createAppInstance: z.boolean().optional(),
+  appInstanceId: z.string().optional(),
+  displayName: z.string().optional(),
+  description: z.string().optional(),
+  dsl: z.string().optional(),
+  sourceAppId: z.string().optional(),
+})
+
+/**
+ * CredentialCandidate is one tenant-visible credential a frontend may
+ * pick for a credential slot. It carries no secret.
+ */
+export const zCredentialCandidate = z.object({
+  credentialId: z.string(),
+  providerId: z.string(),
+  category: zPluginCategory,
+  displayName: z.string(),
+  fromEnterprise: z.boolean(),
+})
+
+/**
+ * CredentialSelectionInput is one deploy-time plugin-credential
+ * selection: a shared credential id chosen for a required DSL slot.
+ */
+export const zCredentialSelectionInput = z.object({
+  providerId: z.string(),
+  category: zPluginCategory.optional(),
+  credentialId: z.string(),
+})
+
+/**
+ * CredentialSlot is one model/tool plugin-credential requirement a
+ * Release's DSL declares, paired with the candidates selectable for it.
+ */
+export const zCredentialSlot = z.object({
+  providerId: z.string(),
+  category: zPluginCategory,
+  candidates: z.array(zCredentialCandidate),
+  lastCredentialId: z.string(),
+})
+
+export const zDeleteApiKeyResponse = z.record(z.string(), z.unknown())
+
+export const zDeleteAppInstanceResponse = z.record(z.string(), z.unknown())
+
+export const zDeleteEnvironmentResponse = z.record(z.string(), z.unknown())
+
+export const zDeleteReleaseResponse = z.record(z.string(), z.unknown())
+
+export const zDeploymentOptionsAppInstanceDefaults = z.object({
+  displayName: z.string(),
+  description: z.string(),
+})
+
+export const zDeploymentOptionsReleaseDefaults = z.object({
+  displayName: z.string(),
+  description: z.string(),
+})
+
+export const zEnvVarInput = z.object({
+  key: z.string(),
+  value: z.string().optional(),
+  valueSource: zEnvVarValueSource.optional(),
+})
+
+export const zEnvVarSlot = z.object({
+  key: z.string(),
+  valueType: zEnvVarValueType,
+  description: z.string(),
+  defaultValue: z.string().optional(),
+  lastValue: z.string().optional(),
+})
+
+export const zDeploymentOptions = z.object({
+  dslDigest: z.string(),
+  appInstanceDefaults: zDeploymentOptionsAppInstanceDefaults,
+  releaseDefaults: zDeploymentOptionsReleaseDefaults,
+  credentialSlots: z.array(zCredentialSlot),
+  envVarSlots: z.array(zEnvVarSlot),
+})
+
+export const zComputeDeploymentOptionsResponse = z.object({
+  options: zDeploymentOptions,
+})
+
+export const zEnvironmentDeploymentRecord = z.object({
+  id: z.string(),
+  status: zDeploymentStatus,
+  createdAt: z.iso.datetime(),
+  finalizedAt: z.iso.datetime().optional(),
+})
+
+/**
+ * Error is the package-wide failure shape, carried wherever an operation or
+ * resource reports an error.
+ */
+export const zError = z.object({
+  code: z.string().optional(),
+  message: z.string().optional(),
+  phase: z.string().optional(),
+  occurredAt: z.iso.datetime().optional(),
+})
+
+export const zDeveloperApiUrl = z.object({
+  apiUrl: z.string(),
+  status: zDeveloperApiUrlStatus,
+  error: zError.optional(),
+})
+
+export const zApiKeySummary = z.object({
+  apiKeyCount: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' }),
+  environmentCount: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' }),
+  developerApiEnabled: z.boolean(),
+  developerApiUrl: zDeveloperApiUrl,
+})
+
+export const zEnvironment = z.object({
+  id: z.string(),
+  displayName: z.string(),
+  description: z.string(),
+  mode: zEnvironmentMode,
+  backend: zRuntimeBackend,
+  status: zEnvironmentStatus,
+  statusMessage: z.string(),
+  lastError: zError.optional(),
+  apiServer: z.string().optional(),
+  namespace: z.string().optional(),
+  managedBy: z.string().optional(),
+  runtimeEndpoint: z.string().optional(),
+  cpuCount: z.number(),
+  createdAt: z.iso.datetime(),
+  updatedAt: z.iso.datetime(),
+})
+
+export const zAccessEndpoint = z.object({
+  environment: zEnvironment.optional(),
+  endpointUrl: z.string(),
+})
+
+export const zCreateEnvironmentResponse = z.object({
+  environment: zEnvironment.optional(),
+})
+
+export const zExchangeControlTokenRequest = z.object({
+  joinToken: z.string().optional(),
+})
+
+export const zExchangeControlTokenResponse = z.object({
+  accessToken: z.string().optional(),
+  expiresAt: z.iso.datetime().optional(),
+})
+
+export const zExportReleaseDslResponse = z.object({
+  dsl: z.string(),
+})
+
+export const zExternalAppRunnerConfig = z.object({
+  runtimeEndpoint: z.string().optional(),
+})
+
+export const zGenerateAppRunnerLaunchProfileRequest = z.object({
+  environmentId: z.string().optional(),
+  mode: zAppRunnerLaunchProfileMode.optional(),
+  controlEndpoint: z.string(),
+  pluginDaemonBaseUrl: z.string(),
+  runtimeListenAddr: z.string(),
+  debugListenAddr: z.string().optional(),
+})
+
+export const zGenerateAppRunnerLaunchProfileResponse = z.object({
+  environmentId: z.string().optional(),
+  joinToken: z.string().optional(),
+  configYaml: z.string().optional(),
+  runtimeEndpoint: z.string().optional(),
+  sourceCommands: z.array(z.string()).optional(),
+  dockerCommands: z.array(z.string()).optional(),
+})
+
+export const zGetAccessChannelsResponse = z.object({
+  accessChannels: zAccessChannels,
+})
+
+export const zGetAccessPolicyResponse = z.object({
+  policy: zAccessPolicy,
+})
+
+export const zGetAppInstanceResponse = z.object({
+  appInstance: zAppInstance,
+})
+
+export const zGetDeveloperApiSettingsResponse = z.object({
+  accessChannels: zAccessChannels,
+  environments: z.array(zEnvironment),
+  apiKeys: z.array(zApiKey),
+  developerApiUrl: zDeveloperApiUrl,
+})
+
+export const zGetEnvironmentResponse = z.object({
+  environment: zEnvironment.optional(),
+})
+
+export const zK8sEnvironmentConfig = z.object({
+  namespace: z.string().optional(),
+  apiServer: z.string().optional(),
+  caBundle: z.string().optional(),
+  bearerToken: z.string().optional(),
+})
+
+export const zCreateEnvironmentRequest = z.object({
+  displayName: z.string(),
+  description: z.string().optional(),
+  mode: zEnvironmentMode.optional(),
+  backend: zRuntimeBackend.optional(),
+  k8s: zK8sEnvironmentConfig.optional(),
+  external: zExternalAppRunnerConfig.optional(),
+  cpuCount: z.number().optional(),
+  idempotencyKey: z.string(),
+})
+
+export const zListApiKeysResponse = z.object({
+  apiKeys: z.array(zApiKey),
+  apiUrl: z.string(),
+})
+
+export const zListReleaseCredentialCandidatesResponse = z.object({
+  slots: z.array(zCredentialSlot),
+})
+
+export const zNamedRef = z.object({
+  id: z.string(),
+  displayName: z.string(),
+})
+
+export const zNewAppInstance = z.object({
+  displayName: z.string().optional(),
+  description: z.string().optional(),
+})
+
+export const zDeployRequest = z.object({
+  dsl: z.string().optional(),
+  sourceAppId: z.string().optional(),
+  newAppInstance: zNewAppInstance.optional(),
+  environmentId: z.string(),
+  releaseName: z.string().optional(),
+  releaseDescription: z.string().optional(),
+  credentials: z.array(zCredentialSelectionInput).optional(),
+  envVars: z.array(zEnvVarInput).optional(),
+  idempotencyKey: z.string(),
+  expectedDslDigest: z.string().optional(),
+})
+
+/**
+ * Operator is who triggered the run (the "END USER OR ACCOUNT" column).
+ */
+export const zOperator = z.object({
+  type: zOperatorType,
+  id: z.string(),
+  displayName: z.string(),
+})
+
+export const zAppRunnerLog = z.object({
+  id: z.string(),
+  timestamp: z.iso.datetime(),
+  workflowRunId: z.string(),
+  status: zAppRunnerLogStatus,
+  durationSeconds: z.number(),
+  totalTokens: z.string(),
+  workspace: zNamedRef,
+  environment: zNamedRef,
+  appInstance: zNamedRef,
+  operator: zOperator,
+  invokeFrom: z.string(),
+  traceId: z.string(),
+  difyTraceId: z.string(),
+  gateCommitId: z.string(),
+  body: z.string().optional(),
+  attributesJson: z.string().optional(),
+  resourceAttributesJson: z.string().optional(),
+})
+
+export const zGetAppRunnerLogResponse = z.object({
+  appRunnerLog: zAppRunnerLog,
+  lastArchived: z.iso.datetime().optional(),
+})
+
+export const zPrecheckReleaseRequest = z.object({
+  appInstanceId: z.string().optional(),
+  dsl: z.string().optional(),
+  sourceAppId: z.string().optional(),
+})
+
+export const zPromoteRequest = z.object({
+  appInstanceId: z.string().optional(),
+  releaseId: z.string(),
+  environmentId: z.string().optional(),
+  credentials: z.array(zCredentialSelectionInput).optional(),
+  envVars: z.array(zEnvVarInput).optional(),
+  idempotencyKey: z.string(),
+})
+
+/**
+ * ReleaseContentMatch identifies an existing release whose DSL content is
+ * identical to the checked content.
+ */
+export const zReleaseContentMatch = z.object({
+  releaseId: z.string(),
+  displayName: z.string(),
+  createdAt: z.iso.datetime(),
+})
+
+export const zReleaseEnvironmentAction = z.object({
+  environment: zEnvironment,
+  kind: zReleaseEnvironmentActionKind,
+  disabledReason: z.string().optional(),
+  requiresRuntimeInputs: z.boolean(),
+  currentReleaseId: z.string(),
+})
+
+/**
+ * ReleaseEnvironmentDeployment is an environment where the release is the
+ * active deployment, paired with that environment's runtime status so the
+ * version history can show running vs failed vs deploying.
+ */
+export const zReleaseEnvironmentDeployment = z.object({
+  environment: zEnvironment,
+  status: zRuntimeInstanceStatus,
+})
+
+export const zReportRuntimeAssignmentStatusRequest = z.object({
+  deploymentId: z.string().optional(),
+  runtimeInstanceId: z.string().optional(),
+  releaseId: z.string().optional(),
+  status: zAckStatus.optional(),
+  lastError: zError.optional(),
+  runnerId: z.string().optional(),
+  assignmentRevision: z.string().optional(),
+})
+
+export const zReportRuntimeAssignmentStatusResponse = z.object({
+  accepted: z.boolean().optional(),
+  stale: z.boolean().optional(),
+})
+
+/**
+ * RequiredSlot is an input requirement extracted from a Release's
+ * DSL.
+ */
+export const zRequiredSlot = z.object({
+  type: zSlotType,
+  providerId: z.string(),
+  category: zPluginCategory,
+  key: z.string(),
+})
+
+export const zRelease = z.object({
+  id: z.string(),
+  appInstanceId: z.string(),
+  displayName: z.string(),
+  description: z.string(),
+  source: zReleaseSource,
+  sourceAppId: z.string().optional(),
+  gateCommitId: z.string(),
+  requiredSlots: z.array(zRequiredSlot),
+  createdBy: zActor,
+  createdAt: z.iso.datetime(),
+})
+
+export const zCreateReleaseResponse = z.object({
+  release: zRelease,
+  appInstance: zAppInstance,
+})
+
+export const zDeployment = z.object({
+  id: z.string(),
+  appInstanceId: z.string(),
+  status: zDeploymentStatus,
+  action: zDeploymentAction,
+  environment: zEnvironment,
+  release: zRelease,
+  error: zError.optional(),
+  createdBy: zActor,
+  createdAt: z.iso.datetime(),
+  finalizedAt: z.iso.datetime().optional(),
+})
+
+export const zCancelDeploymentResponse = z.object({
+  deployment: zDeployment,
+})
+
+export const zDeployResponse = z.object({
+  appInstance: zAppInstance,
+  release: zRelease,
+  deployment: zDeployment,
+})
+
+/**
+ * EnvironmentAppInstance is one app instance as seen from a single environment:
+ * its current release, runtime status, and derived last error in THIS env.
+ */
+export const zEnvironmentAppInstance = z.object({
+  appInstance: zAppInstance.optional(),
+  currentRelease: zRelease.optional(),
+  status: zRuntimeInstanceStatus.optional(),
+  lastError: zError.optional(),
+  workspaceId: z.string().optional(),
+  workspaceName: z.string().optional(),
+})
+
+export const zEnvironmentDeployment = z.object({
+  appInstanceId: z.string(),
+  environment: zEnvironment,
+  status: zRuntimeInstanceStatus,
+  currentRelease: zRelease.optional(),
+  desiredRelease: zRelease.optional(),
+  currentDeployment: zEnvironmentDeploymentRecord.optional(),
+  error: zError.optional(),
+  updatedAt: z.iso.datetime(),
+  releasesBehind: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+})
+
+export const zAppInstanceSummary = z.object({
+  appInstance: zAppInstance,
+  environmentDeployments: z.array(zEnvironmentDeployment),
+  latestRelease: zRelease.optional(),
+  accessChannels: zAccessChannels,
+  apiKeySummary: zApiKeySummary,
+})
+
+export const zComputeReleaseDeploymentViewResponse = z.object({
+  releases: z.array(zRelease),
+  environmentDeployments: z.array(zEnvironmentDeployment),
+  environmentActions: z.array(zReleaseEnvironmentAction),
+  options: zDeploymentOptions.optional(),
+})
+
+/**
+ * EnvironmentDeploymentHistoryItem is one deployment row in an environment's
+ * history, with a thin reference to the owning app instance.
+ */
+export const zEnvironmentDeploymentHistoryItem = z.object({
+  deployment: zDeployment.optional(),
+  appInstanceId: z.string().optional(),
+  appInstanceName: z.string().optional(),
+  workspaceId: z.string().optional(),
+  workspaceName: z.string().optional(),
+})
+
+export const zGetAppInstanceOverviewResponse = z.object({
+  appInstance: zAppInstance,
+  environmentDeployments: z.array(zEnvironmentDeployment),
+  recentReleases: z.array(zRelease),
+  accessChannels: zAccessChannels,
+  apiKeySummary: zApiKeySummary,
+  totalReleaseCount: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' }),
+})
+
+export const zGetReleaseResponse = z.object({
+  release: zRelease,
+})
+
+export const zListEnvironmentDeploymentsResponse = z.object({
+  environmentDeployments: z.array(zEnvironmentDeployment),
+})
+
+export const zPromoteResponse = z.object({
+  deployment: zDeployment,
+})
+
+export const zReleaseSummary = z.object({
+  release: zRelease,
+  deployedEnvironments: z.array(zReleaseEnvironmentDeployment),
+  environmentActions: z.array(zReleaseEnvironmentAction),
+  activeEnvironmentCount: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' }),
+})
+
+export const zResolveApiTokenRouteRequest = z.object({
+  token: z.string().optional(),
+})
+
+export const zResolveApiTokenRouteResponse = z.object({
+  environmentId: z.string().optional(),
+  namespace: z.string().optional(),
+  serviceName: z.string().optional(),
+  servicePort: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  environmentStatus: zEnvironmentStatus.optional(),
+  appId: z.string().optional(),
+  tenantId: z.string().optional(),
+  runtimeInstanceId: z.string().optional(),
+  observedReleaseId: z.string().optional(),
+  runtimeInstanceStatus: zRuntimeInstanceStatus.optional(),
+  revoked: z.boolean().optional(),
+  unavailableReason: z.string().optional(),
+  targetKind: zRouteTargetKind.optional(),
+  directUpstream: z.string().optional(),
+})
+
+export const zRollbackRequest = z.object({
+  appInstanceId: z.string().optional(),
+  environmentId: z.string().optional(),
+  targetReleaseId: z.string(),
+  idempotencyKey: z.string(),
+})
+
+export const zRollbackResponse = z.object({
+  deployment: zDeployment,
+})
+
+export const zRollbackTarget = z.object({
+  release: zRelease,
+  resolvedDeploymentId: z.string(),
+  deployedAt: z.iso.datetime(),
+  isCurrent: z.boolean(),
+})
+
+export const zRunnerInfo = z.object({
+  hostname: z.string().optional(),
+})
+
+export const zBootstrapRunnerRequest = z.object({
+  runner: zRunnerInfo.optional(),
+})
+
+export const zRuntimeArtifact = z.object({
+  dslYaml: z.string().optional(),
+  bindingSnapshotVersion: z.string().optional(),
+  bindingSnapshot: z.record(z.string(), z.unknown()).optional(),
+})
+
+export const zRuntimeArtifactRequest = z.object({
+  runtimeInstanceId: z.string().optional(),
+  releaseId: z.string().optional(),
+  deploymentId: z.string().optional(),
+  bindingSnapshotVersion: z.string().optional(),
+})
+
+export const zBatchResolveRuntimeArtifactsRequest = z.object({
+  requests: z.array(zRuntimeArtifactRequest).optional(),
+})
+
+export const zRuntimeArtifactResult = z.object({
+  runtimeInstanceId: z.string().optional(),
+  releaseId: z.string().optional(),
+  artifact: zRuntimeArtifact.optional(),
+  error: zError.optional(),
+  deploymentId: z.string().optional(),
+})
+
+export const zBatchResolveRuntimeArtifactsResponse = z.object({
+  results: z.array(zRuntimeArtifactResult).optional(),
+})
+
+export const zTestConnectionRequest = z.object({
+  environmentId: z.string().optional(),
+})
+
+export const zTestConnectionResponse = z.object({
+  reachable: z.boolean().optional(),
+  message: z.string().optional(),
+})
+
+export const zUndeployRequest = z.object({
+  appInstanceId: z.string().optional(),
+  environmentId: z.string().optional(),
+  idempotencyKey: z.string(),
+})
+
+export const zUndeployResponse = z.object({
+  deployment: zDeployment,
+})
+
+/**
+ * UnsupportedDslNode identifies a workflow node whose type the app runner
+ * cannot execute.
+ */
+export const zUnsupportedDslNode = z.object({
+  id: z.string(),
+  type: z.string(),
+})
+
+export const zPrecheckReleaseResponse = z.object({
+  gateCommitId: z.string(),
+  canCreate: z.boolean(),
+  matchedRelease: zReleaseContentMatch.optional(),
+  unsupportedNodes: z.array(zUnsupportedDslNode),
+})
+
+export const zUpdateAccessChannelsRequest = z.object({
+  appInstanceId: z.string().optional(),
+  webAppEnabled: z.boolean().optional(),
+  developerApiEnabled: z.boolean().optional(),
+})
+
+export const zUpdateAccessChannelsResponse = z.object({
+  accessChannels: zAccessChannels,
+})
+
+export const zUpdateAccessPolicyRequest = z.object({
+  appInstanceId: z.string().optional(),
+  environmentId: z.string().optional(),
+  mode: zAccessMode,
+  subjects: z.array(zAccessSubject).optional(),
+})
+
+export const zUpdateAccessPolicyResponse = z.object({
+  policy: zAccessPolicy,
+})
+
+export const zUpdateAppInstanceRequest = z.object({
+  appInstanceId: z.string().optional(),
+  displayName: z.string(),
+  description: z.string().optional(),
+})
+
+export const zUpdateAppInstanceResponse = z.object({
+  appInstance: zAppInstance,
+})
+
+export const zUpdateEnvironmentRequest = z.object({
+  environmentId: z.string().optional(),
+  displayName: z.string(),
+  description: z.string().optional(),
+})
+
+export const zUpdateEnvironmentResponse = z.object({
+  environment: zEnvironment.optional(),
+})
+
+export const zUpdateReleaseRequest = z.object({
+  releaseId: z.string().optional(),
+  displayName: z.string(),
+  description: z.string().optional(),
+})
+
+export const zUpdateReleaseResponse = z.object({
+  release: zRelease,
+})
+
 /**
  * Account represents a basic user account
  */
@@ -52,7 +1021,7 @@ export const zBrandingInfo = z.object({
 
 export const zCheckPasswordStatusReply = z.object({
   requirePasswordChange: z.boolean().optional(),
-  changeReason: z.int().optional(),
+  changeReason: zPasswordChangeReason.optional(),
   daysToExpire: z
     .int()
     .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
@@ -178,6 +1147,14 @@ export const zEnterpriseSystemUserSettingReply = z.object({
   enableEmailPasswordLogin: z.boolean().optional(),
 })
 
+export const zExternallyAccessibleApp = z.object({
+  appId: z.string().optional(),
+  tenantId: z.string().optional(),
+  mode: z.string().optional(),
+  name: z.string().optional(),
+  updatedAt: z.string().optional(),
+})
+
 export const zGetBearerTokenResponse = z.object({
   maskedToken: z.string().optional(),
 })
@@ -228,7 +1205,7 @@ export const zGroupAppItem = z.object({
   app_name: z.string().optional(),
   workspace_id: z.string().optional(),
   workspace_name: z.string().optional(),
-  app_status: z.int().optional(),
+  app_status: zAppStatus.optional(),
   token_usage: z.string().optional(),
   rpm: z.string().optional(),
   concurrency: z.string().optional(),
@@ -277,6 +1254,31 @@ export const zInnerIsUserAllowedToAccessWebAppRes = z.object({
   result: z.boolean().optional(),
 })
 
+export const zInnerListExternallyAccessibleAppsReq = z.object({
+  page: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  limit: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  mode: z.string().optional(),
+  name: z.string().optional(),
+})
+
+export const zInnerListExternallyAccessibleAppsRes = z.object({
+  data: z.array(zExternallyAccessibleApp).optional(),
+  total: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  hasMore: z.boolean().optional(),
+})
+
 export const zInnerReleaseAdmissionRequest = z.object({
   admission: zInnerAdmission.optional(),
 })
@@ -314,9 +1316,9 @@ export const zJoinWorkspaceReq = z.object({
 })
 
 export const zLimitConfig = z.object({
-  type: z.int().optional(),
+  type: zLimitType.optional(),
   threshold: z.string().optional(),
-  action: z.int().optional(),
+  action: zLimitAction.optional(),
   reached: z.boolean().optional(),
 })
 
@@ -424,7 +1426,7 @@ export const zOidcReply = z.object({
 export const zOtelExporterEndpoint = z.object({
   endpoint: z.string().optional(),
   compression: z.string().optional(),
-  protocol: z.int().optional(),
+  protocol: z.enum(['HTTP_PROTOBUF', 'HTTP_JSON', 'GRPC']).optional(),
   timeout: z
     .string()
     .regex(/^-?(?:0|[1-9]\d{0,11})(?:\.\d{1,9})?s$/)
@@ -439,7 +1441,7 @@ export const zOtelExporterEndpoint = z.object({
 })
 
 export const zEndpointReply = z.object({
-  mode: z.int().optional(),
+  mode: zOtelEndpointMode.optional(),
   metricsEndpoint: zOtelExporterEndpoint.optional(),
   tracesEndpoint: zOtelExporterEndpoint.optional(),
 })
@@ -449,7 +1451,7 @@ export const zOtelExporterStatusReply = z.object({
   bytesPushed: z.string().optional(),
   itemsInQueue: z.string().optional(),
   logs: z.string().optional(),
-  status: z.int().optional(),
+  status: z.enum(['RUNNING', 'ERROR', 'STOPPED']).optional(),
 })
 
 export const zPasswordPolicyConfig = z.object({
@@ -473,7 +1475,7 @@ export const zPasswordPolicyConfig = z.object({
 })
 
 export const zPasswordStrengthReply = z.object({
-  level: z.int().optional(),
+  level: zPasswordStrengthLevel.optional(),
 })
 
 export const zPasswordStrengthReq = z.object({
@@ -486,10 +1488,25 @@ export const zPluginInstallationPermissionInfo = z.object({
 })
 
 export const zPluginInstallationSettingsReply = z.object({
-  pluginInstallationScope: z.int().optional(),
+  pluginInstallationScope: zPluginInstallationScope.optional(),
   restrictToMarketplaceOnly: z.boolean().optional(),
 })
 
+export const zRbacRole = z.object({
+  id: z.string().optional(),
+  type: z.string().optional(),
+  name: z.string().optional(),
+  description: z.string().optional(),
+  isBuiltin: z.boolean().optional(),
+  category: z.string().optional(),
+  permissionKeys: z.array(z.string()).optional(),
+})
+
+export const zGetMemberRbacRolesReply = z.object({
+  accountId: z.string().optional(),
+  roles: z.array(zRbacRole).optional(),
+})
+
 export const zResetMemberPasswordReply = z.object({
   id: z.string().optional(),
   password: z.string().optional(),
@@ -534,15 +1551,15 @@ export const zResourceGroupDetail = z.object({
     .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
     .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
     .optional(),
-  rpm_action: z.int().optional(),
+  rpm_action: zLimitAction.optional(),
   concurrency_limit: z
     .int()
     .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
     .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
     .optional(),
-  concurrency_action: z.int().optional(),
+  concurrency_action: zLimitAction.optional(),
   token_quota: z.string().optional(),
-  token_action: z.int().optional(),
+  token_action: zLimitAction.optional(),
   created_at: z.string().optional(),
   updated_at: z.string().optional(),
 })
@@ -565,8 +1582,8 @@ export const zResourceGroupItem = z.object({
   token_quota: z.string().optional(),
   token_usage: z.string().optional(),
   app_count: z.string().optional(),
-  rpm_status: z.int().optional(),
-  conc_status: z.int().optional(),
+  rpm_status: zLimitStatus.optional(),
+  conc_status: zLimitStatus.optional(),
   created_at: z.string().optional(),
   updated_at: z.string().optional(),
 })
@@ -606,6 +1623,7 @@ export const zLimitFields = z.object({
     .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
     .optional(),
   workspaces: zResourceQuota.optional(),
+  appRunnerEnvCpus: zResourceQuota.optional(),
 })
 
 /**
@@ -693,7 +1711,7 @@ export const zSearchAppItem = z.object({
   app_name: z.string().optional(),
   workspace_id: z.string().optional(),
   workspace_name: z.string().optional(),
-  app_status: z.int().optional(),
+  app_status: zAppStatus.optional(),
   icon: z.string().optional(),
   icon_type: z.string().optional(),
   icon_background: z.string().optional(),
@@ -760,11 +1778,24 @@ export const zGetWebAppWhitelistSubjectsRes = z.object({
  */
 export const zSubject = z.object({
   subjectId: z.string().optional(),
-  subjectType: z.string().optional(),
+  subjectType: zSubjectType.optional(),
   accountData: zSubjectAccountData.optional(),
   groupData: zSubjectGroupData.optional(),
 })
 
+export const zEnvironmentAccessPolicy = z.object({
+  environment: zEnvironment,
+  policy: zAccessPolicy.optional(),
+  resolvedSubjects: z.array(zSubject),
+})
+
+export const zGetAccessSettingsResponse = z.object({
+  accessChannels: zAccessChannels,
+  environmentPolicies: z.array(zEnvironmentAccessPolicy),
+  webAppEndpoints: z.array(zAccessEndpoint).optional(),
+  cliEndpoint: zAccessEndpoint.optional(),
+})
+
 export const zGetGroupSubjectsRes = z.object({
   subjects: z.array(zSubject).optional(),
 })
@@ -798,6 +1829,72 @@ export const zToggleEndpointRequest = z.object({
   enabled: z.boolean().optional(),
 })
 
+export const zToggleTraceProviderRequest = z.object({
+  id: z.string().optional(),
+  enabled: z.boolean().optional(),
+})
+
+/**
+ * TraceProvider is one configured trace-export destination. Trace data
+ * collected by the enterprise collector is fanned out to every enabled
+ * destination. Credentials carries per-provider secret values (e.g. Langfuse
+ * public/secret keys); Settings carries non-secret options (e.g. host,
+ * project). Secret credential values are redacted on read and preserved on
+ * write when the client echoes the redaction sentinel back (same round-trip
+ * contract as endpoint headers / TLS keys).
+ */
+export const zTraceProvider = z.object({
+  id: z.string().optional(),
+  name: z.string().optional(),
+  provider: z.string().optional(),
+  endpoint: z.string().optional(),
+  protocol: z.string().optional(),
+  credentials: z.record(z.string(), z.string()).optional(),
+  settings: z.record(z.string(), z.string()).optional(),
+  enabled: z.boolean().optional(),
+})
+
+/**
+ * TestTraceProviderRequest tests connectivity/auth for a destination config
+ * before (or without) persisting it. When credentials carry the redaction
+ * sentinel, the stored secret for the destination with the same id is used.
+ */
+export const zTestTraceProviderRequest = z.object({
+  provider: zTraceProvider.optional(),
+})
+
+/**
+ * TraceProviderField describes one credential or setting field of a provider in
+ * the static catalog: the key the dashboard sends back, its display label,
+ * whether it is required, and (for credentials) whether it is a secret that
+ * gets redacted.
+ */
+export const zTraceProviderField = z.object({
+  key: z.string().optional(),
+  displayName: z.string().optional(),
+  required: z.boolean().optional(),
+  secret: z.boolean().optional(),
+})
+
+/**
+ * TraceProviderDescriptor is one entry in the static provider catalog: the
+ * field definitions and transport defaults for a provider type. The dashboard
+ * uses it to render the add/edit form and to know which fields are secret.
+ */
+export const zTraceProviderDescriptor = z.object({
+  provider: z.string().optional(),
+  displayName: z.string().optional(),
+  credentialFields: z.array(zTraceProviderField).optional(),
+  settingFields: z.array(zTraceProviderField).optional(),
+  defaultProtocol: z.string().optional(),
+  supportedProtocols: z.array(z.string()).optional(),
+})
+
+export const zListTraceProvidersReply = z.object({
+  providers: z.array(zTraceProvider).optional(),
+  catalog: z.array(zTraceProviderDescriptor).optional(),
+})
+
 export const zUpdateAccessModeReq = z.object({
   appId: z.string().optional(),
   accessMode: z.string().optional(),
@@ -862,6 +1959,16 @@ export const zUpdateMfaStatusRes = z.object({
   message: z.string().optional(),
 })
 
+export const zUpdateMemberRbacRolesReply = z.object({
+  accountId: z.string().optional(),
+  roles: z.array(zRbacRole).optional(),
+})
+
+export const zUpdateMemberRbacRolesReq = z.object({
+  id: z.string().optional(),
+  roleIds: z.array(z.string()).optional(),
+})
+
 export const zUpdateMemberReply = z.object({
   account: zAccount.optional(),
 })
@@ -894,7 +2001,7 @@ export const zUpdateOfflineLicenseReq = z.object({
 })
 
 export const zUpdatePluginInstallationSettingsRequest = z.object({
-  pluginInstallationScope: z.int().optional(),
+  pluginInstallationScope: zPluginInstallationScope.optional(),
   restrictToMarketplaceOnly: z.boolean().optional(),
 })
 
@@ -908,15 +2015,15 @@ export const zUpdateResourceGroupRequest = z.object({
     .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
     .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
     .optional(),
-  rpm_action: z.int().optional(),
+  rpm_action: zLimitAction.optional(),
   concurrency_limit: z
     .int()
     .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
     .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
     .optional(),
-  concurrency_action: z.int().optional(),
+  concurrency_action: zLimitAction.optional(),
   token_quota: z.string().optional(),
-  token_action: z.int().optional(),
+  token_action: zLimitAction.optional(),
 })
 
 export const zUpdateUserReply = z.object({
@@ -963,6 +2070,18 @@ export const zUpdateWorkspaceReq = z.object({
   status: z.string().optional(),
 })
 
+export const zUpsertTraceProviderReply = z.object({
+  provider: zTraceProvider.optional(),
+})
+
+/**
+ * UpsertTraceProviderRequest creates a destination when id is empty (a new id
+ * is allocated) or updates the destination with the given id otherwise.
+ */
+export const zUpsertTraceProviderRequest = z.object({
+  provider: zTraceProvider.optional(),
+})
+
 export const zWebAppAuthInfo = z.object({
   allowSso: z.boolean().optional(),
   allowEmailCodeLogin: z.boolean().optional(),
@@ -985,6 +2104,7 @@ export const zInfoConfigReply = z.object({
   Branding: zBrandingInfo.optional(),
   WebAppAuth: zWebAppAuthInfo.optional(),
   PluginInstallationPermission: zPluginInstallationPermissionInfo.optional(),
+  EnableAppDeploy: z.boolean().optional(),
 })
 
 export const zWebOAuth2LoginReply = z.object({
@@ -1058,6 +2178,28 @@ export const zUpdateWorkspacePermissionReq = z.object({
   permission: zWorkspacePermission.optional(),
 })
 
+/**
+ * CursorPagination: pagination by cursor token
+ */
+export const zCursorPagination = z.object({
+  pageSize: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  nextCursor: z.string().optional(),
+  prevCursor: z.string().optional(),
+  hasNextPage: z.boolean().optional(),
+  hasPrevPage: z.boolean().optional(),
+  totalCount: z.string().optional(),
+})
+
+export const zListAppRunnerLogsResponse = z.object({
+  appRunnerLogs: z.array(zAppRunnerLog),
+  pagination: zCursorPagination,
+  lastArchived: z.iso.datetime().optional(),
+})
+
 /**
  * Pagination ： Just for pagination by page
  */
@@ -1084,6 +2226,61 @@ export const zPagination = z.object({
     .optional(),
 })
 
+export const zDashboardListAppInstancesResponse = z.object({
+  appInstances: z.array(zAppInstance),
+  pagination: zPagination,
+})
+
+export const zDashboardListEnvironmentDeploymentsResponse = z.object({
+  deployments: z.array(zEnvironmentDeploymentHistoryItem).optional(),
+  pagination: zPagination.optional(),
+})
+
+export const zListAppInstanceSummariesResponse = z.object({
+  appInstanceSummaries: z.array(zAppInstanceSummary),
+  pagination: zPagination,
+})
+
+export const zListAppInstancesResponse = z.object({
+  appInstances: z.array(zAppInstance),
+  pagination: zPagination,
+})
+
+export const zListDeploymentsResponse = z.object({
+  deployments: z.array(zDeployment),
+  pagination: zPagination,
+})
+
+export const zListEnvironmentAppInstancesResponse = z.object({
+  appInstances: z.array(zEnvironmentAppInstance).optional(),
+  pagination: zPagination.optional(),
+})
+
+export const zListEnvironmentsResponse = z.object({
+  environments: z.array(zEnvironment),
+  pagination: zPagination,
+})
+
+export const zListReleaseSummariesResponse = z.object({
+  releaseSummaries: z.array(zReleaseSummary),
+  pagination: zPagination,
+})
+
+export const zListReleasesResponse = z.object({
+  releases: z.array(zRelease),
+  pagination: zPagination,
+})
+
+export const zListRollbackTargetsResponse = z.object({
+  rollbackTargets: z.array(zRollbackTarget),
+  pagination: zPagination,
+})
+
+export const zListAccessSubjectsReply = z.object({
+  subjects: z.array(zSubject).optional(),
+  pagination: zPagination.optional(),
+})
+
 export const zListMembersReply = z.object({
   data: z.array(zAccountDetail).optional(),
   pagination: zPagination.optional(),
@@ -1104,6 +2301,469 @@ export const zListWorkspacesReply = z.object({
   pagination: zPagination.optional(),
 })
 
+export const zAccessSubjectServiceListAccessSubjectsQuery = z.object({
+  keyword: z.string().optional(),
+  groupId: z.string().optional(),
+  pageNumber: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  resultsPerPage: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+})
+
+/**
+ * OK
+ */
+export const zAccessSubjectServiceListAccessSubjectsResponse = zListAccessSubjectsReply
+
+export const zAppInstanceServiceListAppInstanceSummariesQuery = z.object({
+  pageNumber: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  resultsPerPage: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  displayName: z.string().optional(),
+  environmentId: z.string().optional(),
+})
+
+/**
+ * OK
+ */
+export const zAppInstanceServiceListAppInstanceSummariesResponse = zListAppInstanceSummariesResponse
+
+export const zAppInstanceServiceListAppInstancesQuery = z.object({
+  pageNumber: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  resultsPerPage: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  displayName: z.string().optional(),
+  environmentId: z.string().optional(),
+})
+
+/**
+ * OK
+ */
+export const zAppInstanceServiceListAppInstancesResponse = zListAppInstancesResponse
+
+export const zAppInstanceServiceCreateAppInstanceBody = zCreateAppInstanceRequest
+
+/**
+ * OK
+ */
+export const zAppInstanceServiceCreateAppInstanceResponse = zCreateAppInstanceResponse
+
+export const zAppInstanceServiceDeleteAppInstancePath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAppInstanceServiceDeleteAppInstanceResponse = zDeleteAppInstanceResponse
+
+export const zAppInstanceServiceGetAppInstancePath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAppInstanceServiceGetAppInstanceResponse = zGetAppInstanceResponse
+
+export const zAppInstanceServiceUpdateAppInstanceBody = zUpdateAppInstanceRequest
+
+export const zAppInstanceServiceUpdateAppInstancePath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAppInstanceServiceUpdateAppInstanceResponse = zUpdateAppInstanceResponse
+
+export const zAccessServiceGetAccessChannelsPath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceGetAccessChannelsResponse = zGetAccessChannelsResponse
+
+export const zAccessServiceUpdateAccessChannelsBody = zUpdateAccessChannelsRequest
+
+export const zAccessServiceUpdateAccessChannelsPath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceUpdateAccessChannelsResponse = zUpdateAccessChannelsResponse
+
+export const zAccessServiceGetAccessSettingsPath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceGetAccessSettingsResponse = zGetAccessSettingsResponse
+
+export const zDeploymentServiceListDeploymentsPath = z.object({
+  appInstanceId: z.string(),
+})
+
+export const zDeploymentServiceListDeploymentsQuery = z.object({
+  pageNumber: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  resultsPerPage: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  environmentId: z.string().optional(),
+})
+
+/**
+ * OK
+ */
+export const zDeploymentServiceListDeploymentsResponse = zListDeploymentsResponse
+
+export const zAccessServiceGetDeveloperApiSettingsPath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceGetDeveloperApiSettingsResponse = zGetDeveloperApiSettingsResponse
+
+export const zDeploymentServiceListEnvironmentDeploymentsPath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zDeploymentServiceListEnvironmentDeploymentsResponse
+  = zListEnvironmentDeploymentsResponse
+
+export const zAccessServiceGetAccessPolicyPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceGetAccessPolicyResponse = zGetAccessPolicyResponse
+
+export const zAccessServiceUpdateAccessPolicyBody = zUpdateAccessPolicyRequest
+
+export const zAccessServiceUpdateAccessPolicyPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceUpdateAccessPolicyResponse = zUpdateAccessPolicyResponse
+
+export const zAccessServiceListApiKeysPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceListApiKeysResponse = zListApiKeysResponse
+
+export const zAccessServiceCreateApiKeyBody = zCreateApiKeyRequest
+
+export const zAccessServiceCreateApiKeyPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceCreateApiKeyResponse = zCreateApiKeyResponse
+
+export const zAccessServiceDeleteApiKeyPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+  apiKeyId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAccessServiceDeleteApiKeyResponse = zDeleteApiKeyResponse
+
+export const zDeploymentServiceListRollbackTargetsPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+export const zDeploymentServiceListRollbackTargetsQuery = z.object({
+  pageNumber: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  resultsPerPage: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+})
+
+/**
+ * OK
+ */
+export const zDeploymentServiceListRollbackTargetsResponse = zListRollbackTargetsResponse
+
+export const zDeploymentServiceCancelDeploymentBody = zCancelDeploymentRequest
+
+export const zDeploymentServiceCancelDeploymentPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zDeploymentServiceCancelDeploymentResponse = zCancelDeploymentResponse
+
+export const zDeploymentServicePromoteBody = zPromoteRequest
+
+export const zDeploymentServicePromotePath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zDeploymentServicePromoteResponse = zPromoteResponse
+
+export const zDeploymentServiceRollbackBody = zRollbackRequest
+
+export const zDeploymentServiceRollbackPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zDeploymentServiceRollbackResponse = zRollbackResponse
+
+export const zDeploymentServiceUndeployBody = zUndeployRequest
+
+export const zDeploymentServiceUndeployPath = z.object({
+  appInstanceId: z.string(),
+  environmentId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zDeploymentServiceUndeployResponse = zUndeployResponse
+
+export const zReleaseServiceListReleaseSummariesPath = z.object({
+  appInstanceId: z.string(),
+})
+
+export const zReleaseServiceListReleaseSummariesQuery = z.object({
+  releaseId: z.string().optional(),
+  displayName: z.string().optional(),
+  pageNumber: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  resultsPerPage: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  environmentId: z.string().optional(),
+})
+
+/**
+ * OK
+ */
+export const zReleaseServiceListReleaseSummariesResponse = zListReleaseSummariesResponse
+
+export const zReleaseServiceListReleasesPath = z.object({
+  appInstanceId: z.string(),
+})
+
+export const zReleaseServiceListReleasesQuery = z.object({
+  releaseId: z.string().optional(),
+  displayName: z.string().optional(),
+  pageNumber: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  resultsPerPage: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  environmentId: z.string().optional(),
+})
+
+/**
+ * OK
+ */
+export const zReleaseServiceListReleasesResponse = zListReleasesResponse
+
+export const zReleaseServiceComputeReleaseDeploymentViewPath = z.object({
+  appInstanceId: z.string(),
+})
+
+export const zReleaseServiceComputeReleaseDeploymentViewQuery = z.object({
+  releaseId: z.string().optional(),
+  environmentId: z.string().optional(),
+})
+
+/**
+ * OK
+ */
+export const zReleaseServiceComputeReleaseDeploymentViewResponse
+  = zComputeReleaseDeploymentViewResponse
+
+export const zAppInstanceServiceGetAppInstanceOverviewPath = z.object({
+  appInstanceId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zAppInstanceServiceGetAppInstanceOverviewResponse = zGetAppInstanceOverviewResponse
+
+export const zDeploymentServiceDeployBody = zDeployRequest
+
+/**
+ * OK
+ */
+export const zDeploymentServiceDeployResponse = zDeployResponse
+
+export const zEnvironmentServiceListEnvironmentsQuery = z.object({
+  environmentId: z.string().optional(),
+  displayName: z.string().optional(),
+  pageNumber: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+  resultsPerPage: z
+    .int()
+    .min(-2147483648, { error: 'Invalid value: Expected int32 to be >= -2147483648' })
+    .max(2147483647, { error: 'Invalid value: Expected int32 to be <= 2147483647' })
+    .optional(),
+})
+
+/**
+ * OK
+ */
+export const zEnvironmentServiceListEnvironmentsResponse = zListEnvironmentsResponse
+
+export const zReleaseServiceCreateReleaseBody = zCreateReleaseRequest
+
+/**
+ * OK
+ */
+export const zReleaseServiceCreateReleaseResponse = zCreateReleaseResponse
+
+export const zReleaseServiceDeleteReleasePath = z.object({
+  releaseId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zReleaseServiceDeleteReleaseResponse = zDeleteReleaseResponse
+
+export const zReleaseServiceGetReleasePath = z.object({
+  releaseId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zReleaseServiceGetReleaseResponse = zGetReleaseResponse
+
+export const zReleaseServiceUpdateReleaseBody = zUpdateReleaseRequest
+
+export const zReleaseServiceUpdateReleasePath = z.object({
+  releaseId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zReleaseServiceUpdateReleaseResponse = zUpdateReleaseResponse
+
+export const zReleaseServiceExportReleaseDslPath = z.object({
+  releaseId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zReleaseServiceExportReleaseDslResponse = zExportReleaseDslResponse
+
+export const zReleaseServiceListReleaseCredentialCandidatesPath = z.object({
+  releaseId: z.string(),
+})
+
+/**
+ * OK
+ */
+export const zReleaseServiceListReleaseCredentialCandidatesResponse
+  = zListReleaseCredentialCandidatesResponse
+
+export const zReleaseServiceComputeDeploymentOptionsBody = zComputeDeploymentOptionsRequest
+
+/**
+ * OK
+ */
+export const zReleaseServiceComputeDeploymentOptionsResponse = zComputeDeploymentOptionsResponse
+
+export const zReleaseServicePrecheckReleaseBody = zPrecheckReleaseRequest
+
+/**
+ * OK
+ */
+export const zReleaseServicePrecheckReleaseResponse = zPrecheckReleaseResponse
+
 /**
  * OK
  */
diff --git a/packages/contracts/openapi-ts.api.config.ts b/packages/contracts/openapi-ts.api.config.ts
index 26c9e4cef40..8fce8a25bd3 100644
--- a/packages/contracts/openapi-ts.api.config.ts
+++ b/packages/contracts/openapi-ts.api.config.ts
@@ -183,7 +183,17 @@ const addOperationIds = (document: SwaggerDocument) => {
 }
 
 const hasSuccessResponse = (operation: SwaggerOperation) => {
-  return Object.keys(operation.responses ?? {}).some(status => /^2\d\d$/.test(status))
+  return Object.entries(operation.responses ?? {}).some(([status, response]) => {
+    if (!/^2\d\d$/.test(status))
+      return false
+    if (!isObject(response))
+      return false
+    const content = (response as JsonObject).content
+    // 204 No Content is a valid success response without a body
+    if (!isObject(content) || Object.keys(content).length === 0)
+      return status === '204'
+    return true
+  })
 }
 
 const filterContractOperations = (document: SwaggerDocument) => {
diff --git a/packages/contracts/openapi-ts.enterprise.config.ts b/packages/contracts/openapi-ts.enterprise.config.ts
index 3c9bc903ab4..aae8dcb215b 100644
--- a/packages/contracts/openapi-ts.enterprise.config.ts
+++ b/packages/contracts/openapi-ts.enterprise.config.ts
@@ -7,9 +7,36 @@ import yaml from 'js-yaml'
 type JsonObject = Record<string, unknown>
 
 type OpenApiDocument = JsonObject & {
+  components?: OpenApiComponents
   paths?: Record<string, unknown>
 }
 
+type OpenApiComponents = JsonObject & {
+  schemas?: Record<string, OpenApiSchema>
+}
+
+type OpenApiMediaType = JsonObject & {
+  schema?: unknown
+}
+
+type OpenApiOperation = JsonObject & {
+  operationId?: string
+  responses?: Record<string, OpenApiResponse>
+}
+
+type OpenApiPathItem = Record<string, unknown>
+
+type OpenApiResponse = JsonObject & {
+  content?: Record<string, OpenApiMediaType>
+}
+
+type OpenApiSchema = JsonObject & {
+  enum?: unknown[]
+  format?: string
+  properties?: Record<string, OpenApiSchema>
+  type?: string | string[]
+}
+
 type ContractOperation = {
   id: string
   operationId?: string
@@ -21,9 +48,30 @@ const enterpriseServerDir = process.env.DIFY_ENTERPRISE_SERVER
   ? path.resolve(process.env.DIFY_ENTERPRISE_SERVER)
   : path.resolve(currentDir, '../../../dify-enterprise/server')
 const enterpriseOpenApiPath = path.join(enterpriseServerDir, 'pkg/apis/enterprise/openapi.yaml')
+const operationMethods = new Set(['delete', 'get', 'patch', 'post', 'put'])
 
 const isConsoleApiPath = (routePath: string) => routePath.startsWith('/console/api/')
 
+const isObject = (value: unknown): value is JsonObject => {
+  return !!value && typeof value === 'object' && !Array.isArray(value)
+}
+
+const isOpenApiSchema = (value: unknown): value is OpenApiSchema => {
+  return isObject(value)
+}
+
+const asOpenApiOperation = (value: unknown): OpenApiOperation | undefined => {
+  return isObject(value) ? value as OpenApiOperation : undefined
+}
+
+const asOpenApiResponse = (value: unknown): OpenApiResponse | undefined => {
+  return isObject(value) ? value as OpenApiResponse : undefined
+}
+
+const asOpenApiMediaType = (value: unknown): OpenApiMediaType | undefined => {
+  return isObject(value) ? value as OpenApiMediaType : undefined
+}
+
 const stripConsoleApiPrefix = (routePath: string) => {
   if (isConsoleApiPath(routePath))
     return routePath.replace('/console/api', '')
@@ -34,9 +82,18 @@ const stripConsoleApiPrefix = (routePath: string) => {
 const stripSchemaNamePrefix = (schemaName: string) => {
   return schemaName
     .replace(/^dify\.enterprise\.api\.enterprise\./, '')
+    .replace(/^dify\.enterprise\.api\.appdeploy\.v1\./, '')
+    .replace(/^dify\.enterprise\.api\.appdeploy\./, '')
     .replace(/^pagination\./, '')
 }
 
+const contractTagSegment = (tag?: string) => {
+  if (tag === 'EnterpriseAppDeployConsole')
+    return 'AppDeploy'
+
+  return tag || 'default'
+}
+
 const contractNameSegments = (operation: ContractOperation) => {
   const operationId = operation.operationId || operation.id
   const tag = operation.tags?.[0]
@@ -48,7 +105,165 @@ const contractNameSegments = (operation: ContractOperation) => {
 }
 
 const contractPathSegments = (operation: ContractOperation) => {
-  return [operation.tags?.[0] || 'default', ...contractNameSegments(operation)]
+  return [contractTagSegment(operation.tags?.[0]), ...contractNameSegments(operation)]
+}
+
+const hasSchemaLessResponseContent = (operation: OpenApiOperation) => {
+  if (!isObject(operation.responses))
+    return false
+
+  return Object.values(operation.responses).some((response) => {
+    const openApiResponse = asOpenApiResponse(response)
+    if (!openApiResponse || !isObject(openApiResponse.content))
+      return false
+
+    return Object.values(openApiResponse.content).some((mediaType) => {
+      const openApiMediaType = asOpenApiMediaType(mediaType)
+      return !!openApiMediaType && !('schema' in openApiMediaType)
+    })
+  })
+}
+
+// protoc-gen-openapi emits google.api.HttpBody responses as `*/*: {}`. Skip these
+// raw download operations until the source OpenAPI exposes an explicit schema.
+const stripSchemaLessResponseOperations = (pathItem: OpenApiPathItem) => {
+  return Object.fromEntries(
+    Object.entries(pathItem).filter(([method, operation]) => {
+      if (!operationMethods.has(method.toLowerCase()))
+        return true
+
+      const openApiOperation = asOpenApiOperation(operation)
+      return !openApiOperation || !hasSchemaLessResponseContent(openApiOperation)
+    }),
+  )
+}
+
+const toWords = (value: string) => {
+  return value
+    .replace(/[{}]/g, '')
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .split(/[^a-z0-9]+/i)
+    .filter(Boolean)
+}
+
+const toPascalCase = (words: string[]) => {
+  return words.map(word => `${word.charAt(0).toUpperCase()}${word.slice(1)}`).join('')
+}
+
+const commonWordPrefix = (values: string[]) => {
+  const wordLists = values.map(value => value.split('_'))
+  const firstWords = wordLists[0] ?? []
+  const prefix: string[] = []
+
+  for (const [index, word] of firstWords.entries()) {
+    if (!wordLists.every(words => words[index] === word))
+      break
+
+    prefix.push(word)
+  }
+
+  return prefix
+}
+
+const enumSchemaNameFromValues = (values: unknown[]) => {
+  if (values.length === 0 || !values.every(value => typeof value === 'string'))
+    return undefined
+
+  const prefix = commonWordPrefix(values)
+  if (prefix.length < 2)
+    return undefined
+
+  return toPascalCase(prefix.map(word => word.toLowerCase()))
+}
+
+const findSchemaEntry = (
+  schemas: Record<string, OpenApiSchema>,
+  schemaName: string,
+): [string, OpenApiSchema] | undefined => {
+  return Object.entries(schemas)
+    .find(([name]) => stripSchemaNamePrefix(name) === schemaName)
+}
+
+const enumValuesKey = (values: unknown[]) => JSON.stringify(values)
+
+const reusableEnumSchema = (propertySchema: OpenApiSchema): OpenApiSchema => ({
+  ...(propertySchema.format ? { format: propertySchema.format } : {}),
+  enum: propertySchema.enum,
+  type: propertySchema.type ?? 'string',
+})
+
+const enumSchemaKey = (
+  schemas: Record<string, OpenApiSchema>,
+  preferredName: string,
+  valuesKey: string,
+  valuesToSchemaKey: Map<string, string>,
+  schemaName: string,
+  propertyName: string,
+) => {
+  const existingKey = valuesToSchemaKey.get(valuesKey)
+  if (existingKey)
+    return existingKey
+
+  const existingEnumEntry = findSchemaEntry(schemas, preferredName)
+  if (!existingEnumEntry)
+    return preferredName
+
+  const existingEnumValues = existingEnumEntry[1].enum
+  if (Array.isArray(existingEnumValues) && enumValuesKey(existingEnumValues) === valuesKey)
+    return existingEnumEntry[0]
+
+  return `${stripSchemaNamePrefix(schemaName)}${toPascalCase(toWords(propertyName))}`
+}
+
+const promoteInlineEnumSchema = (
+  schemas: Record<string, OpenApiSchema>,
+  schemaName: string,
+  properties: Record<string, OpenApiSchema>,
+  propertyName: string,
+  propertySchema: OpenApiSchema,
+  valuesToSchemaKey: Map<string, string>,
+) => {
+  if (!Array.isArray(propertySchema.enum))
+    return
+
+  const preferredName = enumSchemaNameFromValues(propertySchema.enum)
+  if (!preferredName)
+    return
+
+  const valuesKey = enumValuesKey(propertySchema.enum)
+  const key = enumSchemaKey(schemas, preferredName, valuesKey, valuesToSchemaKey, schemaName, propertyName)
+
+  if (!schemas[key])
+    schemas[key] = reusableEnumSchema(propertySchema)
+
+  valuesToSchemaKey.set(valuesKey, key)
+  properties[propertyName] = {
+    $ref: `#/components/schemas/${key}`,
+  }
+}
+
+// gnostic's protoc-gen-openapi inlines proto enum schemas into every field.
+// Promote prefixable inline enums to reusable schemas so Hey API can emit
+// runtime enum objects from the generated contract.
+const promoteReusableEnumSchemasForHeyApi = (document: OpenApiDocument) => {
+  const schemas = document.components?.schemas
+  if (!schemas)
+    return
+
+  const valuesToSchemaKey = new Map<string, string>()
+
+  Object.entries(schemas).forEach(([schemaName, schema]) => {
+    const properties = schema.properties
+    if (!properties)
+      return
+
+    Object.entries(properties).forEach(([propertyName, propertySchema]) => {
+      if (!isOpenApiSchema(propertySchema))
+        return
+
+      promoteInlineEnumSchema(schemas, schemaName, properties, propertyName, propertySchema, valuesToSchemaKey)
+    })
+  })
 }
 
 const normalizeEnterpriseOpenApi = () => {
@@ -63,9 +278,17 @@ const normalizeEnterpriseOpenApi = () => {
   document.paths = Object.fromEntries(
     Object.entries(paths)
       .filter(([routePath]) => isConsoleApiPath(routePath))
-      .map(([routePath, pathItem]) => [stripConsoleApiPrefix(routePath), pathItem]),
+      .map(([routePath, pathItem]) => {
+        if (!isObject(pathItem))
+          return [stripConsoleApiPrefix(routePath), pathItem]
+
+        return [stripConsoleApiPrefix(routePath), stripSchemaLessResponseOperations(pathItem)]
+      })
+      .filter(([, pathItem]) => !isObject(pathItem) || Object.keys(pathItem).length > 0),
   )
 
+  promoteReusableEnumSchemasForHeyApi(document)
+
   return document
 }
 
@@ -97,6 +320,9 @@ export default defineConfig({
     {
       name: '@hey-api/typescript',
       comments: false,
+      enums: {
+        mode: 'javascript',
+      },
     },
     'zod',
     {
diff --git a/packages/dify-ui/src/autocomplete/index.tsx b/packages/dify-ui/src/autocomplete/index.tsx
index b362a9450fd..4d115024ab1 100644
--- a/packages/dify-ui/src/autocomplete/index.tsx
+++ b/packages/dify-ui/src/autocomplete/index.tsx
@@ -145,9 +145,9 @@ const autocompleteControlVariants = cva(
   {
     variants: {
       size: {
-        small: 'mr-1 size-4',
-        medium: 'mr-1.5 size-5',
-        large: 'mr-2 size-5',
+        small: 'me-1 size-4',
+        medium: 'me-1.5 size-5',
+        large: 'me-2 size-5',
       },
     },
     defaultVariants: {
diff --git a/packages/dify-ui/src/button/index.tsx b/packages/dify-ui/src/button/index.tsx
index 2181b880a55..0d36d7d1510 100644
--- a/packages/dify-ui/src/button/index.tsx
+++ b/packages/dify-ui/src/button/index.tsx
@@ -131,7 +131,7 @@ export function Button({
       {children}
       {loading && (
         <i
-          className="ml-1 i-ri-loader-2-line size-3 animate-spin motion-reduce:animate-none"
+          className="ms-1 i-ri-loader-2-line size-3 animate-spin motion-reduce:animate-none"
           aria-hidden="true"
         />
       )}
diff --git a/packages/dify-ui/src/collapsible/index.tsx b/packages/dify-ui/src/collapsible/index.tsx
index 550584d5da1..73f54c4d2cc 100644
--- a/packages/dify-ui/src/collapsible/index.tsx
+++ b/packages/dify-ui/src/collapsible/index.tsx
@@ -35,7 +35,7 @@ export function CollapsibleTrigger({
   return (
     <BaseCollapsible.Trigger
       className={cn(
-        'group flex min-h-8 w-full touch-manipulation items-center justify-between gap-2 rounded-lg px-2.5 text-left system-sm-medium text-text-secondary outline-hidden select-none',
+        'group flex min-h-8 w-full touch-manipulation items-center justify-between gap-2 rounded-lg px-2.5 text-start system-sm-medium text-text-secondary outline-hidden select-none',
         'hover:not-data-disabled:bg-components-panel-on-panel-item-bg-hover hover:not-data-disabled:text-text-primary',
         'focus-visible:ring-2 focus-visible:ring-state-accent-solid',
         'data-panel-open:text-text-primary',
diff --git a/packages/dify-ui/src/combobox/index.tsx b/packages/dify-ui/src/combobox/index.tsx
index 6931a2df7a8..c97abc7db32 100644
--- a/packages/dify-ui/src/combobox/index.tsx
+++ b/packages/dify-ui/src/combobox/index.tsx
@@ -50,7 +50,7 @@ const comboboxItemClassName = [
 
 const comboboxTriggerVariants = cva(
   [
-    'group/combobox-trigger flex w-full min-w-0 items-center border-0 bg-components-input-bg-normal text-left text-components-input-text-filled outline-hidden transition-colors',
+    'group/combobox-trigger flex w-full min-w-0 items-center border-0 bg-components-input-bg-normal text-start text-components-input-text-filled outline-hidden transition-colors',
     'hover:bg-state-base-hover-alt focus-visible:bg-state-base-hover-alt data-popup-open:bg-state-base-hover-alt',
     'focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:ring-inset',
     'data-placeholder:text-components-input-text-placeholder',
@@ -207,9 +207,9 @@ const comboboxControlVariants = cva(
   {
     variants: {
       size: {
-        small: 'mr-1 size-4',
-        medium: 'mr-1.5 size-5',
-        large: 'mr-2 size-5',
+        small: 'me-1 size-4',
+        medium: 'me-1.5 size-5',
+        large: 'me-2 size-5',
       },
     },
     defaultVariants: {
diff --git a/packages/dify-ui/src/context-menu/index.tsx b/packages/dify-ui/src/context-menu/index.tsx
index f10eea25a94..9c43402961a 100644
--- a/packages/dify-ui/src/context-menu/index.tsx
+++ b/packages/dify-ui/src/context-menu/index.tsx
@@ -219,7 +219,7 @@ export function ContextMenuSubTrigger({
       {...props}
     >
       {children}
-      <span aria-hidden className="ml-auto i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />
+      <span aria-hidden className="ms-auto i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />
     </BaseContextMenu.SubmenuTrigger>
   )
 }
diff --git a/packages/dify-ui/src/dialog/index.tsx b/packages/dify-ui/src/dialog/index.tsx
index 5162a1a35af..9e08da21e58 100644
--- a/packages/dify-ui/src/dialog/index.tsx
+++ b/packages/dify-ui/src/dialog/index.tsx
@@ -8,7 +8,6 @@ export const Dialog = BaseDialog.Root
 export const DialogTrigger = BaseDialog.Trigger
 export const DialogTitle = BaseDialog.Title
 export const DialogDescription = BaseDialog.Description
-export const DialogPortal = BaseDialog.Portal
 
 type DialogCloseButtonProps = Omit<BaseDialog.Close.Props, 'children'>
 
@@ -22,7 +21,7 @@ export function DialogCloseButton({
       aria-label={ariaLabel}
       {...props}
       className={cn(
-        'absolute top-6 right-6 z-10 flex h-5 w-5 cursor-pointer items-center justify-center rounded-2xl hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden disabled:cursor-not-allowed disabled:opacity-50',
+        'absolute top-6 end-6 z-10 flex h-5 w-5 cursor-pointer items-center justify-center rounded-2xl hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden disabled:cursor-not-allowed disabled:opacity-50',
         className,
       )}
     >
@@ -45,7 +44,7 @@ export function DialogContent({
   backdropProps,
 }: DialogContentProps) {
   return (
-    <DialogPortal>
+    <BaseDialog.Portal>
       <BaseDialog.Backdrop
         {...backdropProps}
         className={cn(
@@ -63,6 +62,6 @@ export function DialogContent({
       >
         {children}
       </BaseDialog.Popup>
-    </DialogPortal>
+    </BaseDialog.Portal>
   )
 }
diff --git a/packages/dify-ui/src/dropdown-menu/index.tsx b/packages/dify-ui/src/dropdown-menu/index.tsx
index 9f873a88ae1..7cb585dab3d 100644
--- a/packages/dify-ui/src/dropdown-menu/index.tsx
+++ b/packages/dify-ui/src/dropdown-menu/index.tsx
@@ -191,7 +191,7 @@ export function DropdownMenuSubTrigger({
       {...props}
     >
       {children}
-      <span aria-hidden className="ml-auto i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />
+      <span aria-hidden className="ms-auto i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />
     </Menu.SubmenuTrigger>
   )
 }
diff --git a/packages/dify-ui/src/file-tree/__tests__/index.spec.tsx b/packages/dify-ui/src/file-tree/__tests__/index.spec.tsx
index 1734189df1f..3475b2f5b1e 100644
--- a/packages/dify-ui/src/file-tree/__tests__/index.spec.tsx
+++ b/packages/dify-ui/src/file-tree/__tests__/index.spec.tsx
@@ -77,7 +77,7 @@ describe('FileTree', () => {
     const screen = await render(<TestFileTree />)
 
     await expect.element(screen.getByLabelText('Project files')).toHaveClass('gap-px', 'p-1')
-    await expect.element(screen.getByRole('button', { name: 'button.tsx' })).toHaveClass('h-6', 'rounded-md', 'pl-2', 'pr-1.5', 'data-[selected]:bg-state-base-active')
+    await expect.element(screen.getByRole('button', { name: 'button.tsx' })).toHaveClass('h-6', 'rounded-md', 'ps-2', 'pe-1.5', 'data-[selected]:bg-state-base-active')
     await expect.element(screen.getByText('button.tsx')).toHaveClass('group-data-[selected]/file-tree-row:system-sm-medium', 'group-data-[selected]/file-tree-row:text-text-primary')
     await expect.element(screen.getByText('README.md')).toHaveAttribute('data-label', 'README.md')
     await expect.element(screen.getByText('README.md')).toHaveClass('after:content-[attr(data-label)]')
diff --git a/packages/dify-ui/src/file-tree/index.tsx b/packages/dify-ui/src/file-tree/index.tsx
index f3e42e7a41f..b085fc5c79b 100644
--- a/packages/dify-ui/src/file-tree/index.tsx
+++ b/packages/dify-ui/src/file-tree/index.tsx
@@ -36,7 +36,7 @@ function fileTreeRowClassName({
   className?: string
 }) {
   return cn(
-    'group/file-tree-row relative flex h-6 w-full min-w-0 cursor-pointer items-center rounded-md pl-2 pr-1.5 text-left outline-hidden select-none',
+    'group/file-tree-row relative flex h-6 w-full min-w-0 cursor-pointer items-center rounded-md ps-2 pe-1.5 text-start outline-hidden select-none',
     'hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-state-accent-solid',
     'data-[selected]:bg-state-base-active',
     'data-disabled:cursor-not-allowed data-disabled:opacity-50 data-disabled:hover:bg-transparent',
@@ -361,7 +361,7 @@ export function FileTreeBadge({
 }: FileTreeBadgeProps) {
   const defaultProps: useRender.ElementProps<'span'> = {
     className: cn(
-      'ml-1 inline-flex min-w-4 shrink-0 items-center justify-center rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary',
+      'ms-1 inline-flex min-w-4 shrink-0 items-center justify-center rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary',
       className,
     ),
   }
diff --git a/packages/dify-ui/src/number-field/__tests__/index.spec.tsx b/packages/dify-ui/src/number-field/__tests__/index.spec.tsx
index c05b46eb900..d130be6413a 100644
--- a/packages/dify-ui/src/number-field/__tests__/index.spec.tsx
+++ b/packages/dify-ui/src/number-field/__tests__/index.spec.tsx
@@ -133,8 +133,8 @@ describe('NumberField wrapper', () => {
 
   describe('Unit and controls', () => {
     it.each([
-      ['medium', 'pr-2'],
-      ['large', 'pr-2.5'],
+      ['medium', 'pe-2'],
+      ['large', 'pe-2.5'],
     ] as const)('should apply the %s unit spacing variant', async (size, spacingClass) => {
       const screen = await renderNumberField({
         unitProps: {
diff --git a/packages/dify-ui/src/number-field/index.stories.tsx b/packages/dify-ui/src/number-field/index.stories.tsx
index 3d85b42c096..284148c56ff 100644
--- a/packages/dify-ui/src/number-field/index.stories.tsx
+++ b/packages/dify-ui/src/number-field/index.stories.tsx
@@ -207,11 +207,6 @@ export const States: Story = {
       </FieldRoot>
     </div>
   ),
-  parameters: {
-    a11y: {
-      test: 'todo',
-    },
-  },
 }
 
 function ControlledDemo() {
diff --git a/packages/dify-ui/src/number-field/index.tsx b/packages/dify-ui/src/number-field/index.tsx
index 2ff6fb53c08..f5babeea95e 100644
--- a/packages/dify-ui/src/number-field/index.tsx
+++ b/packages/dify-ui/src/number-field/index.tsx
@@ -100,8 +100,8 @@ export const numberFieldUnitVariants = cva(
   {
     variants: {
       size: {
-        medium: 'pr-2',
-        large: 'pr-2.5',
+        medium: 'pe-2',
+        large: 'pe-2.5',
       },
     },
     defaultVariants: {
diff --git a/packages/dify-ui/src/overlay-shared.ts b/packages/dify-ui/src/overlay-shared.ts
index d6d3a05b9d0..2d90dd372af 100644
--- a/packages/dify-ui/src/overlay-shared.ts
+++ b/packages/dify-ui/src/overlay-shared.ts
@@ -2,7 +2,7 @@ export type OverlayItemVariant = 'default' | 'destructive'
 
 export const overlayRowClassName = 'mx-1 flex h-8 cursor-pointer select-none items-center gap-1 rounded-lg px-2 outline-hidden data-highlighted:bg-state-base-hover data-disabled:cursor-not-allowed data-disabled:opacity-30'
 export const overlayDestructiveClassName = 'data-[variant=destructive]:text-text-destructive data-[variant=destructive]:data-highlighted:bg-state-destructive-hover'
-export const overlayIndicatorClassName = 'ml-auto flex shrink-0 items-center text-text-accent'
+export const overlayIndicatorClassName = 'ms-auto flex shrink-0 items-center text-text-accent'
 export const overlayLabelClassName = 'px-3 pb-0.5 pt-1 text-text-tertiary system-xs-medium-uppercase'
 export const overlaySeparatorClassName = 'my-1 h-px bg-divider-subtle'
 export const overlayPopupBaseClassName = 'max-h-(--available-height) overflow-y-auto overflow-x-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur py-1 text-sm text-text-secondary shadow-lg outline-hidden focus:outline-hidden focus-visible:outline-hidden backdrop-blur-[5px]'
diff --git a/packages/dify-ui/src/pagination/index.stories.tsx b/packages/dify-ui/src/pagination/index.stories.tsx
index 6ffab6bfee9..47beccaf95f 100644
--- a/packages/dify-ui/src/pagination/index.stories.tsx
+++ b/packages/dify-ui/src/pagination/index.stories.tsx
@@ -87,19 +87,11 @@ export const Playground: Story = {
     await userEvent.click(canvas.getByRole('button', { name: '50' }))
     await expect(canvas.getByRole('button', { name: '50' })).toHaveAttribute('aria-pressed', 'true')
   },
-  parameters: {
-    a11y: {
-      test: 'todo',
-    },
-  },
 }
 
 export const DesignSpec: Story = {
   render: () => <DesignSpecDemo />,
   parameters: {
-    a11y: {
-      test: 'todo',
-    },
     docs: {
       description: {
         story: 'Pagination rows with default, hover-like, focused, page-size, and skeleton examples.',
diff --git a/packages/dify-ui/src/pagination/index.tsx b/packages/dify-ui/src/pagination/index.tsx
index 386017828cc..4e5ebf2877c 100644
--- a/packages/dify-ui/src/pagination/index.tsx
+++ b/packages/dify-ui/src/pagination/index.tsx
@@ -355,7 +355,7 @@ export function PaginationPageJump({
     return (
       <span
         data-page-summary={`${pagination.page}/${pagination.totalPages}`}
-        className="inline-grid h-7 system-xs-medium tabular-nums after:invisible after:col-start-1 after:row-start-1 after:py-1.5 after:pr-3 after:pl-2 after:content-[attr(data-page-summary)]"
+        className="inline-grid h-7 system-xs-medium tabular-nums after:invisible after:col-start-1 after:row-start-1 after:py-1.5 after:pe-3 after:ps-2 after:content-[attr(data-page-summary)]"
       >
         <NumberField
           key={pagination.page}
diff --git a/packages/dify-ui/src/scroll-area/__tests__/index.spec.tsx b/packages/dify-ui/src/scroll-area/__tests__/index.spec.tsx
index 73f2f90719f..bed831ba385 100644
--- a/packages/dify-ui/src/scroll-area/__tests__/index.spec.tsx
+++ b/packages/dify-ui/src/scroll-area/__tests__/index.spec.tsx
@@ -120,6 +120,7 @@ describe('scroll-area wrapper', () => {
       await expect.element(screen.getByTestId('scroll-area-vertical-scrollbar')).toHaveAttribute('data-orientation', 'vertical')
       await expect.element(screen.getByTestId('scroll-area-vertical-scrollbar')).toHaveAttribute('data-dify-scrollbar')
       await expect.element(screen.getByTestId('scroll-area-vertical-scrollbar')).toHaveClass(
+        'group/scrollbar',
         'flex',
         'overflow-clip',
         'p-1',
@@ -144,6 +145,9 @@ describe('scroll-area wrapper', () => {
         'transition-[background-color]',
         'motion-reduce:transition-none',
         'data-[orientation=vertical]:w-1',
+        'group-data-hovering/scrollbar:bg-state-base-handle-hover',
+        'data-scrolling:bg-state-base-handle-hover',
+        'active:bg-state-base-handle-hover',
       )
     })
 
@@ -153,6 +157,7 @@ describe('scroll-area wrapper', () => {
       await expect.element(screen.getByTestId('scroll-area-horizontal-scrollbar')).toHaveAttribute('data-orientation', 'horizontal')
       await expect.element(screen.getByTestId('scroll-area-horizontal-scrollbar')).toHaveAttribute('data-dify-scrollbar')
       await expect.element(screen.getByTestId('scroll-area-horizontal-scrollbar')).toHaveClass(
+        'group/scrollbar',
         'flex',
         'overflow-clip',
         'p-1',
@@ -177,6 +182,9 @@ describe('scroll-area wrapper', () => {
         'transition-[background-color]',
         'motion-reduce:transition-none',
         'data-[orientation=horizontal]:h-1',
+        'group-data-hovering/scrollbar:bg-state-base-handle-hover',
+        'data-scrolling:bg-state-base-handle-hover',
+        'active:bg-state-base-handle-hover',
       )
     })
   })
diff --git a/packages/dify-ui/src/scroll-area/index.stories.tsx b/packages/dify-ui/src/scroll-area/index.stories.tsx
index 27f427eb69f..fa32ae048ca 100644
--- a/packages/dify-ui/src/scroll-area/index.stories.tsx
+++ b/packages/dify-ui/src/scroll-area/index.stories.tsx
@@ -366,7 +366,7 @@ export const AppSidebar: Story = {
                     ))}
                   </VerticalContent>
                 </ScrollAreaViewport>
-                <ScrollAreaScrollbar className="data-[orientation=vertical]:my-2 data-[orientation=vertical]:me-1">
+                <ScrollAreaScrollbar>
                   <ScrollAreaThumb />
                 </ScrollAreaScrollbar>
               </ScrollAreaRoot>
diff --git a/packages/dify-ui/src/scroll-area/index.tsx b/packages/dify-ui/src/scroll-area/index.tsx
index 1adea78ee35..fec7daa574d 100644
--- a/packages/dify-ui/src/scroll-area/index.tsx
+++ b/packages/dify-ui/src/scroll-area/index.tsx
@@ -36,7 +36,7 @@ const scrollAreaThumbClassName = cn(
   'data-[orientation=vertical]:w-1',
   'data-[orientation=horizontal]:h-1',
   'group-data-hovering/scrollbar:bg-state-base-handle-hover',
-  'group-data-scrolling/scrollbar:bg-state-base-handle-hover',
+  'data-scrolling:bg-state-base-handle-hover',
   'active:bg-state-base-handle-hover',
 )
 
diff --git a/packages/dify-ui/src/segmented-control/index.stories.tsx b/packages/dify-ui/src/segmented-control/index.stories.tsx
index ead9931898b..f2b6f9cc1f5 100644
--- a/packages/dify-ui/src/segmented-control/index.stories.tsx
+++ b/packages/dify-ui/src/segmented-control/index.stories.tsx
@@ -113,9 +113,6 @@ export const DesignSpec: Story = {
     </div>
   ),
   parameters: {
-    a11y: {
-      test: 'todo',
-    },
     docs: {
       description: {
         story: 'Figma node 2473:9851: segmented control examples with text+icon and icon-only rows, with and without outer padding.',
@@ -171,9 +168,6 @@ export const DataAttributeStates: Story = {
     </div>
   ),
   parameters: {
-    a11y: {
-      test: 'todo',
-    },
     docs: {
       description: {
         story: '`SegmentedControlItem` gets `data-pressed` and `data-disabled` from Base UI Toggle. Accent, neutral, and multiple-selection examples are composed through props and className.',
diff --git a/packages/dify-ui/src/select/index.stories.tsx b/packages/dify-ui/src/select/index.stories.tsx
index 75602572019..f27180bbe08 100644
--- a/packages/dify-ui/src/select/index.stories.tsx
+++ b/packages/dify-ui/src/select/index.stories.tsx
@@ -14,6 +14,9 @@ import {
   SelectTrigger,
   SelectValue,
 } from '.'
+import { Button } from '../button'
+import { FieldDescription, FieldRoot } from '../field'
+import { Form } from '../form'
 
 const triggerWidth = 'w-64'
 
@@ -326,40 +329,33 @@ export const Controlled: Story = {
 
 export const InForm: Story = {
   render: () => (
-    <form
-      onSubmit={(event) => {
-        event.preventDefault()
-      }}
-      className="flex w-72 flex-col gap-3"
-    >
-      <label className="text-xs font-medium text-text-tertiary" htmlFor="timezone">
-        Timezone
-      </label>
-      <Select name="timezone" defaultValue="utc">
-        <SelectTrigger id="timezone" aria-label="Timezone">
-          <SelectValue />
-        </SelectTrigger>
-        <SelectContent>
-          <SelectItem value="utc">
-            <SelectItemText>UTC</SelectItemText>
-            <SelectItemIndicator />
-          </SelectItem>
-          <SelectItem value="pst">
-            <SelectItemText>Pacific (PST)</SelectItemText>
-            <SelectItemIndicator />
-          </SelectItem>
-          <SelectItem value="jst">
-            <SelectItemText>Japan (JST)</SelectItemText>
-            <SelectItemIndicator />
-          </SelectItem>
-        </SelectContent>
-      </Select>
-      <button
-        type="submit"
-        className="h-8 rounded-lg bg-components-button-primary-bg px-3 text-sm text-components-button-primary-text"
-      >
-        Submit
-      </button>
-    </form>
+    <Form aria-label="Timezone form" className="grid w-72 gap-3" onFormSubmit={() => undefined}>
+      <FieldRoot name="timezone">
+        <Select name="timezone" defaultValue="utc">
+          <SelectLabel>Timezone</SelectLabel>
+          <SelectTrigger>
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="utc">
+              <SelectItemText>UTC</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+            <SelectItem value="pst">
+              <SelectItemText>Pacific (PST)</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+            <SelectItem value="jst">
+              <SelectItemText>Japan (JST)</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+          </SelectContent>
+        </Select>
+        <FieldDescription>Used to schedule workflow runs.</FieldDescription>
+      </FieldRoot>
+      <div className="flex justify-end">
+        <Button type="submit" variant="primary">Save</Button>
+      </div>
+    </Form>
   ),
 }
diff --git a/packages/dify-ui/src/select/index.tsx b/packages/dify-ui/src/select/index.tsx
index 046afccf3b3..6667f06770f 100644
--- a/packages/dify-ui/src/select/index.tsx
+++ b/packages/dify-ui/src/select/index.tsx
@@ -22,7 +22,7 @@ export const SelectGroup = BaseSelect.Group
 
 const selectTriggerVariants = cva(
   [
-    'group flex w-full items-center border-0 bg-components-input-bg-normal text-left text-components-input-text-filled outline-hidden',
+    'group flex w-full items-center border-0 bg-components-input-bg-normal text-start text-components-input-text-filled outline-hidden',
     'hover:bg-state-base-hover-alt focus-visible:bg-state-base-hover-alt data-popup-open:bg-state-base-hover-alt',
     'focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:ring-inset',
     'data-placeholder:text-components-input-text-placeholder',
@@ -195,7 +195,7 @@ export function SelectItemText({
 }: BaseSelect.ItemText.Props) {
   return (
     <BaseSelect.ItemText
-      className={cn('mr-1 min-w-0 grow truncate px-1', className)}
+      className={cn('me-1 min-w-0 grow truncate px-1', className)}
       {...props}
     />
   )
@@ -207,7 +207,7 @@ export function SelectItemIndicator({
 }: Omit<BaseSelect.ItemIndicator.Props, 'children'>) {
   return (
     <BaseSelect.ItemIndicator
-      className={cn('ml-auto flex shrink-0 items-center text-text-accent', className)}
+      className={cn('ms-auto flex shrink-0 items-center text-text-accent', className)}
       {...props}
     >
       <span className="i-ri-check-line h-4 w-4" aria-hidden />
diff --git a/packages/dify-ui/src/toast/__tests__/index.spec.tsx b/packages/dify-ui/src/toast/__tests__/index.spec.tsx
index 7e9227e362e..9560d6fbf2e 100644
--- a/packages/dify-ui/src/toast/__tests__/index.spec.tsx
+++ b/packages/dify-ui/src/toast/__tests__/index.spec.tsx
@@ -100,6 +100,24 @@ describe('@langgenius/dify-ui/toast', () => {
     expect(document.body.querySelector('[aria-hidden="true"].i-ri-information-2-fill')).not.toBeInTheDocument()
   })
 
+  it('should wrap long unbroken toast content within the card width', async () => {
+    const screen = await render(<ToastHost />)
+    const longTitle = 'operation error S3: PutObject, exceeded maximum number of attempts, 3, StatusCode: 0, RequestID: , HostID: , request send failed'
+    const longDescription = 'Put "https://plugin/assets/1bd032bb73218a5d141b80cab7111?x-id=PutObject": dial tcp 192.168.0.200:19000: connect: connection refused, icon small en_US failed to remap assets failed to store plugin asset'
+
+    toast.error(longTitle, {
+      description: longDescription,
+    })
+
+    await expect.element(screen.getByText(longTitle)).toBeInTheDocument()
+    await expect.element(screen.getByText(longDescription)).toBeInTheDocument()
+
+    const title = asHTMLElement(screen.getByText(longTitle).element())
+    const description = asHTMLElement(screen.getByText(longDescription).element())
+    expect(title.scrollWidth).toBeLessThanOrEqual(title.clientWidth)
+    expect(description.scrollWidth).toBeLessThanOrEqual(description.clientWidth)
+  })
+
   it('should mark overflow toasts as limited when the stack exceeds the configured limit', async () => {
     const screen = await render(<ToastHost limit={1} />)
 
diff --git a/packages/dify-ui/src/toast/index.tsx b/packages/dify-ui/src/toast/index.tsx
index c97ac3a0550..9dd18518184 100644
--- a/packages/dify-ui/src/toast/index.tsx
+++ b/packages/dify-ui/src/toast/index.tsx
@@ -176,15 +176,15 @@ function ToastCard({
             <ToastIcon type={toastType} />
           </div>
           <div className="min-w-0 flex-1 p-1">
-            <div className="flex w-full items-center gap-1">
+            <div className="flex w-full min-w-0 items-center gap-1">
               {toastItem.title != null && (
-                <BaseToast.Title className="system-sm-semibold wrap-break-word text-text-primary">
+                <BaseToast.Title className="min-w-0 flex-1 system-sm-semibold wrap-break-word [overflow-wrap:anywhere] text-text-primary">
                   {toastItem.title}
                 </BaseToast.Title>
               )}
             </div>
             {toastItem.description != null && (
-              <BaseToast.Description className="mt-1 system-xs-regular wrap-break-word text-text-secondary">
+              <BaseToast.Description className="mt-1 min-w-0 system-xs-regular wrap-break-word [overflow-wrap:anywhere] text-text-secondary">
                 {toastItem.description}
               </BaseToast.Description>
             )}
diff --git a/packages/dify-ui/src/tooltip/index.tsx b/packages/dify-ui/src/tooltip/index.tsx
index 36f9fd0f51d..359fb532e83 100644
--- a/packages/dify-ui/src/tooltip/index.tsx
+++ b/packages/dify-ui/src/tooltip/index.tsx
@@ -62,7 +62,7 @@ export function TooltipContent({
       >
         <BaseTooltip.Popup
           className={cn(
-            'max-w-[300px] rounded-md bg-components-panel-bg px-3 py-2 text-left system-xs-regular wrap-break-word text-text-tertiary shadow-lg',
+            'max-w-[300px] rounded-md bg-components-panel-bg px-3 py-2 text-start system-xs-regular wrap-break-word text-text-tertiary shadow-lg',
             'origin-(--transform-origin) transition-opacity data-ending-style:opacity-0 data-instant:transition-none data-starting-style:opacity-0 motion-reduce:transition-none',
             className,
           )}
diff --git a/packages/iconify-collections/assets/public/agent/building-blocks.svg b/packages/iconify-collections/assets/public/agent/building-blocks.svg
new file mode 100644
index 00000000000..8037f6f0865
--- /dev/null
+++ b/packages/iconify-collections/assets/public/agent/building-blocks.svg
@@ -0,0 +1,3 @@
+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M8.30314 1.54615C8.48087 1.50085 8.66708 1.49473 8.84742 1.52858C9.07685 1.57176 9.27914 1.6956 9.41968 1.77467L13.1768 3.88795C13.2961 3.955 13.4666 4.04398 13.6098 4.17701L13.6697 4.23691C13.7899 4.36839 13.8809 4.52463 13.9366 4.69394C14.0074 4.90941 13.9998 5.13856 13.9998 5.29485V9.55917C13.9998 9.70492 14.0069 9.91888 13.9444 10.1223C13.9076 10.2422 13.8527 10.3559 13.7823 10.4596L13.7068 10.5598C13.5702 10.7233 13.3869 10.8339 13.2647 10.9133L8.25171 14.1718C8.11671 14.2596 7.92272 14.396 7.69637 14.4537C7.51868 14.499 7.33292 14.5051 7.15275 14.4713C6.92315 14.4281 6.72034 14.3049 6.57984 14.2258L2.82268 12.1119C2.68658 12.0353 2.48283 11.9301 2.32984 11.7629C2.20953 11.6314 2.11852 11.475 2.06291 11.3059C1.99209 11.0903 1.99976 10.8606 1.99976 10.7044V6.44069C1.99976 6.29486 1.99262 6.08092 2.0551 5.87753L2.09807 5.7597C2.14656 5.64426 2.21216 5.53647 2.29273 5.44003L2.34611 5.38144C2.47424 5.24974 2.62775 5.15609 2.73479 5.08652L7.85979 1.75514C7.98194 1.67712 8.13342 1.58951 8.30314 1.54615ZM3.33309 10.7044C3.33309 10.7559 3.33334 10.7962 3.33374 10.8307C3.33392 10.8452 3.33411 10.8578 3.33439 10.8684C3.34356 10.8739 3.3543 10.8806 3.36695 10.8879C3.39682 10.9052 3.43208 10.9245 3.47697 10.9498L6.74064 12.7857V11.649L3.33309 9.73235V10.7044ZM8.07398 11.621V12.6972L12.5382 9.7955C12.5784 9.76933 12.6098 9.74883 12.6365 9.73105C12.6475 9.72368 12.6564 9.71639 12.6645 9.71087C12.6647 9.70125 12.6656 9.69004 12.6658 9.67701C12.6661 9.64494 12.6664 9.60721 12.6664 9.55917V8.636L8.07398 11.621ZM3.33309 8.2024L6.74064 10.1191V8.98235L3.33309 7.06568V8.2024ZM8.07398 8.95436V10.0299L12.6664 7.04485V5.96933L8.07398 8.95436ZM8.58374 2.87493L3.95288 5.8847L7.38192 7.81373L12.046 4.78183L8.76604 2.93613C8.71971 2.91007 8.68338 2.89008 8.6521 2.87298C8.63863 2.86561 8.62684 2.85931 8.61695 2.8541C8.60751 2.85987 8.59651 2.86685 8.58374 2.87493Z" fill="#155AEF"/>
+</svg>
diff --git a/packages/iconify-collections/assets/vender/agent-v2/access-point.svg b/packages/iconify-collections/assets/vender/agent-v2/access-point.svg
new file mode 100644
index 00000000000..6f2c2f1926f
--- /dev/null
+++ b/packages/iconify-collections/assets/vender/agent-v2/access-point.svg
@@ -0,0 +1,8 @@
+<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M7.5 11.25C7.91421 11.25 8.25 11.5858 8.25 12V14.25C8.25 14.6642 7.91421 15 7.5 15C7.08579 15 6.75 14.6642 6.75 14.25V12C6.75 11.5858 7.08579 11.25 7.5 11.25Z" fill="currentColor" />
+  <path d="M2.19653 2.19653C2.48937 1.90372 2.96418 1.90382 3.25708 2.19653L8.03027 6.96973C8.09162 7.03108 8.13966 7.10082 8.17529 7.1748C8.19164 7.20869 8.20587 7.24378 8.21704 7.28027C8.24638 7.37633 8.25641 7.477 8.24634 7.57617C8.23743 7.66451 8.21216 7.74788 8.17529 7.82446C8.13963 7.89868 8.09176 7.96874 8.03027 8.03027L3.25708 12.8035C2.96419 13.096 2.48932 13.0962 2.19653 12.8035C1.90394 12.5107 1.90405 12.0358 2.19653 11.7429L5.68945 8.25H0.75C0.335786 8.25 0 7.91421 0 7.5C0 7.08579 0.335786 6.75 0.75 6.75H5.68945L2.19653 3.25708C1.90389 2.96423 1.90388 2.48937 2.19653 2.19653Z" fill="currentColor" />
+  <path d="M10.1521 10.1521C10.445 9.85921 10.9198 9.85921 11.2126 10.1521L12.8035 11.7429C13.096 12.0358 13.0962 12.5107 12.8035 12.8035C12.5107 13.0962 12.0358 13.096 11.7429 12.8035L10.1521 11.2126C9.85921 10.9198 9.85922 10.445 10.1521 10.1521Z" fill="currentColor" />
+  <path d="M14.25 6.75C14.6642 6.75 15 7.08579 15 7.5C15 7.91421 14.6642 8.25 14.25 8.25H12C11.5858 8.25 11.25 7.91421 11.25 7.5C11.25 7.08579 11.5858 6.75 12 6.75H14.25Z" fill="currentColor" />
+  <path d="M11.7422 2.19653C12.035 1.90387 12.5098 1.90406 12.8027 2.19653C13.0956 2.4894 13.0955 2.96419 12.8027 3.25708L11.2119 4.8479C10.919 5.14079 10.4443 5.1408 10.1514 4.8479C9.85883 4.55497 9.85858 4.08013 10.1514 3.78735L11.7422 2.19653Z" fill="currentColor" />
+  <path d="M7.5 0C7.91421 0 8.25 0.335786 8.25 0.75V3C8.25 3.41421 7.91421 3.75 7.5 3.75C7.08579 3.75 6.75 3.41421 6.75 3V0.75C6.75 0.335786 7.08579 0 7.5 0Z" fill="currentColor" />
+</svg>
diff --git a/packages/iconify-collections/assets/vender/agent-v2/end-user-auth.svg b/packages/iconify-collections/assets/vender/agent-v2/end-user-auth.svg
new file mode 100644
index 00000000000..1632376e944
--- /dev/null
+++ b/packages/iconify-collections/assets/vender/agent-v2/end-user-auth.svg
@@ -0,0 +1,5 @@
+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M12 7.33325C13.1046 7.33325 14 8.22865 14 9.33325C14 10.1403 13.5218 10.8356 12.8333 11.1516V11.9999L12.3333 12.4999L12.8333 12.9511V13.6666L12 14.3333L11.1667 13.6666V11.1516C10.4782 10.8356 10 10.1403 10 9.33325C10 8.22865 10.8954 7.33325 12 7.33325ZM12 8.66659C11.6318 8.66659 11.3333 8.96505 11.3333 9.33325C11.3333 9.70145 11.6318 9.99992 12 9.99992C12.3682 9.99992 12.6667 9.70145 12.6667 9.33325C12.6667 8.96505 12.3682 8.66659 12 8.66659Z" fill="currentColor"/>
+<path d="M8 7.99992C8.2545 7.99992 8.50382 8.01506 8.7474 8.04484L8.58594 9.36841C8.39687 9.34527 8.20127 9.33325 8 9.33325C5.8465 9.33325 4.25915 10.7274 3.78646 12.6666H10V13.9999H2.26758L2.33594 13.2708C2.61081 10.3473 4.82817 7.99992 8 7.99992Z" fill="currentColor"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M8 1.33325C9.65687 1.33325 11 2.6764 11 4.33325C11 5.99011 9.65687 7.33325 8 7.33325C6.34315 7.33325 5 5.99011 5 4.33325C5 2.6764 6.34315 1.33325 8 1.33325ZM8 2.66659C7.07953 2.66659 6.33333 3.41278 6.33333 4.33325C6.33333 5.25373 7.07953 5.99992 8 5.99992C8.92047 5.99992 9.66667 5.25373 9.66667 4.33325C9.66667 3.41278 8.92047 2.66659 8 2.66659Z" fill="currentColor"/>
+</svg>
diff --git a/packages/iconify-collections/assets/vender/agent-v2/plan.svg b/packages/iconify-collections/assets/vender/agent-v2/plan.svg
new file mode 100644
index 00000000000..a9456e4806b
--- /dev/null
+++ b/packages/iconify-collections/assets/vender/agent-v2/plan.svg
@@ -0,0 +1,3 @@
+<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M17 0C17.5523 0 18 0.447715 18 1V6C18 6.55228 17.5523 7 17 7H12C11.4477 7 11 6.55228 11 6V4.5H6.94629C5.92438 4.50039 5.56101 5.85276 6.44531 6.36523L12.5576 9.90332C15.2116 11.4402 14.1206 15.4996 11.0537 15.5H7V17C7 17.5523 6.55228 18 6 18H1C0.447715 18 0 17.5523 0 17V12C0 11.4477 0.447715 11 1 11H6C6.55228 11 7 11.4477 7 12V13.5H11.0537C12.0756 13.4996 12.4394 12.1472 11.5557 11.6348L5.44336 8.09668C2.789 6.55983 3.87917 2.50039 6.94629 2.5H11V1C11 0.447715 11.4477 0 12 0H17ZM2 16H5V13H2V16ZM13 5H16V2H13V5Z" fill="currentColor"/>
+</svg>
diff --git a/packages/iconify-collections/assets/vender/agent-v2/prompt-insert.svg b/packages/iconify-collections/assets/vender/agent-v2/prompt-insert.svg
new file mode 100644
index 00000000000..f0be50ee5fe
--- /dev/null
+++ b/packages/iconify-collections/assets/vender/agent-v2/prompt-insert.svg
@@ -0,0 +1,3 @@
+<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M2.91669 1.16669C1.95019 1.16669 1.16669 1.95019 1.16669 2.91669V11.0834C1.16669 12.0499 1.95019 12.8334 2.91669 12.8334H11.0834C12.0499 12.8334 12.8334 12.0499 12.8334 11.0834V2.91669C12.8334 1.95019 12.0499 1.16669 11.0834 1.16669H2.91669ZM2.33335 2.91669C2.33335 2.59452 2.59452 2.33335 2.91669 2.33335H11.0834C11.4055 2.33335 11.6667 2.59452 11.6667 2.91669V11.0834C11.6667 11.4055 11.4055 11.6667 11.0834 11.6667H2.91669C2.59452 11.6667 2.33335 11.4055 2.33335 11.0834V2.91669ZM5.67188 10.5L9.67186 3.50002H8.32815L4.32817 10.5H5.67188Z" fill="#676F83" />
+</svg>
diff --git a/packages/iconify-collections/assets/vender/agent-v2/robot-3.svg b/packages/iconify-collections/assets/vender/agent-v2/robot-3.svg
new file mode 100644
index 00000000000..0f8617ef3a0
--- /dev/null
+++ b/packages/iconify-collections/assets/vender/agent-v2/robot-3.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="17" height="16" viewBox="0 0 17 16" fill="none">
+  <path d="M6.25 6.875C6.82523 6.875 7.29167 7.34128 7.29167 7.91667V9.16667C7.29167 9.74205 6.82523 10.2083 6.25 10.2083C5.67477 10.2083 5.20833 9.74205 5.20833 9.16667V7.91667C5.20833 7.34128 5.67477 6.875 6.25 6.875Z" fill="#676F83"/>
+  <path d="M10.4167 6.875C10.992 6.875 11.4583 7.34135 11.4583 7.91667V9.16667C11.4583 9.74199 10.992 10.2083 10.4167 10.2083C9.84135 10.2083 9.375 9.74199 9.375 9.16667V7.91667C9.375 7.34135 9.84135 6.875 10.4167 6.875Z" fill="#676F83"/>
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M8.33333 0C9.13875 0 9.79167 0.652918 9.79167 1.45833C9.79167 2.02329 9.46964 2.51173 8.99984 2.75391V3.33822C9.38912 3.34279 9.77995 3.35006 10.175 3.36263C11.6983 3.41112 12.7377 3.42425 13.6401 3.90951C14.375 4.30477 15.0255 4.97655 15.3971 5.72347C15.5468 6.02442 15.6427 6.33532 15.7056 6.66667H15.8333C16.2936 6.66667 16.6667 7.03976 16.6667 7.5V10C16.6667 10.4602 16.2936 10.8333 15.8333 10.8333H15.8285C15.8235 11.2254 15.813 11.5735 15.7869 11.8831C15.7386 12.4571 15.6361 12.9628 15.3971 13.4432C15.0254 14.1901 14.3749 14.8619 13.6401 15.2572C12.7377 15.7424 11.6982 15.7556 10.175 15.804C8.93336 15.8436 7.73328 15.8436 6.4917 15.804C4.96843 15.7556 3.92896 15.7424 3.02653 15.2572C2.29178 14.8619 1.64121 14.1902 1.26953 13.4432C1.03058 12.9628 0.928072 12.4571 0.87972 11.8831C0.853642 11.5735 0.843216 11.2254 0.838216 10.8333H0.833333C0.373096 10.8333 0 10.4602 0 10V7.5C0 7.03976 0.373096 6.66667 0.833333 6.66667H0.9611C1.02392 6.33532 1.11984 6.02442 1.26953 5.72347C1.64119 4.97649 2.29177 4.30475 3.02653 3.90951C3.92895 3.42425 4.96837 3.41112 6.4917 3.36263C6.88671 3.35006 7.27754 3.34279 7.66683 3.33822V2.75391C7.19703 2.51173 6.875 2.02329 6.875 1.45833C6.875 0.652918 7.52792 0 8.33333 0ZM10.1213 5.02848C8.91522 4.9901 7.75142 4.9901 6.54541 5.02848C4.85908 5.08217 4.29323 5.12091 3.81592 5.3776C3.38476 5.60954 2.98015 6.02734 2.76204 6.46566C2.65217 6.68652 2.57959 6.96168 2.54069 7.4235C2.50069 7.89854 2.5 8.50363 2.5 9.37825V9.78841C2.5 10.663 2.50069 11.2681 2.54069 11.7432C2.57959 12.205 2.65215 12.4801 2.76204 12.701C2.98015 13.1393 3.38475 13.5571 3.81592 13.7891C4.29321 14.0458 4.85904 14.0845 6.54541 14.1382C7.75141 14.1766 8.91523 14.1766 10.1213 14.1382C11.8075 14.0845 12.3734 14.0458 12.8507 13.7891C13.2819 13.5572 13.6865 13.1394 13.9046 12.701C14.0145 12.4801 14.0871 12.205 14.126 11.7432C14.166 11.2681 14.1667 10.663 14.1667 9.78841V9.37825C14.1667 8.50363 14.166 7.89854 14.126 7.4235C14.0871 6.96168 14.0145 6.68652 13.9046 6.46566C13.6865 6.02729 13.2819 5.60951 12.8507 5.3776C12.3734 5.12091 11.8075 5.08217 10.1213 5.02848Z" fill="#676F83"/>
+</svg>
diff --git a/packages/iconify-collections/assets/vender/main-nav/roster-active.svg b/packages/iconify-collections/assets/vender/main-nav/roster-active.svg
new file mode 100644
index 00000000000..0d0fbb95fe9
--- /dev/null
+++ b/packages/iconify-collections/assets/vender/main-nav/roster-active.svg
@@ -0,0 +1,6 @@
+<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M11.9362 1.5C12.4177 1.50006 12.8411 1.81975 12.9727 2.28296L15.4651 11.061C15.5117 11.2251 15.6125 11.3687 15.7515 11.4675L16.1235 11.7319C16.3544 11.8963 16.4728 12.1769 16.4297 12.4571L15.9206 15.7669C15.8394 16.2948 15.2475 16.5708 14.7905 16.2942L12.8006 15.0893C12.6837 15.0186 12.5618 14.9546 12.4307 14.9165C12.2411 14.8615 12.0443 14.833 11.8462 14.833C10.6885 14.833 9.75 13.8945 9.75 12.7368V9.14722C9.75 8.23747 10.4875 7.5 11.3972 7.5C11.5688 7.5 11.7164 7.62113 11.7503 7.78928L12.3824 10.9483L12.4043 11.0215C12.4721 11.182 12.6457 11.2781 12.8233 11.2427C13.0009 11.2072 13.1242 11.0515 13.125 10.8772L13.1177 10.8017L12.4856 7.6428C12.3818 7.12384 11.9265 6.75002 11.3972 6.75C11.08 6.75 10.7771 6.81165 10.5 6.92359V2.93628C10.5 2.14312 11.1431 1.5 11.9362 1.5Z" fill="currentColor"/>
+<path d="M2.28761 11.1211C2.263 11.2855 2.25026 11.4538 2.25026 11.625C2.25026 13.3862 3.59948 14.8313 5.32057 14.9854L3.0757 16.3674C2.65801 16.6245 2.10961 16.418 1.96534 15.9492L0.926773 12.5742C0.823558 12.2388 0.967018 11.876 1.27174 11.7019L2.28761 11.1211Z" fill="currentColor"/>
+<path d="M6.42041 1.5C7.01664 1.5 7.49997 1.98337 7.49997 2.57959V8.81835C6.96373 8.4594 6.31878 8.25 5.62501 8.25C4.91854 8.25 4.26271 8.46705 3.7207 8.83815L5.01124 2.6455C5.15039 1.97822 5.73876 1.50007 6.42041 1.5Z" fill="currentColor"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M5.625 9C7.07475 9 8.25 10.1753 8.25 11.625C8.25 13.0747 7.07475 14.25 5.625 14.25C4.17525 14.25 3 13.0747 3 11.625C3 10.1753 4.17525 9 5.625 9ZM5.625 10.875C5.21078 10.875 4.875 11.2108 4.875 11.625C4.875 12.0392 5.21078 12.375 5.625 12.375C6.03921 12.375 6.375 12.0392 6.375 11.625C6.375 11.2108 6.03921 10.875 5.625 10.875Z" fill="currentColor"/>
+</svg>
diff --git a/packages/iconify-collections/assets/vender/main-nav/roster.svg b/packages/iconify-collections/assets/vender/main-nav/roster.svg
new file mode 100644
index 00000000000..5169111425e
--- /dev/null
+++ b/packages/iconify-collections/assets/vender/main-nav/roster.svg
@@ -0,0 +1,9 @@
+<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M7.875 11.8125C7.875 13.1587 6.7837 14.25 5.4375 14.25C4.0913 14.25 3 13.1587 3 11.8125C3 10.4663 4.0913 9.375 5.4375 9.375C6.7837 9.375 7.875 10.4663 7.875 11.8125Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M2.25 15.75L5.625 14.25" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M1.5 11.25L3 10.875" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M5.41699 12.5625C5.83121 12.5625 6.16699 12.2267 6.16699 11.8125C6.16699 11.3983 5.83121 11.0625 5.41699 11.0625C5.00278 11.0625 4.66699 11.3983 4.66699 11.8125C4.66699 12.2267 5.00278 12.5625 5.41699 12.5625Z" fill="currentColor"/>
+<path d="M13.125 11.25L12.4956 8.10292C12.4255 7.75237 12.1177 7.5 11.7601 7.5H11.625C10.7966 7.5 10.125 8.17155 10.125 9V12.3939C10.125 13.419 10.956 14.25 11.9811 14.25C12.2408 14.25 12.4976 14.3045 12.7349 14.41L15.75 15.75" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M10.875 7.5V3.75C10.875 2.92157 11.5466 2.25 12.375 2.25H12.5394C12.8836 2.25 13.1836 2.48422 13.267 2.81811L15.3332 11.0833L16.5 11.625" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M7.125 9.75V3C7.125 2.58579 6.78921 2.25 6.375 2.25H5.52089C5.14964 2.25 4.83426 2.5216 4.77919 2.88875L3.75 9.75" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/packages/iconify-collections/assets/vender/workflow/agent.svg b/packages/iconify-collections/assets/vender/workflow/agent.svg
index f30c0b455fc..09bf8c0683c 100644
--- a/packages/iconify-collections/assets/vender/workflow/agent.svg
+++ b/packages/iconify-collections/assets/vender/workflow/agent.svg
@@ -1,8 +1,6 @@
-<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g id="agent">
-<g id="Vector">
-<path d="M14.7401 5.80454C14.5765 4.77996 14.1638 3.79808 13.5306 2.97273C12.8973 2.14738 12.0648 1.48568 11.1185 1.06589C10.1722 0.646098 9.12632 0.461106 8.08751 0.546487C7.05582 0.624753 6.04548 0.966277 5.17744 1.53548C4.3094 2.09758 3.58366 2.88024 3.09272 3.79808C2.59466 4.70881 2.33852 5.7405 2.33852 6.7793V7.22756L1.25703 9.3692C1.04357 9.80322 1.22145 10.3368 1.65547 10.5574L2.3314 10.8989V12.3006C2.3314 12.82 2.53063 13.3038 2.90061 13.6738C3.2706 14.0367 3.75442 14.243 4.27382 14.243H6.01702V14.7624C6.01702 15.1538 6.3372 15.4739 6.72853 15.4739C7.11986 15.4739 7.44004 15.1538 7.44004 14.7624V13.7094C7.44004 13.2185 7.04159 12.82 6.55065 12.82H4.27382C4.13864 12.82 4.00345 12.7631 3.91095 12.6706C3.81846 12.5781 3.76154 12.4429 3.76154 12.3077V10.5716C3.76154 10.2301 3.56943 9.92417 3.2706 9.77476L2.77254 9.52573L3.66904 7.73984C3.72596 7.61889 3.76154 7.4837 3.76154 7.34851V6.77219C3.76154 5.96818 3.96076 5.17129 4.34498 4.4669C4.72919 3.76251 5.28417 3.15772 5.9601 2.7237C6.63603 2.28968 7.41158 2.02643 8.20847 1.96239C9.00536 1.89835 9.81648 2.04066 10.5493 2.36795C11.2822 2.69524 11.9225 3.20042 12.4135 3.84077C12.8973 4.47402 13.2246 5.23533 13.3456 6.02511C13.4665 6.81488 13.3954 7.63312 13.125 8.38731C12.8617 9.12017 12.4206 9.78187 11.8585 10.3084C11.6735 10.4792 11.5668 10.7139 11.5668 10.9701V14.7624C11.5668 15.1538 11.887 15.4739 12.2783 15.4739C12.6696 15.4739 12.9898 15.1538 12.9898 14.7624V11.1978C13.6515 10.5432 14.1567 9.73918 14.4697 8.87114C14.8184 7.89637 14.918 6.83623 14.7615 5.81165L14.7401 5.80454Z" fill="white"/>
-<path d="M10.8055 7.99599C10.8909 7.83234 10.962 7.66158 11.0189 7.4837H11.6522C12.0435 7.4837 12.3637 7.16352 12.3637 6.77219C12.3637 6.38086 12.0435 6.06068 11.6522 6.06068H11.0189C10.9691 5.8828 10.898 5.71204 10.8055 5.54839L11.2537 5.10014C11.5312 4.82266 11.5312 4.3744 11.2537 4.09692C10.9762 3.81943 10.528 3.81943 10.2505 4.09692L9.80225 4.54517C9.6386 4.45267 9.46784 4.38863 9.28996 4.33171V3.69847C9.28996 3.30714 8.96978 2.98696 8.57845 2.98696C8.18712 2.98696 7.86694 3.30714 7.86694 3.69847V4.33171C7.68907 4.38152 7.5183 4.45267 7.35466 4.54517L6.90641 4.09692C6.62892 3.81943 6.18067 3.81943 5.90318 4.09692C5.62569 4.3744 5.62569 4.82266 5.90318 5.10014L6.35143 5.54839C6.26605 5.71204 6.1949 5.8828 6.13798 6.06068H5.50473C5.1134 6.06068 4.79323 6.38086 4.79323 6.77219C4.79323 7.16352 5.1134 7.4837 5.50473 7.4837H6.13798C6.18778 7.66158 6.25893 7.83234 6.35143 7.99599L5.90318 8.44424C5.62569 8.72172 5.62569 9.16997 5.90318 9.44746C6.04548 9.58976 6.22336 9.6538 6.40835 9.6538C6.59334 9.6538 6.77122 9.58265 6.91352 9.44746L7.36177 8.99921C7.52542 9.08459 7.69618 9.15574 7.87406 9.21267V9.84591C7.87406 10.2372 8.19424 10.5574 8.58557 10.5574C8.9769 10.5574 9.29708 10.2372 9.29708 9.84591V9.21267C9.47496 9.16286 9.64572 9.09171 9.80936 8.99921L10.2576 9.44746C10.3999 9.58976 10.5778 9.6538 10.7628 9.6538C10.9478 9.6538 11.1257 9.58265 11.268 9.44746C11.5454 9.16997 11.5454 8.72172 11.268 8.44424L10.8197 7.99599H10.8055ZM7.44004 6.77219C7.44004 6.14606 7.94521 5.64089 8.57134 5.64089C9.19747 5.64089 9.70264 6.14606 9.70264 6.77219C9.70264 7.39832 9.19747 7.90349 8.57134 7.90349C7.94521 7.90349 7.44004 7.39832 7.44004 6.77219Z" fill="white"/>
-</g>
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g id="agent" transform="translate(2.5 1)">
+<path d="M3.3178 20.9524V15.7184C3.31774 15.7136 3.31456 15.6845 3.28404 15.6468L3.24312 15.6069C1.26589 13.9971 0 11.5398 0 8.78813C0.000122972 3.93464 3.93464 0.000122969 8.78813 0C13.5146 0 17.3698 3.73066 17.5691 8.40858C17.5712 8.45846 17.5841 8.48161 17.5865 8.48531L19.3226 11.089C19.7937 11.7956 19.6309 12.7481 18.9513 13.2579L17.5998 14.2707C17.5851 14.2819 17.5763 14.2996 17.5763 14.3178V15.4237C17.576 17.2235 16.1176 18.682 14.3178 18.6822H13.2119C13.1798 18.6822 13.1537 18.7085 13.1536 18.7405V20.9524C13.1536 21.5309 12.6845 21.9999 12.1059 22C11.5274 22 11.0583 21.531 11.0583 20.9524V18.7405C11.0584 17.5513 12.0226 16.587 13.2119 16.587H14.3178C14.9604 16.5868 15.4808 16.0663 15.481 15.4237V14.3178C15.481 13.64 15.8006 13.0016 16.3424 12.595L17.3195 11.8614L15.8432 9.64853C15.603 9.28835 15.4913 8.88291 15.4749 8.49758C15.323 4.93639 12.3872 2.09524 8.78813 2.09524C5.09181 2.09536 2.09536 5.09181 2.09524 8.78813C2.09524 10.883 3.05647 12.7533 4.56594 13.9822C5.0571 14.3822 5.41299 15.0012 5.41304 15.7184V20.9524C5.41304 21.5309 4.94385 21.9998 4.36542 22C3.78684 22 3.3178 21.531 3.3178 20.9524Z" fill="currentColor"/>
+<path d="M9.79012 6.5163L9.31429 5.27923C9.23058 5.06159 9.02158 4.91799 8.78836 4.91799C8.55514 4.91799 8.34614 5.06159 8.26243 5.27923L7.7866 6.5163C7.56194 7.10037 7.10038 7.56194 6.5163 7.78659L5.27923 8.26239C5.06159 8.34609 4.91799 8.55519 4.91799 8.78836C4.91799 9.02158 5.06159 9.23058 5.27923 9.31429L6.5163 9.79012C7.10037 10.0148 7.56194 10.4764 7.7866 11.0604L8.26243 12.2975C8.34614 12.5151 8.55514 12.6587 8.78836 12.6587C9.02158 12.6587 9.23058 12.5151 9.31429 12.2975L9.79012 11.0604C10.0148 10.4764 10.4764 10.0148 11.0604 9.79012L12.2975 9.31429C12.5151 9.23058 12.6587 9.02158 12.6587 8.78836C12.6587 8.55519 12.5151 8.34609 12.2975 8.26239L11.0604 7.78659C10.4764 7.56194 10.0148 7.10038 9.79012 6.5163Z" fill="currentColor"/>
 </g>
 </svg>
diff --git a/packages/iconify-collections/custom-public/icons.json b/packages/iconify-collections/custom-public/icons.json
index 7a4ea8bdaf1..0f83cf3b3e8 100644
--- a/packages/iconify-collections/custom-public/icons.json
+++ b/packages/iconify-collections/custom-public/icons.json
@@ -1,7 +1,10 @@
 {
   "prefix": "custom-public",
-  "lastModified": 1781246368,
+  "lastModified": 1781515983,
   "icons": {
+    "agent-building-blocks": {
+      "body": "<path fill=\"#155AEF\" fill-rule=\"evenodd\" d=\"M8.303 1.546c.178-.045.364-.051.544-.017c.23.043.432.167.573.246l3.757 2.113c.12.067.29.156.433.289l.06.06c.12.131.21.288.267.457c.07.215.063.445.063.6V9.56c0 .146.007.36-.056.563q-.055.181-.162.338l-.075.1c-.137.163-.32.274-.442.353l-5.013 3.259c-.135.088-.33.224-.556.282a1.3 1.3 0 0 1-.543.017c-.23-.043-.433-.166-.573-.245l-3.757-2.114c-.136-.077-.34-.182-.493-.35a1.3 1.3 0 0 1-.267-.456C1.993 11.09 2 10.86 2 10.704V6.441c0-.146-.007-.36.055-.563l.043-.118a1.3 1.3 0 0 1 .195-.32l.053-.059c.128-.131.282-.225.389-.294L7.86 1.755c.122-.078.273-.165.443-.209m-4.97 9.158l.001.164l.033.02l.11.062l3.264 1.836v-1.137L3.333 9.732zm4.741.917v1.076l4.464-2.901l.098-.065l.029-.02v-.034l.001-.118v-.923zm-4.74-3.419L6.74 10.12V8.982L3.333 7.066zm4.74.752v1.076l4.592-2.985V5.969zm.51-6.08l-4.631 3.01l3.429 1.93l4.664-3.032l-3.28-1.846l-.15-.082z\" clip-rule=\"evenodd\"/>"
+    },
     "avatar-user": {
       "body": "<g fill=\"none\"><g clip-path=\"url(#svgID0)\"><rect width=\"512\" height=\"512\" fill=\"#B2DDFF\" rx=\"256\"/><circle cx=\"256\" cy=\"196\" r=\"84\" fill=\"#fff\" opacity=\".68\"/><ellipse cx=\"256\" cy=\"583.5\" fill=\"#fff\" opacity=\".68\" rx=\"266\" ry=\"274.5\"/></g><defs><clipPath id=\"svgID0\"><rect width=\"512\" height=\"512\" fill=\"#fff\" rx=\"256\"/></clipPath></defs></g>",
       "width": 512,
diff --git a/packages/iconify-collections/custom-public/info.json b/packages/iconify-collections/custom-public/info.json
index 115e9e25f90..1b439b73724 100644
--- a/packages/iconify-collections/custom-public/info.json
+++ b/packages/iconify-collections/custom-public/info.json
@@ -1,7 +1,7 @@
 {
   "prefix": "custom-public",
   "name": "Dify Custom Public",
-  "total": 144,
+  "total": 145,
   "version": "0.0.0-private",
   "author": {
     "name": "LangGenius, Inc.",
@@ -13,12 +13,12 @@
     "url": "https://github.com/langgenius/dify/blob/main/LICENSE"
   },
   "samples": [
+    "agent-building-blocks",
     "avatar-user",
     "billing-ar-cube-1",
     "billing-asterisk",
     "billing-aws-marketplace-dark",
-    "billing-aws-marketplace-light",
-    "billing-azure"
+    "billing-aws-marketplace-light"
   ],
   "palette": false
 }
diff --git a/packages/iconify-collections/custom-vender/icons.json b/packages/iconify-collections/custom-vender/icons.json
index bf08a795057..048c5af7553 100644
--- a/packages/iconify-collections/custom-vender/icons.json
+++ b/packages/iconify-collections/custom-vender/icons.json
@@ -1,7 +1,29 @@
 {
   "prefix": "custom-vender",
-  "lastModified": 1781246368,
+  "lastModified": 1781515983,
   "icons": {
+    "agent-v2-access-point": {
+      "body": "<g fill=\"none\"><path d=\"M7.5 11.25C7.91421 11.25 8.25 11.5858 8.25 12V14.25C8.25 14.6642 7.91421 15 7.5 15C7.08579 15 6.75 14.6642 6.75 14.25V12C6.75 11.5858 7.08579 11.25 7.5 11.25Z\" fill=\"currentColor\"/><path d=\"M2.19653 2.19653C2.48937 1.90372 2.96418 1.90382 3.25708 2.19653L8.03027 6.96973C8.09162 7.03108 8.13966 7.10082 8.17529 7.1748C8.19164 7.20869 8.20587 7.24378 8.21704 7.28027C8.24638 7.37633 8.25641 7.477 8.24634 7.57617C8.23743 7.66451 8.21216 7.74788 8.17529 7.82446C8.13963 7.89868 8.09176 7.96874 8.03027 8.03027L3.25708 12.8035C2.96419 13.096 2.48932 13.0962 2.19653 12.8035C1.90394 12.5107 1.90405 12.0358 2.19653 11.7429L5.68945 8.25H0.75C0.335786 8.25 0 7.91421 0 7.5C0 7.08579 0.335786 6.75 0.75 6.75H5.68945L2.19653 3.25708C1.90389 2.96423 1.90388 2.48937 2.19653 2.19653Z\" fill=\"currentColor\"/><path d=\"M10.1521 10.1521C10.445 9.85921 10.9198 9.85921 11.2126 10.1521L12.8035 11.7429C13.096 12.0358 13.0962 12.5107 12.8035 12.8035C12.5107 13.0962 12.0358 13.096 11.7429 12.8035L10.1521 11.2126C9.85921 10.9198 9.85922 10.445 10.1521 10.1521Z\" fill=\"currentColor\"/><path d=\"M14.25 6.75C14.6642 6.75 15 7.08579 15 7.5C15 7.91421 14.6642 8.25 14.25 8.25H12C11.5858 8.25 11.25 7.91421 11.25 7.5C11.25 7.08579 11.5858 6.75 12 6.75H14.25Z\" fill=\"currentColor\"/><path d=\"M11.7422 2.19653C12.035 1.90387 12.5098 1.90406 12.8027 2.19653C13.0956 2.4894 13.0955 2.96419 12.8027 3.25708L11.2119 4.8479C10.919 5.14079 10.4443 5.1408 10.1514 4.8479C9.85883 4.55497 9.85858 4.08013 10.1514 3.78735L11.7422 2.19653Z\" fill=\"currentColor\"/><path d=\"M7.5 0C7.91421 0 8.25 0.335786 8.25 0.75V3C8.25 3.41421 7.91421 3.75 7.5 3.75C7.08579 3.75 6.75 3.41421 6.75 3V0.75C6.75 0.335786 7.08579 0 7.5 0Z\" fill=\"currentColor\"/></g>",
+      "width": 15,
+      "height": 15
+    },
+    "agent-v2-end-user-auth": {
+      "body": "<g fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M12 7.33325C13.1046 7.33325 14 8.22865 14 9.33325C14 10.1403 13.5218 10.8356 12.8333 11.1516V11.9999L12.3333 12.4999L12.8333 12.9511V13.6666L12 14.3333L11.1667 13.6666V11.1516C10.4782 10.8356 10 10.1403 10 9.33325C10 8.22865 10.8954 7.33325 12 7.33325ZM12 8.66659C11.6318 8.66659 11.3333 8.96505 11.3333 9.33325C11.3333 9.70145 11.6318 9.99992 12 9.99992C12.3682 9.99992 12.6667 9.70145 12.6667 9.33325C12.6667 8.96505 12.3682 8.66659 12 8.66659Z\" fill=\"currentColor\"/><path d=\"M8 7.99992C8.2545 7.99992 8.50382 8.01506 8.7474 8.04484L8.58594 9.36841C8.39687 9.34527 8.20127 9.33325 8 9.33325C5.8465 9.33325 4.25915 10.7274 3.78646 12.6666H10V13.9999H2.26758L2.33594 13.2708C2.61081 10.3473 4.82817 7.99992 8 7.99992Z\" fill=\"currentColor\"/><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M8 1.33325C9.65687 1.33325 11 2.6764 11 4.33325C11 5.99011 9.65687 7.33325 8 7.33325C6.34315 7.33325 5 5.99011 5 4.33325C5 2.6764 6.34315 1.33325 8 1.33325ZM8 2.66659C7.07953 2.66659 6.33333 3.41278 6.33333 4.33325C6.33333 5.25373 7.07953 5.99992 8 5.99992C8.92047 5.99992 9.66667 5.25373 9.66667 4.33325C9.66667 3.41278 8.92047 2.66659 8 2.66659Z\" fill=\"currentColor\"/></g>"
+    },
+    "agent-v2-plan": {
+      "body": "<g fill=\"none\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M17 0C17.5523 0 18 0.447715 18 1V6C18 6.55228 17.5523 7 17 7H12C11.4477 7 11 6.55228 11 6V4.5H6.94629C5.92438 4.50039 5.56101 5.85276 6.44531 6.36523L12.5576 9.90332C15.2116 11.4402 14.1206 15.4996 11.0537 15.5H7V17C7 17.5523 6.55228 18 6 18H1C0.447715 18 0 17.5523 0 17V12C0 11.4477 0.447715 11 1 11H6C6.55228 11 7 11.4477 7 12V13.5H11.0537C12.0756 13.4996 12.4394 12.1472 11.5557 11.6348L5.44336 8.09668C2.789 6.55983 3.87917 2.50039 6.94629 2.5H11V1C11 0.447715 11.4477 0 12 0H17ZM2 16H5V13H2V16ZM13 5H16V2H13V5Z\" fill=\"currentColor\"/></g>",
+      "width": 18,
+      "height": 18
+    },
+    "agent-v2-prompt-insert": {
+      "body": "<g fill=\"none\"><path d=\"M2.91669 1.16669C1.95019 1.16669 1.16669 1.95019 1.16669 2.91669V11.0834C1.16669 12.0499 1.95019 12.8334 2.91669 12.8334H11.0834C12.0499 12.8334 12.8334 12.0499 12.8334 11.0834V2.91669C12.8334 1.95019 12.0499 1.16669 11.0834 1.16669H2.91669ZM2.33335 2.91669C2.33335 2.59452 2.59452 2.33335 2.91669 2.33335H11.0834C11.4055 2.33335 11.6667 2.59452 11.6667 2.91669V11.0834C11.6667 11.4055 11.4055 11.6667 11.0834 11.6667H2.91669C2.59452 11.6667 2.33335 11.4055 2.33335 11.0834V2.91669ZM5.67188 10.5L9.67186 3.50002H8.32815L4.32817 10.5H5.67188Z\" fill=\"currentColor\"/></g>",
+      "width": 14,
+      "height": 14
+    },
+    "agent-v2-robot-3": {
+      "body": "<g fill=\"none\"><path d=\"M6.25 6.875C6.82523 6.875 7.29167 7.34128 7.29167 7.91667V9.16667C7.29167 9.74205 6.82523 10.2083 6.25 10.2083C5.67477 10.2083 5.20833 9.74205 5.20833 9.16667V7.91667C5.20833 7.34128 5.67477 6.875 6.25 6.875Z\" fill=\"currentColor\"/><path d=\"M10.4167 6.875C10.992 6.875 11.4583 7.34135 11.4583 7.91667V9.16667C11.4583 9.74199 10.992 10.2083 10.4167 10.2083C9.84135 10.2083 9.375 9.74199 9.375 9.16667V7.91667C9.375 7.34135 9.84135 6.875 10.4167 6.875Z\" fill=\"currentColor\"/><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M8.33333 0C9.13875 0 9.79167 0.652918 9.79167 1.45833C9.79167 2.02329 9.46964 2.51173 8.99984 2.75391V3.33822C9.38912 3.34279 9.77995 3.35006 10.175 3.36263C11.6983 3.41112 12.7377 3.42425 13.6401 3.90951C14.375 4.30477 15.0255 4.97655 15.3971 5.72347C15.5468 6.02442 15.6427 6.33532 15.7056 6.66667H15.8333C16.2936 6.66667 16.6667 7.03976 16.6667 7.5V10C16.6667 10.4602 16.2936 10.8333 15.8333 10.8333H15.8285C15.8235 11.2254 15.813 11.5735 15.7869 11.8831C15.7386 12.4571 15.6361 12.9628 15.3971 13.4432C15.0254 14.1901 14.3749 14.8619 13.6401 15.2572C12.7377 15.7424 11.6982 15.7556 10.175 15.804C8.93336 15.8436 7.73328 15.8436 6.4917 15.804C4.96843 15.7556 3.92896 15.7424 3.02653 15.2572C2.29178 14.8619 1.64121 14.1902 1.26953 13.4432C1.03058 12.9628 0.928072 12.4571 0.87972 11.8831C0.853642 11.5735 0.843216 11.2254 0.838216 10.8333H0.833333C0.373096 10.8333 0 10.4602 0 10V7.5C0 7.03976 0.373096 6.66667 0.833333 6.66667H0.9611C1.02392 6.33532 1.11984 6.02442 1.26953 5.72347C1.64119 4.97649 2.29177 4.30475 3.02653 3.90951C3.92895 3.42425 4.96837 3.41112 6.4917 3.36263C6.88671 3.35006 7.27754 3.34279 7.66683 3.33822V2.75391C7.19703 2.51173 6.875 2.02329 6.875 1.45833C6.875 0.652918 7.52792 0 8.33333 0ZM10.1213 5.02848C8.91522 4.9901 7.75142 4.9901 6.54541 5.02848C4.85908 5.08217 4.29323 5.12091 3.81592 5.3776C3.38476 5.60954 2.98015 6.02734 2.76204 6.46566C2.65217 6.68652 2.57959 6.96168 2.54069 7.4235C2.50069 7.89854 2.5 8.50363 2.5 9.37825V9.78841C2.5 10.663 2.50069 11.2681 2.54069 11.7432C2.57959 12.205 2.65215 12.4801 2.76204 12.701C2.98015 13.1393 3.38475 13.5571 3.81592 13.7891C4.29321 14.0458 4.85904 14.0845 6.54541 14.1382C7.75141 14.1766 8.91523 14.1766 10.1213 14.1382C11.8075 14.0845 12.3734 14.0458 12.8507 13.7891C13.2819 13.5572 13.6865 13.1394 13.9046 12.701C14.0145 12.4801 14.0871 12.205 14.126 11.7432C14.166 11.2681 14.1667 10.663 14.1667 9.78841V9.37825C14.1667 8.50363 14.166 7.89854 14.126 7.4235C14.0871 6.96168 14.0145 6.68652 13.9046 6.46566C13.6865 6.02729 13.2819 5.60951 12.8507 5.3776C12.3734 5.12091 11.8075 5.08217 10.1213 5.02848Z\" fill=\"currentColor\"/></g>",
+      "width": 17
+    },
     "features-citations": {
       "body": "<g fill=\"none\"><path d=\"M1 12C1 5.92487 5.92487 1 12 1C18.0751 1 23 5.92487 23 12C23 18.0751 18.0751 23 12 23C5.92487 23 1 18.0751 1 12ZM7 11.9702V14.958H11.0356V11.2339H8.8125C8.78418 10.8185 8.85498 10.4173 9.0249 10.0303C9.35531 9.29395 10.002 8.77474 10.9648 8.47266V7C9.67155 7.25488 8.68506 7.79297 8.00537 8.61426C7.33512 9.43555 7 10.5542 7 11.9702ZM15.0391 10.0586C15.3695 9.29395 16.0114 8.7653 16.9648 8.47266V7C15.7093 7.25488 14.7323 7.78825 14.0337 8.6001C13.3446 9.41195 13 10.5353 13 11.9702V14.958H17.0356V11.2339H14.8125C14.7747 10.8563 14.8503 10.4645 15.0391 10.0586Z\" fill=\"currentColor\"/></g>",
       "width": 24,
@@ -811,6 +833,16 @@
       "width": 24,
       "height": 24
     },
+    "main-nav-roster": {
+      "body": "<g fill=\"none\"><path d=\"M7.875 11.8125C7.875 13.1587 6.7837 14.25 5.4375 14.25C4.0913 14.25 3 13.1587 3 11.8125C3 10.4663 4.0913 9.375 5.4375 9.375C6.7837 9.375 7.875 10.4663 7.875 11.8125Z\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><path d=\"M2.25 15.75L5.625 14.25\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><path d=\"M1.5 11.25L3 10.875\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><path d=\"M5.41699 12.5625C5.83121 12.5625 6.16699 12.2267 6.16699 11.8125C6.16699 11.3983 5.83121 11.0625 5.41699 11.0625C5.00278 11.0625 4.66699 11.3983 4.66699 11.8125C4.66699 12.2267 5.00278 12.5625 5.41699 12.5625Z\" fill=\"currentColor\"/><path d=\"M13.125 11.25L12.4956 8.10292C12.4255 7.75237 12.1177 7.5 11.7601 7.5H11.625C10.7966 7.5 10.125 8.17155 10.125 9V12.3939C10.125 13.419 10.956 14.25 11.9811 14.25C12.2408 14.25 12.4976 14.3045 12.7349 14.41L15.75 15.75\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><path d=\"M10.875 7.5V3.75C10.875 2.92157 11.5466 2.25 12.375 2.25H12.5394C12.8836 2.25 13.1836 2.48422 13.267 2.81811L15.3332 11.0833L16.5 11.625\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><path d=\"M7.125 9.75V3C7.125 2.58579 6.78921 2.25 6.375 2.25H5.52089C5.14964 2.25 4.83426 2.5216 4.77919 2.88875L3.75 9.75\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/></g>",
+      "width": 18,
+      "height": 18
+    },
+    "main-nav-roster-active": {
+      "body": "<g fill=\"none\"><path d=\"M11.9362 1.5C12.4177 1.50006 12.8411 1.81975 12.9727 2.28296L15.4651 11.061C15.5117 11.2251 15.6125 11.3687 15.7515 11.4675L16.1235 11.7319C16.3544 11.8963 16.4728 12.1769 16.4297 12.4571L15.9206 15.7669C15.8394 16.2948 15.2475 16.5708 14.7905 16.2942L12.8006 15.0893C12.6837 15.0186 12.5618 14.9546 12.4307 14.9165C12.2411 14.8615 12.0443 14.833 11.8462 14.833C10.6885 14.833 9.75 13.8945 9.75 12.7368V9.14722C9.75 8.23747 10.4875 7.5 11.3972 7.5C11.5688 7.5 11.7164 7.62113 11.7503 7.78928L12.3824 10.9483L12.4043 11.0215C12.4721 11.182 12.6457 11.2781 12.8233 11.2427C13.0009 11.2072 13.1242 11.0515 13.125 10.8772L13.1177 10.8017L12.4856 7.6428C12.3818 7.12384 11.9265 6.75002 11.3972 6.75C11.08 6.75 10.7771 6.81165 10.5 6.92359V2.93628C10.5 2.14312 11.1431 1.5 11.9362 1.5Z\" fill=\"currentColor\"/><path d=\"M2.28761 11.1211C2.263 11.2855 2.25026 11.4538 2.25026 11.625C2.25026 13.3862 3.59948 14.8313 5.32057 14.9854L3.0757 16.3674C2.65801 16.6245 2.10961 16.418 1.96534 15.9492L0.926773 12.5742C0.823558 12.2388 0.967018 11.876 1.27174 11.7019L2.28761 11.1211Z\" fill=\"currentColor\"/><path d=\"M6.42041 1.5C7.01664 1.5 7.49997 1.98337 7.49997 2.57959V8.81835C6.96373 8.4594 6.31878 8.25 5.62501 8.25C4.91854 8.25 4.26271 8.46705 3.7207 8.83815L5.01124 2.6455C5.15039 1.97822 5.73876 1.50007 6.42041 1.5Z\" fill=\"currentColor\"/><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M5.625 9C7.07475 9 8.25 10.1753 8.25 11.625C8.25 13.0747 7.07475 14.25 5.625 14.25C4.17525 14.25 3 13.0747 3 11.625C3 10.1753 4.17525 9 5.625 9ZM5.625 10.875C5.21078 10.875 4.875 11.2108 4.875 11.625C4.875 12.0392 5.21078 12.375 5.625 12.375C6.03921 12.375 6.375 12.0392 6.375 11.625C6.375 11.2108 6.03921 10.875 5.625 10.875Z\" fill=\"currentColor\"/></g>",
+      "width": 18,
+      "height": 18
+    },
     "main-nav-studio": {
       "body": "<g fill=\"none\"><path d=\"M15.8206 2.0275C15.7973 1.82217 15.6238 1.66696 15.4171 1.66675C15.2104 1.66654 15.0365 1.82139 15.0128 2.02667C14.865 3.30836 14.1416 4.03176 12.8599 4.17959C12.6547 4.20326 12.4998 4.37719 12.5 4.58383C12.5003 4.79047 12.6554 4.96408 12.8608 4.98733C14.1243 5.13046 14.8978 5.84689 15.0117 7.12955C15.0304 7.33946 15.2064 7.50032 15.4171 7.50008C15.6278 7.49984 15.8035 7.33859 15.8217 7.12863C15.9311 5.86411 16.6973 5.09787 17.9619 4.98841C18.1718 4.97023 18.3331 4.79461 18.3333 4.58387C18.3336 4.37313 18.1728 4.19715 17.9628 4.17851C16.6802 4.06457 15.9637 3.29101 15.8206 2.0275Z\" fill=\"currentColor\"/><path d=\"M7.29167 9.16659C8.9025 9.16659 10.2083 7.86075 10.2083 6.24992C10.2083 4.63909 8.9025 3.33325 7.29167 3.33325C5.68084 3.33325 4.375 4.63909 4.375 6.24992C4.375 7.86075 5.68084 9.16659 7.29167 9.16659Z\" stroke=\"currentColor\" stroke-width=\"1.5\"/><path d=\"M1.66699 16.6667C1.66699 13.9053 3.90557 11.6667 6.66699 11.6667H7.08366\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><path d=\"M9.16634 16.6666L10.833 10.8333H18.333L16.6663 16.6666H9.16634ZM9.16634 16.6666H5.83301\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/></g>",
       "width": 20,
@@ -1295,9 +1327,9 @@
       "height": 24
     },
     "workflow-agent": {
-      "body": "<g fill=\"none\"><g id=\"agent\"><g id=\"Vector\"><path d=\"M14.7401 5.80454C14.5765 4.77996 14.1638 3.79808 13.5306 2.97273C12.8973 2.14738 12.0648 1.48568 11.1185 1.06589C10.1722 0.646098 9.12632 0.461106 8.08751 0.546487C7.05582 0.624753 6.04548 0.966277 5.17744 1.53548C4.3094 2.09758 3.58366 2.88024 3.09272 3.79808C2.59466 4.70881 2.33852 5.7405 2.33852 6.7793V7.22756L1.25703 9.3692C1.04357 9.80322 1.22145 10.3368 1.65547 10.5574L2.3314 10.8989V12.3006C2.3314 12.82 2.53063 13.3038 2.90061 13.6738C3.2706 14.0367 3.75442 14.243 4.27382 14.243H6.01702V14.7624C6.01702 15.1538 6.3372 15.4739 6.72853 15.4739C7.11986 15.4739 7.44004 15.1538 7.44004 14.7624V13.7094C7.44004 13.2185 7.04159 12.82 6.55065 12.82H4.27382C4.13864 12.82 4.00345 12.7631 3.91095 12.6706C3.81846 12.5781 3.76154 12.4429 3.76154 12.3077V10.5716C3.76154 10.2301 3.56943 9.92417 3.2706 9.77476L2.77254 9.52573L3.66904 7.73984C3.72596 7.61889 3.76154 7.4837 3.76154 7.34851V6.77219C3.76154 5.96818 3.96076 5.17129 4.34498 4.4669C4.72919 3.76251 5.28417 3.15772 5.9601 2.7237C6.63603 2.28968 7.41158 2.02643 8.20847 1.96239C9.00536 1.89835 9.81648 2.04066 10.5493 2.36795C11.2822 2.69524 11.9225 3.20042 12.4135 3.84077C12.8973 4.47402 13.2246 5.23533 13.3456 6.02511C13.4665 6.81488 13.3954 7.63312 13.125 8.38731C12.8617 9.12017 12.4206 9.78187 11.8585 10.3084C11.6735 10.4792 11.5668 10.7139 11.5668 10.9701V14.7624C11.5668 15.1538 11.887 15.4739 12.2783 15.4739C12.6696 15.4739 12.9898 15.1538 12.9898 14.7624V11.1978C13.6515 10.5432 14.1567 9.73918 14.4697 8.87114C14.8184 7.89637 14.918 6.83623 14.7615 5.81165L14.7401 5.80454Z\" fill=\"currentColor\"/><path d=\"M10.8055 7.99599C10.8909 7.83234 10.962 7.66158 11.0189 7.4837H11.6522C12.0435 7.4837 12.3637 7.16352 12.3637 6.77219C12.3637 6.38086 12.0435 6.06068 11.6522 6.06068H11.0189C10.9691 5.8828 10.898 5.71204 10.8055 5.54839L11.2537 5.10014C11.5312 4.82266 11.5312 4.3744 11.2537 4.09692C10.9762 3.81943 10.528 3.81943 10.2505 4.09692L9.80225 4.54517C9.6386 4.45267 9.46784 4.38863 9.28996 4.33171V3.69847C9.28996 3.30714 8.96978 2.98696 8.57845 2.98696C8.18712 2.98696 7.86694 3.30714 7.86694 3.69847V4.33171C7.68907 4.38152 7.5183 4.45267 7.35466 4.54517L6.90641 4.09692C6.62892 3.81943 6.18067 3.81943 5.90318 4.09692C5.62569 4.3744 5.62569 4.82266 5.90318 5.10014L6.35143 5.54839C6.26605 5.71204 6.1949 5.8828 6.13798 6.06068H5.50473C5.1134 6.06068 4.79323 6.38086 4.79323 6.77219C4.79323 7.16352 5.1134 7.4837 5.50473 7.4837H6.13798C6.18778 7.66158 6.25893 7.83234 6.35143 7.99599L5.90318 8.44424C5.62569 8.72172 5.62569 9.16997 5.90318 9.44746C6.04548 9.58976 6.22336 9.6538 6.40835 9.6538C6.59334 9.6538 6.77122 9.58265 6.91352 9.44746L7.36177 8.99921C7.52542 9.08459 7.69618 9.15574 7.87406 9.21267V9.84591C7.87406 10.2372 8.19424 10.5574 8.58557 10.5574C8.9769 10.5574 9.29708 10.2372 9.29708 9.84591V9.21267C9.47496 9.16286 9.64572 9.09171 9.80936 8.99921L10.2576 9.44746C10.3999 9.58976 10.5778 9.6538 10.7628 9.6538C10.9478 9.6538 11.1257 9.58265 11.268 9.44746C11.5454 9.16997 11.5454 8.72172 11.268 8.44424L10.8197 7.99599H10.8055ZM7.44004 6.77219C7.44004 6.14606 7.94521 5.64089 8.57134 5.64089C9.19747 5.64089 9.70264 6.14606 9.70264 6.77219C9.70264 7.39832 9.19747 7.90349 8.57134 7.90349C7.94521 7.90349 7.44004 7.39832 7.44004 6.77219Z\" fill=\"currentColor\"/></g></g></g>",
-      "width": 16,
-      "height": 16
+      "body": "<g fill=\"none\"><g id=\"agent\" transform=\"translate(2.5 1)\"><path d=\"M3.3178 20.9524V15.7184C3.31774 15.7136 3.31456 15.6845 3.28404 15.6468L3.24312 15.6069C1.26589 13.9971 0 11.5398 0 8.78813C0.000122972 3.93464 3.93464 0.000122969 8.78813 0C13.5146 0 17.3698 3.73066 17.5691 8.40858C17.5712 8.45846 17.5841 8.48161 17.5865 8.48531L19.3226 11.089C19.7937 11.7956 19.6309 12.7481 18.9513 13.2579L17.5998 14.2707C17.5851 14.2819 17.5763 14.2996 17.5763 14.3178V15.4237C17.576 17.2235 16.1176 18.682 14.3178 18.6822H13.2119C13.1798 18.6822 13.1537 18.7085 13.1536 18.7405V20.9524C13.1536 21.5309 12.6845 21.9999 12.1059 22C11.5274 22 11.0583 21.531 11.0583 20.9524V18.7405C11.0584 17.5513 12.0226 16.587 13.2119 16.587H14.3178C14.9604 16.5868 15.4808 16.0663 15.481 15.4237V14.3178C15.481 13.64 15.8006 13.0016 16.3424 12.595L17.3195 11.8614L15.8432 9.64853C15.603 9.28835 15.4913 8.88291 15.4749 8.49758C15.323 4.93639 12.3872 2.09524 8.78813 2.09524C5.09181 2.09536 2.09536 5.09181 2.09524 8.78813C2.09524 10.883 3.05647 12.7533 4.56594 13.9822C5.0571 14.3822 5.41299 15.0012 5.41304 15.7184V20.9524C5.41304 21.5309 4.94385 21.9998 4.36542 22C3.78684 22 3.3178 21.531 3.3178 20.9524Z\" fill=\"currentColor\"/><path d=\"M9.79012 6.5163L9.31429 5.27923C9.23058 5.06159 9.02158 4.91799 8.78836 4.91799C8.55514 4.91799 8.34614 5.06159 8.26243 5.27923L7.7866 6.5163C7.56194 7.10037 7.10038 7.56194 6.5163 7.78659L5.27923 8.26239C5.06159 8.34609 4.91799 8.55519 4.91799 8.78836C4.91799 9.02158 5.06159 9.23058 5.27923 9.31429L6.5163 9.79012C7.10037 10.0148 7.56194 10.4764 7.7866 11.0604L8.26243 12.2975C8.34614 12.5151 8.55514 12.6587 8.78836 12.6587C9.02158 12.6587 9.23058 12.5151 9.31429 12.2975L9.79012 11.0604C10.0148 10.4764 10.4764 10.0148 11.0604 9.79012L12.2975 9.31429C12.5151 9.23058 12.6587 9.02158 12.6587 8.78836C12.6587 8.55519 12.5151 8.34609 12.2975 8.26239L11.0604 7.78659C10.4764 7.56194 10.0148 7.10038 9.79012 6.5163Z\" fill=\"currentColor\"/></g></g>",
+      "width": 24,
+      "height": 24
     },
     "workflow-answer": {
       "body": "<g fill=\"none\"><g id=\"icons/answer\"><path id=\"Vector (Stroke)\" fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M3.50114 1.67701L10.5011 1.677C11.5079 1.677 12.3241 2.49311 12.3241 3.49992V9.35414C12.3241 10.3609 11.5079 11.177 10.5012 11.1771H8.9954L7.41734 12.4845C7.17339 12.6866 6.81987 12.6856 6.57708 12.4821L5.02026 11.1771H3.50114C2.49436 11.1771 1.67822 10.3608 1.67822 9.35414V3.49993C1.67822 2.49316 2.49437 1.67701 3.50114 1.67701ZM10.5011 2.9895L3.50114 2.98951C3.21924 2.98951 2.99072 3.21803 2.99072 3.49993V9.35414C2.99072 9.63601 3.21926 9.86455 3.50114 9.86455H5.04675C5.33794 9.86455 5.61984 9.96705 5.84302 10.1541L7.00112 11.1249L8.17831 10.1496C8.40069 9.96537 8.68041 9.86455 8.96916 9.86455H10.5011C10.5011 9.86455 10.5011 9.86455 10.5011 9.86455C10.783 9.8645 11.0116 9.63592 11.0116 9.35414V3.49992C11.0116 3.21806 10.7831 2.9895 10.5011 2.9895ZM9.06809 4.93171C9.32437 5.18799 9.32437 5.60351 9.06809 5.85979L7.02642 7.90146C6.77014 8.15774 6.35464 8.15774 6.09835 7.90146L5.22333 7.02646C4.96704 6.77019 4.96704 6.35467 5.22332 6.09839C5.4796 5.8421 5.89511 5.8421 6.15139 6.09837L6.56238 6.50935L8.14001 4.93171C8.3963 4.67543 8.81181 4.67543 9.06809 4.93171Z\" fill=\"currentColor\"/></g></g>",
diff --git a/packages/iconify-collections/custom-vender/info.json b/packages/iconify-collections/custom-vender/info.json
index cef352ac549..608b5020f04 100644
--- a/packages/iconify-collections/custom-vender/info.json
+++ b/packages/iconify-collections/custom-vender/info.json
@@ -1,7 +1,7 @@
 {
   "prefix": "custom-vender",
   "name": "Dify Custom Vender",
-  "total": 319,
+  "total": 326,
   "version": "0.0.0-private",
   "author": {
     "name": "LangGenius, Inc.",
@@ -13,12 +13,12 @@
     "url": "https://github.com/langgenius/dify/blob/main/LICENSE"
   },
   "samples": [
-    "features-citations",
-    "features-content-moderation",
-    "features-document",
-    "features-folder-upload",
-    "features-love-message",
-    "features-message-fast"
+    "agent-v2-access-point",
+    "agent-v2-end-user-auth",
+    "agent-v2-plan",
+    "agent-v2-prompt-insert",
+    "agent-v2-robot-3",
+    "features-citations"
   ],
   "palette": false
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d189883bd0a..3f5f3f59363 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -16,8 +16,8 @@ catalogs:
       specifier: 9.0.0
       version: 9.0.0
     '@base-ui/react':
-      specifier: 1.5.0
-      version: 1.5.0
+      specifier: 1.6.0
+      version: 1.6.0
     '@chromatic-com/storybook':
       specifier: 5.2.1
       version: 5.2.1
@@ -168,6 +168,9 @@ catalogs:
     '@tanstack/eslint-plugin-query':
       specifier: 5.101.0
       version: 5.101.0
+    '@tanstack/query-core':
+      specifier: 5.101.0
+      version: 5.101.0
     '@tanstack/react-form':
       specifier: 1.33.0
       version: 1.33.0
@@ -393,6 +396,12 @@ catalogs:
     jotai:
       specifier: 2.20.1
       version: 2.20.1
+    jotai-scope:
+      specifier: 0.11.0
+      version: 0.11.0
+    jotai-tanstack-query:
+      specifier: 0.11.0
+      version: 0.11.0
     js-audio-recorder:
       specifier: 1.0.7
       version: 1.0.7
@@ -855,7 +864,7 @@ importers:
     devDependencies:
       '@base-ui/react':
         specifier: 'catalog:'
-        version: 1.5.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.6.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@chromatic-com/storybook':
         specifier: 'catalog:'
         version: 5.2.1(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
@@ -1029,7 +1038,7 @@ importers:
         version: 1.32.1(@amplitude/rrweb@2.0.0-alpha.40)
       '@base-ui/react':
         specifier: 'catalog:'
-        version: 1.5.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.6.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@emoji-mart/data':
         specifier: 'catalog:'
         version: 1.2.1
@@ -1096,6 +1105,9 @@ importers:
       '@tailwindcss/typography':
         specifier: 'catalog:'
         version: 0.5.20(tailwindcss@4.3.1)
+      '@tanstack/query-core':
+        specifier: 'catalog:'
+        version: 5.101.0
       '@tanstack/react-form':
         specifier: 'catalog:'
         version: 1.33.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -1189,6 +1201,12 @@ importers:
       jotai:
         specifier: 'catalog:'
         version: 2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7)
+      jotai-scope:
+        specifier: 'catalog:'
+        version: 0.11.0(jotai@2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7))(react@19.2.7)
+      jotai-tanstack-query:
+        specifier: 'catalog:'
+        version: 0.11.0(@tanstack/query-core@5.101.0)(@tanstack/react-query@5.101.0(react@19.2.7))(jotai@2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7))(react@19.2.7)
       js-audio-recorder:
         specifier: 'catalog:'
         version: 1.0.7
@@ -1811,8 +1829,8 @@ packages:
     resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
     engines: {node: '>=6.9.0'}
 
-  '@base-ui/react@1.5.0':
-    resolution: {integrity: sha512-z1gSAlced1yY+iM+mHDEtIkD8UI3Ebs52MuBPxvV6f5hRutk+xvCH/wuB7hDqDzK9JG5FoMz5nhrqtSs1wjt1A==}
+  '@base-ui/react@1.6.0':
+    resolution: {integrity: sha512-/jzjTWJYXhRFO45Bev9lc3cHbmjzCMpUqbMZ2AgKy/z25mY9B6shGSNcXcjQar9n5doM0KYW1W8fcFv2jZBuMw==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       '@date-fns/tz': ^1.2.0
@@ -1828,8 +1846,8 @@ packages:
       date-fns:
         optional: true
 
-  '@base-ui/utils@0.2.9':
-    resolution: {integrity: sha512-x/PDDCYzoqPpjrdyb3VcyylTI2IjUXEtYDGi5foh7KsnmNJIIaVwA2GLgDH1dps1GgXiJbA60hM+AyuTfQzIvw==}
+  '@base-ui/utils@0.3.1':
+    resolution: {integrity: sha512-gFFiltORVmW/N6IILTGxizP3PBpVpysqML1ALY5Vk0mH+7faVkCknOU31goYHN5Aoek2dkjxva1XOD2Ce9WuIg==}
     peerDependencies:
       '@types/react': ^17 || ^18 || ^19
       react: ^17 || ^18 || ^19
@@ -7198,6 +7216,26 @@ packages:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
+  jotai-scope@0.11.0:
+    resolution: {integrity: sha512-ofiW0Z0i3lTw509Gx0+T6fqsDPMDxMn+AHmNs9iF9OA8CmK1/0xRprPxuZ89UZdBzt6jcrTYdunNZSF2255zJQ==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      jotai: '>=2.20.0'
+      react: '>=16.0.0'
+
+  jotai-tanstack-query@0.11.0:
+    resolution: {integrity: sha512-Ys0u0IuuS6/okUJOulFTdCVfVaeKbm1+lKVSN9zHhIxtrAXl9FM4yu7fNvxM6fSz/NCE9tZOKR0MQ3hvplaH8A==}
+    peerDependencies:
+      '@tanstack/query-core': '*'
+      '@tanstack/react-query': '*'
+      jotai: '>=2.0.0'
+      react: ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@tanstack/react-query':
+        optional: true
+      react:
+        optional: true
+
   jotai@2.20.1:
     resolution: {integrity: sha512-dnuKfU/GLi8B28RRMjQ3AfoN7kfzP8o41+AX2FmITZqEMY8PHnjABq+VkEooomLwYaGjda+pgy0yFSjaHX/ZPg==}
     engines: {node: '>=12.20.0'}
@@ -10138,10 +10176,10 @@ snapshots:
       '@babel/helper-string-parser': 7.29.7
       '@babel/helper-validator-identifier': 7.29.7
 
-  '@base-ui/react@1.5.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@base-ui/react@1.6.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.29.2
-      '@base-ui/utils': 0.2.9(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@base-ui/utils': 0.3.1(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@floating-ui/react-dom': 2.1.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@floating-ui/utils': 0.2.11
       react: 19.2.7
@@ -10150,7 +10188,7 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@base-ui/utils@0.2.9(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@base-ui/utils@0.3.1(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.29.2
       '@floating-ui/utils': 0.2.11
@@ -16182,6 +16220,19 @@ snapshots:
 
   jiti@2.7.0: {}
 
+  jotai-scope@0.11.0(jotai@2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7))(react@19.2.7):
+    dependencies:
+      jotai: 2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+
+  jotai-tanstack-query@0.11.0(@tanstack/query-core@5.101.0)(@tanstack/react-query@5.101.0(react@19.2.7))(jotai@2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7))(react@19.2.7):
+    dependencies:
+      '@tanstack/query-core': 5.101.0
+      jotai: 2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7)
+    optionalDependencies:
+      '@tanstack/react-query': 5.101.0(react@19.2.7)
+      react: 19.2.7
+
   jotai@2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7):
     optionalDependencies:
       '@babel/core': 7.29.7
@@ -19270,7 +19321,7 @@ time:
   '@amplitude/analytics-browser@2.44.1': '2026-06-11T23:28:53.586Z'
   '@amplitude/plugin-session-replay-browser@1.32.1': '2026-06-13T00:09:40.086Z'
   '@antfu/eslint-config@9.0.0': '2026-05-11T06:18:58.474Z'
-  '@base-ui/react@1.5.0': '2026-05-19T13:22:48.843Z'
+  '@base-ui/react@1.6.0': '2026-06-18T12:04:15.326Z'
   '@chromatic-com/storybook@5.2.1': '2026-05-14T07:49:29.364Z'
   '@cucumber/cucumber@13.0.0': '2026-06-02T07:10:03.122Z'
   '@egoist/tailwindcss-icons@1.9.2': '2026-01-31T10:48:44.594Z'
@@ -19321,6 +19372,7 @@ time:
   '@tailwindcss/typography@0.5.20': '2026-06-08T10:34:41.124Z'
   '@tailwindcss/vite@4.3.1': '2026-06-12T17:59:45.667Z'
   '@tanstack/eslint-plugin-query@5.101.0': '2026-06-02T19:24:31.866Z'
+  '@tanstack/query-core@5.101.0': '2026-06-02T19:24:32.202Z'
   '@tanstack/react-form@1.33.0': '2026-05-28T17:05:42.660Z'
   '@tanstack/react-hotkeys@0.10.0': '2026-04-25T12:28:06.989Z'
   '@tanstack/react-query@5.101.0': '2026-06-02T19:24:39.383Z'
@@ -19397,6 +19449,8 @@ time:
   i18next@26.3.1: '2026-06-03T14:14:17.016Z'
   iconify-import-svg@0.2.0: '2026-04-20T06:18:25.132Z'
   immer@11.1.8: '2026-05-08T15:09:33.021Z'
+  jotai-scope@0.11.0: '2026-05-13T18:43:15.331Z'
+  jotai-tanstack-query@0.11.0: '2025-08-01T02:55:49.826Z'
   jotai@2.20.1: '2026-06-11T06:30:45.782Z'
   js-audio-recorder@1.0.7: '2021-01-09T10:20:49.923Z'
   js-cookie@3.0.8: '2026-05-29T10:51:39.065Z'
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 313f2102ebf..0971ce8a1f5 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -54,7 +54,7 @@ catalog:
   '@amplitude/analytics-browser': 2.44.1
   '@amplitude/plugin-session-replay-browser': 1.32.1
   '@antfu/eslint-config': 9.0.0
-  '@base-ui/react': 1.5.0
+  '@base-ui/react': 1.6.0
   '@chromatic-com/storybook': 5.2.1
   '@cucumber/cucumber': 13.0.0
   '@egoist/tailwindcss-icons': 1.9.2
@@ -106,6 +106,7 @@ catalog:
   '@tailwindcss/typography': 0.5.20
   '@tailwindcss/vite': 4.3.1
   '@tanstack/eslint-plugin-query': 5.101.0
+  '@tanstack/query-core': 5.101.0
   '@tanstack/react-form': 1.33.0
   '@tanstack/react-hotkeys': 0.10.0
   '@tanstack/react-query': 5.101.0
@@ -181,6 +182,8 @@ catalog:
   iconify-import-svg: 0.2.0
   immer: 11.1.8
   jotai: 2.20.1
+  jotai-scope: 0.11.0
+  jotai-tanstack-query: 0.11.0
   js-audio-recorder: 1.0.7
   js-cookie: 3.0.8
   js-yaml: 4.2.0
diff --git a/web/.env.example b/web/.env.example
index 762db54dafa..112232e529c 100644
--- a/web/.env.example
+++ b/web/.env.example
@@ -90,6 +90,9 @@ NEXT_PUBLIC_ENABLE_SINGLE_DOLLAR_LATEX=false
 # /refine slash commands in the "Go to Anything" command palette)
 NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW=false
 
+# Enable Agent v2 frontend entry points.
+NEXT_PUBLIC_ENABLE_AGENT_V2=false
+
 # The maximum number of tree node depth for workflow
 NEXT_PUBLIC_MAX_TREE_DEPTH=50
 
diff --git a/web/AGENTS.md b/web/AGENTS.md
index 21def787b9e..2281cfab4bf 100644
--- a/web/AGENTS.md
+++ b/web/AGENTS.md
@@ -33,11 +33,20 @@
 - Use local component state for state owned by one component.
 - Use feature-level Jotai atoms for simple client state shared across components in the same feature, especially when components need a shared source of truth, derived values, or shared actions.
 - Use existing feature stores for complex or high-frequency interaction state such as workflow canvas, drag, resize, and panel runtime state.
-- Use `foxact/use-local-storage` only for low-frequency, client-only persistence such as user preferences, dismissed notices, and UI defaults. Do not use localStorage as the live source of truth for app state.
+- For shared low-frequency, client-only persistence such as user preferences, dismissed notices, and UI defaults, use feature-owned storage modules built with `createLocalStorageState`.
 - For high-frequency interactions, update the feature state during interaction and persist storage only on commit or settled updates.
-- Do not access `localStorage`, `window.localStorage`, or `globalThis.localStorage` directly in app code; use the storage hook boundary and preserve existing raw/custom storage formats.
+- Keep storage keys and raw/custom formats in the owner module; callers should import the named storage hooks instead of scattering direct storage access.
 - Do not add ad hoc global event listeners for shared state. Prefer atoms, existing stores, or a shared subscription hook so listeners are centralized and deduplicated.
 
+## Agent V2 Frontend
+
+- Keep Agent V2 separate from legacy workflow Agent. Use `web/features/agent-v2`, `web/app/components/workflow/nodes/agent-v2`, the `agent_node_kind: 'dify_agent'` and `version: '2'` payload discriminator, and `BlockEnum.AgentV2` where the graph type is already migrated. Do not bridge Agent V2 to legacy `agent_strategy_*` behavior or data shapes.
+- Use generated contracts and `consoleQuery` / `consoleClient` from `@/service/client` for Agent V2 backend calls. Do not add handwritten REST helpers, handwritten API types, mock-backed app state, or direct edits to generated contract files.
+- Treat TanStack Query as the server source of truth. Scope editable drafts with an instance-level `AgentComposerProvider`, hydrate Jotai `originalDraft`, `publishedDraft`, and `draft` from contract data, and compute dirty or unpublished state from those draft snapshots.
+- Keep transitional defaults and mock data at the owning surface, such as the configure page or workflow node, not in shared composer defaults.
+- Use `@langgenius/dify-ui/*` primitives and primitive data/CSS selectors first. Add call-site Tailwind only for real design deltas, avoid arbitrary values when token utilities exist, and keep focus rings visible without making inert layout regions focusable.
+- Keep Agent V2 copy in the `agentV2` i18n namespace, currently backed by `agent-v-2.json` in the maintained locale set.
+
 ## Automated Test Generation
 
 - Use `./docs/test.md` as the canonical instruction set for generating frontend automated tests.
diff --git a/web/__tests__/app-sidebar/dataset-info-flow.test.tsx b/web/__tests__/app-sidebar/dataset-info-flow.test.tsx
index 3093b2809dc..bff6f5a29c5 100644
--- a/web/__tests__/app-sidebar/dataset-info-flow.test.tsx
+++ b/web/__tests__/app-sidebar/dataset-info-flow.test.tsx
@@ -4,6 +4,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import DatasetInfo from '@/app/components/app-sidebar/dataset-info'
 import { ChunkingMode, DatasetPermission, DataSourceType } from '@/models/datasets'
 import { RETRIEVE_METHOD } from '@/types/app'
+import { DatasetACLPermission } from '@/utils/permission'
 
 const mockReplace = vi.fn()
 const mockInvalidDatasetList = vi.fn()
@@ -33,11 +34,6 @@ vi.mock('@/context/dataset-detail', () => ({
   }),
 }))
 
-vi.mock('@/context/app-context', () => ({
-  useSelector: (selector: (state: { isCurrentWorkspaceDatasetOperator: boolean }) => unknown) =>
-    selector({ isCurrentWorkspaceDatasetOperator: false }),
-}))
-
 vi.mock('@/hooks/use-knowledge', () => ({
   useKnowledge: () => ({
     formatIndexingTechniqueAndMethod: () => 'indexing-technique',
@@ -153,6 +149,11 @@ const createDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
   enable_api: false,
   is_multimodal: false,
   is_published: true,
+  permission_keys: [
+    DatasetACLPermission.Edit,
+    DatasetACLPermission.Delete,
+    DatasetACLPermission.ImportExportDSL,
+  ],
   ...overrides,
 })
 
diff --git a/web/__tests__/app-sidebar/sidebar-shell-flow.test.tsx b/web/__tests__/app-sidebar/sidebar-shell-flow.test.tsx
index 0e51c650b21..c1f3a1c62d4 100644
--- a/web/__tests__/app-sidebar/sidebar-shell-flow.test.tsx
+++ b/web/__tests__/app-sidebar/sidebar-shell-flow.test.tsx
@@ -4,9 +4,9 @@ import * as React from 'react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import AppDetailNav from '@/app/components/app-sidebar'
 
-const mockSetAppSidebarExpand = vi.fn()
+const mockSetDetailSidebarMode = vi.fn()
 
-let mockAppSidebarExpand = 'expand'
+let mockDetailSidebarMode = 'expand'
 let mockPathname = '/app/app-1/logs'
 let mockSelectedSegment = 'logs'
 let mockIsHovering = true
@@ -18,24 +18,8 @@ vi.mock('react-i18next', () => ({
   }),
 }))
 
-vi.mock('@/app/components/app/store', () => ({
-  useStore: (selector: (state: Record<string, unknown>) => unknown) => selector({
-    appDetail: {
-      id: 'app-1',
-      name: 'Demo App',
-      mode: 'chat',
-      icon: '🤖',
-      icon_type: 'emoji',
-      icon_background: '#FFEAD5',
-      icon_url: null,
-    },
-    appSidebarExpand: mockAppSidebarExpand,
-    setAppSidebarExpand: mockSetAppSidebarExpand,
-  }),
-}))
-
-vi.mock('zustand/react/shallow', () => ({
-  useShallow: (selector: unknown) => selector,
+vi.mock('@/app/components/main-nav/storage', () => ({
+  useDetailSidebarMode: () => [mockDetailSidebarMode, mockSetDetailSidebarMode],
 }))
 
 vi.mock('@/next/navigation', () => ({
@@ -129,7 +113,7 @@ describe('App Sidebar Shell Flow', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     localStorage.clear()
-    mockAppSidebarExpand = 'expand'
+    mockDetailSidebarMode = 'expand'
     mockPathname = '/app/app-1/logs'
     mockSelectedSegment = 'logs'
     mockIsHovering = true
@@ -145,13 +129,13 @@ describe('App Sidebar Shell Flow', () => {
     expect(logsLink.className).toContain('bg-components-menu-item-bg-active')
 
     fireEvent.click(screen.getByRole('button'))
-    expect(mockSetAppSidebarExpand).toHaveBeenCalledWith('collapse')
+    expect(mockSetDetailSidebarMode).toHaveBeenCalledWith('collapse')
 
     const preventDefault = vi.fn()
     hotkeyHandler?.({ preventDefault })
 
     expect(preventDefault).toHaveBeenCalled()
-    expect(mockSetAppSidebarExpand).toHaveBeenCalledWith('collapse')
+    expect(mockSetDetailSidebarMode).toHaveBeenCalledWith('collapse')
   })
 
   it('keeps the normal sidebar on workflow routes', () => {
diff --git a/web/__tests__/app/app-access-control-flow.test.tsx b/web/__tests__/app/app-access-control-flow.test.tsx
index e1284bfc5b5..3ab3587f258 100644
--- a/web/__tests__/app/app-access-control-flow.test.tsx
+++ b/web/__tests__/app/app-access-control-flow.test.tsx
@@ -1,7 +1,7 @@
 import { fireEvent, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
-import AppPublisher from '@/app/components/app/app-publisher'
+import { AppPublisher } from '@/app/components/app/app-publisher'
 import { AccessMode } from '@/models/access-control'
 import { AppModeEnum } from '@/types/app'
 
@@ -56,7 +56,7 @@ vi.mock('@/hooks/use-async-window-open', () => ({
   useAsyncWindowOpen: () => vi.fn(),
 }))
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useGetUserCanAccessApp: () => ({
     data: { result: true },
     isLoading: false,
@@ -89,7 +89,7 @@ vi.mock('@/app/components/workflow/collaboration/core/collaboration-manager', ()
 }))
 
 vi.mock('@/app/components/app/app-access-control', () => ({
-  default: ({
+  AccessControl: ({
     onConfirm,
     onClose,
   }: {
@@ -127,7 +127,8 @@ describe('App Access Control Flow', () => {
   })
 
   it('refreshes app detail after confirming access control updates', async () => {
-    renderWithQueryClient(<AppPublisher publishedAt={1700000000} />)
+    const { queryClient } = renderWithQueryClient(<AppPublisher publishedAt={1700000000} />)
+    const invalidateQueriesSpy = vi.spyOn(queryClient, 'invalidateQueries').mockResolvedValue()
 
     fireEvent.click(screen.getByRole('button', { name: 'workflow.common.publish' }))
     fireEvent.click(screen.getByText('app.accessControlDialog.accessItems.specific'))
@@ -137,11 +138,7 @@ describe('App Access Control Flow', () => {
     fireEvent.click(screen.getByRole('button', { name: 'confirm-access-control' }))
 
     await waitFor(() => {
-      expect(mockFetchAppDetailDirect).toHaveBeenCalledWith({ url: '/apps', id: 'app-1' })
-      expect(mockSetAppDetail).toHaveBeenCalledWith(expect.objectContaining({
-        id: 'app-1',
-        access_mode: AccessMode.PUBLIC,
-      }))
+      expect(invalidateQueriesSpy).toHaveBeenCalledWith({ queryKey: ['apps', 'detail', 'app-1'] })
     })
 
     await waitFor(() => {
diff --git a/web/__tests__/app/app-publisher-flow.test.tsx b/web/__tests__/app/app-publisher-flow.test.tsx
index d598051f72c..37019fba17e 100644
--- a/web/__tests__/app/app-publisher-flow.test.tsx
+++ b/web/__tests__/app/app-publisher-flow.test.tsx
@@ -1,12 +1,11 @@
 import { fireEvent, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
-import AppPublisher from '@/app/components/app/app-publisher'
+import { AppPublisher } from '@/app/components/app/app-publisher'
 import { AccessMode } from '@/models/access-control'
 import { AppModeEnum } from '@/types/app'
 
 const mockTrackEvent = vi.fn()
-const mockRefetch = vi.fn()
 const mockFetchInstalledAppList = vi.fn()
 const mockFetchAppDetailDirect = vi.fn()
 const mockToastError = vi.fn()
@@ -60,11 +59,10 @@ vi.mock('@/hooks/use-async-window-open', () => ({
   useAsyncWindowOpen: () => mockOpenAsyncWindow,
 }))
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useGetUserCanAccessApp: () => ({
     data: { result: true },
     isLoading: false,
-    refetch: mockRefetch,
   }),
   useAppWhiteListSubjects: () => ({
     data: { groups: [], members: [] },
@@ -115,7 +113,7 @@ vi.mock('@/app/components/workflow/collaboration/core/collaboration-manager', ()
 }))
 
 vi.mock('@/app/components/app/app-access-control', () => ({
-  default: () => <div data-testid="app-access-control" />,
+  AccessControl: () => <div data-testid="app-access-control" />,
 }))
 
 vi.mock('@langgenius/dify-ui/popover', () => import('@/__mocks__/base-ui-popover'))
@@ -182,8 +180,6 @@ describe('App Publisher Flow', () => {
         app_name: 'Demo App',
       }))
     })
-
-    expect(mockRefetch).toHaveBeenCalled()
   })
 
   it('opens embedded modal and resolves the installed explore target', async () => {
diff --git a/web/__tests__/apps/app-card-operations-flow.test.tsx b/web/__tests__/apps/app-card-operations-flow.test.tsx
index 5702755a5c8..1c8624ddde9 100644
--- a/web/__tests__/apps/app-card-operations-flow.test.tsx
+++ b/web/__tests__/apps/app-card-operations-flow.test.tsx
@@ -13,10 +13,11 @@ import type { App } from '@/types/app'
 import { fireEvent, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
-import AppCard from '@/app/components/apps/app-card'
+import { AppCard } from '@/app/components/apps/app-card'
 import { AccessMode } from '@/models/access-control'
 import { exportAppConfig, updateAppInfo } from '@/service/apps'
 import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 
 let mockIsCurrentWorkspaceEditor = true
 let mockSystemFeatures = {
@@ -64,10 +65,10 @@ vi.mock('@tanstack/react-query', async (importOriginal) => {
 })
 
 vi.mock('@/next/dynamic', () => ({
-  default: (loader: () => Promise<{ default: React.ComponentType }>) => {
+  default: (loader: () => Promise<React.ComponentType | { default: React.ComponentType }>) => {
     let Component: React.ComponentType<Record<string, unknown>> | null = null
     loader().then((mod) => {
-      Component = mod.default as React.ComponentType<Record<string, unknown>>
+      Component = (typeof mod === 'function' ? mod : mod.default) as React.ComponentType<Record<string, unknown>>
     }).catch(() => {})
     const Wrapper = (props: Record<string, unknown>) => {
       if (Component)
@@ -82,6 +83,17 @@ vi.mock('@/next/dynamic', () => ({
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor,
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: mockIsCurrentWorkspaceEditor ? ['app.create_and_management'] : [],
+  }),
+  useSelector: <T,>(selector: (state: {
+    isCurrentWorkspaceEditor: boolean
+    userProfile: { id: string }
+    workspacePermissionKeys: string[]
+  }) => T): T => selector({
+    isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor,
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: mockIsCurrentWorkspaceEditor ? ['app.create_and_management'] : [],
   }),
 }))
 
@@ -121,7 +133,7 @@ vi.mock('@/service/workflow', () => ({
   fetchWorkflowDraft: vi.fn().mockResolvedValue({ environment_variables: [] }),
 }))
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useGetUserCanAccessApp: () => ({ data: { result: true }, isLoading: false }),
 }))
 
@@ -201,7 +213,7 @@ vi.mock('@/app/components/workflow/dsl-export-confirm-modal', () => ({
 }))
 
 vi.mock('@/app/components/app/app-access-control', () => ({
-  default: ({ onConfirm, onClose }: Record<string, unknown>) => (
+  AccessControl: ({ onConfirm, onClose }: Record<string, unknown>) => (
     <div data-testid="access-control-modal">
       <button data-testid="confirm-access" onClick={onConfirm as () => void}>Confirm</button>
       <button data-testid="cancel-access" onClick={onClose as () => void}>Cancel</button>
@@ -234,6 +246,14 @@ const createMockApp = (overrides: Partial<App> = {}): App => ({
   tags: overrides.tags ?? [],
   access_mode: overrides.access_mode ?? AccessMode.PUBLIC,
   max_active_requests: overrides.max_active_requests ?? null,
+  created_by: overrides.created_by ?? 'user-1',
+  permission_keys: overrides.permission_keys ?? [
+    AppACLPermission.Edit,
+    AppACLPermission.ImportExportDSL,
+    AppACLPermission.Delete,
+    AppACLPermission.ReleaseAndVersion,
+    AppACLPermission.AccessConfig,
+  ],
 })
 
 const mockOnRefresh = vi.fn()
@@ -350,12 +370,11 @@ describe('App Card Operations Flow', () => {
 
   // -- Access mode display --
   describe('Access Mode Display', () => {
-    it('should not render operations menu for non-editor users', () => {
+    it('should not render operations menu when user has no app permissions', () => {
       mockIsCurrentWorkspaceEditor = false
-      renderAppCard({ name: 'Readonly App' })
+      renderAppCard({ name: 'Readonly App', created_by: 'another-user', permission_keys: [] })
 
-      expect(screen.queryByText('app.editApp')).not.toBeInTheDocument()
-      expect(screen.queryByText('common.operation.delete')).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'common.operation.more' })).not.toBeInTheDocument()
     })
   })
 
diff --git a/web/__tests__/apps/app-list-browsing-flow.test.tsx b/web/__tests__/apps/app-list-browsing-flow.test.tsx
index 39d9219be66..555702a66f9 100644
--- a/web/__tests__/apps/app-list-browsing-flow.test.tsx
+++ b/web/__tests__/apps/app-list-browsing-flow.test.tsx
@@ -20,6 +20,7 @@ import { AppModeEnum } from '@/types/app'
 let mockIsCurrentWorkspaceEditor = true
 let mockIsCurrentWorkspaceDatasetOperator = false
 let mockIsLoadingCurrentWorkspace = false
+let mockWorkspacePermissionKeys: string[] = ['app.create_and_management']
 
 let mockSystemFeatures = {
   branding: { enabled: false },
@@ -65,6 +66,12 @@ vi.mock('@/context/app-context', () => ({
     isCurrentWorkspaceDatasetOperator: mockIsCurrentWorkspaceDatasetOperator,
     isLoadingCurrentWorkspace: mockIsLoadingCurrentWorkspace,
     userProfile: { id: 'member-1' },
+    isLoadingWorkspacePermissionKeys: mockIsLoadingCurrentWorkspace,
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -215,6 +222,7 @@ describe('App List Browsing Flow', () => {
     mockIsCurrentWorkspaceEditor = true
     mockIsCurrentWorkspaceDatasetOperator = false
     mockIsLoadingCurrentWorkspace = false
+    mockWorkspacePermissionKeys = ['app.create_and_management']
     mockSystemFeatures = {
       branding: { enabled: false },
       webapp_auth: { enabled: false },
@@ -303,8 +311,9 @@ describe('App List Browsing Flow', () => {
       expect(screen.getByRole('button', { name: 'common.operation.create' })).toBeInTheDocument()
     })
 
-    it('should hide the create menu when user is not a workspace editor', () => {
+    it('should hide the create menu when user lacks app creation permission', () => {
       mockIsCurrentWorkspaceEditor = false
+      mockWorkspacePermissionKeys = []
       mockPages = [createPage([
         createMockApp({ name: 'Test App' }),
       ])]
@@ -312,6 +321,9 @@ describe('App List Browsing Flow', () => {
       renderList()
 
       expect(screen.queryByRole('button', { name: 'common.operation.create' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'app.newApp.startFromBlank' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'app.newApp.startFromTemplate' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'app.importDSL' })).not.toBeInTheDocument()
     })
   })
 
@@ -346,8 +358,9 @@ describe('App List Browsing Flow', () => {
       expect(screen.getByText('app.newApp.dropDSLToCreateApp')).toBeInTheDocument()
     })
 
-    it('should hide drag-drop hint for non-editors', () => {
+    it('should hide drag-drop hint without app creation permission', () => {
       mockIsCurrentWorkspaceEditor = false
+      mockWorkspacePermissionKeys = []
       mockPages = [createPage([createMockApp()])]
       renderList()
 
diff --git a/web/__tests__/apps/create-app-flow.test.tsx b/web/__tests__/apps/create-app-flow.test.tsx
index 1fcc22c4d28..237dec91230 100644
--- a/web/__tests__/apps/create-app-flow.test.tsx
+++ b/web/__tests__/apps/create-app-flow.test.tsx
@@ -21,6 +21,7 @@ import { AppModeEnum } from '@/types/app'
 let mockIsCurrentWorkspaceEditor = true
 let mockIsCurrentWorkspaceDatasetOperator = false
 let mockIsLoadingCurrentWorkspace = false
+let mockWorkspacePermissionKeys: string[] = ['app.create_and_management']
 let mockSystemFeatures = {
   branding: { enabled: false },
   webapp_auth: { enabled: false },
@@ -51,6 +52,12 @@ vi.mock('@/context/app-context', () => ({
     isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor,
     isCurrentWorkspaceDatasetOperator: mockIsCurrentWorkspaceDatasetOperator,
     isLoadingCurrentWorkspace: mockIsLoadingCurrentWorkspace,
+    isLoadingWorkspacePermissionKeys: mockIsLoadingCurrentWorkspace,
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -261,6 +268,7 @@ describe('Create App Flow', () => {
     mockIsCurrentWorkspaceEditor = true
     mockIsCurrentWorkspaceDatasetOperator = false
     mockIsLoadingCurrentWorkspace = false
+    mockWorkspacePermissionKeys = ['app.create_and_management']
     mockSystemFeatures = {
       branding: { enabled: false },
       webapp_auth: { enabled: false },
@@ -282,8 +290,9 @@ describe('Create App Flow', () => {
       expect(screen.getByText('app.importDSL')).toBeInTheDocument()
     })
 
-    it('should not render the create menu when user is not an editor', () => {
+    it('should render disabled the create menu when user lacks app creation permission', () => {
       mockIsCurrentWorkspaceEditor = false
+      mockWorkspacePermissionKeys = []
       renderList()
 
       expect(screen.queryByRole('button', { name: 'common.operation.create' })).not.toBeInTheDocument()
diff --git a/web/__tests__/billing/billing-integration.test.tsx b/web/__tests__/billing/billing-integration.test.tsx
index 57f6faddcc7..2fde9b506f4 100644
--- a/web/__tests__/billing/billing-integration.test.tsx
+++ b/web/__tests__/billing/billing-integration.test.tsx
@@ -127,6 +127,11 @@ const setupProviderContext = (planOverrides: PlanOverrides = {}, extra: Record<s
 const setupAppContext = (overrides: Record<string, unknown> = {}) => {
   mockAppCtx = {
     isCurrentWorkspaceManager: true,
+    workspacePermissionKeys: [
+      'billing.view',
+      'billing.manage',
+      'billing.subscription.manage',
+    ],
     userProfile: { email: 'test@example.com' },
     langGeniusVersionInfo: { current_version: '1.0.0' },
     ...overrides,
@@ -228,9 +233,12 @@ describe('Billing Page + Plan Integration', () => {
 
   // Verify billing URL button visibility and behavior
   describe('Billing URL button', () => {
-    it('should show billing button when enableBilling and isCurrentWorkspaceManager', () => {
+    it('should show billing button when subscription management permission is granted', () => {
       setupProviderContext({ type: Plan.sandbox })
-      setupAppContext({ isCurrentWorkspaceManager: true })
+      setupAppContext({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.subscription.manage'],
+      })
 
       render(<Billing />)
 
@@ -238,9 +246,12 @@ describe('Billing Page + Plan Integration', () => {
       expect(screen.getByText(/viewBillingAction/i)).toBeInTheDocument()
     })
 
-    it('should hide billing button when user is not workspace manager', () => {
+    it('should hide billing button when subscription management permission is missing', () => {
       setupProviderContext({ type: Plan.sandbox })
-      setupAppContext({ isCurrentWorkspaceManager: false })
+      setupAppContext({
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: ['billing.view', 'billing.manage'],
+      })
 
       render(<Billing />)
 
@@ -254,6 +265,17 @@ describe('Billing Page + Plan Integration', () => {
 
       expect(screen.queryByText(/viewBillingTitle/i)).not.toBeInTheDocument()
     })
+
+    it('should hide billing button when no billing permissions are granted', () => {
+      setupProviderContext({ type: Plan.sandbox })
+      setupAppContext({
+        workspacePermissionKeys: [],
+      })
+
+      render(<Billing />)
+
+      expect(screen.queryByText(/viewBillingTitle/i)).not.toBeInTheDocument()
+    })
   })
 })
 
diff --git a/web/__tests__/billing/cloud-plan-payment-flow.test.tsx b/web/__tests__/billing/cloud-plan-payment-flow.test.tsx
index 7682de5f884..5a80f8cd456 100644
--- a/web/__tests__/billing/cloud-plan-payment-flow.test.tsx
+++ b/web/__tests__/billing/cloud-plan-payment-flow.test.tsx
@@ -60,6 +60,11 @@ vi.mock('@/next/navigation', () => ({
 const setupAppContext = (overrides: Record<string, unknown> = {}) => {
   mockAppCtx = {
     isCurrentWorkspaceManager: true,
+    workspacePermissionKeys: [
+      'billing.view',
+      'billing.manage',
+      'billing.subscription.manage',
+    ],
     ...overrides,
   }
 }
@@ -276,8 +281,27 @@ describe('Cloud Plan Payment Flow', () => {
 
   // ─── 5. Permission Check ────────────────────────────────────────────────
   describe('Permission check', () => {
-    it('should show error toast when non-manager clicks upgrade button', async () => {
-      setupAppContext({ isCurrentWorkspaceManager: false })
+    it('should change plans when billing manage permission is granted without manager role', async () => {
+      setupAppContext({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.manage'],
+      })
+      const user = userEvent.setup()
+      renderCloudPlanItem({ currentPlan: Plan.sandbox, plan: Plan.professional })
+
+      const button = getPlanButton('billing.plansCommon.startBuilding')
+      await user.click(button)
+
+      await waitFor(() => {
+        expect(mockFetchSubscriptionUrls).toHaveBeenCalledWith(Plan.professional, 'month')
+      })
+    })
+
+    it('should show error toast when billing manage permission is missing for plan changes', async () => {
+      setupAppContext({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.view', 'billing.subscription.manage'],
+      })
       const user = userEvent.setup()
       renderCloudPlanItem({ currentPlan: Plan.sandbox, plan: Plan.professional })
 
@@ -287,8 +311,41 @@ describe('Cloud Plan Payment Flow', () => {
       await waitFor(() => {
         expect(screen.getByText('billing.buyPermissionDeniedTip')).toBeInTheDocument()
       })
-      // Should not proceed with payment
       expect(mockFetchSubscriptionUrls).not.toHaveBeenCalled()
     })
+
+    it('should open billing portal when subscription management permission is granted without manager role', async () => {
+      setupAppContext({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.subscription.manage'],
+      })
+      const user = userEvent.setup()
+      renderCloudPlanItem({ currentPlan: Plan.professional, plan: Plan.professional })
+
+      const button = getPlanButton('billing.plansCommon.currentPlan')
+      await user.click(button)
+
+      await waitFor(() => {
+        expect(mockOpenAsyncWindow).toHaveBeenCalled()
+      })
+      expect(mockFetchSubscriptionUrls).not.toHaveBeenCalled()
+    })
+
+    it('should show error toast when subscription management permission is missing for current paid plan', async () => {
+      setupAppContext({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.view', 'billing.manage'],
+      })
+      const user = userEvent.setup()
+      renderCloudPlanItem({ currentPlan: Plan.professional, plan: Plan.professional })
+
+      const button = getPlanButton('billing.plansCommon.currentPlan')
+      await user.click(button)
+
+      await waitFor(() => {
+        expect(screen.getByText('billing.buyPermissionDeniedTip')).toBeInTheDocument()
+      })
+      expect(mockOpenAsyncWindow).not.toHaveBeenCalled()
+    })
   })
 })
diff --git a/web/__tests__/billing/education-verification-flow.test.tsx b/web/__tests__/billing/education-verification-flow.test.tsx
index 6098d446348..1b010964ce2 100644
--- a/web/__tests__/billing/education-verification-flow.test.tsx
+++ b/web/__tests__/billing/education-verification-flow.test.tsx
@@ -85,8 +85,8 @@ vi.mock('@/hooks/use-async-window-open', () => ({
   useAsyncWindowOpen: () => vi.fn(),
 }))
 
-vi.mock('foxact/use-local-storage', () => ({
-  useSetLocalStorage: () => mockSetEducationVerifying,
+vi.mock('@/app/education-apply/storage', () => ({
+  useSetEducationVerifying: () => mockSetEducationVerifying,
 }))
 
 // ─── External component mocks ───────────────────────────────────────────────
@@ -143,6 +143,11 @@ const setupContexts = (
   }
   mockAppCtx = {
     isCurrentWorkspaceManager: true,
+    workspacePermissionKeys: [
+      'billing.view',
+      'billing.manage',
+      'billing.subscription.manage',
+    ],
     userProfile: { email: 'student@university.edu' },
     langGeniusVersionInfo: { current_version: '1.0.0' },
     ...appOverrides,
diff --git a/web/__tests__/billing/pricing-modal-flow.test.tsx b/web/__tests__/billing/pricing-modal-flow.test.tsx
index 2ec72986181..c06f56772d0 100644
--- a/web/__tests__/billing/pricing-modal-flow.test.tsx
+++ b/web/__tests__/billing/pricing-modal-flow.test.tsx
@@ -112,6 +112,11 @@ const setupContexts = (planOverrides: Record<string, unknown> = {}, appOverrides
   }
   mockAppCtx = {
     isCurrentWorkspaceManager: true,
+    workspacePermissionKeys: [
+      'billing.view',
+      'billing.manage',
+      'billing.subscription.manage',
+    ],
     userProfile: { email: 'test@example.com' },
     langGeniusVersionInfo: { current_version: '1.0.0' },
     ...appOverrides,
diff --git a/web/__tests__/billing/self-hosted-plan-flow.test.tsx b/web/__tests__/billing/self-hosted-plan-flow.test.tsx
index f2b5cd3531c..08a3d0fed54 100644
--- a/web/__tests__/billing/self-hosted-plan-flow.test.tsx
+++ b/web/__tests__/billing/self-hosted-plan-flow.test.tsx
@@ -49,6 +49,7 @@ vi.mock('@/app/components/billing/pricing/plans/self-hosted-plan-item/list', ()
 const setupAppContext = (overrides: Record<string, unknown> = {}) => {
   mockAppCtx = {
     isCurrentWorkspaceManager: true,
+    workspacePermissionKeys: ['billing.manage'],
     ...overrides,
   }
 }
@@ -179,8 +180,22 @@ describe('Self-Hosted Plan Flow', () => {
 
   // ─── 3. Permission Check ────────────────────────────────────────────────
   describe('Permission check', () => {
-    it('should show error toast when non-manager clicks community button', async () => {
-      setupAppContext({ isCurrentWorkspaceManager: false })
+    it('should redirect when billing manage permission is granted without manager role', async () => {
+      setupAppContext({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.manage'],
+      })
+      const user = userEvent.setup()
+      renderSelfHostedPlanItem(SelfHostedPlan.community)
+
+      const button = screen.getByRole('button')
+      await user.click(button)
+
+      expect(assignedHref).toBe(getStartedWithCommunityUrl)
+    })
+
+    it('should show error toast when billing manage permission is missing for community button', async () => {
+      setupAppContext({ workspacePermissionKeys: [] })
       const user = userEvent.setup()
       renderSelfHostedPlanItem(SelfHostedPlan.community)
 
@@ -194,8 +209,8 @@ describe('Self-Hosted Plan Flow', () => {
       expect(assignedHref).toBe('')
     })
 
-    it('should show error toast when non-manager clicks premium button', async () => {
-      setupAppContext({ isCurrentWorkspaceManager: false })
+    it('should show error toast when billing manage permission is missing for premium button', async () => {
+      setupAppContext({ workspacePermissionKeys: [] })
       const user = userEvent.setup()
       renderSelfHostedPlanItem(SelfHostedPlan.premium)
 
@@ -208,8 +223,8 @@ describe('Self-Hosted Plan Flow', () => {
       expect(assignedHref).toBe('')
     })
 
-    it('should show error toast when non-manager clicks enterprise button', async () => {
-      setupAppContext({ isCurrentWorkspaceManager: false })
+    it('should show error toast when billing manage permission is missing for enterprise button', async () => {
+      setupAppContext({ workspacePermissionKeys: [] })
       const user = userEvent.setup()
       renderSelfHostedPlanItem(SelfHostedPlan.enterprise)
 
diff --git a/web/__tests__/custom/custom-page-flow.test.tsx b/web/__tests__/custom/custom-page-flow.test.tsx
index 66158ec5062..5650f0893c5 100644
--- a/web/__tests__/custom/custom-page-flow.test.tsx
+++ b/web/__tests__/custom/custom-page-flow.test.tsx
@@ -51,7 +51,7 @@ const createBrandState = (overrides: Partial<ReturnType<typeof useWebAppBrand>>
   webappBrandRemoved: false,
   uploadDisabled: false,
   workspaceLogo: 'https://example.com/workspace-logo.png',
-  isCurrentWorkspaceManager: true,
+  canManageCustomBrand: true,
   isSandbox: false,
   handleApply: vi.fn(),
   handleCancel: vi.fn(),
diff --git a/web/__tests__/datasets/dataset-settings-flow.test.tsx b/web/__tests__/datasets/dataset-settings-flow.test.tsx
index eaafcafe626..1c07128eb67 100644
--- a/web/__tests__/datasets/dataset-settings-flow.test.tsx
+++ b/web/__tests__/datasets/dataset-settings-flow.test.tsx
@@ -16,6 +16,7 @@ import { act, renderHook, waitFor } from '@testing-library/react'
 import { IndexingType } from '@/app/components/datasets/create/step-two'
 import { ChunkingMode, DatasetPermission, DataSourceType, WeightedScoreEnum } from '@/models/datasets'
 import { RETRIEVE_METHOD } from '@/types/app'
+import { DatasetACLPermission } from '@/utils/permission'
 
 // --- Mocks ---
 
@@ -28,7 +29,13 @@ const mockInvalidDatasetList = vi.fn()
 const mockUpdateDatasetSetting = vi.fn().mockResolvedValue({})
 
 vi.mock('@/context/app-context', () => ({
-  useSelector: () => false,
+  useSelector: <T,>(selector: (state: {
+    userProfile: { id: string }
+    workspacePermissionKeys: string[]
+  }) => T): T => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: ['dataset.create_and_management'],
+  }),
 }))
 
 vi.mock('@/service/datasets', () => ({
@@ -128,6 +135,7 @@ const createMockDataset = (overrides?: Partial<DataSet>): DataSet => ({
   runtime_mode: 'general',
   enable_api: true,
   is_multimodal: false,
+  permission_keys: [DatasetACLPermission.Edit],
   ...overrides,
 } as DataSet)
 
diff --git a/web/__tests__/develop/api-key-management-flow.test.tsx b/web/__tests__/develop/api-key-management-flow.test.tsx
index 233e152f8fa..0267fdd45e1 100644
--- a/web/__tests__/develop/api-key-management-flow.test.tsx
+++ b/web/__tests__/develop/api-key-management-flow.test.tsx
@@ -86,13 +86,13 @@ describe('API Key management flow', () => {
 
     expect(screen.getByText('https://api.dify.ai/v1')).toBeInTheDocument()
     expect(screen.getByText('appApi.ok')).toBeInTheDocument()
-    expect(screen.getByText('appApi.apiKey')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'appApi.apiKey' })).toBeDisabled()
   })
 
   it('clicking API Key button opens SecretKeyModal with real modal content', async () => {
     const user = userEvent.setup({ advanceTimers: vi.advanceTimersByTime })
 
-    render(<ApiServer apiBaseUrl="https://api.dify.ai/v1" appId="app-1" />)
+    render(<ApiServer apiBaseUrl="https://api.dify.ai/v1" appId="app-1" canManageApiKey />)
 
     // Click API Key button (rendered by SecretKeyButton)
     await act(async () => {
@@ -112,7 +112,7 @@ describe('API Key management flow', () => {
     const user = userEvent.setup({ advanceTimers: vi.advanceTimersByTime })
     mockIsLoading.mockReturnValue(true)
 
-    render(<ApiServer apiBaseUrl="https://api.dify.ai/v1" appId="app-1" />)
+    render(<ApiServer apiBaseUrl="https://api.dify.ai/v1" appId="app-1" canManageApiKey />)
 
     await act(async () => {
       await user.click(screen.getByText('appApi.apiKey'))
@@ -130,7 +130,7 @@ describe('API Key management flow', () => {
   it('modal can be closed by clicking X icon', async () => {
     const user = userEvent.setup({ advanceTimers: vi.advanceTimersByTime })
 
-    render(<ApiServer apiBaseUrl="https://api.dify.ai/v1" appId="app-1" />)
+    render(<ApiServer apiBaseUrl="https://api.dify.ai/v1" appId="app-1" canManageApiKey />)
 
     // Open modal
     await act(async () => {
@@ -143,7 +143,7 @@ describe('API Key management flow', () => {
     })
 
     // Click X icon to close
-    const closeIcon = document.body.querySelector('svg.cursor-pointer')
+    const closeIcon = document.body.querySelector('.i-heroicons-x-mark-20-solid.cursor-pointer')
     expect(closeIcon).toBeInTheDocument()
 
     await act(async () => {
@@ -161,7 +161,7 @@ describe('API Key management flow', () => {
     const user = userEvent.setup({ advanceTimers: vi.advanceTimersByTime })
 
     const { rerender } = render(
-      <ApiServer apiBaseUrl="http://localhost:5001/v1" appId="app-dev" />,
+      <ApiServer apiBaseUrl="http://localhost:5001/v1" appId="app-dev" canManageApiKey />,
     )
 
     expect(screen.getByText('http://localhost:5001/v1')).toBeInTheDocument()
@@ -177,14 +177,14 @@ describe('API Key management flow', () => {
     })
 
     // Close modal, update URL and re-verify
-    const xIcon = document.body.querySelector('svg.cursor-pointer')
+    const xIcon = document.body.querySelector('.i-heroicons-x-mark-20-solid.cursor-pointer')
     await act(async () => {
       await user.click(xIcon!)
     })
     await flushUI()
 
     rerender(
-      <ApiServer apiBaseUrl="https://api.production.com/v1" appId="app-prod" />,
+      <ApiServer apiBaseUrl="https://api.production.com/v1" appId="app-prod" canManageApiKey />,
     )
 
     expect(screen.getByText('https://api.production.com/v1')).toBeInTheDocument()
diff --git a/web/__tests__/develop/develop-page-flow.test.tsx b/web/__tests__/develop/develop-page-flow.test.tsx
index 703f7362f1f..4c4bcd0f064 100644
--- a/web/__tests__/develop/develop-page-flow.test.tsx
+++ b/web/__tests__/develop/develop-page-flow.test.tsx
@@ -56,6 +56,8 @@ vi.mock('@/context/app-context', () => ({
     isCurrentWorkspaceManager: true,
     isCurrentWorkspaceEditor: true,
   }),
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) =>
+    selector({ userProfile: { id: 'user-1' }, workspacePermissionKeys: ['app.create_and_management'] }),
 }))
 
 vi.mock('@/hooks/use-timestamp', () => ({
@@ -108,6 +110,7 @@ describe('DevelopMain page flow', () => {
       name: 'Test App',
       api_base_url: 'https://api.test.com/v1',
       mode: AppModeEnum.CHAT,
+      permission_keys: ['app.acl.edit'],
     }
 
     render(<DevelopMain appId="app-1" />)
@@ -128,6 +131,7 @@ describe('DevelopMain page flow', () => {
       name: 'Chat App',
       api_base_url: 'https://api.test.com/v1',
       mode: AppModeEnum.CHAT,
+      permission_keys: ['app.acl.edit'],
     }
 
     const { container } = render(<DevelopMain appId="app-1" />)
@@ -150,6 +154,7 @@ describe('DevelopMain page flow', () => {
       name: 'My App',
       api_base_url: 'https://api.example.com/v1',
       mode: AppModeEnum.COMPLETION,
+      permission_keys: ['app.acl.edit'],
     }
     rerender(<DevelopMain appId="app-1" />)
 
@@ -166,6 +171,7 @@ describe('DevelopMain page flow', () => {
       name: 'Test App',
       api_base_url: 'https://api.test.com/v1',
       mode: AppModeEnum.WORKFLOW,
+      permission_keys: ['app.acl.edit'],
     }
 
     render(<DevelopMain appId="app-1" />)
@@ -196,6 +202,7 @@ describe('DevelopMain page flow', () => {
         name: `${mode} App`,
         api_base_url: 'https://api.test.com/v1',
         mode,
+        permission_keys: ['app.acl.edit'],
       }
 
       const { container, unmount } = render(<DevelopMain appId="app-1" />)
@@ -216,6 +223,7 @@ describe('DevelopMain page flow', () => {
       name: 'Test App',
       api_base_url: 'https://api.test.com/v1',
       mode: AppModeEnum.CHAT,
+      permission_keys: ['app.acl.edit'],
     }
 
     render(<DevelopMain appId="app-1" />)
diff --git a/web/__tests__/embedded-user-id-store.test.tsx b/web/__tests__/embedded-user-id-store.test.tsx
index 7e9eec644bc..7adb33b7ffd 100644
--- a/web/__tests__/embedded-user-id-store.test.tsx
+++ b/web/__tests__/embedded-user-id-store.test.tsx
@@ -1,23 +1,25 @@
 import { screen, waitFor } from '@testing-library/react'
 import * as React from 'react'
-import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
+import { renderToString } from 'react-dom/server'
+import { createSystemFeaturesWrapper, renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import WebAppStoreProvider, { useWebAppStore } from '@/context/web-app-context'
 
 import { AccessMode } from '@/models/access-control'
 
-vi.mock('@/next/navigation', () => ({
+const navigationMocks = vi.hoisted(() => ({
   usePathname: vi.fn(() => '/chatbot/sample-app'),
-  useSearchParams: vi.fn(() => {
-    const params = new URLSearchParams()
-    return params
-  }),
+  useSearchParams: vi.fn(() => new URLSearchParams()),
+}))
+
+const useGetWebAppAccessModeByCodeMock = vi.hoisted(() => vi.fn())
+
+vi.mock('@/next/navigation', () => ({
+  usePathname: navigationMocks.usePathname,
+  useSearchParams: navigationMocks.useSearchParams,
 }))
 
 vi.mock('@/service/use-share', () => ({
-  useGetWebAppAccessModeByCode: vi.fn(() => ({
-    isLoading: false,
-    data: { accessMode: AccessMode.PUBLIC },
-  })),
+  useGetWebAppAccessModeByCode: (...args: unknown[]) => useGetWebAppAccessModeByCodeMock(...args),
 }))
 
 const mockGetProcessedSystemVariablesFromUrlParams = vi.fn()
@@ -61,10 +63,50 @@ const initialWebAppStore = (() => {
 
 beforeEach(() => {
   mockGetProcessedSystemVariablesFromUrlParams.mockReset()
+  navigationMocks.usePathname.mockReset()
+  navigationMocks.usePathname.mockReturnValue('/chatbot/sample-app')
+  navigationMocks.useSearchParams.mockReset()
+  navigationMocks.useSearchParams.mockReturnValue(new URLSearchParams())
+  useGetWebAppAccessModeByCodeMock.mockReset()
+  useGetWebAppAccessModeByCodeMock.mockReturnValue({
+    isLoading: false,
+    data: { accessMode: AccessMode.PUBLIC },
+  })
   useWebAppStore.setState(initialWebAppStore, true)
 })
 
 describe('WebAppStoreProvider embedded user id handling', () => {
+  it('parses share code from redirect_url during server render without window', () => {
+    const params = new URLSearchParams()
+    params.set('redirect_url', encodeURIComponent('/chatbot/redirected-app'))
+    navigationMocks.usePathname.mockReturnValue('/webapp-signin')
+    navigationMocks.useSearchParams.mockReturnValue(params)
+    const originalWindow = globalThis.window
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: undefined,
+    })
+    const { wrapper: Wrapper } = createSystemFeaturesWrapper()
+
+    try {
+      expect(() => renderToString(
+        <Wrapper>
+          <WebAppStoreProvider>
+            <div />
+          </WebAppStoreProvider>
+        </Wrapper>,
+      )).not.toThrow()
+    }
+    finally {
+      Object.defineProperty(globalThis, 'window', {
+        configurable: true,
+        value: originalWindow,
+      })
+    }
+
+    expect(useGetWebAppAccessModeByCodeMock).toHaveBeenCalledWith('redirected-app')
+  })
+
   it('hydrates embedded user and conversation ids from system variables', async () => {
     mockGetProcessedSystemVariablesFromUrlParams.mockResolvedValue({
       user_id: 'iframe-user-123',
diff --git a/web/__tests__/env.spec.ts b/web/__tests__/env.spec.ts
new file mode 100644
index 00000000000..89781d32685
--- /dev/null
+++ b/web/__tests__/env.spec.ts
@@ -0,0 +1,42 @@
+describe('env runtime transport', () => {
+  const originalAgentV2Env = process.env.NEXT_PUBLIC_ENABLE_AGENT_V2
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.resetModules()
+    vi.doUnmock('../utils/client')
+    document.body.removeAttribute('data-enable-agent-v2')
+    document.body.removeAttribute('data-enable-agent-v-2')
+    delete process.env.NEXT_PUBLIC_ENABLE_AGENT_V2
+  })
+
+  afterAll(() => {
+    if (originalAgentV2Env === undefined)
+      delete process.env.NEXT_PUBLIC_ENABLE_AGENT_V2
+    else
+      process.env.NEXT_PUBLIC_ENABLE_AGENT_V2 = originalAgentV2Env
+  })
+
+  it('should read NEXT_PUBLIC_ENABLE_AGENT_V2 from the browser runtime dataset key', async () => {
+    document.body.setAttribute('data-enable-agent-v2', 'true')
+
+    const { env } = await import('../env')
+
+    expect(env.NEXT_PUBLIC_ENABLE_AGENT_V2).toBe(true)
+  })
+
+  it('should emit the Agent v2 runtime dataset attribute from getDatasetMap on the server', async () => {
+    process.env.NEXT_PUBLIC_ENABLE_AGENT_V2 = 'true'
+
+    vi.doMock('../utils/client', () => ({
+      isClient: false,
+      isServer: true,
+    }))
+
+    const { getDatasetMap } = await import('../env')
+    const datasetMap = getDatasetMap()
+
+    expect(datasetMap['data-enable-agent-v2']).toBe(true)
+    expect(datasetMap['data-enable-agent-v-2']).toBeUndefined()
+  })
+})
diff --git a/web/__tests__/explore/explore-app-list-flow.test.tsx b/web/__tests__/explore/explore-app-list-flow.test.tsx
index f93353443c2..786fef89486 100644
--- a/web/__tests__/explore/explore-app-list-flow.test.tsx
+++ b/web/__tests__/explore/explore-app-list-flow.test.tsx
@@ -15,6 +15,13 @@ import { fetchAppDetail, fetchAppList, fetchBanners } from '@/service/explore'
 import { useMembers } from '@/service/use-common'
 import { AppModeEnum } from '@/types/app'
 
+type MockAppContext = {
+  userProfile: { id: string }
+  workspacePermissionKeys: string[]
+}
+
+const mockUseAppContext = vi.hoisted(() => vi.fn<() => MockAppContext>())
+
 const allCategoriesEn = 'explore.apps.allCategories:{"lng":"en"}'
 let mockTabValue = allCategoriesEn
 const mockSetTab = vi.fn()
@@ -109,7 +116,8 @@ vi.mock('@/service/client', () => ({
 }))
 
 vi.mock('@/context/app-context', () => ({
-  useAppContext: vi.fn(),
+  useAppContext: mockUseAppContext,
+  useSelector: <T,>(selector: (state: MockAppContext) => T): T => selector(mockUseAppContext()),
 }))
 
 vi.mock('@/service/use-common', () => ({
@@ -188,6 +196,7 @@ const createApp = (overrides: Partial<App> = {}): App => ({
 const mockMemberRole = (hasEditPermission: boolean) => {
   ;(useAppContext as Mock).mockReturnValue({
     userProfile: { id: 'user-1' },
+    workspacePermissionKeys: hasEditPermission ? ['app.create_and_management'] : [],
   })
   ;(useMembers as Mock).mockReturnValue({
     data: {
diff --git a/web/__tests__/explore/installed-app-flow.test.tsx b/web/__tests__/explore/installed-app-flow.test.tsx
index 66d88cdf926..b37e69bce92 100644
--- a/web/__tests__/explore/installed-app-flow.test.tsx
+++ b/web/__tests__/explore/installed-app-flow.test.tsx
@@ -11,7 +11,7 @@ import { render, screen, waitFor } from '@testing-library/react'
 import InstalledApp from '@/app/components/explore/installed-app'
 import { useWebAppStore } from '@/context/web-app-context'
 import { AccessMode } from '@/models/access-control'
-import { useGetUserCanAccessApp } from '@/service/access-control'
+import { useGetUserCanAccessApp } from '@/service/access-control/use-app-access-control'
 import { useGetInstalledAppAccessModeByAppId, useGetInstalledAppMeta, useGetInstalledAppParams, useGetInstalledApps } from '@/service/use-explore'
 import { AppModeEnum } from '@/types/app'
 
@@ -19,7 +19,7 @@ vi.mock('@/context/web-app-context', () => ({
   useWebAppStore: vi.fn(),
 }))
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useGetUserCanAccessApp: vi.fn(),
 }))
 
diff --git a/web/__tests__/header/nav-flow.test.tsx b/web/__tests__/header/nav-flow.test.tsx
index dba7b4bf4af..33927f19da4 100644
--- a/web/__tests__/header/nav-flow.test.tsx
+++ b/web/__tests__/header/nav-flow.test.tsx
@@ -43,6 +43,7 @@ vi.mock('@/app/components/app/store', () => ({
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor,
+    workspacePermissionKeys: mockIsCurrentWorkspaceEditor ? ['app.create_and_management'] : [],
   }),
 }))
 
diff --git a/web/__tests__/plugins/plugin-auth-flow.test.tsx b/web/__tests__/plugins/plugin-auth-flow.test.tsx
index c4d28e3f34b..cc42d5204ba 100644
--- a/web/__tests__/plugins/plugin-auth-flow.test.tsx
+++ b/web/__tests__/plugins/plugin-auth-flow.test.tsx
@@ -90,7 +90,6 @@ describe('Plugin Authentication Flow Integration', () => {
         canOAuth: false,
         canApiKey: true,
         credentials: [],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
@@ -108,7 +107,6 @@ describe('Plugin Authentication Flow Integration', () => {
         canOAuth: true,
         canApiKey: true,
         credentials: [],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
@@ -125,7 +123,6 @@ describe('Plugin Authentication Flow Integration', () => {
         canOAuth: false,
         canApiKey: true,
         credentials: [],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
@@ -147,7 +144,6 @@ describe('Plugin Authentication Flow Integration', () => {
         credentials: [
           { id: 'cred-1', name: 'My API Key', is_default: true },
         ],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
@@ -165,7 +161,6 @@ describe('Plugin Authentication Flow Integration', () => {
         canOAuth: false,
         canApiKey: true,
         credentials: [{ id: 'cred-1', name: 'Key', is_default: true }],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
@@ -187,7 +182,6 @@ describe('Plugin Authentication Flow Integration', () => {
         canOAuth: false,
         canApiKey: true,
         credentials: [{ id: 'cred-1', name: 'Key', is_default: true }],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
@@ -207,7 +201,6 @@ describe('Plugin Authentication Flow Integration', () => {
         canOAuth: false,
         canApiKey: true,
         credentials: [],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
@@ -229,7 +222,6 @@ describe('Plugin Authentication Flow Integration', () => {
         canOAuth: true,
         canApiKey: false,
         credentials: [],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
@@ -258,7 +250,6 @@ describe('Plugin Authentication Flow Integration', () => {
           { id: 'cred-2', name: 'API Key 2', is_default: false },
           { id: 'cred-3', name: 'OAuth Token', is_default: false, credential_type: CredentialTypeEnum.OAUTH2 },
         ],
-        disabled: false,
         invalidPluginCredentialInfo: vi.fn(),
         notAllowCustomCredential: false,
       })
diff --git a/web/__tests__/plugins/plugin-page-shell-flow.test.tsx b/web/__tests__/plugins/plugin-page-shell-flow.test.tsx
index 421d805d072..ac090ec577b 100644
--- a/web/__tests__/plugins/plugin-page-shell-flow.test.tsx
+++ b/web/__tests__/plugins/plugin-page-shell-flow.test.tsx
@@ -34,6 +34,14 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceManager: false,
     isCurrentWorkspaceOwner: false,
+    langGeniusVersionInfo: {
+      current_version: '1.0.0',
+    },
+    workspacePermissionKeys: [
+      'plugin.install',
+      'plugin.manage',
+      'plugin.plugin_preferences',
+    ],
   }),
 }))
 
diff --git a/web/__tests__/tools/provider-list-shell-flow.test.tsx b/web/__tests__/tools/provider-list-shell-flow.test.tsx
index 346834c642c..dcf88dda46e 100644
--- a/web/__tests__/tools/provider-list-shell-flow.test.tsx
+++ b/web/__tests__/tools/provider-list-shell-flow.test.tsx
@@ -20,6 +20,18 @@ vi.mock('@/app/components/plugins/hooks', () => ({
   }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    userProfile: { id: 'user-1', timezone: 'UTC' },
+    workspacePermissionKeys: ['tool.manage', 'mcp.manage', 'plugin.install', 'plugin.manage', 'plugin.plugin_preferences'],
+    langGeniusVersionInfo: { current_version: '1.0.0' },
+  }),
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
+    selector({
+      workspacePermissionKeys: ['tool.manage', 'mcp.manage', 'plugin.install', 'plugin.manage', 'plugin.plugin_preferences'],
+    }),
+}))
+
 vi.mock('@/service/use-tools', () => ({
   useAllToolProviders: () => ({
     data: [
@@ -69,6 +81,8 @@ vi.mock('@/service/use-plugins', () => ({
       : null,
   }),
   useInvalidateInstalledPluginList: () => mockInvalidateInstalledPluginList,
+  useMutationPluginPermissionSettings: () => ({ mutate: vi.fn(), isPending: false }),
+  usePluginPermissionSettings: () => ({ data: undefined, isLoading: false, isFetching: false, error: null }),
 }))
 
 vi.mock('@/app/components/tools/labels/filter', () => ({
@@ -152,6 +166,10 @@ vi.mock('@/app/components/tools/mcp', () => ({
   default: ({ searchText }: { searchText: string }) => <div data-testid="mcp-list">{searchText}</div>,
 }))
 
+vi.mock('@/app/components/header/account-setting/update-setting-dialog', () => ({
+  default: () => null,
+}))
+
 const renderProviderList = (searchParams = '') => {
   const { wrapper: SysWrapper } = createSystemFeaturesWrapper({
     systemFeatures: { enable_marketplace: true },
diff --git a/web/__tests__/tools/tool-browsing-and-filtering.test.tsx b/web/__tests__/tools/tool-browsing-and-filtering.test.tsx
index d470326805e..be00661f710 100644
--- a/web/__tests__/tools/tool-browsing-and-filtering.test.tsx
+++ b/web/__tests__/tools/tool-browsing-and-filtering.test.tsx
@@ -43,9 +43,23 @@ vi.mock('@/app/components/plugins/hooks', () => ({
   }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    userProfile: { id: 'user-1', timezone: 'UTC' },
+    workspacePermissionKeys: ['tool.manage', 'mcp.manage', 'plugin.install', 'plugin.manage', 'plugin.plugin_preferences'],
+    langGeniusVersionInfo: { current_version: '1.0.0' },
+  }),
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
+    selector({
+      workspacePermissionKeys: ['tool.manage', 'mcp.manage', 'plugin.install', 'plugin.manage', 'plugin.plugin_preferences'],
+    }),
+}))
+
 vi.mock('@/service/use-plugins', () => ({
   useCheckInstalled: () => ({ data: null }),
   useInvalidateInstalledPluginList: () => vi.fn(),
+  useMutationPluginPermissionSettings: () => ({ mutate: vi.fn(), isPending: false }),
+  usePluginPermissionSettings: () => ({ data: undefined, isLoading: false, isFetching: false, error: null }),
 }))
 
 const mockCollections: Collection[] = [
@@ -198,6 +212,10 @@ vi.mock('@/app/components/tools/mcp', () => ({
   default: () => <div data-testid="mcp-list">MCP List</div>,
 }))
 
+vi.mock('@/app/components/header/account-setting/update-setting-dialog', () => ({
+  default: () => null,
+}))
+
 vi.mock('@langgenius/dify-ui/cn', () => ({
   cn: (...args: unknown[]) => args.filter(Boolean).join(' '),
 }))
diff --git a/web/__tests__/tools/tool-provider-detail-flow.test.tsx b/web/__tests__/tools/tool-provider-detail-flow.test.tsx
index 7b873601d48..e99e7ac24c2 100644
--- a/web/__tests__/tools/tool-provider-detail-flow.test.tsx
+++ b/web/__tests__/tools/tool-provider-detail-flow.test.tsx
@@ -48,6 +48,9 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceManager: true,
   }),
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: ['tool.manage', 'credential.manage', 'credential.use'],
+  }),
 }))
 
 const mockSetShowModelModal = vi.fn()
diff --git a/web/app/(commonLayout)/__tests__/role-route-guard.spec.tsx b/web/app/(commonLayout)/__tests__/role-route-guard.spec.tsx
index 67b50f94096..8fa969fa899 100644
--- a/web/app/(commonLayout)/__tests__/role-route-guard.spec.tsx
+++ b/web/app/(commonLayout)/__tests__/role-route-guard.spec.tsx
@@ -1,13 +1,16 @@
+import type { ReactNode } from 'react'
 import { useQuery } from '@tanstack/react-query'
-import { render, screen } from '@testing-library/react'
+import { screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import RoleRouteGuard from '../role-route-guard'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
+import { RoleRouteGuard } from '../role-route-guard'
 
 const mocks = vi.hoisted(() => ({
   redirect: vi.fn((url: string) => {
     throw new Error(`NEXT_REDIRECT:${url}`)
   }),
   currentWorkspaceQueryOptions: vi.fn(() => ({ queryKey: ['console', 'workspaces', 'current', 'post'] })),
+  systemFeaturesQueryKey: vi.fn(() => ['console', 'systemFeatures', 'get']),
 }))
 
 let mockPathname = '/apps'
@@ -27,6 +30,11 @@ vi.mock('@tanstack/react-query', async (importOriginal) => {
 
 vi.mock('@/service/client', () => ({
   consoleQuery: {
+    systemFeatures: {
+      get: {
+        queryKey: mocks.systemFeaturesQueryKey,
+      },
+    },
     workspaces: {
       current: {
         post: {
@@ -39,6 +47,19 @@ vi.mock('@/service/client', () => ({
 
 const mockUseQuery = vi.mocked(useQuery)
 
+function renderGuard(children: ReactNode) {
+  return renderWithSystemFeatures(
+    <RoleRouteGuard>
+      {children}
+    </RoleRouteGuard>,
+    {
+      systemFeatures: {
+        enable_app_deploy: true,
+      },
+    },
+  )
+}
+
 const setCurrentWorkspaceQuery = (overrides: { role?: string, isPending?: boolean } = {}) => {
   mockUseQuery.mockReturnValue({
     data: overrides.role,
@@ -49,65 +70,37 @@ const setCurrentWorkspaceQuery = (overrides: { role?: string, isPending?: boolea
 describe('RoleRouteGuard', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockPathname = '/apps'
+    mockPathname = '/app/app-1'
     setCurrentWorkspaceQuery()
   })
 
-  it('should render loading while workspace is loading', () => {
-    setCurrentWorkspaceQuery({ isPending: true })
+  it.each(['/', '/apps', '/app/app-1', '/deployments/create', '/snippets', '/explore/apps', '/tools', '/integrations', '/datasets'])('should allow %s without workspace role checks', (pathname) => {
+    mockPathname = pathname
 
-    render((
-      <RoleRouteGuard>
-        <div>content</div>
-      </RoleRouteGuard>
-    ))
-
-    expect(screen.getByRole('status')).toBeInTheDocument()
-    expect(screen.queryByText('content')).not.toBeInTheDocument()
-    expect(mocks.redirect).not.toHaveBeenCalled()
-    expect(mocks.currentWorkspaceQueryOptions).toHaveBeenCalledWith({
-      select: expect.any(Function),
-    })
-  })
-
-  it('should redirect dataset operator on guarded routes', () => {
-    setCurrentWorkspaceQuery({ role: 'dataset_operator' })
-
-    expect(() => render((
-      <RoleRouteGuard>
-        <div>content</div>
-      </RoleRouteGuard>
-    ))).toThrow('NEXT_REDIRECT:/datasets')
-
-    expect(mocks.redirect).toHaveBeenCalledWith('/datasets')
-  })
-
-  it('should allow dataset operator on non-guarded routes', () => {
-    mockPathname = '/plugins'
-    setCurrentWorkspaceQuery({ role: 'dataset_operator' })
-
-    render((
-      <RoleRouteGuard>
-        <div>content</div>
-      </RoleRouteGuard>
-    ))
+    renderGuard(<div>content</div>)
 
     expect(screen.getByText('content')).toBeInTheDocument()
     expect(mocks.redirect).not.toHaveBeenCalled()
+    expect(mockUseQuery).not.toHaveBeenCalled()
+    expect(mocks.currentWorkspaceQueryOptions).not.toHaveBeenCalled()
   })
 
-  it('should not block non-guarded routes while workspace is loading', () => {
-    mockPathname = '/plugins'
-    setCurrentWorkspaceQuery({ isPending: true })
+  it('should redirect deployments route when app deploy is disabled', () => {
+    mockPathname = '/deployments/create'
 
-    render((
+    expect(() => renderWithSystemFeatures(
       <RoleRouteGuard>
         <div>content</div>
-      </RoleRouteGuard>
-    ))
+      </RoleRouteGuard>,
+      {
+        systemFeatures: {
+          enable_app_deploy: false,
+        },
+      },
+    )).toThrow('NEXT_REDIRECT:/apps')
 
-    expect(screen.getByText('content')).toBeInTheDocument()
-    expect(screen.queryByRole('status')).not.toBeInTheDocument()
-    expect(mocks.redirect).not.toHaveBeenCalled()
+    expect(mocks.redirect).toHaveBeenCalledWith('/apps')
+    expect(mockUseQuery).not.toHaveBeenCalled()
+    expect(mocks.currentWorkspaceQueryOptions).not.toHaveBeenCalled()
   })
 })
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
index f1e12b34c70..f9742f35e13 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
@@ -4,11 +4,12 @@ import { useStore } from '@/app/components/app/store'
 import { usePathname, useRouter } from '@/next/navigation'
 import { fetchAppDetailDirect } from '@/service/apps'
 import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 import AppDetailLayout from '../layout-main'
 
 const mockReplace = vi.fn()
 let mockPathname = '/app/app-1/workflow'
-let mockIsCurrentWorkspaceEditor = true
+let mockIsLoadingWorkspacePermissionKeys = false
 
 vi.mock('@/next/navigation', () => ({
   usePathname: vi.fn(),
@@ -22,8 +23,10 @@ vi.mock('@/service/apps', () => ({
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     currentWorkspace: { id: 'workspace-1' },
-    isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor,
     isLoadingCurrentWorkspace: false,
+    isLoadingWorkspacePermissionKeys: mockIsLoadingWorkspacePermissionKeys,
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
   }),
 }))
 
@@ -39,6 +42,7 @@ const createAppDetail = (overrides: Partial<App> = {}) => ({
   id: 'app-1',
   name: 'Demo App',
   mode: AppModeEnum.WORKFLOW,
+  permission_keys: [AppACLPermission.ViewLayout, AppACLPermission.Monitor],
   ...overrides,
 }) as App
 
@@ -52,7 +56,7 @@ describe('AppDetailLayout', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockPathname = '/app/app-1/workflow'
-    mockIsCurrentWorkspaceEditor = true
+    mockIsLoadingWorkspacePermissionKeys = false
     mockUsePathname.mockImplementation(() => mockPathname)
     mockUseRouter.mockReturnValue({
       back: vi.fn(),
@@ -99,8 +103,171 @@ describe('AppDetailLayout', () => {
   })
 
   it('should redirect restricted app pages before exposing app detail content', async () => {
-    mockIsCurrentWorkspaceEditor = false
     mockPathname = '/app/app-1/logs'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [AppACLPermission.ViewLayout] }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/app/app-1/workflow')
+    })
+    expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+    expect(useStore.getState().appDetail).toBeUndefined()
+  })
+
+  it('should allow users with monitor access to open logs directly', async () => {
+    mockPathname = '/app/app-1/logs'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [AppACLPermission.Monitor] }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitForAppContent()
+
+    expect(mockReplace).not.toHaveBeenCalledWith('/app/app-1/overview')
+    expect(useStore.getState().appDetail?.id).toBe('app-1')
+  })
+
+  it('should allow users with layout access to open workflow pages directly', async () => {
+    mockPathname = '/app/app-1/workflow'
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitForAppContent()
+
+    expect(mockReplace).not.toHaveBeenCalledWith('/app/app-1/overview')
+    expect(useStore.getState().appDetail?.id).toBe('app-1')
+  })
+
+  it('should redirect workflow pages when layout access is missing', async () => {
+    mockPathname = '/app/app-1/workflow'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [] }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/app/app-1/develop')
+    })
+    expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+    expect(useStore.getState().appDetail).toBeUndefined()
+  })
+
+  it('should redirect overview pages when monitor access is missing', async () => {
+    mockPathname = '/app/app-1/overview'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [AppACLPermission.ViewLayout] }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/app/app-1/workflow')
+    })
+    expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+    expect(useStore.getState().appDetail).toBeUndefined()
+  })
+
+  it('should wait for workspace permission keys before redirecting restricted pages', async () => {
+    mockIsLoadingWorkspacePermissionKeys = true
+    mockPathname = '/app/app-1/overview'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [AppACLPermission.ViewLayout] }))
+
+    const { rerender } = render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitFor(() => {
+      expect(mockFetchAppDetailDirect).toHaveBeenCalledTimes(1)
+    })
+    expect(mockReplace).not.toHaveBeenCalled()
+    expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+
+    mockIsLoadingWorkspacePermissionKeys = false
+    rerender(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/app/app-1/workflow')
+    })
+  })
+
+  it('should allow users with monitor access to open overview directly', async () => {
+    mockPathname = '/app/app-1/overview'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [AppACLPermission.Monitor] }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitForAppContent()
+
+    expect(mockReplace).not.toHaveBeenCalled()
+    expect(useStore.getState().appDetail?.id).toBe('app-1')
+  })
+
+  it('should redirect access config pages when access config access is missing', async () => {
+    mockPathname = '/app/app-1/access-config'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [AppACLPermission.ViewLayout] }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/app/app-1/workflow')
+    })
+    expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+    expect(useStore.getState().appDetail).toBeUndefined()
+  })
+
+  it('should allow users with access config access to open access config directly', async () => {
+    mockPathname = '/app/app-1/access-config'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [AppACLPermission.AccessConfig] }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitForAppContent()
+
+    expect(mockReplace).not.toHaveBeenCalled()
+    expect(useStore.getState().appDetail?.id).toBe('app-1')
+  })
+
+  it('should redirect annotation pages when edit access is missing', async () => {
+    mockPathname = '/app/app-1/annotations'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({
+      mode: AppModeEnum.CHAT,
+      permission_keys: [AppACLPermission.Monitor],
+    }))
 
     render(
       <AppDetailLayout appId="app-1">
@@ -114,4 +281,23 @@ describe('AppDetailLayout', () => {
     expect(screen.queryByText('App page content')).not.toBeInTheDocument()
     expect(useStore.getState().appDetail).toBeUndefined()
   })
+
+  it('should allow users with edit access to open annotations directly', async () => {
+    mockPathname = '/app/app-1/annotations'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({
+      mode: AppModeEnum.CHAT,
+      permission_keys: [AppACLPermission.Edit],
+    }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitForAppContent()
+
+    expect(mockReplace).not.toHaveBeenCalled()
+    expect(useStore.getState().appDetail?.id).toBe('app-1')
+  })
 })
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/access-config/__tests__/page.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/access-config/__tests__/page.spec.tsx
new file mode 100644
index 00000000000..1aa69c277b4
--- /dev/null
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/access-config/__tests__/page.spec.tsx
@@ -0,0 +1,24 @@
+import { render, screen } from '@testing-library/react'
+import AccessConfig from '../page'
+
+vi.mock('@/app/components/app/access-config', () => ({
+  default: ({ appId }: { appId: string }) => (
+    <div data-testid="app-access-config" data-app-id={appId}>
+      app access config
+      {appId}
+    </div>
+  ),
+}))
+
+describe('App access config route', () => {
+  // Route rendering resolves the async app id params for the client page.
+  describe('Rendering', () => {
+    it('should pass app id from route params', async () => {
+      render(await AccessConfig({
+        params: Promise.resolve({ locale: 'en-US', appId: 'app-route-id' }),
+      }))
+
+      expect(screen.getByTestId('app-access-config')).toHaveAttribute('data-app-id', 'app-route-id')
+    })
+  })
+})
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/access-config/page.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/access-config/page.tsx
new file mode 100644
index 00000000000..85ce85bc398
--- /dev/null
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/access-config/page.tsx
@@ -0,0 +1,16 @@
+import type { Locale } from '@/i18n-config'
+import AppAccessConfigPage from '@/app/components/app/access-config'
+
+export type AccessConfigPageProps = {
+  params: Promise<{ locale: Locale, appId: string }>
+}
+
+const AccessConfig = async (props: AccessConfigPageProps) => {
+  const params = await props.params
+
+  const { appId } = params
+
+  return <AppAccessConfigPage appId={appId} />
+}
+
+export default AccessConfig
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
index d0187b67fc3..dcbcba4116d 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
@@ -13,7 +13,8 @@ import useDocumentTitle from '@/hooks/use-document-title'
 import { usePathname, useRouter } from '@/next/navigation'
 import { fetchAppDetailDirect } from '@/service/apps'
 import { AppModeEnum } from '@/types/app'
-import s from './style.module.css'
+import { getRedirectionPath } from '@/utils/app-redirection'
+import { getAppACLCapabilities } from '@/utils/permission'
 
 type IAppDetailLayoutProps = {
   children: React.ReactNode
@@ -35,7 +36,7 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   const { t } = useTranslation()
   const router = useRouter()
   const pathname = usePathname()
-  const { isCurrentWorkspaceEditor, isLoadingCurrentWorkspace, currentWorkspace } = useAppContext()
+  const { isLoadingCurrentWorkspace, isLoadingWorkspacePermissionKeys, currentWorkspace, userProfile, workspacePermissionKeys } = useAppContext()
   const { appDetail, setAppDetail } = useStore(useShallow(state => ({
     appDetail: state.appDetail,
     setAppDetail: state.setAppDetail,
@@ -85,15 +86,33 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   }, [appId, router, setAppDetail])
 
   useEffect(() => {
-    if (!routeAppDetail || !currentWorkspace.id || isLoadingCurrentWorkspace || isLoadingAppDetail)
+    if (!routeAppDetail || !currentWorkspace.id || isLoadingCurrentWorkspace || isLoadingWorkspacePermissionKeys || isLoadingAppDetail)
       return
     if (routeAppDetail.id !== appId)
       return
 
-    // redirection
-    const canIEditApp = isCurrentWorkspaceEditor
-    if (!canIEditApp && (pathname.endsWith('configuration') || pathname.endsWith('workflow') || pathname.endsWith('logs') || pathname.endsWith('annotations'))) {
-      router.replace(`/app/${appId}/overview`)
+    const appACLCapabilities = getAppACLCapabilities(routeAppDetail.permission_keys, {
+      currentUserId: userProfile?.id,
+      resourceMaintainer: routeAppDetail.maintainer,
+      workspacePermissionKeys,
+    })
+    const isLayoutPath = pathname.endsWith('configuration') || pathname.endsWith('workflow')
+    const isLogsPath = pathname.endsWith('logs')
+    const isAnnotationsPath = pathname.endsWith('annotations')
+    const isOverviewPath = pathname.endsWith('overview')
+    const isAccessConfigPath = pathname.endsWith('access-config')
+    if (
+      (isLayoutPath && !appACLCapabilities.canAccessLayout)
+      || (isLogsPath && !appACLCapabilities.canMonitor)
+      || (isAnnotationsPath && !appACLCapabilities.canEdit)
+      || (isOverviewPath && !appACLCapabilities.canMonitor)
+      || (isAccessConfigPath && !appACLCapabilities.canAccessConfig)
+    ) {
+      router.replace(getRedirectionPath(routeAppDetail, {
+        currentUserId: userProfile?.id,
+        resourceMaintainer: routeAppDetail.maintainer,
+        workspacePermissionKeys,
+      }))
       return
     }
     if ((routeAppDetail.mode === AppModeEnum.WORKFLOW || routeAppDetail.mode === AppModeEnum.ADVANCED_CHAT) && (pathname).endsWith('configuration')) {
@@ -106,7 +125,7 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
 
     if (appDetailRes && appDetail?.id !== appDetailRes.id)
       setAppDetail({ ...appDetailRes, enable_sso: false })
-  }, [appDetail?.id, appDetailRes, appId, currentWorkspace.id, isCurrentWorkspaceEditor, isLoadingAppDetail, isLoadingCurrentWorkspace, pathname, routeAppDetail, router, setAppDetail])
+  }, [appDetail?.id, appDetailRes, appId, currentWorkspace.id, isLoadingAppDetail, isLoadingCurrentWorkspace, isLoadingWorkspacePermissionKeys, pathname, routeAppDetail, router, setAppDetail, userProfile?.id, workspacePermissionKeys])
 
   if (!appDetail) {
     return (
@@ -116,9 +135,19 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
     )
   }
 
+  const isWorkflowPage = pathname.endsWith('/workflow')
+
   return (
-    <div className={cn(s.app, 'relative ml-1 flex', 'overflow-hidden')}>
-      <div className="grow overflow-hidden bg-components-panel-bg">
+    <div className={cn(
+      'relative flex h-0 grow overflow-hidden',
+      !isWorkflowPage && 'pt-1 pr-1 pb-1',
+    )}
+    >
+      <div className={cn(
+        'grow overflow-hidden bg-components-panel-bg',
+        !isWorkflowPage && 'rounded-lg shadow-xs shadow-shadow-shadow-3',
+      )}
+      >
         {children}
       </div>
     </div>
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/card-view.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/card-view.spec.tsx
new file mode 100644
index 00000000000..4099e1fce56
--- /dev/null
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/card-view.spec.tsx
@@ -0,0 +1,159 @@
+import type { App } from '@/types/app'
+import { render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import CardView from '../card-view'
+
+const mockAppState = vi.hoisted(() => ({
+  appDetail: {
+    id: 'app-1',
+    mode: 'chat',
+    permission_keys: [] as string[],
+  },
+  setAppDetail: vi.fn(),
+}))
+
+const mockUpdateAppSiteStatus = vi.hoisted(() => vi.fn())
+const mockUpdateAppSiteConfig = vi.hoisted(() => vi.fn())
+const mockUpdateAppSiteAccessToken = vi.hoisted(() => vi.fn())
+const mockInvalidateQueries = vi.hoisted(() => vi.fn())
+
+vi.mock('@/app/components/app/store', () => ({
+  useStore: <T,>(selector: (state: typeof mockAppState) => T): T => selector(mockAppState),
+}))
+
+vi.mock('@/service/use-workflow', () => ({
+  useAppWorkflow: () => ({ data: undefined }),
+}))
+
+vi.mock('@/service/apps', () => ({
+  updateAppSiteStatus: (...args: unknown[]) => mockUpdateAppSiteStatus(...args),
+  updateAppSiteConfig: (...args: unknown[]) => mockUpdateAppSiteConfig(...args),
+  updateAppSiteAccessToken: (...args: unknown[]) => mockUpdateAppSiteAccessToken(...args),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mockInvalidateQueries,
+  }),
+}))
+
+vi.mock('@/app/components/workflow/collaboration/core/collaboration-manager', () => ({
+  collaborationManager: {
+    onAppStateUpdate: vi.fn(() => vi.fn()),
+  },
+}))
+
+vi.mock('@/app/components/workflow/collaboration/core/websocket-manager', () => ({
+  webSocketClient: {
+    getSocket: vi.fn(() => null),
+  },
+}))
+
+vi.mock('@/app/components/app/overview/app-card', () => ({
+  default: ({
+    cardType,
+    onChangeStatus,
+    onGenerateCode,
+    onSaveSiteConfig,
+  }: {
+    cardType: string
+    onChangeStatus?: (value: boolean) => void
+    onGenerateCode?: () => void
+    onSaveSiteConfig?: (params: Record<string, unknown>) => void
+  }) => (
+    <div>
+      <button type="button" onClick={() => onChangeStatus?.(true)}>
+        toggle
+        {' '}
+        {cardType}
+      </button>
+      {onGenerateCode && (
+        <button type="button" onClick={() => onGenerateCode()}>
+          generate
+          {' '}
+          {cardType}
+        </button>
+      )}
+      {onSaveSiteConfig && (
+        <button type="button" onClick={() => onSaveSiteConfig({ title: 'Site title' })}>
+          save
+          {' '}
+          {cardType}
+        </button>
+      )}
+    </div>
+  ),
+}))
+
+vi.mock('@/app/components/app/overview/trigger-card', () => ({
+  default: () => <div>trigger card</div>,
+}))
+
+vi.mock('@/app/components/tools/mcp/mcp-service-card', () => ({
+  default: () => <div>mcp card</div>,
+}))
+
+describe('CardView ACL edit guards', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockAppState.appDetail = {
+      id: 'app-1',
+      mode: 'chat',
+      permission_keys: [],
+    }
+    mockUpdateAppSiteStatus.mockResolvedValue(mockAppState.appDetail as App)
+    mockUpdateAppSiteConfig.mockResolvedValue(mockAppState.appDetail as App)
+    mockUpdateAppSiteAccessToken.mockResolvedValue({ code: 'token' })
+    mockInvalidateQueries.mockResolvedValue(undefined)
+  })
+
+  // User-facing card actions should not mutate app settings without app ACL edit permission.
+  describe('Permissions', () => {
+    it('should not call write APIs when app ACL edit permission is missing', async () => {
+      const user = userEvent.setup()
+
+      render(<CardView appId="app-1" />)
+
+      await user.click(screen.getByRole('button', { name: /toggle webapp/ }))
+      await user.click(screen.getByRole('button', { name: /save webapp/ }))
+      await user.click(screen.getByRole('button', { name: /generate webapp/ }))
+      await user.click(screen.getByRole('button', { name: /toggle api/ }))
+
+      expect(mockUpdateAppSiteStatus).not.toHaveBeenCalled()
+      expect(mockUpdateAppSiteConfig).not.toHaveBeenCalled()
+      expect(mockUpdateAppSiteAccessToken).not.toHaveBeenCalled()
+    })
+
+    it('should call write APIs when app ACL edit permission is present', async () => {
+      const user = userEvent.setup()
+      mockAppState.appDetail.permission_keys = ['app.acl.edit']
+
+      render(<CardView appId="app-1" />)
+
+      await user.click(screen.getByRole('button', { name: /toggle webapp/ }))
+      await user.click(screen.getByRole('button', { name: /save webapp/ }))
+      await user.click(screen.getByRole('button', { name: /generate webapp/ }))
+      await user.click(screen.getByRole('button', { name: /toggle api/ }))
+
+      await waitFor(() => {
+        expect(mockUpdateAppSiteStatus).toHaveBeenCalledTimes(2)
+      })
+      expect(mockUpdateAppSiteStatus).toHaveBeenCalledWith({
+        url: '/apps/app-1/site-enable',
+        body: { enable_site: true },
+      })
+      expect(mockUpdateAppSiteStatus).toHaveBeenCalledWith({
+        url: '/apps/app-1/api-enable',
+        body: { enable_api: true },
+      })
+      expect(mockUpdateAppSiteConfig).toHaveBeenCalledWith({
+        url: '/apps/app-1/site',
+        body: { title: 'Site title' },
+      })
+      expect(mockUpdateAppSiteAccessToken).toHaveBeenCalledWith({
+        url: '/apps/app-1/site/access-token-reset',
+      })
+      expect(mockInvalidateQueries).toHaveBeenCalledWith({ queryKey: ['apps', 'detail', 'app-1'] })
+    })
+  })
+})
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/chart-view.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/chart-view.spec.tsx
new file mode 100644
index 00000000000..75516435b66
--- /dev/null
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/chart-view.spec.tsx
@@ -0,0 +1,127 @@
+import { render, screen } from '@testing-library/react'
+import { AppACLPermission } from '@/utils/permission'
+import ChartView from '../chart-view'
+
+const testState = vi.hoisted(() => ({
+  appDetail: {
+    id: 'app-1',
+    mode: 'chat',
+    maintainer: 'maintainer-1',
+    permission_keys: [] as string[],
+  },
+  currentUserId: 'user-1',
+  workspacePermissionKeys: [] as string[],
+  chartRenderSpy: vi.fn(),
+}))
+
+vi.mock('@/app/components/app/store', () => ({
+  useStore: <T,>(selector: (state: { appDetail: typeof testState.appDetail }) => T): T => selector({
+    appDetail: testState.appDetail,
+  }),
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn((selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: testState.currentUserId },
+    workspacePermissionKeys: testState.workspacePermissionKeys,
+  })),
+}))
+
+vi.mock('@/context/i18n', () => ({
+  useDocLink: () => (path: string) => path,
+}))
+
+vi.mock('@/app/components/app/overview/app-chart', () => ({
+  AvgResponseTime: () => {
+    testState.chartRenderSpy('avg-response-time')
+    return <div>avg response time chart</div>
+  },
+  AvgSessionInteractions: () => {
+    testState.chartRenderSpy('avg-session-interactions')
+    return <div>avg session interactions chart</div>
+  },
+  AvgUserInteractions: () => {
+    testState.chartRenderSpy('avg-user-interactions')
+    return <div>avg user interactions chart</div>
+  },
+  ConversationsChart: () => {
+    testState.chartRenderSpy('conversations')
+    return <div>conversations chart</div>
+  },
+  CostChart: () => {
+    testState.chartRenderSpy('cost')
+    return <div>cost chart</div>
+  },
+  EndUsersChart: () => {
+    testState.chartRenderSpy('end-users')
+    return <div>end users chart</div>
+  },
+  MessagesChart: () => {
+    testState.chartRenderSpy('messages')
+    return <div>messages chart</div>
+  },
+  TokenPerSecond: () => {
+    testState.chartRenderSpy('token-per-second')
+    return <div>token per second chart</div>
+  },
+  UserSatisfactionRate: () => {
+    testState.chartRenderSpy('user-satisfaction-rate')
+    return <div>user satisfaction rate chart</div>
+  },
+  WorkflowCostChart: () => {
+    testState.chartRenderSpy('workflow-cost')
+    return <div>workflow cost chart</div>
+  },
+  WorkflowDailyTerminalsChart: () => {
+    testState.chartRenderSpy('workflow-daily-terminals')
+    return <div>workflow daily terminals chart</div>
+  },
+  WorkflowMessagesChart: () => {
+    testState.chartRenderSpy('workflow-messages')
+    return <div>workflow messages chart</div>
+  },
+}))
+
+vi.mock('../long-time-range-picker', () => ({
+  default: () => <button type="button">long time range</button>,
+}))
+
+vi.mock('../time-range-picker', () => ({
+  default: () => <button type="button">time range</button>,
+}))
+
+describe('ChartView monitor permission', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    testState.appDetail = {
+      id: 'app-1',
+      mode: 'chat',
+      maintainer: 'maintainer-1',
+      permission_keys: [],
+    }
+    testState.currentUserId = 'user-1'
+    testState.workspacePermissionKeys = []
+  })
+
+  // Monitoring charts are part of the app monitor permission surface.
+  describe('Permissions', () => {
+    it('should not render monitoring charts when app monitor permission is missing', () => {
+      render(<ChartView appId="app-1" headerRight={<button type="button">header action</button>} />)
+
+      expect(screen.queryByRole('heading', { name: 'common.appMenus.overview' })).not.toBeInTheDocument()
+      expect(screen.queryByText('header action')).not.toBeInTheDocument()
+      expect(testState.chartRenderSpy).not.toHaveBeenCalled()
+    })
+
+    it('should render monitoring charts when app monitor permission is granted', () => {
+      testState.appDetail.permission_keys = [AppACLPermission.Monitor]
+
+      render(<ChartView appId="app-1" headerRight={<button type="button">header action</button>} />)
+
+      expect(screen.getByRole('heading', { name: 'common.appMenus.overview' })).toBeInTheDocument()
+      expect(screen.getByText('header action')).toBeInTheDocument()
+      expect(screen.getByText('conversations chart')).toBeInTheDocument()
+      expect(testState.chartRenderSpy).toHaveBeenCalledWith('conversations')
+    })
+  })
+})
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/view.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/view.spec.tsx
new file mode 100644
index 00000000000..5ac607fc301
--- /dev/null
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/view.spec.tsx
@@ -0,0 +1,82 @@
+import type { ReactNode } from 'react'
+import { render, screen } from '@testing-library/react'
+import { AppACLPermission } from '@/utils/permission'
+import OverviewView from '../view'
+
+const testState = vi.hoisted(() => ({
+  appDetail: {
+    id: 'app-1',
+    mode: 'chat',
+    maintainer: 'maintainer-1',
+    permission_keys: [] as string[],
+  },
+  currentUserId: 'user-1',
+  workspacePermissionKeys: [] as string[],
+}))
+
+vi.mock('@/app/components/app/store', () => ({
+  useStore: <T,>(selector: (state: { appDetail: typeof testState.appDetail }) => T): T => selector({
+    appDetail: testState.appDetail,
+  }),
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn((selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: testState.currentUserId },
+    workspacePermissionKeys: testState.workspacePermissionKeys,
+  })),
+}))
+
+vi.mock('@/app/components/app/overview/apikey-info-panel', () => ({
+  default: () => <div>api key info panel</div>,
+}))
+
+vi.mock('../chart-view', () => ({
+  default: ({ appId, headerRight }: { appId: string, headerRight: ReactNode }) => (
+    <div>
+      chart view
+      {' '}
+      {appId}
+      {headerRight}
+    </div>
+  ),
+}))
+
+vi.mock('../tracing/panel', () => ({
+  default: () => <button type="button">tracing</button>,
+}))
+
+describe('OverviewView monitor permission', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    testState.appDetail = {
+      id: 'app-1',
+      mode: 'chat',
+      maintainer: 'maintainer-1',
+      permission_keys: [],
+    }
+    testState.currentUserId = 'user-1'
+    testState.workspacePermissionKeys = []
+  })
+
+  // The overview page should be controlled as one monitor-permission surface.
+  describe('Permissions', () => {
+    it('should not render overview page content when app monitor permission is missing', () => {
+      render(<OverviewView appId="app-1" />)
+
+      expect(screen.queryByText('api key info panel')).not.toBeInTheDocument()
+      expect(screen.queryByText(/chart view app-1/)).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'tracing' })).not.toBeInTheDocument()
+    })
+
+    it('should render overview page content when app monitor permission is granted', () => {
+      testState.appDetail.permission_keys = [AppACLPermission.Monitor]
+
+      render(<OverviewView appId="app-1" />)
+
+      expect(screen.getByText('api key info panel')).toBeInTheDocument()
+      expect(screen.getByText(/chart view app-1/)).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'tracing' })).toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/card-view.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/card-view.tsx
index 06465e3551a..74772c2b806 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/card-view.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/card-view.tsx
@@ -6,28 +6,29 @@ import type { UpdateAppSiteCodeResponse } from '@/models/app'
 import type { App } from '@/types/app'
 import type { I18nKeysByPrefix } from '@/types/i18n'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
-import * as React from 'react'
+import { useQueryClient } from '@tanstack/react-query'
 import { useCallback, useEffect, useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import AppCard from '@/app/components/app/overview/app-card'
 import TriggerCard from '@/app/components/app/overview/trigger-card'
 import { useStore as useAppStore } from '@/app/components/app/store'
+import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import Loading from '@/app/components/base/loading'
 import MCPServiceCard from '@/app/components/tools/mcp/mcp-service-card'
 import { collaborationManager } from '@/app/components/workflow/collaboration/core/collaboration-manager'
 import { webSocketClient } from '@/app/components/workflow/collaboration/core/websocket-manager'
 import { isTriggerNode } from '@/app/components/workflow/types'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import {
-  fetchAppDetail,
   updateAppSiteAccessToken,
   updateAppSiteConfig,
   updateAppSiteStatus,
 } from '@/service/apps'
+import { appDetailQueryKeyPrefix } from '@/service/use-apps'
 import { useAppWorkflow } from '@/service/use-workflow'
 import { AppModeEnum } from '@/types/app'
 import { asyncRunSafe } from '@/utils'
+import { getAppACLCapabilities } from '@/utils/permission'
 
 type ICardViewProps = {
   appId: string
@@ -37,8 +38,15 @@ type ICardViewProps = {
 
 const CardView: FC<ICardViewProps> = ({ appId, isInPanel, className }) => {
   const { t } = useTranslation()
+  const queryClient = useQueryClient()
   const appDetail = useAppStore(state => state.appDetail)
-  const setAppDetail = useAppStore(state => state.setAppDetail)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canEditApp = useMemo(() => getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  }).canEdit, [appDetail?.maintainer, appDetail?.permission_keys, currentUserId, workspacePermissionKeys])
 
   const isWorkflowApp = appDetail?.mode === AppModeEnum.WORKFLOW
   const showMCPCard = isInPanel
@@ -76,17 +84,16 @@ const CardView: FC<ICardViewProps> = ({ appId, isInPanel, className }) => {
     ? buildTriggerModeMessage(t('mcp.server.title', { ns: 'tools' }))
     : null
 
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
 
   const updateAppDetail = useCallback(async () => {
     try {
-      const res = await fetchAppDetail({ url: '/apps', id: appId })
-      setAppDetail({ ...res })
+      await queryClient.invalidateQueries({ queryKey: [...appDetailQueryKeyPrefix, appId] })
     }
     catch (error) {
       console.error(error)
     }
-  }, [appId, setAppDetail])
+  }, [appId, queryClient])
 
   const handleCallbackResult = (err: Error | null, message?: I18nKeysByPrefix<'common', 'actionMsg.'>) => {
     const type = err ? 'error' : 'success'
@@ -129,6 +136,9 @@ const CardView: FC<ICardViewProps> = ({ appId, isInPanel, className }) => {
   }, [appId, updateAppDetail])
 
   const onChangeSiteStatus = async (value: boolean) => {
+    if (!canEditApp)
+      return
+
     const [err] = await asyncRunSafe<App>(
       updateAppSiteStatus({
         url: `/apps/${appId}/site-enable`,
@@ -140,6 +150,9 @@ const CardView: FC<ICardViewProps> = ({ appId, isInPanel, className }) => {
   }
 
   const onChangeApiStatus = async (value: boolean) => {
+    if (!canEditApp)
+      return
+
     const [err] = await asyncRunSafe<App>(
       updateAppSiteStatus({
         url: `/apps/${appId}/api-enable`,
@@ -151,6 +164,9 @@ const CardView: FC<ICardViewProps> = ({ appId, isInPanel, className }) => {
   }
 
   const onSaveSiteConfig: IAppCardProps['onSaveSiteConfig'] = async (params) => {
+    if (!canEditApp)
+      return
+
     const [err] = await asyncRunSafe<App>(
       updateAppSiteConfig({
         url: `/apps/${appId}/site`,
@@ -164,6 +180,9 @@ const CardView: FC<ICardViewProps> = ({ appId, isInPanel, className }) => {
   }
 
   const onGenerateCode = async () => {
+    if (!canEditApp)
+      return
+
     const [err] = await asyncRunSafe<UpdateAppSiteCodeResponse>(
       updateAppSiteAccessToken({
         url: `/apps/${appId}/site/access-token-reset`,
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/chart-view.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/chart-view.tsx
index 0fbc41eb6b8..a4ee7d06a92 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/chart-view.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/chart-view.tsx
@@ -10,6 +10,9 @@ import { TIME_PERIOD_MAPPING as LONG_TIME_PERIOD_MAPPING } from '@/app/component
 import { AvgResponseTime, AvgSessionInteractions, AvgUserInteractions, ConversationsChart, CostChart, EndUsersChart, MessagesChart, TokenPerSecond, UserSatisfactionRate, WorkflowCostChart, WorkflowDailyTerminalsChart, WorkflowMessagesChart } from '@/app/components/app/overview/app-chart'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { IS_CLOUD_EDITION } from '@/config'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { useDocLink } from '@/context/i18n'
+import { getAppACLCapabilities } from '@/utils/permission'
 import LongTimeRangePicker from './long-time-range-picker'
 import TimeRangePicker from './time-range-picker'
 
@@ -34,7 +37,15 @@ type IChartViewProps = {
 
 export default function ChartView({ appId, headerRight }: IChartViewProps) {
   const { t } = useTranslation()
+  const docLink = useDocLink()
   const appDetail = useAppStore(state => state.appDetail)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canMonitor = React.useMemo(() => getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  }).canMonitor, [appDetail?.maintainer, appDetail?.permission_keys, currentUserId, workspacePermissionKeys])
   const isChatApp = appDetail?.mode !== 'completion' && appDetail?.mode !== 'workflow'
   const isWorkflow = appDetail?.mode === 'workflow'
   const [period, setPeriod] = useState<PeriodParams>(IS_CLOUD_EDITION
@@ -42,14 +53,30 @@ export default function ChartView({ appId, headerRight }: IChartViewProps) {
     : { name: t('filter.period.last7days', { ns: 'appLog' }), query: { start: today.subtract(7, 'day').startOf('day').format(queryDateFormat), end: today.endOf('day').format(queryDateFormat) } },
   )
 
-  if (!appDetail)
+  if (!appDetail || !canMonitor)
     return null
 
   return (
-    <div>
-      <div className="mb-4">
-        <div className="mb-2 system-xl-semibold text-text-primary">{t('appMenus.overview', { ns: 'common' })}</div>
-        <div className="flex items-center justify-between">
+    <div className="flex h-full min-h-0 flex-col">
+      <div className="h-[106px] shrink-0">
+        <div className="px-6 pt-3">
+          <div className="flex h-6 items-center">
+            <h1 className="title-2xl-semi-bold text-text-primary">{t('appMenus.overview', { ns: 'common' })}</h1>
+          </div>
+          <div className="mt-0.5 flex h-4 min-w-0 items-start gap-0.5 system-xs-regular text-text-tertiary">
+            <p className="min-w-0 truncate">{t('monitoring.description', { ns: 'appLog' })}</p>
+            <a
+              href={docLink('/use-dify/monitor/analysis')}
+              target="_blank"
+              rel="noopener noreferrer"
+              className="inline-flex shrink-0 items-center text-text-accent hover:underline"
+            >
+              <span>{t('operation.learnMore', { ns: 'common' })}</span>
+              <span className="i-ri-external-link-line size-3" aria-hidden="true" />
+            </a>
+          </div>
+        </div>
+        <div className="mt-1 flex h-10 items-center justify-between pr-10 pl-6">
           {IS_CLOUD_EDITION
             ? (
                 <TimeRangePicker
@@ -69,47 +96,35 @@ export default function ChartView({ appId, headerRight }: IChartViewProps) {
           {headerRight}
         </div>
       </div>
-      {!isWorkflow && (
-        <div className="mb-6 grid w-full grid-cols-1 gap-6 xl:grid-cols-2">
-          <ConversationsChart period={period} id={appId} />
-          <EndUsersChart period={period} id={appId} />
+      <div className="min-h-0 flex-1 overflow-y-auto px-6 pt-2 pb-6">
+        <div className="grid w-full grid-cols-1 gap-3 xl:grid-cols-2">
+          {!isWorkflow && (
+            <>
+              <ConversationsChart period={period} id={appId} />
+              <EndUsersChart period={period} id={appId} />
+              {isChatApp
+                ? (
+                    <AvgSessionInteractions period={period} id={appId} />
+                  )
+                : (
+                    <AvgResponseTime period={period} id={appId} />
+                  )}
+              <TokenPerSecond period={period} id={appId} />
+              <UserSatisfactionRate period={period} id={appId} />
+              <CostChart period={period} id={appId} />
+              {isChatApp && <MessagesChart period={period} id={appId} />}
+            </>
+          )}
+          {isWorkflow && (
+            <>
+              <WorkflowMessagesChart period={period} id={appId} />
+              <WorkflowDailyTerminalsChart period={period} id={appId} />
+              <WorkflowCostChart period={period} id={appId} />
+              <AvgUserInteractions period={period} id={appId} />
+            </>
+          )}
         </div>
-      )}
-      {!isWorkflow && (
-        <div className="mb-6 grid w-full grid-cols-1 gap-6 xl:grid-cols-2">
-          {isChatApp
-            ? (
-                <AvgSessionInteractions period={period} id={appId} />
-              )
-            : (
-                <AvgResponseTime period={period} id={appId} />
-              )}
-          <TokenPerSecond period={period} id={appId} />
-        </div>
-      )}
-      {!isWorkflow && (
-        <div className="mb-6 grid w-full grid-cols-1 gap-6 xl:grid-cols-2">
-          <UserSatisfactionRate period={period} id={appId} />
-          <CostChart period={period} id={appId} />
-        </div>
-      )}
-      {!isWorkflow && isChatApp && (
-        <div className="mb-6 grid w-full grid-cols-1 gap-6 xl:grid-cols-2">
-          <MessagesChart period={period} id={appId} />
-        </div>
-      )}
-      {isWorkflow && (
-        <div className="mb-6 grid w-full grid-cols-1 gap-6 xl:grid-cols-2">
-          <WorkflowMessagesChart period={period} id={appId} />
-          <WorkflowDailyTerminalsChart period={period} id={appId} />
-        </div>
-      )}
-      {isWorkflow && (
-        <div className="mb-6 grid w-full grid-cols-1 gap-6 xl:grid-cols-2">
-          <WorkflowCostChart period={period} id={appId} />
-          <AvgUserInteractions period={period} id={appId} />
-        </div>
-      )}
+      </div>
     </div>
   )
 }
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/page.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/page.tsx
index 39c42d067d1..7b84d311fc9 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/page.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/page.tsx
@@ -1,7 +1,5 @@
 import * as React from 'react'
-import ApikeyInfoPanel from '@/app/components/app/overview/apikey-info-panel'
-import ChartView from './chart-view'
-import TracingPanel from './tracing/panel'
+import OverviewView from './view'
 
 export type IDevelopProps = {
   params: Promise<{ appId: string }>
@@ -15,13 +13,7 @@ const Overview = async (props: IDevelopProps) => {
   } = params
 
   return (
-    <div className="h-full overflow-y-auto bg-chatbot-bg px-4 py-6 sm:px-12">
-      <ApikeyInfoPanel />
-      <ChartView
-        appId={appId}
-        headerRight={<TracingPanel />}
-      />
-    </div>
+    <OverviewView appId={appId} />
   )
 }
 
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/tracing/__tests__/panel.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/tracing/__tests__/panel.spec.tsx
new file mode 100644
index 00000000000..dc2970513a0
--- /dev/null
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/tracing/__tests__/panel.spec.tsx
@@ -0,0 +1,137 @@
+import type { ComponentProps, ReactNode } from 'react'
+import { render, screen, waitFor } from '@testing-library/react'
+import { fetchTracingConfig, fetchTracingStatus, updateTracingStatus } from '@/service/apps'
+import { AppACLPermission } from '@/utils/permission'
+import Panel from '../panel'
+
+const testState = vi.hoisted(() => ({
+  appPermissionKeys: [] as string[],
+  workspacePermissionKeys: [] as string[],
+  configButtonProps: [] as Array<{
+    readOnly: boolean
+    hasConfigured: boolean
+  }>,
+}))
+
+vi.mock('@/next/navigation', () => ({
+  usePathname: () => '/app/app-1/overview',
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn((selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: testState.workspacePermissionKeys,
+  })),
+}))
+
+vi.mock('@/app/components/app/store', () => ({
+  useStore: vi.fn((selector: (state: { appDetail: { permission_keys: string[] } }) => unknown) => selector({
+    appDetail: {
+      permission_keys: testState.appPermissionKeys,
+    },
+  })),
+}))
+
+vi.mock('@/service/apps', () => ({
+  fetchTracingStatus: vi.fn(),
+  fetchTracingConfig: vi.fn(),
+  updateTracingStatus: vi.fn(),
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: vi.fn(),
+}))
+
+vi.mock('@langgenius/dify-ui/status-dot', () => ({
+  StatusDot: ({ status }: { status: string }) => <span data-testid="status-dot">{status}</span>,
+}))
+
+vi.mock('@/app/components/base/icons/src/public/tracing', () => ({
+  AliyunIcon: () => <span data-testid="aliyun-icon" />,
+  ArizeIcon: () => <span data-testid="arize-icon" />,
+  DatabricksIcon: () => <span data-testid="databricks-icon" />,
+  LangfuseIcon: () => <span data-testid="langfuse-icon" />,
+  LangsmithIcon: () => <span data-testid="langsmith-icon" />,
+  MlflowIcon: () => <span data-testid="mlflow-icon" />,
+  OpikIcon: () => <span data-testid="opik-icon" />,
+  PhoenixIcon: () => <span data-testid="phoenix-icon" />,
+  TencentIcon: () => <span data-testid="tencent-icon" />,
+  TracingIcon: () => <span data-testid="tracing-icon" />,
+  WeaveIcon: () => <span data-testid="weave-icon" />,
+}))
+
+vi.mock('../config-button', () => ({
+  default: ({ children, ...props }: ComponentProps<'div'> & { readOnly: boolean, hasConfigured: boolean, children?: ReactNode }) => {
+    testState.configButtonProps.push({
+      readOnly: props.readOnly,
+      hasConfigured: props.hasConfigured,
+    })
+
+    return (
+      <div
+        data-testid="config-button"
+        data-read-only={String(props.readOnly)}
+        data-has-configured={String(props.hasConfigured)}
+      >
+        {children}
+      </div>
+    )
+  },
+}))
+
+const mockedFetchTracingStatus = vi.mocked(fetchTracingStatus)
+const mockedFetchTracingConfig = vi.mocked(fetchTracingConfig)
+const mockedUpdateTracingStatus = vi.mocked(updateTracingStatus)
+
+const renderPanel = async () => {
+  render(<Panel />)
+
+  await screen.findAllByTestId('config-button')
+}
+
+describe('Tracing overview panel permissions', () => {
+  beforeEach(() => {
+    testState.appPermissionKeys = []
+    testState.workspacePermissionKeys = []
+    testState.configButtonProps = []
+    mockedFetchTracingStatus.mockResolvedValue({
+      enabled: false,
+      tracing_provider: null,
+    })
+    mockedFetchTracingConfig.mockResolvedValue({
+      tracing_provider: 'langfuse',
+      tracing_config: {},
+      has_not_configured: true,
+    } as Awaited<ReturnType<typeof fetchTracingConfig>>)
+    mockedUpdateTracingStatus.mockResolvedValue({
+      result: 'success',
+    })
+  })
+
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('marks tracing config as read-only without app monitor or workspace tracking permissions', async () => {
+    await renderPanel()
+
+    await waitFor(() => {
+      expect(testState.configButtonProps[0]).toMatchObject({
+        readOnly: true,
+        hasConfigured: false,
+      })
+    })
+  })
+
+  it('allows tracing config when app ACL includes monitor permission', async () => {
+    testState.appPermissionKeys = [AppACLPermission.Monitor]
+
+    await renderPanel()
+
+    await waitFor(() => {
+      expect(testState.configButtonProps[0]).toMatchObject({
+        readOnly: false,
+        hasConfigured: false,
+      })
+    })
+  })
+})
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/tracing/panel.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/tracing/panel.tsx
index b03fd6e30d3..7c0de99e0f5 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/tracing/panel.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/tracing/panel.tsx
@@ -5,20 +5,29 @@ import type { TracingStatus } from '@/models/app'
 import { cn } from '@langgenius/dify-ui/cn'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { toast } from '@langgenius/dify-ui/toast'
-import {
-  RiArrowDownDoubleLine,
-  RiEqualizer2Line,
-} from '@remixicon/react'
 import { useBoolean } from 'ahooks'
 import * as React from 'react'
 import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useStore as useAppStore } from '@/app/components/app/store'
 import Divider from '@/app/components/base/divider'
-import { AliyunIcon, ArizeIcon, DatabricksIcon, LangfuseIcon, LangsmithIcon, MlflowIcon, OpikIcon, PhoenixIcon, TencentIcon, WeaveIcon } from '@/app/components/base/icons/src/public/tracing'
+import {
+  AliyunIcon,
+  ArizeIcon,
+  DatabricksIcon,
+  LangfuseIcon,
+  LangsmithIcon,
+  MlflowIcon,
+  OpikIcon,
+  PhoenixIcon,
+  TencentIcon,
+  WeaveIcon,
+} from '@/app/components/base/icons/src/public/tracing'
 import Loading from '@/app/components/base/loading'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { usePathname } from '@/next/navigation'
 import { fetchTracingConfig as doFetchTracingConfig, fetchTracingStatus, updateTracingStatus } from '@/service/apps'
+import { getAppACLCapabilities } from '@/utils/permission'
 import ConfigButton from './config-button'
 import TracingIcon from './tracing-icon'
 import { TracingProvider } from './type'
@@ -30,8 +39,16 @@ const Panel: FC = () => {
   const pathname = usePathname()
   const matched = /\/app\/([^/]+)/.exec(pathname)
   const appId = (matched?.length && matched[1]) ? matched[1] : ''
-  const { isCurrentWorkspaceEditor } = useAppContext()
-  const readOnly = !isCurrentWorkspaceEditor
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const appDetail = useAppStore(s => s.appDetail)
+  const appACLCapabilities = React.useMemo(() => getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  }), [appDetail?.maintainer, appDetail?.permission_keys, currentUserId, workspacePermissionKeys])
+  const canConfigTracing = appACLCapabilities.canMonitor
+  const readOnly = !canConfigTracing
 
   const [isLoaded, {
     setTrue: setLoaded,
@@ -247,17 +264,17 @@ const Panel: FC = () => {
         >
           <div
             className={cn(
-              'flex cursor-pointer items-center rounded-xl border-t border-l-[0.5px] border-effects-highlight bg-background-default-dodge p-2 shadow-xs select-none hover:border-effects-highlight-lightmode-off hover:bg-background-default-lighter',
+              'flex cursor-pointer items-center rounded-xl border-[0.5px] border-components-panel-border bg-background-default-dodge p-2 shadow-xs select-none hover:bg-background-default-lighter',
             )}
           >
             <TracingIcon size="md" />
             <div className="mx-2 system-sm-semibold text-text-secondary">{t(`${I18N_PREFIX}.title`, { ns: 'app' })}</div>
             <div className="rounded-md p-1">
-              <RiEqualizer2Line className="size-4 text-text-tertiary" />
+              <span className="i-ri-equalizer-2-line size-4 text-text-tertiary" />
             </div>
             <Divider type="vertical" className="h-3.5" />
             <div className="rounded-md p-1">
-              <RiArrowDownDoubleLine className="size-4 text-text-tertiary" />
+              <span className="i-ri-arrow-down-double-line size-4 text-text-tertiary" />
             </div>
           </div>
         </ConfigButton>
@@ -286,7 +303,7 @@ const Panel: FC = () => {
         >
           <div
             className={cn(
-              'flex cursor-pointer items-center rounded-xl border-t border-l-[0.5px] border-effects-highlight bg-background-default-dodge p-2 shadow-xs select-none hover:border-effects-highlight-lightmode-off hover:bg-background-default-lighter',
+              'flex cursor-pointer items-center rounded-xl border-[0.5px] border-components-panel-border bg-background-default-dodge p-2 shadow-xs select-none hover:bg-background-default-lighter',
             )}
           >
             <div className="mr-1 ml-4 flex items-center">
@@ -297,7 +314,7 @@ const Panel: FC = () => {
             </div>
             {InUseProviderIcon && <InUseProviderIcon className="ml-1 h-4" />}
             <div className="ml-2 rounded-md p-1">
-              <RiEqualizer2Line className="size-4 text-text-tertiary" />
+              <span className="i-ri-equalizer-2-line size-4 text-text-tertiary" />
             </div>
             <Divider type="vertical" className="h-3.5" />
           </div>
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/view.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/view.tsx
new file mode 100644
index 00000000000..7f27286a657
--- /dev/null
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/view.tsx
@@ -0,0 +1,41 @@
+'use client'
+
+import * as React from 'react'
+import ApikeyInfoPanel from '@/app/components/app/overview/apikey-info-panel'
+import { useStore as useAppStore } from '@/app/components/app/store'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { getAppACLCapabilities } from '@/utils/permission'
+import ChartView from './chart-view'
+import TracingPanel from './tracing/panel'
+
+type OverviewViewProps = {
+  appId: string
+}
+
+const OverviewView = ({ appId }: OverviewViewProps) => {
+  const appDetail = useAppStore(state => state.appDetail)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canMonitor = React.useMemo(() => getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  }).canMonitor, [appDetail?.maintainer, appDetail?.permission_keys, currentUserId, workspacePermissionKeys])
+
+  if (!appDetail || !canMonitor)
+    return null
+
+  return (
+    <div className="flex h-full min-h-0 flex-col">
+      <ApikeyInfoPanel />
+      <div className="min-h-0 flex-1">
+        <ChartView
+          appId={appId}
+          headerRight={<TracingPanel />}
+        />
+      </div>
+    </div>
+  )
+}
+
+export default OverviewView
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/style.module.css b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/style.module.css
deleted file mode 100644
index 45c7d197b40..00000000000
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/style.module.css
+++ /dev/null
@@ -1,6 +0,0 @@
-.app {
-    flex-grow: 1;
-    height: 0;
-    border-radius: 16px 16px 0px 0px;
-    box-shadow: 0px 0px 5px rgba(0, 0, 0, 0.05), 0px 0px 2px -1px rgba(0, 0, 0, 0.03);
-}
diff --git a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx
index 11ddc89b4cc..23a9672a220 100644
--- a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx
+++ b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx
@@ -1,6 +1,7 @@
 import { render, screen, waitFor } from '@testing-library/react'
-import { useRouter } from '@/next/navigation'
+import { usePathname, useRouter } from '@/next/navigation'
 import { useDatasetDetail } from '@/service/knowledge/use-dataset'
+import { DatasetACLPermission } from '@/utils/permission'
 import DatasetDetailLayout from '../layout-main'
 
 const mockReplace = vi.fn()
@@ -17,6 +18,10 @@ vi.mock('@/service/knowledge/use-dataset', () => ({
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceDatasetOperator: false,
+    isLoadingCurrentWorkspace: false,
+    isLoadingWorkspacePermissionKeys: false,
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
   }),
 }))
 
@@ -31,11 +36,13 @@ vi.mock('@/hooks/use-document-title', () => ({
 }))
 
 const mockUseRouter = vi.mocked(useRouter)
+const mockUsePathname = vi.mocked(usePathname)
 const mockUseDatasetDetail = vi.mocked(useDatasetDetail)
 
 describe('DatasetDetailLayout', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockUsePathname.mockReturnValue('/datasets/dataset-1/documents')
     mockUseRouter.mockReturnValue({
       back: vi.fn(),
       forward: vi.fn(),
@@ -118,5 +125,172 @@ describe('DatasetDetailLayout', () => {
       expect(screen.getByText('Pipeline content')).toBeInTheDocument()
       expect(mockReplace).not.toHaveBeenCalled()
     })
+
+    it('should apply the dataset surface outside pipeline pages', () => {
+      // Arrange
+      mockUseDatasetDetail.mockReturnValue({
+        data: {
+          id: 'dataset-1',
+          name: 'Dataset 1',
+          provider: 'vendor',
+          runtime_mode: 'rag_pipeline',
+          is_published: true,
+        },
+        error: null,
+        refetch: vi.fn(),
+      } as unknown as ReturnType<typeof useDatasetDetail>)
+
+      // Act
+      render(
+        <DatasetDetailLayout datasetId="dataset-1">
+          <div>Documents content</div>
+        </DatasetDetailLayout>,
+      )
+
+      // Assert
+      expect(screen.getByText('Documents content').parentElement).toHaveClass('rounded-lg')
+    })
+
+    it('should keep pipeline pages unframed', () => {
+      // Arrange
+      mockUsePathname.mockReturnValue('/datasets/dataset-1/pipeline')
+      mockUseDatasetDetail.mockReturnValue({
+        data: {
+          id: 'dataset-1',
+          name: 'Dataset 1',
+          provider: 'vendor',
+          runtime_mode: 'rag_pipeline',
+          is_published: false,
+        },
+        error: null,
+        refetch: vi.fn(),
+      } as unknown as ReturnType<typeof useDatasetDetail>)
+
+      // Act
+      render(
+        <DatasetDetailLayout datasetId="dataset-1">
+          <div>Pipeline content</div>
+        </DatasetDetailLayout>,
+      )
+
+      // Assert
+      expect(screen.getByText('Pipeline content').parentElement).not.toHaveClass('rounded-lg')
+    })
+
+    it('should keep create-from-pipeline pages unframed', () => {
+      // Arrange
+      mockUsePathname.mockReturnValue('/datasets/dataset-1/documents/create-from-pipeline')
+      mockUseDatasetDetail.mockReturnValue({
+        data: {
+          id: 'dataset-1',
+          name: 'Dataset 1',
+          provider: 'vendor',
+          runtime_mode: 'rag_pipeline',
+          is_published: false,
+        },
+        error: null,
+        refetch: vi.fn(),
+      } as unknown as ReturnType<typeof useDatasetDetail>)
+
+      // Act
+      render(
+        <DatasetDetailLayout datasetId="dataset-1">
+          <div>Create from pipeline content</div>
+        </DatasetDetailLayout>,
+      )
+
+      // Assert
+      expect(screen.getByText('Create from pipeline content').parentElement).not.toHaveClass('rounded-lg')
+    })
+  })
+
+  describe('Permission Route Guards', () => {
+    it('should redirect from hit testing when retrieval recall permission is missing', async () => {
+      // Arrange
+      mockUsePathname.mockReturnValue('/datasets/dataset-1/hitTesting')
+      mockUseDatasetDetail.mockReturnValue({
+        data: {
+          id: 'dataset-1',
+          name: 'Dataset 1',
+          provider: 'external',
+          runtime_mode: 'general',
+          is_published: true,
+          permission_keys: [],
+        },
+        error: null,
+        refetch: vi.fn(),
+      } as unknown as ReturnType<typeof useDatasetDetail>)
+
+      // Act
+      render(
+        <DatasetDetailLayout datasetId="dataset-1">
+          <div>Hit testing content</div>
+        </DatasetDetailLayout>,
+      )
+
+      // Assert
+      await waitFor(() => {
+        expect(mockReplace).toHaveBeenCalledWith('/datasets/dataset-1/settings')
+      })
+      expect(screen.queryByText('Hit testing content')).not.toBeInTheDocument()
+    })
+
+    it('should redirect from access config when access config permission is missing', async () => {
+      // Arrange
+      mockUsePathname.mockReturnValue('/datasets/dataset-1/access-config')
+      mockUseDatasetDetail.mockReturnValue({
+        data: {
+          id: 'dataset-1',
+          name: 'Dataset 1',
+          provider: 'vendor',
+          runtime_mode: 'general',
+          is_published: true,
+          permission_keys: [],
+        },
+        error: null,
+        refetch: vi.fn(),
+      } as unknown as ReturnType<typeof useDatasetDetail>)
+
+      // Act
+      render(
+        <DatasetDetailLayout datasetId="dataset-1">
+          <div>Access config content</div>
+        </DatasetDetailLayout>,
+      )
+
+      // Assert
+      await waitFor(() => {
+        expect(mockReplace).toHaveBeenCalledWith('/datasets/dataset-1/documents')
+      })
+      expect(screen.queryByText('Access config content')).not.toBeInTheDocument()
+    })
+
+    it('should render access config when access config permission is granted', () => {
+      // Arrange
+      mockUsePathname.mockReturnValue('/datasets/dataset-1/access-config')
+      mockUseDatasetDetail.mockReturnValue({
+        data: {
+          id: 'dataset-1',
+          name: 'Dataset 1',
+          provider: 'vendor',
+          runtime_mode: 'general',
+          is_published: true,
+          permission_keys: [DatasetACLPermission.AccessConfig],
+        },
+        error: null,
+        refetch: vi.fn(),
+      } as unknown as ReturnType<typeof useDatasetDetail>)
+
+      // Act
+      render(
+        <DatasetDetailLayout datasetId="dataset-1">
+          <div>Access config content</div>
+        </DatasetDetailLayout>,
+      )
+
+      // Assert
+      expect(screen.getByText('Access config content')).toBeInTheDocument()
+      expect(mockReplace).not.toHaveBeenCalled()
+    })
   })
 })
diff --git a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/access-config/__tests__/page.spec.tsx b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/access-config/__tests__/page.spec.tsx
new file mode 100644
index 00000000000..b1eec08101f
--- /dev/null
+++ b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/access-config/__tests__/page.spec.tsx
@@ -0,0 +1,24 @@
+import { render, screen } from '@testing-library/react'
+import AccessConfig from '../page'
+
+vi.mock('@/app/components/datasets/access-config', () => ({
+  default: ({ datasetId }: { datasetId: string }) => (
+    <div data-testid="dataset-access-config" data-dataset-id={datasetId}>
+      dataset access config
+      {datasetId}
+    </div>
+  ),
+}))
+
+describe('Dataset access config route', () => {
+  // Route rendering resolves the async dataset id params for the client page.
+  describe('Rendering', () => {
+    it('should pass dataset id from route params', async () => {
+      render(await AccessConfig({
+        params: Promise.resolve({ datasetId: 'dataset-route-id' }),
+      }))
+
+      expect(screen.getByTestId('dataset-access-config')).toHaveAttribute('data-dataset-id', 'dataset-route-id')
+    })
+  })
+})
diff --git a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/access-config/page.tsx b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/access-config/page.tsx
new file mode 100644
index 00000000000..66a809a795d
--- /dev/null
+++ b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/access-config/page.tsx
@@ -0,0 +1,15 @@
+import DatasetAccessConfigPage from '@/app/components/datasets/access-config'
+
+type Props = {
+  params: Promise<{ datasetId: string }>
+}
+
+const AccessConfig = async (props: Props) => {
+  const params = await props.params
+
+  const { datasetId } = params
+
+  return <DatasetAccessConfigPage datasetId={datasetId} />
+}
+
+export default AccessConfig
diff --git a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
index cbe5371477e..3791009061d 100644
--- a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
+++ b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
@@ -1,14 +1,17 @@
 'use client'
 import type { FC } from 'react'
+import type { DataSet } from '@/models/datasets'
 import { cn } from '@langgenius/dify-ui/cn'
 import * as React from 'react'
 import { useEffect } from 'react'
 import { useTranslation } from 'react-i18next'
 import Loading from '@/app/components/base/loading'
+import { useAppContext } from '@/context/app-context'
 import DatasetDetailContext from '@/context/dataset-detail'
 import useDocumentTitle from '@/hooks/use-document-title'
-import { useRouter } from '@/next/navigation'
+import { usePathname, useRouter } from '@/next/navigation'
 import { useDatasetDetail } from '@/service/knowledge/use-dataset'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 
 type IAppDetailLayoutProps = {
   children: React.ReactNode
@@ -28,6 +31,23 @@ const shouldRedirectToDatasetList = (error: unknown) => {
   return status === 403 || status === 404
 }
 
+const getDatasetRedirectionPath = (
+  dataset: DataSet,
+  datasetACLCapabilities: ReturnType<typeof getDatasetACLCapabilities>,
+) => {
+  if (dataset.provider === 'external') {
+    if (datasetACLCapabilities.canRetrievalRecall)
+      return `/datasets/${dataset.id}/hitTesting`
+
+    return `/datasets/${dataset.id}/settings`
+  }
+
+  if (dataset.runtime_mode === 'rag_pipeline' && !dataset.is_published)
+    return `/datasets/${dataset.id}/pipeline`
+
+  return `/datasets/${dataset.id}/documents`
+}
+
 const DatasetDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   const {
     children,
@@ -35,9 +55,33 @@ const DatasetDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   } = props
   const { t } = useTranslation()
   const router = useRouter()
+  const pathname = usePathname()
+  const {
+    isLoadingCurrentWorkspace,
+    isLoadingWorkspacePermissionKeys,
+    userProfile,
+    workspacePermissionKeys,
+  } = useAppContext()
 
   const { data: datasetRes, error, refetch: mutateDatasetRes } = useDatasetDetail(datasetId)
   const shouldRedirect = shouldRedirectToDatasetList(error)
+  const datasetACLCapabilities = React.useMemo(() => getDatasetACLCapabilities(datasetRes?.permission_keys, {
+    currentUserId: userProfile?.id,
+    resourceMaintainer: datasetRes?.maintainer,
+    workspacePermissionKeys,
+  }), [datasetRes?.maintainer, datasetRes?.permission_keys, userProfile?.id, workspacePermissionKeys])
+  const isAccessConfigPath = pathname.endsWith('/access-config')
+  const isHitTestingPath = pathname.endsWith('/hitTesting')
+  const isPermissionControlledPath = isAccessConfigPath || isHitTestingPath
+  const isCheckingRouteAccess = !!datasetRes
+    && isPermissionControlledPath
+    && (isLoadingCurrentWorkspace || !!isLoadingWorkspacePermissionKeys)
+  const shouldRedirectUnauthorizedRoute = !!datasetRes
+    && !isCheckingRouteAccess
+    && (
+      (isAccessConfigPath && !datasetACLCapabilities.canAccessConfig)
+      || (isHitTestingPath && !datasetACLCapabilities.canRetrievalRecall)
+    )
 
   useDocumentTitle(datasetRes?.name || t('menus.datasets', { ns: 'common' }))
 
@@ -46,17 +90,29 @@ const DatasetDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
       router.replace('/datasets')
   }, [router, shouldRedirect])
 
+  useEffect(() => {
+    if (!datasetRes || !shouldRedirectUnauthorizedRoute)
+      return
+
+    router.replace(getDatasetRedirectionPath(datasetRes, datasetACLCapabilities))
+  }, [datasetACLCapabilities, datasetRes, router, shouldRedirectUnauthorizedRoute])
+
   if (!datasetRes && !error)
     return <Loading type="app" />
 
   if (shouldRedirect)
     return <Loading type="app" />
 
+  if (isCheckingRouteAccess || shouldRedirectUnauthorizedRoute)
+    return <Loading type="app" />
+
+  const isPipelinePage = pathname.endsWith('/pipeline') || pathname.includes('/create-from-pipeline')
+
   return (
     <div
       className={cn(
-        'flex grow overflow-hidden',
-        'rounded-t-2xl',
+        'relative flex h-0 grow overflow-hidden',
+        !isPipelinePage && 'pt-1 pr-1 pb-1',
       )}
     >
       <DatasetDetailContext.Provider value={{
@@ -65,7 +121,13 @@ const DatasetDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
         mutateDatasetRes,
       }}
       >
-        <div className="grow overflow-hidden bg-background-default-subtle">{children}</div>
+        <div className={cn(
+          'grow overflow-hidden bg-components-panel-bg',
+          !isPipelinePage && 'rounded-lg shadow-xs shadow-shadow-shadow-3',
+        )}
+        >
+          {children}
+        </div>
       </DatasetDetailContext.Provider>
     </div>
   )
diff --git a/web/app/(commonLayout)/datasets/layout.spec.tsx b/web/app/(commonLayout)/datasets/layout.spec.tsx
index 7abc2253ce2..4db962ff301 100644
--- a/web/app/(commonLayout)/datasets/layout.spec.tsx
+++ b/web/app/(commonLayout)/datasets/layout.spec.tsx
@@ -5,15 +5,19 @@ import DatasetsLayout from './layout'
 
 const mockReplace = vi.fn()
 const mockUseAppContext = vi.fn()
+let mockPathname = '/datasets'
+let mockExternalKnowledgeApiProviderEnabled: boolean | undefined
 
 vi.mock('@/next/navigation', () => ({
   useRouter: () => ({
     replace: mockReplace,
   }),
+  usePathname: () => mockPathname,
 }))
 
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => mockUseAppContext(),
+  useSelector: (selector: (state: AppContextMock) => unknown) => selector(mockUseAppContext()),
 }))
 
 vi.mock('@/context/external-api-panel-context', () => ({
@@ -21,13 +25,18 @@ vi.mock('@/context/external-api-panel-context', () => ({
 }))
 
 vi.mock('@/context/external-knowledge-api-context', () => ({
-  ExternalKnowledgeApiProvider: ({ children }: { children: ReactNode }) => <>{children}</>,
+  ExternalKnowledgeApiProvider: ({ children, enabled }: { children: ReactNode, enabled?: boolean }) => {
+    mockExternalKnowledgeApiProviderEnabled = enabled
+    return <>{children}</>
+  },
 }))
 
 type AppContextMock = {
   isCurrentWorkspaceEditor: boolean
   isCurrentWorkspaceDatasetOperator: boolean
   isLoadingCurrentWorkspace: boolean
+  isLoadingWorkspacePermissionKeys: boolean
+  workspacePermissionKeys: string[]
   currentWorkspace: {
     id: string
   }
@@ -37,6 +46,8 @@ const baseContext: AppContextMock = {
   isCurrentWorkspaceEditor: true,
   isCurrentWorkspaceDatasetOperator: false,
   isLoadingCurrentWorkspace: false,
+  isLoadingWorkspacePermissionKeys: false,
+  workspacePermissionKeys: [],
   currentWorkspace: {
     id: 'workspace-1',
   },
@@ -52,6 +63,8 @@ const setAppContext = (overrides: Partial<AppContextMock> = {}) => {
 describe('DatasetsLayout', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockPathname = '/datasets'
+    mockExternalKnowledgeApiProviderEnabled = undefined
     setAppContext()
   })
 
@@ -72,10 +85,10 @@ describe('DatasetsLayout', () => {
     expect(mockReplace).not.toHaveBeenCalled()
   })
 
-  it('should redirect non-editor and non-dataset-operator users to /apps', async () => {
+  it('should render loading while workspace permission keys are loading', () => {
     setAppContext({
-      isCurrentWorkspaceEditor: false,
-      isCurrentWorkspaceDatasetOperator: false,
+      isLoadingWorkspacePermissionKeys: true,
+      workspacePermissionKeys: [],
     })
 
     render((
@@ -84,16 +97,16 @@ describe('DatasetsLayout', () => {
       </DatasetsLayout>
     ))
 
+    expect(screen.getByRole('status')).toBeInTheDocument()
     expect(screen.queryByText('datasets')).not.toBeInTheDocument()
-    await waitFor(() => {
-      expect(mockReplace).toHaveBeenCalledWith('/apps')
-    })
+    expect(mockReplace).not.toHaveBeenCalled()
   })
 
-  it('should render children for dataset operators', () => {
+  it('should render children without a page-level dataset permission', () => {
     setAppContext({
-      isCurrentWorkspaceEditor: false,
+      isCurrentWorkspaceEditor: true,
       isCurrentWorkspaceDatasetOperator: true,
+      workspacePermissionKeys: ['dataset.create_and_management', 'dataset.external.connect'],
     })
 
     render((
@@ -105,4 +118,120 @@ describe('DatasetsLayout', () => {
     expect(screen.getByText('datasets')).toBeInTheDocument()
     expect(mockReplace).not.toHaveBeenCalled()
   })
+
+  it('should render children on the dataset list route without dataset permissions', () => {
+    setAppContext({
+      isCurrentWorkspaceEditor: false,
+      isCurrentWorkspaceDatasetOperator: false,
+      workspacePermissionKeys: [],
+    })
+
+    render((
+      <DatasetsLayout>
+        <div>datasets</div>
+      </DatasetsLayout>
+    ))
+
+    expect(screen.getByText('datasets')).toBeInTheDocument()
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    '/datasets/create',
+    '/datasets/create-from-pipeline',
+  ])('should redirect direct dataset creation route to /datasets without dataset.create_and_management: %s', async (pathname) => {
+    mockPathname = pathname
+    setAppContext({
+      workspacePermissionKeys: [],
+    })
+
+    render((
+      <DatasetsLayout>
+        <div>datasets</div>
+      </DatasetsLayout>
+    ))
+
+    expect(screen.queryByText('datasets')).not.toBeInTheDocument()
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/datasets')
+    })
+  })
+
+  it('should render direct dataset creation route when workspace has dataset.create_and_management', () => {
+    mockPathname = '/datasets/create'
+    setAppContext({
+      workspacePermissionKeys: ['dataset.create_and_management'],
+    })
+
+    render((
+      <DatasetsLayout>
+        <div>datasets</div>
+      </DatasetsLayout>
+    ))
+
+    expect(screen.getByText('datasets')).toBeInTheDocument()
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+
+  it('should redirect direct external dataset connection route to /datasets without dataset.external.connect', async () => {
+    mockPathname = '/datasets/connect'
+    setAppContext({
+      workspacePermissionKeys: [],
+    })
+
+    render((
+      <DatasetsLayout>
+        <div>datasets</div>
+      </DatasetsLayout>
+    ))
+
+    expect(screen.queryByText('datasets')).not.toBeInTheDocument()
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/datasets')
+    })
+  })
+
+  it('should render direct external dataset connection route when workspace has dataset.external.connect', () => {
+    mockPathname = '/datasets/connect'
+    setAppContext({
+      workspacePermissionKeys: ['dataset.external.connect'],
+    })
+
+    render((
+      <DatasetsLayout>
+        <div>datasets</div>
+      </DatasetsLayout>
+    ))
+
+    expect(screen.getByText('datasets')).toBeInTheDocument()
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+
+  it('should disable external knowledge API queries without dataset.external.connect', () => {
+    setAppContext({
+      workspacePermissionKeys: [],
+    })
+
+    render((
+      <DatasetsLayout>
+        <div>datasets</div>
+      </DatasetsLayout>
+    ))
+
+    expect(mockExternalKnowledgeApiProviderEnabled).toBe(false)
+  })
+
+  it('should enable external knowledge API queries with dataset.external.connect', () => {
+    setAppContext({
+      workspacePermissionKeys: ['dataset.external.connect'],
+    })
+
+    render((
+      <DatasetsLayout>
+        <div>datasets</div>
+      </DatasetsLayout>
+    ))
+
+    expect(mockExternalKnowledgeApiProviderEnabled).toBe(true)
+  })
 })
diff --git a/web/app/(commonLayout)/datasets/layout.tsx b/web/app/(commonLayout)/datasets/layout.tsx
index a465f8222b0..8f6777dedfb 100644
--- a/web/app/(commonLayout)/datasets/layout.tsx
+++ b/web/app/(commonLayout)/datasets/layout.tsx
@@ -2,32 +2,53 @@
 
 import { useEffect } from 'react'
 import Loading from '@/app/components/base/loading'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextSelector } from '@/context/app-context'
 import { ExternalApiPanelProvider } from '@/context/external-api-panel-context'
 import { ExternalKnowledgeApiProvider } from '@/context/external-knowledge-api-context'
-import { useRouter } from '@/next/navigation'
+import { usePathname, useRouter } from '@/next/navigation'
+import { hasPermission } from '@/utils/permission'
+
+const isDatasetCreatePath = (pathname: string) => {
+  return pathname === '/datasets/create'
+    || pathname.startsWith('/datasets/create/')
+    || pathname === '/datasets/create-from-pipeline'
+    || pathname.startsWith('/datasets/create-from-pipeline/')
+}
+
+const isDatasetExternalConnectPath = (pathname: string) => {
+  return pathname === '/datasets/connect'
+    || pathname.startsWith('/datasets/connect/')
+}
 
 export default function DatasetsLayout({ children }: { children: React.ReactNode }) {
-  const { isCurrentWorkspaceEditor, isCurrentWorkspaceDatasetOperator, currentWorkspace, isLoadingCurrentWorkspace } = useAppContext()
+  const currentWorkspaceId = useAppContextSelector(state => state.currentWorkspace.id)
+  const isLoadingCurrentWorkspace = useAppContextSelector(state => state.isLoadingCurrentWorkspace)
+  const isLoadingWorkspacePermissionKeys = useAppContextSelector(state => state.isLoadingWorkspacePermissionKeys)
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
   const router = useRouter()
-  const shouldRedirect = !isLoadingCurrentWorkspace
-    && currentWorkspace.id
-    && !(isCurrentWorkspaceEditor || isCurrentWorkspaceDatasetOperator)
+  const pathname = usePathname()
+  const isLoadingAccess = isLoadingCurrentWorkspace || !!isLoadingWorkspacePermissionKeys
+  const canCreateDataset = hasPermission(workspacePermissionKeys, 'dataset.create_and_management')
+  const canConnectExternalDataset = hasPermission(workspacePermissionKeys, 'dataset.external.connect')
+  const shouldRedirectToDatasets = !isLoadingAccess
+    && !!currentWorkspaceId
+    && ((isDatasetCreatePath(pathname) && !canCreateDataset)
+      || (isDatasetExternalConnectPath(pathname) && !canConnectExternalDataset))
 
   useEffect(() => {
-    if (shouldRedirect)
-      router.replace('/apps')
-  }, [shouldRedirect, router])
+    if (shouldRedirectToDatasets)
+      router.replace('/datasets')
+  }, [shouldRedirectToDatasets, router])
 
-  if (isLoadingCurrentWorkspace || !currentWorkspace.id)
+  if (isLoadingAccess || !currentWorkspaceId)
     return <Loading type="app" />
 
-  if (shouldRedirect) {
+  if (shouldRedirectToDatasets) {
     return null
   }
 
   return (
-    <ExternalKnowledgeApiProvider>
+    <ExternalKnowledgeApiProvider enabled={canConnectExternalDataset}>
       <ExternalApiPanelProvider>
         {children}
       </ExternalApiPanelProvider>
diff --git a/web/app/(commonLayout)/deployments/[appInstanceId]/access/page.tsx b/web/app/(commonLayout)/deployments/[appInstanceId]/access/page.tsx
new file mode 100644
index 00000000000..5fa2ff42250
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/[appInstanceId]/access/page.tsx
@@ -0,0 +1,8 @@
+import { AccessTab } from '@/features/deployments/detail/access-tab'
+
+export default async function InstanceDetailAccessPage({ params }: {
+  params: Promise<{ appInstanceId: string }>
+}) {
+  const { appInstanceId } = await params
+  return <AccessTab appInstanceId={appInstanceId} />
+}
diff --git a/web/app/(commonLayout)/deployments/[appInstanceId]/api-tokens/page.tsx b/web/app/(commonLayout)/deployments/[appInstanceId]/api-tokens/page.tsx
new file mode 100644
index 00000000000..6fb643008ad
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/[appInstanceId]/api-tokens/page.tsx
@@ -0,0 +1,8 @@
+import { DeveloperApiTab } from '@/features/deployments/detail/developer-api-tab'
+
+export default async function InstanceDetailApiTokensPage({ params }: {
+  params: Promise<{ appInstanceId: string }>
+}) {
+  const { appInstanceId } = await params
+  return <DeveloperApiTab appInstanceId={appInstanceId} />
+}
diff --git a/web/app/(commonLayout)/deployments/[appInstanceId]/instances/page.tsx b/web/app/(commonLayout)/deployments/[appInstanceId]/instances/page.tsx
new file mode 100644
index 00000000000..d51bcfd5898
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/[appInstanceId]/instances/page.tsx
@@ -0,0 +1,8 @@
+import { DeployTab } from '@/features/deployments/detail/deploy-tab'
+
+export default async function InstanceDetailInstancesPage({ params }: {
+  params: Promise<{ appInstanceId: string }>
+}) {
+  const { appInstanceId } = await params
+  return <DeployTab appInstanceId={appInstanceId} />
+}
diff --git a/web/app/(commonLayout)/deployments/[appInstanceId]/layout.tsx b/web/app/(commonLayout)/deployments/[appInstanceId]/layout.tsx
new file mode 100644
index 00000000000..4e39b066201
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/[appInstanceId]/layout.tsx
@@ -0,0 +1,15 @@
+import type { ReactNode } from 'react'
+import { InstanceDetail } from '@/features/deployments/detail'
+
+export default async function InstanceDetailLayout({ children, params }: {
+  children: ReactNode
+  params: Promise<{ appInstanceId: string }>
+}) {
+  const { appInstanceId } = await params
+
+  return (
+    <InstanceDetail appInstanceId={appInstanceId}>
+      {children}
+    </InstanceDetail>
+  )
+}
diff --git a/web/app/(commonLayout)/deployments/[appInstanceId]/overview/page.tsx b/web/app/(commonLayout)/deployments/[appInstanceId]/overview/page.tsx
new file mode 100644
index 00000000000..7362d075a29
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/[appInstanceId]/overview/page.tsx
@@ -0,0 +1,8 @@
+import { OverviewTab } from '@/features/deployments/detail/overview-tab'
+
+export default async function InstanceDetailOverviewPage({ params }: {
+  params: Promise<{ appInstanceId: string }>
+}) {
+  const { appInstanceId } = await params
+  return <OverviewTab appInstanceId={appInstanceId} />
+}
diff --git a/web/app/(commonLayout)/deployments/[appInstanceId]/page.tsx b/web/app/(commonLayout)/deployments/[appInstanceId]/page.tsx
new file mode 100644
index 00000000000..b0ae57a3a87
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/[appInstanceId]/page.tsx
@@ -0,0 +1,8 @@
+import { redirect } from '@/next/navigation'
+
+export default async function InstanceDetailPage({ params }: {
+  params: Promise<{ appInstanceId: string }>
+}) {
+  const { appInstanceId } = await params
+  redirect(`/deployments/${appInstanceId}/overview`)
+}
diff --git a/web/app/(commonLayout)/deployments/[appInstanceId]/releases/page.tsx b/web/app/(commonLayout)/deployments/[appInstanceId]/releases/page.tsx
new file mode 100644
index 00000000000..ee5e689cc65
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/[appInstanceId]/releases/page.tsx
@@ -0,0 +1,8 @@
+import { VersionsTab } from '@/features/deployments/detail/versions-tab'
+
+export default async function InstanceDetailReleasesPage({ params }: {
+  params: Promise<{ appInstanceId: string }>
+}) {
+  const { appInstanceId } = await params
+  return <VersionsTab appInstanceId={appInstanceId} />
+}
diff --git a/web/app/(commonLayout)/deployments/create/page.tsx b/web/app/(commonLayout)/deployments/create/page.tsx
new file mode 100644
index 00000000000..1e85fbdffa7
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/create/page.tsx
@@ -0,0 +1,12 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+import { CreateDeploymentGuide } from '@/features/deployments/create-guide'
+import useDocumentTitle from '@/hooks/use-document-title'
+
+export default function CreateDeploymentPage() {
+  const { t } = useTranslation('deployments')
+  useDocumentTitle(t('documentTitle.create'))
+
+  return <CreateDeploymentGuide />
+}
diff --git a/web/app/(commonLayout)/deployments/layout.tsx b/web/app/(commonLayout)/deployments/layout.tsx
new file mode 100644
index 00000000000..eb522444778
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/layout.tsx
@@ -0,0 +1,13 @@
+import type { ReactNode } from 'react'
+import { DeployDrawer } from '@/features/deployments/deploy-drawer'
+
+export default function DeploymentsLayout({ children }: {
+  children: ReactNode
+}) {
+  return (
+    <>
+      {children}
+      <DeployDrawer />
+    </>
+  )
+}
diff --git a/web/app/(commonLayout)/deployments/page.tsx b/web/app/(commonLayout)/deployments/page.tsx
new file mode 100644
index 00000000000..753f0a1837f
--- /dev/null
+++ b/web/app/(commonLayout)/deployments/page.tsx
@@ -0,0 +1,10 @@
+'use client'
+import { useTranslation } from 'react-i18next'
+import { DeploymentsList } from '@/features/deployments/list'
+import useDocumentTitle from '@/hooks/use-document-title'
+
+export default function DeploymentsPage() {
+  const { t } = useTranslation('deployments')
+  useDocumentTitle(t('documentTitle.list'))
+  return <DeploymentsList />
+}
diff --git a/web/app/(commonLayout)/layout.tsx b/web/app/(commonLayout)/layout.tsx
index fa0ce21bbb8..4d6bdf7984c 100644
--- a/web/app/(commonLayout)/layout.tsx
+++ b/web/app/(commonLayout)/layout.tsx
@@ -16,9 +16,9 @@ import { ModalContextProvider } from '@/context/modal-context-provider'
 import { ProviderContextProvider } from '@/context/provider-context-provider'
 import PartnerStack from '../components/billing/partner-stack'
 import { CommonLayoutHydrationBoundary } from './hydration-boundary'
-import RoleRouteGuard from './role-route-guard'
+import { RoleRouteGuard } from './role-route-guard'
 
-const Layout = async ({ children }: { children: ReactNode }) => {
+export default async function Layout({ children }: { children: ReactNode }) {
   return (
     <>
       <GoogleAnalyticsScripts />
@@ -49,4 +49,3 @@ const Layout = async ({ children }: { children: ReactNode }) => {
     </>
   )
 }
-export default Layout
diff --git a/web/app/(commonLayout)/marketplace/__tests__/page.spec.tsx b/web/app/(commonLayout)/marketplace/__tests__/page.spec.tsx
index ea33cc0ddf1..f0d3eecda30 100644
--- a/web/app/(commonLayout)/marketplace/__tests__/page.spec.tsx
+++ b/web/app/(commonLayout)/marketplace/__tests__/page.spec.tsx
@@ -1,13 +1,18 @@
+import type { ReactNode } from 'react'
 import { render, screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import MarketplacePage from '../page'
 
 vi.mock('@/app/components/plugins/marketplace', () => ({
   default: ({ showInstallButton }: { showInstallButton?: boolean }) => (
-    <div data-show-install={String(showInstallButton ?? true)}>Marketplace</div>
+    <div data-show-install={String(!!showInstallButton)}>Marketplace</div>
   ),
 }))
 
+vi.mock('@/app/components/plugins/marketplace/marketplace-install-permission-provider', () => ({
+  default: ({ children }: { children: ReactNode }) => <>{children}</>,
+}))
+
 describe('MarketplacePage', () => {
   beforeEach(() => {
     vi.clearAllMocks()
diff --git a/web/app/(commonLayout)/marketplace/page.tsx b/web/app/(commonLayout)/marketplace/page.tsx
index 0d0232ae939..b87761b2bfa 100644
--- a/web/app/(commonLayout)/marketplace/page.tsx
+++ b/web/app/(commonLayout)/marketplace/page.tsx
@@ -1,5 +1,6 @@
 import type { SearchParams } from 'nuqs'
 import Marketplace from '@/app/components/plugins/marketplace'
+import MarketplaceInstallPermissionProvider from '@/app/components/plugins/marketplace/marketplace-install-permission-provider'
 
 type MarketplacePageProps = {
   searchParams?: Promise<SearchParams>
@@ -10,10 +11,13 @@ const MarketplacePage = ({
 }: MarketplacePageProps) => {
   return (
     <div id="marketplace-container" className="flex h-full min-h-0 flex-col overflow-y-auto bg-background-default-subtle pr-1">
-      <Marketplace
-        searchParams={searchParams}
-        isMarketplacePlatform
-      />
+      <MarketplaceInstallPermissionProvider>
+        <Marketplace
+          searchParams={searchParams}
+          isMarketplacePlatform
+          showInstallButton
+        />
+      </MarketplaceInstallPermissionProvider>
     </div>
   )
 }
diff --git a/web/app/(commonLayout)/plugins/page.tsx b/web/app/(commonLayout)/plugins/page.tsx
index f62512295b1..55dd57b7ea2 100644
--- a/web/app/(commonLayout)/plugins/page.tsx
+++ b/web/app/(commonLayout)/plugins/page.tsx
@@ -20,7 +20,7 @@ const PluginList = async ({
   return (
     <PluginPage
       plugins={<PluginsPanel />}
-      marketplace={<Marketplace pluginTypeSwitchClassName="top-[60px]" />}
+      marketplace={<Marketplace showInstallButton pluginTypeSwitchClassName="top-[60px]" />}
     />
   )
 }
diff --git a/web/app/(commonLayout)/role-route-guard.tsx b/web/app/(commonLayout)/role-route-guard.tsx
index 482a13c5d26..90526cbb3ca 100644
--- a/web/app/(commonLayout)/role-route-guard.tsx
+++ b/web/app/(commonLayout)/role-route-guard.tsx
@@ -1,29 +1,21 @@
 'use client'
 
 import type { ReactNode } from 'react'
-import { useQuery } from '@tanstack/react-query'
-import Loading from '@/app/components/base/loading'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { redirect, usePathname } from '@/next/navigation'
-import { consoleQuery } from '@/service/client'
 
-const datasetOperatorRedirectRoutes = ['/', '/apps', '/app', '/snippets', '/explore', '/tools', '/integrations'] as const
+function isPathUnderRoute(pathname: string, route: string) {
+  return pathname === route || pathname.startsWith(`${route}/`)
+}
 
-const isPathUnderRoute = (pathname: string, route: string) => pathname === route || pathname.startsWith(`${route}/`)
-
-export default function RoleRouteGuard({ children }: { children: ReactNode }) {
-  const currentWorkspaceRoleQuery = useQuery(consoleQuery.workspaces.current.post.queryOptions({
-    select: workspace => workspace.role,
-  }))
+export function RoleRouteGuard({ children }: { children: ReactNode }) {
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const pathname = usePathname()
-  const shouldGuardRoute = datasetOperatorRedirectRoutes.some(route => isPathUnderRoute(pathname, route))
-  const shouldRedirect = shouldGuardRoute && !currentWorkspaceRoleQuery.isPending && currentWorkspaceRoleQuery.data === 'dataset_operator'
+  const shouldRedirectAppDeploy = isPathUnderRoute(pathname, '/deployments') && !systemFeatures.enable_app_deploy
 
-  // Block rendering only for guarded routes to avoid permission flicker.
-  if (shouldGuardRoute && currentWorkspaceRoleQuery.isPending)
-    return <Loading type="app" />
-
-  if (shouldRedirect)
-    redirect('/datasets')
+  if (shouldRedirectAppDeploy)
+    redirect('/apps')
 
   return <>{children}</>
 }
diff --git a/web/app/(commonLayout)/roster/__tests__/feature-guard.spec.ts b/web/app/(commonLayout)/roster/__tests__/feature-guard.spec.ts
new file mode 100644
index 00000000000..343e0797776
--- /dev/null
+++ b/web/app/(commonLayout)/roster/__tests__/feature-guard.spec.ts
@@ -0,0 +1,41 @@
+const mocks = vi.hoisted(() => ({
+  agentV2Enabled: true,
+  notFound: vi.fn(() => {
+    throw new Error('NEXT_NOT_FOUND')
+  }),
+}))
+
+vi.mock('@/env', () => ({
+  env: {
+    get NEXT_PUBLIC_ENABLE_AGENT_V2() {
+      return mocks.agentV2Enabled
+    },
+  },
+}))
+
+vi.mock('@/next/navigation', () => ({
+  notFound: () => mocks.notFound(),
+}))
+
+describe('guardAgentV2Route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.agentV2Enabled = true
+  })
+
+  it('should allow roster routes when Agent v2 is enabled', async () => {
+    const { guardAgentV2Route } = await import('../feature-guard')
+
+    expect(() => guardAgentV2Route()).not.toThrow()
+    expect(mocks.notFound).not.toHaveBeenCalled()
+  })
+
+  it('should throw notFound when Agent v2 is disabled', async () => {
+    mocks.agentV2Enabled = false
+
+    const { guardAgentV2Route } = await import('../feature-guard')
+
+    expect(() => guardAgentV2Route()).toThrow('NEXT_NOT_FOUND')
+    expect(mocks.notFound).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/web/app/(commonLayout)/roster/__tests__/layout.spec.tsx b/web/app/(commonLayout)/roster/__tests__/layout.spec.tsx
new file mode 100644
index 00000000000..0d4dbc66dc2
--- /dev/null
+++ b/web/app/(commonLayout)/roster/__tests__/layout.spec.tsx
@@ -0,0 +1,43 @@
+import { render, screen } from '@testing-library/react'
+
+const mocks = vi.hoisted(() => ({
+  guardAgentV2Route: vi.fn(),
+}))
+
+vi.mock('../feature-guard', () => ({
+  guardAgentV2Route: () => mocks.guardAgentV2Route(),
+}))
+
+describe('RosterLayout', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('should render children when Agent v2 is enabled', async () => {
+    const { default: RosterLayout } = await import('../layout')
+
+    render(
+      <RosterLayout>
+        <div>Roster content</div>
+      </RosterLayout>,
+    )
+
+    expect(mocks.guardAgentV2Route).toHaveBeenCalledTimes(1)
+    expect(screen.getByText('Roster content')).toBeInTheDocument()
+  })
+
+  it('should block rendering when the roster guard throws notFound', async () => {
+    mocks.guardAgentV2Route.mockImplementation(() => {
+      throw new Error('NEXT_NOT_FOUND')
+    })
+
+    const { default: RosterLayout } = await import('../layout')
+
+    expect(() => render(
+      <RosterLayout>
+        <div>Roster content</div>
+      </RosterLayout>,
+    )).toThrow('NEXT_NOT_FOUND')
+    expect(mocks.guardAgentV2Route).toHaveBeenCalled()
+  })
+})
diff --git a/web/app/(commonLayout)/roster/agent/[agentId]/access/page.tsx b/web/app/(commonLayout)/roster/agent/[agentId]/access/page.tsx
new file mode 100644
index 00000000000..31d2fac8652
--- /dev/null
+++ b/web/app/(commonLayout)/roster/agent/[agentId]/access/page.tsx
@@ -0,0 +1,13 @@
+import { AgentDetailPage } from '@/features/agent-v2/agent-detail/page'
+
+type PageProps = {
+  params: Promise<{ agentId: string }>
+}
+
+export default async function Page({
+  params,
+}: PageProps) {
+  const { agentId } = await params
+
+  return <AgentDetailPage agentId={agentId} section="access" />
+}
diff --git a/web/app/(commonLayout)/roster/agent/[agentId]/configure/page.tsx b/web/app/(commonLayout)/roster/agent/[agentId]/configure/page.tsx
new file mode 100644
index 00000000000..a8a25ba6c3f
--- /dev/null
+++ b/web/app/(commonLayout)/roster/agent/[agentId]/configure/page.tsx
@@ -0,0 +1,13 @@
+import { AgentDetailPage } from '@/features/agent-v2/agent-detail/page'
+
+type PageProps = {
+  params: Promise<{ agentId: string }>
+}
+
+export default async function Page({
+  params,
+}: PageProps) {
+  const { agentId } = await params
+
+  return <AgentDetailPage agentId={agentId} section="configure" />
+}
diff --git a/web/app/(commonLayout)/roster/agent/[agentId]/layout.tsx b/web/app/(commonLayout)/roster/agent/[agentId]/layout.tsx
new file mode 100644
index 00000000000..384443d58bc
--- /dev/null
+++ b/web/app/(commonLayout)/roster/agent/[agentId]/layout.tsx
@@ -0,0 +1,20 @@
+import type { ReactNode } from 'react'
+import { AgentDetailLayout } from '@/features/agent-v2/agent-detail/layout'
+
+type LayoutProps = {
+  children: ReactNode
+  params: Promise<{ agentId: string }>
+}
+
+export default async function Layout({
+  children,
+  params,
+}: LayoutProps) {
+  const { agentId } = await params
+
+  return (
+    <AgentDetailLayout agentId={agentId}>
+      {children}
+    </AgentDetailLayout>
+  )
+}
diff --git a/web/app/(commonLayout)/roster/agent/[agentId]/logs/page.tsx b/web/app/(commonLayout)/roster/agent/[agentId]/logs/page.tsx
new file mode 100644
index 00000000000..1cbcd7bbd90
--- /dev/null
+++ b/web/app/(commonLayout)/roster/agent/[agentId]/logs/page.tsx
@@ -0,0 +1,13 @@
+import { AgentDetailPage } from '@/features/agent-v2/agent-detail/page'
+
+type PageProps = {
+  params: Promise<{ agentId: string }>
+}
+
+export default async function Page({
+  params,
+}: PageProps) {
+  const { agentId } = await params
+
+  return <AgentDetailPage agentId={agentId} section="logs" />
+}
diff --git a/web/app/(commonLayout)/roster/agent/[agentId]/monitoring/page.tsx b/web/app/(commonLayout)/roster/agent/[agentId]/monitoring/page.tsx
new file mode 100644
index 00000000000..ad61db5f8b8
--- /dev/null
+++ b/web/app/(commonLayout)/roster/agent/[agentId]/monitoring/page.tsx
@@ -0,0 +1,13 @@
+import { AgentDetailPage } from '@/features/agent-v2/agent-detail/page'
+
+type PageProps = {
+  params: Promise<{ agentId: string }>
+}
+
+export default async function Page({
+  params,
+}: PageProps) {
+  const { agentId } = await params
+
+  return <AgentDetailPage agentId={agentId} section="monitoring" />
+}
diff --git a/web/app/(commonLayout)/roster/agent/[agentId]/page.tsx b/web/app/(commonLayout)/roster/agent/[agentId]/page.tsx
new file mode 100644
index 00000000000..470fa13f12c
--- /dev/null
+++ b/web/app/(commonLayout)/roster/agent/[agentId]/page.tsx
@@ -0,0 +1,13 @@
+import { redirect } from '@/next/navigation'
+
+type PageProps = {
+  params: Promise<{ agentId: string }>
+}
+
+export default async function Page({
+  params,
+}: PageProps) {
+  const { agentId } = await params
+
+  redirect(`/roster/agent/${agentId}/configure`)
+}
diff --git a/web/app/(commonLayout)/roster/feature-guard.ts b/web/app/(commonLayout)/roster/feature-guard.ts
new file mode 100644
index 00000000000..41f74b6696e
--- /dev/null
+++ b/web/app/(commonLayout)/roster/feature-guard.ts
@@ -0,0 +1,7 @@
+import { env } from '@/env'
+import { notFound } from '@/next/navigation'
+
+export const guardAgentV2Route = () => {
+  if (!env.NEXT_PUBLIC_ENABLE_AGENT_V2)
+    notFound()
+}
diff --git a/web/app/(commonLayout)/roster/layout.tsx b/web/app/(commonLayout)/roster/layout.tsx
new file mode 100644
index 00000000000..be88ab89e2c
--- /dev/null
+++ b/web/app/(commonLayout)/roster/layout.tsx
@@ -0,0 +1,12 @@
+import type { ReactNode } from 'react'
+import { guardAgentV2Route } from './feature-guard'
+
+export default function Layout({
+  children,
+}: {
+  children: ReactNode
+}) {
+  guardAgentV2Route()
+
+  return children
+}
diff --git a/web/app/(commonLayout)/roster/page.tsx b/web/app/(commonLayout)/roster/page.tsx
new file mode 100644
index 00000000000..fff610b6448
--- /dev/null
+++ b/web/app/(commonLayout)/roster/page.tsx
@@ -0,0 +1,5 @@
+import RosterPage from '@/features/agent-v2/roster/page'
+
+export default function Page() {
+  return <RosterPage />
+}
diff --git a/web/app/(shareLayout)/agent/[token]/page.tsx b/web/app/(shareLayout)/agent/[token]/page.tsx
new file mode 100644
index 00000000000..5dc2777c9c4
--- /dev/null
+++ b/web/app/(shareLayout)/agent/[token]/page.tsx
@@ -0,0 +1,15 @@
+'use client'
+
+import * as React from 'react'
+import ChatWithHistoryWrap from '@/app/components/base/chat/chat-with-history'
+import AuthenticatedLayout from '../../components/authenticated-layout'
+
+function Agent() {
+  return (
+    <AuthenticatedLayout>
+      <ChatWithHistoryWrap />
+    </AuthenticatedLayout>
+  )
+}
+
+export default React.memo(Agent)
diff --git a/web/app/(shareLayout)/components/__tests__/authenticated-layout.spec.tsx b/web/app/(shareLayout)/components/__tests__/authenticated-layout.spec.tsx
index 26abb993847..9768daf58be 100644
--- a/web/app/(shareLayout)/components/__tests__/authenticated-layout.spec.tsx
+++ b/web/app/(shareLayout)/components/__tests__/authenticated-layout.spec.tsx
@@ -84,7 +84,7 @@ vi.mock('@/service/use-share', () => ({
   useGetWebAppMeta: () => appMetaQueryState,
 }))
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useGetUserCanAccessApp: () => userCanAccessAppQueryState,
 }))
 
diff --git a/web/app/(shareLayout)/components/authenticated-layout.tsx b/web/app/(shareLayout)/components/authenticated-layout.tsx
index 9cc7ea76012..ae2466146c3 100644
--- a/web/app/(shareLayout)/components/authenticated-layout.tsx
+++ b/web/app/(shareLayout)/components/authenticated-layout.tsx
@@ -7,7 +7,7 @@ import AppUnavailable from '@/app/components/base/app-unavailable'
 import Loading from '@/app/components/base/loading'
 import { useWebAppStore } from '@/context/web-app-context'
 import { usePathname, useRouter, useSearchParams } from '@/next/navigation'
-import { useGetUserCanAccessApp } from '@/service/access-control'
+import { useGetUserCanAccessApp } from '@/service/access-control/use-app-access-control'
 import { useGetWebAppInfo, useGetWebAppMeta, useGetWebAppParams } from '@/service/use-share'
 import { webAppLogout } from '@/service/webapp-auth'
 
diff --git a/web/app/(shareLayout)/webapp-reset-password/page.tsx b/web/app/(shareLayout)/webapp-reset-password/page.tsx
index d905f8d2135..d21729ab59d 100644
--- a/web/app/(shareLayout)/webapp-reset-password/page.tsx
+++ b/web/app/(shareLayout)/webapp-reset-password/page.tsx
@@ -6,7 +6,7 @@ import { noop } from 'es-toolkit/function'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Input from '@/app/components/base/input'
-import { COUNT_DOWN_KEY, COUNT_DOWN_TIME_MS } from '@/app/components/signin/countdown'
+import { COUNT_DOWN_TIME_MS, useSetCountdownLeftTime } from '@/app/components/signin/storage'
 import { emailRegex } from '@/config'
 import { useLocale } from '@/context/i18n'
 import useDocumentTitle from '@/hooks/use-document-title'
@@ -23,6 +23,7 @@ export default function CheckCode() {
   const [email, setEmail] = useState('')
   const [loading, setIsLoading] = useState(false)
   const locale = useLocale()
+  const setCountdownLeftTime = useSetCountdownLeftTime()
 
   const handleGetEMailVerificationCode = async () => {
     try {
@@ -38,7 +39,7 @@ export default function CheckCode() {
       setIsLoading(true)
       const res = await sendResetPasswordCode(email, locale)
       if (res.result === 'success') {
-        localStorage.setItem(COUNT_DOWN_KEY, `${COUNT_DOWN_TIME_MS}`)
+        setCountdownLeftTime(`${COUNT_DOWN_TIME_MS}`)
         const params = new URLSearchParams(searchParams)
         params.set('token', encodeURIComponent(res.data))
         params.set('email', encodeURIComponent(email))
diff --git a/web/app/(shareLayout)/webapp-signin/components/mail-and-code-auth.tsx b/web/app/(shareLayout)/webapp-signin/components/mail-and-code-auth.tsx
index 2d2fde18085..f5f66604283 100644
--- a/web/app/(shareLayout)/webapp-signin/components/mail-and-code-auth.tsx
+++ b/web/app/(shareLayout)/webapp-signin/components/mail-and-code-auth.tsx
@@ -4,7 +4,7 @@ import { noop } from 'es-toolkit/function'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Input from '@/app/components/base/input'
-import { COUNT_DOWN_KEY, COUNT_DOWN_TIME_MS } from '@/app/components/signin/countdown'
+import { COUNT_DOWN_TIME_MS, useSetCountdownLeftTime } from '@/app/components/signin/storage'
 import { emailRegex } from '@/config'
 import { useLocale } from '@/context/i18n'
 import { useRouter, useSearchParams } from '@/next/navigation'
@@ -18,6 +18,7 @@ export default function MailAndCodeAuth() {
   const [email, setEmail] = useState(emailFromLink)
   const [loading, setIsLoading] = useState(false)
   const locale = useLocale()
+  const setCountdownLeftTime = useSetCountdownLeftTime()
 
   const handleGetEMailVerificationCode = async () => {
     try {
@@ -33,7 +34,7 @@ export default function MailAndCodeAuth() {
       setIsLoading(true)
       const ret = await sendWebAppEMailLoginCode(email, locale)
       if (ret.result === 'success') {
-        localStorage.setItem(COUNT_DOWN_KEY, `${COUNT_DOWN_TIME_MS}`)
+        setCountdownLeftTime(`${COUNT_DOWN_TIME_MS}`)
         const params = new URLSearchParams(searchParams)
         params.set('email', encodeURIComponent(email))
         params.set('token', encodeURIComponent(ret.data))
diff --git a/web/app/account/(commonLayout)/delete-account/index.tsx b/web/app/account/(commonLayout)/delete-account/index.tsx
index e4af24e8bfc..0baf6e798e6 100644
--- a/web/app/account/(commonLayout)/delete-account/index.tsx
+++ b/web/app/account/(commonLayout)/delete-account/index.tsx
@@ -2,7 +2,7 @@
 import { Dialog, DialogContent, DialogTitle } from '@langgenius/dify-ui/dialog'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { COUNT_DOWN_KEY, COUNT_DOWN_TIME_MS } from '@/app/components/signin/countdown'
+import { COUNT_DOWN_TIME_MS, useSetCountdownLeftTime } from '@/app/components/signin/storage'
 import CheckEmail from './components/check-email'
 import FeedBack from './components/feed-back'
 import VerifyEmail from './components/verify-email'
@@ -14,6 +14,7 @@ type DeleteAccountProps = {
 
 export default function DeleteAccount(props: DeleteAccountProps) {
   const { t } = useTranslation()
+  const setCountdownLeftTime = useSetCountdownLeftTime()
 
   const [showVerifyEmail, setShowVerifyEmail] = useState(false)
   const [showFeedbackDialog, setShowFeedbackDialog] = useState(false)
@@ -21,10 +22,10 @@ export default function DeleteAccount(props: DeleteAccountProps) {
   const handleEmailCheckSuccess = useCallback(async () => {
     try {
       setShowVerifyEmail(true)
-      localStorage.setItem(COUNT_DOWN_KEY, `${COUNT_DOWN_TIME_MS}`)
+      setCountdownLeftTime(`${COUNT_DOWN_TIME_MS}`)
     }
     catch (error) { console.error(error) }
-  }, [])
+  }, [setCountdownLeftTime])
 
   if (showFeedbackDialog)
     return <FeedBack onCancel={props.onCancel} onConfirm={props.onConfirm} />
diff --git a/web/app/components/__tests__/education-verify-action-recorder.spec.tsx b/web/app/components/__tests__/education-verify-action-recorder.spec.tsx
index d93dc90c2ac..fa885814458 100644
--- a/web/app/components/__tests__/education-verify-action-recorder.spec.tsx
+++ b/web/app/components/__tests__/education-verify-action-recorder.spec.tsx
@@ -12,8 +12,8 @@ vi.mock('@/next/navigation', () => ({
   useSearchParams: vi.fn(),
 }))
 
-vi.mock('foxact/use-local-storage', () => ({
-  useSetLocalStorage: () => setEducationVerifyingMock,
+vi.mock('@/app/education-apply/storage', () => ({
+  useSetEducationVerifying: () => setEducationVerifyingMock,
 }))
 
 const mockUseSearchParams = vi.mocked(useSearchParams)
diff --git a/web/app/components/access-rules-editor/__tests__/index.spec.tsx b/web/app/components/access-rules-editor/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..abb6508afa1
--- /dev/null
+++ b/web/app/components/access-rules-editor/__tests__/index.spec.tsx
@@ -0,0 +1,290 @@
+import type { AccessPolicyWithBindings, ResourceUserAccessSetting } from '@/models/access-control'
+import type { Member } from '@/models/common'
+import { fireEvent, render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import AccessRulesEditor from '../index'
+
+const mockMembers = vi.hoisted(() => ({
+  accounts: [] as Member[] | null,
+  isLoading: false,
+}))
+
+vi.mock('@/service/use-common', () => ({
+  useMembers: vi.fn(() => ({
+    data: { accounts: mockMembers.accounts },
+    isLoading: mockMembers.isLoading,
+  })),
+}))
+
+const createRule = (resourceType: 'app' | 'dataset'): AccessPolicyWithBindings => ({
+  policy: {
+    id: `${resourceType}-policy-id`,
+    tenant_id: 'tenant-id',
+    resource_type: resourceType,
+    policy_key: `${resourceType}-policy-key`,
+    name: `${resourceType} policy`,
+    description: `${resourceType} policy description`,
+    permission_keys: [],
+    is_builtin: false,
+    category: 'global_custom',
+    created_at: '2026-05-22T00:00:00Z',
+    updated_at: '2026-05-22T00:00:00Z',
+  },
+  roles: [],
+  accounts: [],
+})
+
+const createUserAccessSetting = (): ResourceUserAccessSetting => ({
+  account: {
+    account_id: 'account-1',
+    account_name: 'Evan',
+    email: 'evan@example.com',
+  },
+  roles: [{
+    id: 'role-1',
+    type: 'app',
+    category: 'global_custom',
+    name: 'Maintainer',
+    is_builtin: false,
+    permission_keys: [],
+  }],
+  access_policies: [{
+    id: 'app-policy-id',
+    tenant_id: 'tenant-id',
+    resource_type: 'app',
+    policy_key: 'app-policy-key',
+    name: 'Manage',
+    description: 'Can manage this app',
+    permission_keys: [],
+    is_builtin: false,
+    category: 'global_custom',
+  }],
+})
+
+const createDefaultUserAccessSetting = (): ResourceUserAccessSetting => ({
+  ...createUserAccessSetting(),
+  access_policies: [],
+})
+
+const createMember = (overrides: Partial<Member> = {}): Member => ({
+  id: 'account-2',
+  name: 'Mia',
+  email: 'mia@example.com',
+  avatar: '',
+  avatar_url: '',
+  status: 'active',
+  role: 'normal',
+  roles: [],
+  ...overrides,
+} as Member)
+
+describe('AccessRulesEditor', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockMembers.accounts = []
+    mockMembers.isLoading = false
+  })
+
+  it('should render loading state before empty or row content', () => {
+    render(
+      <AccessRulesEditor
+        rules={[]}
+        userAccessSettings={[]}
+        isLoadingRules
+        isLoadingUserAccessSettings={false}
+        openScope="specific"
+        isUpdatingOpenScope={false}
+        updatingAccountId={null}
+      />,
+    )
+
+    expect(screen.getByRole('status', { name: 'appApi.loading' })).toBeInTheDocument()
+    expect(screen.queryByText('permission.accessRule.noUserAccessSettings')).not.toBeInTheDocument()
+  })
+
+  it('should render empty state when there are no user access settings', () => {
+    render(
+      <AccessRulesEditor
+        rules={[]}
+        userAccessSettings={[]}
+        isLoadingRules={false}
+        isLoadingUserAccessSettings={false}
+        openScope="specific"
+        isUpdatingOpenScope={false}
+        updatingAccountId={null}
+      />,
+    )
+
+    expect(screen.getByText('permission.accessRule.noUserAccessSettings')).toBeInTheDocument()
+  })
+
+  it('should disable resource access controls before open scope is available', () => {
+    render(
+      <AccessRulesEditor
+        rules={[]}
+        userAccessSettings={[]}
+        isLoadingRules={false}
+        isLoadingUserAccessSettings={false}
+        isUpdatingOpenScope={false}
+        updatingAccountId={null}
+      />,
+    )
+
+    expect(screen.getByText('permission.accessRule.resourceOpenScope')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'permission.accessRule.resourceOpenScopeDescription' })).toBeInTheDocument()
+
+    const allMembersButton = screen.getByRole('button', { name: /permission\.accessRule\.allPermittedMembers/ })
+    const specificMembersButton = screen.getByRole('button', { name: /permission\.accessRule\.specificMembersOnly/ })
+    expect(allMembersButton).toBeDisabled()
+    expect(specificMembersButton).toBeDisabled()
+    expect(allMembersButton).toHaveAttribute('aria-pressed', 'false')
+    expect(specificMembersButton).toHaveAttribute('aria-pressed', 'false')
+  })
+
+  it('should render resource access controls and update account exceptions', () => {
+    const onOpenScopeChange = vi.fn()
+    const onUserAccessPoliciesChange = vi.fn()
+    const onRemoveAccessPolicyMemberBinding = vi.fn()
+
+    render(
+      <AccessRulesEditor
+        rules={[createRule('app')]}
+        userAccessSettings={[createUserAccessSetting()]}
+        isLoadingRules={false}
+        isLoadingUserAccessSettings={false}
+        openScope="specific"
+        isUpdatingOpenScope={false}
+        updatingAccountId={null}
+        onOpenScopeChange={onOpenScopeChange}
+        onUserAccessPoliciesChange={onUserAccessPoliciesChange}
+        onRemoveAccessPolicyMemberBinding={onRemoveAccessPolicyMemberBinding}
+      />,
+    )
+
+    expect(screen.getByText('permission.accessRule.resourceOpenScope')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /permission\.accessRule\.specificMembersOnly/ })).toHaveAttribute('aria-pressed', 'true')
+    expect(screen.getByText('permission.accessRule.individualPermissionSettings')).toBeInTheDocument()
+    expect(screen.getByText('Evan')).toBeInTheDocument()
+    expect(screen.getByText('evan@example.com')).toBeInTheDocument()
+    expect(screen.queryByText('Maintainer')).not.toBeInTheDocument()
+    expect(screen.getAllByText('Manage').length).toBeGreaterThan(0)
+
+    fireEvent.click(screen.getByRole('button', { name: /permission\.accessRule\.allPermittedMembers/ }))
+    expect(onOpenScopeChange).not.toHaveBeenCalled()
+    expect(screen.getByText('permission.accessRule.changeOpenScopeTitle')).toBeInTheDocument()
+    expect(screen.getByText('permission.accessRule.changeOpenScopeDescription')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'common.operation.change' }))
+    expect(onOpenScopeChange).toHaveBeenCalledWith('all')
+
+    fireEvent.click(screen.getByRole('button', { name: 'common.operation.remove' }))
+    expect(onRemoveAccessPolicyMemberBinding).toHaveBeenCalledWith('account-1', 'app-policy-id')
+  })
+
+  it('should render the fixed default option when an account has no exception policy', () => {
+    render(
+      <AccessRulesEditor
+        rules={[createRule('app')]}
+        userAccessSettings={[createDefaultUserAccessSetting()]}
+        isLoadingRules={false}
+        isLoadingUserAccessSettings={false}
+        openScope="specific"
+        isUpdatingOpenScope={false}
+        updatingAccountId={null}
+      />,
+    )
+
+    expect(screen.getByText('permission.accessRule.defaultPermission')).toBeInTheDocument()
+  })
+
+  it('should mark maintainer rows and prevent editing them', () => {
+    const onUserAccessPoliciesChange = vi.fn()
+    const onRemoveAccessPolicyMemberBinding = vi.fn()
+
+    render(
+      <AccessRulesEditor
+        rules={[createRule('app')]}
+        userAccessSettings={[createUserAccessSetting()]}
+        isLoadingRules={false}
+        isLoadingUserAccessSettings={false}
+        openScope="specific"
+        isUpdatingOpenScope={false}
+        updatingAccountId={null}
+        maintainerId="account-1"
+        onUserAccessPoliciesChange={onUserAccessPoliciesChange}
+        onRemoveAccessPolicyMemberBinding={onRemoveAccessPolicyMemberBinding}
+      />,
+    )
+
+    expect(screen.getByText('permission.accessRule.maintainer')).toBeInTheDocument()
+    expect(screen.getByLabelText(/permission\.accessRule\.exceptionPermissionFor/)).toBeDisabled()
+
+    const removeButton = screen.getByRole('button', { name: 'common.operation.remove' })
+    expect(removeButton).toBeDisabled()
+
+    fireEvent.click(removeButton)
+    expect(onUserAccessPoliciesChange).not.toHaveBeenCalled()
+    expect(onRemoveAccessPolicyMemberBinding).not.toHaveBeenCalled()
+  })
+
+  it('should keep open scope unchanged when the confirmation is cancelled', () => {
+    const onOpenScopeChange = vi.fn()
+
+    render(
+      <AccessRulesEditor
+        rules={[]}
+        userAccessSettings={[]}
+        isLoadingRules={false}
+        isLoadingUserAccessSettings={false}
+        openScope="specific"
+        isUpdatingOpenScope={false}
+        updatingAccountId={null}
+        onOpenScopeChange={onOpenScopeChange}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /permission\.accessRule\.allPermittedMembers/ }))
+    fireEvent.click(screen.getByRole('button', { name: 'common.operation.cancel' }))
+
+    expect(onOpenScopeChange).not.toHaveBeenCalled()
+  })
+
+  it('should add unassigned members with default permission', async () => {
+    const user = userEvent.setup()
+    const onAddAccessSubject = vi.fn()
+    mockMembers.accounts = [
+      createMember({
+        id: 'account-1',
+        name: 'Evan',
+        email: 'evan@example.com',
+      }),
+      createMember(),
+    ]
+
+    render(
+      <AccessRulesEditor
+        rules={[]}
+        userAccessSettings={[createUserAccessSetting()]}
+        isLoadingRules={false}
+        isLoadingUserAccessSettings={false}
+        openScope="specific"
+        isUpdatingOpenScope={false}
+        updatingAccountId={null}
+        onAddAccessSubject={onAddAccessSubject}
+      />,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'common.operation.add' }))
+
+    const dialog = screen.getByRole('dialog', { name: 'permission.accessRule.addMembersTitle' })
+    expect(within(dialog).getByText('Evan')).toBeInTheDocument()
+    expect(within(dialog).getByRole('button', { name: 'common.operation.added' })).toBeDisabled()
+    expect(within(dialog).queryByRole('button', { name: 'permission.accessRule.addMemberAria:{"name":"Evan"}' })).not.toBeInTheDocument()
+    expect(within(dialog).getByText('Mia')).toBeInTheDocument()
+    expect(within(dialog).queryByRole('tablist')).not.toBeInTheDocument()
+
+    await user.click(within(dialog).getByRole('button', { name: 'permission.accessRule.addMemberAria:{"name":"Mia"}' }))
+
+    expect(onAddAccessSubject).toHaveBeenCalledWith('account-2', ['default'])
+  })
+})
diff --git a/web/app/components/access-rules-editor/add-access-subject-popover.tsx b/web/app/components/access-rules-editor/add-access-subject-popover.tsx
new file mode 100644
index 00000000000..68e26f4b8f2
--- /dev/null
+++ b/web/app/components/access-rules-editor/add-access-subject-popover.tsx
@@ -0,0 +1,181 @@
+'use client'
+
+import type { ResourceUserAccessSetting } from '@/models/access-control'
+import type { Member } from '@/models/common'
+import { Avatar } from '@langgenius/dify-ui/avatar'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Input } from '@langgenius/dify-ui/input'
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from '@langgenius/dify-ui/popover'
+import { memo, useCallback, useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import { useMembers } from '@/service/use-common'
+import { DEFAULT_ACCESS_POLICY_ID } from './constants'
+
+type AddAccessSubjectPopoverProps = {
+  userAccessSettings: ResourceUserAccessSetting[]
+  updatingAccountId: string | null
+  onAddAccessSubject: (accountId: string, accessPolicyIds: string[]) => void
+}
+
+function AddAccessSubjectPopover({
+  userAccessSettings,
+  updatingAccountId,
+  onAddAccessSubject,
+}: AddAccessSubjectPopoverProps) {
+  const { t } = useTranslation()
+  const [open, setOpen] = useState(false)
+  const [searchValue, setSearchValue] = useState('')
+  const { data: membersData, isLoading } = useMembers()
+  const existingAccountIds = useMemo(() => {
+    return new Set(userAccessSettings.map(setting => setting.account.account_id))
+  }, [userAccessSettings])
+  const availableMembers = useMemo(() => {
+    const normalizedSearchValue = searchValue.trim().toLowerCase()
+
+    return (membersData?.accounts ?? []).filter((member) => {
+      if (!normalizedSearchValue)
+        return true
+
+      const name = member.name || ''
+      const email = member.email || ''
+      return name.toLowerCase().includes(normalizedSearchValue)
+        || email.toLowerCase().includes(normalizedSearchValue)
+    })
+  }, [membersData?.accounts, searchValue])
+
+  const handleAddMember = useCallback((member: Member) => {
+    onAddAccessSubject(member.id, [DEFAULT_ACCESS_POLICY_ID])
+  }, [onAddAccessSubject])
+
+  const handleOpenChange = useCallback((nextOpen: boolean) => {
+    if (!nextOpen)
+      setSearchValue('')
+
+    setOpen(nextOpen)
+  }, [])
+
+  const addLabel = t('operation.add', { ns: 'common' })
+  const addedLabel = t('operation.added', { ns: 'common' })
+
+  return (
+    <Popover open={open} onOpenChange={handleOpenChange}>
+      <PopoverTrigger
+        render={(
+          <Button
+            variant="primary"
+            size="medium"
+          >
+            <span className="i-ri-add-line size-3.5" aria-hidden />
+            <span>{addLabel}</span>
+          </Button>
+        )}
+      />
+      <PopoverContent
+        placement="bottom-end"
+        sideOffset={8}
+        popupClassName="w-[344px] max-w-[calc(100vw-32px)] overflow-hidden bg-components-panel-bg-blur p-0 shadow-lg backdrop-blur-[5px]"
+        popupProps={{
+          'role': 'dialog',
+          'aria-label': t('accessRule.addMembersTitle', { ns: 'permission' }),
+        }}
+      >
+        <div className="p-2 pb-1">
+          <div className="relative">
+            <span className="pointer-events-none absolute top-1/2 left-2 i-ri-search-line size-4 -translate-y-1/2 text-components-input-text-placeholder" aria-hidden="true" />
+            <Input
+              type="search"
+              aria-label={t('operation.search', { ns: 'common' })}
+              value={searchValue}
+              placeholder={t('placeholder.search', { ns: 'common' })}
+              className="h-8 ps-7 [&::-webkit-search-cancel-button]:appearance-none [&::-webkit-search-decoration]:appearance-none"
+              onValueChange={setSearchValue}
+              autoComplete="off"
+              enterKeyHint="search"
+            />
+          </div>
+        </div>
+        {isLoading
+          ? (
+              <div className="flex h-20 items-center justify-center p-1">
+                <Loading type="app" />
+              </div>
+            )
+          : availableMembers.length === 0
+            ? (
+                <div className="px-3 py-6 text-center system-xs-regular text-text-tertiary">
+                  {t('accessRule.noAvailableMembers', { ns: 'permission' })}
+                </div>
+              )
+            : (
+                <ul className="max-h-80 overflow-y-auto p-1">
+                  {availableMembers.map((member) => {
+                    const isAdded = existingAccountIds.has(member.id)
+                    const isUpdating = updatingAccountId === member.id
+                    const memberName = member.name || member.email
+
+                    return (
+                      <li
+                        key={member.id}
+                        className={cn(
+                          'flex min-h-10 items-center gap-2 rounded-lg py-1 pr-3 pl-2',
+                          !isAdded && 'hover:bg-state-base-hover',
+                        )}
+                      >
+                        <Avatar
+                          avatar={member.avatar_url ?? member.avatar ?? null}
+                          name={memberName}
+                          size="sm"
+                          className={cn('bg-components-icon-bg-blue-solid', isAdded && 'opacity-50')}
+                        />
+                        <div className={cn('min-w-0 flex-1', isAdded && 'opacity-50')}>
+                          <div className="truncate system-sm-medium text-text-secondary">
+                            {memberName}
+                          </div>
+                          <div className="truncate system-xs-regular text-text-tertiary">
+                            {member.email}
+                          </div>
+                        </div>
+                        {isAdded
+                          ? (
+                              <button
+                                type="button"
+                                disabled
+                                className="shrink-0 cursor-not-allowed border-0 bg-transparent p-0 system-xs-regular text-text-tertiary disabled:opacity-100"
+                              >
+                                {addedLabel}
+                              </button>
+                            )
+                          : (
+                              <button
+                                type="button"
+                                disabled={isUpdating}
+                                aria-label={t('accessRule.addMemberAria', { ns: 'permission', name: memberName })}
+                                className={cn(
+                                  'flex h-6 shrink-0 items-center rounded-md px-1 system-xs-medium text-text-accent outline-hidden',
+                                  'hover:bg-state-accent-hover focus-visible:bg-state-accent-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid',
+                                  'disabled:cursor-not-allowed disabled:text-text-disabled disabled:hover:bg-transparent',
+                                )}
+                                onClick={() => handleAddMember(member)}
+                              >
+                                {isUpdating
+                                  ? <span className="i-ri-loader-2-line size-3.5 animate-spin" aria-hidden />
+                                  : `+ ${addLabel}`}
+                              </button>
+                            )}
+                      </li>
+                    )
+                  })}
+                </ul>
+              )}
+      </PopoverContent>
+    </Popover>
+  )
+}
+
+export default memo(AddAccessSubjectPopover)
diff --git a/web/app/components/access-rules-editor/constants.ts b/web/app/components/access-rules-editor/constants.ts
new file mode 100644
index 00000000000..2e5fe085136
--- /dev/null
+++ b/web/app/components/access-rules-editor/constants.ts
@@ -0,0 +1,2 @@
+export const ACCESS_RULE_TABLE_GRID = 'grid-cols-[minmax(0,0.72fr)_minmax(0,1fr)_72px]'
+export const DEFAULT_ACCESS_POLICY_ID = 'default'
diff --git a/web/app/components/access-rules-editor/index.tsx b/web/app/components/access-rules-editor/index.tsx
new file mode 100644
index 00000000000..4029780a721
--- /dev/null
+++ b/web/app/components/access-rules-editor/index.tsx
@@ -0,0 +1,130 @@
+'use client'
+
+import type {
+  AccessPolicyWithBindings,
+  ResourceOpenScope,
+  ResourceUserAccessSetting,
+} from '@/models/access-control'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useMemo } from 'react'
+import { useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import AddAccessSubjectPopover from './add-access-subject-popover'
+import { ACCESS_RULE_TABLE_GRID } from './constants'
+import ResourceOpenScopeSection from './open-scope-section'
+import TitleInfotip from './title-infotip'
+import UserAccessPolicyRow from './user-access-policy-row'
+
+export type AccessRulesEditorProps = {
+  rules: AccessPolicyWithBindings[]
+  userAccessSettings: ResourceUserAccessSetting[]
+  isLoadingRules: boolean
+  isLoadingUserAccessSettings: boolean
+  openScope?: ResourceOpenScope
+  isUpdatingOpenScope: boolean
+  updatingAccountId: string | null
+  maintainerId?: string | null
+  className?: string
+  onOpenScopeChange?: (openScope: ResourceOpenScope) => void
+  onUserAccessPoliciesChange?: (accountId: string, accessPolicyIds: string[]) => void
+  onRemoveAccessPolicyMemberBinding?: (accountId: string, accessPolicyId: string) => void
+  onAddAccessSubject?: (accountId: string, accessPolicyIds: string[]) => void
+}
+
+export default function AccessRulesEditor({
+  rules,
+  userAccessSettings,
+  isLoadingRules,
+  isLoadingUserAccessSettings,
+  openScope,
+  isUpdatingOpenScope,
+  updatingAccountId,
+  maintainerId,
+  className,
+  onOpenScopeChange,
+  onUserAccessPoliciesChange,
+  onRemoveAccessPolicyMemberBinding,
+  onAddAccessSubject,
+}: AccessRulesEditorProps) {
+  const { t } = useTranslation()
+  const isLoading = isLoadingRules || isLoadingUserAccessSettings
+  const individualPermissionSettingsTip = t('accessRule.individualPermissionSettingsTip', { ns: 'permission' })
+  const policyOptions = useMemo(() => {
+    return rules.map(rule => ({
+      id: rule.policy.id,
+      name: rule.policy.name,
+    }))
+  }, [rules])
+
+  return (
+    <div className={cn('flex flex-col gap-4', className)}>
+      <ResourceOpenScopeSection
+        value={openScope}
+        disabled={isUpdatingOpenScope || !openScope}
+        onChange={onOpenScopeChange}
+      />
+      <div className="flex min-h-8 items-center gap-2">
+        <div className="flex min-w-0 flex-1 items-center gap-1">
+          <h2 className="system-sm-semibold text-text-secondary">
+            {t('accessRule.individualPermissionSettings', { ns: 'permission' })}
+          </h2>
+          <TitleInfotip content={individualPermissionSettingsTip} />
+        </div>
+        {onAddAccessSubject
+          ? (
+              <AddAccessSubjectPopover
+                userAccessSettings={userAccessSettings}
+                updatingAccountId={updatingAccountId}
+                onAddAccessSubject={onAddAccessSubject}
+              />
+            )
+          : (
+              <Button
+                variant="primary"
+                size="medium"
+                disabled
+              >
+                <span className="i-ri-add-line size-3.5" aria-hidden />
+                <span>{t('operation.add', { ns: 'common' })}</span>
+              </Button>
+            )}
+      </div>
+      <section className="overflow-hidden rounded-xl border border-components-panel-border bg-components-panel-bg">
+        <div className={cn('grid items-center gap-4 border-b border-divider-deep px-10 py-4 system-sm-semibold text-text-tertiary', ACCESS_RULE_TABLE_GRID)}>
+          <div>{t('accessRule.member', { ns: 'permission' })}</div>
+          <div>{t('accessRule.permission', { ns: 'permission' })}</div>
+          <div>{t('accessRule.actions', { ns: 'permission' })}</div>
+        </div>
+        {isLoading
+          ? (
+              <div className="px-4 py-8 text-center">
+                <Loading type="app" />
+              </div>
+            )
+          : userAccessSettings.length === 0
+            ? (
+                <div className="px-4 py-8 text-center system-sm-regular text-text-tertiary">
+                  {t('accessRule.noUserAccessSettings', { ns: 'permission' })}
+                </div>
+              )
+            : (
+                <div className="px-4">
+                  {userAccessSettings.map((setting, index) => (
+                    <UserAccessPolicyRow
+                      key={setting.account.account_id}
+                      setting={setting}
+                      policyOptions={policyOptions}
+                      disabled={updatingAccountId === setting.account.account_id}
+                      isMaintainer={maintainerId === setting.account.account_id}
+                      className={cn(index > 0 && 'border-t border-divider-subtle')}
+                      onChange={onUserAccessPoliciesChange}
+                      onRemove={onRemoveAccessPolicyMemberBinding}
+                    />
+                  ))}
+                </div>
+              )}
+      </section>
+    </div>
+  )
+}
diff --git a/web/app/components/access-rules-editor/open-scope-confirm-dialog.tsx b/web/app/components/access-rules-editor/open-scope-confirm-dialog.tsx
new file mode 100644
index 00000000000..bfdb9a9e12f
--- /dev/null
+++ b/web/app/components/access-rules-editor/open-scope-confirm-dialog.tsx
@@ -0,0 +1,59 @@
+'use client'
+
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { memo, useCallback } from 'react'
+import { useTranslation } from 'react-i18next'
+
+type OpenScopeConfirmDialogProps = {
+  open: boolean
+  onCancel: () => void
+  onConfirm: () => void
+}
+
+function OpenScopeConfirmDialog({
+  open,
+  onCancel,
+  onConfirm,
+}: OpenScopeConfirmDialogProps) {
+  const { t } = useTranslation()
+  const handleOpenChange = useCallback((nextOpen: boolean) => {
+    if (!nextOpen)
+      onCancel()
+  }, [onCancel])
+
+  return (
+    <AlertDialog
+      open={open}
+      onOpenChange={handleOpenChange}
+    >
+      <AlertDialogContent className="w-120 overflow-hidden! rounded-2xl border-[0.5px] border-components-panel-border bg-components-panel-bg p-0! text-left align-middle shadow-lg">
+        <div className="flex flex-col items-start gap-2 self-stretch p-6 pb-4">
+          <AlertDialogTitle className="title-2xl-semi-bold text-text-primary">
+            {t('accessRule.changeOpenScopeTitle', { ns: 'permission' })}
+          </AlertDialogTitle>
+          <AlertDialogDescription render={<div />} className="system-md-regular text-text-secondary">
+            {t('accessRule.changeOpenScopeDescription', { ns: 'permission' })}
+          </AlertDialogDescription>
+        </div>
+        <AlertDialogActions className="gap-2 p-6">
+          <AlertDialogCancelButton variant="secondary">
+            {t('operation.cancel', { ns: 'common' })}
+          </AlertDialogCancelButton>
+          <AlertDialogConfirmButton onClick={onConfirm}>
+            {t('operation.change', { ns: 'common' })}
+          </AlertDialogConfirmButton>
+        </AlertDialogActions>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}
+
+export default memo(OpenScopeConfirmDialog)
diff --git a/web/app/components/access-rules-editor/open-scope-option.tsx b/web/app/components/access-rules-editor/open-scope-option.tsx
new file mode 100644
index 00000000000..fb2fc20943e
--- /dev/null
+++ b/web/app/components/access-rules-editor/open-scope-option.tsx
@@ -0,0 +1,45 @@
+'use client'
+
+import type { ResourceOpenScope } from '@/models/access-control'
+import { cn } from '@langgenius/dify-ui/cn'
+import { memo } from 'react'
+
+type OpenScopeOptionProps = {
+  value: ResourceOpenScope
+  selected: boolean
+  disabled: boolean
+  title: string
+  description: string
+  onChange?: (openScope: ResourceOpenScope) => void
+}
+
+function OpenScopeOption({
+  value,
+  selected,
+  disabled,
+  title,
+  description,
+  onChange,
+}: OpenScopeOptionProps) {
+  return (
+    <button
+      type="button"
+      aria-pressed={selected}
+      disabled={disabled || !onChange}
+      className={cn(
+        'flex min-h-19 flex-col items-start rounded-xl border bg-components-panel-bg px-7 py-3 text-left shadow-xs outline-hidden transition-colors',
+        'focus-visible:ring-2 focus-visible:ring-state-accent-solid',
+        selected
+          ? 'border-[1.5px] border-state-accent-solid'
+          : 'border-components-panel-border hover:border-divider-deep',
+        (disabled || !onChange) && 'cursor-not-allowed opacity-70',
+      )}
+      onClick={() => onChange?.(value)}
+    >
+      <div className="system-sm-semibold text-text-secondary">{title}</div>
+      <p className="mt-0.5 system-xs-regular text-text-tertiary">{description}</p>
+    </button>
+  )
+}
+
+export default memo(OpenScopeOption)
diff --git a/web/app/components/access-rules-editor/open-scope-section.tsx b/web/app/components/access-rules-editor/open-scope-section.tsx
new file mode 100644
index 00000000000..62cabc40ccb
--- /dev/null
+++ b/web/app/components/access-rules-editor/open-scope-section.tsx
@@ -0,0 +1,79 @@
+'use client'
+
+import type { ResourceOpenScope } from '@/models/access-control'
+import { memo, useCallback, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import OpenScopeConfirmDialog from './open-scope-confirm-dialog'
+import OpenScopeOption from './open-scope-option'
+import TitleInfotip from './title-infotip'
+
+type ResourceOpenScopeSectionProps = {
+  value?: ResourceOpenScope
+  disabled: boolean
+  onChange?: (openScope: ResourceOpenScope) => void
+}
+
+function ResourceOpenScopeSection({
+  value,
+  disabled,
+  onChange,
+}: ResourceOpenScopeSectionProps) {
+  const { t } = useTranslation()
+  const [pendingOpenScope, setPendingOpenScope] = useState<ResourceOpenScope | null>(null)
+  const resourceOpenScopeDescription = t('accessRule.resourceOpenScopeDescription', { ns: 'permission' })
+
+  const handleRequestChange = useCallback((nextOpenScope: ResourceOpenScope) => {
+    if (nextOpenScope === value)
+      return
+
+    setPendingOpenScope(nextOpenScope)
+  }, [value])
+
+  const handleCancelChange = useCallback(() => {
+    setPendingOpenScope(null)
+  }, [])
+
+  const handleConfirmChange = useCallback(() => {
+    if (!pendingOpenScope)
+      return
+
+    onChange?.(pendingOpenScope)
+    setPendingOpenScope(null)
+  }, [onChange, pendingOpenScope])
+
+  return (
+    <section className="flex flex-col gap-2">
+      <div className="flex min-w-0 items-center gap-1">
+        <h2 className="system-sm-semibold text-text-secondary">
+          {t('accessRule.resourceOpenScope', { ns: 'permission' })}
+        </h2>
+        <TitleInfotip content={resourceOpenScopeDescription} />
+      </div>
+      <div className="grid grid-cols-1 gap-2 sm:grid-cols-2">
+        <OpenScopeOption
+          value="all"
+          selected={value === 'all'}
+          disabled={disabled || !onChange}
+          title={t('accessRule.allPermittedMembers', { ns: 'permission' })}
+          description={t('accessRule.allPermittedMembersDescription', { ns: 'permission' })}
+          onChange={onChange ? handleRequestChange : undefined}
+        />
+        <OpenScopeOption
+          value="specific"
+          selected={value === 'specific'}
+          disabled={disabled || !onChange}
+          title={t('accessRule.specificMembersOnly', { ns: 'permission' })}
+          description={t('accessRule.specificMembersOnlyDescription', { ns: 'permission' })}
+          onChange={onChange ? handleRequestChange : undefined}
+        />
+      </div>
+      <OpenScopeConfirmDialog
+        open={!!pendingOpenScope}
+        onCancel={handleCancelChange}
+        onConfirm={handleConfirmChange}
+      />
+    </section>
+  )
+}
+
+export default memo(ResourceOpenScopeSection)
diff --git a/web/app/components/access-rules-editor/title-infotip.tsx b/web/app/components/access-rules-editor/title-infotip.tsx
new file mode 100644
index 00000000000..d0b150c2dc6
--- /dev/null
+++ b/web/app/components/access-rules-editor/title-infotip.tsx
@@ -0,0 +1,14 @@
+'use client'
+
+import { Infotip } from '@/app/components/base/infotip'
+
+export default function TitleInfotip({ content }: { content: string }) {
+  return (
+    <Infotip
+      aria-label={content}
+      popupClassName="max-w-64 text-left wrap-break-word text-text-secondary"
+    >
+      {content}
+    </Infotip>
+  )
+}
diff --git a/web/app/components/access-rules-editor/user-access-policy-row.tsx b/web/app/components/access-rules-editor/user-access-policy-row.tsx
new file mode 100644
index 00000000000..4c3e9d7100c
--- /dev/null
+++ b/web/app/components/access-rules-editor/user-access-policy-row.tsx
@@ -0,0 +1,133 @@
+'use client'
+
+import type { ResourceUserAccessSetting } from '@/models/access-control'
+import { Avatar } from '@langgenius/dify-ui/avatar'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectItemIndicator,
+  SelectItemText,
+  SelectTrigger,
+  SelectValue,
+} from '@langgenius/dify-ui/select'
+import { memo, useCallback } from 'react'
+import { useTranslation } from 'react-i18next'
+import { ACCESS_RULE_TABLE_GRID, DEFAULT_ACCESS_POLICY_ID } from './constants'
+
+type PolicyOption = {
+  id: string
+  name: string
+}
+
+type UserAccessPolicyRowProps = {
+  setting: ResourceUserAccessSetting
+  policyOptions: PolicyOption[]
+  disabled: boolean
+  isMaintainer?: boolean
+  className?: string
+  onChange?: (accountId: string, accessPolicyIds: string[]) => void
+  onRemove?: (accountId: string, accessPolicyId: string) => void
+}
+
+function UserAccessPolicyRow({
+  setting,
+  policyOptions,
+  disabled,
+  isMaintainer = false,
+  className,
+  onChange,
+  onRemove,
+}: UserAccessPolicyRowProps) {
+  const { t } = useTranslation()
+  const accountId = setting.account.account_id
+  const selectedPolicy = setting.access_policies[0]
+  const selectedAccessPolicyId = selectedPolicy?.id
+  const selectedPolicyId = selectedAccessPolicyId ?? DEFAULT_ACCESS_POLICY_ID
+  const isPolicySelectDisabled = disabled || isMaintainer || !onChange
+  const isRemoveDisabled = disabled || isMaintainer || !onRemove || !selectedAccessPolicyId
+  const defaultAccessPolicyName = t('accessRule.defaultPermission', { ns: 'permission' })
+  const accountEmail = setting.account.email || setting.account.account_name
+
+  const handlePolicyChange = useCallback((nextPolicyId: string | null) => {
+    if (isPolicySelectDisabled || !nextPolicyId || nextPolicyId === selectedPolicyId)
+      return
+
+    onChange?.(accountId, [nextPolicyId])
+  }, [accountId, isPolicySelectDisabled, onChange, selectedPolicyId])
+
+  const handleRemove = useCallback(() => {
+    if (isRemoveDisabled || !selectedAccessPolicyId)
+      return
+
+    onRemove?.(accountId, selectedAccessPolicyId)
+  }, [accountId, isRemoveDisabled, onRemove, selectedAccessPolicyId])
+
+  return (
+    <div className={cn('grid min-h-19 items-center gap-4 px-6 py-4', ACCESS_RULE_TABLE_GRID, className)}>
+      <div className="flex min-w-0 items-center gap-3">
+        <Avatar
+          avatar={setting.account.avatar ?? null}
+          name={setting.account.account_name}
+          size="md"
+          className="bg-components-icon-bg-blue-solid"
+        />
+        <div className="min-w-0">
+          <div className="flex min-w-0 items-center gap-1.5">
+            <span className="truncate system-md-medium text-text-secondary">
+              {setting.account.account_name}
+            </span>
+            {isMaintainer && (
+              <span className="max-w-24 shrink-0 truncate rounded-[5px] border border-text-accent-secondary px-1 py-0.5 system-2xs-medium-uppercase text-text-accent-secondary">
+                {t('accessRule.maintainer', { ns: 'permission' })}
+              </span>
+            )}
+          </div>
+          <p className="truncate system-xs-regular text-text-tertiary">
+            {accountEmail}
+          </p>
+        </div>
+      </div>
+      <Select
+        value={selectedPolicyId}
+        onValueChange={handlePolicyChange}
+      >
+        <SelectTrigger
+          aria-label={t('accessRule.exceptionPermissionFor', { ns: 'permission', name: setting.account.account_name })}
+          size="small"
+          disabled={isPolicySelectDisabled}
+          className="w-36"
+        >
+          <SelectValue>
+            {selectedPolicyId === DEFAULT_ACCESS_POLICY_ID
+              ? defaultAccessPolicyName
+              : setting.access_policies[0]?.name}
+          </SelectValue>
+        </SelectTrigger>
+        <SelectContent>
+          <SelectItem value={DEFAULT_ACCESS_POLICY_ID}>
+            <SelectItemText>{defaultAccessPolicyName}</SelectItemText>
+            <SelectItemIndicator />
+          </SelectItem>
+          {policyOptions.map(policy => (
+            <SelectItem key={policy.id} value={policy.id}>
+              <SelectItemText>{policy.name}</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+      <button
+        type="button"
+        disabled={isRemoveDisabled}
+        className="w-fit rounded-md border-none bg-transparent p-0 text-left system-xs-medium text-text-destructive outline-hidden hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid disabled:cursor-not-allowed disabled:text-text-disabled disabled:hover:no-underline"
+        onClick={handleRemove}
+      >
+        {t('operation.remove', { ns: 'common' })}
+      </button>
+    </div>
+  )
+}
+
+export default memo(UserAccessPolicyRow)
diff --git a/web/app/components/app-sidebar/__tests__/app-detail-section.spec.tsx b/web/app/components/app-sidebar/__tests__/app-detail-section.spec.tsx
index 19d7dd5a436..6dc9f5dfb19 100644
--- a/web/app/components/app-sidebar/__tests__/app-detail-section.spec.tsx
+++ b/web/app/components/app-sidebar/__tests__/app-detail-section.spec.tsx
@@ -1,10 +1,11 @@
 import { render, screen } from '@testing-library/react'
+import { AppACLPermission } from '@/utils/permission'
 import AppDetailSection from '../app-detail-section'
 import { useAppInfoActions } from '../app-info/use-app-info-actions'
 
 let mockAppMode = 'chat'
-let mockIsCurrentWorkspaceEditor = true
 let mockPathname = '/app/app-1/logs'
+let mockAppPermissionKeys: string[] = []
 
 vi.mock('@/app/components/app/store', () => ({
   useStore: (selector: (state: Record<string, unknown>) => unknown) => selector({
@@ -15,13 +16,15 @@ vi.mock('@/app/components/app/store', () => ({
       icon: '🤖',
       icon_type: 'emoji',
       icon_background: '#fff',
+      permission_keys: mockAppPermissionKeys,
     },
   }),
 }))
 
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
-    isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor,
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
   }),
 }))
 
@@ -51,13 +54,13 @@ describe('AppDetailSection', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockAppMode = 'chat'
-    mockIsCurrentWorkspaceEditor = true
     mockPathname = '/app/app-1/logs'
+    mockAppPermissionKeys = [AppACLPermission.Monitor]
   })
 
   // Rendering behavior for app detail navigation entries.
   describe('Rendering', () => {
-    it('should split logs and annotations into separate navigation links for chat apps', () => {
+    it('should render logs and overview for chat apps with app monitor permission', () => {
       // Arrange
       mockAppMode = 'chat'
 
@@ -66,13 +69,28 @@ describe('AppDetailSection', () => {
 
       // Assert
       expect(screen.getByRole('link', { name: 'common.appMenus.logs' })).toHaveAttribute('href', '/app/app-1/logs')
+      expect(screen.getByRole('link', { name: 'common.appMenus.overview' })).toHaveAttribute('href', '/app/app-1/overview')
+      expect(screen.queryByRole('link', { name: 'common.appMenus.annotations' })).not.toBeInTheDocument()
+    })
+
+    it('should render annotations for chat apps with app edit permission', () => {
+      // Arrange
+      mockAppMode = 'chat'
+      mockAppPermissionKeys = [AppACLPermission.Edit]
+
+      // Act
+      render(<AppDetailSection />)
+
+      // Assert
       expect(screen.getByRole('link', { name: 'common.appMenus.annotations' })).toHaveAttribute('href', '/app/app-1/annotations')
       expect(screen.getByRole('link', { name: 'common.appMenus.annotations' })).toHaveAttribute('data-icon', 'Annotations')
+      expect(screen.queryByRole('link', { name: 'common.appMenus.overview' })).not.toBeInTheDocument()
     })
 
     it('should render dividers before logs and after annotations for chat apps', () => {
       // Arrange
       mockAppMode = 'chat'
+      mockAppPermissionKeys = [AppACLPermission.Monitor, AppACLPermission.Edit]
 
       // Act
       render(<AppDetailSection />)
@@ -116,9 +134,9 @@ describe('AppDetailSection', () => {
       expect(screen.queryByRole('link', { name: 'common.appMenus.annotations' })).not.toBeInTheDocument()
     })
 
-    it('should not render log group dividers for non-editor users', () => {
+    it('should not render monitor group dividers without monitor or edit permission', () => {
       // Arrange
-      mockIsCurrentWorkspaceEditor = false
+      mockAppPermissionKeys = []
 
       // Act
       render(<AppDetailSection />)
@@ -127,6 +145,62 @@ describe('AppDetailSection', () => {
       expect(screen.queryAllByRole('separator')).toHaveLength(0)
       expect(screen.queryByRole('link', { name: 'common.appMenus.logs' })).not.toBeInTheDocument()
       expect(screen.queryByRole('link', { name: 'common.appMenus.annotations' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('link', { name: 'common.appMenus.overview' })).not.toBeInTheDocument()
+    })
+
+    it('should render logs for users with app monitor permission', () => {
+      // Arrange
+      mockAppPermissionKeys = [AppACLPermission.Monitor]
+
+      // Act
+      render(<AppDetailSection />)
+
+      // Assert
+      expect(screen.getByRole('link', { name: 'common.appMenus.logs' })).toHaveAttribute('href', '/app/app-1/logs')
+      expect(screen.queryByRole('link', { name: 'common.appMenus.annotations' })).not.toBeInTheDocument()
+      expect(screen.getAllByRole('separator')).toHaveLength(2)
+    })
+
+    it('should render the layout navigation for users with view layout permission', () => {
+      // Arrange
+      mockAppPermissionKeys = [AppACLPermission.ViewLayout]
+
+      // Act
+      render(<AppDetailSection />)
+
+      // Assert
+      expect(screen.getByRole('link', { name: 'common.appMenus.promptEng' })).toHaveAttribute('href', '/app/app-1/configuration')
+      expect(screen.queryByRole('link', { name: 'common.appMenus.logs' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('link', { name: 'common.appMenus.annotations' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('link', { name: 'common.appMenus.overview' })).not.toBeInTheDocument()
+    })
+
+    it('should hide the layout navigation when layout access is missing', () => {
+      // Act
+      render(<AppDetailSection />)
+
+      // Assert
+      expect(screen.queryByRole('link', { name: 'common.appMenus.promptEng' })).not.toBeInTheDocument()
+    })
+
+    it('should render resource access navigation when app access config permission is granted', () => {
+      // Arrange
+      mockAppPermissionKeys = [AppACLPermission.AccessConfig]
+
+      // Act
+      render(<AppDetailSection />)
+
+      // Assert
+      expect(screen.getByRole('link', { name: 'common.settings.resourceAccess' })).toHaveAttribute('href', '/app/app-1/access-config')
+      expect(screen.queryByRole('link', { name: 'common.appMenus.overview' })).not.toBeInTheDocument()
+    })
+
+    it('should hide resource access navigation when app access config permission is missing', () => {
+      // Act
+      render(<AppDetailSection />)
+
+      // Assert
+      expect(screen.queryByRole('link', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
     })
 
     it('should pass collapsed mode to app info and navigation links when collapsed', () => {
diff --git a/web/app/components/app-sidebar/__tests__/app-sidebar-dropdown.spec.tsx b/web/app/components/app-sidebar/__tests__/app-sidebar-dropdown.spec.tsx
index 5557118c784..98f4d7b672c 100644
--- a/web/app/components/app-sidebar/__tests__/app-sidebar-dropdown.spec.tsx
+++ b/web/app/components/app-sidebar/__tests__/app-sidebar-dropdown.spec.tsx
@@ -13,12 +13,6 @@ vi.mock('@/app/components/app/store', () => ({
   }),
 }))
 
-vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceEditor: true,
-  }),
-}))
-
 vi.mock('@langgenius/dify-ui/dropdown-menu', () => {
   const DropdownMenuContext = React.createContext<{ isOpen: boolean, setOpen: (open: boolean) => void } | null>(null)
 
@@ -175,9 +169,9 @@ describe('AppSidebarDropdown', () => {
     render(<AppSidebarDropdown navigation={navigation} />)
 
     const appName = screen.getByText('Test App')
-    const appInfoArea = appName.closest('[class*="cursor-pointer"]')
-    if (appInfoArea)
-      await user.click(appInfoArea)
+    await user.click(appName)
+
+    expect(screen.getByTestId('app-info')).toHaveAttribute('data-open', 'true')
   })
 
   it('should display workflow mode label', () => {
diff --git a/web/app/components/app-sidebar/__tests__/dataset-detail-section.spec.tsx b/web/app/components/app-sidebar/__tests__/dataset-detail-section.spec.tsx
index ac02bb1f4e8..25763fb11ae 100644
--- a/web/app/components/app-sidebar/__tests__/dataset-detail-section.spec.tsx
+++ b/web/app/components/app-sidebar/__tests__/dataset-detail-section.spec.tsx
@@ -1,9 +1,9 @@
 import type { DataSet, RelatedAppResponse } from '@/models/datasets'
 import { render, screen } from '@testing-library/react'
+import { DatasetACLPermission } from '@/utils/permission'
 import DatasetDetailSection from '../dataset-detail-section'
 
 let mockPathname = '/datasets/dataset-1/documents'
-let mockIsDatasetOperator = false
 let mockDataset: DataSet | undefined
 let mockRelatedApps: RelatedAppResponse | undefined
 
@@ -13,7 +13,8 @@ vi.mock('@/next/navigation', () => ({
 
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
-    isCurrentWorkspaceDatasetOperator: mockIsDatasetOperator,
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
   }),
 }))
 
@@ -27,7 +28,12 @@ vi.mock('../dataset-info', () => ({
 }))
 
 vi.mock('../nav-link', () => ({
-  default: ({ name, href }: { name: string, href: string }) => <a href={href}>{name}</a>,
+  default: ({ name, href, disabled }: { name: string, href: string, disabled?: boolean }) => {
+    if (disabled)
+      return <button disabled>{name}</button>
+
+    return <a href={href}>{name}</a>
+  },
 }))
 
 vi.mock('../../datasets/extra-info', () => ({
@@ -63,6 +69,7 @@ const createDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
     score_threshold: 0,
   },
   enable_api: true,
+  permission_keys: [DatasetACLPermission.Edit],
   ...overrides,
 } as DataSet)
 
@@ -70,7 +77,6 @@ describe('DatasetDetailSection', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockPathname = '/datasets/dataset-1/documents'
-    mockIsDatasetOperator = false
     mockDataset = createDataset()
     mockRelatedApps = {
       data: [],
@@ -87,4 +93,47 @@ describe('DatasetDetailSection', () => {
     expect(extraInfo).toHaveAttribute('data-document-count', '120')
     expect(extraInfo.parentElement).toHaveClass('mt-auto', 'shrink-0')
   })
+
+  it('should hide dataset stats and API access when dataset edit permission is missing', () => {
+    mockDataset = createDataset({
+      permission_keys: [DatasetACLPermission.Readonly],
+    })
+
+    render(<DatasetDetailSection expand />)
+
+    expect(screen.queryByTestId('extra-info')).not.toBeInTheDocument()
+  })
+
+  it('should render resource access navigation when dataset access config permission is granted', () => {
+    mockDataset = createDataset({
+      permission_keys: [DatasetACLPermission.AccessConfig],
+    })
+
+    render(<DatasetDetailSection expand />)
+
+    expect(screen.getByRole('link', { name: 'common.settings.resourceAccess' })).toHaveAttribute('href', '/datasets/dataset-1/access-config')
+  })
+
+  it('should hide resource access navigation when dataset access config permission is missing', () => {
+    render(<DatasetDetailSection expand />)
+
+    expect(screen.queryByRole('link', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
+  })
+
+  it('should render hit testing navigation as a link when retrieval recall permission is granted', () => {
+    mockDataset = createDataset({
+      permission_keys: [DatasetACLPermission.RetrievalRecall],
+    })
+
+    render(<DatasetDetailSection expand />)
+
+    expect(screen.getByRole('link', { name: 'common.datasetMenus.hitTesting' })).toHaveAttribute('href', '/datasets/dataset-1/hitTesting')
+  })
+
+  it('should disable hit testing navigation when retrieval recall permission is missing', () => {
+    render(<DatasetDetailSection expand />)
+
+    expect(screen.getByRole('button', { name: 'common.datasetMenus.hitTesting' })).toBeDisabled()
+    expect(screen.queryByRole('link', { name: 'common.datasetMenus.hitTesting' })).not.toBeInTheDocument()
+  })
 })
diff --git a/web/app/components/app-sidebar/__tests__/index.spec.tsx b/web/app/components/app-sidebar/__tests__/index.spec.tsx
index 6aefcca8c33..859d4f5de3f 100644
--- a/web/app/components/app-sidebar/__tests__/index.spec.tsx
+++ b/web/app/components/app-sidebar/__tests__/index.spec.tsx
@@ -3,19 +3,11 @@ import userEvent from '@testing-library/user-event'
 import * as React from 'react'
 import AppDetailNav from '..'
 
-let mockAppSidebarExpand = 'expand'
-const mockSetAppSidebarExpand = vi.fn()
+let mockDetailSidebarMode = 'expand'
+const mockSetDetailSidebarMode = vi.fn()
 
-vi.mock('@/app/components/app/store', () => ({
-  useStore: (selector: (state: Record<string, unknown>) => unknown) => selector({
-    appDetail: { id: 'app-1', name: 'Test', mode: 'chat', icon: '🤖', icon_type: 'emoji', icon_background: '#fff' },
-    appSidebarExpand: mockAppSidebarExpand,
-    setAppSidebarExpand: mockSetAppSidebarExpand,
-  }),
-}))
-
-vi.mock('zustand/react/shallow', () => ({
-  useShallow: (fn: unknown) => fn,
+vi.mock('@/app/components/main-nav/storage', () => ({
+  useDetailSidebarMode: () => [mockDetailSidebarMode, mockSetDetailSidebarMode],
 }))
 
 let mockIsHovering = true
@@ -79,7 +71,7 @@ const navigation = [
 describe('AppDetailNav', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockAppSidebarExpand = 'expand'
+    mockDetailSidebarMode = 'expand'
     mockIsHovering = true
     mockKeyPressCallback = null
   })
@@ -110,11 +102,11 @@ describe('AppDetailNav', () => {
     it('should apply expanded width class', () => {
       const { container } = render(<AppDetailNav navigation={navigation} />)
       const sidebar = container.firstElementChild as HTMLElement
-      expect(sidebar).toHaveClass('w-[216px]')
+      expect(sidebar).toHaveClass('w-55')
     })
 
     it('should apply collapsed width class', () => {
-      mockAppSidebarExpand = 'collapse'
+      mockDetailSidebarMode = 'collapse'
       const { container } = render(<AppDetailNav navigation={navigation} />)
       const sidebar = container.firstElementChild as HTMLElement
       expect(sidebar).toHaveClass('w-14')
@@ -164,37 +156,30 @@ describe('AppDetailNav', () => {
     })
 
     it('should pass collapse mode to nav links when collapsed', () => {
-      mockAppSidebarExpand = 'collapse'
+      mockDetailSidebarMode = 'collapse'
       render(<AppDetailNav navigation={navigation} />)
       expect(screen.getByTestId('nav-link-Overview')).toHaveAttribute('data-mode', 'collapse')
     })
   })
 
   describe('Toggle behavior', () => {
-    it('should call setAppSidebarExpand on toggle', async () => {
+    it('should collapse detail sidebar on toggle', async () => {
       const user = userEvent.setup()
       render(<AppDetailNav navigation={navigation} />)
 
       await user.click(screen.getByTestId('toggle-button'))
 
-      expect(mockSetAppSidebarExpand).toHaveBeenCalledWith('collapse')
+      expect(mockSetDetailSidebarMode).toHaveBeenCalledWith('collapse')
     })
 
     it('should toggle from collapse to expand', async () => {
       const user = userEvent.setup()
-      mockAppSidebarExpand = 'collapse'
+      mockDetailSidebarMode = 'collapse'
       render(<AppDetailNav navigation={navigation} />)
 
       await user.click(screen.getByTestId('toggle-button'))
 
-      expect(mockSetAppSidebarExpand).toHaveBeenCalledWith('expand')
-    })
-  })
-
-  describe('Sidebar persistence', () => {
-    it('should persist expand state to localStorage', () => {
-      render(<AppDetailNav navigation={navigation} />)
-      expect(localStorage.setItem).toHaveBeenCalledWith('app-detail-collapse-or-expand', 'expand')
+      expect(mockSetDetailSidebarMode).toHaveBeenCalledWith('expand')
     })
   })
 
@@ -218,7 +203,7 @@ describe('AppDetailNav', () => {
       act(() => {
         cb!({ preventDefault: vi.fn() })
       })
-      expect(mockSetAppSidebarExpand).toHaveBeenCalledWith('collapse')
+      expect(mockSetDetailSidebarMode).toHaveBeenCalledWith('collapse')
     })
   })
 
diff --git a/web/app/components/app-sidebar/app-detail-section.tsx b/web/app/components/app-sidebar/app-detail-section.tsx
index 6eecb81b9e4..5df0a4ef573 100644
--- a/web/app/components/app-sidebar/app-detail-section.tsx
+++ b/web/app/components/app-sidebar/app-detail-section.tsx
@@ -1,5 +1,6 @@
 'use client'
 
+import type { ComponentProps } from 'react'
 import type { NavIcon } from './nav-link'
 import { cn } from '@langgenius/dify-ui/cn'
 import {
@@ -7,6 +8,8 @@ import {
   RiDashboard2Line,
   RiFileList3Fill,
   RiFileList3Line,
+  RiLock2Fill,
+  RiLock2Line,
   RiTerminalBoxFill,
   RiTerminalBoxLine,
   RiTerminalWindowFill,
@@ -20,6 +23,7 @@ import Annotations from '@/app/components/base/icons/src/vender/Annotations'
 import { useAppContext } from '@/context/app-context'
 import { usePathname } from '@/next/navigation'
 import { AppModeEnum } from '@/types/app'
+import { getAppACLCapabilities } from '@/utils/permission'
 import { AppInfoView } from './app-info'
 import { useAppInfoActions } from './app-info/use-app-info-actions'
 import NavLink from './nav-link'
@@ -31,6 +35,15 @@ type AppDetailNavItem = {
   selectedIcon: NavIcon
 }
 
+const AnnotationNavIcon = ({ className, ...props }: ComponentProps<typeof Annotations>) => (
+  <Annotations
+    {...props}
+    className={cn(className, 'size-4')}
+  />
+)
+
+AnnotationNavIcon.displayName = 'Annotations'
+
 const isLogsNavItem = (item: AppDetailNavItem) => item.href.endsWith('/logs')
 const isAnnotationsNavItem = (item: AppDetailNavItem) => item.href.endsWith('/annotations')
 
@@ -58,7 +71,7 @@ const AppDetailSection = ({
 }: AppDetailSectionProps) => {
   const { t } = useTranslation()
   const pathname = usePathname()
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const { userProfile, workspacePermissionKeys } = useAppContext()
   const appDetail = useStore(state => state.appDetail)
   const appInfoActions = useAppInfoActions({
     resetKey: appDetail?.id,
@@ -71,9 +84,14 @@ const AppDetailSection = ({
     const appId = appDetail.id
     const isWorkflowApp = appDetail.mode === AppModeEnum.WORKFLOW || appDetail.mode === AppModeEnum.ADVANCED_CHAT
     const supportsAnnotations = appDetail.mode !== AppModeEnum.WORKFLOW && appDetail.mode !== AppModeEnum.COMPLETION
+    const appACLCapabilities = getAppACLCapabilities(appDetail.permission_keys, {
+      currentUserId: userProfile?.id,
+      resourceMaintainer: appDetail.maintainer,
+      workspacePermissionKeys,
+    })
 
     return [
-      ...(isCurrentWorkspaceEditor
+      ...(appACLCapabilities.canAccessLayout
         ? [{
             name: t('appMenus.promptEng', { ns: 'common' }),
             href: `/app/${appId}/${isWorkflowApp ? 'workflow' : 'configuration'}`,
@@ -88,34 +106,49 @@ const AppDetailSection = ({
         icon: RiTerminalBoxLine,
         selectedIcon: RiTerminalBoxFill,
       },
-      ...(isCurrentWorkspaceEditor
+      ...(appACLCapabilities.canMonitor
         ? [{
             name: t('appMenus.logs', { ns: 'common' }),
             href: `/app/${appId}/logs`,
             icon: RiFileList3Line,
             selectedIcon: RiFileList3Fill,
-          }, ...(supportsAnnotations
-            ? [{
-                name: t('appMenus.annotations', { ns: 'common' }),
-                href: `/app/${appId}/annotations`,
-                icon: Annotations,
-                selectedIcon: Annotations,
-              }]
-            : [])]
+          }]
+        : []
+      ),
+      ...(appACLCapabilities.canEdit && supportsAnnotations
+        ? [{
+            name: t('appMenus.annotations', { ns: 'common' }),
+            href: `/app/${appId}/annotations`,
+            icon: AnnotationNavIcon,
+            selectedIcon: AnnotationNavIcon,
+          }]
+        : []
+      ),
+      ...(appACLCapabilities.canMonitor
+        ? [{
+            name: t('appMenus.overview', { ns: 'common' }),
+            href: `/app/${appId}/overview`,
+            icon: RiDashboard2Line,
+            selectedIcon: RiDashboard2Fill,
+          }]
+        : []
+      ),
+      ...(appACLCapabilities.canAccessConfig
+        ? [{
+            name: t('settings.resourceAccess', { ns: 'common' }),
+            href: `/app/${appId}/access-config`,
+            icon: RiLock2Line,
+            selectedIcon: RiLock2Fill,
+          }]
         : []
       ),
-      {
-        name: t('appMenus.overview', { ns: 'common' }),
-        href: `/app/${appId}/overview`,
-        icon: RiDashboard2Line,
-        selectedIcon: RiDashboard2Fill,
-      },
     ]
-  }, [appDetail, isCurrentWorkspaceEditor, t])
+  }, [appDetail, t, userProfile?.id, workspacePermissionKeys])
 
   if (!appDetail)
     return null
 
+  const hasLogsNavigation = navigation.some(isLogsNavItem)
   const hasAnnotationsNavigation = navigation.some(isAnnotationsNavItem)
 
   return (
@@ -137,7 +170,7 @@ const AppDetailSection = ({
       </div>
       <nav className={cn('flex flex-col gap-y-0.5 py-1', expand ? 'px-1' : 'px-3')}>
         {navigation.map((item) => {
-          const shouldRenderDividerBefore = isLogsNavItem(item)
+          const shouldRenderDividerBefore = isLogsNavItem(item) || (!hasLogsNavigation && isAnnotationsNavItem(item))
           const shouldRenderDividerAfter = hasAnnotationsNavigation ? isAnnotationsNavItem(item) : isLogsNavItem(item)
 
           return (
diff --git a/web/app/components/app-sidebar/app-info/__tests__/app-info-detail-panel.spec.tsx b/web/app/components/app-sidebar/app-info/__tests__/app-info-detail-panel.spec.tsx
index 8017201e6e2..78137d42c13 100644
--- a/web/app/components/app-sidebar/app-info/__tests__/app-info-detail-panel.spec.tsx
+++ b/web/app/components/app-sidebar/app-info/__tests__/app-info-detail-panel.spec.tsx
@@ -3,8 +3,19 @@ import { render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import * as React from 'react'
 import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 import AppInfoDetailPanel from '../app-info-detail-panel'
 
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['app.create_and_management'] as string[],
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
+
 vi.mock('../../../base/app-icon', () => ({
   default: ({ size, icon }: { size: string, icon: string }) => (
     <div data-testid="app-icon" data-size={size} data-icon={icon} />
@@ -66,6 +77,12 @@ vi.mock('../app-operations', () => ({
   ),
 }))
 
+const defaultAppPermissionKeys = [
+  AppACLPermission.Edit,
+  AppACLPermission.ImportExportDSL,
+  AppACLPermission.Delete,
+]
+
 const createAppDetail = (overrides: Partial<App> = {}): App & Partial<AppSSO> => ({
   id: 'app-1',
   name: 'Test App',
@@ -76,6 +93,7 @@ const createAppDetail = (overrides: Partial<App> = {}): App & Partial<AppSSO> =>
   icon_url: '',
   description: 'A test description',
   use_icon_as_answer_icon: false,
+  permission_keys: defaultAppPermissionKeys,
   ...overrides,
 } as App & Partial<AppSSO>)
 
@@ -90,6 +108,7 @@ describe('AppInfoDetailPanel', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.value = ['app.create_and_management']
   })
 
   describe('Rendering', () => {
@@ -167,6 +186,14 @@ describe('AppInfoDetailPanel', () => {
       expect(defaultProps.openModal).toHaveBeenCalledWith('duplicate')
     })
 
+    it('should hide duplicate operation when app.create_and_management permission is missing', () => {
+      mockWorkspacePermissionKeys.value = []
+
+      render(<AppInfoDetailPanel {...defaultProps} />)
+
+      expect(screen.queryByTestId('op-duplicate')).not.toBeInTheDocument()
+    })
+
     it('should call exportCheck when export is clicked', async () => {
       const user = userEvent.setup()
       render(<AppInfoDetailPanel {...defaultProps} />)
@@ -217,6 +244,19 @@ describe('AppInfoDetailPanel', () => {
       expect(screen.queryByTestId('op-import')).not.toBeInTheDocument()
     })
 
+    it('should not show import DSL when import/export DSL permission is missing', () => {
+      render(
+        <AppInfoDetailPanel
+          {...defaultProps}
+          appDetail={createAppDetail({
+            mode: AppModeEnum.WORKFLOW,
+            permission_keys: [AppACLPermission.Edit],
+          })}
+        />,
+      )
+      expect(screen.queryByTestId('op-import')).not.toBeInTheDocument()
+    })
+
     it('should call openModal with importDSL when import is clicked', async () => {
       const user = userEvent.setup()
       render(
diff --git a/web/app/components/app-sidebar/app-info/__tests__/index.spec.tsx b/web/app/components/app-sidebar/app-info/__tests__/index.spec.tsx
index ea0f117dede..573cdf02334 100644
--- a/web/app/components/app-sidebar/app-info/__tests__/index.spec.tsx
+++ b/web/app/components/app-sidebar/app-info/__tests__/index.spec.tsx
@@ -8,12 +8,16 @@ import AppInfo from '..'
 const mockDetailPanel = vi.hoisted(() => vi.fn())
 const mockModals = vi.hoisted(() => vi.fn())
 
-let mockIsCurrentWorkspaceEditor = true
+let mockAppPermissionKeys = ['app.acl.view_layout']
 const mockSetPanelOpen = vi.fn()
 
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
-    isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor,
+    workspacePermissionKeys: ['app.create_and_management'],
+  }),
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: ['app.create_and_management'],
   }),
 }))
 
@@ -53,6 +57,7 @@ const mockAppDetail: App & Partial<AppSSO> = {
   icon_url: '',
   description: '',
   use_icon_as_answer_icon: false,
+  permission_keys: mockAppPermissionKeys,
 } as App & Partial<AppSSO>
 
 const mockUseAppInfoActions = {
@@ -80,8 +85,9 @@ vi.mock('../use-app-info-actions', () => ({
 describe('AppInfo', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsCurrentWorkspaceEditor = true
+    mockAppPermissionKeys = ['app.acl.view_layout']
     mockUseAppInfoActions.appDetail = mockAppDetail
+    mockUseAppInfoActions.appDetail.permission_keys = mockAppPermissionKeys
     mockUseAppInfoActions.panelOpen = false
     mockUseAppInfoActions.activeModal = null
   })
@@ -130,9 +136,10 @@ describe('AppInfo', () => {
     expect(updater(true)).toBe(false)
   })
 
-  it('should not toggle panel when trigger is clicked and user is not editor', async () => {
+  it('should not toggle panel when app ACL does not allow layout access', async () => {
     const user = userEvent.setup()
-    mockIsCurrentWorkspaceEditor = false
+    mockAppPermissionKeys = []
+    mockUseAppInfoActions.appDetail.permission_keys = mockAppPermissionKeys
     render(<AppInfo expand />)
 
     await user.click(screen.getByTestId('trigger'))
diff --git a/web/app/components/app-sidebar/app-info/__tests__/use-app-info-actions.spec.ts b/web/app/components/app-sidebar/app-info/__tests__/use-app-info-actions.spec.ts
index fe5fa03f679..898b8c55a74 100644
--- a/web/app/components/app-sidebar/app-info/__tests__/use-app-info-actions.spec.ts
+++ b/web/app/components/app-sidebar/app-info/__tests__/use-app-info-actions.spec.ts
@@ -25,6 +25,7 @@ const mockFetchWorkflowDraft = vi.fn()
 const mockDownloadBlob = vi.fn()
 const mockGetSocket = vi.fn()
 const mockOnAppMetaUpdate = vi.fn()
+const mockSetQueryData = vi.fn()
 
 let mockAppDetail: Record<string, unknown> | undefined = {
   id: 'app-1',
@@ -63,9 +64,16 @@ vi.mock('@langgenius/dify-ui/toast', () => ({
 }))
 
 vi.mock('@/service/use-apps', () => ({
+  appDetailQueryKeyPrefix: ['apps', 'detail'],
   useInvalidateAppList: () => mockInvalidateAppList,
 }))
 
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    setQueryData: mockSetQueryData,
+  }),
+}))
+
 vi.mock('@/service/apps', () => ({
   updateAppInfo: (...args: unknown[]) => mockUpdateAppInfo(...args),
   copyApp: (...args: unknown[]) => mockCopyApp(...args),
@@ -98,15 +106,12 @@ vi.mock('@/app/components/workflow/collaboration/core/collaboration-manager', ()
   },
 }))
 
-vi.mock('@/config', () => ({
-  NEED_REFRESH_APP_LIST_KEY: 'test-refresh-key',
-}))
-
 describe('useAppInfoActions', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockOnAppMetaUpdate.mockReturnValue(() => {})
     mockGetSocket.mockReturnValue(null)
+    mockSetQueryData.mockReset()
     mockAppDetail = {
       id: 'app-1',
       name: 'Test App',
diff --git a/web/app/components/app-sidebar/app-info/app-info-detail-panel.tsx b/web/app/components/app-sidebar/app-info/app-info-detail-panel.tsx
index 13a55f8984d..cb796157232 100644
--- a/web/app/components/app-sidebar/app-info/app-info-detail-panel.tsx
+++ b/web/app/components/app-sidebar/app-info/app-info-detail-panel.tsx
@@ -14,7 +14,9 @@ import * as React from 'react'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import CardView from '@/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/card-view'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { AppModeEnum } from '@/types/app'
+import { getAppACLCapabilities, hasPermission } from '@/utils/permission'
 import AppIcon from '../../base/app-icon'
 import { AppInfoDetailDrawer } from './app-info-detail-drawer'
 import { getAppModeLabel } from './app-mode-labels'
@@ -36,53 +38,73 @@ const AppInfoDetailPanel = ({
   exportCheck,
 }: AppInfoDetailPanelProps) => {
   const { t } = useTranslation()
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const appACLCapabilities = useMemo(() => getAppACLCapabilities(appDetail.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appDetail.maintainer,
+    workspacePermissionKeys,
+  }), [appDetail.maintainer, appDetail.permission_keys, currentUserId, workspacePermissionKeys])
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
 
   const primaryOperations = useMemo<Operation[]>(() => [
-    {
-      id: 'edit',
-      title: t('editApp', { ns: 'app' }),
-      icon: <RiEditLine />,
-      onClick: () => openModal('edit'),
-    },
-    {
-      id: 'duplicate',
-      title: t('duplicate', { ns: 'app' }),
-      icon: <RiFileCopy2Line />,
-      onClick: () => openModal('duplicate'),
-    },
-    {
-      id: 'export',
-      title: t('export', { ns: 'app' }),
-      icon: <RiFileDownloadLine />,
-      onClick: exportCheck,
-    },
-  ], [t, openModal, exportCheck])
+    ...(appACLCapabilities.canEdit
+      ? [{
+          id: 'edit',
+          title: t('editApp', { ns: 'app' }),
+          icon: <RiEditLine />,
+          onClick: () => openModal('edit'),
+        }]
+      : []),
+    ...(canCreateApp
+      ? [{
+          id: 'duplicate',
+          title: t('duplicate', { ns: 'app' }),
+          icon: <RiFileCopy2Line />,
+          onClick: () => openModal('duplicate'),
+        }]
+      : []),
+    ...(appACLCapabilities.canImportExportDSL
+      ? [{
+          id: 'export',
+          title: t('export', { ns: 'app' }),
+          icon: <RiFileDownloadLine />,
+          onClick: exportCheck,
+        }]
+      : []),
+  ], [appACLCapabilities, canCreateApp, t, openModal, exportCheck])
 
   const secondaryOperations = useMemo<Operation[]>(() => [
-    ...(appDetail.mode === AppModeEnum.ADVANCED_CHAT || appDetail.mode === AppModeEnum.WORKFLOW)
+    ...(appACLCapabilities.canImportExportDSL && (appDetail.mode === AppModeEnum.ADVANCED_CHAT || appDetail.mode === AppModeEnum.WORKFLOW)
       ? [{
           id: 'import',
           title: t('common.importDSL', { ns: 'workflow' }),
           icon: <RiFileUploadLine />,
           onClick: () => openModal('importDSL'),
         }]
-      : [],
-    {
-      id: 'divider-1',
-      title: '',
-      icon: <></>,
-      onClick: () => {},
-      type: 'divider' as const,
-    },
-    {
-      id: 'delete',
-      title: t('operation.delete', { ns: 'common' }),
-      icon: <RiDeleteBinLine />,
-      onClick: () => openModal('delete'),
-    },
-  ], [appDetail.mode, t, openModal])
+      : []),
+    ...(appACLCapabilities.canDelete
+      ? [
+          {
+            id: 'divider-1',
+            title: '',
+            icon: <></>,
+            onClick: () => {},
+            type: 'divider' as const,
+          },
+          {
+            id: 'delete',
+            title: t('operation.delete', { ns: 'common' }),
+            icon: <RiDeleteBinLine />,
+            onClick: () => openModal('delete'),
+          },
+        ]
+      : []),
+  ], [appACLCapabilities, appDetail.mode, t, openModal])
 
   const switchOperation = useMemo(() => {
+    if (!appACLCapabilities.canEdit)
+      return null
     if (appDetail.mode !== AppModeEnum.COMPLETION && appDetail.mode !== AppModeEnum.CHAT)
       return null
     return {
@@ -91,7 +113,7 @@ const AppInfoDetailPanel = ({
       icon: <RiExchange2Line />,
       onClick: () => openModal('switch'),
     }
-  }, [appDetail.mode, t, openModal])
+  }, [appACLCapabilities.canEdit, appDetail.mode, t, openModal])
 
   return (
     <AppInfoDetailDrawer
diff --git a/web/app/components/app-sidebar/app-info/index.tsx b/web/app/components/app-sidebar/app-info/index.tsx
index c2bde1ddb10..f08c1f12ed8 100644
--- a/web/app/components/app-sidebar/app-info/index.tsx
+++ b/web/app/components/app-sidebar/app-info/index.tsx
@@ -1,6 +1,7 @@
 import type { AppInfoActions } from './use-app-info-actions'
 import * as React from 'react'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { getAppACLCapabilities } from '@/utils/permission'
 import AppInfoDetailPanel from './app-info-detail-panel'
 import AppInfoModals from './app-info-modals'
 import AppInfoTrigger from './app-info-trigger'
@@ -79,7 +80,6 @@ export const AppInfoView = ({
   actions,
   renderDetail = true,
 }: AppInfoViewProps) => {
-  const { isCurrentWorkspaceEditor } = useAppContext()
   const {
     appDetail,
     panelOpen,
@@ -87,6 +87,13 @@ export const AppInfoView = ({
     activeModal,
     secretEnvList,
   } = actions
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const appACLCapabilities = getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  })
 
   if (!appDetail)
     return null
@@ -101,7 +108,7 @@ export const AppInfoView = ({
           appDetail={appDetail}
           expand={expand}
           onClick={() => {
-            if (isCurrentWorkspaceEditor)
+            if (appACLCapabilities.canAccessLayout)
               setPanelOpen(v => !v)
           }}
         />
diff --git a/web/app/components/app-sidebar/app-info/use-app-info-actions.ts b/web/app/components/app-sidebar/app-info/use-app-info-actions.ts
index 6162869e1e7..89688a4882f 100644
--- a/web/app/components/app-sidebar/app-info/use-app-info-actions.ts
+++ b/web/app/components/app-sidebar/app-info/use-app-info-actions.ts
@@ -3,15 +3,15 @@ import type { DuplicateAppModalProps } from '@/app/components/app/duplicate-moda
 import type { CreateAppModalProps } from '@/app/components/explore/create-app-modal'
 import type { EnvironmentVariable } from '@/app/components/workflow/types'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
+import { useQueryClient } from '@tanstack/react-query'
 import { useCallback, useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
+import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import { useProviderContext } from '@/context/provider-context'
 import { useRouter } from '@/next/navigation'
 import { copyApp, deleteApp, exportAppConfig, fetchAppDetail, updateAppInfo } from '@/service/apps'
-import { useInvalidateAppList } from '@/service/use-apps'
+import { appDetailQueryKeyPrefix, useInvalidateAppList } from '@/service/use-apps'
 import { fetchWorkflowDraft } from '@/service/workflow'
 import { AppModeEnum } from '@/types/app'
 import { getRedirection } from '@/utils/app-redirection'
@@ -53,6 +53,7 @@ const getCurrentUiState = (state: AppInfoUiState, resetKey?: string) => {
 export function useAppInfoActions({ onDetailExpand, resetKey }: UseAppInfoActionsParams) {
   const { t } = useTranslation()
   const { replace } = useRouter()
+  const queryClient = useQueryClient()
   const { onPlanInfoChanged } = useProviderContext()
   const appDetail = useAppStore(state => state.appDetail)
   const setAppDetail = useAppStore(state => state.setAppDetail)
@@ -108,7 +109,7 @@ export function useAppInfoActions({ onDetailExpand, resetKey }: UseAppInfoAction
     setActiveModal(null)
   }, [setActiveModal])
 
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
 
   const emitAppMetaUpdate = useCallback(() => {
     if (!appDetail?.id)
@@ -145,6 +146,7 @@ export function useAppInfoActions({ onDetailExpand, resetKey }: UseAppInfoAction
             const res = await fetchAppDetail({ url: '/apps', id: appDetail.id })
             if (disposed)
               return
+            queryClient.setQueryData([...appDetailQueryKeyPrefix, appDetail.id], res)
             setAppDetail({ ...res })
           }
           catch (error) {
@@ -158,7 +160,7 @@ export function useAppInfoActions({ onDetailExpand, resetKey }: UseAppInfoAction
       disposed = true
       unsubscribe?.()
     }
-  }, [appDetail?.id, setAppDetail])
+  }, [appDetail?.id, queryClient, setAppDetail])
 
   const onEdit: CreateAppModalProps['onConfirm'] = useCallback(async ({
     name,
@@ -184,13 +186,14 @@ export function useAppInfoActions({ onDetailExpand, resetKey }: UseAppInfoAction
       })
       closeModal()
       toast(t('editDone', { ns: 'app' }), { type: 'success' })
+      queryClient.setQueryData([...appDetailQueryKeyPrefix, app.id], app)
       setAppDetail(app)
       emitAppMetaUpdate()
     }
     catch {
       toast(t('editFailed', { ns: 'app' }), { type: 'error' })
     }
-  }, [appDetail, closeModal, setAppDetail, t, emitAppMetaUpdate])
+  }, [appDetail, closeModal, queryClient, setAppDetail, t, emitAppMetaUpdate])
 
   const onCopy: DuplicateAppModalProps['onConfirm'] = useCallback(async ({
     name,
@@ -213,12 +216,12 @@ export function useAppInfoActions({ onDetailExpand, resetKey }: UseAppInfoAction
       toast(t('newApp.appCreated', { ns: 'app' }), { type: 'success' })
       setNeedRefresh('1')
       onPlanInfoChanged()
-      getRedirection(true, newApp, replace)
+      getRedirection(newApp, replace)
     }
     catch {
       toast(t('newApp.appCreateFailed', { ns: 'app' }), { type: 'error' })
     }
-  }, [appDetail, closeModal, onPlanInfoChanged, replace, t])
+  }, [appDetail, closeModal, onPlanInfoChanged, replace, setNeedRefresh, t])
 
   const onExport = useCallback(async (include = false) => {
     if (!appDetail)
diff --git a/web/app/components/app-sidebar/app-sidebar-dropdown.tsx b/web/app/components/app-sidebar/app-sidebar-dropdown.tsx
index 2b41e80a19d..3292c34cf5e 100644
--- a/web/app/components/app-sidebar/app-sidebar-dropdown.tsx
+++ b/web/app/components/app-sidebar/app-sidebar-dropdown.tsx
@@ -6,15 +6,9 @@ import {
   DropdownMenuContent,
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
-import {
-  RiEqualizer2Line,
-  RiMenuLine,
-} from '@remixicon/react'
-import * as React from 'react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
-import { useAppContext } from '@/context/app-context'
 import AppIcon from '../base/app-icon'
 import Divider from '../base/divider'
 import AppInfo from './app-info'
@@ -33,7 +27,6 @@ type Props = Readonly<{
 
 const AppSidebarDropdown = ({ navigation, appInfoActions }: Props) => {
   const { t } = useTranslation()
-  const { isCurrentWorkspaceEditor } = useAppContext()
   const appDetail = useAppStore(state => state.appDetail)
   const [detailExpand, setDetailExpand] = useState(false)
   const [open, setOpen] = useState(false)
@@ -59,7 +52,7 @@ const AppSidebarDropdown = ({ navigation, appInfoActions }: Props) => {
               background={appDetail.icon_background}
               imageUrl={appDetail.icon_url}
             />
-            <RiMenuLine className="size-4 text-text-tertiary" />
+            <span className="i-ri-menu-line size-4 text-text-tertiary" />
           </DropdownMenuTrigger>
           <DropdownMenuContent
             placement="bottom-start"
@@ -69,7 +62,7 @@ const AppSidebarDropdown = ({ navigation, appInfoActions }: Props) => {
             <div className={cn('w-[305px] rounded-xl border-[0.5px] border-components-panel-border bg-background-default-subtle shadow-lg')}>
               <div className="p-2">
                 <div
-                  className={cn('flex flex-col gap-2 rounded-lg p-2 pb-2.5', isCurrentWorkspaceEditor && 'cursor-pointer hover:bg-state-base-hover')}
+                  className="flex cursor-pointer flex-col gap-2 rounded-lg p-2 pb-2.5 hover:bg-state-base-hover"
                   onClick={() => {
                     if (appInfoActions)
                       appInfoActions.setPanelOpen(true)
@@ -88,7 +81,7 @@ const AppSidebarDropdown = ({ navigation, appInfoActions }: Props) => {
                     />
                     <div className="flex items-center justify-center rounded-md p-0.5">
                       <div className="flex size-5 items-center justify-center">
-                        <RiEqualizer2Line className="size-4 text-text-tertiary" />
+                        <span className="i-ri-equalizer-2-line size-4 text-text-tertiary" />
                       </div>
                     </div>
                   </div>
diff --git a/web/app/components/app-sidebar/dataset-detail-section.tsx b/web/app/components/app-sidebar/dataset-detail-section.tsx
index 824712155a1..f337c6b15aa 100644
--- a/web/app/components/app-sidebar/dataset-detail-section.tsx
+++ b/web/app/components/app-sidebar/dataset-detail-section.tsx
@@ -9,6 +9,8 @@ import {
   RiFileTextLine,
   RiFocus2Fill,
   RiFocus2Line,
+  RiLock2Fill,
+  RiLock2Line,
 } from '@remixicon/react'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -19,6 +21,7 @@ import { useAppContext } from '@/context/app-context'
 import DatasetDetailContext from '@/context/dataset-detail'
 import { usePathname } from '@/next/navigation'
 import { useDatasetDetail, useDatasetRelatedApps } from '@/service/knowledge/use-dataset'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import DatasetInfo from './dataset-info'
 import NavLink from './nav-link'
 
@@ -37,9 +40,14 @@ const DatasetDetailSection = ({
   const { t } = useTranslation()
   const pathname = usePathname()
   const datasetId = getDatasetIdFromPathname(pathname)
-  const { isCurrentWorkspaceDatasetOperator } = useAppContext()
+  const { userProfile, workspacePermissionKeys } = useAppContext()
   const { data: datasetRes, refetch: mutateDatasetRes } = useDatasetDetail(datasetId ?? '')
   const { data: relatedApps } = useDatasetRelatedApps(datasetId ?? '', { enabled: !!datasetId && !!datasetRes })
+  const datasetACLCapabilities = useMemo(() => getDatasetACLCapabilities(datasetRes?.permission_keys, {
+    currentUserId: userProfile?.id,
+    resourceMaintainer: datasetRes?.maintainer,
+    workspacePermissionKeys,
+  }), [datasetRes?.maintainer, datasetRes?.permission_keys, userProfile?.id, workspacePermissionKeys])
 
   const isButtonDisabledWithPipeline = useMemo(() => {
     if (!datasetRes)
@@ -61,7 +69,7 @@ const DatasetDetailSection = ({
         href: `/datasets/${datasetId}/hitTesting`,
         icon: RiFocus2Line,
         selectedIcon: RiFocus2Fill,
-        disabled: isButtonDisabledWithPipeline,
+        disabled: isButtonDisabledWithPipeline || !datasetACLCapabilities.canRetrievalRecall,
       },
       {
         name: t('datasetMenus.settings', { ns: 'common' }),
@@ -70,6 +78,16 @@ const DatasetDetailSection = ({
         selectedIcon: RiEqualizer2Fill,
         disabled: false,
       },
+      ...(datasetACLCapabilities.canAccessConfig
+        ? [{
+            name: t('settings.resourceAccess', { ns: 'common' }),
+            href: `/datasets/${datasetId}/access-config`,
+            icon: RiLock2Line,
+            selectedIcon: RiLock2Fill,
+            disabled: false,
+          }]
+        : []
+      ),
     ]
 
     if (datasetRes?.provider !== 'external') {
@@ -90,7 +108,7 @@ const DatasetDetailSection = ({
     }
 
     return baseNavigation
-  }, [t, datasetId, isButtonDisabledWithPipeline, datasetRes?.provider])
+  }, [t, datasetId, isButtonDisabledWithPipeline, datasetRes?.provider, datasetACLCapabilities])
 
   if (!datasetRes)
     return null
@@ -128,7 +146,7 @@ const DatasetDetailSection = ({
             />
           ))}
         </nav>
-        {!isCurrentWorkspaceDatasetOperator && (
+        {datasetACLCapabilities.canEdit && (
           <div className="mt-auto shrink-0">
             <ExtraInfo
               relatedApps={relatedApps}
diff --git a/web/app/components/app-sidebar/dataset-info/__tests__/dropdown-callbacks.spec.tsx b/web/app/components/app-sidebar/dataset-info/__tests__/dropdown-callbacks.spec.tsx
index 05a06f2f77d..e1bfb008a71 100644
--- a/web/app/components/app-sidebar/dataset-info/__tests__/dropdown-callbacks.spec.tsx
+++ b/web/app/components/app-sidebar/dataset-info/__tests__/dropdown-callbacks.spec.tsx
@@ -8,10 +8,10 @@ import {
   DataSourceType,
 } from '@/models/datasets'
 import { RETRIEVE_METHOD } from '@/types/app'
+import { DatasetACLPermission } from '@/utils/permission'
 import Dropdown from '../dropdown'
 
 let mockDataset: DataSet
-let mockIsDatasetOperator = false
 const mockReplace = vi.fn()
 const mockInvalidDatasetList = vi.fn()
 const mockInvalidDatasetDetail = vi.fn()
@@ -78,6 +78,11 @@ const createDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
   runtime_mode: 'rag_pipeline',
   enable_api: false,
   is_multimodal: false,
+  permission_keys: [
+    DatasetACLPermission.Edit,
+    DatasetACLPermission.Delete,
+    DatasetACLPermission.ImportExportDSL,
+  ],
   ...overrides,
 })
 
@@ -89,11 +94,6 @@ vi.mock('@/context/dataset-detail', () => ({
   useDatasetDetailContextWithSelector: (selector: (state: { dataset?: DataSet }) => unknown) => selector({ dataset: mockDataset }),
 }))
 
-vi.mock('@/context/app-context', () => ({
-  useSelector: (selector: (state: { isCurrentWorkspaceDatasetOperator: boolean }) => unknown) =>
-    selector({ isCurrentWorkspaceDatasetOperator: mockIsDatasetOperator }),
-}))
-
 vi.mock('@/service/knowledge/use-dataset', () => ({
   datasetDetailQueryKeyPrefix: ['dataset', 'detail'],
   useInvalidDatasetList: () => mockInvalidDatasetList,
@@ -143,7 +143,6 @@ describe('Dropdown callback coverage', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDataset = createDataset({ pipeline_id: 'pipeline-1', runtime_mode: 'rag_pipeline' })
-    mockIsDatasetOperator = false
     mockExportPipeline.mockResolvedValue({ data: 'pipeline-content' })
     mockCheckIsUsedInApp.mockResolvedValue({ is_using: false })
     mockDeleteDataset.mockResolvedValue({})
diff --git a/web/app/components/app-sidebar/dataset-info/__tests__/index.spec.tsx b/web/app/components/app-sidebar/dataset-info/__tests__/index.spec.tsx
index e1c4aa7b2b7..63e05435c99 100644
--- a/web/app/components/app-sidebar/dataset-info/__tests__/index.spec.tsx
+++ b/web/app/components/app-sidebar/dataset-info/__tests__/index.spec.tsx
@@ -8,13 +8,14 @@ import {
   DataSourceType,
 } from '@/models/datasets'
 import { RETRIEVE_METHOD } from '@/types/app'
+import { DatasetACLPermission } from '@/utils/permission'
 import DatasetInfo from '..'
 import Dropdown from '../dropdown'
 import Menu from '../menu'
 import MenuItem from '../menu-item'
 
 let mockDataset: DataSet
-let mockIsDatasetOperator = false
+const mockPush = vi.fn()
 const mockReplace = vi.fn()
 const mockInvalidDatasetList = vi.fn()
 const mockInvalidDatasetDetail = vi.fn()
@@ -87,11 +88,17 @@ const createDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
   runtime_mode: 'rag_pipeline',
   enable_api: false,
   is_multimodal: false,
+  permission_keys: [
+    DatasetACLPermission.Edit,
+    DatasetACLPermission.Delete,
+    DatasetACLPermission.ImportExportDSL,
+  ],
   ...overrides,
 })
 
 vi.mock('@/next/navigation', () => ({
   useRouter: () => ({
+    push: mockPush,
     replace: mockReplace,
   }),
 }))
@@ -100,11 +107,6 @@ vi.mock('@/context/dataset-detail', () => ({
   useDatasetDetailContextWithSelector: (selector: (state: { dataset?: DataSet }) => unknown) => selector({ dataset: mockDataset }),
 }))
 
-vi.mock('@/context/app-context', () => ({
-  useSelector: (selector: (state: { isCurrentWorkspaceDatasetOperator: boolean }) => unknown) =>
-    selector({ isCurrentWorkspaceDatasetOperator: mockIsDatasetOperator }),
-}))
-
 vi.mock('@/service/knowledge/use-dataset', () => ({
   datasetDetailQueryKeyPrefix: ['dataset', 'detail'],
   useInvalidDatasetList: () => mockInvalidDatasetList,
@@ -161,7 +163,6 @@ describe('DatasetInfo', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDataset = createDataset()
-    mockIsDatasetOperator = false
   })
 
   // Rendering of dataset summary details based on expand and dataset state.
@@ -273,6 +274,21 @@ describe('Menu', () => {
       expect(screen.getByText('common.operation.delete')).toBeInTheDocument()
     })
 
+    it('should show resource access option when enabled', () => {
+      render(
+        <Menu
+          showDelete={false}
+          showAccessConfig
+          openRenameModal={vi.fn()}
+          handleExportPipeline={vi.fn()}
+          detectIsUsedByApp={vi.fn()}
+          openAccessConfig={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByText('common.settings.resourceAccess')).toBeInTheDocument()
+    })
+
     it('should hide export and delete options when not rag pipeline and not deletable', () => {
       // Arrange
       mockDataset = createDataset({ runtime_mode: 'general' })
@@ -331,6 +347,26 @@ describe('Menu', () => {
       expect(handleExportPipeline).toHaveBeenCalledTimes(1)
       expect(detectIsUsedByApp).toHaveBeenCalledTimes(1)
     })
+
+    it('should invoke access config callback from its menu item', async () => {
+      const user = userEvent.setup()
+      const openAccessConfig = vi.fn()
+
+      render(
+        <Menu
+          showDelete={false}
+          showAccessConfig
+          openRenameModal={vi.fn()}
+          handleExportPipeline={vi.fn()}
+          detectIsUsedByApp={vi.fn()}
+          openAccessConfig={openAccessConfig}
+        />,
+      )
+
+      await user.click(screen.getByText('common.settings.resourceAccess'))
+
+      expect(openAccessConfig).toHaveBeenCalledTimes(1)
+    })
   })
 })
 
@@ -338,7 +374,6 @@ describe('Dropdown', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDataset = createDataset({ pipeline_id: 'pipeline-1', runtime_mode: 'rag_pipeline' })
-    mockIsDatasetOperator = false
     mockExportPipeline.mockResolvedValue({ data: 'pipeline-content' })
     mockCheckIsUsedInApp.mockResolvedValue({ is_using: false })
     mockDeleteDataset.mockResolvedValue({})
@@ -356,12 +391,19 @@ describe('Dropdown', () => {
     }
   })
 
-  // Rendering behavior based on workspace role.
+  // Rendering behavior based on dataset ACL permission keys.
   describe('Rendering', () => {
-    it('should hide delete option when user is dataset operator', async () => {
+    it('should hide delete option when dataset lacks delete ACL permission', async () => {
       const user = userEvent.setup()
       // Arrange
-      mockIsDatasetOperator = true
+      mockDataset = createDataset({
+        pipeline_id: 'pipeline-1',
+        runtime_mode: 'rag_pipeline',
+        permission_keys: [
+          DatasetACLPermission.Edit,
+          DatasetACLPermission.ImportExportDSL,
+        ],
+      })
       render(<Dropdown expand />)
 
       // Act
@@ -370,6 +412,24 @@ describe('Dropdown', () => {
       // Assert
       expect(screen.queryByText('common.operation.delete')).not.toBeInTheDocument()
     })
+
+    it('should show resource access option when dataset only has access config ACL permission', async () => {
+      const user = userEvent.setup()
+      // Arrange
+      mockDataset = createDataset({
+        runtime_mode: 'general',
+        permission_keys: [DatasetACLPermission.AccessConfig],
+      })
+      render(<Dropdown expand />)
+
+      // Act
+      await openMenu(user)
+
+      // Assert
+      expect(screen.getByText('common.settings.resourceAccess')).toBeInTheDocument()
+      expect(screen.queryByText('common.operation.edit')).not.toBeInTheDocument()
+      expect(screen.queryByText('common.operation.delete')).not.toBeInTheDocument()
+    })
   })
 
   // User interactions that trigger modals and exports.
@@ -441,5 +501,22 @@ describe('Dropdown', () => {
       expect(mockInvalidDatasetList).toHaveBeenCalledTimes(1)
       expect(mockReplace).toHaveBeenCalledWith('/datasets')
     })
+
+    it('should navigate to dataset access config when resource access is clicked', async () => {
+      const user = userEvent.setup()
+      // Arrange
+      mockDataset = createDataset({
+        runtime_mode: 'general',
+        permission_keys: [DatasetACLPermission.AccessConfig],
+      })
+      render(<Dropdown expand />)
+
+      // Act
+      await openMenu(user)
+      await user.click(screen.getByText('common.settings.resourceAccess'))
+
+      // Assert
+      expect(mockPush).toHaveBeenCalledWith('/datasets/dataset-1/access-config')
+    })
   })
 })
diff --git a/web/app/components/app-sidebar/dataset-info/dropdown.tsx b/web/app/components/app-sidebar/dataset-info/dropdown.tsx
index 8d37fadb656..6539e6e1715 100644
--- a/web/app/components/app-sidebar/dataset-info/dropdown.tsx
+++ b/web/app/components/app-sidebar/dataset-info/dropdown.tsx
@@ -26,6 +26,7 @@ import { datasetDetailQueryKeyPrefix, useInvalidDatasetList } from '@/service/kn
 import { useInvalid } from '@/service/use-base'
 import { useExportPipelineDSL } from '@/service/use-pipeline'
 import { downloadBlob } from '@/utils/download'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import ActionButton from '../../base/action-button'
 import RenameDatasetModal from '../../datasets/rename-modal'
 import Menu from './menu'
@@ -59,14 +60,24 @@ const DropDown = ({
   triggerClassName,
 }: DropDownProps) => {
   const { t } = useTranslation()
-  const { replace } = useRouter()
+  const { push, replace } = useRouter()
   const [open, setOpen] = useState(false)
   const [showRenameModal, setShowRenameModal] = useState(false)
   const [confirmMessage, setConfirmMessage] = useState<string>('')
   const [showConfirmDelete, setShowConfirmDelete] = useState(false)
 
-  const isCurrentWorkspaceDatasetOperator = useAppContextWithSelector(state => state.isCurrentWorkspaceDatasetOperator)
   const dataset = useDatasetDetailContextWithSelector(state => state.dataset) as DataSet
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const datasetACLCapabilities = React.useMemo(() => getDatasetACLCapabilities(dataset?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset?.maintainer,
+    workspacePermissionKeys,
+  }), [dataset?.maintainer, dataset?.permission_keys, currentUserId, workspacePermissionKeys])
+  const canShowOperations = datasetACLCapabilities.canEdit
+    || datasetACLCapabilities.canImportExportDSL
+    || datasetACLCapabilities.canAccessConfig
+    || datasetACLCapabilities.canDelete
 
   const invalidDatasetList = useInvalidDatasetList()
   const invalidDatasetDetail = useInvalid([...datasetDetailQueryKeyPrefix, dataset.id])
@@ -115,6 +126,11 @@ const DropDown = ({
     }
   }, [dataset.id, t])
 
+  const openAccessConfig = useCallback(() => {
+    setOpen(false)
+    push(`/datasets/${dataset.id}/access-config`)
+  }, [dataset.id, push])
+
   const onConfirmDelete = useCallback(async () => {
     try {
       await deleteDataset(dataset.id)
@@ -127,6 +143,9 @@ const DropDown = ({
     }
   }, [dataset.id, replace, invalidDatasetList, t])
 
+  if (!canShowOperations)
+    return null
+
   return (
     <DropdownMenu
       open={open}
@@ -149,10 +168,14 @@ const DropDown = ({
         popupClassName="border-0 bg-transparent p-0 shadow-none backdrop-blur-none"
       >
         <Menu
-          showDelete={!isCurrentWorkspaceDatasetOperator}
+          showEdit={datasetACLCapabilities.canEdit}
+          showDelete={datasetACLCapabilities.canDelete}
+          showExportPipeline={datasetACLCapabilities.canImportExportDSL}
+          showAccessConfig={datasetACLCapabilities.canAccessConfig}
           openRenameModal={openRenameModal}
           handleExportPipeline={handleExportPipeline}
           detectIsUsedByApp={detectIsUsedByApp}
+          openAccessConfig={openAccessConfig}
         />
       </DropdownMenuContent>
       {showRenameModal && (
diff --git a/web/app/components/app-sidebar/dataset-info/menu.tsx b/web/app/components/app-sidebar/dataset-info/menu.tsx
index 8192bbda42c..ae8bd2ec270 100644
--- a/web/app/components/app-sidebar/dataset-info/menu.tsx
+++ b/web/app/components/app-sidebar/dataset-info/menu.tsx
@@ -1,4 +1,9 @@
-import { RiDeleteBinLine, RiEditLine, RiFileDownloadLine } from '@remixicon/react'
+import {
+  RiDeleteBinLine,
+  RiEditLine,
+  RiFileDownloadLine,
+  RiLock2Line,
+} from '@remixicon/react'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
@@ -6,17 +11,25 @@ import Divider from '../../base/divider'
 import MenuItem from './menu-item'
 
 type MenuProps = {
+  showEdit?: boolean
   showDelete: boolean
+  showExportPipeline?: boolean
+  showAccessConfig?: boolean
   openRenameModal: () => void
   handleExportPipeline: () => void
   detectIsUsedByApp: () => void
+  openAccessConfig?: () => void
 }
 
 const Menu = ({
+  showEdit = true,
   showDelete,
+  showExportPipeline = true,
+  showAccessConfig = false,
   openRenameModal,
   handleExportPipeline,
   detectIsUsedByApp,
+  openAccessConfig,
 }: MenuProps) => {
   const { t } = useTranslation()
   const runtimeMode = useDatasetDetailContextWithSelector(state => state.dataset?.runtime_mode)
@@ -24,18 +37,27 @@ const Menu = ({
   return (
     <div className="flex w-[200px] flex-col rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]">
       <div className="flex flex-col p-1">
-        <MenuItem
-          Icon={RiEditLine}
-          name={t('operation.edit', { ns: 'common' })}
-          handleClick={openRenameModal}
-        />
-        {runtimeMode === 'rag_pipeline' && (
+        {showEdit && (
+          <MenuItem
+            Icon={RiEditLine}
+            name={t('operation.edit', { ns: 'common' })}
+            handleClick={openRenameModal}
+          />
+        )}
+        {showExportPipeline && runtimeMode === 'rag_pipeline' && (
           <MenuItem
             Icon={RiFileDownloadLine}
             name={t('operations.exportPipeline', { ns: 'datasetPipeline' })}
             handleClick={handleExportPipeline}
           />
         )}
+        {showAccessConfig && (
+          <MenuItem
+            Icon={RiLock2Line}
+            name={t('settings.resourceAccess', { ns: 'common' })}
+            handleClick={openAccessConfig}
+          />
+        )}
       </div>
       {showDelete && (
         <>
diff --git a/web/app/components/app-sidebar/index.tsx b/web/app/components/app-sidebar/index.tsx
index 22ae25ddb0a..1e4783390e4 100644
--- a/web/app/components/app-sidebar/index.tsx
+++ b/web/app/components/app-sidebar/index.tsx
@@ -4,9 +4,8 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { useHotkey } from '@tanstack/react-hotkeys'
 import { useHover } from 'ahooks'
 import * as React from 'react'
-import { useCallback, useEffect } from 'react'
-import { useShallow } from 'zustand/react/shallow'
-import { useStore as useAppStore } from '@/app/components/app/store'
+import { useCallback } from 'react'
+import { useDetailSidebarMode } from '@/app/components/main-nav/storage'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
 import Divider from '../base/divider'
 import AppInfo, { AppInfoView } from './app-info'
@@ -37,28 +36,18 @@ const AppDetailNav = ({
   iconType = 'app',
   appInfoActions,
 }: IAppDetailNavProps) => {
-  const { appSidebarExpand, setAppSidebarExpand } = useAppStore(useShallow(state => ({
-    appSidebarExpand: state.appSidebarExpand,
-    setAppSidebarExpand: state.setAppSidebarExpand,
-  })))
+  const [detailSidebarMode, setDetailSidebarMode] = useDetailSidebarMode()
   const sidebarRef = React.useRef<HTMLDivElement>(null)
   const media = useBreakpoints()
   const isMobile = media === MediaType.mobile
-  const expand = appSidebarExpand === 'expand'
+  const expand = detailSidebarMode === 'expand'
 
   const handleToggle = useCallback(() => {
-    setAppSidebarExpand(appSidebarExpand === 'expand' ? 'collapse' : 'expand')
-  }, [appSidebarExpand, setAppSidebarExpand])
+    setDetailSidebarMode(detailSidebarMode === 'expand' ? 'collapse' : 'expand')
+  }, [detailSidebarMode, setDetailSidebarMode])
 
   const isHoveringSidebar = useHover(sidebarRef)
 
-  useEffect(() => {
-    if (appSidebarExpand) {
-      localStorage.setItem('app-detail-collapse-or-expand', appSidebarExpand)
-      setAppSidebarExpand(appSidebarExpand)
-    }
-  }, [appSidebarExpand, setAppSidebarExpand])
-
   useHotkey('Mod+B', (e) => {
     e.preventDefault()
     handleToggle()
@@ -71,7 +60,7 @@ const AppDetailNav = ({
       ref={sidebarRef}
       className={cn(
         'flex shrink-0 flex-col border-r border-divider-burn bg-background-default-subtle transition-all',
-        expand ? 'w-[216px]' : 'w-14',
+        expand ? 'w-55' : 'w-14',
       )}
     >
       <div
@@ -81,7 +70,7 @@ const AppDetailNav = ({
         )}
       >
         {renderHeader
-          ? renderHeader(appSidebarExpand)
+          ? renderHeader(detailSidebarMode)
           : iconType === 'app' && (
             appInfoActions
               ? (
@@ -123,12 +112,12 @@ const AppDetailNav = ({
         )}
       >
         {renderNavigation
-          ? renderNavigation(appSidebarExpand)
+          ? renderNavigation(detailSidebarMode)
           : navigation.map((item, index) => {
               return (
                 <NavLink
                   key={index}
-                  mode={appSidebarExpand}
+                  mode={detailSidebarMode}
                   iconMap={{ selected: item.selectedIcon, normal: item.icon }}
                   name={item.name}
                   href={item.href}
@@ -137,7 +126,7 @@ const AppDetailNav = ({
               )
             })}
       </nav>
-      {iconType !== 'app' && extraInfo && extraInfo(appSidebarExpand)}
+      {iconType !== 'app' && extraInfo && extraInfo(detailSidebarMode)}
     </div>
   )
 }
diff --git a/web/app/components/app-sidebar/snippet-info/__tests__/dropdown.spec.tsx b/web/app/components/app-sidebar/snippet-info/__tests__/dropdown.spec.tsx
index 51f1f0c341b..f72100e9a8f 100644
--- a/web/app/components/app-sidebar/snippet-info/__tests__/dropdown.spec.tsx
+++ b/web/app/components/app-sidebar/snippet-info/__tests__/dropdown.spec.tsx
@@ -12,9 +12,16 @@ const mockToastError = vi.fn()
 const mockUpdateMutate = vi.fn()
 const mockExportMutateAsync = vi.fn()
 const mockDeleteMutate = vi.fn()
+let mockWorkspacePermissionKeys: string[] = ['snippets.create_and_modify', 'snippets.management']
 let mockDropdownOpen = false
 let mockDropdownOnOpenChange: ((open: boolean) => void) | undefined
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 vi.mock('@/next/navigation', () => ({
   useRouter: () => ({
     replace: mockReplace,
@@ -156,6 +163,7 @@ const mockSnippet: SnippetDetail = {
 describe('SnippetInfoDropdown', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys = ['snippets.create_and_modify', 'snippets.management']
     mockDropdownOpen = false
     mockDropdownOnOpenChange = undefined
   })
@@ -167,6 +175,35 @@ describe('SnippetInfoDropdown', () => {
 
       expect(screen.getByRole('button')).toBeInTheDocument()
     })
+
+    it('should render nothing without snippet create or management permission', () => {
+      mockWorkspacePermissionKeys = []
+
+      render(<SnippetInfoDropdown snippet={mockSnippet} />)
+
+      expect(screen.queryByRole('button')).not.toBeInTheDocument()
+    })
+
+    it('should split edit from export and delete actions by snippet permission', async () => {
+      const user = userEvent.setup()
+      mockWorkspacePermissionKeys = ['snippets.create_and_modify']
+
+      const { unmount } = render(<SnippetInfoDropdown snippet={mockSnippet} />)
+      await user.click(screen.getByRole('button'))
+
+      expect(screen.getByText('snippet.menu.editInfo')).toBeInTheDocument()
+      expect(screen.queryByText('snippet.menu.exportSnippet')).not.toBeInTheDocument()
+      expect(screen.queryByText('snippet.menu.deleteSnippet')).not.toBeInTheDocument()
+
+      unmount()
+      mockWorkspacePermissionKeys = ['snippets.management']
+      render(<SnippetInfoDropdown snippet={mockSnippet} />)
+      await user.click(screen.getByRole('button'))
+
+      expect(screen.queryByText('snippet.menu.editInfo')).not.toBeInTheDocument()
+      expect(screen.getByText('snippet.menu.exportSnippet')).toBeInTheDocument()
+      expect(screen.getByText('snippet.menu.deleteSnippet')).toBeInTheDocument()
+    })
   })
 
   // Edit flow should seed the dialog with current snippet info and submit updates.
@@ -207,6 +244,7 @@ describe('SnippetInfoDropdown', () => {
   describe('Export Snippet', () => {
     it('should export and download the snippet yaml', async () => {
       const user = userEvent.setup()
+      mockWorkspacePermissionKeys = ['snippets.management']
       mockExportMutateAsync.mockResolvedValue('yaml: content')
 
       render(<SnippetInfoDropdown snippet={mockSnippet} />)
@@ -226,6 +264,7 @@ describe('SnippetInfoDropdown', () => {
 
     it('should show an error toast when export fails', async () => {
       const user = userEvent.setup()
+      mockWorkspacePermissionKeys = ['snippets.management']
       mockExportMutateAsync.mockRejectedValue(new Error('export failed'))
 
       render(<SnippetInfoDropdown snippet={mockSnippet} />)
diff --git a/web/app/components/app-sidebar/snippet-info/dropdown.tsx b/web/app/components/app-sidebar/snippet-info/dropdown.tsx
index eb108fd2005..00400019f92 100644
--- a/web/app/components/app-sidebar/snippet-info/dropdown.tsx
+++ b/web/app/components/app-sidebar/snippet-info/dropdown.tsx
@@ -22,6 +22,8 @@ import { toast } from '@langgenius/dify-ui/toast'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
 import CreateSnippetDialog from '@/app/components/snippets/create-snippet-dialog'
+import { canCreateAndModifySnippets, canManageSnippets } from '@/app/components/snippets/utils/permission'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useRouter } from '@/next/navigation'
 import { useDeleteSnippetMutation, useExportSnippetMutation, useUpdateSnippetMutation } from '@/service/use-snippets'
 
@@ -34,12 +36,16 @@ type SnippetInfoDropdownProps = {
 const SnippetInfoDropdown = ({ snippet }: SnippetInfoDropdownProps) => {
   const { t } = useTranslation('snippet')
   const { replace } = useRouter()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const [open, setOpen] = React.useState(false)
   const [isEditDialogOpen, setIsEditDialogOpen] = React.useState(false)
   const [isDeleteDialogOpen, setIsDeleteDialogOpen] = React.useState(false)
   const updateSnippetMutation = useUpdateSnippetMutation()
   const exportSnippetMutation = useExportSnippetMutation()
   const deleteSnippetMutation = useDeleteSnippetMutation()
+  const canCreateAndModifySnippet = canCreateAndModifySnippets(workspacePermissionKeys)
+  const canManageSnippet = canManageSnippets(workspacePermissionKeys)
+  const canShowOperations = canCreateAndModifySnippet || canManageSnippet
 
   const initialValue = React.useMemo(() => ({
     name: snippet.name,
@@ -52,6 +58,9 @@ const SnippetInfoDropdown = ({ snippet }: SnippetInfoDropdownProps) => {
   }, [])
 
   const handleExportSnippet = React.useCallback(async () => {
+    if (!canManageSnippet)
+      return
+
     setOpen(false)
     try {
       const data = await exportSnippetMutation.mutateAsync({ snippetId: snippet.id })
@@ -61,7 +70,7 @@ const SnippetInfoDropdown = ({ snippet }: SnippetInfoDropdownProps) => {
     catch {
       toast.error(t('exportFailed'))
     }
-  }, [exportSnippetMutation, snippet.id, snippet.name, t])
+  }, [canManageSnippet, exportSnippetMutation, snippet.id, snippet.name, t])
 
   const handleEditSnippet = React.useCallback(async ({ name, description }: {
     name: string
@@ -99,6 +108,9 @@ const SnippetInfoDropdown = ({ snippet }: SnippetInfoDropdownProps) => {
     })
   }, [deleteSnippetMutation, replace, snippet.id, t])
 
+  if (!canShowOperations)
+    return null
+
   return (
     <>
       <DropdownMenu open={open} onOpenChange={setOpen}>
@@ -112,26 +124,32 @@ const SnippetInfoDropdown = ({ snippet }: SnippetInfoDropdownProps) => {
           sideOffset={4}
           popupClassName="w-[180px] p-1"
         >
-          <DropdownMenuItem className="mx-0 gap-2" onClick={handleOpenEditDialog}>
-            <span aria-hidden className="i-ri-edit-line size-4 shrink-0 text-text-tertiary" />
-            <span className="grow">{t('menu.editInfo')}</span>
-          </DropdownMenuItem>
-          <DropdownMenuItem className="mx-0 gap-2" onClick={handleExportSnippet}>
-            <span aria-hidden className="i-ri-download-2-line size-4 shrink-0 text-text-tertiary" />
-            <span className="grow">{t('menu.exportSnippet')}</span>
-          </DropdownMenuItem>
-          <DropdownMenuSeparator className="my-1! bg-divider-subtle" />
-          <DropdownMenuItem
-            className="mx-0 gap-2"
-            variant="destructive"
-            onClick={() => {
-              setOpen(false)
-              setIsDeleteDialogOpen(true)
-            }}
-          >
-            <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
-            <span className="grow">{t('menu.deleteSnippet')}</span>
-          </DropdownMenuItem>
+          {canCreateAndModifySnippet && (
+            <DropdownMenuItem className="mx-0 gap-2" onClick={handleOpenEditDialog}>
+              <span aria-hidden className="i-ri-edit-line size-4 shrink-0 text-text-tertiary" />
+              <span className="grow">{t('menu.editInfo')}</span>
+            </DropdownMenuItem>
+          )}
+          {canManageSnippet && (
+            <>
+              <DropdownMenuItem className="mx-0 gap-2" onClick={handleExportSnippet}>
+                <span aria-hidden className="i-ri-download-2-line size-4 shrink-0 text-text-tertiary" />
+                <span className="grow">{t('menu.exportSnippet')}</span>
+              </DropdownMenuItem>
+              <DropdownMenuSeparator className="my-1! bg-divider-subtle" />
+              <DropdownMenuItem
+                className="mx-0 gap-2"
+                variant="destructive"
+                onClick={() => {
+                  setOpen(false)
+                  setIsDeleteDialogOpen(true)
+                }}
+              >
+                <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
+                <span className="grow">{t('menu.deleteSnippet')}</span>
+              </DropdownMenuItem>
+            </>
+          )}
         </DropdownMenuContent>
       </DropdownMenu>
 
diff --git a/web/app/components/app/__tests__/store.spec.ts b/web/app/components/app/__tests__/store.spec.ts
index 204d659fdd8..6245d4b2d3d 100644
--- a/web/app/components/app/__tests__/store.spec.ts
+++ b/web/app/components/app/__tests__/store.spec.ts
@@ -3,7 +3,6 @@ import { useStore } from '../store'
 const resetStore = () => {
   useStore.setState({
     appDetail: undefined,
-    appSidebarExpand: '',
     currentLogItem: undefined,
     currentLogModalActiveTab: 'DETAIL',
     showPromptLogModal: false,
@@ -21,7 +20,6 @@ describe('app store', () => {
   it('should expose the default state', () => {
     expect(useStore.getState()).toEqual(expect.objectContaining({
       appDetail: undefined,
-      appSidebarExpand: '',
       currentLogItem: undefined,
       currentLogModalActiveTab: 'DETAIL',
       showPromptLogModal: false,
@@ -36,7 +34,6 @@ describe('app store', () => {
     const currentLogItem = { id: 'message-1' } as ReturnType<typeof useStore.getState>['currentLogItem']
 
     useStore.getState().setAppDetail(appDetail)
-    useStore.getState().setAppSidebarExpand('logs')
     useStore.getState().setCurrentLogItem(currentLogItem)
     useStore.getState().setCurrentLogModalActiveTab('MESSAGE')
     useStore.getState().setShowPromptLogModal(true)
@@ -45,7 +42,6 @@ describe('app store', () => {
 
     expect(useStore.getState()).toEqual(expect.objectContaining({
       appDetail,
-      appSidebarExpand: 'logs',
       currentLogItem,
       currentLogModalActiveTab: 'MESSAGE',
       showPromptLogModal: true,
diff --git a/web/app/components/app/access-config/__tests__/index.spec.tsx b/web/app/components/app/access-config/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..49e8c86825d
--- /dev/null
+++ b/web/app/components/app/access-config/__tests__/index.spec.tsx
@@ -0,0 +1,214 @@
+import type { AccessRulesEditorProps } from '@/app/components/access-rules-editor'
+import { render, screen } from '@testing-library/react'
+import { useStore } from '@/app/components/app/store'
+import {
+  useAppAccessRules,
+  useAppUserAccessSettings,
+} from '@/service/access-control/use-app-access-config'
+import { AppACLPermission } from '@/utils/permission'
+import AppAccessConfigPage from '../index'
+
+const mockAppContext = vi.hoisted(() => ({
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: [] as string[],
+}))
+
+const mockAppAccessRules = vi.hoisted(() => ({
+  items: [] as AccessRulesEditorProps['rules'],
+  isLoading: false,
+}))
+
+const mockAppUserAccessSettings = vi.hoisted(() => ({
+  data: [] as NonNullable<AccessRulesEditorProps['userAccessSettings']>,
+  scope: 'specific' as AccessRulesEditorProps['openScope'],
+  isLoading: false,
+}))
+
+const mockAccessRulesEditor = vi.hoisted(() => ({
+  props: null as AccessRulesEditorProps | null,
+}))
+
+const mockMutations = vi.hoisted(() => ({
+  updateOpenScope: vi.fn(),
+  updateUserAccessSettings: vi.fn(),
+  removeMemberBindings: vi.fn(),
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => mockAppContext,
+}))
+
+vi.mock('@/service/access-control/use-app-access-config', () => ({
+  useAppAccessRules: vi.fn(() => ({
+    data: { items: mockAppAccessRules.items },
+    isLoading: mockAppAccessRules.isLoading,
+  })),
+  useAppUserAccessSettings: vi.fn(() => ({
+    data: mockAppUserAccessSettings.scope
+      ? { data: mockAppUserAccessSettings.data, scope: mockAppUserAccessSettings.scope }
+      : undefined,
+    isLoading: mockAppUserAccessSettings.isLoading,
+  })),
+  useUpdateAppOpenScope: vi.fn(() => ({
+    mutate: mockMutations.updateOpenScope,
+    isPending: false,
+  })),
+  useUpdateAppUserAccessSettings: vi.fn(() => ({
+    mutate: mockMutations.updateUserAccessSettings,
+  })),
+  useRemoveAppAccessPolicyMemberBindings: vi.fn(() => ({
+    mutate: mockMutations.removeMemberBindings,
+  })),
+}))
+
+vi.mock('@/app/components/access-rules-editor', () => ({
+  default: (props: AccessRulesEditorProps) => {
+    mockAccessRulesEditor.props = props
+    return (
+      <div data-testid="access-rules-editor" />
+    )
+  },
+}))
+
+describe('AppAccessConfigPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockAppContext.userProfile = { id: 'user-1' }
+    mockAppContext.workspacePermissionKeys = []
+    mockAppAccessRules.items = []
+    mockAppAccessRules.isLoading = false
+    mockAppUserAccessSettings.data = []
+    mockAppUserAccessSettings.scope = 'specific'
+    mockAppUserAccessSettings.isLoading = false
+    mockAccessRulesEditor.props = null
+    useStore.setState({
+      appDetail: {
+        id: 'app-1',
+        maintainer: 'account-1',
+        permission_keys: [AppACLPermission.AccessConfig],
+      } as NonNullable<ReturnType<typeof useStore.getState>['appDetail']>,
+    })
+  })
+
+  // Rendering wires the app access rules into the shared editor.
+  describe('Rendering', () => {
+    it('should render access config title and pass app rules to the editor', () => {
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      expect(screen.getByRole('heading', { name: 'common.settings.resourceAccess' })).toBeInTheDocument()
+      expect(screen.getByText('permission.accessRule.appDescription')).toBeInTheDocument()
+      expect(screen.getByTestId('access-rules-editor')).toBeInTheDocument()
+      expect(mockAccessRulesEditor.props?.className).toBe('w-full max-w-200')
+      expect(mockAccessRulesEditor.props?.rules).toEqual([])
+      expect(mockAccessRulesEditor.props?.userAccessSettings).toEqual([])
+      expect(mockAccessRulesEditor.props?.openScope).toBe('specific')
+    })
+
+    it('should not pass open scope before user access settings finish loading', () => {
+      mockAppUserAccessSettings.scope = undefined
+      mockAppUserAccessSettings.isLoading = true
+
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      expect(mockAccessRulesEditor.props?.openScope).toBeUndefined()
+    })
+
+    it('should pass the user access settings open scope to the editor', () => {
+      mockAppUserAccessSettings.scope = 'all'
+
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      expect(mockAccessRulesEditor.props?.openScope).toBe('all')
+    })
+
+    it('should pass access rule loading state to the editor', () => {
+      mockAppAccessRules.isLoading = true
+      mockAppUserAccessSettings.isLoading = true
+
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      expect(mockAccessRulesEditor.props?.isLoadingRules).toBe(true)
+      expect(mockAccessRulesEditor.props?.isLoadingUserAccessSettings).toBe(true)
+      expect(mockAccessRulesEditor.props?.isUpdatingOpenScope).toBe(true)
+    })
+
+    it('should pass the app maintainer id from app detail to the editor', () => {
+      useStore.setState({
+        appDetail: {
+          id: 'app-1',
+          maintainer: 'account-1',
+          permission_keys: [AppACLPermission.AccessConfig],
+        } as NonNullable<ReturnType<typeof useStore.getState>['appDetail']>,
+      })
+
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      expect(mockAccessRulesEditor.props?.maintainerId).toBe('account-1')
+    })
+
+    it('should wire open scope and user policy updates', () => {
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      mockAccessRulesEditor.props?.onOpenScopeChange?.('all')
+      expect(mockMutations.updateOpenScope).toHaveBeenCalledWith('all', expect.objectContaining({
+        onError: expect.any(Function),
+      }))
+
+      mockAccessRulesEditor.props?.onUserAccessPoliciesChange?.('account-1', ['policy-1'])
+      expect(mockMutations.updateUserAccessSettings).toHaveBeenCalledWith({
+        accountId: 'account-1',
+        accessPolicyIds: ['policy-1'],
+      }, expect.objectContaining({
+        onSettled: expect.any(Function),
+      }))
+
+      mockAccessRulesEditor.props?.onAddAccessSubject?.('account-2', ['default'])
+      expect(mockMutations.updateUserAccessSettings).toHaveBeenCalledWith({
+        accountId: 'account-2',
+        accessPolicyIds: ['default'],
+      }, expect.objectContaining({
+        onSettled: expect.any(Function),
+      }))
+
+      mockAccessRulesEditor.props?.onRemoveAccessPolicyMemberBinding?.('account-3', 'policy-3')
+      expect(mockMutations.removeMemberBindings).toHaveBeenCalledWith({
+        accessPolicyId: 'policy-3',
+        accountIds: ['account-3'],
+      }, expect.objectContaining({
+        onSettled: expect.any(Function),
+      }))
+    })
+
+    it('should not mount access config data hooks when access config permission is missing', () => {
+      useStore.setState({
+        appDetail: {
+          id: 'app-1',
+          maintainer: 'account-1',
+          permission_keys: [AppACLPermission.ViewLayout],
+        } as NonNullable<ReturnType<typeof useStore.getState>['appDetail']>,
+      })
+
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      expect(screen.queryByTestId('access-rules-editor')).not.toBeInTheDocument()
+      expect(useAppAccessRules).not.toHaveBeenCalled()
+      expect(useAppUserAccessSettings).not.toHaveBeenCalled()
+    })
+
+    it('should allow the app maintainer with app management workspace permission', () => {
+      mockAppContext.userProfile = { id: 'account-1' }
+      mockAppContext.workspacePermissionKeys = ['app.create_and_management']
+      useStore.setState({
+        appDetail: {
+          id: 'app-1',
+          maintainer: 'account-1',
+          permission_keys: [] as string[],
+        } as NonNullable<ReturnType<typeof useStore.getState>['appDetail']>,
+      })
+
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      expect(screen.getByTestId('access-rules-editor')).toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/app/components/app/access-config/index.tsx b/web/app/components/app/access-config/index.tsx
new file mode 100644
index 00000000000..9704540bbd7
--- /dev/null
+++ b/web/app/components/app/access-config/index.tsx
@@ -0,0 +1,120 @@
+'use client'
+
+import type { ResourceOpenScope } from '@/models/access-control'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useCallback, useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AccessRulesEditor from '@/app/components/access-rules-editor'
+import { useStore } from '@/app/components/app/store'
+import { useAppContext } from '@/context/app-context'
+import { useLocale } from '@/context/i18n'
+import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
+import {
+  useAppAccessRules,
+  useAppUserAccessSettings,
+  useRemoveAppAccessPolicyMemberBindings,
+  useUpdateAppOpenScope,
+  useUpdateAppUserAccessSettings,
+} from '@/service/access-control/use-app-access-config'
+import { getAppACLCapabilities } from '@/utils/permission'
+
+type AppAccessConfigPageProps = {
+  appId: string
+}
+
+type AppAccessConfigContentProps = {
+  appId: string
+  maintainerId?: string | null
+}
+
+const AppAccessConfigContent = ({ appId, maintainerId }: AppAccessConfigContentProps) => {
+  const { t } = useTranslation()
+  const locale = useLocale()
+  const language = useMemo(() => getAccessControlTemplateLanguage(locale), [locale])
+  const { data: appAccessRulesResponse, isLoading: isLoadingAppAccessRules } = useAppAccessRules(appId, language)
+  const { data: appUserAccessSettingsResponse, isLoading: isLoadingAppUserAccessSettings } = useAppUserAccessSettings(appId, language)
+  const { mutate: updateAppOpenScope, isPending: isUpdatingAppOpenScope } = useUpdateAppOpenScope(appId)
+  const { mutate: updateAppUserAccessSettings } = useUpdateAppUserAccessSettings(appId)
+  const { mutate: removeAppAccessPolicyMemberBindings } = useRemoveAppAccessPolicyMemberBindings(appId)
+  const [optimisticOpenScope, setOptimisticOpenScope] = useState<ResourceOpenScope | null>(null)
+  const [updatingAccountId, setUpdatingAccountId] = useState<string | null>(null)
+
+  const appAccessRules = appAccessRulesResponse?.items || []
+  const appUserAccessSettings = appUserAccessSettingsResponse?.data || []
+  const openScope = optimisticOpenScope || appUserAccessSettingsResponse?.scope
+
+  const handleOpenScopeChange = useCallback((nextOpenScope: ResourceOpenScope) => {
+    if (nextOpenScope === openScope)
+      return
+
+    const previousOptimisticOpenScope = optimisticOpenScope
+    setOptimisticOpenScope(nextOpenScope)
+    updateAppOpenScope(nextOpenScope, {
+      onError: () => setOptimisticOpenScope(previousOptimisticOpenScope),
+    })
+  }, [openScope, optimisticOpenScope, updateAppOpenScope])
+
+  const handleUserAccessPoliciesChange = useCallback((accountId: string, accessPolicyIds: string[]) => {
+    setUpdatingAccountId(accountId)
+    updateAppUserAccessSettings(
+      { accountId, accessPolicyIds },
+      { onSettled: () => setUpdatingAccountId(null) },
+    )
+  }, [updateAppUserAccessSettings])
+
+  const handleRemoveAccessPolicyMemberBinding = useCallback((accountId: string, accessPolicyId: string) => {
+    setUpdatingAccountId(accountId)
+    removeAppAccessPolicyMemberBindings(
+      { accessPolicyId, accountIds: [accountId] },
+      { onSettled: () => setUpdatingAccountId(null) },
+    )
+  }, [removeAppAccessPolicyMemberBindings])
+
+  return (
+    <ScrollArea
+      className="h-full bg-background-default-subtle"
+      slotClassNames={{ viewport: 'overscroll-contain' }}
+    >
+      <header className="flex min-h-15.5 flex-col justify-center px-6 py-3">
+        <h1 className="system-xl-semibold text-text-primary">{t('settings.resourceAccess', { ns: 'common' })}</h1>
+        <p className="mt-0.5 system-sm-regular text-text-tertiary">
+          {t('accessRule.appDescription', { ns: 'permission' })}
+        </p>
+      </header>
+      <main className="w-full px-6 pt-8 pb-10">
+        <AccessRulesEditor
+          className="w-full max-w-200"
+          rules={appAccessRules}
+          userAccessSettings={appUserAccessSettings}
+          isLoadingRules={isLoadingAppAccessRules}
+          isLoadingUserAccessSettings={isLoadingAppUserAccessSettings}
+          openScope={openScope}
+          isUpdatingOpenScope={isLoadingAppUserAccessSettings || isUpdatingAppOpenScope}
+          updatingAccountId={updatingAccountId}
+          maintainerId={maintainerId}
+          onOpenScopeChange={handleOpenScopeChange}
+          onUserAccessPoliciesChange={handleUserAccessPoliciesChange}
+          onRemoveAccessPolicyMemberBinding={handleRemoveAccessPolicyMemberBinding}
+          onAddAccessSubject={handleUserAccessPoliciesChange}
+        />
+      </main>
+    </ScrollArea>
+  )
+}
+
+const AppAccessConfigPage = ({ appId }: AppAccessConfigPageProps) => {
+  const { userProfile, workspacePermissionKeys } = useAppContext()
+  const appDetail = useStore(state => state.appDetail)
+  const appACLCapabilities = useMemo(() => getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId: userProfile?.id,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  }), [appDetail?.maintainer, appDetail?.permission_keys, userProfile?.id, workspacePermissionKeys])
+
+  if (!appDetail || appDetail.id !== appId || !appACLCapabilities.canAccessConfig)
+    return null
+
+  return <AppAccessConfigContent appId={appId} maintainerId={appDetail.maintainer} />
+}
+
+export default AppAccessConfigPage
diff --git a/web/app/components/app/app-access-control/__tests__/access-control-dialog.spec.tsx b/web/app/components/app/app-access-control/__tests__/access-control-dialog.spec.tsx
index 03a35bd52ab..acbdf1281e5 100644
--- a/web/app/components/app/app-access-control/__tests__/access-control-dialog.spec.tsx
+++ b/web/app/components/app/app-access-control/__tests__/access-control-dialog.spec.tsx
@@ -1,5 +1,5 @@
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
-import AccessControlDialog from '../access-control-dialog'
+import { AccessControlDialog } from '../access-control-dialog'
 
 describe('AccessControlDialog', () => {
   it('should render dialog content when visible', () => {
diff --git a/web/app/components/app/app-access-control/__tests__/access-control-item.spec.tsx b/web/app/components/app/app-access-control/__tests__/access-control-item.spec.tsx
index b1a862a13c9..0972a654751 100644
--- a/web/app/components/app/app-access-control/__tests__/access-control-item.spec.tsx
+++ b/web/app/components/app/app-access-control/__tests__/access-control-item.spec.tsx
@@ -1,45 +1,43 @@
 import { fireEvent, render, screen } from '@testing-library/react'
-import useAccessControlStore from '@/context/access-control-store'
 import { AccessMode } from '@/models/access-control'
-import AccessControlItem from '../access-control-item'
+import { AccessControlItem } from '../access-control-item'
+import { AccessControlRadioGroupHarness } from './access-control-radio-group-harness'
+import { createAccessControlDraftHarness } from './access-control-test-utils'
 
 describe('AccessControlItem', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    useAccessControlStore.setState({
-      appId: '',
-      specificGroups: [],
-      specificMembers: [],
-      currentMenu: AccessMode.PUBLIC,
-      selectedGroupsForBreadcrumb: [],
-    })
   })
 
   it('should update current menu when selecting a different access type', () => {
-    render(
-      <AccessControlItem type={AccessMode.ORGANIZATION}>
-        <span>Organization Only</span>
-      </AccessControlItem>,
+    const harness = createAccessControlDraftHarness(
+      <AccessControlRadioGroupHarness>
+        <AccessControlItem type={AccessMode.ORGANIZATION}>
+          <span>Organization Only</span>
+        </AccessControlItem>
+      </AccessControlRadioGroupHarness>,
+      { currentMenu: AccessMode.PUBLIC },
     )
+    render(harness.element)
 
-    const option = screen.getByText('Organization Only').parentElement as HTMLElement
+    const option = screen.getByRole('radio', { name: 'Organization Only' })
     fireEvent.click(option)
 
-    expect(useAccessControlStore.getState().currentMenu).toBe(AccessMode.ORGANIZATION)
+    expect(harness.getSnapshot().currentMenu).toBe(AccessMode.ORGANIZATION)
   })
 
   it('should keep the selected state for the active access type', () => {
-    useAccessControlStore.setState({
-      currentMenu: AccessMode.ORGANIZATION,
-    })
-
-    render(
-      <AccessControlItem type={AccessMode.ORGANIZATION}>
-        <span>Organization Only</span>
-      </AccessControlItem>,
+    const harness = createAccessControlDraftHarness(
+      <AccessControlRadioGroupHarness>
+        <AccessControlItem type={AccessMode.ORGANIZATION}>
+          <span>Organization Only</span>
+        </AccessControlItem>
+      </AccessControlRadioGroupHarness>,
+      { currentMenu: AccessMode.ORGANIZATION },
     )
+    render(harness.element)
 
-    const option = screen.getByText('Organization Only').parentElement as HTMLElement
-    expect(option).toHaveClass('border-components-option-card-option-selected-border')
+    const option = screen.getByRole('radio', { name: 'Organization Only' })
+    expect(option).toHaveAttribute('data-checked')
   })
 })
diff --git a/web/app/components/app/app-access-control/__tests__/access-control-radio-group-harness.tsx b/web/app/components/app/app-access-control/__tests__/access-control-radio-group-harness.tsx
new file mode 100644
index 00000000000..8dc6cbd75cb
--- /dev/null
+++ b/web/app/components/app/app-access-control/__tests__/access-control-radio-group-harness.tsx
@@ -0,0 +1,17 @@
+import type { ReactNode } from 'react'
+import type { AccessMode } from '@/models/access-control'
+import { RadioGroup } from '@langgenius/dify-ui/radio-group'
+import { useAccessControlStore } from '../store'
+
+export function AccessControlRadioGroupHarness({ children }: {
+  children: ReactNode
+}) {
+  const currentMenu = useAccessControlStore(state => state.currentMenu)
+  const setCurrentMenu = useAccessControlStore(state => state.setCurrentMenu)
+
+  return (
+    <RadioGroup<AccessMode> value={currentMenu} onValueChange={setCurrentMenu}>
+      {children}
+    </RadioGroup>
+  )
+}
diff --git a/web/app/components/app/app-access-control/__tests__/access-control-test-utils.ts b/web/app/components/app/app-access-control/__tests__/access-control-test-utils.ts
new file mode 100644
index 00000000000..2a6f27b8331
--- /dev/null
+++ b/web/app/components/app/app-access-control/__tests__/access-control-test-utils.ts
@@ -0,0 +1,71 @@
+import type { ReactNode } from 'react'
+import type { AccessControlDraft, AccessControlStore } from '../store'
+import { createElement } from 'react'
+import { AccessMode } from '@/models/access-control'
+import { useAccessControlStore } from '../store'
+import { AccessControlDraftProvider } from '../store-provider'
+
+const emptyDraft = {
+  appId: '',
+  currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS,
+  specificGroups: [],
+  specificMembers: [],
+  selectedGroupsForBreadcrumb: [],
+} satisfies Required<AccessControlDraft>
+
+function draftKey(draft: AccessControlDraft) {
+  return [
+    draft.appId ?? '',
+    draft.currentMenu,
+    draft.specificGroups?.map(group => group.id).join(',') ?? '',
+    draft.specificMembers?.map(member => member.id).join(',') ?? '',
+    draft.selectedGroupsForBreadcrumb?.map(group => group.id).join(',') ?? '',
+  ].join(':')
+}
+
+function completeDraft(initialDraft: Partial<AccessControlDraft> = {}): Required<AccessControlDraft> {
+  return {
+    ...emptyDraft,
+    ...initialDraft,
+  }
+}
+
+function SnapshotProbe({ onSnapshot }: {
+  onSnapshot: (snapshot: AccessControlStore) => void
+}) {
+  onSnapshot(useAccessControlStore(state => state))
+  return null
+}
+
+export function createAccessControlDraftHarness(
+  children: ReactNode,
+  initialDraft?: Partial<AccessControlDraft>,
+) {
+  const draft = completeDraft(initialDraft)
+  let snapshot: AccessControlStore = {
+    appId: draft.appId,
+    specificGroups: draft.specificGroups,
+    setSpecificGroups: () => undefined,
+    specificMembers: draft.specificMembers,
+    setSpecificMembers: () => undefined,
+    currentMenu: draft.currentMenu,
+    setCurrentMenu: () => undefined,
+    selectedGroupsForBreadcrumb: draft.selectedGroupsForBreadcrumb,
+    setSelectedGroupsForBreadcrumb: () => undefined,
+  }
+
+  return {
+    element: createElement(
+      AccessControlDraftProvider,
+      {
+        draftKey: draftKey(draft),
+        initialDraft: draft,
+      },
+      createElement(SnapshotProbe, {
+        onSnapshot: nextSnapshot => snapshot = nextSnapshot,
+      }),
+      children,
+    ),
+    getSnapshot: () => snapshot,
+  }
+}
diff --git a/web/app/components/app/app-access-control/__tests__/access-control.spec.tsx b/web/app/components/app/app-access-control/__tests__/access-control.spec.tsx
index 52c2a0dd543..c8bce5401e6 100644
--- a/web/app/components/app/app-access-control/__tests__/access-control.spec.tsx
+++ b/web/app/components/app/app-access-control/__tests__/access-control.spec.tsx
@@ -1,24 +1,23 @@
 import type { AccessControlAccount, AccessControlGroup, Subject } from '@/models/access-control'
 import type { App } from '@/types/app'
+import { SubjectType as EnterpriseSubjectType } from '@dify/contracts/enterprise/types.gen'
 import { toast } from '@langgenius/dify-ui/toast'
 import { fireEvent, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { renderWithSystemFeatures as render } from '@/__tests__/utils/mock-system-features'
-import useAccessControlStore from '@/context/access-control-store'
 import { AccessMode, SubjectType } from '@/models/access-control'
-import AccessControlDialog from '../access-control-dialog'
-import AccessControlItem from '../access-control-item'
-import AddMemberOrGroupDialog from '../add-member-or-group-pop'
-import AccessControl from '../index'
-import SpecificGroupsOrMembers from '../specific-groups-or-members'
+import { AccessControlDialog } from '../access-control-dialog'
+import { AccessControlItem } from '../access-control-item'
+import { AddMemberOrGroupDialog } from '../add-member-or-group-pop'
+import { AccessControl } from '../index'
+import { SpecificGroupsOrMembers } from '../specific-groups-or-members'
+import { AccessControlRadioGroupHarness } from './access-control-radio-group-harness'
+import { createAccessControlDraftHarness } from './access-control-test-utils'
 
 const mockUseAppWhiteListSubjects = vi.fn()
 const mockUseSearchForWhiteListCandidates = vi.fn()
-const mockMutateAsync = vi.fn()
-const mockUseUpdateAccessMode = vi.fn(() => ({
-  isPending: false,
-  mutateAsync: mockMutateAsync,
-}))
+const mockMutate = vi.fn()
+const mockUseMutation = vi.hoisted(() => vi.fn())
 const intersectionObserverMocks = vi.hoisted(() => ({
   callback: null as null | ((entries: Array<{ isIntersecting: boolean }>) => void),
 }))
@@ -36,12 +35,19 @@ vi.mock('@/context/app-context', () => ({
   }),
 }))
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useAppWhiteListSubjects: (...args: unknown[]) => mockUseAppWhiteListSubjects(...args),
   useSearchForWhiteListCandidates: (...args: unknown[]) => mockUseSearchForWhiteListCandidates(...args),
-  useUpdateAccessMode: () => mockUseUpdateAccessMode(),
 }))
 
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useMutation: (...args: unknown[]) => mockUseMutation(...args),
+  }
+})
+
 vi.mock('ahooks', async (importOriginal) => {
   const actual = await importOriginal<typeof import('ahooks')>()
   return {
@@ -94,10 +100,12 @@ beforeAll(() => {
 })
 
 beforeEach(() => {
-  mockMutateAsync.mockResolvedValue(undefined)
-  mockUseUpdateAccessMode.mockReturnValue({
+  mockMutate.mockImplementation((_: unknown, options?: { onSuccess?: () => void }) => {
+    options?.onSuccess?.()
+  })
+  mockUseMutation.mockReturnValue({
     isPending: false,
-    mutateAsync: mockMutateAsync,
+    mutate: mockMutate,
   })
   mockUseAppWhiteListSubjects.mockReturnValue({
     isPending: false,
@@ -117,33 +125,39 @@ beforeEach(() => {
 // AccessControlItem handles selected vs. unselected styling and click state updates
 describe('AccessControlItem', () => {
   it('should update current menu when selecting a different access type', () => {
-    useAccessControlStore.setState({ currentMenu: AccessMode.PUBLIC })
-    render(
-      <AccessControlItem type={AccessMode.ORGANIZATION}>
-        <span>Organization Only</span>
-      </AccessControlItem>,
+    const harness = createAccessControlDraftHarness(
+      <AccessControlRadioGroupHarness>
+        <AccessControlItem type={AccessMode.ORGANIZATION}>
+          <span>Organization Only</span>
+        </AccessControlItem>
+      </AccessControlRadioGroupHarness>,
+      { currentMenu: AccessMode.PUBLIC },
     )
+    render(harness.element)
 
-    const option = screen.getByText('Organization Only').parentElement as HTMLElement
+    const option = screen.getByRole('radio', { name: 'Organization Only' })
     expect(option).toHaveClass('cursor-pointer')
 
     fireEvent.click(option)
 
-    expect(useAccessControlStore.getState().currentMenu).toBe(AccessMode.ORGANIZATION)
+    expect(harness.getSnapshot().currentMenu).toBe(AccessMode.ORGANIZATION)
   })
 
   it('should keep current menu when clicking the selected access type', () => {
-    useAccessControlStore.setState({ currentMenu: AccessMode.ORGANIZATION })
-    render(
-      <AccessControlItem type={AccessMode.ORGANIZATION}>
-        <span>Organization Only</span>
-      </AccessControlItem>,
+    const harness = createAccessControlDraftHarness(
+      <AccessControlRadioGroupHarness>
+        <AccessControlItem type={AccessMode.ORGANIZATION}>
+          <span>Organization Only</span>
+        </AccessControlItem>
+      </AccessControlRadioGroupHarness>,
+      { currentMenu: AccessMode.ORGANIZATION },
     )
+    render(harness.element)
 
-    const option = screen.getByText('Organization Only').parentElement as HTMLElement
+    const option = screen.getByRole('radio', { name: 'Organization Only' })
     fireEvent.click(option)
 
-    expect(useAccessControlStore.getState().currentMenu).toBe(AccessMode.ORGANIZATION)
+    expect(harness.getSnapshot().currentMenu).toBe(AccessMode.ORGANIZATION)
   })
 })
 
@@ -180,32 +194,40 @@ describe('AccessControlDialog', () => {
 // SpecificGroupsOrMembers syncs store state with fetched data and supports removals
 describe('SpecificGroupsOrMembers', () => {
   it('should render collapsed view when not in specific selection mode', () => {
-    useAccessControlStore.setState({ currentMenu: AccessMode.ORGANIZATION })
+    const harness = createAccessControlDraftHarness(
+      <SpecificGroupsOrMembers />,
+      { currentMenu: AccessMode.ORGANIZATION },
+    )
 
-    render(<SpecificGroupsOrMembers />)
+    render(harness.element)
 
     expect(screen.getByText('app.accessControlDialog.accessItems.specific')).toBeInTheDocument()
     expect(screen.queryByText(baseGroup.name)).not.toBeInTheDocument()
   })
 
   it('should show loading state while pending', async () => {
-    useAccessControlStore.setState({ appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS })
-    mockUseAppWhiteListSubjects.mockReturnValue({
-      isPending: true,
-      data: undefined,
-    })
+    const harness = createAccessControlDraftHarness(
+      <SpecificGroupsOrMembers loading />,
+      { appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS },
+    )
 
-    const { container } = render(<SpecificGroupsOrMembers />)
+    render(harness.element)
 
-    await waitFor(() => {
-      expect(container.querySelector('.spin-animation')).toBeInTheDocument()
-    })
+    expect(screen.getByRole('status', { name: 'common.loading' })).toBeInTheDocument()
   })
 
   it('should render fetched groups and members and support removal', async () => {
-    useAccessControlStore.setState({ appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS })
+    const harness = createAccessControlDraftHarness(
+      <SpecificGroupsOrMembers />,
+      {
+        appId: 'app-1',
+        currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS,
+        specificGroups: [baseGroup],
+        specificMembers: [baseMember],
+      },
+    )
 
-    render(<SpecificGroupsOrMembers />)
+    render(harness.element)
 
     await waitFor(() => {
       expect(screen.getByText(baseGroup.name)).toBeInTheDocument()
@@ -234,8 +256,12 @@ describe('SpecificGroupsOrMembers', () => {
 describe('AddMemberOrGroupDialog', () => {
   it('should open search popover and display candidates', async () => {
     const user = userEvent.setup()
+    const harness = createAccessControlDraftHarness(
+      <AddMemberOrGroupDialog />,
+      { appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS },
+    )
 
-    render(<AddMemberOrGroupDialog />)
+    render(harness.element)
 
     await user.click(screen.getByText('common.operation.add'))
 
@@ -246,17 +272,21 @@ describe('AddMemberOrGroupDialog', () => {
 
   it('should allow selecting members and expanding groups', async () => {
     const user = userEvent.setup()
-    render(<AddMemberOrGroupDialog />)
+    const harness = createAccessControlDraftHarness(
+      <AddMemberOrGroupDialog />,
+      { appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS },
+    )
+    render(harness.element)
 
     await user.click(screen.getByText('common.operation.add'))
 
     const expandButton = screen.getByText('app.accessControlDialog.operateGroupAndMember.expand')
     await user.click(expandButton)
-    expect(useAccessControlStore.getState().selectedGroupsForBreadcrumb).toEqual([baseGroup])
+    expect(harness.getSnapshot().selectedGroupsForBreadcrumb).toEqual([baseGroup])
 
     await user.click(screen.getByRole('option', { name: /Member One/ }))
 
-    expect(useAccessControlStore.getState().specificMembers).toEqual([baseMember])
+    expect(harness.getSnapshot().specificMembers).toEqual([baseMember])
   })
 
   it('should update the keyword, fetch the next page, and support deselection and breadcrumb reset', async () => {
@@ -269,7 +299,11 @@ describe('AddMemberOrGroupDialog', () => {
     })
 
     const user = userEvent.setup()
-    render(<AddMemberOrGroupDialog />)
+    const harness = createAccessControlDraftHarness(
+      <AddMemberOrGroupDialog />,
+      { appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS },
+    )
+    render(harness.element)
 
     await user.click(screen.getByText('common.operation.add'))
     await user.type(screen.getByPlaceholderText('app.accessControlDialog.operateGroupAndMember.searchPlaceholder'), 'Group')
@@ -286,9 +320,9 @@ describe('AddMemberOrGroupDialog', () => {
     fireEvent.click(screen.getByText('app.accessControlDialog.operateGroupAndMember.expand'))
     fireEvent.click(screen.getByText('app.accessControlDialog.operateGroupAndMember.allMembers'))
 
-    expect(useAccessControlStore.getState().specificGroups).toEqual([])
-    expect(useAccessControlStore.getState().specificMembers).toEqual([])
-    expect(useAccessControlStore.getState().selectedGroupsForBreadcrumb).toEqual([])
+    expect(harness.getSnapshot().specificGroups).toEqual([])
+    expect(harness.getSnapshot().specificMembers).toEqual([])
+    expect(harness.getSnapshot().selectedGroupsForBreadcrumb).toEqual([])
     expect(fetchNextPage).not.toHaveBeenCalled()
   })
 
@@ -301,7 +335,11 @@ describe('AddMemberOrGroupDialog', () => {
     })
 
     const user = userEvent.setup()
-    render(<AddMemberOrGroupDialog />)
+    const harness = createAccessControlDraftHarness(
+      <AddMemberOrGroupDialog />,
+      { appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS },
+    )
+    render(harness.element)
 
     await user.click(screen.getByText('common.operation.add'))
 
@@ -315,10 +353,6 @@ describe('AccessControl', () => {
     const onClose = vi.fn()
     const onConfirm = vi.fn()
     const toastSpy = vi.spyOn(toast, 'success').mockReturnValue('toast-success')
-    useAccessControlStore.setState({
-      specificGroups: [baseGroup],
-      specificMembers: [baseMember],
-    })
     const app = {
       id: 'app-id-1',
       access_mode: AccessMode.SPECIFIC_GROUPS_MEMBERS,
@@ -332,21 +366,22 @@ describe('AccessControl', () => {
       />,
     )
 
-    await waitFor(() => {
-      expect(useAccessControlStore.getState().currentMenu).toBe(AccessMode.SPECIFIC_GROUPS_MEMBERS)
-    })
-
     fireEvent.click(screen.getByText('common.operation.confirm'))
 
     await waitFor(() => {
-      expect(mockMutateAsync).toHaveBeenCalledWith({
-        appId: app.id,
-        accessMode: AccessMode.SPECIFIC_GROUPS_MEMBERS,
-        subjects: [
-          { subjectId: baseGroup.id, subjectType: SubjectType.GROUP },
-          { subjectId: baseMember.id, subjectType: SubjectType.ACCOUNT },
-        ],
-      })
+      expect(mockMutate).toHaveBeenCalledWith(
+        {
+          body: {
+            appId: app.id,
+            accessMode: AccessMode.SPECIFIC_GROUPS_MEMBERS,
+            subjects: [
+              { subjectId: baseGroup.id, subjectType: EnterpriseSubjectType.SUBJECT_TYPE_GROUP },
+              { subjectId: baseMember.id, subjectType: EnterpriseSubjectType.SUBJECT_TYPE_ACCOUNT },
+            ],
+          },
+        },
+        expect.objectContaining({ onSuccess: expect.any(Function) }),
+      )
       expect(toastSpy).toHaveBeenCalledWith('app.accessControlDialog.updateSuccess')
       expect(onConfirm).toHaveBeenCalled()
     })
diff --git a/web/app/components/app/app-access-control/__tests__/add-member-or-group-pop.spec.tsx b/web/app/components/app/app-access-control/__tests__/add-member-or-group-pop.spec.tsx
index d34756e85e4..11ba79e1851 100644
--- a/web/app/components/app/app-access-control/__tests__/add-member-or-group-pop.spec.tsx
+++ b/web/app/components/app/app-access-control/__tests__/add-member-or-group-pop.spec.tsx
@@ -1,9 +1,9 @@
 import type { AccessControlAccount, AccessControlGroup, Subject } from '@/models/access-control'
 import { render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import useAccessControlStore from '@/context/access-control-store'
-import { SubjectType } from '@/models/access-control'
-import AddMemberOrGroupDialog from '../add-member-or-group-pop'
+import { AccessMode, SubjectType } from '@/models/access-control'
+import { AddMemberOrGroupDialog } from '../add-member-or-group-pop'
+import { createAccessControlDraftHarness } from './access-control-test-utils'
 
 const mockUseSearchForWhiteListCandidates = vi.fn()
 const intersectionObserverMocks = vi.hoisted(() => ({
@@ -18,7 +18,7 @@ vi.mock('@/context/app-context', () => ({
   }),
 }))
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useSearchForWhiteListCandidates: (...args: unknown[]) => mockUseSearchForWhiteListCandidates(...args),
 }))
 
@@ -69,13 +69,6 @@ describe('AddMemberOrGroupDialog', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
-    useAccessControlStore.setState({
-      appId: 'app-1',
-      specificGroups: [],
-      specificMembers: [],
-      currentMenu: SubjectType.GROUP as never,
-      selectedGroupsForBreadcrumb: [],
-    })
     mockUseSearchForWhiteListCandidates.mockReturnValue({
       isLoading: false,
       isFetchingNextPage: false,
@@ -88,7 +81,11 @@ describe('AddMemberOrGroupDialog', () => {
 
   it('should open the search popover and display candidates', async () => {
     const user = userEvent.setup()
-    render(<AddMemberOrGroupDialog />)
+    const harness = createAccessControlDraftHarness(
+      <AddMemberOrGroupDialog />,
+      { appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS },
+    )
+    render(harness.element)
 
     await user.click(screen.getByText('common.operation.add'))
 
@@ -99,16 +96,20 @@ describe('AddMemberOrGroupDialog', () => {
 
   it('should allow expanding groups and selecting members', async () => {
     const user = userEvent.setup()
-    render(<AddMemberOrGroupDialog />)
+    const harness = createAccessControlDraftHarness(
+      <AddMemberOrGroupDialog />,
+      { appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS },
+    )
+    render(harness.element)
 
     await user.click(screen.getByText('common.operation.add'))
     await user.click(screen.getByText('app.accessControlDialog.operateGroupAndMember.expand'))
 
-    expect(useAccessControlStore.getState().selectedGroupsForBreadcrumb).toEqual([baseGroup])
+    expect(harness.getSnapshot().selectedGroupsForBreadcrumb).toEqual([baseGroup])
 
     await user.click(screen.getByRole('option', { name: /Member One/ }))
 
-    expect(useAccessControlStore.getState().specificMembers).toEqual([baseMember])
+    expect(harness.getSnapshot().specificMembers).toEqual([baseMember])
   })
 
   it('should show the empty state when no candidates are returned', async () => {
@@ -120,7 +121,11 @@ describe('AddMemberOrGroupDialog', () => {
     })
 
     const user = userEvent.setup()
-    render(<AddMemberOrGroupDialog />)
+    const harness = createAccessControlDraftHarness(
+      <AddMemberOrGroupDialog />,
+      { appId: 'app-1', currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS },
+    )
+    render(harness.element)
 
     await user.click(screen.getByText('common.operation.add'))
 
@@ -128,9 +133,6 @@ describe('AddMemberOrGroupDialog', () => {
   })
 
   it('should keep breadcrumbs visible when the current group has no candidates', async () => {
-    useAccessControlStore.setState({
-      selectedGroupsForBreadcrumb: [baseGroup],
-    })
     mockUseSearchForWhiteListCandidates.mockReturnValue({
       isLoading: false,
       isFetchingNextPage: false,
@@ -139,7 +141,15 @@ describe('AddMemberOrGroupDialog', () => {
     })
 
     const user = userEvent.setup()
-    render(<AddMemberOrGroupDialog />)
+    const harness = createAccessControlDraftHarness(
+      <AddMemberOrGroupDialog />,
+      {
+        appId: 'app-1',
+        currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS,
+        selectedGroupsForBreadcrumb: [baseGroup],
+      },
+    )
+    render(harness.element)
 
     await user.click(screen.getByText('common.operation.add'))
 
@@ -149,6 +159,6 @@ describe('AddMemberOrGroupDialog', () => {
 
     await user.click(screen.getByRole('button', { name: 'app.accessControlDialog.operateGroupAndMember.allMembers' }))
 
-    expect(useAccessControlStore.getState().selectedGroupsForBreadcrumb).toEqual([])
+    expect(harness.getSnapshot().selectedGroupsForBreadcrumb).toEqual([])
   })
 })
diff --git a/web/app/components/app/app-access-control/__tests__/index.spec.tsx b/web/app/components/app/app-access-control/__tests__/index.spec.tsx
index 74e7d7046c0..dd5e2f4f22f 100644
--- a/web/app/components/app/app-access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/app-access-control/__tests__/index.spec.tsx
@@ -3,9 +3,8 @@ import type { App } from '@/types/app'
 import { toast } from '@langgenius/dify-ui/toast'
 import { fireEvent, screen, waitFor } from '@testing-library/react'
 import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
-import useAccessControlStore from '@/context/access-control-store'
 import { AccessMode } from '@/models/access-control'
-import AccessControl from '../index'
+import { AccessControl } from '../index'
 
 let mockWebappAuth = {
   enabled: true,
@@ -18,20 +17,24 @@ const render = (ui: ReactElement) => renderWithSystemFeatures(ui, {
   systemFeatures: { webapp_auth: mockWebappAuth },
 })
 
-const mockMutateAsync = vi.fn()
-const mockUseUpdateAccessMode = vi.fn(() => ({
-  isPending: false,
-  mutateAsync: mockMutateAsync,
-}))
+const mockMutate = vi.fn()
+const mockUseMutation = vi.hoisted(() => vi.fn())
 const mockUseAppWhiteListSubjects = vi.fn()
 const mockUseSearchForWhiteListCandidates = vi.fn()
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useAppWhiteListSubjects: (...args: unknown[]) => mockUseAppWhiteListSubjects(...args),
   useSearchForWhiteListCandidates: (...args: unknown[]) => mockUseSearchForWhiteListCandidates(...args),
-  useUpdateAccessMode: () => mockUseUpdateAccessMode(),
 }))
 
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useMutation: (...args: unknown[]) => mockUseMutation(...args),
+  }
+})
+
 describe('AccessControl', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -41,14 +44,13 @@ describe('AccessControl', () => {
       allow_email_password_login: false,
       allow_email_code_login: false,
     }
-    useAccessControlStore.setState({
-      appId: '',
-      specificGroups: [],
-      specificMembers: [],
-      currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS,
-      selectedGroupsForBreadcrumb: [],
+    mockMutate.mockImplementation((_: unknown, options?: { onSuccess?: () => void }) => {
+      options?.onSuccess?.()
+    })
+    mockUseMutation.mockReturnValue({
+      isPending: false,
+      mutate: mockMutate,
     })
-    mockMutateAsync.mockResolvedValue(undefined)
     mockUseAppWhiteListSubjects.mockReturnValue({
       isPending: false,
       data: {
@@ -81,18 +83,18 @@ describe('AccessControl', () => {
       />,
     )
 
-    await waitFor(() => {
-      expect(useAccessControlStore.getState().appId).toBe(app.id)
-      expect(useAccessControlStore.getState().currentMenu).toBe(AccessMode.PUBLIC)
-    })
-
     fireEvent.click(screen.getByText('common.operation.confirm'))
 
     await waitFor(() => {
-      expect(mockMutateAsync).toHaveBeenCalledWith({
-        appId: app.id,
-        accessMode: AccessMode.PUBLIC,
-      })
+      expect(mockMutate).toHaveBeenCalledWith(
+        {
+          body: {
+            appId: app.id,
+            accessMode: AccessMode.PUBLIC,
+          },
+        },
+        expect.objectContaining({ onSuccess: expect.any(Function) }),
+      )
       expect(toastSpy).toHaveBeenCalledWith('app.accessControlDialog.updateSuccess')
       expect(onConfirm).toHaveBeenCalledTimes(1)
     })
@@ -116,4 +118,30 @@ describe('AccessControl', () => {
     expect(screen.getByText('app.accessControlDialog.accessItems.external')).toBeInTheDocument()
     expect(screen.getByText('app.accessControlDialog.accessItems.anyone')).toBeInTheDocument()
   })
+
+  it('should prevent confirming specific access before subjects are loaded', () => {
+    mockUseAppWhiteListSubjects.mockReturnValue({
+      isPending: true,
+      data: undefined,
+    })
+
+    render(
+      <AccessControl
+        app={{ id: 'app-id-3', access_mode: AccessMode.SPECIFIC_GROUPS_MEMBERS } as App}
+        onClose={vi.fn()}
+      />,
+    )
+
+    const confirmButton = screen.getByRole('button', { name: 'common.operation.confirm' })
+    const organizationOption = screen.getByRole('radio', {
+      name: 'app.accessControlDialog.accessItems.organization',
+    })
+
+    expect(confirmButton).toBeDisabled()
+    expect(organizationOption).toHaveAttribute('aria-disabled', 'true')
+
+    fireEvent.click(confirmButton)
+
+    expect(mockMutate).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/app/components/app/app-access-control/__tests__/specific-groups-or-members.spec.tsx b/web/app/components/app/app-access-control/__tests__/specific-groups-or-members.spec.tsx
index e7635219405..5e8ec42be8a 100644
--- a/web/app/components/app/app-access-control/__tests__/specific-groups-or-members.spec.tsx
+++ b/web/app/components/app/app-access-control/__tests__/specific-groups-or-members.spec.tsx
@@ -1,17 +1,17 @@
 import type { AccessControlAccount, AccessControlGroup } from '@/models/access-control'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
-import useAccessControlStore from '@/context/access-control-store'
 import { AccessMode } from '@/models/access-control'
-import SpecificGroupsOrMembers from '../specific-groups-or-members'
+import { SpecificGroupsOrMembers } from '../specific-groups-or-members'
+import { createAccessControlDraftHarness } from './access-control-test-utils'
 
-const mockUseAppWhiteListSubjects = vi.fn()
+const mockUseSearchForWhiteListCandidates = vi.fn()
 
 vi.mock('@/service/access-control', () => ({
-  useAppWhiteListSubjects: (...args: unknown[]) => mockUseAppWhiteListSubjects(...args),
+  useSearchForWhiteListCandidates: (...args: unknown[]) => mockUseSearchForWhiteListCandidates(...args),
 }))
 
-vi.mock('../add-member-or-group-pop', () => ({
-  default: () => <div data-testid="add-member-or-group-dialog" />,
+vi.mock('@/service/access-control/use-app-access-control', () => ({
+  useSearchForWhiteListCandidates: (...args: unknown[]) => mockUseSearchForWhiteListCandidates(...args),
 }))
 
 const createGroup = (overrides: Partial<AccessControlGroup> = {}): AccessControlGroup => ({
@@ -36,50 +36,48 @@ describe('SpecificGroupsOrMembers', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
-    useAccessControlStore.setState({
-      appId: '',
-      specificGroups: [],
-      specificMembers: [],
-      currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS,
-      selectedGroupsForBreadcrumb: [],
-    })
-    mockUseAppWhiteListSubjects.mockReturnValue({
-      isPending: false,
-      data: {
-        groups: [baseGroup],
-        members: [baseMember],
-      },
+    mockUseSearchForWhiteListCandidates.mockReturnValue({
+      isLoading: false,
+      isFetchingNextPage: false,
+      fetchNextPage: vi.fn(),
+      data: { pages: [] },
     })
   })
 
   it('should render the collapsed row when not in specific mode', () => {
-    useAccessControlStore.setState({
-      currentMenu: AccessMode.ORGANIZATION,
-    })
+    const harness = createAccessControlDraftHarness(
+      <SpecificGroupsOrMembers />,
+      { currentMenu: AccessMode.ORGANIZATION },
+    )
 
-    render(<SpecificGroupsOrMembers />)
+    render(harness.element)
 
     expect(screen.getByText('app.accessControlDialog.accessItems.specific')).toBeInTheDocument()
-    expect(screen.queryByTestId('add-member-or-group-dialog')).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'common.operation.add' })).not.toBeInTheDocument()
   })
 
-  it('should show loading while whitelist subjects are pending', async () => {
-    mockUseAppWhiteListSubjects.mockReturnValue({
-      isPending: true,
-      data: undefined,
-    })
+  it('should show loading when the selected subjects are pending', async () => {
+    const harness = createAccessControlDraftHarness(<SpecificGroupsOrMembers loading />)
+    render(harness.element)
 
-    const { container } = render(<SpecificGroupsOrMembers />)
+    expect(screen.getByRole('combobox', { name: 'common.operation.add' })).toBeDisabled()
 
     await waitFor(() => {
-      expect(container.querySelector('.spin-animation')).toBeInTheDocument()
+      expect(screen.getByRole('status', { name: 'common.loading' })).toBeInTheDocument()
     })
   })
 
   it('should render fetched groups and members and support removal', async () => {
-    useAccessControlStore.setState({ appId: 'app-1' })
+    const harness = createAccessControlDraftHarness(
+      <SpecificGroupsOrMembers />,
+      {
+        appId: 'app-1',
+        specificGroups: [baseGroup],
+        specificMembers: [baseMember],
+      },
+    )
 
-    render(<SpecificGroupsOrMembers />)
+    render(harness.element)
 
     await waitFor(() => {
       expect(screen.getByText(baseGroup.name)).toBeInTheDocument()
@@ -91,9 +89,9 @@ describe('SpecificGroupsOrMembers', () => {
     const memberRemove = removeButtons[1]!
 
     fireEvent.click(groupRemove)
-    expect(useAccessControlStore.getState().specificGroups).toEqual([])
+    expect(harness.getSnapshot().specificGroups).toEqual([])
 
     fireEvent.click(memberRemove)
-    expect(useAccessControlStore.getState().specificMembers).toEqual([])
+    expect(harness.getSnapshot().specificMembers).toEqual([])
   })
 })
diff --git a/web/app/components/app/app-access-control/access-control-dialog-content.tsx b/web/app/components/app/app-access-control/access-control-dialog-content.tsx
new file mode 100644
index 00000000000..fb1f324a0ea
--- /dev/null
+++ b/web/app/components/app/app-access-control/access-control-dialog-content.tsx
@@ -0,0 +1,110 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { SpecificGroupsOrMembersProps } from './specific-groups-or-members'
+import { Button } from '@langgenius/dify-ui/button'
+import { DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { RadioGroup } from '@langgenius/dify-ui/radio-group'
+import { useTranslation } from 'react-i18next'
+import { AccessMode } from '@/models/access-control'
+import { AccessControlItem } from './access-control-item'
+import { SpecificGroupsOrMembers, WebAppSSONotEnabledTip } from './specific-groups-or-members'
+import { useAccessControlStore } from './store'
+
+type AccessControlDialogContentProps = {
+  title?: ReactNode
+  description?: ReactNode
+  accessLabel?: ReactNode
+  hideExternal?: boolean
+  hideExternalTip?: boolean
+  saving?: boolean
+  controlsDisabled?: boolean
+  confirmDisabled?: boolean
+  specificGroupsOrMembersProps?: SpecificGroupsOrMembersProps
+  onClose: () => void
+  onConfirm: () => void
+}
+
+export function AccessControlDialogContent({
+  title,
+  description,
+  accessLabel,
+  hideExternal = false,
+  hideExternalTip = false,
+  saving = false,
+  controlsDisabled = false,
+  confirmDisabled = false,
+  specificGroupsOrMembersProps,
+  onClose,
+  onConfirm,
+}: AccessControlDialogContentProps) {
+  const { t } = useTranslation()
+  const currentMenu = useAccessControlStore(s => s.currentMenu)
+  const setCurrentMenu = useAccessControlStore(s => s.setCurrentMenu)
+
+  return (
+    <div className="flex flex-col gap-y-3">
+      <div className="pt-6 pr-14 pb-3 pl-6">
+        <DialogTitle className="title-2xl-semi-bold text-text-primary">
+          {title ?? t('accessControlDialog.title', { ns: 'app' })}
+        </DialogTitle>
+        <DialogDescription className="mt-1 system-xs-regular text-text-tertiary">
+          {description ?? t('accessControlDialog.description', { ns: 'app' })}
+        </DialogDescription>
+      </div>
+      <RadioGroup<AccessMode>
+        value={currentMenu}
+        onValueChange={setCurrentMenu}
+        className="flex flex-col items-stretch gap-y-1 px-6 pb-3"
+        aria-labelledby="access-control-options-label"
+        disabled={controlsDisabled}
+      >
+        <div className="leading-6">
+          <p id="access-control-options-label" className="system-sm-medium text-text-tertiary">
+            {accessLabel ?? t('accessControlDialog.accessLabel', { ns: 'app' })}
+          </p>
+        </div>
+        <AccessControlItem type={AccessMode.ORGANIZATION}>
+          <div className="flex items-center p-3">
+            <div className="flex grow items-center gap-x-2">
+              <span className="i-ri-building-line size-4 text-text-primary" aria-hidden="true" />
+              <p className="system-sm-medium text-text-primary">
+                {t('accessControlDialog.accessItems.organization', { ns: 'app' })}
+              </p>
+            </div>
+          </div>
+        </AccessControlItem>
+        <AccessControlItem type={AccessMode.SPECIFIC_GROUPS_MEMBERS}>
+          <SpecificGroupsOrMembers {...specificGroupsOrMembersProps} />
+        </AccessControlItem>
+        {!hideExternal && (
+          <AccessControlItem type={AccessMode.EXTERNAL_MEMBERS}>
+            <div className="flex items-center p-3">
+              <div className="flex grow items-center gap-x-2">
+                <span className="i-ri-verified-badge-line size-4 text-text-primary" aria-hidden="true" />
+                <p className="system-sm-medium text-text-primary">
+                  {t('accessControlDialog.accessItems.external', { ns: 'app' })}
+                </p>
+              </div>
+              {!hideExternalTip && <WebAppSSONotEnabledTip />}
+            </div>
+          </AccessControlItem>
+        )}
+        <AccessControlItem type={AccessMode.PUBLIC}>
+          <div className="flex items-center gap-x-2 p-3">
+            <span className="i-ri-global-line size-4 text-text-primary" aria-hidden="true" />
+            <p className="system-sm-medium text-text-primary">
+              {t('accessControlDialog.accessItems.anyone', { ns: 'app' })}
+            </p>
+          </div>
+        </AccessControlItem>
+      </RadioGroup>
+      <div className="flex items-center justify-end gap-x-2 p-6 pt-5">
+        <Button disabled={saving} onClick={onClose}>{t('operation.cancel', { ns: 'common' })}</Button>
+        <Button disabled={confirmDisabled || saving} loading={saving} variant="primary" onClick={onConfirm}>
+          {t('operation.confirm', { ns: 'common' })}
+        </Button>
+      </div>
+    </div>
+  )
+}
diff --git a/web/app/components/app/app-access-control/access-control-dialog.tsx b/web/app/components/app/app-access-control/access-control-dialog.tsx
index a863935f90d..c29e73aa9a4 100644
--- a/web/app/components/app/app-access-control/access-control-dialog.tsx
+++ b/web/app/components/app/app-access-control/access-control-dialog.tsx
@@ -5,7 +5,6 @@ import {
   DialogCloseButton,
   DialogContent,
 } from '@langgenius/dify-ui/dialog'
-import { useCallback } from 'react'
 
 type DialogProps = {
   className?: string
@@ -14,21 +13,17 @@ type DialogProps = {
   onClose?: () => void
 }
 
-const AccessControlDialog = ({
+export function AccessControlDialog({
   className,
   children,
   show,
   onClose,
-}: DialogProps) => {
-  const close = useCallback(() => {
-    onClose?.()
-  }, [onClose])
-
+}: DialogProps) {
   return (
-    <Dialog open={show} disablePointerDismissal onOpenChange={open => !open && close()}>
+    <Dialog open={show} disablePointerDismissal onOpenChange={open => !open && onClose?.()}>
       <DialogContent
         className={cn(
-          'h-auto max-h-[calc(100dvh-2rem)] min-h-[323px] w-[600px] max-w-none overflow-y-auto rounded-2xl border-none bg-components-panel-bg p-0 shadow-xl transition-all',
+          'h-auto max-h-[calc(100dvh-2rem)] min-h-[323px] w-[600px] max-w-none overflow-y-auto rounded-2xl border-none bg-components-panel-bg p-0 shadow-xl transition-shadow',
           className,
         )}
       >
@@ -38,5 +33,3 @@ const AccessControlDialog = ({
     </Dialog>
   )
 }
-
-export default AccessControlDialog
diff --git a/web/app/components/app/app-access-control/access-control-item.tsx b/web/app/components/app/app-access-control/access-control-item.tsx
index cc2cf94f0c4..5913a7e47f8 100644
--- a/web/app/components/app/app-access-control/access-control-item.tsx
+++ b/web/app/components/app/app-access-control/access-control-item.tsx
@@ -1,37 +1,26 @@
 'use client'
-import type { FC, PropsWithChildren } from 'react'
+import type { PropsWithChildren } from 'react'
 import type { AccessMode } from '@/models/access-control'
-import useAccessControlStore from '@/context/access-control-store'
+import { cn } from '@langgenius/dify-ui/cn'
+import { RadioRoot } from '@langgenius/dify-ui/radio'
 
-type AccessControlItemProps = PropsWithChildren<{
+export function AccessControlItem({ type, children }: PropsWithChildren<{
   type: AccessMode
-}>
-
-const AccessControlItem: FC<AccessControlItemProps> = ({ type, children }) => {
-  const currentMenu = useAccessControlStore(s => s.currentMenu)
-  const setCurrentMenu = useAccessControlStore(s => s.setCurrentMenu)
-  if (currentMenu !== type) {
-    return (
-      <div
-        className="cursor-pointer rounded-[10px] border
-      border-components-option-card-option-border bg-components-option-card-option-bg
-      hover:border-components-option-card-option-border-hover hover:bg-components-option-card-option-bg-hover"
-        onClick={() => setCurrentMenu(type)}
-      >
-        {children}
-      </div>
-    )
-  }
-
+}>) {
   return (
-    <div className="rounded-[10px] border-[1.5px]
-  border-components-option-card-option-selected-border bg-components-option-card-option-selected-bg shadow-sm"
+    <RadioRoot<AccessMode>
+      value={type}
+      variant="unstyled"
+      render={<div />}
+      className={cn(
+        'cursor-pointer rounded-[10px] border-[0.5px] border-components-option-card-option-border bg-components-option-card-option-bg shadow-xs transition-colors',
+        'hover:border-components-option-card-option-border-hover hover:bg-components-option-card-option-bg-hover',
+        'focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+        'data-checked:border-components-option-card-option-selected-border data-checked:bg-components-option-card-option-selected-bg data-checked:ring-[0.5px] data-checked:ring-components-option-card-option-selected-border data-checked:ring-inset',
+        'data-disabled:cursor-not-allowed data-disabled:opacity-60 data-disabled:hover:border-components-option-card-option-border data-disabled:hover:bg-components-option-card-option-bg',
+      )}
     >
       {children}
-    </div>
+    </RadioRoot>
   )
 }
-
-AccessControlItem.displayName = 'AccessControlItem'
-
-export default AccessControlItem
diff --git a/web/app/components/app/app-access-control/access-subject-selector/add-button.tsx b/web/app/components/app/app-access-control/access-subject-selector/add-button.tsx
new file mode 100644
index 00000000000..42fc822e866
--- /dev/null
+++ b/web/app/components/app/app-access-control/access-subject-selector/add-button.tsx
@@ -0,0 +1,208 @@
+'use client'
+
+import type { ComboboxRootChangeEventDetails } from '@langgenius/dify-ui/combobox'
+import type { AccessSubjectSelectionProps } from './types'
+import type {
+  AccessControlGroup,
+  Subject,
+} from '@/models/access-control'
+import {
+  Combobox,
+  ComboboxContent,
+  ComboboxEmpty,
+  ComboboxInput,
+  ComboboxInputGroup,
+  ComboboxList,
+  ComboboxStatus,
+  ComboboxTrigger,
+} from '@langgenius/dify-ui/combobox'
+import { useDebounce } from 'ahooks'
+import { useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+import { useSearchForWhiteListCandidates } from '@/service/access-control/use-app-access-control'
+import { SelectedGroupsBreadCrumb, SubjectItem } from './subject-options'
+import {
+  getSubjectLabel,
+  getSubjectValue,
+  isSameSubject,
+  selectionValueToSubjects,
+  subjectsToSelectionValue,
+} from './utils'
+
+type AccessSubjectAddButtonProps = AccessSubjectSelectionProps & {
+  disabled?: boolean
+  breadcrumbGroups?: AccessControlGroup[]
+  onBreadcrumbGroupsChange?: (groups: AccessControlGroup[]) => void
+}
+
+export function AccessSubjectAddButton({
+  selectedGroups,
+  selectedMembers,
+  onChange,
+  disabled,
+  breadcrumbGroups,
+  onBreadcrumbGroupsChange,
+}: AccessSubjectAddButtonProps) {
+  const { t } = useTranslation()
+  const [open, setOpen] = useState(false)
+  const [keyword, setKeyword] = useState('')
+  const [internalBreadcrumbGroups, setInternalBreadcrumbGroups] = useState<AccessControlGroup[]>([])
+  const scrollRootRef = useRef<HTMLDivElement>(null)
+  const anchorRef = useRef<HTMLDivElement>(null)
+  const selectedGroupsForBreadcrumb = breadcrumbGroups ?? internalBreadcrumbGroups
+  const setSelectedGroupsForBreadcrumb = onBreadcrumbGroupsChange ?? setInternalBreadcrumbGroups
+  const debouncedKeyword = useDebounce(keyword, { wait: 500 })
+
+  const lastAvailableGroup = selectedGroupsForBreadcrumb[selectedGroupsForBreadcrumb.length - 1]
+  const { isLoading, isFetchingNextPage, fetchNextPage, data } = useSearchForWhiteListCandidates({
+    keyword: debouncedKeyword,
+    groupId: lastAvailableGroup?.id,
+    resultsPerPage: 10,
+  }, open && !disabled)
+  const pages = data?.pages ?? []
+  const subjects = pages.flatMap(page => page.subjects ?? [])
+  const selectedSubjects = selectionValueToSubjects({
+    groups: selectedGroups,
+    members: selectedMembers,
+  })
+  const hasResults = pages.length > 0 && subjects.length > 0
+  const shouldShowBreadcrumb = hasResults || selectedGroupsForBreadcrumb.length > 0
+  const hasMore = pages[pages.length - 1]?.hasMore ?? false
+
+  useEffect(() => {
+    let observer: IntersectionObserver | undefined
+    if (anchorRef.current) {
+      observer = new IntersectionObserver((entries) => {
+        if (entries[0]!.isIntersecting && !isLoading && !isFetchingNextPage && hasMore)
+          fetchNextPage()
+      }, { root: scrollRootRef.current, rootMargin: '20px' })
+      observer.observe(anchorRef.current)
+    }
+    return () => observer?.disconnect()
+  }, [fetchNextPage, hasMore, isFetchingNextPage, isLoading])
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    if (nextOpen && disabled)
+      return
+    if (!nextOpen)
+      setKeyword('')
+
+    setOpen(nextOpen)
+  }
+
+  const handleInputValueChange = (inputValue: string, details: ComboboxRootChangeEventDetails) => {
+    if (!disabled && details.reason !== 'item-press')
+      setKeyword(inputValue)
+  }
+
+  const handleValueChange = (nextSubjects: Subject[]) => {
+    onChange(subjectsToSelectionValue(nextSubjects))
+  }
+
+  return (
+    <Combobox<Subject, true>
+      multiple
+      open={open}
+      value={selectedSubjects}
+      inputValue={keyword}
+      items={subjects}
+      disabled={disabled}
+      itemToStringLabel={getSubjectLabel}
+      itemToStringValue={getSubjectValue}
+      isItemEqualToValue={isSameSubject}
+      filter={null}
+      onOpenChange={handleOpenChange}
+      onInputValueChange={handleInputValueChange}
+      onValueChange={handleValueChange}
+    >
+      <ComboboxTrigger
+        aria-label={t('operation.add', { ns: 'common' })}
+        icon={false}
+        size="small"
+        disabled={disabled}
+        className="h-6 w-auto min-w-[52px] shrink-0 rounded-md border-0 bg-transparent px-2 py-0 text-xs font-medium text-components-button-secondary-accent-text hover:bg-state-accent-hover focus-visible:bg-state-accent-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid data-popup-open:bg-state-accent-hover"
+      >
+        <span className="inline-flex min-w-0 items-center justify-center gap-x-0.5 whitespace-nowrap">
+          <span className="i-ri-add-circle-fill size-4 shrink-0" aria-hidden="true" />
+          <span className="shrink-0">{t('operation.add', { ns: 'common' })}</span>
+        </span>
+      </ComboboxTrigger>
+      <ComboboxContent
+        placement="bottom-end"
+        alignOffset={300}
+        popupClassName="relative flex max-h-[400px] w-[400px] flex-col overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur p-0 shadow-lg backdrop-blur-[5px]"
+      >
+        <div ref={scrollRootRef} className="min-h-0 overflow-y-auto">
+          <div className="sticky top-0 z-10 bg-components-panel-bg-blur p-2 pb-0.5 backdrop-blur-[5px]">
+            <ComboboxInputGroup className="h-8 min-h-8 px-2">
+              <span className="mr-0.5 i-ri-search-line size-4 shrink-0 text-text-tertiary" aria-hidden="true" />
+              <ComboboxInput
+                aria-label={t('accessControlDialog.operateGroupAndMember.searchPlaceholder', { ns: 'app' })}
+                placeholder={t('accessControlDialog.operateGroupAndMember.searchPlaceholder', { ns: 'app' })}
+                className="block h-4.5 grow px-1 py-0 text-[13px] text-text-primary"
+              />
+            </ComboboxInputGroup>
+          </div>
+          {isLoading
+            ? (
+                <ComboboxStatus className="p-1">
+                  <SubjectOptionsSkeleton />
+                </ComboboxStatus>
+              )
+            : (
+                <>
+                  {shouldShowBreadcrumb && (
+                    <div className="flex h-7 items-center px-2 py-0.5">
+                      <SelectedGroupsBreadCrumb
+                        selectedGroupsForBreadcrumb={selectedGroupsForBreadcrumb}
+                        onChange={setSelectedGroupsForBreadcrumb}
+                      />
+                    </div>
+                  )}
+                  {hasResults
+                    ? (
+                        <>
+                          <ComboboxList className="max-h-none p-1">
+                            {(subject: Subject) => (
+                              <SubjectItem
+                                key={getSubjectValue(subject)}
+                                subject={subject}
+                                selectedGroups={selectedGroups}
+                                selectedMembers={selectedMembers}
+                                onExpandGroup={group => setSelectedGroupsForBreadcrumb([...selectedGroupsForBreadcrumb, group])}
+                              />
+                            )}
+                          </ComboboxList>
+                          {isFetchingNextPage && <Loading />}
+                          <div ref={anchorRef} className="h-0" />
+                        </>
+                      )
+                    : (
+                        <ComboboxEmpty className="flex h-7 items-center justify-center px-2 py-0.5">
+                          {t('accessControlDialog.operateGroupAndMember.noResult', { ns: 'app' })}
+                        </ComboboxEmpty>
+                      )}
+                </>
+              )}
+        </div>
+      </ComboboxContent>
+    </Combobox>
+  )
+}
+
+function SubjectOptionsSkeleton() {
+  return (
+    <div className="flex flex-col gap-1">
+      {[0, 1, 2, 3, 4].map(index => (
+        <div key={index} className="flex min-h-8 items-center gap-2 rounded-lg p-1 pl-2">
+          <SkeletonRectangle className="my-0 size-4 shrink-0 animate-pulse rounded-sm" />
+          <SkeletonRectangle className="my-0 size-5 shrink-0 animate-pulse rounded-full" />
+          <SkeletonRectangle className="my-0 h-3.5 w-32 animate-pulse" />
+          <SkeletonRectangle className="my-0 h-3 w-16 animate-pulse" />
+        </div>
+      ))}
+    </div>
+  )
+}
diff --git a/web/app/components/app/app-access-control/access-subject-selector/selection-list.tsx b/web/app/components/app/app-access-control/access-subject-selector/selection-list.tsx
new file mode 100644
index 00000000000..4a7a545d62f
--- /dev/null
+++ b/web/app/components/app/app-access-control/access-subject-selector/selection-list.tsx
@@ -0,0 +1,207 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { AccessSubjectSelectionProps } from './types'
+import type {
+  AccessControlAccount,
+  AccessControlGroup,
+} from '@/models/access-control'
+import { Avatar } from '@langgenius/dify-ui/avatar'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+
+type AccessSubjectSelectionListProps = AccessSubjectSelectionProps & {
+  loading?: boolean
+  className?: string
+}
+
+export function AccessSubjectSelectionList({
+  selectedGroups,
+  selectedMembers,
+  onChange,
+  loading,
+  className,
+}: AccessSubjectSelectionListProps) {
+  return (
+    <div className={cn('flex max-h-[400px] flex-col gap-y-2 overflow-y-auto rounded-lg bg-background-section p-2', className)}>
+      {loading
+        ? <AccessSubjectSelectionListSkeleton />
+        : (
+            <RenderGroupsAndMembers
+              selectedGroups={selectedGroups}
+              selectedMembers={selectedMembers}
+              onChange={onChange}
+            />
+          )}
+    </div>
+  )
+}
+
+function AccessSubjectSelectionListSkeleton() {
+  const { t } = useTranslation()
+
+  return (
+    <div role="status" aria-busy="true" aria-label={t('loading', { ns: 'common' })} className="flex flex-col gap-y-2">
+      <SkeletonRectangle className="my-0 h-3 w-14 animate-pulse" />
+      <div className="flex flex-row flex-wrap gap-1">
+        {[0, 1].map(index => (
+          <SelectedItemSkeleton key={index} withMeta />
+        ))}
+      </div>
+      <SkeletonRectangle className="my-0 h-3 w-16 animate-pulse" />
+      <div className="flex flex-row flex-wrap gap-1">
+        {[0, 1, 2].map(index => (
+          <SelectedItemSkeleton key={index} />
+        ))}
+      </div>
+    </div>
+  )
+}
+
+function SelectedItemSkeleton({ withMeta = false }: {
+  withMeta?: boolean
+}) {
+  return (
+    <div className="flex items-center gap-x-1 rounded-full border-[0.5px] border-components-panel-border-subtle bg-components-badge-white-to-dark p-1 pr-1.5 shadow-xs">
+      <SkeletonRectangle className="my-0 size-5 animate-pulse rounded-full" />
+      <SkeletonRectangle className="my-0 h-3 w-20 animate-pulse" />
+      {withMeta && <SkeletonRectangle className="my-0 h-3 w-5 animate-pulse" />}
+      <SkeletonRectangle className="my-0 size-4 animate-pulse rounded-full" />
+    </div>
+  )
+}
+
+function RenderGroupsAndMembers({
+  selectedGroups,
+  selectedMembers,
+  onChange,
+}: AccessSubjectSelectionProps) {
+  const { t } = useTranslation()
+  if (selectedGroups.length <= 0 && selectedMembers.length <= 0) {
+    return (
+      <div className="px-2 pt-5 pb-1.5">
+        <p className="text-center system-xs-regular text-text-tertiary">
+          {t('accessControlDialog.noGroupsOrMembers', { ns: 'app' })}
+        </p>
+      </div>
+    )
+  }
+
+  return (
+    <>
+      <p className="sticky top-0 system-2xs-medium-uppercase text-text-tertiary">
+        {t('accessControlDialog.groups', { ns: 'app', count: selectedGroups.length ?? 0 })}
+      </p>
+      <div className="flex flex-row flex-wrap gap-1">
+        {selectedGroups.map(group => (
+          <SelectedGroupItem
+            key={group.id}
+            group={group}
+            selectedGroups={selectedGroups}
+            selectedMembers={selectedMembers}
+            onChange={onChange}
+          />
+        ))}
+      </div>
+      <p className="sticky top-0 system-2xs-medium-uppercase text-text-tertiary">
+        {t('accessControlDialog.members', { ns: 'app', count: selectedMembers.length ?? 0 })}
+      </p>
+      <div className="flex flex-row flex-wrap gap-1">
+        {selectedMembers.map(member => (
+          <SelectedMemberItem
+            key={member.id}
+            member={member}
+            selectedGroups={selectedGroups}
+            selectedMembers={selectedMembers}
+            onChange={onChange}
+          />
+        ))}
+      </div>
+    </>
+  )
+}
+
+type SelectedGroupItemProps = AccessSubjectSelectionProps & {
+  group: AccessControlGroup
+}
+
+function SelectedGroupItem({
+  group,
+  selectedGroups,
+  selectedMembers,
+  onChange,
+}: SelectedGroupItemProps) {
+  const handleRemoveGroup = () => {
+    onChange({
+      groups: selectedGroups.filter(selectedGroup => selectedGroup.id !== group.id),
+      members: selectedMembers,
+    })
+  }
+
+  return (
+    <SelectedBaseItem
+      icon={<span className="i-ri-organization-chart h-[14px] w-[14px] text-components-avatar-shape-fill-stop-0" aria-hidden="true" />}
+      onRemove={handleRemoveGroup}
+    >
+      <p className="system-xs-regular text-text-primary">{group.name}</p>
+      <p className="system-xs-regular text-text-tertiary">{group.groupSize}</p>
+    </SelectedBaseItem>
+  )
+}
+
+type SelectedMemberItemProps = AccessSubjectSelectionProps & {
+  member: AccessControlAccount
+}
+
+function SelectedMemberItem({
+  member,
+  selectedGroups,
+  selectedMembers,
+  onChange,
+}: SelectedMemberItemProps) {
+  const handleRemoveMember = () => {
+    onChange({
+      groups: selectedGroups,
+      members: selectedMembers.filter(selectedMember => selectedMember.id !== member.id),
+    })
+  }
+
+  return (
+    <SelectedBaseItem
+      icon={<Avatar size="xxs" avatar={null} name={member.name} />}
+      onRemove={handleRemoveMember}
+    >
+      <p className="system-xs-regular text-text-primary">{member.name}</p>
+    </SelectedBaseItem>
+  )
+}
+
+type SelectedBaseItemProps = {
+  icon: ReactNode
+  children: ReactNode
+  onRemove?: () => void
+}
+
+function SelectedBaseItem({ icon, onRemove, children }: SelectedBaseItemProps) {
+  const { t } = useTranslation()
+
+  return (
+    <div className="group flex flex-row items-center gap-x-1 rounded-full border-[0.5px] border-components-panel-border-subtle bg-components-badge-white-to-dark p-1 pr-1.5 shadow-xs">
+      <div className="size-5 overflow-hidden rounded-full bg-components-icon-bg-blue-solid">
+        <div className="flex size-full items-center justify-center bg-[image:var(--color-access-app-icon-mask-bg)]">
+          {icon}
+        </div>
+      </div>
+      {children}
+      <button
+        type="button"
+        className="flex size-4 cursor-pointer items-center justify-center border-none bg-transparent p-0 focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
+        aria-label={t('operation.remove', { ns: 'common' })}
+        onClick={onRemove}
+      >
+        <span className="i-ri-close-circle-fill h-[14px] w-[14px] text-text-quaternary" aria-hidden="true" />
+      </button>
+    </div>
+  )
+}
diff --git a/web/app/components/app/app-access-control/access-subject-selector/subject-options.tsx b/web/app/components/app/app-access-control/access-subject-selector/subject-options.tsx
new file mode 100644
index 00000000000..1a09df73636
--- /dev/null
+++ b/web/app/components/app/app-access-control/access-subject-selector/subject-options.tsx
@@ -0,0 +1,217 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type {
+  AccessControlAccount,
+  AccessControlGroup,
+  Subject,
+  SubjectAccount,
+  SubjectGroup,
+} from '@/models/access-control'
+import { Avatar } from '@langgenius/dify-ui/avatar'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  ComboboxItem,
+  ComboboxItemText,
+} from '@langgenius/dify-ui/combobox'
+import { useTranslation } from 'react-i18next'
+import { useSelector } from '@/context/app-context'
+import { SubjectType } from '@/models/access-control'
+
+export function SubjectItem({
+  subject,
+  selectedGroups,
+  selectedMembers,
+  onExpandGroup,
+}: {
+  subject: Subject
+  selectedGroups: AccessControlGroup[]
+  selectedMembers: AccessControlAccount[]
+  onExpandGroup: (group: AccessControlGroup) => void
+}) {
+  if (subject.subjectType === SubjectType.GROUP) {
+    return (
+      <GroupItem
+        group={(subject as SubjectGroup).groupData}
+        subject={subject}
+        selectedGroups={selectedGroups}
+        onExpandGroup={onExpandGroup}
+      />
+    )
+  }
+
+  return (
+    <MemberItem
+      member={(subject as SubjectAccount).accountData}
+      subject={subject}
+      selectedMembers={selectedMembers}
+    />
+  )
+}
+
+export function SelectedGroupsBreadCrumb({
+  selectedGroupsForBreadcrumb,
+  onChange,
+}: {
+  selectedGroupsForBreadcrumb: AccessControlGroup[]
+  onChange: (groups: AccessControlGroup[]) => void
+}) {
+  const { t } = useTranslation()
+
+  const handleBreadCrumbClick = (index: number) => {
+    const newGroups = selectedGroupsForBreadcrumb.slice(0, index + 1)
+    onChange(newGroups)
+  }
+  const handleReset = () => {
+    onChange([])
+  }
+  const hasBreadcrumb = selectedGroupsForBreadcrumb.length > 0
+
+  return (
+    <div className="flex h-7 items-center gap-x-0.5 px-2 py-0.5">
+      {hasBreadcrumb
+        ? (
+            <button
+              type="button"
+              className="cursor-pointer border-none bg-transparent p-0 text-left system-xs-regular text-text-accent focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
+              onClick={handleReset}
+            >
+              {t('accessControlDialog.operateGroupAndMember.allMembers', { ns: 'app' })}
+            </button>
+          )
+        : (
+            <span className="system-xs-regular text-text-tertiary">{t('accessControlDialog.operateGroupAndMember.allMembers', { ns: 'app' })}</span>
+          )}
+      {selectedGroupsForBreadcrumb.map((group, index) => {
+        const isLastGroup = index === selectedGroupsForBreadcrumb.length - 1
+
+        return (
+          <div key={group.id} className="flex items-center gap-x-0.5 system-xs-regular text-text-tertiary">
+            <span>/</span>
+            {isLastGroup
+              ? <span>{group.name}</span>
+              : (
+                  <button
+                    type="button"
+                    className="cursor-pointer border-none bg-transparent p-0 text-left system-xs-regular text-text-accent focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
+                    onClick={() => handleBreadCrumbClick(index)}
+                  >
+                    {group.name}
+                  </button>
+                )}
+          </div>
+        )
+      })}
+    </div>
+  )
+}
+
+type GroupItemProps = {
+  group: AccessControlGroup
+  subject: Subject
+  selectedGroups: AccessControlGroup[]
+  onExpandGroup: (group: AccessControlGroup) => void
+}
+
+function GroupItem({ group, subject, selectedGroups, onExpandGroup }: GroupItemProps) {
+  const { t } = useTranslation()
+  const isChecked = selectedGroups.some(selectedGroup => selectedGroup.id === group.id)
+
+  return (
+    <div className="flex items-center gap-2 rounded-lg hover:bg-state-base-hover">
+      <ComboboxBaseItem subject={subject}>
+        <SelectionBox checked={isChecked} />
+        <ComboboxItemText className="flex grow items-center px-0">
+          <div className="mr-2 size-5 overflow-hidden rounded-full bg-components-icon-bg-blue-solid">
+            <div className="flex size-full items-center justify-center bg-[image:var(--color-access-app-icon-mask-bg)]">
+              <span className="i-ri-organization-chart h-[14px] w-[14px] text-components-avatar-shape-fill-stop-0" aria-hidden="true" />
+            </div>
+          </div>
+          <span className="mr-1 system-sm-medium text-text-secondary">{group.name}</span>
+          <span className="system-xs-regular text-text-tertiary">{group.groupSize}</span>
+        </ComboboxItemText>
+      </ComboboxBaseItem>
+      <Button
+        size="small"
+        disabled={isChecked}
+        variant="ghost-accent"
+        className="mr-1 flex shrink-0 items-center justify-between px-1.5 py-1"
+        onPointerDown={event => event.preventDefault()}
+        onClick={() => onExpandGroup(group)}
+      >
+        <span className="px-[3px]">{t('accessControlDialog.operateGroupAndMember.expand', { ns: 'app' })}</span>
+        <span className="i-ri-arrow-right-s-line size-4" aria-hidden="true" />
+      </Button>
+    </div>
+  )
+}
+
+type MemberItemProps = {
+  member: AccessControlAccount
+  subject: Subject
+  selectedMembers: AccessControlAccount[]
+}
+
+function MemberItem({ member, subject, selectedMembers }: MemberItemProps) {
+  const currentUser = useSelector(s => s.userProfile)
+  const { t } = useTranslation()
+  const isChecked = selectedMembers.some(selectedMember => selectedMember.id === member.id)
+  return (
+    <ComboboxBaseItem subject={subject} className="pr-3">
+      <SelectionBox checked={isChecked} />
+      <ComboboxItemText className="flex grow items-center px-0">
+        <div className="mr-2 size-5 overflow-hidden rounded-full bg-components-icon-bg-blue-solid">
+          <div className="flex size-full items-center justify-center bg-[image:var(--color-access-app-icon-mask-bg)]">
+            <Avatar size="xxs" avatar={null} name={member.name} />
+          </div>
+        </div>
+        <span className="mr-1 system-sm-medium text-text-secondary">{member.name}</span>
+        {currentUser.email === member.email && (
+          <span className="system-xs-regular text-text-tertiary">
+            (
+            {t('you', { ns: 'common' })}
+            )
+          </span>
+        )}
+      </ComboboxItemText>
+      <span className="system-xs-regular text-text-quaternary">{member.email}</span>
+    </ComboboxBaseItem>
+  )
+}
+
+type ComboboxBaseItemProps = {
+  className?: string
+  subject: Subject
+  children: ReactNode
+}
+
+function ComboboxBaseItem({ children, className, subject }: ComboboxBaseItemProps) {
+  return (
+    <ComboboxItem
+      value={subject}
+      className={cn(
+        'mx-0 flex min-h-8 grow grid-cols-none items-center gap-2 rounded-lg p-1 pl-2',
+        className,
+      )}
+    >
+      {children}
+    </ComboboxItem>
+  )
+}
+
+function SelectionBox({ checked }: { checked: boolean }) {
+  return (
+    <span
+      aria-hidden="true"
+      className={cn(
+        'flex size-4 shrink-0 items-center justify-center rounded-sm shadow-xs shadow-shadow-shadow-3',
+        checked
+          ? 'bg-components-checkbox-bg text-components-checkbox-icon'
+          : 'border border-components-checkbox-border bg-components-checkbox-bg-unchecked',
+      )}
+    >
+      {checked && <span className="i-ri-check-line size-3" />}
+    </span>
+  )
+}
diff --git a/web/app/components/app/app-access-control/access-subject-selector/types.ts b/web/app/components/app/app-access-control/access-subject-selector/types.ts
new file mode 100644
index 00000000000..649b2c22df1
--- /dev/null
+++ b/web/app/components/app/app-access-control/access-subject-selector/types.ts
@@ -0,0 +1,15 @@
+import type {
+  AccessControlAccount,
+  AccessControlGroup,
+} from '@/models/access-control'
+
+export type AccessSubjectSelectionValue = {
+  groups: AccessControlGroup[]
+  members: AccessControlAccount[]
+}
+
+export type AccessSubjectSelectionProps = {
+  selectedGroups: AccessControlGroup[]
+  selectedMembers: AccessControlAccount[]
+  onChange: (value: AccessSubjectSelectionValue) => void
+}
diff --git a/web/app/components/app/app-access-control/access-subject-selector/utils.ts b/web/app/components/app/app-access-control/access-subject-selector/utils.ts
new file mode 100644
index 00000000000..70917bf02cf
--- /dev/null
+++ b/web/app/components/app/app-access-control/access-subject-selector/utils.ts
@@ -0,0 +1,64 @@
+import type { AccessSubjectSelectionValue } from './types'
+import type {
+  AccessControlAccount,
+  AccessControlGroup,
+  Subject,
+  SubjectAccount,
+  SubjectGroup,
+} from '@/models/access-control'
+import { SubjectType } from '@/models/access-control'
+
+function groupToSubject(group: AccessControlGroup): SubjectGroup {
+  return {
+    subjectId: group.id,
+    subjectType: SubjectType.GROUP,
+    groupData: group,
+  }
+}
+
+function memberToSubject(member: AccessControlAccount): SubjectAccount {
+  return {
+    subjectId: member.id,
+    subjectType: SubjectType.ACCOUNT,
+    accountData: member,
+  }
+}
+
+export function getSubjectLabel(subject: Subject) {
+  if (subject.subjectType === SubjectType.GROUP)
+    return (subject as SubjectGroup).groupData.name
+
+  return (subject as SubjectAccount).accountData.name
+}
+
+export function getSubjectValue(subject: Subject) {
+  return `${subject.subjectType}:${subject.subjectId}`
+}
+
+export function isSameSubject(item: Subject, value: Subject) {
+  return item.subjectId === value.subjectId && item.subjectType === value.subjectType
+}
+
+export function selectionValueToSubjects({
+  groups,
+  members,
+}: AccessSubjectSelectionValue) {
+  return [
+    ...groups.map(groupToSubject),
+    ...members.map(memberToSubject),
+  ]
+}
+
+export function subjectsToSelectionValue(subjects: Subject[]): AccessSubjectSelectionValue {
+  const groups: AccessControlGroup[] = []
+  const members: AccessControlAccount[] = []
+
+  subjects.forEach((subject) => {
+    if (subject.subjectType === SubjectType.GROUP)
+      groups.push((subject as SubjectGroup).groupData)
+    else
+      members.push((subject as SubjectAccount).accountData)
+  })
+
+  return { groups, members }
+}
diff --git a/web/app/components/app/app-access-control/add-member-or-group-pop.tsx b/web/app/components/app/app-access-control/add-member-or-group-pop.tsx
index 5c09699f733..c1df04d257c 100644
--- a/web/app/components/app/app-access-control/add-member-or-group-pop.tsx
+++ b/web/app/components/app/app-access-control/add-member-or-group-pop.tsx
@@ -1,369 +1,31 @@
 'use client'
-import type { ComboboxRootChangeEventDetails } from '@langgenius/dify-ui/combobox'
-import type { AccessControlAccount, AccessControlGroup, Subject, SubjectAccount, SubjectGroup } from '@/models/access-control'
-import { Avatar } from '@langgenius/dify-ui/avatar'
-import { Button } from '@langgenius/dify-ui/button'
-import { cn } from '@langgenius/dify-ui/cn'
-import {
-  Combobox,
-  ComboboxContent,
-  ComboboxEmpty,
-  ComboboxInput,
-  ComboboxInputGroup,
-  ComboboxItem,
-  ComboboxItemText,
-  ComboboxList,
-  ComboboxStatus,
-  ComboboxTrigger,
-} from '@langgenius/dify-ui/combobox'
-import { RiAddCircleFill, RiArrowRightSLine, RiOrganizationChart } from '@remixicon/react'
-import { useDebounce } from 'ahooks'
-import { useEffect, useRef, useState } from 'react'
-import { useTranslation } from 'react-i18next'
-import { useSelector } from '@/context/app-context'
-import { SubjectType } from '@/models/access-control'
-import { useSearchForWhiteListCandidates } from '@/service/access-control'
-import useAccessControlStore from '../../../../context/access-control-store'
-import Loading from '../../base/loading'
 
-export default function AddMemberOrGroupDialog() {
-  const { t } = useTranslation()
-  const [open, setOpen] = useState(false)
-  const [keyword, setKeyword] = useState('')
-  const scrollRootRef = useRef<HTMLDivElement>(null)
-  const anchorRef = useRef<HTMLDivElement>(null)
+import {
+  AccessSubjectAddButton,
+} from './access-subject-selector/add-button'
+import { useAccessControlStore } from './store'
+
+export function AddMemberOrGroupDialog({ disabled = false }: {
+  disabled?: boolean
+}) {
   const specificGroups = useAccessControlStore(s => s.specificGroups)
   const setSpecificGroups = useAccessControlStore(s => s.setSpecificGroups)
   const specificMembers = useAccessControlStore(s => s.specificMembers)
   const setSpecificMembers = useAccessControlStore(s => s.setSpecificMembers)
-  const selectedGroupsForBreadcrumb = useAccessControlStore(s => s.selectedGroupsForBreadcrumb)
-  const debouncedKeyword = useDebounce(keyword, { wait: 500 })
-
-  const lastAvailableGroup = selectedGroupsForBreadcrumb[selectedGroupsForBreadcrumb.length - 1]
-  const { isLoading, isFetchingNextPage, fetchNextPage, data } = useSearchForWhiteListCandidates({ keyword: debouncedKeyword, groupId: lastAvailableGroup?.id, resultsPerPage: 10 }, open)
-  const pages = data?.pages ?? []
-  const subjects = pages.flatMap(page => page.subjects ?? [])
-  const selectedSubjects = [
-    ...specificGroups.map(groupToSubject),
-    ...specificMembers.map(memberToSubject),
-  ]
-  const hasResults = pages.length > 0 && subjects.length > 0
-  const shouldShowBreadcrumb = hasResults || selectedGroupsForBreadcrumb.length > 0
-  const hasMore = pages[pages.length - 1]?.hasMore ?? false
-
-  useEffect(() => {
-    let observer: IntersectionObserver | undefined
-    if (anchorRef.current) {
-      observer = new IntersectionObserver((entries) => {
-        if (entries[0]!.isIntersecting && !isLoading && hasMore)
-          fetchNextPage()
-      }, { root: scrollRootRef.current, rootMargin: '20px' })
-      observer.observe(anchorRef.current)
-    }
-    return () => observer?.disconnect()
-  }, [isLoading, fetchNextPage, hasMore])
-
-  const handleOpenChange = (nextOpen: boolean) => {
-    if (!nextOpen)
-      setKeyword('')
-
-    setOpen(nextOpen)
-  }
-
-  const handleInputValueChange = (inputValue: string, details: ComboboxRootChangeEventDetails) => {
-    if (details.reason !== 'item-press')
-      setKeyword(inputValue)
-  }
-
-  const handleValueChange = (nextSubjects: Subject[]) => {
-    const nextGroups: AccessControlGroup[] = []
-    const nextMembers: AccessControlAccount[] = []
-
-    for (const subject of nextSubjects) {
-      if (subject.subjectType === SubjectType.GROUP)
-        nextGroups.push((subject as SubjectGroup).groupData)
-      else
-        nextMembers.push((subject as SubjectAccount).accountData)
-    }
-
-    setSpecificGroups(nextGroups)
-    setSpecificMembers(nextMembers)
-  }
-
-  return (
-    <Combobox<Subject, true>
-      multiple
-      open={open}
-      value={selectedSubjects}
-      inputValue={keyword}
-      items={subjects}
-      itemToStringLabel={getSubjectLabel}
-      itemToStringValue={getSubjectValue}
-      isItemEqualToValue={isSameSubject}
-      filter={null}
-      onOpenChange={handleOpenChange}
-      onInputValueChange={handleInputValueChange}
-      onValueChange={handleValueChange}
-    >
-      <ComboboxTrigger
-        aria-label={t('operation.add', { ns: 'common' })}
-        icon={false}
-        size="small"
-        className="flex h-6 w-auto shrink-0 items-center gap-x-0.5 rounded-md border-0 bg-transparent px-2 py-0 text-xs font-medium text-components-button-secondary-accent-text hover:bg-state-accent-hover focus-visible:bg-state-accent-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid data-popup-open:bg-state-accent-hover"
-      >
-        <RiAddCircleFill className="size-4" aria-hidden="true" />
-        <span>{t('operation.add', { ns: 'common' })}</span>
-      </ComboboxTrigger>
-      <ComboboxContent
-        placement="bottom-end"
-        alignOffset={300}
-        popupClassName="relative flex max-h-[400px] w-[400px] flex-col overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur p-0 shadow-lg backdrop-blur-[5px]"
-      >
-        <div ref={scrollRootRef} className="min-h-0 overflow-y-auto">
-          <div className="sticky top-0 z-10 bg-components-panel-bg-blur p-2 pb-0.5 backdrop-blur-[5px]">
-            <ComboboxInputGroup className="h-8 min-h-8 px-2">
-              <span className="mr-0.5 i-ri-search-line size-4 shrink-0 text-text-tertiary" aria-hidden="true" />
-              <ComboboxInput
-                aria-label={t('accessControlDialog.operateGroupAndMember.searchPlaceholder', { ns: 'app' })}
-                placeholder={t('accessControlDialog.operateGroupAndMember.searchPlaceholder', { ns: 'app' })}
-                className="block h-4.5 grow px-1 py-0 text-[13px] text-text-primary"
-              />
-            </ComboboxInputGroup>
-          </div>
-          {isLoading
-            ? (
-                <ComboboxStatus className="p-1">
-                  <Loading />
-                </ComboboxStatus>
-              )
-            : (
-                <>
-                  {shouldShowBreadcrumb && (
-                    <div className="flex h-7 items-center px-2 py-0.5">
-                      <SelectedGroupsBreadCrumb />
-                    </div>
-                  )}
-                  {hasResults
-                    ? (
-                        <>
-                          <ComboboxList className="max-h-none p-1">
-                            {(subject: Subject) => <SubjectItem key={getSubjectValue(subject)} subject={subject} />}
-                          </ComboboxList>
-                          {isFetchingNextPage && <Loading />}
-                          <div ref={anchorRef} className="h-0" />
-                        </>
-                      )
-                    : (
-                        <ComboboxEmpty className="flex h-7 items-center justify-center px-2 py-0.5">
-                          {t('accessControlDialog.operateGroupAndMember.noResult', { ns: 'app' })}
-                        </ComboboxEmpty>
-                      )}
-                </>
-              )}
-        </div>
-      </ComboboxContent>
-    </Combobox>
-  )
-}
-
-function groupToSubject(group: AccessControlGroup): SubjectGroup {
-  return {
-    subjectId: group.id,
-    subjectType: SubjectType.GROUP,
-    groupData: group,
-  }
-}
-
-function memberToSubject(member: AccessControlAccount): SubjectAccount {
-  return {
-    subjectId: member.id,
-    subjectType: SubjectType.ACCOUNT,
-    accountData: member,
-  }
-}
-
-function getSubjectLabel(subject: Subject) {
-  if (subject.subjectType === SubjectType.GROUP)
-    return (subject as SubjectGroup).groupData.name
-
-  return (subject as SubjectAccount).accountData.name
-}
-
-function getSubjectValue(subject: Subject) {
-  return `${subject.subjectType}:${subject.subjectId}`
-}
-
-function isSameSubject(item: Subject, value: Subject) {
-  return item.subjectId === value.subjectId && item.subjectType === value.subjectType
-}
-
-function SubjectItem({ subject }: { subject: Subject }) {
-  if (subject.subjectType === SubjectType.GROUP)
-    return <GroupItem group={(subject as SubjectGroup).groupData} subject={subject} />
-
-  return <MemberItem member={(subject as SubjectAccount).accountData} subject={subject} />
-}
-
-function SelectedGroupsBreadCrumb() {
   const selectedGroupsForBreadcrumb = useAccessControlStore(s => s.selectedGroupsForBreadcrumb)
   const setSelectedGroupsForBreadcrumb = useAccessControlStore(s => s.setSelectedGroupsForBreadcrumb)
-  const { t } = useTranslation()
-
-  const handleBreadCrumbClick = (index: number) => {
-    const newGroups = selectedGroupsForBreadcrumb.slice(0, index + 1)
-    setSelectedGroupsForBreadcrumb(newGroups)
-  }
-  const handleReset = () => {
-    setSelectedGroupsForBreadcrumb([])
-  }
-  const hasBreadcrumb = selectedGroupsForBreadcrumb.length > 0
 
   return (
-    <div className="flex h-7 items-center gap-x-0.5 px-2 py-0.5">
-      {hasBreadcrumb
-        ? (
-            <button
-              type="button"
-              className="cursor-pointer border-none bg-transparent p-0 text-left system-xs-regular text-text-accent focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
-              onClick={handleReset}
-            >
-              {t('accessControlDialog.operateGroupAndMember.allMembers', { ns: 'app' })}
-            </button>
-          )
-        : (
-            <span className="system-xs-regular text-text-tertiary">{t('accessControlDialog.operateGroupAndMember.allMembers', { ns: 'app' })}</span>
-          )}
-      {selectedGroupsForBreadcrumb.map((group, index) => {
-        const isLastGroup = index === selectedGroupsForBreadcrumb.length - 1
-
-        return (
-          <div key={index} className="flex items-center gap-x-0.5 system-xs-regular text-text-tertiary">
-            <span>/</span>
-            {isLastGroup
-              ? <span>{group.name}</span>
-              : (
-                  <button
-                    type="button"
-                    className="cursor-pointer border-none bg-transparent p-0 text-left system-xs-regular text-text-accent focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
-                    onClick={() => handleBreadCrumbClick(index)}
-                  >
-                    {group.name}
-                  </button>
-                )}
-          </div>
-        )
-      })}
-    </div>
-  )
-}
-
-type GroupItemProps = {
-  group: AccessControlGroup
-  subject: Subject
-}
-function GroupItem({ group, subject }: GroupItemProps) {
-  const { t } = useTranslation()
-  const specificGroups = useAccessControlStore(s => s.specificGroups)
-  const selectedGroupsForBreadcrumb = useAccessControlStore(s => s.selectedGroupsForBreadcrumb)
-  const setSelectedGroupsForBreadcrumb = useAccessControlStore(s => s.setSelectedGroupsForBreadcrumb)
-  const isChecked = specificGroups.some(g => g.id === group.id)
-
-  const handleExpandClick = () => {
-    setSelectedGroupsForBreadcrumb([...selectedGroupsForBreadcrumb, group])
-  }
-
-  return (
-    <div className="flex items-center gap-2 rounded-lg hover:bg-state-base-hover">
-      <BaseItem subject={subject}>
-        <SelectionBox checked={isChecked} />
-        <ComboboxItemText className="flex grow items-center px-0">
-          <div className="mr-2 size-5 overflow-hidden rounded-full bg-components-icon-bg-blue-solid">
-            <div className="bg-access-app-icon-mask-bg flex size-full items-center justify-center">
-              <RiOrganizationChart className="h-[14px] w-[14px] text-components-avatar-shape-fill-stop-0" aria-hidden="true" />
-            </div>
-          </div>
-          <span className="mr-1 system-sm-medium text-text-secondary">{group.name}</span>
-          <span className="system-xs-regular text-text-tertiary">{group.groupSize}</span>
-        </ComboboxItemText>
-      </BaseItem>
-      <Button
-        size="small"
-        disabled={isChecked}
-        variant="ghost-accent"
-        className="mr-1 flex shrink-0 items-center justify-between px-1.5 py-1"
-        onPointerDown={event => event.preventDefault()}
-        onClick={handleExpandClick}
-      >
-        <span className="px-[3px]">{t('accessControlDialog.operateGroupAndMember.expand', { ns: 'app' })}</span>
-        <RiArrowRightSLine className="size-4" aria-hidden="true" />
-      </Button>
-    </div>
-  )
-}
-
-type MemberItemProps = {
-  member: AccessControlAccount
-  subject: Subject
-}
-function MemberItem({ member, subject }: MemberItemProps) {
-  const currentUser = useSelector(s => s.userProfile)
-  const { t } = useTranslation()
-  const specificMembers = useAccessControlStore(s => s.specificMembers)
-  const isChecked = specificMembers.some(m => m.id === member.id)
-  return (
-    <BaseItem subject={subject} className="pr-3">
-      <SelectionBox checked={isChecked} />
-      <ComboboxItemText className="flex grow items-center px-0">
-        <div className="mr-2 size-5 overflow-hidden rounded-full bg-components-icon-bg-blue-solid">
-          <div className="bg-access-app-icon-mask-bg flex size-full items-center justify-center">
-            <Avatar size="xxs" avatar={null} name={member.name} />
-          </div>
-        </div>
-        <span className="mr-1 system-sm-medium text-text-secondary">{member.name}</span>
-        {currentUser.email === member.email && (
-          <span className="system-xs-regular text-text-tertiary">
-            (
-            {t('you', { ns: 'common' })}
-            )
-          </span>
-        )}
-      </ComboboxItemText>
-      <span className="system-xs-regular text-text-quaternary">{member.email}</span>
-    </BaseItem>
-  )
-}
-
-type BaseItemProps = {
-  className?: string
-  subject: Subject
-  children: React.ReactNode
-}
-function BaseItem({ children, className, subject }: BaseItemProps) {
-  return (
-    <ComboboxItem
-      value={subject}
-      className={cn(
-        'mx-0 flex min-h-8 grow grid-cols-none items-center gap-2 rounded-lg p-1 pl-2',
-        className,
-      )}
-    >
-      {children}
-    </ComboboxItem>
-  )
-}
-
-function SelectionBox({ checked }: { checked: boolean }) {
-  return (
-    <span
-      aria-hidden="true"
-      className={cn(
-        'flex size-4 shrink-0 items-center justify-center rounded-sm shadow-xs shadow-shadow-shadow-3',
-        checked
-          ? 'bg-components-checkbox-bg text-components-checkbox-icon'
-          : 'border border-components-checkbox-border bg-components-checkbox-bg-unchecked',
-      )}
-    >
-      {checked && <span className="i-ri-check-line size-3" />}
-    </span>
+    <AccessSubjectAddButton
+      selectedGroups={specificGroups}
+      selectedMembers={specificMembers}
+      disabled={disabled}
+      breadcrumbGroups={selectedGroupsForBreadcrumb}
+      onBreadcrumbGroupsChange={setSelectedGroupsForBreadcrumb}
+      onChange={({ groups, members }) => {
+        setSpecificGroups(groups)
+        setSpecificMembers(members)
+      }}
+    />
   )
 }
diff --git a/web/app/components/app/app-access-control/index.tsx b/web/app/components/app/app-access-control/index.tsx
index 1deb0fa2108..18c28d12757 100644
--- a/web/app/components/app/app-access-control/index.tsx
+++ b/web/app/components/app/app-access-control/index.tsx
@@ -1,20 +1,18 @@
 'use client'
-import type { Subject } from '@/models/access-control'
+import type { Subject as EnterpriseSubject } from '@dify/contracts/enterprise/types.gen'
 import type { App } from '@/types/app'
-import { Button } from '@langgenius/dify-ui/button'
-import { DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { SubjectType as EnterpriseSubjectType } from '@dify/contracts/enterprise/types.gen'
 import { toast } from '@langgenius/dify-ui/toast'
-import { RiBuildingLine, RiGlobalLine, RiVerifiedBadgeLine } from '@remixicon/react'
-import { useSuspenseQuery } from '@tanstack/react-query'
-import { useCallback, useEffect } from 'react'
+import { useMutation, useSuspenseQuery } from '@tanstack/react-query'
 import { useTranslation } from 'react-i18next'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
-import { AccessMode, SubjectType } from '@/models/access-control'
-import { useUpdateAccessMode } from '@/service/access-control'
-import useAccessControlStore from '../../../../context/access-control-store'
-import AccessControlDialog from './access-control-dialog'
-import AccessControlItem from './access-control-item'
-import SpecificGroupsOrMembers, { WebAppSSONotEnabledTip } from './specific-groups-or-members'
+import { AccessMode } from '@/models/access-control'
+import { useAppWhiteListSubjects } from '@/service/access-control/use-app-access-control'
+import { consoleQuery } from '@/service/client'
+import { AccessControlDialog } from './access-control-dialog'
+import { AccessControlDialogContent } from './access-control-dialog-content'
+import { useAccessControlStore } from './store'
+import { AccessControlDraftProvider } from './store-provider'
 
 type AccessControlProps = {
   app: App
@@ -22,92 +20,113 @@ type AccessControlProps = {
   onConfirm?: () => void
 }
 
-export default function AccessControl(props: AccessControlProps) {
+export function AccessControl(props: AccessControlProps) {
   const { app, onClose, onConfirm } = props
   const { t } = useTranslation()
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const setAppId = useAccessControlStore(s => s.setAppId)
-  const specificGroups = useAccessControlStore(s => s.specificGroups)
-  const specificMembers = useAccessControlStore(s => s.specificMembers)
-  const currentMenu = useAccessControlStore(s => s.currentMenu)
-  const setCurrentMenu = useAccessControlStore(s => s.setCurrentMenu)
-  const hideTip = systemFeatures.webapp_auth.enabled
+  const hideExternalTip = systemFeatures.webapp_auth.enabled
     && (systemFeatures.webapp_auth.allow_sso
       || systemFeatures.webapp_auth.allow_email_password_login
       || systemFeatures.webapp_auth.allow_email_code_login)
+  const initialAccessMode = app.access_mode ?? AccessMode.SPECIFIC_GROUPS_MEMBERS
+  const whiteListSubjectsQuery = useAppWhiteListSubjects(
+    app.id,
+    initialAccessMode === AccessMode.SPECIFIC_GROUPS_MEMBERS,
+  )
+  const initialSpecificGroups = whiteListSubjectsQuery.data?.groups ?? []
+  const initialSpecificMembers = whiteListSubjectsQuery.data?.members ?? []
+  const draftKey = [
+    app.id,
+    initialAccessMode,
+    initialSpecificGroups.map(group => group.id).join(','),
+    initialSpecificMembers.map(member => member.id).join(','),
+  ].join(':')
 
-  useEffect(() => {
-    setAppId(app.id)
-    setCurrentMenu(app.access_mode ?? AccessMode.SPECIFIC_GROUPS_MEMBERS)
-  }, [app, setAppId, setCurrentMenu])
+  return (
+    <AccessControlDraftProvider
+      draftKey={draftKey}
+      initialDraft={{
+        appId: app.id,
+        currentMenu: initialAccessMode,
+        specificGroups: initialSpecificGroups,
+        specificMembers: initialSpecificMembers,
+        selectedGroupsForBreadcrumb: [],
+      }}
+    >
+      <AccessControlForm
+        app={app}
+        hideExternalTip={hideExternalTip}
+        subjectsLoading={initialAccessMode === AccessMode.SPECIFIC_GROUPS_MEMBERS && whiteListSubjectsQuery.isPending}
+        onClose={onClose}
+        onConfirm={onConfirm}
+        successMessage={t('accessControlDialog.updateSuccess', { ns: 'app' })}
+      />
+    </AccessControlDraftProvider>
+  )
+}
 
-  const { isPending, mutateAsync: updateAccessMode } = useUpdateAccessMode()
-  const handleConfirm = useCallback(async () => {
+function AccessControlForm({
+  app,
+  hideExternalTip,
+  subjectsLoading,
+  successMessage,
+  onClose,
+  onConfirm,
+}: {
+  app: App
+  hideExternalTip: boolean
+  subjectsLoading: boolean
+  successMessage: string
+  onClose: () => void
+  onConfirm?: () => void
+}) {
+  const specificGroups = useAccessControlStore(s => s.specificGroups)
+  const specificMembers = useAccessControlStore(s => s.specificMembers)
+  const currentMenu = useAccessControlStore(s => s.currentMenu)
+  const { isPending, mutate: updateAccessMode } = useMutation(consoleQuery.explore.updateAppAccessMode.mutationOptions())
+
+  function handleConfirm() {
     const submitData: {
       appId: string
       accessMode: AccessMode
-      subjects?: Pick<Subject, 'subjectId' | 'subjectType'>[]
+      subjects?: Pick<EnterpriseSubject, 'subjectId' | 'subjectType'>[]
     } = { appId: app.id, accessMode: currentMenu }
     if (currentMenu === AccessMode.SPECIFIC_GROUPS_MEMBERS) {
-      const subjects: Pick<Subject, 'subjectId' | 'subjectType'>[] = []
+      const subjects: Pick<EnterpriseSubject, 'subjectId' | 'subjectType'>[] = []
       specificGroups.forEach((group) => {
-        subjects.push({ subjectId: group.id, subjectType: SubjectType.GROUP })
+        subjects.push({ subjectId: group.id, subjectType: EnterpriseSubjectType.SUBJECT_TYPE_GROUP })
       })
       specificMembers.forEach((member) => {
         subjects.push({
           subjectId: member.id,
-          subjectType: SubjectType.ACCOUNT,
+          subjectType: EnterpriseSubjectType.SUBJECT_TYPE_ACCOUNT,
         })
       })
       submitData.subjects = subjects
     }
-    await updateAccessMode(submitData)
-    toast.success(t('accessControlDialog.updateSuccess', { ns: 'app' }))
-    onConfirm?.()
-  }, [updateAccessMode, app, specificGroups, specificMembers, t, onConfirm, currentMenu])
+    updateAccessMode({
+      body: submitData,
+    }, {
+      onSuccess: () => {
+        toast.success(successMessage)
+        onConfirm?.()
+      },
+    })
+  }
+
   return (
     <AccessControlDialog show onClose={onClose}>
-      <div className="flex flex-col gap-y-3">
-        <div className="pt-6 pr-14 pb-3 pl-6">
-          <DialogTitle className="title-2xl-semi-bold text-text-primary">{t('accessControlDialog.title', { ns: 'app' })}</DialogTitle>
-          <DialogDescription className="mt-1 system-xs-regular text-text-tertiary">{t('accessControlDialog.description', { ns: 'app' })}</DialogDescription>
-        </div>
-        <div className="flex flex-col gap-y-1 px-6 pb-3">
-          <div className="leading-6">
-            <p className="system-sm-medium text-text-tertiary">{t('accessControlDialog.accessLabel', { ns: 'app' })}</p>
-          </div>
-          <AccessControlItem type={AccessMode.ORGANIZATION}>
-            <div className="flex items-center p-3">
-              <div className="flex grow items-center gap-x-2">
-                <RiBuildingLine className="size-4 text-text-primary" />
-                <p className="system-sm-medium text-text-primary">{t('accessControlDialog.accessItems.organization', { ns: 'app' })}</p>
-              </div>
-            </div>
-          </AccessControlItem>
-          <AccessControlItem type={AccessMode.SPECIFIC_GROUPS_MEMBERS}>
-            <SpecificGroupsOrMembers />
-          </AccessControlItem>
-          <AccessControlItem type={AccessMode.EXTERNAL_MEMBERS}>
-            <div className="flex items-center p-3">
-              <div className="flex grow items-center gap-x-2">
-                <RiVerifiedBadgeLine className="size-4 text-text-primary" />
-                <p className="system-sm-medium text-text-primary">{t('accessControlDialog.accessItems.external', { ns: 'app' })}</p>
-              </div>
-              {!hideTip && <WebAppSSONotEnabledTip />}
-            </div>
-          </AccessControlItem>
-          <AccessControlItem type={AccessMode.PUBLIC}>
-            <div className="flex items-center gap-x-2 p-3">
-              <RiGlobalLine className="size-4 text-text-primary" />
-              <p className="system-sm-medium text-text-primary">{t('accessControlDialog.accessItems.anyone', { ns: 'app' })}</p>
-            </div>
-          </AccessControlItem>
-        </div>
-        <div className="flex items-center justify-end gap-x-2 p-6 pt-5">
-          <Button onClick={onClose}>{t('operation.cancel', { ns: 'common' })}</Button>
-          <Button disabled={isPending} loading={isPending} variant="primary" onClick={handleConfirm}>{t('operation.confirm', { ns: 'common' })}</Button>
-        </div>
-      </div>
+      <AccessControlDialogContent
+        hideExternalTip={hideExternalTip}
+        saving={isPending}
+        controlsDisabled={subjectsLoading || isPending}
+        confirmDisabled={subjectsLoading}
+        specificGroupsOrMembersProps={{
+          loading: subjectsLoading,
+        }}
+        onClose={onClose}
+        onConfirm={handleConfirm}
+      />
     </AccessControlDialog>
   )
 }
diff --git a/web/app/components/app/app-access-control/specific-groups-or-members.tsx b/web/app/components/app/app-access-control/specific-groups-or-members.tsx
index 982a018930c..4ccac83a1d3 100644
--- a/web/app/components/app/app-access-control/specific-groups-or-members.tsx
+++ b/web/app/components/app/app-access-control/specific-groups-or-members.tsx
@@ -1,34 +1,30 @@
 'use client'
-import type { AccessControlAccount, AccessControlGroup } from '@/models/access-control'
-import { Avatar } from '@langgenius/dify-ui/avatar'
-import { RiCloseCircleFill, RiLockLine, RiOrganizationChart } from '@remixicon/react'
-import { useCallback, useEffect } from 'react'
 import { useTranslation } from 'react-i18next'
 import { AccessMode } from '@/models/access-control'
-import { useAppWhiteListSubjects } from '@/service/access-control'
-import useAccessControlStore from '../../../../context/access-control-store'
 import { Infotip } from '../../base/infotip'
-import Loading from '../../base/loading'
-import AddMemberOrGroupDialog from './add-member-or-group-pop'
+import { AccessSubjectSelectionList } from './access-subject-selector/selection-list'
+import { AddMemberOrGroupDialog } from './add-member-or-group-pop'
+import { useAccessControlStore } from './store'
 
-export default function SpecificGroupsOrMembers() {
+export type SpecificGroupsOrMembersProps = {
+  loading?: boolean
+}
+
+export function SpecificGroupsOrMembers({
+  loading = false,
+}: SpecificGroupsOrMembersProps) {
   const currentMenu = useAccessControlStore(s => s.currentMenu)
-  const appId = useAccessControlStore(s => s.appId)
+  const specificGroups = useAccessControlStore(s => s.specificGroups)
   const setSpecificGroups = useAccessControlStore(s => s.setSpecificGroups)
+  const specificMembers = useAccessControlStore(s => s.specificMembers)
   const setSpecificMembers = useAccessControlStore(s => s.setSpecificMembers)
   const { t } = useTranslation()
 
-  const { isPending, data } = useAppWhiteListSubjects(appId, Boolean(appId) && currentMenu === AccessMode.SPECIFIC_GROUPS_MEMBERS)
-  useEffect(() => {
-    setSpecificGroups(data?.groups ?? [])
-    setSpecificMembers(data?.members ?? [])
-  }, [data, setSpecificGroups, setSpecificMembers])
-
   if (currentMenu !== AccessMode.SPECIFIC_GROUPS_MEMBERS) {
     return (
       <div className="flex items-center p-3">
         <div className="flex grow items-center gap-x-2">
-          <RiLockLine className="size-4 text-text-primary" />
+          <span className="i-ri-lock-line size-4 text-text-primary" aria-hidden="true" />
           <p className="system-sm-medium text-text-primary">{t('accessControlDialog.accessItems.specific', { ns: 'app' })}</p>
         </div>
       </div>
@@ -39,109 +35,28 @@ export default function SpecificGroupsOrMembers() {
     <div>
       <div className="flex items-center gap-x-1 p-3">
         <div className="flex grow items-center gap-x-1">
-          <RiLockLine className="size-4 text-text-primary" />
+          <span className="i-ri-lock-line size-4 text-text-primary" aria-hidden="true" />
           <p className="system-sm-medium text-text-primary">{t('accessControlDialog.accessItems.specific', { ns: 'app' })}</p>
         </div>
         <div className="flex items-center gap-x-1">
-          <AddMemberOrGroupDialog />
+          <AddMemberOrGroupDialog disabled={loading} />
         </div>
       </div>
       <div className="px-1 pb-1">
-        <div className="flex max-h-[400px] flex-col gap-y-2 overflow-y-auto rounded-lg bg-background-section p-2">
-          {isPending ? <Loading /> : <RenderGroupsAndMembers />}
-        </div>
+        <AccessSubjectSelectionList
+          selectedGroups={specificGroups}
+          selectedMembers={specificMembers}
+          loading={loading}
+          onChange={({ groups, members }) => {
+            setSpecificGroups(groups)
+            setSpecificMembers(members)
+          }}
+        />
       </div>
     </div>
   )
 }
 
-function RenderGroupsAndMembers() {
-  const { t } = useTranslation()
-  const specificGroups = useAccessControlStore(s => s.specificGroups)
-  const specificMembers = useAccessControlStore(s => s.specificMembers)
-  if (specificGroups.length <= 0 && specificMembers.length <= 0)
-    return <div className="px-2 pt-5 pb-1.5"><p className="text-center system-xs-regular text-text-tertiary">{t('accessControlDialog.noGroupsOrMembers', { ns: 'app' })}</p></div>
-  return (
-    <>
-      <p className="sticky top-0 system-2xs-medium-uppercase text-text-tertiary">{t('accessControlDialog.groups', { ns: 'app', count: specificGroups.length ?? 0 })}</p>
-      <div className="flex flex-row flex-wrap gap-1">
-        {specificGroups.map((group, index) => <GroupItem key={index} group={group} />)}
-      </div>
-      <p className="sticky top-0 system-2xs-medium-uppercase text-text-tertiary">{t('accessControlDialog.members', { ns: 'app', count: specificMembers.length ?? 0 })}</p>
-      <div className="flex flex-row flex-wrap gap-1">
-        {specificMembers.map((member, index) => <MemberItem key={index} member={member} />)}
-      </div>
-    </>
-  )
-}
-
-type GroupItemProps = {
-  group: AccessControlGroup
-}
-function GroupItem({ group }: GroupItemProps) {
-  const specificGroups = useAccessControlStore(s => s.specificGroups)
-  const setSpecificGroups = useAccessControlStore(s => s.setSpecificGroups)
-  const handleRemoveGroup = useCallback(() => {
-    setSpecificGroups(specificGroups.filter(g => g.id !== group.id))
-  }, [group, setSpecificGroups, specificGroups])
-  return (
-    <BaseItem
-      icon={<RiOrganizationChart className="h-[14px] w-[14px] text-components-avatar-shape-fill-stop-0" />}
-      onRemove={handleRemoveGroup}
-    >
-      <p className="system-xs-regular text-text-primary">{group.name}</p>
-      <p className="system-xs-regular text-text-tertiary">{group.groupSize}</p>
-    </BaseItem>
-  )
-}
-
-type MemberItemProps = {
-  member: AccessControlAccount
-}
-function MemberItem({ member }: MemberItemProps) {
-  const specificMembers = useAccessControlStore(s => s.specificMembers)
-  const setSpecificMembers = useAccessControlStore(s => s.setSpecificMembers)
-  const handleRemoveMember = useCallback(() => {
-    setSpecificMembers(specificMembers.filter(m => m.id !== member.id))
-  }, [member, setSpecificMembers, specificMembers])
-  return (
-    <BaseItem
-      icon={<Avatar size="xxs" avatar={null} name={member.name} />}
-      onRemove={handleRemoveMember}
-    >
-      <p className="system-xs-regular text-text-primary">{member.name}</p>
-    </BaseItem>
-  )
-}
-
-type BaseItemProps = {
-  icon: React.ReactNode
-  children: React.ReactNode
-  onRemove?: () => void
-}
-function BaseItem({ icon, onRemove, children }: BaseItemProps) {
-  const { t } = useTranslation()
-
-  return (
-    <div className="group flex flex-row items-center gap-x-1 rounded-full border-[0.5px] border-components-panel-border-subtle bg-components-badge-white-to-dark p-1 pr-1.5 shadow-xs">
-      <div className="size-5 overflow-hidden rounded-full bg-components-icon-bg-blue-solid">
-        <div className="bg-access-app-icon-mask-bg flex size-full items-center justify-center">
-          {icon}
-        </div>
-      </div>
-      {children}
-      <button
-        type="button"
-        className="flex size-4 cursor-pointer items-center justify-center border-none bg-transparent p-0 focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
-        aria-label={t('operation.remove', { ns: 'common' })}
-        onClick={onRemove}
-      >
-        <RiCloseCircleFill className="h-[14px] w-[14px] text-text-quaternary" aria-hidden="true" />
-      </button>
-    </div>
-  )
-}
-
 export function WebAppSSONotEnabledTip() {
   const { t } = useTranslation()
   const tip = t('accessControlDialog.webAppSSONotEnabledTip', { ns: 'app' })
diff --git a/web/app/components/app/app-access-control/store-provider.tsx b/web/app/components/app/app-access-control/store-provider.tsx
new file mode 100644
index 00000000000..7b8563289b1
--- /dev/null
+++ b/web/app/components/app/app-access-control/store-provider.tsx
@@ -0,0 +1,34 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { AccessControlDraft, AccessControlStoreApi } from './store'
+import { useRef } from 'react'
+import { AccessControlStoreContext, createAccessControlStore } from './store'
+
+export function AccessControlDraftProvider({
+  children,
+  draftKey,
+  initialDraft,
+}: {
+  children?: ReactNode
+  draftKey: string
+  initialDraft: AccessControlDraft
+}) {
+  const storeRef = useRef<{
+    draftKey: string
+    store: AccessControlStoreApi
+  } | undefined>(undefined)
+
+  if (!storeRef.current || storeRef.current.draftKey !== draftKey) {
+    storeRef.current = {
+      draftKey,
+      store: createAccessControlStore(initialDraft),
+    }
+  }
+
+  return (
+    <AccessControlStoreContext value={storeRef.current.store}>
+      {children}
+    </AccessControlStoreContext>
+  )
+}
diff --git a/web/app/components/app/app-access-control/store.ts b/web/app/components/app/app-access-control/store.ts
new file mode 100644
index 00000000000..7b863c2f93c
--- /dev/null
+++ b/web/app/components/app/app-access-control/store.ts
@@ -0,0 +1,52 @@
+import type { StoreApi } from 'zustand'
+import type { AccessControlAccount, AccessControlGroup, AccessMode } from '@/models/access-control'
+import type { App } from '@/types/app'
+import { createContext, use } from 'react'
+import { useStore } from 'zustand'
+import { createStore } from 'zustand/vanilla'
+
+export type AccessControlDraft = {
+  appId?: App['id']
+  currentMenu: AccessMode
+  specificGroups?: AccessControlGroup[]
+  specificMembers?: AccessControlAccount[]
+  selectedGroupsForBreadcrumb?: AccessControlGroup[]
+}
+
+export type AccessControlStore = {
+  appId: App['id']
+  specificGroups: AccessControlGroup[]
+  setSpecificGroups: (specificGroups: AccessControlGroup[]) => void
+  specificMembers: AccessControlAccount[]
+  setSpecificMembers: (specificMembers: AccessControlAccount[]) => void
+  currentMenu: AccessMode
+  setCurrentMenu: (currentMenu: AccessMode) => void
+  selectedGroupsForBreadcrumb: AccessControlGroup[]
+  setSelectedGroupsForBreadcrumb: (selectedGroupsForBreadcrumb: AccessControlGroup[]) => void
+}
+
+export type AccessControlStoreApi = StoreApi<AccessControlStore>
+
+export function createAccessControlStore(initialDraft: AccessControlDraft) {
+  return createStore<AccessControlStore>(set => ({
+    appId: initialDraft.appId ?? '',
+    specificGroups: initialDraft.specificGroups ?? [],
+    setSpecificGroups: specificGroups => set({ specificGroups }),
+    specificMembers: initialDraft.specificMembers ?? [],
+    setSpecificMembers: specificMembers => set({ specificMembers }),
+    currentMenu: initialDraft.currentMenu,
+    setCurrentMenu: currentMenu => set({ currentMenu }),
+    selectedGroupsForBreadcrumb: initialDraft.selectedGroupsForBreadcrumb ?? [],
+    setSelectedGroupsForBreadcrumb: selectedGroupsForBreadcrumb => set({ selectedGroupsForBreadcrumb }),
+  }))
+}
+
+export const AccessControlStoreContext = createContext<AccessControlStoreApi | undefined>(undefined)
+
+export function useAccessControlStore<T>(selector: (state: AccessControlStore) => T) {
+  const store = use(AccessControlStoreContext)
+  if (!store)
+    throw new Error('useAccessControlStore must be used inside AccessControlDraftProvider')
+
+  return useStore(store, selector)
+}
diff --git a/web/app/components/app/app-publisher/__tests__/features-wrapper.spec.tsx b/web/app/components/app/app-publisher/__tests__/features-wrapper.spec.tsx
index e9e54d11068..5c4d8a22c16 100644
--- a/web/app/components/app/app-publisher/__tests__/features-wrapper.spec.tsx
+++ b/web/app/components/app/app-publisher/__tests__/features-wrapper.spec.tsx
@@ -39,7 +39,7 @@ vi.mock('react-i18next', () => ({
 }))
 
 vi.mock('@/app/components/app/app-publisher', () => ({
-  default: (props: Record<string, any>) => {
+  AppPublisher: (props: Record<string, any>) => {
     mockAppPublisherProps.current = props
     return (
       <div>
diff --git a/web/app/components/app/app-publisher/__tests__/index.spec.tsx b/web/app/components/app/app-publisher/__tests__/index.spec.tsx
index e8f617e049a..f5b800ee40b 100644
--- a/web/app/components/app/app-publisher/__tests__/index.spec.tsx
+++ b/web/app/components/app/app-publisher/__tests__/index.spec.tsx
@@ -5,7 +5,7 @@ import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features
 import { AccessMode } from '@/models/access-control'
 import { AppModeEnum } from '@/types/app'
 import { basePath } from '@/utils/var'
-import AppPublisher from '../index'
+import { AppPublisher } from '../index'
 
 const render = (ui: React.ReactElement) => renderWithSystemFeatures(ui, {
   systemFeatures: { webapp_auth: { enabled: true } },
@@ -16,6 +16,7 @@ const mockOnToggle = vi.fn()
 const mockSetAppDetail = vi.fn()
 const mockTrackEvent = vi.fn()
 const mockRefetch = vi.fn()
+const mockUseGetUserCanAccessApp = vi.fn()
 const mockOpenAsyncWindow = vi.fn()
 const mockFetchInstalledAppList = vi.fn()
 const mockFetchAppDetailDirect = vi.fn()
@@ -33,6 +34,7 @@ const hotkeyMocks = vi.hoisted(() => ({
 }))
 
 let mockAppDetail: Record<string, any> | null = null
+let mockWorkspacePermissionKeys: string[] = ['tool.manage']
 
 vi.mock('react-i18next', () => ({
   useTranslation: () => ({
@@ -64,12 +66,15 @@ vi.mock('@/hooks/use-async-window-open', () => ({
   useAsyncWindowOpen: () => mockOpenAsyncWindow,
 }))
 
-vi.mock('@/service/access-control', () => ({
-  useGetUserCanAccessApp: () => ({
-    data: { result: true },
-    isLoading: false,
-    refetch: mockRefetch,
-  }),
+vi.mock('@/service/access-control/use-app-access-control', () => ({
+  useGetUserCanAccessApp: (params: unknown) => {
+    mockUseGetUserCanAccessApp(params)
+    return {
+      data: { result: true },
+      isLoading: false,
+      refetch: mockRefetch,
+    }
+  },
   useAppWhiteListSubjects: () => ({
     data: { groups: [], members: [] },
     isLoading: false,
@@ -104,6 +109,9 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceManager: true,
   }),
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
 }))
 
 vi.mock('@langgenius/dify-ui/toast', () => ({
@@ -128,7 +136,7 @@ vi.mock('@/app/components/app/overview/embedded', () => ({
 }))
 
 vi.mock('../../app-access-control', () => ({
-  default: ({ onConfirm, onClose }: { onConfirm: () => Promise<void>, onClose: () => void }) => (
+  AccessControl: ({ onConfirm, onClose }: { onConfirm: () => Promise<void>, onClose: () => void }) => (
     <div data-testid="access-control">
       <button onClick={() => void onConfirm()}>confirm-access-control</button>
       <button onClick={onClose}>close-access-control</button>
@@ -186,6 +194,7 @@ describe('AppPublisher', () => {
     sectionProps.summary = null
     sectionProps.access = null
     sectionProps.actions = null
+    mockWorkspacePermissionKeys = ['tool.manage']
     mockAppDetail = {
       id: 'app-1',
       name: 'Demo App',
@@ -212,7 +221,7 @@ describe('AppPublisher', () => {
     })
   })
 
-  it('should open the publish popover and refetch access permission data', async () => {
+  it('should enable access permission query when the publish popover opens', async () => {
     render(
       <AppPublisher
         publishedAt={Date.now()}
@@ -226,8 +235,12 @@ describe('AppPublisher', () => {
     expect(mockOnToggle).toHaveBeenCalledWith(true)
 
     await waitFor(() => {
-      expect(mockRefetch).toHaveBeenCalledTimes(1)
+      expect(mockUseGetUserCanAccessApp).toHaveBeenCalledWith({
+        appId: 'app-1',
+        enabled: true,
+      })
     })
+    expect(mockRefetch).not.toHaveBeenCalled()
   })
 
   it('should publish and track the publish event', async () => {
@@ -354,6 +367,26 @@ describe('AppPublisher', () => {
     expect(screen.getByTestId('workflow-tool-drawer')).toBeInTheDocument()
   })
 
+  it('should not open workflow tool drawer without tool.manage', () => {
+    mockWorkspacePermissionKeys = []
+    mockAppDetail = {
+      ...mockAppDetail,
+      mode: AppModeEnum.WORKFLOW,
+    }
+
+    render(
+      <AppPublisher
+        publishedAt={Date.now()}
+      />,
+    )
+
+    fireEvent.click(screen.getByText('common.publish'))
+    fireEvent.click(screen.getByText('publisher-workflow-tool'))
+
+    expect(screen.queryByTestId('workflow-tool-drawer')).not.toBeInTheDocument()
+    expect(sectionProps.actions?.workflowToolAvailable).toBe(false)
+  })
+
   it('should close embedded and access control panels through child callbacks', async () => {
     render(
       <AppPublisher
@@ -374,11 +407,12 @@ describe('AppPublisher', () => {
   })
 
   it('should refresh app detail after access control confirmation', async () => {
-    render(
+    const { queryClient } = render(
       <AppPublisher
         publishedAt={Date.now()}
       />,
     )
+    const invalidateQueriesSpy = vi.spyOn(queryClient, 'invalidateQueries').mockResolvedValue()
 
     fireEvent.click(screen.getByText('common.publish'))
     fireEvent.click(screen.getByText('publisher-access-control'))
@@ -388,11 +422,7 @@ describe('AppPublisher', () => {
     fireEvent.click(screen.getByText('confirm-access-control'))
 
     await waitFor(() => {
-      expect(mockFetchAppDetailDirect).toHaveBeenCalledWith({ url: '/apps', id: 'app-1' })
-      expect(mockSetAppDetail).toHaveBeenCalledWith({
-        id: 'app-1',
-        access_mode: AccessMode.PUBLIC,
-      })
+      expect(invalidateQueriesSpy).toHaveBeenCalledWith({ queryKey: ['apps', 'detail', 'app-1'] })
     })
   })
 
diff --git a/web/app/components/app/app-publisher/__tests__/sections.spec.tsx b/web/app/components/app/app-publisher/__tests__/sections.spec.tsx
index 1572f3d4e07..6675dd49f39 100644
--- a/web/app/components/app/app-publisher/__tests__/sections.spec.tsx
+++ b/web/app/components/app/app-publisher/__tests__/sections.spec.tsx
@@ -243,7 +243,6 @@ describe('app-publisher sections', () => {
         workflowToolAvailable={false}
         workflowToolIsLoading={false}
         workflowToolOutdated={false}
-        workflowToolIsCurrentWorkspaceManager
         workflowToolMessage="workflow-disabled"
         onConfigureWorkflowTool={vi.fn()}
       />,
@@ -282,7 +281,6 @@ describe('app-publisher sections', () => {
         workflowToolAvailable
         workflowToolIsLoading={false}
         workflowToolOutdated={false}
-        workflowToolIsCurrentWorkspaceManager
         onConfigureWorkflowTool={vi.fn()}
       />,
     )
@@ -309,7 +307,6 @@ describe('app-publisher sections', () => {
         workflowToolAvailable
         workflowToolIsLoading={false}
         workflowToolOutdated={false}
-        workflowToolIsCurrentWorkspaceManager
         onConfigureWorkflowTool={vi.fn()}
       />,
     )
diff --git a/web/app/components/app/app-publisher/features-wrapper.tsx b/web/app/components/app/app-publisher/features-wrapper.tsx
index 3189eb89908..b26f6ebf799 100644
--- a/web/app/components/app/app-publisher/features-wrapper.tsx
+++ b/web/app/components/app/app-publisher/features-wrapper.tsx
@@ -14,7 +14,7 @@ import { produce } from 'immer'
 import * as React from 'react'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import AppPublisher from '@/app/components/app/app-publisher'
+import { AppPublisher } from '@/app/components/app/app-publisher'
 import { useFeatures, useFeaturesStore } from '@/app/components/base/features/hooks'
 import { FILE_EXTS } from '@/app/components/base/prompt-editor/constants'
 import { SupportUploadFileTypes } from '@/app/components/workflow/types'
diff --git a/web/app/components/app/app-publisher/index.tsx b/web/app/components/app/app-publisher/index.tsx
index de5b1a9a4af..f3e65682a8f 100644
--- a/web/app/components/app/app-publisher/index.tsx
+++ b/web/app/components/app/app-publisher/index.tsx
@@ -8,14 +8,10 @@ import { Button } from '@langgenius/dify-ui/button'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useHotkey } from '@tanstack/react-hotkeys'
-import { useSuspenseQuery } from '@tanstack/react-query'
+import { useQueryClient, useSuspenseQuery } from '@tanstack/react-query'
 import {
-
-  memo,
   use,
-  useCallback,
   useEffect,
-  useMemo,
   useState,
 } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -30,6 +26,7 @@ import EmbeddedModal from '@/app/components/app/overview/embedded'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { trackEvent } from '@/app/components/base/amplitude'
 import { buildInstalledAppPath } from '@/app/components/explore/installed-app/routes'
+import { useCanManageTools } from '@/app/components/tools/hooks/use-tool-permissions'
 import { WorkflowToolDrawer } from '@/app/components/tools/workflow-tool'
 import { useConfigureButton } from '@/app/components/tools/workflow-tool/hooks/use-configure-button'
 import { collaborationManager } from '@/app/components/workflow/collaboration/core/collaboration-manager'
@@ -40,14 +37,15 @@ import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { useAsyncWindowOpen } from '@/hooks/use-async-window-open'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import { AccessMode } from '@/models/access-control'
-import { useAppWhiteListSubjects, useGetUserCanAccessApp } from '@/service/access-control'
-import { fetchAppDetailDirect, publishToCreatorsPlatform } from '@/service/apps'
+import { useAppWhiteListSubjects, useGetUserCanAccessApp } from '@/service/access-control/use-app-access-control'
+import { publishToCreatorsPlatform } from '@/service/apps'
 import { fetchInstalledAppList } from '@/service/explore'
+import { appDetailQueryKeyPrefix } from '@/service/use-apps'
 import { useInvalidateAppWorkflow } from '@/service/use-workflow'
 import { fetchPublishedWorkflow } from '@/service/workflow'
 import { AppModeEnum } from '@/types/app'
 import { basePath } from '@/utils/var'
-import AccessControl from '../app-access-control'
+import { AccessControl } from '../app-access-control'
 import {
   PublisherAccessSection,
   PublisherActionsSection,
@@ -84,7 +82,7 @@ export type AppPublisherProps = {
   hasHumanInputNode?: boolean
 }
 
-const PUBLISH_SHORTCUT = ['Mod', 'Shift', 'P']
+const PUBLISH_SHORTCUT = ['ctrl', '⇧', 'P']
 
 export type AppPublisherPublishParams = ModelAndParameter | PublishWorkflowParams
 
@@ -94,7 +92,7 @@ type AppPublisherPublishHandler
 
 type AppPublisherRestoreHandler = () => Promise<unknown> | unknown
 
-const AppPublisher = ({
+export function AppPublisher({
   disabled = false,
   publishDisabled = false,
   publishedAt,
@@ -114,7 +112,7 @@ const AppPublisher = ({
   hasTriggerNode = false,
   startNodeLimitExceeded = false,
   hasHumanInputNode = false,
-}: AppPublisherProps) => {
+}: AppPublisherProps) {
   const { t } = useTranslation()
 
   const [published, setPublished] = useState(false)
@@ -130,57 +128,45 @@ const AppPublisher = ({
 
   const workflowStore = use(WorkflowContext)
   const appDetail = useAppStore(state => state.appDetail)
-  const setAppDetail = useAppStore(s => s.setAppDetail)
+  const canManageTools = useCanManageTools()
+  const queryClient = useQueryClient()
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { formatTimeFromNow } = useFormatTimeFromNow()
   const { app_base_url: appBaseURL = '', access_token: accessToken = '' } = appDetail?.site ?? {}
 
   const appURL = getPublisherAppUrl({ appBaseUrl: appBaseURL, accessToken, mode: appDetail?.mode })
   const isChatApp = [AppModeEnum.CHAT, AppModeEnum.AGENT_CHAT, AppModeEnum.COMPLETION].includes(appDetail?.mode || AppModeEnum.CHAT)
-  const hiddenLaunchVariables = useMemo<WorkflowHiddenStartVariable[]>(
-    () => (inputs ?? []).filter(input => input.hide === true),
-    [inputs],
-  )
-  const supportedWorkflowLaunchVariables = useMemo(
-    () => hiddenLaunchVariables.filter(isWorkflowLaunchInputSupported),
-    [hiddenLaunchVariables],
-  )
-  const unsupportedWorkflowLaunchVariables = useMemo(
-    () => hiddenLaunchVariables.filter(variable => !isWorkflowLaunchInputSupported(variable)),
-    [hiddenLaunchVariables],
-  )
-  const initialWorkflowLaunchValues = useMemo(
-    () => createWorkflowLaunchInitialValues(supportedWorkflowLaunchVariables),
-    [supportedWorkflowLaunchVariables],
-  )
+  const hiddenLaunchVariables: WorkflowHiddenStartVariable[] = (inputs ?? []).filter(input => input.hide === true)
+  const supportedWorkflowLaunchVariables = hiddenLaunchVariables.filter(isWorkflowLaunchInputSupported)
+  const unsupportedWorkflowLaunchVariables = hiddenLaunchVariables.filter(variable => !isWorkflowLaunchInputSupported(variable))
+  const initialWorkflowLaunchValues = createWorkflowLaunchInitialValues(supportedWorkflowLaunchVariables)
 
-  const { data: userCanAccessApp, isLoading: isGettingUserCanAccessApp, refetch } = useGetUserCanAccessApp({ appId: appDetail?.id, enabled: false })
+  const shouldLoadUserCanAccessApp = Boolean(appDetail?.id && open && systemFeatures.webapp_auth.enabled)
+  const { data: userCanAccessApp, isLoading: isGettingUserCanAccessApp } = useGetUserCanAccessApp({
+    appId: appDetail?.id,
+    enabled: shouldLoadUserCanAccessApp,
+  })
   const { data: appAccessSubjects, isLoading: isGettingAppWhiteListSubjects } = useAppWhiteListSubjects(appDetail?.id, open && systemFeatures.webapp_auth.enabled && appDetail?.access_mode === AccessMode.SPECIFIC_GROUPS_MEMBERS)
   const invalidateAppWorkflow = useInvalidateAppWorkflow()
   const openAsyncWindow = useAsyncWindowOpen()
 
-  const isAppAccessSet = useMemo(() => isPublisherAccessConfigured(appDetail, appAccessSubjects), [appAccessSubjects, appDetail])
+  const isAppAccessSet = isPublisherAccessConfigured(appDetail, appAccessSubjects)
 
-  const noAccessPermission = useMemo(() => Boolean(
+  const noAccessPermission = Boolean(
     systemFeatures.webapp_auth.enabled
     && appDetail
     && appDetail.access_mode !== AccessMode.EXTERNAL_MEMBERS
     && !userCanAccessApp?.result,
-  ), [systemFeatures, appDetail, userCanAccessApp])
-  const disabledFunctionButton = useMemo(() => (!publishedAt || missingStartNode || noAccessPermission), [publishedAt, missingStartNode, noAccessPermission])
-  const disabledFunctionTooltip = useMemo(() => getDisabledFunctionTooltip({
+  )
+  const disabledFunctionButton = !publishedAt || missingStartNode || noAccessPermission
+  const disabledFunctionTooltip = getDisabledFunctionTooltip({
     t,
     publishedAt,
     missingStartNode,
     noAccessPermission,
-  }), [missingStartNode, noAccessPermission, publishedAt, t])
+  })
 
-  useEffect(() => {
-    if (systemFeatures.webapp_auth.enabled && open && appDetail)
-      refetch()
-  }, [open, appDetail, refetch, systemFeatures])
-
-  const handlePublish = useCallback(async (params?: ModelAndParameter | PublishWorkflowParams) => {
+  async function handlePublish(params?: ModelAndParameter | PublishWorkflowParams) {
     try {
       await onPublish?.(params)
       setPublished(true)
@@ -212,17 +198,17 @@ const AppPublisher = ({
       console.warn('[app-publisher] publish failed', error)
       setPublished(false)
     }
-  }, [appDetail, onPublish, invalidateAppWorkflow])
+  }
 
-  const handleRestore = useCallback(async () => {
+  async function handleRestore() {
     try {
       await onRestore?.()
       setOpen(false)
     }
     catch { }
-  }, [onRestore])
+  }
 
-  const handleOpenChange = useCallback((nextOpen: boolean) => {
+  function handleOpenChange(nextOpen: boolean) {
     if (disabled) {
       setOpen(false)
       return
@@ -233,9 +219,9 @@ const AppPublisher = ({
 
     if (nextOpen)
       setPublished(false)
-  }, [disabled, onToggle])
+  }
 
-  const handleOpenInExplore = useCallback(async () => {
+  async function handleOpenInExplore() {
     await openAsyncWindow(async () => {
       if (!appDetail?.id)
         throw new Error('App not found')
@@ -248,34 +234,33 @@ const AppPublisher = ({
         toast.error(`${err.message || err}`)
       },
     })
-  }, [appDetail?.id, openAsyncWindow])
+  }
 
-  const handleAccessControlUpdate = useCallback(async () => {
+  async function handleAccessControlUpdate() {
     if (!appDetail)
       return
     try {
-      const res = await fetchAppDetailDirect({ url: '/apps', id: appDetail.id })
-      setAppDetail(res)
+      await queryClient.invalidateQueries({ queryKey: [...appDetailQueryKeyPrefix, appDetail.id] })
     }
     finally {
       setShowAppAccessControl(false)
     }
-  }, [appDetail, setAppDetail])
+  }
 
-  const handleOpenWorkflowLaunchDialog = useCallback((targetUrl: string) => {
+  function handleOpenWorkflowLaunchDialog(targetUrl: string) {
     setWorkflowLaunchValues(initialWorkflowLaunchValues)
     setWorkflowLaunchTargetUrl(targetUrl)
     setWorkflowLaunchDialogOpen(true)
-  }, [initialWorkflowLaunchValues])
+  }
 
-  const handleWorkflowLaunchValueChange = useCallback((variable: string, value: WorkflowLaunchInputValue) => {
+  function handleWorkflowLaunchValueChange(variable: string, value: WorkflowLaunchInputValue) {
     setWorkflowLaunchValues(prev => ({
       ...prev,
       [variable]: value,
     }))
-  }, [])
+  }
 
-  const handleWorkflowLaunchConfirm = useCallback(async (event: FormEvent<HTMLFormElement>) => {
+  async function handleWorkflowLaunchConfirm(event: FormEvent<HTMLFormElement>) {
     event.preventDefault()
 
     const targetUrl = await buildWorkflowLaunchUrl({
@@ -286,8 +271,9 @@ const AppPublisher = ({
 
     window.open(targetUrl, '_blank')
     setWorkflowLaunchDialogOpen(false)
-  }, [supportedWorkflowLaunchVariables, workflowLaunchTargetUrl, workflowLaunchValues])
-  const handlePublishToMarketplace = useCallback(async () => {
+  }
+
+  async function handlePublishToMarketplace() {
     if (!appDetail?.id || publishingToMarketplace)
       return
     setPublishingToMarketplace(true)
@@ -302,7 +288,7 @@ const AppPublisher = ({
     finally {
       setPublishingToMarketplace(false)
     }
-  }, [appDetail?.id, publishingToMarketplace, t])
+  }
 
   useHotkey('Mod+Shift+P', (e) => {
     e.preventDefault()
@@ -335,18 +321,21 @@ const AppPublisher = ({
   }, [appDetail?.id, invalidateAppWorkflow, workflowStore])
 
   const hasPublishedVersion = !!publishedAt
+  const workflowToolVisible = appDetail?.mode === AppModeEnum.WORKFLOW && !hasHumanInputNode && !hasTriggerNode
+  const workflowToolAvailableForUser = workflowToolAvailable && canManageTools
   const workflowToolMessage = !hasPublishedVersion || !workflowToolAvailable
     ? t('common.workflowAsToolDisabledHint', { ns: 'workflow' })
     : undefined
-  const workflowToolVisible = appDetail?.mode === AppModeEnum.WORKFLOW && !hasHumanInputNode && !hasTriggerNode
   const workflowToolPublished = !!toolPublished
-  const closeWorkflowToolDrawer = useCallback(() => setWorkflowToolDrawerOpen(false), [])
-  const workflowToolIcon = useMemo(() => ({
+  function closeWorkflowToolDrawer() {
+    setWorkflowToolDrawerOpen(false)
+  }
+  const workflowToolIcon = {
     content: (appDetail?.icon_type === 'image' ? '🤖' : appDetail?.icon) || '🤖',
     background: (appDetail?.icon_type === 'image' ? appDefaultIconBackground : appDetail?.icon_background) || appDefaultIconBackground,
-  }), [appDetail?.icon, appDetail?.icon_background, appDetail?.icon_type])
+  }
   const workflowTool = useConfigureButton({
-    enabled: workflowToolVisible,
+    enabled: workflowToolVisible && canManageTools,
     published: workflowToolPublished,
     detailNeedUpdate: workflowToolPublished && published,
     workflowAppId: appDetail?.id ?? '',
@@ -359,16 +348,19 @@ const AppPublisher = ({
     onRefreshData,
     onConfigured: closeWorkflowToolDrawer,
   })
-  const openWorkflowToolDrawer = useCallback(() => {
+  function openWorkflowToolDrawer() {
+    if (!canManageTools)
+      return
+
     handleOpenChange(false)
     setWorkflowToolDrawerOpen(true)
-  }, [handleOpenChange])
-  const upgradeHighlightStyle = useMemo(() => ({
+  }
+  const upgradeHighlightStyle = {
     background: 'linear-gradient(97deg, var(--components-input-border-active-prompt-1, rgba(11, 165, 236, 0.95)) -3.64%, var(--components-input-border-active-prompt-2, rgba(21, 90, 239, 0.95)) 45.14%)',
     WebkitBackgroundClip: 'text',
     backgroundClip: 'text',
     WebkitTextFillColor: 'transparent',
-  }), [])
+  }
 
   return (
     <>
@@ -443,10 +435,9 @@ const AppPublisher = ({
               showBatchRunConfig={hiddenLaunchVariables.length > 0 && (appDetail?.mode === AppModeEnum.WORKFLOW || appDetail?.mode === AppModeEnum.COMPLETION)}
               showRunConfig={hiddenLaunchVariables.length > 0}
               toolPublished={toolPublished}
-              workflowToolAvailable={workflowToolAvailable}
+              workflowToolAvailable={workflowToolAvailableForUser}
               workflowToolIsLoading={workflowTool.isLoading}
               workflowToolOutdated={workflowTool.outdated}
-              workflowToolIsCurrentWorkspaceManager={workflowTool.isCurrentWorkspaceManager}
               workflowToolMessage={workflowToolMessage}
               onConfigureWorkflowTool={openWorkflowToolDrawer}
             />
@@ -485,7 +476,7 @@ const AppPublisher = ({
           onSubmit={handleWorkflowLaunchConfirm}
         />
       </Popover>
-      {workflowToolDrawerOpen && (
+      {workflowToolDrawerOpen && canManageTools && (
         <WorkflowToolDrawer
           isAdd={!workflowToolPublished}
           payload={workflowTool.payload}
@@ -497,5 +488,3 @@ const AppPublisher = ({
     </>
   )
 }
-
-export default memo(AppPublisher)
diff --git a/web/app/components/app/app-publisher/sections.tsx b/web/app/components/app/app-publisher/sections.tsx
index b3fd7dc14ba..abb2deb2e86 100644
--- a/web/app/components/app/app-publisher/sections.tsx
+++ b/web/app/components/app/app-publisher/sections.tsx
@@ -9,7 +9,6 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from '@langgenius/dify-ui/tooltip'
-import { RiSettings2Line } from '@remixicon/react'
 import { formatForDisplay } from '@tanstack/react-hotkeys'
 import { useTranslation } from 'react-i18next'
 import Divider from '@/app/components/base/divider'
@@ -71,7 +70,6 @@ type ActionsSectionProps = Pick<AppPublisherProps, | 'hasHumanInputNode'
     showRunConfig?: boolean
     workflowToolIsLoading: boolean
     workflowToolOutdated: boolean
-    workflowToolIsCurrentWorkspaceManager: boolean
     workflowToolMessage?: string
     onConfigureWorkflowTool: () => void
   }
@@ -275,7 +273,6 @@ export const PublisherActionsSection = ({
   workflowToolAvailable = true,
   workflowToolIsLoading,
   workflowToolOutdated,
-  workflowToolIsCurrentWorkspaceManager,
   workflowToolMessage,
   onConfigureWorkflowTool,
 }: ActionsSectionProps) => {
@@ -297,7 +294,7 @@ export const PublisherActionsSection = ({
           actionButton={showRunConfig
             ? {
                 ariaLabel: t('operation.config', { ns: 'common' }),
-                icon: <RiSettings2Line className="size-4" />,
+                icon: <span className="i-ri-settings-2-line size-4" />,
                 onClick: () => handleOpenRunConfig?.(appURL),
               }
             : undefined}
@@ -316,7 +313,7 @@ export const PublisherActionsSection = ({
                 actionButton={showBatchRunConfig
                   ? {
                       ariaLabel: t('operation.config', { ns: 'common' }),
-                      icon: <RiSettings2Line className="size-4" />,
+                      icon: <span className="i-ri-settings-2-line size-4" />,
                       onClick: () => handleOpenRunConfig?.(`${appURL}${appURL.includes('?') ? '&' : '?'}mode=batch`),
                     }
                   : undefined}
@@ -366,7 +363,6 @@ export const PublisherActionsSection = ({
           published={!!toolPublished}
           isLoading={workflowToolIsLoading}
           outdated={workflowToolOutdated}
-          isCurrentWorkspaceManager={workflowToolIsCurrentWorkspaceManager}
           onConfigure={onConfigureWorkflowTool}
           disabledReason={workflowToolMessage}
         />
diff --git a/web/app/components/app/configuration/config/agent-setting-button.tsx b/web/app/components/app/configuration/config/agent-setting-button.tsx
index 68a3f8cef16..ff95d4c8c9d 100644
--- a/web/app/components/app/configuration/config/agent-setting-button.tsx
+++ b/web/app/components/app/configuration/config/agent-setting-button.tsx
@@ -2,7 +2,6 @@
 import type { FC } from 'react'
 import type { AgentConfig } from '@/models/debug'
 import { Button } from '@langgenius/dify-ui/button'
-import { RiSettings2Line } from '@remixicon/react'
 import * as React from 'react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -12,6 +11,7 @@ type Props = Readonly<{
   isFunctionCall: boolean
   isChatModel: boolean
   agentConfig?: AgentConfig
+  disabled?: boolean
   onAgentSettingChange: (payload: AgentConfig) => void
 }>
 
@@ -20,14 +20,15 @@ const AgentSettingButton: FC<Props> = ({
   isFunctionCall,
   isChatModel,
   agentConfig,
+  disabled = false,
 }) => {
   const { t } = useTranslation()
   const [isShowAgentSetting, setIsShowAgentSetting] = useState(false)
 
   return (
     <>
-      <Button onClick={() => setIsShowAgentSetting(true)} className="mr-2 shrink-0">
-        <RiSettings2Line className="mr-1 size-4 text-text-tertiary" />
+      <Button onClick={() => setIsShowAgentSetting(true)} className="mr-2 shrink-0" disabled={disabled}>
+        <span className="mr-1 i-ri-settings-2-line size-4 text-text-tertiary" />
         {t('agent.setting.name', { ns: 'appDebug' })}
       </Button>
       {isShowAgentSetting && (
diff --git a/web/app/components/app/configuration/config/agent/agent-tools/__tests__/setting-built-in-tool.spec.tsx b/web/app/components/app/configuration/config/agent/agent-tools/__tests__/setting-built-in-tool.spec.tsx
index 083e93b086d..cd72279fe38 100644
--- a/web/app/components/app/configuration/config/agent/agent-tools/__tests__/setting-built-in-tool.spec.tsx
+++ b/web/app/components/app/configuration/config/agent/agent-tools/__tests__/setting-built-in-tool.spec.tsx
@@ -186,6 +186,20 @@ describe('SettingBuiltInTool', () => {
     expect(screen.getByTestId('mock-form')).toBeInTheDocument()
   })
 
+  it('should render a masked drawer with balanced vertical offsets', async () => {
+    const { baseElement } = renderComponent()
+    await waitFor(() => {
+      expect(screen.getByTestId('mock-form')).toBeInTheDocument()
+    })
+
+    expect(baseElement.querySelector('.bg-background-overlay')).toBeInTheDocument()
+    const drawerPopup = baseElement.querySelector('[role="dialog"]')
+    expect(drawerPopup).toHaveClass(
+      'data-[swipe-direction=right]:top-6',
+      'data-[swipe-direction=right]:bottom-6',
+    )
+  })
+
   it('should call onSave with updated values when save button clicked', async () => {
     const { onSave } = renderComponent()
     await waitFor(() => expect(screen.getByTestId('mock-form')).toBeInTheDocument())
diff --git a/web/app/components/app/configuration/config/agent/agent-tools/setting-built-in-tool.tsx b/web/app/components/app/configuration/config/agent/agent-tools/setting-built-in-tool.tsx
index ccfbd3be14b..113ef2a1c40 100644
--- a/web/app/components/app/configuration/config/agent/agent-tools/setting-built-in-tool.tsx
+++ b/web/app/components/app/configuration/config/agent/agent-tools/setting-built-in-tool.tsx
@@ -181,9 +181,9 @@ const SettingBuiltInTool: FC<Props> = ({
       }}
     >
       <DrawerPortal>
-        <DrawerBackdrop className="bg-transparent" />
+        <DrawerBackdrop className="bg-background-overlay" />
         <DrawerViewport>
-          <DrawerPopup className={cn('justify-start bg-components-panel-bg! p-0! shadow-xl data-[swipe-direction=right]:top-16 data-[swipe-direction=right]:right-2 data-[swipe-direction=right]:bottom-2 data-[swipe-direction=right]:h-auto data-[swipe-direction=right]:w-[420px] data-[swipe-direction=right]:max-w-[420px] data-[swipe-direction=right]:rounded-2xl data-[swipe-direction=right]:border-[0.5px] data-[swipe-direction=right]:border-components-panel-border')}>
+          <DrawerPopup className={cn('justify-start bg-components-panel-bg! p-0! shadow-xl data-[swipe-direction=right]:top-6 data-[swipe-direction=right]:right-2 data-[swipe-direction=right]:bottom-6 data-[swipe-direction=right]:h-auto data-[swipe-direction=right]:w-[420px] data-[swipe-direction=right]:max-w-[420px] data-[swipe-direction=right]:rounded-2xl data-[swipe-direction=right]:border-[0.5px] data-[swipe-direction=right]:border-components-panel-border')}>
             <DrawerContent className="flex min-h-0 flex-1 flex-col p-0 pb-0">
               {isLoading && <Loading type="app" />}
               {!isLoading && (
diff --git a/web/app/components/app/configuration/config/auto-gen-model-storage.ts b/web/app/components/app/configuration/config/auto-gen-model-storage.ts
new file mode 100644
index 00000000000..137e8bc556a
--- /dev/null
+++ b/web/app/components/app/configuration/config/auto-gen-model-storage.ts
@@ -0,0 +1,12 @@
+import type { Model } from '@/types/app'
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+const [
+  useAutoGenModel,
+  _useAutoGenModelValue,
+  _useSetAutoGenModel,
+] = createLocalStorageState<Model>('auto-gen-model')
+
+export {
+  useAutoGenModel,
+}
diff --git a/web/app/components/app/configuration/config/automatic/get-automatic-res.tsx b/web/app/components/app/configuration/config/automatic/get-automatic-res.tsx
index 7041a11ee67..763913f7a64 100644
--- a/web/app/components/app/configuration/config/automatic/get-automatic-res.tsx
+++ b/web/app/components/app/configuration/config/automatic/get-automatic-res.tsx
@@ -39,6 +39,7 @@ import { useModelListAndDefaultModelAndCurrentProviderAndModel } from '@/app/com
 import ModelParameterModal from '@/app/components/header/account-setting/model-provider-page/model-parameter-modal'
 import { generateBasicAppFirstTimeRule, generateRule } from '@/service/debug'
 import { useGenerateRuleTemplate } from '@/service/use-apps'
+import { useAutoGenModel } from '../auto-gen-model-storage'
 import IdeaOutput from './idea-output'
 import InstructionEditorInBasic from './instruction-editor'
 import InstructionEditorInWorkflow from './instruction-editor-in-workflow'
@@ -90,10 +91,8 @@ const GetAutomaticRes: FC<IGetAutomaticResProps> = ({
   onFinished,
 }) => {
   const { t } = useTranslation()
-  const localModel = localStorage.getItem('auto-gen-model')
-    ? JSON.parse(localStorage.getItem('auto-gen-model') as string) as Model
-    : null
-  const [model, setModel] = React.useState<Model>(localModel || {
+  const [storedModel, setStoredModel] = useAutoGenModel()
+  const [model, setModel] = React.useState<Model>(storedModel || {
     name: '',
     provider: '',
     mode: mode as unknown as ModelModeType,
@@ -182,11 +181,8 @@ const GetAutomaticRes: FC<IGetAutomaticResProps> = ({
 
   useEffect(() => {
     if (defaultModel) {
-      const localModel = localStorage.getItem('auto-gen-model')
-        ? JSON.parse(localStorage.getItem('auto-gen-model') || '')
-        : null
-      if (localModel) {
-        setModel(localModel)
+      if (storedModel) {
+        setModel(storedModel)
       }
       else {
         setModel(prev => ({
@@ -196,7 +192,7 @@ const GetAutomaticRes: FC<IGetAutomaticResProps> = ({
         }))
       }
     }
-  }, [defaultModel])
+  }, [defaultModel, storedModel])
 
   const renderLoading = (
     <div className="flex h-full w-0 grow flex-col items-center justify-center space-y-3">
@@ -213,8 +209,8 @@ const GetAutomaticRes: FC<IGetAutomaticResProps> = ({
       mode: newValue.mode as ModelModeType,
     }
     setModel(newModel)
-    localStorage.setItem('auto-gen-model', JSON.stringify(newModel))
-  }, [model, setModel])
+    setStoredModel(newModel)
+  }, [model, setModel, setStoredModel])
 
   const handleCompletionParamsChange = useCallback((newParams: FormValue) => {
     const newModel = {
@@ -222,8 +218,8 @@ const GetAutomaticRes: FC<IGetAutomaticResProps> = ({
       completion_params: newParams as CompletionParams,
     }
     setModel(newModel)
-    localStorage.setItem('auto-gen-model', JSON.stringify(newModel))
-  }, [model, setModel])
+    setStoredModel(newModel)
+  }, [model, setModel, setStoredModel])
 
   const onGenerate = async () => {
     if (!isValid())
diff --git a/web/app/components/app/configuration/config/code-generator/get-code-generator-res.tsx b/web/app/components/app/configuration/config/code-generator/get-code-generator-res.tsx
index dd7fd42dc8d..82f99204880 100644
--- a/web/app/components/app/configuration/config/code-generator/get-code-generator-res.tsx
+++ b/web/app/components/app/configuration/config/code-generator/get-code-generator-res.tsx
@@ -19,7 +19,6 @@ import {
   useBoolean,
   useSessionStorageState,
 } from 'ahooks'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import * as React from 'react'
 import { useCallback, useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -31,6 +30,7 @@ import ModelParameterModal from '@/app/components/header/account-setting/model-p
 import { generateRule } from '@/service/debug'
 import { useGenerateRuleTemplate } from '@/service/use-apps'
 import { languageMap } from '../../../../workflow/nodes/_base/components/editor/code-editor/index'
+import { useAutoGenModel } from '../auto-gen-model-storage'
 import IdeaOutput from '../automatic/idea-output'
 import InstructionEditor from '../automatic/instruction-editor-in-workflow'
 import ResPlaceholder from '../automatic/res-placeholder'
@@ -40,7 +40,6 @@ import { GeneratorType } from '../automatic/types'
 import useGenData from '../automatic/use-gen-data'
 
 const i18nPrefix = 'generate'
-const AUTO_GEN_MODEL_STORAGE_KEY = 'auto-gen-model'
 const defaultCompletionParams = {
   temperature: 0.7,
   max_tokens: 0,
@@ -75,7 +74,7 @@ export const GetCodeGeneratorResModal: FC<IGetCodeGeneratorResProps> = (
   },
 ) => {
   const { t } = useTranslation()
-  const [storedModel, setStoredModel] = useLocalStorage<Model>(AUTO_GEN_MODEL_STORAGE_KEY)
+  const [storedModel, setStoredModel] = useAutoGenModel()
   const [model, setModel] = React.useState<Model>(storedModel || {
     name: '',
     provider: '',
diff --git a/web/app/components/app/configuration/configuration-view.tsx b/web/app/components/app/configuration/configuration-view.tsx
index a33280bb06c..90f2d429720 100644
--- a/web/app/components/app/configuration/configuration-view.tsx
+++ b/web/app/components/app/configuration/configuration-view.tsx
@@ -109,6 +109,7 @@ const ConfigurationView: FC<ConfigurationViewModel> = ({
                         isChatModel={contextValue.modelModeType === ModelModeType.chat}
                         agentConfig={modelConfig.agentConfig}
                         isFunctionCall={contextValue.isFunctionCall}
+                        disabled={contextValue.readonly}
                         onAgentSettingChange={onAgentSettingChange}
                       />
                     )}
@@ -119,6 +120,7 @@ const ConfigurationView: FC<ConfigurationViewModel> = ({
                           provider={modelConfig.provider}
                           completionParams={contextValue.completionParams}
                           modelId={modelConfig.model_id}
+                          readonly={contextValue.readonly}
                           setModel={onModelChange}
                           onCompletionParamsChange={onCompletionParamsChange}
                           debugWithMultipleModel={debugWithMultipleModel}
@@ -245,7 +247,7 @@ const ConfigurationView: FC<ConfigurationViewModel> = ({
               inWorkflow={false}
               showFileUpload={false}
               isChatMode={contextValue.mode !== AppModeEnum.COMPLETION}
-              disabled={false}
+              disabled={!!contextValue.readonly}
               onChange={onFeaturesChange}
               onClose={onCloseFeaturePanel}
               promptVariables={promptVariables}
diff --git a/web/app/components/app/configuration/dataset-config/__tests__/index.spec.tsx b/web/app/components/app/configuration/dataset-config/__tests__/index.spec.tsx
index 25e38b48552..56dac4e06e9 100644
--- a/web/app/components/app/configuration/dataset-config/__tests__/index.spec.tsx
+++ b/web/app/components/app/configuration/dataset-config/__tests__/index.spec.tsx
@@ -8,7 +8,7 @@ import { ComparisonOperator, LogicalOperator } from '@/app/components/workflow/n
 import { getSelectedDatasetsMode } from '@/app/components/workflow/nodes/knowledge-retrieval/utils'
 import { DatasetPermission, DataSourceType } from '@/models/datasets'
 import { AppModeEnum, ModelModeType, RETRIEVE_TYPE } from '@/types/app'
-import { hasEditPermissionForDataset } from '@/utils/permission'
+import { DatasetACLPermission, getDatasetACLCapabilities, hasEditPermissionForDataset } from '@/utils/permission'
 import DatasetConfig from '../index'
 
 // Mock external dependencies
@@ -42,10 +42,29 @@ vi.mock('@/context/app-context', () => ({
     userProfile: {
       id: 'user-123',
     },
+    workspacePermissionKeys: [],
   })),
 }))
 
 vi.mock('@/utils/permission', () => ({
+  DatasetACLPermission: {
+    Readonly: 'dataset.acl.readonly',
+    Edit: 'dataset.acl.edit',
+    Use: 'dataset.acl.use',
+  },
+  getDatasetACLCapabilities: vi.fn(() => ({
+    canReadonly: false,
+    canEdit: true,
+    canImportExportDSL: false,
+    canPipelineTest: false,
+    canDocumentDownload: false,
+    canRetrievalRecall: false,
+    canUse: true,
+    canDeleteFile: false,
+    canPipelineRelease: false,
+    canDelete: false,
+    canAccessConfig: false,
+  })),
   hasEditPermissionForDataset: vi.fn(() => true),
 }))
 
@@ -234,6 +253,7 @@ const createMockDataset = (overrides: Partial<DataSet> = {}): DataSet => {
     indexing_technique: 'high_quality' as any,
     author_name: 'Test Author',
     created_by: 'user-123',
+    maintainer: 'user-123',
     updated_by: 'user-123',
     updated_at: Date.now(),
     app_count: 0,
@@ -306,6 +326,19 @@ const renderDatasetConfig = (contextOverrides: Partial<typeof mockConfigContext>
 describe('DatasetConfig', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    vi.mocked(getDatasetACLCapabilities).mockReturnValue({
+      canReadonly: false,
+      canEdit: true,
+      canImportExportDSL: false,
+      canPipelineTest: false,
+      canDocumentDownload: false,
+      canRetrievalRecall: false,
+      canUse: true,
+      canDeleteFile: false,
+      canPipelineRelease: false,
+      canDelete: false,
+      canAccessConfig: false,
+    })
     mockConfigContext.dataSets = []
     mockConfigContext.setDataSets = vi.fn()
     mockConfigContext.setModelConfig = vi.fn()
@@ -438,6 +471,38 @@ describe('DatasetConfig', () => {
 
       expect(screen.getByTestId(`card-item-${dataset.id}`))!.toBeInTheDocument()
     })
+
+    it('should disable dataset editing when ACL does not grant edit even if legacy dataset permission allows it', () => {
+      const dataset = createMockDataset({
+        permission: DatasetPermission.allTeamMembers,
+        permission_keys: [DatasetACLPermission.Use],
+      })
+      vi.mocked(hasEditPermissionForDataset).mockReturnValue(true)
+      vi.mocked(getDatasetACLCapabilities).mockReturnValue({
+        canReadonly: false,
+        canEdit: false,
+        canImportExportDSL: false,
+        canPipelineTest: false,
+        canDocumentDownload: false,
+        canRetrievalRecall: false,
+        canUse: true,
+        canDeleteFile: false,
+        canPipelineRelease: false,
+        canDelete: false,
+        canAccessConfig: false,
+      })
+
+      renderDatasetConfig({
+        dataSets: [dataset],
+      })
+
+      expect(screen.getByTestId(`card-item-${dataset.id}`))!.toBeInTheDocument()
+      expect(screen.queryByText('Edit')).not.toBeInTheDocument()
+      expect(getDatasetACLCapabilities).toHaveBeenCalledWith(dataset.permission_keys, expect.objectContaining({
+        currentUserId: 'user-123',
+        resourceMaintainer: dataset.maintainer,
+      }))
+    })
   })
 
   describe('Context Variables', () => {
diff --git a/web/app/components/app/configuration/dataset-config/index.tsx b/web/app/components/app/configuration/dataset-config/index.tsx
index 6ea2a638396..aa5624099aa 100644
--- a/web/app/components/app/configuration/dataset-config/index.tsx
+++ b/web/app/components/app/configuration/dataset-config/index.tsx
@@ -31,7 +31,7 @@ import {
 import { useSelector as useAppContextSelector } from '@/context/app-context'
 import ConfigContext from '@/context/debug-configuration'
 import { AppModeEnum } from '@/types/app'
-import { hasEditPermissionForDataset } from '@/utils/permission'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import FeaturePanel from '../base/feature-panel'
 import OperationBtn from '../base/operation-btn'
 import { useFormattingChangedDispatcher } from '../debug/hooks'
@@ -45,7 +45,8 @@ type Props = Readonly<{
 }>
 const DatasetConfig: FC<Props> = ({ readonly, hideMetadataFilter }) => {
   const { t } = useTranslation()
-  const userProfile = useAppContextSelector(s => s.userProfile)
+  const currentUserId = useAppContextSelector(s => s.userProfile?.id)
+  const workspacePermissionKeys = useAppContextSelector(s => s.workspacePermissionKeys)
   const {
     mode,
     dataSets: dataSet,
@@ -155,17 +156,17 @@ const DatasetConfig: FC<Props> = ({ readonly, hideMetadataFilter }) => {
 
   const formattedDataset = useMemo(() => {
     return dataSet.map((item) => {
-      const datasetConfig = {
-        createdBy: item.created_by,
-        partialMemberList: item.partial_member_list || [],
-        permission: item.permission,
-      }
+      const datasetACLCapabilities = getDatasetACLCapabilities(item.permission_keys, {
+        currentUserId,
+        resourceMaintainer: item.maintainer,
+        workspacePermissionKeys,
+      })
       return {
         ...item,
-        editable: hasEditPermissionForDataset(userProfile?.id || '', datasetConfig),
+        editable: datasetACLCapabilities.canEdit,
       }
     })
-  }, [dataSet, userProfile?.id])
+  }, [currentUserId, dataSet, workspacePermissionKeys])
 
   const metadataList = useMemo(() => {
     return intersectionBy(...formattedDataset.filter((dataset) => {
@@ -249,7 +250,7 @@ const DatasetConfig: FC<Props> = ({ readonly, hideMetadataFilter }) => {
     setDatasetConfigs(newInputs)
   }, [setDatasetConfigs, datasetConfigsRef])
 
-  const handleMetadataCompletionParamsChange = useCallback((newParams: Record<string, any>) => {
+  const handleMetadataCompletionParamsChange = useCallback((newParams: Record<string, unknown>) => {
     const newInputs = produce(datasetConfigsRef.current!, (draft) => {
       draft.metadata_model_config = {
         ...draft.metadata_model_config!,
diff --git a/web/app/components/app/configuration/dataset-config/select-dataset/__tests__/index.spec.tsx b/web/app/components/app/configuration/dataset-config/select-dataset/__tests__/index.spec.tsx
index fe475cf8711..46dac5351ce 100644
--- a/web/app/components/app/configuration/dataset-config/select-dataset/__tests__/index.spec.tsx
+++ b/web/app/components/app/configuration/dataset-config/select-dataset/__tests__/index.spec.tsx
@@ -33,6 +33,13 @@ vi.mock('@/service/knowledge/use-dataset', () => ({
   useInfiniteDatasets: (...args: any[]) => mockUseInfiniteDatasets(...args),
 }))
 
+let mockWorkspacePermissionKeys = ['dataset.create_and_management']
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 vi.mock('@/hooks/use-knowledge', () => ({
   useKnowledge: () => ({
     formatIndexingTechniqueAndMethod: (tech: string, method: string) => `${tech}:${method}`,
@@ -78,6 +85,7 @@ const makeDataset = (overrides: Partial<DataSet>): DataSet => ({
 describe('SelectDataSet', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys = ['dataset.create_and_management']
   })
 
   it('renders dataset entries, allows selection, and fires onSelect', async () => {
@@ -139,6 +147,25 @@ describe('SelectDataSet', () => {
     expect(screen.getByRole('button', { name: 'common.operation.add' })).toBeDisabled()
   })
 
+  it('should hide the create dataset link when dataset.create_and_management is unavailable', async () => {
+    mockWorkspacePermissionKeys = []
+    mockUseInfiniteDatasets.mockReturnValue({
+      data: { pages: [{ data: [] }] },
+      isLoading: false,
+      isFetchingNextPage: false,
+      fetchNextPage: vi.fn(),
+      hasNextPage: false,
+    })
+
+    await act(async () => {
+      render(<SelectDataSet {...baseProps} onSelect={vi.fn()} selectedIds={[]} />)
+    })
+
+    expect(screen.getByText('appDebug.feature.dataSet.noDataSet')).toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: 'appDebug.feature.dataSet.toCreate' })).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'common.operation.add' })).toBeDisabled()
+  })
+
   it('uses selectedIds as the initial modal selection', async () => {
     const datasetOne = makeDataset({
       id: 'set-1',
diff --git a/web/app/components/app/configuration/dataset-config/select-dataset/index.tsx b/web/app/components/app/configuration/dataset-config/select-dataset/index.tsx
index 45647160a01..60c4d79a1a6 100644
--- a/web/app/components/app/configuration/dataset-config/select-dataset/index.tsx
+++ b/web/app/components/app/configuration/dataset-config/select-dataset/index.tsx
@@ -13,12 +13,15 @@ import Badge from '@/app/components/base/badge'
 import Loading from '@/app/components/base/loading'
 import { ModelFeatureEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import FeatureIcon from '@/app/components/header/account-setting/model-provider-page/model-selector/feature-icon'
+import { useSelector as useAppContextSelector } from '@/context/app-context'
 import { useKnowledge } from '@/hooks/use-knowledge'
 import Link from '@/next/link'
 import { useInfiniteDatasets } from '@/service/knowledge/use-dataset'
+import { hasPermission } from '@/utils/permission'
 
 type ISelectDataSetProps = {
   isShow: boolean
+  modal?: boolean
   onClose: () => void
   selectedIds: string[]
   onSelect: (dataSet: DataSet[]) => void
@@ -26,6 +29,7 @@ type ISelectDataSetProps = {
 
 const SelectDataSet: FC<ISelectDataSetProps> = ({
   isShow,
+  modal,
   onClose,
   selectedIds,
   onSelect,
@@ -34,6 +38,8 @@ const SelectDataSet: FC<ISelectDataSetProps> = ({
   const [selectedIdsInModal, setSelectedIdsInModal] = useState(() => selectedIds)
   const canSelectMulti = true
   const { formatIndexingTechniqueAndMethod } = useKnowledge()
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+  const canCreateDataset = hasPermission(workspacePermissionKeys, 'dataset.create_and_management')
   const { data, isLoading, isFetchingNextPage, fetchNextPage, hasNextPage } = useInfiniteDatasets(
     { page: 1 },
     { enabled: isShow, staleTime: 0, refetchOnMount: 'always' },
@@ -90,8 +96,8 @@ const SelectDataSet: FC<ISelectDataSetProps> = ({
   }, [handleClose])
 
   return (
-    <Dialog open={isShow} onOpenChange={handleOpenChange}>
-      <DialogContent className="w-100 overflow-hidden">
+    <Dialog modal={modal} open={isShow} onOpenChange={handleOpenChange}>
+      <DialogContent backdropProps={{ forceRender: true }} className="w-100 overflow-hidden">
         <DialogTitle className="title-2xl-semi-bold text-text-primary">
           {t('feature.dataSet.selectTitle', { ns: 'appDebug' })}
         </DialogTitle>
@@ -105,7 +111,9 @@ const SelectDataSet: FC<ISelectDataSetProps> = ({
         {hasNoData && (
           <div className="mt-6 flex h-32 items-center justify-center space-x-1 rounded-lg border border-divider-subtle bg-components-panel-on-panel-item-bg text-[13px]">
             <span className="text-text-tertiary">{t('feature.dataSet.noDataSet', { ns: 'appDebug' })}</span>
-            <Link href="/datasets/create" className="font-normal text-text-accent">{t('feature.dataSet.toCreate', { ns: 'appDebug' })}</Link>
+            {canCreateDataset && (
+              <Link href="/datasets/create" className="font-normal text-text-accent">{t('feature.dataSet.toCreate', { ns: 'appDebug' })}</Link>
+            )}
           </div>
         )}
 
diff --git a/web/app/components/app/configuration/dataset-config/settings-modal/__tests__/index.spec.tsx b/web/app/components/app/configuration/dataset-config/settings-modal/__tests__/index.spec.tsx
index cc7f574208d..092ad6d7ec2 100644
--- a/web/app/components/app/configuration/dataset-config/settings-modal/__tests__/index.spec.tsx
+++ b/web/app/components/app/configuration/dataset-config/settings-modal/__tests__/index.spec.tsx
@@ -1,15 +1,19 @@
 import type { MockedFunction } from 'vitest'
 import type { DataSet } from '@/models/datasets'
 import type { RetrievalConfig } from '@/types/app'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { IndexingType } from '@/app/components/datasets/create/step-two'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
 import { ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
+import { defaultSystemFeatures } from '@/features/system-features/config'
 import { ChunkingMode, DatasetPermission, DataSourceType, RerankingModeEnum } from '@/models/datasets'
 import { updateDatasetSetting } from '@/service/datasets'
 import { useMembers } from '@/service/use-common'
 import { RETRIEVE_METHOD } from '@/types/app'
+import { DatasetACLPermission } from '@/utils/permission'
 import SettingsModal from '../index'
 
 const toastMocks = vi.hoisted(() => ({
@@ -33,7 +37,6 @@ vi.mock('@langgenius/dify-ui/toast', () => ({
 const mockOnCancel = vi.fn()
 const mockOnSave = vi.fn()
 const mockSetShowAccountSettingModal = vi.fn()
-let mockIsWorkspaceDatasetOperator = false
 
 const mockUseModelList = vi.fn()
 const mockUseModelListAndDefaultModel = vi.fn()
@@ -65,14 +68,20 @@ vi.mock('@/service/use-common', async () => ({
 }))
 
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({ isCurrentWorkspaceDatasetOperator: mockIsWorkspaceDatasetOperator }),
-  useSelector: <T,>(selector: (value: { userProfile: { id: string, name: string, email: string, avatar_url: string } }) => T) => selector({
+  useAppContext: () => {
+    throw new Error('legacy workspace dataset_operator state should not be used by SettingsModal')
+  },
+  useSelector: <T,>(selector: (value: {
+    userProfile: { id: string, name: string, email: string, avatar_url: string }
+    workspacePermissionKeys: string[]
+  }) => T) => selector({
     userProfile: {
       id: 'user-1',
       name: 'User One',
       email: 'user@example.com',
       avatar_url: 'avatar.png',
     },
+    workspacePermissionKeys: [],
   }),
 }))
 
@@ -185,6 +194,7 @@ const createDataset = (overrides: Partial<DataSet> = {}, retrievalOverrides: Par
     runtime_mode: 'general',
     enable_api: true,
     is_multimodal: false,
+    permission_keys: [DatasetACLPermission.Edit],
     ...overrides,
     retrieval_model_dict: {
       ...retrievalConfig,
@@ -198,12 +208,19 @@ const createDataset = (overrides: Partial<DataSet> = {}, retrievalOverrides: Par
 }
 
 const renderWithProviders = (dataset: DataSet) => {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  })
+  queryClient.setQueryData(systemFeaturesQueryOptions().queryKey, defaultSystemFeatures)
+
   return render(
-    <SettingsModal
-      currentDataset={dataset}
-      onCancel={mockOnCancel}
-      onSave={mockOnSave}
-    />,
+    <QueryClientProvider client={queryClient}>
+      <SettingsModal
+        currentDataset={dataset}
+        onCancel={mockOnCancel}
+        onSave={mockOnSave}
+      />
+    </QueryClientProvider>,
 
   )
 }
@@ -220,7 +237,6 @@ const renderSettingsModal = async (dataset: DataSet) => {
 describe('SettingsModal', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsWorkspaceDatasetOperator = false
     mockUseMembers.mockReturnValue({
       data: {
         accounts: [
@@ -379,6 +395,18 @@ describe('SettingsModal', () => {
     })
   })
 
+  // Dataset ACL permissions control whether the legacy dataset permission selector is editable.
+  describe('Permission Handling', () => {
+    it('should disable permission selector when dataset lacks edit ACL permission', async () => {
+      const dataset = createDataset({ permission_keys: [DatasetACLPermission.Readonly] })
+
+      const { container } = renderWithProviders(dataset)
+      await waitFor(() => expect(mockUseMembers).toHaveBeenCalled())
+
+      expect(container.querySelector('[class*="cursor-not-allowed"]')).toBeInTheDocument()
+    })
+  })
+
   // Validation guardrails before saving.
   describe('Validation', () => {
     it('should block save when dataset name is empty', async () => {
diff --git a/web/app/components/app/configuration/dataset-config/settings-modal/index.tsx b/web/app/components/app/configuration/dataset-config/settings-modal/index.tsx
index ba11de128db..2a832586dfd 100644
--- a/web/app/components/app/configuration/dataset-config/settings-modal/index.tsx
+++ b/web/app/components/app/configuration/dataset-config/settings-modal/index.tsx
@@ -21,7 +21,6 @@ import { ModelTypeEnum } from '@/app/components/header/account-setting/model-pro
 import { useModelList } from '@/app/components/header/account-setting/model-provider-page/hooks'
 import ModelSelector from '@/app/components/header/account-setting/model-provider-page/model-selector'
 import { useIntegrationsSetting } from '@/app/components/header/account-setting/use-integrations-setting'
-import { useAppContext } from '@/context/app-context'
 import { useDocLink } from '@/context/i18n'
 import { DatasetPermission } from '@/models/datasets'
 import { updateDatasetSetting } from '@/service/datasets'
@@ -30,6 +29,7 @@ import { RetrievalChangeTip, RetrievalSection } from './retrieval-section'
 
 type SettingsModalProps = {
   currentDataset: DataSet
+  height?: string
   onCancel: () => void
   onSave: (newDataset: DataSet) => void
 }
@@ -44,6 +44,7 @@ const labelClass = `
 
 const SettingsModal: FC<SettingsModalProps> = ({
   currentDataset,
+  height = 'calc(100vh - 72px)',
   onCancel,
   onSave,
 }) => {
@@ -55,7 +56,6 @@ const SettingsModal: FC<SettingsModalProps> = ({
   const isExternal = currentDataset.provider === 'external'
   const openIntegrationsSetting = useIntegrationsSetting()
   const [loading, setLoading] = useState(false)
-  const { isCurrentWorkspaceDatasetOperator } = useAppContext()
   const [localeCurrentDataset, setLocaleCurrentDataset] = useState({ ...currentDataset })
   const [topK, setTopK] = useState(localeCurrentDataset?.external_retrieval_model.top_k ?? 2)
   const [scoreThreshold, setScoreThreshold] = useState(localeCurrentDataset?.external_retrieval_model.score_threshold ?? 0.5)
@@ -186,9 +186,9 @@ const SettingsModal: FC<SettingsModalProps> = ({
 
   return (
     <div
-      className="flex w-full flex-col overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-xl"
+      className="flex min-h-0 w-full flex-col overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-xl"
       style={{
-        height: 'calc(100vh - 72px)',
+        height,
       }}
       ref={ref}
     >
@@ -238,7 +238,7 @@ const SettingsModal: FC<SettingsModalProps> = ({
           </div>
           <div className="w-full">
             <PermissionSelector
-              disabled={!localeCurrentDataset?.embedding_available || isCurrentWorkspaceDatasetOperator}
+              disabled={!localeCurrentDataset?.embedding_available}
               permission={localeCurrentDataset.permission}
               value={selectedMemberIDs}
               onChange={v => handleValueChange('permission', v!)}
diff --git a/web/app/components/app/configuration/debug/__tests__/chat-user-input.spec.tsx b/web/app/components/app/configuration/debug/__tests__/chat-user-input.spec.tsx
index 01f3e2834a7..dca45fbbe74 100644
--- a/web/app/components/app/configuration/debug/__tests__/chat-user-input.spec.tsx
+++ b/web/app/components/app/configuration/debug/__tests__/chat-user-input.spec.tsx
@@ -138,10 +138,12 @@ const createContextValue = (overrides: Partial<{
   modelConfig: ModelConfig
   setInputs: (inputs: Inputs) => void
   readonly: boolean
+  canTestAndRun: boolean
 }> = {}) => ({
   modelConfig: createModelConfig(),
   setInputs: mockSetInputs,
   readonly: false,
+  canTestAndRun: true,
   ...overrides,
 })
 
@@ -485,49 +487,79 @@ describe('ChatUserInput', () => {
     })
   })
 
-  describe('Readonly Mode', () => {
-    it('should set string input as readonly when readonly is true', () => {
+  describe('Debug Permission', () => {
+    it('should keep string input editable when configuration is readonly but test/run is allowed', () => {
       mockUseContext.mockReturnValue(createContextValue({
         modelConfig: createModelConfig([
           createPromptVariable({ key: 'name', name: 'Name', type: 'string' }),
         ]),
         readonly: true,
+        canTestAndRun: true,
+      }))
+
+      render(<ChatUserInput inputs={{}} />)
+      expect(screen.getByTestId('input-Name')).not.toHaveAttribute('readonly')
+    })
+
+    it('should set string input as readonly when test/run is denied even if configuration is editable', () => {
+      mockUseContext.mockReturnValue(createContextValue({
+        modelConfig: createModelConfig([
+          createPromptVariable({ key: 'name', name: 'Name', type: 'string' }),
+        ]),
+        readonly: false,
+        canTestAndRun: false,
       }))
 
       render(<ChatUserInput inputs={{}} />)
       expect(screen.getByTestId('input-Name')).toHaveAttribute('readonly')
     })
 
-    it('should set paragraph input as readonly when readonly is true', () => {
+    it('should set string input as readonly when configuration is readonly and test/run is denied', () => {
+      mockUseContext.mockReturnValue(createContextValue({
+        modelConfig: createModelConfig([
+          createPromptVariable({ key: 'name', name: 'Name', type: 'string' }),
+        ]),
+        readonly: true,
+        canTestAndRun: false,
+      }))
+
+      render(<ChatUserInput inputs={{}} />)
+      expect(screen.getByTestId('input-Name')).toHaveAttribute('readonly')
+    })
+
+    it('should set paragraph input as readonly when configuration is readonly and test/run is denied', () => {
       mockUseContext.mockReturnValue(createContextValue({
         modelConfig: createModelConfig([
           createPromptVariable({ key: 'desc', name: 'Description', type: 'paragraph' }),
         ]),
         readonly: true,
+        canTestAndRun: false,
       }))
 
       render(<ChatUserInput inputs={{}} />)
       expect(screen.getByRole('textbox', { name: 'Description' })).toHaveAttribute('readonly')
     })
 
-    it('should disable select when readonly is true', () => {
+    it('should disable select when configuration is readonly and test/run is denied', () => {
       mockUseContext.mockReturnValue(createContextValue({
         modelConfig: createModelConfig([
           createPromptVariable({ key: 'choice', name: 'Choice', type: 'select', options: ['A', 'B'] }),
         ]),
         readonly: true,
+        canTestAndRun: false,
       }))
 
       render(<ChatUserInput inputs={{}} />)
       expect(screen.getByTestId('select-input')).toBeDisabled()
     })
 
-    it('should disable checkbox when readonly is true', () => {
+    it('should disable checkbox when configuration is readonly and test/run is denied', () => {
       mockUseContext.mockReturnValue(createContextValue({
         modelConfig: createModelConfig([
           createPromptVariable({ key: 'enabled', name: 'Enabled', type: 'checkbox' }),
         ]),
         readonly: true,
+        canTestAndRun: false,
       }))
 
       render(<ChatUserInput inputs={{}} />)
diff --git a/web/app/components/app/configuration/debug/__tests__/index.spec.tsx b/web/app/components/app/configuration/debug/__tests__/index.spec.tsx
index c17a74e24c3..b9e1400c67a 100644
--- a/web/app/components/app/configuration/debug/__tests__/index.spec.tsx
+++ b/web/app/components/app/configuration/debug/__tests__/index.spec.tsx
@@ -258,6 +258,7 @@ vi.mock('../debug-with-single-model', () => {
 
 const createContextValue = (overrides: Partial<DebugContextValue> = {}): DebugContextValue => ({
   readonly: false,
+  canTestAndRun: true,
   appId: 'app-id',
   isAPIKeySet: true,
   isTrailFinished: false,
@@ -540,10 +541,23 @@ describe('Debug', () => {
       expect(screen.queryByTestId('chat-user-input')).not.toBeInTheDocument()
     })
 
-    it('should not render refresh action when readonly is true', () => {
+    it('should keep refresh action available when readonly app still has test/run permission', () => {
       renderDebug({
         contextValue: {
           readonly: true,
+          canTestAndRun: true,
+        },
+      })
+
+      fireEvent.click(screen.getAllByTestId('action-button')[0]!)
+      expect(mockState.mockHandleRestart).toHaveBeenCalledTimes(1)
+    })
+
+    it('should not render refresh action when test/run permission is missing', () => {
+      renderDebug({
+        contextValue: {
+          readonly: false,
+          canTestAndRun: false,
         },
       })
 
@@ -907,6 +921,26 @@ describe('Debug', () => {
       expect(screen.getByRole('button', { name: 'common.modelProvider.addModel(4/4)' }))!.toBeDisabled()
     })
 
+    it('should disable add-model button when test/run permission is missing', () => {
+      const onMultipleModelConfigsChange = vi.fn()
+
+      renderDebug({
+        contextValue: {
+          canTestAndRun: false,
+        },
+        props: {
+          debugWithMultipleModel: true,
+          multipleModelConfigs: [{ id: 'model-1', model: 'vision-model', provider: 'openai', parameters: {} }],
+          onMultipleModelConfigsChange,
+        },
+      })
+
+      const addModelButton = screen.getByRole('button', { name: 'common.modelProvider.addModel(1/4)' })
+      expect(addModelButton).toBeDisabled()
+      fireEvent.click(addModelButton)
+      expect(onMultipleModelConfigsChange).not.toHaveBeenCalled()
+    })
+
     it('should emit completion event in multiple-model completion mode', () => {
       renderDebug({
         contextValue: {
diff --git a/web/app/components/app/configuration/debug/chat-user-input.tsx b/web/app/components/app/configuration/debug/chat-user-input.tsx
index 65322cae1b1..251cf819e5d 100644
--- a/web/app/components/app/configuration/debug/chat-user-input.tsx
+++ b/web/app/components/app/configuration/debug/chat-user-input.tsx
@@ -18,7 +18,8 @@ const ChatUserInput = ({
   inputs,
 }: Props) => {
   const { t } = useTranslation()
-  const { modelConfig, setInputs, readonly } = useContext(ConfigContext)
+  const { modelConfig, setInputs, canTestAndRun = false } = useContext(ConfigContext)
+  const debugInputReadonly = !canTestAndRun
 
   const promptVariables = modelConfig.configs.prompt_variables.filter(({ key, name }) => {
     return key && key?.trim() && name && name?.trim()
@@ -51,6 +52,8 @@ const ChatUserInput = ({
   }, [promptVariables, inputs, setInputs])
 
   const handleInputValueChange = (key: string, value: string | boolean) => {
+    if (debugInputReadonly)
+      return
     if (!(key in promptVariableObj))
       return
 
@@ -88,7 +91,7 @@ const ChatUserInput = ({
                     placeholder={name}
                     autoFocus={index === 0}
                     maxLength={max_length}
-                    readOnly={readonly}
+                    readOnly={debugInputReadonly}
                   />
                 )}
                 {type === 'paragraph' && (
@@ -98,13 +101,13 @@ const ChatUserInput = ({
                     placeholder={name}
                     value={inputs[key] ? `${inputs[key]}` : ''}
                     onValueChange={(value) => { handleInputValueChange(key, value) }}
-                    readOnly={readonly}
+                    readOnly={debugInputReadonly}
                   />
                 )}
                 {type === 'select' && (
                   <Select
                     value={inputs[key] ? String(inputs[key]) : null}
-                    disabled={readonly}
+                    disabled={debugInputReadonly}
                     onValueChange={(nextValue) => {
                       if (!nextValue)
                         return
@@ -132,7 +135,7 @@ const ChatUserInput = ({
                     placeholder={name}
                     autoFocus={index === 0}
                     maxLength={max_length}
-                    readOnly={readonly}
+                    readOnly={debugInputReadonly}
                   />
                 )}
                 {type === 'checkbox' && (
@@ -141,7 +144,7 @@ const ChatUserInput = ({
                     value={!!inputs[key]}
                     required={required}
                     onChange={(value) => { handleInputValueChange(key, value) }}
-                    readonly={readonly}
+                    readonly={debugInputReadonly}
                   />
                 )}
               </div>
diff --git a/web/app/components/app/configuration/debug/debug-with-multiple-model/__tests__/chat-item.spec.tsx b/web/app/components/app/configuration/debug/debug-with-multiple-model/__tests__/chat-item.spec.tsx
index 719479498a7..5117aced684 100644
--- a/web/app/components/app/configuration/debug/debug-with-multiple-model/__tests__/chat-item.spec.tsx
+++ b/web/app/components/app/configuration/debug/debug-with-multiple-model/__tests__/chat-item.spec.tsx
@@ -115,6 +115,7 @@ const createDefaultMocks = () => {
     appId: 'app-123',
     inputs: { key: 'value' },
     collectionList: [],
+    canTestAndRun: true,
   })
 
   mockUseProviderContext.mockReturnValue({
@@ -287,6 +288,7 @@ describe('ChatItem', () => {
         appId: 'app-123',
         inputs: {},
         collectionList: [],
+        canTestAndRun: true,
       })
 
       renderComponent()
@@ -522,6 +524,7 @@ describe('ChatItem', () => {
           { id: 'collection1', icon: 'icon1' },
           { id: 'collection2', icon: 'icon2' },
         ],
+        canTestAndRun: true,
       })
 
       renderComponent()
@@ -545,6 +548,7 @@ describe('ChatItem', () => {
         appId: 'app-123',
         inputs: {},
         collectionList: [],
+        canTestAndRun: true,
       })
 
       renderComponent()
@@ -563,6 +567,7 @@ describe('ChatItem', () => {
         appId: 'app-123',
         inputs: {},
         collectionList: [],
+        canTestAndRun: true,
       })
 
       renderComponent()
@@ -631,6 +636,7 @@ describe('ChatItem', () => {
         appId: 'app-123',
         inputs: {},
         collectionList: [],
+        canTestAndRun: true,
       })
 
       // This may throw since the code does agentConfig.tools?.forEach
diff --git a/web/app/components/app/configuration/debug/debug-with-multiple-model/__tests__/index.spec.tsx b/web/app/components/app/configuration/debug/debug-with-multiple-model/__tests__/index.spec.tsx
index bd12ff2c142..6d678eebf13 100644
--- a/web/app/components/app/configuration/debug/debug-with-multiple-model/__tests__/index.spec.tsx
+++ b/web/app/components/app/configuration/debug/debug-with-multiple-model/__tests__/index.spec.tsx
@@ -29,10 +29,13 @@ let modelIdCounter = 0
 let featureState: FeatureStoreState
 
 type MockChatInputAreaProps = {
+  readonly?: boolean
   onSend?: (message: string, files?: FileEntity[]) => void
   onFeatureBarClick?: (state: boolean) => void
   showFeatureBar?: boolean
   showFileUpload?: boolean
+  featureBarReadonly?: boolean
+  disabled?: boolean
   inputs?: Record<string, any>
   inputsForm?: InputForm[]
   speechToTextConfig?: unknown
@@ -90,8 +93,8 @@ vi.mock('@/app/components/base/chat/chat/chat-input-area', () => ({
     capturedChatInputProps = props
     return (
       <div data-testid="chat-input-area">
-        <button type="button" onClick={() => props.onSend?.('test message', mockFiles)}>send</button>
-        <button type="button" onClick={() => props.onFeatureBarClick?.(true)}>feature</button>
+        <button type="button" disabled={props.disabled} onClick={() => props.onSend?.('test message', mockFiles)}>send</button>
+        {props.showFeatureBar && <button type="button" disabled={props.featureBarReadonly} onClick={() => props.onFeatureBarClick?.(true)}>feature</button>}
       </div>
     )
   },
@@ -150,12 +153,16 @@ type DebugConfiguration = {
   mode: AppModeEnum
   inputs: Inputs
   modelConfig: ModelConfig
+  readonly: boolean
+  canTestAndRun: boolean
 }
 
 const createDebugConfiguration = (overrides: Partial<DebugConfiguration> = {}): DebugConfiguration => ({
   mode: AppModeEnum.CHAT,
   inputs: {},
   modelConfig: createModelConfig(),
+  readonly: false,
+  canTestAndRun: true,
   ...overrides,
 })
 
@@ -438,6 +445,38 @@ describe('DebugWithMultipleModel', () => {
       expect(useAppStore.getState().showAppConfigureFeaturesModal).toBe(true)
     })
 
+    it('should allow sending but disable feature configuration when configuration is readonly and test/run is allowed', () => {
+      mockUseDebugConfigurationContext.mockReturnValue(createDebugConfiguration({
+        readonly: true,
+        canTestAndRun: true,
+      }))
+
+      renderComponent()
+      fireEvent.click(screen.getByRole('button', { name: /send/i }))
+
+      expect(capturedChatInputProps?.readonly).toBe(false)
+      expect(capturedChatInputProps?.disabled).toBe(false)
+      expect(capturedChatInputProps?.showFeatureBar).toBe(true)
+      expect(capturedChatInputProps?.featureBarReadonly).toBe(true)
+      expect(screen.getByRole('button', { name: /feature/i })).toBeDisabled()
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith(expect.objectContaining({
+        type: APP_CHAT_WITH_MULTIPLE_MODEL,
+      }))
+    })
+
+    it('should block sending when test/run permission is missing', () => {
+      mockUseDebugConfigurationContext.mockReturnValue(createDebugConfiguration({
+        canTestAndRun: false,
+      }))
+
+      renderComponent()
+      fireEvent.click(screen.getByRole('button', { name: /send/i }))
+
+      expect(capturedChatInputProps?.readonly).toBe(true)
+      expect(capturedChatInputProps?.disabled).toBe(true)
+      expect(mockEventEmitter.emit).not.toHaveBeenCalled()
+    })
+
     it('should render chat input in agent chat mode', () => {
       // Arrange
       mockUseDebugConfigurationContext.mockReturnValue(createDebugConfiguration({
diff --git a/web/app/components/app/configuration/debug/debug-with-multiple-model/chat-item.tsx b/web/app/components/app/configuration/debug/debug-with-multiple-model/chat-item.tsx
index d5b353c899b..39f29972ea4 100644
--- a/web/app/components/app/configuration/debug/debug-with-multiple-model/chat-item.tsx
+++ b/web/app/components/app/configuration/debug/debug-with-multiple-model/chat-item.tsx
@@ -44,6 +44,7 @@ const ChatItem: FC<ChatItemProps> = ({
     appId,
     inputs,
     collectionList,
+    canTestAndRun = false,
   } = useDebugConfigurationContext()
   const { textGenerationModelList } = useProviderContext()
   const features = useFeatures(s => s.features)
@@ -84,6 +85,8 @@ const ChatItem: FC<ChatItemProps> = ({
   useFormattingChangedSubscription(chatList)
 
   const doSend: OnSend = useCallback((message, files) => {
+    if (!canTestAndRun)
+      return
     const currentProvider = textGenerationModelList.find(item => item.provider === modelAndParameter.provider)
     const currentModel = currentProvider?.models.find(model => model.model === modelAndParameter.model)
     const supportVision = currentModel?.features?.includes(ModelFeatureEnum.vision)
@@ -116,7 +119,7 @@ const ChatItem: FC<ChatItemProps> = ({
         onGetSuggestedQuestions: (responseItemId, getAbortController) => fetchSuggestedQuestions(appId, responseItemId, getAbortController),
       },
     )
-  }, [appId, chatList, config, handleSend, inputs, modelAndParameter.model, modelAndParameter.parameters, modelAndParameter.provider, textGenerationModelList])
+  }, [appId, canTestAndRun, chatList, config, handleSend, inputs, modelAndParameter.model, modelAndParameter.parameters, modelAndParameter.provider, textGenerationModelList])
 
   const { eventEmitter } = useEventEmitterContextContext()
   eventEmitter?.useSubscription((v: any) => {
diff --git a/web/app/components/app/configuration/debug/debug-with-multiple-model/index.tsx b/web/app/components/app/configuration/debug/debug-with-multiple-model/index.tsx
index 11241fec67a..b219af3c6a3 100644
--- a/web/app/components/app/configuration/debug/debug-with-multiple-model/index.tsx
+++ b/web/app/components/app/configuration/debug/debug-with-multiple-model/index.tsx
@@ -23,6 +23,8 @@ const DebugWithMultipleModel = () => {
     mode,
     inputs,
     modelConfig,
+    readonly,
+    canTestAndRun = false,
   } = useDebugConfigurationContext()
   const speech2text = useFeatures(s => s.features.speech2text)
   const file = useFeatures(s => s.features.file)
@@ -35,6 +37,8 @@ const DebugWithMultipleModel = () => {
   const isChatMode = mode === AppModeEnum.CHAT || mode === AppModeEnum.AGENT_CHAT
 
   const handleSend = useCallback((message: string, files?: FileEntity[]) => {
+    if (!canTestAndRun)
+      return
     if (checkCanSend && !checkCanSend())
       return
 
@@ -45,7 +49,7 @@ const DebugWithMultipleModel = () => {
         files,
       },
     } as any)
-  }, [eventEmitter, checkCanSend])
+  }, [canTestAndRun, eventEmitter, checkCanSend])
 
   const twoLine = multipleModelConfigs.length === 2
   const threeLine = multipleModelConfigs.length === 3
@@ -141,7 +145,10 @@ const DebugWithMultipleModel = () => {
         <div className="shrink-0 px-6 pb-0">
           <ChatInputArea
             botName="Bot"
+            readonly={!canTestAndRun}
+            disabled={!canTestAndRun}
             showFeatureBar
+            featureBarReadonly={readonly}
             showFileUpload={false}
             onFeatureBarClick={setShowAppConfigureFeaturesModal}
             onSend={handleSend}
diff --git a/web/app/components/app/configuration/debug/debug-with-single-model/__tests__/index.spec.tsx b/web/app/components/app/configuration/debug/debug-with-single-model/__tests__/index.spec.tsx
index 1cc359fe856..fc1df42ea4b 100644
--- a/web/app/components/app/configuration/debug/debug-with-single-model/__tests__/index.spec.tsx
+++ b/web/app/components/app/configuration/debug/debug-with-single-model/__tests__/index.spec.tsx
@@ -164,6 +164,8 @@ vi.mock('@/next/navigation', () => ({
 
 // Mock complex context providers
 const mockDebugConfigContext = {
+  readonly: false,
+  canTestAndRun: true,
   appId: 'test-app-id',
   isAPIKeySet: true,
   isTrailFinished: false,
@@ -405,6 +407,7 @@ vi.mock('@/app/components/base/audio-btn/audio.player.manager', () => ({
 }))
 
 type MockChatProps = {
+  readonly?: boolean
   chatList?: ChatItem[]
   isResponding?: boolean
   onSend?: (message: string, files?: FileEntity[]) => void
@@ -418,6 +421,9 @@ type MockChatProps = {
   onAnnotationRemoved?: (index: number) => void
   switchSibling?: (siblingMessageId: string) => void
   onFeatureBarClick?: (state: boolean) => void
+  showFeatureBar?: boolean
+  featureBarReadonly?: boolean
+  inputDisabled?: boolean
 }
 
 const mockFile: FileEntity = {
@@ -434,6 +440,7 @@ const mockFile: FileEntity = {
 // This is a pragmatic mock that tests the integration at DebugWithSingleModel level
 vi.mock('@/app/components/base/chat/chat', () => ({
   default: function MockChat({
+    readonly,
     chatList,
     isResponding,
     onSend,
@@ -447,6 +454,9 @@ vi.mock('@/app/components/base/chat/chat', () => ({
     onAnnotationRemoved,
     switchSibling,
     onFeatureBarClick,
+    showFeatureBar,
+    featureBarReadonly,
+    inputDisabled,
   }: MockChatProps) {
     const items = chatList || []
     const suggested = suggestedQuestions ?? []
@@ -464,6 +474,8 @@ vi.mock('@/app/components/base/chat/chat', () => ({
         <textarea
           data-testid="chat-input"
           placeholder="Type a message"
+          readOnly={readonly}
+          disabled={inputDisabled}
           onChange={() => {
             // Simulate input change
           }}
@@ -471,14 +483,14 @@ vi.mock('@/app/components/base/chat/chat', () => ({
         <button
           data-testid="send-button"
           onClick={() => onSend?.('test message', [])}
-          disabled={isResponding}
+          disabled={isResponding || readonly || inputDisabled}
         >
           Send
         </button>
         <button
           data-testid="send-with-files"
           onClick={() => onSend?.('test message', [mockFile])}
-          disabled={isResponding}
+          disabled={isResponding || readonly || inputDisabled}
         >
           Send With Files
         </button>
@@ -518,9 +530,10 @@ vi.mock('@/app/components/base/chat/chat', () => ({
             Switch
           </button>
         )}
-        {onFeatureBarClick && (
+        {showFeatureBar && onFeatureBarClick && (
           <button
             data-testid="feature-bar-button"
+            disabled={featureBarReadonly}
             onClick={() => onFeatureBarClick(true)}
           >
             Features
@@ -649,6 +662,46 @@ describe('DebugWithSingleModel', () => {
 
       expect(useAppStore.getState().showAppConfigureFeaturesModal).toBe(true)
     })
+
+    it('should allow sending but disable feature configuration when configuration is readonly and test/run is allowed', async () => {
+      mockUseDebugConfigurationContext.mockReturnValue({
+        ...mockDebugConfigContext,
+        readonly: true,
+        canTestAndRun: true,
+      })
+
+      render(<DebugWithSingleModel ref={ref as RefObject<DebugWithSingleModelRefType>} />)
+
+      expect(screen.getByTestId('chat-input')).not.toHaveAttribute('readonly')
+      expect(screen.getByTestId('feature-bar-button')).toBeDisabled()
+      expect(screen.queryByTestId('add-annotation-button')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('edit-annotation-button')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('remove-annotation-button')).not.toBeInTheDocument()
+
+      fireEvent.click(screen.getByTestId('send-button'))
+
+      await waitFor(() => {
+        expect(mockSsePost).toHaveBeenCalled()
+      })
+    })
+
+    it('should block sending when test/run permission is missing', () => {
+      mockUseDebugConfigurationContext.mockReturnValue({
+        ...mockDebugConfigContext,
+        readonly: false,
+        canTestAndRun: false,
+      })
+
+      render(<DebugWithSingleModel ref={ref as RefObject<DebugWithSingleModelRefType>} />)
+
+      expect(screen.getByTestId('chat-input')).toHaveAttribute('readonly')
+      expect(screen.getByTestId('chat-input')).toBeDisabled()
+      expect(screen.getByTestId('send-button')).toBeDisabled()
+      expect(screen.getByTestId('feature-bar-button')).toBeInTheDocument()
+      expect(screen.queryByTestId('add-annotation-button')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('edit-annotation-button')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('remove-annotation-button')).not.toBeInTheDocument()
+    })
   })
 
   // Model Configuration Tests
diff --git a/web/app/components/app/configuration/debug/debug-with-single-model/index.tsx b/web/app/components/app/configuration/debug/debug-with-single-model/index.tsx
index aef3d5ef9c4..0670a097366 100644
--- a/web/app/components/app/configuration/debug/debug-with-single-model/index.tsx
+++ b/web/app/components/app/configuration/debug/debug-with-single-model/index.tsx
@@ -40,6 +40,7 @@ const DebugWithSingleModel = (
   const { userProfile } = useAppContext()
   const {
     readonly,
+    canTestAndRun = false,
     modelConfig,
     appId,
     inputs,
@@ -47,6 +48,8 @@ const DebugWithSingleModel = (
     completionParams,
     // isShowVisionConfig,
   } = useDebugConfigurationContext()
+  const debugInputReadonly = !canTestAndRun
+  const canManageAnnotation = !readonly && canTestAndRun
   const { textGenerationModelList } = useProviderContext()
   const features = useFeatures(s => s.features)
   const configTemplate = useConfigFromDebugContext()
@@ -91,6 +94,8 @@ const DebugWithSingleModel = (
   useFormattingChangedSubscription(chatList)
 
   const doSend: OnSend = useCallback((message, files, isRegenerate = false, parentAnswer: ChatItem | null = null) => {
+    if (!canTestAndRun)
+      return
     if (checkCanSend && !checkCanSend())
       return
     const currentProvider = textGenerationModelList.find(item => item.provider === modelConfig.provider)
@@ -125,7 +130,7 @@ const DebugWithSingleModel = (
         onGetSuggestedQuestions: (responseItemId, getAbortController) => fetchSuggestedQuestions(appId, responseItemId, getAbortController),
       },
     )
-  }, [appId, chatList, checkCanSend, completionParams, config, handleSend, inputs, modelConfig.mode, modelConfig.model_id, modelConfig.provider, textGenerationModelList])
+  }, [appId, canTestAndRun, chatList, checkCanSend, completionParams, config, handleSend, inputs, modelConfig.mode, modelConfig.model_id, modelConfig.provider, textGenerationModelList])
 
   const doRegenerate = useCallback((chatItem: ChatItem, editedQuestion?: { message: string, files?: FileEntity[] }) => {
     const question = editedQuestion ? chatItem : chatList.find(item => item.id === chatItem.parentMessageId)!
@@ -151,15 +156,17 @@ const DebugWithSingleModel = (
 
   return (
     <Chat
-      readonly={readonly}
+      readonly={debugInputReadonly}
       config={config}
       chatList={chatList}
       isResponding={isResponding}
       chatContainerClassName="px-3 pt-6"
       chatFooterClassName="px-3 pt-10 pb-0"
       showFeatureBar
+      featureBarReadonly={readonly}
       showFileUpload={false}
       onFeatureBarClick={setShowAppConfigureFeaturesModal}
+      inputDisabled={!canTestAndRun}
       suggestedQuestions={suggestedQuestions}
       onSend={doSend}
       inputs={inputs}
@@ -170,9 +177,9 @@ const DebugWithSingleModel = (
       showPromptLog
       questionIcon={<Avatar avatar={userProfile.avatar_url} name={userProfile.name} size="xl" />}
       allToolIcons={allToolIcons}
-      onAnnotationEdited={handleAnnotationEdited}
-      onAnnotationAdded={handleAnnotationAdded}
-      onAnnotationRemoved={handleAnnotationRemoved}
+      onAnnotationEdited={canManageAnnotation ? handleAnnotationEdited : undefined}
+      onAnnotationAdded={canManageAnnotation ? handleAnnotationAdded : undefined}
+      onAnnotationRemoved={canManageAnnotation ? handleAnnotationRemoved : undefined}
       noSpacing
     />
   )
diff --git a/web/app/components/app/configuration/debug/index.tsx b/web/app/components/app/configuration/debug/index.tsx
index 8ce019e004a..e3e840f7571 100644
--- a/web/app/components/app/configuration/debug/index.tsx
+++ b/web/app/components/app/configuration/debug/index.tsx
@@ -77,7 +77,7 @@ const Debug: FC<IDebug> = ({
 }) => {
   const { t } = useTranslation()
   const {
-    readonly,
+    canTestAndRun = false,
     appId,
     mode,
     modelModeType,
@@ -303,6 +303,9 @@ const Debug: FC<IDebug> = ({
   }
 
   const handleSendTextCompletion = () => {
+    if (!canTestAndRun)
+      return
+
     if (debugWithMultipleModel) {
       eventEmitter?.emit({
         type: APP_CHAT_WITH_MULTIPLE_MODEL,
@@ -404,7 +407,7 @@ const Debug: FC<IDebug> = ({
                       <Button
                         variant="ghost-accent"
                         onClick={() => onMultipleModelConfigsChange(true, [...multipleModelConfigs, { id: `${Date.now()}`, model: '', provider: '', parameters: {} }])}
-                        disabled={multipleModelConfigs.length >= 4}
+                        disabled={multipleModelConfigs.length >= 4 || !canTestAndRun}
                       >
                         <RiAddLine className="mr-1 size-3.5" />
                         {t('modelProvider.addModel', { ns: 'common' })}
@@ -420,7 +423,7 @@ const Debug: FC<IDebug> = ({
             {mode !== AppModeEnum.COMPLETION && (
               <>
                 {
-                  !readonly && (
+                  canTestAndRun && (
                     <Tooltip>
                       <TooltipTrigger render={<ActionButton onClick={clearConversation}><RefreshCcw01 className="size-4" /></ActionButton>} />
                       <TooltipContent>
@@ -434,7 +437,7 @@ const Debug: FC<IDebug> = ({
                   varList.length > 0 && (
                     <div className="relative mr-2 ml-1">
                       <Tooltip>
-                        <TooltipTrigger render={<ActionButton state={expanded ? ActionButtonState.Active : undefined} onClick={() => !readonly && setExpanded(!expanded)}><RiEqualizer2Line className="size-4" /></ActionButton>} />
+                        <TooltipTrigger render={<ActionButton state={expanded ? ActionButtonState.Active : undefined} disabled={!canTestAndRun} onClick={() => setExpanded(!expanded)}><RiEqualizer2Line className="size-4" /></ActionButton>} />
                         <TooltipContent>
                           {t('panel.userInputField', { ns: 'workflow' })}
                         </TooltipContent>
diff --git a/web/app/components/app/configuration/hooks/__tests__/use-configuration.spec.tsx b/web/app/components/app/configuration/hooks/__tests__/use-configuration.spec.tsx
index 1ebe300325f..c9f10b71574 100644
--- a/web/app/components/app/configuration/hooks/__tests__/use-configuration.spec.tsx
+++ b/web/app/components/app/configuration/hooks/__tests__/use-configuration.spec.tsx
@@ -2,11 +2,12 @@
 import { act, renderHook, waitFor } from '@testing-library/react'
 import { updateAppModelConfig } from '@/service/apps'
 import { AppModeEnum, ModelModeType } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 import { useConfiguration } from '../use-configuration'
 
 const mockSetShowAccountSettingModal = vi.fn()
-const mockSetAppSidebarExpand = vi.fn()
 const mockSetShowAppConfigureFeaturesModal = vi.fn()
+const mockSetDetailSidebarMode = vi.fn()
 const mockHandleMultipleModelConfigsChange = vi.fn()
 const mockFetchCollectionList = vi.fn()
 const mockFetchAppDetailDirect = vi.fn()
@@ -27,6 +28,7 @@ let latestAdvancedPromptConfigOptions: AdvancedPromptConfigOptions | undefined
 let mockTempStopState: string[] = []
 let mockCurrentModelFeatures = ['vision']
 let mockCurrentModelMode = ModelModeType.chat
+let mockAppPermissionKeys: string[] = [AppACLPermission.Edit, AppACLPermission.ReleaseAndVersion]
 
 vi.mock('react-i18next', () => ({
   useTranslation: () => ({
@@ -53,6 +55,11 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     currentWorkspace: { id: 'workspace-1' },
     isLoadingCurrentWorkspace: false,
+    workspacePermissionKeys: ['app.create_and_management'],
+  }),
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: ['app.create_and_management'],
   }),
 }))
 
@@ -76,13 +83,17 @@ vi.mock('@/app/components/app/store', () => ({
         updated_at: 1710000000,
       },
       mode: AppModeEnum.CHAT,
+      permission_keys: mockAppPermissionKeys,
     },
-    setAppSidebarExpand: mockSetAppSidebarExpand,
     showAppConfigureFeaturesModal: false,
     setShowAppConfigureFeaturesModal: mockSetShowAppConfigureFeaturesModal,
   }),
 }))
 
+vi.mock('@/app/components/main-nav/storage', () => ({
+  useSetDetailSidebarMode: () => mockSetDetailSidebarMode,
+}))
+
 vi.mock('@/service/use-common', () => ({
   useFileUploadConfig: () => ({
     data: undefined,
@@ -176,6 +187,7 @@ describe('useConfiguration', () => {
     mockTempStopState = []
     mockCurrentModelFeatures = ['vision']
     mockCurrentModelMode = ModelModeType.chat
+    mockAppPermissionKeys = [AppACLPermission.Edit, AppACLPermission.ReleaseAndVersion]
     mockFetchCollectionList.mockResolvedValue([])
     mockFetchDatasets.mockResolvedValue({ data: [] })
     mockFetchAndMergeValidCompletionParams.mockResolvedValue({
@@ -278,6 +290,92 @@ describe('useConfiguration', () => {
     }))
   })
 
+  it('should block publishing when app release permission is missing', async () => {
+    mockAppPermissionKeys = [AppACLPermission.ViewLayout]
+
+    const { result } = renderHook(() => useConfiguration())
+
+    await waitFor(() => {
+      expect(result.current.showLoading).toBe(false)
+    })
+
+    expect(result.current.contextValue.readonly).toBe(true)
+    expect(result.current.contextValue.canTestAndRun).toBe(false)
+    expect(result.current.appPublisherProps.disabled).toBe(true)
+    expect(result.current.appPublisherProps.publishDisabled).toBe(true)
+
+    await act(async () => {
+      await result.current.appPublisherProps.onPublish!(undefined, result.current.featuresData)
+    })
+
+    expect(updateAppModelConfig).not.toHaveBeenCalled()
+  })
+
+  it('should allow test and run while keeping configuration readonly when only app test/run permission exists', async () => {
+    mockAppPermissionKeys = [AppACLPermission.TestAndRun]
+
+    const { result } = renderHook(() => useConfiguration())
+
+    await waitFor(() => {
+      expect(result.current.showLoading).toBe(false)
+    })
+
+    expect(result.current.contextValue.readonly).toBe(true)
+    expect(result.current.contextValue.canTestAndRun).toBe(true)
+    expect(result.current.appPublisherProps.disabled).toBe(true)
+    expect(result.current.appPublisherProps.publishDisabled).toBe(true)
+
+    await act(async () => {
+      await result.current.appPublisherProps.onPublish!(undefined, result.current.featuresData)
+    })
+
+    expect(updateAppModelConfig).not.toHaveBeenCalled()
+  })
+
+  it('should keep configuration editable but block publishing when only app edit permission exists', async () => {
+    mockAppPermissionKeys = [AppACLPermission.Edit]
+
+    const { result } = renderHook(() => useConfiguration())
+
+    await waitFor(() => {
+      expect(result.current.showLoading).toBe(false)
+    })
+
+    expect(result.current.contextValue.readonly).toBe(false)
+    expect(result.current.contextValue.canTestAndRun).toBe(false)
+    expect(result.current.appPublisherProps.disabled).toBe(true)
+    expect(result.current.appPublisherProps.publishDisabled).toBe(true)
+
+    await act(async () => {
+      await result.current.appPublisherProps.onPublish!(undefined, result.current.featuresData)
+    })
+
+    expect(updateAppModelConfig).not.toHaveBeenCalled()
+  })
+
+  it('should allow publishing with app release permission even when configuration is readonly', async () => {
+    mockAppPermissionKeys = [AppACLPermission.ReleaseAndVersion]
+
+    const { result } = renderHook(() => useConfiguration())
+
+    await waitFor(() => {
+      expect(result.current.showLoading).toBe(false)
+    })
+
+    expect(result.current.contextValue.readonly).toBe(true)
+    expect(result.current.contextValue.canTestAndRun).toBe(false)
+    expect(result.current.appPublisherProps.disabled).toBe(false)
+    expect(result.current.appPublisherProps.publishDisabled).toBe(false)
+
+    await act(async () => {
+      await result.current.appPublisherProps.onPublish!(undefined, result.current.featuresData)
+    })
+
+    expect(updateAppModelConfig).toHaveBeenCalledWith(expect.objectContaining({
+      url: '/apps/app-1/model-config',
+    }))
+  })
+
   it('should expose derived feature flags and imperative callbacks', async () => {
     mockCurrentModelFeatures = ['vision', 'document', 'audio', 'video']
     mockFetchAppDetailDirect.mockResolvedValueOnce({
@@ -371,7 +469,7 @@ describe('useConfiguration', () => {
     expect(mockSetShowAppConfigureFeaturesModal).toHaveBeenCalledWith(true)
     expect(mockFormattingChangedDispatcher).toHaveBeenCalled()
     expect(mockHandleMultipleModelConfigsChange).toHaveBeenCalled()
-    expect(mockSetAppSidebarExpand).toHaveBeenCalledWith('collapse')
+    expect(mockSetDetailSidebarMode).toHaveBeenCalledWith('collapse')
     expect(mockSetShowAccountSettingModal).toHaveBeenCalledWith({ payload: 'provider' })
     expect(mockSetConversationHistoriesRole).toHaveBeenCalledWith({
       assistant_prefix: 'bot',
diff --git a/web/app/components/app/configuration/hooks/use-configuration.ts b/web/app/components/app/configuration/hooks/use-configuration.ts
index 8b29f4db887..53f3364fa9f 100644
--- a/web/app/components/app/configuration/hooks/use-configuration.ts
+++ b/web/app/components/app/configuration/hooks/use-configuration.ts
@@ -41,6 +41,7 @@ import {
   useTextGenerationCurrentProviderAndModelAndModelList,
 } from '@/app/components/header/account-setting/model-provider-page/hooks'
 import { useIntegrationsSetting } from '@/app/components/header/account-setting/use-integrations-setting'
+import { useSetDetailSidebarMode } from '@/app/components/main-nav/storage'
 import { ANNOTATION_DEFAULT, DATASET_DEFAULT, DEFAULT_AGENT_SETTING, DEFAULT_CHAT_PROMPT_CONFIG, DEFAULT_COMPLETION_PROMPT_CONFIG } from '@/config'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
@@ -50,6 +51,7 @@ import { usePathname } from '@/next/navigation'
 import { updateAppModelConfig } from '@/service/apps'
 import { useFileUploadConfig } from '@/service/use-common'
 import { AppModeEnum, ModelModeType, Resolution, RETRIEVE_TYPE, TransferMethod } from '@/types/app'
+import { getAppACLCapabilities } from '@/utils/permission'
 import { supportFunctionCall } from '@/utils/tool-call'
 import { basePath } from '@/utils/var'
 import {
@@ -108,18 +110,24 @@ export type ConfigurationViewModel = {
 
 export const useConfiguration = (): ConfigurationViewModel => {
   const { t } = useTranslation()
-  const { isLoadingCurrentWorkspace, currentWorkspace } = useAppContext()
+  const { isLoadingCurrentWorkspace, currentWorkspace, userProfile, workspacePermissionKeys } = useAppContext()
   const openIntegrationsSetting = useIntegrationsSetting()
 
-  const { appDetail, showAppConfigureFeaturesModal, setAppSidebarExpand, setShowAppConfigureFeaturesModal } = useAppStore(useShallow(state => ({
+  const { appDetail, showAppConfigureFeaturesModal, setShowAppConfigureFeaturesModal } = useAppStore(useShallow(state => ({
     appDetail: state.appDetail,
-    setAppSidebarExpand: state.setAppSidebarExpand,
     showAppConfigureFeaturesModal: state.showAppConfigureFeaturesModal,
     setShowAppConfigureFeaturesModal: state.setShowAppConfigureFeaturesModal,
   })))
+  const setDetailSidebarMode = useSetDetailSidebarMode()
 
   const { data: fileUploadConfigResponse } = useFileUploadConfig()
   const latestPublishedAt = useMemo(() => appDetail?.model_config?.updated_at, [appDetail])
+  const appACLCapabilities = useMemo(() => getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId: userProfile?.id,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  }), [appDetail?.maintainer, appDetail?.permission_keys, userProfile?.id, workspacePermissionKeys])
+  const configurationReadonly = !appACLCapabilities.canEdit
   const [formattingChanged, setFormattingChanged] = useState(false)
   const [hasFetchedDetail, setHasFetchedDetail] = useState(false)
   const pathname = usePathname()
@@ -482,6 +490,9 @@ export const useConfiguration = (): ConfigurationViewModel => {
   ])
 
   const onPublish = useCallback(async (params?: AppPublisherPublishParams, features?: FeaturesData) => {
+    if (!appACLCapabilities.canReleaseAndVersion)
+      return
+
     const modelAndParameter = params && 'model' in params && 'provider' in params && 'parameters' in params
       ? params
       : undefined
@@ -515,6 +526,7 @@ export const useConfiguration = (): ConfigurationViewModel => {
       textToSpeechConfig,
     })(updateAppModelConfig, modelAndParameter, features)
   }, [
+    appACLCapabilities.canReleaseAndVersion,
     appId,
     chatPromptConfig,
     citationConfig,
@@ -557,8 +569,8 @@ export const useConfiguration = (): ConfigurationViewModel => {
         { id: `${Date.now()}-no-repeat`, model: '', provider: '', parameters: {} },
       ],
     )
-    setAppSidebarExpand('collapse')
-  }, [completionParamsState, handleMultipleModelConfigsChange, modelConfig.model_id, modelConfig.provider, setAppSidebarExpand])
+    setDetailSidebarMode('collapse')
+  }, [completionParamsState, handleMultipleModelConfigsChange, modelConfig.model_id, modelConfig.provider, setDetailSidebarMode])
 
   const onAgentSettingChange = useCallback((config: ModelConfig['agentConfig']) => {
     setModelConfig(produce(modelConfig, (draft: ModelConfig) => {
@@ -567,6 +579,8 @@ export const useConfiguration = (): ConfigurationViewModel => {
   }, [modelConfig, setModelConfig])
 
   const contextValue: DebugConfigurationValue = {
+    readonly: configurationReadonly,
+    canTestAndRun: appACLCapabilities.canTestAndRun,
     appId,
     isAPIKeySet,
     isTrailFinished: false,
@@ -644,7 +658,8 @@ export const useConfiguration = (): ConfigurationViewModel => {
 
   return {
     appPublisherProps: {
-      publishDisabled: cannotPublish,
+      disabled: !appACLCapabilities.canReleaseAndVersion,
+      publishDisabled: cannotPublish || !appACLCapabilities.canReleaseAndVersion,
       publishedAt: (latestPublishedAt || 0) * 1000,
       debugWithMultipleModel,
       multipleModelConfigs,
diff --git a/web/app/components/app/configuration/prompt-value-panel/__tests__/index.spec.tsx b/web/app/components/app/configuration/prompt-value-panel/__tests__/index.spec.tsx
index f935abcee6e..de12a55069c 100644
--- a/web/app/components/app/configuration/prompt-value-panel/__tests__/index.spec.tsx
+++ b/web/app/components/app/configuration/prompt-value-panel/__tests__/index.spec.tsx
@@ -40,8 +40,13 @@ vi.mock('@/app/components/app/store', () => ({
 
 // Use real store - global zustand mock will auto-reset between tests
 vi.mock('@/app/components/base/features/new-feature-panel/feature-bar', () => ({
-  default: ({ onFeatureBarClick }: { onFeatureBarClick: () => void }) => (
-    <button type="button" onClick={onFeatureBarClick}>
+  default: ({ onFeatureBarClick, disabled, hideEditEntrance }: { onFeatureBarClick: () => void, disabled?: boolean, hideEditEntrance?: boolean }) => (
+    <button
+      type="button"
+      disabled={disabled}
+      data-hide-edit-entrance={hideEditEntrance ? 'true' : 'false'}
+      onClick={onFeatureBarClick}
+    >
       feature bar
     </button>
   ),
@@ -126,6 +131,7 @@ const baseContextValue: any = {
     },
   },
   setInputs: mockSetInputs,
+  canTestAndRun: true,
   mode: AppModeEnum.COMPLETION,
   isAdvancedMode: false,
   completionPromptConfig: {
@@ -425,13 +431,42 @@ describe('PromptValuePanel', () => {
     expect(screen.getByTestId('bool-input-boolVar')).toBeInTheDocument()
   })
 
-  it('marks actions as disabled when readonly even if the prompt is runnable', () => {
+  it('keeps debug actions enabled when readonly configuration still has test/run permission', () => {
     renderPanel({
       context: {
         readonly: true,
+        canTestAndRun: true,
       },
     })
 
+    expect(screen.getByRole('button', { name: 'common.operation.clear' })).toHaveAttribute('data-disabled', 'false')
+    expect(screen.getByRole('button', { name: 'appDebug.inputs.run' })).toHaveAttribute('data-disabled', 'false')
+    expect(screen.getByRole('button', { name: 'feature bar' })).toBeDisabled()
+    expect(screen.getByRole('button', { name: 'feature bar' })).toHaveAttribute('data-hide-edit-entrance', 'true')
+  })
+
+  it('marks debug inputs and actions as disabled when test/run permission is missing even if configuration is editable', () => {
+    renderPanel({
+      context: {
+        readonly: false,
+        canTestAndRun: false,
+      },
+    })
+
+    expect(screen.getByPlaceholderText('Text Var')).toHaveAttribute('readonly')
+    expect(screen.getByRole('button', { name: 'common.operation.clear' })).toHaveAttribute('data-disabled', 'true')
+    expect(screen.getByRole('button', { name: 'appDebug.inputs.run' })).toHaveAttribute('data-disabled', 'true')
+  })
+
+  it('marks debug inputs and actions as disabled when configuration is readonly and test/run permission is missing', () => {
+    renderPanel({
+      context: {
+        readonly: true,
+        canTestAndRun: false,
+      },
+    })
+
+    expect(screen.getByPlaceholderText('Text Var')).toHaveAttribute('readonly')
     expect(screen.getByRole('button', { name: 'common.operation.clear' })).toHaveAttribute('data-disabled', 'true')
     expect(screen.getByRole('button', { name: 'appDebug.inputs.run' })).toHaveAttribute('data-disabled', 'true')
   })
diff --git a/web/app/components/app/configuration/prompt-value-panel/index.tsx b/web/app/components/app/configuration/prompt-value-panel/index.tsx
index f86f3828c3e..8c8a97c3f5a 100644
--- a/web/app/components/app/configuration/prompt-value-panel/index.tsx
+++ b/web/app/components/app/configuration/prompt-value-panel/index.tsx
@@ -40,7 +40,8 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
   onVisionFilesChange,
 }) => {
   const { t } = useTranslation()
-  const { readonly, modelModeType, modelConfig, setInputs, mode, isAdvancedMode, completionPromptConfig, chatPromptConfig } = useContext(ConfigContext)
+  const { readonly, canTestAndRun = false, modelModeType, modelConfig, setInputs, mode, isAdvancedMode, completionPromptConfig, chatPromptConfig } = useContext(ConfigContext)
+  const debugInputReadonly = !canTestAndRun
   const [userInputFieldCollapse, setUserInputFieldCollapse] = useState(false)
   const promptVariables = modelConfig.configs.prompt_variables.filter(({ key, name }) => {
     return key && key?.trim() && name && name?.trim()
@@ -86,6 +87,8 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
   }, [chatPromptConfig?.prompt, completionPromptConfig.prompt?.text, isAdvancedMode, mode, modelConfig.configs.prompt_template, modelModeType])
 
   const handleInputValueChange = (key: string, value: string | boolean) => {
+    if (debugInputReadonly)
+      return
     if (!(key in promptVariableObj))
       return
 
@@ -98,6 +101,8 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
   }
 
   const onClear = () => {
+    if (debugInputReadonly)
+      return
     const newInputs: Inputs = {}
     promptVariables.forEach((item) => {
       newInputs[item.key] = ''
@@ -146,7 +151,7 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
                         placeholder={name}
                         autoFocus={index === 0}
                         maxLength={max_length}
-                        readOnly={readonly}
+                        readOnly={debugInputReadonly}
                       />
                     )}
                     {type === 'paragraph' && (
@@ -156,13 +161,13 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
                         placeholder={name}
                         value={inputs[key] ? `${inputs[key]}` : ''}
                         onValueChange={(value) => { handleInputValueChange(key, value) }}
-                        readOnly={readonly}
+                        readOnly={debugInputReadonly}
                       />
                     )}
                     {type === 'select' && (
                       <Select
                         value={inputs[key] ? String(inputs[key]) : null}
-                        disabled={readonly}
+                        disabled={debugInputReadonly}
                         onValueChange={(nextValue) => {
                           if (!nextValue)
                             return
@@ -190,7 +195,7 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
                         placeholder={name}
                         autoFocus={index === 0}
                         maxLength={max_length}
-                        readOnly={readonly}
+                        readOnly={debugInputReadonly}
                       />
                     )}
                     {type === 'checkbox' && (
@@ -199,7 +204,7 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
                         value={!!inputs[key]}
                         required={required}
                         onChange={(value) => { handleInputValueChange(key, value) }}
-                        readonly={readonly}
+                        readonly={debugInputReadonly}
                       />
                     )}
                   </div>
@@ -218,7 +223,7 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
                       url: fileItem.url,
                       upload_file_id: fileItem.fileId,
                     })))}
-                    disabled={readonly}
+                    disabled={debugInputReadonly}
                   />
                 </div>
               </div>
@@ -227,14 +232,14 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
         )}
         {!userInputFieldCollapse && (
           <div className="flex justify-between border-t border-divider-subtle p-4 pt-3">
-            <Button className="w-[72px]" disabled={readonly} onClick={onClear}>{t('operation.clear', { ns: 'common' })}</Button>
+            <Button className="w-[72px]" disabled={debugInputReadonly} onClick={onClear}>{t('operation.clear', { ns: 'common' })}</Button>
             {canNotRun && (
               <Tooltip>
                 <TooltipTrigger
                   render={(
                     <Button
                       variant="primary"
-                      disabled={canNotRun || readonly}
+                      disabled={canNotRun || !canTestAndRun}
                       onClick={() => onSend?.()}
                       className="w-[96px]"
                     >
@@ -251,7 +256,7 @@ const PromptValuePanel: FC<IPromptValuePanelProps> = ({
             {!canNotRun && (
               <Button
                 variant="primary"
-                disabled={canNotRun || readonly}
+                disabled={canNotRun || !canTestAndRun}
                 onClick={() => onSend?.()}
                 className="w-[96px]"
               >
diff --git a/web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx b/web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx
index 93d9699088b..72e3ff2c19a 100644
--- a/web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx
+++ b/web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx
@@ -1,5 +1,5 @@
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
+import { NEED_REFRESH_APP_LIST_KEY } from '@/app/components/apps/storage'
 import { AppModeEnum } from '@/types/app'
 import Apps from '../index'
 
@@ -14,6 +14,8 @@ const mockToastError = vi.fn()
 const mockTrackCreateApp = vi.fn()
 const mockInvalidateAppList = vi.hoisted(() => vi.fn())
 let latestDebounceFn = () => {}
+let mockWorkspacePermissionKeys: string[] = ['app.create_and_management']
+let mockIsCurrentWorkspaceEditor = true
 
 vi.mock('ahooks', () => ({
   useDebounceFn: (fn: () => void) => {
@@ -26,7 +28,10 @@ vi.mock('ahooks', () => ({
   },
 }))
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({ isCurrentWorkspaceEditor: true }),
+  useAppContext: () => ({
+    isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor,
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
 }))
 vi.mock('nuqs', () => ({
   useQueryState: () => ['Recommended', vi.fn()],
@@ -46,14 +51,16 @@ vi.mock('@/app/components/app/type-selector', () => ({
   ),
 }))
 vi.mock('../../app-card', () => ({
-  default: ({ app, onCreate }: { app: { app: { name: string } }, onCreate: () => void }) => (
-    <div
+  default: ({ app, canCreate, onCreate }: { app: { app: { name: string } }, canCreate: boolean, onCreate: () => void }) => (
+    <button
+      type="button"
       data-testid="app-card"
       data-name={app.app.name}
+      data-can-create={canCreate ? 'true' : 'false'}
       onClick={onCreate}
     >
       {app.app.name}
-    </div>
+    </button>
   ),
 }))
 vi.mock('@/app/components/explore/create-app-modal', () => ({
@@ -172,6 +179,8 @@ describe('Apps', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     localStorage.clear()
+    mockWorkspacePermissionKeys = ['app.create_and_management']
+    mockIsCurrentWorkspaceEditor = true
     mockUseExploreAppList.mockReturnValue({
       data: defaultData,
       isLoading: false,
@@ -180,7 +189,11 @@ describe('Apps', () => {
       export_data: 'dsl',
       mode: AppModeEnum.CHAT,
     })
-    mockImportDSL.mockResolvedValue({ app_id: 'created-app-id' })
+    mockImportDSL.mockResolvedValue({
+      app_id: 'created-app-id',
+      app_mode: AppModeEnum.CHAT,
+      permission_keys: ['app.acl.view_layout'],
+    })
   })
 
   it('renders template cards when data is available', () => {
@@ -198,6 +211,24 @@ describe('Apps', () => {
     expect(screen.getByTestId('create-from-template-modal'))!.toBeInTheDocument()
   })
 
+  it('passes app.create_and_management permission to template cards even when user is not a workspace editor', () => {
+    mockIsCurrentWorkspaceEditor = false
+    mockWorkspacePermissionKeys = ['app.create_and_management']
+
+    render(<Apps />)
+
+    expect(screen.getAllByTestId('app-card')[0]).toHaveAttribute('data-can-create', 'true')
+  })
+
+  it('does not allow template creation when app.create_and_management permission is missing', () => {
+    mockIsCurrentWorkspaceEditor = true
+    mockWorkspacePermissionKeys = []
+
+    render(<Apps />)
+
+    expect(screen.getAllByTestId('app-card')[0]).toHaveAttribute('data-can-create', 'false')
+  })
+
   it('shows no template message when list is empty', () => {
     mockUseExploreAppList.mockReturnValueOnce({
       data: { allList: [], categories: [] },
@@ -260,9 +291,10 @@ describe('Apps', () => {
     expect(mockHandleCheckPluginDependencies).toHaveBeenCalledWith('created-app-id')
     expect(localStorage.getItem(NEED_REFRESH_APP_LIST_KEY)).toBe('1')
     expect(mockInvalidateAppList).toHaveBeenCalledTimes(1)
-    expect(mockGetRedirection).toHaveBeenCalledWith(true, {
+    expect(mockGetRedirection).toHaveBeenCalledWith({
       id: 'created-app-id',
       mode: AppModeEnum.CHAT,
+      permission_keys: ['app.acl.view_layout'],
     }, mockPush)
   })
 
diff --git a/web/app/components/app/create-app-dialog/app-list/index.tsx b/web/app/components/app/create-app-dialog/app-list/index.tsx
index d6bb85bbe69..04e759575b9 100644
--- a/web/app/components/app/create-app-dialog/app-list/index.tsx
+++ b/web/app/components/app/create-app-dialog/app-list/index.tsx
@@ -6,17 +6,16 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { toast } from '@langgenius/dify-ui/toast'
 import { RiRobot2Line } from '@remixicon/react'
 import { useDebounceFn } from 'ahooks'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import * as React from 'react'
 import { useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import AppTypeSelector from '@/app/components/app/type-selector'
+import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import Divider from '@/app/components/base/divider'
 import Input from '@/app/components/base/input'
 import Loading from '@/app/components/base/loading'
 import CreateAppModal from '@/app/components/explore/create-app-modal'
 import { usePluginDependencies } from '@/app/components/workflow/plugin-dependency/hooks'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
 import { useAppContext } from '@/context/app-context'
 import { DSLImportMode } from '@/models/app'
 import { useRouter } from '@/next/navigation'
@@ -27,6 +26,7 @@ import { useExploreAppList } from '@/service/use-explore'
 import { AppModeEnum } from '@/types/app'
 import { getRedirection } from '@/utils/app-redirection'
 import { trackCreateApp } from '@/utils/create-app-tracking'
+import { hasPermission } from '@/utils/permission'
 import AppCard from '../app-card'
 import Sidebar, { AppCategories, AppCategoryLabel } from './sidebar'
 
@@ -45,12 +45,13 @@ const Apps = ({
   onCreateFromBlank,
 }: AppsProps) => {
   const { t } = useTranslation()
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
+  const canCreateAppFromTemplate = hasPermission(workspacePermissionKeys, 'app.create_and_management')
   const { push } = useRouter()
   const invalidateAppList = useInvalidateAppList()
   const allCategoriesEn = AppCategories.RECOMMENDED
 
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
 
   const [keywords, setKeywords] = useState('')
   const [searchKeywords, setSearchKeywords] = useState('')
@@ -142,7 +143,8 @@ const Apps = ({
         await handleCheckPluginDependencies(app.app_id)
       setNeedRefresh('1')
       invalidateAppList()
-      getRedirection(isCurrentWorkspaceEditor, { id: app.app_id!, mode }, push)
+      if (app.app_id)
+        getRedirection({ id: app.app_id, mode: app.app_mode, permission_keys: app.permission_keys }, push)
     }
     catch {
       toast.error(t('newApp.appCreateFailed', { ns: 'app' }))
@@ -207,7 +209,7 @@ const Apps = ({
                   <AppCard
                     key={app.app_id}
                     app={app}
-                    canCreate={isCurrentWorkspaceEditor}
+                    canCreate={canCreateAppFromTemplate}
                     onCreate={() => {
                       setCurrApp(app)
                       setIsShowCreateModal(true)
diff --git a/web/app/components/app/create-app-modal/__tests__/index.spec.tsx b/web/app/components/app/create-app-modal/__tests__/index.spec.tsx
index eb3a2d15c15..47c8fb5c46c 100644
--- a/web/app/components/app/create-app-modal/__tests__/index.spec.tsx
+++ b/web/app/components/app/create-app-modal/__tests__/index.spec.tsx
@@ -1,9 +1,8 @@
 import type { App } from '@/types/app'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
+import { NEED_REFRESH_APP_LIST_KEY } from '@/app/components/apps/storage'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { useRouter } from '@/next/navigation'
@@ -13,8 +12,8 @@ import { getRedirection } from '@/utils/app-redirection'
 import { trackCreateApp } from '@/utils/create-app-tracking'
 import CreateAppModal from '../index'
 
-const hotkeyMocks = vi.hoisted(() => ({
-  handlers: new Map<string, () => void>(),
+const ahooksMocks = vi.hoisted(() => ({
+  keyPressHandlers: [] as Array<() => void>,
 }))
 const mockInvalidateAppList = vi.hoisted(() => vi.fn())
 
@@ -27,16 +26,12 @@ vi.mock('ahooks', () => ({
   },
   useHover: () => false,
 }))
-
-vi.mock('@tanstack/react-hotkeys', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@tanstack/react-hotkeys')>()
-  return {
-    ...actual,
-    useHotkey: (hotkey: string, handler: () => void) => {
-      hotkeyMocks.handlers.set(hotkey, handler)
-    },
-  }
-})
+vi.mock('@tanstack/react-hotkeys', () => ({
+  formatForDisplay: (key: string) => key,
+  useHotkey: (_hotkey: string, handler: () => void) => {
+    ahooksMocks.keyPressHandlers.push(handler)
+  },
+}))
 vi.mock('@/next/navigation', () => ({
   useRouter: vi.fn(),
   useParams: () => ({}),
@@ -124,7 +119,7 @@ describe('CreateAppModal', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
-    hotkeyMocks.handlers.clear()
+    ahooksMocks.keyPressHandlers.length = 0
     mockUseRouter.mockReturnValue({ push: mockPush } as unknown as ReturnType<typeof useRouter>)
     mockUseProviderContext.mockReturnValue({
       plan: {
@@ -136,7 +131,8 @@ describe('CreateAppModal', () => {
       enableBilling: true,
     } as unknown as ReturnType<typeof useProviderContext>)
     mockUseAppContext.mockReturnValue({
-      isCurrentWorkspaceEditor: true,
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: ['app.create_and_management'],
     } as unknown as ReturnType<typeof useAppContext>)
     mockSetItem.mockClear()
     Object.defineProperty(window, 'localStorage', {
@@ -153,7 +149,7 @@ describe('CreateAppModal', () => {
   })
 
   it('creates an app, notifies success, and fires callbacks', async () => {
-    const mockApp: Partial<App> = { id: 'app-1', mode: AppModeEnum.ADVANCED_CHAT }
+    const mockApp: Partial<App> = { id: 'app-1', mode: AppModeEnum.ADVANCED_CHAT, maintainer: 'user-1' }
     mockCreateApp.mockResolvedValue(mockApp as App)
     const { onClose, onSuccess } = renderModal()
 
@@ -176,7 +172,13 @@ describe('CreateAppModal', () => {
     expect(onClose).toHaveBeenCalled()
     await waitFor(() => expect(mockSetItem).toHaveBeenCalledWith(NEED_REFRESH_APP_LIST_KEY, '1'))
     expect(mockInvalidateAppList).toHaveBeenCalledTimes(1)
-    await waitFor(() => expect(mockGetRedirection).toHaveBeenCalledWith(true, mockApp, mockPush))
+    await waitFor(() =>
+      expect(mockGetRedirection).toHaveBeenCalledWith(mockApp, mockPush, {
+        currentUserId: 'user-1',
+        resourceMaintainer: 'user-1',
+        workspacePermissionKeys: ['app.create_and_management'],
+      }),
+    )
   })
 
   it('shows error toast when creation fails', async () => {
@@ -217,26 +219,18 @@ describe('CreateAppModal', () => {
     expect(onCreateFromTemplate).toHaveBeenCalled()
   })
 
-  it('renders the create shortcut with kbd primitives', () => {
-    renderModal()
-
-    const createButton = screen.getByRole('button', { name: /app\.newApp\.Create/ })
-    expect(createButton.querySelectorAll('kbd')).toHaveLength(2)
-  })
-
   it('creates a beginner chat app with the keyboard shortcut and selected icon style', async () => {
-    const user = userEvent.setup()
     mockCreateApp.mockResolvedValue({ id: 'chat-app', mode: AppModeEnum.CHAT } as App)
     renderModal()
 
     fireEvent.click(screen.getByText('app.newApp.forBeginners'))
     fireEvent.click(screen.getByText('app.types.chatbot'))
-    await user.click(screen.getByText('open-icon-picker'))
+    fireEvent.click(screen.getByText('open-icon-picker'))
     await waitFor(() => {
       expect(screen.getByPlaceholderText('Search emojis...')).toBeInTheDocument()
     })
-    await user.click(screen.getByRole('button', { name: '#E4FBCC' }))
-    await user.click(screen.getByRole('button', { name: /iconPicker\.ok/ }))
+    fireEvent.click(screen.getByRole('button', { name: '#E4FBCC' }))
+    fireEvent.click(screen.getByRole('button', { name: /iconPicker\.ok/ }))
     await waitFor(() => {
       expect(screen.queryByPlaceholderText('Search emojis...')).not.toBeInTheDocument()
     })
@@ -247,7 +241,7 @@ describe('CreateAppModal', () => {
       target: { value: 'Created from shortcut' },
     })
 
-    hotkeyMocks.handlers.get('Mod+Enter')?.()
+    ahooksMocks.keyPressHandlers.at(-1)?.()
 
     await waitFor(() => {
       expect(mockCreateApp).toHaveBeenCalledWith({
@@ -264,14 +258,13 @@ describe('CreateAppModal', () => {
   it('shows validation feedback when the keyboard shortcut runs without a name', () => {
     renderModal()
 
-    hotkeyMocks.handlers.get('Mod+Enter')?.()
+    ahooksMocks.keyPressHandlers.at(-1)?.()
 
     expect(mockToastError).toHaveBeenCalledWith('app.newApp.nameNotEmpty')
     expect(mockCreateApp).not.toHaveBeenCalled()
   })
 
   it('ignores the keyboard shortcut when the app quota is exhausted and closes the icon picker', async () => {
-    const user = userEvent.setup()
     mockUseProviderContext.mockReturnValue({
       plan: {
         type: AppModeEnum.ADVANCED_CHAT,
@@ -284,18 +277,18 @@ describe('CreateAppModal', () => {
 
     renderModal()
 
-    await user.click(screen.getByText('open-icon-picker'))
+    fireEvent.click(screen.getByText('open-icon-picker'))
     await waitFor(() => {
       expect(screen.getByPlaceholderText('Search emojis...')).toBeInTheDocument()
     })
-    await user.click(screen.getByRole('button', { name: /iconPicker\.cancel/ }))
+    fireEvent.click(screen.getByRole('button', { name: /iconPicker\.cancel/ }))
     await waitFor(() => {
       expect(screen.queryByPlaceholderText('Search emojis...')).not.toBeInTheDocument()
     })
 
     expect(screen.queryByPlaceholderText('Search emojis...')).not.toBeInTheDocument()
 
-    hotkeyMocks.handlers.get('Mod+Enter')?.()
+    ahooksMocks.keyPressHandlers.at(-1)?.()
 
     expect(mockCreateApp).not.toHaveBeenCalled()
   })
diff --git a/web/app/components/app/create-app-modal/index.tsx b/web/app/components/app/create-app-modal/index.tsx
index bd4f7ea40ec..ce3f11f24c3 100644
--- a/web/app/components/app/create-app-modal/index.tsx
+++ b/web/app/components/app/create-app-modal/index.tsx
@@ -10,15 +10,14 @@ import { toast } from '@langgenius/dify-ui/toast'
 import { RiArrowRightLine, RiArrowRightSLine, RiExchange2Fill } from '@remixicon/react'
 import { formatForDisplay, useHotkey } from '@tanstack/react-hotkeys'
 import { useDebounceFn } from 'ahooks'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useCallback, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import AppIcon from '@/app/components/base/app-icon'
 import Divider from '@/app/components/base/divider'
 import { BubbleTextMod, ChatBot, ListSparkle, Logic } from '@/app/components/base/icons/src/vender/solid/communication'
 import Input from '@/app/components/base/input'
 import AppsFull from '@/app/components/billing/apps-full-in-dialog'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import useTheme from '@/hooks/use-theme'
@@ -28,6 +27,7 @@ import { useInvalidateAppList } from '@/service/use-apps'
 import { AppModeEnum } from '@/types/app'
 import { getRedirection } from '@/utils/app-redirection'
 import { trackCreateApp } from '@/utils/create-app-tracking'
+import { hasPermission } from '@/utils/permission'
 import { basePath } from '@/utils/var'
 import AppIconPicker from '../../base/app-icon-picker'
 import { CreateAppDialogShell } from '../create-app-dialog-shell'
@@ -56,14 +56,18 @@ function CreateApp({ onClose, onSuccess, onCreateFromTemplate, defaultAppMode }:
 
   const { plan, enableBilling } = useProviderContext()
   const isAppsFull = (enableBilling && plan.usage.buildApps >= plan.total.buildApps)
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const { userProfile, workspacePermissionKeys } = useAppContext()
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
   const invalidateAppList = useInvalidateAppList()
 
   const isCreatingRef = useRef(false)
 
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
 
   const onCreate = useCallback(async () => {
+    if (!canCreateApp)
+      return
+
     if (!appMode) {
       toast.error(t('newApp.appTypeRequired', { ns: 'app' }))
       return
@@ -92,17 +96,21 @@ function CreateApp({ onClose, onSuccess, onCreateFromTemplate, defaultAppMode }:
       onClose()
       setNeedRefresh('1')
       invalidateAppList()
-      getRedirection(isCurrentWorkspaceEditor, app, push)
+      getRedirection(app, push, {
+        currentUserId: userProfile?.id,
+        resourceMaintainer: app.maintainer,
+        workspacePermissionKeys,
+      })
     }
     catch (error) {
       toast.error(error instanceof Error ? error.message : t('newApp.appCreateFailed', { ns: 'app' }))
     }
     isCreatingRef.current = false
-  }, [name, t, appMode, appIcon, description, onSuccess, onClose, push, isCurrentWorkspaceEditor, setNeedRefresh, invalidateAppList])
+  }, [canCreateApp, name, t, appMode, appIcon, description, onSuccess, onClose, push, userProfile?.id, workspacePermissionKeys, setNeedRefresh, invalidateAppList])
 
   const { run: handleCreateApp } = useDebounceFn(onCreate, { wait: 300 })
   useHotkey('Mod+Enter', () => {
-    if (isAppsFull)
+    if (isAppsFull || !canCreateApp)
       return
     handleCreateApp()
   }, {
@@ -272,7 +280,7 @@ function CreateApp({ onClose, onSuccess, onCreateFromTemplate, defaultAppMode }:
               </button>
               <div className="flex gap-2">
                 <Button onClick={onClose}>{t('newApp.Cancel', { ns: 'app' })}</Button>
-                <Button disabled={isAppsFull || !name} className="gap-1" variant="primary" onClick={handleCreateApp}>
+                <Button disabled={!canCreateApp || isAppsFull || !name} className="gap-1" variant="primary" onClick={handleCreateApp}>
                   <span>{t('newApp.Create', { ns: 'app' })}</span>
                   <KbdGroup>
                     {['Mod', 'Enter'].map(key => (
diff --git a/web/app/components/app/create-from-dsl-modal/__tests__/index.spec.tsx b/web/app/components/app/create-from-dsl-modal/__tests__/index.spec.tsx
index 55eeda20de0..45bb635edcb 100644
--- a/web/app/components/app/create-from-dsl-modal/__tests__/index.spec.tsx
+++ b/web/app/components/app/create-from-dsl-modal/__tests__/index.spec.tsx
@@ -6,7 +6,7 @@ import {
   screen,
   waitFor,
 } from '@testing-library/react'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
+import { NEED_REFRESH_APP_LIST_KEY } from '@/app/components/apps/storage'
 import { DSLImportMode, DSLImportStatus } from '@/models/app'
 import { AppModeEnum } from '@/types/app'
 import CreateFromDSLModal, { CreateFromDSLModalTab } from '../index'
@@ -208,6 +208,7 @@ describe('CreateFromDSLModal', () => {
       status: DSLImportStatus.COMPLETED,
       app_id: 'app-1',
       app_mode: AppModeEnum.CHAT,
+      permission_keys: ['app.acl.view_layout'],
     })
 
     render(
@@ -244,8 +245,7 @@ describe('CreateFromDSLModal', () => {
     expect(mockInvalidateAppList).toHaveBeenCalledTimes(1)
     expect(mockHandleCheckPluginDependencies).toHaveBeenCalledWith('app-1')
     expect(mockGetRedirection).toHaveBeenCalledWith(
-      true,
-      { id: 'app-1', mode: 'chat' },
+      { id: 'app-1', mode: 'chat', permission_keys: ['app.acl.view_layout'] },
       mockPush,
     )
   })
@@ -256,6 +256,7 @@ describe('CreateFromDSLModal', () => {
       status: DSLImportStatus.COMPLETED_WITH_WARNINGS,
       app_id: 'app-2',
       app_mode: AppModeEnum.CHAT,
+      permission_keys: ['app.acl.view_layout'],
     })
 
     render(
@@ -322,6 +323,7 @@ describe('CreateFromDSLModal', () => {
       status: DSLImportStatus.COMPLETED,
       app_id: 'app-3',
       app_mode: AppModeEnum.WORKFLOW,
+      permission_keys: ['app.acl.view_layout'],
     })
 
     render(
@@ -450,6 +452,7 @@ describe('CreateFromDSLModal', () => {
       status: DSLImportStatus
       app_id: string
       app_mode: string
+      permission_keys?: string[]
     }) => void
     mockImportDSL.mockImplementationOnce(
       () =>
@@ -478,6 +481,7 @@ describe('CreateFromDSLModal', () => {
         status: DSLImportStatus.COMPLETED,
         app_id: 'app-1',
         app_mode: AppModeEnum.CHAT,
+        permission_keys: ['app.acl.view_layout'],
       })
     })
 
@@ -498,6 +502,7 @@ describe('CreateFromDSLModal', () => {
       status: DSLImportStatus.COMPLETED,
       app_id: 'app-shortcut',
       app_mode: 'chat',
+      permission_keys: ['app.acl.view_layout'],
     })
 
     render(
diff --git a/web/app/components/app/create-from-dsl-modal/index.tsx b/web/app/components/app/create-from-dsl-modal/index.tsx
index 103d71840b3..c44e6f3769c 100644
--- a/web/app/components/app/create-from-dsl-modal/index.tsx
+++ b/web/app/components/app/create-from-dsl-modal/index.tsx
@@ -8,14 +8,12 @@ import { Kbd, KbdGroup } from '@langgenius/dify-ui/kbd'
 import { toast } from '@langgenius/dify-ui/toast'
 import { formatForDisplay, useHotkey } from '@tanstack/react-hotkeys'
 import { useDebounceFn } from 'ahooks'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import Input from '@/app/components/base/input'
 import AppsFull from '@/app/components/billing/apps-full-in-dialog'
 import { usePluginDependencies } from '@/app/components/workflow/plugin-dependency/hooks'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
-import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import {
   DSLImportMode,
@@ -56,7 +54,7 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
   const [versions, setVersions] = useState<{ importedVersion: string, systemVersion: string }>()
   const [importId, setImportId] = useState<string>()
   const { handleCheckPluginDependencies } = usePluginDependencies()
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
 
   const readFile = useCallback((file: File) => {
     const reader = new FileReader()
@@ -75,7 +73,6 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
       setFileContent('')
   }, [readFile])
 
-  const { isCurrentWorkspaceEditor } = useAppContext()
   const { plan, enableBilling } = useProviderContext()
   const isAppsFull = (enableBilling && plan.usage.buildApps >= plan.total.buildApps)
   const invalidateAppList = useInvalidateAppList()
@@ -113,7 +110,7 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
 
       if (!response)
         return
-      const { id, status, app_id, app_mode, imported_dsl_version, current_dsl_version } = response
+      const { id, status, app_id, app_mode, imported_dsl_version, current_dsl_version, permission_keys } = response
       if (status === DSLImportStatus.COMPLETED || status === DSLImportStatus.COMPLETED_WITH_WARNINGS) {
         trackCreateApp({ source: 'studio_upload', appMode: app_mode })
 
@@ -130,9 +127,10 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
         })
         setNeedRefresh('1')
         invalidateAppList()
-        if (app_id)
+        if (app_id) {
           await handleCheckPluginDependencies(app_id)
-        getRedirection(isCurrentWorkspaceEditor, { id: app_id!, mode: app_mode }, push)
+          getRedirection({ id: app_id, mode: app_mode, permission_keys }, push)
+        }
       }
       else if (status === DSLImportStatus.PENDING) {
         setVersions({
@@ -171,7 +169,7 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
         import_id: importId,
       })
 
-      const { status, app_id, app_mode } = response
+      const { status, app_id, app_mode, permission_keys } = response
 
       if (status === DSLImportStatus.COMPLETED) {
         trackCreateApp({ source: 'studio_upload', appMode: app_mode })
@@ -185,7 +183,8 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
           await handleCheckPluginDependencies(app_id)
         setNeedRefresh('1')
         invalidateAppList()
-        getRedirection(isCurrentWorkspaceEditor, { id: app_id!, mode: app_mode }, push)
+        if (app_id)
+          getRedirection({ id: app_id, mode: app_mode, permission_keys }, push)
       }
       else if (status === DSLImportStatus.FAILED) {
         toast.error(response.error || t('newApp.appCreateFailed', { ns: 'app' }))
diff --git a/web/app/components/app/duplicate-modal/__tests__/index.spec.tsx b/web/app/components/app/duplicate-modal/__tests__/index.spec.tsx
index 9d68c43d245..76b8274e16c 100644
--- a/web/app/components/app/duplicate-modal/__tests__/index.spec.tsx
+++ b/web/app/components/app/duplicate-modal/__tests__/index.spec.tsx
@@ -32,6 +32,37 @@ vi.mock('@/app/components/base/app-icon', () => ({
   ),
 }))
 
+vi.mock('@/app/components/base/app-icon-picker', () => ({
+  default: ({
+    onOpenChange,
+    onSelect,
+  }: {
+    onOpenChange: (open: boolean) => void
+    onSelect: (payload: { type: 'emoji', icon: string, background: string }) => void
+  }) => {
+    let selectedBackground = '#FFEAD5'
+    return (
+      <div>
+        <input placeholder="Search emojis..." />
+        <button type="button" onClick={() => {}}>
+          <em-emoji />
+        </button>
+        <button type="button" aria-label="#E4FBCC" onClick={() => { selectedBackground = '#E4FBCC' }} />
+        <button
+          type="button"
+          onClick={() => {
+            onSelect({ type: 'emoji', icon: '🤖', background: selectedBackground })
+            onOpenChange(false)
+          }}
+        >
+          iconPicker.ok
+        </button>
+        <button type="button" onClick={() => onOpenChange(false)}>iconPicker.cancel</button>
+      </div>
+    )
+  },
+}))
+
 describe('DuplicateAppModal', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -88,8 +119,8 @@ describe('DuplicateAppModal', () => {
     await waitFor(() => {
       expect(screen.getByPlaceholderText('Search emojis...')).toBeInTheDocument()
     })
-    await user.click(screen.getByRole('button', { name: '#E4FBCC' }))
-    await user.click(screen.getByRole('button', { name: /iconPicker\.ok/ }))
+    await user.click(screen.getByRole('button', { name: '#E4FBCC', hidden: true }))
+    await user.click(screen.getByRole('button', { name: /iconPicker\.ok/, hidden: true }))
     await waitFor(() => {
       expect(screen.queryByPlaceholderText('Search emojis...')).not.toBeInTheDocument()
     })
@@ -145,7 +176,19 @@ describe('DuplicateAppModal', () => {
     await waitFor(() => {
       expect(screen.getByPlaceholderText('Search emojis...')).toBeInTheDocument()
     })
-    await user.click(screen.getByRole('button', { name: /iconPicker\.cancel/ }))
+    const emojiButton = document.querySelector('em-emoji')?.closest('button')
+    expect(emojiButton).toBeTruthy()
+    await user.click(emojiButton!)
+    await user.click(screen.getByRole('button', { name: '#E4FBCC', hidden: true }))
+    await user.click(screen.getByRole('button', { name: /iconPicker\.ok/, hidden: true }))
+    await waitFor(() => {
+      expect(screen.queryByPlaceholderText('Search emojis...')).not.toBeInTheDocument()
+    })
+    await user.click(screen.getByText('open-icon-picker'))
+    await waitFor(() => {
+      expect(screen.getByPlaceholderText('Search emojis...')).toBeInTheDocument()
+    })
+    await user.click(screen.getByRole('button', { name: /iconPicker\.cancel/, hidden: true }))
     await waitFor(() => {
       expect(screen.queryByPlaceholderText('Search emojis...')).not.toBeInTheDocument()
     })
@@ -153,9 +196,9 @@ describe('DuplicateAppModal', () => {
 
     expect(onConfirm).toHaveBeenCalledWith(expect.objectContaining({
       name: 'Image App',
-      icon_type: 'image',
-      icon: 'original-file',
-      icon_background: undefined,
+      icon_type: 'emoji',
+      icon: expect.any(String),
+      icon_background: '#E4FBCC',
     }))
   })
 })
diff --git a/web/app/components/app/log/empty-element.tsx b/web/app/components/app/log/empty-element.tsx
index 7b89ac40604..232e913b942 100644
--- a/web/app/components/app/log/empty-element.tsx
+++ b/web/app/components/app/log/empty-element.tsx
@@ -3,6 +3,7 @@ import type { FC, SVGProps } from 'react'
 import type { App } from '@/types/app'
 import * as React from 'react'
 import { Trans, useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import Link from '@/next/link'
 import { AppModeEnum } from '@/types/app'
 import { getRedirectionPath } from '@/utils/app-redirection'
@@ -18,6 +19,8 @@ const ThreeDotsIcon = ({ className }: SVGProps<SVGElement>) => {
 
 const EmptyElement: FC<{ appDetail: App }> = ({ appDetail }) => {
   const { t } = useTranslation()
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
 
   const getWebAppType = (appType: AppModeEnum) => {
     if (appType !== AppModeEnum.COMPLETION && appType !== AppModeEnum.WORKFLOW)
@@ -37,8 +40,24 @@ const EmptyElement: FC<{ appDetail: App }> = ({ appDetail }) => {
             i18nKey="table.empty.element.content"
             ns="appLog"
             components={{
-              shareLink: <Link href={`${appDetail.site.app_base_url}${basePath}/${getWebAppType(appDetail.mode)}/${appDetail.site.access_token}`} className="text-util-colors-blue-blue-600" target="_blank" rel="noopener noreferrer" />,
-              testLink: <Link href={getRedirectionPath(true, appDetail)} className="text-util-colors-blue-blue-600" />,
+              shareLink: (
+                <Link
+                  href={`${appDetail.site.app_base_url}${basePath}/${getWebAppType(appDetail.mode)}/${appDetail.site.access_token}`}
+                  className="text-util-colors-blue-blue-600"
+                  target="_blank"
+                  rel="noopener noreferrer"
+                />
+              ),
+              testLink: (
+                <Link
+                  href={getRedirectionPath(appDetail, {
+                    currentUserId,
+                    resourceMaintainer: appDetail.maintainer,
+                    workspacePermissionKeys,
+                  })}
+                  className="text-util-colors-blue-blue-600"
+                />
+              ),
             }}
           />
         </div>
diff --git a/web/app/components/app/overview/__tests__/app-card-sections.spec.tsx b/web/app/components/app/overview/__tests__/app-card-sections.spec.tsx
index d3f83d5d9cf..0e58a14781b 100644
--- a/web/app/components/app/overview/__tests__/app-card-sections.spec.tsx
+++ b/web/app/components/app/overview/__tests__/app-card-sections.spec.tsx
@@ -26,7 +26,7 @@ vi.mock('../customize', () => ({
 }))
 
 vi.mock('../../app-access-control', () => ({
-  default: ({ onClose, onConfirm }: { onClose: () => void, onConfirm: () => void }) => (
+  AccessControl: ({ onClose, onConfirm }: { onClose: () => void, onConfirm: () => void }) => (
     <div data-testid="access-control">
       <button type="button" onClick={onClose}>close-access</button>
       <button type="button" onClick={onConfirm}>confirm-access</button>
@@ -149,7 +149,7 @@ describe('app-card-sections', () => {
         isApp
         accessibleUrl="https://example.com/apps/demo"
         showConfirmDelete
-        isCurrentWorkspaceManager
+        canRegenerateUrl
         genLoading={false}
         onRegenerate={onRegenerate}
         onShowRegenerateConfirm={vi.fn()}
diff --git a/web/app/components/app/overview/__tests__/app-card-utils.spec.ts b/web/app/components/app/overview/__tests__/app-card-utils.spec.ts
index 0a6d7f7dd75..11c2dd54bb1 100644
--- a/web/app/components/app/overview/__tests__/app-card-utils.spec.ts
+++ b/web/app/components/app/overview/__tests__/app-card-utils.spec.ts
@@ -153,8 +153,8 @@ describe('app-card-utils', () => {
       appInfo: baseAppInfo,
       cardType: 'webapp',
       currentWorkflow: null,
-      isCurrentWorkspaceEditor: true,
-      isCurrentWorkspaceManager: true,
+      canManageWebApp: true,
+      canManageApi: true,
     })
 
     expect(state.isApp).toBe(true)
@@ -168,8 +168,8 @@ describe('app-card-utils', () => {
       appInfo: { ...baseAppInfo, mode: AppModeEnum.WORKFLOW },
       cardType: 'webapp',
       currentWorkflow: null,
-      isCurrentWorkspaceEditor: true,
-      isCurrentWorkspaceManager: true,
+      canManageWebApp: true,
+      canManageApi: true,
     })
     expect(unpublishedState.appUnpublished).toBe(true)
     expect(unpublishedState.toggleDisabled).toBe(true)
@@ -182,8 +182,8 @@ describe('app-card-utils', () => {
           nodes: [{ data: { type: BlockEnum.Answer } }],
         },
       },
-      isCurrentWorkspaceEditor: true,
-      isCurrentWorkspaceManager: true,
+      canManageWebApp: true,
+      canManageApi: true,
     })
     expect(missingStartState.missingStartNode).toBe(true)
     expect(missingStartState.runningStatus).toBe(false)
@@ -210,13 +210,13 @@ describe('app-card-utils', () => {
     expect(getAppCardOperationKeys({
       cardType: 'api',
       appMode: AppModeEnum.COMPLETION,
-      isCurrentWorkspaceEditor: true,
+      canManageSettings: true,
     })).toEqual(['develop'])
 
     expect(getAppCardOperationKeys({
       cardType: 'webapp',
       appMode: AppModeEnum.CHAT,
-      isCurrentWorkspaceEditor: false,
+      canManageSettings: false,
     })).toEqual(['launch', 'embedded', 'customize'])
   })
 
diff --git a/web/app/components/app/overview/__tests__/app-card.spec.tsx b/web/app/components/app/overview/__tests__/app-card.spec.tsx
index 1e9ba71a4ff..bd801d71410 100644
--- a/web/app/components/app/overview/__tests__/app-card.spec.tsx
+++ b/web/app/components/app/overview/__tests__/app-card.spec.tsx
@@ -5,6 +5,7 @@ import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features
 import { InputVarType } from '@/app/components/workflow/types'
 import { AccessMode } from '@/models/access-control'
 import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 import { basePath } from '@/utils/var'
 import AppCard from '../app-card'
 
@@ -12,7 +13,6 @@ const render = (ui: ReactElement) => renderWithSystemFeatures(ui, {
   systemFeatures: { webapp_auth: { enabled: true } },
 })
 
-const mockFetchAppDetailDirect = vi.fn()
 const mockPush = vi.fn()
 const mockSetAppDetail = vi.fn()
 const mockOnChangeStatus = vi.fn()
@@ -29,16 +29,6 @@ vi.mock('react-i18next', () => ({
   Trans: ({ i18nKey }: { i18nKey?: string }) => i18nKey ?? null,
 }))
 
-vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: true,
-    isCurrentWorkspaceEditor: true,
-    langGeniusVersionInfo: {
-      current_env: 'TESTING',
-    },
-  }),
-}))
-
 vi.mock('@/context/i18n', () => ({
   useDocLink: () => (path: string) => `https://docs.example.com${path}`,
 }))
@@ -63,16 +53,12 @@ vi.mock('@/service/use-workflow', () => ({
   }),
 }))
 
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useAppWhiteListSubjects: () => ({
     data: mockAccessSubjects,
   }),
 }))
 
-vi.mock('@/service/apps', () => ({
-  fetchAppDetailDirect: (...args: unknown[]) => mockFetchAppDetailDirect(...args),
-}))
-
 vi.mock('@/app/components/develop/secret-key/secret-key-button', () => ({
   default: ({ appId }: { appId: string }) => <div data-testid="secret-key-button">{appId}</div>,
 }))
@@ -90,7 +76,7 @@ vi.mock('../customize', () => ({
 }))
 
 vi.mock('../../app-access-control', () => ({
-  default: ({ onConfirm, onClose }: { onConfirm: () => Promise<void>, onClose: () => void }) => (
+  AccessControl: ({ onConfirm, onClose }: { onConfirm: () => Promise<void>, onClose: () => void }) => (
     <div data-testid="access-control-modal">
       <button onClick={() => void onConfirm()}>confirm-access-control</button>
       <button onClick={onClose}>close-access-control</button>
@@ -113,6 +99,7 @@ describe('AppCard', () => {
     icon: 'app-icon',
     icon_background: '#fff',
     api_base_url: 'https://api.example.com',
+    permission_keys: [AppACLPermission.Edit, AppACLPermission.ReleaseAndVersion],
     site: {
       app_base_url: 'https://example.com',
       access_token: 'access-token',
@@ -138,10 +125,6 @@ describe('AppCard', () => {
       groups: [],
       members: [],
     }
-    mockFetchAppDetailDirect.mockResolvedValue({
-      id: 'app-1',
-      access_mode: AccessMode.PUBLIC,
-    })
   })
 
   it('should open the published webapp when launch is clicked', () => {
@@ -344,6 +327,21 @@ describe('AppCard', () => {
     expect(screen.getByText('publishApp.notSet')).toBeInTheDocument()
   })
 
+  it('should hide the access-control section when release permission is missing', () => {
+    render(
+      <AppCard
+        appInfo={{
+          ...appInfo,
+          permission_keys: [AppACLPermission.Edit],
+        }}
+        onChangeStatus={mockOnChangeStatus}
+      />,
+    )
+
+    expect(screen.queryByText('publishApp.title')).not.toBeInTheDocument()
+    expect(screen.queryByText('publishApp.notSet')).not.toBeInTheDocument()
+  })
+
   it('should hide the address and operation sections for unpublished workflows', () => {
     mockWorkflow = null
 
@@ -400,13 +398,14 @@ describe('AppCard', () => {
   })
 
   it('should refresh app detail after confirming access control changes', async () => {
-    render(
+    const { queryClient } = render(
       <AppCard
         appInfo={appInfo}
         onChangeStatus={mockOnChangeStatus}
         onGenerateCode={mockOnGenerateCode}
       />,
     )
+    const invalidateQueriesSpy = vi.spyOn(queryClient, 'invalidateQueries').mockResolvedValue()
 
     fireEvent.click(screen.getByText('publishApp.notSet'))
     expect(screen.getByTestId('access-control-modal')).toBeInTheDocument()
@@ -414,11 +413,7 @@ describe('AppCard', () => {
     fireEvent.click(screen.getByText('confirm-access-control'))
 
     await waitFor(() => {
-      expect(mockFetchAppDetailDirect).toHaveBeenCalledWith({ url: '/apps', id: 'app-1' })
-      expect(mockSetAppDetail).toHaveBeenCalledWith({
-        id: 'app-1',
-        access_mode: AccessMode.PUBLIC,
-      })
+      expect(invalidateQueriesSpy).toHaveBeenCalledWith({ queryKey: ['apps', 'detail', 'app-1'] })
     })
   })
 
@@ -472,14 +467,14 @@ describe('AppCard', () => {
 
   it('should report refresh failures from access control updates', async () => {
     const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => { })
-    mockFetchAppDetailDirect.mockRejectedValueOnce(new Error('refresh failed'))
 
-    render(
+    const { queryClient } = render(
       <AppCard
         appInfo={appInfo}
         onChangeStatus={mockOnChangeStatus}
       />,
     )
+    vi.spyOn(queryClient, 'invalidateQueries').mockRejectedValueOnce(new Error('refresh failed'))
 
     fireEvent.click(screen.getByText('publishApp.notSet'))
     fireEvent.click(screen.getByText('confirm-access-control'))
diff --git a/web/app/components/app/overview/__tests__/toggle-logic.test.ts b/web/app/components/app/overview/__tests__/toggle-logic.test.ts
index ee4c650d1f7..9127dca1040 100644
--- a/web/app/components/app/overview/__tests__/toggle-logic.test.ts
+++ b/web/app/components/app/overview/__tests__/toggle-logic.test.ts
@@ -50,8 +50,8 @@ describe('app-card-utils', () => {
         appInfo: baseAppInfo,
         cardType: 'webapp',
         currentWorkflow: null,
-        isCurrentWorkspaceEditor: true,
-        isCurrentWorkspaceManager: true,
+        canManageWebApp: true,
+        canManageApi: true,
       })
 
       expect(state.appUnpublished).toBe(true)
@@ -70,8 +70,8 @@ describe('app-card-utils', () => {
             nodes: [{ data: { type: 'start' } }],
           },
         },
-        isCurrentWorkspaceEditor: true,
-        isCurrentWorkspaceManager: true,
+        canManageWebApp: true,
+        canManageApi: true,
       })
 
       expect(state.appUnpublished).toBe(false)
@@ -87,7 +87,7 @@ describe('app-card-utils', () => {
       expect(getAppCardOperationKeys({
         cardType: 'webapp',
         appMode: AppModeEnum.CHAT,
-        isCurrentWorkspaceEditor: true,
+        canManageSettings: true,
       })).toEqual(['launch', 'embedded', 'customize', 'settings'])
     })
 
@@ -95,7 +95,7 @@ describe('app-card-utils', () => {
       expect(getAppCardOperationKeys({
         cardType: 'api',
         appMode: AppModeEnum.COMPLETION,
-        isCurrentWorkspaceEditor: false,
+        canManageSettings: false,
       })).toEqual(['develop'])
     })
   })
diff --git a/web/app/components/app/overview/__tests__/trigger-card.spec.tsx b/web/app/components/app/overview/__tests__/trigger-card.spec.tsx
index 7e183a3b158..e7a838d0e6f 100644
--- a/web/app/components/app/overview/__tests__/trigger-card.spec.tsx
+++ b/web/app/components/app/overview/__tests__/trigger-card.spec.tsx
@@ -1,6 +1,7 @@
 import type { AppDetailResponse } from '@/models/app'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 import TriggerCard from '../trigger-card'
 
 vi.mock('react-i18next', () => ({
@@ -17,6 +18,10 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceEditor: true,
   }),
+  useSelector: <T,>(selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => T) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
+  }),
 }))
 
 vi.mock('@/context/i18n', () => ({
@@ -79,7 +84,8 @@ vi.mock('@langgenius/dify-ui/switch', () => ({
       data-testid="switch"
       data-checked={checked ? 'true' : 'false'}
       data-disabled={disabled ? 'true' : 'false'}
-      onClick={() => onCheckedChange(!checked)}
+      disabled={disabled}
+      onClick={() => !disabled && onCheckedChange(!checked)}
     >
       Switch
     </button>
@@ -99,6 +105,7 @@ describe('TriggerCard', () => {
     updated_at: Date.now(),
     enable_site: true,
     enable_api: true,
+    permission_keys: [AppACLPermission.Edit],
   } as AppDetailResponse
 
   const mockOnToggleResult = vi.fn()
@@ -341,7 +348,7 @@ describe('TriggerCard', () => {
     })
   })
 
-  describe('Editor Permissions', () => {
+  describe('App ACL Permissions', () => {
     it('should render switches for triggers', () => {
       mockTriggers = [
         {
@@ -358,6 +365,32 @@ describe('TriggerCard', () => {
       const switchBtn = screen.getByTestId('switch')
       expect(switchBtn).toBeInTheDocument()
     })
+
+    it('should disable switches and skip updates without app edit permission', () => {
+      mockTriggers = [
+        {
+          id: 'trigger-1',
+          node_id: 'node-1',
+          title: 'Test Trigger',
+          trigger_type: 'trigger-webhook',
+          status: 'enabled',
+        },
+      ]
+      const appInfoWithoutEditPermission = {
+        ...mockAppInfo,
+        permission_keys: [],
+      } as AppDetailResponse
+
+      render(<TriggerCard appInfo={appInfoWithoutEditPermission} onToggleResult={mockOnToggleResult} />)
+
+      const switchBtn = screen.getByTestId('switch')
+      expect(switchBtn).toHaveAttribute('data-disabled', 'true')
+
+      fireEvent.click(switchBtn)
+
+      expect(mockUpdateTriggerStatus).not.toHaveBeenCalled()
+      expect(mockSetTriggerStatus).not.toHaveBeenCalled()
+    })
   })
 
   describe('Status Sync', () => {
diff --git a/web/app/components/app/overview/app-card-sections.tsx b/web/app/components/app/overview/app-card-sections.tsx
index 00fa0cf4afc..b67808362d4 100644
--- a/web/app/components/app/overview/app-card-sections.tsx
+++ b/web/app/components/app/overview/app-card-sections.tsx
@@ -37,7 +37,7 @@ import Divider from '@/app/components/base/divider'
 import ShareQRCode from '@/app/components/base/qrcode'
 import { AccessMode } from '@/models/access-control'
 import { AppModeEnum } from '@/types/app'
-import AccessControl from '../app-access-control'
+import { AccessControl } from '../app-access-control'
 import CustomizeModal from './customize'
 import EmbeddedModal from './embedded'
 import SettingsModal from './settings'
@@ -226,7 +226,7 @@ export const AppCardUrlSection = ({
   isApp,
   accessibleUrl,
   showConfirmDelete,
-  isCurrentWorkspaceManager,
+  canRegenerateUrl,
   genLoading,
   onRegenerate,
   onShowRegenerateConfirm,
@@ -236,7 +236,7 @@ export const AppCardUrlSection = ({
   isApp: boolean
   accessibleUrl: string
   showConfirmDelete: boolean
-  isCurrentWorkspaceManager: boolean
+  canRegenerateUrl: boolean
   genLoading: boolean
   onRegenerate: () => void
   onShowRegenerateConfirm: () => void
@@ -277,7 +277,7 @@ export const AppCardUrlSection = ({
           </AlertDialogActions>
         </AlertDialogContent>
       </AlertDialog>
-      {isApp && isCurrentWorkspaceManager && (
+      {isApp && canRegenerateUrl && (
         <MaybeTooltip content={t('overview.appInfo.regenerate', { ns: 'appOverview' }) || ''}>
           <div
             className="size-6 cursor-pointer rounded-md hover:bg-state-base-hover"
diff --git a/web/app/components/app/overview/app-card-utils.ts b/web/app/components/app/overview/app-card-utils.ts
index c08fa73b18a..9475da4300a 100644
--- a/web/app/components/app/overview/app-card-utils.ts
+++ b/web/app/components/app/overview/app-card-utils.ts
@@ -221,22 +221,22 @@ export const getAppCardDisplayState = ({
   appInfo,
   cardType,
   currentWorkflow,
-  isCurrentWorkspaceEditor,
-  isCurrentWorkspaceManager,
+  canManageWebApp,
+  canManageApi,
   triggerModeDisabled = false,
 }: {
   appInfo: AppInfo
   cardType: OverviewCardType
   currentWorkflow: WorkflowLike
-  isCurrentWorkspaceEditor: boolean
-  isCurrentWorkspaceManager: boolean
+  canManageWebApp: boolean
+  canManageApi: boolean
   triggerModeDisabled?: boolean
 }): AppCardDisplayState => {
   const isApp = cardType === 'webapp'
   const isWorkflowApp = appInfo.mode === AppModeEnum.WORKFLOW
   const appUnpublished = isWorkflowApp && !currentWorkflow?.graph
   const missingStartNode = isWorkflowApp && !hasWorkflowStartNode(currentWorkflow)
-  const hasInsufficientPermissions = isApp ? !isCurrentWorkspaceEditor : !isCurrentWorkspaceManager
+  const hasInsufficientPermissions = isApp ? !canManageWebApp : !canManageApi
   const toggleDisabled = hasInsufficientPermissions || appUnpublished || missingStartNode || triggerModeDisabled
   const runningStatus = (appUnpublished || missingStartNode) ? false : (isApp ? appInfo.enable_site : appInfo.enable_api)
   const appMode = getCardAppMode(appInfo.mode)
@@ -269,11 +269,11 @@ export const isAppAccessConfigured = (appDetail: AppDetailResponse | null | unde
 export const getAppCardOperationKeys = ({
   cardType,
   appMode,
-  isCurrentWorkspaceEditor,
+  canManageSettings,
 }: {
   cardType: OverviewCardType
   appMode: AppModeEnum
-  isCurrentWorkspaceEditor: boolean
+  canManageSettings: boolean
 }): OverviewOperationKey[] => {
   if (cardType === 'api')
     return ['develop']
@@ -283,7 +283,7 @@ export const getAppCardOperationKeys = ({
     operationKeys.push('embedded')
 
   operationKeys.push('customize')
-  if (isCurrentWorkspaceEditor)
+  if (canManageSettings)
     operationKeys.push('settings')
 
   return operationKeys
diff --git a/web/app/components/app/overview/app-card.tsx b/web/app/components/app/overview/app-card.tsx
index d116e165344..c074229cdae 100644
--- a/web/app/components/app/overview/app-card.tsx
+++ b/web/app/components/app/overview/app-card.tsx
@@ -6,23 +6,24 @@ import type { AppSSO } from '@/types/app'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Switch } from '@langgenius/dify-ui/switch'
-import { useSuspenseQuery } from '@tanstack/react-query'
+import { useQueryClient, useSuspenseQuery } from '@tanstack/react-query'
 import * as React from 'react'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import AppBasic from '@/app/components/app-sidebar/basic'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import SecretKeyButton from '@/app/components/develop/secret-key/secret-key-button'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDocLink } from '@/context/i18n'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { AccessMode } from '@/models/access-control'
 import { usePathname, useRouter } from '@/next/navigation'
-import { useAppWhiteListSubjects } from '@/service/access-control'
-import { fetchAppDetailDirect } from '@/service/apps'
+import { useAppWhiteListSubjects } from '@/service/access-control/use-app-access-control'
+import { appDetailQueryKeyPrefix } from '@/service/use-apps'
 import { useAppWorkflow } from '@/service/use-workflow'
 import { AppModeEnum } from '@/types/app'
 import { asyncRunSafe } from '@/utils'
+import { getAppACLCapabilities } from '@/utils/permission'
 import {
   AppCardAccessControlSection,
   AppCardDialogs,
@@ -68,12 +69,20 @@ function AppCard({
 }: IAppCardProps) {
   const router = useRouter()
   const pathname = usePathname()
-  const { isCurrentWorkspaceManager, isCurrentWorkspaceEditor } = useAppContext()
+  const queryClient = useQueryClient()
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const appACLCapabilities = useMemo(() => getAppACLCapabilities(appInfo.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appInfo.maintainer,
+    workspacePermissionKeys,
+  }), [appInfo.maintainer, appInfo.permission_keys, currentUserId, workspacePermissionKeys])
+  const canEditApp = appACLCapabilities.canEdit
+  const canManageWebAppAccessControl = appACLCapabilities.canReleaseAndVersion
   const shouldFetchWorkflow = appInfo.mode === AppModeEnum.WORKFLOW || appInfo.mode === AppModeEnum.ADVANCED_CHAT
   const { data: currentWorkflow } = useAppWorkflow(shouldFetchWorkflow ? appInfo.id : '')
   const docLink = useDocLink()
   const appDetail = useAppStore(state => state.appDetail)
-  const setAppDetail = useAppStore(state => state.setAppDetail)
   const [showSettingsModal, setShowSettingsModal] = useState(false)
   const [showEmbedded, setShowEmbedded] = useState(false)
   const [showCustomizeModal, setShowCustomizeModal] = useState(false)
@@ -86,15 +95,15 @@ function AppCard({
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { data: appAccessSubjects } = useAppWhiteListSubjects(
     appDetail?.id,
-    systemFeatures.webapp_auth.enabled && appDetail?.access_mode === AccessMode.SPECIFIC_GROUPS_MEMBERS,
+    systemFeatures.webapp_auth.enabled && canManageWebAppAccessControl && appDetail?.access_mode === AccessMode.SPECIFIC_GROUPS_MEMBERS,
   )
 
   const cardState = getAppCardDisplayState({
     appInfo,
     cardType,
     currentWorkflow,
-    isCurrentWorkspaceEditor,
-    isCurrentWorkspaceManager,
+    canManageWebApp: canEditApp,
+    canManageApi: canEditApp,
     triggerModeDisabled,
   })
 
@@ -137,31 +146,30 @@ function AppCard({
   }
 
   const handleClickAccessControl = useCallback(() => {
-    if (!appDetail)
+    if (!appDetail || !canManageWebAppAccessControl)
       return
 
     setShowAccessControl(true)
-  }, [appDetail])
+  }, [appDetail, canManageWebAppAccessControl])
 
   const handleAccessControlUpdate = useCallback(async () => {
     if (!appDetail)
       return
 
     try {
-      const res = await fetchAppDetailDirect({ url: '/apps', id: appDetail.id })
-      setAppDetail(res)
+      await queryClient.invalidateQueries({ queryKey: [...appDetailQueryKeyPrefix, appDetail.id] })
       setShowAccessControl(false)
     }
     catch (error) {
       console.error('Failed to fetch app detail:', error)
     }
-  }, [appDetail, setAppDetail])
+  }, [appDetail, queryClient])
 
   const operationKeys = useMemo(() => getAppCardOperationKeys({
     cardType,
     appMode: cardState.appMode,
-    isCurrentWorkspaceEditor,
-  }), [cardState.appMode, cardType, isCurrentWorkspaceEditor])
+    canManageSettings: canEditApp,
+  }), [canEditApp, cardState.appMode, cardType])
 
   const handleLaunch = useCallback(() => {
     window.open(cardState.accessibleUrl, '_blank')
@@ -335,7 +343,7 @@ function AppCard({
               isApp={isApp}
               accessibleUrl={cardState.accessibleUrl}
               showConfirmDelete={showConfirmDelete}
-              isCurrentWorkspaceManager={isCurrentWorkspaceManager}
+              canRegenerateUrl={canEditApp}
               genLoading={genLoading}
               onRegenerate={() => {
                 onGenCode()
@@ -345,7 +353,7 @@ function AppCard({
               onHideRegenerateConfirm={() => setShowConfirmDelete(false)}
             />
           )}
-          {!cardState.isMinimalState && isApp && systemFeatures.webapp_auth.enabled && appDetail && (
+          {!cardState.isMinimalState && isApp && systemFeatures.webapp_auth.enabled && canManageWebAppAccessControl && appDetail && (
             <AppCardAccessControlSection
               t={t}
               appDetail={appDetail}
@@ -356,7 +364,7 @@ function AppCard({
         </div>
         {!cardState.isMinimalState && (
           <div className="flex items-center gap-1 self-stretch p-3">
-            {!isApp && <SecretKeyButton appId={appInfo.id} />}
+            {!isApp && <SecretKeyButton appId={appInfo.id} canManage={canEditApp} />}
             <AppCardOperations
               t={t}
               operations={operations}
diff --git a/web/app/components/app/overview/app-chart.tsx b/web/app/components/app/overview/app-chart.tsx
index 10e022151f6..d05a83f0b76 100644
--- a/web/app/components/app/overview/app-chart.tsx
+++ b/web/app/components/app/overview/app-chart.tsx
@@ -95,11 +95,11 @@ const Chart: React.FC<IChartProps> = ({
   const tokenSummary = getTokenSummary(statistics)
 
   return (
-    <div className={`flex w-full flex-col rounded-xl bg-components-chart-bg px-6 py-4 shadow-xs ${className ?? ''}`}>
-      <div className="mb-3">
+    <div className={`flex h-[316px] w-full flex-col overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg ${className ?? ''}`}>
+      <div className="flex h-11 shrink-0 items-center px-6 pt-6 pb-1">
         <Basic name={title} type={timePeriod} hoverTip={explanation} />
       </div>
-      <div className="mb-4 flex-1">
+      <div className="flex h-8 shrink-0 items-start px-6 py-1">
         <Basic
           isExtraInLine={CHART_TYPE_CONFIG[chartType].showTokens}
           name={summaryValue}
@@ -123,7 +123,7 @@ const Chart: React.FC<IChartProps> = ({
           textStyle={{ main: `text-3xl! font-normal! ${summaryValue === '0' || summaryValue === '0 ms' ? 'text-text-quaternary!' : ''}` }}
         />
       </div>
-      <ReactECharts option={options} style={{ height: 160 }} />
+      <ReactECharts option={options} style={{ height: 240, width: '100%' }} />
     </div>
   )
 }
diff --git a/web/app/components/app/overview/trigger-card.tsx b/web/app/components/app/overview/trigger-card.tsx
index d6bcb9efcff..5928f9140e7 100644
--- a/web/app/components/app/overview/trigger-card.tsx
+++ b/web/app/components/app/overview/trigger-card.tsx
@@ -1,4 +1,5 @@
 'use client'
+import type { TriggerWithProvider } from '@/app/components/workflow/block-selector/types'
 import type { AppDetailResponse } from '@/models/app'
 import type { AppTrigger } from '@/service/use-tools'
 import type { AppSSO } from '@/types/app'
@@ -7,11 +8,10 @@ import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Switch } from '@langgenius/dify-ui/switch'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
-import { TriggerAll } from '@/app/components/base/icons/src/vender/workflow'
 import BlockIcon from '@/app/components/workflow/block-icon'
 import { useTriggerStatusStore } from '@/app/components/workflow/store/trigger-status'
 import { BlockEnum } from '@/app/components/workflow/types'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDocLink } from '@/context/i18n'
 import Link from '@/next/link'
 import {
@@ -22,13 +22,14 @@ import {
 } from '@/service/use-tools'
 import { useAllTriggerPlugins } from '@/service/use-triggers'
 import { canFindTool } from '@/utils'
+import { getAppACLCapabilities } from '@/utils/permission'
 
 type ITriggerCardProps = {
   appInfo: AppDetailResponse & Partial<AppSSO>
   onToggleResult?: (err: Error | null, message?: I18nKeysByPrefix<'common', 'actionMsg.'>) => void
 }
 
-const getTriggerIcon = (trigger: AppTrigger, triggerPlugins: any[]) => {
+const getTriggerIcon = (trigger: AppTrigger, triggerPlugins: TriggerWithProvider[]) => {
   const { trigger_type, status, provider_name } = trigger
 
   // Get BlockEnum type from trigger_type
@@ -55,7 +56,7 @@ const getTriggerIcon = (trigger: AppTrigger, triggerPlugins: any[]) => {
       || triggerWithProvider.id.includes(provider_name)
       || triggerWithProvider.name === provider_name,
     )
-    triggerIcon = foundTrigger?.icon
+    triggerIcon = typeof foundTrigger?.icon === 'string' ? foundTrigger.icon : undefined
   }
 
   return (
@@ -78,7 +79,13 @@ function TriggerCard({ appInfo, onToggleResult }: ITriggerCardProps) {
   const { t } = useTranslation()
   const docLink = useDocLink()
   const appId = appInfo.id
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canEditApp = React.useMemo(() => getAppACLCapabilities(appInfo.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appInfo.maintainer,
+    workspacePermissionKeys,
+  }).canEdit, [appInfo.maintainer, appInfo.permission_keys, currentUserId, workspacePermissionKeys])
   const { data: triggersResponse, isLoading } = useAppTriggers(appId)
   const { mutateAsync: updateTriggerStatus } = useUpdateTriggerStatus()
   const invalidateAppTriggers = useInvalidateAppTriggers()
@@ -87,7 +94,7 @@ function TriggerCard({ appInfo, onToggleResult }: ITriggerCardProps) {
   // Zustand store for trigger status sync
   const { setTriggerStatus, setTriggerStatuses } = useTriggerStatusStore()
 
-  const triggers = triggersResponse?.data || []
+  const triggers = React.useMemo(() => triggersResponse?.data || [], [triggersResponse?.data])
   const triggerCount = triggers.length
 
   // Sync trigger statuses to Zustand store when data loads initially or after API calls
@@ -105,6 +112,9 @@ function TriggerCard({ appInfo, onToggleResult }: ITriggerCardProps) {
   }, [triggers, setTriggerStatuses])
 
   const onToggleTrigger = async (trigger: AppTrigger, enabled: boolean) => {
+    if (!canEditApp)
+      return
+
     try {
       // Immediately update Zustand store for real-time UI sync
       const newStatus = enabled ? 'enabled' : 'disabled'
@@ -149,7 +159,7 @@ function TriggerCard({ appInfo, onToggleResult }: ITriggerCardProps) {
           <div className="flex w-full items-center gap-3 self-stretch">
             <div className="flex grow items-center">
               <div className="mr-2 shrink-0 rounded-lg border-[0.5px] border-divider-subtle bg-util-colors-purple-purple-500 p-1 shadow-md">
-                <TriggerAll className="size-4 text-text-primary-on-surface" />
+                <div className="i-custom-vender-workflow-trigger-all size-4 text-text-primary-on-surface" />
               </div>
               <div className="group w-full">
                 <div className="min-w-0 overflow-hidden system-md-semibold break-normal text-ellipsis text-text-secondary group-hover:text-text-primary">
@@ -185,7 +195,7 @@ function TriggerCard({ appInfo, onToggleResult }: ITriggerCardProps) {
                   <Switch
                     checked={trigger.status === 'enabled'}
                     onCheckedChange={enabled => onToggleTrigger(trigger, enabled)}
-                    disabled={!isCurrentWorkspaceEditor}
+                    disabled={!canEditApp}
                   />
                 </div>
               </div>
diff --git a/web/app/components/app/store.ts b/web/app/components/app/store.ts
index 020f2b4e6fe..059bd160430 100644
--- a/web/app/components/app/store.ts
+++ b/web/app/components/app/store.ts
@@ -4,7 +4,6 @@ import { create } from 'zustand'
 
 type State = {
   appDetail?: App & Partial<AppSSO>
-  appSidebarExpand: string
   currentLogItem?: IChatItem
   currentLogModalActiveTab: string
   showPromptLogModal: boolean
@@ -15,7 +14,6 @@ type State = {
 
 type Action = {
   setAppDetail: (appDetail?: App & Partial<AppSSO>) => void
-  setAppSidebarExpand: (state: string) => void
   setCurrentLogItem: (item?: IChatItem) => void
   setCurrentLogModalActiveTab: (tab: string) => void
   setShowPromptLogModal: (showPromptLogModal: boolean) => void
@@ -27,8 +25,6 @@ type Action = {
 export const useStore = create<State & Action>(set => ({
   appDetail: undefined,
   setAppDetail: appDetail => set(() => ({ appDetail })),
-  appSidebarExpand: '',
-  setAppSidebarExpand: appSidebarExpand => set(() => ({ appSidebarExpand })),
   currentLogItem: undefined,
   currentLogModalActiveTab: 'DETAIL',
   setCurrentLogItem: currentLogItem => set(() => ({ currentLogItem })),
diff --git a/web/app/components/app/switch-app-modal/__tests__/index.spec.tsx b/web/app/components/app/switch-app-modal/__tests__/index.spec.tsx
index 8e9cca423e8..8d3684c0d03 100644
--- a/web/app/components/app/switch-app-modal/__tests__/index.spec.tsx
+++ b/web/app/components/app/switch-app-modal/__tests__/index.spec.tsx
@@ -3,8 +3,8 @@ import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import * as React from 'react'
 import { useStore as useAppStore } from '@/app/components/app/store'
+import { NEED_REFRESH_APP_LIST_KEY } from '@/app/components/apps/storage'
 import { Plan } from '@/app/components/billing/type'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
 import { AppModeEnum } from '@/types/app'
 import SwitchAppModal from '../index'
 
@@ -274,7 +274,10 @@ describe('SwitchAppModal', () => {
       const user = userEvent.setup()
       // Arrange
       const { appDetail, notify, onClose, onSuccess } = renderComponent()
-      mockSwitchApp.mockResolvedValueOnce({ new_app_id: 'new-app-001' })
+      mockSwitchApp.mockResolvedValueOnce({
+        new_app_id: 'new-app-001',
+        permission_keys: ['app.acl.view_layout'],
+      })
 
       // Act
       await user.click(screen.getByRole('button', { name: 'app.switchStart' }))
@@ -300,7 +303,10 @@ describe('SwitchAppModal', () => {
     it('should update the icon through the picker before switching apps', async () => {
       const user = userEvent.setup()
       const { appDetail } = renderComponent()
-      mockSwitchApp.mockResolvedValueOnce({ new_app_id: 'new-app-003' })
+      mockSwitchApp.mockResolvedValueOnce({
+        new_app_id: 'new-app-003',
+        permission_keys: ['app.acl.view_layout'],
+      })
 
       await user.click(screen.getByText('open-icon-picker'))
       await waitFor(() => {
@@ -359,7 +365,10 @@ describe('SwitchAppModal', () => {
       const user = userEvent.setup()
       // Arrange
       const { appDetail } = renderComponent({ inAppDetail: true })
-      mockSwitchApp.mockResolvedValueOnce({ new_app_id: 'new-app-002' })
+      mockSwitchApp.mockResolvedValueOnce({
+        new_app_id: 'new-app-002',
+        permission_keys: ['app.acl.view_layout'],
+      })
 
       // Act
       await user.click(screen.getByText('app.removeOriginal'))
diff --git a/web/app/components/app/switch-app-modal/index.tsx b/web/app/components/app/switch-app-modal/index.tsx
index 0c794025062..40eb7252746 100644
--- a/web/app/components/app/switch-app-modal/index.tsx
+++ b/web/app/components/app/switch-app-modal/index.tsx
@@ -16,16 +16,14 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
 import { toast } from '@langgenius/dify-ui/toast'
 import { RiCloseLine } from '@remixicon/react'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
+import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import AppIcon from '@/app/components/base/app-icon'
 import { AlertTriangle } from '@/app/components/base/icons/src/vender/solid/alertsAndFeedback'
 import Input from '@/app/components/base/input'
 import AppsFull from '@/app/components/billing/apps-full-in-dialog'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
-import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { useRouter } from '@/next/navigation'
 import { deleteApp, switchApp } from '@/service/apps'
@@ -46,7 +44,6 @@ const SwitchAppModal = ({ show, appDetail, inAppDetail = false, onSuccess, onClo
   const { t } = useTranslation()
   const setAppDetail = useAppStore(s => s.setAppDetail)
 
-  const { isCurrentWorkspaceEditor } = useAppContext()
   const { plan, enableBilling } = useProviderContext()
   const isAppsFull = (enableBilling && plan.usage.buildApps >= plan.total.buildApps)
 
@@ -61,11 +58,11 @@ const SwitchAppModal = ({ show, appDetail, inAppDetail = false, onSuccess, onClo
   const [removeOriginal, setRemoveOriginal] = useState<boolean>(false)
   const [showConfirmDelete, setShowConfirmDelete] = useState(false)
 
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
 
   const goStart = async () => {
     try {
-      const { new_app_id: newAppID } = await switchApp({
+      const { new_app_id: newAppID, permission_keys } = await switchApp({
         appID: appDetail.id,
         name,
         icon_type: appIcon.type,
@@ -83,10 +80,10 @@ const SwitchAppModal = ({ show, appDetail, inAppDetail = false, onSuccess, onClo
         await deleteApp(appDetail.id)
       setNeedRefresh('1')
       getRedirection(
-        isCurrentWorkspaceEditor,
         {
           id: newAppID,
           mode: appDetail.mode === AppModeEnum.COMPLETION ? AppModeEnum.WORKFLOW : AppModeEnum.ADVANCED_CHAT,
+          permission_keys,
         },
         removeOriginal ? replace : push,
       )
diff --git a/web/app/components/app/workflow-log/__tests__/index.spec.tsx b/web/app/components/app/workflow-log/__tests__/index.spec.tsx
index 1fe3db30db9..af5f7ed85a8 100644
--- a/web/app/components/app/workflow-log/__tests__/index.spec.tsx
+++ b/web/app/components/app/workflow-log/__tests__/index.spec.tsx
@@ -82,6 +82,10 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     userProfile: { timezone: 'UTC' },
   }),
+  useSelector: (selector: (state: { userProfile: { id: string, timezone: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: 'user-1', timezone: 'UTC' },
+    workspacePermissionKeys: ['app.create_and_management'],
+  }),
 }))
 
 // Mock WorkflowContextProvider
diff --git a/web/app/components/app/workflow-log/index.tsx b/web/app/components/app/workflow-log/index.tsx
index ea7c6c178ba..8780d686ad2 100644
--- a/web/app/components/app/workflow-log/index.tsx
+++ b/web/app/components/app/workflow-log/index.tsx
@@ -16,6 +16,7 @@ import Loading from '@/app/components/base/loading'
 import { APP_PAGE_LIMIT } from '@/config'
 import { userProfileQueryOptions } from '@/features/account-profile/client'
 import { useWorkflowLogs } from '@/service/use-log'
+import PageTitle from '../log-annotation/page-title'
 import Filter, { TIME_PERIOD_MAPPING } from './filter'
 import List from './list'
 
@@ -67,8 +68,10 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
 
   return (
     <div className="flex h-full flex-col">
-      <h1 className="system-xl-semibold text-text-primary">{t('workflowTitle', { ns: 'appLog' })}</h1>
-      <p className="system-sm-regular text-text-tertiary">{t('workflowSubtitle', { ns: 'appLog' })}</p>
+      <PageTitle
+        title={t('workflowTitle', { ns: 'appLog' })}
+        description={t('workflowSubtitle', { ns: 'appLog' })}
+      />
       <div className="flex max-h-[calc(100%-16px)] flex-1 flex-col py-4">
         <Filter queryParams={queryParams} setQueryParams={setQueryParams} />
         {/* workflow log */}
diff --git a/web/app/components/apps/__tests__/app-card.spec.tsx b/web/app/components/apps/__tests__/app-card.spec.tsx
index c790b414f67..78c47fc865c 100644
--- a/web/app/components/apps/__tests__/app-card.spec.tsx
+++ b/web/app/components/apps/__tests__/app-card.spec.tsx
@@ -8,7 +8,9 @@ import * as appsService from '@/service/apps'
 import * as exploreService from '@/service/explore'
 import * as workflowService from '@/service/workflow'
 import { AppModeEnum } from '@/types/app'
-import AppCard from '../app-card'
+import { AppACLPermission } from '@/utils/permission'
+import { AppCard } from '../app-card'
+import { StarredAppCard } from '../starred-app-card'
 
 let mockWebappAuthEnabled = false
 
@@ -60,11 +62,16 @@ vi.mock('use-context-selector', () => ({
   }),
 }))
 
+const mockAppContext = vi.hoisted(() => ({
+  isCurrentWorkspaceEditor: true,
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: ['app.create_and_management'] as string[],
+}))
+
 // Mock app context
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceEditor: true,
-  }),
+  useAppContext: () => mockAppContext,
+  useSelector: (selector: (state: typeof mockAppContext) => unknown) => selector(mockAppContext),
 }))
 
 // Mock provider context
@@ -114,6 +121,13 @@ vi.mock('@/service/access-control', () => ({
   }),
 }))
 
+vi.mock('@/service/access-control/use-app-access-control', () => ({
+  useGetUserCanAccessApp: () => ({
+    data: { result: true },
+    isLoading: false,
+  }),
+}))
+
 // Mock hooks
 const mockOpenAsyncWindow = vi.fn()
 vi.mock('@/hooks/use-async-window-open', () => ({
@@ -126,7 +140,7 @@ const { mockGetRedirection } = vi.hoisted(() => ({
 }))
 
 vi.mock('@/utils/app-redirection', () => ({
-  getRedirectionPath: (_isCurrentWorkspaceEditor: boolean, app: { id: string }) => `/app/${app.id}/configuration`,
+  getRedirectionPath: (app: { id: string }) => `/app/${app.id}/configuration`,
   getRedirection: mockGetRedirection,
 }))
 
@@ -305,8 +319,21 @@ vi.mock('@langgenius/dify-ui/dropdown-menu', () => {
 
 // AppCardTags has tag API dependencies - mock for isolated testing
 vi.mock('@/features/tag-management/components/app-card-tags', () => ({
-  AppCardTags: ({ tags }: { tags?: { id: string, name: string }[] }) => {
-    return React.createElement('div', { 'aria-label': 'tag-selector' }, tags?.map((tag: { id: string, name: string }) => React.createElement('span', { key: tag.id }, tag.name)))
+  AppCardTags: ({
+    tags,
+    canBindOrUnbindTags,
+  }: {
+    tags?: { id: string, name: string }[]
+    canBindOrUnbindTags?: boolean
+  }) => {
+    return React.createElement(
+      'div',
+      {
+        'aria-label': 'tag-selector',
+        'data-can-bind-or-unbind-tags': String(Boolean(canBindOrUnbindTags)),
+      },
+      tags?.map((tag: { id: string, name: string }) => React.createElement('span', { key: tag.id }, tag.name)),
+    )
   },
 }))
 
@@ -325,6 +352,8 @@ const createMockApp = (overrides: Partial<App> = {}): App => ({
   icon_background: '#FFEAD5',
   icon_url: null,
   author_name: 'Test Author',
+  created_by: 'user-1',
+  maintainer: 'user-1',
   created_at: 1704067200,
   updated_at: 1704153600,
   tags: [],
@@ -350,6 +379,9 @@ describe('AppCard', () => {
     mockWebappAuthEnabled = false
     mockDeleteMutationPending = false
     mockToggleStarMutationPending = false
+    mockAppContext.isCurrentWorkspaceEditor = true
+    mockAppContext.userProfile = { id: 'user-1' }
+    mockAppContext.workspacePermissionKeys = ['app.create_and_management']
   })
 
   describe('Rendering', () => {
@@ -426,6 +458,36 @@ describe('AppCard', () => {
       expect(screen.queryByText('Old Tag')).not.toBeInTheDocument()
     })
 
+    it('should allow app edit permission to bind tags without workspace tag management permission', () => {
+      mockAppContext.isCurrentWorkspaceEditor = false
+      mockAppContext.workspacePermissionKeys = []
+      mockAppContext.userProfile = { id: 'user-2' }
+      const editableApp = createMockApp({
+        maintainer: 'user-1',
+        tags: [{ id: 'tag1', name: 'Tag 1', type: 'app' as const, binding_count: 0 }],
+        permission_keys: [AppACLPermission.Edit],
+      })
+
+      render(<AppCard app={editableApp} />)
+
+      expect(screen.getByLabelText('tag-selector')).toHaveAttribute('data-can-bind-or-unbind-tags', 'true')
+    })
+
+    it('should not render tag selector without app edit or workspace tag management permission', () => {
+      mockAppContext.isCurrentWorkspaceEditor = false
+      mockAppContext.workspacePermissionKeys = []
+      mockAppContext.userProfile = { id: 'user-2' }
+      const readonlyApp = createMockApp({
+        maintainer: 'user-1',
+        tags: [{ id: 'tag1', name: 'Tag 1', type: 'app' as const, binding_count: 0 }],
+        permission_keys: [AppACLPermission.ViewLayout],
+      })
+
+      render(<AppCard app={readonlyApp} />)
+
+      expect(screen.queryByLabelText('tag-selector')).not.toBeInTheDocument()
+    })
+
     it('should render with onRefresh callback', () => {
       render(<AppCard app={mockApp} onRefresh={mockOnRefresh} />)
       expect(screen.getByRole('link', { name: 'Test App' })).toBeInTheDocument()
@@ -557,6 +619,38 @@ describe('AppCard', () => {
       })
     })
 
+    it('should show duplicate option when user can create apps without app import export permission', async () => {
+      const appWithoutImportExportPermission = createMockApp({
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        permission_keys: [AppACLPermission.ViewLayout],
+      })
+      render(<AppCard app={appWithoutImportExportPermission} />)
+
+      fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+
+      await waitFor(() => {
+        expect(screen.getByText('app.duplicate')).toBeInTheDocument()
+      })
+      expect(screen.queryByText('app.export')).not.toBeInTheDocument()
+    })
+
+    it('should show duplicate option on starred cards when user can create apps without app import export permission', async () => {
+      const appWithoutImportExportPermission = createMockApp({
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        permission_keys: [AppACLPermission.ViewLayout],
+      })
+      render(<StarredAppCard app={appWithoutImportExportPermission} />)
+
+      fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+
+      await waitFor(() => {
+        expect(screen.getByText('app.duplicate')).toBeInTheDocument()
+      })
+      expect(screen.queryByText('app.export')).not.toBeInTheDocument()
+    })
+
     it('should show export option when dropdown menu is opened', async () => {
       render(<AppCard app={mockApp} />)
 
@@ -588,6 +682,24 @@ describe('AppCard', () => {
       })
     })
 
+    it('should show switch option when user can edit app without app creation permission', async () => {
+      mockAppContext.workspacePermissionKeys = []
+      const editableChatApp = createMockApp({
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        mode: AppModeEnum.CHAT,
+        permission_keys: [AppACLPermission.Edit],
+      })
+      render(<AppCard app={editableChatApp} />)
+
+      fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+
+      await waitFor(() => {
+        expect(screen.getByText(/switch/i)).toBeInTheDocument()
+      })
+      expect(screen.queryByText('app.duplicate')).not.toBeInTheDocument()
+    })
+
     it('should show switch option for completion mode apps', async () => {
       const completionApp = { ...mockApp, mode: AppModeEnum.COMPLETION }
       render(<AppCard app={completionApp} />)
@@ -1623,6 +1735,54 @@ describe('AppCard', () => {
       })
     })
 
+    it('should show access control option when user has app release and version permission', async () => {
+      const appWithReleasePermission = createMockApp({
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        permission_keys: [AppACLPermission.ReleaseAndVersion],
+      })
+      render(<AppCard app={appWithReleasePermission} />)
+
+      fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+
+      await waitFor(() => {
+        expect(screen.getByText('app.accessControl')).toBeInTheDocument()
+      })
+    })
+
+    it('should show resource access option when user only has app access config permission', async () => {
+      const appWithAccessConfigPermission = createMockApp({
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        permission_keys: [AppACLPermission.AccessConfig, AppACLPermission.Delete],
+      })
+      render(<AppCard app={appWithAccessConfigPermission} />)
+
+      fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+
+      await waitFor(() => {
+        expect(screen.getByText('common.operation.delete')).toBeInTheDocument()
+      })
+      expect(screen.queryByText('app.accessControl')).not.toBeInTheDocument()
+      expect(screen.getByText('common.settings.resourceAccess')).toBeInTheDocument()
+    })
+
+    it('should navigate to app access config when resource access is clicked', async () => {
+      const appWithAccessConfigPermission = createMockApp({
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        permission_keys: [AppACLPermission.AccessConfig],
+      })
+      render(<AppCard app={appWithAccessConfigPermission} />)
+
+      fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+      await waitFor(() => {
+        fireEvent.click(screen.getByText('common.settings.resourceAccess'))
+      })
+
+      expect(mockPush).toHaveBeenCalledWith('/app/test-app-id/access-config')
+    })
+
     it('should click access control button', async () => {
       render(<AppCard app={mockApp} />)
 
@@ -1731,7 +1891,7 @@ describe('AppCard', () => {
       vi.resetModules()
       vi.doMock('@langgenius/dify-ui/alert-dialog', createMockAlertDialogModule)
 
-      const { default: IsolatedAppCard } = await import('../app-card')
+      const { AppCard: IsolatedAppCard } = await import('../app-card')
       render(<IsolatedAppCard app={mockApp} />)
 
       fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
@@ -1753,7 +1913,7 @@ describe('AppCard', () => {
       vi.resetModules()
       vi.doMock('@langgenius/dify-ui/alert-dialog', createMockAlertDialogModule)
 
-      const { default: IsolatedAppCard } = await import('../app-card')
+      const { AppCard: IsolatedAppCard } = await import('../app-card')
       render(<IsolatedAppCard app={mockApp} />)
 
       fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
@@ -1773,7 +1933,7 @@ describe('AppCard', () => {
       mockDeleteMutationPending = true
       vi.doMock('@langgenius/dify-ui/alert-dialog', createMockAlertDialogModule)
 
-      const { default: IsolatedAppCard } = await import('../app-card')
+      const { AppCard: IsolatedAppCard } = await import('../app-card')
       render(<IsolatedAppCard app={mockApp} />)
 
       fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
diff --git a/web/app/components/apps/__tests__/index.spec.tsx b/web/app/components/apps/__tests__/index.spec.tsx
index 32ebd35eba6..7f6120afef0 100644
--- a/web/app/components/apps/__tests__/index.spec.tsx
+++ b/web/app/components/apps/__tests__/index.spec.tsx
@@ -28,6 +28,7 @@ const mockHandleImportDSL = vi.fn()
 const mockHandleImportDSLConfirm = vi.fn()
 const mockTrackCreateApp = vi.fn()
 const mockFetchAppDetail = vi.mocked(fetchAppDetail)
+let mockWorkspacePermissionKeys: string[] = ['app.create_and_management']
 
 const mockTemplateApp: App = {
   app_id: 'template-1',
@@ -68,6 +69,15 @@ vi.mock('@/app/education-apply/hooks', () => ({
   },
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+  useAppContext: () => ({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 vi.mock('@/hooks/use-import-dsl', () => ({
   useImportDSL: () => ({
     handleImportDSL: mockHandleImportDSL,
@@ -193,6 +203,7 @@ describe('Apps', () => {
     vi.clearAllMocks()
     documentTitleCalls = []
     educationInitCalls = 0
+    mockWorkspacePermissionKeys = ['app.create_and_management']
     mockSearchParams = new URLSearchParams()
     mockReplace.mockClear()
     mockFetchAppDetail.mockResolvedValue({
@@ -351,6 +362,14 @@ describe('Apps', () => {
       expect(screen.getByTestId('template-id')).toHaveTextContent('tpl-42')
     })
 
+    it('should not render the template modal without app.create_and_management permission', () => {
+      mockWorkspacePermissionKeys = []
+      mockSearchParams = new URLSearchParams('template-id=tpl-42')
+      renderWithClient(<Apps />)
+
+      expect(screen.queryByTestId('marketplace-template-modal')).not.toBeInTheDocument()
+    })
+
     it('should not render the template modal when no template-id is present', () => {
       renderWithClient(<Apps />)
 
@@ -391,6 +410,16 @@ describe('Apps', () => {
       })
     })
 
+    it('should not open create modal from template preview without app.create_and_management permission', async () => {
+      mockWorkspacePermissionKeys = []
+      renderWithClient(<Apps />)
+
+      fireEvent.click(screen.getByTestId('open-preview'))
+      fireEvent.click(await screen.findByTestId('try-app-create'))
+
+      expect(screen.queryByTestId('create-app-modal')).not.toBeInTheDocument()
+    })
+
     it('should track marketplace template creation after confirming a pending import', async () => {
       mockHandleImportDSL.mockImplementation(async (_payload: unknown, options: { onPending?: () => void }) => {
         options.onPending?.()
diff --git a/web/app/components/apps/__tests__/list.spec.tsx b/web/app/components/apps/__tests__/list.spec.tsx
index 22c86a1fbeb..f5ac48c3a46 100644
--- a/web/app/components/apps/__tests__/list.spec.tsx
+++ b/web/app/components/apps/__tests__/list.spec.tsx
@@ -65,13 +65,22 @@ vi.mock('@/service/client', () => ({
   },
 }))
 
-const mockIsCurrentWorkspaceEditor = vi.fn(() => true)
 const mockIsCurrentWorkspaceDatasetOperator = vi.fn(() => false)
+let mockWorkspacePermissionKeys = ['app.create_and_management']
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
-    isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor(),
     isCurrentWorkspaceDatasetOperator: mockIsCurrentWorkspaceDatasetOperator(),
     userProfile: { id: 'creator-1' },
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+  useSelector: (selector: (state: {
+    isCurrentWorkspaceDatasetOperator: boolean
+    userProfile: { id: string }
+    workspacePermissionKeys: string[]
+  }) => unknown) => selector({
+    isCurrentWorkspaceDatasetOperator: mockIsCurrentWorkspaceDatasetOperator(),
+    userProfile: { id: 'creator-1' },
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -229,14 +238,6 @@ vi.mock('@/service/use-apps', () => ({
   }),
 }))
 
-vi.mock('@/config', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@/config')>()
-  return {
-    ...actual,
-    NEED_REFRESH_APP_LIST_KEY: 'needRefreshAppList',
-  }
-})
-
 vi.mock('@/hooks/use-pay', () => ({
   CheckModal: () => null,
 }))
@@ -276,6 +277,9 @@ vi.mock('@/next/dynamic', () => ({
 }))
 
 vi.mock('../app-card', () => ({
+  AppCard: ({ app }: { app: { id: string, name: string } }) => {
+    return React.createElement('div', { 'data-testid': `app-card-${app.id}`, 'role': 'article' }, app.name)
+  },
   AppCardActionBar: ({ app, onRefresh }: { app: { id: string }, onRefresh?: () => void }) => {
     return React.createElement('button', {
       'data-testid': `app-card-action-bar-${app.id}`,
@@ -352,8 +356,8 @@ const openAppSortSelect = async (user = userEvent.setup()) => {
 describe('List', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsCurrentWorkspaceEditor.mockReturnValue(true)
     mockIsCurrentWorkspaceDatasetOperator.mockReturnValue(false)
+    mockWorkspacePermissionKeys = ['app.create_and_management']
     mockDragging = false
     mockOnDSLFileDropped = null
     mockServiceState.error = null
@@ -492,7 +496,7 @@ describe('List', () => {
       expect(screen.queryByTestId('new-app-card')).not.toBeInTheDocument()
     })
 
-    it('should render drop DSL hint for editors', () => {
+    it('should render drop DSL hint when app creation permission is available', () => {
       renderList()
       expect(screen.getByText('app.newApp.dropDSLToCreateApp'))!.toBeInTheDocument()
     })
@@ -739,8 +743,8 @@ describe('List', () => {
       expect(screen.getByTestId('create-dsl-modal'))!.toBeInTheDocument()
     })
 
-    it('should not render create button for non-editors', () => {
-      mockIsCurrentWorkspaceEditor.mockReturnValue(false)
+    it('should not render create button without app creation permission', () => {
+      mockWorkspacePermissionKeys = []
 
       renderList()
 
@@ -748,17 +752,17 @@ describe('List', () => {
     })
   })
 
-  describe('Non-Editor User', () => {
-    it('should not render new app card for non-editors', () => {
-      mockIsCurrentWorkspaceEditor.mockReturnValue(false)
+  describe('User Without App Creation Permission', () => {
+    it('should not render new app card without app creation permission', () => {
+      mockWorkspacePermissionKeys = []
 
       renderList()
 
       expect(screen.queryByTestId('new-app-card')).not.toBeInTheDocument()
     })
 
-    it('should not render drop DSL hint for non-editors', () => {
-      mockIsCurrentWorkspaceEditor.mockReturnValue(false)
+    it('should not render drop DSL hint without app creation permission', () => {
+      mockWorkspacePermissionKeys = []
 
       renderList()
 
diff --git a/web/app/components/apps/__tests__/new-app-card.spec.tsx b/web/app/components/apps/__tests__/new-app-card.spec.tsx
index 00be07998b5..4f7b8c4bf92 100644
--- a/web/app/components/apps/__tests__/new-app-card.spec.tsx
+++ b/web/app/components/apps/__tests__/new-app-card.spec.tsx
@@ -4,6 +4,7 @@ import * as React from 'react'
 import CreateAppCard from '../new-app-card'
 
 const mockReplace = vi.fn()
+let mockWorkspacePermissionKeys: string[] = ['app.create_and_management']
 vi.mock('@/next/navigation', () => ({
   useRouter: () => ({
     replace: mockReplace,
@@ -11,6 +12,12 @@ vi.mock('@/next/navigation', () => ({
   useSearchParams: () => new URLSearchParams(),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 const mockOnPlanInfoChanged = vi.fn()
 vi.mock('@/context/provider-context', () => ({
   useProviderContext: () => ({
@@ -58,6 +65,7 @@ describe('CreateAppCard', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys = ['app.create_and_management']
   })
 
   describe('Rendering', () => {
@@ -66,6 +74,14 @@ describe('CreateAppCard', () => {
       expect(screen.getByText('app.newApp.startFromBlank')).toBeInTheDocument()
     })
 
+    it('should not render without app.create_and_management permission', () => {
+      mockWorkspacePermissionKeys = []
+
+      const { container } = render(<CreateAppCard ref={defaultRef} />)
+
+      expect(container).toBeEmptyDOMElement()
+    })
+
     it('should render three create buttons', () => {
       render(<CreateAppCard ref={defaultRef} />)
 
diff --git a/web/app/components/apps/app-card.tsx b/web/app/components/apps/app-card.tsx
index 2d6e1e6ee31..7e2f173ee3f 100644
--- a/web/app/components/apps/app-card.tsx
+++ b/web/app/components/apps/app-card.tsx
@@ -1,5 +1,6 @@
 'use client'
 
+import type { FormEvent, FormEventHandler, MouseEvent } from 'react'
 import type { DuplicateAppModalProps } from '@/app/components/app/duplicate-modal'
 import type { CreateAppModalProps } from '@/app/components/explore/create-app-modal'
 import type { EnvironmentVariable } from '@/app/components/workflow/types'
@@ -30,17 +31,15 @@ import {
   TooltipTrigger,
 } from '@langgenius/dify-ui/tooltip'
 import { useSuspenseQuery } from '@tanstack/react-query'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
-import * as React from 'react'
 import { useCallback, useId, useMemo, useState } from 'react'
 import { Trans, useTranslation } from 'react-i18next'
 import { AppTypeIcon } from '@/app/components/app/type-selector'
+import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import AppIcon from '@/app/components/base/app-icon'
 import StarIcon from '@/app/components/base/icons/src/vender/Star'
 import { UserAvatarList } from '@/app/components/base/user-avatar-list'
 import { buildInstalledAppPath } from '@/app/components/explore/installed-app/routes'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextSelector } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { AppCardTags } from '@/features/tag-management/components/app-card-tags'
@@ -49,7 +48,7 @@ import { AccessMode } from '@/models/access-control'
 import dynamic from '@/next/dynamic'
 import Link from '@/next/link'
 import { useRouter } from '@/next/navigation'
-import { useGetUserCanAccessApp } from '@/service/access-control'
+import { useGetUserCanAccessApp } from '@/service/access-control/use-app-access-control'
 import { copyApp, exportAppConfig, updateAppInfo } from '@/service/apps'
 import { fetchInstalledAppList } from '@/service/explore'
 import { useDeleteAppMutation, useToggleAppStarMutation } from '@/service/use-apps'
@@ -57,6 +56,7 @@ import { fetchWorkflowDraft } from '@/service/workflow'
 import { AppModeEnum } from '@/types/app'
 import { getRedirection, getRedirectionPath } from '@/utils/app-redirection'
 import { downloadBlob } from '@/utils/download'
+import { getAppACLCapabilities, hasPermission } from '@/utils/permission'
 import { formatTime } from '@/utils/time'
 import { basePath } from '@/utils/var'
 
@@ -72,7 +72,7 @@ const SwitchAppModal = dynamic(() => import('@/app/components/app/switch-app-mod
 const DSLExportConfirmModal = dynamic(() => import('@/app/components/workflow/dsl-export-confirm-modal'), {
   ssr: false,
 })
-const AccessControl = dynamic(() => import('@/app/components/app/app-access-control'), {
+const AccessControl = dynamic(() => import('@/app/components/app/app-access-control').then(mod => mod.AccessControl), {
   ssr: false,
 })
 
@@ -101,6 +101,8 @@ type AppAccessModeIconProps = {
   accessMode?: AccessMode | null
 }
 
+const getAppResourceMaintainer = (app: App) => app.maintainer
+
 function AppAccessModeIcon({ accessMode }: AppAccessModeIconProps) {
   const { t } = useTranslation()
 
@@ -129,39 +131,55 @@ function AppAccessModeIcon({ accessMode }: AppAccessModeIconProps) {
 
 type AppCardOperationsMenuProps = {
   app: App
+  shouldShowEditOption: boolean
+  shouldShowDuplicateOption: boolean
+  shouldShowExportOption: boolean
   shouldShowSwitchOption: boolean
   shouldShowOpenInExploreOption: boolean
   shouldShowAccessControlOption: boolean
+  shouldShowAccessConfigOption: boolean
+  shouldShowDeleteOption: boolean
   onEdit: () => void
   onDuplicate: () => void
   onExport: () => void
   onSwitch: () => void
   onDelete: () => void
   onAccessControl: () => void
+  onAccessConfig: () => void
 }
 
-const AppCardOperationsMenu: React.FC<AppCardOperationsMenuProps> = ({
+function AppCardOperationsMenu({
   app,
+  shouldShowEditOption,
+  shouldShowDuplicateOption,
+  shouldShowExportOption,
   shouldShowSwitchOption,
   shouldShowOpenInExploreOption,
   shouldShowAccessControlOption,
+  shouldShowAccessConfigOption,
+  shouldShowDeleteOption,
   onEdit,
   onDuplicate,
   onExport,
   onSwitch,
   onDelete,
   onAccessControl,
-}) => {
+  onAccessConfig,
+}: AppCardOperationsMenuProps) {
   const { t } = useTranslation()
   const openAsyncWindow = useAsyncWindowOpen()
+  const hasEditGroup = shouldShowEditOption
+  const hasCreateExportGroup = shouldShowDuplicateOption || shouldShowExportOption
+  const hasSwitchOrExploreGroup = shouldShowSwitchOption || shouldShowOpenInExploreOption
+  const hasAccessDeleteGroup = shouldShowAccessControlOption || shouldShowAccessConfigOption || shouldShowDeleteOption
 
-  const handleMenuAction = useCallback((e: React.MouseEvent<HTMLElement>, action: () => void) => {
+  function handleMenuAction(e: MouseEvent<HTMLElement>, action: () => void) {
     e.stopPropagation()
     e.preventDefault()
     action()
-  }, [])
+  }
 
-  const handleOpenInstalledApp = useCallback(async (e: React.MouseEvent<HTMLElement>) => {
+  async function handleOpenInstalledApp(e: MouseEvent<HTMLElement>) {
     e.stopPropagation()
     e.preventDefault()
     try {
@@ -180,61 +198,75 @@ const AppCardOperationsMenu: React.FC<AppCardOperationsMenuProps> = ({
       const message = e instanceof Error ? e.message : `${e}`
       toast.error(message)
     }
-  }, [app.id, openAsyncWindow])
+  }
 
   return (
     <>
-      <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onEdit)}>
-        <span className="system-sm-regular text-text-secondary">{t('editApp', { ns: 'app' })}</span>
-      </DropdownMenuItem>
-      <DropdownMenuSeparator />
-      <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onDuplicate)}>
-        <span className="system-sm-regular text-text-secondary">{t('duplicate', { ns: 'app' })}</span>
-      </DropdownMenuItem>
-      <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onExport)}>
-        <span className="system-sm-regular text-text-secondary">{t('export', { ns: 'app' })}</span>
-      </DropdownMenuItem>
+      {shouldShowEditOption && (
+        <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onEdit)}>
+          <span className="system-sm-regular text-text-secondary">{t('editApp', { ns: 'app' })}</span>
+        </DropdownMenuItem>
+      )}
+      {hasEditGroup && (hasCreateExportGroup || hasSwitchOrExploreGroup || hasAccessDeleteGroup) && (
+        <DropdownMenuSeparator />
+      )}
+      {shouldShowDuplicateOption && (
+        <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onDuplicate)}>
+          <span className="system-sm-regular text-text-secondary">{t('duplicate', { ns: 'app' })}</span>
+        </DropdownMenuItem>
+      )}
+      {shouldShowExportOption && (
+        <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onExport)}>
+          <span className="system-sm-regular text-text-secondary">{t('export', { ns: 'app' })}</span>
+        </DropdownMenuItem>
+      )}
+      {hasCreateExportGroup && (hasSwitchOrExploreGroup || hasAccessDeleteGroup) && (
+        <DropdownMenuSeparator />
+      )}
       {shouldShowSwitchOption && (
-        <>
-          <DropdownMenuSeparator />
-          <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onSwitch)}>
-            <span className="text-sm/5 text-text-secondary">{t('switch', { ns: 'app' })}</span>
-          </DropdownMenuItem>
-        </>
+        <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onSwitch)}>
+          <span className="text-sm/5 text-text-secondary">{t('switch', { ns: 'app' })}</span>
+        </DropdownMenuItem>
       )}
       {shouldShowOpenInExploreOption && (
-        <>
-          <DropdownMenuSeparator />
-          <DropdownMenuItem className="gap-2 px-3" onClick={handleOpenInstalledApp}>
-            <span className="system-sm-regular text-text-secondary">{t('openInExplore', { ns: 'app' })}</span>
-          </DropdownMenuItem>
-        </>
+        <DropdownMenuItem className="gap-2 px-3" onClick={handleOpenInstalledApp}>
+          <span className="system-sm-regular text-text-secondary">{t('openInExplore', { ns: 'app' })}</span>
+        </DropdownMenuItem>
+      )}
+      {hasSwitchOrExploreGroup && hasAccessDeleteGroup && (
+        <DropdownMenuSeparator />
       )}
-      <DropdownMenuSeparator />
       {shouldShowAccessControlOption && (
-        <>
-          <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onAccessControl)}>
-            <span className="text-sm/5 text-text-secondary">{t('accessControl', { ns: 'app' })}</span>
-          </DropdownMenuItem>
-          <DropdownMenuSeparator />
-        </>
+        <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onAccessControl)}>
+          <span className="text-sm/5 text-text-secondary">{t('accessControl', { ns: 'app' })}</span>
+        </DropdownMenuItem>
+      )}
+      {shouldShowAccessConfigOption && (
+        <DropdownMenuItem className="gap-2 px-3" onClick={e => handleMenuAction(e, onAccessConfig)}>
+          <span className="text-sm/5 text-text-secondary">{t('settings.resourceAccess', { ns: 'common' })}</span>
+        </DropdownMenuItem>
+      )}
+      {(shouldShowAccessControlOption || shouldShowAccessConfigOption) && shouldShowDeleteOption && (
+        <DropdownMenuSeparator />
+      )}
+      {shouldShowDeleteOption && (
+        <DropdownMenuItem
+          variant="destructive"
+          className="gap-2 px-3"
+          onClick={e => handleMenuAction(e, onDelete)}
+        >
+          <span className="system-sm-regular">
+            {t('operation.delete', { ns: 'common' })}
+          </span>
+        </DropdownMenuItem>
       )}
-      <DropdownMenuItem
-        variant="destructive"
-        className="gap-2 px-3"
-        onClick={e => handleMenuAction(e, onDelete)}
-      >
-        <span className="system-sm-regular">
-          {t('operation.delete', { ns: 'common' })}
-        </span>
-      </DropdownMenuItem>
     </>
   )
 }
 
 type AppCardOperationsMenuContentProps = Omit<AppCardOperationsMenuProps, 'shouldShowOpenInExploreOption'>
 
-const AppCardOperationsMenuContent: React.FC<AppCardOperationsMenuContentProps> = (props) => {
+function AppCardOperationsMenuContent(props: AppCardOperationsMenuContentProps) {
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { data: userCanAccessApp, isLoading: isGettingUserCanAccessApp } = useGetUserCanAccessApp({
     appId: props.app.id,
@@ -260,10 +292,11 @@ type AppCardActionBarProps = {
   onRefresh?: () => void
 }
 
-export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefresh }) => {
+export function AppCardActionBar({ app, onRefresh }: AppCardActionBarProps) {
   const { t } = useTranslation()
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const currentUserId = useAppContextSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
   const { onPlanInfoChanged } = useProviderContext()
   const { push } = useRouter()
 
@@ -277,7 +310,15 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
   const [secretEnvList, setSecretEnvList] = useState<EnvironmentVariable[]>([])
   const { mutateAsync: mutateDeleteApp, isPending: isDeleting } = useDeleteAppMutation()
   const { mutateAsync: mutateToggleAppStar, isPending: isTogglingStar } = useToggleAppStarMutation()
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
+  const resourceMaintainer = getAppResourceMaintainer(app)
+  const maintainerPermissionOptions = useMemo(() => ({
+    currentUserId,
+    resourceMaintainer,
+    workspacePermissionKeys,
+  }), [currentUserId, resourceMaintainer, workspacePermissionKeys])
+  const appACLCapabilities = useMemo(() => getAppACLCapabilities(app.permission_keys, maintainerPermissionOptions), [app.permission_keys, maintainerPermissionOptions])
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
 
   const onConfirmDelete = useCallback(async () => {
     try {
@@ -304,7 +345,7 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
 
   const isDeleteConfirmDisabled = isDeleting || confirmDeleteInput !== app.name
 
-  const onDeleteDialogSubmit: React.FormEventHandler<HTMLFormElement> = useCallback((e) => {
+  const onDeleteDialogSubmit: FormEventHandler<HTMLFormElement> = useCallback((e) => {
     e.preventDefault()
     if (isDeleteConfirmDisabled)
       return
@@ -347,6 +388,11 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
     })
   }, [])
 
+  const handleOpenAccessConfig = useCallback(() => {
+    setIsOperationsMenuOpen(false)
+    push(`/app/${app.id}/access-config`)
+  }, [app.id, push])
+
   const onEdit: CreateAppModalProps['onConfirm'] = useCallback(async ({
     name,
     icon_type,
@@ -391,7 +437,11 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
       setNeedRefresh('1')
       onRefresh?.()
       onPlanInfoChanged()
-      getRedirection(isCurrentWorkspaceEditor, newApp, push)
+      getRedirection(newApp, push, {
+        currentUserId,
+        resourceMaintainer: getAppResourceMaintainer(newApp),
+        workspacePermissionKeys,
+      })
     }
     catch {
       toast.error(t('newApp.appCreateFailed', { ns: 'app' }))
@@ -442,7 +492,7 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
     setShowAccessControl(false)
   }, [onRefresh, setShowAccessControl])
 
-  const handleToggleStar = useCallback(async (e: React.MouseEvent<HTMLButtonElement>) => {
+  const handleToggleStar = useCallback(async (e: MouseEvent<HTMLButtonElement>) => {
     e.stopPropagation()
     e.preventDefault()
 
@@ -461,8 +511,14 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
     }
   }, [app.id, app.is_starred, isTogglingStar, mutateToggleAppStar, onRefresh, t])
 
-  const shouldShowSwitchOption = app.mode === AppModeEnum.COMPLETION || app.mode === AppModeEnum.CHAT
-  const shouldShowAccessControlOption = systemFeatures.webapp_auth.enabled && isCurrentWorkspaceEditor
+  const shouldShowEditOption = appACLCapabilities.canEdit
+  const shouldShowDuplicateOption = canCreateApp
+  const shouldShowExportOption = appACLCapabilities.canImportExportDSL
+  const shouldShowSwitchOption = canCreateApp && appACLCapabilities.canEdit && (app.mode === AppModeEnum.COMPLETION || app.mode === AppModeEnum.CHAT)
+  const shouldShowAccessControlOption = systemFeatures.webapp_auth.enabled && appACLCapabilities.canReleaseAndVersion
+  const shouldShowAccessConfigOption = appACLCapabilities.canAccessConfig
+  const shouldShowDeleteOption = appACLCapabilities.canDelete
+  const shouldShowOperationsMenu = shouldShowEditOption || shouldShowDuplicateOption || shouldShowExportOption || shouldShowSwitchOption || shouldShowAccessControlOption || shouldShowAccessConfigOption || shouldShowDeleteOption
   const operationsMenuWidthClassName = shouldShowSwitchOption ? 'w-[256px]' : 'w-[216px]'
   const starActionLabel = app.is_starred
     ? t('studio.unstarApp', { ns: 'app' })
@@ -500,7 +556,7 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
           />
           <TooltipContent>{starActionLabel}</TooltipContent>
         </Tooltip>
-        {isCurrentWorkspaceEditor && (
+        {shouldShowOperationsMenu && (
           <DropdownMenu modal={false} open={isOperationsMenuOpen} onOpenChange={setIsOperationsMenuOpen}>
             <DropdownMenuTrigger
               aria-label={t('operation.more', { ns: 'common' })}
@@ -525,28 +581,40 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
                 ? (
                     <AppCardOperationsMenuContent
                       app={app}
+                      shouldShowEditOption={shouldShowEditOption}
+                      shouldShowDuplicateOption={shouldShowDuplicateOption}
+                      shouldShowExportOption={shouldShowExportOption}
                       shouldShowSwitchOption={shouldShowSwitchOption}
                       shouldShowAccessControlOption={shouldShowAccessControlOption}
+                      shouldShowAccessConfigOption={shouldShowAccessConfigOption}
+                      shouldShowDeleteOption={shouldShowDeleteOption}
                       onEdit={handleShowEditModal}
                       onDuplicate={handleShowDuplicateModal}
                       onExport={exportCheck}
                       onSwitch={handleShowSwitchModal}
                       onDelete={handleShowDeleteConfirm}
                       onAccessControl={handleShowAccessControl}
+                      onAccessConfig={handleOpenAccessConfig}
                     />
                   )
                 : (
                     <AppCardOperationsMenu
                       app={app}
+                      shouldShowEditOption={shouldShowEditOption}
+                      shouldShowDuplicateOption={shouldShowDuplicateOption}
+                      shouldShowExportOption={shouldShowExportOption}
                       shouldShowSwitchOption={shouldShowSwitchOption}
                       shouldShowOpenInExploreOption={!app.has_draft_trigger}
                       shouldShowAccessControlOption={shouldShowAccessControlOption}
+                      shouldShowAccessConfigOption={shouldShowAccessConfigOption}
+                      shouldShowDeleteOption={shouldShowDeleteOption}
                       onEdit={handleShowEditModal}
                       onDuplicate={handleShowDuplicateModal}
                       onExport={exportCheck}
                       onSwitch={handleShowSwitchModal}
                       onDelete={handleShowDeleteConfirm}
                       onAccessControl={handleShowAccessControl}
+                      onAccessConfig={handleOpenAccessConfig}
                     />
                   )}
             </DropdownMenuContent>
@@ -651,10 +719,11 @@ export const AppCardActionBar: React.FC<AppCardActionBarProps> = ({ app, onRefre
   )
 }
 
-const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () => { } }: AppCardProps) => {
+export function AppCard({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () => {} }: AppCardProps) {
   const { t } = useTranslation()
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const currentUserId = useAppContextSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
   const { onPlanInfoChanged } = useProviderContext()
   const { push } = useRouter()
 
@@ -668,9 +737,18 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
   const [secretEnvList, setSecretEnvList] = useState<EnvironmentVariable[]>([])
   const { mutateAsync: mutateDeleteApp, isPending: isDeleting } = useDeleteAppMutation()
   const { mutateAsync: mutateToggleAppStar, isPending: isTogglingStar } = useToggleAppStarMutation()
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
+  const resourceMaintainer = getAppResourceMaintainer(app)
+  const maintainerPermissionOptions = useMemo(() => ({
+    currentUserId,
+    resourceMaintainer,
+    workspacePermissionKeys,
+  }), [currentUserId, resourceMaintainer, workspacePermissionKeys])
+  const appACLCapabilities = useMemo(() => getAppACLCapabilities(app.permission_keys, maintainerPermissionOptions), [app.permission_keys, maintainerPermissionOptions])
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
+  const canManageAppTags = hasPermission(workspacePermissionKeys, 'app.tag.manage')
 
-  const onConfirmDelete = useCallback(async () => {
+  async function onConfirmDelete() {
     try {
       await mutateDeleteApp(app.id)
       toast.success(t('appDeleted', { ns: 'app' }))
@@ -682,63 +760,68 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
       const message = e instanceof Error ? e.message : ''
       toast.error(`${t('appDeleteFailed', { ns: 'app' })}${message ? `: ${message}` : ''}`)
     }
-  }, [app.id, mutateDeleteApp, onPlanInfoChanged, t])
+  }
 
-  const onDeleteDialogOpenChange = useCallback((open: boolean) => {
+  function onDeleteDialogOpenChange(open: boolean) {
     if (isDeleting)
       return
 
     setShowConfirmDelete(open)
     if (!open)
       setConfirmDeleteInput('')
-  }, [isDeleting])
+  }
 
   const isDeleteConfirmDisabled = isDeleting || confirmDeleteInput !== app.name
 
-  const onDeleteDialogSubmit: React.FormEventHandler<HTMLFormElement> = useCallback((e) => {
-    e.preventDefault()
+  function onDeleteDialogSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault()
     if (isDeleteConfirmDisabled)
       return
 
     void onConfirmDelete()
-  }, [isDeleteConfirmDisabled, onConfirmDelete])
+  }
 
-  const handleShowEditModal = useCallback(() => {
+  function handleShowEditModal() {
     setIsOperationsMenuOpen(false)
     queueMicrotask(() => {
       setShowEditModal(true)
     })
-  }, [])
+  }
 
-  const handleShowDuplicateModal = useCallback(() => {
+  function handleShowDuplicateModal() {
     setIsOperationsMenuOpen(false)
     queueMicrotask(() => {
       setShowDuplicateModal(true)
     })
-  }, [])
+  }
 
-  const handleShowSwitchModal = useCallback(() => {
+  function handleShowSwitchModal() {
     setIsOperationsMenuOpen(false)
     queueMicrotask(() => {
       setShowSwitchModal(true)
     })
-  }, [])
+  }
 
-  const handleShowDeleteConfirm = useCallback(() => {
+  function handleShowDeleteConfirm() {
     setIsOperationsMenuOpen(false)
     queueMicrotask(() => {
       setShowConfirmDelete(true)
     })
-  }, [])
+  }
 
-  const handleShowAccessControl = useCallback(() => {
+  function handleShowAccessControl() {
     setIsOperationsMenuOpen(false)
     queueMicrotask(() => {
       setShowAccessControl(true)
     })
-  }, [])
+  }
 
-  const onEdit: CreateAppModalProps['onConfirm'] = useCallback(async ({
+  const handleOpenAccessConfig = useCallback(() => {
+    setIsOperationsMenuOpen(false)
+    push(`/app/${app.id}/access-config`)
+  }, [app.id, push])
+
+  const onEdit: CreateAppModalProps['onConfirm'] = async ({
     name,
     icon_type,
     icon,
@@ -766,7 +849,7 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
     catch (e) {
       toast.error(e instanceof Error ? e.message : t('editFailed', { ns: 'app' }))
     }
-  }, [app.id, onRefresh, t])
+  }
 
   const onCopy: DuplicateAppModalProps['onConfirm'] = async ({ name, icon_type, icon, icon_background }) => {
     try {
@@ -784,7 +867,11 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
       if (onRefresh)
         onRefresh()
       onPlanInfoChanged()
-      getRedirection(isCurrentWorkspaceEditor, newApp, push)
+      getRedirection(newApp, push, {
+        currentUserId,
+        resourceMaintainer: getAppResourceMaintainer(newApp),
+        workspacePermissionKeys,
+      })
     }
     catch {
       toast.error(t('newApp.appCreateFailed', { ns: 'app' }))
@@ -831,11 +918,11 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
     setShowSwitchModal(false)
   }
 
-  const onUpdateAccessControl = useCallback(() => {
+  function onUpdateAccessControl() {
     if (onRefresh)
       onRefresh()
     setShowAccessControl(false)
-  }, [onRefresh, setShowAccessControl])
+  }
 
   const handleToggleStar = useCallback(async (e: React.MouseEvent<HTMLButtonElement>) => {
     e.stopPropagation()
@@ -856,8 +943,15 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
     }
   }, [app.id, app.is_starred, isTogglingStar, mutateToggleAppStar, onRefresh, t])
 
-  const shouldShowSwitchOption = app.mode === AppModeEnum.COMPLETION || app.mode === AppModeEnum.CHAT
-  const shouldShowAccessControlOption = systemFeatures.webapp_auth.enabled && isCurrentWorkspaceEditor
+  const shouldShowEditOption = appACLCapabilities.canEdit
+  const shouldShowDuplicateOption = canCreateApp
+  const shouldShowExportOption = appACLCapabilities.canImportExportDSL
+  const shouldShowSwitchOption = appACLCapabilities.canEdit && (app.mode === AppModeEnum.COMPLETION || app.mode === AppModeEnum.CHAT)
+  const shouldShowAccessControlOption = systemFeatures.webapp_auth.enabled && appACLCapabilities.canReleaseAndVersion
+  const shouldShowAccessConfigOption = appACLCapabilities.canAccessConfig
+  const shouldShowDeleteOption = appACLCapabilities.canDelete
+  const shouldShowOperationsMenu = shouldShowEditOption || shouldShowDuplicateOption || shouldShowExportOption || shouldShowSwitchOption || shouldShowAccessControlOption || shouldShowAccessConfigOption || shouldShowDeleteOption
+  const shouldShowAppTags = appACLCapabilities.canEdit || canManageAppTags
   const operationsMenuWidthClassName = shouldShowSwitchOption ? 'w-[256px]' : 'w-[216px]'
 
   const editTimeText = useMemo(() => {
@@ -900,7 +994,7 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
   }, [app.id, onlineUsers])
   const appNameId = useId()
   const appDescriptionId = useId()
-  const appHref = getRedirectionPath(isCurrentWorkspaceEditor, app)
+  const appHref = getRedirectionPath(app, maintainerPermissionOptions)
   const starActionLabel = app.is_starred
     ? t('studio.unstarApp', { ns: 'app' })
     : t('studio.starApp', { ns: 'app' })
@@ -956,7 +1050,7 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
             </div>
           </div>
         </Link>
-        {isCurrentWorkspaceEditor && (
+        {shouldShowAppTags && (
           <div
             className="absolute top-[104px] right-3 left-3 flex h-[26px] min-w-0 items-start"
             onClick={(e) => {
@@ -967,6 +1061,7 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
             <AppCardTags
               appId={app.id}
               tags={app.tags}
+              canBindOrUnbindTags={appACLCapabilities.canEdit}
               onOpenTagManagement={onOpenTagManagement}
               onTagsChange={onRefresh}
             />
@@ -1003,7 +1098,7 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
             />
             <TooltipContent>{starActionLabel}</TooltipContent>
           </Tooltip>
-          {isCurrentWorkspaceEditor && (
+          {shouldShowOperationsMenu && (
             <DropdownMenu modal={false} open={isOperationsMenuOpen} onOpenChange={setIsOperationsMenuOpen}>
               <DropdownMenuTrigger
                 aria-label={t('operation.more', { ns: 'common' })}
@@ -1028,28 +1123,40 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
                   ? (
                       <AppCardOperationsMenuContent
                         app={app}
+                        shouldShowEditOption={shouldShowEditOption}
+                        shouldShowDuplicateOption={shouldShowDuplicateOption}
+                        shouldShowExportOption={shouldShowExportOption}
                         shouldShowSwitchOption={shouldShowSwitchOption}
                         shouldShowAccessControlOption={shouldShowAccessControlOption}
+                        shouldShowAccessConfigOption={shouldShowAccessConfigOption}
+                        shouldShowDeleteOption={shouldShowDeleteOption}
                         onEdit={handleShowEditModal}
                         onDuplicate={handleShowDuplicateModal}
                         onExport={exportCheck}
                         onSwitch={handleShowSwitchModal}
                         onDelete={handleShowDeleteConfirm}
                         onAccessControl={handleShowAccessControl}
+                        onAccessConfig={handleOpenAccessConfig}
                       />
                     )
                   : (
                       <AppCardOperationsMenu
                         app={app}
+                        shouldShowEditOption={shouldShowEditOption}
+                        shouldShowDuplicateOption={shouldShowDuplicateOption}
+                        shouldShowExportOption={shouldShowExportOption}
                         shouldShowSwitchOption={shouldShowSwitchOption}
                         shouldShowOpenInExploreOption={!app.has_draft_trigger}
                         shouldShowAccessControlOption={shouldShowAccessControlOption}
+                        shouldShowAccessConfigOption={shouldShowAccessConfigOption}
+                        shouldShowDeleteOption={shouldShowDeleteOption}
                         onEdit={handleShowEditModal}
                         onDuplicate={handleShowDuplicateModal}
                         onExport={exportCheck}
                         onSwitch={handleShowSwitchModal}
                         onDelete={handleShowDeleteConfirm}
                         onAccessControl={handleShowAccessControl}
+                        onAccessConfig={handleOpenAccessConfig}
                       />
                     )}
               </DropdownMenuContent>
@@ -1163,5 +1270,3 @@ const AppCard = ({ app, onlineUsers = [], onRefresh, onOpenTagManagement = () =>
     </>
   )
 }
-
-export default React.memo(AppCard)
diff --git a/web/app/components/apps/app-list-creation-modals.tsx b/web/app/components/apps/app-list-creation-modals.tsx
index e9e0b30c2f9..de5675c864e 100644
--- a/web/app/components/apps/app-list-creation-modals.tsx
+++ b/web/app/components/apps/app-list-creation-modals.tsx
@@ -14,6 +14,7 @@ const CreateAppTemplateDialog = dynamic(() => import('@/app/components/app/creat
 })
 
 export function AppListCreationModals({
+  canCreateApp,
   category,
   droppedDSLFile,
   showCreateFromDSLModal,
@@ -26,6 +27,7 @@ export function AppListCreationModals({
   onSetShowNewAppModal,
   onSetShowNewAppTemplateDialog,
 }: {
+  canCreateApp: boolean
   category: AppListCategory
   droppedDSLFile?: File
   showCreateFromDSLModal: boolean
@@ -38,6 +40,9 @@ export function AppListCreationModals({
   onSetShowNewAppModal: (show: boolean) => void
   onSetShowNewAppTemplateDialog: (show: boolean) => void
 }) {
+  if (!canCreateApp)
+    return null
+
   return (
     <>
       {showCreateFromDSLModal && (
diff --git a/web/app/components/apps/index.tsx b/web/app/components/apps/index.tsx
index 9c994118839..66a9cd6b67f 100644
--- a/web/app/components/apps/index.tsx
+++ b/web/app/components/apps/index.tsx
@@ -5,6 +5,7 @@ import type { TrackCreateAppParams } from '@/utils/create-app-tracking'
 import { useCallback, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useEducationInit } from '@/app/education-apply/hooks'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import AppListContext from '@/context/app-list-context'
 import useDocumentTitle from '@/hooks/use-document-title'
 import { useImportDSL } from '@/hooks/use-import-dsl'
@@ -13,6 +14,7 @@ import dynamic from '@/next/dynamic'
 import { useRouter, useSearchParams } from '@/next/navigation'
 import { fetchAppDetail } from '@/service/explore'
 import { trackCreateApp } from '@/utils/create-app-tracking'
+import { hasPermission } from '@/utils/permission'
 import List from './list'
 
 const DSLConfirmModal = dynamic(() => import('../app/create-from-dsl-modal/dsl-confirm-modal'), { ssr: false })
@@ -24,6 +26,8 @@ const Apps = () => {
   const { t } = useTranslation()
   const searchParams = useSearchParams()
   const { replace } = useRouter()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
   const templateId = searchParams.get('template-id')
   const templateDismissedRef = useRef(false)
 
@@ -48,12 +52,15 @@ const Apps = () => {
   const [isShowCreateModal, setIsShowCreateModal] = useState(false)
 
   const handleShowFromTryApp = useCallback(() => {
+    if (!canCreateApp)
+      return
+
     currentCreateAppTrackingRef.current = {
       source: 'studio_template_preview',
       templateId: currentTryAppParams?.appId || currentTryAppParams?.app.app_id,
     }
     setIsShowCreateModal(true)
-  }, [currentTryAppParams?.app.app_id, currentTryAppParams?.appId])
+  }, [canCreateApp, currentTryAppParams?.app.app_id, currentTryAppParams?.appId])
   const trackCurrentCreateApp = useCallback((appMode?: TryAppSelection['app']['app']['mode'] | null) => {
     const currentCreateAppTracking = currentCreateAppTrackingRef.current
     const resolvedAppMode = appMode ?? currentCreateAppModeRef.current
@@ -102,6 +109,9 @@ const Apps = () => {
   }, [handleImportDSLConfirm, onSuccess, trackCurrentCreateApp])
 
   const handleMarketplaceTemplateConfirm = useCallback(async (dslContent: string) => {
+    if (!canCreateApp)
+      return
+
     currentCreateAppModeRef.current = null
     currentCreateAppTrackingRef.current = {
       source: 'external',
@@ -121,7 +131,7 @@ const Apps = () => {
         setShowDSLConfirmModal(true)
       },
     })
-  }, [handleImportDSL, handleCloseTemplateModal, onSuccess, templateId, trackCurrentCreateApp])
+  }, [canCreateApp, handleImportDSL, handleCloseTemplateModal, onSuccess, templateId, trackCurrentCreateApp])
 
   const onCreate: CreateAppModalProps['onConfirm'] = useCallback(async ({
     name,
@@ -130,6 +140,9 @@ const Apps = () => {
     icon_background,
     description,
   }) => {
+    if (!canCreateApp)
+      return
+
     hideTryAppPanel()
 
     const { export_data, mode } = await fetchAppDetail(
@@ -154,7 +167,7 @@ const Apps = () => {
         setShowDSLConfirmModal(true)
       },
     })
-  }, [currApp?.app.id, handleImportDSL, hideTryAppPanel, trackCurrentCreateApp])
+  }, [canCreateApp, currApp?.app.id, handleImportDSL, hideTryAppPanel, trackCurrentCreateApp])
 
   return (
     <AppListContext.Provider value={{
@@ -202,7 +215,7 @@ const Apps = () => {
           />
         )}
 
-        {templateId && !templateDismissedRef.current && (
+        {canCreateApp && templateId && !templateDismissedRef.current && (
           <ImportFromMarketplaceTemplateModal
             templateId={templateId}
             onClose={handleCloseTemplateModal}
diff --git a/web/app/components/apps/list.tsx b/web/app/components/apps/list.tsx
index b9aad31cf39..7af2adc1a05 100644
--- a/web/app/components/apps/list.tsx
+++ b/web/app/components/apps/list.tsx
@@ -4,10 +4,9 @@ import type { AppListQuery, AppListSortBy } from '@/contract/console/apps'
 import { cn } from '@langgenius/dify-ui/cn'
 import { keepPreviousData, useInfiniteQuery, useQuery, useSuspenseQuery } from '@tanstack/react-query'
 import { useDebounce } from 'ahooks'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
+import { useNeedRefreshAppList } from '@/app/components/apps/storage'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
@@ -15,7 +14,8 @@ import { CheckModal } from '@/hooks/use-pay'
 import { usePathname, useRouter, useSearchParams } from '@/next/navigation'
 import { consoleQuery } from '@/service/client'
 import { AppModeEnum } from '@/types/app'
-import AppCard from './app-card'
+import { hasPermission } from '@/utils/permission'
+import { AppCard } from './app-card'
 import { AppCardSkeleton } from './app-card-skeleton'
 import { AppListCreationModals } from './app-list-creation-modals'
 import { AppListHeaderFilters } from './app-list-header-filters'
@@ -40,7 +40,7 @@ function List({
 }: Props) {
   const { t } = useTranslation()
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const { isCurrentWorkspaceEditor, isCurrentWorkspaceDatasetOperator } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
   const { onPlanInfoChanged } = useProviderContext()
   const searchParams = useSearchParams()
   const pathname = usePathname()
@@ -62,17 +62,21 @@ function List({
   const [showNewAppModal, setShowNewAppModal] = useState(false)
   const [showCreateFromDSLModal, setShowCreateFromDSLModal] = useState(false)
   const [droppedDSLFile, setDroppedDSLFile] = useState<File | undefined>()
-  const [needsRefreshAppList, setNeedsRefreshAppList] = useLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, '0', { raw: true })
+  const [needsRefreshAppList, setNeedsRefreshAppList] = useNeedRefreshAppList()
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
 
   const handleDSLFileDropped = useCallback((file: File) => {
+    if (!canCreateApp)
+      return
+
     setDroppedDSLFile(file)
     setShowCreateFromDSLModal(true)
-  }, [])
+  }, [canCreateApp])
 
   const { dragging } = useDSLDragDrop({
     onDSLFileDropped: handleDSLFileDropped,
     containerRef,
-    enabled: isCurrentWorkspaceEditor,
+    enabled: canCreateApp,
   })
 
   useEffect(() => {
@@ -116,7 +120,6 @@ function List({
       initialPageParam: 1,
       placeholderData: keepPreviousData,
     }),
-    enabled: !isCurrentWorkspaceDatasetOperator,
     refetchInterval: systemFeatures.enable_collaboration_mode ? 10000 : false,
   })
 
@@ -135,7 +138,6 @@ function List({
         query: starredAppListQuery,
       },
     }),
-    enabled: !isCurrentWorkspaceDatasetOperator,
   })
 
   const refreshAppLists = useCallback(() => {
@@ -158,8 +160,6 @@ function List({
   }, [needsRefreshAppList, refetch, setNeedsRefreshAppList])
 
   useEffect(() => {
-    if (isCurrentWorkspaceDatasetOperator)
-      return
     const hasMore = hasNextPage ?? true
     let observer: IntersectionObserver | undefined
 
@@ -184,7 +184,7 @@ function List({
       observer.observe(anchorRef.current)
     }
     return () => observer?.disconnect()
-  }, [isLoading, isFetchingNextPage, fetchNextPage, error, hasNextPage, isCurrentWorkspaceDatasetOperator])
+  }, [isLoading, isFetchingNextPage, fetchNextPage, error, hasNextPage])
 
   const pages = useMemo(() => data?.pages ?? [], [data?.pages])
   const apps = useMemo(() => pages.flatMap(({ data: pageApps }) => pageApps), [pages])
@@ -210,7 +210,19 @@ function List({
   const hasAnyApp = (pages[0]?.total ?? 0) > 0
   const hasActiveFilters = category !== 'all' || tagIDs.length > 0 || keywords.trim().length > 0 || debouncedKeywords.trim().length > 0 || creatorIDs.length > 0
   const showSkeleton = isLoading || (isFetching && pages.length === 0)
-  const showFirstEmptyState = !showSkeleton && !hasAnyApp && isCurrentWorkspaceEditor && hasResolvedFirstPage && !hasActiveFilters
+  const showFirstEmptyState = !showSkeleton && !hasAnyApp && canCreateApp && hasResolvedFirstPage && !hasActiveFilters
+  const openCreateBlankModal = useCallback(() => {
+    if (canCreateApp)
+      setShowNewAppModal(true)
+  }, [canCreateApp])
+  const openCreateTemplateDialog = useCallback(() => {
+    if (canCreateApp)
+      setShowNewAppTemplateDialog(true)
+  }, [canCreateApp])
+  const openCreateFromDSLModal = useCallback(() => {
+    if (canCreateApp)
+      setShowCreateFromDSLModal(true)
+  }, [canCreateApp])
 
   return (
     <>
@@ -238,19 +250,19 @@ function List({
             onKeywordsChange={setKeywords}
             onCreatorIDsChange={setCreatorIDs}
             onSortByChange={setSortBy}
-            onCreateBlank={() => setShowNewAppModal(true)}
-            onCreateTemplate={() => setShowNewAppTemplateDialog(true)}
-            onImportDSL={() => setShowCreateFromDSLModal(true)}
+            onCreateBlank={openCreateBlankModal}
+            onCreateTemplate={openCreateTemplateDialog}
+            onImportDSL={openCreateFromDSLModal}
             onOpenTagManagement={() => setShowTagManagementModal(true)}
-            showCreateButton={isCurrentWorkspaceEditor}
+            showCreateButton={canCreateApp}
           />
         </StudioListHeader>
         {showFirstEmptyState
           ? (
               <FirstEmptyState
-                onCreateBlank={() => setShowNewAppModal(true)}
-                onCreateTemplate={() => setShowNewAppTemplateDialog(true)}
-                onImportDSL={() => setShowCreateFromDSLModal(true)}
+                onCreateBlank={openCreateBlankModal}
+                onCreateTemplate={openCreateTemplateDialog}
+                onImportDSL={openCreateFromDSLModal}
               />
             )
           : (
@@ -258,7 +270,6 @@ function List({
                 {starredApps.length > 0 && (
                   <StarredAppList
                     apps={starredApps}
-                    isCurrentWorkspaceEditor={isCurrentWorkspaceEditor}
                     onRefresh={refreshAppLists}
                   />
                 )}
@@ -287,7 +298,7 @@ function List({
               </>
             )}
 
-        {isCurrentWorkspaceEditor && !showFirstEmptyState && (
+        {canCreateApp && !showFirstEmptyState && (
           <div
             className={`flex items-center justify-center gap-2 py-4 ${dragging ? 'text-text-accent' : 'text-text-quaternary'}`}
             role="region"
@@ -307,6 +318,7 @@ function List({
       </div>
 
       <AppListCreationModals
+        canCreateApp={canCreateApp}
         category={category}
         droppedDSLFile={droppedDSLFile}
         showCreateFromDSLModal={showCreateFromDSLModal}
diff --git a/web/app/components/apps/new-app-card.tsx b/web/app/components/apps/new-app-card.tsx
index 907e98544e4..bc2c5b767fd 100644
--- a/web/app/components/apps/new-app-card.tsx
+++ b/web/app/components/apps/new-app-card.tsx
@@ -9,6 +9,7 @@ import CreateResourceCard, {
   createResourceCardActionClassName,
   createResourceCardActionIconClassName,
 } from '@/app/components/base/create-resource-card'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import AppListContext from '@/context/app-list-context'
 import { useProviderContext } from '@/context/provider-context'
 import dynamic from '@/next/dynamic'
@@ -17,6 +18,7 @@ import {
   useSearchParams,
 } from '@/next/navigation'
 import { AppModeEnum } from '@/types/app'
+import { hasPermission } from '@/utils/permission'
 
 const CreateAppModal = dynamic(() => import('@/app/components/app/create-app-modal'), {
   ssr: false,
@@ -48,10 +50,12 @@ const CreateAppCard = ({
   const searchParams = useSearchParams()
   const { replace } = useRouter()
   const dslUrl = searchParams.get('remoteInstallUrl') || undefined
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
 
   const [showNewAppTemplateDialog, setShowNewAppTemplateDialog] = useState(false)
   const [showNewAppModal, setShowNewAppModal] = useState(false)
-  const [showCreateFromDSLModal, setShowCreateFromDSLModal] = useState(!!dslUrl)
+  const [showCreateFromDSLModal, setShowCreateFromDSLModal] = useState(canCreateApp && !!dslUrl)
 
   const activeTab = useMemo(() => {
     if (dslUrl)
@@ -86,6 +90,18 @@ const CreateAppCard = ({
     }
   }, [controlHideCreateFromTemplatePanel])
 
+  useEffect(() => {
+    if (canCreateApp)
+      return
+
+    setShowNewAppModal(false)
+    setShowNewAppTemplateDialog(false)
+    setShowCreateFromDSLModal(false)
+  }, [canCreateApp])
+
+  if (!canCreateApp)
+    return null
+
   return (
     <>
       <CreateResourceCard
diff --git a/web/app/components/apps/starred-app-card.tsx b/web/app/components/apps/starred-app-card.tsx
index 2d03d766962..1d22a3a4b3b 100644
--- a/web/app/components/apps/starred-app-card.tsx
+++ b/web/app/components/apps/starred-app-card.tsx
@@ -5,6 +5,7 @@ import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { AppTypeIcon } from '@/app/components/app/type-selector'
 import AppIcon from '@/app/components/base/app-icon'
+import { useSelector as useAppContextSelector } from '@/context/app-context'
 import Link from '@/next/link'
 import { getRedirectionPath } from '@/utils/app-redirection'
 import { formatTime } from '@/utils/time'
@@ -12,12 +13,13 @@ import { AppCardActionBar } from './app-card'
 
 type StarredAppCardProps = {
   app: App
-  isCurrentWorkspaceEditor: boolean
   onRefresh?: () => void
 }
 
-export function StarredAppCard({ app, isCurrentWorkspaceEditor, onRefresh }: StarredAppCardProps) {
+export function StarredAppCard({ app, onRefresh }: StarredAppCardProps) {
   const { t } = useTranslation()
+  const currentUserId = useAppContextSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
 
   const editTimeText = useMemo(() => {
     const timestamp = app.updated_at || app.created_at
@@ -30,11 +32,16 @@ export function StarredAppCard({ app, isCurrentWorkspaceEditor, onRefresh }: Sta
     })
     return `${t('segment.editedAt', { ns: 'datasetDocuments' })} ${timeText}`
   }, [app.created_at, app.updated_at, t])
+  const href = getRedirectionPath(app, {
+    currentUserId,
+    resourceMaintainer: app.maintainer,
+    workspacePermissionKeys,
+  })
 
   return (
     <div className="group relative">
       <Link
-        href={getRedirectionPath(isCurrentWorkspaceEditor, app)}
+        href={href}
         className="flex h-[72px] min-w-0 items-center gap-3 overflow-hidden rounded-xl border-[0.5px] border-components-card-border bg-components-card-bg px-4 py-3 shadow-xs outline-hidden transition-shadow duration-200 hover:shadow-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid"
       >
         <div className="relative shrink-0">
diff --git a/web/app/components/apps/starred-app-list.tsx b/web/app/components/apps/starred-app-list.tsx
index 2b106cff515..de527a07a7b 100644
--- a/web/app/components/apps/starred-app-list.tsx
+++ b/web/app/components/apps/starred-app-list.tsx
@@ -7,7 +7,6 @@ import { StarredAppCard } from './starred-app-card'
 
 type StarredAppListProps = {
   apps: App[]
-  isCurrentWorkspaceEditor: boolean
   onRefresh?: () => void
 }
 
@@ -23,7 +22,6 @@ function SectionDivider({ label }: { label: string }) {
 
 export function StarredAppList({
   apps,
-  isCurrentWorkspaceEditor,
   onRefresh,
 }: StarredAppListProps) {
   const { t } = useTranslation()
@@ -39,7 +37,6 @@ export function StarredAppList({
           <StarredAppCard
             key={app.id}
             app={app}
-            isCurrentWorkspaceEditor={isCurrentWorkspaceEditor}
             onRefresh={onRefresh}
           />
         ))}
diff --git a/web/app/components/apps/storage.ts b/web/app/components/apps/storage.ts
new file mode 100644
index 00000000000..bb54f6155dc
--- /dev/null
+++ b/web/app/components/apps/storage.ts
@@ -0,0 +1,14 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+export const NEED_REFRESH_APP_LIST_KEY = 'needRefreshAppList'
+
+const [
+  useNeedRefreshAppList,
+  _useNeedRefreshAppListValue,
+  useSetNeedRefreshAppList,
+] = createLocalStorageState<string>(NEED_REFRESH_APP_LIST_KEY, '0', { raw: true })
+
+export {
+  useNeedRefreshAppList,
+  useSetNeedRefreshAppList,
+}
diff --git a/web/app/components/base/app-icon/index.tsx b/web/app/components/base/app-icon/index.tsx
index 1010720e838..fa83560c0ce 100644
--- a/web/app/components/base/app-icon/index.tsx
+++ b/web/app/components/base/app-icon/index.tsx
@@ -8,10 +8,18 @@ import { useHover } from 'ahooks'
 import { cva } from 'class-variance-authority'
 import { init } from 'emoji-mart'
 import * as React from 'react'
-import { useRef } from 'react'
+import { useRef, useSyncExternalStore } from 'react'
 
 init({ data })
 
+const subscribeHydrationState = () => () => {}
+
+const useIsHydrated = () => useSyncExternalStore(
+  subscribeHydrationState,
+  () => true,
+  () => false,
+)
+
 type AppIconProps = {
   size?: 'xs' | 'tiny' | 'small' | 'medium' | 'large' | 'xl' | 'xxl'
   rounded?: boolean
@@ -105,9 +113,20 @@ const AppIcon: FC<AppIconProps> = ({
 }) => {
   const isValidImageIcon = iconType === 'image' && imageUrl
   const emojiIcon = (icon && icon !== '') ? icon : '🤖'
-  const Icon = <em-emoji key={emojiIcon} id={emojiIcon} />
+  const isHydrated = useIsHydrated()
+  const Icon = isHydrated ? <em-emoji key={emojiIcon} id={emojiIcon} /> : emojiIcon
   const wrapperRef = useRef<HTMLSpanElement>(null)
   const isHovering = useHover(wrapperRef)
+  const handleKeyDown = (event: React.KeyboardEvent<HTMLSpanElement>) => {
+    if (!onClick)
+      return
+
+    if (event.key !== 'Enter' && event.key !== ' ')
+      return
+
+    event.preventDefault()
+    onClick()
+  }
 
   return (
     <span
@@ -115,6 +134,9 @@ const AppIcon: FC<AppIconProps> = ({
       className={cn(appIconVariants({ size, rounded }), className)}
       style={{ background: isValidImageIcon ? undefined : (background || '#FFEAD5') }}
       onClick={onClick}
+      onKeyDown={onClick ? handleKeyDown : undefined}
+      role={onClick ? 'button' : undefined}
+      tabIndex={onClick ? 0 : undefined}
     >
       {
         isValidImageIcon
diff --git a/web/app/components/base/chat/chat-with-history/hooks.tsx b/web/app/components/base/chat/chat-with-history/hooks.tsx
index c2936a71ee5..98840509e94 100644
--- a/web/app/components/base/chat/chat-with-history/hooks.tsx
+++ b/web/app/components/base/chat/chat-with-history/hooks.tsx
@@ -5,10 +5,10 @@ import type { AppData, ConversationItem } from '@/models/share'
 import type { HumanInputFilledFormData, HumanInputFormData } from '@/types/workflow'
 import { toast } from '@langgenius/dify-ui/toast'
 import { noop } from 'es-toolkit/function'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { produce } from 'immer'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useConversationIdInfo, useWebAppSidebarCollapseState } from '@/app/components/base/chat/storage'
 import { getProcessedFilesFromResponse } from '@/app/components/base/file-uploader/utils'
 import { InputVarType } from '@/app/components/workflow/types'
 import { useWebAppStore } from '@/context/web-app-context'
@@ -19,12 +19,8 @@ import { useInvalidateShareConversations, useShareChatList, useShareConversation
 import { TransferMethod } from '@/types/app'
 import { addFileInfos, sortAgentSorts } from '../../../tools/utils'
 import { enrichSubmittedHumanInputFormData } from '../chat/answer/human-input-content/submitted-utils'
-import { CONVERSATION_ID_INFO } from '../constants'
 import { buildChatItemTree, getProcessedSystemVariablesFromUrlParams, getRawInputsFromUrlParams, getRawUserVariablesFromUrlParams } from '../utils'
 
-const WEBAPP_SIDEBAR_COLLAPSE_STORAGE_KEY = 'webappSidebarCollapse'
-const rawStorageOptions = { raw: true } as const
-
 function getFormattedChatList(messages: any[]) {
   const newChatList: ChatItem[] = []
   messages.forEach((item) => {
@@ -129,17 +125,13 @@ export const useChatWithHistory = (installedAppInfo?: InstalledApp) => {
     }
     setLocaleFromProps()
   }, [appData])
-  const [storedSidebarCollapseState, setStoredSidebarCollapseState] = useLocalStorage<string>(
-    WEBAPP_SIDEBAR_COLLAPSE_STORAGE_KEY,
-    undefined,
-    rawStorageOptions,
-  )
+  const [storedSidebarCollapseState, setStoredSidebarCollapseState] = useWebAppSidebarCollapseState()
   const sidebarCollapseState = storedSidebarCollapseState === 'collapsed'
   const handleSidebarCollapse = useCallback((state: boolean) => {
     if (appId)
       setStoredSidebarCollapseState(state ? 'collapsed' : 'expanded')
   }, [appId, setStoredSidebarCollapseState])
-  const [conversationIdInfo, setConversationIdInfo] = useLocalStorage<Record<string, Record<string, string>>>(CONVERSATION_ID_INFO, {})
+  const [conversationIdInfo, setConversationIdInfo] = useConversationIdInfo()
   const currentConversationId = useMemo(() => conversationIdInfo?.[appId || '']?.[userId || 'DEFAULT'] || '', [appId, conversationIdInfo, userId])
   const handleConversationIdInfoChange = useCallback((changeConversationId: string) => {
     if (appId) {
diff --git a/web/app/components/base/chat/chat/answer/__tests__/operation.spec.tsx b/web/app/components/base/chat/chat/answer/__tests__/operation.spec.tsx
index bd3de0cec3a..8281de6fced 100644
--- a/web/app/components/base/chat/chat/answer/__tests__/operation.spec.tsx
+++ b/web/app/components/base/chat/chat/answer/__tests__/operation.spec.tsx
@@ -150,6 +150,7 @@ const mockContextValue: ChatContextValue = {
   onAnnotationAdded: vi.fn(),
   onAnnotationEdited: vi.fn(),
   onAnnotationRemoved: vi.fn(),
+  readonly: false,
 }
 
 vi.mock('../../context', () => ({
@@ -205,6 +206,7 @@ describe('Operation', () => {
     mockContextValue.onAnnotationAdded = vi.fn()
     mockContextValue.onAnnotationEdited = vi.fn()
     mockContextValue.onAnnotationRemoved = vi.fn()
+    mockContextValue.readonly = false
     mockProviderContext.plan.usage.annotatedResponse = 0
     mockProviderContext.enableBilling = false
     mockAddAnnotation.mockResolvedValue({ id: 'ann-new', account: { name: 'Test User' } })
@@ -243,6 +245,30 @@ describe('Operation', () => {
       expect(screen.getByTestId('annotation-ctrl'))!.toBeInTheDocument()
     })
 
+    it('should hide annotation button when chat is readonly', () => {
+      mockContextValue.readonly = true
+      mockContextValue.config = makeChatConfig({
+        supportAnnotation: true,
+        annotation_reply: { id: 'ar-1', score_threshold: 0.5, embedding_model: { embedding_provider_name: '', embedding_model_name: '' }, enabled: true },
+      })
+
+      renderOperation()
+
+      expect(screen.queryByTestId('annotation-ctrl')).not.toBeInTheDocument()
+    })
+
+    it('should hide annotation button when annotation callbacks are incomplete', () => {
+      mockContextValue.onAnnotationEdited = undefined
+      mockContextValue.config = makeChatConfig({
+        supportAnnotation: true,
+        annotation_reply: { id: 'ar-1', score_threshold: 0.5, embedding_model: { embedding_provider_name: '', embedding_model_name: '' }, enabled: true },
+      })
+
+      renderOperation()
+
+      expect(screen.queryByTestId('annotation-ctrl')).not.toBeInTheDocument()
+    })
+
     it('should show prompt log when showPromptLog is true', () => {
       renderOperation({ ...baseProps, showPromptLog: true })
       expect(screen.getByTestId('log-btn'))!.toBeInTheDocument()
@@ -307,6 +333,7 @@ describe('Operation', () => {
       renderOperation({ ...baseProps, item })
       expect(screen.queryByTestId('audio-btn')).not.toBeInTheDocument()
       expect(screen.queryByRole('button', { name: 'operation.copy' })).not.toBeInTheDocument()
+      expect(screen.queryByTestId('annotation-ctrl')).not.toBeInTheDocument()
     })
   })
 
@@ -804,40 +831,22 @@ describe('Operation', () => {
       expect(copy).toHaveBeenCalledWith('Hello world')
     })
 
-    it('should handle editing annotation missing onAnnotationEdited gracefully', async () => {
-      const user = userEvent.setup()
+    it('should hide cached annotation edit controls when chat is readonly', () => {
+      mockContextValue.readonly = true
       mockContextValue.config = makeChatConfig({
         supportAnnotation: true,
         annotation_reply: { id: 'ar-1', score_threshold: 0.5, embedding_model: { embedding_provider_name: '', embedding_model_name: '' }, enabled: true },
         appId: 'test-app',
       })
-      mockContextValue.onAnnotationEdited = undefined
       const item = { ...baseItem, annotation: { id: 'ann-1', created_at: 123, authorName: 'test author' } as unknown as Record<string, unknown> } as unknown as ChatItem
+
       renderOperation({ ...baseProps, item })
-      const editBtn = screen.getByTestId('annotation-edit-btn')
-      await user.click(editBtn)
-      await user.click(screen.getByTestId('modal-edit'))
-      expect(mockContextValue.onAnnotationEdited).toBeUndefined()
+
+      expect(screen.queryByTestId('annotation-edit-btn')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('edit-reply-modal')).not.toBeInTheDocument()
     })
 
-    it('should handle adding annotation missing onAnnotationAdded gracefully', async () => {
-      const user = userEvent.setup()
-      mockContextValue.config = makeChatConfig({
-        supportAnnotation: true,
-        annotation_reply: { id: 'ar-1', score_threshold: 0.5, embedding_model: { embedding_provider_name: '', embedding_model_name: '' }, enabled: true },
-        appId: 'test-app',
-      })
-      mockContextValue.onAnnotationAdded = undefined
-      const item = { ...baseItem, annotation: { id: 'ann-1', created_at: 123, authorName: 'test author' } as unknown as Record<string, unknown> } as unknown as ChatItem
-      renderOperation({ ...baseProps, item })
-      const editBtn = screen.getByTestId('annotation-edit-btn')
-      await user.click(editBtn)
-      await user.click(screen.getByTestId('modal-add'))
-      expect(mockContextValue.onAnnotationAdded).toBeUndefined()
-    })
-
-    it('should handle removing annotation missing onAnnotationRemoved gracefully', async () => {
-      const user = userEvent.setup()
+    it('should hide cached annotation edit controls when mutation callbacks are missing', () => {
       mockContextValue.config = makeChatConfig({
         supportAnnotation: true,
         annotation_reply: { id: 'ar-1', score_threshold: 0.5, embedding_model: { embedding_provider_name: '', embedding_model_name: '' }, enabled: true },
@@ -845,11 +854,11 @@ describe('Operation', () => {
       })
       mockContextValue.onAnnotationRemoved = undefined
       const item = { ...baseItem, annotation: { id: 'ann-1', created_at: 123, authorName: 'test author' } as unknown as Record<string, unknown> } as unknown as ChatItem
+
       renderOperation({ ...baseProps, item })
-      const editBtn = screen.getByTestId('annotation-edit-btn')
-      await user.click(editBtn)
-      await user.click(screen.getByTestId('modal-remove'))
-      expect(mockContextValue.onAnnotationRemoved).toBeUndefined()
+
+      expect(screen.queryByTestId('annotation-edit-btn')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('edit-reply-modal')).not.toBeInTheDocument()
     })
   })
 })
diff --git a/web/app/components/base/chat/chat/answer/operation.tsx b/web/app/components/base/chat/chat/answer/operation.tsx
index 0fac08ede14..f0097eeee8f 100644
--- a/web/app/components/base/chat/chat/answer/operation.tsx
+++ b/web/app/components/base/chat/chat/answer/operation.tsx
@@ -73,6 +73,7 @@ function Operation({
     onAnnotationRemoved,
     onFeedback,
     onRegenerate,
+    readonly,
   } = useChatContext()
   const [isShowReplyModal, setIsShowReplyModal] = useState(false)
   const [isShowFeedbackModal, setIsShowFeedbackModal] = useState(false)
@@ -108,6 +109,8 @@ function Operation({
 
   const shouldShowUserFeedbackBar = !isOpeningStatement && config?.supportFeedback && !!onFeedback && !config?.supportAnnotation
   const shouldShowAdminFeedbackBar = !isOpeningStatement && config?.supportFeedback && !!onFeedback && !!config?.supportAnnotation
+  const canManageAnnotation = !readonly && !!onAnnotationAdded && !!onAnnotationEdited && !!onAnnotationRemoved
+  const shouldShowAnnotationAction = canManageAnnotation && !!config?.supportAnnotation && !!config.annotation_reply?.enabled && !humanInputFormDataList?.length
 
   const userFeedbackLabel = t('table.header.userRate', { ns: 'appLog' }) || 'User feedback'
   const adminFeedbackLabel = t('table.header.adminRate', { ns: 'appLog' }) || 'Admin feedback'
@@ -174,7 +177,7 @@ function Operation({
       width += 28 + 8
     if (!isOpeningStatement && config?.text_to_speech?.enabled)
       width += 26
-    if (!isOpeningStatement && config?.supportAnnotation && config?.annotation_reply?.enabled)
+    if (!isOpeningStatement && shouldShowAnnotationAction)
       width += 26
     if (shouldShowUserFeedbackBar)
       width += hasUserFeedback ? 28 + 8 : 60 + 8
@@ -182,7 +185,7 @@ function Operation({
       width += (hasAdminFeedback ? 28 : 60) + 8 + (hasUserFeedback ? 28 : 0)
 
     return width
-  }, [config?.annotation_reply?.enabled, config?.supportAnnotation, config?.text_to_speech?.enabled, hasAdminFeedback, hasUserFeedback, isOpeningStatement, shouldShowAdminFeedbackBar, shouldShowUserFeedbackBar, showPromptLog])
+  }, [config?.text_to_speech?.enabled, hasAdminFeedback, hasUserFeedback, isOpeningStatement, shouldShowAdminFeedbackBar, shouldShowAnnotationAction, shouldShowUserFeedbackBar, showPromptLog])
 
   const positionRight = useMemo(() => operationWidth < maxSize, [operationWidth, maxSize])
 
@@ -339,7 +342,7 @@ function Operation({
                 <span aria-hidden="true" className="i-ri-reset-left-line size-4" />
               </ActionButton>
             )}
-            {config?.supportAnnotation && config.annotation_reply?.enabled && !humanInputFormDataList?.length && (
+            {shouldShowAnnotationAction && (
               <AnnotationCtrlButton
                 appId={config?.appId || ''}
                 messageId={id}
@@ -353,19 +356,21 @@ function Operation({
           </div>
         )}
       </div>
-      <EditReplyModal
-        isShow={isShowReplyModal}
-        onHide={() => setIsShowReplyModal(false)}
-        query={question}
-        answer={content}
-        onEdited={(editedQuery, editedAnswer) => onAnnotationEdited?.(editedQuery, editedAnswer, index)}
-        onAdded={(annotationId, authorName, editedQuery, editedAnswer) => onAnnotationAdded?.(annotationId, authorName, editedQuery, editedAnswer, index)}
-        appId={config?.appId || ''}
-        messageId={id}
-        annotationId={annotation?.id || ''}
-        createdAt={annotation?.created_at}
-        onRemove={() => onAnnotationRemoved?.(index)}
-      />
+      {canManageAnnotation && (
+        <EditReplyModal
+          isShow={isShowReplyModal}
+          onHide={() => setIsShowReplyModal(false)}
+          query={question}
+          answer={content}
+          onEdited={(editedQuery, editedAnswer) => onAnnotationEdited?.(editedQuery, editedAnswer, index)}
+          onAdded={(annotationId, authorName, editedQuery, editedAnswer) => onAnnotationAdded?.(annotationId, authorName, editedQuery, editedAnswer, index)}
+          appId={config?.appId || ''}
+          messageId={id}
+          annotationId={annotation?.id || ''}
+          createdAt={annotation?.created_at}
+          onRemove={() => onAnnotationRemoved?.(index)}
+        />
+      )}
       {isShowFeedbackModal && (
         <Dialog
           open
diff --git a/web/app/components/base/chat/chat/chat-input-area/index.tsx b/web/app/components/base/chat/chat/chat-input-area/index.tsx
index 406748126ea..ea9e631cba9 100644
--- a/web/app/components/base/chat/chat/chat-input-area/index.tsx
+++ b/web/app/components/base/chat/chat/chat-input-area/index.tsx
@@ -25,6 +25,7 @@ type ChatInputAreaProps = {
   botName?: string
   showFeatureBar?: boolean
   showFileUpload?: boolean
+  featureBarReadonly?: boolean
   featureBarDisabled?: boolean
   onFeatureBarClick?: (state: boolean) => void
   visionConfig?: FileUpload
@@ -43,7 +44,7 @@ type ChatInputAreaProps = {
    */
   sendOnEnter?: boolean
 }
-const ChatInputArea = ({ readonly, botName, showFeatureBar, showFileUpload, featureBarDisabled, onFeatureBarClick, visionConfig, speechToTextConfig = { enabled: true }, onSend, inputs = {}, inputsForm = [], theme, isResponding, disabled, sendOnEnter = true }: ChatInputAreaProps) => {
+const ChatInputArea = ({ readonly, botName, showFeatureBar, showFileUpload, featureBarReadonly = readonly, featureBarDisabled, onFeatureBarClick, visionConfig, speechToTextConfig = { enabled: true }, onSend, inputs = {}, inputsForm = [], theme, isResponding, disabled, sendOnEnter = true }: ChatInputAreaProps) => {
   const { t } = useTranslation()
   const { wrapperRef, textareaRef, textValueRef, holdSpaceRef, handleTextareaResize, isMultipleLine } = useTextAreaHeight()
   const [query, setQuery] = useState('')
@@ -154,7 +155,7 @@ const ChatInputArea = ({ readonly, botName, showFeatureBar, showFileUpload, feat
         </div>
         {isMultipleLine && (<div className="px-[9px]">{operation}</div>)}
       </div>
-      {showFeatureBar && (<FeatureBar showFileUpload={showFileUpload} disabled={featureBarDisabled} onFeatureBarClick={readonly ? noop : onFeatureBarClick} hideEditEntrance={readonly} />)}
+      {showFeatureBar && (<FeatureBar showFileUpload={showFileUpload} disabled={featureBarDisabled} onFeatureBarClick={featureBarReadonly ? noop : onFeatureBarClick} hideEditEntrance={featureBarReadonly} />)}
     </>
   )
 }
diff --git a/web/app/components/base/chat/chat/index.tsx b/web/app/components/base/chat/chat/index.tsx
index f4a32e56072..ffa4158521e 100644
--- a/web/app/components/base/chat/chat/index.tsx
+++ b/web/app/components/base/chat/chat/index.tsx
@@ -64,6 +64,7 @@ export type ChatProps = {
   switchSibling?: (siblingMessageId: string) => void
   showFeatureBar?: boolean
   showFileUpload?: boolean
+  featureBarReadonly?: boolean
   onFeatureBarClick?: (state: boolean) => void
   noSpacing?: boolean
   inputDisabled?: boolean
@@ -109,6 +110,7 @@ const Chat: FC<ChatProps> = ({
   switchSibling,
   showFeatureBar,
   showFileUpload,
+  featureBarReadonly,
   onFeatureBarClick,
   noSpacing,
   inputDisabled,
@@ -242,6 +244,7 @@ const Chat: FC<ChatProps> = ({
                   disabled={inputDisabled}
                   showFeatureBar={showFeatureBar}
                   showFileUpload={showFileUpload}
+                  featureBarReadonly={featureBarReadonly}
                   featureBarDisabled={isResponding}
                   onFeatureBarClick={onFeatureBarClick}
                   visionConfig={config?.file_upload}
diff --git a/web/app/components/base/chat/chat/log/__tests__/index.spec.tsx b/web/app/components/base/chat/chat/log/__tests__/index.spec.tsx
index b59f439f16d..2235c9db1d9 100644
--- a/web/app/components/base/chat/chat/log/__tests__/index.spec.tsx
+++ b/web/app/components/base/chat/chat/log/__tests__/index.spec.tsx
@@ -28,7 +28,6 @@ describe('Log', () => {
   beforeEach(() => {
     vi.mocked(useAppStore).mockImplementation(selector => selector({
       // State properties
-      appSidebarExpand: 'expand',
       currentLogModalActiveTab: 'question',
       showPromptLogModal: false,
       showAgentLogModal: false,
diff --git a/web/app/components/base/chat/embedded-chatbot/hooks.tsx b/web/app/components/base/chat/embedded-chatbot/hooks.tsx
index b9c2df19b3d..34abfad3489 100644
--- a/web/app/components/base/chat/embedded-chatbot/hooks.tsx
+++ b/web/app/components/base/chat/embedded-chatbot/hooks.tsx
@@ -5,10 +5,10 @@ import type { Locale } from '@/i18n-config'
 import type { AppData, ConversationItem } from '@/models/share'
 import { toast } from '@langgenius/dify-ui/toast'
 import { noop } from 'es-toolkit/function'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { produce } from 'immer'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useConversationIdInfo } from '@/app/components/base/chat/storage'
 import { addFileInfos, sortAgentSorts } from '@/app/components/tools/utils'
 import { InputVarType } from '@/app/components/workflow/types'
 import { useWebAppStore } from '@/context/web-app-context'
@@ -18,7 +18,6 @@ import { useInvalidateShareConversations, useShareChatList, useShareConversation
 import { useGetTryAppInfo, useGetTryAppParams } from '@/service/use-try-app'
 import { TransferMethod } from '@/types/app'
 import { getProcessedFilesFromResponse } from '../../file-uploader/utils'
-import { CONVERSATION_ID_INFO } from '../constants'
 import { buildChatItemTree, getProcessedInputsFromUrlParams, getProcessedSystemVariablesFromUrlParams, getProcessedUserVariablesFromUrlParams } from '../utils'
 
 function getFormattedChatList(messages: any[]) {
@@ -102,7 +101,7 @@ export const useEmbeddedChatbot = (appSourceType: AppSourceType, tryAppId?: stri
     }
     setLanguageFromParams()
   }, [appInfo])
-  const [conversationIdInfo, setConversationIdInfo] = useLocalStorage<Record<string, Record<string, string>>>(CONVERSATION_ID_INFO, {})
+  const [conversationIdInfo, setConversationIdInfo] = useConversationIdInfo()
   const removeConversationIdInfo = useCallback((appId: string) => {
     setConversationIdInfo((prev) => {
       const newInfo = { ...prev }
diff --git a/web/app/components/base/chat/storage.ts b/web/app/components/base/chat/storage.ts
new file mode 100644
index 00000000000..d31b5778615
--- /dev/null
+++ b/web/app/components/base/chat/storage.ts
@@ -0,0 +1,19 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+import { CONVERSATION_ID_INFO } from './constants'
+
+const [
+  useConversationIdInfo,
+  _useConversationIdInfoValue,
+  _useSetConversationIdInfo,
+] = createLocalStorageState<Record<string, Record<string, string>>>(CONVERSATION_ID_INFO, {})
+
+const [
+  useWebAppSidebarCollapseState,
+  _useWebAppSidebarCollapseStateValue,
+  _useSetWebAppSidebarCollapseState,
+] = createLocalStorageState<string>('webappSidebarCollapse', undefined, { raw: true })
+
+export {
+  useConversationIdInfo,
+  useWebAppSidebarCollapseState,
+}
diff --git a/web/app/components/base/features/new-feature-panel/__tests__/index.spec.tsx b/web/app/components/base/features/new-feature-panel/__tests__/index.spec.tsx
index 4947d2c7c01..7946523c7ba 100644
--- a/web/app/components/base/features/new-feature-panel/__tests__/index.spec.tsx
+++ b/web/app/components/base/features/new-feature-panel/__tests__/index.spec.tsx
@@ -57,6 +57,7 @@ const renderPanel = (props: Partial<{
   onClose: () => void
   inWorkflow: boolean
   showFileUpload: boolean
+  showAnnotationReply: boolean
 }> = {}) => {
   return render(
     <FeaturesProvider features={defaultFeatures}>
@@ -68,6 +69,7 @@ const renderPanel = (props: Partial<{
         onClose={props.onClose ?? vi.fn()}
         inWorkflow={props.inWorkflow}
         showFileUpload={props.showFileUpload}
+        showAnnotationReply={props.showAnnotationReply}
       />
     </FeaturesProvider>,
   )
@@ -191,5 +193,11 @@ describe('NewFeaturePanel', () => {
 
       expect(screen.queryByText(/feature\.annotation\.title/)).not.toBeInTheDocument()
     })
+
+    it('should not render AnnotationReply when showAnnotationReply is false', () => {
+      renderPanel({ isChatMode: true, inWorkflow: false, showAnnotationReply: false })
+
+      expect(screen.queryByText(/feature\.annotation\.title/)).not.toBeInTheDocument()
+    })
   })
 })
diff --git a/web/app/components/base/features/new-feature-panel/index.tsx b/web/app/components/base/features/new-feature-panel/index.tsx
index 3c8f441521a..2cb21d9382c 100644
--- a/web/app/components/base/features/new-feature-panel/index.tsx
+++ b/web/app/components/base/features/new-feature-panel/index.tsx
@@ -1,3 +1,4 @@
+import type { ReactNode } from 'react'
 import type { OnFeaturesChange } from '@/app/components/base/features/types'
 import type { InputVar } from '@/app/components/workflow/types'
 import type { PromptVariable } from '@/models/debug'
@@ -26,9 +27,14 @@ type Props = Readonly<{
   onClose: () => void
   inWorkflow?: boolean
   showFileUpload?: boolean
+  showModeration?: boolean
+  showAnnotationReply?: boolean
   promptVariables?: PromptVariable[]
   workflowVariables?: InputVar[]
   onAutoAddPromptVariable?: (variable: PromptVariable[]) => void
+  title?: ReactNode
+  description?: ReactNode
+  drawerClassName?: string
 }>
 
 const NewFeaturePanel = ({
@@ -39,9 +45,14 @@ const NewFeaturePanel = ({
   onClose,
   inWorkflow = true,
   showFileUpload = true,
+  showModeration = true,
+  showAnnotationReply = true,
   promptVariables,
   workflowVariables,
   onAutoAddPromptVariable,
+  title,
+  description,
+  drawerClassName,
 }: Props) => {
   const { t } = useTranslation()
   const { data: speech2textDefaultModel } = useDefaultModel(ModelTypeEnum.speech2text)
@@ -52,13 +63,14 @@ const NewFeaturePanel = ({
       show={show}
       onClose={onClose}
       inWorkflow={inWorkflow}
+      className={drawerClassName}
     >
       <div className="flex h-full grow flex-col">
         {/* header */}
         <div className="flex shrink-0 justify-between p-4 pb-3">
           <div>
-            <div className="system-xl-semibold text-text-primary">{t('common.features', { ns: 'workflow' })}</div>
-            <div className="body-xs-regular text-text-tertiary">{t('common.featuresDescription', { ns: 'workflow' })}</div>
+            <div className="system-xl-semibold text-text-primary">{title ?? t('common.features', { ns: 'workflow' })}</div>
+            <div className="body-xs-regular text-text-tertiary">{description ?? t('common.featuresDescription', { ns: 'workflow' })}</div>
           </div>
           <DrawerCloseButton
             aria-label={t('operation.close', { ns: 'common' })}
@@ -93,8 +105,8 @@ const NewFeaturePanel = ({
           {isChatMode && (
             <Citation disabled={disabled} onChange={onChange} />
           )}
-          {(isChatMode || !inWorkflow) && <Moderation disabled={disabled} onChange={onChange} />}
-          {!inWorkflow && isChatMode && (
+          {showModeration && (isChatMode || !inWorkflow) && <Moderation disabled={disabled} onChange={onChange} />}
+          {showAnnotationReply && !inWorkflow && isChatMode && (
             <AnnotationReply disabled={disabled} onChange={onChange} />
           )}
         </div>
diff --git a/web/app/components/base/features/new-feature-panel/moderation/__tests__/moderation-setting-modal.spec.tsx b/web/app/components/base/features/new-feature-panel/moderation/__tests__/moderation-setting-modal.spec.tsx
index 4f55e6eb7b2..c6359f3713b 100644
--- a/web/app/components/base/features/new-feature-panel/moderation/__tests__/moderation-setting-modal.spec.tsx
+++ b/web/app/components/base/features/new-feature-panel/moderation/__tests__/moderation-setting-modal.spec.tsx
@@ -302,6 +302,37 @@ describe('ModerationSettingModal', () => {
     }))
   })
 
+  it('should save the latest preset response when content textarea changes', async () => {
+    const data: ModerationConfig = {
+      ...defaultData,
+      config: {
+        keywords: 'bad',
+        inputs_config: { enabled: true, preset_response: 'blocked' },
+        outputs_config: { enabled: false, preset_response: '' },
+      },
+    }
+    await renderModal(
+      <ModerationSettingModal
+        data={data}
+        onCancel={vi.fn()}
+        onSave={onSave}
+      />,
+    )
+
+    fireEvent.change(screen.getByRole('textbox', { name: /feature\.moderation\.modal\.content\.preset/ }), {
+      target: { value: 'updated blocked response' },
+    })
+    fireEvent.click(screen.getByText(/operation\.save/))
+
+    expect(onSave).toHaveBeenCalledWith(expect.objectContaining({
+      config: expect.objectContaining({
+        inputs_config: expect.objectContaining({
+          preset_response: 'updated blocked response',
+        }),
+      }),
+    }))
+  })
+
   it('should show api selector when api type is selected', async () => {
     await renderModal(
       <ModerationSettingModal
@@ -702,7 +733,10 @@ describe('ModerationSettingModal', () => {
 
     expect(mockSetShowAccountSettingModal).toHaveBeenCalled()
 
-    expect(mockSetShowAccountSettingModal).toHaveBeenCalledWith({ payload: 'provider' })
+    expect(mockSetShowAccountSettingModal).toHaveBeenCalledWith({
+      payload: 'provider',
+      onCancelCallback: expect.any(Function),
+    })
   })
 
   it('should not save when OpenAI type is selected but not configured', async () => {
diff --git a/web/app/components/base/features/new-feature-panel/moderation/moderation-content.tsx b/web/app/components/base/features/new-feature-panel/moderation/moderation-content.tsx
index 9df107bf848..b008490ae6f 100644
--- a/web/app/components/base/features/new-feature-panel/moderation/moderation-content.tsx
+++ b/web/app/components/base/features/new-feature-panel/moderation/moderation-content.tsx
@@ -2,6 +2,7 @@ import type { FC } from 'react'
 import type { ModerationContentConfig } from '@/models/debug'
 import { Switch } from '@langgenius/dify-ui/switch'
 import { Textarea } from '@langgenius/dify-ui/textarea'
+import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 
 type ModerationContentProps = {
@@ -19,57 +20,71 @@ const ModerationContent: FC<ModerationContentProps> = ({
   onConfigChange,
 }) => {
   const { t } = useTranslation()
+  const [presetResponse, setPresetResponse] = useState(config.preset_response || '')
 
   const handleConfigChange = (field: string, value: boolean | string) => {
     if (field === 'preset_response' && typeof value === 'string')
       value = value.slice(0, 100)
-    onConfigChange({ ...config, [field]: value })
+
+    onConfigChange({
+      ...config,
+      preset_response: field === 'preset_response' ? value as string : presetResponse,
+      [field]: value,
+    })
+  }
+
+  const handlePresetResponseChange = (value: string) => {
+    const nextValue = value.slice(0, 100)
+    setPresetResponse(nextValue)
+    handleConfigChange('preset_response', nextValue)
   }
 
   return (
-    <div className="py-2">
-      <div className="rounded-lg border border-components-panel-border bg-components-panel-bg">
-        <div className="flex h-10 items-center justify-between rounded-lg px-3">
-          <div className="shrink-0 text-sm font-medium text-text-primary">{title}</div>
-          <div className="flex grow items-center justify-end">
-            {
-              info && (
-                <div className="mr-2 truncate text-xs text-text-tertiary" title={info}>{info}</div>
-              )
-            }
-            <Switch
-              size="lg"
-              checked={config.enabled}
-              onCheckedChange={v => handleConfigChange('enabled', v)}
-            />
-          </div>
+    <div className="rounded-xl border-[0.5px] border-components-panel-border-subtle bg-components-panel-on-panel-item-bg shadow-xs">
+      <div className="flex min-h-10 items-center gap-2 px-3 py-2">
+        <div className="min-w-0 flex-1 system-sm-medium text-text-secondary">{title}</div>
+        <div className="flex min-w-0 shrink-0 items-center justify-end">
+          {
+            info && (
+              <div className="mr-2 truncate system-xs-regular text-text-tertiary" title={info}>{info}</div>
+            )
+          }
+          <Switch
+            checked={config.enabled}
+            onCheckedChange={v => handleConfigChange('enabled', v)}
+          />
         </div>
-        {
-          config.enabled && showPreset && (
-            <div className="rounded-lg bg-components-panel-bg px-3 pt-1 pb-3">
-              <div className="flex h-8 items-center justify-between text-[13px] font-medium text-text-secondary">
+      </div>
+      {
+        config.enabled && showPreset && (
+          <div className="px-3 pt-0.5 pb-3">
+            <div className="flex h-8 items-center justify-between gap-2">
+              <span className="system-2xs-medium-uppercase text-text-secondary">
                 {t('feature.moderation.modal.content.preset', { ns: 'appDebug' })}
-                <span className="text-xs font-normal text-text-tertiary">{t('feature.moderation.modal.content.supportMarkdown', { ns: 'appDebug' })}</span>
-              </div>
-              {/* Keep this counter composed locally; extract only if more textarea counter cases repeat. */}
-              <div className="relative h-20">
-                <Textarea
-                  aria-label={t('feature.moderation.modal.content.preset', { ns: 'appDebug' }) as string}
-                  value={config.preset_response || ''}
-                  className="size-full resize-none pb-8"
-                  placeholder={t('feature.moderation.modal.content.placeholder', { ns: 'appDebug' }) || ''}
-                  onValueChange={value => handleConfigChange('preset_response', value)}
-                />
-                <div className="absolute right-2 bottom-2 flex h-5 items-center rounded-md bg-background-section px-1 text-xs font-medium text-text-quaternary">
-                  <span>{(config.preset_response || '').length}</span>
-                  /
-                  <span className="text-text-tertiary">100</span>
-                </div>
+              </span>
+              <span className="flex shrink-0 items-center gap-0.5 rounded bg-background-section px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary">
+                <span className="i-ri-markdown-line size-3" aria-hidden />
+                {t('feature.moderation.modal.content.supportMarkdown', { ns: 'appDebug' })}
+              </span>
+            </div>
+            {/* Keep this counter composed locally; extract only if more textarea counter cases repeat. */}
+            <div className="relative h-20">
+              <Textarea
+                aria-label={t('feature.moderation.modal.content.preset', { ns: 'appDebug' }) as string}
+                value={presetResponse}
+                className="size-full resize-none pb-8"
+                placeholder={t('feature.moderation.modal.content.placeholder', { ns: 'appDebug' }) || ''}
+                onValueChange={handlePresetResponseChange}
+              />
+              <div className="absolute right-2 bottom-2 flex h-5 items-center rounded-md bg-background-section px-1 system-2xs-medium-uppercase text-text-quaternary">
+                <span>{presetResponse.length}</span>
+                /
+                <span className="text-text-tertiary">100</span>
               </div>
             </div>
-          )
-        }
-      </div>
+          </div>
+        )
+      }
     </div>
   )
 }
diff --git a/web/app/components/base/features/new-feature-panel/moderation/moderation-setting-modal.tsx b/web/app/components/base/features/new-feature-panel/moderation/moderation-setting-modal.tsx
index 163f13819a7..313e399e2e5 100644
--- a/web/app/components/base/features/new-feature-panel/moderation/moderation-setting-modal.tsx
+++ b/web/app/components/base/features/new-feature-panel/moderation/moderation-setting-modal.tsx
@@ -1,4 +1,4 @@
-import type { FC } from 'react'
+import type { FC, ReactNode } from 'react'
 import type { CodeBasedExtensionItem } from '@/models/common'
 import type { ModerationConfig, ModerationContentConfig } from '@/models/debug'
 import { Button } from '@langgenius/dify-ui/button'
@@ -6,7 +6,7 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
 import { Textarea } from '@langgenius/dify-ui/textarea'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useState } from 'react'
+import { useCallback, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Divider from '@/app/components/base/divider'
 import { ApiBasedExtensionSelector } from '@/app/components/header/account-setting/api-based-extension-page/selector'
@@ -27,6 +27,27 @@ type Provider = {
   form_schema?: CodeBasedExtensionItem['form_schema']
 }
 
+function ProviderIcon({ type }: { type: string }) {
+  if (type === 'openai_moderation')
+    return <span className="i-ri-openai-fill size-4 text-text-secondary" aria-hidden />
+
+  if (type === 'keywords')
+    return <span className="i-ri-search-line size-4 text-util-colors-green-green-600" aria-hidden />
+
+  return <span className="i-ri-image-line size-4 text-util-colors-violet-violet-600" aria-hidden />
+}
+
+function LabeledDivider({ children }: { children: ReactNode }) {
+  return (
+    <div className="flex w-full items-center gap-2">
+      <span className="shrink-0 system-xs-medium-uppercase text-text-tertiary">
+        {children}
+      </span>
+      <Divider bgStyle="gradient" className="my-0 h-px flex-1" />
+    </div>
+  )
+}
+
 type ModerationSettingModalProps = {
   data: ModerationConfig
   onCancel: () => void
@@ -41,12 +62,27 @@ const ModerationSettingModal: FC<ModerationSettingModalProps> = ({
   const { t } = useTranslation()
   const docLink = useDocLink()
   const locale = useLocale()
-  const { data: modelProviders, isPending: isLoading } = useModelProviders()
+  const { data: modelProviders, isPending: isLoading, refetch: refetchModelProviders } = useModelProviders()
+  const localeDataRef = useRef<ModerationConfig>(data)
   const [localeData, setLocaleData] = useState<ModerationConfig>(data)
   const openIntegrationsSetting = useIntegrationsSetting()
+  const updateLocaleData = useCallback((
+    update: ModerationConfig | ((current: ModerationConfig) => ModerationConfig),
+    options: { render?: boolean } = {},
+  ) => {
+    const nextLocaleData = typeof update === 'function'
+      ? update(localeDataRef.current)
+      : update
+
+    localeDataRef.current = nextLocaleData
+
+    if (options.render !== false)
+      setLocaleData(nextLocaleData)
+  }, [])
   const handleOpenSettingsModal = () => {
     openIntegrationsSetting({
       payload: ACCOUNT_SETTING_TAB.PROVIDER,
+      onCancelCallback: refetchModelProviders,
     })
   }
   const { data: codeBasedExtensionList } = useCodeBasedExtensions('moderation')
@@ -85,20 +121,20 @@ const ModerationSettingModal: FC<ModerationSettingModalProps> = ({
   const currentProvider = providers.find(provider => provider.key === localeData.type)
 
   const handleDataTypeChange = (type: string) => {
-    let config: undefined | Record<string, any>
+    let config: undefined | Record<string, string>
     const currProvider = providers.find(provider => provider.key === type)
 
     if (systemTypes.findIndex(t => t === type) < 0 && currProvider?.form_schema) {
       config = currProvider?.form_schema.reduce((prev, next) => {
         prev[next.variable] = next.default
         return prev
-      }, {} as Record<string, any>)
+      }, {} as Record<string, string>)
     }
-    setLocaleData({
-      ...localeData,
+    updateLocaleData(current => ({
+      ...current,
       type,
       config,
-    })
+    }))
   }
 
   const handleDataKeywordsChange = (value: string) => {
@@ -111,43 +147,46 @@ const ModerationSettingModal: FC<ModerationSettingModalProps> = ({
       return prev
     }, [])
 
-    setLocaleData({
-      ...localeData,
+    updateLocaleData(current => ({
+      ...current,
       config: {
-        ...localeData.config,
+        ...current.config,
         keywords: arr.slice(0, 100).join('\n'),
       },
-    })
+    }))
   }
 
   const handleDataContentChange = (contentType: string, contentConfig: ModerationContentConfig) => {
-    setLocaleData({
-      ...localeData,
+    const previousContentConfig = localeDataRef.current.config?.[contentType] as ModerationContentConfig | undefined
+    const shouldRender = previousContentConfig?.enabled !== contentConfig.enabled
+
+    updateLocaleData(current => ({
+      ...current,
       config: {
-        ...localeData.config,
+        ...current.config,
         [contentType]: contentConfig,
       },
-    })
+    }), { render: shouldRender })
   }
 
   const handleDataApiBasedChange = (apiBasedExtensionId: string) => {
-    setLocaleData({
-      ...localeData,
+    updateLocaleData(current => ({
+      ...current,
       config: {
-        ...localeData.config,
+        ...current.config,
         api_based_extension_id: apiBasedExtensionId,
       },
-    })
+    }))
   }
 
   const handleDataExtraChange = (extraValue: Record<string, string>) => {
-    setLocaleData({
-      ...localeData,
+    updateLocaleData(current => ({
+      ...current,
       config: {
-        ...localeData.config,
+        ...current.config,
         ...extraValue,
       },
-    })
+    }))
   }
 
   const formatData = (originData: ModerationConfig) => {
@@ -179,115 +218,116 @@ const ModerationSettingModal: FC<ModerationSettingModalProps> = ({
   }
 
   const handleSave = () => {
+    const currentLocaleData = localeDataRef.current
+    const providerForSave = providers.find(provider => provider.key === currentLocaleData.type)
+
     /* v8 ignore next -- UI-invariant guard: same condition is used in Save button disabled logic, so when true handleSave has no user-triggerable invocation path. @preserve */
-    if (localeData.type === 'openai_moderation' && !isOpenAIProviderConfigured)
+    if (currentLocaleData.type === 'openai_moderation' && !isOpenAIProviderConfigured)
       return
 
-    if (!localeData.config?.inputs_config?.enabled && !localeData.config?.outputs_config?.enabled) {
+    if (!currentLocaleData.config?.inputs_config?.enabled && !currentLocaleData.config?.outputs_config?.enabled) {
       toast.error(t('feature.moderation.modal.content.condition', { ns: 'appDebug' }))
       return
     }
 
-    if (localeData.type === 'keywords' && !localeData.config.keywords) {
+    if (currentLocaleData.type === 'keywords' && !currentLocaleData.config.keywords) {
       toast.error(t('errorMessage.valueOfVarRequired', { ns: 'appDebug', key: locale !== LanguagesSupported[1] ? 'keywords' : '关键词' }))
       return
     }
 
-    if (localeData.type === 'api' && !localeData.config.api_based_extension_id) {
+    if (currentLocaleData.type === 'api' && !currentLocaleData.config.api_based_extension_id) {
       toast.error(t('errorMessage.valueOfVarRequired', { ns: 'appDebug', key: locale !== LanguagesSupported[1] ? 'API Extension' : 'API 扩展' }))
       return
     }
 
-    if (systemTypes.findIndex(t => t === localeData.type) < 0 && currentProvider?.form_schema) {
-      for (let i = 0; i < currentProvider.form_schema.length; i++) {
-        if (!localeData.config?.[currentProvider.form_schema[i]!.variable] && currentProvider.form_schema[i]!.required) {
-          toast.error(t('errorMessage.valueOfVarRequired', { ns: 'appDebug', key: locale !== LanguagesSupported[1] ? currentProvider.form_schema[i]!.label['en-US'] : currentProvider.form_schema[i]!.label['zh-Hans'] }))
+    if (systemTypes.findIndex(t => t === currentLocaleData.type) < 0 && providerForSave?.form_schema) {
+      for (let i = 0; i < providerForSave.form_schema.length; i++) {
+        if (!currentLocaleData.config?.[providerForSave.form_schema[i]!.variable] && providerForSave.form_schema[i]!.required) {
+          toast.error(t('errorMessage.valueOfVarRequired', { ns: 'appDebug', key: locale !== LanguagesSupported[1] ? providerForSave.form_schema[i]!.label['en-US'] : providerForSave.form_schema[i]!.label['zh-Hans'] }))
           return
         }
       }
     }
 
-    if (localeData.config.inputs_config?.enabled && !localeData.config.inputs_config.preset_response && localeData.type !== 'api') {
+    if (currentLocaleData.config.inputs_config?.enabled && !currentLocaleData.config.inputs_config.preset_response && currentLocaleData.type !== 'api') {
       toast.error(t('feature.moderation.modal.content.errorMessage', { ns: 'appDebug' }))
       return
     }
 
-    if (localeData.config.outputs_config?.enabled && !localeData.config.outputs_config.preset_response && localeData.type !== 'api') {
+    if (currentLocaleData.config.outputs_config?.enabled && !currentLocaleData.config.outputs_config.preset_response && currentLocaleData.type !== 'api') {
       toast.error(t('feature.moderation.modal.content.errorMessage', { ns: 'appDebug' }))
       return
     }
 
-    onSave(formatData(localeData))
+    onSave(formatData(currentLocaleData))
   }
 
   return (
     <Dialog open>
-      <DialogContent className="mt-14! w-[600px]! max-w-none! border-none p-6! text-left align-middle">
-
-        <div className="flex items-center justify-between">
-          <div className="title-2xl-semi-bold text-text-primary">{t('feature.moderation.modal.title', { ns: 'appDebug' })}</div>
+      <DialogContent className="mt-14! w-[600px]! max-w-none! overflow-hidden border-[0.5px]! border-components-panel-border! p-0! text-left align-middle">
+        <div className="flex items-start gap-2 px-6 pt-6 pr-14 pb-3">
+          <div className="title-2xl-semi-bold text-text-primary">
+            {t('feature.moderation.modal.title', { ns: 'appDebug' })}
+          </div>
           <button
             type="button"
             aria-label={t('operation.close', { ns: 'common' })}
-            className="cursor-pointer border-none bg-transparent p-1 focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
+            className="absolute top-5 right-5 flex size-8 cursor-pointer items-center justify-center rounded-lg border-none bg-transparent text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
             onClick={onCancel}
           >
-            <span className="i-ri-close-line size-4 text-text-tertiary" aria-hidden="true" />
+            <span className="i-ri-close-line size-[18px]" aria-hidden="true" />
           </button>
         </div>
-        <div className="py-2">
-          <div className="text-sm/9 font-medium text-text-primary">
-            {t('feature.moderation.modal.provider.title', { ns: 'appDebug' })}
-          </div>
-          <div className="grid grid-cols-3 gap-2.5">
-            {
-              providers.map(provider => (
-                <div
+        <div className="flex flex-col gap-4 px-6 py-3">
+          <div className="flex flex-col gap-1">
+            <div className="system-sm-medium text-text-secondary">
+              {t('feature.moderation.modal.provider.title', { ns: 'appDebug' })}
+            </div>
+            <div className="grid grid-cols-3 gap-2">
+              {providers.map(provider => (
+                <button
+                  type="button"
                   key={provider.key}
                   className={cn(
-                    'flex h-8 cursor-default items-center rounded-md border border-components-option-card-option-border bg-components-option-card-option-bg px-2 system-sm-regular text-text-secondary',
-                    localeData.type !== provider.key && 'cursor-pointer hover:border-components-option-card-option-border-hover hover:bg-components-option-card-option-bg-hover hover:shadow-xs',
-                    localeData.type === provider.key && 'border-[1.5px] border-components-option-card-option-selected-border bg-components-option-card-option-selected-bg system-sm-medium shadow-xs',
+                    'flex min-h-[68px] flex-col items-start justify-center gap-1.5 rounded-xl border border-components-option-card-option-border bg-components-option-card-option-bg px-3 py-2 text-left text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+                    localeData.type !== provider.key && 'hover:border-components-option-card-option-border-hover hover:bg-components-option-card-option-bg-hover hover:shadow-xs',
+                    localeData.type === provider.key && 'border-[1.5px] border-components-option-card-option-selected-border bg-components-option-card-option-selected-bg shadow-xs',
                     localeData.type === 'openai_moderation' && provider.key === 'openai_moderation' && !isOpenAIProviderConfigured && 'text-text-disabled',
                   )}
                   onClick={() => handleDataTypeChange(provider.key)}
                 >
-                  <div className={cn(
-                    'mr-2 size-4 rounded-full border border-components-radio-border bg-components-radio-bg shadow-xs',
-                    localeData.type === provider.key && 'border-[5px] border-components-radio-border-checked',
-                  )}
-                  >
+                  <div className="flex size-8 items-center justify-center rounded-lg border-[0.5px] border-divider-regular bg-background-default-dodge">
+                    <ProviderIcon type={provider.key} />
                   </div>
-                  {provider.name}
-                </div>
-              ))
-            }
-          </div>
-          {
-            !isLoading && !isOpenAIProviderConfigured && localeData.type === 'openai_moderation' && (
+                  <span className="w-full truncate system-xs-regular">
+                    {provider.name}
+                  </span>
+                </button>
+              ))}
+            </div>
+            {!isLoading && !isOpenAIProviderConfigured && localeData.type === 'openai_moderation' && (
               <div className="mt-2 flex items-center rounded-lg border border-[#FEF0C7] bg-[#FFFAEB] px-3 py-2">
                 <span className="mr-1 i-custom-vender-line-general-info-circle h-4 w-4 text-[#F79009]" />
                 <div className="flex items-center text-xs font-medium text-gray-700">
                   {t('feature.moderation.modal.openaiNotConfig.before', { ns: 'appDebug' })}
-                  <span
+                  <button
+                    type="button"
                     className="cursor-pointer text-primary-600"
                     onClick={handleOpenSettingsModal}
                   >
-                  &nbsp;
+                    &nbsp;
                     {t('settings.provider', { ns: 'common' })}
-&nbsp;
-                  </span>
+                    &nbsp;
+                  </button>
                   {t('feature.moderation.modal.openaiNotConfig.after', { ns: 'appDebug' })}
                 </div>
               </div>
-            )
-          }
-        </div>
-        {
-          localeData.type === 'keywords' && (
-            <div className="py-2">
-              <div className="mb-1 text-sm font-medium text-text-primary">{t('feature.moderation.modal.provider.keywords', { ns: 'appDebug' })}</div>
-              <div className="mb-2 text-xs text-text-tertiary">{t('feature.moderation.modal.keywords.tip', { ns: 'appDebug' })}</div>
+            )}
+          </div>
+          {localeData.type === 'keywords' && (
+            <div className="flex flex-col gap-1">
+              <div className="system-sm-medium text-text-secondary">{t('feature.moderation.modal.provider.keywords', { ns: 'appDebug' })}</div>
+              <div className="system-xs-regular text-text-tertiary">{t('feature.moderation.modal.keywords.tip', { ns: 'appDebug' })}</div>
               {/* Keep this counter composed locally; extract only if more textarea counter cases repeat. */}
               <div className="relative h-[88px]">
                 <Textarea
@@ -297,7 +337,7 @@ const ModerationSettingModal: FC<ModerationSettingModalProps> = ({
                   className="size-full resize-none pb-8"
                   placeholder={t('feature.moderation.modal.keywords.placeholder', { ns: 'appDebug' }) || ''}
                 />
-                <div className="absolute right-2 bottom-2 flex h-5 items-center rounded-md bg-background-section px-1 text-xs font-medium text-text-quaternary">
+                <div className="absolute right-2 bottom-2 flex h-5 items-center rounded-md bg-background-section px-1 system-2xs-medium-uppercase text-text-quaternary">
                   <span>{(localeData.config?.keywords || '').split('\n').filter(Boolean).length}</span>
                   /
                   <span className="text-text-tertiary">
@@ -307,18 +347,16 @@ const ModerationSettingModal: FC<ModerationSettingModalProps> = ({
                 </div>
               </div>
             </div>
-          )
-        }
-        {
-          localeData.type === 'api' && (
-            <div className="py-2">
-              <div className="flex h-9 items-center justify-between">
-                <div className="text-sm font-medium text-text-primary">{t('apiBasedExtension.selector.title', { ns: 'common' })}</div>
+          )}
+          {localeData.type === 'api' && (
+            <div className="flex flex-col gap-1">
+              <div className="flex h-6 items-center justify-between">
+                <div className="system-sm-medium text-text-secondary">{t('apiBasedExtension.selector.title', { ns: 'common' })}</div>
                 <a
                   href={docLink('/use-dify/workspace/api-extension/api-extension')}
                   target="_blank"
                   rel="noopener noreferrer"
-                  className="group flex items-center text-xs text-text-tertiary hover:text-primary-600"
+                  className="group flex items-center system-xs-regular text-text-tertiary hover:text-primary-600"
                 >
                   <span className="mr-1 i-custom-vender-line-education-book-open-01 size-3 text-text-tertiary group-hover:text-primary-600" />
                   {t('apiBasedExtension.link', { ns: 'common' })}
@@ -329,46 +367,51 @@ const ModerationSettingModal: FC<ModerationSettingModalProps> = ({
                 onChange={handleDataApiBasedChange}
               />
             </div>
-          )
-        }
-        {
-          systemTypes.findIndex(t => t === localeData.type) < 0
-          && currentProvider?.form_schema
-          && (
-            <FormGeneration
-              forms={currentProvider?.form_schema}
-              value={localeData.config}
-              onChange={handleDataExtraChange}
+          )}
+          {systemTypes.findIndex(t => t === localeData.type) < 0
+            && currentProvider?.form_schema
+            && (
+              <FormGeneration
+                forms={currentProvider?.form_schema}
+                value={localeData.config}
+                onChange={handleDataExtraChange}
+              />
+            )}
+          <div className="flex flex-col gap-2">
+            <LabeledDivider>{t('feature.moderation.title', { ns: 'appDebug' })}</LabeledDivider>
+            <ModerationContent
+              key={`inputs-${localeData.type}-${localeData.config?.inputs_config?.preset_response ?? ''}`}
+              title={t('feature.moderation.modal.content.input', { ns: 'appDebug' }) || ''}
+              config={localeData.config?.inputs_config || { enabled: false, preset_response: '' }}
+              onConfigChange={config => handleDataContentChange('inputs_config', config)}
+              info={(localeData.type === 'api' && t('feature.moderation.modal.content.fromApi', { ns: 'appDebug' })) || ''}
+              showPreset={localeData.type !== 'api'}
             />
-          )
-        }
-        <Divider bgStyle="gradient" className="my-3 h-px" />
-        <ModerationContent
-          title={t('feature.moderation.modal.content.input', { ns: 'appDebug' }) || ''}
-          config={localeData.config?.inputs_config || { enabled: false, preset_response: '' }}
-          onConfigChange={config => handleDataContentChange('inputs_config', config)}
-          info={(localeData.type === 'api' && t('feature.moderation.modal.content.fromApi', { ns: 'appDebug' })) || ''}
-          showPreset={localeData.type !== 'api'}
-        />
-        <ModerationContent
-          title={t('feature.moderation.modal.content.output', { ns: 'appDebug' }) || ''}
-          config={localeData.config?.outputs_config || { enabled: false, preset_response: '' }}
-          onConfigChange={config => handleDataContentChange('outputs_config', config)}
-          info={(localeData.type === 'api' && t('feature.moderation.modal.content.fromApi', { ns: 'appDebug' })) || ''}
-          showPreset={localeData.type !== 'api'}
-        />
-        <div className="mt-1 mb-8 text-xs font-medium text-text-tertiary">{t('feature.moderation.modal.content.condition', { ns: 'appDebug' })}</div>
-        <div className="flex items-center justify-end">
+            <ModerationContent
+              key={`outputs-${localeData.type}-${localeData.config?.outputs_config?.preset_response ?? ''}`}
+              title={t('feature.moderation.modal.content.output', { ns: 'appDebug' }) || ''}
+              config={localeData.config?.outputs_config || { enabled: false, preset_response: '' }}
+              onConfigChange={config => handleDataContentChange('outputs_config', config)}
+              info={(localeData.type === 'api' && t('feature.moderation.modal.content.fromApi', { ns: 'appDebug' })) || ''}
+              showPreset={localeData.type !== 'api'}
+            />
+            <div className="py-0.5 system-xs-regular text-text-tertiary">{t('feature.moderation.modal.content.condition', { ns: 'appDebug' })}</div>
+          </div>
+        </div>
+        <div className="flex h-[76px] items-center justify-end gap-2 px-6 pt-5 pb-6">
           <Button
             onClick={onCancel}
-            className="mr-2"
+            size="medium"
+            className="min-w-[72px]"
           >
             {t('operation.cancel', { ns: 'common' })}
           </Button>
           <Button
             variant="primary"
+            size="medium"
             onClick={handleSave}
             disabled={localeData.type === 'openai_moderation' && !isOpenAIProviderConfigured}
+            className="min-w-[72px]"
           >
             {t('operation.save', { ns: 'common' })}
           </Button>
diff --git a/web/app/components/base/icons/src/vender/solid/arrows/index.ts b/web/app/components/base/icons/src/vender/solid/arrows/index.ts
index d89a969bd44..e27f5526a31 100644
--- a/web/app/components/base/icons/src/vender/solid/arrows/index.ts
+++ b/web/app/components/base/icons/src/vender/solid/arrows/index.ts
@@ -1,3 +1 @@
-export { default as ArrowDownDoubleLine } from './ArrowDownDoubleLine'
 export { default as ArrowDownRoundFill } from './ArrowDownRoundFill'
-export { default as ArrowUpDoubleLine } from './ArrowUpDoubleLine'
diff --git a/web/app/components/base/icons/src/vender/workflow/Agent.json b/web/app/components/base/icons/src/vender/workflow/Agent.json
index 996040ee091..a195e8d6f27 100644
--- a/web/app/components/base/icons/src/vender/workflow/Agent.json
+++ b/web/app/components/base/icons/src/vender/workflow/Agent.json
@@ -4,9 +4,9 @@
     "isRootNode": true,
     "name": "svg",
     "attributes": {
-      "width": "16",
-      "height": "16",
-      "viewBox": "0 0 16 16",
+      "width": "24",
+      "height": "24",
+      "viewBox": "0 0 24 24",
       "fill": "none",
       "xmlns": "http://www.w3.org/2000/svg"
     },
@@ -15,35 +15,27 @@
         "type": "element",
         "name": "g",
         "attributes": {
-          "id": "agent"
+          "id": "agent",
+          "transform": "translate(2.5 1)"
         },
         "children": [
           {
             "type": "element",
-            "name": "g",
+            "name": "path",
             "attributes": {
-              "id": "Vector"
+              "d": "M3.3178 20.9524V15.7184C3.31774 15.7136 3.31456 15.6845 3.28404 15.6468L3.24312 15.6069C1.26589 13.9971 0 11.5398 0 8.78813C0.000122972 3.93464 3.93464 0.000122969 8.78813 0C13.5146 0 17.3698 3.73066 17.5691 8.40858C17.5712 8.45846 17.5841 8.48161 17.5865 8.48531L19.3226 11.089C19.7937 11.7956 19.6309 12.7481 18.9513 13.2579L17.5998 14.2707C17.5851 14.2819 17.5763 14.2996 17.5763 14.3178V15.4237C17.576 17.2235 16.1176 18.682 14.3178 18.6822H13.2119C13.1798 18.6822 13.1537 18.7085 13.1536 18.7405V20.9524C13.1536 21.5309 12.6845 21.9999 12.1059 22C11.5274 22 11.0583 21.531 11.0583 20.9524V18.7405C11.0584 17.5513 12.0226 16.587 13.2119 16.587H14.3178C14.9604 16.5868 15.4808 16.0663 15.481 15.4237V14.3178C15.481 13.64 15.8006 13.0016 16.3424 12.595L17.3195 11.8614L15.8432 9.64853C15.603 9.28835 15.4913 8.88291 15.4749 8.49758C15.323 4.93639 12.3872 2.09524 8.78813 2.09524C5.09181 2.09536 2.09536 5.09181 2.09524 8.78813C2.09524 10.883 3.05647 12.7533 4.56594 13.9822C5.0571 14.3822 5.41299 15.0012 5.41304 15.7184V20.9524C5.41304 21.5309 4.94385 21.9998 4.36542 22C3.78684 22 3.3178 21.531 3.3178 20.9524Z",
+              "fill": "currentColor"
             },
-            "children": [
-              {
-                "type": "element",
-                "name": "path",
-                "attributes": {
-                  "d": "M14.7401 5.80454C14.5765 4.77996 14.1638 3.79808 13.5306 2.97273C12.8973 2.14738 12.0648 1.48568 11.1185 1.06589C10.1722 0.646098 9.12632 0.461106 8.08751 0.546487C7.05582 0.624753 6.04548 0.966277 5.17744 1.53548C4.3094 2.09758 3.58366 2.88024 3.09272 3.79808C2.59466 4.70881 2.33852 5.7405 2.33852 6.7793V7.22756L1.25703 9.3692C1.04357 9.80322 1.22145 10.3368 1.65547 10.5574L2.3314 10.8989V12.3006C2.3314 12.82 2.53063 13.3038 2.90061 13.6738C3.2706 14.0367 3.75442 14.243 4.27382 14.243H6.01702V14.7624C6.01702 15.1538 6.3372 15.4739 6.72853 15.4739C7.11986 15.4739 7.44004 15.1538 7.44004 14.7624V13.7094C7.44004 13.2185 7.04159 12.82 6.55065 12.82H4.27382C4.13864 12.82 4.00345 12.7631 3.91095 12.6706C3.81846 12.5781 3.76154 12.4429 3.76154 12.3077V10.5716C3.76154 10.2301 3.56943 9.92417 3.2706 9.77476L2.77254 9.52573L3.66904 7.73984C3.72596 7.61889 3.76154 7.4837 3.76154 7.34851V6.77219C3.76154 5.96818 3.96076 5.17129 4.34498 4.4669C4.72919 3.76251 5.28417 3.15772 5.9601 2.7237C6.63603 2.28968 7.41158 2.02643 8.20847 1.96239C9.00536 1.89835 9.81648 2.04066 10.5493 2.36795C11.2822 2.69524 11.9225 3.20042 12.4135 3.84077C12.8973 4.47402 13.2246 5.23533 13.3456 6.02511C13.4665 6.81488 13.3954 7.63312 13.125 8.38731C12.8617 9.12017 12.4206 9.78187 11.8585 10.3084C11.6735 10.4792 11.5668 10.7139 11.5668 10.9701V14.7624C11.5668 15.1538 11.887 15.4739 12.2783 15.4739C12.6696 15.4739 12.9898 15.1538 12.9898 14.7624V11.1978C13.6515 10.5432 14.1567 9.73918 14.4697 8.87114C14.8184 7.89637 14.918 6.83623 14.7615 5.81165L14.7401 5.80454Z",
-                  "fill": "currentColor"
-                },
-                "children": []
-              },
-              {
-                "type": "element",
-                "name": "path",
-                "attributes": {
-                  "d": "M10.8055 7.99599C10.8909 7.83234 10.962 7.66158 11.0189 7.4837H11.6522C12.0435 7.4837 12.3637 7.16352 12.3637 6.77219C12.3637 6.38086 12.0435 6.06068 11.6522 6.06068H11.0189C10.9691 5.8828 10.898 5.71204 10.8055 5.54839L11.2537 5.10014C11.5312 4.82266 11.5312 4.3744 11.2537 4.09692C10.9762 3.81943 10.528 3.81943 10.2505 4.09692L9.80225 4.54517C9.6386 4.45267 9.46784 4.38863 9.28996 4.33171V3.69847C9.28996 3.30714 8.96978 2.98696 8.57845 2.98696C8.18712 2.98696 7.86694 3.30714 7.86694 3.69847V4.33171C7.68907 4.38152 7.5183 4.45267 7.35466 4.54517L6.90641 4.09692C6.62892 3.81943 6.18067 3.81943 5.90318 4.09692C5.62569 4.3744 5.62569 4.82266 5.90318 5.10014L6.35143 5.54839C6.26605 5.71204 6.1949 5.8828 6.13798 6.06068H5.50473C5.1134 6.06068 4.79323 6.38086 4.79323 6.77219C4.79323 7.16352 5.1134 7.4837 5.50473 7.4837H6.13798C6.18778 7.66158 6.25893 7.83234 6.35143 7.99599L5.90318 8.44424C5.62569 8.72172 5.62569 9.16997 5.90318 9.44746C6.04548 9.58976 6.22336 9.6538 6.40835 9.6538C6.59334 9.6538 6.77122 9.58265 6.91352 9.44746L7.36177 8.99921C7.52542 9.08459 7.69618 9.15574 7.87406 9.21267V9.84591C7.87406 10.2372 8.19424 10.5574 8.58557 10.5574C8.9769 10.5574 9.29708 10.2372 9.29708 9.84591V9.21267C9.47496 9.16286 9.64572 9.09171 9.80936 8.99921L10.2576 9.44746C10.3999 9.58976 10.5778 9.6538 10.7628 9.6538C10.9478 9.6538 11.1257 9.58265 11.268 9.44746C11.5454 9.16997 11.5454 8.72172 11.268 8.44424L10.8197 7.99599H10.8055ZM7.44004 6.77219C7.44004 6.14606 7.94521 5.64089 8.57134 5.64089C9.19747 5.64089 9.70264 6.14606 9.70264 6.77219C9.70264 7.39832 9.19747 7.90349 8.57134 7.90349C7.94521 7.90349 7.44004 7.39832 7.44004 6.77219Z",
-                  "fill": "currentColor"
-                },
-                "children": []
-              }
-            ]
+            "children": []
+          },
+          {
+            "type": "element",
+            "name": "path",
+            "attributes": {
+              "d": "M9.79012 6.5163L9.31429 5.27923C9.23058 5.06159 9.02158 4.91799 8.78836 4.91799C8.55514 4.91799 8.34614 5.06159 8.26243 5.27923L7.7866 6.5163C7.56194 7.10037 7.10038 7.56194 6.5163 7.78659L5.27923 8.26239C5.06159 8.34609 4.91799 8.55519 4.91799 8.78836C4.91799 9.02158 5.06159 9.23058 5.27923 9.31429L6.5163 9.79012C7.10037 10.0148 7.56194 10.4764 7.7866 11.0604L8.26243 12.2975C8.34614 12.5151 8.55514 12.6587 8.78836 12.6587C9.02158 12.6587 9.23058 12.5151 9.31429 12.2975L9.79012 11.0604C10.0148 10.4764 10.4764 10.0148 11.0604 9.79012L12.2975 9.31429C12.5151 9.23058 12.6587 9.02158 12.6587 8.78836C12.6587 8.55519 12.5151 8.34609 12.2975 8.26239L11.0604 7.78659C10.4764 7.56194 10.0148 7.10038 9.79012 6.5163Z",
+              "fill": "currentColor"
+            },
+            "children": []
           }
         ]
       }
diff --git a/web/app/components/base/param-item/index.tsx b/web/app/components/base/param-item/index.tsx
index 8599a607232..d4cb2979fe1 100644
--- a/web/app/components/base/param-item/index.tsx
+++ b/web/app/components/base/param-item/index.tsx
@@ -25,11 +25,12 @@ type Props = Readonly<{
   min?: number
   max: number
   onChange: (key: string, value: number) => void
+  disabled?: boolean
   hasSwitch?: boolean
   onSwitchChange?: (key: string, enable: boolean) => void
 }>
 
-const ParamItem: FC<Props> = ({ className, id, name, noTooltip, tip, step = 0.1, min = 0, max, value, enable, onChange, hasSwitch, onSwitchChange }) => {
+const ParamItem: FC<Props> = ({ className, id, name, noTooltip, tip, step = 0.1, min = 0, max, value, enable, onChange, disabled = false, hasSwitch, onSwitchChange }) => {
   return (
     <FieldsetRoot className={className}>
       <FieldsetLegend className="sr-only">{name}</FieldsetLegend>
@@ -40,6 +41,7 @@ const ParamItem: FC<Props> = ({ className, id, name, noTooltip, tip, step = 0.1,
               size="md"
               className="mr-2"
               checked={enable}
+              disabled={disabled}
               onCheckedChange={async (val) => {
                 onSwitchChange?.(id, val)
               }}
@@ -56,7 +58,7 @@ const ParamItem: FC<Props> = ({ className, id, name, noTooltip, tip, step = 0.1,
       <div className="mt-1 flex items-center">
         <div className="mr-3 flex shrink-0 items-center">
           <NumberField
-            disabled={!enable}
+            disabled={disabled || !enable}
             min={min}
             max={max}
             step={step}
@@ -75,7 +77,7 @@ const ParamItem: FC<Props> = ({ className, id, name, noTooltip, tip, step = 0.1,
         <div className="flex grow items-center">
           <Slider
             className="w-full"
-            disabled={!enable}
+            disabled={disabled || !enable}
             value={max < 5 ? value * 100 : value}
             min={min < 1 ? min * 100 : min}
             max={max < 5 ? max * 100 : max}
diff --git a/web/app/components/base/param-item/score-threshold-item.tsx b/web/app/components/base/param-item/score-threshold-item.tsx
index dbbf0a96edd..5c7540d1404 100644
--- a/web/app/components/base/param-item/score-threshold-item.tsx
+++ b/web/app/components/base/param-item/score-threshold-item.tsx
@@ -11,6 +11,7 @@ type Props = Readonly<{
   enable: boolean
   hasSwitch?: boolean
   onSwitchChange?: (key: string, enable: boolean) => void
+  disabled?: boolean
 }>
 
 const VALUE_LIMIT = {
@@ -39,6 +40,7 @@ const ScoreThresholdItem: FC<Props> = ({
   onChange,
   hasSwitch,
   onSwitchChange,
+  disabled = false,
 }) => {
   const { t } = useTranslation()
   const handleParamChange = (key: string, nextValue: number) => {
@@ -56,6 +58,7 @@ const ScoreThresholdItem: FC<Props> = ({
       value={safeValue}
       enable={enable}
       onChange={handleParamChange}
+      disabled={disabled}
       hasSwitch={hasSwitch}
       onSwitchChange={onSwitchChange}
     />
diff --git a/web/app/components/base/param-item/top-k-item.tsx b/web/app/components/base/param-item/top-k-item.tsx
index 0449eb34d7f..120d3e0b453 100644
--- a/web/app/components/base/param-item/top-k-item.tsx
+++ b/web/app/components/base/param-item/top-k-item.tsx
@@ -10,6 +10,7 @@ type Props = Readonly<{
   value: number
   onChange: (key: string, value: number) => void
   enable: boolean
+  disabled?: boolean
 }>
 
 const maxTopK = env.NEXT_PUBLIC_TOP_K_MAX_VALUE
@@ -25,6 +26,7 @@ const TopKItem: FC<Props> = ({
   value,
   enable,
   onChange,
+  disabled = false,
 }) => {
   const { t } = useTranslation()
   const handleParamChange = (key: string, value: number) => {
@@ -42,6 +44,7 @@ const TopKItem: FC<Props> = ({
       {...VALUE_LIMIT}
       value={value}
       enable={enable}
+      disabled={disabled}
       onChange={handleParamChange}
     />
   )
diff --git a/web/app/components/base/prompt-editor/__tests__/index.spec.tsx b/web/app/components/base/prompt-editor/__tests__/index.spec.tsx
index 9c0b3cec39f..df89f1cb1dd 100644
--- a/web/app/components/base/prompt-editor/__tests__/index.spec.tsx
+++ b/web/app/components/base/prompt-editor/__tests__/index.spec.tsx
@@ -9,6 +9,13 @@ import {
   UPDATE_HISTORY_EVENT_EMITTER,
 } from '../constants'
 import PromptEditor from '../index'
+import { CustomTextNode } from '../plugins/custom-text/node'
+
+type MockNodeReplacementConfig = {
+  replace?: unknown
+  with?: (arg: { __text: string }) => void
+  withKlass?: unknown
+}
 
 const mocks = vi.hoisted(() => {
   const commandHandlers = new Map<unknown, (payload: unknown) => boolean>()
@@ -18,6 +25,7 @@ const mocks = vi.hoisted(() => {
   return {
     emit: vi.fn(),
     rootLines: ['first line', 'second line'],
+    nodeReplacementConfig: undefined as MockNodeReplacementConfig | undefined,
     commandHandlers,
     subscriptions,
     rootElement,
@@ -86,7 +94,7 @@ vi.mock('@lexical/react/LexicalComposer', () => ({
   LexicalComposer: ({ initialConfig, children }: {
     initialConfig: {
       onError?: (error: Error) => void
-      nodes?: Array<{ replace?: unknown, with: (arg: { __text: string }) => void }>
+      nodes?: unknown[]
     }
     children: ReactNode
   }) => {
@@ -99,9 +107,11 @@ vi.mock('@lexical/react/LexicalComposer', () => ({
       }
     }
     if (initialConfig?.nodes) {
-      const textNodeConf = initialConfig.nodes.find((n: { replace?: unknown, with: (arg: { __text: string }) => void }) => n?.replace)
-      if (textNodeConf)
-        textNodeConf.with({ __text: 'test' })
+      const textNodeConf = initialConfig.nodes.find((node): node is MockNodeReplacementConfig => {
+        return typeof node === 'object' && node !== null && 'replace' in node
+      })
+      mocks.nodeReplacementConfig = textNodeConf
+      textNodeConf?.with?.({ __text: 'test' })
     }
     return <div data-testid="lexical-composer">{children}</div>
   },
@@ -173,10 +183,17 @@ describe('PromptEditor', () => {
     mocks.commandHandlers.clear()
     mocks.subscriptions.length = 0
     mocks.rootLines = ['first line', 'second line']
+    mocks.nodeReplacementConfig = undefined
   })
 
   // Rendering shell and text output from lexical state.
   describe('Rendering', () => {
+    it('should register CustomTextNode as the TextNode replacement class', () => {
+      render(<PromptEditor />)
+
+      expect(mocks.nodeReplacementConfig?.withKlass).toBe(CustomTextNode)
+    })
+
     it('should render placeholder and call onChange with joined lexical text', async () => {
       const onChange = vi.fn()
 
diff --git a/web/app/components/base/prompt-editor/__tests__/prompt-editor-content.spec.tsx b/web/app/components/base/prompt-editor/__tests__/prompt-editor-content.spec.tsx
index 02de482073b..3d6766b0024 100644
--- a/web/app/components/base/prompt-editor/__tests__/prompt-editor-content.spec.tsx
+++ b/web/app/components/base/prompt-editor/__tests__/prompt-editor-content.spec.tsx
@@ -7,6 +7,7 @@ import { LexicalComposer } from '@lexical/react/LexicalComposer'
 import { useLexicalComposerContext } from '@lexical/react/LexicalComposerContext'
 import { act, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import {
+  $getRoot,
   BLUR_COMMAND,
   COMMAND_PRIORITY_EDITOR,
   createCommand,
@@ -17,6 +18,7 @@ import { useEffect } from 'react'
 import { GeneratorType } from '@/app/components/app/configuration/config/automatic/types'
 import { useEventEmitterContextContext } from '@/context/event-emitter'
 import { EventEmitterContextProvider } from '@/context/event-emitter-provider'
+import { AgentOutputBlockNode } from '../plugins/agent-output-block/node'
 import { ContextBlockNode } from '../plugins/context-block'
 import { CurrentBlockNode } from '../plugins/current-block'
 import { CustomTextNode } from '../plugins/custom-text/node'
@@ -26,6 +28,7 @@ import { HITLInputNode } from '../plugins/hitl-input-block'
 import { LastRunBlockNode } from '../plugins/last-run-block'
 import { QueryBlockNode } from '../plugins/query-block'
 import { RequestURLBlockNode } from '../plugins/request-url-block'
+import { RosterReferenceBlockNode } from '../plugins/roster-reference-block/node'
 import { PROMPT_EDITOR_UPDATE_VALUE_BY_EVENT_EMITTER } from '../plugins/update-block'
 import { VariableValueBlockNode } from '../plugins/variable-value-block/node'
 import { WorkflowVariableBlockNode } from '../plugins/workflow-variable-block'
@@ -108,10 +111,12 @@ const PromptEditorContentHarness = ({
           RequestURLBlockNode,
           WorkflowVariableBlockNode,
           VariableValueBlockNode,
+          RosterReferenceBlockNode,
           HITLInputNode,
           CurrentBlockNode,
           ErrorMessageBlockNode,
           LastRunBlockNode,
+          AgentOutputBlockNode,
         ],
         editorState: textToEditorState(initialText),
         onError: (error: Error) => {
@@ -201,6 +206,117 @@ describe('PromptEditorContent', () => {
       expect(screen.getByRole('textbox')).toBeInTheDocument()
     })
 
+    it('should render adjacent agent output tokens as inline output blocks', async () => {
+      const captures: Captures = { editor: null, eventEmitter: null }
+      const initialText = '[§output:ccc:ccc§][§output:output_3ggg:output_3ggg§][§output:ggg:ggg§][§output:output_3fdfdf:output_3fdfdf§]'
+
+      const { container } = render(
+        <PromptEditorContentHarness
+          captures={captures}
+          initialText={initialText}
+          shortcutPopups={[]}
+          floatingAnchorElem={document.createElement('div')}
+          onEditorChange={vi.fn()}
+          agentOutputBlock={{
+            show: true,
+            outputs: [
+              { name: 'ccc', type: 'string' },
+              { name: 'output_3ggg', type: 'string' },
+              { name: 'ggg', type: 'string' },
+              { name: 'output_3fdfdf', type: 'string' },
+            ],
+          }}
+        />,
+      )
+
+      await waitFor(() => {
+        expect(screen.getByText('ccc')).toBeInTheDocument()
+        expect(screen.getByText('output_3ggg')).toBeInTheDocument()
+        expect(screen.getByText('ggg')).toBeInTheDocument()
+        expect(screen.getByText('output_3fdfdf')).toBeInTheDocument()
+      })
+      expect(container).not.toHaveTextContent('[§output:ccc:ccc§]')
+
+      await waitFor(() => {
+        expect(captures.editor).not.toBeNull()
+      })
+      captures.editor!.getEditorState().read(() => {
+        expect($getRoot().getTextContent()).toBe(initialText)
+      })
+    })
+
+    it('should infer file type when rendering a file-name output token', async () => {
+      const captures: Captures = { editor: null, eventEmitter: null }
+
+      render(
+        <PromptEditorContentHarness
+          captures={captures}
+          initialText="[§output:qna_report.pdf:qna_report.pdf§]"
+          shortcutPopups={[]}
+          floatingAnchorElem={document.createElement('div')}
+          onEditorChange={vi.fn()}
+          agentOutputBlock={{
+            show: true,
+            outputs: [
+              { name: 'qna_report.pdf', type: 'string' },
+            ],
+          }}
+        />,
+      )
+
+      await waitFor(() => {
+        expect(screen.getByText('qna_report.pdf')).toBeInTheDocument()
+        expect(screen.getByText('file')).toBeInTheDocument()
+      })
+    })
+
+    it('should update rendered output block type when declared output config changes', async () => {
+      const captures: Captures = { editor: null, eventEmitter: null }
+      const outputBlock = {
+        show: true,
+        outputs: [
+          { name: 'summary', type: 'string' as const },
+        ],
+      }
+
+      const { rerender } = render(
+        <PromptEditorContentHarness
+          captures={captures}
+          initialText="[§output:summary:summary§]"
+          shortcutPopups={[]}
+          floatingAnchorElem={document.createElement('div')}
+          onEditorChange={vi.fn()}
+          agentOutputBlock={outputBlock}
+        />,
+      )
+
+      await waitFor(() => {
+        expect(screen.getByText('summary')).toBeInTheDocument()
+        expect(screen.getByText('string')).toBeInTheDocument()
+      })
+
+      rerender(
+        <PromptEditorContentHarness
+          captures={captures}
+          initialText="[§output:summary:summary§]"
+          shortcutPopups={[]}
+          floatingAnchorElem={document.createElement('div')}
+          onEditorChange={vi.fn()}
+          agentOutputBlock={{
+            show: true,
+            outputs: [
+              { name: 'summary', type: 'file' },
+            ],
+          }}
+        />,
+      )
+
+      await waitFor(() => {
+        expect(screen.getByText('file')).toBeInTheDocument()
+      })
+      expect(screen.queryByText('string')).not.toBeInTheDocument()
+    })
+
     it('should render optional blocks and open shortcut popups with the real editor runtime', async () => {
       const captures: Captures = { editor: null, eventEmitter: null }
       const onEditorChange = vi.fn()
@@ -291,5 +407,29 @@ describe('PromptEditorContent', () => {
       expect(screen.queryByTestId('draggable-target-line')).not.toBeInTheDocument()
       expect(screen.getByText('common.promptEditor.placeholder')).toBeInTheDocument()
     })
+
+    it('should render roster references as inline token pills when enabled', async () => {
+      const captures: Captures = { editor: null, eventEmitter: null }
+
+      const { container } = render(
+        <PromptEditorContentHarness
+          captures={captures}
+          shortcutPopups={[]}
+          initialText="Use [§file:file-1:qna_report.pdf§]"
+          floatingAnchorElem={null}
+          onEditorChange={vi.fn()}
+          rosterReferenceBlock={{ show: true }}
+        />,
+      )
+
+      await waitFor(() => {
+        expect(captures.editor).not.toBeNull()
+      })
+
+      const token = container.querySelector('[data-roster-reference-kind="file"]') as HTMLElement
+      expect(token).toBeInTheDocument()
+      expect(token).toHaveTextContent('qna_report.pdf')
+      expect(token.querySelector('.i-ri-file-pdf-2-fill')).toBeInTheDocument()
+    })
   })
 })
diff --git a/web/app/components/base/prompt-editor/index.tsx b/web/app/components/base/prompt-editor/index.tsx
index da2de727702..c663f9deb0c 100644
--- a/web/app/components/base/prompt-editor/index.tsx
+++ b/web/app/components/base/prompt-editor/index.tsx
@@ -7,6 +7,7 @@ import type {
 import type { FC } from 'react'
 import type { Hotkey, ShortcutPopupDisplayMode, ShortcutPopupInsertHandler } from './plugins/shortcuts-popup-plugin'
 import type {
+  AgentOutputBlockType,
   ContextBlockType,
   CurrentBlockType,
   ErrorMessageBlockType,
@@ -16,6 +17,7 @@ import type {
   LastRunBlockType,
   QueryBlockType,
   RequestURLBlockType,
+  RosterReferenceBlockType,
   VariableBlockType,
   WorkflowVariableBlockType,
 } from './types'
@@ -34,6 +36,7 @@ import {
   UPDATE_DATASETS_EVENT_EMITTER,
   UPDATE_HISTORY_EVENT_EMITTER,
 } from './constants'
+import { AgentOutputBlockNode } from './plugins/agent-output-block/node'
 import {
   ContextBlockNode,
 } from './plugins/context-block'
@@ -44,10 +47,10 @@ import { CustomTextNode } from './plugins/custom-text/node'
 import {
   ErrorMessageBlockNode,
 } from './plugins/error-message-block'
+
 import {
   HistoryBlockNode,
 } from './plugins/history-block'
-
 import {
   HITLInputNode,
 } from './plugins/hitl-input-block'
@@ -60,6 +63,7 @@ import {
 import {
   RequestURLBlockNode,
 } from './plugins/request-url-block'
+import { RosterReferenceBlockNode } from './plugins/roster-reference-block/node'
 import { VariableValueBlockNode } from './plugins/variable-value-block/node'
 import {
   WorkflowVariableBlockNode,
@@ -108,6 +112,7 @@ const EditableSyncPlugin: FC<{ editable: boolean }> = ({ editable }) => {
 
 export type PromptEditorProps = {
   instanceId?: string
+  children?: React.ReactNode
   compact?: boolean
   wrapperClassName?: string
   className?: string
@@ -124,13 +129,17 @@ export type PromptEditorProps = {
   requestURLBlock?: RequestURLBlockType
   historyBlock?: HistoryBlockType
   variableBlock?: VariableBlockType
+  rosterReferenceBlock?: RosterReferenceBlockType
   externalToolBlock?: ExternalToolBlockType
   workflowVariableBlock?: WorkflowVariableBlockType
+  agentOutputBlock?: AgentOutputBlockType
   hitlInputBlock?: HITLInputBlockType
   currentBlock?: CurrentBlockType
   errorMessageBlock?: ErrorMessageBlockType
   lastRunBlock?: LastRunBlockType
   isSupportFileVar?: boolean
+  disableSlashPicker?: boolean
+  disableBracePicker?: boolean
   shortcutPopups?: Array<{
     hotkey: Hotkey
     displayMode?: ShortcutPopupDisplayMode
@@ -140,6 +149,7 @@ export type PromptEditorProps = {
 
 const PromptEditor: FC<PromptEditorProps> = ({
   instanceId,
+  children,
   compact,
   wrapperClassName,
   className,
@@ -156,13 +166,17 @@ const PromptEditor: FC<PromptEditorProps> = ({
   requestURLBlock,
   historyBlock,
   variableBlock,
+  rosterReferenceBlock,
   externalToolBlock,
   workflowVariableBlock,
+  agentOutputBlock,
   hitlInputBlock,
   currentBlock,
   errorMessageBlock,
   lastRunBlock,
   isSupportFileVar,
+  disableSlashPicker = false,
+  disableBracePicker = false,
   shortcutPopups = [],
 }) => {
   const { eventEmitter } = useEventEmitterContextContext()
@@ -177,6 +191,7 @@ const PromptEditor: FC<PromptEditorProps> = ({
       {
         replace: TextNode,
         with: (node: TextNode) => new CustomTextNode(node.__text),
+        withKlass: CustomTextNode,
       },
       ContextBlockNode,
       HistoryBlockNode,
@@ -184,10 +199,12 @@ const PromptEditor: FC<PromptEditorProps> = ({
       RequestURLBlockNode,
       WorkflowVariableBlockNode,
       VariableValueBlockNode,
+      RosterReferenceBlockNode,
       HITLInputNode,
       CurrentBlockNode,
       ErrorMessageBlockNode,
       LastRunBlockNode, // LastRunBlockNode is used for error message block replacement
+      AgentOutputBlockNode,
     ],
     editorState: textToEditorState(value || ''),
     onError: (error: Error) => {
@@ -242,13 +259,17 @@ const PromptEditor: FC<PromptEditorProps> = ({
           requestURLBlock={requestURLBlock}
           historyBlock={historyBlock}
           variableBlock={variableBlock}
+          rosterReferenceBlock={rosterReferenceBlock}
           externalToolBlock={externalToolBlock}
           workflowVariableBlock={workflowVariableBlock}
+          agentOutputBlock={agentOutputBlock}
           hitlInputBlock={hitlInputBlock}
           currentBlock={currentBlock}
           errorMessageBlock={errorMessageBlock}
           lastRunBlock={lastRunBlock}
           isSupportFileVar={isSupportFileVar}
+          disableSlashPicker={disableSlashPicker}
+          disableBracePicker={disableBracePicker}
           onBlur={onBlur}
           onFocus={onFocus}
           instanceId={instanceId}
@@ -257,6 +278,7 @@ const PromptEditor: FC<PromptEditorProps> = ({
         />
         <ValueSyncPlugin value={value} />
         <EditableSyncPlugin editable={editable} />
+        {children}
       </div>
     </LexicalComposer>
   )
diff --git a/web/app/components/base/prompt-editor/plugins/agent-output-block/__tests__/component.spec.tsx b/web/app/components/base/prompt-editor/plugins/agent-output-block/__tests__/component.spec.tsx
new file mode 100644
index 00000000000..a40a5f3d4ca
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/agent-output-block/__tests__/component.spec.tsx
@@ -0,0 +1,369 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { ButtonHTMLAttributes, ReactNode } from 'react'
+import { useLexicalComposerContext } from '@lexical/react/LexicalComposerContext'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { $getNodeByKey } from 'lexical'
+import AgentOutputBlockComponent from '../component'
+import { $createAgentOutputBlockNode } from '../node'
+
+const { mockEditorFocus, mockEditorUpdate, mockGetRootText, mockNodeReplace, mockSelectNext } = vi.hoisted(() => ({
+  mockEditorFocus: vi.fn(),
+  mockEditorUpdate: vi.fn((callback: () => void) => callback()),
+  mockGetRootText: {
+    value: '[§output:summary:summary§]',
+  },
+  mockNodeReplace: vi.fn(),
+  mockSelectNext: vi.fn(),
+}))
+
+vi.mock('@lexical/react/LexicalComposerContext')
+vi.mock('@langgenius/dify-ui/select', () => ({
+  Select: ({
+    children,
+    onValueChange,
+  }: {
+    children: ReactNode
+    onValueChange: (value: string) => void
+  }) => (
+    <div>
+      {children}
+      <button type="button" onClick={() => onValueChange('file')}>Select file</button>
+    </div>
+  ),
+  SelectContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  SelectItem: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  SelectItemIndicator: () => <span />,
+  SelectItemText: ({ children }: { children: ReactNode }) => <span>{children}</span>,
+  SelectLabel: ({ children }: { children: ReactNode }) => <span>{children}</span>,
+  SelectTrigger: ({
+    children,
+    onClick,
+    onMouseDown,
+    ...props
+  }: ButtonHTMLAttributes<HTMLButtonElement>) => (
+    <button type="button" onClick={onClick} onMouseDown={onMouseDown} {...props}>
+      {children}
+    </button>
+  ),
+}))
+vi.mock('lexical', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('lexical')>()
+
+  return {
+    ...actual,
+    $getNodeByKey: vi.fn(),
+    $getRoot: vi.fn(() => ({
+      getChildren: () => [{
+        getTextContent: () => mockGetRootText.value,
+      }],
+    })),
+  }
+})
+
+vi.mock('../node', () => ({
+  $createAgentOutputBlockNode: vi.fn((name: string, outputType: string, isEditing: boolean) => ({
+    isEditing,
+    name,
+    outputType,
+  })),
+  $isAgentOutputBlockNode: () => true,
+}))
+
+const outputs: DeclaredOutputConfig[] = [
+  {
+    name: 'output',
+    type: 'string',
+    required: false,
+  },
+]
+
+describe('AgentOutputBlockComponent', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetRootText.value = '[§output:summary:summary§]'
+    vi.mocked(useLexicalComposerContext).mockReturnValue([
+      {
+        focus: mockEditorFocus,
+        update: mockEditorUpdate,
+      },
+      {},
+    ] as unknown as ReturnType<typeof useLexicalComposerContext>)
+    vi.mocked($getNodeByKey).mockReturnValue({
+      replace: mockNodeReplace.mockReturnValue({
+        selectNext: mockSelectNext,
+      }),
+    } as never)
+  })
+
+  it('does not replace the Lexical node while typing an output name and commits on blur', async () => {
+    const user = userEvent.setup()
+    const onChange = vi.fn()
+
+    render(
+      <AgentOutputBlockComponent
+        nodeKey="output-node"
+        name="output"
+        outputType="string"
+        isEditing
+        outputs={outputs}
+        onChange={onChange}
+      />,
+    )
+
+    const input = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+
+    await user.clear(input)
+    await user.type(input, 'summary')
+
+    expect(input).toHaveValue('summary')
+    expect(mockNodeReplace).not.toHaveBeenCalled()
+    expect(onChange).not.toHaveBeenCalled()
+
+    await user.tab()
+
+    expect($createAgentOutputBlockNode).toHaveBeenCalledWith(
+      'summary',
+      'string',
+      false,
+      expect.arrayContaining([
+        expect.objectContaining({
+          name: 'summary',
+          type: 'string',
+          required: false,
+        }),
+      ]),
+      onChange,
+    )
+    expect(mockNodeReplace).toHaveBeenCalledTimes(1)
+    expect(mockSelectNext).not.toHaveBeenCalled()
+    expect(mockEditorFocus).not.toHaveBeenCalled()
+    expect(onChange).toHaveBeenCalledWith(expect.arrayContaining([
+      expect.objectContaining({
+        name: 'summary',
+        type: 'string',
+        required: false,
+      }),
+    ]), '[§output:summary:summary§]')
+  })
+
+  it('moves the editor selection after the output block when committing with Enter', async () => {
+    const user = userEvent.setup()
+
+    render(
+      <AgentOutputBlockComponent
+        nodeKey="output-node"
+        name="output"
+        outputType="string"
+        isEditing
+        outputs={outputs}
+      />,
+    )
+
+    const input = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+
+    await user.clear(input)
+    await user.type(input, 'summary')
+    await user.keyboard('{Enter}')
+
+    expect(mockNodeReplace).toHaveBeenCalledTimes(1)
+    expect(mockSelectNext).toHaveBeenCalledTimes(1)
+    await waitFor(() => {
+      expect(mockEditorFocus).toHaveBeenCalledTimes(1)
+    })
+  })
+
+  it('commits the input DOM value on Enter even before React state rerenders', () => {
+    const onChange = vi.fn()
+
+    render(
+      <AgentOutputBlockComponent
+        nodeKey="output-node"
+        name="output"
+        outputType="string"
+        isEditing
+        outputs={outputs}
+        onChange={onChange}
+      />,
+    )
+
+    const input = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+
+    fireEvent.change(input, { target: { value: 'summary' } })
+    fireEvent.keyDown(input, { key: 'Enter' })
+
+    expect($createAgentOutputBlockNode).toHaveBeenCalledWith(
+      'summary',
+      'string',
+      false,
+      expect.arrayContaining([
+        expect.objectContaining({
+          name: 'summary',
+        }),
+      ]),
+      onChange,
+    )
+  })
+
+  it('automatically commits file-name outputs as file type', () => {
+    const onChange = vi.fn()
+    mockGetRootText.value = '[§output:qna_report.pdf:qna_report.pdf§]'
+
+    render(
+      <AgentOutputBlockComponent
+        nodeKey="output-node"
+        name="output"
+        outputType="string"
+        isEditing
+        outputs={outputs}
+        onChange={onChange}
+      />,
+    )
+
+    const input = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+
+    fireEvent.change(input, { target: { value: 'qna_report.pdf' } })
+    fireEvent.keyDown(input, { key: 'Enter' })
+
+    expect($createAgentOutputBlockNode).toHaveBeenCalledWith(
+      'qna_report.pdf',
+      'file',
+      false,
+      expect.arrayContaining([
+        expect.objectContaining({
+          name: 'qna_report.pdf',
+          type: 'file',
+          file: {
+            extensions: [],
+            mime_types: [],
+          },
+        }),
+      ]),
+      onChange,
+    )
+    expect(onChange).toHaveBeenCalledWith(expect.arrayContaining([
+      expect.objectContaining({
+        name: 'qna_report.pdf',
+        type: 'file',
+      }),
+    ]), '[§output:qna_report.pdf:qna_report.pdf§]')
+  })
+
+  it('keeps dotted output names as the selected type when the extension is not whitelisted', () => {
+    const onChange = vi.fn()
+    mockGetRootText.value = '[§output:report.customext:report.customext§]'
+
+    render(
+      <AgentOutputBlockComponent
+        nodeKey="output-node"
+        name="output"
+        outputType="string"
+        isEditing
+        outputs={outputs}
+        onChange={onChange}
+      />,
+    )
+
+    const input = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+
+    fireEvent.change(input, { target: { value: 'report.customext' } })
+    fireEvent.keyDown(input, { key: 'Enter' })
+
+    expect($createAgentOutputBlockNode).toHaveBeenCalledWith(
+      'report.customext',
+      'string',
+      false,
+      expect.arrayContaining([
+        expect.objectContaining({
+          name: 'report.customext',
+          type: 'string',
+        }),
+      ]),
+      onChange,
+    )
+  })
+
+  it('does not commit the name blur before selecting an output type', () => {
+    const onChange = vi.fn()
+    mockGetRootText.value = '[§output:summary:summary§]'
+
+    render(
+      <AgentOutputBlockComponent
+        nodeKey="output-node"
+        name="output"
+        outputType="string"
+        isEditing
+        outputs={outputs}
+        onChange={onChange}
+      />,
+    )
+
+    const input = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+    const typeTrigger = screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.typeLabel' })
+
+    fireEvent.change(input, { target: { value: 'summary' } })
+    fireEvent.mouseDown(typeTrigger)
+    fireEvent.blur(input)
+
+    expect(onChange).not.toHaveBeenCalled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Select file' }))
+
+    expect($createAgentOutputBlockNode).toHaveBeenCalledWith(
+      'summary',
+      'file',
+      false,
+      expect.arrayContaining([
+        expect.objectContaining({
+          name: 'summary',
+          type: 'file',
+        }),
+      ]),
+      onChange,
+    )
+  })
+
+  it('does not save stale output data when the Lexical node has already been replaced', async () => {
+    const user = userEvent.setup()
+    const onChange = vi.fn()
+    vi.mocked($getNodeByKey).mockReturnValue(null)
+
+    render(
+      <AgentOutputBlockComponent
+        nodeKey="output-node"
+        name="output"
+        outputType="string"
+        isEditing
+        outputs={outputs}
+        onChange={onChange}
+      />,
+    )
+
+    const input = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+
+    await user.clear(input)
+    await user.type(input, 'summary')
+    await user.keyboard('{Enter}')
+
+    expect(mockNodeReplace).not.toHaveBeenCalled()
+    expect(onChange).not.toHaveBeenCalled()
+    expect(mockEditorFocus).not.toHaveBeenCalled()
+  })
+
+  it('renders the committed output block as non-editable adaptive text', () => {
+    render(
+      <AgentOutputBlockComponent
+        nodeKey="output-node"
+        name="qna_report_pdf"
+        outputType="file"
+        isEditing={false}
+        outputs={outputs}
+      />,
+    )
+
+    expect(screen.queryByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'workflow.nodes.agent.outputVars.typeLabel' })).not.toBeInTheDocument()
+    expect(screen.getByText('qna_report_pdf')).toBeInTheDocument()
+    expect(screen.getByText('file')).toBeInTheDocument()
+  })
+})
diff --git a/web/app/components/base/prompt-editor/plugins/agent-output-block/__tests__/node.spec.tsx b/web/app/components/base/prompt-editor/plugins/agent-output-block/__tests__/node.spec.tsx
new file mode 100644
index 00000000000..95f71afc67a
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/agent-output-block/__tests__/node.spec.tsx
@@ -0,0 +1,106 @@
+import type {
+  Klass,
+  LexicalEditor,
+  LexicalNode,
+} from 'lexical'
+import { createEditor } from 'lexical'
+import {
+  $createAgentOutputBlockNode,
+  $isAgentOutputBlockNode,
+  AgentOutputBlockNode,
+} from '../node'
+import {
+  extractAgentOutputNames,
+  getAgentOutputToken,
+  inferAgentOutputType,
+  parseAgentOutputToken,
+  replaceAgentOutputName,
+} from '../utils'
+
+describe('AgentOutputBlockNode', () => {
+  let editor: LexicalEditor
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    editor = createEditor({
+      nodes: [AgentOutputBlockNode as unknown as Klass<LexicalNode>],
+    })
+  })
+
+  const runInEditor = (callback: () => void) => {
+    editor.update(callback, { discrete: true })
+  }
+
+  it('should persist output tokens with bracket wrappers', () => {
+    runInEditor(() => {
+      const node = $createAgentOutputBlockNode('summary', 'string')
+
+      expect(node.getTextContent()).toBe('[§output:summary:summary§]')
+      expect(getAgentOutputToken('summary')).toBe('[§output:summary:summary§]')
+    })
+  })
+
+  it('should persist and parse file-name output tokens', () => {
+    runInEditor(() => {
+      const node = $createAgentOutputBlockNode('qna_report.pdf', 'file')
+
+      expect(node.getTextContent()).toBe('[§output:qna_report.pdf:qna_report.pdf§]')
+      expect(getAgentOutputToken('qna_report.pdf')).toBe('[§output:qna_report.pdf:qna_report.pdf§]')
+    })
+
+    expect(parseAgentOutputToken('Use [§output:qna_report.pdf:qna_report.pdf§]')).toEqual({
+      name: 'qna_report.pdf',
+      start: 4,
+      end: 44,
+    })
+  })
+
+  it('should infer file type only for whitelisted file extensions', () => {
+    expect(inferAgentOutputType('qna_report.pdf', 'string')).toBe('file')
+    expect(inferAgentOutputType('QNA_REPORT.PDF', 'string')).toBe('file')
+    expect(inferAgentOutputType('report.customext', 'string')).toBe('string')
+    expect(inferAgentOutputType('report.customext', 'object')).toBe('object')
+  })
+
+  it('should parse bracketed output tokens and legacy bare tokens', () => {
+    expect(parseAgentOutputToken('before [§output:summary:summary§] after')).toEqual({
+      name: 'summary',
+      start: 7,
+      end: 33,
+    })
+    expect(parseAgentOutputToken('before §output:summary:summary§ after')).toEqual({
+      name: 'summary',
+      start: 7,
+      end: 31,
+    })
+    expect(parseAgentOutputToken('[§skill:summary:summary§]')).toBeNull()
+  })
+
+  it('should extract output names from bracketed and legacy tokens', () => {
+    expect([...extractAgentOutputNames('A [§output:summary:summary§] B §output:qna_report.pdf:qna_report.pdf§')]).toEqual([
+      'summary',
+      'qna_report.pdf',
+    ])
+  })
+
+  it('should replace only matching output token names', () => {
+    expect(replaceAgentOutputName(
+      'Use [§output:summary:summary§] and §output:other:other§',
+      'summary',
+      'final_summary',
+    )).toBe('Use [§output:final_summary:final_summary§] and §output:other:other§')
+  })
+
+  it('should create node with helper and support type guard checks', () => {
+    runInEditor(() => {
+      const node = $createAgentOutputBlockNode('result', 'object')
+
+      expect(node).toBeInstanceOf(AgentOutputBlockNode)
+      expect(node.getTextContent()).toBe('[§output:result:result§]')
+      expect($isAgentOutputBlockNode(node)).toBe(true)
+      expect($isAgentOutputBlockNode(null)).toBe(false)
+      expect($isAgentOutputBlockNode(undefined)).toBe(false)
+      expect($isAgentOutputBlockNode({} as LexicalNode)).toBe(false)
+    })
+  })
+})
diff --git a/web/app/components/base/prompt-editor/plugins/agent-output-block/commands.ts b/web/app/components/base/prompt-editor/plugins/agent-output-block/commands.ts
new file mode 100644
index 00000000000..c4f8745426e
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/agent-output-block/commands.ts
@@ -0,0 +1,3 @@
+import { createCommand } from 'lexical'
+
+export const INSERT_AGENT_OUTPUT_BLOCK_COMMAND = createCommand('INSERT_AGENT_OUTPUT_BLOCK_COMMAND')
diff --git a/web/app/components/base/prompt-editor/plugins/agent-output-block/component.tsx b/web/app/components/base/prompt-editor/plugins/agent-output-block/component.tsx
new file mode 100644
index 00000000000..68d128f956c
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/agent-output-block/component.tsx
@@ -0,0 +1,211 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { AgentOutputTypeOptionValue } from './utils'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectItemIndicator,
+  SelectItemText,
+  SelectLabel,
+  SelectTrigger,
+} from '@langgenius/dify-ui/select'
+import { useLexicalComposerContext } from '@lexical/react/LexicalComposerContext'
+import { $getNodeByKey, $getRoot } from 'lexical'
+import { memo, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { $createAgentOutputBlockNode, $isAgentOutputBlockNode } from './node'
+import {
+  AGENT_OUTPUT_NAME_PATTERN,
+  AGENT_OUTPUT_TYPE_OPTIONS,
+  createAgentOutputConfig,
+  getAgentOutputTypeOption,
+  inferAgentOutputType,
+} from './utils'
+
+type AgentOutputBlockComponentProps = {
+  nodeKey: string
+  name: string
+  outputType: AgentOutputTypeOptionValue
+  isEditing: boolean
+  outputs: DeclaredOutputConfig[]
+  onChange?: (outputs: DeclaredOutputConfig[], prompt?: string) => void
+}
+
+function upsertOutput(
+  outputs: DeclaredOutputConfig[],
+  oldName: string,
+  nextName: string,
+  outputType: AgentOutputTypeOptionValue,
+) {
+  const trimmedName = nextName.trim()
+  if (!AGENT_OUTPUT_NAME_PATTERN.test(trimmedName))
+    return null
+
+  const nextOutputType = inferAgentOutputType(trimmedName, outputType)
+  const existingIndex = outputs.findIndex(output => output.name === oldName)
+  const duplicateIndex = outputs.findIndex(output => output.name === trimmedName && output.name !== oldName)
+  if (duplicateIndex >= 0)
+    return null
+
+  const nextOutput = createAgentOutputConfig(trimmedName, nextOutputType)
+  if (existingIndex >= 0)
+    return outputs.map((output, index) => index === existingIndex ? nextOutput : output)
+
+  return [...outputs, nextOutput]
+}
+
+const AgentOutputBlockComponent = ({
+  nodeKey,
+  name,
+  outputType,
+  isEditing,
+  outputs,
+  onChange,
+}: AgentOutputBlockComponentProps) => {
+  const { t } = useTranslation()
+  const [editor] = useLexicalComposerContext()
+  const selected = getAgentOutputTypeOption(outputType)
+  const [draftName, setDraftName] = useState(name)
+  const [lastNodeName, setLastNodeName] = useState(name)
+  const skipNextBlurCommitRef = useRef(false)
+  const latestDraftNameRef = useRef(name)
+
+  if (name !== lastNodeName) {
+    setLastNodeName(name)
+    setDraftName(name)
+    latestDraftNameRef.current = name
+  }
+
+  const commitOutput = (nextName: string, nextType: AgentOutputTypeOptionValue, selectAfterCommit = false) => {
+    const trimmedName = nextName.trim()
+    const nextOutputs = upsertOutput(outputs, name, trimmedName, nextType)
+    if (!nextOutputs) {
+      setDraftName(name)
+      return false
+    }
+
+    let didCommit = false
+    let nextPrompt: string | undefined
+    editor.update(() => {
+      const node = $getNodeByKey(nodeKey)
+      if (!$isAgentOutputBlockNode(node))
+        return
+
+      const nextOutputType = inferAgentOutputType(trimmedName, nextType)
+      const nextNode = node.replace($createAgentOutputBlockNode(trimmedName, nextOutputType, false, nextOutputs, onChange))
+      if (selectAfterCommit)
+        nextNode.selectNext()
+      nextPrompt = $getRoot().getChildren().map(node => node.getTextContent()).join('\n')
+      didCommit = true
+    })
+
+    if (!didCommit)
+      return false
+
+    onChange?.(nextOutputs, nextPrompt)
+
+    return true
+  }
+
+  if (!isEditing) {
+    return (
+      <span
+        contentEditable={false}
+        className="inline-flex min-w-[18px] items-center gap-1 rounded-[5px] border border-util-colors-violet-violet-100 bg-util-colors-violet-violet-50 px-1 py-0.5 align-middle shadow-xs"
+      >
+        <span aria-hidden="true" className="i-custom-vender-workflow-variable-x size-3.5 shrink-0 text-util-colors-violet-violet-700" />
+        <span className="system-xs-medium whitespace-nowrap text-util-colors-violet-violet-700">
+          {name}
+        </span>
+        <span className="rounded-[3px] px-0.5 system-2xs-medium-uppercase whitespace-nowrap text-text-tertiary">
+          {selected.label}
+        </span>
+      </span>
+    )
+  }
+
+  return (
+    <span
+      contentEditable={false}
+      className="inline-flex items-center gap-[3px] rounded-[5px] border border-util-colors-violet-violet-700 bg-util-colors-violet-violet-50 p-px align-middle shadow-xs"
+    >
+      <span className="flex min-w-0 items-center gap-0.5 pl-0.5">
+        <span aria-hidden="true" className="i-custom-vender-workflow-variable-x size-3.5 shrink-0 text-util-colors-violet-violet-700" />
+        <input
+          aria-label={t('nodes.agent.outputVars.nameLabel', { ns: 'workflow' })}
+          value={draftName}
+          className="h-4 max-w-28 min-w-5 border-0 bg-transparent p-0 text-center system-xs-regular text-util-colors-violet-violet-700 outline-hidden placeholder:text-util-colors-violet-violet-700/50 focus:w-24"
+          placeholder={t('nodes.agent.outputVars.namePlaceholder', { ns: 'workflow' })}
+          onMouseDown={event => event.stopPropagation()}
+          onClick={event => event.stopPropagation()}
+          onKeyDown={(event) => {
+            event.stopPropagation()
+            event.nativeEvent.stopImmediatePropagation?.()
+            if (event.key === 'Enter') {
+              event.preventDefault()
+              skipNextBlurCommitRef.current = true
+              const didCommit = commitOutput(event.currentTarget.value, outputType, true)
+              if (!didCommit) {
+                skipNextBlurCommitRef.current = false
+                return
+              }
+
+              queueMicrotask(() => {
+                editor.focus()
+              })
+            }
+            if (event.key === 'Escape') {
+              event.preventDefault()
+              setDraftName(name)
+              event.currentTarget.blur()
+            }
+          }}
+          onChange={(event) => {
+            latestDraftNameRef.current = event.currentTarget.value
+            setDraftName(event.currentTarget.value)
+          }}
+          onBlur={(event) => {
+            if (skipNextBlurCommitRef.current) {
+              skipNextBlurCommitRef.current = false
+              return
+            }
+
+            commitOutput(event.currentTarget.value, outputType)
+          }}
+        />
+      </span>
+      <Select<AgentOutputTypeOptionValue>
+        value={outputType}
+        onValueChange={(nextType) => {
+          skipNextBlurCommitRef.current = false
+          if (nextType)
+            commitOutput(latestDraftNameRef.current, nextType)
+        }}
+      >
+        <SelectLabel className="sr-only">
+          {t('nodes.agent.outputVars.typeLabel', { ns: 'workflow' })}
+        </SelectLabel>
+        <SelectTrigger
+          aria-label={t('nodes.agent.outputVars.typeLabel', { ns: 'workflow' })}
+          className="h-4 min-w-4 rounded bg-util-colors-violet-violet-200 py-0 pr-0.5 pl-1 system-2xs-semibold-uppercase text-util-colors-violet-violet-700 hover:bg-util-colors-violet-violet-200"
+          onMouseDown={() => {
+            skipNextBlurCommitRef.current = true
+          }}
+          onClick={event => event.stopPropagation()}
+        >
+          {selected.label}
+        </SelectTrigger>
+        <SelectContent popupClassName="w-40">
+          {AGENT_OUTPUT_TYPE_OPTIONS.map(option => (
+            <SelectItem key={option.value} value={option.value}>
+              <SelectItemText>{option.label}</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    </span>
+  )
+}
+
+export default memo(AgentOutputBlockComponent)
diff --git a/web/app/components/base/prompt-editor/plugins/agent-output-block/index.tsx b/web/app/components/base/prompt-editor/plugins/agent-output-block/index.tsx
new file mode 100644
index 00000000000..aeafc69c5f4
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/agent-output-block/index.tsx
@@ -0,0 +1,138 @@
+import type { ElementNode, TextNode } from 'lexical'
+import type { AgentOutputBlockType } from '../../types'
+import { useLexicalComposerContext } from '@lexical/react/LexicalComposerContext'
+import { mergeRegister } from '@lexical/utils'
+import {
+  $applyNodeReplacement,
+  $getRoot,
+  $insertNodes,
+  $isElementNode,
+  COMMAND_PRIORITY_EDITOR,
+} from 'lexical'
+import { memo, useCallback, useEffect } from 'react'
+import { decoratorTransform } from '../../utils'
+import { CustomTextNode } from '../custom-text/node'
+import { INSERT_AGENT_OUTPUT_BLOCK_COMMAND } from './commands'
+import { $createAgentOutputBlockNode, AgentOutputBlockNode } from './node'
+import {
+  createAgentOutputConfig,
+  getAgentOutputTypeOptionValue,
+  getUniqueAgentOutputName,
+  inferAgentOutputType,
+  parseAgentOutputToken,
+} from './utils'
+
+function getAgentOutputBlockNodeType(name: string, outputs: NonNullable<AgentOutputBlockType['outputs']>) {
+  const output = outputs.find(item => item.name === name)
+
+  return inferAgentOutputType(name, output ? getAgentOutputTypeOptionValue(output) : 'string')
+}
+
+const AgentOutputBlock = memo(({
+  outputs = [],
+  onChange,
+}: AgentOutputBlockType) => {
+  const [editor] = useLexicalComposerContext()
+
+  useEffect(() => {
+    if (!editor.hasNodes([AgentOutputBlockNode]))
+      throw new Error('AgentOutputBlockPlugin: AgentOutputBlock not registered on editor')
+
+    return mergeRegister(
+      editor.registerCommand(
+        INSERT_AGENT_OUTPUT_BLOCK_COMMAND,
+        () => {
+          const name = getUniqueAgentOutputName(outputs)
+          const outputType = 'string'
+          const nextOutputs = [...outputs, createAgentOutputConfig(name, outputType)]
+          const agentOutputBlockNode = $createAgentOutputBlockNode(name, outputType, true, nextOutputs, onChange)
+
+          $insertNodes([agentOutputBlockNode])
+          const nextPrompt = $getRoot().getChildren().map(node => node.getTextContent()).join('\n')
+          onChange?.(nextOutputs, nextPrompt)
+
+          return true
+        },
+        COMMAND_PRIORITY_EDITOR,
+      ),
+    )
+  }, [editor, onChange, outputs])
+
+  return null
+})
+AgentOutputBlock.displayName = 'AgentOutputBlock'
+
+const AgentOutputBlockReplacementBlock = memo(({
+  outputs = [],
+  onChange,
+}: AgentOutputBlockType) => {
+  const [editor] = useLexicalComposerContext()
+
+  useEffect(() => {
+    if (!editor.hasNodes([AgentOutputBlockNode]))
+      throw new Error('AgentOutputBlockNodePlugin: AgentOutputBlockNode not registered on editor')
+  }, [editor])
+
+  const createAgentOutputBlockNode = useCallback((textNode: TextNode): AgentOutputBlockNode => {
+    const match = parseAgentOutputToken(textNode.getTextContent())
+    const name = match?.name || ''
+    const outputType = getAgentOutputBlockNodeType(name, outputs)
+
+    return $applyNodeReplacement($createAgentOutputBlockNode(name, outputType, false, outputs, onChange))
+  }, [onChange, outputs])
+
+  const getMatch = useCallback((text: string) => {
+    const match = parseAgentOutputToken(text)
+
+    if (!match)
+      return null
+
+    return {
+      end: match.end,
+      start: match.start,
+    }
+  }, [])
+
+  const transformListener = useCallback((textNode: CustomTextNode) => {
+    return decoratorTransform(textNode, getMatch, createAgentOutputBlockNode, {
+      allowAdjacentMatches: true,
+    })
+  }, [createAgentOutputBlockNode, getMatch])
+
+  useEffect(() => {
+    return mergeRegister(
+      editor.registerNodeTransform(CustomTextNode, transformListener),
+    )
+  }, [editor, transformListener])
+
+  useEffect(() => {
+    editor.update(() => {
+      const visitNode = (node: ElementNode) => {
+        node.getChildren().forEach((child) => {
+          if (child instanceof AgentOutputBlockNode) {
+            const name = child.getName()
+            const outputType = getAgentOutputBlockNodeType(name, outputs)
+            if (
+              child.getOutputType() !== outputType
+              || child.getOutputs() !== outputs
+              || child.getOnChange() !== onChange
+            ) {
+              child.replace($createAgentOutputBlockNode(name, outputType, child.isEditing(), outputs, onChange))
+            }
+            return
+          }
+
+          if ($isElementNode(child))
+            visitNode(child)
+        })
+      }
+
+      visitNode($getRoot())
+    })
+  }, [editor, onChange, outputs])
+
+  return null
+})
+AgentOutputBlockReplacementBlock.displayName = 'AgentOutputBlockReplacementBlock'
+
+export { AgentOutputBlock, AgentOutputBlockReplacementBlock }
diff --git a/web/app/components/base/prompt-editor/plugins/agent-output-block/node.tsx b/web/app/components/base/prompt-editor/plugins/agent-output-block/node.tsx
new file mode 100644
index 00000000000..11e14f7c245
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/agent-output-block/node.tsx
@@ -0,0 +1,131 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { LexicalNode, NodeKey, SerializedLexicalNode } from 'lexical'
+import type { AgentOutputTypeOptionValue } from './utils'
+import { DecoratorNode } from 'lexical'
+import AgentOutputBlockComponent from './component'
+import { getAgentOutputToken } from './utils'
+
+type SerializedNode = SerializedLexicalNode & {
+  name: string
+  outputType: AgentOutputTypeOptionValue
+}
+
+export class AgentOutputBlockNode extends DecoratorNode<React.JSX.Element> {
+  __name: string
+  __outputType: AgentOutputTypeOptionValue
+  __isEditing: boolean
+  __outputs: DeclaredOutputConfig[]
+  __onChange?: (outputs: DeclaredOutputConfig[], prompt?: string) => void
+
+  static override getType(): string {
+    return 'agent-output-block'
+  }
+
+  static override clone(node: AgentOutputBlockNode): AgentOutputBlockNode {
+    return new AgentOutputBlockNode(
+      node.__name,
+      node.__outputType,
+      node.__isEditing,
+      node.__outputs,
+      node.__onChange,
+      node.__key,
+    )
+  }
+
+  override isInline(): boolean {
+    return true
+  }
+
+  constructor(
+    name: string,
+    outputType: AgentOutputTypeOptionValue,
+    isEditing = false,
+    outputs: DeclaredOutputConfig[] = [],
+    onChange?: (outputs: DeclaredOutputConfig[], prompt?: string) => void,
+    key?: NodeKey,
+  ) {
+    super(key)
+
+    this.__name = name
+    this.__outputType = outputType
+    this.__isEditing = isEditing
+    this.__outputs = outputs
+    this.__onChange = onChange
+  }
+
+  override createDOM(): HTMLElement {
+    const div = document.createElement('div')
+    div.classList.add('inline-flex', 'items-center', 'align-middle')
+    return div
+  }
+
+  override updateDOM(): false {
+    return false
+  }
+
+  override decorate(): React.JSX.Element {
+    return (
+      <AgentOutputBlockComponent
+        nodeKey={this.getKey()}
+        name={this.getName()}
+        outputType={this.getOutputType()}
+        isEditing={this.isEditing()}
+        outputs={this.getOutputs()}
+        onChange={this.getOnChange()}
+      />
+    )
+  }
+
+  static override importJSON(serializedNode: SerializedNode): AgentOutputBlockNode {
+    return $createAgentOutputBlockNode(serializedNode.name, serializedNode.outputType)
+  }
+
+  override exportJSON(): SerializedNode {
+    return {
+      type: 'agent-output-block',
+      version: 1,
+      name: this.getName(),
+      outputType: this.getOutputType(),
+    }
+  }
+
+  getName(): string {
+    return this.getLatest().__name
+  }
+
+  getOutputType(): AgentOutputTypeOptionValue {
+    return this.getLatest().__outputType
+  }
+
+  isEditing(): boolean {
+    return this.getLatest().__isEditing
+  }
+
+  getOutputs(): DeclaredOutputConfig[] {
+    return this.getLatest().__outputs
+  }
+
+  getOnChange(): ((outputs: DeclaredOutputConfig[], prompt?: string) => void) | undefined {
+    return this.getLatest().__onChange
+  }
+
+  override getTextContent(): string {
+    return getAgentOutputToken(this.getName())
+  }
+}
+
+export function $createAgentOutputBlockNode(
+  name: string,
+  outputType: AgentOutputTypeOptionValue = 'string',
+  isEditing = false,
+  outputs: DeclaredOutputConfig[] = [],
+  onChange?: (outputs: DeclaredOutputConfig[], prompt?: string) => void,
+): AgentOutputBlockNode {
+  return new AgentOutputBlockNode(name, outputType, isEditing, outputs, onChange)
+}
+
+export function $isAgentOutputBlockNode(
+  node: AgentOutputBlockNode | LexicalNode | null | undefined,
+): node is AgentOutputBlockNode {
+  return node instanceof AgentOutputBlockNode
+}
diff --git a/web/app/components/base/prompt-editor/plugins/agent-output-block/utils.ts b/web/app/components/base/prompt-editor/plugins/agent-output-block/utils.ts
new file mode 100644
index 00000000000..a45152d4f2b
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/agent-output-block/utils.ts
@@ -0,0 +1,174 @@
+import type { DeclaredOutputConfig, DeclaredOutputType } from '@dify/contracts/api/console/apps/types.gen'
+
+export type AgentOutputTypeOptionValue
+  = DeclaredOutputType
+    | 'array[boolean]'
+    | 'array[file]'
+    | 'array[number]'
+    | 'array[object]'
+    | 'array[string]'
+
+export type AgentOutputTypeOption = {
+  label: string
+  type: DeclaredOutputType
+  value: AgentOutputTypeOptionValue
+  arrayItemType?: DeclaredOutputType
+}
+
+const AGENT_OUTPUT_TOKEN_REGEX = /\[§output:([^:§\]]+):([^:§\]]+)§\]/
+const LEGACY_AGENT_OUTPUT_TOKEN_REGEX = /§output:([^:§\]]+):([^:§\]]+)§/
+export const AGENT_OUTPUT_NAME_PATTERN = /^[a-z_][\w.-]*$/i
+const AGENT_OUTPUT_FILE_NAME_PATTERN = /^[^.][^/\\:*?"<>|\n\r]*\.([a-z0-9]{1,16})$/i
+const AGENT_OUTPUT_FILE_EXTENSION_WHITELIST = new Set([
+  'amr',
+  'csv',
+  'doc',
+  'docx',
+  'eml',
+  'epub',
+  'gif',
+  'html',
+  'jpeg',
+  'jpg',
+  'm4a',
+  'markdown',
+  'md',
+  'mdx',
+  'mov',
+  'mp3',
+  'mp4',
+  'mpeg',
+  'mpga',
+  'msg',
+  'pdf',
+  'png',
+  'ppt',
+  'pptx',
+  'svg',
+  'txt',
+  'wav',
+  'webm',
+  'webp',
+  'xls',
+  'xlsx',
+  'xml',
+])
+
+export function getAgentOutputToken(name: string) {
+  return `[§output:${name}:${name}§]`
+}
+
+export function parseAgentOutputToken(text: string) {
+  const match = AGENT_OUTPUT_TOKEN_REGEX.exec(text) ?? LEGACY_AGENT_OUTPUT_TOKEN_REGEX.exec(text)
+  if (!match)
+    return null
+
+  return {
+    name: match[1]!,
+    start: match.index,
+    end: match.index + match[0].length,
+  }
+}
+
+export function extractAgentOutputNames(text: string) {
+  const names = new Set<string>()
+  const bracketedRegex = new RegExp(AGENT_OUTPUT_TOKEN_REGEX.source, 'g')
+  const legacyRegex = new RegExp(LEGACY_AGENT_OUTPUT_TOKEN_REGEX.source, 'g')
+
+  for (const match of text.matchAll(bracketedRegex))
+    names.add(match[1]!)
+
+  for (const match of text.matchAll(legacyRegex))
+    names.add(match[1]!)
+
+  return names
+}
+
+export function replaceAgentOutputName(text: string, oldName: string, nextName: string) {
+  const replaceTokenName = (match: string, name: string, mirrorName: string) => {
+    if (name !== oldName)
+      return match
+
+    return match.replace(`${name}:${mirrorName}`, `${nextName}:${nextName}`)
+  }
+
+  return text
+    .replace(new RegExp(AGENT_OUTPUT_TOKEN_REGEX.source, 'g'), replaceTokenName)
+    .replace(new RegExp(LEGACY_AGENT_OUTPUT_TOKEN_REGEX.source, 'g'), replaceTokenName)
+}
+
+export const AGENT_OUTPUT_TYPE_OPTIONS: AgentOutputTypeOption[] = [
+  { value: 'string', label: 'string', type: 'string' },
+  { value: 'number', label: 'number', type: 'number' },
+  { value: 'boolean', label: 'boolean', type: 'boolean' },
+  { value: 'object', label: 'object', type: 'object' },
+  { value: 'file', label: 'file', type: 'file' },
+  { value: 'array[string]', label: 'array[string]', type: 'array', arrayItemType: 'string' },
+  { value: 'array[number]', label: 'array[number]', type: 'array', arrayItemType: 'number' },
+  { value: 'array[boolean]', label: 'array[boolean]', type: 'array', arrayItemType: 'boolean' },
+  { value: 'array[object]', label: 'array[object]', type: 'array', arrayItemType: 'object' },
+  { value: 'array[file]', label: 'array[file]', type: 'array', arrayItemType: 'file' },
+]
+
+export function getAgentOutputTypeOption(value: AgentOutputTypeOptionValue) {
+  return AGENT_OUTPUT_TYPE_OPTIONS.find(option => option.value === value) || AGENT_OUTPUT_TYPE_OPTIONS[0]!
+}
+
+function isSupportedAgentOutputFileName(name: string) {
+  const match = AGENT_OUTPUT_FILE_NAME_PATTERN.exec(name.trim())
+  if (!match)
+    return false
+
+  return AGENT_OUTPUT_FILE_EXTENSION_WHITELIST.has(match[1]!.toLowerCase())
+}
+
+export function inferAgentOutputType(name: string, fallbackType: AgentOutputTypeOptionValue): AgentOutputTypeOptionValue {
+  if (isSupportedAgentOutputFileName(name))
+    return 'file'
+
+  return fallbackType
+}
+
+export function getAgentOutputTypeOptionValue(output: DeclaredOutputConfig): AgentOutputTypeOptionValue {
+  if (output.type !== 'array')
+    return output.type
+
+  return `array[${output.array_item?.type || 'object'}]` as AgentOutputTypeOptionValue
+}
+
+export function createAgentOutputConfig(name: string, type: AgentOutputTypeOptionValue): DeclaredOutputConfig {
+  const option = getAgentOutputTypeOption(type)
+  const output: DeclaredOutputConfig = {
+    name: name.trim(),
+    type: option.type,
+    required: false,
+  }
+
+  if (option.type === 'array') {
+    output.array_item = {
+      type: option.arrayItemType || 'object',
+    }
+  }
+
+  if (option.type === 'file') {
+    output.file = {
+      extensions: [],
+      mime_types: [],
+    }
+  }
+
+  return output
+}
+
+export function getUniqueAgentOutputName(outputs: DeclaredOutputConfig[]) {
+  const outputNames = new Set(outputs.map(output => output.name))
+  const baseName = 'output'
+  if (!outputNames.has(baseName))
+    return baseName
+
+  let index = 1
+  while (outputNames.has(`${baseName}_${index}`))
+    index += 1
+
+  return `${baseName}_${index}`
+}
diff --git a/web/app/components/base/prompt-editor/plugins/component-picker-block/__tests__/index.spec.tsx b/web/app/components/base/prompt-editor/plugins/component-picker-block/__tests__/index.spec.tsx
index 886b23f18b2..9465c2027fe 100644
--- a/web/app/components/base/prompt-editor/plugins/component-picker-block/__tests__/index.spec.tsx
+++ b/web/app/components/base/prompt-editor/plugins/component-picker-block/__tests__/index.spec.tsx
@@ -1,6 +1,7 @@
 import type { EventEmitter } from 'ahooks/lib/useEventEmitter'
 import type { LexicalEditor } from 'lexical'
 import type {
+  AgentOutputBlockType,
   ContextBlockType,
   CurrentBlockType,
   ErrorMessageBlockType,
@@ -33,6 +34,7 @@ import { VAR_REFERENCE_CHILD_POPUP_CLASS_NAME } from '@/app/components/workflow/
 import { VarType } from '@/app/components/workflow/types'
 import { useEventEmitterContextContext } from '@/context/event-emitter'
 import { EventEmitterContextProvider } from '@/context/event-emitter-provider'
+import { INSERT_AGENT_OUTPUT_BLOCK_COMMAND } from '../../agent-output-block/commands'
 import { INSERT_CONTEXT_BLOCK_COMMAND } from '../../context-block'
 import { INSERT_CURRENT_BLOCK_COMMAND } from '../../current-block'
 import { INSERT_ERROR_MESSAGE_BLOCK_COMMAND } from '../../error-message-block'
@@ -148,6 +150,7 @@ const MinimalEditor: React.FC<{
   queryBlock?: QueryBlockType
   variableBlock?: VariableBlockType
   workflowVariableBlock?: WorkflowVariableBlockType
+  agentOutputBlock?: AgentOutputBlockType
   currentBlock?: CurrentBlockType
   errorMessageBlock?: ErrorMessageBlockType
   lastRunBlock?: LastRunBlockType
@@ -158,6 +161,7 @@ const MinimalEditor: React.FC<{
   queryBlock,
   variableBlock,
   workflowVariableBlock,
+  agentOutputBlock,
   currentBlock,
   errorMessageBlock,
   lastRunBlock,
@@ -187,6 +191,7 @@ const MinimalEditor: React.FC<{
           queryBlock={queryBlock}
           variableBlock={variableBlock}
           workflowVariableBlock={workflowVariableBlock}
+          agentOutputBlock={agentOutputBlock}
           currentBlock={currentBlock}
           errorMessageBlock={errorMessageBlock}
           lastRunBlock={lastRunBlock}
@@ -600,6 +605,48 @@ describe('ComponentPicker (component-picker-block/index.tsx)', () => {
     })
   })
 
+  it('clears slash trigger state after creating an agent output from the footer action', async () => {
+    const captures: Captures = { editor: null, eventEmitter: null }
+
+    render((
+      <MinimalEditor
+        triggerString="/"
+        workflowVariableBlock={makeWorkflowVariableBlock({}, [
+          makeWorkflowVarNode('node-1', 'Node 1', [
+            makeWorkflowNodeVar('output', VarType.string),
+          ]),
+        ])}
+        agentOutputBlock={{
+          show: true,
+          outputs: [],
+          onChange: vi.fn(),
+        }}
+        captures={captures}
+      />
+    ))
+
+    const editor = await waitForEditor(captures)
+    const dispatchSpy = vi.spyOn(editor, 'dispatchCommand')
+
+    await setEditorText(editor, '/', true)
+    await flushNextTick()
+
+    const newOutputAction = await screen.findByText('workflow.nodes.agent.outputVars.newOutput')
+    fireEvent.click(newOutputAction)
+
+    expect(dispatchSpy).toHaveBeenCalledWith(INSERT_AGENT_OUTPUT_BLOCK_COMMAND, undefined)
+    await waitFor(() => {
+      expect(readEditorText(editor)).not.toContain('/')
+      expect(screen.queryByText('workflow.nodes.agent.outputVars.newOutput')).not.toBeInTheDocument()
+    })
+
+    const editable = screen.getByTestId(CONTENT_EDITABLE_TEST_ID)
+    fireEvent.focus(editable)
+
+    await flushNextTick()
+    expect(screen.queryByText('workflow.nodes.agent.outputVars.newOutput')).not.toBeInTheDocument()
+  })
+
   it('defaults to the first workflow variable and removes the full slash query when selecting by keyboard', async () => {
     const captures: Captures = { editor: null, eventEmitter: null }
 
diff --git a/web/app/components/base/prompt-editor/plugins/component-picker-block/index.tsx b/web/app/components/base/prompt-editor/plugins/component-picker-block/index.tsx
index 5aa207e2d39..afe43d2c379 100644
--- a/web/app/components/base/prompt-editor/plugins/component-picker-block/index.tsx
+++ b/web/app/components/base/prompt-editor/plugins/component-picker-block/index.tsx
@@ -1,6 +1,7 @@
 import type { MenuRenderFn } from '@lexical/react/LexicalTypeaheadMenuPlugin'
 import type { LexicalEditor, TextNode } from 'lexical'
 import type {
+  AgentOutputBlockType,
   ContextBlockType,
   CurrentBlockType,
   ErrorMessageBlockType,
@@ -39,11 +40,13 @@ import {
   useState,
 } from 'react'
 import ReactDOM from 'react-dom'
+import { useTranslation } from 'react-i18next'
 import { GeneratorType } from '@/app/components/app/configuration/config/automatic/types'
 import VarReferenceVars, { VAR_REFERENCE_CHILD_POPUP_CLASS_NAME } from '@/app/components/workflow/nodes/_base/components/variable/var-reference-vars'
 import { useEventEmitterContextContext } from '@/context/event-emitter'
 import { useBasicTypeaheadTriggerMatch } from '../../hooks'
 import { $splitNodeContainingQuery } from '../../utils'
+import { INSERT_AGENT_OUTPUT_BLOCK_COMMAND } from '../agent-output-block/commands'
 import { INSERT_CURRENT_BLOCK_COMMAND } from '../current-block'
 import { INSERT_ERROR_MESSAGE_BLOCK_COMMAND } from '../error-message-block'
 import { INSERT_LAST_RUN_BLOCK_COMMAND } from '../last-run-block'
@@ -60,6 +63,7 @@ type ComponentPickerProps = {
   variableBlock?: VariableBlockType
   externalToolBlock?: ExternalToolBlockType
   workflowVariableBlock?: WorkflowVariableBlockType
+  agentOutputBlock?: AgentOutputBlockType
   currentBlock?: CurrentBlockType
   errorMessageBlock?: ErrorMessageBlockType
   lastRunBlock?: LastRunBlockType
@@ -74,11 +78,13 @@ const ComponentPicker = ({
   variableBlock,
   externalToolBlock,
   workflowVariableBlock,
+  agentOutputBlock,
   currentBlock,
   errorMessageBlock,
   lastRunBlock,
   isSupportFileVar,
 }: ComponentPickerProps) => {
+  const { t } = useTranslation()
   const { eventEmitter } = useEventEmitterContextContext()
   const { refs, floatingStyles, isPositioned } = useFloating({
     placement: 'bottom-start',
@@ -105,6 +111,7 @@ const ComponentPicker = ({
   const [queryString, setQueryString] = useState<string | null>(null)
   const [blurHidden, setBlurHidden] = useState(false)
   const blurTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+  const showAgentOutputAction = triggerString === '/' && agentOutputBlock?.show
 
   const clearBlurTimer = useCallback(() => {
     if (blurTimerRef.current) {
@@ -210,6 +217,12 @@ const ComponentPicker = ({
     }
   }, [editor, currentBlock?.generatorType, checkForTriggerMatch, triggerString])
 
+  const resetTypeaheadState = useCallback(() => {
+    triggerMatchRef.current = null
+    setQueryString(null)
+    setBlurHidden(true)
+  }, [])
+
   const handleClose = useCallback(() => {
     const escapeEvent = new KeyboardEvent('keydown', { key: 'Escape' })
     editor.dispatchCommand(KEY_ESCAPE_COMMAND, escapeEvent)
@@ -223,7 +236,7 @@ const ComponentPicker = ({
 
     if (blurHidden)
       return null
-    if (!(anchorElementRef.current && (allFlattenOptions.length || workflowVariableBlock?.show)))
+    if (!(anchorElementRef.current && (allFlattenOptions.length || workflowVariableBlock?.show || showAgentOutputAction)))
       return null
 
     setTimeout(() => {
@@ -299,6 +312,29 @@ const ComponentPicker = ({
                     ))
                   }
                 </div>
+                {showAgentOutputAction && (
+                  <div className="mt-1 border-t border-divider-subtle p-1">
+                    <button
+                      type="button"
+                      className="flex h-6 w-full items-center gap-1 rounded-md py-1 pr-1 pl-3 text-left system-sm-regular text-text-secondary hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+                      onMouseDown={event => event.preventDefault()}
+                      onClick={() => {
+                        editor.update(() => {
+                          const currentTriggerMatch = triggerMatchRef.current ?? checkForTriggerMatch(triggerString, editor)
+                          const needRemove = currentTriggerMatch ? $splitNodeContainingQuery(currentTriggerMatch) : null
+                          if (needRemove)
+                            needRemove.remove()
+                        })
+                        editor.dispatchCommand(INSERT_AGENT_OUTPUT_BLOCK_COMMAND, undefined)
+                        resetTypeaheadState()
+                      }}
+                    >
+                      <span aria-hidden="true" className="i-ri-add-line size-4 shrink-0" />
+                      <span className="min-w-0 flex-1 truncate">{t('nodes.agent.outputVars.newOutput', { ns: 'workflow' })}</span>
+                      <span aria-hidden="true" className="i-ri-question-line size-3.5 shrink-0 text-text-quaternary" />
+                    </button>
+                  </div>
+                )}
               </div>
             </div>,
             anchorElementRef.current,
@@ -306,7 +342,7 @@ const ComponentPicker = ({
         }
       </>
     )
-  }, [blurHidden, allFlattenOptions.length, workflowVariableBlock?.show, floatingStyles, isPositioned, refs, workflowVariableOptions, isSupportFileVar, handleClose, currentBlock?.generatorType, handleSelectWorkflowVariable, queryString, triggerString, workflowVariableBlock?.showManageInputField, workflowVariableBlock?.onManageInputField])
+  }, [blurHidden, allFlattenOptions.length, workflowVariableBlock?.show, showAgentOutputAction, floatingStyles, isPositioned, refs, workflowVariableOptions, isSupportFileVar, handleClose, currentBlock?.generatorType, handleSelectWorkflowVariable, queryString, triggerString, workflowVariableBlock?.showManageInputField, workflowVariableBlock?.onManageInputField, editor, checkForTriggerMatch, t, resetTypeaheadState])
 
   return (
     <LexicalTypeaheadMenuPlugin
diff --git a/web/app/components/base/prompt-editor/plugins/roster-reference-block/__tests__/node.spec.tsx b/web/app/components/base/prompt-editor/plugins/roster-reference-block/__tests__/node.spec.tsx
new file mode 100644
index 00000000000..178a20f71d6
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/roster-reference-block/__tests__/node.spec.tsx
@@ -0,0 +1,119 @@
+import type {
+  Klass,
+  LexicalEditor,
+  LexicalNode,
+} from 'lexical'
+import { render, screen } from '@testing-library/react'
+import { createEditor } from 'lexical'
+import RosterReferenceBlockComponent from '../component'
+import {
+  $createRosterReferenceBlockNode,
+  $isRosterReferenceBlockNode,
+  RosterReferenceBlockNode,
+} from '../node'
+import {
+  getRosterReferenceFileIconType,
+  parseRosterReferenceToken,
+} from '../utils'
+
+describe('RosterReferenceBlockNode', () => {
+  let editor: LexicalEditor
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    editor = createEditor({
+      nodes: [RosterReferenceBlockNode as unknown as Klass<LexicalNode>],
+    })
+  })
+
+  const runInEditor = (callback: () => void) => {
+    editor.update(callback, { discrete: true })
+  }
+
+  it('should parse roster reference tokens and infer icon classes', () => {
+    expect(parseRosterReferenceToken('[§skill:2c3176de8a01:tender-analyzer§]')).toEqual({
+      kind: 'skill',
+      id: '2c3176de8a01',
+      label: 'tender-analyzer',
+    })
+    expect(parseRosterReferenceToken('[§file:1f0ad3e2:qna_report:final.pdf§]')).toEqual({
+      kind: 'file',
+      id: '1f0ad3e2',
+      label: 'qna_report:final.pdf',
+    })
+    expect(parseRosterReferenceToken('[§unknown:1:item§]')).toBeNull()
+    expect(getRosterReferenceFileIconType('qna_report.pdf')).toBe('pdf')
+  })
+
+  it('should render a non-editable token pill component', () => {
+    const { container } = render(
+      <RosterReferenceBlockComponent text="[§tool-all:tavily/tavily:tavily§]" />,
+    )
+
+    const token = screen.getByTitle('tavily')
+    expect(token).toHaveAttribute('contenteditable', 'false')
+    expect(token).toHaveAttribute('data-roster-reference-kind', 'tool-all')
+    expect(token).toHaveAttribute('data-roster-reference-id', 'tavily/tavily')
+    expect(token).toHaveClass('border-state-accent-hover-alt')
+    expect(token).toHaveClass('bg-state-accent-hover')
+    expect(token).toHaveTextContent('tavily')
+    expect(container.querySelector('.i-custom-public-other-default-tool-icon')).toBeInTheDocument()
+  })
+
+  it('should render knowledge icon with the configured retrieval row style', () => {
+    const { container } = render(
+      <RosterReferenceBlockComponent text="[§knowledge:manual-1:产品手册§]" />,
+    )
+
+    const iconShell = container.querySelector('.bg-util-colors-green-green-500')
+    expect(iconShell).toBeInTheDocument()
+    expect(iconShell).toHaveClass('text-text-primary-on-surface')
+    expect(iconShell?.querySelector('.i-ri-book-open-line')).toBeInTheDocument()
+  })
+
+  it('should expose DecoratorNode behavior and preserve raw text content', () => {
+    runInEditor(() => {
+      const node = new RosterReferenceBlockNode('[§tool-all:tavily/tavily:tavily§]', 'node-key')
+      const cloned = RosterReferenceBlockNode.clone(node)
+      const dom = node.createDOM()
+
+      expect(RosterReferenceBlockNode.getType()).toBe('roster-reference-block')
+      expect(cloned).toBeInstanceOf(RosterReferenceBlockNode)
+      expect(cloned.getKey()).toBe('node-key')
+      expect(node.isInline()).toBe(true)
+      expect(dom).toHaveClass('inline-flex')
+      expect(dom).toHaveClass('align-middle')
+      expect(node.getTextContent()).toBe('[§tool-all:tavily/tavily:tavily§]')
+    })
+  })
+
+  it('should import and export serialized node text', () => {
+    runInEditor(() => {
+      const imported = RosterReferenceBlockNode.importJSON({
+        text: '[§knowledge:manual-1:产品手册§]',
+        type: 'roster-reference-block',
+        version: 1,
+      })
+      const exported = imported.exportJSON()
+
+      expect(exported).toEqual({
+        text: '[§knowledge:manual-1:产品手册§]',
+        type: 'roster-reference-block',
+        version: 1,
+      })
+    })
+  })
+
+  it('should create node with helper and support type guard checks', () => {
+    runInEditor(() => {
+      const node = $createRosterReferenceBlockNode('[§skill:playwright:Playwright§]')
+
+      expect(node).toBeInstanceOf(RosterReferenceBlockNode)
+      expect(node.getTextContent()).toBe('[§skill:playwright:Playwright§]')
+      expect($isRosterReferenceBlockNode(node)).toBe(true)
+      expect($isRosterReferenceBlockNode(null)).toBe(false)
+      expect($isRosterReferenceBlockNode(undefined)).toBe(false)
+      expect($isRosterReferenceBlockNode({} as LexicalNode)).toBe(false)
+    })
+  })
+})
diff --git a/web/app/components/base/prompt-editor/plugins/roster-reference-block/component.tsx b/web/app/components/base/prompt-editor/plugins/roster-reference-block/component.tsx
new file mode 100644
index 00000000000..bfe83cd322b
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/roster-reference-block/component.tsx
@@ -0,0 +1,55 @@
+import { cn } from '@langgenius/dify-ui/cn'
+import { FileTreeIcon } from '@langgenius/dify-ui/file-tree'
+import { use } from 'react'
+import { RosterReferenceBlockContext } from './context'
+import {
+  getRosterReferenceFileIconType,
+  getRosterReferenceIconClassName,
+  parseRosterReferenceToken,
+} from './utils'
+
+type RosterReferenceBlockComponentProps = {
+  text: string
+}
+
+const RosterReferenceBlockComponent = ({
+  text,
+}: RosterReferenceBlockComponentProps) => {
+  const rosterReferenceBlock = use(RosterReferenceBlockContext)
+  const token = parseRosterReferenceToken(text)
+
+  if (!token)
+    return null
+
+  const isKnowledge = token.kind === 'knowledge'
+  const customIcon = rosterReferenceBlock?.renderIcon?.(token)
+  const defaultIcon = token.kind === 'file'
+    ? <FileTreeIcon type={getRosterReferenceFileIconType(token.label)} className="size-4" />
+    : <span className={cn(isKnowledge ? 'size-3.5' : 'size-3.5 shrink-0', getRosterReferenceIconClassName(token))} />
+
+  return (
+    <span
+      contentEditable={false}
+      data-roster-reference-kind={token.kind}
+      data-roster-reference-id={token.id}
+      title={token.label}
+      className="inline-flex min-w-[18px] items-center gap-0.5 overflow-hidden rounded-[5px] border border-state-accent-hover-alt bg-state-accent-hover py-px pr-1 pl-px align-middle shadow-xs shadow-shadow-shadow-3"
+    >
+      <span
+        aria-hidden
+        className={cn(
+          'inline-flex size-4 shrink-0 items-center justify-center rounded-[5px] border-[0.5px] border-divider-subtle bg-background-default-dodge',
+          token.kind === 'cli_tool' && 'border-divider-regular bg-text-tertiary',
+          isKnowledge && 'border-divider-subtle bg-util-colors-green-green-500 p-[3px] text-text-primary-on-surface shadow-xs shadow-shadow-shadow-3',
+        )}
+      >
+        {customIcon || defaultIcon}
+      </span>
+      <span className="max-w-48 truncate system-xs-medium text-text-accent">
+        {token.label}
+      </span>
+    </span>
+  )
+}
+
+export default RosterReferenceBlockComponent
diff --git a/web/app/components/base/prompt-editor/plugins/roster-reference-block/context.ts b/web/app/components/base/prompt-editor/plugins/roster-reference-block/context.ts
new file mode 100644
index 00000000000..2669dc27178
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/roster-reference-block/context.ts
@@ -0,0 +1,4 @@
+import type { RosterReferenceBlockType } from '../../types'
+import { createContext } from 'react'
+
+export const RosterReferenceBlockContext = createContext<RosterReferenceBlockType | undefined>(undefined)
diff --git a/web/app/components/base/prompt-editor/plugins/roster-reference-block/index.tsx b/web/app/components/base/prompt-editor/plugins/roster-reference-block/index.tsx
new file mode 100644
index 00000000000..64354617017
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/roster-reference-block/index.tsx
@@ -0,0 +1,63 @@
+import type { EntityMatch } from '@lexical/text'
+import type { LexicalEditor, TextNode } from 'lexical'
+import { useLexicalComposerContext } from '@lexical/react/LexicalComposerContext'
+import { mergeRegister } from '@lexical/utils'
+import { $applyNodeReplacement } from 'lexical'
+import {
+  useCallback,
+  useEffect,
+} from 'react'
+import { decoratorTransform } from '../../utils'
+import { CustomTextNode } from '../custom-text/node'
+import { RosterReferenceBlockNode } from './node'
+import { ROSTER_REFERENCE_REGEX } from './utils'
+
+type RosterReferenceNodeRegistry = {
+  _nodes: Map<string, { klass: typeof RosterReferenceBlockNode }>
+}
+
+function createRegisteredRosterReferenceBlockNode(editor: LexicalEditor, textNode: TextNode): RosterReferenceBlockNode {
+  const RegisteredRosterReferenceBlockNode = (editor as unknown as RosterReferenceNodeRegistry)
+    ._nodes
+    .get(RosterReferenceBlockNode.getType())
+    ?.klass ?? RosterReferenceBlockNode
+
+  return $applyNodeReplacement(new RegisteredRosterReferenceBlockNode(textNode.getTextContent()))
+}
+
+const RosterReferenceBlock = () => {
+  const [editor] = useLexicalComposerContext()
+
+  useEffect(() => {
+    if (!editor.hasNodes([RosterReferenceBlockNode]))
+      throw new Error('RosterReferenceBlockPlugin: RosterReferenceBlockNode not registered on editor')
+  }, [editor])
+
+  const createRosterReferenceBlockNode = useCallback((textNode: CustomTextNode): RosterReferenceBlockNode => (
+    createRegisteredRosterReferenceBlockNode(editor, textNode)
+  ), [editor])
+
+  const getRosterReferenceMatch = useCallback((text: string): EntityMatch | null => {
+    const matchArr = ROSTER_REFERENCE_REGEX.exec(text)
+
+    if (matchArr === null)
+      return null
+
+    const startOffset = matchArr.index
+    const endOffset = startOffset + matchArr[0].length
+    return {
+      end: endOffset,
+      start: startOffset,
+    }
+  }, [])
+
+  useEffect(() => {
+    return mergeRegister(
+      editor.registerNodeTransform(CustomTextNode, textNode => decoratorTransform(textNode, getRosterReferenceMatch, createRosterReferenceBlockNode)),
+    )
+  }, [createRosterReferenceBlockNode, editor, getRosterReferenceMatch])
+
+  return null
+}
+
+export default RosterReferenceBlock
diff --git a/web/app/components/base/prompt-editor/plugins/roster-reference-block/node.tsx b/web/app/components/base/prompt-editor/plugins/roster-reference-block/node.tsx
new file mode 100644
index 00000000000..19c33f44918
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/roster-reference-block/node.tsx
@@ -0,0 +1,76 @@
+import type {
+  LexicalNode,
+  NodeKey,
+  SerializedLexicalNode,
+} from 'lexical'
+import type { JSX } from 'react'
+import {
+  $applyNodeReplacement,
+  DecoratorNode,
+} from 'lexical'
+import RosterReferenceBlockComponent from './component'
+
+type SerializedRosterReferenceBlockNode = SerializedLexicalNode & {
+  text: string
+}
+
+export class RosterReferenceBlockNode extends DecoratorNode<JSX.Element> {
+  __text: string
+
+  static override getType(): string {
+    return 'roster-reference-block'
+  }
+
+  static override clone(node: RosterReferenceBlockNode): RosterReferenceBlockNode {
+    return new RosterReferenceBlockNode(node.__text, node.__key)
+  }
+
+  constructor(text: string, key?: NodeKey) {
+    super(key)
+    this.__text = text
+  }
+
+  override isInline(): boolean {
+    return true
+  }
+
+  override createDOM(): HTMLElement {
+    const span = document.createElement('span')
+    span.classList.add('inline-flex', 'items-center', 'align-middle')
+    return span
+  }
+
+  override updateDOM(): false {
+    return false
+  }
+
+  override decorate(): JSX.Element {
+    return <RosterReferenceBlockComponent text={this.getTextContent()} />
+  }
+
+  static override importJSON(serializedNode: SerializedRosterReferenceBlockNode): RosterReferenceBlockNode {
+    return $createRosterReferenceBlockNode(serializedNode.text)
+  }
+
+  override exportJSON(): SerializedRosterReferenceBlockNode {
+    return {
+      text: this.getTextContent(),
+      type: 'roster-reference-block',
+      version: 1,
+    }
+  }
+
+  override getTextContent(): string {
+    return this.getLatest().__text
+  }
+}
+
+export function $createRosterReferenceBlockNode(text = ''): RosterReferenceBlockNode {
+  return $applyNodeReplacement(new RosterReferenceBlockNode(text))
+}
+
+export function $isRosterReferenceBlockNode(
+  node: LexicalNode | null | undefined,
+): node is RosterReferenceBlockNode {
+  return node instanceof RosterReferenceBlockNode
+}
diff --git a/web/app/components/base/prompt-editor/plugins/roster-reference-block/utils.ts b/web/app/components/base/prompt-editor/plugins/roster-reference-block/utils.ts
new file mode 100644
index 00000000000..82af42492da
--- /dev/null
+++ b/web/app/components/base/prompt-editor/plugins/roster-reference-block/utils.ts
@@ -0,0 +1,111 @@
+import type { FileTreeIconType } from '@langgenius/dify-ui/file-tree'
+
+type RosterReferenceKind = 'skill' | 'file' | 'tool-all' | 'tool' | 'cli_tool' | 'knowledge'
+
+export type RosterReferenceToken = {
+  kind: RosterReferenceKind
+  id: string
+  label: string
+}
+
+export const ROSTER_REFERENCE_REGEX = /\[§(?:skill|file|tool-all|tool|cli_tool|knowledge):[^\]§\n\r]+§\]/
+
+const KNOWN_KINDS = new Set<RosterReferenceKind>([
+  'skill',
+  'file',
+  'tool-all',
+  'tool',
+  'cli_tool',
+  'knowledge',
+])
+
+export function parseRosterReferenceToken(text: string): RosterReferenceToken | null {
+  if (!text.startsWith('[§') || !text.endsWith('§]'))
+    return null
+
+  const body = text.slice(2, -2)
+  const firstColonIndex = body.indexOf(':')
+  if (firstColonIndex === -1)
+    return null
+
+  const kind = body.slice(0, firstColonIndex) as RosterReferenceKind
+  if (!KNOWN_KINDS.has(kind))
+    return null
+
+  const rest = body.slice(firstColonIndex + 1)
+  const secondColonIndex = rest.indexOf(':')
+  const id = secondColonIndex === -1 ? rest : rest.slice(0, secondColonIndex)
+  const label = secondColonIndex === -1 ? id : rest.slice(secondColonIndex + 1)
+
+  if (!id || !label)
+    return null
+
+  return {
+    kind,
+    id,
+    label,
+  }
+}
+
+const codeFileExtensions = new Set([
+  'css',
+  'go',
+  'html',
+  'htm',
+  'js',
+  'jsx',
+  'py',
+  'rb',
+  'rs',
+  'scss',
+  'sh',
+  'ts',
+  'tsx',
+  'vue',
+  'yaml',
+  'yml',
+])
+const imageFileExtensions = new Set(['apng', 'avif', 'bmp', 'gif', 'ico', 'jpeg', 'jpg', 'png', 'svg', 'webp'])
+const tableFileExtensions = new Set(['csv', 'xls', 'xlsx'])
+const archiveFileExtensions = new Set(['7z', 'gz', 'rar', 'tar', 'zip'])
+
+export function getRosterReferenceFileIconType(label: string): FileTreeIconType {
+  const extension = label.includes('.') ? label.split('.').pop()?.toLowerCase() : undefined
+
+  if (!extension)
+    return 'folder'
+  if (imageFileExtensions.has(extension))
+    return 'image'
+  if (extension === 'pdf')
+    return 'pdf'
+  if (extension === 'md' || extension === 'markdown' || extension === 'mdx')
+    return 'markdown'
+  if (extension === 'json')
+    return 'json'
+  if (tableFileExtensions.has(extension))
+    return 'table'
+  if (archiveFileExtensions.has(extension))
+    return 'archive'
+  if (codeFileExtensions.has(extension))
+    return 'code'
+  if (extension === 'txt')
+    return 'text'
+
+  return 'file'
+}
+
+export function getRosterReferenceIconClassName(token: RosterReferenceToken) {
+  switch (token.kind) {
+    case 'skill':
+      return 'i-custom-public-agent-building-blocks text-text-tertiary'
+    case 'file':
+      return ''
+    case 'tool-all':
+    case 'tool':
+      return 'i-custom-public-other-default-tool-icon text-[#ef5b39]'
+    case 'cli_tool':
+      return 'i-ri-terminal-box-line text-text-primary-on-surface'
+    case 'knowledge':
+      return 'i-ri-book-open-line'
+  }
+}
diff --git a/web/app/components/base/prompt-editor/prompt-editor-content.tsx b/web/app/components/base/prompt-editor/prompt-editor-content.tsx
index ac2385fa341..db0a8361c29 100644
--- a/web/app/components/base/prompt-editor/prompt-editor-content.tsx
+++ b/web/app/components/base/prompt-editor/prompt-editor-content.tsx
@@ -2,6 +2,7 @@ import type { EditorState } from 'lexical'
 import type { FC } from 'react'
 import type { Hotkey, ShortcutPopupDisplayMode, ShortcutPopupInsertHandler } from './plugins/shortcuts-popup-plugin'
 import type {
+  AgentOutputBlockType,
   ContextBlockType,
   CurrentBlockType,
   ErrorMessageBlockType,
@@ -11,6 +12,7 @@ import type {
   LastRunBlockType,
   QueryBlockType,
   RequestURLBlockType,
+  RosterReferenceBlockType,
   VariableBlockType,
   WorkflowVariableBlockType,
 } from './types'
@@ -21,6 +23,10 @@ import { HistoryPlugin } from '@lexical/react/LexicalHistoryPlugin'
 import { OnChangePlugin } from '@lexical/react/LexicalOnChangePlugin'
 import { RichTextPlugin } from '@lexical/react/LexicalRichTextPlugin'
 import * as React from 'react'
+import {
+  AgentOutputBlock,
+  AgentOutputBlockReplacementBlock,
+} from './plugins/agent-output-block'
 import ComponentPickerBlock from './plugins/component-picker-block'
 import {
   ContextBlock,
@@ -57,6 +63,8 @@ import {
   RequestURLBlock,
   RequestURLBlockReplacementBlock,
 } from './plugins/request-url-block'
+import RosterReferenceBlock from './plugins/roster-reference-block'
+import { RosterReferenceBlockContext } from './plugins/roster-reference-block/context'
 import ShortcutsPopupPlugin from './plugins/shortcuts-popup-plugin'
 import UpdateBlock from './plugins/update-block'
 import VariableBlock from './plugins/variable-block'
@@ -84,13 +92,17 @@ type PromptEditorContentProps = {
   requestURLBlock?: RequestURLBlockType
   historyBlock?: HistoryBlockType
   variableBlock?: VariableBlockType
+  rosterReferenceBlock?: RosterReferenceBlockType
   externalToolBlock?: ExternalToolBlockType
   workflowVariableBlock?: WorkflowVariableBlockType
+  agentOutputBlock?: AgentOutputBlockType
   hitlInputBlock?: HITLInputBlockType
   currentBlock?: CurrentBlockType
   errorMessageBlock?: ErrorMessageBlockType
   lastRunBlock?: LastRunBlockType
   isSupportFileVar?: boolean
+  disableSlashPicker?: boolean
+  disableBracePicker?: boolean
   onBlur?: () => void
   onFocus?: () => void
   instanceId?: string
@@ -110,13 +122,17 @@ const PromptEditorContent: FC<PromptEditorContentProps> = ({
   requestURLBlock,
   historyBlock,
   variableBlock,
+  rosterReferenceBlock,
   externalToolBlock,
   workflowVariableBlock,
+  agentOutputBlock,
   hitlInputBlock,
   currentBlock,
   errorMessageBlock,
   lastRunBlock,
   isSupportFileVar,
+  disableSlashPicker,
+  disableBracePicker,
   onBlur,
   onFocus,
   instanceId,
@@ -124,7 +140,7 @@ const PromptEditorContent: FC<PromptEditorContentProps> = ({
   onEditorChange,
 }) => {
   return (
-    <>
+    <RosterReferenceBlockContext value={rosterReferenceBlock}>
       <RichTextPlugin
         contentEditable={(
           <ContentEditable
@@ -150,34 +166,40 @@ const PromptEditorContent: FC<PromptEditorContentProps> = ({
           {(closePortal, onInsert) => <Popup onClose={closePortal} onInsert={onInsert} />}
         </ShortcutsPopupPlugin>
       ))}
-      <ComponentPickerBlock
-        triggerString="/"
-        contextBlock={contextBlock}
-        historyBlock={historyBlock}
-        queryBlock={queryBlock}
-        requestURLBlock={requestURLBlock}
-        variableBlock={variableBlock}
-        externalToolBlock={externalToolBlock}
-        workflowVariableBlock={workflowVariableBlock}
-        currentBlock={currentBlock}
-        errorMessageBlock={errorMessageBlock}
-        lastRunBlock={lastRunBlock}
-        isSupportFileVar={isSupportFileVar}
-      />
-      <ComponentPickerBlock
-        triggerString="{"
-        contextBlock={contextBlock}
-        historyBlock={historyBlock}
-        queryBlock={queryBlock}
-        requestURLBlock={requestURLBlock}
-        variableBlock={variableBlock}
-        externalToolBlock={externalToolBlock}
-        workflowVariableBlock={workflowVariableBlock}
-        currentBlock={currentBlock}
-        errorMessageBlock={errorMessageBlock}
-        lastRunBlock={lastRunBlock}
-        isSupportFileVar={isSupportFileVar}
-      />
+      {!disableSlashPicker && (
+        <ComponentPickerBlock
+          triggerString="/"
+          contextBlock={contextBlock}
+          historyBlock={historyBlock}
+          queryBlock={queryBlock}
+          requestURLBlock={requestURLBlock}
+          variableBlock={variableBlock}
+          externalToolBlock={externalToolBlock}
+          workflowVariableBlock={workflowVariableBlock}
+          agentOutputBlock={agentOutputBlock}
+          currentBlock={currentBlock}
+          errorMessageBlock={errorMessageBlock}
+          lastRunBlock={lastRunBlock}
+          isSupportFileVar={isSupportFileVar}
+        />
+      )}
+      {!disableBracePicker && (
+        <ComponentPickerBlock
+          triggerString="{"
+          contextBlock={contextBlock}
+          historyBlock={historyBlock}
+          queryBlock={queryBlock}
+          requestURLBlock={requestURLBlock}
+          variableBlock={variableBlock}
+          externalToolBlock={externalToolBlock}
+          workflowVariableBlock={workflowVariableBlock}
+          agentOutputBlock={agentOutputBlock}
+          currentBlock={currentBlock}
+          errorMessageBlock={errorMessageBlock}
+          lastRunBlock={lastRunBlock}
+          isSupportFileVar={isSupportFileVar}
+        />
+      )}
       {contextBlock?.show && (
         <>
           <ContextBlock {...contextBlock} />
@@ -202,12 +224,21 @@ const PromptEditorContent: FC<PromptEditorContentProps> = ({
           <VariableValueBlock />
         </>
       )}
+      {rosterReferenceBlock?.show && (
+        <RosterReferenceBlock />
+      )}
       {workflowVariableBlock?.show && (
         <>
           <WorkflowVariableBlock {...workflowVariableBlock} />
           <WorkflowVariableBlockReplacementBlock {...workflowVariableBlock} />
         </>
       )}
+      {agentOutputBlock?.show && (
+        <>
+          <AgentOutputBlock {...agentOutputBlock} />
+          <AgentOutputBlockReplacementBlock {...agentOutputBlock} />
+        </>
+      )}
       {hitlInputBlock?.show && (
         <>
           <HITLInputBlock {...hitlInputBlock} />
@@ -248,7 +279,7 @@ const PromptEditorContent: FC<PromptEditorContentProps> = ({
       {floatingAnchorElem && (
         <DraggableBlockPlugin anchorElem={floatingAnchorElem} />
       )}
-    </>
+    </RosterReferenceBlockContext>
   )
 }
 
diff --git a/web/app/components/base/prompt-editor/types.ts b/web/app/components/base/prompt-editor/types.ts
index 93bbb2f8b7c..5846ca51229 100644
--- a/web/app/components/base/prompt-editor/types.ts
+++ b/web/app/components/base/prompt-editor/types.ts
@@ -1,8 +1,10 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
 import type { GeneratorType } from '../../app/configuration/config/automatic/types'
 import type { FormInputItem } from '../../workflow/nodes/human-input/types'
 import type { Type } from '../../workflow/nodes/llm/types'
 import type { Dataset } from './plugins/context-block'
 import type { RoleName } from './plugins/history-block'
+import type { RosterReferenceToken } from './plugins/roster-reference-block/utils'
 import type {
   Node,
   NodeOutPutVar,
@@ -59,6 +61,11 @@ export type VariableBlockType = {
   variables?: Option[]
 }
 
+export type RosterReferenceBlockType = {
+  show?: boolean
+  renderIcon?: (token: RosterReferenceToken) => React.ReactNode
+}
+
 export type ExternalToolBlockType = {
   show?: boolean
   externalTools?: ExternalToolOption[]
@@ -81,6 +88,12 @@ export type WorkflowVariableBlockType = {
   onManageInputField?: () => void
 }
 
+export type AgentOutputBlockType = {
+  show?: boolean
+  outputs?: DeclaredOutputConfig[]
+  onChange?: (outputs: DeclaredOutputConfig[], prompt?: string) => void
+}
+
 export type WorkflowNodesMap = Record<string, Pick<Node['data'], 'title' | 'type' | 'height' | 'width' | 'position'> & { modelProvider?: string }>
 
 export type HITLInputBlockType = {
diff --git a/web/app/components/base/prompt-editor/utils.ts b/web/app/components/base/prompt-editor/utils.ts
index af1d0524009..2f94ba7d087 100644
--- a/web/app/components/base/prompt-editor/utils.ts
+++ b/web/app/components/base/prompt-editor/utils.ts
@@ -140,9 +140,9 @@ export function registerLexicalTextEntity<T extends TextNode>(
       let nodeToReplace
 
       if (match.start === 0)
-        [nodeToReplace, currentNode] = (currentNode.splitText(match.end)) as [any, TextNode]
+        [nodeToReplace, currentNode] = currentNode.splitText(match.end) as [TextNode, TextNode]
       else
-        [, nodeToReplace, currentNode] = (currentNode.splitText(match.start, match.end)) as [unknown, any, TextNode]
+        [, nodeToReplace, currentNode] = currentNode.splitText(match.start, match.end) as [TextNode, TextNode, TextNode]
 
       const replacementNode = createNode(nodeToReplace!)
       replacementNode.setFormat(nodeToReplace!.getFormat())
@@ -194,6 +194,9 @@ export const decoratorTransform = (
   node: CustomTextNode,
   getMatch: (text: string) => null | EntityMatch,
   createNode: (textNode: TextNode) => LexicalNode,
+  options?: {
+    allowAdjacentMatches?: boolean
+  },
 ) => {
   if (!node.isSimpleText())
     return
@@ -227,7 +230,7 @@ export const decoratorTransform = (
     else {
       const nextMatch = getMatch(nextText)
 
-      if (nextMatch !== null && nextMatch.start === 0)
+      if (!options?.allowAdjacentMatches && nextMatch !== null && nextMatch.start === 0)
         return
     }
 
@@ -240,9 +243,9 @@ export const decoratorTransform = (
     let nodeToReplace
 
     if (match.start === 0)
-      [nodeToReplace, currentNode] = (currentNode.splitText(match.end)) as [any, CustomTextNode]
+      [nodeToReplace, currentNode] = currentNode.splitText(match.end) as [CustomTextNode, CustomTextNode]
     else
-      [, nodeToReplace, currentNode] = (currentNode.splitText(match.start, match.end)) as [unknown, any, CustomTextNode]
+      [, nodeToReplace, currentNode] = currentNode.splitText(match.start, match.end) as [CustomTextNode, CustomTextNode, CustomTextNode]
 
     const replacementNode = createNode(nodeToReplace!)
     nodeToReplace!.replace(replacementNode)
diff --git a/web/app/components/billing/apps-full-in-dialog/__tests__/index.spec.tsx b/web/app/components/billing/apps-full-in-dialog/__tests__/index.spec.tsx
index 701be3f5a8a..ca0a355c547 100644
--- a/web/app/components/billing/apps-full-in-dialog/__tests__/index.spec.tsx
+++ b/web/app/components/billing/apps-full-in-dialog/__tests__/index.spec.tsx
@@ -109,6 +109,7 @@ const buildAppContext = (overrides: Partial<AppContextValue> = {}): AppContextVa
     langGeniusVersionInfo,
     isLoadingCurrentWorkspace: false,
     isValidatingCurrentWorkspace: false,
+    workspacePermissionKeys: [],
   }
   const useSelector: AppContextValue['useSelector'] = selector => selector({ ...base, useSelector })
   return {
diff --git a/web/app/components/billing/billing-page/__tests__/index.spec.tsx b/web/app/components/billing/billing-page/__tests__/index.spec.tsx
index 929e16afb20..d9f296e7978 100644
--- a/web/app/components/billing/billing-page/__tests__/index.spec.tsx
+++ b/web/app/components/billing/billing-page/__tests__/index.spec.tsx
@@ -5,10 +5,19 @@ let currentBillingUrl: string | null = 'https://billing'
 let fetching = false
 let isManager = true
 let enableBilling = true
+let workspacePermissionKeys: string[] = ['billing.subscription.manage']
 
 const refetchMock = vi.fn()
 const openAsyncWindowMock = vi.fn()
 
+type BillingUrlCallback = () => Promise<string | null>
+type BillingWindowOptions = {
+  immediateUrl: string | null
+  features: string
+  onError: (err: Error) => void
+}
+type OpenAsyncWindowCall = [BillingUrlCallback, BillingWindowOptions]
+
 vi.mock('@/service/use-billing', () => ({
   useBillingUrl: () => ({
     data: currentBillingUrl,
@@ -24,6 +33,7 @@ vi.mock('@/hooks/use-async-window-open', () => ({
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceManager: isManager,
+    workspacePermissionKeys,
   }),
 }))
 
@@ -44,16 +54,25 @@ describe('Billing', () => {
     fetching = false
     isManager = true
     enableBilling = true
+    workspacePermissionKeys = ['billing.subscription.manage']
     refetchMock.mockResolvedValue({ data: 'https://billing' })
   })
 
-  it('hides the billing action when user is not manager or billing is disabled', () => {
+  it('shows the billing action when subscription management permission is granted without manager role', () => {
     isManager = false
+
+    render(<Billing />)
+
+    expect(screen.getByRole('button', { name: /billing\.viewBillingTitle/ })).toBeInTheDocument()
+  })
+
+  it('hides the billing action when subscription management permission is missing or billing is disabled', () => {
+    workspacePermissionKeys = []
     render(<Billing />)
     expect(screen.queryByRole('button', { name: /billing\.viewBillingTitle/ })).not.toBeInTheDocument()
 
     vi.clearAllMocks()
-    isManager = true
+    workspacePermissionKeys = ['billing.subscription.manage']
     enableBilling = false
     render(<Billing />)
     expect(screen.queryByRole('button', { name: /billing\.viewBillingTitle/ })).not.toBeInTheDocument()
@@ -66,7 +85,7 @@ describe('Billing', () => {
     fireEvent.click(actionButton)
 
     await waitFor(() => expect(openAsyncWindowMock).toHaveBeenCalled())
-    const [, options] = (openAsyncWindowMock.mock.calls[0] ?? []) as [unknown, any]
+    const [, options] = openAsyncWindowMock.mock.calls[0] as OpenAsyncWindowCall
     expect(options).toMatchObject({
       immediateUrl: currentBillingUrl,
       features: 'noopener,noreferrer',
@@ -82,7 +101,7 @@ describe('Billing', () => {
     fireEvent.click(actionButton)
 
     await waitFor(() => expect(openAsyncWindowMock).toHaveBeenCalled())
-    const [asyncCallback] = (openAsyncWindowMock.mock.calls[0] ?? []) as [any]
+    const [asyncCallback] = openAsyncWindowMock.mock.calls[0] as OpenAsyncWindowCall
 
     // Execute the async callback passed to openAsyncWindow
     const result = await asyncCallback()
@@ -98,7 +117,7 @@ describe('Billing', () => {
     fireEvent.click(actionButton)
 
     await waitFor(() => expect(openAsyncWindowMock).toHaveBeenCalled())
-    const [asyncCallback] = (openAsyncWindowMock.mock.calls[0] ?? []) as [any]
+    const [asyncCallback] = openAsyncWindowMock.mock.calls[0] as OpenAsyncWindowCall
 
     // Execute the async callback when url is null
     const result = await asyncCallback()
@@ -113,7 +132,7 @@ describe('Billing', () => {
     fireEvent.click(actionButton)
 
     await waitFor(() => expect(openAsyncWindowMock).toHaveBeenCalled())
-    const [, options] = (openAsyncWindowMock.mock.calls[0] ?? []) as [unknown, any]
+    const [, options] = openAsyncWindowMock.mock.calls[0] as OpenAsyncWindowCall
 
     // Execute the onError callback
     const testError = new Error('Test error')
diff --git a/web/app/components/billing/billing-page/index.tsx b/web/app/components/billing/billing-page/index.tsx
index afafbe447f7..4b1d4424c04 100644
--- a/web/app/components/billing/billing-page/index.tsx
+++ b/web/app/components/billing/billing-page/index.tsx
@@ -1,21 +1,20 @@
 'use client'
 import type { FC } from 'react'
-import {
-  RiArrowRightUpLine,
-} from '@remixicon/react'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { useAsyncWindowOpen } from '@/hooks/use-async-window-open'
 import { useBillingUrl } from '@/service/use-billing'
+import { BillingPermission, hasPermission } from '@/utils/permission'
 import PlanComp from '../plan'
 
 const Billing: FC = () => {
   const { t } = useTranslation()
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
   const { enableBilling } = useProviderContext()
-  const { data: billingUrl, isFetching, refetch } = useBillingUrl(enableBilling && isCurrentWorkspaceManager)
+  const canManageBillingSubscription = hasPermission(workspacePermissionKeys, BillingPermission.SubscriptionManage)
+  const { data: billingUrl, isFetching, refetch } = useBillingUrl(enableBilling && canManageBillingSubscription)
   const openAsyncWindow = useAsyncWindowOpen()
 
   const handleOpenBilling = async () => {
@@ -36,7 +35,7 @@ const Billing: FC = () => {
   return (
     <div>
       <PlanComp loc="billing-page" />
-      {enableBilling && isCurrentWorkspaceManager && (
+      {enableBilling && canManageBillingSubscription && (
         <button
           type="button"
           className="mt-3 flex w-full items-center justify-between rounded-xl bg-background-section-burn px-4 py-3"
@@ -49,7 +48,7 @@ const Billing: FC = () => {
           </div>
           <span className="inline-flex h-8 w-24 items-center justify-center gap-0.5 rounded-lg border-[0.5px] border-components-button-secondary-border bg-components-button-secondary-bg px-3 py-2 text-saas-dify-blue-accessible shadow-[0_1px_2px_rgba(9,9,11,0.05)] backdrop-blur-[5px]">
             <span className="system-sm-medium leading-none">{t('viewBillingAction', { ns: 'billing' })}</span>
-            <RiArrowRightUpLine className="size-4" />
+            <span className="i-ri-arrow-right-up-line size-4" />
           </span>
         </button>
       )}
diff --git a/web/app/components/billing/hooks/use-education-discount.ts b/web/app/components/billing/hooks/use-education-discount.ts
index dedad4707ee..07977bf4f16 100644
--- a/web/app/components/billing/hooks/use-education-discount.ts
+++ b/web/app/components/billing/hooks/use-education-discount.ts
@@ -4,18 +4,20 @@ import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useAppContext } from '@/context/app-context'
 import { fetchSubscriptionUrls } from '@/service/billing'
+import { BillingPermission, hasPermission } from '@/utils/permission'
 import { Plan } from '../type'
 
 export const useEducationDiscount = () => {
   const { t } = useTranslation()
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
   const [isEducationDiscountLoading, setIsEducationDiscountLoading] = useState(false)
+  const canManageBilling = hasPermission(workspacePermissionKeys, BillingPermission.Manage)
 
   const handleEducationDiscount = useCallback(async () => {
     if (isEducationDiscountLoading)
       return
 
-    if (!isCurrentWorkspaceManager) {
+    if (!canManageBilling) {
       toast.error(t('buyPermissionDeniedTip', { ns: 'billing' }))
       return
     }
@@ -28,7 +30,7 @@ export const useEducationDiscount = () => {
     finally {
       setIsEducationDiscountLoading(false)
     }
-  }, [isCurrentWorkspaceManager, isEducationDiscountLoading, t])
+  }, [canManageBilling, isEducationDiscountLoading, t])
 
   return {
     handleEducationDiscount,
diff --git a/web/app/components/billing/plan/__tests__/index.spec.tsx b/web/app/components/billing/plan/__tests__/index.spec.tsx
index 618da01749e..f062acba15e 100644
--- a/web/app/components/billing/plan/__tests__/index.spec.tsx
+++ b/web/app/components/billing/plan/__tests__/index.spec.tsx
@@ -12,6 +12,7 @@ let currentPath = '/billing'
 
 const push = vi.fn()
 let isCurrentWorkspaceManager = true
+let workspacePermissionKeys = ['billing.manage']
 let assignedHref = ''
 const originalLocation = window.location
 
@@ -42,11 +43,12 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     userProfile: { email: 'user@example.com' },
     isCurrentWorkspaceManager,
+    workspacePermissionKeys,
   }),
 }))
 
-vi.mock('foxact/use-local-storage', () => ({
-  useSetLocalStorage: () => setEducationVerifyingMock,
+vi.mock('@/app/education-apply/storage', () => ({
+  useSetEducationVerifying: () => setEducationVerifyingMock,
 }))
 
 vi.mock('@/service/billing', () => ({
@@ -127,6 +129,7 @@ describe('PlanComp', () => {
     currentPath = '/billing'
     isPending = false
     isCurrentWorkspaceManager = true
+    workspacePermissionKeys = ['billing.manage']
     mockConfig.isCloudEdition = true
     assignedHref = ''
     providerContextMock.mockReturnValue({
@@ -255,8 +258,9 @@ describe('PlanComp', () => {
     expect(screen.queryByText('education.useEducationDiscount')).not.toBeInTheDocument()
   })
 
-  it('does not show education discount button for non-manager sandbox education accounts', () => {
+  it('does not show education discount button without billing manage permission', () => {
     isCurrentWorkspaceManager = false
+    workspacePermissionKeys = []
     providerContextMock.mockReturnValue({
       plan: { ...planMock, type: Plan.sandbox },
       enableEducationPlan: true,
diff --git a/web/app/components/billing/plan/index.tsx b/web/app/components/billing/plan/index.tsx
index e9519c9edf0..775f6997f19 100644
--- a/web/app/components/billing/plan/index.tsx
+++ b/web/app/components/billing/plan/index.tsx
@@ -4,17 +4,15 @@ import { Button } from '@langgenius/dify-ui/button'
 import {
   RiBook2Line,
   RiFileEditLine,
-  RiGraduationCapLine,
   RiGroupLine,
 } from '@remixicon/react'
 import { useUnmountedRef } from 'ahooks'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import * as React from 'react'
 import { useEffect } from 'react'
 import { useTranslation } from 'react-i18next'
 import { ApiAggregate, TriggerAll } from '@/app/components/base/icons/src/vender/workflow'
 import UsageInfo from '@/app/components/billing/usage-info'
-import { EDUCATION_VERIFYING_LOCALSTORAGE_ITEM } from '@/app/education-apply/constants'
+import { useSetEducationVerifying } from '@/app/education-apply/storage'
 import VerifyStateModal from '@/app/education-apply/verify-state-modal'
 import { IS_CLOUD_EDITION } from '@/config'
 import { useAppContext } from '@/context/app-context'
@@ -22,6 +20,7 @@ import { useModalContextSelector } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
 import { usePathname, useRouter } from '@/next/navigation'
 import { useEducationVerify } from '@/service/use-education'
+import { BillingPermission, hasPermission } from '@/utils/permission'
 import { getDaysUntilEndOfMonth } from '@/utils/time'
 import { Loading } from '../../base/icons/src/public/thought'
 import { NUM_INFINITE } from '../config'
@@ -42,7 +41,7 @@ const PlanComp: FC<Props> = ({
   const { t } = useTranslation()
   const router = useRouter()
   const path = usePathname()
-  const { userProfile, isCurrentWorkspaceManager } = useAppContext()
+  const { userProfile, workspacePermissionKeys } = useAppContext()
   const { plan, enableEducationPlan, allowRefreshEducationVerify, isEducationAccount } = useProviderContext()
   const isAboutToExpire = allowRefreshEducationVerify
   const {
@@ -70,9 +69,10 @@ const PlanComp: FC<Props> = ({
 
   const [showModal, setShowModal] = React.useState(false)
   const { handleEducationDiscount, isEducationDiscountLoading } = useEducationDiscount()
+  const canManageBilling = hasPermission(workspacePermissionKeys, BillingPermission.Manage)
   const { mutateAsync, isPending } = useEducationVerify()
   const setShowAccountSettingModal = useModalContextSelector(s => s.setShowAccountSettingModal)
-  const setEducationVerifying = useSetLocalStorage<string>(EDUCATION_VERIFYING_LOCALSTORAGE_ITEM, { raw: true })
+  const setEducationVerifying = useSetEducationVerifying()
   const unmountedRef = useUnmountedRef()
   const handleVerify = () => {
     if (isPending)
@@ -116,14 +116,14 @@ const PlanComp: FC<Props> = ({
           <div className="flex shrink-0 items-center gap-1">
             {IS_CLOUD_EDITION && enableEducationPlan && (!isEducationAccount || isAboutToExpire) && (
               <Button variant="ghost" onClick={handleVerify} disabled={isPending}>
-                <RiGraduationCapLine className="mr-1 size-4" />
+                <span className="mr-1 i-ri-graduation-cap-line size-4" />
                 {t('toVerified', { ns: 'education' })}
                 {isPending && <Loading className="ml-1 animate-spin-slow" />}
               </Button>
             )}
-            {IS_CLOUD_EDITION && enableEducationPlan && isEducationAccount && type === Plan.sandbox && isCurrentWorkspaceManager && (
+            {IS_CLOUD_EDITION && enableEducationPlan && isEducationAccount && type === Plan.sandbox && canManageBilling && (
               <Button variant="ghost" onClick={handleEducationDiscount} disabled={isEducationDiscountLoading}>
-                <RiGraduationCapLine className="mr-1 size-4" />
+                <span className="mr-1 i-ri-graduation-cap-line size-4" />
                 {t('useEducationDiscount', { ns: 'education' })}
                 {isEducationDiscountLoading && <Loading className="ml-1 animate-spin-slow" />}
               </Button>
diff --git a/web/app/components/billing/pricing/__tests__/dialog.spec.tsx b/web/app/components/billing/pricing/__tests__/dialog.spec.tsx
index c1ed3898de4..9b166980207 100644
--- a/web/app/components/billing/pricing/__tests__/dialog.spec.tsx
+++ b/web/app/components/billing/pricing/__tests__/dialog.spec.tsx
@@ -70,7 +70,10 @@ describe('Pricing dialog lifecycle', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     latestOnOpenChange = undefined
-    ;(useAppContext as Mock).mockReturnValue({ isCurrentWorkspaceManager: true })
+    ;(useAppContext as Mock).mockReturnValue({
+      isCurrentWorkspaceManager: true,
+      workspacePermissionKeys: ['billing.manage'],
+    })
     ;(useProviderContext as Mock).mockReturnValue({
       plan: {
         type: Plan.sandbox,
diff --git a/web/app/components/billing/pricing/__tests__/index.spec.tsx b/web/app/components/billing/pricing/__tests__/index.spec.tsx
index 264c80c5e76..3a6d81aa0a2 100644
--- a/web/app/components/billing/pricing/__tests__/index.spec.tsx
+++ b/web/app/components/billing/pricing/__tests__/index.spec.tsx
@@ -53,7 +53,10 @@ describe('Pricing', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockLanguage = 'en'
-    ;(useAppContext as Mock).mockReturnValue({ isCurrentWorkspaceManager: true })
+    ;(useAppContext as Mock).mockReturnValue({
+      isCurrentWorkspaceManager: true,
+      workspacePermissionKeys: ['billing.manage'],
+    })
     ;(useProviderContext as Mock).mockReturnValue({
       plan: {
         type: Plan.sandbox,
@@ -76,6 +79,10 @@ describe('Pricing', () => {
     })
 
     it('should default to yearly billing for education accounts', () => {
+      ;(useAppContext as Mock).mockReturnValue({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.manage'],
+      })
       ;(useProviderContext as Mock).mockReturnValue({
         plan: {
           type: Plan.sandbox,
@@ -91,8 +98,11 @@ describe('Pricing', () => {
       expect(screen.getByRole('switch')).toBeChecked()
     })
 
-    it('should not default to yearly billing for non-manager education accounts', () => {
-      ;(useAppContext as Mock).mockReturnValue({ isCurrentWorkspaceManager: false })
+    it('should not default to yearly billing when billing manage permission is missing', () => {
+      ;(useAppContext as Mock).mockReturnValue({
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: [],
+      })
       ;(useProviderContext as Mock).mockReturnValue({
         plan: {
           type: Plan.sandbox,
diff --git a/web/app/components/billing/pricing/index.tsx b/web/app/components/billing/pricing/index.tsx
index 268c655e85e..5f8d4cc0974 100644
--- a/web/app/components/billing/pricing/index.tsx
+++ b/web/app/components/billing/pricing/index.tsx
@@ -15,6 +15,7 @@ import { useState } from 'react'
 import { useAppContext } from '@/context/app-context'
 import { useGetPricingPageLanguage } from '@/context/i18n'
 import { useProviderContext } from '@/context/provider-context'
+import { BillingPermission, hasPermission } from '@/utils/permission'
 import { NoiseBottom, NoiseTop } from './assets'
 import Footer from './footer'
 import Header from './header'
@@ -40,12 +41,13 @@ const Pricing: FC<PricingProps> = ({
   onCancel,
 }) => {
   const { plan, enableEducationPlan, isEducationAccount } = useProviderContext()
-  const { isCurrentWorkspaceManager } = useAppContext()
-  const shouldDefaultToYearly = isCurrentWorkspaceManager && enableEducationPlan && isEducationAccount
+  const { workspacePermissionKeys } = useAppContext()
+  const canManageBilling = hasPermission(workspacePermissionKeys, BillingPermission.Manage)
+  const shouldDefaultToYearly = canManageBilling && enableEducationPlan && isEducationAccount
   const [selectedPlanRange, setSelectedPlanRange] = React.useState<PlanRange>()
   const planRange = selectedPlanRange ?? (shouldDefaultToYearly ? PlanRange.yearly : PlanRange.monthly)
   const [currentCategory, setCurrentCategory] = useState<Category>(CategoryEnum.CLOUD)
-  const canPay = isCurrentWorkspaceManager
+  const canPay = canManageBilling
 
   const pricingPageLanguage = useGetPricingPageLanguage()
   const pricingPageURL = pricingPageLanguage
diff --git a/web/app/components/billing/pricing/plans/cloud-plan-item/__tests__/index.spec.tsx b/web/app/components/billing/pricing/plans/cloud-plan-item/__tests__/index.spec.tsx
index 65c710e37ea..4e33b2c99c4 100644
--- a/web/app/components/billing/pricing/plans/cloud-plan-item/__tests__/index.spec.tsx
+++ b/web/app/components/billing/pricing/plans/cloud-plan-item/__tests__/index.spec.tsx
@@ -77,7 +77,14 @@ beforeAll(() => {
 beforeEach(() => {
   vi.clearAllMocks()
   toast.dismiss()
-  mockUseAppContext.mockReturnValue({ isCurrentWorkspaceManager: true })
+  mockUseAppContext.mockReturnValue({
+    isCurrentWorkspaceManager: true,
+    workspacePermissionKeys: [
+      'billing.view',
+      'billing.manage',
+      'billing.subscription.manage',
+    ],
+  })
   mockUseProviderContext.mockReturnValue({
     enableEducationPlan: false,
     isEducationAccount: false,
@@ -173,8 +180,11 @@ describe('CloudPlanItem', () => {
 
   // Payment actions triggered from the CTA
   describe('Plan purchase flow', () => {
-    it('should show toast when non-manager tries to buy a plan', () => {
-      mockUseAppContext.mockReturnValue({ isCurrentWorkspaceManager: false })
+    it('should show toast when billing manage permission is missing for plan purchase', () => {
+      mockUseAppContext.mockReturnValue({
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: ['billing.subscription.manage'],
+      })
 
       renderWithToastHost(
         <CloudPlanItem
@@ -188,11 +198,16 @@ describe('CloudPlanItem', () => {
       fireEvent.click(screen.getByRole('button', { name: 'billing.plansCommon.startBuilding' }))
       expect(screen.getByText('billing.buyPermissionDeniedTip'))!.toBeInTheDocument()
       expect(mockBillingInvoices).not.toHaveBeenCalled()
+      expect(mockFetchSubscriptionUrls).not.toHaveBeenCalled()
     })
 
     it('should open billing portal when upgrading current paid plan', async () => {
       const openWindow = vi.fn(async (cb: () => Promise<string>) => await cb())
       mockUseAsyncWindowOpen.mockReturnValue(openWindow)
+      mockUseAppContext.mockReturnValue({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.subscription.manage'],
+      })
 
       render(
         <CloudPlanItem
@@ -212,6 +227,11 @@ describe('CloudPlanItem', () => {
     })
 
     it('should redirect to subscription url when selecting a new paid plan', async () => {
+      mockUseAppContext.mockReturnValue({
+        isCurrentWorkspaceManager: false,
+        workspacePermissionKeys: ['billing.manage'],
+      })
+
       render(
         <CloudPlanItem
           plan={Plan.professional}
@@ -293,8 +313,11 @@ describe('CloudPlanItem', () => {
       })
     })
 
-    it('should show default CTA and hide warning when current user is not workspace manager', () => {
-      mockUseAppContext.mockReturnValue({ isCurrentWorkspaceManager: false })
+    it('should show default CTA and hide warning when billing manage permission is missing', () => {
+      mockUseAppContext.mockReturnValue({
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: [],
+      })
       mockUseProviderContext.mockReturnValue({
         enableEducationPlan: true,
         isEducationAccount: true,
@@ -314,8 +337,11 @@ describe('CloudPlanItem', () => {
       expect(screen.queryByText('education.planNotSupportEducationDiscount')).not.toBeInTheDocument()
     })
 
-    it('should hide education unsupported warning when current user is not workspace manager', () => {
-      mockUseAppContext.mockReturnValue({ isCurrentWorkspaceManager: false })
+    it('should hide education unsupported warning when billing manage permission is missing', () => {
+      mockUseAppContext.mockReturnValue({
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: [],
+      })
       mockUseProviderContext.mockReturnValue({
         enableEducationPlan: true,
         isEducationAccount: true,
diff --git a/web/app/components/billing/pricing/plans/cloud-plan-item/index.tsx b/web/app/components/billing/pricing/plans/cloud-plan-item/index.tsx
index 9dfc1453033..9c10aa50688 100644
--- a/web/app/components/billing/pricing/plans/cloud-plan-item/index.tsx
+++ b/web/app/components/billing/pricing/plans/cloud-plan-item/index.tsx
@@ -18,6 +18,7 @@ import { useProviderContext } from '@/context/provider-context'
 import { useAsyncWindowOpen } from '@/hooks/use-async-window-open'
 import { fetchSubscriptionUrls } from '@/service/billing'
 import { consoleClient } from '@/service/client'
+import { BillingPermission, hasPermission } from '@/utils/permission'
 import { ALL_PLANS } from '../../../config'
 import { useEducationDiscount } from '../../../hooks/use-education-discount'
 import { Plan } from '../../../type'
@@ -55,7 +56,9 @@ const CloudPlanItem: FC<CloudPlanItemProps> = ({
   const isCurrent = plan === currentPlan
   const isCurrentPaidPlan = isCurrent && !isFreePlan
   const isPlanDisabled = isCurrentPaidPlan ? false : planInfo.level <= ALL_PLANS[currentPlan].level
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
+  const canManageBilling = hasPermission(workspacePermissionKeys, BillingPermission.Manage)
+  const canManageBillingSubscription = hasPermission(workspacePermissionKeys, BillingPermission.SubscriptionManage)
   const { enableEducationPlan, isEducationAccount } = useProviderContext()
   const isEducationDiscountMode = enableEducationPlan && isEducationAccount
   const isEducationDiscountSupportedPlan = plan === Plan.professional && isYear
@@ -87,18 +90,14 @@ const CloudPlanItem: FC<CloudPlanItemProps> = ({
     if (isPlanDisabled)
       return
 
-    if (isEducationDiscountMode && isEducationDiscountSupportedPlan && !isCurrentPaidPlan) {
-      await handleEducationDiscount()
-      return
-    }
-
-    if (!isCurrentWorkspaceManager) {
-      toast.error(t('buyPermissionDeniedTip', { ns: 'billing' }))
-      return
-    }
     setLoading(true)
     try {
       if (isCurrentPaidPlan) {
+        if (!canManageBillingSubscription) {
+          toast.error(t('buyPermissionDeniedTip', { ns: 'billing' }))
+          return
+        }
+
         await openAsyncWindow(async () => {
           const res = await consoleClient.billing.invoices()
           if (res.url)
@@ -115,6 +114,16 @@ const CloudPlanItem: FC<CloudPlanItemProps> = ({
       if (isFreePlan)
         return
 
+      if (!canManageBilling) {
+        toast.error(t('buyPermissionDeniedTip', { ns: 'billing' }))
+        return
+      }
+
+      if (isEducationDiscountMode && isEducationDiscountSupportedPlan) {
+        await handleEducationDiscount()
+        return
+      }
+
       const res = await fetchSubscriptionUrls(plan, isYear ? 'year' : 'month')
       // Adb Block additional tracking block the gtag, so we need to redirect directly
       window.location.href = res.url
diff --git a/web/app/components/billing/pricing/plans/self-hosted-plan-item/__tests__/index.spec.tsx b/web/app/components/billing/pricing/plans/self-hosted-plan-item/__tests__/index.spec.tsx
index 1a2a8b10a13..c2923f98071 100644
--- a/web/app/components/billing/pricing/plans/self-hosted-plan-item/__tests__/index.spec.tsx
+++ b/web/app/components/billing/pricing/plans/self-hosted-plan-item/__tests__/index.spec.tsx
@@ -59,7 +59,10 @@ beforeAll(() => {
 beforeEach(() => {
   vi.clearAllMocks()
   toast.dismiss()
-  mockUseAppContext.mockReturnValue({ isCurrentWorkspaceManager: true })
+  mockUseAppContext.mockReturnValue({
+    isCurrentWorkspaceManager: false,
+    workspacePermissionKeys: ['billing.manage'],
+  })
   assignedHref = ''
 })
 
@@ -90,8 +93,11 @@ describe('SelfHostedPlanItem', () => {
   })
 
   describe('CTA interactions', () => {
-    it('should show toast when non-manager tries to proceed', () => {
-      mockUseAppContext.mockReturnValue({ isCurrentWorkspaceManager: false })
+    it('should show toast when billing manage permission is missing', () => {
+      mockUseAppContext.mockReturnValue({
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: [],
+      })
 
       renderWithToastHost(<SelfHostedPlanItem plan={SelfHostedPlan.premium} />)
       fireEvent.click(screen.getByRole('button', { name: /billing\.plans\.premium\.btnText/ }))
diff --git a/web/app/components/billing/pricing/plans/self-hosted-plan-item/index.tsx b/web/app/components/billing/pricing/plans/self-hosted-plan-item/index.tsx
index 5851a47e87d..233f26ceb3f 100644
--- a/web/app/components/billing/pricing/plans/self-hosted-plan-item/index.tsx
+++ b/web/app/components/billing/pricing/plans/self-hosted-plan-item/index.tsx
@@ -7,6 +7,7 @@ import { useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
 import { Azure, GoogleCloud } from '@/app/components/base/icons/src/public/billing'
 import { useAppContext } from '@/context/app-context'
+import { BillingPermission, hasPermission } from '@/utils/permission'
 import { contactSalesUrl, getStartedWithCommunityUrl, getWithPremiumUrl } from '../../../config'
 import { SelfHostedPlan } from '../../../type'
 import { Community, Enterprise, EnterpriseNoise, Premium, PremiumNoise } from '../../assets'
@@ -51,11 +52,11 @@ const SelfHostedPlanItem: FC<SelfHostedPlanItemProps> = ({
   const isFreePlan = plan === SelfHostedPlan.community
   const isPremiumPlan = plan === SelfHostedPlan.premium
   const isEnterprisePlan = plan === SelfHostedPlan.enterprise
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
+  const canManageBilling = hasPermission(workspacePermissionKeys, BillingPermission.Manage)
 
   const handleGetPayUrl = useCallback(() => {
-    // Only workspace manager can buy plan
-    if (!isCurrentWorkspaceManager) {
+    if (!canManageBilling) {
       toast.error(t('buyPermissionDeniedTip', { ns: 'billing' }))
       return
     }
@@ -70,7 +71,7 @@ const SelfHostedPlanItem: FC<SelfHostedPlanItemProps> = ({
 
     if (isEnterprisePlan)
       window.location.href = contactSalesUrl
-  }, [isCurrentWorkspaceManager, isFreePlan, isPremiumPlan, isEnterprisePlan, t])
+  }, [canManageBilling, isFreePlan, isPremiumPlan, isEnterprisePlan, t])
 
   return (
     <div className="relative flex flex-1 flex-col overflow-hidden">
diff --git a/web/app/components/custom/custom-page/__tests__/index.spec.tsx b/web/app/components/custom/custom-page/__tests__/index.spec.tsx
index 585156c9a18..fdfa4377bea 100644
--- a/web/app/components/custom/custom-page/__tests__/index.spec.tsx
+++ b/web/app/components/custom/custom-page/__tests__/index.spec.tsx
@@ -103,6 +103,7 @@ const createAppContextValue = (): AppContextValue => ({
   useSelector: vi.fn() as unknown as AppContextValue['useSelector'],
   isLoadingCurrentWorkspace: false,
   isValidatingCurrentWorkspace: false,
+  workspacePermissionKeys: [],
 })
 
 describe('CustomPage', () => {
diff --git a/web/app/components/custom/custom-web-app-brand/__tests__/index.spec.tsx b/web/app/components/custom/custom-web-app-brand/__tests__/index.spec.tsx
index fd78377e6df..4c2574c10bd 100644
--- a/web/app/components/custom/custom-web-app-brand/__tests__/index.spec.tsx
+++ b/web/app/components/custom/custom-web-app-brand/__tests__/index.spec.tsx
@@ -19,7 +19,7 @@ const createHookState = (overrides: Partial<ReturnType<typeof useWebAppBrand>> =
   uploadDisabled: false,
   workspaceLogo: 'https://example.com/workspace-logo.png',
   isSandbox: false,
-  isCurrentWorkspaceManager: true,
+  canManageCustomBrand: true,
   handleApply: vi.fn(),
   handleCancel: vi.fn(),
   handleChange: vi.fn(),
@@ -91,6 +91,19 @@ describe('CustomWebAppBrand', () => {
       expect(screen.getByRole('switch')).toHaveAttribute('aria-disabled', 'true')
     })
 
+    it('should disable write controls when customization management permission is missing', () => {
+      renderComponent({
+        fileId: 'new-logo',
+        canManageCustomBrand: false,
+        uploadDisabled: true,
+      })
+
+      expect(screen.getByRole('switch')).toHaveAttribute('aria-disabled', 'true')
+      expect(screen.getByRole('button', { name: 'custom.change' })).toBeDisabled()
+      expect(screen.getByRole('button', { name: 'common.operation.cancel' })).toBeDisabled()
+      expect(screen.getByRole('button', { name: 'custom.apply' })).toBeDisabled()
+    })
+
     it('should default the switch to unchecked when brand removal state is missing', () => {
       const { container } = renderComponent({
         webappBrandRemoved: undefined,
diff --git a/web/app/components/custom/custom-web-app-brand/hooks/__tests__/use-web-app-brand.spec.tsx b/web/app/components/custom/custom-web-app-brand/hooks/__tests__/use-web-app-brand.spec.tsx
index 758d0126c2b..1a096a38dc5 100644
--- a/web/app/components/custom/custom-web-app-brand/hooks/__tests__/use-web-app-brand.spec.tsx
+++ b/web/app/components/custom/custom-web-app-brand/hooks/__tests__/use-web-app-brand.spec.tsx
@@ -107,6 +107,7 @@ const createAppContextValue = (overrides: Partial<AppContextValue> = {}): AppCon
     isCurrentWorkspaceOwner: false,
     isCurrentWorkspaceEditor: false,
     isCurrentWorkspaceDatasetOperator: false,
+    workspacePermissionKeys: ['customization.manage'],
     mutateCurrentWorkspace: vi.fn(),
     langGeniusVersionInfo: initialLangGeniusVersionInfo,
     useSelector: vi.fn() as unknown as AppContextValue['useSelector'],
@@ -139,10 +140,35 @@ describe('useWebAppBrand', () => {
 
       expect(result.current.webappLogo).toBe('https://example.com/replace.png')
       expect(result.current.workspaceLogo).toBe('https://example.com/workspace-logo.png')
+      expect(result.current.canManageCustomBrand).toBe(true)
       expect(result.current.uploadDisabled).toBe(false)
       expect(result.current.uploading).toBe(false)
     })
 
+    it('should disable uploads when customization management permission is missing', () => {
+      appContextValue = createAppContextValue({
+        workspacePermissionKeys: [],
+        isCurrentWorkspaceManager: true,
+      })
+
+      const { result } = renderHook(() => useWebAppBrand())
+
+      expect(result.current.canManageCustomBrand).toBe(false)
+      expect(result.current.uploadDisabled).toBe(true)
+    })
+
+    it('should allow uploads for non-manager users with customization management permission', () => {
+      appContextValue = createAppContextValue({
+        workspacePermissionKeys: ['customization.manage'],
+        isCurrentWorkspaceManager: false,
+      })
+
+      const { result } = renderHook(() => useWebAppBrand())
+
+      expect(result.current.canManageCustomBrand).toBe(true)
+      expect(result.current.uploadDisabled).toBe(false)
+    })
+
     it('should disable uploads in sandbox workspaces and when branding is removed', () => {
       mockUseProviderContext.mockReturnValue(createProviderContext({
         enableBilling: true,
diff --git a/web/app/components/custom/custom-web-app-brand/hooks/use-web-app-brand.ts b/web/app/components/custom/custom-web-app-brand/hooks/use-web-app-brand.ts
index f8b0ebce5e5..397334bb2ec 100644
--- a/web/app/components/custom/custom-web-app-brand/hooks/use-web-app-brand.ts
+++ b/web/app/components/custom/custom-web-app-brand/hooks/use-web-app-brand.ts
@@ -9,6 +9,7 @@ import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { updateCurrentWorkspace } from '@/service/common'
+import { hasPermission } from '@/utils/permission'
 
 const MAX_LOGO_FILE_SIZE = 5 * 1024 * 1024
 const CUSTOM_CONFIG_URL = '/workspaces/custom-config'
@@ -16,7 +17,7 @@ const WEB_APP_LOGO_UPLOAD_URL = '/workspaces/custom-config/webapp-logo/upload'
 const useWebAppBrand = () => {
   const { t } = useTranslation()
   const { plan, enableBilling } = useProviderContext()
-  const { currentWorkspace, mutateCurrentWorkspace, isCurrentWorkspaceManager } = useAppContext()
+  const { currentWorkspace, mutateCurrentWorkspace, workspacePermissionKeys } = useAppContext()
   const [fileId, setFileId] = useState('')
   const [imgKey, setImgKey] = useState(() => Date.now())
   const [uploadProgress, setUploadProgress] = useState(0)
@@ -25,7 +26,8 @@ const useWebAppBrand = () => {
   const uploading = uploadProgress > 0 && uploadProgress < 100
   const webappLogo = currentWorkspace.custom_config?.replace_webapp_logo || ''
   const webappBrandRemoved = currentWorkspace.custom_config?.remove_webapp_brand
-  const uploadDisabled = isSandbox || webappBrandRemoved || !isCurrentWorkspaceManager
+  const canManageCustomBrand = hasPermission(workspacePermissionKeys, 'customization.manage')
+  const uploadDisabled = isSandbox || webappBrandRemoved || !canManageCustomBrand
   const workspaceLogo = systemFeatures.branding.enabled ? systemFeatures.branding.workspace_logo : ''
   const persistWorkspaceBrand = async (body: Record<string, unknown>) => {
     await updateCurrentWorkspace({
@@ -89,7 +91,7 @@ const useWebAppBrand = () => {
     uploadDisabled,
     workspaceLogo,
     isSandbox,
-    isCurrentWorkspaceManager,
+    canManageCustomBrand,
     handleApply,
     handleCancel,
     handleChange,
diff --git a/web/app/components/custom/custom-web-app-brand/index.tsx b/web/app/components/custom/custom-web-app-brand/index.tsx
index 0eae4261ccc..74ceea608ca 100644
--- a/web/app/components/custom/custom-web-app-brand/index.tsx
+++ b/web/app/components/custom/custom-web-app-brand/index.tsx
@@ -20,7 +20,7 @@ const CustomWebAppBrand = () => {
     webappBrandRemoved,
     uploadDisabled,
     workspaceLogo,
-    isCurrentWorkspaceManager,
+    canManageCustomBrand,
     isSandbox,
     handleApply,
     handleCancel,
@@ -36,7 +36,7 @@ const CustomWebAppBrand = () => {
         <Switch
           size="lg"
           checked={webappBrandRemoved ?? false}
-          disabled={isSandbox || !isCurrentWorkspaceManager}
+          disabled={isSandbox || !canManageCustomBrand}
           onCheckedChange={handleSwitch}
         />
       </div>
@@ -98,7 +98,7 @@ const CustomWebAppBrand = () => {
                 <Button
                   className="mr-2"
                   onClick={handleCancel}
-                  disabled={webappBrandRemoved || !isCurrentWorkspaceManager}
+                  disabled={webappBrandRemoved || !canManageCustomBrand}
                 >
                   {t('operation.cancel', { ns: 'common' })}
                 </Button>
@@ -106,7 +106,7 @@ const CustomWebAppBrand = () => {
                   variant="primary"
                   className="mr-2"
                   onClick={handleApply}
-                  disabled={webappBrandRemoved || !isCurrentWorkspaceManager}
+                  disabled={webappBrandRemoved || !canManageCustomBrand}
                 >
                   {t('apply', { ns: 'custom' })}
                 </Button>
diff --git a/web/app/components/datasets/access-config/__tests__/index.spec.tsx b/web/app/components/datasets/access-config/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..e93c0ef9433
--- /dev/null
+++ b/web/app/components/datasets/access-config/__tests__/index.spec.tsx
@@ -0,0 +1,198 @@
+import type { AccessRulesEditorProps } from '@/app/components/access-rules-editor'
+import { render, screen } from '@testing-library/react'
+import {
+  useDatasetAccessRules,
+  useDatasetUserAccessSettings,
+} from '@/service/access-control/use-dataset-access-config'
+import { DatasetACLPermission } from '@/utils/permission'
+import DatasetAccessConfigPage from '../index'
+
+const mockDatasetAccessRules = vi.hoisted(() => ({
+  items: [] as AccessRulesEditorProps['rules'],
+  isLoading: false,
+}))
+
+const mockDatasetUserAccessSettings = vi.hoisted(() => ({
+  data: [] as NonNullable<AccessRulesEditorProps['userAccessSettings']>,
+  scope: 'specific' as AccessRulesEditorProps['openScope'],
+  isLoading: false,
+}))
+
+const mockDatasetDetail = vi.hoisted(() => ({
+  dataset: undefined as { maintainer?: string | null, permission_keys?: string[] } | undefined,
+}))
+
+const mockAppContextState = vi.hoisted(() => ({
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: [] as string[],
+}))
+
+const mockAccessRulesEditor = vi.hoisted(() => ({
+  props: null as AccessRulesEditorProps | null,
+}))
+
+const mockMutations = vi.hoisted(() => ({
+  updateOpenScope: vi.fn(),
+  updateUserAccessSettings: vi.fn(),
+  removeMemberBindings: vi.fn(),
+}))
+
+vi.mock('@/service/access-control/use-dataset-access-config', () => ({
+  useDatasetAccessRules: vi.fn(() => ({
+    data: { items: mockDatasetAccessRules.items },
+    isLoading: mockDatasetAccessRules.isLoading,
+  })),
+  useDatasetUserAccessSettings: vi.fn(() => ({
+    data: mockDatasetUserAccessSettings.scope
+      ? { data: mockDatasetUserAccessSettings.data, scope: mockDatasetUserAccessSettings.scope }
+      : undefined,
+    isLoading: mockDatasetUserAccessSettings.isLoading,
+  })),
+  useUpdateDatasetOpenScope: vi.fn(() => ({
+    mutate: mockMutations.updateOpenScope,
+    isPending: false,
+  })),
+  useUpdateDatasetUserAccessSettings: vi.fn(() => ({
+    mutate: mockMutations.updateUserAccessSettings,
+  })),
+  useRemoveDatasetAccessPolicyMemberBindings: vi.fn(() => ({
+    mutate: mockMutations.removeMemberBindings,
+  })),
+}))
+
+vi.mock('@/context/dataset-detail', () => ({
+  useDatasetDetailContextWithSelector: vi.fn((selector: (state: { dataset?: { maintainer?: string | null, permission_keys?: string[] } }) => unknown) => {
+    return selector({ dataset: mockDatasetDetail.dataset })
+  }),
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn((selector: (state: typeof mockAppContextState) => unknown) => selector(mockAppContextState)),
+}))
+
+vi.mock('@/app/components/access-rules-editor', () => ({
+  default: (props: AccessRulesEditorProps) => {
+    mockAccessRulesEditor.props = props
+    return (
+      <div data-testid="access-rules-editor" />
+    )
+  },
+}))
+
+describe('DatasetAccessConfigPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockDatasetAccessRules.items = []
+    mockDatasetAccessRules.isLoading = false
+    mockDatasetUserAccessSettings.data = []
+    mockDatasetUserAccessSettings.scope = 'specific'
+    mockDatasetUserAccessSettings.isLoading = false
+    mockDatasetDetail.dataset = {
+      maintainer: 'maintainer-1',
+      permission_keys: [DatasetACLPermission.AccessConfig],
+    }
+    mockAppContextState.userProfile = { id: 'user-1' }
+    mockAppContextState.workspacePermissionKeys = []
+    mockAccessRulesEditor.props = null
+  })
+
+  // Rendering wires dataset access rules into the shared editor.
+  describe('Rendering', () => {
+    it('should render access config title and pass dataset rules to the editor', () => {
+      render(<DatasetAccessConfigPage datasetId="dataset-1" />)
+
+      expect(screen.getByRole('heading', { name: 'common.settings.resourceAccess' })).toBeInTheDocument()
+      expect(screen.getByText('permission.accessRule.datasetDescription')).toBeInTheDocument()
+      expect(screen.getByTestId('access-rules-editor')).toBeInTheDocument()
+      expect(mockAccessRulesEditor.props?.className).toBe('w-full max-w-200')
+      expect(mockAccessRulesEditor.props?.rules).toEqual([])
+      expect(mockAccessRulesEditor.props?.userAccessSettings).toEqual([])
+      expect(mockAccessRulesEditor.props?.openScope).toBe('specific')
+    })
+
+    it('should not pass open scope before user access settings finish loading', () => {
+      mockDatasetUserAccessSettings.scope = undefined
+      mockDatasetUserAccessSettings.isLoading = true
+
+      render(<DatasetAccessConfigPage datasetId="dataset-1" />)
+
+      expect(mockAccessRulesEditor.props?.openScope).toBeUndefined()
+    })
+
+    it('should pass the user access settings open scope to the editor', () => {
+      mockDatasetUserAccessSettings.scope = 'all'
+
+      render(<DatasetAccessConfigPage datasetId="dataset-1" />)
+
+      expect(mockAccessRulesEditor.props?.openScope).toBe('all')
+    })
+
+    it('should pass access rule loading state to the editor', () => {
+      mockDatasetAccessRules.isLoading = true
+      mockDatasetUserAccessSettings.isLoading = true
+
+      render(<DatasetAccessConfigPage datasetId="dataset-1" />)
+
+      expect(mockAccessRulesEditor.props?.isLoadingRules).toBe(true)
+      expect(mockAccessRulesEditor.props?.isLoadingUserAccessSettings).toBe(true)
+      expect(mockAccessRulesEditor.props?.isUpdatingOpenScope).toBe(true)
+    })
+
+    it('should pass the dataset maintainer id from dataset detail to the editor', () => {
+      mockDatasetDetail.dataset = {
+        maintainer: 'account-1',
+        permission_keys: [DatasetACLPermission.AccessConfig],
+      }
+
+      render(<DatasetAccessConfigPage datasetId="dataset-1" />)
+
+      expect(mockAccessRulesEditor.props?.maintainerId).toBe('account-1')
+    })
+
+    it('should disable access config queries and hide the editor when access config permission is missing', () => {
+      mockDatasetDetail.dataset = {
+        maintainer: 'account-1',
+        permission_keys: [],
+      }
+
+      render(<DatasetAccessConfigPage datasetId="dataset-1" />)
+
+      expect(screen.queryByTestId('access-rules-editor')).not.toBeInTheDocument()
+      expect(vi.mocked(useDatasetAccessRules)).toHaveBeenCalledWith('dataset-1', expect.any(String), { enabled: false })
+      expect(vi.mocked(useDatasetUserAccessSettings)).toHaveBeenCalledWith('dataset-1', expect.any(String), { enabled: false })
+    })
+
+    it('should wire open scope and user policy updates', () => {
+      render(<DatasetAccessConfigPage datasetId="dataset-1" />)
+
+      mockAccessRulesEditor.props?.onOpenScopeChange?.('all')
+      expect(mockMutations.updateOpenScope).toHaveBeenCalledWith('all', expect.objectContaining({
+        onError: expect.any(Function),
+      }))
+
+      mockAccessRulesEditor.props?.onUserAccessPoliciesChange?.('account-1', ['policy-1'])
+      expect(mockMutations.updateUserAccessSettings).toHaveBeenCalledWith({
+        accountId: 'account-1',
+        accessPolicyIds: ['policy-1'],
+      }, expect.objectContaining({
+        onSettled: expect.any(Function),
+      }))
+
+      mockAccessRulesEditor.props?.onAddAccessSubject?.('account-2', ['default'])
+      expect(mockMutations.updateUserAccessSettings).toHaveBeenCalledWith({
+        accountId: 'account-2',
+        accessPolicyIds: ['default'],
+      }, expect.objectContaining({
+        onSettled: expect.any(Function),
+      }))
+
+      mockAccessRulesEditor.props?.onRemoveAccessPolicyMemberBinding?.('account-3', 'policy-3')
+      expect(mockMutations.removeMemberBindings).toHaveBeenCalledWith({
+        accessPolicyId: 'policy-3',
+        accountIds: ['account-3'],
+      }, expect.objectContaining({
+        onSettled: expect.any(Function),
+      }))
+    })
+  })
+})
diff --git a/web/app/components/datasets/access-config/index.tsx b/web/app/components/datasets/access-config/index.tsx
new file mode 100644
index 00000000000..fd9a851ccf1
--- /dev/null
+++ b/web/app/components/datasets/access-config/index.tsx
@@ -0,0 +1,120 @@
+'use client'
+
+import type { ResourceOpenScope } from '@/models/access-control'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useCallback, useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AccessRulesEditor from '@/app/components/access-rules-editor'
+import Loading from '@/app/components/base/loading'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
+import { useLocale } from '@/context/i18n'
+import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
+import {
+  useDatasetAccessRules,
+  useDatasetUserAccessSettings,
+  useRemoveDatasetAccessPolicyMemberBindings,
+  useUpdateDatasetOpenScope,
+  useUpdateDatasetUserAccessSettings,
+} from '@/service/access-control/use-dataset-access-config'
+import { getDatasetACLCapabilities } from '@/utils/permission'
+
+type DatasetAccessConfigPageProps = {
+  datasetId: string
+}
+
+const DatasetAccessConfigPage = ({ datasetId }: DatasetAccessConfigPageProps) => {
+  const { t } = useTranslation()
+  const locale = useLocale()
+  const language = useMemo(() => getAccessControlTemplateLanguage(locale), [locale])
+  const dataset = useDatasetDetailContextWithSelector(state => state.dataset)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canAccessConfig = useMemo(() => getDatasetACLCapabilities(dataset?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset?.maintainer,
+    workspacePermissionKeys,
+  }).canAccessConfig, [currentUserId, dataset?.maintainer, dataset?.permission_keys, workspacePermissionKeys])
+  const { data: datasetAccessRulesResponse, isLoading: isLoadingDatasetAccessRules } = useDatasetAccessRules(datasetId, language, { enabled: canAccessConfig })
+  const { data: datasetUserAccessSettingsResponse, isLoading: isLoadingDatasetUserAccessSettings } = useDatasetUserAccessSettings(datasetId, language, { enabled: canAccessConfig })
+  const { mutate: updateDatasetOpenScope, isPending: isUpdatingDatasetOpenScope } = useUpdateDatasetOpenScope(datasetId)
+  const { mutate: updateDatasetUserAccessSettings } = useUpdateDatasetUserAccessSettings(datasetId)
+  const { mutate: removeDatasetAccessPolicyMemberBindings } = useRemoveDatasetAccessPolicyMemberBindings(datasetId)
+  const [optimisticOpenScope, setOptimisticOpenScope] = useState<ResourceOpenScope | null>(null)
+  const [updatingAccountId, setUpdatingAccountId] = useState<string | null>(null)
+
+  const datasetAccessRules = datasetAccessRulesResponse?.items || []
+  const datasetUserAccessSettings = datasetUserAccessSettingsResponse?.data || []
+  const openScope = optimisticOpenScope || datasetUserAccessSettingsResponse?.scope
+
+  const handleOpenScopeChange = useCallback((nextOpenScope: ResourceOpenScope) => {
+    if (!canAccessConfig)
+      return
+    if (nextOpenScope === openScope)
+      return
+
+    const previousOptimisticOpenScope = optimisticOpenScope
+    setOptimisticOpenScope(nextOpenScope)
+    updateDatasetOpenScope(nextOpenScope, {
+      onError: () => setOptimisticOpenScope(previousOptimisticOpenScope),
+    })
+  }, [canAccessConfig, openScope, optimisticOpenScope, updateDatasetOpenScope])
+
+  const handleUserAccessPoliciesChange = useCallback((accountId: string, accessPolicyIds: string[]) => {
+    if (!canAccessConfig)
+      return
+
+    setUpdatingAccountId(accountId)
+    updateDatasetUserAccessSettings(
+      { accountId, accessPolicyIds },
+      { onSettled: () => setUpdatingAccountId(null) },
+    )
+  }, [canAccessConfig, updateDatasetUserAccessSettings])
+
+  const handleRemoveAccessPolicyMemberBinding = useCallback((accountId: string, accessPolicyId: string) => {
+    if (!canAccessConfig)
+      return
+
+    setUpdatingAccountId(accountId)
+    removeDatasetAccessPolicyMemberBindings(
+      { accessPolicyId, accountIds: [accountId] },
+      { onSettled: () => setUpdatingAccountId(null) },
+    )
+  }, [canAccessConfig, removeDatasetAccessPolicyMemberBindings])
+
+  if (!canAccessConfig)
+    return <Loading type="app" />
+
+  return (
+    <ScrollArea
+      className="h-full bg-background-default-subtle"
+      slotClassNames={{ viewport: 'overscroll-contain' }}
+    >
+      <header className="flex min-h-15.5 flex-col justify-center px-6 py-3">
+        <h1 className="system-sm-semibold text-text-primary">{t('settings.resourceAccess', { ns: 'common' })}</h1>
+        <p className="mt-0.5 system-xs-regular text-text-tertiary">
+          {t('accessRule.datasetDescription', { ns: 'permission' })}
+        </p>
+      </header>
+      <main className="w-full px-6 pt-8 pb-10">
+        <AccessRulesEditor
+          className="w-full max-w-200"
+          rules={datasetAccessRules}
+          userAccessSettings={datasetUserAccessSettings}
+          isLoadingRules={isLoadingDatasetAccessRules}
+          isLoadingUserAccessSettings={isLoadingDatasetUserAccessSettings}
+          openScope={openScope}
+          isUpdatingOpenScope={isLoadingDatasetUserAccessSettings || isUpdatingDatasetOpenScope}
+          updatingAccountId={updatingAccountId}
+          maintainerId={dataset?.maintainer}
+          onOpenScopeChange={handleOpenScopeChange}
+          onUserAccessPoliciesChange={handleUserAccessPoliciesChange}
+          onRemoveAccessPolicyMemberBinding={handleRemoveAccessPolicyMemberBinding}
+          onAddAccessSubject={handleUserAccessPoliciesChange}
+        />
+      </main>
+    </ScrollArea>
+  )
+}
+
+export default DatasetAccessConfigPage
diff --git a/web/app/components/datasets/common/economical-retrieval-method-config/index.tsx b/web/app/components/datasets/common/economical-retrieval-method-config/index.tsx
index 65facad266f..77d88bf2520 100644
--- a/web/app/components/datasets/common/economical-retrieval-method-config/index.tsx
+++ b/web/app/components/datasets/common/economical-retrieval-method-config/index.tsx
@@ -40,6 +40,7 @@ const EconomicalRetrievalMethodConfig: FC<Props> = ({
         type={RETRIEVE_METHOD.keywordSearch}
         value={value}
         onChange={onChange}
+        disabled={disabled}
       />
     </OptionCard>
   )
diff --git a/web/app/components/datasets/common/retrieval-method-config/index.tsx b/web/app/components/datasets/common/retrieval-method-config/index.tsx
index 52fdfa97529..ea792628739 100644
--- a/web/app/components/datasets/common/retrieval-method-config/index.tsx
+++ b/web/app/components/datasets/common/retrieval-method-config/index.tsx
@@ -114,6 +114,7 @@ const RetrievalMethodConfig: FC<Props> = ({
             value={value}
             onChange={onChange}
             showMultiModalTip={showMultiModalTip}
+            disabled={disabled}
           />
         </OptionCard>
       )}
@@ -137,6 +138,7 @@ const RetrievalMethodConfig: FC<Props> = ({
             value={value}
             onChange={onChange}
             showMultiModalTip={showMultiModalTip}
+            disabled={disabled}
           />
         </OptionCard>
       )}
@@ -161,6 +163,7 @@ const RetrievalMethodConfig: FC<Props> = ({
             value={value}
             onChange={onChange}
             showMultiModalTip={showMultiModalTip}
+            disabled={disabled}
           />
         </OptionCard>
       )}
diff --git a/web/app/components/datasets/common/retrieval-param-config/index.tsx b/web/app/components/datasets/common/retrieval-param-config/index.tsx
index fe9152944c2..64f07e59ec6 100644
--- a/web/app/components/datasets/common/retrieval-param-config/index.tsx
+++ b/web/app/components/datasets/common/retrieval-param-config/index.tsx
@@ -31,6 +31,7 @@ type Props = Readonly<{
   type: RETRIEVE_METHOD
   value: RetrievalConfig
   showMultiModalTip?: boolean
+  disabled?: boolean
   onChange: (value: RetrievalConfig) => void
 }>
 
@@ -38,6 +39,7 @@ const RetrievalParamConfig: FC<Props> = ({
   type,
   value,
   showMultiModalTip = false,
+  disabled = false,
   onChange,
 }) => {
   const { t } = useTranslation()
@@ -59,13 +61,15 @@ const RetrievalParamConfig: FC<Props> = ({
   )
 
   const handleToggleRerankEnable = useCallback((enable: boolean) => {
+    if (disabled)
+      return
     if (enable && !currentModel)
       toast.error(t('errorMsg.rerankModelRequired', { ns: 'workflow' }))
     onChange({
       ...value,
       reranking_enable: enable,
     })
-  }, [currentModel, onChange, value])
+  }, [currentModel, disabled, onChange, t, value])
 
   const rerankModel = useMemo(() => {
     return {
@@ -75,6 +79,8 @@ const RetrievalParamConfig: FC<Props> = ({
   }, [value.reranking_model])
 
   const handleChangeRerankMode = (v: RerankingModeEnum) => {
+    if (disabled)
+      return
     if (v === value.reranking_mode)
       return
 
@@ -124,6 +130,7 @@ const RetrievalParamConfig: FC<Props> = ({
                 size="md"
                 checked={value.reranking_enable}
                 onCheckedChange={handleToggleRerankEnable}
+                disabled={disabled}
               />
             )}
             <div className="flex items-center">
@@ -143,6 +150,8 @@ const RetrievalParamConfig: FC<Props> = ({
                   defaultModel={rerankModel && { provider: rerankModel.provider_name, model: rerankModel.model_name }}
                   modelList={rerankModelList}
                   onSelect={(v) => {
+                    if (disabled)
+                      return
                     onChange({
                       ...value,
                       reranking_model: {
@@ -151,6 +160,7 @@ const RetrievalParamConfig: FC<Props> = ({
                       },
                     })
                   }}
+                  readonly={disabled}
                 />
                 {showMultiModalTip && (
                   <div className="mt-2 flex h-10 items-center gap-x-0.5 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur p-2 shadow-xs backdrop-blur-[5px]">
@@ -175,18 +185,23 @@ const RetrievalParamConfig: FC<Props> = ({
               className="grow"
               value={value.top_k}
               onChange={(_key, v) => {
+                if (disabled)
+                  return
                 onChange({
                   ...value,
                   top_k: v,
                 })
               }}
               enable={true}
+              disabled={disabled}
             />
             {(!isEconomical && !(value.search_method === RETRIEVE_METHOD.fullText && !value.reranking_enable)) && (
               <ScoreThresholdItem
                 className="grow"
                 value={value.score_threshold}
                 onChange={(_key, v) => {
+                  if (disabled)
+                    return
                   onChange({
                     ...value,
                     score_threshold: v,
@@ -194,7 +209,10 @@ const RetrievalParamConfig: FC<Props> = ({
                 }}
                 enable={value.score_threshold_enabled}
                 hasSwitch={true}
+                disabled={disabled}
                 onSwitchChange={(_key, v) => {
+                  if (disabled)
+                    return
                   onChange({
                     ...value,
                     score_threshold_enabled: v,
@@ -246,6 +264,8 @@ const RetrievalParamConfig: FC<Props> = ({
                     ],
                   }}
                   onChange={(v) => {
+                    if (disabled)
+                      return
                     onChange({
                       ...value,
                       weights: {
@@ -271,6 +291,8 @@ const RetrievalParamConfig: FC<Props> = ({
                     defaultModel={rerankModel && { provider: rerankModel.provider_name, model: rerankModel.model_name }}
                     modelList={rerankModelList}
                     onSelect={(v) => {
+                      if (disabled)
+                        return
                       onChange({
                         ...value,
                         reranking_model: {
@@ -279,6 +301,7 @@ const RetrievalParamConfig: FC<Props> = ({
                         },
                       })
                     }}
+                    readonly={disabled}
                   />
                   {showMultiModalTip && (
                     <div className="mt-2 flex h-10 items-center gap-x-0.5 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur p-2 shadow-xs backdrop-blur-[5px]">
@@ -299,17 +322,22 @@ const RetrievalParamConfig: FC<Props> = ({
                 className="grow"
                 value={value.top_k}
                 onChange={(_key, v) => {
+                  if (disabled)
+                    return
                   onChange({
                     ...value,
                     top_k: v,
                   })
                 }}
                 enable={true}
+                disabled={disabled}
               />
               <ScoreThresholdItem
                 className="grow"
                 value={value.score_threshold}
                 onChange={(_key, v) => {
+                  if (disabled)
+                    return
                   onChange({
                     ...value,
                     score_threshold: v,
@@ -317,7 +345,10 @@ const RetrievalParamConfig: FC<Props> = ({
                 }}
                 enable={value.score_threshold_enabled}
                 hasSwitch={true}
+                disabled={disabled}
                 onSwitchChange={(_key, v) => {
+                  if (disabled)
+                    return
                   onChange({
                     ...value,
                     score_threshold_enabled: v,
diff --git a/web/app/components/datasets/create/__tests__/index.spec.tsx b/web/app/components/datasets/create/__tests__/index.spec.tsx
index b63058af04d..7668e778d94 100644
--- a/web/app/components/datasets/create/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/create/__tests__/index.spec.tsx
@@ -30,6 +30,30 @@ vi.mock('@/next/link', () => {
   }
 })
 
+const mockReplace = vi.fn()
+vi.mock('@/next/navigation', () => ({
+  useRouter: () => ({
+    replace: mockReplace,
+  }),
+}))
+
+let mockCurrentUserId = 'user-1'
+let mockWorkspacePermissionKeys = ['dataset.create_and_management']
+let mockIsLoadingWorkspacePermissionKeys = false
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: {
+    userProfile: { id: string }
+    workspacePermissionKeys: string[]
+    isLoadingWorkspacePermissionKeys: boolean
+  }) => unknown) => {
+    return selector({
+      userProfile: { id: mockCurrentUserId },
+      workspacePermissionKeys: mockWorkspacePermissionKeys,
+      isLoadingWorkspacePermissionKeys: mockIsLoadingWorkspacePermissionKeys,
+    })
+  },
+}))
+
 // Mock modal context
 const mockSetShowAccountSettingModal = vi.fn()
 vi.mock('@/context/modal-context', () => ({
@@ -165,6 +189,7 @@ vi.mock('../step-two', () => ({
         <span data-testid="step-two-is-api-key-set">{String(props.isAPIKeySet)}</span>
         <span data-testid="step-two-data-source-type">{props.dataSourceType}</span>
         <span data-testid="step-two-files-count">{props.files?.length || 0}</span>
+        <span data-testid="step-two-can-create-document">{String(props.canCreateDocument)}</span>
         <button data-testid="step-two-prev" onClick={() => props.onStepChange!(-1)}>Prev Step</button>
         <button data-testid="step-two-next" onClick={() => props.onStepChange!(1)}>Next Step</button>
         <button data-testid="step-two-setting" onClick={props.onSetting}>Open Settings</button>
@@ -274,6 +299,7 @@ const createMockDataset = (overrides?: Partial<DataSet>): DataSet => ({
   runtime_mode: 'general' as const,
   enable_api: false,
   is_multimodal: false,
+  permission_keys: ['dataset.acl.use', 'dataset.acl.edit'],
   ...overrides,
 })
 
@@ -293,6 +319,9 @@ describe('DatasetUpdateForm', () => {
     mockDataSourceList = { result: [createMockDataSourceAuth()] }
     mockIsLoadingDataSourceList = false
     mockFetchingError = false
+    mockCurrentUserId = 'user-1'
+    mockWorkspacePermissionKeys = ['dataset.create_and_management']
+    mockIsLoadingWorkspacePermissionKeys = false
     // Reset captured props
     stepOneProps = {} as StepOneProps
     stepTwoProps = {} as StepTwoProps
@@ -750,6 +779,26 @@ describe('DatasetUpdateForm', () => {
       expect(screen.getByTestId('step-two'))!.toBeInTheDocument()
     })
 
+    it('should redirect when existing dataset does not grant add document permission', async () => {
+      mockDatasetDetail = createMockDataset({ permission_keys: ['dataset.acl.edit'] })
+
+      render(<DatasetUpdateForm datasetId="dataset-123" />)
+
+      await waitFor(() => {
+        expect(mockReplace).toHaveBeenCalledWith('/datasets/dataset-123/documents')
+      })
+      expect(screen.queryByTestId('step-one')).not.toBeInTheDocument()
+    })
+
+    it('should pass add document permission to StepTwo for existing dataset', () => {
+      mockDatasetDetail = createMockDataset()
+
+      render(<DatasetUpdateForm datasetId="dataset-123" />)
+      fireEvent.click(screen.getByTestId('step-one-next'))
+
+      expect(screen.getByTestId('step-two-can-create-document')).toHaveTextContent('true')
+    })
+
     it('should pass indexingType from datasetDetail to StepTwo', () => {
       mockDatasetDetail = createMockDataset({ indexing_technique: IndexingTypeValues.ECONOMICAL })
       render(<DatasetUpdateForm datasetId="dataset-123" />)
diff --git a/web/app/components/datasets/create/index.tsx b/web/app/components/datasets/create/index.tsx
index e5e8eda2382..71d34e9649b 100644
--- a/web/app/components/datasets/create/index.tsx
+++ b/web/app/components/datasets/create/index.tsx
@@ -4,16 +4,19 @@ import type { CrawlOptions, CrawlResultItem, createDocumentResponse, FileItem }
 import type { RETRIEVE_METHOD } from '@/types/app'
 import { produce } from 'immer'
 import * as React from 'react'
-import { useCallback, useState } from 'react'
+import { useCallback, useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Loading from '@/app/components/base/loading'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
 import { useDefaultModel } from '@/app/components/header/account-setting/model-provider-page/hooks'
 import { useIntegrationsSetting } from '@/app/components/header/account-setting/use-integrations-setting'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import { DataSourceProvider } from '@/models/common'
 import { DataSourceType } from '@/models/datasets'
+import { useRouter } from '@/next/navigation'
 import { useGetDefaultDataSourceListAuth } from '@/service/use-datasource'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import AppUnavailable from '../../base/app-unavailable'
 import { ModelTypeEnum } from '../../header/account-setting/model-provider-page/declarations'
 import StepOne from './step-one'
@@ -37,9 +40,22 @@ const DEFAULT_CRAWL_OPTIONS: CrawlOptions = {
 
 const DatasetUpdateForm = ({ datasetId }: DatasetUpdateFormProps) => {
   const { t } = useTranslation()
+  const router = useRouter()
   const openIntegrationsSetting = useIntegrationsSetting()
   const datasetDetail = useDatasetDetailContextWithSelector(state => state.dataset)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const isLoadingWorkspacePermissionKeys = useAppContextWithSelector(state => state.isLoadingWorkspacePermissionKeys)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const { data: embeddingsDefaultModel } = useDefaultModel(ModelTypeEnum.textEmbedding)
+  const canAddDocumentsToDataset = !datasetId || getDatasetACLCapabilities(datasetDetail?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: datasetDetail?.maintainer,
+    workspacePermissionKeys,
+  }).canUse
+  const shouldRedirectToDocuments = !!datasetId
+    && !!datasetDetail
+    && !isLoadingWorkspacePermissionKeys
+    && !canAddDocumentsToDataset
 
   const [dataSourceType, setDataSourceType] = useState<DataSourceType>(DataSourceType.FILE)
   const [step, setStep] = useState(1)
@@ -103,6 +119,14 @@ const DatasetUpdateForm = ({ datasetId }: DatasetUpdateFormProps) => {
     setStep(step + delta)
   }, [step, setStep])
 
+  useEffect(() => {
+    if (shouldRedirectToDocuments && datasetId)
+      router.replace(`/datasets/${datasetId}/documents`)
+  }, [datasetId, router, shouldRedirectToDocuments])
+
+  if ((!!datasetId && isLoadingWorkspacePermissionKeys) || shouldRedirectToDocuments)
+    return <Loading type="app" />
+
   if (fetchingAuthedDataSourceListError)
     return <AppUnavailable code={500} unknownReason={t('error.unavailable', { ns: 'datasetCreation' }) as string} />
 
@@ -156,6 +180,7 @@ const DatasetUpdateForm = ({ datasetId }: DatasetUpdateFormProps) => {
                   websiteCrawlProvider={websiteCrawlProvider}
                   websiteCrawlJobId={websiteCrawlJobId}
                   onStepChange={changeStep}
+                  canCreateDocument={canAddDocumentsToDataset}
                   updateIndexingTypeCache={updateIndexingTypeCache}
                   updateRetrievalMethodCache={updateRetrievalMethodCache}
                   updateResultCache={updateResultCache}
diff --git a/web/app/components/datasets/create/step-two/hooks/__tests__/use-document-creation.spec.ts b/web/app/components/datasets/create/step-two/hooks/__tests__/use-document-creation.spec.ts
index 52099668ec6..cb6fadde4ee 100644
--- a/web/app/components/datasets/create/step-two/hooks/__tests__/use-document-creation.spec.ts
+++ b/web/app/components/datasets/create/step-two/hooks/__tests__/use-document-creation.spec.ts
@@ -1,4 +1,4 @@
-import type { CustomFile, FullDocumentDetail, ProcessRule } from '@/models/datasets'
+import type { CreateDocumentReq, CustomFile, FullDocumentDetail, ProcessRule } from '@/models/datasets'
 import type { RetrievalConfig } from '@/types/app'
 import { renderHook } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
@@ -183,6 +183,44 @@ describe('useDocumentCreation', () => {
     })
   })
 
+  describe('executeCreation', () => {
+    it('should not create document when existing dataset cannot add documents', async () => {
+      const onStepChange = vi.fn()
+      const { result } = renderHook(() =>
+        useDocumentCreation({
+          ...defaultOptions,
+          datasetId: 'dataset-1',
+          canCreateDocument: false,
+          onStepChange,
+        }),
+      )
+
+      await result.current.executeCreation({} as CreateDocumentReq, IndexingType.QUALIFIED, defaultValidationParams.retrievalConfig)
+
+      expect(mocks.mutateAsync).not.toHaveBeenCalled()
+      expect(mocks.invalidDatasetList).not.toHaveBeenCalled()
+      expect(onStepChange).not.toHaveBeenCalled()
+    })
+
+    it('should allow setting saves even when document creation permission is false', async () => {
+      const onSave = vi.fn()
+      const { result } = renderHook(() =>
+        useDocumentCreation({
+          ...defaultOptions,
+          datasetId: 'dataset-1',
+          canCreateDocument: false,
+          isSetting: true,
+          onSave,
+        }),
+      )
+
+      await result.current.executeCreation({} as CreateDocumentReq, IndexingType.QUALIFIED, defaultValidationParams.retrievalConfig)
+
+      expect(mocks.mutateAsync).toHaveBeenCalled()
+      expect(onSave).toHaveBeenCalled()
+    })
+  })
+
   describe('isCreating', () => {
     it('should reflect mutation pending state', () => {
       const { result } = renderHook(() => useDocumentCreation(defaultOptions))
diff --git a/web/app/components/datasets/create/step-two/hooks/use-document-creation.ts b/web/app/components/datasets/create/step-two/hooks/use-document-creation.ts
index 27d96e66099..9fcf7980584 100644
--- a/web/app/components/datasets/create/step-two/hooks/use-document-creation.ts
+++ b/web/app/components/datasets/create/step-two/hooks/use-document-creation.ts
@@ -26,6 +26,7 @@ type UseDocumentCreationOptions = {
   crawlOptions?: CrawlOptions
   websiteCrawlProvider?: DataSourceProvider
   websiteCrawlJobId?: string
+  canCreateDocument?: boolean
   // Callbacks
   onStepChange?: (delta: number) => void
   updateIndexingTypeCache?: (type: string) => void
@@ -46,7 +47,7 @@ type ValidationParams = {
 }
 export const useDocumentCreation = (options: UseDocumentCreationOptions) => {
   const { t } = useTranslation()
-  const { datasetId, isSetting, documentDetail, dataSourceType, files, notionPages, notionCredentialId, websitePages, crawlOptions, websiteCrawlProvider = DataSourceProvider.jinaReader, websiteCrawlJobId = '', onStepChange, updateIndexingTypeCache, updateResultCache, updateRetrievalMethodCache, onSave, mutateDatasetRes } = options
+  const { datasetId, isSetting, documentDetail, dataSourceType, files, notionPages, notionCredentialId, websitePages, crawlOptions, websiteCrawlProvider = DataSourceProvider.jinaReader, websiteCrawlJobId = '', canCreateDocument = true, onStepChange, updateIndexingTypeCache, updateResultCache, updateRetrievalMethodCache, onSave, mutateDatasetRes } = options
   const createFirstDocumentMutation = useCreateFirstDocument()
   const createDocumentMutation = useCreateDocument(datasetId!)
   const invalidDatasetList = useInvalidDatasetList()
@@ -140,6 +141,9 @@ export const useDocumentCreation = (options: UseDocumentCreationOptions) => {
   ])
   // Execute creation
   const executeCreation = useCallback(async (params: CreateDocumentReq, indexType: IndexingType, retrievalConfig: RetrievalConfig) => {
+    if (datasetId && !isSetting && !canCreateDocument)
+      return
+
     if (!datasetId) {
       await createFirstDocumentMutation.mutateAsync(params, {
         onSuccess(data) {
@@ -179,6 +183,7 @@ export const useDocumentCreation = (options: UseDocumentCreationOptions) => {
     dataSourceType,
     onStepChange,
     isSetting,
+    canCreateDocument,
     onSave,
   ])
   // Validate preview params
diff --git a/web/app/components/datasets/create/step-two/index.tsx b/web/app/components/datasets/create/step-two/index.tsx
index e3144c411da..39c9688c3b5 100644
--- a/web/app/components/datasets/create/step-two/index.tsx
+++ b/web/app/components/datasets/create/step-two/index.tsx
@@ -17,6 +17,7 @@ import { useFetchDefaultProcessRule } from '@/service/knowledge/use-create-datas
 import { GeneralChunkingOptions, IndexingModeSection, ParentChildOptions, PreviewPanel, StepTwoFooter } from './components'
 import { IndexingType, MAXIMUM_CHUNK_TOKEN_LENGTH, useDocumentCreation, useIndexingConfig, useIndexingEstimate, usePreviewState, useSegmentationState } from './hooks'
 
+// eslint-disable-next-line no-barrel-files/no-barrel-files
 export { IndexingType }
 
 const StepTwo: FC<StepTwoProps> = ({
@@ -33,6 +34,7 @@ const StepTwo: FC<StepTwoProps> = ({
   crawlOptions,
   websiteCrawlProvider = DataSourceProvider.jinaReader,
   websiteCrawlJobId = '',
+  canCreateDocument = true,
   onStepChange,
   updateIndexingTypeCache,
   updateResultCache,
@@ -88,6 +90,7 @@ const StepTwo: FC<StepTwoProps> = ({
     crawlOptions,
     websiteCrawlProvider,
     websiteCrawlJobId,
+    canCreateDocument,
     onStepChange,
     updateIndexingTypeCache,
     updateResultCache,
@@ -146,6 +149,9 @@ const StepTwo: FC<StepTwoProps> = ({
   }, [segmentation, t, estimateHook])
 
   const handleCreate = useCallback(async () => {
+    if (!canCreateDocument)
+      return
+
     const isValid = creation.validateParams({
       segmentationType: segmentation.segmentationType,
       maxChunkLength: segmentation.maxChunkLength,
@@ -162,7 +168,7 @@ const StepTwo: FC<StepTwoProps> = ({
     if (!params)
       return
     await creation.executeCreation(params, indexing.indexType, indexing.retrievalConfig)
-  }, [creation, segmentation, indexing, currentDocForm, docLanguage])
+  }, [canCreateDocument, creation, segmentation, indexing, currentDocForm, docLanguage])
 
   const handlePickerChange = useCallback((selected: { id: string, name: string }) => {
     estimateHook.reset()
@@ -187,7 +193,7 @@ const StepTwo: FC<StepTwoProps> = ({
       segmentation.applyConfigFromRules(rules, isHierarchical)
       segmentation.setSegmentationType(documentDetail.dataset_process_rule.mode)
     }
-  // eslint-disable-next-line react-hooks/exhaustive-deps
+  // eslint-disable-next-line react/exhaustive-deps
   }, [])
 
   // Show options conditions
diff --git a/web/app/components/datasets/create/step-two/types.ts b/web/app/components/datasets/create/step-two/types.ts
index 7f5291fb13b..3868bb0ef4f 100644
--- a/web/app/components/datasets/create/step-two/types.ts
+++ b/web/app/components/datasets/create/step-two/types.ts
@@ -19,6 +19,7 @@ export type StepTwoProps = {
   crawlOptions?: CrawlOptions
   websiteCrawlProvider?: DataSourceProvider
   websiteCrawlJobId?: string
+  canCreateDocument?: boolean
   onStepChange?: (delta: number) => void
   updateIndexingTypeCache?: (type: string) => void
   updateRetrievalMethodCache?: (method: RETRIEVE_METHOD | '') => void
diff --git a/web/app/components/datasets/documents/__tests__/index.spec.tsx b/web/app/components/datasets/documents/__tests__/index.spec.tsx
index 2dd91dd7f38..fa09e9c0766 100644
--- a/web/app/components/datasets/documents/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/documents/__tests__/index.spec.tsx
@@ -33,6 +33,8 @@ vi.mock('@/context/dataset-detail', () => ({
         embedding_available: true,
         data_source_type: DataSourceType.FILE,
         runtime_mode: 'rag',
+        created_by: 'test-user',
+        permission_keys: ['dataset.acl.use', 'dataset.acl.edit'],
       },
     }
     return selector(mockState as MockState)
@@ -45,6 +47,14 @@ vi.mock('@/context/provider-context', () => ({
   })),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) =>
+    selector({
+      userProfile: { id: 'test-user' },
+      workspacePermissionKeys: ['dataset.create_and_management'],
+    }),
+}))
+
 // Mock document service hooks
 const mockInvalidDocumentList = vi.fn()
 const mockInvalidDocumentDetail = vi.fn()
@@ -278,6 +288,8 @@ describe('Documents', () => {
           embedding_available: true,
           data_source_type: DataSourceType.FILE,
           runtime_mode: 'rag',
+          created_by: 'test-user',
+          permission_keys: ['dataset.acl.use', 'dataset.acl.edit'],
         },
       }
       return selector(mockState as MockState)
@@ -362,6 +374,8 @@ describe('Documents', () => {
             embedding_available: true,
             data_source_type: DataSourceType.NOTION,
             runtime_mode: 'rag',
+            created_by: 'test-user',
+            permission_keys: ['dataset.acl.use', 'dataset.acl.edit'],
           },
         }
         return selector(mockState as MockState)
@@ -466,6 +480,8 @@ describe('Documents', () => {
             embedding_available: true,
             data_source_type: DataSourceType.FILE,
             runtime_mode: 'rag_pipeline',
+            created_by: 'test-user',
+            permission_keys: ['dataset.acl.use', 'dataset.acl.edit'],
           },
         }
         return selector(mockState as MockState)
@@ -487,6 +503,8 @@ describe('Documents', () => {
             embedding_available: true,
             data_source_type: DataSourceType.FILE,
             runtime_mode: 'rag',
+            created_by: 'test-user',
+            permission_keys: ['dataset.acl.use', 'dataset.acl.edit'],
           },
         }
         return selector(mockState as MockState)
diff --git a/web/app/components/datasets/documents/components/__tests__/documents-header.spec.tsx b/web/app/components/datasets/documents/components/__tests__/documents-header.spec.tsx
index 0289a79e2a4..664b05cbe35 100644
--- a/web/app/components/datasets/documents/components/__tests__/documents-header.spec.tsx
+++ b/web/app/components/datasets/documents/components/__tests__/documents-header.spec.tsx
@@ -32,6 +32,9 @@ describe('DocumentsHeader', () => {
     datasetId: 'dataset-123',
     dataSourceType: DataSourceType.FILE,
     embeddingAvailable: true,
+    canManageMetadata: true,
+    canAddDocument: true,
+    canEditDocument: true,
     isFreePlan: false,
     statusFilterValue: 'all',
     sortValue: 'created_at' as SortType,
@@ -86,6 +89,22 @@ describe('DocumentsHeader', () => {
       render(<DocumentsHeader {...defaultProps} />)
       expect(screen.getByRole('textbox')).toBeInTheDocument()
     })
+
+    it('should hide action controls by default when permissions are omitted', () => {
+      const {
+        canManageMetadata: _canManageMetadata,
+        canAddDocument: _canAddDocument,
+        canEditDocument: _canEditDocument,
+        ...propsWithoutPermissions
+      } = defaultProps
+
+      render(<DocumentsHeader {...propsWithoutPermissions} />)
+
+      expect(screen.queryByTestId('auto-disabled-document')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('index-failed')).not.toBeInTheDocument()
+      expect(screen.queryByText(/metadata\.metadata/i)).not.toBeInTheDocument()
+      expect(screen.queryByText(/list\.addFile/i)).not.toBeInTheDocument()
+    })
   })
 
   describe('AutoDisabledDocument', () => {
@@ -98,6 +117,11 @@ describe('DocumentsHeader', () => {
       render(<DocumentsHeader {...defaultProps} isFreePlan={true} />)
       expect(screen.queryByTestId('auto-disabled-document')).not.toBeInTheDocument()
     })
+
+    it('should not show AutoDisabledDocument without document edit permission', () => {
+      render(<DocumentsHeader {...defaultProps} canEditDocument={false} />)
+      expect(screen.queryByTestId('auto-disabled-document')).not.toBeInTheDocument()
+    })
   })
 
   describe('IndexFailed', () => {
@@ -105,6 +129,11 @@ describe('DocumentsHeader', () => {
       render(<DocumentsHeader {...defaultProps} />)
       expect(screen.getByTestId('index-failed')).toBeInTheDocument()
     })
+
+    it('should not show IndexFailed without document edit permission', () => {
+      render(<DocumentsHeader {...defaultProps} canEditDocument={false} />)
+      expect(screen.queryByTestId('index-failed')).not.toBeInTheDocument()
+    })
   })
 
   describe('Embedding Availability', () => {
diff --git a/web/app/components/datasets/documents/components/__tests__/operations.spec.tsx b/web/app/components/datasets/documents/components/__tests__/operations.spec.tsx
index a1ee53fa3f7..957b7b7dd0d 100644
--- a/web/app/components/datasets/documents/components/__tests__/operations.spec.tsx
+++ b/web/app/components/datasets/documents/components/__tests__/operations.spec.tsx
@@ -86,6 +86,10 @@ describe('Operations', () => {
     datasetId: 'dataset-1',
     detail: defaultDetail,
     onUpdate: mockOnUpdate,
+    canEdit: true,
+    canDownload: true,
+    canDelete: true,
+    canViewSettings: true,
   }
 
   beforeEach(() => {
@@ -124,6 +128,54 @@ describe('Operations', () => {
       const disabledSwitch = screen.getByRole('switch')
       expect(disabledSwitch)!.toHaveAttribute('aria-disabled', 'true')
     })
+
+    it('should not render an operations menu and should disable switch without any document operation permissions', async () => {
+      vi.useFakeTimers()
+      render(
+        <Operations
+          {...defaultProps}
+          canEdit={false}
+          canDownload={false}
+          canDelete={false}
+          canViewSettings={false}
+        />,
+      )
+
+      expect(screen.queryByRole('button', { name: 'common.operation.more' })).not.toBeInTheDocument()
+
+      const switchElement = screen.getByRole('switch')
+      expect(switchElement)!.toHaveAttribute('aria-disabled', 'true')
+      await act(async () => {
+        fireEvent.click(switchElement)
+        vi.advanceTimersByTime(600)
+      })
+      expect(mockEnable).not.toHaveBeenCalled()
+      expect(mockDisable).not.toHaveBeenCalled()
+      vi.useRealTimers()
+    })
+
+    it('should only render download action when download is the only granted document operation', async () => {
+      render(
+        <Operations
+          {...defaultProps}
+          canEdit={false}
+          canDownload
+          canDelete={false}
+          canViewSettings={false}
+        />,
+      )
+
+      const moreButton = screen.getByRole('button', { name: 'common.operation.more' })
+      await act(async () => {
+        fireEvent.click(moreButton)
+      })
+
+      expect(screen.getByText('datasetDocuments.list.action.download'))!.toBeInTheDocument()
+      expect(screen.queryByText('datasetDocuments.list.table.rename')).not.toBeInTheDocument()
+      expect(screen.queryByText('datasetDocuments.list.action.settings')).not.toBeInTheDocument()
+      expect(screen.queryByText('datasetDocuments.list.action.archive')).not.toBeInTheDocument()
+      expect(screen.queryByText('datasetDocuments.list.action.delete')).not.toBeInTheDocument()
+    })
   })
 
   describe('switch toggle', () => {
@@ -223,6 +275,17 @@ describe('Operations', () => {
       })
       expect(mockPush).toHaveBeenCalledWith('/datasets/dataset-1/documents/doc-1/settings')
     })
+
+    it('should hide document settings when settings permission is not granted', async () => {
+      render(<Operations {...defaultProps} canViewSettings={false} />)
+
+      const moreButton = screen.getByRole('button', { name: 'common.operation.more' })
+      await act(async () => {
+        fireEvent.click(moreButton)
+      })
+
+      expect(screen.queryByText('datasetDocuments.list.action.settings')).not.toBeInTheDocument()
+    })
   })
 
   describe('detail scene', () => {
diff --git a/web/app/components/datasets/documents/components/document-list/__tests__/index.spec.tsx b/web/app/components/datasets/documents/components/document-list/__tests__/index.spec.tsx
index 9002e29f01a..3840223e2db 100644
--- a/web/app/components/datasets/documents/components/document-list/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/documents/components/document-list/__tests__/index.spec.tsx
@@ -24,8 +24,22 @@ vi.mock('@/next/navigation', () => ({
 }))
 
 vi.mock('@/context/dataset-detail', () => ({
-  useDatasetDetailContextWithSelector: (selector: (state: { dataset: { doc_form: string } }) => unknown) =>
-    selector({ dataset: { doc_form: ChunkingMode.text } }),
+  useDatasetDetailContextWithSelector: (selector: (state: { dataset: { doc_form: string, created_by: string, permission_keys: string[] } }) => unknown) =>
+    selector({
+      dataset: {
+        doc_form: ChunkingMode.text,
+        created_by: 'user-1',
+        permission_keys: ['dataset.acl.edit', 'dataset.acl.use'],
+      },
+    }),
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) =>
+    selector({
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: ['dataset.create_and_management'],
+    }),
 }))
 
 vi.mock('@/app/components/datasets/metadata/hooks/use-batch-edit-document-metadata', () => ({
@@ -384,15 +398,14 @@ describe('DocumentList', () => {
     })
 
     it('should show rename modal when rename button is clicked', async () => {
-      const { container } = render(<DocumentList {...defaultProps} />, { wrapper: createWrapper() })
+      render(<DocumentList {...defaultProps} />, { wrapper: createWrapper() })
 
-      // Find and click the rename button in the first row
-      const renameButtons = container.querySelectorAll('.cursor-pointer.rounded-md')
-      if (renameButtons.length > 0) {
-        await act(async () => {
-          fireEvent.click(renameButtons[0]!)
-        })
-      }
+      await act(async () => {
+        fireEvent.click(screen.getAllByRole('button', { name: 'common.operation.more' })[0]!)
+      })
+      await act(async () => {
+        fireEvent.click(await screen.findByText('datasetDocuments.list.table.rename'))
+      })
 
       expect(screen.getByRole('dialog', { name: 'datasetDocuments.list.table.rename' }))!.toBeInTheDocument()
     })
diff --git a/web/app/components/datasets/documents/components/document-list/components/document-table-row.tsx b/web/app/components/datasets/documents/components/document-list/components/document-table-row.tsx
index e4c4fe31c17..7fedde10168 100644
--- a/web/app/components/datasets/documents/components/document-list/components/document-table-row.tsx
+++ b/web/app/components/datasets/documents/components/document-list/components/document-table-row.tsx
@@ -9,10 +9,13 @@ import ChunkingModeLabel from '@/app/components/datasets/common/chunking-mode-la
 import Operations from '@/app/components/datasets/documents/components/operations'
 import SummaryStatus from '@/app/components/datasets/documents/detail/completed/common/summary-status'
 import StatusItem from '@/app/components/datasets/documents/status-item'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import useTimestamp from '@/hooks/use-timestamp'
 import { DataSourceType } from '@/models/datasets'
 import { useRouter, useSearchParams } from '@/next/navigation'
 import { formatNumber } from '@/utils/format'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import DocumentSourceIcon from './document-source-icon'
 import { renderTdValue } from './utils'
 
@@ -58,6 +61,14 @@ const DocumentTableRow = React.memo(({
   const router = useRouter()
   const searchParams = useSearchParams()
   const documentNameId = React.useId()
+  const dataset = useDatasetDetailContextWithSelector(s => s.dataset)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const datasetACLCapabilities = React.useMemo(() => getDatasetACLCapabilities(dataset?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset?.maintainer,
+    workspacePermissionKeys,
+  }), [dataset?.maintainer, dataset?.permission_keys, currentUserId, workspacePermissionKeys])
 
   const isFile = doc.data_source_type === DataSourceType.FILE
   const fileType = isFile ? doc.data_source_detail_dict?.upload_file?.extension : ''
@@ -67,7 +78,7 @@ const DocumentTableRow = React.memo(({
     router.push(`/datasets/${datasetId}/documents/${doc.id}${queryString ? `?${queryString}` : ''}`)
   }, [router, datasetId, doc.id, queryString])
 
-  const handleCheckboxClick = useCallback((e: React.MouseEvent) => {
+  const stopPropagation = useCallback((e: React.SyntheticEvent) => {
     e.stopPropagation()
   }, [])
 
@@ -82,7 +93,7 @@ const DocumentTableRow = React.memo(({
       onClick={handleRowClick}
     >
       <td className="text-left align-middle text-xs text-text-tertiary">
-        <div className="flex items-center" onClick={handleCheckboxClick}>
+        <div className="flex items-center" role="presentation" onClick={stopPropagation} onKeyDown={stopPropagation}>
           <Checkbox
             className="mr-2 shrink-0"
             value={doc.id}
@@ -111,23 +122,26 @@ const DocumentTableRow = React.memo(({
               <SummaryStatus status={doc.summary_index_status} />
             </div>
           )}
-          <div className="hidden shrink-0 group-hover:ml-auto group-hover:flex">
-            <Tooltip>
-              <TooltipTrigger
-                render={(
-                  <div
-                    className="cursor-pointer rounded-md p-1 hover:bg-state-base-hover"
-                    onClick={handleRenameClick}
-                  >
-                    <span className="i-ri-edit-line size-4 text-text-tertiary" />
-                  </div>
-                )}
-              />
-              <TooltipContent>
-                {t('list.table.rename', { ns: 'datasetDocuments' })}
-              </TooltipContent>
-            </Tooltip>
-          </div>
+          {datasetACLCapabilities.canEdit && (
+            <div className="hidden shrink-0 group-hover:ml-auto group-hover:flex">
+              <Tooltip>
+                <TooltipTrigger
+                  render={(
+                    <button
+                      type="button"
+                      className="cursor-pointer rounded-md border-none bg-transparent p-1 hover:bg-state-base-hover"
+                      onClick={handleRenameClick}
+                    >
+                      <span className="i-ri-edit-line size-4 text-text-tertiary" />
+                    </button>
+                  )}
+                />
+                <TooltipContent>
+                  {t('list.table.rename', { ns: 'datasetDocuments' })}
+                </TooltipContent>
+              </Tooltip>
+            </div>
+          )}
         </div>
       </td>
       <td>
@@ -152,6 +166,10 @@ const DocumentTableRow = React.memo(({
           datasetId={datasetId}
           detail={pick(doc, ['name', 'enabled', 'archived', 'id', 'data_source_type', 'doc_form', 'display_status'])}
           onUpdate={onUpdate}
+          canEdit={datasetACLCapabilities.canEdit}
+          canDownload={datasetACLCapabilities.canDocumentDownload}
+          canDelete={datasetACLCapabilities.canDeleteFile}
+          canViewSettings={datasetACLCapabilities.canEdit}
         />
       </td>
     </tr>
diff --git a/web/app/components/datasets/documents/components/documents-header.tsx b/web/app/components/datasets/documents/components/documents-header.tsx
index 3e9f6463f78..bef76cf06a6 100644
--- a/web/app/components/datasets/documents/components/documents-header.tsx
+++ b/web/app/components/datasets/documents/components/documents-header.tsx
@@ -2,9 +2,7 @@
 import type { FC } from 'react'
 import type { BuiltInMetadataItem, MetadataItemWithValueLength } from '@/app/components/datasets/metadata/types'
 import type { SortType } from '@/service/datasets'
-import { PlusIcon } from '@heroicons/react/24/solid'
 import { Button } from '@langgenius/dify-ui/button'
-import { RiDraftLine, RiExternalLinkLine } from '@remixicon/react'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import Chip from '@/app/components/base/chip'
@@ -28,6 +26,9 @@ type DocumentsHeaderProps = {
   datasetId: string
   dataSourceType?: DataSourceType
   embeddingAvailable: boolean
+  canManageMetadata?: boolean
+  canAddDocument?: boolean
+  canEditDocument?: boolean
   isFreePlan: boolean
 
   // Filter & sort
@@ -59,6 +60,9 @@ const DocumentsHeader: FC<DocumentsHeaderProps> = ({
   datasetId,
   dataSourceType,
   embeddingAvailable,
+  canManageMetadata = false,
+  canAddDocument = false,
+  canEditDocument = false,
   isFreePlan,
   statusFilterValue,
   sortValue,
@@ -128,7 +132,7 @@ const DocumentsHeader: FC<DocumentsHeaderProps> = ({
             href={docLink('/use-dify/knowledge/integrate-knowledge-within-application')}
           >
             <span>{t('list.learnMore', { ns: 'datasetDocuments' })}</span>
-            <RiExternalLinkLine className="size-3" />
+            <span className="i-ri-external-link-line size-3" />
           </a>
         </div>
       </div>
@@ -164,17 +168,17 @@ const DocumentsHeader: FC<DocumentsHeaderProps> = ({
 
         {/* Right: Actions */}
         <div className="flex h-8! items-center justify-center gap-2">
-          {!isFreePlan && <AutoDisabledDocument datasetId={datasetId} />}
-          <IndexFailed datasetId={datasetId} />
+          {!isFreePlan && canEditDocument && <AutoDisabledDocument datasetId={datasetId} />}
+          {canEditDocument && <IndexFailed datasetId={datasetId} />}
           {!embeddingAvailable && (
             <StatusWithAction
               type="warning"
               description={t('embeddingModelNotAvailable', { ns: 'dataset' })}
             />
           )}
-          {embeddingAvailable && (
+          {embeddingAvailable && canManageMetadata && (
             <Button variant="secondary" className="shrink-0" onClick={showEditMetadataModal}>
-              <RiDraftLine className="mr-1 size-4" />
+              <span className="mr-1 i-ri-draft-line size-4" />
               {t('metadata.metadata', { ns: 'dataset' })}
             </Button>
           )}
@@ -190,9 +194,9 @@ const DocumentsHeader: FC<DocumentsHeaderProps> = ({
               onIsBuiltInEnabledChange={onBuiltInEnabledChange}
             />
           )}
-          {embeddingAvailable && (
+          {embeddingAvailable && canAddDocument && (
             <Button variant="primary" onClick={onAddDocument} className="shrink-0">
-              <PlusIcon className="mr-2 size-4 stroke-current" />
+              <span className="mr-2 i-heroicons-plus-solid size-4 stroke-current" />
               {addButtonText}
             </Button>
           )}
diff --git a/web/app/components/datasets/documents/components/empty-element.tsx b/web/app/components/datasets/documents/components/empty-element.tsx
index 506b8ab6dbb..af035622ee0 100644
--- a/web/app/components/datasets/documents/components/empty-element.tsx
+++ b/web/app/components/datasets/documents/components/empty-element.tsx
@@ -12,7 +12,7 @@ type EmptyElementProps = {
   type?: 'upload' | 'sync'
 }
 
-const EmptyElement: FC<EmptyElementProps> = ({ canAdd = true, onClick, type = 'upload' }) => {
+const EmptyElement: FC<EmptyElementProps> = ({ canAdd = false, onClick, type = 'upload' }) => {
   const { t } = useTranslation()
   return (
     <div className={s.emptyWrapper}>
diff --git a/web/app/components/datasets/documents/components/list.tsx b/web/app/components/datasets/documents/components/list.tsx
index 4144cad169c..ef965554b9c 100644
--- a/web/app/components/datasets/documents/components/list.tsx
+++ b/web/app/components/datasets/documents/components/list.tsx
@@ -8,8 +8,10 @@ import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import EditMetadataBatchModal from '@/app/components/datasets/metadata/edit-metadata-batch/modal'
 import useBatchEditDocumentMetadata from '@/app/components/datasets/metadata/hooks/use-batch-edit-document-metadata'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector as useDatasetDetailContext } from '@/context/dataset-detail'
 import { ChunkingMode, DocumentActionType } from '@/models/datasets'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import BatchAction from '../detail/completed/common/batch-action'
 import s from '../style.module.css'
 import { DocumentTableRow, SortHeader } from './document-list/components'
@@ -59,6 +61,13 @@ const DocumentList = ({
   const pageSize = pagination.limit ?? 10
   const totalPages = Math.max(Math.ceil(pagination.total / pageSize), 1)
   const datasetConfig = useDatasetDetailContext(s => s.dataset)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const datasetACLCapabilities = useMemo(() => getDatasetACLCapabilities(datasetConfig?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: datasetConfig?.maintainer,
+    workspacePermissionKeys,
+  }), [datasetConfig?.maintainer, datasetConfig?.permission_keys, currentUserId, workspacePermissionKeys])
   const chunkingMode = datasetConfig?.doc_form
   const isGeneralMode = chunkingMode !== ChunkingMode.parentChild
   const isQAMode = chunkingMode === ChunkingMode.qa
@@ -194,14 +203,14 @@ const DocumentList = ({
         <BatchAction
           className="absolute bottom-16 left-0 z-20"
           selectedIds={selectedIds}
-          onArchive={handleAction(DocumentActionType.archive)}
-          onBatchSummary={handleAction(DocumentActionType.summary)}
-          onBatchEnable={handleAction(DocumentActionType.enable)}
-          onBatchDisable={handleAction(DocumentActionType.disable)}
-          onBatchDownload={downloadableSelectedIds.length > 0 ? handleBatchDownload : undefined}
-          onBatchDelete={handleAction(DocumentActionType.delete)}
-          onEditMetadata={showEditModal}
-          onBatchReIndex={hasErrorDocumentsSelected ? handleBatchReIndex : undefined}
+          onArchive={datasetACLCapabilities.canEdit ? handleAction(DocumentActionType.archive) : undefined}
+          onBatchSummary={datasetACLCapabilities.canEdit ? handleAction(DocumentActionType.summary) : undefined}
+          onBatchEnable={datasetACLCapabilities.canEdit ? handleAction(DocumentActionType.enable) : undefined}
+          onBatchDisable={datasetACLCapabilities.canEdit ? handleAction(DocumentActionType.disable) : undefined}
+          onBatchDownload={datasetACLCapabilities.canDocumentDownload && downloadableSelectedIds.length > 0 ? handleBatchDownload : undefined}
+          onBatchDelete={datasetACLCapabilities.canDeleteFile ? handleAction(DocumentActionType.delete) : undefined}
+          onEditMetadata={datasetACLCapabilities.canEdit ? showEditModal : undefined}
+          onBatchReIndex={datasetACLCapabilities.canEdit && hasErrorDocumentsSelected ? handleBatchReIndex : undefined}
           onCancel={clearSelection}
         />
       )}
diff --git a/web/app/components/datasets/documents/components/operations.tsx b/web/app/components/datasets/documents/components/operations.tsx
index 2f6425d880a..c821211da09 100644
--- a/web/app/components/datasets/documents/components/operations.tsx
+++ b/web/app/components/datasets/documents/components/operations.tsx
@@ -51,8 +51,25 @@ type OperationsProps = {
   onUpdate: (operationName?: string) => void
   scene?: 'list' | 'detail'
   className?: string
+  canEdit: boolean
+  canDownload: boolean
+  canDelete: boolean
+  canViewSettings: boolean
 }
-const Operations = ({ embeddingAvailable, datasetId, detail, selectedIds, onSelectedIdChange, onUpdate, scene = 'list', className = '' }: OperationsProps) => {
+const Operations = ({
+  embeddingAvailable,
+  datasetId,
+  detail,
+  selectedIds,
+  onSelectedIdChange,
+  onUpdate,
+  scene = 'list',
+  className = '',
+  canEdit,
+  canDownload,
+  canDelete,
+  canViewSettings,
+}: OperationsProps) => {
   const { id, name, enabled = false, archived = false, data_source_type, display_status } = detail || {}
   const [showModal, setShowModal] = useState(false)
   const [isOperationsMenuOpen, setIsOperationsMenuOpen] = useState(false)
@@ -71,7 +88,29 @@ const Operations = ({ embeddingAvailable, datasetId, detail, selectedIds, onSele
   const { mutateAsync: pauseDocument } = useDocumentPause()
   const { mutateAsync: resumeDocument } = useDocumentResume()
   const isListScene = scene === 'list'
+  const canShowRenameAction = canEdit && !archived
+  const canShowSummaryAction = canEdit && !archived && IS_CE_EDITION
+  const canShowSettingsAction = canViewSettings
+  const canShowDownloadAction = canDownload && data_source_type === DataSourceType.FILE
+  const canShowSyncAction = canEdit && !archived && ['notion_import', DataSourceType.WEB].includes(data_source_type)
+  const canShowPauseAction = canEdit && !archived && display_status?.toLowerCase() === 'indexing'
+  const canShowResumeAction = canEdit && !archived && display_status?.toLowerCase() === 'paused'
+  const canShowArchiveAction = canEdit && !archived
+  const canShowUnarchiveAction = canEdit && archived
+  const canShowDeleteAction = canDelete
+  const canShowPrimarySection = canShowRenameAction || canShowSummaryAction || canShowSettingsAction || canShowDownloadAction || canShowSyncAction
+  const canShowStatusSection = canShowPauseAction || canShowResumeAction || canShowArchiveAction || canShowUnarchiveAction
+  const hasOperationsMenu = embeddingAvailable && (canShowPrimarySection || canShowStatusSection || canShowDeleteAction)
+  const canOperate = useCallback((operationName: OperationName) => {
+    if (operationName === DocumentActionType.delete)
+      return canDelete
+
+    return canEdit
+  }, [canDelete, canEdit])
   const onOperate = useCallback(async (operationName: OperationName) => {
+    if (!canOperate(operationName))
+      return
+
     let opApi
     switch (operationName) {
       case 'archive':
@@ -121,6 +160,7 @@ const Operations = ({ embeddingAvailable, datasetId, detail, selectedIds, onSele
       setDeleting(false)
   }, [
     archiveDocument,
+    canOperate,
     data_source_type,
     datasetId,
     deleteDocument,
@@ -139,6 +179,8 @@ const Operations = ({ embeddingAvailable, datasetId, detail, selectedIds, onSele
     unArchiveDocument,
   ])
   const { run: handleSwitch } = useDebounceFn((operationName: OperationName) => {
+    if (!canEdit)
+      return
     if (operationName === DocumentActionType.enable && enabled)
       return
     if (operationName === DocumentActionType.disable && !enabled)
@@ -154,16 +196,24 @@ const Operations = ({ embeddingAvailable, datasetId, detail, selectedIds, onSele
     id: string
     name: string
   }) => {
+    if (!canEdit)
+      return
+
     setCurrDocument(doc)
     setShowRenameModalTrue()
-  }, [setShowRenameModalTrue])
+  }, [canEdit, setShowRenameModalTrue])
   const handleRenamed = useCallback(() => {
     onUpdate()
   }, [onUpdate])
   const closeOperationsMenu = useCallback(() => {
     setIsOperationsMenuOpen(false)
   }, [])
+  const stopPropagation = useCallback((e: React.SyntheticEvent) => {
+    e.stopPropagation()
+  }, [])
   const handleDownload = useCallback(async () => {
+    if (!canDownload)
+      return
     // Avoid repeated clicks while the signed URL request is in-flight.
     if (isDownloading)
       return
@@ -175,7 +225,7 @@ const Operations = ({ embeddingAvailable, datasetId, detail, selectedIds, onSele
     }
     // Trigger download without navigating away (helps avoid duplicate downloads in some browsers).
     downloadUrl({ url: res.url, fileName: name })
-  }, [datasetId, downloadDocument, id, isDownloading, name, t])
+  }, [canDownload, datasetId, downloadDocument, id, isDownloading, name, t])
   const handleShowRename = useCallback(() => {
     closeOperationsMenu()
     handleShowRenameModal({
@@ -188,50 +238,68 @@ const Operations = ({ embeddingAvailable, datasetId, detail, selectedIds, onSele
     void onOperate(operationName)
   }, [closeOperationsMenu, onOperate])
   const handleDeleteClick = useCallback(() => {
+    if (!canDelete)
+      return
+
     closeOperationsMenu()
     setShowModal(true)
-  }, [closeOperationsMenu])
+  }, [canDelete, closeOperationsMenu])
   const handleDownloadClick = useCallback((evt: React.MouseEvent<HTMLElement>) => {
     evt.preventDefault()
     evt.stopPropagation()
     evt.nativeEvent.stopImmediatePropagation?.()
+    if (!canDownload)
+      return
+
     closeOperationsMenu()
     void handleDownload()
-  }, [closeOperationsMenu, handleDownload])
+  }, [canDownload, closeOperationsMenu, handleDownload])
   const menuActionClassName = cn(s.actionItem, 'border-none bg-transparent')
   const menuDeleteActionClassName = cn(menuActionClassName, s.deleteActionItem, 'group')
   const handleSettingsClick = useCallback((evt: React.MouseEvent<HTMLElement>) => {
     evt.preventDefault()
     evt.stopPropagation()
     evt.nativeEvent.stopImmediatePropagation?.()
+    if (!canViewSettings)
+      return
+
     closeOperationsMenu()
     router.push(`/datasets/${datasetId}/documents/${detail.id}/settings`)
-  }, [closeOperationsMenu, datasetId, detail.id, router])
+  }, [canViewSettings, closeOperationsMenu, datasetId, detail.id, router])
   const settingsMenuItem = (
     <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={handleSettingsClick}>
       <span aria-hidden className="i-ri-equalizer-2-line size-4 text-text-tertiary" />
       <span className={s.actionName}>{t('list.action.settings', { ns: 'datasetDocuments' })}</span>
     </button>
   )
+  const renderListSwitch = () => {
+    if (!canEdit)
+      return <Switch checked={archived ? false : enabled} onCheckedChange={noop} disabled={true} size="md" />
+
+    if (archived) {
+      return (
+        <Popover>
+          <PopoverTrigger nativeButton={false} openOnHover render={<div><Switch checked={false} onCheckedChange={noop} disabled={true} size="md" /></div>} />
+          <PopoverContent popupClassName="px-3 py-2 font-semibold system-xs-regular text-text-tertiary">
+            {t('list.action.enableWarning', { ns: 'datasetDocuments' })}
+          </PopoverContent>
+        </Popover>
+      )
+    }
+
+    return <Switch checked={enabled} onCheckedChange={v => handleSwitch(v ? 'enable' : 'disable')} size="md" />
+  }
+
   return (
-    <div className="flex items-center" onClick={e => e.stopPropagation()}>
+    <div className="flex items-center" role="presentation" onClick={stopPropagation} onKeyDown={stopPropagation}>
       {isListScene && !embeddingAvailable && (<Switch checked={false} onCheckedChange={noop} disabled={true} size="md" />)}
       {isListScene && embeddingAvailable && (
         <>
-          {archived
-            ? (
-                <Popover>
-                  <PopoverTrigger nativeButton={false} openOnHover render={<div><Switch checked={false} onCheckedChange={noop} disabled={true} size="md" /></div>} />
-                  <PopoverContent popupClassName="px-3 py-2 font-semibold system-xs-regular text-text-tertiary">
-                    {t('list.action.enableWarning', { ns: 'datasetDocuments' })}
-                  </PopoverContent>
-                </Popover>
-              )
-            : <Switch checked={enabled} onCheckedChange={v => handleSwitch(v ? 'enable' : 'disable')} size="md" />}
-          <Divider className="mr-2! ml-4! h-3!" type="vertical" />
+          {renderListSwitch()}
+          {hasOperationsMenu && <Divider className="mr-2! ml-4! h-3!" type="vertical" />}
         </>
       )}
-      {embeddingAvailable && (
+      {hasOperationsMenu && (
         <>
           <DropdownMenu open={isOperationsMenuOpen} onOpenChange={setIsOperationsMenuOpen}>
             <DropdownMenuTrigger
@@ -258,74 +326,66 @@ const Operations = ({ embeddingAvailable, datasetId, detail, selectedIds, onSele
               popupClassName={cn('w-[200px] py-0', className)}
             >
               <div className="w-full py-1">
-                {!archived && (
+                {canShowPrimarySection && (
                   <>
-                    <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={handleShowRename}>
-                      <span aria-hidden className="i-ri-edit-line size-4 text-text-tertiary" />
-                      <span className={s.actionName}>{t('list.table.rename', { ns: 'datasetDocuments' })}</span>
-                    </button>
-                    {IS_CE_EDITION && (
+                    {canShowRenameAction && (
+                      <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={handleShowRename}>
+                        <span aria-hidden className="i-ri-edit-line size-4 text-text-tertiary" />
+                        <span className={s.actionName}>{t('list.table.rename', { ns: 'datasetDocuments' })}</span>
+                      </button>
+                    )}
+                    {canShowSummaryAction && (
                       <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={() => handleMenuOperation('summary')}>
                         <span aria-hidden className="i-custom-vender-knowledge-search-lines-sparkle size-4 text-text-tertiary" />
                         <span className={s.actionName}>{t('list.action.summary', { ns: 'datasetDocuments' })}</span>
                       </button>
                     )}
-                    {settingsMenuItem}
-                    {data_source_type === DataSourceType.FILE && (
+                    {canShowSettingsAction && settingsMenuItem}
+                    {canShowDownloadAction && (
                       <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={handleDownloadClick}>
                         <span aria-hidden className="i-ri-download-2-line size-4 text-text-tertiary" />
                         <span className={s.actionName}>{t('list.action.download', { ns: 'datasetDocuments' })}</span>
                       </button>
                     )}
-                    {['notion_import', DataSourceType.WEB].includes(data_source_type) && (
+                    {canShowSyncAction && (
                       <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={() => handleMenuOperation('sync')}>
                         <span aria-hidden className="i-ri-loop-left-line size-4 text-text-tertiary" />
                         <span className={s.actionName}>{t('list.action.sync', { ns: 'datasetDocuments' })}</span>
                       </button>
                     )}
-                    <Divider className="my-1" />
+                    {(canShowStatusSection || canShowDeleteAction) && <Divider className="my-1" />}
                   </>
                 )}
-                {archived && (
-                  <>
-                    {settingsMenuItem}
-                    {data_source_type === DataSourceType.FILE && (
-                      <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={handleDownloadClick}>
-                        <span aria-hidden className="i-ri-download-2-line size-4 text-text-tertiary" />
-                        <span className={s.actionName}>{t('list.action.download', { ns: 'datasetDocuments' })}</span>
-                      </button>
-                    )}
-                    <Divider className="my-1" />
-                  </>
-                )}
-                {!archived && display_status?.toLowerCase() === 'indexing' && (
+                {canShowPauseAction && (
                   <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={() => handleMenuOperation('pause')}>
                     <span aria-hidden className="i-ri-pause-circle-line size-4 text-text-tertiary" />
                     <span className={s.actionName}>{t('list.action.pause', { ns: 'datasetDocuments' })}</span>
                   </button>
                 )}
-                {!archived && display_status?.toLowerCase() === 'paused' && (
+                {canShowResumeAction && (
                   <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={() => handleMenuOperation('resume')}>
                     <span aria-hidden className="i-ri-play-circle-line size-4 text-text-tertiary" />
                     <span className={s.actionName}>{t('list.action.resume', { ns: 'datasetDocuments' })}</span>
                   </button>
                 )}
-                {!archived && (
+                {canShowArchiveAction && (
                   <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={() => handleMenuOperation('archive')}>
                     <span aria-hidden className="i-ri-archive-2-line size-4 text-text-tertiary" />
                     <span className={s.actionName}>{t('list.action.archive', { ns: 'datasetDocuments' })}</span>
                   </button>
                 )}
-                {archived && (
+                {canShowUnarchiveAction && (
                   <button type="button" className={cn(menuActionClassName, 'text-left')} onClick={() => handleMenuOperation('un_archive')}>
                     <span aria-hidden className="i-ri-archive-2-line size-4 text-text-tertiary" />
                     <span className={s.actionName}>{t('list.action.unarchive', { ns: 'datasetDocuments' })}</span>
                   </button>
                 )}
-                <button type="button" className={cn(menuDeleteActionClassName, 'text-left')} onClick={handleDeleteClick}>
-                  <span aria-hidden className="i-ri-delete-bin-line size-4 text-text-tertiary group-hover:text-text-destructive" />
-                  <span className={cn(s.actionName, 'group-hover:text-text-destructive')}>{t('list.action.delete', { ns: 'datasetDocuments' })}</span>
-                </button>
+                {canShowDeleteAction && (
+                  <button type="button" className={cn(menuDeleteActionClassName, 'text-left')} onClick={handleDeleteClick}>
+                    <span aria-hidden className="i-ri-delete-bin-line size-4 text-text-tertiary group-hover:text-text-destructive" />
+                    <span className={cn(s.actionName, 'group-hover:text-text-destructive')}>{t('list.action.delete', { ns: 'datasetDocuments' })}</span>
+                  </button>
+                )}
               </div>
             </DropdownMenuContent>
           </DropdownMenu>
diff --git a/web/app/components/datasets/documents/create-from-pipeline/__tests__/index.spec.tsx b/web/app/components/datasets/documents/create-from-pipeline/__tests__/index.spec.tsx
index ae1eb817b4c..b6ec26b923c 100644
--- a/web/app/components/datasets/documents/create-from-pipeline/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/documents/create-from-pipeline/__tests__/index.spec.tsx
@@ -4,7 +4,7 @@ import type { Node } from '@/app/components/workflow/types'
 import type { NotionPage } from '@/models/common'
 import type { CrawlResultItem, CustomFile, DocumentItem, FileItem } from '@/models/datasets'
 import type { InitialDocumentDetail, OnlineDriveFile } from '@/models/pipeline'
-import { act, fireEvent, render, renderHook, screen } from '@testing-library/react'
+import { act, fireEvent, render, renderHook, screen, waitFor } from '@testing-library/react'
 import * as React from 'react'
 import { BlockEnum } from '@/app/components/workflow/types'
 import { DatasourceType } from '@/models/pipeline'
@@ -19,6 +19,7 @@ import {
   useOnlineDrive,
   useWebsiteCrawl,
 } from '../hooks'
+import CreateFromPipeline from '../index'
 import { StepOneContent, StepThreeContent, StepTwoContent } from '../steps'
 import { StepOnePreview, StepTwoPreview } from '../steps/preview-panel'
 import {
@@ -37,11 +38,31 @@ const mockPlan = {
   type: 'professional',
 }
 
+let mockDatasetPermissionKeys = ['dataset.acl.use']
+const mockRouterReplace = vi.fn()
+
 vi.mock('@/context/provider-context', () => ({
   useProviderContextSelector: (selector: (state: { plan: typeof mockPlan, enableBilling: boolean }) => unknown) =>
     selector({ plan: mockPlan, enableBilling: true }),
 }))
 
+let mockCurrentUserId = 'user-1'
+let mockWorkspacePermissionKeys = ['dataset.create_and_management']
+let mockIsLoadingWorkspacePermissionKeys = false
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: {
+    userProfile: { id: string }
+    workspacePermissionKeys: string[]
+    isLoadingWorkspacePermissionKeys: boolean
+  }) => unknown) => {
+    return selector({
+      userProfile: { id: mockCurrentUserId },
+      workspacePermissionKeys: mockWorkspacePermissionKeys,
+      isLoadingWorkspacePermissionKeys: mockIsLoadingWorkspacePermissionKeys,
+    })
+  },
+}))
+
 vi.mock('@/service/use-billing', () => ({
   useCurrentPlanVectorSpace: () => ({
     data: {
@@ -53,8 +74,8 @@ vi.mock('@/service/use-billing', () => ({
 }))
 
 vi.mock('@/context/dataset-detail', () => ({
-  useDatasetDetailContextWithSelector: (selector: (state: { dataset: { pipeline_id: string } }) => unknown) =>
-    selector({ dataset: { pipeline_id: 'test-pipeline-id' } }),
+  useDatasetDetailContextWithSelector: (selector: (state: { dataset: { id: string, pipeline_id: string, permission_keys: string[] } }) => unknown) =>
+    selector({ dataset: { id: 'test-dataset-id', pipeline_id: 'test-pipeline-id', permission_keys: mockDatasetPermissionKeys } }),
 }))
 
 // Mock API services
@@ -104,7 +125,7 @@ vi.mock('@/next/navigation', () => ({
   useParams: () => ({ datasetId: 'test-dataset-id' }),
   useRouter: () => ({
     push: vi.fn(),
-    replace: vi.fn(),
+    replace: mockRouterReplace,
     back: vi.fn(),
   }),
   usePathname: () => '/datasets/test-dataset-id/documents/create-from-pipeline',
@@ -233,6 +254,26 @@ const createMockOnlineDriveFile = (overrides?: Partial<OnlineDriveFile>): Online
   ...overrides,
 } as OnlineDriveFile)
 
+beforeEach(() => {
+  mockDatasetPermissionKeys = ['dataset.acl.use']
+  mockCurrentUserId = 'user-1'
+  mockWorkspacePermissionKeys = ['dataset.create_and_management']
+  mockIsLoadingWorkspacePermissionKeys = false
+  mockRouterReplace.mockClear()
+})
+
+describe('CreateFromPipeline permission guard', () => {
+  it('should redirect when existing dataset cannot add documents', async () => {
+    mockDatasetPermissionKeys = ['dataset.acl.edit']
+
+    render(<CreateFromPipeline />)
+
+    await waitFor(() => {
+      expect(mockRouterReplace).toHaveBeenCalledWith('/datasets/test-dataset-id/documents')
+    })
+  })
+})
+
 // Hook Tests - useAddDocumentsSteps
 describe('useAddDocumentsSteps', () => {
   it('should initialize with step 1', () => {
diff --git a/web/app/components/datasets/documents/create-from-pipeline/hooks/__tests__/use-datasource-actions.spec.ts b/web/app/components/datasets/documents/create-from-pipeline/hooks/__tests__/use-datasource-actions.spec.ts
index 2328541cd1a..a1c38c683d3 100644
--- a/web/app/components/datasets/documents/create-from-pipeline/hooks/__tests__/use-datasource-actions.spec.ts
+++ b/web/app/components/datasets/documents/create-from-pipeline/hooks/__tests__/use-datasource-actions.spec.ts
@@ -201,4 +201,35 @@ describe('useDatasourceActions', () => {
       expect.anything(),
     )
   })
+
+  it('should not submit process form when processing is not allowed', () => {
+    const params = {
+      ...defaultParams(),
+      canProcess: false,
+    }
+    const submit = vi.fn()
+    const { result } = renderHook(() => useDatasourceActions(params))
+    result.current.formRef.current = { submit }
+
+    act(() => {
+      result.current.onClickProcess()
+    })
+
+    expect(submit).not.toHaveBeenCalled()
+  })
+
+  it('should not run published pipeline when processing is not allowed', () => {
+    const params = {
+      ...defaultParams(),
+      canProcess: false,
+    }
+    const { result } = renderHook(() => useDatasourceActions(params))
+
+    act(() => {
+      result.current.handleSubmit({ query: 'test' })
+    })
+
+    expect(mockRunPublishedPipeline).not.toHaveBeenCalled()
+    expect(params.handleNextStep).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/app/components/datasets/documents/create-from-pipeline/hooks/use-datasource-actions.ts b/web/app/components/datasets/documents/create-from-pipeline/hooks/use-datasource-actions.ts
index ae6472118c7..a0ac69bd1ab 100644
--- a/web/app/components/datasets/documents/create-from-pipeline/hooks/use-datasource-actions.ts
+++ b/web/app/components/datasets/documents/create-from-pipeline/hooks/use-datasource-actions.ts
@@ -34,6 +34,7 @@ type DatasourceActionsParams = {
   clearWebsiteCrawlData: () => void
   clearOnlineDriveData: () => void
   setDatasource: (ds: Datasource) => void
+  canProcess?: boolean
 }
 
 /**
@@ -54,6 +55,7 @@ export const useDatasourceActions = ({
   clearWebsiteCrawlData,
   clearOnlineDriveData,
   setDatasource,
+  canProcess = true,
 }: DatasourceActionsParams) => {
   const isPreview = useRef(false)
   const formRef = useRef<{ submit: () => void } | null>(null)
@@ -170,6 +172,9 @@ export const useDatasourceActions = ({
 
   // Handle document processing
   const handleProcess = useCallback(async (data: Record<string, unknown>) => {
+    if (!canProcess)
+      return
+
     if (!datasource || !pipelineId)
       return
 
@@ -192,13 +197,16 @@ export const useDatasourceActions = ({
         })
       },
     })
-  }, [datasource, pipelineId, datasourceType, buildProcessDatasourceInfo, runPublishedPipeline, setBatchId, setDocuments, handleNextStep])
+  }, [canProcess, datasource, pipelineId, datasourceType, buildProcessDatasourceInfo, runPublishedPipeline, setBatchId, setDocuments, handleNextStep])
 
   // Form submission handlers
   const onClickProcess = useCallback(() => {
+    if (!canProcess)
+      return
+
     isPreview.current = false
     formRef.current?.submit()
-  }, [])
+  }, [canProcess])
 
   const onClickPreview = useCallback(() => {
     isPreview.current = true
diff --git a/web/app/components/datasets/documents/create-from-pipeline/index.tsx b/web/app/components/datasets/documents/create-from-pipeline/index.tsx
index 07843217eff..d83e9ae501d 100644
--- a/web/app/components/datasets/documents/create-from-pipeline/index.tsx
+++ b/web/app/components/datasets/documents/create-from-pipeline/index.tsx
@@ -5,16 +5,19 @@ import type { Node } from '@/app/components/workflow/types'
 import type { FileIndexingEstimateResponse } from '@/models/datasets'
 import type { InitialDocumentDetail } from '@/models/pipeline'
 import { useBoolean } from 'ahooks'
-import { useCallback, useMemo, useState } from 'react'
+import { useCallback, useEffect, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Loading from '@/app/components/base/loading'
 import { PlanUpgradeModal } from '@/app/components/billing/plan-upgrade-modal'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import { useProviderContextSelector } from '@/context/provider-context'
 import { DatasourceType } from '@/models/pipeline'
+import { useRouter } from '@/next/navigation'
 import { useCurrentPlanVectorSpace } from '@/service/use-billing'
 import { useFileUploadConfig } from '@/service/use-common'
 import { usePublishedPipelineInfo } from '@/service/use-pipeline'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import { useDataSourceStore } from './data-source/store'
 import DataSourceProvider from './data-source/store/provider'
 import {
@@ -32,10 +35,23 @@ import { StepOnePreview, StepTwoPreview } from './steps/preview-panel'
 
 const CreateFormPipeline = () => {
   const { t } = useTranslation()
+  const router = useRouter()
   const plan = useProviderContextSelector(state => state.plan)
   const enableBilling = useProviderContextSelector(state => state.enableBilling)
-  const pipelineId = useDatasetDetailContextWithSelector(s => s.dataset?.pipeline_id)
+  const dataset = useDatasetDetailContextWithSelector(s => s.dataset)
+  const pipelineId = dataset?.pipeline_id
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const isLoadingWorkspacePermissionKeys = useAppContextWithSelector(state => state.isLoadingWorkspacePermissionKeys)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const dataSourceStore = useDataSourceStore()
+  const canAddDocumentsToDataset = getDatasetACLCapabilities(dataset?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset?.maintainer,
+    workspacePermissionKeys,
+  }).canUse
+  const shouldRedirectToDocuments = !!dataset
+    && !isLoadingWorkspacePermissionKeys
+    && !canAddDocumentsToDataset
 
   // Core state
   const [datasource, setDatasource] = useState<Datasource>()
@@ -187,11 +203,20 @@ const CreateFormPipeline = () => {
     clearWebsiteCrawlData,
     clearOnlineDriveData,
     setDatasource,
+    canProcess: canAddDocumentsToDataset,
   })
 
+  useEffect(() => {
+    if (shouldRedirectToDocuments && dataset?.id)
+      router.replace(`/datasets/${dataset.id}/documents`)
+  }, [dataset, router, shouldRedirectToDocuments])
+
   if (isFetchingPipelineInfo)
     return <Loading type="app" />
 
+  if (isLoadingWorkspacePermissionKeys || shouldRedirectToDocuments)
+    return <Loading type="app" />
+
   return (
     <div className="relative flex h-[calc(100vh-56px)] w-full min-w-[1024px] overflow-x-auto rounded-t-2xl border-t border-effects-highlight bg-background-default-subtle">
       <div className="h-full min-w-0 flex-1">
diff --git a/web/app/components/datasets/documents/detail/__tests__/index.spec.tsx b/web/app/components/datasets/documents/detail/__tests__/index.spec.tsx
index e8946ce5842..ebbd6ef4a2a 100644
--- a/web/app/components/datasets/documents/detail/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/documents/detail/__tests__/index.spec.tsx
@@ -1,10 +1,11 @@
 import { act, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { DatasetACLPermission } from '@/utils/permission'
 
 // --- All hoisted mock fns and state (accessible inside vi.mock factories) ---
 const mocks = vi.hoisted(() => {
   const state = {
-    dataset: { embedding_available: true } as Record<string, unknown> | null,
+    dataset: { embedding_available: true, permission_keys: ['dataset.acl.edit'] } as Record<string, unknown> | null,
     documentDetail: null as Record<string, unknown> | null,
     documentError: null as Error | null,
     documentMetadata: null as Record<string, unknown> | null,
@@ -156,8 +157,8 @@ vi.mock('../../status-item', () => ({
 }))
 
 vi.mock('@/app/components/datasets/metadata/metadata-document', () => ({
-  default: ({ datasetId, documentId }: { datasetId?: string, documentId?: string }) => (
-    <div data-testid="metadata" data-dataset-id={datasetId} data-document-id={documentId}>Metadata</div>
+  default: ({ datasetId, documentId, canEdit }: { datasetId?: string, documentId?: string, canEdit?: boolean }) => (
+    <div data-testid="metadata" data-dataset-id={datasetId} data-document-id={documentId} data-can-edit={String(canEdit)}>Metadata</div>
   ),
 }))
 
@@ -195,7 +196,7 @@ describe('DocumentDetail', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     vi.useFakeTimers()
-    mocks.state.dataset = { embedding_available: true }
+    mocks.state.dataset = { embedding_available: true, permission_keys: [DatasetACLPermission.Edit] }
     mocks.state.documentDetail = createDocumentDetail()
     mocks.state.documentError = null
     mocks.state.documentMetadata = null
@@ -284,6 +285,12 @@ describe('DocumentDetail', () => {
       render(<DocumentDetail datasetId="ds-1" documentId="doc-1" />)
       expect(screen.queryByTestId('segment-add')).not.toBeInTheDocument()
     })
+
+    it('should hide SegmentAdd when dataset only has readonly ACL permission', () => {
+      mocks.state.dataset = { embedding_available: true, permission_keys: [DatasetACLPermission.Readonly] }
+      render(<DocumentDetail datasetId="ds-1" documentId="doc-1" />)
+      expect(screen.queryByTestId('segment-add')).not.toBeInTheDocument()
+    })
   })
 
   describe('Metadata Panel', () => {
@@ -316,6 +323,14 @@ describe('DocumentDetail', () => {
       const metadata = screen.getByTestId('metadata')
       expect(metadata).toHaveAttribute('data-dataset-id', 'ds-1')
       expect(metadata).toHaveAttribute('data-document-id', 'doc-1')
+      expect(metadata).toHaveAttribute('data-can-edit', 'true')
+    })
+
+    it('should pass readonly ACL state to Metadata', () => {
+      mocks.state.dataset = { embedding_available: true, permission_keys: [DatasetACLPermission.Readonly] }
+      render(<DocumentDetail datasetId="ds-1" documentId="doc-1" />)
+
+      expect(screen.getByTestId('metadata')).toHaveAttribute('data-can-edit', 'false')
     })
   })
 
diff --git a/web/app/components/datasets/documents/detail/completed/common/batch-action.tsx b/web/app/components/datasets/documents/detail/completed/common/batch-action.tsx
index f0913405c42..9d1354d045d 100644
--- a/web/app/components/datasets/documents/detail/completed/common/batch-action.tsx
+++ b/web/app/components/datasets/documents/detail/completed/common/batch-action.tsx
@@ -22,10 +22,10 @@ const i18nPrefix = 'batchAction'
 type IBatchActionProps = {
   className?: string
   selectedIds: string[]
-  onBatchEnable: () => void
-  onBatchDisable: () => void
+  onBatchEnable?: () => void
+  onBatchDisable?: () => void
   onBatchDownload?: () => void
-  onBatchDelete: () => Promise<void>
+  onBatchDelete?: () => Promise<void>
   onBatchSummary?: () => void
   onArchive?: () => void
   onEditMetadata?: () => void
@@ -56,6 +56,9 @@ const BatchAction: FC<IBatchActionProps> = ({
   }] = useBoolean(false)
 
   const handleBatchDelete = async () => {
+    if (!onBatchDelete)
+      return
+
     setIsDeleting()
     await onBatchDelete()
     hideDeleteConfirm()
@@ -70,22 +73,26 @@ const BatchAction: FC<IBatchActionProps> = ({
           <span className="system-sm-semibold text-text-accent">{t(`${i18nPrefix}.selected`, { ns: 'dataset' })}</span>
         </div>
         <Divider type="vertical" className="mx-0.5 h-3.5 bg-divider-regular" />
-        <Button
-          variant="ghost"
-          className="gap-x-0.5 px-3"
-          onClick={onBatchEnable}
-        >
-          <RiCheckboxCircleLine className="size-4" />
-          <span className="px-0.5">{t(`${i18nPrefix}.enable`, { ns: 'dataset' })}</span>
-        </Button>
-        <Button
-          variant="ghost"
-          className="gap-x-0.5 px-3"
-          onClick={onBatchDisable}
-        >
-          <RiCloseCircleLine className="size-4" />
-          <span className="px-0.5">{t(`${i18nPrefix}.disable`, { ns: 'dataset' })}</span>
-        </Button>
+        {onBatchEnable && (
+          <Button
+            variant="ghost"
+            className="gap-x-0.5 px-3"
+            onClick={onBatchEnable}
+          >
+            <RiCheckboxCircleLine className="size-4" />
+            <span className="px-0.5">{t(`${i18nPrefix}.enable`, { ns: 'dataset' })}</span>
+          </Button>
+        )}
+        {onBatchDisable && (
+          <Button
+            variant="ghost"
+            className="gap-x-0.5 px-3"
+            onClick={onBatchDisable}
+          >
+            <RiCloseCircleLine className="size-4" />
+            <span className="px-0.5">{t(`${i18nPrefix}.disable`, { ns: 'dataset' })}</span>
+          </Button>
+        )}
         {onEditMetadata && (
           <Button
             variant="ghost"
@@ -136,15 +143,17 @@ const BatchAction: FC<IBatchActionProps> = ({
             <span className="px-0.5">{t(`${i18nPrefix}.download`, { ns: 'dataset' })}</span>
           </Button>
         )}
-        <Button
-          variant="ghost"
-          tone="destructive"
-          className="gap-x-0.5 px-3"
-          onClick={showDeleteConfirm}
-        >
-          <RiDeleteBinLine className="size-4" />
-          <span className="px-0.5">{t(`${i18nPrefix}.delete`, { ns: 'dataset' })}</span>
-        </Button>
+        {onBatchDelete && (
+          <Button
+            variant="ghost"
+            tone="destructive"
+            className="gap-x-0.5 px-3"
+            onClick={showDeleteConfirm}
+          >
+            <RiDeleteBinLine className="size-4" />
+            <span className="px-0.5">{t(`${i18nPrefix}.delete`, { ns: 'dataset' })}</span>
+          </Button>
+        )}
 
         <Divider type="vertical" className="mx-0.5 h-3.5 bg-divider-regular" />
         <Button
@@ -155,24 +164,26 @@ const BatchAction: FC<IBatchActionProps> = ({
           <span className="px-0.5">{t(`${i18nPrefix}.cancel`, { ns: 'dataset' })}</span>
         </Button>
       </div>
-      <AlertDialog open={isShowDeleteConfirm} onOpenChange={open => !open && hideDeleteConfirm()}>
-        <AlertDialogContent>
-          <div className="flex flex-col gap-2 px-6 pt-6 pb-4">
-            <AlertDialogTitle className="w-full truncate title-2xl-semi-bold text-text-primary">
-              {t('list.delete.title', { ns: 'datasetDocuments' })}
-            </AlertDialogTitle>
-            <AlertDialogDescription className="w-full system-md-regular wrap-break-word whitespace-pre-wrap text-text-tertiary">
-              {t('list.delete.content', { ns: 'datasetDocuments' })}
-            </AlertDialogDescription>
-          </div>
-          <AlertDialogActions>
-            <AlertDialogCancelButton>{t('operation.cancel', { ns: 'common' })}</AlertDialogCancelButton>
-            <AlertDialogConfirmButton loading={isDeleting} disabled={isDeleting} onClick={handleBatchDelete}>
-              {t('operation.sure', { ns: 'common' })}
-            </AlertDialogConfirmButton>
-          </AlertDialogActions>
-        </AlertDialogContent>
-      </AlertDialog>
+      {onBatchDelete && (
+        <AlertDialog open={isShowDeleteConfirm} onOpenChange={open => !open && hideDeleteConfirm()}>
+          <AlertDialogContent>
+            <div className="flex flex-col gap-2 px-6 pt-6 pb-4">
+              <AlertDialogTitle className="w-full truncate title-2xl-semi-bold text-text-primary">
+                {t('list.delete.title', { ns: 'datasetDocuments' })}
+              </AlertDialogTitle>
+              <AlertDialogDescription className="w-full system-md-regular wrap-break-word whitespace-pre-wrap text-text-tertiary">
+                {t('list.delete.content', { ns: 'datasetDocuments' })}
+              </AlertDialogDescription>
+            </div>
+            <AlertDialogActions>
+              <AlertDialogCancelButton>{t('operation.cancel', { ns: 'common' })}</AlertDialogCancelButton>
+              <AlertDialogConfirmButton loading={isDeleting} disabled={isDeleting} onClick={handleBatchDelete}>
+                {t('operation.sure', { ns: 'common' })}
+              </AlertDialogConfirmButton>
+            </AlertDialogActions>
+          </AlertDialogContent>
+        </AlertDialog>
+      )}
     </div>
   )
 }
diff --git a/web/app/components/datasets/documents/detail/completed/common/drawer.tsx b/web/app/components/datasets/documents/detail/completed/common/drawer.tsx
index 86c40a73677..dac3cef9f2d 100644
--- a/web/app/components/datasets/documents/detail/completed/common/drawer.tsx
+++ b/web/app/components/datasets/documents/detail/completed/common/drawer.tsx
@@ -1,4 +1,4 @@
-import type { ComponentProps, ReactNode } from 'react'
+import type { ReactNode } from 'react'
 import { cn } from '@langgenius/dify-ui/cn'
 import {
   Drawer,
@@ -11,7 +11,6 @@ import {
 
 type DrawerSide = 'right' | 'left' | 'bottom' | 'top'
 type DrawerSwipeDirection = 'right' | 'left' | 'down' | 'up'
-type DrawerOpenChange = NonNullable<ComponentProps<typeof Drawer>['onOpenChange']>
 
 type CompletedDrawerProps = {
   open: boolean
@@ -47,16 +46,6 @@ export function CompletedDrawer({
   panelContentClassName,
   modal = false,
 }: CompletedDrawerProps) {
-  const handleOpenChange: DrawerOpenChange = (nextOpen, eventDetails) => {
-    if (nextOpen)
-      return
-
-    if (eventDetails.reason === 'focus-out' || eventDetails.reason === 'outside-press')
-      return
-
-    onClose()
-  }
-
   if (!open)
     return null
 
@@ -66,7 +55,7 @@ export function CompletedDrawer({
       modal={modal}
       swipeDirection={SIDE_TO_SWIPE_DIRECTION[side]}
       disablePointerDismissal
-      onOpenChange={handleOpenChange}
+      onOpenChange={nextOpen => !nextOpen && onClose()}
     >
       <DrawerPortal>
         {modal && (
diff --git a/web/app/components/datasets/documents/detail/index.tsx b/web/app/components/datasets/documents/detail/index.tsx
index c0c9629bfd6..1d7ad17d07e 100644
--- a/web/app/components/datasets/documents/detail/index.tsx
+++ b/web/app/components/datasets/documents/detail/index.tsx
@@ -11,6 +11,7 @@ import Divider from '@/app/components/base/divider'
 import FloatRightContainer from '@/app/components/base/float-right-container'
 import Loading from '@/app/components/base/loading'
 import Metadata from '@/app/components/datasets/metadata/metadata-document'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
 import { ChunkingMode, DisplayStatusList } from '@/models/datasets'
@@ -19,6 +20,7 @@ import { useDocumentDetail, useDocumentMetadata, useInvalidDocumentList } from '
 import { useCheckSegmentBatchImportProgress, useChildSegmentListKey, useSegmentBatchImport, useSegmentListKey } from '@/service/knowledge/use-segment'
 import { useInvalid } from '@/service/use-base'
 import { segmentImportStatus } from '@/types/dataset'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import Operations from '../components/operations'
 import StatusItem from '../status-item'
 import BatchModal from './batch-modal'
@@ -47,7 +49,18 @@ const DocumentDetail: FC<DocumentDetailProps> = ({ datasetId, documentId }) => {
   const isMobile = media === MediaType.mobile
 
   const dataset = useDatasetDetailContextWithSelector(s => s.dataset)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const embeddingAvailable = !!dataset?.embedding_available
+  const datasetACLCapabilities = useMemo(
+    () => getDatasetACLCapabilities(dataset?.permission_keys, {
+      currentUserId,
+      resourceMaintainer: dataset?.maintainer,
+      workspacePermissionKeys,
+    }),
+    [dataset?.maintainer, dataset?.permission_keys, currentUserId, workspacePermissionKeys],
+  )
+  const canEditDocument = datasetACLCapabilities.canEdit
   const [showMetadata, setShowMetadata] = useState(!isMobile)
   const [newSegmentModalVisible, setNewSegmentModalVisible] = useState(false)
   const [batchModalVisible, setBatchModalVisible] = useState(false)
@@ -205,7 +218,7 @@ const DocumentDetail: FC<DocumentDetailProps> = ({ datasetId, documentId }) => {
             parentMode={parentMode}
           />
           <div className="flex flex-wrap items-center">
-            {embeddingAvailable && documentDetail && !documentDetail.archived && !isFullDocMode && (
+            {embeddingAvailable && canEditDocument && documentDetail && !documentDetail.archived && !isFullDocMode && (
               <>
                 <SegmentAdd
                   importStatus={importStatus}
@@ -226,6 +239,7 @@ const DocumentDetail: FC<DocumentDetailProps> = ({ datasetId, documentId }) => {
                 detail={statusDetail}
                 datasetId={datasetId}
                 onUpdate={handleOperate}
+                canEdit={canEditDocument}
               />
             )}
             <Operations
@@ -235,6 +249,10 @@ const DocumentDetail: FC<DocumentDetailProps> = ({ datasetId, documentId }) => {
               datasetId={datasetId}
               onUpdate={handleOperate}
               className="w-[200px]!"
+              canEdit={canEditDocument}
+              canDownload={datasetACLCapabilities.canDocumentDownload}
+              canDelete={datasetACLCapabilities.canDeleteFile}
+              canViewSettings={canEditDocument}
             />
             <button
               type="button"
@@ -283,6 +301,7 @@ const DocumentDetail: FC<DocumentDetailProps> = ({ datasetId, documentId }) => {
               datasetId={datasetId}
               documentId={documentId}
               docDetail={docDetail}
+              canEdit={canEditDocument}
             />
           </FloatRightContainer>
         </div>
diff --git a/web/app/components/datasets/documents/detail/metadata/__tests__/index.spec.tsx b/web/app/components/datasets/documents/detail/metadata/__tests__/index.spec.tsx
index ae06f1bb282..65725e62cde 100644
--- a/web/app/components/datasets/documents/detail/metadata/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/documents/detail/metadata/__tests__/index.spec.tsx
@@ -175,6 +175,7 @@ describe('Metadata', () => {
     docDetail: createMockDocDetail(),
     loading: false,
     onUpdate: vi.fn(),
+    canEdit: true,
   }
 
   describe('Rendering', () => {
@@ -196,6 +197,20 @@ describe('Metadata', () => {
       expect(screen.getByText(/operation\.edit/i))!.toBeInTheDocument()
     })
 
+    it('should hide edit button when canEdit is false', () => {
+      render(<Metadata {...defaultProps} canEdit={false} />)
+
+      expect(screen.queryByText(/operation\.edit/i)).not.toBeInTheDocument()
+    })
+
+    it('should hide edit button by default when canEdit is omitted', () => {
+      const { canEdit: _canEdit, ...propsWithoutCanEdit } = defaultProps
+
+      render(<Metadata {...propsWithoutCanEdit} />)
+
+      expect(screen.queryByText(/operation\.edit/i)).not.toBeInTheDocument()
+    })
+
     it('should show loading state', () => {
       render(<Metadata {...defaultProps} loading={true} />)
 
@@ -334,6 +349,17 @@ describe('Metadata', () => {
       expect(screen.getByText(/metadata\.docTypeSelectTitle/i))!.toBeInTheDocument()
     })
 
+    it('should keep doc type selection read-only when canEdit is false', () => {
+      const docDetail = createMockDocDetail({ doc_type: '' })
+
+      render(<Metadata {...defaultProps} docDetail={docDetail} canEdit={false} />)
+
+      expect(screen.queryByText(/metadata\.docTypeSelectTitle/i)).not.toBeInTheDocument()
+      expect(screen.queryByText(/metadata\.firstMetaAction/i)).not.toBeInTheDocument()
+      expect(screen.queryByText(/operation\.save/i)).not.toBeInTheDocument()
+      expect(mockModifyDocMetadata).not.toHaveBeenCalled()
+    })
+
     it('should show description when no doc_type exists', () => {
       const docDetail = createMockDocDetail({ doc_type: '' })
 
@@ -535,6 +561,7 @@ describe('useMetadataState coverage', () => {
     docDetail: createMockDocDetail(),
     loading: false,
     onUpdate: vi.fn(),
+    canEdit: true,
   }
 
   describe('cancelDocType', () => {
diff --git a/web/app/components/datasets/documents/detail/metadata/hooks/__tests__/use-metadata-state.spec.ts b/web/app/components/datasets/documents/detail/metadata/hooks/__tests__/use-metadata-state.spec.ts
index 2d5afcc3a99..9444095ba07 100644
--- a/web/app/components/datasets/documents/detail/metadata/hooks/__tests__/use-metadata-state.spec.ts
+++ b/web/app/components/datasets/documents/detail/metadata/hooks/__tests__/use-metadata-state.spec.ts
@@ -63,7 +63,7 @@ describe('useMetadataState', () => {
     const stableDocDetail = makeDoc()
 
     const { result } = renderHook(() =>
-      useMetadataState({ docDetail: stableDocDetail, onUpdate }), { wrapper })
+      useMetadataState({ docDetail: stableDocDetail, onUpdate, canEdit: true }), { wrapper })
 
     // --- Initialization ---
     expect(result.current.docType).toBe('book')
@@ -150,7 +150,7 @@ describe('useMetadataState', () => {
   // Verify empty doc type starts in editing mode
   it('should initialize in editing mode when no doc type exists', () => {
     const stableDocDetail = makeDoc({ doc_type: '' as FullDocumentDetail['doc_type'], doc_metadata: {} as FullDocumentDetail['doc_metadata'] })
-    const { result } = renderHook(() => useMetadataState({ docDetail: stableDocDetail }), { wrapper })
+    const { result } = renderHook(() => useMetadataState({ docDetail: stableDocDetail, canEdit: true }), { wrapper })
 
     expect(result.current.docType).toBe('')
     expect(result.current.editStatus).toBe(true)
@@ -167,7 +167,7 @@ describe('useMetadataState', () => {
 
   // Verify undefined docDetail handling
   it('should handle undefined docDetail gracefully', () => {
-    const { result } = renderHook(() => useMetadataState({ docDetail: undefined }), { wrapper })
+    const { result } = renderHook(() => useMetadataState({ docDetail: undefined, canEdit: true }), { wrapper })
 
     expect(result.current.docType).toBe('')
     expect(result.current.editStatus).toBe(true)
diff --git a/web/app/components/datasets/documents/detail/metadata/hooks/use-metadata-state.ts b/web/app/components/datasets/documents/detail/metadata/hooks/use-metadata-state.ts
index 7fc0c17cb05..2f45d0144e7 100644
--- a/web/app/components/datasets/documents/detail/metadata/hooks/use-metadata-state.ts
+++ b/web/app/components/datasets/documents/detail/metadata/hooks/use-metadata-state.ts
@@ -21,41 +21,62 @@ const normalizeDocType = (rawDocType: string): DocType | '' => {
 type UseMetadataStateOptions = {
   docDetail?: FullDocumentDetail
   onUpdate?: () => void
+  canEdit?: boolean
 }
-export function useMetadataState({ docDetail, onUpdate }: UseMetadataStateOptions) {
+export function useMetadataState({ docDetail, onUpdate, canEdit = false }: UseMetadataStateOptions) {
   const { doc_metadata = {} } = docDetail || {}
   const rawDocType = docDetail?.doc_type ?? ''
   const docType = normalizeDocType(rawDocType)
+  const shouldSelectDocType = canEdit && !rawDocType
   const { t } = useTranslation()
   const datasetId = useDocumentContext(s => s.datasetId)
   const documentId = useDocumentContext(s => s.documentId)
   // If no documentType yet, start in editing + showDocTypes mode
-  const [editStatus, setEditStatus] = useState(!docType)
-  const [metadataParams, setMetadataParams] = useState<MetadataState>(docType
+  const [editStatus, setEditStatus] = useState(shouldSelectDocType)
+  const [metadataParams, setMetadataParams] = useState<MetadataState>(rawDocType
     ? { documentType: docType, metadata: (doc_metadata || {}) as Record<string, string> }
     : { metadata: {} })
-  const [showDocTypes, setShowDocTypes] = useState(!docType)
+  const [showDocTypes, setShowDocTypes] = useState(shouldSelectDocType)
   const [tempDocType, setTempDocType] = useState<DocType | ''>('')
   const [saveLoading, setSaveLoading] = useState(false)
   // Sync local state when the upstream docDetail changes (e.g. after save or navigation).
   // These setters are intentionally called together to batch-reset multiple pieces
   // of derived editing state that cannot be expressed as pure derived values.
   useEffect(() => {
-    if (docDetail?.doc_type) {
-      // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
-      setEditStatus(false)
-      // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
-      setShowDocTypes(false)
-      // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
-      setTempDocType(docType)
-      // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
-      setMetadataParams({
-        documentType: docType,
-        metadata: (docDetail?.doc_metadata || {}) as Record<string, string>,
-      })
-    }
-  }, [docDetail?.doc_type, docDetail?.doc_metadata, docType])
+    if (!rawDocType)
+      return
+
+    // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
+    setEditStatus(false)
+    // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
+    setShowDocTypes(false)
+    // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
+    setTempDocType(docType)
+    // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
+    setMetadataParams({
+      documentType: docType,
+      metadata: (docDetail?.doc_metadata || {}) as Record<string, string>,
+    })
+  }, [docDetail?.doc_metadata, docType, rawDocType])
+  useEffect(() => {
+    if (rawDocType && canEdit)
+      return
+
+    // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
+    setEditStatus(canEdit && !rawDocType)
+    // eslint-disable-next-line react-hooks-extra/no-direct-set-state-in-use-effect
+    setShowDocTypes(canEdit && !rawDocType)
+  }, [canEdit, rawDocType])
+  const updateShowDocTypes = (show: boolean) => {
+    if (!canEdit)
+      return
+
+    setShowDocTypes(show)
+  }
   const confirmDocType = () => {
+    if (!canEdit)
+      return
+
     if (!tempDocType)
       return
     setMetadataParams({
@@ -67,20 +88,32 @@ export function useMetadataState({ docDetail, onUpdate }: UseMetadataStateOption
     setShowDocTypes(false)
   }
   const cancelDocType = () => {
+    if (!canEdit)
+      return
+
     setTempDocType(metadataParams.documentType ?? '')
     setEditStatus(true)
     setShowDocTypes(false)
   }
   const enableEdit = () => {
+    if (!canEdit)
+      return
+
     setEditStatus(true)
   }
   const cancelEdit = () => {
+    if (!canEdit)
+      return
+
     setMetadataParams({ documentType: docType || '', metadata: { ...docDetail?.doc_metadata } })
     setEditStatus(!docType)
     if (!docType)
       setShowDocTypes(true)
   }
   const saveMetadata = async () => {
+    if (!canEdit)
+      return
+
     setSaveLoading(true)
     const [e] = await asyncRunSafe<CommonResponse>(modifyDocMetadata({
       datasetId,
@@ -99,6 +132,9 @@ export function useMetadataState({ docDetail, onUpdate }: UseMetadataStateOption
     setSaveLoading(false)
   }
   const updateMetadataField = (field: string, value: string) => {
+    if (!canEdit)
+      return
+
     setMetadataParams(prev => ({ ...prev, metadata: { ...prev.metadata, [field]: value } }))
   }
   return {
@@ -109,7 +145,7 @@ export function useMetadataState({ docDetail, onUpdate }: UseMetadataStateOption
     saveLoading,
     metadataParams,
     setTempDocType,
-    setShowDocTypes,
+    setShowDocTypes: updateShowDocTypes,
     confirmDocType,
     cancelDocType,
     enableEdit,
diff --git a/web/app/components/datasets/documents/detail/metadata/index.tsx b/web/app/components/datasets/documents/detail/metadata/index.tsx
index 762f1ff3e41..5fc65f53c52 100644
--- a/web/app/components/datasets/documents/detail/metadata/index.tsx
+++ b/web/app/components/datasets/documents/detail/metadata/index.tsx
@@ -18,9 +18,10 @@ type MetadataProps = {
   docDetail?: FullDocumentDetail
   loading: boolean
   onUpdate: () => void
+  canEdit?: boolean
 }
 
-const Metadata: FC<MetadataProps> = ({ docDetail, loading, onUpdate }) => {
+const Metadata: FC<MetadataProps> = ({ docDetail, loading, onUpdate, canEdit = false }) => {
   const { t } = useTranslation()
   const metadataMap = useMetadataMap()
 
@@ -39,7 +40,7 @@ const Metadata: FC<MetadataProps> = ({ docDetail, loading, onUpdate }) => {
     cancelEdit,
     saveMetadata,
     updateMetadataField,
-  } = useMetadataState({ docDetail, onUpdate })
+  } = useMetadataState({ docDetail, onUpdate, canEdit })
 
   if (loading) {
     return (
@@ -56,21 +57,23 @@ const Metadata: FC<MetadataProps> = ({ docDetail, loading, onUpdate }) => {
         <span className={s.title}>{t('metadata.title', { ns: 'datasetDocuments' })}</span>
         {!editStatus
           ? (
-              <Button onClick={enableEdit} className={`${s.opBtn} ${s.opEditBtn}`}>
-                <PencilIcon className={s.opIcon} />
-                {t('operation.edit', { ns: 'common' })}
-              </Button>
+              canEdit && (
+                <Button onClick={enableEdit} className={`${s.opBtn} ${s.opEditBtn}`}>
+                  <PencilIcon className={s.opIcon} />
+                  {t('operation.edit', { ns: 'common' })}
+                </Button>
+              )
             )
-          : !showDocTypes && (
-              <div className={s.opBtnWrapper}>
-                <Button onClick={cancelEdit} className={`${s.opBtn} ${s.opCancelBtn}`}>
-                  {t('operation.cancel', { ns: 'common' })}
-                </Button>
-                <Button onClick={saveMetadata} className={`${s.opBtn} ${s.opSaveBtn}`} variant="primary" loading={saveLoading}>
-                  {t('operation.save', { ns: 'common' })}
-                </Button>
-              </div>
-            )}
+          : canEdit && !showDocTypes && (
+            <div className={s.opBtnWrapper}>
+              <Button onClick={cancelEdit} className={`${s.opBtn} ${s.opCancelBtn}`}>
+                {t('operation.cancel', { ns: 'common' })}
+              </Button>
+              <Button onClick={saveMetadata} className={`${s.opBtn} ${s.opSaveBtn}`} variant="primary" loading={saveLoading}>
+                {t('operation.save', { ns: 'common' })}
+              </Button>
+            </div>
+          )}
       </div>
 
       {/* Document type display / selector */}
@@ -81,7 +84,7 @@ const Metadata: FC<MetadataProps> = ({ docDetail, loading, onUpdate }) => {
           : (
               <DocumentTypeDisplay
                 displayType={metadataParams.documentType || ''}
-                showChangeLink={editStatus}
+                showChangeLink={canEdit && editStatus}
                 onChangeClick={() => setShowDocTypes(true)}
               />
             )}
@@ -90,7 +93,7 @@ const Metadata: FC<MetadataProps> = ({ docDetail, loading, onUpdate }) => {
       {(!docType && showDocTypes) ? null : <Divider />}
 
       {/* Doc type selector or editable metadata fields */}
-      {showDocTypes
+      {canEdit && showDocTypes
         ? (
             <DocTypeSelector
               docType={docType}
@@ -104,7 +107,7 @@ const Metadata: FC<MetadataProps> = ({ docDetail, loading, onUpdate }) => {
         : (
             <MetadataFieldList
               mainField={metadataParams.documentType || ''}
-              canEdit={editStatus}
+              canEdit={canEdit && editStatus}
               metadata={metadataParams.metadata}
               docDetail={docDetail}
               onFieldUpdate={updateMetadataField}
diff --git a/web/app/components/datasets/documents/index.tsx b/web/app/components/datasets/documents/index.tsx
index 29d9c01f714..33b27c1c46e 100644
--- a/web/app/components/datasets/documents/index.tsx
+++ b/web/app/components/datasets/documents/index.tsx
@@ -2,6 +2,7 @@
 import type { FC } from 'react'
 import { useCallback } from 'react'
 import Loading from '@/app/components/base/loading'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import { useProviderContext } from '@/context/provider-context'
 import { DataSourceType } from '@/models/datasets'
@@ -9,6 +10,7 @@ import { useRouter } from '@/next/navigation'
 import { useDocumentList, useInvalidDocumentDetail, useInvalidDocumentList } from '@/service/knowledge/use-document'
 import { useChildSegmentListKey, useSegmentListKey } from '@/service/knowledge/use-segment'
 import { useInvalid } from '@/service/use-base'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import useEditDocumentMetadata from '../metadata/hooks/use-edit-dataset-metadata'
 import DocumentsHeader from './components/documents-header'
 import EmptyElement from './components/empty-element'
@@ -29,7 +31,14 @@ const Documents: FC<IDocumentsProps> = ({ datasetId }) => {
   const isFreePlan = plan.type === 'sandbox'
 
   const dataset = useDatasetDetailContextWithSelector(s => s.dataset)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const embeddingAvailable = !!dataset?.embedding_available
+  const datasetACLCapabilities = getDatasetACLCapabilities(dataset?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset?.maintainer,
+    workspacePermissionKeys,
+  })
 
   // Use custom hook for page state management
   const {
@@ -106,12 +115,14 @@ const Documents: FC<IDocumentsProps> = ({ datasetId }) => {
 
   // Route to document creation page
   const routeToDocCreate = useCallback(() => {
+    if (!datasetACLCapabilities.canUse)
+      return
     if (dataset?.runtime_mode === 'rag_pipeline') {
       router.push(`/datasets/${datasetId}/documents/create-from-pipeline`)
       return
     }
     router.push(`/datasets/${datasetId}/documents/create`)
-  }, [dataset?.runtime_mode, datasetId, router])
+  }, [dataset?.runtime_mode, datasetACLCapabilities.canUse, datasetId, router])
 
   const total = documentsRes?.total || 0
   const documentsList = documentsRes?.data
@@ -147,7 +158,7 @@ const Documents: FC<IDocumentsProps> = ({ datasetId }) => {
     const isDataSourceNotion = dataset?.data_source_type === DataSourceType.NOTION
     return (
       <EmptyElement
-        canAdd={embeddingAvailable}
+        canAdd={embeddingAvailable && datasetACLCapabilities.canUse}
         onClick={routeToDocCreate}
         type={isDataSourceNotion ? 'sync' : 'upload'}
       />
@@ -160,6 +171,9 @@ const Documents: FC<IDocumentsProps> = ({ datasetId }) => {
         datasetId={datasetId}
         dataSourceType={dataset?.data_source_type}
         embeddingAvailable={embeddingAvailable}
+        canManageMetadata={datasetACLCapabilities.canEdit}
+        canAddDocument={datasetACLCapabilities.canUse}
+        canEditDocument={datasetACLCapabilities.canEdit}
         isFreePlan={isFreePlan}
         statusFilterValue={statusFilterValue}
         sortValue={sortValue}
diff --git a/web/app/components/datasets/documents/status-item/__tests__/index.spec.tsx b/web/app/components/datasets/documents/status-item/__tests__/index.spec.tsx
index 324e7142427..490dbed6378 100644
--- a/web/app/components/datasets/documents/status-item/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/documents/status-item/__tests__/index.spec.tsx
@@ -161,6 +161,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
         />,
       )
       // Switch component should be present in detail scene
@@ -186,6 +187,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
         />,
       )
       const switchElement = screen.getByRole('switch')
@@ -203,6 +205,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
         />,
       )
       const switchElement = screen.getByRole('switch')
@@ -220,6 +223,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
         />,
       )
       const switchElement = screen.getByRole('switch')
@@ -242,6 +246,24 @@ describe('StatusItem', () => {
       const switchElement = screen.getByRole('switch')
       expect(switchElement).toHaveAttribute('aria-disabled', 'true')
     })
+
+    it('should render switch as disabled when canEdit is false', () => {
+      render(
+        <StatusItem
+          status="available"
+          scene="detail"
+          detail={{
+            enabled: true,
+            archived: false,
+            id: 'doc-1',
+          }}
+          datasetId="dataset-1"
+          canEdit={false}
+        />,
+      )
+      const switchElement = screen.getByRole('switch')
+      expect(switchElement).toHaveAttribute('aria-disabled', 'true')
+    })
   })
 
   describe('switch operations', () => {
@@ -257,6 +279,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
           onUpdate={mockOnUpdate}
         />,
       )
@@ -284,6 +307,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
           onUpdate={mockOnUpdate}
         />,
       )
@@ -325,6 +349,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
           onUpdate={mockOnUpdate}
         />,
       )
@@ -353,6 +378,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
           onUpdate={mockOnUpdate}
         />,
       )
@@ -384,6 +410,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
           onUpdate={mockOnUpdate}
         />,
       )
@@ -413,6 +440,7 @@ describe('StatusItem', () => {
             id: 'doc-1',
           }}
           datasetId="dataset-1"
+          canEdit
           onUpdate={mockOnUpdate}
         />,
       )
diff --git a/web/app/components/datasets/documents/status-item/index.tsx b/web/app/components/datasets/documents/status-item/index.tsx
index fb875fee571..f225b9fd378 100644
--- a/web/app/components/datasets/documents/status-item/index.tsx
+++ b/web/app/components/datasets/documents/status-item/index.tsx
@@ -37,8 +37,9 @@ type StatusItemProps = {
   }
   datasetId?: string
   onUpdate?: (operationName?: string) => void
+  canEdit?: boolean
 }
-const StatusItem = ({ status, reverse = false, scene = 'list', textCls = '', errorMessage, datasetId = '', detail, onUpdate }: StatusItemProps) => {
+const StatusItem = ({ status, reverse = false, scene = 'list', textCls = '', errorMessage, datasetId = '', detail, onUpdate, canEdit = false }: StatusItemProps) => {
   const { t } = useTranslation()
   const DOC_INDEX_STATUS_MAP = useIndexStatus()
   const localStatus = status.toLowerCase() as keyof typeof DOC_INDEX_STATUS_MAP
@@ -48,6 +49,9 @@ const StatusItem = ({ status, reverse = false, scene = 'list', textCls = '', err
   const { mutateAsync: disableDocument } = useDocumentDisable()
   const { mutateAsync: deleteDocument } = useDocumentDelete()
   const onOperate = async (operationName: OperationName) => {
+    if (!canEdit)
+      return
+
     let opApi = deleteDocument
     switch (operationName) {
       case 'enable':
@@ -67,6 +71,8 @@ const StatusItem = ({ status, reverse = false, scene = 'list', textCls = '', err
     }
   }
   const { run: handleSwitch } = useDebounceFn((operationName: OperationName) => {
+    if (!canEdit)
+      return
     if (operationName === 'enable' && enabled)
       return
     if (operationName === 'disable' && !enabled)
@@ -99,8 +105,8 @@ const StatusItem = ({ status, reverse = false, scene = 'list', textCls = '', err
                 <span className="flex">
                   <Switch
                     checked={archived ? false : enabled}
-                    onCheckedChange={v => !archived && handleSwitch(v ? 'enable' : 'disable')}
-                    disabled={embedding || archived}
+                    onCheckedChange={v => !archived && canEdit && handleSwitch(v ? 'enable' : 'disable')}
+                    disabled={embedding || archived || !canEdit}
                     size="md"
                   />
                 </span>
diff --git a/web/app/components/datasets/external-api/external-api-panel/__tests__/index.spec.tsx b/web/app/components/datasets/external-api/external-api-panel/__tests__/index.spec.tsx
index 964b8fe3443..573a9c16b73 100644
--- a/web/app/components/datasets/external-api/external-api-panel/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/external-api/external-api-panel/__tests__/index.spec.tsx
@@ -29,8 +29,8 @@ vi.mock('@/context/i18n', () => ({
 
 // Mock the ExternalKnowledgeAPICard to avoid mocking its internal dependencies
 vi.mock('../../external-knowledge-api-card', () => ({
-  default: ({ api }: { api: ExternalAPIItem }) => (
-    <div data-testid={`api-card-${api.id}`}>{api.name}</div>
+  default: ({ api, canManageExternalKnowledgeApi }: { api: ExternalAPIItem, canManageExternalKnowledgeApi: boolean }) => (
+    <div data-testid={`api-card-${api.id}`} data-can-manage-external-knowledge-api={canManageExternalKnowledgeApi}>{api.name}</div>
   ),
 }))
 
@@ -38,6 +38,7 @@ vi.mock('../../external-knowledge-api-card', () => ({
 
 describe('ExternalAPIPanel', () => {
   const defaultProps = {
+    canManageExternalKnowledgeApi: true,
     onClose: vi.fn(),
   }
 
@@ -71,6 +72,11 @@ describe('ExternalAPIPanel', () => {
       expect(screen.getByText('dataset.createExternalAPI'))!.toBeInTheDocument()
     })
 
+    it('should hide create button when external knowledge API management is unavailable', () => {
+      render(<ExternalAPIPanel {...defaultProps} canManageExternalKnowledgeApi={false} />)
+      expect(screen.queryByText('dataset.createExternalAPI')).not.toBeInTheDocument()
+    })
+
     it('should render close button', () => {
       const { container } = render(<ExternalAPIPanel {...defaultProps} />)
       const closeButton = container.querySelector('[class*="action-button"]') || screen.getAllByRole('button')[0]
@@ -123,6 +129,7 @@ describe('ExternalAPIPanel', () => {
       render(<ExternalAPIPanel {...defaultProps} />)
       expect(screen.getByTestId('api-card-api-1'))!.toBeInTheDocument()
       expect(screen.getByTestId('api-card-api-2'))!.toBeInTheDocument()
+      expect(screen.getByTestId('api-card-api-1')).toHaveAttribute('data-can-manage-external-knowledge-api', 'true')
       expect(screen.getByText('Test API 1'))!.toBeInTheDocument()
       expect(screen.getByText('Test API 2'))!.toBeInTheDocument()
     })
@@ -131,7 +138,7 @@ describe('ExternalAPIPanel', () => {
   describe('User Interactions', () => {
     it('should call onClose when close button is clicked', () => {
       const onClose = vi.fn()
-      render(<ExternalAPIPanel onClose={onClose} />)
+      render(<ExternalAPIPanel canManageExternalKnowledgeApi={true} onClose={onClose} />)
       // Find the close button (ActionButton with close icon)
       const buttons = screen.getAllByRole('button')
       const closeButton = buttons.find(btn => btn.querySelector('svg[class*="ri-close"]'))
diff --git a/web/app/components/datasets/external-api/external-api-panel/index.tsx b/web/app/components/datasets/external-api/external-api-panel/index.tsx
index 32f7def506c..1255391c1ec 100644
--- a/web/app/components/datasets/external-api/external-api-panel/index.tsx
+++ b/web/app/components/datasets/external-api/external-api-panel/index.tsx
@@ -15,16 +15,20 @@ import { useModalContext } from '@/context/modal-context'
 import ExternalKnowledgeAPICard from '../external-knowledge-api-card'
 
 type ExternalAPIPanelProps = {
+  canManageExternalKnowledgeApi: boolean
   onClose: () => void
 }
 
-const ExternalAPIPanel: React.FC<ExternalAPIPanelProps> = ({ onClose }) => {
+const ExternalAPIPanel: React.FC<ExternalAPIPanelProps> = ({ canManageExternalKnowledgeApi, onClose }) => {
   const { t } = useTranslation()
   const docLink = useDocLink()
   const { setShowExternalKnowledgeAPIModal } = useModalContext()
   const { externalKnowledgeApiList, mutateExternalKnowledgeApis, isLoading } = useExternalKnowledgeApi()
 
   const handleOpenExternalAPIModal = () => {
+    if (!canManageExternalKnowledgeApi)
+      return
+
     setShowExternalKnowledgeAPIModal({
       payload: { name: '', settings: { endpoint: '', api_key: '' } },
       datasetBindings: [],
@@ -67,16 +71,18 @@ const ExternalAPIPanel: React.FC<ExternalAPIPanelProps> = ({ onClose }) => {
             </ActionButton>
           </div>
         </div>
-        <div className="flex flex-col items-start justify-center gap-2 self-stretch px-4 py-3">
-          <Button
-            variant="primary"
-            className="flex items-center justify-center gap-0.5 px-3 py-2"
-            onClick={handleOpenExternalAPIModal}
-          >
-            <RiAddLine className="size-4 text-components-button-primary-text" />
-            <div className="system-sm-medium text-components-button-primary-text">{t('createExternalAPI', { ns: 'dataset' })}</div>
-          </Button>
-        </div>
+        {canManageExternalKnowledgeApi && (
+          <div className="flex flex-col items-start justify-center gap-2 self-stretch px-4 py-3">
+            <Button
+              variant="primary"
+              className="flex items-center justify-center gap-0.5 px-3 py-2"
+              onClick={handleOpenExternalAPIModal}
+            >
+              <RiAddLine className="size-4 text-components-button-primary-text" />
+              <div className="system-sm-medium text-components-button-primary-text">{t('createExternalAPI', { ns: 'dataset' })}</div>
+            </Button>
+          </div>
+        )}
         <div className="flex grow flex-col items-start gap-1 self-stretch px-4 py-0">
           {isLoading
             ? (
@@ -84,7 +90,11 @@ const ExternalAPIPanel: React.FC<ExternalAPIPanelProps> = ({ onClose }) => {
               )
             : (
                 externalKnowledgeApiList.map(api => (
-                  <ExternalKnowledgeAPICard key={api.id} api={api} />
+                  <ExternalKnowledgeAPICard
+                    key={api.id}
+                    api={api}
+                    canManageExternalKnowledgeApi={canManageExternalKnowledgeApi}
+                  />
                 ))
               )}
         </div>
diff --git a/web/app/components/datasets/external-api/external-knowledge-api-card/__tests__/index.spec.tsx b/web/app/components/datasets/external-api/external-knowledge-api-card/__tests__/index.spec.tsx
index 6dfd8ff13d1..93edb4e898d 100644
--- a/web/app/components/datasets/external-api/external-knowledge-api-card/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/external-api/external-knowledge-api-card/__tests__/index.spec.tsx
@@ -47,6 +47,7 @@ describe('ExternalKnowledgeAPICard', () => {
 
   const defaultProps = {
     api: mockApi,
+    canManageExternalKnowledgeApi: true,
   }
 
   beforeEach(() => {
@@ -75,6 +76,17 @@ describe('ExternalKnowledgeAPICard', () => {
       expect(buttons.length).toBe(2)
     })
 
+    it('should hide edit and delete buttons when external knowledge API management is unavailable', () => {
+      const { container } = render((
+        <ExternalKnowledgeAPICard
+          {...defaultProps}
+          canManageExternalKnowledgeApi={false}
+        />
+      ))
+
+      expect(container.querySelectorAll('button').length).toBe(0)
+    })
+
     it('should render API connection icon', () => {
       const { container } = render(<ExternalKnowledgeAPICard {...defaultProps} />)
       const icon = container.querySelector('svg')
@@ -351,7 +363,7 @@ describe('ExternalKnowledgeAPICard', () => {
         ...mockApi,
         settings: { endpoint: '', api_key: 'key' },
       }
-      render(<ExternalKnowledgeAPICard api={apiWithEmptyEndpoint} />)
+      render(<ExternalKnowledgeAPICard api={apiWithEmptyEndpoint} canManageExternalKnowledgeApi={true} />)
       expect(screen.getByText('Test External API'))!.toBeInTheDocument()
     })
 
diff --git a/web/app/components/datasets/external-api/external-knowledge-api-card/index.tsx b/web/app/components/datasets/external-api/external-knowledge-api-card/index.tsx
index 3d2e839198a..f1c53e44bba 100644
--- a/web/app/components/datasets/external-api/external-knowledge-api-card/index.tsx
+++ b/web/app/components/datasets/external-api/external-knowledge-api-card/index.tsx
@@ -24,9 +24,10 @@ import { checkUsageExternalAPI, deleteExternalAPI, fetchExternalAPI, updateExter
 
 type ExternalKnowledgeAPICardProps = {
   api: ExternalAPIItem
+  canManageExternalKnowledgeApi: boolean
 }
 
-const ExternalKnowledgeAPICard: React.FC<ExternalKnowledgeAPICardProps> = ({ api }) => {
+const ExternalKnowledgeAPICard: React.FC<ExternalKnowledgeAPICardProps> = ({ api, canManageExternalKnowledgeApi }) => {
   const { setShowExternalKnowledgeAPIModal } = useModalContext()
   const [showConfirm, setShowConfirm] = useState(false)
   const [isHovered, setIsHovered] = useState(false)
@@ -36,6 +37,9 @@ const ExternalKnowledgeAPICard: React.FC<ExternalKnowledgeAPICardProps> = ({ api
   const { t } = useTranslation()
 
   const handleEditClick = async () => {
+    if (!canManageExternalKnowledgeApi)
+      return
+
     try {
       const response = await fetchExternalAPI({ apiTemplateId: api.id })
       const formValue: CreateExternalAPIReq = {
@@ -84,6 +88,9 @@ const ExternalKnowledgeAPICard: React.FC<ExternalKnowledgeAPICardProps> = ({ api
   }
 
   const handleDeleteClick = async () => {
+    if (!canManageExternalKnowledgeApi)
+      return
+
     try {
       const usage = await checkUsageExternalAPI({ apiTemplateId: api.id })
       if (usage.is_using)
@@ -97,6 +104,9 @@ const ExternalKnowledgeAPICard: React.FC<ExternalKnowledgeAPICardProps> = ({ api
   }
 
   const handleConfirmDelete = async () => {
+    if (!canManageExternalKnowledgeApi)
+      return
+
     try {
       const response = await deleteExternalAPI({ apiTemplateId: api.id })
       if (response && response.result === 'success') {
@@ -125,19 +135,21 @@ const ExternalKnowledgeAPICard: React.FC<ExternalKnowledgeAPICardProps> = ({ api
           </div>
           <div className="self-stretch system-xs-regular text-text-tertiary">{api.settings.endpoint}</div>
         </div>
-        <div className="flex items-start gap-1">
-          <ActionButton onClick={handleEditClick}>
-            <RiEditLine className="size-4 text-text-tertiary hover:text-text-secondary" />
-          </ActionButton>
-          <ActionButton
-            className="hover:bg-state-destructive-hover"
-            onClick={handleDeleteClick}
-            onMouseEnter={() => setIsHovered(true)}
-            onMouseLeave={() => setIsHovered(false)}
-          >
-            <RiDeleteBinLine className="size-4 text-text-tertiary hover:text-text-destructive" />
-          </ActionButton>
-        </div>
+        {canManageExternalKnowledgeApi && (
+          <div className="flex items-start gap-1">
+            <ActionButton onClick={handleEditClick}>
+              <RiEditLine className="size-4 text-text-tertiary hover:text-text-secondary" />
+            </ActionButton>
+            <ActionButton
+              className="hover:bg-state-destructive-hover"
+              onClick={handleDeleteClick}
+              onMouseEnter={() => setIsHovered(true)}
+              onMouseLeave={() => setIsHovered(false)}
+            >
+              <RiDeleteBinLine className="size-4 text-text-tertiary hover:text-text-destructive" />
+            </ActionButton>
+          </div>
+        )}
       </div>
       <AlertDialog open={showConfirm} onOpenChange={open => !open && setShowConfirm(false)}>
         <AlertDialogContent>
diff --git a/web/app/components/datasets/external-knowledge-base/create/RetrievalSettings.tsx b/web/app/components/datasets/external-knowledge-base/create/RetrievalSettings.tsx
index 35d61720286..93be9dc1cb3 100644
--- a/web/app/components/datasets/external-knowledge-base/create/RetrievalSettings.tsx
+++ b/web/app/components/datasets/external-knowledge-base/create/RetrievalSettings.tsx
@@ -11,6 +11,7 @@ type RetrievalSettingsProps = {
   scoreThresholdEnabled: boolean
   isInHitTesting?: boolean
   isInRetrievalSetting?: boolean
+  readonly?: boolean
   onChange: (data: { top_k?: number, score_threshold?: number, score_threshold_enabled?: boolean }) => void
 }
 
@@ -21,6 +22,7 @@ const RetrievalSettings: FC<RetrievalSettingsProps> = ({
   onChange,
   isInHitTesting = false,
   isInRetrievalSetting = false,
+  readonly = false,
 }) => {
   const { t } = useTranslation()
 
@@ -50,6 +52,7 @@ const RetrievalSettings: FC<RetrievalSettingsProps> = ({
             value={topK}
             onChange={(_key, v) => onChange({ top_k: v })}
             enable={true}
+            disabled={readonly}
           />
         </div>
         <div className="flex grow flex-col gap-1">
@@ -60,6 +63,7 @@ const RetrievalSettings: FC<RetrievalSettingsProps> = ({
             enable={scoreThresholdEnabled}
             hasSwitch={true}
             onSwitchChange={(_key, v) => handleScoreThresholdChange(v)}
+            disabled={readonly}
           />
         </div>
       </div>
diff --git a/web/app/components/datasets/extra-info/__tests__/index.spec.tsx b/web/app/components/datasets/extra-info/__tests__/index.spec.tsx
index de61894a11a..beccaa66600 100644
--- a/web/app/components/datasets/extra-info/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/extra-info/__tests__/index.spec.tsx
@@ -3,6 +3,7 @@ import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { describe, expect, it, vi } from 'vitest'
 import { AppModeEnum } from '@/types/app'
+import { DatasetACLPermission } from '@/utils/permission'
 
 // Component Imports (after mocks)
 
@@ -34,6 +35,7 @@ const mockDataset: Partial<DataSet> = {
   id: 'dataset-123',
   name: 'Test Dataset',
   enable_api: true,
+  permission_keys: [DatasetACLPermission.Edit],
 }
 
 // Mock use-context-selector
@@ -56,14 +58,6 @@ vi.mock('@/context/dataset-detail', () => ({
   ),
 }))
 
-// Mock app context for workspace permissions
-let mockIsCurrentWorkspaceManager = true
-vi.mock('@/context/app-context', () => ({
-  useSelector: vi.fn((selector: (state: { isCurrentWorkspaceManager: boolean }) => unknown) =>
-    selector({ isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager }),
-  ),
-}))
-
 const mockEnableDatasetServiceApi = vi.fn(() => Promise.resolve({ result: 'success' }))
 const mockDisableDatasetServiceApi = vi.fn(() => Promise.resolve({ result: 'success' }))
 
@@ -521,7 +515,7 @@ describe('ApiAccess', () => {
 describe('ApiAccessCard', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsCurrentWorkspaceManager = true
+    mockDataset.permission_keys = [DatasetACLPermission.Edit]
     mockEnableDatasetServiceApi.mockResolvedValue({ result: 'success' })
     mockDisableDatasetServiceApi.mockResolvedValue({ result: 'success' })
   })
@@ -664,8 +658,8 @@ describe('ApiAccessCard', () => {
   })
 
   describe('Permission Handling', () => {
-    it('should disable switch when user is not workspace manager', () => {
-      mockIsCurrentWorkspaceManager = false
+    it('should disable switch when dataset lacks edit ACL permission', () => {
+      mockDataset.permission_keys = []
 
       render(
         <ApiAccessCard
@@ -677,8 +671,8 @@ describe('ApiAccessCard', () => {
       expect(switchButton).toHaveAttribute('aria-disabled', 'true')
     })
 
-    it('should enable switch when user is workspace manager', () => {
-      mockIsCurrentWorkspaceManager = true
+    it('should enable switch when dataset has edit ACL permission', () => {
+      mockDataset.permission_keys = [DatasetACLPermission.Edit]
 
       render(
         <ApiAccessCard
diff --git a/web/app/components/datasets/extra-info/api-access/__tests__/card.spec.tsx b/web/app/components/datasets/extra-info/api-access/__tests__/card.spec.tsx
index 3f9eadc7050..fe2ce21986d 100644
--- a/web/app/components/datasets/extra-info/api-access/__tests__/card.spec.tsx
+++ b/web/app/components/datasets/extra-info/api-access/__tests__/card.spec.tsx
@@ -1,25 +1,21 @@
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { DatasetACLPermission } from '@/utils/permission'
 import Card from '../card'
 
 // Shared mock state for context selectors
 let mockDatasetId: string | undefined = 'dataset-123'
 let mockMutateDatasetRes: ReturnType<typeof vi.fn> = vi.fn()
-let mockIsCurrentWorkspaceManager = true
+let mockDatasetPermissionKeys: string[] = [DatasetACLPermission.Edit]
 
 vi.mock('@/context/dataset-detail', () => ({
   useDatasetDetailContextWithSelector: (selector: (state: Record<string, unknown>) => unknown) =>
     selector({
-      dataset: { id: mockDatasetId },
+      dataset: { id: mockDatasetId, permission_keys: mockDatasetPermissionKeys },
       mutateDatasetRes: mockMutateDatasetRes,
     }),
 }))
 
-vi.mock('@/context/app-context', () => ({
-  useSelector: (selector: (state: Record<string, unknown>) => unknown) =>
-    selector({ isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager }),
-}))
-
 const mockEnableApi = vi.fn()
 const mockDisableApi = vi.fn()
 
@@ -41,7 +37,7 @@ describe('Card (API Access)', () => {
     vi.clearAllMocks()
     mockDatasetId = 'dataset-123'
     mockMutateDatasetRes = vi.fn()
-    mockIsCurrentWorkspaceManager = true
+    mockDatasetPermissionKeys = [DatasetACLPermission.Edit]
   })
 
   // Rendering: verifies enabled/disabled states render correctly
@@ -149,8 +145,8 @@ describe('Card (API Access)', () => {
 
   // Switch disabled state
   describe('Switch State', () => {
-    it('should disable switch when user is not workspace manager', () => {
-      mockIsCurrentWorkspaceManager = false
+    it('should disable switch when dataset lacks edit ACL permission', () => {
+      mockDatasetPermissionKeys = []
       render(<Card apiEnabled={true} />)
 
       const switchButton = screen.getByRole('switch')
@@ -158,8 +154,8 @@ describe('Card (API Access)', () => {
       expect(switchButton).toHaveAttribute('aria-disabled', 'true')
     })
 
-    it('should enable switch when user is workspace manager', () => {
-      mockIsCurrentWorkspaceManager = true
+    it('should enable switch when dataset has edit ACL permission', () => {
+      mockDatasetPermissionKeys = [DatasetACLPermission.Edit]
       render(<Card apiEnabled={true} />)
 
       const switchButton = screen.getByRole('switch')
diff --git a/web/app/components/datasets/extra-info/api-access/card.tsx b/web/app/components/datasets/extra-info/api-access/card.tsx
index 0b7a5778538..3a5685e8fbb 100644
--- a/web/app/components/datasets/extra-info/api-access/card.tsx
+++ b/web/app/components/datasets/extra-info/api-access/card.tsx
@@ -1,15 +1,15 @@
 import { cn } from '@langgenius/dify-ui/cn'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Switch } from '@langgenius/dify-ui/switch'
-import { RiArrowRightUpLine, RiBookOpenLine } from '@remixicon/react'
 import * as React from 'react'
 import { useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useSelector as useAppContextSelector } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import { useDatasetApiAccessUrl } from '@/hooks/use-api-access-url'
 import Link from '@/next/link'
 import { useDisableDatasetServiceApi, useEnableDatasetServiceApi } from '@/service/knowledge/use-dataset'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 
 type CardProps = {
   apiEnabled: boolean
@@ -20,11 +20,22 @@ const Card = ({
 }: CardProps) => {
   const { t } = useTranslation()
   const datasetId = useDatasetDetailContextWithSelector(state => state.dataset?.id)
+  const dataset = useDatasetDetailContextWithSelector(state => state.dataset)
   const mutateDatasetRes = useDatasetDetailContextWithSelector(state => state.mutateDatasetRes)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const { mutateAsync: enableDatasetServiceApi } = useEnableDatasetServiceApi()
   const { mutateAsync: disableDatasetServiceApi } = useDisableDatasetServiceApi()
 
-  const isCurrentWorkspaceManager = useAppContextSelector(state => state.isCurrentWorkspaceManager)
+  const datasetACLCapabilities = React.useMemo(
+    () => getDatasetACLCapabilities(dataset?.permission_keys, {
+      currentUserId,
+      resourceMaintainer: dataset?.maintainer,
+      workspacePermissionKeys,
+    }),
+    [dataset?.maintainer, dataset?.permission_keys, currentUserId, workspacePermissionKeys],
+  )
+  const canManageApiAccess = datasetACLCapabilities.canEdit
 
   const apiReferenceUrl = useDatasetApiAccessUrl()
 
@@ -62,7 +73,7 @@ const Card = ({
             <Switch
               checked={apiEnabled}
               onCheckedChange={onToggle}
-              disabled={!isCurrentWorkspaceManager}
+              disabled={!canManageApiAccess}
             />
           </div>
           <div className="system-xs-regular text-text-tertiary">
@@ -78,11 +89,11 @@ const Card = ({
           rel="noopener noreferrer"
           className="flex h-8 items-center space-x-[7px] rounded-lg px-2 text-text-tertiary hover:bg-state-base-hover"
         >
-          <RiBookOpenLine className="size-3.5 shrink-0" />
+          <span className="i-ri-book-open-line size-3.5 shrink-0" />
           <div className="grow truncate system-sm-regular">
             {t('overview.apiInfo.doc', { ns: 'appOverview' })}
           </div>
-          <RiArrowRightUpLine className="size-3.5 shrink-0" />
+          <span className="i-ri-arrow-right-up-line size-3.5 shrink-0" />
         </Link>
       </div>
     </div>
diff --git a/web/app/components/datasets/extra-info/service-api/__tests__/card.spec.tsx b/web/app/components/datasets/extra-info/service-api/__tests__/card.spec.tsx
index 678434b8c08..fdbebc3d8a7 100644
--- a/web/app/components/datasets/extra-info/service-api/__tests__/card.spec.tsx
+++ b/web/app/components/datasets/extra-info/service-api/__tests__/card.spec.tsx
@@ -98,7 +98,7 @@ describe('Card (Service API)', () => {
   // User Interactions: tests button clicks
   describe('User Interactions', () => {
     it('should call onOpenSecretKeyModal when API key button is clicked', () => {
-      renderWithProviders(<Card {...defaultProps} />)
+      renderWithProviders(<Card {...defaultProps} canManageSecretKey />)
 
       const apiKeyButton = screen.getByText(/serviceApi\.card\.apiKey/).closest('button')
       fireEvent.click(apiKeyButton!)
@@ -106,6 +106,13 @@ describe('Card (Service API)', () => {
       expect(onOpenSecretKeyModal).toHaveBeenCalledTimes(1)
     })
 
+    it('should disable API key button when secret key management is not allowed', () => {
+      renderWithProviders(<Card {...defaultProps} canManageSecretKey={false} />)
+
+      const apiKeyButton = screen.getByText(/serviceApi\.card\.apiKey/).closest('button')
+      expect(apiKeyButton).toBeDisabled()
+    })
+
     it('should render API reference as a link', () => {
       renderWithProviders(<Card {...defaultProps} />)
       const link = screen.getByRole('link')
diff --git a/web/app/components/datasets/extra-info/service-api/__tests__/index.spec.tsx b/web/app/components/datasets/extra-info/service-api/__tests__/index.spec.tsx
index e48e57bd202..06bb88e91ef 100644
--- a/web/app/components/datasets/extra-info/service-api/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/extra-info/service-api/__tests__/index.spec.tsx
@@ -8,6 +8,13 @@ import ServiceApi from '../index'
 
 // Mock Setup
 
+let mockWorkspacePermissionKeys: string[] = ['dataset.api_key.manage']
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
+    selector({ workspacePermissionKeys: mockWorkspacePermissionKeys }),
+}))
+
 vi.mock('@/next/navigation', () => ({
   useRouter: () => ({
     push: vi.fn(),
@@ -31,10 +38,11 @@ vi.mock('@/hooks/use-api-access-url', () => ({
 
 // Mock SecretKeyModal to avoid complex modal rendering
 vi.mock('@/app/components/develop/secret-key/secret-key-modal', () => ({
-  default: ({ isShow, onClose }: { isShow: boolean, onClose: () => void }) => (
+  default: ({ isShow, onClose, canManage }: { isShow: boolean, onClose: () => void, canManage: boolean }) => (
     isShow
       ? (
           <div data-testid="secret-key-modal">
+            <span data-testid="secret-key-modal-can-manage">{String(canManage)}</span>
             <button onClick={onClose} data-testid="close-modal-btn">Close</button>
           </div>
         )
@@ -48,6 +56,7 @@ const renderCard = (ui: React.ReactElement) =>
 describe('ServiceApi', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys = ['dataset.api_key.manage']
   })
 
   describe('Rendering', () => {
@@ -191,7 +200,7 @@ describe('Card (service-api)', () => {
     it('should call onOpenSecretKeyModal when API Key button is clicked', async () => {
       const user = userEvent.setup()
 
-      renderCard(<Card apiBaseUrl="https://api.example.com" onOpenSecretKeyModal={onOpenSecretKeyModal} />)
+      renderCard(<Card apiBaseUrl="https://api.example.com" onOpenSecretKeyModal={onOpenSecretKeyModal} canManageSecretKey />)
 
       const apiKeyButton = screen.getByText(/serviceApi\.card\.apiKey/i).closest('button')
       if (apiKeyButton)
@@ -200,6 +209,13 @@ describe('Card (service-api)', () => {
       expect(onOpenSecretKeyModal).toHaveBeenCalledTimes(1)
     })
 
+    it('should disable API Key button when secret key management is not allowed', () => {
+      renderCard(<Card apiBaseUrl="https://api.example.com" onOpenSecretKeyModal={onOpenSecretKeyModal} canManageSecretKey={false} />)
+
+      const apiKeyButton = screen.getByText(/serviceApi\.card\.apiKey/i).closest('button')
+      expect(apiKeyButton).toBeDisabled()
+    })
+
     it('should have correct href for API Reference link', () => {
       renderCard(<Card apiBaseUrl="https://api.example.com" onOpenSecretKeyModal={onOpenSecretKeyModal} />)
 
@@ -243,4 +259,48 @@ describe('ServiceApi Integration', () => {
       expect(screen.queryByText(/serviceApi\.card\.title/i)).not.toBeInTheDocument()
     })
   })
+
+  it('should pass workspace API key management permission to secret key modal', async () => {
+    const user = userEvent.setup()
+
+    render(<ServiceApi apiBaseUrl="https://api.example.com" />)
+
+    const trigger = screen.getByText(/serviceApi\.title/i).closest('[class*="cursor-pointer"]')
+    if (trigger)
+      await user.click(trigger)
+
+    await waitFor(() => {
+      expect(screen.getByText(/serviceApi\.card\.apiKey/i)).toBeInTheDocument()
+    })
+
+    const apiKeyButton = screen.getByText(/serviceApi\.card\.apiKey/i).closest('button')
+    if (apiKeyButton)
+      await user.click(apiKeyButton)
+
+    await waitFor(() => {
+      expect(screen.getByTestId('secret-key-modal-can-manage')).toHaveTextContent('true')
+    })
+  })
+
+  it('should keep API key button disabled without workspace API key management permission', async () => {
+    const user = userEvent.setup()
+    mockWorkspacePermissionKeys = []
+
+    render(<ServiceApi apiBaseUrl="https://api.example.com" />)
+
+    const trigger = screen.getByText(/serviceApi\.title/i).closest('[class*="cursor-pointer"]')
+    if (trigger)
+      await user.click(trigger)
+
+    await waitFor(() => {
+      expect(screen.getByText(/serviceApi\.card\.apiKey/i)).toBeInTheDocument()
+    })
+
+    const apiKeyButton = screen.getByText(/serviceApi\.card\.apiKey/i).closest('button')
+    expect(apiKeyButton).toBeDisabled()
+    if (apiKeyButton)
+      await user.click(apiKeyButton)
+
+    expect(screen.queryByTestId('secret-key-modal')).not.toBeInTheDocument()
+  })
 })
diff --git a/web/app/components/datasets/extra-info/service-api/card.tsx b/web/app/components/datasets/extra-info/service-api/card.tsx
index c178f875fd5..7a9f1aa8159 100644
--- a/web/app/components/datasets/extra-info/service-api/card.tsx
+++ b/web/app/components/datasets/extra-info/service-api/card.tsx
@@ -1,22 +1,22 @@
 import { Button } from '@langgenius/dify-ui/button'
 import { PopoverClose } from '@langgenius/dify-ui/popover'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
-import { RiBookOpenLine, RiKey2Line } from '@remixicon/react'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
 import CopyFeedback from '@/app/components/base/copy-feedback'
-import { ApiAggregate } from '@/app/components/base/icons/src/vender/knowledge'
 import { useDatasetApiAccessUrl } from '@/hooks/use-api-access-url'
 import Link from '@/next/link'
 
 type CardProps = {
   apiBaseUrl: string
   onOpenSecretKeyModal: () => void
+  canManageSecretKey?: boolean
 }
 
 const Card = ({
   apiBaseUrl,
   onOpenSecretKeyModal,
+  canManageSecretKey = false,
 }: CardProps) => {
   const { t } = useTranslation()
 
@@ -28,7 +28,7 @@ const Card = ({
         <div className="flex items-center gap-x-3">
           <div className="flex grow items-center gap-x-2">
             <div className="flex size-6 shrink-0 items-center justify-center rounded-lg border-[0.5px] border-divider-subtle bg-util-colors-blue-brand-blue-brand-500 shadow-md shadow-shadow-shadow-5">
-              <ApiAggregate className="size-4 text-text-primary-on-surface" />
+              <span className="i-custom-vender-knowledge-api-aggregate size-4 text-text-primary-on-surface" />
             </div>
             <div className="grow truncate system-sm-semibold text-text-secondary">
               {t('serviceApi.card.title', { ns: 'dataset' })}
@@ -72,9 +72,10 @@ const Card = ({
               variant="ghost"
               size="small"
               className="gap-x-px text-text-tertiary"
+              disabled={!canManageSecretKey}
               onClick={onOpenSecretKeyModal}
             >
-              <RiKey2Line className="size-3.5 shrink-0" />
+              <span className="i-ri-key-2-line size-3.5 shrink-0" />
               <span className="px-[3px] system-xs-medium">
                 {t('serviceApi.card.apiKey', { ns: 'dataset' })}
               </span>
@@ -91,7 +92,7 @@ const Card = ({
             size="small"
             className="gap-x-px text-text-tertiary"
           >
-            <RiBookOpenLine className="size-3.5 shrink-0" />
+            <span className="i-ri-book-open-line size-3.5 shrink-0" />
             <span className="px-[3px] system-xs-medium">
               {t('serviceApi.card.apiReference', { ns: 'dataset' })}
             </span>
diff --git a/web/app/components/datasets/extra-info/service-api/index.tsx b/web/app/components/datasets/extra-info/service-api/index.tsx
index 0b42717b6eb..8d1ca6e4d16 100644
--- a/web/app/components/datasets/extra-info/service-api/index.tsx
+++ b/web/app/components/datasets/extra-info/service-api/index.tsx
@@ -5,6 +5,8 @@ import * as React from 'react'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import SecretKeyModal from '@/app/components/develop/secret-key/secret-key-modal'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
 import Card from './card'
 
 type ServiceApiProps = {
@@ -17,6 +19,8 @@ const ServiceApi = ({
   const { t } = useTranslation()
   const [open, setOpen] = useState(false)
   const [isSecretKeyModalVisible, setIsSecretKeyModalVisible] = useState(false)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canManageSecretKey = hasPermission(workspacePermissionKeys, 'dataset.api_key.manage')
 
   const handleOpenSecretKeyModal = useCallback(() => {
     setIsSecretKeyModalVisible(true)
@@ -60,12 +64,14 @@ const ServiceApi = ({
           <Card
             apiBaseUrl={apiBaseUrl}
             onOpenSecretKeyModal={handleOpenSecretKeyModal}
+            canManageSecretKey={canManageSecretKey}
           />
         </PopoverContent>
       </Popover>
       <SecretKeyModal
         isShow={isSecretKeyModalVisible}
         onClose={handleCloseSecretKeyModal}
+        canManage={canManageSecretKey}
       />
     </div>
   )
diff --git a/web/app/components/datasets/hit-testing/__tests__/index.spec.tsx b/web/app/components/datasets/hit-testing/__tests__/index.spec.tsx
index df0e39554a8..50ba6fc7d6e 100644
--- a/web/app/components/datasets/hit-testing/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/hit-testing/__tests__/index.spec.tsx
@@ -56,8 +56,14 @@ const mockDataset = {
     score_threshold: 0.5,
   },
   is_multimodal: false,
+  permission_keys: ['dataset.acl.retrieval_recall'],
 } as Partial<DataSet>
 
+let mockAppContextState = {
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: [] as string[],
+}
+
 vi.mock('use-context-selector', () => ({
   useContext: vi.fn(() => ({ dataset: mockDataset })),
   useContextSelector: vi.fn((_, selector) => selector({ dataset: mockDataset })),
@@ -73,6 +79,10 @@ vi.mock('@/context/dataset-detail', () => ({
   ),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector(mockAppContextState),
+}))
+
 const mockRecordsRefetch = vi.fn()
 const mockHitTestingMutateAsync = vi.fn()
 const mockExternalHitTestingMutateAsync = vi.fn()
@@ -304,6 +314,11 @@ const _createMockRetrievalConfig = (overrides = {}): RetrievalConfig => ({
 describe('HitTestingPage', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockDataset.permission_keys = ['dataset.acl.retrieval_recall']
+    mockAppContextState = {
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: [],
+    }
   })
 
   describe('Rendering', () => {
@@ -330,6 +345,16 @@ describe('HitTestingPage', () => {
       renderWithProviders(<HitTestingPage datasetId="dataset-1" />)
       expect(screen.getByRole('textbox'))!.toBeInTheDocument()
     })
+
+    it('should disable testing-record queries and hide query input when retrieval recall permission is missing', async () => {
+      const { useDatasetTestingRecords } = await import('@/service/knowledge/use-dataset')
+      mockDataset.permission_keys = []
+
+      renderWithProviders(<HitTestingPage datasetId="dataset-1" />)
+
+      expect(screen.queryByRole('textbox')).not.toBeInTheDocument()
+      expect(vi.mocked(useDatasetTestingRecords)).toHaveBeenCalledWith('dataset-1', { limit: 10, page: 1 }, { enabled: false })
+    })
   })
 
   describe('Loading States', () => {
@@ -589,6 +614,7 @@ describe('HitTestingPage', () => {
 describe('Integration: Hit Testing Flow', () => {
   beforeEach(async () => {
     vi.clearAllMocks()
+    mockDataset.permission_keys = ['dataset.acl.retrieval_recall']
     mockHitTestingMutateAsync.mockReset()
     mockExternalHitTestingMutateAsync.mockReset()
 
diff --git a/web/app/components/datasets/hit-testing/components/query-input/__tests__/index.spec.tsx b/web/app/components/datasets/hit-testing/components/query-input/__tests__/index.spec.tsx
index 271db6bf127..51f2150d457 100644
--- a/web/app/components/datasets/hit-testing/components/query-input/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/hit-testing/components/query-input/__tests__/index.spec.tsx
@@ -64,6 +64,7 @@ describe('QueryInput', () => {
     onClickRetrievalMethod: vi.fn(),
     retrievalConfig: { search_method: 'semantic_search' } as RetrievalConfig,
     isEconomy: false,
+    canRunRetrievalRecall: true,
     hitTestingMutation: vi.fn(),
     externalKnowledgeBaseHitTestingMutation: vi.fn(),
   })
@@ -102,6 +103,12 @@ describe('QueryInput', () => {
     expect(screen.getByRole('button', { name: /input\.testing/ }))!.toBeDisabled()
   })
 
+  it('should disable submit button when retrieval recall permission is missing', () => {
+    render(<QueryInput {...defaultProps} canRunRetrievalRecall={false} />)
+
+    expect(screen.getByRole('button', { name: /input\.testing/ }))!.toBeDisabled()
+  })
+
   it('should render retrieval method for non-external mode', () => {
     render(<QueryInput {...defaultProps} />)
     expect(screen.getByText('dataset.retrieval.semantic_search.title'))!.toBeInTheDocument()
@@ -233,6 +240,16 @@ describe('QueryInput', () => {
     })
   })
 
+  describe('Permission Guarding', () => {
+    it('should not run hit testing mutation when retrieval recall permission is missing', () => {
+      render(<QueryInput {...defaultProps} canRunRetrievalRecall={false} />)
+
+      fireEvent.click(screen.getByRole('button', { name: /input\.testing/ }))
+
+      expect(defaultProps.hitTestingMutation).not.toHaveBeenCalled()
+    })
+  })
+
   // Cover lines 127-143: handleImageChange
   describe('Image Change Handling', () => {
     it('should update queries when images change', () => {
diff --git a/web/app/components/datasets/hit-testing/components/query-input/index.tsx b/web/app/components/datasets/hit-testing/components/query-input/index.tsx
index 9f3b489cd9f..73edb09c39e 100644
--- a/web/app/components/datasets/hit-testing/components/query-input/index.tsx
+++ b/web/app/components/datasets/hit-testing/components/query-input/index.tsx
@@ -38,6 +38,7 @@ type QueryInputProps = {
   onClickRetrievalMethod: () => void
   retrievalConfig: RetrievalConfig
   isEconomy: boolean
+  canRunRetrievalRecall?: boolean
   onSubmit?: () => void
   hitTestingMutation: UseMutateAsyncFunction<HitTestingResponse, Error, HitTestingRequest, unknown>
   externalKnowledgeBaseHitTestingMutation: UseMutateAsyncFunction<
@@ -59,6 +60,7 @@ const QueryInput = ({
   onClickRetrievalMethod,
   retrievalConfig,
   isEconomy,
+  canRunRetrievalRecall = true,
   onSubmit: _onSubmit,
   hitTestingMutation,
   externalKnowledgeBaseHitTestingMutation,
@@ -143,6 +145,9 @@ const QueryInput = ({
   }, [queries, setQueries])
 
   const onSubmit = useCallback(async () => {
+    if (!canRunRetrievalRecall)
+      return
+
     await hitTestingMutation({
       query: text,
       attachment_ids: images.map(image => image.uploadedId),
@@ -158,9 +163,12 @@ const QueryInput = ({
           _onSubmit()
       },
     })
-  }, [text, retrievalConfig, isEconomy, hitTestingMutation, onUpdateList, _onSubmit, images, setHitResult])
+  }, [canRunRetrievalRecall, text, retrievalConfig, isEconomy, hitTestingMutation, onUpdateList, _onSubmit, images, setHitResult])
 
   const externalRetrievalTestingOnSubmit = useCallback(async () => {
+    if (!canRunRetrievalRecall)
+      return
+
     await externalKnowledgeBaseHitTestingMutation({
       query: text,
       external_retrieval_model: {
@@ -174,7 +182,7 @@ const QueryInput = ({
         onUpdateList?.()
       },
     })
-  }, [text, externalRetrievalSettings, externalKnowledgeBaseHitTestingMutation, onUpdateList, setExternalHitResult])
+  }, [canRunRetrievalRecall, text, externalRetrievalSettings, externalKnowledgeBaseHitTestingMutation, onUpdateList, setExternalHitResult])
 
   const retrievalMethod = isEconomy ? RETRIEVE_METHOD.keywordSearch : retrievalConfig.search_method
   const icon = <img className="size-3.5 text-util-colors-purple-purple-600" src={getIcon(retrievalMethod)} alt="" />
@@ -192,14 +200,14 @@ const QueryInput = ({
         onClick={isExternal ? externalRetrievalTestingOnSubmit : onSubmit}
         variant="primary"
         loading={loading}
-        disabled={(text.length === 0 && images.length === 0) || text.length > 200 || (images.length > 0 && !isAllUploaded)}
+        disabled={!canRunRetrievalRecall || (text.length === 0 && images.length === 0) || text.length > 200 || (images.length > 0 && !isAllUploaded)}
         className="w-[88px]"
       >
         <RiPlayCircleLine className="mr-1 size-4" />
         {t('input.testing', { ns: 'datasetHitTesting' })}
       </Button>
     )
-  }, [isExternal, externalRetrievalTestingOnSubmit, onSubmit, text, loading, t, images, isAllUploaded])
+  }, [isExternal, externalRetrievalTestingOnSubmit, onSubmit, canRunRetrievalRecall, text, loading, t, images, isAllUploaded])
 
   return (
     <div className={cn('relative flex h-80 shrink-0 flex-col overflow-hidden rounded-xl bg-linear-to-r from-components-input-border-active-prompt-1 to-components-input-border-active-prompt-2 p-0.5 shadow-xs')}>
diff --git a/web/app/components/datasets/hit-testing/index.tsx b/web/app/components/datasets/hit-testing/index.tsx
index 161748104e1..3324a497838 100644
--- a/web/app/components/datasets/hit-testing/index.tsx
+++ b/web/app/components/datasets/hit-testing/index.tsx
@@ -27,6 +27,7 @@ import { useContext } from 'use-context-selector'
 import FloatRightContainer from '@/app/components/base/float-right-container'
 import Loading from '@/app/components/base/loading'
 import docStyle from '@/app/components/datasets/documents/detail/completed/style.module.css'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import DatasetDetailContext from '@/context/dataset-detail'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
 import { useDatasetTestingRecords } from '@/service/knowledge/use-dataset'
@@ -34,6 +35,7 @@ import {
   useExternalKnowledgeBaseHitTesting,
   useHitTesting,
 } from '@/service/knowledge/use-hit-testing'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import { CardSkelton } from '../documents/detail/completed/skeleton/general-list-skeleton'
 import EmptyRecords from './components/empty-records'
 import QueryInput from './components/query-input'
@@ -60,12 +62,19 @@ const HitTestingPage: FC<Props> = ({ datasetId }: Props) => {
   const [queryInputKey, setQueryInputKey] = useState(Date.now())
 
   const [currPage, setCurrPage] = useState<number>(0)
-  const { data: recordsRes, refetch: recordsRefetch, isLoading: isRecordsLoading } = useDatasetTestingRecords(datasetId, { limit, page: currPage + 1 })
+  const { dataset: currentDataset } = useContext(DatasetDetailContext)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canRunRetrievalRecall = React.useMemo(() => getDatasetACLCapabilities(currentDataset?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: currentDataset?.maintainer,
+    workspacePermissionKeys,
+  }).canRetrievalRecall, [currentDataset?.maintainer, currentDataset?.permission_keys, currentUserId, workspacePermissionKeys])
+  const { data: recordsRes, refetch: recordsRefetch, isLoading: isRecordsLoading } = useDatasetTestingRecords(datasetId, { limit, page: currPage + 1 }, { enabled: canRunRetrievalRecall })
 
   const total = recordsRes?.total || 0
   const totalPages = total ? Math.max(Math.ceil(total / limit), 1) : 1
 
-  const { dataset: currentDataset } = useContext(DatasetDetailContext)
   const isExternal = currentDataset?.provider === 'external'
 
   const [retrievalConfig, setRetrievalConfig] = useState(currentDataset?.retrieval_model_dict as RetrievalConfig)
@@ -121,6 +130,9 @@ const HitTestingPage: FC<Props> = ({ datasetId }: Props) => {
     setShowRightPanel(!isMobile)
   }, [isMobile, setShowRightPanel])
 
+  if (!canRunRetrievalRecall)
+    return <Loading type="app" />
+
   return (
     <div className="relative flex size-full gap-x-6 overflow-y-auto pl-6">
       <div className="flex min-w-0 flex-1 flex-col py-3">
@@ -143,6 +155,7 @@ const HitTestingPage: FC<Props> = ({ datasetId }: Props) => {
           isEconomy={currentDataset?.indexing_technique === 'economy'}
           hitTestingMutation={hitTestingMutation}
           externalKnowledgeBaseHitTestingMutation={externalKnowledgeBaseHitTestingMutation}
+          canRunRetrievalRecall={canRunRetrievalRecall}
         />
         <div className="mt-6 mb-3 text-base font-semibold text-text-primary">{t('records', { ns: 'datasetHitTesting' })}</div>
         {isRecordsLoading && (
diff --git a/web/app/components/datasets/list/__tests__/header.spec.tsx b/web/app/components/datasets/list/__tests__/header.spec.tsx
index 49883a543c5..04ae8513d06 100644
--- a/web/app/components/datasets/list/__tests__/header.spec.tsx
+++ b/web/app/components/datasets/list/__tests__/header.spec.tsx
@@ -22,7 +22,7 @@ vi.mock('@/features/tag-management/components/tag-filter', () => ({
 }))
 
 vi.mock('@/app/components/datasets/create/website/base/checkbox-with-label', () => ({
-  default: () => <label>include all</label>,
+  default: () => <span>include all</span>,
 }))
 
 vi.mock('../../extra-info/service-api', () => ({
@@ -31,9 +31,9 @@ vi.mock('../../extra-info/service-api', () => ({
 
 const defaultProps = {
   apiBaseUrl: 'https://api.example.com',
+  canConnectExternalDataset: true,
+  canCreateDataset: true,
   includeAll: false,
-  isCurrentWorkspaceEditor: true,
-  isCurrentWorkspaceManager: true,
   isCurrentWorkspaceOwner: true,
   keywords: '',
   tagFilterValue: [],
@@ -61,4 +61,30 @@ describe('DatasetListHeader', () => {
 
     expect(menuItem.querySelector('.i-custom-vender-pipeline-pipeline-line')).toBeInTheDocument()
   })
+
+  it('should hide dataset creation actions when dataset.create_and_management is unavailable', () => {
+    render(<DatasetListHeader {...defaultProps} canCreateDataset={false} />)
+
+    expect(screen.queryByRole('button', { name: /dataset\.firstEmpty\.createTitle/ })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: /dataset\.firstEmpty\.pipelineTitle/ })).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /dataset\.connectDataset/ })).toBeInTheDocument()
+  })
+
+  it('should hide external API panel entry when dataset.external.connect is unavailable', () => {
+    render(<DatasetListHeader {...defaultProps} canConnectExternalDataset={false} />)
+
+    expect(screen.queryByRole('button', { name: /dataset\.externalAPIPanelTitle/ })).not.toBeInTheDocument()
+  })
+
+  it('should hide the create menu when no creation or connection action is available', () => {
+    render((
+      <DatasetListHeader
+        {...defaultProps}
+        canConnectExternalDataset={false}
+        canCreateDataset={false}
+      />
+    ))
+
+    expect(screen.queryByRole('button', { name: /common\.operation\.create/ })).not.toBeInTheDocument()
+  })
 })
diff --git a/web/app/components/datasets/list/__tests__/index.spec.tsx b/web/app/components/datasets/list/__tests__/index.spec.tsx
index 5fcf57a6b2c..76dfb03a9ed 100644
--- a/web/app/components/datasets/list/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/list/__tests__/index.spec.tsx
@@ -5,6 +5,12 @@ import List from '../index'
 
 const mockPush = vi.fn()
 const mockReplace = vi.fn()
+let mockAppContextState = {
+  isCurrentWorkspaceEditor: true,
+  isCurrentWorkspaceManager: true,
+  workspacePermissionKeys: ['dataset.create_and_management', 'dataset.external.connect'],
+}
+let mockIsCurrentWorkspaceOwner = true
 vi.mock('@/next/navigation', () => ({
   useRouter: () => ({
     push: mockPush,
@@ -16,9 +22,9 @@ vi.mock('@/next/navigation', () => ({
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     currentWorkspace: { role: 'admin' },
-    isCurrentWorkspaceOwner: true,
+    isCurrentWorkspaceOwner: mockIsCurrentWorkspaceOwner,
   }),
-  useSelector: () => true,
+  useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector(mockAppContextState),
 }))
 
 // Mock external api panel context
@@ -75,8 +81,8 @@ vi.mock('../datasets', () => ({
 
 // Mock ExternalAPIPanel component
 vi.mock('../../external-api/external-api-panel', () => ({
-  default: ({ onClose }: { onClose: () => void }) => (
-    <div data-testid="external-api-panel">
+  default: ({ canManageExternalKnowledgeApi, onClose }: { canManageExternalKnowledgeApi: boolean, onClose: () => void }) => (
+    <div data-testid="external-api-panel" data-can-manage-external-knowledge-api={canManageExternalKnowledgeApi}>
       <button onClick={onClose}>Close Panel</button>
     </div>
   ),
@@ -123,6 +129,12 @@ vi.mock('@/app/components/datasets/create/website/base/checkbox-with-label', ()
 describe('List', () => {
   beforeEach(async () => {
     vi.clearAllMocks()
+    mockAppContextState = {
+      isCurrentWorkspaceEditor: true,
+      isCurrentWorkspaceManager: true,
+      workspacePermissionKeys: ['dataset.create_and_management', 'dataset.external.connect'],
+    }
+    mockIsCurrentWorkspaceOwner = true
     const { useDatasetList } = await import('@/service/knowledge/use-dataset')
     vi.mocked(useDatasetList).mockReturnValue({
       data: { pages: [{ data: [], total: 1 }] },
@@ -153,6 +165,18 @@ describe('List', () => {
       render(<List />)
       expect(screen.getByText(/externalAPIPanelTitle/)).toBeInTheDocument()
     })
+
+    it('should hide external API panel button without dataset.external.connect', () => {
+      mockAppContextState = {
+        isCurrentWorkspaceEditor: true,
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: ['dataset.create_and_management'],
+      }
+
+      render(<List />)
+
+      expect(screen.queryByText(/externalAPIPanelTitle/)).not.toBeInTheDocument()
+    })
   })
 
   describe('Props', () => {
@@ -254,6 +278,48 @@ describe('List', () => {
       expect(screen.queryByTestId('datasets-component')).not.toBeInTheDocument()
     })
 
+    it('should render first empty state when dataset.create_and_management is available without the legacy editor role', async () => {
+      mockAppContextState = {
+        isCurrentWorkspaceEditor: false,
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: ['dataset.create_and_management'],
+      }
+      const { useDatasetList } = await import('@/service/knowledge/use-dataset')
+      vi.mocked(useDatasetList).mockReturnValue({
+        data: { pages: [{ data: [], total: 0 }] },
+        fetchNextPage: vi.fn(),
+        hasNextPage: false,
+        isFetching: false,
+        isFetchingNextPage: false,
+      } as unknown as ReturnType<typeof useDatasetList>)
+
+      render(<List />)
+
+      expect(screen.getByText('dataset.firstEmpty.title')).toBeInTheDocument()
+      expect(screen.getByRole('link', { name: /dataset\.firstEmpty\.pipelineTitle/ })).toHaveAttribute('href', '/datasets/create-from-pipeline')
+    })
+
+    it('should not render first empty state for legacy editors without dataset creation permissions', async () => {
+      mockAppContextState = {
+        isCurrentWorkspaceEditor: true,
+        isCurrentWorkspaceManager: true,
+        workspacePermissionKeys: [],
+      }
+      const { useDatasetList } = await import('@/service/knowledge/use-dataset')
+      vi.mocked(useDatasetList).mockReturnValue({
+        data: { pages: [{ data: [], total: 0 }] },
+        fetchNextPage: vi.fn(),
+        hasNextPage: false,
+        isFetching: false,
+        isFetchingNextPage: false,
+      } as unknown as ReturnType<typeof useDatasetList>)
+
+      render(<List />)
+
+      expect(screen.queryByText('dataset.firstEmpty.title')).not.toBeInTheDocument()
+      expect(screen.getByTestId('datasets-component')).toBeInTheDocument()
+    })
+
     it('should not render first empty state before the first dataset page resolves', async () => {
       const { useDatasetList } = await import('@/service/knowledge/use-dataset')
       vi.mocked(useDatasetList).mockReturnValue({
@@ -298,7 +364,11 @@ describe('List', () => {
           currentWorkspace: { role: 'normal' },
           isCurrentWorkspaceOwner: false,
         }),
-        useSelector: () => true,
+        useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector({
+          isCurrentWorkspaceEditor: false,
+          isCurrentWorkspaceManager: false,
+          workspacePermissionKeys: ['dataset.create_and_management', 'dataset.external.connect'],
+        }),
       }))
 
       // Clear module cache and re-import
@@ -343,9 +413,48 @@ describe('List', () => {
       render(<ListComponent />)
 
       expect(screen.getByTestId('external-api-panel')).toBeInTheDocument()
+      expect(screen.getByTestId('external-api-panel')).toHaveAttribute('data-can-manage-external-knowledge-api', 'true')
+    })
+
+    it('should not show ExternalAPIPanel without dataset.external.connect even when panel state is open', async () => {
+      vi.doMock('@/context/app-context', () => ({
+        useAppContext: () => ({
+          currentWorkspace: { role: 'admin' },
+          isCurrentWorkspaceOwner: true,
+        }),
+        useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector({
+          isCurrentWorkspaceEditor: true,
+          isCurrentWorkspaceManager: true,
+          workspacePermissionKeys: ['dataset.create_and_management'],
+        }),
+      }))
+      vi.doMock('@/context/external-api-panel-context', () => ({
+        useExternalApiPanel: () => ({
+          showExternalApiPanel: true,
+          setShowExternalApiPanel: mockSetShowExternalApiPanel,
+        }),
+      }))
+
+      vi.resetModules()
+      const { default: ListComponent } = await import('../index')
+
+      render(<ListComponent />)
+
+      expect(screen.queryByTestId('external-api-panel')).not.toBeInTheDocument()
     })
 
     it('should close ExternalAPIPanel when onClose is called', async () => {
+      vi.doMock('@/context/app-context', () => ({
+        useAppContext: () => ({
+          currentWorkspace: { role: 'admin' },
+          isCurrentWorkspaceOwner: true,
+        }),
+        useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector({
+          isCurrentWorkspaceEditor: true,
+          isCurrentWorkspaceManager: true,
+          workspacePermissionKeys: ['dataset.create_and_management', 'dataset.external.connect'],
+        }),
+      }))
       vi.doMock('@/context/external-api-panel-context', () => ({
         useExternalApiPanel: () => ({
           showExternalApiPanel: true,
@@ -377,7 +486,11 @@ describe('List', () => {
           currentWorkspace: { role: 'editor' },
           isCurrentWorkspaceOwner: false,
         }),
-        useSelector: () => true,
+        useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector({
+          isCurrentWorkspaceEditor: true,
+          isCurrentWorkspaceManager: true,
+          workspacePermissionKeys: ['dataset.create_and_management', 'dataset.external.connect'],
+        }),
       }))
 
       vi.resetModules()
diff --git a/web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx b/web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx
index 00828d382cf..4f85e926ea7 100644
--- a/web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx
@@ -19,13 +19,20 @@ vi.mock('@/hooks/use-format-time-from-now', () => ({
 }))
 
 const mockPush = vi.fn()
+const mockOpenAccessConfig = vi.fn()
+const mockCloseAccessConfig = vi.fn()
 
 vi.mock('@/next/navigation', () => ({
   useRouter: () => ({ push: mockPush }),
 }))
 
+let mockAppContextState = {
+  isCurrentWorkspaceDatasetOperator: false,
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: [] as string[],
+}
 vi.mock('@/context/app-context', () => ({
-  useSelector: (selector: (state: { isCurrentWorkspaceDatasetOperator: boolean }) => boolean) => selector({ isCurrentWorkspaceDatasetOperator: false }),
+  useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector(mockAppContextState),
 }))
 
 vi.mock('../hooks/use-dataset-card-state', () => ({
@@ -33,11 +40,14 @@ vi.mock('../hooks/use-dataset-card-state', () => ({
     modalState: {
       showRenameModal: false,
       showConfirmDelete: false,
+      showAccessConfig: false,
       confirmMessage: '',
     },
     openRenameModal: vi.fn(),
     closeRenameModal: vi.fn(),
     closeConfirmDelete: vi.fn(),
+    openAccessConfig: mockOpenAccessConfig,
+    closeAccessConfig: mockCloseAccessConfig,
     handleExportPipeline: vi.fn(),
     detectIsUsedByApp: vi.fn(),
     onConfirmDelete: vi.fn(),
@@ -51,15 +61,29 @@ vi.mock('../components/dataset-card-header', () => ({
   default: ({ dataset }: { dataset: DataSet }) => <div data-testid="card-header">{dataset.name}</div>,
 }))
 vi.mock('../components/dataset-card-modals', () => ({
-  default: () => <div data-testid="card-modals" />,
+  default: ({ onCloseAccessConfig }: { onCloseAccessConfig?: () => void }) => (
+    <div data-testid="card-modals" data-has-close-access-config={typeof onCloseAccessConfig === 'function'} />
+  ),
 }))
 vi.mock('@/features/tag-management/components/dataset-card-tags', () => ({
-  DatasetCardTags: ({ onClick }: { onClick: (e: React.MouseEvent) => void }) => (
-    <div data-testid="tag-area" onClick={onClick} />
+  DatasetCardTags: ({
+    onClick,
+    canBindOrUnbindTags,
+  }: {
+    onClick: (e: React.MouseEvent) => void
+    canBindOrUnbindTags?: boolean
+  }) => (
+    <div
+      data-testid="tag-area"
+      data-can-bind-or-unbind-tags={String(Boolean(canBindOrUnbindTags))}
+      onClick={onClick}
+    />
   ),
 }))
 vi.mock('../components/operations-dropdown', () => ({
-  default: () => <div data-testid="operations-dropdown" />,
+  default: ({ openAccessConfig }: { openAccessConfig?: () => void }) => (
+    <div data-testid="operations-dropdown" data-has-open-access-config={typeof openAccessConfig === 'function'} />
+  ),
 }))
 
 // Factory function for DataSet mock data
@@ -90,6 +114,11 @@ const createMockDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
 describe('DatasetCard Integration', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockAppContextState = {
+      isCurrentWorkspaceDatasetOperator: false,
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: [],
+    }
   })
 
   // Integration tests for Description component
@@ -253,14 +282,36 @@ describe('DatasetCard Component', () => {
     expect(card).toHaveClass('hover:bg-components-card-bg-alt')
   })
 
+  it('should pass access config handlers to operations and modals', () => {
+    const dataset = createMockDataset()
+    render(<DatasetCard dataset={dataset} />)
+
+    expect(screen.getByTestId('operations-dropdown')).toHaveAttribute('data-has-open-access-config', 'true')
+    expect(screen.getByTestId('card-modals')).toHaveAttribute('data-has-close-access-config', 'true')
+  })
+
   it('should navigate to hitTesting for external provider', () => {
-    const dataset = createMockDataset({ provider: 'external' })
+    const dataset = createMockDataset({
+      provider: 'external',
+      permission_keys: ['dataset.acl.retrieval_recall'],
+    })
     render(<DatasetCard dataset={dataset} />)
 
     fireEvent.click(screen.getByText('Test Dataset'))
     expect(mockPush).toHaveBeenCalledWith('/datasets/dataset-1/hitTesting')
   })
 
+  it('should navigate to settings for external provider when retrieval recall permission is missing', () => {
+    const dataset = createMockDataset({
+      provider: 'external',
+      permission_keys: [],
+    })
+    render(<DatasetCard dataset={dataset} />)
+
+    fireEvent.click(screen.getByText('Test Dataset'))
+    expect(mockPush).toHaveBeenCalledWith('/datasets/dataset-1/settings')
+  })
+
   it('should navigate to pipeline for unpublished pipeline', () => {
     const dataset = createMockDataset({ runtime_mode: 'rag_pipeline', is_published: false })
     render(<DatasetCard dataset={dataset} />)
@@ -278,4 +329,20 @@ describe('DatasetCard Component', () => {
     // Tag area click should not trigger card navigation
     expect(mockPush).not.toHaveBeenCalled()
   })
+
+  it('should allow tag binding when dataset has edit ACL', () => {
+    const dataset = createMockDataset({ permission_keys: ['dataset.acl.edit'] })
+
+    render(<DatasetCard dataset={dataset} />)
+
+    expect(screen.getByTestId('tag-area')).toHaveAttribute('data-can-bind-or-unbind-tags', 'true')
+  })
+
+  it('should not allow tag binding when dataset lacks edit ACL', () => {
+    const dataset = createMockDataset({ permission_keys: ['dataset.acl.readonly'] })
+
+    render(<DatasetCard dataset={dataset} />)
+
+    expect(screen.getByTestId('tag-area')).toHaveAttribute('data-can-bind-or-unbind-tags', 'false')
+  })
 })
diff --git a/web/app/components/datasets/list/dataset-card/__tests__/operations.spec.tsx b/web/app/components/datasets/list/dataset-card/__tests__/operations.spec.tsx
index 41c0b2749ba..015f7f1cbb5 100644
--- a/web/app/components/datasets/list/dataset-card/__tests__/operations.spec.tsx
+++ b/web/app/components/datasets/list/dataset-card/__tests__/operations.spec.tsx
@@ -18,6 +18,7 @@ describe('Operations', () => {
     openRenameModal: vi.fn(),
     handleExportPipeline: vi.fn(),
     detectIsUsedByApp: vi.fn(),
+    openAccessConfig: vi.fn(),
   }
 
   beforeEach(() => {
@@ -80,6 +81,14 @@ describe('Operations', () => {
       fireEvent.click(screen.getByText(/operation\.delete/))
       expect(detectIsUsedByApp).toHaveBeenCalledTimes(1)
     })
+
+    it('should call openAccessConfig when access config is clicked', () => {
+      const openAccessConfig = vi.fn()
+      renderInMenu(<Operations {...defaultProps} showAccessConfig openAccessConfig={openAccessConfig} />)
+
+      fireEvent.click(screen.getByText(/settings\.resourceAccess/))
+      expect(openAccessConfig).toHaveBeenCalledTimes(1)
+    })
   })
 
   describe('Edge Cases', () => {
diff --git a/web/app/components/datasets/list/dataset-card/components/__tests__/dataset-card-modals.spec.tsx b/web/app/components/datasets/list/dataset-card/components/__tests__/dataset-card-modals.spec.tsx
index 8cc10ae5ae0..fd6ac86eedb 100644
--- a/web/app/components/datasets/list/dataset-card/components/__tests__/dataset-card-modals.spec.tsx
+++ b/web/app/components/datasets/list/dataset-card/components/__tests__/dataset-card-modals.spec.tsx
@@ -71,10 +71,12 @@ describe('DatasetCardModals', () => {
     modalState: {
       showRenameModal: false,
       showConfirmDelete: false,
+      showAccessConfig: false,
       confirmMessage: '',
     },
     onCloseRename: vi.fn(),
     onCloseConfirm: vi.fn(),
+    onCloseAccessConfig: vi.fn(),
     onConfirmDelete: vi.fn(),
     onSuccess: vi.fn(),
   }
@@ -209,6 +211,7 @@ describe('DatasetCardModals', () => {
           modalState={{
             showRenameModal: true,
             showConfirmDelete: true,
+            showAccessConfig: false,
             confirmMessage: 'Delete this dataset?',
           }}
         />,
diff --git a/web/app/components/datasets/list/dataset-card/components/__tests__/operations-dropdown.spec.tsx b/web/app/components/datasets/list/dataset-card/components/__tests__/operations-dropdown.spec.tsx
index 6f7faf51ce5..5a6303d83e9 100644
--- a/web/app/components/datasets/list/dataset-card/components/__tests__/operations-dropdown.spec.tsx
+++ b/web/app/components/datasets/list/dataset-card/components/__tests__/operations-dropdown.spec.tsx
@@ -3,6 +3,7 @@ import { fireEvent, render, screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { IndexingType } from '@/app/components/datasets/create/step-two'
 import { ChunkingMode, DatasetPermission, DataSourceType } from '@/models/datasets'
+import { DatasetACLPermission } from '@/utils/permission'
 import OperationsDropdown from '../operations-dropdown'
 
 describe('OperationsDropdown', () => {
@@ -25,15 +26,21 @@ describe('OperationsDropdown', () => {
     created_by: 'user-1',
     doc_form: ChunkingMode.text,
     runtime_mode: 'general',
+    permission_keys: [
+      DatasetACLPermission.Edit,
+      DatasetACLPermission.Delete,
+      DatasetACLPermission.ImportExportDSL,
+      DatasetACLPermission.AccessConfig,
+    ],
     ...overrides,
   } as DataSet)
 
   const defaultProps = {
     dataset: createMockDataset(),
-    isCurrentWorkspaceDatasetOperator: false,
     openRenameModal: vi.fn(),
     handleExportPipeline: vi.fn(),
     detectIsUsedByApp: vi.fn(),
+    openAccessConfig: vi.fn(),
   }
 
   beforeEach(() => {
@@ -65,38 +72,52 @@ describe('OperationsDropdown', () => {
   })
 
   describe('Props', () => {
-    it('should show delete option when not workspace dataset operator', () => {
-      render(<OperationsDropdown {...defaultProps} isCurrentWorkspaceDatasetOperator={false} />)
+    it('should show delete option when dataset has delete ACL permission', () => {
+      render(<OperationsDropdown {...defaultProps} />)
 
-      const triggerButton = document.querySelector('[class*="cursor-pointer"]')
-      if (triggerButton)
-        fireEvent.click(triggerButton)
+      fireEvent.click(screen.getByLabelText('Dataset operations'))
+
+      expect(screen.getByText('common.operation.delete')).toBeInTheDocument()
     })
 
-    it('should hide delete option when is workspace dataset operator', () => {
-      render(<OperationsDropdown {...defaultProps} isCurrentWorkspaceDatasetOperator={true} />)
+    it('should hide delete option when dataset lacks delete ACL permission', () => {
+      const dataset = createMockDataset({
+        permission_keys: [DatasetACLPermission.Edit],
+      })
+      render(<OperationsDropdown {...defaultProps} dataset={dataset} />)
 
-      const triggerButton = document.querySelector('[class*="cursor-pointer"]')
-      if (triggerButton)
-        fireEvent.click(triggerButton)
+      fireEvent.click(screen.getByLabelText('Dataset operations'))
+
+      expect(screen.queryByText('common.operation.delete')).not.toBeInTheDocument()
     })
 
     it('should show export pipeline when runtime_mode is rag_pipeline', () => {
       const dataset = createMockDataset({ runtime_mode: 'rag_pipeline' })
       render(<OperationsDropdown {...defaultProps} dataset={dataset} />)
 
-      const triggerButton = document.querySelector('[class*="cursor-pointer"]')
-      if (triggerButton)
-        fireEvent.click(triggerButton)
+      fireEvent.click(screen.getByLabelText('Dataset operations'))
+
+      expect(screen.getByText('datasetPipeline.operations.exportPipeline')).toBeInTheDocument()
     })
 
     it('should hide export pipeline when runtime_mode is not rag_pipeline', () => {
       const dataset = createMockDataset({ runtime_mode: 'general' })
       render(<OperationsDropdown {...defaultProps} dataset={dataset} />)
 
-      const triggerButton = document.querySelector('[class*="cursor-pointer"]')
-      if (triggerButton)
-        fireEvent.click(triggerButton)
+      fireEvent.click(screen.getByLabelText('Dataset operations'))
+
+      expect(screen.queryByText('datasetPipeline.operations.exportPipeline')).not.toBeInTheDocument()
+    })
+
+    it('should show resource access option when dataset has access config ACL permission', () => {
+      const dataset = createMockDataset({
+        permission_keys: [DatasetACLPermission.AccessConfig],
+      })
+      render(<OperationsDropdown {...defaultProps} dataset={dataset} />)
+
+      fireEvent.click(screen.getByLabelText('Dataset operations'))
+
+      expect(screen.getByText('common.settings.resourceAccess')).toBeInTheDocument()
     })
   })
 
@@ -181,6 +202,19 @@ describe('OperationsDropdown', () => {
       render(<OperationsDropdown {...defaultProps} detectIsUsedByApp={detectIsUsedByApp} />)
       expect(detectIsUsedByApp).not.toHaveBeenCalled()
     })
+
+    it('should call openAccessConfig when resource access is clicked', () => {
+      const openAccessConfig = vi.fn()
+      const dataset = createMockDataset({
+        permission_keys: [DatasetACLPermission.AccessConfig],
+      })
+      render(<OperationsDropdown {...defaultProps} dataset={dataset} openAccessConfig={openAccessConfig} />)
+
+      fireEvent.click(screen.getByLabelText('Dataset operations'))
+      fireEvent.click(screen.getByText('common.settings.resourceAccess'))
+
+      expect(openAccessConfig).toHaveBeenCalledTimes(1)
+    })
   })
 
   describe('Edge Cases', () => {
diff --git a/web/app/components/datasets/list/dataset-card/components/dataset-card-modals.tsx b/web/app/components/datasets/list/dataset-card/components/dataset-card-modals.tsx
index 47a195943b4..14f0f3c79b0 100644
--- a/web/app/components/datasets/list/dataset-card/components/dataset-card-modals.tsx
+++ b/web/app/components/datasets/list/dataset-card/components/dataset-card-modals.tsx
@@ -15,6 +15,7 @@ import RenameDatasetModal from '../../../rename-modal'
 type ModalState = {
   showRenameModal: boolean
   showConfirmDelete: boolean
+  showAccessConfig: boolean
   confirmMessage: string
 }
 
@@ -23,6 +24,7 @@ type DatasetCardModalsProps = {
   modalState: ModalState
   onCloseRename: () => void
   onCloseConfirm: () => void
+  onCloseAccessConfig: () => void
   onConfirmDelete: () => void
   onSuccess?: () => void
 }
diff --git a/web/app/components/datasets/list/dataset-card/components/operations-dropdown.tsx b/web/app/components/datasets/list/dataset-card/components/operations-dropdown.tsx
index 481819599e0..4032810a07a 100644
--- a/web/app/components/datasets/list/dataset-card/components/operations-dropdown.tsx
+++ b/web/app/components/datasets/list/dataset-card/components/operations-dropdown.tsx
@@ -6,24 +6,40 @@ import {
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
 import * as React from 'react'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import Operations from '../operations'
 
 type OperationsDropdownProps = {
   dataset: DataSet
-  isCurrentWorkspaceDatasetOperator: boolean
   openRenameModal: () => void
   handleExportPipeline: (include?: boolean) => void
   detectIsUsedByApp: () => void
+  openAccessConfig: () => void
 }
 
 const OperationsDropdown = ({
   dataset,
-  isCurrentWorkspaceDatasetOperator,
   openRenameModal,
   handleExportPipeline,
   detectIsUsedByApp,
+  openAccessConfig,
 }: OperationsDropdownProps) => {
   const [open, setOpen] = React.useState(false)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const datasetACLCapabilities = React.useMemo(() => getDatasetACLCapabilities(dataset.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset.maintainer,
+    workspacePermissionKeys,
+  }), [dataset.maintainer, dataset.permission_keys, currentUserId, workspacePermissionKeys])
+  const canShowOperations = datasetACLCapabilities.canEdit
+    || datasetACLCapabilities.canImportExportDSL
+    || datasetACLCapabilities.canAccessConfig
+    || datasetACLCapabilities.canDelete
+
+  if (!canShowOperations)
+    return null
 
   return (
     <div
@@ -53,11 +69,14 @@ const OperationsDropdown = ({
           popupClassName="min-w-[186px]"
         >
           <Operations
-            showDelete={!isCurrentWorkspaceDatasetOperator}
-            showExportPipeline={dataset.runtime_mode === 'rag_pipeline'}
+            showEdit={datasetACLCapabilities.canEdit}
+            showDelete={datasetACLCapabilities.canDelete}
+            showExportPipeline={dataset.runtime_mode === 'rag_pipeline' && datasetACLCapabilities.canImportExportDSL}
+            showAccessConfig={datasetACLCapabilities.canAccessConfig}
             openRenameModal={openRenameModal}
             handleExportPipeline={handleExportPipeline}
             detectIsUsedByApp={detectIsUsedByApp}
+            openAccessConfig={openAccessConfig}
           />
         </DropdownMenuContent>
       </DropdownMenu>
diff --git a/web/app/components/datasets/list/dataset-card/hooks/__tests__/use-dataset-card-state.spec.ts b/web/app/components/datasets/list/dataset-card/hooks/__tests__/use-dataset-card-state.spec.ts
index fa4868f3911..6229fafac2c 100644
--- a/web/app/components/datasets/list/dataset-card/hooks/__tests__/use-dataset-card-state.spec.ts
+++ b/web/app/components/datasets/list/dataset-card/hooks/__tests__/use-dataset-card-state.spec.ts
@@ -20,6 +20,13 @@ vi.mock('@langgenius/dify-ui/toast', () => ({
 const mockCheckUsage = vi.fn()
 const mockDeleteDataset = vi.fn()
 const mockExportPipeline = vi.fn()
+const mockPush = vi.fn()
+
+vi.mock('@/next/navigation', () => ({
+  useRouter: () => ({
+    push: mockPush,
+  }),
+}))
 
 vi.mock('@/service/use-dataset-card', () => ({
   useCheckDatasetUsage: () => ({ mutateAsync: mockCheckUsage }),
diff --git a/web/app/components/datasets/list/dataset-card/hooks/use-dataset-card-state.ts b/web/app/components/datasets/list/dataset-card/hooks/use-dataset-card-state.ts
index 88aa7b50ae9..7a71f2a4df5 100644
--- a/web/app/components/datasets/list/dataset-card/hooks/use-dataset-card-state.ts
+++ b/web/app/components/datasets/list/dataset-card/hooks/use-dataset-card-state.ts
@@ -2,6 +2,7 @@ import type { DataSet } from '@/models/datasets'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useRouter } from '@/next/navigation'
 import { useCheckDatasetUsage, useDeleteDataset } from '@/service/use-dataset-card'
 import { useExportPipelineDSL } from '@/service/use-pipeline'
 import { downloadBlob } from '@/utils/download'
@@ -9,6 +10,7 @@ import { downloadBlob } from '@/utils/download'
 type ModalState = {
   showRenameModal: boolean
   showConfirmDelete: boolean
+  showAccessConfig: boolean
   confirmMessage: string
 }
 
@@ -19,11 +21,13 @@ type UseDatasetCardStateOptions = {
 
 export const useDatasetCardState = ({ dataset, onSuccess }: UseDatasetCardStateOptions) => {
   const { t } = useTranslation()
+  const { push } = useRouter()
 
   // Modal state
   const [modalState, setModalState] = useState<ModalState>({
     showRenameModal: false,
     showConfirmDelete: false,
+    showAccessConfig: false,
     confirmMessage: '',
   })
 
@@ -43,6 +47,14 @@ export const useDatasetCardState = ({ dataset, onSuccess }: UseDatasetCardStateO
     setModalState(prev => ({ ...prev, showConfirmDelete: false }))
   }, [])
 
+  const openAccessConfig = useCallback(() => {
+    push(`/datasets/${dataset.id}/access-config`)
+  }, [dataset.id, push])
+
+  const closeAccessConfig = useCallback(() => {
+    setModalState(prev => ({ ...prev, showAccessConfig: false }))
+  }, [])
+
   // API mutations
   const { mutateAsync: checkUsage } = useCheckDatasetUsage()
   const { mutateAsync: deleteDatasetMutation } = useDeleteDataset()
@@ -112,6 +124,8 @@ export const useDatasetCardState = ({ dataset, onSuccess }: UseDatasetCardStateO
     openRenameModal,
     closeRenameModal,
     closeConfirmDelete,
+    openAccessConfig,
+    closeAccessConfig,
 
     // Export state
     exporting,
diff --git a/web/app/components/datasets/list/dataset-card/index.tsx b/web/app/components/datasets/list/dataset-card/index.tsx
index c68e31f0a6c..aee6b54fd93 100644
--- a/web/app/components/datasets/list/dataset-card/index.tsx
+++ b/web/app/components/datasets/list/dataset-card/index.tsx
@@ -4,6 +4,7 @@ import { useMemo } from 'react'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { DatasetCardTags } from '@/features/tag-management/components/dataset-card-tags'
 import { useRouter } from '@/next/navigation'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import CornerLabels from './components/corner-labels'
 import DatasetCardFooter from './components/dataset-card-footer'
 import DatasetCardHeader from './components/dataset-card-header'
@@ -26,8 +27,8 @@ const DatasetCard = ({
   onOpenTagManagement = () => {},
 }: DatasetCardProps) => {
   const { push } = useRouter()
-
-  const isCurrentWorkspaceDatasetOperator = useAppContextWithSelector(state => state.isCurrentWorkspaceDatasetOperator)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
 
   const datasetCard = useDatasetCardController({ dataset, onSuccess })
   const {
@@ -35,6 +36,8 @@ const DatasetCard = ({
     openRenameModal,
     closeRenameModal,
     closeConfirmDelete,
+    openAccessConfig,
+    closeAccessConfig,
     handleExportPipeline,
     detectIsUsedByApp,
     onConfirmDelete,
@@ -44,15 +47,25 @@ const DatasetCard = ({
   const isPipelineUnpublished = useMemo(() => {
     return dataset.runtime_mode === 'rag_pipeline' && !dataset.is_published
   }, [dataset.runtime_mode, dataset.is_published])
+  const datasetACLCapabilities = useMemo(() => getDatasetACLCapabilities(dataset.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset.maintainer,
+    workspacePermissionKeys,
+  }), [dataset.maintainer, dataset.permission_keys, currentUserId, workspacePermissionKeys])
 
   const handleCardClick = (e: React.MouseEvent) => {
     e.preventDefault()
-    if (isExternalProvider)
-      push(`/datasets/${dataset.id}/hitTesting`)
-    else if (isPipelineUnpublished)
+    if (isExternalProvider) {
+      push(datasetACLCapabilities.canRetrievalRecall
+        ? `/datasets/${dataset.id}/hitTesting`
+        : `/datasets/${dataset.id}/settings`)
+    }
+    else if (isPipelineUnpublished) {
       push(`/datasets/${dataset.id}/pipeline`)
-    else
+    }
+    else {
       push(`/datasets/${dataset.id}/documents`)
+    }
   }
 
   const handleTagAreaClick = (e: React.MouseEvent) => {
@@ -77,14 +90,15 @@ const DatasetCard = ({
           onClick={handleTagAreaClick}
           onOpenTagManagement={onOpenTagManagement}
           onTagsChange={onSuccess}
+          canBindOrUnbindTags={datasetACLCapabilities.canEdit}
         />
         <DatasetCardFooter dataset={dataset} />
         <OperationsDropdown
           dataset={dataset}
-          isCurrentWorkspaceDatasetOperator={isCurrentWorkspaceDatasetOperator}
           openRenameModal={openRenameModal}
           handleExportPipeline={handleExportPipeline}
           detectIsUsedByApp={detectIsUsedByApp}
+          openAccessConfig={openAccessConfig}
         />
       </div>
       <DatasetCardModals
@@ -92,6 +106,7 @@ const DatasetCard = ({
         modalState={modalState}
         onCloseRename={closeRenameModal}
         onCloseConfirm={closeConfirmDelete}
+        onCloseAccessConfig={closeAccessConfig}
         onConfirmDelete={onConfirmDelete}
         onSuccess={onSuccess}
       />
diff --git a/web/app/components/datasets/list/dataset-card/operations.tsx b/web/app/components/datasets/list/dataset-card/operations.tsx
index 1349ae05e72..70fffa97693 100644
--- a/web/app/components/datasets/list/dataset-card/operations.tsx
+++ b/web/app/components/datasets/list/dataset-card/operations.tsx
@@ -6,20 +6,26 @@ import * as React from 'react'
 import { useTranslation } from 'react-i18next'
 
 type OperationsProps = {
+  showEdit?: boolean
   showDelete: boolean
   showExportPipeline: boolean
+  showAccessConfig?: boolean
   openRenameModal: () => void
   handleExportPipeline: () => void
   detectIsUsedByApp: () => void
+  openAccessConfig: () => void
   onClose?: () => void
 }
 
 const Operations = ({
+  showEdit = true,
   showDelete,
   showExportPipeline,
+  showAccessConfig = false,
   openRenameModal,
   handleExportPipeline,
   detectIsUsedByApp,
+  openAccessConfig,
   onClose,
 }: OperationsProps) => {
   const { t } = useTranslation()
@@ -39,23 +45,36 @@ const Operations = ({
     detectIsUsedByApp()
   }
 
+  const handleAccessConfig = () => {
+    onClose?.()
+    openAccessConfig()
+  }
+
   return (
     <>
-      <DropdownMenuItem onClick={handleRename}>
-        <span aria-hidden className="i-ri-edit-line size-4 text-text-tertiary" />
-        {t('operation.edit', { ns: 'common' })}
-      </DropdownMenuItem>
+      {showEdit && (
+        <DropdownMenuItem onClick={handleRename}>
+          <span aria-hidden className="mr-1 i-ri-edit-line size-4 text-text-tertiary" />
+          {t('operation.edit', { ns: 'common' })}
+        </DropdownMenuItem>
+      )}
       {showExportPipeline && (
         <DropdownMenuItem onClick={handleExport}>
-          <span aria-hidden className="i-ri-file-download-line size-4 text-text-tertiary" />
+          <span aria-hidden className="mr-1 i-ri-file-download-line size-4 text-text-tertiary" />
           {t('operations.exportPipeline', { ns: 'datasetPipeline' })}
         </DropdownMenuItem>
       )}
+      {showAccessConfig && (
+        <DropdownMenuItem onClick={handleAccessConfig}>
+          <span aria-hidden className="mr-1 i-ri-lock-line size-4 text-text-tertiary" />
+          {t('settings.resourceAccess', { ns: 'common' })}
+        </DropdownMenuItem>
+      )}
       {showDelete && (
         <>
           <DropdownMenuSeparator />
           <DropdownMenuItem variant="destructive" onClick={handleDelete}>
-            <span aria-hidden className="i-ri-delete-bin-line size-4" />
+            <span aria-hidden className="mr-1 i-ri-delete-bin-line size-4" />
             {t('operation.delete', { ns: 'common' })}
           </DropdownMenuItem>
         </>
diff --git a/web/app/components/datasets/list/first-empty-state/__tests__/index.spec.tsx b/web/app/components/datasets/list/first-empty-state/__tests__/index.spec.tsx
index 4186027af62..a1e3e7a7b90 100644
--- a/web/app/components/datasets/list/first-empty-state/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/list/first-empty-state/__tests__/index.spec.tsx
@@ -9,11 +9,25 @@ vi.mock('@/next/link', () => ({
 
 describe('DatasetFirstEmptyState', () => {
   it('uses the pipeline icon for the create-from-pipeline action', () => {
-    render(<DatasetFirstEmptyState />)
+    render(<DatasetFirstEmptyState canConnectExternalDataset canCreateDataset />)
 
     const pipelineLink = screen.getByRole('link', { name: /dataset\.firstEmpty\.pipelineTitle/ })
 
     expect(pipelineLink).toHaveAttribute('href', '/datasets/create-from-pipeline')
     expect(pipelineLink.querySelector('.i-custom-vender-pipeline-pipeline-line')).toBeInTheDocument()
   })
+
+  it('should hide dataset creation actions when dataset.create_and_management is unavailable', () => {
+    render(<DatasetFirstEmptyState canConnectExternalDataset canCreateDataset={false} />)
+
+    expect(screen.queryByRole('link', { name: /dataset\.firstEmpty\.createTitle/ })).not.toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /dataset\.firstEmpty\.pipelineTitle/ })).not.toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /dataset\.connectDataset/ })).toHaveAttribute('href', '/datasets/connect')
+  })
+
+  it('should render nothing when no empty-state action is available', () => {
+    const { container } = render(<DatasetFirstEmptyState canConnectExternalDataset={false} canCreateDataset={false} />)
+
+    expect(container).toBeEmptyDOMElement()
+  })
 })
diff --git a/web/app/components/datasets/list/first-empty-state/index.tsx b/web/app/components/datasets/list/first-empty-state/index.tsx
index 7294fd81273..bdfcabf439f 100644
--- a/web/app/components/datasets/list/first-empty-state/index.tsx
+++ b/web/app/components/datasets/list/first-empty-state/index.tsx
@@ -13,33 +13,49 @@ type EmptyCreateAction = {
   description: string
 }
 
-function DatasetFirstEmptyState() {
+type DatasetFirstEmptyStateProps = {
+  canConnectExternalDataset: boolean
+  canCreateDataset: boolean
+}
+
+function DatasetFirstEmptyState({
+  canConnectExternalDataset,
+  canCreateDataset,
+}: DatasetFirstEmptyStateProps) {
   const { t } = useTranslation()
 
-  const actions: EmptyCreateAction[] = [
-    {
-      badge: t('firstEmpty.recommended', { ns: 'dataset' }),
-      href: '/datasets/create',
-      icon: <span aria-hidden className="i-ri-add-line size-4" />,
-      id: 'create',
-      title: t('firstEmpty.createTitle', { ns: 'dataset' }),
-      description: t('firstEmpty.createDescription', { ns: 'dataset' }),
-    },
-    {
-      href: '/datasets/create-from-pipeline',
-      icon: <span aria-hidden className="i-custom-vender-pipeline-pipeline-line size-4" />,
-      id: 'pipeline',
-      title: t('firstEmpty.pipelineTitle', { ns: 'dataset' }),
-      description: t('firstEmpty.pipelineDescription', { ns: 'dataset' }),
-    },
-    {
-      href: '/datasets/connect',
-      icon: <span aria-hidden className="i-custom-vender-solid-development-api-connection-mod size-4" />,
-      id: 'connect',
-      title: t('connectDataset', { ns: 'dataset' }),
-      description: t('firstEmpty.connectDescription', { ns: 'dataset' }),
-    },
-  ]
+  const createActions: EmptyCreateAction[] = canCreateDataset
+    ? [
+        {
+          badge: t('firstEmpty.recommended', { ns: 'dataset' }),
+          href: '/datasets/create',
+          icon: <span aria-hidden className="i-ri-add-line size-4" />,
+          id: 'create',
+          title: t('firstEmpty.createTitle', { ns: 'dataset' }),
+          description: t('firstEmpty.createDescription', { ns: 'dataset' }),
+        },
+        {
+          href: '/datasets/create-from-pipeline',
+          icon: <span aria-hidden className="i-custom-vender-pipeline-pipeline-line size-4" />,
+          id: 'pipeline',
+          title: t('firstEmpty.pipelineTitle', { ns: 'dataset' }),
+          description: t('firstEmpty.pipelineDescription', { ns: 'dataset' }),
+        },
+      ]
+    : []
+  const connectAction: EmptyCreateAction | undefined = canConnectExternalDataset
+    ? {
+        href: '/datasets/connect',
+        icon: <span aria-hidden className="i-custom-vender-solid-development-api-connection-mod size-4" />,
+        id: 'connect',
+        title: t('connectDataset', { ns: 'dataset' }),
+        description: t('firstEmpty.connectDescription', { ns: 'dataset' }),
+      }
+    : undefined
+  const hasActions = createActions.length > 0 || !!connectAction
+
+  if (!hasActions)
+    return null
 
   return (
     <div className="flex grow flex-col overflow-hidden">
@@ -63,31 +79,37 @@ function DatasetFirstEmptyState() {
               </h2>
             </div>
             <div className="flex w-full flex-col gap-2 pb-8">
-              <div className="flex flex-col gap-2">
-                {actions.slice(0, 2).map(action => (
-                  <FirstEmptyActionCard
-                    key={action.id}
-                    badge={action.badge}
-                    description={action.description}
-                    href={action.href}
-                    icon={action.icon}
-                    title={action.title}
-                    visualStyle="list"
-                  />
-                ))}
-              </div>
-              <div className="flex items-center gap-2 text-text-tertiary">
-                <div className="h-px min-w-0 flex-1 bg-linear-to-r from-background-body/0 to-divider-regular" />
-                <span className="system-xs-medium-uppercase uppercase">{t('firstEmpty.or', { ns: 'dataset' })}</span>
-                <div className="h-px min-w-0 flex-1 bg-linear-to-r from-divider-regular to-background-body/0" />
-              </div>
-              <FirstEmptyActionCard
-                description={actions[2]!.description}
-                href={actions[2]!.href}
-                icon={actions[2]!.icon}
-                title={actions[2]!.title}
-                visualStyle="list"
-              />
+              {createActions.length > 0 && (
+                <div className="flex flex-col gap-2">
+                  {createActions.map(action => (
+                    <FirstEmptyActionCard
+                      key={action.id}
+                      badge={action.badge}
+                      description={action.description}
+                      href={action.href}
+                      icon={action.icon}
+                      title={action.title}
+                      visualStyle="list"
+                    />
+                  ))}
+                </div>
+              )}
+              {createActions.length > 0 && connectAction && (
+                <div className="flex items-center gap-2 text-text-tertiary">
+                  <div className="h-px min-w-0 flex-1 bg-linear-to-r from-background-body/0 to-divider-regular" />
+                  <span className="system-xs-medium-uppercase uppercase">{t('firstEmpty.or', { ns: 'dataset' })}</span>
+                  <div className="h-px min-w-0 flex-1 bg-linear-to-r from-divider-regular to-background-body/0" />
+                </div>
+              )}
+              {connectAction && (
+                <FirstEmptyActionCard
+                  description={connectAction.description}
+                  href={connectAction.href}
+                  icon={connectAction.icon}
+                  title={connectAction.title}
+                  visualStyle="list"
+                />
+              )}
             </div>
           </div>
         </section>
diff --git a/web/app/components/datasets/list/header.tsx b/web/app/components/datasets/list/header.tsx
index 8ffbe741f66..85508625801 100644
--- a/web/app/components/datasets/list/header.tsx
+++ b/web/app/components/datasets/list/header.tsx
@@ -10,9 +10,9 @@ import ServiceApi from '../extra-info/service-api'
 
 type Props = {
   apiBaseUrl: string
+  canConnectExternalDataset: boolean
+  canCreateDataset: boolean
   includeAll: boolean
-  isCurrentWorkspaceEditor: boolean
-  isCurrentWorkspaceManager: boolean
   isCurrentWorkspaceOwner: boolean
   keywords: string
   tagFilterValue: string[]
@@ -28,9 +28,9 @@ type Props = {
 
 const DatasetListHeader = ({
   apiBaseUrl,
+  canConnectExternalDataset,
+  canCreateDataset,
   includeAll,
-  isCurrentWorkspaceEditor,
-  isCurrentWorkspaceManager,
   isCurrentWorkspaceOwner,
   keywords,
   tagFilterValue,
@@ -44,23 +44,24 @@ const DatasetListHeader = ({
   onTagsChange,
 }: Props) => {
   const { t } = useTranslation()
+  const showCreateMenu = canCreateDataset || canConnectExternalDataset
 
   return (
     <div className="sticky top-0 z-10 flex flex-col gap-[14px] bg-background-body px-8 pt-4 pb-2">
       <div className="flex h-6 w-full items-center gap-2">
         <h1 className="min-w-0 flex-1 text-[18px]/[21.6px] font-semibold text-text-primary">{t('knowledge', { ns: 'dataset' })}</h1>
         <div className="flex shrink-0 items-center gap-2">
-          <button
-            type="button"
-            className="flex items-center justify-center gap-1 overflow-hidden rounded-md px-1.5 py-1 text-text-tertiary hover:bg-state-base-hover"
-            onClick={onExternalApiClick}
-          >
-            <span aria-hidden className="i-custom-vender-solid-development-api-connection-mod size-3.5 shrink-0" />
-            <span className="px-0.5 system-xs-medium">{t('externalAPIPanelTitle', { ns: 'dataset' })}</span>
-          </button>
-          {isCurrentWorkspaceManager && (
-            <ServiceApi apiBaseUrl={apiBaseUrl} />
+          {canConnectExternalDataset && (
+            <button
+              type="button"
+              className="flex items-center justify-center gap-1 overflow-hidden rounded-md px-1.5 py-1 text-text-tertiary hover:bg-state-base-hover"
+              onClick={onExternalApiClick}
+            >
+              <span aria-hidden className="i-custom-vender-solid-development-api-connection-mod size-3.5 shrink-0" />
+              <span className="px-0.5 system-xs-medium">{t('externalAPIPanelTitle', { ns: 'dataset' })}</span>
+            </button>
           )}
+          <ServiceApi apiBaseUrl={apiBaseUrl} />
         </div>
       </div>
       <div className="flex flex-wrap items-center justify-between gap-2">
@@ -92,7 +93,7 @@ const DatasetListHeader = ({
           )}
         </div>
         <div className="flex items-center gap-2">
-          {isCurrentWorkspaceEditor && (
+          {showCreateMenu && (
             <DropdownMenu modal={false}>
               <DropdownMenuTrigger
                 render={(
@@ -112,28 +113,36 @@ const DatasetListHeader = ({
                 sideOffset={4}
                 popupClassName="w-80"
               >
-                <DropdownMenuItem
-                  className="h-8 gap-1 rounded-lg px-2 py-1 system-md-regular text-text-secondary"
-                  onClick={onCreateDataset}
-                >
-                  <span aria-hidden className="i-ri-add-line size-4 shrink-0 text-text-secondary" />
-                  <span className="min-w-0 flex-1 truncate px-1">{t('firstEmpty.createTitle', { ns: 'dataset' })}</span>
-                </DropdownMenuItem>
-                <DropdownMenuItem
-                  className="h-8 gap-1 rounded-lg px-2 py-1 system-md-regular text-text-secondary"
-                  onClick={onCreateFromPipeline}
-                >
-                  <span aria-hidden className="i-custom-vender-pipeline-pipeline-line size-4 shrink-0 text-text-secondary" />
-                  <span className="min-w-0 flex-1 truncate px-1">{t('firstEmpty.pipelineTitle', { ns: 'dataset' })}</span>
-                </DropdownMenuItem>
-                <DropdownMenuSeparator className="my-1" />
-                <DropdownMenuItem
-                  className="h-8 gap-1 rounded-lg px-2 py-1 system-md-regular text-text-secondary"
-                  onClick={onConnectDataset}
-                >
-                  <span aria-hidden className="i-custom-vender-solid-development-api-connection-mod size-4 shrink-0 text-text-secondary" />
-                  <span className="min-w-0 flex-1 truncate px-1">{t('connectDataset', { ns: 'dataset' })}</span>
-                </DropdownMenuItem>
+                {canCreateDataset && (
+                  <>
+                    <DropdownMenuItem
+                      className="h-8 gap-1 rounded-lg px-2 py-1 system-md-regular text-text-secondary"
+                      onClick={onCreateDataset}
+                    >
+                      <span aria-hidden className="i-ri-add-line size-4 shrink-0 text-text-secondary" />
+                      <span className="min-w-0 flex-1 truncate px-1">{t('firstEmpty.createTitle', { ns: 'dataset' })}</span>
+                    </DropdownMenuItem>
+                    <DropdownMenuItem
+                      className="h-8 gap-1 rounded-lg px-2 py-1 system-md-regular text-text-secondary"
+                      onClick={onCreateFromPipeline}
+                    >
+                      <span aria-hidden className="i-custom-vender-pipeline-pipeline-line size-4 shrink-0 text-text-secondary" />
+                      <span className="min-w-0 flex-1 truncate px-1">{t('firstEmpty.pipelineTitle', { ns: 'dataset' })}</span>
+                    </DropdownMenuItem>
+                  </>
+                )}
+                {canCreateDataset && canConnectExternalDataset && (
+                  <DropdownMenuSeparator className="my-1" />
+                )}
+                {canConnectExternalDataset && (
+                  <DropdownMenuItem
+                    className="h-8 gap-1 rounded-lg px-2 py-1 system-md-regular text-text-secondary"
+                    onClick={onConnectDataset}
+                  >
+                    <span aria-hidden className="i-custom-vender-solid-development-api-connection-mod size-4 shrink-0 text-text-secondary" />
+                    <span className="min-w-0 flex-1 truncate px-1">{t('connectDataset', { ns: 'dataset' })}</span>
+                  </DropdownMenuItem>
+                )}
               </DropdownMenuContent>
             </DropdownMenu>
           )}
diff --git a/web/app/components/datasets/list/index.tsx b/web/app/components/datasets/list/index.tsx
index a1ebe6649da..ba1d7cb5565 100644
--- a/web/app/components/datasets/list/index.tsx
+++ b/web/app/components/datasets/list/index.tsx
@@ -11,6 +11,7 @@ import { TagManagementModal } from '@/features/tag-management/components/tag-man
 import useDocumentTitle from '@/hooks/use-document-title'
 import { useRouter } from '@/next/navigation'
 import { useDatasetApiBaseUrl, useDatasetList, useInvalidDatasetList } from '@/service/knowledge/use-dataset'
+import { hasPermission } from '@/utils/permission'
 // Components
 import FilterEmptyState from '../../base/filter-empty-state'
 import ExternalAPIPanel from '../external-api/external-api-panel'
@@ -47,8 +48,9 @@ const List = () => {
     handleTagsUpdate()
   }
 
-  const isCurrentWorkspaceManager = useAppContextSelector(state => state.isCurrentWorkspaceManager)
-  const isCurrentWorkspaceEditor = useAppContextSelector(state => state.isCurrentWorkspaceEditor)
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+  const canCreateDataset = hasPermission(workspacePermissionKeys, 'dataset.create_and_management')
+  const canConnectExternalDataset = hasPermission(workspacePermissionKeys, 'dataset.external.connect')
   const { data: apiBaseInfo } = useDatasetApiBaseUrl()
   const datasetListQuery = useDatasetList({
     initialPage: 1,
@@ -61,7 +63,7 @@ const List = () => {
   const hasResolvedFirstPage = pages.length > 0
   const hasAnyDataset = (pages[0]?.total ?? 0) > 0
   const hasActiveFilters = tagIDs.length > 0 || keywords.trim().length > 0 || searchKeywords.trim().length > 0 || includeAll
-  const showEmptyDataList = !hasAnyDataset && isCurrentWorkspaceEditor && hasResolvedFirstPage && !hasActiveFilters
+  const showEmptyDataList = !hasAnyDataset && (canCreateDataset || canConnectExternalDataset) && hasResolvedFirstPage && !hasActiveFilters
   const showFilteredEmptyState = !hasAnyDataset && hasResolvedFirstPage && hasActiveFilters
 
   return (
@@ -71,9 +73,9 @@ const List = () => {
             <>
               <DatasetListHeader
                 apiBaseUrl={apiBaseInfo?.api_base_url ?? ''}
+                canConnectExternalDataset={canConnectExternalDataset}
+                canCreateDataset={canCreateDataset}
                 includeAll={includeAll}
-                isCurrentWorkspaceEditor={isCurrentWorkspaceEditor}
-                isCurrentWorkspaceManager={isCurrentWorkspaceManager}
                 isCurrentWorkspaceOwner={isCurrentWorkspaceOwner}
                 keywords={keywords}
                 tagFilterValue={tagFilterValue}
@@ -86,16 +88,19 @@ const List = () => {
                 onOpenTagManagement={() => setShowTagManagementModal(true)}
                 onTagsChange={handleTagsChange}
               />
-              <DatasetFirstEmptyState />
+              <DatasetFirstEmptyState
+                canConnectExternalDataset={canConnectExternalDataset}
+                canCreateDataset={canCreateDataset}
+              />
             </>
           )
         : (
             <>
               <DatasetListHeader
                 apiBaseUrl={apiBaseInfo?.api_base_url ?? ''}
+                canConnectExternalDataset={canConnectExternalDataset}
+                canCreateDataset={canCreateDataset}
                 includeAll={includeAll}
-                isCurrentWorkspaceEditor={isCurrentWorkspaceEditor}
-                isCurrentWorkspaceManager={isCurrentWorkspaceManager}
                 isCurrentWorkspaceOwner={isCurrentWorkspaceOwner}
                 keywords={keywords}
                 tagFilterValue={tagFilterValue}
@@ -127,7 +132,12 @@ const List = () => {
         onClose={() => setShowTagManagementModal(false)}
         onTagsChange={invalidDatasetList}
       />
-      {showExternalApiPanel && <ExternalAPIPanel onClose={() => setShowExternalApiPanel(false)} />}
+      {showExternalApiPanel && canConnectExternalDataset && (
+        <ExternalAPIPanel
+          canManageExternalKnowledgeApi={canConnectExternalDataset}
+          onClose={() => setShowExternalApiPanel(false)}
+        />
+      )}
     </div>
   )
 }
diff --git a/web/app/components/datasets/list/new-dataset-card/__tests__/index.spec.tsx b/web/app/components/datasets/list/new-dataset-card/__tests__/index.spec.tsx
index 4d360eecb91..2b4e22317d9 100644
--- a/web/app/components/datasets/list/new-dataset-card/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/list/new-dataset-card/__tests__/index.spec.tsx
@@ -3,6 +3,12 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import NewDatasetCard from '../index'
 import Option from '../option'
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: ['dataset.create_and_management', 'dataset.external.connect'],
+  }),
+}))
+
 describe('New Dataset Card Integration', () => {
   beforeEach(() => {
     vi.clearAllMocks()
diff --git a/web/app/components/datasets/list/new-dataset-card/option.tsx b/web/app/components/datasets/list/new-dataset-card/option.tsx
index 1650b58dd10..8016f5f1a11 100644
--- a/web/app/components/datasets/list/new-dataset-card/option.tsx
+++ b/web/app/components/datasets/list/new-dataset-card/option.tsx
@@ -10,13 +10,28 @@ type OptionProps = {
   iconClassName: string
   text: string
   href: string
+  disabled?: boolean
 }
 
 const Option = ({
   iconClassName,
   text,
   href,
+  disabled = false,
 }: OptionProps) => {
+  if (disabled) {
+    return (
+      <div
+        className={cn(
+          'flex w-full cursor-not-allowed items-center gap-x-2 rounded-lg bg-transparent px-4 py-2 text-text-tertiary opacity-50 shadow-shadow-shadow-3',
+        )}
+      >
+        <span aria-hidden="true" className={cn(iconClassName, 'h-4 w-4 shrink-0')} />
+        <span className="grow text-left system-sm-medium">{text}</span>
+      </div>
+    )
+  }
+
   return (
     <Link
       type="button"
diff --git a/web/app/components/datasets/metadata/metadata-document/__tests__/index.spec.tsx b/web/app/components/datasets/metadata/metadata-document/__tests__/index.spec.tsx
index bf155aa9ace..815bd27c6cd 100644
--- a/web/app/components/datasets/metadata/metadata-document/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/metadata/metadata-document/__tests__/index.spec.tsx
@@ -103,6 +103,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
       expect(container.firstChild)!.toBeInTheDocument()
@@ -114,6 +115,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
       expect(screen.getByText('field_one'))!.toBeInTheDocument()
@@ -134,6 +136,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
       expect(screen.getAllByText(/metadata/i).length).toBeGreaterThan(0)
@@ -150,6 +153,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -169,6 +173,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -187,6 +192,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -205,6 +211,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -222,6 +229,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -242,6 +250,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -253,17 +262,42 @@ describe('MetadataDocument', () => {
   })
 
   describe('Edit Mode', () => {
-    it('should show edit button when not in edit mode and embedding available', () => {
+    it('should show edit button when not in edit mode, embedding available, and canEdit is true', () => {
       render(
         <MetadataDocument
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
       expect(screen.getByText(/edit/i))!.toBeInTheDocument()
     })
 
+    it('should hide edit button by default when canEdit is omitted', () => {
+      render(
+        <MetadataDocument
+          datasetId="ds-1"
+          documentId="doc-1"
+          docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
+        />,
+      )
+      expect(screen.queryByText(/^edit$/i)).not.toBeInTheDocument()
+    })
+
+    it('should hide edit button when canEdit is false', () => {
+      render(
+        <MetadataDocument
+          datasetId="ds-1"
+          documentId="doc-1"
+          docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit={false}
+        />,
+      )
+      expect(screen.queryByText(/^edit$/i)).not.toBeInTheDocument()
+    })
+
     it('should call startToEdit when edit button is clicked', () => {
       const startToEdit = vi.fn()
       mockUseMetadataDocument.mockReturnValue({
@@ -277,6 +311,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -297,6 +332,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -317,6 +353,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -340,6 +377,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -364,6 +402,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -388,6 +427,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -412,6 +452,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -431,6 +472,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -454,6 +496,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -478,6 +521,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -714,6 +758,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
@@ -731,6 +776,7 @@ describe('MetadataDocument', () => {
           datasetId="ds-1"
           documentId="doc-1"
           docDetail={mockDocDetail as Parameters<typeof MetadataDocument>[0]['docDetail']}
+          canEdit
         />,
       )
 
diff --git a/web/app/components/datasets/metadata/metadata-document/index.tsx b/web/app/components/datasets/metadata/metadata-document/index.tsx
index c54b99edbc1..56391acb8ec 100644
--- a/web/app/components/datasets/metadata/metadata-document/index.tsx
+++ b/web/app/components/datasets/metadata/metadata-document/index.tsx
@@ -3,7 +3,6 @@ import type { FC } from 'react'
 import type { FullDocumentDetail } from '@/models/datasets'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
-import { RiEditLine } from '@remixicon/react'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
 import Divider from '@/app/components/base/divider'
@@ -18,12 +17,14 @@ type Props = Readonly<{
   documentId: string
   className?: string
   docDetail: FullDocumentDetail
+  canEdit?: boolean
 }>
 const MetadataDocument: FC<Props> = ({
   datasetId,
   documentId,
   className,
   docDetail,
+  canEdit = false,
 }) => {
   const { t } = useTranslation()
 
@@ -57,7 +58,7 @@ const MetadataDocument: FC<Props> = ({
                 titleTooltip={t(`${i18nPrefix}.metadataToolTip`, { ns: 'dataset' })}
                 list={isEdit ? tempList : list}
                 dataSetId={datasetId}
-                headerRight={embeddingAvailable && (isEdit
+                headerRight={embeddingAvailable && canEdit && (isEdit
                   ? (
                       <div className="flex space-x-1">
                         <Button variant="ghost" size="small" onClick={handleCancel}>
@@ -70,7 +71,7 @@ const MetadataDocument: FC<Props> = ({
                     )
                   : (
                       <Button variant="ghost" size="small" onClick={startToEdit}>
-                        <RiEditLine className="mr-1 size-3.5 cursor-pointer text-text-tertiary" />
+                        <span className="mr-1 i-ri-edit-line size-3.5 cursor-pointer text-text-tertiary" />
                         <div>{t('operation.edit', { ns: 'common' })}</div>
                       </Button>
                     ))}
@@ -90,7 +91,7 @@ const MetadataDocument: FC<Props> = ({
             </div>
           )
         : (
-            embeddingAvailable && <NoData onStart={() => setIsEdit(true)} />
+            embeddingAvailable && canEdit && <NoData onStart={() => setIsEdit(true)} />
           )}
       {builtInEnabled && (
         <div className="pl-2">
diff --git a/web/app/components/datasets/preview/__tests__/container.spec.tsx b/web/app/components/datasets/preview/__tests__/container.spec.tsx
index 473d91f8574..9f7ff17522a 100644
--- a/web/app/components/datasets/preview/__tests__/container.spec.tsx
+++ b/web/app/components/datasets/preview/__tests__/container.spec.tsx
@@ -2,7 +2,7 @@ import { render, screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import PreviewContainer from '../container'
 
-// Tests for PreviewContainer - a layout wrapper with header and scrollable main area
+// Tests for PreviewContainer - a layout wrapper with header and scrollable content area
 describe('PreviewContainer', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -17,11 +17,11 @@ describe('PreviewContainer', () => {
       expect(headerEl)!.toBeInTheDocument()
     })
 
-    it('should render children in a main element', () => {
-      render(<PreviewContainer header="Header">Main content</PreviewContainer>)
+    it('should render children in the content area', () => {
+      render(<PreviewContainer header="Header" data-testid="inner-container">Main content</PreviewContainer>)
 
-      const mainEl = screen.getByRole('main')
-      expect(mainEl)!.toHaveTextContent('Main content')
+      const contentEl = screen.getByTestId('inner-container').lastElementChild
+      expect(contentEl)!.toHaveTextContent('Main content')
     })
 
     it('should render both header and children simultaneously', () => {
@@ -36,10 +36,11 @@ describe('PreviewContainer', () => {
     })
 
     it('should render without children', () => {
-      render(<PreviewContainer header="Header" />)
+      render(<PreviewContainer header="Header" data-testid="inner-container" />)
 
-      expect(screen.getByRole('main'))!.toBeInTheDocument()
-      expect(screen.getByRole('main').childElementCount).toBe(0)
+      const contentEl = screen.getByTestId('inner-container').lastElementChild
+      expect(contentEl)!.toBeInTheDocument()
+      expect(contentEl!.childElementCount).toBe(0)
     })
   })
 
@@ -52,16 +53,14 @@ describe('PreviewContainer', () => {
       expect(container.firstElementChild)!.toHaveClass('outer-class')
     })
 
-    it('should apply mainClassName to the main element', () => {
+    it('should apply mainClassName to the content area', () => {
       render(
-        <PreviewContainer header="Header" mainClassName="custom-main">Content</PreviewContainer>,
+        <PreviewContainer header="Header" mainClassName="custom-main" data-testid="inner-container">Content</PreviewContainer>,
       )
 
-      const mainEl = screen.getByRole('main')
-      expect(mainEl)!.toHaveClass('custom-main')
-      // Default classes should still be present
-      // Default classes should still be present
-      expect(mainEl)!.toHaveClass('w-full', 'grow', 'overflow-y-auto', 'px-6', 'py-5')
+      const contentEl = screen.getByTestId('inner-container').lastElementChild
+      expect(contentEl)!.toHaveClass('custom-main')
+      expect(contentEl)!.toHaveClass('w-full', 'grow', 'overflow-y-auto', 'px-6', 'py-5')
     })
 
     it('should forward ref to the inner container div', () => {
@@ -116,10 +115,10 @@ describe('PreviewContainer', () => {
       expect(inner)!.toHaveClass('flex', 'h-full', 'w-full', 'flex-col')
     })
 
-    it('should have main with overflow-y-auto for scrolling', () => {
-      render(<PreviewContainer header="Header">Content</PreviewContainer>)
+    it('should have content area with overflow-y-auto for scrolling', () => {
+      render(<PreviewContainer header="Header" data-testid="inner-container">Content</PreviewContainer>)
 
-      expect(screen.getByRole('main'))!.toHaveClass('overflow-y-auto')
+      expect(screen.getByTestId('inner-container').lastElementChild)!.toHaveClass('overflow-y-auto')
     })
   })
 
@@ -139,9 +138,9 @@ describe('PreviewContainer', () => {
     })
 
     it('should render with null children', () => {
-      render(<PreviewContainer header="Header">{null}</PreviewContainer>)
+      render(<PreviewContainer header="Header" data-testid="inner-container">{null}</PreviewContainer>)
 
-      expect(screen.getByRole('main'))!.toBeInTheDocument()
+      expect(screen.getByTestId('inner-container').lastElementChild)!.toBeInTheDocument()
     })
 
     it('should render with multiple children', () => {
diff --git a/web/app/components/datasets/preview/container.tsx b/web/app/components/datasets/preview/container.tsx
index 742c1e2ac15..c651de6c1f7 100644
--- a/web/app/components/datasets/preview/container.tsx
+++ b/web/app/components/datasets/preview/container.tsx
@@ -19,9 +19,9 @@ const PreviewContainer: FC<PreviewContainerProps> = (props) => {
         <header className="border-b border-divider-subtle pt-4 pr-4 pb-3 pl-5">
           {header}
         </header>
-        <main className={cn('w-full grow overflow-y-auto px-6 py-5', mainClassName)}>
+        <div className={cn('w-full grow overflow-y-auto px-6 py-5', mainClassName)}>
           {children}
-        </main>
+        </div>
       </div>
     </div>
   )
diff --git a/web/app/components/datasets/rename-modal/__tests__/index.spec.tsx b/web/app/components/datasets/rename-modal/__tests__/index.spec.tsx
index 1322d4f6e6b..8fde3275112 100644
--- a/web/app/components/datasets/rename-modal/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/rename-modal/__tests__/index.spec.tsx
@@ -34,6 +34,35 @@ vi.mock('../../../base/app-icon', () => ({
   ),
 }))
 
+vi.mock('@/app/components/base/app-icon-picker', () => ({
+  default: ({
+    onOpenChange,
+    onSelect,
+  }: {
+    onOpenChange: (open: boolean) => void
+    onSelect: (payload: { type: 'emoji', icon: string, background: string }) => void
+  }) => {
+    let selectedBackground = '#FFEAD5'
+    return (
+      <div>
+        <input placeholder="Search emojis..." />
+        <button type="button" aria-label="#E4FBCC" onClick={() => { selectedBackground = '#E4FBCC' }} />
+        <button type="button" aria-label="#E0F2FE" onClick={() => { selectedBackground = '#E0F2FE' }} />
+        <button
+          type="button"
+          onClick={() => {
+            onSelect({ type: 'emoji', icon: '📊', background: selectedBackground })
+            onOpenChange(false)
+          }}
+        >
+          iconPicker.ok
+        </button>
+        <button type="button" onClick={() => onOpenChange(false)}>iconPicker.cancel</button>
+      </div>
+    )
+  },
+}))
+
 // The mock returns 'ns.key' format, e.g., 'common.operation.cancel'
 
 describe('RenameDatasetModal', () => {
diff --git a/web/app/components/datasets/settings/form/__tests__/index.spec.tsx b/web/app/components/datasets/settings/form/__tests__/index.spec.tsx
index 3e5ae330a22..b39f4e54706 100644
--- a/web/app/components/datasets/settings/form/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/settings/form/__tests__/index.spec.tsx
@@ -4,6 +4,7 @@ import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { ChunkingMode, DatasetPermission, DataSourceType } from '@/models/datasets'
 import { expectLoadingButton } from '@/test/button'
 import { RETRIEVE_METHOD } from '@/types/app'
+import { DatasetACLPermission } from '@/utils/permission'
 import { IndexingType } from '../../../create/step-two'
 import Form from '../index'
 
@@ -22,12 +23,25 @@ const mockUserProfile = {
   avatar_url: '',
   role: 'owner',
 }
+let mockWorkspacePermissionKeys = ['dataset.create_and_management']
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useSuspenseQuery: () => ({
+      data: {
+        rbac_enabled: false,
+      },
+    }),
+  }
+})
 
 vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: unknown) => unknown) => {
     const state = {
-      isCurrentWorkspaceDatasetOperator: false,
       userProfile: mockUserProfile,
+      workspacePermissionKeys: mockWorkspacePermissionKeys,
     }
     return selector(state)
   },
@@ -99,6 +113,7 @@ const createMockDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
   runtime_mode: 'general',
   enable_api: true,
   is_multimodal: false,
+  permission_keys: [DatasetACLPermission.Edit],
   ...overrides,
 })
 
@@ -177,7 +192,6 @@ vi.mock('@/context/provider-context', () => ({
     plan: { type: 'free' },
     enableBilling: false,
     onPlanInfoChanged: vi.fn(),
-    isCurrentWorkspaceDatasetOperator: false,
     supportRetrievalMethods: ['semantic_search', 'full_text_search', 'hybrid_search'],
   }),
 }))
@@ -237,6 +251,7 @@ describe('Form', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDataset = createMockDataset()
+    mockWorkspacePermissionKeys = ['dataset.create_and_management']
   })
 
   describe('Rendering', () => {
@@ -460,6 +475,15 @@ describe('Form', () => {
       const descriptionTextarea = screen.getByDisplayValue('Test description')
       expect(descriptionTextarea).toBeDisabled()
     })
+
+    it('should disable save when dataset only has readonly ACL permission', () => {
+      mockWorkspacePermissionKeys = []
+      mockDataset = createMockDataset({ permission_keys: [DatasetACLPermission.Readonly] })
+      render(<Form />)
+
+      const saveButton = screen.getByRole('button', { name: /form\.save/i })
+      expect(saveButton).toBeDisabled()
+    })
   })
 
   describe('Conditional Rendering', () => {
diff --git a/web/app/components/datasets/settings/form/components/__tests__/basic-info-section.spec.tsx b/web/app/components/datasets/settings/form/components/__tests__/basic-info-section.spec.tsx
index 7681d35702a..3c0e997ad57 100644
--- a/web/app/components/datasets/settings/form/components/__tests__/basic-info-section.spec.tsx
+++ b/web/app/components/datasets/settings/form/components/__tests__/basic-info-section.spec.tsx
@@ -7,6 +7,18 @@ import { RETRIEVE_METHOD } from '@/types/app'
 import { IndexingType } from '../../../../create/step-two'
 import BasicInfoSection from '../basic-info-section'
 
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useSuspenseQuery: () => ({
+      data: {
+        rbac_enabled: false,
+      },
+    }),
+  }
+})
+
 // Mock app-context
 vi.mock('@/context/app-context', () => ({
   useSelector: () => ({
@@ -105,8 +117,8 @@ describe('BasicInfoSection', () => {
   }
 
   const mockMemberList: Member[] = [
-    { id: 'user-1', name: 'User 1', email: 'user1@example.com', role: 'owner', avatar: '', avatar_url: '', last_login_at: '', created_at: '', status: 'active' },
-    { id: 'user-2', name: 'User 2', email: 'user2@example.com', role: 'admin', avatar: '', avatar_url: '', last_login_at: '', created_at: '', status: 'active' },
+    { id: 'user-1', name: 'User 1', email: 'user1@example.com', role: 'owner', roles: [], avatar: '', avatar_url: '', last_login_at: '', created_at: '', status: 'active' },
+    { id: 'user-2', name: 'User 2', email: 'user2@example.com', role: 'admin', roles: [], avatar: '', avatar_url: '', last_login_at: '', created_at: '', status: 'active' },
   ]
 
   const mockIconInfo: IconInfo = {
@@ -118,7 +130,6 @@ describe('BasicInfoSection', () => {
 
   const defaultProps = {
     currentDataset: mockDataset,
-    isCurrentWorkspaceDatasetOperator: false,
     name: 'Test Dataset',
     setName: vi.fn(),
     description: 'Test description',
@@ -346,9 +357,9 @@ describe('BasicInfoSection', () => {
       expect(disabledElement)!.toBeInTheDocument()
     })
 
-    it('should be disabled when user is dataset operator', () => {
+    it('should be disabled when form is readonly from dataset ACL editability', () => {
       const { container } = render(
-        <BasicInfoSection {...defaultProps} isCurrentWorkspaceDatasetOperator={true} />,
+        <BasicInfoSection {...defaultProps} readonly />,
       )
 
       const disabledElement = container.querySelector('[class*="cursor-not-allowed"]')
diff --git a/web/app/components/datasets/settings/form/components/basic-info-section.tsx b/web/app/components/datasets/settings/form/components/basic-info-section.tsx
index 17d0a3e6d23..b22d3fc5d0d 100644
--- a/web/app/components/datasets/settings/form/components/basic-info-section.tsx
+++ b/web/app/components/datasets/settings/form/components/basic-info-section.tsx
@@ -15,7 +15,6 @@ const labelClass = 'flex items-center shrink-0 w-[180px] h-7 pt-1'
 
 type BasicInfoSectionProps = {
   currentDataset: DataSet | undefined
-  isCurrentWorkspaceDatasetOperator: boolean
   name: string
   setName: (value: string) => void
   description: string
@@ -30,11 +29,11 @@ type BasicInfoSectionProps = {
   selectedMemberIDs: string[]
   setSelectedMemberIDs: (value: string[]) => void
   memberList: Member[]
+  readonly?: boolean
 }
 
 const BasicInfoSection = ({
   currentDataset,
-  isCurrentWorkspaceDatasetOperator,
   name,
   setName,
   description,
@@ -49,6 +48,7 @@ const BasicInfoSection = ({
   selectedMemberIDs,
   setSelectedMemberIDs,
   memberList,
+  readonly = false,
 }: BasicInfoSectionProps) => {
   const { t } = useTranslation()
 
@@ -62,16 +62,16 @@ const BasicInfoSection = ({
         <div className="flex grow items-center gap-x-2">
           <AppIcon
             size="small"
-            onClick={handleOpenAppIconPicker}
-            className="cursor-pointer"
+            onClick={readonly ? undefined : handleOpenAppIconPicker}
+            className={readonly ? undefined : 'cursor-pointer'}
             iconType={iconInfo.icon_type as AppIconType}
             icon={iconInfo.icon}
             background={iconInfo.icon_background}
             imageUrl={iconInfo.icon_url}
-            showEditIcon
+            showEditIcon={!readonly}
           />
           <Input
-            disabled={!currentDataset?.embedding_available}
+            disabled={!currentDataset?.embedding_available || readonly}
             value={name}
             onChange={e => setName(e.target.value)}
           />
@@ -86,7 +86,7 @@ const BasicInfoSection = ({
         <div className="grow">
           <Textarea
             aria-label={t('form.desc', { ns: 'datasetSettings' })}
-            disabled={!currentDataset?.embedding_available}
+            disabled={!currentDataset?.embedding_available || readonly}
             className="resize-none"
             placeholder={t('form.descPlaceholder', { ns: 'datasetSettings' }) || ''}
             value={description}
@@ -102,7 +102,7 @@ const BasicInfoSection = ({
         </div>
         <div className="grow">
           <PermissionSelector
-            disabled={!currentDataset?.embedding_available || isCurrentWorkspaceDatasetOperator}
+            disabled={!currentDataset?.embedding_available || readonly}
             permission={permission}
             value={selectedMemberIDs}
             onChange={v => setPermission(v)}
diff --git a/web/app/components/datasets/settings/form/components/external-knowledge-section.tsx b/web/app/components/datasets/settings/form/components/external-knowledge-section.tsx
index fb9c0eed720..0e1891ab6f5 100644
--- a/web/app/components/datasets/settings/form/components/external-knowledge-section.tsx
+++ b/web/app/components/datasets/settings/form/components/external-knowledge-section.tsx
@@ -14,6 +14,7 @@ type ExternalKnowledgeSectionProps = {
   scoreThreshold: number
   scoreThresholdEnabled: boolean
   handleSettingsChange: (data: { top_k?: number, score_threshold?: number, score_threshold_enabled?: boolean }) => void
+  readonly?: boolean
 }
 
 const ExternalKnowledgeSection = ({
@@ -22,6 +23,7 @@ const ExternalKnowledgeSection = ({
   scoreThreshold,
   scoreThresholdEnabled,
   handleSettingsChange,
+  readonly = false,
 }: ExternalKnowledgeSectionProps) => {
   const { t } = useTranslation()
 
@@ -40,6 +42,7 @@ const ExternalKnowledgeSection = ({
           scoreThresholdEnabled={scoreThresholdEnabled}
           onChange={handleSettingsChange}
           isInRetrievalSetting={true}
+          readonly={readonly}
         />
       </div>
 
diff --git a/web/app/components/datasets/settings/form/components/indexing-section.tsx b/web/app/components/datasets/settings/form/components/indexing-section.tsx
index 09aceea0f25..c5edcbbbef1 100644
--- a/web/app/components/datasets/settings/form/components/indexing-section.tsx
+++ b/web/app/components/datasets/settings/form/components/indexing-section.tsx
@@ -2,7 +2,6 @@
 import type { DefaultModel, Model } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import type { DataSet, SummaryIndexSetting as SummaryIndexSettingType } from '@/models/datasets'
 import type { RetrievalConfig } from '@/types/app'
-import { RiAlertFill } from '@remixicon/react'
 import { useTranslation } from 'react-i18next'
 import Divider from '@/app/components/base/divider'
 import EconomicalRetrievalMethodConfig from '@/app/components/datasets/common/economical-retrieval-method-config'
@@ -33,6 +32,7 @@ type IndexingSectionProps = {
   summaryIndexSetting: SummaryIndexSettingType | undefined
   handleSummaryIndexSettingChange: (payload: SummaryIndexSettingType) => void
   showMultiModalTip: boolean
+  readonly?: boolean
 }
 
 const IndexingSection = ({
@@ -49,6 +49,7 @@ const IndexingSection = ({
   summaryIndexSetting,
   handleSummaryIndexSettingChange,
   showMultiModalTip,
+  readonly = false,
 }: IndexingSectionProps) => {
   const { t } = useTranslation()
   const docLink = useDocLink()
@@ -108,7 +109,7 @@ const IndexingSection = ({
           <div className="grow">
             <IndexMethod
               value={indexMethod!}
-              disabled={!currentDataset?.embedding_available}
+              disabled={!currentDataset?.embedding_available || readonly}
               onChange={setIndexMethod}
               currentValue={currentDataset.indexing_technique}
               keywordNumber={keywordNumber}
@@ -118,7 +119,7 @@ const IndexingSection = ({
               <div className="relative mt-2 flex h-10 items-center gap-x-0.5 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur px-2 shadow-xs shadow-shadow-shadow-3">
                 <div className="absolute top-0 left-0 flex size-full items-center bg-toast-warning-bg opacity-40" />
                 <div className="p-1">
-                  <RiAlertFill className="size-4 text-text-warning-secondary" />
+                  <span className="i-ri-alert-fill size-4 text-text-warning-secondary" />
                 </div>
                 <span className="system-xs-medium text-text-primary">
                   {t('form.upgradeHighQualityTip', { ns: 'datasetSettings' })}
@@ -142,6 +143,7 @@ const IndexingSection = ({
               defaultModel={embeddingModel}
               modelList={embeddingModelList}
               onSelect={setEmbeddingModel}
+              readonly={readonly}
             />
           </div>
         </div>
@@ -155,6 +157,7 @@ const IndexingSection = ({
             entry="dataset-settings"
             summaryIndexSetting={summaryIndexSetting}
             onSummaryIndexSettingChange={handleSummaryIndexSettingChange}
+            readonly={readonly}
           />
         </>
       )}
@@ -189,12 +192,14 @@ const IndexingSection = ({
                       value={retrievalConfig}
                       onChange={setRetrievalConfig}
                       showMultiModalTip={showMultiModalTip}
+                      disabled={readonly}
                     />
                   )
                 : (
                     <EconomicalRetrievalMethodConfig
                       value={retrievalConfig}
                       onChange={setRetrievalConfig}
+                      disabled={readonly}
                     />
                   )}
             </div>
diff --git a/web/app/components/datasets/settings/form/hooks/__tests__/use-form-state.spec.ts b/web/app/components/datasets/settings/form/hooks/__tests__/use-form-state.spec.ts
index cefcedafc67..78db31af095 100644
--- a/web/app/components/datasets/settings/form/hooks/__tests__/use-form-state.spec.ts
+++ b/web/app/components/datasets/settings/form/hooks/__tests__/use-form-state.spec.ts
@@ -3,6 +3,7 @@ import type { RetrievalConfig } from '@/types/app'
 import { act, renderHook, waitFor } from '@testing-library/react'
 import { ChunkingMode, DatasetPermission, DataSourceType, WeightedScoreEnum } from '@/models/datasets'
 import { RETRIEVE_METHOD } from '@/types/app'
+import { DatasetACLPermission } from '@/utils/permission'
 import { IndexingType } from '../../../../create/step-two'
 import { useFormState } from '../use-form-state'
 
@@ -16,7 +17,10 @@ const mockMutateDatasets = vi.fn()
 const mockInvalidDatasetList = vi.fn()
 
 vi.mock('@/context/app-context', () => ({
-  useSelector: () => false, // isCurrentWorkspaceDatasetOperator
+  useSelector: <T>(selector: (value: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => T) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
+  }),
 }))
 
 const createDefaultMockDataset = (): DataSet => ({
@@ -85,6 +89,7 @@ const createDefaultMockDataset = (): DataSet => ({
   runtime_mode: 'general',
   enable_api: true,
   is_multimodal: false,
+  permission_keys: [DatasetACLPermission.Edit],
 })
 
 let mockDataset: DataSet = createDefaultMockDataset()
@@ -183,6 +188,17 @@ describe('useFormState', () => {
       expect(result.current.currentDataset).toBeDefined()
       expect(result.current.currentDataset?.id).toBe('dataset-1')
     })
+
+    it('should expose editability from dataset ACL permission keys without legacy role state', () => {
+      mockDataset = {
+        ...createDefaultMockDataset(),
+        permission_keys: [DatasetACLPermission.Readonly],
+      }
+      const { result } = renderHook(() => useFormState())
+
+      expect(result.current.canEditSettings).toBe(false)
+      expect('isCurrentWorkspaceDatasetOperator' in result.current).toBe(false)
+    })
   })
 
   describe('State Setters', () => {
@@ -471,6 +487,21 @@ describe('useFormState', () => {
       })
     })
 
+    it('should not save when dataset only has readonly ACL permission', async () => {
+      const { updateDatasetSetting } = await import('@/service/datasets')
+      mockDataset = {
+        ...createDefaultMockDataset(),
+        permission_keys: [DatasetACLPermission.Readonly],
+      }
+      const { result } = renderHook(() => useFormState())
+
+      await act(async () => {
+        await result.current.handleSave()
+      })
+
+      expect(updateDatasetSetting).not.toHaveBeenCalled()
+    })
+
     it('should show success toast on successful save', async () => {
       const { toast } = await import('@langgenius/dify-ui/toast')
       const { result } = renderHook(() => useFormState())
diff --git a/web/app/components/datasets/settings/form/hooks/use-form-state.ts b/web/app/components/datasets/settings/form/hooks/use-form-state.ts
index 0ebd60a69a1..8892d982636 100644
--- a/web/app/components/datasets/settings/form/hooks/use-form-state.ts
+++ b/web/app/components/datasets/settings/form/hooks/use-form-state.ts
@@ -16,6 +16,7 @@ import { DatasetPermission } from '@/models/datasets'
 import { updateDatasetSetting } from '@/service/datasets'
 import { useInvalidDatasetList } from '@/service/knowledge/use-dataset'
 import { useMembers } from '@/service/use-common'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import { checkShowMultiModalTip } from '../../utils'
 
 const DEFAULT_APP_ICON: IconInfo = {
@@ -27,9 +28,19 @@ const DEFAULT_APP_ICON: IconInfo = {
 
 export const useFormState = () => {
   const { t } = useTranslation()
-  const isCurrentWorkspaceDatasetOperator = useAppContextWithSelector(state => state.isCurrentWorkspaceDatasetOperator)
   const currentDataset = useDatasetDetailContextWithSelector(state => state.dataset)
   const mutateDatasets = useDatasetDetailContextWithSelector(state => state.mutateDatasetRes)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const datasetACLCapabilities = useMemo(
+    () => getDatasetACLCapabilities(currentDataset?.permission_keys, {
+      currentUserId,
+      resourceMaintainer: currentDataset?.maintainer,
+      workspacePermissionKeys,
+    }),
+    [currentDataset?.maintainer, currentDataset?.permission_keys, currentUserId, workspacePermissionKeys],
+  )
+  const canEditSettings = datasetACLCapabilities.canEdit
 
   // Basic form state
   const [loading, setLoading] = useState(false)
@@ -111,6 +122,9 @@ export const useFormState = () => {
 
   // Save handler
   const handleSave = async () => {
+    if (!canEditSettings)
+      return
+
     if (loading)
       return
 
@@ -201,7 +215,7 @@ export const useFormState = () => {
   return {
     // Context values
     currentDataset,
-    isCurrentWorkspaceDatasetOperator,
+    canEditSettings,
 
     // Loading state
     loading,
diff --git a/web/app/components/datasets/settings/form/index.tsx b/web/app/components/datasets/settings/form/index.tsx
index a483c94be38..58b86ff228c 100644
--- a/web/app/components/datasets/settings/form/index.tsx
+++ b/web/app/components/datasets/settings/form/index.tsx
@@ -12,7 +12,7 @@ const Form = () => {
   const {
     // Context values
     currentDataset,
-    isCurrentWorkspaceDatasetOperator,
+    canEditSettings,
 
     // Loading state
     loading,
@@ -66,12 +66,12 @@ const Form = () => {
   } = useFormState()
 
   const isExternalProvider = currentDataset?.provider === 'external'
+  const readonly = !canEditSettings
 
   return (
     <div className="flex w-full flex-col gap-y-4 px-20 py-8 sm:w-[960px]">
       <BasicInfoSection
         currentDataset={currentDataset}
-        isCurrentWorkspaceDatasetOperator={isCurrentWorkspaceDatasetOperator}
         name={name}
         setName={setName}
         description={description}
@@ -86,6 +86,7 @@ const Form = () => {
         selectedMemberIDs={selectedMemberIDs}
         setSelectedMemberIDs={setSelectedMemberIDs}
         memberList={memberList}
+        readonly={readonly}
       />
 
       {isExternalProvider
@@ -96,6 +97,7 @@ const Form = () => {
               scoreThreshold={scoreThreshold}
               scoreThresholdEnabled={scoreThresholdEnabled}
               handleSettingsChange={handleSettingsChange}
+              readonly={readonly}
             />
           )
         : (
@@ -113,6 +115,7 @@ const Form = () => {
               summaryIndexSetting={summaryIndexSetting}
               handleSummaryIndexSettingChange={handleSummaryIndexSettingChange}
               showMultiModalTip={showMultiModalTip}
+              readonly={readonly}
             />
           )}
 
@@ -126,7 +129,7 @@ const Form = () => {
             className="min-w-24"
             variant="primary"
             loading={loading}
-            disabled={loading}
+            disabled={loading || readonly}
             onClick={handleSave}
           >
             {t('form.save', { ns: 'datasetSettings' })}
diff --git a/web/app/components/datasets/settings/permission-selector/__tests__/index.spec.tsx b/web/app/components/datasets/settings/permission-selector/__tests__/index.spec.tsx
index 84d5ae64551..7793c50acc2 100644
--- a/web/app/components/datasets/settings/permission-selector/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/settings/permission-selector/__tests__/index.spec.tsx
@@ -1,5 +1,6 @@
 import type { Member } from '@/models/common'
-import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { fireEvent, screen, waitFor } from '@testing-library/react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { DatasetPermission } from '@/models/datasets'
 import PermissionSelector from '../index'
 
@@ -16,10 +17,10 @@ vi.mock('@/context/app-context', () => ({
 
 describe('PermissionSelector', () => {
   const mockMemberList: Member[] = [
-    { id: 'user-1', name: 'Current User', email: 'current@example.com', avatar: '', avatar_url: '', role: 'owner', last_login_at: '', created_at: '', status: 'active' }!,
-    { id: 'user-2', name: 'John Doe', email: 'john@example.com', avatar: '', avatar_url: '', role: 'admin', last_login_at: '', created_at: '', status: 'active' }!,
-    { id: 'user-3', name: 'Jane Smith', email: 'jane@example.com', avatar: '', avatar_url: '', role: 'editor', last_login_at: '', created_at: '', status: 'active' }!,
-    { id: 'user-4', name: 'Dataset Operator', email: 'operator@example.com', avatar: '', avatar_url: '', role: 'dataset_operator', last_login_at: '', created_at: '', status: 'active' }!,
+    { id: 'user-1', name: 'Current User', email: 'current@example.com', avatar: '', avatar_url: '', role: 'owner', roles: [], last_login_at: '', created_at: '', status: 'active' }!,
+    { id: 'user-2', name: 'John Doe', email: 'john@example.com', avatar: '', avatar_url: '', role: 'admin', roles: [], last_login_at: '', created_at: '', status: 'active' }!,
+    { id: 'user-3', name: 'Jane Smith', email: 'jane@example.com', avatar: '', avatar_url: '', role: 'editor', roles: [], last_login_at: '', created_at: '', status: 'active' }!,
+    { id: 'user-4', name: 'Dataset Operator', email: 'operator@example.com', avatar: '', avatar_url: '', role: 'dataset_operator', roles: [], last_login_at: '', created_at: '', status: 'active' }!,
   ]
 
   const defaultProps = {
@@ -36,22 +37,22 @@ describe('PermissionSelector', () => {
 
   describe('Rendering', () => {
     it('should render without crashing', () => {
-      render(<PermissionSelector {...defaultProps} />)
+      renderWithSystemFeatures(<PermissionSelector {...defaultProps} />)
       expect(screen.getByText(/form\.permissionsOnlyMe/))!.toBeInTheDocument()
     })
 
     it('should render Only Me option when permission is onlyMe', () => {
-      render(<PermissionSelector {...defaultProps} permission={DatasetPermission.onlyMe} />)
+      renderWithSystemFeatures(<PermissionSelector {...defaultProps} permission={DatasetPermission.onlyMe} />)
       expect(screen.getByText(/form\.permissionsOnlyMe/))!.toBeInTheDocument()
     })
 
     it('should render All Team Members option when permission is allTeamMembers', () => {
-      render(<PermissionSelector {...defaultProps} permission={DatasetPermission.allTeamMembers} />)
+      renderWithSystemFeatures(<PermissionSelector {...defaultProps} permission={DatasetPermission.allTeamMembers} />)
       expect(screen.getByText(/form\.permissionsAllMember/))!.toBeInTheDocument()
     })
 
     it('should render selected member names when permission is partialMembers', () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -66,7 +67,7 @@ describe('PermissionSelector', () => {
 
   describe('Dropdown Toggle', () => {
     it('should open dropdown when clicked', async () => {
-      render(<PermissionSelector {...defaultProps} />)
+      renderWithSystemFeatures(<PermissionSelector {...defaultProps} />)
 
       const trigger = screen.getByText(/form\.permissionsOnlyMe/)
       fireEvent.click(trigger)
@@ -78,7 +79,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should not open dropdown when disabled', () => {
-      render(<PermissionSelector {...defaultProps} disabled={true} />)
+      renderWithSystemFeatures(<PermissionSelector {...defaultProps} disabled={true} />)
 
       const trigger = screen.getByText(/form\.permissionsOnlyMe/)
       fireEvent.click(trigger)
@@ -91,7 +92,7 @@ describe('PermissionSelector', () => {
   describe('Permission Selection', () => {
     it('should call onChange with onlyMe when Only Me is selected', async () => {
       const handleChange = vi.fn()
-      render(<PermissionSelector {...defaultProps} onChange={handleChange} permission={DatasetPermission.allTeamMembers} />)
+      renderWithSystemFeatures(<PermissionSelector {...defaultProps} onChange={handleChange} permission={DatasetPermission.allTeamMembers} />)
 
       const trigger = screen.getByText(/form\.permissionsAllMember/)
       fireEvent.click(trigger)
@@ -106,7 +107,7 @@ describe('PermissionSelector', () => {
 
     it('should call onChange with allTeamMembers when All Team Members is selected', async () => {
       const handleChange = vi.fn()
-      render(<PermissionSelector {...defaultProps} onChange={handleChange} />)
+      renderWithSystemFeatures(<PermissionSelector {...defaultProps} onChange={handleChange} />)
 
       const trigger = screen.getByText(/form\.permissionsOnlyMe/)
       fireEvent.click(trigger)
@@ -122,7 +123,7 @@ describe('PermissionSelector', () => {
     it('should call onChange with partialMembers when Invited Members is selected', async () => {
       const handleChange = vi.fn()
       const handleMemberSelect = vi.fn()
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           onChange={handleChange}
@@ -145,7 +146,7 @@ describe('PermissionSelector', () => {
 
   describe('Member Selection', () => {
     it('should show member list when partialMembers is selected', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -165,7 +166,7 @@ describe('PermissionSelector', () => {
 
     it('should call onMemberSelect when a member is clicked', async () => {
       const handleMemberSelect = vi.fn()
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -186,7 +187,7 @@ describe('PermissionSelector', () => {
 
     it('should deselect member when clicked again', async () => {
       const handleMemberSelect = vi.fn()
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -209,7 +210,7 @@ describe('PermissionSelector', () => {
 
   describe('Search Functionality', () => {
     it('should allow typing in search input', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -228,7 +229,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should render search input in partial members mode', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -244,7 +245,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should filter members after debounce completes', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -270,7 +271,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should handle clear search functionality', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -297,7 +298,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should filter members by email', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -323,7 +324,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should show no results message when search matches nothing', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -349,7 +350,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should show current user when search matches user name', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -375,7 +376,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should show current user when search matches user email', async () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -401,16 +402,30 @@ describe('PermissionSelector', () => {
 
   describe('Disabled State', () => {
     it('should apply disabled styles when disabled', () => {
-      const { container } = render(<PermissionSelector {...defaultProps} disabled={true} />)
+      const { container } = renderWithSystemFeatures(<PermissionSelector {...defaultProps} disabled={true} />)
       // When disabled, the component has cursor-not-allowed! class (escaped in Tailwind)
       const triggerElement = container.querySelector('[class*="cursor-not-allowed"]')
       expect(triggerElement)!.toBeInTheDocument()
     })
+
+    it('should show access config hint and remain closed when RBAC is enabled', () => {
+      renderWithSystemFeatures(<PermissionSelector {...defaultProps} />, {
+        systemFeatures: {
+          rbac_enabled: true,
+        },
+      })
+
+      const trigger = screen.getByText(/form\.permissionsAccessConfig/)
+      fireEvent.click(trigger)
+
+      expect(screen.getByText(/form\.permissionsAccessConfig/))!.toBeInTheDocument()
+      expect(screen.queryByText(/form\.permissionsOnlyMe/))!.not.toBeInTheDocument()
+    })
   })
 
   describe('Display Variations', () => {
     it('should display single avatar when only one member selected', () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -424,7 +439,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should display two avatars when two or more members selected', () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           permission={DatasetPermission.partialMembers}
@@ -440,7 +455,7 @@ describe('PermissionSelector', () => {
 
   describe('Edge Cases', () => {
     it('should handle empty member list', () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           memberList={[]}
@@ -451,7 +466,7 @@ describe('PermissionSelector', () => {
     })
 
     it('should handle member list with only current user', () => {
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           memberList={[mockMemberList[0]!]}
@@ -467,10 +482,10 @@ describe('PermissionSelector', () => {
       // This is tested indirectly through the memberList filtering
       const memberListWithNormalUser: Member[] = [
         ...mockMemberList,
-        { id: 'user-5', name: 'Normal User', email: 'normal@example.com', avatar: '', avatar_url: '', role: 'normal', last_login_at: '', created_at: '', status: 'active' },
+        { id: 'user-5', name: 'Normal User', email: 'normal@example.com', avatar: '', avatar_url: '', role: 'normal', roles: [], last_login_at: '', created_at: '', status: 'active' },
       ]
 
-      render(
+      renderWithSystemFeatures(
         <PermissionSelector
           {...defaultProps}
           memberList={memberListWithNormalUser}
@@ -486,7 +501,7 @@ describe('PermissionSelector', () => {
 
   describe('Props', () => {
     it('should update when permission prop changes', () => {
-      const { rerender } = render(<PermissionSelector {...defaultProps} permission={DatasetPermission.onlyMe} />)
+      const { rerender } = renderWithSystemFeatures(<PermissionSelector {...defaultProps} permission={DatasetPermission.onlyMe} />)
 
       expect(screen.getByText(/form\.permissionsOnlyMe/))!.toBeInTheDocument()
 
diff --git a/web/app/components/datasets/settings/permission-selector/index.tsx b/web/app/components/datasets/settings/permission-selector/index.tsx
index 067bf68da4a..afff19320e5 100644
--- a/web/app/components/datasets/settings/permission-selector/index.tsx
+++ b/web/app/components/datasets/settings/permission-selector/index.tsx
@@ -1,18 +1,18 @@
 import type { Member } from '@/models/common'
 import { Avatar } from '@langgenius/dify-ui/avatar'
 import { cn } from '@langgenius/dify-ui/cn'
+import { Input } from '@langgenius/dify-ui/input'
 import {
   Popover,
   PopoverContent,
   PopoverTrigger,
 } from '@langgenius/dify-ui/popover'
-import { RiArrowDownSLine, RiGroup2Line, RiLock2Line } from '@remixicon/react'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useDebounceFn } from 'ahooks'
-import * as React from 'react'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import Input from '@/app/components/base/input'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { DatasetPermission } from '@/models/datasets'
 import MemberItem from './member-item'
 import Item from './permission-item'
@@ -36,6 +36,7 @@ const PermissionSelector = ({
 }: RoleSelectorProps) => {
   const { t } = useTranslation()
   const userProfile = useAppContextWithSelector(state => state.userProfile)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const [open, setOpen] = useState(false)
 
   const [keywords, setKeywords] = useState('')
@@ -66,7 +67,7 @@ const PermissionSelector = ({
   }, [searchKeywords, userProfile])
 
   const filteredMemberList = useMemo(() => {
-    return memberList.filter(member => (member.name.includes(searchKeywords) || member.email.includes(searchKeywords)) && member.id !== userProfile.id && ['owner', 'admin', 'editor', 'dataset_operator'].includes(member.role))
+    return memberList.filter(member => (member.name.includes(searchKeywords) || member.email.includes(searchKeywords)) && member.id !== userProfile.id)
   }, [memberList, searchKeywords, userProfile])
 
   const onSelectOnlyMe = useCallback(() => {
@@ -88,12 +89,14 @@ const PermissionSelector = ({
   const isAllTeamMembers = permission === DatasetPermission.allTeamMembers
   const isPartialMembers = permission === DatasetPermission.partialMembers
   const selectedMemberNames = selectedMembers.map(member => member.name).join(', ')
+  const isDisabledByRBAC = systemFeatures.rbac_enabled
+  const isDisabled = disabled || isDisabledByRBAC
 
   return (
     <Popover
       open={open}
       onOpenChange={(nextOpen) => {
-        if (disabled)
+        if (isDisabled)
           return
         setOpen(nextOpen)
       }}
@@ -101,9 +104,19 @@ const PermissionSelector = ({
       <div className="relative">
         <PopoverTrigger
           render={(
-            <div className={cn('group flex cursor-pointer items-center gap-x-0.5 rounded-lg bg-components-input-bg-normal px-2 py-1 hover:bg-state-base-hover-alt data-popup-open:bg-state-base-hover-alt', disabled && 'cursor-not-allowed! bg-components-input-bg-disabled! hover:bg-components-input-bg-disabled!')}>
+            <div className={cn('group flex cursor-pointer items-center gap-x-0.5 rounded-lg bg-components-input-bg-normal px-2 py-1 hover:bg-state-base-hover-alt data-popup-open:bg-state-base-hover-alt', isDisabled && 'cursor-not-allowed! bg-components-input-bg-disabled! hover:bg-components-input-bg-disabled!')}>
+              {isDisabledByRBAC && (
+                <>
+                  <div className="flex size-6 shrink-0 items-center justify-center">
+                    <span className="i-ri-lock-2-line size-4 text-text-tertiary" />
+                  </div>
+                  <div className="grow p-1 system-sm-regular text-components-input-text-placeholder">
+                    {t('form.permissionsAccessConfig', { ns: 'datasetSettings' })}
+                  </div>
+                </>
+              )}
               {
-                isOnlyMe && (
+                !isDisabledByRBAC && isOnlyMe && (
                   <>
                     <div className="flex size-6 shrink-0 items-center justify-center">
                       <Avatar avatar={userProfile.avatar_url} name={userProfile.name} size="xs" />
@@ -115,10 +128,10 @@ const PermissionSelector = ({
                 )
               }
               {
-                isAllTeamMembers && (
+                !isDisabledByRBAC && isAllTeamMembers && (
                   <>
                     <div className="flex size-6 shrink-0 items-center justify-center">
-                      <RiGroup2Line className="size-4 text-text-secondary" />
+                      <span className="i-ri-group-2-line size-4 text-text-secondary" />
                     </div>
                     <div className="grow p-1 system-sm-regular text-components-input-text-filled">
                       {t('form.permissionsAllMember', { ns: 'datasetSettings' })}
@@ -127,7 +140,7 @@ const PermissionSelector = ({
                 )
               }
               {
-                isPartialMembers && (
+                !isDisabledByRBAC && isPartialMembers && (
                   <>
                     <div className="relative flex size-6 shrink-0 items-center justify-center">
                       {
@@ -167,11 +180,11 @@ const PermissionSelector = ({
                   </>
                 )
               }
-              <RiArrowDownSLine
-                className={cn(
-                  'size-4 shrink-0 text-text-quaternary group-hover:text-text-secondary group-data-popup-open:text-text-secondary',
-                  disabled && 'text-components-input-text-placeholder!',
-                )}
+              <span className={cn(
+                'i-ri-arrow-down-s-line',
+                'size-4 shrink-0 text-text-quaternary group-hover:text-text-secondary group-data-popup-open:text-text-secondary',
+                isDisabled && 'text-components-input-text-placeholder!',
+              )}
               />
             </div>
           )}
@@ -196,7 +209,7 @@ const PermissionSelector = ({
               <Item
                 leftIcon={(
                   <div className="flex size-6 shrink-0 items-center justify-center">
-                    <RiGroup2Line className="size-4 text-text-secondary" />
+                    <span className="i-ri-group-2-line size-4 text-text-secondary" />
                   </div>
                 )}
                 text={t('form.permissionsAllMember', { ns: 'datasetSettings' })}
@@ -207,7 +220,7 @@ const PermissionSelector = ({
               <Item
                 leftIcon={(
                   <div className="flex size-6 shrink-0 items-center justify-center">
-                    <RiLock2Line className="size-4 text-text-secondary" />
+                    <span className="i-ri-lock-2-line size-4 text-text-secondary" />
                   </div>
                 )}
                 text={t('form.permissionsInvitedMembers', { ns: 'datasetSettings' })}
@@ -218,13 +231,25 @@ const PermissionSelector = ({
             {isPartialMembers && (
               <div className="max-h-[360px] overflow-y-auto border-t border-divider-regular pr-1 pb-1 pl-1">
                 <div className="sticky top-0 left-0 z-10 bg-components-panel-on-panel-item-bg p-2 pb-1">
-                  <Input
-                    showLeftIcon
-                    showClearIcon
-                    value={keywords}
-                    onChange={e => handleKeywordsChange(e.target.value)}
-                    onClear={() => handleKeywordsChange('')}
-                  />
+                  <div className="relative w-full">
+                    <span className="absolute top-1/2 left-2 i-ri-search-line size-4 -translate-y-1/2 text-components-input-text-placeholder" />
+                    <Input
+                      className={cn('w-full pl-[26px]', keywords && 'pr-[26px]')}
+                      value={keywords}
+                      placeholder={t('operation.search', { ns: 'common' }) || ''}
+                      onChange={e => handleKeywordsChange(e.target.value)}
+                    />
+                    {!!keywords && (
+                      <button
+                        type="button"
+                        aria-label={t('operation.clear', { ns: 'common' })}
+                        className="group absolute top-1/2 right-2 -translate-y-1/2 cursor-pointer border-none bg-transparent p-px"
+                        onClick={() => handleKeywordsChange('')}
+                      >
+                        <span className="i-ri-close-circle-fill size-3.5 cursor-pointer text-text-quaternary group-hover:text-text-tertiary" aria-hidden="true" />
+                      </button>
+                    )}
+                  </div>
                 </div>
                 <div className="flex flex-col p-1">
                   {showMe && (
diff --git a/web/app/components/datasets/settings/summary-index-setting.tsx b/web/app/components/datasets/settings/summary-index-setting.tsx
index 6c2aad20c3a..5e7a1697fd6 100644
--- a/web/app/components/datasets/settings/summary-index-setting.tsx
+++ b/web/app/components/datasets/settings/summary-index-setting.tsx
@@ -75,6 +75,7 @@ const SummaryIndexSetting = ({
             checked={summaryIndexSetting?.enable ?? false}
             onCheckedChange={handleSummaryIndexEnableChange}
             size="md"
+            disabled={readonly}
           />
         </div>
         {
@@ -123,6 +124,7 @@ const SummaryIndexSetting = ({
                 checked={summaryIndexSetting?.enable ?? false}
                 onCheckedChange={handleSummaryIndexEnableChange}
                 size="md"
+                disabled={readonly}
               />
               {
                 summaryIndexSetting?.enable ? t('list.status.enabled', { ns: 'datasetDocuments' }) : t('list.status.disabled', { ns: 'datasetDocuments' })
@@ -189,6 +191,7 @@ const SummaryIndexSetting = ({
           checked={summaryIndexSetting?.enable ?? false}
           onCheckedChange={handleSummaryIndexEnableChange}
           size="md"
+          disabled={readonly}
         />
         <div className="system-sm-semibold text-text-secondary">
           {t('form.summaryAutoGen', { ns: 'datasetSettings' })}
diff --git a/web/app/components/develop/ApiServer.tsx b/web/app/components/develop/ApiServer.tsx
index 24398d1c858..eeb09d5fd41 100644
--- a/web/app/components/develop/ApiServer.tsx
+++ b/web/app/components/develop/ApiServer.tsx
@@ -8,10 +8,12 @@ import SecretKeyButton from '@/app/components/develop/secret-key/secret-key-butt
 type ApiServerProps = {
   apiBaseUrl: string
   appId?: string
+  canManageApiKey?: boolean
 }
 const ApiServer: FC<ApiServerProps> = ({
   apiBaseUrl,
   appId,
+  canManageApiKey = false,
 }) => {
   const { t } = useTranslation()
 
@@ -29,6 +31,7 @@ const ApiServer: FC<ApiServerProps> = ({
       <SecretKeyButton
         className="h-8! shrink-0"
         appId={appId}
+        canManage={canManageApiKey}
       />
     </div>
   )
diff --git a/web/app/components/develop/__tests__/ApiServer.spec.tsx b/web/app/components/develop/__tests__/ApiServer.spec.tsx
index a805a3d2e0d..3d2fe4e53dd 100644
--- a/web/app/components/develop/__tests__/ApiServer.spec.tsx
+++ b/web/app/components/develop/__tests__/ApiServer.spec.tsx
@@ -80,7 +80,7 @@ describe('ApiServer', () => {
   describe('SecretKeyButton interaction', () => {
     it('should open modal when API key button is clicked', async () => {
       const user = userEvent.setup()
-      render(<ApiServer {...defaultProps} appId="app-123" />)
+      render(<ApiServer {...defaultProps} appId="app-123" canManageApiKey />)
 
       const apiKeyButton = screen.getByText('appApi.apiKey')
       await act(async () => {
@@ -92,7 +92,7 @@ describe('ApiServer', () => {
 
     it('should close modal when close button is clicked', async () => {
       const user = userEvent.setup()
-      render(<ApiServer {...defaultProps} appId="app-123" />)
+      render(<ApiServer {...defaultProps} appId="app-123" canManageApiKey />)
 
       const apiKeyButton = screen.getByText('appApi.apiKey')
       await act(async () => {
@@ -108,6 +108,20 @@ describe('ApiServer', () => {
 
       expect(screen.queryByRole('dialog', { name: 'Secret key' })).not.toBeInTheDocument()
     })
+
+    it('should disable API key button by default', async () => {
+      const user = userEvent.setup()
+      render(<ApiServer {...defaultProps} appId="app-123" />)
+
+      const apiKeyButton = screen.getByRole('button', { name: /apiKey/i })
+      expect(apiKeyButton).toBeDisabled()
+
+      await act(async () => {
+        await user.click(apiKeyButton)
+      })
+
+      expect(screen.queryByRole('dialog', { name: 'Secret key' })).not.toBeInTheDocument()
+    })
   })
 
   describe('styling', () => {
diff --git a/web/app/components/develop/index.tsx b/web/app/components/develop/index.tsx
index bf82facb6aa..3e3b52a5a39 100644
--- a/web/app/components/develop/index.tsx
+++ b/web/app/components/develop/index.tsx
@@ -3,6 +3,8 @@ import { useStore as useAppStore } from '@/app/components/app/store'
 import Loading from '@/app/components/base/loading'
 import ApiServer from '@/app/components/develop/ApiServer'
 import Doc from '@/app/components/develop/doc'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { getAppACLCapabilities } from '@/utils/permission'
 
 type IDevelopMainProps = {
   appId: string
@@ -10,6 +12,13 @@ type IDevelopMainProps = {
 
 const DevelopMain = ({ appId }: IDevelopMainProps) => {
   const appDetail = useAppStore(state => state.appDetail)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const appACLCapabilities = getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  })
 
   if (!appDetail) {
     return (
@@ -23,7 +32,7 @@ const DevelopMain = ({ appId }: IDevelopMainProps) => {
     <div data-testid="develop-main" className="relative flex h-full flex-col overflow-hidden">
       <div className="flex shrink-0 items-center justify-between border-b border-solid border-b-divider-regular px-6 py-2">
         <div className="text-lg font-medium text-text-primary"></div>
-        <ApiServer apiBaseUrl={appDetail.api_base_url} appId={appId} />
+        <ApiServer apiBaseUrl={appDetail.api_base_url} appId={appId} canManageApiKey={appACLCapabilities.canEdit} />
       </div>
       <div className="grow overflow-auto p-4 sm:px-10">
         <Doc appDetail={appDetail} />
diff --git a/web/app/components/develop/secret-key/__tests__/secret-key-button.spec.tsx b/web/app/components/develop/secret-key/__tests__/secret-key-button.spec.tsx
index 22342b18b50..6e91454fbdb 100644
--- a/web/app/components/develop/secret-key/__tests__/secret-key-button.spec.tsx
+++ b/web/app/components/develop/secret-key/__tests__/secret-key-button.spec.tsx
@@ -3,11 +3,12 @@ import userEvent from '@testing-library/user-event'
 import SecretKeyButton from '../secret-key-button'
 
 vi.mock('@/app/components/develop/secret-key/secret-key-modal', () => ({
-  default: ({ isShow, onClose, appId }: { isShow: boolean, onClose: () => void, appId?: string }) => (
+  default: ({ isShow, onClose, appId, canManage }: { isShow: boolean, onClose: () => void, appId?: string, canManage: boolean }) => (
     isShow
       ? (
           <div data-testid="secret-key-modal">
             <span data-testid="modal-app-id">{`Modal for ${appId || 'no-app'}`}</span>
+            <span data-testid="modal-can-manage">{String(canManage)}</span>
             <button onClick={onClose} data-testid="close-modal">Close</button>
           </div>
         )
@@ -29,8 +30,8 @@ describe('SecretKeyButton', () => {
 
     it('should render the key icon', () => {
       const { container } = render(<SecretKeyButton />)
-      const svg = container.querySelector('svg')
-      expect(svg)!.toBeInTheDocument()
+      const icon = container.querySelector('.i-ri-key-2-line')
+      expect(icon)!.toBeInTheDocument()
     })
 
     it('should not show modal initially', () => {
@@ -42,7 +43,7 @@ describe('SecretKeyButton', () => {
   describe('button interaction', () => {
     it('should open modal when button is clicked', async () => {
       const user = userEvent.setup()
-      render(<SecretKeyButton />)
+      render(<SecretKeyButton canManage />)
 
       const button = screen.getByRole('button')
       await act(async () => {
@@ -54,7 +55,7 @@ describe('SecretKeyButton', () => {
 
     it('should close modal when onClose is called', async () => {
       const user = userEvent.setup()
-      render(<SecretKeyButton />)
+      render(<SecretKeyButton canManage />)
 
       const button = screen.getByRole('button')
       await act(async () => {
@@ -73,7 +74,7 @@ describe('SecretKeyButton', () => {
 
     it('should toggle modal visibility', async () => {
       const user = userEvent.setup()
-      render(<SecretKeyButton />)
+      render(<SecretKeyButton canManage />)
 
       const button = screen.getByRole('button')
 
@@ -104,7 +105,7 @@ describe('SecretKeyButton', () => {
 
     it('should pass appId to modal', async () => {
       const user = userEvent.setup()
-      render(<SecretKeyButton appId="app-123" />)
+      render(<SecretKeyButton appId="app-123" canManage />)
 
       const button = screen.getByRole('button')
       await act(async () => {
@@ -116,7 +117,7 @@ describe('SecretKeyButton', () => {
 
     it('should handle undefined appId', async () => {
       const user = userEvent.setup()
-      render(<SecretKeyButton />)
+      render(<SecretKeyButton canManage />)
 
       const button = screen.getByRole('button')
       await act(async () => {
@@ -126,6 +127,38 @@ describe('SecretKeyButton', () => {
       expect(screen.getByText('Modal for no-app'))!.toBeInTheDocument()
     })
 
+    it('should pass canManage to modal', async () => {
+      const user = userEvent.setup()
+      render(<SecretKeyButton appId="app-123" canManage />)
+
+      const button = screen.getByRole('button')
+      await act(async () => {
+        await user.click(button)
+      })
+
+      expect(screen.getByTestId('modal-can-manage')).toHaveTextContent('true')
+    })
+
+    it('should disable the button and keep modal closed when canManage is false', async () => {
+      const user = userEvent.setup()
+      render(<SecretKeyButton appId="app-123" canManage={false} />)
+
+      const button = screen.getByRole('button')
+      expect(button).toBeDisabled()
+
+      await act(async () => {
+        await user.click(button)
+      })
+
+      expect(screen.queryByTestId('secret-key-modal')).not.toBeInTheDocument()
+    })
+
+    it('should disable the button by default when canManage is omitted', () => {
+      render(<SecretKeyButton appId="app-123" />)
+
+      expect(screen.getByRole('button')).toBeDisabled()
+    })
+
     it('should apply custom textCls', () => {
       render(<SecretKeyButton textCls="custom-text-class" />)
       const text = screen.getByText('appApi.apiKey')
@@ -184,7 +217,7 @@ describe('SecretKeyButton', () => {
   describe('modal props', () => {
     it('should pass isShow prop to modal', async () => {
       const user = userEvent.setup()
-      render(<SecretKeyButton />)
+      render(<SecretKeyButton canManage />)
 
       expect(screen.queryByTestId('secret-key-modal')).not.toBeInTheDocument()
 
@@ -198,7 +231,7 @@ describe('SecretKeyButton', () => {
 
     it('should pass onClose callback to modal', async () => {
       const user = userEvent.setup()
-      render(<SecretKeyButton />)
+      render(<SecretKeyButton canManage />)
 
       const button = screen.getByRole('button')
       await act(async () => {
@@ -223,7 +256,7 @@ describe('SecretKeyButton', () => {
 
     it('should be keyboard accessible', async () => {
       const user = userEvent.setup()
-      render(<SecretKeyButton />)
+      render(<SecretKeyButton canManage />)
 
       const button = screen.getByRole('button')
       button.focus()
@@ -242,8 +275,8 @@ describe('SecretKeyButton', () => {
       const user = userEvent.setup()
       render(
         <>
-          <SecretKeyButton appId="app-1" />
-          <SecretKeyButton appId="app-2" />
+          <SecretKeyButton appId="app-1" canManage />
+          <SecretKeyButton appId="app-2" canManage />
         </>,
       )
 
diff --git a/web/app/components/develop/secret-key/__tests__/secret-key-modal.spec.tsx b/web/app/components/develop/secret-key/__tests__/secret-key-modal.spec.tsx
index 00948180eb4..94c215103c6 100644
--- a/web/app/components/develop/secret-key/__tests__/secret-key-modal.spec.tsx
+++ b/web/app/components/develop/secret-key/__tests__/secret-key-modal.spec.tsx
@@ -83,6 +83,7 @@ vi.mock('@/service/knowledge/use-dataset', () => ({
 describe('SecretKeyModal', () => {
   const defaultProps = {
     isShow: true,
+    canManage: true,
     onClose: vi.fn(),
   }
 
@@ -124,7 +125,7 @@ describe('SecretKeyModal', () => {
 
     it('should render the close icon', async () => {
       await renderModal(<SecretKeyModal {...defaultProps} />)
-      const closeIcon = document.body.querySelector('svg.cursor-pointer')
+      const closeIcon = document.body.querySelector('.i-heroicons-x-mark-20-solid')
       expect(closeIcon).toBeInTheDocument()
     })
   })
@@ -186,19 +187,26 @@ describe('SecretKeyModal', () => {
       expect(screen.getByText('appApi.never')).toBeInTheDocument()
     })
 
-    it('should render delete button for managers', async () => {
+    it('should render delete button for permitted users', async () => {
       await renderModal(<SecretKeyModal {...defaultProps} appId="app-123" />)
       const buttons = screen.getAllByRole('button')
       expect(buttons.length).toBeGreaterThanOrEqual(2)
-      const deleteIcon = document.body.querySelector('svg[class*="size-4"]')
+      const deleteIcon = document.body.querySelector('.i-ri-delete-bin-line')
       expect(deleteIcon).toBeInTheDocument()
     })
 
-    it('should not render delete button for non-managers', async () => {
+    it('should render delete button when canManage is true even if the workspace role is not manager', async () => {
       mockIsCurrentWorkspaceManager.mockReturnValue(false)
       await renderModal(<SecretKeyModal {...defaultProps} appId="app-123" />)
-      const actionButtons = screen.getAllByRole('button')
-      expect(actionButtons.length).toBeGreaterThan(0)
+      const deleteIcon = document.body.querySelector('.i-ri-delete-bin-line')
+      expect(deleteIcon).toBeInTheDocument()
+    })
+
+    it('should not render delete button when canManage is false even if the workspace role is manager', async () => {
+      mockIsCurrentWorkspaceManager.mockReturnValue(true)
+      await renderModal(<SecretKeyModal {...defaultProps} appId="app-123" canManage={false} />)
+      const deleteIcon = document.body.querySelector('.i-ri-delete-bin-line')
+      expect(deleteIcon).not.toBeInTheDocument()
     })
 
     it('should render table headers', async () => {
@@ -230,7 +238,7 @@ describe('SecretKeyModal', () => {
       const onClose = vi.fn()
       await renderModal(<SecretKeyModal {...defaultProps} onClose={onClose} />)
 
-      const closeIcon = document.body.querySelector('svg.cursor-pointer')
+      const closeIcon = document.body.querySelector('.i-heroicons-x-mark-20-solid')
       expect(closeIcon).toBeInTheDocument()
 
       await act(async () => {
@@ -356,10 +364,18 @@ describe('SecretKeyModal', () => {
       expect(createButton).toBeDisabled()
     })
 
-    it('should disable create button when not editor', async () => {
+    it('should keep create button enabled when canManage is true even if the workspace role is not editor', async () => {
       mockIsCurrentWorkspaceEditor.mockReturnValue(false)
       await renderModal(<SecretKeyModal {...defaultProps} />)
 
+      const createButton = screen.getByText('appApi.apiKeyModal.createNewSecretKey').closest('button')
+      expect(createButton).not.toBeDisabled()
+    })
+
+    it('should disable create button when canManage is false even if the workspace role is editor', async () => {
+      mockIsCurrentWorkspaceEditor.mockReturnValue(true)
+      await renderModal(<SecretKeyModal {...defaultProps} canManage={false} />)
+
       const createButton = screen.getByText('appApi.apiKeyModal.createNewSecretKey').closest('button')
       expect(createButton).toBeDisabled()
     })
@@ -374,7 +390,7 @@ describe('SecretKeyModal', () => {
       mockAppApiKeysData.mockReturnValue({ data: apiKeys })
     })
 
-    it('should render delete button for managers', async () => {
+    it('should render delete button for permitted users', async () => {
       await renderModal(<SecretKeyModal {...defaultProps} appId="app-123" />)
 
       const actionButtons = screen.getAllByRole('button')
@@ -394,10 +410,10 @@ describe('SecretKeyModal', () => {
       expect(actionContainers.length).toBeGreaterThan(0)
     })
 
-    it('should have delete button visible for managers', async () => {
+    it('should have delete button visible for permitted users', async () => {
       await renderModal(<SecretKeyModal {...defaultProps} appId="app-123" />)
 
-      const deleteIcon = document.body.querySelector('svg[class*="size-4"]')
+      const deleteIcon = document.body.querySelector('.i-ri-delete-bin-line')
       const deleteButton = deleteIcon?.closest('button')
       expect(deleteButton).toBeInTheDocument()
     })
diff --git a/web/app/components/develop/secret-key/secret-key-button.tsx b/web/app/components/develop/secret-key/secret-key-button.tsx
index edeaf531be3..567abb863e0 100644
--- a/web/app/components/develop/secret-key/secret-key-button.tsx
+++ b/web/app/components/develop/secret-key/secret-key-button.tsx
@@ -1,6 +1,5 @@
 'use client'
 import { Button } from '@langgenius/dify-ui/button'
-import { RiKey2Line } from '@remixicon/react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import SecretKeyModal from '@/app/components/develop/secret-key/secret-key-modal'
@@ -9,25 +8,28 @@ type ISecretKeyButtonProps = {
   className?: string
   appId?: string
   textCls?: string
+  canManage?: boolean
 }
 
-const SecretKeyButton = ({ className, appId, textCls }: ISecretKeyButtonProps) => {
-  const [isVisible, setVisible] = useState(false)
+const SecretKeyButton = ({ className, appId, textCls, canManage = false }: ISecretKeyButtonProps) => {
+  const [isVisible, setIsVisible] = useState(false)
   const { t } = useTranslation()
+
   return (
     <>
       <Button
         className={`px-3 ${className}`}
-        onClick={() => setVisible(true)}
+        onClick={() => setIsVisible(true)}
         size="small"
         variant="ghost"
+        disabled={!canManage}
       >
         <div className="flex size-3.5 items-center justify-center">
-          <RiKey2Line className="size-3.5 text-text-tertiary" />
+          <span className="i-ri-key-2-line size-3.5 text-text-tertiary" />
         </div>
         <div className={`px-[3px] system-xs-medium text-text-tertiary ${textCls}`}>{t('apiKey', { ns: 'appApi' })}</div>
       </Button>
-      <SecretKeyModal isShow={isVisible} onClose={() => setVisible(false)} appId={appId} />
+      <SecretKeyModal isShow={isVisible} onClose={() => setIsVisible(false)} appId={appId} canManage={canManage} />
     </>
   )
 }
diff --git a/web/app/components/develop/secret-key/secret-key-modal.tsx b/web/app/components/develop/secret-key/secret-key-modal.tsx
index 7d949d7864e..13c16582e61 100644
--- a/web/app/components/develop/secret-key/secret-key-modal.tsx
+++ b/web/app/components/develop/secret-key/secret-key-modal.tsx
@@ -1,6 +1,5 @@
 'use client'
 import type { CreateApiKeyResponse } from '@/models/app'
-import { PlusIcon, XMarkIcon } from '@heroicons/react/20/solid'
 import {
   AlertDialog,
   AlertDialogActions,
@@ -13,7 +12,6 @@ import {
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Dialog, DialogContent, DialogTitle } from '@langgenius/dify-ui/dialog'
-import { RiDeleteBinLine } from '@remixicon/react'
 import {
   useState,
 } from 'react'
@@ -39,19 +37,21 @@ import s from './style.module.css'
 type ISecretKeyModalProps = {
   isShow: boolean
   appId?: string
+  canManage: boolean
   onClose: () => void
 }
 
 const SecretKeyModal = ({
   isShow = false,
   appId,
+  canManage,
   onClose,
 }: ISecretKeyModalProps) => {
   const { t } = useTranslation()
   const { formatTime } = useTimestamp()
-  const { currentWorkspace, isCurrentWorkspaceManager, isCurrentWorkspaceEditor } = useAppContext()
+  const { currentWorkspace } = useAppContext()
   const [showConfirmDelete, setShowConfirmDelete] = useState(false)
-  const [isVisible, setVisible] = useState(false)
+  const [isVisible, setIsVisible] = useState(false)
   const [newKey, setNewKey] = useState<CreateApiKeyResponse | undefined>(undefined)
   const invalidateAppApiKeys = useInvalidateAppApiKeys()
   const invalidateDatasetApiKeys = useInvalidateDatasetApiKeys()
@@ -64,6 +64,8 @@ const SecretKeyModal = ({
 
   const onDel = async () => {
     setShowConfirmDelete(false)
+    if (!canManage)
+      return
     if (!delKeyID)
       return
 
@@ -79,12 +81,15 @@ const SecretKeyModal = ({
   }
 
   const onCreate = async () => {
+    if (!currentWorkspace || !canManage)
+      return
+
     const params = appId
       ? { url: `/apps/${appId}/api-keys`, body: {} }
       : { url: '/datasets/api-keys', body: {} }
     const createApikey = appId ? createAppApikey : createDatasetApikey
     const res = await createApikey(params)
-    setVisible(true)
+    setIsVisible(true)
     setNewKey(res)
     if (appId)
       invalidateAppApiKeys(appId)
@@ -105,7 +110,7 @@ const SecretKeyModal = ({
   }
 
   const handleClose = () => {
-    setVisible(false)
+    setIsVisible(false)
     onClose()
   }
 
@@ -124,7 +129,7 @@ const SecretKeyModal = ({
           </DialogTitle>
 
           <div className="-mt-6 -mr-2 mb-4 flex justify-end">
-            <XMarkIcon className="size-6 cursor-pointer text-text-tertiary" onClick={handleClose} />
+            <span className="i-heroicons-x-mark-20-solid size-6 cursor-pointer text-text-tertiary" onClick={handleClose} />
           </div>
           <p className="mt-1 shrink-0 text-[13px] leading-5 font-normal text-text-tertiary">{t('apiKeyModal.apiSecretKeyTips', { ns: 'appApi' })}</p>
           {isApiKeysLoading && <div className="mt-4"><Loading /></div>}
@@ -145,14 +150,14 @@ const SecretKeyModal = ({
                       <div className="w-[200px] shrink-0 truncate px-3">{api.last_used_at ? formatTime(Number(api.last_used_at), t('dateTimeFormat', { ns: 'appLog' }) as string) : t('never', { ns: 'appApi' })}</div>
                       <div className="flex grow space-x-2 px-3">
                         <CopyFeedback content={api.token} />
-                        {isCurrentWorkspaceManager && (
+                        {canManage && (
                           <ActionButton
                             onClick={() => {
                               setDelKeyId(api.id)
                               setShowConfirmDelete(true)
                             }}
                           >
-                            <RiDeleteBinLine className="size-4" />
+                            <span className="i-ri-delete-bin-line size-4" />
                           </ActionButton>
                         )}
                       </div>
@@ -163,8 +168,8 @@ const SecretKeyModal = ({
             )
           }
           <div className="flex">
-            <Button className={`mt-4 flex shrink-0 ${s.autoWidth}`} onClick={onCreate} disabled={!currentWorkspace || !isCurrentWorkspaceEditor}>
-              <PlusIcon className="mr-1 flex size-4 shrink-0" />
+            <Button className={`mt-4 flex shrink-0 ${s.autoWidth}`} onClick={onCreate} disabled={!currentWorkspace || !canManage}>
+              <span className="mr-1 i-heroicons-plus-20-solid flex size-4 shrink-0" />
               <div className="text-xs font-medium text-text-secondary">{t('apiKeyModal.createNewSecretKey', { ns: 'appApi' })}</div>
             </Button>
           </div>
@@ -194,7 +199,7 @@ const SecretKeyModal = ({
         </DialogContent>
       </Dialog>
       {isShow && (
-        <SecretKeyGenerateModal className="shrink-0" isShow={isVisible} onClose={() => setVisible(false)} newKey={newKey} />
+        <SecretKeyGenerateModal className="shrink-0" isShow={isVisible} onClose={() => setIsVisible(false)} newKey={newKey} />
       )}
     </>
   )
diff --git a/web/app/components/education-verify-action-recorder.tsx b/web/app/components/education-verify-action-recorder.tsx
index ece0569c7e2..03f1d942d35 100644
--- a/web/app/components/education-verify-action-recorder.tsx
+++ b/web/app/components/education-verify-action-recorder.tsx
@@ -1,16 +1,13 @@
 'use client'
 
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useEffect } from 'react'
-import {
-  EDUCATION_VERIFY_URL_SEARCHPARAMS_ACTION,
-  EDUCATION_VERIFYING_LOCALSTORAGE_ITEM,
-} from '@/app/education-apply/constants'
+import { EDUCATION_VERIFY_URL_SEARCHPARAMS_ACTION } from '@/app/education-apply/constants'
+import { useSetEducationVerifying } from '@/app/education-apply/storage'
 import { useSearchParams } from '@/next/navigation'
 
 export function EducationVerifyActionRecorder() {
   const searchParams = useSearchParams()
-  const setEducationVerifying = useSetLocalStorage<string>(EDUCATION_VERIFYING_LOCALSTORAGE_ITEM, { raw: true })
+  const setEducationVerifying = useSetEducationVerifying()
 
   useEffect(() => {
     if (searchParams.get('action') === EDUCATION_VERIFY_URL_SEARCHPARAMS_ACTION)
diff --git a/web/app/components/explore/app-list/__tests__/index.spec.tsx b/web/app/components/explore/app-list/__tests__/index.spec.tsx
index af87312825c..0bc33b5a751 100644
--- a/web/app/components/explore/app-list/__tests__/index.spec.tsx
+++ b/web/app/components/explore/app-list/__tests__/index.spec.tsx
@@ -9,12 +9,19 @@ import { createStore, Provider as JotaiProvider } from 'jotai'
 import { createSystemFeaturesWrapper } from '@/__tests__/utils/mock-system-features'
 import { useAppContext } from '@/context/app-context'
 import { fetchAppDetail, fetchAppList, fetchBanners } from '@/service/explore'
-import { useMembers } from '@/service/use-common'
 import { renderWithNuqs } from '@/test/nuqs-testing'
 import { AppModeEnum } from '@/types/app'
-import { LEARN_DIFY_HIDDEN_STORAGE_KEY } from '../../learn-dify/atoms'
+import { AppACLPermission } from '@/utils/permission'
+import { LEARN_DIFY_HIDDEN_STORAGE_KEY } from '../../learn-dify/storage'
 import AppList from '../index'
 
+type MockAppContext = {
+  userProfile: { id: string }
+  workspacePermissionKeys: string[]
+}
+
+const mockUseAppContext = vi.hoisted(() => vi.fn<() => MockAppContext>())
+
 let mockExploreData: { categories: string[], allList: App[] } | undefined = { categories: [], allList: [] }
 let mockLearnDifyApps: App[] = []
 let mockLearnDifyLoading = false
@@ -100,11 +107,8 @@ vi.mock('@/service/client', () => ({
 }))
 
 vi.mock('@/context/app-context', () => ({
-  useAppContext: vi.fn(),
-}))
-
-vi.mock('@/service/use-common', () => ({
-  useMembers: vi.fn(),
+  useAppContext: mockUseAppContext,
+  useSelector: <T,>(selector: (state: MockAppContext) => T): T => selector(mockUseAppContext()),
 }))
 
 vi.mock('@/hooks/use-import-dsl', () => ({
@@ -239,6 +243,7 @@ const createWorkspaceApp = (overrides: Partial<WorkspaceApp> = {}): WorkspaceApp
   api_base_url: overrides.api_base_url ?? '',
   tags: overrides.tags ?? [],
   access_mode: overrides.access_mode,
+  permission_keys: overrides.permission_keys,
 } as WorkspaceApp)
 
 const createBanner = (overrides: Partial<BannerType> = {}): BannerType => ({
@@ -255,15 +260,10 @@ const createBanner = (overrides: Partial<BannerType> = {}): BannerType => ({
   created_at: overrides.created_at ?? '2024-01-01T00:00:00Z',
 })
 
-const mockMemberRole = (hasEditPermission: boolean) => {
+const mockAppCreatePermission = (hasEditPermission: boolean) => {
   ;(useAppContext as Mock).mockReturnValue({
     userProfile: { id: 'user-1' },
-    isCurrentWorkspaceEditor: hasEditPermission,
-  })
-  ;(useMembers as Mock).mockReturnValue({
-    data: {
-      accounts: [{ id: 'user-1', role: hasEditPermission ? 'admin' : 'normal' }],
-    },
+    workspacePermissionKeys: hasEditPermission ? ['app.create_and_management'] : [],
   })
 }
 
@@ -283,7 +283,7 @@ const renderAppList = (
   options: RenderOptions = {},
 ) => {
   mockConfig.isCloudEdition = options.isCloudEdition ?? false
-  mockMemberRole(hasEditPermission)
+  mockAppCreatePermission(hasEditPermission)
   const { wrapper: SystemFeaturesWrapper, queryClient } = createSystemFeaturesWrapper({
     systemFeatures: { enable_explore_banner: options.enableExploreBanner ?? false },
   })
@@ -436,7 +436,7 @@ describe('AppList', () => {
         allList: [createApp()],
       }
       mockWorkspaceApps = [
-        createWorkspaceApp({ id: 'app-1', name: 'Email Reply', author_name: 'Evan' }),
+        createWorkspaceApp({ id: 'app-1', name: 'Email Reply', author_name: 'Evan', permission_keys: [AppACLPermission.Monitor] }),
         createWorkspaceApp({ id: 'app-2', name: 'Feature Copilot', author_name: 'Maggie' }),
         createWorkspaceApp({ id: 'app-3', name: 'Book Translation', author_name: 'Alex' }),
         createWorkspaceApp({ id: 'app-4', name: 'Logo Design', author_name: 'Taylor' }),
diff --git a/web/app/components/explore/app-list/index.tsx b/web/app/components/explore/app-list/index.tsx
index 8bc348935d8..00431c36486 100644
--- a/web/app/components/explore/app-list/index.tsx
+++ b/web/app/components/explore/app-list/index.tsx
@@ -25,8 +25,8 @@ import { DSLImportMode } from '@/models/app'
 import dynamic from '@/next/dynamic'
 import { consoleQuery } from '@/service/client'
 import { fetchAppDetail, fetchAppList, fetchBanners } from '@/service/explore'
-import { useMembers } from '@/service/use-common'
 import { trackCreateApp } from '@/utils/create-app-tracking'
+import { hasPermission } from '@/utils/permission'
 import { ExploreAppListHeader } from './explore-app-list-header'
 import { ExploreRecommendations } from './explore-recommendations'
 import { ExploreHomeSkeleton } from './loading-skeletons'
@@ -100,7 +100,7 @@ function getDisabledBannersQueryOptions() {
 const Apps = ({ onSuccess }: { onSuccess?: () => void }) => {
   const { t } = useTranslation()
   const locale = useLocale()
-  const { userProfile } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
   const { data: systemFeatures } = useSuspenseQuery(
     systemFeaturesQueryOptions(),
   )
@@ -120,12 +120,8 @@ const Apps = ({ onSuccess }: { onSuccess?: () => void }) => {
       isAppListError: exploreAppListQuery.isError || (!exploreAppListQuery.isPending && !exploreAppListQuery.data),
     }),
   })
-  const { data: membersData } = useMembers()
   const allCategoriesEn = t('apps.allCategories', { ns: 'explore', lng: 'en' })
-  const userAccount = membersData?.accounts?.find(
-    account => account.id === userProfile.id,
-  )
-  const hasEditPermission = !!userAccount && userAccount.role !== 'normal'
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
 
   const [keywords, setKeywords] = useState('')
   const [searchKeywords, setSearchKeywords] = useState('')
@@ -288,7 +284,7 @@ const Apps = ({ onSuccess }: { onSuccess?: () => void }) => {
                   <Banner banners={homeQueries.banners} />
                 )}
                 <ExploreRecommendations
-                  canCreate={hasEditPermission}
+                  canCreate={canCreateApp}
                   continueWorkApps={homeQueries.continueWorkApps}
                   onCreate={handleCreateFromLearnDify}
                   onTry={handleTryApp}
@@ -314,7 +310,7 @@ const Apps = ({ onSuccess }: { onSuccess?: () => void }) => {
                       <AppCard
                         key={app.app_id}
                         app={app}
-                        canCreate={hasEditPermission}
+                        canCreate={canCreateApp}
                         onCreate={() => handleCreateFromAppList(app)}
                         onTry={handleTryApp}
                       />
diff --git a/web/app/components/explore/continue-work/item.tsx b/web/app/components/explore/continue-work/item.tsx
index dc722c1669a..89f09d57a8f 100644
--- a/web/app/components/explore/continue-work/item.tsx
+++ b/web/app/components/explore/continue-work/item.tsx
@@ -5,7 +5,7 @@ import * as React from 'react'
 import { useTranslation } from 'react-i18next'
 import { AppTypeIcon } from '@/app/components/app/type-selector'
 import AppIcon from '@/app/components/base/app-icon'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextSelector } from '@/context/app-context'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import Link from '@/next/link'
 import { getRedirectionPath } from '@/utils/app-redirection'
@@ -19,9 +19,14 @@ const ContinueWorkItem = ({
 }: ContinueWorkItemProps) => {
   const { t } = useTranslation()
   const { formatTimeFromNow } = useFormatTimeFromNow()
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const currentUserId = useAppContextSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
   const updatedAt = (app.updated_at || app.created_at) * 1000
-  const href = getRedirectionPath(Boolean(isCurrentWorkspaceEditor), app)
+  const href = getRedirectionPath(app, {
+    currentUserId,
+    resourceMaintainer: app.maintainer,
+    workspacePermissionKeys,
+  })
 
   return (
     <Link href={href} className="flex min-w-0 items-center gap-3 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg px-4 pt-4 pb-4 shadow-xs shadow-shadow-shadow-3">
diff --git a/web/app/components/explore/installed-app/__tests__/index.spec.tsx b/web/app/components/explore/installed-app/__tests__/index.spec.tsx
index 40709b418b4..36268eced8b 100644
--- a/web/app/components/explore/installed-app/__tests__/index.spec.tsx
+++ b/web/app/components/explore/installed-app/__tests__/index.spec.tsx
@@ -4,7 +4,7 @@ import { render, screen, waitFor } from '@testing-library/react'
 
 import { useWebAppStore } from '@/context/web-app-context'
 import { AccessMode } from '@/models/access-control'
-import { useGetUserCanAccessApp } from '@/service/access-control'
+import { useGetUserCanAccessApp } from '@/service/access-control/use-app-access-control'
 import { useGetInstalledAppAccessModeByAppId, useGetInstalledAppMeta, useGetInstalledAppParams, useGetInstalledApps } from '@/service/use-explore'
 import { AppModeEnum } from '@/types/app'
 import InstalledApp from '../index'
@@ -12,7 +12,7 @@ import InstalledApp from '../index'
 vi.mock('@/context/web-app-context', () => ({
   useWebAppStore: vi.fn(),
 }))
-vi.mock('@/service/access-control', () => ({
+vi.mock('@/service/access-control/use-app-access-control', () => ({
   useGetUserCanAccessApp: vi.fn(),
 }))
 vi.mock('@/service/use-explore', () => ({
diff --git a/web/app/components/explore/installed-app/index.tsx b/web/app/components/explore/installed-app/index.tsx
index ff8c5127df1..d28678fd655 100644
--- a/web/app/components/explore/installed-app/index.tsx
+++ b/web/app/components/explore/installed-app/index.tsx
@@ -7,7 +7,7 @@ import Loading from '@/app/components/base/loading'
 import TextGenerationApp from '@/app/components/share/text-generation'
 import { useWebAppStore } from '@/context/web-app-context'
 import dynamic from '@/next/dynamic'
-import { useGetUserCanAccessApp } from '@/service/access-control'
+import { useGetUserCanAccessApp } from '@/service/access-control/use-app-access-control'
 import { useGetInstalledAppAccessModeByAppId, useGetInstalledAppMeta, useGetInstalledAppParams, useGetInstalledApps } from '@/service/use-explore'
 import { AppModeEnum } from '@/types/app'
 import AppUnavailable from '../../base/app-unavailable'
diff --git a/web/app/components/explore/learn-dify/atoms.ts b/web/app/components/explore/learn-dify/atoms.ts
deleted file mode 100644
index b5400a34ad3..00000000000
--- a/web/app/components/explore/learn-dify/atoms.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-'use client'
-
-import { atom, useAtomValue, useSetAtom } from 'jotai'
-import { atomWithStorage } from 'jotai/utils'
-
-export const LEARN_DIFY_HIDDEN_STORAGE_KEY = 'explore-learn-dify-hidden'
-
-const learnDifyHiddenAtom = atomWithStorage<boolean>(
-  LEARN_DIFY_HIDDEN_STORAGE_KEY,
-  false,
-  undefined,
-  { getOnInit: true },
-)
-
-const learnDifyVisibleAtom = atom(get => !get(learnDifyHiddenAtom))
-
-export function useLearnDifyVisibleValue() {
-  return useAtomValue(learnDifyVisibleAtom)
-}
-
-export function useSetLearnDifyHidden() {
-  return useSetAtom(learnDifyHiddenAtom)
-}
diff --git a/web/app/components/explore/learn-dify/index.tsx b/web/app/components/explore/learn-dify/index.tsx
index 9fc940735f8..d057b21a215 100644
--- a/web/app/components/explore/learn-dify/index.tsx
+++ b/web/app/components/explore/learn-dify/index.tsx
@@ -7,8 +7,8 @@ import * as React from 'react'
 import { useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useLearnDifyAppList } from '@/service/use-explore'
-import { useLearnDifyVisibleValue, useSetLearnDifyHidden } from './atoms'
 import LearnDifyItem from './item'
+import { useLearnDifyHiddenValue, useSetLearnDifyHidden } from './storage'
 
 type LearnDifyProps = {
   canCreate?: boolean
@@ -132,10 +132,10 @@ const LearnDifyContent = ({
 }
 
 const DismissibleLearnDify = (props: LearnDifyProps) => {
-  const visible = useLearnDifyVisibleValue()
+  const hidden = useLearnDifyHiddenValue()
   const setHidden = useSetLearnDifyHidden()
 
-  if (!visible)
+  if (hidden)
     return null
 
   return <LearnDifyContent {...props} onHide={() => setHidden(true)} />
diff --git a/web/app/components/explore/learn-dify/storage.ts b/web/app/components/explore/learn-dify/storage.ts
new file mode 100644
index 00000000000..479a4b287a3
--- /dev/null
+++ b/web/app/components/explore/learn-dify/storage.ts
@@ -0,0 +1,16 @@
+'use client'
+
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+export const LEARN_DIFY_HIDDEN_STORAGE_KEY = 'explore-learn-dify-hidden'
+
+const [
+  _useLearnDifyHidden,
+  useLearnDifyHiddenValue,
+  useSetLearnDifyHidden,
+] = createLocalStorageState<boolean>(LEARN_DIFY_HIDDEN_STORAGE_KEY, false)
+
+export {
+  useLearnDifyHiddenValue,
+  useSetLearnDifyHidden,
+}
diff --git a/web/app/components/goto-anything/__tests__/index.spec.tsx b/web/app/components/goto-anything/__tests__/index.spec.tsx
index fe577072c59..1eeed9a6a41 100644
--- a/web/app/components/goto-anything/__tests__/index.spec.tsx
+++ b/web/app/components/goto-anything/__tests__/index.spec.tsx
@@ -71,6 +71,13 @@ vi.mock('@/context/i18n', () => ({
   useGetLanguage: () => 'en_US',
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission', () => ({
+  default: () => ({
+    canInstallPlugin: true,
+    currentDifyVersion: '1.0.0',
+  }),
+}))
+
 const contextValue = { isWorkflowPage: false, isRagPipelinePage: false }
 vi.mock('../context', () => ({
   useGotoAnythingContext: () => contextValue,
diff --git a/web/app/components/goto-anything/actions/__tests__/app.spec.ts b/web/app/components/goto-anything/actions/__tests__/app.spec.ts
index 55939b2da88..b8d58512efe 100644
--- a/web/app/components/goto-anything/actions/__tests__/app.spec.ts
+++ b/web/app/components/goto-anything/actions/__tests__/app.spec.ts
@@ -6,7 +6,7 @@ vi.mock('@/service/apps', () => ({
 }))
 
 vi.mock('@/utils/app-redirection', () => ({
-  getRedirectionPath: vi.fn((_isAdmin: boolean, app: { id: string }) => `/app/${app.id}`),
+  getRedirectionPath: vi.fn((app: { id: string }) => `/app/${app.id}`),
 }))
 
 vi.mock('../../../app/type-selector', () => ({
diff --git a/web/app/components/goto-anything/actions/app.tsx b/web/app/components/goto-anything/actions/app.tsx
index 4524ba741fa..7b156fba3e6 100644
--- a/web/app/components/goto-anything/actions/app.tsx
+++ b/web/app/components/goto-anything/actions/app.tsx
@@ -52,10 +52,7 @@ const parser = (apps: App[]): AppSearchResult[] => {
     title: app.name,
     description: app.description,
     type: 'app' as const,
-    path: getRedirectionPath(true, {
-      id: app.id,
-      mode: app.mode,
-    }),
+    path: getRedirectionPath(app),
     icon: appIcon(app),
     data: app,
   }))
@@ -70,7 +67,7 @@ const parserWithSections = (apps: App[]): SearchResult[] => {
       title: app.name,
       description: app.description,
       type: 'app' as const,
-      path: getRedirectionPath(true, { id: app.id, mode: app.mode }),
+      path: getRedirectionPath(app),
       icon: appIcon(app),
       data: app,
     })
diff --git a/web/app/components/goto-anything/index.tsx b/web/app/components/goto-anything/index.tsx
index f56ada5881d..af5b8bd7bde 100644
--- a/web/app/components/goto-anything/index.tsx
+++ b/web/app/components/goto-anything/index.tsx
@@ -5,6 +5,8 @@ import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
 import { Command } from 'cmdk'
 import { useCallback, useEffect, useMemo, useRef } from 'react'
 import { useTranslation } from 'react-i18next'
+import { PluginInstallPermissionProvider } from '../plugins/install-plugin/components/plugin-install-permission-provider'
+import useWorkspacePluginInstallPermission from '../plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import InstallFromMarketplace from '../plugins/install-plugin/install-from-marketplace'
 import { slashCommandRegistry } from './actions/commands/registry'
 import { SlashCommandProvider } from './actions/commands/slash-provider'
@@ -25,6 +27,7 @@ const GotoAnythingDialog: FC<Props> = ({
 }) => {
   const { t } = useTranslation()
   const { isWorkflowPage, isRagPipelinePage } = useGotoAnythingContext()
+  const { canInstallPlugin, currentDifyVersion } = useWorkspacePluginInstallPermission()
   const prevShowRef = useRef(false)
 
   // Search state management (called first so setSearchQuery is available)
@@ -216,13 +219,18 @@ const GotoAnythingDialog: FC<Props> = ({
         </DialogContent>
       </Dialog>
 
-      {activePlugin && (
-        <InstallFromMarketplace
-          manifest={activePlugin}
-          uniqueIdentifier={activePlugin.latest_package_identifier}
-          onClose={() => setActivePlugin(undefined)}
-          onSuccess={() => setActivePlugin(undefined)}
-        />
+      {activePlugin && canInstallPlugin && (
+        <PluginInstallPermissionProvider
+          canInstallPlugin={canInstallPlugin}
+          currentDifyVersion={currentDifyVersion}
+        >
+          <InstallFromMarketplace
+            manifest={activePlugin}
+            uniqueIdentifier={activePlugin.latest_package_identifier}
+            onClose={() => setActivePlugin(undefined)}
+            onSuccess={() => setActivePlugin(undefined)}
+          />
+        </PluginInstallPermissionProvider>
       )}
     </>
   )
diff --git a/web/app/components/header/__tests__/index.spec.tsx b/web/app/components/header/__tests__/index.spec.tsx
index d1a71c9bcd8..73530684b39 100644
--- a/web/app/components/header/__tests__/index.spec.tsx
+++ b/web/app/components/header/__tests__/index.spec.tsx
@@ -2,7 +2,7 @@ import type { AnchorHTMLAttributes, ReactElement } from 'react'
 import { fireEvent, screen } from '@testing-library/react'
 import { vi } from 'vitest'
 import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
-import Header from '../index'
+import { Header } from '../index'
 
 function createMockComponent(testId: string) {
   return () => <div data-testid={testId} />
@@ -21,7 +21,7 @@ vi.mock('@/app/components/header/app-nav', () => ({
 }))
 
 vi.mock('@/app/components/header/dataset-nav', () => ({
-  default: createMockComponent('dataset-nav'),
+  DatasetNav: createMockComponent('dataset-nav'),
 }))
 
 vi.mock('@/app/components/header/env-nav', () => ({
@@ -29,7 +29,7 @@ vi.mock('@/app/components/header/env-nav', () => ({
 }))
 
 vi.mock('@/app/components/header/explore-nav', () => ({
-  default: createMockComponent('explore-nav'),
+  ExploreNav: createMockComponent('explore-nav'),
 }))
 
 vi.mock('@/app/components/header/license-env', () => ({
@@ -41,7 +41,7 @@ vi.mock('@/app/components/header/plugins-nav', () => ({
 }))
 
 vi.mock('@/app/components/header/tools-nav', () => ({
-  default: createMockComponent('tools-nav'),
+  ToolsNav: createMockComponent('tools-nav'),
 }))
 
 vi.mock('@/app/components/header/plan-badge', () => ({
@@ -56,6 +56,7 @@ vi.mock('@/next/link', () => ({
 
 let mockIsWorkspaceEditor = false
 let mockIsDatasetOperator = false
+let mockWorkspacePermissionKeys: string[] = []
 let mockMedia = 'desktop'
 let mockEnableBilling = false
 let mockPlanType = 'sandbox'
@@ -70,6 +71,9 @@ vi.mock('@/context/app-context', () => ({
     isCurrentWorkspaceEditor: mockIsWorkspaceEditor,
     isCurrentWorkspaceDatasetOperator: mockIsDatasetOperator,
   }),
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
 }))
 
 vi.mock('@/hooks/use-breakpoints', () => ({
@@ -107,6 +111,7 @@ describe('Header', () => {
     vi.clearAllMocks()
     mockIsWorkspaceEditor = false
     mockIsDatasetOperator = false
+    mockWorkspacePermissionKeys = ['app_library.access', 'tool.manage']
     mockMedia = 'desktop'
     mockEnableBilling = false
     mockPlanType = 'sandbox'
@@ -122,6 +127,7 @@ describe('Header', () => {
     expect(screen.queryByRole('heading', { level: 1 })).not.toBeInTheDocument()
     expect(screen.queryByRole('img', { name: /dify logo/i })).not.toBeInTheDocument()
     expect(screen.getByTestId('workplace-selector')).toBeInTheDocument()
+    expect(screen.getByTestId('explore-nav')).toBeInTheDocument()
     expect(screen.getByTestId('app-nav')).toBeInTheDocument()
     expect(screen.getByTestId('account-dropdown')).toBeInTheDocument()
   })
@@ -138,8 +144,8 @@ describe('Header', () => {
     expect(screen.getByTestId('plan-badge')).toBeInTheDocument()
   })
 
-  it('should hide explore nav when user is dataset operator', () => {
-    mockIsDatasetOperator = true
+  it('should hide explore nav when workspace lacks app library access', () => {
+    mockWorkspacePermissionKeys = ['tool.manage']
     renderHeader()
 
     expect(screen.queryByTestId('explore-nav')).not.toBeInTheDocument()
@@ -201,38 +207,43 @@ describe('Header', () => {
     expect(screen.getByRole('link', { name: 'Dify' })).toHaveAttribute('href', '/apps')
   })
 
-  it('should show dataset nav for editor who is not dataset operator', () => {
-    mockIsWorkspaceEditor = true
-    mockIsDatasetOperator = false
+  it('should show app and dataset nav without page-level permissions', () => {
+    mockWorkspacePermissionKeys = []
 
     renderHeader()
 
     expect(screen.getByTestId('dataset-nav')).toBeInTheDocument()
-    expect(screen.getByTestId('explore-nav')).toBeInTheDocument()
     expect(screen.getByTestId('app-nav')).toBeInTheDocument()
   })
 
-  it('should hide dataset nav when neither editor nor dataset operator', () => {
-    mockIsWorkspaceEditor = false
-    mockIsDatasetOperator = false
+  it('should show dataset nav when workspace only has dataset mutation permissions', () => {
+    mockWorkspacePermissionKeys = ['dataset.create_and_management', 'dataset.tag.manage', 'dataset.external.connect']
 
     renderHeader()
 
-    expect(screen.queryByTestId('dataset-nav')).not.toBeInTheDocument()
+    expect(screen.getByTestId('dataset-nav')).toBeInTheDocument()
   })
 
-  it('should render mobile layout with dataset operator nav restrictions', () => {
+  it('should render mobile layout with page permission nav restrictions', () => {
     mockMedia = 'mobile'
-    mockIsDatasetOperator = true
+    mockWorkspacePermissionKeys = []
 
     renderHeader()
 
     expect(screen.queryByTestId('explore-nav')).not.toBeInTheDocument()
-    expect(screen.queryByTestId('app-nav')).not.toBeInTheDocument()
     expect(screen.queryByTestId('tools-nav')).not.toBeInTheDocument()
+    expect(screen.getByTestId('app-nav')).toBeInTheDocument()
     expect(screen.getByTestId('dataset-nav')).toBeInTheDocument()
   })
 
+  it('should show tools nav when workspace has MCP management access', () => {
+    mockWorkspacePermissionKeys = ['mcp.manage']
+
+    renderHeader()
+
+    expect(screen.getByTestId('tools-nav')).toBeInTheDocument()
+  })
+
   it('should render mobile layout with billing enabled', () => {
     mockMedia = 'mobile'
     mockEnableBilling = true
diff --git a/web/app/components/header/account-dropdown/__tests__/index.spec.tsx b/web/app/components/header/account-dropdown/__tests__/index.spec.tsx
index e459ca2317a..81b08046a94 100644
--- a/web/app/components/header/account-dropdown/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-dropdown/__tests__/index.spec.tsx
@@ -147,6 +147,7 @@ const baseAppContextValue: AppContextValue = {
   useSelector: vi.fn(),
   isLoadingCurrentWorkspace: false,
   isValidatingCurrentWorkspace: false,
+  workspacePermissionKeys: [],
 }
 
 describe('AccountDropdown', () => {
diff --git a/web/app/components/header/account-dropdown/index.tsx b/web/app/components/header/account-dropdown/index.tsx
index 5d9524d9fe5..dbadfc1f64c 100644
--- a/web/app/components/header/account-dropdown/index.tsx
+++ b/web/app/components/header/account-dropdown/index.tsx
@@ -8,10 +8,10 @@ import {
   DropdownMenuContent,
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { resetUser } from '@/app/components/base/amplitude/utils'
+import { useSetEducationExpiredHasNoticed, useSetEducationReverifyHasNoticed, useSetEducationReverifyPrevExpireAt } from '@/app/education-apply/storage'
 import { useAppContext } from '@/context/app-context'
 import { useRouter } from '@/next/navigation'
 import { useLogout } from '@/service/use-common'
@@ -27,9 +27,6 @@ type AccountDropdownProps = {
   variant?: 'default' | 'mainNav'
 }
 
-const EDUCATION_REVERIFY_PREV_EXPIRE_AT_KEY = 'education-reverify-prev-expire-at'
-const EDUCATION_REVERIFY_HAS_NOTICED_KEY = 'education-reverify-has-noticed'
-const EDUCATION_EXPIRED_HAS_NOTICED_KEY = 'education-expired-has-noticed'
 const mainNavMenuPopupClassName = 'w-60 max-w-80 overflow-hidden bg-components-panel-bg-blur! p-0! backdrop-blur-[5px]'
 
 export default function AppSelector({
@@ -41,9 +38,9 @@ export default function AppSelector({
   const [isAccountMenuOpen, setIsAccountMenuOpen] = useState(false)
   const { t } = useTranslation()
   const { userProfile, langGeniusVersionInfo } = useAppContext()
-  const clearEducationReverifyPrevExpireAt = useSetLocalStorage<number>(EDUCATION_REVERIFY_PREV_EXPIRE_AT_KEY)
-  const clearEducationReverifyHasNoticed = useSetLocalStorage<boolean>(EDUCATION_REVERIFY_HAS_NOTICED_KEY)
-  const clearEducationExpiredHasNoticed = useSetLocalStorage<boolean>(EDUCATION_EXPIRED_HAS_NOTICED_KEY)
+  const clearEducationReverifyPrevExpireAt = useSetEducationReverifyPrevExpireAt()
+  const clearEducationReverifyHasNoticed = useSetEducationReverifyHasNoticed()
+  const clearEducationExpiredHasNoticed = useSetEducationExpiredHasNoticed()
 
   const { mutateAsync: logout } = useLogout()
 
diff --git a/web/app/components/header/account-setting/__tests__/constants.spec.ts b/web/app/components/header/account-setting/__tests__/constants.spec.ts
index e99a278f307..04b9db50741 100644
--- a/web/app/components/header/account-setting/__tests__/constants.spec.ts
+++ b/web/app/components/header/account-setting/__tests__/constants.spec.ts
@@ -20,6 +20,8 @@ describe('AccountSetting Constants', () => {
   it('should have correct ACCOUNT_SETTING_TAB values', () => {
     expect(ACCOUNT_SETTING_TAB.PROVIDER).toBe('provider')
     expect(ACCOUNT_SETTING_TAB.MEMBERS).toBe('members')
+    expect(ACCOUNT_SETTING_TAB.PERMISSIONS).toBe('permissions')
+    expect(ACCOUNT_SETTING_TAB.ACCESS_RULES).toBe('access-rules')
     expect(ACCOUNT_SETTING_TAB.BILLING).toBe('billing')
     expect(ACCOUNT_SETTING_TAB.DATA_SOURCE).toBe('data-source')
     expect(ACCOUNT_SETTING_TAB.API_BASED_EXTENSION).toBe('custom-endpoint')
@@ -34,6 +36,8 @@ describe('AccountSetting Constants', () => {
   it('isValidAccountSettingTab should return true for valid tabs', () => {
     expect(isValidAccountSettingTab('provider')).toBe(true)
     expect(isValidAccountSettingTab('members')).toBe(true)
+    expect(isValidAccountSettingTab('permissions')).toBe(true)
+    expect(isValidAccountSettingTab('access-rules')).toBe(true)
     expect(isValidAccountSettingTab('billing')).toBe(true)
     expect(isValidAccountSettingTab('data-source')).toBe(true)
     expect(isValidAccountSettingTab('custom-endpoint')).toBe(true)
@@ -48,6 +52,8 @@ describe('AccountSetting Constants', () => {
   })
 
   it('isValidSettingsTab should include integrations tabs', () => {
+    expect(isValidSettingsTab('permissions')).toBe(true)
+    expect(isValidSettingsTab('access-rules')).toBe(true)
     expect(isValidSettingsTab('billing')).toBe(true)
     expect(isValidSettingsTab('language')).toBe(true)
     expect(isValidSettingsTab('provider')).toBe(true)
diff --git a/web/app/components/header/account-setting/__tests__/index.spec.tsx b/web/app/components/header/account-setting/__tests__/index.spec.tsx
index d273b240b12..d59199769ed 100644
--- a/web/app/components/header/account-setting/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/__tests__/index.spec.tsx
@@ -10,6 +10,9 @@ import { ACCOUNT_SETTING_TAB } from '../constants'
 import AccountSetting from '../index'
 
 const mockResetModelProviderListExpanded = vi.fn()
+const mockAppContextState = vi.hoisted(() => ({
+  current: null as unknown,
+}))
 
 vi.mock('@/context/provider-context', async (importOriginal) => {
   const actual = await importOriginal<typeof import('@/context/provider-context')>()
@@ -24,6 +27,7 @@ vi.mock('@/context/app-context', async (importOriginal) => {
   return {
     ...actual,
     useAppContext: vi.fn(),
+    useSelector: vi.fn((selector: (state: unknown) => unknown) => selector(mockAppContextState.current)),
   }
 })
 
@@ -111,6 +115,16 @@ vi.mock('@/app/components/header/account-setting/data-source-page-new', () => ({
   default: () => <div data-testid="data-source-page" />,
 }))
 
+vi.mock('@/app/components/header/account-setting/permissions-page', () => ({
+  __esModule: true,
+  default: () => <div data-testid="permissions-page" />,
+}))
+
+vi.mock('@/app/components/header/account-setting/access-rules-page', () => ({
+  __esModule: true,
+  default: () => <div data-testid="access-rules-page" />,
+}))
+
 const baseAppContextValue: AppContextValue = {
   userProfile: {
     id: '1',
@@ -150,6 +164,16 @@ const baseAppContextValue: AppContextValue = {
   useSelector: vi.fn(),
   isLoadingCurrentWorkspace: false,
   isValidatingCurrentWorkspace: false,
+  workspacePermissionKeys: [
+    'workspace.member.manage',
+    'workspace.role.manage',
+    'data_source.manage',
+    'api_extension.manage',
+    'customization.manage',
+    'billing.view',
+    'billing.manage',
+    'billing.subscription.manage',
+  ],
 }
 
 describe('AccountSetting', () => {
@@ -199,6 +223,7 @@ describe('AccountSetting', () => {
       enableReplaceWebAppLogo: true,
     })
     vi.mocked(useAppContext).mockReturnValue(baseAppContextValue)
+    mockAppContextState.current = baseAppContextValue
     vi.mocked(useBreakpoints).mockReturnValue(MediaType.pc)
   })
 
@@ -209,9 +234,11 @@ describe('AccountSetting', () => {
 
       // Assert
       expect(screen.getByText('common.settings.settings'))!.toBeInTheDocument()
-      expect(screen.getByText('common.settings.workspace'))!.toBeInTheDocument()
+      expect(screen.getAllByText('common.settings.workspace').length).toBeGreaterThan(0)
       expect(screen.queryByText('common.settings.provider'))!.not.toBeInTheDocument()
       expect(screen.getAllByText('common.settings.members').length).toBeGreaterThan(0)
+      expect(screen.getByRole('button', { name: 'common.settings.rolesAndPermissions' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'common.settings.resourceAccess' })).toBeInTheDocument()
       expect(screen.getByText('common.settings.billing'))!.toBeInTheDocument()
       expect(screen.queryByText('common.settings.dataSource'))!.not.toBeInTheDocument()
       expect(screen.queryByText('common.settings.customEndpoint'))!.not.toBeInTheDocument()
@@ -301,53 +328,82 @@ describe('AccountSetting', () => {
       expect(screen.queryByText('common.settings.provider')).not.toBeInTheDocument()
     })
 
-    it('should filter items for dataset operator', () => {
+    it('should not hide workspace menu items solely for dataset operators', () => {
       // Arrange
-      vi.mocked(useAppContext).mockReturnValue({
+      const datasetOperatorContext = {
         ...baseAppContextValue,
         isCurrentWorkspaceDatasetOperator: true,
-      })
+      }
+      vi.mocked(useAppContext).mockReturnValue(datasetOperatorContext)
+      mockAppContextState.current = datasetOperatorContext
 
       // Act
       renderAccountSetting()
 
       // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
-      // Assert
+      expect(screen.getByRole('button', { name: 'common.settings.members' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'common.settings.rolesAndPermissions' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'common.settings.resourceAccess' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'common.settings.billing' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'custom.custom' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'common.settings.preferences' })).toBeInTheDocument()
+    })
+
+    it('should keep moved integrations hidden when api extension permission is missing', () => {
+      // Arrange
+      const contextWithoutApiExtensionPermission = {
+        ...baseAppContextValue,
+        workspacePermissionKeys: baseAppContextValue.workspacePermissionKeys.filter(key => key !== 'api_extension.manage'),
+      }
+      vi.mocked(useAppContext).mockReturnValue(contextWithoutApiExtensionPermission)
+      mockAppContextState.current = contextWithoutApiExtensionPermission
+
+      // Act
+      renderAccountSetting()
+
       // Assert
       expect(screen.queryByText('common.settings.provider')).not.toBeInTheDocument()
-      expect(screen.queryByRole('button', { name: 'common.settings.members' })).not.toBeInTheDocument()
+      expect(screen.queryByText('common.settings.dataSource')).not.toBeInTheDocument()
+      expect(screen.queryByText('common.settings.customEndpoint')).not.toBeInTheDocument()
+    })
+
+    it('should show custom tab when customization permission is missing', () => {
+      // Arrange
+      const contextWithoutCustomizationPermission = {
+        ...baseAppContextValue,
+        workspacePermissionKeys: baseAppContextValue.workspacePermissionKeys.filter(key => key !== 'customization.manage'),
+      }
+      vi.mocked(useAppContext).mockReturnValue(contextWithoutCustomizationPermission)
+      mockAppContextState.current = contextWithoutCustomizationPermission
+
+      // Act
+      renderAccountSetting()
+
+      // Assert
+      expect(screen.queryByText('common.settings.provider')).not.toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'common.settings.members' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'custom.custom' })).toBeInTheDocument()
       expect(screen.getByText('common.settings.preferences'))!.toBeInTheDocument()
     })
 
+    it('should hide role and resource access entries when role management permission is missing', () => {
+      // Arrange
+      const contextWithoutRoleManagePermission = {
+        ...baseAppContextValue,
+        workspacePermissionKeys: baseAppContextValue.workspacePermissionKeys.filter(key => key !== 'workspace.role.manage'),
+      }
+      vi.mocked(useAppContext).mockReturnValue(contextWithoutRoleManagePermission)
+      mockAppContextState.current = contextWithoutRoleManagePermission
+
+      // Act
+      renderAccountSetting()
+
+      // Assert
+      expect(screen.getByRole('button', { name: 'common.settings.members' })).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'common.settings.rolesAndPermissions' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
+    })
+
     it('should hide billing and custom tabs when disabled', () => {
       // Arrange
       vi.mocked(useProviderContext).mockReturnValue({
@@ -394,6 +450,38 @@ describe('AccountSetting', () => {
       expect(screen.queryByText('common.settings.billing')).not.toBeInTheDocument()
       expect(screen.queryByText('custom.custom')).not.toBeInTheDocument()
     })
+
+    it('should hide billing entry when billing view permission is missing', () => {
+      // Arrange
+      const contextWithoutBillingViewPermission = {
+        ...baseAppContextValue,
+        workspacePermissionKeys: baseAppContextValue.workspacePermissionKeys.filter(key => key !== 'billing.view'),
+      }
+      vi.mocked(useAppContext).mockReturnValue(contextWithoutBillingViewPermission)
+      mockAppContextState.current = contextWithoutBillingViewPermission
+
+      // Act
+      renderAccountSetting()
+
+      // Assert
+      expect(screen.queryByRole('button', { name: 'common.settings.billing' })).not.toBeInTheDocument()
+    })
+
+    it('should not render billing page when active billing tab lacks billing view permission', () => {
+      // Arrange
+      const contextWithoutBillingViewPermission = {
+        ...baseAppContextValue,
+        workspacePermissionKeys: baseAppContextValue.workspacePermissionKeys.filter(key => key !== 'billing.view'),
+      }
+      vi.mocked(useAppContext).mockReturnValue(contextWithoutBillingViewPermission)
+      mockAppContextState.current = contextWithoutBillingViewPermission
+
+      // Act
+      renderAccountSetting({ initialTab: ACCOUNT_SETTING_TAB.BILLING })
+
+      // Assert
+      expect(screen.queryByTestId('billing-page')).not.toBeInTheDocument()
+    })
   })
 
   describe('Tab Navigation', () => {
@@ -428,6 +516,15 @@ describe('AccountSetting', () => {
       fireEvent.click(screen.getAllByText('common.settings.members')[0]!)
       expect(screen.getAllByText('common.settings.members').length).toBeGreaterThan(1)
 
+      // Roles & Permissions
+      fireEvent.click(screen.getByRole('button', { name: 'common.settings.rolesAndPermissions' }))
+      expect(screen.getByTestId('permissions-page')).toBeInTheDocument()
+
+      // Resource Access
+      fireEvent.click(screen.getByRole('button', { name: 'common.settings.resourceAccess' }))
+      expect(screen.getByText('common.settings.resourceAccessDescription')).toBeInTheDocument()
+      expect(screen.getByTestId('access-rules-page')).toBeInTheDocument()
+
       // Language
       fireEvent.click(screen.getByText('common.settings.preferences'))
       expect(screen.getByText('common.account.general')).toBeInTheDocument()
diff --git a/web/app/components/header/account-setting/__tests__/menu-dialog.spec.tsx b/web/app/components/header/account-setting/__tests__/menu-dialog.spec.tsx
index b69b9e89b2c..d202ee7964a 100644
--- a/web/app/components/header/account-setting/__tests__/menu-dialog.spec.tsx
+++ b/web/app/components/header/account-setting/__tests__/menu-dialog.spec.tsx
@@ -17,6 +17,7 @@ describe('MenuDialog', () => {
 
       // Assert
       expect(screen.getByTestId('dialog-content')).toBeInTheDocument()
+      expect(screen.getByRole('dialog').children).toHaveLength(1)
     })
 
     it('should not render children when show is false', () => {
diff --git a/web/app/components/header/account-setting/__tests__/permission-group-list.spec.tsx b/web/app/components/header/account-setting/__tests__/permission-group-list.spec.tsx
new file mode 100644
index 00000000000..4f6908d6c57
--- /dev/null
+++ b/web/app/components/header/account-setting/__tests__/permission-group-list.spec.tsx
@@ -0,0 +1,255 @@
+import type { PermissionGroup } from '@/models/access-control'
+import { render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import PermissionGroupList from '../permission-group-list'
+
+const createPermissionGroup = (overrides: Partial<PermissionGroup> = {}): PermissionGroup => ({
+  group_key: 'app_management',
+  group_name: 'App management',
+  description: '',
+  permissions: [
+    {
+      key: 'app.dsl.import',
+      name: 'Import DSL',
+      description: '',
+    },
+    {
+      key: 'app.dsl.export',
+      name: 'Export DSL',
+      description: '',
+    },
+  ],
+  ...overrides,
+})
+
+const permissionGroups = [
+  createPermissionGroup(),
+  createPermissionGroup({
+    group_key: 'api_access',
+    group_name: 'API access',
+    permissions: [
+      {
+        key: 'app.api.view',
+        name: 'View API',
+        description: '',
+      },
+    ],
+  }),
+]
+
+const getPermissionRow = (permissionName: string) => screen.getByText(permissionName).closest('div')!
+
+const getPermissionCheckbox = (permissionName: string) => within(getPermissionRow(permissionName)).getByRole('checkbox')
+
+describe('PermissionGroupList', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  // Rendering keeps the permission catalog visible as grouped collapsible rows.
+  describe('Rendering', () => {
+    it('should render the list as a flexible scroll region', () => {
+      const { container } = render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={[]}
+          onChange={vi.fn()}
+        />,
+      )
+
+      expect(container.firstElementChild).toHaveClass('min-h-0', 'flex-1')
+      expect(container.querySelector('.h-full.overflow-hidden')).toBeInTheDocument()
+    })
+
+    it('should render an empty state when there are no permission groups', () => {
+      render(<PermissionGroupList groups={[]} value={[]} onChange={vi.fn()} />)
+
+      expect(screen.getByText('permission.permissionList.noPermissionsFound')).toHaveClass('flex', 'h-full', 'items-center', 'justify-center')
+    })
+
+    it('should expand the first selected group by default', () => {
+      render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={['app.api.view']}
+          onChange={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByRole('button', { name: /API access/ })).toHaveAttribute('aria-expanded', 'true')
+      expect(getPermissionCheckbox('View API')).toHaveAttribute('aria-checked', 'true')
+      expect(screen.queryByText('Import DSL')).not.toBeInTheDocument()
+    })
+  })
+
+  // Group rows can be expanded and collapsed without changing selected values.
+  describe('Group Interaction', () => {
+    it('should toggle a group when clicking its header', async () => {
+      const user = userEvent.setup()
+
+      render(<PermissionGroupList groups={permissionGroups} value={[]} onChange={vi.fn()} />)
+
+      const apiGroupButton = screen.getByRole('button', { name: /API access/ })
+      expect(apiGroupButton).toHaveAttribute('aria-expanded', 'false')
+
+      await user.click(apiGroupButton)
+
+      expect(apiGroupButton).toHaveAttribute('aria-expanded', 'true')
+      expect(getPermissionCheckbox('View API')).toBeInTheDocument()
+    })
+
+    it('should toggle a group when clicking its arrow control', async () => {
+      const user = userEvent.setup()
+
+      render(<PermissionGroupList groups={permissionGroups} value={[]} onChange={vi.fn()} />)
+
+      const apiGroupButton = screen.getByRole('button', { name: /API access/ })
+      expect(apiGroupButton).toHaveAttribute('aria-expanded', 'false')
+
+      await user.click(screen.getByRole('button', { name: 'permission.permissionList.expandGroup' }))
+
+      expect(apiGroupButton).toHaveAttribute('aria-expanded', 'true')
+    })
+  })
+
+  // Checkbox interactions update only the selected permission key set.
+  describe('Permission Interaction', () => {
+    it('should add a permission when clicking an unchecked item row', async () => {
+      const user = userEvent.setup()
+      const handleChange = vi.fn()
+
+      render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={['app.dsl.export']}
+          onChange={handleChange}
+        />,
+      )
+
+      await user.click(screen.getByText('Import DSL'))
+
+      expect(handleChange).toHaveBeenCalledTimes(1)
+      expect(handleChange).toHaveBeenCalledWith(['app.dsl.export', 'app.dsl.import'])
+    })
+
+    it('should remove a selected permission when clicking its item row', async () => {
+      const user = userEvent.setup()
+      const handleChange = vi.fn()
+
+      render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={['app.dsl.export']}
+          onChange={handleChange}
+        />,
+      )
+
+      await user.click(screen.getByText('Export DSL'))
+
+      expect(handleChange).toHaveBeenCalledTimes(1)
+      expect(handleChange).toHaveBeenCalledWith([])
+    })
+
+    it('should show selected counts on groups with selected permissions', () => {
+      render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={['app.dsl.export']}
+          onChange={vi.fn()}
+        />,
+      )
+
+      const appManagementRow = screen.getByRole('button', { name: /App management/ }).parentElement!
+      expect(within(appManagementRow).getByText('1/2')).toBeInTheDocument()
+    })
+
+    it('should select all permissions in a group without toggling expansion', async () => {
+      const user = userEvent.setup()
+      const handleChange = vi.fn()
+
+      render(<PermissionGroupList groups={permissionGroups} value={[]} onChange={handleChange} />)
+
+      const appManagementButton = screen.getByRole('button', { name: /App management/ })
+      const appManagementRow = appManagementButton.parentElement!
+      await user.click(within(appManagementRow).getByRole('button', { name: 'permission.permissionList.selectAll' }))
+
+      expect(handleChange).toHaveBeenCalledTimes(1)
+      expect(handleChange).toHaveBeenCalledWith(['app.dsl.import', 'app.dsl.export'])
+      expect(appManagementButton).toHaveAttribute('aria-expanded', 'true')
+    })
+
+    it('should clear all permissions in a fully selected group', async () => {
+      const user = userEvent.setup()
+      const handleChange = vi.fn()
+
+      render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={['app.dsl.import', 'app.dsl.export', 'app.api.view']}
+          onChange={handleChange}
+        />,
+      )
+
+      const appManagementRow = screen.getByRole('button', { name: /App management/ }).parentElement!
+      await user.click(within(appManagementRow).getByRole('button', { name: 'permission.permissionList.clearAll' }))
+
+      expect(handleChange).toHaveBeenCalledTimes(1)
+      expect(handleChange).toHaveBeenCalledWith(['app.api.view'])
+    })
+  })
+
+  // Read-only mode still allows browsing groups but blocks permission mutation.
+  describe('Read-only Mode', () => {
+    it('should hide group bulk actions in read-only mode', () => {
+      render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={['app.dsl.export']}
+          onChange={vi.fn()}
+          readonly
+        />,
+      )
+
+      expect(screen.queryByRole('button', { name: 'permission.permissionList.selectAll' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'permission.permissionList.clearAll' })).not.toBeInTheDocument()
+    })
+
+    it('should not change permissions when clicking a row or checkbox in read-only mode', async () => {
+      const user = userEvent.setup()
+      const handleChange = vi.fn()
+
+      render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={['app.dsl.export']}
+          onChange={handleChange}
+          readonly
+        />,
+      )
+
+      await user.click(screen.getByText('Import DSL'))
+      await user.click(getPermissionCheckbox('Export DSL'))
+
+      expect(handleChange).not.toHaveBeenCalled()
+    })
+
+    it('should still allow expanding groups in read-only mode', async () => {
+      const user = userEvent.setup()
+
+      render(
+        <PermissionGroupList
+          groups={permissionGroups}
+          value={[]}
+          onChange={vi.fn()}
+          readonly
+        />,
+      )
+
+      const apiGroupButton = screen.getByRole('button', { name: /API access/ })
+      await user.click(apiGroupButton)
+
+      expect(apiGroupButton).toHaveAttribute('aria-expanded', 'true')
+      expect(getPermissionCheckbox('View API')).toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/__tests__/use-integrations-setting.spec.ts b/web/app/components/header/account-setting/__tests__/use-integrations-setting.spec.ts
index f850c60d8b7..e8b5536b40e 100644
--- a/web/app/components/header/account-setting/__tests__/use-integrations-setting.spec.ts
+++ b/web/app/components/header/account-setting/__tests__/use-integrations-setting.spec.ts
@@ -40,4 +40,25 @@ describe('useIntegrationsSetting', () => {
 
     expect(mockSetShowAccountSettingModal).toHaveBeenCalledWith({ payload: 'mcp' })
   })
+
+  it('should preserve the agent source for agent-scoped settings', () => {
+    const { result } = renderHook(() => useIntegrationsSetting())
+
+    act(() => {
+      result.current({ payload: ACCOUNT_SETTING_TAB.PROVIDER, source: 'agent' })
+    })
+
+    expect(mockSetShowAccountSettingModal).toHaveBeenCalledWith({ payload: 'provider', source: 'agent' })
+  })
+
+  it('should preserve the cancel callback for migrated integrations settings', () => {
+    const onCancelCallback = vi.fn()
+    const { result } = renderHook(() => useIntegrationsSetting())
+
+    act(() => {
+      result.current({ payload: ACCOUNT_SETTING_TAB.PROVIDER, onCancelCallback })
+    })
+
+    expect(mockSetShowAccountSettingModal).toHaveBeenCalledWith({ payload: 'provider', onCancelCallback })
+  })
 })
diff --git a/web/app/components/header/account-setting/__tests__/workspace-role-checkbox-list.spec.tsx b/web/app/components/header/account-setting/__tests__/workspace-role-checkbox-list.spec.tsx
new file mode 100644
index 00000000000..653e1737790
--- /dev/null
+++ b/web/app/components/header/account-setting/__tests__/workspace-role-checkbox-list.spec.tsx
@@ -0,0 +1,76 @@
+import type { Role } from '@/models/access-control'
+import { render, screen } from '@testing-library/react'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
+import WorkspaceRoleCheckboxList from '../workspace-role-checkbox-list'
+
+vi.mock('@/service/access-control/use-workspace-roles')
+
+const createRole = (overrides: Partial<Role>): Role => ({
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_custom',
+  name: 'Role',
+  description: '',
+  is_builtin: false,
+  permission_keys: [],
+  role_tag: '',
+  ...overrides,
+})
+
+const mockRoles = [
+  createRole({ id: 'role-1', name: 'First role' }),
+  createRole({ id: 'role-2', name: 'Second role' }),
+]
+
+describe('WorkspaceRoleCheckboxList', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(useWorkspaceRoleList).mockReturnValue({
+      data: {
+        pages: [{
+          data: mockRoles,
+          pagination: {
+            total_count: 2,
+            per_page: 20,
+            current_page: 1,
+            total_pages: 1,
+          },
+        }],
+        pageParams: [1],
+      },
+      isLoading: false,
+      error: null,
+      hasNextPage: false,
+      isFetchingNextPage: false,
+      fetchNextPage: vi.fn(),
+    } as unknown as ReturnType<typeof useWorkspaceRoleList>)
+  })
+
+  it('should render checkboxes when multiple roles are allowed', () => {
+    render(
+      <WorkspaceRoleCheckboxList
+        selectedRoleIds={['role-1']}
+        selectedRoles={[mockRoles[0]!]}
+        onSelectedRolesChange={vi.fn()}
+      />,
+    )
+
+    expect(screen.getByRole('checkbox', { name: /First role/i })).toBeInTheDocument()
+    expect(screen.queryByRole('radio', { name: /First role/i })).not.toBeInTheDocument()
+  })
+
+  it('should render radios when only one role is allowed', () => {
+    render(
+      <WorkspaceRoleCheckboxList
+        selectedRoleIds={['role-1']}
+        selectedRoles={[mockRoles[0]!]}
+        allowMultipleRoles={false}
+        onSelectedRolesChange={vi.fn()}
+      />,
+    )
+
+    expect(screen.getByRole('radio', { name: /First role/i })).toBeInTheDocument()
+    expect(screen.queryByRole('checkbox', { name: /First role/i })).not.toBeInTheDocument()
+  })
+})
diff --git a/web/app/components/header/account-setting/access-rules-page/__tests__/access-rule-section.spec.tsx b/web/app/components/header/account-setting/access-rules-page/__tests__/access-rule-section.spec.tsx
new file mode 100644
index 00000000000..35dd91459b6
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/__tests__/access-rule-section.spec.tsx
@@ -0,0 +1,226 @@
+import type { ReactNode } from 'react'
+import type { AccessPolicyWithBindings } from '@/models/access-control'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import AccessRuleSection from '../access-rule-section'
+
+const mocks = vi.hoisted(() => ({
+  workspacePermissionKeys: [] as string[],
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn((selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mocks.workspacePermissionKeys,
+  })),
+}))
+
+const rule: AccessPolicyWithBindings = {
+  policy: {
+    id: 'app-rule-1',
+    tenant_id: 'tenant-1',
+    resource_type: 'app',
+    policy_key: 'app-rule',
+    name: 'Full Control',
+    description: 'Can edit and publish apps.',
+    permission_keys: ['app.edit'],
+    is_builtin: true,
+    category: 'global_system_default',
+    created_at: '2026-01-01',
+    updated_at: '2026-01-01',
+  },
+  roles: [{
+    role_id: 'role-1',
+    role_name: 'Admin',
+    binding_id: 'role-binding-1',
+    is_locked: true,
+    role_tag: '',
+  }],
+  accounts: [{
+    account_id: 'account-1',
+    account_name: 'Levi',
+    binding_id: 'account-binding-1',
+    is_locked: false,
+  }],
+}
+
+let intersectionObserverCallback: IntersectionObserverCallback | null = null
+
+class MockIntersectionObserver {
+  constructor(callback: IntersectionObserverCallback) {
+    intersectionObserverCallback = callback
+  }
+
+  observe = vi.fn()
+  disconnect = vi.fn()
+}
+
+const renderWithQueryClient = (children: ReactNode) => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      {children}
+    </QueryClientProvider>,
+  )
+}
+
+describe('AccessRuleSection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.workspacePermissionKeys = []
+    intersectionObserverCallback = null
+    globalThis.IntersectionObserver = MockIntersectionObserver as unknown as typeof IntersectionObserver
+  })
+
+  it('should render a collapsed group and expand it when the header is clicked', async () => {
+    render(
+      <AccessRuleSection
+        title="App Access Rules"
+        rules={[rule]}
+        totalCount={1}
+        isLoadingRules={false}
+      />,
+    )
+
+    expect(screen.queryByText('Full Control')).not.toBeInTheDocument()
+
+    await userEvent.click(screen.getByRole('button', { expanded: false }))
+
+    expect(screen.getByText('Full Control')).toBeInTheDocument()
+  })
+
+  it('should summarize total permission sets without binding counts', () => {
+    render(
+      <AccessRuleSection
+        title="App Access Rules"
+        rules={[rule]}
+        totalCount={2}
+        isLoadingRules={false}
+      />,
+    )
+
+    expect(screen.getByText(/permission\.accessRule\.summary/)).toHaveTextContent('"count":2')
+    expect(screen.queryByText(/permission\.accessRule\.lockedSummary/)).not.toBeInTheDocument()
+  })
+
+  it('should render a placeholder when a rule has no description', () => {
+    render(
+      <AccessRuleSection
+        title="App Access Rules"
+        rules={[{
+          ...rule,
+          policy: {
+            ...rule.policy,
+            description: '',
+          },
+        }]}
+        totalCount={1}
+        isLoadingRules={false}
+        defaultExpanded
+      />,
+    )
+
+    expect(screen.getByText('permission.accessRule.noDescription')).toBeInTheDocument()
+  })
+
+  it('should fetch the next page when the expanded group reaches its list anchor', () => {
+    const fetchNextPage = vi.fn()
+
+    render(
+      <AccessRuleSection
+        title="App Access Rules"
+        rules={[rule]}
+        totalCount={2}
+        isLoadingRules={false}
+        hasNextPage
+        fetchNextPage={fetchNextPage}
+        defaultExpanded
+      />,
+    )
+
+    intersectionObserverCallback?.(
+      [{ isIntersecting: true } as IntersectionObserverEntry],
+      {} as IntersectionObserver,
+    )
+
+    expect(fetchNextPage).toHaveBeenCalledTimes(1)
+  })
+
+  it('should not fetch more while a next page is already loading', () => {
+    const fetchNextPage = vi.fn()
+
+    render(
+      <AccessRuleSection
+        title="App Access Rules"
+        rules={[rule]}
+        totalCount={2}
+        isLoadingRules={false}
+        isFetchingNextPage
+        hasNextPage
+        fetchNextPage={fetchNextPage}
+        defaultExpanded
+      />,
+    )
+
+    intersectionObserverCallback?.(
+      [{ isIntersecting: true } as IntersectionObserverEntry],
+      {} as IntersectionObserver,
+    )
+
+    expect(fetchNextPage).not.toHaveBeenCalled()
+  })
+
+  it('should expose create action when workspace role management is allowed', async () => {
+    mocks.workspacePermissionKeys = ['workspace.role.manage']
+    const onCreate = vi.fn()
+
+    renderWithQueryClient(
+      <AccessRuleSection
+        title="App Access Rules"
+        rules={[rule]}
+        totalCount={1}
+        isLoadingRules={false}
+        onCreate={onCreate}
+      />,
+    )
+
+    await userEvent.click(screen.getByRole('button', { name: /permission\.accessRule\.newPermissionSet/ }))
+
+    expect(onCreate).toHaveBeenCalledTimes(1)
+  })
+
+  it('should keep row actions when workspace role management is allowed', () => {
+    mocks.workspacePermissionKeys = ['workspace.role.manage']
+
+    renderWithQueryClient(
+      <AccessRuleSection
+        title="App Access Rules"
+        rules={[rule]}
+        totalCount={1}
+        isLoadingRules={false}
+        defaultExpanded
+      />,
+    )
+
+    expect(screen.getByRole('button', { name: 'common.operation.moreActions' })).toBeInTheDocument()
+  })
+
+  it('should hide create action when workspace role management is missing', () => {
+    render(
+      <AccessRuleSection
+        title="App Access Rules"
+        rules={[rule]}
+        totalCount={1}
+        isLoadingRules={false}
+      />,
+    )
+
+    expect(screen.queryByRole('button', { name: /permission\.accessRule\.newPermissionSet/ })).not.toBeInTheDocument()
+  })
+})
diff --git a/web/app/components/header/account-setting/access-rules-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/access-rules-page/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..1658b851092
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/__tests__/index.spec.tsx
@@ -0,0 +1,241 @@
+import type { AccessPolicyWithBindings } from '@/models/access-control'
+import { toast } from '@langgenius/dify-ui/toast'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import {
+  useCreateAccessRule,
+  useInfiniteWorkspaceAppAccessRules,
+  useInfiniteWorkspaceDatasetAccessRules,
+  useUpdateAccessRule,
+} from '@/service/access-control/use-workspace-access-rules'
+import AccessRulesPage from '../index'
+
+const mocks = vi.hoisted(() => ({
+  createAccessRule: vi.fn(),
+  updateAccessRule: vi.fn(),
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    success: vi.fn(),
+  },
+}))
+
+vi.mock('@/service/access-control/use-workspace-access-rules', () => ({
+  workspaceAccessRulesQueryKeys: {
+    app: () => ['workspace-access-rules', 'app'],
+    dataset: () => ['workspace-access-rules', 'dataset'],
+  },
+  useCreateAccessRule: vi.fn(),
+  useInfiniteWorkspaceAppAccessRules: vi.fn(),
+  useInfiniteWorkspaceDatasetAccessRules: vi.fn(),
+  useUpdateAccessRule: vi.fn(),
+}))
+
+vi.mock('../access-rule-section', () => ({
+  default: ({
+    title,
+    rules,
+    onCreate,
+    onEditRule,
+  }: {
+    title: string
+    rules: AccessPolicyWithBindings[]
+    onCreate: () => void
+    onEditRule: (rule: AccessPolicyWithBindings) => void
+  }) => (
+    <section aria-label={title}>
+      <h2>{title}</h2>
+      <button type="button" aria-label={`create ${title}`} onClick={onCreate}>
+        create
+        {title}
+      </button>
+      <button type="button" aria-label={`edit ${title}`} onClick={() => onEditRule(rules[0]!)}>
+        edit
+        {title}
+      </button>
+    </section>
+  ),
+}))
+
+vi.mock('../permission-set-modal', () => ({
+  default: ({
+    mode,
+    resourceType,
+    initialValues,
+    onSubmit,
+  }: {
+    mode: string
+    resourceType: string
+    initialValues?: { name: string, description: string, permissionKeys: string[] }
+    onSubmit: (values: { name: string, description: string, permissionKeys: string[] }) => void
+  }) => (
+    <div role="dialog" aria-label={`${resourceType} ${mode}`}>
+      <span>{initialValues?.name}</span>
+      <button
+        type="button"
+        onClick={() => onSubmit({
+          name: `${resourceType} permission`,
+          description: `${resourceType} description`,
+          permissionKeys: [`${resourceType}.acl.edit`],
+        })}
+      >
+        submit permission set
+      </button>
+    </div>
+  ),
+}))
+
+const appRule: AccessPolicyWithBindings = {
+  policy: {
+    id: 'app-rule-1',
+    tenant_id: 'tenant-1',
+    resource_type: 'app',
+    policy_key: 'app-rule',
+    name: 'App rule',
+    description: 'App rule description',
+    permission_keys: ['app.acl.edit'],
+    is_builtin: false,
+    category: 'global_custom',
+    created_at: '2026-01-01',
+    updated_at: '2026-01-01',
+  },
+  roles: [{
+    role_id: 'role-1',
+    role_name: 'Role 1',
+    binding_id: 'role-binding-1',
+    is_locked: false,
+    role_tag: '',
+  }],
+  accounts: [{
+    account_id: 'member-1',
+    account_name: 'Member 1',
+    binding_id: 'member-binding-1',
+    is_locked: false,
+  }],
+}
+
+const datasetRule: AccessPolicyWithBindings = {
+  policy: {
+    ...appRule.policy,
+    id: 'dataset-rule-1',
+    resource_type: 'dataset',
+    policy_key: 'dataset-rule',
+    name: 'Dataset rule',
+    permission_keys: ['dataset.acl.edit'],
+  },
+  roles: [{
+    role_id: 'dataset-role-1',
+    role_name: 'Dataset Role 1',
+    binding_id: 'dataset-role-binding-1',
+    is_locked: false,
+    role_tag: '',
+  }],
+  accounts: [{
+    account_id: 'dataset-member-1',
+    account_name: 'Dataset Member 1',
+    binding_id: 'dataset-member-binding-1',
+    is_locked: false,
+  }],
+}
+
+const mockMutation = (mock: ReturnType<typeof vi.fn>) => {
+  mock.mockImplementation((_payload, options) => {
+    options?.onSuccess?.()
+    return Promise.resolve()
+  })
+
+  return {
+    mutate: mock,
+    mutateAsync: mock,
+  }
+}
+
+const pagination = {
+  total_count: 1,
+  per_page: 20,
+  current_page: 1,
+  total_pages: 1,
+}
+
+const setupHooks = () => {
+  vi.mocked(useInfiniteWorkspaceAppAccessRules).mockReturnValue({
+    data: { pages: [{ items: [appRule], pagination }], pageParams: [1] },
+    isLoading: false,
+    isFetchingNextPage: false,
+    fetchNextPage: vi.fn(),
+    hasNextPage: false,
+    error: null,
+  } as unknown as ReturnType<typeof useInfiniteWorkspaceAppAccessRules>)
+  vi.mocked(useInfiniteWorkspaceDatasetAccessRules).mockReturnValue({
+    data: { pages: [{ items: [datasetRule], pagination }], pageParams: [1] },
+    isLoading: false,
+    isFetchingNextPage: false,
+    fetchNextPage: vi.fn(),
+    hasNextPage: false,
+    error: null,
+  } as unknown as ReturnType<typeof useInfiniteWorkspaceDatasetAccessRules>)
+  vi.mocked(useCreateAccessRule).mockReturnValue(mockMutation(mocks.createAccessRule) as unknown as ReturnType<typeof useCreateAccessRule>)
+  vi.mocked(useUpdateAccessRule).mockReturnValue(mockMutation(mocks.updateAccessRule) as unknown as ReturnType<typeof useUpdateAccessRule>)
+}
+
+describe('AccessRulesPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    setupHooks()
+  })
+
+  it('renders app and dataset access rule sections', () => {
+    render(<AccessRulesPage />)
+
+    expect(screen.getByRole('heading', { name: 'permission.accessRule.appTitle' })).toBeInTheDocument()
+    expect(screen.getByRole('heading', { name: 'permission.accessRule.datasetTitle' })).toBeInTheDocument()
+  })
+
+  it('creates app permission sets with app resource type', async () => {
+    render(<AccessRulesPage />)
+
+    await userEvent.click(screen.getByRole('button', { name: 'create permission.accessRule.appTitle' }))
+    await userEvent.click(screen.getByRole('button', { name: 'submit permission set' }))
+
+    expect(mocks.createAccessRule).toHaveBeenCalledWith({
+      name: 'app permission',
+      description: 'app description',
+      permission_keys: ['app.acl.edit'],
+      resourceType: 'app',
+    }, expect.any(Object))
+    expect(toast.success).toHaveBeenCalledWith('permission.accessRule.created')
+  })
+
+  it('creates dataset permission sets with dataset resource type', async () => {
+    render(<AccessRulesPage />)
+
+    await userEvent.click(screen.getByRole('button', { name: 'create permission.accessRule.datasetTitle' }))
+    await userEvent.click(screen.getByRole('button', { name: 'submit permission set' }))
+
+    expect(mocks.createAccessRule).toHaveBeenCalledWith({
+      name: 'dataset permission',
+      description: 'dataset description',
+      permission_keys: ['dataset.acl.edit'],
+      resourceType: 'dataset',
+    }, expect.any(Object))
+    expect(toast.success).toHaveBeenCalledWith('permission.accessRule.created')
+  })
+
+  it('updates dataset permission sets with dataset resource type', async () => {
+    render(<AccessRulesPage />)
+
+    await userEvent.click(screen.getByRole('button', { name: 'edit permission.accessRule.datasetTitle' }))
+    expect(screen.getByText('Dataset rule')).toBeInTheDocument()
+    await userEvent.click(screen.getByRole('button', { name: 'submit permission set' }))
+
+    expect(mocks.updateAccessRule).toHaveBeenCalledWith({
+      id: 'dataset-rule-1',
+      name: 'dataset permission',
+      description: 'dataset description',
+      permission_keys: ['dataset.acl.edit'],
+      resourceType: 'dataset',
+    }, expect.any(Object))
+    expect(toast.success).toHaveBeenCalledWith('permission.accessRule.updated')
+  })
+})
diff --git a/web/app/components/header/account-setting/access-rules-page/access-rule-row-menu.tsx b/web/app/components/header/account-setting/access-rules-page/access-rule-row-menu.tsx
new file mode 100644
index 00000000000..8fd88c1f4fc
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/access-rule-row-menu.tsx
@@ -0,0 +1,154 @@
+'use client'
+
+import type { AccessPolicy } from '@/models/access-control'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useCallback, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import ActionButton from '@/app/components/base/action-button'
+import { useCopyAccessRule, useDeleteAccessRule } from '@/service/access-control/use-workspace-access-rules'
+
+type AccessRuleRowMenuProps = {
+  rule: AccessPolicy
+  onView?: () => void
+  onEdit?: () => void
+}
+
+const AccessRuleRowMenu = ({
+  rule,
+  onView,
+  onEdit,
+}: AccessRuleRowMenuProps) => {
+  const { t } = useTranslation()
+  const [open, setOpen] = useState(false)
+  const [showDeleteConfirm, setShowDeleteConfirm] = useState(false)
+
+  const { mutateAsync: copyAccessRule } = useCopyAccessRule(rule.resource_type)
+  const { mutateAsync: deleteAccessRule, isPending: isDeletingAccessRule } = useDeleteAccessRule(rule.resource_type)
+
+  const handleView = useCallback(() => {
+    onView?.()
+  }, [onView])
+
+  const handleCopyRules = useCallback(() => {
+    copyAccessRule(rule.id, {
+      onSuccess: () => {
+        toast.success(t('accessRule.copied', { ns: 'permission' }))
+        setOpen(false)
+      },
+    })
+  }, [copyAccessRule, rule.id, t])
+
+  const openDeleteConfirm = useCallback(() => {
+    setShowDeleteConfirm(true)
+    setOpen(false)
+  }, [])
+
+  const handleDelete = useCallback(() => {
+    deleteAccessRule(rule.id, {
+      onSuccess: () => {
+        toast.success(t('accessRule.deleted', { ns: 'permission' }))
+        setShowDeleteConfirm(false)
+      },
+    })
+  }, [deleteAccessRule, rule.id, t])
+
+  const isBuiltIn = rule.is_builtin
+
+  return (
+    <>
+      <DropdownMenu open={open} onOpenChange={setOpen}>
+        <DropdownMenuTrigger
+          render={(
+            <ActionButton
+              size="l"
+              className={open ? 'bg-state-base-hover' : ''}
+              aria-label={t('operation.moreActions', { ns: 'common' })}
+            />
+          )}
+        >
+          <span aria-hidden className="i-ri-more-fill h-4 w-4 text-text-tertiary" />
+        </DropdownMenuTrigger>
+        <DropdownMenuContent
+          placement="bottom-end"
+          sideOffset={4}
+          popupClassName="min-w-[140px]"
+        >
+          {isBuiltIn
+            ? (
+                <DropdownMenuItem
+                  className="system-sm-semibold text-text-secondary"
+                  onClick={handleView}
+                >
+                  {t('operation.view', { ns: 'common' })}
+                </DropdownMenuItem>
+              )
+            : (
+                <DropdownMenuItem
+                  className="system-sm-semibold text-text-secondary"
+                  onClick={onEdit}
+                >
+                  {t('operation.edit', { ns: 'common' })}
+                </DropdownMenuItem>
+              )}
+          <DropdownMenuItem
+            className="system-sm-semibold text-text-secondary"
+            onClick={handleCopyRules}
+          >
+            {t('common.duplicateAction', { ns: 'permission' })}
+          </DropdownMenuItem>
+          {!isBuiltIn && (
+            <>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem
+                variant="destructive"
+                className="system-sm-semibold"
+                onClick={openDeleteConfirm}
+              >
+                {t('operation.delete', { ns: 'common' })}
+              </DropdownMenuItem>
+            </>
+          )}
+        </DropdownMenuContent>
+      </DropdownMenu>
+      <AlertDialog open={showDeleteConfirm} onOpenChange={open => !open && setShowDeleteConfirm(false)}>
+        <AlertDialogContent backdropProps={{ forceRender: true }}>
+          <div className="flex flex-col gap-2 px-6 pt-6 pb-4">
+            <AlertDialogTitle className="w-full truncate title-2xl-semi-bold text-text-primary">
+              {t('accessRule.deleteTitle', { ns: 'permission', name: rule.name })}
+            </AlertDialogTitle>
+            <AlertDialogDescription className="w-full system-md-regular wrap-break-word whitespace-pre-wrap text-text-tertiary">
+              {t('accessRule.deleteDescription', { ns: 'permission' })}
+            </AlertDialogDescription>
+          </div>
+          <AlertDialogActions>
+            <AlertDialogCancelButton>{t('operation.cancel', { ns: 'common' })}</AlertDialogCancelButton>
+            <AlertDialogConfirmButton
+              disabled={isDeletingAccessRule}
+              onClick={handleDelete}
+            >
+              {t('operation.delete', { ns: 'common' })}
+            </AlertDialogConfirmButton>
+          </AlertDialogActions>
+        </AlertDialogContent>
+      </AlertDialog>
+    </>
+  )
+}
+
+export default AccessRuleRowMenu
diff --git a/web/app/components/header/account-setting/access-rules-page/access-rule-row.tsx b/web/app/components/header/account-setting/access-rules-page/access-rule-row.tsx
new file mode 100644
index 00000000000..89673392658
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/access-rule-row.tsx
@@ -0,0 +1,54 @@
+'use client'
+
+import type { AccessPolicyWithBindings } from '@/models/access-control'
+import { cn } from '@langgenius/dify-ui/cn'
+import { memo, useCallback } from 'react'
+import { useTranslation } from 'react-i18next'
+import AccessRuleRowMenu from './access-rule-row-menu'
+
+type AccessRuleRowProps = {
+  rule: AccessPolicyWithBindings
+  canManage: boolean
+  className?: string
+  showMenu?: boolean
+  onView?: (rule: AccessPolicyWithBindings) => void
+  onEdit?: (rule: AccessPolicyWithBindings) => void
+}
+
+const AccessRuleRow = ({
+  rule,
+  canManage,
+  className,
+  showMenu = true,
+  onView,
+  onEdit,
+}: AccessRuleRowProps) => {
+  const { t } = useTranslation()
+  const { policy } = rule
+  const description = policy.description.trim() || t('accessRule.noDescription', { ns: 'permission' })
+
+  const handleView = useCallback(() => onView?.(rule), [onView, rule])
+  const handleEdit = useCallback(() => onEdit?.(rule), [onEdit, rule])
+
+  return (
+    <div className={cn('flex items-start gap-3 px-1 py-3.5', className)}>
+      <div className="min-w-0 flex-1">
+        <div className="flex h-6 items-center system-sm-semibold text-text-primary">
+          {policy.name}
+        </div>
+        <p className="system-xs-regular leading-4 text-text-tertiary">
+          {description}
+        </p>
+      </div>
+      {showMenu && canManage && (
+        <AccessRuleRowMenu
+          onView={handleView}
+          onEdit={handleEdit}
+          rule={policy}
+        />
+      )}
+    </div>
+  )
+}
+
+export default memo(AccessRuleRow)
diff --git a/web/app/components/header/account-setting/access-rules-page/access-rule-section.tsx b/web/app/components/header/account-setting/access-rules-page/access-rule-section.tsx
new file mode 100644
index 00000000000..fe1498a64f0
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/access-rule-section.tsx
@@ -0,0 +1,165 @@
+'use client'
+
+import type { AccessPolicyWithBindings } from '@/models/access-control'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { memo, useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import ActionButton from '@/app/components/base/action-button'
+import Loading from '@/app/components/base/loading'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
+import AccessRuleRow from './access-rule-row'
+
+type AccessRuleSectionProps = {
+  title: string
+  rules: AccessPolicyWithBindings[]
+  totalCount?: number
+  isLoadingRules: boolean
+  isFetchingNextPage?: boolean
+  hasNextPage?: boolean
+  fetchNextPage?: () => unknown
+  error?: unknown
+  defaultExpanded?: boolean
+  onCreate?: () => void
+  onViewRule?: (rule: AccessPolicyWithBindings) => void
+  onEditRule?: (rule: AccessPolicyWithBindings) => void
+  className?: string
+}
+
+const AccessRuleSection = ({
+  title,
+  rules,
+  totalCount,
+  isLoadingRules,
+  isFetchingNextPage = false,
+  hasNextPage,
+  fetchNextPage,
+  error,
+  defaultExpanded = false,
+  onCreate,
+  onViewRule,
+  onEditRule,
+  className,
+}: AccessRuleSectionProps) => {
+  const { t } = useTranslation()
+  const [expanded, setExpanded] = useState(defaultExpanded)
+  const listRef = useRef<HTMLDivElement>(null)
+  const anchorRef = useRef<HTMLDivElement>(null)
+  const workspacePermissionKeys = useAppContextWithSelector(s => s.workspacePermissionKeys)
+  const canManage = hasPermission(workspacePermissionKeys, 'workspace.role.manage')
+  const ruleCount = totalCount ?? rules.length
+
+  useEffect(() => {
+    const hasMore = hasNextPage ?? true
+    let observer: IntersectionObserver | undefined
+
+    if (!expanded || error || !fetchNextPage)
+      return
+
+    if (anchorRef.current && listRef.current) {
+      const containerHeight = listRef.current.clientHeight
+      const dynamicMargin = Math.max(48, Math.min(containerHeight * 0.2, 120))
+
+      observer = new IntersectionObserver((entries) => {
+        if (entries[0]!.isIntersecting && !isLoadingRules && !isFetchingNextPage && !error && hasMore)
+          fetchNextPage()
+      }, {
+        root: listRef.current,
+        rootMargin: `${dynamicMargin}px`,
+      })
+      observer.observe(anchorRef.current)
+    }
+
+    return () => observer?.disconnect()
+  }, [error, expanded, fetchNextPage, hasNextPage, isFetchingNextPage, isLoadingRules])
+
+  return (
+    <section className={cn('overflow-hidden rounded-xl border border-components-panel-border bg-components-panel-bg', className)}>
+      <div className="flex items-center gap-4 p-4">
+        <button
+          type="button"
+          className="min-w-0 flex-1 text-left"
+          onClick={() => setExpanded(expanded => !expanded)}
+          aria-expanded={expanded}
+        >
+          <div className="flex min-w-0 items-center gap-4">
+            <span className="truncate system-sm-semibold text-text-primary">
+              {title}
+            </span>
+            <span className="shrink-0 system-xs-regular text-text-tertiary">
+              {t('accessRule.summary', { ns: 'permission', count: ruleCount })}
+            </span>
+          </div>
+        </button>
+        <div className="flex shrink-0 items-center gap-3">
+          {canManage && (
+            <Button
+              variant="primary"
+              size="medium"
+              onClick={onCreate}
+              disabled={isLoadingRules}
+            >
+              <span className="mr-0.5 i-ri-add-line size-3.5" />
+              <span>{t('accessRule.newPermissionSet', { ns: 'permission' })}</span>
+            </Button>
+          )}
+          <ActionButton
+            size="l"
+            aria-label={expanded ? t('accessRule.collapseSection', { ns: 'permission', title }) : t('accessRule.expandSection', { ns: 'permission', title })}
+            onClick={() => setExpanded(expanded => !expanded)}
+          >
+            <span
+              aria-hidden
+              className={cn(
+                'i-ri-arrow-right-s-line size-4 text-text-tertiary transition-transform',
+                expanded && 'rotate-90',
+              )}
+            />
+          </ActionButton>
+        </div>
+      </div>
+      {expanded && (
+        <div
+          ref={listRef}
+          className="max-h-105 overflow-y-auto overscroll-contain border-t border-divider-deep px-4"
+        >
+          {isLoadingRules
+            ? (
+                <div className="px-1 py-8 text-center">
+                  <Loading type="app" />
+                </div>
+              )
+            : rules.length === 0
+              ? (
+                  <div className="px-1 py-8 text-center system-sm-regular text-text-tertiary">
+                    {t('accessRule.noRules', { ns: 'permission' })}
+                  </div>
+                )
+              : (
+                  <>
+                    {rules.map((rule, index) => (
+                      <AccessRuleRow
+                        key={rule.policy.id}
+                        rule={rule}
+                        canManage={canManage}
+                        className={cn(index > 0 && 'border-t border-divider-regular')}
+                        onView={onViewRule}
+                        onEdit={onEditRule}
+                      />
+                    ))}
+                    <div ref={anchorRef} className="h-1" />
+                    {isFetchingNextPage && (
+                      <div className="px-1 py-3 text-center system-xs-regular text-text-tertiary">
+                        <Loading type="app" />
+                      </div>
+                    )}
+                  </>
+                )}
+        </div>
+      )}
+    </section>
+  )
+}
+
+export default memo(AccessRuleSection)
diff --git a/web/app/components/header/account-setting/access-rules-page/app-access-rule-section.tsx b/web/app/components/header/account-setting/access-rules-page/app-access-rule-section.tsx
new file mode 100644
index 00000000000..1b83eaf1c5d
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/app-access-rule-section.tsx
@@ -0,0 +1,152 @@
+import type { PermissionSetFormValues, PermissionSetModalMode } from './permission-set-modal'
+import type { AccessPolicyWithBindings } from '@/models/access-control'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useCallback, useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useLocale } from '@/context/i18n'
+import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
+import {
+  useCreateAccessRule,
+  useInfiniteWorkspaceAppAccessRules,
+  useUpdateAccessRule,
+} from '@/service/access-control/use-workspace-access-rules'
+import AccessRuleSection from './access-rule-section'
+import PermissionSetModal from './permission-set-modal'
+
+type AppAccessRuleSectionProps = {
+  className?: string
+}
+
+type PermissionSetModalState = {
+  mode: PermissionSetModalMode
+  ruleId?: string
+  initialValues?: PermissionSetFormValues
+}
+
+const RULES_PER_PAGE = 20
+
+const AppAccessRuleSection = ({
+  className,
+}: AppAccessRuleSectionProps) => {
+  const { t } = useTranslation()
+  const locale = useLocale()
+  const [permissionSetModalState, setPermissionSetModalState] = useState<PermissionSetModalState | null>(null)
+  const language = useMemo(() => getAccessControlTemplateLanguage(locale), [locale])
+
+  const {
+    data: appAccessRulesResponse,
+    isLoading,
+    isFetchingNextPage,
+    fetchNextPage,
+    hasNextPage,
+    error,
+  } = useInfiniteWorkspaceAppAccessRules({
+    page: 1,
+    limit: RULES_PER_PAGE,
+    language,
+  })
+  const { mutateAsync: createAccessRule } = useCreateAccessRule()
+  const { mutateAsync: updateAccessRule } = useUpdateAccessRule()
+
+  const appAccessRules = useMemo(() => appAccessRulesResponse?.pages.flatMap(page => page.items) || [], [appAccessRulesResponse?.pages])
+  const totalCount = appAccessRulesResponse?.pages[0]?.pagination.total_count || 0
+
+  const closePermissionSetModal = useCallback(() => {
+    setPermissionSetModalState(null)
+  }, [])
+
+  const handleCreate = useCallback(() => {
+    setPermissionSetModalState({ mode: 'create' })
+  }, [])
+
+  const handleView = useCallback((rule: AccessPolicyWithBindings) => {
+    const { policy } = rule
+    setPermissionSetModalState({
+      mode: 'view',
+      initialValues: {
+        name: policy.name,
+        description: policy.description,
+        permissionKeys: policy.permission_keys,
+      },
+    })
+  }, [])
+
+  const handleEdit = useCallback((rule: AccessPolicyWithBindings) => {
+    const { policy } = rule
+    setPermissionSetModalState({
+      mode: 'edit',
+      ruleId: policy.id,
+      initialValues: {
+        name: policy.name,
+        description: policy.description,
+        permissionKeys: policy.permission_keys,
+      },
+    })
+  }, [])
+
+  const handlePermissionSetSubmit = useCallback((values: PermissionSetFormValues) => {
+    if (!permissionSetModalState)
+      return
+
+    const { name, description, permissionKeys } = values
+    if (permissionSetModalState.mode === 'create') {
+      createAccessRule({
+        name,
+        description,
+        permission_keys: permissionKeys,
+        resourceType: 'app',
+      }, {
+        onSuccess: () => {
+          toast.success(t('accessRule.created', { ns: 'permission' }))
+          closePermissionSetModal()
+        },
+      })
+    }
+    else if (permissionSetModalState.mode === 'edit') {
+      updateAccessRule({
+        id: permissionSetModalState.ruleId!,
+        name,
+        description,
+        permission_keys: permissionKeys,
+        resourceType: 'app',
+      }, {
+        onSuccess: () => {
+          toast.success(t('accessRule.updated', { ns: 'permission' }))
+          closePermissionSetModal()
+        },
+      })
+    }
+  }, [closePermissionSetModal, createAccessRule, permissionSetModalState, t, updateAccessRule])
+
+  return (
+    <>
+      <AccessRuleSection
+        title={t('accessRule.appTitle', { ns: 'permission' })}
+        rules={appAccessRules}
+        totalCount={totalCount}
+        isLoadingRules={isLoading}
+        isFetchingNextPage={isFetchingNextPage}
+        hasNextPage={hasNextPage}
+        fetchNextPage={fetchNextPage}
+        error={error}
+        defaultExpanded
+        onCreate={handleCreate}
+        onViewRule={handleView}
+        onEditRule={handleEdit}
+        className={className}
+      />
+      {permissionSetModalState && (
+        <PermissionSetModal
+          open
+          mode={permissionSetModalState.mode}
+          resourceType="app"
+          initialValues={permissionSetModalState.initialValues}
+          onClose={closePermissionSetModal}
+          onSubmit={handlePermissionSetSubmit}
+        />
+      )}
+    </>
+  )
+}
+
+export default AppAccessRuleSection
diff --git a/web/app/components/header/account-setting/access-rules-page/dataset-access-rule-section.tsx b/web/app/components/header/account-setting/access-rules-page/dataset-access-rule-section.tsx
new file mode 100644
index 00000000000..ef21c673333
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/dataset-access-rule-section.tsx
@@ -0,0 +1,151 @@
+import type { PermissionSetFormValues, PermissionSetModalMode } from './permission-set-modal'
+import type { AccessPolicyWithBindings } from '@/models/access-control'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useCallback, useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useLocale } from '@/context/i18n'
+import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
+import {
+  useCreateAccessRule,
+  useInfiniteWorkspaceDatasetAccessRules,
+  useUpdateAccessRule,
+} from '@/service/access-control/use-workspace-access-rules'
+import AccessRuleSection from './access-rule-section'
+import PermissionSetModal from './permission-set-modal'
+
+type DatasetAccessRuleSectionProps = {
+  className?: string
+}
+
+type PermissionSetModalState = {
+  mode: PermissionSetModalMode
+  ruleId?: string
+  initialValues?: PermissionSetFormValues
+}
+
+const RULES_PER_PAGE = 20
+
+const DatasetAccessRuleSection = ({
+  className,
+}: DatasetAccessRuleSectionProps) => {
+  const { t } = useTranslation()
+  const locale = useLocale()
+  const [permissionSetModalState, setPermissionSetModalState] = useState<PermissionSetModalState | null>(null)
+  const language = useMemo(() => getAccessControlTemplateLanguage(locale), [locale])
+
+  const {
+    data: datasetAccessRulesResponse,
+    isLoading,
+    isFetchingNextPage,
+    fetchNextPage,
+    hasNextPage,
+    error,
+  } = useInfiniteWorkspaceDatasetAccessRules({
+    page: 1,
+    limit: RULES_PER_PAGE,
+    language,
+  })
+  const { mutateAsync: createAccessRule } = useCreateAccessRule()
+  const { mutateAsync: updateAccessRule } = useUpdateAccessRule()
+
+  const datasetAccessRules = useMemo(() => datasetAccessRulesResponse?.pages.flatMap(page => page.items) || [], [datasetAccessRulesResponse?.pages])
+  const totalCount = datasetAccessRulesResponse?.pages[0]?.pagination.total_count || 0
+
+  const closePermissionSetModal = useCallback(() => {
+    setPermissionSetModalState(null)
+  }, [])
+
+  const handleCreate = useCallback(() => {
+    setPermissionSetModalState({ mode: 'create' })
+  }, [])
+
+  const handleView = useCallback((rule: AccessPolicyWithBindings) => {
+    const { policy } = rule
+    setPermissionSetModalState({
+      mode: 'view',
+      initialValues: {
+        name: policy.name,
+        description: policy.description,
+        permissionKeys: policy.permission_keys,
+      },
+    })
+  }, [])
+
+  const handleEdit = useCallback((rule: AccessPolicyWithBindings) => {
+    const { policy } = rule
+    setPermissionSetModalState({
+      mode: 'edit',
+      ruleId: policy.id,
+      initialValues: {
+        name: policy.name,
+        description: policy.description,
+        permissionKeys: policy.permission_keys,
+      },
+    })
+  }, [])
+
+  const handlePermissionSetSubmit = useCallback((values: PermissionSetFormValues) => {
+    if (!permissionSetModalState)
+      return
+
+    const { name, description, permissionKeys } = values
+    if (permissionSetModalState.mode === 'create') {
+      createAccessRule({
+        name,
+        description,
+        permission_keys: permissionKeys,
+        resourceType: 'dataset',
+      }, {
+        onSuccess: () => {
+          toast.success(t('accessRule.created', { ns: 'permission' }))
+          closePermissionSetModal()
+        },
+      })
+    }
+    else if (permissionSetModalState.mode === 'edit') {
+      updateAccessRule({
+        id: permissionSetModalState.ruleId!,
+        name,
+        description,
+        permission_keys: permissionKeys,
+        resourceType: 'dataset',
+      }, {
+        onSuccess: () => {
+          toast.success(t('accessRule.updated', { ns: 'permission' }))
+          closePermissionSetModal()
+        },
+      })
+    }
+  }, [closePermissionSetModal, createAccessRule, permissionSetModalState, t, updateAccessRule])
+
+  return (
+    <>
+      <AccessRuleSection
+        title={t('accessRule.datasetTitle', { ns: 'permission' })}
+        rules={datasetAccessRules}
+        totalCount={totalCount}
+        isLoadingRules={isLoading}
+        isFetchingNextPage={isFetchingNextPage}
+        hasNextPage={hasNextPage}
+        fetchNextPage={fetchNextPage}
+        error={error}
+        onCreate={handleCreate}
+        onViewRule={handleView}
+        onEditRule={handleEdit}
+        className={className}
+      />
+      {permissionSetModalState && (
+        <PermissionSetModal
+          open
+          mode={permissionSetModalState.mode}
+          resourceType="dataset"
+          initialValues={permissionSetModalState.initialValues}
+          onClose={closePermissionSetModal}
+          onSubmit={handlePermissionSetSubmit}
+        />
+      )}
+    </>
+  )
+}
+
+export default DatasetAccessRuleSection
diff --git a/web/app/components/header/account-setting/access-rules-page/index.tsx b/web/app/components/header/account-setting/access-rules-page/index.tsx
new file mode 100644
index 00000000000..bd8569adc20
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/index.tsx
@@ -0,0 +1,15 @@
+'use client'
+
+import AppAccessRuleSection from './app-access-rule-section'
+import DatasetAccessRuleSection from './dataset-access-rule-section'
+
+const AccessRulesPage = () => {
+  return (
+    <div className="flex flex-col gap-4">
+      <AppAccessRuleSection />
+      <DatasetAccessRuleSection />
+    </div>
+  )
+}
+
+export default AccessRulesPage
diff --git a/web/app/components/header/account-setting/access-rules-page/permission-set-modal/__tests__/index.spec.tsx b/web/app/components/header/account-setting/access-rules-page/permission-set-modal/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..b28a95a78ee
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/permission-set-modal/__tests__/index.spec.tsx
@@ -0,0 +1,209 @@
+import type { PermissionGroup } from '@/models/access-control'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import PermissionSetModal from '../index'
+
+const expectedAppACLPermissionKeys = [
+  'app.acl.view_layout',
+  'app.acl.test_and_run',
+  'app.acl.edit',
+  'app.acl.import_export_dsl',
+  'app.acl.delete',
+  'app.acl.release_and_version',
+  'app.acl.monitor',
+  'app.acl.access_config',
+]
+
+const getPermissionKeyMatcher = (permissionKey: string) => new RegExp(permissionKey.replaceAll('.', '\\.'))
+
+const mockCatalogs = vi.hoisted(() => ({
+  app: {
+    groups: [] as PermissionGroup[],
+  },
+  dataset: {
+    groups: [] as PermissionGroup[],
+  },
+}))
+
+vi.mock('@/service/access-control/use-permission-catalog', () => ({
+  useAppPermissionCatalog: () => ({
+    data: { groups: mockCatalogs.app.groups },
+  }),
+  useDatasetPermissionCatalog: () => ({
+    data: { groups: mockCatalogs.dataset.groups },
+  }),
+}))
+
+const createPermissionGroup = (overrides: Partial<PermissionGroup> = {}): PermissionGroup => ({
+  group_key: 'app_management',
+  group_name: 'App management',
+  description: '',
+  permissions: expectedAppACLPermissionKeys.map(permissionKey => ({
+    key: permissionKey,
+    name: permissionKey,
+    description: '',
+  })),
+  ...overrides,
+})
+
+describe('PermissionSetModal', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockCatalogs.app.groups = [createPermissionGroup()]
+    mockCatalogs.dataset.groups = [
+      createPermissionGroup({
+        group_key: 'dataset_management',
+        group_name: 'Dataset management',
+        permissions: [
+          {
+            key: 'dataset.acl.edit',
+            name: 'Edit dataset',
+            description: '',
+          },
+        ],
+      }),
+    ]
+  })
+
+  // Rendering keeps the form fields and permission picker available inside the modal.
+  describe('Rendering', () => {
+    it('should render create mode with app permission catalog', () => {
+      render(
+        <PermissionSetModal
+          open
+          mode="create"
+          resourceType="app"
+          onClose={vi.fn()}
+          onSubmit={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByText('permission.permissionSet.modal.create.app.title')).toBeInTheDocument()
+      expect(screen.getByLabelText(/permission\.permissionSet\.nameLabel/)).toBeInTheDocument()
+      expect(screen.getByLabelText('permission.permissionSet.descriptionLabel')).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: /App management/ })).toHaveAttribute('aria-expanded', 'true')
+      expect(screen.getByText(/app\.acl\.edit/)).toBeInTheDocument()
+    })
+
+    it('should render the complete app ACL permission catalog', async () => {
+      render(
+        <PermissionSetModal
+          open
+          mode="create"
+          resourceType="app"
+          onClose={vi.fn()}
+          onSubmit={vi.fn()}
+        />,
+      )
+
+      for (const permissionKey of expectedAppACLPermissionKeys)
+        expect(await screen.findByText(getPermissionKeyMatcher(permissionKey))).toBeInTheDocument()
+    })
+
+    it('should render dataset permission catalog when resource type is dataset', () => {
+      render(
+        <PermissionSetModal
+          open
+          mode="create"
+          resourceType="dataset"
+          onClose={vi.fn()}
+          onSubmit={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByText('permission.permissionSet.modal.create.dataset.title')).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: /Dataset management/ })).toBeInTheDocument()
+      expect(screen.getByText(/dataset\.acl\.edit/)).toBeInTheDocument()
+    })
+  })
+
+  // Form submission trims text fields and sends the selected permission keys.
+  describe('User Interactions', () => {
+    it('should submit trimmed values and selected permissions when confirming create mode', async () => {
+      const user = userEvent.setup()
+      const handleClose = vi.fn()
+      const handleSubmit = vi.fn()
+
+      render(
+        <PermissionSetModal
+          open
+          mode="create"
+          resourceType="app"
+          onClose={handleClose}
+          onSubmit={handleSubmit}
+        />,
+      )
+
+      await user.type(screen.getByLabelText(/permission\.permissionSet\.nameLabel/), '  Custom app rule  ')
+      await user.type(screen.getByLabelText('permission.permissionSet.descriptionLabel'), '  Can edit apps  ')
+      await user.click(screen.getByText(/app\.acl\.release_and_version/))
+      await user.click(screen.getByRole('button', { name: 'common.operation.confirm' }))
+
+      expect(handleSubmit).toHaveBeenCalledTimes(1)
+      expect(handleSubmit).toHaveBeenCalledWith({
+        name: 'Custom app rule',
+        description: 'Can edit apps',
+        permissionKeys: ['app.acl.release_and_version'],
+      })
+      expect(handleClose).toHaveBeenCalledTimes(1)
+    })
+
+    it('should submit an updated description when editing an existing permission set', async () => {
+      const user = userEvent.setup()
+      const handleSubmit = vi.fn()
+
+      render(
+        <PermissionSetModal
+          open
+          mode="edit"
+          resourceType="app"
+          initialValues={{
+            name: 'Existing app rule',
+            description: 'Original description',
+            permissionKeys: ['app.acl.edit'],
+          }}
+          onClose={vi.fn()}
+          onSubmit={handleSubmit}
+        />,
+      )
+
+      const descriptionInput = screen.getByLabelText('permission.permissionSet.descriptionLabel')
+      await user.clear(descriptionInput)
+      await user.type(descriptionInput, '  Updated rule description  ')
+      await user.click(screen.getByRole('button', { name: 'common.operation.confirm' }))
+
+      expect(handleSubmit).toHaveBeenCalledTimes(1)
+      expect(handleSubmit).toHaveBeenCalledWith({
+        name: 'Existing app rule',
+        description: 'Updated rule description',
+        permissionKeys: ['app.acl.edit'],
+      })
+    })
+  })
+
+  // View mode is read-only and uses close-only footer actions.
+  describe('Read-only Mode', () => {
+    it('should disable editing and hide confirm action in view mode', () => {
+      render(
+        <PermissionSetModal
+          open
+          mode="view"
+          resourceType="app"
+          initialValues={{
+            name: 'Viewer',
+            description: 'Read only rule',
+            permissionKeys: ['app.acl.edit'],
+          }}
+          onClose={vi.fn()}
+          onSubmit={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByLabelText(/permission\.permissionSet\.nameLabel/)).toBeDisabled()
+      expect(screen.getByLabelText('permission.permissionSet.descriptionLabel')).toBeDisabled()
+      expect(screen.queryByRole('button', { name: 'common.operation.confirm' })).not.toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'common.operation.close' })).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'permission.permissionList.clearAll' })).not.toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/access-rules-page/permission-set-modal/hooks.ts b/web/app/components/header/account-setting/access-rules-page/permission-set-modal/hooks.ts
new file mode 100644
index 00000000000..de29b2a61e0
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/permission-set-modal/hooks.ts
@@ -0,0 +1,40 @@
+import type { AccessPolicyResourceType } from '@/models/access-control'
+import { useMemo } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useAppPermissionCatalog, useDatasetPermissionCatalog } from '@/service/access-control/use-permission-catalog'
+
+export const usePermissionsGroups = (resourceType: AccessPolicyResourceType) => {
+  const { t } = useTranslation()
+  const { data: appPermissionCatalog } = useAppPermissionCatalog(resourceType === 'app')
+  const { data: datasetPermissionCatalog } = useDatasetPermissionCatalog(resourceType === 'dataset')
+
+  const permissionCatalog = resourceType === 'app' ? appPermissionCatalog : datasetPermissionCatalog
+
+  const groups = useMemo(() => {
+    return (permissionCatalog?.groups || []).map(group => ({
+      ...group,
+      group_name: t(`group.${resourceType}_acl`, {
+        ns: 'permission',
+        defaultValue: group.group_name,
+      }),
+      permissions: group.permissions.map(permission => ({
+        ...permission,
+        name: t(permission.key, {
+          ns: 'permissionKeys',
+          defaultValue: permission.name,
+        }),
+      })),
+    }))
+  }, [permissionCatalog?.groups, resourceType, t])
+
+  const allPermissions = groups.flatMap(g => g.permissions) || []
+
+  const permissionMap = Object.fromEntries(
+    allPermissions.map(p => [p.key, p]),
+  )
+
+  return {
+    groups,
+    permissionMap,
+  }
+}
diff --git a/web/app/components/header/account-setting/access-rules-page/permission-set-modal/index.tsx b/web/app/components/header/account-setting/access-rules-page/permission-set-modal/index.tsx
new file mode 100644
index 00000000000..d77f3f9ef68
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/permission-set-modal/index.tsx
@@ -0,0 +1,179 @@
+'use client'
+
+import type { AccessPolicyResourceType } from '@/models/access-control'
+import { Button } from '@langgenius/dify-ui/button'
+import {
+  Dialog,
+  DialogCloseButton,
+  DialogContent,
+  DialogDescription,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { Input } from '@langgenius/dify-ui/input'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import PermissionPicker from './permission-picker'
+
+export type PermissionSetModalMode = 'create' | 'edit' | 'view'
+
+export type PermissionSetFormValues = {
+  name: string
+  description: string
+  permissionKeys: string[]
+}
+
+type PermissionSetModalProps = {
+  open: boolean
+  mode: PermissionSetModalMode
+  resourceType: AccessPolicyResourceType
+  initialValues?: Partial<PermissionSetFormValues>
+  onClose: () => void
+  onSubmit: (values: PermissionSetFormValues) => void
+}
+
+type PermissionSetModalBodyProps = Omit<PermissionSetModalProps, 'open'>
+
+const PermissionSetModalBody = ({
+  mode,
+  resourceType,
+  initialValues,
+  onClose,
+  onSubmit,
+}: PermissionSetModalBodyProps) => {
+  const { t } = useTranslation()
+  const [name, setName] = useState(initialValues?.name ?? '')
+  const [description, setDescription] = useState(initialValues?.description ?? '')
+  const [permissionKeys, setPermissionKeys] = useState<string[]>(initialValues?.permissionKeys ?? [])
+
+  const trimmedName = name.trim()
+  const readonly = mode === 'view'
+  const canSubmit = trimmedName.length > 0
+
+  const handleConfirm = () => {
+    if (readonly || !canSubmit)
+      return
+    onSubmit({
+      name: trimmedName,
+      description: description.trim(),
+      permissionKeys,
+    })
+    onClose()
+  }
+
+  return (
+    <DialogContent
+      className="flex h-[85vh] w-140 flex-col overflow-hidden p-0"
+      backdropProps={{ forceRender: true }}
+    >
+      <div className="relative shrink-0 px-6 pt-6 pb-4">
+        <DialogCloseButton />
+        <div className="pr-8">
+          <DialogTitle className="system-xl-semibold text-text-primary">
+            {t(`permissionSet.modal.${mode}.${resourceType}.title`, { ns: 'permission' })}
+          </DialogTitle>
+          <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+            {t(`permissionSet.modal.${mode}.${resourceType}.description`, { ns: 'permission' })}
+          </DialogDescription>
+        </div>
+      </div>
+
+      <div className="border-t border-divider-subtle" />
+
+      <div className="flex min-h-0 flex-1 flex-col gap-5 overflow-y-hidden px-6 py-5">
+        <div className="flex shrink-0 flex-col gap-1">
+          <label htmlFor="permission-set-name" className="system-sm-medium text-text-secondary">
+            {t('permissionSet.nameLabel', { ns: 'permission' })}
+            <span aria-hidden className="ml-0.5 text-text-destructive">*</span>
+          </label>
+          <Input
+            id="permission-set-name"
+            value={name}
+            onChange={e => setName(e.target.value)}
+            placeholder={t('permissionSet.namePlaceholder', { ns: 'permission' })}
+            disabled={readonly}
+          />
+        </div>
+
+        <div className="flex shrink-0 flex-col gap-1">
+          <label htmlFor="permission-set-description" className="system-sm-medium text-text-secondary">
+            {t('permissionSet.descriptionLabel', { ns: 'permission' })}
+          </label>
+          <Textarea
+            id="permission-set-description"
+            value={description}
+            onValueChange={value => setDescription(value)}
+            placeholder={t('permissionSet.descriptionPlaceholder', { ns: 'permission' })}
+            className="min-h-20 resize-none"
+            disabled={readonly}
+          />
+        </div>
+
+        <div className="flex min-h-0 flex-1 flex-col gap-2">
+          <div className="system-sm-medium text-text-secondary">{t('permissionSet.permissions', { ns: 'permission' })}</div>
+          <PermissionPicker
+            resourceType={resourceType}
+            value={permissionKeys}
+            onChange={setPermissionKeys}
+            readonly={readonly}
+          />
+        </div>
+      </div>
+
+      <div className="flex shrink-0 items-center justify-between gap-3 border-t border-divider-subtle px-6 py-4">
+        <a
+          href="https://docs.dify.ai/"
+          target="_blank"
+          rel="noreferrer"
+          className="inline-flex items-center gap-1 system-xs-medium text-text-accent hover:underline"
+        >
+          <span>{t('permissionSet.learnMore', { ns: 'permission' })}</span>
+          <span aria-hidden className="i-ri-external-link-line h-3.5 w-3.5" />
+        </a>
+        <div className="flex items-center gap-2">
+          <Button variant="secondary" onClick={onClose}>
+            {readonly ? t('operation.close', { ns: 'common' }) : t('operation.cancel', { ns: 'common' })}
+          </Button>
+          {!readonly && (
+            <Button
+              variant="primary"
+              disabled={!canSubmit}
+              onClick={handleConfirm}
+            >
+              {t('operation.confirm', { ns: 'common' })}
+            </Button>
+          )}
+        </div>
+      </div>
+    </DialogContent>
+  )
+}
+
+const PermissionSetModal = ({
+  open,
+  mode,
+  resourceType,
+  initialValues,
+  onClose,
+  onSubmit,
+}: PermissionSetModalProps) => {
+  return (
+    <Dialog
+      open={open}
+      onOpenChange={(nextOpen) => {
+        if (!nextOpen)
+          onClose()
+      }}
+    >
+      <PermissionSetModalBody
+        mode={mode}
+        resourceType={resourceType}
+        initialValues={initialValues}
+        onClose={onClose}
+        onSubmit={onSubmit}
+      />
+    </Dialog>
+  )
+}
+
+export default PermissionSetModal
diff --git a/web/app/components/header/account-setting/access-rules-page/permission-set-modal/permission-picker.tsx b/web/app/components/header/account-setting/access-rules-page/permission-set-modal/permission-picker.tsx
new file mode 100644
index 00000000000..6a816408a3e
--- /dev/null
+++ b/web/app/components/header/account-setting/access-rules-page/permission-set-modal/permission-picker.tsx
@@ -0,0 +1,35 @@
+'use client'
+
+import type { AccessPolicyResourceType } from '@/models/access-control'
+import PermissionGroupList from '../../permission-group-list'
+import { usePermissionsGroups } from './hooks'
+
+type PermissionPickerProps = {
+  resourceType: AccessPolicyResourceType
+  value: string[]
+  onChange: (next: string[]) => void
+  className?: string
+  readonly?: boolean
+}
+
+const PermissionPicker = ({
+  resourceType,
+  value,
+  onChange,
+  className,
+  readonly = false,
+}: PermissionPickerProps) => {
+  const { groups } = usePermissionsGroups(resourceType)
+
+  return (
+    <PermissionGroupList
+      groups={groups}
+      value={value}
+      onChange={onChange}
+      className={className}
+      readonly={readonly}
+    />
+  )
+}
+
+export default PermissionPicker
diff --git a/web/app/components/header/account-setting/api-based-extension-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/api-based-extension-page/__tests__/index.spec.tsx
index de131a2491d..af0536fd282 100644
--- a/web/app/components/header/account-setting/api-based-extension-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/api-based-extension-page/__tests__/index.spec.tsx
@@ -7,11 +7,21 @@ const {
   mockCreateApiBasedExtension,
   mockUpdateApiBasedExtension,
   mockDeleteApiBasedExtension,
+  mockWorkspacePermissionKeys,
 } = vi.hoisted(() => ({
   mockApiBasedExtensionsQuery: vi.fn(),
   mockCreateApiBasedExtension: vi.fn(),
   mockUpdateApiBasedExtension: vi.fn(),
   mockDeleteApiBasedExtension: vi.fn(),
+  mockWorkspacePermissionKeys: {
+    current: ['api_extension.manage'] as string[],
+  },
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn((selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.current,
+  })),
 }))
 
 vi.mock('@/service/client', () => ({
@@ -48,6 +58,7 @@ vi.mock('@tanstack/react-query', () => ({
 describe('ApiBasedExtensionPage', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.current = ['api_extension.manage']
     mockApiBasedExtensionsQuery.mockReturnValue({
       data: [],
       isPending: false,
@@ -175,6 +186,24 @@ describe('ApiBasedExtensionPage', () => {
       expect(screen.queryByText('common.apiBasedExtension.title')).not.toBeInTheDocument()
       expect(screen.getByText('common.apiBasedExtension.add'))!.toBeInTheDocument()
     })
+
+    it('should disable management actions when api extension permission is missing', () => {
+      // Arrange
+      mockWorkspacePermissionKeys.current = []
+      const extension: ApiBasedExtensionResponse = { id: '1', name: 'Extension 1', api_endpoint: 'url1', api_key: 'key1' }
+      mockApiBasedExtensionsQuery.mockReturnValue({
+        data: [extension],
+        isPending: false,
+      })
+
+      // Act
+      render(<ApiBasedExtensionPage />)
+
+      // Assert
+      expect(screen.getByRole('button', { name: 'common.apiBasedExtension.add' })).toBeDisabled()
+      expect(screen.getByRole('button', { name: 'common.operation.edit' })).toBeDisabled()
+      expect(screen.getByRole('button', { name: 'common.operation.delete' })).toBeDisabled()
+    })
   })
 
   describe('User Interactions', () => {
diff --git a/web/app/components/header/account-setting/api-based-extension-page/__tests__/item.spec.tsx b/web/app/components/header/account-setting/api-based-extension-page/__tests__/item.spec.tsx
index 9643b81ae48..0077f66a565 100644
--- a/web/app/components/header/account-setting/api-based-extension-page/__tests__/item.spec.tsx
+++ b/web/app/components/header/account-setting/api-based-extension-page/__tests__/item.spec.tsx
@@ -81,6 +81,26 @@ describe('Item Component', () => {
       // Assert
       expect(mockOnEdit).toHaveBeenCalledWith(mockData)
     })
+
+    it('should disable edit and delete actions when management is not allowed', () => {
+      // Act
+      render(<Item apiBasedExtension={mockData} onEdit={mockOnEdit} canManage={false} />)
+
+      // Assert
+      expect(screen.getByRole('button', { name: 'common.operation.edit' })).toBeDisabled()
+      expect(screen.getByRole('button', { name: 'common.operation.delete' })).toBeDisabled()
+    })
+
+    it('should not open edit or delete flows when management is not allowed', () => {
+      // Act
+      render(<Item apiBasedExtension={mockData} onEdit={mockOnEdit} canManage={false} />)
+      fireEvent.click(screen.getByText('common.operation.edit'))
+      fireEvent.click(screen.getByText('common.operation.delete'))
+
+      // Assert
+      expect(mockOnEdit).not.toHaveBeenCalled()
+      expect(screen.queryByText(/common\.operation\.delete.*Test Extension.*\?/i)).not.toBeInTheDocument()
+    })
   })
 
   describe('Deletion', () => {
diff --git a/web/app/components/header/account-setting/api-based-extension-page/index.tsx b/web/app/components/header/account-setting/api-based-extension-page/index.tsx
index 5bf385345b9..78faacf711f 100644
--- a/web/app/components/header/account-setting/api-based-extension-page/index.tsx
+++ b/web/app/components/header/account-setting/api-based-extension-page/index.tsx
@@ -6,7 +6,9 @@ import { useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { SearchInput } from '@/app/components/base/search-input'
 import { SkeletonContainer, SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { consoleQuery } from '@/service/client'
+import { hasPermission } from '@/utils/permission'
 import { Empty } from './empty'
 import { Item } from './item'
 import { ApiBasedExtensionModal } from './modal'
@@ -49,6 +51,8 @@ export function ApiBasedExtensionPage({
   layout,
 }: ApiBasedExtensionPageProps = {}) {
   const { t } = useTranslation()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canManage = hasPermission(workspacePermissionKeys, 'api_extension.manage')
   const { data: apiBasedExtensions = [], isPending: isLoading } = useQuery(consoleQuery.apiBasedExtension.get.queryOptions())
   const [dialogState, setDialogState] = useState<ApiBasedExtensionDialogState>(null)
   const [keywords, setKeywords] = useState('')
@@ -67,11 +71,17 @@ export function ApiBasedExtensionPage({
   const hasSearchKeywords = keywords.trim().length > 0
 
   const handleOpenApiBasedExtensionModal = () => {
+    if (!canManage)
+      return
+
     setDialogState({
       mode: 'create',
     })
   }
   const handleEditApiBasedExtension = (apiBasedExtension: ApiBasedExtensionResponse) => {
+    if (!canManage)
+      return
+
     setDialogState({
       mode: 'edit',
       apiBasedExtension,
@@ -94,6 +104,7 @@ export function ApiBasedExtensionPage({
       />
       <Button
         variant="secondary"
+        disabled={!canManage}
         onClick={handleOpenApiBasedExtensionModal}
       >
         <span className="mr-1 i-ri-add-line size-4" aria-hidden="true" />
@@ -128,6 +139,7 @@ export function ApiBasedExtensionPage({
               key={item.id}
               apiBasedExtension={item}
               onEdit={handleEditApiBasedExtension}
+              canManage={canManage}
             />
           ))
         )
diff --git a/web/app/components/header/account-setting/api-based-extension-page/item.tsx b/web/app/components/header/account-setting/api-based-extension-page/item.tsx
index 25485226b24..3972a88fef8 100644
--- a/web/app/components/header/account-setting/api-based-extension-page/item.tsx
+++ b/web/app/components/header/account-setting/api-based-extension-page/item.tsx
@@ -16,19 +16,27 @@ import { consoleQuery } from '@/service/client'
 type ItemProps = {
   apiBasedExtension: ApiBasedExtensionResponse
   onEdit: (apiBasedExtension: ApiBasedExtensionResponse) => void
+  canManage?: boolean
 }
 export function Item({
   apiBasedExtension,
   onEdit,
+  canManage = true,
 }: ItemProps) {
   const { t } = useTranslation()
   const [showDeleteConfirm, setShowDeleteConfirm] = useState(false)
   const deleteApiBasedExtensionMutation = useMutation(consoleQuery.apiBasedExtension.byId.delete.mutationOptions())
 
   const handleOpenApiBasedExtensionModal = () => {
+    if (!canManage)
+      return
+
     onEdit(apiBasedExtension)
   }
   const handleDeleteApiBasedExtension = () => {
+    if (!canManage)
+      return
+
     deleteApiBasedExtensionMutation.mutate({
       params: {
         id: apiBasedExtension.id,
@@ -48,13 +56,15 @@ export function Item({
       </div>
       <div className="pointer-events-none flex shrink-0 items-center gap-1 opacity-0 transition-opacity group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100">
         <Button
+          disabled={!canManage}
           onClick={handleOpenApiBasedExtensionModal}
         >
           <span className="mr-1 i-ri-edit-line size-4" aria-hidden="true" />
           {t('operation.edit', { ns: 'common' })}
         </Button>
         <Button
-          onClick={() => setShowDeleteConfirm(true)}
+          disabled={!canManage}
+          onClick={() => canManage && setShowDeleteConfirm(true)}
         >
           <span className="mr-1 i-ri-delete-bin-line size-4" aria-hidden="true" />
           {t('operation.delete', { ns: 'common' })}
@@ -70,7 +80,7 @@ export function Item({
           <AlertDialogActions>
             <AlertDialogCancelButton>{t('operation.cancel', { ns: 'common' })}</AlertDialogCancelButton>
             <AlertDialogConfirmButton
-              disabled={deleteApiBasedExtensionMutation.isPending}
+              disabled={!canManage || deleteApiBasedExtensionMutation.isPending}
               onClick={handleDeleteApiBasedExtension}
             >
               {t('operation.delete', { ns: 'common' }) || ''}
diff --git a/web/app/components/header/account-setting/constants.ts b/web/app/components/header/account-setting/constants.ts
index 191c5b4cab5..d8128631306 100644
--- a/web/app/components/header/account-setting/constants.ts
+++ b/web/app/components/header/account-setting/constants.ts
@@ -6,6 +6,8 @@ export const ACCOUNT_SETTING_MODAL_ACTION = 'showSettings'
 export const ACCOUNT_SETTING_TAB = {
   PROVIDER: 'provider',
   MEMBERS: 'members',
+  PERMISSIONS: 'permissions',
+  ACCESS_RULES: 'access-rules',
   BILLING: 'billing',
   DATA_SOURCE: 'data-source',
   API_BASED_EXTENSION: 'custom-endpoint',
@@ -19,6 +21,8 @@ export const DEFAULT_ACCOUNT_SETTING_TAB = ACCOUNT_SETTING_TAB.MEMBERS
 
 const WORKSPACE_SETTING_TAB_VALUES = [
   ACCOUNT_SETTING_TAB.MEMBERS,
+  ACCOUNT_SETTING_TAB.PERMISSIONS,
+  ACCOUNT_SETTING_TAB.ACCESS_RULES,
   ACCOUNT_SETTING_TAB.BILLING,
   ACCOUNT_SETTING_TAB.CUSTOM,
 ] as const
diff --git a/web/app/components/header/account-setting/data-source-page-new/__tests__/card.spec.tsx b/web/app/components/header/account-setting/data-source-page-new/__tests__/card.spec.tsx
index d11d7d166a2..5ce1c8f72c1 100644
--- a/web/app/components/header/account-setting/data-source-page-new/__tests__/card.spec.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/__tests__/card.spec.tsx
@@ -11,6 +11,14 @@ import { useInvalidDataSourceList } from '@/service/use-pipeline'
 import Card from '../card'
 import { useDataSourceAuthUpdate } from '../hooks'
 
+let mockWorkspacePermissionKeys: string[] = ['credential.manage', 'credential.use']
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 vi.mock('@/app/components/plugins/plugin-auth', () => ({
   ApiKeyModal: vi.fn(({ onClose, onUpdate, onRemove, disabled, editValues }: { onClose: () => void, onUpdate: () => void, onRemove: () => void, disabled: boolean, editValues: Record<string, unknown> }) => (
     <div data-testid="mock-api-key-modal" data-disabled={disabled}>
@@ -24,8 +32,8 @@ vi.mock('@/app/components/plugins/plugin-auth', () => ({
   AuthCategory: {
     datasource: 'datasource',
   },
-  AddApiKeyButton: ({ onUpdate }: { onUpdate: () => void }) => <button onClick={onUpdate}>Add API Key</button>,
-  AddOAuthButton: ({ onUpdate }: { onUpdate: () => void }) => <button onClick={onUpdate}>Add OAuth</button>,
+  AddApiKeyButton: ({ onUpdate, disabled }: { onUpdate: () => void, disabled?: boolean }) => <button disabled={disabled} onClick={onUpdate}>Add API Key</button>,
+  AddOAuthButton: ({ onUpdate, disabled }: { onUpdate: () => void, disabled?: boolean }) => <button disabled={disabled} onClick={onUpdate}>Add OAuth</button>,
 }))
 
 vi.mock('@/hooks/use-i18n', () => ({
@@ -118,6 +126,7 @@ describe('Card Component', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
     mockPluginAuthActionReturn = createMockPluginAuthActionReturn()
 
     vi.mocked(useDataSourceAuthUpdate).mockReturnValue({ handleAuthUpdate: mockHandleAuthUpdate })
@@ -297,6 +306,60 @@ describe('Card Component', () => {
       })
       expect(openOAuthPopup).not.toHaveBeenCalled()
     })
+
+    it('should allow credential.use to set default without allowing credential management actions', async () => {
+      // Arrange
+      mockWorkspacePermissionKeys = ['credential.use']
+
+      const oAuthItem = {
+        ...mockItem,
+        credentials_list: [{
+          ...mockItem.credentials_list[0]!,
+          type: CredentialTypeEnum.OAUTH2,
+        }],
+      }
+      render(<Card item={oAuthItem} />)
+
+      // Act: setting the default is a credential-use action.
+      openDropdown('Credential 1')
+      fireEvent.click(screen.getByText(/auth.setDefault/))
+
+      // Assert
+      await waitFor(() => {
+        expect(mockPluginAuthActionReturn.handleSetDefault).toHaveBeenCalledWith('c1')
+      })
+
+      // Act: management actions remain blocked without credential.manage.
+      openDropdown('Credential 1')
+      fireEvent.click(screen.getByText(/operation.rename/))
+      expect(screen.queryByPlaceholderText(/placeholder.input/)).not.toBeInTheDocument()
+
+      fireEvent.click(screen.getByText(/dataSource.notion.changeAuthorizedPages/))
+
+      // Assert
+      expect(mockGetPluginOAuthUrl).not.toHaveBeenCalled()
+      expect(mockPluginAuthActionReturn.handleRename).not.toHaveBeenCalled()
+    })
+
+    it('should block credential actions when neither credential.use nor credential.manage is granted', async () => {
+      // Arrange
+      mockWorkspacePermissionKeys = []
+
+      render(<Card item={mockItem} />)
+
+      // Act
+      openDropdown('Credential 1')
+      fireEvent.click(screen.getByText(/auth.setDefault/))
+      fireEvent.click(screen.getByText(/operation.edit/))
+      fireEvent.click(screen.getByText(/operation.remove/))
+
+      // Assert
+      await waitFor(() => {
+        expect(mockPluginAuthActionReturn.handleSetDefault).not.toHaveBeenCalled()
+        expect(mockPluginAuthActionReturn.handleEdit).not.toHaveBeenCalled()
+        expect(mockPluginAuthActionReturn.openConfirm).not.toHaveBeenCalled()
+      })
+    })
   })
 
   describe('Modals', () => {
@@ -354,6 +417,19 @@ describe('Card Component', () => {
       // Assert
       expect(screen.getByTestId('mock-api-key-modal'))!.toHaveAttribute('data-disabled', 'true')
     })
+
+    it('should disable ApiKeyModal when user lacks credential.manage', () => {
+      // Arrange
+      mockWorkspacePermissionKeys = ['credential.use']
+      const mockReturn = createMockPluginAuthActionReturn({ editValues: { some: 'value' }, doingAction: false })
+      vi.mocked(usePluginAuthAction).mockReturnValue(mockReturn)
+
+      // Act
+      render(<Card item={mockItem} disabled={false} />)
+
+      // Assert
+      expect(screen.getByTestId('mock-api-key-modal'))!.toHaveAttribute('data-disabled', 'true')
+    })
   })
 
   describe('Integration', () => {
@@ -374,5 +450,29 @@ describe('Card Component', () => {
       // Assert
       expectAuthUpdated()
     })
+
+    it('should disable configure credential actions when user lacks credential.manage', () => {
+      // Arrange
+      mockWorkspacePermissionKeys = ['credential.use']
+      const configurableItem: DataSourceAuth = {
+        ...mockItem,
+        credential_schema: [{ name: 'api_key', type: FormTypeEnum.textInput, label: 'API Key', required: true }],
+        oauth_schema: {
+          client_schema: [{ name: 'oauth_key', type: FormTypeEnum.textInput, label: 'OAuth Key', required: true }],
+        },
+      }
+
+      // Act
+      render(<Card item={configurableItem} />)
+      fireEvent.click(screen.getByText(/dataSource.configure/))
+
+      // Assert
+      expect(screen.getByText('Add API Key')).toBeDisabled()
+      expect(screen.getByText('Add OAuth')).toBeDisabled()
+
+      fireEvent.click(screen.getByText('Add API Key'))
+      fireEvent.click(screen.getByText('Add OAuth'))
+      expect(mockInvalidateDataSourceListAuth).toHaveBeenCalledTimes(0)
+    })
   })
 })
diff --git a/web/app/components/header/account-setting/data-source-page-new/__tests__/index.spec.tsx b/web/app/components/header/account-setting/data-source-page-new/__tests__/index.spec.tsx
index 9cdef50105c..871ab0b4321 100644
--- a/web/app/components/header/account-setting/data-source-page-new/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/__tests__/index.spec.tsx
@@ -64,12 +64,16 @@ vi.mock('@/app/components/plugins/plugin-auth', () => ({
 vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
   useCanSetPluginSettings: () => ({
     canSetPermissions: true,
+    canSetPluginPreferences: true,
   }),
   usePluginSettingsAccess: () => ({
     canSetPermissions: true,
+    canSetPluginPreferences: true,
+    canViewInstalledPlugins: true,
   }),
   default: () => ({
     canSetPermissions: true,
+    canSetPluginPreferences: true,
   }),
 }))
 
diff --git a/web/app/components/header/account-setting/data-source-page-new/__tests__/install-from-marketplace.spec.tsx b/web/app/components/header/account-setting/data-source-page-new/__tests__/install-from-marketplace.spec.tsx
index 128662e7fae..ba73742642f 100644
--- a/web/app/components/header/account-setting/data-source-page-new/__tests__/install-from-marketplace.spec.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/__tests__/install-from-marketplace.spec.tsx
@@ -58,6 +58,12 @@ vi.mock('../hooks', () => ({
   useMarketplaceAllPlugins: vi.fn(),
 }))
 
+vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
+  usePluginSettingsAccess: () => ({
+    canInstallPlugin: true,
+  }),
+}))
+
 describe('InstallFromMarketplace Component', () => {
   const mockProviders: DataSourceAuth[] = [
     {
diff --git a/web/app/components/header/account-setting/data-source-page-new/__tests__/item.spec.tsx b/web/app/components/header/account-setting/data-source-page-new/__tests__/item.spec.tsx
index ed05018388f..fdcb954c145 100644
--- a/web/app/components/header/account-setting/data-source-page-new/__tests__/item.spec.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/__tests__/item.spec.tsx
@@ -67,7 +67,7 @@ describe('Item Component', () => {
   describe('Rename Mode Interactions', () => {
     it('should switch to rename mode when Trigger Rename is clicked', async () => {
       // Arrange
-      render(<Item credentialItem={mockCredentialItem} onAction={mockOnAction} />)
+      render(<Item credentialItem={mockCredentialItem} onAction={mockOnAction} canManageCredential />)
 
       // Act
       await triggerRename()
@@ -78,7 +78,7 @@ describe('Item Component', () => {
 
     it('should update rename input value when changed', async () => {
       // Arrange
-      render(<Item credentialItem={mockCredentialItem} onAction={mockOnAction} />)
+      render(<Item credentialItem={mockCredentialItem} onAction={mockOnAction} canManageCredential />)
       await triggerRename()
       const input = screen.getByPlaceholderText('common.placeholder.input')
 
@@ -91,7 +91,7 @@ describe('Item Component', () => {
 
     it('should call onAction with "rename" and correct payload when Save is clicked', async () => {
       // Arrange
-      render(<Item credentialItem={mockCredentialItem} onAction={mockOnAction} />)
+      render(<Item credentialItem={mockCredentialItem} onAction={mockOnAction} canManageCredential />)
       await triggerRename()
       const input = screen.getByPlaceholderText('common.placeholder.input')
       fireEvent.change(input, { target: { value: 'New Name' } })
@@ -115,7 +115,7 @@ describe('Item Component', () => {
 
     it('should exit rename mode without calling onAction when Cancel is clicked', async () => {
       // Arrange
-      render(<Item credentialItem={mockCredentialItem} onAction={mockOnAction} />)
+      render(<Item credentialItem={mockCredentialItem} onAction={mockOnAction} canManageCredential />)
       await triggerRename()
       const input = screen.getByPlaceholderText('common.placeholder.input')
       fireEvent.change(input, { target: { value: 'Cancelled Name' } })
@@ -137,7 +137,7 @@ describe('Item Component', () => {
       const parentClick = vi.fn()
       render(
         <div onClick={parentClick}>
-          <Item credentialItem={mockCredentialItem} onAction={mockOnAction} />
+          <Item credentialItem={mockCredentialItem} onAction={mockOnAction} canManageCredential />
         </div>,
       )
       // Act & Assert
@@ -164,7 +164,7 @@ describe('Item Component', () => {
     it('should not throw if onAction is missing', async () => {
       // Arrange & Act
       // @ts-expect-error - Testing runtime tolerance for missing prop
-      render(<Item credentialItem={mockCredentialItem} onAction={undefined} />)
+      render(<Item credentialItem={mockCredentialItem} onAction={undefined} canManageCredential />)
       await triggerRename()
 
       // Assert
diff --git a/web/app/components/header/account-setting/data-source-page-new/__tests__/operator.spec.tsx b/web/app/components/header/account-setting/data-source-page-new/__tests__/operator.spec.tsx
index 12042acfa1f..1cbe3717b0d 100644
--- a/web/app/components/header/account-setting/data-source-page-new/__tests__/operator.spec.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/__tests__/operator.spec.tsx
@@ -65,7 +65,7 @@ describe('Operator Component', () => {
     it('should call onRename when "rename" action is selected', async () => {
       // Arrange
       const credential = createMockCredential(CredentialTypeEnum.OAUTH2)
-      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} />)
+      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} canManageCredential />)
 
       // Act
       await userEvent.setup().click(screen.getByRole('button'))
@@ -81,7 +81,7 @@ describe('Operator Component', () => {
     it('should handle missing onRename gracefully when "rename" action is selected', async () => {
       // Arrange
       const credential = createMockCredential(CredentialTypeEnum.OAUTH2)
-      render(<Operator credentialItem={credential} onAction={mockOnAction} />)
+      render(<Operator credentialItem={credential} onAction={mockOnAction} canManageCredential />)
 
       // Act & Assert
       await userEvent.setup().click(screen.getByRole('button'))
@@ -92,7 +92,7 @@ describe('Operator Component', () => {
     it('should call onAction for "setDefault" action', async () => {
       // Arrange
       const credential = createMockCredential(CredentialTypeEnum.API_KEY)
-      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} />)
+      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} canUseCredential />)
 
       // Act
       await userEvent.setup().click(screen.getByRole('button'))
@@ -107,7 +107,7 @@ describe('Operator Component', () => {
     it('should call onAction for "edit" action', async () => {
       // Arrange
       const credential = createMockCredential(CredentialTypeEnum.API_KEY)
-      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} />)
+      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} canManageCredential />)
 
       // Act
       await userEvent.setup().click(screen.getByRole('button'))
@@ -122,7 +122,7 @@ describe('Operator Component', () => {
     it('should call onAction for "change" action', async () => {
       // Arrange
       const credential = createMockCredential(CredentialTypeEnum.OAUTH2)
-      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} />)
+      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} canManageCredential />)
 
       // Act
       await userEvent.setup().click(screen.getByRole('button'))
@@ -137,7 +137,7 @@ describe('Operator Component', () => {
     it('should call onAction for "delete" action', async () => {
       // Arrange
       const credential = createMockCredential(CredentialTypeEnum.API_KEY)
-      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} />)
+      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} canManageCredential />)
 
       // Act
       await userEvent.setup().click(screen.getByRole('button'))
@@ -148,5 +148,20 @@ describe('Operator Component', () => {
         expect(mockOnAction).toHaveBeenCalledWith('delete', credential)
       })
     })
+
+    it('should not call actions by default when credential permissions are omitted', async () => {
+      const credential = createMockCredential(CredentialTypeEnum.API_KEY)
+      render(<Operator credentialItem={credential} onAction={mockOnAction} onRename={mockOnRename} />)
+
+      await userEvent.setup().click(screen.getByRole('button'))
+      fireEvent.click(await screen.findByText('plugin.auth.setDefault'))
+      fireEvent.click(screen.getByText('common.operation.edit'))
+      fireEvent.click(screen.getByText('common.operation.remove'))
+
+      await waitFor(() => {
+        expect(mockOnAction).not.toHaveBeenCalled()
+        expect(mockOnRename).not.toHaveBeenCalled()
+      })
+    })
   })
 })
diff --git a/web/app/components/header/account-setting/data-source-page-new/__tests__/plugin-actions.spec.tsx b/web/app/components/header/account-setting/data-source-page-new/__tests__/plugin-actions.spec.tsx
index c03998eadae..792dc0b3f75 100644
--- a/web/app/components/header/account-setting/data-source-page-new/__tests__/plugin-actions.spec.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/__tests__/plugin-actions.spec.tsx
@@ -94,6 +94,13 @@ vi.mock('@/utils/var', () => ({
   getMarketplaceUrl: (path: string) => `https://marketplace.example.com${path}`,
 }))
 
+vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
+  usePluginSettingsAccess: () => ({
+    canManagePlugin: true,
+    canUpdatePlugin: true,
+  }),
+}))
+
 const createPluginDetail = (overrides: Partial<PluginDetail> = {}): PluginDetail => ({
   id: 'plugin-installation-id',
   created_at: '2024-01-01',
diff --git a/web/app/components/header/account-setting/data-source-page-new/card.tsx b/web/app/components/header/account-setting/data-source-page-new/card.tsx
index 57d217ad985..0eddcb5d394 100644
--- a/web/app/components/header/account-setting/data-source-page-new/card.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/card.tsx
@@ -24,6 +24,7 @@ import {
 } from '@/app/components/plugins/plugin-auth'
 import { AuthCategory } from '@/app/components/plugins/plugin-auth/types'
 import { CollectionType } from '@/app/components/tools/types'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import { useRenderI18nObject } from '@/hooks/use-i18n'
 import { openOAuthPopup } from '@/hooks/use-oauth'
 import { useGetDataSourceOAuthUrl } from '@/service/use-datasource'
@@ -49,6 +50,7 @@ const Card = ({
   onPluginUpdate,
 }: CardProps) => {
   const { t } = useTranslation()
+  const { canUseCredential, canManageCredential } = useCredentialPermissions()
   const renderI18nObject = useRenderI18nObject()
   const {
     icon,
@@ -176,6 +178,7 @@ const Card = ({
             pluginPayload={pluginPayload}
             item={item}
             onUpdate={handleAuthUpdate}
+            disabled={disabled || !canManageCredential}
           />
         </div>
       </div>
@@ -192,6 +195,8 @@ const Card = ({
                   key={credentialItem.id}
                   credentialItem={credentialItem}
                   onAction={handleAction}
+                  canUseCredential={canUseCredential}
+                  canManageCredential={canManageCredential}
                 />
               ))
             }
@@ -216,7 +221,7 @@ const Card = ({
           </div>
           <AlertDialogActions>
             <AlertDialogCancelButton>{t('operation.cancel', { ns: 'common' })}</AlertDialogCancelButton>
-            <AlertDialogConfirmButton disabled={doingAction} onClick={handleConfirm}>
+            <AlertDialogConfirmButton disabled={doingAction || !canManageCredential} onClick={handleConfirm}>
               {t('operation.confirm', { ns: 'common' })}
             </AlertDialogConfirmButton>
           </AlertDialogActions>
@@ -234,7 +239,7 @@ const Card = ({
             formSchemas={credential_schema}
             editValues={editValues}
             onRemove={handleRemove}
-            disabled={disabled || doingAction}
+            disabled={disabled || doingAction || !canManageCredential}
           />
         )
       }
diff --git a/web/app/components/header/account-setting/data-source-page-new/index.tsx b/web/app/components/header/account-setting/data-source-page-new/index.tsx
index 691a0cca838..5200a4df097 100644
--- a/web/app/components/header/account-setting/data-source-page-new/index.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/index.tsx
@@ -5,7 +5,7 @@ import { Trans, useTranslation } from 'react-i18next'
 import { SearchInput } from '@/app/components/base/search-input'
 import { SkeletonContainer, SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
 import { usePluginsWithLatestVersion } from '@/app/components/plugins/hooks'
-import { useCanSetPluginSettings } from '@/app/components/plugins/plugin-page/use-reference-setting'
+import { usePluginSettingsAccess } from '@/app/components/plugins/plugin-page/use-reference-setting'
 import { PluginCategoryEnum } from '@/app/components/plugins/types'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { useRenderI18nObject } from '@/hooks/use-i18n'
@@ -59,14 +59,15 @@ const DataSourcePage = ({
   const renderI18nObject = useRenderI18nObject()
   const [searchText, setSearchText] = useState('')
   const {
-    canSetPermissions,
-  } = useCanSetPluginSettings()
+    canSetPluginPreferences,
+    canViewInstalledPlugins,
+  } = usePluginSettingsAccess()
   const { data: enable_marketplace } = useSuspenseQuery({
     ...systemFeaturesQueryOptions(),
     select: s => s.enable_marketplace,
   })
   const { data, isLoading: isDataSourceListLoading } = useGetDataSourceListAuth()
-  const { data: installedPluginList } = useInstalledPluginList()
+  const { data: installedPluginList } = useInstalledPluginList(!canViewInstalledPlugins)
   const pluginListWithLatestVersion = usePluginsWithLatestVersion(installedPluginList?.plugins)
   const invalidateInstalledPluginList = useInvalidateInstalledPluginList()
   const invalidateDataSourceListAuth = useInvalidDataSourceListAuth()
@@ -111,7 +112,7 @@ const DataSourcePage = ({
         value={searchText}
         onValueChange={setSearchText}
       />
-      {canSetPermissions && (
+      {canSetPluginPreferences && (
         <UpdateSettingDialog
           category={PluginCategoryEnum.datasource}
         />
diff --git a/web/app/components/header/account-setting/data-source-page-new/install-from-marketplace.tsx b/web/app/components/header/account-setting/data-source-page-new/install-from-marketplace.tsx
index 7be959e52cb..15e1bfeb1d5 100644
--- a/web/app/components/header/account-setting/data-source-page-new/install-from-marketplace.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/install-from-marketplace.tsx
@@ -16,6 +16,7 @@ import Divider from '@/app/components/base/divider'
 import Loading from '@/app/components/base/loading'
 import List from '@/app/components/plugins/marketplace/list'
 import { getMarketplaceCategoryUrl } from '@/app/components/plugins/marketplace/utils'
+import { usePluginSettingsAccess } from '@/app/components/plugins/plugin-page/use-reference-setting'
 import ProviderCard from '@/app/components/plugins/provider-card'
 import { PluginCategoryEnum } from '@/app/components/plugins/types'
 import Link from '@/next/link'
@@ -33,6 +34,7 @@ const InstallFromMarketplace = ({
 }: InstallFromMarketplaceProps) => {
   const { t } = useTranslation()
   const { theme } = useTheme()
+  const { canInstallPlugin } = usePluginSettingsAccess()
   const [collapse, setCollapse] = useState(false)
   const {
     plugins: allPlugins,
@@ -74,7 +76,7 @@ const InstallFromMarketplace = ({
             marketplaceCollections={[]}
             marketplaceCollectionPluginsMap={{}}
             plugins={allPlugins}
-            showInstallButton
+            showInstallButton={canInstallPlugin}
             cardContainerClassName="grid grid-cols-3 gap-2"
             cardRender={cardRender}
             emptyClassName="h-auto"
diff --git a/web/app/components/header/account-setting/data-source-page-new/item.tsx b/web/app/components/header/account-setting/data-source-page-new/item.tsx
index cb4520a3a2c..fe46af7c6b8 100644
--- a/web/app/components/header/account-setting/data-source-page-new/item.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/item.tsx
@@ -14,10 +14,14 @@ import Operator from './operator'
 type ItemProps = {
   credentialItem: DataSourceCredential
   onAction: (action: string, credentialItem: DataSourceCredential, renamePayload?: { credential_id: string, name: string }) => void
+  canUseCredential?: boolean
+  canManageCredential?: boolean
 }
 const Item = ({
   credentialItem,
   onAction,
+  canUseCredential = false,
+  canManageCredential = false,
 }: ItemProps) => {
   const { t } = useTranslation()
   const [renaming, setRenaming] = useState(false)
@@ -97,6 +101,8 @@ const Item = ({
               credentialItem={credentialItem}
               onAction={onAction}
               onRename={() => setRenaming(true)}
+              canUseCredential={canUseCredential}
+              canManageCredential={canManageCredential}
             />
           </>
         )
diff --git a/web/app/components/header/account-setting/data-source-page-new/operator.tsx b/web/app/components/header/account-setting/data-source-page-new/operator.tsx
index 4e1148aae2b..1a1b243d8c2 100644
--- a/web/app/components/header/account-setting/data-source-page-new/operator.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/operator.tsx
@@ -20,17 +20,24 @@ type OperatorProps = {
   credentialItem: DataSourceCredential
   onAction: (action: string, credentialItem: DataSourceCredential) => void
   onRename?: () => void
+  canUseCredential?: boolean
+  canManageCredential?: boolean
 }
 const Operator = ({
   credentialItem,
   onAction,
   onRename,
+  canUseCredential = false,
+  canManageCredential = false,
 }: OperatorProps) => {
   const { t } = useTranslation()
   const {
     type,
   } = credentialItem
-  const handleAction = useCallback((action: string) => {
+  const handleAction = useCallback((action: string, allowed: boolean) => {
+    if (!allowed)
+      return
+
     queueMicrotask(() => {
       if (action === 'rename') {
         onRename?.()
@@ -54,30 +61,30 @@ const Operator = ({
         )}
       />
       <DropdownMenuContent placement="bottom-end" sideOffset={4} popupClassName="min-w-[200px]">
-        <DropdownMenuItem className="h-auto gap-2 py-2" onClick={() => handleAction('setDefault')}>
+        <DropdownMenuItem disabled={!canUseCredential} className="h-auto gap-2 py-2" onClick={() => handleAction('setDefault', canUseCredential)}>
           <span aria-hidden className="i-ri-home-9-line size-4 text-text-tertiary" />
           <div className="system-sm-semibold text-text-secondary">{t('auth.setDefault', { ns: 'plugin' })}</div>
         </DropdownMenuItem>
         {type === CredentialTypeEnum.OAUTH2 && (
-          <DropdownMenuItem className="h-auto gap-2 py-2" onClick={() => handleAction('rename')}>
+          <DropdownMenuItem disabled={!canManageCredential} className="h-auto gap-2 py-2" onClick={() => handleAction('rename', canManageCredential)}>
             <span aria-hidden className="i-ri-edit-line size-4 text-text-tertiary" />
             <div className="system-sm-semibold text-text-secondary">{t('operation.rename', { ns: 'common' })}</div>
           </DropdownMenuItem>
         )}
         {type === CredentialTypeEnum.API_KEY && (
-          <DropdownMenuItem className="h-auto gap-2 py-2" onClick={() => handleAction('edit')}>
+          <DropdownMenuItem disabled={!canManageCredential} className="h-auto gap-2 py-2" onClick={() => handleAction('edit', canManageCredential)}>
             <span aria-hidden className="i-ri-equalizer-2-line size-4 text-text-tertiary" />
             <div className="system-sm-semibold text-text-secondary">{t('operation.edit', { ns: 'common' })}</div>
           </DropdownMenuItem>
         )}
         {type === CredentialTypeEnum.OAUTH2 && (
-          <DropdownMenuItem className="h-auto gap-2 py-2" onClick={() => handleAction('change')}>
+          <DropdownMenuItem disabled={!canManageCredential} className="h-auto gap-2 py-2" onClick={() => handleAction('change', canManageCredential)}>
             <span aria-hidden className="i-ri-sticky-note-add-line size-4 text-text-tertiary" />
             <div className="mb-1 system-sm-semibold text-text-secondary">{t('dataSource.notion.changeAuthorizedPages', { ns: 'common' })}</div>
           </DropdownMenuItem>
         )}
         <DropdownMenuSeparator />
-        <DropdownMenuItem variant="destructive" className="h-auto gap-2 py-2" onClick={() => handleAction('delete')}>
+        <DropdownMenuItem disabled={!canManageCredential} variant="destructive" className="h-auto gap-2 py-2" onClick={() => handleAction('delete', canManageCredential)}>
           <span aria-hidden className="i-ri-delete-bin-line size-4" />
           <div className="system-sm-semibold">
             {t('operation.remove', { ns: 'common' })}
diff --git a/web/app/components/header/account-setting/data-source-page-new/plugin-actions.tsx b/web/app/components/header/account-setting/data-source-page-new/plugin-actions.tsx
index bf72eb2afe2..5e9c1db9d89 100644
--- a/web/app/components/header/account-setting/data-source-page-new/plugin-actions.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/plugin-actions.tsx
@@ -9,6 +9,7 @@ import Badge from '@/app/components/base/badge'
 import { HeaderModals } from '@/app/components/plugins/plugin-detail-panel/detail-header/components'
 import { useDetailHeaderState, usePluginOperations } from '@/app/components/plugins/plugin-detail-panel/detail-header/hooks'
 import OperationDropdown from '@/app/components/plugins/plugin-detail-panel/operation-dropdown'
+import { usePluginSettingsAccess } from '@/app/components/plugins/plugin-page/use-reference-setting'
 import { useReadmePanelStore } from '@/app/components/plugins/readme-panel/store'
 import { PluginSource } from '@/app/components/plugins/types'
 import PluginVersionPicker from '@/app/components/plugins/update-plugin/plugin-version-picker'
@@ -49,6 +50,7 @@ const DataSourcePluginActions = ({
   const locale = useLocale()
   const readmeTriggerId = useId()
   const openReadmePanel = useReadmePanelStore(s => s.openReadmePanel)
+  const { canManagePlugin, canUpdatePlugin } = usePluginSettingsAccess()
   const detailHeaderState = usePluginDetailHeader(detail)
   const {
     modalStates,
@@ -67,6 +69,8 @@ const DataSourcePluginActions = ({
     modalStates,
     versionPicker,
     isFromMarketplace,
+    canManagePlugin,
+    canUpdatePlugin,
     onUpdate,
   })
   const displayVersion = isFromGitHub ? (detail.meta?.version ?? detail.version) : detail.version
@@ -96,7 +100,7 @@ const DataSourcePluginActions = ({
     <div className="flex shrink-0 items-center gap-1" onClick={e => e.stopPropagation()}>
       {!!displayVersion && (
         <PluginVersionPicker
-          disabled={!isFromMarketplace}
+          disabled={!canUpdatePlugin || !isFromMarketplace}
           isShow={versionPicker.isShow}
           onShowChange={versionPicker.setIsShow}
           pluginID={detail.plugin_id}
@@ -108,7 +112,7 @@ const DataSourcePluginActions = ({
               text={(
                 <>
                   <div>{displayVersion}</div>
-                  {isFromMarketplace && <span aria-hidden className="ml-1 i-ri-arrow-left-right-line h-3 w-3 shrink-0 text-text-tertiary" />}
+                  {canUpdatePlugin && isFromMarketplace && <span aria-hidden className="ml-1 i-ri-arrow-left-right-line h-3 w-3 shrink-0 text-text-tertiary" />}
                 </>
               )}
               hasRedCornerMark={hasNewVersion}
@@ -117,7 +121,7 @@ const DataSourcePluginActions = ({
           )}
         />
       )}
-      {(hasNewVersion || isFromGitHub) && (
+      {canUpdatePlugin && (hasNewVersion || isFromGitHub) && (
         <Tooltip>
           <TooltipTrigger
             delay={300}
@@ -145,6 +149,8 @@ const DataSourcePluginActions = ({
         onViewReadme={detail.plugin_unique_identifier ? handleViewReadme : undefined}
         detailUrl={getDetailUrl(detail, locale, theme || 'light')}
         triggerSize="xs"
+        showCheckVersion={canUpdatePlugin}
+        showRemove={canManagePlugin}
       />
       <HeaderModals
         detail={detail}
diff --git a/web/app/components/header/account-setting/index.tsx b/web/app/components/header/account-setting/index.tsx
index 41c8573b17a..3d9b0b1a8c9 100644
--- a/web/app/components/header/account-setting/index.tsx
+++ b/web/app/components/header/account-setting/index.tsx
@@ -3,24 +3,26 @@ import type { AccountSettingTab } from '@/app/components/header/account-setting/
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
-import { useCallback, useState } from 'react'
+import { useCallback, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import BillingPage from '@/app/components/billing/billing-page'
 import CustomPage from '@/app/components/custom/custom-page'
 import {
   ACCOUNT_SETTING_TAB,
-
 } from '@/app/components/header/account-setting/constants'
 import MenuDialog from '@/app/components/header/account-setting/menu-dialog'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
+import { BillingPermission, hasPermission } from '@/utils/permission'
+import AccessRulesPage from './access-rules-page'
 import { ApiBasedExtensionPage } from './api-based-extension-page'
 import DataSourcePage from './data-source-page-new'
 import LanguagePage from './language-page'
 import MembersPage from './members-page'
 import ModelProviderPage from './model-provider-page'
 import { useResetModelProviderListExpanded } from './model-provider-page/atoms'
+import PermissionsPage from './permissions-page'
 
 const iconClassName = `
   w-4 h-4 mr-2
@@ -47,10 +49,15 @@ export default function AccountSetting({
   onTabChangeAction,
 }: IAccountSettingProps) {
   const resetModelProviderListExpanded = useResetModelProviderListExpanded()
-  const activeMenu = activeTab
   const { t } = useTranslation()
   const { enableBilling, enableReplaceWebAppLogo } = useProviderContext()
-  const { isCurrentWorkspaceDatasetOperator } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
+  const canManageWorkspaceRoles = hasPermission(workspacePermissionKeys, 'workspace.role.manage')
+  const canViewBilling = enableBilling && hasPermission(workspacePermissionKeys, BillingPermission.View)
+  const activeMenu = activeTab === ACCOUNT_SETTING_TAB.BILLING && !canViewBilling
+    ? ACCOUNT_SETTING_TAB.LANGUAGE
+    : activeTab
+  const scrollContainerRef = useRef<HTMLDivElement>(null)
 
   const settingItems: GroupItem[] = [
     {
@@ -65,6 +72,19 @@ export default function AccountSetting({
       icon: <span className={cn('i-ri-group-2-line', iconClassName)} />,
       activeIcon: <span className={cn('i-ri-group-2-fill', iconClassName)} />,
     },
+    {
+      key: ACCOUNT_SETTING_TAB.PERMISSIONS,
+      name: t('settings.rolesAndPermissions', { ns: 'common' }),
+      icon: <span className={cn('i-ri-shield-user-line', iconClassName)} />,
+      activeIcon: <span className={cn('i-ri-shield-user-fill', iconClassName)} />,
+    },
+    {
+      key: ACCOUNT_SETTING_TAB.ACCESS_RULES,
+      name: t('settings.resourceAccess', { ns: 'common' }),
+      description: t('settings.resourceAccessDescription', { ns: 'common' }),
+      icon: <span className={cn('i-ri-lock-2-line', iconClassName)} />,
+      activeIcon: <span className={cn('i-ri-lock-2-fill', iconClassName)} />,
+    },
     {
       key: ACCOUNT_SETTING_TAB.BILLING,
       name: t('settings.billing', { ns: 'common' }),
@@ -101,14 +121,16 @@ export default function AccountSetting({
   const activeItem = settingItems.find(item => item.key === activeMenu)
 
   const visibleSettingItems: GroupItem[] = (() => {
-    if (isCurrentWorkspaceDatasetOperator)
-      return []
-
     const visibleTabs: AccountSettingTab[] = []
 
     visibleTabs.push(ACCOUNT_SETTING_TAB.MEMBERS)
 
-    if (enableBilling)
+    if (canManageWorkspaceRoles) {
+      visibleTabs.push(ACCOUNT_SETTING_TAB.PERMISSIONS)
+      visibleTabs.push(ACCOUNT_SETTING_TAB.ACCESS_RULES)
+    }
+
+    if (canViewBilling)
       visibleTabs.push(ACCOUNT_SETTING_TAB.BILLING)
 
     if (enableReplaceWebAppLogo || enableBilling)
@@ -207,6 +229,7 @@ export default function AccountSetting({
             <div className="mt-1 system-2xs-medium-uppercase text-text-tertiary">ESC</div>
           </div>
           <ScrollArea
+            ref={scrollContainerRef}
             className="h-full min-h-0 flex-1 bg-components-panel-bg"
             slotClassNames={{
               viewport: 'overscroll-contain',
@@ -214,10 +237,10 @@ export default function AccountSetting({
             }}
           >
             <div className="sticky top-0 z-20 mx-8 flex min-h-[60px] items-end bg-components-panel-bg pt-8 pb-2">
-              <div className="shrink-0 title-2xl-semi-bold text-text-primary">
+              <div className="min-w-0 flex-1 title-2xl-semi-bold text-text-primary">
                 {activeItem?.title ?? activeItem?.name}
                 {activeItem?.description && (
-                  <div className="mt-1 system-sm-regular text-text-tertiary">{activeItem?.description}</div>
+                  <div className="mt-1 system-sm-regular wrap-break-word whitespace-normal text-text-tertiary">{activeItem?.description}</div>
                 )}
               </div>
             </div>
@@ -229,6 +252,8 @@ export default function AccountSetting({
                 />
               )}
               {activeMenu === ACCOUNT_SETTING_TAB.MEMBERS && <MembersPage />}
+              {activeMenu === ACCOUNT_SETTING_TAB.PERMISSIONS && <PermissionsPage containerRef={scrollContainerRef} />}
+              {activeMenu === ACCOUNT_SETTING_TAB.ACCESS_RULES && <AccessRulesPage />}
               {activeMenu === ACCOUNT_SETTING_TAB.BILLING && <BillingPage />}
               {activeMenu === ACCOUNT_SETTING_TAB.DATA_SOURCE && <DataSourcePage />}
               {activeMenu === ACCOUNT_SETTING_TAB.API_BASED_EXTENSION && <ApiBasedExtensionPage />}
diff --git a/web/app/components/header/account-setting/members-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/members-page/__tests__/index.spec.tsx
index e1298004879..d618b70cfbb 100644
--- a/web/app/components/header/account-setting/members-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/members-page/__tests__/index.spec.tsx
@@ -1,4 +1,5 @@
 import type { AppContextValue } from '@/context/app-context'
+import type { Role } from '@/models/access-control'
 import type { ICurrentWorkspace, Member } from '@/models/common'
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
@@ -9,18 +10,33 @@ import { Plan } from '@/app/components/billing/type'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
+import { useUpdateRolesOfMember } from '@/service/access-control/use-member-roles'
 import { useMembers } from '@/service/use-common'
 import MembersPage from '../index'
 
 vi.mock('@/context/app-context')
 vi.mock('@/context/provider-context')
 vi.mock('@/hooks/use-format-time-from-now')
+vi.mock('@/service/access-control/use-member-roles')
 vi.mock('@/service/use-common')
 
 const renderMembersPage = () => renderWithSystemFeatures(<MembersPage />, {
   systemFeatures: { is_email_setup: true },
 })
 
+const createRole = (overrides: Partial<Role>): Role => ({
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_custom',
+  name: 'Role',
+  description: '',
+  is_builtin: false,
+  permission_keys: [],
+  role_tag: '',
+  ...overrides,
+})
+
 vi.mock('../edit-workspace-modal', () => ({
   default: ({ onCancel }: { onCancel: () => void }) => (
     <div>
@@ -51,17 +67,39 @@ vi.mock('../invited-modal', () => ({
     </div>
   ),
 }))
-vi.mock('../operation', () => ({
-  default: ({ member }: { member: Member }) => (
-    <div>
-      Member Operation
-      {' '}
-      {member.role}
-    </div>
+vi.mock('../role-badges', () => ({
+  default: ({ roleNames }: { roleNames: string[] }) => (
+    <div data-testid="role-badges">{roleNames.join(',')}</div>
   ),
 }))
-vi.mock('../operation/transfer-ownership', () => ({
-  default: ({ onOperate }: { onOperate: () => void }) => <button onClick={onOperate}>Transfer ownership</button>,
+vi.mock('../member-menu', () => ({
+  default: ({
+    member,
+    isCurrentUser,
+    onTransferOwnership,
+    canTransferOwnership,
+  }: {
+    member: Member
+    isCurrentUser?: boolean
+    onTransferOwnership?: () => void
+    canTransferOwnership?: boolean
+  }) => (
+    <div data-testid="member-menu">
+      {member.role !== 'owner' && !isCurrentUser && (
+        <div>{`Member Operation ${member.role}`}</div>
+      )}
+      {canTransferOwnership && member.role === 'owner' && onTransferOwnership && (
+        <button
+          onClick={(e) => {
+            e.stopPropagation()
+            onTransferOwnership()
+          }}
+        >
+          Transfer ownership
+        </button>
+      )}
+    </div>
+  ),
 }))
 vi.mock('../transfer-ownership-modal', () => ({
   default: ({ onClose }: { onClose: () => void }) => (
@@ -71,6 +109,33 @@ vi.mock('../transfer-ownership-modal', () => ({
     </div>
   ),
 }))
+vi.mock('../member-details-modal', () => ({
+  default: ({
+    member,
+    onClose,
+    canAssignRoles,
+    onAssignSubmit,
+  }: {
+    member: Member
+    onClose: () => void
+    canAssignRoles?: boolean
+    onAssignSubmit?: (roles: Role[]) => void
+  }) => (
+    <div>
+      <div>Member Details Modal</div>
+      <div data-testid="details-member-name">{member.name}</div>
+      <div data-testid="details-can-assign">{String(canAssignRoles)}</div>
+      <button onClick={() => onAssignSubmit?.([
+        createRole({ id: 'role-next', name: 'Next role' }),
+        createRole({ id: 'role-extra', name: 'Extra role' }),
+      ])}
+      >
+        Submit Member Roles
+      </button>
+      <button onClick={onClose}>Close Member Details Modal</button>
+    </div>
+  ),
+}))
 vi.mock('@/app/components/billing/upgrade-btn', () => ({
   default: () => <div>Upgrade Button</div>,
 }))
@@ -78,6 +143,7 @@ vi.mock('@/app/components/billing/upgrade-btn', () => ({
 describe('MembersPage', () => {
   const mockRefetch = vi.fn()
   const mockFormatTimeFromNow = vi.fn(() => 'just now')
+  const mockUpdateRolesOfMember = vi.fn()
 
   const mockAccounts: Member[] = [
     {
@@ -91,6 +157,7 @@ describe('MembersPage', () => {
       last_login_at: '1731000000',
       created_at: '1731000000',
       status: 'active',
+      roles: [createRole({ id: 'owner-role', name: 'Owner', is_builtin: true, role_tag: 'owner' })],
     },
     {
       id: '2',
@@ -103,6 +170,7 @@ describe('MembersPage', () => {
       last_login_at: '1731000000',
       created_at: '1731000000',
       status: 'active',
+      roles: [createRole({ id: 'admin-role', name: 'Admin', is_builtin: true })],
     },
   ]
 
@@ -114,12 +182,20 @@ describe('MembersPage', () => {
       currentWorkspace: { name: 'Test Workspace', role: 'owner' } as ICurrentWorkspace,
       isCurrentWorkspaceOwner: true,
       isCurrentWorkspaceManager: true,
+      workspacePermissionKeys: ['workspace.member.manage'],
     } as unknown as AppContextValue)
 
     vi.mocked(useMembers).mockReturnValue({
       data: { accounts: mockAccounts },
       refetch: mockRefetch,
     } as unknown as ReturnType<typeof useMembers>)
+    mockUpdateRolesOfMember.mockImplementation((_payload, options) => {
+      options?.onSuccess?.()
+      return Promise.resolve()
+    })
+    vi.mocked(useUpdateRolesOfMember).mockReturnValue({
+      mutateAsync: mockUpdateRolesOfMember,
+    } as unknown as ReturnType<typeof useUpdateRolesOfMember>)
 
     vi.mocked(useProviderContext).mockReturnValue(createMockProviderContextValue({
       enableBilling: false,
@@ -139,6 +215,15 @@ describe('MembersPage', () => {
     expect(screen.getByText('Admin User'))!.toBeInTheDocument()
   })
 
+  it('should render fixed name column and flexible role column layout', () => {
+    renderMembersPage()
+
+    expect(screen.getByText('common.members.name', { selector: '.system-xs-medium-uppercase' }))!.toHaveClass('w-65', 'shrink-0')
+    expect(screen.getByText('common.members.role', { selector: '.system-xs-medium-uppercase' }))!.toHaveClass('min-w-0', 'grow')
+    expect(screen.getByTestId('member-row-1').children[0])!.toHaveClass('w-65', 'shrink-0')
+    expect(screen.getByTestId('member-row-1').children[2])!.toHaveClass('min-w-0', 'grow')
+  })
+
   it('should open and close invite modal', async () => {
     const user = userEvent.setup()
 
@@ -183,7 +268,7 @@ describe('MembersPage', () => {
 
     renderMembersPage()
 
-    expect(screen.getByText('common.members.owner'))!.toBeInTheDocument()
+    expect(screen.getByText('Owner'))!.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: /transfer ownership/i })).not.toBeInTheDocument()
   })
 
@@ -294,6 +379,7 @@ describe('MembersPage', () => {
       currentWorkspace: { name: 'Test Workspace', role: 'admin' } as ICurrentWorkspace,
       isCurrentWorkspaceOwner: false,
       isCurrentWorkspaceManager: true,
+      workspacePermissionKeys: ['workspace.member.manage'],
     } as unknown as AppContextValue)
 
     renderMembersPage()
@@ -308,6 +394,7 @@ describe('MembersPage', () => {
       currentWorkspace: { name: 'Test Workspace', role: 'admin' } as ICurrentWorkspace,
       isCurrentWorkspaceOwner: false,
       isCurrentWorkspaceManager: true,
+      workspacePermissionKeys: ['workspace.member.manage'],
     } as unknown as AppContextValue)
     vi.mocked(useMembers).mockReturnValue({
       data: {
@@ -329,7 +416,6 @@ describe('MembersPage', () => {
     expect(screen.getByText('Member Operation normal'))!.toBeInTheDocument()
     expect(screen.getByText('Member Operation dataset_operator'))!.toBeInTheDocument()
     expect(screen.getByText('Member Operation admin'))!.toBeInTheDocument()
-    expect(screen.getAllByText('common.members.admin')).toHaveLength(1)
     expect(screen.queryByText('Member Operation owner')).not.toBeInTheDocument()
   })
 
@@ -380,7 +466,7 @@ describe('MembersPage', () => {
     expect(screen.getByText('1'))!.toBeInTheDocument()
   })
 
-  it('should show normal role as fallback for unknown role', () => {
+  it('should render role badge names from account roles', () => {
     vi.mocked(useAppContext).mockReturnValue({
       userProfile: { email: 'admin@example.com' },
       currentWorkspace: { name: 'Test Workspace', role: 'admin' } as ICurrentWorkspace,
@@ -394,7 +480,106 @@ describe('MembersPage', () => {
 
     renderMembersPage()
 
-    expect(screen.getByText('common.members.normal'))!.toBeInTheDocument()
+    expect(screen.getByText('Admin'))!.toBeInTheDocument()
+  })
+
+  it('should open member details modal when a member row is clicked', async () => {
+    const user = userEvent.setup()
+
+    renderMembersPage()
+
+    await user.click(screen.getByTestId('member-row-2'))
+
+    expect(screen.getByText('Member Details Modal'))!.toBeInTheDocument()
+    expect(screen.getByTestId('details-member-name'))!.toHaveTextContent('Admin User')
+
+    await user.click(screen.getByRole('button', { name: 'Close Member Details Modal' }))
+    expect(screen.queryByText('Member Details Modal')).not.toBeInTheDocument()
+  })
+
+  it('should open member details modal via keyboard Enter', async () => {
+    const user = userEvent.setup()
+
+    renderMembersPage()
+
+    const row = screen.getByTestId('member-row-2')
+    row.focus()
+    await user.keyboard('{Enter}')
+
+    expect(screen.getByText('Member Details Modal'))!.toBeInTheDocument()
+  })
+
+  it('should not allow assigning roles from member details when target is owner', async () => {
+    const user = userEvent.setup()
+
+    renderMembersPage()
+
+    await user.click(screen.getByTestId('member-row-1'))
+
+    expect(screen.getByTestId('details-can-assign'))!.toHaveTextContent('false')
+  })
+
+  it('should not allow assigning roles from member details when target is current user', async () => {
+    const user = userEvent.setup()
+    vi.mocked(useAppContext).mockReturnValue({
+      userProfile: { email: 'admin@example.com' },
+      currentWorkspace: { name: 'Test Workspace', role: 'admin' } as ICurrentWorkspace,
+      isCurrentWorkspaceOwner: false,
+      isCurrentWorkspaceManager: true,
+      workspacePermissionKeys: ['workspace.member.manage'],
+    } as unknown as AppContextValue)
+
+    renderMembersPage()
+
+    await user.click(screen.getByTestId('member-row-2'))
+
+    expect(screen.getByTestId('details-can-assign'))!.toHaveTextContent('false')
+  })
+
+  it('should submit only one member role when RBAC is disabled', async () => {
+    const user = userEvent.setup()
+
+    renderMembersPage()
+
+    await user.click(screen.getByTestId('member-row-2'))
+    await user.click(screen.getByRole('button', { name: 'Submit Member Roles' }))
+
+    expect(mockUpdateRolesOfMember).toHaveBeenCalledWith({
+      memberId: '2',
+      roleIds: ['role-next'],
+    }, expect.any(Object))
+    expect(mockRefetch).toHaveBeenCalled()
+    expect(screen.getByText('Member Details Modal')).toBeInTheDocument()
+    expect(screen.getByTestId('details-member-name')).toHaveTextContent('Admin User')
+  })
+
+  it('should submit multiple member roles when RBAC is enabled', async () => {
+    const user = userEvent.setup()
+
+    renderWithSystemFeatures(<MembersPage />, {
+      systemFeatures: {
+        is_email_setup: true,
+        rbac_enabled: true,
+      },
+    })
+
+    await user.click(screen.getByTestId('member-row-2'))
+    await user.click(screen.getByRole('button', { name: 'Submit Member Roles' }))
+
+    expect(mockUpdateRolesOfMember).toHaveBeenCalledWith({
+      memberId: '2',
+      roleIds: ['role-next', 'role-extra'],
+    }, expect.any(Object))
+  })
+
+  it('should not open member details when clicking the member menu area', async () => {
+    const user = userEvent.setup()
+
+    renderMembersPage()
+
+    await user.click(screen.getByRole('button', { name: /transfer ownership/i }))
+
+    expect(screen.queryByText('Member Details Modal')).not.toBeInTheDocument()
   })
 
   it('should show upgrade button when member limit is full', () => {
diff --git a/web/app/components/header/account-setting/members-page/__tests__/member-menu.spec.tsx b/web/app/components/header/account-setting/members-page/__tests__/member-menu.spec.tsx
new file mode 100644
index 00000000000..a780e46ff4e
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/__tests__/member-menu.spec.tsx
@@ -0,0 +1,152 @@
+import type { Role } from '@/models/access-control'
+import type { Member } from '@/models/common'
+import { toast } from '@langgenius/dify-ui/toast'
+import { QueryClient } from '@tanstack/react-query'
+import { screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
+import { useUpdateRolesOfMember } from '@/service/access-control/use-member-roles'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
+import { deleteMemberOrCancelInvitation } from '@/service/common'
+import { commonQueryKeys } from '@/service/use-common'
+import MemberMenu from '../member-menu'
+
+vi.mock('@/service/access-control/use-member-roles')
+vi.mock('@/service/access-control/use-workspace-roles')
+vi.mock('@/service/common', () => ({
+  deleteMemberOrCancelInvitation: vi.fn(),
+}))
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    success: vi.fn(),
+  },
+}))
+
+const createRole = (overrides: Partial<Role>): Role => ({
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_custom',
+  name: 'Role',
+  description: '',
+  is_builtin: false,
+  permission_keys: [],
+  role_tag: '',
+  ...overrides,
+})
+
+const roles = [
+  createRole({ id: 'role-1', name: 'First role' }),
+  createRole({ id: 'role-2', name: 'Second role' }),
+]
+
+const member: Member = {
+  id: 'member-1',
+  name: 'Member User',
+  email: 'member@example.com',
+  avatar: '',
+  avatar_url: '',
+  role: 'normal',
+  roles: [roles[0]!],
+  last_active_at: '1731000000',
+  last_login_at: '1731000000',
+  created_at: '1731000000',
+  status: 'active',
+}
+
+describe('MemberMenu', () => {
+  const mockUpdateRolesOfMember = vi.fn()
+
+  const createQueryClient = () => new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+        staleTime: Infinity,
+      },
+      mutations: {
+        retry: false,
+      },
+    },
+  })
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUpdateRolesOfMember.mockResolvedValue(undefined)
+    vi.mocked(deleteMemberOrCancelInvitation).mockResolvedValue({ result: 'success' })
+    vi.mocked(useUpdateRolesOfMember).mockReturnValue({
+      mutateAsync: mockUpdateRolesOfMember,
+    } as unknown as ReturnType<typeof useUpdateRolesOfMember>)
+    vi.mocked(useWorkspaceRoleList).mockReturnValue({
+      data: {
+        pages: [{
+          data: roles,
+          pagination: {
+            total_count: 2,
+            per_page: 20,
+            current_page: 1,
+            total_pages: 1,
+          },
+        }],
+        pageParams: [1],
+      },
+      isLoading: false,
+      error: null,
+      hasNextPage: false,
+      isFetchingNextPage: false,
+      fetchNextPage: vi.fn(),
+    } as unknown as ReturnType<typeof useWorkspaceRoleList>)
+  })
+
+  it('should submit only one selected role from the assign modal when RBAC is disabled', async () => {
+    const user = userEvent.setup()
+
+    renderWithSystemFeatures(
+      <MemberMenu
+        member={member}
+        isCurrentUser={false}
+        allowMultipleRoles={false}
+      />,
+      {
+        systemFeatures: {
+          rbac_enabled: false,
+        },
+      },
+    )
+
+    await user.click(screen.getByRole('button', { name: /members\.memberActions/i }))
+    await user.click(screen.getByRole('menuitem', { name: /members\.assignRoles/i }))
+    await user.click(screen.getByRole('radio', { name: /Second role/i }))
+    await user.click(screen.getByRole('button', { name: /common\.operation\.confirm/i }))
+
+    expect(mockUpdateRolesOfMember).toHaveBeenCalledWith({
+      memberId: 'member-1',
+      roleIds: ['role-2'],
+    }, expect.any(Object))
+  })
+
+  it('should refresh and invalidate members after removing a member', async () => {
+    const user = userEvent.setup()
+    const queryClient = createQueryClient()
+    const membersQueryKey = [...commonQueryKeys.members, 'en-US']
+    queryClient.setQueryData(membersQueryKey, { accounts: [member] })
+
+    renderWithSystemFeatures(
+      <MemberMenu
+        member={member}
+        isCurrentUser={false}
+      />,
+      {
+        queryClient,
+      },
+    )
+
+    await user.click(screen.getByRole('button', { name: /members\.memberActions/i }))
+    await user.click(screen.getByRole('menuitem', { name: /members\.removeFromTeam/i }))
+
+    expect(deleteMemberOrCancelInvitation).toHaveBeenCalledWith({
+      url: '/workspaces/current/members/member-1',
+    })
+    expect(queryClient.getQueryState(membersQueryKey)?.isInvalidated).toBe(true)
+    expect(toast.success).toHaveBeenCalledWith('common.actionMsg.modifiedSuccessfully')
+  })
+})
diff --git a/web/app/components/header/account-setting/members-page/__tests__/role-badges.spec.tsx b/web/app/components/header/account-setting/members-page/__tests__/role-badges.spec.tsx
new file mode 100644
index 00000000000..3135bc4256f
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/__tests__/role-badges.spec.tsx
@@ -0,0 +1,22 @@
+import { render, screen } from '@testing-library/react'
+import RoleBadges from '../role-badges'
+
+describe('RoleBadges', () => {
+  describe('Rendering', () => {
+    it('should expose visible role names as badge titles', () => {
+      render(<RoleBadges roleNames={['Very long custom role name', 'Admin']} />)
+
+      expect(screen.getByTitle('Very long custom role name'))!.toHaveTextContent('Very long custom role name')
+      expect(screen.getByTitle('Admin'))!.toHaveTextContent('Admin')
+    })
+
+    it('should render overflow count for hidden roles', () => {
+      render(<RoleBadges roleNames={['Owner', 'Admin', 'Editor']} max={2} />)
+
+      expect(screen.getByTitle('Owner'))!.toBeInTheDocument()
+      expect(screen.getByTitle('Admin'))!.toBeInTheDocument()
+      expect(screen.getByText('+1'))!.toBeInTheDocument()
+      expect(screen.queryByTitle('Editor')).not.toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/members-page/assign-roles-modal/__tests__/index.spec.tsx b/web/app/components/header/account-setting/members-page/assign-roles-modal/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..4e6113f9828
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/assign-roles-modal/__tests__/index.spec.tsx
@@ -0,0 +1,72 @@
+import type { Role } from '@/models/access-control'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
+import AssignRolesModal from '../index'
+
+vi.mock('@/service/access-control/use-workspace-roles')
+
+const createRole = (overrides: Partial<Role>): Role => ({
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_custom',
+  name: 'Role',
+  description: '',
+  is_builtin: false,
+  permission_keys: [],
+  role_tag: '',
+  ...overrides,
+})
+
+const roles = [
+  createRole({ id: 'role-1', name: 'First role' }),
+  createRole({ id: 'role-2', name: 'Second role' }),
+]
+
+describe('AssignRolesModal', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(useWorkspaceRoleList).mockReturnValue({
+      data: {
+        pages: [{
+          data: roles,
+          pagination: {
+            total_count: 2,
+            per_page: 20,
+            current_page: 1,
+            total_pages: 1,
+          },
+        }],
+        pageParams: [1],
+      },
+      isLoading: false,
+      error: null,
+      hasNextPage: false,
+      isFetchingNextPage: false,
+      fetchNextPage: vi.fn(),
+    } as unknown as ReturnType<typeof useWorkspaceRoleList>)
+  })
+
+  describe('Role selection', () => {
+    it('should disable confirm when the last selected role is unchecked', async () => {
+      const user = userEvent.setup()
+
+      render(
+        <AssignRolesModal
+          selectedRoles={[roles[0]!]}
+          onClose={vi.fn()}
+          onSubmit={vi.fn()}
+        />,
+      )
+
+      const confirmButton = screen.getByRole('button', { name: /common\.operation\.confirm/i })
+
+      expect(confirmButton).toBeEnabled()
+
+      await user.click(screen.getByRole('checkbox', { name: /First role/i }))
+
+      expect(confirmButton).toBeDisabled()
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/members-page/assign-roles-modal/index.tsx b/web/app/components/header/account-setting/members-page/assign-roles-modal/index.tsx
new file mode 100644
index 00000000000..e679b630e87
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/assign-roles-modal/index.tsx
@@ -0,0 +1,116 @@
+'use client'
+
+import type { Role } from '@/models/access-control'
+import { Button } from '@langgenius/dify-ui/button'
+import {
+  Dialog,
+  DialogCloseButton,
+  DialogContent,
+  DialogDescription,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import WorkspaceRoleCheckboxList from '../../workspace-role-checkbox-list'
+
+type AssignRolesModalProps = {
+  selectedRoles: Role[]
+  allowMultipleRoles?: boolean
+  onClose: () => void
+  onSubmit: (roles: Role[]) => void
+}
+
+type AssignRolesModalBodyProps = AssignRolesModalProps
+
+const AssignRolesModalBody = ({
+  selectedRoles,
+  allowMultipleRoles = true,
+  onClose,
+  onSubmit,
+}: AssignRolesModalBodyProps) => {
+  const { t } = useTranslation()
+  const [selected, setSelected] = useState(selectedRoles)
+  const selectedRoleIds = selected.map(role => role.id)
+  const isConfirmDisabled = selected.length === 0
+
+  const handleConfirm = () => {
+    if (isConfirmDisabled)
+      return
+
+    onSubmit(selected)
+    onClose()
+  }
+
+  return (
+    <DialogContent
+      className="flex h-121 w-120 flex-col overflow-hidden p-0"
+      backdropProps={{ forceRender: true }}
+    >
+      <div className="relative shrink-0 px-6 pt-6 pb-4">
+        <DialogCloseButton />
+        <div className="pr-8">
+          <DialogTitle className="system-xl-semibold text-text-primary">
+            {t('members.assignRolesModal.title', { ns: 'common', defaultValue: 'Assign Roles' })}
+          </DialogTitle>
+          <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+            {t('members.assignRolesModal.description', {
+              ns: 'common',
+              defaultValue:
+                'Select roles to assign to this member. All permissions from selected roles will be combined.',
+            })}
+          </DialogDescription>
+        </div>
+      </div>
+
+      <WorkspaceRoleCheckboxList
+        selectedRoleIds={selectedRoleIds}
+        selectedRoles={selected}
+        allowMultipleRoles={allowMultipleRoles}
+        onSelectedRolesChange={setSelected}
+      />
+
+      <div className="flex shrink-0 items-center justify-between gap-3 border-t border-divider-subtle px-6 py-4">
+        <div className="system-xs-regular text-text-tertiary">
+          {t('members.assignRolesModal.selectedCount', {
+            ns: 'common',
+            count: selected.length,
+          })}
+        </div>
+        <div className="flex items-center gap-2">
+          <Button variant="secondary" onClick={onClose}>
+            {t('operation.cancel', { ns: 'common' })}
+          </Button>
+          <Button variant="primary" disabled={isConfirmDisabled} onClick={handleConfirm}>
+            {t('operation.confirm', { ns: 'common' })}
+          </Button>
+        </div>
+      </div>
+    </DialogContent>
+  )
+}
+
+const AssignRolesModal = ({
+  selectedRoles,
+  allowMultipleRoles = true,
+  onClose,
+  onSubmit,
+}: AssignRolesModalProps) => {
+  return (
+    <Dialog
+      open
+      onOpenChange={(nextOpen) => {
+        if (!nextOpen)
+          onClose()
+      }}
+    >
+      <AssignRolesModalBody
+        selectedRoles={selectedRoles}
+        allowMultipleRoles={allowMultipleRoles}
+        onClose={onClose}
+        onSubmit={onSubmit}
+      />
+    </Dialog>
+  )
+}
+
+export default AssignRolesModal
diff --git a/web/app/components/header/account-setting/members-page/index.tsx b/web/app/components/header/account-setting/members-page/index.tsx
index 568413780ae..b9f42d4f1cc 100644
--- a/web/app/components/header/account-setting/members-page/index.tsx
+++ b/web/app/components/header/account-setting/members-page/index.tsx
@@ -1,9 +1,10 @@
 'use client'
+import type { Role } from '@/models/access-control'
 import type { InvitationResult, Member } from '@/models/common'
-import { Avatar } from '@langgenius/dify-ui/avatar'
+import { toast } from '@langgenius/dify-ui/toast'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import { useSuspenseQuery } from '@tanstack/react-query'
-import { useState } from 'react'
+import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { NUM_INFINITE } from '@/app/components/billing/config'
 import { Plan } from '@/app/components/billing/type'
@@ -12,32 +13,26 @@ import { useAppContext } from '@/context/app-context'
 import { useLocale } from '@/context/i18n'
 import { useProviderContext } from '@/context/provider-context'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
-import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
-import { LanguagesSupported } from '@/i18n-config/language'
+import { getAccessControlTemplateLanguage, LanguagesSupported } from '@/i18n-config/language'
+import { useUpdateRolesOfMember } from '@/service/access-control/use-member-roles'
 import { useMembers } from '@/service/use-common'
+import { hasPermission } from '@/utils/permission'
 import EditWorkspaceModal from './edit-workspace-modal'
 import InviteButton from './invite-button'
 import InviteModal from './invite-modal'
 import InvitedModal from './invited-modal'
-import Operation from './operation'
-import TransferOwnership from './operation/transfer-ownership'
+import MemberDetailsModal from './member-details-modal'
+import MemberRow from './member-row'
 import TransferOwnershipModal from './transfer-ownership-modal'
 
 const MembersPage = () => {
   const { t } = useTranslation()
-  const RoleMap = {
-    owner: t('members.owner', { ns: 'common' }),
-    admin: t('members.admin', { ns: 'common' }),
-    editor: t('members.editor', { ns: 'common' }),
-    dataset_operator: t('members.datasetOperator', { ns: 'common' }),
-    normal: t('members.normal', { ns: 'common' }),
-  }
   const locale = useLocale()
+  const language = getAccessControlTemplateLanguage(locale)
 
-  const { userProfile, currentWorkspace, isCurrentWorkspaceOwner, isCurrentWorkspaceManager } = useAppContext()
-  const { data, refetch } = useMembers()
+  const { userProfile, currentWorkspace, isCurrentWorkspaceOwner, workspacePermissionKeys } = useAppContext()
+  const { data, refetch } = useMembers(language)
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const { formatTimeFromNow } = useFormatTimeFromNow()
   const [inviteModalVisible, setInviteModalVisible] = useState(false)
   const [invitationResults, setInvitationResults] = useState<InvitationResult[]>([])
   const [invitedModalVisible, setInvitedModalVisible] = useState(false)
@@ -47,19 +42,48 @@ const MembersPage = () => {
   const isMemberFull = enableBilling && isNotUnlimitedMemberPlan && accounts.length >= plan.total.teamMembers
   const [editWorkspaceModalVisible, setEditWorkspaceModalVisible] = useState(false)
   const [showTransferOwnershipModal, setShowTransferOwnershipModal] = useState(false)
-  const canOperateMember = (account: Member) => {
-    if (isCurrentWorkspaceOwner)
-      return account.role !== 'owner'
+  const [detailsMember, setDetailsMember] = useState<Member | null>(null)
 
-    return currentWorkspace.role === 'admin' && account.role !== 'owner' && account.email !== userProfile.email
+  const canManageMembers = hasPermission(workspacePermissionKeys, 'workspace.member.manage')
+
+  const handleOpenDetails = useCallback((member: Member) => {
+    setDetailsMember(member)
+  }, [])
+
+  const handleCloseDetails = useCallback(() => {
+    setDetailsMember(null)
+  }, [])
+
+  const { mutateAsync: updateRolesOfMember } = useUpdateRolesOfMember()
+
+  const handleAssignRolesSubmit = (roles: Role[]) => {
+    const roleIds = systemFeatures.rbac_enabled
+      ? roles.map(role => role.id)
+      : roles.slice(0, 1).map(role => role.id)
+
+    updateRolesOfMember({
+      memberId: detailsMember!.id,
+      roleIds,
+    }, {
+      onSuccess: () => {
+        toast.success(t('actionMsg.modifiedSuccessfully', { ns: 'common' }))
+        refetch()
+      },
+    })
   }
 
+  const handleTransferOwnership = useCallback(() => {
+    setShowTransferOwnershipModal(true)
+  }, [])
+
   return (
     <>
       <div className="flex flex-col">
         <div className="mb-6 flex items-center gap-3 rounded-xl border-t-[0.5px] border-l-[0.5px] border-divider-subtle bg-linear-to-r from-background-gradient-bg-fill-chat-bg-2 to-background-gradient-bg-fill-chat-bg-1 py-2 pr-5 pl-2">
           <div className="flex h-12 w-12 items-center justify-center rounded-xl bg-components-icon-bg-blue-solid text-[20px]">
-            <span className="bg-linear-to-r from-components-avatar-shape-fill-stop-0 to-components-avatar-shape-fill-stop-100 bg-clip-text font-semibold text-shadow-shadow-1 uppercase opacity-90">{currentWorkspace?.name[0]?.toLocaleUpperCase()}</span>
+            <span className="bg-linear-to-r from-components-avatar-shape-fill-stop-0 to-components-avatar-shape-fill-stop-100 bg-clip-text font-semibold text-shadow-shadow-1 uppercase opacity-90">
+              {currentWorkspace?.name[0]?.toLocaleUpperCase()}
+            </span>
           </div>
           <div className="grow">
             <div className="flex items-center gap-1 system-md-semibold text-text-secondary">
@@ -120,48 +144,29 @@ const MembersPage = () => {
             <UpgradeBtn className="mr-2" loc="member-invite" />
           )}
           <div className="shrink-0">
-            {isCurrentWorkspaceManager && <InviteButton disabled={isMemberFull} onClick={() => setInviteModalVisible(true)} />}
+            {canManageMembers && <InviteButton disabled={isMemberFull} onClick={() => setInviteModalVisible(true)} />}
           </div>
         </div>
         <div className="overflow-visible lg:overflow-visible">
-          <div className="flex min-w-[480px] items-center border-b border-divider-regular py-[7px]">
-            <div className="grow px-3 system-xs-medium-uppercase text-text-tertiary">{t('members.name', { ns: 'common' })}</div>
-            <div className="w-[120px] shrink-0 px-2 system-xs-medium-uppercase text-text-tertiary">{t('members.lastActive', { ns: 'common' })}</div>
-            <div className="w-[96px] shrink-0 px-2 system-xs-medium-uppercase text-text-tertiary">{t('members.role', { ns: 'common' })}</div>
+          <div className="flex min-w-120 items-center border-b border-divider-regular py-1.75">
+            <div className="w-65 shrink-0 px-3 system-xs-medium-uppercase text-text-tertiary">{t('members.name', { ns: 'common' })}</div>
+            <div className="w-30 shrink-0 system-xs-medium-uppercase text-text-tertiary">{t('members.lastActive', { ns: 'common' })}</div>
+            <div className="min-w-0 grow px-3 system-xs-medium-uppercase text-text-tertiary">{t('members.role', { ns: 'common' })}</div>
           </div>
-          <div className="relative min-w-[480px]">
-            {
-              accounts.map(account => (
-                <div key={account.id} className="flex border-b border-divider-subtle">
-                  <div className="flex grow items-center px-3 py-2">
-                    <Avatar avatar={account.avatar_url} size="sm" className="mr-2" name={account.name} />
-                    <div className="">
-                      <div className="system-sm-medium text-text-secondary">
-                        {account.name}
-                        {account.status === 'pending' && <span className="ml-1 system-xs-medium text-text-warning">{t('members.pending', { ns: 'common' })}</span>}
-                        {userProfile.email === account.email && <span className="system-xs-regular text-text-tertiary">{t('members.you', { ns: 'common' })}</span>}
-                      </div>
-                      <div className="system-xs-regular text-text-tertiary">{account.email}</div>
-                    </div>
-                  </div>
-                  <div className="flex w-[120px] shrink-0 items-center px-2 py-2 system-sm-regular text-text-secondary">{formatTimeFromNow(Number((account.last_active_at || account.created_at)) * 1000)}</div>
-                  <div className="flex w-[96px] shrink-0 items-center">
-                    {isCurrentWorkspaceOwner && account.role === 'owner' && isAllowTransferWorkspace && (
-                      <TransferOwnership onOperate={() => setShowTransferOwnershipModal(true)}></TransferOwnership>
-                    )}
-                    {isCurrentWorkspaceOwner && account.role === 'owner' && !isAllowTransferWorkspace && (
-                      <div className="px-3 system-sm-regular text-text-secondary">{RoleMap[account.role] || RoleMap.normal}</div>
-                    )}
-                    {account.role !== 'owner' && canOperateMember(account) && (
-                      <Operation member={account} operatorRole={currentWorkspace.role} onOperate={refetch} />
-                    )}
-                    {account.role !== 'owner' && !canOperateMember(account) && (
-                      <div className="px-3 system-sm-regular text-text-secondary">{RoleMap[account.role] || RoleMap.normal}</div>
-                    )}
-                  </div>
-                </div>
-              ))
-            }
+          <div className="relative min-w-120">
+            {accounts.map(account => (
+              <MemberRow
+                key={account.id}
+                member={account}
+                roles={account.roles}
+                isCurrentUser={userProfile.email === account.email}
+                canManage={canManageMembers}
+                canTransferOwnership={isCurrentWorkspaceOwner && isAllowTransferWorkspace}
+                allowMultipleRoles={systemFeatures.rbac_enabled}
+                onOpenDetails={handleOpenDetails}
+                onTransferOwnership={handleTransferOwnership}
+              />
+            ))}
           </div>
         </div>
       </div>
@@ -199,6 +204,19 @@ const MembersPage = () => {
           onClose={() => setShowTransferOwnershipModal(false)}
         />
       )}
+      {detailsMember && (
+        <MemberDetailsModal
+          member={detailsMember}
+          canAssignRoles={
+            canManageMembers
+            && detailsMember.role !== 'owner'
+            && userProfile.email !== detailsMember.email
+          }
+          allowMultipleRoles={systemFeatures.rbac_enabled}
+          onClose={handleCloseDetails}
+          onAssignSubmit={handleAssignRolesSubmit}
+        />
+      )}
     </>
   )
 }
diff --git a/web/app/components/header/account-setting/members-page/invite-modal/__tests__/index.spec.tsx b/web/app/components/header/account-setting/members-page/invite-modal/__tests__/index.spec.tsx
index 9b262a3f31c..40f5c84a93e 100644
--- a/web/app/components/header/account-setting/members-page/invite-modal/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/members-page/invite-modal/__tests__/index.spec.tsx
@@ -1,10 +1,13 @@
 import type { InvitationResponse } from '@/models/common'
 import { toast } from '@langgenius/dify-ui/toast'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { vi } from 'vitest'
 import { useProviderContextSelector } from '@/context/provider-context'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
 import { inviteMember } from '@/service/common'
+import { commonQueryKeys } from '@/service/use-common'
 import InviteModal from '../index'
 
 const { mockToastError } = vi.hoisted(() => ({
@@ -18,6 +21,7 @@ vi.mock('@/context/provider-context', () => ({
   })),
 }))
 vi.mock('@/service/common')
+vi.mock('@/service/access-control/use-workspace-roles')
 vi.mock('@langgenius/dify-ui/toast', () => ({
   toast: {
     error: mockToastError,
@@ -47,21 +51,85 @@ describe('InviteModal', () => {
   const mockOnSend = vi.fn()
   const mockRefreshLicenseLimit = vi.fn()
 
+  const createQueryClient = () => new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+        staleTime: Infinity,
+      },
+      mutations: {
+        retry: false,
+      },
+    },
+  })
+
   beforeEach(() => {
     vi.clearAllMocks()
 
+    vi.mocked(useWorkspaceRoleList).mockReturnValue({
+      data: {
+        pages: [{
+          data: [
+            {
+              id: 'admin',
+              tenant_id: 'tenant-id',
+              type: 'workspace',
+              category: 'global_system_default',
+              name: 'Admin',
+              description: 'Can manage workspace settings',
+              is_builtin: true,
+              permission_keys: [],
+              role_tag: '',
+            },
+            {
+              id: 'normal',
+              tenant_id: 'tenant-id',
+              type: 'workspace',
+              category: 'global_system_default',
+              name: 'Normal',
+              description: 'Can use apps',
+              is_builtin: true,
+              permission_keys: [],
+              role_tag: '',
+            },
+          ],
+          pagination: {
+            total_count: 2,
+            per_page: 20,
+            current_page: 1,
+            total_pages: 1,
+          },
+        }],
+        pageParams: [1],
+      },
+      isLoading: false,
+      error: null,
+      hasNextPage: false,
+      isFetchingNextPage: false,
+      fetchNextPage: vi.fn(),
+    } as unknown as ReturnType<typeof useWorkspaceRoleList>)
+
     vi.mocked(useProviderContextSelector).mockImplementation(selector => selector({
       licenseLimit: { workspace_members: { size: 5, limit: 10 } },
       refreshLicenseLimit: mockRefreshLicenseLimit,
     } as unknown as Parameters<typeof selector>[0]))
   })
 
-  const renderModal = (isEmailSetup = true) => render(
-    <InviteModal isEmailSetup={isEmailSetup} onCancel={mockOnCancel} onSend={mockOnSend} />,
-  )
+  const renderModal = (isEmailSetup = true, queryClient = createQueryClient()) => ({
+    queryClient,
+    ...render(
+      <QueryClientProvider client={queryClient}>
+        <InviteModal isEmailSetup={isEmailSetup} onCancel={mockOnCancel} onSend={mockOnSend} />
+      </QueryClientProvider>,
+    ),
+  })
   const fillEmails = (value: string) => {
     fireEvent.change(screen.getByTestId('mock-email-input'), { target: { value } })
   }
+  const selectAdminRole = async (user: ReturnType<typeof userEvent.setup>) => {
+    await user.click(screen.getByRole('button', { name: /members\.selectRole/i }))
+    await user.click(screen.getByRole('menuitemradio', { name: /Admin/i }))
+  }
 
   it('should render invite modal content', async () => {
     renderModal()
@@ -76,10 +144,15 @@ describe('InviteModal', () => {
     expect(await screen.findByText(/members\.emailNotSetup$/i)).toBeInTheDocument()
   })
 
-  it('should enable send button after entering an email', async () => {
+  it('should enable send button after entering an email and selecting a role', async () => {
     renderModal()
     fillEmails('user@example.com')
 
+    expect(screen.getByRole('button', { name: /members\.sendInvite/i })).toBeDisabled()
+
+    const user = userEvent.setup()
+    await selectAdminRole(user)
+
     expect(screen.getByRole('button', { name: /members\.sendInvite/i })).toBeEnabled()
   })
 
@@ -90,6 +163,7 @@ describe('InviteModal', () => {
     renderModal()
 
     fillEmails('user@example.com')
+    await selectAdminRole(user)
     await user.click(screen.getByRole('button', { name: /members\.sendInvite/i }))
 
     await waitFor(() => {
@@ -109,6 +183,7 @@ describe('InviteModal', () => {
     renderModal()
 
     fillEmails('user@example.com')
+    await selectAdminRole(user)
     await user.click(screen.getByRole('button', { name: /members\.sendInvite/i }))
 
     await waitFor(() => {
@@ -119,6 +194,52 @@ describe('InviteModal', () => {
     })
   })
 
+  it('should submit the selected workspace role id', async () => {
+    const user = userEvent.setup()
+    vi.mocked(inviteMember).mockResolvedValue({
+      result: 'success',
+      invitation_results: [],
+    } as InvitationResponse)
+
+    renderModal()
+
+    fillEmails('user@example.com')
+    await selectAdminRole(user)
+    await user.click(screen.getByRole('button', { name: /members\.sendInvite/i }))
+
+    await waitFor(() => {
+      expect(inviteMember).toHaveBeenCalledWith({
+        url: '/workspaces/current/members/invite-email',
+        body: {
+          emails: ['user@example.com'],
+          role: 'admin',
+          language: 'en-US',
+        },
+      })
+    })
+  })
+
+  it('should invalidate members after successful submission', async () => {
+    const user = userEvent.setup()
+    const queryClient = createQueryClient()
+    const membersQueryKey = [...commonQueryKeys.members, 'en-US']
+    queryClient.setQueryData(membersQueryKey, { accounts: [] })
+    vi.mocked(inviteMember).mockResolvedValue({
+      result: 'success',
+      invitation_results: [],
+    } as InvitationResponse)
+
+    renderModal(true, queryClient)
+
+    fillEmails('user@example.com')
+    await selectAdminRole(user)
+    await user.click(screen.getByRole('button', { name: /members\.sendInvite/i }))
+
+    await waitFor(() => {
+      expect(queryClient.getQueryState(membersQueryKey)?.isInvalidated).toBe(true)
+    })
+  })
+
   it('should keep send button disabled when license limit is exceeded', async () => {
     vi.mocked(useProviderContextSelector).mockImplementation(selector => selector({
       licenseLimit: { workspace_members: { size: 10, limit: 10 } },
@@ -147,6 +268,7 @@ describe('InviteModal', () => {
 
     // Use an email that passes basic validation but fails our strict regex (needs 2+ char TLD)
     fillEmails('invalid@email.c')
+    await selectAdminRole(user)
     await user.click(screen.getByRole('button', { name: /members\.sendInvite/i }))
 
     expect(toast.error).toHaveBeenCalledWith('common.members.emailInvalid')
@@ -200,6 +322,7 @@ describe('InviteModal', () => {
     renderModal()
 
     fillEmails('user@example.com')
+    await selectAdminRole(user)
     await user.click(screen.getByRole('button', { name: /members\.sendInvite/i }))
 
     await waitFor(() => {
@@ -235,6 +358,7 @@ describe('InviteModal', () => {
     renderModal()
 
     fillEmails('user@example.com')
+    await selectAdminRole(user)
 
     const sendBtn = screen.getByRole('button', { name: /members\.sendInvite/i })
 
@@ -283,6 +407,7 @@ describe('InviteModal', () => {
     renderModal()
 
     fillEmails('user@example.com')
+    await selectAdminRole(user)
 
     const sendBtn = screen.getByRole('button', { name: /members\.sendInvite/i })
 
diff --git a/web/app/components/header/account-setting/members-page/invite-modal/__tests__/role-selector.spec.tsx b/web/app/components/header/account-setting/members-page/invite-modal/__tests__/role-selector.spec.tsx
index 1284a7abb19..2fd8e2a91d7 100644
--- a/web/app/components/header/account-setting/members-page/invite-modal/__tests__/role-selector.spec.tsx
+++ b/web/app/components/header/account-setting/members-page/invite-modal/__tests__/role-selector.spec.tsx
@@ -1,101 +1,192 @@
-import { render, screen, waitFor, within } from '@testing-library/react'
+import type { Role, RoleListResponse } from '@/models/access-control'
+import { act, render, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { useState } from 'react'
 import { vi } from 'vitest'
-import { createMockProviderContextValue } from '@/__mocks__/provider-context'
-import { useProviderContext } from '@/context/provider-context'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
 import RoleSelector from '../role-selector'
 
-vi.mock('@/context/provider-context')
+vi.mock('@/service/access-control/use-workspace-roles')
+
+const createRole = (overrides: Partial<Role>): Role => ({
+  id: overrides.id ?? overrides.name ?? 'role-id',
+  tenant_id: 'tenant-id',
+  type: 'workspace',
+  category: 'global_system_default',
+  name: overrides.name ?? 'Role',
+  description: overrides.description ?? '',
+  is_builtin: overrides.is_builtin ?? true,
+  permission_keys: [],
+  role_tag: '',
+  ...overrides,
+})
+
+const rolePages: RoleListResponse[] = [
+  {
+    data: [
+      createRole({ id: 'admin', name: 'Admin', description: 'Can manage workspace settings' }),
+      createRole({ id: 'editor', name: 'Editor', description: 'Can build and edit apps' }),
+      createRole({ id: 'normal', name: 'Normal', description: 'Can use apps' }),
+    ],
+    pagination: {
+      total_count: 3,
+      per_page: 20,
+      current_page: 1,
+      total_pages: 1,
+    },
+  },
+]
+
+const mockUseWorkspaceRoleList = ({
+  pages = rolePages,
+  isLoading = false,
+  hasNextPage = false,
+  isFetchingNextPage = false,
+  fetchNextPage = vi.fn(),
+}: {
+  pages?: RoleListResponse[]
+  isLoading?: boolean
+  hasNextPage?: boolean
+  isFetchingNextPage?: boolean
+  fetchNextPage?: () => void
+} = {}) => {
+  vi.mocked(useWorkspaceRoleList).mockReturnValue({
+    data: { pages, pageParams: [1] },
+    isLoading,
+    error: null,
+    hasNextPage,
+    isFetchingNextPage,
+    fetchNextPage,
+  } as unknown as ReturnType<typeof useWorkspaceRoleList>)
+}
 
 type WrapperProps = {
-  initialRole?: 'normal' | 'editor' | 'admin' | 'dataset_operator'
+  initialRole?: string
 }
 
 const RoleSelectorWrapper = ({ initialRole = 'normal' }: WrapperProps) => {
-  const [role, setRole] = useState<'normal' | 'editor' | 'admin' | 'dataset_operator'>(initialRole)
+  const [role, setRole] = useState(initialRole)
   return <RoleSelector value={role} onChange={setRole} />
 }
 
-const getTrigger = () => screen.getByRole('button', { name: /members\.invitedAsRole/i })
-const getRoleDialog = () => screen.getByRole('dialog')
-const getRoleOption = (role: string) => within(getRoleDialog()).getByRole('button', { name: new RegExp(`common\\.members\\.${role}`, 'i') })
+const getTrigger = () => screen.getByRole('button', { name: /members\.(invitedAsRole|selectRole)/i })
+const getRoleMenu = () => screen.getByRole('menu')
+const getRoleOption = (role: string) => within(getRoleMenu()).getByRole('menuitemradio', { name: new RegExp(role, 'i') })
 
 describe('RoleSelector', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    vi.mocked(useProviderContext).mockReturnValue(createMockProviderContextValue({
-      datasetOperatorEnabled: true,
-    }))
+    mockUseWorkspaceRoleList()
   })
 
-  it('should show current role in trigger text', () => {
+  it('should show current role name in trigger text', () => {
     render(<RoleSelectorWrapper initialRole="admin" />)
 
-    // members.invitedAsRole is the translation key
-    expect(screen.getByText(/members\.invitedAsRole/i)).toBeInTheDocument()
+    expect(screen.getByText(/members\.invitedAsRole:\{"role":"Admin"\}/i)).toBeInTheDocument()
+  })
+
+  it('should ask users to select a role when no role is selected', () => {
+    render(<RoleSelectorWrapper initialRole="" />)
+
+    expect(screen.getByText(/members\.selectRole/i)).toBeInTheDocument()
+    expect(screen.queryByText(/members\.invitedAsRole:\{"role":""\}/i)).not.toBeInTheDocument()
   })
 
   it('should toggle dropdown when trigger is clicked', async () => {
     const user = userEvent.setup()
     render(<RoleSelectorWrapper />)
 
-    const trigger = getTrigger()
+    await user.click(getTrigger())
+    expect(getRoleOption('Normal')).toBeInTheDocument()
 
-    // Open
-    await user.click(trigger)
-    expect(getRoleOption('normal')).toBeInTheDocument()
-
-    // Close
-    await user.click(trigger)
+    await user.click(getTrigger())
     await waitFor(() => {
-      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+      expect(screen.queryByRole('menu')).not.toBeInTheDocument()
     })
   })
 
-  it('should show checkmark for selected role', async () => {
+  it('should show checkmark state for selected role', async () => {
     const user = userEvent.setup()
     render(<RoleSelectorWrapper initialRole="editor" />)
 
     await user.click(getTrigger())
 
-    expect(getRoleOption('editor')).toHaveAttribute('aria-pressed', 'true')
+    expect(getRoleOption('Editor')).toHaveAttribute('aria-checked', 'true')
   })
 
-  it.each([
-    ['normal'],
-    ['editor'],
-    ['admin'],
-    ['datasetOperator'],
-  ])('should update selected role after user chooses %s', async (roleKey) => {
+  it('should update selected role name after user chooses a role', async () => {
     const user = userEvent.setup()
 
-    render(<RoleSelectorWrapper initialRole="normal" />)
+    render(<RoleSelectorWrapper initialRole="Normal" />)
 
     await user.click(getTrigger())
-    await user.click(getRoleOption(roleKey))
+    await user.click(getRoleOption('Admin'))
 
-    // Verify dropdown closed
     await waitFor(() => {
-      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+      expect(screen.queryByRole('menu')).not.toBeInTheDocument()
     })
 
-    // Verify trigger text updated (using translation key pattern from global mock)
-    expect(screen.getByText(/members\.invitedAsRole/i)).toBeInTheDocument()
+    expect(screen.getByText(/members\.invitedAsRole:\{"role":"Admin"\}/i)).toBeInTheDocument()
   })
 
-  it('should hide dataset operator option when feature is disabled', async () => {
+  it('should load more roles when scrolling reaches the list anchor', async () => {
     const user = userEvent.setup()
+    const fetchNextPage = vi.fn()
+    const callbacks: IntersectionObserverCallback[] = []
+    const originalIntersectionObserver = globalThis.IntersectionObserver
 
-    vi.mocked(useProviderContext).mockReturnValue(createMockProviderContextValue({
-      datasetOperatorEnabled: false,
-    }))
+    globalThis.IntersectionObserver = class {
+      readonly root: Element | Document | null = null
+      readonly rootMargin: string = ''
+      readonly scrollMargin: string = ''
+      readonly thresholds: ReadonlyArray<number> = []
+
+      constructor(callback: IntersectionObserverCallback) {
+        callbacks.push(callback)
+      }
+
+      observe() { /* noop */ }
+      unobserve() { /* noop */ }
+      disconnect() { /* noop */ }
+      takeRecords(): IntersectionObserverEntry[] { return [] }
+    }
+
+    mockUseWorkspaceRoleList({ hasNextPage: true, fetchNextPage })
 
     render(<RoleSelectorWrapper />)
 
     await user.click(getTrigger())
+    await waitFor(() => {
+      expect(callbacks).toHaveLength(1)
+    })
 
-    expect(within(getRoleDialog()).queryByRole('button', { name: /common\.members\.datasetOperator/i })).not.toBeInTheDocument()
-    expect(getRoleOption('normal')).toBeInTheDocument()
+    await act(async () => {
+      callbacks[0]!([{ isIntersecting: true } as IntersectionObserverEntry], {} as IntersectionObserver)
+    })
+
+    expect(fetchNextPage).toHaveBeenCalledTimes(1)
+
+    globalThis.IntersectionObserver = originalIntersectionObserver
+  })
+
+  it('should render an empty state when there are no roles', async () => {
+    const user = userEvent.setup()
+    mockUseWorkspaceRoleList({
+      pages: [{
+        data: [],
+        pagination: {
+          total_count: 0,
+          per_page: 20,
+          current_page: 1,
+          total_pages: 0,
+        },
+      }],
+    })
+
+    render(<RoleSelectorWrapper initialRole="" />)
+
+    await user.click(getTrigger())
+
+    expect(within(getRoleMenu()).getByText(/dynamicSelect\.noData/i)).toBeInTheDocument()
   })
 })
diff --git a/web/app/components/header/account-setting/members-page/invite-modal/index.tsx b/web/app/components/header/account-setting/members-page/invite-modal/index.tsx
index d80b93cdb33..d6fd5adf31a 100644
--- a/web/app/components/header/account-setting/members-page/invite-modal/index.tsx
+++ b/web/app/components/header/account-setting/members-page/invite-modal/index.tsx
@@ -1,10 +1,10 @@
 'use client'
-import type { RoleKey } from './role-selector'
 import type { InvitationResult } from '@/models/common'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Dialog, DialogCloseButton, DialogContent, DialogTitle } from '@langgenius/dify-ui/dialog'
 import { toast } from '@langgenius/dify-ui/toast'
+import { useQueryClient } from '@tanstack/react-query'
 import { useBoolean } from 'ahooks'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -13,6 +13,7 @@ import { emailRegex } from '@/config'
 import { useLocale } from '@/context/i18n'
 import { useProviderContextSelector } from '@/context/provider-context'
 import { inviteMember } from '@/service/common'
+import { commonQueryKeys } from '@/service/use-common'
 import RoleSelector from './role-selector'
 import 'react-multi-email/dist/style.css'
 
@@ -28,6 +29,7 @@ const InviteModal = ({
   onSend,
 }: IInviteModalProps) => {
   const { t } = useTranslation()
+  const queryClient = useQueryClient()
   const licenseLimit = useProviderContextSelector(s => s.licenseLimit)
   const refreshLicenseLimit = useProviderContextSelector(s => s.refreshLicenseLimit)
   const [emails, setEmails] = useState<string[]>([])
@@ -36,7 +38,7 @@ const InviteModal = ({
   const isLimitExceeded = isLimited && (usedSize > licenseLimit.workspace_members.limit)
 
   const locale = useLocale()
-  const [role, setRole] = useState<RoleKey>('normal')
+  const [role, setRole] = useState<string>('')
 
   const [isSubmitting, {
     setTrue: setIsSubmitting,
@@ -56,6 +58,7 @@ const InviteModal = ({
 
         if (result === 'success') {
           refreshLicenseLimit()
+          void queryClient.invalidateQueries({ queryKey: commonQueryKeys.members })
           onCancel()
           onSend(invitation_results)
         }
@@ -66,7 +69,7 @@ const InviteModal = ({
       toast.error(t('members.emailInvalid', { ns: 'common' }))
     }
     setIsSubmitted()
-  }, [isLimitExceeded, emails, role, locale, onCancel, onSend, t, isSubmitting, refreshLicenseLimit, setIsSubmitted, setIsSubmitting])
+  }, [isLimitExceeded, emails, role, locale, onCancel, onSend, t, isSubmitting, refreshLicenseLimit, queryClient, setIsSubmitted, setIsSubmitting])
 
   return (
     <Dialog
@@ -78,7 +81,7 @@ const InviteModal = ({
     >
       <DialogContent
         backdropProps={{ forceRender: true }}
-        className="w-[400px] px-8 py-6"
+        className="w-100 overflow-visible px-8 py-6"
       >
         <DialogCloseButton className="top-6 right-8" />
         <div className="mb-2 pr-8">
@@ -144,7 +147,7 @@ const InviteModal = ({
             tabIndex={0}
             className="w-full"
             onClick={handleSend}
-            disabled={!emails.length || isLimitExceeded || isSubmitting}
+            disabled={!emails.length || !role || isLimitExceeded || isSubmitting}
             variant="primary"
           >
             {t('members.sendInvite', { ns: 'common' })}
diff --git a/web/app/components/header/account-setting/members-page/invite-modal/role-selector.tsx b/web/app/components/header/account-setting/members-page/invite-modal/role-selector.tsx
index af821e3bdef..36cf845acb8 100644
--- a/web/app/components/header/account-setting/members-page/invite-modal/role-selector.tsx
+++ b/web/app/components/header/account-setting/members-page/invite-modal/role-selector.tsx
@@ -1,138 +1,164 @@
 import { cn } from '@langgenius/dify-ui/cn'
 import {
-  Popover,
-  PopoverContent,
-  PopoverTrigger,
-} from '@langgenius/dify-ui/popover'
-import * as React from 'react'
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useProviderContext } from '@/context/provider-context'
-
-const roleI18nKeyMap = {
-  normal: 'members.normal',
-  editor: 'members.editor',
-  admin: 'members.admin',
-  dataset_operator: 'members.datasetOperator',
-} as const
-
-export type RoleKey = keyof typeof roleI18nKeyMap
+import { useLocale } from '@/context/i18n'
+import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
 
 type RoleSelectorProps = {
-  value: RoleKey
-  onChange: (role: RoleKey) => void
+  value: string
+  onChange: (role: string) => void
 }
 
+const PAGE_SIZE = 20
+
 const RoleSelector = ({ value, onChange }: RoleSelectorProps) => {
   const { t } = useTranslation()
-  const { datasetOperatorEnabled } = useProviderContext()
-  const [open, setOpen] = React.useState(false)
+  const locale = useLocale()
+  const [open, setOpen] = useState(false)
+  const containerRef = useRef<HTMLDivElement>(null)
+  const anchorRef = useRef<HTMLDivElement>(null)
+  const [observerReadyKey, setObserverReadyKey] = useState(0)
+  const language = useMemo(() => getAccessControlTemplateLanguage(locale), [locale])
+
+  const {
+    data: rolesData,
+    isLoading: rolesLoading,
+    error,
+    hasNextPage,
+    isFetchingNextPage,
+    fetchNextPage,
+  } = useWorkspaceRoleList({
+    page: 1,
+    limit: PAGE_SIZE,
+    language,
+  })
+
+  useEffect(() => {
+    const hasMore = hasNextPage ?? true
+    let observer: IntersectionObserver | undefined
+
+    if (error || !open)
+      return
+
+    if (anchorRef.current && containerRef.current) {
+      const containerHeight = containerRef.current.clientHeight
+      const dynamicMargin = Math.max(100, Math.min(containerHeight * 0.2, 200))
+
+      observer = new IntersectionObserver((entries) => {
+        if (entries[0]!.isIntersecting && !rolesLoading && !isFetchingNextPage && !error && hasMore)
+          fetchNextPage()
+      }, {
+        root: containerRef.current,
+        rootMargin: `${dynamicMargin}px`,
+      })
+      observer.observe(anchorRef.current)
+    }
+
+    return () => observer?.disconnect()
+  }, [rolesLoading, isFetchingNextPage, fetchNextPage, error, hasNextPage, open, observerReadyKey])
+
+  const roles = useMemo(() => rolesData?.pages.flatMap(page => page.data) ?? [], [rolesData])
+  const selectedRole = roles.find(role => role.id === value)
+  const selectedRoleName = selectedRole?.name || value
+  const triggerLabel = selectedRoleName
+    ? t('members.invitedAsRole', { ns: 'common', role: selectedRoleName })
+    : t('members.selectRole', { ns: 'common' })
+
+  const setContainerElement = useCallback((node: HTMLDivElement | null) => {
+    containerRef.current = node
+    setObserverReadyKey(key => key + 1)
+  }, [])
+
+  const setAnchorElement = useCallback((node: HTMLDivElement | null) => {
+    anchorRef.current = node
+    setObserverReadyKey(key => key + 1)
+  }, [])
+
+  const handleRoleChange = (roleId: string) => {
+    onChange(roleId)
+    setOpen(false)
+  }
 
   return (
-    <Popover
+    <DropdownMenu
       open={open}
       onOpenChange={setOpen}
+      modal={false}
     >
-      <PopoverTrigger
+      <DropdownMenuTrigger
         data-testid="role-selector-trigger"
         className={cn(
           'flex w-full cursor-pointer items-center rounded-lg bg-components-input-bg-normal px-3 py-2 hover:bg-state-base-hover',
           open && 'bg-state-base-hover',
         )}
       >
-        <div className="mr-2 grow text-sm/5 text-text-primary">{t('members.invitedAsRole', { ns: 'common', role: t(roleI18nKeyMap[value], { ns: 'common' }) })}</div>
-        <div className="i-ri-arrow-down-s-line size-4 shrink-0 text-text-secondary" />
-      </PopoverTrigger>
-      <PopoverContent
+        <div className="mr-2 grow text-sm/5 text-text-primary">{triggerLabel}</div>
+        <div className={cn('size-4 shrink-0 text-text-secondary', open ? 'i-ri-arrow-up-s-line' : 'i-ri-arrow-down-s-line')} />
+      </DropdownMenuTrigger>
+      <DropdownMenuContent
         placement="bottom-start"
         sideOffset={4}
-        popupClassName="w-[336px] rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-lg"
+        popupClassName="w-[336px] rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-bg p-0 shadow-lg"
       >
-        <div className="p-1">
-          <button
-            type="button"
-            aria-pressed={value === 'normal'}
-            className="w-full cursor-pointer rounded-lg border-none bg-transparent p-2 text-left hover:bg-state-base-hover"
-            onClick={() => {
-              onChange('normal')
-              setOpen(false)
-            }}
-          >
-            <div className="relative pl-5">
-              <div className="text-sm/5 text-text-secondary">{t('members.normal', { ns: 'common' })}</div>
-              <div className="text-xs leading-[18px] text-text-tertiary">{t('members.normalTip', { ns: 'common' })}</div>
-              {value === 'normal' && (
-                <div
-                  aria-hidden="true"
-                  className="absolute top-0.5 left-0 i-custom-vender-line-general-check size-4 text-text-accent"
-                />
-              )}
-            </div>
-          </button>
-          <button
-            type="button"
-            aria-pressed={value === 'editor'}
-            className="w-full cursor-pointer rounded-lg border-none bg-transparent p-2 text-left hover:bg-state-base-hover"
-            onClick={() => {
-              onChange('editor')
-              setOpen(false)
-            }}
-          >
-            <div className="relative pl-5">
-              <div className="text-sm/5 text-text-secondary">{t('members.editor', { ns: 'common' })}</div>
-              <div className="text-xs leading-[18px] text-text-tertiary">{t('members.editorTip', { ns: 'common' })}</div>
-              {value === 'editor' && (
-                <div
-                  aria-hidden="true"
-                  className="absolute top-0.5 left-0 i-custom-vender-line-general-check size-4 text-text-accent"
-                />
-              )}
-            </div>
-          </button>
-          <button
-            type="button"
-            aria-pressed={value === 'admin'}
-            className="w-full cursor-pointer rounded-lg border-none bg-transparent p-2 text-left hover:bg-state-base-hover"
-            onClick={() => {
-              onChange('admin')
-              setOpen(false)
-            }}
-          >
-            <div className="relative pl-5">
-              <div className="text-sm/5 text-text-secondary">{t('members.admin', { ns: 'common' })}</div>
-              <div className="text-xs leading-[18px] text-text-tertiary">{t('members.adminTip', { ns: 'common' })}</div>
-              {value === 'admin' && (
-                <div
-                  aria-hidden="true"
-                  className="absolute top-0.5 left-0 i-custom-vender-line-general-check size-4 text-text-accent"
-                />
-              )}
-            </div>
-          </button>
-          {datasetOperatorEnabled && (
-            <button
-              type="button"
-              aria-pressed={value === 'dataset_operator'}
-              className="w-full cursor-pointer rounded-lg border-none bg-transparent p-2 text-left hover:bg-state-base-hover"
-              onClick={() => {
-                onChange('dataset_operator')
-                setOpen(false)
-              }}
-            >
-              <div className="relative pl-5">
-                <div className="text-sm/5 text-text-secondary">{t('members.datasetOperator', { ns: 'common' })}</div>
-                <div className="text-xs leading-[18px] text-text-tertiary">{t('members.datasetOperatorTip', { ns: 'common' })}</div>
-                {value === 'dataset_operator' && (
-                  <div
-                    aria-hidden="true"
-                    className="absolute top-0.5 left-0 i-custom-vender-line-general-check size-4 text-text-accent"
-                  />
-                )}
-              </div>
-            </button>
-          )}
-        </div>
-      </PopoverContent>
-    </Popover>
+        <ScrollArea
+          ref={setContainerElement}
+          className="h-70"
+          slotClassNames={{ viewport: 'overscroll-contain' }}
+        >
+          <div className="p-1">
+            {rolesLoading
+              ? (
+                  <div className="px-3 py-6 text-center system-sm-regular text-text-tertiary">
+                    {t('loading', { ns: 'common' })}
+                  </div>
+                )
+              : roles.length === 0
+                ? (
+                    <div className="px-3 py-6 text-center system-sm-regular text-text-tertiary">
+                      {t('dynamicSelect.noData', { ns: 'common' })}
+                    </div>
+                  )
+                : (
+                    <>
+                      <DropdownMenuRadioGroup
+                        value={value}
+                        onValueChange={handleRoleChange}
+                      >
+                        {roles.map(role => (
+                          <DropdownMenuRadioItem
+                            key={role.id}
+                            value={role.id}
+                            className="mx-0 h-auto w-full cursor-pointer items-start gap-0 rounded-lg border-none bg-transparent p-2 text-left hover:bg-state-base-hover data-highlighted:bg-state-base-hover"
+                          >
+                            <div className="relative min-w-0 pl-5">
+                              <div className="truncate text-sm leading-5 text-text-secondary">{role.name}</div>
+                              <div className="line-clamp-2 text-xs leading-4.5 text-text-tertiary">{role.description || t('role.noDescription', { ns: 'permission' })}</div>
+                              {value === role.id && (
+                                <div
+                                  aria-hidden="true"
+                                  className="absolute top-0.5 left-0 i-custom-vender-line-general-check h-4 w-4 text-text-accent"
+                                />
+                              )}
+                            </div>
+                          </DropdownMenuRadioItem>
+                        ))}
+                      </DropdownMenuRadioGroup>
+                      <div ref={setAnchorElement} className="h-0" />
+                    </>
+                  )}
+          </div>
+        </ScrollArea>
+      </DropdownMenuContent>
+    </DropdownMenu>
   )
 }
 
diff --git a/web/app/components/header/account-setting/members-page/invited-modal/__tests__/index.spec.tsx b/web/app/components/header/account-setting/members-page/invited-modal/__tests__/index.spec.tsx
index 32d0bdda50f..27ba8e4b41f 100644
--- a/web/app/components/header/account-setting/members-page/invited-modal/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/members-page/invited-modal/__tests__/index.spec.tsx
@@ -14,6 +14,7 @@ describe('InvitedModal', () => {
   const mockOnCancel = vi.fn()
   const results: InvitationResult[] = [
     { email: 'success@example.com', status: 'success', url: 'http://invite.com/1' },
+    { email: 'member@example.com', status: 'already_member', message: 'Account already in workspace.' },
     { email: 'failed@example.com', status: 'failed', message: 'Error msg' },
   ]
 
@@ -28,6 +29,8 @@ describe('InvitedModal', () => {
     expect(await screen.findByText(/members\.invitationSent$/i)).toBeInTheDocument()
     expect(await screen.findByText(/members\.invitationLink/i)).toBeInTheDocument()
     expect(screen.getByText('http://invite.com/1')).toBeInTheDocument()
+    expect(screen.getByText(/members\.alreadyInTeam$/i)).toBeInTheDocument()
+    expect(screen.getByText('member@example.com')).toBeInTheDocument()
     expect(screen.getByText('failed@example.com')).toBeInTheDocument()
   })
 
@@ -53,6 +56,19 @@ describe('InvitedModal', () => {
     expect(screen.queryByText(/members\.failedInvitationEmails/i)).not.toBeInTheDocument()
   })
 
+  it('should show already-member message without invitation copy when every email is already a member', () => {
+    const alreadyMembers: InvitationResult[] = [
+      { email: 'member@example.com', status: 'already_member' },
+    ]
+
+    render(<InvitedModal invitationResults={alreadyMembers} onCancel={mockOnCancel} />)
+
+    expect(screen.getByText(/members\.noNewInvitationsSent/i)).toBeInTheDocument()
+    expect(screen.getByText(/members\.alreadyInTeamTip/i)).toBeInTheDocument()
+    expect(screen.getByText('member@example.com')).toBeInTheDocument()
+    expect(screen.queryByText(/members\.invitationLink/i)).not.toBeInTheDocument()
+  })
+
   it('should hide both sections when results are empty', () => {
     render(<InvitedModal invitationResults={[]} onCancel={mockOnCancel} />)
 
@@ -85,4 +101,16 @@ describe('InvitedModal (non-CE edition)', () => {
     // CE-only content should not be shown
     expect(screen.queryByText(/members\.invitationLink/i)).not.toBeInTheDocument()
   })
+
+  it('should show already-member details when IS_CE_EDITION is false', () => {
+    const results: InvitationResult[] = [
+      { email: 'member@example.com', status: 'already_member' },
+    ]
+
+    render(<InvitedModal invitationResults={results} onCancel={mockOnCancel} />)
+
+    expect(screen.getByText(/members\.noNewInvitationsSent/i)).toBeInTheDocument()
+    expect(screen.getByText(/members\.alreadyInTeam$/i)).toBeInTheDocument()
+    expect(screen.getByText('member@example.com')).toBeInTheDocument()
+  })
 })
diff --git a/web/app/components/header/account-setting/members-page/invited-modal/index.tsx b/web/app/components/header/account-setting/members-page/invited-modal/index.tsx
index 8ac60da1f4f..d03d420a667 100644
--- a/web/app/components/header/account-setting/members-page/invited-modal/index.tsx
+++ b/web/app/components/header/account-setting/members-page/invited-modal/index.tsx
@@ -2,12 +2,12 @@ import type { InvitationResult } from '@/models/common'
 import { Button } from '@langgenius/dify-ui/button'
 import { Dialog, DialogCloseButton, DialogContent, DialogTitle } from '@langgenius/dify-ui/dialog'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
-import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { IS_CE_EDITION } from '@/config'
 import InvitationLink from './invitation-link'
 
 export type SuccessInvitationResult = Extract<InvitationResult, { status: 'success' }>
+type AlreadyMemberInvitationResult = Extract<InvitationResult, { status: 'already_member' }>
 type FailedInvitationResult = Extract<InvitationResult, { status: 'failed' }>
 
 type IInvitedModalProps = {
@@ -20,8 +20,17 @@ const InvitedModal = ({
 }: IInvitedModalProps) => {
   const { t } = useTranslation()
 
-  const successInvitationResults = useMemo<SuccessInvitationResult[]>(() => invitationResults?.filter(item => item.status === 'success') as SuccessInvitationResult[], [invitationResults])
-  const failedInvitationResults = useMemo<FailedInvitationResult[]>(() => invitationResults?.filter(item => item.status !== 'success') as FailedInvitationResult[], [invitationResults])
+  const successInvitationResults = invitationResults.filter(
+    (item): item is SuccessInvitationResult => item.status === 'success',
+  )
+  const alreadyMemberInvitationResults = invitationResults.filter(
+    (item): item is AlreadyMemberInvitationResult => item.status === 'already_member',
+  )
+  const failedInvitationResults = invitationResults.filter(
+    (item): item is FailedInvitationResult => item.status === 'failed',
+  )
+  const onlyAlreadyMembers = alreadyMemberInvitationResults.length > 0 && successInvitationResults.length === 0 && failedInvitationResults.length === 0
+  const description = t(onlyAlreadyMembers ? 'members.alreadyInTeamTip' : 'members.invitationSentTip', { ns: 'common' })
 
   return (
     <Dialog
@@ -46,16 +55,20 @@ const InvitedModal = ({
             <div className="i-heroicons-check-circle-solid h-[22px] w-[22px] text-[#039855]" />
           </div>
         </div>
-        <DialogTitle className="mb-1 text-xl font-semibold text-text-primary">{t('members.invitationSent', { ns: 'common' })}</DialogTitle>
+        <DialogTitle className="mb-1 text-xl font-semibold text-text-primary">
+          {t(onlyAlreadyMembers ? 'members.noNewInvitationsSent' : 'members.invitationSent', { ns: 'common' })}
+        </DialogTitle>
         {!IS_CE_EDITION && (
-          <div className="mb-10 text-sm text-text-tertiary">{t('members.invitationSentTip', { ns: 'common' })}</div>
+          <div className="mb-5 text-sm text-text-tertiary">{description}</div>
         )}
-        {IS_CE_EDITION && (
+        {(IS_CE_EDITION || !!alreadyMemberInvitationResults.length) && (
           <>
-            <div className="mb-5 text-sm text-text-tertiary">{t('members.invitationSentTip', { ns: 'common' })}</div>
+            {IS_CE_EDITION && (
+              <div className="mb-5 text-sm text-text-tertiary">{description}</div>
+            )}
             <div className="mb-9 flex flex-col gap-2">
               {
-                !!successInvitationResults.length
+                IS_CE_EDITION && !!successInvitationResults.length
                 && (
                   <>
                     <div className="py-2 text-sm font-medium text-text-primary">{t('members.invitationLink', { ns: 'common' })}</div>
@@ -65,7 +78,30 @@ const InvitedModal = ({
                 )
               }
               {
-                !!failedInvitationResults.length
+                !!alreadyMemberInvitationResults.length
+                && (
+                  <>
+                    <div className="py-2 text-sm font-medium text-text-primary">{t('members.alreadyInTeam', { ns: 'common' })}</div>
+                    {!onlyAlreadyMembers && (
+                      <div className="text-sm text-text-tertiary">{t('members.alreadyInTeamTip', { ns: 'common' })}</div>
+                    )}
+                    <div className="flex flex-wrap justify-between gap-y-1">
+                      {
+                        alreadyMemberInvitationResults.map(item => (
+                          <div
+                            key={item.email}
+                            className="flex justify-center rounded-md border border-components-panel-border bg-background-section-burn px-1 text-sm text-text-secondary"
+                          >
+                            {item.email}
+                          </div>
+                        ))
+                      }
+                    </div>
+                  </>
+                )
+              }
+              {
+                IS_CE_EDITION && !!failedInvitationResults.length
                 && (
                   <>
                     <div className="py-2 text-sm font-medium text-text-primary">{t('members.failedInvitationEmails', { ns: 'common' })}</div>
diff --git a/web/app/components/header/account-setting/members-page/member-details-modal/__tests__/index.spec.tsx b/web/app/components/header/account-setting/members-page/member-details-modal/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..1508a5b6eb7
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/member-details-modal/__tests__/index.spec.tsx
@@ -0,0 +1,203 @@
+import type { Role } from '@/models/access-control'
+import type { Member } from '@/models/common'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { vi } from 'vitest'
+import { useRolesOfMember } from '@/service/access-control/use-member-roles'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
+import MemberDetailsModal from '../index'
+
+vi.mock('@/service/access-control/use-member-roles')
+vi.mock('@/service/access-control/use-workspace-roles')
+
+const createRole = (overrides: Partial<Role>): Role => ({
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_custom',
+  name: 'Custom role',
+  description: '',
+  is_builtin: false,
+  permission_keys: [],
+  role_tag: '',
+  ...overrides,
+})
+
+const member: Member = {
+  id: 'member-1',
+  name: 'Admin User',
+  email: 'admin@example.com',
+  avatar: '',
+  avatar_url: '',
+  role: 'admin',
+  roles: [
+    createRole({ id: 'role-1', name: 'Custom role' }),
+  ],
+  last_active_at: '1731000000',
+  last_login_at: '1731000000',
+  created_at: '1731000000',
+  status: 'active',
+}
+
+describe('MemberDetailsModal', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(useRolesOfMember).mockReturnValue({
+      data: {
+        account_id: member.id,
+        roles: [
+          createRole({ id: 'role-1', name: 'Custom role' }),
+        ],
+      },
+      isLoading: false,
+    } as unknown as ReturnType<typeof useRolesOfMember>)
+    vi.mocked(useWorkspaceRoleList).mockReturnValue({
+      data: {
+        pages: [{
+          data: [
+            createRole({ id: 'role-1', name: 'Custom role' }),
+            createRole({ id: 'role-2', name: 'Second role' }),
+          ],
+          pagination: {
+            total_count: 2,
+            per_page: 20,
+            current_page: 1,
+            total_pages: 1,
+          },
+        }],
+        pageParams: [1],
+      },
+      isLoading: false,
+      error: null,
+      hasNextPage: false,
+      isFetchingNextPage: false,
+      fetchNextPage: vi.fn(),
+    } as unknown as ReturnType<typeof useWorkspaceRoleList>)
+  })
+
+  describe('Rendering', () => {
+    it('should render role loading state without assigned role chips or count', () => {
+      vi.mocked(useRolesOfMember).mockReturnValue({
+        data: undefined,
+        isLoading: true,
+      } as unknown as ReturnType<typeof useRolesOfMember>)
+
+      render(
+        <MemberDetailsModal
+          member={member}
+          canAssignRoles
+          onClose={vi.fn()}
+          onAssignSubmit={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByRole('status', { name: 'appApi.loading' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: /members\.memberDetails\.assign/i })).toBeInTheDocument()
+      expect(screen.queryByText('Custom role')).not.toBeInTheDocument()
+      expect(screen.queryByText('1')).not.toBeInTheDocument()
+    })
+  })
+
+  describe('Role actions', () => {
+    it('should not show role removal controls when role assignment is not allowed', () => {
+      render(
+        <MemberDetailsModal
+          member={member}
+          canAssignRoles={false}
+          onClose={vi.fn()}
+          onAssignSubmit={vi.fn()}
+        />,
+      )
+
+      expect(screen.queryByRole('button', { name: /members\.memberDetails\.assign/i })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: /members\.memberDetails\.removeRoleAria/i })).not.toBeInTheDocument()
+    })
+
+    it('should submit pending role changes only after save is clicked', async () => {
+      const user = userEvent.setup()
+      const handleAssignSubmit = vi.fn()
+
+      vi.mocked(useRolesOfMember).mockReturnValue({
+        data: {
+          account_id: member.id,
+          roles: [
+            createRole({ id: 'role-1', name: 'Custom role' }),
+            createRole({ id: 'role-2', name: 'Second role' }),
+          ],
+        },
+      } as unknown as ReturnType<typeof useRolesOfMember>)
+
+      render(
+        <MemberDetailsModal
+          member={member}
+          canAssignRoles
+          onClose={vi.fn()}
+          onAssignSubmit={handleAssignSubmit}
+        />,
+      )
+
+      await user.click(screen.getByRole('button', { name: /Custom role/i }))
+
+      await user.click(screen.getByRole('menuitem', { name: /common\.operation\.remove/i }))
+
+      expect(handleAssignSubmit).not.toHaveBeenCalled()
+
+      await user.click(screen.getByRole('button', { name: /common\.operation\.save/i }))
+
+      expect(handleAssignSubmit).toHaveBeenCalledWith([
+        expect.objectContaining({ id: 'role-2', name: 'Second role' }),
+      ])
+    })
+
+    it('should keep assigned role selections pending until save is clicked', async () => {
+      const user = userEvent.setup()
+      const handleAssignSubmit = vi.fn()
+
+      render(
+        <MemberDetailsModal
+          member={member}
+          canAssignRoles
+          onClose={vi.fn()}
+          onAssignSubmit={handleAssignSubmit}
+        />,
+      )
+
+      await user.click(screen.getByRole('button', { name: /members\.memberDetails\.assign/i }))
+      await user.click(screen.getByRole('checkbox', { name: /Second role/i }))
+      await user.click(screen.getByRole('button', { name: /common\.operation\.confirm/i }))
+
+      expect(handleAssignSubmit).not.toHaveBeenCalled()
+
+      await user.click(screen.getByRole('button', { name: /common\.operation\.save/i }))
+
+      expect(handleAssignSubmit).toHaveBeenCalledWith([
+        expect.objectContaining({ id: 'role-1', name: 'Custom role' }),
+        expect.objectContaining({ id: 'role-2', name: 'Second role' }),
+      ])
+    })
+
+    it('should replace the selected role when multiple roles are not allowed', async () => {
+      const user = userEvent.setup()
+      const handleAssignSubmit = vi.fn()
+
+      render(
+        <MemberDetailsModal
+          member={member}
+          canAssignRoles
+          allowMultipleRoles={false}
+          onClose={vi.fn()}
+          onAssignSubmit={handleAssignSubmit}
+        />,
+      )
+
+      await user.click(screen.getByRole('button', { name: /members\.memberDetails\.assign/i }))
+      await user.click(screen.getByRole('radio', { name: /Second role/i }))
+      await user.click(screen.getByRole('button', { name: /common\.operation\.confirm/i }))
+      await user.click(screen.getByRole('button', { name: /common\.operation\.save/i }))
+
+      expect(handleAssignSubmit).toHaveBeenCalledWith([
+        expect.objectContaining({ id: 'role-2', name: 'Second role' }),
+      ])
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/members-page/member-details-modal/index.tsx b/web/app/components/header/account-setting/members-page/member-details-modal/index.tsx
new file mode 100644
index 00000000000..269a4c03ddd
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/member-details-modal/index.tsx
@@ -0,0 +1,225 @@
+'use client'
+
+import type { Role } from '@/models/access-control'
+import type { Member } from '@/models/common'
+import { Avatar } from '@langgenius/dify-ui/avatar'
+import { Button } from '@langgenius/dify-ui/button'
+import {
+  Dialog,
+  DialogCloseButton,
+  DialogContent,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { memo, useCallback, useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import { useLocale } from '@/context/i18n'
+import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
+import { useRolesOfMember } from '@/service/access-control/use-member-roles'
+import AssignRolesModal from '../assign-roles-modal'
+import PermissionRoleChip from './permission-role-chip'
+
+type MemberDetailsModalProps = {
+  member: Member
+  canAssignRoles?: boolean
+  allowMultipleRoles?: boolean
+  onClose: () => void
+  onAssignSubmit?: (roles: Role[]) => void
+}
+
+const MemberDetailsModal = ({
+  member,
+  canAssignRoles = false,
+  allowMultipleRoles = true,
+  onClose,
+  onAssignSubmit,
+}: MemberDetailsModalProps) => {
+  const { t } = useTranslation()
+  const locale = useLocale()
+  const [assignOpen, setAssignOpen] = useState(false)
+  const language = useMemo(() => getAccessControlTemplateLanguage(locale), [locale])
+
+  const { data: rolesOfMember, isLoading: isLoadingRolesOfMember } = useRolesOfMember(member.id, language)
+  const [pendingRoles, setPendingRoles] = useState<Role[]>()
+
+  const roles = useMemo(() => rolesOfMember?.roles ?? [], [rolesOfMember?.roles])
+  const selectedRoles = pendingRoles ?? roles
+  const selectedRoleIds = useMemo(() => selectedRoles.map(role => role.id), [selectedRoles])
+
+  const builtinRoles = useMemo(() => selectedRoles.filter(role => role.is_builtin), [selectedRoles])
+  const customRoles = useMemo(() => selectedRoles.filter(role => !role.is_builtin), [selectedRoles])
+
+  const handleClose = useCallback(() => {
+    setAssignOpen(false)
+  }, [])
+
+  const handleAssignSubmit = useCallback((roles: Role[]) => {
+    setPendingRoles(allowMultipleRoles ? roles : roles.slice(0, 1))
+    setAssignOpen(false)
+  }, [allowMultipleRoles])
+
+  const handleRemove = useCallback((roleId: string) => {
+    if (!allowMultipleRoles && selectedRoles.length <= 1)
+      return
+
+    setPendingRoles(selectedRoles.filter(selectedRole => selectedRole.id !== roleId))
+  }, [allowMultipleRoles, selectedRoles])
+
+  const handleSave = useCallback(() => {
+    onAssignSubmit?.(allowMultipleRoles ? selectedRoles : selectedRoles.slice(0, 1))
+    onClose()
+  }, [allowMultipleRoles, onAssignSubmit, onClose, selectedRoles])
+
+  return (
+    <>
+      <Dialog
+        open
+        onOpenChange={(next) => {
+          if (!next)
+            onClose()
+        }}
+      >
+        <DialogContent className="w-110 overflow-visible p-0" backdropProps={{ forceRender: true }}>
+          <div className="relative px-6 pt-6 pb-5">
+            <DialogCloseButton />
+            <DialogTitle className="pr-8 system-xl-semibold text-text-primary">
+              {t('members.memberDetails.title', {
+                ns: 'common',
+                defaultValue: 'Member Details',
+              })}
+            </DialogTitle>
+
+            <div className="mt-5 flex items-center gap-3">
+              <Avatar
+                avatar={member.avatar_url}
+                name={member.name}
+                size="2xl"
+              />
+              <div className="min-w-0 flex-1">
+                <div className="truncate system-md-semibold text-text-primary">
+                  {member.name}
+                </div>
+                <div className="truncate system-xs-regular text-text-tertiary">
+                  {member.email}
+                </div>
+              </div>
+            </div>
+          </div>
+
+          <div className="border-t border-divider-subtle px-6 py-4">
+            <div className="flex items-center justify-between">
+              <div className="flex items-center gap-1.5 system-sm-semibold text-text-secondary">
+                <span>
+                  {t('members.memberDetails.assignedRoles', {
+                    ns: 'common',
+                    defaultValue: 'Assigned Roles',
+                  })}
+                </span>
+                {!isLoadingRolesOfMember && (
+                  <span className="system-xs-medium text-text-tertiary">
+                    {selectedRoleIds.length}
+                  </span>
+                )}
+              </div>
+              {canAssignRoles && (
+                <Button
+                  variant="ghost"
+                  size="small"
+                  onClick={() => setAssignOpen(true)}
+                >
+                  <span
+                    aria-hidden
+                    className="mr-0.5 i-ri-add-line h-3.5 w-3.5"
+                  />
+                  {t('members.memberDetails.assign', {
+                    ns: 'common',
+                    defaultValue: 'Assign',
+                  })}
+                </Button>
+              )}
+            </div>
+
+            {isLoadingRolesOfMember
+              ? (
+                  <div className="mt-4">
+                    <Loading />
+                  </div>
+                )
+              : (
+                  <>
+                    {builtinRoles.length > 0 && (
+                      <div className="mt-4">
+                        <div className="mb-2 system-2xs-medium-uppercase text-text-tertiary">
+                          {t('members.memberDetails.generalGroup', {
+                            ns: 'common',
+                          })}
+                        </div>
+                        <div className="flex flex-wrap gap-1.5">
+                          {builtinRoles.map(role => (
+                            <PermissionRoleChip
+                              key={role.id}
+                              roleId={role.id}
+                              label={role.name}
+                              isOwner={role.role_tag === 'owner'}
+                              permissionKeys={role.permission_keys}
+                              onRemove={canAssignRoles ? handleRemove : undefined}
+                            />
+                          ))}
+                        </div>
+                      </div>
+                    )}
+                    {customRoles.length > 0 && (
+                      <div className="mt-4">
+                        <div className="mb-2 system-2xs-medium-uppercase text-text-tertiary">
+                          {t('members.memberDetails.customGroup', {
+                            ns: 'common',
+                          })}
+                        </div>
+                        <div className="flex flex-wrap gap-1.5">
+                          {customRoles.map(role => (
+                            <PermissionRoleChip
+                              key={role.id}
+                              roleId={role.id}
+                              label={role.name}
+                              isOwner={role.role_tag === 'owner'}
+                              permissionKeys={role.permission_keys}
+                              onRemove={canAssignRoles ? handleRemove : undefined}
+                            />
+                          ))}
+                        </div>
+                      </div>
+                    )}
+                  </>
+                )}
+          </div>
+
+          {canAssignRoles && (
+            <div className="flex items-center justify-end gap-2 px-6 pt-2 pb-4">
+              <Button variant="secondary" onClick={onClose}>
+                {t('operation.cancel', { ns: 'common' })}
+              </Button>
+              <Button
+                variant="primary"
+                onClick={handleSave}
+                disabled={!onAssignSubmit}
+              >
+                {t('operation.save', { ns: 'common' })}
+              </Button>
+            </div>
+          )}
+        </DialogContent>
+      </Dialog>
+
+      {assignOpen && (
+        <AssignRolesModal
+          selectedRoles={selectedRoles}
+          allowMultipleRoles={allowMultipleRoles}
+          onClose={handleClose}
+          onSubmit={handleAssignSubmit}
+        />
+      )}
+    </>
+  )
+}
+
+export default memo(MemberDetailsModal)
diff --git a/web/app/components/header/account-setting/members-page/member-details-modal/permission-role-chip.tsx b/web/app/components/header/account-setting/members-page/member-details-modal/permission-role-chip.tsx
new file mode 100644
index 00000000000..e9456c18f66
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/member-details-modal/permission-role-chip.tsx
@@ -0,0 +1,162 @@
+'use client'
+
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import {
+  PreviewCard,
+  PreviewCardContent,
+  PreviewCardTrigger,
+} from '@langgenius/dify-ui/preview-card'
+import { memo, useState } from 'react'
+import { Trans, useTranslation } from 'react-i18next'
+
+type PermissionRoleChipProps = {
+  roleId: string
+  label: string
+  isOwner: boolean
+  permissionKeys: string[]
+  onRemove?: (roleId: string) => void
+  className?: string
+}
+
+const PermissionRoleChip = ({
+  roleId,
+  label,
+  isOwner,
+  permissionKeys,
+  onRemove,
+  className,
+}: PermissionRoleChipProps) => {
+  const { t } = useTranslation()
+  const [open, setOpen] = useState(false)
+  const permissions = permissionKeys
+  const canOpenMenu = !isOwner && !!onRemove
+  const permissionLabels = permissions
+    .map(key => t(key, {
+      ns: 'permissionKeys',
+      defaultValue: key,
+    }))
+    .join(', ')
+  const hasPermissionLabels = permissionLabels.length > 0
+
+  const chipClassName = cn(
+    'inline-flex h-6 max-w-full items-center rounded-full border-[0.5px] border-components-panel-border-subtle bg-background-body p-1 system-xs-regular text-text-primary shadow-xs transition-colors outline-none',
+    canOpenMenu && 'cursor-pointer hover:bg-background-section-burn focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden',
+    open && 'bg-background-section-burn',
+    className,
+  )
+
+  const chipContent = (
+    <span className="min-w-0 truncate px-1 leading-4">{label}</span>
+  )
+
+  const chip = canOpenMenu
+    ? (
+        <button
+          type="button"
+          className={chipClassName}
+          aria-label={t('members.memberDetails.roleActionsAria', {
+            ns: 'common',
+            role: label,
+            defaultValue: 'Open actions for {{role}} role',
+          })}
+          data-testid="permission-role-chip"
+          data-role-id={roleId}
+        >
+          {chipContent}
+        </button>
+      )
+    : (
+        <span
+          className={chipClassName}
+          data-testid="permission-role-chip"
+          data-role-id={roleId}
+        >
+          {chipContent}
+        </span>
+      )
+
+  const permissionSummary = (
+    <div className="flex w-58 flex-col gap-1 px-4 py-3.5">
+      <div className="title-xs-semi-bold leading-4 whitespace-nowrap text-text-primary">
+        {label}
+      </div>
+      <div className="body-xs-regular text-text-secondary">
+        {hasPermissionLabels
+          ? (
+              <Trans
+                i18nKey="members.memberDetails.rolePermissionSummary"
+                ns="common"
+                values={{
+                  role: label,
+                  permissions: permissionLabels,
+                }}
+                components={{
+                  permissionList: <span className="text-text-accent" />,
+                }}
+              />
+            )
+          : t('members.memberDetails.roleNoPermissionSummary', {
+              ns: 'common',
+              defaultValue: 'Current role has no permissions.',
+            })}
+      </div>
+    </div>
+  )
+
+  const chipWithPermissions = (
+    <PreviewCard>
+      <PreviewCardTrigger render={chip} />
+      <PreviewCardContent
+        placement="bottom-start"
+        sideOffset={8}
+        popupClassName="overflow-hidden border-components-panel-border bg-components-tooltip-bg p-0 shadow-lg backdrop-blur-[5px]"
+      >
+        {permissionSummary}
+      </PreviewCardContent>
+    </PreviewCard>
+  )
+
+  if (!canOpenMenu)
+    return chipWithPermissions
+
+  const menuTrigger = (
+    <PreviewCard>
+      <DropdownMenuTrigger render={<PreviewCardTrigger render={chip} />} />
+      <PreviewCardContent
+        placement="bottom-start"
+        sideOffset={8}
+        popupClassName="overflow-hidden border-components-panel-border bg-components-tooltip-bg p-0 shadow-lg backdrop-blur-[5px]"
+      >
+        {permissionSummary}
+      </PreviewCardContent>
+    </PreviewCard>
+  )
+
+  return (
+    <DropdownMenu open={open} onOpenChange={setOpen}>
+      {menuTrigger}
+      <DropdownMenuContent
+        placement="bottom-start"
+        sideOffset={4}
+        popupClassName="w-[236px] rounded-xl p-1"
+      >
+        <DropdownMenuItem
+          variant="destructive"
+          className="h-8 gap-2 rounded-lg px-2 py-1 system-sm-regular"
+          onClick={() => onRemove?.(roleId)}
+        >
+          <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
+          {t('operation.remove', { ns: 'common' })}
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
+
+export default memo(PermissionRoleChip)
diff --git a/web/app/components/header/account-setting/members-page/member-menu.tsx b/web/app/components/header/account-setting/members-page/member-menu.tsx
new file mode 100644
index 00000000000..d658d09f65f
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/member-menu.tsx
@@ -0,0 +1,160 @@
+'use client'
+import type { Role } from '@/models/access-control'
+import type { Member } from '@/models/common'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useQueryClient } from '@tanstack/react-query'
+import { memo, useCallback, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import ActionButton from '@/app/components/base/action-button'
+import { useUpdateRolesOfMember } from '@/service/access-control/use-member-roles'
+import { deleteMemberOrCancelInvitation } from '@/service/common'
+import { commonQueryKeys } from '@/service/use-common'
+import AssignRolesModal from './assign-roles-modal'
+
+type MemberMenuProps = {
+  member: Member
+  isCurrentUser: boolean
+  canTransferOwnership?: boolean
+  allowMultipleRoles?: boolean
+  onTransferOwnership?: () => void
+}
+
+const MemberMenu = ({
+  member,
+  isCurrentUser,
+  canTransferOwnership = false,
+  allowMultipleRoles = true,
+  onTransferOwnership,
+}: MemberMenuProps) => {
+  const { t } = useTranslation()
+  const queryClient = useQueryClient()
+  const [open, setOpen] = useState(false)
+  const [assignModalOpen, setAssignModalOpen] = useState(false)
+
+  const isOwner = member.role === 'owner'
+  const canAssignRoles = !isOwner && !isCurrentUser
+  const canRemove = !isOwner && !isCurrentUser
+  const showTransferOwnership = isOwner && canTransferOwnership
+
+  const selectedRoles = member.roles || []
+
+  const handleOpenAssignRoles = useCallback(() => {
+    setOpen(false)
+    setAssignModalOpen(true)
+  }, [])
+
+  const { mutateAsync: updateRolesOfMember } = useUpdateRolesOfMember()
+
+  const handleAssignRolesSubmit = useCallback((roles: Role[]) => {
+    const roleIds = allowMultipleRoles
+      ? roles.map(role => role.id)
+      : roles.slice(0, 1).map(role => role.id)
+
+    updateRolesOfMember({
+      memberId: member.id,
+      roleIds,
+    }, {
+      onSuccess: () => {
+        toast.success(t('actionMsg.modifiedSuccessfully', { ns: 'common' }))
+      },
+    })
+  }, [allowMultipleRoles, member.id, t, updateRolesOfMember])
+
+  const handleRemove = useCallback(async () => {
+    setOpen(false)
+    try {
+      await deleteMemberOrCancelInvitation({ url: `/workspaces/current/members/${member.id}` })
+      void queryClient.invalidateQueries({ queryKey: commonQueryKeys.members })
+      toast.success(t('actionMsg.modifiedSuccessfully', { ns: 'common' }))
+    }
+    catch {
+    }
+  }, [member.id, queryClient, t])
+
+  const handleTransferOwnership = useCallback(() => {
+    setOpen(false)
+    onTransferOwnership?.()
+  }, [onTransferOwnership])
+
+  const stopPropagationOnClick = useCallback((e: React.MouseEvent) => {
+    e.stopPropagation()
+  }, [])
+
+  const stopPropagationOnKeyDown = useCallback((e: React.KeyboardEvent<HTMLDivElement>) => {
+    if (e.key === 'Enter' || e.key === ' ')
+      e.stopPropagation()
+  }, [])
+
+  if (!canAssignRoles && !canRemove && !showTransferOwnership)
+    return null
+
+  return (
+    <div role="presentation" onClick={stopPropagationOnClick} onKeyDown={stopPropagationOnKeyDown}>
+      <DropdownMenu open={open} onOpenChange={setOpen}>
+        <DropdownMenuTrigger
+          render={(
+            <ActionButton
+              size="l"
+              className={cn(open && 'bg-state-base-hover')}
+              aria-label={t('members.memberActions', { ns: 'common', defaultValue: 'Member actions' })}
+            />
+          )}
+        >
+          <span aria-hidden className="i-ri-more-fill h-4 w-4 text-text-tertiary" />
+        </DropdownMenuTrigger>
+        <DropdownMenuContent
+          placement="bottom-end"
+          sideOffset={4}
+          popupClassName="min-w-[180px] rounded-xl p-1"
+        >
+          {canAssignRoles && (
+            <DropdownMenuItem
+              className="system-sm-medium text-text-secondary"
+              onClick={handleOpenAssignRoles}
+            >
+              {t('members.assignRoles', { ns: 'common', defaultValue: 'Assign Roles' })}
+            </DropdownMenuItem>
+          )}
+          {showTransferOwnership && (
+            <DropdownMenuItem
+              className="system-sm-medium text-text-secondary"
+              onClick={handleTransferOwnership}
+            >
+              {t('members.transferOwnership', { ns: 'common' })}
+            </DropdownMenuItem>
+          )}
+          {(canAssignRoles || showTransferOwnership) && canRemove && (
+            <DropdownMenuSeparator />
+          )}
+          {canRemove && (
+            <DropdownMenuItem
+              variant="destructive"
+              className="system-sm-medium"
+              onClick={handleRemove}
+            >
+              {t('members.removeFromTeam', { ns: 'common' })}
+            </DropdownMenuItem>
+          )}
+        </DropdownMenuContent>
+      </DropdownMenu>
+      {assignModalOpen && (
+        <AssignRolesModal
+          selectedRoles={selectedRoles}
+          allowMultipleRoles={allowMultipleRoles}
+          onClose={() => setAssignModalOpen(false)}
+          onSubmit={handleAssignRolesSubmit}
+        />
+      )}
+    </div>
+  )
+}
+
+export default memo(MemberMenu)
diff --git a/web/app/components/header/account-setting/members-page/member-row.tsx b/web/app/components/header/account-setting/members-page/member-row.tsx
new file mode 100644
index 00000000000..2886a45700e
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/member-row.tsx
@@ -0,0 +1,109 @@
+'use client'
+import type { KeyboardEvent } from 'react'
+import type { Member } from '@/models/common'
+import { Avatar } from '@langgenius/dify-ui/avatar'
+import { memo, useCallback } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
+import MemberMenu from './member-menu'
+import RoleBadges from './role-badges'
+
+type MemberRowProps = {
+  member: Member
+  roles: Array<{
+    id: string
+    name: string
+  }>
+  isCurrentUser: boolean
+  canManage: boolean
+  canTransferOwnership: boolean
+  allowMultipleRoles: boolean
+  onOpenDetails: (member: Member) => void
+  onTransferOwnership: () => void
+}
+
+const MemberRow = ({
+  member,
+  roles,
+  isCurrentUser,
+  canManage,
+  canTransferOwnership,
+  allowMultipleRoles,
+  onOpenDetails,
+  onTransferOwnership,
+}: MemberRowProps) => {
+  const { t } = useTranslation()
+  const { formatTimeFromNow } = useFormatTimeFromNow()
+
+  const roleNames = roles.map(role => role.name)
+
+  const openDetails = useCallback(() => {
+    onOpenDetails(member)
+  }, [member, onOpenDetails])
+
+  const handleRowKeyDown = useCallback((e: KeyboardEvent<HTMLDivElement>) => {
+    if (e.key === 'Enter' || e.key === ' ') {
+      e.preventDefault()
+      openDetails()
+    }
+  }, [openDetails])
+
+  return (
+    <div
+      role="button"
+      tabIndex={0}
+      data-testid={`member-row-${member.id}`}
+      aria-label={t('members.memberDetails.openAria', {
+        ns: 'common',
+        name: member.name,
+        defaultValue: 'Open member details for {{name}}',
+      })}
+      className="flex cursor-pointer border-b border-divider-subtle hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+      onClick={openDetails}
+      onKeyDown={handleRowKeyDown}
+    >
+      <div className="flex w-65 shrink-0 items-center px-3 py-2">
+        <Avatar avatar={member.avatar_url} size="sm" className="mr-2" name={member.name} />
+        <div className="">
+          <div className="system-sm-medium text-text-secondary">
+            {member.name}
+            {member.status === 'pending' && (
+              <span className="ml-1 system-xs-medium text-text-warning">
+                {t('members.pending', { ns: 'common' })}
+              </span>
+            )}
+            {isCurrentUser && (
+              <span className="system-xs-regular text-text-tertiary">
+                {t('members.you', { ns: 'common' })}
+              </span>
+            )}
+          </div>
+          <div className="system-xs-regular text-text-tertiary">{member.email}</div>
+        </div>
+      </div>
+      <div className="flex w-30 shrink-0 items-center py-2 system-sm-regular text-text-secondary">
+        {formatTimeFromNow(Number((member.last_active_at || member.created_at)) * 1000)}
+      </div>
+      <div
+        className="flex min-w-0 grow items-center gap-2 px-3"
+        role="presentation"
+      >
+        <RoleBadges
+          className="grow"
+          roleNames={roleNames}
+        />
+        {canManage && (
+          <MemberMenu
+            member={member}
+            isCurrentUser={isCurrentUser}
+            canTransferOwnership={canTransferOwnership}
+            allowMultipleRoles={allowMultipleRoles}
+            onTransferOwnership={onTransferOwnership}
+          />
+        )}
+      </div>
+    </div>
+  )
+}
+
+export default memo(MemberRow)
diff --git a/web/app/components/header/account-setting/members-page/operation/__tests__/index.spec.tsx b/web/app/components/header/account-setting/members-page/operation/__tests__/index.spec.tsx
deleted file mode 100644
index 728ccf82e18..00000000000
--- a/web/app/components/header/account-setting/members-page/operation/__tests__/index.spec.tsx
+++ /dev/null
@@ -1,142 +0,0 @@
-import type { Member } from '@/models/common'
-import { render, screen, waitFor } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import { vi } from 'vitest'
-import Operation from '../index'
-
-const mockUpdateMemberRole = vi.fn()
-const mockDeleteMemberOrCancelInvitation = vi.fn()
-
-vi.mock('@/service/common', () => ({
-  deleteMemberOrCancelInvitation: (args: unknown) => mockDeleteMemberOrCancelInvitation(args),
-  updateMemberRole: (args: unknown) => mockUpdateMemberRole(args),
-}))
-
-const mockUseProviderContext = vi.fn(() => ({
-  datasetOperatorEnabled: false,
-}))
-
-vi.mock('@/context/provider-context', () => ({
-  useProviderContext: () => mockUseProviderContext(),
-}))
-
-const defaultMember: Member = {
-  id: 'member-id',
-  name: 'Test Member',
-  email: 'test@example.com',
-  avatar: '',
-  avatar_url: null,
-  status: 'active',
-  role: 'editor',
-  last_login_at: '',
-  last_active_at: '',
-  created_at: '',
-}
-
-const renderOperation = (propsOverride: Partial<Member> = {}, operatorRole = 'owner', onOperate?: () => void) => {
-  const mergedMember = { ...defaultMember, ...propsOverride }
-  return render(
-    <>
-      <Operation member={mergedMember} operatorRole={operatorRole} onOperate={onOperate ?? vi.fn()} />
-    </>,
-  )
-}
-
-describe('Operation', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    mockUseProviderContext.mockReturnValue({ datasetOperatorEnabled: false })
-  })
-
-  it('should render the current role label when member has editor role', () => {
-    renderOperation()
-
-    expect(screen.getByText('common.members.editor')).toBeInTheDocument()
-  })
-
-  it('should show dataset operator option when feature flag is enabled', async () => {
-    const user = userEvent.setup()
-
-    mockUseProviderContext.mockReturnValue({ datasetOperatorEnabled: true })
-    renderOperation()
-
-    await user.click(screen.getByText('common.members.editor'))
-
-    expect(await screen.findByText('common.members.datasetOperator')).toBeInTheDocument()
-  })
-
-  it('should show admin-allowed role options when operator role is admin', async () => {
-    const user = userEvent.setup()
-
-    renderOperation({}, 'admin')
-
-    await user.click(screen.getByText('common.members.editor'))
-
-    expect(screen.getByText('common.members.admin')).toBeInTheDocument()
-    expect(screen.getAllByText('common.members.editor')).toHaveLength(2)
-    expect(screen.getByText('common.members.normal')).toBeInTheDocument()
-    expect(screen.queryByText('common.members.datasetOperator')).not.toBeInTheDocument()
-    expect(screen.getByText('common.members.removeFromTeam')).toBeInTheDocument()
-  })
-
-  it('should not show role options or remove action when operator role is unsupported', async () => {
-    const user = userEvent.setup()
-
-    renderOperation({}, 'normal')
-
-    await user.click(screen.getByText('common.members.editor'))
-
-    expect(screen.queryByText('common.members.normal')).not.toBeInTheDocument()
-    expect(screen.queryByText('common.members.removeFromTeam')).not.toBeInTheDocument()
-  })
-
-  it('should call updateMemberRole and onOperate when selecting another role', async () => {
-    const user = userEvent.setup()
-    const onOperate = vi.fn()
-    renderOperation({}, 'owner', onOperate)
-
-    await user.click(screen.getByText('common.members.editor'))
-    await user.click(await screen.findByText('common.members.normal'))
-
-    await waitFor(() => {
-      expect(mockUpdateMemberRole).toHaveBeenCalledWith({
-        url: '/workspaces/current/members/member-id/update-role',
-        body: { role: 'normal' },
-      })
-      expect(onOperate).toHaveBeenCalled()
-    })
-  })
-
-  it('should show dataset operator option when operator is admin and feature flag is enabled', async () => {
-    const user = userEvent.setup()
-    mockUseProviderContext.mockReturnValue({ datasetOperatorEnabled: true })
-    renderOperation({}, 'admin')
-
-    await user.click(screen.getByText('common.members.editor'))
-
-    expect(await screen.findByText('common.members.datasetOperator')).toBeInTheDocument()
-    expect(screen.getByText('common.members.admin')).toBeInTheDocument()
-  })
-
-  it('should fall back to normal role label when member role is unknown', () => {
-    renderOperation({ role: 'unknown_role' as Member['role'] })
-
-    expect(screen.getByText('common.members.normal')).toBeInTheDocument()
-  })
-
-  it('should call deleteMemberOrCancelInvitation when removing the member', async () => {
-    const user = userEvent.setup()
-    const onOperate = vi.fn()
-    renderOperation({}, 'owner', onOperate)
-
-    await user.click(screen.getByText('common.members.editor'))
-    await user.click(await screen.findByText('common.members.removeFromTeam'))
-
-    await waitFor(() => {
-      expect(mockDeleteMemberOrCancelInvitation).toHaveBeenCalledWith({
-        url: '/workspaces/current/members/member-id',
-      })
-      expect(onOperate).toHaveBeenCalled()
-    })
-  })
-})
diff --git a/web/app/components/header/account-setting/members-page/operation/__tests__/transfer-ownership.spec.tsx b/web/app/components/header/account-setting/members-page/operation/__tests__/transfer-ownership.spec.tsx
deleted file mode 100644
index f7b8f1dd5a2..00000000000
--- a/web/app/components/header/account-setting/members-page/operation/__tests__/transfer-ownership.spec.tsx
+++ /dev/null
@@ -1,91 +0,0 @@
-import type { AppContextValue } from '@/context/app-context'
-import type { ICurrentWorkspace } from '@/models/common'
-import { fireEvent, screen, waitFor } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import { vi } from 'vitest'
-import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
-import { useAppContext } from '@/context/app-context'
-import { useWorkspacePermissions } from '@/service/use-workspace'
-import TransferOwnership from '../transfer-ownership'
-
-vi.mock('@/context/app-context')
-vi.mock('@/service/use-workspace')
-
-describe('TransferOwnership', () => {
-  const setupPermissions = ({
-    isFetching,
-    allowOwnerTransfer,
-  }: {
-    isFetching: boolean
-    allowOwnerTransfer?: boolean
-  }) => {
-    vi.mocked(useWorkspacePermissions).mockReturnValue({
-      data: allowOwnerTransfer === undefined ? null : { allow_owner_transfer: allowOwnerTransfer },
-      isFetching,
-    } as unknown as ReturnType<typeof useWorkspacePermissions>)
-  }
-
-  const renderTransferOwnership = (
-    brandingEnabled: boolean,
-    onOperate: () => void = vi.fn(),
-  ) =>
-    renderWithSystemFeatures(<TransferOwnership onOperate={onOperate} />, {
-      systemFeatures: { branding: { enabled: brandingEnabled } },
-    })
-
-  beforeEach(() => {
-    vi.clearAllMocks()
-    vi.mocked(useAppContext).mockReturnValue({
-      currentWorkspace: { id: 'workspace-id' } as ICurrentWorkspace,
-    } as unknown as AppContextValue)
-  })
-
-  it('should show loading status while permissions are loading', () => {
-    setupPermissions({ isFetching: true })
-
-    renderTransferOwnership(true)
-
-    expect(screen.getByRole('status')).toBeInTheDocument()
-  })
-
-  it('should show owner text without transfer menu when transfer is forbidden', () => {
-    setupPermissions({ isFetching: false, allowOwnerTransfer: false })
-
-    renderTransferOwnership(true)
-
-    expect(screen.getByText(/members\.owner/i)).toBeInTheDocument()
-    expect(screen.queryByText(/members\.transferOwnership/i)).toBeNull()
-  })
-
-  it('should open transfer dialog when transfer option is selected', async () => {
-    const user = userEvent.setup()
-    const onOperate = vi.fn()
-
-    setupPermissions({ isFetching: false, allowOwnerTransfer: true })
-
-    renderTransferOwnership(true, onOperate)
-
-    await user.click(screen.getByRole('button', { name: /members\.owner/i }))
-    const transferOptionText = await screen.findByText(/members\.transferOwnership/i)
-    const transferOption = transferOptionText.closest('div.cursor-pointer')
-    if (!transferOption)
-      throw new Error('Transfer option container not found')
-    fireEvent.click(transferOption)
-
-    await waitFor(() => {
-      expect(onOperate).toHaveBeenCalledTimes(1)
-    })
-  })
-
-  it('should allow transfer menu when branding is disabled', async () => {
-    const user = userEvent.setup()
-
-    setupPermissions({ isFetching: false })
-
-    renderTransferOwnership(false)
-
-    await user.click(screen.getByRole('button', { name: /members\.owner/i }))
-
-    expect(screen.getByText(/members\.transferOwnership/i)).toBeInTheDocument()
-  })
-})
diff --git a/web/app/components/header/account-setting/members-page/operation/index.tsx b/web/app/components/header/account-setting/members-page/operation/index.tsx
deleted file mode 100644
index fe72f972d13..00000000000
--- a/web/app/components/header/account-setting/members-page/operation/index.tsx
+++ /dev/null
@@ -1,131 +0,0 @@
-'use client'
-import type { Member } from '@/models/common'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger,
-} from '@langgenius/dify-ui/dropdown-menu'
-import { toast } from '@langgenius/dify-ui/toast'
-import { memo, useMemo } from 'react'
-import { useTranslation } from 'react-i18next'
-import { useProviderContext } from '@/context/provider-context'
-import { deleteMemberOrCancelInvitation, updateMemberRole } from '@/service/common'
-
-type IOperationProps = {
-  member: Member
-  operatorRole: string
-  onOperate: () => void
-}
-const roleI18nKeyMap = {
-  admin: { label: 'members.admin', tip: 'members.adminTip' },
-  editor: { label: 'members.editor', tip: 'members.editorTip' },
-  normal: { label: 'members.normal', tip: 'members.normalTip' },
-  dataset_operator: { label: 'members.datasetOperator', tip: 'members.datasetOperatorTip' },
-} as const
-type OperationRoleKey = keyof typeof roleI18nKeyMap
-const nonOwnerRoles = ['admin', 'editor', 'normal'] as const
-const isNonOwnerRole = (role: Member['role']) => role !== 'owner'
-
-const Operation = ({ member, operatorRole, onOperate }: IOperationProps) => {
-  const { t } = useTranslation()
-  const { datasetOperatorEnabled } = useProviderContext()
-  const RoleMap = {
-    owner: t('members.owner', { ns: 'common' }),
-    admin: t('members.admin', { ns: 'common' }),
-    editor: t('members.editor', { ns: 'common' }),
-    normal: t('members.normal', { ns: 'common' }),
-    dataset_operator: t('members.datasetOperator', { ns: 'common' }),
-  }
-  const roleList = useMemo((): OperationRoleKey[] => {
-    if (operatorRole === 'owner') {
-      return [
-        'admin',
-        'editor',
-        'normal',
-        ...(datasetOperatorEnabled ? ['dataset_operator'] as const : []),
-      ]
-    }
-    if (operatorRole === 'admin') {
-      return [
-        ...nonOwnerRoles,
-        ...(datasetOperatorEnabled ? ['dataset_operator'] as const : []),
-      ]
-    }
-    return []
-  }, [operatorRole, datasetOperatorEnabled])
-  const canRemoveMember = operatorRole === 'owner' || (operatorRole === 'admin' && isNonOwnerRole(member.role))
-  const handleDeleteMemberOrCancelInvitation = async () => {
-    try {
-      await deleteMemberOrCancelInvitation({ url: `/workspaces/current/members/${member.id}` })
-      onOperate()
-      toast.success(t('actionMsg.modifiedSuccessfully', { ns: 'common' }))
-    }
-    catch {
-    }
-  }
-  const handleUpdateMemberRole = async (role: string) => {
-    try {
-      await updateMemberRole({
-        url: `/workspaces/current/members/${member.id}/update-role`,
-        body: { role },
-      })
-      onOperate()
-      toast.success(t('actionMsg.modifiedSuccessfully', { ns: 'common' }))
-    }
-    catch {
-    }
-  }
-  return (
-    <DropdownMenu>
-      <DropdownMenuTrigger
-        className="group flex size-full cursor-pointer items-center justify-between border-none bg-transparent px-3 text-left system-sm-regular text-text-secondary hover:bg-state-base-hover data-popup-open:bg-state-base-hover"
-      >
-        {RoleMap[member.role] || RoleMap.normal}
-        <span aria-hidden className="i-ri-arrow-down-s-line hidden size-4 shrink-0 group-hover:block group-data-popup-open:block" />
-      </DropdownMenuTrigger>
-      <DropdownMenuContent
-        placement="bottom-end"
-        sideOffset={4}
-        popupClassName="inline-flex flex-col rounded-xl p-0"
-      >
-        <div className="p-1">
-          {roleList.map(role => (
-            <DropdownMenuItem
-              key={role}
-              className="h-auto items-start gap-2 rounded-lg px-3 py-2"
-              onClick={() => handleUpdateMemberRole(role)}
-            >
-              {role === member.role
-                ? <span aria-hidden className="mt-[2px] i-ri-check-line h-4 w-4 shrink-0 text-text-accent" />
-                : <span aria-hidden className="mt-[2px] h-4 w-4 shrink-0" />}
-              <div>
-                <div className="system-sm-semibold whitespace-nowrap text-text-secondary">{t(roleI18nKeyMap[role].label, { ns: 'common' })}</div>
-                <div className="system-xs-regular whitespace-nowrap text-text-tertiary">{t(roleI18nKeyMap[role].tip, { ns: 'common' })}</div>
-              </div>
-            </DropdownMenuItem>
-          ))}
-        </div>
-        {canRemoveMember && (
-          <>
-            <DropdownMenuSeparator className="my-0" />
-            <div className="p-1">
-              <DropdownMenuItem
-                className="h-auto items-start gap-2 rounded-lg px-3 py-2"
-                onClick={handleDeleteMemberOrCancelInvitation}
-              >
-                <span aria-hidden className="mt-[2px] h-4 w-4 shrink-0" />
-                <div>
-                  <div className="system-sm-semibold whitespace-nowrap text-text-secondary">{t('members.removeFromTeam', { ns: 'common' })}</div>
-                  <div className="system-xs-regular whitespace-nowrap text-text-tertiary">{t('members.removeFromTeamTip', { ns: 'common' })}</div>
-                </div>
-              </DropdownMenuItem>
-            </div>
-          </>
-        )}
-      </DropdownMenuContent>
-    </DropdownMenu>
-  )
-}
-export default memo(Operation)
diff --git a/web/app/components/header/account-setting/members-page/operation/transfer-ownership.tsx b/web/app/components/header/account-setting/members-page/operation/transfer-ownership.tsx
deleted file mode 100644
index 8a9f07fa0ad..00000000000
--- a/web/app/components/header/account-setting/members-page/operation/transfer-ownership.tsx
+++ /dev/null
@@ -1,64 +0,0 @@
-'use client'
-import { cn } from '@langgenius/dify-ui/cn'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from '@langgenius/dify-ui/dropdown-menu'
-import {
-  RiArrowDownSLine,
-} from '@remixicon/react'
-import { useSuspenseQuery } from '@tanstack/react-query'
-import { useTranslation } from 'react-i18next'
-import Loading from '@/app/components/base/loading'
-import { useAppContext } from '@/context/app-context'
-import { systemFeaturesQueryOptions } from '@/features/system-features/client'
-import { useWorkspacePermissions } from '@/service/use-workspace'
-
-type Props = Readonly<{
-  onOperate: () => void
-}>
-
-const TransferOwnership = ({ onOperate }: Props) => {
-  const { t } = useTranslation()
-  const { currentWorkspace } = useAppContext()
-  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const { data: workspacePermissions, isFetching: isFetchingWorkspacePermissions } = useWorkspacePermissions(currentWorkspace!.id, systemFeatures.branding.enabled)
-  if (systemFeatures.branding.enabled) {
-    if (isFetchingWorkspacePermissions) {
-      return <Loading />
-    }
-    if (!workspacePermissions || workspacePermissions.allow_owner_transfer !== true) {
-      return <span className="px-3 system-sm-regular text-text-secondary">{t('members.owner', { ns: 'common' })}</span>
-    }
-  }
-
-  return (
-    <DropdownMenu modal={false}>
-      <DropdownMenuTrigger
-        className={cn(
-          'group flex size-full cursor-pointer items-center justify-between px-3 system-sm-regular text-text-secondary outline-hidden',
-          'hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-1 focus-visible:ring-components-input-border-hover data-popup-open:bg-state-base-hover',
-        )}
-      >
-        {t('members.owner', { ns: 'common' })}
-        <RiArrowDownSLine className="hidden size-4 group-hover:block group-data-popup-open:block" />
-      </DropdownMenuTrigger>
-      <DropdownMenuContent
-        placement="bottom-end"
-        sideOffset={4}
-        popupClassName="bg-components-panel-bg-blur p-1 backdrop-blur-xs"
-      >
-        <DropdownMenuItem
-          className="h-auto px-3 py-2"
-          onClick={onOperate}
-        >
-          <span className="system-md-regular whitespace-nowrap text-text-secondary">{t('members.transferOwnership', { ns: 'common' })}</span>
-        </DropdownMenuItem>
-      </DropdownMenuContent>
-    </DropdownMenu>
-  )
-}
-
-export default TransferOwnership
diff --git a/web/app/components/header/account-setting/members-page/role-badges.tsx b/web/app/components/header/account-setting/members-page/role-badges.tsx
new file mode 100644
index 00000000000..fc1654f3022
--- /dev/null
+++ b/web/app/components/header/account-setting/members-page/role-badges.tsx
@@ -0,0 +1,54 @@
+'use client'
+
+import { cn } from '@langgenius/dify-ui/cn'
+import { memo } from 'react'
+
+type RoleBadgeProps = {
+  label: string
+  className?: string
+}
+
+const RoleBadge = memo(({ label, className }: RoleBadgeProps) => {
+  return (
+    <span
+      className={cn(
+        'inline-flex h-5 max-w-full shrink items-center overflow-hidden rounded-md bg-background-body px-1.5 system-xs-medium text-text-secondary shadow-xs',
+        className,
+      )}
+      title={label}
+    >
+      <span className="truncate">{label}</span>
+    </span>
+  )
+})
+
+type RoleBadgesProps = {
+  roleNames: string[]
+  max?: number
+  className?: string
+}
+
+const RoleBadges = ({ roleNames, max = 2, className }: RoleBadgesProps) => {
+  if (!roleNames.length)
+    return null
+
+  const visible = roleNames.slice(0, max)
+  const overflow = roleNames.slice(max)
+
+  return (
+    <div className={cn('flex min-w-0 items-center gap-1', className)}>
+      {visible.map(role => (
+        <RoleBadge key={role} label={role} />
+      ))}
+      {overflow.length > 0 && (
+        <span
+          className="inline-flex h-5 shrink-0 cursor-default items-center rounded-md bg-background-body px-1.5 system-xs-medium text-text-tertiary shadow-xs"
+        >
+          {`+${overflow.length}`}
+        </span>
+      )}
+    </div>
+  )
+}
+
+export default memo(RoleBadges)
diff --git a/web/app/components/header/account-setting/menu-dialog.tsx b/web/app/components/header/account-setting/menu-dialog.tsx
index ab2812bd1cc..e0aef1ef484 100644
--- a/web/app/components/header/account-setting/menu-dialog.tsx
+++ b/web/app/components/header/account-setting/menu-dialog.tsx
@@ -4,6 +4,7 @@ import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
 import { useCallback } from 'react'
 
 type DialogProps = {
+  backdropClassName?: string
   className?: string
   children: ReactNode
   show: boolean
@@ -11,6 +12,7 @@ type DialogProps = {
 }
 
 const MenuDialog = ({
+  backdropClassName,
   className,
   children,
   show,
@@ -27,13 +29,12 @@ const MenuDialog = ({
       }}
     >
       <DialogContent
-        backdropClassName="z-40 bg-transparent"
+        backdropClassName={cn('z-40 bg-transparent', backdropClassName)}
         className={cn(
           'top-0 left-0 z-40 h-full max-h-none w-full max-w-none translate-x-0 translate-y-0 scale-100 overflow-hidden rounded-none border-none bg-background-sidenav-bg p-0 shadow-none backdrop-blur-md transition-opacity data-ending-style:scale-100 data-starting-style:scale-100',
           className,
         )}
       >
-        <div className="absolute top-0 right-0 h-full w-1/2 bg-components-panel-bg" />
         {children}
       </DialogContent>
     </Dialog>
diff --git a/web/app/components/header/account-setting/model-provider-page/__tests__/index.non-cloud.spec.tsx b/web/app/components/header/account-setting/model-provider-page/__tests__/index.non-cloud.spec.tsx
index 6ff9664bded..ce2b1c85b4f 100644
--- a/web/app/components/header/account-setting/model-provider-page/__tests__/index.non-cloud.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/__tests__/index.non-cloud.spec.tsx
@@ -62,9 +62,12 @@ vi.mock('../install-from-marketplace', () => ({
 vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
   useCanSetPluginSettings: () => ({
     canSetPermissions: true,
+    canSetPluginPreferences: true,
   }),
   usePluginSettingsAccess: () => ({
     canSetPermissions: true,
+    canSetPluginPreferences: true,
+    canViewInstalledPlugins: true,
   }),
   default: () => ({
     referenceSetting: {
diff --git a/web/app/components/header/account-setting/model-provider-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/__tests__/index.spec.tsx
index 475b3944250..b82929ca04b 100644
--- a/web/app/components/header/account-setting/model-provider-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/__tests__/index.spec.tsx
@@ -146,13 +146,17 @@ vi.mock('../system-model-selector', () => ({
 vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
   useCanSetPluginSettings: () => ({
     canSetPermissions: true,
+    canSetPluginPreferences: true,
   }),
   usePluginSettingsAccess: () => ({
     canSetPermissions: true,
+    canSetPluginPreferences: true,
+    canViewInstalledPlugins: true,
   }),
   default: () => ({
     referenceSetting: mockReferenceSetting,
     canSetPermissions: true,
+    canSetPluginPreferences: true,
   }),
 }))
 
diff --git a/web/app/components/header/account-setting/model-provider-page/__tests__/install-from-marketplace.spec.tsx b/web/app/components/header/account-setting/model-provider-page/__tests__/install-from-marketplace.spec.tsx
index c3753dd602c..7962486504c 100644
--- a/web/app/components/header/account-setting/model-provider-page/__tests__/install-from-marketplace.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/__tests__/install-from-marketplace.spec.tsx
@@ -59,6 +59,12 @@ vi.mock('../hooks', () => ({
   })),
 }))
 
+vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
+  usePluginSettingsAccess: () => ({
+    canInstallPlugin: true,
+  }),
+}))
+
 describe('InstallFromMarketplace', () => {
   const mockProviders = [] as ModelProvider[]
 
diff --git a/web/app/components/header/account-setting/model-provider-page/declarations.ts b/web/app/components/header/account-setting/model-provider-page/declarations.ts
index fc18f019a01..e497cb7614c 100644
--- a/web/app/components/header/account-setting/model-provider-page/declarations.ts
+++ b/web/app/components/header/account-setting/model-provider-page/declarations.ts
@@ -247,6 +247,7 @@ export type DefaultModelResponse = {
 export type DefaultModel = {
   provider: string
   model: string
+  plugin_id?: string
 }
 
 export type CustomConfigurationModelFixedFields = {
diff --git a/web/app/components/header/account-setting/model-provider-page/index.tsx b/web/app/components/header/account-setting/model-provider-page/index.tsx
index 22b4100db08..5d51f78c1e9 100644
--- a/web/app/components/header/account-setting/model-provider-page/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/index.tsx
@@ -10,7 +10,7 @@ import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { SearchInput } from '@/app/components/base/search-input'
 import { usePluginsWithLatestVersion } from '@/app/components/plugins/hooks'
-import { useCanSetPluginSettings } from '@/app/components/plugins/plugin-page/use-reference-setting'
+import { usePluginSettingsAccess } from '@/app/components/plugins/plugin-page/use-reference-setting'
 import { PluginCategoryEnum } from '@/app/components/plugins/types'
 import { useProviderContext } from '@/context/provider-context'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
@@ -49,8 +49,9 @@ const ModelProviderPage = ({
   const debouncedSearchText = useDebounce(searchText, { wait: 500 })
   const { t } = useTranslation()
   const {
-    canSetPermissions,
-  } = useCanSetPluginSettings()
+    canSetPluginPreferences,
+    canViewInstalledPlugins,
+  } = usePluginSettingsAccess()
   const { data: textGenerationDefaultModel, isLoading: isTextGenerationDefaultModelLoading } = useDefaultModel(ModelTypeEnum.textGeneration)
   const { data: embeddingsDefaultModel, isLoading: isEmbeddingsDefaultModelLoading } = useDefaultModel(ModelTypeEnum.textEmbedding)
   const { data: rerankDefaultModel, isLoading: isRerankDefaultModelLoading } = useDefaultModel(ModelTypeEnum.rerank)
@@ -64,7 +65,7 @@ const ModelProviderPage = ({
   }, [providers])
   const { data: installedPlugins } = useQuery(consoleQuery.plugins.checkInstalled.queryOptions({
     input: { body: { plugin_ids: allPluginIds } },
-    enabled: allPluginIds.length > 0,
+    enabled: canViewInstalledPlugins && allPluginIds.length > 0,
     staleTime: 0,
   }))
   const enrichedPlugins = usePluginsWithLatestVersion(installedPlugins?.plugins)
@@ -188,7 +189,7 @@ const ModelProviderPage = ({
               </div>
             )
           : systemModelSelector('h-8 px-3 system-sm-medium')}
-        {canSetPermissions && (
+        {canSetPluginPreferences && (
           <UpdateSettingDialog
             category={PluginCategoryEnum.model}
           />
diff --git a/web/app/components/header/account-setting/model-provider-page/install-from-marketplace.tsx b/web/app/components/header/account-setting/model-provider-page/install-from-marketplace.tsx
index 106fd87bee8..d86d2d14bef 100644
--- a/web/app/components/header/account-setting/model-provider-page/install-from-marketplace.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/install-from-marketplace.tsx
@@ -10,6 +10,7 @@ import Divider from '@/app/components/base/divider'
 import Loading from '@/app/components/base/loading'
 import List from '@/app/components/plugins/marketplace/list'
 import { getMarketplaceCategoryUrl } from '@/app/components/plugins/marketplace/utils'
+import { usePluginSettingsAccess } from '@/app/components/plugins/plugin-page/use-reference-setting'
 import ProviderCard from '@/app/components/plugins/provider-card'
 import { PluginCategoryEnum } from '@/app/components/plugins/types'
 import Link from '@/next/link'
@@ -27,6 +28,7 @@ const InstallFromMarketplace = ({
 }: InstallFromMarketplaceProps) => {
   const { t } = useTranslation()
   const { theme } = useTheme()
+  const { canInstallPlugin } = usePluginSettingsAccess()
   const [collapse, setCollapse] = useState(false)
   const {
     plugins: allPlugins,
@@ -73,7 +75,7 @@ const InstallFromMarketplace = ({
             marketplaceCollections={[]}
             marketplaceCollectionPluginsMap={{}}
             plugins={allPlugins}
-            showInstallButton
+            showInstallButton={canInstallPlugin}
             cardContainerClassName="grid grid-cols-3 gap-2"
             cardRender={cardRender}
             emptyClassName="h-auto"
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-credential-in-load-balancing.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-credential-in-load-balancing.spec.tsx
index c72264dd7ae..16b3dc3fb54 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-credential-in-load-balancing.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-credential-in-load-balancing.spec.tsx
@@ -3,6 +3,12 @@ import { fireEvent, render, screen } from '@testing-library/react'
 import { ConfigurationMethodEnum, ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import AddCredentialInLoadBalancing from '../add-credential-in-load-balancing'
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: ['credential.use', 'credential.manage'],
+  }),
+}))
+
 vi.mock('@/app/components/header/account-setting/model-provider-page/model-auth', () => ({
   Authorized: ({
     renderTrigger,
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-custom-model.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-custom-model.spec.tsx
index d0ba140fded..3bfa1029474 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-custom-model.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-custom-model.spec.tsx
@@ -24,6 +24,12 @@ vi.mock('../hooks/use-custom-models', () => ({
   useCanAddedModels: () => mockCanAddedModels,
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: ['credential.manage', 'credential.use'],
+  }),
+}))
+
 // Mock components
 vi.mock('../../model-icon', () => ({
   default: () => <div data-testid="model-icon" />,
@@ -66,7 +72,6 @@ describe('AddCustomModel', () => {
     )
 
     expect(screen.getByText(/modelProvider.addModel/)).toBeInTheDocument()
-    expect(screen.getByTestId('add-circle-icon')).toBeInTheDocument()
   })
 
   it('should call handleOpenModal directly when no models available and allowed', () => {
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/switch-credential-in-load-balancing.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/switch-credential-in-load-balancing.spec.tsx
index e135c23764b..e871b35954f 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/switch-credential-in-load-balancing.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/switch-credential-in-load-balancing.spec.tsx
@@ -4,6 +4,12 @@ import userEvent from '@testing-library/user-event'
 import { ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import SwitchCredentialInLoadBalancing from '../switch-credential-in-load-balancing'
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: ['credential.use', 'credential.manage'],
+  }),
+}))
+
 // Mock components
 vi.mock('../authorized', () => ({
   default: ({ renderTrigger, onItemClick, items }: { renderTrigger: () => React.ReactNode, onItemClick: (c: unknown) => void, items: { credentials: unknown[] }[] }) => (
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx
index 9d83d1632ad..1f27fc96788 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx
@@ -6,7 +6,6 @@ import type {
   ModelProvider,
 } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import { cn } from '@langgenius/dify-ui/cn'
-import { RiAddLine } from '@remixicon/react'
 import {
   memo,
   useCallback,
@@ -14,6 +13,8 @@ import {
 import { useTranslation } from 'react-i18next'
 import { ConfigurationMethodEnum, ModelModalModeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import { Authorized } from '@/app/components/header/account-setting/model-provider-page/model-auth'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
 
 type AddCredentialInLoadBalancingProps = {
   provider: ModelProvider
@@ -22,7 +23,7 @@ type AddCredentialInLoadBalancingProps = {
   currentCustomConfigurationModelFixedFields?: CustomConfigurationModelFixedFields
   modelCredential: ModelCredential
   onSelectCredential: (credential: Credential) => void
-  onUpdate?: (payload?: any, formValues?: Record<string, any>) => void
+  onUpdate?: (payload?: unknown, formValues?: Record<string, unknown>) => void
   onRemove?: (credentialId: string) => void
 }
 const AddCredentialInLoadBalancing = ({
@@ -35,12 +36,15 @@ const AddCredentialInLoadBalancing = ({
   onRemove,
 }: AddCredentialInLoadBalancingProps) => {
   const { t } = useTranslation()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
+  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
   const {
     available_credentials,
   } = modelCredential
   const isCustomModel = configurationMethod === ConfigurationMethodEnum.customizableModel
   const notAllowCustomCredential = provider.allow_custom_token === false
-  const handleUpdate = useCallback((payload?: any, formValues?: Record<string, any>) => {
+  const handleUpdate = useCallback((payload?: unknown, formValues?: Record<string, unknown>) => {
     onUpdate?.(payload, formValues)
   }, [onUpdate])
 
@@ -51,13 +55,16 @@ const AddCredentialInLoadBalancing = ({
         open && 'bg-state-base-hover',
       )}
       >
-        <RiAddLine className="mr-2 size-4" />
+        <span className="mr-2 i-ri-add-line size-4" />
         {t('modelProvider.auth.addCredential', { ns: 'common' })}
       </div>
     )
 
     return Item
-  }, [t, isCustomModel])
+  }, [t])
+
+  if (!canUseCredential)
+    return null
 
   return (
     <Authorized
@@ -69,7 +76,7 @@ const AddCredentialInLoadBalancing = ({
         onUpdate: handleUpdate,
         onRemove,
       }}
-      triggerOnlyOpenModal={!available_credentials?.length && !notAllowCustomCredential}
+      triggerOnlyOpenModal={!available_credentials?.length && !notAllowCustomCredential && canManageCredential}
       items={[
         {
           title: isCustomModel ? '' : t('modelProvider.auth.apiKeys', { ns: 'common' }),
@@ -86,6 +93,7 @@ const AddCredentialInLoadBalancing = ({
           }
         : undefined}
       onItemClick={onSelectCredential}
+      hideAddAction={!canManageCredential}
       placement="bottom-start"
       popupTitle={isCustomModel ? t('modelProvider.auth.modelCredentials', { ns: 'common' }) : ''}
     />
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx
index d4b778d415b..d7c677b06c4 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx
@@ -17,10 +17,6 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from '@langgenius/dify-ui/tooltip'
-import {
-  RiAddCircleFill,
-  RiAddLine,
-} from '@remixicon/react'
 import {
   memo,
   useCallback,
@@ -28,6 +24,8 @@ import {
 } from 'react'
 import { useTranslation } from 'react-i18next'
 import { ModelModalModeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
 import ModelIcon from '../model-icon'
 import { useAuth } from './hooks/use-auth'
 import { useCanAddedModels } from './hooks/use-custom-models'
@@ -48,6 +46,9 @@ const AddCustomModel = ({
   const [open, setOpen] = useState(false)
   const canAddedModels = useCanAddedModels(provider)
   const noModels = !canAddedModels.length
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
+  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
   const {
     handleOpenModal: handleOpenModalForAddNewCustomModel,
   } = useAuth(
@@ -72,6 +73,7 @@ const AddCustomModel = ({
   )
   const notAllowCustomCredential = provider.allow_custom_token === false
   const renderTrigger = useCallback((open?: boolean, onClick?: () => void) => {
+    const disabled = (noModels && !canManageCredential) || (!noModels && !canUseCredential)
     const item = (
       <Button
         variant="ghost"
@@ -81,13 +83,14 @@ const AddCustomModel = ({
           'text-text-tertiary',
           open && 'bg-components-button-ghost-bg-hover',
           notAllowCustomCredential && !!noModels && 'cursor-not-allowed opacity-50',
+          disabled && 'cursor-not-allowed opacity-50',
         )}
       >
-        <RiAddCircleFill className="mr-1 size-3.5" />
+        <span className="mr-1 i-ri-add-circle-fill size-3.5" />
         {t('modelProvider.addModel', { ns: 'common' })}
       </Button>
     )
-    if (notAllowCustomCredential && !!noModels) {
+    if ((notAllowCustomCredential && !!noModels) || disabled) {
       return (
         <Tooltip>
           <TooltipTrigger render={item} />
@@ -96,10 +99,10 @@ const AddCustomModel = ({
       )
     }
     return item
-  }, [t, notAllowCustomCredential, noModels])
+  }, [canManageCredential, canUseCredential, t, notAllowCustomCredential, noModels])
 
   if (noModels) {
-    return renderTrigger(false, notAllowCustomCredential ? undefined : handleOpenModalForAddNewCustomModel)
+    return renderTrigger(false, notAllowCustomCredential || !canManageCredential ? undefined : handleOpenModalForAddNewCustomModel)
   }
 
   return (
@@ -124,6 +127,9 @@ const AddCustomModel = ({
                   key={model.model}
                   className="flex h-8 cursor-pointer items-center rounded-lg px-2 hover:bg-state-base-hover"
                   onClick={() => {
+                    if (!canUseCredential)
+                      return
+
                     setOpen(false)
                     handleOpenModalForAddCustomModelToModelList(undefined, model)
                   }}
@@ -145,7 +151,7 @@ const AddCustomModel = ({
             }
           </div>
           {
-            !notAllowCustomCredential && (
+            !notAllowCustomCredential && canManageCredential && (
               <div
                 className="flex cursor-pointer items-center border-t border-t-divider-subtle p-3 system-xs-medium text-text-accent-light-mode-only"
                 onClick={() => {
@@ -153,7 +159,7 @@ const AddCustomModel = ({
                   handleOpenModalForAddNewCustomModel()
                 }}
               >
-                <RiAddLine className="mr-1 size-4" />
+                <span className="mr-1 i-ri-add-line size-4" />
                 {t('modelProvider.auth.addNewModel', { ns: 'common' })}
               </div>
             )
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/__tests__/index.spec.tsx
index f405fb55280..f0058dca99f 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/__tests__/index.spec.tsx
@@ -11,6 +11,13 @@ const mockHandleConfirmDelete = vi.fn()
 
 let mockDeleteCredentialId: string | null = null
 let mockDoingAction = false
+let mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
 
 vi.mock('../../hooks', () => ({
   useAuth: () => ({
@@ -25,9 +32,12 @@ vi.mock('../../hooks', () => ({
 }))
 
 vi.mock('../authorized-item', () => ({
-  default: ({ credentials, model, onEdit, onDelete, onItemClick }: {
+  default: ({ credentials, model, disabled, disableEdit, disableDelete, onEdit, onDelete, onItemClick }: {
     credentials: Credential[]
     model?: CustomModel
+    disabled?: boolean
+    disableEdit?: boolean
+    disableDelete?: boolean
     onEdit?: (credential: Credential, model?: CustomModel) => void
     onDelete?: (credential: Credential, model?: CustomModel) => void
     onItemClick?: (credential: Credential, model?: CustomModel) => void
@@ -36,9 +46,9 @@ vi.mock('../authorized-item', () => ({
       {credentials.map((cred: Credential) => (
         <div key={cred.credential_id}>
           <span>{cred.credential_name}</span>
-          <button onClick={() => onEdit?.(cred, model)}>Edit</button>
-          <button onClick={() => onDelete?.(cred, model)}>Delete</button>
-          <button onClick={() => onItemClick?.(cred, model)}>Select</button>
+          <button disabled={disabled || disableEdit} onClick={() => onEdit?.(cred, model)}>Edit</button>
+          <button disabled={disabled || disableDelete} onClick={() => onDelete?.(cred, model)}>Delete</button>
+          <button disabled={disabled} onClick={() => onItemClick?.(cred, model)}>Select</button>
         </div>
       ))}
     </div>
@@ -79,6 +89,7 @@ describe('Authorized', () => {
     vi.clearAllMocks()
     mockDeleteCredentialId = null
     mockDoingAction = false
+    mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
   })
 
   it('should render trigger and open popup when trigger is clicked', () => {
@@ -185,6 +196,29 @@ describe('Authorized', () => {
     expect(screen.queryByRole('button', { name: /addApiKey/i })).not.toBeInTheDocument()
   })
 
+  it('should allow use-only users to switch credentials but not add, edit, or delete them', () => {
+    mockWorkspacePermissionKeys = ['credential.use']
+
+    render(
+      <Authorized
+        provider={mockProvider}
+        configurationMethod={ConfigurationMethodEnum.predefinedModel}
+        items={mockItems}
+        renderTrigger={mockRenderTrigger}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /trigger\s*closed/i }))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Edit' })[0]!)
+    fireEvent.click(screen.getAllByRole('button', { name: 'Delete' })[0]!)
+    fireEvent.click(screen.getAllByRole('button', { name: 'Select' })[0]!)
+
+    expect(mockHandleActiveCredential).toHaveBeenCalledWith(mockCredentials[0], mockItems[0]!.model)
+    expect(mockHandleOpenModal).not.toHaveBeenCalled()
+    expect(mockOpenConfirmDelete).not.toHaveBeenCalled()
+    expect(screen.queryByRole('button', { name: /addApiKey/i })).not.toBeInTheDocument()
+  })
+
   it('should show confirm dialog and call confirm handler when delete is confirmed', () => {
     mockDeleteCredentialId = 'cred-1'
 
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/authorized-item.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/authorized-item.tsx
index 7e7bd9b7d81..55c2f2d7cf3 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/authorized-item.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/authorized-item.tsx
@@ -27,6 +27,8 @@ type AuthorizedItemProps = {
   showModelTitle?: boolean
   disableDeleteButShowAction?: boolean
   disableDeleteTip?: string
+  disableEdit?: boolean
+  disableDelete?: boolean
 }
 export const AuthorizedItem = ({
   provider,
@@ -42,6 +44,8 @@ export const AuthorizedItem = ({
   showModelTitle,
   disableDeleteButShowAction,
   disableDeleteTip,
+  disableEdit,
+  disableDelete,
 }: AuthorizedItemProps) => {
   const handleEdit = useCallback((credential?: Credential) => {
     onEdit?.(credential, model)
@@ -86,6 +90,8 @@ export const AuthorizedItem = ({
             disabled={disabled}
             onDelete={handleDelete}
             onEdit={handleEdit}
+            disableEdit={disableEdit}
+            disableDelete={disableDelete}
             showSelectedIcon={showItemSelectedIcon}
             selectedCredentialId={selectedCredentialId}
             onItemClick={handleItemClick}
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/index.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/index.tsx
index 903d2205726..042d6771097 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/index.tsx
@@ -1,6 +1,3 @@
-import type {
-  OffsetOptions,
-} from '@floating-ui/react'
 import type { Placement } from '@langgenius/dify-ui/popover'
 import type { MouseEvent } from 'react'
 import type {
@@ -26,9 +23,6 @@ import {
   PopoverContent,
   PopoverTrigger,
 } from '@langgenius/dify-ui/popover'
-import {
-  RiAddLine,
-} from '@remixicon/react'
 import {
   Fragment,
   memo,
@@ -36,9 +30,17 @@ import {
   useState,
 } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
 import { useAuth } from '../hooks'
 import AuthorizedItem from './authorized-item'
 
+type PopoverOffsetOptions = {
+  mainAxis?: number
+  crossAxis?: number
+  alignmentAxis?: number
+}
+
 type AuthorizedProps = {
   provider: ModelProvider
   configurationMethod: ConfigurationMethodEnum
@@ -59,7 +61,7 @@ type AuthorizedProps = {
   renderTrigger: (open?: boolean) => React.ReactNode
   isOpen?: boolean
   onOpenChange?: (open: boolean) => void
-  offset?: number | OffsetOptions
+  offset?: number | PopoverOffsetOptions
   placement?: Placement
   triggerPopupSameWidth?: boolean
   popupClassName?: string
@@ -99,6 +101,9 @@ const Authorized = ({
   disableDeleteTip,
 }: AuthorizedProps) => {
   const { t } = useTranslation()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
+  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
   const [isLocalOpen, setIsLocalOpen] = useState(false)
   const mergedIsOpen = isOpen ?? isLocalOpen
   const setMergedIsOpen = useCallback((open: boolean) => {
@@ -134,15 +139,24 @@ const Authorized = ({
   )
 
   const handleEdit = useCallback((credential?: Credential, model?: CustomModel) => {
+    if (!canManageCredential)
+      return
+
     setMergedIsOpen(false)
     handleOpenModal(credential, model)
-  }, [handleOpenModal, setMergedIsOpen])
+  }, [canManageCredential, handleOpenModal, setMergedIsOpen])
   const handleDelete = useCallback((credential?: Credential, model?: CustomModel) => {
+    if (!canManageCredential)
+      return
+
     setMergedIsOpen(false)
     openConfirmDelete(credential, model)
-  }, [openConfirmDelete, setMergedIsOpen])
+  }, [canManageCredential, openConfirmDelete, setMergedIsOpen])
 
   const handleItemClick = useCallback((credential: Credential, model?: CustomModel) => {
+    if (!canUseCredential)
+      return
+
     if (disableItemClick)
       return
 
@@ -152,9 +166,9 @@ const Authorized = ({
       handleActiveCredential(credential, model)
 
     setMergedIsOpen(false)
-  }, [handleActiveCredential, onItemClick, setMergedIsOpen, disableItemClick])
+  }, [canUseCredential, handleActiveCredential, onItemClick, setMergedIsOpen, disableItemClick])
   const notAllowCustomCredential = provider.allow_custom_token === false
-  const resolvedOffset = typeof offset === 'number' || typeof offset === 'function' ? undefined : offset
+  const resolvedOffset = typeof offset === 'number' ? undefined : offset
   const sideOffset = typeof offset === 'number' ? offset : resolvedOffset?.mainAxis ?? 0
   const alignOffset = typeof offset === 'number' ? 0 : resolvedOffset?.crossAxis ?? resolvedOffset?.alignmentAxis ?? 0
   const popupProps = triggerPopupSameWidth
@@ -165,8 +179,11 @@ const Authorized = ({
       return
 
     event.preventDefault()
+    if (!canManageCredential)
+      return
+
     handleOpenModal()
-  }, [handleOpenModal, triggerOnlyOpenModal])
+  }, [canManageCredential, handleOpenModal, triggerOnlyOpenModal])
 
   return (
     <>
@@ -207,7 +224,9 @@ const Authorized = ({
                       title={item.title}
                       model={item.model}
                       credentials={item.credentials}
-                      disabled={disabled}
+                      disabled={disabled || !canUseCredential}
+                      disableEdit={!canManageCredential}
+                      disableDelete={!canManageCredential}
                       onDelete={handleDelete}
                       disableDeleteButShowAction={disableDeleteButShowAction}
                       disableDeleteTip={disableDeleteTip}
@@ -228,7 +247,7 @@ const Authorized = ({
             </div>
             <div className="h-px bg-divider-subtle"></div>
             {
-              isModelCredential && !notAllowCustomCredential && !hideAddAction && (
+              isModelCredential && !notAllowCustomCredential && !hideAddAction && canManageCredential && (
                 <div
                   onClick={() => handleEdit(
                     undefined,
@@ -241,13 +260,13 @@ const Authorized = ({
                   )}
                   className="flex h-[40px] cursor-pointer items-center px-3 system-xs-medium text-text-accent-light-mode-only"
                 >
-                  <RiAddLine className="mr-1 size-4" />
+                  <span className="mr-1 i-ri-add-line size-4" />
                   {t('modelProvider.auth.addModelCredential', { ns: 'common' })}
                 </div>
               )
             }
             {
-              !isModelCredential && !notAllowCustomCredential && !hideAddAction && (
+              !isModelCredential && !notAllowCustomCredential && !hideAddAction && canManageCredential && (
                 <div className="p-2">
                   <Button
                     onClick={() => handleEdit()}
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx
index aaaa8f5dfa4..1a9fd752683 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx
@@ -9,7 +9,6 @@ import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
-import { RiArrowDownSLine } from '@remixicon/react'
 import {
   memo,
   useCallback,
@@ -17,6 +16,8 @@ import {
 import { useTranslation } from 'react-i18next'
 import Badge from '@/app/components/base/badge'
 import { ConfigurationMethodEnum, ModelModalModeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
 import Authorized from './authorized'
 
 type SwitchCredentialInLoadBalancingProps = {
@@ -25,7 +26,7 @@ type SwitchCredentialInLoadBalancingProps = {
   credentials?: Credential[]
   customModelCredential?: Credential
   setCustomModelCredential: Dispatch<SetStateAction<Credential | undefined>>
-  onUpdate?: (payload?: any, formValues?: Record<string, any>) => void
+  onUpdate?: (payload?: unknown, formValues?: Record<string, unknown>) => void
   onRemove?: (credentialId: string) => void
 }
 const SwitchCredentialInLoadBalancing = ({
@@ -39,9 +40,15 @@ const SwitchCredentialInLoadBalancing = ({
 }: SwitchCredentialInLoadBalancingProps) => {
   const { t } = useTranslation()
   const notAllowCustomCredential = provider.allow_custom_token === false
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
+  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
   const handleItemClick = useCallback((credential: Credential) => {
+    if (!canUseCredential)
+      return
+
     setCustomModelCredential(credential)
-  }, [setCustomModelCredential])
+  }, [canUseCredential, setCustomModelCredential])
 
   const renderTrigger = useCallback(() => {
     const selectedCredentialId = customModelCredential?.credential_id
@@ -60,7 +67,7 @@ const SwitchCredentialInLoadBalancing = ({
         className={cn(
           'shrink-0 space-x-1',
           (authRemoved || unavailable) && 'text-components-button-destructive-secondary-text',
-          empty && 'cursor-not-allowed opacity-50',
+          (empty || !canUseCredential) && 'cursor-not-allowed opacity-50',
         )}
       >
         {
@@ -85,10 +92,10 @@ const SwitchCredentialInLoadBalancing = ({
             <Badge className="ml-2">Enterprise</Badge>
           )
         }
-        <RiArrowDownSLine className="size-4" />
+        <span className="i-ri-arrow-down-s-line size-4" />
       </Button>
     )
-    if (empty && notAllowCustomCredential) {
+    if ((empty && notAllowCustomCredential) || !canUseCredential) {
       return (
         <Tooltip>
           <TooltipTrigger render={Item} />
@@ -99,7 +106,7 @@ const SwitchCredentialInLoadBalancing = ({
       )
     }
     return Item
-  }, [customModelCredential, t, credentials, notAllowCustomCredential])
+  }, [canUseCredential, customModelCredential, t, credentials, notAllowCustomCredential])
 
   return (
     <Authorized
@@ -133,8 +140,10 @@ const SwitchCredentialInLoadBalancing = ({
       onItemClick={handleItemClick}
       enableAddModelCredential
       showItemSelectedIcon
+      disabled={!canUseCredential}
+      hideAddAction={!canManageCredential}
       popupTitle={t('modelProvider.auth.modelCredentials', { ns: 'common' })}
-      triggerOnlyOpenModal={!credentials?.length}
+      triggerOnlyOpenModal={!credentials?.length && canManageCredential}
     />
   )
 }
diff --git a/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/dialog.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/dialog.spec.tsx
index e2c934bb7cc..cfb241be7d5 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/dialog.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/dialog.spec.tsx
@@ -78,9 +78,8 @@ vi.mock('../../model-auth/hooks', () => ({
 }))
 
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: true,
-  }),
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
+    selector({ workspacePermissionKeys: ['credential.manage', 'credential.use'] }),
 }))
 
 vi.mock('@/hooks/use-i18n', () => ({
diff --git a/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/index.spec.tsx
index a7e85bd9ebf..f1d672299c0 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/index.spec.tsx
@@ -29,7 +29,7 @@ const mockState = vi.hoisted(() => ({
   credentialData: { credentials: {}, available_credentials: [] } as CredentialData,
   doingAction: false,
   deleteCredentialId: null as string | null,
-  isCurrentWorkspaceManager: true,
+  workspacePermissionKeys: ['credential.manage', 'credential.use'] as string[],
   formSchemas: [] as CredentialFormSchema[],
   formValues: {} as Record<string, unknown>,
   modelNameAndTypeFormSchemas: [] as CredentialFormSchema[],
@@ -76,7 +76,8 @@ vi.mock('../../model-auth/hooks', () => ({
 }))
 
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({ isCurrentWorkspaceManager: mockState.isCurrentWorkspaceManager }),
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
+    selector({ workspacePermissionKeys: mockState.workspacePermissionKeys }),
 }))
 
 vi.mock('@/hooks/use-i18n', () => ({
@@ -183,7 +184,7 @@ describe('ModelModal', () => {
     mockState.credentialData = { credentials: {}, available_credentials: [] }
     mockState.doingAction = false
     mockState.deleteCredentialId = null
-    mockState.isCurrentWorkspaceManager = true
+    mockState.workspacePermissionKeys = ['credential.manage', 'credential.use']
     mockState.formSchemas = []
     mockState.formValues = {}
     mockState.modelNameAndTypeFormSchemas = []
diff --git a/web/app/components/header/account-setting/model-provider-page/model-modal/index.tsx b/web/app/components/header/account-setting/model-provider-page/model-modal/index.tsx
index ecc0cf48e4b..0c7f68fb361 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-modal/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-modal/index.tsx
@@ -41,8 +41,9 @@ import {
   useCredentialData,
 } from '@/app/components/header/account-setting/model-provider-page/model-auth/hooks'
 import ModelIcon from '@/app/components/header/account-setting/model-provider-page/model-icon'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useRenderI18nObject } from '@/hooks/use-i18n'
+import { hasPermission } from '@/utils/permission'
 import {
   ConfigurationMethodEnum,
   FormTypeEnum,
@@ -106,7 +107,9 @@ const ModelModal: FC<ModelModalProps> = ({
     available_credentials,
   } = credentialData as any
 
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
+  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
   const { t } = useTranslation()
   const language = useLanguage()
   const {
@@ -120,15 +123,21 @@ const ModelModal: FC<ModelModalProps> = ({
   const formRef2 = useRef<FormRefObject>(null)
   const isEditMode = !!credential && !!Object.keys(formSchemasValue || {}).filter((key) => {
     return key !== '__model_name' && key !== '__model_type' && !!formValues[key]
-  }).length && isCurrentWorkspaceManager
+  }).length && canManageCredential
 
   const handleSave = useCallback(async () => {
     if (mode === ModelModalModeEnum.addCustomModelToModelList && selectedCredential && !selectedCredential?.addNewCredential) {
+      if (!canUseCredential)
+        return
+
       handleActiveCredential(selectedCredential, model)
       onCancel()
       return
     }
 
+    if (!canManageCredential)
+      return
+
     let modelNameAndTypeIsCheckValidated = true
     let modelNameAndTypeValues: Record<string, any> = {}
 
@@ -188,7 +197,7 @@ const ModelModal: FC<ModelModalProps> = ({
       })
     }
     onSave(values)
-  }, [handleSaveCredential, credential?.credential_id, model, onSave, mode, selectedCredential, handleActiveCredential])
+  }, [mode, selectedCredential, model, canUseCredential, canManageCredential, onSave, handleActiveCredential, onCancel, handleSaveCredential, credential?.credential_id])
 
   const modalTitle = useMemo(() => {
     let label = t('modelProvider.auth.apiKeyModal.title', { ns: 'common' })
@@ -266,11 +275,14 @@ const ModelModal: FC<ModelModalProps> = ({
       return t('operation.add', { ns: 'common' })
     return t('operation.save', { ns: 'common' })
   }, [mode, t])
+  const canSaveCredentialChange = mode === ModelModalModeEnum.addCustomModelToModelList && selectedCredential && !selectedCredential.addNewCredential
+    ? canUseCredential
+    : canManageCredential
 
   const handleDeleteCredential = useCallback(() => {
     handleConfirmDelete()
     onCancel()
-  }, [handleConfirmDelete])
+  }, [handleConfirmDelete, onCancel])
 
   const handleModelNameAndTypeChange = useCallback((field: string, value: any) => {
     const {
@@ -327,7 +339,7 @@ const ModelModal: FC<ModelModalProps> = ({
                 onSelect={setSelectedCredential}
                 selectedCredential={selectedCredential}
                 disabled={isLoading}
-                notAllowAddNewCredential={notAllowCustomCredential}
+                notAllowAddNewCredential={notAllowCustomCredential || !canManageCredential}
               />
             )
           }
@@ -402,7 +414,7 @@ const ModelModal: FC<ModelModalProps> = ({
             <Button
               variant="primary"
               onClick={handleSave}
-              disabled={isLoading || doingAction}
+              disabled={isLoading || doingAction || !canSaveCredentialChange}
             >
               {saveButtonText}
             </Button>
diff --git a/web/app/components/header/account-setting/model-provider-page/model-parameter-modal/agent-model-trigger.tsx b/web/app/components/header/account-setting/model-provider-page/model-parameter-modal/agent-model-trigger.tsx
index 1df71b32761..f5f00b93242 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-parameter-modal/agent-model-trigger.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-parameter-modal/agent-model-trigger.tsx
@@ -4,7 +4,6 @@ import type {
   ModelProvider,
 } from '../declarations'
 import { cn } from '@langgenius/dify-ui/cn'
-import { RiEqualizer2Line } from '@remixicon/react'
 import { useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Loading from '@/app/components/base/loading'
@@ -75,7 +74,7 @@ const AgentModelTrigger: FC<AgentModelTriggerProps> = ({
   return (
     <div
       className={cn(
-        'group relative flex grow cursor-pointer items-center gap-[2px] rounded-lg bg-components-input-bg-normal p-1 hover:bg-state-base-hover-alt',
+        'group relative flex grow cursor-pointer items-center gap-0.5 rounded-lg bg-components-input-bg-normal p-1 hover:bg-state-base-hover-alt',
       )}
     >
       {modelId
@@ -131,7 +130,7 @@ const AgentModelTrigger: FC<AgentModelTriggerProps> = ({
               )}
               {modelProvider && !disabled && !needsConfiguration && (
                 <div className="flex items-center pr-1">
-                  <RiEqualizer2Line className="size-4 text-text-tertiary group-hover:text-text-secondary" />
+                  <span className="i-ri-equalizer-2-line size-4 text-text-tertiary group-hover:text-text-secondary" />
                 </div>
               )}
             </>
@@ -144,7 +143,7 @@ const AgentModelTrigger: FC<AgentModelTriggerProps> = ({
                 </span>
               </div>
               <div className="flex items-center pr-1">
-                <RiEqualizer2Line className="size-4 text-text-tertiary group-hover:text-text-secondary" />
+                <span className="i-ri-equalizer-2-line size-4 text-text-tertiary group-hover:text-text-secondary" />
               </div>
             </>
           )}
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/index.spec.tsx
index fd6b2298e74..41721774e68 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/index.spec.tsx
@@ -108,7 +108,11 @@ describe('ModelSelector', () => {
     fireEvent.click(screen.getByRole('combobox'))
     fireEvent.click(screen.getByText('select'))
 
-    expect(onSelect).toHaveBeenCalledWith({ provider: 'openai', model: 'gpt-4' })
+    expect(onSelect).toHaveBeenCalledWith({
+      provider: 'openai',
+      model: 'gpt-4',
+      plugin_id: 'langgenius/openai',
+    })
   })
 
   it('should close popup when popup requests hide', () => {
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup-item.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup-item.spec.tsx
index e946ef6348d..f8511a17855 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup-item.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup-item.spec.tsx
@@ -74,6 +74,9 @@ vi.mock('@/context/provider-context', () => ({
 const mockUseAppContext = vi.hoisted(() => vi.fn())
 vi.mock('@/context/app-context', () => ({
   useAppContext: mockUseAppContext,
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: ['credential.manage', 'credential.use'],
+  }),
 }))
 
 const makeModelItem = (overrides: Partial<ModelItem> = {}): ModelItem => ({
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup.spec.tsx
index 67edd0ae685..66d66807b2e 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup.spec.tsx
@@ -30,6 +30,10 @@ vi.mock('@/next/navigation', () => ({
   useSearchParams: () => mockSearchParams.current,
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission', () => ({
+  default: () => ({ canInstallPlugin: true }),
+}))
+
 const mockSupportFunctionCall = vi.hoisted(() => vi.fn())
 vi.mock('@/utils/tool-call', () => ({
   supportFunctionCall: mockSupportFunctionCall,
@@ -261,7 +265,7 @@ describe('Popup', () => {
     expect(input).toHaveFocus()
   })
 
-  it('should show matching models when searching by model name', () => {
+  it('should show matching models when searching by model name with direct props', () => {
     renderPopup(
       <PopupHarness
         modelList={[
@@ -290,7 +294,7 @@ describe('Popup', () => {
     expect(screen.queryByText(/common\.modelProvider\.selector\.noModelFoundForSearch/)).not.toBeInTheDocument()
   })
 
-  it('should show empty search placeholder when no provider or model name matches', () => {
+  it('should show empty search placeholder when direct props have no provider or model match', () => {
     renderPopup(
       <PopupHarness
         modelList={[
@@ -315,7 +319,7 @@ describe('Popup', () => {
     expect(screen.queryByText('gpt-4')).not.toBeInTheDocument()
   })
 
-  it('should show all models of a provider when searching by provider label', () => {
+  it('should show all models of a provider when searching by provider label with direct props', () => {
     renderPopup(
       <PopupHarness
         modelList={[
@@ -525,6 +529,151 @@ describe('Popup', () => {
     expect(screen.queryByText('langgenius/tongyi/tongyi')).not.toBeInTheDocument()
   })
 
+  it('should match by model provider key when direct props model label does not contain the search text', () => {
+    renderPopup(
+      <PopupHarness
+        modelList={[
+          makeModel({
+            provider: 'azure_openai',
+            label: { en_US: 'Azure', zh_Hans: 'Azure' },
+            models: [
+              makeModelItem({ model: 'gpt-4', label: { en_US: 'GPT-4', zh_Hans: 'GPT-4' } }),
+            ],
+          }),
+        ]}
+        onHide={vi.fn()}
+      />,
+    )
+
+    fireEvent.change(
+      screen.getByPlaceholderText('datasetSettings.form.searchModel'),
+      { target: { value: 'openai' } },
+    )
+
+    expect(screen.getByText('azure_openai'))!.toBeInTheDocument()
+    expect(screen.getByText('gpt-4'))!.toBeInTheDocument()
+  })
+
+  it('should still apply scope features when direct props match by provider label', () => {
+    mockSupportFunctionCall.mockReturnValue(false)
+
+    renderPopup(
+      <PopupHarness
+        modelList={[
+          makeModel({
+            provider: 'openai',
+            label: { en_US: 'OpenAI', zh_Hans: 'OpenAI' },
+            models: [
+              makeModelItem({ model: 'gpt-4', features: [ModelFeatureEnum.vision] }),
+              makeModelItem({ model: 'gpt-4-tool', features: [ModelFeatureEnum.toolCall] }),
+            ],
+          }),
+        ]}
+        onHide={vi.fn()}
+        scopeFeatures={[ModelFeatureEnum.toolCall]}
+      />,
+    )
+
+    fireEvent.change(
+      screen.getByPlaceholderText('datasetSettings.form.searchModel'),
+      { target: { value: 'openai' } },
+    )
+
+    expect(screen.getByText(/common\.modelProvider\.selector\.noModelFoundForSearch.*openai/))!.toBeInTheDocument()
+    expect(screen.queryByText('gpt-4')).not.toBeInTheDocument()
+    expect(screen.queryByText('gpt-4-tool')).not.toBeInTheDocument()
+  })
+
+  it('should show matching models when searching by model name', () => {
+    renderPopup(
+      <PopupHarness
+        modelList={[
+          makeModel({
+            models: [makeModelItem({ model: 'gpt-4', label: { en_US: 'GPT-4', zh_Hans: 'GPT-4' } })],
+          }),
+          makeModel({
+            provider: 'anthropic',
+            label: { en_US: 'Anthropic', zh_Hans: 'Anthropic' },
+            models: [makeModelItem({ model: 'claude-3', label: { en_US: 'Claude 3', zh_Hans: 'Claude 3' } })],
+          }),
+        ]}
+        onHide={vi.fn()}
+      />,
+    )
+
+    fireEvent.change(
+      screen.getByPlaceholderText('datasetSettings.form.searchModel'),
+      { target: { value: 'claude' } },
+    )
+
+    expect(screen.queryByText('openai')).not.toBeInTheDocument()
+    expect(screen.getByText('anthropic')).toBeInTheDocument()
+    expect(screen.getByText('claude-3')).toBeInTheDocument()
+    expect(screen.queryByText('gpt-4')).not.toBeInTheDocument()
+    expect(screen.queryByText(/common\.modelProvider\.selector\.noModelFoundForSearch.*claude/)).not.toBeInTheDocument()
+  })
+
+  it('should show empty search placeholder when no provider or model name matches', () => {
+    renderPopup(
+      <PopupHarness
+        modelList={[
+          makeModel({
+            label: { en_US: 'OpenAI', zh_Hans: 'OpenAI' },
+            models: [
+              makeModelItem({ model: 'gpt-4', label: { en_US: 'GPT-4', zh_Hans: 'GPT-4' } }),
+            ],
+          }),
+        ]}
+        onHide={vi.fn()}
+      />,
+    )
+
+    fireEvent.change(
+      screen.getByPlaceholderText('datasetSettings.form.searchModel'),
+      { target: { value: 'mistral' } },
+    )
+
+    expect(screen.getByText(/common\.modelProvider\.selector\.noModelFoundForSearch.*mistral/))!.toBeInTheDocument()
+    expect(screen.queryByText('openai')).not.toBeInTheDocument()
+    expect(screen.queryByText('gpt-4')).not.toBeInTheDocument()
+  })
+
+  it('should show all models of a provider when searching by provider label', () => {
+    renderPopup(
+      <PopupHarness
+        modelList={[
+          makeModel({
+            provider: 'openai',
+            label: { en_US: 'OpenAI', zh_Hans: 'OpenAI' },
+            models: [
+              makeModelItem({ model: 'gpt-4', label: { en_US: 'GPT-4', zh_Hans: 'GPT-4' } }),
+              makeModelItem({ model: 'gpt-4o', label: { en_US: 'GPT-4o', zh_Hans: 'GPT-4o' } }),
+            ],
+          }),
+          makeModel({
+            provider: 'anthropic',
+            label: { en_US: 'Anthropic', zh_Hans: 'Anthropic' },
+            models: [
+              makeModelItem({ model: 'claude-3', label: { en_US: 'Claude 3', zh_Hans: 'Claude 3' } }),
+            ],
+          }),
+        ]}
+        onHide={vi.fn()}
+      />,
+    )
+
+    fireEvent.change(
+      screen.getByPlaceholderText('datasetSettings.form.searchModel'),
+      { target: { value: 'openai' } },
+    )
+
+    expect(screen.getByText('openai'))!.toBeInTheDocument()
+    expect(screen.getByText('gpt-4'))!.toBeInTheDocument()
+    expect(screen.getByText('gpt-4o'))!.toBeInTheDocument()
+    expect(screen.queryByText('anthropic')).not.toBeInTheDocument()
+    expect(screen.queryByText('claude-3')).not.toBeInTheDocument()
+  })
+
   it('should match by model provider key when model label does not contain the search text', () => {
     renderPopup(
       <PopupHarness
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/index.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/index.tsx
index 93e0ac8fae8..0b4f43d9072 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/index.tsx
@@ -11,6 +11,15 @@ import ModelSelectorTrigger from './model-selector-trigger'
 import Popup from './popup'
 import { getModelSelectorValueLabel, isSameModelSelectorValue } from './types'
 
+const getModelProviderPluginId = (provider: string) => {
+  const [organization, pluginName] = provider.split('/').filter(Boolean)
+
+  if (organization && pluginName)
+    return `${organization}/${pluginName}`
+
+  return provider ? `langgenius/${provider}` : ''
+}
+
 type ModelSelectorProps = {
   defaultModel?: DefaultModel
   modelList: Model[]
@@ -24,6 +33,7 @@ type ModelSelectorProps = {
   showDeprecatedWarnIcon?: boolean
   hideProviderSettingsFooter?: boolean
   onConfigureEmptyState?: () => void
+  providerSettingsSource?: 'agent'
   showModelMeta?: boolean
 }
 function ModelSelector({
@@ -39,6 +49,7 @@ function ModelSelector({
   showDeprecatedWarnIcon = true,
   hideProviderSettingsFooter,
   onConfigureEmptyState,
+  providerSettingsSource,
   showModelMeta,
 }: ModelSelectorProps) {
   const { t } = useTranslation()
@@ -74,8 +85,13 @@ function ModelSelector({
     setOpen(false)
     setInputValue('')
 
-    if (onSelect)
-      onSelect({ provider, model: model.model })
+    if (onSelect) {
+      onSelect({
+        provider,
+        model: model.model,
+        plugin_id: getModelProviderPluginId(provider),
+      })
+    }
   }, [onSelect])
 
   const handleValueChange = useCallback((value: ModelSelectorValue | null) => {
@@ -150,6 +166,7 @@ function ModelSelector({
           modelList={modelList}
           scopeFeatures={scopeFeatures}
           hideProviderSettingsFooter={hideProviderSettingsFooter}
+          providerSettingsSource={providerSettingsSource}
           onConfigureEmptyState={onConfigureEmptyState ? handleConfigureEmptyState : undefined}
           onInputValueChange={setInputValue}
           onHide={handleHide}
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/marketplace-section.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/marketplace-section.tsx
index 987bae96758..26edfd22eca 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/marketplace-section.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/marketplace-section.tsx
@@ -11,6 +11,7 @@ type MarketplaceSectionProps = {
   marketplaceCollapsed: boolean
   installingProvider: ModelProviderQuotaGetPaid | null
   isMarketplacePluginsLoading: boolean
+  canInstallPlugin: boolean
   theme?: string
   onMarketplaceCollapsedChange: (collapsed: boolean) => void
   onInstallPlugin: (key: ModelProviderQuotaGetPaid) => void | Promise<void>
@@ -21,6 +22,7 @@ function MarketplaceSection({
   marketplaceCollapsed,
   installingProvider,
   isMarketplacePluginsLoading,
+  canInstallPlugin,
   theme,
   onMarketplaceCollapsedChange,
   onInstallPlugin,
@@ -60,21 +62,23 @@ function MarketplaceSection({
                     <Icon className="size-5 shrink-0 rounded-md" />
                     <span className="system-sm-regular text-text-secondary">{modelNameMap[key]}</span>
                   </div>
-                  <Button
-                    variant="secondary"
-                    size="small"
-                    className={cn(
-                      'shrink-0 backdrop-blur-[5px]',
-                      !isInstalling && 'hidden group-hover:flex',
-                    )}
-                    disabled={isInstalling || isMarketplacePluginsLoading}
-                    onClick={() => onInstallPlugin(key)}
-                  >
-                    {isInstalling && <span className="i-ri-loader-2-line size-3.5 animate-spin" />}
-                    {isInstalling
-                      ? t('installModal.installing', { ns: 'plugin' })
-                      : t('modelProvider.selector.install', { ns: 'common' })}
-                  </Button>
+                  {canInstallPlugin && (
+                    <Button
+                      variant="secondary"
+                      size="small"
+                      className={cn(
+                        'shrink-0 backdrop-blur-[5px]',
+                        !isInstalling && 'hidden group-hover:flex',
+                      )}
+                      disabled={isInstalling || isMarketplacePluginsLoading}
+                      onClick={() => onInstallPlugin(key)}
+                    >
+                      {isInstalling && <span className="i-ri-loader-2-line size-3.5 animate-spin" />}
+                      {isInstalling
+                        ? t('installModal.installing', { ns: 'plugin' })
+                        : t('modelProvider.selector.install', { ns: 'common' })}
+                    </Button>
+                  )}
                 </div>
               )
             })}
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx
index 59aa284b339..a957ae16577 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx
@@ -8,8 +8,10 @@ import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { CreditsCoin } from '@/app/components/base/icons/src/vender/line/financeAndECommerce'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useModalContext } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
+import { hasPermission } from '@/utils/permission'
 import { ConfigurationMethodEnum, ModelStatusEnum } from '../declarations'
 import { useLanguage, useUpdateModelList, useUpdateModelProviders } from '../hooks'
 import ModelIcon from '../model-icon'
@@ -48,7 +50,13 @@ function PopupItem({
   const updateModelList = useUpdateModelList()
   const updateModelProviders = useUpdateModelProviders()
   const currentProvider = modelProviders.find(provider => provider.provider === model.provider)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canUseCredentials = hasPermission(workspacePermissionKeys, ['credential.manage', 'credential.use'])
+  const canManageCredentials = hasPermission(workspacePermissionKeys, 'credential.manage')
   const handleOpenModelModal = () => {
+    if (!canManageCredentials)
+      return
+
     if (!currentProvider)
       return
     setShowModelModal({
@@ -102,6 +110,7 @@ function PopupItem({
         </button>
         <Popover open={dropdownOpen} onOpenChange={setDropdownOpen}>
           <PopoverTrigger
+            disabled={!canUseCredentials}
             render={(
               <button type="button" className="flex max-w-[50%] min-w-0 shrink-0 cursor-pointer items-center rounded-md px-1.5 py-1 system-xs-medium text-text-tertiary hover:bg-components-button-ghost-bg-hover">
                 {isUsingCredits
@@ -133,7 +142,7 @@ function PopupItem({
                           <span className="ml-1 truncate text-text-tertiary">{t('modelProvider.selector.configureRequired', { ns: 'common' })}</span>
                         </>
                       )}
-                <span className="i-ri-arrow-down-s-line size-3.5! shrink-0 translate-y-px text-text-tertiary" />
+                {canUseCredentials && <span className="i-ri-arrow-down-s-line size-3.5! shrink-0 translate-y-px text-text-tertiary" />}
               </button>
             )}
           />
@@ -184,13 +193,15 @@ function PopupItem({
                 onPointerDown={onPreviewCardClose}
               >
                 {rowContent}
-                <button
-                  type="button"
-                  className="hidden cursor-pointer text-xs font-medium text-text-accent group-hover:block"
-                  onClick={handleOpenModelModal}
-                >
-                  {t('operation.add', { ns: 'common' }).toLocaleUpperCase()}
-                </button>
+                {canManageCredentials && (
+                  <button
+                    type="button"
+                    className="hidden cursor-pointer text-xs font-medium text-text-accent group-hover:block"
+                    onClick={handleOpenModelModal}
+                  >
+                    {t('operation.add', { ns: 'common' }).toLocaleUpperCase()}
+                  </button>
+                )}
               </div>
             )
           : (
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/popup.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/popup.tsx
index dd759fe60ad..3b8122f6071 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/popup.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/popup.tsx
@@ -11,6 +11,7 @@ import { ACCOUNT_SETTING_MODAL_ACTION, ACCOUNT_SETTING_TAB } from '@/app/compone
 import { useIntegrationsSetting } from '@/app/components/header/account-setting/use-integrations-setting'
 import checkTaskStatus from '@/app/components/plugins/install-plugin/base/check-task-status'
 import useRefreshPluginList from '@/app/components/plugins/install-plugin/hooks/use-refresh-plugin-list'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import { IS_CLOUD_EDITION } from '@/config'
 import { useProviderContext } from '@/context/provider-context'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
@@ -38,6 +39,7 @@ export type PopupProps = {
   modelList: Model[]
   scopeFeatures?: ModelFeatureEnum[]
   hideProviderSettingsFooter?: boolean
+  providerSettingsSource?: 'agent'
   onConfigureEmptyState?: () => void
   onInputValueChange: (value: string) => void
   onHide: () => void
@@ -48,6 +50,7 @@ function Popup({
   modelList,
   scopeFeatures = [],
   hideProviderSettingsFooter,
+  providerSettingsSource,
   onConfigureEmptyState,
   onInputValueChange,
   onHide,
@@ -70,6 +73,7 @@ function Popup({
   } = useMarketplaceAllPlugins(modelProviders, '', enableMarketplace)
   const { mutateAsync: installPackageFromMarketPlace } = useInstallPackageFromMarketPlace()
   const { refreshPluginList } = useRefreshPluginList()
+  const { canInstallPlugin } = useWorkspacePluginInstallPermission()
   const [installingProvider, setInstallingProvider] = useState<ModelProviderQuotaGetPaid | null>(null)
   const { isExhausted: isCreditsExhausted } = useTrialCredits()
   const { data: trialModels = [] } = useQuery(consoleQuery.trialModels.get.queryOptions({
@@ -98,7 +102,7 @@ function Popup({
   })
 
   const handleInstallPlugin = useCallback(async (key: ModelProviderQuotaGetPaid) => {
-    if (!enableMarketplace || !allPlugins || isMarketplacePluginsLoading || installingProvider)
+    if (!enableMarketplace || !canInstallPlugin || !allPlugins || isMarketplacePluginsLoading || installingProvider)
       return
     const pluginId = providerKeyToPluginId[key]
     const plugin = allPlugins.find(p => p.plugin_id === pluginId)
@@ -119,7 +123,7 @@ function Popup({
     finally {
       setInstallingProvider(null)
     }
-  }, [allPlugins, enableMarketplace, installPackageFromMarketPlace, installingProvider, isMarketplacePluginsLoading, refreshPluginList])
+  }, [allPlugins, enableMarketplace, canInstallPlugin, installPackageFromMarketPlace, installingProvider, isMarketplacePluginsLoading, refreshPluginList])
 
   const installedModelList = useMemo(() => {
     const modelMap = new Map(modelList.map(model => [model.provider, model]))
@@ -173,8 +177,8 @@ function Popup({
 
   const handleOpenSettings = useCallback(() => {
     onHide()
-    openIntegrationsSetting({ payload: ACCOUNT_SETTING_TAB.PROVIDER })
-  }, [onHide, openIntegrationsSetting])
+    openIntegrationsSetting({ payload: ACCOUNT_SETTING_TAB.PROVIDER, source: providerSettingsSource })
+  }, [onHide, openIntegrationsSetting, providerSettingsSource])
   const handleClosePreviewCard = useCallback(() => {
     previewCardHandle.close()
   }, [previewCardHandle])
@@ -228,6 +232,7 @@ function Popup({
               marketplaceCollapsed={marketplaceCollapsed}
               installingProvider={installingProvider}
               isMarketplacePluginsLoading={isMarketplacePluginsLoading}
+              canInstallPlugin={canInstallPlugin}
               theme={theme}
               onMarketplaceCollapsedChange={setMarketplaceCollapsed}
               onInstallPlugin={handleInstallPlugin}
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/index.spec.tsx
index 0b920008b42..01886f0db8a 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/index.spec.tsx
@@ -8,6 +8,7 @@ import { ConfigurationMethodEnum } from '../../declarations'
 import ProviderAddedCard from '../index'
 
 let mockIsCurrentWorkspaceManager = true
+let mockWorkspacePermissionKeys: string[] = ['plugin.manage', 'credential.manage', 'credential.use']
 const mockFetchModelProviderModels = vi.fn()
 const mockQueryOptions = vi.fn(({ input, ...options }: { input: { params: { provider: string } }, enabled?: boolean }) => ({
   queryKey: ['console', 'modelProviders', 'models', input.params.provider],
@@ -29,6 +30,9 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager,
   }),
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
 }))
 
 // Mock internal components to simplify testing of the index file
@@ -101,6 +105,7 @@ describe('ProviderAddedCard', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockIsCurrentWorkspaceManager = true
+    mockWorkspacePermissionKeys = ['plugin.manage', 'credential.manage', 'credential.use']
   })
 
   it('should render provider added card component', () => {
@@ -196,7 +201,7 @@ describe('ProviderAddedCard', () => {
     expect(screen.getByText('common.modelProvider.configureTip')).toBeInTheDocument()
   })
 
-  it('should render custom model actions for workspace managers', () => {
+  it('should render custom model actions when user can manage plugins', () => {
     const customConfigProvider = {
       ...mockProvider,
       configurate_methods: [ConfigurationMethodEnum.customizableModel],
@@ -208,7 +213,21 @@ describe('ProviderAddedCard', () => {
 
     unmount()
     mockIsCurrentWorkspaceManager = false
+    mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
     renderWithQueryClient(<ProviderAddedCard provider={customConfigProvider} />)
     expect(screen.queryByTestId('manage-custom-model')).not.toBeInTheDocument()
   })
+
+  it('should render custom model actions when user can manage plugins without credential permissions', () => {
+    const customConfigProvider = {
+      ...mockProvider,
+      configurate_methods: [ConfigurationMethodEnum.customizableModel],
+    } as unknown as ModelProvider
+    mockWorkspacePermissionKeys = ['plugin.manage']
+
+    renderWithQueryClient(<ProviderAddedCard provider={customConfigProvider} />)
+
+    expect(screen.getByTestId('manage-custom-model')).toBeInTheDocument()
+    expect(screen.getByTestId('add-custom-model')).toBeInTheDocument()
+  })
 })
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/model-list-item.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/model-list-item.spec.tsx
index 1615d86faf1..d21df4c5a89 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/model-list-item.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/model-list-item.spec.tsx
@@ -14,10 +14,11 @@ function createWrapper() {
 
 let mockModelLoadBalancingEnabled = false
 let mockPlanType: string = 'pro'
+let mockWorkspacePermissionKeys: string[] = ['plugin.manage']
 
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
-    isCurrentWorkspaceManager: true,
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -70,6 +71,7 @@ describe('ModelListItem', () => {
     vi.clearAllMocks()
     mockModelLoadBalancingEnabled = false
     mockPlanType = 'pro'
+    mockWorkspacePermissionKeys = ['plugin.manage']
   })
 
   it('should render model item with icon and name', () => {
@@ -142,6 +144,42 @@ describe('ModelListItem', () => {
     expect(onModifyLoadBalancing).toHaveBeenCalledWith(mockModel)
   })
 
+  it('should allow model status and load balancing controls with plugin.manage', () => {
+    mockWorkspacePermissionKeys = ['plugin.manage']
+    mockModelLoadBalancingEnabled = true
+
+    render(
+      <ModelListItem
+        model={mockModel}
+        provider={mockProvider}
+        isConfigurable
+        onModifyLoadBalancing={vi.fn()}
+      />,
+      { wrapper: createWrapper() },
+    )
+
+    expect(screen.getByRole('switch')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'modify load balancing' })).toBeInTheDocument()
+  })
+
+  it('should hide model status and load balancing controls without plugin.manage', () => {
+    mockWorkspacePermissionKeys = []
+    mockModelLoadBalancingEnabled = true
+
+    render(
+      <ModelListItem
+        model={mockModel}
+        provider={mockProvider}
+        isConfigurable
+        onModifyLoadBalancing={vi.fn()}
+      />,
+      { wrapper: createWrapper() },
+    )
+
+    expect(screen.queryByRole('switch')).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'modify load balancing' })).not.toBeInTheDocument()
+  })
+
   // Deprecated branches: opacity-60, disabled switch, no ConfigModel
   it('should show deprecated model with opacity and disabled switch', () => {
     // Arrange
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/model-list.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/model-list.spec.tsx
index e435835807f..215b349eb0d 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/model-list.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/model-list.spec.tsx
@@ -4,12 +4,11 @@ import { ConfigurationMethodEnum } from '../../declarations'
 import ModelList from '../model-list'
 
 const mockSetShowModelLoadBalancingModal = vi.fn()
-let mockIsCurrentWorkspaceManager = true
+let mockWorkspacePermissionKeys: string[] = ['plugin.manage', 'credential.manage', 'credential.use']
 
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager,
-  }),
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
+    selector({ workspacePermissionKeys: mockWorkspacePermissionKeys }),
 }))
 
 vi.mock('@/context/modal-context', () => ({
@@ -46,7 +45,7 @@ describe('ModelList', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsCurrentWorkspaceManager = true
+    mockWorkspacePermissionKeys = ['plugin.manage', 'credential.manage', 'credential.use']
   })
 
   it('should render model count and model items', () => {
@@ -92,8 +91,8 @@ describe('ModelList', () => {
     expect(mockSetShowModelLoadBalancingModal).toHaveBeenCalled()
   })
 
-  it('should hide custom model actions for non-manager', () => {
-    mockIsCurrentWorkspaceManager = false
+  it('should hide custom model actions without plugin.manage', () => {
+    mockWorkspacePermissionKeys = []
     render(
       <ModelList
         provider={mockProvider}
@@ -107,15 +106,12 @@ describe('ModelList', () => {
     expect(screen.queryByTestId('add-custom-model')).not.toBeInTheDocument()
   })
 
-  // isConfigurable=false: predefinedModel only provider hides custom model actions
   it('should hide custom model actions when provider uses predefinedModel only', () => {
-    // Arrange
     const predefinedProvider = {
       provider: 'test-provider',
       configurate_methods: ['predefinedModel'],
     } as unknown as ModelProvider
 
-    // Act
     render(
       <ModelList
         provider={predefinedProvider}
@@ -183,15 +179,12 @@ describe('ModelList', () => {
     expect(mockSetShowModelLoadBalancingModal).toHaveBeenCalledWith(null)
   })
 
-  // fetchFromRemote filtered out: provider with only fetchFromRemote
   it('should hide custom model actions when provider uses fetchFromRemote only', () => {
-    // Arrange
     const fetchOnlyProvider = {
       provider: 'test-provider',
       configurate_methods: ['fetchFromRemote'],
     } as unknown as ModelProvider
 
-    // Act
     render(
       <ModelList
         provider={fetchOnlyProvider}
@@ -237,16 +230,14 @@ describe('ModelList', () => {
     expect(screen.queryByTestId('add-custom-model')).not.toBeInTheDocument()
   })
 
-  it('should show custom model actions when provider is configurable and user is workspace manager', () => {
-    // Arrange: use ConfigurationMethodEnum.customizableModel ('customizable-model') so isConfigurable=true
+  it('should show custom model actions when provider is configurable and user can manage plugins', () => {
     const configurableProvider = {
       provider: 'test-provider',
       configurate_methods: [ConfigurationMethodEnum.customizableModel],
     } as unknown as ModelProvider
 
-    mockIsCurrentWorkspaceManager = true
+    mockWorkspacePermissionKeys = ['plugin.manage']
 
-    // Act
     render(
       <ModelList
         provider={configurableProvider}
@@ -256,22 +247,18 @@ describe('ModelList', () => {
       />,
     )
 
-    // Assert: custom model actions are shown (isConfigurable=true && isCurrentWorkspaceManager=true)
-    // Assert: custom model actions are shown (isConfigurable=true && isCurrentWorkspaceManager=true)
     expect(screen.getByTestId('manage-credentials'))!.toBeInTheDocument()
     expect(screen.getByTestId('add-custom-model'))!.toBeInTheDocument()
   })
 
-  it('should hide custom model actions when provider is configurable but user is not workspace manager', () => {
-    // Arrange: use ConfigurationMethodEnum.customizableModel ('customizable-model') so isConfigurable=true, but manager=false
+  it('should hide custom model actions when provider is configurable but user cannot manage plugins', () => {
     const configurableProvider = {
       provider: 'test-provider',
       configurate_methods: [ConfigurationMethodEnum.customizableModel],
     } as unknown as ModelProvider
 
-    mockIsCurrentWorkspaceManager = false
+    mockWorkspacePermissionKeys = []
 
-    // Act
     render(
       <ModelList
         provider={configurableProvider}
@@ -281,38 +268,6 @@ describe('ModelList', () => {
       />,
     )
 
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
-    // Assert: custom model actions are hidden (isCurrentWorkspaceManager=false covers the && short-circuit)
     expect(screen.queryByTestId('manage-credentials')).not.toBeInTheDocument()
     expect(screen.queryByTestId('add-custom-model')).not.toBeInTheDocument()
   })
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/provider-card-actions.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/provider-card-actions.spec.tsx
index 595ad30089a..55a67db72f9 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/provider-card-actions.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/provider-card-actions.spec.tsx
@@ -71,6 +71,16 @@ vi.mock('@/app/components/plugins/plugin-detail-panel/operation-dropdown', () =>
   ),
 }))
 
+vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
+  usePluginSettingsAccess: () => ({
+    canManagePlugin: true,
+    canUpdatePlugin: true,
+  }),
+  default: () => ({
+    canUpdate: true,
+  }),
+}))
+
 vi.mock('@/app/components/plugins/update-plugin/plugin-version-picker', () => ({
   default: ({ trigger, onSelect, disabled }: {
     trigger: ReactNode
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/quota-panel.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/quota-panel.spec.tsx
index 01627533a2b..daaebf53724 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/quota-panel.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/quota-panel.spec.tsx
@@ -56,6 +56,14 @@ vi.mock('../../hooks', () => ({
   }),
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission', () => ({
+  default: () => ({
+    canInstallPlugin: true,
+    canUpdatePlugin: true,
+    currentDifyVersion: '1.0.0',
+  }),
+}))
+
 vi.mock('@/hooks/use-timestamp', () => ({
   default: () => ({
     formatTime: () => '2024-12-31',
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/index.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/index.tsx
index 1f42c5ec7d2..696c9c623d7 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/index.tsx
@@ -14,10 +14,11 @@ import {
   ManageCustomModelCredentials,
 } from '@/app/components/header/account-setting/model-provider-page/model-auth'
 import { IS_CE_EDITION } from '@/config'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useProviderContextSelector } from '@/context/provider-context'
 import { renderI18nObject } from '@/i18n-config'
 import { consoleQuery } from '@/service/client'
+import { hasPermission } from '@/utils/permission'
 import { useModelProviderListExpanded, useSetModelProviderListExpanded } from '../atoms'
 import { ConfigurationMethodEnum } from '../declarations'
 import { useLanguage } from '../hooks'
@@ -65,10 +66,12 @@ const ProviderAddedCard: FC<ProviderAddedCardProps> = ({
   }))
   const hasModelList = hasFetchedModelList && !!modelList.length
   const showCollapsedSection = !expanded || !hasFetchedModelList
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const showModelProvider = systemConfig.enabled && MODEL_PROVIDER_QUOTA_GET_PAID.includes(currentProviderName as ModelProviderQuotaGetPaid) && !IS_CE_EDITION
-  const showCredential = supportsPredefinedModel && isCurrentWorkspaceManager
-  const showCustomModelActions = supportsCustomizableModel && isCurrentWorkspaceManager
+  const canManagePlugins = hasPermission(workspacePermissionKeys, 'plugin.manage')
+  const canUseCredentials = hasPermission(workspacePermissionKeys, ['credential.manage', 'credential.use'])
+  const showCredential = supportsPredefinedModel && canUseCredentials
+  const showCustomModelActions = supportsCustomizableModel && canManagePlugins
 
   const refreshModelList = useCallback((targetProviderName: string) => {
     if (targetProviderName !== currentProviderName)
@@ -241,7 +244,7 @@ const ProviderAddedCard: FC<ProviderAddedCardProps> = ({
       </div>
       {
         showCollapsedSection && (
-          <div className="group flex items-center justify-between border-t border-t-divider-subtle py-1.5 pr-[11px] pl-2 system-xs-medium text-text-tertiary">
+          <div className="group flex items-center justify-between border-t border-t-divider-subtle py-1.5 pr-2.75 pl-2 system-xs-medium text-text-tertiary">
             {(showModelProvider || !notConfigured) && (
               <button
                 type="button"
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/api-key-section.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/api-key-section.spec.tsx
index 942885c617c..03224ac09f3 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/api-key-section.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/api-key-section.spec.tsx
@@ -3,6 +3,12 @@ import { fireEvent, render, screen } from '@testing-library/react'
 import { CustomConfigurationStatusEnum, PreferredProviderTypeEnum } from '../../../declarations'
 import ApiKeySection from '../api-key-section'
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: ['credential.manage', 'credential.use'],
+  }),
+}))
+
 const createCredential = (overrides: Partial<Credential> = {}): Credential => ({
   credential_id: 'cred-1',
   credential_name: 'Test API Key',
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/dropdown-content.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/dropdown-content.spec.tsx
index 424b92c8dd9..5e16edba5e4 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/dropdown-content.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/dropdown-content.spec.tsx
@@ -10,6 +10,7 @@ const mockOpenConfirmDelete = vi.fn()
 const mockCloseConfirmDelete = vi.fn()
 const mockHandleConfirmDelete = vi.fn()
 let mockDeleteCredentialId: string | null = null
+let mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
 
 vi.mock('../../use-trial-credits', () => ({
   useTrialCredits: () => ({ credits: 0, totalCredits: 10_000, isExhausted: true, isLoading: false }),
@@ -34,9 +35,18 @@ vi.mock('../../../model-auth/hooks', () => ({
   }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 vi.mock('../../../model-auth/authorized/credential-item', () => ({
-  default: ({ credential, onItemClick, onEdit, onDelete }: {
+  default: ({ credential, disabled, disableEdit, disableDelete, onItemClick, onEdit, onDelete }: {
     credential: { credential_id: string, credential_name: string }
+    disabled?: boolean
+    disableEdit?: boolean
+    disableDelete?: boolean
     onItemClick?: (c: unknown) => void
     onEdit?: (c: unknown) => void
     onDelete?: (c: unknown) => void
@@ -44,8 +54,8 @@ vi.mock('../../../model-auth/authorized/credential-item', () => ({
     <div data-testid={`credential-${credential.credential_id}`}>
       <span>{credential.credential_name}</span>
       <button data-testid={`click-${credential.credential_id}`} onClick={() => onItemClick?.(credential)}>select</button>
-      <button data-testid={`edit-${credential.credential_id}`} onClick={() => onEdit?.(credential)}>edit</button>
-      <button data-testid={`delete-${credential.credential_id}`} onClick={() => onDelete?.(credential)}>delete</button>
+      <button data-testid={`edit-${credential.credential_id}`} disabled={disabled || disableEdit} onClick={() => onEdit?.(credential)}>edit</button>
+      <button data-testid={`delete-${credential.credential_id}`} disabled={disabled || disableDelete} onClick={() => onDelete?.(credential)}>delete</button>
     </div>
   ),
 }))
@@ -87,6 +97,7 @@ describe('DropdownContent', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDeleteCredentialId = null
+    mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
   })
 
   describe('UsagePrioritySection visibility', () => {
@@ -362,6 +373,30 @@ describe('DropdownContent', () => {
         expect.objectContaining({ credential_id: 'cred-2' }),
       )
     })
+
+    it('should allow use-only users to switch credentials but not edit or delete them', () => {
+      mockWorkspacePermissionKeys = ['credential.use']
+
+      render(
+        <DropdownContent
+          provider={createProvider()}
+          state={createState()}
+          isChangingPriority={false}
+          onChangePriority={onChangePriority}
+          onClose={onClose}
+        />,
+      )
+
+      fireEvent.click(screen.getByTestId('click-cred-2'))
+      fireEvent.click(screen.getByTestId('edit-cred-2'))
+      fireEvent.click(screen.getByTestId('delete-cred-2'))
+
+      expect(mockActivate).toHaveBeenCalledWith(
+        expect.objectContaining({ credential_id: 'cred-2' }),
+      )
+      expect(mockHandleOpenModal).not.toHaveBeenCalled()
+      expect(mockOpenConfirmDelete).not.toHaveBeenCalled()
+    })
   })
 
   describe('Add API Key', () => {
@@ -386,6 +421,27 @@ describe('DropdownContent', () => {
       expect(mockHandleOpenModal).toHaveBeenCalledWith()
       expect(onClose).toHaveBeenCalled()
     })
+
+    it('should hide add action for use-only users', () => {
+      mockWorkspacePermissionKeys = ['credential.use']
+
+      render(
+        <DropdownContent
+          provider={createProvider({
+            custom_configuration: {
+              status: CustomConfigurationStatusEnum.noConfigure,
+              available_credentials: [],
+            },
+          })}
+          state={createState({ hasCredentials: false })}
+          isChangingPriority={false}
+          onChangePriority={onChangePriority}
+          onClose={onClose}
+        />,
+      )
+
+      expect(screen.queryByRole('button', { name: /addApiKey/ })).not.toBeInTheDocument()
+    })
   })
 
   describe('AlertDialog for delete confirmation', () => {
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/api-key-section.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/api-key-section.tsx
index 41645677b69..eba042cb48f 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/api-key-section.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/api-key-section.tsx
@@ -2,6 +2,8 @@ import type { Credential, CustomModel, ModelProvider } from '../../declarations'
 import { Button } from '@langgenius/dify-ui/button'
 import { memo } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
 import CredentialItem from '../../model-auth/authorized/credential-item'
 
 type ApiKeySectionProps = {
@@ -27,6 +29,8 @@ function ApiKeySection({
 }: ApiKeySectionProps) {
   const { t } = useTranslation()
   const notAllowCustomCredential = provider.allow_custom_token === false
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
 
   if (!credentials.length) {
     return (
@@ -41,7 +45,7 @@ function ApiKeySection({
             </div>
           </div>
         </div>
-        {!notAllowCustomCredential && (
+        {!notAllowCustomCredential && canManageCredential && (
           <Button
             onClick={onAdd}
             className="w-full"
@@ -59,7 +63,7 @@ function ApiKeySection({
         <div className="pt-3 pr-2 pb-1 pl-7 system-xs-medium-uppercase text-text-tertiary">
           {t('modelProvider.auth.apiKeys', { ns: 'common' })}
         </div>
-        <div className="max-h-[200px] overflow-y-auto">
+        <div className="max-h-50 overflow-y-auto">
           {credentials.map(credential => (
             <CredentialItem
               key={credential.credential_id}
@@ -70,11 +74,13 @@ function ApiKeySection({
               onItemClick={onItemClick}
               onEdit={onEdit}
               onDelete={onDelete}
+              disableEdit={!canManageCredential}
+              disableDelete={!canManageCredential}
             />
           ))}
         </div>
       </div>
-      {!notAllowCustomCredential && (
+      {!notAllowCustomCredential && canManageCredential && (
         <div className="p-2">
           <Button
             onClick={onAdd}
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-list-item.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-list-item.tsx
index 66a080015d7..7fda66c8e4f 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-list-item.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-list-item.tsx
@@ -13,6 +13,7 @@ import { useAppContext } from '@/context/app-context'
 import { useProviderContext, useProviderContextSelector } from '@/context/provider-context'
 import { consoleQuery } from '@/service/client'
 import { disableModel, enableModel } from '@/service/common'
+import { hasPermission } from '@/utils/permission'
 import { ModelStatusEnum } from '../declarations'
 import { useUpdateModelList } from '../hooks'
 import { ConfigModel } from '../model-auth'
@@ -31,7 +32,8 @@ const ModelListItem = ({ model, provider, isConfigurable, onChange, onModifyLoad
   const { t } = useTranslation()
   const { plan } = useProviderContext()
   const modelLoadBalancingEnabled = useProviderContextSelector(state => state.modelLoadBalancingEnabled)
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
+  const canManagePlugin = hasPermission(workspacePermissionKeys, 'plugin.manage')
   const queryClient = useQueryClient()
   const updateModelList = useUpdateModelList()
   const modelProviderModelListQueryKey = consoleQuery.modelProviders.models.queryKey({
@@ -86,12 +88,12 @@ const ModelListItem = ({ model, provider, isConfigurable, onChange, onModifyLoad
       </ModelName>
       <div className="flex shrink-0 items-center">
         {modelLoadBalancingEnabled && !model.deprecated && model.load_balancing_enabled && !model.has_invalid_load_balancing_configs && (
-          <Badge className="mr-1 h-[18px] w-[18px] items-center justify-center border-text-accent-secondary p-0">
+          <Badge className="mr-1 h-4.5 w-4.5 items-center justify-center border-text-accent-secondary p-0">
             <Balance className="size-3 text-text-accent-secondary" />
           </Badge>
         )}
         {
-          (isCurrentWorkspaceManager && (modelLoadBalancingEnabled || plan.type === Plan.sandbox) && !model.deprecated && [ModelStatusEnum.active, ModelStatusEnum.disabled].includes(model.status)) && (
+          (canManagePlugin && (modelLoadBalancingEnabled || plan.type === Plan.sandbox) && !model.deprecated && [ModelStatusEnum.active, ModelStatusEnum.disabled].includes(model.status)) && (
             <ConfigModel
               onClick={() => onModifyLoadBalancing?.(model)}
               loadBalancingEnabled={model.load_balancing_enabled}
@@ -110,7 +112,7 @@ const ModelListItem = ({ model, provider, isConfigurable, onChange, onModifyLoad
                   </PopoverContent>
                 </Popover>
               )
-            : (isCurrentWorkspaceManager && (
+            : (canManagePlugin && (
                 <Switch
                   className="ml-2"
                   checked={model?.status === ModelStatusEnum.active}
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-list.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-list.tsx
index 344d3de0f6a..9870950fe3e 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-list.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-list.tsx
@@ -4,17 +4,15 @@ import type {
   ModelItem,
   ModelProvider,
 } from '../declarations'
-import {
-  RiArrowRightSLine,
-} from '@remixicon/react'
 import { useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
 import {
   AddCustomModel,
   ManageCustomModelCredentials,
 } from '@/app/components/header/account-setting/model-provider-page/model-auth'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useModalContextSelector } from '@/context/modal-context'
+import { hasPermission } from '@/utils/permission'
 import {
   ConfigurationMethodEnum,
 } from '../declarations'
@@ -35,7 +33,8 @@ const ModelList: FC<ModelListProps> = ({
 }) => {
   const { t } = useTranslation()
   const configurativeMethods = provider.configurate_methods.filter(method => method !== ConfigurationMethodEnum.fetchFromRemote)
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canManagePlugins = hasPermission(workspacePermissionKeys, 'plugin.manage')
   const isConfigurable = configurativeMethods.includes(ConfigurationMethodEnum.customizableModel)
   const setShowModelLoadBalancingModal = useModalContextSelector(state => state.setShowModelLoadBalancingModal)
   const onModifyLoadBalancing = useCallback((model: ModelItem, credential?: Credential) => {
@@ -53,22 +52,22 @@ const ModelList: FC<ModelListProps> = ({
   return (
     <div className="rounded-b-xl px-2 pb-2">
       <div className="rounded-lg bg-components-panel-bg py-1">
-        <div className="flex items-center pr-[3px] pl-1">
+        <div className="flex items-center pr-0.75 pl-1">
           <span className="group mr-2 flex shrink-0 items-center">
             <span className="inline-flex h-6 items-center pr-1.5 pl-1 system-xs-medium text-text-tertiary group-hover:hidden">
               {t('modelProvider.modelsNum', { ns: 'common', num: models.length })}
-              <RiArrowRightSLine className="mr-0.5 size-4 rotate-90" />
+              <span className="mr-0.5 i-ri-arrow-right-s-line size-4 rotate-90" />
             </span>
             <span
               className="hidden h-6 cursor-pointer items-center rounded-lg bg-state-base-hover pr-1.5 pl-1 system-xs-medium text-text-tertiary group-hover:inline-flex"
               onClick={() => onCollapse()}
             >
               {t('modelProvider.modelsNum', { ns: 'common', num: models.length })}
-              <RiArrowRightSLine className="mr-0.5 size-4 rotate-90" />
+              <span className="mr-0.5 i-ri-arrow-right-s-line size-4 rotate-90" />
             </span>
           </span>
           {
-            isConfigurable && isCurrentWorkspaceManager && (
+            isConfigurable && canManagePlugins && (
               <div className="flex grow justify-end">
                 <ManageCustomModelCredentials
                   provider={provider}
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/provider-card-actions.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/provider-card-actions.tsx
index 94e290ea9c5..ae22c90588a 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/provider-card-actions.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/provider-card-actions.tsx
@@ -9,6 +9,7 @@ import Badge from '@/app/components/base/badge'
 import { HeaderModals } from '@/app/components/plugins/plugin-detail-panel/detail-header/components'
 import { useDetailHeaderState, usePluginOperations } from '@/app/components/plugins/plugin-detail-panel/detail-header/hooks'
 import OperationDropdown from '@/app/components/plugins/plugin-detail-panel/operation-dropdown'
+import { usePluginSettingsAccess } from '@/app/components/plugins/plugin-page/use-reference-setting'
 import { PluginSource } from '@/app/components/plugins/types'
 import PluginVersionPicker from '@/app/components/plugins/update-plugin/plugin-version-picker'
 import { useLocale } from '@/context/i18n'
@@ -24,6 +25,7 @@ const ProviderCardActions: FC<Props> = ({ detail, onUpdate }) => {
   const { t } = useTranslation()
   const { theme } = useTheme()
   const locale = useLocale()
+  const { canManagePlugin, canUpdatePlugin } = usePluginSettingsAccess()
 
   const { source, version, latest_version, latest_unique_identifier, meta } = detail
   const author = detail.declaration?.author ?? ''
@@ -47,6 +49,8 @@ const ProviderCardActions: FC<Props> = ({ detail, onUpdate }) => {
     modalStates,
     versionPicker,
     isFromMarketplace,
+    canManagePlugin,
+    canUpdatePlugin,
     onUpdate,
   })
 
@@ -77,7 +81,7 @@ const ProviderCardActions: FC<Props> = ({ detail, onUpdate }) => {
     <>
       {!!version && (
         <PluginVersionPicker
-          disabled={!isFromMarketplace}
+          disabled={!isFromMarketplace || !canUpdatePlugin}
           isShow={versionPicker.isShow}
           onShowChange={versionPicker.setIsShow}
           pluginID={detail.plugin_id}
@@ -88,13 +92,13 @@ const ProviderCardActions: FC<Props> = ({ detail, onUpdate }) => {
           trigger={(
             <Badge
               className={cn(
-                isFromMarketplace && 'cursor-pointer hover:bg-state-base-hover',
+                canUpdatePlugin && isFromMarketplace && 'cursor-pointer hover:bg-state-base-hover',
               )}
               uppercase={false}
               text={(
                 <>
                   <span>{version}</span>
-                  {isFromMarketplace && <span className="ml-1 i-ri-arrow-left-right-line size-3" />}
+                  {canUpdatePlugin && isFromMarketplace && <span className="ml-1 i-ri-arrow-left-right-line size-3" />}
                 </>
               )}
               hasRedCornerMark={hasNewVersion}
@@ -103,7 +107,7 @@ const ProviderCardActions: FC<Props> = ({ detail, onUpdate }) => {
         />
       )}
 
-      {(hasNewVersion || isFromGitHub) && (
+      {canUpdatePlugin && (hasNewVersion || isFromGitHub) && (
         <Tooltip>
           <TooltipTrigger
             delay={300}
@@ -132,6 +136,8 @@ const ProviderCardActions: FC<Props> = ({ detail, onUpdate }) => {
         detailUrl={detailUrl}
         placement="bottom-start"
         destructiveRemove
+        showCheckVersion={canUpdatePlugin}
+        showRemove={canManagePlugin}
       />
 
       <HeaderModals
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/quota-panel.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/quota-panel.tsx
index ecae5fc1818..6cf1b72113f 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/quota-panel.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/quota-panel.tsx
@@ -11,6 +11,8 @@ import * as React from 'react'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Loading from '@/app/components/base/loading'
+import { PluginInstallPermissionProvider } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import InstallFromMarketplace from '@/app/components/plugins/install-plugin/install-from-marketplace'
 import { IS_CLOUD_EDITION } from '@/config'
 import useTimestamp from '@/hooks/use-timestamp'
@@ -85,11 +87,12 @@ const QuotaPanel: FC<QuotaPanelProps> = ({
     setTrue: showInstallFromMarketplace,
     setFalse: hideInstallFromMarketplace,
   }] = useBoolean(false)
+  const { canInstallPlugin, canUpdatePlugin, currentDifyVersion } = useWorkspacePluginInstallPermission()
   const selectedPluginIdRef = useRef<string | null>(null)
 
   const handleIconClick = useCallback((key: ModelProviderQuotaGetPaid) => {
     const isInstalled = providerMap.get(key)
-    if (!isInstalled && allPlugins) {
+    if (!isInstalled && allPlugins && canInstallPlugin) {
       const pluginId = providerKeyToPluginId[key]
       const plugin = allPlugins.find(p => p.plugin_id === pluginId)
       if (plugin) {
@@ -98,7 +101,7 @@ const QuotaPanel: FC<QuotaPanelProps> = ({
         showInstallFromMarketplace()
       }
     }
-  }, [allPlugins, providerMap, showInstallFromMarketplace])
+  }, [allPlugins, canInstallPlugin, providerMap, showInstallFromMarketplace])
 
   useEffect(() => {
     if (isShowInstallModal && selectedPluginIdRef.current) {
@@ -178,7 +181,7 @@ const QuotaPanel: FC<QuotaPanelProps> = ({
                     aria-label={tooltipText}
                     render={(
                       <div
-                        className={cn('relative size-6', !providerType && 'cursor-pointer hover:opacity-80')}
+                        className={cn('relative size-6', !providerType && canInstallPlugin && 'cursor-pointer hover:opacity-80')}
                         onClick={() => handleIconClick(key)}
                       >
                         <Icon className="size-6 rounded-lg" />
@@ -197,13 +200,19 @@ const QuotaPanel: FC<QuotaPanelProps> = ({
           </div>
         </div>
       </div>
-      {isShowInstallModal && selectedPlugin && (
-        <InstallFromMarketplace
-          manifest={selectedPlugin}
-          uniqueIdentifier={selectedPlugin.latest_package_identifier}
-          onClose={hideInstallFromMarketplace}
-          onSuccess={hideInstallFromMarketplace}
-        />
+      {isShowInstallModal && selectedPlugin && canInstallPlugin && (
+        <PluginInstallPermissionProvider
+          canInstallPlugin={canInstallPlugin}
+          canUpdatePlugin={canUpdatePlugin}
+          currentDifyVersion={currentDifyVersion}
+        >
+          <InstallFromMarketplace
+            manifest={selectedPlugin}
+            uniqueIdentifier={selectedPlugin.latest_package_identifier}
+            onClose={hideInstallFromMarketplace}
+            onSuccess={hideInstallFromMarketplace}
+          />
+        </PluginInstallPermissionProvider>
       )}
     </div>
   )
diff --git a/web/app/components/header/account-setting/model-provider-page/system-model-selector/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/system-model-selector/__tests__/index.spec.tsx
index 43d16754c4c..f7111646e76 100644
--- a/web/app/components/header/account-setting/model-provider-page/system-model-selector/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/system-model-selector/__tests__/index.spec.tsx
@@ -32,11 +32,11 @@ const mockInvalidateDefaultModel = vi.hoisted(() => vi.fn())
 const mockUpdateDefaultModel = vi.hoisted(() => vi.fn(() => Promise.resolve({ result: 'success' })))
 const mockModelSelectorProps = vi.hoisted(() => [] as Array<{ hideProviderSettingsFooter?: boolean, onConfigureEmptyState?: () => void, showModelMeta?: boolean }>)
 
-let mockIsCurrentWorkspaceManager = true
+let mockWorkspacePermissionKeys = ['plugin.manage']
 
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
-    isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager,
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -108,7 +108,7 @@ describe('SystemModel', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockModelSelectorProps.length = 0
-    mockIsCurrentWorkspaceManager = true
+    mockWorkspacePermissionKeys = ['plugin.manage']
   })
 
   it('should render settings button', () => {
@@ -184,8 +184,8 @@ describe('SystemModel', () => {
     expect(mockUpdateModelList).not.toHaveBeenCalled()
   })
 
-  it('should disable save when user is not workspace manager', async () => {
-    mockIsCurrentWorkspaceManager = false
+  it('should disable save without plugin manage permission', async () => {
+    mockWorkspacePermissionKeys = []
     render(<SystemModel {...defaultProps} />)
 
     fireEvent.click(screen.getByRole('button', { name: /system model settings/i }))
diff --git a/web/app/components/header/account-setting/model-provider-page/system-model-selector/index.tsx b/web/app/components/header/account-setting/model-provider-page/system-model-selector/index.tsx
index 596c80b9d42..6ed2482b1fb 100644
--- a/web/app/components/header/account-setting/model-provider-page/system-model-selector/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/system-model-selector/index.tsx
@@ -18,6 +18,7 @@ import { Infotip } from '@/app/components/base/infotip'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import { updateDefaultModel } from '@/service/common'
+import { hasPermission } from '@/utils/permission'
 import { ModelTypeEnum } from '../declarations'
 import {
   useInvalidateDefaultModel,
@@ -65,8 +66,9 @@ const SystemModel: FC<SystemModelSelectorProps> = ({
   hideProviderSettingsFooter,
 }) => {
   const { t } = useTranslation()
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const { workspacePermissionKeys } = useAppContext()
   const { textGenerationModelList } = useProviderContext()
+  const canManageSystemDefaultModel = hasPermission(workspacePermissionKeys, 'plugin.manage')
   const updateModelList = useUpdateModelList()
   const invalidateDefaultModel = useInvalidateDefaultModel()
   const { data: embeddingModelList } = useModelList(ModelTypeEnum.textEmbedding)
@@ -258,7 +260,7 @@ const SystemModel: FC<SystemModelSelectorProps> = ({
               className="min-w-[72px]"
               variant="primary"
               onClick={handleSave}
-              disabled={!isCurrentWorkspaceManager}
+              disabled={!canManageSystemDefaultModel}
             >
               {t('operation.save', { ns: 'common' })}
             </Button>
diff --git a/web/app/components/header/account-setting/permission-group-list.tsx b/web/app/components/header/account-setting/permission-group-list.tsx
new file mode 100644
index 00000000000..462e0cd5223
--- /dev/null
+++ b/web/app/components/header/account-setting/permission-group-list.tsx
@@ -0,0 +1,190 @@
+'use client'
+
+import type { PermissionGroup } from '@/models/access-control'
+import { Checkbox } from '@langgenius/dify-ui/checkbox'
+import { cn } from '@langgenius/dify-ui/cn'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+
+type PermissionGroupListProps = {
+  groups: PermissionGroup[]
+  value: string[]
+  onChange: (next: string[]) => void
+  className?: string
+  readonly?: boolean
+}
+
+const PermissionGroupList = ({
+  groups,
+  value,
+  onChange,
+  className,
+  readonly = false,
+}: PermissionGroupListProps) => {
+  const { t } = useTranslation()
+  const [expandedGroupKeys, setExpandedGroupKeys] = useState<Set<string> | null>(null)
+
+  const selectedSet = useMemo(() => new Set(value), [value])
+
+  const defaultExpandedGroupKeys = useMemo(() => {
+    if (groups.length === 0)
+      return new Set<string>()
+    const firstSelectedGroup = groups.find(group =>
+      group.permissions.some(permission => selectedSet.has(permission.key)),
+    )
+    return new Set([(firstSelectedGroup ?? groups[0]!).group_key])
+  }, [groups, selectedSet])
+
+  const expandedGroupKeysMerged = expandedGroupKeys ?? defaultExpandedGroupKeys
+
+  const toggleGroupExpanded = (groupKey: string) => {
+    setExpandedGroupKeys((prev) => {
+      const next = new Set(prev ?? expandedGroupKeysMerged)
+      if (next.has(groupKey))
+        next.delete(groupKey)
+      else
+        next.add(groupKey)
+      return next
+    })
+  }
+
+  const togglePermission = (permissionKey: string) => {
+    if (readonly)
+      return
+
+    if (selectedSet.has(permissionKey))
+      onChange(value.filter(key => key !== permissionKey))
+    else
+      onChange([...value, permissionKey])
+  }
+
+  const toggleGroupSelection = (group: PermissionGroup, selectedCount: number) => {
+    if (readonly)
+      return
+
+    const permissionKeys = group.permissions.map(permission => permission.key)
+    if (selectedCount === permissionKeys.length) {
+      const groupPermissionKeySet = new Set(permissionKeys)
+      onChange(value.filter(key => !groupPermissionKeySet.has(key)))
+      return
+    }
+
+    const next = new Set(value)
+    permissionKeys.forEach(key => next.add(key))
+    onChange(Array.from(next))
+  }
+
+  return (
+    <div className={cn('min-h-0 flex-1 rounded-xl border border-components-panel-border bg-components-panel-bg shadow-xs', className)}>
+      <ScrollArea
+        className="h-full overflow-hidden rounded-xl"
+        slotClassNames={{
+          viewport: 'overscroll-contain',
+          content: groups.length === 0 ? 'h-full' : undefined,
+        }}
+      >
+        {groups.length === 0
+          ? (
+              <div className="flex h-full items-center justify-center px-3 py-6 text-center system-sm-regular text-text-tertiary">
+                {t('permissionList.noPermissionsFound', { ns: 'permission' })}
+              </div>
+            )
+          : (
+              <div className="flex flex-col">
+                {groups.map((group) => {
+                  const expanded = expandedGroupKeysMerged.has(group.group_key)
+                  const selectedCount = group.permissions.reduce(
+                    (count, permission) => count + (selectedSet.has(permission.key) ? 1 : 0),
+                    0,
+                  )
+                  const totalCount = group.permissions.length
+                  const allSelected = totalCount > 0 && selectedCount === totalCount
+
+                  return (
+                    <div key={group.group_key} className="border-b border-b-divider-subtle">
+                      <div className="group/permission-category flex h-12 w-full items-center gap-3 px-3 hover:bg-state-base-hover">
+                        <button
+                          type="button"
+                          className="min-w-0 flex-1 truncate text-left system-md-medium text-text-secondary focus-visible:outline-2 focus-visible:-outline-offset-2 focus-visible:outline-components-input-border-active"
+                          aria-expanded={expanded}
+                          onClick={() => toggleGroupExpanded(group.group_key)}
+                        >
+                          {group.group_name}
+                        </button>
+                        {!readonly && totalCount > 0 && (
+                          <button
+                            type="button"
+                            className="shrink-0 rounded-md px-1.5 py-0.5 system-sm-medium text-text-accent opacity-0 group-hover/permission-category:opacity-100 hover:bg-state-accent-hover focus-visible:opacity-100 focus-visible:outline-2 focus-visible:-outline-offset-2 focus-visible:outline-components-input-border-active"
+                            onClick={() => toggleGroupSelection(group, selectedCount)}
+                          >
+                            {allSelected
+                              ? t('permissionList.clearAll', { ns: 'permission' })
+                              : t('permissionList.selectAll', { ns: 'permission' })}
+                          </button>
+                        )}
+                        {selectedCount > 0 && (
+                          <span className="shrink-0 rounded-md bg-util-colors-blue-blue-100 px-2 py-0.5 system-sm-medium text-text-accent">
+                            {selectedCount}
+                            /
+                            {totalCount}
+                          </span>
+                        )}
+                        <button
+                          type="button"
+                          className="flex h-6 w-6 shrink-0 items-center justify-center focus-visible:outline-2 focus-visible:-outline-offset-2 focus-visible:outline-components-input-border-active"
+                          aria-label={expanded ? t('permissionList.collapseGroup', { ns: 'permission' }) : t('permissionList.expandGroup', { ns: 'permission' })}
+                          onClick={() => toggleGroupExpanded(group.group_key)}
+                        >
+                          <span
+                            aria-hidden
+                            className={cn(
+                              'i-ri-arrow-right-s-fill h-4 w-4 text-text-tertiary transition-transform',
+                              expanded && 'rotate-90',
+                            )}
+                          />
+                        </button>
+                      </div>
+                      {expanded && (
+                        <div className="flex flex-col">
+                          {group.permissions.map((permission) => {
+                            const checked = selectedSet.has(permission.key)
+
+                            return (
+                              <div
+                                key={permission.key}
+                                className={cn(
+                                  'flex min-h-9 items-center gap-3 px-3 py-1.5',
+                                  readonly ? 'cursor-default' : 'cursor-pointer hover:bg-state-base-hover',
+                                  checked && 'bg-state-accent-hover',
+                                  checked && !readonly && 'hover:bg-state-accent-hover',
+                                )}
+                                onClick={() => togglePermission(permission.key)}
+                              >
+                                <Checkbox
+                                  checked={checked}
+                                  disabled={readonly}
+                                  className="shrink-0"
+                                  onCheckedChange={() => {
+                                    togglePermission(permission.key)
+                                  }}
+                                />
+                                <span className="min-w-0 flex-1 truncate system-md-regular text-text-secondary">
+                                  {permission.name}
+                                </span>
+                              </div>
+                            )
+                          })}
+                        </div>
+                      )}
+                    </div>
+                  )
+                })}
+              </div>
+            )}
+      </ScrollArea>
+    </div>
+  )
+}
+
+export default PermissionGroupList
diff --git a/web/app/components/header/account-setting/permissions-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/permissions-page/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..b37c07d1054
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/__tests__/index.spec.tsx
@@ -0,0 +1,230 @@
+import type { AppContextValue } from '@/context/app-context'
+import type { Role } from '@/models/access-control'
+import { toast } from '@langgenius/dify-ui/toast'
+import { render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { useSelector as useAppContextSelector } from '@/context/app-context'
+import { useCreateWorkspaceRole, useUpdateWorkspaceRole } from '@/service/access-control/use-workspace-roles'
+import { useRoleGroups } from '../hooks'
+import PermissionsPage from '../index'
+
+const mocks = vi.hoisted(() => ({
+  workspacePermissionKeys: [] as string[],
+  createWorkspaceRole: vi.fn(),
+  updateWorkspaceRole: vi.fn(),
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    success: vi.fn(),
+  },
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn((selector: (state: AppContextValue) => unknown) => selector({
+    workspacePermissionKeys: mocks.workspacePermissionKeys,
+  } as AppContextValue)),
+}))
+
+vi.mock('@/service/access-control/use-workspace-roles', () => ({
+  useCreateWorkspaceRole: vi.fn(),
+  useUpdateWorkspaceRole: vi.fn(),
+}))
+
+vi.mock('../hooks', () => ({
+  useRoleGroups: vi.fn(),
+}))
+
+vi.mock('../role-list', () => ({
+  default: ({
+    groups,
+    isLoading,
+    isFetchingNextPage,
+    onView,
+    onEdit,
+  }: {
+    groups: Array<{ items: Role[] }>
+    isLoading?: boolean
+    isFetchingNextPage?: boolean
+    onView: (role: Role) => void
+    onEdit: (role: Role) => void
+  }) => {
+    const role = groups[0]?.items[0]
+
+    return (
+      <div>
+        {isLoading && <span>initial role loading</span>}
+        {isFetchingNextPage && <span>next role page loading</span>}
+        {role && (
+          <>
+            <span>{role.name}</span>
+            <button type="button" onClick={() => onView(role)}>view role</button>
+            <button type="button" onClick={() => onEdit(role)}>edit role</button>
+          </>
+        )}
+      </div>
+    )
+  },
+}))
+
+vi.mock('../role-modal', () => ({
+  default: ({
+    mode,
+    role,
+    onSubmit,
+  }: {
+    mode: string
+    role?: Role
+    onSubmit: (data: { name: string, description: string, permissionKeys: string[] }) => void
+  }) => (
+    <div role="dialog" aria-label={`${mode} role`}>
+      <span>{role?.name}</span>
+      <button
+        type="button"
+        onClick={() => onSubmit({
+          name: `${mode} name`,
+          description: `${mode} description`,
+          permissionKeys: ['workspace.member.manage'],
+        })}
+      >
+        submit role
+      </button>
+    </div>
+  ),
+}))
+
+const role: Role = {
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_custom',
+  name: 'Custom manager',
+  description: 'Can manage workspace members',
+  is_builtin: false,
+  permission_keys: ['workspace.member.manage'],
+  role_tag: '',
+}
+
+const mockMutation = (mock: ReturnType<typeof vi.fn>) => {
+  mock.mockImplementation((_payload, options) => {
+    options?.onSuccess?.()
+    return Promise.resolve()
+  })
+
+  return { mutateAsync: mock }
+}
+
+const renderPermissionsPage = () => {
+  const containerRef = {
+    current: document.createElement('div'),
+  }
+
+  Object.defineProperty(containerRef.current, 'clientHeight', {
+    configurable: true,
+    value: 800,
+  })
+
+  return render(<PermissionsPage containerRef={containerRef} />)
+}
+
+describe('PermissionsPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.workspacePermissionKeys = []
+    vi.mocked(useAppContextSelector).mockImplementation((selector: (state: AppContextValue) => unknown) => selector({
+      workspacePermissionKeys: mocks.workspacePermissionKeys,
+    } as AppContextValue))
+    vi.mocked(useRoleGroups).mockReturnValue({
+      roleGroups: [{
+        id: 'global_custom',
+        category: 'global_custom',
+        title: 'Custom roles',
+        items: [role],
+      }],
+      isLoading: false,
+      isFetchingNextPage: false,
+      fetchNextPage: vi.fn(),
+      hasNextPage: false,
+      error: null,
+    } as ReturnType<typeof useRoleGroups>)
+    vi.mocked(useCreateWorkspaceRole).mockReturnValue(mockMutation(mocks.createWorkspaceRole) as unknown as ReturnType<typeof useCreateWorkspaceRole>)
+    vi.mocked(useUpdateWorkspaceRole).mockReturnValue(mockMutation(mocks.updateWorkspaceRole) as unknown as ReturnType<typeof useUpdateWorkspaceRole>)
+  })
+
+  it('hides role creation without workspace role manage permission', () => {
+    renderPermissionsPage()
+
+    expect(screen.queryByRole('button', { name: 'permission.role.addRole' })).not.toBeInTheDocument()
+    expect(screen.getByText('Custom manager')).toBeInTheDocument()
+  })
+
+  it('renders the workspace roles summary with the compact scheme bar style', () => {
+    renderPermissionsPage()
+
+    const title = screen.getByText('permission.role.workspaceRoles.title')
+    const description = screen.getByText('permission.role.workspaceRoles.description')
+    const schemeBar = title.parentElement?.parentElement as HTMLElement
+
+    expect(schemeBar).toHaveClass(
+      'min-h-[67px]',
+      'overflow-hidden',
+      'rounded-xl',
+      'border-divider-regular',
+      'px-4',
+      'py-3',
+    )
+    expect(title).toHaveClass('truncate', 'system-md-semibold', 'text-text-secondary')
+    expect(description).toHaveClass('truncate', 'system-xs-regular', 'text-text-tertiary')
+  })
+
+  it('passes role loading states to the role list', () => {
+    vi.mocked(useRoleGroups).mockReturnValue({
+      roleGroups: [],
+      isLoading: true,
+      isFetchingNextPage: true,
+      fetchNextPage: vi.fn(),
+      hasNextPage: true,
+      error: null,
+    } as ReturnType<typeof useRoleGroups>)
+
+    renderPermissionsPage()
+
+    expect(screen.getByText('initial role loading')).toBeInTheDocument()
+    expect(screen.getByText('next role page loading')).toBeInTheDocument()
+  })
+
+  it('creates workspace roles when role management is allowed', async () => {
+    mocks.workspacePermissionKeys = ['workspace.role.manage']
+
+    renderPermissionsPage()
+
+    await userEvent.click(screen.getByRole('button', { name: 'permission.role.addRole' }))
+    expect(screen.getByRole('dialog', { name: 'create role' })).toBeInTheDocument()
+    await userEvent.click(screen.getByRole('button', { name: 'submit role' }))
+
+    expect(mocks.createWorkspaceRole).toHaveBeenCalledWith({
+      name: 'create name',
+      description: 'create description',
+      permission_keys: ['workspace.member.manage'],
+    }, expect.any(Object))
+    expect(toast.success).toHaveBeenCalledWith('permission.role.created')
+  })
+
+  it('updates the selected workspace role from the edit modal', async () => {
+    renderPermissionsPage()
+
+    await userEvent.click(screen.getByRole('button', { name: 'edit role' }))
+    const dialog = screen.getByRole('dialog', { name: 'edit role' })
+    expect(dialog).toBeInTheDocument()
+    expect(within(dialog).getByText('Custom manager')).toBeInTheDocument()
+    await userEvent.click(screen.getByRole('button', { name: 'submit role' }))
+
+    expect(mocks.updateWorkspaceRole).toHaveBeenCalledWith({
+      id: 'role-1',
+      name: 'edit name',
+      description: 'edit description',
+      permission_keys: ['workspace.member.manage'],
+    }, expect.any(Object))
+    expect(toast.success).toHaveBeenCalledWith('permission.role.updated')
+  })
+})
diff --git a/web/app/components/header/account-setting/permissions-page/helpers.ts b/web/app/components/header/account-setting/permissions-page/helpers.ts
new file mode 100644
index 00000000000..f302814fb63
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/helpers.ts
@@ -0,0 +1,29 @@
+import type { InfiniteData } from '@tanstack/react-query'
+import type { RoleListGroup } from './role-list'
+import type { RoleListResponse } from '@/models/access-control'
+
+export const formatRoleGroups = (roleListResponse: InfiniteData<RoleListResponse> | undefined): RoleListGroup[] => {
+  if (!roleListResponse)
+    return []
+  const roles = roleListResponse.pages.flatMap(page => page.data)
+  const result: RoleListGroup[] = []
+  const builtinRoles = roles.filter(role => role.is_builtin)
+  const customRoles = roles.filter(role => !role.is_builtin)
+  if (builtinRoles.length > 0) {
+    result.push({
+      id: 'builtin',
+      category: 'global_system_default',
+      title: 'System Roles',
+      items: builtinRoles,
+    })
+  }
+  if (customRoles.length > 0) {
+    result.push({
+      id: 'custom',
+      category: 'global_custom',
+      title: 'Custom Roles',
+      items: customRoles,
+    })
+  }
+  return result
+}
diff --git a/web/app/components/header/account-setting/permissions-page/hooks.ts b/web/app/components/header/account-setting/permissions-page/hooks.ts
new file mode 100644
index 00000000000..19185eff73a
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/hooks.ts
@@ -0,0 +1,26 @@
+import type { RoleListRequest } from '@/models/access-control'
+import { useMemo } from 'react'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
+import { formatRoleGroups } from './helpers'
+
+export const useRoleGroups = (params: RoleListRequest) => {
+  const {
+    data: roleList,
+    isFetchingNextPage,
+    isLoading,
+    fetchNextPage,
+    hasNextPage,
+    error,
+  } = useWorkspaceRoleList(params)
+
+  const roleGroups = useMemo(() => formatRoleGroups(roleList), [roleList])
+
+  return {
+    roleGroups,
+    isFetchingNextPage,
+    isLoading,
+    fetchNextPage,
+    hasNextPage,
+    error,
+  }
+}
diff --git a/web/app/components/header/account-setting/permissions-page/index.tsx b/web/app/components/header/account-setting/permissions-page/index.tsx
new file mode 100644
index 00000000000..e5d3408106d
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/index.tsx
@@ -0,0 +1,170 @@
+'use client'
+
+import type { RoleModalMode, submitRoleData } from './role-modal'
+import type { Role } from '@/models/access-control'
+import { Button } from '@langgenius/dify-ui/button'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { useLocale } from '@/context/i18n'
+import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
+import { useCreateWorkspaceRole, useUpdateWorkspaceRole } from '@/service/access-control/use-workspace-roles'
+import { hasPermission } from '@/utils/permission'
+import { useRoleGroups } from './hooks'
+import RoleList from './role-list'
+import RoleModal from './role-modal'
+
+type PermissionsPageProps = {
+  containerRef: React.RefObject<HTMLDivElement | null>
+}
+
+type ModalState = {
+  mode: RoleModalMode
+  role?: Role
+} | null
+
+const PAGE_SIZE = 20
+
+const PermissionsPage = ({ containerRef }: PermissionsPageProps) => {
+  const { t } = useTranslation()
+  const locale = useLocale()
+  const [modalState, setModalState] = useState<ModalState>(null)
+  const anchorRef = useRef<HTMLDivElement>(null)
+
+  const workspacePermissionKeys = useAppContextWithSelector(s => s.workspacePermissionKeys)
+
+  const language = useMemo(() => getAccessControlTemplateLanguage(locale), [locale])
+
+  const {
+    roleGroups,
+    isLoading,
+    isFetchingNextPage,
+    fetchNextPage,
+    hasNextPage,
+    error,
+  } = useRoleGroups({
+    page: 1,
+    limit: PAGE_SIZE,
+    include_owner: 1,
+    language,
+  })
+
+  const { mutateAsync: createWorkspaceRole } = useCreateWorkspaceRole()
+  const { mutateAsync: updateWorkspaceRole } = useUpdateWorkspaceRole()
+
+  const openCreate = useCallback(() => {
+    setModalState({ mode: 'create' })
+  }, [])
+
+  const handleView = useCallback((role: Role) => {
+    setModalState({ mode: 'view', role })
+  }, [])
+
+  const handleEdit = useCallback((role: Role) => {
+    setModalState({ mode: 'edit', role })
+  }, [])
+
+  const closeModal = useCallback(() => setModalState(null), [])
+
+  const handleSubmit = useCallback(
+    (data: submitRoleData) => {
+      const { name, description, permissionKeys } = data
+      const mode = modalState?.mode ?? ''
+      const roleId = modalState?.role?.id ?? ''
+      if (mode === 'create') {
+        createWorkspaceRole({ name, description, permission_keys: permissionKeys }, {
+          onSuccess: () => {
+            toast.success(t('role.created', { ns: 'permission' }))
+            closeModal()
+          },
+        })
+      }
+      else if (mode === 'edit') {
+        updateWorkspaceRole({ id: roleId, name, description, permission_keys: permissionKeys }, {
+          onSuccess: () => {
+            toast.success(t('role.updated', { ns: 'permission' }))
+            closeModal()
+          },
+        })
+      }
+    },
+    [createWorkspaceRole, updateWorkspaceRole, closeModal, modalState, t],
+  )
+
+  useEffect(() => {
+    const hasMore = hasNextPage ?? true
+    let observer: IntersectionObserver | undefined
+
+    if (error) {
+      if (observer)
+        observer.disconnect()
+      return
+    }
+
+    if (anchorRef.current && containerRef.current) {
+      const containerHeight = containerRef.current.clientHeight
+      const dynamicMargin = Math.max(100, Math.min(containerHeight * 0.2, 200))
+
+      observer = new IntersectionObserver((entries) => {
+        if (entries[0]!.isIntersecting && !isLoading && !isFetchingNextPage && !error && hasMore)
+          fetchNextPage()
+      }, {
+        root: containerRef.current,
+        rootMargin: `${dynamicMargin}px`,
+      })
+      observer.observe(anchorRef.current)
+    }
+    return () => observer?.disconnect()
+  }, [isLoading, isFetchingNextPage, fetchNextPage, error, hasNextPage, containerRef])
+
+  const canManageRoles = hasPermission(workspacePermissionKeys, 'workspace.role.manage')
+
+  return (
+    <>
+      <div className="flex min-w-0 flex-col gap-y-6">
+        <div className="flex min-h-[67px] min-w-0 items-center gap-3 overflow-hidden rounded-xl border-t-[0.5px] border-l-[0.5px] border-divider-regular bg-linear-to-b from-background-gradient-bg-fill-chat-bg-2 to-background-gradient-bg-fill-chat-bg-1 px-4 py-3">
+          <div className="flex min-w-0 grow flex-col gap-y-1 overflow-hidden">
+            <div className="truncate system-md-semibold text-text-secondary">
+              {t('role.workspaceRoles.title', { ns: 'permission' })}
+            </div>
+            <div className="truncate system-xs-regular text-text-tertiary">
+              {t('role.workspaceRoles.description', { ns: 'permission' })}
+            </div>
+          </div>
+          {canManageRoles && (
+            <div className="flex shrink-0 items-center">
+              <Button
+                variant="primary"
+                size="small"
+                onClick={openCreate}
+                disabled={isLoading}
+              >
+                {t('role.addRole', { ns: 'permission' })}
+              </Button>
+            </div>
+          )}
+        </div>
+        <RoleList
+          groups={roleGroups}
+          isLoading={isLoading}
+          isFetchingNextPage={isFetchingNextPage}
+          onView={handleView}
+          onEdit={handleEdit}
+        />
+        <div ref={anchorRef} className="h-0" />
+      </div>
+      {modalState && (
+        <RoleModal
+          mode={modalState?.mode ?? 'create'}
+          open
+          role={modalState?.role}
+          onClose={closeModal}
+          onSubmit={handleSubmit}
+        />
+      )}
+    </>
+  )
+}
+
+export default PermissionsPage
diff --git a/web/app/components/header/account-setting/permissions-page/role-list/__tests__/index.spec.tsx b/web/app/components/header/account-setting/permissions-page/role-list/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..c789b163b19
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-list/__tests__/index.spec.tsx
@@ -0,0 +1,184 @@
+import type { Role } from '@/models/access-control'
+import { render, screen } from '@testing-library/react'
+import RoleList from '../index'
+
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['workspace.role.manage'] as string[],
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
+
+vi.mock('@/service/access-control/use-workspace-roles', () => ({
+  useCopyWorkspaceRole: () => ({
+    mutateAsync: vi.fn(),
+  }),
+  useDeleteWorkspaceRole: () => ({
+    mutateAsync: vi.fn(),
+    isPending: false,
+  }),
+  useGetMembersOfRole: () => ({
+    data: {
+      data: [],
+      pagination: {
+        total_count: 0,
+        per_page: 1,
+        current_page: 1,
+        total_pages: 1,
+      },
+    },
+    isPending: false,
+  }),
+}))
+
+const createRole = (overrides: Partial<Role> = {}): Role => ({
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_system_default',
+  name: 'Owner',
+  description: 'Full access to all workspace features and settings',
+  is_builtin: true,
+  permission_keys: [],
+  role_tag: '',
+  ...overrides,
+})
+
+describe('RoleList', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockWorkspacePermissionKeys.value = ['workspace.role.manage']
+  })
+
+  describe('Rendering', () => {
+    it('shows a loading status while the first page is loading', () => {
+      render(
+        <RoleList
+          groups={[]}
+          isLoading
+        />,
+      )
+
+      expect(screen.getByRole('status', { name: 'appApi.loading' })).toBeInTheDocument()
+      expect(screen.queryByText(/permission\.role\.groups/)).not.toBeInTheDocument()
+    })
+
+    it('renders role groups with compact section labels', () => {
+      render(
+        <RoleList
+          groups={[
+            {
+              id: 'builtin',
+              category: 'global_system_default',
+              title: 'System Roles',
+              items: [createRole()],
+            },
+            {
+              id: 'custom',
+              category: 'global_custom',
+              title: 'Custom Roles',
+              items: [createRole({
+                id: 'role-custom',
+                category: 'global_custom',
+                name: 'Executive',
+                description: 'Unrestricted access to all workspace operations',
+                is_builtin: false,
+              })],
+            },
+          ]}
+        />,
+      )
+
+      const systemLabel = screen.getByText(/permission\.role\.groups\.builtin/)
+      const customLabel = screen.getByText(/permission\.role\.groups\.custom/)
+
+      expect(systemLabel).toHaveClass('min-h-6', 'system-sm-medium', 'text-text-secondary')
+      expect(customLabel).toHaveClass('min-h-6', 'system-sm-medium', 'text-text-secondary')
+      expect(screen.getByText('Owner')).toBeInTheDocument()
+      expect(screen.getByText('Executive')).toBeInTheDocument()
+    })
+
+    it('shows a bottom loading status while fetching the next page', () => {
+      render(
+        <RoleList
+          groups={[
+            {
+              id: 'builtin',
+              category: 'global_system_default',
+              title: 'System Roles',
+              items: [createRole()],
+            },
+          ]}
+          isFetchingNextPage
+        />,
+      )
+
+      expect(screen.getByText('Owner')).toBeInTheDocument()
+      expect(screen.getByRole('status', { name: 'appApi.loading' })).toBeInTheDocument()
+    })
+  })
+
+  describe('Row Styles', () => {
+    it('renders rows as divided hoverable list items', () => {
+      render(
+        <RoleList
+          groups={[
+            {
+              id: 'builtin',
+              category: 'global_system_default',
+              title: 'System Roles',
+              items: [createRole()],
+            },
+          ]}
+        />,
+      )
+
+      const name = screen.getByText('Owner')
+      const row = name.closest('.border-b')
+
+      expect(row).toHaveClass(
+        'border-b',
+        'border-divider-regular',
+        'px-3',
+        'py-3.5',
+        'hover:bg-background-default-hover',
+      )
+      expect(name).toHaveClass('truncate', 'system-sm-semibold', 'text-text-primary')
+      expect(screen.getByText('Full access to all workspace features and settings')).toHaveClass(
+        'truncate',
+        'system-xs-regular',
+        'text-text-secondary',
+      )
+    })
+
+    it('uses the no-description fallback with the row description style', () => {
+      render(
+        <RoleList
+          groups={[
+            {
+              id: 'custom',
+              category: 'global_custom',
+              title: 'Custom Roles',
+              items: [createRole({
+                id: 'role-custom',
+                category: 'global_custom',
+                name: 'Partner',
+                description: '',
+                is_builtin: false,
+              })],
+            },
+          ]}
+        />,
+      )
+
+      expect(screen.getByText('permission.role.noDescription')).toHaveClass(
+        'truncate',
+        'system-xs-regular',
+        'text-text-secondary',
+      )
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/permissions-page/role-list/__tests__/row-menu.spec.tsx b/web/app/components/header/account-setting/permissions-page/role-list/__tests__/row-menu.spec.tsx
new file mode 100644
index 00000000000..90558b49896
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-list/__tests__/row-menu.spec.tsx
@@ -0,0 +1,291 @@
+import type { Role } from '@/models/access-control'
+import { fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import RowMenu from '../row-menu'
+
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['workspace.role.manage'] as string[],
+}))
+
+const mockCopyRole = vi.hoisted(() => vi.fn((_variables, options?: { onSuccess?: () => void }) => {
+  options?.onSuccess?.()
+}))
+const mockDeleteRole = vi.hoisted(() => vi.fn())
+const membersOfRoleQueryMock = vi.hoisted(() => {
+  const response = {
+    data: [],
+    pagination: {
+      total_count: 3,
+      per_page: 1,
+      current_page: 1,
+      total_pages: 3,
+    },
+  }
+
+  return {
+    useGetMembersOfRole: vi.fn(() => ({
+      data: response,
+      isPending: false,
+    })),
+  }
+})
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
+
+vi.mock('@/service/access-control/use-workspace-roles', () => ({
+  useCopyWorkspaceRole: () => ({
+    mutate: mockCopyRole,
+    isPending: false,
+  }),
+  useDeleteWorkspaceRole: () => ({
+    mutateAsync: mockDeleteRole,
+    isPending: false,
+  }),
+  useGetMembersOfRole: membersOfRoleQueryMock.useGetMembersOfRole,
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    success: vi.fn(),
+  },
+}))
+
+const createRole = (overrides: Partial<Role> = {}): Role => ({
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_system_default',
+  name: 'Owner',
+  description: 'Workspace owner',
+  is_builtin: true,
+  permission_keys: [],
+  role_tag: '',
+  ...overrides,
+})
+
+const openMenu = async () => {
+  const user = userEvent.setup()
+  await user.click(screen.getByRole('button', { name: 'common.operation.moreActions' }))
+  const menus = screen.getAllByRole('menu')
+  return {
+    user,
+    menu: menus[menus.length - 1]!,
+  }
+}
+
+describe('RowMenu', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    document.body.querySelectorAll('[role="menu"], [role="menuitem"]').forEach(element => element.remove())
+    mockWorkspacePermissionKeys.value = ['workspace.role.manage']
+  })
+
+  afterEach(() => {
+    document.body.querySelectorAll('[role="menu"], [role="menuitem"]').forEach(element => element.remove())
+  })
+
+  describe('Rendering', () => {
+    it('should render view action for the owner system role', async () => {
+      render(
+        <RowMenu
+          roleCategory="global_system_default"
+          role={createRole({ role_tag: 'owner' })}
+        />,
+      )
+
+      const { menu } = await openMenu()
+
+      expect(within(menu).getByRole('menuitem', { name: 'common.operation.view' })).toBeInTheDocument()
+      expect(within(menu).getByRole('menuitem', { name: 'permission.common.duplicateAction' })).toBeInTheDocument()
+      expect(within(menu).queryByRole('menuitem', { name: 'common.operation.edit' })).not.toBeInTheDocument()
+      expect(within(menu).queryByRole('menuitem', { name: 'common.operation.delete' })).not.toBeInTheDocument()
+    })
+
+    it('should render view action for non-owner system roles', async () => {
+      render(
+        <RowMenu
+          roleCategory="global_system_default"
+          role={createRole({ id: 'role-editor', name: 'Editor' })}
+        />,
+      )
+
+      const { menu } = await openMenu()
+
+      expect(within(menu).getByRole('menuitem', { name: 'common.operation.view' })).toBeInTheDocument()
+      expect(within(menu).queryByRole('menuitem', { name: 'common.operation.edit' })).not.toBeInTheDocument()
+    })
+
+    it('should hide view action for custom roles', async () => {
+      render(
+        <RowMenu
+          roleCategory="global_custom"
+          role={createRole({
+            id: 'role-custom',
+            category: 'global_custom',
+            name: 'Custom role',
+            is_builtin: false,
+          })}
+        />,
+      )
+
+      const { menu } = await openMenu()
+
+      expect(within(menu).queryByRole('menuitem', { name: 'common.operation.view' })).not.toBeInTheDocument()
+      expect(within(menu).getByRole('menuitem', { name: 'common.operation.edit' })).toBeInTheDocument()
+      expect(within(menu).getByRole('menuitem', { name: 'permission.common.duplicateAction' })).toBeInTheDocument()
+      expect(within(menu).getByRole('menuitem', { name: 'common.operation.delete' })).toBeInTheDocument()
+    })
+
+    it('should keep custom role management actions visible without manage permission', async () => {
+      mockWorkspacePermissionKeys.value = []
+
+      render(
+        <RowMenu
+          roleCategory="global_custom"
+          role={createRole({
+            id: 'role-custom',
+            category: 'global_custom',
+            name: 'Custom role',
+            is_builtin: false,
+          })}
+        />,
+      )
+
+      const { menu } = await openMenu()
+
+      expect(within(menu).getByRole('menuitem', { name: 'common.operation.edit' })).toHaveAttribute('aria-disabled', 'true')
+      expect(within(menu).getByRole('menuitem', { name: 'permission.common.duplicateAction' })).toHaveAttribute('aria-disabled', 'true')
+      expect(within(menu).getByRole('menuitem', { name: 'common.operation.delete' })).toHaveAttribute('aria-disabled', 'true')
+    })
+  })
+
+  describe('User Interactions', () => {
+    it('should call onView when clicking the owner view action', async () => {
+      const onView = vi.fn()
+      const role = createRole({ role_tag: 'owner' })
+      render(
+        <RowMenu
+          roleCategory="global_system_default"
+          role={role}
+          onView={onView}
+        />,
+      )
+
+      const { user, menu } = await openMenu()
+      await user.click(within(menu).getByRole('menuitem', { name: 'common.operation.view' }))
+
+      expect(onView).toHaveBeenCalledTimes(1)
+      expect(onView).toHaveBeenCalledWith(role)
+    })
+
+    it('should ask before duplicating a system role and skipping member assignments', async () => {
+      const role = createRole({ id: 'role-default-editor', name: 'Editor' })
+      render(
+        <RowMenu
+          roleCategory="global_system_default"
+          role={role}
+        />,
+      )
+
+      const { user, menu } = await openMenu()
+      await user.click(within(menu).getByRole('menuitem', { name: 'permission.common.duplicateAction' }))
+
+      const dialog = screen.getByRole('alertdialog')
+      expect(dialog).toHaveTextContent('permission.role.copyMembersTitle')
+      expect(dialog).toHaveTextContent('permission.role.copyMembersDescription:{"name":"Editor","count":3}')
+      expect(membersOfRoleQueryMock.useGetMembersOfRole).toHaveBeenCalledWith({
+        roleId: role.id,
+        page: 1,
+        limit: 9999,
+      })
+
+      await user.click(within(dialog).getByRole('button', { name: 'common.operation.skip' }))
+
+      expect(mockCopyRole).toHaveBeenCalledTimes(1)
+      expect(mockCopyRole).toHaveBeenCalledWith({
+        roleId: role.id,
+        copy_member: false,
+      }, expect.objectContaining({
+        onSuccess: expect.any(Function),
+      }))
+    })
+
+    it('should copy member assignments when confirming duplicate with copy', async () => {
+      const role = createRole({ id: 'role-custom', category: 'global_custom', name: 'Support', is_builtin: false })
+      render(
+        <RowMenu
+          roleCategory="global_custom"
+          role={role}
+        />,
+      )
+
+      const { user, menu } = await openMenu()
+      await user.click(within(menu).getByRole('menuitem', { name: 'permission.common.duplicateAction' }))
+      const dialog = screen.getByRole('alertdialog')
+
+      await user.click(within(dialog).getByRole('button', { name: 'common.operation.copy' }))
+
+      expect(mockCopyRole).toHaveBeenCalledTimes(1)
+      expect(mockCopyRole).toHaveBeenCalledWith({
+        roleId: role.id,
+        copy_member: true,
+      }, expect.objectContaining({
+        onSuccess: expect.any(Function),
+      }))
+    })
+
+    it('should close the copy member assignments dialog when clicking the backdrop', async () => {
+      render(
+        <RowMenu
+          roleCategory="global_system_default"
+          role={createRole({ id: 'role-default-editor', name: 'Editor' })}
+        />,
+      )
+
+      const { user, menu } = await openMenu()
+      await user.click(within(menu).getByRole('menuitem', { name: 'permission.common.duplicateAction' }))
+
+      expect(screen.getByRole('alertdialog')).toBeInTheDocument()
+
+      const backdrop = document.body.querySelector('.bg-background-overlay')
+      expect(backdrop).toBeInTheDocument()
+      fireEvent.click(backdrop!)
+
+      await waitFor(() => {
+        expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
+      })
+    })
+
+    it('should ignore role management actions without manage permission', async () => {
+      mockWorkspacePermissionKeys.value = []
+      const onEdit = vi.fn()
+      const role = createRole({
+        id: 'role-custom',
+        category: 'global_custom',
+        name: 'Custom role',
+        is_builtin: false,
+      })
+      render(
+        <RowMenu
+          roleCategory="global_custom"
+          role={role}
+          onEdit={onEdit}
+        />,
+      )
+
+      const { menu } = await openMenu()
+
+      fireEvent.click(within(menu).getByRole('menuitem', { name: 'common.operation.edit' }))
+      fireEvent.click(within(menu).getByRole('menuitem', { name: 'permission.common.duplicateAction' }))
+      fireEvent.click(within(menu).getByRole('menuitem', { name: 'common.operation.delete' }))
+
+      expect(onEdit).not.toHaveBeenCalled()
+      expect(mockCopyRole).not.toHaveBeenCalled()
+      expect(mockDeleteRole).not.toHaveBeenCalled()
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/permissions-page/role-list/copy-members-confirm-dialog.tsx b/web/app/components/header/account-setting/permissions-page/role-list/copy-members-confirm-dialog.tsx
new file mode 100644
index 00000000000..59a347553a7
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-list/copy-members-confirm-dialog.tsx
@@ -0,0 +1,82 @@
+'use client'
+
+import type { Role } from '@/models/access-control'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { Button } from '@langgenius/dify-ui/button'
+import { useTranslation } from 'react-i18next'
+import { useGetMembersOfRole } from '@/service/access-control/use-workspace-roles'
+
+type CopyMembersConfirmDialogProps = {
+  role: Role
+  isCopyingRole: boolean
+  onOpenChange: (open: boolean) => void
+  onDuplicate: (copyMember: boolean) => void
+}
+
+export function CopyMembersConfirmDialog({
+  role,
+  isCopyingRole,
+  onOpenChange,
+  onDuplicate,
+}: CopyMembersConfirmDialogProps) {
+  const { t } = useTranslation()
+  const { data: membersOfRole, isPending: isLoadingMembersOfRole } = useGetMembersOfRole({
+    roleId: role.id,
+    page: 1,
+    limit: 9999,
+  })
+  const memberCount = membersOfRole?.pagination.total_count ?? 0
+  const isLoadingMemberCount = isLoadingMembersOfRole && !membersOfRole
+  const isActionDisabled = isCopyingRole || isLoadingMemberCount
+
+  return (
+    <AlertDialog open onOpenChange={onOpenChange}>
+      <AlertDialogContent
+        backdropProps={{
+          forceRender: true,
+          onClick: () => onOpenChange(false),
+        }}
+      >
+        <div className="flex flex-col gap-2 px-6 pt-6 pb-4">
+          <AlertDialogTitle className="w-full title-2xl-semi-bold text-text-primary">
+            {t('role.copyMembersTitle', { ns: 'permission' })}
+          </AlertDialogTitle>
+          <AlertDialogDescription className="w-full system-md-regular wrap-break-word whitespace-pre-wrap text-text-secondary">
+            {
+              isLoadingMemberCount
+                ? t('role.copyMembersLoading', { ns: 'permission' })
+                : t('role.copyMembersDescription', {
+                    ns: 'permission',
+                    name: role.name,
+                    count: memberCount,
+                  })
+            }
+          </AlertDialogDescription>
+        </div>
+        <AlertDialogActions>
+          <Button
+            variant="secondary"
+            disabled={isActionDisabled}
+            onClick={() => onDuplicate(false)}
+          >
+            {t('operation.skip', { ns: 'common' })}
+          </Button>
+          <Button
+            variant="primary"
+            disabled={isActionDisabled}
+            loading={isCopyingRole}
+            onClick={() => onDuplicate(true)}
+          >
+            {t('operation.copy', { ns: 'common' })}
+          </Button>
+        </AlertDialogActions>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}
diff --git a/web/app/components/header/account-setting/permissions-page/role-list/index.tsx b/web/app/components/header/account-setting/permissions-page/role-list/index.tsx
new file mode 100644
index 00000000000..7afd0a3eb59
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-list/index.tsx
@@ -0,0 +1,78 @@
+'use client'
+
+import type { Role, RoleCategory } from '@/models/access-control'
+import { cn } from '@langgenius/dify-ui/cn'
+import { memo } from 'react'
+import { useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import Row from './row'
+
+export type RoleListGroup = {
+  id: string
+  category: RoleCategory
+  title: string
+  items: Role[]
+}
+
+type RoleListProps = {
+  groups: RoleListGroup[]
+  className?: string
+  isLoading?: boolean
+  isFetchingNextPage?: boolean
+  onView?: (role: Role) => void
+  onEdit?: (role: Role) => void
+}
+
+const RoleList = ({
+  groups,
+  className,
+  isLoading = false,
+  isFetchingNextPage = false,
+  onView,
+  onEdit,
+}: RoleListProps) => {
+  const { t } = useTranslation()
+
+  if (isLoading) {
+    return (
+      <div className={cn('px-1 py-8 text-center', className)}>
+        <Loading type="app" />
+      </div>
+    )
+  }
+
+  return (
+    <div className={cn('flex min-w-0 flex-col gap-y-6', className)}>
+      {groups.map(group => (
+        <section
+          key={group.id}
+          className="flex min-w-0 flex-col gap-y-1"
+        >
+          <div className="flex min-h-6 items-center system-sm-medium text-text-secondary">
+            {t(`role.groups.${group.id}`, { ns: 'permission', defaultValue: group.title })}
+          </div>
+          <div className="flex flex-col">
+            {group.items.map(row => (
+              <Row
+                key={row.id}
+                name={row.name}
+                description={row.description}
+                roleCategory={group.category}
+                role={row}
+                onView={onView}
+                onEdit={onEdit}
+              />
+            ))}
+          </div>
+        </section>
+      ))}
+      {isFetchingNextPage && (
+        <div className="px-1 py-3 text-center">
+          <Loading type="app" />
+        </div>
+      )}
+    </div>
+  )
+}
+
+export default memo(RoleList)
diff --git a/web/app/components/header/account-setting/permissions-page/role-list/row-menu.tsx b/web/app/components/header/account-setting/permissions-page/role-list/row-menu.tsx
new file mode 100644
index 00000000000..678357ea4bc
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-list/row-menu.tsx
@@ -0,0 +1,192 @@
+'use client'
+import type { Role, RoleCategory } from '@/models/access-control'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useCallback, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import ActionButton from '@/app/components/base/action-button'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { useCopyWorkspaceRole, useDeleteWorkspaceRole } from '@/service/access-control/use-workspace-roles'
+import { hasPermission } from '@/utils/permission'
+import { CopyMembersConfirmDialog } from './copy-members-confirm-dialog'
+
+type RowMenuProps = {
+  roleCategory: RoleCategory
+  role: Role
+  onView?: (role: Role) => void
+  onEdit?: (role: Role) => void
+}
+
+const RowMenu = ({
+  roleCategory,
+  role,
+  onView,
+  onEdit,
+}: RowMenuProps) => {
+  const { t } = useTranslation()
+  const [open, setOpen] = useState(false)
+  const [showDeleteConfirm, setShowDeleteConfirm] = useState(false)
+  const [showCopyMembersConfirm, setShowCopyMembersConfirm] = useState(false)
+
+  const workspacePermissionKeys = useAppContextWithSelector(s => s.workspacePermissionKeys)
+  const canManageRoles = hasPermission(workspacePermissionKeys, 'workspace.role.manage')
+
+  const handleView = useCallback(() => onView?.(role), [onView, role])
+
+  const handleEdit = useCallback(() => {
+    if (!canManageRoles)
+      return
+
+    onEdit?.(role)
+  }, [canManageRoles, onEdit, role])
+
+  const { mutate: copyRole, isPending: isCopyingRole } = useCopyWorkspaceRole()
+
+  const openCopyMembersConfirm = useCallback(() => {
+    if (!canManageRoles)
+      return
+
+    setShowCopyMembersConfirm(true)
+    setOpen(false)
+  }, [canManageRoles])
+
+  const handleDuplicate = useCallback((copyMember: boolean) => {
+    if (!canManageRoles)
+      return
+
+    copyRole({
+      roleId: role.id,
+      copy_member: copyMember,
+    }, {
+      onSuccess: () => {
+        toast.success(t('role.duplicated', { ns: 'permission' }))
+        setShowCopyMembersConfirm(false)
+      },
+    })
+  }, [canManageRoles, copyRole, role.id, t])
+
+  const { mutateAsync: deleteRole, isPending: isDeletingRole } = useDeleteWorkspaceRole()
+
+  const openDeleteConfirm = useCallback(() => {
+    if (!canManageRoles)
+      return
+
+    setShowDeleteConfirm(true)
+    setOpen(false)
+  }, [canManageRoles])
+
+  const handleDelete = useCallback(() => {
+    if (!canManageRoles)
+      return
+
+    deleteRole(role.id, {
+      onSuccess: () => {
+        toast.success(t('role.deleted', { ns: 'permission' }))
+        setShowDeleteConfirm(false)
+      },
+    })
+  }, [canManageRoles, deleteRole, role.id, t])
+
+  const hasViewAction = roleCategory === 'global_system_default'
+  const hasEditAction = roleCategory === 'global_custom'
+  const hasDeleteAction = roleCategory === 'global_custom'
+
+  return (
+    <>
+      <DropdownMenu open={open} onOpenChange={setOpen}>
+        <DropdownMenuTrigger render={<ActionButton size="m" className={cn('shrink-0', open && 'bg-state-base-hover')} aria-label={t('operation.moreActions', { ns: 'common' })} />}>
+          <span aria-hidden className="i-ri-more-fill h-4 w-4 text-text-tertiary" />
+        </DropdownMenuTrigger>
+        <DropdownMenuContent placement="bottom-end" sideOffset={4} popupClassName="min-w-[160px]">
+          {
+            hasViewAction && (
+              <DropdownMenuItem className="system-sm-semibold text-text-secondary" onClick={handleView}>
+                {t('operation.view', { ns: 'common' })}
+              </DropdownMenuItem>
+            )
+          }
+          {
+            hasEditAction && (
+              <DropdownMenuItem
+                disabled={!canManageRoles}
+                className="system-sm-semibold text-text-secondary"
+                onClick={handleEdit}
+              >
+                {t('operation.edit', { ns: 'common' })}
+              </DropdownMenuItem>
+            )
+          }
+          <DropdownMenuItem
+            disabled={!canManageRoles}
+            className="system-sm-semibold text-text-secondary"
+            onClick={openCopyMembersConfirm}
+          >
+            {t('common.duplicateAction', { ns: 'permission' })}
+          </DropdownMenuItem>
+          {
+            hasDeleteAction && (
+              <>
+                <DropdownMenuSeparator />
+                <DropdownMenuItem
+                  disabled={!canManageRoles}
+                  variant="destructive"
+                  className="system-sm-semibold"
+                  onClick={openDeleteConfirm}
+                >
+                  {t('operation.delete', { ns: 'common' })}
+                </DropdownMenuItem>
+              </>
+            )
+          }
+        </DropdownMenuContent>
+      </DropdownMenu>
+      <AlertDialog open={showDeleteConfirm} onOpenChange={open => !open && setShowDeleteConfirm(false)}>
+        <AlertDialogContent backdropProps={{ forceRender: true }}>
+          <div className="flex flex-col gap-2 px-6 pt-6 pb-4">
+            <AlertDialogTitle className="w-full truncate title-2xl-semi-bold text-text-primary">
+              {t('role.deleteTitle', { ns: 'permission', name: role.name })}
+            </AlertDialogTitle>
+            <AlertDialogDescription className="w-full system-md-regular wrap-break-word whitespace-pre-wrap text-text-tertiary">
+              {t('role.deleteDescription', { ns: 'permission' })}
+            </AlertDialogDescription>
+          </div>
+          <AlertDialogActions>
+            <AlertDialogCancelButton>{t('operation.cancel', { ns: 'common' })}</AlertDialogCancelButton>
+            <AlertDialogConfirmButton
+              disabled={isDeletingRole}
+              onClick={handleDelete}
+            >
+              {t('operation.delete', { ns: 'common' })}
+            </AlertDialogConfirmButton>
+          </AlertDialogActions>
+        </AlertDialogContent>
+      </AlertDialog>
+      {showCopyMembersConfirm && (
+        <CopyMembersConfirmDialog
+          role={role}
+          isCopyingRole={isCopyingRole}
+          onOpenChange={setShowCopyMembersConfirm}
+          onDuplicate={handleDuplicate}
+        />
+      )}
+    </>
+  )
+}
+
+export default RowMenu
diff --git a/web/app/components/header/account-setting/permissions-page/role-list/row.tsx b/web/app/components/header/account-setting/permissions-page/role-list/row.tsx
new file mode 100644
index 00000000000..b9a622da3d4
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-list/row.tsx
@@ -0,0 +1,53 @@
+import type { Role, RoleCategory } from '@/models/access-control'
+import { cn } from '@langgenius/dify-ui/cn'
+import { memo } from 'react'
+import { useTranslation } from 'react-i18next'
+import RowMenu from './row-menu'
+
+type RowProps = {
+  className?: string
+  name: string
+  description: string
+  roleCategory: RoleCategory
+  role: Role
+  onView?: (role: Role) => void
+  onEdit?: (role: Role) => void
+}
+
+const Row = ({
+  className,
+  name,
+  description,
+  roleCategory,
+  role,
+  onView,
+  onEdit,
+}: RowProps) => {
+  const { t } = useTranslation()
+
+  return (
+    <div
+      className={cn(
+        'flex min-w-0 items-center gap-3 border-b border-divider-regular px-3 py-3.5 hover:bg-background-default-hover',
+        className,
+      )}
+    >
+      <div className="min-w-0 flex-1 space-y-1">
+        <div className="truncate system-sm-semibold text-text-primary">
+          {name}
+        </div>
+        <p className="truncate system-xs-regular text-text-secondary">
+          {description || t('role.noDescription', { ns: 'permission' })}
+        </p>
+      </div>
+      <RowMenu
+        roleCategory={roleCategory}
+        role={role}
+        onView={onView}
+        onEdit={onEdit}
+      />
+    </div>
+  )
+}
+
+export default memo(Row)
diff --git a/web/app/components/header/account-setting/permissions-page/role-modal/__tests__/index.spec.tsx b/web/app/components/header/account-setting/permissions-page/role-modal/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..15de6c99014
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-modal/__tests__/index.spec.tsx
@@ -0,0 +1,164 @@
+import type { PermissionGroup, Role } from '@/models/access-control'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import RoleModal from '../index'
+
+const mockWorkspacePermissionCatalog = vi.hoisted(() => ({
+  groups: [] as PermissionGroup[],
+}))
+
+vi.mock('@/service/access-control/use-permission-catalog', () => ({
+  useWorkspacePermissionCatalog: () => ({
+    data: { groups: mockWorkspacePermissionCatalog.groups },
+  }),
+}))
+
+const createPermissionGroup = (overrides: Partial<PermissionGroup> = {}): PermissionGroup => ({
+  group_key: 'workspace_management',
+  group_name: 'Workspace management',
+  description: '',
+  permissions: [
+    {
+      key: 'workspace.member.manage',
+      name: 'Manage members',
+      description: '',
+    },
+  ],
+  ...overrides,
+})
+
+const createRole = (overrides: Partial<Role> = {}): Role => ({
+  id: 'role-1',
+  tenant_id: 'tenant-1',
+  type: 'workspace',
+  category: 'global_custom',
+  name: 'Operator',
+  description: 'Can operate workspace',
+  is_builtin: false,
+  permission_keys: ['workspace.member.manage'],
+  role_tag: '',
+  ...overrides,
+})
+
+describe('RoleModal', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockWorkspacePermissionCatalog.groups = [createPermissionGroup()]
+  })
+
+  // Rendering keeps role fields and workspace permissions in one modal form.
+  describe('Rendering', () => {
+    it('should render edit mode with role values and selected permissions', () => {
+      render(
+        <RoleModal
+          open
+          mode="edit"
+          role={createRole()}
+          onClose={vi.fn()}
+          onSubmit={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByText('permission.role.modal.edit.title')).toBeInTheDocument()
+      expect(screen.getByLabelText('permission.role.modal.nameLabel')).toHaveValue('Operator')
+      expect(screen.getByLabelText('permission.role.modal.descriptionLabel')).toHaveValue('Can operate workspace')
+      expect(screen.getByRole('button', { name: /Workspace management/ })).toHaveAttribute('aria-expanded', 'true')
+      expect(screen.getByText(/workspace\.member\.manage/)).toBeInTheDocument()
+    })
+
+    it('should disable confirm action when role name is empty', () => {
+      render(
+        <RoleModal
+          open
+          mode="create"
+          onClose={vi.fn()}
+          onSubmit={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByRole('button', { name: 'common.operation.confirm' })).toBeDisabled()
+    })
+  })
+
+  // Submitting creates the payload expected by role create/update mutations.
+  describe('User Interactions', () => {
+    it('should submit trimmed role fields and selected permission keys', async () => {
+      const user = userEvent.setup()
+      const handleClose = vi.fn()
+      const handleSubmit = vi.fn()
+
+      render(
+        <RoleModal
+          open
+          mode="create"
+          onClose={handleClose}
+          onSubmit={handleSubmit}
+        />,
+      )
+
+      await user.type(screen.getByLabelText('permission.role.modal.nameLabel'), '  Support role  ')
+      await user.type(screen.getByLabelText('permission.role.modal.descriptionLabel'), '  Helps members  ')
+      await user.click(screen.getByText(/workspace\.member\.manage/))
+      await user.click(screen.getByRole('button', { name: 'common.operation.confirm' }))
+
+      expect(handleSubmit).toHaveBeenCalledTimes(1)
+      expect(handleSubmit).toHaveBeenCalledWith({
+        name: 'Support role',
+        description: 'Helps members',
+        permissionKeys: ['workspace.member.manage'],
+      })
+      expect(handleClose).toHaveBeenCalledTimes(1)
+    })
+
+    it('should submit an updated role description when editing an existing role', async () => {
+      const user = userEvent.setup()
+      const handleSubmit = vi.fn()
+
+      render(
+        <RoleModal
+          open
+          mode="edit"
+          role={createRole({
+            description: 'Original description',
+            permission_keys: ['workspace.member.manage'],
+          })}
+          onClose={vi.fn()}
+          onSubmit={handleSubmit}
+        />,
+      )
+
+      const descriptionInput = screen.getByLabelText('permission.role.modal.descriptionLabel')
+      await user.clear(descriptionInput)
+      await user.type(descriptionInput, '  Updated role description  ')
+      await user.click(screen.getByRole('button', { name: 'common.operation.confirm' }))
+
+      expect(handleSubmit).toHaveBeenCalledTimes(1)
+      expect(handleSubmit).toHaveBeenCalledWith({
+        name: 'Operator',
+        description: 'Updated role description',
+        permissionKeys: ['workspace.member.manage'],
+      })
+    })
+  })
+
+  // View mode preserves the permission display but blocks edits and confirmation.
+  describe('Read-only Mode', () => {
+    it('should render role details as read-only in view mode', () => {
+      render(
+        <RoleModal
+          open
+          mode="view"
+          role={createRole()}
+          onClose={vi.fn()}
+          onSubmit={vi.fn()}
+        />,
+      )
+
+      expect(screen.getByLabelText('permission.role.modal.nameLabel')).toBeDisabled()
+      expect(screen.getByLabelText('permission.role.modal.descriptionLabel')).toBeDisabled()
+      expect(screen.queryByRole('button', { name: 'common.operation.confirm' })).not.toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'common.operation.close' })).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'permission.permissionList.clearAll' })).not.toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/permissions-page/role-modal/hooks.ts b/web/app/components/header/account-setting/permissions-page/role-modal/hooks.ts
new file mode 100644
index 00000000000..c3ea672a1ae
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-modal/hooks.ts
@@ -0,0 +1,36 @@
+import { useMemo } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useWorkspacePermissionCatalog } from '@/service/access-control/use-permission-catalog'
+
+export const useWorkspacePermissionGroups = () => {
+  const { t } = useTranslation()
+  const { data: workspacePermissionCatalog } = useWorkspacePermissionCatalog()
+
+  const groups = useMemo(() => {
+    return (workspacePermissionCatalog?.groups || []).map(group => ({
+      ...group,
+      group_name: t(`group.${group.group_key}`, {
+        ns: 'permission',
+        defaultValue: group.group_name,
+      }),
+      permissions: group.permissions.map(permission => ({
+        ...permission,
+        name: t(permission.key, {
+          ns: 'permissionKeys',
+          defaultValue: permission.name,
+        }),
+      })),
+    }))
+  }, [t, workspacePermissionCatalog?.groups])
+
+  const allPermissions = groups.flatMap(g => g.permissions) || []
+
+  const permissionMap = Object.fromEntries(
+    allPermissions.map(p => [p.key, p]),
+  )
+
+  return {
+    groups,
+    permissionMap,
+  }
+}
diff --git a/web/app/components/header/account-setting/permissions-page/role-modal/index.tsx b/web/app/components/header/account-setting/permissions-page/role-modal/index.tsx
new file mode 100644
index 00000000000..fe7abf64672
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-modal/index.tsx
@@ -0,0 +1,147 @@
+'use client'
+
+import type { Role } from '@/models/access-control'
+import { Button } from '@langgenius/dify-ui/button'
+import {
+  Dialog,
+  DialogCloseButton,
+  DialogContent,
+  DialogDescription,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { Input } from '@langgenius/dify-ui/input'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { useCallback, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import PermissionField from './permission-field'
+
+export type RoleModalMode = 'create' | 'view' | 'edit'
+
+export type submitRoleData = {
+  name: string
+  description?: string
+  permissionKeys?: string[]
+}
+
+type RoleModalProps = {
+  mode: RoleModalMode
+  open: boolean
+  role?: Role
+  onClose: () => void
+  onSubmit?: (data: submitRoleData) => void
+}
+
+const RoleModal = ({
+  mode,
+  open,
+  role,
+  onClose,
+  onSubmit,
+}: RoleModalProps) => {
+  const { t } = useTranslation()
+  const [name, setName] = useState(role?.name ?? '')
+  const [desc, setDesc] = useState(role?.description ?? '')
+  const [permissionKeys, setPermissionKeys] = useState<string[]>(role?.permission_keys ?? [])
+
+  const readonly = mode === 'view'
+
+  const onRoleNameChange = useCallback((e: React.ChangeEvent<HTMLInputElement>) => {
+    setName(e.target.value)
+  }, [])
+
+  const onRoleDescChange = useCallback((value: string) => {
+    setDesc(value)
+  }, [])
+
+  const handleSubmit = () => {
+    onSubmit?.({ name: name.trim(), description: desc.trim(), permissionKeys })
+    onClose()
+  }
+
+  return (
+    <Dialog
+      open={open}
+      onOpenChange={(nextOpen) => {
+        if (!nextOpen)
+          onClose()
+      }}
+    >
+      <DialogContent
+        className="flex h-[85vh] w-140 flex-col overflow-hidden p-0"
+        backdropProps={{ forceRender: true }}
+      >
+        <div className="relative shrink-0 px-6 pt-6 pb-4">
+          <DialogCloseButton />
+          <div className="pr-8">
+            <DialogTitle className="system-xl-semibold text-text-primary">
+              {t(`role.modal.${mode}.title`, { ns: 'permission' })}
+            </DialogTitle>
+            <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+              {t(`role.modal.${mode}.description`, { ns: 'permission' })}
+            </DialogDescription>
+          </div>
+        </div>
+        <div className="border-t border-divider-subtle" />
+        <div className="flex min-h-0 flex-1 flex-col gap-5 overflow-y-hidden px-6 py-5">
+          <div className="flex shrink-0 flex-col gap-1">
+            <label htmlFor="role-name" className="system-sm-medium text-text-secondary">
+              {t('role.modal.nameLabel', { ns: 'permission' })}
+            </label>
+            <Input
+              id="role-name"
+              value={name}
+              onChange={onRoleNameChange}
+              placeholder={t('role.modal.namePlaceholder', { ns: 'permission' })}
+              disabled={readonly}
+            />
+          </div>
+          <div className="flex shrink-0 flex-col gap-1">
+            <label htmlFor="role-description" className="system-sm-medium text-text-secondary">
+              {t('role.modal.descriptionLabel', { ns: 'permission' })}
+            </label>
+            <Textarea
+              id="role-description"
+              value={desc}
+              onValueChange={onRoleDescChange}
+              placeholder={t('role.modal.descriptionPlaceholder', { ns: 'permission' })}
+              disabled={readonly}
+              className="min-h-24 resize-none"
+            />
+          </div>
+          <PermissionField
+            value={permissionKeys}
+            onChange={setPermissionKeys}
+            readonly={readonly}
+          />
+        </div>
+        <div className="flex shrink-0 items-center justify-between gap-3 border-t border-divider-subtle px-6 py-4">
+          <a
+            href="https://docs.dify.ai/"
+            target="_blank"
+            rel="noreferrer"
+            className="inline-flex items-center gap-1 system-xs-medium text-text-accent hover:underline"
+          >
+            <span>{t('permissionSet.learnMore', { ns: 'permission' })}</span>
+            <span aria-hidden className="i-ri-external-link-line h-3.5 w-3.5" />
+          </a>
+          <div className="flex items-center gap-2">
+            <Button variant="secondary" onClick={onClose}>
+              {readonly ? t('operation.close', { ns: 'common' }) : t('operation.cancel', { ns: 'common' })}
+            </Button>
+            {!readonly && (
+              <Button
+                variant="primary"
+                disabled={!name.trim()}
+                onClick={handleSubmit}
+              >
+                {t('operation.confirm', { ns: 'common' })}
+              </Button>
+            )}
+          </div>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+export default RoleModal
diff --git a/web/app/components/header/account-setting/permissions-page/role-modal/permission-field.tsx b/web/app/components/header/account-setting/permissions-page/role-modal/permission-field.tsx
new file mode 100644
index 00000000000..c0f4a6478dd
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-modal/permission-field.tsx
@@ -0,0 +1,27 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+import PermissionPicker from './permission-picker'
+
+type PermissionFieldProps = {
+  value: string[]
+  onChange: (next: string[]) => void
+  readonly?: boolean
+}
+
+const PermissionField = ({
+  value,
+  onChange,
+  readonly = false,
+}: PermissionFieldProps) => {
+  const { t } = useTranslation()
+
+  return (
+    <div className="flex min-h-0 flex-1 flex-col gap-2">
+      <div className="system-sm-medium text-text-secondary">{t('permissionSet.permissions', { ns: 'permission' })}</div>
+      <PermissionPicker value={value} onChange={onChange} readonly={readonly} />
+    </div>
+  )
+}
+
+export default PermissionField
diff --git a/web/app/components/header/account-setting/permissions-page/role-modal/permission-picker.tsx b/web/app/components/header/account-setting/permissions-page/role-modal/permission-picker.tsx
new file mode 100644
index 00000000000..c988a21c4c8
--- /dev/null
+++ b/web/app/components/header/account-setting/permissions-page/role-modal/permission-picker.tsx
@@ -0,0 +1,32 @@
+'use client'
+
+import PermissionGroupList from '../../permission-group-list'
+import { useWorkspacePermissionGroups } from './hooks'
+
+type PermissionPickerProps = {
+  value: string[]
+  onChange: (next: string[]) => void
+  className?: string
+  readonly?: boolean
+}
+
+const PermissionPicker = ({
+  value,
+  onChange,
+  className,
+  readonly = false,
+}: PermissionPickerProps) => {
+  const { groups } = useWorkspacePermissionGroups()
+
+  return (
+    <PermissionGroupList
+      groups={groups}
+      value={value}
+      onChange={onChange}
+      className={className}
+      readonly={readonly}
+    />
+  )
+}
+
+export default PermissionPicker
diff --git a/web/app/components/header/account-setting/plugin-page/SerpapiPlugin.tsx b/web/app/components/header/account-setting/plugin-page/SerpapiPlugin.tsx
deleted file mode 100644
index 31c4ce2c3a0..00000000000
--- a/web/app/components/header/account-setting/plugin-page/SerpapiPlugin.tsx
+++ /dev/null
@@ -1,69 +0,0 @@
-import type { Form, ValidateValue } from '../key-validator/declarations'
-import type { PluginProvider } from '@/models/common'
-import { toast } from '@langgenius/dify-ui/toast'
-import { useTranslation } from 'react-i18next'
-import { useAppContext } from '@/context/app-context'
-import SerpapiLogo from '../../assets/serpapi.png'
-import KeyValidator from '../key-validator'
-import { updatePluginKey, validatePluginKey } from './utils'
-
-type SerpapiPluginProps = {
-  plugin: PluginProvider
-  onUpdate: () => void
-}
-const SerpapiPlugin = ({ plugin, onUpdate }: SerpapiPluginProps) => {
-  const { t } = useTranslation()
-  const { isCurrentWorkspaceManager } = useAppContext()
-  const forms: Form[] = [{
-    key: 'api_key',
-    title: t('plugin.serpapi.apiKey', { ns: 'common' }),
-    placeholder: t('plugin.serpapi.apiKeyPlaceholder', { ns: 'common' }),
-    value: plugin.credentials?.api_key,
-    validate: {
-      before: (v) => {
-        if (v?.api_key)
-          return true
-      },
-      run: async (v) => {
-        return validatePluginKey('serpapi', {
-          credentials: {
-            api_key: v?.api_key,
-          },
-        })
-      },
-    },
-    handleFocus: (v, dispatch) => {
-      if (v.api_key === plugin.credentials?.api_key)
-        dispatch({ ...v, api_key: '' })
-    },
-  }]
-  const handleSave = async (v: ValidateValue) => {
-    if (!v?.api_key || v?.api_key === plugin.credentials?.api_key)
-      return
-    const res = await updatePluginKey('serpapi', {
-      credentials: {
-        api_key: v?.api_key,
-      },
-    })
-    if (res.status === 'success') {
-      toast.success(t('actionMsg.modifiedSuccessfully', { ns: 'common' }))
-      onUpdate()
-      return true
-    }
-  }
-  return (
-    <KeyValidator
-      type="serpapi"
-      title={<img alt="serpapi logo" src={SerpapiLogo.src} width={64} />}
-      status={plugin.credentials?.api_key ? 'success' : 'add'}
-      forms={forms}
-      keyFrom={{
-        text: t('plugin.serpapi.keyFrom', { ns: 'common' }),
-        link: 'https://serpapi.com/manage-api-key',
-      }}
-      onSave={handleSave}
-      disabled={!isCurrentWorkspaceManager}
-    />
-  )
-}
-export default SerpapiPlugin
diff --git a/web/app/components/header/account-setting/plugin-page/__tests__/SerpapiPlugin.spec.tsx b/web/app/components/header/account-setting/plugin-page/__tests__/SerpapiPlugin.spec.tsx
deleted file mode 100644
index 2055c0725de..00000000000
--- a/web/app/components/header/account-setting/plugin-page/__tests__/SerpapiPlugin.spec.tsx
+++ /dev/null
@@ -1,213 +0,0 @@
-import type { PluginProvider } from '@/models/common'
-import { act, fireEvent, render, screen, waitFor } from '@testing-library/react'
-import { useAppContext } from '@/context/app-context'
-import SerpapiPlugin from '../SerpapiPlugin'
-import { updatePluginKey, validatePluginKey } from '../utils'
-
-const mockEventEmitter = vi.hoisted(() => {
-  let subscriber: ((value: string) => void) | undefined
-  return {
-    useSubscription: vi.fn((callback: (value: string) => void) => {
-      subscriber = callback
-    }),
-    emit: vi.fn((value: string) => {
-      subscriber?.(value)
-    }),
-    reset: () => {
-      subscriber = undefined
-    },
-  }
-})
-
-const { mockToast } = vi.hoisted(() => {
-  const mockToast = Object.assign(vi.fn(), {
-    success: vi.fn(),
-    error: vi.fn(),
-    warning: vi.fn(),
-    info: vi.fn(),
-    dismiss: vi.fn(),
-    update: vi.fn(),
-    promise: vi.fn(),
-  })
-  return { mockToast }
-})
-
-vi.mock('@langgenius/dify-ui/toast', () => ({
-  toast: mockToast,
-}))
-
-vi.mock('@/context/app-context', () => ({
-  useAppContext: vi.fn(),
-}))
-
-vi.mock('../utils', () => ({
-  updatePluginKey: vi.fn(),
-  validatePluginKey: vi.fn(),
-}))
-
-vi.mock('@/context/event-emitter', () => ({
-  useEventEmitterContextContext: vi.fn(() => ({
-    eventEmitter: mockEventEmitter,
-  })),
-}))
-
-describe('SerpapiPlugin', () => {
-  const mockOnUpdate = vi.fn()
-  const mockUpdatePluginKey = updatePluginKey as ReturnType<typeof vi.fn>
-  const mockValidatePluginKey = validatePluginKey as ReturnType<typeof vi.fn>
-
-  beforeEach(() => {
-    vi.clearAllMocks()
-    mockEventEmitter.reset()
-    const mockUseAppContext = useAppContext as ReturnType<typeof vi.fn>
-    mockUseAppContext.mockReturnValue({
-      isCurrentWorkspaceManager: true,
-    })
-    mockValidatePluginKey.mockResolvedValue({ status: 'success' })
-    mockUpdatePluginKey.mockResolvedValue({ status: 'success' })
-  })
-
-  it('should show key input when manager clicks edit key', () => {
-    const mockPlugin: PluginProvider = {
-      tool_name: 'serpapi',
-      credentials: {
-        api_key: 'existing-key',
-      },
-    } as PluginProvider
-
-    render(<SerpapiPlugin plugin={mockPlugin} onUpdate={mockOnUpdate} />)
-
-    fireEvent.click(screen.getByText('common.provider.editKey'))
-    expect(screen.getByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder')).toBeInTheDocument()
-  })
-
-  it('should clear existing key on focus and show validation error for invalid key', async () => {
-    vi.useFakeTimers()
-    try {
-      mockValidatePluginKey.mockResolvedValue({ status: 'error', message: 'Invalid API key' })
-
-      const mockPlugin: PluginProvider = {
-        tool_name: 'serpapi',
-        credentials: {
-          api_key: 'existing-key',
-        },
-      } as PluginProvider
-
-      render(<SerpapiPlugin plugin={mockPlugin} onUpdate={mockOnUpdate} />)
-
-      fireEvent.click(screen.getByText('common.provider.editKey'))
-      const input = screen.getByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder')
-
-      expect(input).toHaveValue('existing-key')
-      fireEvent.focus(input)
-      expect(input).toHaveValue('')
-
-      fireEvent.change(input, {
-        target: { value: 'invalid-key' },
-      })
-
-      await act(async () => {
-        await vi.advanceTimersByTimeAsync(1000)
-      })
-
-      expect(screen.getByText(/Invalid API key/)).toBeInTheDocument()
-
-      fireEvent.focus(input)
-      expect(input).toHaveValue('invalid-key')
-
-      fireEvent.change(input, {
-        target: { value: '' },
-      })
-
-      await act(async () => {
-        await vi.advanceTimersByTimeAsync(1000)
-      })
-
-      expect(screen.queryByText(/Invalid API key/)).toBeNull()
-    }
-    finally {
-      vi.useRealTimers()
-    }
-  })
-
-  it('should not open key input when user is not workspace manager', () => {
-    const mockUseAppContext = useAppContext as ReturnType<typeof vi.fn>
-    mockUseAppContext.mockReturnValue({
-      isCurrentWorkspaceManager: false,
-    })
-
-    const mockPlugin = {
-      tool_name: 'serpapi',
-      is_enabled: true,
-      credentials: null,
-    } satisfies PluginProvider
-
-    render(<SerpapiPlugin plugin={mockPlugin} onUpdate={mockOnUpdate} />)
-
-    fireEvent.click(screen.getByText('common.provider.addKey'))
-
-    expect(screen.queryByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder')).toBeNull()
-  })
-
-  it('should save changed key and trigger success feedback', async () => {
-    const mockPlugin: PluginProvider = {
-      tool_name: 'serpapi',
-      credentials: {
-        api_key: 'existing-key',
-      },
-    } as PluginProvider
-
-    render(<SerpapiPlugin plugin={mockPlugin} onUpdate={mockOnUpdate} />)
-
-    fireEvent.click(screen.getByText('common.provider.editKey'))
-    fireEvent.change(screen.getByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder'), {
-      target: { value: 'new-key' },
-    })
-    fireEvent.click(screen.getByText('common.operation.save'))
-
-    await waitFor(() => {
-      expect(screen.queryByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder')).toBeNull()
-    })
-  })
-
-  it('should keep editor open when save request fails', async () => {
-    mockUpdatePluginKey.mockResolvedValue({ status: 'error', message: 'update failed' })
-
-    const mockPlugin: PluginProvider = {
-      tool_name: 'serpapi',
-      credentials: {
-        api_key: 'existing-key',
-      },
-    } as PluginProvider
-
-    render(<SerpapiPlugin plugin={mockPlugin} onUpdate={mockOnUpdate} />)
-
-    fireEvent.click(screen.getByText('common.provider.editKey'))
-    fireEvent.change(screen.getByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder'), {
-      target: { value: 'new-key' },
-    })
-    fireEvent.click(screen.getByText('common.operation.save'))
-
-    await waitFor(() => {
-      expect(screen.getByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder')).toBeInTheDocument()
-    })
-  })
-
-  it('should keep editor open when key value is unchanged', async () => {
-    const mockPlugin: PluginProvider = {
-      tool_name: 'serpapi',
-      credentials: {
-        api_key: 'existing-key',
-      },
-    } as PluginProvider
-
-    render(<SerpapiPlugin plugin={mockPlugin} onUpdate={mockOnUpdate} />)
-
-    fireEvent.click(screen.getByText('common.provider.editKey'))
-    fireEvent.click(screen.getByText('common.operation.save'))
-
-    await waitFor(() => {
-      expect(screen.getByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder')).toBeInTheDocument()
-    })
-  })
-})
diff --git a/web/app/components/header/account-setting/plugin-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/plugin-page/__tests__/index.spec.tsx
deleted file mode 100644
index ca0c41a83bf..00000000000
--- a/web/app/components/header/account-setting/plugin-page/__tests__/index.spec.tsx
+++ /dev/null
@@ -1,120 +0,0 @@
-import { fireEvent, render, screen, waitFor } from '@testing-library/react'
-import { useState } from 'react'
-import { useAppContext } from '@/context/app-context'
-import PluginPage from '../index'
-import { updatePluginKey, validatePluginKey } from '../utils'
-
-const mockUsePluginProviders = vi.hoisted(() => vi.fn())
-
-vi.mock('@/service/use-common', () => ({
-  usePluginProviders: mockUsePluginProviders,
-}))
-
-vi.mock('@/context/app-context', () => ({
-  useAppContext: vi.fn(),
-}))
-
-vi.mock('@langgenius/dify-ui/toast', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@langgenius/dify-ui/toast')>()
-  return {
-    ...actual,
-
-  }
-})
-
-vi.mock('@/context/event-emitter', () => ({
-  useEventEmitterContextContext: () => ({
-    eventEmitter: {
-      emit: vi.fn(),
-      useSubscription: vi.fn(),
-    },
-  }),
-}))
-
-vi.mock('../utils', () => ({
-  updatePluginKey: vi.fn(),
-  validatePluginKey: vi.fn(),
-}))
-
-describe('PluginPage', () => {
-  const mockUpdatePluginKey = updatePluginKey as ReturnType<typeof vi.fn>
-  const mockValidatePluginKey = validatePluginKey as ReturnType<typeof vi.fn>
-
-  beforeEach(() => {
-    vi.clearAllMocks()
-    const mockUseAppContext = useAppContext as ReturnType<typeof vi.fn>
-    mockUseAppContext.mockReturnValue({
-      isCurrentWorkspaceManager: true,
-    })
-    mockValidatePluginKey.mockResolvedValue({ status: 'success' })
-    mockUpdatePluginKey.mockResolvedValue({ status: 'success' })
-  })
-
-  it('should render plugin settings with edit action when serpapi key exists', () => {
-    mockUsePluginProviders.mockReturnValue({
-      data: [
-        { tool_name: 'serpapi', credentials: { api_key: 'test-key' } },
-      ],
-      refetch: vi.fn(),
-    })
-
-    render(<PluginPage />)
-    expect(screen.getByText('common.provider.editKey')).toBeInTheDocument()
-  })
-
-  it('should render plugin settings with add action when serpapi key is missing', () => {
-    mockUsePluginProviders.mockReturnValue({
-      data: [
-        { tool_name: 'serpapi', credentials: null },
-      ],
-      refetch: vi.fn(),
-    })
-
-    render(<PluginPage />)
-    expect(screen.getByText('common.provider.addKey')).toBeInTheDocument()
-  })
-
-  it('should display encryption notice with PKCS1_OAEP link', () => {
-    mockUsePluginProviders.mockReturnValue({
-      data: [],
-      refetch: vi.fn(),
-    })
-
-    render(<PluginPage />)
-    expect(screen.getByText(/common\.provider\.encrypted\.front/)).toBeInTheDocument()
-    expect(screen.getByText(/common\.provider\.encrypted\.back/)).toBeInTheDocument()
-    const link = screen.getByRole('link', { name: 'PKCS1_OAEP' })
-    expect(link).toHaveAttribute('target', '_blank')
-    expect(link).toHaveAttribute('href', 'https://pycryptodome.readthedocs.io/en/latest/src/cipher/oaep.html')
-  })
-
-  it('should show reload state after saving key', async () => {
-    let showReloadedState = () => {}
-    const Wrapper = () => {
-      const [reloaded, setReloaded] = useState(false)
-      showReloadedState = () => setReloaded(true)
-      return (
-        <>
-          <PluginPage />
-          {reloaded && <div>providers-reloaded</div>}
-        </>
-      )
-    }
-    mockUsePluginProviders.mockImplementation(() => ({
-      data: [{ tool_name: 'serpapi', credentials: { api_key: 'existing-key' } }],
-      refetch: () => showReloadedState(),
-    }))
-
-    render(<Wrapper />)
-
-    fireEvent.click(screen.getByText('common.provider.editKey'))
-    fireEvent.change(screen.getByPlaceholderText('common.plugin.serpapi.apiKeyPlaceholder'), {
-      target: { value: 'new-key' },
-    })
-    fireEvent.click(screen.getByText('common.operation.save'))
-
-    await waitFor(() => {
-      expect(screen.getByText('providers-reloaded')).toBeInTheDocument()
-    })
-  })
-})
diff --git a/web/app/components/header/account-setting/plugin-page/__tests__/utils.spec.ts b/web/app/components/header/account-setting/plugin-page/__tests__/utils.spec.ts
deleted file mode 100644
index e49a9f41c9f..00000000000
--- a/web/app/components/header/account-setting/plugin-page/__tests__/utils.spec.ts
+++ /dev/null
@@ -1,73 +0,0 @@
-import { updatePluginProviderAIKey, validatePluginProviderKey } from '@/service/common'
-import { ValidatedStatus } from '../../key-validator/declarations'
-import { updatePluginKey, validatePluginKey } from '../utils'
-
-vi.mock('@/service/common', () => ({
-  validatePluginProviderKey: vi.fn(),
-  updatePluginProviderAIKey: vi.fn(),
-}))
-
-const mockValidatePluginProviderKey = validatePluginProviderKey as ReturnType<typeof vi.fn>
-const mockUpdatePluginProviderAIKey = updatePluginProviderAIKey as ReturnType<typeof vi.fn>
-
-describe('Plugin Utils', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-  })
-
-  describe.each([
-    {
-      name: 'validatePluginKey',
-      utilFn: validatePluginKey,
-      serviceMock: mockValidatePluginProviderKey,
-      successBody: { credentials: { api_key: 'test-key' } },
-      failureBody: { credentials: { api_key: 'invalid' } },
-      exceptionBody: { credentials: { api_key: 'test' } },
-      serviceErrorMessage: 'Invalid API key',
-      thrownErrorMessage: 'Network error',
-    },
-    {
-      name: 'updatePluginKey',
-      utilFn: updatePluginKey,
-      serviceMock: mockUpdatePluginProviderAIKey,
-      successBody: { credentials: { api_key: 'new-key' } },
-      failureBody: { credentials: { api_key: 'test' } },
-      exceptionBody: { credentials: { api_key: 'test' } },
-      serviceErrorMessage: 'Update failed',
-      thrownErrorMessage: 'Request failed',
-    },
-  ])('$name', ({ utilFn, serviceMock, successBody, failureBody, exceptionBody, serviceErrorMessage, thrownErrorMessage }) => {
-    it('should return success status when service succeeds', async () => {
-      serviceMock.mockResolvedValue({ result: 'success' })
-
-      const result = await utilFn('serpapi', successBody)
-
-      expect(result.status).toBe(ValidatedStatus.Success)
-    })
-
-    it('should return error status with message when service returns an error', async () => {
-      serviceMock.mockResolvedValue({
-        result: 'error',
-        error: serviceErrorMessage,
-      })
-
-      const result = await utilFn('serpapi', failureBody)
-
-      expect(result).toMatchObject({
-        status: ValidatedStatus.Error,
-        message: serviceErrorMessage,
-      })
-    })
-
-    it('should return error status when service throws exception', async () => {
-      serviceMock.mockRejectedValue(new Error(thrownErrorMessage))
-
-      const result = await utilFn('serpapi', exceptionBody)
-
-      expect(result).toMatchObject({
-        status: ValidatedStatus.Error,
-        message: thrownErrorMessage,
-      })
-    })
-  })
-})
diff --git a/web/app/components/header/account-setting/plugin-page/index.tsx b/web/app/components/header/account-setting/plugin-page/index.tsx
deleted file mode 100644
index 15d83028746..00000000000
--- a/web/app/components/header/account-setting/plugin-page/index.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import type { PluginProvider } from '@/models/common'
-import { LockClosedIcon } from '@heroicons/react/24/solid'
-import { useTranslation } from 'react-i18next'
-import Link from '@/next/link'
-import { usePluginProviders } from '@/service/use-common'
-import SerpapiPlugin from './SerpapiPlugin'
-
-const PluginPage = () => {
-  const { t } = useTranslation()
-  const { data: plugins, refetch: mutate } = usePluginProviders()
-
-  const Plugin_MAP: Record<string, (plugin: PluginProvider) => React.JSX.Element> = {
-    serpapi: (plugin: PluginProvider) => <SerpapiPlugin key="serpapi" plugin={plugin} onUpdate={() => mutate()} />,
-  }
-
-  return (
-    <div className="pb-7">
-      <div>
-        {plugins?.map(plugin => Plugin_MAP[plugin.tool_name]!(plugin))}
-      </div>
-      <div className="fixed bottom-0 flex h-[42px] w-[472px] items-center bg-white text-xs text-gray-500">
-        <LockClosedIcon className="mr-1 size-3" />
-        {t('provider.encrypted.front', { ns: 'common' })}
-        <Link
-          className="mx-1 text-primary-600"
-          target="_blank"
-          rel="noopener noreferrer"
-          href="https://pycryptodome.readthedocs.io/en/latest/src/cipher/oaep.html"
-        >
-          PKCS1_OAEP
-        </Link>
-        {t('provider.encrypted.back', { ns: 'common' })}
-      </div>
-    </div>
-  )
-}
-
-export default PluginPage
diff --git a/web/app/components/header/account-setting/plugin-page/utils.ts b/web/app/components/header/account-setting/plugin-page/utils.ts
deleted file mode 100644
index 385ef31cab2..00000000000
--- a/web/app/components/header/account-setting/plugin-page/utils.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { updatePluginProviderAIKey, validatePluginProviderKey } from '@/service/common'
-import { ValidatedStatus } from '../key-validator/declarations'
-
-export const validatePluginKey = async (pluginType: string, body: any) => {
-  try {
-    const res = await validatePluginProviderKey({
-      url: `/workspaces/current/tool-providers/${pluginType}/credentials-validate`,
-      body,
-    })
-    if (res.result === 'success')
-      return Promise.resolve({ status: ValidatedStatus.Success })
-    else
-      return Promise.resolve({ status: ValidatedStatus.Error, message: res.error })
-  }
-  catch (e: any) {
-    return Promise.resolve({ status: ValidatedStatus.Error, message: e.message })
-  }
-}
-
-export const updatePluginKey = async (pluginType: string, body: any) => {
-  try {
-    const res = await updatePluginProviderAIKey({
-      url: `/workspaces/current/tool-providers/${pluginType}/credentials`,
-      body,
-    })
-    if (res.result === 'success')
-      return Promise.resolve({ status: ValidatedStatus.Success })
-    else
-      return Promise.resolve({ status: ValidatedStatus.Error, message: res.error })
-  }
-  catch (e: any) {
-    return Promise.resolve({ status: ValidatedStatus.Error, message: e.message })
-  }
-}
diff --git a/web/app/components/header/account-setting/use-integrations-setting.ts b/web/app/components/header/account-setting/use-integrations-setting.ts
index 04f2f65a411..06181a5f56f 100644
--- a/web/app/components/header/account-setting/use-integrations-setting.ts
+++ b/web/app/components/header/account-setting/use-integrations-setting.ts
@@ -7,8 +7,8 @@ import { useModalContext } from '@/context/modal-context'
 import { integrationSectionByMovedAccountSettingTab } from './destinations'
 
 type IntegrationsSettingState
-  = | { payload: MovedAccountSettingTab }
-    | { section: IntegrationSection }
+  = | { payload: MovedAccountSettingTab, source?: 'agent', onCancelCallback?: () => void }
+    | { section: IntegrationSection, source?: 'agent', onCancelCallback?: () => void }
 
 export const useIntegrationsSetting = () => {
   const { setShowAccountSettingModal } = useModalContext()
@@ -19,7 +19,12 @@ export const useIntegrationsSetting = () => {
         ? state.section
         : integrationSectionByMovedAccountSettingTab[state.payload]
 
-    if (section)
-      setShowAccountSettingModal({ payload: section })
+    if (section) {
+      setShowAccountSettingModal({
+        payload: section,
+        ...(state.source ? { source: state.source } : {}),
+        ...(state.onCancelCallback ? { onCancelCallback: state.onCancelCallback } : {}),
+      })
+    }
   }, [setShowAccountSettingModal])
 }
diff --git a/web/app/components/header/account-setting/workspace-role-checkbox-list.tsx b/web/app/components/header/account-setting/workspace-role-checkbox-list.tsx
new file mode 100644
index 00000000000..f3afc856cba
--- /dev/null
+++ b/web/app/components/header/account-setting/workspace-role-checkbox-list.tsx
@@ -0,0 +1,281 @@
+'use client'
+
+import type { Role } from '@/models/access-control'
+import { Checkbox } from '@langgenius/dify-ui/checkbox'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Input } from '@langgenius/dify-ui/input'
+import { RadioControl, RadioRoot } from '@langgenius/dify-ui/radio'
+import { RadioGroup } from '@langgenius/dify-ui/radio-group'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useLocale } from '@/context/i18n'
+import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
+import { useWorkspaceRoleList } from '@/service/access-control/use-workspace-roles'
+
+type WorkspaceRoleCheckboxListProps = {
+  selectedRoleIds: string[]
+  selectedRoles?: Role[]
+  allowMultipleRoles?: boolean
+  disabledRoleIds?: string[]
+  onSelectedRolesChange: (selectedRoles: Role[]) => void
+  includeOwner?: boolean
+}
+
+const PAGE_SIZE = 20
+const EMPTY_DISABLED_ROLE_IDS: string[] = []
+
+const createSelectedRolePlaceholder = (id: string): Role => ({
+  id,
+  tenant_id: '',
+  type: 'workspace',
+  category: 'global_custom',
+  name: id,
+  description: '',
+  is_builtin: false,
+  permission_keys: [],
+  role_tag: '',
+})
+
+const WorkspaceRoleCheckboxList = ({
+  selectedRoleIds,
+  selectedRoles,
+  allowMultipleRoles = true,
+  disabledRoleIds = EMPTY_DISABLED_ROLE_IDS,
+  onSelectedRolesChange,
+  includeOwner = false,
+}: WorkspaceRoleCheckboxListProps) => {
+  const { t } = useTranslation()
+  const locale = useLocale()
+  const [keyword, setKeyword] = useState('')
+  const containerRef = useRef<HTMLDivElement>(null)
+  const anchorRef = useRef<HTMLDivElement>(null)
+  const language = useMemo(() => getAccessControlTemplateLanguage(locale), [locale])
+
+  const {
+    data: rolesData,
+    isLoading: rolesLoading,
+    error,
+    hasNextPage,
+    isFetchingNextPage,
+    fetchNextPage,
+  } = useWorkspaceRoleList({
+    page: 1,
+    limit: PAGE_SIZE,
+    include_owner: includeOwner ? 1 : 0,
+    language,
+  })
+
+  useEffect(() => {
+    const hasMore = hasNextPage ?? true
+    let observer: IntersectionObserver | undefined
+
+    if (error)
+      return
+
+    if (anchorRef.current && containerRef.current) {
+      const containerHeight = containerRef.current.clientHeight
+      const dynamicMargin = Math.max(100, Math.min(containerHeight * 0.2, 200))
+
+      observer = new IntersectionObserver((entries) => {
+        if (entries[0]!.isIntersecting && !rolesLoading && !isFetchingNextPage && !error && hasMore)
+          fetchNextPage()
+      }, {
+        root: containerRef.current,
+        rootMargin: `${dynamicMargin}px`,
+      })
+      observer.observe(anchorRef.current)
+    }
+    return () => observer?.disconnect()
+  }, [rolesLoading, isFetchingNextPage, fetchNextPage, error, hasNextPage])
+
+  const roles = useMemo(() => rolesData?.pages.flatMap(page => page.data) ?? [], [rolesData])
+  const roleById = useMemo(() => {
+    return new Map(roles.map(role => [role.id, role]))
+  }, [roles])
+  const selectedRoleIdSet = useMemo(() => new Set(selectedRoleIds), [selectedRoleIds])
+  const disabledRoleIdSet = useMemo(() => new Set(disabledRoleIds), [disabledRoleIds])
+  const selectedRoleObjects = useMemo(() => {
+    if (selectedRoles)
+      return selectedRoles
+
+    return selectedRoleIds.map(roleId => roleById.get(roleId) ?? createSelectedRolePlaceholder(roleId))
+  }, [roleById, selectedRoleIds, selectedRoles])
+
+  const filteredRoles = useMemo(() => {
+    const trimmed = keyword.trim().toLowerCase()
+    if (!trimmed)
+      return roles
+
+    return roles.filter(
+      role =>
+        role.name.toLowerCase().includes(trimmed)
+        || role.description?.toLowerCase().includes(trimmed),
+    )
+  }, [roles, keyword])
+
+  const toggleRole = useCallback((role: Role) => {
+    if (disabledRoleIdSet.has(role.id))
+      return
+
+    if (!allowMultipleRoles) {
+      onSelectedRolesChange(selectedRoleIdSet.has(role.id) ? selectedRoleObjects : [role])
+      return
+    }
+
+    onSelectedRolesChange(
+      selectedRoleIdSet.has(role.id)
+        ? selectedRoleObjects.filter(selectedRole => selectedRole.id !== role.id)
+        : [...selectedRoleObjects, role],
+    )
+  }, [allowMultipleRoles, disabledRoleIdSet, onSelectedRolesChange, selectedRoleIdSet, selectedRoleObjects])
+
+  const handleRadioValueChange = useCallback((roleId: string) => {
+    const role = roleById.get(roleId)
+    if (!role || disabledRoleIdSet.has(role.id))
+      return
+
+    onSelectedRolesChange([role])
+  }, [disabledRoleIdSet, onSelectedRolesChange, roleById])
+
+  const renderRoleText = (role: Role) => (
+    <div className="min-w-0 flex-1">
+      <div className="system-sm-semibold text-text-secondary">
+        {role.name}
+      </div>
+      <div className="mt-0.5 system-xs-regular text-text-tertiary">
+        {role.description || t('role.noDescription', { ns: 'permission' })}
+      </div>
+    </div>
+  )
+
+  return (
+    <>
+      <div className="shrink-0 px-6 pt-3 pb-2">
+        <div className="relative">
+          <span
+            aria-hidden
+            className="pointer-events-none absolute top-1/2 left-3 i-ri-search-line size-4 -translate-y-1/2 text-text-tertiary"
+          />
+          <Input
+            value={keyword}
+            onChange={e => setKeyword(e.target.value)}
+            placeholder={t('role.searchPlaceholder', { ns: 'permission' })}
+            className="pr-8 pl-8"
+          />
+          {keyword && (
+            <button
+              type="button"
+              className="absolute top-1/2 right-2 flex size-5 -translate-y-1/2 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:outline-2 focus-visible:-outline-offset-1 focus-visible:outline-components-input-border-active"
+              aria-label={t('operation.clear', { ns: 'common' })}
+              onClick={() => setKeyword('')}
+            >
+              <span aria-hidden className="i-ri-close-line size-4" />
+            </button>
+          )}
+        </div>
+      </div>
+
+      <ScrollArea
+        ref={containerRef}
+        className="min-h-0 flex-1"
+        slotClassNames={{ viewport: 'px-3 overscroll-contain' }}
+      >
+        {rolesLoading
+          ? (
+              <div className="px-3 py-6 text-center system-sm-regular text-text-tertiary">
+                {t('role.loading', { ns: 'permission' })}
+              </div>
+            )
+          : filteredRoles.length === 0
+            ? (
+                <div className="px-3 py-6 text-center system-sm-regular text-text-tertiary">
+                  {t('role.noMatchingRoles', { ns: 'permission' })}
+                </div>
+              )
+            : (
+                <>
+                  {allowMultipleRoles
+                    ? (
+                        <ul className="flex flex-col gap-0.5 pb-2">
+                          {filteredRoles.map((role) => {
+                            const checked = selectedRoleIdSet.has(role.id)
+                            const disabled = disabledRoleIdSet.has(role.id)
+                            const handleToggle = () => toggleRole(role)
+
+                            return (
+                              <li key={role.id}>
+                                <div
+                                  role="checkbox"
+                                  aria-checked={checked}
+                                  aria-disabled={disabled}
+                                  tabIndex={disabled ? -1 : 0}
+                                  className={cn(
+                                    'flex cursor-pointer items-start gap-3 rounded-lg px-3 py-2.5 hover:bg-state-base-hover focus-visible:outline-2 focus-visible:-outline-offset-2 focus-visible:outline-components-input-border-active',
+                                    checked && 'bg-state-accent-hover hover:bg-state-accent-hover',
+                                    disabled && 'cursor-not-allowed opacity-50 hover:bg-transparent',
+                                  )}
+                                  onClick={handleToggle}
+                                  onKeyDown={(e) => {
+                                    if (e.key === ' ' || e.key === 'Enter') {
+                                      e.preventDefault()
+                                      handleToggle()
+                                    }
+                                  }}
+                                >
+                                  <Checkbox
+                                    checked={checked}
+                                    disabled={disabled}
+                                    className="pointer-events-none mt-0.5"
+                                  />
+                                  {renderRoleText(role)}
+                                </div>
+                              </li>
+                            )
+                          })}
+                        </ul>
+                      )
+                    : (
+                        <RadioGroup
+                          value={selectedRoleIds[0] ?? ''}
+                          onValueChange={handleRadioValueChange}
+                          className="flex-col items-stretch gap-0.5 pb-2"
+                          render={<ul />}
+                        >
+                          {filteredRoles.map((role) => {
+                            const checked = selectedRoleIdSet.has(role.id)
+                            const disabled = disabledRoleIdSet.has(role.id)
+
+                            return (
+                              <li key={role.id}>
+                                <RadioRoot
+                                  value={role.id}
+                                  disabled={disabled}
+                                  variant="unstyled"
+                                  render={(
+                                    <div
+                                      className={cn(
+                                        'flex cursor-pointer items-start gap-3 rounded-lg px-3 py-2.5 hover:bg-state-base-hover focus-visible:outline-2 focus-visible:-outline-offset-2 focus-visible:outline-components-input-border-active',
+                                        checked && 'bg-state-accent-hover hover:bg-state-accent-hover',
+                                        disabled && 'cursor-not-allowed opacity-50 hover:bg-transparent',
+                                      )}
+                                    />
+                                  )}
+                                >
+                                  <RadioControl className="pointer-events-none mt-0.5" />
+                                  {renderRoleText(role)}
+                                </RadioRoot>
+                              </li>
+                            )
+                          })}
+                        </RadioGroup>
+                      )}
+                  <div ref={anchorRef} className="h-0" />
+                </>
+              )}
+      </ScrollArea>
+    </>
+  )
+}
+
+export default WorkspaceRoleCheckboxList
diff --git a/web/app/components/header/app-nav/__tests__/index.spec.tsx b/web/app/components/header/app-nav/__tests__/index.spec.tsx
index 1fd30271ac9..adcaf17d2da 100644
--- a/web/app/components/header/app-nav/__tests__/index.spec.tsx
+++ b/web/app/components/header/app-nav/__tests__/index.spec.tsx
@@ -2,9 +2,9 @@ import { useInfiniteQuery } from '@tanstack/react-query'
 import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { useStore as useAppStore } from '@/app/components/app/store'
-import { useAppContext } from '@/context/app-context'
 import { useParams } from '@/next/navigation'
 import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 import AppNav from '../index'
 
 const mockAppListInfiniteOptions = vi.hoisted(() => vi.fn((options: unknown) => options))
@@ -19,14 +19,18 @@ vi.mock('react-i18next', () => ({
   }),
 }))
 
-vi.mock('@/context/app-context', () => ({
-  useAppContext: vi.fn(),
-}))
-
 vi.mock('@/app/components/app/store', () => ({
   useStore: vi.fn(),
 }))
 
+let mockWorkspacePermissionKeys: string[] = ['app.create_and_management']
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 vi.mock('@/service/client', () => ({
   consoleQuery: {
     apps: {
@@ -151,11 +155,11 @@ const mockAppData = [
     icon: '🤖',
     icon_background: null,
     icon_url: null,
+    permission_keys: [] as string[],
   },
 ]
 
 const mockUseParams = vi.mocked(useParams)
-const mockUseAppContext = vi.mocked(useAppContext)
 const mockUseAppStore = vi.mocked(useAppStore)
 const mockUseInfiniteQuery = vi.mocked(useInfiniteQuery)
 let mockAppDetail: { id: string, name: string } | null = null
@@ -168,14 +172,12 @@ const setupDefaultMocks = (options?: {
   hasNextPage?: boolean
   refetch?: () => void
   fetchNextPage?: () => void
-  isEditor?: boolean
   appData?: typeof mockAppData
 }) => {
   const refetch = options?.refetch ?? vi.fn()
   const fetchNextPage = options?.fetchNextPage ?? vi.fn()
 
   mockUseParams.mockReturnValue({ appId: 'app-1' } as ReturnType<typeof useParams>)
-  mockUseAppContext.mockReturnValue({ isCurrentWorkspaceEditor: options?.isEditor ?? false } as ReturnType<typeof useAppContext>)
   mockUseAppStore.mockImplementation((selector: unknown) => (selector as (state: { appDetail: { id: string, name: string } | null }) => unknown)({ appDetail: mockAppDetail }))
   mockUseInfiniteQuery.mockReturnValue({
     data: { pages: [{ data: options?.appData ?? mockAppData }] },
@@ -192,6 +194,7 @@ describe('AppNav', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockAppDetail = null
+    mockWorkspacePermissionKeys = ['app.create_and_management']
     setupDefaultMocks()
   })
 
@@ -212,6 +215,15 @@ describe('AppNav', () => {
     expect(options.getNextPageParam({ has_more: false, page: 3 })).toBeUndefined()
   })
 
+  it('should keep snippets configured as an active studio child link after rerender setup', () => {
+    setupDefaultMocks()
+    render(<AppNav />)
+
+    expect(screen.getByTestId('nav-text')).toHaveTextContent('menus.apps')
+    expect(screen.getByTestId('nav-active-segment')).toHaveTextContent(JSON.stringify(['apps', 'app', 'snippets']))
+    expect(screen.getByTestId('nav-active-link')).toHaveTextContent('snippets:tabs.snippets->/snippets')
+  })
+
   it('should configure snippets as an active studio child link', () => {
     setupDefaultMocks()
     render(<AppNav />)
@@ -221,9 +233,8 @@ describe('AppNav', () => {
     expect(screen.getByTestId('nav-active-link')).toHaveTextContent('snippets:tabs.snippets->/snippets')
   })
 
-  it('should build editor links and update app name when app detail changes', async () => {
+  it('should build layout links from app ACL and update app name when app detail changes', async () => {
     setupDefaultMocks({
-      isEditor: true,
       appData: [
         {
           id: 'app-1',
@@ -233,6 +244,7 @@ describe('AppNav', () => {
           icon: '🤖',
           icon_background: null,
           icon_url: null,
+          permission_keys: [AppACLPermission.Edit],
         },
         {
           id: 'app-2',
@@ -242,6 +254,7 @@ describe('AppNav', () => {
           icon: '⚙️',
           icon_background: null,
           icon_url: null,
+          permission_keys: [AppACLPermission.TestAndRun],
         },
       ],
     })
@@ -304,6 +317,20 @@ describe('AppNav', () => {
     })
   })
 
+  it('should not open create modals without app.create_and_management permission', async () => {
+    const user = userEvent.setup()
+    mockWorkspacePermissionKeys = []
+    render(<AppNav />)
+
+    await user.click(screen.getByTestId('create-blank'))
+    await user.click(screen.getByTestId('create-template'))
+    await user.click(screen.getByTestId('create-dsl'))
+
+    expect(screen.queryByTestId('create-app-modal')).not.toBeInTheDocument()
+    expect(screen.queryByTestId('create-app-template-dialog')).not.toBeInTheDocument()
+    expect(screen.queryByTestId('create-from-dsl-modal')).not.toBeInTheDocument()
+  })
+
   it('should load more when user clicks load more and more data is available', async () => {
     const user = userEvent.setup()
     const { fetchNextPage } = setupDefaultMocks({ hasNextPage: true })
@@ -322,10 +349,9 @@ describe('AppNav', () => {
     expect(fetchNextPage).not.toHaveBeenCalled()
   })
 
-  // Non-editor link path: isCurrentWorkspaceEditor=false → link ends with /overview
-  it('should build overview links when user is not editor', () => {
+  it('should build overview links when app layout ACL is missing', () => {
     // Arrange
-    setupDefaultMocks({ isEditor: false })
+    setupDefaultMocks()
 
     // Act
     render(<AppNav />)
@@ -359,7 +385,6 @@ describe('AppNav', () => {
   it('should build workflow link for ADVANCED_CHAT mode when user is editor', () => {
     // Arrange
     setupDefaultMocks({
-      isEditor: true,
       appData: [
         {
           id: 'app-3',
@@ -369,6 +394,7 @@ describe('AppNav', () => {
           icon: '💬',
           icon_background: null,
           icon_url: null,
+          permission_keys: [AppACLPermission.ViewLayout],
         },
       ],
     })
@@ -383,7 +409,20 @@ describe('AppNav', () => {
   // No-match update path: appDetail.id doesn't match any nav item
   it('should not change nav item names when appDetail id does not match any item', async () => {
     // Arrange
-    setupDefaultMocks({ isEditor: true })
+    setupDefaultMocks({
+      appData: [
+        {
+          id: 'app-1',
+          name: 'App 1',
+          mode: AppModeEnum.AGENT_CHAT,
+          icon_type: 'emoji',
+          icon: '🤖',
+          icon_background: null,
+          icon_url: null,
+          permission_keys: [AppACLPermission.Edit],
+        },
+      ],
+    })
     const { rerender } = render(<AppNav />)
 
     // Act - set appDetail to a non-matching id
diff --git a/web/app/components/header/app-nav/index.tsx b/web/app/components/header/app-nav/index.tsx
index fffeb8055cd..47c3a56a9e3 100644
--- a/web/app/components/header/app-nav/index.tsx
+++ b/web/app/components/header/app-nav/index.tsx
@@ -2,19 +2,16 @@
 
 import type { NavItem } from '../nav/nav-selector'
 import type { AppListQuery } from '@/contract/console/apps'
-import {
-  RiRobot2Fill,
-  RiRobot2Line,
-} from '@remixicon/react'
 import { keepPreviousData, useInfiniteQuery } from '@tanstack/react-query'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import dynamic from '@/next/dynamic'
 import { useParams } from '@/next/navigation'
 import { consoleQuery } from '@/service/client'
 import { AppModeEnum } from '@/types/app'
+import { getAppACLCapabilities, hasPermission } from '@/utils/permission'
 import Nav from '../nav'
 
 const CreateAppTemplateDialog = dynamic(() => import('@/app/components/app/create-app-dialog'), { ssr: false })
@@ -27,8 +24,8 @@ const appNavListQuery = {
   name: '',
 } satisfies AppListQuery
 
-const getAppLink = (isCurrentWorkspaceEditor: boolean, appId: string, appMode: AppModeEnum) => {
-  if (!isCurrentWorkspaceEditor)
+const getAppLink = (canAccessLayout: boolean, appId: string, appMode: AppModeEnum) => {
+  if (!canAccessLayout)
     return `/app/${appId}/overview`
 
   if (appMode === AppModeEnum.WORKFLOW || appMode === AppModeEnum.ADVANCED_CHAT)
@@ -40,8 +37,10 @@ const getAppLink = (isCurrentWorkspaceEditor: boolean, appId: string, appMode: A
 const AppNav = () => {
   const { t } = useTranslation()
   const { appId } = useParams()
-  const { isCurrentWorkspaceEditor } = useAppContext()
   const appDetail = useAppStore(state => state.appDetail)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
   const [showNewAppDialog, setShowNewAppDialog] = useState(false)
   const [showNewAppTemplateDialog, setShowNewAppTemplateDialog] = useState(false)
   const [showCreateFromDSLModal, setShowCreateFromDSLModal] = useState(false)
@@ -72,14 +71,17 @@ const AppNav = () => {
       fetchNextPage()
   }, [fetchNextPage, hasNextPage])
 
-  const openModal = (state: string) => {
+  const openModal = useCallback((state: string) => {
+    if (!canCreateApp)
+      return
+
     if (state === 'blank')
       setShowNewAppDialog(true)
     if (state === 'template')
       setShowNewAppTemplateDialog(true)
     if (state === 'dsl')
       setShowCreateFromDSLModal(true)
-  }
+  }, [canCreateApp])
 
   const navItems = useMemo<NavItem[]>(() => {
     const appItems = appsData?.pages.flatMap(appData => appData.data) ?? []
@@ -92,16 +94,20 @@ const AppNav = () => {
       icon_url: app.icon_url,
       name: appDetail?.id === app.id ? appDetail.name : app.name,
       mode: app.mode,
-      link: getAppLink(isCurrentWorkspaceEditor, app.id, app.mode),
+      link: getAppLink(getAppACLCapabilities(app.permission_keys, {
+        currentUserId,
+        resourceMaintainer: app.maintainer,
+        workspacePermissionKeys,
+      }).canAccessLayout, app.id, app.mode),
     }))
-  }, [appDetail?.id, appDetail?.name, appsData?.pages, isCurrentWorkspaceEditor])
+  }, [appDetail?.id, appDetail?.name, appsData?.pages, currentUserId, workspacePermissionKeys])
 
   return (
     <>
       <Nav
         isApp
-        icon={<RiRobot2Line className="size-4" />}
-        activeIcon={<RiRobot2Fill className="size-4" />}
+        icon={<span className="i-ri-robot-2-line size-4" />}
+        activeIcon={<span className="i-ri-robot-2-fill size-4" />}
         text={t('menus.apps', { ns: 'common' })}
         activeSegment={['apps', 'app', 'snippets']}
         link="/apps"
@@ -118,17 +124,17 @@ const AppNav = () => {
         isLoadingMore={isFetchingNextPage}
       />
       <CreateAppModal
-        show={showNewAppDialog}
+        show={canCreateApp && showNewAppDialog}
         onClose={() => setShowNewAppDialog(false)}
         onSuccess={() => refetch()}
       />
       <CreateAppTemplateDialog
-        show={showNewAppTemplateDialog}
+        show={canCreateApp && showNewAppTemplateDialog}
         onClose={() => setShowNewAppTemplateDialog(false)}
         onSuccess={() => refetch()}
       />
       <CreateFromDSLModal
-        show={showCreateFromDSLModal}
+        show={canCreateApp && showCreateFromDSLModal}
         onClose={() => setShowCreateFromDSLModal(false)}
         onSuccess={() => refetch()}
       />
diff --git a/web/app/components/header/assets/serpapi.png b/web/app/components/header/assets/serpapi.png
deleted file mode 100644
index 9650453ed5f..00000000000
Binary files a/web/app/components/header/assets/serpapi.png and /dev/null differ
diff --git a/web/app/components/header/dataset-nav/__tests__/index.spec.tsx b/web/app/components/header/dataset-nav/__tests__/index.spec.tsx
index 56c3c4bee08..38e4169eb24 100644
--- a/web/app/components/header/dataset-nav/__tests__/index.spec.tsx
+++ b/web/app/components/header/dataset-nav/__tests__/index.spec.tsx
@@ -10,7 +10,7 @@ import {
   useDatasetDetail,
   useDatasetList,
 } from '@/service/knowledge/use-dataset'
-import DatasetNav from '../index'
+import { DatasetNav } from '../index'
 
 vi.mock('@/next/navigation', () => ({
   useParams: vi.fn(),
@@ -132,6 +132,7 @@ describe('DatasetNav', () => {
     } as unknown as ReturnType<typeof useDatasetList>)
     vi.mocked(useAppContext).mockReturnValue({
       isCurrentWorkspaceEditor: true,
+      workspacePermissionKeys: ['dataset.create_and_management'],
     } as unknown as ReturnType<typeof useAppContext>)
   })
 
@@ -174,30 +175,34 @@ describe('DatasetNav', () => {
       expect(within(menu).getByText('Null Icon Dataset')).toBeInTheDocument()
     })
 
-    it('should navigate to correct link when an item is clicked', () => {
-      render(<DatasetNav />)
+    it('should navigate to correct links for navigation items', () => {
+      const { unmount } = render(<DatasetNav />)
       const selector = screen.getByRole('button', { name: /Test Dataset/i })
       fireEvent.click(selector)
 
       const menu = screen.getByRole('menu')
       const pipelineItem = within(menu).getByText('Pipeline Dataset')
-      fireEvent.click(pipelineItem)
 
       // dataset-2 is rag_pipeline and not published -> /datasets/dataset-2/pipeline
+      fireEvent.click(pipelineItem)
       expect(mockPush).toHaveBeenCalledWith('/datasets/dataset-2/pipeline')
 
-      fireEvent.click(selector)
-      const menu2 = screen.getByRole('menu')
-      const externalItem = within(menu2).getByText('External Dataset')
-      fireEvent.click(externalItem)
+      unmount()
+      mockPush.mockClear()
+      render(<DatasetNav />)
+      fireEvent.click(screen.getByRole('button', { name: /Test Dataset/i }))
+
+      const externalItem = within(screen.getByRole('menu')).getByText('External Dataset')
       // dataset-3 is provider external -> /datasets/dataset-3/hitTesting
+      fireEvent.click(externalItem)
       expect(mockPush).toHaveBeenCalledWith('/datasets/dataset-3/hitTesting')
 
-      fireEvent.click(selector)
-      const menu3 = screen.getByRole('menu')
-      const publishedItem = within(menu3).getByText('Published Pipeline')
-      fireEvent.click(publishedItem)
+      mockPush.mockClear()
+      fireEvent.click(screen.getByRole('button', { name: /Test Dataset/i }))
+
+      const publishedItem = within(screen.getByRole('menu')).getByText('Published Pipeline')
       // dataset-4 is rag_pipeline and published -> /datasets/dataset-4/documents
+      fireEvent.click(publishedItem)
       expect(mockPush).toHaveBeenCalledWith('/datasets/dataset-4/documents')
     })
   })
diff --git a/web/app/components/header/dataset-nav/index.tsx b/web/app/components/header/dataset-nav/index.tsx
index 394ecca26f1..578fcc4797a 100644
--- a/web/app/components/header/dataset-nav/index.tsx
+++ b/web/app/components/header/dataset-nav/index.tsx
@@ -3,32 +3,71 @@
 import type { NavItem } from '../nav/nav-selector'
 import type { DataSet, IconInfo } from '@/models/datasets'
 import { flatten } from 'es-toolkit/compat'
-import { useCallback, useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useParams, useRouter } from '@/next/navigation'
 import { useDatasetDetail, useDatasetList } from '@/service/knowledge/use-dataset'
 import { basePath } from '@/utils/var'
 import Nav from '../nav'
 
-const DEFAULT_DATASET_ICON: IconInfo = {
-  icon_type: 'emoji',
+const DEFAULT_DATASET_ICON_INFO = {
   icon: '📙',
+  icon_type: 'emoji',
   icon_background: '#FFF4ED',
   icon_url: '',
-}
+} satisfies IconInfo
 
 type NullableDatasetIconInfo = Partial<{
   [Key in keyof IconInfo]: IconInfo[Key] | null
 }>
 
-const normalizeDatasetIconInfo = (iconInfo?: NullableDatasetIconInfo | null): IconInfo => ({
-  icon_type: iconInfo?.icon_type ?? DEFAULT_DATASET_ICON.icon_type,
-  icon: iconInfo?.icon ?? DEFAULT_DATASET_ICON.icon,
-  icon_background: iconInfo?.icon_background ?? DEFAULT_DATASET_ICON.icon_background,
-  icon_url: iconInfo?.icon_url ?? DEFAULT_DATASET_ICON.icon_url,
-})
+function normalizeDatasetIconInfo(iconInfo?: NullableDatasetIconInfo | null): IconInfo {
+  return {
+    icon: iconInfo?.icon ?? DEFAULT_DATASET_ICON_INFO.icon,
+    icon_type: iconInfo?.icon_type ?? DEFAULT_DATASET_ICON_INFO.icon_type,
+    icon_background: iconInfo?.icon_background ?? DEFAULT_DATASET_ICON_INFO.icon_background,
+    icon_url: iconInfo?.icon_url ?? DEFAULT_DATASET_ICON_INFO.icon_url,
+  }
+}
 
-const DatasetNav = () => {
+function datasetLink(dataset: DataSet) {
+  const isPipelineUnpublished = dataset.runtime_mode === 'rag_pipeline' && !dataset.is_published
+  const link = isPipelineUnpublished
+    ? `/datasets/${dataset.id}/pipeline`
+    : `/datasets/${dataset.id}/documents`
+
+  return dataset.provider === 'external'
+    ? `/datasets/${dataset.id}/hitTesting`
+    : link
+}
+
+function currentDatasetNavItem(dataset: DataSet) {
+  const iconInfo = normalizeDatasetIconInfo(dataset.icon_info)
+
+  return {
+    id: dataset.id,
+    name: dataset.name,
+    icon: iconInfo.icon,
+    icon_type: iconInfo.icon_type,
+    icon_background: iconInfo.icon_background ?? null,
+    icon_url: iconInfo.icon_url ?? null,
+  } satisfies Omit<NavItem, 'link'>
+}
+
+function datasetNavItem(dataset: DataSet) {
+  const iconInfo = normalizeDatasetIconInfo(dataset.icon_info)
+
+  return {
+    id: dataset.id,
+    name: dataset.name,
+    link: datasetLink(dataset),
+    icon: iconInfo.icon,
+    icon_type: iconInfo.icon_type,
+    icon_background: iconInfo.icon_background ?? null,
+    icon_url: iconInfo.icon_url ?? null,
+  } satisfies NavItem
+}
+
+export function DatasetNav() {
   const { t } = useTranslation()
   const router = useRouter()
   const { datasetId } = useParams()
@@ -44,64 +83,23 @@ const DatasetNav = () => {
   })
   const datasetItems = flatten(datasetList?.pages.map(datasetData => datasetData.data))
 
-  const curNav = useMemo(() => {
-    if (!currentDataset)
-      return
-    const iconInfo = normalizeDatasetIconInfo(currentDataset.icon_info)
-    return {
-      id: currentDataset.id,
-      name: currentDataset.name,
-      icon: iconInfo.icon,
-      icon_type: iconInfo.icon_type,
-      icon_background: iconInfo.icon_background ?? null,
-      icon_url: iconInfo.icon_url ?? null,
-    } as Omit<NavItem, 'link'>
-  }, [currentDataset])
+  const curNav = currentDataset ? currentDatasetNavItem(currentDataset) : undefined
+  const navigationItems = datasetItems.map(datasetNavItem)
+  const runtimeMode = currentDataset?.runtime_mode
+  const createRoute = runtimeMode === 'rag_pipeline'
+    ? `${basePath}/datasets/create-from-pipeline`
+    : `${basePath}/datasets/create`
 
-  const getDatasetLink = useCallback((dataset: DataSet) => {
-    const isPipelineUnpublished = dataset.runtime_mode === 'rag_pipeline' && !dataset.is_published
-    const link = isPipelineUnpublished
-      ? `/datasets/${dataset.id}/pipeline`
-      : `/datasets/${dataset.id}/documents`
-    return dataset.provider === 'external'
-      ? `/datasets/${dataset.id}/hitTesting`
-      : link
-  }, [])
-
-  const navigationItems = useMemo(() => {
-    return datasetItems.map((dataset) => {
-      const link = getDatasetLink(dataset)
-      const iconInfo = normalizeDatasetIconInfo(dataset.icon_info)
-      return {
-        id: dataset.id,
-        name: dataset.name,
-        link,
-        icon: iconInfo.icon,
-        icon_type: iconInfo.icon_type,
-        icon_background: iconInfo.icon_background ?? null,
-        icon_url: iconInfo.icon_url ?? null,
-      }
-    }) as NavItem[]
-  }, [datasetItems, getDatasetLink])
-
-  const createRoute = useMemo(() => {
-    const runtimeMode = currentDataset?.runtime_mode
-    if (runtimeMode === 'rag_pipeline')
-      return `${basePath}/datasets/create-from-pipeline`
-    else
-      return `${basePath}/datasets/create`
-  }, [currentDataset?.runtime_mode])
-
-  const handleLoadMore = useCallback(() => {
-    if (hasNextPage)
-      fetchNextPage()
-  }, [hasNextPage, fetchNextPage])
+  function handleLoadMore() {
+    if (hasNextPage && !isFetchingNextPage)
+      void fetchNextPage()
+  }
 
   return (
     <Nav
       isApp={false}
-      icon={<span className="i-ri-book-2-line size-4" />}
-      activeIcon={<span className="i-ri-book-2-fill size-4" />}
+      icon={<span aria-hidden className="i-ri-book-2-line size-4" />}
+      activeIcon={<span aria-hidden className="i-ri-book-2-fill size-4" />}
       text={t('menus.datasets', { ns: 'common' })}
       activeSegment="datasets"
       link="/datasets"
@@ -114,5 +112,3 @@ const DatasetNav = () => {
     />
   )
 }
-
-export default DatasetNav
diff --git a/web/app/components/header/explore-nav/__tests__/index.spec.tsx b/web/app/components/header/explore-nav/__tests__/index.spec.tsx
index b01bac710f6..07617b337a5 100644
--- a/web/app/components/header/explore-nav/__tests__/index.spec.tsx
+++ b/web/app/components/header/explore-nav/__tests__/index.spec.tsx
@@ -1,7 +1,7 @@
 import type { Mock } from 'vitest'
 import { render, screen } from '@testing-library/react'
 import { usePathname, useSelectedLayoutSegment } from '@/next/navigation'
-import ExploreNav from '../index'
+import { ExploreNav } from '../index'
 
 vi.mock('@/next/navigation', () => ({
   usePathname: vi.fn(),
diff --git a/web/app/components/header/explore-nav/index.tsx b/web/app/components/header/explore-nav/index.tsx
index 3f3f57b0296..f42326e2100 100644
--- a/web/app/components/header/explore-nav/index.tsx
+++ b/web/app/components/header/explore-nav/index.tsx
@@ -9,13 +9,11 @@ import { useTranslation } from 'react-i18next'
 import Link from '@/next/link'
 import { usePathname, useSelectedLayoutSegment } from '@/next/navigation'
 
-type ExploreNavProps = {
-  className?: string
-}
-
-const ExploreNav = ({
+export function ExploreNav({
   className,
-}: ExploreNavProps) => {
+}: {
+  className?: string
+}) {
   const { t } = useTranslation()
   const pathname = usePathname()
   const selectedSegment = useSelectedLayoutSegment()
@@ -31,11 +29,9 @@ const ExploreNav = ({
           ? <RiPlanetFill className="size-4" />
           : <RiPlanetLine className="size-4" />
       }
-      <div className="ml-2 max-[1024px]:hidden">
+      <div className="ml-2 max-[1120px]:hidden">
         {t('menus.explore', { ns: 'common' })}
       </div>
     </Link>
   )
 }
-
-export default ExploreNav
diff --git a/web/app/components/header/header-wrapper.tsx b/web/app/components/header/header-wrapper.tsx
index 52c91c92061..efff8432174 100644
--- a/web/app/components/header/header-wrapper.tsx
+++ b/web/app/components/header/header-wrapper.tsx
@@ -1,12 +1,12 @@
 'use client'
 import type { EventEmitterValue } from '@/context/event-emitter'
 import { cn } from '@langgenius/dify-ui/cn'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import * as React from 'react'
 import { useState } from 'react'
 import { useEventEmitterContextContext } from '@/context/event-emitter'
 import { usePathname } from '@/next/navigation'
 import s from './index.module.css'
+import { useWorkflowCanvasMaximizeValue } from './storage'
 
 type HeaderWrapperProps = {
   children: React.ReactNode
@@ -19,7 +19,7 @@ const HeaderWrapper = ({
   const isBordered = ['/apps', '/snippets', '/datasets/create', '/tools'].includes(pathname)
   const inWorkflowCanvas = pathname.endsWith('/workflow')
   const isPipelineCanvas = pathname.endsWith('/pipeline')
-  const [storedHideHeader] = useLocalStorage<boolean>('workflow-canvas-maximize', false)
+  const storedHideHeader = useWorkflowCanvasMaximizeValue()
   const [eventHideHeader, setEventHideHeader] = useState<boolean | null>(null)
   const hideHeader = eventHideHeader ?? storedHideHeader
   const { eventEmitter } = useEventEmitterContextContext()
diff --git a/web/app/components/header/index.tsx b/web/app/components/header/index.tsx
index afbe6b030f3..5c496952a40 100644
--- a/web/app/components/header/index.tsx
+++ b/web/app/components/header/index.tsx
@@ -1,25 +1,26 @@
 'use client'
 import { useSuspenseQuery } from '@tanstack/react-query'
-import { useCallback } from 'react'
 import DifyLogo from '@/app/components/base/logo/dify-logo'
 import WorkplaceSelector from '@/app/components/header/account-dropdown/workplace-selector'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
-import { useAppContext } from '@/context/app-context'
+import { useAppContext, useSelector as useAppContextSelector } from '@/context/app-context'
 import { useModalContext } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
+import { DeploymentsNav } from '@/features/deployments/nav'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
 import Link from '@/next/link'
+import { hasPermission } from '@/utils/permission'
 import { Plan } from '../billing/type'
 import AccountDropdown from './account-dropdown'
 import AppNav from './app-nav'
-import DatasetNav from './dataset-nav'
+import { DatasetNav } from './dataset-nav'
 import EnvNav from './env-nav'
-import ExploreNav from './explore-nav'
+import { ExploreNav } from './explore-nav'
 import LicenseNav from './license-env'
 import { PlanBadge } from './plan-badge'
 import PluginsNav from './plugins-nav'
-import ToolsNav from './tools-nav'
+import { ToolsNav } from './tools-nav'
 
 const navClassName = `
   flex items-center relative px-3 h-8 rounded-xl
@@ -27,21 +28,27 @@ const navClassName = `
   cursor-pointer
 `
 
-const Header = () => {
-  const { isCurrentWorkspaceEditor, isCurrentWorkspaceDatasetOperator } = useAppContext()
+export function Header() {
+  const workspacePermissionKeys = useAppContextSelector(s => s.workspacePermissionKeys)
   const media = useBreakpoints()
   const isMobile = media === MediaType.mobile
+  const { isCurrentWorkspaceEditor } = useAppContext()
   const { enableBilling, plan } = useProviderContext()
   const { setShowPricingModal, setShowAccountSettingModal } = useModalContext()
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const isFreePlan = plan.type === Plan.sandbox
   const isBrandingEnabled = systemFeatures.branding.enabled
-  const handlePlanClick = useCallback(() => {
+  const canUseAppDeploy = isCurrentWorkspaceEditor && systemFeatures.enable_app_deploy
+
+  function handlePlanClick() {
     if (isFreePlan)
       setShowPricingModal()
     else
       setShowAccountSettingModal({ payload: ACCOUNT_SETTING_TAB.BILLING })
-  }, [isFreePlan, setShowAccountSettingModal, setShowPricingModal])
+  }
+
+  const canAccessExplorePage = hasPermission(workspacePermissionKeys, 'app_library.access')
+  const canAccessToolsPage = hasPermission(workspacePermissionKeys, ['tool.manage', 'mcp.manage'])
 
   const logoLabel = isBrandingEnabled && systemFeatures.branding.application_title ? systemFeatures.branding.application_title : 'Dify'
   const renderLogo = () => (
@@ -72,45 +79,42 @@ const Header = () => {
             <WorkplaceSelector />
             {enableBilling ? <PlanBadge allowHover sandboxAsUpgrade plan={plan.type} onClick={handlePlanClick} /> : <LicenseNav />}
           </div>
-          <div className="flex items-center">
-            <div className="mr-2">
-              <PluginsNav />
-            </div>
+          <div className="flex items-center gap-2">
+            <PluginsNav />
             <AccountDropdown />
           </div>
         </div>
-        <div className="my-1 flex items-center justify-center space-x-1">
-          {!isCurrentWorkspaceDatasetOperator && <ExploreNav className={navClassName} />}
-          {!isCurrentWorkspaceDatasetOperator && <AppNav />}
-          {(isCurrentWorkspaceEditor || isCurrentWorkspaceDatasetOperator) && <DatasetNav />}
-          {!isCurrentWorkspaceDatasetOperator && <ToolsNav className={navClassName} />}
+        <div className="my-1 flex items-center justify-center gap-1">
+          {canAccessExplorePage && <ExploreNav className={navClassName} />}
+          <AppNav />
+          <DatasetNav />
+          {canAccessToolsPage && <ToolsNav className={navClassName} />}
+          {canUseAppDeploy && <DeploymentsNav />}
         </div>
       </div>
     )
   }
 
   return (
-    <div className="flex h-[56px] items-center">
-      <div className="flex min-w-0 flex-1 items-center pr-2 pl-3 min-[1280px]:pr-3">
+    <div className="flex h-14 items-center">
+      <div className="flex min-w-0 flex-1 items-center overflow-hidden pr-2 pl-3 min-[1280px]:pr-3">
         {renderLogo()}
         <div className="mx-1.5 shrink-0 font-light text-divider-deep">/</div>
         <WorkplaceSelector />
         {enableBilling ? <PlanBadge allowHover sandboxAsUpgrade plan={plan.type} onClick={handlePlanClick} /> : <LicenseNav />}
       </div>
-      <div className="flex items-center space-x-2">
-        {!isCurrentWorkspaceDatasetOperator && <ExploreNav className={navClassName} />}
-        {!isCurrentWorkspaceDatasetOperator && <AppNav />}
-        {(isCurrentWorkspaceEditor || isCurrentWorkspaceDatasetOperator) && <DatasetNav />}
-        {!isCurrentWorkspaceDatasetOperator && <ToolsNav className={navClassName} />}
+      <div className="flex min-w-0 items-center justify-center gap-2 overflow-hidden py-3">
+        {canAccessExplorePage && <ExploreNav className={navClassName} />}
+        <AppNav />
+        <DatasetNav />
+        {canAccessToolsPage && <ToolsNav className={navClassName} />}
+        {canUseAppDeploy && <DeploymentsNav />}
       </div>
-      <div className="flex min-w-0 flex-1 items-center justify-end pr-3 pl-2 min-[1280px]:pl-3">
+      <div className="flex min-w-0 flex-1 items-center justify-end gap-2 pr-3 pl-2 min-[1280px]:pl-3">
         <EnvNav />
-        <div className="mr-2">
-          <PluginsNav />
-        </div>
+        <PluginsNav />
         <AccountDropdown />
       </div>
     </div>
   )
 }
-export default Header
diff --git a/web/app/components/header/maintenance-notice.tsx b/web/app/components/header/maintenance-notice.tsx
index d3a6481f1a5..918c3ce78f4 100644
--- a/web/app/components/header/maintenance-notice.tsx
+++ b/web/app/components/header/maintenance-notice.tsx
@@ -1,15 +1,15 @@
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { X } from '@/app/components/base/icons/src/vender/line/general'
 import { useLanguage } from '@/app/components/header/account-setting/model-provider-page/hooks'
 import { NOTICE_I18N } from '@/i18n-config/language'
+import { useHideMaintenanceNotice } from './storage'
 
 const MaintenanceNotice = () => {
   const { t } = useTranslation()
   const locale = useLanguage()
 
-  const [hiddenNoticeValue, setHiddenNoticeValue] = useLocalStorage<string>('hide-maintenance-notice', '0', { raw: true })
+  const [hiddenNoticeValue, setHiddenNoticeValue] = useHideMaintenanceNotice()
   const hiddenNotice = hiddenNoticeValue === '1'
   const [closedInSession, setClosedInSession] = useState(false)
   const showNotice = !hiddenNotice && !closedInSession
diff --git a/web/app/components/header/nav/__tests__/index.spec.tsx b/web/app/components/header/nav/__tests__/index.spec.tsx
index 2dd2843c52f..09c934f69e0 100644
--- a/web/app/components/header/nav/__tests__/index.spec.tsx
+++ b/web/app/components/header/nav/__tests__/index.spec.tsx
@@ -12,14 +12,18 @@ import * as React from 'react'
 import { vi } from 'vitest'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { useAppContext } from '@/context/app-context'
-import { useRouter, useSelectedLayoutSegment } from '@/next/navigation'
+import { useSelectedLayoutSegment } from '@/next/navigation'
 import { AppModeEnum } from '@/types/app'
 import Nav from '../index'
 
+const mockPush = vi.fn()
+
 // Mock next/navigation
 vi.mock('@/next/navigation', () => ({
   useSelectedLayoutSegment: vi.fn(),
-  useRouter: vi.fn(),
+  useRouter: () => ({
+    push: mockPush,
+  }),
 }))
 
 // Mock app store
@@ -56,7 +60,6 @@ describe('Nav Component', () => {
   const mockSetAppDetail = vi.fn()
   const mockOnCreate = vi.fn()
   const mockOnLoadMore = vi.fn()
-  const mockPush = vi.fn()
 
   const navigationItems: NavItem[] = [
     {
@@ -99,10 +102,8 @@ describe('Nav Component', () => {
     vi.mocked(useAppStore).mockReturnValue(mockSetAppDetail)
     vi.mocked(useAppContext).mockReturnValue({
       isCurrentWorkspaceEditor: true,
+      workspacePermissionKeys: ['app.create_and_management', 'dataset.create_and_management'],
     } as unknown as AppContextValue)
-    vi.mocked(useRouter).mockReturnValue({
-      push: mockPush,
-    } as unknown as ReturnType<typeof useRouter>)
   })
 
   describe('Rendering', () => {
@@ -139,9 +140,9 @@ describe('Nav Component', () => {
       )
 
       expect(screen.getByText('Nav Text')).toBeInTheDocument()
-      expect(screen.getByText('Nav Text')).toHaveClass('max-[1024px]:hidden')
+      expect(screen.getByText('Nav Text')).toHaveClass('max-[1120px]:hidden')
       expect(screen.getByRole('link', { name: 'SNIPPETS' })).toHaveAttribute('href', '/snippets')
-      expect(screen.getByRole('link', { name: 'SNIPPETS' })).not.toHaveClass('max-[1024px]:hidden')
+      expect(screen.getByRole('link', { name: 'SNIPPETS' })).not.toHaveClass('max-[1120px]:hidden')
     })
 
     it('should not show hover background if not activated', () => {
@@ -213,7 +214,7 @@ describe('Nav Component', () => {
       })
     })
 
-    it('should navigate when an item is selected', async () => {
+    it('should clear app detail and navigate when an item is selected', async () => {
       vi.mocked(useSelectedLayoutSegment).mockReturnValue('snippets')
       render(<Nav {...defaultProps} activeSegment={['apps', 'app', 'snippets']} curNav={curNav} />)
       const selectorButton = screen.getByRole('button', { name: /Item 1/i })
@@ -228,6 +229,7 @@ describe('Nav Component', () => {
         fireEvent.click(item2)
       })
 
+      expect(mockSetAppDetail).toHaveBeenCalled()
       expect(mockPush).toHaveBeenCalledWith('/item2')
     })
 
@@ -248,7 +250,7 @@ describe('Nav Component', () => {
         })
       }
 
-      expect(mockPush).not.toHaveBeenCalled()
+      expect(mockSetAppDetail).not.toHaveBeenCalled()
     })
 
     it('should call onCreate when create button is clicked', async () => {
@@ -291,6 +293,7 @@ describe('Nav Component', () => {
     it('should not show create button if NOT an editor', async () => {
       vi.mocked(useAppContext).mockReturnValue({
         isCurrentWorkspaceEditor: false,
+        workspacePermissionKeys: [],
       } as unknown as AppContextValue)
       render(<Nav {...defaultProps} curNav={curNav} />)
       const selectorButton = screen.getByRole('button', { name: /Item 1/i })
diff --git a/web/app/components/header/nav/index.tsx b/web/app/components/header/nav/index.tsx
index e5518f43d05..94acdd3f685 100644
--- a/web/app/components/header/nav/index.tsx
+++ b/web/app/components/header/nav/index.tsx
@@ -7,7 +7,7 @@ import { useState } from 'react'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import Link from '@/next/link'
 import { useSelectedLayoutSegment } from '@/next/navigation'
-import NavSelector from './nav-selector'
+import { NavSelector } from './nav-selector'
 
 type INavProps = {
   icon: React.ReactNode
@@ -46,12 +46,12 @@ const Nav = ({
 
   return (
     <div className={`
-      flex h-8 max-w-167.5 shrink-0 items-center rounded-xl px-0.5 text-sm font-medium max-[1024px]:max-w-100
+      flex h-8 max-w-167.5 min-w-0 items-center rounded-xl px-0.5 text-sm font-medium max-[1120px]:max-w-100
       ${isActivated && 'bg-components-main-nav-nav-button-bg-active font-semibold shadow-md'}
       ${!curNav && !isActivated && 'hover:bg-components-main-nav-nav-button-bg-hover'}
     `}
     >
-      <Link href={link}>
+      <Link href={link} className="shrink-0">
         <div
           onClick={(e) => {
             // Don't clear state if opening in new tab/window
@@ -74,7 +74,7 @@ const Nav = ({
                   : icon
             }
           </div>
-          <div className="ml-2 max-[1024px]:hidden">
+          <div className="ml-2 max-[1120px]:hidden">
             {text}
           </div>
         </div>
@@ -82,7 +82,7 @@ const Nav = ({
       {
         curNav && isActivated && (
           <>
-            <div className="font-light text-divider-deep">/</div>
+            <div className="shrink-0 font-light text-divider-deep">/</div>
             <NavSelector
               isApp={isApp}
               curNav={curNav}
@@ -98,12 +98,12 @@ const Nav = ({
       {
         !curNav && shouldShowActiveLink && (
           <>
-            <div className="font-light text-divider-deep">/</div>
+            <div className="shrink-0 font-light text-divider-deep">/</div>
             <Link
               href={activeLink.link}
-              className="hover:bg-components-main-nav-nav-button-bg-active-hover flex h-7 cursor-pointer items-center rounded-[10px] px-2.5 text-components-main-nav-nav-button-text-active"
+              className="hover:bg-components-main-nav-nav-button-bg-active-hover flex h-7 min-w-0 cursor-pointer items-center rounded-[10px] px-2.5 text-components-main-nav-nav-button-text-active"
             >
-              {activeLink.text}
+              <span className="truncate">{activeLink.text}</span>
             </Link>
           </>
         )
diff --git a/web/app/components/header/nav/nav-selector/__tests__/index.spec.tsx b/web/app/components/header/nav/nav-selector/__tests__/index.spec.tsx
index aaabe456132..dc6886e7f4a 100644
--- a/web/app/components/header/nav/nav-selector/__tests__/index.spec.tsx
+++ b/web/app/components/header/nav/nav-selector/__tests__/index.spec.tsx
@@ -5,13 +5,15 @@ import userEvent from '@testing-library/user-event'
 import { vi } from 'vitest'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { useAppContext } from '@/context/app-context'
-import { useRouter } from '@/next/navigation'
 import { AppModeEnum } from '@/types/app'
-import NavSelector from '../index'
+import { NavSelector } from '../index'
+
+const mockPush = vi.fn()
 
-// Mock next/navigation
 vi.mock('@/next/navigation', () => ({
-  useRouter: vi.fn(),
+  useRouter: () => ({
+    push: mockPush,
+  }),
 }))
 
 // Mock app store
@@ -28,7 +30,6 @@ describe('NavSelector Component', () => {
   const mockSetAppDetail = vi.fn()
   const mockOnCreate = vi.fn()
   const mockOnLoadMore = vi.fn()
-  const mockPush = vi.fn()
 
   const navigationItems: NavItem[] = [
     {
@@ -69,10 +70,8 @@ describe('NavSelector Component', () => {
     vi.mocked(useAppStore).mockReturnValue(mockSetAppDetail)
     vi.mocked(useAppContext).mockReturnValue({
       isCurrentWorkspaceEditor: true,
+      workspacePermissionKeys: ['app.create_and_management', 'dataset.create_and_management'],
     } as unknown as AppContextValue)
-    vi.mocked(useRouter).mockReturnValue({
-      push: mockPush,
-    } as unknown as ReturnType<typeof useRouter>)
   })
 
   describe('Rendering', () => {
@@ -101,7 +100,7 @@ describe('NavSelector Component', () => {
       expect(screen.getByText('Item 2'))!.toBeInTheDocument()
     })
 
-    it('should navigate and call setAppDetail when an item is clicked', async () => {
+    it('should call setAppDetail and navigate when an item is clicked', async () => {
       render(<NavSelector {...defaultProps} />)
       const button = screen.getByRole('button')
       await act(async () => {
@@ -115,7 +114,7 @@ describe('NavSelector Component', () => {
       expect(mockPush).toHaveBeenCalledWith('/item2')
     })
 
-    it('should not navigate if current item is clicked', async () => {
+    it('should render current item without a route link', async () => {
       render(<NavSelector {...defaultProps} />)
       const button = screen.getByRole('button')
       await act(async () => {
@@ -128,7 +127,8 @@ describe('NavSelector Component', () => {
           fireEvent.click(listItem)
         })
       }
-      expect(mockPush).not.toHaveBeenCalled()
+      expect(listItem?.closest('a')).toBeNull()
+      expect(mockSetAppDetail).not.toHaveBeenCalled()
     })
 
     it('should call onCreate when create button is clicked (non-app mode)', async () => {
@@ -196,17 +196,46 @@ describe('NavSelector Component', () => {
       expect(await screen.findByText(/app\.newApp\.startFromBlank/i))!.toBeInTheDocument()
     })
 
-    it('should not show create button for non-editors', async () => {
+    it('should show create button when dataset.create_and_management permission is present', async () => {
       vi.mocked(useAppContext).mockReturnValue({
         isCurrentWorkspaceEditor: false,
+        workspacePermissionKeys: ['dataset.create_and_management'],
       } as unknown as AppContextValue)
       render(<NavSelector {...defaultProps} />)
       const button = screen.getByRole('button')
       await act(async () => {
         fireEvent.click(button)
       })
+      expect(screen.getByText('Create New')).toBeInTheDocument()
+    })
+
+    it('should hide dataset create button without dataset.create_and_management permission', async () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceEditor: true,
+        workspacePermissionKeys: ['app.create_and_management'],
+      } as unknown as AppContextValue)
+      render(<NavSelector {...defaultProps} />)
+      const button = screen.getByRole('button')
+      await act(async () => {
+        fireEvent.click(button)
+      })
+
       expect(screen.queryByText('Create New')).not.toBeInTheDocument()
     })
+
+    it('should hide app create menu without app.create_and_management permission', async () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceEditor: true,
+        workspacePermissionKeys: ['dataset.create_and_management'],
+      } as unknown as AppContextValue)
+      render(<NavSelector {...defaultProps} isApp />)
+      const button = screen.getByRole('button')
+      await act(async () => {
+        fireEvent.click(button)
+      })
+
+      expect(screen.queryByRole('menuitem', { name: /Create New/i })).not.toBeInTheDocument()
+    })
   })
 
   describe('Scroll behavior', () => {
diff --git a/web/app/components/header/nav/nav-selector/index.tsx b/web/app/components/header/nav/nav-selector/index.tsx
index 057e50dabf0..03a4deb9ce9 100644
--- a/web/app/components/header/nav/nav-selector/index.tsx
+++ b/web/app/components/header/nav/nav-selector/index.tsx
@@ -10,10 +10,6 @@ import {
   DropdownMenuSubTrigger,
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
-import {
-  RiAddLine,
-  RiArrowDownSLine,
-} from '@remixicon/react'
 import { debounce } from 'es-toolkit/compat'
 import { useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -24,6 +20,7 @@ import { FileArrow01, FilePlus01, FilePlus02 } from '@/app/components/base/icons
 import Loading from '@/app/components/base/loading'
 import { useAppContext } from '@/context/app-context'
 import { useRouter } from '@/next/navigation'
+import { hasPermission } from '@/utils/permission'
 
 export type NavItem = {
   id: string
@@ -53,14 +50,14 @@ type AppCreateMenuProps = {
   onCreate: (state: string) => void
 }
 
-const AppCreateMenu = ({
+function AppCreateMenu({
   createText,
   startFromBlankText,
   startFromTemplateText,
   importDSLText,
   onCreate,
-}: AppCreateMenuProps) => {
-  const handleCreate = (state: string) => {
+}: AppCreateMenuProps) {
+  function handleCreate(state: string) {
     onCreate(state)
   }
 
@@ -111,11 +108,68 @@ const AppCreateMenu = ({
   )
 }
 
-const NavSelector = ({ curNav, navigationItems, createText, isApp, onCreate, onLoadMore, isLoadingMore }: INavSelectorProps) => {
-  const { t } = useTranslation()
+function NavSelectorItemContent({ nav }: {
+  nav: NavItem
+}) {
+  return (
+    <>
+      <div className="relative mr-2 size-6 shrink-0 rounded-md">
+        <AppIcon
+          size="tiny"
+          iconType={nav.icon_type}
+          icon={nav.icon}
+          background={nav.icon_background}
+          imageUrl={nav.icon_url}
+        />
+        {!!nav.mode && (
+          <AppTypeIcon type={nav.mode} wrapperClassName="absolute -bottom-0.5 -right-0.5 h-3.5 w-3.5 shadow-sm" className="size-2.5" />
+        )}
+      </div>
+      <div className="min-w-0 truncate">
+        {nav.name}
+      </div>
+    </>
+  )
+}
+
+function NavSelectorRouteItem({ nav, isCurrent, onBeforeNavigate }: {
+  nav: NavItem
+  isCurrent: boolean
+  onBeforeNavigate: () => void
+}) {
   const router = useRouter()
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const className = 'h-auto truncate px-3 py-[6px] text-[14px] font-normal text-text-secondary'
+
+  function handleNavigate() {
+    onBeforeNavigate()
+    router.push(nav.link)
+  }
+
+  if (isCurrent) {
+    return (
+      <DropdownMenuItem
+        className={className}
+      >
+        <NavSelectorItemContent nav={nav} />
+      </DropdownMenuItem>
+    )
+  }
+
+  return (
+    <DropdownMenuItem
+      className={className}
+      onClick={handleNavigate}
+    >
+      <NavSelectorItemContent nav={nav} />
+    </DropdownMenuItem>
+  )
+}
+
+export function NavSelector({ curNav, navigationItems, createText, isApp, onCreate, onLoadMore, isLoadingMore }: INavSelectorProps) {
+  const { t } = useTranslation()
+  const { workspacePermissionKeys } = useAppContext()
   const setAppDetail = useAppStore(state => state.setAppDetail)
+  const canCreate = hasPermission(workspacePermissionKeys, isApp ? 'app.create_and_management' : 'dataset.create_and_management')
 
   const handleScroll = useCallback(debounce((e) => {
     if (typeof onLoadMore === 'function') {
@@ -130,15 +184,12 @@ const NavSelector = ({ curNav, navigationItems, createText, isApp, onCreate, onL
     <DropdownMenu modal={false}>
       <DropdownMenuTrigger
         className={cn(
-          'hover:hover:bg-components-main-nav-nav-button-bg-active-hover group inline-flex h-7 items-center justify-center rounded-[10px] pr-2.5 pl-2 text-[14px] font-semibold text-components-main-nav-nav-button-text-active outline-hidden',
+          'hover:hover:bg-components-main-nav-nav-button-bg-active-hover group inline-flex h-7 min-w-0 items-center justify-center rounded-[10px] pr-2.5 pl-2 text-[14px] font-semibold text-components-main-nav-nav-button-text-active outline-hidden',
           'focus-visible:bg-components-main-nav-nav-button-bg-active focus-visible:ring-1 focus-visible:ring-components-input-border-hover data-popup-open:bg-components-main-nav-nav-button-bg-active',
         )}
       >
-        <div className="max-w-[157px] truncate" title={curNav?.name}>{curNav?.name}</div>
-        <RiArrowDownSLine
-          className="ml-1 size-3 shrink-0 opacity-50 group-hover:opacity-100 group-data-popup-open:opacity-100"
-          aria-hidden="true"
-        />
+        <div className="max-w-[157px] min-w-0 truncate">{curNav?.name}</div>
+        <span className="ml-1 i-ri-arrow-down-s-line size-3 shrink-0 opacity-50 group-hover:opacity-100 group-data-popup-open:opacity-100" aria-hidden="true" />
       </DropdownMenuTrigger>
       <DropdownMenuContent
         placement="bottom-end"
@@ -148,33 +199,12 @@ const NavSelector = ({ curNav, navigationItems, createText, isApp, onCreate, onL
         <div className="max-h-[50vh] overflow-auto px-1 py-1" onScroll={handleScroll}>
           {
             navigationItems.map(nav => (
-              <DropdownMenuItem
+              <NavSelectorRouteItem
                 key={nav.id}
-                className="h-auto truncate px-3 py-[6px] text-[14px] font-normal text-text-secondary"
-                onClick={() => {
-                  if (curNav?.id === nav.id)
-                    return
-                  setAppDetail()
-                  router.push(nav.link)
-                }}
-                title={nav.name}
-              >
-                <div className="relative mr-2 size-6 shrink-0 rounded-md">
-                  <AppIcon
-                    size="tiny"
-                    iconType={nav.icon_type}
-                    icon={nav.icon}
-                    background={nav.icon_background}
-                    imageUrl={nav.icon_url}
-                  />
-                  {!!nav.mode && (
-                    <AppTypeIcon type={nav.mode} wrapperClassName="absolute -bottom-0.5 -right-0.5 h-3.5 w-3.5 shadow-sm" className="size-2.5" />
-                  )}
-                </div>
-                <div className="min-w-0 truncate">
-                  {nav.name}
-                </div>
-              </DropdownMenuItem>
+                nav={nav}
+                isCurrent={curNav?.id === nav.id}
+                onBeforeNavigate={setAppDetail}
+              />
             ))
           }
           {isLoadingMore && (
@@ -183,20 +213,20 @@ const NavSelector = ({ curNav, navigationItems, createText, isApp, onCreate, onL
             </div>
           )}
         </div>
-        {!isApp && isCurrentWorkspaceEditor && (
+        {!isApp && canCreate && (
           <div className="p-1">
             <DropdownMenuItem
               className="h-9 gap-2 px-3 py-[6px]"
               onClick={() => onCreate('')}
             >
               <div className="flex h-6 w-6 shrink-0 items-center justify-center rounded-md border-[0.5px] border-divider-regular bg-background-default">
-                <RiAddLine className="size-4 text-text-primary" />
+                <span className="i-ri-add-line size-4 text-text-primary" />
               </div>
               <div className="grow text-left text-[14px] font-normal text-text-secondary">{createText}</div>
             </DropdownMenuItem>
           </div>
         )}
-        {isApp && isCurrentWorkspaceEditor && (
+        {isApp && canCreate && (
           <AppCreateMenu
             createText={createText}
             startFromBlankText={t('newApp.startFromBlank', { ns: 'app' })}
@@ -209,5 +239,3 @@ const NavSelector = ({ curNav, navigationItems, createText, isApp, onCreate, onL
     </DropdownMenu>
   )
 }
-
-export default NavSelector
diff --git a/web/app/components/header/storage.ts b/web/app/components/header/storage.ts
new file mode 100644
index 00000000000..0c3b099808d
--- /dev/null
+++ b/web/app/components/header/storage.ts
@@ -0,0 +1,18 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+const [
+  useHideMaintenanceNotice,
+  _useHideMaintenanceNoticeValue,
+  _useSetHideMaintenanceNotice,
+] = createLocalStorageState<string>('hide-maintenance-notice', '0', { raw: true })
+
+const [
+  _useWorkflowCanvasMaximize,
+  useWorkflowCanvasMaximizeValue,
+  _useSetWorkflowCanvasMaximize,
+] = createLocalStorageState<boolean>('workflow-canvas-maximize', false)
+
+export {
+  useHideMaintenanceNotice,
+  useWorkflowCanvasMaximizeValue,
+}
diff --git a/web/app/components/header/tools-nav/__tests__/index.spec.tsx b/web/app/components/header/tools-nav/__tests__/index.spec.tsx
index d5646e09d7f..018efc9faee 100644
--- a/web/app/components/header/tools-nav/__tests__/index.spec.tsx
+++ b/web/app/components/header/tools-nav/__tests__/index.spec.tsx
@@ -1,6 +1,6 @@
 import { render, screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import ToolsNav from '../index'
+import { ToolsNav } from '../index'
 
 const mockUseSelectedLayoutSegment = vi.fn()
 vi.mock('@/next/navigation', () => ({
diff --git a/web/app/components/header/tools-nav/index.tsx b/web/app/components/header/tools-nav/index.tsx
index 22f6818a7a9..d4a6c17fd00 100644
--- a/web/app/components/header/tools-nav/index.tsx
+++ b/web/app/components/header/tools-nav/index.tsx
@@ -10,13 +10,11 @@ import { buildIntegrationPath } from '@/app/components/integrations/routes'
 import Link from '@/next/link'
 import { useSelectedLayoutSegment } from '@/next/navigation'
 
-type ToolsNavProps = {
-  className?: string
-}
-
-const ToolsNav = ({
+export function ToolsNav({
   className,
-}: ToolsNavProps) => {
+}: {
+  className?: string
+}) {
   const { t } = useTranslation()
   const selectedSegment = useSelectedLayoutSegment()
   const activated = selectedSegment === 'integrations' || selectedSegment === 'tools'
@@ -31,11 +29,9 @@ const ToolsNav = ({
           ? <RiHammerFill className="size-4" />
           : <RiHammerLine className="size-4" />
       }
-      <div className="ml-2 max-[1024px]:hidden">
+      <div className="ml-2 max-[1120px]:hidden">
         {t('menus.tools', { ns: 'common' })}
       </div>
     </Link>
   )
 }
-
-export default ToolsNav
diff --git a/web/app/components/integrations/__tests__/page.spec.tsx b/web/app/components/integrations/__tests__/page.spec.tsx
index 17c58cddc77..13c1f89bc16 100644
--- a/web/app/components/integrations/__tests__/page.spec.tsx
+++ b/web/app/components/integrations/__tests__/page.spec.tsx
@@ -7,6 +7,10 @@ const { mockRouterPush, mockWindowOpen } = vi.hoisted(() => ({
   mockWindowOpen: vi.fn(),
 }))
 
+const mockAppContextState = vi.hoisted(() => ({
+  workspacePermissionKeys: ['tool.manage', 'mcp.manage'] as string[],
+}))
+
 const {
   mockCanManagement,
   mockCanDebugger,
@@ -39,19 +43,35 @@ vi.mock('@/next/navigation', () => ({
   }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockAppContextState.workspacePermissionKeys,
+  }),
+}))
+
 vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
   usePluginSettingsAccess: () => ({
     permission: mockReferenceSetting().permission,
+    canInstallPlugin: mockCanManagement(),
+    canManagePlugin: true,
     canManagement: mockCanManagement(),
     canDebugger: mockCanDebugger(),
     canSetPermissions: mockCanSetPermissions(),
+    canSetPluginPreferences: mockCanSetPermissions(),
+    canUpdatePlugin: true,
+    canViewInstalledPlugins: true,
     setPluginPermissionSettings: mockSetReferenceSettings,
   }),
   default: () => ({
     referenceSetting: mockReferenceSetting(),
+    canInstallPlugin: mockCanManagement(),
+    canManagePlugin: true,
     canManagement: mockCanManagement(),
     canDebugger: mockCanDebugger(),
     canSetPermissions: mockCanSetPermissions(),
+    canSetPluginPreferences: mockCanSetPermissions(),
+    canUpdatePlugin: true,
+    canViewInstalledPlugins: true,
     setReferenceSettings: mockSetReferenceSettings,
   }),
 }))
@@ -245,6 +265,7 @@ describe('IntegrationsPage', () => {
     mockCanManagement.mockReturnValue(true)
     mockCanDebugger.mockReturnValue(true)
     mockCanSetPermissions.mockReturnValue(true)
+    mockAppContextState.workspacePermissionKeys = ['tool.manage', 'mcp.manage']
     mockReferenceSetting.mockReturnValue({
       permission: {
         install_permission: 'everyone',
@@ -396,6 +417,24 @@ describe('IntegrationsPage', () => {
     expect(screen.getByTestId('data-source-page')).toBeInTheDocument()
   })
 
+  it('does not render the MCP management route without mcp.manage', () => {
+    mockAppContextState.workspacePermissionKeys = ['tool.manage']
+
+    const { container } = renderIntegrationsPage(undefined, 'mcp')
+
+    expect(screen.queryByTestId('tool-provider-list')).not.toBeInTheDocument()
+    expect(container.firstElementChild).toBeNull()
+  })
+
+  it.each(['custom-tool', 'workflow-tool'] as const)('does not render the %s management route without tool.manage', (section) => {
+    mockAppContextState.workspacePermissionKeys = ['mcp.manage']
+
+    const { container } = renderIntegrationsPage(undefined, section)
+
+    expect(screen.queryByTestId('tool-provider-list')).not.toBeInTheDocument()
+    expect(container.firstElementChild).toBeNull()
+  })
+
   it('remounts the tools section content when the route section changes', () => {
     const view = renderIntegrationsPage(undefined, 'builtin')
 
@@ -490,6 +529,18 @@ describe('IntegrationsPage', () => {
     expect(onSectionChange).toHaveBeenCalledTimes(2)
   })
 
+  it('hides custom and workflow tool entries without tool.manage while keeping MCP with mcp.manage', () => {
+    mockAppContextState.workspacePermissionKeys = ['mcp.manage']
+    renderIntegrationsPage(undefined, { section: 'provider', onSectionChange: vi.fn() })
+
+    fireEvent.click(screen.getByRole('button', { name: 'common.menus.tools' }))
+
+    expect(screen.getByRole('button', { name: 'common.toolsPage.toolPlugin' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'MCP' })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'workflow.common.workflowAsTool' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'common.settings.swaggerAPIAsTool' })).not.toBeInTheDocument()
+  })
+
   it('opens tools to the tools plugin page when the parent tools nav is clicked', () => {
     renderIntegrationsPage(undefined, 'provider')
 
diff --git a/web/app/components/integrations/__tests__/tool-provider-list.spec.tsx b/web/app/components/integrations/__tests__/tool-provider-list.spec.tsx
index 32121c9125d..57c78a8b36e 100644
--- a/web/app/components/integrations/__tests__/tool-provider-list.spec.tsx
+++ b/web/app/components/integrations/__tests__/tool-provider-list.spec.tsx
@@ -89,11 +89,17 @@ const createDefaultCollections = () => [
 let mockCollectionData: ReturnType<typeof createDefaultCollections> = []
 let mockIsLoadingToolProviders = false
 const mockRefetch = vi.fn()
+const mockUseAllToolProviders = vi.hoisted(() => vi.fn())
 vi.mock('@/service/use-tools', () => ({
-  useAllToolProviders: () => ({
-    data: mockCollectionData,
-    isLoading: mockIsLoadingToolProviders,
-    refetch: mockRefetch,
+  useAllToolProviders: (enabled?: boolean) => mockUseAllToolProviders(enabled),
+}))
+
+const mockAppContextState = vi.hoisted(() => ({
+  workspacePermissionKeys: ['tool.manage', 'mcp.manage'] as string[],
+}))
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockAppContextState.workspacePermissionKeys,
   }),
 }))
 
@@ -131,13 +137,19 @@ const {
 vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
   useCanSetPluginSettings: () => ({
     canSetPermissions: mockCanSetPermissions(),
+    canSetPluginPreferences: mockCanSetPermissions(),
   }),
   usePluginSettingsAccess: () => ({
     canSetPermissions: mockCanSetPermissions(),
+    canSetPluginPreferences: mockCanSetPermissions(),
+    canManagePlugin: true,
+    canUpdatePlugin: true,
+    canViewInstalledPlugins: true,
   }),
   default: () => ({
     referenceSetting: mockReferenceSetting(),
     canSetPermissions: mockCanSetPermissions(),
+    canSetPluginPreferences: mockCanSetPermissions(),
     setReferenceSettings: mockSetReferenceSettings,
   }),
 }))
@@ -316,6 +328,12 @@ describe('ProviderList', () => {
     mockEnableMarketplace = false
     mockCollectionData = createDefaultCollections()
     mockIsLoadingToolProviders = false
+    mockAppContextState.workspacePermissionKeys = ['tool.manage', 'mcp.manage']
+    mockUseAllToolProviders.mockImplementation((enabled = true) => ({
+      data: enabled ? mockCollectionData : [],
+      isLoading: enabled ? mockIsLoadingToolProviders : false,
+      refetch: mockRefetch,
+    }))
     mockCheckedInstalledData = null
     mockCanSetPermissions.mockReturnValue(true)
     mockReferenceSetting.mockReturnValue({
@@ -347,6 +365,43 @@ describe('ProviderList', () => {
       expect(screen.getByText('MCP')).toBeInTheDocument()
     })
 
+    it('hides custom and workflow tabs without tool.manage while keeping MCP with mcp.manage', () => {
+      mockAppContextState.workspacePermissionKeys = ['mcp.manage']
+
+      renderProviderList()
+
+      expect(screen.getByText('tools.type.builtIn')).toBeInTheDocument()
+      expect(screen.queryByText('tools.type.custom')).not.toBeInTheDocument()
+      expect(screen.queryByText('tools.type.workflow')).not.toBeInTheDocument()
+      expect(screen.getByText('MCP')).toBeInTheDocument()
+    })
+
+    it('hides MCP tab without mcp.manage', () => {
+      mockAppContextState.workspacePermissionKeys = ['tool.manage']
+
+      renderProviderList()
+
+      expect(screen.getByText('tools.type.builtIn')).toBeInTheDocument()
+      expect(screen.getByText('tools.type.custom')).toBeInTheDocument()
+      expect(screen.getByText('tools.type.workflow')).toBeInTheDocument()
+      expect(screen.queryByText('MCP')).not.toBeInTheDocument()
+    })
+
+    it.each([
+      ['api'],
+      ['workflow'],
+    ] as const)('does not query providers for %s category without tool.manage', (category) => {
+      mockAppContextState.workspacePermissionKeys = []
+
+      renderProviderList({ category })
+
+      expect(mockUseAllToolProviders).toHaveBeenCalledWith(false)
+      expect(screen.queryByTestId('card-my-api')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('card-wf-tool')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('custom-create-card')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('toolbar-add-custom-tool')).not.toBeInTheDocument()
+    })
+
     it('switches tab when clicked', () => {
       renderProviderList()
       fireEvent.click(screen.getByText('tools.type.custom'))
@@ -745,6 +800,16 @@ describe('ProviderList', () => {
       expect(screen.getByTestId('mcp-list')).toBeInTheDocument()
     })
 
+    it('does not render or query MCP management list without mcp.manage', () => {
+      mockAppContextState.workspacePermissionKeys = ['tool.manage']
+
+      renderProviderList({ category: 'mcp' })
+
+      expect(mockUseAllToolProviders).toHaveBeenCalledWith(false)
+      expect(screen.queryByTestId('mcp-list')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('toolbar-add-mcp')).not.toBeInTheDocument()
+    })
+
     it('keeps MCP creation in the empty card when there are no MCP servers', () => {
       renderProviderList({ category: 'mcp' })
 
diff --git a/web/app/components/integrations/hooks/use-integration-nav.ts b/web/app/components/integrations/hooks/use-integration-nav.ts
index 5587f4b19f2..4640ca97306 100644
--- a/web/app/components/integrations/hooks/use-integration-nav.ts
+++ b/web/app/components/integrations/hooks/use-integration-nav.ts
@@ -9,6 +9,11 @@ export type IntegrationHeader = {
   title: string
 }
 
+type IntegrationNavOptions = {
+  canManageTools?: boolean
+  canManageMCP?: boolean
+}
+
 export const getPluginCategoryBySection = (section: IntegrationSection) => {
   if (section === 'builtin')
     return PluginCategoryEnum.tool
@@ -20,8 +25,12 @@ export const getPluginCategoryBySection = (section: IntegrationSection) => {
     return PluginCategoryEnum.extension
 }
 
-export function useIntegrationNav(section: IntegrationSection) {
+export function useIntegrationNav(section: IntegrationSection, options: IntegrationNavOptions = {}) {
   const { t } = useTranslation()
+  const {
+    canManageMCP = true,
+    canManageTools = true,
+  } = options
   const providerItem = useMemo<IntegrationSidebarNavItemData>(() => ({
     section: 'provider',
     label: t('settings.provider', { ns: 'common' }),
@@ -39,36 +48,48 @@ export function useIntegrationNav(section: IntegrationSection) {
     icon: 'i-custom-vender-integrations-api-extension',
     iconClassName: 'h-[13px] w-3.5',
   }), [t])
-  const toolItems = useMemo<IntegrationSidebarNavItemData[]>(() => [
-    {
-      section: 'builtin',
-      label: t('toolsPage.toolPlugin', { ns: 'common' }),
-      icon: 'i-custom-vender-integrations-tools',
-      iconClassName: 'h-[14px] w-[12.5px]',
-      className: 'pl-8',
-    },
-    {
-      section: 'mcp',
-      label: 'MCP',
-      icon: 'i-custom-vender-integrations-mcp',
-      iconClassName: 'h-[14.5px] w-[13.5px]',
-      className: 'pl-8',
-    },
-    {
-      section: 'workflow-tool',
-      label: t('common.workflowAsTool', { ns: 'workflow' }),
-      icon: 'i-custom-vender-integrations-workflow-as-tool',
-      iconClassName: 'size-4',
-      className: 'pl-8',
-    },
-    {
-      section: 'custom-tool',
-      label: t('settings.swaggerAPIAsTool', { ns: 'common' }),
-      icon: 'i-custom-vender-integrations-custom-tool',
-      iconClassName: 'h-[14.5px] w-[12.5px]',
-      className: 'pl-8',
-    },
-  ], [t])
+  const toolItems = useMemo<IntegrationSidebarNavItemData[]>(() => {
+    const items: IntegrationSidebarNavItemData[] = [
+      {
+        section: 'builtin',
+        label: t('toolsPage.toolPlugin', { ns: 'common' }),
+        icon: 'i-custom-vender-integrations-tools',
+        iconClassName: 'h-[14px] w-[12.5px]',
+        className: 'pl-8',
+      },
+    ]
+
+    if (canManageMCP) {
+      items.push({
+        section: 'mcp',
+        label: 'MCP',
+        icon: 'i-custom-vender-integrations-mcp',
+        iconClassName: 'h-[14.5px] w-[13.5px]',
+        className: 'pl-8',
+      })
+    }
+
+    if (canManageTools) {
+      items.push(
+        {
+          section: 'workflow-tool',
+          label: t('common.workflowAsTool', { ns: 'workflow' }),
+          icon: 'i-custom-vender-integrations-workflow-as-tool',
+          iconClassName: 'size-4',
+          className: 'pl-8',
+        },
+        {
+          section: 'custom-tool',
+          label: t('settings.swaggerAPIAsTool', { ns: 'common' }),
+          icon: 'i-custom-vender-integrations-custom-tool',
+          iconClassName: 'h-[14.5px] w-[12.5px]',
+          className: 'pl-8',
+        },
+      )
+    }
+
+    return items
+  }, [canManageMCP, canManageTools, t])
   const secondaryItems = useMemo<IntegrationSidebarNavItemData[]>(() => [
     {
       section: 'trigger',
diff --git a/web/app/components/integrations/hooks/use-integration-permissions.ts b/web/app/components/integrations/hooks/use-integration-permissions.ts
index 9ecbd8f4c43..0b694b555e1 100644
--- a/web/app/components/integrations/hooks/use-integration-permissions.ts
+++ b/web/app/components/integrations/hooks/use-integration-permissions.ts
@@ -10,15 +10,19 @@ const isPluginCategorySection = (section: IntegrationSection) => {
 export function useIntegrationPermissions(section: IntegrationSection) {
   const {
     permission,
-    canManagement,
     canDebugger,
+    canInstallPlugin,
+    canManagePlugin,
+    canSetPluginPreferences,
     canSetPermissions,
+    canUpdatePlugin,
+    canViewInstalledPlugins,
     isPermissionLoading,
     permissionError,
     setPluginPermissionSettings,
   } = usePluginSettingsAccess()
   const isPluginCategory = isPluginCategorySection(section)
-  const showPluginCategorySetting = isPluginCategory && canSetPermissions
+  const showPluginCategorySetting = isPluginCategory && canSetPluginPreferences
   const showPermissionQuickPanel = canSetPermissions && !!permission
 
   const handlePermissionChange = (key: PermissionSettingKey, value: PermissionType) => {
@@ -33,7 +37,12 @@ export function useIntegrationPermissions(section: IntegrationSection) {
 
   return {
     canDebugger,
-    canManagement,
+    canInstallPlugin,
+    canManagePlugin,
+    canSetPluginPreferences,
+    canUpdatePlugin,
+    canViewInstalledPlugins,
+    canManagement: canInstallPlugin,
     handlePermissionChange,
     isPluginCategory,
     isReferenceSettingLoading: isPermissionLoading,
diff --git a/web/app/components/integrations/page.tsx b/web/app/components/integrations/page.tsx
index 95ff41891ac..da7872df700 100644
--- a/web/app/components/integrations/page.tsx
+++ b/web/app/components/integrations/page.tsx
@@ -13,6 +13,7 @@ import {
   buildMarketplaceUrlPathByIntegrationSection,
   toolCategoryBySection,
 } from '@/app/components/integrations/routes'
+import { useCanManageMCP, useCanManageTools } from '@/app/components/tools/hooks/use-tool-permissions'
 import { useDocLink } from '@/context/i18n'
 import Link from '@/next/link'
 import { useRouter } from '@/next/navigation'
@@ -104,9 +105,14 @@ export default function IntegrationsPage({
   const docLink = useDocLink()
   const router = useRouter()
   const section = useIntegrationSection(routeSection)
+  const canManageMCP = useCanManageMCP()
+  const canManageTools = useCanManageTools()
   const {
-    canManagement,
     canDebugger,
+    canInstallPlugin,
+    canManagePlugin,
+    canUpdatePlugin,
+    canViewInstalledPlugins,
     handlePermissionChange,
     isPluginCategory,
     permission,
@@ -114,7 +120,7 @@ export default function IntegrationsPage({
     showPluginCategorySetting,
   } = useIntegrationPermissions(section)
   const [providerSearchText, setProviderSearchText] = useState('')
-  const showInstallAction = canManagement
+  const showInstallAction = canInstallPlugin
   const showUtilityActions = canDebugger || showPermissionQuickPanel
   const {
     activeItem,
@@ -124,7 +130,7 @@ export default function IntegrationsPage({
     providerItem,
     secondaryItems,
     toolItems,
-  } = useIntegrationNav(section)
+  } = useIntegrationNav(section, { canManageMCP, canManageTools })
   const isToolSection = Boolean(toolCategoryBySection[section])
   const [isToolsExpanded, setIsToolsExpanded] = useState(isToolSection)
   const useFillLayout = section === 'provider' || section === 'data-source' || section === 'custom-endpoint' || isToolSection || isPluginCategory
@@ -193,6 +199,11 @@ export default function IntegrationsPage({
     </>
   )
 
+  if (section === 'mcp' && !canManageMCP)
+    return null
+  if ((section === 'custom-tool' || section === 'workflow-tool') && !canManageTools)
+    return null
+
   return (
     <div className="flex h-full min-h-0 w-full flex-1 bg-components-panel-bg" style={sidebarWidthStyle}>
       <aside className={cn(
@@ -217,7 +228,7 @@ export default function IntegrationsPage({
           </div>
           {showInstallAction && (
             <IntegrationSidebarActions
-              canManagement={canManagement}
+              canManagement={canInstallPlugin}
               installContextCategory={getPluginCategoryBySection(section)}
               onSwitchToMarketplace={handleSwitchToMarketplace}
             />
@@ -281,7 +292,10 @@ export default function IntegrationsPage({
                   providerSearchText={providerSearchText}
                   onProviderSearchTextChange={setProviderSearchText}
                   onSwitchToMarketplace={handleSwitchToMarketplace}
-                  canInstallPlugin={canManagement}
+                  canInstallPlugin={canInstallPlugin}
+                  canManagePlugin={canManagePlugin}
+                  canUpdatePlugin={canUpdatePlugin}
+                  canViewInstalledPlugins={canViewInstalledPlugins}
                   pluginCategoryToolbarAction={pluginSettingAction}
                 />
               </div>
@@ -304,7 +318,10 @@ export default function IntegrationsPage({
                   providerSearchText={providerSearchText}
                   onProviderSearchTextChange={setProviderSearchText}
                   onSwitchToMarketplace={handleSwitchToMarketplace}
-                  canInstallPlugin={canManagement}
+                  canInstallPlugin={canInstallPlugin}
+                  canManagePlugin={canManagePlugin}
+                  canUpdatePlugin={canUpdatePlugin}
+                  canViewInstalledPlugins={canViewInstalledPlugins}
                   pluginCategoryToolbarAction={pluginSettingAction}
                 />
               </ScrollArea>
diff --git a/web/app/components/integrations/plugin-category-page.tsx b/web/app/components/integrations/plugin-category-page.tsx
index 65d77fb1cbc..783266c8dd9 100644
--- a/web/app/components/integrations/plugin-category-page.tsx
+++ b/web/app/components/integrations/plugin-category-page.tsx
@@ -15,6 +15,9 @@ import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 
 type PluginCategoryPageProps = {
   canInstall?: boolean
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
+  canViewInstalledPlugins?: boolean
   category: PluginCategoryEnum
   layout?: (parts: { body: ReactNode, toolbar: ReactNode }) => ReactNode
   onSwitchToMarketplace?: () => void
@@ -25,6 +28,9 @@ const supportedLocalPackageExtensions = SUPPORT_INSTALL_LOCAL_FILE_EXTENSIONS.sp
 
 const PluginCategoryPageContent = ({
   canInstall = true,
+  canManagePlugin = true,
+  canUpdatePlugin = true,
+  canViewInstalledPlugins = true,
   category,
   layout,
   onSwitchToMarketplace,
@@ -65,7 +71,17 @@ const PluginCategoryPageContent = ({
 
   return (
     <div ref={containerRef} className="relative flex h-0 grow flex-col overflow-hidden bg-components-panel-bg">
-      <PluginsPanel canInstall={canInstall} contentInset="compact" fixedCategory={category} layout={layout} onSwitchToMarketplace={onSwitchToMarketplace} toolbarAction={toolbarAction} />
+      <PluginsPanel
+        canInstall={canInstall}
+        canManagePlugin={canManagePlugin}
+        canUpdatePlugin={canUpdatePlugin}
+        canViewInstalledPlugins={canViewInstalledPlugins}
+        contentInset="compact"
+        fixedCategory={category}
+        layout={layout}
+        onSwitchToMarketplace={onSwitchToMarketplace}
+        toolbarAction={toolbarAction}
+      />
       {dragging && (
         <div
           className="absolute inset-0 m-0.5 rounded-2xl border-2 border-dashed border-components-dropzone-border-accent
@@ -94,6 +110,9 @@ const PluginCategoryPageContent = ({
 
 const PluginCategoryPage = ({
   canInstall = true,
+  canManagePlugin = true,
+  canUpdatePlugin = true,
+  canViewInstalledPlugins = true,
   category,
   layout,
   onSwitchToMarketplace,
@@ -107,7 +126,16 @@ const PluginCategoryPage = ({
 
   return (
     <PluginPageContextProvider key={category} initialFilters={initialFilters}>
-      <PluginCategoryPageContent canInstall={canInstall} category={category} layout={layout} onSwitchToMarketplace={onSwitchToMarketplace} toolbarAction={toolbarAction} />
+      <PluginCategoryPageContent
+        canInstall={canInstall}
+        canManagePlugin={canManagePlugin}
+        canUpdatePlugin={canUpdatePlugin}
+        canViewInstalledPlugins={canViewInstalledPlugins}
+        category={category}
+        layout={layout}
+        onSwitchToMarketplace={onSwitchToMarketplace}
+        toolbarAction={toolbarAction}
+      />
     </PluginPageContextProvider>
   )
 }
diff --git a/web/app/components/integrations/section-renderer.tsx b/web/app/components/integrations/section-renderer.tsx
index 051e4dd4c05..1250ba38d33 100644
--- a/web/app/components/integrations/section-renderer.tsx
+++ b/web/app/components/integrations/section-renderer.tsx
@@ -14,6 +14,9 @@ import ToolProviderList from './tool-provider-list'
 
 type IntegrationSectionRendererProps = {
   canInstallPlugin?: boolean
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
+  canViewInstalledPlugins?: boolean
   description?: ReactNode
   onProviderSearchTextChange: (value: string) => void
   onSwitchToMarketplace?: () => void
@@ -26,6 +29,9 @@ type IntegrationSectionRendererProps = {
 
 const IntegrationSectionRenderer = ({
   canInstallPlugin = true,
+  canManagePlugin = true,
+  canUpdatePlugin = true,
+  canViewInstalledPlugins = true,
   description,
   onProviderSearchTextChange,
   onSwitchToMarketplace,
@@ -66,6 +72,19 @@ const IntegrationSectionRenderer = ({
       {body}
     </>
   )
+  const renderPluginCategoryPage = (category: PluginCategoryEnum) => (
+    <PluginCategoryPage
+      canInstall={canInstallPlugin}
+      canManagePlugin={canManagePlugin}
+      canUpdatePlugin={canUpdatePlugin}
+      canViewInstalledPlugins={canViewInstalledPlugins}
+      category={category}
+      layout={renderDirectLayout}
+      onSwitchToMarketplace={onSwitchToMarketplace}
+      toolbarAction={pluginCategoryToolbarAction}
+    />
+  )
+
   switch (section) {
     case 'provider':
       return (
@@ -78,7 +97,7 @@ const IntegrationSectionRenderer = ({
         />
       )
     case 'builtin':
-      return <PluginCategoryPage canInstall={canInstallPlugin} category={PluginCategoryEnum.tool} layout={renderDirectLayout} onSwitchToMarketplace={onSwitchToMarketplace} toolbarAction={pluginCategoryToolbarAction} />
+      return renderPluginCategoryPage(PluginCategoryEnum.tool)
     case 'mcp':
       return <ToolProviderList category="mcp" contentInset="compact" layout={renderDirectLayout} />
     case 'custom-tool':
@@ -92,11 +111,11 @@ const IntegrationSectionRenderer = ({
     case 'custom-endpoint':
       return <ApiBasedExtensionPage layout={renderScrollableLayout} />
     case 'trigger':
-      return <PluginCategoryPage canInstall={canInstallPlugin} category={PluginCategoryEnum.trigger} layout={renderDirectLayout} onSwitchToMarketplace={onSwitchToMarketplace} toolbarAction={pluginCategoryToolbarAction} />
+      return renderPluginCategoryPage(PluginCategoryEnum.trigger)
     case 'agent-strategy':
-      return <PluginCategoryPage canInstall={canInstallPlugin} category={PluginCategoryEnum.agent} layout={renderDirectLayout} onSwitchToMarketplace={onSwitchToMarketplace} toolbarAction={pluginCategoryToolbarAction} />
+      return renderPluginCategoryPage(PluginCategoryEnum.agent)
     case 'extension':
-      return <PluginCategoryPage canInstall={canInstallPlugin} category={PluginCategoryEnum.extension} layout={renderDirectLayout} onSwitchToMarketplace={onSwitchToMarketplace} toolbarAction={pluginCategoryToolbarAction} />
+      return renderPluginCategoryPage(PluginCategoryEnum.extension)
     default:
       return null
   }
diff --git a/web/app/components/integrations/tool-provider-list.tsx b/web/app/components/integrations/tool-provider-list.tsx
index 2a66a97b96c..0ebfd3e0ac4 100644
--- a/web/app/components/integrations/tool-provider-list.tsx
+++ b/web/app/components/integrations/tool-provider-list.tsx
@@ -18,8 +18,9 @@ import { isSearchResultEmpty } from '@/app/components/base/search-input/search-s
 import { useTags } from '@/app/components/plugins/hooks'
 import Empty from '@/app/components/plugins/marketplace/empty'
 import PluginDetailPanel from '@/app/components/plugins/plugin-detail-panel'
-import { useCanSetPluginSettings } from '@/app/components/plugins/plugin-page/use-reference-setting'
+import { usePluginSettingsAccess } from '@/app/components/plugins/plugin-page/use-reference-setting'
 import { toolsContentInsetClassNames, toolsUnifiedContentFrameClassName } from '@/app/components/tools/content-inset'
+import { useCanManageMCP, useCanManageTools } from '@/app/components/tools/hooks/use-tool-permissions'
 import Marketplace from '@/app/components/tools/marketplace'
 import MCPList from '@/app/components/tools/mcp'
 import ProviderDetail from '@/app/components/tools/provider/detail'
@@ -87,8 +88,13 @@ const ProviderList = ({
   const { t } = useTranslation()
   const { getTagLabel } = useTags()
   const {
-    canSetPermissions,
-  } = useCanSetPluginSettings()
+    canManagePlugin,
+    canSetPluginPreferences,
+    canUpdatePlugin,
+    canViewInstalledPlugins,
+  } = usePluginSettingsAccess()
+  const canManageTools = useCanManageTools()
+  const canManageMCP = useCanManageMCP()
   const { data: enable_marketplace } = useSuspenseQuery({
     ...systemFeaturesQueryOptions(),
     select: s => s.enable_marketplace,
@@ -96,13 +102,24 @@ const ProviderList = ({
   const { activeTab, handleCategoryChange, isRouteCategory } = useToolProviderCategory(category)
   const contentPaddingClassName = toolsContentInsetClassNames[contentInset]
   const toolListFrameClassName = cn(contentPaddingClassName, toolsUnifiedContentFrameClassName)
-  const showToolsUpdateSetting = activeTab === 'builtin' && canSetPermissions
+  const showToolsUpdateSetting = activeTab === 'builtin' && canSetPluginPreferences
   const showLabelFilter = activeTab === 'builtin'
+  const isToolManageTab = activeTab === 'api' || activeTab === 'workflow'
+  const isMCPManageTab = activeTab === 'mcp'
+  const canReadActiveTab = isMCPManageTab ? canManageMCP : !isToolManageTab || canManageTools
   const options = [
     { value: 'builtin', text: t('type.builtIn', { ns: 'tools' }) },
-    { value: 'api', text: t('type.custom', { ns: 'tools' }) },
-    { value: 'workflow', text: t('type.workflow', { ns: 'tools' }) },
-    { value: 'mcp', text: 'MCP' },
+    ...(canManageTools
+      ? [
+          { value: 'api', text: t('type.custom', { ns: 'tools' }) },
+          { value: 'workflow', text: t('type.workflow', { ns: 'tools' }) },
+        ]
+      : []),
+    ...(canManageMCP
+      ? [
+          { value: 'mcp', text: 'MCP' },
+        ]
+      : []),
   ]
   const [tagFilterValue, setTagFilterValue] = useState<string[]>([])
   const handleTagsChange = (value: string[]) => {
@@ -119,16 +136,19 @@ const ProviderList = ({
   const handleCreatedMCPProviderHandled = useCallback(() => {
     setCreatedMCPProviderId(undefined)
   }, [])
-  const { data: collectionList = [], isLoading: isCollectionListLoading, refetch } = useAllToolProviders()
+  const { data: collectionList = [], isLoading: isCollectionListLoading, refetch } = useAllToolProviders(canReadActiveTab)
   const activeTabCollectionList = useMemo(() => {
+    if (!canReadActiveTab)
+      return []
+
     return collectionList.filter(collection => collection.type === activeTab)
-  }, [activeTab, collectionList])
+  }, [activeTab, canReadActiveTab, collectionList])
   const hasCategoryCollections = activeTabCollectionList.length > 0
-  const shouldShowCustomToolCreateCard = !(activeTab === 'api' && !isCollectionListLoading && hasCategoryCollections)
-  const shouldShowMCPCreateCard = !(activeTab === 'mcp' && hasCategoryCollections)
+  const shouldShowCustomToolCreateCard = canManageTools && !(activeTab === 'api' && !isCollectionListLoading && hasCategoryCollections)
+  const shouldShowMCPCreateCard = canManageMCP && !(activeTab === 'mcp' && hasCategoryCollections)
   const shouldShowToolbarCreateAction
-    = (activeTab === 'mcp' && hasCategoryCollections)
-      || (activeTab === 'api' && !isCollectionListLoading && hasCategoryCollections)
+    = (activeTab === 'mcp' && canManageMCP && hasCategoryCollections)
+      || (activeTab === 'api' && canManageTools && !isCollectionListLoading && hasCategoryCollections)
   const filteredCollectionList = useMemo(() => {
     return activeTabCollectionList.filter((collection) => {
       if (showLabelFilter && tagFilterValue.length > 0 && (!collection.labels || collection.labels.every(label => !tagFilterValue.includes(label))))
@@ -152,7 +172,7 @@ const ProviderList = ({
   }, [currentProviderId, filteredCollectionList])
   const { data: checkedInstalledData } = useCheckInstalled({
     pluginIds: currentProvider?.plugin_id ? [currentProvider.plugin_id] : [],
-    enabled: !!currentProvider?.plugin_id,
+    enabled: canViewInstalledPlugins && !!currentProvider?.plugin_id,
   })
   const invalidateInstalledPluginList = useInvalidateInstalledPluginList()
   const currentPluginDetail = useMemo(() => {
@@ -229,7 +249,7 @@ const ProviderList = ({
                   tagFilterValue={tagFilterValue}
                 />
               )}
-              {activeTab === 'mcp' && (
+              {activeTab === 'mcp' && canManageMCP && (
                 <MCPList
                   searchText={keywords}
                   contentInset={contentInset}
@@ -256,6 +276,8 @@ const ProviderList = ({
         detail={currentPluginDetail}
         onUpdate={() => invalidateInstalledPluginList()}
         onHide={() => setCurrentProviderId(undefined)}
+        canManagePlugin={canManagePlugin}
+        canUpdatePlugin={canUpdatePlugin}
       />
     </>
   )
diff --git a/web/app/components/main-nav/__tests__/index.spec.tsx b/web/app/components/main-nav/__tests__/index.spec.tsx
index 684a66d87fd..cf68d4cac8a 100644
--- a/web/app/components/main-nav/__tests__/index.spec.tsx
+++ b/web/app/components/main-nav/__tests__/index.spec.tsx
@@ -10,10 +10,10 @@ import { createStore, Provider as JotaiProvider } from 'jotai'
 import { createTestQueryClient, renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { Plan } from '@/app/components/billing/type'
-import { LEARN_DIFY_HIDDEN_STORAGE_KEY } from '@/app/components/explore/learn-dify/atoms'
+import { LEARN_DIFY_HIDDEN_STORAGE_KEY } from '@/app/components/explore/learn-dify/storage'
 import { useGotoAnythingOpen } from '@/app/components/goto-anything/atoms'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
-import { useAppContext } from '@/context/app-context'
+import { useAppContext, useSelector as useAppContextSelector } from '@/context/app-context'
 import { useModalContext } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
 import { usePathname, useRouter } from '@/next/navigation'
@@ -21,20 +21,27 @@ import { consoleQuery } from '@/service/client'
 import { useGetInstalledApps, useUninstallApp, useUpdateAppPinStatus } from '@/service/use-explore'
 import { AppModeEnum } from '@/types/app'
 import MainNav from '../index'
+import { DETAIL_SIDEBAR_STORAGE_KEY } from '../storage'
 
 const activeEdgeClassName = 'before:pointer-events-none'
 
-const { mockSwitchWorkspace, mockToastSuccess, hotkeyRegistrations } = vi.hoisted(() => ({
+const { mockIsAgentV2Enabled, mockSwitchWorkspace, mockToastSuccess, hotkeyRegistrations } = vi.hoisted(() => ({
   mockSwitchWorkspace: vi.fn(),
   mockToastSuccess: vi.fn(),
+  mockIsAgentV2Enabled: vi.fn(() => true),
   hotkeyRegistrations: new Map<string, {
     handler: (event: { preventDefault: () => void }) => void
     options?: { ignoreInputs?: boolean }
   }>(),
 }))
 
+vi.mock('@/features/agent-v2/feature-flag', () => ({
+  isAgentV2Enabled: () => mockIsAgentV2Enabled(),
+}))
+
 vi.mock('@/context/app-context', () => ({
   useAppContext: vi.fn(),
+  useSelector: vi.fn(),
 }))
 
 vi.mock('@/context/provider-context', () => ({
@@ -159,6 +166,24 @@ vi.mock('@/app/components/app-sidebar/dataset-detail-top', () => ({
   ),
 }))
 
+vi.mock('@/features/agent-v2/agent-detail/navigation', () => ({
+  AgentDetailSection: ({ expand }: { expand: boolean }) => <div data-testid="agent-detail-section" data-expand={expand} />,
+  AgentDetailTop: ({ expand, onToggle }: { expand: boolean, onToggle: () => void }) => (
+    <div data-testid="agent-detail-top" data-expand={expand}>
+      <button type="button" data-testid="agent-detail-toggle" onClick={onToggle}>Toggle</button>
+    </div>
+  ),
+}))
+
+vi.mock('@/features/deployments/detail/deployment-sidebar', () => ({
+  DeploymentDetailSection: ({ expand }: { expand: boolean }) => <div data-testid="deployment-detail-section" data-expand={expand} />,
+  DeploymentDetailTop: ({ expand, onToggle }: { expand: boolean, onToggle: () => void }) => (
+    <div data-testid="deployment-detail-top" data-expand={expand}>
+      <button type="button" data-testid="deployment-detail-toggle" onClick={onToggle}>Toggle</button>
+    </div>
+  ),
+}))
+
 vi.mock('@/context/i18n', () => ({
   useLocale: () => 'en-US',
   useDocLink: () => (path: string) => `https://docs.dify.ai${path}`,
@@ -182,6 +207,23 @@ let mockInstalledApps: InstalledApp[] = []
 let mockInstalledAppsPending = false
 let mockWorkspaces: IWorkspace[] = []
 
+const ownerWorkspacePermissionKeys = [
+  'workspace.member.manage',
+  'workspace.role.manage',
+  'app_library.access',
+  'app.create_and_management',
+  'dataset.create_and_management',
+  'dataset.external.connect',
+  'tool.manage',
+  'mcp.manage',
+]
+
+const datasetOperatorWorkspacePermissionKeys = [
+  'plugin.install',
+  'dataset.create_and_management',
+  'dataset.external.connect',
+]
+
 const createInstalledApp = (overrides: Partial<InstalledApp> = {}): InstalledApp => ({
   id: overrides.id ?? 'installed-1',
   uninstallable: overrides.uninstallable ?? false,
@@ -237,11 +279,15 @@ const appContextValue: AppContextValue = {
   },
   useSelector: vi.fn(),
   isLoadingCurrentWorkspace: false,
+  isLoadingWorkspacePermissionKeys: false,
   isValidatingCurrentWorkspace: false,
+  workspacePermissionKeys: ownerWorkspacePermissionKeys,
 }
 
+type MainNavSystemFeatures = NonNullable<Parameters<typeof renderWithSystemFeatures>[1]>['systemFeatures']
+
 const renderMainNav = (
-  systemFeatures = { branding: { enabled: false } },
+  systemFeatures: MainNavSystemFeatures = { branding: { enabled: false } },
   options: { store?: ReturnType<typeof createStore>, extra?: ReactNode } = {},
 ) => {
   const queryClient = createTestQueryClient()
@@ -274,6 +320,7 @@ describe('MainNav', () => {
       { id: 'workspace-1', name: 'Solar Studio', plan: Plan.team, status: 'normal', created_at: 0, current: true },
       { id: 'workspace-2', name: 'Evan Workspace', plan: Plan.sandbox, status: 'normal', created_at: 0, current: false },
     ]
+    mockIsAgentV2Enabled.mockReturnValue(true)
 
     ;(usePathname as Mock).mockImplementation(() => mockPathname)
     ;(useRouter as Mock).mockReturnValue({
@@ -285,6 +332,7 @@ describe('MainNav', () => {
       refresh: vi.fn(),
     })
     ;(useAppContext as Mock).mockReturnValue(appContextValue)
+    ;(useAppContextSelector as Mock).mockImplementation((selector: (state: AppContextValue) => unknown) => selector((useAppContext as Mock)() as AppContextValue))
     ;(useProviderContext as Mock).mockReturnValue({
       enableBilling: true,
       isEducationAccount: false,
@@ -309,7 +357,6 @@ describe('MainNav', () => {
     })
     mockSwitchWorkspace.mockReturnValue(new Promise(() => {}))
     hotkeyRegistrations.clear()
-    useAppStore.getState().setAppSidebarExpand('')
     useAppStore.getState().setAppDetail()
   })
 
@@ -320,11 +367,36 @@ describe('MainNav', () => {
     expect(screen.getByRole('button', { name: 'common.account.account' })).not.toHaveTextContent(Plan.team)
     expect(screen.getByRole('link', { name: /common.mainNav.home/ })).toHaveAttribute('href', '/')
     expect(screen.getByRole('link', { name: /common.menus.apps/ })).toHaveAttribute('href', '/apps')
+    expect(screen.getByRole('link', { name: /common.menus.roster/ })).toHaveAttribute('href', '/roster')
     expect(screen.getByRole('link', { name: /common.menus.datasets/ })).toHaveAttribute('href', '/datasets')
     expect(screen.getByRole('link', { name: /common.mainNav.integrations/ })).toHaveAttribute('href', '/integrations/model-provider')
     expect(screen.getByRole('link', { name: /common.mainNav.marketplace/ })).toHaveAttribute('href', '/marketplace')
   })
 
+  it('hides the roster entry when Agent v2 is disabled', () => {
+    mockIsAgentV2Enabled.mockReturnValue(false)
+
+    renderMainNav()
+
+    expect(screen.queryByRole('link', { name: /common.menus.roster/ })).not.toBeInTheDocument()
+  })
+
+  it('renders deployments in primary navigation when app deploy is enabled', () => {
+    renderMainNav({ branding: { enabled: false }, enable_app_deploy: true })
+
+    const marketplaceLink = screen.getByRole('link', { name: /common.mainNav.marketplace/ })
+    const deploymentsLink = screen.getByRole('link', { name: /common.menus.deployments/ })
+
+    expect(deploymentsLink).toHaveAttribute('href', '/deployments')
+    expect(marketplaceLink.compareDocumentPosition(deploymentsLink)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+  })
+
+  it('hides deployments in primary navigation when app deploy is disabled', () => {
+    renderMainNav({ branding: { enabled: false }, enable_app_deploy: false })
+
+    expect(screen.queryByRole('link', { name: /common.menus.deployments/ })).not.toBeInTheDocument()
+  })
+
   it('aligns the global navigation spacing with the main sidebar design', () => {
     mockInstalledApps = [createInstalledApp()]
 
@@ -346,7 +418,7 @@ describe('MainNav', () => {
   })
 
   it('keeps the global navigation account section expanded on home routes', () => {
-    localStorage.setItem('app-detail-collapse-or-expand', 'collapse')
+    localStorage.setItem(DETAIL_SIDEBAR_STORAGE_KEY, 'collapse')
     mockPathname = '/'
 
     renderMainNav()
@@ -416,7 +488,7 @@ describe('MainNav', () => {
     expect(screen.getAllByText(Plan.team)).toHaveLength(1)
   })
 
-  it('hides app and tools entries for dataset operators', () => {
+  it('keeps unrestricted main routes visible for dataset operators while hiding roster', () => {
     ;(useAppContext as Mock).mockReturnValue({
       ...appContextValue,
       currentWorkspace: {
@@ -427,19 +499,22 @@ describe('MainNav', () => {
       isCurrentWorkspaceEditor: false,
       isCurrentWorkspaceManager: false,
       isCurrentWorkspaceOwner: false,
+      workspacePermissionKeys: datasetOperatorWorkspacePermissionKeys,
     })
 
     renderMainNav()
 
-    expect(screen.queryByRole('link', { name: /common.mainNav.home/ })).not.toBeInTheDocument()
-    expect(screen.queryByRole('link', { name: /common.menus.apps/ })).not.toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.mainNav.home/ })).toHaveAttribute('href', '/')
+    expect(screen.getByRole('link', { name: /common.menus.apps/ })).toHaveAttribute('href', '/apps')
+    expect(screen.queryByRole('link', { name: /common.menus.roster/ })).not.toBeInTheDocument()
     expect(screen.getByRole('link', { name: /common.menus.datasets/ })).toHaveAttribute('href', '/datasets')
-    expect(screen.queryByRole('link', { name: /common.mainNav.integrations/ })).not.toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.mainNav.integrations/ })).toHaveAttribute('href', '/integrations/model-provider')
     expect(screen.getByRole('link', { name: /common.mainNav.marketplace/ })).toHaveAttribute('href', '/marketplace')
+    expect(screen.queryByRole('link', { name: /common.menus.deployments/ })).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'explore.sidebar.webApps' })).not.toBeInTheDocument()
   })
 
-  it('hides datasets for members without editor or dataset-operator access', () => {
+  it('keeps unrestricted main routes visible without route permission keys', () => {
     ;(useAppContext as Mock).mockReturnValue({
       ...appContextValue,
       currentWorkspace: {
@@ -450,14 +525,17 @@ describe('MainNav', () => {
       isCurrentWorkspaceEditor: false,
       isCurrentWorkspaceManager: false,
       isCurrentWorkspaceOwner: false,
+      workspacePermissionKeys: ['app_library.access', 'tool.manage'],
     })
 
-    renderMainNav()
+    renderMainNav({ branding: { enabled: false }, enable_app_deploy: true })
 
     expect(screen.getByRole('link', { name: /common.mainNav.home/ })).toBeInTheDocument()
     expect(screen.getByRole('link', { name: /common.menus.apps/ })).toBeInTheDocument()
-    expect(screen.queryByRole('link', { name: /common.menus.datasets/ })).not.toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.menus.roster/ })).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.menus.datasets/ })).toBeInTheDocument()
     expect(screen.getByRole('link', { name: /common.mainNav.integrations/ })).toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /common.menus.deployments/ })).not.toBeInTheDocument()
     expect(screen.getByRole('link', { name: /common.mainNav.marketplace/ })).toBeInTheDocument()
   })
 
@@ -548,7 +626,7 @@ describe('MainNav', () => {
     expect(screen.getByRole('complementary')).toHaveClass('p-1')
     expect(screen.getByTestId('app-detail-top')).toHaveAttribute('data-expand', 'false')
     expect(screen.getByTestId('app-detail-section')).toHaveAttribute('data-expand', 'false')
-    expect(localStorage.getItem('app-detail-collapse-or-expand')).toBe('collapse')
+    expect(localStorage.getItem(DETAIL_SIDEBAR_STORAGE_KEY)).toBe('collapse')
   })
 
   it('shows app detail navigation as a floating preview when hovering the collapsed top toggle', () => {
@@ -559,7 +637,7 @@ describe('MainNav', () => {
     fireEvent.mouseEnter(screen.getByTestId('app-detail-top').parentElement!)
 
     expect(screen.getByRole('complementary')).toHaveClass('w-16', 'overflow-visible')
-    expect(localStorage.getItem('app-detail-collapse-or-expand')).toBe('collapse')
+    expect(localStorage.getItem(DETAIL_SIDEBAR_STORAGE_KEY)).toBe('collapse')
     expect(screen.getAllByTestId('app-detail-top')).toHaveLength(1)
     expect(screen.getByTestId('app-detail-top')).toHaveAttribute('data-expand', 'true')
     expect(screen.getByTestId('app-detail-section')).toHaveAttribute('data-expand', 'true')
@@ -577,7 +655,7 @@ describe('MainNav', () => {
     expect(screen.getByRole('complementary')).not.toHaveClass('overflow-visible')
     expect(screen.getByTestId('app-detail-top')).toHaveAttribute('data-expand', 'true')
     expect(screen.getByTestId('app-detail-section')).toHaveAttribute('data-expand', 'true')
-    expect(localStorage.getItem('app-detail-collapse-or-expand')).toBe('expand')
+    expect(localStorage.getItem(DETAIL_SIDEBAR_STORAGE_KEY)).toBe('expand')
   })
 
   it('replaces global navigation with dataset detail navigation on dataset routes', () => {
@@ -607,7 +685,7 @@ describe('MainNav', () => {
     expect(screen.getByRole('complementary')).toHaveClass('p-1')
     expect(screen.getByTestId('dataset-detail-top')).toHaveAttribute('data-expand', 'false')
     expect(screen.getByTestId('dataset-detail-section')).toHaveAttribute('data-expand', 'false')
-    expect(localStorage.getItem('app-detail-collapse-or-expand')).toBe('collapse')
+    expect(localStorage.getItem(DETAIL_SIDEBAR_STORAGE_KEY)).toBe('collapse')
   })
 
   it('shows dataset detail navigation as a floating preview when hovering the collapsed top toggle', () => {
@@ -618,12 +696,96 @@ describe('MainNav', () => {
     fireEvent.mouseEnter(screen.getByTestId('dataset-detail-top').parentElement!)
 
     expect(screen.getByRole('complementary')).toHaveClass('w-16', 'overflow-visible')
-    expect(localStorage.getItem('app-detail-collapse-or-expand')).toBe('collapse')
+    expect(localStorage.getItem(DETAIL_SIDEBAR_STORAGE_KEY)).toBe('collapse')
     expect(screen.getAllByTestId('dataset-detail-top')).toHaveLength(1)
     expect(screen.getByTestId('dataset-detail-top')).toHaveAttribute('data-expand', 'true')
     expect(screen.getByTestId('dataset-detail-section')).toHaveAttribute('data-expand', 'true')
   })
 
+  it('replaces global navigation with agent detail navigation on roster detail routes', () => {
+    mockPathname = '/roster/agent/agent-1/configure'
+
+    renderMainNav()
+
+    expect(screen.getByTestId('agent-detail-top')).toBeInTheDocument()
+    expect(screen.getByTestId('agent-detail-section')).toBeInTheDocument()
+    expect(screen.getByTestId('agent-detail-top')).toHaveAttribute('data-expand', 'true')
+    expect(screen.getByTestId('agent-detail-section')).toHaveAttribute('data-expand', 'true')
+    expect(screen.getByRole('complementary')).toHaveClass('w-[248px]')
+    expect(screen.getByRole('complementary')).toHaveClass('p-1')
+    expect(screen.getByRole('complementary')).toHaveClass('bg-background-body')
+    expect(screen.queryByRole('button', { name: 'common.mainNav.workspace.openMenu' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /common.menus.roster/ })).not.toBeInTheDocument()
+  })
+
+  it('keeps roster detail navigation hidden when Agent v2 is disabled', () => {
+    mockIsAgentV2Enabled.mockReturnValue(false)
+    mockPathname = '/roster/agent/agent-1/configure'
+
+    renderMainNav()
+
+    expect(screen.queryByTestId('agent-detail-top')).not.toBeInTheDocument()
+    expect(screen.queryByTestId('agent-detail-section')).not.toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /common.menus.roster/ })).not.toBeInTheDocument()
+  })
+
+  it('replaces global navigation with deployment detail navigation on deployment routes', () => {
+    mockPathname = '/deployments/app-instance-1/releases'
+
+    renderMainNav({ branding: { enabled: false }, enable_app_deploy: true })
+
+    expect(screen.getByTestId('deployment-detail-top')).toBeInTheDocument()
+    expect(screen.getByTestId('deployment-detail-section')).toBeInTheDocument()
+    expect(screen.getByTestId('deployment-detail-top')).toHaveAttribute('data-expand', 'true')
+    expect(screen.getByTestId('deployment-detail-section')).toHaveAttribute('data-expand', 'true')
+    expect(screen.getByRole('complementary')).toHaveClass('w-[248px]')
+    expect(screen.getByRole('complementary')).toHaveClass('p-1')
+    expect(screen.getByRole('complementary')).toHaveClass('bg-background-body')
+    expect(screen.queryByRole('button', { name: 'common.mainNav.workspace.openMenu' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /common.mainNav.home/ })).not.toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /common.menus.deployments/ })).not.toBeInTheDocument()
+  })
+
+  it('collapses agent detail navigation from the top-right toggle', () => {
+    mockPathname = '/roster/agent/agent-1/configure'
+
+    renderMainNav()
+    fireEvent.click(screen.getByTestId('agent-detail-toggle'))
+
+    expect(screen.getByRole('complementary')).toHaveClass('w-16')
+    expect(screen.getByRole('complementary')).toHaveClass('p-1')
+    expect(screen.getByTestId('agent-detail-top')).toHaveAttribute('data-expand', 'false')
+    expect(screen.getByTestId('agent-detail-section')).toHaveAttribute('data-expand', 'false')
+    expect(localStorage.getItem(DETAIL_SIDEBAR_STORAGE_KEY)).toBe('collapse')
+  })
+
+  it('collapses deployment detail navigation from the top-right toggle', () => {
+    mockPathname = '/deployments/app-instance-1/releases'
+
+    renderMainNav({ branding: { enabled: false }, enable_app_deploy: true })
+    fireEvent.click(screen.getByTestId('deployment-detail-toggle'))
+
+    expect(screen.getByRole('complementary')).toHaveClass('w-16')
+    expect(screen.getByRole('complementary')).toHaveClass('p-1')
+    expect(screen.getByTestId('deployment-detail-top')).toHaveAttribute('data-expand', 'false')
+    expect(screen.getByTestId('deployment-detail-section')).toHaveAttribute('data-expand', 'false')
+    expect(localStorage.getItem(DETAIL_SIDEBAR_STORAGE_KEY)).toBe('collapse')
+  })
+
+  it.each([
+    '/deployments',
+    '/deployments/create',
+  ])('keeps global navigation on deployment collection route %s', (pathname) => {
+    mockPathname = pathname
+
+    renderMainNav({ branding: { enabled: false }, enable_app_deploy: true })
+
+    expect(screen.queryByTestId('deployment-detail-top')).not.toBeInTheDocument()
+    expect(screen.queryByTestId('deployment-detail-section')).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'common.mainNav.workspace.openMenu' })).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.menus.deployments/ })).toHaveAttribute('href', '/deployments')
+  })
+
   it('registers the detail navigation shortcut to run while inputs are focused', () => {
     mockPathname = '/app/app-1/overview'
 
@@ -633,6 +795,21 @@ describe('MainNav', () => {
       expect.objectContaining({ ignoreInputs: false }),
     )
   })
+
+  it('shows agent detail navigation as a floating preview when hovering the collapsed top toggle', () => {
+    mockPathname = '/roster/agent/agent-1/configure'
+
+    renderMainNav()
+    fireEvent.click(screen.getByTestId('agent-detail-toggle'))
+    fireEvent.mouseEnter(screen.getByTestId('agent-detail-top').parentElement!)
+
+    expect(screen.getByRole('complementary')).toHaveClass('w-16', 'overflow-visible')
+    expect(localStorage.getItem(DETAIL_SIDEBAR_STORAGE_KEY)).toBe('collapse')
+    expect(screen.getAllByTestId('agent-detail-top')).toHaveLength(1)
+    expect(screen.getByTestId('agent-detail-top')).toHaveAttribute('data-expand', 'true')
+    expect(screen.getByTestId('agent-detail-section')).toHaveAttribute('data-expand', 'true')
+  })
+
   it.each([
     '/datasets/create',
     '/datasets/create-from-pipeline',
@@ -659,6 +836,16 @@ describe('MainNav', () => {
     expect(marketplaceLink).toHaveClass(activeEdgeClassName)
   })
 
+  it('marks roster active on roster routes', () => {
+    mockPathname = '/roster'
+
+    renderMainNav()
+
+    const rosterLink = screen.getByRole('link', { name: /common.menus.roster/ })
+    expect(rosterLink).toHaveClass(activeEdgeClassName)
+    expect(rosterLink).toHaveAttribute('aria-current', 'page')
+  })
+
   it('applies the Figma glass active state to the Home route', () => {
     mockPathname = '/'
 
@@ -796,7 +983,7 @@ describe('MainNav', () => {
     expect(mockSetShowAccountSettingModal).not.toHaveBeenCalledWith({ payload: ACCOUNT_SETTING_TAB.BILLING })
   })
 
-  it('limits workspace settings and invite actions by role', async () => {
+  it('limits invite members by member management permission', async () => {
     ;(useAppContext as Mock).mockReturnValue({
       ...appContextValue,
       currentWorkspace: {
@@ -805,6 +992,7 @@ describe('MainNav', () => {
       },
       isCurrentWorkspaceManager: false,
       isCurrentWorkspaceOwner: false,
+      workspacePermissionKeys: ownerWorkspacePermissionKeys.filter(key => key !== 'workspace.member.manage'),
     })
 
     renderMainNav()
@@ -815,7 +1003,7 @@ describe('MainNav', () => {
     expect(screen.queryByText('common.mainNav.workspace.inviteMembers')).not.toBeInTheDocument()
   })
 
-  it('hides workspace settings actions for dataset operators', () => {
+  it('keeps workspace settings visible and hides invite members without member management permission', () => {
     ;(useAppContext as Mock).mockReturnValue({
       ...appContextValue,
       currentWorkspace: {
@@ -826,13 +1014,14 @@ describe('MainNav', () => {
       isCurrentWorkspaceEditor: false,
       isCurrentWorkspaceManager: false,
       isCurrentWorkspaceOwner: false,
+      workspacePermissionKeys: datasetOperatorWorkspacePermissionKeys,
     })
 
     renderMainNav()
 
     fireEvent.click(screen.getByRole('button', { name: 'common.mainNav.workspace.openMenu' }))
 
-    expect(screen.queryByText('common.mainNav.workspace.settings')).not.toBeInTheDocument()
+    expect(screen.getByText('common.mainNav.workspace.settings')).toBeInTheDocument()
     expect(screen.queryByText('common.mainNav.workspace.inviteMembers')).not.toBeInTheDocument()
   })
 
diff --git a/web/app/components/main-nav/__tests__/layout.spec.tsx b/web/app/components/main-nav/__tests__/layout.spec.tsx
index 0157235b6f2..02d2da91c90 100644
--- a/web/app/components/main-nav/__tests__/layout.spec.tsx
+++ b/web/app/components/main-nav/__tests__/layout.spec.tsx
@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react'
-import { render, screen } from '@testing-library/react'
+import { fireEvent, render, screen } from '@testing-library/react'
 import MainNavLayout from '../layout'
 
 vi.mock('@/app/components/header', () => ({
@@ -10,6 +10,12 @@ vi.mock('@/app/components/header/header-wrapper', () => ({
   default: ({ children }: { children: ReactNode }) => <div data-testid="header-wrapper">{children}</div>,
 }))
 
+vi.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 vi.mock('../index', () => ({
   default: ({ className }: { className?: string }) => <aside className={className} data-testid="main-nav">MainNav</aside>,
 }))
@@ -34,4 +40,37 @@ describe('MainNavLayout', () => {
     expect(screen.queryByTestId('header-wrapper')).not.toBeInTheDocument()
     expect(screen.queryByTestId('desktop-header')).not.toBeInTheDocument()
   })
+
+  it('renders one main landmark as the skip navigation target', () => {
+    render(<MainNavLayout><div>content</div></MainNavLayout>)
+
+    const main = screen.getByRole('main')
+
+    expect(screen.getAllByRole('main')).toHaveLength(1)
+    expect(main).toHaveAttribute('id', 'main-content')
+    expect(main).toHaveAttribute('tabIndex', '-1')
+    expect(main).toHaveClass('outline-hidden', 'focus:outline-hidden', 'focus-visible:outline-hidden')
+    expect(main).toHaveTextContent('content')
+  })
+
+  it('renders skip navigation before the repeated main navigation', () => {
+    const { container } = render(<MainNavLayout><div>content</div></MainNavLayout>)
+
+    const skipLink = screen.getByRole('link', { name: 'navigation.skipToMain' })
+
+    expect(skipLink).toHaveAttribute('href', '#main-content')
+    expect(skipLink).toHaveClass('outline-hidden', 'focus-visible:ring-2', 'focus-visible:ring-state-accent-solid')
+    expect(container.querySelector('a, button, input, select, textarea, [tabindex]:not([tabindex="-1"])')).toBe(skipLink)
+  })
+
+  it('moves focus to the main content when skip navigation is activated', () => {
+    render(<MainNavLayout><div>content</div></MainNavLayout>)
+
+    const skipLink = screen.getByRole('link', { name: 'navigation.skipToMain' })
+    const main = screen.getByRole('main')
+
+    fireEvent.click(skipLink)
+
+    expect(main).toHaveFocus()
+  })
 })
diff --git a/web/app/components/main-nav/components/__tests__/workspace-card.spec.tsx b/web/app/components/main-nav/components/__tests__/workspace-card.spec.tsx
index 2ae5061ce65..92683817aef 100644
--- a/web/app/components/main-nav/components/__tests__/workspace-card.spec.tsx
+++ b/web/app/components/main-nav/components/__tests__/workspace-card.spec.tsx
@@ -1,3 +1,4 @@
+import type { AppContextValue } from '@/context/app-context'
 import type { ModalContextState } from '@/context/modal-context'
 import type { ProviderContextState } from '@/context/provider-context'
 import type { ICurrentWorkspace, IWorkspace } from '@/models/common'
@@ -5,6 +6,7 @@ import { fireEvent, screen, waitFor, within } from '@testing-library/react'
 import { createTestQueryClient, renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { Plan } from '@/app/components/billing/type'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
+import { useSelector as useAppContextSelector } from '@/context/app-context'
 import { useModalContext } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
 import { LicenseStatus } from '@/features/system-features/constants'
@@ -32,6 +34,10 @@ vi.mock('@/context/provider-context', () => ({
   useProviderContext: vi.fn(),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn(),
+}))
+
 vi.mock('@/context/modal-context', () => ({
   useModalContext: vi.fn(),
 }))
@@ -120,6 +126,12 @@ const renderWorkspaceCard = (options?: RenderWorkspaceCardOptions) => {
   })
 }
 
+const mockWorkspacePermissionKeys = (workspacePermissionKeys: string[]) => {
+  vi.mocked(useAppContextSelector).mockImplementation((selector: (state: AppContextValue) => unknown) => selector({
+    workspacePermissionKeys,
+  } as AppContextValue))
+}
+
 describe('WorkspaceCard', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -137,6 +149,7 @@ describe('WorkspaceCard', () => {
       isFetchedPlan: true,
       plan: { type: Plan.sandbox },
     } as ProviderContextState)
+    mockWorkspacePermissionKeys(['workspace.member.manage'])
     vi.mocked(useModalContext).mockReturnValue({
       setShowPricingModal: mockSetShowPricingModal,
       setShowAccountSettingModal: mockSetShowAccountSettingModal,
@@ -308,6 +321,24 @@ describe('WorkspaceCard', () => {
     expect(mockSetShowAccountSettingModal).toHaveBeenCalledWith({ payload: ACCOUNT_SETTING_TAB.BILLING })
   })
 
+  it('opens members settings from workspace menu when billing is disabled', async () => {
+    vi.mocked(useProviderContext).mockReturnValue({
+      enableBilling: false,
+      isEducationAccount: false,
+      isEducationWorkspace: false,
+      isFetchedPlan: false,
+      plan: { type: Plan.sandbox },
+    } as ProviderContextState)
+
+    renderWorkspaceCard()
+
+    fireEvent.click(screen.getByRole('button', { name: 'common.mainNav.workspace.openMenu' }))
+    fireEvent.click(await screen.findByRole('button', { name: 'common.mainNav.workspace.settings' }))
+
+    expect(mockSetShowAccountSettingModal).toHaveBeenCalledWith({ payload: ACCOUNT_SETTING_TAB.MEMBERS })
+    expect(mockSetShowAccountSettingModal).not.toHaveBeenCalledWith({ payload: ACCOUNT_SETTING_TAB.BILLING })
+  })
+
   it('switches workspace from the workspace switcher item', async () => {
     renderWorkspaceCard()
 
@@ -317,11 +348,12 @@ describe('WorkspaceCard', () => {
     await waitFor(() => expect(mockSwitchWorkspace).toHaveBeenCalledWith({ body: { tenant_id: 'workspace-2' } }))
   })
 
-  it('hides workspace management actions for dataset operators', async () => {
+  it('keeps workspace settings visible for dataset operators without member management permission', async () => {
     mockCurrentWorkspaceQuery({
       ...currentWorkspaceValue,
       role: 'dataset_operator',
     })
+    mockWorkspacePermissionKeys([])
 
     renderWorkspaceCard()
 
@@ -329,7 +361,35 @@ describe('WorkspaceCard', () => {
 
     const panel = await screen.findByRole('dialog', { name: 'Solar Studio' })
     expect(panel).toBeInTheDocument()
-    expect(within(panel).queryByRole('button', { name: 'common.mainNav.workspace.settings' })).not.toBeInTheDocument()
+    expect(within(panel).getByRole('button', { name: 'common.mainNav.workspace.settings' })).toBeInTheDocument()
+    expect(within(panel).queryByRole('button', { name: 'common.mainNav.workspace.inviteMembers' })).not.toBeInTheDocument()
+  })
+
+  it('shows invite members when member management permission is available', async () => {
+    mockCurrentWorkspaceQuery({
+      ...currentWorkspaceValue,
+      role: 'normal',
+    })
+    mockWorkspacePermissionKeys(['workspace.member.manage'])
+
+    renderWorkspaceCard()
+
+    fireEvent.click(screen.getByRole('button', { name: 'common.mainNav.workspace.openMenu' }))
+
+    const panel = await screen.findByRole('dialog', { name: 'Solar Studio' })
+    expect(within(panel).getByRole('button', { name: 'common.mainNav.workspace.settings' })).toBeInTheDocument()
+    expect(within(panel).getByRole('button', { name: 'common.mainNav.workspace.inviteMembers' })).toBeInTheDocument()
+  })
+
+  it('hides invite members when member management permission is missing', async () => {
+    mockWorkspacePermissionKeys([])
+
+    renderWorkspaceCard()
+
+    fireEvent.click(screen.getByRole('button', { name: 'common.mainNav.workspace.openMenu' }))
+
+    const panel = await screen.findByRole('dialog', { name: 'Solar Studio' })
+    expect(within(panel).getByRole('button', { name: 'common.mainNav.workspace.settings' })).toBeInTheDocument()
     expect(within(panel).queryByRole('button', { name: 'common.mainNav.workspace.inviteMembers' })).not.toBeInTheDocument()
   })
 })
diff --git a/web/app/components/main-nav/components/help-menu.tsx b/web/app/components/main-nav/components/help-menu.tsx
index 9bf62c6a777..2f74454fd2e 100644
--- a/web/app/components/main-nav/components/help-menu.tsx
+++ b/web/app/components/main-nav/components/help-menu.tsx
@@ -15,7 +15,7 @@ import {
 import { useSuspenseQuery } from '@tanstack/react-query'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useLearnDifyVisibleValue, useSetLearnDifyHidden } from '@/app/components/explore/learn-dify/atoms'
+import { useLearnDifyHiddenValue, useSetLearnDifyHidden } from '@/app/components/explore/learn-dify/storage'
 import AccountAbout from '@/app/components/header/account-about'
 import Compliance from '@/app/components/header/account-dropdown/compliance'
 import { ExternalLinkIndicator, MenuItemContent } from '@/app/components/header/account-dropdown/menu-item-content'
@@ -52,7 +52,7 @@ const HelpMenu = ({
   const docLink = useDocLink()
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { langGeniusVersionInfo, isCurrentWorkspaceOwner } = useAppContext()
-  const learnDifyVisible = useLearnDifyVisibleValue()
+  const learnDifyHidden = useLearnDifyHiddenValue()
   const setLearnDifyHidden = useSetLearnDifyHidden()
   const [aboutVisible, setAboutVisible] = useState(false)
   const [open, setOpen] = useState(false)
@@ -96,7 +96,7 @@ const HelpMenu = ({
                 />
               </DropdownMenuLinkItem>
               <DropdownMenuCheckboxItem
-                checked={learnDifyVisible}
+                checked={!learnDifyHidden}
                 closeOnClick={false}
                 className="mx-0 h-8 gap-1 px-0 py-1 pr-2 pl-3"
                 onCheckedChange={checked => setLearnDifyHidden(!checked)}
@@ -109,13 +109,13 @@ const HelpMenu = ({
                   aria-hidden
                   className={cn(
                     'relative inline-flex h-4 w-7 shrink-0 items-center rounded-[5px] p-0.5 transition-colors',
-                    learnDifyVisible ? 'bg-components-toggle-bg' : 'bg-components-toggle-bg-unchecked',
+                    !learnDifyHidden ? 'bg-components-toggle-bg' : 'bg-components-toggle-bg-unchecked',
                   )}
                 >
                   <span
                     className={cn(
                       'block h-3 w-2.5 rounded-[3px] bg-components-toggle-knob shadow-sm transition-transform',
-                      learnDifyVisible && 'translate-x-3.5',
+                      !learnDifyHidden && 'translate-x-3.5',
                     )}
                   />
                 </span>
diff --git a/web/app/components/main-nav/components/nav-link.tsx b/web/app/components/main-nav/components/nav-link.tsx
index 560764ddbd4..10865c94d18 100644
--- a/web/app/components/main-nav/components/nav-link.tsx
+++ b/web/app/components/main-nav/components/nav-link.tsx
@@ -4,7 +4,7 @@ import type { MainNavItem } from '../types'
 import { cn } from '@langgenius/dify-ui/cn'
 import Link from '@/next/link'
 
-const navItemClassName = 'group relative flex h-8 w-full items-center gap-2 rounded-[10px] px-2 py-1.5 outline-hidden transition-colors focus-visible:ring-2 focus-visible:ring-state-accent-solid'
+const navItemClassName = 'group relative flex h-8 w-full items-center gap-2 rounded-[10px] px-2 py-1.5 outline-hidden transition-colors focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-state-accent-solid'
 
 const activeNavItemClassName = cn(
   'overflow-hidden',
diff --git a/web/app/components/main-nav/components/web-apps-section.tsx b/web/app/components/main-nav/components/web-apps-section.tsx
index d31972d6796..65ea3a3564e 100644
--- a/web/app/components/main-nav/components/web-apps-section.tsx
+++ b/web/app/components/main-nav/components/web-apps-section.tsx
@@ -26,8 +26,10 @@ import Divider from '@/app/components/base/divider'
 import { SearchInput } from '@/app/components/base/search-input'
 import { isInstalledAppPath } from '@/app/components/explore/installed-app/routes'
 import AppNavItem from '@/app/components/explore/sidebar/app-nav-item'
+import { useAppContext } from '@/context/app-context'
 import { usePathname } from '@/next/navigation'
 import { useGetInstalledApps, useUninstallApp, useUpdateAppPinStatus } from '@/service/use-explore'
+import { hasPermission } from '@/utils/permission'
 
 const appNavItemHeight = 32
 const appNavItemGap = 2
@@ -72,7 +74,7 @@ type WebAppListRow
     kind: 'separator'
   }
 
-const WebAppsSection = () => {
+const WebAppsSectionContent = () => {
   const { t } = useTranslation()
   const pathname = usePathname()
   const scrollRef = useRef<HTMLDivElement>(null)
@@ -210,6 +212,7 @@ const WebAppsSection = () => {
             value={searchText}
             onValueChange={setSearchText}
             placeholder={t('mainNav.webApps.searchPlaceholder', { ns: 'common' })}
+            // eslint-disable-next-line jsx-a11y/no-autofocus -- The field is mounted after an explicit search action.
             autoFocus
           />
         </div>
@@ -297,4 +300,14 @@ const WebAppsSection = () => {
   )
 }
 
+const WebAppsSection = () => {
+  const { workspacePermissionKeys } = useAppContext()
+  const canAccessAppLibrary = hasPermission(workspacePermissionKeys, 'app_library.access')
+
+  if (!canAccessAppLibrary)
+    return null
+
+  return <WebAppsSectionContent />
+}
+
 export default WebAppsSection
diff --git a/web/app/components/main-nav/components/workspace-card.tsx b/web/app/components/main-nav/components/workspace-card.tsx
index 09d521bd448..9a8dea0280c 100644
--- a/web/app/components/main-nav/components/workspace-card.tsx
+++ b/web/app/components/main-nav/components/workspace-card.tsx
@@ -17,10 +17,12 @@ import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/con
 import LicenseNav from '@/app/components/header/license-env'
 import { buildIntegrationPath } from '@/app/components/integrations/routes'
 import { IS_CLOUD_EDITION } from '@/config'
+import { useSelector as useAppContextSelector } from '@/context/app-context'
 import { useModalContext } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
 import Link from '@/next/link'
 import { consoleQuery } from '@/service/client'
+import { hasPermission } from '@/utils/permission'
 import { basePath } from '@/utils/var'
 import { formatCredits, getRemainingCredits } from '../utils'
 import { WorkspaceIcon, WorkspaceMenuItemContent } from './workspace-menu-content'
@@ -118,6 +120,7 @@ function WorkspaceCardTrigger({
         title={name}
         className={cn(
           'flex w-full items-center gap-1.5 py-1.5 pr-3 pl-1.5 text-left transition-colors focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden focus-visible:ring-inset',
+          showCloudBilling ? 'rounded-t-xl' : 'rounded-xl',
           open && 'bg-linear-to-b from-background-section-burn to-background-section',
         )}
       >
@@ -159,7 +162,6 @@ function WorkspaceCardTrigger({
 function WorkspaceMenuHeader({
   name,
   status,
-  showWorkspaceSettings,
   showInviteMembers,
   settingsLabel,
   inviteMembersLabel,
@@ -168,7 +170,6 @@ function WorkspaceMenuHeader({
 }: {
   name: string
   status: ReactNode
-  showWorkspaceSettings: boolean
   showInviteMembers: boolean
   settingsLabel: ReactNode
   inviteMembersLabel: ReactNode
@@ -185,15 +186,13 @@ function WorkspaceMenuHeader({
           </div>
           <WorkspaceIcon name={name} className="h-9 w-9 shrink-0" />
         </div>
-        {showWorkspaceSettings && (
-          <button
-            type="button"
-            className="flex h-8 w-full cursor-pointer items-center gap-2 rounded-lg px-3 py-1 text-left outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:ring-inset"
-            onClick={onOpenSettings}
-          >
-            <WorkspaceMenuItemContent icon={<span aria-hidden className="i-custom-vender-main-nav-workspace-settings h-4 w-4" />} label={settingsLabel} />
-          </button>
-        )}
+        <button
+          type="button"
+          className="flex h-8 w-full cursor-pointer items-center gap-2 rounded-lg px-3 py-1 text-left outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:ring-inset"
+          onClick={onOpenSettings}
+        >
+          <WorkspaceMenuItemContent icon={<span aria-hidden className="i-custom-vender-main-nav-workspace-settings h-4 w-4" />} label={settingsLabel} />
+        </button>
         {showInviteMembers && (
           <button
             type="button"
@@ -233,6 +232,7 @@ export function WorkspaceCard() {
   const workspaces = workspacesData?.workspaces
   const currentWorkspaceInList = workspaces?.find(workspace => workspace.current)
   const { enableBilling } = useProviderContext()
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
   const { setShowPricingModal, setShowAccountSettingModal } = useModalContext()
   const showCloudBilling = IS_CLOUD_EDITION && enableBilling
   const [open, setOpen] = useState(false)
@@ -251,8 +251,7 @@ export function WorkspaceCard() {
   const isFreePlan = workspacePlan === Plan.sandbox
   const showPlanAction = showCloudBilling
   const planActionLabel = t(isFreePlan ? 'upgradeBtn.encourageShort' : 'upgradeBtn.plain', { ns: 'billing' })
-  const showWorkspaceSettings = currentWorkspace.role !== 'dataset_operator'
-  const showInviteMembers = showWorkspaceSettings && ['owner', 'admin'].includes(currentWorkspace.role)
+  const showInviteMembers = hasPermission(workspacePermissionKeys, 'workspace.member.manage')
   const renderWorkspaceStatus = () => enableBilling ? <WorkspacePlanBadge plan={workspacePlan} /> : <LicenseNav />
 
   const handleSwitchWorkspace = async (tenant_id: string) => {
@@ -292,13 +291,16 @@ export function WorkspaceCard() {
           <WorkspaceMenuHeader
             name={currentWorkspace.name}
             status={renderWorkspaceStatus()}
-            showWorkspaceSettings={showWorkspaceSettings}
             showInviteMembers={showInviteMembers}
             settingsLabel={t('mainNav.workspace.settings', { ns: 'common' })}
             inviteMembersLabel={t('mainNav.workspace.inviteMembers', { ns: 'common' })}
             onOpenSettings={() => {
               setOpen(false)
-              setShowAccountSettingModal({ payload: ACCOUNT_SETTING_TAB.BILLING })
+              setShowAccountSettingModal({
+                payload: enableBilling
+                  ? ACCOUNT_SETTING_TAB.BILLING
+                  : ACCOUNT_SETTING_TAB.MEMBERS,
+              })
             }}
             onInviteMembers={() => {
               setOpen(false)
diff --git a/web/app/components/main-nav/index.tsx b/web/app/components/main-nav/index.tsx
index ccb149978d8..6e11df51839 100644
--- a/web/app/components/main-nav/index.tsx
+++ b/web/app/components/main-nav/index.tsx
@@ -4,7 +4,6 @@ import type { MainNavItem, MainNavProps } from './types'
 import { cn } from '@langgenius/dify-ui/cn'
 import { useHotkey } from '@tanstack/react-hotkeys'
 import { useSuspenseQuery } from '@tanstack/react-query'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useShallow } from 'zustand/react/shallow'
@@ -15,8 +14,10 @@ import DatasetDetailTop from '@/app/components/app-sidebar/dataset-detail-top'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import DifyLogo from '@/app/components/base/logo/dify-logo'
 import EnvNav from '@/app/components/header/env-nav'
-import { buildIntegrationPath } from '@/app/components/integrations/routes'
 import { useAppContext } from '@/context/app-context'
+import { AgentDetailSection, AgentDetailTop } from '@/features/agent-v2/agent-detail/navigation'
+import { isAgentV2Enabled } from '@/features/agent-v2/feature-flag'
+import { DeploymentDetailSection, DeploymentDetailTop } from '@/features/deployments/detail/deployment-sidebar'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import Link from '@/next/link'
 import { usePathname } from '@/next/navigation'
@@ -26,10 +27,12 @@ import MainNavLink from './components/nav-link'
 import { MainNavSearchButton } from './components/search-button'
 import WebAppsSection from './components/web-apps-section'
 import { WorkspaceCard } from './components/workspace-card'
+import { isMainNavRouteVisible, MAIN_NAV_ROUTES } from './routes'
+import { useDetailSidebarMode } from './storage'
 
 const DATASET_COLLECTION_ROUTES = new Set(['create', 'create-from-pipeline', 'connect'])
 const DATASET_DOCUMENT_CREATION_ROUTES = new Set(['create', 'create-from-pipeline'])
-const DETAIL_SIDEBAR_STORAGE_KEY = 'app-detail-collapse-or-expand'
+const DEPLOYMENT_COLLECTION_ROUTES = new Set(['create'])
 const secondarySidebarHelpTriggerIcon = <span aria-hidden className="i-ri-question-line size-4 shrink-0" />
 
 function SecondarySidebarHelpMenu({
@@ -60,6 +63,18 @@ const isDatasetDetailPathname = (pathname: string) => {
   return true
 }
 
+const isAgentDetailPathname = (pathname: string) => {
+  const [section, type, agentId] = pathname.split('/').filter(Boolean)
+
+  return section === 'roster' && type === 'agent' && !!agentId
+}
+
+const isDeploymentDetailPathname = (pathname: string) => {
+  const [section, appInstanceId] = pathname.split('/').filter(Boolean)
+
+  return section === 'deployments' && !!appInstanceId && !DEPLOYMENT_COLLECTION_ROUTES.has(appInstanceId)
+}
+
 const isSnippetDetailPathname = (pathname: string) => {
   const [section, snippetId] = pathname.split('/').filter(Boolean)
 
@@ -73,19 +88,21 @@ const MainNav = ({
   const pathname = usePathname()
   const { langGeniusVersionInfo, isCurrentWorkspaceDatasetOperator, isCurrentWorkspaceEditor } = useAppContext()
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const agentV2Enabled = isAgentV2Enabled()
   const showEnvTag = langGeniusVersionInfo.current_env === 'TESTING' || langGeniusVersionInfo.current_env === 'DEVELOPMENT'
+  const canUseAppDeploy = isCurrentWorkspaceEditor && systemFeatures.enable_app_deploy
   const showAppDetailNavigation = !isCurrentWorkspaceDatasetOperator && pathname.startsWith('/app/')
   const showDatasetDetailNavigation = isDatasetDetailPathname(pathname)
+  const showAgentDetailNavigation = agentV2Enabled && !isCurrentWorkspaceDatasetOperator && isAgentDetailPathname(pathname)
+  const showDeploymentDetailNavigation = canUseAppDeploy && !isCurrentWorkspaceDatasetOperator && isDeploymentDetailPathname(pathname)
   const showSnippetDetailBottomNavigation = isSnippetDetailPathname(pathname)
-  const showDetailNavigation = showAppDetailNavigation || showDatasetDetailNavigation
-  const { hasAppDetail, appSidebarExpand, setAppDetail, setAppSidebarExpand } = useAppStore(useShallow(state => ({
+  const showDetailNavigation = showAppDetailNavigation || showDatasetDetailNavigation || showAgentDetailNavigation || showDeploymentDetailNavigation
+  const { hasAppDetail, setAppDetail } = useAppStore(useShallow(state => ({
     hasAppDetail: !!state.appDetail,
-    appSidebarExpand: state.appSidebarExpand,
     setAppDetail: state.setAppDetail,
-    setAppSidebarExpand: state.setAppSidebarExpand,
   })))
-  const [storedDetailSidebarExpand, setStoredDetailSidebarExpand] = useLocalStorage<string>(DETAIL_SIDEBAR_STORAGE_KEY, 'expand', { raw: true })
-  const detailNavigationMode = appSidebarExpand === 'collapse' || (!appSidebarExpand && storedDetailSidebarExpand === 'collapse') ? 'collapse' : 'expand'
+  const [storedDetailSidebarExpand, setStoredDetailSidebarExpand] = useDetailSidebarMode()
+  const detailNavigationMode = storedDetailSidebarExpand === 'collapse' ? 'collapse' : 'expand'
   const detailNavigationExpanded = detailNavigationMode === 'expand'
   const isCollapsedDetailNavigation = showDetailNavigation && !detailNavigationExpanded
   const [detailNavigationHoverPreviewOpen, setDetailNavigationHoverPreviewOpen] = useState(false)
@@ -104,16 +121,17 @@ const MainNav = ({
 
       setDetailNavigationTransitionDisabled(true)
       setDetailNavigationHoverPreviewOpen(false)
-      setAppSidebarExpand('expand')
+      setStoredDetailSidebarExpand('expand')
       detailNavigationTransitionTimerRef.current = setTimeout(() => {
         setDetailNavigationTransitionDisabled(false)
       }, 200)
       return
     }
 
+    const nextMode = detailNavigationExpanded ? 'collapse' : 'expand'
     setDetailNavigationHoverPreviewOpen(false)
-    setAppSidebarExpand(detailNavigationExpanded ? 'collapse' : 'expand')
-  }, [detailNavigationExpanded, isDetailNavigationHoverPreviewOpen, setAppSidebarExpand])
+    setStoredDetailSidebarExpand(nextMode)
+  }, [detailNavigationExpanded, isDetailNavigationHoverPreviewOpen, setStoredDetailSidebarExpand])
   const openDetailNavigationHoverPreview = useCallback(() => {
     if (!isCollapsedDetailNavigation)
       return
@@ -141,13 +159,6 @@ const MainNav = ({
     }
   }, [])
 
-  useEffect(() => {
-    if (!showDetailNavigation)
-      return
-
-    setStoredDetailSidebarExpand(detailNavigationMode)
-  }, [detailNavigationMode, setStoredDetailSidebarExpand, showDetailNavigation])
-
   useEffect(() => {
     if (pathname.startsWith('/app/') || !hasAppDetail)
       return
@@ -165,73 +176,41 @@ const MainNav = ({
     ignoreInputs: false,
   })
 
-  const navItems = useMemo<MainNavItem[]>(() => [
-    ...(!isCurrentWorkspaceDatasetOperator
-      ? [
-          {
-            href: '/',
-            label: t('mainNav.home', { ns: 'common' }),
-            active: (path: string) => path === '/' || path === '/explore/apps',
-            icon: 'i-custom-vender-main-nav-home',
-            activeIcon: 'i-custom-vender-main-nav-home-active',
-          },
-          {
-            href: '/apps',
-            label: t('menus.apps', { ns: 'common' }),
-            active: (path: string) => path.startsWith('/apps') || path.startsWith('/app/') || path.startsWith('/snippets'),
-            icon: 'i-custom-vender-main-nav-studio',
-            activeIcon: 'i-custom-vender-main-nav-studio-active',
-          },
-        ]
-      : []),
-    ...((isCurrentWorkspaceEditor || isCurrentWorkspaceDatasetOperator)
-      ? [
-          {
-            href: '/datasets',
-            label: t('menus.datasets', { ns: 'common' }),
-            active: (path: string) => path.startsWith('/datasets'),
-            icon: 'i-custom-vender-main-nav-knowledge',
-            activeIcon: 'i-custom-vender-main-nav-knowledge-active',
-          },
-        ]
-      : []),
-    ...(!isCurrentWorkspaceDatasetOperator
-      ? [
-          {
-            href: buildIntegrationPath('provider'),
-            label: t('mainNav.integrations', { ns: 'common' }),
-            active: (path: string) => path.startsWith('/integrations') || path.startsWith('/tools'),
-            icon: 'i-custom-vender-main-nav-integrations',
-            activeIcon: 'i-custom-vender-main-nav-integrations-active',
-          },
-        ]
-      : []),
-    {
-      href: '/marketplace',
-      label: t('mainNav.marketplace', { ns: 'common' }),
-      active: path => path.startsWith('/marketplace') || path.startsWith('/plugins'),
-      icon: 'i-custom-vender-main-nav-marketplace',
-      activeIcon: 'i-custom-vender-main-nav-marketplace-active',
-    },
-  ], [isCurrentWorkspaceDatasetOperator, isCurrentWorkspaceEditor, t])
+  const navItems = useMemo<MainNavItem[]>(() => MAIN_NAV_ROUTES
+    .filter(route => isMainNavRouteVisible(route, {
+      agentV2Enabled,
+      canUseAppDeploy,
+      isCurrentWorkspaceDatasetOperator,
+    }))
+    .map(route => ({
+      href: route.href,
+      label: t(route.labelKey, { ns: 'common' }),
+      active: route.active,
+      icon: route.icon,
+      activeIcon: route.activeIcon,
+    })), [agentV2Enabled, canUseAppDeploy, isCurrentWorkspaceDatasetOperator, t])
 
-  const renderLogo = () => (
-    <Link
-      href="/"
-      className="flex h-8 shrink-0 items-center overflow-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
-      aria-label={systemFeatures.branding.enabled && systemFeatures.branding.application_title ? systemFeatures.branding.application_title : 'Dify'}
-    >
-      {systemFeatures.branding.enabled && systemFeatures.branding.workspace_logo
-        ? (
-            <img
-              src={systemFeatures.branding.workspace_logo}
-              className="block h-5.5 w-auto object-contain"
-              alt=""
-            />
-          )
-        : <DifyLogo alt="" />}
-    </Link>
-  )
+  const renderLogo = () => {
+    const appTitle = systemFeatures.branding.enabled && systemFeatures.branding.application_title ? systemFeatures.branding.application_title : 'Dify'
+
+    return (
+      <Link
+        href="/"
+        className="flex h-8 shrink-0 items-center overflow-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+        aria-label={appTitle}
+      >
+        {systemFeatures.branding.enabled && systemFeatures.branding.workspace_logo
+          ? (
+              <img
+                src={systemFeatures.branding.workspace_logo}
+                className="block h-5.5 w-auto object-contain"
+                alt=""
+              />
+            )
+          : <DifyLogo alt="" />}
+      </Link>
+    )
+  }
 
   return (
     <aside
@@ -272,12 +251,26 @@ const MainNav = ({
                     onToggle={handleToggleDetailNavigation}
                   />
                 )
-              : (
-                  <DatasetDetailTop
-                    expand={detailNavigationVisibleExpanded}
-                    onToggle={handleToggleDetailNavigation}
-                  />
-                )
+              : showDatasetDetailNavigation
+                ? (
+                    <DatasetDetailTop
+                      expand={detailNavigationVisibleExpanded}
+                      onToggle={handleToggleDetailNavigation}
+                    />
+                  )
+                : showAgentDetailNavigation
+                  ? (
+                      <AgentDetailTop
+                        expand={detailNavigationVisibleExpanded}
+                        onToggle={handleToggleDetailNavigation}
+                      />
+                    )
+                  : (
+                      <DeploymentDetailTop
+                        expand={detailNavigationVisibleExpanded}
+                        onToggle={handleToggleDetailNavigation}
+                      />
+                    )
             : showSnippetDetailBottomNavigation
               ? null
               : (
@@ -294,7 +287,11 @@ const MainNav = ({
           {showDetailNavigation
             ? showAppDetailNavigation
               ? <AppDetailSection expand={detailNavigationVisibleExpanded} />
-              : <DatasetDetailSection expand={detailNavigationVisibleExpanded} />
+              : showDatasetDetailNavigation
+                ? <DatasetDetailSection expand={detailNavigationVisibleExpanded} />
+                : showAgentDetailNavigation
+                  ? <AgentDetailSection expand={detailNavigationVisibleExpanded} />
+                  : <DeploymentDetailSection expand={detailNavigationVisibleExpanded} />
             : showSnippetDetailBottomNavigation
               ? null
               : (
diff --git a/web/app/components/main-nav/layout.tsx b/web/app/components/main-nav/layout.tsx
index d01af10f271..44730fe7468 100644
--- a/web/app/components/main-nav/layout.tsx
+++ b/web/app/components/main-nav/layout.tsx
@@ -1,7 +1,9 @@
 'use client'
 
 import type { ReactNode } from 'react'
+import { useTranslation } from 'react-i18next'
 import MainNav from './index'
+import { MAIN_CONTENT_ID, SkipNav } from './skip-nav'
 
 type MainNavLayoutProps = {
   children: ReactNode
@@ -10,12 +12,19 @@ type MainNavLayoutProps = {
 const MainNavLayout = ({
   children,
 }: MainNavLayoutProps) => {
+  const { t } = useTranslation('common')
+
   return (
     <div className="flex h-0 min-h-0 grow overflow-hidden bg-background-body">
+      <SkipNav>{t('navigation.skipToMain')}</SkipNav>
       <MainNav />
-      <div className="flex min-w-0 grow flex-col overflow-hidden">
+      <main
+        id={MAIN_CONTENT_ID}
+        tabIndex={-1}
+        className="flex min-w-0 grow flex-col overflow-hidden outline-hidden focus:outline-hidden focus-visible:outline-hidden"
+      >
         {children}
-      </div>
+      </main>
     </div>
   )
 }
diff --git a/web/app/components/main-nav/routes.ts b/web/app/components/main-nav/routes.ts
new file mode 100644
index 00000000000..438094a581e
--- /dev/null
+++ b/web/app/components/main-nav/routes.ts
@@ -0,0 +1,104 @@
+import { buildIntegrationPath } from '@/app/components/integrations/routes'
+
+type MainNavRouteVisibility = 'all' | 'notDatasetOperator' | 'appDeployEditor'
+
+export type MainNavRouteConfig = {
+  key: string
+  href: string
+  labelKey: string
+  active: (pathname: string) => boolean
+  icon: string
+  activeIcon: string
+  visibility: MainNavRouteVisibility
+  feature?: 'agentV2'
+}
+
+export type MainNavRouteVisibilityOptions = {
+  agentV2Enabled: boolean
+  canUseAppDeploy: boolean
+  isCurrentWorkspaceDatasetOperator: boolean
+}
+
+function isPathUnderRoute(pathname: string, route: string) {
+  return pathname === route || pathname.startsWith(`${route}/`)
+}
+
+export const MAIN_NAV_ROUTES = [
+  {
+    key: 'home',
+    href: '/',
+    labelKey: 'mainNav.home',
+    active: (path: string) => path === '/' || path === '/explore/apps',
+    icon: 'i-custom-vender-main-nav-home',
+    activeIcon: 'i-custom-vender-main-nav-home-active',
+    visibility: 'all',
+  },
+  {
+    key: 'apps',
+    href: '/apps',
+    labelKey: 'menus.apps',
+    active: (path: string) => isPathUnderRoute(path, '/apps') || isPathUnderRoute(path, '/app') || isPathUnderRoute(path, '/snippets'),
+    icon: 'i-custom-vender-main-nav-studio',
+    activeIcon: 'i-custom-vender-main-nav-studio-active',
+    visibility: 'all',
+  },
+  {
+    key: 'roster',
+    href: '/roster',
+    labelKey: 'menus.roster',
+    active: (path: string) => isPathUnderRoute(path, '/roster'),
+    icon: 'i-custom-vender-main-nav-roster',
+    activeIcon: 'i-custom-vender-main-nav-roster-active',
+    visibility: 'notDatasetOperator',
+    feature: 'agentV2',
+  },
+  {
+    key: 'datasets',
+    href: '/datasets',
+    labelKey: 'menus.datasets',
+    active: (path: string) => isPathUnderRoute(path, '/datasets'),
+    icon: 'i-custom-vender-main-nav-knowledge',
+    activeIcon: 'i-custom-vender-main-nav-knowledge-active',
+    visibility: 'all',
+  },
+  {
+    key: 'integrations',
+    href: buildIntegrationPath('provider'),
+    labelKey: 'mainNav.integrations',
+    active: (path: string) => isPathUnderRoute(path, '/integrations') || isPathUnderRoute(path, '/tools'),
+    icon: 'i-custom-vender-main-nav-integrations',
+    activeIcon: 'i-custom-vender-main-nav-integrations-active',
+    visibility: 'all',
+  },
+  {
+    key: 'marketplace',
+    href: '/marketplace',
+    labelKey: 'mainNav.marketplace',
+    active: (path: string) => isPathUnderRoute(path, '/marketplace') || isPathUnderRoute(path, '/plugins'),
+    icon: 'i-custom-vender-main-nav-marketplace',
+    activeIcon: 'i-custom-vender-main-nav-marketplace-active',
+    visibility: 'all',
+  },
+  {
+    key: 'deployments',
+    href: '/deployments',
+    labelKey: 'menus.deployments',
+    active: (path: string) => isPathUnderRoute(path, '/deployments'),
+    icon: 'i-ri-rocket-line',
+    activeIcon: 'i-ri-rocket-fill',
+    visibility: 'appDeployEditor',
+  },
+] as const satisfies readonly MainNavRouteConfig[]
+
+export function isMainNavRouteVisible(route: MainNavRouteConfig, options: MainNavRouteVisibilityOptions) {
+  if (route.feature === 'agentV2' && !options.agentV2Enabled)
+    return false
+
+  if (route.visibility === 'all')
+    return true
+
+  if (route.visibility === 'notDatasetOperator')
+    return !options.isCurrentWorkspaceDatasetOperator
+
+  return options.canUseAppDeploy
+}
diff --git a/web/app/components/main-nav/skip-nav.tsx b/web/app/components/main-nav/skip-nav.tsx
new file mode 100644
index 00000000000..eda7ad4b5f0
--- /dev/null
+++ b/web/app/components/main-nav/skip-nav.tsx
@@ -0,0 +1,37 @@
+'use client'
+
+import type { ComponentProps, MouseEventHandler } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+
+export const MAIN_CONTENT_ID = 'main-content'
+const MAIN_CONTENT_HREF = `#${MAIN_CONTENT_ID}`
+
+export function SkipNav({
+  className,
+  children,
+  onClick,
+  ...props
+}: ComponentProps<'a'>) {
+  const handleClick: MouseEventHandler<HTMLAnchorElement> = (event) => {
+    onClick?.(event)
+
+    if (event.defaultPrevented)
+      return
+
+    document.getElementById(MAIN_CONTENT_ID)?.focus()
+  }
+
+  return (
+    <a
+      href={MAIN_CONTENT_HREF}
+      onClick={handleClick}
+      className={cn(
+        'fixed top-2 left-2 z-60 inline-flex h-9 -translate-y-[calc(100%+0.75rem)] items-center justify-center rounded-lg border-[0.5px] border-components-button-secondary-border bg-components-button-secondary-bg px-3 system-sm-medium text-components-button-secondary-text shadow-lg shadow-shadow-shadow-5 outline-hidden transition-transform duration-150 focus-visible:translate-y-0 focus-visible:ring-2 focus-visible:ring-state-accent-solid motion-reduce:transition-none',
+        className,
+      )}
+      {...props}
+    >
+      {children}
+    </a>
+  )
+}
diff --git a/web/app/components/main-nav/storage.ts b/web/app/components/main-nav/storage.ts
new file mode 100644
index 00000000000..2fb03d23595
--- /dev/null
+++ b/web/app/components/main-nav/storage.ts
@@ -0,0 +1,16 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+type DetailSidebarMode = 'expand' | 'collapse'
+
+export const DETAIL_SIDEBAR_STORAGE_KEY = 'app-detail-collapse-or-expand'
+
+const [
+  useDetailSidebarMode,
+  _useDetailSidebarModeValue,
+  useSetDetailSidebarMode,
+] = createLocalStorageState<DetailSidebarMode>(DETAIL_SIDEBAR_STORAGE_KEY, 'expand', { raw: true })
+
+export {
+  useDetailSidebarMode,
+  useSetDetailSidebarMode,
+}
diff --git a/web/app/components/plugins/__tests__/provider-card.spec.tsx b/web/app/components/plugins/__tests__/provider-card.spec.tsx
index 71efd86bb07..7a4758c3147 100644
--- a/web/app/components/plugins/__tests__/provider-card.spec.tsx
+++ b/web/app/components/plugins/__tests__/provider-card.spec.tsx
@@ -21,6 +21,10 @@ vi.mock('@/app/components/plugins/install-plugin/install-from-marketplace', () =
   ),
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-plugin-install-permission', () => ({
+  default: () => ({ canInstallPlugin: true }),
+}))
+
 vi.mock('@/app/components/plugins/marketplace/utils', () => ({
   getPluginLinkInMarketplace: (plugin: Plugin, params: Record<string, string>) =>
     `/marketplace/${plugin.org}/${plugin.name}?language=${params.language}&theme=${params.theme}`,
diff --git a/web/app/components/plugins/install-plugin/components/__tests__/plugin-install-permission-provider.spec.tsx b/web/app/components/plugins/install-plugin/components/__tests__/plugin-install-permission-provider.spec.tsx
new file mode 100644
index 00000000000..453ef2c91b1
--- /dev/null
+++ b/web/app/components/plugins/install-plugin/components/__tests__/plugin-install-permission-provider.spec.tsx
@@ -0,0 +1,88 @@
+import { render, screen } from '@testing-library/react'
+import usePluginInstallPermission from '../../hooks/use-plugin-install-permission'
+import {
+  PluginInstallPermissionProvider,
+  PluginInstallPermissionProviderGuard,
+} from '../plugin-install-permission-provider'
+
+const PermissionProbe = () => {
+  const {
+    canInstallPlugin,
+    canUpdatePlugin,
+    currentDifyVersion,
+  } = usePluginInstallPermission()
+
+  return (
+    <div>
+      <span>
+        install:
+        {String(canInstallPlugin)}
+      </span>
+      <span>
+        update:
+        {String(canUpdatePlugin)}
+      </span>
+      <span>
+        version:
+        {currentDifyVersion}
+      </span>
+    </div>
+  )
+}
+
+describe('PluginInstallPermissionProvider', () => {
+  // Rendering provides plugin permission state to hook consumers.
+  describe('Rendering', () => {
+    it('should provide explicit install, update, and version values', () => {
+      render(
+        <PluginInstallPermissionProvider
+          canInstallPlugin
+          canUpdatePlugin={false}
+          currentDifyVersion="1.2.3"
+        >
+          <PermissionProbe />
+        </PluginInstallPermissionProvider>,
+      )
+
+      expect(screen.getByText('install:true')).toBeInTheDocument()
+      expect(screen.getByText('update:false')).toBeInTheDocument()
+      expect(screen.getByText('version:1.2.3')).toBeInTheDocument()
+    })
+
+    it('should update provided values after rerender', () => {
+      const { rerender } = render(
+        <PluginInstallPermissionProvider canInstallPlugin currentDifyVersion="1.0.0">
+          <PermissionProbe />
+        </PluginInstallPermissionProvider>,
+      )
+
+      rerender(
+        <PluginInstallPermissionProvider canInstallPlugin={false} currentDifyVersion="2.0.0">
+          <PermissionProbe />
+        </PluginInstallPermissionProvider>,
+      )
+
+      expect(screen.getByText('install:false')).toBeInTheDocument()
+      expect(screen.getByText('update:false')).toBeInTheDocument()
+      expect(screen.getByText('version:2.0.0')).toBeInTheDocument()
+    })
+  })
+})
+
+describe('PluginInstallPermissionProviderGuard', () => {
+  // Guard avoids replacing an existing provider higher in the tree.
+  describe('Rendering', () => {
+    it('should keep existing provider values when nested under a provider', () => {
+      render(
+        <PluginInstallPermissionProvider canInstallPlugin={false} currentDifyVersion="outer">
+          <PluginInstallPermissionProviderGuard canInstallPlugin currentDifyVersion="inner">
+            <PermissionProbe />
+          </PluginInstallPermissionProviderGuard>
+        </PluginInstallPermissionProvider>,
+      )
+
+      expect(screen.getByText('install:false')).toBeInTheDocument()
+      expect(screen.getByText('version:outer')).toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/app/components/plugins/install-plugin/components/plugin-install-permission-provider.tsx b/web/app/components/plugins/install-plugin/components/plugin-install-permission-provider.tsx
new file mode 100644
index 00000000000..a9c980d67bc
--- /dev/null
+++ b/web/app/components/plugins/install-plugin/components/plugin-install-permission-provider.tsx
@@ -0,0 +1,69 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { PluginInstallPermissionStore } from '../hooks/use-plugin-install-permission'
+import { use, useEffect, useRef } from 'react'
+import {
+  createPluginInstallPermissionStore,
+  PluginInstallPermissionContext,
+} from '../hooks/use-plugin-install-permission'
+
+type PluginInstallPermissionProviderProps = {
+  canInstallPlugin: boolean
+  canUpdatePlugin?: boolean
+  currentDifyVersion?: string
+  children: ReactNode
+}
+
+export const PluginInstallPermissionProvider = ({
+  canInstallPlugin,
+  canUpdatePlugin,
+  currentDifyVersion,
+  children,
+}: PluginInstallPermissionProviderProps) => {
+  const storeRef = useRef<PluginInstallPermissionStore | null>(null)
+
+  if (!storeRef.current) {
+    storeRef.current = createPluginInstallPermissionStore({
+      canInstallPlugin,
+      canUpdatePlugin,
+      currentDifyVersion,
+    })
+  }
+
+  useEffect(() => {
+    storeRef.current?.getState().setPluginInstallPermission({
+      canInstallPlugin,
+      canUpdatePlugin: canUpdatePlugin ?? canInstallPlugin,
+      currentDifyVersion,
+    })
+  }, [canInstallPlugin, canUpdatePlugin, currentDifyVersion])
+
+  return (
+    <PluginInstallPermissionContext value={storeRef.current}>
+      {children}
+    </PluginInstallPermissionContext>
+  )
+}
+
+export const PluginInstallPermissionProviderGuard = ({
+  canInstallPlugin,
+  canUpdatePlugin,
+  currentDifyVersion,
+  children,
+}: PluginInstallPermissionProviderProps) => {
+  const store = use(PluginInstallPermissionContext)
+
+  if (store)
+    return children
+
+  return (
+    <PluginInstallPermissionProvider
+      canInstallPlugin={canInstallPlugin}
+      canUpdatePlugin={canUpdatePlugin}
+      currentDifyVersion={currentDifyVersion}
+    >
+      {children}
+    </PluginInstallPermissionProvider>
+  )
+}
diff --git a/web/app/components/plugins/install-plugin/hooks/__tests__/use-plugin-install-permission.spec.tsx b/web/app/components/plugins/install-plugin/hooks/__tests__/use-plugin-install-permission.spec.tsx
new file mode 100644
index 00000000000..bba2c65f9af
--- /dev/null
+++ b/web/app/components/plugins/install-plugin/hooks/__tests__/use-plugin-install-permission.spec.tsx
@@ -0,0 +1,51 @@
+import type { ReactNode } from 'react'
+import { renderHook } from '@testing-library/react'
+import usePluginInstallPermission, {
+  createPluginInstallPermissionStore,
+  PluginInstallPermissionContext,
+  usePluginInstallPermissionStore,
+} from '../use-plugin-install-permission'
+
+describe('usePluginInstallPermission', () => {
+  // Store creation defaults update permission to install permission when not provided.
+  describe('Store Defaults', () => {
+    it('should default update permission from install permission', () => {
+      const store = createPluginInstallPermissionStore({
+        canInstallPlugin: false,
+      })
+
+      expect(store.getState().canInstallPlugin).toBe(false)
+      expect(store.getState().canUpdatePlugin).toBe(false)
+    })
+  })
+
+  // Hook consumers read values from the plugin install permission context.
+  describe('Context', () => {
+    it('should expose plugin install permissions from context store', () => {
+      const store = createPluginInstallPermissionStore({
+        canInstallPlugin: true,
+        canUpdatePlugin: false,
+        currentDifyVersion: '1.2.3',
+      })
+      const wrapper = ({ children }: { children: ReactNode }) => (
+        <PluginInstallPermissionContext value={store}>
+          {children}
+        </PluginInstallPermissionContext>
+      )
+
+      const { result } = renderHook(() => usePluginInstallPermission(), { wrapper })
+
+      expect(result.current).toEqual({
+        canInstallPlugin: true,
+        canUpdatePlugin: false,
+        currentDifyVersion: '1.2.3',
+      })
+    })
+
+    it('should throw when provider is missing', () => {
+      expect(() => {
+        renderHook(() => usePluginInstallPermissionStore(state => state.canInstallPlugin))
+      }).toThrow('Missing PluginInstallPermissionProvider in the tree')
+    })
+  })
+})
diff --git a/web/app/components/plugins/install-plugin/hooks/__tests__/use-workspace-plugin-install-permission.spec.ts b/web/app/components/plugins/install-plugin/hooks/__tests__/use-workspace-plugin-install-permission.spec.ts
new file mode 100644
index 00000000000..8fdf23de333
--- /dev/null
+++ b/web/app/components/plugins/install-plugin/hooks/__tests__/use-workspace-plugin-install-permission.spec.ts
@@ -0,0 +1,81 @@
+import { renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import useWorkspacePluginInstallPermission from '../use-workspace-plugin-install-permission'
+
+let mockWorkspacePermissionKeys: string[] = []
+
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    langGeniusVersionInfo: { current_version: '1.0.0' },
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
+describe('useWorkspacePluginInstallPermission', () => {
+  beforeEach(() => {
+    mockWorkspacePermissionKeys = []
+  })
+
+  it('should grant install and update capabilities with plugin.install', () => {
+    mockWorkspacePermissionKeys = ['plugin.install']
+
+    const { result } = renderHook(() => useWorkspacePluginInstallPermission())
+
+    expect(result.current.canInstallPlugin).toBe(true)
+    expect(result.current.canUpdatePlugin).toBe(true)
+    expect(result.current.canViewInstalledPlugins).toBe(true)
+    expect(result.current.canManagePlugin).toBe(false)
+    expect(result.current.canDebugPlugin).toBe(false)
+    expect(result.current.canSetPluginPreferences).toBe(false)
+  })
+
+  it('should grant update, view, and manage capabilities but not install with plugin.manage', () => {
+    mockWorkspacePermissionKeys = ['plugin.manage']
+
+    const { result } = renderHook(() => useWorkspacePluginInstallPermission())
+
+    expect(result.current.canInstallPlugin).toBe(false)
+    expect(result.current.canUpdatePlugin).toBe(true)
+    expect(result.current.canViewInstalledPlugins).toBe(true)
+    expect(result.current.canManagePlugin).toBe(true)
+    expect(result.current.canDebugPlugin).toBe(false)
+    expect(result.current.canSetPluginPreferences).toBe(false)
+  })
+
+  it('should grant plugin debug capability with plugin.debug', () => {
+    mockWorkspacePermissionKeys = ['plugin.debug']
+
+    const { result } = renderHook(() => useWorkspacePluginInstallPermission())
+
+    expect(result.current.canInstallPlugin).toBe(false)
+    expect(result.current.canUpdatePlugin).toBe(false)
+    expect(result.current.canViewInstalledPlugins).toBe(false)
+    expect(result.current.canManagePlugin).toBe(false)
+    expect(result.current.canDebugPlugin).toBe(true)
+    expect(result.current.canSetPluginPreferences).toBe(false)
+  })
+
+  it('should grant plugin preference setting capability with plugin.plugin_preferences', () => {
+    mockWorkspacePermissionKeys = ['plugin.plugin_preferences']
+
+    const { result } = renderHook(() => useWorkspacePluginInstallPermission())
+
+    expect(result.current.canInstallPlugin).toBe(false)
+    expect(result.current.canUpdatePlugin).toBe(false)
+    expect(result.current.canViewInstalledPlugins).toBe(false)
+    expect(result.current.canManagePlugin).toBe(false)
+    expect(result.current.canDebugPlugin).toBe(false)
+    expect(result.current.canSetPluginPreferences).toBe(true)
+  })
+
+  it('should deny plugin capabilities without plugin install or manage permissions', () => {
+    const { result } = renderHook(() => useWorkspacePluginInstallPermission())
+
+    expect(result.current.canInstallPlugin).toBe(false)
+    expect(result.current.canUpdatePlugin).toBe(false)
+    expect(result.current.canViewInstalledPlugins).toBe(false)
+    expect(result.current.canManagePlugin).toBe(false)
+    expect(result.current.canDebugPlugin).toBe(false)
+    expect(result.current.canSetPluginPreferences).toBe(false)
+  })
+})
diff --git a/web/app/components/plugins/install-plugin/hooks/use-plugin-install-permission.ts b/web/app/components/plugins/install-plugin/hooks/use-plugin-install-permission.ts
new file mode 100644
index 00000000000..2bb7f7f45ee
--- /dev/null
+++ b/web/app/components/plugins/install-plugin/hooks/use-plugin-install-permission.ts
@@ -0,0 +1,73 @@
+import type { StoreApi } from 'zustand'
+import { createContext, use } from 'react'
+import { useStore } from 'zustand'
+import { createStore } from 'zustand/vanilla'
+
+export type PluginInstallPermissionState = {
+  canInstallPlugin: boolean
+  canUpdatePlugin: boolean
+  currentDifyVersion?: string
+}
+
+type PluginInstallPermissionAction = {
+  setPluginInstallPermission: (state: PluginInstallPermissionState) => void
+}
+
+export type PluginInstallPermissionStoreState = PluginInstallPermissionState & PluginInstallPermissionAction
+
+export type PluginInstallPermissionStore = StoreApi<PluginInstallPermissionStoreState>
+
+const defaultPluginInstallPermissionState: PluginInstallPermissionState = {
+  canInstallPlugin: true,
+  canUpdatePlugin: true,
+}
+
+export const createPluginInstallPermissionStore = (initProps?: Partial<PluginInstallPermissionState>) => {
+  const canInstallPlugin = initProps?.canInstallPlugin ?? defaultPluginInstallPermissionState.canInstallPlugin
+
+  return createStore<PluginInstallPermissionStoreState>()(set => ({
+    ...defaultPluginInstallPermissionState,
+    ...initProps,
+    canUpdatePlugin: initProps?.canUpdatePlugin ?? canInstallPlugin,
+    setPluginInstallPermission: state => set(() => state),
+  }))
+}
+
+const fallbackPluginInstallPermissionStore = createPluginInstallPermissionStore()
+
+export const PluginInstallPermissionContext = createContext<PluginInstallPermissionStore | null>(null)
+
+export const usePluginInstallPermissionStore = <T>(selector: (state: PluginInstallPermissionStoreState) => T): T => {
+  const store = use(PluginInstallPermissionContext)
+  if (!store)
+    throw new Error('Missing PluginInstallPermissionProvider in the tree')
+
+  return useStore(store, selector)
+}
+
+const usePluginInstallPermission = () => {
+  const canInstallPlugin = usePluginInstallPermissionStore(state => state.canInstallPlugin)
+  const canUpdatePlugin = usePluginInstallPermissionStore(state => state.canUpdatePlugin)
+  const currentDifyVersion = usePluginInstallPermissionStore(state => state.currentDifyVersion)
+
+  return {
+    canInstallPlugin,
+    canUpdatePlugin,
+    currentDifyVersion,
+  }
+}
+
+export const useOptionalPluginInstallPermission = () => {
+  const store = use(PluginInstallPermissionContext) ?? fallbackPluginInstallPermissionStore
+  const canInstallPlugin = useStore(store, state => state.canInstallPlugin)
+  const canUpdatePlugin = useStore(store, state => state.canUpdatePlugin)
+  const currentDifyVersion = useStore(store, state => state.currentDifyVersion)
+
+  return {
+    canInstallPlugin,
+    canUpdatePlugin,
+    currentDifyVersion,
+  }
+}
+
+export default usePluginInstallPermission
diff --git a/web/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission.ts b/web/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission.ts
new file mode 100644
index 00000000000..59e7c1ad7f8
--- /dev/null
+++ b/web/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission.ts
@@ -0,0 +1,45 @@
+import { useMemo } from 'react'
+import { useAppContext } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
+
+const pluginReadAndUpdatePermissionKeys = ['plugin.install', 'plugin.manage']
+
+const useWorkspacePluginInstallPermission = () => {
+  const { langGeniusVersionInfo, workspacePermissionKeys } = useAppContext()
+
+  const canInstallPlugin = useMemo(() => {
+    return hasPermission(workspacePermissionKeys, 'plugin.install')
+  }, [workspacePermissionKeys])
+
+  const canUpdatePlugin = useMemo(() => {
+    return hasPermission(workspacePermissionKeys, pluginReadAndUpdatePermissionKeys)
+  }, [workspacePermissionKeys])
+
+  const canViewInstalledPlugins = useMemo(() => {
+    return hasPermission(workspacePermissionKeys, pluginReadAndUpdatePermissionKeys)
+  }, [workspacePermissionKeys])
+
+  const canManagePlugin = useMemo(() => {
+    return hasPermission(workspacePermissionKeys, 'plugin.manage')
+  }, [workspacePermissionKeys])
+
+  const canDebugPlugin = useMemo(() => {
+    return hasPermission(workspacePermissionKeys, 'plugin.debug')
+  }, [workspacePermissionKeys])
+
+  const canSetPluginPreferences = useMemo(() => {
+    return hasPermission(workspacePermissionKeys, 'plugin.plugin_preferences')
+  }, [workspacePermissionKeys])
+
+  return {
+    canInstallPlugin,
+    canUpdatePlugin,
+    canViewInstalledPlugins,
+    canManagePlugin,
+    canDebugPlugin,
+    canSetPluginPreferences,
+    currentDifyVersion: langGeniusVersionInfo?.current_version,
+  }
+}
+
+export default useWorkspacePluginInstallPermission
diff --git a/web/app/components/plugins/install-plugin/install-from-marketplace/steps/__tests__/install.spec.tsx b/web/app/components/plugins/install-plugin/install-from-marketplace/steps/__tests__/install.spec.tsx
index b42b119bde6..222029ab013 100644
--- a/web/app/components/plugins/install-plugin/install-from-marketplace/steps/__tests__/install.spec.tsx
+++ b/web/app/components/plugins/install-plugin/install-from-marketplace/steps/__tests__/install.spec.tsx
@@ -71,6 +71,12 @@ vi.mock('@/app/components/plugins/install-plugin/hooks/use-check-installed', ()
   }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    langGeniusVersionInfo: mockLangGeniusVersionInfo,
+  }),
+}))
+
 // Mock service hooks
 vi.mock('@/service/use-plugins', () => ({
   useInstallPackageFromMarketPlace: () => ({
@@ -95,10 +101,10 @@ vi.mock('../../../base/check-task-status', () => ({
   }),
 }))
 
-// Mock useAppContext
-vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    langGeniusVersionInfo: mockLangGeniusVersionInfo,
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-plugin-install-permission', () => ({
+  default: () => ({
+    canInstallPlugin: true,
+    currentDifyVersion: mockLangGeniusVersionInfo.current_version,
   }),
 }))
 
diff --git a/web/app/components/plugins/marketplace/__tests__/index.spec.tsx b/web/app/components/plugins/marketplace/__tests__/index.spec.tsx
index cd9877467d4..5444d6ae6d7 100644
--- a/web/app/components/plugins/marketplace/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/marketplace/__tests__/index.spec.tsx
@@ -64,12 +64,22 @@ describe('Marketplace', () => {
     expect(getByTestId('list-wrapper')).toBeInTheDocument()
   })
 
-  it('should pass showInstallButton=true by default to ListWrapper', async () => {
+  it('should pass showInstallButton=false by default to ListWrapper', async () => {
     const Marketplace = (await import('../index')).default
     const element = await Marketplace({})
 
     const { getByTestId } = render(element as React.ReactElement)
 
+    const listWrapper = getByTestId('list-wrapper')
+    expect(listWrapper.getAttribute('data-show-install')).toBe('false')
+  })
+
+  it('should pass showInstallButton=true when specified', async () => {
+    const Marketplace = (await import('../index')).default
+    const element = await Marketplace({ showInstallButton: true })
+
+    const { getByTestId } = render(element as React.ReactElement)
+
     const listWrapper = getByTestId('list-wrapper')
     expect(listWrapper.getAttribute('data-show-install')).toBe('true')
   })
diff --git a/web/app/components/plugins/marketplace/index.tsx b/web/app/components/plugins/marketplace/index.tsx
index c80aa1a2ba6..785669bd595 100644
--- a/web/app/components/plugins/marketplace/index.tsx
+++ b/web/app/components/plugins/marketplace/index.tsx
@@ -1,4 +1,5 @@
 import type { SearchParams } from 'nuqs'
+import { PluginInstallPermissionProviderGuard } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
 import { TanstackQueryInitializer } from '@/context/query-client'
 import Description from './description'
 import { HydrateQueryClient } from './hydration-server'
@@ -17,7 +18,7 @@ type MarketplaceProps = {
 }
 
 const Marketplace = async ({
-  showInstallButton = true,
+  showInstallButton = false,
   pluginTypeSwitchClassName,
   isMarketplacePlatform = false,
   marketplaceNav,
@@ -26,20 +27,22 @@ const Marketplace = async ({
   return (
     <TanstackQueryInitializer>
       <HydrateQueryClient searchParams={searchParams}>
-        <Description
-          isMarketplacePlatform={isMarketplacePlatform}
-          marketplaceNav={marketplaceNav}
-        />
-        {
-          !isMarketplacePlatform && (
-            <StickySearchAndSwitchWrapper
-              pluginTypeSwitchClassName={pluginTypeSwitchClassName}
-            />
-          )
-        }
-        <ListWrapper
-          showInstallButton={showInstallButton}
-        />
+        <PluginInstallPermissionProviderGuard canInstallPlugin={showInstallButton}>
+          <Description
+            isMarketplacePlatform={isMarketplacePlatform}
+            marketplaceNav={marketplaceNav}
+          />
+          {
+            !isMarketplacePlatform && (
+              <StickySearchAndSwitchWrapper
+                pluginTypeSwitchClassName={pluginTypeSwitchClassName}
+              />
+            )
+          }
+          <ListWrapper
+            showInstallButton={showInstallButton}
+          />
+        </PluginInstallPermissionProviderGuard>
       </HydrateQueryClient>
     </TanstackQueryInitializer>
   )
diff --git a/web/app/components/plugins/marketplace/list/__tests__/card-wrapper.spec.tsx b/web/app/components/plugins/marketplace/list/__tests__/card-wrapper.spec.tsx
index 5d766548cc7..861bdbac345 100644
--- a/web/app/components/plugins/marketplace/list/__tests__/card-wrapper.spec.tsx
+++ b/web/app/components/plugins/marketplace/list/__tests__/card-wrapper.spec.tsx
@@ -46,6 +46,11 @@ vi.mock('@/app/components/plugins/install-plugin/install-from-marketplace', () =
   ),
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-plugin-install-permission', () => ({
+  default: () => ({ canInstallPlugin: true }),
+  useOptionalPluginInstallPermission: () => ({ canInstallPlugin: true }),
+}))
+
 vi.mock('../../utils', () => ({
   getPluginDetailLinkInMarketplace: (plugin: Plugin) => `/detail/${plugin.org}/${plugin.name}`,
   getPluginLinkInMarketplace: (plugin: Plugin, params: Record<string, string>) => `/marketplace/${plugin.org}/${plugin.name}?language=${params.language}&theme=${params.theme}`,
diff --git a/web/app/components/plugins/marketplace/list/card-wrapper.tsx b/web/app/components/plugins/marketplace/list/card-wrapper.tsx
index 0356b985199..7e38d660fde 100644
--- a/web/app/components/plugins/marketplace/list/card-wrapper.tsx
+++ b/web/app/components/plugins/marketplace/list/card-wrapper.tsx
@@ -9,6 +9,7 @@ import { useLocale, useTranslation } from '#i18n'
 import Card from '@/app/components/plugins/card'
 import CardMoreInfo from '@/app/components/plugins/card/card-more-info'
 import { useTags } from '@/app/components/plugins/hooks'
+import { useOptionalPluginInstallPermission } from '@/app/components/plugins/install-plugin/hooks/use-plugin-install-permission'
 import InstallFromMarketplace from '@/app/components/plugins/install-plugin/install-from-marketplace'
 import { getPluginLinkInMarketplace } from '../utils'
 
@@ -26,6 +27,7 @@ const CardWrapperComponent = ({
     setTrue: showInstallFromMarketplace,
     setFalse: hideInstallFromMarketplace,
   }] = useBoolean(false)
+  const { canInstallPlugin } = useOptionalPluginInstallPermission()
   const locale = useLocale()
   const { getTagLabel } = useTags()
 
@@ -41,8 +43,9 @@ const CardWrapperComponent = ({
   const handleOpenMarketplaceDetail = () => {
     window.open(getPluginLinkInMarketplace(plugin, marketplaceLinkParams), '_blank', 'noopener,noreferrer')
   }
+  const showInstallAction = !!showInstallButton && canInstallPlugin
 
-  if (showInstallButton) {
+  if (showInstallAction) {
     return (
       <div
         className="group relative cursor-pointer rounded-xl"
diff --git a/web/app/components/plugins/marketplace/list/index.tsx b/web/app/components/plugins/marketplace/list/index.tsx
index e1f4d71e5c6..3c02e708b32 100644
--- a/web/app/components/plugins/marketplace/list/index.tsx
+++ b/web/app/components/plugins/marketplace/list/index.tsx
@@ -2,6 +2,7 @@
 import type { Plugin } from '../../types'
 import type { MarketplaceCollection, SearchParamsFromCollection } from '../types'
 import { cn } from '@langgenius/dify-ui/cn'
+import { PluginInstallPermissionProviderGuard } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
 import Empty from '../empty'
 import CardWrapper from './card-wrapper'
 import ListWithCollection from './list-with-collection'
@@ -27,7 +28,7 @@ const List = ({
   onCollectionMoreClick,
 }: ListProps) => {
   return (
-    <>
+    <PluginInstallPermissionProviderGuard canInstallPlugin={!!showInstallButton}>
       {
         !plugins && (
           <ListWithCollection
@@ -69,7 +70,7 @@ const List = ({
           <Empty className={emptyClassName} />
         )
       }
-    </>
+    </PluginInstallPermissionProviderGuard>
   )
 }
 
diff --git a/web/app/components/plugins/marketplace/marketplace-install-permission-provider.tsx b/web/app/components/plugins/marketplace/marketplace-install-permission-provider.tsx
new file mode 100644
index 00000000000..ffa83c2a0ef
--- /dev/null
+++ b/web/app/components/plugins/marketplace/marketplace-install-permission-provider.tsx
@@ -0,0 +1,25 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { PluginInstallPermissionProvider } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
+import { useAppContext } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
+
+type MarketplaceInstallPermissionProviderProps = {
+  children: ReactNode
+}
+
+const MarketplaceInstallPermissionProvider = ({
+  children,
+}: MarketplaceInstallPermissionProviderProps) => {
+  const { workspacePermissionKeys } = useAppContext()
+  const canInstallPlugin = hasPermission(workspacePermissionKeys, 'plugin.install')
+
+  return (
+    <PluginInstallPermissionProvider canInstallPlugin={canInstallPlugin}>
+      {children}
+    </PluginInstallPermissionProvider>
+  )
+}
+
+export default MarketplaceInstallPermissionProvider
diff --git a/web/app/components/plugins/plugin-auth/__tests__/authorized-in-node.spec.tsx b/web/app/components/plugins/plugin-auth/__tests__/authorized-in-node.spec.tsx
index eaf586125c0..ba542bdc9ed 100644
--- a/web/app/components/plugins/plugin-auth/__tests__/authorized-in-node.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/__tests__/authorized-in-node.spec.tsx
@@ -1,7 +1,7 @@
 import type { ReactNode } from 'react'
 import type { Credential, PluginPayload } from '../types'
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
-import { fireEvent, render, screen } from '@testing-library/react'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { AuthCategory, CredentialTypeEnum } from '../types'
 
@@ -118,6 +118,24 @@ describe('AuthorizedInNode Component', () => {
     expect(screen.getByText('plugin.auth.workspaceDefault'))!.toBeInTheDocument()
   })
 
+  it('should expose the workspace default credential id when requested', async () => {
+    const AuthorizedInNode = (await import('../authorized-in-node')).default
+    const onDefaultCredentialChange = vi.fn()
+    const pluginPayload = createPluginPayload()
+    render(
+      <AuthorizedInNode
+        pluginPayload={pluginPayload}
+        onAuthorizationItemClick={vi.fn()}
+        onDefaultCredentialChange={onDefaultCredentialChange}
+      />,
+      { wrapper: createWrapper() },
+    )
+
+    await waitFor(() => {
+      expect(onDefaultCredentialChange).toHaveBeenCalledWith('test-credential-id')
+    })
+  })
+
   it('should render credential name when credentialId matches', async () => {
     const AuthorizedInNode = (await import('../authorized-in-node')).default
     const credential = createCredential({ id: 'selected-id', name: 'My Credential' })
diff --git a/web/app/components/plugins/plugin-auth/__tests__/plugin-auth-in-agent.spec.tsx b/web/app/components/plugins/plugin-auth/__tests__/plugin-auth-in-agent.spec.tsx
index d19c05efe12..6f8125ac132 100644
--- a/web/app/components/plugins/plugin-auth/__tests__/plugin-auth-in-agent.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/__tests__/plugin-auth-in-agent.spec.tsx
@@ -43,8 +43,11 @@ vi.mock('@/context/app-context', () => ({
   }),
   // Item renders useAppContextWithSelector(state => state.userProfile) for the
   // borrowed-row heuristic. Provide a minimal stub so the selector runs.
-  useSelector: (selector: (state: { userProfile: typeof mockUserProfile }) => unknown) =>
-    selector({ userProfile: mockUserProfile }),
+  useSelector: (selector: (state: { userProfile: typeof mockUserProfile, workspacePermissionKeys: string[] }) => unknown) =>
+    selector({
+      userProfile: mockUserProfile,
+      workspacePermissionKeys: ['credential.manage', 'credential.use'],
+    }),
 }))
 
 vi.mock('@/hooks/use-oauth', () => ({
diff --git a/web/app/components/plugins/plugin-auth/__tests__/plugin-auth.spec.tsx b/web/app/components/plugins/plugin-auth/__tests__/plugin-auth.spec.tsx
index 5b07c571156..97d94cbd86d 100644
--- a/web/app/components/plugins/plugin-auth/__tests__/plugin-auth.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/__tests__/plugin-auth.spec.tsx
@@ -6,6 +6,9 @@ import { AuthCategory } from '../types'
 
 const mockUsePluginAuth = vi.fn()
 const mockSetShowAccountSettingModal = vi.fn()
+const mockAppContext = vi.hoisted(() => ({
+  workspacePermissionKeys: ['credential.manage', 'credential.use'] as string[],
+}))
 
 vi.mock('../hooks/use-plugin-auth', () => ({
   usePluginAuth: (...args: unknown[]) => mockUsePluginAuth(...args),
@@ -20,6 +23,13 @@ vi.mock('../authorized', () => ({
   ),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
+    selector({
+      workspacePermissionKeys: mockAppContext.workspacePermissionKeys,
+    }),
+}))
+
 vi.mock('@/context/modal-context', () => ({
   useModalContext: () => ({
     setShowAccountSettingModal: mockSetShowAccountSettingModal,
@@ -34,6 +44,7 @@ const defaultPayload = {
 describe('PluginAuth', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockAppContext.workspacePermissionKeys = ['credential.manage', 'credential.use']
   })
 
   afterEach(() => {
@@ -46,7 +57,6 @@ describe('PluginAuth', () => {
       canOAuth: false,
       canApiKey: true,
       credentials: [],
-      disabled: false,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -62,7 +72,6 @@ describe('PluginAuth', () => {
       canOAuth: true,
       canApiKey: true,
       credentials: [{ id: '1', name: 'key', is_default: true, provider: 'test' }],
-      disabled: false,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -78,7 +87,6 @@ describe('PluginAuth', () => {
       canOAuth: false,
       canApiKey: true,
       credentials: [{ id: '1', name: 'key', is_default: true, provider: 'test' }],
-      disabled: false,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -98,7 +106,6 @@ describe('PluginAuth', () => {
       canOAuth: false,
       canApiKey: true,
       credentials: [],
-      disabled: false,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -113,7 +120,6 @@ describe('PluginAuth', () => {
       canOAuth: false,
       canApiKey: true,
       credentials: [],
-      disabled: false,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -128,7 +134,6 @@ describe('PluginAuth', () => {
       canOAuth: false,
       canApiKey: false,
       credentials: [],
-      disabled: false,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -137,13 +142,13 @@ describe('PluginAuth', () => {
     expect(mockUsePluginAuth).toHaveBeenCalledWith(defaultPayload, true)
   })
 
-  it('renders permission hint when authorization configuration is disabled by workspace permissions', () => {
+  it('renders permission hint and disables authorization configuration when credential.manage is missing', () => {
+    mockAppContext.workspacePermissionKeys = ['credential.use']
     mockUsePluginAuth.mockReturnValue({
       isAuthorized: false,
       canOAuth: false,
       canApiKey: true,
       credentials: [],
-      disabled: true,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -157,12 +162,12 @@ describe('PluginAuth', () => {
   })
 
   it('opens members settings when permission hint action is clicked', () => {
+    mockAppContext.workspacePermissionKeys = ['credential.use']
     mockUsePluginAuth.mockReturnValue({
       isAuthorized: false,
       canOAuth: false,
       canApiKey: true,
       credentials: [],
-      disabled: true,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -176,12 +181,12 @@ describe('PluginAuth', () => {
   })
 
   it('does not render permission hint for datasource authorization', () => {
+    mockAppContext.workspacePermissionKeys = ['credential.use']
     mockUsePluginAuth.mockReturnValue({
       isAuthorized: false,
       canOAuth: false,
       canApiKey: true,
       credentials: [],
-      disabled: true,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: false,
     })
@@ -192,12 +197,12 @@ describe('PluginAuth', () => {
   })
 
   it('does not render permission hint when custom credentials are unavailable', () => {
+    mockAppContext.workspacePermissionKeys = ['credential.use']
     mockUsePluginAuth.mockReturnValue({
       isAuthorized: false,
       canOAuth: false,
       canApiKey: true,
       credentials: [],
-      disabled: true,
       invalidPluginCredentialInfo: vi.fn(),
       notAllowCustomCredential: true,
     })
diff --git a/web/app/components/plugins/plugin-auth/authorize/__tests__/api-key-modal.spec.tsx b/web/app/components/plugins/plugin-auth/authorize/__tests__/api-key-modal.spec.tsx
index f9b382ef4fd..7b2df1f9918 100644
--- a/web/app/components/plugins/plugin-auth/authorize/__tests__/api-key-modal.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/authorize/__tests__/api-key-modal.spec.tsx
@@ -247,6 +247,18 @@ describe('ApiKeyModal', () => {
     expect(mockOnClose).toHaveBeenCalled()
   })
 
+  it('should call onClose after controlled cancel closes the modal', async () => {
+    const mockOnClose = vi.fn()
+    render(<ControlledModalHarness ApiKeyModal={ApiKeyModal} onClose={mockOnClose} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'common.operation.cancel' }))
+
+    await waitFor(() => {
+      expect(screen.getByTestId('modal-open-state')).toHaveTextContent('false')
+    })
+    expect(mockOnClose).toHaveBeenCalled()
+  })
+
   it('should close through controlled open state when cancel is clicked', async () => {
     const mockOnClose = vi.fn()
     render(<ControlledModalHarness ApiKeyModal={ApiKeyModal} onClose={mockOnClose} />)
diff --git a/web/app/components/plugins/plugin-auth/authorize/__tests__/index.spec.tsx b/web/app/components/plugins/plugin-auth/authorize/__tests__/index.spec.tsx
index 5a705b14ebc..aad6a174730 100644
--- a/web/app/components/plugins/plugin-auth/authorize/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/authorize/__tests__/index.spec.tsx
@@ -28,6 +28,9 @@ const createWrapper = () => {
 
 // Mock API hooks - only mock network-related hooks
 const mockGetPluginOAuthClientSchema = vi.fn()
+const mockAppContext = vi.hoisted(() => ({
+  workspacePermissionKeys: ['credential.manage', 'credential.use'] as string[],
+}))
 
 vi.mock('../../hooks/use-credential', () => ({
   useGetPluginOAuthUrlHook: () => ({
@@ -61,6 +64,13 @@ vi.mock('@/hooks/use-oauth', () => ({
   openOAuthPopup: vi.fn(),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
+    selector({
+      workspacePermissionKeys: mockAppContext.workspacePermissionKeys,
+    }),
+}))
+
 // Mock service/use-triggers - API service
 vi.mock('@/service/use-triggers', () => ({
   useTriggerPluginDynamicOptions: () => ({
@@ -84,6 +94,7 @@ const createPluginPayload = (overrides: Partial<PluginPayload> = {}): PluginPayl
 describe('Authorize', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockAppContext.workspacePermissionKeys = ['credential.manage', 'credential.use']
     mockGetPluginOAuthClientSchema.mockReturnValue({
       schema: [],
       is_oauth_custom_client_enabled: false,
@@ -240,15 +251,15 @@ describe('Authorize', () => {
       })
     })
 
-    describe('disabled prop', () => {
-      it('should disable OAuth button when disabled is true', () => {
+    describe('credential.manage permission', () => {
+      it('should disable OAuth button when credential.manage is missing', () => {
         const pluginPayload = createPluginPayload()
+        mockAppContext.workspacePermissionKeys = ['credential.use']
 
         render(
           <Authorize
             pluginPayload={pluginPayload}
             canOAuth={true}
-            disabled={true}
           />,
           { wrapper: createWrapper() },
         )
@@ -256,14 +267,14 @@ describe('Authorize', () => {
         expect(screen.getByRole('button')).toBeDisabled()
       })
 
-      it('should disable API Key button when disabled is true', () => {
+      it('should disable API Key button when credential.manage is missing', () => {
         const pluginPayload = createPluginPayload()
+        mockAppContext.workspacePermissionKeys = ['credential.use']
 
         render(
           <Authorize
             pluginPayload={pluginPayload}
             canApiKey={true}
-            disabled={true}
           />,
           { wrapper: createWrapper() },
         )
@@ -271,7 +282,7 @@ describe('Authorize', () => {
         expect(screen.getByRole('button')).toBeDisabled()
       })
 
-      it('should not disable buttons when disabled is false', () => {
+      it('should not disable buttons when credential.manage is present', () => {
         const pluginPayload = createPluginPayload()
 
         render(
@@ -279,7 +290,6 @@ describe('Authorize', () => {
             pluginPayload={pluginPayload}
             canOAuth={true}
             canApiKey={true}
-            disabled={false}
           />,
           { wrapper: createWrapper() },
         )
@@ -538,15 +548,15 @@ describe('Authorize', () => {
       }).not.toThrow()
     })
 
-    it('should handle both disabled and notAllowCustomCredential together', () => {
+    it('should stay disabled when credential.manage is missing and custom credentials are unavailable', () => {
       const pluginPayload = createPluginPayload()
+      mockAppContext.workspacePermissionKeys = ['credential.use']
 
       render(
         <Authorize
           pluginPayload={pluginPayload}
           canOAuth={true}
           canApiKey={true}
-          disabled={true}
           notAllowCustomCredential={true}
         />,
         { wrapper: createWrapper() },
@@ -730,15 +740,15 @@ describe('Authorize', () => {
       expect(buttons.length).toBe(2)
     })
 
-    it('should indicate disabled state for accessibility', () => {
+    it('should indicate permission-disabled state for accessibility', () => {
       const pluginPayload = createPluginPayload()
+      mockAppContext.workspacePermissionKeys = ['credential.use']
 
       render(
         <Authorize
           pluginPayload={pluginPayload}
           canOAuth={true}
           canApiKey={true}
-          disabled={true}
         />,
         { wrapper: createWrapper() },
       )
diff --git a/web/app/components/plugins/plugin-auth/authorize/index.tsx b/web/app/components/plugins/plugin-auth/authorize/index.tsx
index 925359e5190..e09afd2d860 100644
--- a/web/app/components/plugins/plugin-auth/authorize/index.tsx
+++ b/web/app/components/plugins/plugin-auth/authorize/index.tsx
@@ -8,6 +8,8 @@ import {
   useMemo,
 } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
 import AddApiKeyButton from './add-api-key-button'
 import AddOAuthButton from './add-oauth-button'
 
@@ -17,7 +19,6 @@ type AuthorizeProps = {
   showDivider?: boolean
   canOAuth?: boolean
   canApiKey?: boolean
-  disabled?: boolean
   onUpdate?: () => void
   notAllowCustomCredential?: boolean
   /**
@@ -34,12 +35,14 @@ const Authorize = ({
   showDivider = true,
   canOAuth,
   canApiKey,
-  disabled,
   onUpdate,
   notAllowCustomCredential,
   onApiKeyClick,
 }: AuthorizeProps) => {
   const { t } = useTranslation()
+  const workspacePermissionKeys = useAppContextWithSelector(s => s.workspacePermissionKeys)
+  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+
   const oAuthButtonProps: AddOAuthButtonProps = useMemo(() => {
     if (theme === 'secondary') {
       return {
@@ -81,7 +84,7 @@ const Authorize = ({
       <div className={cn('min-w-0 flex-1', notAllowCustomCredential && 'opacity-50')}>
         <AddOAuthButton
           {...oAuthButtonProps}
-          disabled={disabled || notAllowCustomCredential}
+          disabled={!canManageCredential || notAllowCustomCredential}
           onUpdate={onUpdate}
         />
       </div>
@@ -98,14 +101,14 @@ const Authorize = ({
       )
     }
     return Item
-  }, [notAllowCustomCredential, oAuthButtonProps, disabled, onUpdate, t])
+  }, [notAllowCustomCredential, oAuthButtonProps, canManageCredential, onUpdate, t])
 
   const ApiKeyButton = useMemo(() => {
     const Item = (
       <div className={cn('min-w-0 flex-1', notAllowCustomCredential && 'opacity-50')}>
         <AddApiKeyButton
           {...apiKeyButtonProps}
-          disabled={disabled || notAllowCustomCredential}
+          disabled={!canManageCredential || notAllowCustomCredential}
           onUpdate={onUpdate}
         />
       </div>
@@ -122,7 +125,7 @@ const Authorize = ({
       )
     }
     return Item
-  }, [notAllowCustomCredential, apiKeyButtonProps, disabled, onUpdate, t])
+  }, [notAllowCustomCredential, apiKeyButtonProps, canManageCredential, onUpdate, t])
 
   return (
     <>
diff --git a/web/app/components/plugins/plugin-auth/authorized-in-node.tsx b/web/app/components/plugins/plugin-auth/authorized-in-node.tsx
index 82c4119b7af..17f70f317dc 100644
--- a/web/app/components/plugins/plugin-auth/authorized-in-node.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized-in-node.tsx
@@ -10,6 +10,7 @@ import { RiArrowDownSLine } from '@remixicon/react'
 import {
   memo,
   useCallback,
+  useEffect,
   useState,
 } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -22,11 +23,13 @@ type AuthorizedInNodeProps = {
   pluginPayload: PluginPayload
   onAuthorizationItemClick: (id: string) => void
   credentialId?: string
+  onDefaultCredentialChange?: (id?: string) => void
 }
 const AuthorizedInNode = ({
   pluginPayload,
   onAuthorizationItemClick,
   credentialId,
+  onDefaultCredentialChange,
 }: AuthorizedInNodeProps) => {
   const { t } = useTranslation()
   const [isOpen, setIsOpen] = useState(false)
@@ -34,10 +37,15 @@ const AuthorizedInNode = ({
     canApiKey,
     canOAuth,
     credentials,
-    disabled,
     invalidPluginCredentialInfo,
     notAllowCustomCredential,
   } = usePluginAuth(pluginPayload, true, credentialId ? [credentialId] : undefined)
+  const defaultCredentialId = credentials.find(c => c.is_default)?.id
+
+  useEffect(() => {
+    onDefaultCredentialChange?.(defaultCredentialId)
+  }, [defaultCredentialId, onDefaultCredentialChange])
+
   const renderTrigger = useCallback((open?: boolean) => {
     let label = ''
     let removed = false
@@ -108,9 +116,15 @@ const AuthorizedInNode = ({
     },
   ]
   const handleAuthorizationItemClick = useCallback((id: string) => {
-    onAuthorizationItemClick(id)
+    onAuthorizationItemClick(
+      id === '__workspace_default__' && onDefaultCredentialChange
+        ? defaultCredentialId || id
+        : id,
+    )
     setIsOpen(false)
   }, [
+    defaultCredentialId,
+    onDefaultCredentialChange,
     onAuthorizationItemClick,
     setIsOpen,
   ])
@@ -128,7 +142,6 @@ const AuthorizedInNode = ({
       placement="bottom-end"
       triggerPopupSameWidth={false}
       popupClassName="w-[360px]"
-      disabled={disabled}
       disableSetDefault
       onItemClick={handleAuthorizationItemClick}
       extraAuthorizationItems={extraAuthorizationItems}
diff --git a/web/app/components/plugins/plugin-auth/authorized/__tests__/index.spec.tsx b/web/app/components/plugins/plugin-auth/authorized/__tests__/index.spec.tsx
index 83c92eb4196..62e34ae2b6c 100644
--- a/web/app/components/plugins/plugin-auth/authorized/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/__tests__/index.spec.tsx
@@ -75,6 +75,17 @@ vi.mock('@/hooks/use-oauth', () => ({
 
 vi.mock('@langgenius/dify-ui/popover', async () => await import('@/__mocks__/base-ui-popover'))
 
+const mockAppContext = vi.hoisted(() => ({
+  userProfile: { id: 'test-user', name: 'Test User', email: 'test@example.com', avatar_url: '' },
+  workspacePermissionKeys: ['credential.manage', 'credential.use'] as string[],
+}))
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: {
+    userProfile: typeof mockAppContext.userProfile
+    workspacePermissionKeys: string[]
+  }) => unknown) => selector(mockAppContext),
+}))
+
 // Mock service/use-triggers
 vi.mock('@/service/use-triggers', () => ({
   useTriggerPluginDynamicOptions: () => ({
@@ -130,6 +141,7 @@ const createCredential = (overrides: Partial<Credential> = {}): Credential => ({
 describe('Authorized Component', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockAppContext.workspacePermissionKeys = ['credential.manage', 'credential.use']
     mockDeletePluginCredential.mockResolvedValue({})
     mockSetPluginDefaultCredential.mockResolvedValue({})
     mockUpdatePluginCredential.mockResolvedValue({})
@@ -1445,32 +1457,42 @@ describe('Authorized Component', () => {
       expect(screen.getByText('API Keys'))!.toBeInTheDocument()
     })
 
-    it('should pass disabled to Item components', () => {
+    it('should allow credential.use to set default when credential.manage is missing', () => {
       const pluginPayload = createPluginPayload()
       const credentials = [createCredential({ is_default: false })]
+      mockAppContext.workspacePermissionKeys = ['credential.use']
 
       render(
         <Authorized
           pluginPayload={pluginPayload}
           credentials={credentials}
           isOpen={true}
-          disabled={true}
         />,
         { wrapper: createWrapper() },
       )
 
-      // When disabled is true, action buttons should be disabled
-      // Look for the set default button which should have disabled attribute
       const setDefaultButton = screen.queryByText('plugin.auth.setDefault')
-      if (setDefaultButton) {
-        const button = setDefaultButton.closest('button')
-        expect(button)!.toBeDisabled()
-      }
-      else {
-        // If no set default button, verify the component rendered
-        // If no set default button, verify the component rendered
-        expect(screen.getByText('API Keys'))!.toBeInTheDocument()
-      }
+      expect(setDefaultButton)!.toBeInTheDocument()
+      expect(setDefaultButton!.closest('button'))!.toBeEnabled()
+    })
+
+    it('should disable set default when credential.use and credential.manage are missing', () => {
+      const pluginPayload = createPluginPayload()
+      const credentials = [createCredential({ is_default: false })]
+      mockAppContext.workspacePermissionKeys = []
+
+      render(
+        <Authorized
+          pluginPayload={pluginPayload}
+          credentials={credentials}
+          isOpen={true}
+        />,
+        { wrapper: createWrapper() },
+      )
+
+      const setDefaultButton = screen.queryByText('plugin.auth.setDefault')
+      expect(setDefaultButton)!.toBeInTheDocument()
+      expect(setDefaultButton!.closest('button'))!.toBeDisabled()
     })
 
     it('should pass disableSetDefault to Item components', () => {
diff --git a/web/app/components/plugins/plugin-auth/authorized/__tests__/item.spec.tsx b/web/app/components/plugins/plugin-auth/authorized/__tests__/item.spec.tsx
index 22ea9d36bbd..e42b4317c44 100644
--- a/web/app/components/plugins/plugin-auth/authorized/__tests__/item.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/__tests__/item.spec.tsx
@@ -9,8 +9,11 @@ import Item from '../item'
 // borrowed-row heuristic; provide a minimal mock so the selector resolves.
 const mockUserProfile = { id: 'test-user', name: 'Test User', email: 'test@example.com', avatar_url: '' }
 vi.mock('@/context/app-context', () => ({
-  useSelector: (selector: (state: { userProfile: typeof mockUserProfile }) => unknown) =>
-    selector({ userProfile: mockUserProfile }),
+  useSelector: (selector: (state: { userProfile: typeof mockUserProfile, workspacePermissionKeys: string[] }) => unknown) =>
+    selector({
+      userProfile: mockUserProfile,
+      workspacePermissionKeys: ['credential.manage', 'credential.use'],
+    }),
 }))
 
 // ==================== Test Utilities ====================
@@ -86,8 +89,7 @@ describe('Item Component', () => {
         />,
       )
 
-      const svgs = container.querySelectorAll('svg')
-      expect(svgs.length).toBeGreaterThan(0)
+      expect(container.querySelector('.i-ri-check-line')).toBeInTheDocument()
     })
 
     it('should not render selected icon when credential is not selected', () => {
@@ -100,7 +102,8 @@ describe('Item Component', () => {
           selectedCredentialId="sel-id"
         />,
       )
-      const selectedSvgCount = selectedContainer.querySelectorAll('svg').length
+      const selectedIcon = selectedContainer.querySelector('.i-ri-check-line')
+      expect(selectedIcon).not.toBeNull()
 
       cleanup()
 
@@ -111,9 +114,9 @@ describe('Item Component', () => {
           selectedCredentialId="other-id"
         />,
       )
-      const unselectedSvgCount = unselectedContainer.querySelectorAll('svg').length
+      const unselectedIcon = unselectedContainer.querySelector('.i-ri-check-line')
 
-      expect(unselectedSvgCount).toBeLessThan(selectedSvgCount)
+      expect(unselectedIcon).not.toBeInTheDocument()
     })
 
     it('should render with disabled appearance when not_allowed_to_use is true', () => {
@@ -351,7 +354,7 @@ describe('Item Component', () => {
         />,
       )
 
-      const editButton = container.querySelector('svg')?.closest('button') as HTMLElement
+      const editButton = container.querySelector('.i-ri-equalizer-2-line')?.closest('button') as HTMLElement
       fireEvent.click(editButton)
       expect(onEdit).toHaveBeenCalledWith('edit-test-id', {
         api_key: 'secret',
@@ -415,7 +418,7 @@ describe('Item Component', () => {
         />,
       )
 
-      const deleteButton = container.querySelector('svg')?.closest('button') as HTMLElement
+      const deleteButton = container.querySelector('.i-ri-delete-bin-line')?.closest('button') as HTMLElement
       fireEvent.click(deleteButton)
       expect(onDelete).toHaveBeenCalledWith('delete-test-id')
     })
@@ -532,7 +535,7 @@ describe('Item Component', () => {
         />,
       )
 
-      const deleteButton = container.querySelector('svg')?.closest('button') as HTMLElement
+      const deleteButton = container.querySelector('.i-ri-delete-bin-line')?.closest('button') as HTMLElement
       fireEvent.click(deleteButton)
       expect(onDelete).toHaveBeenCalled()
     })
diff --git a/web/app/components/plugins/plugin-auth/authorized/index.tsx b/web/app/components/plugins/plugin-auth/authorized/index.tsx
index be69685755f..7a72e36a4fa 100644
--- a/web/app/components/plugins/plugin-auth/authorized/index.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/index.tsx
@@ -27,6 +27,7 @@ import {
   useState,
 } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import Authorize from '../authorize'
 import ApiKeyModal from '../authorize/api-key-modal'
 import {
@@ -42,7 +43,6 @@ type AuthorizedProps = {
   credentials: Credential[]
   canOAuth?: boolean
   canApiKey?: boolean
-  disabled?: boolean
   renderTrigger?: (open?: boolean) => React.ReactNode
   isOpen?: boolean
   onOpenChange?: (open: boolean) => void
@@ -63,7 +63,6 @@ const Authorized = ({
   credentials,
   canOAuth,
   canApiKey,
-  disabled,
   renderTrigger,
   isOpen,
   onOpenChange,
@@ -80,6 +79,7 @@ const Authorized = ({
   notAllowCustomCredential,
 }: AuthorizedProps) => {
   const { t } = useTranslation()
+  const { canUseCredential, canManageCredential } = useCredentialPermissions()
   const [isLocalOpen, setIsLocalOpen] = useState(false)
   const mergedIsOpen = isOpen ?? isLocalOpen
   const setMergedIsOpen = useCallback((open: boolean) => {
@@ -94,12 +94,15 @@ const Authorized = ({
   const [deleteCredentialId, setDeleteCredentialId] = useState<string | null>(null)
   const { mutateAsync: deletePluginCredential } = useDeletePluginCredentialHook(pluginPayload)
   const openConfirm = useCallback((credentialId?: string) => {
+    if (!canManageCredential)
+      return
+
     setMergedIsOpen(false)
     if (credentialId)
       pendingOperationCredentialIdRef.current = credentialId
 
     setDeleteCredentialId(pendingOperationCredentialIdRef.current)
-  }, [setMergedIsOpen])
+  }, [canManageCredential, setMergedIsOpen])
   const closeConfirm = useCallback(() => {
     setDeleteCredentialId(null)
     pendingOperationCredentialIdRef.current = null
@@ -111,7 +114,7 @@ const Authorized = ({
     setDoingAction(doing)
   }, [])
   const handleConfirm = useCallback(async () => {
-    if (doingActionRef.current)
+    if (doingActionRef.current || !canManageCredential)
       return
     if (!pendingOperationCredentialIdRef.current) {
       setDeleteCredentialId(null)
@@ -128,15 +131,18 @@ const Authorized = ({
     finally {
       handleSetDoingAction(false)
     }
-  }, [deletePluginCredential, onUpdate, t, handleSetDoingAction])
+  }, [canManageCredential, deletePluginCredential, onUpdate, t, handleSetDoingAction])
   const [editValues, setEditValues] = useState<Record<string, unknown> | null>(null)
   const [isApiKeyModalOpen, setIsApiKeyModalOpen] = useState(false)
   const handleEdit = useCallback((id: string, values: Record<string, unknown>) => {
+    if (!canManageCredential)
+      return
+
     setMergedIsOpen(false)
     pendingOperationCredentialIdRef.current = id
     setEditValues(values)
     setIsApiKeyModalOpen(true)
-  }, [setMergedIsOpen])
+  }, [canManageCredential, setMergedIsOpen])
   const handleApiKeyModalOpenChange = useCallback((open: boolean) => {
     setIsApiKeyModalOpen(open)
     if (!open)
@@ -146,15 +152,21 @@ const Authorized = ({
   // popover closes due to outside-click detection on the modal's portal.
   const [isAddApiKeyOpen, setIsAddApiKeyOpen] = useState(false)
   const handleAddApiKeyClick = useCallback(() => {
+    if (!canManageCredential)
+      return
+
     setMergedIsOpen(false)
     setIsAddApiKeyOpen(true)
-  }, [setMergedIsOpen])
+  }, [canManageCredential, setMergedIsOpen])
   const handleRemove = useCallback(() => {
+    if (!canManageCredential)
+      return
+
     setDeleteCredentialId(pendingOperationCredentialIdRef.current)
-  }, [])
+  }, [canManageCredential])
   const { mutateAsync: setPluginDefaultCredential } = useSetPluginDefaultCredentialHook(pluginPayload)
   const handleSetDefault = useCallback(async (id: string) => {
-    if (doingActionRef.current)
+    if (doingActionRef.current || !canUseCredential)
       return
     try {
       handleSetDoingAction(true)
@@ -165,13 +177,13 @@ const Authorized = ({
     finally {
       handleSetDoingAction(false)
     }
-  }, [setPluginDefaultCredential, onUpdate, t, handleSetDoingAction])
+  }, [canUseCredential, setPluginDefaultCredential, onUpdate, t, handleSetDoingAction])
   const { mutateAsync: updatePluginCredential } = useUpdatePluginCredentialHook(pluginPayload)
   const handleRename = useCallback(async (payload: {
     credential_id: string
     name: string
   }) => {
-    if (doingActionRef.current)
+    if (doingActionRef.current || !canManageCredential)
       return
     try {
       handleSetDoingAction(true)
@@ -182,7 +194,7 @@ const Authorized = ({
     finally {
       handleSetDoingAction(false)
     }
-  }, [updatePluginCredential, t, handleSetDoingAction, onUpdate])
+  }, [canManageCredential, updatePluginCredential, t, handleSetDoingAction, onUpdate])
   const unavailableCredentials = credentials.filter(credential => credential.not_allowed_to_use)
   const unavailableCredential = credentials.find(credential => credential.not_allowed_to_use && credential.is_default)
   const resolvedOffset = typeof offset === 'number' || typeof offset === 'function' ? undefined : offset
@@ -252,7 +264,6 @@ const Authorized = ({
                         <Item
                           key={credential.id}
                           credential={credential}
-                          disabled={disabled}
                           onItemClick={onItemClick}
                           disableRename
                           disableEdit
@@ -281,7 +292,6 @@ const Authorized = ({
                         <Item
                           key={credential.id}
                           credential={credential}
-                          disabled={disabled}
                           disableEdit
                           onDelete={openConfirm}
                           onSetDefault={handleSetDefault}
@@ -311,7 +321,6 @@ const Authorized = ({
                         <Item
                           key={credential.id}
                           credential={credential}
-                          disabled={disabled}
                           onDelete={openConfirm}
                           onEdit={handleEdit}
                           onSetDefault={handleSetDefault}
@@ -339,7 +348,6 @@ const Authorized = ({
                       showDivider={false}
                       canOAuth={canOAuth}
                       canApiKey={canApiKey}
-                      disabled={disabled}
                       onUpdate={onUpdate}
                       onApiKeyClick={handleAddApiKeyClick}
                     />
@@ -359,7 +367,7 @@ const Authorized = ({
           </div>
           <AlertDialogActions>
             <AlertDialogCancelButton>{t('operation.cancel', { ns: 'common' })}</AlertDialogCancelButton>
-            <AlertDialogConfirmButton disabled={doingAction} onClick={handleConfirm}>
+            <AlertDialogConfirmButton disabled={!canManageCredential || doingAction} onClick={handleConfirm}>
               {t('operation.confirm', { ns: 'common' })}
             </AlertDialogConfirmButton>
           </AlertDialogActions>
@@ -374,7 +382,7 @@ const Authorized = ({
             editValues={editValues}
             onClose={() => handleApiKeyModalOpenChange(false)}
             onRemove={handleRemove}
-            disabled={disabled || doingAction}
+            disabled={!canManageCredential || doingAction}
             onUpdate={onUpdate}
           />
         )
@@ -386,7 +394,7 @@ const Authorized = ({
             onOpenChange={setIsAddApiKeyOpen}
             pluginPayload={pluginPayload}
             onClose={() => setIsAddApiKeyOpen(false)}
-            disabled={disabled || doingAction}
+            disabled={!canManageCredential || doingAction}
             onUpdate={onUpdate}
           />
         )
diff --git a/web/app/components/plugins/plugin-auth/authorized/item.tsx b/web/app/components/plugins/plugin-auth/authorized/item.tsx
index 5d91c34e8e1..88edd05b6b8 100644
--- a/web/app/components/plugins/plugin-auth/authorized/item.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/item.tsx
@@ -4,10 +4,6 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import {
-  RiCheckLine,
-  RiDeleteBinLine,
-  RiEditLine,
-  RiEqualizer2Line,
   RiInformationLine,
 } from '@remixicon/react'
 import {
@@ -20,11 +16,11 @@ import ActionButton from '@/app/components/base/action-button'
 import Badge from '@/app/components/base/badge'
 import Input from '@/app/components/base/input'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
 import { CredentialTypeEnum } from '../types'
 
 type ItemProps = {
   credential: Credential
-  disabled?: boolean
   onDelete?: (id: string) => void
   onEdit?: (id: string, values: Record<string, unknown>) => void
   onSetDefault?: (id: string) => void
@@ -39,10 +35,10 @@ type ItemProps = {
   onItemClick?: (id: string) => void
   showSelectedIcon?: boolean
   selectedCredentialId?: string
+  disabled?: boolean
 }
 const Item = ({
   credential,
-  disabled,
   onDelete,
   onEdit,
   onSetDefault,
@@ -54,10 +50,14 @@ const Item = ({
   onItemClick,
   showSelectedIcon,
   selectedCredentialId,
+  disabled,
 }: ItemProps) => {
   const { t } = useTranslation()
   const [renaming, setRenaming] = useState(false)
   const [renameValue, setRenameValue] = useState(credential.name)
+  const workspacePermissionKeys = useAppContextWithSelector(s => s.workspacePermissionKeys)
+  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
   const isOAuth = credential.credential_type === CredentialTypeEnum.OAUTH2
   const isPersonal = credential.visibility === 'only_me'
   const userProfile = useAppContextWithSelector(state => state.userProfile)
@@ -81,10 +81,10 @@ const Item = ({
       className={cn(
         'group flex h-8 items-center rounded-lg p-1 hover:bg-state-base-hover',
         renaming && 'bg-state-base-hover',
-        (disabled || credential.not_allowed_to_use) && 'cursor-not-allowed opacity-50',
+        (disabled || !canUseCredential || credential.not_allowed_to_use) && 'cursor-not-allowed opacity-50',
       )}
       onClick={() => {
-        if (credential.not_allowed_to_use || disabled)
+        if (disabled || credential.not_allowed_to_use || !canUseCredential)
           return
         onItemClick?.(credential.id === '__workspace_default__' ? '' : credential.id)
       }}
@@ -134,7 +134,7 @@ const Item = ({
                 <div className="size-4">
                   {
                     selectedCredentialId === credential.id && (
-                      <RiCheckLine className="size-4 text-text-accent" />
+                      <span className="i-ri-check-line size-4 text-text-accent" />
                     )
                   }
                 </div>
@@ -190,7 +190,7 @@ const Item = ({
               !credential.is_default && !disableSetDefault && !credential.not_allowed_to_use && !isBorrowed && (
                 <Button
                   size="small"
-                  disabled={disabled}
+                  disabled={disabled || !canUseCredential}
                   onClick={(e) => {
                     e.stopPropagation()
                     onSetDefault?.(credential.id)
@@ -206,14 +206,14 @@ const Item = ({
                   <TooltipTrigger
                     render={(
                       <ActionButton
-                        disabled={disabled}
+                        disabled={disabled || !canManageCredential}
                         onClick={(e) => {
                           e.stopPropagation()
                           setRenaming(true)
                           setRenameValue(credential.name)
                         }}
                       >
-                        <RiEditLine className="size-4 text-text-tertiary" />
+                        <span className="i-ri-edit-line size-4 text-text-tertiary" />
                       </ActionButton>
                     )}
                   />
@@ -229,7 +229,7 @@ const Item = ({
                   <TooltipTrigger
                     render={(
                       <ActionButton
-                        disabled={disabled}
+                        disabled={disabled || !canManageCredential}
                         onClick={(e) => {
                           e.stopPropagation()
                           onEdit?.(
@@ -242,7 +242,7 @@ const Item = ({
                           )
                         }}
                       >
-                        <RiEqualizer2Line className="size-4 text-text-tertiary" />
+                        <span className="i-ri-equalizer-2-line size-4 text-text-tertiary" />
                       </ActionButton>
                     )}
                   />
@@ -259,13 +259,13 @@ const Item = ({
                     render={(
                       <ActionButton
                         className="hover:bg-transparent"
-                        disabled={disabled}
+                        disabled={disabled || !canManageCredential}
                         onClick={(e) => {
                           e.stopPropagation()
                           onDelete?.(credential.id)
                         }}
                       >
-                        <RiDeleteBinLine className="size-4 text-text-tertiary hover:text-text-destructive" />
+                        <span className="i-ri-delete-bin-line size-4 text-text-tertiary hover:text-text-destructive" />
                       </ActionButton>
                     )}
                   />
diff --git a/web/app/components/plugins/plugin-auth/hooks/__tests__/use-plugin-auth.spec.ts b/web/app/components/plugins/plugin-auth/hooks/__tests__/use-plugin-auth.spec.ts
index 2903eb8c341..11a7e602d38 100644
--- a/web/app/components/plugins/plugin-auth/hooks/__tests__/use-plugin-auth.spec.ts
+++ b/web/app/components/plugins/plugin-auth/hooks/__tests__/use-plugin-auth.spec.ts
@@ -25,12 +25,6 @@ vi.mock('../use-credential', () => ({
   useInvalidPluginCredentialInfoHook: () => mockInvalidate,
 }))
 
-vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: true,
-  }),
-}))
-
 const basePayload = {
   category: AuthCategory.tool,
   provider: 'test-provider',
@@ -55,12 +49,6 @@ describe('usePluginAuth', () => {
     expect(result.current.canApiKey).toBe(true)
   })
 
-  it('should return disabled=false for workspace managers', () => {
-    const { result } = renderHook(() => usePluginAuth(basePayload, true))
-
-    expect(result.current.disabled).toBe(false)
-  })
-
   it('should return notAllowCustomCredential=false when allowed', () => {
     const { result } = renderHook(() => usePluginAuth(basePayload, true))
 
diff --git a/web/app/components/plugins/plugin-auth/hooks/use-plugin-auth.ts b/web/app/components/plugins/plugin-auth/hooks/use-plugin-auth.ts
index a06d3470828..e38fb021a3f 100644
--- a/web/app/components/plugins/plugin-auth/hooks/use-plugin-auth.ts
+++ b/web/app/components/plugins/plugin-auth/hooks/use-plugin-auth.ts
@@ -1,5 +1,4 @@
 import type { PluginPayload } from '../types'
-import { useAppContext } from '@/context/app-context'
 import { CredentialTypeEnum } from '../types'
 import {
   useGetPluginCredentialInfoHook,
@@ -12,7 +11,6 @@ export const usePluginAuth = (
   includeCredentialIds?: string[],
 ) => {
   const { data } = useGetPluginCredentialInfoHook(pluginPayload, enable, includeCredentialIds)
-  const { isCurrentWorkspaceManager } = useAppContext()
   const isAuthorized = !!data?.credentials.length
   const canOAuth = data?.supported_credential_types.includes(CredentialTypeEnum.OAUTH2)
   const canApiKey = data?.supported_credential_types.includes(CredentialTypeEnum.API_KEY)
@@ -23,7 +21,6 @@ export const usePluginAuth = (
     canOAuth,
     canApiKey,
     credentials: data?.credentials || [],
-    disabled: !isCurrentWorkspaceManager,
     notAllowCustomCredential: data?.allow_custom_token === false,
     invalidPluginCredentialInfo,
   }
diff --git a/web/app/components/plugins/plugin-auth/plugin-auth-in-agent.tsx b/web/app/components/plugins/plugin-auth/plugin-auth-in-agent.tsx
index fea94915df1..efd2cf00905 100644
--- a/web/app/components/plugins/plugin-auth/plugin-auth-in-agent.tsx
+++ b/web/app/components/plugins/plugin-auth/plugin-auth-in-agent.tsx
@@ -34,7 +34,6 @@ const PluginAuthInAgent = ({
     canOAuth,
     canApiKey,
     credentials,
-    disabled,
     invalidPluginCredentialInfo,
     notAllowCustomCredential,
   } = usePluginAuth(pluginPayload, true, credentialId ? [credentialId] : undefined)
@@ -104,7 +103,6 @@ const PluginAuthInAgent = ({
             pluginPayload={pluginPayload}
             canOAuth={canOAuth}
             canApiKey={canApiKey}
-            disabled={disabled}
             onUpdate={invalidPluginCredentialInfo}
             notAllowCustomCredential={notAllowCustomCredential}
           />
@@ -117,7 +115,6 @@ const PluginAuthInAgent = ({
             credentials={credentials}
             canOAuth={canOAuth}
             canApiKey={canApiKey}
-            disabled={disabled}
             disableSetDefault
             onItemClick={handleAuthorizationItemClick}
             extraAuthorizationItems={extraAuthorizationItems}
diff --git a/web/app/components/plugins/plugin-auth/plugin-auth.tsx b/web/app/components/plugins/plugin-auth/plugin-auth.tsx
index c0d9fe54080..9017008fdae 100644
--- a/web/app/components/plugins/plugin-auth/plugin-auth.tsx
+++ b/web/app/components/plugins/plugin-auth/plugin-auth.tsx
@@ -26,12 +26,10 @@ const PluginAuth = ({
     canOAuth,
     canApiKey,
     credentials,
-    disabled,
     invalidPluginCredentialInfo,
     notAllowCustomCredential,
   } = usePluginAuth(pluginPayload, !!pluginPayload.provider)
   const showPermissionHint = !isAuthorized
-    && disabled
     && !notAllowCustomCredential
     && pluginPayload.category === AuthCategory.tool
     && (canOAuth || canApiKey)
@@ -40,7 +38,6 @@ const PluginAuth = ({
       pluginPayload={pluginPayload}
       canOAuth={canOAuth}
       canApiKey={canApiKey}
-      disabled={disabled}
       onUpdate={invalidPluginCredentialInfo}
       notAllowCustomCredential={notAllowCustomCredential}
     />
@@ -88,7 +85,6 @@ const PluginAuth = ({
             credentials={credentials}
             canOAuth={canOAuth}
             canApiKey={canApiKey}
-            disabled={disabled}
             onUpdate={invalidPluginCredentialInfo}
             notAllowCustomCredential={notAllowCustomCredential}
           />
diff --git a/web/app/components/plugins/plugin-detail-panel/__tests__/detail-header.spec.tsx b/web/app/components/plugins/plugin-detail-panel/__tests__/detail-header.spec.tsx
index 1a74ca1ccc3..05c9d4bdc6f 100644
--- a/web/app/components/plugins/plugin-detail-panel/__tests__/detail-header.spec.tsx
+++ b/web/app/components/plugins/plugin-detail-panel/__tests__/detail-header.spec.tsx
@@ -158,6 +158,7 @@ let mockAutoUpgradeInfo: {
 vi.mock('../../plugin-page/use-reference-setting', () => ({
   default: () => ({
     referenceSetting: mockAutoUpgradeInfo ? { auto_upgrade: mockAutoUpgradeInfo } : null,
+    canUpdate: true,
   }),
 }))
 
diff --git a/web/app/components/plugins/plugin-detail-panel/detail-header/__tests__/index.spec.tsx b/web/app/components/plugins/plugin-detail-panel/detail-header/__tests__/index.spec.tsx
index 278555c0bf6..e809573a7ce 100644
--- a/web/app/components/plugins/plugin-detail-panel/detail-header/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/plugin-detail-panel/detail-header/__tests__/index.spec.tsx
@@ -131,6 +131,7 @@ vi.mock('@/app/components/plugins/plugin-page/use-reference-setting', () => ({
         upgrade_time_of_day: 0,
       },
     },
+    canUpdate: true,
   }),
 }))
 
diff --git a/web/app/components/plugins/plugin-detail-panel/detail-header/hooks/use-plugin-operations.ts b/web/app/components/plugins/plugin-detail-panel/detail-header/hooks/use-plugin-operations.ts
index 2931c4e7051..57ed30fe15d 100644
--- a/web/app/components/plugins/plugin-detail-panel/detail-header/hooks/use-plugin-operations.ts
+++ b/web/app/components/plugins/plugin-detail-panel/detail-header/hooks/use-plugin-operations.ts
@@ -14,6 +14,8 @@ import { checkForUpdates, fetchReleases } from '../../../install-plugin/hooks'
 import { PluginSource } from '../../../types'
 
 type UsePluginOperationsParams = {
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
   detail: PluginDetail
   modalStates: ModalStates
   versionPicker: {
@@ -31,6 +33,8 @@ type UsePluginOperationsReturn = {
 }
 
 export const usePluginOperations = ({
+  canManagePlugin = true,
+  canUpdatePlugin = true,
   detail,
   modalStates,
   versionPicker,
@@ -50,6 +54,9 @@ export const usePluginOperations = ({
   }, [invalidateCheckInstalled, onUpdate])
 
   const handleUpdate = useCallback(async (isDowngrade?: boolean) => {
+    if (!canUpdatePlugin)
+      return
+
     if (isFromMarketplace) {
       versionPicker.setIsDowngrade(!!isDowngrade)
       modalStates.showUpdateModal()
@@ -91,6 +98,7 @@ export const usePluginOperations = ({
       })
     }
   }, [
+    canUpdatePlugin,
     isFromMarketplace,
     meta,
     author,
@@ -110,6 +118,9 @@ export const usePluginOperations = ({
   }, [handlePluginUpdated, modalStates])
 
   const handleDelete = useCallback(async () => {
+    if (!canManagePlugin)
+      return
+
     modalStates.showDeleting()
     const res = await uninstallPlugin(id)
     modalStates.hideDeleting()
@@ -123,6 +134,7 @@ export const usePluginOperations = ({
       trackEvent('plugin_uninstalled', { plugin_id, plugin_name: name })
     }
   }, [
+    canManagePlugin,
     id,
     category,
     plugin_id,
diff --git a/web/app/components/plugins/plugin-detail-panel/detail-header/index.tsx b/web/app/components/plugins/plugin-detail-panel/detail-header/index.tsx
index d9e16052acd..64f8ee94038 100644
--- a/web/app/components/plugins/plugin-detail-panel/detail-header/index.tsx
+++ b/web/app/components/plugins/plugin-detail-panel/detail-header/index.tsx
@@ -34,6 +34,8 @@ import { HeaderModals, PluginSourceBadge } from './components'
 import { useDetailHeaderState, usePluginOperations } from './hooks'
 
 type Props = Readonly<{
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
   detail: PluginDetail
   isReadmeView?: boolean
   onHide?: () => void
@@ -69,6 +71,8 @@ const getDetailUrl = (
 }
 
 const DetailHeader = ({
+  canManagePlugin = true,
+  canUpdatePlugin = true,
   detail,
   isReadmeView = false,
   onHide,
@@ -119,6 +123,8 @@ const DetailHeader = ({
     modalStates,
     versionPicker,
     isFromMarketplace,
+    canManagePlugin,
+    canUpdatePlugin,
     onUpdate,
   })
 
@@ -174,7 +180,7 @@ const DetailHeader = ({
             {/* Version Picker */}
             {!!version && (
               <PluginVersionPicker
-                disabled={!isFromMarketplace || isReadmeView}
+                disabled={!canUpdatePlugin || !isFromMarketplace || isReadmeView}
                 isShow={versionPicker.isShow}
                 onShowChange={versionPicker.setIsShow}
                 pluginID={plugin_id}
@@ -185,13 +191,13 @@ const DetailHeader = ({
                     className={cn(
                       'mx-1',
                       versionPicker.isShow && 'bg-state-base-hover',
-                      (versionPicker.isShow || isFromMarketplace) && 'hover:bg-state-base-hover',
+                      (versionPicker.isShow || (canUpdatePlugin && isFromMarketplace)) && 'hover:bg-state-base-hover',
                     )}
                     uppercase={false}
                     text={(
                       <>
                         <div>{isFromGitHub ? (meta?.version ?? version ?? '') : version}</div>
-                        {isFromMarketplace && !isReadmeView && <span aria-hidden className="ml-1 i-ri-arrow-left-right-line size-3 text-text-tertiary" />}
+                        {canUpdatePlugin && isFromMarketplace && !isReadmeView && <span aria-hidden className="ml-1 i-ri-arrow-left-right-line size-3 text-text-tertiary" />}
                       </>
                     )}
                     hasRedCornerMark={hasNewVersion}
@@ -219,7 +225,7 @@ const DetailHeader = ({
             )}
 
             {/* Update Button */}
-            {(hasNewVersion || isFromGitHub) && (
+            {canUpdatePlugin && (hasNewVersion || isFromGitHub) && (
               <Tooltip>
                 <TooltipTrigger
                   delay={300}
@@ -264,6 +270,8 @@ const DetailHeader = ({
               onRemove={modalStates.showDeleteConfirm}
               onViewReadme={canViewReadme ? handleViewReadme : undefined}
               detailUrl={detailUrl}
+              showCheckVersion={canUpdatePlugin}
+              showRemove={canManagePlugin}
             />
             <ActionButton onClick={onHide}>
               <span aria-hidden className="i-ri-close-line size-4" />
diff --git a/web/app/components/plugins/plugin-detail-panel/index.tsx b/web/app/components/plugins/plugin-detail-panel/index.tsx
index b8571b11d73..f72e251a224 100644
--- a/web/app/components/plugins/plugin-detail-panel/index.tsx
+++ b/web/app/components/plugins/plugin-detail-panel/index.tsx
@@ -24,12 +24,16 @@ import { SubscriptionList } from './subscription-list'
 import { TriggerEventsList } from './trigger/event-list'
 
 type Props = Readonly<{
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
   detail?: PluginDetail
   onUpdate: () => void
   onHide: () => void
 }>
 
 const PluginDetailPanel: FC<Props> = ({
+  canManagePlugin = true,
+  canUpdatePlugin = true,
   detail,
   onUpdate,
   onHide,
@@ -75,7 +79,13 @@ const PluginDetailPanel: FC<Props> = ({
             <DrawerContent className="flex min-h-0 flex-1 flex-col p-0 pb-0">
               {detail && (
                 <>
-                  <DetailHeader detail={detail} onUpdate={handleUpdate} onHide={onHide} />
+                  <DetailHeader
+                    detail={detail}
+                    onUpdate={handleUpdate}
+                    onHide={onHide}
+                    canManagePlugin={canManagePlugin}
+                    canUpdatePlugin={canUpdatePlugin}
+                  />
                   <div className="grow overflow-y-auto">
                     <div className="flex min-h-full flex-col">
                       <div className="flex-1">
diff --git a/web/app/components/plugins/plugin-detail-panel/operation-dropdown.tsx b/web/app/components/plugins/plugin-detail-panel/operation-dropdown.tsx
index b1b85155e58..a18807b0bb9 100644
--- a/web/app/components/plugins/plugin-detail-panel/operation-dropdown.tsx
+++ b/web/app/components/plugins/plugin-detail-panel/operation-dropdown.tsx
@@ -28,6 +28,8 @@ type Props = Readonly<{
   popupClassName?: string
   triggerSize?: 'm' | 'xs'
   destructiveRemove?: boolean
+  showCheckVersion?: boolean
+  showRemove?: boolean
 }>
 
 const operationMenuPopupClassName = 'w-[192px] py-1'
@@ -47,12 +49,22 @@ const OperationDropdown: FC<Props> = ({
   popupClassName,
   triggerSize = 'm',
   destructiveRemove = false,
+  showCheckVersion = true,
+  showRemove = true,
 }) => {
   const { t } = useTranslation()
   const { data: enable_marketplace } = useSuspenseQuery({
     ...systemFeaturesQueryOptions(),
     select: s => s.enable_marketplace,
   })
+  const showInfo = source === PluginSource.github
+  const showCheckVersionAction = showCheckVersion && source === PluginSource.github
+  const showMarketplaceDetail = (source === PluginSource.marketplace || source === PluginSource.github) && enable_marketplace
+  const showRemoveAction = showRemove
+  const showSeparator = showRemoveAction && (showMarketplaceDetail || !!onViewReadme)
+
+  if (!showInfo && !showCheckVersionAction && !showMarketplaceDetail && !onViewReadme && !showRemoveAction)
+    return null
 
   return (
     <DropdownMenu>
@@ -67,18 +79,28 @@ const OperationDropdown: FC<Props> = ({
         alignOffset={alignOffset}
         popupClassName={cn(operationMenuPopupClassName, popupClassName)}
       >
-        {source === PluginSource.github && (
+        {showInfo && (
           <DropdownMenuItem className={operationMenuItemClassName} onClick={onInfo}>
             <span className={operationMenuLabelClassName}>{t('detailPanel.operation.info', { ns: 'plugin' })}</span>
           </DropdownMenuItem>
         )}
-        {source === PluginSource.github && (
+        {showCheckVersionAction && (
           <DropdownMenuItem className={operationMenuItemClassName} onClick={onCheckVersion}>
             <span className={operationMenuLabelClassName}>{t('detailPanel.operation.checkUpdate', { ns: 'plugin' })}</span>
           </DropdownMenuItem>
         )}
-        {(source === PluginSource.marketplace || source === PluginSource.github) && enable_marketplace && (
-          <DropdownMenuItem className={operationMenuItemClassName} render={<a href={detailUrl} target="_blank" rel="noopener noreferrer" />}>
+        {showMarketplaceDetail && (
+          <DropdownMenuItem
+            className={operationMenuItemClassName}
+            render={(
+              <a
+                href={detailUrl}
+                target="_blank"
+                rel="noopener noreferrer"
+                aria-label={t('detailPanel.operation.viewDetail', { ns: 'plugin' })}
+              />
+            )}
+          >
             <span className={operationMenuLabelClassName}>{t('detailPanel.operation.viewDetail', { ns: 'plugin' })}</span>
             <span className="i-ri-arrow-right-up-line size-3.5 shrink-0 text-text-tertiary" />
           </DropdownMenuItem>
@@ -88,20 +110,22 @@ const OperationDropdown: FC<Props> = ({
             <span className={operationMenuLabelClassName}>{t('detailPanel.operation.viewReadme', { ns: 'plugin' })}</span>
           </DropdownMenuItem>
         )}
-        {(source === PluginSource.marketplace || source === PluginSource.github) && enable_marketplace && (
+        {showSeparator && (
           <DropdownMenuSeparator className="my-0" />
         )}
-        <DropdownMenuItem
-          className={cn(
-            operationMenuItemClassName,
-            destructiveRemove && 'data-highlighted:bg-state-destructive-hover data-highlighted:text-text-destructive',
-          )}
-          onClick={onRemove}
-        >
-          <span className={cn(operationMenuLabelClassName, destructiveRemove && 'text-inherit')}>
-            {t('detailPanel.operation.remove', { ns: 'plugin' })}
-          </span>
-        </DropdownMenuItem>
+        {showRemoveAction && (
+          <DropdownMenuItem
+            className={cn(
+              operationMenuItemClassName,
+              destructiveRemove && 'data-highlighted:bg-state-destructive-hover data-highlighted:text-text-destructive',
+            )}
+            onClick={onRemove}
+          >
+            <span className={cn(operationMenuLabelClassName, destructiveRemove && 'text-inherit')}>
+              {t('detailPanel.operation.remove', { ns: 'plugin' })}
+            </span>
+          </DropdownMenuItem>
+        )}
       </DropdownMenuContent>
     </DropdownMenu>
   )
diff --git a/web/app/components/plugins/plugin-detail-panel/tool-selector/__tests__/index.spec.tsx b/web/app/components/plugins/plugin-detail-panel/tool-selector/__tests__/index.spec.tsx
index f039ef11e75..4b1fee74415 100644
--- a/web/app/components/plugins/plugin-detail-panel/tool-selector/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/plugin-detail-panel/tool-selector/__tests__/index.spec.tsx
@@ -192,6 +192,26 @@ vi.mock('@langgenius/dify-ui/popover', () => ({
         : children}
     </div>
   ),
+  PortalToFollowElemTrigger: ({
+    children,
+    render,
+    onClick,
+  }: {
+    children: ReactNode
+    render?: ReactNode
+    onClick?: () => void
+  }) => (
+    <div data-testid="popover-trigger" onClick={onClick}>
+      {render
+        ? (
+            <>
+              {render}
+              {children}
+            </>
+          )
+        : children}
+    </div>
+  ),
   PopoverContent: ({ children }: { children: ReactNode }) => (
     <div data-testid="popover-content">{children}</div>
   ),
diff --git a/web/app/components/plugins/plugin-detail-panel/tool-selector/components/tool-item.tsx b/web/app/components/plugins/plugin-detail-panel/tool-selector/components/tool-item.tsx
index 5711326b104..cda69fe1824 100644
--- a/web/app/components/plugins/plugin-detail-panel/tool-selector/components/tool-item.tsx
+++ b/web/app/components/plugins/plugin-detail-panel/tool-selector/components/tool-item.tsx
@@ -4,17 +4,11 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Switch } from '@langgenius/dify-ui/switch'
-import {
-  RiDeleteBinLine,
-  RiEqualizer2Line,
-  RiErrorWarningFill,
-} from '@remixicon/react'
 import * as React from 'react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import ActionButton from '@/app/components/base/action-button'
 import AppIcon from '@/app/components/base/app-icon'
-import { Group } from '@/app/components/base/icons/src/vender/other'
 import { InstallPluginButton } from '@/app/components/workflow/nodes/_base/components/install-plugin-button'
 import { useMCPToolAvailability } from '@/app/components/workflow/nodes/_base/components/mcp-tool-availability'
 import McpToolNotSupportTooltip from '@/app/components/workflow/nodes/_base/components/mcp-tool-not-support-tooltip'
@@ -89,7 +83,7 @@ const ToolItem = ({
         )}
         >
           <div className="flex size-5 items-center justify-center opacity-35">
-            <Group className="text-text-tertiary" />
+            <span className="i-custom-vender-other-group text-text-tertiary" />
           </div>
         </div>
       )}
@@ -100,7 +94,7 @@ const ToolItem = ({
       <div className="hidden items-center gap-1 group-hover:flex">
         {!noAuth && !isError && !uninstalled && !versionMismatch && !isShowCanNotChooseMCPTip && (
           <ActionButton>
-            <RiEqualizer2Line className="size-4" />
+            <span className="i-ri-equalizer-2-line size-4" />
           </ActionButton>
         )}
         <div
@@ -112,7 +106,7 @@ const ToolItem = ({
           onMouseOver={() => setIsDeleting(true)}
           onMouseLeave={() => setIsDeleting(false)}
         >
-          <RiDeleteBinLine className="size-4" />
+          <span className="i-ri-delete-bin-line size-4" />
         </div>
       </div>
       {!isError && !uninstalled && !noAuth && !versionMismatch && !isShowCanNotChooseMCPTip && showSwitch && (
@@ -143,7 +137,7 @@ const ToolItem = ({
             className="-mt-1"
             uniqueIdentifier={installInfo}
             tooltip={(
-              <div className="w-[180px]" data-testid="tooltip-content">
+              <div className="w-45" data-testid="tooltip-content">
                 <div className="mb-1.5 font-semibold text-text-secondary" data-testid="tooltip-content-title">
                   {t('detailPanel.toolSelector.unsupportedTitle', { ns: 'plugin' })}
                 </div>
@@ -175,7 +169,7 @@ const ToolItem = ({
             aria-label={typeof errorTip === 'string' ? errorTip : t('detailPanel.toolSelector.unsupportedTitle', { ns: 'plugin' })}
             className="inline-flex border-0 bg-transparent p-0"
           >
-            <RiErrorWarningFill className="size-4 text-text-destructive" />
+            <span className="i-ri-error-warning-fill size-4 text-text-destructive" />
           </PopoverTrigger>
           <PopoverContent popupClassName="px-3 py-2 system-xs-regular text-text-tertiary">
             {errorTip}
diff --git a/web/app/components/plugins/plugin-item/index.tsx b/web/app/components/plugins/plugin-item/index.tsx
index c1748f77f97..8db022b5d30 100644
--- a/web/app/components/plugins/plugin-item/index.tsx
+++ b/web/app/components/plugins/plugin-item/index.tsx
@@ -33,11 +33,15 @@ import { PluginSource } from '../types'
 import Action from './action'
 
 type Props = Readonly<{
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
   className?: string
   plugin: PluginDetail
 }>
 
 const PluginItem: FC<Props> = ({
+  canManagePlugin = true,
+  canUpdatePlugin = true,
   className,
   plugin,
 }) => {
@@ -152,9 +156,9 @@ const PluginItem: FC<Props> = ({
                   author={author}
                   pluginName={name}
                   usedInApps={5}
-                  isShowFetchNewVersion={source === PluginSource.github}
+                  isShowFetchNewVersion={canUpdatePlugin && source === PluginSource.github}
                   isShowInfo={source === PluginSource.github}
-                  isShowDelete
+                  isShowDelete={canManagePlugin}
                   meta={meta}
                   onDelete={handleDelete}
                   category={category}
diff --git a/web/app/components/plugins/plugin-page/__tests__/index.spec.tsx b/web/app/components/plugins/plugin-page/__tests__/index.spec.tsx
index a3b9c2266bf..3a74f455cb2 100644
--- a/web/app/components/plugins/plugin-page/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/plugin-page/__tests__/index.spec.tsx
@@ -42,6 +42,8 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceManager: true,
     isCurrentWorkspaceOwner: false,
+    langGeniusVersionInfo: { current_version: '1.0.0' },
+    workspacePermissionKeys: ['plugin.install', 'plugin.manage', 'plugin.debug', 'plugin.plugin_preferences'],
   }),
 }))
 
diff --git a/web/app/components/plugins/plugin-page/__tests__/plugins-panel.spec.tsx b/web/app/components/plugins/plugin-page/__tests__/plugins-panel.spec.tsx
index d30eab46e9e..f9bd4927969 100644
--- a/web/app/components/plugins/plugin-page/__tests__/plugins-panel.spec.tsx
+++ b/web/app/components/plugins/plugin-page/__tests__/plugins-panel.spec.tsx
@@ -275,7 +275,7 @@ describe('PluginsPanel', () => {
   it('loads the scoped plugin category list whenever an integrations category panel mounts', () => {
     render(<PluginsPanel contentInset="compact" fixedCategory={PluginCategoryEnum.trigger} />)
 
-    expect(mockUseInstalledPluginList).toHaveBeenCalledWith(undefined, 100, {
+    expect(mockUseInstalledPluginList).toHaveBeenCalledWith(false, 100, {
       category: PluginCategoryEnum.trigger,
       refetchOnMount: 'always',
     })
@@ -285,7 +285,7 @@ describe('PluginsPanel', () => {
     render(<PluginsPanel contentInset="compact" fixedCategory={PluginCategoryEnum.tool} />)
 
     expect(screen.getByTestId('filter-management')).toHaveAttribute('data-hide-tag-filter', 'false')
-    expect(mockUseInstalledPluginList).toHaveBeenCalledWith(undefined, 100, {
+    expect(mockUseInstalledPluginList).toHaveBeenCalledWith(false, 100, {
       category: PluginCategoryEnum.tool,
       refetchOnMount: 'always',
     })
diff --git a/web/app/components/plugins/plugin-page/__tests__/use-reference-setting.spec.ts b/web/app/components/plugins/plugin-page/__tests__/use-reference-setting.spec.ts
index 639cf411791..aec8390ec15 100644
--- a/web/app/components/plugins/plugin-page/__tests__/use-reference-setting.spec.ts
+++ b/web/app/components/plugins/plugin-page/__tests__/use-reference-setting.spec.ts
@@ -9,23 +9,15 @@ import { useInvalidateReferenceSettings, useMutationPluginPermissionSettings, us
 import { PermissionType, PluginCategoryEnum } from '../../types'
 import useReferenceSetting, { useCanInstallPluginFromMarketplace } from '../use-reference-setting'
 
-vi.mock('@/context/app-context', () => ({
-  useAppContext: vi.fn(),
-}))
+vi.mock('@/context/app-context', async () => {
+  const actual = await vi.importActual('@/context/app-context')
+  return {
+    ...actual,
+    useAppContext: vi.fn(),
+  }
+})
 
 vi.mock('@/service/use-plugins', () => ({
-  hasPluginPermission: vi.fn((permission: string | undefined, isAdmin: boolean) => {
-    if (!permission)
-      return false
-
-    if (permission === 'noone')
-      return false
-
-    if (permission === 'everyone')
-      return true
-
-    return isAdmin
-  }),
   usePluginAutoUpgradeSettings: vi.fn(),
   usePluginPermissionSettings: vi.fn(),
   useMutationPluginPermissionSettings: vi.fn(),
@@ -44,6 +36,8 @@ describe('useReferenceSetting Hook', () => {
     vi.mocked(useAppContext).mockReturnValue({
       isCurrentWorkspaceManager: false,
       isCurrentWorkspaceOwner: false,
+      langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+      workspacePermissionKeys: [] as string[],
     } as ReturnType<typeof useAppContext>)
 
     vi.mocked(usePluginAutoUpgradeSettings).mockReturnValue({
@@ -79,8 +73,8 @@ describe('useReferenceSetting Hook', () => {
     vi.mocked(useInvalidateReferenceSettings).mockReturnValue(vi.fn())
   })
 
-  describe('hasPermission logic', () => {
-    it('should return false when permission is undefined', () => {
+  describe('permission key access', () => {
+    it('should return false without plugin permission keys', () => {
       vi.mocked(usePluginPermissionSettings).mockReturnValue({
         data: {
           install_permission: undefined,
@@ -94,7 +88,7 @@ describe('useReferenceSetting Hook', () => {
       expect(result.current.canDebugger).toBe(false)
     })
 
-    it('should return false when permission is noOne', () => {
+    it('should ignore legacy noOne permission when plugin keys are missing', () => {
       vi.mocked(usePluginPermissionSettings).mockReturnValue({
         data: {
           install_permission: PermissionType.noOne,
@@ -108,7 +102,13 @@ describe('useReferenceSetting Hook', () => {
       expect(result.current.canDebugger).toBe(false)
     })
 
-    it('should return true when permission is everyone', () => {
+    it('should allow install and debug when plugin permission keys are present', () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceManager: false,
+        isCurrentWorkspaceOwner: false,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: ['plugin.install', 'plugin.debug'],
+      } as ReturnType<typeof useAppContext>)
       vi.mocked(usePluginPermissionSettings).mockReturnValue({
         data: {
           install_permission: PermissionType.everyone,
@@ -122,48 +122,12 @@ describe('useReferenceSetting Hook', () => {
       expect(result.current.canDebugger).toBe(true)
     })
 
-    it('should return isAdmin when permission is admin and user is manager', () => {
+    it('should ignore legacy admin permission for managers without plugin keys', () => {
       vi.mocked(useAppContext).mockReturnValue({
         isCurrentWorkspaceManager: true,
         isCurrentWorkspaceOwner: false,
-      } as ReturnType<typeof useAppContext>)
-
-      vi.mocked(usePluginPermissionSettings).mockReturnValue({
-        data: {
-          install_permission: PermissionType.admin,
-          debug_permission: PermissionType.admin,
-        },
-      } as ReturnType<typeof usePluginPermissionSettings>)
-
-      const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool))
-
-      expect(result.current.canManagement).toBe(true)
-      expect(result.current.canDebugger).toBe(true)
-    })
-
-    it('should return isAdmin when permission is admin and user is owner', () => {
-      vi.mocked(useAppContext).mockReturnValue({
-        isCurrentWorkspaceManager: false,
-        isCurrentWorkspaceOwner: true,
-      } as ReturnType<typeof useAppContext>)
-
-      vi.mocked(usePluginPermissionSettings).mockReturnValue({
-        data: {
-          install_permission: PermissionType.admin,
-          debug_permission: PermissionType.admin,
-        },
-      } as ReturnType<typeof usePluginPermissionSettings>)
-
-      const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool))
-
-      expect(result.current.canManagement).toBe(true)
-      expect(result.current.canDebugger).toBe(true)
-    })
-
-    it('should return false when permission is admin and user is not admin', () => {
-      vi.mocked(useAppContext).mockReturnValue({
-        isCurrentWorkspaceManager: false,
-        isCurrentWorkspaceOwner: false,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: [] as string[],
       } as ReturnType<typeof useAppContext>)
 
       vi.mocked(usePluginPermissionSettings).mockReturnValue({
@@ -178,24 +142,57 @@ describe('useReferenceSetting Hook', () => {
       expect(result.current.canManagement).toBe(false)
       expect(result.current.canDebugger).toBe(false)
     })
-  })
 
-  describe('canSetPermissions', () => {
-    it('should be true when user is workspace manager', () => {
-      vi.mocked(useAppContext).mockReturnValue({
-        isCurrentWorkspaceManager: true,
-        isCurrentWorkspaceOwner: false,
-      } as ReturnType<typeof useAppContext>)
-
-      const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool))
-
-      expect(result.current.canSetPermissions).toBe(true)
-    })
-
-    it('should be true when user is workspace owner', () => {
+    it('should ignore legacy admin permission for owners without plugin keys', () => {
       vi.mocked(useAppContext).mockReturnValue({
         isCurrentWorkspaceManager: false,
         isCurrentWorkspaceOwner: true,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: [] as string[],
+      } as ReturnType<typeof useAppContext>)
+
+      vi.mocked(usePluginPermissionSettings).mockReturnValue({
+        data: {
+          install_permission: PermissionType.admin,
+          debug_permission: PermissionType.admin,
+        },
+      } as ReturnType<typeof usePluginPermissionSettings>)
+
+      const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool))
+
+      expect(result.current.canManagement).toBe(false)
+      expect(result.current.canDebugger).toBe(false)
+    })
+
+    it('should use plugin keys even when legacy admin permission is configured', () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceManager: false,
+        isCurrentWorkspaceOwner: false,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: ['plugin.install', 'plugin.debug'],
+      } as ReturnType<typeof useAppContext>)
+
+      vi.mocked(usePluginPermissionSettings).mockReturnValue({
+        data: {
+          install_permission: PermissionType.admin,
+          debug_permission: PermissionType.admin,
+        },
+      } as ReturnType<typeof usePluginPermissionSettings>)
+
+      const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool))
+
+      expect(result.current.canManagement).toBe(true)
+      expect(result.current.canDebugger).toBe(true)
+    })
+  })
+
+  describe('canSetPermissions', () => {
+    it('should be true with plugin preferences permission when RBAC is disabled', () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceManager: false,
+        isCurrentWorkspaceOwner: false,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: ['plugin.plugin_preferences'],
       } as ReturnType<typeof useAppContext>)
 
       const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool))
@@ -203,10 +200,28 @@ describe('useReferenceSetting Hook', () => {
       expect(result.current.canSetPermissions).toBe(true)
     })
 
-    it('should be false when user is neither manager nor owner', () => {
+    it('should be false when RBAC is enabled even with plugin preferences permission', () => {
       vi.mocked(useAppContext).mockReturnValue({
         isCurrentWorkspaceManager: false,
+        isCurrentWorkspaceOwner: true,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: ['plugin.plugin_preferences'],
+      } as ReturnType<typeof useAppContext>)
+
+      const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool), {
+        systemFeatures: { rbac_enabled: true },
+      })
+
+      expect(result.current.canSetPermissions).toBe(false)
+      expect(result.current.canSetPluginPreferences).toBe(true)
+    })
+
+    it('should be false without plugin preferences permission', () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceManager: true,
         isCurrentWorkspaceOwner: false,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: [] as string[],
       } as ReturnType<typeof useAppContext>)
 
       const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool))
@@ -280,7 +295,13 @@ describe('useReferenceSetting Hook', () => {
       expect(result.current.isUpdatePending).toBe(true)
     })
 
-    it('should keep permissions available when reference setting data is still loading', () => {
+    it('should keep permission key access available when reference setting data is still loading', () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceManager: false,
+        isCurrentWorkspaceOwner: false,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: ['plugin.install', 'plugin.debug'],
+      } as ReturnType<typeof useAppContext>)
       vi.mocked(usePluginAutoUpgradeSettings).mockReturnValue({
         data: undefined,
       } as unknown as ReturnType<typeof usePluginAutoUpgradeSettings>)
@@ -292,6 +313,65 @@ describe('useReferenceSetting Hook', () => {
       expect(result.current.canDebugger).toBe(true)
     })
   })
+
+  describe('RBAC permissions', () => {
+    it('should use workspace permission keys when RBAC is enabled', () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceManager: false,
+        isCurrentWorkspaceOwner: false,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: [
+          'plugin.install',
+          'plugin.manage',
+          'plugin.debug',
+          'plugin.plugin_preferences',
+        ],
+      } as ReturnType<typeof useAppContext>)
+      vi.mocked(usePluginPermissionSettings).mockReturnValue({
+        data: {
+          install_permission: PermissionType.noOne,
+          debug_permission: PermissionType.noOne,
+        },
+      } as ReturnType<typeof usePluginPermissionSettings>)
+
+      const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool), {
+        systemFeatures: { rbac_enabled: true },
+      })
+
+      expect(result.current.canInstallPlugin).toBe(true)
+      expect(result.current.canManagement).toBe(true)
+      expect(result.current.canUpdatePlugin).toBe(true)
+      expect(result.current.canViewInstalledPlugins).toBe(true)
+      expect(result.current.canManagePlugin).toBe(true)
+      expect(result.current.canDebugPlugin).toBe(true)
+      expect(result.current.canDebugger).toBe(true)
+      expect(result.current.canSetPermissions).toBe(false)
+      expect(result.current.canSetPluginPreferences).toBe(true)
+    })
+
+    it('should ignore legacy plugin permission settings when RBAC is enabled', () => {
+      vi.mocked(useAppContext).mockReturnValue({
+        isCurrentWorkspaceManager: true,
+        isCurrentWorkspaceOwner: false,
+        langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+        workspacePermissionKeys: [] as string[],
+      } as ReturnType<typeof useAppContext>)
+
+      const { result } = renderHook(() => useReferenceSetting(PluginCategoryEnum.tool), {
+        systemFeatures: { rbac_enabled: true },
+      })
+
+      expect(result.current.canInstallPlugin).toBe(false)
+      expect(result.current.canManagement).toBe(false)
+      expect(result.current.canUpdatePlugin).toBe(false)
+      expect(result.current.canViewInstalledPlugins).toBe(false)
+      expect(result.current.canManagePlugin).toBe(false)
+      expect(result.current.canDebugPlugin).toBe(false)
+      expect(result.current.canDebugger).toBe(false)
+      expect(result.current.canSetPermissions).toBe(false)
+      expect(result.current.canSetPluginPreferences).toBe(false)
+    })
+  })
 })
 
 describe('useCanInstallPluginFromMarketplace Hook', () => {
@@ -301,6 +381,8 @@ describe('useCanInstallPluginFromMarketplace Hook', () => {
     vi.mocked(useAppContext).mockReturnValue({
       isCurrentWorkspaceManager: true,
       isCurrentWorkspaceOwner: false,
+      langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+      workspacePermissionKeys: ['plugin.install'],
     } as ReturnType<typeof useAppContext>)
 
     vi.mocked(usePluginPermissionSettings).mockReturnValue({
@@ -318,7 +400,7 @@ describe('useCanInstallPluginFromMarketplace Hook', () => {
     vi.mocked(useInvalidateReferenceSettings).mockReturnValue(vi.fn())
   })
 
-  it('should return true when marketplace is enabled and canManagement is true', () => {
+  it('should return true when marketplace is enabled and plugin.install is available', () => {
     const { result } = renderHook(() => useCanInstallPluginFromMarketplace(), {
       systemFeatures: { enable_marketplace: true },
     })
@@ -334,13 +416,13 @@ describe('useCanInstallPluginFromMarketplace Hook', () => {
     expect(result.current.canInstallPluginFromMarketplace).toBe(false)
   })
 
-  it('should return false when canManagement is false', () => {
-    vi.mocked(usePluginPermissionSettings).mockReturnValue({
-      data: {
-        install_permission: PermissionType.noOne,
-        debug_permission: PermissionType.noOne,
-      },
-    } as ReturnType<typeof usePluginPermissionSettings>)
+  it('should return false without plugin.install', () => {
+    vi.mocked(useAppContext).mockReturnValue({
+      isCurrentWorkspaceManager: true,
+      isCurrentWorkspaceOwner: false,
+      langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+      workspacePermissionKeys: [] as string[],
+    } as ReturnType<typeof useAppContext>)
 
     const { result } = renderHook(() => useCanInstallPluginFromMarketplace(), {
       systemFeatures: { enable_marketplace: true },
@@ -349,13 +431,13 @@ describe('useCanInstallPluginFromMarketplace Hook', () => {
     expect(result.current.canInstallPluginFromMarketplace).toBe(false)
   })
 
-  it('should return false when both marketplace is disabled and canManagement is false', () => {
-    vi.mocked(usePluginPermissionSettings).mockReturnValue({
-      data: {
-        install_permission: PermissionType.noOne,
-        debug_permission: PermissionType.noOne,
-      },
-    } as ReturnType<typeof usePluginPermissionSettings>)
+  it('should return false when both marketplace is disabled and plugin.install is missing', () => {
+    vi.mocked(useAppContext).mockReturnValue({
+      isCurrentWorkspaceManager: true,
+      isCurrentWorkspaceOwner: false,
+      langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+      workspacePermissionKeys: [] as string[],
+    } as ReturnType<typeof useAppContext>)
 
     const { result } = renderHook(() => useCanInstallPluginFromMarketplace(), {
       systemFeatures: { enable_marketplace: false },
@@ -364,12 +446,36 @@ describe('useCanInstallPluginFromMarketplace Hook', () => {
     expect(result.current.canInstallPluginFromMarketplace).toBe(false)
   })
 
-  it('should only read plugin permissions and not fetch category auto-upgrade settings', () => {
+  it('should not fetch legacy plugin permissions or category auto-upgrade settings', () => {
     renderHook(() => useCanInstallPluginFromMarketplace(), {
       systemFeatures: { enable_marketplace: true },
     })
 
-    expect(usePluginPermissionSettings).toHaveBeenCalled()
+    expect(usePluginPermissionSettings).not.toHaveBeenCalled()
     expect(usePluginAutoUpgradeSettings).not.toHaveBeenCalled()
   })
+
+  it('should use plugin.install when marketplace and RBAC are enabled', () => {
+    vi.mocked(useAppContext).mockReturnValue({
+      isCurrentWorkspaceManager: false,
+      isCurrentWorkspaceOwner: false,
+      langGeniusVersionInfo: { current_version: '1.0.0', latest_version: '', version: '' },
+      workspacePermissionKeys: ['plugin.install'],
+    } as ReturnType<typeof useAppContext>)
+    vi.mocked(usePluginPermissionSettings).mockReturnValue({
+      data: {
+        install_permission: PermissionType.noOne,
+        debug_permission: PermissionType.noOne,
+      },
+    } as ReturnType<typeof usePluginPermissionSettings>)
+
+    const { result } = renderHook(() => useCanInstallPluginFromMarketplace(), {
+      systemFeatures: {
+        enable_marketplace: true,
+        rbac_enabled: true,
+      },
+    })
+
+    expect(result.current.canInstallPluginFromMarketplace).toBe(true)
+  })
 })
diff --git a/web/app/components/plugins/plugin-page/index.tsx b/web/app/components/plugins/plugin-page/index.tsx
index e6348fbd1fb..914ed72efb0 100644
--- a/web/app/components/plugins/plugin-page/index.tsx
+++ b/web/app/components/plugins/plugin-page/index.tsx
@@ -14,7 +14,7 @@ import {
 import { useSuspenseQuery } from '@tanstack/react-query'
 import { useBoolean } from 'ahooks'
 import { noop } from 'es-toolkit/function'
-import { useEffect, useMemo, useState } from 'react'
+import { cloneElement, isValidElement, useEffect, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import TabSlider from '@/app/components/base/tab-slider'
 import ReferenceSettingModal from '@/app/components/plugins/reference-setting-modal'
@@ -27,6 +27,7 @@ import Link from '@/next/link'
 import { fetchBundleInfoFromMarketPlace, fetchManifestFromMarketPlace } from '@/service/plugins'
 import { sleep } from '@/utils'
 import { PLUGIN_PAGE_TABS_MAP } from '../hooks'
+import { PluginInstallPermissionProvider } from '../install-plugin/components/plugin-install-permission-provider'
 import InstallFromLocalPackage from '../install-plugin/install-from-local-package'
 import InstallFromMarketplace from '../install-plugin/install-from-marketplace'
 import { PLUGIN_TYPE_SEARCH_MAP } from '../marketplace/constants'
@@ -53,6 +54,12 @@ export type PluginPageProps = {
   plugins: React.ReactNode
   marketplace: React.ReactNode
 }
+type PluginPanelPermissionProps = {
+  canInstall?: boolean
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
+  canViewInstalledPlugins?: boolean
+}
 const PluginPage = ({
   plugins,
   marketplace,
@@ -78,10 +85,32 @@ const PluginPage = ({
 
   const [manifest, setManifest] = useState<PluginDeclaration | PluginManifestInMarket | null>(null)
 
+  const {
+    referenceSetting,
+    canInstallPlugin,
+    canUpdatePlugin,
+    canViewInstalledPlugins,
+    canManagePlugin,
+    canDebugger,
+    canSetPermissions,
+    canSetPluginPreferences,
+    currentDifyVersion,
+    isPermissionLoading,
+    isReferenceSettingLoading,
+    setReferenceSettings,
+  } = useReferenceSetting(PluginCategoryEnum.tool)
+
   useEffect(() => {
     (async () => {
       setUniqueIdentifier(null)
       await sleep(100)
+      if (isPermissionLoading)
+        return
+
+      if (!canInstallPlugin) {
+        setInstallState(null)
+        return
+      }
       if (packageId) {
         const { data } = await fetchManifestFromMarketPlace(encodeURIComponent(packageId))
         const { plugin, version } = data
@@ -105,17 +134,7 @@ const PluginPage = ({
         }
       }
     })()
-  }, [packageId, bundleInfo, showInstallFromMarketplace])
-
-  const {
-    referenceSetting,
-    canManagement,
-    canDebugger,
-    canSetPermissions,
-    isPermissionLoading,
-    isReferenceSettingLoading,
-    setReferenceSettings,
-  } = useReferenceSetting(PluginCategoryEnum.tool)
+  }, [packageId, bundleInfo, canInstallPlugin, isPermissionLoading, setInstallState, showInstallFromMarketplace])
   const [showPluginSettingModal, {
     setTrue: setShowPluginSettingModal,
     setFalse: setHidePluginSettingModal,
@@ -140,6 +159,11 @@ const PluginPage = ({
     : t('metadata.title', { ns: 'plugin' }))
 
   const handleFileChange = (file: File | null) => {
+    if (!canInstallPlugin) {
+      setCurrentFile(null)
+      return
+    }
+
     if (!file || !file.name.endsWith('.difypkg')) {
       setCurrentFile(null)
       return
@@ -150,10 +174,22 @@ const PluginPage = ({
   const uploaderProps = useUploader({
     onFileChange: handleFileChange,
     containerRef,
-    enabled: isPluginsTab && canManagement,
+    enabled: isPluginsTab && canInstallPlugin,
   })
 
   const { dragging, fileUploader, fileChangeHandle, removeFile } = uploaderProps
+  const pluginsWithPermission = useMemo(() => {
+    if (!isValidElement(plugins) || typeof plugins.type === 'string')
+      return plugins
+
+    return cloneElement(plugins as React.ReactElement<PluginPanelPermissionProps>, {
+      canInstall: canInstallPlugin,
+      canManagePlugin,
+      canUpdatePlugin,
+      canViewInstalledPlugins,
+    })
+  }, [canInstallPlugin, canManagePlugin, canUpdatePlugin, canViewInstalledPlugins, plugins])
+
   return (
     <div
       id="marketplace-container"
@@ -212,9 +248,9 @@ const PluginPage = ({
               )
             }
             <PluginTasks />
-            {(canManagement || isPermissionLoading) && (
+            {(canInstallPlugin || isPermissionLoading) && (
               <InstallPluginDropdown
-                disabled={isPermissionLoading || !canManagement}
+                disabled={isPermissionLoading || !canInstallPlugin}
                 onSwitchToMarketplaceTab={() => setActiveTab('discover')}
               />
             )}
@@ -233,7 +269,7 @@ const PluginPage = ({
               </Button>
             )}
             {
-              canSetPermissions && (
+              (canSetPermissions || canSetPluginPreferences) && (
                 <Tooltip>
                   <TooltipTrigger
                     render={(
@@ -259,7 +295,13 @@ const PluginPage = ({
       </div>
       {isPluginsTab && (
         <>
-          {plugins}
+          <PluginInstallPermissionProvider
+            canInstallPlugin={canInstallPlugin}
+            canUpdatePlugin={canUpdatePlugin}
+            currentDifyVersion={currentDifyVersion}
+          >
+            {pluginsWithPermission}
+          </PluginInstallPermissionProvider>
           {dragging && (
             <div
               className="absolute inset-0 m-0.5 rounded-2xl border-2 border-dashed border-components-dropzone-border-accent
@@ -267,10 +309,12 @@ const PluginPage = ({
             >
             </div>
           )}
-          <div className={`flex items-center justify-center gap-2 py-4 ${dragging ? 'text-text-accent' : 'text-text-quaternary'}`}>
-            <RiDragDropLine className="size-4" />
-            <span className="system-xs-regular">{t('installModal.dropPluginToInstall', { ns: 'plugin' })}</span>
-          </div>
+          {canInstallPlugin && (
+            <div className={`flex items-center justify-center gap-2 py-4 ${dragging ? 'text-text-accent' : 'text-text-quaternary'}`}>
+              <RiDragDropLine className="size-4" />
+              <span className="system-xs-regular">{t('installModal.dropPluginToInstall', { ns: 'plugin' })}</span>
+            </div>
+          )}
           {currentFile && (
             <InstallFromLocalPackage
               file={currentFile}
@@ -289,12 +333,22 @@ const PluginPage = ({
         </>
       )}
       {
-        isExploringMarketplace && enable_marketplace && marketplace
+        isExploringMarketplace && enable_marketplace && (
+          <PluginInstallPermissionProvider
+            canInstallPlugin={canInstallPlugin}
+            canUpdatePlugin={canUpdatePlugin}
+            currentDifyVersion={currentDifyVersion}
+          >
+            {marketplace}
+          </PluginInstallPermissionProvider>
+        )
       }
 
       {showPluginSettingModal && referenceSetting && (
         <ReferenceSettingModal
           payload={referenceSetting}
+          canSetPermissions={canSetPermissions}
+          canSetAutoUpdate={canSetPluginPreferences}
           onHide={setHidePluginSettingModal}
           onSave={setReferenceSettings}
         />
diff --git a/web/app/components/plugins/plugin-page/list/index.tsx b/web/app/components/plugins/plugin-page/list/index.tsx
index b4cf4db76cf..2d7595f29b3 100644
--- a/web/app/components/plugins/plugin-page/list/index.tsx
+++ b/web/app/components/plugins/plugin-page/list/index.tsx
@@ -3,11 +3,18 @@ import type { PluginDetail } from '../../types'
 import PluginItem from '../../plugin-item'
 
 type IPluginListProps = {
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
   children?: ReactNode
   pluginList: PluginDetail[]
 }
 
-const PluginList: FC<IPluginListProps> = ({ children, pluginList }) => {
+const PluginList: FC<IPluginListProps> = ({
+  canManagePlugin = true,
+  canUpdatePlugin = true,
+  children,
+  pluginList,
+}) => {
   return (
     <div className="pb-3">
       <div className="grid grid-cols-1 gap-3 lg:grid-cols-2">
@@ -15,6 +22,8 @@ const PluginList: FC<IPluginListProps> = ({ children, pluginList }) => {
           <PluginItem
             key={plugin.plugin_id}
             plugin={plugin}
+            canManagePlugin={canManagePlugin}
+            canUpdatePlugin={canUpdatePlugin}
           />
         ))}
         {children}
diff --git a/web/app/components/plugins/plugin-page/plugin-tasks/components/__tests__/error-plugin-item.spec.tsx b/web/app/components/plugins/plugin-page/plugin-tasks/components/__tests__/error-plugin-item.spec.tsx
index fcae8d67169..9d705185535 100644
--- a/web/app/components/plugins/plugin-page/plugin-tasks/components/__tests__/error-plugin-item.spec.tsx
+++ b/web/app/components/plugins/plugin-page/plugin-tasks/components/__tests__/error-plugin-item.spec.tsx
@@ -24,6 +24,13 @@ vi.mock('@/service/plugins', () => ({
   fetchPluginInfoFromMarketPlace: vi.fn(),
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission', () => ({
+  default: () => ({
+    canInstallPlugin: true,
+    currentDifyVersion: '1.0.0',
+  }),
+}))
+
 const mockFetch = vi.mocked(fetchPluginInfoFromMarketPlace)
 const mockGetIconUrl = vi.fn((icon: string) => `https://icons/${icon}`)
 
diff --git a/web/app/components/plugins/plugin-page/plugin-tasks/components/error-plugin-item.tsx b/web/app/components/plugins/plugin-page/plugin-tasks/components/error-plugin-item.tsx
index 5489db495a0..83fc9995dce 100644
--- a/web/app/components/plugins/plugin-page/plugin-tasks/components/error-plugin-item.tsx
+++ b/web/app/components/plugins/plugin-page/plugin-tasks/components/error-plugin-item.tsx
@@ -4,6 +4,8 @@ import type { Locale } from '@/i18n-config'
 import { Button } from '@langgenius/dify-ui/button'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { PluginInstallPermissionProvider } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import InstallFromMarketplace from '@/app/components/plugins/install-plugin/install-from-marketplace'
 import { PluginSource } from '@/app/components/plugins/types'
 import { fetchPluginInfoFromMarketPlace } from '@/service/plugins'
@@ -22,6 +24,7 @@ const ErrorPluginItem: FC<ErrorPluginItemProps> = ({ plugin, getIconUrl, languag
   const [showInstallModal, setShowInstallModal] = useState(false)
   const [installPayload, setInstallPayload] = useState<{ uniqueIdentifier: string, manifest: Plugin } | null>(null)
   const [isFetching, setIsFetching] = useState(false)
+  const { canInstallPlugin, currentDifyVersion } = useWorkspacePluginInstallPermission()
 
   const handleInstallFromMarketplace = useCallback(async () => {
     const parts = plugin.plugin_id.split('/')
@@ -75,7 +78,7 @@ const ErrorPluginItem: FC<ErrorPluginItemProps> = ({ plugin, getIconUrl, languag
   const errorMsg = t(errorMsgKey, { ns: 'plugin' })
 
   const renderAction = () => {
-    if (source === PluginSource.marketplace) {
+    if (source === PluginSource.marketplace && canInstallPlugin) {
       return (
         <div className="pt-1">
           <Button variant="secondary" size="small" loading={isFetching} onClick={handleInstallFromMarketplace}>
@@ -84,7 +87,7 @@ const ErrorPluginItem: FC<ErrorPluginItemProps> = ({ plugin, getIconUrl, languag
         </div>
       )
     }
-    if (source === PluginSource.github) {
+    if (source === PluginSource.github && canInstallPlugin) {
       return (
         <div className="pt-1">
           <Button variant="secondary" size="small">
@@ -116,16 +119,21 @@ const ErrorPluginItem: FC<ErrorPluginItemProps> = ({ plugin, getIconUrl, languag
         action={renderAction()}
         onClear={onClear}
       />
-      {showInstallModal && installPayload && (
-        <InstallFromMarketplace
-          uniqueIdentifier={installPayload.uniqueIdentifier}
-          manifest={installPayload.manifest}
-          onClose={() => setShowInstallModal(false)}
-          onSuccess={() => {
-            setShowInstallModal(false)
-            onClear()
-          }}
-        />
+      {showInstallModal && installPayload && canInstallPlugin && (
+        <PluginInstallPermissionProvider
+          canInstallPlugin={canInstallPlugin}
+          currentDifyVersion={currentDifyVersion}
+        >
+          <InstallFromMarketplace
+            uniqueIdentifier={installPayload.uniqueIdentifier}
+            manifest={installPayload.manifest}
+            onClose={() => setShowInstallModal(false)}
+            onSuccess={() => {
+              setShowInstallModal(false)
+              onClear()
+            }}
+          />
+        </PluginInstallPermissionProvider>
       )}
     </>
   )
diff --git a/web/app/components/plugins/plugin-page/plugins-panel-results.tsx b/web/app/components/plugins/plugin-page/plugins-panel-results.tsx
index cd81024fd4c..ce84b37f933 100644
--- a/web/app/components/plugins/plugin-page/plugins-panel-results.tsx
+++ b/web/app/components/plugins/plugin-page/plugins-panel-results.tsx
@@ -58,6 +58,8 @@ const BuiltinMarketplacePanel = ({
 }
 
 type PluginsPanelResultsProps = {
+  canManagePlugin: boolean
+  canUpdatePlugin: boolean
   containerRef: RefObject<HTMLDivElement | null>
   contentFrameClassName: string
   contentInset: PluginPageContentInset
@@ -78,6 +80,8 @@ type PluginsPanelResultsProps = {
 }
 
 const PluginsPanelResults = ({
+  canManagePlugin,
+  canUpdatePlugin,
   containerRef,
   contentFrameClassName,
   contentInset,
@@ -117,7 +121,11 @@ const PluginsPanelResults = ({
         )}
         >
           {(hasVisiblePlugins || hasVisibleBuiltinTools) && (
-            <List pluginList={filteredList}>
+            <List
+              pluginList={filteredList}
+              canManagePlugin={canManagePlugin}
+              canUpdatePlugin={canUpdatePlugin}
+            >
               {filteredBuiltinTools.map(collection => (
                 <button
                   key={collection.id}
diff --git a/web/app/components/plugins/plugin-page/plugins-panel.tsx b/web/app/components/plugins/plugin-page/plugins-panel.tsx
index 20ace911115..d1ccc4e36f0 100644
--- a/web/app/components/plugins/plugin-page/plugins-panel.tsx
+++ b/web/app/components/plugins/plugin-page/plugins-panel.tsx
@@ -52,6 +52,9 @@ const matchesSearchQuery = (plugin: PluginDetail & { latest_version: string }, q
 
 type PluginsPanelProps = {
   canInstall?: boolean
+  canManagePlugin?: boolean
+  canUpdatePlugin?: boolean
+  canViewInstalledPlugins?: boolean
   contentInset?: PluginPageContentInset
   fixedCategory?: PluginCategoryEnum
   layout?: (parts: { body: ReactNode, toolbar: ReactNode }) => ReactNode
@@ -61,6 +64,9 @@ type PluginsPanelProps = {
 
 const PluginsPanel = ({
   canInstall = true,
+  canManagePlugin = true,
+  canUpdatePlugin = true,
+  canViewInstalledPlugins = true,
   contentInset = 'default',
   fixedCategory,
   layout,
@@ -82,7 +88,7 @@ const PluginsPanel = ({
     select: s => s.enable_marketplace,
   })
   const { data: pluginList, isLoading: isPluginListLoading, isFetching, isLastPage, loadNextPage } = useInstalledPluginList(
-    undefined,
+    !canViewInstalledPlugins,
     100,
     fixedCategory
       ? {
@@ -217,6 +223,8 @@ const PluginsPanel = ({
                   scrollAreaLabel={scrollAreaLabel}
                   setCurrentBuiltinToolID={setCurrentBuiltinToolID}
                   tagFilterValue={filters.tags}
+                  canManagePlugin={canManagePlugin}
+                  canUpdatePlugin={canUpdatePlugin}
                 />
               )
             : isIntegrationCategorySearchEmpty
@@ -251,6 +259,8 @@ const PluginsPanel = ({
         detail={currentPluginDetail}
         onUpdate={() => invalidateInstalledPluginList()}
         onHide={handleHide}
+        canManagePlugin={canManagePlugin}
+        canUpdatePlugin={canUpdatePlugin}
       />
       {currentBuiltinTool && !currentBuiltinTool.plugin_id && (
         <ProviderDetail
diff --git a/web/app/components/plugins/plugin-page/use-reference-setting.ts b/web/app/components/plugins/plugin-page/use-reference-setting.ts
index 1c6258b29f8..0b779ccdd96 100644
--- a/web/app/components/plugins/plugin-page/use-reference-setting.ts
+++ b/web/app/components/plugins/plugin-page/use-reference-setting.ts
@@ -5,19 +5,29 @@ import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useAppContext } from '@/context/app-context'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
-import { hasPluginPermission, useInvalidateReferenceSettings, useMutationPluginPermissionSettings, useMutationReferenceSettings, usePluginAutoUpgradeSettings, usePluginPermissionSettings } from '@/service/use-plugins'
+import { useInvalidateReferenceSettings, useMutationPluginPermissionSettings, useMutationReferenceSettings, usePluginAutoUpgradeSettings, usePluginPermissionSettings } from '@/service/use-plugins'
+import { hasPermission } from '@/utils/permission'
 
-export const useCanSetPluginSettings = () => {
-  const { isCurrentWorkspaceManager, isCurrentWorkspaceOwner } = useAppContext()
+const pluginReadAndUpdatePermissionKeys = ['plugin.install', 'plugin.manage']
+
+const useCanSetPluginSettings = () => {
+  const { workspacePermissionKeys } = useAppContext()
+  const { data: rbacEnabled } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: s => s.rbac_enabled,
+  })
+  const canSetPluginPreferences = hasPermission(workspacePermissionKeys, 'plugin.plugin_preferences')
 
   return {
-    canSetPermissions: isCurrentWorkspaceManager || isCurrentWorkspaceOwner,
+    canSetPermissions: !rbacEnabled && canSetPluginPreferences,
+    canSetPluginPreferences,
   }
 }
 
 export const usePluginSettingsAccess = () => {
   const { t } = useTranslation()
-  const { canSetPermissions } = useCanSetPluginSettings()
+  const { workspacePermissionKeys, langGeniusVersionInfo } = useAppContext()
+  const { canSetPermissions, canSetPluginPreferences } = useCanSetPluginSettings()
   const permissionQuery = usePluginPermissionSettings()
   const { data: permissions } = permissionQuery
   const { mutate: setPluginPermissionSettings, isPending: isPermissionUpdatePending } = useMutationPluginPermissionSettings({
@@ -25,13 +35,25 @@ export const usePluginSettingsAccess = () => {
       toast.success(t('api.actionSuccess', { ns: 'common' }))
     },
   })
+  const canInstallPlugin = hasPermission(workspacePermissionKeys, 'plugin.install')
+  const canUpdatePlugin = hasPermission(workspacePermissionKeys, pluginReadAndUpdatePermissionKeys)
+  const canViewInstalledPlugins = hasPermission(workspacePermissionKeys, pluginReadAndUpdatePermissionKeys)
+  const canManagePlugin = hasPermission(workspacePermissionKeys, 'plugin.manage')
+  const canDebugPlugin = hasPermission(workspacePermissionKeys, 'plugin.debug')
 
   return {
     permission: permissions,
     setPluginPermissionSettings,
-    canManagement: hasPluginPermission(permissions?.install_permission, canSetPermissions),
-    canDebugger: hasPluginPermission(permissions?.debug_permission, canSetPermissions),
+    canInstallPlugin,
+    canUpdatePlugin,
+    canViewInstalledPlugins,
+    canManagePlugin,
+    canDebugPlugin,
+    canSetPluginPreferences,
+    canManagement: canInstallPlugin,
+    canDebugger: canDebugPlugin,
     canSetPermissions,
+    currentDifyVersion: langGeniusVersionInfo?.current_version,
     isPermissionLoading: permissionQuery.isLoading || permissionQuery.isFetching,
     permissionError: permissionQuery.error,
     isPermissionUpdatePending,
@@ -63,7 +85,14 @@ const useReferenceSetting = (category: PluginCategoryEnum) => {
     setReferenceSettings: updateReferenceSetting,
     canManagement: permissionAccess.canManagement,
     canDebugger: permissionAccess.canDebugger,
+    canInstallPlugin: permissionAccess.canInstallPlugin,
+    canUpdatePlugin: permissionAccess.canUpdatePlugin,
+    canViewInstalledPlugins: permissionAccess.canViewInstalledPlugins,
+    canManagePlugin: permissionAccess.canManagePlugin,
+    canDebugPlugin: permissionAccess.canDebugPlugin,
     canSetPermissions: permissionAccess.canSetPermissions,
+    canSetPluginPreferences: permissionAccess.canSetPluginPreferences,
+    currentDifyVersion: permissionAccess.currentDifyVersion,
     isPermissionLoading: permissionAccess.isPermissionLoading,
     permissionError: permissionAccess.permissionError,
     isReferenceSettingLoading: autoUpgradeQuery.isLoading || autoUpgradeQuery.isFetching,
@@ -73,20 +102,16 @@ const useReferenceSetting = (category: PluginCategoryEnum) => {
 }
 
 export const useCanInstallPluginFromMarketplace = () => {
-  const { data: enable_marketplace } = useSuspenseQuery({
+  const { data: marketplaceAccess } = useSuspenseQuery({
     ...systemFeaturesQueryOptions(),
     select: s => s.enable_marketplace,
   })
-  const { isCurrentWorkspaceManager, isCurrentWorkspaceOwner } = useAppContext()
-  const { data: permissions } = usePluginPermissionSettings()
-  const canManagement = hasPluginPermission(
-    permissions?.install_permission,
-    isCurrentWorkspaceManager || isCurrentWorkspaceOwner,
-  )
+  const { workspacePermissionKeys } = useAppContext()
+  const canInstallPlugin = hasPermission(workspacePermissionKeys, 'plugin.install')
 
   const canInstallPluginFromMarketplace = useMemo(() => {
-    return enable_marketplace && canManagement
-  }, [enable_marketplace, canManagement])
+    return Boolean(marketplaceAccess && canInstallPlugin)
+  }, [marketplaceAccess, canInstallPlugin])
 
   return {
     canInstallPluginFromMarketplace,
diff --git a/web/app/components/plugins/provider-card.tsx b/web/app/components/plugins/provider-card.tsx
index 710a748a853..86e18f126ac 100644
--- a/web/app/components/plugins/provider-card.tsx
+++ b/web/app/components/plugins/provider-card.tsx
@@ -3,12 +3,12 @@ import type { FC } from 'react'
 import type { Plugin } from './types'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
-import { RiArrowRightUpLine } from '@remixicon/react'
 import { useBoolean } from 'ahooks'
 import { useTheme } from 'next-themes'
 import * as React from 'react'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
+import usePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-plugin-install-permission'
 import InstallFromMarketplace from '@/app/components/plugins/install-plugin/install-from-marketplace'
 import { getPluginLinkInMarketplace } from '@/app/components/plugins/marketplace/utils'
 import { useLocale } from '@/context/i18n'
@@ -35,6 +35,7 @@ const ProviderCardComponent: FC<Props> = ({
     setTrue: showInstallFromMarketplace,
     setFalse: hideInstallFromMarketplace,
   }] = useBoolean(false)
+  const { canInstallPlugin } = usePluginInstallPermission()
   const { org, label } = payload
   const locale = useLocale()
 
@@ -69,20 +70,22 @@ const ProviderCardComponent: FC<Props> = ({
       <div
         className="absolute inset-x-0 bottom-0 hidden items-center gap-2 rounded-xl bg-linear-to-tr from-components-panel-on-panel-item-bg to-background-gradient-mask-transparent p-4 pt-4 group-hover:flex"
       >
-        <Button
-          className="grow"
-          variant="primary"
-          onClick={showInstallFromMarketplace}
-        >
-          {t('detailPanel.operation.install', { ns: 'plugin' })}
-        </Button>
+        {canInstallPlugin && (
+          <Button
+            className="grow"
+            variant="primary"
+            onClick={showInstallFromMarketplace}
+          >
+            {t('detailPanel.operation.install', { ns: 'plugin' })}
+          </Button>
+        )}
         <Button
           className="grow"
           variant="secondary"
         >
           <a href={getPluginLinkInMarketplace(payload, marketplaceLinkParams)} target="_blank" className="flex items-center gap-0.5">
             {t('detailPanel.operation.detail', { ns: 'plugin' })}
-            <RiArrowRightUpLine className="size-4" />
+            <span className="i-ri-arrow-right-up-line size-4" />
           </a>
         </Button>
       </div>
diff --git a/web/app/components/plugins/reference-setting-modal/__tests__/index.spec.tsx b/web/app/components/plugins/reference-setting-modal/__tests__/index.spec.tsx
index 22060d4431c..74ff07e9102 100644
--- a/web/app/components/plugins/reference-setting-modal/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/reference-setting-modal/__tests__/index.spec.tsx
@@ -9,7 +9,10 @@ import { PermissionType } from '@/app/components/plugins/types'
 import { AUTO_UPDATE_MODE, AUTO_UPDATE_STRATEGY } from '../auto-update-setting/types'
 import ReferenceSettingModal from '../index'
 
-const mockSystemFeatures = { enable_marketplace: true }
+const mockSystemFeatures = {
+  enable_marketplace: true,
+  rbac_enabled: false,
+}
 
 const render = (ui: ReactElement) =>
   renderWithSystemFeatures(ui, { systemFeatures: mockSystemFeatures })
@@ -37,19 +40,26 @@ vi.mock('@langgenius/dify-ui/dialog', () => ({
 
 // Mock OptionCard component
 vi.mock('@/app/components/workflow/nodes/_base/components/option-card', () => ({
-  default: ({ title, onSelect, selected, className }: {
+  default: ({ title, onSelect, selected, className, disabled, tooltip }: {
     title: string
     onSelect: () => void
     selected: boolean
     className?: string
+    disabled?: boolean
+    tooltip?: string
   }) => (
     <button
       data-testid={`option-card-${title.toLowerCase().replace(/\s+/g, '-')}`}
-      onClick={onSelect}
+      onClick={() => {
+        if (!disabled)
+          onSelect()
+      }}
       aria-pressed={selected}
+      disabled={disabled}
       className={className}
     >
       {title}
+      {tooltip && <span>{tooltip}</span>}
     </button>
   ),
 }))
@@ -113,6 +123,7 @@ describe('reference-setting-modal', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockSystemFeatures.enable_marketplace = true
+    mockSystemFeatures.rbac_enabled = false
   })
 
   // Label component tests moved to label.spec.tsx
@@ -123,6 +134,8 @@ describe('reference-setting-modal', () => {
   describe('ReferenceSettingModal (index.tsx)', () => {
     const defaultProps = {
       payload: createMockReferenceSetting(),
+      canSetPermissions: true,
+      canSetAutoUpdate: true,
       onHide: vi.fn(),
       onSave: vi.fn(),
     }
@@ -227,6 +240,19 @@ describe('reference-setting-modal', () => {
         expect(screen.queryByTestId('auto-update-setting')).not.toBeInTheDocument()
       })
 
+      it('should hide permission controls when permission editing is disabled', () => {
+        render(<ReferenceSettingModal {...defaultProps} canSetPermissions={false} />)
+
+        expect(screen.queryByText('plugin.privilege.whoCanInstall')).not.toBeInTheDocument()
+        expect(screen.queryByText('plugin.privilege.whoCanDebug')).not.toBeInTheDocument()
+      })
+
+      it('should hide AutoUpdateSetting when auto update editing is disabled', () => {
+        render(<ReferenceSettingModal {...defaultProps} canSetAutoUpdate={false} />)
+
+        expect(screen.queryByTestId('auto-update-setting')).not.toBeInTheDocument()
+      })
+
       it('should render modal with closable attribute', () => {
         // Arrange & Act
         render(<ReferenceSettingModal {...defaultProps} />)
@@ -235,6 +261,16 @@ describe('reference-setting-modal', () => {
         // Assert
         expect(screen.getByTestId('modal-close'))!.toBeInTheDocument()
       })
+
+      it('should disable permission controls with settings permissions tooltip beside titles when RBAC is enabled', () => {
+        mockSystemFeatures.rbac_enabled = true
+
+        render(<ReferenceSettingModal {...defaultProps} />)
+
+        expect(screen.getAllByLabelText('plugin.privilege.configurePermissionsInSettings')).toHaveLength(2)
+        expect(screen.queryByText('plugin.privilege.configurePermissionsInSettings')).not.toBeInTheDocument()
+        expect(screen.getAllByTestId(/option-card/).every(option => option.hasAttribute('disabled'))).toBe(true)
+      })
     })
 
     describe('State Management', () => {
@@ -272,6 +308,16 @@ describe('reference-setting-modal', () => {
         expect(noOneOptions[0])!.toHaveAttribute('aria-pressed', 'true')
       })
 
+      it('should not update permission when RBAC disables permission controls', () => {
+        mockSystemFeatures.rbac_enabled = true
+        render(<ReferenceSettingModal {...defaultProps} />)
+
+        const noOneOptions = screen.getAllByTestId('option-card-plugin.privilege.noone')
+        fireEvent.click(noOneOptions[0]!)
+
+        expect(noOneOptions[0])!.toHaveAttribute('aria-pressed', 'false')
+      })
+
       it('should initialize with payload auto_upgrade values', () => {
         // Arrange
         const payload = createMockReferenceSetting({
@@ -411,6 +457,66 @@ describe('reference-setting-modal', () => {
           }))
         })
       })
+
+      it('should preserve permission values when permission editing is disabled', async () => {
+        const onSave = vi.fn().mockResolvedValue(undefined)
+        const payload = createMockReferenceSetting({
+          permission: {
+            install_permission: PermissionType.admin,
+            debug_permission: PermissionType.noOne,
+          },
+        })
+
+        render(
+          <ReferenceSettingModal
+            {...defaultProps}
+            payload={payload}
+            canSetPermissions={false}
+            onSave={onSave}
+          />,
+        )
+        fireEvent.click(screen.getByTestId('auto-update-change'))
+        fireEvent.click(screen.getByText('common.operation.save'))
+
+        await waitFor(() => {
+          expect(onSave).toHaveBeenCalledWith(expect.objectContaining({
+            permission: payload.permission,
+            auto_upgrade: expect.objectContaining({
+              strategy_setting: AUTO_UPDATE_STRATEGY.latest,
+            }),
+          }))
+        })
+      })
+
+      it('should preserve auto update values when auto update editing is disabled', async () => {
+        const onSave = vi.fn().mockResolvedValue(undefined)
+        const payload = createMockReferenceSetting({
+          auto_upgrade: createMockAutoUpdateConfig({
+            strategy_setting: AUTO_UPDATE_STRATEGY.fixOnly,
+          }),
+        })
+
+        render(
+          <ReferenceSettingModal
+            {...defaultProps}
+            payload={payload}
+            canSetAutoUpdate={false}
+            onSave={onSave}
+          />,
+        )
+        const noOneOptions = screen.getAllByTestId('option-card-plugin.privilege.noone')
+        fireEvent.click(noOneOptions[0]!)
+        fireEvent.click(screen.getByText('common.operation.save'))
+
+        await waitFor(() => {
+          expect(onSave).toHaveBeenCalledWith(expect.objectContaining({
+            permission: expect.objectContaining({
+              install_permission: PermissionType.noOne,
+            }),
+            auto_upgrade: payload.auto_upgrade,
+          }))
+        })
+      })
     })
 
     describe('Callback Stability and Memoization', () => {
@@ -727,7 +833,7 @@ describe('reference-setting-modal', () => {
 
         // Assert
         const modal = screen.getByTestId('modal')
-        expect(modal)!.toHaveClass('w-[620px]', 'max-w-[620px]', 'p-0!')
+        expect(modal)!.toHaveClass('w-155', 'max-w-155', 'p-0!')
       })
 
       it('should pass isShow=true to Modal', () => {
@@ -801,6 +907,8 @@ describe('reference-setting-modal', () => {
       render(
         <ReferenceSettingModal
           payload={initialPayload}
+          canSetPermissions
+          canSetAutoUpdate
           onHide={onHide}
           onSave={onSave}
         />,
@@ -845,6 +953,8 @@ describe('reference-setting-modal', () => {
       render(
         <ReferenceSettingModal
           payload={initialPayload}
+          canSetPermissions
+          canSetAutoUpdate
           onHide={onHide}
           onSave={onSave}
         />,
@@ -866,6 +976,8 @@ describe('reference-setting-modal', () => {
       // Arrange
       const props = {
         payload: createMockReferenceSetting(),
+        canSetPermissions: true,
+        canSetAutoUpdate: true,
         onHide: vi.fn(),
         onSave: vi.fn(),
       }
diff --git a/web/app/components/plugins/reference-setting-modal/index.tsx b/web/app/components/plugins/reference-setting-modal/index.tsx
index eaa97f7043e..451f0e45e3e 100644
--- a/web/app/components/plugins/reference-setting-modal/index.tsx
+++ b/web/app/components/plugins/reference-setting-modal/index.tsx
@@ -26,12 +26,16 @@ const autoUpdateDefaultValue: AutoUpdateConfig = {
 
 type Props = Readonly<{
   payload: ReferenceSetting
+  canSetPermissions?: boolean
+  canSetAutoUpdate?: boolean
   onHide: () => void
   onSave: (payload: ReferenceSetting) => void
 }>
 
 const PluginSettingModal: FC<Props> = ({
   payload,
+  canSetPermissions = false,
+  canSetAutoUpdate = false,
   onHide,
   onSave,
 }) => {
@@ -39,26 +43,27 @@ const PluginSettingModal: FC<Props> = ({
   const { auto_upgrade: autoUpdateConfig, permission: privilege } = payload || {}
   const [tempPrivilege, setTempPrivilege] = useState<Permissions>(privilege)
   const [tempAutoUpdateConfig, setTempAutoUpdateConfig] = useState<AutoUpdateConfig>(autoUpdateConfig || autoUpdateDefaultValue)
-  const { data: enable_marketplace } = useSuspenseQuery({
-    ...systemFeaturesQueryOptions(),
-    select: s => s.enable_marketplace,
-  })
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isPermissionDisabledByRBAC = systemFeatures.rbac_enabled
+  const permissionDisabledTip = t(`${i18nPrefix}.configurePermissionsInSettings`, { ns: 'plugin' })
   const handlePrivilegeChange = useCallback((key: string) => {
     return (value: PermissionType) => {
+      if (isPermissionDisabledByRBAC)
+        return
       setTempPrivilege({
         ...tempPrivilege,
         [key]: value,
       })
     }
-  }, [tempPrivilege])
+  }, [isPermissionDisabledByRBAC, tempPrivilege])
 
   const handleSave = useCallback(async () => {
     await onSave({
-      permission: tempPrivilege,
-      auto_upgrade: tempAutoUpdateConfig,
+      permission: canSetPermissions ? tempPrivilege : (privilege || tempPrivilege),
+      auto_upgrade: canSetAutoUpdate ? tempAutoUpdateConfig : (autoUpdateConfig || tempAutoUpdateConfig),
     })
     onHide()
-  }, [onHide, onSave, tempAutoUpdateConfig, tempPrivilege])
+  }, [autoUpdateConfig, canSetAutoUpdate, canSetPermissions, onHide, onSave, privilege, tempAutoUpdateConfig, tempPrivilege])
 
   return (
     <Dialog
@@ -68,48 +73,54 @@ const PluginSettingModal: FC<Props> = ({
           onHide()
       }}
     >
-      <DialogContent className="w-[620px] max-w-[620px] overflow-hidden! border-none p-0! text-left align-middle">
+      <DialogContent className="w-155 max-w-155 overflow-hidden! border-none p-0! text-left align-middle">
         <DialogCloseButton />
 
         <div className="shadows-shadow-xl flex w-full flex-col items-start rounded-2xl border border-components-panel-border bg-components-panel-bg">
           <div className="flex items-start gap-2 self-stretch pt-6 pr-14 pb-3 pl-6">
             <span className="self-stretch title-2xl-semi-bold text-text-primary">{t(`${i18nPrefix}.title`, { ns: 'plugin' })}</span>
           </div>
-          <div className="flex flex-col items-start justify-center gap-4 self-stretch px-6 py-3">
-            {[
-              { title: t(`${i18nPrefix}.whoCanInstall`, { ns: 'plugin' }), key: 'install_permission', value: tempPrivilege?.install_permission || PermissionType.noOne },
-              { title: t(`${i18nPrefix}.whoCanDebug`, { ns: 'plugin' }), key: 'debug_permission', value: tempPrivilege?.debug_permission || PermissionType.noOne },
-            ].map(({ title, key, value }) => (
-              <div key={key} className="flex flex-col items-start gap-1 self-stretch">
-                <Label label={title} />
-                <div className="flex w-full items-start justify-between gap-2">
-                  {[PermissionType.everyone, PermissionType.admin, PermissionType.noOne].map(option => (
-                    <OptionCard
-                      key={option}
-                      title={t(`${i18nPrefix}.${option}`, { ns: 'plugin' })}
-                      onSelect={() => handlePrivilegeChange(key)(option)}
-                      selected={value === option}
-                      className="flex-1"
-                    />
-                  ))}
+          {canSetPermissions && (
+            <div className="flex flex-col items-start justify-center gap-4 self-stretch px-6 py-3">
+              {[
+                { title: t(`${i18nPrefix}.whoCanInstall`, { ns: 'plugin' }), key: 'install_permission', value: tempPrivilege?.install_permission || PermissionType.noOne },
+                { title: t(`${i18nPrefix}.whoCanDebug`, { ns: 'plugin' }), key: 'debug_permission', value: tempPrivilege?.debug_permission || PermissionType.noOne },
+              ].map(({ title, key, value }) => (
+                <div key={key} className="flex flex-col items-start gap-1 self-stretch">
+                  <Label
+                    label={title}
+                    tooltip={isPermissionDisabledByRBAC ? permissionDisabledTip : undefined}
+                  />
+                  <div className="flex w-full items-start justify-between gap-2">
+                    {[PermissionType.everyone, PermissionType.admin, PermissionType.noOne].map(option => (
+                      <OptionCard
+                        key={option}
+                        title={t(`${i18nPrefix}.${option}`, { ns: 'plugin' })}
+                        onSelect={() => handlePrivilegeChange(key)(option)}
+                        selected={value === option}
+                        disabled={isPermissionDisabledByRBAC}
+                        className="flex-1"
+                      />
+                    ))}
+                  </div>
                 </div>
-              </div>
-            ))}
-          </div>
+              ))}
+            </div>
+          )}
           {
-            enable_marketplace && (
+            systemFeatures.enable_marketplace && canSetAutoUpdate && (
               <AutoUpdateSetting payload={tempAutoUpdateConfig} onChange={setTempAutoUpdateConfig} />
             )
           }
-          <div className="flex h-[76px] items-center justify-end gap-2 self-stretch p-6 pt-5">
+          <div className="flex h-19 items-center justify-end gap-2 self-stretch p-6 pt-5">
             <Button
-              className="min-w-[72px]"
+              className="min-w-18"
               onClick={onHide}
             >
               {t('operation.cancel', { ns: 'common' })}
             </Button>
             <Button
-              className="min-w-[72px]"
+              className="min-w-18"
               variant="primary"
               onClick={handleSave}
             >
diff --git a/web/app/components/plugins/reference-setting-modal/label.tsx b/web/app/components/plugins/reference-setting-modal/label.tsx
index fdc8965e2ec..4fc2415c346 100644
--- a/web/app/components/plugins/reference-setting-modal/label.tsx
+++ b/web/app/components/plugins/reference-setting-modal/label.tsx
@@ -1,21 +1,41 @@
 'use client'
 import type { FC } from 'react'
 import { cn } from '@langgenius/dify-ui/cn'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import * as React from 'react'
 
 type Props = Readonly<{
   label: string
   description?: string
+  tooltip?: string
 }>
 
 const Label: FC<Props> = ({
   label,
   description,
+  tooltip,
 }) => {
+  const tooltipIcon = (
+    <span
+      aria-label={tooltip}
+      className="ml-1 flex size-4 shrink-0 cursor-pointer items-center justify-center"
+    >
+      <span aria-hidden className="i-ri-question-line size-3.5 text-text-quaternary" />
+    </span>
+  )
+
   return (
     <div>
       <div className={cn('flex h-6 items-center', description && 'h-4')}>
         <span className="system-sm-semibold text-text-secondary">{label}</span>
+        {tooltip && (
+          <Tooltip>
+            <TooltipTrigger render={tooltipIcon} />
+            <TooltipContent>
+              {tooltip}
+            </TooltipContent>
+          </Tooltip>
+        )}
       </div>
       {description && (
         <div className="mt-1 body-xs-regular text-text-tertiary">
diff --git a/web/app/components/plugins/types.ts b/web/app/components/plugins/types.ts
index e1d0513f789..0d4863c5629 100644
--- a/web/app/components/plugins/types.ts
+++ b/web/app/components/plugins/types.ts
@@ -3,7 +3,6 @@ import type { CredentialFormSchemaBase } from '../header/account-setting/model-p
 import type { AutoUpdateConfig } from './reference-setting-modal/auto-update-setting/types'
 import type { TypeWithI18N } from '@/app/components/base/form/types'
 import type { Collection, ToolCredential } from '@/app/components/tools/types'
-import type { AgentFeature } from '@/app/components/workflow/nodes/agent/types'
 import type { Locale } from '@/i18n-config'
 
 export enum PluginCategoryEnum {
@@ -567,6 +566,12 @@ export type StrategyDetail = {
   features: AgentFeature[]
 }
 
+const AgentFeature = {
+  HISTORY_MESSAGES: 'history-messages',
+} as const
+
+type AgentFeature = typeof AgentFeature[keyof typeof AgentFeature]
+
 type Identity = {
   author: string
   name: string
diff --git a/web/app/components/rag-pipeline/components/__tests__/conversion.spec.tsx b/web/app/components/rag-pipeline/components/__tests__/conversion.spec.tsx
index cb11e5baf44..489fe005380 100644
--- a/web/app/components/rag-pipeline/components/__tests__/conversion.spec.tsx
+++ b/web/app/components/rag-pipeline/components/__tests__/conversion.spec.tsx
@@ -9,6 +9,24 @@ vi.mock('@/next/navigation', () => ({
   useParams: () => ({ datasetId: 'ds-123' }),
 }))
 
+let mockDatasetDetailState = {
+  dataset: {
+    permission_keys: ['dataset.acl.edit'],
+    maintainer: 'maintainer-id',
+  },
+}
+vi.mock('@/context/dataset-detail', () => ({
+  useDatasetDetailContextWithSelector: (selector: (state: typeof mockDatasetDetailState) => unknown) => selector(mockDatasetDetailState),
+}))
+
+let mockAppContextState = {
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: [] as string[],
+}
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector(mockAppContextState),
+}))
+
 vi.mock('@/service/use-pipeline', () => ({
   useConvertDatasetToPipeline: () => ({
     mutateAsync: mockConvert,
@@ -54,6 +72,16 @@ vi.mock('../screenshot', () => ({
 describe('Conversion', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockDatasetDetailState = {
+      dataset: {
+        permission_keys: ['dataset.acl.edit'],
+        maintainer: 'maintainer-id',
+      },
+    }
+    mockAppContextState = {
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: [],
+    }
   })
 
   afterEach(() => {
@@ -74,6 +102,25 @@ describe('Conversion', () => {
     expect(screen.getByText('datasetPipeline.operations.convert')).toBeInTheDocument()
   })
 
+  it('should disable convert button when dataset lacks edit ACL', () => {
+    mockDatasetDetailState = {
+      dataset: {
+        permission_keys: ['dataset.acl.readonly'],
+        maintainer: 'maintainer-id',
+      },
+    }
+
+    render(<Conversion />)
+
+    const convertButton = screen.getByRole('button', { name: 'datasetPipeline.operations.convert' })
+    expect(convertButton).toBeDisabled()
+
+    fireEvent.click(convertButton)
+
+    expect(screen.queryByText('datasetPipeline.conversion.confirm.title')).not.toBeInTheDocument()
+    expect(mockConvert).not.toHaveBeenCalled()
+  })
+
   it('should render warning text', () => {
     render(<Conversion />)
 
diff --git a/web/app/components/rag-pipeline/components/__tests__/index.spec.tsx b/web/app/components/rag-pipeline/components/__tests__/index.spec.tsx
index 3b171c2494e..dc3df5a7a4e 100644
--- a/web/app/components/rag-pipeline/components/__tests__/index.spec.tsx
+++ b/web/app/components/rag-pipeline/components/__tests__/index.spec.tsx
@@ -82,6 +82,17 @@ vi.mock('@/app/components/workflow/store', () => {
   }
 })
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canImportExportDSL: boolean, canRun: boolean, canReleaseAndVersion: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canImportExportDSL: true,
+        canRun: true,
+        canReleaseAndVersion: true,
+      },
+    }),
+}))
+
 const {
   mockHandlePaneContextmenuCancel,
   mockExportCheck,
@@ -208,6 +219,24 @@ vi.mock('@/service/knowledge/use-dataset', () => ({
   useInvalidDatasetList: () => vi.fn(),
 }))
 
+let mockDatasetDetailState = {
+  dataset: {
+    permission_keys: ['dataset.acl.edit'],
+    maintainer: 'maintainer-id',
+  },
+}
+vi.mock('@/context/dataset-detail', () => ({
+  useDatasetDetailContextWithSelector: (selector: (state: typeof mockDatasetDetailState) => unknown) => selector(mockDatasetDetailState),
+}))
+
+let mockAppContextState = {
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: [] as string[],
+}
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: typeof mockAppContextState) => unknown) => selector(mockAppContextState),
+}))
+
 vi.mock('@/service/workflow', () => ({
   fetchWorkflowDraft: vi.fn().mockResolvedValue({
     graph: { nodes: [], edges: [], viewport: {} },
@@ -374,6 +403,16 @@ function getAppIcon() {
 describe('Conversion', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockDatasetDetailState = {
+      dataset: {
+        permission_keys: ['dataset.acl.edit'],
+        maintainer: 'maintainer-id',
+      },
+    }
+    mockAppContextState = {
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: [],
+    }
   })
 
   describe('Rendering', () => {
diff --git a/web/app/components/rag-pipeline/components/__tests__/rag-pipeline-children.spec.tsx b/web/app/components/rag-pipeline/components/__tests__/rag-pipeline-children.spec.tsx
index fcb208fc674..56baf482d77 100644
--- a/web/app/components/rag-pipeline/components/__tests__/rag-pipeline-children.spec.tsx
+++ b/web/app/components/rag-pipeline/components/__tests__/rag-pipeline-children.spec.tsx
@@ -42,6 +42,15 @@ vi.mock('@/app/components/workflow/store', () => ({
   }),
 }))
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canImportExportDSL: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canImportExportDSL: true,
+      },
+    }),
+}))
+
 vi.mock('@/app/components/workflow/hooks', () => ({
   useDSL: () => ({
     exportCheck: mockExportCheck,
diff --git a/web/app/components/rag-pipeline/components/__tests__/rag-pipeline-main.spec.tsx b/web/app/components/rag-pipeline/components/__tests__/rag-pipeline-main.spec.tsx
index 22d38861dad..d175780a029 100644
--- a/web/app/components/rag-pipeline/components/__tests__/rag-pipeline-main.spec.tsx
+++ b/web/app/components/rag-pipeline/components/__tests__/rag-pipeline-main.spec.tsx
@@ -2,14 +2,23 @@ import type { PropsWithChildren } from 'react'
 import type { Edge, Node, Viewport } from 'reactflow'
 import { cleanup, render, screen } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { DatasetACLPermission } from '@/utils/permission'
 import RagPipelineMain from '../rag-pipeline-main'
 
+const mockPermissionState = vi.hoisted(() => ({
+  permissionKeys: ['dataset.acl.edit'] as string[],
+}))
+
 vi.mock('../../hooks', () => ({
   useAvailableNodesMetaData: () => ({ nodes: [], nodesMap: {} }),
   useDSL: () => ({
     exportCheck: vi.fn(),
     handleExportDSL: vi.fn(),
   }),
+  useDSLByCanEdit: () => ({
+    exportCheck: vi.fn(),
+    handleExportDSL: vi.fn(),
+  }),
   useGetRunAndTraceUrl: () => ({
     getWorkflowRunAndTraceUrl: vi.fn(),
   }),
@@ -17,6 +26,10 @@ vi.mock('../../hooks', () => ({
     doSyncWorkflowDraft: vi.fn(),
     syncWorkflowDraftWhenPageClose: vi.fn(),
   }),
+  useNodesSyncDraftByCanEdit: () => ({
+    doSyncWorkflowDraft: vi.fn(),
+    syncWorkflowDraftWhenPageClose: vi.fn(),
+  }),
   usePipelineRefreshDraft: () => ({
     handleRefreshWorkflowDraft: vi.fn(),
   }),
@@ -27,10 +40,21 @@ vi.mock('../../hooks', () => ({
     handleRun: vi.fn(),
     handleStopRun: vi.fn(),
   }),
+  usePipelineRunByCanEdit: () => ({
+    handleBackupDraft: vi.fn(),
+    handleLoadBackupDraft: vi.fn(),
+    handleRestoreFromPublishedWorkflow: vi.fn(),
+    handleRun: vi.fn(),
+    handleStopRun: vi.fn(),
+  }),
   usePipelineStartRun: () => ({
     handleStartWorkflowRun: vi.fn(),
     handleWorkflowStartRunInWorkflow: vi.fn(),
   }),
+  usePipelineStartRunByCanEdit: () => ({
+    handleStartWorkflowRun: vi.fn(),
+    handleWorkflowStartRunInWorkflow: vi.fn(),
+  }),
 }))
 
 vi.mock('../../hooks/use-configs-map', () => ({
@@ -77,9 +101,16 @@ vi.mock('@/app/components/workflow/hooks/use-fetch-workflow-inspect-vars', () =>
   }),
 }))
 
+vi.mock('@/context/dataset-detail', () => ({
+  useDatasetDetailContextWithSelector: (selector: (state: { dataset: { permission_keys: string[] } }) => unknown) =>
+    selector({ dataset: { permission_keys: mockPermissionState.permissionKeys } }),
+}))
+
 vi.mock('@/app/components/workflow', () => ({
-  WorkflowWithInnerContext: ({ children, onWorkflowDataUpdate }: PropsWithChildren<{ onWorkflowDataUpdate?: (payload: unknown) => void }>) => (
+  WorkflowWithInnerContext: ({ children, onWorkflowDataUpdate, hooksStore }: PropsWithChildren<{ onWorkflowDataUpdate?: (payload: unknown) => void, hooksStore?: { accessControl?: { canComment?: boolean, canEdit?: boolean } } }>) => (
     <div data-testid="workflow-inner-context">
+      <div data-testid="can-comment">{String(hooksStore?.accessControl?.canComment)}</div>
+      <div data-testid="can-edit">{String(hooksStore?.accessControl?.canEdit)}</div>
       {children}
       <button
         data-testid="trigger-update"
@@ -120,6 +151,7 @@ describe('RagPipelineMain', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockPermissionState.permissionKeys = [DatasetACLPermission.Edit]
   })
 
   describe('rendering', () => {
@@ -191,6 +223,15 @@ describe('RagPipelineMain', () => {
   })
 
   describe('hooks integration', () => {
+    it('should pass readonly ACL permission as comment-only workflow access', () => {
+      mockPermissionState.permissionKeys = [DatasetACLPermission.Readonly]
+
+      render(<RagPipelineMain {...defaultProps} />)
+
+      expect(screen.getByTestId('can-comment')).toHaveTextContent('true')
+      expect(screen.getByTestId('can-edit')).toHaveTextContent('false')
+    })
+
     it('should use useNodesSyncDraft hook', () => {
       render(<RagPipelineMain {...defaultProps} />)
 
diff --git a/web/app/components/rag-pipeline/components/conversion.tsx b/web/app/components/rag-pipeline/components/conversion.tsx
index 5e500a88a69..48f8fec4c1e 100644
--- a/web/app/components/rag-pipeline/components/conversion.tsx
+++ b/web/app/components/rag-pipeline/components/conversion.tsx
@@ -12,19 +12,34 @@ import { toast } from '@langgenius/dify-ui/toast'
 import * as React from 'react'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import { useParams } from '@/next/navigation'
 import { datasetDetailQueryKeyPrefix } from '@/service/knowledge/use-dataset'
 import { useInvalid } from '@/service/use-base'
 import { useConvertDatasetToPipeline } from '@/service/use-pipeline'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import PipelineScreenShot from './screenshot'
 
 const Conversion = () => {
   const { t } = useTranslation()
   const { datasetId } = useParams()
+  const dataset = useDatasetDetailContextWithSelector(state => state.dataset)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const [showConfirmModal, setShowConfirmModal] = useState(false)
   const { mutateAsync: convert, isPending } = useConvertDatasetToPipeline()
   const invalidDatasetDetail = useInvalid([...datasetDetailQueryKeyPrefix, datasetId])
+  const datasetACLCapabilities = React.useMemo(() => getDatasetACLCapabilities(dataset?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset?.maintainer,
+    workspacePermissionKeys,
+  }), [currentUserId, dataset?.maintainer, dataset?.permission_keys, workspacePermissionKeys])
+  const canConvertDataset = datasetACLCapabilities.canEdit
   const handleConvert = useCallback(() => {
+    if (!canConvertDataset || !datasetId)
+      return
+
     convert(datasetId as string, {
       onSuccess: (res) => {
         if (res.status === 'success') {
@@ -40,10 +55,13 @@ const Conversion = () => {
         toast.error(t('conversion.errorMessage', { ns: 'datasetPipeline' }))
       },
     })
-  }, [convert, datasetId, invalidDatasetDetail, t])
+  }, [canConvertDataset, convert, datasetId, invalidDatasetDetail, t])
   const handleShowConfirmModal = useCallback(() => {
+    if (!canConvertDataset)
+      return
+
     setShowConfirmModal(true)
-  }, [])
+  }, [canConvertDataset])
   const handleCancelConversion = useCallback(() => {
     setShowConfirmModal(false)
   }, [])
@@ -63,7 +81,7 @@ const Conversion = () => {
             </div>
           </div>
           <div className="flex items-center gap-x-4">
-            <Button variant="primary" className="w-32" onClick={handleShowConfirmModal}>
+            <Button variant="primary" className="w-32" disabled={!canConvertDataset} onClick={handleShowConfirmModal}>
               {t('operations.convert', { ns: 'datasetPipeline' })}
             </Button>
             <span className="system-xs-regular text-text-warning">
@@ -93,7 +111,7 @@ const Conversion = () => {
             <AlertDialogCancelButton>
               {t('operation.cancel', { ns: 'common' })}
             </AlertDialogCancelButton>
-            <AlertDialogConfirmButton loading={isPending} disabled={isPending} onClick={handleConvert}>
+            <AlertDialogConfirmButton loading={isPending} disabled={isPending || !canConvertDataset} onClick={handleConvert}>
               {t('operation.confirm', { ns: 'common' })}
             </AlertDialogConfirmButton>
           </AlertDialogActions>
diff --git a/web/app/components/rag-pipeline/components/panel/input-field/__tests__/index.spec.tsx b/web/app/components/rag-pipeline/components/panel/input-field/__tests__/index.spec.tsx
index d362b31057f..8b9b93480c5 100644
--- a/web/app/components/rag-pipeline/components/panel/input-field/__tests__/index.spec.tsx
+++ b/web/app/components/rag-pipeline/components/panel/input-field/__tests__/index.spec.tsx
@@ -16,6 +16,7 @@ const mockCloseAllInputFieldPanels = vi.fn()
 const mockToggleInputFieldPreviewPanel = vi.fn()
 let mockIsPreviewing = false
 let mockIsEditing = false
+let mockCanEdit = true
 
 vi.mock('@/app/components/rag-pipeline/hooks', () => ({
   useInputFieldPanel: () => ({
@@ -26,6 +27,15 @@ vi.mock('@/app/components/rag-pipeline/hooks', () => ({
   }),
 }))
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canEdit: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canEdit: mockCanEdit,
+      },
+    }),
+}))
+
 let mockRagPipelineVariables: RAGPipelineVariables = []
 const mockSetRagPipelineVariables = vi.fn()
 
@@ -178,11 +188,13 @@ const setupMocks = (options?: {
   ragPipelineVariables?: RAGPipelineVariables
   isPreviewing?: boolean
   isEditing?: boolean
+  canEdit?: boolean
 }) => {
   mockNodesData = options?.nodes || []
   mockRagPipelineVariables = options?.ragPipelineVariables || []
   mockIsPreviewing = options?.isPreviewing || false
   mockIsEditing = options?.isEditing || false
+  mockCanEdit = options?.canEdit ?? true
 }
 
 describe('InputFieldPanel', () => {
@@ -429,6 +441,16 @@ describe('InputFieldPanel', () => {
         'false',
       )
     })
+
+    it('should set readonly to true when access control cannot edit', () => {
+      setupMocks({ canEdit: false })
+
+      render(<InputFieldPanel />)
+
+      expect(screen.getByTestId('field-list-readonly-shared'))!.toHaveTextContent(
+        'true',
+      )
+    })
   })
 
   describe('Input Fields Change Handler', () => {
@@ -514,6 +536,41 @@ describe('InputFieldPanel', () => {
       const hasSharedField = setVarsCall.some(isSharedField)
       expect(hasSharedField).toBe(true)
     })
+
+    it('should ignore input field changes when access control cannot edit', () => {
+      const nodes = [createDataSourceNode('node-1', 'DataSource 1')]
+      setupMocks({ nodes, canEdit: false })
+      render(<InputFieldPanel />)
+
+      fireEvent.click(screen.getByTestId('trigger-change-node-1'))
+
+      expect(mockSetRagPipelineVariables).not.toHaveBeenCalled()
+      expect(mockHandleSyncWorkflowDraft).not.toHaveBeenCalled()
+    })
+
+    it('should ignore input field changes while previewing', () => {
+      const nodes = [createDataSourceNode('node-1', 'DataSource 1')]
+      setupMocks({ nodes, isPreviewing: true })
+      render(<InputFieldPanel />)
+
+      fireEvent.click(screen.getByTestId('trigger-change-node-1'))
+
+      expect(mockSetRagPipelineVariables).not.toHaveBeenCalled()
+      expect(mockHandleSyncWorkflowDraft).not.toHaveBeenCalled()
+    })
+
+    it('should still persist input field changes while edit panel is open if access control can edit', async () => {
+      const nodes = [createDataSourceNode('node-1', 'DataSource 1')]
+      setupMocks({ nodes, isEditing: true, canEdit: true })
+      render(<InputFieldPanel />)
+
+      fireEvent.click(screen.getByTestId('trigger-change-node-1'))
+
+      await waitFor(() => {
+        expect(mockSetRagPipelineVariables).toHaveBeenCalled()
+      })
+      expect(mockHandleSyncWorkflowDraft).toHaveBeenCalled()
+    })
   })
 
   describe('Label Class Names', () => {
diff --git a/web/app/components/rag-pipeline/components/panel/input-field/index.tsx b/web/app/components/rag-pipeline/components/panel/input-field/index.tsx
index 3572d6012fc..410cbb3f75f 100644
--- a/web/app/components/rag-pipeline/components/panel/input-field/index.tsx
+++ b/web/app/components/rag-pipeline/components/panel/input-field/index.tsx
@@ -16,6 +16,7 @@ import Divider from '@/app/components/base/divider'
 import { Infotip } from '@/app/components/base/infotip'
 import { useInputFieldPanel } from '@/app/components/rag-pipeline/hooks'
 import { useNodesSyncDraft } from '@/app/components/workflow/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { useStore } from '@/app/components/workflow/store'
 import { BlockEnum } from '@/app/components/workflow/types'
 import FieldList from './field-list'
@@ -32,6 +33,9 @@ const InputFieldPanel = () => {
     isPreviewing,
     isEditing,
   } = useInputFieldPanel()
+  const canEdit = useHooksStore(s => s.accessControl.canEdit)
+  const shouldIgnoreInputFieldChange = !canEdit || isPreviewing
+  const isReadonly = shouldIgnoreInputFieldChange || isEditing
   const ragPipelineVariables = useStore(state => state.ragPipelineVariables)
   const setRagPipelineVariables = useStore(state => state.setRagPipelineVariables)
 
@@ -61,6 +65,9 @@ const InputFieldPanel = () => {
   }, [nodes])
 
   const updateInputFields = useCallback(async (key: string, value: InputVar[]) => {
+    if (shouldIgnoreInputFieldChange)
+      return
+
     inputFieldsMap.current[key] = value
     const datasourceNodeInputFields: RAGPipelineVariables = []
     const globalInputFields: RAGPipelineVariables = []
@@ -85,7 +92,7 @@ const InputFieldPanel = () => {
     const newRagPipelineVariables = [...datasourceNodeInputFields, ...globalInputFields]
     setRagPipelineVariables?.(newRagPipelineVariables)
     handleSyncWorkflowDraft()
-  }, [setRagPipelineVariables, handleSyncWorkflowDraft])
+  }, [shouldIgnoreInputFieldChange, setRagPipelineVariables, handleSyncWorkflowDraft])
 
   const closePanel = useCallback(() => {
     closeAllInputFieldPanels()
@@ -154,7 +161,7 @@ const InputFieldPanel = () => {
                   nodeId={key}
                   LabelRightContent={<Datasource nodeData={datasourceNodeDataMap[key]!} />}
                   inputFields={inputFields}
-                  readonly={isPreviewing || isEditing}
+                  readonly={isReadonly}
                   labelClassName="pt-1 pb-1"
                   handleInputFieldsChange={updateInputFields}
                   allVariableNames={allVariableNames}
@@ -168,7 +175,7 @@ const InputFieldPanel = () => {
           nodeId="shared"
           LabelRightContent={<GlobalInputs />}
           inputFields={inputFieldsMap.current.shared || []}
-          readonly={isPreviewing || isEditing}
+          readonly={isReadonly}
           labelClassName="pt-2 pb-1"
           handleInputFieldsChange={updateInputFields}
           allVariableNames={allVariableNames}
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-children.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-children.tsx
index 3ce17737aaf..c5539114bed 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-children.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-children.tsx
@@ -9,6 +9,7 @@ import {
   useDSL,
   usePanelInteractions,
 } from '@/app/components/workflow/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { useEventEmitterContextContext } from '@/context/event-emitter'
 import PluginDependency from '../../workflow/plugin-dependency'
 import { useStore } from '../../workflow/store'
@@ -23,6 +24,7 @@ const RagPipelineChildren = () => {
   const [secretEnvList, setSecretEnvList] = useState<EnvironmentVariable[]>([])
   const showImportDSLModal = useStore(s => s.showImportDSLModal)
   const setShowImportDSLModal = useStore(s => s.setShowImportDSLModal)
+  const canImportExportDSL = useHooksStore(s => s.accessControl.canImportExportDSL)
   const {
     handlePaneContextmenuCancel,
   } = usePanelInteractions()
@@ -43,7 +45,7 @@ const RagPipelineChildren = () => {
     <>
       <PluginDependency />
       {
-        showImportDSLModal && (
+        canImportExportDSL && showImportDSLModal && (
           <UpdateDSLModal
             onCancel={() => setShowImportDSLModal(false)}
             onBackup={exportCheck!}
@@ -52,7 +54,7 @@ const RagPipelineChildren = () => {
         )
       }
       {
-        secretEnvList.length > 0 && (
+        canImportExportDSL && secretEnvList.length > 0 && (
           <DSLExportConfirmModal
             envList={secretEnvList}
             onConfirm={handleExportDSL!}
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-header/__tests__/index.spec.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-header/__tests__/index.spec.tsx
index 69f93d12051..72ea0e06f4a 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-header/__tests__/index.spec.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-header/__tests__/index.spec.tsx
@@ -50,6 +50,16 @@ vi.mock('@/app/components/workflow/store', () => ({
   }),
 }))
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canRun: boolean, canReleaseAndVersion: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canRun: true,
+        canReleaseAndVersion: true,
+      },
+    }),
+}))
+
 const mockHandleSyncWorkflowDraft = vi.fn()
 const mockHandleCheckBeforePublish = vi.fn().mockResolvedValue(true)
 const mockHandleStopRun = vi.fn()
@@ -122,8 +132,29 @@ vi.mock('@/service/knowledge/use-dataset', () => ({
 }))
 
 const mockMutateDatasetRes = vi.fn()
+let mockDatasetPermissionKeys = ['dataset.acl.use']
+let mockDatasetMaintainer: string | undefined
+let mockCurrentUserId = 'user-1'
+let mockIsLoadingWorkspacePermissionKeys = false
+let mockWorkspacePermissionKeys: string[] = []
 vi.mock('@/context/dataset-detail', () => ({
-  useDatasetDetailContextWithSelector: () => mockMutateDatasetRes,
+  useDatasetDetailContextWithSelector: (selector: (state: Record<string, unknown>) => unknown) => selector({
+    dataset: {
+      permission_keys: mockDatasetPermissionKeys,
+      maintainer: mockDatasetMaintainer,
+    },
+    mutateDatasetRes: mockMutateDatasetRes,
+  }),
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: Record<string, unknown>) => unknown) => selector({
+    userProfile: {
+      id: mockCurrentUserId,
+    },
+    isLoadingWorkspacePermissionKeys: mockIsLoadingWorkspacePermissionKeys,
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
 }))
 
 const mockSetShowPricingModal = vi.fn()
@@ -221,6 +252,11 @@ describe('RagPipelineHeader', () => {
       setShowEnvPanel: mockSetShowEnvPanel,
     }
     mockProviderContextValue = createMockProviderContextValue()
+    mockDatasetPermissionKeys = ['dataset.acl.use']
+    mockDatasetMaintainer = undefined
+    mockCurrentUserId = 'user-1'
+    mockIsLoadingWorkspacePermissionKeys = false
+    mockWorkspacePermissionKeys = []
   })
 
   describe('Rendering', () => {
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-header/__tests__/run-mode.spec.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-header/__tests__/run-mode.spec.tsx
index 7655952aede..7c02bd65b23 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-header/__tests__/run-mode.spec.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-header/__tests__/run-mode.spec.tsx
@@ -35,6 +35,12 @@ vi.mock('@/app/components/workflow/store', () => ({
   }),
 }))
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: (selector: (state: { accessControl: { canRun: boolean } }) => unknown) => selector({
+    accessControl: { canRun: true },
+  }),
+}))
+
 vi.mock('@/app/components/workflow/types', () => ({
   WorkflowRunningStatus: { Running: 'running' },
 }))
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/__tests__/index.spec.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/__tests__/index.spec.tsx
index bb50bf2f689..9625edc7e57 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/__tests__/index.spec.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/__tests__/index.spec.tsx
@@ -93,10 +93,21 @@ vi.mock('@/app/components/workflow/hooks', () => ({
   }),
 }))
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: (selector: (state: { accessControl: { canReleaseAndVersion: boolean } }) => unknown) => selector({
+    accessControl: { canReleaseAndVersion: true },
+  }),
+}))
+
 const mockPublishedAt = vi.fn(() => null as number | null)
 const mockDraftUpdatedAt = vi.fn(() => 1700000000)
 const mockPipelineId = vi.fn(() => 'test-pipeline-id')
 const mockSetPublishedAt = vi.fn()
+let mockDatasetPermissionKeys = ['dataset.acl.use']
+let mockDatasetMaintainer: string | undefined
+let mockCurrentUserId = 'user-1'
+let mockIsLoadingWorkspacePermissionKeys = false
+let mockWorkspacePermissionKeys: string[] = []
 
 vi.mock('@/app/components/workflow/store', () => ({
   useStore: (selector: (s: Record<string, unknown>) => unknown) => {
@@ -117,11 +128,27 @@ vi.mock('@/app/components/workflow/store', () => ({
 const mockMutateDatasetRes = vi.fn()
 vi.mock('@/context/dataset-detail', () => ({
   useDatasetDetailContextWithSelector: (selector: (s: Record<string, unknown>) => unknown) => {
-    const state = { mutateDatasetRes: mockMutateDatasetRes }
+    const state = {
+      dataset: {
+        permission_keys: mockDatasetPermissionKeys,
+        maintainer: mockDatasetMaintainer,
+      },
+      mutateDatasetRes: mockMutateDatasetRes,
+    }
     return selector(state)
   },
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: Record<string, unknown>) => unknown) => selector({
+    userProfile: {
+      id: mockCurrentUserId,
+    },
+    isLoadingWorkspacePermissionKeys: mockIsLoadingWorkspacePermissionKeys,
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 const mockSetShowPricingModal = vi.fn()
 vi.mock('@/context/modal-context', () => ({
   useModalContextSelector: <T,>(selector: (state: { setShowPricingModal: typeof mockSetShowPricingModal }) => T): T =>
@@ -247,6 +274,11 @@ describe('publisher', () => {
     mockPipelineId.mockReturnValue('test-pipeline-id')
     mockIsAllowPublishAsCustomKnowledgePipelineTemplate.mockReturnValue(true)
     mockHandleCheckBeforePublish.mockResolvedValue(true)
+    mockDatasetPermissionKeys = ['dataset.acl.use']
+    mockDatasetMaintainer = undefined
+    mockCurrentUserId = 'user-1'
+    mockIsLoadingWorkspacePermissionKeys = false
+    mockWorkspacePermissionKeys = []
   })
 
   describe('Publisher (index.tsx)', () => {
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/__tests__/popup.spec.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/__tests__/popup.spec.tsx
index e6f39fc91ea..8ba56ad0af0 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/__tests__/popup.spec.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/__tests__/popup.spec.tsx
@@ -61,6 +61,11 @@ let mockPublishedAt: string | undefined = '2024-01-01T00:00:00Z'
 let mockDraftUpdatedAt: string | undefined = '2024-06-01T00:00:00Z'
 let mockPipelineId: string | undefined = 'pipeline-123'
 let mockIsAllowPublishAsCustom = true
+let mockDatasetPermissionKeys = ['dataset.acl.use']
+let mockDatasetMaintainer: string | undefined
+let mockCurrentUserId = 'user-1'
+let mockIsLoadingWorkspacePermissionKeys = false
+let mockWorkspacePermissionKeys: string[] = []
 const mockUseBoolean = vi.hoisted(() => vi.fn())
 vi.mock('@/next/navigation', () => ({
   useParams: () => ({ datasetId: 'ds-123' }),
@@ -141,7 +146,23 @@ vi.mock('@/app/components/workflow/hooks', () => ({
 }))
 
 vi.mock('@/context/dataset-detail', () => ({
-  useDatasetDetailContextWithSelector: () => mockMutateDatasetRes,
+  useDatasetDetailContextWithSelector: (selector: (state: Record<string, unknown>) => unknown) => selector({
+    dataset: {
+      permission_keys: mockDatasetPermissionKeys,
+      maintainer: mockDatasetMaintainer,
+    },
+    mutateDatasetRes: mockMutateDatasetRes,
+  }),
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: Record<string, unknown>) => unknown) => selector({
+    userProfile: {
+      id: mockCurrentUserId,
+    },
+    isLoadingWorkspacePermissionKeys: mockIsLoadingWorkspacePermissionKeys,
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
 }))
 
 vi.mock('@/context/i18n', () => ({
@@ -218,6 +239,11 @@ describe('Popup', () => {
     mockDraftUpdatedAt = '2024-06-01T00:00:00Z'
     mockPipelineId = 'pipeline-123'
     mockIsAllowPublishAsCustom = true
+    mockDatasetPermissionKeys = ['dataset.acl.use']
+    mockDatasetMaintainer = undefined
+    mockCurrentUserId = 'user-1'
+    mockIsLoadingWorkspacePermissionKeys = false
+    mockWorkspacePermissionKeys = []
     mockUseBoolean.mockImplementation((initial: boolean) => [initial, {
       setFalse: vi.fn(),
       setTrue: vi.fn(),
@@ -306,6 +332,14 @@ describe('Popup', () => {
       expect(btn).toBeDisabled()
     })
 
+    it('should disable add documents button when dataset cannot add documents', () => {
+      mockDatasetPermissionKeys = ['dataset.acl.edit']
+      render(<Popup />)
+
+      const btn = screen.getByText('pipeline.common.goToAddDocuments').closest('button')
+      expect(btn).toBeDisabled()
+    })
+
     it('should disable publish-as button when not published', () => {
       mockPublishedAt = undefined
       render(<Popup />)
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/index.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/index.tsx
index c452c3b9c00..b07d21f6a42 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/index.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/index.tsx
@@ -12,6 +12,7 @@ import {
 } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useNodesSyncDraft } from '@/app/components/workflow/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { useStore } from '@/app/components/workflow/store'
 import { useDocLink } from '@/context/i18n'
 import Link from '@/next/link'
@@ -24,6 +25,7 @@ const Publisher = () => {
   const [open, setOpen] = useState(false)
   const [confirmVisible, { setFalse: hideConfirm, setTrue: showConfirm }] = useBoolean(false)
   const { handleSyncWorkflowDraft } = useNodesSyncDraft()
+  const canPipelineRelease = useHooksStore(s => s.accessControl.canReleaseAndVersion)
   const docLink = useDocLink()
   const pipelineId = useStore(s => s.pipelineId)
   const { mutateAsync: publishAsCustomizedPipeline } = usePublishAsCustomizedPipeline()
@@ -34,10 +36,10 @@ const Publisher = () => {
   const handleOpenChange = useCallback((newOpen: boolean) => {
     if (!newOpen && confirmVisible)
       return
-    if (newOpen)
+    if (newOpen && canPipelineRelease)
       handleSyncWorkflowDraft(true)
-    setOpen(newOpen)
-  }, [confirmVisible, handleSyncWorkflowDraft])
+    setOpen(canPipelineRelease && newOpen)
+  }, [confirmVisible, handleSyncWorkflowDraft, canPipelineRelease])
   const closePopover = useCallback(() => {
     setOpen(false)
   }, [])
@@ -91,6 +93,7 @@ const Publisher = () => {
             <Button
               className="px-2"
               variant="primary"
+              disabled={!canPipelineRelease}
             >
               <span className="pl-1">{t('common.publish', { ns: 'workflow' })}</span>
               <RiArrowDownSLine className="size-4" />
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/popup.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/popup.tsx
index 6d12adf42e3..1baad279036 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/popup.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-header/publisher/popup.tsx
@@ -24,6 +24,7 @@ import PremiumBadge from '@/app/components/base/premium-badge'
 import { useChecklistBeforePublish } from '@/app/components/workflow/hooks'
 import { useStore, useWorkflowStore } from '@/app/components/workflow/store'
 import { IS_CLOUD_EDITION } from '@/config'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import { useModalContextSelector } from '@/context/modal-context'
 import { useProviderContextSelector } from '@/context/provider-context'
@@ -35,6 +36,7 @@ import { useInvalidDatasetList } from '@/service/knowledge/use-dataset'
 import { useInvalid } from '@/service/use-base'
 import { publishedPipelineInfoQueryKeyPrefix } from '@/service/use-pipeline'
 import { usePublishWorkflow } from '@/service/use-workflow'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 
 const PUBLISH_SHORTCUT = ['Mod', 'Shift', 'P']
 type PopupProps = {
@@ -60,7 +62,11 @@ const Popup = ({
   const publishedAt = useStore(s => s.publishedAt)
   const draftUpdatedAt = useStore(s => s.draftUpdatedAt)
   const pipelineId = useStore(s => s.pipelineId)
+  const dataset = useDatasetDetailContextWithSelector(s => s.dataset)
   const mutateDatasetRes = useDatasetDetailContextWithSelector(s => s.mutateDatasetRes)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const isLoadingWorkspacePermissionKeys = useAppContextWithSelector(state => state.isLoadingWorkspacePermissionKeys)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const [published, setPublished] = useState(false)
   const { formatTimeFromNow } = useFormatTimeFromNow()
   const { handleCheckBeforePublish } = useChecklistBeforePublish()
@@ -69,6 +75,12 @@ const Popup = ({
   const isAllowPublishAsCustomKnowledgePipelineTemplate = useProviderContextSelector(s => s.isAllowPublishAsCustomKnowledgePipelineTemplate)
   const setShowPricingModal = useModalContextSelector(s => s.setShowPricingModal)
   const apiReferenceUrl = useDatasetApiAccessUrl()
+  const canAddDocumentsToDataset = getDatasetACLCapabilities(dataset?.permission_keys, {
+    currentUserId,
+    resourceMaintainer: dataset?.maintainer,
+    workspacePermissionKeys,
+  }).canUse
+  const isAddDocumentsDisabled = !publishedAt || isLoadingWorkspacePermissionKeys || !canAddDocumentsToDataset
   const [localConfirmVisible, { setFalse: hideLocalConfirm, setTrue: showLocalConfirm }] = useBoolean(false)
   const confirmVisible = controlledConfirmVisible ?? localConfirmVisible
   const showConfirm = onShowConfirm ?? showLocalConfirm
@@ -141,8 +153,11 @@ const Popup = ({
     handlePublish()
   })
   const goToAddDocuments = useCallback(() => {
+    if (isAddDocumentsDisabled)
+      return
+
     push(`/datasets/${datasetId}/documents/create-from-pipeline`)
-  }, [datasetId, push])
+  }, [datasetId, isAddDocumentsDisabled, push])
   const handleClickPublishAsKnowledgePipeline = useCallback(() => {
     onRequestClose?.()
     if (!isAllowPublishAsCustomKnowledgePipelineTemplate) {
@@ -193,7 +208,7 @@ const Popup = ({
         </Button>
       </div>
       <div className="border-t-[0.5px] border-t-divider-regular p-4 pt-3">
-        <Button className="mb-1 w-full hover:bg-state-accent-hover hover:text-text-accent" variant="tertiary" onClick={goToAddDocuments} disabled={!publishedAt}>
+        <Button className="mb-1 w-full hover:bg-state-accent-hover hover:text-text-accent" variant="tertiary" onClick={goToAddDocuments} disabled={isAddDocumentsDisabled}>
           <div className="flex grow items-center">
             <RiPlayCircleLine className="mr-2 size-4" />
             {t('common.goToAddDocuments', { ns: 'pipeline' })}
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-header/run-mode.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-header/run-mode.tsx
index 2002141265b..71c44c5b6f4 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-header/run-mode.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-header/run-mode.tsx
@@ -7,6 +7,7 @@ import { useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
 import { StopCircle } from '@/app/components/base/icons/src/vender/line/mediaAndDevices'
 import { useWorkflowRun, useWorkflowStartRun } from '@/app/components/workflow/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { useStore, useWorkflowStore } from '@/app/components/workflow/store'
 import { WorkflowRunningStatus } from '@/app/components/workflow/types'
 import { EVENT_WORKFLOW_STOP } from '@/app/components/workflow/variable-inspect/types'
@@ -25,9 +26,10 @@ const RunMode = ({
   const workflowStore = useWorkflowStore()
   const workflowRunningData = useStore(s => s.workflowRunningData)
   const isPreparingDataSource = useStore(s => s.isPreparingDataSource)
+  const canRun = useHooksStore(s => s.accessControl.canRun)
 
   const isRunning = workflowRunningData?.result.status === WorkflowRunningStatus.Running
-  const isDisabled = isPreparingDataSource || isRunning
+  const isDisabled = isPreparingDataSource || isRunning || !canRun
 
   const handleStop = useCallback(() => {
     handleStopRun(workflowRunningData?.task_id || '')
@@ -45,6 +47,9 @@ const RunMode = ({
       handleStop()
   })
 
+  if (!canRun)
+    return null
+
   return (
     <div className="flex items-center gap-x-px">
       <button
@@ -55,7 +60,8 @@ const RunMode = ({
           isDisabled ? 'rounded-l-md' : 'rounded-md',
         )}
         onClick={() => {
-          handleWorkflowStartRunInWorkflow()
+          if (canRun)
+            handleWorkflowStartRunInWorkflow()
         }}
         disabled={isDisabled}
       >
diff --git a/web/app/components/rag-pipeline/components/rag-pipeline-main.tsx b/web/app/components/rag-pipeline/components/rag-pipeline-main.tsx
index 7175b0675ee..e8b05c576e9 100644
--- a/web/app/components/rag-pipeline/components/rag-pipeline-main.tsx
+++ b/web/app/components/rag-pipeline/components/rag-pipeline-main.tsx
@@ -6,14 +6,17 @@ import {
 import { WorkflowWithInnerContext } from '@/app/components/workflow'
 import { useSetWorkflowVarsWithValue } from '@/app/components/workflow/hooks/use-fetch-workflow-inspect-vars'
 import { useWorkflowStore } from '@/app/components/workflow/store'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import {
   useAvailableNodesMetaData,
-  useDSL,
+  useDSLByCanEdit,
   useGetRunAndTraceUrl,
-  useNodesSyncDraft,
+  useNodesSyncDraftByCanEdit,
   usePipelineRefreshDraft,
-  usePipelineRun,
-  usePipelineStartRun,
+  usePipelineRunByCanEdit,
+  usePipelineStartRunByCanEdit,
 } from '../hooks'
 import { useConfigsMap } from '../hooks/use-configs-map'
 import { useInspectVarsCrud } from '../hooks/use-inspect-vars-crud'
@@ -26,6 +29,17 @@ const RagPipelineMain = ({
   viewport,
 }: RagPipelineMainProps) => {
   const workflowStore = useWorkflowStore()
+  const dataset = useDatasetDetailContextWithSelector(s => s.dataset)
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const datasetACLCapabilities = useMemo(
+    () => getDatasetACLCapabilities(dataset?.permission_keys, {
+      currentUserId,
+      resourceMaintainer: dataset?.maintainer,
+      workspacePermissionKeys,
+    }),
+    [dataset?.maintainer, dataset?.permission_keys, currentUserId, workspacePermissionKeys],
+  )
 
   const handleWorkflowDataUpdate = useCallback((payload: any) => {
     const {
@@ -45,7 +59,7 @@ const RagPipelineMain = ({
   const {
     doSyncWorkflowDraft,
     syncWorkflowDraftWhenPageClose,
-  } = useNodesSyncDraft()
+  } = useNodesSyncDraftByCanEdit(datasetACLCapabilities.canEdit)
   const { handleRefreshWorkflowDraft } = usePipelineRefreshDraft()
   const {
     handleBackupDraft,
@@ -53,17 +67,17 @@ const RagPipelineMain = ({
     handleRestoreFromPublishedWorkflow,
     handleRun,
     handleStopRun,
-  } = usePipelineRun()
+  } = usePipelineRunByCanEdit(datasetACLCapabilities.canEdit)
   const {
     handleStartWorkflowRun,
     handleWorkflowStartRunInWorkflow,
-  } = usePipelineStartRun()
+  } = usePipelineStartRunByCanEdit(datasetACLCapabilities.canEdit)
   const availableNodesMetaData = useAvailableNodesMetaData()
   const { getWorkflowRunAndTraceUrl } = useGetRunAndTraceUrl()
   const {
     exportCheck,
     handleExportDSL,
-  } = useDSL()
+  } = useDSLByCanEdit(datasetACLCapabilities.canEdit)
 
   const configsMap = useConfigsMap()
   const { fetchInspectVars } = useSetWorkflowVarsWithValue({
@@ -117,6 +131,13 @@ const RagPipelineMain = ({
       invalidateSysVarValues,
       resetConversationVar,
       invalidateConversationVarValues,
+      accessControl: {
+        canEdit: datasetACLCapabilities.canEdit,
+        canComment: datasetACLCapabilities.canReadonly || datasetACLCapabilities.canEdit,
+        canRun: datasetACLCapabilities.canPipelineTest,
+        canImportExportDSL: datasetACLCapabilities.canImportExportDSL,
+        canReleaseAndVersion: datasetACLCapabilities.canPipelineRelease,
+      },
       configsMap,
     }
   }, [
@@ -149,6 +170,7 @@ const RagPipelineMain = ({
     invalidateSysVarValues,
     resetConversationVar,
     invalidateConversationVarValues,
+    datasetACLCapabilities,
     configsMap,
   ])
 
diff --git a/web/app/components/rag-pipeline/hooks/__tests__/use-available-nodes-meta-data.spec.ts b/web/app/components/rag-pipeline/hooks/__tests__/use-available-nodes-meta-data.spec.ts
index f3d04533da3..9ed0dbfd15d 100644
--- a/web/app/components/rag-pipeline/hooks/__tests__/use-available-nodes-meta-data.spec.ts
+++ b/web/app/components/rag-pipeline/hooks/__tests__/use-available-nodes-meta-data.spec.ts
@@ -3,10 +3,16 @@ import { describe, expect, it, vi } from 'vitest'
 import { BlockEnum } from '@/app/components/workflow/types'
 import { useAvailableNodesMetaData } from '../use-available-nodes-meta-data'
 
+const mockIsAgentV2Enabled = vi.hoisted(() => vi.fn(() => true))
+
 vi.mock('@/context/i18n', () => ({
   useDocLink: () => (path?: string) => `https://docs.dify.ai${path || ''}`,
 }))
 
+vi.mock('@/features/agent-v2/feature-flag', () => ({
+  isAgentV2Enabled: () => mockIsAgentV2Enabled(),
+}))
+
 vi.mock('@/app/components/workflow/constants/node', () => ({
   WORKFLOW_COMMON_NODES: [
     {
@@ -21,6 +27,14 @@ vi.mock('@/app/components/workflow/constants/node', () => ({
       metaData: { type: BlockEnum.HttpRequest },
       defaultValue: { title: 'HTTP Request' },
     },
+    {
+      metaData: { type: BlockEnum.Agent },
+      defaultValue: { title: 'Agent' },
+    },
+    {
+      metaData: { type: BlockEnum.AgentV2 },
+      defaultValue: { title: 'Agent' },
+    },
   ],
 }))
 
@@ -46,6 +60,11 @@ vi.mock('@/app/components/workflow/nodes/knowledge-base/default', () => ({
 }))
 
 describe('useAvailableNodesMetaData', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockIsAgentV2Enabled.mockReturnValue(true)
+  })
+
   it('should return nodes and nodesMap', () => {
     const { result } = renderHook(() => useAvailableNodesMetaData())
 
@@ -98,7 +117,7 @@ describe('useAvailableNodesMetaData', () => {
     const { result } = renderHook(() => useAvailableNodesMetaData())
 
     result.current.nodes.forEach((node) => {
-      expect(node.defaultValue.type).toBe(node.metaData.type)
+      expect(node.defaultValue.type).toBe(node.metaData.type === BlockEnum.AgentV2 ? BlockEnum.Agent : node.metaData.type)
       expect(node.defaultValue.title).toBe(node.metaData.title)
     })
   })
@@ -127,4 +146,26 @@ describe('useAvailableNodesMetaData', () => {
     expect(nodeTypes).toContain(BlockEnum.HttpRequest)
     expect(nodeTypes).not.toContain(BlockEnum.HumanInput)
   })
+
+  it('should expose Agent v2 instead of legacy Agent when Agent v2 is enabled', () => {
+    const { result } = renderHook(() => useAvailableNodesMetaData())
+    const nodeTypes = result.current.nodes.map(n => n.metaData.type)
+
+    expect(nodeTypes).toContain(BlockEnum.AgentV2)
+    expect(nodeTypes).not.toContain(BlockEnum.Agent)
+    expect(result.current.nodesMap[BlockEnum.AgentV2]).toBeDefined()
+    expect(result.current.nodesMap[BlockEnum.Agent]).toBeUndefined()
+  })
+
+  it('should expose legacy Agent instead of Agent v2 when Agent v2 is disabled', () => {
+    mockIsAgentV2Enabled.mockReturnValue(false)
+
+    const { result } = renderHook(() => useAvailableNodesMetaData())
+    const nodeTypes = result.current.nodes.map(n => n.metaData.type)
+
+    expect(nodeTypes).toContain(BlockEnum.Agent)
+    expect(nodeTypes).not.toContain(BlockEnum.AgentV2)
+    expect(result.current.nodesMap[BlockEnum.Agent]).toBeDefined()
+    expect(result.current.nodesMap[BlockEnum.AgentV2]).toBeUndefined()
+  })
 })
diff --git a/web/app/components/rag-pipeline/hooks/use-DSL.ts b/web/app/components/rag-pipeline/hooks/use-DSL.ts
index 12bcbe041b0..249862450ef 100644
--- a/web/app/components/rag-pipeline/hooks/use-DSL.ts
+++ b/web/app/components/rag-pipeline/hooks/use-DSL.ts
@@ -7,13 +7,17 @@ import { useEventEmitterContextContext } from '@/context/event-emitter'
 import { useExportPipelineDSL } from '@/service/use-pipeline'
 import { fetchWorkflowDraft } from '@/service/workflow'
 import { downloadBlob } from '@/utils/download'
-import { useNodesSyncDraft } from './use-nodes-sync-draft'
+import {
+  useNodesSyncDraft,
+  useNodesSyncDraftByCanEdit,
+} from './use-nodes-sync-draft'
 
-export const useDSL = () => {
+type DoSyncWorkflowDraft = ReturnType<typeof useNodesSyncDraft>['doSyncWorkflowDraft']
+
+const useDSLBase = (doSyncWorkflowDraft: DoSyncWorkflowDraft) => {
   const { t } = useTranslation()
   const { eventEmitter } = useEventEmitterContextContext()
   const [exporting, setExporting] = useState(false)
-  const { doSyncWorkflowDraft } = useNodesSyncDraft()
   const workflowStore = useWorkflowStore()
   const { mutateAsync: exportPipelineConfig } = useExportPipelineDSL()
   const handleExportDSL = useCallback(async (include = false) => {
@@ -66,3 +70,15 @@ export const useDSL = () => {
     handleExportDSL,
   }
 }
+
+export const useDSLByCanEdit = (canEdit: boolean) => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraftByCanEdit(canEdit)
+
+  return useDSLBase(doSyncWorkflowDraft)
+}
+
+export const useDSL = () => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraft()
+
+  return useDSLBase(doSyncWorkflowDraft)
+}
diff --git a/web/app/components/rag-pipeline/hooks/use-available-nodes-meta-data.ts b/web/app/components/rag-pipeline/hooks/use-available-nodes-meta-data.ts
index eaadf471062..c5d92844342 100644
--- a/web/app/components/rag-pipeline/hooks/use-available-nodes-meta-data.ts
+++ b/web/app/components/rag-pipeline/hooks/use-available-nodes-meta-data.ts
@@ -1,4 +1,5 @@
 import type { AvailableNodesMetaData } from '@/app/components/workflow/hooks-store/store'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { WORKFLOW_COMMON_NODES } from '@/app/components/workflow/constants/node'
@@ -7,14 +8,21 @@ import dataSourceDefault from '@/app/components/workflow/nodes/data-source/defau
 import knowledgeBaseDefault from '@/app/components/workflow/nodes/knowledge-base/default'
 import { BlockEnum } from '@/app/components/workflow/types'
 import { useDocLink } from '@/context/i18n'
+import { isAgentV2Enabled } from '@/features/agent-v2/feature-flag'
 
 export const useAvailableNodesMetaData = () => {
   const { t } = useTranslation()
   const docLink = useDocLink()
+  const agentV2Enabled = isAgentV2Enabled()
 
   const mergedNodesMetaData = useMemo(() => [
-    // RAG pipeline doesn't support human-input node temporarily
-    ...WORKFLOW_COMMON_NODES.filter(node => node.metaData.type !== BlockEnum.HumanInput),
+    ...WORKFLOW_COMMON_NODES.filter(node =>
+      node.metaData.type !== BlockEnum.HumanInput
+      && (
+        agentV2Enabled
+          ? node.metaData.type !== BlockEnum.Agent
+          : node.metaData.type !== BlockEnum.AgentV2
+      )),
     {
       ...dataSourceDefault,
       defaultValue: {
@@ -24,7 +32,7 @@ export const useAvailableNodesMetaData = () => {
     },
     knowledgeBaseDefault,
     dataSourceEmptyDefault,
-  ], [])
+  ], [agentV2Enabled])
 
   const helpLinkUri = useMemo(() => docLink(
     '/use-dify/knowledge/knowledge-pipeline/knowledge-pipeline-orchestration',
@@ -33,7 +41,7 @@ export const useAvailableNodesMetaData = () => {
   const availableNodesMetaData = useMemo(() => mergedNodesMetaData.map((node) => {
     const { metaData } = node
     const title = t(`blocks.${metaData.type}`, { ns: 'workflow' })
-    const description = t(`blocksAbout.${metaData.type}`, { ns: 'workflow' })
+    const description = t(`blocksAbout.${metaData.type}` as I18nKeysWithPrefix<'workflow', 'blocksAbout.'>, { ns: 'workflow' })
     return {
       ...node,
       metaData: {
@@ -44,7 +52,7 @@ export const useAvailableNodesMetaData = () => {
       },
       defaultValue: {
         ...node.defaultValue,
-        type: metaData.type,
+        type: metaData.type === BlockEnum.AgentV2 ? BlockEnum.Agent : metaData.type,
         title,
       },
     }
diff --git a/web/app/components/rag-pipeline/hooks/use-nodes-sync-draft.ts b/web/app/components/rag-pipeline/hooks/use-nodes-sync-draft.ts
index 184adb582ff..fe5d8df971c 100644
--- a/web/app/components/rag-pipeline/hooks/use-nodes-sync-draft.ts
+++ b/web/app/components/rag-pipeline/hooks/use-nodes-sync-draft.ts
@@ -5,6 +5,7 @@ import { useStoreApi } from 'reactflow'
 import { useSerialAsyncCallback } from '@/app/components/workflow/hooks/use-serial-async-callback'
 import {
   useNodesReadOnly,
+  useNodesReadOnlyByCanEdit,
 } from '@/app/components/workflow/hooks/use-workflow'
 import {
   useWorkflowStore,
@@ -14,10 +15,9 @@ import { postWithKeepalive } from '@/service/fetch'
 import { syncWorkflowDraft } from '@/service/workflow'
 import { usePipelineRefreshDraft } from '.'
 
-export const useNodesSyncDraft = () => {
+const useNodesSyncDraftBase = (getNodesReadOnly: () => boolean) => {
   const store = useStoreApi()
   const workflowStore = useWorkflowStore()
-  const { getNodesReadOnly } = useNodesReadOnly()
   const { handleRefreshWorkflowDraft } = usePipelineRefreshDraft()
 
   const getPostParams = useCallback(() => {
@@ -123,3 +123,15 @@ export const useNodesSyncDraft = () => {
     syncWorkflowDraftWhenPageClose,
   }
 }
+
+export const useNodesSyncDraftByCanEdit = (canEdit: boolean) => {
+  const { getNodesReadOnly } = useNodesReadOnlyByCanEdit(canEdit)
+
+  return useNodesSyncDraftBase(getNodesReadOnly)
+}
+
+export const useNodesSyncDraft = () => {
+  const { getNodesReadOnly } = useNodesReadOnly()
+
+  return useNodesSyncDraftBase(getNodesReadOnly)
+}
diff --git a/web/app/components/rag-pipeline/hooks/use-pipeline-run.ts b/web/app/components/rag-pipeline/hooks/use-pipeline-run.ts
index b35441365b3..33387184596 100644
--- a/web/app/components/rag-pipeline/hooks/use-pipeline-run.ts
+++ b/web/app/components/rag-pipeline/hooks/use-pipeline-run.ts
@@ -15,13 +15,17 @@ import { ssePost } from '@/service/base'
 import { useInvalidAllLastRun, useInvalidateWorkflowRunHistory } from '@/service/use-workflow'
 import { stopWorkflowRun } from '@/service/workflow'
 import { FlowType } from '@/types/common'
-import { useNodesSyncDraft } from './use-nodes-sync-draft'
+import {
+  useNodesSyncDraft,
+  useNodesSyncDraftByCanEdit,
+} from './use-nodes-sync-draft'
 
-export const usePipelineRun = () => {
+type DoSyncWorkflowDraft = ReturnType<typeof useNodesSyncDraft>['doSyncWorkflowDraft']
+
+const usePipelineRunBase = (doSyncWorkflowDraft: DoSyncWorkflowDraft) => {
   const store = useStoreApi()
   const workflowStore = useWorkflowStore()
   const reactflow = useReactFlow()
-  const { doSyncWorkflowDraft } = useNodesSyncDraft()
   const { handleUpdateWorkflowCanvas } = useWorkflowUpdate()
 
   const {
@@ -315,3 +319,15 @@ export const usePipelineRun = () => {
     handleRestoreFromPublishedWorkflow,
   }
 }
+
+export const usePipelineRunByCanEdit = (canEdit: boolean) => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraftByCanEdit(canEdit)
+
+  return usePipelineRunBase(doSyncWorkflowDraft)
+}
+
+export const usePipelineRun = () => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraft()
+
+  return usePipelineRunBase(doSyncWorkflowDraft)
+}
diff --git a/web/app/components/rag-pipeline/hooks/use-pipeline-start-run.tsx b/web/app/components/rag-pipeline/hooks/use-pipeline-start-run.tsx
index ca57aefeb06..9434e6d71f5 100644
--- a/web/app/components/rag-pipeline/hooks/use-pipeline-start-run.tsx
+++ b/web/app/components/rag-pipeline/hooks/use-pipeline-start-run.tsx
@@ -7,12 +7,14 @@ import {
 import {
   useInputFieldPanel,
   useNodesSyncDraft,
+  useNodesSyncDraftByCanEdit,
 } from '.'
 
-export const usePipelineStartRun = () => {
+type DoSyncWorkflowDraft = ReturnType<typeof useNodesSyncDraft>['doSyncWorkflowDraft']
+
+const usePipelineStartRunBase = (doSyncWorkflowDraft: DoSyncWorkflowDraft) => {
   const workflowStore = useWorkflowStore()
   const { handleCancelDebugAndPreviewPanel } = useWorkflowInteractions()
-  const { doSyncWorkflowDraft } = useNodesSyncDraft()
   const { closeAllInputFieldPanels } = useInputFieldPanel()
 
   const handleWorkflowStartRunInWorkflow = useCallback(async () => {
@@ -62,3 +64,15 @@ export const usePipelineStartRun = () => {
     handleWorkflowStartRunInWorkflow,
   }
 }
+
+export const usePipelineStartRunByCanEdit = (canEdit: boolean) => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraftByCanEdit(canEdit)
+
+  return usePipelineStartRunBase(doSyncWorkflowDraft)
+}
+
+export const usePipelineStartRun = () => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraft()
+
+  return usePipelineStartRunBase(doSyncWorkflowDraft)
+}
diff --git a/web/app/components/signin/__tests__/countdown.spec.tsx b/web/app/components/signin/__tests__/countdown.spec.tsx
index 4ac0b437bb6..abd89686f17 100644
--- a/web/app/components/signin/__tests__/countdown.spec.tsx
+++ b/web/app/components/signin/__tests__/countdown.spec.tsx
@@ -1,6 +1,7 @@
 import { act, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import Countdown, { COUNT_DOWN_KEY, COUNT_DOWN_TIME_MS } from '../countdown'
+import Countdown from '../countdown'
+import { COUNT_DOWN_KEY, COUNT_DOWN_TIME_MS } from '../storage'
 
 describe('Countdown', () => {
   beforeEach(() => {
diff --git a/web/app/components/signin/countdown.tsx b/web/app/components/signin/countdown.tsx
index 627a1eea36d..54c22262d7e 100644
--- a/web/app/components/signin/countdown.tsx
+++ b/web/app/components/signin/countdown.tsx
@@ -2,9 +2,7 @@
 import { useCountDown } from 'ahooks'
 import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-
-export const COUNT_DOWN_TIME_MS = 59000
-export const COUNT_DOWN_KEY = 'leftTime'
+import { COUNT_DOWN_TIME_MS, useCountdownLeftTimeValue, useSetCountdownLeftTime } from './storage'
 
 type CountdownProps = {
   onResend?: () => void
@@ -12,24 +10,26 @@ type CountdownProps = {
 
 export default function Countdown({ onResend }: CountdownProps) {
   const { t } = useTranslation()
-  const [leftTime, setLeftTime] = useState(() => Number(localStorage.getItem(COUNT_DOWN_KEY) || COUNT_DOWN_TIME_MS))
+  const storedLeftTime = useCountdownLeftTimeValue()
+  const setStoredLeftTime = useSetCountdownLeftTime()
+  const [leftTime, setLeftTime] = useState(() => Number(storedLeftTime || COUNT_DOWN_TIME_MS))
   const [time] = useCountDown({
     leftTime,
     onEnd: () => {
       setLeftTime(0)
-      localStorage.removeItem(COUNT_DOWN_KEY)
+      setStoredLeftTime(null)
     },
   })
 
   const resend = async function () {
     setLeftTime(COUNT_DOWN_TIME_MS)
-    localStorage.setItem(COUNT_DOWN_KEY, `${COUNT_DOWN_TIME_MS}`)
+    setStoredLeftTime(`${COUNT_DOWN_TIME_MS}`)
     onResend?.()
   }
 
   useEffect(() => {
-    localStorage.setItem(COUNT_DOWN_KEY, `${time}`)
-  }, [time])
+    setStoredLeftTime(`${time}`)
+  }, [setStoredLeftTime, time])
 
   return (
     <p className="system-xs-regular text-text-tertiary">
diff --git a/web/app/components/signin/storage.ts b/web/app/components/signin/storage.ts
new file mode 100644
index 00000000000..ae5f8306b42
--- /dev/null
+++ b/web/app/components/signin/storage.ts
@@ -0,0 +1,15 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+export const COUNT_DOWN_TIME_MS = 59000
+export const COUNT_DOWN_KEY = 'leftTime'
+
+const [
+  _useCountdownLeftTime,
+  useCountdownLeftTimeValue,
+  useSetCountdownLeftTime,
+] = createLocalStorageState<string>(COUNT_DOWN_KEY, undefined, { raw: true })
+
+export {
+  useCountdownLeftTimeValue,
+  useSetCountdownLeftTime,
+}
diff --git a/web/app/components/snippet-list/__tests__/index.spec.tsx b/web/app/components/snippet-list/__tests__/index.spec.tsx
index d87db18579a..dca361764eb 100644
--- a/web/app/components/snippet-list/__tests__/index.spec.tsx
+++ b/web/app/components/snippet-list/__tests__/index.spec.tsx
@@ -70,12 +70,31 @@ vi.mock('@/service/client', () => ({
 
 const mockIsCurrentWorkspaceEditor = vi.fn(() => true)
 const mockIsCurrentWorkspaceDatasetOperator = vi.fn(() => false)
+const mockWorkspacePermissionKeys = vi.fn(() => ['snippets.create_and_modify'])
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
+  useAppContext: () => {
+    const state = {
+      isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor(),
+      isCurrentWorkspaceDatasetOperator: mockIsCurrentWorkspaceDatasetOperator(),
+      isLoadingCurrentWorkspace: false,
+      userProfile: { id: 'creator-1' },
+      workspacePermissionKeys: mockWorkspacePermissionKeys(),
+    }
+
+    return state
+  },
+  useSelector: <T,>(selector: (state: {
+    isCurrentWorkspaceEditor: boolean
+    isCurrentWorkspaceDatasetOperator: boolean
+    isLoadingCurrentWorkspace: boolean
+    userProfile: { id: string }
+    workspacePermissionKeys: string[]
+  }) => T): T => selector({
     isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor(),
     isCurrentWorkspaceDatasetOperator: mockIsCurrentWorkspaceDatasetOperator(),
     isLoadingCurrentWorkspace: false,
     userProfile: { id: 'creator-1' },
+    workspacePermissionKeys: mockWorkspacePermissionKeys(),
   }),
 }))
 
@@ -228,6 +247,7 @@ describe('SnippetList', () => {
     mockQueryState.creatorIDs = []
     mockIsCurrentWorkspaceEditor.mockReturnValue(true)
     mockIsCurrentWorkspaceDatasetOperator.mockReturnValue(false)
+    mockWorkspacePermissionKeys.mockReturnValue(['snippets.create_and_modify'])
     mockUseInfiniteSnippetList.mockReturnValue({
       ...mockSnippetListState,
       refetch: mockRefetch,
@@ -294,14 +314,35 @@ describe('SnippetList', () => {
     expect(mockSetCreatorIDs).toHaveBeenCalledWith(['creator-2'])
   })
 
-  it('hides the create button for non-editors', () => {
-    mockIsCurrentWorkspaceEditor.mockReturnValue(false)
+  it('hides the create button without snippet create permission', () => {
+    mockWorkspacePermissionKeys.mockReturnValue([])
 
     renderList()
 
     expect(screen.queryByRole('button', { name: 'snippet.create' })).not.toBeInTheDocument()
   })
 
+  it('does not fetch or render snippets without snippet list permissions', () => {
+    mockWorkspacePermissionKeys.mockReturnValue([])
+
+    renderList()
+
+    expect(mockUseInfiniteSnippetList).toHaveBeenCalledWith(expect.any(Object), {
+      enabled: false,
+    })
+    expect(screen.queryByRole('link', { name: /Sales Snippet/ })).not.toBeInTheDocument()
+    expect(screen.getByText('workflow.tabs.noSnippetsFound')).toBeInTheDocument()
+  })
+
+  it('shows the create button for users with snippet create permission even when they are not workspace editors', () => {
+    mockIsCurrentWorkspaceEditor.mockReturnValue(false)
+    mockWorkspacePermissionKeys.mockReturnValue(['snippets.create_and_modify'])
+
+    renderList()
+
+    expect(screen.getByRole('button', { name: 'snippet.create' })).toBeInTheDocument()
+  })
+
   it('shows an empty state when no snippets are returned', () => {
     mockUseInfiniteSnippetList.mockReturnValue({
       ...mockSnippetListState,
@@ -355,14 +396,21 @@ describe('SnippetList', () => {
     expect(mockFetchNextPage).toHaveBeenCalledTimes(1)
   })
 
-  it('does not fetch snippets or register infinite scroll for dataset operators', () => {
+  it('fetches snippets for dataset operators when they have snippet list permissions', () => {
     mockIsCurrentWorkspaceDatasetOperator.mockReturnValue(true)
 
     renderList()
 
     expect(mockUseInfiniteSnippetList).toHaveBeenCalledWith(expect.any(Object), {
-      enabled: false,
+      enabled: true,
     })
+  })
+
+  it('does not register infinite scroll without snippet list permissions', () => {
+    mockWorkspacePermissionKeys.mockReturnValue([])
+
+    renderList()
+
     intersectionCallback?.([
       { isIntersecting: true } as IntersectionObserverEntry,
     ], {} as IntersectionObserver)
diff --git a/web/app/components/snippet-list/components/__tests__/snippet-card.spec.tsx b/web/app/components/snippet-list/components/__tests__/snippet-card.spec.tsx
index 8166c2850fd..30b063c47a6 100644
--- a/web/app/components/snippet-list/components/__tests__/snippet-card.spec.tsx
+++ b/web/app/components/snippet-list/components/__tests__/snippet-card.spec.tsx
@@ -8,6 +8,7 @@ const {
   mockExportMutateAsync,
   mockOnRefresh,
   mockIsCurrentWorkspaceEditor,
+  mockWorkspacePermissionKeys,
   mockToastError,
   mockToastSuccess,
   mockUpdateMutate,
@@ -16,6 +17,7 @@ const {
   mockDownloadBlob: vi.fn(),
   mockExportMutateAsync: vi.fn(),
   mockIsCurrentWorkspaceEditor: vi.fn(() => true),
+  mockWorkspacePermissionKeys: vi.fn(() => ['snippets.create_and_modify', 'snippets.management']),
   mockOnRefresh: vi.fn(),
   mockToastError: vi.fn(),
   mockToastSuccess: vi.fn(),
@@ -25,6 +27,14 @@ const {
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor(),
+    workspacePermissionKeys: mockWorkspacePermissionKeys(),
+  }),
+  useSelector: <T,>(selector: (state: {
+    isCurrentWorkspaceEditor: boolean
+    workspacePermissionKeys: string[]
+  }) => T): T => selector({
+    isCurrentWorkspaceEditor: mockIsCurrentWorkspaceEditor(),
+    workspacePermissionKeys: mockWorkspacePermissionKeys(),
   }),
 }))
 
@@ -105,6 +115,7 @@ describe('SnippetCard', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockIsCurrentWorkspaceEditor.mockReturnValue(true)
+    mockWorkspacePermissionKeys.mockReturnValue(['snippets.create_and_modify', 'snippets.management'])
   })
 
   describe('Rendering', () => {
@@ -149,14 +160,40 @@ describe('SnippetCard', () => {
       expect(screen.queryByRole('menuitem', { name: /duplicate/i })).not.toBeInTheDocument()
     })
 
-    it('should hide operations for users without editor permission', () => {
-      mockIsCurrentWorkspaceEditor.mockReturnValue(false)
+    it('should hide operations for users without snippet permissions', () => {
+      mockWorkspacePermissionKeys.mockReturnValue([])
 
       render(<SnippetCard snippet={createSnippet()} />)
 
       expect(screen.queryByRole('button', { name: 'common.operation.more' })).not.toBeInTheDocument()
     })
 
+    it('should show edit info with create-and-modify permission without management actions', async () => {
+      mockIsCurrentWorkspaceEditor.mockReturnValue(false)
+      mockWorkspacePermissionKeys.mockReturnValue(['snippets.create_and_modify'])
+
+      render(<SnippetCard snippet={createSnippet()} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'common.operation.more' }))
+
+      expect(await screen.findByRole('menuitem', { name: 'snippet.menu.editInfo' })).toBeInTheDocument()
+      expect(screen.queryByRole('menuitem', { name: 'snippet.menu.exportSnippet' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('menuitem', { name: 'snippet.menu.deleteSnippet' })).not.toBeInTheDocument()
+    })
+
+    it('should show export and delete with snippet management permission without edit info', async () => {
+      mockIsCurrentWorkspaceEditor.mockReturnValue(false)
+      mockWorkspacePermissionKeys.mockReturnValue(['snippets.management'])
+
+      render(<SnippetCard snippet={createSnippet()} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'common.operation.more' }))
+
+      expect(screen.queryByRole('menuitem', { name: 'snippet.menu.editInfo' })).not.toBeInTheDocument()
+      expect(await screen.findByRole('menuitem', { name: 'snippet.menu.exportSnippet' })).toBeInTheDocument()
+      expect(await screen.findByRole('menuitem', { name: 'snippet.menu.deleteSnippet' })).toBeInTheDocument()
+    })
+
     it('should forward tag selector actions without navigating the card link', () => {
       const onOpenTagManagement = vi.fn()
       const onTagsChange = vi.fn()
@@ -178,6 +215,7 @@ describe('SnippetCard', () => {
     })
 
     it('should export a snippet from the operations menu', async () => {
+      mockWorkspacePermissionKeys.mockReturnValue(['snippets.management'])
       mockExportMutateAsync.mockResolvedValue('snippet-yaml')
 
       render(<SnippetCard snippet={createSnippet()} />)
@@ -194,6 +232,7 @@ describe('SnippetCard', () => {
     })
 
     it('should show an error toast when snippet export fails', async () => {
+      mockWorkspacePermissionKeys.mockReturnValue(['snippets.management'])
       mockExportMutateAsync.mockRejectedValue(new Error('export failed'))
 
       render(<SnippetCard snippet={createSnippet()} />)
diff --git a/web/app/components/snippet-list/components/__tests__/snippet-create-button.spec.tsx b/web/app/components/snippet-list/components/__tests__/snippet-create-button.spec.tsx
index ec62cf8941a..025654bcfb5 100644
--- a/web/app/components/snippet-list/components/__tests__/snippet-create-button.spec.tsx
+++ b/web/app/components/snippet-list/components/__tests__/snippet-create-button.spec.tsx
@@ -1,7 +1,7 @@
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import SnippetCreateButton from '../snippet-create-button'
 
-const { mockPush, mockCreateMutateAsync, mockSyncDraftWorkflow, mockImportMutateAsync, mockConfirmImportMutateAsync, mockToastSuccess, mockToastError } = vi.hoisted(() => ({
+const { mockPush, mockCreateMutateAsync, mockSyncDraftWorkflow, mockImportMutateAsync, mockConfirmImportMutateAsync, mockToastSuccess, mockToastError, mockWorkspacePermissionKeys } = vi.hoisted(() => ({
   mockPush: vi.fn(),
   mockCreateMutateAsync: vi.fn(),
   mockSyncDraftWorkflow: vi.fn(),
@@ -9,6 +9,7 @@ const { mockPush, mockCreateMutateAsync, mockSyncDraftWorkflow, mockImportMutate
   mockConfirmImportMutateAsync: vi.fn(),
   mockToastSuccess: vi.fn(),
   mockToastError: vi.fn(),
+  mockWorkspacePermissionKeys: vi.fn(() => ['snippets.create_and_modify']),
 }))
 
 vi.mock('@/next/navigation', () => ({
@@ -24,6 +25,15 @@ vi.mock('@langgenius/dify-ui/toast', () => ({
   },
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    workspacePermissionKeys: mockWorkspacePermissionKeys(),
+  }),
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys(),
+  }),
+}))
+
 vi.mock('@/service/use-snippets', () => ({
   useCreateSnippetMutation: () => ({
     mutateAsync: mockCreateMutateAsync,
@@ -50,6 +60,15 @@ vi.mock('@/service/client', () => ({
 describe('SnippetCreateButton', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.mockReturnValue(['snippets.create_and_modify'])
+  })
+
+  it('should not render without snippet create permission', () => {
+    mockWorkspacePermissionKeys.mockReturnValue([])
+
+    render(<SnippetCreateButton />)
+
+    expect(screen.queryByRole('button', { name: 'snippet.create' })).not.toBeInTheDocument()
   })
 
   it('should open the create dialog and create a snippet from the modal', async () => {
diff --git a/web/app/components/snippet-list/components/snippet-card.tsx b/web/app/components/snippet-list/components/snippet-card.tsx
index 55d73719ac7..96a42ffc13b 100644
--- a/web/app/components/snippet-list/components/snippet-card.tsx
+++ b/web/app/components/snippet-list/components/snippet-card.tsx
@@ -22,7 +22,8 @@ import { toast } from '@langgenius/dify-ui/toast'
 import { useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import CreateSnippetDialog from '@/app/components/snippets/create-snippet-dialog'
-import { useAppContext } from '@/context/app-context'
+import { canCreateAndModifySnippets, canManageSnippets } from '@/app/components/snippets/utils/permission'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { TagSelector } from '@/features/tag-management/components/tag-selector'
 import Link from '@/next/link'
 import { useMembers } from '@/service/use-common'
@@ -45,7 +46,7 @@ const SnippetCard = ({
 }: Props) => {
   const { t } = useTranslation('snippet')
   const { t: tCommon } = useTranslation()
-  const { isCurrentWorkspaceEditor } = useAppContext()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const { data: membersData } = useMembers()
   const [isOperationsMenuOpen, setIsOperationsMenuOpen] = useState(false)
   const [isEditDialogOpen, setIsEditDialogOpen] = useState(false)
@@ -53,6 +54,9 @@ const SnippetCard = ({
   const updateSnippetMutation = useUpdateSnippetMutation()
   const exportSnippetMutation = useExportSnippetMutation()
   const deleteSnippetMutation = useDeleteSnippetMutation()
+  const canCreateAndModifySnippet = canCreateAndModifySnippets(workspacePermissionKeys)
+  const canManageSnippet = canManageSnippets(workspacePermissionKeys)
+  const canShowOperations = canCreateAndModifySnippet || canManageSnippet
 
   const memberNameById = useMemo(() => {
     return new Map((membersData?.accounts ?? []).map(member => [member.id, member.name]))
@@ -78,6 +82,9 @@ const SnippetCard = ({
   }
 
   const handleExportSnippet = async () => {
+    if (!canManageSnippet)
+      return
+
     setIsOperationsMenuOpen(false)
     try {
       const data = await exportSnippetMutation.mutateAsync({ snippetId: snippet.id })
@@ -166,7 +173,7 @@ const SnippetCard = ({
               />
             </div>
           </div>
-          {isCurrentWorkspaceEditor && (
+          {canShowOperations && (
             <div
               className={cn(
                 'absolute top-1/2 right-1.5 flex -translate-y-1/2 items-center transition-opacity',
@@ -195,23 +202,29 @@ const SnippetCard = ({
                   sideOffset={4}
                   popupClassName="w-[216px]"
                 >
-                  <DropdownMenuItem className="gap-2 px-3" onClick={handleOpenEditDialog}>
-                    <span className="system-sm-regular text-text-secondary">{t('menu.editInfo')}</span>
-                  </DropdownMenuItem>
-                  <DropdownMenuItem className="gap-2 px-3" onClick={handleExportSnippet}>
-                    <span className="system-sm-regular text-text-secondary">{t('menu.exportSnippet')}</span>
-                  </DropdownMenuItem>
-                  <DropdownMenuSeparator />
-                  <DropdownMenuItem
-                    variant="destructive"
-                    className="gap-2 px-3"
-                    onClick={() => {
-                      setIsOperationsMenuOpen(false)
-                      setIsDeleteDialogOpen(true)
-                    }}
-                  >
-                    <span className="system-sm-regular">{t('menu.deleteSnippet')}</span>
-                  </DropdownMenuItem>
+                  {canCreateAndModifySnippet && (
+                    <DropdownMenuItem className="gap-2 px-3" onClick={handleOpenEditDialog}>
+                      <span className="system-sm-regular text-text-secondary">{t('menu.editInfo')}</span>
+                    </DropdownMenuItem>
+                  )}
+                  {canManageSnippet && (
+                    <>
+                      <DropdownMenuItem className="gap-2 px-3" onClick={handleExportSnippet}>
+                        <span className="system-sm-regular text-text-secondary">{t('menu.exportSnippet')}</span>
+                      </DropdownMenuItem>
+                      <DropdownMenuSeparator />
+                      <DropdownMenuItem
+                        variant="destructive"
+                        className="gap-2 px-3"
+                        onClick={() => {
+                          setIsOperationsMenuOpen(false)
+                          setIsDeleteDialogOpen(true)
+                        }}
+                      >
+                        <span className="system-sm-regular">{t('menu.deleteSnippet')}</span>
+                      </DropdownMenuItem>
+                    </>
+                  )}
                 </DropdownMenuContent>
               </DropdownMenu>
             </div>
diff --git a/web/app/components/snippet-list/components/snippet-create-button.tsx b/web/app/components/snippet-list/components/snippet-create-button.tsx
index 59397121152..1d117e4dad5 100644
--- a/web/app/components/snippet-list/components/snippet-create-button.tsx
+++ b/web/app/components/snippet-list/components/snippet-create-button.tsx
@@ -15,6 +15,7 @@ import ImportSnippetDSLDialog from '@/app/components/snippets/import-snippet-dsl
 const SnippetCreateButton = () => {
   const { t } = useTranslation('snippet')
   const {
+    canCreateAndModifySnippet,
     createSnippetMutation,
     handleCreateSnippet,
     isCreatingSnippet,
@@ -24,6 +25,9 @@ const SnippetCreateButton = () => {
   const [isMenuOpen, setIsMenuOpen] = useState(false)
   const isSubmitting = isCreatingSnippet || createSnippetMutation.isPending
 
+  if (!canCreateAndModifySnippet)
+    return null
+
   return (
     <>
       <Popover open={isMenuOpen} onOpenChange={setIsMenuOpen}>
diff --git a/web/app/components/snippet-list/index.tsx b/web/app/components/snippet-list/index.tsx
index b317c08ee09..e62216a7c4a 100644
--- a/web/app/components/snippet-list/index.tsx
+++ b/web/app/components/snippet-list/index.tsx
@@ -6,7 +6,7 @@ import { Input } from '@langgenius/dify-ui/input'
 import { useDebounce } from 'ahooks'
 import { useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { TagFilter } from '@/features/tag-management/components/tag-filter'
 import useDocumentTitle from '@/hooks/use-document-title'
 import dynamic from '@/next/dynamic'
@@ -15,6 +15,7 @@ import { useInfiniteSnippetList } from '@/service/use-snippets'
 import CreatorsFilter from '../apps/creators-filter'
 import Empty from '../apps/empty'
 import { StudioListHeader } from '../apps/studio-list-header'
+import { canAccessSnippets } from '../snippets/utils/permission'
 import SnippetCard from './components/snippet-card'
 import SnippetCreateButton from './components/snippet-create-button'
 import { SNIPPET_LIST_SEARCH_DEBOUNCE_MS } from './constants'
@@ -45,7 +46,8 @@ const SnippetCardSkeleton = ({ count }: SnippetCardSkeletonProps) => {
 
 const SnippetList = () => {
   const { t } = useTranslation()
-  const { isCurrentWorkspaceEditor, isCurrentWorkspaceDatasetOperator, isLoadingCurrentWorkspace } = useAppContext()
+  const isLoadingCurrentWorkspace = useAppContextWithSelector(state => state.isLoadingCurrentWorkspace)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   // eslint-disable-next-line react/use-state -- custom URL query hook, not React.useState
   const {
     query: { tagIDs, keywords, creatorIDs },
@@ -67,6 +69,7 @@ const SnippetList = () => {
     ...(tagIDs.length ? { tag_ids: tagIDs } : {}),
     ...(creatorIDs.length ? { creator_ids: creatorIDs } : {}),
   }), [creatorIDs, debouncedKeywords, tagIDs])
+  const canQuerySnippetList = canAccessSnippets(workspacePermissionKeys)
 
   const {
     data,
@@ -78,11 +81,11 @@ const SnippetList = () => {
     error,
     refetch,
   } = useInfiniteSnippetList(snippetListQuery, {
-    enabled: !isCurrentWorkspaceDatasetOperator,
+    enabled: canQuerySnippetList,
   })
 
   useEffect(() => {
-    if (isCurrentWorkspaceDatasetOperator)
+    if (!canQuerySnippetList)
       return
 
     const hasMore = hasNextPage ?? true
@@ -110,12 +113,12 @@ const SnippetList = () => {
     }
 
     return () => observer?.disconnect()
-  }, [error, fetchNextPage, hasNextPage, isCurrentWorkspaceDatasetOperator, isFetchingNextPage, isLoading])
+  }, [canQuerySnippetList, error, fetchNextPage, hasNextPage, isFetchingNextPage, isLoading])
 
-  const pages = useMemo(() => data?.pages ?? [], [data?.pages])
+  const pages = useMemo(() => canQuerySnippetList ? data?.pages ?? [] : [], [canQuerySnippetList, data?.pages])
   const snippets = useMemo<SnippetListItem[]>(() => pages.flatMap(({ data: pageSnippets }) => pageSnippets), [pages])
   const hasAnySnippet = (pages[0]?.total ?? 0) > 0
-  const showSkeleton = isLoading || (isFetching && pages.length === 0)
+  const showSkeleton = isLoadingCurrentWorkspace || (canQuerySnippetList && (isLoading || (isFetching && pages.length === 0)))
 
   return (
     <div ref={containerRef} className="relative flex h-0 shrink-0 grow flex-col overflow-y-auto bg-background-body">
@@ -162,9 +165,7 @@ const SnippetList = () => {
               )}
             </div>
           </div>
-          {(isCurrentWorkspaceEditor || isLoadingCurrentWorkspace) && (
-            <SnippetCreateButton />
-          )}
+          <SnippetCreateButton />
         </div>
       </StudioListHeader>
       <div className={cn(
diff --git a/web/app/components/snippets/__tests__/import-snippet-dsl-dialog.spec.tsx b/web/app/components/snippets/__tests__/import-snippet-dsl-dialog.spec.tsx
index c1295ddb585..90517f9d419 100644
--- a/web/app/components/snippets/__tests__/import-snippet-dsl-dialog.spec.tsx
+++ b/web/app/components/snippets/__tests__/import-snippet-dsl-dialog.spec.tsx
@@ -16,10 +16,23 @@ const toastMocks = vi.hoisted(() => ({
   error: vi.fn(),
 }))
 
+const contextMocks = vi.hoisted(() => ({
+  workspacePermissionKeys: ['snippets.create_and_modify'] as string[],
+}))
+
 vi.mock('@/next/navigation', () => ({
   useRouter: () => routerMocks,
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    workspacePermissionKeys: contextMocks.workspacePermissionKeys,
+  }),
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: contextMocks.workspacePermissionKeys,
+  }),
+}))
+
 vi.mock('@langgenius/dify-ui/toast', () => ({
   toast: toastMocks,
 }))
@@ -52,6 +65,7 @@ vi.mock('@/app/components/app/create-from-dsl-modal/uploader', () => ({
 describe('ImportSnippetDSLDialog', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    contextMocks.workspacePermissionKeys = ['snippets.create_and_modify']
   })
 
   it('should import a snippet DSL from URL and navigate to the imported snippet', async () => {
@@ -130,4 +144,18 @@ describe('ImportSnippetDSLDialog', () => {
       expect(onClose).not.toHaveBeenCalled()
     })
   })
+
+  it('should disable import without snippet create permission', async () => {
+    const user = userEvent.setup()
+    contextMocks.workspacePermissionKeys = []
+
+    render(<ImportSnippetDSLDialog isOpen onClose={vi.fn()} />)
+
+    await user.click(screen.getByRole('button', { name: 'snippet.importFromDSLUrl' }))
+    await user.type(screen.getByPlaceholderText('snippet.importFromDSLUrlPlaceholder'), 'https://example.com/snippet.yml')
+    await user.click(screen.getByRole('button', { name: 'common.operation.create' }))
+
+    expect(screen.getByRole('button', { name: 'common.operation.create' })).toBeDisabled()
+    expect(serviceMocks.importMutateAsync).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/app/components/snippets/__tests__/index.spec.tsx b/web/app/components/snippets/__tests__/index.spec.tsx
index 9d524b38c9a..977454c1661 100644
--- a/web/app/components/snippets/__tests__/index.spec.tsx
+++ b/web/app/components/snippets/__tests__/index.spec.tsx
@@ -3,7 +3,6 @@ import { render, screen } from '@testing-library/react'
 import SnippetPage from '..'
 
 const mockUseSnippetInit = vi.fn()
-const mockSetAppSidebarExpand = vi.fn()
 let capturedWorkflowDefaultContextProps: {
   nodes: unknown[]
   edges: unknown[]
@@ -39,12 +38,6 @@ vi.mock('@/hooks/use-document-title', () => ({
   default: vi.fn(),
 }))
 
-vi.mock('@/app/components/app/store', () => ({
-  useStore: (selector: (state: { setAppSidebarExpand: typeof mockSetAppSidebarExpand }) => unknown) => selector({
-    setAppSidebarExpand: mockSetAppSidebarExpand,
-  }),
-}))
-
 vi.mock('@/app/components/workflow', () => ({
   default: ({
     children,
diff --git a/web/app/components/snippets/components/__tests__/snippet-main.spec.tsx b/web/app/components/snippets/components/__tests__/snippet-main.spec.tsx
index 1cabdc903f2..5be724ce257 100644
--- a/web/app/components/snippets/components/__tests__/snippet-main.spec.tsx
+++ b/web/app/components/snippets/components/__tests__/snippet-main.spec.tsx
@@ -26,6 +26,9 @@ const mockHandleWorkflowStartRunInWorkflow = vi.fn()
 const mockHandleCheckBeforePublish = vi.fn()
 const mockPush = vi.hoisted(() => vi.fn())
 const mockUseAvailableNodesMetaData = vi.hoisted(() => vi.fn())
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['snippets.create_and_modify'],
+}))
 const mockInspectVarsCrud = {
   hasNodeInspectVars: vi.fn(),
   hasSetInspectVar: vi.fn(),
@@ -49,6 +52,12 @@ vi.mock('@langgenius/dify-ui/toast', () => ({
     success: vi.fn(),
   },
 }))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
 let capturedHooksStore: Record<string, unknown> | undefined
 let capturedWorkflowNodes: WorkflowProps['nodes'] | undefined
 let snippetDetailStoreState: {
@@ -160,9 +169,11 @@ vi.mock('@/app/components/snippets/components/snippet-children', () => ({
     onExitEditingWithoutSave,
     onPublish,
     canSave,
+    canEdit,
     isEditing,
   }: {
     canSave: boolean
+    canEdit: boolean
     isEditing: boolean
     onCancel: () => void
     onEdit: () => void
@@ -170,7 +181,7 @@ vi.mock('@/app/components/snippets/components/snippet-children', () => ({
     onPublish: () => void
   }) => (
     <div>
-      {!isEditing && <button type="button" onClick={onEdit}>edit</button>}
+      {!isEditing && canEdit && <button type="button" onClick={onEdit}>edit</button>}
       <a href="/snippets">snippets list</a>
       <button type="button" onClick={onExitEditingWithoutSave}>exit without save</button>
       <button type="button" disabled={!canSave} onClick={onPublish}>publish</button>
@@ -324,6 +335,7 @@ describe('SnippetMain', () => {
       reset: mockReset,
       setFields: mockSetFields,
     }
+    mockWorkspacePermissionKeys.value = ['snippets.create_and_modify']
   })
 
   describe('Initial Mode', () => {
@@ -339,6 +351,23 @@ describe('SnippetMain', () => {
       expect(capturedWorkflowNodes?.map(node => node.id)).toEqual(['draft-node'])
     })
 
+    it('should stay readonly without snippet create-and-modify permission', async () => {
+      mockWorkspacePermissionKeys.value = []
+      const draftNode = createDraftNode('draft-node')
+
+      renderSnippetMain({
+        hasPublishedWorkflow: false,
+        workflowDraftNodes: [draftNode],
+      })
+
+      expect(screen.queryByRole('button', { name: 'edit' })).not.toBeInTheDocument()
+
+      const doSyncWorkflowDraft = capturedHooksStore?.doSyncWorkflowDraft as (() => Promise<void>)
+      await doSyncWorkflowDraft()
+
+      expect(mockDoSyncWorkflowDraft).not.toHaveBeenCalled()
+    })
+
     it('should enter readonly mode with published graph by default when published workflow exists', async () => {
       const publishedNode = createDraftNode('published-node')
       const draftNode = createDraftNode('draft-node')
diff --git a/web/app/components/snippets/components/hooks/use-snippet-input-field-actions.ts b/web/app/components/snippets/components/hooks/use-snippet-input-field-actions.ts
index d8142232cfb..862cb3cfc29 100644
--- a/web/app/components/snippets/components/hooks/use-snippet-input-field-actions.ts
+++ b/web/app/components/snippets/components/hooks/use-snippet-input-field-actions.ts
@@ -5,10 +5,12 @@ import { useNodesSyncDraft } from '../../hooks/use-nodes-sync-draft'
 import { useSnippetDetailStore } from '../../store'
 
 type UseSnippetInputFieldActionsOptions = {
+  canEdit?: boolean
   snippetId: string
 }
 
 export const useSnippetInputFieldActions = ({
+  canEdit = true,
   snippetId,
 }: UseSnippetInputFieldActionsOptions) => {
   const { syncInputFieldsDraft } = useNodesSyncDraft(snippetId)
@@ -21,11 +23,14 @@ export const useSnippetInputFieldActions = ({
   })))
 
   const handleFieldsChange = useCallback((newFields: SnippetInputField[]) => {
+    if (!canEdit)
+      return
+
     setFields(newFields)
     void syncInputFieldsDraft(newFields, {
       onRefresh: setFields,
     })
-  }, [setFields, syncInputFieldsDraft])
+  }, [canEdit, setFields, syncInputFieldsDraft])
 
   return {
     fields,
diff --git a/web/app/components/snippets/components/snippet-children.tsx b/web/app/components/snippets/components/snippet-children.tsx
index 4675ad8fa1f..8ce66be3053 100644
--- a/web/app/components/snippets/components/snippet-children.tsx
+++ b/web/app/components/snippets/components/snippet-children.tsx
@@ -8,6 +8,7 @@ type SnippetChildrenProps = {
   snippetId: string
   fields: SnippetInputField[]
   canDiscardChanges: boolean
+  canEdit?: boolean
   canSave: boolean
   hasDraftChanges: boolean
   isEditing: boolean
@@ -24,6 +25,7 @@ const SnippetChildren = ({
   snippetId,
   fields,
   canDiscardChanges,
+  canEdit = true,
   canSave,
   hasDraftChanges,
   isEditing,
@@ -42,6 +44,7 @@ const SnippetChildren = ({
       <SnippetHeader
         snippetId={snippetId}
         canDiscardChanges={canDiscardChanges}
+        canEdit={canEdit}
         canSave={canSave}
         hasDraftChanges={hasDraftChanges}
         isEditing={isEditing}
diff --git a/web/app/components/snippets/components/snippet-header/index.tsx b/web/app/components/snippets/components/snippet-header/index.tsx
index 63d904c78e7..b2d433d7197 100644
--- a/web/app/components/snippets/components/snippet-header/index.tsx
+++ b/web/app/components/snippets/components/snippet-header/index.tsx
@@ -16,6 +16,7 @@ import RunMode from './run-mode'
 type SnippetHeaderProps = {
   snippetId: string
   canDiscardChanges: boolean
+  canEdit?: boolean
   canSave: boolean
   hasDraftChanges: boolean
   isEditing: boolean
@@ -39,6 +40,7 @@ const ViewOnlyBadge = () => {
 }
 
 const EditActions = ({
+  canEdit = true,
   canSave,
   hasDraftChanges,
   isEditing,
@@ -48,11 +50,14 @@ const EditActions = ({
   onExitEditingWithoutSave,
   onPublish,
   onSaveAndExitEditing,
-}: Pick<SnippetHeaderProps, 'canSave' | 'hasDraftChanges' | 'isEditing' | 'isPublishing' | 'onEdit' | 'onExitEditing' | 'onExitEditingWithoutSave' | 'onPublish' | 'onSaveAndExitEditing'>) => {
+}: Pick<SnippetHeaderProps, 'canEdit' | 'canSave' | 'hasDraftChanges' | 'isEditing' | 'isPublishing' | 'onEdit' | 'onExitEditing' | 'onExitEditingWithoutSave' | 'onPublish' | 'onSaveAndExitEditing'>) => {
   const { t } = useTranslation('snippet')
   const [exitConfirmOpen, setExitConfirmOpen] = useState(false)
 
   if (!isEditing) {
+    if (!canEdit)
+      return null
+
     return (
       <Button variant="primary" onClick={onEdit}>
         {t('edit')}
@@ -67,8 +72,11 @@ const EditActions = ({
         onOpenChange={setExitConfirmOpen}
         trigger={(
           <Button
-            disabled={isPublishing}
+            disabled={isPublishing || !canEdit}
             onClick={(event) => {
+              if (!canEdit)
+                return
+
               if (!hasDraftChanges) {
                 event.preventDefault()
                 void onExitEditing()
@@ -81,8 +89,8 @@ const EditActions = ({
             {t('exitEditing')}
           </Button>
         )}
-        disabled={isPublishing}
-        saveDisabled={!canSave}
+        disabled={isPublishing || !canEdit}
+        saveDisabled={!canEdit || !canSave}
         loading={isPublishing}
         onDiscard={async () => {
           await onExitEditingWithoutSave()
@@ -96,7 +104,7 @@ const EditActions = ({
       <Button
         variant="primary"
         loading={isPublishing}
-        disabled={isPublishing || !canSave}
+        disabled={isPublishing || !canEdit || !canSave}
         onClick={onPublish}
       >
         {t('save')}
@@ -108,6 +116,7 @@ const EditActions = ({
 const SnippetHeader = ({
   snippetId,
   canDiscardChanges,
+  canEdit = true,
   canSave,
   hasDraftChanges,
   isEditing,
@@ -135,6 +144,7 @@ const SnippetHeader = ({
             : <ViewOnlyBadge />,
           left: (
             <EditActions
+              canEdit={canEdit}
               canSave={canSave}
               hasDraftChanges={hasDraftChanges}
               isEditing={isEditing}
@@ -164,7 +174,7 @@ const SnippetHeader = ({
         viewHistoryProps,
       },
     }
-  }, [canDiscardChanges, canSave, hasDraftChanges, isEditing, isPublishing, onCancel, onEdit, onExitEditing, onExitEditingWithoutSave, onPublish, onSaveAndExitEditing, t, viewHistoryProps])
+  }, [canDiscardChanges, canEdit, canSave, hasDraftChanges, isEditing, isPublishing, onCancel, onEdit, onExitEditing, onExitEditingWithoutSave, onPublish, onSaveAndExitEditing, t, viewHistoryProps])
 
   return <Header {...headerProps} />
 }
diff --git a/web/app/components/snippets/components/snippet-main.tsx b/web/app/components/snippets/components/snippet-main.tsx
index 1126e271f27..9f9ecab698a 100644
--- a/web/app/components/snippets/components/snippet-main.tsx
+++ b/web/app/components/snippets/components/snippet-main.tsx
@@ -23,6 +23,7 @@ import {
   initialEdges,
   initialNodes,
 } from '@/app/components/workflow/utils'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useRouter } from '@/next/navigation'
 import { useSnippetPublishedWorkflow } from '@/service/use-snippet-workflows'
 import { useConfigsMap } from '../hooks/use-configs-map'
@@ -33,6 +34,7 @@ import { useSnippetRefreshDraft } from '../hooks/use-snippet-refresh-draft'
 import { useSnippetRun } from '../hooks/use-snippet-run'
 import { useSnippetStartRun } from '../hooks/use-snippet-start-run'
 import { useSnippetDetailStore } from '../store'
+import { canCreateAndModifySnippets } from '../utils/permission'
 import { useSnippetInputFieldActions } from './hooks/use-snippet-input-field-actions'
 import { useSnippetPublish } from './hooks/use-snippet-publish'
 import SaveBeforeLeavingDialog from './save-before-leaving-dialog'
@@ -54,6 +56,7 @@ type SnippetMainContentProps = {
   snippetId: string
   fields: SnippetInputField[]
   canDiscardChanges: boolean
+  canEdit: boolean
   canSave: boolean
   hasDraftChanges: boolean
   isEditing: boolean
@@ -92,6 +95,7 @@ const SnippetMainContent = ({
   snippetId,
   fields,
   canDiscardChanges,
+  canEdit,
   canSave,
   hasDraftChanges,
   isEditing,
@@ -224,6 +228,7 @@ const SnippetMainContent = ({
         snippetId={snippetId}
         fields={fields}
         canDiscardChanges={canDiscardChanges}
+        canEdit={canEdit}
         canSave={canSave}
         hasDraftChanges={hasDraftChanges}
         isEditing={isEditing}
@@ -261,7 +266,10 @@ const SnippetMain = ({
   draftEdges,
   draftViewport,
 }: SnippetMainProps) => {
-  const [isEditing, setIsEditing] = useState(!hasPublishedWorkflow)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canCreateAndModifySnippet = canCreateAndModifySnippets(workspacePermissionKeys)
+  const [isEditingState, setIsEditingState] = useState(!hasPublishedWorkflow)
+  const isEditing = canCreateAndModifySnippet && isEditingState
   const [localDraftState, setLocalDraftState] = useState<LocalDraftState>()
   const [draftChangeState, setDraftChangeState] = useState({
     initial: hasInitialDraftChanges,
@@ -365,6 +373,7 @@ const SnippetMain = ({
     fields,
     handleFieldsChange,
   } = useSnippetInputFieldActions({
+    canEdit: canCreateAndModifySnippet,
     snippetId,
   })
   const {
@@ -405,7 +414,7 @@ const SnippetMain = ({
   const doSyncWorkflowDraft = useCallback((
     ...args: Parameters<typeof syncWorkflowDraft>
   ) => {
-    if (!isEditing)
+    if (!canCreateAndModifySnippet || !isEditing)
       return Promise.resolve()
 
     const [
@@ -421,19 +430,22 @@ const SnippetMain = ({
       setHasDraftChanges(true)
 
     return syncWorkflowDraft(...args)
-  }, [isEditing, setHasDraftChanges, syncWorkflowDraft])
+  }, [canCreateAndModifySnippet, isEditing, setHasDraftChanges, syncWorkflowDraft])
 
   const syncWorkflowDraftWhenPageCloseInEditing = useCallback(() => {
-    if (!isEditing)
+    if (!canCreateAndModifySnippet || !isEditing)
       return
 
     syncWorkflowDraftWhenPageClose()
-  }, [isEditing, syncWorkflowDraftWhenPageClose])
+  }, [canCreateAndModifySnippet, isEditing, syncWorkflowDraftWhenPageClose])
 
   const handleFieldsChangeInEditing = useCallback((nextFields: SnippetInputField[]) => {
+    if (!canCreateAndModifySnippet || !isEditing)
+      return
+
     handleFieldsChange(nextFields)
     setHasDraftChanges(true)
-  }, [handleFieldsChange, setHasDraftChanges])
+  }, [canCreateAndModifySnippet, handleFieldsChange, isEditing, setHasDraftChanges])
 
   const updateLocalDraftFromSyncPayload = useCallback((
     syncedDraftPayload?: Omit<SnippetDraftSyncPayload, 'hash'> | void,
@@ -468,6 +480,9 @@ const SnippetMain = ({
   }, [draftPayload, fields, setFields])
 
   const handleCancelChanges = useCallback(async () => {
+    if (!canCreateAndModifySnippet)
+      return
+
     const workflow = publishedWorkflow ?? (await refetchPublishedWorkflow()).data
     if (!workflow)
       return
@@ -485,32 +500,41 @@ const SnippetMain = ({
       onRefresh: setFields,
     })
     setHasDraftChanges(false)
-  }, [handleRestoreFromPublishedWorkflow, publishedWorkflow, refetchPublishedWorkflow, setFields, setHasDraftChanges, syncInputFieldsDraft, updateLocalDraftFromSyncPayload])
+  }, [canCreateAndModifySnippet, handleRestoreFromPublishedWorkflow, publishedWorkflow, refetchPublishedWorkflow, setFields, setHasDraftChanges, syncInputFieldsDraft, updateLocalDraftFromSyncPayload])
 
   const handleExitEditing = useCallback(async () => {
-    if (hasDraftChanges)
+    if (!canCreateAndModifySnippet || hasDraftChanges)
       return
 
-    setIsEditing(false)
-  }, [hasDraftChanges])
+    setIsEditingState(false)
+  }, [canCreateAndModifySnippet, hasDraftChanges])
 
   const handleExitEditingWithoutSave = useCallback(async () => {
+    if (!canCreateAndModifySnippet)
+      return
+
     const syncedDraftPayload = await syncWorkflowDraft(true)
     updateLocalDraftFromSyncPayload(syncedDraftPayload)
     skipNextForcedDraftSyncRef.current = true
-    setIsEditing(false)
-  }, [syncWorkflowDraft, updateLocalDraftFromSyncPayload])
+    setIsEditingState(false)
+  }, [canCreateAndModifySnippet, syncWorkflowDraft, updateLocalDraftFromSyncPayload])
 
   const handleDiscardAndRoute = useCallback(async () => {
+    if (!canCreateAndModifySnippet)
+      return
+
     const syncedDraftPayload = await syncWorkflowDraft(true)
     updateLocalDraftFromSyncPayload(syncedDraftPayload)
     skipNextForcedDraftSyncRef.current = true
-  }, [syncWorkflowDraft, updateLocalDraftFromSyncPayload])
+  }, [canCreateAndModifySnippet, syncWorkflowDraft, updateLocalDraftFromSyncPayload])
 
   const handleEdit = useCallback(() => {
+    if (!canCreateAndModifySnippet)
+      return
+
     skipNextForcedDraftSyncRef.current = true
-    setIsEditing(true)
-  }, [])
+    setIsEditingState(true)
+  }, [canCreateAndModifySnippet])
 
   const hooksStore = useMemo(() => {
     return {
@@ -594,6 +618,7 @@ const SnippetMain = ({
             snippetId={snippetId}
             fields={fields}
             canDiscardChanges={hasPublishedWorkflow}
+            canEdit={canCreateAndModifySnippet}
             canSave={canSave}
             hasDraftChanges={hasDraftChanges}
             isEditing={isEditing}
@@ -609,7 +634,7 @@ const SnippetMain = ({
             }}
             onSavedAndExitEditing={() => {
               setHasDraftChanges(false)
-              setIsEditing(false)
+              setIsEditingState(false)
             }}
           />
         </WorkflowWithInnerContext>
diff --git a/web/app/components/snippets/hooks/__tests__/use-create-snippet.spec.tsx b/web/app/components/snippets/hooks/__tests__/use-create-snippet.spec.tsx
index d4b7de7cc0a..73b0f81ab35 100644
--- a/web/app/components/snippets/hooks/__tests__/use-create-snippet.spec.tsx
+++ b/web/app/components/snippets/hooks/__tests__/use-create-snippet.spec.tsx
@@ -8,12 +8,14 @@ const {
   mockSyncDraftWorkflow,
   mockToastError,
   mockToastSuccess,
+  mockWorkspacePermissionKeys,
 } = vi.hoisted(() => ({
   mockMutateAsync: vi.fn(),
   mockPush: vi.fn(),
   mockSyncDraftWorkflow: vi.fn(),
   mockToastError: vi.fn(),
   mockToastSuccess: vi.fn(),
+  mockWorkspacePermissionKeys: vi.fn(() => ['snippets.create_and_modify']),
 }))
 
 vi.mock('@/next/navigation', () => ({
@@ -35,6 +37,15 @@ vi.mock('@/service/client', () => ({
   },
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    workspacePermissionKeys: mockWorkspacePermissionKeys(),
+  }),
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys(),
+  }),
+}))
+
 vi.mock('@langgenius/dify-ui/toast', () => ({
   toast: {
     success: (...args: unknown[]) => mockToastSuccess(...args),
@@ -45,6 +56,7 @@ vi.mock('@langgenius/dify-ui/toast', () => ({
 describe('useCreateSnippet', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.mockReturnValue(['snippets.create_and_modify'])
   })
 
   describe('State', () => {
diff --git a/web/app/components/snippets/hooks/__tests__/use-nodes-sync-draft.spec.ts b/web/app/components/snippets/hooks/__tests__/use-nodes-sync-draft.spec.ts
index e9ac6848425..ee5a2663134 100644
--- a/web/app/components/snippets/hooks/__tests__/use-nodes-sync-draft.spec.ts
+++ b/web/app/components/snippets/hooks/__tests__/use-nodes-sync-draft.spec.ts
@@ -6,6 +6,7 @@ import { useNodesSyncDraft } from '../use-nodes-sync-draft'
 
 const mockGetNodes = vi.fn()
 const mockGetNodesReadOnly = vi.fn()
+const mockUseNodesReadOnlyByCanEdit = vi.fn()
 const mockPostWithKeepalive = vi.fn()
 const mockSyncDraftWorkflow = vi.fn()
 const mockSetDraftUpdatedAt = vi.fn()
@@ -30,7 +31,10 @@ vi.mock('reactflow', () => ({
 }))
 
 vi.mock('@/app/components/workflow/hooks/use-workflow', () => ({
-  useNodesReadOnly: () => ({ getNodesReadOnly: mockGetNodesReadOnly }),
+  useNodesReadOnly: () => {
+    throw new Error('Missing HooksStoreContext.Provider in the tree')
+  },
+  useNodesReadOnlyByCanEdit: (canEdit: boolean) => mockUseNodesReadOnlyByCanEdit(canEdit),
 }))
 
 vi.mock('@/app/components/workflow/hooks/use-serial-async-callback', () => ({
@@ -96,6 +100,7 @@ describe('snippet/use-nodes-sync-draft', () => {
       setDraftUpdatedAt: mockSetDraftUpdatedAt,
       setSyncWorkflowDraftHash: mockSetSyncWorkflowDraftHash,
     }
+    mockUseNodesReadOnlyByCanEdit.mockReturnValue({ getNodesReadOnly: mockGetNodesReadOnly })
     mockGetNodesReadOnly.mockReturnValue(false)
     mockGetNodes.mockReturnValue([
       { id: 'node-1', position: { x: 0, y: 0 }, data: { title: 'Start', _temp: 'drop' } },
@@ -131,6 +136,7 @@ describe('snippet/use-nodes-sync-draft', () => {
         hash: 'draft-hash',
       },
     })
+    expect(mockUseNodesReadOnlyByCanEdit).toHaveBeenCalledWith(true)
   })
 
   it('should snapshot graph before queued draft sync executes', async () => {
diff --git a/web/app/components/snippets/hooks/use-create-snippet.ts b/web/app/components/snippets/hooks/use-create-snippet.ts
index 90a5b20d4dd..7ace87cbafd 100644
--- a/web/app/components/snippets/hooks/use-create-snippet.ts
+++ b/web/app/components/snippets/hooks/use-create-snippet.ts
@@ -2,18 +2,25 @@ import type { CreateSnippetDialogPayload } from '@/app/components/snippets/creat
 import { toast } from '@langgenius/dify-ui/toast'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useRouter } from '@/next/navigation'
 import { consoleClient } from '@/service/client'
 import { useCreateSnippetMutation } from '@/service/use-snippets'
+import { canCreateAndModifySnippets } from '../utils/permission'
 
 export const useCreateSnippet = () => {
   const { t } = useTranslation()
   const { push } = useRouter()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const createSnippetMutation = useCreateSnippetMutation()
   const [isCreateSnippetDialogOpen, setIsCreateSnippetDialogOpen] = useState(false)
   const [isCreatingSnippet, setIsCreatingSnippet] = useState(false)
+  const canCreateAndModifySnippet = canCreateAndModifySnippets(workspacePermissionKeys)
 
   const handleOpenCreateSnippetDialog = () => {
+    if (!canCreateAndModifySnippet)
+      return
+
     setIsCreateSnippetDialogOpen(true)
   }
 
@@ -27,6 +34,9 @@ export const useCreateSnippet = () => {
     graph,
     input_fields,
   }: CreateSnippetDialogPayload) => {
+    if (!canCreateAndModifySnippet)
+      return
+
     setIsCreatingSnippet(true)
 
     try {
@@ -60,6 +70,7 @@ export const useCreateSnippet = () => {
   }
 
   return {
+    canCreateAndModifySnippet,
     createSnippetMutation,
     handleCloseCreateSnippetDialog,
     handleCreateSnippet,
diff --git a/web/app/components/snippets/hooks/use-nodes-sync-draft.ts b/web/app/components/snippets/hooks/use-nodes-sync-draft.ts
index 9dd5515ea0e..e38a0539aa6 100644
--- a/web/app/components/snippets/hooks/use-nodes-sync-draft.ts
+++ b/web/app/components/snippets/hooks/use-nodes-sync-draft.ts
@@ -4,7 +4,7 @@ import type { SnippetDraftSyncPayload, SnippetDraftSyncResponse, SnippetWorkflow
 import { produce } from 'immer'
 import { useCallback } from 'react'
 import { useStoreApi } from 'reactflow'
-import { useNodesReadOnly } from '@/app/components/workflow/hooks/use-workflow'
+import { useNodesReadOnlyByCanEdit } from '@/app/components/workflow/hooks/use-workflow'
 import { useWorkflowStore } from '@/app/components/workflow/store'
 import { API_PREFIX } from '@/config'
 import { consoleClient } from '@/service/client'
@@ -46,7 +46,7 @@ const enqueueSnippetDraftSync = <Result>(
 export const useNodesSyncDraft = (snippetId: string) => {
   const store = useStoreApi()
   const workflowStore = useWorkflowStore()
-  const { getNodesReadOnly } = useNodesReadOnly()
+  const { getNodesReadOnly } = useNodesReadOnlyByCanEdit(true)
   const { handleRefreshWorkflowDraft } = useSnippetRefreshDraft(snippetId)
 
   const getInputFieldsSyncPayload = useCallback((inputFields?: SnippetInputField[]) => {
diff --git a/web/app/components/snippets/import-snippet-dsl-dialog.tsx b/web/app/components/snippets/import-snippet-dsl-dialog.tsx
index 9933db7418d..7e99726102f 100644
--- a/web/app/components/snippets/import-snippet-dsl-dialog.tsx
+++ b/web/app/components/snippets/import-snippet-dsl-dialog.tsx
@@ -19,11 +19,13 @@ import { toast } from '@langgenius/dify-ui/toast'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Uploader from '@/app/components/app/create-from-dsl-modal/uploader'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useRouter } from '@/next/navigation'
 import {
   useConfirmSnippetImportMutation,
   useImportSnippetDSLMutation,
 } from '@/service/use-snippets'
+import { canCreateAndModifySnippets } from './utils/permission'
 
 type ImportSnippetDSLDialogProps = {
   isOpen: boolean
@@ -105,6 +107,8 @@ function ImportSnippetDSLDialog({
 }: ImportSnippetDSLDialogProps) {
   const { t } = useTranslation()
   const { push } = useRouter()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canCreateAndModifySnippet = canCreateAndModifySnippets(workspacePermissionKeys)
   const importSnippetMutation = useImportSnippetDSLMutation()
   const confirmSnippetImportMutation = useConfirmSnippetImportMutation()
   const [currentTab, setCurrentTab] = useState<ImportSnippetDSLDialogTab>(ImportSnippetDSLDialogTab.FromFile)
@@ -162,6 +166,9 @@ function ImportSnippetDSLDialog({
   }, [handleImportSuccess])
 
   const handleImport = useCallback(async () => {
+    if (!canCreateAndModifySnippet)
+      return
+
     try {
       const response = await importSnippetMutation.mutateAsync({
         mode: currentTab === ImportSnippetDSLDialogTab.FromFile ? 'yaml-content' : 'yaml-url',
@@ -175,10 +182,10 @@ function ImportSnippetDSLDialog({
       if (error instanceof Error && error.message)
         toast.error(error.message)
     }
-  }, [currentTab, dslUrl, fileContent, handleImportResponse, importSnippetMutation])
+  }, [canCreateAndModifySnippet, currentTab, dslUrl, fileContent, handleImportResponse, importSnippetMutation])
 
   const handleConfirmImport: MouseEventHandler = useCallback(async () => {
-    if (!importId)
+    if (!canCreateAndModifySnippet || !importId)
       return
 
     try {
@@ -189,7 +196,7 @@ function ImportSnippetDSLDialog({
       if (error instanceof Error && error.message)
         toast.error(error.message)
     }
-  }, [confirmSnippetImportMutation, handleImportResponse, importId])
+  }, [canCreateAndModifySnippet, confirmSnippetImportMutation, handleImportResponse, importId])
 
   const tabs = useMemo(() => [
     {
@@ -204,6 +211,7 @@ function ImportSnippetDSLDialog({
 
   const isSubmitting = importSnippetMutation.isPending || confirmSnippetImportMutation.isPending
   const importDisabled = isSubmitting
+    || !canCreateAndModifySnippet
     || (currentTab === ImportSnippetDSLDialogTab.FromFile && !currentFile)
     || (currentTab === ImportSnippetDSLDialogTab.FromUrl && !dslUrl.trim())
 
@@ -277,7 +285,7 @@ function ImportSnippetDSLDialog({
       {showConfirmModal && (
         <SnippetDSLConfirmDialog
           versions={versions}
-          confirmDisabled={confirmSnippetImportMutation.isPending}
+          confirmDisabled={confirmSnippetImportMutation.isPending || !canCreateAndModifySnippet}
           onCancel={() => setShowConfirmModal(false)}
           onConfirm={handleConfirmImport}
         />
diff --git a/web/app/components/snippets/utils/permission.ts b/web/app/components/snippets/utils/permission.ts
new file mode 100644
index 00000000000..0eb2018ea76
--- /dev/null
+++ b/web/app/components/snippets/utils/permission.ts
@@ -0,0 +1,22 @@
+import type { PermissionKey } from '@/models/access-control'
+import { hasPermission } from '@/utils/permission'
+
+export const SnippetPermission = {
+  CreateAndModify: 'snippets.create_and_modify',
+  Management: 'snippets.management',
+} as const satisfies Record<string, PermissionKey>
+
+export const canCreateAndModifySnippets = (workspacePermissionKeys: readonly PermissionKey[] | null | undefined) => {
+  return hasPermission(workspacePermissionKeys, SnippetPermission.CreateAndModify)
+}
+
+export const canManageSnippets = (workspacePermissionKeys: readonly PermissionKey[] | null | undefined) => {
+  return hasPermission(workspacePermissionKeys, SnippetPermission.Management)
+}
+
+export const canAccessSnippets = (workspacePermissionKeys: readonly PermissionKey[] | null | undefined) => {
+  return hasPermission(workspacePermissionKeys, [
+    SnippetPermission.CreateAndModify,
+    SnippetPermission.Management,
+  ])
+}
diff --git a/web/app/components/tools/edit-custom-collection-modal/index.tsx b/web/app/components/tools/edit-custom-collection-modal/index.tsx
index ef3218bb570..4c745256b83 100644
--- a/web/app/components/tools/edit-custom-collection-modal/index.tsx
+++ b/web/app/components/tools/edit-custom-collection-modal/index.tsx
@@ -14,7 +14,6 @@ import {
   DrawerViewport,
 } from '@langgenius/dify-ui/drawer'
 import { Input } from '@langgenius/dify-ui/input'
-import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
 import { Textarea } from '@langgenius/dify-ui/textarea'
 import { toast } from '@langgenius/dify-ui/toast'
 import { RiSettings2Line } from '@remixicon/react'
@@ -221,7 +220,7 @@ const EditCustomCollectionModal: FC<Props> = ({
                   : 'data-[swipe-direction=right]:right-2',
               )}
             >
-              <DrawerContent className="flex min-h-0 flex-1 flex-col overflow-hidden p-0 pb-0">
+              <DrawerContent className="flex min-h-0 flex-1 flex-col p-0 pb-0">
                 <div className="shrink-0 border-b border-divider-regular py-4">
                   <div className="flex h-6 items-center justify-between pr-5 pl-6">
                     <DrawerTitle className="min-w-0 truncate system-xl-semibold text-text-primary">
@@ -234,14 +233,8 @@ const EditCustomCollectionModal: FC<Props> = ({
                   </div>
                 </div>
                 <div className="min-h-0 flex-1">
-                  <div className="flex h-full min-h-0 flex-col">
-                    <ScrollArea
-                      className="min-h-0 flex-1 overflow-hidden"
-                      slotClassNames={{
-                        viewport: 'overscroll-contain',
-                        content: 'space-y-4 py-3 pr-8 pl-6',
-                      }}
-                    >
+                  <div className="flex h-full flex-col">
+                    <div className="h-0 grow space-y-4 overflow-y-auto px-6 py-3">
                       <div>
                         <div className="py-2 system-sm-medium text-text-primary">
                           {t('createTool.name', { ns: 'tools' })}
@@ -380,7 +373,7 @@ const EditCustomCollectionModal: FC<Props> = ({
                         />
                       </div>
 
-                    </ScrollArea>
+                    </div>
                     <div className={cn(isEdit ? 'justify-between' : 'justify-end', 'mt-2 flex shrink-0 rounded-b-[10px] border-t border-divider-regular bg-background-section-burn px-6 py-4')}>
                       {
                         isEdit && (
diff --git a/web/app/components/tools/hooks/use-tool-permissions.ts b/web/app/components/tools/hooks/use-tool-permissions.ts
new file mode 100644
index 00000000000..2d393007a29
--- /dev/null
+++ b/web/app/components/tools/hooks/use-tool-permissions.ts
@@ -0,0 +1,16 @@
+'use client'
+
+import { useSelector as useAppContextSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
+
+export const useCanManageTools = () => {
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+
+  return hasPermission(workspacePermissionKeys, 'tool.manage')
+}
+
+export const useCanManageMCP = () => {
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+
+  return hasPermission(workspacePermissionKeys, 'mcp.manage')
+}
diff --git a/web/app/components/tools/integrations-setting-modal.tsx b/web/app/components/tools/integrations-setting-modal.tsx
index 86a29df7870..7bd2cee75e3 100644
--- a/web/app/components/tools/integrations-setting-modal.tsx
+++ b/web/app/components/tools/integrations-setting-modal.tsx
@@ -2,6 +2,7 @@
 
 import type { IntegrationSection } from '@/app/components/integrations/routes'
 import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
 import { useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
 import MenuDialog from '@/app/components/header/account-setting/menu-dialog'
@@ -10,23 +11,35 @@ import { getMarketplaceUrl } from '@/utils/var'
 
 type IntegrationsSettingModalProps = {
   section: IntegrationSection
+  source?: 'agent'
   onCancel: () => void
   onSectionChange: (section: IntegrationSection) => void
 }
 
 export default function IntegrationsSettingModal({
   section,
+  source,
   onCancel,
   onSectionChange,
 }: IntegrationsSettingModalProps) {
   const { t } = useTranslation()
+  const isAgentSource = source === 'agent'
   const handleSwitchToMarketplace = useCallback((path: string) => {
     window.open(getMarketplaceUrl(path), '_blank', 'noopener,noreferrer')
   }, [])
 
   return (
-    <MenuDialog show onClose={onCancel}>
-      <div className="mx-auto flex h-dvh w-[min(1440px,calc(100vw-48px))] shrink-0 py-6">
+    <MenuDialog
+      show
+      backdropClassName={isAgentSource ? 'bg-background-overlay' : undefined}
+      className={isAgentSource ? 'bg-transparent backdrop-blur-none' : undefined}
+      onClose={onCancel}
+    >
+      <div className={cn(
+        'mx-auto flex h-dvh w-[min(1440px,calc(100vw-48px))] shrink-0 py-6',
+        isAgentSource && 'w-full p-6',
+      )}
+      >
         <div className="relative flex min-h-0 w-full shrink-0 overflow-hidden rounded-2xl border border-divider-subtle bg-components-panel-bg shadow-2xl">
           <div className="fixed top-6 right-6 z-9999 flex flex-col items-center">
             <Button
diff --git a/web/app/components/tools/mcp/__tests__/create-card.spec.tsx b/web/app/components/tools/mcp/__tests__/create-card.spec.tsx
index 335eee0bf65..0d8c0b9bc2f 100644
--- a/web/app/components/tools/mcp/__tests__/create-card.spec.tsx
+++ b/web/app/components/tools/mcp/__tests__/create-card.spec.tsx
@@ -40,14 +40,11 @@ vi.mock('../modal', () => ({
   },
 }))
 
-// Mutable workspace manager state
-let mockIsCurrentWorkspaceManager = true
+let mockWorkspacePermissionKeys: string[] = ['mcp.manage']
 
-// Mock the app context
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager,
-    isCurrentWorkspaceEditor: true,
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -87,7 +84,7 @@ describe('NewMCPCard', () => {
 
   beforeEach(() => {
     mockCreateMCP.mockClear()
-    mockIsCurrentWorkspaceManager = true
+    mockWorkspacePermissionKeys = ['mcp.manage']
   })
 
   describe('Rendering', () => {
@@ -108,8 +105,7 @@ describe('NewMCPCard', () => {
 
     it('should render add icon', () => {
       render(<NewMCPCard {...defaultProps} />, { wrapper: createWrapper() })
-      const svgElements = document.querySelectorAll('svg')
-      expect(svgElements.length).toBeGreaterThan(0)
+      expect(document.querySelector('.border-dashed')).toBeInTheDocument()
     })
 
     it('should render toolbar button', () => {
@@ -154,17 +150,17 @@ describe('NewMCPCard', () => {
     })
   })
 
-  describe('Non-Manager User', () => {
-    it('should not render card when user is not workspace manager', () => {
-      mockIsCurrentWorkspaceManager = false
+  describe('mcp.manage Permission', () => {
+    it('should not render card when user lacks mcp.manage', () => {
+      mockWorkspacePermissionKeys = []
 
       render(<NewMCPCard {...defaultProps} />, { wrapper: createWrapper() })
 
       expect(screen.queryByText('tools.mcp.create.cardTitle')).not.toBeInTheDocument()
     })
 
-    it('should not render toolbar button when user is not workspace manager', () => {
-      mockIsCurrentWorkspaceManager = false
+    it('should not render toolbar button when user lacks mcp.manage', () => {
+      mockWorkspacePermissionKeys = []
 
       render(<NewMCPButton {...defaultProps} />, { wrapper: createWrapper() })
 
diff --git a/web/app/components/tools/mcp/__tests__/index.spec.tsx b/web/app/components/tools/mcp/__tests__/index.spec.tsx
index 4f12310ea1a..264d71db190 100644
--- a/web/app/components/tools/mcp/__tests__/index.spec.tsx
+++ b/web/app/components/tools/mcp/__tests__/index.spec.tsx
@@ -12,14 +12,25 @@ type MockDetail = MockProvider | undefined
 
 // Mock dependencies
 const mockRefetch = vi.fn()
+const mockUseAllToolProviders = vi.fn()
 let mockProviders: MockProvider[] = []
 let mockIsLoadingToolProviders = false
+let mockWorkspacePermissionKeys = ['mcp.manage']
 
 vi.mock('@/service/use-tools', () => ({
-  useAllToolProviders: () => ({
-    data: mockProviders,
-    isLoading: mockIsLoadingToolProviders,
-    refetch: mockRefetch,
+  useAllToolProviders: (enabled?: boolean) => {
+    mockUseAllToolProviders(enabled)
+    return {
+      data: mockProviders,
+      isLoading: mockIsLoadingToolProviders,
+      refetch: mockRefetch,
+    }
+  },
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -36,9 +47,9 @@ vi.mock('@/app/components/tools/provider/tool-card-skeleton', () => ({
 // Mock child components
 vi.mock('../create-card', () => ({
   default: ({ handleCreate }: { handleCreate: (provider: { id: string, name: string }) => void }) => (
-    <div data-testid="create-card" onClick={() => handleCreate({ id: 'new-id', name: 'New Provider' })}>
+    <button data-testid="create-card" type="button" onClick={() => handleCreate({ id: 'new-id', name: 'New Provider' })}>
       Create Card
-    </div>
+    </button>
   ),
 }))
 
@@ -47,7 +58,7 @@ vi.mock('../provider-card', () => ({
     const displayName = typeof data.name === 'string' ? data.name : Object.values(data.name)[0]
     return (
       <div data-testid={`provider-card-${data.id}`}>
-        <span onClick={() => handleSelect(data.id)}>{displayName}</span>
+        <button type="button" onClick={() => handleSelect(data.id)}>{displayName}</button>
         <button data-testid={`update-btn-${data.id}`} onClick={() => onUpdate(data.id)}>Update</button>
         <button data-testid={`delete-btn-${data.id}`} onClick={onDeleted}>Delete</button>
       </div>
@@ -78,6 +89,7 @@ describe('MCPList', () => {
     vi.useFakeTimers()
     mockProviders = []
     mockIsLoadingToolProviders = false
+    mockWorkspacePermissionKeys = ['mcp.manage']
     mockRefetch.mockResolvedValue(undefined)
   })
 
@@ -98,6 +110,16 @@ describe('MCPList', () => {
       expect(screen.getByTestId('create-card')).toBeInTheDocument()
     })
 
+    it('should not render or query providers when user lacks mcp.manage', () => {
+      mockWorkspacePermissionKeys = []
+
+      const { container } = render(<MCPList searchText="" />)
+
+      expect(container.firstElementChild).toBeNull()
+      expect(mockUseAllToolProviders).toHaveBeenCalledWith(false)
+      expect(screen.queryByTestId('create-card')).not.toBeInTheDocument()
+    })
+
     it('should hide create card when parent moves creation into the toolbar', () => {
       mockProviders = [
         { id: '1', name: 'Provider 1', type: 'mcp' },
diff --git a/web/app/components/tools/mcp/__tests__/mcp-service-card.spec.tsx b/web/app/components/tools/mcp/__tests__/mcp-service-card.spec.tsx
index 62c6d5f3f61..c9814e8c8d6 100644
--- a/web/app/components/tools/mcp/__tests__/mcp-service-card.spec.tsx
+++ b/web/app/components/tools/mcp/__tests__/mcp-service-card.spec.tsx
@@ -57,7 +57,7 @@ type MockHookState = {
     description: string
     parameters: Record<string, unknown>
   } | undefined
-  isCurrentWorkspaceManager: boolean
+  canManageMCP: boolean
   toggleDisabled: boolean
   isMinimalState: boolean
   appUnpublished: boolean
@@ -80,7 +80,7 @@ const createDefaultHookState = (overrides: Partial<MockHookState> = {}): MockHoo
     description: 'Test server',
     parameters: {},
   },
-  isCurrentWorkspaceManager: true,
+  canManageMCP: true,
   toggleDisabled: false,
   isMinimalState: false,
   appUnpublished: false,
@@ -143,6 +143,28 @@ describe('MCPServiceCard', () => {
       expect(screen.getByRole('switch')).toBeInTheDocument()
     })
 
+    it('should keep status visible and disable management controls without mcp.manage', () => {
+      mockHookState = createDefaultHookState({
+        canManageMCP: false,
+        toggleDisabled: true,
+      })
+
+      render(<MCPServiceCard appInfo={createMockAppInfo()} />, { wrapper: createWrapper() })
+
+      expect(screen.getByText('tools.mcp.server.title')).toBeInTheDocument()
+      expect(screen.getByText(/appOverview.overview.status/)).toBeInTheDocument()
+      expect(screen.getByText('https://api.example.com/mcp/server/abc123/mcp')).toBeInTheDocument()
+
+      const switchElement = screen.getByRole('switch')
+      expect(switchElement.className).toContain('cursor-not-allowed')
+
+      const editButton = screen.getByRole('button', { name: /tools\.mcp\.server\.edit/i })
+      expect(editButton).toBeDisabled()
+
+      const regenerateButton = screen.getByRole('button', { name: /appOverview\.overview\.appInfo\.regenerate/i })
+      expect(regenerateButton).toBeDisabled()
+    })
+
     it('should render edit button in full state', () => {
       render(<MCPServiceCard appInfo={createMockAppInfo()} />, { wrapper: createWrapper() })
 
diff --git a/web/app/components/tools/mcp/__tests__/provider-card.spec.tsx b/web/app/components/tools/mcp/__tests__/provider-card.spec.tsx
index 4ac9e354637..6ff54b6ec1c 100644
--- a/web/app/components/tools/mcp/__tests__/provider-card.spec.tsx
+++ b/web/app/components/tools/mcp/__tests__/provider-card.spec.tsx
@@ -81,11 +81,11 @@ vi.mock('../detail/operation-dropdown', () => ({
   ),
 }))
 
-// Mock the app context
+let mockWorkspacePermissionKeys: string[] = ['mcp.manage']
+
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: true,
-    isCurrentWorkspaceEditor: true,
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -155,6 +155,7 @@ describe('MCPCard', () => {
     mockDeleteMCP.mockClear()
     mockUpdateMCP.mockResolvedValue({ result: 'success' })
     mockDeleteMCP.mockResolvedValue({ result: 'success' })
+    mockWorkspacePermissionKeys = ['mcp.manage']
   })
 
   describe('Rendering', () => {
@@ -335,12 +336,20 @@ describe('MCPCard', () => {
   })
 
   describe('Operation Dropdown', () => {
-    it('should render operation dropdown for workspace managers', () => {
+    it('should render operation dropdown when user has mcp.manage', () => {
       render(<MCPCard {...defaultProps} />, { wrapper: createWrapper() })
 
       expect(screen.getByTestId('operation-dropdown')).toBeInTheDocument()
     })
 
+    it('should not render operation dropdown when user lacks mcp.manage', () => {
+      mockWorkspacePermissionKeys = []
+
+      render(<MCPCard {...defaultProps} />, { wrapper: createWrapper() })
+
+      expect(screen.queryByTestId('operation-dropdown')).not.toBeInTheDocument()
+    })
+
     it('should stop propagation when clicking on dropdown container', () => {
       const handleSelect = vi.fn()
       render(<MCPCard {...defaultProps} handleSelect={handleSelect} />, { wrapper: createWrapper() })
diff --git a/web/app/components/tools/mcp/create-card.tsx b/web/app/components/tools/mcp/create-card.tsx
index 1ec9e99f3ad..58faa5368f5 100644
--- a/web/app/components/tools/mcp/create-card.tsx
+++ b/web/app/components/tools/mcp/create-card.tsx
@@ -3,7 +3,7 @@ import type { ToolWithProvider } from '@/app/components/workflow/types'
 import { Button } from '@langgenius/dify-ui/button'
 import { useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useAppContext } from '@/context/app-context'
+import { useCanManageMCP } from '@/app/components/tools/hooks/use-tool-permissions'
 import { useDocLink } from '@/context/i18n'
 import { useCreateMCP } from '@/service/use-tools'
 import CreateEntryCard from '../provider/create-entry-card'
@@ -14,18 +14,21 @@ type Props = Readonly<{
 }>
 
 function useMCPCreateAction({ handleCreate }: Props) {
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const canManageMCP = useCanManageMCP()
   const { mutateAsync: createMCP } = useCreateMCP()
   const [showModal, setShowModal] = useState(false)
 
   const create = async (info: Parameters<typeof createMCP>[0]) => {
+    if (!canManageMCP)
+      return
+
     const provider = await createMCP(info)
     await handleCreate(provider)
   }
 
   return {
+    canManageMCP,
     create,
-    isCurrentWorkspaceManager,
     setShowModal,
     showModal,
   }
@@ -35,13 +38,13 @@ export function NewMCPButton({ handleCreate }: Props) {
   const { t } = useTranslation()
   const addMCPServerLabel = t('mcp.create.cardTitle', { ns: 'tools' })
   const {
+    canManageMCP,
     create,
-    isCurrentWorkspaceManager,
     setShowModal,
     showModal,
   } = useMCPCreateAction({ handleCreate })
 
-  if (!isCurrentWorkspaceManager)
+  if (!canManageMCP)
     return null
 
   return (
@@ -56,7 +59,7 @@ export function NewMCPButton({ handleCreate }: Props) {
         <span aria-hidden className="i-ri-add-line size-4 shrink-0" />
         {addMCPServerLabel}
       </Button>
-      {showModal && (
+      {canManageMCP && showModal && (
         <MCPModal
           show={showModal}
           onConfirm={create}
@@ -71,8 +74,8 @@ const NewMCPCard = ({ handleCreate }: Props) => {
   const { t } = useTranslation()
   const docLink = useDocLink()
   const {
+    canManageMCP,
     create,
-    isCurrentWorkspaceManager,
     setShowModal,
     showModal,
   } = useMCPCreateAction({ handleCreate })
@@ -81,7 +84,7 @@ const NewMCPCard = ({ handleCreate }: Props) => {
 
   return (
     <>
-      {isCurrentWorkspaceManager && (
+      {canManageMCP && (
         <CreateEntryCard
           title={t('mcp.create.cardTitle', { ns: 'tools' })}
           linkText={t('mcp.create.cardLink', { ns: 'tools' })}
@@ -89,7 +92,7 @@ const NewMCPCard = ({ handleCreate }: Props) => {
           onCreate={() => setShowModal(true)}
         />
       )}
-      {showModal && (
+      {canManageMCP && showModal && (
         <MCPModal
           show={showModal}
           onConfirm={create}
diff --git a/web/app/components/tools/mcp/detail/__tests__/content.spec.tsx b/web/app/components/tools/mcp/detail/__tests__/content.spec.tsx
index 8f01d3f8d90..584b84f3ee3 100644
--- a/web/app/components/tools/mcp/detail/__tests__/content.spec.tsx
+++ b/web/app/components/tools/mcp/detail/__tests__/content.spec.tsx
@@ -107,14 +107,13 @@ vi.mock('../tool-item', () => ({
   ),
 }))
 
-// Mutable workspace manager state
-let mockIsCurrentWorkspaceManager = true
+// Mutable workspace permission state
+let mockWorkspacePermissionKeys: string[] = ['mcp.manage']
 
 // Mock the app context
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager,
-    isCurrentWorkspaceEditor: true,
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -196,7 +195,7 @@ describe('MCPDetailContent', () => {
     mockIsFetching = false
     mockIsUpdating = false
     mockIsAuthorizing = false
-    mockIsCurrentWorkspaceManager = true
+    mockWorkspacePermissionKeys = ['mcp.manage']
   })
 
   describe('Rendering', () => {
@@ -232,13 +231,13 @@ describe('MCPDetailContent', () => {
       expect(screen.getByTestId('operation-dropdown')).toBeInTheDocument()
     })
 
-    it('should not render operation dropdown for non-workspace managers', () => {
-      mockIsCurrentWorkspaceManager = false
+    it('should not render detail when user lacks mcp.manage', () => {
+      mockWorkspacePermissionKeys = []
 
       render(<MCPDetailContent {...defaultProps} />, { wrapper: createWrapper() })
 
       expect(screen.queryByTestId('operation-dropdown')).not.toBeInTheDocument()
-      expect(screen.getByRole('button', { name: 'common.operation.close' })).toBeInTheDocument()
+      expect(screen.queryByText('Test MCP Server')).not.toBeInTheDocument()
     })
   })
 
@@ -466,16 +465,15 @@ describe('MCPDetailContent', () => {
       })
     })
 
-    it('should disable authorize button when not workspace manager', () => {
-      mockIsCurrentWorkspaceManager = false
+    it('should not render authorize action when user lacks mcp.manage', () => {
+      mockWorkspacePermissionKeys = []
       const detail = createMockDetail({ is_team_authorization: false })
       render(
         <MCPDetailContent {...defaultProps} detail={detail} />,
         { wrapper: createWrapper() },
       )
 
-      const authorizeBtn = screen.getByText('tools.mcp.authorize')
-      expect(authorizeBtn.closest('button'))!.toBeDisabled()
+      expect(screen.queryByText('tools.mcp.authorize')).not.toBeInTheDocument()
     })
   })
 
@@ -757,21 +755,18 @@ describe('MCPDetailContent', () => {
       })
     })
 
-    it('should not call handleUpdateTools if not workspace manager', async () => {
-      mockIsCurrentWorkspaceManager = false
+    it('should not render OAuth authorization action when user lacks mcp.manage', async () => {
+      mockWorkspacePermissionKeys = []
       mockAuthorizeMcp.mockResolvedValue({ authorization_url: 'https://oauth.example.com' })
       const detail = createMockDetail({ is_team_authorization: false })
 
-      // OAuth callback should not trigger update for non-manager
-      // The button is disabled, so we simulate a scenario where OAuth was already started
       render(
         <MCPDetailContent {...defaultProps} detail={detail} />,
         { wrapper: createWrapper() },
       )
 
-      // Button should be disabled
-      const authorizeBtn = screen.getByText('tools.mcp.authorize')
-      expect(authorizeBtn.closest('button'))!.toBeDisabled()
+      expect(screen.queryByText('tools.mcp.authorize')).not.toBeInTheDocument()
+      expect(mockAuthorizeMcp).not.toHaveBeenCalled()
     })
   })
 
@@ -802,16 +797,15 @@ describe('MCPDetailContent', () => {
       })
     })
 
-    it('should disable authorized button when not workspace manager', () => {
-      mockIsCurrentWorkspaceManager = false
+    it('should not render authorized button when user lacks mcp.manage', () => {
+      mockWorkspacePermissionKeys = []
       const detail = createMockDetail({ is_team_authorization: true })
       render(
         <MCPDetailContent {...defaultProps} detail={detail} />,
         { wrapper: createWrapper() },
       )
 
-      const authorizedBtn = screen.getByText('tools.auth.authorized')
-      expect(authorizedBtn.closest('button'))!.toBeDisabled()
+      expect(screen.queryByText('tools.auth.authorized')).not.toBeInTheDocument()
     })
   })
 
diff --git a/web/app/components/tools/mcp/detail/content.tsx b/web/app/components/tools/mcp/detail/content.tsx
index f3bb250acd7..97c85e33f64 100644
--- a/web/app/components/tools/mcp/detail/content.tsx
+++ b/web/app/components/tools/mcp/detail/content.tsx
@@ -21,7 +21,7 @@ import { useCallback, useEffect } from 'react'
 import { useTranslation } from 'react-i18next'
 import ActionButton from '@/app/components/base/action-button'
 import Icon from '@/app/components/plugins/card/base/card-icon'
-import { useAppContext } from '@/context/app-context'
+import { useCanManageMCP } from '@/app/components/tools/hooks/use-tool-permissions'
 import { openOAuthPopup } from '@/hooks/use-oauth'
 import {
   useAuthorizeMCP,
@@ -58,9 +58,9 @@ const MCPDetailContent: FC<Props> = ({
   onFirstCreate,
 }) => {
   const { t } = useTranslation()
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const canManageMCP = useCanManageMCP()
 
-  const { data, isFetching: isGettingTools } = useMCPTools(detail.is_team_authorization ? detail.id : '')
+  const { data, isFetching: isGettingTools } = useMCPTools(canManageMCP && detail.is_team_authorization ? detail.id : '')
   const invalidateMCPTools = useInvalidateMCPTools()
   const invalidateAllMCPTools = useInvalidateAllMCPTools()
   const { mutateAsync: updateTools, isPending: isUpdating } = useUpdateMCPTools()
@@ -74,13 +74,13 @@ const MCPDetailContent: FC<Props> = ({
 
   const handleUpdateTools = useCallback(async () => {
     hideUpdateConfirm()
-    if (!detail)
+    if (!canManageMCP || !detail)
       return
     await updateTools(detail.id)
     invalidateMCPTools(detail.id)
     invalidateAllMCPTools()
     onUpdate()
-  }, [detail, hideUpdateConfirm, invalidateAllMCPTools, invalidateMCPTools, onUpdate, updateTools])
+  }, [canManageMCP, detail, hideUpdateConfirm, invalidateAllMCPTools, invalidateMCPTools, onUpdate, updateTools])
 
   const { mutateAsync: updateMCP } = useUpdateMCP({})
   const { mutateAsync: deleteMCP } = useDeleteMCP({})
@@ -101,17 +101,17 @@ const MCPDetailContent: FC<Props> = ({
   }] = useBoolean(false)
 
   const handleOAuthCallback = useCallback(() => {
-    if (!isCurrentWorkspaceManager)
+    if (!canManageMCP)
       return
     if (!detail.id)
       return
     handleUpdateTools()
-  }, [detail.id, handleUpdateTools, isCurrentWorkspaceManager])
+  }, [canManageMCP, detail.id, handleUpdateTools])
 
   const handleAuthorize = useCallback(async () => {
-    onFirstCreate()
-    if (!isCurrentWorkspaceManager)
+    if (!canManageMCP)
       return
+    onFirstCreate()
     if (!detail)
       return
     try {
@@ -129,10 +129,10 @@ const MCPDetailContent: FC<Props> = ({
       // to update the connection status indicator
       onUpdate()
     }
-  }, [onFirstCreate, isCurrentWorkspaceManager, detail, authorizeMcp, handleUpdateTools, handleOAuthCallback, onUpdate])
+  }, [canManageMCP, onFirstCreate, detail, authorizeMcp, handleUpdateTools, handleOAuthCallback, onUpdate])
 
   const handleUpdate = useCallback(async (data: MCPModalConfirmPayload) => {
-    if (!detail)
+    if (!canManageMCP || !detail)
       return
     const res = await updateMCP({
       ...data,
@@ -143,10 +143,10 @@ const MCPDetailContent: FC<Props> = ({
       onUpdate()
       handleAuthorize()
     }
-  }, [detail, updateMCP, hideUpdateModal, onUpdate, handleAuthorize])
+  }, [canManageMCP, detail, updateMCP, hideUpdateModal, onUpdate, handleAuthorize])
 
   const handleDelete = useCallback(async () => {
-    if (!detail)
+    if (!canManageMCP || !detail)
       return
     showDeleting()
     const res = await deleteMCP(detail.id) as MutationResult
@@ -155,14 +155,14 @@ const MCPDetailContent: FC<Props> = ({
       hideDeleteConfirm()
       onUpdate(true)
     }
-  }, [detail, showDeleting, deleteMCP, hideDeleting, hideDeleteConfirm, onUpdate])
+  }, [canManageMCP, detail, showDeleting, deleteMCP, hideDeleting, hideDeleteConfirm, onUpdate])
 
   useEffect(() => {
     if (isTriggerAuthorize)
       handleAuthorize()
   }, [])
 
-  if (!detail)
+  if (!detail || !canManageMCP)
     return null
   const identifierLabel = t('mcp.identifier', { ns: 'tools' })
   const serverUrlLabel = t('mcp.modal.serverUrl', { ns: 'tools' })
@@ -214,7 +214,7 @@ const MCPDetailContent: FC<Props> = ({
             </div>
           </div>
           <div className="flex gap-1">
-            {isCurrentWorkspaceManager && (
+            {canManageMCP && (
               <OperationDropdown
                 onEdit={showUpdateModal}
                 onRemove={showDeleteConfirm}
@@ -231,7 +231,7 @@ const MCPDetailContent: FC<Props> = ({
               variant="secondary"
               className="w-full"
               onClick={handleAuthorize}
-              disabled={!isCurrentWorkspaceManager}
+              disabled={!canManageMCP}
             >
               <StatusDot className="mr-2" status="success" />
               {t('auth.authorized', { ns: 'tools' })}
@@ -242,7 +242,7 @@ const MCPDetailContent: FC<Props> = ({
               variant="primary"
               className="w-full"
               onClick={handleAuthorize}
-              disabled={!isCurrentWorkspaceManager}
+              disabled={!canManageMCP}
             >
               {t('mcp.authorize', { ns: 'tools' })}
             </Button>
@@ -318,7 +318,7 @@ const MCPDetailContent: FC<Props> = ({
           </div>
         )}
       </div>
-      {isShowUpdateModal && (
+      {canManageMCP && isShowUpdateModal && (
         <MCPModal
           data={detail}
           show={isShowUpdateModal}
@@ -326,7 +326,7 @@ const MCPDetailContent: FC<Props> = ({
           onHide={hideUpdateModal}
         />
       )}
-      <AlertDialog open={isShowDeleteConfirm} onOpenChange={open => !open && hideDeleteConfirm()}>
+      <AlertDialog open={canManageMCP && isShowDeleteConfirm} onOpenChange={open => !open && hideDeleteConfirm()}>
         <AlertDialogContent>
           <div className="flex flex-col gap-2 px-6 pt-6 pb-4">
             <AlertDialogTitle className="w-full truncate title-2xl-semi-bold text-text-primary">
diff --git a/web/app/components/tools/mcp/hooks/__tests__/use-mcp-service-card.spec.ts b/web/app/components/tools/mcp/hooks/__tests__/use-mcp-service-card.spec.ts
index a11365e4456..30c34f5b300 100644
--- a/web/app/components/tools/mcp/hooks/__tests__/use-mcp-service-card.spec.ts
+++ b/web/app/components/tools/mcp/hooks/__tests__/use-mcp-service-card.spec.ts
@@ -6,6 +6,7 @@ import { act, renderHook } from '@testing-library/react'
 import * as React from 'react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 import { useMCPServiceCardState } from '../use-mcp-service-card'
 
 // Mutable mock data for MCP server detail
@@ -22,20 +23,29 @@ let mockMCPServerDetailData: {
   description: 'Test server',
   parameters: {},
 }
+const mockUpdateMCPServer = vi.fn().mockResolvedValue({})
+const mockRefreshMCPServerCode = vi.fn().mockResolvedValue({})
+const mockInvalidateMCPServerDetail = vi.fn()
+let mockUseMCPServerDetailAppID = ''
+let mockUseMCPServerDetailEnabled: boolean | undefined
 
 // Mock service hooks
 vi.mock('@/service/use-tools', () => ({
   useUpdateMCPServer: () => ({
-    mutateAsync: vi.fn().mockResolvedValue({}),
+    mutateAsync: mockUpdateMCPServer,
   }),
   useRefreshMCPServerCode: () => ({
-    mutateAsync: vi.fn().mockResolvedValue({}),
+    mutateAsync: mockRefreshMCPServerCode,
     isPending: false,
   }),
-  useMCPServerDetail: () => ({
-    data: mockMCPServerDetailData,
-  }),
-  useInvalidateMCPServerDetail: () => vi.fn(),
+  useMCPServerDetail: (appID: string, enabled?: boolean) => {
+    mockUseMCPServerDetailAppID = appID
+    mockUseMCPServerDetailEnabled = enabled
+    return {
+      data: mockMCPServerDetailData,
+    }
+  },
+  useInvalidateMCPServerDetail: () => mockInvalidateMCPServerDetail,
 }))
 
 // Mock workflow hook
@@ -53,14 +63,6 @@ vi.mock('@/service/use-workflow', () => ({
   }),
 }))
 
-// Mock app context
-vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: true,
-    isCurrentWorkspaceEditor: true,
-  }),
-}))
-
 // Mock apps service
 vi.mock('@/service/apps', () => ({
   fetchAppDetail: vi.fn().mockResolvedValue({
@@ -84,14 +86,19 @@ describe('useMCPServiceCardState', () => {
       React.createElement(QueryClientProvider, { client: queryClient }, children)
   }
 
-  const createMockAppInfo = (mode: AppModeEnum = AppModeEnum.CHAT): AppDetailResponse & Partial<AppSSO> => ({
+  const createMockAppInfo = (
+    mode: AppModeEnum = AppModeEnum.CHAT,
+    permissionKeys: string[] = [AppACLPermission.Edit],
+  ): AppDetailResponse & Partial<AppSSO> => ({
     id: 'app-123',
     name: 'Test App',
     mode,
     api_base_url: 'https://api.example.com/v1',
+    permission_keys: permissionKeys,
   } as AppDetailResponse & Partial<AppSSO>)
 
   beforeEach(() => {
+    vi.clearAllMocks()
     // Reset mock data to default (published server)
     mockMCPServerDetailData = {
       id: 'server-123',
@@ -100,6 +107,8 @@ describe('useMCPServiceCardState', () => {
       description: 'Test server',
       parameters: {},
     }
+    mockUseMCPServerDetailAppID = ''
+    mockUseMCPServerDetailEnabled = undefined
   })
 
   describe('Initialization', () => {
@@ -150,14 +159,58 @@ describe('useMCPServiceCardState', () => {
   })
 
   describe('Permission Flags', () => {
-    it('should have isCurrentWorkspaceManager as true', () => {
+    it('should expose MCP manage capability from app edit ACL', () => {
       const appInfo = createMockAppInfo()
       const { result } = renderHook(
         () => useMCPServiceCardState(appInfo, false),
         { wrapper: createWrapper() },
       )
 
-      expect(result.current.isCurrentWorkspaceManager).toBe(true)
+      expect(result.current.canManageMCP).toBe(true)
+    })
+
+    it('should keep MCP server status readable and disable mutations without app edit ACL', async () => {
+      const appInfo = createMockAppInfo(AppModeEnum.CHAT, [])
+      const { result } = renderHook(
+        () => useMCPServiceCardState(appInfo, false),
+        { wrapper: createWrapper() },
+      )
+
+      expect(result.current.canManageMCP).toBe(false)
+      expect(result.current.toggleDisabled).toBe(true)
+      expect(result.current.serverPublished).toBe(true)
+      expect(result.current.serverActivated).toBe(true)
+      expect(result.current.serverURL).toBe('https://api.example.com/mcp/server/abc123/mcp')
+      expect(mockUseMCPServerDetailAppID).toBe('app-123')
+      expect(mockUseMCPServerDetailEnabled).toBe(true)
+
+      act(() => {
+        result.current.openServerModal()
+        result.current.openConfirmDelete()
+      })
+      expect(result.current.showMCPServerModal).toBe(false)
+      expect(result.current.showConfirmDelete).toBe(false)
+
+      await act(async () => {
+        await result.current.handleGenCode()
+        await result.current.handleStatusChange(true)
+      })
+      expect(mockRefreshMCPServerCode).not.toHaveBeenCalled()
+      expect(mockUpdateMCPServer).not.toHaveBeenCalled()
+    })
+
+    it('should read workflow state without app edit ACL for workflow apps', () => {
+      const appInfo = createMockAppInfo(AppModeEnum.WORKFLOW, [])
+      const { result } = renderHook(
+        () => useMCPServiceCardState(appInfo, false),
+        { wrapper: createWrapper() },
+      )
+
+      expect(result.current.canManageMCP).toBe(false)
+      expect(result.current.isLoading).toBe(false)
+      expect(result.current.appUnpublished).toBe(false)
+      expect(result.current.missingStartNode).toBe(false)
+      expect(result.current.toggleDisabled).toBe(true)
     })
 
     it('should have toggleDisabled false when editor has permissions', () => {
diff --git a/web/app/components/tools/mcp/hooks/use-mcp-service-card.ts b/web/app/components/tools/mcp/hooks/use-mcp-service-card.ts
index 5ea6a237fcf..81d3b84302a 100644
--- a/web/app/components/tools/mcp/hooks/use-mcp-service-card.ts
+++ b/web/app/components/tools/mcp/hooks/use-mcp-service-card.ts
@@ -4,7 +4,7 @@ import type { AppSSO } from '@/types/app'
 import { useQuery, useQueryClient } from '@tanstack/react-query'
 import { useCallback, useMemo, useState } from 'react'
 import { BlockEnum } from '@/app/components/workflow/types'
-import { useAppContext } from '@/context/app-context'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { fetchAppDetail } from '@/service/apps'
 import {
   useInvalidateMCPServerDetail,
@@ -14,6 +14,7 @@ import {
 } from '@/service/use-tools'
 import { useAppWorkflow } from '@/service/use-workflow'
 import { AppModeEnum } from '@/types/app'
+import { getAppACLCapabilities } from '@/utils/permission'
 
 const BASIC_APP_CONFIG_KEY = 'basicAppConfig'
 
@@ -35,9 +36,17 @@ export const useMCPServiceCardState = (
   const { mutateAsync: updateMCPServer } = useUpdateMCPServer()
   const { mutateAsync: refreshMCPServerCode, isPending: genLoading } = useRefreshMCPServerCode()
   const invalidateMCPServerDetail = useInvalidateMCPServerDetail()
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
 
-  // Context
-  const { isCurrentWorkspaceManager, isCurrentWorkspaceEditor } = useAppContext()
+  const canManageMCP = useMemo(
+    () => getAppACLCapabilities(appInfo.permission_keys, {
+      currentUserId,
+      resourceMaintainer: appInfo.maintainer,
+      workspacePermissionKeys,
+    }).canEdit,
+    [appInfo.maintainer, appInfo.permission_keys, currentUserId, workspacePermissionKeys],
+  )
 
   // UI state
   const [showConfirmDelete, setShowConfirmDelete] = useState(false)
@@ -62,7 +71,7 @@ export const useMCPServiceCardState = (
   })
 
   // MCP server detail
-  const { data: detail } = useMCPServerDetail(appId)
+  const { data: detail } = useMCPServerDetail(appId, !!appId)
   const { id, status, server_code } = detail ?? {}
 
   // Server state
@@ -76,7 +85,7 @@ export const useMCPServiceCardState = (
   const appUnpublished = isAdvancedApp ? !currentWorkflow?.graph : !basicAppConfig.updated_at
   const hasStartNode = currentWorkflow?.graph?.nodes?.some(node => node.data.type === BlockEnum.Start)
   const missingStartNode = isWorkflowApp && !hasStartNode
-  const hasInsufficientPermissions = !isCurrentWorkspaceEditor
+  const hasInsufficientPermissions = !canManageMCP
   const toggleDisabled = hasInsufficientPermissions || appUnpublished || missingStartNode || triggerModeDisabled
   const isMinimalState = appUnpublished || missingStartNode
 
@@ -107,11 +116,17 @@ export const useMCPServiceCardState = (
 
   // Handlers
   const handleGenCode = useCallback(async () => {
+    if (!canManageMCP)
+      return
+
     await refreshMCPServerCode(detail?.id || '')
     invalidateMCPServerDetail(appId)
-  }, [refreshMCPServerCode, detail?.id, invalidateMCPServerDetail, appId])
+  }, [canManageMCP, refreshMCPServerCode, detail?.id, invalidateMCPServerDetail, appId])
 
   const handleStatusChange = useCallback(async (state: boolean) => {
+    if (!canManageMCP)
+      return { activated: false }
+
     if (state && !serverPublished) {
       setShowMCPServerModal(true)
       return { activated: false }
@@ -126,7 +141,7 @@ export const useMCPServiceCardState = (
     })
     invalidateMCPServerDetail(appId)
     return { activated: state }
-  }, [serverPublished, updateMCPServer, appId, id, detail, invalidateMCPServerDetail])
+  }, [canManageMCP, serverPublished, updateMCPServer, appId, id, detail, invalidateMCPServerDetail])
 
   const handleServerModalHide = useCallback((wasActivated: boolean) => {
     setShowMCPServerModal(false)
@@ -134,9 +149,19 @@ export const useMCPServiceCardState = (
     return { shouldDeactivate: !wasActivated }
   }, [])
 
-  const openConfirmDelete = useCallback(() => setShowConfirmDelete(true), [])
+  const openConfirmDelete = useCallback(() => {
+    if (!canManageMCP)
+      return
+
+    setShowConfirmDelete(true)
+  }, [canManageMCP])
   const closeConfirmDelete = useCallback(() => setShowConfirmDelete(false), [])
-  const openServerModal = useCallback(() => setShowMCPServerModal(true), [])
+  const openServerModal = useCallback(() => {
+    if (!canManageMCP)
+      return
+
+    setShowMCPServerModal(true)
+  }, [canManageMCP])
 
   const invalidateBasicAppConfig = useCallback(() => {
     queryClient.invalidateQueries({ queryKey: [BASIC_APP_CONFIG_KEY, appId] })
@@ -154,7 +179,7 @@ export const useMCPServiceCardState = (
     detail,
 
     // Permission & validation flags
-    isCurrentWorkspaceManager,
+    canManageMCP,
     toggleDisabled,
     isMinimalState,
     appUnpublished,
diff --git a/web/app/components/tools/mcp/index.tsx b/web/app/components/tools/mcp/index.tsx
index 77b6fae7064..57e10003c5d 100644
--- a/web/app/components/tools/mcp/index.tsx
+++ b/web/app/components/tools/mcp/index.tsx
@@ -3,6 +3,7 @@ import type { ToolsContentInset } from '../content-inset'
 import type { ToolWithProvider } from '@/app/components/workflow/types'
 import { cn } from '@langgenius/dify-ui/cn'
 import { useEffect, useMemo, useState } from 'react'
+import { useCanManageMCP } from '@/app/components/tools/hooks/use-tool-permissions'
 import ToolCardSkeletonGrid from '@/app/components/tools/provider/tool-card-skeleton'
 import {
   useAllToolProviders,
@@ -27,7 +28,8 @@ const MCPList = ({
   onCreatedProviderHandled,
   showCreateCard = true,
 }: Props) => {
-  const { data: list = [] as ToolWithProvider[], isLoading, refetch } = useAllToolProviders()
+  const canManageMCP = useCanManageMCP()
+  const { data: list = [] as ToolWithProvider[], isLoading, refetch } = useAllToolProviders(canManageMCP)
   const [isTriggerAuthorize, setIsTriggerAuthorize] = useState<boolean>(false)
 
   const filteredList = useMemo(() => {
@@ -47,13 +49,16 @@ const MCPList = ({
   }, [list, currentProviderID])
 
   const handleCreate = async (provider: ToolWithProvider) => {
+    if (!canManageMCP)
+      return
+
     await refetch() // update list
     setCurrentProviderID(provider.id)
     setIsTriggerAuthorize(true)
   }
 
   useEffect(() => {
-    if (!createdProviderId)
+    if (!canManageMCP || !createdProviderId)
       return
 
     let isActive = true
@@ -78,15 +83,21 @@ const MCPList = ({
     return () => {
       isActive = false
     }
-  }, [createdProviderId, onCreatedProviderHandled, refetch])
+  }, [canManageMCP, createdProviderId, onCreatedProviderHandled, refetch])
 
   const handleUpdate = async (providerID: string) => {
+    if (!canManageMCP)
+      return
+
     await refetch() // update list
     setCurrentProviderID(providerID)
     setIsTriggerAuthorize(true)
   }
   const contentPaddingClassName = toolsContentInsetClassNames[contentInset]
   const contentFrameClassName = cn(contentPaddingClassName, toolsUnifiedContentFrameClassName)
+  if (!canManageMCP)
+    return null
+
   return (
     <>
       <div
diff --git a/web/app/components/tools/mcp/mcp-service-card.tsx b/web/app/components/tools/mcp/mcp-service-card.tsx
index a897d39dbdd..fd0a1a6f79b 100644
--- a/web/app/components/tools/mcp/mcp-service-card.tsx
+++ b/web/app/components/tools/mcp/mcp-service-card.tsx
@@ -19,7 +19,6 @@ import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/pop
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Switch } from '@langgenius/dify-ui/switch'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
-import { RiEditLine, RiLoopLeftLine } from '@remixicon/react'
 import { useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import CopyFeedback from '@/app/components/base/copy-feedback'
@@ -53,7 +52,7 @@ const StatusIndicator: FC<StatusIndicatorProps> = ({ serverActivated }) => {
 type ServerURLSectionProps = {
   serverURL: string
   serverPublished: boolean
-  isCurrentWorkspaceManager: boolean
+  canManageMCP: boolean
   genLoading: boolean
   onRegenerate: () => void
 }
@@ -61,7 +60,7 @@ type ServerURLSectionProps = {
 const ServerURLSection: FC<ServerURLSectionProps> = ({
   serverURL,
   serverPublished,
-  isCurrentWorkspaceManager,
+  canManageMCP,
   genLoading,
   onRegenerate,
 }) => {
@@ -81,25 +80,29 @@ const ServerURLSection: FC<ServerURLSectionProps> = ({
           <>
             <CopyFeedback content={serverURL} className="size-6!" />
             <Divider type="vertical" className="mx-0.5! h-3.5! shrink-0" />
-            {isCurrentWorkspaceManager && (
-              <Tooltip>
-                <TooltipTrigger
-                  render={(
-                    <button
-                      type="button"
-                      className="cursor-pointer rounded-md p-1 outline-hidden hover:bg-state-base-hover focus-visible:ring-1 focus-visible:ring-components-input-border-hover"
-                      aria-label={t('overview.appInfo.regenerate', { ns: 'appOverview' }) || ''}
-                      onClick={onRegenerate}
-                    >
-                      <RiLoopLeftLine className={cn('size-4 text-text-tertiary hover:text-text-secondary', genLoading && 'animate-spin')} />
-                    </button>
-                  )}
-                />
-                <TooltipContent>
-                  {t('overview.appInfo.regenerate', { ns: 'appOverview' })}
-                </TooltipContent>
-              </Tooltip>
-            )}
+            <Tooltip>
+              <TooltipTrigger
+                render={(
+                  <button
+                    type="button"
+                    className={cn(
+                      'rounded-md p-1 outline-hidden focus-visible:ring-1 focus-visible:ring-components-input-border-hover',
+                      canManageMCP
+                        ? 'cursor-pointer hover:bg-state-base-hover'
+                        : 'cursor-not-allowed',
+                    )}
+                    aria-label={t('overview.appInfo.regenerate', { ns: 'appOverview' }) || ''}
+                    disabled={!canManageMCP}
+                    onClick={onRegenerate}
+                  >
+                    <span className={cn('i-ri-loop-left-line', 'size-4 text-text-tertiary hover:text-text-secondary', genLoading && 'animate-spin')} />
+                  </button>
+                )}
+              />
+              <TooltipContent>
+                {t('overview.appInfo.regenerate', { ns: 'appOverview' })}
+              </TooltipContent>
+            </Tooltip>
           </>
         )}
       </div>
@@ -205,7 +208,7 @@ const MCPServiceCard: FC<IAppCardProps> = ({
     serverActivated,
     serverURL,
     detail,
-    isCurrentWorkspaceManager,
+    canManageMCP,
     toggleDisabled,
     isMinimalState,
     appUnpublished,
@@ -363,7 +366,7 @@ const MCPServiceCard: FC<IAppCardProps> = ({
               <ServerURLSection
                 serverURL={serverURL}
                 serverPublished={serverPublished}
-                isCurrentWorkspaceManager={isCurrentWorkspaceManager}
+                canManageMCP={canManageMCP}
                 genLoading={genLoading}
                 onRegenerate={openConfirmDelete}
               />
@@ -378,7 +381,7 @@ const MCPServiceCard: FC<IAppCardProps> = ({
                 onClick={openServerModal}
               >
                 <div className="flex items-center justify-center gap-px">
-                  <RiEditLine className="size-3.5" />
+                  <span className="i-ri-edit-line size-3.5" />
                   <div className="px-[3px] system-xs-medium text-text-tertiary">
                     {serverPublished ? t('mcp.server.edit', { ns: 'tools' }) : t('mcp.server.addDescription', { ns: 'tools' })}
                   </div>
diff --git a/web/app/components/tools/mcp/provider-card.tsx b/web/app/components/tools/mcp/provider-card.tsx
index 7e2be5efab0..0142b812351 100644
--- a/web/app/components/tools/mcp/provider-card.tsx
+++ b/web/app/components/tools/mcp/provider-card.tsx
@@ -1,4 +1,5 @@
 'use client'
+import type { ComponentProps, KeyboardEvent, MouseEvent } from 'react'
 import type { ToolWithProvider } from '../../workflow/types'
 import {
   AlertDialog,
@@ -14,7 +15,7 @@ import { useBoolean } from 'ahooks'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Icon from '@/app/components/plugins/card/base/card-icon'
-import { useAppContext } from '@/context/app-context'
+import { useCanManageMCP } from '@/app/components/tools/hooks/use-tool-permissions'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import { useDeleteMCP, useUpdateMCP } from '@/service/use-tools'
 import OperationDropdown from './detail/operation-dropdown'
@@ -28,6 +29,15 @@ type Props = Readonly<{
   onDeleted: () => void
 }>
 
+type MCPModalConfirmPayload = Parameters<ComponentProps<typeof MCPModal>['onConfirm']>[0]
+type MutationResult = {
+  result?: string
+}
+
+const isMCPCardActionTarget = (target: EventTarget | null) => {
+  return target instanceof HTMLElement && Boolean(target.closest('[data-mcp-card-action]'))
+}
+
 const MCPCard = ({
   currentProvider,
   data,
@@ -37,7 +47,7 @@ const MCPCard = ({
 }: Props) => {
   const { t } = useTranslation()
   const { formatTimeFromNow } = useFormatTimeFromNow()
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const canManageMCP = useCanManageMCP()
   const isConfigured = data.is_team_authorization && data.tools.length > 0
   const updatedAtText = data.updated_at
     ? `${t('mcp.updateTime', { ns: 'tools' })} ${formatTimeFromNow(data.updated_at * 1000)}`
@@ -63,30 +73,60 @@ const MCPCard = ({
     setFalse: hideDeleting,
   }] = useBoolean(false)
 
-  const handleUpdate = useCallback(async (form: any) => {
+  const handleUpdate = useCallback(async (form: MCPModalConfirmPayload) => {
+    if (!canManageMCP)
+      return
+
     const res = await updateMCP({
       ...form,
       provider_id: data.id,
-    })
-    if ((res as any)?.result === 'success') {
+    }) as MutationResult
+    if (res.result === 'success') {
       hideUpdateModal()
       onUpdate(data.id)
     }
-  }, [data, updateMCP, hideUpdateModal, onUpdate])
+  }, [canManageMCP, data, updateMCP, hideUpdateModal, onUpdate])
 
   const handleDelete = useCallback(async () => {
+    if (!canManageMCP)
+      return
+
     showDeleting()
-    const res = await deleteMCP(data.id)
+    const res = await deleteMCP(data.id) as MutationResult
     hideDeleting()
-    if ((res as any)?.result === 'success') {
+    if (res.result === 'success') {
       hideDeleteConfirm()
       onDeleted()
     }
-  }, [showDeleting, deleteMCP, data.id, hideDeleting, hideDeleteConfirm, onDeleted])
+  }, [canManageMCP, showDeleting, deleteMCP, data.id, hideDeleting, hideDeleteConfirm, onDeleted])
+
+  const handleSelectProvider = useCallback(() => {
+    handleSelect(data.id)
+  }, [data.id, handleSelect])
+
+  const handleCardClick = useCallback((event: MouseEvent<HTMLDivElement>) => {
+    if (isMCPCardActionTarget(event.target))
+      return
+
+    handleSelectProvider()
+  }, [handleSelectProvider])
+
+  const handleCardKeyDown = useCallback((event: KeyboardEvent<HTMLDivElement>) => {
+    if (isMCPCardActionTarget(event.target))
+      return
+    if (event.key !== 'Enter' && event.key !== ' ')
+      return
+
+    event.preventDefault()
+    handleSelectProvider()
+  }, [handleSelectProvider])
 
   return (
     <div
-      onClick={() => handleSelect(data.id)}
+      role="button"
+      tabIndex={0}
+      onClick={handleCardClick}
+      onKeyDown={handleCardKeyDown}
       className={cn(
         'group relative flex cursor-pointer flex-col overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg shadow-xs hover:bg-components-panel-on-panel-item-bg-hover',
         currentProvider?.id === data.id && 'border-components-option-card-option-selected-border bg-components-panel-on-panel-item-bg-hover',
@@ -124,8 +164,8 @@ const MCPCard = ({
           </div>
         )}
       </div>
-      {isCurrentWorkspaceManager && (
-        <div className={cn('absolute top-2.5 right-2.5 hidden group-hover:block', isOperationShow && 'block')} onClick={e => e.stopPropagation()}>
+      {canManageMCP && (
+        <div data-mcp-card-action className={cn('absolute top-2.5 right-2.5 hidden group-hover:block', isOperationShow && 'block')}>
           <OperationDropdown
             inCard
             onOpenChange={setIsOperationShow}
@@ -134,7 +174,7 @@ const MCPCard = ({
           />
         </div>
       )}
-      {isShowUpdateModal && (
+      {canManageMCP && isShowUpdateModal && (
         <MCPModal
           data={data}
           show={isShowUpdateModal}
@@ -142,7 +182,7 @@ const MCPCard = ({
           onHide={hideUpdateModal}
         />
       )}
-      <AlertDialog open={isShowDeleteConfirm} onOpenChange={open => !open && hideDeleteConfirm()}>
+      <AlertDialog open={canManageMCP && isShowDeleteConfirm} onOpenChange={open => !open && hideDeleteConfirm()}>
         <AlertDialogContent>
           <div className="flex flex-col gap-2 px-6 pt-6 pb-4">
             <AlertDialogTitle className="w-full truncate title-2xl-semi-bold text-text-primary">
diff --git a/web/app/components/tools/provider/__tests__/custom-create-card.spec.tsx b/web/app/components/tools/provider/__tests__/custom-create-card.spec.tsx
index 28003bc919c..c15ddb95550 100644
--- a/web/app/components/tools/provider/__tests__/custom-create-card.spec.tsx
+++ b/web/app/components/tools/provider/__tests__/custom-create-card.spec.tsx
@@ -4,13 +4,11 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { AuthType } from '../../types'
 import CustomCreateCard, { NewCustomToolButton } from '../custom-create-card'
 
-// Mock workspace manager state
-let mockIsWorkspaceManager = true
+let mockWorkspacePermissionKeys: string[] = ['tool.manage']
 
-// Mock useAppContext
 vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: mockIsWorkspaceManager,
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
   }),
 }))
 
@@ -83,28 +81,23 @@ describe('CustomCreateCard', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsWorkspaceManager = true
+    mockWorkspacePermissionKeys = ['tool.manage']
     mockModalVisible = false
     mockCreateCustomCollection.mockResolvedValue({})
   })
 
-  // Tests for conditional rendering based on workspace manager status
-  describe('Workspace Manager Conditional Rendering', () => {
-    it('should render card when user is workspace manager', () => {
-      mockIsWorkspaceManager = true
-
+  describe('tool.manage conditional rendering', () => {
+    it('should render card when user has tool.manage', () => {
       render(<CustomCreateCard onRefreshData={mockOnRefreshData} />)
 
-      // Card should be visible with create text
       expect(screen.getByText(/createSwaggerAPIAsTool/i)).toBeInTheDocument()
     })
 
-    it('should not render anything when user is not workspace manager', () => {
-      mockIsWorkspaceManager = false
+    it('should not render anything when user does not have tool.manage', () => {
+      mockWorkspacePermissionKeys = []
 
       const { container } = render(<CustomCreateCard onRefreshData={mockOnRefreshData} />)
 
-      // Container should be empty (firstChild is null when nothing renders)
       expect(container.firstChild).toBeNull()
     })
   })
@@ -146,12 +139,20 @@ describe('CustomCreateCard', () => {
   })
 
   describe('Toolbar Button Rendering', () => {
-    it('should render toolbar add button for workspace managers', () => {
+    it('should render toolbar add button when user has tool.manage', () => {
       render(<NewCustomToolButton onRefreshData={mockOnRefreshData} />)
 
       expect(screen.getByRole('button', { name: /tools\.addSwaggerAPIAsTool/i })).toBeInTheDocument()
     })
 
+    it('should not render toolbar add button when user does not have tool.manage', () => {
+      mockWorkspacePermissionKeys = []
+
+      const { container } = render(<NewCustomToolButton onRefreshData={mockOnRefreshData} />)
+
+      expect(container.firstChild).toBeNull()
+    })
+
     it('should open modal when toolbar add button is clicked', () => {
       render(<NewCustomToolButton onRefreshData={mockOnRefreshData} />)
 
diff --git a/web/app/components/tools/provider/__tests__/detail.spec.tsx b/web/app/components/tools/provider/__tests__/detail.spec.tsx
index af17cc27e1e..9aca087cf7d 100644
--- a/web/app/components/tools/provider/__tests__/detail.spec.tsx
+++ b/web/app/components/tools/provider/__tests__/detail.spec.tsx
@@ -13,10 +13,16 @@ vi.mock('@/i18n-config/language', () => ({
 }))
 
 const mockIsCurrentWorkspaceManager = vi.fn(() => true)
+const mockAppContextState = vi.hoisted(() => ({
+  workspacePermissionKeys: ['tool.manage', 'credential.manage', 'credential.use'] as string[],
+}))
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager(),
   }),
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockAppContextState.workspacePermissionKeys,
+  }),
 }))
 
 const mockSetShowModelModal = vi.fn()
@@ -118,10 +124,10 @@ vi.mock('@/app/components/tools/edit-custom-collection-modal', () => ({
 }))
 
 vi.mock('@/app/components/tools/setting/build-in/config-credentials', () => ({
-  default: ({ onCancel, onSaved, onRemove }: { onCancel: () => void, onSaved: (val: Record<string, string>) => Promise<void>, onRemove: () => Promise<void> }) => (
-    <div data-testid="config-credential">
-      <button data-testid="credential-save" onClick={() => onSaved({ key: 'val' })}>Save</button>
-      <button data-testid="credential-remove" onClick={onRemove}>Remove</button>
+  default: ({ onCancel, onSaved, onRemove, readonly }: { onCancel: () => void, onSaved: (val: Record<string, string>) => Promise<void>, onRemove: () => Promise<void>, readonly?: boolean }) => (
+    <div data-testid="config-credential" data-readonly={readonly ? 'true' : 'false'}>
+      <button data-testid="credential-save" disabled={readonly} onClick={() => onSaved({ key: 'val' })}>Save</button>
+      <button data-testid="credential-remove" disabled={readonly} onClick={onRemove}>Remove</button>
       <button data-testid="credential-cancel" onClick={onCancel}>Cancel</button>
     </div>
   ),
@@ -167,6 +173,7 @@ describe('ProviderDetail', () => {
     ])
     mockFetchCustomToolList.mockResolvedValue([])
     mockFetchModelToolList.mockResolvedValue([])
+    mockAppContextState.workspacePermissionKeys = ['tool.manage', 'credential.manage', 'credential.use']
   })
 
   afterEach(() => {
@@ -330,6 +337,24 @@ describe('ProviderDetail', () => {
 
       expect(configureButton.querySelector('.i-ri-equalizer-2-line')).toBeInTheDocument()
     })
+
+    it('does not fetch or enable custom tool management without tool.manage', async () => {
+      mockAppContextState.workspacePermissionKeys = []
+
+      render(
+        <ProviderDetail
+          collection={createMockCollection({ type: CollectionType.custom })}
+          onHide={mockOnHide}
+          onRefreshData={mockOnRefreshData}
+        />,
+      )
+
+      const configureButton = (await screen.findByText('tools.createTool.editAction')).closest('button')!
+
+      expect(mockFetchCustomCollection).not.toHaveBeenCalled()
+      expect(mockFetchCustomToolList).not.toHaveBeenCalled()
+      expect(configureButton).toBeDisabled()
+    })
   })
 
   describe('Workflow Collection', () => {
@@ -395,6 +420,22 @@ describe('ProviderDetail', () => {
 
       expect(actions).toHaveClass('-mx-4', 'px-4', 'border-b-[0.5px]', 'border-divider-subtle')
     })
+
+    it('does not fetch or show workflow tool edit actions without tool.manage', () => {
+      mockAppContextState.workspacePermissionKeys = []
+
+      render(
+        <ProviderDetail
+          collection={createMockCollection({ type: CollectionType.workflow })}
+          onHide={mockOnHide}
+          onRefreshData={mockOnRefreshData}
+        />,
+      )
+
+      expect(mockFetchWorkflowToolDetail).not.toHaveBeenCalled()
+      expect(screen.queryByText('tools.openInStudio')).not.toBeInTheDocument()
+      expect(screen.queryByText('tools.createTool.editAction')).not.toBeInTheDocument()
+    })
   })
 
   describe('Model Collection', () => {
@@ -494,6 +535,46 @@ describe('ProviderDetail', () => {
       expect(screen.getByTestId('config-credential'))!.toBeInTheDocument()
     })
 
+    it('does not open setup credential drawer without credential.manage', async () => {
+      mockAppContextState.workspacePermissionKeys = ['tool.manage', 'credential.use']
+
+      render(
+        <ProviderDetail
+          collection={createMockCollection({ allow_delete: true, is_team_authorization: false })}
+          onHide={mockOnHide}
+          onRefreshData={mockOnRefreshData}
+        />,
+      )
+      await waitFor(() => {
+        expect(screen.getByText('tools.auth.unauthorized'))!.toBeInTheDocument()
+      })
+
+      const setupButton = screen.getByText('tools.auth.unauthorized').closest('button')!
+      expect(setupButton).toBeDisabled()
+      fireEvent.click(setupButton)
+      expect(screen.queryByTestId('config-credential')).not.toBeInTheDocument()
+    })
+
+    it('opens authorized credential drawer as readonly with credential.use only', async () => {
+      mockAppContextState.workspacePermissionKeys = ['tool.manage', 'credential.use']
+
+      render(
+        <ProviderDetail
+          collection={createMockCollection({ allow_delete: true, is_team_authorization: true })}
+          onHide={mockOnHide}
+          onRefreshData={mockOnRefreshData}
+        />,
+      )
+      await waitFor(() => {
+        expect(screen.getByText('tools.auth.authorized'))!.toBeInTheDocument()
+      })
+
+      fireEvent.click(screen.getByText('tools.auth.authorized'))
+      expect(screen.getByTestId('config-credential'))!.toHaveAttribute('data-readonly', 'true')
+      expect(screen.getByTestId('credential-save'))!.toBeDisabled()
+      expect(screen.getByTestId('credential-remove'))!.toBeDisabled()
+    })
+
     it('saves credentials and refreshes data', async () => {
       render(
         <ProviderDetail
diff --git a/web/app/components/tools/provider/custom-create-card.tsx b/web/app/components/tools/provider/custom-create-card.tsx
index 0eb159478c3..b4ce4968492 100644
--- a/web/app/components/tools/provider/custom-create-card.tsx
+++ b/web/app/components/tools/provider/custom-create-card.tsx
@@ -6,7 +6,7 @@ import { toast } from '@langgenius/dify-ui/toast'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import EditCustomToolModal from '@/app/components/tools/edit-custom-collection-modal'
-import { useAppContext } from '@/context/app-context'
+import { useCanManageTools } from '@/app/components/tools/hooks/use-tool-permissions'
 import { useDocLink } from '@/context/i18n'
 import { createCustomCollection } from '@/service/tools'
 import CreateEntryCard from './create-entry-card'
@@ -17,10 +17,13 @@ type Props = Readonly<{
 
 function useCustomToolCreateAction({ onRefreshData }: Props) {
   const { t } = useTranslation()
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const canManageTools = useCanManageTools()
   const [isShowEditCollectionToolModal, setIsShowEditCustomCollectionModal] = useState(false)
 
   const doCreateCustomToolCollection = async (data: CustomCollectionBackend) => {
+    if (!canManageTools)
+      return
+
     await createCustomCollection(data)
     toast.success(t('api.actionSuccess', { ns: 'common' }))
     setIsShowEditCustomCollectionModal(false)
@@ -28,8 +31,8 @@ function useCustomToolCreateAction({ onRefreshData }: Props) {
   }
 
   return {
+    canManageTools,
     doCreateCustomToolCollection,
-    isCurrentWorkspaceManager,
     isShowEditCollectionToolModal,
     setIsShowEditCustomCollectionModal,
   }
@@ -39,13 +42,13 @@ export const NewCustomToolButton = ({ onRefreshData }: Props) => {
   const { t } = useTranslation()
   const addSwaggerAPIAsToolLabel = t('addSwaggerAPIAsTool', { ns: 'tools' })
   const {
+    canManageTools,
     doCreateCustomToolCollection,
-    isCurrentWorkspaceManager,
     isShowEditCollectionToolModal,
     setIsShowEditCustomCollectionModal,
   } = useCustomToolCreateAction({ onRefreshData })
 
-  if (!isCurrentWorkspaceManager)
+  if (!canManageTools)
     return null
 
   return (
@@ -75,15 +78,15 @@ const Contribute = ({ onRefreshData }: Props) => {
   const { t } = useTranslation()
   const docLink = useDocLink()
   const {
+    canManageTools,
     doCreateCustomToolCollection,
-    isCurrentWorkspaceManager,
     isShowEditCollectionToolModal,
     setIsShowEditCustomCollectionModal,
   } = useCustomToolCreateAction({ onRefreshData })
 
   return (
     <>
-      {isCurrentWorkspaceManager && (
+      {canManageTools && (
         <CreateEntryCard
           className="min-w-0"
           title={t('createSwaggerAPIAsTool', { ns: 'tools' })}
diff --git a/web/app/components/tools/provider/detail.tsx b/web/app/components/tools/provider/detail.tsx
index d53bf1d1526..adf993c44d8 100644
--- a/web/app/components/tools/provider/detail.tsx
+++ b/web/app/components/tools/provider/detail.tsx
@@ -36,13 +36,14 @@ import Description from '@/app/components/plugins/card/base/description'
 import OrgInfo from '@/app/components/plugins/card/base/org-info'
 import Title from '@/app/components/plugins/card/base/title'
 import EditCustomToolModal from '@/app/components/tools/edit-custom-collection-modal'
+import { useCanManageTools } from '@/app/components/tools/hooks/use-tool-permissions'
 import ConfigCredential from '@/app/components/tools/setting/build-in/config-credentials'
 import { WorkflowToolDrawer } from '@/app/components/tools/workflow-tool'
-import { useAppContext } from '@/context/app-context'
 import { useLocale } from '@/context/i18n'
 import { useModalContext } from '@/context/modal-context'
 
 import { useProviderContext } from '@/context/provider-context'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import { getLanguage } from '@/i18n-config/language'
 import {
   deleteWorkflowTool,
@@ -81,7 +82,9 @@ const ProviderDetail = ({
   const isAuthed = collection.is_team_authorization
   const isBuiltIn = collection.type === CollectionType.builtIn
   const isModel = collection.type === CollectionType.model
-  const { isCurrentWorkspaceManager } = useAppContext()
+  const { canUseCredential, canManageCredential } = useCredentialPermissions()
+  const canOpenCredentialSettings = isAuthed ? canUseCredential : canManageCredential
+  const canManageTools = useCanManageTools()
   const invalidateAllWorkflowTools = useInvalidateAllWorkflowTools()
   const [isDetailLoading, setIsDetailLoading] = useState(false)
 
@@ -90,6 +93,9 @@ const ProviderDetail = ({
   const { setShowModelModal } = useModalContext()
   const { modelProviders: providers } = useProviderContext()
   const showSettingAuthModal = () => {
+    if (!canOpenCredentialSettings)
+      return
+
     if (isModel) {
       const provider = providers.find(item => item.provider === collection?.id)
       if (provider) {
@@ -116,6 +122,9 @@ const ProviderDetail = ({
   const [deleteAction, setDeleteAction] = useState('')
 
   const getCustomProvider = useCallback(async () => {
+    if (!canManageTools)
+      return
+
     setIsDetailLoading(true)
     const res = await fetchCustomCollection(collection.name)
     if (res.credentials.auth_type === AuthType.apiKey && !res.credentials.api_key_header_prefix) {
@@ -128,9 +137,12 @@ const ProviderDetail = ({
       provider: collection.name,
     })
     setIsDetailLoading(false)
-  }, [collection.labels, collection.name])
+  }, [canManageTools, collection.labels, collection.name])
 
   const doUpdateCustomToolCollection = async (data: CustomCollectionBackend) => {
+    if (!canManageTools)
+      return
+
     await updateCustomCollection(data)
     onRefreshData()
     await getCustomProvider()
@@ -140,6 +152,9 @@ const ProviderDetail = ({
     setIsShowEditCustomCollectionModal(false)
   }
   const doRemoveCustomToolCollection = async () => {
+    if (!canManageTools)
+      return
+
     await removeCustomCollection(collection?.name as string)
     onRefreshData()
     toast.success(t('api.actionSuccess', { ns: 'common' }))
@@ -148,6 +163,9 @@ const ProviderDetail = ({
   // workflow provider
   const [workflowToolDrawerOpen, setWorkflowToolDrawerOpen] = useState(false)
   const getWorkflowToolProvider = useCallback(async () => {
+    if (!canManageTools)
+      return
+
     setIsDetailLoading(true)
     const res = await fetchWorkflowToolDetail(collection.id)
     const payload = {
@@ -165,8 +183,11 @@ const ProviderDetail = ({
     }
     setCustomCollection(payload)
     setIsDetailLoading(false)
-  }, [collection.id])
+  }, [canManageTools, collection.id])
   const removeWorkflowToolProvider = async () => {
+    if (!canManageTools)
+      return
+
     await deleteWorkflowTool(collection.id)
     onRefreshData()
     toast.success(t('api.actionSuccess', { ns: 'common' }))
@@ -176,6 +197,9 @@ const ProviderDetail = ({
     workflow_app_id: string
     workflow_tool_id: string
   }>) => {
+    if (!canManageTools)
+      return
+
     await saveWorkflowToolProvider(data)
     invalidateAllWorkflowTools()
     onRefreshData()
@@ -218,21 +242,27 @@ const ProviderDetail = ({
         setToolList([])
       }
       else {
+        if (!canManageTools) {
+          setToolList([])
+          setIsDetailLoading(false)
+          return
+        }
+
         const list = await fetchCustomToolList(collection.name)
         setToolList(list)
       }
     }
     catch { }
     setIsDetailLoading(false)
-  }, [collection.name, collection.type])
+  }, [canManageTools, collection.name, collection.type])
 
   useEffect(() => {
-    if (collection.type === CollectionType.custom)
+    if (collection.type === CollectionType.custom && canManageTools)
       getCustomProvider()
-    if (collection.type === CollectionType.workflow)
+    if (collection.type === CollectionType.workflow && canManageTools)
       getWorkflowToolProvider()
     getProviderToolList()
-  }, [collection.name, collection.type, getCustomProvider, getProviderToolList, getWorkflowToolProvider])
+  }, [canManageTools, collection.name, collection.type, getCustomProvider, getProviderToolList, getWorkflowToolProvider])
 
   return (
     <Drawer
@@ -288,6 +318,7 @@ const ProviderDetail = ({
                     <Button
                       className={cn('my-3 w-full shrink-0')}
                       onClick={() => setIsShowEditCustomCollectionModal(true)}
+                      disabled={!canManageTools}
                     >
                       <span aria-hidden className="mr-1 i-ri-equalizer-2-line size-4 text-components-button-secondary-text" />
                       <div className="system-sm-medium text-text-secondary">{t('createTool.editAction', { ns: 'tools' })}</div>
@@ -308,7 +339,7 @@ const ProviderDetail = ({
                         variant="secondary"
                         className={cn('my-3 h-8 min-w-0 flex-1 rounded-lg px-3 py-2')}
                         onClick={() => setWorkflowToolDrawerOpen(true)}
-                        disabled={!isCurrentWorkspaceManager}
+                        disabled={!canManageTools}
                       >
                         <span aria-hidden className="i-ri-equalizer-2-line size-4 shrink-0 text-components-button-secondary-text" />
                         <span className="min-w-0 truncate px-0.5 system-sm-medium text-components-button-secondary-text">{t('createTool.editAction', { ns: 'tools' })}</span>
@@ -332,7 +363,7 @@ const ProviderDetail = ({
                                   if (collection.type === CollectionType.builtIn || collection.type === CollectionType.model)
                                     showSettingAuthModal()
                                 }}
-                                disabled={!isCurrentWorkspaceManager}
+                                disabled={!canOpenCredentialSettings}
                               >
                                 <StatusDot className="mr-2" status="success" />
                                 {t('auth.authorized', { ns: 'tools' })}
@@ -354,7 +385,7 @@ const ProviderDetail = ({
                                 if (collection.type === CollectionType.builtIn || collection.type === CollectionType.model)
                                   showSettingAuthModal()
                               }}
-                              disabled={!isCurrentWorkspaceManager}
+                              disabled={!canOpenCredentialSettings}
                             >
                               {t('auth.unauthorized', { ns: 'tools' })}
                             </Button>
@@ -401,20 +432,27 @@ const ProviderDetail = ({
                     collection={collection}
                     onCancel={() => setShowSettingAuth(false)}
                     onSaved={async (value) => {
+                      if (!canManageCredential)
+                        return
+
                       await updateBuiltInToolCredential(collection.name, value)
                       toast.success(t('api.actionSuccess', { ns: 'common' }))
                       await onRefreshData()
                       setShowSettingAuth(false)
                     }}
                     onRemove={async () => {
+                      if (!canManageCredential)
+                        return
+
                       await removeBuiltInToolCredential(collection.name)
                       toast.success(t('api.actionSuccess', { ns: 'common' }))
                       await onRefreshData()
                       setShowSettingAuth(false)
                     }}
+                    readonly={!canManageCredential}
                   />
                 )}
-                {isShowEditCollectionToolModal && (
+                {isShowEditCollectionToolModal && canManageTools && (
                   <EditCustomToolModal
                     payload={customCollection}
                     onHide={() => setIsShowEditCustomCollectionModal(false)}
@@ -422,7 +460,7 @@ const ProviderDetail = ({
                     onRemove={onClickCustomToolDelete}
                   />
                 )}
-                {workflowToolDrawerOpen && (
+                {workflowToolDrawerOpen && canManageTools && (
                   <WorkflowToolDrawer
                     payload={customCollection as unknown as WorkflowToolDrawerPayload}
                     onHide={() => setWorkflowToolDrawerOpen(false)}
diff --git a/web/app/components/tools/setting/build-in/config-credentials.tsx b/web/app/components/tools/setting/build-in/config-credentials.tsx
index a7ef23657d9..0b5e61444bf 100644
--- a/web/app/components/tools/setting/build-in/config-credentials.tsx
+++ b/web/app/components/tools/setting/build-in/config-credentials.tsx
@@ -33,6 +33,7 @@ type Props = Readonly<{
   isHideRemoveBtn?: boolean
   onRemove?: () => void
   isSaving?: boolean
+  readonly?: boolean
 }>
 
 const ConfigCredential: FC<Props> = ({
@@ -42,6 +43,7 @@ const ConfigCredential: FC<Props> = ({
   isHideRemoveBtn,
   onRemove = noop,
   isSaving,
+  readonly,
 }) => {
   const { t } = useTranslation()
   const language = useLanguage()
@@ -118,6 +120,7 @@ const ConfigCredential: FC<Props> = ({
                           }}
                           formSchemas={credentialSchema}
                           isEditMode={true}
+                          readonly={readonly}
                           showOnVariableMap={{}}
                           validating={false}
                           inputClassName="bg-components-input-bg-normal!"
@@ -137,13 +140,15 @@ const ConfigCredential: FC<Props> = ({
                         />
                         <div className={cn((collection.is_team_authorization && !isHideRemoveBtn) ? 'justify-between' : 'justify-end', 'mt-2 flex')}>
                           {
-                            (collection.is_team_authorization && !isHideRemoveBtn) && (
+                            (collection.is_team_authorization && !isHideRemoveBtn && !readonly) && (
                               <Button onClick={onRemove}>{t('operation.remove', { ns: 'common' })}</Button>
                             )
                           }
                           <div className="flex space-x-2">
                             <Button onClick={onCancel}>{t('operation.cancel', { ns: 'common' })}</Button>
-                            <Button loading={isLoading || isSaving} disabled={isLoading || isSaving} variant="primary" onClick={handleSave}>{t('operation.save', { ns: 'common' })}</Button>
+                            {!readonly && (
+                              <Button loading={isLoading || isSaving} disabled={isLoading || isSaving} variant="primary" onClick={handleSave}>{t('operation.save', { ns: 'common' })}</Button>
+                            )}
                           </div>
                         </div>
                       </>
diff --git a/web/app/components/tools/workflow-tool/__tests__/configure-button.spec.tsx b/web/app/components/tools/workflow-tool/__tests__/configure-button.spec.tsx
index 06b9a77b5c5..079c838cc84 100644
--- a/web/app/components/tools/workflow-tool/__tests__/configure-button.spec.tsx
+++ b/web/app/components/tools/workflow-tool/__tests__/configure-button.spec.tsx
@@ -22,14 +22,6 @@ vi.mock('@/next/navigation', () => ({
   useParams: () => ({}),
 }))
 
-// Mock app context
-const mockIsCurrentWorkspaceManager = vi.fn(() => true)
-vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager(),
-  }),
-}))
-
 // Mock API services - only mock external services
 const mockCreateWorkflowToolProvider = vi.fn()
 const mockSaveWorkflowToolProvider = vi.fn()
@@ -140,7 +132,6 @@ const createDefaultConfigureButtonProps = (overrides = {}) => ({
   published: false,
   isLoading: false,
   outdated: false,
-  isCurrentWorkspaceManager: true,
   onConfigure: vi.fn(),
   ...overrides,
 })
@@ -177,7 +168,6 @@ const createDefaultDrawerPayload = (overrides: Partial<WorkflowToolDrawerPayload
 describe('WorkflowToolConfigureButton', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsCurrentWorkspaceManager.mockReturnValue(true)
     mockUseWorkflowToolDetailByAppID.mockImplementation((_appId: string, enabled: boolean) => ({
       data: enabled ? createMockWorkflowToolDetail() : undefined,
       isLoading: false,
@@ -274,18 +264,6 @@ describe('WorkflowToolConfigureButton', () => {
         expect(screen.getByText('workflow.common.manageInTools'))!.toBeInTheDocument()
       })
     })
-
-    it('should render different UI for non-workspace manager', () => {
-      // Arrange
-      const props = createDefaultConfigureButtonProps({ isCurrentWorkspaceManager: false })
-
-      // Act
-      render(<WorkflowToolConfigureButton {...props} />)
-
-      // Assert
-      const textElement = screen.getByText('workflow.common.workflowAsTool')
-      expect(textElement)!.toHaveClass('text-text-tertiary')
-    })
   })
 
   // Props Testing (REQUIRED)
@@ -452,9 +430,9 @@ describe('WorkflowToolConfigureButton', () => {
       })
     })
 
-    it('should disable configure button when not workspace manager', async () => {
+    it('should disable configure button when workflow tool is disabled', async () => {
       // Arrange
-      const props = createDefaultConfigureButtonProps({ published: true, isCurrentWorkspaceManager: false })
+      const props = createDefaultConfigureButtonProps({ published: true, disabled: true })
 
       // Act
       render(<WorkflowToolConfigureButton {...props} />)
@@ -1535,7 +1513,6 @@ describe('MethodSelector', () => {
 describe('Integration Tests', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsCurrentWorkspaceManager.mockReturnValue(true)
     mockUseWorkflowToolDetailByAppID.mockImplementation((_appId: string, enabled: boolean) => ({
       data: enabled ? createMockWorkflowToolDetail() : undefined,
       isLoading: false,
diff --git a/web/app/components/tools/workflow-tool/__tests__/index.spec.tsx b/web/app/components/tools/workflow-tool/__tests__/index.spec.tsx
index c0811ba6d5f..e3791bb174f 100644
--- a/web/app/components/tools/workflow-tool/__tests__/index.spec.tsx
+++ b/web/app/components/tools/workflow-tool/__tests__/index.spec.tsx
@@ -89,21 +89,12 @@ describe('WorkflowToolDrawer', () => {
     await user.clear(screen.getByPlaceholderText('tools.createTool.toolNamePlaceHolder'))
     await user.type(screen.getByPlaceholderText('tools.createTool.toolNamePlaceHolder'), 'Created Tool')
     await user.click(screen.getByTestId('append-label'))
-    await user.click(screen.getByTestId('app-icon'))
-    await waitFor(() => {
-      expect(screen.getByPlaceholderText('Search emojis...')).toBeInTheDocument()
-    })
-    await user.click(screen.getByRole('button', { name: '#E4FBCC' }))
-    await user.click(screen.getByRole('button', { name: /iconPicker\.ok/ }))
-    await waitFor(() => {
-      expect(screen.queryByPlaceholderText('Search emojis...')).not.toBeInTheDocument()
-    })
     await user.click(screen.getByRole('button', { name: 'common.operation.save' }))
 
     expect(onCreate).toHaveBeenCalledWith(expect.objectContaining({
       workflow_app_id: 'workflow-app-1',
       label: 'Created Tool',
-      icon: { content: '🔧', background: '#E4FBCC' },
+      icon: { content: '🔧', background: '#ffffff' },
       labels: ['label1', 'new-label'],
     }))
   })
diff --git a/web/app/components/tools/workflow-tool/configure-button.tsx b/web/app/components/tools/workflow-tool/configure-button.tsx
index 58706962502..d1ce3a52a80 100644
--- a/web/app/components/tools/workflow-tool/configure-button.tsx
+++ b/web/app/components/tools/workflow-tool/configure-button.tsx
@@ -13,7 +13,6 @@ type Props = Readonly<{
   published: boolean
   isLoading: boolean
   outdated: boolean
-  isCurrentWorkspaceManager: boolean
   onConfigure: () => void
   disabledReason?: string
 }>
@@ -23,7 +22,6 @@ const WorkflowToolConfigureButton = ({
   published,
   isLoading,
   outdated,
-  isCurrentWorkspaceManager,
   onConfigure,
   disabledReason,
 }: Props) => {
@@ -36,46 +34,30 @@ const WorkflowToolConfigureButton = ({
       {(!published || !isLoading) && (
         <div className={cn(
           'group rounded-lg bg-background-section-burn transition-colors',
-          disabled || !isCurrentWorkspaceManager ? 'cursor-not-allowed opacity-60 shadow-xs' : 'cursor-pointer',
-          !disabled && !published && isCurrentWorkspaceManager && 'hover:bg-state-accent-hover',
+          disabled ? 'cursor-not-allowed opacity-60 shadow-xs' : 'cursor-pointer',
+          !disabled && !published && 'hover:bg-state-accent-hover',
         )}
         >
-          {isCurrentWorkspaceManager
-            ? (
-                <div
-                  className="flex items-center justify-start gap-2 p-2 pl-2.5"
-                  onClick={() => {
-                    if (!disabled && !published)
-                      onConfigure()
-                  }}
-                >
-                  <span className={cn('relative i-ri-hammer-line size-4 text-text-secondary', !disabled && !published && 'group-hover:text-text-accent')} />
-                  <div
-                    title={t('common.workflowAsTool', { ns: 'workflow' }) || ''}
-                    className={cn('shrink grow basis-0 truncate system-sm-medium text-text-secondary', !disabled && !published && 'group-hover:text-text-accent')}
-                  >
-                    {t('common.workflowAsTool', { ns: 'workflow' })}
-                  </div>
-                  {!published && (
-                    <span className="shrink-0 rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary">
-                      {t('common.configureRequired', { ns: 'workflow' })}
-                    </span>
-                  )}
-                </div>
-              )
-            : (
-                <div
-                  className="flex items-center justify-start gap-2 p-2 pl-2.5"
-                >
-                  <span className="i-ri-hammer-line size-4 text-text-tertiary" />
-                  <div
-                    title={t('common.workflowAsTool', { ns: 'workflow' }) || ''}
-                    className="shrink grow basis-0 truncate system-sm-medium text-text-tertiary"
-                  >
-                    {t('common.workflowAsTool', { ns: 'workflow' })}
-                  </div>
-                </div>
-              )}
+          <div
+            className="flex items-center justify-start gap-2 p-2 pl-2.5"
+            onClick={() => {
+              if (!disabled && !published)
+                onConfigure()
+            }}
+          >
+            <span className={cn('relative i-ri-hammer-line size-4 text-text-secondary', !disabled && !published && 'group-hover:text-text-accent')} />
+            <div
+              title={t('common.workflowAsTool', { ns: 'workflow' }) || ''}
+              className={cn('shrink grow basis-0 truncate system-sm-medium text-text-secondary', !disabled && !published && 'group-hover:text-text-accent')}
+            >
+              {t('common.workflowAsTool', { ns: 'workflow' })}
+            </div>
+            {!published && (
+              <span className="shrink-0 rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary">
+                {t('common.configureRequired', { ns: 'workflow' })}
+              </span>
+            )}
+          </div>
           {disabledReason && (
             <div className="mt-1 px-2.5 pb-2 text-xs leading-[18px] text-text-tertiary">
               {disabledReason}
@@ -88,7 +70,7 @@ const WorkflowToolConfigureButton = ({
                   size="small"
                   className="w-[140px]"
                   onClick={onConfigure}
-                  disabled={!isCurrentWorkspaceManager || disabled}
+                  disabled={disabled}
                 >
                   {t('common.configure', { ns: 'workflow' })}
                   {outdated && <StatusDot className="ml-1" status="warning" />}
diff --git a/web/app/components/tools/workflow-tool/hooks/__tests__/use-configure-button.spec.ts b/web/app/components/tools/workflow-tool/hooks/__tests__/use-configure-button.spec.ts
index fd800fe5b00..741d7ebadbf 100644
--- a/web/app/components/tools/workflow-tool/hooks/__tests__/use-configure-button.spec.ts
+++ b/web/app/components/tools/workflow-tool/hooks/__tests__/use-configure-button.spec.ts
@@ -4,13 +4,6 @@ import { act, renderHook } from '@testing-library/react'
 import { InputVarType } from '@/app/components/workflow/types'
 import { isParametersOutdated, useConfigureButton } from '../use-configure-button'
 
-const mockIsCurrentWorkspaceManager = vi.fn(() => true)
-vi.mock('@/context/app-context', () => ({
-  useAppContext: () => ({
-    isCurrentWorkspaceManager: mockIsCurrentWorkspaceManager(),
-  }),
-}))
-
 const mockCreateWorkflowToolProvider = vi.fn()
 const mockSaveWorkflowToolProvider = vi.fn()
 vi.mock('@/service/tools', () => ({
@@ -197,7 +190,6 @@ describe('isParametersOutdated', () => {
 describe('useConfigureButton', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockIsCurrentWorkspaceManager.mockReturnValue(true)
     mockUseWorkflowToolDetailByAppID.mockImplementation((_appId: string, enabled: boolean) => ({
       data: enabled ? createMockDetail() : undefined,
       isLoading: false,
@@ -214,12 +206,6 @@ describe('useConfigureButton', () => {
       expect(result.current.payload).toMatchObject({ workflow_app_id: 'app-123' })
     })
 
-    it('should forward isCurrentWorkspaceManager from context', () => {
-      mockIsCurrentWorkspaceManager.mockReturnValue(false)
-      const { result } = renderHook(() => useConfigureButton(createDefaultOptions()))
-      expect(result.current.isCurrentWorkspaceManager).toBe(false)
-    })
-
     it('should forward isLoading from query hook', () => {
       mockUseWorkflowToolDetailByAppID.mockReturnValue({ data: undefined, isLoading: true })
       const { result } = renderHook(() => useConfigureButton(createDefaultOptions({ published: true })))
diff --git a/web/app/components/tools/workflow-tool/hooks/use-configure-button.ts b/web/app/components/tools/workflow-tool/hooks/use-configure-button.ts
index f4b6881f986..2e2d89e1506 100644
--- a/web/app/components/tools/workflow-tool/hooks/use-configure-button.ts
+++ b/web/app/components/tools/workflow-tool/hooks/use-configure-button.ts
@@ -4,7 +4,6 @@ import type { PublishWorkflowParams } from '@/types/workflow'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useEffect, useMemo, useRef } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useAppContext } from '@/context/app-context'
 import { createWorkflowToolProvider, saveWorkflowToolProvider } from '@/service/tools'
 import { useInvalidateAllWorkflowTools, useInvalidateWorkflowToolDetailByAppID, useWorkflowToolDetailByAppID } from '@/service/use-tools'
 
@@ -119,7 +118,6 @@ export function useConfigureButton(options: UseConfigureButtonOptions) {
   } = options
 
   const { t } = useTranslation()
-  const { isCurrentWorkspaceManager } = useAppContext()
 
   // Data fetching via React Query
   const { data: detail, isLoading } = useWorkflowToolDetailByAppID(workflowAppId, enabled && published)
@@ -209,7 +207,6 @@ export function useConfigureButton(options: UseConfigureButtonOptions) {
     isLoading,
     outdated,
     payload,
-    isCurrentWorkspaceManager,
     handleCreate,
     handleUpdate,
   }
diff --git a/web/app/components/workflow-app/__tests__/index.spec.tsx b/web/app/components/workflow-app/__tests__/index.spec.tsx
index 880a62ca8d4..28810aa264f 100644
--- a/web/app/components/workflow-app/__tests__/index.spec.tsx
+++ b/web/app/components/workflow-app/__tests__/index.spec.tsx
@@ -1,5 +1,6 @@
 import type { ReactNode } from 'react'
 import { render, screen, waitFor } from '@testing-library/react'
+import { AppACLPermission } from '@/utils/permission'
 import WorkflowApp from '../index'
 
 const mockSetTriggerStatuses = vi.fn()
@@ -17,6 +18,8 @@ let appStoreState: {
   appDetail?: {
     id: string
     mode: string
+    maintainer?: string
+    permission_keys?: string[]
   }
 }
 
@@ -38,6 +41,10 @@ let appContextState: {
   currentWorkspace: {
     id?: string
   }
+  userProfile: {
+    id: string
+  }
+  workspacePermissionKeys: string[]
 }
 
 let appTriggersState: {
@@ -185,6 +192,7 @@ describe('WorkflowApp', () => {
       appDetail: {
         id: 'app-1',
         mode: 'workflow',
+        permission_keys: [AppACLPermission.TestAndRun],
       },
     }
     workflowInitState = {
@@ -206,6 +214,8 @@ describe('WorkflowApp', () => {
     appContextState = {
       isLoadingCurrentWorkspace: false,
       currentWorkspace: { id: 'workspace-1' },
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: [],
     }
     appTriggersState = {}
     searchParamsValue = null
@@ -293,6 +303,27 @@ describe('WorkflowApp', () => {
     expect(mockSetInputs).not.toHaveBeenCalled()
   })
 
+  it('should skip replay lookups when test/run permission is missing', async () => {
+    searchParamsValue = 'run-1'
+    appStoreState = {
+      appDetail: {
+        id: 'app-1',
+        mode: 'workflow',
+        permission_keys: [AppACLPermission.ViewLayout],
+      },
+    }
+
+    render(<WorkflowApp />)
+
+    await waitFor(() => {
+      expect(screen.getByTestId('workflow-app-main')).toBeInTheDocument()
+    })
+
+    expect(mockGetWorkflowRunAndTraceUrl).not.toHaveBeenCalled()
+    expect(mockFetchRunDetail).not.toHaveBeenCalled()
+    expect(mockSetInputs).not.toHaveBeenCalled()
+  })
+
   it('should skip replay fetches when the resolved run url is empty', async () => {
     searchParamsValue = 'run-1'
     mockGetWorkflowRunAndTraceUrl.mockReturnValue({ runUrl: '' })
diff --git a/web/app/components/workflow-app/components/__tests__/workflow-children.spec.tsx b/web/app/components/workflow-app/components/__tests__/workflow-children.spec.tsx
index 898afffb694..aff1c32b19d 100644
--- a/web/app/components/workflow-app/components/__tests__/workflow-children.spec.tsx
+++ b/web/app/components/workflow-app/components/__tests__/workflow-children.spec.tsx
@@ -45,6 +45,7 @@ const mockExportCheck = vi.fn()
 const mockAutoGenerateWebhookUrl = vi.fn()
 
 let workflowStoreState: WorkflowStoreState
+let mockCanEdit = true
 let eventSubscription: ((value: { type: string, payload: { data: Array<Record<string, unknown>> } }) => void) | null = null
 let lastGenerateNodeInput: Record<string, unknown> | null = null
 
@@ -61,6 +62,16 @@ vi.mock('@/app/components/workflow/store', () => ({
   useStore: <T,>(selector: (state: WorkflowStoreState) => T) => selector(workflowStoreState),
 }))
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canImportExportDSL: boolean, canEdit: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canImportExportDSL: true,
+        canEdit: mockCanEdit,
+      },
+    }),
+}))
+
 vi.mock('@/context/event-emitter', () => ({
   useEventEmitterContextContext: () => ({
     eventEmitter: {
@@ -296,6 +307,7 @@ describe('WorkflowChildren', () => {
     }
     eventSubscription = null
     lastGenerateNodeInput = null
+    mockCanEdit = true
     mockHandleSyncWorkflowDraft.mockImplementation((_force?: boolean, _notRefresh?: boolean, callback?: { onSuccess?: () => void }) => {
       callback?.onSuccess?.()
     })
@@ -380,6 +392,20 @@ describe('WorkflowChildren', () => {
     expect(mockHandleOnboardingClose).toHaveBeenCalled()
   })
 
+  it('should hide onboarding actions when workflow is readonly', () => {
+    mockCanEdit = false
+    workflowStoreState = {
+      ...workflowStoreState,
+      showOnboarding: true,
+    }
+
+    render(<WorkflowChildren />)
+
+    expect(screen.queryByTestId('workflow-onboarding-modal')).not.toBeInTheDocument()
+    expect(mockSetNodes).not.toHaveBeenCalled()
+    expect(mockHandleSyncWorkflowDraft).not.toHaveBeenCalled()
+  })
+
   it('should create a start node, sync draft, and auto-generate webhook url after selecting a start node', async () => {
     const user = userEvent.setup()
     workflowStoreState = {
diff --git a/web/app/components/workflow-app/components/__tests__/workflow-main.spec.tsx b/web/app/components/workflow-app/components/__tests__/workflow-main.spec.tsx
index 956c95fa754..cc3f726f6b6 100644
--- a/web/app/components/workflow-app/components/__tests__/workflow-main.spec.tsx
+++ b/web/app/components/workflow-app/components/__tests__/workflow-main.spec.tsx
@@ -1,8 +1,10 @@
 import type { ReactNode } from 'react'
 import type { WorkflowProps } from '@/app/components/workflow'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { useStore as useAppStore } from '@/app/components/app/store'
 import { ChatVarType } from '@/app/components/workflow/panel/chat-variable-panel/type'
 import { BlockEnum } from '@/app/components/workflow/types'
+import { AppACLPermission } from '@/utils/permission'
 import WorkflowMain from '../workflow-main'
 
 const mockSetFeatures = vi.fn()
@@ -92,12 +94,6 @@ vi.mock('@/app/components/workflow/store', () => ({
   }),
 }))
 
-vi.mock('@/app/components/app/store', () => ({
-  useStore: <T,>(selector: (state: { appDetail: { mode: string } }) => T) => selector({
-    appDetail: { mode: 'workflow' },
-  }),
-}))
-
 vi.mock('reactflow', () => ({
   useReactFlow: () => ({
     getNodes: () => [],
@@ -224,6 +220,7 @@ vi.mock('@/app/components/workflow-app/hooks', () => ({
   useAvailableNodesMetaData: () => ({ nodes: [{ id: 'start' }], nodesMap: { start: { id: 'start' } } }),
   useConfigsMap: () => ({ flowId: 'app-1', flowType: 'app-flow', fileSettings: { enabled: true } }),
   useDSL: () => ({ exportCheck: hookFns.exportCheck, handleExportDSL: hookFns.handleExportDSL }),
+  useDSLByCanEdit: () => ({ exportCheck: hookFns.exportCheck, handleExportDSL: hookFns.handleExportDSL }),
   useGetRunAndTraceUrl: () => ({ getWorkflowRunAndTraceUrl: hookFns.getWorkflowRunAndTraceUrl }),
   useInspectVarsCrud: () => ({
     hasNodeInspectVars: hookFns.hasNodeInspectVars,
@@ -245,6 +242,10 @@ vi.mock('@/app/components/workflow-app/hooks', () => ({
     doSyncWorkflowDraft: hookFns.doSyncWorkflowDraft,
     syncWorkflowDraftWhenPageClose: hookFns.syncWorkflowDraftWhenPageClose,
   }),
+  useNodesSyncDraftByCanEdit: () => ({
+    doSyncWorkflowDraft: hookFns.doSyncWorkflowDraft,
+    syncWorkflowDraftWhenPageClose: hookFns.syncWorkflowDraftWhenPageClose,
+  }),
   useSetWorkflowVarsWithValue: () => ({
     fetchInspectVars: hookFns.fetchInspectVars,
   }),
@@ -256,6 +257,13 @@ vi.mock('@/app/components/workflow-app/hooks', () => ({
     handleRun: hookFns.handleRun,
     handleStopRun: hookFns.handleStopRun,
   }),
+  useWorkflowRunByCanEdit: () => ({
+    handleBackupDraft: hookFns.handleBackupDraft,
+    handleLoadBackupDraft: hookFns.handleLoadBackupDraft,
+    handleRestoreFromPublishedWorkflow: hookFns.handleRestoreFromPublishedWorkflow,
+    handleRun: hookFns.handleRun,
+    handleStopRun: hookFns.handleStopRun,
+  }),
   useWorkflowStartRun: () => ({
     handleStartWorkflowRun: hookFns.handleStartWorkflowRun,
     handleWorkflowStartRunInChatflow: hookFns.handleWorkflowStartRunInChatflow,
@@ -265,6 +273,27 @@ vi.mock('@/app/components/workflow-app/hooks', () => ({
     handleWorkflowTriggerPluginRunInWorkflow: hookFns.handleWorkflowTriggerPluginRunInWorkflow,
     handleWorkflowRunAllTriggersInWorkflow: hookFns.handleWorkflowRunAllTriggersInWorkflow,
   }),
+  useWorkflowStartRunByCanEdit: () => ({
+    handleStartWorkflowRun: hookFns.handleStartWorkflowRun,
+    handleWorkflowStartRunInChatflow: hookFns.handleWorkflowStartRunInChatflow,
+    handleWorkflowStartRunInWorkflow: hookFns.handleWorkflowStartRunInWorkflow,
+    handleWorkflowTriggerScheduleRunInWorkflow: hookFns.handleWorkflowTriggerScheduleRunInWorkflow,
+    handleWorkflowTriggerWebhookRunInWorkflow: hookFns.handleWorkflowTriggerWebhookRunInWorkflow,
+    handleWorkflowTriggerPluginRunInWorkflow: hookFns.handleWorkflowTriggerPluginRunInWorkflow,
+    handleWorkflowRunAllTriggersInWorkflow: hookFns.handleWorkflowRunAllTriggersInWorkflow,
+  }),
+}))
+
+vi.mock('@/app/components/workflow-app/hooks/use-workflow-draft-graph-for-canvas', () => ({
+  useWorkflowDraftGraphForCanvas: () => ({
+    getWorkflowDraftGraphForCanvas: (graph?: { nodes?: unknown[], edges?: unknown[], viewport?: unknown }) => ({
+      nodes: graph?.nodes?.length
+        ? graph.nodes
+        : [{ id: 'start-placeholder', data: { type: BlockEnum.StartPlaceholder } }],
+      edges: graph?.edges || [],
+      viewport: graph?.viewport || { x: 0, y: 0, zoom: 1 },
+    }),
+  }),
 }))
 
 vi.mock('@/app/components/workflow-app/hooks/use-workflow-draft-graph-for-canvas', () => ({
@@ -297,6 +326,7 @@ describe('WorkflowMain', () => {
     collaborationListeners.workflowUpdate = null
     collaborationListeners.syncRequest = null
     mockFetchWorkflowDraft.mockReset()
+    useAppStore.setState({ appDetail: undefined })
   })
 
   it('should render the inner workflow context with children and forwarded graph props', () => {
@@ -405,6 +435,30 @@ describe('WorkflowMain', () => {
     })
   })
 
+  it('should pass view-layout ACL permission as comment-only workflow access', () => {
+    useAppStore.setState({
+      appDetail: {
+        permission_keys: [AppACLPermission.ViewLayout],
+      } as never,
+    })
+
+    render(
+      <WorkflowMain
+        nodes={[]}
+        edges={[]}
+        viewport={{ x: 0, y: 0, zoom: 1 }}
+      />,
+    )
+
+    expect(capturedContextProps?.hooksStore).toMatchObject({
+      accessControl: {
+        canEdit: false,
+        canComment: true,
+        canRun: false,
+      },
+    })
+  })
+
   it('passes collaboration props and tracks cursors when collaboration is enabled', () => {
     collaborationRuntime.isEnabled = true
     collaborationRuntime.isConnected = true
diff --git a/web/app/components/workflow-app/components/workflow-children.tsx b/web/app/components/workflow-app/components/workflow-children.tsx
index 2e65b5963dc..4ef93b079b2 100644
--- a/web/app/components/workflow-app/components/workflow-children.tsx
+++ b/web/app/components/workflow-app/components/workflow-children.tsx
@@ -1,5 +1,5 @@
 import type {
-  PluginDefaultValue,
+  BlockDefaultValue,
   TriggerDefaultValue,
 } from '@/app/components/workflow/block-selector/types'
 import type { EnvironmentVariable } from '@/app/components/workflow/types'
@@ -15,6 +15,7 @@ import {
   useDSL,
   usePanelInteractions,
 } from '@/app/components/workflow/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { useNodesSyncDraft } from '@/app/components/workflow/hooks/use-nodes-sync-draft'
 import { useStore } from '@/app/components/workflow/store'
 import { BlockEnum } from '@/app/components/workflow/types'
@@ -72,6 +73,8 @@ const WorkflowChildren = () => {
   const showImportDSLModal = useStore(s => s.showImportDSLModal)
   const setShowImportDSLModal = useStore(s => s.setShowImportDSLModal)
   const showOnboarding = useStore(s => s.showOnboarding)
+  const canImportExportDSL = useHooksStore(s => s.accessControl.canImportExportDSL)
+  const canEdit = useHooksStore(s => s.accessControl.canEdit)
   const setShowOnboarding = useStore(s => s.setShowOnboarding)
   const setHasSelectedStartNode = useStore(s => s.setHasSelectedStartNode)
   const setShouldAutoOpenStartNodeSelector = useStore(s => s.setShouldAutoOpenStartNodeSelector)
@@ -98,7 +101,10 @@ const WorkflowChildren = () => {
     handleOnboardingClose()
   }, [handleOnboardingClose])
 
-  const handleSelectStartNode = useCallback((nodeType: BlockEnum, toolConfig?: PluginDefaultValue) => {
+  const handleSelectStartNode = useCallback((nodeType: BlockEnum, toolConfig?: BlockDefaultValue) => {
+    if (!canEdit)
+      return
+
     const nodeDefault = availableNodesMetaData.nodesMap?.[nodeType]
     if (!nodeDefault?.defaultValue)
       return
@@ -152,7 +158,7 @@ const WorkflowChildren = () => {
         console.error('Failed to save node to draft')
       },
     })
-  }, [availableNodesMetaData, setShowOnboarding, setHasSelectedStartNode, reactFlowStore, handleSyncWorkflowDraft])
+  }, [availableNodesMetaData, autoGenerateWebhookUrl, canEdit, handleSyncWorkflowDraft, reactFlowStore, setHasSelectedStartNode, setShouldAutoOpenStartNodeSelector, setShowOnboarding])
 
   return (
     <>
@@ -161,7 +167,7 @@ const WorkflowChildren = () => {
         showFeaturesPanel && <Features />
       }
       {
-        showOnboarding && (
+        canEdit && showOnboarding && (
           <WorkflowOnboardingModal
             isShow={showOnboarding}
             onClose={handleCloseOnboarding}
@@ -170,7 +176,7 @@ const WorkflowChildren = () => {
         )
       }
       {
-        showImportDSLModal && (
+        canImportExportDSL && showImportDSLModal && (
           <UpdateDSLModal
             onCancel={() => setShowImportDSLModal(false)}
             onBackup={exportCheck!}
@@ -179,7 +185,7 @@ const WorkflowChildren = () => {
         )
       }
       {
-        secretEnvList.length > 0 && (
+        canImportExportDSL && secretEnvList.length > 0 && (
           <DSLExportConfirmModal
             envList={secretEnvList}
             onConfirm={handleExportDSL!}
diff --git a/web/app/components/workflow-app/components/workflow-header/__tests__/features-trigger.spec.tsx b/web/app/components/workflow-app/components/workflow-header/__tests__/features-trigger.spec.tsx
index d1e471cc514..a2d3ba5c750 100644
--- a/web/app/components/workflow-app/components/workflow-header/__tests__/features-trigger.spec.tsx
+++ b/web/app/components/workflow-app/components/workflow-header/__tests__/features-trigger.spec.tsx
@@ -1,11 +1,13 @@
 import type { ReactElement } from 'react'
 import type { AppPublisherProps } from '@/app/components/app/app-publisher'
 import type { App } from '@/types/app'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { Plan } from '@/app/components/billing/type'
 import { BlockEnum, InputVarType } from '@/app/components/workflow/types'
+import { consoleQuery } from '@/service/client'
 import FeaturesTrigger from '../features-trigger'
 
 const mockUseIsChatMode = vi.fn()
@@ -44,6 +46,7 @@ const mockUpdatePublishedWorkflow = vi.fn()
 const mockResetWorkflowVersionHistory = vi.fn()
 const mockInvalidateAppTriggers = vi.fn()
 const mockFetchAppDetail = vi.fn()
+const mockInvalidateQueries = vi.fn()
 const mockSetPublishedAt = vi.fn()
 const mockSetLastPublishedHasUserInput = vi.fn()
 
@@ -84,6 +87,25 @@ vi.mock('@/app/components/workflow/store', () => ({
   useWorkflowStore: () => mockWorkflowStore,
 }))
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canReleaseAndVersion: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canReleaseAndVersion: true,
+      },
+    }),
+}))
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useQueryClient: () => ({
+      invalidateQueries: mockInvalidateQueries,
+    }),
+  }
+})
+
 vi.mock('@/app/components/base/features/hooks', () => ({
   useFeatures: (selector: (state: Record<string, unknown>) => unknown) => mockUseFeatures(selector),
 }))
@@ -101,7 +123,7 @@ vi.mock('reactflow', () => ({
 }))
 
 vi.mock('@/app/components/app/app-publisher', () => ({
-  default: (props: AppPublisherProps) => {
+  AppPublisher: (props: AppPublisherProps) => {
     const inputs = props.inputs ?? []
     return (
       <div
@@ -167,7 +189,15 @@ const createProviderContext = ({
 })
 
 const renderWithToast = (ui: ReactElement) => {
-  return render(ui)
+  const queryClient = new QueryClient()
+  return {
+    queryClient,
+    ...render(
+      <QueryClientProvider client={queryClient}>
+        {ui}
+      </QueryClientProvider>,
+    ),
+  }
 }
 
 describe('FeaturesTrigger', () => {
@@ -194,6 +224,7 @@ describe('FeaturesTrigger', () => {
     // Set up app store state
     useAppStore.setState({ appDetail: { id: 'app-id' } as unknown as App })
     mockFetchAppDetail.mockResolvedValue({ id: 'app-id' })
+    mockInvalidateQueries.mockResolvedValue(undefined)
     mockPublishWorkflow.mockResolvedValue({ created_at: '2024-01-01T00:00:00Z' })
   })
 
@@ -437,11 +468,75 @@ describe('FeaturesTrigger', () => {
         expect(mockSetLastPublishedHasUserInput).toHaveBeenCalledWith(true)
         expect(mockResetWorkflowVersionHistory).toHaveBeenCalled()
         expect(toastMocks.call).toHaveBeenCalledWith({ type: 'success', message: 'common.api.actionSuccess' })
-        expect(mockFetchAppDetail).toHaveBeenCalledWith({ url: '/apps', id: 'app-id' })
+        expect(mockInvalidateQueries).toHaveBeenCalledWith({ queryKey: ['apps', 'detail', 'app-id'] })
         expect(useAppStore.getState().appDetail).toBeDefined()
       })
     })
 
+    it('should invalidate roster list after publishing a workflow with a roster Agent v2 node', async () => {
+      // Arrange
+      const user = userEvent.setup()
+      mockUseNodes.mockReturnValue([
+        { id: 'start', data: { type: BlockEnum.Start } },
+        {
+          id: 'agent-v2',
+          data: {
+            type: BlockEnum.AgentV2,
+            version: '2',
+            agent_node_kind: 'dify_agent',
+            agent_binding: {
+              binding_type: 'roster_agent',
+              agent_id: 'agent-1',
+            },
+          },
+        },
+      ])
+      renderWithToast(<FeaturesTrigger />)
+
+      // Act
+      await user.click(screen.getByRole('button', { name: 'publisher-publish' }))
+
+      // Assert
+      await waitFor(() => {
+        expect(mockInvalidateQueries).toHaveBeenCalledWith({
+          queryKey: consoleQuery.agent.get.key(),
+        })
+      })
+    })
+
+    it('should keep roster list cache stable after publishing a workflow without roster Agent v2 nodes', async () => {
+      // Arrange
+      const user = userEvent.setup()
+      mockUseNodes.mockReturnValue([
+        { id: 'start', data: { type: BlockEnum.Start } },
+        {
+          id: 'inline-agent-v2',
+          data: {
+            type: BlockEnum.AgentV2,
+            version: '2',
+            agent_node_kind: 'dify_agent',
+            agent_binding: {
+              binding_type: 'inline_agent',
+              agent_id: 'agent-1',
+              current_snapshot_id: 'snapshot-1',
+            },
+          },
+        },
+      ])
+      renderWithToast(<FeaturesTrigger />)
+
+      // Act
+      await user.click(screen.getByRole('button', { name: 'publisher-publish' }))
+
+      // Assert
+      await waitFor(() => {
+        expect(mockPublishWorkflow).toHaveBeenCalled()
+      })
+      expect(mockInvalidateQueries).not.toHaveBeenCalledWith({
+        queryKey: consoleQuery.agent.get.key(),
+      })
+    })
+
     it('should pass publish params to workflow publish mutation', async () => {
       // Arrange
       const user = userEvent.setup()
@@ -503,7 +598,7 @@ describe('FeaturesTrigger', () => {
       // Arrange
       const user = userEvent.setup()
       const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
-      mockFetchAppDetail.mockRejectedValue(new Error('fetch failed'))
+      mockInvalidateQueries.mockRejectedValue(new Error('fetch failed'))
 
       renderWithToast(<FeaturesTrigger />)
 
diff --git a/web/app/components/workflow-app/components/workflow-header/features-trigger.tsx b/web/app/components/workflow-app/components/workflow-header/features-trigger.tsx
index 1c4eeed4173..ab41536fd85 100644
--- a/web/app/components/workflow-app/components/workflow-header/features-trigger.tsx
+++ b/web/app/components/workflow-app/components/workflow-header/features-trigger.tsx
@@ -8,7 +8,7 @@ import type {
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { toast } from '@langgenius/dify-ui/toast'
-import { RiApps2AddLine } from '@remixicon/react'
+import { useQueryClient } from '@tanstack/react-query'
 import {
   memo,
   useCallback,
@@ -16,7 +16,7 @@ import {
 } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useEdges } from 'reactflow'
-import AppPublisher from '@/app/components/app/app-publisher'
+import { AppPublisher } from '@/app/components/app/app-publisher'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { useFeatures } from '@/app/components/base/features/hooks'
 import { Plan } from '@/app/components/billing/type'
@@ -28,6 +28,8 @@ import {
   useNodesSyncDraft,
   // useWorkflowRunValidation,
 } from '@/app/components/workflow/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
+import { hasValidRosterAgentBinding, isAgentV2NodeData } from '@/app/components/workflow/nodes/agent-v2/types'
 import {
   useStore,
   useWorkflowStore,
@@ -40,7 +42,8 @@ import {
 } from '@/app/components/workflow/types'
 import { useProviderContext } from '@/context/provider-context'
 import useTheme from '@/hooks/use-theme'
-import { fetchAppDetail } from '@/service/apps'
+import { consoleQuery } from '@/service/client'
+import { appDetailQueryKeyPrefix } from '@/service/use-apps'
 import { useInvalidateAppTriggers } from '@/service/use-tools'
 import { useInvalidateAppWorkflow, usePublishWorkflow, useResetWorkflowVersionHistory } from '@/service/use-workflow'
 
@@ -49,10 +52,11 @@ const FeaturesTrigger = () => {
   const { theme } = useTheme()
   const isChatMode = useIsChatMode()
   const workflowStore = useWorkflowStore()
+  const queryClient = useQueryClient()
   const appDetail = useAppStore(s => s.appDetail)
   const appID = appDetail?.id
-  const setAppDetail = useAppStore(s => s.setAppDetail)
   const { nodesReadOnly, getNodesReadOnly } = useNodesReadOnly()
+  const canReleaseAndVersion = useHooksStore(s => s.accessControl.canReleaseAndVersion)
   const { plan, isFetchedPlan } = useProviderContext()
   const publishedAt = useStore(s => s.publishedAt)
   const draftUpdatedAt = useStore(s => s.draftUpdatedAt)
@@ -130,13 +134,12 @@ const FeaturesTrigger = () => {
 
   const updateAppDetail = useCallback(async () => {
     try {
-      const res = await fetchAppDetail({ url: '/apps', id: appID! })
-      setAppDetail({ ...res })
+      await queryClient.invalidateQueries({ queryKey: [...appDetailQueryKeyPrefix, appID!] })
     }
     catch (error) {
       console.error(error)
     }
-  }, [appID, setAppDetail])
+  }, [appID, queryClient])
 
   const { mutateAsync: publishWorkflow } = usePublishWorkflow()
   // const { validateBeforeRun } = useWorkflowRunValidation()
@@ -166,6 +169,11 @@ const FeaturesTrigger = () => {
         updatePublishedWorkflow(appID!)
         updateAppDetail()
         invalidateAppTriggers(appID!)
+        if (nodes.some(node => isAgentV2NodeData(node.data) && hasValidRosterAgentBinding(node.data))) {
+          void queryClient.invalidateQueries({
+            queryKey: consoleQuery.agent.get.key(),
+          })
+        }
         workflowStore.getState().setPublishedAt(res.created_at)
         workflowStore.getState().setLastPublishedHasUserInput(hasUserInputNode)
         resetWorkflowVersionHistory()
@@ -174,7 +182,7 @@ const FeaturesTrigger = () => {
     else {
       throw new Error('Checklist failed')
     }
-  }, [needWarningNodes, handleCheckBeforePublish, publishWorkflow, appID, t, updatePublishedWorkflow, updateAppDetail, workflowStore, resetWorkflowVersionHistory, invalidateAppTriggers, hasUserInputNode])
+  }, [needWarningNodes, handleCheckBeforePublish, publishWorkflow, appID, t, updatePublishedWorkflow, updateAppDetail, invalidateAppTriggers, nodes, queryClient, workflowStore, hasUserInputNode, resetWorkflowVersionHistory])
 
   const onPublisherToggle = useCallback((state: boolean) => {
     if (state)
@@ -196,7 +204,7 @@ const FeaturesTrigger = () => {
           )}
           onClick={handleShowFeatures}
         >
-          <RiApps2AddLine className="mr-1 size-4 text-components-button-secondary-text" />
+          <span className="mr-1 i-ri-apps-2-add-line size-4 text-components-button-secondary-text" />
           {t('common.features', { ns: 'workflow' })}
         </Button>
       )}
@@ -204,7 +212,7 @@ const FeaturesTrigger = () => {
         {...{
           publishedAt,
           draftUpdatedAt,
-          disabled: nodesReadOnly || !hasWorkflowNodes,
+          disabled: nodesReadOnly || !hasWorkflowNodes || !canReleaseAndVersion,
           toolPublished,
           inputs: variables,
           outputs: endVariables,
@@ -216,7 +224,7 @@ const FeaturesTrigger = () => {
           missingStartNode: !startNode,
           hasTriggerNode,
           startNodeLimitExceeded,
-          publishDisabled: !hasWorkflowNodes || startNodeLimitExceeded,
+          publishDisabled: !hasWorkflowNodes || startNodeLimitExceeded || !canReleaseAndVersion,
           hasHumanInputNode,
         }}
       />
diff --git a/web/app/components/workflow-app/components/workflow-main.tsx b/web/app/components/workflow-app/components/workflow-main.tsx
index 08fc2e8daf6..bfd0c3aa3d4 100644
--- a/web/app/components/workflow-app/components/workflow-main.tsx
+++ b/web/app/components/workflow-app/components/workflow-main.tsx
@@ -21,18 +21,20 @@ import { useCollaboration } from '@/app/components/workflow/collaboration/hooks/
 import { useWorkflowUpdate } from '@/app/components/workflow/hooks/use-workflow-interactions'
 import { useStore, useWorkflowStore } from '@/app/components/workflow/store'
 import { SupportUploadFileTypes } from '@/app/components/workflow/types'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { fetchWorkflowDraft } from '@/service/workflow'
+import { getAppACLCapabilities } from '@/utils/permission'
 import {
   useAvailableNodesMetaData,
   useConfigsMap,
-  useDSL,
+  useDSLByCanEdit,
   useGetRunAndTraceUrl,
   useInspectVarsCrud,
-  useNodesSyncDraft,
+  useNodesSyncDraftByCanEdit,
   useSetWorkflowVarsWithValue,
   useWorkflowRefreshDraft,
-  useWorkflowRun,
-  useWorkflowStartRun,
+  useWorkflowRunByCanEdit,
+  useWorkflowStartRunByCanEdit,
 } from '../hooks'
 import WorkflowChildren from './workflow-children'
 
@@ -75,6 +77,16 @@ const WorkflowMain = ({
   const filteredCursors = Object.fromEntries(
     Object.entries(cursors).filter(([userId]) => userId !== myUserId),
   )
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const appACLCapabilities = useMemo(
+    () => getAppACLCapabilities(appDetail?.permission_keys, {
+      currentUserId,
+      resourceMaintainer: appDetail?.maintainer,
+      workspacePermissionKeys,
+    }),
+    [appDetail?.maintainer, appDetail?.permission_keys, currentUserId, workspacePermissionKeys],
+  )
 
   useEffect(() => {
     if (!isCollaborationEnabled)
@@ -138,7 +150,7 @@ const WorkflowMain = ({
   const {
     doSyncWorkflowDraft,
     syncWorkflowDraftWhenPageClose,
-  } = useNodesSyncDraft()
+  } = useNodesSyncDraftByCanEdit(appACLCapabilities.canEdit)
   const { handleRefreshWorkflowDraft } = useWorkflowRefreshDraft()
   const { handleUpdateWorkflowCanvas } = useWorkflowUpdate()
   const {
@@ -147,7 +159,7 @@ const WorkflowMain = ({
     handleRestoreFromPublishedWorkflow,
     handleRun,
     handleStopRun,
-  } = useWorkflowRun()
+  } = useWorkflowRunByCanEdit(appACLCapabilities.canEdit)
 
   useEffect(() => {
     if (!appId || !isCollaborationEnabled)
@@ -209,13 +221,13 @@ const WorkflowMain = ({
     handleWorkflowTriggerWebhookRunInWorkflow,
     handleWorkflowTriggerPluginRunInWorkflow,
     handleWorkflowRunAllTriggersInWorkflow,
-  } = useWorkflowStartRun()
+  } = useWorkflowStartRunByCanEdit(appACLCapabilities.canEdit)
   const availableNodesMetaData = useAvailableNodesMetaData()
   const { getWorkflowRunAndTraceUrl } = useGetRunAndTraceUrl()
   const {
     exportCheck,
     handleExportDSL,
-  } = useDSL()
+  } = useDSLByCanEdit(appACLCapabilities.canEdit)
 
   const configsMap = useConfigsMap()
 
@@ -275,6 +287,13 @@ const WorkflowMain = ({
       invalidateSysVarValues,
       resetConversationVar,
       invalidateConversationVarValues,
+      accessControl: {
+        canEdit: appACLCapabilities.canEdit,
+        canComment: appACLCapabilities.canComment,
+        canRun: appACLCapabilities.canTestAndRun,
+        canImportExportDSL: appACLCapabilities.canImportExportDSL,
+        canReleaseAndVersion: appACLCapabilities.canReleaseAndVersion,
+      },
       configsMap,
     }
   }, [
@@ -312,6 +331,7 @@ const WorkflowMain = ({
     invalidateSysVarValues,
     resetConversationVar,
     invalidateConversationVarValues,
+    appACLCapabilities,
     configsMap,
   ])
 
diff --git a/web/app/components/workflow-app/components/workflow-onboarding-modal/index.tsx b/web/app/components/workflow-app/components/workflow-onboarding-modal/index.tsx
index 8f25cd00d03..770295526e7 100644
--- a/web/app/components/workflow-app/components/workflow-onboarding-modal/index.tsx
+++ b/web/app/components/workflow-app/components/workflow-onboarding-modal/index.tsx
@@ -1,6 +1,6 @@
 'use client'
 import type { FC } from 'react'
-import type { PluginDefaultValue } from '@/app/components/workflow/block-selector/types'
+import type { BlockDefaultValue } from '@/app/components/workflow/block-selector/types'
 import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
 import { useTranslation } from 'react-i18next'
 import { BlockEnum } from '@/app/components/workflow/types'
@@ -9,7 +9,7 @@ import StartNodeSelectionPanel from './start-node-selection-panel'
 type WorkflowOnboardingModalProps = {
   isShow: boolean
   onClose: () => void
-  onSelectStartNode: (nodeType: BlockEnum, toolConfig?: PluginDefaultValue) => void
+  onSelectStartNode: (nodeType: BlockEnum, toolConfig?: BlockDefaultValue) => void
 }
 
 const WorkflowOnboardingModal: FC<WorkflowOnboardingModalProps> = ({
diff --git a/web/app/components/workflow-app/components/workflow-onboarding-modal/start-node-selection-panel.tsx b/web/app/components/workflow-app/components/workflow-onboarding-modal/start-node-selection-panel.tsx
index 61e53b301e3..3e44d5d7a4c 100644
--- a/web/app/components/workflow-app/components/workflow-onboarding-modal/start-node-selection-panel.tsx
+++ b/web/app/components/workflow-app/components/workflow-onboarding-modal/start-node-selection-panel.tsx
@@ -1,6 +1,6 @@
 'use client'
 import type { FC } from 'react'
-import type { PluginDefaultValue } from '@/app/components/workflow/block-selector/types'
+import type { BlockDefaultValue } from '@/app/components/workflow/block-selector/types'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import NodeSelector from '@/app/components/workflow/block-selector'
@@ -10,7 +10,7 @@ import StartNodeOption from './start-node-option'
 
 type StartNodeSelectionPanelProps = {
   onSelectUserInput: () => void
-  onSelectTrigger: (nodeType: BlockEnum, toolConfig?: PluginDefaultValue) => void
+  onSelectTrigger: (nodeType: BlockEnum, toolConfig?: BlockDefaultValue) => void
 }
 
 const StartNodeSelectionPanel: FC<StartNodeSelectionPanelProps> = ({
@@ -20,7 +20,7 @@ const StartNodeSelectionPanel: FC<StartNodeSelectionPanelProps> = ({
   const { t } = useTranslation()
   const [showTriggerSelector, setShowTriggerSelector] = useState(false)
 
-  const handleTriggerSelect = useCallback((nodeType: BlockEnum, toolConfig?: PluginDefaultValue) => {
+  const handleTriggerSelect = useCallback((nodeType: BlockEnum, toolConfig?: BlockDefaultValue) => {
     setShowTriggerSelector(false)
     onSelectTrigger(nodeType, toolConfig)
   }, [onSelectTrigger])
diff --git a/web/app/components/workflow-app/hooks/__tests__/use-available-nodes-meta-data.spec.ts b/web/app/components/workflow-app/hooks/__tests__/use-available-nodes-meta-data.spec.ts
index a53f0cac380..17083cc87b9 100644
--- a/web/app/components/workflow-app/hooks/__tests__/use-available-nodes-meta-data.spec.ts
+++ b/web/app/components/workflow-app/hooks/__tests__/use-available-nodes-meta-data.spec.ts
@@ -3,11 +3,16 @@ import { BlockEnum } from '@/app/components/workflow/types'
 import { useAvailableNodesMetaData } from '../use-available-nodes-meta-data'
 
 const mockUseIsChatMode = vi.fn()
+const mockIsAgentV2Enabled = vi.hoisted(() => vi.fn(() => true))
 
 vi.mock('@/app/components/workflow-app/hooks/use-is-chat-mode', () => ({
   useIsChatMode: () => mockUseIsChatMode(),
 }))
 
+vi.mock('@/features/agent-v2/feature-flag', () => ({
+  isAgentV2Enabled: () => mockIsAgentV2Enabled(),
+}))
+
 vi.mock('@/context/i18n', () => ({
   useDocLink: () => (path: string) => `/docs${path}`,
 }))
@@ -15,6 +20,7 @@ vi.mock('@/context/i18n', () => ({
 describe('useAvailableNodesMetaData', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockIsAgentV2Enabled.mockReturnValue(true)
   })
 
   it('should include chat-specific nodes and make the start node undeletable in chat mode', () => {
@@ -47,4 +53,29 @@ describe('useAvailableNodesMetaData', () => {
       title: 'workflow.blocks.start',
     })
   })
+
+  it('should expose Agent v2 instead of legacy Agent when Agent v2 is enabled', () => {
+    mockUseIsChatMode.mockReturnValue(false)
+
+    const { result } = renderHook(() => useAvailableNodesMetaData())
+    const nodeTypes = result.current.nodes.map(node => node.metaData.type)
+
+    expect(nodeTypes).toContain(BlockEnum.AgentV2)
+    expect(nodeTypes).not.toContain(BlockEnum.Agent)
+    expect(result.current.nodesMap?.[BlockEnum.AgentV2]).toBeDefined()
+    expect(result.current.nodesMap?.[BlockEnum.Agent]).toBeUndefined()
+  })
+
+  it('should expose legacy Agent instead of Agent v2 when Agent v2 is disabled', () => {
+    mockUseIsChatMode.mockReturnValue(false)
+    mockIsAgentV2Enabled.mockReturnValue(false)
+
+    const { result } = renderHook(() => useAvailableNodesMetaData())
+    const nodeTypes = result.current.nodes.map(node => node.metaData.type)
+
+    expect(nodeTypes).toContain(BlockEnum.Agent)
+    expect(nodeTypes).not.toContain(BlockEnum.AgentV2)
+    expect(result.current.nodesMap?.[BlockEnum.Agent]).toBeDefined()
+    expect(result.current.nodesMap?.[BlockEnum.AgentV2]).toBeUndefined()
+  })
 })
diff --git a/web/app/components/workflow-app/hooks/__tests__/use-workflow-init.spec.ts b/web/app/components/workflow-app/hooks/__tests__/use-workflow-init.spec.ts
index 47ac39c60e2..4bc3c1a8fcb 100644
--- a/web/app/components/workflow-app/hooks/__tests__/use-workflow-init.spec.ts
+++ b/web/app/components/workflow-app/hooks/__tests__/use-workflow-init.spec.ts
@@ -1,6 +1,7 @@
 import { renderHook, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { BlockEnum } from '@/app/components/workflow/types'
+import { AppACLPermission } from '@/utils/permission'
 
 import { useWorkflowInit } from '../use-workflow-init'
 
@@ -21,6 +22,8 @@ let appStoreState: {
     id: string
     name: string
     mode: string
+    permission_keys?: string[]
+    maintainer?: string
   }
 }
 
@@ -43,6 +46,14 @@ vi.mock('@/app/components/app/store', () => ({
     selector(appStoreState),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T>(selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => T): T =>
+    selector({
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: ['app.create_and_management'],
+    }),
+}))
+
 vi.mock('../use-workflow-template', () => ({
   useWorkflowTemplate: () => ({
     nodes: appStoreState.appDetail.mode === 'workflow'
@@ -98,7 +109,7 @@ describe('useWorkflowInit', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     appStoreState = {
-      appDetail: { id: 'app-1', name: 'Test', mode: 'workflow' },
+      appDetail: { id: 'app-1', name: 'Test', mode: 'workflow', permission_keys: [AppACLPermission.Edit] },
     }
     workflowConfigState = { data: null, isLoading: false }
     mockWorkflowStoreGetState.mockReturnValue({
@@ -154,7 +165,7 @@ describe('useWorkflowInit', () => {
 
   it('should keep creating the first backend draft for advanced chat apps', async () => {
     appStoreState = {
-      appDetail: { id: 'app-1', name: 'Test', mode: 'advanced-chat' },
+      appDetail: { id: 'app-1', name: 'Test', mode: 'advanced-chat', permission_keys: [AppACLPermission.Edit] },
     }
     mockFetchWorkflowDraft
       .mockReset()
@@ -180,6 +191,33 @@ describe('useWorkflowInit', () => {
     expect(mockSetSyncWorkflowDraftHash).toHaveBeenCalledWith('new-hash')
   })
 
+  it('should keep readonly users local when the first workflow draft does not exist', async () => {
+    appStoreState = {
+      appDetail: { id: 'app-1', name: 'Test', mode: 'workflow', permission_keys: [AppACLPermission.ViewLayout] },
+    }
+    mockFetchWorkflowDraft
+      .mockReset()
+      .mockRejectedValueOnce(notExistError())
+
+    const { result } = renderHook(() => useWorkflowInit())
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false)
+    })
+
+    expect(result.current.data?.graph.nodes).toEqual([
+      { id: 'start-placeholder', data: { type: BlockEnum.StartPlaceholder } },
+    ])
+    expect(mockSyncWorkflowDraft).not.toHaveBeenCalled()
+    expect(mockWorkflowStoreSetState).toHaveBeenCalledWith(expect.objectContaining({
+      envSecrets: {},
+      environmentVariables: [],
+      conversationVariables: [],
+      isWorkflowDataLoaded: true,
+    }))
+    expect(mockSetSyncWorkflowDraftHash).toHaveBeenCalledWith('')
+  })
+
   it('should restore a local start placeholder when an existing workflow draft has an empty graph', async () => {
     mockFetchWorkflowDraft.mockReset().mockResolvedValue({
       ...draftResponse,
diff --git a/web/app/components/workflow-app/hooks/use-DSL.ts b/web/app/components/workflow-app/hooks/use-DSL.ts
index 2fb2df8a3b0..9110e53c506 100644
--- a/web/app/components/workflow-app/hooks/use-DSL.ts
+++ b/web/app/components/workflow-app/hooks/use-DSL.ts
@@ -12,13 +12,17 @@ import { useEventEmitterContextContext } from '@/context/event-emitter'
 import { exportAppConfig } from '@/service/apps'
 import { fetchWorkflowDraft } from '@/service/workflow'
 import { downloadBlob } from '@/utils/download'
-import { useNodesSyncDraft } from './use-nodes-sync-draft'
+import {
+  useNodesSyncDraft,
+  useNodesSyncDraftByCanEdit,
+} from './use-nodes-sync-draft'
 
-export const useDSL = () => {
+type DoSyncWorkflowDraft = ReturnType<typeof useNodesSyncDraft>['doSyncWorkflowDraft']
+
+const useDSLBase = (doSyncWorkflowDraft: DoSyncWorkflowDraft) => {
   const { t } = useTranslation()
   const { eventEmitter } = useEventEmitterContextContext()
   const [exporting, setExporting] = useState(false)
-  const { doSyncWorkflowDraft } = useNodesSyncDraft()
 
   const appDetail = useAppStore(s => s.appDetail)
 
@@ -75,3 +79,15 @@ export const useDSL = () => {
     handleExportDSL,
   }
 }
+
+export const useDSLByCanEdit = (canEdit: boolean) => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraftByCanEdit(canEdit)
+
+  return useDSLBase(doSyncWorkflowDraft)
+}
+
+export const useDSL = () => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraft()
+
+  return useDSLBase(doSyncWorkflowDraft)
+}
diff --git a/web/app/components/workflow-app/hooks/use-available-nodes-meta-data.ts b/web/app/components/workflow-app/hooks/use-available-nodes-meta-data.ts
index bc468e73e35..b001c381898 100644
--- a/web/app/components/workflow-app/hooks/use-available-nodes-meta-data.ts
+++ b/web/app/components/workflow-app/hooks/use-available-nodes-meta-data.ts
@@ -1,5 +1,6 @@
 import type { AvailableNodesMetaData } from '@/app/components/workflow/hooks-store/store'
 import type { DocPathWithoutLang } from '@/types/doc-paths'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { WORKFLOW_COMMON_NODES } from '@/app/components/workflow/constants/node'
@@ -12,12 +13,14 @@ import TriggerScheduleDefault from '@/app/components/workflow/nodes/trigger-sche
 import TriggerWebhookDefault from '@/app/components/workflow/nodes/trigger-webhook/default'
 import { BlockEnum } from '@/app/components/workflow/types'
 import { useDocLink } from '@/context/i18n'
+import { isAgentV2Enabled } from '@/features/agent-v2/feature-flag'
 import { useIsChatMode } from './use-is-chat-mode'
 
 export const useAvailableNodesMetaData = () => {
   const { t } = useTranslation()
   const isChatMode = useIsChatMode()
   const docLink = useDocLink()
+  const agentV2Enabled = isAgentV2Enabled()
 
   const startNodeMetaData = useMemo(() => ({
     ...StartDefault,
@@ -28,8 +31,13 @@ export const useAvailableNodesMetaData = () => {
   }), [isChatMode])
 
   const mergedNodesMetaData = useMemo(() => {
+    const commonNodes = WORKFLOW_COMMON_NODES.filter(node =>
+      agentV2Enabled
+        ? node.metaData.type !== BlockEnum.Agent
+        : node.metaData.type !== BlockEnum.AgentV2)
+
     return [
-      ...WORKFLOW_COMMON_NODES,
+      ...commonNodes,
       startNodeMetaData,
       ...(
         isChatMode
@@ -43,12 +51,12 @@ export const useAvailableNodesMetaData = () => {
             ]
       ),
     ]
-  }, [isChatMode, startNodeMetaData])
+  }, [agentV2Enabled, isChatMode, startNodeMetaData])
 
   const availableNodesMetaData = useMemo(() => mergedNodesMetaData.map((node) => {
     const { metaData } = node
     const title = t(`blocks.${metaData.type}`, { ns: 'workflow' })
-    const description = t(`blocksAbout.${metaData.type}`, { ns: 'workflow' })
+    const description = t(`blocksAbout.${metaData.type}` as I18nKeysWithPrefix<'workflow', 'blocksAbout.'>, { ns: 'workflow' })
     const helpLinkPath = `/use-dify/nodes/${metaData.helpLinkUri}` as DocPathWithoutLang
     return {
       ...node,
@@ -60,7 +68,7 @@ export const useAvailableNodesMetaData = () => {
       },
       defaultValue: {
         ...node.defaultValue,
-        type: metaData.type,
+        type: metaData.type === BlockEnum.AgentV2 ? BlockEnum.Agent : metaData.type,
         title,
       },
     }
diff --git a/web/app/components/workflow-app/hooks/use-nodes-sync-draft.ts b/web/app/components/workflow-app/hooks/use-nodes-sync-draft.ts
index f7bd2f4c2fb..980b2536546 100644
--- a/web/app/components/workflow-app/hooks/use-nodes-sync-draft.ts
+++ b/web/app/components/workflow-app/hooks/use-nodes-sync-draft.ts
@@ -7,7 +7,7 @@ import { useStoreApi } from 'reactflow'
 import { useFeaturesStore } from '@/app/components/base/features/hooks'
 import { collaborationManager } from '@/app/components/workflow/collaboration/core/collaboration-manager'
 import { useSerialAsyncCallback } from '@/app/components/workflow/hooks/use-serial-async-callback'
-import { useNodesReadOnly } from '@/app/components/workflow/hooks/use-workflow'
+import { useNodesReadOnly, useNodesReadOnlyByCanEdit } from '@/app/components/workflow/hooks/use-workflow'
 import { useWorkflowStore } from '@/app/components/workflow/store'
 import { BlockEnum } from '@/app/components/workflow/types'
 import { API_PREFIX } from '@/config'
@@ -16,11 +16,10 @@ import { postWithKeepalive } from '@/service/fetch'
 import { syncWorkflowDraft } from '@/service/workflow'
 import { useWorkflowRefreshDraft } from '.'
 
-export const useNodesSyncDraft = () => {
+const useNodesSyncDraftBase = (getNodesReadOnly: () => boolean) => {
   const store = useStoreApi()
   const workflowStore = useWorkflowStore()
   const featuresStore = useFeaturesStore()
-  const { getNodesReadOnly } = useNodesReadOnly()
   const { handleRefreshWorkflowDraft } = useWorkflowRefreshDraft()
   const { data: isCollaborationEnabled } = useSuspenseQuery({
     ...systemFeaturesQueryOptions(),
@@ -181,3 +180,15 @@ export const useNodesSyncDraft = () => {
     syncWorkflowDraftWhenPageClose,
   }
 }
+
+export const useNodesSyncDraftByCanEdit = (canEdit: boolean) => {
+  const { getNodesReadOnly } = useNodesReadOnlyByCanEdit(canEdit)
+
+  return useNodesSyncDraftBase(getNodesReadOnly)
+}
+
+export const useNodesSyncDraft = () => {
+  const { getNodesReadOnly } = useNodesReadOnly()
+
+  return useNodesSyncDraftBase(getNodesReadOnly)
+}
diff --git a/web/app/components/workflow-app/hooks/use-workflow-init.ts b/web/app/components/workflow-app/hooks/use-workflow-init.ts
index 7a4ccd63101..2845b97f46d 100644
--- a/web/app/components/workflow-app/hooks/use-workflow-init.ts
+++ b/web/app/components/workflow-app/hooks/use-workflow-init.ts
@@ -4,6 +4,7 @@ import type { FetchWorkflowDraftResponse } from '@/types/workflow'
 import {
   useCallback,
   useEffect,
+  useMemo,
   useState,
 } from 'react'
 import { useStore as useAppStore } from '@/app/components/app/store'
@@ -12,6 +13,7 @@ import {
   useWorkflowStore,
 } from '@/app/components/workflow/store'
 import { BlockEnum } from '@/app/components/workflow/types'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useWorkflowConfig } from '@/service/use-workflow'
 import {
   fetchNodesDefaultConfigs,
@@ -20,9 +22,37 @@ import {
   syncWorkflowDraft,
 } from '@/service/workflow'
 import { AppModeEnum } from '@/types/app'
+import { getAppACLCapabilities } from '@/utils/permission'
 import { useWorkflowDraftGraphForCanvas } from './use-workflow-draft-graph-for-canvas'
 import { useWorkflowTemplate } from './use-workflow-template'
 
+const emptyAccount = {
+  id: '',
+  name: '',
+  email: '',
+}
+
+const createLocalWorkflowDraft = (
+  graph: FetchWorkflowDraftResponse['graph'],
+): FetchWorkflowDraftResponse => ({
+  id: '',
+  graph,
+  features: {
+    retriever_resource: { enabled: true },
+  },
+  created_at: 0,
+  created_by: emptyAccount,
+  hash: '',
+  updated_at: 0,
+  updated_by: emptyAccount,
+  tool_published: false,
+  environment_variables: [],
+  conversation_variables: [],
+  version: '',
+  marked_name: '',
+  marked_comment: '',
+})
+
 const hasConnectedUserInput = (nodes: Node[] = [], edges: Edge[] = []): boolean => {
   const startNodeIds = nodes
     .filter(node => node?.data?.type === BlockEnum.Start)
@@ -41,6 +71,13 @@ export const useWorkflowInit = () => {
     edges: edgesTemplate,
   } = useWorkflowTemplate()
   const appDetail = useAppStore(state => state.appDetail)!
+  const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const appACLCapabilities = useMemo(() => getAppACLCapabilities(appDetail.permission_keys, {
+    currentUserId,
+    resourceMaintainer: appDetail.maintainer,
+    workspacePermissionKeys,
+  }), [appDetail.maintainer, appDetail.permission_keys, currentUserId, workspacePermissionKeys])
   const { getWorkflowDraftGraphForCanvas } = useWorkflowDraftGraphForCanvas(appDetail.mode)
   const setSyncWorkflowDraftHash = useStore(s => s.setSyncWorkflowDraftHash)
   const [data, setData] = useState<FetchWorkflowDraftResponse>()
@@ -86,6 +123,10 @@ export const useWorkflowInit = () => {
         error.json().then((err: any) => {
           if (err.code === 'draft_workflow_not_exist') {
             const isAdvancedChat = appDetail.mode === AppModeEnum.ADVANCED_CHAT
+            const initialGraph = {
+              nodes: isAdvancedChat ? nodesTemplate : [],
+              edges: isAdvancedChat ? edgesTemplate : [],
+            }
             workflowStore.setState({
               notInitialWorkflow: true,
               showOnboarding: false,
@@ -94,13 +135,28 @@ export const useWorkflowInit = () => {
               hasShownOnboarding: !isAdvancedChat,
             })
 
+            if (!appACLCapabilities.canEdit) {
+              const initialData = createLocalWorkflowDraft({
+                ...getWorkflowDraftGraphForCanvas(initialGraph, {
+                  localStartPlaceholderNodes: nodesTemplate,
+                }),
+              })
+              setData(initialData)
+              workflowStore.setState({
+                envSecrets: {},
+                environmentVariables: [],
+                conversationVariables: [],
+                isWorkflowDataLoaded: true,
+              })
+              setSyncWorkflowDraftHash(initialData.hash)
+              setIsLoading(false)
+              return
+            }
+
             syncWorkflowDraft({
               url: `/apps/${appDetail.id}/workflows/draft`,
               params: {
-                graph: {
-                  nodes: isAdvancedChat ? nodesTemplate : [],
-                  edges: isAdvancedChat ? edgesTemplate : [],
-                },
+                graph: initialGraph,
                 features: {
                   retriever_resource: { enabled: true },
                 },
@@ -116,7 +172,7 @@ export const useWorkflowInit = () => {
         })
       }
     }
-  }, [appDetail, getWorkflowDraftGraphForCanvas, nodesTemplate, edgesTemplate, workflowStore, setSyncWorkflowDraftHash])
+  }, [appACLCapabilities.canEdit, appDetail, getWorkflowDraftGraphForCanvas, nodesTemplate, edgesTemplate, workflowStore, setSyncWorkflowDraftHash])
 
   useEffect(() => {
     handleGetInitialWorkflowData()
diff --git a/web/app/components/workflow-app/hooks/use-workflow-run.ts b/web/app/components/workflow-app/hooks/use-workflow-run.ts
index aa6b860acb7..d7a90e36605 100644
--- a/web/app/components/workflow-app/hooks/use-workflow-run.ts
+++ b/web/app/components/workflow-app/hooks/use-workflow-run.ts
@@ -26,7 +26,10 @@ import { stopWorkflowRun } from '@/service/workflow'
 import { AppModeEnum } from '@/types/app'
 import { useSetWorkflowVarsWithValue } from '../../workflow/hooks/use-fetch-workflow-inspect-vars'
 import { useConfigsMap } from './use-configs-map'
-import { useNodesSyncDraft } from './use-nodes-sync-draft'
+import {
+  useNodesSyncDraft,
+  useNodesSyncDraftByCanEdit,
+} from './use-nodes-sync-draft'
 import {
   createBaseWorkflowRunCallbacks,
   createFinalWorkflowRunCallbacks,
@@ -96,12 +99,13 @@ const getWorkflowTracingCount = (workflowData: unknown) => {
   return Array.isArray(tracing) ? tracing.length : undefined
 }
 
-export const useWorkflowRun = () => {
+type DoSyncWorkflowDraft = ReturnType<typeof useNodesSyncDraft>['doSyncWorkflowDraft']
+
+const useWorkflowRunBase = (doSyncWorkflowDraft: DoSyncWorkflowDraft) => {
   const store = useStoreApi()
   const workflowStore = useWorkflowStore()
   const reactflow = useReactFlow()
   const featuresStore = useFeaturesStore()
-  const { doSyncWorkflowDraft } = useNodesSyncDraft()
   const { handleUpdateWorkflowCanvas } = useWorkflowUpdate()
   const pathname = usePathname()
   const configsMap = useConfigsMap()
@@ -515,3 +519,15 @@ export const useWorkflowRun = () => {
     handleRestoreFromPublishedWorkflow,
   }
 }
+
+export const useWorkflowRunByCanEdit = (canEdit: boolean) => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraftByCanEdit(canEdit)
+
+  return useWorkflowRunBase(doSyncWorkflowDraft)
+}
+
+export const useWorkflowRun = () => {
+  const { doSyncWorkflowDraft } = useNodesSyncDraft()
+
+  return useWorkflowRunBase(doSyncWorkflowDraft)
+}
diff --git a/web/app/components/workflow-app/hooks/use-workflow-start-run.tsx b/web/app/components/workflow-app/hooks/use-workflow-start-run.tsx
index 516a653cd18..f5c58e2cd3a 100644
--- a/web/app/components/workflow-app/hooks/use-workflow-start-run.tsx
+++ b/web/app/components/workflow-app/hooks/use-workflow-start-run.tsx
@@ -11,17 +11,23 @@ import {
 import {
   useIsChatMode,
   useNodesSyncDraft,
+  useNodesSyncDraftByCanEdit,
   useWorkflowRun,
+  useWorkflowRunByCanEdit,
 } from '.'
 
-export const useWorkflowStartRun = () => {
+type HandleRun = ReturnType<typeof useWorkflowRun>['handleRun']
+type DoSyncWorkflowDraft = ReturnType<typeof useNodesSyncDraft>['doSyncWorkflowDraft']
+
+const useWorkflowStartRunBase = (
+  handleRun: HandleRun,
+  doSyncWorkflowDraft: DoSyncWorkflowDraft,
+) => {
   const store = useStoreApi()
   const workflowStore = useWorkflowStore()
   const featuresStore = useFeaturesStore()
   const isChatMode = useIsChatMode()
   const { handleCancelDebugAndPreviewPanel } = useWorkflowInteractions()
-  const { handleRun } = useWorkflowRun()
-  const { doSyncWorkflowDraft } = useNodesSyncDraft()
 
   const handleWorkflowStartRunInWorkflow = useCallback(async () => {
     const {
@@ -303,3 +309,17 @@ export const useWorkflowStartRun = () => {
     handleWorkflowRunAllTriggersInWorkflow,
   }
 }
+
+export const useWorkflowStartRunByCanEdit = (canEdit: boolean) => {
+  const { handleRun } = useWorkflowRunByCanEdit(canEdit)
+  const { doSyncWorkflowDraft } = useNodesSyncDraftByCanEdit(canEdit)
+
+  return useWorkflowStartRunBase(handleRun, doSyncWorkflowDraft)
+}
+
+export const useWorkflowStartRun = () => {
+  const { handleRun } = useWorkflowRun()
+  const { doSyncWorkflowDraft } = useNodesSyncDraft()
+
+  return useWorkflowStartRunBase(handleRun, doSyncWorkflowDraft)
+}
diff --git a/web/app/components/workflow-app/index.tsx b/web/app/components/workflow-app/index.tsx
index e45ebbac771..dd572c0b7e5 100644
--- a/web/app/components/workflow-app/index.tsx
+++ b/web/app/components/workflow-app/index.tsx
@@ -24,6 +24,7 @@ import { useSearchParams } from '@/next/navigation'
 import { fetchRunDetail } from '@/service/log'
 import { useAppTriggers } from '@/service/use-tools'
 import { AppModeEnum } from '@/types/app'
+import { getAppACLCapabilities } from '@/utils/permission'
 import WorkflowAppMain from './components/workflow-main'
 
 import { useGetRunAndTraceUrl } from './hooks/use-get-run-and-trace-url'
@@ -44,11 +45,16 @@ const WorkflowAppWithAdditionalContext = () => {
     fileUploadConfigResponse,
   } = useWorkflowInit()
   const workflowStore = useWorkflowStore()
-  const { isLoadingCurrentWorkspace, currentWorkspace } = useAppContext()
+  const { isLoadingCurrentWorkspace, currentWorkspace, userProfile, workspacePermissionKeys } = useAppContext()
 
   // Initialize trigger status at application level
   const { setTriggerStatuses } = useTriggerStatusStore()
   const appDetail = useAppStore(s => s.appDetail)
+  const appACLCapabilities = useMemo(() => getAppACLCapabilities(appDetail?.permission_keys, {
+    currentUserId: userProfile?.id,
+    resourceMaintainer: appDetail?.maintainer,
+    workspacePermissionKeys,
+  }), [appDetail?.maintainer, appDetail?.permission_keys, userProfile?.id, workspacePermissionKeys])
   const appId = appDetail?.id
   const isWorkflowMode = appDetail?.mode === AppModeEnum.WORKFLOW
   const { data: triggersResponse } = useAppTriggers(isWorkflowMode ? appId : undefined, {
@@ -98,7 +104,7 @@ const WorkflowAppWithAdditionalContext = () => {
   const replayRunId = searchParams.get('replayRunId')
 
   useEffect(() => {
-    if (!replayRunId)
+    if (!replayRunId || !appACLCapabilities.canTestAndRun)
       return
     const { runUrl } = getWorkflowRunAndTraceUrl(replayRunId)
     if (!runUrl)
@@ -127,7 +133,7 @@ const WorkflowAppWithAdditionalContext = () => {
       setShowInputsPanel(true)
       setShowDebugAndPreviewPanel(true)
     })
-  }, [replayRunId, workflowStore, getWorkflowRunAndTraceUrl])
+  }, [appACLCapabilities.canTestAndRun, replayRunId, workflowStore, getWorkflowRunAndTraceUrl])
 
   if (!data || isLoading || isLoadingCurrentWorkspace || !currentWorkspace.id) {
     return (
diff --git a/web/app/components/workflow/__tests__/candidate-node-main.spec.tsx b/web/app/components/workflow/__tests__/candidate-node-main.spec.tsx
index 2e465c6df2c..3b327d7cc98 100644
--- a/web/app/components/workflow/__tests__/candidate-node-main.spec.tsx
+++ b/web/app/components/workflow/__tests__/candidate-node-main.spec.tsx
@@ -16,6 +16,8 @@ const mockCustomNode = vi.hoisted(() => vi.fn())
 const mockCustomNoteNode = vi.hoisted(() => vi.fn())
 const mockGetIterationStartNode = vi.hoisted(() => vi.fn())
 const mockGetLoopStartNode = vi.hoisted(() => vi.fn())
+const mockCreateInlineAgentBinding = vi.hoisted(() => vi.fn())
+const mockSetOpenInlineAgentPanelNodeId = vi.hoisted(() => vi.fn())
 
 vi.mock('ahooks', () => ({
   useEventListener: (...args: unknown[]) => mockUseEventListener(...args),
@@ -68,6 +70,12 @@ vi.mock('@/app/components/workflow/note-node', () => ({
   },
 }))
 
+vi.mock('@/app/components/workflow/nodes/agent-v2/hooks', () => ({
+  useCreateInlineAgentBinding: () => ({
+    createInlineAgentBinding: mockCreateInlineAgentBinding,
+  }),
+}))
+
 vi.mock('@/app/components/workflow/utils', () => ({
   getIterationStartNode: (...args: unknown[]) => mockGetIterationStartNode(...args),
   getLoopStartNode: (...args: unknown[]) => mockGetLoopStartNode(...args),
@@ -102,6 +110,9 @@ describe('CandidateNodeMain', () => {
     mockUseEventListener.mockImplementation((event: 'click' | 'contextmenu', handler: (event: { preventDefault: () => void }) => void) => {
       eventHandlers[event] = handler
     })
+    mockSetNodes.mockImplementation((nextNodes) => {
+      nodes = nextNodes
+    })
     mockUseStoreApi.mockReturnValue({
       getState: () => ({
         getNodes: () => nodes,
@@ -126,6 +137,9 @@ describe('CandidateNodeMain', () => {
       },
     }))
     mockUseWorkflowStore.mockReturnValue({
+      getState: () => ({
+        setOpenInlineAgentPanelNodeId: mockSetOpenInlineAgentPanelNodeId,
+      }),
       setState: mockWorkflowStoreSetState,
     })
     mockUseHooks.mockReturnValue({
@@ -137,6 +151,17 @@ describe('CandidateNodeMain', () => {
     mockHandleSyncWorkflowDraft.mockImplementation((_isSync: boolean, _force: boolean, options?: { onSuccess?: () => void }) => {
       options?.onSuccess?.()
     })
+    mockCreateInlineAgentBinding.mockImplementation((_nodeId: string, options?: { onSuccess?: (binding: {
+      binding_type: 'inline_agent'
+      agent_id: string
+      current_snapshot_id: string
+    }) => void }) => {
+      options?.onSuccess?.({
+        binding_type: 'inline_agent',
+        agent_id: 'inline-agent-1',
+        current_snapshot_id: 'inline-snapshot-1',
+      })
+    })
     mockGetIterationStartNode.mockReturnValue(createNode({ id: 'iteration-start' }))
     mockGetLoopStartNode.mockReturnValue(createNode({ id: 'loop-start' }))
   })
@@ -201,6 +226,97 @@ describe('CandidateNodeMain', () => {
     expect(mockHandleNodeSelect).toHaveBeenCalledWith('candidate-note')
   })
 
+  it('should sync draft immediately when committing an Agent v2 node', () => {
+    const candidateNode = createNode({
+      id: 'candidate-agent-v2',
+      type: CUSTOM_NODE,
+      data: {
+        type: BlockEnum.Agent,
+        title: 'Agent Candidate',
+        agent_binding: {
+          binding_type: 'roster_agent',
+          agent_id: 'agent-1',
+        },
+        agent_node_kind: 'dify_agent',
+        version: '2',
+        _isCandidate: true,
+      },
+    })
+
+    render(<CandidateNodeMain candidateNode={candidateNode} />)
+
+    eventHandlers.click?.({ preventDefault: vi.fn() })
+
+    expect(mockSetNodes).toHaveBeenCalledWith(expect.arrayContaining([
+      expect.objectContaining({
+        id: 'candidate-agent-v2',
+        data: expect.objectContaining({
+          agent_binding: {
+            binding_type: 'roster_agent',
+            agent_id: 'agent-1',
+          },
+          agent_node_kind: 'dify_agent',
+          version: '2',
+          _isCandidate: false,
+        }),
+      }),
+    ]))
+    expect(mockHandleSyncWorkflowDraft).toHaveBeenCalledWith(true, true)
+  })
+
+  it('should create inline binding before syncing a start-from-scratch Agent v2 node', () => {
+    const candidateNode = createNode({
+      id: 'candidate-inline-agent-v2',
+      type: CUSTOM_NODE,
+      data: {
+        type: BlockEnum.Agent,
+        title: 'Agent Candidate',
+        agent_binding: {
+          binding_type: 'inline_agent',
+        },
+        agent_node_kind: 'dify_agent',
+        version: '2',
+        _isCandidate: true,
+      },
+    })
+
+    render(<CandidateNodeMain candidateNode={candidateNode} />)
+
+    eventHandlers.click?.({ preventDefault: vi.fn() })
+
+    expect(mockCreateInlineAgentBinding).toHaveBeenCalledWith('candidate-inline-agent-v2', expect.objectContaining({
+      onSuccess: expect.any(Function),
+    }))
+    expect(mockSetNodes.mock.calls[0]?.[0]).toEqual(expect.arrayContaining([
+      expect.objectContaining({
+        id: 'candidate-inline-agent-v2',
+        data: expect.objectContaining({
+          agent_binding: {
+            binding_type: 'inline_agent',
+          },
+          _isTempNode: true,
+        }),
+      }),
+    ]))
+    expect(mockSetNodes).toHaveBeenLastCalledWith(expect.arrayContaining([
+      expect.objectContaining({
+        id: 'candidate-inline-agent-v2',
+        data: expect.objectContaining({
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'inline-snapshot-1',
+          },
+        }),
+      }),
+    ]))
+    const finalNodes = mockSetNodes.mock.calls.at(-1)?.[0]
+    const finalAgentNode = finalNodes.find((node: { id: string }) => node.id === 'candidate-inline-agent-v2')
+    expect(finalAgentNode.data._isTempNode).toBeUndefined()
+    expect(mockSetOpenInlineAgentPanelNodeId).toHaveBeenCalledWith('candidate-inline-agent-v2')
+    expect(mockHandleSyncWorkflowDraft).toHaveBeenCalledWith(true, true)
+  })
+
   it('should append iteration and loop start helper nodes for control-flow candidates', () => {
     const iterationNode = createNode({
       id: 'candidate-iteration',
diff --git a/web/app/components/workflow/__tests__/panel-contextmenu.spec.tsx b/web/app/components/workflow/__tests__/panel-contextmenu.spec.tsx
index 1f3ff385da5..37ee2cf0b30 100644
--- a/web/app/components/workflow/__tests__/panel-contextmenu.spec.tsx
+++ b/web/app/components/workflow/__tests__/panel-contextmenu.spec.tsx
@@ -1,5 +1,6 @@
 import { ContextMenu } from '@langgenius/dify-ui/context-menu'
 import { fireEvent, screen, waitFor } from '@testing-library/react'
+import { fullWorkflowAccessControl } from '../hooks-store'
 import { PanelContextmenu } from '../panel-contextmenu'
 import { BlockEnum } from '../types'
 import { createNode } from './fixtures'
@@ -167,4 +168,26 @@ describe('PanelContextmenu', () => {
       expect(mockClose).toHaveBeenCalled()
     })
   })
+
+  it('should hide add note when editing is denied but comments are allowed', async () => {
+    mockUseWorkflowMoveMode.mockReturnValue({
+      isCommentModeAvailable: true,
+    })
+
+    renderPanelContextmenu({
+      initialStoreState: {
+        contextMenuTarget: { type: 'panel' },
+      },
+      hooksStoreProps: {
+        accessControl: {
+          ...fullWorkflowAccessControl,
+          canEdit: false,
+          canComment: true,
+        },
+      },
+    })
+
+    expect(await screen.findByText('comments.actions.addComment')).toBeInTheDocument()
+    expect(screen.queryByText('nodes.note.addNote')).not.toBeInTheDocument()
+  })
 })
diff --git a/web/app/components/workflow/__tests__/selection-contextmenu.spec.tsx b/web/app/components/workflow/__tests__/selection-contextmenu.spec.tsx
index 39eff52fdc6..3ae8851a23f 100644
--- a/web/app/components/workflow/__tests__/selection-contextmenu.spec.tsx
+++ b/web/app/components/workflow/__tests__/selection-contextmenu.spec.tsx
@@ -19,6 +19,15 @@ const mockHandleNodesDuplicate = vi.fn()
 const mockHandleNodesDelete = vi.fn()
 const mockHandleCreateSnippet = vi.fn()
 const mockCreateSnippetDialogRender = vi.fn()
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['snippets.create_and_modify'] as string[],
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
 
 vi.mock('@/app/components/snippets/hooks/use-create-snippet', async () => {
   const React = await vi.importActual<typeof import('react')>('react')
@@ -135,6 +144,7 @@ describe('SelectionContextmenu', () => {
     mockHandleNodesDelete.mockReset()
     mockHandleCreateSnippet.mockReset()
     mockCreateSnippetDialogRender.mockReset()
+    mockWorkspacePermissionKeys.value = ['snippets.create_and_modify']
   })
 
   it('should not render when selection context menu target is absent', () => {
@@ -226,6 +236,24 @@ describe('SelectionContextmenu', () => {
     }))
   })
 
+  it('should hide create snippet action without snippets create-and-modify permission', async () => {
+    mockWorkspacePermissionKeys.value = []
+    const nodes = [
+      createNode({ id: 'n1', selected: true, width: 80, height: 40 }),
+      createNode({ id: 'n2', selected: true, position: { x: 140, y: 0 }, width: 80, height: 40 }),
+    ]
+    const { store } = renderSelectionMenu({ nodes })
+
+    act(() => {
+      store.setState({ contextMenuTarget: { type: 'selection' } })
+    })
+
+    await waitFor(() => {
+      expect(screen.getByRole('menuitem', { name: /common.copy/ })).toBeInTheDocument()
+    })
+    expect(screen.queryByRole('menuitem', { name: /Create Snippet|snippet\.createDialogTitle/ })).not.toBeInTheDocument()
+  })
+
   it('should add input fields for variable references outside of the selected graph', async () => {
     const nodes = [
       createNode({
diff --git a/web/app/components/workflow/__tests__/workflow-test-env.spec.tsx b/web/app/components/workflow/__tests__/workflow-test-env.spec.tsx
index f47da870bb3..739fd01410e 100644
--- a/web/app/components/workflow/__tests__/workflow-test-env.spec.tsx
+++ b/web/app/components/workflow/__tests__/workflow-test-env.spec.tsx
@@ -95,16 +95,9 @@ describe('renderWorkflowComponent', () => {
     expect(screen.getByTestId('hooks-reader'))!.toHaveTextContent('test-123')
   })
 
-  it('should throw when HooksStoreContext is not provided', () => {
-    const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
-    try {
-      expect(() => {
-        renderWorkflowComponent(React.createElement(HooksStoreReader))
-      }).toThrow('Missing HooksStoreContext.Provider')
-    }
-    finally {
-      consoleSpy.mockRestore()
-    }
+  it('should provide HooksStoreContext with default store', () => {
+    renderWorkflowComponent(React.createElement(HooksStoreReader))
+    expect(screen.getByTestId('hooks-reader'))!.toHaveTextContent('none')
   })
 
   it('should forward extra render options (container)', () => {
diff --git a/web/app/components/workflow/__tests__/workflow-test-env.tsx b/web/app/components/workflow/__tests__/workflow-test-env.tsx
index ff18b304e50..7c46887d3ef 100644
--- a/web/app/components/workflow/__tests__/workflow-test-env.tsx
+++ b/web/app/components/workflow/__tests__/workflow-test-env.tsx
@@ -141,9 +141,7 @@ type StoreInstances = {
 
 function createStoresFromOptions(options: WorkflowProviderOptions): StoreInstances {
   const store = createTestWorkflowStore(options.initialStoreState)
-  const hooksStore = options.hooksStoreProps !== undefined
-    ? createTestHooksStore(options.hooksStoreProps)
-    : undefined
+  const hooksStore = createTestHooksStore(options.hooksStoreProps)
   return { store, hooksStore }
 }
 
diff --git a/web/app/components/workflow/block-icon.tsx b/web/app/components/workflow/block-icon.tsx
index 15292a07049..afb2acdaa11 100644
--- a/web/app/components/workflow/block-icon.tsx
+++ b/web/app/components/workflow/block-icon.tsx
@@ -68,6 +68,7 @@ const DEFAULT_ICON_MAP: Record<BlockEnum, React.ComponentType<{ className: strin
   [BlockEnum.DocExtractor]: DocsExtractor,
   [BlockEnum.ListFilter]: ListFilter,
   [BlockEnum.Agent]: Agent,
+  [BlockEnum.AgentV2]: Agent,
   [BlockEnum.KnowledgeBase]: KnowledgeBase,
   [BlockEnum.DataSource]: Datasource,
   [BlockEnum.DataSourceEmpty]: () => null,
@@ -118,6 +119,7 @@ const ICON_CONTAINER_BG_COLOR_MAP: Record<string, string> = {
   [BlockEnum.DocExtractor]: 'bg-util-colors-green-green-500',
   [BlockEnum.ListFilter]: 'bg-util-colors-cyan-cyan-500',
   [BlockEnum.Agent]: 'bg-util-colors-indigo-indigo-500',
+  [BlockEnum.AgentV2]: 'bg-util-colors-indigo-indigo-500',
   [BlockEnum.HumanInput]: 'bg-util-colors-cyan-cyan-500',
   [BlockEnum.KnowledgeBase]: 'bg-util-colors-warning-warning-500',
   [BlockEnum.DataSource]: 'bg-components-icon-bg-midnight-solid',
diff --git a/web/app/components/workflow/block-selector/__tests__/blocks.spec.tsx b/web/app/components/workflow/block-selector/__tests__/blocks.spec.tsx
index 70900d64b56..a417f974ba8 100644
--- a/web/app/components/workflow/block-selector/__tests__/blocks.spec.tsx
+++ b/web/app/components/workflow/block-selector/__tests__/blocks.spec.tsx
@@ -1,6 +1,10 @@
 import type { NodeDefault } from '../../types'
-import { render, screen } from '@testing-library/react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { FlowType } from '@/types/common'
+import { HooksStoreContext } from '../../hooks-store/provider'
+import { createHooksStore } from '../../hooks-store/store'
 import { BlockEnum } from '../../types'
 import Blocks from '../blocks'
 import { BlockClassificationEnum } from '../types'
@@ -10,6 +14,11 @@ const runtimeState = vi.hoisted(() => ({
   nodes: [] as Array<{ data: { type?: BlockEnum } }>,
 }))
 
+const queryMocks = vi.hoisted(() => ({
+  inviteOptionsQueryFn: vi.fn(),
+  toastError: vi.fn(),
+}))
+
 vi.mock('reactflow', () => ({
   useStoreApi: () => ({
     getState: () => ({
@@ -26,10 +35,36 @@ vi.mock('@/app/components/app/store', () => ({
   }),
 }))
 
-const createBlock = (type: BlockEnum, title: string, classification = BlockClassificationEnum.Default): NodeDefault => ({
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      inviteOptions: {
+        get: {
+          queryOptions: (options: unknown) => ({
+            queryKey: ['agents', 'invite-options', options],
+            queryFn: () => queryMocks.inviteOptionsQueryFn(options),
+          }),
+        },
+      },
+    },
+  },
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    error: (message: string) => queryMocks.toastError(message),
+  },
+}))
+
+const createBlock = (
+  type: BlockEnum,
+  title: string,
+  classification = BlockClassificationEnum.Default,
+  sort = 0,
+): NodeDefault => ({
   metaData: {
     classification,
-    sort: 0,
+    sort,
     type,
     title,
     author: 'Dify',
@@ -65,12 +100,12 @@ describe('Blocks', () => {
       />,
     )
 
-    expect(screen.getByText('LLM')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'LLM' })).toBeInTheDocument()
     expect(screen.getByText('Exit Loop')).toBeInTheDocument()
     expect(screen.getByText('workflow.nodes.loop.loopNode')).toBeInTheDocument()
     expect(screen.queryByText('Knowledge Retrieval')).not.toBeInTheDocument()
 
-    await user.click(screen.getByText('LLM'))
+    await user.click(screen.getByRole('button', { name: 'LLM' }))
 
     expect(onSelect).toHaveBeenCalledWith(BlockEnum.LLM)
   })
@@ -87,4 +122,297 @@ describe('Blocks', () => {
 
     expect(screen.getByText('workflow.tabs.noResult')).toBeInTheDocument()
   })
+
+  it('opens the agent selector on Agent block hover', async () => {
+    const user = userEvent.setup()
+    queryMocks.inviteOptionsQueryFn.mockResolvedValue({
+      data: [],
+      has_more: false,
+      limit: 8,
+      page: 1,
+      total: 0,
+    })
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+        },
+      },
+    })
+    const hooksStore = createHooksStore({
+      configsMap: {
+        flowId: 'app-1',
+        flowType: FlowType.appFlow,
+        fileSettings: {} as never,
+      },
+    })
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <HooksStoreContext value={hooksStore}>
+          <Blocks
+            searchText=""
+            onSelect={vi.fn()}
+            availableBlocksTypes={[BlockEnum.AgentV2]}
+            blocks={[createBlock(BlockEnum.AgentV2, 'Agent')]}
+          />
+        </HooksStoreContext>
+      </QueryClientProvider>,
+    )
+
+    await user.hover(screen.getByRole('button', { name: 'Agent' }))
+
+    expect(await screen.findByRole('dialog', { name: 'agentV2.roster.nodeSelector.dialogLabel' })).toBeInTheDocument()
+  })
+
+  it('opens the agent selector from the Agent block and selects an agent', async () => {
+    const user = userEvent.setup()
+    const onSelect = vi.fn()
+    queryMocks.inviteOptionsQueryFn.mockResolvedValue({
+      data: [
+        {
+          id: 'agent-1',
+          name: 'Nadia',
+          description: 'Clarification Drafter',
+          active_config_snapshot_id: 'version-1',
+          role: 'Researcher',
+          agent_kind: 'dify_agent',
+          icon: 'A',
+          icon_background: '#E9D7FE',
+          icon_type: 'emoji',
+          scope: 'roster',
+          source: 'workflow',
+          status: 'active',
+        },
+      ],
+      has_more: false,
+      limit: 8,
+      page: 1,
+      total: 1,
+    })
+
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+        },
+      },
+    })
+    const hooksStore = createHooksStore({
+      configsMap: {
+        flowId: 'app-1',
+        flowType: FlowType.appFlow,
+        fileSettings: {} as never,
+      },
+    })
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <HooksStoreContext value={hooksStore}>
+          <Blocks
+            searchText=""
+            onSelect={onSelect}
+            availableBlocksTypes={[BlockEnum.LLM, BlockEnum.AgentV2]}
+            blocks={[
+              createBlock(BlockEnum.LLM, 'LLM', BlockClassificationEnum.Default, 0),
+              createBlock(BlockEnum.AgentV2, 'Agent', BlockClassificationEnum.Default, 3),
+            ]}
+          />
+        </HooksStoreContext>
+      </QueryClientProvider>,
+    )
+
+    expect(
+      screen.getByText('Agent').compareDocumentPosition(screen.getByText('LLM')) & Node.DOCUMENT_POSITION_FOLLOWING,
+    ).toBeTruthy()
+
+    await user.click(screen.getByRole('button', { name: 'Agent' }))
+
+    expect(await screen.findByRole('dialog', { name: 'agentV2.roster.nodeSelector.dialogLabel' })).toBeInTheDocument()
+    expect(screen.getByRole('combobox', { name: 'agentV2.roster.searchLabel' })).toBeInTheDocument()
+    expect(await screen.findByText('Nadia')).toBeInTheDocument()
+    expect(screen.getByText('Researcher')).toBeInTheDocument()
+
+    await user.click(screen.getByRole('option', { name: 'Nadia Researcher' }))
+
+    expect(onSelect).toHaveBeenCalledWith(BlockEnum.AgentV2, {
+      agent_binding: {
+        binding_type: 'roster_agent',
+        agent_id: 'agent-1',
+      },
+      agent_node_kind: 'dify_agent',
+      version: '2',
+    })
+    expect(queryMocks.inviteOptionsQueryFn).toHaveBeenCalledWith({
+      input: {
+        query: {
+          app_id: 'app-1',
+          limit: 8,
+          page: 1,
+        },
+      },
+    })
+  })
+
+  it('does not select an Agent v2 roster agent without active config snapshot', async () => {
+    const user = userEvent.setup()
+    const onSelect = vi.fn()
+    queryMocks.inviteOptionsQueryFn.mockResolvedValue({
+      data: [
+        {
+          id: 'agent-1',
+          name: 'Nadia',
+          description: 'Clarification Drafter',
+          active_config_snapshot_id: null,
+          role: 'Researcher',
+          agent_kind: 'dify_agent',
+          icon: 'A',
+          icon_background: '#E9D7FE',
+          icon_type: 'emoji',
+          scope: 'roster',
+          source: 'workflow',
+          status: 'active',
+        },
+      ],
+      has_more: false,
+      limit: 8,
+      page: 1,
+      total: 1,
+    })
+
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+        },
+      },
+    })
+    const hooksStore = createHooksStore({
+      configsMap: {
+        flowId: 'app-1',
+        flowType: FlowType.appFlow,
+        fileSettings: {} as never,
+      },
+    })
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <HooksStoreContext value={hooksStore}>
+          <Blocks
+            searchText=""
+            onSelect={onSelect}
+            availableBlocksTypes={[BlockEnum.AgentV2]}
+            blocks={[createBlock(BlockEnum.AgentV2, 'Agent', BlockClassificationEnum.Default, 3)]}
+          />
+        </HooksStoreContext>
+      </QueryClientProvider>,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Agent' }))
+    expect(await screen.findByText('Nadia')).toBeInTheDocument()
+
+    await user.click(screen.getByRole('option', { name: 'Nadia Researcher' }))
+
+    await waitFor(() => expect(queryMocks.toastError).toHaveBeenCalledWith('workflow.nodes.agent.modelNotSelected'))
+    expect(onSelect).not.toHaveBeenCalled()
+  })
+
+  it('inserts an inline Agent v2 node from the selector start action', async () => {
+    const user = userEvent.setup()
+    const onSelect = vi.fn()
+    queryMocks.inviteOptionsQueryFn.mockResolvedValue({
+      data: [],
+      has_more: false,
+      limit: 8,
+      page: 1,
+      total: 0,
+    })
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+        },
+      },
+    })
+    const hooksStore = createHooksStore({
+      configsMap: {
+        flowId: 'app-1',
+        flowType: FlowType.appFlow,
+        fileSettings: {} as never,
+      },
+    })
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <HooksStoreContext value={hooksStore}>
+          <Blocks
+            searchText=""
+            onSelect={onSelect}
+            availableBlocksTypes={[BlockEnum.AgentV2]}
+            blocks={[createBlock(BlockEnum.AgentV2, 'Agent', BlockClassificationEnum.Default, 3)]}
+          />
+        </HooksStoreContext>
+      </QueryClientProvider>,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Agent' }))
+    await user.click(await screen.findByRole('button', { name: 'agentV2.roster.nodeSelector.startFromScratch' }))
+
+    expect(onSelect).toHaveBeenCalledWith(BlockEnum.AgentV2, {
+      agent_binding: {
+        binding_type: 'inline_agent',
+      },
+      agent_node_kind: 'dify_agent',
+      version: '2',
+    })
+  })
+
+  it('closes the agent selector when Escape closes the combobox', async () => {
+    const user = userEvent.setup()
+    queryMocks.inviteOptionsQueryFn.mockResolvedValue({
+      data: [],
+      has_more: false,
+      limit: 8,
+      page: 1,
+      total: 0,
+    })
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+        },
+      },
+    })
+    const hooksStore = createHooksStore({
+      configsMap: {
+        flowId: 'app-1',
+        flowType: FlowType.appFlow,
+        fileSettings: {} as never,
+      },
+    })
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <HooksStoreContext value={hooksStore}>
+          <Blocks
+            searchText=""
+            onSelect={vi.fn()}
+            availableBlocksTypes={[BlockEnum.AgentV2]}
+            blocks={[createBlock(BlockEnum.AgentV2, 'Agent')]}
+          />
+        </HooksStoreContext>
+      </QueryClientProvider>,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Agent' }))
+
+    expect(await screen.findByRole('dialog', { name: 'agentV2.roster.nodeSelector.dialogLabel' })).toBeInTheDocument()
+
+    await user.click(screen.getByRole('combobox', { name: 'agentV2.roster.searchLabel' }))
+    await user.keyboard('{Escape}')
+
+    await waitFor(() => {
+      expect(screen.queryByRole('dialog', { name: 'agentV2.roster.nodeSelector.dialogLabel' })).not.toBeInTheDocument()
+    })
+  })
 })
diff --git a/web/app/components/workflow/block-selector/__tests__/index.spec.tsx b/web/app/components/workflow/block-selector/__tests__/index.spec.tsx
index 52928540e2d..7aa8c9b9d28 100644
--- a/web/app/components/workflow/block-selector/__tests__/index.spec.tsx
+++ b/web/app/components/workflow/block-selector/__tests__/index.spec.tsx
@@ -53,6 +53,10 @@ const dataSource: ToolWithProvider = {
 }
 
 describe('NodeSelectorWrapper', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
   it('filters hidden block types from hooks store and forwards data sources', async () => {
     renderWorkflowComponent(
       <NodeSelectorWrapper
diff --git a/web/app/components/workflow/block-selector/__tests__/tool-picker.spec.tsx b/web/app/components/workflow/block-selector/__tests__/tool-picker.spec.tsx
index 943c3649ae1..b5949265cad 100644
--- a/web/app/components/workflow/block-selector/__tests__/tool-picker.spec.tsx
+++ b/web/app/components/workflow/block-selector/__tests__/tool-picker.spec.tsx
@@ -35,6 +35,7 @@ const mockCreateCustomCollection = vi.mocked(createCustomCollection)
 const mockInstallPackageFromMarketPlace = vi.fn()
 const mockCheckInstalled = vi.fn()
 const mockRefreshPluginList = vi.fn()
+let mockWorkspacePermissionKeys: string[] = ['tool.manage']
 
 const mockUseGetLanguage = vi.mocked(useGetLanguage)
 const mockUseTheme = vi.mocked(useTheme)
@@ -54,6 +55,12 @@ vi.mock('@/context/i18n', () => ({
   useGetLanguage: vi.fn(),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
 vi.mock('@/hooks/use-theme', () => ({
   default: vi.fn(),
 }))
@@ -70,6 +77,10 @@ vi.mock('@/app/components/plugins/marketplace/hooks', () => ({
   useMarketplacePlugins: vi.fn(),
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission', () => ({
+  default: () => ({ canInstallPlugin: true }),
+}))
+
 vi.mock('@/service/tools', () => ({
   createCustomCollection: vi.fn(),
 }))
@@ -323,6 +334,7 @@ const renderToolPicker = (props: Partial<React.ComponentProps<typeof ToolPicker>
 describe('ToolPicker', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys = ['tool.manage']
 
     mockUseGetLanguage.mockReturnValue('en_US')
     mockUseTheme.mockReturnValue({ theme: Theme.light } as ReturnType<typeof useTheme>)
@@ -345,8 +357,12 @@ describe('ToolPicker', () => {
       page: 0,
     } as ReturnType<typeof useMarketplacePlugins>)
     mockUseAllBuiltInTools.mockReturnValue({ data: builtInTools } as ReturnType<typeof useAllBuiltInTools>)
-    mockUseAllCustomTools.mockReturnValue({ data: customTools } as ReturnType<typeof useAllCustomTools>)
-    mockUseAllWorkflowTools.mockReturnValue({ data: workflowTools } as ReturnType<typeof useAllWorkflowTools>)
+    mockUseAllCustomTools.mockImplementation((enabled = true) => ({
+      data: enabled ? customTools : [],
+    } as ReturnType<typeof useAllCustomTools>))
+    mockUseAllWorkflowTools.mockImplementation((enabled = true) => ({
+      data: enabled ? workflowTools : [],
+    } as ReturnType<typeof useAllWorkflowTools>))
     mockUseAllMCPTools.mockReturnValue({ data: mcpTools } as ReturnType<typeof useAllMCPTools>)
     mockUseInvalidateAllBuiltInTools.mockReturnValue(mockInvalidateBuiltInTools)
     mockUseInvalidateAllCustomTools.mockReturnValue(mockInvalidateCustomTools)
@@ -482,6 +498,24 @@ describe('ToolPicker', () => {
     expect(screen.queryByTestId('edit-custom-tool-modal')).not.toBeInTheDocument()
   })
 
+  it('should keep custom and workflow tools usable but hide custom create action without tool.manage', () => {
+    mockWorkspacePermissionKeys = []
+
+    renderToolPicker({
+      isShow: true,
+      supportAddCustomTool: true,
+    })
+
+    expect(mockUseAllCustomTools).toHaveBeenCalledWith(true)
+    expect(mockUseAllWorkflowTools).toHaveBeenCalledWith(true)
+    expect(screen.getByText('Custom Provider')).toBeInTheDocument()
+    expect(screen.getByText('Built-in Provider')).toBeInTheDocument()
+    expect(screen.getByText('MCP Provider')).toBeInTheDocument()
+    expect(Array.from(document.querySelectorAll('button')).some((button) => {
+      return button.className.includes('bg-components-button-primary-bg')
+    })).toBe(false)
+  })
+
   it('should invalidate all tool collections after featured install succeeds', async () => {
     const user = userEvent.setup()
 
diff --git a/web/app/components/workflow/block-selector/agent-selector.tsx b/web/app/components/workflow/block-selector/agent-selector.tsx
new file mode 100644
index 00000000000..05268025ee5
--- /dev/null
+++ b/web/app/components/workflow/block-selector/agent-selector.tsx
@@ -0,0 +1,311 @@
+import type { AgentInviteOptionResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { ComboboxRootChangeEventDetails } from '@langgenius/dify-ui/combobox'
+import type { NodeDefault } from '../types'
+import type { AgentRosterNodeData } from './types'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  Combobox,
+  ComboboxEmpty,
+  ComboboxInput,
+  ComboboxInputGroup,
+  ComboboxItem,
+  ComboboxItemText,
+  ComboboxList,
+  ComboboxStatus,
+} from '@langgenius/dify-ui/combobox'
+import {
+  Popover,
+  PopoverContent,
+  PopoverTitle,
+  PopoverTrigger,
+} from '@langgenius/dify-ui/popover'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useQuery } from '@tanstack/react-query'
+import { useDebounce } from 'ahooks'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
+import Link from '@/next/link'
+import { consoleQuery } from '@/service/client'
+import BlockIcon from '../block-icon'
+
+const AGENT_SELECTOR_PAGE_SIZE = 8
+
+export function AgentSelectorContent({
+  open,
+  onOpenChange,
+  onSelect,
+  onStartFromScratch,
+}: {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  onSelect: (agent: AgentRosterNodeData) => void
+  onStartFromScratch?: () => void
+}) {
+  const { t } = useTranslation(['agentV2', 'common', 'workflow'])
+  const appId = useHooksStore(s => s.configsMap?.flowId)
+  const [searchText, setSearchText] = useState('')
+  const debouncedSearchText = useDebounce(searchText.trim(), { wait: 300 })
+  const agentsQuery = useQuery({
+    ...consoleQuery.agent.inviteOptions.get.queryOptions({
+      input: {
+        query: {
+          limit: AGENT_SELECTOR_PAGE_SIZE,
+          page: 1,
+          ...(appId ? { app_id: appId } : {}),
+          ...(debouncedSearchText ? { keyword: debouncedSearchText } : {}),
+        },
+      },
+    }),
+  })
+  const agents = agentsQuery.data?.data ?? []
+  const handleInputValueChange = (nextSearchText: string, details: ComboboxRootChangeEventDetails) => {
+    if (details.reason !== 'item-press')
+      setSearchText(nextSearchText)
+  }
+  const handleValueChange = (agent: AgentInviteOptionResponse | null) => {
+    if (!agent)
+      return
+
+    if (!agent.active_config_snapshot_id) {
+      toast.error(t('nodes.agent.modelNotSelected', { ns: 'workflow' }))
+      return
+    }
+
+    onSelect(toAgentRosterNodeData(agent))
+  }
+  const handleOpenChange = (nextOpen: boolean) => {
+    if (!nextOpen)
+      onOpenChange(false)
+  }
+  const isLoading = agentsQuery.isPending
+
+  return (
+    <div className="w-60 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg backdrop-blur-sm">
+      <Combobox<AgentInviteOptionResponse>
+        filter={null}
+        inputValue={searchText}
+        items={agents}
+        itemToStringLabel={getAgentLabel}
+        itemToStringValue={getAgentValue}
+        open={open}
+        value={null}
+        onInputValueChange={handleInputValueChange}
+        onOpenChange={handleOpenChange}
+        onValueChange={handleValueChange}
+      >
+        <div className="bg-components-panel-bg-blur p-2 pb-1">
+          <ComboboxInputGroup className="h-8 min-h-8 px-2">
+            <span aria-hidden className="mr-0.5 i-ri-search-line size-4 shrink-0 text-components-input-text-placeholder" />
+            <ComboboxInput
+              aria-label={t('roster.searchLabel', { ns: 'agentV2' })}
+              placeholder={t('roster.nodeSelector.searchPlaceholder', { ns: 'agentV2' })}
+              className="block h-4.5 grow px-1 py-0 system-sm-regular text-components-input-text-filled"
+            />
+          </ComboboxInputGroup>
+        </div>
+        <div className="max-h-54 overflow-y-auto p-1">
+          {isLoading && (
+            <AgentSelectorLoadingSkeleton label={t('loading', { ns: 'common' })} />
+          )}
+          {!isLoading && agentsQuery.isError && (
+            <ComboboxStatus className="px-3 py-2 system-xs-regular">
+              {t('roster.loadingError', { ns: 'agentV2' })}
+            </ComboboxStatus>
+          )}
+          {!isLoading && !agentsQuery.isError && (
+            <>
+              <ComboboxList className="max-h-none overflow-visible p-0">
+                {(agent: AgentInviteOptionResponse) => (
+                  <AgentSelectorItem key={agent.id} agent={agent} />
+                )}
+              </ComboboxList>
+              <ComboboxEmpty className="px-3 py-2 system-xs-regular">
+                {debouncedSearchText
+                  ? t('roster.emptySearch', { ns: 'agentV2' })
+                  : t('roster.empty', { ns: 'agentV2' })}
+              </ComboboxEmpty>
+            </>
+          )}
+        </div>
+      </Combobox>
+      <div className="border-t border-divider-subtle p-1">
+        {onStartFromScratch && (
+          <button
+            type="button"
+            className="flex min-h-7 w-full cursor-pointer items-center gap-2 rounded-md px-2 py-1.5 text-left system-sm-regular text-text-secondary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            onClick={onStartFromScratch}
+          >
+            <span aria-hidden className="i-ri-add-line size-4 shrink-0 text-text-tertiary" />
+            <span className="min-w-0 flex-1 truncate">
+              {t('roster.nodeSelector.startFromScratch', { ns: 'agentV2' })}
+            </span>
+          </button>
+        )}
+        <Link
+          href="/roster"
+          className="flex min-h-7 w-full items-center gap-2 rounded-md px-2 py-1.5 system-sm-regular text-text-secondary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+        >
+          <span aria-hidden className="i-ri-arrow-right-up-line size-4 shrink-0 text-text-tertiary" />
+          <span className="min-w-0 flex-1 truncate">
+            {t('roster.nodeSelector.manageInAgentConsole', { ns: 'agentV2' })}
+          </span>
+        </Link>
+      </div>
+    </div>
+  )
+}
+
+function AgentSelectorLoadingSkeleton({
+  label,
+}: {
+  label: string
+}) {
+  return (
+    <ComboboxStatus className="p-0">
+      <span className="sr-only">{label}</span>
+      <div className="relative overflow-hidden" aria-hidden>
+        <div className="p-1">
+          {['skeleton-1', 'skeleton-2', 'skeleton-3', 'skeleton-4'].map((key, index) => (
+            <div
+              key={key}
+              className={cn(
+                'flex items-center gap-2 py-1.5 pr-3 pl-2 opacity-20',
+                index === 3 && 'opacity-10',
+              )}
+            >
+              <div className="size-8 shrink-0 rounded-full bg-text-quaternary" />
+              <div className="flex min-w-0 flex-1 flex-col gap-1.5">
+                <div className="h-2 w-20 rounded-xs bg-text-quaternary" />
+                <div className="h-2 w-28 rounded-xs bg-text-quaternary" />
+              </div>
+            </div>
+          ))}
+        </div>
+        <div className="pointer-events-none absolute inset-0 bg-linear-to-b from-components-panel-bg-transparent to-background-default-subtle" />
+      </div>
+    </ComboboxStatus>
+  )
+}
+
+function getAgentLabel(agent: AgentInviteOptionResponse) {
+  return agent.name
+}
+
+function getAgentValue(agent: AgentInviteOptionResponse) {
+  return agent.id
+}
+
+function toAgentRosterNodeData(agent: AgentInviteOptionResponse): AgentRosterNodeData {
+  return {
+    description: agent.description,
+    icon: agent.icon,
+    icon_background: agent.icon_background,
+    icon_type: agent.icon_type,
+    id: agent.id,
+    name: agent.name,
+    role: agent.role,
+  }
+}
+
+function AgentSelectorAvatar({
+  agent,
+}: {
+  agent: AgentInviteOptionResponse
+}) {
+  return (
+    <AppIcon
+      size="small"
+      iconType={agent.icon_type}
+      icon={agent.icon ?? undefined}
+      background={agent.icon_background}
+      imageUrl={agent.icon ?? undefined}
+    />
+  )
+}
+
+function AgentSelectorItem({
+  agent,
+}: {
+  agent: AgentInviteOptionResponse
+}) {
+  return (
+    <ComboboxItem
+      value={agent}
+      className="grid-cols-[1fr] gap-0 py-1.5 pr-3 pl-2"
+    >
+      <ComboboxItemText className="flex items-center gap-2 px-0">
+        <span aria-hidden className="shrink-0">
+          <AgentSelectorAvatar agent={agent} />
+        </span>
+        <span className="flex min-w-0 flex-1 flex-col gap-0.5">
+          <span className="truncate system-sm-medium text-text-secondary">
+            {agent.name}
+          </span>
+          <span className="truncate system-xs-regular text-text-tertiary">
+            {agent.role || agent.description}
+          </span>
+        </span>
+      </ComboboxItemText>
+    </ComboboxItem>
+  )
+}
+
+export function AgentBlockItem({
+  block,
+  onSelect,
+  onStartFromScratch,
+}: {
+  block: NodeDefault
+  onSelect: (agent: AgentRosterNodeData) => void
+  onStartFromScratch: () => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const [open, setOpen] = useState(false)
+  const handleSelect = (agent: AgentRosterNodeData) => {
+    setOpen(false)
+    onSelect(agent)
+  }
+
+  return (
+    <Popover open={open} onOpenChange={setOpen}>
+      <PopoverTrigger
+        openOnHover
+        render={(
+          <button
+            type="button"
+            className="flex h-8 w-full cursor-pointer items-center rounded-lg px-3 text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden data-popup-open:bg-state-base-hover"
+          >
+            <BlockIcon
+              className="mr-2 shrink-0"
+              type={block.metaData.type}
+            />
+            <span className="min-w-0 grow truncate system-sm-medium text-text-secondary">
+              {block.metaData.title}
+            </span>
+            <span aria-hidden className="i-custom-vender-solid-general-arrow-down-round-fill size-4 shrink-0 -rotate-90 text-text-tertiary" />
+          </button>
+        )}
+      />
+      <PopoverContent
+        placement="right-start"
+        sideOffset={4}
+        popupClassName="border-none bg-transparent p-0 shadow-none backdrop-blur-none"
+      >
+        <PopoverTitle className="sr-only">
+          {t('roster.nodeSelector.dialogLabel')}
+        </PopoverTitle>
+        <AgentSelectorContent
+          open={open}
+          onOpenChange={setOpen}
+          onSelect={handleSelect}
+          onStartFromScratch={() => {
+            setOpen(false)
+            onStartFromScratch()
+          }}
+        />
+      </PopoverContent>
+    </Popover>
+  )
+}
diff --git a/web/app/components/workflow/block-selector/blocks.tsx b/web/app/components/workflow/block-selector/blocks.tsx
index d5fe0b8b29a..9cc90246754 100644
--- a/web/app/components/workflow/block-selector/blocks.tsx
+++ b/web/app/components/workflow/block-selector/blocks.tsx
@@ -1,4 +1,4 @@
-import type { NodeDefault } from '../types'
+import type { NodeDefault, OnSelectBlock } from '../types'
 import type { BlockClassificationEnum } from './types'
 import {
   createPreviewCardHandle,
@@ -17,12 +17,13 @@ import { useStoreApi } from 'reactflow'
 import Badge from '@/app/components/base/badge'
 import BlockIcon from '../block-icon'
 import { BlockEnum } from '../types'
+import { AgentBlockItem } from './agent-selector'
 import { BLOCK_CLASSIFICATIONS } from './constants'
 import { useBlocks } from './hooks'
 
 type BlocksProps = {
   searchText: string
-  onSelect: (type: BlockEnum) => void
+  onSelect: OnSelectBlock
   availableBlocksTypes?: BlockEnum[]
   blocks?: NodeDefault[]
 }
@@ -79,7 +80,13 @@ const Blocks = ({
   const isEmpty = Object.values(groups).every(list => !list.length)
 
   const renderGroup = useCallback((classification: BlockClassificationEnum) => {
-    const list = groups[classification]!.sort((a, b) => (a.metaData.sort || 0) - (b.metaData.sort || 0))
+    const list = [...groups[classification]!].sort((a, b) => {
+      if (a.metaData.type === BlockEnum.AgentV2)
+        return -1
+      if (b.metaData.type === BlockEnum.AgentV2)
+        return 1
+      return (a.metaData.sort || 0) - (b.metaData.sort || 0)
+    })
     const { getNodes } = store.getState()
     const nodes = getNodes()
     const hasKnowledgeBaseNode = nodes.some(node => node.data.type === BlockEnum.KnowledgeBase)
@@ -102,39 +109,64 @@ const Blocks = ({
           )
         }
         {
-          // Preview is supplementary: icon/title/description are all reachable
-          // from the node that gets added on click (inspector + canvas), so
-          // hover/focus-only activation is a11y-safe. See
-          // packages/dify-ui/AGENTS.md → Overlay Primitive Selection.
-          filteredList.map(block => (
-            <PreviewCardTrigger
-              key={block.metaData.type}
-              delay={150}
-              closeDelay={150}
-              handle={previewCardHandle}
-              payload={{ block }}
-              render={(
-                <div
-                  className="flex h-8 w-full cursor-pointer items-center rounded-lg px-3 hover:bg-state-base-hover"
-                  onClick={() => onSelect(block.metaData.type)}
-                >
-                  <BlockIcon
-                    className="mr-2 shrink-0"
-                    type={block.metaData.type}
-                  />
-                  <div className="grow text-sm text-text-secondary">{block.metaData.title}</div>
-                  {
-                    block.metaData.type === BlockEnum.LoopEnd && (
-                      <Badge
-                        text={t('nodes.loop.loopNode', { ns: 'workflow' })}
-                        className="ml-2 shrink-0"
-                      />
-                    )
-                  }
-                </div>
-              )}
-            />
-          ))
+          filteredList.map((block) => {
+            if (block.metaData.type === BlockEnum.AgentV2) {
+              return (
+                <AgentBlockItem
+                  key={block.metaData.type}
+                  block={block}
+                  onSelect={agent =>
+                    onSelect(BlockEnum.AgentV2, {
+                      agent_binding: {
+                        binding_type: 'roster_agent',
+                        agent_id: agent.id,
+                      },
+                      agent_node_kind: 'dify_agent',
+                      version: '2',
+                    })}
+                  onStartFromScratch={() =>
+                    onSelect(BlockEnum.AgentV2, {
+                      agent_binding: {
+                        binding_type: 'inline_agent',
+                      },
+                      agent_node_kind: 'dify_agent',
+                      version: '2',
+                    })}
+                />
+              )
+            }
+
+            return (
+              <PreviewCardTrigger
+                key={block.metaData.type}
+                delay={150}
+                closeDelay={150}
+                handle={previewCardHandle}
+                payload={{ block }}
+                render={(
+                  <button
+                    type="button"
+                    className="flex h-8 w-full cursor-pointer items-center rounded-lg px-3 text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+                    onClick={() => onSelect(block.metaData.type)}
+                  >
+                    <BlockIcon
+                      className="mr-2 shrink-0"
+                      type={block.metaData.type}
+                    />
+                    <span className="min-w-0 grow truncate text-sm text-text-secondary">{block.metaData.title}</span>
+                    {
+                      block.metaData.type === BlockEnum.LoopEnd && (
+                        <Badge
+                          text={t('nodes.loop.loopNode', { ns: 'workflow' })}
+                          className="ml-2 shrink-0"
+                        />
+                      )
+                    }
+                  </button>
+                )}
+              />
+            )
+          })
         }
       </div>
     )
diff --git a/web/app/components/workflow/block-selector/constants.tsx b/web/app/components/workflow/block-selector/constants.tsx
index 5ecce2aa49d..a036cc270cb 100644
--- a/web/app/components/workflow/block-selector/constants.tsx
+++ b/web/app/components/workflow/block-selector/constants.tsx
@@ -61,6 +61,16 @@ export const ENTRY_NODE_TYPES = [
 ] as const
 
 export const BLOCKS = [
+  {
+    classification: BlockClassificationEnum.Default,
+    type: BlockEnum.Agent,
+    title: 'Agent',
+  },
+  {
+    classification: BlockClassificationEnum.Default,
+    type: BlockEnum.AgentV2,
+    title: 'Agent',
+  },
   {
     classification: BlockClassificationEnum.Default,
     type: BlockEnum.LLM,
@@ -147,9 +157,4 @@ export const BLOCKS = [
     type: BlockEnum.ListFilter,
     title: 'List Filter',
   },
-  {
-    classification: BlockClassificationEnum.Default,
-    type: BlockEnum.Agent,
-    title: 'Agent',
-  },
 ] as const satisfies readonly Block[]
diff --git a/web/app/components/workflow/block-selector/featured-tools.tsx b/web/app/components/workflow/block-selector/featured-tools.tsx
index 61f8426028e..bd50d1abc64 100644
--- a/web/app/components/workflow/block-selector/featured-tools.tsx
+++ b/web/app/components/workflow/block-selector/featured-tools.tsx
@@ -4,16 +4,17 @@ import type { ToolWithProvider } from '../types'
 import type { ToolDefaultValue, ToolValue } from './types'
 import type { Plugin } from '@/app/components/plugins/types'
 import type { Locale } from '@/i18n-config'
+import { cn } from '@langgenius/dify-ui/cn'
 import { createPreviewCardHandle, PreviewCard, PreviewCardContent, PreviewCardTrigger } from '@langgenius/dify-ui/preview-card'
-import { RiMoreLine } from '@remixicon/react'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { useEffect, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { ArrowDownDoubleLine, ArrowDownRoundFill, ArrowUpDoubleLine } from '@/app/components/base/icons/src/vender/solid/arrows'
 import Loading from '@/app/components/base/loading'
+import { PluginInstallPermissionProvider } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import InstallFromMarketplace from '@/app/components/plugins/install-plugin/install-from-marketplace'
 import { getMarketplaceCategoryUrl } from '@/app/components/plugins/marketplace/utils'
 import Action from '@/app/components/workflow/block-selector/market-place-plugin/action'
+import { useFeaturedToolsCollapsed } from '@/app/components/workflow/block-selector/storage'
 import { useGetLanguage } from '@/context/i18n'
 import Link from '@/next/link'
 import { formatNumber } from '@/utils/format'
@@ -41,8 +42,6 @@ type FeaturedToolPreviewPayload = {
   description: string
 }
 
-const STORAGE_KEY = 'workflow_tools_featured_collapsed'
-
 const FeaturedTools = ({
   plugins,
   providerMap,
@@ -56,7 +55,7 @@ const FeaturedTools = ({
   const previewCardHandle = useMemo(() => createPreviewCardHandle<FeaturedToolPreviewPayload>(), [])
   const [visibleCount, setVisibleCount] = useState(INITIAL_VISIBLE_COUNT)
   const [visibleCountPlugins, setVisibleCountPlugins] = useState(plugins)
-  const [isCollapsed, setIsCollapsed] = useLocalStorage<boolean>(STORAGE_KEY, false)
+  const [isCollapsed, setIsCollapsed] = useFeaturedToolsCollapsed()
 
   if (visibleCountPlugins !== plugins) {
     setVisibleCountPlugins(plugins)
@@ -124,7 +123,12 @@ const FeaturedTools = ({
         onClick={() => setIsCollapsed(prev => !prev)}
       >
         <span className="system-xs-medium text-text-primary">{t('tabs.featuredTools', { ns: 'workflow' })}</span>
-        <ArrowDownRoundFill className={`ml-0.5 size-4 text-text-tertiary transition-transform ${isCollapsed ? '-rotate-90' : 'rotate-0'}`} />
+        <span className={cn(
+          'i-custom-vender-solid-arrows-arrow-down-round-fill',
+          'ml-0.5 size-4 text-text-tertiary transition-transform',
+          isCollapsed ? '-rotate-90' : 'rotate-0',
+        )}
+        />
       </button>
 
       {!isCollapsed && (
@@ -190,13 +194,13 @@ const FeaturedTools = ({
               }}
             >
               <div className="flex items-center px-1 text-text-tertiary transition-colors group-hover:text-text-secondary">
-                <RiMoreLine className="size-4 group-hover:hidden" />
+                <span className="i-ri-more-line size-4 group-hover:hidden" />
                 {isExpanded
                   ? (
-                      <ArrowUpDoubleLine className="hidden size-4 group-hover:block" />
+                      <span className="i-custom-vender-solid-arrows-arrow-up-double-line hidden size-4 group-hover:block" />
                     )
                   : (
-                      <ArrowDownDoubleLine className="hidden size-4 group-hover:block" />
+                      <span className="i-custom-vender-solid-arrows-arrow-down-double-line hidden size-4 group-hover:block" />
                     )}
               </div>
               <div className="system-xs-regular">
@@ -235,6 +239,7 @@ function FeaturedToolUninstalledItem({
   const installCountLabel = t('install', { ns: 'plugin', num: formatNumber(plugin.install_count || 0) })
   const [actionOpen, setActionOpen] = useState(false)
   const [isInstallModalOpen, setIsInstallModalOpen] = useState(false)
+  const { canInstallPlugin, currentDifyVersion } = useWorkspacePluginInstallPermission()
 
   useEffect(() => {
     if (!actionOpen)
@@ -266,16 +271,18 @@ function FeaturedToolUninstalledItem({
         <div
           className={`flex h-full items-center gap-1 system-xs-medium text-components-button-secondary-accent-text [&_.action-btn]:size-6 [&_.action-btn]:min-h-0 [&_.action-btn]:rounded-lg [&_.action-btn]:p-0 ${actionOpen ? '' : 'hidden group-hover:flex'}`}
         >
-          <button
-            type="button"
-            className="cursor-pointer rounded-md px-1.5 py-0.5 hover:bg-state-base-hover"
-            onClick={() => {
-              setActionOpen(false)
-              setIsInstallModalOpen(true)
-            }}
-          >
-            {t('installAction', { ns: 'plugin' })}
-          </button>
+          {canInstallPlugin && (
+            <button
+              type="button"
+              className="cursor-pointer rounded-md px-1.5 py-0.5 hover:bg-state-base-hover"
+              onClick={() => {
+                setActionOpen(false)
+                setIsInstallModalOpen(true)
+              }}
+            >
+              {t('installAction', { ns: 'plugin' })}
+            </button>
+          )}
           <Action
             open={actionOpen}
             onOpenChange={setActionOpen}
@@ -304,18 +311,23 @@ function FeaturedToolUninstalledItem({
             />
           )
         : row}
-      {isInstallModalOpen && (
-        <InstallFromMarketplace
-          uniqueIdentifier={plugin.latest_package_identifier}
-          manifest={plugin}
-          onSuccess={async () => {
-            setIsInstallModalOpen(false)
-            await onInstallSuccess?.()
-          }}
-          onClose={() => {
-            setIsInstallModalOpen(false)
-          }}
-        />
+      {isInstallModalOpen && canInstallPlugin && (
+        <PluginInstallPermissionProvider
+          canInstallPlugin={canInstallPlugin}
+          currentDifyVersion={currentDifyVersion}
+        >
+          <InstallFromMarketplace
+            uniqueIdentifier={plugin.latest_package_identifier}
+            manifest={plugin}
+            onSuccess={async () => {
+              setIsInstallModalOpen(false)
+              await onInstallSuccess?.()
+            }}
+            onClose={() => {
+              setIsInstallModalOpen(false)
+            }}
+          />
+        </PluginInstallPermissionProvider>
       )}
     </>
   )
diff --git a/web/app/components/workflow/block-selector/featured-triggers.tsx b/web/app/components/workflow/block-selector/featured-triggers.tsx
index 6f16d033994..99617c76d27 100644
--- a/web/app/components/workflow/block-selector/featured-triggers.tsx
+++ b/web/app/components/workflow/block-selector/featured-triggers.tsx
@@ -4,16 +4,17 @@ import type { TriggerPluginActionPreviewPayload } from './trigger-plugin/action-
 import type { TriggerDefaultValue, TriggerWithProvider } from './types'
 import type { Plugin } from '@/app/components/plugins/types'
 import type { Locale } from '@/i18n-config'
+import { cn } from '@langgenius/dify-ui/cn'
 import { createPreviewCardHandle, PreviewCard, PreviewCardContent, PreviewCardTrigger } from '@langgenius/dify-ui/preview-card'
-import { RiMoreLine } from '@remixicon/react'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { useEffect, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { ArrowDownDoubleLine, ArrowDownRoundFill, ArrowUpDoubleLine } from '@/app/components/base/icons/src/vender/solid/arrows'
 import Loading from '@/app/components/base/loading'
+import { PluginInstallPermissionProvider } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import InstallFromMarketplace from '@/app/components/plugins/install-plugin/install-from-marketplace'
 import { getMarketplaceCategoryUrl } from '@/app/components/plugins/marketplace/utils'
 import Action from '@/app/components/workflow/block-selector/market-place-plugin/action'
+import { useFeaturedTriggersCollapsed } from '@/app/components/workflow/block-selector/storage'
 import { useGetLanguage } from '@/context/i18n'
 import Link from '@/next/link'
 import { formatNumber } from '@/utils/format'
@@ -40,8 +41,6 @@ type FeaturedTriggerPreviewPayload = {
   description: string
 }
 
-const STORAGE_KEY = 'workflow_triggers_featured_collapsed'
-
 const FeaturedTriggers = ({
   plugins,
   providerMap,
@@ -55,7 +54,7 @@ const FeaturedTriggers = ({
   const triggerActionPreviewCardHandle = useMemo(() => createPreviewCardHandle<TriggerPluginActionPreviewPayload>(), [])
   const [visibleCount, setVisibleCount] = useState(INITIAL_VISIBLE_COUNT)
   const [visibleCountPlugins, setVisibleCountPlugins] = useState(plugins)
-  const [isCollapsed, setIsCollapsed] = useLocalStorage<boolean>(STORAGE_KEY, false)
+  const [isCollapsed, setIsCollapsed] = useFeaturedTriggersCollapsed()
 
   if (visibleCountPlugins !== plugins) {
     setVisibleCountPlugins(plugins)
@@ -123,7 +122,12 @@ const FeaturedTriggers = ({
         onClick={() => setIsCollapsed(prev => !prev)}
       >
         <span className="system-xs-medium text-text-primary">{t('tabs.featuredTools', { ns: 'workflow' })}</span>
-        <ArrowDownRoundFill className={`ml-0.5 size-4 text-text-tertiary transition-transform ${isCollapsed ? '-rotate-90' : 'rotate-0'}`} />
+        <span className={cn(
+          'i-custom-vender-solid-arrows-arrow-down-round-fill',
+          'ml-0.5 size-4 text-text-tertiary transition-transform',
+          isCollapsed ? '-rotate-90' : 'rotate-0',
+        )}
+        />
       </button>
 
       {!isCollapsed && (
@@ -183,13 +187,13 @@ const FeaturedTriggers = ({
               }}
             >
               <div className="flex items-center px-1 text-text-tertiary transition-colors group-hover:text-text-secondary">
-                <RiMoreLine className="size-4 group-hover:hidden" />
+                <span className="i-ri-more-line size-4 group-hover:hidden" />
                 {isExpanded
                   ? (
-                      <ArrowUpDoubleLine className="hidden size-4 group-hover:block" />
+                      <span className="i-custom-vender-solid-arrows-arrow-up-double-line hidden size-4 group-hover:block" />
                     )
                   : (
-                      <ArrowDownDoubleLine className="hidden size-4 group-hover:block" />
+                      <span className="i-custom-vender-solid-arrows-arrow-down-double-line hidden size-4 group-hover:block" />
                     )}
               </div>
               <div className="system-xs-regular">
@@ -233,6 +237,7 @@ function FeaturedTriggerUninstalledItem({
   const installCountLabel = t('install', { ns: 'plugin', num: formatNumber(plugin.install_count || 0) })
   const [actionOpen, setActionOpen] = useState(false)
   const [isInstallModalOpen, setIsInstallModalOpen] = useState(false)
+  const { canInstallPlugin, currentDifyVersion } = useWorkspacePluginInstallPermission()
 
   useEffect(() => {
     if (!actionOpen)
@@ -262,16 +267,18 @@ function FeaturedTriggerUninstalledItem({
         <div
           className={`flex h-full items-center gap-1 system-xs-medium text-components-button-secondary-accent-text [&_.action-btn]:size-6 [&_.action-btn]:min-h-0 [&_.action-btn]:rounded-lg [&_.action-btn]:p-0 ${actionOpen ? '' : 'hidden group-hover:flex'}`}
         >
-          <button
-            type="button"
-            className="cursor-pointer rounded-md px-1.5 py-0.5 hover:bg-state-base-hover"
-            onClick={() => {
-              setActionOpen(false)
-              setIsInstallModalOpen(true)
-            }}
-          >
-            {t('installAction', { ns: 'plugin' })}
-          </button>
+          {canInstallPlugin && (
+            <button
+              type="button"
+              className="cursor-pointer rounded-md px-1.5 py-0.5 hover:bg-state-base-hover"
+              onClick={() => {
+                setActionOpen(false)
+                setIsInstallModalOpen(true)
+              }}
+            >
+              {t('installAction', { ns: 'plugin' })}
+            </button>
+          )}
           <Action
             open={actionOpen}
             onOpenChange={setActionOpen}
@@ -300,18 +307,23 @@ function FeaturedTriggerUninstalledItem({
             />
           )
         : row}
-      {isInstallModalOpen && (
-        <InstallFromMarketplace
-          uniqueIdentifier={plugin.latest_package_identifier}
-          manifest={plugin}
-          onSuccess={async () => {
-            setIsInstallModalOpen(false)
-            await onInstallSuccess?.()
-          }}
-          onClose={() => {
-            setIsInstallModalOpen(false)
-          }}
-        />
+      {isInstallModalOpen && canInstallPlugin && (
+        <PluginInstallPermissionProvider
+          canInstallPlugin={canInstallPlugin}
+          currentDifyVersion={currentDifyVersion}
+        >
+          <InstallFromMarketplace
+            uniqueIdentifier={plugin.latest_package_identifier}
+            manifest={plugin}
+            onSuccess={async () => {
+              setIsInstallModalOpen(false)
+              await onInstallSuccess?.()
+            }}
+            onClose={() => {
+              setIsInstallModalOpen(false)
+            }}
+          />
+        </PluginInstallPermissionProvider>
       )}
     </>
   )
diff --git a/web/app/components/workflow/block-selector/market-place-plugin/__tests__/item-list.spec.tsx b/web/app/components/workflow/block-selector/market-place-plugin/__tests__/item-list.spec.tsx
index be251a54ffc..85640e132f1 100644
--- a/web/app/components/workflow/block-selector/market-place-plugin/__tests__/item-list.spec.tsx
+++ b/web/app/components/workflow/block-selector/market-place-plugin/__tests__/item-list.spec.tsx
@@ -23,6 +23,13 @@ vi.mock('@/app/components/plugins/install-plugin/install-from-marketplace', () =
   ),
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission', () => ({
+  default: () => ({
+    canInstallPlugin: true,
+    currentDifyVersion: '1.0.0',
+  }),
+}))
+
 vi.mock('../action', () => ({
   default: ({ open, onOpenChange }: { open: boolean, onOpenChange: (open: boolean) => void }) => (
     <button type="button" onClick={() => onOpenChange(!open)}>
diff --git a/web/app/components/workflow/block-selector/market-place-plugin/item.tsx b/web/app/components/workflow/block-selector/market-place-plugin/item.tsx
index fc2876e34c5..16316ffc8b5 100644
--- a/web/app/components/workflow/block-selector/market-place-plugin/item.tsx
+++ b/web/app/components/workflow/block-selector/market-place-plugin/item.tsx
@@ -5,17 +5,16 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { useBoolean } from 'ahooks'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
+import { PluginInstallPermissionProvider } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import InstallFromMarketplace from '@/app/components/plugins/install-plugin/install-from-marketplace'
 import { useLocale } from '@/context/i18n'
 
 import { formatNumber } from '@/utils/format'
 import Action from './action'
 
-enum ActionType {
-  install = 'install',
-  download = 'download',
-  // viewDetail = 'viewDetail', // wait for marketplace api
-}
+type ActionType = 'install' | 'download'
+
 type Props = Readonly<{
   payload: Plugin
   onAction: (type: ActionType) => void
@@ -33,6 +32,7 @@ const Item: FC<Props> = ({
     setTrue: showInstallModal,
     setFalse: hideInstallModal,
   }] = useBoolean(false)
+  const { canInstallPlugin, currentDifyVersion } = useWorkspacePluginInstallPermission()
 
   return (
     <div className="group/plugin flex rounded-lg py-1 pr-1 pl-3 select-none hover:bg-state-base-hover">
@@ -52,13 +52,15 @@ const Item: FC<Props> = ({
         </div>
         {/* Action */}
         <div className={cn(!open ? 'hidden' : 'flex', 'h-4 items-center space-x-1 system-xs-medium text-components-button-secondary-accent-text group-hover/plugin:flex')}>
-          <button
-            type="button"
-            className="cursor-pointer rounded-md border-0 bg-transparent px-1.5 py-0.5 hover:bg-state-base-hover"
-            onClick={showInstallModal}
-          >
-            {t('installAction', { ns: 'plugin' })}
-          </button>
+          {canInstallPlugin && (
+            <button
+              type="button"
+              className="cursor-pointer rounded-md border-0 bg-transparent px-1.5 py-0.5 hover:bg-state-base-hover"
+              onClick={showInstallModal}
+            >
+              {t('installAction', { ns: 'plugin' })}
+            </button>
+          )}
           <Action
             open={open}
             onOpenChange={setOpen}
@@ -67,13 +69,18 @@ const Item: FC<Props> = ({
             version={payload.latest_version}
           />
         </div>
-        {isShowInstallModal && (
-          <InstallFromMarketplace
-            uniqueIdentifier={payload.latest_package_identifier}
-            manifest={payload}
-            onSuccess={hideInstallModal}
-            onClose={hideInstallModal}
-          />
+        {isShowInstallModal && canInstallPlugin && (
+          <PluginInstallPermissionProvider
+            canInstallPlugin={canInstallPlugin}
+            currentDifyVersion={currentDifyVersion}
+          >
+            <InstallFromMarketplace
+              uniqueIdentifier={payload.latest_package_identifier}
+              manifest={payload}
+              onSuccess={hideInstallModal}
+              onClose={hideInstallModal}
+            />
+          </PluginInstallPermissionProvider>
         )}
       </div>
     </div>
diff --git a/web/app/components/workflow/block-selector/rag-tool-recommendations/__tests__/list.spec.tsx b/web/app/components/workflow/block-selector/rag-tool-recommendations/__tests__/list.spec.tsx
index a7ff5ad084f..a9ffafca722 100644
--- a/web/app/components/workflow/block-selector/rag-tool-recommendations/__tests__/list.spec.tsx
+++ b/web/app/components/workflow/block-selector/rag-tool-recommendations/__tests__/list.spec.tsx
@@ -25,6 +25,13 @@ vi.mock('@/app/components/workflow/nodes/_base/components/mcp-tool-availability'
   }),
 }))
 
+vi.mock('@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission', () => ({
+  default: () => ({
+    canInstallPlugin: true,
+    currentDifyVersion: '1.0.0',
+  }),
+}))
+
 vi.mock('@/app/components/plugins/install-plugin/install-from-marketplace', () => ({
   default: ({
     uniqueIdentifier,
diff --git a/web/app/components/workflow/block-selector/rag-tool-recommendations/index.tsx b/web/app/components/workflow/block-selector/rag-tool-recommendations/index.tsx
index f7def41acd5..62ef354c35f 100644
--- a/web/app/components/workflow/block-selector/rag-tool-recommendations/index.tsx
+++ b/web/app/components/workflow/block-selector/rag-tool-recommendations/index.tsx
@@ -3,13 +3,13 @@ import type { Dispatch, SetStateAction } from 'react'
 import type { ViewType } from '@/app/components/workflow/block-selector/view-type-select'
 import type { OnSelectBlock } from '@/app/components/workflow/types'
 import { RiMoreLine } from '@remixicon/react'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import * as React from 'react'
 import { useCallback, useMemo } from 'react'
 import { Trans, useTranslation } from 'react-i18next'
 import { ArrowDownRoundFill } from '@/app/components/base/icons/src/vender/solid/arrows'
 import Loading from '@/app/components/base/loading'
 import { getFormattedPlugin } from '@/app/components/plugins/marketplace/utils'
+import { useRAGRecommendationsCollapsed } from '@/app/components/workflow/block-selector/storage'
 import Link from '@/next/link'
 import { useRAGRecommendedPlugins } from '@/service/use-tools'
 import { getMarketplaceUrl } from '@/utils/var'
@@ -21,15 +21,13 @@ type RAGToolRecommendationsProps = {
   onTagsChange: Dispatch<SetStateAction<string[]>>
 }
 
-const STORAGE_KEY = 'workflow_rag_recommendations_collapsed'
-
 const RAGToolRecommendations = ({
   viewType,
   onSelect,
   onTagsChange,
 }: RAGToolRecommendationsProps) => {
   const { t } = useTranslation()
-  const [isCollapsed, setIsCollapsed] = useLocalStorage<boolean>(STORAGE_KEY, false)
+  const [isCollapsed, setIsCollapsed] = useRAGRecommendationsCollapsed()
 
   const {
     data: ragRecommendedPlugins,
diff --git a/web/app/components/workflow/block-selector/rag-tool-recommendations/uninstalled-item.tsx b/web/app/components/workflow/block-selector/rag-tool-recommendations/uninstalled-item.tsx
index 768edc5ace5..0595fd292e8 100644
--- a/web/app/components/workflow/block-selector/rag-tool-recommendations/uninstalled-item.tsx
+++ b/web/app/components/workflow/block-selector/rag-tool-recommendations/uninstalled-item.tsx
@@ -3,6 +3,8 @@ import type { Plugin } from '@/app/components/plugins/types'
 import { useBoolean } from 'ahooks'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
+import { PluginInstallPermissionProvider } from '@/app/components/plugins/install-plugin/components/plugin-install-permission-provider'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import InstallFromMarketplace from '@/app/components/plugins/install-plugin/install-from-marketplace'
 import { useLocale } from '@/context/i18n'
 import BlockIcon from '../../block-icon'
@@ -24,6 +26,7 @@ const UninstalledItem = ({
     setTrue: showInstallModal,
     setFalse: hideInstallModal,
   }] = useBoolean(false)
+  const { canInstallPlugin, currentDifyVersion } = useWorkspacePluginInstallPermission()
 
   return (
     <div className="flex h-8 items-center rounded-lg pr-2 pl-3 hover:bg-state-base-hover">
@@ -41,19 +44,26 @@ const UninstalledItem = ({
             {payload.org}
           </span>
         </div>
-        <div
-          className="cursor-pointer pl-1.5 system-xs-medium text-components-button-secondary-accent-text"
-          onClick={showInstallModal}
-        >
-          {t('installAction', { ns: 'plugin' })}
-        </div>
-        {isShowInstallModal && (
-          <InstallFromMarketplace
-            uniqueIdentifier={payload.latest_package_identifier}
-            manifest={payload}
-            onSuccess={hideInstallModal}
-            onClose={hideInstallModal}
-          />
+        {canInstallPlugin && (
+          <div
+            className="cursor-pointer pl-1.5 system-xs-medium text-components-button-secondary-accent-text"
+            onClick={showInstallModal}
+          >
+            {t('installAction', { ns: 'plugin' })}
+          </div>
+        )}
+        {isShowInstallModal && canInstallPlugin && (
+          <PluginInstallPermissionProvider
+            canInstallPlugin={canInstallPlugin}
+            currentDifyVersion={currentDifyVersion}
+          >
+            <InstallFromMarketplace
+              uniqueIdentifier={payload.latest_package_identifier}
+              manifest={payload}
+              onSuccess={hideInstallModal}
+              onClose={hideInstallModal}
+            />
+          </PluginInstallPermissionProvider>
         )}
       </div>
     </div>
diff --git a/web/app/components/workflow/block-selector/storage.ts b/web/app/components/workflow/block-selector/storage.ts
new file mode 100644
index 00000000000..bddac31846f
--- /dev/null
+++ b/web/app/components/workflow/block-selector/storage.ts
@@ -0,0 +1,25 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+const [
+  useFeaturedToolsCollapsed,
+  _useFeaturedToolsCollapsedValue,
+  _useSetFeaturedToolsCollapsed,
+] = createLocalStorageState<boolean>('workflow_tools_featured_collapsed', false)
+
+const [
+  useFeaturedTriggersCollapsed,
+  _useFeaturedTriggersCollapsedValue,
+  _useSetFeaturedTriggersCollapsed,
+] = createLocalStorageState<boolean>('workflow_triggers_featured_collapsed', false)
+
+const [
+  useRAGRecommendationsCollapsed,
+  _useRAGRecommendationsCollapsedValue,
+  _useSetRAGRecommendationsCollapsed,
+] = createLocalStorageState<boolean>('workflow_rag_recommendations_collapsed', false)
+
+export {
+  useFeaturedToolsCollapsed,
+  useFeaturedTriggersCollapsed,
+  useRAGRecommendationsCollapsed,
+}
diff --git a/web/app/components/workflow/block-selector/tool-picker.tsx b/web/app/components/workflow/block-selector/tool-picker.tsx
index 571f6770058..eb7e60623d1 100644
--- a/web/app/components/workflow/block-selector/tool-picker.tsx
+++ b/web/app/components/workflow/block-selector/tool-picker.tsx
@@ -1,7 +1,7 @@
 'use client'
 import type { OffsetOptions } from '@floating-ui/react'
 import type { Placement } from '@langgenius/dify-ui/popover'
-import type { FC } from 'react'
+import type { ReactNode } from 'react'
 import type { ToolDefaultValue, ToolValue } from './types'
 import type { CustomCollectionBackend } from '@/app/components/tools/types'
 import type { BlockEnum, OnSelectBlock } from '@/app/components/workflow/types'
@@ -14,11 +14,11 @@ import {
 import { toast } from '@langgenius/dify-ui/toast'
 import { useSuspenseQuery } from '@tanstack/react-query'
 import { useBoolean } from 'ahooks'
-import * as React from 'react'
 import { useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import SearchBox from '@/app/components/plugins/marketplace/search-box'
 import EditCustomToolModal from '@/app/components/tools/edit-custom-collection-modal'
+import { useCanManageTools } from '@/app/components/tools/hooks/use-tool-permissions'
 import AllTools from '@/app/components/workflow/block-selector/all-tools'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import {
@@ -37,13 +37,17 @@ import {
 } from '@/service/use-tools'
 
 type Props = Readonly<{
-  panelClassName?: string
   disabled: boolean
-  trigger: React.ReactNode
+  trigger: ReactNode
   placement?: Placement
   offset?: OffsetOptions
   isShow: boolean
   onShowChange: (isShow: boolean) => void
+}> & ToolPickerContentProps
+
+export type ToolPickerContentProps = Readonly<{
+  focusSearchOnMount?: boolean
+  panelClassName?: string
   onSelect: (tool: ToolDefaultValue) => void
   onSelectMultiple: (tools: ToolDefaultValue[]) => void
   supportAddCustomTool?: boolean
@@ -51,34 +55,30 @@ type Props = Readonly<{
   selectedTools?: ToolValue[]
 }>
 
-const ToolPicker: FC<Props> = ({
-  disabled,
-  trigger,
-  placement = 'right-start',
-  offset = 0,
-  isShow,
-  onShowChange,
+export function ToolPickerContent({
+  focusSearchOnMount = false,
   onSelect,
   onSelectMultiple,
   supportAddCustomTool,
   scope = 'all',
   selectedTools,
   panelClassName,
-}) => {
+}: ToolPickerContentProps) {
   const { t } = useTranslation()
   const [searchText, setSearchText] = useState('')
   const [tags, setTags] = useState<string[]>([])
-  const sideOffset = typeof offset === 'number' ? offset : (typeof offset === 'function' ? 0 : (offset?.mainAxis ?? 0))
-  const alignOffset = typeof offset === 'number' ? 0 : (typeof offset === 'function' ? 0 : (offset?.crossAxis ?? 0))
+  const canManageTools = useCanManageTools()
 
   const { data: enable_marketplace } = useSuspenseQuery({
     ...systemFeaturesQueryOptions(),
     select: s => s.enable_marketplace,
   })
   const { data: buildInTools } = useAllBuiltInTools()
-  const { data: customTools } = useAllCustomTools()
+  const shouldFetchCustomTools = scope !== 'plugins' && scope !== 'workflow'
+  const { data: customTools } = useAllCustomTools(shouldFetchCustomTools)
   const invalidateCustomTools = useInvalidateAllCustomTools()
-  const { data: workflowTools } = useAllWorkflowTools()
+  const shouldFetchWorkflowTools = scope !== 'plugins' && scope !== 'custom'
+  const { data: workflowTools } = useAllWorkflowTools(shouldFetchWorkflowTools)
   const { data: mcpTools } = useAllMCPTools()
   const invalidateBuiltInTools = useInvalidateAllBuiltInTools()
   const invalidateWorkflowTools = useInvalidateAllWorkflowTools()
@@ -120,12 +120,6 @@ const ToolPicker: FC<Props> = ({
 
   const handleAddedCustomTool = invalidateCustomTools
 
-  const handleOpenChange = (nextOpen: boolean) => {
-    if (nextOpen && disabled)
-      return
-    onShowChange(nextOpen)
-  }
-
   const handleSelect = (_type: BlockEnum, tool?: ToolDefaultValue) => {
     onSelect(tool!)
   }
@@ -140,13 +134,16 @@ const ToolPicker: FC<Props> = ({
   }] = useBoolean(false)
 
   const doCreateCustomToolCollection = async (data: CustomCollectionBackend) => {
+    if (!canManageTools)
+      return
+
     await createCustomCollection(data)
     toast.success(t('api.actionSuccess', { ns: 'common' }))
     hideEditCustomCollectionModal()
     handleAddedCustomTool()
   }
 
-  if (isShowEditCollectionToolModal) {
+  if (isShowEditCollectionToolModal && canManageTools) {
     return (
       <EditCustomToolModal
         dialogClassName="bg-background-overlay"
@@ -157,6 +154,70 @@ const ToolPicker: FC<Props> = ({
     )
   }
 
+  return (
+    <div className={cn('relative min-h-20 rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg backdrop-blur-xs', panelClassName)}>
+      <div className="p-2 pb-1">
+        <SearchBox
+          search={searchText}
+          onSearchChange={setSearchText}
+          tags={tags}
+          onTagsChange={setTags}
+          placeholder={t('searchTools', { ns: 'plugin' })!}
+          supportAddCustomTool={supportAddCustomTool && canManageTools}
+          onAddedCustomTool={handleAddedCustomTool}
+          onShowAddCustomCollectionModal={showEditCustomCollectionModal}
+          // The picker replaces the focused menu item inside an already-open popover.
+          // Focusing search keeps keyboard users in the same add-tool workflow.
+          /* eslint-disable-next-line jsx-a11y/no-autofocus */
+          autoFocus={focusSearchOnMount}
+          inputClassName="grow"
+        />
+      </div>
+      <AllTools
+        className="mt-1"
+        toolContentClassName="max-w-full"
+        tags={tags}
+        searchText={searchText}
+        onSelect={handleSelect as OnSelectBlock}
+        onSelectMultiple={handleSelectMultiple}
+        buildInTools={builtinToolList || []}
+        customTools={customToolList || []}
+        workflowTools={workflowToolList || []}
+        mcpTools={mcpTools || []}
+        selectedTools={selectedTools}
+        onTagsChange={setTags}
+        featuredPlugins={featuredPlugins}
+        featuredLoading={isFeaturedLoading}
+        showFeatured={scope === 'all' && enable_marketplace}
+        onFeaturedInstallSuccess={async () => {
+          invalidateBuiltInTools()
+          invalidateCustomTools()
+          invalidateWorkflowTools()
+          invalidateMcpTools()
+        }}
+      />
+    </div>
+  )
+}
+
+function ToolPicker({
+  disabled,
+  trigger,
+  placement = 'right-start',
+  offset = 0,
+  isShow,
+  onShowChange,
+  ...contentProps
+}: Props) {
+  const sideOffset = typeof offset === 'number' ? offset : (typeof offset === 'function' ? 0 : (offset?.mainAxis ?? 0))
+  const alignOffset = typeof offset === 'number' ? 0 : (typeof offset === 'function' ? 0 : (offset?.crossAxis ?? 0))
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    if (nextOpen && disabled)
+      return
+    onShowChange(nextOpen)
+  }
+
   return (
     <Popover
       open={isShow}
@@ -175,47 +236,10 @@ const ToolPicker: FC<Props> = ({
         alignOffset={alignOffset}
         popupClassName="border-none bg-transparent shadow-none"
       >
-        <div className={cn('relative min-h-20 rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg backdrop-blur-xs', panelClassName)}>
-          <div className="p-2 pb-1">
-            <SearchBox
-              search={searchText}
-              onSearchChange={setSearchText}
-              tags={tags}
-              onTagsChange={setTags}
-              placeholder={t('searchTools', { ns: 'plugin' })!}
-              supportAddCustomTool={supportAddCustomTool}
-              onAddedCustomTool={handleAddedCustomTool}
-              onShowAddCustomCollectionModal={showEditCustomCollectionModal}
-              inputClassName="grow"
-            />
-          </div>
-          <AllTools
-            className="mt-1"
-            toolContentClassName="max-w-full"
-            tags={tags}
-            searchText={searchText}
-            onSelect={handleSelect as OnSelectBlock}
-            onSelectMultiple={handleSelectMultiple}
-            buildInTools={builtinToolList || []}
-            customTools={customToolList || []}
-            workflowTools={workflowToolList || []}
-            mcpTools={mcpTools || []}
-            selectedTools={selectedTools}
-            onTagsChange={setTags}
-            featuredPlugins={featuredPlugins}
-            featuredLoading={isFeaturedLoading}
-            showFeatured={scope === 'all' && enable_marketplace}
-            onFeaturedInstallSuccess={async () => {
-              invalidateBuiltInTools()
-              invalidateCustomTools()
-              invalidateWorkflowTools()
-              invalidateMcpTools()
-            }}
-          />
-        </div>
+        <ToolPickerContent {...contentProps} />
       </PopoverContent>
     </Popover>
   )
 }
 
-export default React.memo(ToolPicker)
+export default ToolPicker
diff --git a/web/app/components/workflow/block-selector/tool/action-item.tsx b/web/app/components/workflow/block-selector/tool/action-item.tsx
index 7265b65b300..153bc75ce56 100644
--- a/web/app/components/workflow/block-selector/tool/action-item.tsx
+++ b/web/app/components/workflow/block-selector/tool/action-item.tsx
@@ -85,6 +85,7 @@ const ToolItem: FC<Props> = ({
           provider_id: provider.id,
           provider_type: provider.type,
           provider_name: provider.name,
+          provider_show_name: provider.label[language],
           plugin_id: provider.plugin_id,
           plugin_unique_identifier: provider.plugin_unique_identifier,
           provider_icon: normalizedIcon,
diff --git a/web/app/components/workflow/block-selector/tool/tool.tsx b/web/app/components/workflow/block-selector/tool/tool.tsx
index a307b0672f7..3802de6137a 100644
--- a/web/app/components/workflow/block-selector/tool/tool.tsx
+++ b/web/app/components/workflow/block-selector/tool/tool.tsx
@@ -118,6 +118,7 @@ const Tool: FC<Props> = ({
                 provider_id: payload.id,
                 provider_type: payload.type,
                 provider_name: payload.name,
+                provider_show_name: payload.label[language],
                 plugin_id: payload.plugin_id!,
                 plugin_unique_identifier: payload.plugin_unique_identifier!,
                 provider_icon: normalizedIcon,
@@ -148,7 +149,7 @@ const Tool: FC<Props> = ({
           : `${selectedToolsNum} / ${totalToolsNum}`}
       </span>
     )
-  }, [actions, getIsDisabled, isAllSelected, isHovering, language, onSelectMultiple, payload.id, payload.is_team_authorization, payload.name, payload.type, selectedToolsNum, t, totalToolsNum])
+  }, [actions, getIsDisabled, isAllSelected, isHovering, language, normalizedIcon, normalizedIconDark, onSelectMultiple, payload.id, payload.is_team_authorization, payload.label, payload.name, payload.plugin_id, payload.plugin_unique_identifier, payload.type, selectedToolsNum, t, totalToolsNum])
 
   if (isFoldHasSearchText !== hasSearchText) {
     setIsFoldHasSearchText(hasSearchText)
@@ -196,6 +197,7 @@ const Tool: FC<Props> = ({
               provider_id: payload.id,
               provider_type: payload.type,
               provider_name: payload.name,
+              provider_show_name: payload.label[language],
               plugin_id: payload.plugin_id,
               plugin_unique_identifier: payload.plugin_unique_identifier,
               provider_icon: normalizedIcon,
diff --git a/web/app/components/workflow/block-selector/types.ts b/web/app/components/workflow/block-selector/types.ts
index cb74b9c78b0..a6fea38acbd 100644
--- a/web/app/components/workflow/block-selector/types.ts
+++ b/web/app/components/workflow/block-selector/types.ts
@@ -1,3 +1,4 @@
+import type { AgentInviteOptionResponse } from '@dify/contracts/api/console/agent/types.gen'
 import type { ParametersSchema, PluginMeta, PluginTriggerSubscriptionConstructor, SupportedCreationMethods, TriggerEvent } from '../../plugins/types'
 import type { Collection, Event } from '../../tools/types'
 import type { TypeWithI18N } from '@/app/components/header/account-setting/model-provider-page/declarations'
@@ -48,6 +49,7 @@ export type TriggerDefaultValue = PluginCommonDefaultValue & {
 }
 
 export type ToolDefaultValue = PluginCommonDefaultValue & {
+  provider_show_name?: string
   tool_name: string
   tool_label: string
   tool_description: string
@@ -75,8 +77,34 @@ export type DataSourceDefaultValue = Omit<PluginCommonDefaultValue, 'provider_id
   plugin_unique_identifier?: string
 }
 
+export type AgentRosterNodeData = Pick<
+  AgentInviteOptionResponse,
+  'description' | 'icon' | 'icon_background' | 'icon_type' | 'id' | 'name' | 'role'
+>
+
+type AgentRosterBinding = {
+  binding_type: 'roster_agent'
+  agent_id: string
+}
+
+export type AgentInlineBinding = {
+  binding_type: 'inline_agent'
+  agent_id?: string | null
+  current_snapshot_id?: string | null
+}
+
+export type AgentBinding = AgentRosterBinding | AgentInlineBinding
+
+type AgentDefaultValue = {
+  agent_binding: AgentBinding
+  agent_node_kind: 'dify_agent'
+  version: '2'
+}
+
 export type PluginDefaultValue = ToolDefaultValue | DataSourceDefaultValue | TriggerDefaultValue
 
+export type BlockDefaultValue = PluginDefaultValue | AgentDefaultValue
+
 export type ToolValue = {
   provider_name: string
   provider_show_name?: string
diff --git a/web/app/components/workflow/candidate-node-main.tsx b/web/app/components/workflow/candidate-node-main.tsx
index 8161f4aefef..d7473023891 100644
--- a/web/app/components/workflow/candidate-node-main.tsx
+++ b/web/app/components/workflow/candidate-node-main.tsx
@@ -1,4 +1,5 @@
 import type {
+  ComponentProps,
   FC,
 } from 'react'
 import type {
@@ -17,6 +18,8 @@ import { useCollaborativeWorkflow } from '@/app/components/workflow/hooks/use-co
 import { CUSTOM_NODE } from './constants'
 import { useAutoGenerateWebhookUrl, useNodesInteractions, useNodesSyncDraft, useWorkflowHistory, WorkflowHistoryEvent } from './hooks'
 import CustomNode from './nodes'
+import { useCreateInlineAgentBinding } from './nodes/agent-v2/hooks'
+import { isAgentV2NodeData, needsInlineAgentBindingCreation } from './nodes/agent-v2/types'
 import CustomNoteNode from './note-node'
 import { CUSTOM_NOTE_NODE } from './note-node/constants'
 import {
@@ -41,18 +44,21 @@ const CandidateNodeMain: FC<Props> = ({
   const { handleSyncWorkflowDraft } = useNodesSyncDraft()
   const autoGenerateWebhookUrl = useAutoGenerateWebhookUrl()
   const collaborativeWorkflow = useCollaborativeWorkflow()
+  const { createInlineAgentBinding } = useCreateInlineAgentBinding()
 
   useEventListener('click', (e) => {
     e.preventDefault()
     const { screenToFlowPosition } = reactflow
     const { nodes, setNodes } = collaborativeWorkflow.getState()
     const { x, y } = screenToFlowPosition({ x: mousePosition.pageX, y: mousePosition.pageY })
+    const shouldCreateInlineAgentBinding = isAgentV2NodeData(candidateNode.data) && needsInlineAgentBindingCreation(candidateNode.data)
     const newNodes = produce(nodes, (draft) => {
       draft.push({
         ...candidateNode,
         data: {
           ...candidateNode.data,
           _isCandidate: false,
+          _isTempNode: shouldCreateInlineAgentBinding ? true : candidateNode.data._isTempNode,
         },
         position: {
           x,
@@ -81,6 +87,33 @@ const CandidateNodeMain: FC<Props> = ({
         onSuccess: () => autoGenerateWebhookUrl(candidateNode.id),
       })
     }
+
+    if (shouldCreateInlineAgentBinding) {
+      createInlineAgentBinding(candidateNode.id, {
+        onError: () => {
+          const { nodes, setNodes } = collaborativeWorkflow.getState()
+          setNodes(nodes.filter(node => node.id !== candidateNode.id))
+        },
+        onSuccess: (binding) => {
+          const { nodes, setNodes } = collaborativeWorkflow.getState()
+          setNodes(produce(nodes, (draft) => {
+            const node = draft.find(node => node.id === candidateNode.id)
+            if (node) {
+              if (isAgentV2NodeData(node.data) && needsInlineAgentBindingCreation(node.data))
+                node.data.agent_binding = binding
+              node.data._openInlineAgentPanel = true
+              delete node.data._isTempNode
+            }
+          }))
+          workflowStore.getState().setOpenInlineAgentPanelNodeId(candidateNode.id)
+          handleSyncWorkflowDraft(true, true)
+        },
+      })
+      return
+    }
+
+    if (isAgentV2NodeData(candidateNode.data))
+      handleSyncWorkflowDraft(true, true)
   })
 
   useEventListener('contextmenu', (e) => {
@@ -100,12 +133,12 @@ const CandidateNodeMain: FC<Props> = ({
     >
       {
         candidateNode.type === CUSTOM_NODE && (
-          <CustomNode {...candidateNode as any} />
+          <CustomNode {...candidateNode as unknown as ComponentProps<typeof CustomNode>} />
         )
       }
       {
         candidateNode.type === CUSTOM_NOTE_NODE && (
-          <CustomNoteNode {...candidateNode as any} />
+          <CustomNoteNode {...candidateNode as unknown as ComponentProps<typeof CustomNoteNode>} />
         )
       }
     </div>
diff --git a/web/app/components/workflow/constants.ts b/web/app/components/workflow/constants.ts
index 765f10ed3c4..4dc3109a208 100644
--- a/web/app/components/workflow/constants.ts
+++ b/web/app/components/workflow/constants.ts
@@ -121,13 +121,22 @@ export const SUPPORT_OUTPUT_VARS_NODE = [
   BlockEnum.DocExtractor,
   BlockEnum.ListFilter,
   BlockEnum.Agent,
+  BlockEnum.AgentV2,
   BlockEnum.DataSource,
   BlockEnum.HumanInput,
 ]
 
 export const AGENT_OUTPUT_STRUCT: Var[] = [
   {
-    variable: 'usage',
+    variable: 'text',
+    type: VarType.string,
+  },
+  {
+    variable: 'files',
+    type: VarType.arrayFile,
+  },
+  {
+    variable: 'json',
     type: VarType.object,
   },
 ]
diff --git a/web/app/components/workflow/constants/node.ts b/web/app/components/workflow/constants/node.ts
index 4d67f278c25..41269044245 100644
--- a/web/app/components/workflow/constants/node.ts
+++ b/web/app/components/workflow/constants/node.ts
@@ -1,3 +1,4 @@
+import agentV2Default from '@/app/components/workflow/nodes/agent-v2/default'
 import agentDefault from '@/app/components/workflow/nodes/agent/default'
 import assignerDefault from '@/app/components/workflow/nodes/assigner/default'
 import codeDefault from '@/app/components/workflow/nodes/code/default'
@@ -26,6 +27,7 @@ export const WORKFLOW_COMMON_NODES = [
   llmDefault,
   knowledgeRetrievalDefault,
   agentDefault,
+  agentV2Default,
   questionClassifierDefault,
   ifElseDefault,
   iterationDefault,
diff --git a/web/app/components/workflow/header/__tests__/header-in-restoring.spec.tsx b/web/app/components/workflow/header/__tests__/header-in-restoring.spec.tsx
index 87e1db69bf0..ebf8afa6d8d 100644
--- a/web/app/components/workflow/header/__tests__/header-in-restoring.spec.tsx
+++ b/web/app/components/workflow/header/__tests__/header-in-restoring.spec.tsx
@@ -1,5 +1,6 @@
 import type { VersionHistory } from '@/types/workflow'
-import { screen } from '@testing-library/react'
+import { fireEvent, screen } from '@testing-library/react'
+import { Plan } from '@/app/components/billing/type'
 import { FlowType } from '@/types/common'
 import { renderWorkflowComponent } from '../../__tests__/workflow-test-env'
 import { WorkflowVersion } from '../../types'
@@ -10,6 +11,15 @@ const mockInvalidAllLastRun = vi.fn()
 const mockResetWorkflowVersionHistory = vi.fn()
 const mockHandleLoadBackupDraft = vi.fn()
 const mockHandleRefreshWorkflowDraft = vi.fn()
+let mockPlanType = Plan.professional
+let mockEnableBilling = true
+
+vi.mock('@/context/provider-context', () => ({
+  useProviderContext: () => ({
+    plan: { type: mockPlanType },
+    enableBilling: mockEnableBilling,
+  }),
+}))
 
 vi.mock('@/hooks/use-theme', () => ({
   default: () => ({
@@ -75,6 +85,8 @@ const createVersion = (overrides: Partial<VersionHistory> = {}): VersionHistory
 describe('HeaderInRestoring', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockPlanType = Plan.professional
+    mockEnableBilling = true
   })
 
   it('should disable restore when the flow id is not ready yet', () => {
@@ -125,4 +137,26 @@ describe('HeaderInRestoring', () => {
 
     expect(screen.getByRole('button', { name: 'workflow.common.restore' })).toBeDisabled()
   })
+
+  it('should show plan upgrade modal instead of restoring when sandbox users click restore', () => {
+    mockPlanType = Plan.sandbox
+    renderWorkflowComponent(<HeaderInRestoring />, {
+      initialStoreState: {
+        currentVersion: createVersion(),
+      },
+      hooksStoreProps: {
+        configsMap: {
+          flowId: 'app-1',
+          flowType: FlowType.appFlow,
+          fileSettings: {} as never,
+        },
+      },
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.common.restore' }))
+
+    expect(screen.getByText('billing.upgrade.workflowRestore.title')).toBeInTheDocument()
+    expect(mockRestoreWorkflow).not.toHaveBeenCalled()
+    expect(mockHandleRefreshWorkflowDraft).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/app/components/workflow/header/__tests__/run-and-history.spec.tsx b/web/app/components/workflow/header/__tests__/run-and-history.spec.tsx
new file mode 100644
index 00000000000..98a426ef1dc
--- /dev/null
+++ b/web/app/components/workflow/header/__tests__/run-and-history.spec.tsx
@@ -0,0 +1,77 @@
+import { render, screen } from '@testing-library/react'
+import RunAndHistory from '../run-and-history'
+
+const mockState = vi.hoisted(() => ({
+  canRun: true,
+  nodesReadOnly: false,
+}))
+const mockRunMode = vi.hoisted(() => vi.fn())
+const mockHandleWorkflowStartRunInChatflow = vi.hoisted(() => vi.fn())
+
+vi.mock('../../hooks', () => ({
+  useNodesReadOnly: () => ({ nodesReadOnly: mockState.nodesReadOnly }),
+  useWorkflowStartRun: () => ({
+    handleWorkflowStartRunInChatflow: mockHandleWorkflowStartRunInChatflow,
+  }),
+}))
+
+vi.mock('../../hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canRun: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canRun: mockState.canRun,
+      },
+    }),
+}))
+
+vi.mock('../run-mode', () => ({
+  default: ({ text, disabled }: { text?: string, disabled?: boolean }) => {
+    mockRunMode({ text, disabled })
+
+    return (
+      <button type="button" disabled={disabled}>
+        {text ?? 'workflow.common.run'}
+      </button>
+    )
+  },
+}))
+
+vi.mock('../view-history', () => ({
+  default: () => <button type="button">History</button>,
+}))
+
+vi.mock('../checklist', () => ({
+  default: ({ disabled }: { disabled: boolean }) => (
+    <button type="button" disabled={disabled}>
+      Checklist
+    </button>
+  ),
+}))
+
+describe('RunAndHistory', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockState.canRun = true
+    mockState.nodesReadOnly = false
+  })
+
+  it('should keep the test run button visible and disabled when workflow run permission is denied', () => {
+    mockState.canRun = false
+
+    render(<RunAndHistory showRunButton runButtonText="Test Run" />)
+
+    expect(screen.getByRole('button', { name: 'Test Run' })).toBeDisabled()
+    expect(mockRunMode).toHaveBeenCalledWith({
+      text: 'Test Run',
+      disabled: true,
+    })
+  })
+
+  it('should keep the preview button visible and disabled when workflow run permission is denied', () => {
+    mockState.canRun = false
+
+    render(<RunAndHistory showPreviewButton />)
+
+    expect(screen.getByRole('button', { name: 'workflow.common.debugAndPreview' })).toBeDisabled()
+  })
+})
diff --git a/web/app/components/workflow/header/__tests__/run-mode.spec.tsx b/web/app/components/workflow/header/__tests__/run-mode.spec.tsx
index 7e2bc8d0b76..b92f8d12a45 100644
--- a/web/app/components/workflow/header/__tests__/run-mode.spec.tsx
+++ b/web/app/components/workflow/header/__tests__/run-mode.spec.tsx
@@ -22,6 +22,7 @@ const hotkeyRegistrations = vi.hoisted(() => new Map<string, {
 let mockWarningNodes: Array<{ id: string }> = []
 let mockWorkflowRunningData: { result: { status: WorkflowRunningStatus }, task_id: string } | undefined
 let mockIsListening = false
+let mockCanRun = true
 let mockDynamicOptions = [
   { type: TriggerType.UserInput, nodeId: 'start-node' },
 ]
@@ -47,6 +48,15 @@ vi.mock('@/app/components/workflow/store/workflow', () => ({
     selector({ workflowRunningData: mockWorkflowRunningData, isListening: mockIsListening }),
 }))
 
+vi.mock('@/app/components/workflow/hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canRun: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canRun: mockCanRun,
+      },
+    }),
+}))
+
 vi.mock('@tanstack/react-hotkeys', async (importOriginal) => {
   const actual = await importOriginal<typeof import('@tanstack/react-hotkeys')>()
   return {
@@ -82,10 +92,6 @@ vi.mock('@/context/event-emitter', () => ({
   }),
 }))
 
-vi.mock('@/app/components/base/icons/src/vender/line/mediaAndDevices', () => ({
-  StopCircle: () => <span data-testid="stop-circle" />,
-}))
-
 vi.mock('../test-run-menu', async (importOriginal) => {
   const actual = await importOriginal<typeof import('../test-run-menu')>()
   const TestRunMenuMock = ({ children, options, onSelect, ref }: { children: ReactNode, options: Array<{ type: TriggerType, nodeId?: string, relatedNodeIds?: string[] }>, onSelect: (option: { type: TriggerType, nodeId?: string, relatedNodeIds?: string[] }) => void, ref?: React.Ref<TestRunMenuRef> }) => {
@@ -114,6 +120,7 @@ describe('RunMode', () => {
     mockWarningNodes = []
     mockWorkflowRunningData = undefined
     mockIsListening = false
+    mockCanRun = true
     hotkeyRegistrations.clear()
     mockDynamicOptions = [
       { type: TriggerType.UserInput, nodeId: 'start-node' },
@@ -152,7 +159,7 @@ describe('RunMode', () => {
     render(<RunMode />)
 
     expect(screen.getByText(/running/i))!.toBeInTheDocument()
-    fireEvent.click(screen.getByTestId('stop-circle').closest('button') as HTMLButtonElement)
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.debug.variableInspect.trigger.stop' }))
 
     expect(mockHandleStopRun).toHaveBeenCalledWith('task-1')
   })
@@ -172,4 +179,19 @@ describe('RunMode', () => {
       expect.objectContaining({ ignoreInputs: true }),
     )
   })
+
+  it('should keep the run trigger visible and disabled when workflow run permission is denied', () => {
+    mockCanRun = false
+    mockWorkflowRunningData = {
+      result: { status: WorkflowRunningStatus.Running },
+      task_id: 'task-1',
+    }
+
+    render(<RunMode />)
+
+    expect(screen.getByRole('button', { name: /run/i })).toBeDisabled()
+    expect(screen.queryByTestId('trigger-option')).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'workflow.debug.variableInspect.trigger.stop' })).not.toBeInTheDocument()
+    expect(mockHandleWorkflowStartRunInWorkflow).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/app/components/workflow/header/header-in-normal.tsx b/web/app/components/workflow/header/header-in-normal.tsx
index ea7c29affae..30fc8d24422 100644
--- a/web/app/components/workflow/header/header-in-normal.tsx
+++ b/web/app/components/workflow/header/header-in-normal.tsx
@@ -11,6 +11,7 @@ import {
   useNodesReadOnly,
   useWorkflowRun,
 } from '../hooks'
+import { useHooksStore } from '../hooks-store'
 import {
   useStore,
   useWorkflowStore,
@@ -43,6 +44,7 @@ const HeaderInNormal = ({
 }: HeaderInNormalProps) => {
   const workflowStore = useWorkflowStore()
   const { nodesReadOnly } = useNodesReadOnly()
+  const canReleaseAndVersion = useHooksStore(s => s.accessControl.canReleaseAndVersion)
   const { handleNodeSelect } = useNodesInteractions()
   const setShowWorkflowVersionHistoryPanel = useStore(s => s.setShowWorkflowVersionHistoryPanel)
   const setShowEnvPanel = useStore(s => s.setShowEnvPanel)
@@ -94,7 +96,7 @@ const HeaderInNormal = ({
           </div>
         )}
         {components?.middle}
-        <VersionHistoryButton onClick={onStartRestoring} />
+        {canReleaseAndVersion && <VersionHistoryButton onClick={onStartRestoring} />}
       </div>
     </div>
   )
diff --git a/web/app/components/workflow/header/header-in-restoring.tsx b/web/app/components/workflow/header/header-in-restoring.tsx
index bb3753ccfb4..b098bed6018 100644
--- a/web/app/components/workflow/header/header-in-restoring.tsx
+++ b/web/app/components/workflow/header/header-in-restoring.tsx
@@ -4,9 +4,13 @@ import { toast } from '@langgenius/dify-ui/toast'
 import { RiHistoryLine } from '@remixicon/react'
 import {
   useCallback,
+  useState,
 } from 'react'
 import { useTranslation } from 'react-i18next'
+import { PlanUpgradeModal } from '@/app/components/billing/plan-upgrade-modal'
+import { Plan } from '@/app/components/billing/type'
 import { useSelector as useAppContextSelector } from '@/context/app-context'
+import { useProviderContext } from '@/context/provider-context'
 import useTheme from '@/hooks/use-theme'
 import { useInvalidAllLastRun, useResetWorkflowVersionHistory, useRestoreWorkflow } from '@/service/use-workflow'
 import { FlowType } from '@/types/common'
@@ -32,6 +36,8 @@ const HeaderInRestoring = ({
 }: HeaderInRestoringProps) => {
   const { t } = useTranslation()
   const { theme } = useTheme()
+  const [isRestorePlanUpgradeModalOpen, setIsRestorePlanUpgradeModalOpen] = useState(false)
+  const { plan, enableBilling } = useProviderContext()
   const workflowStore = useWorkflowStore()
   const userProfile = useAppContextSelector(s => s.userProfile)
   const configsMap = useHooksStore(s => s.configsMap)
@@ -49,6 +55,7 @@ const HeaderInRestoring = ({
   const { mutateAsync: restoreWorkflow } = useRestoreWorkflow()
   const resetWorkflowVersionHistory = useResetWorkflowVersionHistory()
   const canRestore = !!currentVersion?.id && !!configsMap?.flowId && currentVersion.version !== WorkflowVersion.Draft
+  const canUseWorkflowVersionAction = !enableBilling || plan.type !== Plan.sandbox
   const canEmitCollaborationEvents = configsMap?.flowType === FlowType.appFlow
 
   const handleCancelRestore = useCallback(() => {
@@ -116,6 +123,11 @@ const HeaderInRestoring = ({
     if (!canRestore || !currentVersion)
       return
 
+    if (!canUseWorkflowVersionAction) {
+      setIsRestorePlanUpgradeModalOpen(true)
+      return
+    }
+
     setShowWorkflowVersionHistoryPanel(false)
     await emitRestoreIntent()
 
@@ -138,7 +150,7 @@ const HeaderInRestoring = ({
       resetWorkflowVersionHistory()
       onRestoreSettled?.()
     }
-  }, [canRestore, currentVersion, setShowWorkflowVersionHistoryPanel, emitRestoreIntent, restoreWorkflow, restoreVersionUrl, workflowStore, handleRefreshWorkflowDraft, t, deleteAllInspectVars, invalidAllLastRun, emitRestoreComplete, emitWorkflowUpdate, resetWorkflowVersionHistory, onRestoreSettled])
+  }, [canRestore, currentVersion, canUseWorkflowVersionAction, setShowWorkflowVersionHistoryPanel, emitRestoreIntent, restoreWorkflow, restoreVersionUrl, workflowStore, handleRefreshWorkflowDraft, t, deleteAllInspectVars, invalidAllLastRun, emitRestoreComplete, emitWorkflowUpdate, resetWorkflowVersionHistory, onRestoreSettled])
 
   return (
     <>
@@ -170,6 +182,14 @@ const HeaderInRestoring = ({
           </div>
         </Button>
       </div>
+      {isRestorePlanUpgradeModalOpen && (
+        <PlanUpgradeModal
+          show
+          onClose={() => setIsRestorePlanUpgradeModalOpen(false)}
+          title={t('upgrade.workflowRestore.title', { ns: 'billing' })!}
+          description={t('upgrade.workflowRestore.description', { ns: 'billing' })!}
+        />
+      )}
     </>
   )
 }
diff --git a/web/app/components/workflow/header/run-and-history.tsx b/web/app/components/workflow/header/run-and-history.tsx
index c2e9cfceb96..2b221f1ce07 100644
--- a/web/app/components/workflow/header/run-and-history.tsx
+++ b/web/app/components/workflow/header/run-and-history.tsx
@@ -1,33 +1,44 @@
 import type { ViewHistoryProps } from './view-history'
 import { cn } from '@langgenius/dify-ui/cn'
-import {
-  RiPlayLargeLine,
-} from '@remixicon/react'
 import { memo } from 'react'
 import { useTranslation } from 'react-i18next'
 import {
   useNodesReadOnly,
   useWorkflowStartRun,
 } from '../hooks'
+import { useHooksStore } from '../hooks-store'
 import Checklist from './checklist'
 import RunMode from './run-mode'
 import ViewHistory from './view-history'
 
-const PreviewMode = memo(() => {
+const PreviewMode = memo(({
+  disabled = false,
+}: {
+  disabled?: boolean
+}) => {
   const { t } = useTranslation()
   const { handleWorkflowStartRunInChatflow } = useWorkflowStartRun()
+  const canRun = useHooksStore(s => s.accessControl.canRun)
+  const isDisabled = disabled || !canRun
 
   return (
-    <div
+    <button
+      type="button"
+      disabled={isDisabled}
       className={cn(
         'flex h-7 items-center rounded-md px-2.5 text-[13px] font-medium text-components-button-secondary-accent-text',
-        'cursor-pointer hover:bg-state-accent-hover',
+        isDisabled
+          ? 'cursor-not-allowed opacity-50'
+          : 'cursor-pointer hover:bg-state-accent-hover',
       )}
-      onClick={() => handleWorkflowStartRunInChatflow()}
+      onClick={() => {
+        if (!isDisabled)
+          handleWorkflowStartRunInChatflow()
+      }}
     >
-      <RiPlayLargeLine className="mr-1 size-4" />
+      <span aria-hidden className="mr-1 i-ri-play-large-line size-4" />
       {t('common.debugAndPreview', { ns: 'workflow' })}
-    </div>
+    </button>
   )
 })
 
@@ -41,6 +52,7 @@ export type RunAndHistoryProps = {
     RunMode?: React.ComponentType<
       {
         text?: string
+        disabled?: boolean
       }
     >
   }
@@ -53,17 +65,18 @@ const RunAndHistory = ({
   components,
 }: RunAndHistoryProps) => {
   const { nodesReadOnly } = useNodesReadOnly()
+  const canRun = useHooksStore(s => s.accessControl.canRun)
   const { RunMode: CustomRunMode } = components || {}
 
   return (
     <div className="flex h-8 items-center rounded-lg border-[0.5px] border-components-button-secondary-border bg-components-button-secondary-bg px-0.5 shadow-xs">
       {
         showRunButton && (
-          CustomRunMode ? <CustomRunMode text={runButtonText} /> : <RunMode text={runButtonText} />
+          CustomRunMode ? <CustomRunMode text={runButtonText} disabled={!canRun} /> : <RunMode text={runButtonText} disabled={!canRun} />
         )
       }
       {
-        showPreviewButton && <PreviewMode />
+        showPreviewButton && <PreviewMode disabled={!canRun} />
       }
       <div className="mx-0.5 h-3.5 w-px bg-divider-regular"></div>
       <ViewHistory {...viewHistoryProps} />
diff --git a/web/app/components/workflow/header/run-mode.tsx b/web/app/components/workflow/header/run-mode.tsx
index 7b80025a48d..365481bea5f 100644
--- a/web/app/components/workflow/header/run-mode.tsx
+++ b/web/app/components/workflow/header/run-mode.tsx
@@ -7,8 +7,8 @@ import * as React from 'react'
 import { useCallback, useRef } from 'react'
 import { useTranslation } from 'react-i18next'
 import { trackEvent } from '@/app/components/base/amplitude'
-import { StopCircle } from '@/app/components/base/icons/src/vender/line/mediaAndDevices'
 import { useWorkflowRun, useWorkflowRunValidation, useWorkflowStartRun } from '@/app/components/workflow/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { ShortcutKbd } from '@/app/components/workflow/shortcuts/shortcut-kbd'
 import { useStore } from '@/app/components/workflow/store/workflow'
 import { WorkflowRunningStatus } from '@/app/components/workflow/types'
@@ -20,6 +20,7 @@ import TestRunMenu, { TriggerType } from './test-run-menu'
 
 type RunModeProps = {
   text?: string
+  disabled?: boolean
 }
 
 const isWorkflowStopEvent = (value: EventEmitterValue) =>
@@ -27,6 +28,7 @@ const isWorkflowStopEvent = (value: EventEmitterValue) =>
 
 const RunMode = ({
   text,
+  disabled = false,
 }: RunModeProps) => {
   const { t } = useTranslation()
   const {
@@ -40,6 +42,8 @@ const RunMode = ({
   const { warningNodes } = useWorkflowRunValidation()
   const workflowRunningData = useStore(s => s.workflowRunningData)
   const isListening = useStore(s => s.isListening)
+  const canRun = useHooksStore(s => s.accessControl.canRun)
+  const isRunDisabled = disabled || !canRun
 
   const status = workflowRunningData?.result.status
   const isRunning = status === WorkflowRunningStatus.Running || isListening
@@ -48,8 +52,11 @@ const RunMode = ({
   const testRunMenuRef = useRef<TestRunMenuRef>(null)
 
   const handleToggleTestRunMenu = useCallback(() => {
+    if (isRunDisabled)
+      return
+
     testRunMenuRef.current?.toggle()
-  }, [])
+  }, [isRunDisabled])
 
   useHotkey(TEST_RUN_MENU_HOTKEY, handleToggleTestRunMenu, {
     ignoreInputs: true,
@@ -60,6 +67,9 @@ const RunMode = ({
   }, [handleStopRun, workflowRunningData?.task_id])
 
   const handleTriggerSelect = useCallback((option: TriggerOption) => {
+    if (isRunDisabled)
+      return
+
     // Validate checklist before running any workflow
     let isValid: boolean = true
     warningNodes.forEach((node) => {
@@ -95,7 +105,7 @@ const RunMode = ({
         handleWorkflowRunAllTriggersInWorkflow(targetNodeIds)
       trackEvent('app_start_action_time', { action_type: 'all' })
     }
-  }, [warningNodes, t, handleWorkflowStartRunInWorkflow, handleWorkflowTriggerScheduleRunInWorkflow, handleWorkflowTriggerWebhookRunInWorkflow, handleWorkflowTriggerPluginRunInWorkflow, handleWorkflowRunAllTriggersInWorkflow])
+  }, [isRunDisabled, warningNodes, t, handleWorkflowStartRunInWorkflow, handleWorkflowTriggerScheduleRunInWorkflow, handleWorkflowTriggerWebhookRunInWorkflow, handleWorkflowTriggerPluginRunInWorkflow, handleWorkflowRunAllTriggersInWorkflow])
 
   const { eventEmitter } = useEventEmitterContextContext()
   eventEmitter?.useSubscription((v: EventEmitterValue) => {
@@ -106,49 +116,67 @@ const RunMode = ({
   return (
     <div className="flex items-center gap-x-px">
       {
-        isRunning
+        isRunDisabled
           ? (
               <button
                 type="button"
                 className={cn(
-                  'flex h-7 cursor-not-allowed items-center gap-x-1 rounded-l-md bg-state-accent-hover px-1.5 system-xs-medium text-text-accent',
+                  'flex h-7 cursor-not-allowed items-center gap-x-1 rounded-md px-1.5 system-xs-medium text-text-accent opacity-50',
                 )}
-                disabled={true}
+                disabled
+                style={{ userSelect: 'none' }}
               >
-                <span className="mr-1 i-ri-loader-2-line size-4 animate-spin" />
-                {isListening ? t('common.listening', { ns: 'workflow' }) : t('common.running', { ns: 'workflow' })}
+                <span aria-hidden className="mr-1 i-ri-play-large-line size-4" />
+                {text ?? t('common.run', { ns: 'workflow' })}
+                <ShortcutKbd hotkey={TEST_RUN_MENU_HOTKEY} textColor="secondary" />
               </button>
             )
           : (
-              <TestRunMenu
-                ref={testRunMenuRef}
-                options={dynamicOptions}
-                onSelect={handleTriggerSelect}
-              >
-                <button
-                  type="button"
-                  className={cn(
-                    'flex h-7 cursor-pointer items-center gap-x-1 rounded-md px-1.5 system-xs-medium text-text-accent hover:bg-state-accent-hover',
-                  )}
-                  style={{ userSelect: 'none' }}
-                >
-                  <span aria-hidden className="mr-1 i-ri-play-large-line size-4" />
-                  {text ?? t('common.run', { ns: 'workflow' })}
-                  <ShortcutKbd hotkey={TEST_RUN_MENU_HOTKEY} textColor="secondary" />
-                </button>
-              </TestRunMenu>
+              isRunning
+                ? (
+                    <button
+                      type="button"
+                      className={cn(
+                        'flex h-7 cursor-not-allowed items-center gap-x-1 rounded-l-md bg-state-accent-hover px-1.5 system-xs-medium text-text-accent',
+                      )}
+                      disabled={true}
+                    >
+                      <span className="mr-1 i-ri-loader-2-line size-4 animate-spin" />
+                      {isListening ? t('common.listening', { ns: 'workflow' }) : t('common.running', { ns: 'workflow' })}
+                    </button>
+                  )
+                : (
+                    <TestRunMenu
+                      ref={testRunMenuRef}
+                      options={dynamicOptions}
+                      onSelect={handleTriggerSelect}
+                    >
+                      <button
+                        type="button"
+                        className={cn(
+                          'flex h-7 cursor-pointer items-center gap-x-1 rounded-md px-1.5 system-xs-medium text-text-accent hover:bg-state-accent-hover',
+                        )}
+                        style={{ userSelect: 'none' }}
+                      >
+                        <span aria-hidden className="mr-1 i-ri-play-large-line size-4" />
+                        {text ?? t('common.run', { ns: 'workflow' })}
+                        <ShortcutKbd hotkey={TEST_RUN_MENU_HOTKEY} textColor="secondary" />
+                      </button>
+                    </TestRunMenu>
+                  )
             )
       }
       {
-        isRunning && (
+        isRunning && !isRunDisabled && (
           <button
             type="button"
+            aria-label={t('debug.variableInspect.trigger.stop', { ns: 'workflow' })}
             className={cn(
               'flex size-7 items-center justify-center rounded-r-md bg-state-accent-active',
             )}
             onClick={handleStop}
           >
-            <StopCircle className="size-4 text-text-accent" />
+            <span aria-hidden className="i-ri-stop-circle-line size-4 text-text-accent" />
           </button>
         )
       }
diff --git a/web/app/components/workflow/hooks-store/provider.tsx b/web/app/components/workflow/hooks-store/provider.tsx
index 365e97eb14e..48288ebd56a 100644
--- a/web/app/components/workflow/hooks-store/provider.tsx
+++ b/web/app/components/workflow/hooks-store/provider.tsx
@@ -18,12 +18,18 @@ export const HooksStoreContextProvider = ({ children, ...restProps }: HooksStore
   const storeRef = useRef<HooksStore | undefined>(undefined)
   const d3Selection = useStore(s => s.d3Selection)
   const d3Zoom = useStore(s => s.d3Zoom)
+  const { accessControl } = restProps
 
   useEffect(() => {
     if (storeRef.current && d3Selection && d3Zoom)
       storeRef.current.getState().refreshAll(restProps)
   }, [d3Selection, d3Zoom])
 
+  useEffect(() => {
+    if (storeRef.current && accessControl)
+      storeRef.current.getState().refreshAll({ accessControl })
+  }, [accessControl])
+
   if (!storeRef.current)
     storeRef.current = createHooksStore(restProps)
 
diff --git a/web/app/components/workflow/hooks-store/store.ts b/web/app/components/workflow/hooks-store/store.ts
index c01e42dc4a1..d487ed27f0f 100644
--- a/web/app/components/workflow/hooks-store/store.ts
+++ b/web/app/components/workflow/hooks-store/store.ts
@@ -27,6 +27,23 @@ export type SyncDraftCallback = {
   onError?: () => void
   onSettled?: () => void
 }
+
+export type WorkflowAccessControl = {
+  canEdit: boolean
+  canComment: boolean
+  canRun: boolean
+  canImportExportDSL: boolean
+  canReleaseAndVersion: boolean
+}
+
+export const fullWorkflowAccessControl: WorkflowAccessControl = {
+  canEdit: true,
+  canComment: true,
+  canRun: true,
+  canImportExportDSL: true,
+  canReleaseAndVersion: true,
+}
+
 type CommonHooksFnMap = {
   doSyncWorkflowDraft: (
     notRefreshWhenSyncError?: boolean,
@@ -65,6 +82,7 @@ type CommonHooksFnMap = {
   invalidateSysVarValues: () => void
   resetConversationVar: (varId: string) => Promise<void>
   invalidateConversationVarValues: () => void
+  accessControl: WorkflowAccessControl
   configsMap?: {
     flowId: string
     flowType: FlowType
@@ -117,6 +135,7 @@ export const createHooksStore = ({
   resetConversationVar = async () => noop(),
   invalidateConversationVarValues = noop,
   configsMap,
+  accessControl = fullWorkflowAccessControl,
 }: Partial<Shape>) => {
   return createStore<Shape>(set => ({
     refreshAll: props => set(state => ({ ...state, ...props })),
@@ -155,6 +174,7 @@ export const createHooksStore = ({
     resetConversationVar,
     invalidateConversationVarValues,
     configsMap,
+    accessControl,
   }))
 }
 
diff --git a/web/app/components/workflow/hooks/__tests__/use-node-plugin-installation.spec.ts b/web/app/components/workflow/hooks/__tests__/use-node-plugin-installation.spec.ts
index 4577055098c..57652c54cce 100644
--- a/web/app/components/workflow/hooks/__tests__/use-node-plugin-installation.spec.ts
+++ b/web/app/components/workflow/hooks/__tests__/use-node-plugin-installation.spec.ts
@@ -13,6 +13,13 @@ const mockInvalidToolsByType = vi.fn()
 const mockTriggerPlugins = vi.fn()
 const mockInvalidateTriggers = vi.fn()
 const mockInvalidDataSourceList = vi.fn()
+let mockWorkspacePermissionKeys = ['plugin.install']
+
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
 
 vi.mock('@/service/use-tools', () => ({
   useAllBuiltInTools: (enabled: boolean) => mockBuiltInTools(enabled),
@@ -86,6 +93,7 @@ const matchedDataSource = {
 describe('useNodePluginInstallation', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys = ['plugin.install']
     mockBuiltInTools.mockReturnValue({ data: undefined, isLoading: false })
     mockCustomTools.mockReturnValue({ data: undefined, isLoading: false })
     mockWorkflowTools.mockReturnValue({ data: undefined, isLoading: false })
@@ -169,6 +177,17 @@ describe('useNodePluginInstallation', () => {
     expect(result.current.shouldDim).toBe(false)
   })
 
+  it('should not allow installing missing tool plugins without plugin install permission', () => {
+    mockWorkspacePermissionKeys = []
+    mockBuiltInTools.mockReturnValue({ data: [], isLoading: false })
+
+    const { result } = renderWorkflowHook(() => useNodePluginInstallation(makeToolNode()))
+
+    expect(result.current.isMissing).toBe(true)
+    expect(result.current.uniqueIdentifier).toBe('plugin-search@1.0.0')
+    expect(result.current.canInstall).toBe(false)
+  })
+
   it('should flag missing trigger plugins and invalidate trigger data after installation', () => {
     mockTriggerPlugins.mockReturnValue({ data: [matchedTriggerProvider], isLoading: false })
 
diff --git a/web/app/components/workflow/hooks/__tests__/use-nodes-interactions.spec.ts b/web/app/components/workflow/hooks/__tests__/use-nodes-interactions.spec.ts
index 220b73ea7ce..f0ce89a7018 100644
--- a/web/app/components/workflow/hooks/__tests__/use-nodes-interactions.spec.ts
+++ b/web/app/components/workflow/hooks/__tests__/use-nodes-interactions.spec.ts
@@ -20,6 +20,7 @@ const mockHandleNodeLoopChildrenCopy = vi.hoisted(() => vi.fn(() => ({
   copyChildren: [],
   newIdMapping: {},
 })))
+const mockCreateInlineAgentBinding = vi.hoisted(() => vi.fn())
 const runtimeNodesMetaDataMap = vi.hoisted(() => ({
   value: {} as Record<string, unknown>,
 }))
@@ -78,6 +79,12 @@ vi.mock('../use-inspect-vars-crud', () => ({
   }),
 }))
 
+vi.mock('../../nodes/agent-v2/hooks', () => ({
+  useCreateInlineAgentBinding: () => ({
+    createInlineAgentBinding: mockCreateInlineAgentBinding,
+  }),
+}))
+
 vi.mock('../../nodes/iteration/use-interactions', () => ({
   useNodeIterationInteractions: () => ({
     handleNodeIterationChildDrag: () => ({ restrictPosition: {} }),
@@ -107,6 +114,17 @@ describe('useNodesInteractions', () => {
     resetReactFlowMockState()
     runtimeState.nodesReadOnly = false
     runtimeState.workflowReadOnly = false
+    mockCreateInlineAgentBinding.mockImplementation((_nodeId: string, options?: { onSuccess?: (binding: {
+      binding_type: 'inline_agent'
+      agent_id: string
+      current_snapshot_id: string
+    }) => void }) => {
+      options?.onSuccess?.({
+        binding_type: 'inline_agent',
+        agent_id: 'inline-agent-1',
+        current_snapshot_id: 'inline-snapshot-1',
+      })
+    })
     currentNodes = [
       createNode({
         id: 'node-1',
@@ -452,6 +470,84 @@ describe('useNodesInteractions', () => {
     expect(rfState.setEdges).not.toHaveBeenCalled()
   })
 
+  it('creates an inline agent binding before syncing an added Agent v2 node', () => {
+    currentNodes = [
+      createNode({
+        id: 'node-1',
+        width: 100,
+        data: {
+          type: BlockEnum.Code,
+          title: 'Code',
+          desc: '',
+        },
+      }),
+    ]
+    rfState.nodes = currentNodes as unknown as typeof rfState.nodes
+    rfState.edges = []
+    rfState.setNodes.mockImplementation((nextNodes) => {
+      rfState.nodes = nextNodes
+    })
+    rfState.setEdges.mockImplementation((nextEdges) => {
+      rfState.edges = nextEdges
+    })
+    runtimeNodesMetaDataMap.value = {
+      [BlockEnum.AgentV2]: {
+        defaultValue: {
+          type: BlockEnum.AgentV2,
+          title: 'Agent',
+          desc: '',
+          agent_node_kind: 'dify_agent',
+          version: '2',
+        },
+        metaData: {
+          isSingleton: false,
+        },
+      },
+    }
+
+    const { result, store } = renderWorkflowHook(() => useNodesInteractions(), {
+      historyStore: {
+        nodes: currentNodes,
+        edges: [],
+      },
+    })
+
+    act(() => {
+      result.current.handleNodeAdd(
+        {
+          nodeType: BlockEnum.AgentV2,
+          pluginDefaultValue: {
+            agent_binding: {
+              binding_type: 'inline_agent',
+            },
+            agent_node_kind: 'dify_agent',
+            version: '2',
+          },
+        },
+        { prevNodeId: 'node-1' },
+      )
+    })
+
+    const agentNode = rfState.nodes.find(node => node.data.type === BlockEnum.AgentV2)
+    const firstSetNodesPayload = rfState.setNodes.mock.calls[0]?.[0]
+    const pendingAgentNode = firstSetNodesPayload.find((node: Node) => node.data.type === BlockEnum.AgentV2)
+    const finalSetNodesPayload = rfState.setNodes.mock.calls.at(-1)?.[0]
+    const finalAgentNode = finalSetNodesPayload.find((node: Node) => node.data.type === BlockEnum.AgentV2)
+
+    expect(pendingAgentNode?.data._isTempNode).toBe(true)
+    expect(agentNode?.data.agent_binding).toEqual({
+      binding_type: 'inline_agent',
+      agent_id: 'inline-agent-1',
+      current_snapshot_id: 'inline-snapshot-1',
+    })
+    expect(finalAgentNode?.data._isTempNode).toBeUndefined()
+    expect(mockCreateInlineAgentBinding).toHaveBeenCalledWith(agentNode?.id, expect.objectContaining({
+      onSuccess: expect.any(Function),
+    }))
+    expect(store.getState().openInlineAgentPanelNodeId).toBe(agentNode?.id)
+    expect(mockHandleSyncWorkflowDraft).toHaveBeenCalledWith(true, true)
+  })
+
   it('cancels selection state with collaborative nodes snapshot', () => {
     currentNodes = [
       createNode({
diff --git a/web/app/components/workflow/hooks/__tests__/use-workflow-panel-interactions.spec.tsx b/web/app/components/workflow/hooks/__tests__/use-workflow-panel-interactions.spec.tsx
index 9ff61f70f92..30ad040f050 100644
--- a/web/app/components/workflow/hooks/__tests__/use-workflow-panel-interactions.spec.tsx
+++ b/web/app/components/workflow/hooks/__tests__/use-workflow-panel-interactions.spec.tsx
@@ -1,6 +1,6 @@
 import { act } from '@testing-library/react'
 import { renderWorkflowHook } from '../../__tests__/workflow-test-env'
-import { ControlMode } from '../../types'
+import { ControlMode, WorkflowRunningStatus } from '../../types'
 import {
   useWorkflowInteractions,
   useWorkflowMoveMode,
@@ -107,4 +107,64 @@ describe('useWorkflowMoveMode', () => {
     expect(store.getState().controlMode).toBe(ControlMode.Pointer)
     expect(mockHandleSelectionCancel).not.toHaveBeenCalled()
   })
+
+  it('switches to comment mode when nodes are read-only', () => {
+    runtimeState.nodesReadOnly = true
+    const { result, store } = renderWorkflowHook(() => useWorkflowMoveMode(), {
+      initialStoreState: {
+        controlMode: ControlMode.Pointer,
+      },
+    })
+
+    act(() => {
+      result.current.handleModeComment()
+    })
+
+    expect(store.getState().controlMode).toBe(ControlMode.Comment)
+    expect(mockHandleSelectionCancel).toHaveBeenCalledTimes(1)
+    expect(result.current.canUseCommentMode).toBe(true)
+  })
+
+  it('does not switch to comment mode while workflow operation is blocked', () => {
+    const { result, store } = renderWorkflowHook(() => useWorkflowMoveMode(), {
+      initialStoreState: {
+        controlMode: ControlMode.Pointer,
+        workflowRunningData: {
+          result: { status: WorkflowRunningStatus.Running },
+        } as never,
+      },
+    })
+
+    act(() => {
+      result.current.handleModeComment()
+    })
+
+    expect(result.current.canUseCommentMode).toBe(false)
+    expect(store.getState().controlMode).toBe(ControlMode.Pointer)
+    expect(mockHandleSelectionCancel).not.toHaveBeenCalled()
+  })
+
+  it('does not switch to comment mode when commenting is denied', () => {
+    const { result, store } = renderWorkflowHook(() => useWorkflowMoveMode(), {
+      initialStoreState: {
+        controlMode: ControlMode.Pointer,
+      },
+      hooksStoreProps: {
+        accessControl: {
+          canEdit: true,
+          canComment: false,
+          canRun: true,
+          canImportExportDSL: true,
+          canReleaseAndVersion: true,
+        },
+      },
+    })
+
+    act(() => {
+      result.current.handleModeComment()
+    })
+
+    expect(store.getState().controlMode).toBe(ControlMode.Pointer)
+    expect(mockHandleSelectionCancel).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/app/components/workflow/hooks/__tests__/use-workflow.spec.ts b/web/app/components/workflow/hooks/__tests__/use-workflow.spec.ts
index 2ae8bec6aea..99c1a0d57b3 100644
--- a/web/app/components/workflow/hooks/__tests__/use-workflow.spec.ts
+++ b/web/app/components/workflow/hooks/__tests__/use-workflow.spec.ts
@@ -1,12 +1,16 @@
+import type { NodeDefault } from '../../types'
 import { act, renderHook } from '@testing-library/react'
 import { createNode } from '../../__tests__/fixtures'
 import { baseRunningData, renderWorkflowFlowHook, renderWorkflowHook } from '../../__tests__/workflow-test-env'
-import { WorkflowRunningStatus } from '../../types'
+import { BlockClassificationEnum } from '../../block-selector/types'
+import { BlockEnum, WorkflowRunningStatus } from '../../types'
 import {
   useIsChatMode,
   useIsNodeInIteration,
   useIsNodeInLoop,
   useNodesReadOnly,
+  useNodesReadOnlyByCanEdit,
+  useWorkflow,
   useWorkflowReadOnly,
 } from '../use-workflow'
 
@@ -20,6 +24,20 @@ beforeEach(() => {
   mockAppMode = 'workflow'
 })
 
+function createNodeDefault(type: BlockEnum): NodeDefault {
+  return {
+    metaData: {
+      classification: BlockClassificationEnum.Default,
+      sort: 0,
+      type,
+      title: type,
+      author: 'test',
+    },
+    defaultValue: {},
+    checkValid: () => ({ isValid: true }),
+  }
+}
+
 // ---------------------------------------------------------------------------
 // useIsChatMode
 // ---------------------------------------------------------------------------
@@ -108,8 +126,41 @@ describe('useWorkflowReadOnly', () => {
 // ---------------------------------------------------------------------------
 
 describe('useNodesReadOnly', () => {
+  it('should use the default HooksStoreContext from the workflow test helper', () => {
+    const { result } = renderWorkflowHook(() => useNodesReadOnly())
+    expect(result.current.nodesReadOnly).toBe(false)
+    expect(result.current.getNodesReadOnly()).toBe(false)
+  })
+
+  it('should return true when explicit edit permission is denied before HooksStoreContext is available', () => {
+    const { result } = renderWorkflowHook(() => useNodesReadOnlyByCanEdit(false))
+    expect(result.current.nodesReadOnly).toBe(true)
+    expect(result.current.getNodesReadOnly()).toBe(true)
+  })
+
+  it('should return false when edit permission is allowed by HooksStoreContext', () => {
+    const { result } = renderWorkflowHook(() => useNodesReadOnly(), {
+      hooksStoreProps: {},
+    })
+    expect(result.current.nodesReadOnly).toBe(false)
+  })
+
+  it('should expose getNodesReadOnly that reads from store state', () => {
+    const { result, store } = renderWorkflowHook(() => useNodesReadOnly(), {
+      hooksStoreProps: {},
+    })
+
+    expect(result.current.getNodesReadOnly()).toBe(false)
+
+    act(() => {
+      store.setState({ isRestoring: true })
+    })
+    expect(result.current.getNodesReadOnly()).toBe(true)
+  })
+
   it('should return true when status is Running', () => {
     const { result } = renderWorkflowHook(() => useNodesReadOnly(), {
+      hooksStoreProps: {},
       initialStoreState: {
         workflowRunningData: baseRunningData(),
       },
@@ -119,6 +170,7 @@ describe('useNodesReadOnly', () => {
 
   it('should return true when status is Paused', () => {
     const { result } = renderWorkflowHook(() => useNodesReadOnly(), {
+      hooksStoreProps: {},
       initialStoreState: {
         workflowRunningData: baseRunningData({ result: { status: WorkflowRunningStatus.Paused } }),
       },
@@ -128,6 +180,7 @@ describe('useNodesReadOnly', () => {
 
   it('should return true when historyWorkflowData is present', () => {
     const { result } = renderWorkflowHook(() => useNodesReadOnly(), {
+      hooksStoreProps: {},
       initialStoreState: {
         historyWorkflowData: { id: 'run-1', status: 'succeeded' },
       },
@@ -137,6 +190,7 @@ describe('useNodesReadOnly', () => {
 
   it('should return true when isRestoring is true', () => {
     const { result } = renderWorkflowHook(() => useNodesReadOnly(), {
+      hooksStoreProps: {},
       initialStoreState: { isRestoring: true },
     })
     expect(result.current.nodesReadOnly).toBe(true)
@@ -153,22 +207,73 @@ describe('useNodesReadOnly', () => {
   })
 
   it('should return false when none of the conditions are met', () => {
-    const { result } = renderWorkflowHook(() => useNodesReadOnly())
+    const { result } = renderWorkflowHook(() => useNodesReadOnly(), {
+      hooksStoreProps: {},
+    })
     expect(result.current.nodesReadOnly).toBe(false)
   })
 
-  it('should expose getNodesReadOnly that reads from store state', () => {
-    const { result, store } = renderWorkflowHook(() => useNodesReadOnly())
-
-    expect(result.current.getNodesReadOnly()).toBe(false)
-
-    act(() => {
-      store.setState({ isRestoring: true })
+  it('should return true when edit permission is denied by HooksStoreContext', () => {
+    const { result } = renderWorkflowHook(() => useNodesReadOnly(), {
+      hooksStoreProps: {
+        accessControl: {
+          canEdit: false,
+          canComment: true,
+          canRun: true,
+          canImportExportDSL: true,
+          canReleaseAndVersion: true,
+        },
+      },
     })
+    expect(result.current.nodesReadOnly).toBe(true)
     expect(result.current.getNodesReadOnly()).toBe(true)
   })
 })
 
+// ---------------------------------------------------------------------------
+// useWorkflow connection validation
+// ---------------------------------------------------------------------------
+
+describe('useWorkflow connection validation', () => {
+  it('should validate Agent V2 graph nodes against the Agent V2 catalog type', () => {
+    const agentNode = createNode({
+      id: 'agent-v2',
+      data: {
+        type: BlockEnum.Agent,
+        title: 'Agent',
+        desc: '',
+        agent_node_kind: 'dify_agent',
+        version: '2',
+      },
+    })
+    const codeNode = createNode({
+      id: 'code',
+      data: {
+        type: BlockEnum.Code,
+        title: 'Code',
+        desc: '',
+      },
+    })
+
+    const { result } = renderWorkflowFlowHook(() => useWorkflow(), {
+      nodes: [agentNode, codeNode],
+      edges: [],
+      hooksStoreProps: {
+        availableNodesMetaData: {
+          nodes: [createNodeDefault(BlockEnum.AgentV2), createNodeDefault(BlockEnum.Code)],
+        },
+      },
+    })
+
+    expect(result.current.isValidConnection({
+      source: 'agent-v2',
+      sourceHandle: 'source',
+      target: 'code',
+      targetHandle: 'target',
+    })).toBe(true)
+  })
+})
+
 // ---------------------------------------------------------------------------
 // useIsNodeInIteration
 // ---------------------------------------------------------------------------
diff --git a/web/app/components/workflow/hooks/use-checklist.ts b/web/app/components/workflow/hooks/use-checklist.ts
index 2eb73ae2a2c..299fa4794b0 100644
--- a/web/app/components/workflow/hooks/use-checklist.ts
+++ b/web/app/components/workflow/hooks/use-checklist.ts
@@ -56,6 +56,7 @@ import {
 } from '../hooks'
 import { useHooksStore } from '../hooks-store/store'
 import { getNodeUsedVars, isSpecialVar } from '../nodes/_base/components/variable/utils'
+import { isAgentV2NodeData } from '../nodes/agent-v2/types'
 import { IndexMethodEnum } from '../nodes/knowledge-base/types'
 import { getLLMModelIssue, isLLMModelProviderInstalled, LLMModelIssueCode } from '../nodes/llm/utils'
 import {
@@ -65,6 +66,7 @@ import {
 import { BlockEnum } from '../types'
 import {
   getDataSourceCheckParams,
+  getNodeCatalogType,
   getToolCheckParams,
   getValidTreeNodes,
 } from '../utils'
@@ -249,7 +251,7 @@ export const useChecklist = (nodes: Node[], edges: Edge[], options?: { flowType?
         moreDataForCheckValid = getTriggerCheckParams(node!.data as PluginTriggerNodeType, triggerPlugins, language)
 
       const toolIcon = getToolIcon(node!.data)
-      if (node!.data.type === BlockEnum.Agent) {
+      if (node!.data.type === BlockEnum.Agent && !isAgentV2NodeData(node!.data)) {
         const data = node!.data as AgentNodeType
         const isReadyForCheckValid = !!strategyProviders
         const provider = strategyProviders?.find(provider => provider.declaration.identity.name === data.agent_strategy_provider_name)
@@ -267,7 +269,7 @@ export const useChecklist = (nodes: Node[], edges: Edge[], options?: { flowType?
 
       if (node!.type === CUSTOM_NODE) {
         const checkData = getCheckData(node!.data)
-        const validator = nodesExtraData?.[node!.data.type as BlockEnum]?.checkValid
+        const validator = nodesExtraData?.[getNodeCatalogType(node!.data)]?.checkValid
         const isPluginMissing = isNodePluginMissing(node!.data, { builtInTools: buildInTools, customTools, workflowTools, mcpTools, triggerPlugins, dataSourceList })
 
         const errorMessages: string[] = []
@@ -522,7 +524,7 @@ export const useChecklistBeforePublish = () => {
       if (node!.data.type === BlockEnum.DataSource)
         moreDataForCheckValid = getDataSourceCheckParams(node!.data as DataSourceNodeType, dataSourceList || [], language)
 
-      if (node!.data.type === BlockEnum.Agent) {
+      if (node!.data.type === BlockEnum.Agent && !isAgentV2NodeData(node!.data)) {
         const data = node!.data as AgentNodeType
         const isReadyForCheckValid = !!strategyProviders
         const provider = strategyProviders?.find(provider => provider.declaration.identity.name === data.agent_strategy_provider_name)
@@ -551,7 +553,7 @@ export const useChecklistBeforePublish = () => {
       }
 
       const checkData = getCheckData(node!.data, datasets, embeddingProviderModelMap)
-      const { errorMessage } = nodesExtraData![node!.data.type as BlockEnum].checkValid(checkData, t, withFlowType(moreDataForCheckValid, flowType))
+      const { errorMessage } = nodesExtraData![getNodeCatalogType(node!.data)].checkValid(checkData, t, withFlowType(moreDataForCheckValid, flowType))
 
       if (errorMessage) {
         toast.error(`[${node!.data.title}] ${errorMessage}`)
diff --git a/web/app/components/workflow/hooks/use-node-plugin-installation.ts b/web/app/components/workflow/hooks/use-node-plugin-installation.ts
index 55f8982efe3..1ac2e496b30 100644
--- a/web/app/components/workflow/hooks/use-node-plugin-installation.ts
+++ b/web/app/components/workflow/hooks/use-node-plugin-installation.ts
@@ -3,6 +3,7 @@ import type { ToolNodeType } from '../nodes/tool/types'
 import type { PluginTriggerNodeType } from '../nodes/trigger-plugin/types'
 import type { CommonNodeType } from '../types'
 import { useCallback, useMemo } from 'react'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import { CollectionType } from '@/app/components/tools/types'
 import { useInvalidDataSourceList } from '@/service/use-pipeline'
 import {
@@ -42,7 +43,7 @@ const NOOP_INSTALLATION: InstallationState = {
   shouldDim: false,
 }
 
-const useToolInstallation = (data: ToolNodeType, enabled: boolean): InstallationState => {
+const useToolInstallation = (data: ToolNodeType, enabled: boolean, canInstallPlugin: boolean): InstallationState => {
   const isBuiltIn = enabled && data.provider_type === CollectionType.builtIn
   const isCustom = enabled && data.provider_type === CollectionType.custom
   const isWorkflow = enabled && data.provider_type === CollectionType.workflow
@@ -108,7 +109,7 @@ const useToolInstallation = (data: ToolNodeType, enabled: boolean): Installation
   }, [collection, plugin_id, provider_id, provider_name])
 
   const uniqueIdentifier = data.plugin_unique_identifier || data.plugin_id || data.provider_id
-  const canInstall = Boolean(data.plugin_unique_identifier)
+  const canInstall = Boolean(data.plugin_unique_identifier) && canInstallPlugin
 
   const onInstallSuccess = useCallback(() => {
     if (invalidateTools)
@@ -127,7 +128,7 @@ const useToolInstallation = (data: ToolNodeType, enabled: boolean): Installation
   }
 }
 
-const useTriggerInstallation = (data: PluginTriggerNodeType, enabled: boolean): InstallationState => {
+const useTriggerInstallation = (data: PluginTriggerNodeType, enabled: boolean, canInstallPlugin: boolean): InstallationState => {
   const triggerPluginsQuery = useAllTriggerPlugins(enabled)
   const invalidateTriggers = useInvalidateAllTriggerPlugins()
 
@@ -143,7 +144,7 @@ const useTriggerInstallation = (data: PluginTriggerNodeType, enabled: boolean):
   }, [plugin_id, provider_id, provider_name, triggerProviders])
 
   const uniqueIdentifier = data.plugin_unique_identifier || data.plugin_id || data.provider_id
-  const canInstall = Boolean(data.plugin_unique_identifier)
+  const canInstall = Boolean(data.plugin_unique_identifier) && canInstallPlugin
 
   const onInstallSuccess = useCallback(() => {
     invalidateTriggers()
@@ -161,7 +162,7 @@ const useTriggerInstallation = (data: PluginTriggerNodeType, enabled: boolean):
   }
 }
 
-const useDataSourceInstallation = (data: DataSourceNodeType, _enabled: boolean): InstallationState => {
+const useDataSourceInstallation = (data: DataSourceNodeType, _enabled: boolean, canInstallPlugin: boolean): InstallationState => {
   const dataSourceList = useStore(s => s.dataSourceList)
   const invalidateDataSourceList = useInvalidDataSourceList()
 
@@ -174,7 +175,7 @@ const useDataSourceInstallation = (data: DataSourceNodeType, _enabled: boolean):
   }, [dataSourceList, plugin_id, plugin_unique_identifier, provider_name])
 
   const uniqueIdentifier = data.plugin_unique_identifier || data.plugin_id
-  const canInstall = Boolean(data.plugin_unique_identifier)
+  const canInstall = Boolean(data.plugin_unique_identifier) && canInstallPlugin
 
   const onInstallSuccess = useCallback(() => {
     invalidateDataSourceList()
@@ -198,10 +199,11 @@ export const useNodePluginInstallation = (data: CommonNodeType): InstallationSta
   const isTool = data.type === BlockEnum.Tool
   const isTrigger = data.type === BlockEnum.TriggerPlugin
   const isDataSource = data.type === BlockEnum.DataSource
+  const { canInstallPlugin } = useWorkspacePluginInstallPermission()
 
-  const toolInstallation = useToolInstallation(data as ToolNodeType, isTool)
-  const triggerInstallation = useTriggerInstallation(data as PluginTriggerNodeType, isTrigger)
-  const dataSourceInstallation = useDataSourceInstallation(data as DataSourceNodeType, isDataSource)
+  const toolInstallation = useToolInstallation(data as ToolNodeType, isTool, canInstallPlugin)
+  const triggerInstallation = useTriggerInstallation(data as PluginTriggerNodeType, isTrigger, canInstallPlugin)
+  const dataSourceInstallation = useDataSourceInstallation(data as DataSourceNodeType, isDataSource, canInstallPlugin)
 
   if (isTool)
     return toolInstallation
diff --git a/web/app/components/workflow/hooks/use-nodes-interactions.ts b/web/app/components/workflow/hooks/use-nodes-interactions.ts
index 5b8dc1a14e4..538c270692c 100644
--- a/web/app/components/workflow/hooks/use-nodes-interactions.ts
+++ b/web/app/components/workflow/hooks/use-nodes-interactions.ts
@@ -7,7 +7,7 @@ import type {
   OnConnectStart,
   ResizeParamsWithDirection,
 } from 'reactflow'
-import type { PluginDefaultValue } from '../block-selector/types'
+import type { BlockDefaultValue } from '../block-selector/types'
 import type { IterationNodeType } from '../nodes/iteration/types'
 import type { LoopNodeType } from '../nodes/loop/types'
 import type { VariableAssignerNodeType } from '../nodes/variable-assigner/types'
@@ -36,6 +36,8 @@ import {
   Y_OFFSET,
 } from '../constants'
 import { getNodeUsedVars } from '../nodes/_base/components/variable/utils'
+import { useCreateInlineAgentBinding } from '../nodes/agent-v2/hooks'
+import { isAgentV2NodeData, needsInlineAgentBindingCreation } from '../nodes/agent-v2/types'
 import { CUSTOM_ITERATION_START_NODE } from '../nodes/iteration-start/constants'
 import { useNodeIterationInteractions } from '../nodes/iteration/use-interactions'
 import { CUSTOM_LOOP_START_NODE } from '../nodes/loop-start/constants'
@@ -48,8 +50,10 @@ import {
   generateNewNode,
   genNewNodeTitleFromOld,
   getNestedNodePosition,
+  getNodeCatalogType,
   getNodeCustomTypeByNodeDataType,
   getNodesConnectedSourceOrTargetHandleIdsMap,
+  getNodesWithSameDefaultDataType,
   getTopLeftNodePosition,
   isClipboardEdgeStructurallyValid,
   isClipboardNodeStructurallyValid,
@@ -84,6 +88,16 @@ const ENTRY_NODE_WRAPPER_OFFSET = {
   y: 21, // Adjusted based on visual testing feedback
 } as const
 
+function needsPendingInlineAgentBinding(defaultValue?: BlockDefaultValue) {
+  if (!defaultValue || !('agent_binding' in defaultValue))
+    return false
+
+  const binding = defaultValue.agent_binding
+
+  return binding.binding_type === 'inline_agent'
+    && (!binding.agent_id || !binding.current_snapshot_id)
+}
+
 const pruneClipboardNodesWithFilteredAncestors = (
   sourceNodes: Node[],
   candidateNodes: Node[],
@@ -174,6 +188,31 @@ export const useNodesInteractions = () => {
     redo,
   } = useWorkflowHistory()
   const autoGenerateWebhookUrl = useAutoGenerateWebhookUrl()
+  const { createInlineAgentBinding } = useCreateInlineAgentBinding()
+
+  const createInlineAgentBindingForNode = useCallback((nodeId: string, options?: {
+    onError?: () => void
+  }) => {
+    createInlineAgentBinding(nodeId, {
+      onError: () => {
+        options?.onError?.()
+      },
+      onSuccess: (binding) => {
+        const { nodes, setNodes } = collaborativeWorkflow.getState()
+        setNodes(produce(nodes, (draft) => {
+          const node = draft.find(node => node.id === nodeId)
+          if (node) {
+            if (isAgentV2NodeData(node.data) && needsInlineAgentBindingCreation(node.data))
+              node.data.agent_binding = binding
+            node.data._openInlineAgentPanel = true
+            delete node.data._isTempNode
+          }
+        }))
+        workflowStore.getState().setOpenInlineAgentPanelNodeId(nodeId)
+        handleSyncWorkflowDraft(true, true)
+      },
+    })
+  }, [collaborativeWorkflow, createInlineAgentBinding, handleSyncWorkflowDraft, workflowStore])
 
   const handleNodeDragStart = useCallback<NodeDragHandler>(
     (_, node) => {
@@ -233,12 +272,12 @@ export const useNodesInteractions = () => {
         const currentNode = draft.find(n => n.id === node.id)!
 
         // Check if current dragging node is an entry node
-        const isCurrentEntryNode = isTriggerNode(node.data.type as any) || node.data.type === BlockEnum.Start
+        const isCurrentEntryNode = isTriggerNode(node.data.type as BlockEnum) || node.data.type === BlockEnum.Start
 
         // X-axis alignment with offset consideration
         if (showVerticalHelpLineNodesLength > 0) {
           const targetNode = showVerticalHelpLineNodes[0]
-          const isTargetEntryNode = isTriggerNode(targetNode!.data.type as any) || targetNode!.data.type === BlockEnum.Start
+          const isTargetEntryNode = isTriggerNode(targetNode!.data.type as BlockEnum) || targetNode!.data.type === BlockEnum.Start
 
           // Calculate the wrapper position needed to align the inner nodes
           // Target inner position = target.position + target.offset
@@ -262,7 +301,7 @@ export const useNodesInteractions = () => {
         // Y-axis alignment with offset consideration
         if (showHorizontalHelpLineNodesLength > 0) {
           const targetNode = showHorizontalHelpLineNodes[0]
-          const isTargetEntryNode = isTriggerNode(targetNode!.data.type as any) || targetNode!.data.type === BlockEnum.Start
+          const isTargetEntryNode = isTriggerNode(targetNode!.data.type as BlockEnum) || targetNode!.data.type === BlockEnum.Start
 
           const targetOffset = isTargetEntryNode ? ENTRY_NODE_WRAPPER_OFFSET.y : 0
           const currentOffset = isCurrentEntryNode ? ENTRY_NODE_WRAPPER_OFFSET.y : 0
@@ -619,7 +658,7 @@ export const useNodesInteractions = () => {
   )
 
   const handleNodeConnectEnd = useCallback<OnConnectEnd>(
-    (e: any) => {
+    (e) => {
       if (getNodesReadOnly())
         return
 
@@ -645,7 +684,8 @@ export const useNodesInteractions = () => {
         if (fromNode.parentId !== toNode.parentId)
           return
 
-        const { x, y } = screenToFlowPosition({ x: e.x, y: e.y })
+        const pointer = e as { x: number, y: number }
+        const { x, y } = screenToFlowPosition({ x: pointer.x, y: pointer.y })
 
         if (
           fromHandleType === 'source'
@@ -708,7 +748,7 @@ export const useNodesInteractions = () => {
         return
 
       if (
-        nodesMetaDataMap?.[currentNode.data.type as BlockEnum]?.metaData
+        nodesMetaDataMap?.[getNodeCatalogType(currentNode.data)]?.metaData
           .isUndeletable
       ) {
         return
@@ -880,24 +920,24 @@ export const useNodesInteractions = () => {
         return
 
       const { nodes, setNodes, edges, setEdges } = collaborativeWorkflow.getState()
-      const nodesWithSameType = nodes.filter(
-        node => node.data.type === nodeType,
-      )
       const nodeMetaData = nodesMetaDataMap?.[nodeType]
       if (!nodeMetaData)
         return
       const { defaultValue } = nodeMetaData
+      const nodesWithSameType = getNodesWithSameDefaultDataType(nodes, nodeType, defaultValue)
+      const shouldCreateInlineAgentBinding = nodeType === BlockEnum.AgentV2 && needsPendingInlineAgentBinding(pluginDefaultValue)
       const { newNode, newIterationStartNode, newLoopStartNode }
         = generateNewNode({
           type: getNodeCustomTypeByNodeDataType(nodeType),
           data: {
-            ...(defaultValue as any),
+            ...(defaultValue as Node['data']),
             title:
               nodesWithSameType.length > 0
                 ? `${defaultValue.title} ${nodesWithSameType.length + 1}`
                 : defaultValue.title,
             ...pluginDefaultValue,
             selected: true,
+            ...(shouldCreateInlineAgentBinding ? { _isTempNode: true } : {}),
             _showAddVariablePopup:
               (nodeType === BlockEnum.VariableAssigner
                 || nodeType === BlockEnum.VariableAggregator)
@@ -1141,7 +1181,7 @@ export const useNodesInteractions = () => {
           }
         }
 
-        let nodesConnectedSourceOrTargetHandleIdsMap: Record<string, any>
+        let nodesConnectedSourceOrTargetHandleIdsMap: ReturnType<typeof getNodesConnectedSourceOrTargetHandleIdsMap>
         if (newEdge) {
           nodesConnectedSourceOrTargetHandleIdsMap
             = getNodesConnectedSourceOrTargetHandleIdsMap(
@@ -1420,6 +1460,18 @@ export const useNodesInteractions = () => {
         })
         setEdges(newEdges)
       }
+      if (isAgentV2NodeData(newNode.data) && needsInlineAgentBindingCreation(newNode.data)) {
+        saveStateToHistory(WorkflowHistoryEvent.NodeAdd, { nodeId: newNode.id })
+        createInlineAgentBindingForNode(newNode.id, {
+          onError: () => {
+            const { nodes, setNodes, edges, setEdges } = collaborativeWorkflow.getState()
+            setNodes(nodes.filter(node => node.id !== newNode.id))
+            setEdges(edges.filter(edge => edge.source !== newNode.id && edge.target !== newNode.id))
+          },
+        })
+        return
+      }
+
       handleSyncWorkflowDraft()
       saveStateToHistory(WorkflowHistoryEvent.NodeAdd, { nodeId: newNode.id })
     },
@@ -1427,6 +1479,7 @@ export const useNodesInteractions = () => {
       getNodesReadOnly,
       collaborativeWorkflow,
       handleSyncWorkflowDraft,
+      createInlineAgentBindingForNode,
       saveStateToHistory,
       workflowStore,
       getAfterNodesInSameBranch,
@@ -1439,7 +1492,7 @@ export const useNodesInteractions = () => {
       currentNodeId: string,
       nodeType: BlockEnum,
       sourceHandle: string,
-      pluginDefaultValue?: PluginDefaultValue,
+      pluginDefaultValue?: BlockDefaultValue,
     ) => {
       if (getNodesReadOnly())
         return
@@ -1447,13 +1500,12 @@ export const useNodesInteractions = () => {
       const { nodes, setNodes, edges, setEdges } = collaborativeWorkflow.getState()
       const currentNode = nodes.find(node => node.id === currentNodeId)!
       const connectedEdges = getConnectedEdges([currentNode], edges)
-      const nodesWithSameType = nodes.filter(
-        node => node.data.type === nodeType,
-      )
       const nodeMetaData = nodesMetaDataMap?.[nodeType]
       if (!nodeMetaData)
         return
       const { defaultValue } = nodeMetaData
+      const nodesWithSameType = getNodesWithSameDefaultDataType(nodes, nodeType, defaultValue)
+      const shouldCreateInlineAgentBinding = nodeType === BlockEnum.AgentV2 && needsPendingInlineAgentBinding(pluginDefaultValue)
       const {
         newNode: newCurrentNode,
         newIterationStartNode,
@@ -1461,12 +1513,13 @@ export const useNodesInteractions = () => {
       } = generateNewNode({
         type: getNodeCustomTypeByNodeDataType(nodeType),
         data: {
-          ...(defaultValue as any),
+          ...(defaultValue as Node['data']),
           title:
             nodesWithSameType.length > 0
               ? `${defaultValue.title} ${nodesWithSameType.length + 1}`
               : defaultValue.title,
           ...pluginDefaultValue,
+          ...(shouldCreateInlineAgentBinding ? { _isTempNode: true } : {}),
           _connectedSourceHandleIds: [],
           _connectedTargetHandleIds: [],
           selected: currentNode.data.selected,
@@ -1651,6 +1704,15 @@ export const useNodesInteractions = () => {
           onSuccess: () => autoGenerateWebhookUrl(newCurrentNode.id),
         })
       }
+      else if (isAgentV2NodeData(newCurrentNode.data) && needsInlineAgentBindingCreation(newCurrentNode.data)) {
+        createInlineAgentBindingForNode(newCurrentNode.id, {
+          onError: () => {
+            const { setNodes, setEdges } = collaborativeWorkflow.getState()
+            setNodes(nodes)
+            setEdges(edges)
+          },
+        })
+      }
       else {
         handleSyncWorkflowDraft()
       }
@@ -1663,6 +1725,7 @@ export const useNodesInteractions = () => {
       getNodesReadOnly,
       collaborativeWorkflow,
       handleSyncWorkflowDraft,
+      createInlineAgentBindingForNode,
       saveStateToHistory,
       nodesMetaDataMap,
       autoGenerateWebhookUrl,
@@ -1729,7 +1792,7 @@ export const useNodesInteractions = () => {
     if (node.type === CUSTOM_NOTE_NODE)
       return true
 
-    const nodeMeta = nodesMetaDataMap?.[node.data.type as BlockEnum]
+    const nodeMeta = nodesMetaDataMap?.[getNodeCatalogType(node.data)]
     if (!nodeMeta)
       return false
 
@@ -1741,7 +1804,7 @@ export const useNodesInteractions = () => {
     if (node.type === CUSTOM_NOTE_NODE)
       return {}
 
-    const nodeMeta = nodesMetaDataMap?.[node.data.type as BlockEnum]
+    const nodeMeta = nodesMetaDataMap?.[getNodeCatalogType(node.data)]
     return nodeMeta?.defaultValue
   }, [nodesMetaDataMap])
 
@@ -2359,7 +2422,7 @@ export const useNodesInteractions = () => {
 
       const currentNode = nodes.find(n => n.id === nodeId)!
       const childrenNodes = nodes.filter(n =>
-        currentNode.data._children?.find((c: any) => c.nodeId === n.id),
+        currentNode.data._children?.find((child: NonNullable<Node['data']['_children']>[number]) => child.nodeId === n.id),
       )
       let rightNode: Node
       let bottomNode: Node
diff --git a/web/app/components/workflow/hooks/use-nodes-meta-data.ts b/web/app/components/workflow/hooks/use-nodes-meta-data.ts
index 2ea2fd9e9fc..37ad7986571 100644
--- a/web/app/components/workflow/hooks/use-nodes-meta-data.ts
+++ b/web/app/components/workflow/hooks/use-nodes-meta-data.ts
@@ -5,6 +5,7 @@ import { CollectionType } from '@/app/components/tools/types'
 import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { useStore } from '@/app/components/workflow/store'
 import { BlockEnum } from '@/app/components/workflow/types'
+import { getNodeCatalogType } from '@/app/components/workflow/utils/node'
 import { useGetLanguage } from '@/context/i18n'
 import {
   useAllBuiltInTools,
@@ -32,7 +33,7 @@ export const useNodeMetaData = (node: Node) => {
   const dataSourceList = useStore(s => s.dataSourceList)
   const availableNodesMetaData = useNodesMetaData()
   const { data } = node
-  const nodeMetaData = availableNodesMetaData.nodesMap?.[data.type]
+  const nodeMetaData = availableNodesMetaData.nodesMap?.[getNodeCatalogType(data)]
   const author = useMemo(() => {
     if (data.type === BlockEnum.DataSource)
       return dataSourceList?.find(dataSource => dataSource.plugin_id === data.plugin_id)?.author
diff --git a/web/app/components/workflow/hooks/use-workflow-panel-interactions.ts b/web/app/components/workflow/hooks/use-workflow-panel-interactions.ts
index 89f8a9a4454..c3ebeba2300 100644
--- a/web/app/components/workflow/hooks/use-workflow-panel-interactions.ts
+++ b/web/app/components/workflow/hooks/use-workflow-panel-interactions.ts
@@ -1,8 +1,9 @@
 import { useSuspenseQuery } from '@tanstack/react-query'
 import { useCallback } from 'react'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
+import { useHooksStore } from '../hooks-store'
 import { useStore, useWorkflowStore } from '../store'
-import { ControlMode } from '../types'
+import { ControlMode, WorkflowRunningStatus } from '../types'
 import { useEdgesInteractionsWithoutSync } from './use-edges-interactions-without-sync'
 import { useNodesInteractionsWithoutSync } from './use-nodes-interactions-without-sync'
 import { useSelectionInteractions } from './use-selection-interactions'
@@ -29,12 +30,23 @@ export const useWorkflowInteractions = () => {
 
 export const useWorkflowMoveMode = () => {
   const setControlMode = useStore(s => s.setControlMode)
+  const workflowRunningData = useStore(s => s.workflowRunningData)
+  const historyWorkflowData = useStore(s => s.historyWorkflowData)
+  const isRestoring = useStore(s => s.isRestoring)
+  const canComment = useHooksStore(s => s.accessControl.canComment)
   const { getNodesReadOnly } = useNodesReadOnly()
   const { handleSelectionCancel } = useSelectionInteractions()
   const { data: isCommentModeAvailable } = useSuspenseQuery({
     ...systemFeaturesQueryOptions(),
     select: s => s.enable_collaboration_mode,
   })
+  const isCommentModeOperationBlocked = !!(
+    workflowRunningData?.result.status === WorkflowRunningStatus.Running
+    || workflowRunningData?.result.status === WorkflowRunningStatus.Paused
+    || historyWorkflowData
+    || isRestoring
+  )
+  const canUseCommentMode = !!(canComment && !isCommentModeOperationBlocked && isCommentModeAvailable)
 
   const handleModePointer = useCallback(() => {
     if (getNodesReadOnly())
@@ -52,17 +64,18 @@ export const useWorkflowMoveMode = () => {
   }, [getNodesReadOnly, handleSelectionCancel, setControlMode])
 
   const handleModeComment = useCallback(() => {
-    if (getNodesReadOnly() || !isCommentModeAvailable)
+    if (!canUseCommentMode)
       return
 
     setControlMode(ControlMode.Comment)
     handleSelectionCancel()
-  }, [getNodesReadOnly, handleSelectionCancel, isCommentModeAvailable, setControlMode])
+  }, [canUseCommentMode, handleSelectionCancel, setControlMode])
 
   return {
     handleModePointer,
     handleModeHand,
     handleModeComment,
     isCommentModeAvailable,
+    canUseCommentMode,
   }
 }
diff --git a/web/app/components/workflow/hooks/use-workflow.ts b/web/app/components/workflow/hooks/use-workflow.ts
index 2e2a5318d8e..8bfa148f9fc 100644
--- a/web/app/components/workflow/hooks/use-workflow.ts
+++ b/web/app/components/workflow/hooks/use-workflow.ts
@@ -26,6 +26,7 @@ import { useNodesMetaData } from '.'
 import {
   SUPPORT_OUTPUT_VARS_NODE,
 } from '../constants'
+import { useHooksStore } from '../hooks-store'
 import { findUsedVarNodes, getNodeOutputVars, updateNodeVars } from '../nodes/_base/components/variable/utils'
 
 import { CUSTOM_NOTE_NODE } from '../note-node/constants'
@@ -36,6 +37,7 @@ import {
 import {
   WorkflowRunningStatus,
 } from '../types'
+import { getNodeCatalogType } from '../utils'
 import {
   getWorkflowEntryNode,
   isWorkflowEntryNode,
@@ -360,13 +362,15 @@ export const useWorkflow = () => {
       return false
 
     if (sourceNode && targetNode) {
-      const sourceNodeAvailableNextNodes = getAvailableBlocks(sourceNode.data.type, !!sourceNode.parentId).availableNextBlocks
-      const targetNodeAvailablePrevNodes = getAvailableBlocks(targetNode.data.type, !!targetNode.parentId).availablePrevBlocks
+      const sourceNodeCatalogType = getNodeCatalogType(sourceNode.data)
+      const targetNodeCatalogType = getNodeCatalogType(targetNode.data)
+      const sourceNodeAvailableNextNodes = getAvailableBlocks(sourceNodeCatalogType, !!sourceNode.parentId).availableNextBlocks
+      const targetNodeAvailablePrevNodes = getAvailableBlocks(targetNodeCatalogType, !!targetNode.parentId).availablePrevBlocks
 
-      if (!sourceNodeAvailableNextNodes.includes(targetNode.data.type))
+      if (!sourceNodeAvailableNextNodes.includes(targetNodeCatalogType))
         return false
 
-      if (!targetNodeAvailablePrevNodes.includes(sourceNode.data.type))
+      if (!targetNodeAvailablePrevNodes.includes(sourceNodeCatalogType))
         return false
     }
 
@@ -434,7 +438,7 @@ export const useWorkflowReadOnly = () => {
   }
 }
 
-export const useNodesReadOnly = () => {
+const useNodesReadOnlyBase = (canEdit: boolean) => {
   const workflowStore = useWorkflowStore()
   const canvasReadOnly = useStore(s => s.canvasReadOnly)
   const workflowRunningData = useStore(s => s.workflowRunningData)
@@ -451,16 +455,18 @@ export const useNodesReadOnly = () => {
 
     return !!(
       canvasReadOnly
+      || !canEdit
       || workflowRunningData?.result.status === WorkflowRunningStatus.Running
       || workflowRunningData?.result.status === WorkflowRunningStatus.Paused
       || historyWorkflowData
       || isRestoring
     )
-  }, [workflowStore])
+  }, [workflowStore, canEdit])
 
   return {
     nodesReadOnly: !!(
       canvasReadOnly
+      || !canEdit
       || workflowRunningData?.result.status === WorkflowRunningStatus.Running
       || workflowRunningData?.result.status === WorkflowRunningStatus.Paused
       || historyWorkflowData
@@ -470,6 +476,16 @@ export const useNodesReadOnly = () => {
   }
 }
 
+export const useNodesReadOnlyByCanEdit = (canEdit: boolean) => {
+  return useNodesReadOnlyBase(canEdit)
+}
+
+export const useNodesReadOnly = () => {
+  const canEdit = useHooksStore(s => s.accessControl.canEdit)
+
+  return useNodesReadOnlyBase(canEdit)
+}
+
 export const useIsNodeInIteration = (iterationId: string) => {
   const collaborativeWorkflow = useCollaborativeWorkflow()
 
diff --git a/web/app/components/workflow/node-actions-menu/__tests__/details.spec.tsx b/web/app/components/workflow/node-actions-menu/__tests__/details.spec.tsx
index 4a54d759bc7..19cb4ea0e4b 100644
--- a/web/app/components/workflow/node-actions-menu/__tests__/details.spec.tsx
+++ b/web/app/components/workflow/node-actions-menu/__tests__/details.spec.tsx
@@ -131,7 +131,10 @@ describe('node actions menu details', () => {
       handleNodesCopy,
     } as unknown as ReturnType<typeof useNodesInteractions>)
     mockUseNodesReadOnly.mockReturnValue({ nodesReadOnly: false } as ReturnType<typeof useNodesReadOnly>)
-    mockUseHooksStore.mockImplementation((selector: any) => selector({ configsMap: { flowType: FlowType.appFlow } }))
+    mockUseHooksStore.mockImplementation((selector: any) => selector({
+      configsMap: { flowType: FlowType.appFlow },
+      accessControl: { canRun: true },
+    }))
     mockUseNodes.mockReturnValue([{ id: 'start', position: { x: 0, y: 0 }, data: { type: BlockEnum.Start } as any }] as any)
     mockUseAllWorkflowTools.mockReturnValue({ data: [] } as any)
   })
diff --git a/web/app/components/workflow/node-actions-menu/__tests__/index.spec.tsx b/web/app/components/workflow/node-actions-menu/__tests__/index.spec.tsx
index 6b6bdeb9331..44704d037bc 100644
--- a/web/app/components/workflow/node-actions-menu/__tests__/index.spec.tsx
+++ b/web/app/components/workflow/node-actions-menu/__tests__/index.spec.tsx
@@ -130,6 +130,19 @@ describe('NodeActionsDropdown', () => {
     expect(store.getState().pendingSingleRun).toEqual({ nodeId: 'node-1', action: 'run' })
   })
 
+  it('should hide single-run actions when nodes are readonly', async () => {
+    const user = userEvent.setup()
+    mockUseNodesReadOnly.mockReturnValueOnce({
+      nodesReadOnly: true,
+    } as ReturnType<typeof useNodesReadOnly>)
+
+    renderComponent()
+
+    await user.click(screen.getByRole('button', { name: 'common.operation.more' }))
+
+    expect(screen.queryByText('workflow.panel.runThisStep')).not.toBeInTheDocument()
+  })
+
   it('should hide the help link when showHelpLink is false', async () => {
     const user = userEvent.setup()
     renderComponent(false)
diff --git a/web/app/components/workflow/node-actions-menu/change-block-menu-trigger.tsx b/web/app/components/workflow/node-actions-menu/change-block-menu-trigger.tsx
index 183d515cf41..2a6c6864c93 100644
--- a/web/app/components/workflow/node-actions-menu/change-block-menu-trigger.tsx
+++ b/web/app/components/workflow/node-actions-menu/change-block-menu-trigger.tsx
@@ -15,6 +15,7 @@ import {
 import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import useNodes from '@/app/components/workflow/store/workflow/use-nodes'
 import { BlockEnum, isTriggerNode } from '@/app/components/workflow/types'
+import { getNodeCatalogType } from '@/app/components/workflow/utils'
 import { FlowType } from '@/types/common'
 
 type ChangeBlockMenuTriggerProps = {
@@ -30,10 +31,11 @@ export function ChangeBlockMenuTrigger({
 }: ChangeBlockMenuTriggerProps) {
   const { t } = useTranslation()
   const { handleNodeChange } = useNodesInteractions()
+  const nodeCatalogType = getNodeCatalogType(nodeData)
   const {
     availablePrevBlocks,
     availableNextBlocks,
-  } = useAvailableBlocks(nodeData.type, nodeData.isInIteration || nodeData.isInLoop)
+  } = useAvailableBlocks(nodeCatalogType, nodeData.isInIteration || nodeData.isInLoop)
   const isChatMode = useIsChatMode()
   const flowType = useHooksStore(s => s.configsMap?.flowType)
   const nodes = useNodes()
diff --git a/web/app/components/workflow/node-actions-menu/use-node-actions-menu-model.ts b/web/app/components/workflow/node-actions-menu/use-node-actions-menu-model.ts
index 579b3406c9d..db184749303 100644
--- a/web/app/components/workflow/node-actions-menu/use-node-actions-menu-model.ts
+++ b/web/app/components/workflow/node-actions-menu/use-node-actions-menu-model.ts
@@ -7,6 +7,7 @@ import {
   useNodesInteractions,
   useNodesReadOnly,
 } from '@/app/components/workflow/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { useWorkflowStore } from '@/app/components/workflow/store'
 import { BlockEnum, NodeRunningStatus } from '@/app/components/workflow/types'
 import { canRunBySingle } from '@/app/components/workflow/utils'
@@ -35,11 +36,12 @@ export function useNodeActionsMenuModel({
   } = useNodesInteractions()
   const workflowStore = useWorkflowStore()
   const { nodesReadOnly } = useNodesReadOnly()
+  const canRunWorkflow = useHooksStore(s => s.accessControl.canRun)
   const nodeMetaData = useNodeMetaData({ id, data } as Node)
   const { data: workflowTools } = useAllWorkflowTools()
 
   const isChildNode = !!(data.isInIteration || data.isInLoop)
-  const canRun = canRunBySingle(data.type, isChildNode)
+  const canRun = canRunWorkflow && !nodesReadOnly && canRunBySingle(data.type, isChildNode)
   const isSingleRunning = data._singleRunningStatus === NodeRunningStatus.Running
   const canChangeBlock = !nodeMetaData.isTypeFixed && !nodeMetaData.isUndeletable && !nodesReadOnly
   const sourceHandle = useMemo(() => {
diff --git a/web/app/components/workflow/nodes/_base/components/__tests__/node-control.spec.tsx b/web/app/components/workflow/nodes/_base/components/__tests__/node-control.spec.tsx
index 62d74b64da1..95d1cd74069 100644
--- a/web/app/components/workflow/nodes/_base/components/__tests__/node-control.spec.tsx
+++ b/web/app/components/workflow/nodes/_base/components/__tests__/node-control.spec.tsx
@@ -1,15 +1,19 @@
+import type React from 'react'
 import type { CommonNodeType } from '../../../../types'
 import { fireEvent, screen } from '@testing-library/react'
 import { renderWorkflowComponent } from '../../../../__tests__/workflow-test-env'
+import { fullWorkflowAccessControl } from '../../../../hooks-store'
 import { BlockEnum, NodeRunningStatus } from '../../../../types'
 import NodeControl from '../node-control'
 
 const {
   mockHandleNodeSelect,
   mockCanRunBySingle,
+  mockUseNodesReadOnly,
 } = vi.hoisted(() => ({
   mockHandleNodeSelect: vi.fn(),
   mockCanRunBySingle: vi.fn(() => true),
+  mockUseNodesReadOnly: vi.fn(() => false),
 }))
 
 let mockPluginInstallLocked = false
@@ -21,6 +25,7 @@ vi.mock('../../../../hooks', async () => {
     useNodesInteractions: () => ({
       handleNodeSelect: mockHandleNodeSelect,
     }),
+    useNodesReadOnly: mockUseNodesReadOnly,
   }
 })
 
@@ -51,6 +56,14 @@ function NodeControlHarness({ id, data }: { id: string, data: CommonNodeType, se
   )
 }
 
+function renderNodeControl(ui: React.ReactElement, accessControl = fullWorkflowAccessControl) {
+  return renderWorkflowComponent(ui, {
+    hooksStoreProps: {
+      accessControl,
+    },
+  })
+}
+
 const makeData = (overrides: Partial<CommonNodeType> = {}): CommonNodeType => ({
   type: BlockEnum.Code,
   title: 'Node',
@@ -67,12 +80,13 @@ describe('NodeControl', () => {
     vi.clearAllMocks()
     mockPluginInstallLocked = false
     mockCanRunBySingle.mockReturnValue(true)
+    mockUseNodesReadOnly.mockReturnValue(false)
   })
 
   // Run/stop behavior should be driven by the workflow store, not CSS classes.
   describe('Single Run Actions', () => {
     it('should trigger a single run through the workflow store', () => {
-      const { store } = renderWorkflowComponent(
+      const { store } = renderNodeControl(
         <NodeControlHarness id="node-1" data={makeData()} />,
       )
 
@@ -84,7 +98,7 @@ describe('NodeControl', () => {
     })
 
     it('should trigger stop when the node is already single-running', () => {
-      const { store } = renderWorkflowComponent(
+      const { store } = renderNodeControl(
         <NodeControlHarness
           id="node-2"
           data={makeData({
@@ -106,7 +120,7 @@ describe('NodeControl', () => {
     it('should keep the panel operator available when the plugin is install-locked', () => {
       mockPluginInstallLocked = true
 
-      renderWorkflowComponent(
+      renderNodeControl(
         <NodeControlHarness
           id="node-3"
           data={makeData({
@@ -121,7 +135,7 @@ describe('NodeControl', () => {
     it('should hide the run control when single-node execution is not supported', () => {
       mockCanRunBySingle.mockReturnValue(false)
 
-      renderWorkflowComponent(
+      renderNodeControl(
         <NodeControlHarness
           id="node-4"
           data={makeData()}
@@ -131,5 +145,32 @@ describe('NodeControl', () => {
       expect(screen.queryByRole('button', { name: 'workflow.panel.runThisStep' })).not.toBeInTheDocument()
       expect(screen.getByRole('button', { name: 'open panel' })).toBeInTheDocument()
     })
+
+    it('should hide the run control when workflow run permission is missing', () => {
+      renderNodeControl(
+        <NodeControlHarness id="node-5" data={makeData()} />,
+        {
+          canEdit: false,
+          canComment: true,
+          canRun: false,
+          canImportExportDSL: false,
+          canReleaseAndVersion: false,
+        },
+      )
+
+      expect(screen.queryByRole('button', { name: 'workflow.panel.runThisStep' })).not.toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'open panel' })).toBeInTheDocument()
+    })
+
+    it('should hide the run control when nodes are read-only', () => {
+      mockUseNodesReadOnly.mockReturnValue(true)
+
+      renderNodeControl(
+        <NodeControlHarness id="node-6" data={makeData()} />,
+      )
+
+      expect(screen.queryByRole('button', { name: 'workflow.panel.runThisStep' })).not.toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'open panel' })).toBeInTheDocument()
+    })
   })
 })
diff --git a/web/app/components/workflow/nodes/_base/components/agent-strategy-selector.tsx b/web/app/components/workflow/nodes/_base/components/agent-strategy-selector.tsx
index 9d1d8eec0a9..b432213061b 100644
--- a/web/app/components/workflow/nodes/_base/components/agent-strategy-selector.tsx
+++ b/web/app/components/workflow/nodes/_base/components/agent-strategy-selector.tsx
@@ -46,7 +46,7 @@ const NotFoundWarn = (props: {
       <TooltipTrigger
         render={<div><span className="i-ri-error-warning-fill size-4 text-text-destructive" aria-hidden="true" /></div>}
       />
-      <TooltipContent className="w-[180px]">
+      <TooltipContent className="w-45">
         <div className="space-y-1 text-xs">
           <h3 className="font-semibold text-text-primary">
             {title}
@@ -208,7 +208,7 @@ export const AgentStrategySelector = memo((props: AgentStrategySelectorProps) =>
                 <SwitchPluginVersion
                   uniqueIdentifier={value.plugin_unique_identifier}
                   tooltip={(
-                    <div className="w-[180px] space-y-1 text-xs">
+                    <div className="w-45 space-y-1 text-xs">
                       <h3 className="font-semibold text-text-primary">
                         {t('nodes.agent.unsupportedStrategy', { ns: 'workflow' })}
                       </h3>
@@ -231,12 +231,12 @@ export const AgentStrategySelector = memo((props: AgentStrategySelectorProps) =>
         sideOffset={0}
         popupClassName="border-none bg-transparent p-0 shadow-none backdrop-blur-none"
       >
-        <div className="w-[388px] overflow-hidden rounded-md border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow">
+        <div className="w-97 overflow-hidden rounded-md border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow">
           <header className="flex gap-1 p-2">
             <SearchInput placeholder={t('nodes.agent.strategy.searchPlaceholder', { ns: 'workflow' })} value={query} onValueChange={setQuery} className="w-full" />
             <ViewTypeSelect viewType={viewType} onChange={setViewType} />
           </header>
-          <main className="relative flex w-full flex-col overflow-hidden md:max-h-[300px] xl:max-h-[400px] 2xl:max-h-[564px]" ref={wrapElemRef}>
+          <div className="relative flex w-full flex-col overflow-hidden md:max-h-75 xl:max-h-100 2xl:max-h-141" ref={wrapElemRef}>
             <Tools
               tools={filteredTools}
               viewType={viewType}
@@ -268,7 +268,7 @@ export const AgentStrategySelector = memo((props: AgentStrategySelectorProps) =>
                 disableMaxWidth
               />
             )}
-          </main>
+          </div>
         </div>
       </PopoverContent>
     </Popover>
diff --git a/web/app/components/workflow/nodes/_base/components/install-plugin-button.tsx b/web/app/components/workflow/nodes/_base/components/install-plugin-button.tsx
index dd2611b395b..560b64a6213 100644
--- a/web/app/components/workflow/nodes/_base/components/install-plugin-button.tsx
+++ b/web/app/components/workflow/nodes/_base/components/install-plugin-button.tsx
@@ -1,10 +1,10 @@
 import type { ComponentProps, MouseEventHandler } from 'react'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
-import { RiInstallLine, RiLoader2Line } from '@remixicon/react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import checkTaskStatus from '@/app/components/plugins/install-plugin/base/check-task-status'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import { TaskStatus } from '@/app/components/plugins/types'
 import { useCheckInstalled, useInstallPackageFromMarketPlace } from '@/service/use-plugins'
 
@@ -23,6 +23,7 @@ export const InstallPluginButton = (props: InstallPluginButtonProps) => {
     ...rest
   } = props
   const { t } = useTranslation()
+  const { canInstallPlugin } = useWorkspacePluginInstallPermission()
   const identifiers = Array.from(new Set(
     [uniqueIdentifier, ...extraIdentifiers].filter((item): item is string => Boolean(item)),
   ))
@@ -83,7 +84,7 @@ export const InstallPluginButton = (props: InstallPluginButtonProps) => {
       },
     })
   }
-  if (!manifest.data)
+  if (!canInstallPlugin || !manifest.data)
     return null
   const identifierSet = new Set(identifiers)
   const isInstalled = manifest.data.plugins.some(plugin => (
@@ -102,7 +103,7 @@ export const InstallPluginButton = (props: InstallPluginButtonProps) => {
       className={cn('flex items-center', className)}
     >
       {!isLoading ? t('nodes.agent.pluginInstaller.install', { ns: 'workflow' }) : t('nodes.agent.pluginInstaller.installing', { ns: 'workflow' })}
-      {!isLoading ? <RiInstallLine className="ml-1 size-3.5" /> : <RiLoader2Line className="ml-1 size-3.5 animate-spin" />}
+      {!isLoading ? <span className="ml-1 i-ri-install-line size-3.5" /> : <span className="ml-1 i-ri-loader-2-line size-3.5 animate-spin" />}
     </Button>
   )
 }
diff --git a/web/app/components/workflow/nodes/_base/components/next-step/add.tsx b/web/app/components/workflow/nodes/_base/components/next-step/add.tsx
index c890aab83de..4d85aa31de6 100644
--- a/web/app/components/workflow/nodes/_base/components/next-step/add.tsx
+++ b/web/app/components/workflow/nodes/_base/components/next-step/add.tsx
@@ -18,6 +18,7 @@ import {
   useNodesInteractions,
   useNodesReadOnly,
 } from '@/app/components/workflow/hooks'
+import { getNodeCatalogType } from '@/app/components/workflow/utils'
 
 type AddProps = {
   nodeId: string
@@ -37,7 +38,7 @@ const Add = ({
   const [open, setOpen] = useState(false)
   const { handleNodeAdd } = useNodesInteractions()
   const { nodesReadOnly } = useNodesReadOnly()
-  const { availableNextBlocks } = useAvailableBlocks(nodeData.type, nodeData.isInIteration || nodeData.isInLoop)
+  const { availableNextBlocks } = useAvailableBlocks(getNodeCatalogType(nodeData), nodeData.isInIteration || nodeData.isInLoop)
 
   const handleSelect = useCallback<OnSelectBlock>((type, pluginDefaultValue) => {
     handleNodeAdd(
diff --git a/web/app/components/workflow/nodes/_base/components/next-step/operator.tsx b/web/app/components/workflow/nodes/_base/components/next-step/operator.tsx
index c24d7aa8f4f..2bf9ad4330b 100644
--- a/web/app/components/workflow/nodes/_base/components/next-step/operator.tsx
+++ b/web/app/components/workflow/nodes/_base/components/next-step/operator.tsx
@@ -18,6 +18,7 @@ import {
   useAvailableBlocks,
   useNodesInteractions,
 } from '@/app/components/workflow/hooks'
+import { getNodeCatalogType } from '@/app/components/workflow/utils'
 
 type ChangeItemProps = {
   data: CommonNodeType
@@ -32,10 +33,11 @@ const ChangeItem = ({
   const { t } = useTranslation()
 
   const { handleNodeChange } = useNodesInteractions()
+  const nodeCatalogType = getNodeCatalogType(data)
   const {
     availablePrevBlocks,
     availableNextBlocks,
-  } = useAvailableBlocks(data.type, data.isInIteration || data.isInLoop)
+  } = useAvailableBlocks(nodeCatalogType, data.isInIteration || data.isInLoop)
 
   const handleSelect = useCallback<OnSelectBlock>((type, pluginDefaultValue) => {
     handleNodeChange(nodeId, type, sourceHandle, pluginDefaultValue)
@@ -59,7 +61,7 @@ const ChangeItem = ({
       }}
       trigger={renderTrigger}
       popupClassName="w-[328px]!"
-      availableBlocksTypes={intersection(availablePrevBlocks, availableNextBlocks).filter(item => item !== data.type)}
+      availableBlocksTypes={intersection(availablePrevBlocks, availableNextBlocks).filter(item => item !== nodeCatalogType)}
     />
   )
 }
diff --git a/web/app/components/workflow/nodes/_base/components/node-control.tsx b/web/app/components/workflow/nodes/_base/components/node-control.tsx
index 2932e8d599f..926f3820b12 100644
--- a/web/app/components/workflow/nodes/_base/components/node-control.tsx
+++ b/web/app/components/workflow/nodes/_base/components/node-control.tsx
@@ -11,10 +11,12 @@ import { useTranslation } from 'react-i18next'
 import {
   Stop,
 } from '@/app/components/base/icons/src/vender/line/mediaAndDevices'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import { NodeActionsDropdown } from '@/app/components/workflow/node-actions-menu'
 import { useWorkflowStore } from '@/app/components/workflow/store'
 import {
   useNodesInteractions,
+  useNodesReadOnly,
 } from '../../../hooks'
 import { NodeRunningStatus } from '../../../types'
 import { canRunBySingle } from '../../../utils'
@@ -29,7 +31,9 @@ const NodeControl: FC<NodeControlProps> = ({
 }) => {
   const { t } = useTranslation()
   const { handleNodeSelect } = useNodesInteractions()
+  const nodesReadOnly = useNodesReadOnly()
   const workflowStore = useWorkflowStore()
+  const canRun = useHooksStore(s => s.accessControl.canRun)
   const isSingleRunning = data._singleRunningStatus === NodeRunningStatus.Running
 
   const isChildNode = !!(data.isInIteration || data.isInLoop)
@@ -48,7 +52,7 @@ const NodeControl: FC<NodeControlProps> = ({
         onClick={e => e.stopPropagation()}
       >
         {
-          canRunBySingle(data.type, isChildNode) && (
+          canRun && !nodesReadOnly && canRunBySingle(data.type, isChildNode) && (
             <button
               type="button"
               aria-label={isSingleRunning ? t('debug.variableInspect.trigger.stop', { ns: 'workflow' }) : t('panel.runThisStep', { ns: 'workflow' })}
diff --git a/web/app/components/workflow/nodes/_base/components/node-handle.tsx b/web/app/components/workflow/nodes/_base/components/node-handle.tsx
index 1cfb6244837..896e56f2b10 100644
--- a/web/app/components/workflow/nodes/_base/components/node-handle.tsx
+++ b/web/app/components/workflow/nodes/_base/components/node-handle.tsx
@@ -1,5 +1,5 @@
 import type { MouseEvent } from 'react'
-import type { PluginDefaultValue } from '../../../block-selector/types'
+import type { BlockDefaultValue } from '../../../block-selector/types'
 import type { Node } from '../../../types'
 import { cn } from '@langgenius/dify-ui/cn'
 import {
@@ -28,6 +28,7 @@ import {
   BlockEnum,
   NodeRunningStatus,
 } from '../../../types'
+import { getNodeCatalogType } from '../../../utils'
 
 type NodeHandleProps = {
   handleId: string
@@ -57,7 +58,7 @@ export const NodeTargetHandle = memo(({
   const { handleNodeAdd } = useNodesInteractions()
   const { getNodesReadOnly } = useNodesReadOnly()
   const connected = data._connectedTargetHandleIds?.includes(handleId)
-  const { availablePrevBlocks } = useAvailableBlocks(data.type, data.isInIteration || data.isInLoop)
+  const { availablePrevBlocks } = useAvailableBlocks(getNodeCatalogType(data), data.isInIteration || data.isInLoop)
   const isConnectable = !!availablePrevBlocks.length
 
   const handleOpenChange = useCallback((v: boolean) => {
@@ -68,7 +69,7 @@ export const NodeTargetHandle = memo(({
     if (!connected)
       setOpen(v => !v)
   }, [connected])
-  const handleSelect = useCallback((type: BlockEnum, pluginDefaultValue?: PluginDefaultValue) => {
+  const handleSelect = useCallback((type: BlockEnum, pluginDefaultValue?: BlockDefaultValue) => {
     handleNodeAdd(
       {
         nodeType: type,
@@ -147,7 +148,7 @@ export const NodeSourceHandle = memo(({
   const workflowStoreApi = useWorkflowStore()
   const { handleNodeAdd } = useNodesInteractions()
   const { getNodesReadOnly } = useNodesReadOnly()
-  const { availableNextBlocks } = useAvailableBlocks(data.type, data.isInIteration || data.isInLoop)
+  const { availableNextBlocks } = useAvailableBlocks(getNodeCatalogType(data), data.isInIteration || data.isInLoop)
   const isConnectable = !!availableNextBlocks.length
   const isChatMode = useIsChatMode()
   const shouldAutoOpen = shouldAutoOpenStartNodeSelector && canAutoOpenStartNodeSelector(data.type, isChatMode)
@@ -161,7 +162,7 @@ export const NodeSourceHandle = memo(({
     e.stopPropagation()
     setOpen(v => !v)
   }, [])
-  const handleSelect = useCallback((type: BlockEnum, pluginDefaultValue?: PluginDefaultValue) => {
+  const handleSelect = useCallback((type: BlockEnum, pluginDefaultValue?: BlockDefaultValue) => {
     handleNodeAdd(
       {
         nodeType: type,
diff --git a/web/app/components/workflow/nodes/_base/components/option-card.tsx b/web/app/components/workflow/nodes/_base/components/option-card.tsx
index 4bb860aba6d..c90a8c76f94 100644
--- a/web/app/components/workflow/nodes/_base/components/option-card.tsx
+++ b/web/app/components/workflow/nodes/_base/components/option-card.tsx
@@ -50,7 +50,7 @@ const OptionCard: FC<Props> = ({
       className={cn(
         'flex h-8 cursor-default items-center rounded-md border border-components-option-card-option-border bg-components-option-card-option-bg px-2 system-sm-regular text-text-secondary',
         (!selected && !disabled) && 'cursor-pointer hover:border-components-option-card-option-border-hover hover:bg-components-option-card-option-bg-hover hover:shadow-xs',
-        selected && 'border-[1.5px] border-components-option-card-option-selected-border bg-components-option-card-option-selected-bg system-sm-medium shadow-xs',
+        (selected && !disabled) && 'border-[1.5px] border-components-option-card-option-selected-border bg-components-option-card-option-selected-bg system-sm-medium shadow-xs',
         disabled && 'text-text-disabled',
         variants({ align }),
         className,
diff --git a/web/app/components/workflow/nodes/_base/components/switch-plugin-version.tsx b/web/app/components/workflow/nodes/_base/components/switch-plugin-version.tsx
index 4220d65be5c..0a1a7fd3ad8 100644
--- a/web/app/components/workflow/nodes/_base/components/switch-plugin-version.tsx
+++ b/web/app/components/workflow/nodes/_base/components/switch-plugin-version.tsx
@@ -3,13 +3,13 @@
 import type { FC, ReactNode } from 'react'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
-import { RiArrowLeftRightLine, RiExternalLinkLine } from '@remixicon/react'
 import { useBoolean } from 'ahooks'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Badge from '@/app/components/base/badge'
 import { Badge as Badge2, BadgeState } from '@/app/components/base/badge/index'
 import useGetIcon from '@/app/components/plugins/install-plugin/base/use-get-icon'
+import useWorkspacePluginInstallPermission from '@/app/components/plugins/install-plugin/hooks/use-workspace-plugin-install-permission'
 import { pluginManifestToCardPluginProps } from '@/app/components/plugins/install-plugin/utils'
 import PluginMutationModel from '@/app/components/plugins/plugin-mutation-model'
 import PluginVersionPicker from '@/app/components/plugins/update-plugin/plugin-version-picker'
@@ -34,6 +34,7 @@ export const SwitchPluginVersion: FC<SwitchPluginVersionProps> = (props) => {
     version: string
     pluginUniqueIden: string
   }>()
+  const { canUpdatePlugin } = useWorkspacePluginInstallPermission()
   const pluginDetails = useCheckInstalled({
     pluginIds: [pluginId!],
     enabled: true,
@@ -64,7 +65,7 @@ export const SwitchPluginVersion: FC<SwitchPluginVersionProps> = (props) => {
   const { t } = useTranslation()
 
   // Guard against null/undefined uniqueIdentifier to prevent app crash
-  if (!uniqueIdentifier || !pluginId)
+  if (!uniqueIdentifier || !pluginId || !canUpdatePlugin)
     return null
 
   const content = (
@@ -99,7 +100,7 @@ export const SwitchPluginVersion: FC<SwitchPluginVersionProps> = (props) => {
               <span className="system-xs-regular text-xs text-text-accent">
                 {t('nodes.agent.installPlugin.changelog', { ns: 'workflow' })}
               </span>
-              <RiExternalLinkLine className="size-3 text-text-accent" />
+              <span className="i-ri-external-link-line size-3 text-text-accent" />
             </Link>
           )}
         />
@@ -127,7 +128,7 @@ export const SwitchPluginVersion: FC<SwitchPluginVersionProps> = (props) => {
               text={(
                 <>
                   <div>{pluginDetail.version}</div>
-                  <RiArrowLeftRightLine className="ml-1 size-3 text-text-tertiary" />
+                  <span className="ml-1 i-ri-arrow-left-right-line size-3 text-text-tertiary" />
                 </>
               )}
               hasRedCornerMark={true}
diff --git a/web/app/components/workflow/nodes/_base/components/variable/__tests__/utils.spec.ts b/web/app/components/workflow/nodes/_base/components/variable/__tests__/utils.spec.ts
index ec7c4f17deb..8e72be3f677 100644
--- a/web/app/components/workflow/nodes/_base/components/variable/__tests__/utils.spec.ts
+++ b/web/app/components/workflow/nodes/_base/components/variable/__tests__/utils.spec.ts
@@ -1,12 +1,13 @@
+import type { AgentV2NodeType } from '@/app/components/workflow/nodes/agent-v2/types'
 import type { AnswerNodeType } from '@/app/components/workflow/nodes/answer/types'
 import type { HumanInputNodeType } from '@/app/components/workflow/nodes/human-input/types'
 import type { LLMNodeType } from '@/app/components/workflow/nodes/llm/types'
 import type { Node, PromptItem } from '@/app/components/workflow/types'
 import { describe, expect, it } from 'vitest'
 import { DeliveryMethodType } from '@/app/components/workflow/nodes/human-input/types'
-import { BlockEnum, EditionType, InputVarType, PromptRole } from '@/app/components/workflow/types'
+import { BlockEnum, EditionType, InputVarType, PromptRole, VarType } from '@/app/components/workflow/types'
 import { AppModeEnum } from '@/types/app'
-import { getNodeUsedVars, updateNodeVars } from '../utils'
+import { getNodeUsedVars, toNodeAvailableVars, updateNodeVars } from '../utils'
 
 const createNode = <T>(data: Node<T>['data']): Node<T> => ({
   id: 'node-1',
@@ -42,6 +43,89 @@ const createLLMNodeData = (promptTemplate: PromptItem[]): LLMNodeType => ({
 })
 
 describe('variable utils', () => {
+  describe('toNodeAvailableVars', () => {
+    it('uses Agent v2 default declared outputs for agent nodes', () => {
+      const node = createNode<AgentV2NodeType>({
+        type: BlockEnum.Agent,
+        title: 'Agent',
+        desc: '',
+        agent_node_kind: 'dify_agent',
+        version: '2',
+      })
+
+      const availableVars = toNodeAvailableVars({
+        beforeNodes: [node],
+        isChatMode: false,
+        filterVar: () => true,
+        allPluginInfoList: {},
+      })
+
+      expect(availableVars).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            nodeId: 'node-1',
+            vars: [
+              { variable: 'text', type: VarType.string },
+              { variable: 'files', type: VarType.arrayFile },
+              { variable: 'json', type: VarType.object },
+            ],
+          }),
+        ]),
+      )
+      expect(availableVars.find(item => item.nodeId === 'node-1')?.vars).not.toContainEqual({
+        variable: 'usage',
+        type: VarType.object,
+      })
+    })
+
+    it('uses Agent v2 declared outputs from graph data', () => {
+      const node = createNode<AgentV2NodeType>({
+        type: BlockEnum.AgentV2,
+        title: 'Agent',
+        desc: '',
+        agent_node_kind: 'dify_agent',
+        agent_declared_outputs: [
+          {
+            name: 'summary',
+            type: 'string',
+            description: 'Short summary',
+          },
+          {
+            name: 'attachments',
+            type: 'array',
+            array_item: {
+              type: 'file',
+            },
+          },
+        ],
+        version: '2',
+      })
+
+      const availableVars = toNodeAvailableVars({
+        beforeNodes: [node],
+        isChatMode: false,
+        filterVar: () => true,
+        allPluginInfoList: {},
+      })
+
+      expect(availableVars).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            nodeId: 'node-1',
+            vars: [
+              { variable: 'summary', type: VarType.string },
+              { variable: 'attachments', type: VarType.arrayFile },
+            ],
+          }),
+        ]),
+      )
+      expect(availableVars.find(item => item.nodeId === 'node-1')?.vars).not.toContainEqual({
+        variable: 'text',
+        type: VarType.string,
+      })
+    })
+  })
+
   describe('getNodeUsedVars', () => {
     it('should read variables from llm jinja prompt text', () => {
       const node = createNode<LLMNodeType>(
@@ -108,6 +192,19 @@ describe('variable utils', () => {
         ]),
       )
     })
+
+    it('should read variables from agent task', () => {
+      const node = createNode<AgentV2NodeType>({
+        type: BlockEnum.Agent,
+        title: 'Agent',
+        desc: '',
+        agent_node_kind: 'dify_agent',
+        agent_task: 'Clarify {{#start.tender#}}',
+        version: '2',
+      })
+
+      expect(getNodeUsedVars(node)).toContainEqual(['start', 'tender'])
+    })
   })
 
   describe('updateNodeVars', () => {
@@ -144,6 +241,21 @@ describe('variable utils', () => {
       })
     })
 
+    it('should replace agent task references', () => {
+      const node = createNode<AgentV2NodeType>({
+        type: BlockEnum.Agent,
+        title: 'Agent',
+        desc: '',
+        agent_node_kind: 'dify_agent',
+        agent_task: 'Clarify {{#start.tender#}}',
+        version: '2',
+      })
+
+      const updatedNode = updateNodeVars(node, ['start', 'tender'], ['start', 'question'])
+
+      expect((updatedNode.data as AgentV2NodeType).agent_task).toBe('Clarify {{#start.question#}}')
+    })
+
     it('should replace human input email template references', () => {
       const node = createNode<HumanInputNodeType>({
         type: BlockEnum.HumanInput,
diff --git a/web/app/components/workflow/nodes/_base/components/variable/utils.ts b/web/app/components/workflow/nodes/_base/components/variable/utils.ts
index 80a33eecc6d..0f265b0e7ef 100644
--- a/web/app/components/workflow/nodes/_base/components/variable/utils.ts
+++ b/web/app/components/workflow/nodes/_base/components/variable/utils.ts
@@ -1,4 +1,3 @@
-import type { AgentNodeType } from '../../../agent/types'
 import type { AnswerNodeType } from '../../../answer/types'
 import type { CodeNodeType } from '../../../code/types'
 import type { DocExtractorNodeType } from '../../../document-extractor/types'
@@ -14,6 +13,8 @@ import type { ParameterExtractorNodeType } from '../../../parameter-extractor/ty
 import type { QuestionClassifierNodeType } from '../../../question-classifier/types'
 import type { TemplateTransformNodeType } from '../../../template-transform/types'
 import type { ToolNodeType } from '../../../tool/types'
+import type { AgentV2NodeType } from '@/app/components/workflow/nodes/agent-v2/types'
+import type { AgentNodeType } from '@/app/components/workflow/nodes/agent/types'
 import type { DataSourceNodeType } from '@/app/components/workflow/nodes/data-source/types'
 import type { HumanInputNodeType } from '@/app/components/workflow/nodes/human-input/types'
 import type { CaseItem, Condition } from '@/app/components/workflow/nodes/if-else/types'
@@ -51,6 +52,8 @@ import {
   TEMPLATE_TRANSFORM_OUTPUT_STRUCT,
   TOOL_OUTPUT_STRUCT,
 } from '@/app/components/workflow/constants'
+import { getAgentV2OutputVars } from '@/app/components/workflow/nodes/agent-v2/output-variables'
+import { isAgentV2NodeData } from '@/app/components/workflow/nodes/agent-v2/types'
 import DataSourceNodeDefault from '@/app/components/workflow/nodes/data-source/default'
 import HumanInputNodeDefault from '@/app/components/workflow/nodes/human-input/default'
 import { DeliveryMethodType } from '@/app/components/workflow/nodes/human-input/types'
@@ -592,6 +595,11 @@ const formatItem = (
     }
 
     case BlockEnum.Agent: {
+      if (isAgentV2NodeData(data)) {
+        res.vars = getAgentV2OutputVars(data)
+        break
+      }
+
       const payload = data as AgentNodeType
       const outputs: Var[] = []
       Object.keys(payload.output_schema?.properties || {}).forEach(
@@ -610,6 +618,11 @@ const formatItem = (
       break
     }
 
+    case BlockEnum.AgentV2: {
+      res.vars = getAgentV2OutputVars(data as AgentV2NodeType)
+      break
+    }
+
     case BlockEnum.DataSource: {
       const payload = data as DataSourceNodeType
       const dataSourceVars
@@ -1448,6 +1461,31 @@ export const getNodeUsedVars = (node: Node): ValueSelector[] => {
       res = [...(mixVars as ValueSelector[]), ...(vars as any)]
       break
     }
+    case BlockEnum.Agent: {
+      if (isAgentV2NodeData(data)) {
+        const payload = data as AgentV2NodeType
+        res = matchNotSystemVars([payload.agent_task || ''])
+        break
+      }
+
+      const payload = data as AgentNodeType
+      const valueSelectors: ValueSelector[] = []
+      if (!payload.agent_parameters)
+        break
+
+      Object.keys(payload.agent_parameters || {}).forEach((key) => {
+        const { value } = payload.agent_parameters![key]!
+        if (typeof value === 'string')
+          valueSelectors.push(...matchNotSystemVars([value]))
+      })
+      res = valueSelectors
+      break
+    }
+    case BlockEnum.AgentV2: {
+      const payload = data as AgentV2NodeType
+      res = matchNotSystemVars([payload.agent_task || ''])
+      break
+    }
     case BlockEnum.DataSource: {
       const payload = data as DataSourceNodeType
       const mixVars = matchNotSystemVars(
@@ -1507,21 +1545,6 @@ export const getNodeUsedVars = (node: Node): ValueSelector[] => {
       break
     }
 
-    case BlockEnum.Agent: {
-      const payload = data as AgentNodeType
-      const valueSelectors: ValueSelector[] = []
-      if (!payload.agent_parameters)
-        break
-
-      Object.keys(payload.agent_parameters || {}).forEach((key) => {
-        const { value } = payload.agent_parameters![key]!
-        if (typeof value === 'string')
-          valueSelectors.push(...matchNotSystemVars([value]))
-      })
-      res = valueSelectors
-      break
-    }
-
     case BlockEnum.HumanInput: {
       const payload = data as HumanInputNodeType
       const formContent = payload.form_content
@@ -1882,43 +1905,17 @@ export const updateNodeVars = (
         }
         break
       }
-      case BlockEnum.DataSource: {
-        const payload = data as DataSourceNodeType
-        const hasShouldRenameVar = Object.keys(
-          payload.datasource_parameters,
-        )?.filter(
-          key =>
-            payload.datasource_parameters[key]!.type !== ToolVarType.constant,
-        )
-        if (hasShouldRenameVar) {
-          Object.keys(payload.datasource_parameters).forEach((key) => {
-            const value = payload.datasource_parameters[key]!
-            const { type } = value!
-            if (
-              type === ToolVarType.variable
-              && value!.value.join('.') === oldVarSelector.join('.')
-            ) {
-              payload.datasource_parameters[key] = {
-                ...value,
-                value: newVarSelector,
-              }
-            }
-
-            if (type === ToolVarType.mixed) {
-              payload.datasource_parameters[key] = {
-                ...value,
-                value: replaceOldVarInText(
-                  payload.datasource_parameters[key]!.value as string,
-                  oldVarSelector,
-                  newVarSelector,
-                ),
-              }
-            }
-          })
-        }
-        break
-      }
       case BlockEnum.Agent: {
+        if (isAgentV2NodeData(data)) {
+          const payload = data as AgentV2NodeType
+          payload.agent_task = replaceOldVarInText(
+            payload.agent_task || '',
+            oldVarSelector,
+            newVarSelector,
+          )
+          break
+        }
+
         const payload = data as AgentNodeType
         if (payload.agent_parameters) {
           Object.keys(payload.agent_parameters).forEach((key) => {
@@ -1958,6 +1955,51 @@ export const updateNodeVars = (
         }
         break
       }
+      case BlockEnum.AgentV2: {
+        const payload = data as AgentV2NodeType
+        payload.agent_task = replaceOldVarInText(
+          payload.agent_task || '',
+          oldVarSelector,
+          newVarSelector,
+        )
+        break
+      }
+      case BlockEnum.DataSource: {
+        const payload = data as DataSourceNodeType
+        const hasShouldRenameVar = Object.keys(
+          payload.datasource_parameters,
+        )?.filter(
+          key =>
+            payload.datasource_parameters[key]!.type !== ToolVarType.constant,
+        )
+        if (hasShouldRenameVar) {
+          Object.keys(payload.datasource_parameters).forEach((key) => {
+            const value = payload.datasource_parameters[key]!
+            const { type } = value!
+            if (
+              type === ToolVarType.variable
+              && value!.value.join('.') === oldVarSelector.join('.')
+            ) {
+              payload.datasource_parameters[key] = {
+                ...value,
+                value: newVarSelector,
+              }
+            }
+
+            if (type === ToolVarType.mixed) {
+              payload.datasource_parameters[key] = {
+                ...value,
+                value: replaceOldVarInText(
+                  payload.datasource_parameters[key]!.value as string,
+                  oldVarSelector,
+                  newVarSelector,
+                ),
+              }
+            }
+          })
+        }
+        break
+      }
       case BlockEnum.VariableAssigner: {
         const payload = data as VariableAssignerNodeType
         if (payload.variables) {
diff --git a/web/app/components/workflow/nodes/_base/components/workflow-panel/__tests__/index.spec.tsx b/web/app/components/workflow/nodes/_base/components/workflow-panel/__tests__/index.spec.tsx
index 8137b0ff3a6..97c055a8534 100644
--- a/web/app/components/workflow/nodes/_base/components/workflow-panel/__tests__/index.spec.tsx
+++ b/web/app/components/workflow/nodes/_base/components/workflow-panel/__tests__/index.spec.tsx
@@ -16,6 +16,8 @@ const mockHandleSingleRun = vi.fn()
 const mockHandleStop = vi.fn()
 const mockHandleRunWithParams = vi.fn()
 let mockShowMessageLogModal = false
+let mockNodesReadOnly = false
+let mockCanRun = true
 let mockBuiltInTools = [{
   id: 'provider/tool',
   name: 'Tool',
@@ -28,6 +30,14 @@ const mockLogsState = {
   showSpecialResultPanel: false,
 }
 
+const createMockSingleRunParams = () => ({
+  forms: [],
+  onStop: vi.fn(),
+  runningStatus: NodeRunningStatus.Succeeded,
+  existVarValuesInForms: [],
+  filteredExistVarForms: [],
+})
+
 const mockLastRunState = {
   isShowSingleRun: false,
   hideSingleRun: vi.fn(),
@@ -43,13 +53,7 @@ const mockLastRunState = {
   setIsRunAfterSingleRun: vi.fn(),
   setTabType: vi.fn(),
   handleAfterCustomSingleRun: vi.fn(),
-  singleRunParams: {
-    forms: [],
-    onStop: vi.fn(),
-    runningStatus: NodeRunningStatus.Succeeded,
-    existVarValuesInForms: [],
-    filteredExistVarForms: [],
-  },
+  singleRunParams: createMockSingleRunParams(),
   nodeInfo: { id: 'node-1' },
   setRunInputData: vi.fn(),
   handleStop: () => mockHandleStop(),
@@ -113,7 +117,7 @@ vi.mock('@/app/components/workflow/hooks', () => ({
     },
   }),
   useNodesReadOnly: () => ({
-    nodesReadOnly: false,
+    nodesReadOnly: mockNodesReadOnly,
   }),
   useToolIcon: () => undefined,
   useWorkflowHistory: () => ({
@@ -126,11 +130,14 @@ vi.mock('@/app/components/workflow/hooks', () => ({
 }))
 
 vi.mock('@/app/components/workflow/hooks-store', () => ({
-  useHooksStore: (selector: (state: { configsMap: { flowId: string, flowType: string } }) => unknown) => selector({
+  useHooksStore: (selector: (state: { configsMap: { flowId: string, flowType: string }, accessControl: { canRun: boolean } }) => unknown) => selector({
     configsMap: {
       flowId: 'flow-1',
       flowType: 'app',
     },
+    accessControl: {
+      canRun: mockCanRun,
+    },
   }),
 }))
 
@@ -296,6 +303,8 @@ describe('workflow-panel index', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockShowMessageLogModal = false
+    mockNodesReadOnly = false
+    mockCanRun = true
     mockBuiltInTools = [{
       id: 'provider/tool',
       name: 'Tool',
@@ -306,6 +315,7 @@ describe('workflow-panel index', () => {
     mockLogsState.showSpecialResultPanel = false
     mockLastRunState.isShowSingleRun = false
     mockLastRunState.tabType = 'settings'
+    mockLastRunState.singleRunParams = createMockSingleRunParams()
   })
 
   it('should render the settings panel and wire title, description, run, and close actions', async () => {
@@ -348,6 +358,42 @@ describe('workflow-panel index', () => {
     }))
   })
 
+  it('should hide the single-run action when nodes are readonly even with run permission', () => {
+    mockNodesReadOnly = true
+
+    renderWorkflowComponent(
+      <BasePanel id="node-1" data={createData() as never}>
+        <div>panel-child</div>
+      </BasePanel>,
+      {
+        initialStoreState: {
+          nodePanelWidth: 480,
+          otherPanelWidth: 200,
+        },
+      },
+    )
+
+    expect(screen.queryByRole('button', { name: 'workflow.panel.runThisStep' })).not.toBeInTheDocument()
+  })
+
+  it('should hide the single-run action when run permission is missing', () => {
+    mockCanRun = false
+
+    renderWorkflowComponent(
+      <BasePanel id="node-1" data={createData() as never}>
+        <div>panel-child</div>
+      </BasePanel>,
+      {
+        initialStoreState: {
+          nodePanelWidth: 480,
+          otherPanelWidth: 200,
+        },
+      },
+    )
+
+    expect(screen.queryByRole('button', { name: 'workflow.panel.runThisStep' })).not.toBeInTheDocument()
+  })
+
   it('should render the special result panel when logs request it', () => {
     mockLogsState.showSpecialResultPanel = true
 
@@ -460,6 +506,26 @@ describe('workflow-panel index', () => {
     expect(screen.getByText('data-source-before-run-form')).toBeInTheDocument()
   })
 
+  it('should keep the settings panel visible when single-run params have no forms', () => {
+    mockLastRunState.isShowSingleRun = true
+    mockLastRunState.singleRunParams = {} as ReturnType<typeof createMockSingleRunParams>
+
+    renderWorkflowComponent(
+      <BasePanel id="node-agent" data={createData({ type: BlockEnum.Agent }) as never}>
+        <div>panel-child</div>
+      </BasePanel>,
+      {
+        initialStoreState: {
+          nodePanelWidth: 480,
+          otherPanelWidth: 200,
+        },
+      },
+    )
+
+    expect(screen.queryByText('before-run-form')).not.toBeInTheDocument()
+    expect(screen.getByText('panel-child')).toBeInTheDocument()
+  })
+
   it('should render data source authorization controls and jump to the settings modal', () => {
     renderWorkflowComponent(
       <BasePanel id="node-1" data={createData({ type: BlockEnum.DataSource, plugin_id: 'source-1', provider_type: 'remote' }) as never}>
diff --git a/web/app/components/workflow/nodes/_base/components/workflow-panel/index.tsx b/web/app/components/workflow/nodes/_base/components/workflow-panel/index.tsx
index 5ac6fa2f8d6..f30c428890e 100644
--- a/web/app/components/workflow/nodes/_base/components/workflow-panel/index.tsx
+++ b/web/app/components/workflow/nodes/_base/components/workflow-panel/index.tsx
@@ -1,4 +1,4 @@
-import type { FC, ReactNode } from 'react'
+import type { CSSProperties, FC, ReactNode } from 'react'
 import type { SimpleSubscription } from '@/app/components/plugins/plugin-detail-panel/subscription-list'
 import type { Node } from '@/app/components/workflow/types'
 import { cn } from '@langgenius/dify-ui/cn'
@@ -13,7 +13,6 @@ import {
   RiPlayLargeLine,
 } from '@remixicon/react'
 import { debounce } from 'es-toolkit/compat'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import * as React from 'react'
 import {
   cloneElement,
@@ -58,12 +57,14 @@ import { useHooksStore } from '@/app/components/workflow/hooks-store'
 import useInspectVarsCrud from '@/app/components/workflow/hooks/use-inspect-vars-crud'
 import { NodeActionsDropdown } from '@/app/components/workflow/node-actions-menu'
 import Split from '@/app/components/workflow/nodes/_base/components/split'
+import { useSetWorkflowNodePanelWidth } from '@/app/components/workflow/persistence/local-storage-options'
 import { useLogs } from '@/app/components/workflow/run/hooks'
 import SpecialResultPanel from '@/app/components/workflow/run/special-result-panel'
 import { useStore } from '@/app/components/workflow/store'
 import { BlockEnum, NodeRunningStatus } from '@/app/components/workflow/types'
 import {
   canRunBySingle,
+  getNodeCatalogType,
   hasErrorHandleNode,
   hasRetryNode,
   isSupportCustomRunForm,
@@ -164,7 +165,7 @@ const BasePanel: FC<BasePanelProps> = ({
   const setNodePanelWidth = useStore(s => s.setNodePanelWidth)
   const pendingSingleRun = useStore(s => s.pendingSingleRun)
   const setPendingSingleRun = useStore(s => s.setPendingSingleRun)
-  const setNodePanelWidthStorage = useSetLocalStorage<string>('workflow-node-panel-width', { raw: true })
+  const setNodePanelWidthStorage = useSetWorkflowNodePanelWidth()
 
   const reservedCanvasWidth = 400 // Reserve the minimum visible width for the canvas
 
@@ -177,7 +178,7 @@ const BasePanel: FC<BasePanelProps> = ({
     const newValue = clampNodePanelWidth(width, maxNodePanelWidth)
 
     if (source === 'user')
-      setNodePanelWidthStorage(`${newValue}`)
+      setNodePanelWidthStorage(newValue)
 
     setNodePanelWidth(newValue)
   }, [maxNodePanelWidth, setNodePanelWidth, setNodePanelWidthStorage])
@@ -209,7 +210,7 @@ const BasePanel: FC<BasePanelProps> = ({
 
   const { handleNodeSelect } = useNodesInteractions()
   const { nodesReadOnly } = useNodesReadOnly()
-  const { availableNextBlocks } = useAvailableBlocks(data.type, data.isInIteration || data.isInLoop)
+  const { availableNextBlocks } = useAvailableBlocks(getNodeCatalogType(data), data.isInIteration || data.isInLoop)
   const toolIcon = useToolIcon(data)
 
   const { saveStateToHistory } = useWorkflowHistory()
@@ -229,6 +230,7 @@ const BasePanel: FC<BasePanelProps> = ({
   }, [handleNodeDataUpdateWithSyncDraft, id, saveStateToHistory])
 
   const isChildNode = !!(data.isInIteration || data.isInLoop)
+  const nodeMetaType = getNodeCatalogType(data)
   const isSupportSingleRun = canRunBySingle(data.type, isChildNode)
   const appDetail = useAppStore(state => state.appDetail)
 
@@ -265,6 +267,7 @@ const BasePanel: FC<BasePanelProps> = ({
   } = useNodesMetaData()
 
   const configsMap = useHooksStore(s => s.configsMap)
+  const canRun = useHooksStore(s => s.accessControl.canRun)
   const {
     isShowSingleRun,
     hideSingleRun,
@@ -293,7 +296,7 @@ const BasePanel: FC<BasePanelProps> = ({
     flowId: configsMap?.flowId || '',
     flowType: configsMap?.flowType || FlowType.appFlow,
     data,
-    defaultRunInputData: nodesMap?.[data.type]?.defaultRunInputData || {},
+    defaultRunInputData: nodesMap?.[nodeMetaType]?.defaultRunInputData || {},
     isPaused,
   })
 
@@ -405,6 +408,11 @@ const BasePanel: FC<BasePanelProps> = ({
     id,
     data,
   }) as Node, [id, data])
+  const singleRunForms = singleRunParams?.forms
+  const isCustomRunFormNode = isSupportCustomRunForm(data.type)
+  const shouldRenderSingleRunPanel = isShowSingleRun && (isCustomRunFormNode || !!singleRunForms)
+  const isSingleRunPanelVisible = showSingleRunPanel && shouldRenderSingleRunPanel
+
   if (logParams.showSpecialResultPanel) {
     return (
       <div className={cn(
@@ -413,7 +421,7 @@ const BasePanel: FC<BasePanelProps> = ({
       >
         <div
           ref={containerRef}
-          className={cn('flex h-full flex-col rounded-2xl border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-lg', showSingleRunPanel ? 'overflow-hidden' : 'overflow-y-auto')}
+          className={cn('flex h-full flex-col rounded-2xl border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-lg', isSingleRunPanelVisible ? 'overflow-hidden' : 'overflow-y-auto')}
           style={{
             width: `${nodePanelWidth}px`,
           }}
@@ -431,20 +439,39 @@ const BasePanel: FC<BasePanelProps> = ({
     )
   }
 
-  if (isShowSingleRun) {
-    const form = getCustomRunForm({
-      nodeId: id,
-      flowId: configsMap?.flowId || '',
-      flowType: configsMap?.flowType || FlowType.appFlow,
-      payload: data,
-      setRunResult,
-      setIsRunAfterSingleRun,
-      isPaused,
-      isRunAfterSingleRun,
-      onSuccess: handleAfterCustomSingleRun,
-      onCancel: hideSingleRun,
-      appendNodeInspectVars,
-    })
+  if (shouldRenderSingleRunPanel) {
+    const customRunForm = isCustomRunFormNode
+      ? getCustomRunForm({
+          nodeId: id,
+          flowId: configsMap?.flowId || '',
+          flowType: configsMap?.flowType || FlowType.appFlow,
+          payload: data,
+          setRunResult,
+          setIsRunAfterSingleRun,
+          isPaused,
+          isRunAfterSingleRun,
+          onSuccess: handleAfterCustomSingleRun,
+          onCancel: hideSingleRun,
+          appendNodeInspectVars,
+        })
+      : null
+    const singleRunPanelContent = isCustomRunFormNode
+      ? customRunForm
+      : singleRunForms
+        ? (
+            <BeforeRunForm
+              nodeName={data.title}
+              nodeType={data.type}
+              onHide={hideSingleRun}
+              onRun={handleRunWithParams}
+              {...singleRunParams!}
+              {...passedLogParams}
+              existVarValuesInForms={getExistVarValuesInForms(singleRunForms)}
+              filteredExistVarForms={getFilteredExistVarForms(singleRunForms)}
+              handleAfterHumanInputStepRun={handleAfterCustomSingleRun}
+            />
+          )
+        : null
 
     return (
       <div className={cn(
@@ -453,29 +480,12 @@ const BasePanel: FC<BasePanelProps> = ({
       >
         <div
           ref={containerRef}
-          className={cn('flex h-full flex-col rounded-2xl border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-lg', showSingleRunPanel ? 'overflow-hidden' : 'overflow-y-auto')}
+          className={cn('flex h-full flex-col rounded-2xl border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-lg', isSingleRunPanelVisible ? 'overflow-hidden' : 'overflow-y-auto')}
           style={{
             width: `${nodePanelWidth}px`,
           }}
         >
-          {isSupportCustomRunForm(data.type)
-            ? (
-                form
-              )
-            : (
-                <BeforeRunForm
-                  nodeName={data.title}
-                  nodeType={data.type}
-                  onHide={hideSingleRun}
-                  onRun={handleRunWithParams}
-                  {...singleRunParams!}
-                  {...passedLogParams}
-                  existVarValuesInForms={getExistVarValuesInForms(singleRunParams?.forms as any)}
-                  filteredExistVarForms={getFilteredExistVarForms(singleRunParams?.forms as any)}
-                  handleAfterHumanInputStepRun={handleAfterCustomSingleRun}
-                />
-              )}
-
+          {singleRunPanelContent}
         </div>
       </div>
     )
@@ -485,6 +495,9 @@ const BasePanel: FC<BasePanelProps> = ({
   const singleRunActionLabel = isSingleRunning
     ? t('debug.variableInspect.trigger.stop', { ns: 'workflow' })
     : runThisStepLabel
+  const nodePanelRightOffset = !showMessageLogModal
+    ? '4px'
+    : `${otherPanelWidth + 8}px`
   const isStartPlaceholderPanel = data.type === BlockEnum.StartPlaceholder
   const panelChildren = cloneElement(children as any, {
     id,
@@ -517,8 +530,9 @@ const BasePanel: FC<BasePanelProps> = ({
         showMessageLogModal && 'absolute z-0 mr-2 w-[400px] overflow-hidden rounded-2xl border-[0.5px] border-components-panel-border shadow-lg transition-all',
       )}
       style={{
-        right: !showMessageLogModal ? '0' : `${otherPanelWidth}px`,
-      }}
+        'right': !showMessageLogModal ? '0' : `${otherPanelWidth}px`,
+        '--workflow-node-panel-right': nodePanelRightOffset,
+      } as CSSProperties}
     >
       <div
         ref={triggerRef}
@@ -530,10 +544,11 @@ const BasePanel: FC<BasePanelProps> = ({
         ref={containerRef}
         value={tabType}
         onValueChange={selectedValue => setTabType(selectedValue)}
-        className={cn('flex h-full flex-col rounded-2xl border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-lg transition-[width] ease-linear', showSingleRunPanel ? 'overflow-hidden' : 'overflow-y-auto')}
+        className={cn('flex h-full flex-col rounded-2xl border-[0.5px] border-components-panel-border bg-components-panel-bg shadow-lg transition-[width] ease-linear', isSingleRunPanelVisible ? 'overflow-hidden' : 'overflow-y-auto')}
         style={{
-          width: `${nodePanelWidth}px`,
-        }}
+          'width': `${nodePanelWidth}px`,
+          '--workflow-node-panel-width': `${nodePanelWidth}px`,
+        } as CSSProperties}
       >
         <div className="sticky top-0 z-10 shrink-0 border-b-[0.5px] border-divider-regular bg-components-panel-bg">
           <div className="flex items-center px-4 pt-4 pb-1">
@@ -566,7 +581,7 @@ const BasePanel: FC<BasePanelProps> = ({
             )}
             <div className="flex shrink-0 items-center text-text-tertiary">
               {
-                isSupportSingleRun && !nodesReadOnly && (
+                isSupportSingleRun && canRun && !nodesReadOnly && (
                   <Tooltip disabled={isSingleRunning}>
                     <TooltipTrigger
                       render={(
@@ -595,7 +610,7 @@ const BasePanel: FC<BasePanelProps> = ({
                   </Tooltip>
                 )
               }
-              <HelpLink nodeType={data.type} />
+              <HelpLink nodeType={nodeMetaType} />
               <NodeActionsDropdown id={id} data={data} showHelpLink={false} />
               <div className="mx-3 h-3.5 w-px bg-divider-regular" />
               <button
diff --git a/web/app/components/workflow/nodes/_base/components/workflow-panel/last-run/use-last-run.ts b/web/app/components/workflow/nodes/_base/components/workflow-panel/last-run/use-last-run.ts
index a538bcf29e3..fb38aaaf4d5 100644
--- a/web/app/components/workflow/nodes/_base/components/workflow-panel/last-run/use-last-run.ts
+++ b/web/app/components/workflow/nodes/_base/components/workflow-panel/last-run/use-last-run.ts
@@ -10,7 +10,6 @@ import {
 import { useWorkflowRunValidation } from '@/app/components/workflow/hooks/use-checklist'
 import useInspectVarsCrud from '@/app/components/workflow/hooks/use-inspect-vars-crud'
 import useOneStepRun from '@/app/components/workflow/nodes/_base/hooks/use-one-step-run'
-import useAgentSingleRunFormParams from '@/app/components/workflow/nodes/agent/use-single-run-form-params'
 import useVariableAssignerSingleRunFormParams from '@/app/components/workflow/nodes/assigner/use-single-run-form-params'
 import useCodeSingleRunFormParams from '@/app/components/workflow/nodes/code/use-single-run-form-params'
 import useDocExtractorSingleRunFormParams from '@/app/components/workflow/nodes/document-extractor/use-single-run-form-params'
@@ -50,7 +49,8 @@ const singleRunFormParamsHooks: Record<BlockEnum, any> = {
   [BlockEnum.Tool]: useToolSingleRunFormParams,
   [BlockEnum.ParameterExtractor]: useParameterExtractorSingleRunFormParams,
   [BlockEnum.Iteration]: useIterationSingleRunFormParams,
-  [BlockEnum.Agent]: useAgentSingleRunFormParams,
+  [BlockEnum.Agent]: undefined,
+  [BlockEnum.AgentV2]: undefined,
   [BlockEnum.DocExtractor]: useDocExtractorSingleRunFormParams,
   [BlockEnum.Loop]: useLoopSingleRunFormParams,
   [BlockEnum.Start]: useStartSingleRunFormParams,
@@ -91,6 +91,7 @@ const getDataForCheckMoreHooks: Record<BlockEnum, any> = {
   [BlockEnum.ParameterExtractor]: undefined,
   [BlockEnum.Iteration]: undefined,
   [BlockEnum.Agent]: undefined,
+  [BlockEnum.AgentV2]: undefined,
   [BlockEnum.DocExtractor]: undefined,
   [BlockEnum.Loop]: undefined,
   [BlockEnum.Start]: undefined,
diff --git a/web/app/components/workflow/nodes/agent-v2/__tests__/default.spec.ts b/web/app/components/workflow/nodes/agent-v2/__tests__/default.spec.ts
new file mode 100644
index 00000000000..ed7d9b23395
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/__tests__/default.spec.ts
@@ -0,0 +1,110 @@
+import type { AgentV2NodeType } from '../types'
+import { BlockEnum } from '@/app/components/workflow/types'
+import nodeDefault from '../default'
+import { isAgentV2NodeData } from '../types'
+
+const t = vi.fn((key: string, options?: Record<string, unknown>) => {
+  if (key === 'errorMsg.fieldRequired')
+    return `required:${options?.field}`
+
+  if (key === 'nodes.agent.roster.label')
+    return 'Agent'
+
+  return key
+})
+
+const createPayload = (overrides: Partial<AgentV2NodeType> = {}): AgentV2NodeType => ({
+  title: 'Agent',
+  desc: '',
+  type: BlockEnum.AgentV2,
+  agent_binding: {
+    binding_type: 'roster_agent',
+    agent_id: 'agent-1',
+  },
+  agent_node_kind: 'dify_agent',
+  version: '2',
+  ...overrides,
+})
+
+describe('agent/default', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('requires a roster agent id', () => {
+    const result = nodeDefault.checkValid(createPayload({
+      agent_binding: {
+        binding_type: 'roster_agent',
+        agent_id: '',
+      },
+    }), t)
+
+    expect(result).toEqual({
+      isValid: false,
+      errorMessage: 'required:Agent',
+    })
+  })
+
+  it('requires a roster agent binding', () => {
+    const result = nodeDefault.checkValid(createPayload({ agent_binding: undefined }), t)
+
+    expect(result).toEqual({
+      isValid: false,
+      errorMessage: 'required:Agent',
+    })
+  })
+
+  it('passes validation when a roster agent binding is selected', () => {
+    const result = nodeDefault.checkValid(createPayload(), t)
+
+    expect(result).toEqual({
+      isValid: true,
+      errorMessage: '',
+    })
+  })
+
+  it('requires complete inline agent binding', () => {
+    const result = nodeDefault.checkValid(createPayload({
+      agent_binding: {
+        binding_type: 'inline_agent',
+      },
+    }), t)
+
+    expect(result).toEqual({
+      isValid: false,
+      errorMessage: 'required:Agent',
+    })
+  })
+
+  it('passes validation for complete inline agent binding', () => {
+    const result = nodeDefault.checkValid(createPayload({
+      agent_binding: {
+        binding_type: 'inline_agent',
+        agent_id: 'inline-agent-1',
+        current_snapshot_id: 'inline-snapshot-1',
+      },
+    }), t)
+
+    expect(result).toEqual({
+      isValid: true,
+      errorMessage: '',
+    })
+  })
+
+  it('creates Agent v2 graph data by default', () => {
+    expect(nodeDefault.defaultValue).toMatchObject({
+      agent_node_kind: 'dify_agent',
+      version: '2',
+    })
+  })
+
+  it('identifies version 2 agent data as Agent v2', () => {
+    expect(isAgentV2NodeData(createPayload({ type: BlockEnum.Agent }))).toBe(true)
+    expect(isAgentV2NodeData({
+      title: 'Agent',
+      desc: '',
+      type: BlockEnum.Agent,
+      version: '2',
+    } as Parameters<typeof isAgentV2NodeData>[0])).toBe(false)
+  })
+})
diff --git a/web/app/components/workflow/nodes/agent-v2/__tests__/hooks.spec.tsx b/web/app/components/workflow/nodes/agent-v2/__tests__/hooks.spec.tsx
new file mode 100644
index 00000000000..16963ba9011
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/__tests__/hooks.spec.tsx
@@ -0,0 +1,280 @@
+import { QueryClient } from '@tanstack/react-query'
+import { act, waitFor } from '@testing-library/react'
+import { FlowType } from '@/types/common'
+import { renderWorkflowHook } from '../../../__tests__/workflow-test-env'
+import { useWorkflowInlineAgentConfigureSync } from '../agent-soul-config'
+import { useCreateInlineAgentBinding } from '../hooks'
+
+const mockDefaultModel = vi.hoisted(() => ({
+  value: {
+    model: 'gpt-4o-mini',
+    model_type: 'llm',
+    provider: {
+      provider: 'langgenius/openai/openai',
+      icon_small: {
+        en_US: 'openai',
+        zh_Hans: 'openai',
+      },
+    },
+  },
+}))
+const mockComposerMutationFn = vi.hoisted(() => vi.fn(async (variables: unknown) => ({
+  agent_soul: (variables as {
+    body?: {
+      agent_soul?: unknown
+    }
+  }).body?.agent_soul,
+  binding: {
+    binding_type: 'inline_agent',
+    agent_id: 'inline-agent-1',
+    current_snapshot_id: 'inline-snapshot-1',
+  },
+  variables,
+})))
+const mockComposerMutationOptions = vi.hoisted(() => vi.fn(() => ({
+  mutationFn: mockComposerMutationFn,
+})))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    error: vi.fn(),
+  },
+}))
+
+vi.mock('@/app/components/header/account-setting/model-provider-page/hooks', () => ({
+  useDefaultModel: () => ({
+    data: mockDefaultModel.value,
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        get: {
+          queryOptions: vi.fn(),
+        },
+      },
+    },
+    apps: {
+      byAppId: {
+        workflows: {
+          draft: {
+            nodes: {
+              byNodeId: {
+                agentComposer: {
+                  get: {
+                    queryKey: ({ input }: { input: { params: { app_id: string, node_id: string } } }) => [
+                      'workflow-agent-composer',
+                      input.params.app_id,
+                      input.params.node_id,
+                    ],
+                  },
+                  put: {
+                    mutationOptions: mockComposerMutationOptions,
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+}))
+
+describe('useCreateInlineAgentBinding', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockDefaultModel.value = {
+      model: 'gpt-4o-mini',
+      model_type: 'llm',
+      provider: {
+        provider: 'langgenius/openai/openai',
+        icon_small: {
+          en_US: 'openai',
+          zh_Hans: 'openai',
+        },
+      },
+    }
+  })
+
+  it('creates inline agent with the default text generation model', async () => {
+    const onSuccess = vi.fn()
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        mutations: {
+          retry: false,
+        },
+      },
+    })
+    const { result } = renderWorkflowHook(() => useCreateInlineAgentBinding(), {
+      queryClient,
+      hooksStoreProps: {
+        configsMap: {
+          flowId: 'app-1',
+          flowType: FlowType.appFlow,
+          fileSettings: {} as never,
+        },
+      },
+    })
+
+    act(() => {
+      result.current.createInlineAgentBinding('node-1', { onSuccess })
+    })
+
+    await waitFor(() => expect(mockComposerMutationFn).toHaveBeenCalled())
+    expect(mockComposerMutationFn).toHaveBeenCalledWith({
+      params: {
+        app_id: 'app-1',
+        node_id: 'node-1',
+      },
+      body: {
+        variant: 'workflow',
+        save_strategy: 'node_job_only',
+        soul_lock: {
+          locked: false,
+        },
+        agent_soul: {
+          schema_version: 1,
+          prompt: {
+            system_prompt: '',
+          },
+          model: {
+            model_provider: 'langgenius/openai/openai',
+            model: 'gpt-4o-mini',
+            plugin_id: 'langgenius/openai',
+          },
+        },
+      },
+    }, expect.any(Object))
+    await waitFor(() => expect(onSuccess).toHaveBeenCalledWith({
+      binding_type: 'inline_agent',
+      agent_id: 'inline-agent-1',
+      current_snapshot_id: 'inline-snapshot-1',
+    }))
+  })
+
+  it('creates inline agent with a model-less initial soul before the default model loads', async () => {
+    mockDefaultModel.value = undefined as never
+    const onSuccess = vi.fn()
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        mutations: {
+          retry: false,
+        },
+      },
+    })
+    const { result } = renderWorkflowHook(() => useCreateInlineAgentBinding(), {
+      queryClient,
+      hooksStoreProps: {
+        configsMap: {
+          flowId: 'app-1',
+          flowType: FlowType.appFlow,
+          fileSettings: {} as never,
+        },
+      },
+    })
+
+    act(() => {
+      result.current.createInlineAgentBinding('node-1', { onSuccess })
+    })
+
+    await waitFor(() => expect(mockComposerMutationFn).toHaveBeenCalled())
+    expect(mockComposerMutationFn).toHaveBeenCalledWith({
+      params: {
+        app_id: 'app-1',
+        node_id: 'node-1',
+      },
+      body: {
+        variant: 'workflow',
+        save_strategy: 'node_job_only',
+        soul_lock: {
+          locked: false,
+        },
+        agent_soul: {
+          schema_version: 1,
+          prompt: {
+            system_prompt: '',
+          },
+        },
+      },
+    }, expect.any(Object))
+    await waitFor(() => expect(onSuccess).toHaveBeenCalledWith({
+      binding_type: 'inline_agent',
+      agent_id: 'inline-agent-1',
+      current_snapshot_id: 'inline-snapshot-1',
+    }))
+  })
+})
+
+describe('useWorkflowInlineAgentConfigureSync', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('saves inline agent composer changes through the workflow node composer API', async () => {
+    vi.setSystemTime(1710000300000)
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+        },
+        mutations: {
+          retry: false,
+        },
+      },
+    })
+    const { result } = renderWorkflowHook(() => useWorkflowInlineAgentConfigureSync({
+      nodeId: 'node-1',
+      baseConfig: {
+        schema_version: 1,
+      },
+      currentModel: {
+        provider: 'langgenius/openai/openai',
+        model: 'gpt-4o-mini',
+      },
+      enabled: true,
+    }), {
+      queryClient,
+      hooksStoreProps: {
+        configsMap: {
+          flowId: 'app-1',
+          flowType: FlowType.appFlow,
+          fileSettings: {} as never,
+        },
+      },
+    })
+
+    await act(async () => {
+      await result.current.saveDraft()
+    })
+
+    expect(mockComposerMutationFn).toHaveBeenCalledWith({
+      params: {
+        app_id: 'app-1',
+        node_id: 'node-1',
+      },
+      body: expect.objectContaining({
+        variant: 'workflow',
+        save_strategy: 'node_job_only',
+        agent_soul: expect.objectContaining({
+          schema_version: 1,
+          prompt: expect.objectContaining({
+            system_prompt: '',
+          }),
+          model: expect.objectContaining({
+            model_provider: 'langgenius/openai/openai',
+            model: 'gpt-4o-mini',
+          }),
+        }),
+      }),
+    }, expect.any(Object))
+    await waitFor(() => expect(result.current.draftSavedAt).toBe(1710000300000))
+    expect(queryClient.getQueryData(['workflow-agent-composer', 'app-1', 'node-1'])).toEqual(expect.objectContaining({
+      agent_soul: expect.objectContaining({
+        schema_version: 1,
+      }),
+    }))
+  })
+})
diff --git a/web/app/components/workflow/nodes/agent-v2/__tests__/node.spec.tsx b/web/app/components/workflow/nodes/agent-v2/__tests__/node.spec.tsx
new file mode 100644
index 00000000000..f1799608382
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/__tests__/node.spec.tsx
@@ -0,0 +1,186 @@
+import type { ReactNode } from 'react'
+import type { AgentV2NodeType } from '../types'
+import { render, screen } from '@testing-library/react'
+import { BlockEnum } from '@/app/components/workflow/types'
+import { AgentV2Node } from '../node'
+
+const {
+  mockUseAgentRosterDetail,
+  mockUseWorkflowInlineAgentDetail,
+} = vi.hoisted(() => ({
+  mockUseAgentRosterDetail: vi.fn(),
+  mockUseWorkflowInlineAgentDetail: vi.fn(),
+}))
+
+vi.mock('../../_base/components/setting-item', () => ({
+  SettingItem: ({
+    label,
+    status,
+    tooltip,
+    children,
+  }: {
+    label: ReactNode
+    status?: string
+    tooltip?: string
+    children?: ReactNode
+  }) => (
+    <div>
+      {`${label}:${status || 'normal'}:${tooltip || ''}`}
+      {children}
+    </div>
+  ),
+}))
+
+vi.mock('../hooks', () => ({
+  useAgentRosterDetail: (agentId?: string) => mockUseAgentRosterDetail(agentId),
+  useWorkflowInlineAgentDetail: (nodeId?: string, agentId?: string | null) => mockUseWorkflowInlineAgentDetail(nodeId, agentId),
+}))
+
+const createData = (overrides: Partial<AgentV2NodeType> = {}): AgentV2NodeType => ({
+  title: 'Agent',
+  desc: '',
+  type: BlockEnum.AgentV2,
+  agent_binding: {
+    binding_type: 'roster_agent',
+    agent_id: 'agent-1',
+  },
+  agent_node_kind: 'dify_agent',
+  version: '2',
+  ...overrides,
+})
+
+describe('agent/node', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUseAgentRosterDetail.mockImplementation((agentId?: string) => ({
+      isPending: false,
+      data: agentId
+        ? {
+            id: agentId,
+            name: 'Nadia',
+            description: 'Clarification Drafter',
+            icon: 'N',
+            icon_background: '#E9D7FE',
+            icon_type: 'emoji',
+          }
+        : undefined,
+    }))
+    mockUseWorkflowInlineAgentDetail.mockImplementation((nodeId?: string, agentId?: string | null) => ({
+      isPending: false,
+      data: nodeId && agentId
+        ? {
+            agent: {
+              id: agentId,
+              name: 'Workflow Agent 1',
+              description: '',
+              scope: 'workflow_only',
+              status: 'active',
+            },
+          }
+        : undefined,
+    }))
+  })
+
+  it('renders the selected roster agent', () => {
+    const { container } = render(
+      <AgentV2Node
+        id="agent-node"
+        data={createData()}
+      />,
+    )
+
+    expect(screen.getByText('workflow.nodes.agent.roster.label')).toHaveClass('px-2.5', 'py-0.5', 'system-2xs-medium-uppercase')
+    expect(screen.getByText('Nadia')).toHaveClass('system-xs-regular', 'text-text-secondary')
+    expect(container.querySelector('.bg-workflow-block-parma-bg')).toHaveClass('gap-1', 'rounded-lg', 'p-1')
+    expect(container.querySelector('.h-1.px-3')).not.toBeInTheDocument()
+  })
+
+  it('renders a stable roster placeholder while agent detail is loading', () => {
+    mockUseAgentRosterDetail.mockReturnValue({ data: undefined })
+
+    const { container } = render(
+      <AgentV2Node
+        id="agent-node"
+        data={createData()}
+      />,
+    )
+
+    expect(container.querySelector('.bg-workflow-block-parma-bg')).toBeInTheDocument()
+    expect(container.querySelector('.h-2.w-20')).toBeInTheDocument()
+  })
+
+  it('renders the inline setup agent style', () => {
+    const { container } = render(
+      <AgentV2Node
+        id="agent-node"
+        data={createData({
+          agent_binding: {
+            binding_type: 'inline_agent',
+          },
+        })}
+      />,
+    )
+
+    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.name')).toHaveClass('system-xs-regular', 'text-text-secondary')
+    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.type')).toHaveClass('system-2xs-regular', 'text-text-tertiary')
+    const robotIcon = container.querySelector('.i-custom-vender-agent-v2-robot-3')
+    expect(robotIcon).toHaveClass('size-5')
+    expect(robotIcon?.parentElement).toHaveClass('size-8', 'rounded-full', 'bg-background-default-burn')
+  })
+
+  it('renders inline agent name from workflow composer state', () => {
+    render(
+      <AgentV2Node
+        id="agent-node"
+        data={createData({
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'snapshot-1',
+          },
+        })}
+      />,
+    )
+
+    expect(mockUseAgentRosterDetail).toHaveBeenCalledWith(undefined)
+    expect(mockUseWorkflowInlineAgentDetail).toHaveBeenCalledWith('agent-node', 'inline-agent-1')
+    expect(screen.getByText('Workflow Agent 1')).toHaveClass('system-xs-regular', 'text-text-secondary')
+    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.type')).toHaveClass('system-2xs-regular', 'text-text-tertiary')
+  })
+
+  it('renders a stable inline placeholder while agent detail is loading', () => {
+    mockUseWorkflowInlineAgentDetail.mockReturnValue({
+      isPending: true,
+      data: undefined,
+    })
+
+    const { container } = render(
+      <AgentV2Node
+        id="agent-node"
+        data={createData({
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'snapshot-1',
+          },
+        })}
+      />,
+    )
+
+    expect(screen.queryByText('workflow.nodes.agent.roster.inlineSetup.name')).not.toBeInTheDocument()
+    expect(container.querySelector('.bg-workflow-block-parma-bg')).toBeInTheDocument()
+    expect(container.querySelector('.size-8.shrink-0.rounded-full.bg-text-quaternary\\/20')).toBeInTheDocument()
+    expect(container.querySelector('.h-2.w-20')).toBeInTheDocument()
+  })
+
+  it('renders an error state when no roster agent is selected', () => {
+    render(
+      <AgentV2Node
+        id="agent-node"
+        data={createData({ agent_binding: undefined })}
+      />,
+    )
+
+    expect(screen.getByText(/workflow.nodes.agent.roster.label:error:/)).toHaveTextContent('workflow.errorMsg.fieldRequired')
+  })
+})
diff --git a/web/app/components/workflow/nodes/agent-v2/__tests__/panel.spec.tsx b/web/app/components/workflow/nodes/agent-v2/__tests__/panel.spec.tsx
new file mode 100644
index 00000000000..522e53235f1
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/__tests__/panel.spec.tsx
@@ -0,0 +1,979 @@
+import type { ReactNode } from 'react'
+import type { AgentV2NodeType } from '../types'
+import type { PromptEditorProps } from '@/app/components/base/prompt-editor'
+import type { NodePanelProps } from '@/app/components/workflow/types'
+import { fireEvent, render, screen, within } from '@testing-library/react'
+import { BlockEnum } from '@/app/components/workflow/types'
+import { AgentV2Panel } from '../panel'
+
+const {
+  mockEditorFocus,
+  mockEditorUpdate,
+  mockHandleNodeDataUpdate,
+  mockHandleNodeDataUpdateWithSyncDraft,
+  mockInsertNodes,
+  mockOrchestrateDrawerPanelProps,
+  mockPromptEditorProps,
+  mockSetInputs,
+  mockStoreState,
+  mockUseAgentRosterDetail,
+  mockUseWorkflowInlineAgentDetail,
+  mockUseNodeCrud,
+} = vi.hoisted(() => ({
+  mockEditorFocus: vi.fn(),
+  mockEditorUpdate: vi.fn((callback: () => void) => callback()),
+  mockHandleNodeDataUpdate: vi.fn(),
+  mockHandleNodeDataUpdateWithSyncDraft: vi.fn((_payload, options) => options?.callback?.onSuccess?.()),
+  mockInsertNodes: vi.fn(),
+  mockOrchestrateDrawerPanelProps: [] as Array<{
+    agentId: string
+    inlineComposerState?: unknown
+    isInline: boolean
+    nodeId: string
+    open: boolean
+  }>,
+  mockPromptEditorProps: [] as PromptEditorProps[],
+  mockSetInputs: vi.fn(),
+  mockStoreState: {
+    openInlineAgentPanelNodeId: undefined as string | undefined,
+    setOpenInlineAgentPanelNodeId: vi.fn(),
+  },
+  mockUseAgentRosterDetail: vi.fn(),
+  mockUseWorkflowInlineAgentDetail: vi.fn(),
+  mockUseNodeCrud: vi.fn(),
+}))
+
+vi.mock('../../_base/components/output-vars', () => ({
+  __esModule: true,
+  default: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  VarItem: ({ name, type, description }: { name: string, type: string, description?: string }) => (
+    <div>{`${name}:${type}:${description || ''}`}</div>
+  ),
+}))
+
+vi.mock('@/app/components/base/prompt-editor', () => ({
+  default: (props: PromptEditorProps) => {
+    mockPromptEditorProps.push(props)
+
+    return (
+      <>
+        <textarea
+          aria-label="workflow.nodes.agent.task.label"
+          placeholder={typeof props.placeholder === 'string' ? props.placeholder : undefined}
+          value={props.value}
+          onChange={event => props.onChange?.(event.currentTarget.value)}
+          onBlur={props.onBlur}
+          onFocus={props.onFocus}
+        />
+        {props.children}
+      </>
+    )
+  },
+}))
+
+vi.mock('@lexical/react/LexicalComposerContext', () => ({
+  useLexicalComposerContext: () => [{
+    focus: mockEditorFocus,
+    update: mockEditorUpdate,
+  }],
+}))
+
+vi.mock('lexical', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('lexical')>()
+
+  return {
+    ...actual,
+    $insertNodes: mockInsertNodes,
+  }
+})
+
+vi.mock('@/app/components/base/prompt-editor/plugins/custom-text/node', () => ({
+  $createCustomTextNode: (text: string) => ({
+    getTextContent: () => text,
+  }),
+}))
+
+vi.mock('../../_base/hooks/use-node-crud', () => ({
+  default: (id: string, data: AgentV2NodeType) => mockUseNodeCrud(id, data),
+}))
+
+vi.mock('@/app/components/workflow/block-selector/agent-selector', () => ({
+  AgentSelectorContent: ({
+    onSelect,
+  }: {
+    onSelect: (agent: {
+      description: string
+      icon: string
+      icon_background: string
+      icon_type: 'emoji'
+      id: string
+      name: string
+      role: string
+    }) => void
+  }) => (
+    <button
+      type="button"
+      onClick={() => onSelect({
+        id: 'agent-2',
+        name: 'Mara',
+        description: 'Tender Analyst',
+        icon: 'M',
+        icon_background: '#D1E9FF',
+        icon_type: 'emoji',
+        role: 'Analyst',
+      })}
+    >
+      Select Mara
+    </button>
+  ),
+}))
+
+vi.mock('../hooks', () => ({
+  useAgentRosterDetail: (agentId?: string) => mockUseAgentRosterDetail(agentId),
+  useWorkflowInlineAgentDetail: (nodeId?: string, agentId?: string | null) => mockUseWorkflowInlineAgentDetail(nodeId, agentId),
+}))
+
+vi.mock('../components/agent-orchestrate-drawer-panel', () => ({
+  AgentOrchestrateDrawerPanel: (props: {
+    agentId: string
+    appId?: string
+    inlineComposerState?: unknown
+    isInline: boolean
+    nodeId: string
+    open: boolean
+  }) => {
+    mockOrchestrateDrawerPanelProps.push(props)
+
+    return (
+      <div role="region" aria-label={props.isInline ? 'inline-orchestrate-panel' : 'readonly-roster-orchestrate-panel'} />
+    )
+  },
+}))
+
+vi.mock('../../_base/hooks/use-available-var-list', () => ({
+  default: () => ({
+    availableVars: [{
+      nodeId: 'start',
+      title: 'START',
+      vars: [{ variable: 'question', type: 'string' }],
+    }],
+    availableNodesWithParent: [{
+      id: 'start',
+      data: {
+        title: 'START',
+        type: BlockEnum.Start,
+      },
+      position: { x: 0, y: 0 },
+    }],
+  }),
+}))
+
+vi.mock('@/app/components/workflow/hooks', () => ({
+  useNodeDataUpdate: () => ({
+    handleNodeDataUpdate: mockHandleNodeDataUpdate,
+    handleNodeDataUpdateWithSyncDraft: mockHandleNodeDataUpdateWithSyncDraft,
+  }),
+  useWorkflowVariableType: () => vi.fn(),
+}))
+
+vi.mock('@/app/components/workflow/store', () => ({
+  useStore: (selector: (state: typeof mockStoreState) => unknown) => selector(mockStoreState),
+}))
+
+const createData = (overrides: Partial<AgentV2NodeType> = {}): AgentV2NodeType => ({
+  title: 'Agent',
+  desc: '',
+  type: BlockEnum.AgentV2,
+  agent_binding: {
+    binding_type: 'roster_agent',
+    agent_id: 'agent-1',
+  },
+  agent_node_kind: 'dify_agent',
+  version: '2',
+  ...overrides,
+})
+
+const panelProps = {} as NodePanelProps<AgentV2NodeType>['panelProps']
+
+describe('agent/panel', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockPromptEditorProps.length = 0
+    mockOrchestrateDrawerPanelProps.length = 0
+    mockStoreState.openInlineAgentPanelNodeId = undefined
+    mockUseNodeCrud.mockImplementation((_id: string, data: AgentV2NodeType) => ({
+      inputs: data,
+      setInputs: mockSetInputs,
+    }))
+    mockUseAgentRosterDetail.mockImplementation((agentId?: string) => ({
+      data: agentId
+        ? {
+            id: agentId,
+            name: 'Nadia',
+            description: 'Clarification Drafter',
+            icon: 'N',
+            icon_background: '#E9D7FE',
+            icon_type: 'emoji',
+            role: 'Researcher',
+          }
+        : undefined,
+    }))
+    mockUseWorkflowInlineAgentDetail.mockImplementation((nodeId?: string, agentId?: string | null) => ({
+      data: nodeId && agentId
+        ? {
+            agent: {
+              id: agentId,
+              name: 'Workflow Agent 1',
+              description: '',
+              scope: 'workflow_only',
+              status: 'active',
+            },
+          }
+        : undefined,
+    }))
+  })
+
+  it('renders selected roster agent trigger and default Agent v2 output vars', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    expect(screen.getByText('workflow.nodes.agent.roster.label')).toBeInTheDocument()
+    expect(screen.getByText('Nadia')).toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.task.label')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'workflow.nodes.agent.task.tooltip' })).toBeInTheDocument()
+    expect(screen.getByRole('textbox', { name: 'workflow.nodes.agent.task.label' })).toHaveValue('')
+    expect(screen.getByRole('button', { name: 'workflow.nodes.agent.advancedSetting' })).toBeInTheDocument()
+    expect(screen.getByText('text')).toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.outputVars.text')).toBeInTheDocument()
+    expect(screen.queryByText('usage')).not.toBeInTheDocument()
+    expect(screen.getByText('files')).toBeInTheDocument()
+    expect(screen.getByText('array[file]')).toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.outputVars.files.title')).toBeInTheDocument()
+    expect(screen.getByText('json')).toBeInTheDocument()
+    expect(screen.getByText('object')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.newOutput' })).toBeInTheDocument()
+  })
+
+  it('opens and closes the roster agent layered panel', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /^workflow\.nodes\.agent\.roster\.openPanel/ }))
+
+    const panel = screen.getByRole('dialog', { name: 'Nadia' })
+    expect(panel).toBeInTheDocument()
+    expect(within(panel).getByText('Researcher')).toBeInTheDocument()
+    expect(within(panel).getByRole('link', { name: 'workflow.nodes.agent.roster.editInConsole' })).toHaveAttribute('href', '/roster/agent/agent-1/configure')
+    expect(within(panel).getByRole('button', { name: 'workflow.nodes.agent.roster.makeCopy' })).toBeInTheDocument()
+    expect(within(panel).getByRole('region', { name: 'readonly-roster-orchestrate-panel' })).toBeInTheDocument()
+    expect(mockOrchestrateDrawerPanelProps.at(-1)).toMatchObject({
+      agentId: 'agent-1',
+      isInline: false,
+      nodeId: 'agent-node',
+      open: true,
+    })
+
+    fireEvent.keyDown(panel, { key: 'Escape' })
+
+    expect(screen.queryByRole('dialog', { name: 'Nadia' })).not.toBeInTheDocument()
+  })
+
+  it('renders a required roster state when no roster agent is selected', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({ agent_binding: undefined })}
+        panelProps={panelProps}
+      />,
+    )
+
+    expect(screen.getByText('workflow.nodes.agent.roster.label')).toBeInTheDocument()
+    expect(screen.getByText(/^workflow\.errorMsg\.fieldRequired/)).toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.task.label')).toBeInTheDocument()
+    expect(screen.getByText('text')).toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.outputVars.text')).toBeInTheDocument()
+  })
+
+  it('renders a pending inline agent state while the binding is being created', () => {
+    const { container } = render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          _isTempNode: true,
+          agent_binding: {
+            binding_type: 'inline_agent',
+          },
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    expect(screen.queryByText(/^workflow\.errorMsg\.fieldRequired/)).not.toBeInTheDocument()
+    expect(container.querySelector('[aria-busy="true"]')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'workflow.nodes.agent.roster.change' })).toBeDisabled()
+    expect(screen.getByText('workflow.nodes.agent.task.label')).toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.outputVars.text')).toBeInTheDocument()
+    expect(container.querySelector('[inert]')).toBeInTheDocument()
+  })
+
+  it('renders inline agent detail from workflow composer state and opens the inline panel', () => {
+    mockStoreState.openInlineAgentPanelNodeId = 'agent-node'
+    const { container } = render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          _isTempNode: true,
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'snapshot-1',
+          },
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    expect(mockUseAgentRosterDetail).toHaveBeenCalledWith(undefined)
+    expect(mockUseWorkflowInlineAgentDetail).toHaveBeenCalledWith('agent-node', 'inline-agent-1')
+    expect(screen.queryByText('Workflow Agent 1')).not.toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.name')).toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.type')).toBeInTheDocument()
+    expect(container.querySelector('.i-custom-vender-agent-v2-robot-3')).toHaveClass('size-5')
+    expect(container.querySelector('.i-custom-vender-agent-v2-robot-3')?.parentElement).toHaveClass('size-8', 'rounded-full', 'bg-background-default-burn')
+    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.title')).toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.description')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /^workflow\.nodes\.agent\.roster\.openPanel/ })).toBeInTheDocument()
+    expect(screen.getByRole('dialog', { name: 'workflow.nodes.agent.roster.inlineSetup.title' })).toBeInTheDocument()
+    expect(screen.getByRole('region', { name: 'inline-orchestrate-panel' })).toBeInTheDocument()
+    expect(mockOrchestrateDrawerPanelProps.at(-1)).toMatchObject({
+      agentId: 'inline-agent-1',
+      isInline: true,
+      nodeId: 'agent-node',
+      open: true,
+    })
+    expect(screen.queryByText('workflow.nodes.agent.roster.editInConsole')).not.toBeInTheDocument()
+    expect(screen.queryByText('workflow.nodes.agent.roster.makeCopy')).not.toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.task.label')).toBeInTheDocument()
+  })
+
+  it('uses the detail header when opening an existing inline agent from the roster trigger', () => {
+    const { rerender } = render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'snapshot-1',
+          },
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /^workflow\.nodes\.agent\.roster\.openPanel/ }))
+    expect(mockStoreState.setOpenInlineAgentPanelNodeId).toHaveBeenCalledWith('agent-node')
+
+    mockStoreState.openInlineAgentPanelNodeId = 'agent-node'
+    rerender(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'snapshot-1',
+          },
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    const panel = screen.getByRole('dialog', { name: 'Workflow Agent 1' })
+    expect(panel).toBeInTheDocument()
+    expect(panel.querySelector('header')).not.toHaveClass('h-[108px]')
+    expect(within(panel).getByText('workflow.nodes.agent.roster.inlineSetup.type')).toBeInTheDocument()
+    expect(within(panel).queryByText('workflow.nodes.agent.roster.inlineSetup.title')).not.toBeInTheDocument()
+    expect(within(panel).queryByText('workflow.nodes.agent.roster.inlineSetup.description')).not.toBeInTheDocument()
+    expect(within(panel).queryByRole('link', { name: 'workflow.nodes.agent.roster.editInConsole' })).not.toBeInTheDocument()
+    expect(within(panel).queryByRole('button', { name: 'workflow.nodes.agent.roster.makeCopy' })).not.toBeInTheDocument()
+    expect(screen.getByRole('region', { name: 'inline-orchestrate-panel' })).toBeInTheDocument()
+  })
+
+  it('opens the inline panel while workflow composer state is still loading', () => {
+    mockStoreState.openInlineAgentPanelNodeId = 'agent-node'
+    mockUseWorkflowInlineAgentDetail.mockReturnValue({ data: undefined })
+
+    const { container } = render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'snapshot-1',
+          },
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    expect(mockUseWorkflowInlineAgentDetail).toHaveBeenCalledWith('agent-node', 'inline-agent-1')
+    expect(container.querySelector('[aria-busy="true"]')).toBeInTheDocument()
+    expect(screen.queryByText('workflow.nodes.agent.roster.inlineSetup.name')).not.toBeInTheDocument()
+    expect(screen.getByRole('dialog', { name: 'workflow.nodes.agent.roster.inlineSetup.title' })).toBeInTheDocument()
+    expect(screen.getByRole('region', { name: 'inline-orchestrate-panel' })).toBeInTheDocument()
+    expect(mockOrchestrateDrawerPanelProps.at(-1)).toMatchObject({
+      agentId: 'inline-agent-1',
+      inlineComposerState: undefined,
+      isInline: true,
+      nodeId: 'agent-node',
+      open: true,
+    })
+  })
+
+  it('recovers the inline setup panel open state from the node open marker', () => {
+    mockUseWorkflowInlineAgentDetail.mockReturnValue({ data: undefined })
+
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          _openInlineAgentPanel: true,
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'snapshot-1',
+          },
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    expect(mockStoreState.setOpenInlineAgentPanelNodeId).toHaveBeenCalledWith('agent-node')
+    expect(mockHandleNodeDataUpdate).toHaveBeenCalledWith({
+      id: 'agent-node',
+      data: {
+        _openInlineAgentPanel: false,
+      },
+    })
+  })
+
+  it('updates roster agent binding from the selector', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.roster.change' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Select Mara' }))
+
+    expect(mockHandleNodeDataUpdateWithSyncDraft).toHaveBeenCalledWith(
+      {
+        id: 'agent-node',
+        data: expect.objectContaining({
+          agent_binding: {
+            binding_type: 'roster_agent',
+            agent_id: 'agent-2',
+          },
+        }),
+      },
+      expect.objectContaining({
+        sync: true,
+        notRefreshWhenSyncError: true,
+      }),
+    )
+  })
+
+  it('does not fall back to the roster agent description when role is empty', () => {
+    mockUseAgentRosterDetail.mockReturnValue({
+      data: {
+        id: 'agent-1',
+        name: 'Nadia',
+        description: 'Clarification Drafter',
+        icon: 'N',
+        icon_background: '#E9D7FE',
+        icon_type: 'emoji',
+        role: '',
+      },
+    })
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    expect(screen.getByText('Nadia')).toBeInTheDocument()
+    expect(screen.queryByText('Clarification Drafter')).not.toBeInTheDocument()
+  })
+
+  it('updates agent task and opens prompt insertion shortcuts', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({ agent_task: 'Graph task' })}
+        panelProps={panelProps}
+      />,
+    )
+
+    const editor = screen.getByRole('textbox', { name: 'workflow.nodes.agent.task.label' })
+    expect(editor).toHaveValue('Graph task')
+
+    fireEvent.change(editor, { target: { value: 'Clarify {{#start.question#}}' } })
+
+    expect(mockSetInputs).toHaveBeenCalledWith(expect.objectContaining({
+      agent_task: 'Clarify {{#start.question#}}',
+    }))
+    expect(mockPromptEditorProps[0]?.workflowVariableBlock).toMatchObject({
+      show: true,
+    })
+    expect(mockPromptEditorProps[0]?.agentOutputBlock).toMatchObject({
+      show: true,
+      outputs: expect.arrayContaining([
+        expect.objectContaining({ name: 'text' }),
+      ]),
+    })
+    expect(mockPromptEditorProps[0]?.contextBlock).toBeUndefined()
+
+    expect(screen.queryByRole('button', { name: 'workflow.nodes.agent.task.insert' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'workflow.nodes.agent.task.mention' })).not.toBeInTheDocument()
+
+    fireEvent.focus(editor)
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.task.insert' }))
+    expect(mockEditorFocus).toHaveBeenCalled()
+    expect(mockInsertNodes.mock.calls[0]?.[0]?.[0]?.getTextContent()).toBe('/')
+    expect(screen.queryByRole('button', { name: 'workflow.nodes.agent.task.mention' })).not.toBeInTheDocument()
+  })
+
+  it('syncs declared outputs created from the agent task editor', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    mockPromptEditorProps[0]?.agentOutputBlock?.onChange?.([
+      ...mockPromptEditorProps[0]!.agentOutputBlock!.outputs!,
+      {
+        name: 'summary',
+        type: 'string',
+        required: false,
+      },
+    ], 'Use [§output:summary:summary§]')
+
+    expect(mockHandleNodeDataUpdateWithSyncDraft).toHaveBeenCalledWith(
+      {
+        id: 'agent-node',
+        data: expect.objectContaining({
+          agent_task: 'Use [§output:summary:summary§]',
+          agent_declared_outputs: expect.arrayContaining([
+            expect.objectContaining({
+              name: 'summary',
+              type: 'string',
+              required: false,
+            }),
+          ]),
+        }),
+      },
+      expect.objectContaining({
+        sync: true,
+        notRefreshWhenSyncError: true,
+      }),
+    )
+  })
+
+  it('keeps the latest local task draft when outputs change before rerender', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.change(screen.getByRole('textbox', { name: 'workflow.nodes.agent.task.label' }), {
+      target: {
+        value: 'Draft before output',
+      },
+    })
+    mockPromptEditorProps[0]?.agentOutputBlock?.onChange?.([
+      ...mockPromptEditorProps[0]!.agentOutputBlock!.outputs!,
+      {
+        name: 'summary',
+        type: 'string',
+        required: false,
+      },
+    ])
+
+    expect(mockHandleNodeDataUpdateWithSyncDraft).toHaveBeenCalledWith(
+      {
+        id: 'agent-node',
+        data: expect.objectContaining({
+          agent_task: 'Draft before output',
+          agent_declared_outputs: expect.arrayContaining([
+            expect.objectContaining({
+              name: 'summary',
+              type: 'string',
+              required: false,
+            }),
+          ]),
+        }),
+      },
+      expect.objectContaining({
+        sync: true,
+        notRefreshWhenSyncError: true,
+      }),
+    )
+  })
+
+  it('saves agent task to workflow draft node data', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.change(screen.getByRole('textbox', { name: 'workflow.nodes.agent.task.label' }), {
+      target: {
+        value: 'Use the previous result',
+      },
+    })
+
+    expect(mockSetInputs).toHaveBeenCalledWith(expect.objectContaining({
+      agent_task: 'Use the previous result',
+    }))
+  })
+
+  it('removes declared outputs when their prompt output token is deleted', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_task: 'Use [§output:summary:summary§] and [§output:manual:manual§]',
+          agent_declared_outputs: [
+            {
+              name: 'summary',
+              type: 'string',
+              required: false,
+            },
+            {
+              name: 'manual',
+              type: 'string',
+              required: false,
+            },
+          ],
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.change(screen.getByRole('textbox', { name: 'workflow.nodes.agent.task.label' }), {
+      target: {
+        value: 'Use [§output:manual:manual§]',
+      },
+    })
+
+    expect(mockSetInputs).toHaveBeenCalledWith(expect.objectContaining({
+      agent_task: 'Use [§output:manual:manual§]',
+      agent_declared_outputs: [
+        expect.objectContaining({
+          name: 'manual',
+        }),
+      ],
+    }))
+  })
+
+  it('does not remove prompt output tokens when declared outputs are changed from the output list', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_task: 'Use [§output:summary:summary§]',
+          agent_declared_outputs: [
+            {
+              name: 'summary',
+              type: 'string',
+              required: false,
+            },
+          ],
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    mockPromptEditorProps[0]?.agentOutputBlock?.onChange?.([])
+
+    expect(mockHandleNodeDataUpdateWithSyncDraft).toHaveBeenCalledWith(
+      {
+        id: 'agent-node',
+        data: expect.objectContaining({
+          agent_task: 'Use [§output:summary:summary§]',
+          agent_declared_outputs: [],
+        }),
+      },
+      expect.objectContaining({
+        sync: true,
+        notRefreshWhenSyncError: true,
+      }),
+    )
+  })
+
+  it('renames prompt output tokens when a referenced declared output is renamed from the output list', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_task: 'Use [§output:summary:summary§] and §output:other:other§',
+          agent_declared_outputs: [
+            {
+              name: 'summary',
+              type: 'string',
+              required: false,
+            },
+            {
+              name: 'other',
+              type: 'string',
+              required: false,
+            },
+          ],
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    mockPromptEditorProps[0]?.agentOutputBlock?.onChange?.([
+      {
+        name: 'final_summary',
+        type: 'string',
+        required: false,
+      },
+      {
+        name: 'other',
+        type: 'string',
+        required: false,
+      },
+    ])
+
+    expect(mockHandleNodeDataUpdateWithSyncDraft).toHaveBeenCalledWith(
+      {
+        id: 'agent-node',
+        data: expect.objectContaining({
+          agent_task: 'Use [§output:final_summary:final_summary§] and §output:other:other§',
+          agent_declared_outputs: [
+            expect.objectContaining({
+              name: 'final_summary',
+            }),
+            expect.objectContaining({
+              name: 'other',
+            }),
+          ],
+        }),
+      },
+      expect.objectContaining({
+        sync: true,
+        notRefreshWhenSyncError: true,
+      }),
+    )
+  })
+
+  it('renders declared outputs from workflow draft graph data', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_declared_outputs: [
+            {
+              name: 'summary',
+              type: 'string',
+              description: 'Short summary',
+            },
+            {
+              name: 'attachments',
+              type: 'array',
+              description: 'Generated files',
+              array_item: {
+                type: 'file',
+              },
+            },
+          ],
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    expect(screen.getByText('summary')).toBeInTheDocument()
+    expect(screen.getByText('string')).toBeInTheDocument()
+    expect(screen.getByText('Short summary')).toBeInTheDocument()
+    expect(screen.getByText('attachments')).toBeInTheDocument()
+    expect(screen.getByText('array[file]')).toBeInTheDocument()
+    expect(screen.getByText('Generated files')).toBeInTheDocument()
+    expect(screen.queryByText('workflow.nodes.agent.outputVars.text')).not.toBeInTheDocument()
+  })
+
+  it('adds a declared output to workflow draft node data', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.newOutput' }))
+    fireEvent.change(screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' }), {
+      target: {
+        value: 'summary',
+      },
+    })
+    fireEvent.change(screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.descriptionLabel' }), {
+      target: {
+        value: 'Short summary',
+      },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.confirm' }))
+
+    expect(mockHandleNodeDataUpdateWithSyncDraft).toHaveBeenCalledWith(
+      {
+        id: 'agent-node',
+        data: expect.objectContaining({
+          agent_declared_outputs: expect.arrayContaining([
+            expect.objectContaining({
+              name: 'summary',
+              type: 'string',
+              required: false,
+              description: 'Short summary',
+            }),
+          ]),
+        }),
+      },
+      expect.objectContaining({
+        sync: true,
+        notRefreshWhenSyncError: true,
+      }),
+    )
+  })
+
+  it('submits the output editor with a scoped Mod+Enter shortcut', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.newOutput' }))
+    const nameInput = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+    fireEvent.change(nameInput, {
+      target: {
+        value: 'summary',
+      },
+    })
+    fireEvent.keyDown(document, { key: 'Enter', ctrlKey: true })
+
+    expect(mockHandleNodeDataUpdateWithSyncDraft).not.toHaveBeenCalled()
+
+    fireEvent.keyDown(nameInput, { key: 'Enter', ctrlKey: true })
+
+    expect(mockHandleNodeDataUpdateWithSyncDraft).toHaveBeenCalledWith(
+      {
+        id: 'agent-node',
+        data: expect.objectContaining({
+          agent_declared_outputs: expect.arrayContaining([
+            expect.objectContaining({
+              name: 'summary',
+            }),
+          ]),
+        }),
+      },
+      expect.objectContaining({
+        sync: true,
+        notRefreshWhenSyncError: true,
+      }),
+    )
+  })
+
+  it('cancels the output editor with a scoped Escape shortcut', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.newOutput' }))
+    const nameInput = screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })
+    fireEvent.change(nameInput, {
+      target: {
+        value: 'summary',
+      },
+    })
+    fireEvent.keyDown(document, { key: 'Escape' })
+
+    expect(screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })).toBeInTheDocument()
+
+    fireEvent.keyDown(nameInput, { key: 'Escape' })
+
+    expect(screen.queryByRole('textbox', { name: 'workflow.nodes.agent.outputVars.nameLabel' })).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.newOutput' })).toBeInTheDocument()
+    expect(mockHandleNodeDataUpdateWithSyncDraft).not.toHaveBeenCalled()
+  })
+
+  it('reveals output editor advanced options with the collapsible trigger', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.newOutput' }))
+
+    expect(screen.queryByRole('textbox', { name: 'workflow.nodes.agent.outputVars.defaultValueLabel' })).not.toBeInTheDocument()
+
+    const advancedTrigger = screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.showAdvancedOptions' })
+    expect(advancedTrigger).toHaveAttribute('aria-expanded', 'false')
+
+    fireEvent.click(advancedTrigger)
+
+    expect(advancedTrigger).toHaveAttribute('aria-expanded', 'true')
+    expect(screen.getByRole('textbox', { name: 'workflow.nodes.agent.outputVars.defaultValueLabel' })).toBeInTheDocument()
+  })
+
+  it('does not show name validation error before the user enters a name', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData()}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.newOutput' }))
+
+    expect(screen.queryByText('workflow.nodes.agent.outputVars.nameInvalid')).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'workflow.nodes.agent.outputVars.confirm' })).toBeDisabled()
+  })
+})
diff --git a/web/app/components/workflow/nodes/agent-v2/agent-soul-config.ts b/web/app/components/workflow/nodes/agent-v2/agent-soul-config.ts
new file mode 100644
index 00000000000..be73fc9fa60
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/agent-soul-config.ts
@@ -0,0 +1,170 @@
+import type { AgentSoulConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { DefaultModelResponse } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { debounce } from 'es-toolkit/compat'
+import { useStore as useJotaiStore, useSetAtom } from 'jotai'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
+import { useSerialAsyncCallback } from '@/app/components/workflow/hooks/use-serial-async-callback'
+import { agentSoulConfigToFormState, formStateToAgentSoulConfig } from '@/features/agent-v2/agent-composer/conversions'
+import {
+  agentComposerDraftAtom,
+  agentComposerOriginalConfigAtom,
+  agentComposerOriginalDraftAtom,
+  isAgentComposerDirtyAtom,
+} from '@/features/agent-v2/agent-composer/store'
+import { consoleQuery } from '@/service/client'
+import { FlowType } from '@/types/common'
+
+const DRAFT_AUTOSAVE_WAIT = 5000
+
+function getModelProviderPluginId(provider: string) {
+  const [organization, pluginName] = provider.split('/').filter(Boolean)
+
+  if (organization && pluginName)
+    return `${organization}/${pluginName}`
+
+  return provider ? `langgenius/${provider}` : ''
+}
+
+export function getDefaultAgentSoul(defaultModel?: DefaultModelResponse): AgentSoulConfig {
+  const baseConfig: AgentSoulConfig = {
+    schema_version: 1,
+    prompt: {
+      system_prompt: '',
+    },
+  }
+
+  if (!defaultModel)
+    return baseConfig
+
+  const modelProvider = defaultModel.provider.provider
+
+  return {
+    ...baseConfig,
+    model: {
+      model_provider: modelProvider,
+      model: defaultModel.model,
+      plugin_id: getModelProviderPluginId(modelProvider),
+    },
+  }
+}
+
+export function useWorkflowInlineAgentConfigureSync({
+  nodeId,
+  baseConfig,
+  currentModel,
+  enabled,
+}: {
+  nodeId: string
+  baseConfig?: AgentSoulConfig
+  currentModel?: {
+    provider: string
+    model: string
+    plugin_id?: string
+  }
+  enabled: boolean
+}) {
+  const queryClient = useQueryClient()
+  const configsMap = useHooksStore(state => state.configsMap)
+  const store = useJotaiStore()
+  const setOriginalConfig = useSetAtom(agentComposerOriginalConfigAtom)
+  const setOriginalDraft = useSetAtom(agentComposerOriginalDraftAtom)
+  const [draftSavedAt, setDraftSavedAt] = useState<number | undefined>(undefined)
+  const baseConfigRef = useRef(baseConfig)
+  const currentModelRef = useRef(currentModel)
+  const enabledRef = useRef(enabled)
+  const lastAutosavedDraftKeyRef = useRef<string | undefined>(undefined)
+  const saveComposerMutation = useMutation(
+    consoleQuery.apps.byAppId.workflows.draft.nodes.byNodeId.agentComposer.put.mutationOptions(),
+  )
+
+  baseConfigRef.current = baseConfig
+  currentModelRef.current = currentModel
+  enabledRef.current = enabled
+
+  const getAgentSoulDraft = useCallback(() => formStateToAgentSoulConfig({
+    baseConfig: baseConfigRef.current,
+    formState: store.get(agentComposerDraftAtom),
+    currentModel: currentModelRef.current,
+  }), [store])
+
+  const saveComposer = useSerialAsyncCallback(async (configSnapshot: AgentSoulConfig) => {
+    if (!configsMap?.flowId || configsMap.flowType !== FlowType.appFlow)
+      return
+
+    const savedDraftKey = JSON.stringify(configSnapshot)
+    const composerState = await saveComposerMutation.mutateAsync({
+      params: {
+        app_id: configsMap.flowId,
+        node_id: nodeId,
+      },
+      body: {
+        variant: 'workflow',
+        save_strategy: 'node_job_only',
+        agent_soul: configSnapshot,
+      },
+    })
+
+    queryClient.setQueryData(
+      consoleQuery.apps.byAppId.workflows.draft.nodes.byNodeId.agentComposer.get.queryKey({
+        input: {
+          params: {
+            app_id: configsMap.flowId,
+            node_id: nodeId,
+          },
+        },
+      }),
+      composerState,
+    )
+    setOriginalConfig(composerState.agent_soul)
+    setOriginalDraft(agentSoulConfigToFormState(composerState.agent_soul))
+    setDraftSavedAt(Date.now())
+    lastAutosavedDraftKeyRef.current = savedDraftKey
+  })
+
+  const latestDraftSaveRef = useRef<() => void>(() => undefined)
+  latestDraftSaveRef.current = () => {
+    void saveComposer(getAgentSoulDraft())
+  }
+
+  const debouncedSaveDraft = useMemo(() => debounce(() => {
+    latestDraftSaveRef.current()
+  }, DRAFT_AUTOSAVE_WAIT), [])
+
+  const saveDraft = useCallback(async () => {
+    if (!enabledRef.current)
+      return
+
+    debouncedSaveDraft.cancel?.()
+    await saveComposer(getAgentSoulDraft())
+  }, [debouncedSaveDraft, getAgentSoulDraft, saveComposer])
+
+  useEffect(() => {
+    return store.sub(agentComposerDraftAtom, () => {
+      const agentSoulDraft = getAgentSoulDraft()
+      const agentSoulDraftKey = JSON.stringify(agentSoulDraft)
+
+      if (
+        !enabledRef.current
+        || !store.get(isAgentComposerDirtyAtom)
+        || lastAutosavedDraftKeyRef.current === agentSoulDraftKey
+      ) {
+        return
+      }
+
+      debouncedSaveDraft()
+    })
+  }, [debouncedSaveDraft, getAgentSoulDraft, store])
+
+  useEffect(() => {
+    return () => {
+      debouncedSaveDraft.flush?.()
+    }
+  }, [debouncedSaveDraft])
+
+  return {
+    draftSavedAt,
+    saveDraft,
+  }
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-advanced-settings.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-advanced-settings.tsx
new file mode 100644
index 00000000000..d3c43f1ad00
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-advanced-settings.tsx
@@ -0,0 +1,27 @@
+import {
+  CollapsiblePanel,
+  CollapsibleRoot,
+  CollapsibleTrigger,
+} from '@langgenius/dify-ui/collapsible'
+import { useTranslation } from 'react-i18next'
+
+export function AgentAdvancedSettings() {
+  const { t } = useTranslation()
+
+  return (
+    <CollapsibleRoot className="border-b border-divider-subtle py-2">
+      <CollapsibleTrigger className="group h-8 min-h-0 justify-start gap-0 rounded-none px-4 py-0 hover:not-data-disabled:bg-transparent hover:not-data-disabled:text-text-secondary data-panel-open:text-text-secondary">
+        <span className="min-w-0 truncate system-sm-semibold-uppercase text-text-secondary">
+          {t('nodes.agent.advancedSetting', { ns: 'workflow' })}
+        </span>
+        <span
+          aria-hidden="true"
+          className="i-custom-vender-solid-general-arrow-down-round-fill size-4 rotate-270 text-text-quaternary transition-transform group-data-panel-open:rotate-0 motion-reduce:transition-none"
+        />
+      </CollapsibleTrigger>
+      <CollapsiblePanel>
+        <div className="px-4" />
+      </CollapsiblePanel>
+    </CollapsibleRoot>
+  )
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-orchestrate-drawer-panel.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-orchestrate-drawer-panel.tsx
new file mode 100644
index 00000000000..f04899116b0
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-orchestrate-drawer-panel.tsx
@@ -0,0 +1,122 @@
+'use client'
+
+import type { AgentConfigSnapshotSummaryResponse, AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { WorkflowAgentComposerResponse } from '@dify/contracts/api/console/apps/types.gen'
+import { skipToken, useQuery } from '@tanstack/react-query'
+import { useAtom } from 'jotai'
+import Loading from '@/app/components/base/loading'
+import { ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { useDefaultModel, useTextGenerationCurrentProviderAndModelAndModelList } from '@/app/components/header/account-setting/model-provider-page/hooks'
+import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { useHydrateAgentSoulConfigDraft } from '@/features/agent-v2/agent-composer/store'
+import { agentComposerModelAtom } from '@/features/agent-v2/agent-composer/store-modules/model'
+import { AgentOrchestratePanel } from '@/features/agent-v2/agent-detail/configure/components/orchestrate'
+import { consoleQuery } from '@/service/client'
+import { useWorkflowInlineAgentConfigureSync } from '../agent-soul-config'
+
+type AgentOrchestrateDrawerPanelProps = {
+  agentId: string
+  appId?: string
+  inlineComposerState?: WorkflowAgentComposerResponse
+  isInline: boolean
+  nodeId: string
+  open: boolean
+}
+
+export function AgentOrchestrateDrawerPanel(props: AgentOrchestrateDrawerPanelProps) {
+  return (
+    <AgentComposerProvider>
+      <AgentOrchestrateDrawerPanelContent {...props} />
+    </AgentComposerProvider>
+  )
+}
+
+function AgentOrchestrateDrawerPanelContent({
+  agentId,
+  appId,
+  inlineComposerState,
+  isInline,
+  nodeId,
+  open,
+}: AgentOrchestrateDrawerPanelProps) {
+  const rosterComposerQuery = useQuery(consoleQuery.agent.byAgentId.composer.get.queryOptions({
+    input: open && !isInline
+      ? {
+          params: {
+            agent_id: agentId,
+          },
+        }
+      : skipToken,
+  }))
+  const composerState = isInline ? inlineComposerState : rosterComposerQuery.data
+  const agentSoulConfig = composerState?.agent_soul
+  const activeConfigSnapshot = ('active_config_snapshot' in (composerState ?? {}))
+    ? composerState?.active_config_snapshot as AgentConfigSnapshotSummaryResponse | null | undefined
+    : undefined
+  const { currentModel, setConfigureModel, textGenerationModelList } = useAgentOrchestrateModelOptions()
+  const { draftSavedAt, saveDraft } = useWorkflowInlineAgentConfigureSync({
+    nodeId,
+    baseConfig: agentSoulConfig,
+    currentModel,
+    enabled: open && isInline && !!agentSoulConfig,
+  })
+
+  useHydrateAgentSoulConfigDraft({
+    agentId: isInline ? `${nodeId}:${agentId}` : agentId,
+    activeVersionId: activeConfigSnapshot?.id,
+    config: agentSoulConfig as AgentSoulConfig | undefined,
+  })
+
+  if (!agentSoulConfig) {
+    return (
+      <div className="flex h-full min-h-80 items-center justify-center bg-components-panel-bg">
+        <Loading type="app" />
+      </div>
+    )
+  }
+
+  return (
+    <AgentOrchestratePanel
+      agentId={agentId}
+      appId={isInline ? appId : undefined}
+      activeConfigSnapshot={activeConfigSnapshot}
+      agentSoulConfig={agentSoulConfig as AgentSoulConfig}
+      agentName={composerState?.agent?.name}
+      currentModel={currentModel}
+      textGenerationModelList={textGenerationModelList}
+      draftSavedAt={draftSavedAt}
+      readOnly={!isInline}
+      showHeader={false}
+      showPublishBar={false}
+      className="h-full max-w-none min-w-0 flex-none rounded-none border-0"
+      onSelectModel={setConfigureModel}
+      onPublish={() => {
+        void saveDraft()
+      }}
+      onOpenVersions={() => undefined}
+    />
+  )
+}
+
+function useAgentOrchestrateModelOptions() {
+  const [model, setModel] = useAtom(agentComposerModelAtom)
+  const {
+    data: defaultTextGenerationModel,
+  } = useDefaultModel(ModelTypeEnum.textGeneration)
+  const defaultModel = defaultTextGenerationModel
+    ? {
+        provider: defaultTextGenerationModel.provider.provider,
+        model: defaultTextGenerationModel.model,
+      }
+    : undefined
+  const currentModel = model ?? defaultModel
+  const {
+    textGenerationModelList,
+  } = useTextGenerationCurrentProviderAndModelAndModelList(currentModel)
+
+  return {
+    currentModel,
+    setConfigureModel: setModel,
+    textGenerationModelList,
+  }
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/__tests__/utils.spec.ts b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/__tests__/utils.spec.ts
new file mode 100644
index 00000000000..4648f90c238
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/__tests__/utils.spec.ts
@@ -0,0 +1,57 @@
+import type { OutputDraft } from '../utils'
+import { describe, expect, it } from 'vitest'
+import {
+  createOutputFromDraft,
+  getDefaultValueErrorKey,
+} from '../utils'
+
+const createDraft = (overrides: Partial<OutputDraft> = {}): OutputDraft => ({
+  defaultValue: '',
+  description: '',
+  name: 'summary',
+  required: false,
+  type: 'string',
+  ...overrides,
+})
+
+describe('agent output variables utils', () => {
+  it('should build a declared output from the editable draft', () => {
+    expect(createOutputFromDraft(createDraft({
+      defaultValue: '42',
+      description: 'A numeric score',
+      required: true,
+      type: 'number',
+    }))).toEqual({
+      name: 'summary',
+      type: 'number',
+      required: true,
+      description: 'A numeric score',
+      failure_strategy: {
+        on_failure: 'default_value',
+        default_value: 42,
+      },
+    })
+  })
+
+  it('should validate default values against the declared output type', () => {
+    expect(getDefaultValueErrorKey(createDraft({
+      defaultValue: 'not-json',
+      type: 'object',
+    }))).toBe('nodes.agent.outputVars.defaultValueObjectInvalid')
+
+    expect(getDefaultValueErrorKey(createDraft({
+      defaultValue: '{}',
+      type: 'array[string]',
+    }))).toBe('nodes.agent.outputVars.defaultValueArrayInvalid')
+
+    expect(getDefaultValueErrorKey(createDraft({
+      defaultValue: 'yes',
+      type: 'boolean',
+    }))).toBe('nodes.agent.outputVars.defaultValueBooleanInvalid')
+
+    expect(getDefaultValueErrorKey(createDraft({
+      defaultValue: '[]',
+      type: 'array[file]',
+    }))).toBe('nodes.agent.outputVars.defaultValueFileUnsupported')
+  })
+})
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/edit-card.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/edit-card.tsx
new file mode 100644
index 00000000000..3e66f868ad9
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/edit-card.tsx
@@ -0,0 +1,186 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { EditingState, OutputDraft } from './utils'
+import { Button } from '@langgenius/dify-ui/button'
+import { CollapsiblePanel, CollapsibleRoot, CollapsibleTrigger } from '@langgenius/dify-ui/collapsible'
+import { FieldControl, FieldError, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import { Form } from '@langgenius/dify-ui/form'
+import { Kbd, KbdGroup } from '@langgenius/dify-ui/kbd'
+import { Switch } from '@langgenius/dify-ui/switch'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { formatForDisplay, useHotkey } from '@tanstack/react-hotkeys'
+import { useId, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { OutputTypeSelect } from './type-select'
+import {
+  createOutputFromDraft,
+  getDefaultValueErrorKey,
+  OUTPUT_NAME_PATTERN,
+  OUTPUT_NAME_PATTERN_SOURCE,
+} from './utils'
+
+const CONFIRM_HOTKEY = 'Mod+Enter'
+
+function ConfirmHotkeyHint() {
+  const displayKeys = formatForDisplay(CONFIRM_HOTKEY, { separatorToken: ' ' })
+    .split(' ')
+    .filter(Boolean)
+
+  return (
+    <KbdGroup aria-hidden="true">
+      {displayKeys.map(key => (
+        <Kbd key={key} color="white">
+          {key}
+        </Kbd>
+      ))}
+    </KbdGroup>
+  )
+}
+
+export function OutputEditCard({
+  existingOutputs,
+  state,
+  onCancel,
+  onConfirm,
+}: {
+  existingOutputs: DeclaredOutputConfig[]
+  state: EditingState
+  onCancel: () => void
+  onConfirm: (output: DeclaredOutputConfig, index?: number) => void
+}) {
+  const { t } = useTranslation()
+  const nameErrorId = useId()
+  const editorRef = useRef<HTMLDivElement>(null)
+  const [draft, setDraft] = useState(state.draft)
+  const trimmedName = draft.name.trim()
+  const duplicateName = existingOutputs.some((output, index) => output.name === trimmedName && index !== state.index)
+  const nameInvalid = !!trimmedName && !OUTPUT_NAME_PATTERN.test(trimmedName)
+  const hasNameError = duplicateName || nameInvalid
+  const defaultValueErrorKey = getDefaultValueErrorKey(draft)
+  const confirmDisabled = !trimmedName || nameInvalid || duplicateName || !!defaultValueErrorKey
+  function updateDraft(next: Partial<OutputDraft>) {
+    setDraft(prev => ({ ...prev, ...next }))
+  }
+  function handleConfirm() {
+    if (confirmDisabled)
+      return
+    onConfirm(createOutputFromDraft(draft), state.index)
+  }
+  useHotkey(CONFIRM_HOTKEY, handleConfirm, { target: editorRef, ignoreInputs: false })
+  useHotkey('Escape', onCancel, { target: editorRef, ignoreInputs: false })
+  return (
+    <div ref={editorRef}>
+      <Form
+        aria-label={t('nodes.agent.outputVars.editorLabel', { ns: 'workflow' })}
+        className="flex flex-col overflow-hidden rounded-xl border border-components-panel-border bg-components-panel-bg shadow-md shadow-shadow-shadow-4"
+        onSubmit={(event) => {
+          event.preventDefault()
+          handleConfirm()
+        }}
+      >
+        <div className="px-2 pt-2">
+          <div className="flex h-6 items-center gap-x-2">
+            <FieldRoot name="name" invalid={hasNameError} className="contents">
+              <FieldLabel className="sr-only">
+                {t('nodes.agent.outputVars.nameLabel', { ns: 'workflow' })}
+              </FieldLabel>
+              <FieldControl
+                aria-describedby={hasNameError ? nameErrorId : undefined}
+                // eslint-disable-next-line jsx-a11y/no-autofocus -- Inline editor opens from an explicit user action and should focus the first editable field.
+                autoFocus
+                required
+                pattern={OUTPUT_NAME_PATTERN_SOURCE}
+                size="small"
+                value={draft.name}
+                placeholder={t('nodes.agent.outputVars.namePlaceholder', { ns: 'workflow' })}
+                className="h-6 w-24 px-1.5 py-0 code-sm-semibold"
+                onChange={event => updateDraft({ name: event.currentTarget.value })}
+              />
+            </FieldRoot>
+            <OutputTypeSelect
+              value={draft.type}
+              onChange={value => updateDraft({ type: value })}
+            />
+            <FieldRoot name="required" className="contents">
+              <FieldLabel className="flex h-6 items-center gap-x-1 system-xs-regular text-text-tertiary">
+                <Switch
+                  aria-label={t('nodes.agent.outputVars.requiredLabel', { ns: 'workflow' })}
+                  size="xs"
+                  checked={draft.required}
+                  onCheckedChange={required => updateDraft({ required })}
+                />
+                {t('nodes.agent.outputVars.requiredLabel', { ns: 'workflow' })}
+              </FieldLabel>
+            </FieldRoot>
+          </div>
+          {hasNameError && (
+            <FieldRoot name="nameError" invalid className="contents">
+              <FieldError id={nameErrorId} match className="mt-1 px-1 py-0 system-xs-regular text-text-destructive">
+                {duplicateName
+                  ? t('nodes.agent.outputVars.nameDuplicate', { ns: 'workflow' })
+                  : t('nodes.agent.outputVars.nameInvalid', { ns: 'workflow' })}
+              </FieldError>
+            </FieldRoot>
+          )}
+          <FieldRoot name="description" className="contents">
+            <FieldLabel className="sr-only">
+              {t('nodes.agent.outputVars.descriptionLabel', { ns: 'workflow' })}
+            </FieldLabel>
+            <FieldControl
+              size="small"
+              value={draft.description}
+              placeholder={t('nodes.agent.outputVars.descriptionPlaceholder', { ns: 'workflow' })}
+              className="mt-2 h-5 border-transparent bg-transparent px-1 py-0 system-xs-regular shadow-none hover:border-transparent hover:bg-transparent focus:bg-transparent"
+              onChange={event => updateDraft({ description: event.currentTarget.value })}
+            />
+          </FieldRoot>
+        </div>
+        <CollapsibleRoot>
+          <CollapsibleTrigger className="h-8 min-h-8 justify-start gap-x-0.5 rounded-none border-y border-divider-subtle pr-2 pl-2.5 system-xs-regular text-text-tertiary hover:not-data-disabled:bg-state-base-hover hover:not-data-disabled:text-text-tertiary focus-visible:bg-state-base-hover focus-visible:ring-inset data-panel-open:text-text-tertiary">
+            <span
+              aria-hidden="true"
+              className="i-ri-arrow-down-double-line size-3 transition-transform duration-100 ease-out group-data-panel-open:rotate-180 motion-reduce:transition-none"
+            />
+            {t('nodes.agent.outputVars.showAdvancedOptions', { ns: 'workflow' })}
+          </CollapsibleTrigger>
+          <CollapsiblePanel className="border-t border-divider-subtle">
+            <div className="px-3 py-2">
+              <FieldRoot name="defaultValue" className="gap-1">
+                <FieldLabel className="py-0 system-xs-medium text-text-secondary">
+                  {t('nodes.agent.outputVars.defaultValueLabel', { ns: 'workflow' })}
+                </FieldLabel>
+                <Textarea
+                  size="small"
+                  value={draft.defaultValue}
+                  placeholder={t('nodes.agent.outputVars.defaultValuePlaceholder', { ns: 'workflow' })}
+                  className="mt-1 min-h-6"
+                  onValueChange={defaultValue => updateDraft({ defaultValue })}
+                />
+                {defaultValueErrorKey && (
+                  <FieldError match className="py-0 system-xs-regular text-text-destructive">
+                    {t(defaultValueErrorKey, { ns: 'workflow' })}
+                  </FieldError>
+                )}
+              </FieldRoot>
+            </div>
+          </CollapsiblePanel>
+        </CollapsibleRoot>
+        <div className="flex h-12 items-center justify-end gap-x-2 px-3">
+          <Button type="button" size="small" variant="secondary" onClick={onCancel}>
+            {t('operation.cancel', { ns: 'common' })}
+          </Button>
+          <Button
+            type="submit"
+            size="small"
+            variant="primary"
+            disabled={confirmDisabled}
+            aria-label={t('nodes.agent.outputVars.confirm', { ns: 'workflow' })}
+            className="gap-x-1"
+          >
+            {t('nodes.agent.outputVars.confirm', { ns: 'workflow' })}
+            <ConfirmHotkeyHint />
+          </Button>
+        </div>
+      </Form>
+    </div>
+  )
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/index.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/index.tsx
new file mode 100644
index 00000000000..4303a18c1bc
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/index.tsx
@@ -0,0 +1,151 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { AgentOutputVariablesProps, EditingState } from './utils'
+import { Button } from '@langgenius/dify-ui/button'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import Divider from '@/app/components/base/divider'
+import OutputVars from '../../../_base/components/output-vars'
+import { OutputEditCard } from './edit-card'
+import {
+  createDraft,
+  getOutputDescription,
+  getOutputDisplayType,
+  getOutputTypeOptionValue,
+  isDefaultOutput,
+} from './utils'
+
+function OutputRow({
+  output,
+  editable,
+  onDelete,
+  onEdit,
+}: {
+  output: DeclaredOutputConfig
+  editable: boolean
+  onDelete: () => void
+  onEdit: () => void
+}) {
+  const { t } = useTranslation()
+  const description = getOutputDescription(output, t)
+  return (
+    <div className="group flex min-h-12 flex-col rounded-lg py-0.5 focus-within:bg-state-base-hover hover:bg-state-base-hover">
+      <div className="flex h-6 items-center gap-x-1 pr-0.5 pl-1">
+        <div className="flex min-w-0 grow items-center gap-x-1">
+          <span className="flex h-5 min-w-0 items-center px-1">
+            <span className="truncate code-sm-semibold leading-4 text-text-primary">{output.name}</span>
+          </span>
+          <span className="flex h-5 shrink-0 items-center px-1 system-xs-medium text-text-tertiary">{getOutputDisplayType(output)}</span>
+          {output.required && (
+            <span className="flex h-3 shrink-0 items-center px-1 system-2xs-medium-uppercase text-text-warning">
+              {t('nodes.agent.outputVars.requiredLabel', { ns: 'workflow' })}
+            </span>
+          )}
+        </div>
+        {editable && (
+          <div className="pointer-events-none flex shrink-0 items-center gap-x-0.5 opacity-0 group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100">
+            <button
+              type="button"
+              aria-label={t('nodes.agent.outputVars.edit', { ns: 'workflow', name: output.name })}
+              className="flex size-6 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover-alt hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+              onClick={onEdit}
+            >
+              <span aria-hidden="true" className="i-ri-pencil-line size-4" />
+            </button>
+            <button
+              type="button"
+              aria-label={t('nodes.agent.outputVars.delete', { ns: 'workflow', name: output.name })}
+              className="flex size-6 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover-alt hover:text-text-destructive focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+              onClick={onDelete}
+            >
+              <span aria-hidden="true" className="i-ri-delete-bin-line size-4" />
+            </button>
+          </div>
+        )}
+      </div>
+      {description && (
+        <div className="truncate px-2 pb-1 system-xs-regular text-text-tertiary">
+          {description}
+        </div>
+      )}
+    </div>
+  )
+}
+export function AgentOutputVariables({
+  outputs,
+  onChange,
+}: AgentOutputVariablesProps) {
+  const { t } = useTranslation()
+  const [editingState, setEditingState] = useState<EditingState | null>(null)
+  function handleNewOutput() {
+    setEditingState({ draft: createDraft() })
+  }
+  function handleEditOutput(index: number) {
+    setEditingState({ index, draft: createDraft(outputs[index]) })
+  }
+  function handleDeleteOutput(index: number) {
+    onChange(outputs.filter((_, outputIndex) => outputIndex !== index))
+  }
+  function handleConfirm(output: DeclaredOutputConfig, index?: number) {
+    if (typeof index === 'number') {
+      onChange(outputs.map((item, outputIndex) => outputIndex === index ? output : item))
+    }
+    else {
+      onChange([...outputs, output])
+    }
+    setEditingState(null)
+  }
+  return (
+    <OutputVars>
+      <div className="pb-2">
+        <div className="flex flex-col">
+          {outputs.map((output, index) => (
+            editingState?.index === index
+              ? (
+                  <OutputEditCard
+                    key={`${output.name}-editing`}
+                    existingOutputs={outputs}
+                    state={editingState}
+                    onCancel={() => setEditingState(null)}
+                    onConfirm={handleConfirm}
+                  />
+                )
+              : (
+                  <OutputRow
+                    key={`${output.name}-${getOutputTypeOptionValue(output)}`}
+                    output={output}
+                    editable={!isDefaultOutput(output)}
+                    onDelete={() => handleDeleteOutput(index)}
+                    onEdit={() => handleEditOutput(index)}
+                  />
+                )
+          ))}
+          <div className="py-1">
+            <Divider type="horizontal" className="h-px bg-divider-subtle" />
+          </div>
+          {editingState && editingState.index == null
+            ? (
+                <OutputEditCard
+                  existingOutputs={outputs}
+                  state={editingState}
+                  onCancel={() => setEditingState(null)}
+                  onConfirm={handleConfirm}
+                />
+              )
+            : (
+                <div className="pt-1">
+                  <Button
+                    size="small"
+                    variant="tertiary"
+                    className="h-6 w-full gap-x-1 rounded-md bg-components-input-bg-normal text-text-secondary hover:bg-state-base-hover"
+                    onClick={handleNewOutput}
+                  >
+                    <span aria-hidden="true" className="i-ri-add-line size-3.5" />
+                    {t('nodes.agent.outputVars.newOutput', { ns: 'workflow' })}
+                  </Button>
+                </div>
+              )}
+        </div>
+      </div>
+    </OutputVars>
+  )
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/type-select.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/type-select.tsx
new file mode 100644
index 00000000000..ffdea9b4958
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/type-select.tsx
@@ -0,0 +1,51 @@
+import type { OutputTypeOptionValue } from './utils'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectItemIndicator,
+  SelectItemText,
+  SelectLabel,
+  SelectTrigger,
+} from '@langgenius/dify-ui/select'
+import { useTranslation } from 'react-i18next'
+import { getOutputTypeOption, OUTPUT_TYPE_OPTIONS } from './utils'
+
+export function OutputTypeSelect({
+  value,
+  onChange,
+}: {
+  value: OutputTypeOptionValue
+  onChange: (value: OutputTypeOptionValue) => void
+}) {
+  const { t } = useTranslation()
+  const selected = getOutputTypeOption(value)
+
+  return (
+    <Select<OutputTypeOptionValue>
+      value={value}
+      onValueChange={(nextValue) => {
+        if (nextValue)
+          onChange(nextValue)
+      }}
+    >
+      <SelectLabel className="sr-only">
+        {t('nodes.agent.outputVars.typeLabel', { ns: 'workflow' })}
+      </SelectLabel>
+      <SelectTrigger
+        aria-label={t('nodes.agent.outputVars.typeLabel', { ns: 'workflow' })}
+        className="h-6 w-auto rounded-md bg-transparent px-1 py-0 system-xs-medium text-text-tertiary hover:bg-state-base-hover"
+      >
+        {selected.label}
+      </SelectTrigger>
+      <SelectContent popupClassName="w-40">
+        {OUTPUT_TYPE_OPTIONS.map(option => (
+          <SelectItem key={option.value} value={option.value}>
+            <SelectItemText>{option.label}</SelectItemText>
+            <SelectItemIndicator />
+          </SelectItem>
+        ))}
+      </SelectContent>
+    </Select>
+  )
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/utils.ts b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/utils.ts
new file mode 100644
index 00000000000..39e35c64a72
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-output-variables/utils.ts
@@ -0,0 +1,200 @@
+import type { DeclaredOutputConfig, DeclaredOutputType } from '@dify/contracts/api/console/apps/types.gen'
+import type { TFunction } from 'i18next'
+import { defaultAgentV2DeclaredOutputs } from '../../output-variables'
+
+export type OutputTypeOptionValue
+  = DeclaredOutputType
+    | 'array[boolean]'
+    | 'array[file]'
+    | 'array[number]'
+    | 'array[object]'
+    | 'array[string]'
+
+export type OutputTypeOption = {
+  label: string
+  type: DeclaredOutputType
+  value: OutputTypeOptionValue
+  arrayItemType?: DeclaredOutputType
+}
+
+export type OutputDraft = {
+  defaultValue: string
+  description: string
+  name: string
+  required: boolean
+  type: OutputTypeOptionValue
+}
+
+export type EditingState = {
+  draft: OutputDraft
+  index?: number
+}
+
+export type AgentOutputVariablesProps = {
+  outputs: DeclaredOutputConfig[]
+  onChange: (outputs: DeclaredOutputConfig[]) => void
+}
+
+export const OUTPUT_NAME_PATTERN = /^[a-z_]\w*$/i
+export const OUTPUT_NAME_PATTERN_SOURCE = '[A-Za-z_][A-Za-z0-9_]*'
+
+export const OUTPUT_TYPE_OPTIONS: OutputTypeOption[] = [
+  { value: 'string', label: 'string', type: 'string' },
+  { value: 'number', label: 'number', type: 'number' },
+  { value: 'boolean', label: 'boolean', type: 'boolean' },
+  { value: 'object', label: 'object', type: 'object' },
+  { value: 'file', label: 'file', type: 'file' },
+  { value: 'array[string]', label: 'array[string]', type: 'array', arrayItemType: 'string' },
+  { value: 'array[number]', label: 'array[number]', type: 'array', arrayItemType: 'number' },
+  { value: 'array[boolean]', label: 'array[boolean]', type: 'array', arrayItemType: 'boolean' },
+  { value: 'array[object]', label: 'array[object]', type: 'array', arrayItemType: 'object' },
+  { value: 'array[file]', label: 'array[file]', type: 'array', arrayItemType: 'file' },
+]
+
+export function getOutputTypeOptionValue(output: DeclaredOutputConfig): OutputTypeOptionValue {
+  if (output.type !== 'array')
+    return output.type
+
+  return `array[${output.array_item?.type || 'object'}]` as OutputTypeOptionValue
+}
+
+export function getOutputTypeOption(value: OutputTypeOptionValue) {
+  return OUTPUT_TYPE_OPTIONS.find(option => option.value === value) || OUTPUT_TYPE_OPTIONS[0]!
+}
+
+export function createDraft(output?: DeclaredOutputConfig): OutputDraft {
+  if (!output) {
+    return {
+      defaultValue: '',
+      description: '',
+      name: '',
+      required: false,
+      type: 'string',
+    }
+  }
+
+  return {
+    defaultValue: getOutputDefaultValue(output),
+    description: output.description || '',
+    name: output.name,
+    required: output.required ?? true,
+    type: getOutputTypeOptionValue(output),
+  }
+}
+
+export function createOutputFromDraft(draft: OutputDraft): DeclaredOutputConfig {
+  const option = getOutputTypeOption(draft.type)
+  const output: DeclaredOutputConfig = {
+    name: draft.name.trim(),
+    type: option.type,
+    required: draft.required,
+  }
+
+  if (draft.description.trim())
+    output.description = draft.description.trim()
+
+  if (option.type === 'array') {
+    output.array_item = {
+      type: option.arrayItemType || 'object',
+    }
+  }
+
+  if (option.type === 'file') {
+    output.file = {
+      extensions: [],
+      mime_types: [],
+    }
+  }
+
+  if (draft.defaultValue.trim()) {
+    output.failure_strategy = {
+      on_failure: 'default_value',
+      default_value: coerceDefaultValue(draft.defaultValue, option),
+    }
+  }
+
+  return output
+}
+
+export function getDefaultValueErrorKey(draft: OutputDraft) {
+  const trimmed = draft.defaultValue.trim()
+  if (!trimmed)
+    return null
+
+  const option = getOutputTypeOption(draft.type)
+  if (option.type === 'file' || option.arrayItemType === 'file')
+    return 'nodes.agent.outputVars.defaultValueFileUnsupported'
+
+  if (option.type === 'number' && Number.isNaN(Number(trimmed)))
+    return 'nodes.agent.outputVars.defaultValueNumberInvalid'
+
+  if (option.type === 'boolean' && trimmed !== 'true' && trimmed !== 'false')
+    return 'nodes.agent.outputVars.defaultValueBooleanInvalid'
+
+  if (option.type === 'object' || option.type === 'array') {
+    try {
+      const parsed = JSON.parse(trimmed)
+      if (option.type === 'object' && (!parsed || Array.isArray(parsed) || typeof parsed !== 'object'))
+        return 'nodes.agent.outputVars.defaultValueObjectInvalid'
+      if (option.type === 'array' && !Array.isArray(parsed))
+        return 'nodes.agent.outputVars.defaultValueArrayInvalid'
+    }
+    catch {
+      return option.type === 'object'
+        ? 'nodes.agent.outputVars.defaultValueObjectInvalid'
+        : 'nodes.agent.outputVars.defaultValueArrayInvalid'
+    }
+  }
+
+  return null
+}
+
+export function isDefaultOutput(output: DeclaredOutputConfig) {
+  return defaultAgentV2DeclaredOutputs.some(defaultOutput =>
+    defaultOutput.name === output.name
+    && defaultOutput.type === output.type
+    && getOutputTypeOptionValue(defaultOutput) === getOutputTypeOptionValue(output),
+  )
+}
+
+export function getOutputDescription(output: DeclaredOutputConfig, t: TFunction) {
+  if (output.name === 'text')
+    return t('nodes.agent.outputVars.text', { ns: 'workflow' })
+  if (output.name === 'files')
+    return t('nodes.agent.outputVars.files.title', { ns: 'workflow' })
+  if (output.name === 'json')
+    return t('nodes.agent.outputVars.json', { ns: 'workflow' })
+  return output.description || ''
+}
+
+export function getOutputDisplayType(output: DeclaredOutputConfig) {
+  return getOutputTypeOption(getOutputTypeOptionValue(output)).label
+}
+
+function getOutputDefaultValue(output: DeclaredOutputConfig) {
+  const defaultValue = output.failure_strategy?.default_value
+  if (defaultValue == null)
+    return ''
+  if (typeof defaultValue === 'string')
+    return defaultValue
+  return JSON.stringify(defaultValue)
+}
+
+function coerceDefaultValue(value: string, option: OutputTypeOption): unknown {
+  const trimmed = value.trim()
+  if (option.type === 'number') {
+    const parsed = Number(trimmed)
+    return Number.isNaN(parsed) ? trimmed : parsed
+  }
+  if (option.type === 'boolean')
+    return trimmed === 'true'
+  if (option.type === 'object' || option.type === 'array') {
+    try {
+      return JSON.parse(trimmed)
+    }
+    catch {
+      return trimmed
+    }
+  }
+  return trimmed
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-roster-field.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-roster-field.tsx
new file mode 100644
index 00000000000..5a933f63830
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-roster-field.tsx
@@ -0,0 +1,378 @@
+import type { ReactNode, RefObject } from 'react'
+import type { AgentRosterNodeData } from '@/app/components/workflow/block-selector/types'
+import type { AppIconType } from '@/types/app'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  Drawer,
+  DrawerCloseButton,
+  DrawerContent,
+  DrawerPopup,
+  DrawerPortal,
+  DrawerTitle,
+  DrawerViewport,
+} from '@langgenius/dify-ui/drawer'
+import { FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import {
+  Popover,
+  PopoverContent,
+  PopoverTitle,
+  PopoverTrigger,
+} from '@langgenius/dify-ui/popover'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import { AgentSelectorContent } from '@/app/components/workflow/block-selector/agent-selector'
+import { getAgentDetailPath } from '@/features/agent-v2/agent-detail/routes'
+import Link from '@/next/link'
+
+const i18nPrefix = 'nodes.agent'
+type AgentRosterDrawerMode = 'setup' | 'detail'
+
+type AgentRosterDisplayData = {
+  description?: string | null
+  icon?: string | null
+  icon_background?: string | null
+  icon_type?: string | null
+  id: string
+  name: string
+  role?: string | null
+}
+
+const getAppIconType = (iconType?: string | null): AppIconType | null => {
+  if (iconType === 'emoji' || iconType === 'image' || iconType === 'link')
+    return iconType
+
+  return null
+}
+
+function AgentRosterAvatar({
+  agent,
+  size = 'lg',
+  className,
+}: {
+  agent: AgentRosterDisplayData
+  size?: 'xs' | 'md' | 'lg'
+  className?: string
+}) {
+  const iconSize = size === 'md' ? 'medium' : size === 'xs' ? 'tiny' : 'small'
+
+  return (
+    <AppIcon
+      size={iconSize}
+      iconType={getAppIconType(agent.icon_type)}
+      icon={agent.icon ?? undefined}
+      background={agent.icon_background}
+      imageUrl={agent.icon ?? undefined}
+      className={className}
+    />
+  )
+}
+
+function InlineSetupAvatar({
+  className,
+}: {
+  className?: string
+}) {
+  return (
+    <span className={cn('flex size-8 shrink-0 items-center justify-center rounded-full bg-background-default-burn', className)}>
+      <span aria-hidden className="i-custom-vender-agent-v2-robot-3 size-5 text-text-tertiary" />
+    </span>
+  )
+}
+
+function AgentRosterDrawer({
+  agent,
+  children,
+  mode = 'detail',
+  open,
+  portalContainerRef,
+  showAccessIcon = true,
+  showConsoleLink = true,
+  showDetailActions = true,
+  onClose,
+}: {
+  agent: AgentRosterDisplayData
+  children?: ReactNode
+  mode?: AgentRosterDrawerMode
+  open: boolean
+  portalContainerRef: RefObject<HTMLDivElement | null>
+  showAccessIcon?: boolean
+  showConsoleLink?: boolean
+  showDetailActions?: boolean
+  onClose: () => void
+}) {
+  const { t } = useTranslation()
+  const isSetup = mode === 'setup'
+  const title = isSetup ? t(`${i18nPrefix}.roster.inlineSetup.title`, { ns: 'workflow' }) : agent.name
+  const description = isSetup ? t(`${i18nPrefix}.roster.inlineSetup.description`, { ns: 'workflow' }) : agent.role
+
+  return (
+    <Drawer
+      open={open}
+      modal={false}
+      disablePointerDismissal
+      swipeDirection="right"
+      onOpenChange={(nextOpen) => {
+        if (!nextOpen)
+          onClose()
+      }}
+    >
+      <DrawerPortal container={portalContainerRef}>
+        <DrawerViewport className="pointer-events-none">
+          <DrawerPopup
+            className="pointer-events-auto p-0 data-[swipe-direction=right]:top-14 data-[swipe-direction=right]:bottom-1 data-[swipe-direction=right]:h-auto data-[swipe-direction=right]:rounded-2xl data-[swipe-direction=right]:border-[0.5px] data-[swipe-direction=right]:border-r-[0.5px] data-[swipe-direction=right]:border-divider-subtle data-[swipe-direction=right]:shadow-2xl data-[swipe-direction=right]:shadow-shadow-shadow-5"
+            style={{
+              right: 'var(--workflow-node-panel-right, 4px)',
+              width: 'var(--workflow-node-panel-width, 400px)',
+            }}
+          >
+            <DrawerContent className="flex h-full min-h-0 flex-1 flex-col overflow-hidden p-0 pb-0">
+              <header
+                className={cn(
+                  'flex shrink-0 flex-col border-b border-divider-subtle bg-components-panel-bg',
+                  isSetup
+                    ? 'h-16 px-4 py-3'
+                    : showDetailActions
+                      ? 'h-[108px] gap-3 py-3 pr-4 pl-3'
+                      : 'py-3 pr-4 pl-3',
+                )}
+              >
+                <div className="flex min-w-0 items-start justify-between">
+                  <div className={cn('flex min-w-0 flex-1', isSetup ? 'min-w-px flex-col' : 'h-10 items-center gap-2 px-0.5 py-0.5')}>
+                    {!isSetup && <AgentRosterAvatar agent={agent} size="md" className="size-9" />}
+                    <div className={cn('flex min-w-0 flex-1 flex-col', isSetup ? '' : 'gap-0.5 py-px')}>
+                      <div className="flex min-w-0 items-center gap-1">
+                        <DrawerTitle className={cn('truncate', isSetup ? 'system-xl-semibold text-text-primary' : 'system-sm-medium text-text-secondary')}>
+                          {title}
+                        </DrawerTitle>
+                        {!isSetup && showAccessIcon && <span aria-hidden className="i-ri-lock-line size-3 shrink-0 text-text-tertiary" />}
+                      </div>
+                      {description && (
+                        <p className={cn(isSetup ? 'min-w-full' : 'truncate', 'system-xs-regular text-text-tertiary')}>
+                          {description}
+                        </p>
+                      )}
+                    </div>
+                  </div>
+                  <div className="flex shrink-0 items-center gap-1 py-1">
+                    <button
+                      type="button"
+                      aria-label={t(`${i18nPrefix}.roster.more`, { ns: 'workflow' })}
+                      className="flex size-6 cursor-pointer items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+                    >
+                      <span aria-hidden className="i-ri-more-fill size-4" />
+                    </button>
+                    <div className="flex h-3.5 items-start px-1">
+                      <div className="h-full w-px bg-divider-regular" />
+                    </div>
+                    <DrawerCloseButton
+                      aria-label={t('operation.close', { ns: 'common' })}
+                      className="size-6 rounded-md"
+                    />
+                  </div>
+                </div>
+                {!isSetup && showDetailActions && (
+                  <div className="flex h-8 gap-2 pl-1">
+                    {showConsoleLink && (
+                      <Link
+                        href={getAgentDetailPath(agent.id, 'configure')}
+                        className="inline-flex h-8 min-w-0 flex-1 cursor-pointer items-center justify-center gap-1.5 rounded-lg border-[0.5px] border-components-button-secondary-border bg-components-button-secondary-bg px-3 text-[13px] leading-4 font-medium whitespace-nowrap text-components-button-secondary-text shadow-xs outline-hidden backdrop-blur-[5px] hover:border-components-button-secondary-border-hover hover:bg-components-button-secondary-bg-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+                      >
+                        <span aria-hidden className="i-ri-external-link-line size-4 shrink-0" />
+                        <span className="truncate">
+                          {t(`${i18nPrefix}.roster.editInConsole`, { ns: 'workflow' })}
+                        </span>
+                      </Link>
+                    )}
+                    <Button
+                      variant="secondary"
+                      size="medium"
+                      className="min-w-0 flex-1 gap-1.5 px-3"
+                    >
+                      <span aria-hidden className="i-ri-file-copy-2-line size-4 shrink-0" />
+                      <span className="truncate">
+                        {t(`${i18nPrefix}.roster.makeCopy`, { ns: 'workflow' })}
+                      </span>
+                    </Button>
+                  </div>
+                )}
+              </header>
+              <div
+                role="region"
+                aria-label={t(`${i18nPrefix}.roster.panelLabel`, { ns: 'workflow', name: agent.name })}
+                className="min-h-0 flex-1 overflow-hidden bg-components-panel-bg"
+              >
+                {children ?? <div className="h-full min-h-80 bg-components-panel-bg" />}
+              </div>
+            </DrawerContent>
+          </DrawerPopup>
+        </DrawerViewport>
+      </DrawerPortal>
+    </Drawer>
+  )
+}
+
+export function AgentRosterField({
+  agent,
+  agentId,
+  canOpenPanel = true,
+  isPanelOpen,
+  isPending = false,
+  isLoading = false,
+  isInlineSetup = false,
+  panelBody,
+  panelMode = 'detail',
+  showPanelDetailActions = true,
+  portalContainerRef,
+  onChange,
+  onPanelOpenChange,
+}: {
+  agent?: AgentRosterDisplayData
+  agentId?: string
+  canOpenPanel?: boolean
+  isPanelOpen?: boolean
+  isLoading?: boolean
+  isInlineSetup?: boolean
+  isPending?: boolean
+  panelBody?: ReactNode
+  panelMode?: AgentRosterDrawerMode
+  showPanelDetailActions?: boolean
+  portalContainerRef: RefObject<HTMLDivElement | null>
+  onChange: (agent: AgentRosterNodeData) => void
+  onPanelOpenChange?: (open: boolean) => void
+}) {
+  const { t } = useTranslation()
+  const [localPanelOpen, setLocalPanelOpen] = useState(false)
+  const [isSelectorOpen, setIsSelectorOpen] = useState(false)
+  const panelOpen = isPanelOpen ?? localPanelOpen
+  const setPanelOpen = onPanelOpenChange ?? setLocalPanelOpen
+  const inlineSetupName = t(`${i18nPrefix}.roster.inlineSetup.name`, { ns: 'workflow' })
+  const inlineSetupType = t(`${i18nPrefix}.roster.inlineSetup.type`, { ns: 'workflow' })
+  const rosterRequiredMessage = t('errorMsg.fieldRequired', {
+    ns: 'workflow',
+    field: t(`${i18nPrefix}.roster.label`, { ns: 'workflow' }),
+  })
+  const agentContent = agent
+    ? (
+        <>
+          {isInlineSetup ? <InlineSetupAvatar /> : <AgentRosterAvatar agent={agent} />}
+          <span className="flex min-w-0 flex-1 flex-col gap-0.5 py-px">
+            <span className="truncate system-sm-medium text-text-secondary">
+              {isInlineSetup ? inlineSetupName : agent.name}
+            </span>
+            <span className="truncate system-xs-regular text-text-tertiary">
+              {isInlineSetup ? inlineSetupType : agent.role}
+            </span>
+          </span>
+        </>
+      )
+    : null
+  const loadingContent = (
+    <>
+      <span aria-hidden className="size-8 shrink-0 rounded-lg bg-text-quaternary/20" />
+      <span aria-hidden className="flex min-w-0 flex-1 flex-col gap-1.5">
+        <span className="h-2.5 w-24 rounded-xs bg-text-quaternary/20" />
+        <span className="h-2 w-16 rounded-xs bg-text-quaternary/15" />
+      </span>
+    </>
+  )
+
+  return (
+    <FieldRoot name="agent_binding" className="gap-1 px-4 py-2">
+      <div className="flex h-6 items-center gap-2">
+        <FieldLabel className="min-w-0 flex-1 py-1 system-sm-semibold-uppercase! text-text-secondary">
+          {t('nodes.agent.roster.label', { ns: 'workflow' })}
+        </FieldLabel>
+        <Popover
+          open={isPending ? false : isSelectorOpen}
+          onOpenChange={(open) => {
+            if (!isPending)
+              setIsSelectorOpen(open)
+          }}
+        >
+          <PopoverTrigger
+            render={(
+              <button
+                type="button"
+                disabled={isPending}
+                className={cn('flex h-6 shrink-0 cursor-pointer items-center justify-center rounded-md px-1.5 py-1 system-xs-medium text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden', isPending && 'cursor-not-allowed opacity-50 hover:bg-transparent hover:text-text-tertiary')}
+              >
+                {t(`${i18nPrefix}.roster.change`, { ns: 'workflow' })}
+              </button>
+            )}
+          />
+          <PopoverContent
+            placement="bottom-end"
+            sideOffset={4}
+            popupClassName="border-none bg-transparent p-0 shadow-none backdrop-blur-none"
+          >
+            <PopoverTitle className="sr-only">
+              {t('roster.nodeSelector.dialogLabel', { ns: 'agentV2' })}
+            </PopoverTitle>
+            <AgentSelectorContent
+              open={isSelectorOpen}
+              onOpenChange={setIsSelectorOpen}
+              onSelect={(nextAgent) => {
+                setIsSelectorOpen(false)
+                onChange(nextAgent)
+              }}
+            />
+          </PopoverContent>
+        </Popover>
+      </div>
+      {agent
+        ? (
+            canOpenPanel
+              ? (
+                  <>
+                    <button
+                      type="button"
+                      aria-label={t(`${i18nPrefix}.roster.openPanel`, { ns: 'workflow', name: isInlineSetup ? inlineSetupName : agent.name })}
+                      aria-busy={isLoading || undefined}
+                      className="flex h-13 w-full min-w-0 cursor-pointer items-center gap-2 rounded-[10px] border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg py-2 pr-4 pl-2 text-left shadow-xs shadow-shadow-shadow-3 hover:bg-components-panel-on-panel-item-bg-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+                      onClick={() => setPanelOpen(true)}
+                    >
+                      {isLoading ? loadingContent : agentContent}
+                      <span className="flex shrink-0 items-center text-text-tertiary">
+                        <span aria-hidden className="i-ri-arrow-right-line size-4" />
+                      </span>
+                    </button>
+                    <AgentRosterDrawer
+                      agent={agent}
+                      mode={panelMode}
+                      open={panelOpen}
+                      portalContainerRef={portalContainerRef}
+                      showAccessIcon={!isInlineSetup}
+                      showDetailActions={showPanelDetailActions}
+                      onClose={() => setPanelOpen(false)}
+                    >
+                      {panelBody}
+                    </AgentRosterDrawer>
+                  </>
+                )
+              : (
+                  <div className="flex h-13 w-full min-w-0 items-center gap-2 rounded-[10px] border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg py-2 pr-4 pl-2 text-left shadow-xs shadow-shadow-shadow-3">
+                    {agentContent}
+                  </div>
+                )
+          )
+        : isPending || agentId
+          ? (
+              <div aria-busy="true" className="flex h-13 w-full min-w-0 items-center gap-2 rounded-[10px] border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg py-2 pr-4 pl-2 text-left shadow-xs shadow-shadow-shadow-3">
+                {loadingContent}
+              </div>
+            )
+          : (
+              <div className="flex h-13 w-full min-w-0 items-center gap-2 rounded-[10px] border-[0.5px] border-state-destructive-border bg-components-panel-on-panel-item-bg py-2 pr-4 pl-2 text-left shadow-xs shadow-shadow-shadow-3">
+                <span className="flex size-8 shrink-0 items-center justify-center rounded-lg bg-state-destructive-hover text-text-destructive">
+                  <span aria-hidden className="i-ri-error-warning-line size-4" />
+                </span>
+                <span className="min-w-0 flex-1 truncate system-sm-medium text-text-destructive">
+                  {rosterRequiredMessage}
+                </span>
+              </div>
+            )}
+    </FieldRoot>
+  )
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-task-field.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-task-field.tsx
new file mode 100644
index 00000000000..7ae37e81dea
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-task-field.tsx
@@ -0,0 +1,152 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { AgentV2NodeType } from '../types'
+import type { WorkflowNodesMap } from '@/app/components/base/prompt-editor/types'
+import { cn } from '@langgenius/dify-ui/cn'
+import { FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import { useLexicalComposerContext } from '@lexical/react/LexicalComposerContext'
+import { useBoolean } from 'ahooks'
+import { $insertNodes } from 'lexical'
+import { useCallback } from 'react'
+import { useTranslation } from 'react-i18next'
+import { Infotip } from '@/app/components/base/infotip'
+import PromptEditor from '@/app/components/base/prompt-editor'
+import { $createCustomTextNode } from '@/app/components/base/prompt-editor/plugins/custom-text/node'
+import { useWorkflowVariableType } from '../../../hooks'
+import { BlockEnum } from '../../../types'
+import useAvailableVarList from '../../_base/hooks/use-available-var-list'
+
+const i18nPrefix = 'nodes.agent'
+
+function AgentTaskToolbar({
+  taskLength,
+  onInsert,
+}: {
+  taskLength: number
+  onInsert: () => void
+}) {
+  const { t } = useTranslation()
+  const [editor] = useLexicalComposerContext()
+
+  const handleInsert = useCallback(() => {
+    onInsert()
+    editor.focus()
+    editor.update(() => {
+      $insertNodes([$createCustomTextNode('/')])
+    })
+  }, [editor, onInsert])
+
+  return (
+    <div className="flex h-8 shrink-0 items-center justify-between px-3 text-text-tertiary">
+      <div className="flex min-w-0 items-center gap-3">
+        <button
+          type="button"
+          className="flex items-center gap-1 system-xs-medium hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          onClick={handleInsert}
+        >
+          <span aria-hidden className="i-ri-slash-commands-2 size-3.5" />
+          {t(`${i18nPrefix}.task.insert`, { ns: 'workflow' })}
+        </button>
+      </div>
+      <div className="rounded-sm border border-divider-regular bg-background-default px-1 system-2xs-regular text-text-tertiary">
+        {taskLength}
+      </div>
+    </div>
+  )
+}
+
+export function AgentTaskField({
+  id,
+  data,
+  readOnly,
+  onChange,
+  outputs,
+  onOutputsChange,
+}: {
+  id: string
+  data: AgentV2NodeType
+  readOnly?: boolean
+  onChange: (value: string) => void
+  outputs: DeclaredOutputConfig[]
+  onOutputsChange: (outputs: DeclaredOutputConfig[], prompt?: string) => void
+}) {
+  const { t } = useTranslation()
+  const getVarType = useWorkflowVariableType()
+  const {
+    availableVars,
+    availableNodesWithParent,
+  } = useAvailableVarList(id)
+  const [isFocus, {
+    setTrue: setFocus,
+    setFalse: setBlur,
+  }] = useBoolean(false)
+
+  const workflowNodesMap = availableNodesWithParent.reduce<WorkflowNodesMap>((acc, node) => {
+    acc[node.id] = {
+      title: node.data.title,
+      type: node.data.type,
+      width: node.width ?? undefined,
+      height: node.height ?? undefined,
+      position: node.position,
+    }
+    if (node.data.type === BlockEnum.Start) {
+      acc.sys = {
+        title: t('blocks.start', { ns: 'workflow' }),
+        type: BlockEnum.Start,
+      }
+    }
+    return acc
+  }, {})
+
+  return (
+    <FieldRoot name="agent_task" className="gap-1 px-4 py-2">
+      <div className="flex h-6 items-center gap-1">
+        <FieldLabel className="min-w-0 py-1 system-sm-semibold-uppercase! text-text-secondary">
+          {t(`${i18nPrefix}.task.label`, { ns: 'workflow' })}
+        </FieldLabel>
+        <Infotip aria-label={t(`${i18nPrefix}.task.tooltip`, { ns: 'workflow' })}>
+          {t(`${i18nPrefix}.task.tooltip`, { ns: 'workflow' })}
+        </Infotip>
+      </div>
+      <div
+        className={cn(
+          'h-80 rounded-[9px]! p-0.5',
+          isFocus ? 'bg-linear-to-r from-components-input-border-active-prompt-1 to-components-input-border-active-prompt-2' : 'bg-transparent',
+          readOnly && 'pointer-events-none',
+        )}
+      >
+        <div className={cn('flex h-full flex-col rounded-lg', isFocus ? 'bg-background-default' : 'bg-components-input-bg-normal')}>
+          <PromptEditor
+            wrapperClassName="flex h-full flex-col"
+            value={data.agent_task || ''}
+            onChange={onChange}
+            editable={!readOnly}
+            compact
+            className="min-h-0 flex-1 overflow-y-auto px-3 py-2"
+            placeholderClassName="px-3 py-2"
+            placeholder={t(`${i18nPrefix}.task.placeholder`, { ns: 'workflow' })}
+            onFocus={setFocus}
+            onBlur={setBlur}
+            workflowVariableBlock={{
+              show: true,
+              variables: availableVars,
+              getVarType,
+              workflowNodesMap,
+            }}
+            agentOutputBlock={{
+              show: true,
+              outputs,
+              onChange: onOutputsChange,
+            }}
+          >
+            {isFocus && (
+              <AgentTaskToolbar
+                taskLength={(data.agent_task || '').length}
+                onInsert={setFocus}
+              />
+            )}
+          </PromptEditor>
+        </div>
+      </div>
+    </FieldRoot>
+  )
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/default.ts b/web/app/components/workflow/nodes/agent-v2/default.ts
new file mode 100644
index 00000000000..d1575b32f07
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/default.ts
@@ -0,0 +1,36 @@
+import type { NodeDefault } from '../../types'
+import type { AgentV2NodeType } from './types'
+import { BlockEnum } from '../../types'
+import { genNodeMetaData } from '../../utils'
+import { hasValidAgentBinding } from './types'
+
+const metaData = genNodeMetaData({
+  sort: 3,
+  type: BlockEnum.AgentV2,
+})
+
+const nodeDefault: NodeDefault<AgentV2NodeType> = {
+  metaData,
+  defaultValue: {
+    agent_node_kind: 'dify_agent',
+    version: '2',
+  },
+  checkValid(payload, t) {
+    if (!hasValidAgentBinding(payload)) {
+      return {
+        isValid: false,
+        errorMessage: t('errorMsg.fieldRequired', {
+          ns: 'workflow',
+          field: t('nodes.agent.roster.label', { ns: 'workflow' }),
+        }),
+      }
+    }
+
+    return {
+      isValid: true,
+      errorMessage: '',
+    }
+  },
+}
+
+export default nodeDefault
diff --git a/web/app/components/workflow/nodes/agent-v2/hooks.ts b/web/app/components/workflow/nodes/agent-v2/hooks.ts
new file mode 100644
index 00000000000..6d9bbbd3d44
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/hooks.ts
@@ -0,0 +1,114 @@
+import type { AgentInlineBinding } from '../../block-selector/types'
+import { toast } from '@langgenius/dify-ui/toast'
+import { skipToken, useMutation, useQuery } from '@tanstack/react-query'
+import { useCallback } from 'react'
+import { useTranslation } from 'react-i18next'
+import { ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { useDefaultModel } from '@/app/components/header/account-setting/model-provider-page/hooks'
+import { useHooksStore } from '@/app/components/workflow/hooks-store'
+import { consoleQuery } from '@/service/client'
+import { FlowType } from '@/types/common'
+import { getDefaultAgentSoul } from './agent-soul-config'
+
+type CreatedInlineAgentBinding = AgentInlineBinding & {
+  agent_id: string
+  current_snapshot_id: string
+}
+
+type CreateInlineAgentBindingOptions = {
+  onError?: () => void
+  onSuccess?: (binding: CreatedInlineAgentBinding) => void
+}
+
+export function useAgentRosterDetail(agentId?: string) {
+  return useQuery(consoleQuery.agent.byAgentId.get.queryOptions({
+    input: agentId
+      ? {
+          params: {
+            agent_id: agentId,
+          },
+        }
+      : skipToken,
+  }))
+}
+
+export function useWorkflowInlineAgentDetail(nodeId?: string, agentId?: string | null) {
+  const configsMap = useHooksStore(state => state.configsMap)
+
+  return useQuery(consoleQuery.apps.byAppId.workflows.draft.nodes.byNodeId.agentComposer.get.queryOptions({
+    input: configsMap?.flowId && configsMap.flowType === FlowType.appFlow && nodeId && agentId
+      ? {
+          params: {
+            app_id: configsMap.flowId,
+            node_id: nodeId,
+          },
+        }
+      : skipToken,
+  }))
+}
+
+export function useCreateInlineAgentBinding() {
+  const { t } = useTranslation('agentV2')
+  const configsMap = useHooksStore(state => state.configsMap)
+  const { data: defaultModel } = useDefaultModel(ModelTypeEnum.textGeneration)
+  const {
+    isPending,
+    mutate,
+  } = useMutation(
+    consoleQuery.apps.byAppId.workflows.draft.nodes.byNodeId.agentComposer.put.mutationOptions(),
+  )
+
+  const createInlineAgentBinding = useCallback((nodeId: string, options?: CreateInlineAgentBindingOptions) => {
+    if (!configsMap?.flowId || configsMap.flowType !== FlowType.appFlow) {
+      toast.error(t('roster.nodeSelector.createInlineFailed'))
+      options?.onError?.()
+      return
+    }
+
+    mutate(
+      {
+        params: {
+          app_id: configsMap.flowId,
+          node_id: nodeId,
+        },
+        body: {
+          variant: 'workflow',
+          save_strategy: 'node_job_only',
+          soul_lock: {
+            locked: false,
+          },
+          agent_soul: getDefaultAgentSoul(defaultModel),
+        },
+      },
+      {
+        onSuccess: (composerState) => {
+          const binding = composerState.binding
+
+          if (
+            binding?.binding_type !== 'inline_agent'
+            || !binding.agent_id
+            || !binding.current_snapshot_id
+          ) {
+            toast.error(t('roster.nodeSelector.createInlineFailed'))
+            options?.onError?.()
+            return
+          }
+
+          options?.onSuccess?.({
+            binding_type: 'inline_agent',
+            agent_id: binding.agent_id,
+            current_snapshot_id: binding.current_snapshot_id,
+          })
+        },
+        onError: () => {
+          options?.onError?.()
+        },
+      },
+    )
+  }, [configsMap?.flowId, configsMap?.flowType, defaultModel, mutate, t])
+
+  return {
+    createInlineAgentBinding,
+    isCreatingInlineAgent: isPending,
+  }
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/node.tsx b/web/app/components/workflow/nodes/agent-v2/node.tsx
new file mode 100644
index 00000000000..95e0c03ecfd
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/node.tsx
@@ -0,0 +1,126 @@
+import type { NodeProps } from '../../types'
+import type { AgentV2NodeType } from './types'
+import type { AppIconType } from '@/types/app'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import { SettingItem } from '../_base/components/setting-item'
+import { useAgentRosterDetail, useWorkflowInlineAgentDetail } from './hooks'
+import { hasInlineAgentBinding, hasValidRosterAgentBinding } from './types'
+
+const getAppIconType = (iconType?: string | null): AppIconType | null => {
+  if (iconType === 'emoji' || iconType === 'image' || iconType === 'link')
+    return iconType
+
+  return null
+}
+
+function AgentNodeAvatar({
+  agent,
+  isInlineAgent,
+}: {
+  agent?: ReturnType<typeof useAgentRosterDetail>['data']
+  isInlineAgent: boolean
+}) {
+  if (isInlineAgent) {
+    return (
+      <span className="flex size-8 shrink-0 items-center justify-center rounded-full bg-background-default-burn text-text-tertiary">
+        <span aria-hidden className="i-custom-vender-agent-v2-robot-3 size-5" />
+      </span>
+    )
+  }
+
+  if (!agent)
+    return <span aria-hidden className="size-8 shrink-0 rounded-full bg-text-quaternary/20" />
+
+  return (
+    <AppIcon
+      size="small"
+      iconType={getAppIconType(agent.icon_type)}
+      icon={agent.icon ?? undefined}
+      background={agent.icon_background}
+      imageUrl={agent.icon ?? undefined}
+    />
+  )
+}
+
+function AgentNodeAvatarPlaceholder() {
+  return <span aria-hidden className="size-8 shrink-0 rounded-full bg-text-quaternary/20" />
+}
+
+function AgentNodeModel({
+  data,
+  agent,
+  inlineAgentName,
+  isLoading,
+}: {
+  data: AgentV2NodeType
+  agent?: ReturnType<typeof useAgentRosterDetail>['data']
+  inlineAgentName?: string
+  isLoading: boolean
+}) {
+  const { t } = useTranslation()
+  const isInlineAgent = hasInlineAgentBinding(data)
+  const name = isInlineAgent ? (inlineAgentName || t('nodes.agent.roster.inlineSetup.name', { ns: 'workflow' })) : agent?.name
+  const role = isInlineAgent ? t('nodes.agent.roster.inlineSetup.type', { ns: 'workflow' }) : ''
+  const showPlaceholder = isLoading || (!isInlineAgent && !agent)
+
+  return (
+    <div className="flex flex-col gap-0.5 py-1">
+      <div className="px-2.5 py-0.5 system-2xs-medium-uppercase text-text-tertiary">
+        {t('nodes.agent.roster.label', { ns: 'workflow' })}
+      </div>
+      <div className="px-2.5">
+        <div className="flex min-w-0 items-center gap-1 rounded-lg bg-workflow-block-parma-bg p-1">
+          {showPlaceholder
+            ? <AgentNodeAvatarPlaceholder />
+            : <AgentNodeAvatar agent={agent} isInlineAgent={isInlineAgent} />}
+          <div className="flex min-w-0 flex-1 flex-col justify-center">
+            {showPlaceholder
+              ? (
+                  <div aria-hidden className="flex flex-col gap-1.5 py-0.5">
+                    <span className="h-2 w-20 rounded-xs bg-text-quaternary/20" />
+                    <span className="h-2 w-14 rounded-xs bg-text-quaternary/15" />
+                  </div>
+                )
+              : (
+                  <>
+                    <div className="truncate system-xs-regular text-text-secondary">
+                      {name}
+                    </div>
+                    <div className="truncate system-2xs-regular text-text-tertiary">
+                      {role}
+                    </div>
+                  </>
+                )}
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}
+
+export function AgentV2Node({ id, data }: NodeProps<AgentV2NodeType>) {
+  const { t } = useTranslation()
+  const hasValidAgent = hasValidRosterAgentBinding(data)
+  const isInlineAgent = hasInlineAgentBinding(data)
+  const rosterAgentId = data.agent_binding?.binding_type === 'roster_agent' ? data.agent_binding.agent_id : undefined
+  const inlineAgentId = data.agent_binding?.binding_type === 'inline_agent' ? data.agent_binding.agent_id : undefined
+  const rosterAgentQuery = useAgentRosterDetail(rosterAgentId)
+  const inlineAgentQuery = useWorkflowInlineAgentDetail(id, inlineAgentId)
+  const isInlineAgentDetailLoading = isInlineAgent && !!inlineAgentId && inlineAgentQuery.isPending
+
+  if (isInlineAgent || hasValidAgent)
+    return <AgentNodeModel data={data} agent={rosterAgentQuery.data} inlineAgentName={inlineAgentQuery.data?.agent?.name} isLoading={isInlineAgentDetailLoading} />
+
+  return (
+    <div className="mb-1 space-y-1 px-3">
+      <SettingItem
+        label={t('nodes.agent.roster.label', { ns: 'workflow' })}
+        status={hasValidAgent ? undefined : 'error'}
+        tooltip={hasValidAgent ? undefined : t('errorMsg.fieldRequired', { ns: 'workflow', field: t('nodes.agent.roster.label', { ns: 'workflow' }) })}
+      >
+        {rosterAgentQuery.data?.name}
+      </SettingItem>
+    </div>
+  )
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/output-variables.ts b/web/app/components/workflow/nodes/agent-v2/output-variables.ts
new file mode 100644
index 00000000000..b2c8fec6e44
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/output-variables.ts
@@ -0,0 +1,86 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { AgentV2NodeType } from './types'
+import type { Var } from '@/app/components/workflow/types'
+import { VarType } from '@/app/components/workflow/types'
+
+export const defaultAgentV2DeclaredOutputs: DeclaredOutputConfig[] = [
+  {
+    name: 'text',
+    type: 'string',
+    required: false,
+    description: 'Free-form text answer.',
+  },
+  {
+    name: 'files',
+    type: 'array',
+    required: false,
+    description: 'Files produced by the agent.',
+    array_item: {
+      type: 'file',
+    },
+  },
+  {
+    name: 'json',
+    type: 'object',
+    required: false,
+    description: 'Free-form JSON object.',
+  },
+]
+
+const outputTypeLabels: Record<DeclaredOutputConfig['type'], string> = {
+  array: 'Array',
+  boolean: 'Boolean',
+  file: 'File',
+  number: 'Number',
+  object: 'Object',
+  string: 'String',
+}
+
+const outputVarTypes: Record<DeclaredOutputConfig['type'], VarType> = {
+  array: VarType.array,
+  boolean: VarType.boolean,
+  file: VarType.file,
+  number: VarType.number,
+  object: VarType.object,
+  string: VarType.string,
+}
+
+const arrayItemVarTypes: Record<DeclaredOutputConfig['type'], VarType> = {
+  array: VarType.array,
+  boolean: VarType.arrayBoolean,
+  file: VarType.arrayFile,
+  number: VarType.arrayNumber,
+  object: VarType.arrayObject,
+  string: VarType.arrayString,
+}
+
+export function getAgentV2DeclaredOutputs(data: AgentV2NodeType) {
+  return data.agent_declared_outputs?.length
+    ? data.agent_declared_outputs
+    : defaultAgentV2DeclaredOutputs
+}
+
+/**
+ * @public
+ */
+// TODO: Remove this marker after the output type label consumer is wired.
+export function getDeclaredOutputTypeLabel(output: DeclaredOutputConfig) {
+  if (output.type === 'array')
+    return `Array[${output.array_item ? outputTypeLabels[output.array_item.type] : 'Object'}]`
+
+  return outputTypeLabels[output.type]
+}
+
+function getDeclaredOutputVarType(output: DeclaredOutputConfig) {
+  if (output.type === 'array')
+    return output.array_item ? arrayItemVarTypes[output.array_item.type] : VarType.arrayObject
+
+  return outputVarTypes[output.type]
+}
+
+export function getAgentV2OutputVars(data: AgentV2NodeType): Var[] {
+  return getAgentV2DeclaredOutputs(data).map(output => ({
+    variable: output.name,
+    type: getDeclaredOutputVarType(output),
+  }))
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/panel.tsx b/web/app/components/workflow/nodes/agent-v2/panel.tsx
new file mode 100644
index 00000000000..c01c46fe513
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/panel.tsx
@@ -0,0 +1,218 @@
+import type { AgentRosterNodeData } from '../../block-selector/types'
+import type { NodePanelProps } from '../../types'
+import type { AgentV2NodeType } from './types'
+import { produce } from 'immer'
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import {
+  extractAgentOutputNames,
+  replaceAgentOutputName,
+} from '@/app/components/base/prompt-editor/plugins/agent-output-block/utils'
+import { useNodeDataUpdate } from '@/app/components/workflow/hooks'
+import { useStore } from '@/app/components/workflow/store'
+import useNodeCrud from '../_base/hooks/use-node-crud'
+import { AgentAdvancedSettings } from './components/agent-advanced-settings'
+import { AgentOrchestrateDrawerPanel } from './components/agent-orchestrate-drawer-panel'
+import { AgentOutputVariables } from './components/agent-output-variables'
+import { AgentRosterField } from './components/agent-roster-field'
+import { AgentTaskField } from './components/agent-task-field'
+import { useAgentRosterDetail, useWorkflowInlineAgentDetail } from './hooks'
+import { getAgentV2DeclaredOutputs } from './output-variables'
+import { hasValidInlineAgentBinding } from './types'
+
+export function AgentV2Panel({
+  id,
+  data,
+}: NodePanelProps<AgentV2NodeType>) {
+  const { t } = useTranslation()
+  const { inputs, setInputs } = useNodeCrud<AgentV2NodeType>(id, data)
+  const inputsRef = useRef(inputs)
+  const promptOutputNamesRef = useRef(extractAgentOutputNames(inputs.agent_task || ''))
+  const [isRosterAgentPanelOpen, setIsRosterAgentPanelOpen] = useState(false)
+  const [isInlineAgentPanelOpenedFromTrigger, setIsInlineAgentPanelOpenedFromTrigger] = useState(false)
+  const { handleNodeDataUpdate, handleNodeDataUpdateWithSyncDraft } = useNodeDataUpdate()
+  const openInlineAgentPanelNodeId = useStore(state => state.openInlineAgentPanelNodeId)
+  const setOpenInlineAgentPanelNodeId = useStore(state => state.setOpenInlineAgentPanelNodeId)
+  const appId = useStore(state => state.appId)
+  const drawerPortalContainerRef = useRef<HTMLDivElement>(null)
+  const declaredOutputs = getAgentV2DeclaredOutputs(inputs)
+  const rosterAgentId = inputs.agent_binding?.binding_type === 'roster_agent' ? inputs.agent_binding.agent_id : undefined
+  const inlineAgentId = inputs.agent_binding?.binding_type === 'inline_agent' ? inputs.agent_binding.agent_id : undefined
+  const isInlineAgentReady = hasValidInlineAgentBinding(inputs)
+  const isInlineAgentPending = inputs.agent_binding?.binding_type === 'inline_agent' && !isInlineAgentReady
+  const isInlineAgentPanelOpen = isInlineAgentReady && openInlineAgentPanelNodeId === id
+  const rosterAgentQuery = useAgentRosterDetail(rosterAgentId)
+  const inlineAgentQuery = useWorkflowInlineAgentDetail(id, inlineAgentId)
+  const inlineAgent = inlineAgentQuery.data?.agent
+  const isAgentPanelOpen = isInlineAgentReady ? isInlineAgentPanelOpen : isRosterAgentPanelOpen
+  const isInlineAgentLoading = isInlineAgentReady && !inlineAgent
+  const displayedAgent = rosterAgentQuery.data ?? (inlineAgentId && isInlineAgentReady
+    ? {
+        id: inlineAgentId,
+        name: inlineAgent?.name || t('nodes.agent.roster.inlineSetup.name', { ns: 'workflow' }),
+        description: inlineAgent?.description,
+        role: t('nodes.agent.roster.inlineSetup.type', { ns: 'workflow' }),
+      }
+    : undefined)
+
+  useEffect(() => {
+    inputsRef.current = inputs
+    promptOutputNamesRef.current = extractAgentOutputNames(inputs.agent_task || '')
+  }, [inputs])
+
+  useEffect(() => {
+    if (!inputs._openInlineAgentPanel || !isInlineAgentReady)
+      return
+
+    setOpenInlineAgentPanelNodeId(id)
+    handleNodeDataUpdate({
+      id,
+      data: {
+        _openInlineAgentPanel: false,
+      },
+    })
+  }, [handleNodeDataUpdate, id, inputs._openInlineAgentPanel, isInlineAgentReady, setOpenInlineAgentPanelNodeId])
+
+  const handleTaskChange = useCallback((value: string) => {
+    const currentPromptOutputNames = extractAgentOutputNames(value)
+    const removedPromptOutputNames = [...promptOutputNamesRef.current].filter(name => !currentPromptOutputNames.has(name))
+    const newInputs = produce(inputsRef.current, (draft) => {
+      draft.agent_task = value
+      if (removedPromptOutputNames.length) {
+        const removedNameSet = new Set(removedPromptOutputNames)
+        draft.agent_declared_outputs = getAgentV2DeclaredOutputs(draft)
+          .filter(output => !removedNameSet.has(output.name))
+      }
+    })
+    inputsRef.current = newInputs
+    promptOutputNamesRef.current = currentPromptOutputNames
+    setInputs(newInputs)
+  }, [setInputs])
+
+  const handleRosterChange = useCallback((agent: AgentRosterNodeData) => {
+    setOpenInlineAgentPanelNodeId(undefined)
+    const newInputs = produce(inputs, (draft) => {
+      delete (draft as AgentV2NodeType & { agent_roster?: unknown }).agent_roster
+      draft.agent_binding = {
+        binding_type: 'roster_agent',
+        agent_id: agent.id,
+      }
+    })
+    handleNodeDataUpdateWithSyncDraft(
+      {
+        id,
+        data: newInputs,
+      },
+      {
+        sync: true,
+        notRefreshWhenSyncError: true,
+      },
+    )
+  }, [handleNodeDataUpdateWithSyncDraft, id, inputs, setOpenInlineAgentPanelNodeId])
+
+  const handleAgentPanelOpenChange = useCallback((open: boolean) => {
+    if (isInlineAgentReady) {
+      if (open)
+        setIsInlineAgentPanelOpenedFromTrigger(true)
+
+      setOpenInlineAgentPanelNodeId(open ? id : undefined)
+      return
+    }
+
+    setIsRosterAgentPanelOpen(open)
+  }, [id, isInlineAgentReady, setOpenInlineAgentPanelNodeId])
+
+  const handleDeclaredOutputsChange = useCallback((outputs: ReturnType<typeof getAgentV2DeclaredOutputs>, agentTask?: string) => {
+    const previousOutputs = getAgentV2DeclaredOutputs(inputsRef.current)
+    let nextAgentTask = agentTask
+    if (nextAgentTask === undefined && previousOutputs.length === outputs.length) {
+      const renamedOutputs = previousOutputs
+        .map((previousOutput, index) => ({
+          oldName: previousOutput.name,
+          nextName: outputs[index]?.name,
+        }))
+        .filter(({ oldName, nextName }) => nextName && oldName !== nextName)
+
+      if (renamedOutputs.length === 1) {
+        const { oldName, nextName } = renamedOutputs[0]!
+        const currentAgentTask = inputsRef.current.agent_task || ''
+        if (extractAgentOutputNames(currentAgentTask).has(oldName))
+          nextAgentTask = replaceAgentOutputName(currentAgentTask, oldName, nextName!)
+      }
+    }
+
+    const newInputs = produce(inputsRef.current, (draft) => {
+      draft.agent_declared_outputs = outputs
+      if (nextAgentTask !== undefined)
+        draft.agent_task = nextAgentTask
+    })
+    inputsRef.current = newInputs
+    if (nextAgentTask !== undefined)
+      promptOutputNamesRef.current = extractAgentOutputNames(nextAgentTask)
+    handleNodeDataUpdateWithSyncDraft(
+      {
+        id,
+        data: newInputs,
+      },
+      {
+        sync: true,
+        notRefreshWhenSyncError: true,
+      },
+    )
+  }, [handleNodeDataUpdateWithSyncDraft, id])
+
+  return (
+    <div ref={drawerPortalContainerRef} className="pt-2">
+      <div className="border-b border-divider-subtle">
+        <AgentRosterField
+          agent={displayedAgent}
+          agentId={rosterAgentId ?? inlineAgentId ?? undefined}
+          canOpenPanel={!isInlineAgentPending}
+          isInlineSetup={isInlineAgentReady}
+          isLoading={isInlineAgentLoading}
+          isPanelOpen={isAgentPanelOpen}
+          isPending={isInlineAgentPending}
+          panelBody={isAgentPanelOpen && displayedAgent
+            ? (
+                <AgentOrchestrateDrawerPanel
+                  agentId={displayedAgent.id}
+                  appId={appId}
+                  inlineComposerState={inlineAgentQuery.data}
+                  isInline={isInlineAgentReady}
+                  nodeId={id}
+                  open={isAgentPanelOpen}
+                />
+              )
+            : undefined}
+          panelMode={isInlineAgentReady && !isInlineAgentPanelOpenedFromTrigger ? 'setup' : 'detail'}
+          portalContainerRef={drawerPortalContainerRef}
+          showPanelDetailActions={!isInlineAgentReady}
+          onChange={handleRosterChange}
+          onPanelOpenChange={handleAgentPanelOpenChange}
+        />
+      </div>
+      <div
+        aria-disabled={isInlineAgentPending}
+        inert={isInlineAgentPending ? true : undefined}
+        className={isInlineAgentPending ? 'pointer-events-none' : undefined}
+      >
+        <div className="border-b border-divider-subtle">
+          <AgentTaskField
+            id={id}
+            data={inputs}
+            outputs={declaredOutputs}
+            onChange={handleTaskChange}
+            onOutputsChange={handleDeclaredOutputsChange}
+          />
+        </div>
+        <AgentAdvancedSettings />
+        <div>
+          <AgentOutputVariables
+            outputs={declaredOutputs}
+            onChange={handleDeclaredOutputsChange}
+          />
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/app/components/workflow/nodes/agent-v2/types.ts b/web/app/components/workflow/nodes/agent-v2/types.ts
new file mode 100644
index 00000000000..41989ede16b
--- /dev/null
+++ b/web/app/components/workflow/nodes/agent-v2/types.ts
@@ -0,0 +1,45 @@
+import type { DeclaredOutputConfig } from '@dify/contracts/api/console/apps/types.gen'
+import type { AgentBinding } from '@/app/components/workflow/block-selector/types'
+import type { CommonNodeType } from '@/app/components/workflow/types'
+import { BlockEnum } from '@/app/components/workflow/types'
+
+export type AgentV2NodeType = CommonNodeType & {
+  agent_binding?: AgentBinding
+  agent_declared_outputs?: DeclaredOutputConfig[]
+  agent_node_kind: 'dify_agent'
+  agent_task?: string
+  version: '2'
+}
+
+export function isAgentV2NodeData(data: CommonNodeType): data is AgentV2NodeType {
+  const payload = data as { agent_node_kind?: string, version?: string }
+  return (data.type === BlockEnum.Agent || data.type === BlockEnum.AgentV2)
+    && payload.agent_node_kind === 'dify_agent'
+    && payload.version === '2'
+}
+
+export function hasValidRosterAgentBinding(data: AgentV2NodeType) {
+  return data.agent_binding?.binding_type === 'roster_agent'
+    && typeof data.agent_binding.agent_id === 'string'
+    && data.agent_binding.agent_id.length > 0
+}
+
+export function hasInlineAgentBinding(data: AgentV2NodeType) {
+  return data.agent_binding?.binding_type === 'inline_agent'
+}
+
+export function hasValidInlineAgentBinding(data: AgentV2NodeType) {
+  return data.agent_binding?.binding_type === 'inline_agent'
+    && typeof data.agent_binding.agent_id === 'string'
+    && data.agent_binding.agent_id.length > 0
+    && typeof data.agent_binding.current_snapshot_id === 'string'
+    && data.agent_binding.current_snapshot_id.length > 0
+}
+
+export function needsInlineAgentBindingCreation(data: AgentV2NodeType) {
+  return hasInlineAgentBinding(data) && !hasValidInlineAgentBinding(data)
+}
+
+export function hasValidAgentBinding(data: AgentV2NodeType) {
+  return hasValidInlineAgentBinding(data) || hasValidRosterAgentBinding(data)
+}
diff --git a/web/app/components/workflow/nodes/components.ts b/web/app/components/workflow/nodes/components.ts
index 7c196e3f2f5..fa86c55e0c3 100644
--- a/web/app/components/workflow/nodes/components.ts
+++ b/web/app/components/workflow/nodes/components.ts
@@ -1,5 +1,9 @@
-import type { ComponentType } from 'react'
+import type { ComponentProps, ComponentType } from 'react'
+import { createElement } from 'react'
 import { BlockEnum } from '../types'
+import { AgentV2Node } from './agent-v2/node'
+import { AgentV2Panel } from './agent-v2/panel'
+import { isAgentV2NodeData } from './agent-v2/types'
 import AgentNode from './agent/node'
 import AgentPanel from './agent/panel'
 import AnswerNode from './answer/node'
@@ -53,7 +57,25 @@ import TriggerWebhookPanel from './trigger-webhook/panel'
 import VariableAssignerNode from './variable-assigner/node'
 import VariableAssignerPanel from './variable-assigner/panel'
 
-export const NodeComponentMap: Record<string, ComponentType<any>> = {
+type WorkflowAgentNodeProps = ComponentProps<typeof AgentNode> | ComponentProps<typeof AgentV2Node>
+type WorkflowAgentPanelProps = ComponentProps<typeof AgentPanel> | ComponentProps<typeof AgentV2Panel>
+type WorkflowComponentMap = Record<string, ComponentType<Record<string, never>>>
+
+function WorkflowAgentNode(props: WorkflowAgentNodeProps) {
+  if (isAgentV2NodeData(props.data))
+    return createElement(AgentV2Node, props as ComponentProps<typeof AgentV2Node>)
+
+  return createElement(AgentNode, props as ComponentProps<typeof AgentNode>)
+}
+
+function WorkflowAgentPanel(props: WorkflowAgentPanelProps) {
+  if (isAgentV2NodeData(props.data))
+    return createElement(AgentV2Panel, props as ComponentProps<typeof AgentV2Panel>)
+
+  return createElement(AgentPanel, props as ComponentProps<typeof AgentPanel>)
+}
+
+export const NodeComponentMap = {
   [BlockEnum.Start]: StartNode,
   [BlockEnum.StartPlaceholder]: StartPlaceholderNode,
   [BlockEnum.End]: EndNode,
@@ -74,16 +96,17 @@ export const NodeComponentMap: Record<string, ComponentType<any>> = {
   [BlockEnum.Loop]: LoopNode,
   [BlockEnum.DocExtractor]: DocExtractorNode,
   [BlockEnum.ListFilter]: ListFilterNode,
-  [BlockEnum.Agent]: AgentNode,
+  [BlockEnum.Agent]: WorkflowAgentNode,
+  [BlockEnum.AgentV2]: AgentV2Node,
   [BlockEnum.DataSource]: DataSourceNode,
   [BlockEnum.KnowledgeBase]: KnowledgeBaseNode,
   [BlockEnum.HumanInput]: HumanInputNode,
   [BlockEnum.TriggerSchedule]: TriggerScheduleNode,
   [BlockEnum.TriggerWebhook]: TriggerWebhookNode,
   [BlockEnum.TriggerPlugin]: TriggerPluginNode,
-}
+} as unknown as WorkflowComponentMap
 
-export const PanelComponentMap: Record<string, ComponentType<any>> = {
+export const PanelComponentMap = {
   [BlockEnum.Start]: StartPanel,
   [BlockEnum.StartPlaceholder]: StartPlaceholderPanel,
   [BlockEnum.End]: EndPanel,
@@ -104,11 +127,12 @@ export const PanelComponentMap: Record<string, ComponentType<any>> = {
   [BlockEnum.Loop]: LoopPanel,
   [BlockEnum.DocExtractor]: DocExtractorPanel,
   [BlockEnum.ListFilter]: ListFilterPanel,
-  [BlockEnum.Agent]: AgentPanel,
+  [BlockEnum.Agent]: WorkflowAgentPanel,
+  [BlockEnum.AgentV2]: AgentV2Panel,
   [BlockEnum.DataSource]: DataSourcePanel,
   [BlockEnum.KnowledgeBase]: KnowledgeBasePanel,
   [BlockEnum.HumanInput]: HumanInputPanel,
   [BlockEnum.TriggerSchedule]: TriggerSchedulePanel,
   [BlockEnum.TriggerWebhook]: TriggerWebhookPanel,
   [BlockEnum.TriggerPlugin]: TriggerPluginPanel,
-}
+} as unknown as WorkflowComponentMap
diff --git a/web/app/components/workflow/nodes/data-source/node.tsx b/web/app/components/workflow/nodes/data-source/node.tsx
index 81ad58ee7d9..4a9dc0ce653 100644
--- a/web/app/components/workflow/nodes/data-source/node.tsx
+++ b/web/app/components/workflow/nodes/data-source/node.tsx
@@ -23,7 +23,7 @@ const Node: FC<NodeProps<DataSourceNodeType>> = ({
 
   return (
     <div className="relative mb-1 px-3 py-1">
-      <div className="pointer-events-auto absolute top-[-32px] right-3 z-40">
+      <div className="pointer-events-auto absolute -top-8 right-3 z-40">
         <InstallPluginButton
           size="small"
           extraIdentifiers={[
diff --git a/web/app/components/workflow/nodes/human-input/components/delivery-method/__tests__/test-email-sender.spec.tsx b/web/app/components/workflow/nodes/human-input/components/delivery-method/__tests__/test-email-sender.spec.tsx
index ea1514fc965..db88f1a67ca 100644
--- a/web/app/components/workflow/nodes/human-input/components/delivery-method/__tests__/test-email-sender.spec.tsx
+++ b/web/app/components/workflow/nodes/human-input/components/delivery-method/__tests__/test-email-sender.spec.tsx
@@ -86,9 +86,11 @@ const renderWithProviders = (ui: ReactNode) => {
             useSelector: vi.fn(),
             isLoadingCurrentWorkspace: false,
             isValidatingCurrentWorkspace: false,
+            workspacePermissionKeys: [],
           }),
           isLoadingCurrentWorkspace: false,
           isValidatingCurrentWorkspace: false,
+          workspacePermissionKeys: [],
         }}
       >
         <HooksStoreContext.Provider value={hooksStore}>
diff --git a/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/email-input.spec.tsx b/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/email-input.spec.tsx
index 30c6db59230..0ca263206bd 100644
--- a/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/email-input.spec.tsx
+++ b/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/email-input.spec.tsx
@@ -52,6 +52,7 @@ const createMember = (overrides: Partial<Member>): Member => ({
   avatar_url: 'avatar.png',
   status: 'active',
   role: 'normal',
+  roles: [],
   created_at: '2026-01-01T00:00:00Z',
   last_active_at: '2026-01-02T00:00:00Z',
   last_login_at: '2026-01-03T00:00:00Z',
diff --git a/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/email-item.spec.tsx b/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/email-item.spec.tsx
index 72f995787b2..4c759906877 100644
--- a/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/email-item.spec.tsx
+++ b/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/email-item.spec.tsx
@@ -13,6 +13,7 @@ describe('human-input/delivery-method/recipient/email-item', () => {
       avatar_url: 'avatar.png',
       status: 'active',
       role: 'normal',
+      roles: [],
       created_at: '2026-01-01T00:00:00Z',
       last_active_at: '2026-01-02T00:00:00Z',
       last_login_at: '2026-01-03T00:00:00Z',
@@ -45,6 +46,7 @@ describe('human-input/delivery-method/recipient/email-item', () => {
       avatar_url: null,
       status: 'pending',
       role: 'normal',
+      roles: [],
       created_at: '2026-01-01T00:00:00Z',
       last_active_at: '2026-01-02T00:00:00Z',
       last_login_at: '2026-01-03T00:00:00Z',
diff --git a/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/member-list.spec.tsx b/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/member-list.spec.tsx
index e33ab459583..b794f23be21 100644
--- a/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/member-list.spec.tsx
+++ b/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/member-list.spec.tsx
@@ -10,6 +10,7 @@ const createMember = (overrides: Partial<Member>): Member => ({
   avatar_url: 'owner.png',
   status: 'active',
   role: 'normal',
+  roles: [],
   created_at: '2026-01-01T00:00:00Z',
   last_active_at: '2026-01-02T00:00:00Z',
   last_login_at: '2026-01-03T00:00:00Z',
diff --git a/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/member-selector.spec.tsx b/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/member-selector.spec.tsx
index 8d54e3babae..0f7e1eca1d7 100644
--- a/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/member-selector.spec.tsx
+++ b/web/app/components/workflow/nodes/human-input/components/delivery-method/recipient/__tests__/member-selector.spec.tsx
@@ -38,6 +38,7 @@ const members: Member[] = [{
   avatar_url: 'avatar.png',
   status: 'active',
   role: 'normal',
+  roles: [],
   created_at: '2026-01-01T00:00:00Z',
   last_active_at: '2026-01-02T00:00:00Z',
   last_login_at: '2026-01-03T00:00:00Z',
diff --git a/web/app/components/workflow/nodes/knowledge-retrieval/__tests__/integration.spec.tsx b/web/app/components/workflow/nodes/knowledge-retrieval/__tests__/integration.spec.tsx
index aec46ee2c7a..c5b424f0f98 100644
--- a/web/app/components/workflow/nodes/knowledge-retrieval/__tests__/integration.spec.tsx
+++ b/web/app/components/workflow/nodes/knowledge-retrieval/__tests__/integration.spec.tsx
@@ -14,6 +14,7 @@ import {
 } from '@/models/datasets'
 import { AccountProfileQueryProvider, createAccountProfileQueryClient } from '@/test/account-profile-query'
 import { RETRIEVE_METHOD, RETRIEVE_TYPE } from '@/types/app'
+import { DatasetACLPermission, getDatasetACLCapabilities } from '@/utils/permission'
 import { DatasetsDetailContext } from '../../../datasets-detail-store/provider'
 import { createDatasetsDetailStore } from '../../../datasets-detail-store/store'
 import { BlockEnum, VarType } from '../../../types'
@@ -58,6 +59,7 @@ const createDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
   data_source_type: DataSourceType.FILE,
   indexing_technique: 'high_quality' as DataSet['indexing_technique'],
   created_by: 'user-1',
+  maintainer: 'user-1',
   updated_by: 'user-1',
   updated_at: 1690000000,
   app_count: 0,
@@ -128,8 +130,9 @@ const createCondition = (overrides: Partial<MetadataFilteringCondition> = {}): M
 })
 
 vi.mock('@/context/app-context', () => ({
-  useSelector: (selector: (state: { userProfile: { id: string } }) => unknown) => selector({
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
     userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
   }),
   useAppContext: () => ({
     userProfile: {
@@ -139,6 +142,24 @@ vi.mock('@/context/app-context', () => ({
 }))
 
 vi.mock('@/utils/permission', () => ({
+  DatasetACLPermission: {
+    Readonly: 'dataset.acl.readonly',
+    Edit: 'dataset.acl.edit',
+    Use: 'dataset.acl.use',
+  },
+  getDatasetACLCapabilities: vi.fn(() => ({
+    canReadonly: false,
+    canEdit: true,
+    canImportExportDSL: false,
+    canPipelineTest: false,
+    canDocumentDownload: false,
+    canRetrievalRecall: false,
+    canUse: true,
+    canDeleteFile: false,
+    canPipelineRelease: false,
+    canDelete: false,
+    canAccessConfig: false,
+  })),
   hasEditPermissionForDataset: (
     userId: string,
     datasetConfig: { createdBy: string, partialMemberList: string[], permission: DatasetPermission },
@@ -287,6 +308,19 @@ describe('knowledge-retrieval path', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockHasEditPermissionForDataset.mockReturnValue(true)
+    vi.mocked(getDatasetACLCapabilities).mockReturnValue({
+      canReadonly: false,
+      canEdit: true,
+      canImportExportDSL: false,
+      canPipelineTest: false,
+      canDocumentDownload: false,
+      canRetrievalRecall: false,
+      canUse: true,
+      canDeleteFile: false,
+      canPipelineRelease: false,
+      canDelete: false,
+      canAccessConfig: false,
+    })
   })
 
   describe('Dataset controls', () => {
@@ -372,6 +406,42 @@ describe('knowledge-retrieval path', () => {
 
       expect(onChange).toHaveBeenCalledWith([])
     })
+
+    it('should hide dataset settings when ACL does not grant edit even if legacy dataset permission allows it', () => {
+      const dataset = createDataset({
+        permission: DatasetPermission.allTeamMembers,
+        permission_keys: [DatasetACLPermission.Use],
+      })
+      mockHasEditPermissionForDataset.mockReturnValue(true)
+      vi.mocked(getDatasetACLCapabilities).mockReturnValue({
+        canReadonly: false,
+        canEdit: false,
+        canImportExportDSL: false,
+        canPipelineTest: false,
+        canDocumentDownload: false,
+        canRetrievalRecall: false,
+        canUse: true,
+        canDeleteFile: false,
+        canPipelineRelease: false,
+        canDelete: false,
+        canAccessConfig: false,
+      })
+
+      render(
+        <DatasetList
+          list={[dataset]}
+          onChange={vi.fn()}
+        />,
+      )
+
+      const datasetItem = getDatasetItem()
+
+      expect(within(datasetItem).queryByRole('button', { name: 'common.operation.edit' })).not.toBeInTheDocument()
+      expect(getDatasetACLCapabilities).toHaveBeenCalledWith(dataset.permission_keys, expect.objectContaining({
+        currentUserId: 'user-1',
+        resourceMaintainer: dataset.maintainer,
+      }))
+    })
   })
 
   describe('Retrieval settings', () => {
diff --git a/web/app/components/workflow/nodes/knowledge-retrieval/components/add-dataset.tsx b/web/app/components/workflow/nodes/knowledge-retrieval/components/add-dataset.tsx
index f2537f94e16..683d18a78fe 100644
--- a/web/app/components/workflow/nodes/knowledge-retrieval/components/add-dataset.tsx
+++ b/web/app/components/workflow/nodes/knowledge-retrieval/components/add-dataset.tsx
@@ -9,11 +9,13 @@ import SelectDataset from '@/app/components/app/configuration/dataset-config/sel
 
 type Props = Readonly<{
   selectedIds: string[]
+  modal?: boolean
   onChange: (dataSets: DataSet[]) => void
 }>
 
 const AddDataset: FC<Props> = ({
   selectedIds,
+  modal,
   onChange,
 }) => {
   const { t } = useTranslation()
@@ -38,6 +40,7 @@ const AddDataset: FC<Props> = ({
       </button>
       <SelectDataset
         isShow={isShowModal}
+        modal={modal}
         onClose={hideModal}
         selectedIds={selectedIds}
         onSelect={handleSelect}
diff --git a/web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-item.tsx b/web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-item.tsx
index c2a1aff4912..59f7307a2b9 100644
--- a/web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-item.tsx
+++ b/web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-item.tsx
@@ -33,6 +33,10 @@ type Props = Readonly<{
   onChange: (dataSet: DataSet) => void
   readonly?: boolean
   editable?: boolean
+  settingsDrawerBackdropClassName?: string
+  settingsDrawerBackdropForceRender?: boolean
+  settingsDrawerPopupClassName?: string
+  settingsModalHeight?: string
 }>
 
 const DatasetItem: FC<Props> = ({
@@ -41,6 +45,10 @@ const DatasetItem: FC<Props> = ({
   onChange,
   readonly,
   editable = true,
+  settingsDrawerBackdropClassName,
+  settingsDrawerBackdropForceRender,
+  settingsDrawerPopupClassName,
+  settingsModalHeight,
 }) => {
   const media = useBreakpoints()
   const { t } = useTranslation()
@@ -147,12 +155,23 @@ const DatasetItem: FC<Props> = ({
           }}
         >
           <DrawerPortal>
-            <DrawerBackdrop className={cn(!isMobile && 'bg-transparent')} />
+            <DrawerBackdrop
+              forceRender={settingsDrawerBackdropForceRender}
+              className={cn(
+                !settingsDrawerBackdropClassName && !isMobile && 'bg-transparent',
+                settingsDrawerBackdropClassName,
+              )}
+            />
             <DrawerViewport>
-              <DrawerPopup className="p-0! data-[swipe-direction=right]:top-16 data-[swipe-direction=right]:right-2 data-[swipe-direction=right]:bottom-3 data-[swipe-direction=right]:h-auto data-[swipe-direction=right]:w-full data-[swipe-direction=right]:max-w-[640px] data-[swipe-direction=right]:rounded-xl">
-                <DrawerContent className="flex min-h-0 flex-1 flex-col p-0 pb-0">
+              <DrawerPopup className={cn(
+                'p-0! data-[swipe-direction=right]:right-2 data-[swipe-direction=right]:h-auto data-[swipe-direction=right]:w-full data-[swipe-direction=right]:max-w-[640px] data-[swipe-direction=right]:rounded-xl',
+                settingsDrawerPopupClassName ?? 'data-[swipe-direction=right]:top-16 data-[swipe-direction=right]:bottom-3',
+              )}
+              >
+                <DrawerContent className="flex h-full min-h-0 flex-1 flex-col p-0 pb-0">
                   <SettingsModal
                     currentDataset={payload}
+                    height={settingsModalHeight}
                     onCancel={hideSettingsModal}
                     onSave={handleSave}
                   />
diff --git a/web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-list.tsx b/web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-list.tsx
index 1c14b6dbea1..b68e2d1e7a7 100644
--- a/web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-list.tsx
+++ b/web/app/components/workflow/nodes/knowledge-retrieval/components/dataset-list.tsx
@@ -6,22 +6,31 @@ import * as React from 'react'
 import { useCallback, useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useSelector as useAppContextSelector } from '@/context/app-context'
-import { hasEditPermissionForDataset } from '@/utils/permission'
+import { getDatasetACLCapabilities } from '@/utils/permission'
 import Item from './dataset-item'
 
 type Props = Readonly<{
   list: DataSet[]
   onChange: (list: DataSet[]) => void
   readonly?: boolean
+  settingsDrawerBackdropClassName?: string
+  settingsDrawerBackdropForceRender?: boolean
+  settingsDrawerPopupClassName?: string
+  settingsModalHeight?: string
 }>
 
 const DatasetList: FC<Props> = ({
   list,
   onChange,
   readonly,
+  settingsDrawerBackdropClassName,
+  settingsDrawerBackdropForceRender,
+  settingsDrawerPopupClassName,
+  settingsModalHeight,
 }) => {
   const { t } = useTranslation()
-  const userProfile = useAppContextSelector(s => s.userProfile)
+  const currentUserId = useAppContextSelector(s => s.userProfile?.id)
+  const workspacePermissionKeys = useAppContextSelector(s => s.workspacePermissionKeys)
 
   const handleRemove = useCallback((index: number) => {
     return () => {
@@ -43,17 +52,17 @@ const DatasetList: FC<Props> = ({
 
   const formattedList = useMemo(() => {
     return list.map((item) => {
-      const datasetConfig = {
-        createdBy: item.created_by,
-        partialMemberList: item.partial_member_list || [],
-        permission: item.permission,
-      }
+      const datasetACLCapabilities = getDatasetACLCapabilities(item.permission_keys, {
+        currentUserId,
+        resourceMaintainer: item.maintainer,
+        workspacePermissionKeys,
+      })
       return {
         ...item,
-        editable: hasEditPermissionForDataset(userProfile?.id || '', datasetConfig),
+        editable: datasetACLCapabilities.canEdit,
       }
     })
-  }, [list, userProfile?.id])
+  }, [currentUserId, list, workspacePermissionKeys])
 
   return (
     <div className="space-y-1">
@@ -67,6 +76,10 @@ const DatasetList: FC<Props> = ({
                 onChange={handleChange(index)}
                 readonly={readonly}
                 editable={item.editable}
+                settingsDrawerBackdropClassName={settingsDrawerBackdropClassName}
+                settingsDrawerBackdropForceRender={settingsDrawerBackdropForceRender}
+                settingsDrawerPopupClassName={settingsDrawerPopupClassName}
+                settingsModalHeight={settingsModalHeight}
               />
             )
           })
diff --git a/web/app/components/workflow/nodes/knowledge-retrieval/components/retrieval-config.tsx b/web/app/components/workflow/nodes/knowledge-retrieval/components/retrieval-config.tsx
index 987ee789147..12e47278597 100644
--- a/web/app/components/workflow/nodes/knowledge-retrieval/components/retrieval-config.tsx
+++ b/web/app/components/workflow/nodes/knowledge-retrieval/components/retrieval-config.tsx
@@ -32,6 +32,7 @@ type Props = Readonly<{
   onSingleRetrievalModelChange?: ModelParameterModalProps['setModel']
   onSingleRetrievalModelParamsChange?: ModelParameterModalProps['onCompletionParamsChange']
   readonly?: boolean
+  modal?: boolean
   rerankModalOpen: boolean
   onRerankModelOpenChange: (open: boolean) => void
   selectedDatasets: DataSet[]
@@ -45,6 +46,7 @@ const RetrievalConfig: FC<Props> = ({
   onSingleRetrievalModelChange,
   onSingleRetrievalModelParamsChange,
   readonly,
+  modal,
   rerankModalOpen,
   onRerankModelOpenChange,
   selectedDatasets,
@@ -115,6 +117,7 @@ const RetrievalConfig: FC<Props> = ({
 
   return (
     <Popover
+      modal={modal}
       open={rerankModalOpen}
       onOpenChange={(nextOpen) => {
         if (readonly)
diff --git a/web/app/components/workflow/nodes/llm/components/json-schema-config-modal/json-schema-generator/index.tsx b/web/app/components/workflow/nodes/llm/components/json-schema-config-modal/json-schema-generator/index.tsx
index 2f2c3469794..84177e9ade8 100644
--- a/web/app/components/workflow/nodes/llm/components/json-schema-config-modal/json-schema-generator/index.tsx
+++ b/web/app/components/workflow/nodes/llm/components/json-schema-config-modal/json-schema-generator/index.tsx
@@ -11,6 +11,7 @@ import {
 import { toast } from '@langgenius/dify-ui/toast'
 import * as React from 'react'
 import { useCallback, useState } from 'react'
+import { useAutoGenModel } from '@/app/components/app/configuration/config/auto-gen-model-storage'
 import { ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import { useModelListAndDefaultModelAndCurrentProviderAndModel } from '@/app/components/header/account-setting/model-provider-page/hooks'
 import useTheme from '@/hooks/use-theme'
@@ -41,25 +42,13 @@ const createEmptyModel = (): Model => ({
   completion_params: {} as CompletionParams,
 })
 
-const getStoredModel = (): Model | null => {
-  if (typeof window === 'undefined')
-    return null
-
-  const savedModel = window.localStorage.getItem('auto-gen-model')
-
-  if (!savedModel)
-    return null
-
-  return JSON.parse(savedModel) as Model
-}
-
 const JsonSchemaGenerator: FC<JsonSchemaGeneratorProps> = ({
   onApply,
   crossAxisOffset,
 }) => {
   const [open, setOpen] = useState(false)
   const [view, setView] = useState<GeneratorView>(GENERATOR_VIEWS.promptEditor)
-  const [model, setModel] = useState<Model | null>(() => getStoredModel())
+  const [model, setModel] = useAutoGenModel()
   const [instruction, setInstruction] = useState('')
   const [schema, setSchema] = useState<SchemaRoot | null>(null)
   const { theme } = useTheme()
@@ -102,8 +91,7 @@ const JsonSchemaGenerator: FC<JsonSchemaGeneratorProps> = ({
       mode: newValue.mode as ModelModeType,
     }
     setModel(newModel)
-    window.localStorage.setItem('auto-gen-model', JSON.stringify(newModel))
-  }, [resolvedModel])
+  }, [resolvedModel, setModel])
 
   const handleCompletionParamsChange = useCallback((newParams: FormValue) => {
     const newModel = {
@@ -111,8 +99,7 @@ const JsonSchemaGenerator: FC<JsonSchemaGeneratorProps> = ({
       completion_params: newParams as CompletionParams,
     }
     setModel(newModel)
-    window.localStorage.setItem('auto-gen-model', JSON.stringify(newModel))
-  }, [resolvedModel])
+  }, [resolvedModel, setModel])
 
   const { mutateAsync: generateStructuredOutputRules, isPending: isGenerating } = useGenerateStructuredOutputRules()
 
diff --git a/web/app/components/workflow/nodes/parameter-extractor/components/extract-parameter/import-from-tool.tsx b/web/app/components/workflow/nodes/parameter-extractor/components/extract-parameter/import-from-tool.tsx
index 48240858a17..e4bf0fd2d56 100644
--- a/web/app/components/workflow/nodes/parameter-extractor/components/extract-parameter/import-from-tool.tsx
+++ b/web/app/components/workflow/nodes/parameter-extractor/components/extract-parameter/import-from-tool.tsx
@@ -3,7 +3,7 @@ import type { FC } from 'react'
 import type { Param, ParamType } from '../../types'
 import type { ToolParameter } from '@/app/components/tools/types'
 import type {
-  PluginDefaultValue,
+  BlockDefaultValue,
   ToolDefaultValue,
 } from '@/app/components/workflow/block-selector/types'
 import type { BlockEnum } from '@/app/components/workflow/types'
@@ -50,7 +50,7 @@ const ImportFromTool: FC<Props> = ({
   const { data: customTools } = useAllCustomTools()
   const { data: workflowTools } = useAllWorkflowTools()
 
-  const handleSelectTool = useCallback((_type: BlockEnum, toolInfo?: PluginDefaultValue) => {
+  const handleSelectTool = useCallback((_type: BlockEnum, toolInfo?: BlockDefaultValue) => {
     if (!toolInfo || 'datasource_name' in toolInfo || !('tool_name' in toolInfo))
       return
 
diff --git a/web/app/components/workflow/nodes/question-classifier/components/class-list.tsx b/web/app/components/workflow/nodes/question-classifier/components/class-list.tsx
index 672536aabed..d81392ef19c 100644
--- a/web/app/components/workflow/nodes/question-classifier/components/class-list.tsx
+++ b/web/app/components/workflow/nodes/question-classifier/components/class-list.tsx
@@ -5,7 +5,6 @@ import type { ValueSelector, Var } from '@/app/components/workflow/types'
 import { cn } from '@langgenius/dify-ui/cn'
 import { RiDraggable } from '@remixicon/react'
 import { noop } from 'es-toolkit/function'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { produce } from 'immer'
 import * as React from 'react'
 import { useCallback, useEffect, useRef, useState } from 'react'
@@ -14,12 +13,11 @@ import { ReactSortable } from 'react-sortablejs'
 import { ArrowDownRoundFill } from '@/app/components/base/icons/src/vender/solid/general'
 import { useEdgesInteractions } from '../../../hooks'
 import AddButton from '../../_base/components/add-button'
+import { useInlineLabelHintDismissed } from '../storage'
 import Item from './class-item'
 import { getDefaultClassLabel, isDefaultClassLabel } from './class-label-utils'
 
 const i18nPrefix = 'nodes.questionClassifiers'
-const INLINE_LABEL_HINT_STORAGE_KEY = 'question-classifier-inline-label-hint-dismissed'
-
 type Props = Readonly<{
   nodeId: string
   list: Topic[]
@@ -43,7 +41,7 @@ const ClassList: FC<Props> = ({
   const [shouldScrollToEnd, setShouldScrollToEnd] = useState(false)
   const prevListLength = useRef(list.length)
   const [collapsed, setCollapsed] = useState(false)
-  const [storedRenameHintDismissed, setIsRenameHintDismissed] = useLocalStorage<boolean>(INLINE_LABEL_HINT_STORAGE_KEY)
+  const [storedRenameHintDismissed, setIsRenameHintDismissed] = useInlineLabelHintDismissed()
   const isRenameHintDismissed = storedRenameHintDismissed ?? false
 
   const handleClassChange = useCallback((index: number) => {
diff --git a/web/app/components/workflow/nodes/question-classifier/storage.ts b/web/app/components/workflow/nodes/question-classifier/storage.ts
new file mode 100644
index 00000000000..e13a5436c7e
--- /dev/null
+++ b/web/app/components/workflow/nodes/question-classifier/storage.ts
@@ -0,0 +1,11 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+const [
+  useInlineLabelHintDismissed,
+  _useInlineLabelHintDismissedValue,
+  _useSetInlineLabelHintDismissed,
+] = createLocalStorageState<boolean>('question-classifier-inline-label-hint-dismissed')
+
+export {
+  useInlineLabelHintDismissed,
+}
diff --git a/web/app/components/workflow/nodes/tool/node.tsx b/web/app/components/workflow/nodes/tool/node.tsx
index fa6fea24c21..023be76cc7c 100644
--- a/web/app/components/workflow/nodes/tool/node.tsx
+++ b/web/app/components/workflow/nodes/tool/node.tsx
@@ -35,7 +35,7 @@ const Node: FC<NodeProps<ToolNodeType>> = ({
   return (
     <div className="relative mb-1 px-3 py-1">
       {showInstallButton && (
-        <div className="pointer-events-auto absolute top-[-32px] right-3 z-40">
+        <div className="pointer-events-auto absolute -top-8 right-3 z-40">
           <InstallPluginButton
             size="small"
             className="font-medium! text-text-accent!"
diff --git a/web/app/components/workflow/nodes/trigger-plugin/node.tsx b/web/app/components/workflow/nodes/trigger-plugin/node.tsx
index 49fb0fd68cd..57733121fad 100644
--- a/web/app/components/workflow/nodes/trigger-plugin/node.tsx
+++ b/web/app/components/workflow/nodes/trigger-plugin/node.tsx
@@ -64,7 +64,7 @@ const Node: FC<NodeProps<PluginTriggerNodeType>> = ({
   return (
     <div className="relative mb-1 px-3 py-1">
       {showInstallButton && (
-        <div className="pointer-events-auto absolute top-[-32px] right-3 z-40">
+        <div className="pointer-events-auto absolute -top-8 right-3 z-40">
           <InstallPluginButton
             size="small"
             extraIdentifiers={[
@@ -87,7 +87,7 @@ const Node: FC<NodeProps<PluginTriggerNodeType>> = ({
           >
             <div
               title={key}
-              className="max-w-[100px] shrink-0 truncate text-xs font-medium text-text-tertiary uppercase"
+              className="max-w-25 shrink-0 truncate text-xs font-medium text-text-tertiary uppercase"
             >
               {key}
             </div>
diff --git a/web/app/components/workflow/note-node/hooks.ts b/web/app/components/workflow/note-node/hooks.ts
index 8a9e3573eba..0760697179d 100644
--- a/web/app/components/workflow/note-node/hooks.ts
+++ b/web/app/components/workflow/note-node/hooks.ts
@@ -1,14 +1,13 @@
 import type { EditorState } from 'lexical'
 import type { NoteTheme } from './types'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useCallback } from 'react'
 import { useNodeDataUpdate, useWorkflowHistory, WorkflowHistoryEvent } from '../hooks'
-import { NOTE_SHOW_AUTHOR_STORAGE_KEY } from './constants'
+import { useSetWorkflowNoteShowAuthor } from '../persistence/local-storage-options'
 
 export const useNote = (id: string) => {
   const { handleNodeDataUpdateWithSyncDraft } = useNodeDataUpdate()
   const { saveStateToHistory } = useWorkflowHistory()
-  const setShowAuthorStorage = useSetLocalStorage<string>(NOTE_SHOW_AUTHOR_STORAGE_KEY, { raw: true })
+  const setShowAuthorStorage = useSetWorkflowNoteShowAuthor()
 
   const handleThemeChange = useCallback((theme: NoteTheme) => {
     handleNodeDataUpdateWithSyncDraft({ id, data: { theme } })
diff --git a/web/app/components/workflow/operator/__tests__/add-block.spec.tsx b/web/app/components/workflow/operator/__tests__/add-block.spec.tsx
index 0e27d2cc155..98bdb241540 100644
--- a/web/app/components/workflow/operator/__tests__/add-block.spec.tsx
+++ b/web/app/components/workflow/operator/__tests__/add-block.spec.tsx
@@ -26,19 +26,48 @@ type BlockSelectorMockProps = {
 const {
   mockHandlePaneContextmenuCancel,
   mockWorkflowStoreSetState,
+  mockSetOpenInlineAgentPanelNodeId,
   mockGenerateNewNode,
   mockGetNodeCustomTypeByNodeDataType,
+  mockGetNodesWithSameDefaultDataType,
+  mockCreateInlineAgentBinding,
+  mockHandleSyncWorkflowDraft,
+  mockSaveStateToHistory,
 } = vi.hoisted(() => ({
   mockHandlePaneContextmenuCancel: vi.fn(),
   mockWorkflowStoreSetState: vi.fn(),
+  mockSetOpenInlineAgentPanelNodeId: vi.fn(),
   mockGenerateNewNode: vi.fn(({ type, data }: { type: string, data: Record<string, unknown> }) => ({
     newNode: {
       id: 'generated-node',
       type,
       data,
+      position: {
+        x: 0,
+        y: 0,
+      },
     },
   })),
   mockGetNodeCustomTypeByNodeDataType: vi.fn((type: string) => `${type}-custom`),
+  mockGetNodesWithSameDefaultDataType: vi.fn((
+    nodes: Array<{ data: { agent_node_kind?: string, type?: BlockEnum, version?: string } }>,
+    type: BlockEnum,
+    defaultValue: { agent_node_kind?: string, type?: BlockEnum, version?: string },
+  ) => {
+    const dataType = defaultValue.type ?? type
+    if (dataType !== type && defaultValue.version) {
+      return nodes.filter(node =>
+        node.data.type === dataType
+        && node.data.version === defaultValue.version
+        && node.data.agent_node_kind === defaultValue.agent_node_kind,
+      )
+    }
+
+    return nodes.filter(node => node.data.type === dataType)
+  }),
+  mockCreateInlineAgentBinding: vi.fn(),
+  mockHandleSyncWorkflowDraft: vi.fn(),
+  mockSaveStateToHistory: vi.fn(),
 }))
 
 let latestBlockSelectorProps: BlockSelectorMockProps | null = null
@@ -47,7 +76,7 @@ let mockIsChatMode = false
 let mockFlowType: FlowType = FlowType.appFlow
 
 const mockAvailableNextBlocks = [BlockEnum.Answer, BlockEnum.Code]
-const mockNodesMetaDataMap = {
+const mockNodesMetaDataMap: Partial<Record<BlockEnum, { defaultValue: Record<string, unknown> }>> = {
   [BlockEnum.Answer]: {
     defaultValue: {
       title: 'Answer',
@@ -90,14 +119,48 @@ vi.mock('../../hooks-store', () => ({
 }))
 
 vi.mock('../../store', () => ({
+  useStore: (selector: (state: { mousePosition: { pageX: number, pageY: number, elementX: number, elementY: number } }) => unknown) =>
+    selector({
+      mousePosition: {
+        pageX: 120,
+        pageY: 240,
+        elementX: 12,
+        elementY: 24,
+      },
+    }),
   useWorkflowStore: () => ({
+    getState: () => ({
+      setOpenInlineAgentPanelNodeId: mockSetOpenInlineAgentPanelNodeId,
+    }),
     setState: mockWorkflowStoreSetState,
   }),
 }))
 
+vi.mock('../../hooks/use-nodes-sync-draft', () => ({
+  useNodesSyncDraft: () => ({
+    handleSyncWorkflowDraft: mockHandleSyncWorkflowDraft,
+  }),
+}))
+
+vi.mock('../../hooks/use-workflow-history', () => ({
+  WorkflowHistoryEvent: {
+    NodeAdd: 'NodeAdd',
+  },
+  useWorkflowHistory: () => ({
+    saveStateToHistory: mockSaveStateToHistory,
+  }),
+}))
+
+vi.mock('../../nodes/agent-v2/hooks', () => ({
+  useCreateInlineAgentBinding: () => ({
+    createInlineAgentBinding: mockCreateInlineAgentBinding,
+  }),
+}))
+
 vi.mock('../../utils', () => ({
   generateNewNode: mockGenerateNewNode,
   getNodeCustomTypeByNodeDataType: mockGetNodeCustomTypeByNodeDataType,
+  getNodesWithSameDefaultDataType: mockGetNodesWithSameDefaultDataType,
 }))
 
 vi.mock('../tip-popup', () => ({
@@ -114,6 +177,17 @@ describe('AddBlock', () => {
     mockNodesReadOnly = false
     mockIsChatMode = false
     mockFlowType = FlowType.appFlow
+    mockCreateInlineAgentBinding.mockImplementation((_nodeId: string, options?: { onSuccess?: (binding: {
+      binding_type: 'inline_agent'
+      agent_id: string
+      current_snapshot_id: string
+    }) => void }) => {
+      options?.onSuccess?.({
+        binding_type: 'inline_agent',
+        agent_id: 'inline-agent-1',
+        current_snapshot_id: 'snapshot-1',
+      })
+    })
   })
 
   // Rendering and selector configuration.
@@ -211,7 +285,7 @@ describe('AddBlock', () => {
         },
       })
       expect(mockWorkflowStoreSetState).toHaveBeenCalledWith({
-        candidateNode: {
+        candidateNode: expect.objectContaining({
           id: 'generated-node',
           type: 'answer-custom',
           data: {
@@ -221,8 +295,92 @@ describe('AddBlock', () => {
             pluginId: 'plugin-1',
             _isCandidate: true,
           },
+        }),
+      })
+    })
+
+    it('should count Agent v2 nodes by the final default data type without counting legacy Agent nodes', async () => {
+      mockNodesMetaDataMap[BlockEnum.AgentV2] = {
+        defaultValue: {
+          title: 'Agent',
+          desc: '',
+          agent_node_kind: 'dify_agent',
+          type: BlockEnum.Agent,
+          version: '2',
+        },
+      }
+      renderWithReactFlow([
+        createNode({ id: 'old-agent', position: { x: 0, y: 0 }, data: { type: BlockEnum.Agent, version: '2' } }),
+        createNode({ id: 'agent-v2', position: { x: 80, y: 0 }, data: { agent_node_kind: 'dify_agent', type: BlockEnum.Agent, version: '2' } }),
+      ])
+
+      await waitFor(() => expect(latestBlockSelectorProps).not.toBeNull())
+
+      act(() => {
+        latestBlockSelectorProps?.onSelect(BlockEnum.AgentV2)
+      })
+
+      expect(mockGetNodesWithSameDefaultDataType).toHaveBeenCalledWith(
+        expect.any(Array),
+        BlockEnum.AgentV2,
+        {
+          title: 'Agent',
+          desc: '',
+          agent_node_kind: 'dify_agent',
+          type: BlockEnum.Agent,
+          version: '2',
+        },
+      )
+      expect(mockGenerateNewNode).toHaveBeenCalledWith({
+        type: 'agent-v2-custom',
+        data: {
+          title: 'Agent 2',
+          desc: '',
+          agent_node_kind: 'dify_agent',
+          type: BlockEnum.Agent,
+          version: '2',
+          _isCandidate: true,
+        },
+        position: {
+          x: 0,
+          y: 0,
         },
       })
     })
+
+    it('should commit start-from-scratch Agent v2 immediately and create the inline binding', async () => {
+      mockNodesMetaDataMap[BlockEnum.AgentV2] = {
+        defaultValue: {
+          title: 'Agent',
+          desc: '',
+          agent_node_kind: 'dify_agent',
+          type: BlockEnum.Agent,
+          version: '2',
+        },
+      }
+      renderWithReactFlow([])
+
+      await waitFor(() => expect(latestBlockSelectorProps).not.toBeNull())
+
+      act(() => {
+        latestBlockSelectorProps?.onSelect(BlockEnum.AgentV2, {
+          agent_binding: {
+            binding_type: 'inline_agent',
+          },
+          agent_node_kind: 'dify_agent',
+          version: '2',
+        })
+      })
+
+      expect(mockWorkflowStoreSetState).toHaveBeenCalledWith({
+        candidateNode: undefined,
+      })
+      expect(mockCreateInlineAgentBinding).toHaveBeenCalledWith('generated-node', expect.objectContaining({
+        onSuccess: expect.any(Function),
+      }))
+      expect(mockSetOpenInlineAgentPanelNodeId).toHaveBeenCalledWith('generated-node')
+      expect(mockHandleSyncWorkflowDraft).toHaveBeenCalledWith(true, true)
+      expect(mockSaveStateToHistory).toHaveBeenCalledWith('NodeAdd', { nodeId: 'generated-node' })
+    })
   })
 })
diff --git a/web/app/components/workflow/operator/__tests__/control.spec.tsx b/web/app/components/workflow/operator/__tests__/control.spec.tsx
index 3a31c8f7217..23118185d4d 100644
--- a/web/app/components/workflow/operator/__tests__/control.spec.tsx
+++ b/web/app/components/workflow/operator/__tests__/control.spec.tsx
@@ -10,16 +10,22 @@ type WorkflowStoreState = {
 const {
   mockHandleAddNote,
   mockHandleLayout,
+  mockHandleModeComment,
   mockHandleModeHand,
   mockHandleModePointer,
 } = vi.hoisted(() => ({
   mockHandleAddNote: vi.fn(),
   mockHandleLayout: vi.fn(),
+  mockHandleModeComment: vi.fn(),
   mockHandleModeHand: vi.fn(),
   mockHandleModePointer: vi.fn(),
 }))
 
 let mockNodesReadOnly = false
+let mockCanComment = true
+let mockCanEdit = true
+let mockCanUseCommentMode = true
+let mockIsCommentModeAvailable = true
 let mockStoreState: WorkflowStoreState
 
 vi.mock('../../hooks', () => ({
@@ -30,6 +36,9 @@ vi.mock('../../hooks', () => ({
   useWorkflowMoveMode: () => ({
     handleModePointer: mockHandleModePointer,
     handleModeHand: mockHandleModeHand,
+    handleModeComment: mockHandleModeComment,
+    isCommentModeAvailable: mockIsCommentModeAvailable,
+    canUseCommentMode: mockCanUseCommentMode,
   }),
   useWorkflowOrganize: () => ({
     handleLayout: mockHandleLayout,
@@ -46,6 +55,16 @@ vi.mock('../../store', () => ({
   useStore: (selector: (state: WorkflowStoreState) => unknown) => selector(mockStoreState),
 }))
 
+vi.mock('../../hooks-store', () => ({
+  useHooksStore: <T,>(selector: (state: { accessControl: { canComment: boolean, canEdit: boolean } }) => T): T =>
+    selector({
+      accessControl: {
+        canComment: mockCanComment,
+        canEdit: mockCanEdit,
+      },
+    }),
+}))
+
 vi.mock('../add-block', () => ({
   default: () => <div data-testid="add-block" />,
 }))
@@ -68,6 +87,10 @@ describe('Control', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockNodesReadOnly = false
+    mockCanComment = true
+    mockCanEdit = true
+    mockCanUseCommentMode = true
+    mockIsCommentModeAvailable = true
     mockStoreState = {
       controlMode: ControlMode.Pointer,
     }
@@ -103,15 +126,19 @@ describe('Control', () => {
       fireEvent.click(screen.getByTestId('workflow.nodes.note.addNote').firstElementChild as HTMLElement)
       fireEvent.click(screen.getByTestId('workflow.common.pointerMode').firstElementChild as HTMLElement)
       fireEvent.click(screen.getByTestId('workflow.common.handMode').firstElementChild as HTMLElement)
+      fireEvent.click(screen.getByTestId('workflow.common.commentMode').firstElementChild as HTMLElement)
       fireEvent.click(screen.getByTestId('workflow.panel.organizeBlocks').firstElementChild as HTMLElement)
 
       expect(mockHandleAddNote).toHaveBeenCalledTimes(1)
       expect(mockHandleModePointer).toHaveBeenCalledTimes(1)
       expect(mockHandleModeHand).toHaveBeenCalledTimes(1)
+      expect(mockHandleModeComment).toHaveBeenCalledTimes(1)
       expect(mockHandleLayout).toHaveBeenCalledTimes(1)
     })
 
-    it('should block note creation when the workflow is read only', () => {
+    it('should block note creation when editing is not allowed', () => {
+      mockCanEdit = false
+      mockCanComment = true
       mockNodesReadOnly = true
 
       render(<Control />)
@@ -120,5 +147,32 @@ describe('Control', () => {
 
       expect(mockHandleAddNote).not.toHaveBeenCalled()
     })
+
+    it('should keep comment mode enabled for readonly layout users who can comment', () => {
+      mockNodesReadOnly = true
+      mockCanUseCommentMode = true
+
+      render(<Control />)
+
+      const commentButton = screen.getByTestId('workflow.common.commentMode').firstElementChild as HTMLButtonElement
+      expect(commentButton).toBeEnabled()
+
+      fireEvent.click(commentButton)
+
+      expect(mockHandleModeComment).toHaveBeenCalledTimes(1)
+    })
+
+    it('should disable comment mode when comment operation is blocked', () => {
+      mockCanUseCommentMode = false
+
+      render(<Control />)
+
+      const commentButton = screen.getByTestId('workflow.common.commentMode').firstElementChild as HTMLButtonElement
+      expect(commentButton).toBeDisabled()
+
+      fireEvent.click(commentButton)
+
+      expect(mockHandleModeComment).not.toHaveBeenCalled()
+    })
   })
 })
diff --git a/web/app/components/workflow/operator/add-block.tsx b/web/app/components/workflow/operator/add-block.tsx
index 52b71764393..e2937f28642 100644
--- a/web/app/components/workflow/operator/add-block.tsx
+++ b/web/app/components/workflow/operator/add-block.tsx
@@ -4,6 +4,7 @@ import type {
 } from '@/app/components/workflow/types'
 import { cn } from '@langgenius/dify-ui/cn'
 import { RiAddCircleFill } from '@remixicon/react'
+import { produce } from 'immer'
 import {
   memo,
   useCallback,
@@ -11,6 +12,7 @@ import {
 } from 'react'
 import { useTranslation } from 'react-i18next'
 import {
+  useReactFlow,
   useStoreApi,
 } from 'reactflow'
 import BlockSelector from '@/app/components/workflow/block-selector'
@@ -26,10 +28,16 @@ import {
   usePanelInteractions,
 } from '../hooks'
 import { useHooksStore } from '../hooks-store'
-import { useWorkflowStore } from '../store'
+import { useCollaborativeWorkflow } from '../hooks/use-collaborative-workflow'
+import { useNodesSyncDraft } from '../hooks/use-nodes-sync-draft'
+import { useWorkflowHistory, WorkflowHistoryEvent } from '../hooks/use-workflow-history'
+import { useCreateInlineAgentBinding } from '../nodes/agent-v2/hooks'
+import { isAgentV2NodeData, needsInlineAgentBindingCreation } from '../nodes/agent-v2/types'
+import { useStore, useWorkflowStore } from '../store'
 import {
   generateNewNode,
   getNodeCustomTypeByNodeDataType,
+  getNodesWithSameDefaultDataType,
 } from '../utils'
 import TipPopup from './tip-popup'
 
@@ -47,10 +55,16 @@ const AddBlock = ({
 }: AddBlockProps) => {
   const { t } = useTranslation()
   const store = useStoreApi()
+  const reactflow = useReactFlow()
   const workflowStore = useWorkflowStore()
+  const mousePosition = useStore(s => s.mousePosition)
+  const collaborativeWorkflow = useCollaborativeWorkflow()
   const isChatMode = useIsChatMode()
   const { nodesReadOnly } = useNodesReadOnly()
   const { handlePaneContextmenuCancel } = usePanelInteractions()
+  const { handleSyncWorkflowDraft } = useNodesSyncDraft()
+  const { saveStateToHistory } = useWorkflowHistory()
+  const { createInlineAgentBinding } = useCreateInlineAgentBinding()
   const [open, setOpen] = useState(false)
   const { availableNextBlocks } = useAvailableBlocks(BlockEnum.Start, false)
   const { nodesMap: nodesMetaDataMap } = useNodesMetaData()
@@ -67,11 +81,11 @@ const AddBlock = ({
     const {
       getNodes,
     } = store.getState()
-    const nodes = getNodes()
-    const nodesWithSameType = nodes.filter(node => node.data.type === type)
     const {
       defaultValue,
     } = nodesMetaDataMap![type]
+    const nodes = getNodes()
+    const nodesWithSameType = getNodesWithSameDefaultDataType(nodes, type, defaultValue)
     const { newNode } = generateNewNode({
       type: getNodeCustomTypeByNodeDataType(type),
       data: {
@@ -85,10 +99,56 @@ const AddBlock = ({
         y: 0,
       },
     })
+    if (isAgentV2NodeData(newNode.data) && needsInlineAgentBindingCreation(newNode.data)) {
+      const { nodes, setNodes } = collaborativeWorkflow.getState()
+      const { screenToFlowPosition } = reactflow
+      const position = screenToFlowPosition({
+        x: mousePosition.pageX,
+        y: mousePosition.pageY,
+      })
+      const nodeToInsert = {
+        ...newNode,
+        data: {
+          ...newNode.data,
+          _isCandidate: false,
+          _isTempNode: true,
+          selected: true,
+        },
+        position,
+      }
+      setNodes(produce(nodes, (draft) => {
+        draft.forEach((node) => {
+          node.data.selected = false
+        })
+        draft.push(nodeToInsert)
+      }))
+      workflowStore.setState({
+        candidateNode: undefined,
+      })
+      saveStateToHistory(WorkflowHistoryEvent.NodeAdd, { nodeId: newNode.id })
+      createInlineAgentBinding(newNode.id, {
+        onSuccess: (binding) => {
+          const { nodes, setNodes } = collaborativeWorkflow.getState()
+          setNodes(produce(nodes, (draft) => {
+            const node = draft.find(node => node.id === newNode.id)
+            if (node) {
+              if (isAgentV2NodeData(node.data) && needsInlineAgentBindingCreation(node.data))
+                node.data.agent_binding = binding
+              node.data._openInlineAgentPanel = true
+              delete node.data._isTempNode
+            }
+          }))
+          workflowStore.getState().setOpenInlineAgentPanelNodeId(newNode.id)
+          handleSyncWorkflowDraft(true, true)
+        },
+      })
+      setOpen(false)
+      return
+    }
     workflowStore.setState({
       candidateNode: newNode,
     })
-  }, [store, workflowStore, nodesMetaDataMap])
+  }, [collaborativeWorkflow, createInlineAgentBinding, handleSyncWorkflowDraft, mousePosition.pageX, mousePosition.pageY, reactflow, saveStateToHistory, store, workflowStore, nodesMetaDataMap])
 
   const renderTriggerElement = useCallback((open: boolean) => {
     return (
diff --git a/web/app/components/workflow/operator/control.tsx b/web/app/components/workflow/operator/control.tsx
index 74baf76afd4..228ffd37447 100644
--- a/web/app/components/workflow/operator/control.tsx
+++ b/web/app/components/workflow/operator/control.tsx
@@ -34,6 +34,7 @@ const Control = () => {
     handleModeHand,
     handleModeComment,
     isCommentModeAvailable,
+    canUseCommentMode,
   } = useWorkflowMoveMode()
   const { handleLayout } = useWorkflowOrganize()
   const { handleAddNote } = useOperator()
@@ -103,11 +104,11 @@ const Control = () => {
           <button
             type="button"
             aria-label={t('common.commentMode', { ns: 'workflow' })}
-            disabled={nodesReadOnly}
+            disabled={!canUseCommentMode}
             className={cn(
               'ml-px flex size-8 cursor-pointer items-center justify-center rounded-lg',
               controlMode === ControlMode.Comment ? 'bg-state-accent-active text-text-accent' : 'hover:bg-state-base-hover hover:text-text-secondary',
-              `${nodesReadOnly && 'cursor-not-allowed text-text-disabled hover:bg-transparent hover:text-text-disabled'}`,
+              `${!canUseCommentMode && 'cursor-not-allowed text-text-disabled hover:bg-transparent hover:text-text-disabled'}`,
             )}
             onClick={handleModeComment}
           >
diff --git a/web/app/components/workflow/operator/hooks.ts b/web/app/components/workflow/operator/hooks.ts
index 4330920d501..8c7fd0f15e3 100644
--- a/web/app/components/workflow/operator/hooks.ts
+++ b/web/app/components/workflow/operator/hooks.ts
@@ -1,19 +1,18 @@
 import type { NoteNodeType } from '../note-node/types'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { useCallback } from 'react'
 import { useAppContext } from '@/context/app-context'
 import {
   CUSTOM_NOTE_NODE,
-  NOTE_SHOW_AUTHOR_STORAGE_KEY,
 } from '../note-node/constants'
 import { NoteTheme } from '../note-node/types'
+import { useWorkflowNoteShowAuthorValue } from '../persistence/local-storage-options'
 import { useWorkflowStore } from '../store'
 import { generateNewNode } from '../utils'
 
 export const useOperator = () => {
   const workflowStore = useWorkflowStore()
   const { userProfile } = useAppContext()
-  const [showAuthorStorage] = useLocalStorage<string>(NOTE_SHOW_AUTHOR_STORAGE_KEY, 'true', { raw: true })
+  const showAuthorStorage = useWorkflowNoteShowAuthorValue()
 
   const handleAddNote = useCallback(() => {
     const { newNode } = generateNewNode({
diff --git a/web/app/components/workflow/panel-contextmenu.tsx b/web/app/components/workflow/panel-contextmenu.tsx
index 5ceb7b843f1..2e620e26909 100644
--- a/web/app/components/workflow/panel-contextmenu.tsx
+++ b/web/app/components/workflow/panel-contextmenu.tsx
@@ -17,10 +17,12 @@ import {
   useWorkflowMoveMode,
   useWorkflowStartRun,
 } from './hooks'
+import { useHooksStore } from './hooks-store'
 import AddBlock from './operator/add-block'
 import { useOperator } from './operator/hooks'
 import { ShortcutKbd } from './shortcuts/shortcut-kbd'
 import { useStore } from './store'
+import { WorkflowRunningStatus } from './types'
 
 export function PanelContextmenu({
   onClose,
@@ -34,6 +36,9 @@ export function PanelContextmenu({
   const pendingComment = useStore(s => s.pendingComment)
   const setCommentPlacing = useStore(s => s.setCommentPlacing)
   const setCommentQuickAdd = useStore(s => s.setCommentQuickAdd)
+  const workflowRunningData = useStore(s => s.workflowRunningData)
+  const historyWorkflowData = useStore(s => s.historyWorkflowData)
+  const isRestoring = useStore(s => s.isRestoring)
   const { handleNodesPaste } = useNodesInteractions()
   const {
     handleStartWorkflowRun,
@@ -42,7 +47,16 @@ export function PanelContextmenu({
   const { handleAddNote } = useOperator()
   const { isCommentModeAvailable } = useWorkflowMoveMode()
   const { exportCheck } = useDSL()
+  const accessControl = useHooksStore(s => s.accessControl)
   const isChatMode = useIsChatMode()
+  const workflowOperationReadOnly = !!(
+    workflowRunningData?.result.status === WorkflowRunningStatus.Running
+    || workflowRunningData?.result.status === WorkflowRunningStatus.Paused
+    || historyWorkflowData
+    || isRestoring
+  )
+  const canEditWorkflow = accessControl.canEdit && !workflowOperationReadOnly
+  const canCommentWorkflow = accessControl.canComment && !workflowOperationReadOnly
 
   const renderAddBlockTrigger = useCallback(() => {
     return (
@@ -78,26 +92,30 @@ export function PanelContextmenu({
       sideOffset={4}
     >
       <ContextMenuGroup>
-        <AddBlock
-          renderTrigger={renderAddBlockTrigger}
-          renderTriggerAsButtonRoot
-          onClose={onClose}
-          offset={{
-            mainAxis: -36,
-            crossAxis: -4,
-          }}
-        />
-        <ContextMenuItem
-          className="justify-between gap-4 px-3 text-text-secondary"
-          onClick={(e) => {
-            e.stopPropagation()
-            handleAddNote()
-            onClose()
-          }}
-        >
-          {t('nodes.note.addNote', { ns: 'workflow' })}
-        </ContextMenuItem>
-        {isCommentModeAvailable && (
+        {canEditWorkflow && (
+          <AddBlock
+            renderTrigger={renderAddBlockTrigger}
+            renderTriggerAsButtonRoot
+            onClose={onClose}
+            offset={{
+              mainAxis: -36,
+              crossAxis: -4,
+            }}
+          />
+        )}
+        {canEditWorkflow && (
+          <ContextMenuItem
+            className="justify-between gap-4 px-3 text-text-secondary"
+            onClick={(e) => {
+              e.stopPropagation()
+              handleAddNote()
+              onClose()
+            }}
+          >
+            {t('nodes.note.addNote', { ns: 'workflow' })}
+          </ContextMenuItem>
+        )}
+        {canCommentWorkflow && isCommentModeAvailable && (
           <ContextMenuItem
             disabled={!!pendingComment}
             className={cn(
@@ -116,48 +134,58 @@ export function PanelContextmenu({
             {t('comments.actions.addComment', { ns: 'workflow' })}
           </ContextMenuItem>
         )}
-        <ContextMenuItem
-          className="justify-between gap-4 px-3 text-text-secondary"
-          onClick={handleRunAction}
-        >
-          {isChatMode ? t('common.debugAndPreview', { ns: 'workflow' }) : t('common.run', { ns: 'workflow' })}
-          {!isChatMode && <ShortcutKbd hotkey={TEST_RUN_MENU_HOTKEY} />}
-        </ContextMenuItem>
-      </ContextMenuGroup>
-      <ContextMenuSeparator />
-      <ContextMenuGroup>
-        <ContextMenuItem
-          disabled={!clipboardElements.length}
-          className={cn(
-            'justify-between gap-4 px-3 text-text-secondary',
-            !clipboardElements.length && 'cursor-not-allowed opacity-50',
-          )}
-          onClick={() => {
-            if (clipboardElements.length) {
-              handleNodesPaste()
-              onClose()
-            }
-          }}
-        >
-          {t('common.pasteHere', { ns: 'workflow' })}
-          <ShortcutKbd shortcut="workflow.paste" />
-        </ContextMenuItem>
-      </ContextMenuGroup>
-      <ContextMenuSeparator />
-      <ContextMenuGroup>
-        <ContextMenuItem
-          className="justify-between gap-4 px-3 text-text-secondary"
-          onClick={() => exportCheck?.()}
-        >
-          {t('export', { ns: 'app' })}
-        </ContextMenuItem>
-        <ContextMenuItem
-          className="justify-between gap-4 px-3 text-text-secondary"
-          onClick={() => setShowImportDSLModal(true)}
-        >
-          {t('importApp', { ns: 'app' })}
-        </ContextMenuItem>
+        {accessControl.canRun && (
+          <ContextMenuItem
+            className="justify-between gap-4 px-3 text-text-secondary"
+            onClick={handleRunAction}
+          >
+            {isChatMode ? t('common.debugAndPreview', { ns: 'workflow' }) : t('common.run', { ns: 'workflow' })}
+            {!isChatMode && <ShortcutKbd hotkey={TEST_RUN_MENU_HOTKEY} />}
+          </ContextMenuItem>
+        )}
       </ContextMenuGroup>
+      {canEditWorkflow && (
+        <>
+          <ContextMenuSeparator />
+          <ContextMenuGroup>
+            <ContextMenuItem
+              disabled={!clipboardElements.length}
+              className={cn(
+                'justify-between gap-4 px-3 text-text-secondary',
+                !clipboardElements.length && 'cursor-not-allowed opacity-50',
+              )}
+              onClick={() => {
+                if (clipboardElements.length) {
+                  handleNodesPaste()
+                  onClose()
+                }
+              }}
+            >
+              {t('common.pasteHere', { ns: 'workflow' })}
+              <ShortcutKbd shortcut="workflow.paste" />
+            </ContextMenuItem>
+          </ContextMenuGroup>
+        </>
+      )}
+      {accessControl.canImportExportDSL && (
+        <>
+          <ContextMenuSeparator />
+          <ContextMenuGroup>
+            <ContextMenuItem
+              className="justify-between gap-4 px-3 text-text-secondary"
+              onClick={() => exportCheck?.()}
+            >
+              {t('export', { ns: 'app' })}
+            </ContextMenuItem>
+            <ContextMenuItem
+              className="justify-between gap-4 px-3 text-text-secondary"
+              onClick={() => setShowImportDSLModal(true)}
+            >
+              {t('importApp', { ns: 'app' })}
+            </ContextMenuItem>
+          </ContextMenuGroup>
+        </>
+      )}
     </ContextMenuContent>
   )
 }
diff --git a/web/app/components/workflow/panel/__tests__/inputs-panel.spec.tsx b/web/app/components/workflow/panel/__tests__/inputs-panel.spec.tsx
index 41174d97a1e..667b0e9a67f 100644
--- a/web/app/components/workflow/panel/__tests__/inputs-panel.spec.tsx
+++ b/web/app/components/workflow/panel/__tests__/inputs-panel.spec.tsx
@@ -299,5 +299,31 @@ describe('InputsPanel', () => {
 
       expect(screen.getByRole('button', { name: 'workflow.singleRun.startRun' })).toBeDisabled()
     })
+
+    it('should disable the run button and skip execution when test/run permission is missing', async () => {
+      const user = userEvent.setup()
+      const onRun = vi.fn()
+      const handleRun = vi.fn()
+
+      renderInputsPanel(createStartNode(), {
+        hooksStoreProps: createHooksStoreProps({
+          handleRun,
+          accessControl: {
+            canEdit: true,
+            canComment: true,
+            canRun: false,
+            canImportExportDSL: true,
+            canReleaseAndVersion: true,
+          },
+        }),
+      }, onRun)
+
+      await user.click(screen.getByRole('button', { name: 'workflow.singleRun.startRun' }))
+
+      expect(screen.getByRole('button', { name: 'workflow.singleRun.startRun' })).toBeDisabled()
+      expect(mockCheckInputsForm).not.toHaveBeenCalled()
+      expect(onRun).not.toHaveBeenCalled()
+      expect(handleRun).not.toHaveBeenCalled()
+    })
   })
 })
diff --git a/web/app/components/workflow/panel/debug-and-preview/__tests__/hooks/handle-send.spec.ts b/web/app/components/workflow/panel/debug-and-preview/__tests__/hooks/handle-send.spec.ts
index fb045c47233..cadf5f6733c 100644
--- a/web/app/components/workflow/panel/debug-and-preview/__tests__/hooks/handle-send.spec.ts
+++ b/web/app/components/workflow/panel/debug-and-preview/__tests__/hooks/handle-send.spec.ts
@@ -11,6 +11,9 @@ const mockSetLoopTimes = vi.fn()
 const mockSubmitHumanInputForm = vi.fn()
 const mockSseGet = vi.fn()
 const mockGetNodes = vi.fn((): any[] => [])
+const mockHooksStoreState = vi.hoisted(() => ({
+  canRun: true,
+}))
 
 let mockWorkflowRunningData: any = null
 
@@ -49,7 +52,12 @@ vi.mock('../../../../hooks', () => ({
 }))
 
 vi.mock('../../../../hooks-store', () => ({
-  useHooksStore: () => null,
+  useHooksStore: (selector: (state: { configsMap: null, accessControl: { canRun: boolean } }) => unknown) => selector({
+    configsMap: null,
+    accessControl: {
+      canRun: mockHooksStoreState.canRun,
+    },
+  }),
 }))
 
 vi.mock('../../../../store', () => ({
@@ -67,6 +75,7 @@ vi.mock('../../../../store', () => ({
 const resetMocksAndWorkflowState = () => {
   vi.clearAllMocks()
   mockWorkflowRunningData = null
+  mockHooksStoreState.canRun = true
 }
 
 describe('useChat – handleSend', () => {
@@ -87,6 +96,20 @@ describe('useChat – handleSend', () => {
     expect(bodyParams.query).toBe('hello')
   })
 
+  it('should return false and skip handleRun when test/run permission is missing', () => {
+    mockHooksStoreState.canRun = false
+    const { result } = renderHook(() => useChat({}))
+
+    let returned: unknown
+    act(() => {
+      returned = result.current.handleSend({ query: 'hello', inputs: {} }, {})
+    })
+
+    expect(returned).toBe(false)
+    expect(mockHandleRun).not.toHaveBeenCalled()
+    expect(result.current.chatList).toHaveLength(0)
+  })
+
   it('should show notification and return false when already responding', () => {
     mockHandleRun.mockImplementation(() => {})
 
diff --git a/web/app/components/workflow/panel/debug-and-preview/hooks.ts b/web/app/components/workflow/panel/debug-and-preview/hooks.ts
index 24f643ec870..463eff19221 100644
--- a/web/app/components/workflow/panel/debug-and-preview/hooks.ts
+++ b/web/app/components/workflow/panel/debug-and-preview/hooks.ts
@@ -68,6 +68,7 @@ export const useChat = (
   const isRespondingRef = useRef(false)
   const workflowEventsAbortControllerRef = useRef<AbortController | null>(null)
   const configsMap = useHooksStore(s => s.configsMap)
+  const canRun = useHooksStore(s => s.accessControl.canRun)
   const invalidAllLastRun = useInvalidAllLastRun(configsMap?.flowType, configsMap?.flowId)
   const { fetchInspectVars } = useSetWorkflowVarsWithValue()
   const [suggestedQuestions, setSuggestQuestions] = useState<string[]>([])
@@ -259,6 +260,9 @@ export const useChat = (
       onGetSuggestedQuestions,
     }: SendCallback,
   ) => {
+    if (canRun === false)
+      return false
+
     if (isRespondingRef.current) {
       toast.info(t('errorMessage.waitForResponse', { ns: 'appDebug' }))
       return false
@@ -665,7 +669,7 @@ export const useChat = (
         },
       },
     )
-  }, [threadMessages, chatTree.length, updateCurrentQAOnTree, handleResponding, formSettings?.inputsForm, handleRun, t, workflowStore, fetchInspectVars, invalidAllLastRun, config?.suggested_questions_after_answer?.enabled])
+  }, [canRun, threadMessages, chatTree.length, updateCurrentQAOnTree, handleResponding, formSettings?.inputsForm, handleRun, t, workflowStore, fetchInspectVars, invalidAllLastRun, config?.suggested_questions_after_answer?.enabled])
 
   const handleSubmitHumanInputForm = async (formToken: string, formData: HumanInputFormSubmitData) => {
     await submitHumanInputForm(formToken, formData)
diff --git a/web/app/components/workflow/panel/debug-and-preview/index.tsx b/web/app/components/workflow/panel/debug-and-preview/index.tsx
index 3f0576d8703..ff99f10505c 100644
--- a/web/app/components/workflow/panel/debug-and-preview/index.tsx
+++ b/web/app/components/workflow/panel/debug-and-preview/index.tsx
@@ -5,7 +5,6 @@ import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/too
 import { RiCloseLine, RiEqualizer2Line } from '@remixicon/react'
 import { debounce } from 'es-toolkit/compat'
 import { noop } from 'es-toolkit/function'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import {
   memo,
   useCallback,
@@ -24,6 +23,7 @@ import {
   useWorkflowInteractions,
 } from '../../hooks'
 import { useResizePanel } from '../../nodes/_base/hooks/use-resize-panel'
+import { useSetDebugPreviewPanelWidth } from '../../persistence/local-storage-options'
 import { BlockEnum } from '../../types'
 import ChatWrapper from './chat-wrapper'
 
@@ -55,10 +55,10 @@ const DebugAndPreview = () => {
   const nodePanelWidth = useStore(s => s.nodePanelWidth)
   const panelWidth = useStore(s => s.previewPanelWidth)
   const setPanelWidth = useStore(s => s.setPreviewPanelWidth)
-  const setPanelWidthStorage = useSetLocalStorage<string>('debug-and-preview-panel-width', { raw: true })
+  const setPanelWidthStorage = useSetDebugPreviewPanelWidth()
   const handleResize = useCallback((width: number, source: 'user' | 'system' = 'user') => {
     if (source === 'user')
-      setPanelWidthStorage(`${width}`)
+      setPanelWidthStorage(width)
     setPanelWidth(width)
   }, [setPanelWidth, setPanelWidthStorage])
   const maxPanelWidth = useMemo(() => {
diff --git a/web/app/components/workflow/panel/inputs-panel.tsx b/web/app/components/workflow/panel/inputs-panel.tsx
index 6a40a755396..f76ce322df9 100644
--- a/web/app/components/workflow/panel/inputs-panel.tsx
+++ b/web/app/components/workflow/panel/inputs-panel.tsx
@@ -34,6 +34,7 @@ const InputsPanel = ({ onRun }: Props) => {
   const workflowStore = useWorkflowStore()
   const inputs = useStore(s => s.inputs)
   const fileSettings = useHooksStore(s => s.configsMap?.fileSettings)
+  const canRunWorkflow = useHooksStore(s => s.accessControl.canRun)
   const nodes = useNodes<StartNodeType>()
   const files = useStore(s => s.files)
   const workflowRunningData = useStore(s => s.workflowRunningData)
@@ -92,16 +93,19 @@ const InputsPanel = ({ onRun }: Props) => {
     }
   }
 
+  const canRun = useMemo(() => {
+    const canUploadReady = !(files?.some(item => (item.transfer_method as any) === TransferMethod.local_file && !item.upload_file_id))
+    return canRunWorkflow && canUploadReady
+  }, [canRunWorkflow, files])
+
   const doRun = useCallback(() => {
+    if (!canRun)
+      return
     if (!checkInputsForm(initialInputs, variables as any))
       return
     onRun()
     handleRun({ inputs: getProcessedInputs(initialInputs, variables as any), files })
-  }, [files, handleRun, initialInputs, onRun, variables, checkInputsForm])
-
-  const canRun = useMemo(() => {
-    return !(files?.some(item => (item.transfer_method as any) === TransferMethod.local_file && !item.upload_file_id))
-  }, [files])
+  }, [canRun, files, handleRun, initialInputs, onRun, variables, checkInputsForm])
 
   return (
     <>
diff --git a/web/app/components/workflow/panel/version-history-panel/__tests__/index.spec.tsx b/web/app/components/workflow/panel/version-history-panel/__tests__/index.spec.tsx
index 3c9f7dba0ea..3bd17d4947f 100644
--- a/web/app/components/workflow/panel/version-history-panel/__tests__/index.spec.tsx
+++ b/web/app/components/workflow/panel/version-history-panel/__tests__/index.spec.tsx
@@ -1,16 +1,23 @@
 import type { Shape } from '../../../store'
 import type { VersionHistory } from '@/types/workflow'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
-import { useEffect } from 'react'
+import { useEffect, useRef } from 'react'
+import { Plan } from '@/app/components/billing/type'
 import { VersionHistoryContextMenuOptions, WorkflowVersion } from '../../../types'
 
 const mockHandleRestoreFromPublishedWorkflow = vi.fn()
 const mockHandleLoadBackupDraft = vi.fn()
 const mockHandleRefreshWorkflowDraft = vi.fn()
+const mockHandleExportDSL = vi.fn()
 const mockRestoreWorkflow = vi.fn()
 const mockSetCurrentVersion = vi.fn()
 const mockSetShowWorkflowVersionHistoryPanel = vi.fn()
 const mockWorkflowStoreSetState = vi.fn()
+const mockEmitRestoreIntent = vi.fn()
+const mockEmitRestoreComplete = vi.fn()
+const mockEmitWorkflowUpdate = vi.fn()
+let mockPlanType = Plan.professional
+let mockEnableBilling = true
 
 const createVersionHistory = (overrides: Partial<VersionHistory> = {}): VersionHistory => ({
   id: 'version-id',
@@ -56,6 +63,13 @@ vi.mock('@/context/app-context', () => ({
   useSelector: () => ({ id: 'test-user-id' }),
 }))
 
+vi.mock('@/context/provider-context', () => ({
+  useProviderContext: () => ({
+    plan: { type: mockPlanType },
+    enableBilling: mockEnableBilling,
+  }),
+}))
+
 vi.mock('@/service/use-workflow', () => ({
   useDeleteWorkflow: () => ({ mutateAsync: vi.fn() }),
   useInvalidAllLastRun: () => vi.fn(),
@@ -88,7 +102,7 @@ vi.mock('@/service/use-workflow', () => ({
 }))
 
 vi.mock('../../../hooks', () => ({
-  useDSL: () => ({ handleExportDSL: vi.fn() }),
+  useDSL: () => ({ handleExportDSL: mockHandleExportDSL }),
   useWorkflowRefreshDraft: () => ({ handleRefreshWorkflowDraft: mockHandleRefreshWorkflowDraft }),
   useWorkflowRun: () => ({
     handleRestoreFromPublishedWorkflow: mockHandleRestoreFromPublishedWorkflow,
@@ -103,6 +117,14 @@ vi.mock('../../../hooks-store', () => ({
   }),
 }))
 
+vi.mock('../../../collaboration/core/collaboration-manager', () => ({
+  collaborationManager: {
+    emitRestoreIntent: mockEmitRestoreIntent,
+    emitRestoreComplete: mockEmitRestoreComplete,
+    emitWorkflowUpdate: mockEmitWorkflowUpdate,
+  },
+}))
+
 vi.mock('../../../store', () => ({
   useStore: <T,>(selector: (state: MockVersionStoreState) => T) => {
     const state: MockVersionStoreState = {
@@ -149,19 +171,27 @@ vi.mock('../version-history-item', () => ({
   default: (props: MockVersionHistoryItemProps) => {
     const MockVersionHistoryItem = () => {
       const { item, onClick, handleClickActionMenuItem } = props
+      const didSelectDraftRef = useRef(false)
 
       useEffect(() => {
-        if (item.version === WorkflowVersion.Draft)
+        if (item.version === WorkflowVersion.Draft && !didSelectDraftRef.current) {
+          didSelectDraftRef.current = true
           onClick(item)
+        }
       }, [item, onClick])
 
       return (
         <div>
           <button onClick={() => onClick(item)}>{item.marked_name || item.version}</button>
           {item.version !== WorkflowVersion.Draft && (
-            <button onClick={() => handleClickActionMenuItem(VersionHistoryContextMenuOptions.restore)}>
-              {`restore-${item.id}`}
-            </button>
+            <>
+              <button onClick={() => handleClickActionMenuItem(VersionHistoryContextMenuOptions.restore)}>
+                {`restore-${item.id}`}
+              </button>
+              <button onClick={() => handleClickActionMenuItem(VersionHistoryContextMenuOptions.exportDSL)}>
+                {`export-${item.id}`}
+              </button>
+            </>
           )}
         </div>
       )
@@ -174,7 +204,10 @@ vi.mock('../version-history-item', () => ({
 describe('VersionHistoryPanel', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockRestoreWorkflow.mockResolvedValue(undefined)
     mockCurrentVersion = null
+    mockPlanType = Plan.professional
+    mockEnableBilling = true
   })
 
   describe('Version Click Behavior', () => {
@@ -221,6 +254,9 @@ describe('VersionHistoryPanel', () => {
       />,
     )
 
+    await waitFor(() => {
+      expect(mockHandleLoadBackupDraft).toHaveBeenCalled()
+    })
     vi.clearAllMocks()
 
     fireEvent.click(screen.getByText('restore-published-version-id'))
@@ -237,9 +273,47 @@ describe('VersionHistoryPanel', () => {
     })
   })
 
+  it('should show plan upgrade modal instead of restore confirmation for sandbox users', async () => {
+    const { VersionHistoryPanel } = await import('../index')
+    mockPlanType = Plan.sandbox
+
+    render(
+      <VersionHistoryPanel
+        latestVersionId="published-version-id"
+        restoreVersionUrl={versionId => `/apps/app-1/workflows/${versionId}/restore`}
+      />,
+    )
+
+    vi.clearAllMocks()
+
+    fireEvent.click(screen.getByText('restore-published-version-id'))
+
+    expect(screen.getByText('billing.upgrade.workflowRestore.title')).toBeInTheDocument()
+    expect(screen.queryByText('confirm restore')).not.toBeInTheDocument()
+    expect(mockRestoreWorkflow).not.toHaveBeenCalled()
+  })
+
+  it('should show plan upgrade modal instead of exporting DSL for sandbox users', async () => {
+    const { VersionHistoryPanel } = await import('../index')
+    mockPlanType = Plan.sandbox
+
+    render(
+      <VersionHistoryPanel
+        latestVersionId="published-version-id"
+        restoreVersionUrl={versionId => `/apps/app-1/workflows/${versionId}/restore`}
+      />,
+    )
+
+    vi.clearAllMocks()
+
+    fireEvent.click(screen.getByText('export-published-version-id'))
+
+    expect(screen.getByText('billing.upgrade.workflowRestore.title')).toBeInTheDocument()
+    expect(mockHandleExportDSL).not.toHaveBeenCalled()
+  })
+
   it('should keep restore mode backup state when restore request fails', async () => {
     const { VersionHistoryPanel } = await import('../index')
-    mockRestoreWorkflow.mockRejectedValueOnce(new Error('restore failed'))
     mockCurrentVersion = createVersionHistory({
       id: 'draft-version-id',
       version: WorkflowVersion.Draft,
@@ -253,6 +327,7 @@ describe('VersionHistoryPanel', () => {
     )
 
     vi.clearAllMocks()
+    mockRestoreWorkflow.mockRejectedValueOnce(new Error('restore failed'))
 
     fireEvent.click(screen.getByText('restore-published-version-id'))
     fireEvent.click(screen.getByText('confirm restore'))
diff --git a/web/app/components/workflow/panel/version-history-panel/__tests__/version-history-item.spec.tsx b/web/app/components/workflow/panel/version-history-panel/__tests__/version-history-item.spec.tsx
index 545becd1cfc..b28901a8f95 100644
--- a/web/app/components/workflow/panel/version-history-panel/__tests__/version-history-item.spec.tsx
+++ b/web/app/components/workflow/panel/version-history-panel/__tests__/version-history-item.spec.tsx
@@ -61,6 +61,7 @@ describe('VersionHistoryItem', () => {
           latestVersionId="latest-version"
           onClick={onClick}
           handleClickActionMenuItem={vi.fn()}
+          canImportExportDSL
           isLast={false}
         />,
       )
@@ -91,6 +92,7 @@ describe('VersionHistoryItem', () => {
           latestVersionId="version-1"
           onClick={onClick}
           handleClickActionMenuItem={handleClickActionMenuItem}
+          canImportExportDSL
           isLast={false}
         />,
       )
@@ -127,6 +129,35 @@ describe('VersionHistoryItem', () => {
       )
     })
 
+    it('should hide export from the context menu when import/export DSL permission is missing', async () => {
+      const user = userEvent.setup()
+
+      render(
+        <VersionHistoryItem
+          item={createVersionHistory()}
+          currentVersion={null}
+          latestVersionId="version-1"
+          onClick={vi.fn()}
+          handleClickActionMenuItem={vi.fn()}
+          canImportExportDSL={false}
+          isLast={false}
+        />,
+      )
+
+      const title = screen.getByText('Release 1')
+      const itemContainer = title.closest('.group')
+      if (!itemContainer)
+        throw new Error('Expected version history item container')
+
+      fireEvent.mouseEnter(itemContainer)
+
+      const triggerButton = await screen.findByRole('button')
+      await user.click(triggerButton)
+
+      expect(screen.queryByText('app.export')).not.toBeInTheDocument()
+      expect(screen.getByText('workflow.versionHistory.copyId')).toBeInTheDocument()
+    })
+
     it('should ignore clicks when the item is already selected', async () => {
       const user = userEvent.setup()
       const onClick = vi.fn()
@@ -139,6 +170,7 @@ describe('VersionHistoryItem', () => {
           latestVersionId="other-version"
           onClick={onClick}
           handleClickActionMenuItem={vi.fn()}
+          canImportExportDSL
           isLast
         />,
       )
diff --git a/web/app/components/workflow/panel/version-history-panel/action-menu/__tests__/index.spec.tsx b/web/app/components/workflow/panel/version-history-panel/action-menu/__tests__/index.spec.tsx
index 42952f373b8..56890f01d6a 100644
--- a/web/app/components/workflow/panel/version-history-panel/action-menu/__tests__/index.spec.tsx
+++ b/web/app/components/workflow/panel/version-history-panel/action-menu/__tests__/index.spec.tsx
@@ -1,10 +1,35 @@
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { Plan } from '@/app/components/billing/type'
 import { renderWorkflowComponent } from '../../../../__tests__/workflow-test-env'
 import { VersionHistoryContextMenuOptions } from '../../../../types'
 import ActionMenu from '../index'
 
+vi.mock('@/config', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/config')>()
+  return {
+    ...actual,
+    IS_CLOUD_EDITION: true,
+  }
+})
+
+let mockPlanType = Plan.professional
+let mockEnableBilling = true
+
+vi.mock('@/context/provider-context', () => ({
+  useProviderContext: () => ({
+    plan: { type: mockPlanType },
+    enableBilling: mockEnableBilling,
+  }),
+}))
+
 describe('ActionMenu', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockPlanType = Plan.professional
+    mockEnableBilling = true
+  })
+
   it('toggles the trigger and forwards menu clicks', async () => {
     const user = userEvent.setup()
     const setOpen = vi.fn()
@@ -14,6 +39,7 @@ describe('ActionMenu', () => {
       <ActionMenu
         isNamedVersion
         isShowDelete
+        canImportExportDSL
         open
         setOpen={setOpen}
         handleClickActionMenuItem={handleClickActionMenuItem}
@@ -34,4 +60,28 @@ describe('ActionMenu', () => {
       VersionHistoryContextMenuOptions.delete,
     )
   })
+
+  it('shows upgrade buttons beside restore and export for sandbox users', async () => {
+    const user = userEvent.setup()
+    const handleClickActionMenuItem = vi.fn()
+    mockPlanType = Plan.sandbox
+
+    renderWorkflowComponent(
+      <ActionMenu
+        isNamedVersion
+        isShowDelete
+        canImportExportDSL
+        open
+        setOpen={vi.fn()}
+        handleClickActionMenuItem={handleClickActionMenuItem}
+      />,
+    )
+
+    const upgradeButtons = screen.getAllByRole('button', { name: 'billing.upgradeBtn.encourageShort' })
+    expect(upgradeButtons).toHaveLength(2)
+
+    await user.click(upgradeButtons[0]!)
+
+    expect(handleClickActionMenuItem).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/app/components/workflow/panel/version-history-panel/action-menu/__tests__/use-action-menu.spec.tsx b/web/app/components/workflow/panel/version-history-panel/action-menu/__tests__/use-action-menu.spec.tsx
index e08bc787d7a..78944e6cc79 100644
--- a/web/app/components/workflow/panel/version-history-panel/action-menu/__tests__/use-action-menu.spec.tsx
+++ b/web/app/components/workflow/panel/version-history-panel/action-menu/__tests__/use-action-menu.spec.tsx
@@ -6,6 +6,7 @@ describe('useActionMenu', () => {
   it('returns restore, edit, export, copy and delete operations for app workflows', () => {
     const { result } = renderWorkflowHook(() => useActionMenu({
       isNamedVersion: true,
+      canImportExportDSL: true,
       isShowDelete: false,
       open: false,
       setOpen: vi.fn(),
@@ -27,6 +28,7 @@ describe('useActionMenu', () => {
   it('omits export for pipelines and renames the edit action for unnamed versions', () => {
     const { result } = renderWorkflowHook(() => useActionMenu({
       isNamedVersion: false,
+      canImportExportDSL: true,
       isShowDelete: true,
       open: false,
       setOpen: vi.fn(),
@@ -52,4 +54,21 @@ describe('useActionMenu', () => {
       },
     ])
   })
+
+  it('omits export when import/export DSL permission is missing', () => {
+    const { result } = renderWorkflowHook(() => useActionMenu({
+      isNamedVersion: true,
+      canImportExportDSL: false,
+      isShowDelete: false,
+      open: false,
+      setOpen: vi.fn(),
+      handleClickActionMenuItem: vi.fn(),
+    }))
+
+    expect(result.current.options.map(item => item.key)).toEqual([
+      VersionHistoryContextMenuOptions.restore,
+      VersionHistoryContextMenuOptions.edit,
+      VersionHistoryContextMenuOptions.copyId,
+    ])
+  })
 })
diff --git a/web/app/components/workflow/panel/version-history-panel/action-menu/action-menu-item.tsx b/web/app/components/workflow/panel/version-history-panel/action-menu/action-menu-item.tsx
index 7d24e812177..a1fc8673eff 100644
--- a/web/app/components/workflow/panel/version-history-panel/action-menu/action-menu-item.tsx
+++ b/web/app/components/workflow/panel/version-history-panel/action-menu/action-menu-item.tsx
@@ -3,11 +3,13 @@ import type { VersionHistoryContextMenuOptions } from '../../../types'
 import { cn } from '@langgenius/dify-ui/cn'
 import { DropdownMenuItem } from '@langgenius/dify-ui/dropdown-menu'
 import * as React from 'react'
+import UpgradeBtn from '@/app/components/billing/upgrade-btn'
 
 type ActionMenuItemProps = {
   item: {
     key: VersionHistoryContextMenuOptions
     name: string
+    showUpgrade?: boolean
   }
   onClick: (operation: VersionHistoryContextMenuOptions) => void
   isDestructive?: boolean
@@ -22,21 +24,38 @@ const ActionMenuItem: FC<ActionMenuItemProps> = ({
     <DropdownMenuItem
       variant={isDestructive ? 'destructive' : 'default'}
       className={cn(
-        'justify-between px-2 py-1.5',
+        'justify-between gap-x-3 px-2 py-1.5 whitespace-nowrap',
         isDestructive && 'data-highlighted:bg-state-destructive-hover',
       )}
       onClick={(event) => {
         event.stopPropagation()
+        const target = event.target
+        if (target instanceof Element && target.closest('[data-upgrade-action]'))
+          return
+
         onClick(item.key)
       }}
     >
       <div className={cn(
-        'flex-1 system-md-regular text-text-primary',
+        'flex-1 system-md-regular whitespace-nowrap text-text-primary',
         isDestructive && 'text-inherit',
       )}
       >
         {item.name}
       </div>
+      {item.showUpgrade && (
+        <div
+          data-upgrade-action
+          className="shrink-0"
+        >
+          <UpgradeBtn
+            size="custom"
+            isShort
+            loc="workflow-version-history-menu"
+            className="h-5! rounded-md! px-1!"
+          />
+        </div>
+      )}
     </DropdownMenuItem>
   )
 }
diff --git a/web/app/components/workflow/panel/version-history-panel/action-menu/index.tsx b/web/app/components/workflow/panel/version-history-panel/action-menu/index.tsx
index 4af7f9bc52b..5d96a761edd 100644
--- a/web/app/components/workflow/panel/version-history-panel/action-menu/index.tsx
+++ b/web/app/components/workflow/panel/version-history-panel/action-menu/index.tsx
@@ -15,6 +15,7 @@ import useActionMenu from './use-action-menu'
 export type ActionMenuProps = {
   isShowDelete: boolean
   isNamedVersion: boolean
+  canImportExportDSL: boolean
   open: boolean
   setOpen: React.Dispatch<React.SetStateAction<boolean>>
   handleClickActionMenuItem: (operation: VersionHistoryContextMenuOptions) => void
@@ -41,7 +42,7 @@ const ActionMenu: FC<ActionMenuProps> = (props: ActionMenuProps) => {
       <DropdownMenuContent
         placement="bottom-end"
         sideOffset={4}
-        popupClassName="w-[184px] shadow-shadow-shadow-5"
+        popupClassName="w-max min-w-[184px] max-w-[calc(100vw-24px)] shadow-shadow-shadow-5"
       >
         {
           options.map(option => (
diff --git a/web/app/components/workflow/panel/version-history-panel/action-menu/use-action-menu.ts b/web/app/components/workflow/panel/version-history-panel/action-menu/use-action-menu.ts
index 4a81809aeb2..94b94aa2516 100644
--- a/web/app/components/workflow/panel/version-history-panel/action-menu/use-action-menu.ts
+++ b/web/app/components/workflow/panel/version-history-panel/action-menu/use-action-menu.ts
@@ -1,15 +1,20 @@
 import type { ActionMenuProps } from './index'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
+import { Plan } from '@/app/components/billing/type'
 import { useStore } from '@/app/components/workflow/store'
+import { useProviderContext } from '@/context/provider-context'
 import { VersionHistoryContextMenuOptions } from '../../../types'
 
 const useActionMenu = (props: ActionMenuProps) => {
   const {
     isNamedVersion,
+    canImportExportDSL,
   } = props
   const { t } = useTranslation()
   const pipelineId = useStore(s => s.pipelineId)
+  const { plan, enableBilling } = useProviderContext()
+  const shouldShowUpgrade = enableBilling && plan.type === Plan.sandbox
 
   const deleteOperation = {
     key: VersionHistoryContextMenuOptions.delete,
@@ -21,6 +26,7 @@ const useActionMenu = (props: ActionMenuProps) => {
       {
         key: VersionHistoryContextMenuOptions.restore,
         name: t('common.restore', { ns: 'workflow' }),
+        ...(shouldShowUpgrade ? { showUpgrade: true } : {}),
       },
       isNamedVersion
         ? {
@@ -32,10 +38,11 @@ const useActionMenu = (props: ActionMenuProps) => {
             name: t('versionHistory.nameThisVersion', { ns: 'workflow' }),
           },
       // todo: pipeline support export specific version DSL
-      ...(!pipelineId
+      ...(canImportExportDSL && !pipelineId
         ? [{
             key: VersionHistoryContextMenuOptions.exportDSL,
             name: t('export', { ns: 'app' }),
+            ...(shouldShowUpgrade ? { showUpgrade: true } : {}),
           }]
         : []),
       {
@@ -43,7 +50,7 @@ const useActionMenu = (props: ActionMenuProps) => {
         name: t('versionHistory.copyId', { ns: 'workflow' }),
       },
     ]
-  }, [isNamedVersion, pipelineId, t])
+  }, [canImportExportDSL, isNamedVersion, pipelineId, shouldShowUpgrade, shouldShowUpgrade, t])
 
   return {
     deleteOperation,
diff --git a/web/app/components/workflow/panel/version-history-panel/index.tsx b/web/app/components/workflow/panel/version-history-panel/index.tsx
index 568d12fd959..384e945168f 100644
--- a/web/app/components/workflow/panel/version-history-panel/index.tsx
+++ b/web/app/components/workflow/panel/version-history-panel/index.tsx
@@ -8,7 +8,10 @@ import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import VersionInfoModal from '@/app/components/app/app-publisher/version-info-modal'
 import Divider from '@/app/components/base/divider'
+import { PlanUpgradeModal } from '@/app/components/billing/plan-upgrade-modal'
+import { Plan } from '@/app/components/billing/type'
 import { useSelector as useAppContextSelector } from '@/context/app-context'
+import { useProviderContext } from '@/context/provider-context'
 import { useDeleteWorkflow, useInvalidAllLastRun, useResetWorkflowVersionHistory, useRestoreWorkflow, useUpdateWorkflow, useWorkflowVersionHistory } from '@/service/use-workflow'
 import { useDSL, useWorkflowRefreshDraft, useWorkflowRun } from '../../hooks'
 import { useHooksStore } from '../../hooks-store'
@@ -43,8 +46,11 @@ export const VersionHistoryPanel = ({
   const [isOnlyShowNamedVersions, setIsOnlyShowNamedVersions] = useState(false)
   const [operatedItem, setOperatedItem] = useState<VersionHistory>()
   const [restoreConfirmOpen, setRestoreConfirmOpen] = useState(false)
+  const [isRestorePlanUpgradeModalOpen, setIsRestorePlanUpgradeModalOpen] = useState(false)
   const [deleteConfirmOpen, setDeleteConfirmOpen] = useState(false)
   const [editModalOpen, setEditModalOpen] = useState(false)
+  const { plan, enableBilling } = useProviderContext()
+  const canUseWorkflowVersionAction = !enableBilling || plan.type !== Plan.sandbox
   const workflowStore = useWorkflowStore()
   const { handleRestoreFromPublishedWorkflow, handleLoadBackupDraft } = useWorkflowRun()
   const { handleRefreshWorkflowDraft } = useWorkflowRefreshDraft()
@@ -54,6 +60,7 @@ export const VersionHistoryPanel = ({
   const setCurrentVersion = useStore(s => s.setCurrentVersion)
   const userProfile = useAppContextSelector(s => s.userProfile)
   const configsMap = useHooksStore(s => s.configsMap)
+  const canImportExportDSL = useHooksStore(s => s.accessControl.canImportExportDSL)
   const invalidAllLastRun = useInvalidAllLastRun(configsMap?.flowType, configsMap?.flowId)
   const {
     deleteAllInspectVars,
@@ -111,6 +118,10 @@ export const VersionHistoryPanel = ({
     setOperatedItem(item)
     switch (operation) {
       case VersionHistoryContextMenuOptions.restore:
+        if (!canUseWorkflowVersionAction) {
+          setIsRestorePlanUpgradeModalOpen(true)
+          break
+        }
         setRestoreConfirmOpen(true)
         break
       case VersionHistoryContextMenuOptions.edit:
@@ -124,10 +135,16 @@ export const VersionHistoryPanel = ({
         toast.success(t('versionHistory.action.copyIdSuccess', { ns: 'workflow' }))
         break
       case VersionHistoryContextMenuOptions.exportDSL:
+        if (!canUseWorkflowVersionAction) {
+          setIsRestorePlanUpgradeModalOpen(true)
+          break
+        }
+        if (!canImportExportDSL)
+          return
         handleExportDSL?.(false, item.id)
         break
     }
-  }, [t, handleExportDSL])
+  }, [canUseWorkflowVersionAction, canImportExportDSL, t, handleExportDSL])
 
   const handleCancel = useCallback((operation: VersionHistoryContextMenuOptions) => {
     switch (operation) {
@@ -293,6 +310,7 @@ export const VersionHistoryPanel = ({
                           latestVersionId={latestVersionId || ''}
                           onClick={handleVersionClick}
                           handleClickActionMenuItem={handleClickActionMenuItem.bind(null, item)}
+                          canImportExportDSL={canImportExportDSL}
                           isLast={isLast}
                         />
                       )
@@ -330,6 +348,14 @@ export const VersionHistoryPanel = ({
           onRestore={handleRestore}
         />
       )}
+      {isRestorePlanUpgradeModalOpen && (
+        <PlanUpgradeModal
+          show
+          onClose={() => setIsRestorePlanUpgradeModalOpen(false)}
+          title={t('upgrade.workflowRestore.title', { ns: 'billing' })!}
+          description={t('upgrade.workflowRestore.description', { ns: 'billing' })!}
+        />
+      )}
       {deleteConfirmOpen && (
         <DeleteConfirmModal
           isOpen={deleteConfirmOpen}
diff --git a/web/app/components/workflow/panel/version-history-panel/version-history-item.tsx b/web/app/components/workflow/panel/version-history-panel/version-history-item.tsx
index efc1dfe1ecc..e0c19ee589d 100644
--- a/web/app/components/workflow/panel/version-history-panel/version-history-item.tsx
+++ b/web/app/components/workflow/panel/version-history-panel/version-history-item.tsx
@@ -14,7 +14,9 @@ type VersionHistoryItemProps = {
   latestVersionId: string
   onClick: (item: VersionHistory) => void
   handleClickActionMenuItem: (operation: VersionHistoryContextMenuOptions) => void
+  canImportExportDSL: boolean
   isLast: boolean
+  hideActionMenu?: boolean
 }
 
 const formatVersion = (versionHistory: VersionHistory, latestVersionId: string): string => {
@@ -42,7 +44,9 @@ const VersionHistoryItem: React.FC<VersionHistoryItemProps> = ({
   latestVersionId,
   onClick,
   handleClickActionMenuItem,
+  canImportExportDSL,
   isLast,
+  hideActionMenu,
 }) => {
   const { t } = useTranslation()
   const [isHovering, setIsHovering] = useState(false)
@@ -78,6 +82,9 @@ const VersionHistoryItem: React.FC<VersionHistoryItemProps> = ({
         setOpen(false)
       }}
       onContextMenu={(e) => {
+        if (hideActionMenu)
+          return
+
         e.preventDefault()
         setOpen(true)
       }}
@@ -123,11 +130,12 @@ const VersionHistoryItem: React.FC<VersionHistoryItemProps> = ({
         }
       </div>
       {/* Action Menu */}
-      {!isDraft && isHovering && (
+      {!hideActionMenu && !isDraft && isHovering && (
         <div className="absolute top-1 right-1">
           <ActionMenu
             isShowDelete={!isLatest}
             isNamedVersion={!!item.marked_name}
+            canImportExportDSL={canImportExportDSL}
             open={open}
             setOpen={setOpen}
             handleClickActionMenuItem={handleClickActionMenuItem}
diff --git a/web/app/components/workflow/persistence/local-storage-bridge.tsx b/web/app/components/workflow/persistence/local-storage-bridge.tsx
index 437917162e1..31031e5348b 100644
--- a/web/app/components/workflow/persistence/local-storage-bridge.tsx
+++ b/web/app/components/workflow/persistence/local-storage-bridge.tsx
@@ -1,15 +1,12 @@
-import { useLocalStorage, useSetLocalStorage } from 'foxact/use-local-storage'
 import { useEffect, useLayoutEffect as useLayoutEffectFromReact } from 'react'
 import { useStore, useWorkflowStore } from '../store'
 import {
   isControlMode,
   isFiniteNumber,
-  numberStorageOptions,
-  rawStorageOptions,
-  WORKFLOW_NODE_PANEL_WIDTH_KEY,
-  WORKFLOW_OPERATION_MODE_KEY,
-  WORKFLOW_PREVIEW_PANEL_WIDTH_KEY,
-  WORKFLOW_VARIABLE_INSPECT_PANEL_HEIGHT_KEY,
+  useDebugPreviewPanelWidthValue,
+  useWorkflowNodePanelWidthValue,
+  useWorkflowOperationMode,
+  useWorkflowVariableInspectPanelHeightValue,
 } from './local-storage-options'
 
 const useIsoLayoutEffect = typeof document !== 'undefined'
@@ -17,10 +14,10 @@ const useIsoLayoutEffect = typeof document !== 'undefined'
   : useEffect
 
 export const WorkflowLocalStorageBridge = () => {
-  const [storedNodePanelWidth] = useLocalStorage<number>(WORKFLOW_NODE_PANEL_WIDTH_KEY, undefined, numberStorageOptions)
-  const [storedPreviewPanelWidth] = useLocalStorage<number>(WORKFLOW_PREVIEW_PANEL_WIDTH_KEY, undefined, numberStorageOptions)
-  const [storedVariableInspectPanelHeight] = useLocalStorage<number>(WORKFLOW_VARIABLE_INSPECT_PANEL_HEIGHT_KEY, undefined, numberStorageOptions)
-  const [storedControlMode] = useLocalStorage<string>(WORKFLOW_OPERATION_MODE_KEY, undefined, rawStorageOptions)
+  const storedNodePanelWidth = useWorkflowNodePanelWidthValue()
+  const storedPreviewPanelWidth = useDebugPreviewPanelWidthValue()
+  const storedVariableInspectPanelHeight = useWorkflowVariableInspectPanelHeightValue()
+  const [storedControlMode, setControlModeStorage] = useWorkflowOperationMode()
 
   const workflowStore = useWorkflowStore()
   const setNodePanelWidth = useStore(state => state.setNodePanelWidth)
@@ -29,8 +26,6 @@ export const WorkflowLocalStorageBridge = () => {
   const setVariableInspectPanelHeight = useStore(state => state.setVariableInspectPanelHeight)
   const setControlMode = useStore(state => state.setControlMode)
 
-  const setControlModeStorage = useSetLocalStorage<string>(WORKFLOW_OPERATION_MODE_KEY, rawStorageOptions)
-
   useIsoLayoutEffect(() => {
     if (!isFiniteNumber(storedNodePanelWidth))
       return
diff --git a/web/app/components/workflow/persistence/local-storage-options.ts b/web/app/components/workflow/persistence/local-storage-options.ts
index af953f8287e..1cf90d806f0 100644
--- a/web/app/components/workflow/persistence/local-storage-options.ts
+++ b/web/app/components/workflow/persistence/local-storage-options.ts
@@ -1,12 +1,14 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+import { NOTE_SHOW_AUTHOR_STORAGE_KEY } from '../note-node/constants'
 import { ControlMode } from '../types'
 
-export const WORKFLOW_NODE_PANEL_WIDTH_KEY = 'workflow-node-panel-width'
-export const WORKFLOW_PREVIEW_PANEL_WIDTH_KEY = 'debug-and-preview-panel-width'
-export const WORKFLOW_VARIABLE_INSPECT_PANEL_HEIGHT_KEY = 'workflow-variable-inpsect-panel-height'
-export const WORKFLOW_OPERATION_MODE_KEY = 'workflow-operation-mode'
+const WORKFLOW_NODE_PANEL_WIDTH_KEY = 'workflow-node-panel-width'
+const WORKFLOW_PREVIEW_PANEL_WIDTH_KEY = 'debug-and-preview-panel-width'
+const WORKFLOW_VARIABLE_INSPECT_PANEL_HEIGHT_KEY = 'workflow-variable-inpsect-panel-height'
+const WORKFLOW_OPERATION_MODE_KEY = 'workflow-operation-mode'
 
-export const rawStorageOptions = { raw: true } as const
-export const numberStorageOptions = {
+const rawStorageOptions = { raw: true } as const
+const numberStorageOptions = {
   serializer: String,
   deserializer: Number,
 } as const
@@ -18,3 +20,45 @@ export const isControlMode = (value: string | null): value is ControlMode => {
 export const isFiniteNumber = (value: number | null): value is number => {
   return value !== null && Number.isFinite(value)
 }
+
+const [
+  _useWorkflowNodePanelWidth,
+  useWorkflowNodePanelWidthValue,
+  useSetWorkflowNodePanelWidth,
+] = createLocalStorageState<number>(WORKFLOW_NODE_PANEL_WIDTH_KEY, undefined, numberStorageOptions)
+
+const [
+  _useDebugPreviewPanelWidth,
+  useDebugPreviewPanelWidthValue,
+  useSetDebugPreviewPanelWidth,
+] = createLocalStorageState<number>(WORKFLOW_PREVIEW_PANEL_WIDTH_KEY, undefined, numberStorageOptions)
+
+const [
+  _useWorkflowVariableInspectPanelHeight,
+  useWorkflowVariableInspectPanelHeightValue,
+  useSetWorkflowVariableInspectPanelHeight,
+] = createLocalStorageState<number>(WORKFLOW_VARIABLE_INSPECT_PANEL_HEIGHT_KEY, undefined, numberStorageOptions)
+
+const [
+  useWorkflowOperationMode,
+  _useWorkflowOperationModeValue,
+  _useSetWorkflowOperationMode,
+] = createLocalStorageState<string>(WORKFLOW_OPERATION_MODE_KEY, undefined, rawStorageOptions)
+
+const [
+  _useWorkflowNoteShowAuthor,
+  useWorkflowNoteShowAuthorValue,
+  useSetWorkflowNoteShowAuthor,
+] = createLocalStorageState<string>(NOTE_SHOW_AUTHOR_STORAGE_KEY, 'true', rawStorageOptions)
+
+export {
+  useDebugPreviewPanelWidthValue,
+  useSetDebugPreviewPanelWidth,
+  useSetWorkflowNodePanelWidth,
+  useSetWorkflowNoteShowAuthor,
+  useSetWorkflowVariableInspectPanelHeight,
+  useWorkflowNodePanelWidthValue,
+  useWorkflowNoteShowAuthorValue,
+  useWorkflowOperationMode,
+  useWorkflowVariableInspectPanelHeightValue,
+}
diff --git a/web/app/components/workflow/run/__tests__/result-panel.spec.tsx b/web/app/components/workflow/run/__tests__/result-panel.spec.tsx
index ea8606d74ee..2f3ec0610ff 100644
--- a/web/app/components/workflow/run/__tests__/result-panel.spec.tsx
+++ b/web/app/components/workflow/run/__tests__/result-panel.spec.tsx
@@ -98,7 +98,7 @@ vi.mock('@/app/components/workflow/run/retry-log', () => ({
   },
 }))
 
-vi.mock('@/app/components/workflow/run/agent-log', () => ({
+vi.mock('@/app/components/workflow/run/agent-log/agent-log-trigger', () => ({
   AgentLogTrigger: (props: {
     onShowAgentOrToolLog: (detail: unknown) => void
     nodeInfo: { agentLog?: unknown }
@@ -327,6 +327,19 @@ describe('ResultPanel', () => {
     fireEvent.click(screen.getByRole('button', { name: 'agent-trigger' }))
     expect(handleShowAgentOrToolLog).toHaveBeenCalledWith(agentLog)
 
+    rerender(
+      <ResultPanel
+        nodeInfo={createNodeInfo({
+          node_type: BlockEnum.AgentV2,
+          agentLog,
+        })}
+        status={NodeRunningStatus.Succeeded}
+        handleShowAgentOrToolLog={handleShowAgentOrToolLog}
+      />,
+    )
+
+    expect(screen.queryByRole('button', { name: 'agent-trigger' })).not.toBeInTheDocument()
+
     rerender(
       <ResultPanel
         nodeInfo={createNodeInfo({
diff --git a/web/app/components/workflow/run/__tests__/special-result-panel.spec.tsx b/web/app/components/workflow/run/__tests__/special-result-panel.spec.tsx
index 8e09cf6741a..459ddf1d86e 100644
--- a/web/app/components/workflow/run/__tests__/special-result-panel.spec.tsx
+++ b/web/app/components/workflow/run/__tests__/special-result-panel.spec.tsx
@@ -31,8 +31,8 @@ vi.mock('../loop-log', () => ({
   },
 }))
 
-vi.mock('../agent-log', () => ({
-  AgentResultPanel: ({ agentOrToolLogItemStack }: { agentOrToolLogItemStack: AgentLogItemWithChildren[] }) => {
+vi.mock('../agent-log/agent-result-panel', () => ({
+  default: ({ agentOrToolLogItemStack }: { agentOrToolLogItemStack: AgentLogItemWithChildren[] }) => {
     mocks.agentPanel(agentOrToolLogItemStack)
     return <div data-testid="agent-result-panel">{agentOrToolLogItemStack.length}</div>
   },
diff --git a/web/app/components/workflow/run/agent-log/__tests__/agent-log-item.spec.tsx b/web/app/components/workflow/run/agent-log/__tests__/agent-log-item.spec.tsx
index d444eb6c627..50ac08b682c 100644
--- a/web/app/components/workflow/run/agent-log/__tests__/agent-log-item.spec.tsx
+++ b/web/app/components/workflow/run/agent-log/__tests__/agent-log-item.spec.tsx
@@ -41,6 +41,7 @@ const createAppContextValue = (): AppContextValue => {
     langGeniusVersionInfo: initialLangGeniusVersionInfo,
     isLoadingCurrentWorkspace: false,
     isValidatingCurrentWorkspace: false,
+    workspacePermissionKeys: [],
   }
   const useSelector: AppContextValue['useSelector'] = selector => selector(value)
   value = {
diff --git a/web/app/components/workflow/run/agent-log/__tests__/agent-log-nav.spec.tsx b/web/app/components/workflow/run/agent-log/__tests__/agent-log-nav.spec.tsx
index 43ee728eda9..bc66598e746 100644
--- a/web/app/components/workflow/run/agent-log/__tests__/agent-log-nav.spec.tsx
+++ b/web/app/components/workflow/run/agent-log/__tests__/agent-log-nav.spec.tsx
@@ -1,7 +1,7 @@
 import type { AgentLogItemWithChildren } from '@/types/workflow'
 import { render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import AgentLogNav from '../agent-log-nav'
+import { AgentLogNav } from '../agent-log-nav'
 
 const createLogItem = (overrides: Partial<AgentLogItemWithChildren> = {}): AgentLogItemWithChildren => ({
   message_id: 'message-1',
diff --git a/web/app/components/workflow/run/agent-log/__tests__/agent-log-trigger.spec.tsx b/web/app/components/workflow/run/agent-log/__tests__/agent-log-trigger.spec.tsx
index 29919e4ccfe..d6d6c8d499c 100644
--- a/web/app/components/workflow/run/agent-log/__tests__/agent-log-trigger.spec.tsx
+++ b/web/app/components/workflow/run/agent-log/__tests__/agent-log-trigger.spec.tsx
@@ -2,7 +2,7 @@ import type { AgentLogItemWithChildren, NodeTracing } from '@/types/workflow'
 import { render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { BlockEnum } from '../../../types'
-import AgentLogTrigger from '../agent-log-trigger'
+import { AgentLogTrigger } from '../agent-log-trigger'
 
 const createAgentLogItem = (overrides: Partial<AgentLogItemWithChildren> = {}): AgentLogItemWithChildren => ({
   node_execution_id: 'exec-1',
@@ -63,7 +63,7 @@ describe('AgentLogTrigger', () => {
 
   // Agent triggers should expose strategy text and open the log stack payload.
   describe('User Interactions', () => {
-    it('should show the agent strategy and pass the log payload on click', async () => {
+    it('should show the legacy agent strategy and pass the log payload on click', async () => {
       const user = userEvent.setup()
       const onShowAgentOrToolLog = vi.fn()
       const agentLog = [createAgentLogItem({ message_id: 'message-1' })]
@@ -87,7 +87,7 @@ describe('AgentLogTrigger', () => {
       })
     })
 
-    it('should still open the detail view when no strategy label is available', async () => {
+    it('should open the detail view when execution metadata is unavailable', async () => {
       const user = userEvent.setup()
       const onShowAgentOrToolLog = vi.fn()
 
diff --git a/web/app/components/workflow/run/agent-log/__tests__/agent-result-panel.spec.tsx b/web/app/components/workflow/run/agent-log/__tests__/agent-result-panel.spec.tsx
index 8cd7d349f65..7953bfc52a1 100644
--- a/web/app/components/workflow/run/agent-log/__tests__/agent-result-panel.spec.tsx
+++ b/web/app/components/workflow/run/agent-log/__tests__/agent-result-panel.spec.tsx
@@ -38,6 +38,7 @@ const createAppContextValue = (): AppContextValue => {
     langGeniusVersionInfo: initialLangGeniusVersionInfo,
     isLoadingCurrentWorkspace: false,
     isValidatingCurrentWorkspace: false,
+    workspacePermissionKeys: [],
   }
   const useSelector: AppContextValue['useSelector'] = selector => selector(value)
   value = {
diff --git a/web/app/components/workflow/run/agent-log/agent-log-nav.tsx b/web/app/components/workflow/run/agent-log/agent-log-nav.tsx
index 2db450aee00..fc95c861f95 100644
--- a/web/app/components/workflow/run/agent-log/agent-log-nav.tsx
+++ b/web/app/components/workflow/run/agent-log/agent-log-nav.tsx
@@ -1,6 +1,5 @@
 import type { AgentLogItemWithChildren } from '@/types/workflow'
 import { Button } from '@langgenius/dify-ui/button'
-import { RiArrowLeftLine } from '@remixicon/react'
 import { useTranslation } from 'react-i18next'
 import AgentLogNavMore from './agent-log-nav-more'
 
@@ -8,10 +7,10 @@ type AgentLogNavProps = {
   agentOrToolLogItemStack: AgentLogItemWithChildren[]
   onShowAgentOrToolLog: (detail?: AgentLogItemWithChildren) => void
 }
-const AgentLogNav = ({
+export function AgentLogNav({
   agentOrToolLogItemStack,
   onShowAgentOrToolLog,
-}: AgentLogNavProps) => {
+}: AgentLogNavProps) {
   const { t } = useTranslation()
   const agentOrToolLogItemStackLength = agentOrToolLogItemStack.length
   const first = agentOrToolLogItemStack[0]
@@ -28,7 +27,7 @@ const AgentLogNav = ({
           onShowAgentOrToolLog()
         }}
       >
-        <RiArrowLeftLine className="mr-1 size-3.5" />
+        <span aria-hidden className="mr-1 i-ri-arrow-left-line size-3.5" />
         AGENT
       </Button>
       <div className="mx-0.5 shrink-0 system-xs-regular text-divider-deep">/</div>
@@ -45,7 +44,7 @@ const AgentLogNav = ({
               </Button>
             )
           : (
-              <div className="flex items-center px-[5px] system-xs-medium-uppercase text-text-tertiary">
+              <div className="flex items-center px-1.25 system-xs-medium-uppercase text-text-tertiary">
                 {t('nodes.agent.strategy.label', { ns: 'workflow' })}
               </div>
             )
@@ -74,5 +73,3 @@ const AgentLogNav = ({
     </div>
   )
 }
-
-export default AgentLogNav
diff --git a/web/app/components/workflow/run/agent-log/agent-log-trigger.tsx b/web/app/components/workflow/run/agent-log/agent-log-trigger.tsx
index e1b1983050d..41a44eb67b6 100644
--- a/web/app/components/workflow/run/agent-log/agent-log-trigger.tsx
+++ b/web/app/components/workflow/run/agent-log/agent-log-trigger.tsx
@@ -2,24 +2,24 @@ import type {
   AgentLogItemWithChildren,
   NodeTracing,
 } from '@/types/workflow'
-import { RiArrowRightLine } from '@remixicon/react'
 import { useTranslation } from 'react-i18next'
 
 type AgentLogTriggerProps = {
   nodeInfo: NodeTracing
   onShowAgentOrToolLog: (detail?: AgentLogItemWithChildren) => void
 }
-const AgentLogTrigger = ({
+export function AgentLogTrigger({
   nodeInfo,
   onShowAgentOrToolLog,
-}: AgentLogTriggerProps) => {
+}: AgentLogTriggerProps) {
   const { t } = useTranslation()
   const { agentLog, execution_metadata } = nodeInfo
   const agentStrategy = execution_metadata?.tool_info?.agent_strategy
 
   return (
-    <div
-      className="cursor-pointer rounded-[10px] bg-components-button-tertiary-bg"
+    <button
+      type="button"
+      className="w-full cursor-pointer rounded-[10px] bg-components-button-tertiary-bg text-left focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
       onClick={() => {
         onShowAgentOrToolLog({ message_id: nodeInfo.id, children: agentLog || [] } as AgentLogItemWithChildren)
       }}
@@ -28,22 +28,20 @@ const AgentLogTrigger = ({
         {t('nodes.agent.strategy.label', { ns: 'workflow' })}
       </div>
       <div className="flex items-center pt-1 pr-2 pb-1.5 pl-3">
-        {
-          agentStrategy && (
-            <div className="grow system-xs-medium text-text-secondary">
-              {agentStrategy}
-            </div>
-          )
-        }
+        {agentStrategy
+          ? (
+              <div className="grow system-xs-medium text-text-secondary">
+                {agentStrategy}
+              </div>
+            )
+          : <div className="grow" />}
         <div
           className="flex shrink-0 cursor-pointer items-center px-px system-xs-regular-uppercase text-text-tertiary"
         >
           {t('detail', { ns: 'runLog' })}
-          <RiArrowRightLine className="ml-0.5 size-3.5" />
+          <span aria-hidden className="ml-0.5 i-ri-arrow-right-line size-3.5" />
         </div>
       </div>
-    </div>
+    </button>
   )
 }
-
-export default AgentLogTrigger
diff --git a/web/app/components/workflow/run/agent-log/agent-result-panel.tsx b/web/app/components/workflow/run/agent-log/agent-result-panel.tsx
index 1ea8082276a..29520c344a9 100644
--- a/web/app/components/workflow/run/agent-log/agent-result-panel.tsx
+++ b/web/app/components/workflow/run/agent-log/agent-result-panel.tsx
@@ -1,8 +1,7 @@
 import type { AgentLogItemWithChildren } from '@/types/workflow'
-import { RiAlertFill } from '@remixicon/react'
 import { useTranslation } from 'react-i18next'
 import AgentLogItem from './agent-log-item'
-import AgentLogNav from './agent-log-nav'
+import { AgentLogNav } from './agent-log-nav'
 
 type AgentResultPanelProps = {
   agentOrToolLogItemStack: AgentLogItemWithChildren[]
@@ -45,7 +44,7 @@ const AgentResultPanel = ({
               }}
             >
             </div>
-            <RiAlertFill className="mr-1.5 size-4 text-text-warning-secondary" />
+            <span aria-hidden className="mr-1.5 i-ri-alert-fill size-4 text-text-warning-secondary" />
             <div className="system-xs-medium text-text-primary">
               {t('circularInvocationTip', { ns: 'runLog' })}
             </div>
diff --git a/web/app/components/workflow/run/agent-log/index.tsx b/web/app/components/workflow/run/agent-log/index.tsx
deleted file mode 100644
index a39f5416bb4..00000000000
--- a/web/app/components/workflow/run/agent-log/index.tsx
+++ /dev/null
@@ -1,2 +0,0 @@
-export { default as AgentLogTrigger } from './agent-log-trigger'
-export { default as AgentResultPanel } from './agent-result-panel'
diff --git a/web/app/components/workflow/run/node.tsx b/web/app/components/workflow/run/node.tsx
index 75f57a6a961..275022323a0 100644
--- a/web/app/components/workflow/run/node.tsx
+++ b/web/app/components/workflow/run/node.tsx
@@ -28,7 +28,7 @@ import { useDocLink } from '@/context/i18n'
 import BlockIcon from '../block-icon'
 import { BlockEnum } from '../types'
 import LargeDataAlert from '../variable-inspect/large-data-alert'
-import { AgentLogTrigger } from './agent-log'
+import { AgentLogTrigger } from './agent-log/agent-log-trigger'
 import { IterationLogTrigger } from './iteration-log'
 import { LoopLogTrigger } from './loop-log'
 import { RetryLogTrigger } from './retry-log'
diff --git a/web/app/components/workflow/run/result-panel.tsx b/web/app/components/workflow/run/result-panel.tsx
index 699aceae781..37f2101fc92 100644
--- a/web/app/components/workflow/run/result-panel.tsx
+++ b/web/app/components/workflow/run/result-panel.tsx
@@ -8,7 +8,7 @@ import { useTranslation } from 'react-i18next'
 import CodeEditor from '@/app/components/workflow/nodes/_base/components/editor/code-editor'
 import ErrorHandleTip from '@/app/components/workflow/nodes/_base/components/error-handle/error-handle-tip'
 import { CodeLanguage } from '@/app/components/workflow/nodes/code/types'
-import { AgentLogTrigger } from '@/app/components/workflow/run/agent-log'
+import { AgentLogTrigger } from '@/app/components/workflow/run/agent-log/agent-log-trigger'
 import { IterationLogTrigger } from '@/app/components/workflow/run/iteration-log'
 import { LoopLogTrigger } from '@/app/components/workflow/run/loop-log'
 import { RetryLogTrigger } from '@/app/components/workflow/run/retry-log'
diff --git a/web/app/components/workflow/run/special-result-panel.tsx b/web/app/components/workflow/run/special-result-panel.tsx
index 34a9e2fb37a..94ce26e79c3 100644
--- a/web/app/components/workflow/run/special-result-panel.tsx
+++ b/web/app/components/workflow/run/special-result-panel.tsx
@@ -5,7 +5,7 @@ import type {
   LoopVariableMap,
   NodeTracing,
 } from '@/types/workflow'
-import { AgentResultPanel } from './agent-log'
+import AgentResultPanel from './agent-log/agent-result-panel'
 import { IterationResultPanel } from './iteration-log'
 import { LoopResultPanel } from './loop-log'
 import { RetryResultPanel } from './retry-log'
diff --git a/web/app/components/workflow/selection-contextmenu.tsx b/web/app/components/workflow/selection-contextmenu.tsx
index 2470d5e1b65..dffbd31a5e1 100644
--- a/web/app/components/workflow/selection-contextmenu.tsx
+++ b/web/app/components/workflow/selection-contextmenu.tsx
@@ -13,7 +13,9 @@ import {
 import { useTranslation } from 'react-i18next'
 import { useStore as useReactFlowStore } from 'reactflow'
 import { useCreateSnippetFromSelection } from '@/app/components/snippets/hooks/use-create-snippet-from-selection'
+import { canCreateAndModifySnippets } from '@/app/components/snippets/utils/permission'
 import { useCollaborativeWorkflow } from '@/app/components/workflow/hooks/use-collaborative-workflow'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useNodesInteractions, useNodesReadOnly, useNodesSyncDraft } from './hooks'
 import { useWorkflowHistory, WorkflowHistoryEvent } from './hooks/use-workflow-history'
 import { ShortcutKbd } from './shortcuts/shortcut-kbd'
@@ -233,6 +235,7 @@ export function SelectionContextmenu({
 }) {
   const { t } = useTranslation()
   const { getNodesReadOnly } = useNodesReadOnly()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const { handleNodesCopy, handleNodesDelete, handleNodesDuplicate } = useNodesInteractions()
   const isSelectionContextMenu = useStore(s => s.contextMenuTarget?.type === 'selection')
 
@@ -256,7 +259,8 @@ export function SelectionContextmenu({
     selectedNodes,
     onClose,
   })
-  const canCreateSnippet = selectedNodes.every(node => !unsupportedSnippetNodeTypes.has(node.data.type))
+  const canCreateSnippet = canCreateAndModifySnippets(workspacePermissionKeys)
+    && selectedNodes.every(node => !unsupportedSnippetNodeTypes.has(node.data.type))
 
   const handleCopyNodes = useCallback(() => {
     handleNodesCopy()
diff --git a/web/app/components/workflow/store/workflow/__tests__/node-slice.spec.ts b/web/app/components/workflow/store/workflow/__tests__/node-slice.spec.ts
index b81d793504e..87528bf6f7a 100644
--- a/web/app/components/workflow/store/workflow/__tests__/node-slice.spec.ts
+++ b/web/app/components/workflow/store/workflow/__tests__/node-slice.spec.ts
@@ -9,6 +9,7 @@ describe('createNodeSlice', () => {
     expect(store.getState().iterTimes).toBe(1)
     expect(store.getState().loopTimes).toBe(1)
     expect(store.getState().iterParallelLogMap.size).toBe(0)
+    expect(store.getState().openInlineAgentPanelNodeId).toBeUndefined()
 
     store.getState().setConnectingNodePayload({
       nodeId: 'node-1',
@@ -20,6 +21,7 @@ describe('createNodeSlice', () => {
       nodeId: 'node-1',
       action: 'run',
     })
+    store.getState().setOpenInlineAgentPanelNodeId('agent-node-1')
 
     expect(store.getState().connectingNodePayload).toEqual({
       nodeId: 'node-1',
@@ -31,5 +33,6 @@ describe('createNodeSlice', () => {
       nodeId: 'node-1',
       action: 'run',
     })
+    expect(store.getState().openInlineAgentPanelNodeId).toBe('agent-node-1')
   })
 })
diff --git a/web/app/components/workflow/store/workflow/node-slice.ts b/web/app/components/workflow/store/workflow/node-slice.ts
index be8580eae5a..31f5231c715 100644
--- a/web/app/components/workflow/store/workflow/node-slice.ts
+++ b/web/app/components/workflow/store/workflow/node-slice.ts
@@ -18,6 +18,8 @@ export type NodeSliceShape = {
   setNodeAnimation: (nodeAnimation: boolean) => void
   candidateNode?: Node
   setCandidateNode: (candidateNode?: Node) => void
+  openInlineAgentPanelNodeId?: string
+  setOpenInlineAgentPanelNodeId: (nodeId?: string) => void
   showAssignVariablePopup?: {
     nodeId: string
     nodeData: Node['data']
@@ -59,6 +61,8 @@ export const createNodeSlice: StateCreator<NodeSliceShape> = set => ({
   setNodeAnimation: nodeAnimation => set(() => ({ nodeAnimation })),
   candidateNode: undefined,
   setCandidateNode: candidateNode => set(() => ({ candidateNode })),
+  openInlineAgentPanelNodeId: undefined,
+  setOpenInlineAgentPanelNodeId: nodeId => set(() => ({ openInlineAgentPanelNodeId: nodeId })),
   showAssignVariablePopup: undefined,
   setShowAssignVariablePopup: showAssignVariablePopup => set(() => ({ showAssignVariablePopup })),
   hoveringAssignVariableGroupId: undefined,
diff --git a/web/app/components/workflow/types.ts b/web/app/components/workflow/types.ts
index 8835d3e45b2..b122a0666d7 100644
--- a/web/app/components/workflow/types.ts
+++ b/web/app/components/workflow/types.ts
@@ -6,7 +6,7 @@ import type {
 } from 'reactflow'
 import type { Plugin, PluginMeta } from '@/app/components/plugins/types'
 import type { Collection, Tool } from '@/app/components/tools/types'
-import type { BlockClassificationEnum, PluginDefaultValue } from '@/app/components/workflow/block-selector/types'
+import type { BlockClassificationEnum, BlockDefaultValue, PluginDefaultValue } from '@/app/components/workflow/block-selector/types'
 import type {
   DefaultValueForm,
   ErrorHandleTypeEnum,
@@ -47,6 +47,7 @@ export enum BlockEnum {
   IterationStart = 'iteration-start',
   Assigner = 'assigner', // is now named as VariableAssigner
   Agent = 'agent',
+  AgentV2 = 'agent-v2',
   Loop = 'loop',
   LoopStart = 'loop-start',
   LoopEnd = 'loop-end',
@@ -94,6 +95,7 @@ export type CommonNodeType<T = {}> = {
   _retryIndex?: number
   _dataSourceStartToAdd?: boolean
   _isTempNode?: boolean
+  _openInlineAgentPanel?: boolean
   isInIteration?: boolean
   iteration_id?: string
   selected?: boolean
@@ -344,7 +346,7 @@ export type NodeDefault<T = {}> = {
   }) => Var[]
 }
 
-export type OnSelectBlock = (type: BlockEnum, pluginDefaultValue?: PluginDefaultValue) => void
+export type OnSelectBlock = (type: BlockEnum, defaultValue?: BlockDefaultValue) => void
 
 export enum WorkflowRunningStatus {
   Waiting = 'waiting',
@@ -378,7 +380,7 @@ export type OnNodeAdd = (
     nodeType: BlockEnum
     sourceHandle?: string
     targetHandle?: string
-    pluginDefaultValue?: PluginDefaultValue
+    pluginDefaultValue?: BlockDefaultValue
   },
   oldNodesPayload: {
     prevNodeId?: string
diff --git a/web/app/components/workflow/utils/__tests__/node.spec.ts b/web/app/components/workflow/utils/__tests__/node.spec.ts
index 19f3a1614a1..28f19939eb8 100644
--- a/web/app/components/workflow/utils/__tests__/node.spec.ts
+++ b/web/app/components/workflow/utils/__tests__/node.spec.ts
@@ -12,11 +12,38 @@ import {
   getIterationStartNode,
   getLoopStartNode,
   getNestedNodePosition,
+  getNodeCatalogType,
   getNodeCustomTypeByNodeDataType,
   getTopLeftNodePosition,
   hasRetryNode,
 } from '../node'
 
+describe('getNodeCatalogType', () => {
+  it('should use Agent V2 catalog type for graph agent nodes with the Agent V2 discriminator', () => {
+    expect(getNodeCatalogType({
+      title: 'Agent',
+      desc: '',
+      type: BlockEnum.Agent,
+      agent_node_kind: 'dify_agent',
+      version: '2',
+    } as CommonNodeType)).toBe(BlockEnum.AgentV2)
+  })
+
+  it('should keep the graph node type for regular nodes and legacy Agent nodes', () => {
+    expect(getNodeCatalogType({
+      title: 'Code',
+      desc: '',
+      type: BlockEnum.Code,
+    })).toBe(BlockEnum.Code)
+
+    expect(getNodeCatalogType({
+      title: 'Agent',
+      desc: '',
+      type: BlockEnum.Agent,
+    })).toBe(BlockEnum.Agent)
+  })
+})
+
 describe('generateNewNode', () => {
   it('should create a basic node with default CUSTOM_NODE type', () => {
     const { newNode } = generateNewNode({
diff --git a/web/app/components/workflow/utils/common.ts b/web/app/components/workflow/utils/common.ts
index 0f5dacf3f28..a850e1cb6c6 100644
--- a/web/app/components/workflow/utils/common.ts
+++ b/web/app/components/workflow/utils/common.ts
@@ -4,7 +4,7 @@
  * @param fallbackText - Text to show when finishedAt is not available (default: 'Running')
  * @returns Formatted string like " (14:30:25)" or " (Running)"
  */
-export const formatWorkflowRunIdentifier = (finishedAt?: number, fallbackText = 'Running'): string => {
+export function formatWorkflowRunIdentifier(finishedAt?: number, fallbackText = 'Running'): string {
   if (!finishedAt) {
     const capitalized = fallbackText.charAt(0).toUpperCase() + fallbackText.slice(1)
     return ` (${capitalized})`
diff --git a/web/app/components/workflow/utils/node.ts b/web/app/components/workflow/utils/node.ts
index d6163ea1c83..d319b020058 100644
--- a/web/app/components/workflow/utils/node.ts
+++ b/web/app/components/workflow/utils/node.ts
@@ -1,6 +1,7 @@
 import type { IterationNodeType } from '../nodes/iteration/types'
 import type { LoopNodeType } from '../nodes/loop/types'
 import type {
+  CommonNodeType,
   Node,
 } from '../types'
 import {
@@ -14,12 +15,17 @@ import {
   LOOP_CHILDREN_Z_INDEX,
   LOOP_NODE_Z_INDEX,
 } from '../constants'
+import { isAgentV2NodeData } from '../nodes/agent-v2/types'
 import { CUSTOM_ITERATION_START_NODE } from '../nodes/iteration-start/constants'
 import { CUSTOM_LOOP_START_NODE } from '../nodes/loop-start/constants'
 import {
   BlockEnum,
 } from '../types'
 
+export function getNodeCatalogType(data: CommonNodeType): BlockEnum {
+  return isAgentV2NodeData(data) ? BlockEnum.AgentV2 : data.type
+}
+
 export function generateNewNode({ data, position, id, zIndex, type, ...rest }: Omit<Node, 'id'> & { id?: string }): {
   newNode: Node
   newIterationStartNode?: Node
@@ -142,6 +148,26 @@ export const getNestedNodePosition = (node: Node, parentNode: Node) => {
   }
 }
 
+export const getNodesWithSameDefaultDataType = (
+  nodes: Node[],
+  nodeType: BlockEnum,
+  defaultValue: Partial<Node['data']>,
+) => {
+  const dataType = (defaultValue.type as BlockEnum | undefined) ?? nodeType
+  const discriminatorEntries = (['agent_node_kind', 'version'] as const)
+    .map(key => [key, (defaultValue as Record<string, unknown>)[key]] as const)
+    .filter(([, value]) => value !== undefined)
+
+  if (dataType !== nodeType && discriminatorEntries.length > 0) {
+    return nodes.filter(node =>
+      node.data.type === dataType
+      && discriminatorEntries.every(([key, value]) => (node.data as Record<string, unknown>)[key] === value),
+    )
+  }
+
+  return nodes.filter(node => node.data.type === dataType)
+}
+
 export const hasRetryNode = (nodeType?: BlockEnum) => {
   return nodeType === BlockEnum.LLM || nodeType === BlockEnum.Tool || nodeType === BlockEnum.HttpRequest || nodeType === BlockEnum.Code
 }
diff --git a/web/app/components/workflow/utils/workflow.ts b/web/app/components/workflow/utils/workflow.ts
index 0a1de2991eb..f976968feea 100644
--- a/web/app/components/workflow/utils/workflow.ts
+++ b/web/app/components/workflow/utils/workflow.ts
@@ -27,6 +27,7 @@ export const canRunBySingle = (nodeType: BlockEnum, isChildNode: boolean) => {
     || nodeType === BlockEnum.ParameterExtractor
     || nodeType === BlockEnum.Iteration
     || nodeType === BlockEnum.Agent
+    || nodeType === BlockEnum.AgentV2
     || nodeType === BlockEnum.DocExtractor
     || nodeType === BlockEnum.Loop
     || nodeType === BlockEnum.Start
@@ -184,5 +185,5 @@ export const changeNodesAndEdgesId = (nodes: Node[], edges: Edge[]) => {
 }
 
 export const hasErrorHandleNode = (nodeType?: BlockEnum) => {
-  return nodeType === BlockEnum.LLM || nodeType === BlockEnum.Tool || nodeType === BlockEnum.HttpRequest || nodeType === BlockEnum.Code || nodeType === BlockEnum.Agent
+  return nodeType === BlockEnum.LLM || nodeType === BlockEnum.Tool || nodeType === BlockEnum.HttpRequest || nodeType === BlockEnum.Code || nodeType === BlockEnum.Agent || nodeType === BlockEnum.AgentV2
 }
diff --git a/web/app/components/workflow/variable-inspect/index.tsx b/web/app/components/workflow/variable-inspect/index.tsx
index 924ad7d07c0..8d5b500bca6 100644
--- a/web/app/components/workflow/variable-inspect/index.tsx
+++ b/web/app/components/workflow/variable-inspect/index.tsx
@@ -1,12 +1,12 @@
 import type { FC } from 'react'
 import { cn } from '@langgenius/dify-ui/cn'
 import { debounce } from 'es-toolkit/compat'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import {
   useCallback,
   useMemo,
 } from 'react'
 import { useResizePanel } from '../nodes/_base/hooks/use-resize-panel'
+import { useSetWorkflowVariableInspectPanelHeight } from '../persistence/local-storage-options'
 import { useStore } from '../store'
 import Panel from './panel'
 
@@ -22,10 +22,10 @@ const VariableInspectPanel: FC = () => {
     return workflowCanvasHeight - 60
   }, [workflowCanvasHeight])
 
-  const setPanelHeightStorage = useSetLocalStorage<string>('workflow-variable-inpsect-panel-height', { raw: true })
+  const setPanelHeightStorage = useSetWorkflowVariableInspectPanelHeight()
 
   const handleResize = useCallback((width: number, height: number) => {
-    setPanelHeightStorage(`${height}`)
+    setPanelHeightStorage(height)
     setVariableInspectPanelHeight(height)
   }, [setVariableInspectPanelHeight, setPanelHeightStorage])
 
diff --git a/web/app/components/workflow/variable-inspect/right.tsx b/web/app/components/workflow/variable-inspect/right.tsx
index 97768c63949..98a86d089c1 100644
--- a/web/app/components/workflow/variable-inspect/right.tsx
+++ b/web/app/components/workflow/variable-inspect/right.tsx
@@ -111,9 +111,6 @@ const Right = ({
     if (blockType === BlockEnum.LLM)
       return node?.data?.prompt_template?.text || node?.data?.prompt_template?.[0].text
 
-    // if (blockType === BlockEnum.Agent) {
-    //   return node?.data?.agent_parameters?.instruction?.value
-    // }
     if (blockType === BlockEnum.Code)
       return node?.data?.code
   }, [canShowPromptGenerator])
@@ -139,12 +136,6 @@ const Right = ({
           }
           break
 
-        //  Agent is a plugin, may has many instructions, can not locate which one to update
-        // case BlockEnum.Agent:
-        //   if (draft?.agent_parameters?.instruction) {
-        //     draft.agent_parameters.instruction.value = res.modified
-        //   }
-        //   break
         case BlockEnum.Code:
           draft.code = res.modified
           break
diff --git a/web/app/components/workflow/workflow-generator/apply.ts b/web/app/components/workflow/workflow-generator/apply.ts
index a4e77335512..c8946a41cec 100644
--- a/web/app/components/workflow/workflow-generator/apply.ts
+++ b/web/app/components/workflow/workflow-generator/apply.ts
@@ -89,7 +89,7 @@ export const applyToNewApp = async ({
   instruction,
   appName,
   icon,
-}: ApplyToNewAppParams): Promise<{ appId: string, appMode: AppModeEnum }> => {
+}: ApplyToNewAppParams): Promise<{ appId: string, appMode: AppModeEnum, permissionKeys?: string[] }> => {
   const appMode = MODE_TO_APP_MODE[mode]
   const name = (appName ?? '').trim() || deriveAppName(instruction)
   const appIcon = (icon ?? '').trim() || '🤖'
@@ -131,7 +131,7 @@ export const applyToNewApp = async ({
     throw syncErr
   }
 
-  return { appId: app.id, appMode }
+  return { appId: app.id, appMode, permissionKeys: app.permission_keys }
 }
 
 type ApplyToCurrentAppParams = {
diff --git a/web/app/components/workflow/workflow-generator/index.tsx b/web/app/components/workflow/workflow-generator/index.tsx
index e7824ae0d9b..fade26f0482 100644
--- a/web/app/components/workflow/workflow-generator/index.tsx
+++ b/web/app/components/workflow/workflow-generator/index.tsx
@@ -1,7 +1,7 @@
 'use client'
 import type { GeneratedGraph } from './types'
 import type { FormValue } from '@/app/components/header/account-setting/model-provider-page/declarations'
-import type { CompletionParams, Model } from '@/types/app'
+import type { CompletionParams, ModelModeType } from '@/types/app'
 import {
   AlertDialog,
   AlertDialogActions,
@@ -16,7 +16,6 @@ import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
 import { Textarea } from '@langgenius/dify-ui/textarea'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useBoolean } from 'ahooks'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import * as React from 'react'
 import { useCallback, useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -26,19 +25,17 @@ import { ModelTypeEnum } from '@/app/components/header/account-setting/model-pro
 import { useModelListAndDefaultModelAndCurrentProviderAndModel } from '@/app/components/header/account-setting/model-provider-page/hooks'
 import ModelParameterModal from '@/app/components/header/account-setting/model-provider-page/model-parameter-modal'
 import WorkflowPreview from '@/app/components/workflow/workflow-preview'
-import { useAppContext } from '@/context/app-context'
 import { useRouter } from '@/next/navigation'
 import { generateWorkflow } from '@/service/debug'
 import { fetchWorkflowDraft } from '@/service/workflow'
-import { ModelModeType } from '@/types/app'
 import { getRedirectionPath } from '@/utils/app-redirection'
 import { applyToCurrentApp, applyToNewApp, WorkflowApplyHashCollisionError, WorkflowApplyOrphanError } from './apply'
 import ExamplePrompts from './example-prompts'
 import GenerationPhases from './generation-phases'
+import { EMPTY_WORKFLOW_GENERATOR_MODEL, useWorkflowGeneratorModel } from './storage'
 import { useWorkflowGeneratorStore } from './store'
 import useGenGraph from './use-gen-graph'
 
-const STORAGE_MODEL_KEY = 'workflow-gen-model'
 // Hard ceiling before we abort a hung request. Generous on purpose: the
 // backend runs two sequential LLM calls and may retry a transient provider
 // error (bounded backoff) or an unparseable response (one extra call), so a
@@ -49,17 +46,6 @@ const FE_TIMEOUT_MS = 90_000
 // keeping the limit client-side turns an opaque 400 into a visible input stop.
 const MAX_INSTRUCTION_LENGTH = 10_000
 
-// Stable default used both as the SSR/empty-storage seed for the persisted
-// model and as the merge base when patching a partial update. Module-level so
-// the reference stays identical across renders (useLocalStorage uses it as the
-// server value, which must not change identity each render).
-const EMPTY_MODEL: Model = {
-  name: '',
-  provider: '',
-  mode: ModelModeType.chat,
-  completion_params: {} as CompletionParams,
-}
-
 const renderPlaceholder = (label: string) => (
   <div className="flex h-full w-0 grow flex-col items-center justify-center space-y-3 px-8">
     <span className="i-custom-vender-other-generator size-8 text-text-quaternary" />
@@ -111,7 +97,6 @@ const RecoveryDialog = ({ open, onOpenChange, title, description, cancelLabel, c
 const WorkflowGeneratorModal: React.FC = () => {
   const { t } = useTranslation('workflow')
   const router = useRouter()
-  const { isCurrentWorkspaceEditor } = useAppContext()
 
   const isOpen = useWorkflowGeneratorStore(s => s.isOpen)
   const mode = useWorkflowGeneratorStore(s => s.mode)
@@ -122,10 +107,7 @@ const WorkflowGeneratorModal: React.FC = () => {
 
   const isRefine = intent === 'refine' && !!currentAppId
 
-  // Persisted model selection. ``useLocalStorage`` is the storage boundary
-  // mandated for client-only preferences — the empty model is the SSR/seed
-  // value so ``model`` is always a concrete ``Model`` (never null) here.
-  const [model, setModel] = useLocalStorage<Model>(STORAGE_MODEL_KEY, EMPTY_MODEL)
+  const [model, setModel] = useWorkflowGeneratorModel()
 
   const { defaultModel } = useModelListAndDefaultModelAndCurrentProviderAndModel(ModelTypeEnum.textGeneration)
 
@@ -135,7 +117,7 @@ const WorkflowGeneratorModal: React.FC = () => {
   useEffect(() => {
     if (defaultModel && !model.name) {
       setModel(prev => ({
-        ...(prev ?? EMPTY_MODEL),
+        ...(prev ?? EMPTY_WORKFLOW_GENERATOR_MODEL),
         name: defaultModel.model,
         provider: defaultModel.provider.provider,
       }))
@@ -144,7 +126,7 @@ const WorkflowGeneratorModal: React.FC = () => {
 
   const handleModelChange = useCallback((newValue: { modelId: string, provider: string, mode?: string, features?: string[] }) => {
     setModel(prev => ({
-      ...(prev ?? EMPTY_MODEL),
+      ...(prev ?? EMPTY_WORKFLOW_GENERATOR_MODEL),
       provider: newValue.provider,
       name: newValue.modelId,
       mode: newValue.mode as ModelModeType,
@@ -153,7 +135,7 @@ const WorkflowGeneratorModal: React.FC = () => {
 
   const handleCompletionParamsChange = useCallback((newParams: FormValue) => {
     setModel(prev => ({
-      ...(prev ?? EMPTY_MODEL),
+      ...(prev ?? EMPTY_WORKFLOW_GENERATOR_MODEL),
       completion_params: newParams as CompletionParams,
     }))
   }, [setModel])
@@ -356,7 +338,7 @@ const WorkflowGeneratorModal: React.FC = () => {
       return
     setApplyingTrue()
     try {
-      const { appId, appMode } = await applyToNewApp({
+      const { appId, appMode, permissionKeys } = await applyToNewApp({
         mode,
         graph: current.graph as GeneratedGraph,
         instruction,
@@ -365,7 +347,7 @@ const WorkflowGeneratorModal: React.FC = () => {
       })
       toast.success(t('workflowGenerator.applied'))
       closeGenerator()
-      router.push(getRedirectionPath(isCurrentWorkspaceEditor, { id: appId, mode: appMode }))
+      router.push(getRedirectionPath({ id: appId, mode: appMode, permission_keys: permissionKeys }))
     }
     catch (e: unknown) {
       if (e instanceof WorkflowApplyOrphanError) {
@@ -382,7 +364,7 @@ const WorkflowGeneratorModal: React.FC = () => {
     finally {
       setApplyingFalse()
     }
-  }, [current, instruction, mode, router, isCurrentWorkspaceEditor, closeGenerator, t, isApplying, setApplyingTrue, setApplyingFalse])
+  }, [current, instruction, mode, router, closeGenerator, t, isApplying, setApplyingTrue, setApplyingFalse])
 
   const handleApplyToCurrentConfirmed = useCallback(async () => {
     if (!current?.graph || !currentAppId || isApplying)
diff --git a/web/app/components/workflow/workflow-generator/storage.ts b/web/app/components/workflow/workflow-generator/storage.ts
new file mode 100644
index 00000000000..500fb8d43fd
--- /dev/null
+++ b/web/app/components/workflow/workflow-generator/storage.ts
@@ -0,0 +1,20 @@
+import type { CompletionParams, Model } from '@/types/app'
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+import { ModelModeType } from '@/types/app'
+
+export const EMPTY_WORKFLOW_GENERATOR_MODEL: Model = {
+  name: '',
+  provider: '',
+  mode: ModelModeType.chat,
+  completion_params: {} as CompletionParams,
+}
+
+const [
+  useWorkflowGeneratorModel,
+  _useWorkflowGeneratorModelValue,
+  _useSetWorkflowGeneratorModel,
+] = createLocalStorageState<Model>('workflow-gen-model', EMPTY_WORKFLOW_GENERATOR_MODEL)
+
+export {
+  useWorkflowGeneratorModel,
+}
diff --git a/web/app/education-apply/constants.ts b/web/app/education-apply/constants.ts
index cfe80556c6e..cb0c339af3a 100644
--- a/web/app/education-apply/constants.ts
+++ b/web/app/education-apply/constants.ts
@@ -1,3 +1,2 @@
 export const EDUCATION_VERIFY_URL_SEARCHPARAMS_ACTION = 'getEducationVerify'
-export const EDUCATION_VERIFYING_LOCALSTORAGE_ITEM = 'educationVerifying'
 export const EDUCATION_RE_VERIFY_ACTION = 'educationReVerify'
diff --git a/web/app/education-apply/education-apply-page.tsx b/web/app/education-apply/education-apply-page.tsx
index aaa2e66e6e7..61ae39b3ac7 100644
--- a/web/app/education-apply/education-apply-page.tsx
+++ b/web/app/education-apply/education-apply-page.tsx
@@ -8,12 +8,11 @@ import { Checkbox } from '@langgenius/dify-ui/checkbox'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { noop } from 'es-toolkit/function'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useState } from 'react'
 import { Trans, useTranslation } from 'react-i18next'
 import { useEducationDiscount } from '@/app/components/billing/hooks/use-education-discount'
 import { Plan } from '@/app/components/billing/type'
-import { EDUCATION_VERIFYING_LOCALSTORAGE_ITEM } from '@/app/education-apply/constants'
+import { useSetEducationVerifying } from '@/app/education-apply/storage'
 import { useAppContext } from '@/context/app-context'
 import { useDocLink } from '@/context/i18n'
 import { useProviderContext } from '@/context/provider-context'
@@ -27,6 +26,7 @@ import {
   useEducationAdd,
   useInvalidateEducationStatus,
 } from '@/service/use-education'
+import { BillingPermission, hasPermission } from '@/utils/permission'
 import DifyLogo from '../components/base/logo/dify-logo'
 import AppliedEducationContent from './applied-education-content'
 import RoleSelector from './role-selector'
@@ -52,7 +52,7 @@ const EducationApplyAgeContent = () => {
     mutateAsync: educationAdd,
   } = useEducationAdd({ onSuccess: noop })
   const { onPlanInfoChanged, isEducationAccount, plan } = useProviderContext()
-  const { currentWorkspace, isCurrentWorkspaceManager } = useAppContext()
+  const { currentWorkspace, workspacePermissionKeys } = useAppContext()
   const updateEducationStatus = useInvalidateEducationStatus()
   const docLink = useDocLink()
   const { handleEducationDiscount } = useEducationDiscount()
@@ -60,12 +60,13 @@ const EducationApplyAgeContent = () => {
   const openAsyncWindow = useAsyncWindowOpen()
   const queryClient = useQueryClient()
   const switchWorkspaceMutation = useMutation(consoleQuery.workspaces.switch.post.mutationOptions())
-  const setEducationVerifying = useSetLocalStorage<string>(EDUCATION_VERIFYING_LOCALSTORAGE_ITEM, { raw: true })
+  const setEducationVerifying = useSetEducationVerifying()
 
   const searchParams = useSearchParams()
   const token = searchParams.get('token')
+  const canManageBilling = hasPermission(workspacePermissionKeys, BillingPermission.Manage)
   const appliedEducationCase = (() => {
-    if (!isCurrentWorkspaceManager)
+    if (!canManageBilling)
       return AppliedEducationCase.noPaymentPermission
 
     if (plan.type === Plan.sandbox)
diff --git a/web/app/education-apply/hooks.ts b/web/app/education-apply/hooks.ts
index ae216feebc2..d4a1e6fa274 100644
--- a/web/app/education-apply/hooks.ts
+++ b/web/app/education-apply/hooks.ts
@@ -4,13 +4,18 @@ import { useDebounceFn } from 'ahooks'
 import dayjs from 'dayjs'
 import timezone from 'dayjs/plugin/timezone'
 import utc from 'dayjs/plugin/utc'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import {
   useCallback,
   useEffect,
   useState,
 } from 'react'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
+import {
+  useEducationExpiredHasNoticed,
+  useEducationReverifyHasNoticed,
+  useEducationReverifyPrevExpireAt,
+  useEducationVerifying,
+} from '@/app/education-apply/storage'
 import { useModalContextSelector } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
 import { userProfileQueryOptions } from '@/features/account-profile/client'
@@ -19,7 +24,6 @@ import { useEducationAutocomplete, useEducationVerify } from '@/service/use-educ
 import {
   EDUCATION_RE_VERIFY_ACTION,
   EDUCATION_VERIFY_URL_SEARCHPARAMS_ACTION,
-  EDUCATION_VERIFYING_LOCALSTORAGE_ITEM,
 } from './constants'
 
 dayjs.extend(utc)
@@ -89,9 +93,9 @@ const useEducationReverifyNotice = ({
   // const [educationInfo, setEducationInfo] = useState<{ is_student: boolean, allow_refresh: boolean, expire_at: number | null } | null>(null)
   // const isLoading = !educationInfo
   const { educationAccountExpireAt, allowRefreshEducationVerify, isLoadingEducationAccountInfo: isLoading } = useProviderContext()
-  const [prevExpireAt, setPrevExpireAt] = useLocalStorage<number>('education-reverify-prev-expire-at', 0)
-  const [reverifyHasNoticed, setReverifyHasNoticed] = useLocalStorage<boolean>('education-reverify-has-noticed', false)
-  const [expiredHasNoticed, setExpiredHasNoticed] = useLocalStorage<boolean>('education-expired-has-noticed', false)
+  const [prevExpireAt, setPrevExpireAt] = useEducationReverifyPrevExpireAt()
+  const [reverifyHasNoticed, setReverifyHasNoticed] = useEducationReverifyHasNoticed()
+  const [expiredHasNoticed, setExpiredHasNoticed] = useEducationExpiredHasNoticed()
 
   useEffect(() => {
     if (isLoading || !timezone)
@@ -132,7 +136,7 @@ const useEducationReverifyNotice = ({
 export const useEducationInit = () => {
   const setShowAccountSettingModal = useModalContextSelector(s => s.setShowAccountSettingModal)
   const setShowEducationExpireNoticeModal = useModalContextSelector(s => s.setShowEducationExpireNoticeModal)
-  const [educationVerifying, setEducationVerifying] = useLocalStorage<string>(EDUCATION_VERIFYING_LOCALSTORAGE_ITEM, 'no', { raw: true })
+  const [educationVerifying, setEducationVerifying] = useEducationVerifying()
   const searchParams = useSearchParams()
   const educationVerifyAction = searchParams.get('action')
 
diff --git a/web/app/education-apply/storage.ts b/web/app/education-apply/storage.ts
new file mode 100644
index 00000000000..209045b087e
--- /dev/null
+++ b/web/app/education-apply/storage.ts
@@ -0,0 +1,38 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+const EDUCATION_VERIFYING_LOCALSTORAGE_ITEM = 'educationVerifying'
+
+const [
+  useEducationVerifying,
+  _useEducationVerifyingValue,
+  useSetEducationVerifying,
+] = createLocalStorageState<string>(EDUCATION_VERIFYING_LOCALSTORAGE_ITEM, 'no', { raw: true })
+
+const [
+  useEducationReverifyPrevExpireAt,
+  _useEducationReverifyPrevExpireAtValue,
+  useSetEducationReverifyPrevExpireAt,
+] = createLocalStorageState<number>('education-reverify-prev-expire-at', 0)
+
+const [
+  useEducationReverifyHasNoticed,
+  _useEducationReverifyHasNoticedValue,
+  useSetEducationReverifyHasNoticed,
+] = createLocalStorageState<boolean>('education-reverify-has-noticed', false)
+
+const [
+  useEducationExpiredHasNoticed,
+  _useEducationExpiredHasNoticedValue,
+  useSetEducationExpiredHasNoticed,
+] = createLocalStorageState<boolean>('education-expired-has-noticed', false)
+
+export {
+  useEducationExpiredHasNoticed,
+  useEducationReverifyHasNoticed,
+  useEducationReverifyPrevExpireAt,
+  useEducationVerifying,
+  useSetEducationExpiredHasNoticed,
+  useSetEducationReverifyHasNoticed,
+  useSetEducationReverifyPrevExpireAt,
+  useSetEducationVerifying,
+}
diff --git a/web/app/reset-password/page.tsx b/web/app/reset-password/page.tsx
index e15d87034c8..25ccfecb7b7 100644
--- a/web/app/reset-password/page.tsx
+++ b/web/app/reset-password/page.tsx
@@ -12,7 +12,7 @@ import useDocumentTitle from '@/hooks/use-document-title'
 import Link from '@/next/link'
 import { useRouter, useSearchParams } from '@/next/navigation'
 import { sendResetPasswordCode } from '@/service/common'
-import { COUNT_DOWN_KEY, COUNT_DOWN_TIME_MS } from '../components/signin/countdown'
+import { COUNT_DOWN_TIME_MS, useSetCountdownLeftTime } from '../components/signin/storage'
 
 export default function CheckCode() {
   const { t } = useTranslation()
@@ -22,6 +22,7 @@ export default function CheckCode() {
   const [email, setEmail] = useState('')
   const [loading, setIsLoading] = useState(false)
   const locale = useLocale()
+  const setCountdownLeftTime = useSetCountdownLeftTime()
 
   const handleGetEMailVerificationCode = async () => {
     try {
@@ -37,7 +38,7 @@ export default function CheckCode() {
       setIsLoading(true)
       const res = await sendResetPasswordCode(email, locale)
       if (res.result === 'success') {
-        localStorage.setItem(COUNT_DOWN_KEY, `${COUNT_DOWN_TIME_MS}`)
+        setCountdownLeftTime(`${COUNT_DOWN_TIME_MS}`)
         const params = new URLSearchParams(searchParams)
         params.set('token', encodeURIComponent(res.data))
         params.set('email', encodeURIComponent(email))
diff --git a/web/app/signin/__tests__/normal-form.spec.tsx b/web/app/signin/__tests__/normal-form.spec.tsx
new file mode 100644
index 00000000000..6dfdfbb372f
--- /dev/null
+++ b/web/app/signin/__tests__/normal-form.spec.tsx
@@ -0,0 +1,113 @@
+import { useQuery, useSuspenseQuery } from '@tanstack/react-query'
+import { render, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { useRouter, useSearchParams } from '@/next/navigation'
+import NormalForm from '../normal-form'
+
+vi.mock('@tanstack/react-query', async () => {
+  const actual = await vi.importActual<typeof import('@tanstack/react-query')>('@tanstack/react-query')
+  return {
+    ...actual,
+    useQuery: vi.fn(),
+    useSuspenseQuery: vi.fn(),
+  }
+})
+
+vi.mock('@/features/account-profile/client', () => ({
+  isLegacyBase401: vi.fn(() => false),
+  userProfileQueryOptions: vi.fn(() => ({
+    queryKey: ['account', 'profile'],
+    queryFn: vi.fn(),
+  })),
+}))
+
+vi.mock('@/features/system-features/client', () => ({
+  systemFeaturesQueryOptions: vi.fn(() => ({
+    queryKey: ['system-features'],
+    queryFn: vi.fn(),
+  })),
+}))
+
+vi.mock('@/next/navigation', () => ({
+  useRouter: vi.fn(),
+  useSearchParams: vi.fn(),
+}))
+
+vi.mock('@/service/common', async () => {
+  const actual = await vi.importActual<typeof import('@/service/common')>('@/service/common')
+  return {
+    ...actual,
+    invitationCheck: vi.fn(),
+  }
+})
+
+vi.mock('./utils/post-login-redirect', () => ({
+  resolvePostLoginRedirect: vi.fn(() => null),
+}))
+
+const mockReplace = vi.fn()
+const mockUseQuery = vi.mocked(useQuery)
+const mockUseSuspenseQuery = vi.mocked(useSuspenseQuery)
+const mockUseRouter = useRouter as unknown as ReturnType<typeof vi.fn>
+const mockUseSearchParams = useSearchParams as unknown as ReturnType<typeof vi.fn>
+
+const loggedInQueryResult = {
+  isPending: false,
+  data: {
+    profile: {
+      id: 'account-id',
+    },
+  },
+  error: null,
+}
+
+const invitationQueryResult = {
+  isPending: false,
+  isError: false,
+  data: {
+    is_valid: true,
+    data: {
+      workspace_name: 'Acme',
+      workspace_id: 'workspace-id',
+      email: 'invitee@example.com',
+    },
+  },
+}
+
+describe('NormalForm', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUseRouter.mockReturnValue({ replace: mockReplace })
+    mockUseSearchParams.mockReturnValue(new URLSearchParams('invite_token=invite-token'))
+    mockUseSuspenseQuery.mockReturnValue({
+      data: {
+        enable_social_oauth_login: false,
+        sso_enforced_for_signin: false,
+        enable_email_code_login: false,
+        enable_email_password_login: true,
+        is_email_setup: true,
+        is_allow_register: false,
+        license: {
+          status: 'none',
+        },
+        branding: {
+          enabled: true,
+        },
+      },
+    } as unknown as ReturnType<typeof useSuspenseQuery>)
+  })
+
+  describe('Invite Redirects', () => {
+    it('should send logged-in invite visitors to the invite confirmation page', async () => {
+      mockUseQuery
+        .mockReturnValueOnce(loggedInQueryResult as unknown as ReturnType<typeof useQuery>)
+        .mockReturnValueOnce(invitationQueryResult as unknown as ReturnType<typeof useQuery>)
+
+      render(<NormalForm />)
+
+      await waitFor(() => {
+        expect(mockReplace).toHaveBeenCalledWith('/signin/invite-settings?invite_token=invite-token')
+      })
+    })
+  })
+})
diff --git a/web/app/signin/components/mail-and-code-auth.tsx b/web/app/signin/components/mail-and-code-auth.tsx
index 2c013b868bc..98a24c44ccc 100644
--- a/web/app/signin/components/mail-and-code-auth.tsx
+++ b/web/app/signin/components/mail-and-code-auth.tsx
@@ -2,10 +2,9 @@ import { Button } from '@langgenius/dify-ui/button'
 import { FieldControl, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
 import { Form } from '@langgenius/dify-ui/form'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { COUNT_DOWN_KEY, COUNT_DOWN_TIME_MS } from '@/app/components/signin/countdown'
+import { COUNT_DOWN_TIME_MS, useSetCountdownLeftTime } from '@/app/components/signin/storage'
 import { emailRegex } from '@/config'
 import { useLocale } from '@/context/i18n'
 import { useRouter, useSearchParams } from '@/next/navigation'
@@ -23,7 +22,7 @@ export default function MailAndCodeAuth({ isInvite }: MailAndCodeAuthProps) {
   const [email, setEmail] = useState(emailFromLink)
   const [loading, setLoading] = useState(false)
   const locale = useLocale()
-  const setCountdownLeftTime = useSetLocalStorage<string>(COUNT_DOWN_KEY, { raw: true })
+  const setCountdownLeftTime = useSetCountdownLeftTime()
 
   const handleGetEMailVerificationCode = async () => {
     try {
diff --git a/web/app/signin/invite-settings/__tests__/page.spec.tsx b/web/app/signin/invite-settings/__tests__/page.spec.tsx
index 6990e71a679..4038aff328f 100644
--- a/web/app/signin/invite-settings/__tests__/page.spec.tsx
+++ b/web/app/signin/invite-settings/__tests__/page.spec.tsx
@@ -86,6 +86,7 @@ describe('InviteSettingsPage', () => {
           workspace_name: 'Acme',
           workspace_id: 'workspace-id',
           email: 'invitee@example.com',
+          requires_setup: true,
         },
       },
       refetch: mockRefetch,
@@ -138,5 +139,99 @@ describe('InviteSettingsPage', () => {
         })
       })
     })
+
+    it('should only submit the token when an active account accepts an invitation', async () => {
+      mockUseInvitationCheck.mockReturnValue({
+        data: {
+          is_valid: true,
+          data: {
+            workspace_name: 'Acme',
+            workspace_id: 'workspace-id',
+            email: 'invitee@example.com',
+            account_status: 'active',
+            requires_setup: false,
+          },
+        },
+        refetch: mockRefetch,
+      } as unknown as ReturnType<typeof useInvitationCheck>)
+
+      render(<InviteSettingsPage />)
+
+      expect(screen.queryByLabelText('login.name')).not.toBeInTheDocument()
+      fireEvent.click(screen.getByRole('button', { name: 'login.join Acme' }))
+
+      await waitFor(() => {
+        expect(mockActivateMember).toHaveBeenCalledWith({
+          url: '/activate',
+          body: {
+            token: 'invite-token',
+          },
+        })
+      })
+    })
+
+    it('should only submit the token when an active account check omits setup state', async () => {
+      mockUseInvitationCheck.mockReturnValue({
+        data: {
+          is_valid: true,
+          data: {
+            workspace_name: 'Acme',
+            workspace_id: 'workspace-id',
+            email: 'invitee@example.com',
+            account_status: 'active',
+          },
+        },
+        refetch: mockRefetch,
+      } as unknown as ReturnType<typeof useInvitationCheck>)
+
+      render(<InviteSettingsPage />)
+
+      expect(screen.queryByLabelText('login.name')).not.toBeInTheDocument()
+      fireEvent.click(screen.getByRole('button', { name: 'login.join Acme' }))
+
+      await waitFor(() => {
+        expect(mockActivateMember).toHaveBeenCalledWith({
+          url: '/activate',
+          body: {
+            token: 'invite-token',
+          },
+        })
+      })
+    })
+
+    it('should submit setup fields when the invitation requires account setup', async () => {
+      mockUseInvitationCheck.mockReturnValue({
+        data: {
+          is_valid: true,
+          data: {
+            workspace_name: 'Acme',
+            workspace_id: 'workspace-id',
+            email: 'invitee@example.com',
+            account_status: 'active',
+            requires_setup: true,
+          },
+        },
+        refetch: mockRefetch,
+      } as unknown as ReturnType<typeof useInvitationCheck>)
+
+      render(<InviteSettingsPage />)
+
+      fireEvent.change(screen.getByLabelText('login.name'), {
+        target: { value: 'Invitee' },
+      })
+      fireEvent.click(screen.getByRole('button', { name: 'login.join Acme' }))
+
+      await waitFor(() => {
+        expect(mockActivateMember).toHaveBeenCalledWith({
+          url: '/activate',
+          body: {
+            token: 'invite-token',
+            name: 'Invitee',
+            interface_language: 'zh-Hans',
+            timezone: 'Asia/Shanghai',
+          },
+        })
+      })
+    })
   })
 })
diff --git a/web/app/signin/invite-settings/page.tsx b/web/app/signin/invite-settings/page.tsx
index f4f255bd89b..df48867a9b9 100644
--- a/web/app/signin/invite-settings/page.tsx
+++ b/web/app/signin/invite-settings/page.tsx
@@ -1,6 +1,7 @@
 'use client'
 import type { Locale } from '@/i18n-config'
 import { Button } from '@langgenius/dify-ui/button'
+import { Input } from '@langgenius/dify-ui/input'
 import { Select, SelectContent, SelectItem, SelectItemIndicator, SelectItemText, SelectTrigger } from '@langgenius/dify-ui/select'
 import { toast } from '@langgenius/dify-ui/toast'
 import { RiAccountCircleLine } from '@remixicon/react'
@@ -8,7 +9,6 @@ import { useQueryClient, useSuspenseQuery } from '@tanstack/react-query'
 import { noop } from 'es-toolkit/function'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import Input from '@/app/components/base/input'
 import Loading from '@/app/components/base/loading'
 import { LICENSE_LINK } from '@/constants/link'
 import { useLocale } from '@/context/i18n'
@@ -85,25 +85,32 @@ export default function InviteSettingsPage() {
     },
   }
   const { data: checkRes, refetch: recheck } = useInvitationCheck(checkParams.params, !!token)
+  const requiresAccountSetup = checkRes?.data?.requires_setup ?? checkRes?.data?.account_status === 'pending'
 
   const handleActivate = useCallback(async () => {
     try {
-      if (!name) {
+      if (requiresAccountSetup && !name) {
         toast.error(t('enterYourName', { ns: 'login' }))
         return
       }
+      const body = requiresAccountSetup
+        ? {
+            token,
+            name,
+            interface_language: language,
+            timezone,
+          }
+        : {
+            token,
+          }
       const res = await activateMember({
         url: '/activate',
-        body: {
-          token,
-          name,
-          interface_language: language,
-          timezone,
-        },
+        body,
       })
       if (res.result === 'success') {
         // Tokens are now stored in cookies by the backend
-        await setLocaleOnClient(language!, false)
+        if (requiresAccountSetup)
+          await setLocaleOnClient(language!, false)
         await queryClient.resetQueries({ queryKey: consoleQuery.account.profile.get.key() })
         const redirectUrl = resolvePostLoginRedirect(searchParams)
         router.replace(redirectUrl || '/')
@@ -112,7 +119,7 @@ export default function InviteSettingsPage() {
     catch {
       recheck()
     }
-  }, [language, name, queryClient, recheck, searchParams, timezone, token, router, t])
+  }, [language, name, queryClient, recheck, requiresAccountSetup, searchParams, timezone, token, router, t])
 
   if (!checkRes)
     return <Loading />
@@ -138,77 +145,84 @@ export default function InviteSettingsPage() {
         <RiAccountCircleLine className="size-6 text-2xl text-text-accent-light-mode-only" />
       </div>
       <div className="pt-2 pb-4">
-        <h2 className="title-4xl-semi-bold text-text-primary">{t('setYourAccount', { ns: 'login' })}</h2>
+        <h2 className="title-4xl-semi-bold text-text-primary">
+          {requiresAccountSetup
+            ? t('setYourAccount', { ns: 'login' })
+            : `${t('join', { ns: 'login' })}${checkRes?.data?.workspace_name}`}
+        </h2>
       </div>
       <form onSubmit={noop}>
-        <div className="mb-5">
-          <label htmlFor="name" className="my-2 system-md-semibold text-text-secondary">
-            {t('name', { ns: 'login' })}
-          </label>
-          <div className="mt-1">
-            <Input
-              id="name"
-              type="text"
-              value={name}
-              onChange={e => setName(e.target.value)}
-              placeholder={t('namePlaceholder', { ns: 'login' }) || ''}
-              onKeyDown={(e) => {
-                if (e.key === 'Enter') {
-                  e.preventDefault()
-                  e.stopPropagation()
-                  handleActivate()
-                }
-              }}
-            />
-          </div>
-        </div>
-        <div className="mb-5">
-          <label htmlFor="interface_language" className="my-2 system-md-semibold text-text-secondary">
-            {t('interfaceLanguage', { ns: 'login' })}
-          </label>
-          <div className="mt-1">
-            <Select
-              value={selectedLanguage?.value ?? null}
-              onValueChange={handleLanguageChange}
-            >
-              <SelectTrigger id="interface_language" size="large">
-                {selectedLanguage?.name ?? t('placeholder.select', { ns: 'common' })}
-              </SelectTrigger>
-              <SelectContent>
-                {LANGUAGE_OPTIONS.map(item => (
-                  <SelectItem key={item.value} value={item.value}>
-                    <SelectItemText>{item.name}</SelectItemText>
-                    <SelectItemIndicator />
-                  </SelectItem>
-                ))}
-              </SelectContent>
-            </Select>
-          </div>
-        </div>
-        {/* timezone */}
-        <div className="mb-5">
-          <label htmlFor="timezone" className="system-md-semibold text-text-secondary">
-            {t('timezone', { ns: 'login' })}
-          </label>
-          <div className="mt-1">
-            <Select
-              value={selectedTimezone?.value ?? null}
-              onValueChange={handleTimezoneChange}
-            >
-              <SelectTrigger id="timezone" size="large">
-                {selectedTimezone?.name ?? t('placeholder.select', { ns: 'common' })}
-              </SelectTrigger>
-              <SelectContent>
-                {TIMEZONE_OPTIONS.map(item => (
-                  <SelectItem key={item.value} value={item.value}>
-                    <SelectItemText>{item.name}</SelectItemText>
-                    <SelectItemIndicator />
-                  </SelectItem>
-                ))}
-              </SelectContent>
-            </Select>
-          </div>
-        </div>
+        {requiresAccountSetup && (
+          <>
+            <div className="mb-5">
+              <label htmlFor="name" className="my-2 system-md-semibold text-text-secondary">
+                {t('name', { ns: 'login' })}
+              </label>
+              <div className="mt-1">
+                <Input
+                  id="name"
+                  type="text"
+                  value={name}
+                  onChange={e => setName(e.target.value)}
+                  placeholder={t('namePlaceholder', { ns: 'login' }) || ''}
+                  onKeyDown={(e) => {
+                    if (e.key === 'Enter') {
+                      e.preventDefault()
+                      e.stopPropagation()
+                      handleActivate()
+                    }
+                  }}
+                />
+              </div>
+            </div>
+            <div className="mb-5">
+              <label htmlFor="interface_language" className="my-2 system-md-semibold text-text-secondary">
+                {t('interfaceLanguage', { ns: 'login' })}
+              </label>
+              <div className="mt-1">
+                <Select
+                  value={selectedLanguage?.value ?? null}
+                  onValueChange={handleLanguageChange}
+                >
+                  <SelectTrigger id="interface_language" size="large">
+                    {selectedLanguage?.name ?? t('placeholder.select', { ns: 'common' })}
+                  </SelectTrigger>
+                  <SelectContent>
+                    {LANGUAGE_OPTIONS.map(item => (
+                      <SelectItem key={item.value} value={item.value}>
+                        <SelectItemText>{item.name}</SelectItemText>
+                        <SelectItemIndicator />
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </div>
+            </div>
+            <div className="mb-5">
+              <label htmlFor="timezone" className="system-md-semibold text-text-secondary">
+                {t('timezone', { ns: 'login' })}
+              </label>
+              <div className="mt-1">
+                <Select
+                  value={selectedTimezone?.value ?? null}
+                  onValueChange={handleTimezoneChange}
+                >
+                  <SelectTrigger id="timezone" size="large">
+                    {selectedTimezone?.name ?? t('placeholder.select', { ns: 'common' })}
+                  </SelectTrigger>
+                  <SelectContent>
+                    {TIMEZONE_OPTIONS.map(item => (
+                      <SelectItem key={item.value} value={item.value}>
+                        <SelectItemText>{item.name}</SelectItemText>
+                        <SelectItemIndicator />
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </div>
+            </div>
+          </>
+        )}
         <div>
           <Button
             variant="primary"
diff --git a/web/app/signin/normal-form.tsx b/web/app/signin/normal-form.tsx
index e3fbdc15354..656ae46f68c 100644
--- a/web/app/signin/normal-form.tsx
+++ b/web/app/signin/normal-form.tsx
@@ -74,9 +74,14 @@ function NormalForm() {
     if (!isLoggedIn)
       return
 
+    if (isInviteLink) {
+      router.replace(`/signin/invite-settings?${searchParams.toString()}`)
+      return
+    }
+
     const redirectUrl = resolvePostLoginRedirect(searchParams)
     router.replace(redirectUrl || '/')
-  }, [isLoggedIn, router, searchParams])
+  }, [isInviteLink, isLoggedIn, router, searchParams])
 
   useEffect(() => {
     if (message)
@@ -197,9 +202,13 @@ function NormalForm() {
                   <>
                     <MailAndCodeAuth isInvite={isInviteLink} />
                     {hasEmailPasswordLogin && (
-                      <div className="cursor-pointer py-1 text-center" onClick={() => { setSelectedAuthType('password') }}>
+                      <button
+                        type="button"
+                        className="w-full cursor-pointer py-1 text-center"
+                        onClick={() => { setSelectedAuthType('password') }}
+                      >
                         <span className="system-xs-medium text-components-button-secondary-accent-text">{t('usePassword', { ns: 'login' })}</span>
-                      </div>
+                      </button>
                     )}
                   </>
                 )}
@@ -207,9 +216,13 @@ function NormalForm() {
                   <>
                     <MailAndPasswordAuth isInvite={isInviteLink} isEmailSetup={systemFeatures.is_email_setup} />
                     {hasEmailCodeLogin && (
-                      <div className="cursor-pointer py-1 text-center" onClick={() => { setSelectedAuthType('code') }}>
+                      <button
+                        type="button"
+                        className="w-full cursor-pointer py-1 text-center"
+                        onClick={() => { setSelectedAuthType('code') }}
+                      >
                         <span className="system-xs-medium text-components-button-secondary-accent-text">{t('useVerificationCode', { ns: 'login' })}</span>
-                      </div>
+                      </button>
                     )}
                   </>
                 )}
diff --git a/web/config/index.ts b/web/config/index.ts
index dcd38229400..5b325a267e3 100644
--- a/web/config/index.ts
+++ b/web/config/index.ts
@@ -180,8 +180,6 @@ export const VAR_ITEM_TEMPLATE_IN_PIPELINE = {
 
 export const appDefaultIconBackground = '#D5F5F6'
 
-export const NEED_REFRESH_APP_LIST_KEY = 'needRefreshAppList'
-
 export const DATASET_DEFAULT = {
   top_k: 4,
   score_threshold: 0.8,
diff --git a/web/context/__tests__/app-context-provider.spec.tsx b/web/context/__tests__/app-context-provider.spec.tsx
new file mode 100644
index 00000000000..0e55cd8459e
--- /dev/null
+++ b/web/context/__tests__/app-context-provider.spec.tsx
@@ -0,0 +1,179 @@
+import { render, screen } from '@testing-library/react'
+import { useAppContext, useSelector } from '../app-context'
+import { AppContextProvider } from '../app-context-provider'
+
+const mockInvalidateQueries = vi.hoisted(() => vi.fn())
+const mockPermissionKeysState = vi.hoisted(() => ({
+  isPending: false,
+  permissionKeys: ['app.create_and_management'],
+}))
+const mockCurrentWorkspaceResponse = vi.hoisted(() => ({
+  id: 'workspace-1',
+  name: 'Workspace',
+  plan: 'sandbox',
+  status: 'normal',
+  created_at: 1704067200,
+  role: 'editor',
+  trial_credits: 200,
+  trial_credits_used: 0,
+  next_credit_reset_date: 1706745600,
+  custom_config: {},
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: mockInvalidateQueries,
+  }),
+  useSuspenseQuery: (options: { queryKey?: readonly unknown[] }) => {
+    if (options.queryKey?.[0] === 'system-features') {
+      return {
+        data: {
+          branding: {
+            enabled: false,
+          },
+        },
+      }
+    }
+
+    return {
+      data: {
+        profile: {
+          id: 'user-1',
+          name: 'User',
+          email: 'user@example.com',
+          avatar: '',
+          avatar_url: '',
+          is_password_set: true,
+        },
+        meta: {
+          currentVersion: '1.0.0',
+          currentEnv: 'cloud',
+        },
+      },
+    }
+  },
+  useQuery: (options: { select?: (workspace: typeof mockCurrentWorkspaceResponse) => unknown }) => ({
+    data: options.select ? options.select(mockCurrentWorkspaceResponse) : mockCurrentWorkspaceResponse,
+    isFetching: false,
+    isPending: false,
+  }),
+}))
+
+vi.mock('@/features/system-features/client', () => ({
+  systemFeaturesQueryOptions: () => ({
+    queryKey: ['system-features'],
+  }),
+}))
+
+vi.mock('@/features/account-profile/client', () => ({
+  userProfileQueryOptions: () => ({
+    queryKey: ['user-profile'],
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    workspaces: {
+      current: {
+        post: {
+          key: () => ['current-workspace'],
+          queryOptions: (options: Record<string, unknown>) => ({
+            queryKey: ['current-workspace'],
+            ...options,
+          }),
+        },
+      },
+    },
+  },
+}))
+
+vi.mock('@/service/access-control/use-permission-keys', () => ({
+  useWorkspacePermissionKeys: () => ({
+    data: {
+      workspace: {
+        permission_keys: mockPermissionKeysState.permissionKeys,
+      },
+      app: {
+        default_permission_keys: [],
+        overrides: [],
+      },
+      dataset: {
+        default_permission_keys: [],
+        overrides: [],
+      },
+    },
+    isPending: mockPermissionKeysState.isPending,
+  }),
+}))
+
+vi.mock('@/service/use-common', () => ({
+  useLangGeniusVersion: () => ({
+    data: {
+      version: '1.0.1',
+      release_date: '',
+      release_notes: '',
+      can_auto_update: false,
+    },
+  }),
+}))
+
+vi.mock('@/app/components/base/amplitude', () => ({
+  setUserId: vi.fn(),
+  setUserProperties: vi.fn(),
+}))
+
+vi.mock('@/app/components/base/amplitude/registration-tracking', () => ({
+  flushRegistrationSuccess: vi.fn(),
+}))
+
+vi.mock('@/app/components/base/zendesk/utils', () => ({
+  setZendeskConversationFields: vi.fn(),
+}))
+
+vi.mock('@/app/components/header/maintenance-notice', () => ({
+  default: () => null,
+}))
+
+function AppContextProbe() {
+  const context = useAppContext()
+  const selectedWorkspacePermissionKeys = useSelector(state => state.workspacePermissionKeys)
+
+  return (
+    <>
+      <span>
+        keys:
+        {selectedWorkspacePermissionKeys.join(',')}
+      </span>
+      <span>
+        loading:
+        {String(context.isLoadingWorkspacePermissionKeys)}
+      </span>
+      <span>
+        role:
+        {context.currentWorkspace.role}
+      </span>
+    </>
+  )
+}
+
+describe('AppContextProvider', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockPermissionKeysState.isPending = false
+    mockPermissionKeysState.permissionKeys = ['app.create_and_management']
+  })
+
+  describe('Workspace Permission Keys', () => {
+    it('should provide current workspace permission keys from my-permissions', () => {
+      render(
+        <AppContextProvider>
+          <AppContextProbe />
+        </AppContextProvider>,
+      )
+
+      expect(screen.getByText('keys:app.create_and_management')).toBeInTheDocument()
+      expect(screen.getByText('loading:false')).toBeInTheDocument()
+      expect(screen.getByText('role:editor')).toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/context/access-control-store.ts b/web/context/access-control-store.ts
deleted file mode 100644
index 1cb8eb98489..00000000000
--- a/web/context/access-control-store.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import type { AccessControlAccount, AccessControlGroup } from '@/models/access-control'
-import type { App } from '@/types/app'
-import { create } from 'zustand'
-import { AccessMode } from '@/models/access-control'
-
-type AccessControlStore = {
-  appId: App['id']
-  setAppId: (appId: App['id']) => void
-  specificGroups: AccessControlGroup[]
-  setSpecificGroups: (specificGroups: AccessControlGroup[]) => void
-  specificMembers: AccessControlAccount[]
-  setSpecificMembers: (specificMembers: AccessControlAccount[]) => void
-  currentMenu: AccessMode
-  setCurrentMenu: (currentMenu: AccessMode) => void
-  selectedGroupsForBreadcrumb: AccessControlGroup[]
-  setSelectedGroupsForBreadcrumb: (selectedGroupsForBreadcrumb: AccessControlGroup[]) => void
-}
-
-const useAccessControlStore = create<AccessControlStore>((set) => {
-  return {
-    appId: '',
-    setAppId: appId => set({ appId }),
-    specificGroups: [],
-    setSpecificGroups: specificGroups => set({ specificGroups }),
-    specificMembers: [],
-    setSpecificMembers: specificMembers => set({ specificMembers }),
-    currentMenu: AccessMode.SPECIFIC_GROUPS_MEMBERS,
-    setCurrentMenu: currentMenu => set({ currentMenu }),
-    selectedGroupsForBreadcrumb: [],
-    setSelectedGroupsForBreadcrumb: selectedGroupsForBreadcrumb => set({ selectedGroupsForBreadcrumb }),
-  }
-})
-
-export default useAccessControlStore
diff --git a/web/context/app-context-provider.tsx b/web/context/app-context-provider.tsx
index d974ad916bc..2091f0818c2 100644
--- a/web/context/app-context-provider.tsx
+++ b/web/context/app-context-provider.tsx
@@ -21,6 +21,7 @@ import {
 import { env } from '@/env'
 import { userProfileQueryOptions } from '@/features/account-profile/client'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
+import { useWorkspacePermissionKeys } from '@/service/access-control/use-permission-keys'
 import { consoleQuery } from '@/service/client'
 import {
   useLangGeniusVersion,
@@ -31,6 +32,7 @@ type AppContextProviderProps = {
 }
 
 const workspaceRoles = new Set<ICurrentWorkspace['role']>(['owner', 'admin', 'editor', 'dataset_operator', 'normal'])
+const emptyWorkspacePermissionKeys: string[] = []
 
 const resolveWorkspaceRole = (role: PostWorkspacesCurrentResponse['role']): ICurrentWorkspace['role'] => {
   if (role && workspaceRoles.has(role as ICurrentWorkspace['role']))
@@ -71,6 +73,7 @@ export const AppContextProvider: FC<AppContextProviderProps> = ({ children }) =>
   const currentWorkspaceQuery = useQuery(consoleQuery.workspaces.current.post.queryOptions({
     select: normalizeCurrentWorkspace,
   }))
+  const workspacePermissionKeysQuery = useWorkspacePermissionKeys()
   const langGeniusVersionQuery = useLangGeniusVersion(
     userProfileResp?.meta.currentVersion,
     !systemFeatures.branding.enabled,
@@ -184,7 +187,9 @@ export const AppContextProvider: FC<AppContextProviderProps> = ({ children }) =>
       isCurrentWorkspaceDatasetOperator,
       mutateCurrentWorkspace,
       isLoadingCurrentWorkspace: currentWorkspaceQuery.isPending,
+      isLoadingWorkspacePermissionKeys: workspacePermissionKeysQuery.isPending,
       isValidatingCurrentWorkspace: currentWorkspaceQuery.isFetching,
+      workspacePermissionKeys: workspacePermissionKeysQuery.data?.workspace.permission_keys ?? emptyWorkspacePermissionKeys,
     }}
     >
       <div className="flex h-full flex-col overflow-hidden">
diff --git a/web/context/app-context.ts b/web/context/app-context.ts
index 50df95e71ef..5b8fcf22e69 100644
--- a/web/context/app-context.ts
+++ b/web/context/app-context.ts
@@ -17,7 +17,9 @@ export type AppContextValue = {
   langGeniusVersionInfo: LangGeniusVersionResponse
   useSelector: typeof useSelector
   isLoadingCurrentWorkspace: boolean
+  isLoadingWorkspacePermissionKeys?: boolean
   isValidatingCurrentWorkspace: boolean
+  workspacePermissionKeys: string[]
 }
 
 export const userProfilePlaceholder = {
@@ -64,7 +66,9 @@ export const AppContext = createContext<AppContextValue>({
   langGeniusVersionInfo: initialLangGeniusVersionInfo,
   useSelector,
   isLoadingCurrentWorkspace: false,
+  isLoadingWorkspacePermissionKeys: false,
   isValidatingCurrentWorkspace: false,
+  workspacePermissionKeys: [],
 })
 
 export function useSelector<T>(selector: (value: AppContextValue) => T): T {
diff --git a/web/context/debug-configuration.ts b/web/context/debug-configuration.ts
index 48e34fbe5ee..a5f80f06840 100644
--- a/web/context/debug-configuration.ts
+++ b/web/context/debug-configuration.ts
@@ -30,6 +30,7 @@ import { AppModeEnum, ModelModeType, Resolution, RETRIEVE_TYPE, TransferMethod }
 
 type IDebugConfiguration = {
   readonly?: boolean
+  canTestAndRun?: boolean
   appId: string
   isAPIKeySet: boolean
   isTrailFinished: boolean
@@ -110,6 +111,7 @@ type IDebugConfiguration = {
 
 const DebugConfigurationContext = createContext<IDebugConfiguration>({
   readonly: false,
+  canTestAndRun: false,
   appId: '',
   isAPIKeySet: false,
   isTrailFinished: false,
diff --git a/web/context/external-knowledge-api-context.tsx b/web/context/external-knowledge-api-context.tsx
index 64f23a3085a..854aab47660 100644
--- a/web/context/external-knowledge-api-context.tsx
+++ b/web/context/external-knowledge-api-context.tsx
@@ -15,14 +15,18 @@ const ExternalKnowledgeApiContext = createContext<ExternalKnowledgeApiContextTyp
 
 type ExternalKnowledgeApiProviderProps = {
   children: ReactNode
+  enabled?: boolean
 }
 
-export const ExternalKnowledgeApiProvider: FC<ExternalKnowledgeApiProviderProps> = ({ children }) => {
-  const { data, refetch, isLoading } = useExternalKnowledgeApiList()
+export const ExternalKnowledgeApiProvider: FC<ExternalKnowledgeApiProviderProps> = ({ children, enabled = true }) => {
+  const { data, refetch, isLoading } = useExternalKnowledgeApiList({ enabled })
 
   const mutateExternalKnowledgeApis = useCallback(() => {
+    if (!enabled)
+      return Promise.resolve(undefined)
+
     return refetch().then(res => res.data)
-  }, [refetch])
+  }, [enabled, refetch])
 
   const contextValue = useMemo<ExternalKnowledgeApiContextType>(() => ({
     externalKnowledgeApiList: data?.data || [],
diff --git a/web/context/modal-context-provider.tsx b/web/context/modal-context-provider.tsx
index 78fdcf8c130..2c2d9ad185d 100644
--- a/web/context/modal-context-provider.tsx
+++ b/web/context/modal-context-provider.tsx
@@ -11,7 +11,6 @@ import type { InputVar } from '@/app/components/workflow/types'
 import type { ExpireNoticeModalPayloadProps } from '@/app/education-apply/expire-notice-modal'
 import type { ExternalDataTool } from '@/models/common'
 import type { ModerationConfig, PromptVariable } from '@/models/debug'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import { useCallback, useEffect, useRef, useState } from 'react'
 import {
   DEFAULT_ACCOUNT_SETTING_TAB,
@@ -20,9 +19,7 @@ import {
   isValidSettingsTab,
   isWorkspaceSettingTab,
 } from '@/app/components/header/account-setting/constants'
-import {
-  EDUCATION_VERIFYING_LOCALSTORAGE_ITEM,
-} from '@/app/education-apply/constants'
+import { useSetEducationVerifying } from '@/app/education-apply/storage'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
 import {
@@ -107,7 +104,7 @@ export const ModalContextProvider = ({
   const [showUpdatePluginModal, setShowUpdatePluginModal] = useState<ModalState<UpdatePluginPayload> | null>(null)
   const [showEducationExpireNoticeModal, setShowEducationExpireNoticeModal] = useState<ModalState<ExpireNoticeModalPayloadProps> | null>(null)
   const { currentWorkspace } = useAppContext()
-  const setEducationVerifying = useSetLocalStorage<string>(EDUCATION_VERIFYING_LOCALSTORAGE_ITEM, { raw: true })
+  const setEducationVerifying = useSetEducationVerifying()
 
   const [showAnnotationFullModal, setShowAnnotationFullModal] = useState(false)
   const handleCancelAccountSettingModal = () => {
@@ -269,6 +266,7 @@ export const ModalContextProvider = ({
           integrationSettingModalSection && (
             <IntegrationsSettingModal
               section={integrationSettingModalSection}
+              source={accountSettingCallbacksRef.current?.source}
               onCancel={handleCancelAccountSettingModal}
               onSectionChange={section => setUrlAccountModalState({ payload: section })}
             />
diff --git a/web/context/modal-context.test.tsx b/web/context/modal-context.test.tsx
index 7feaedd4fa3..cd54fcd41a9 100644
--- a/web/context/modal-context.test.tsx
+++ b/web/context/modal-context.test.tsx
@@ -38,8 +38,8 @@ vi.mock('@/app/components/header/account-setting', () => ({
   ),
 }))
 
-vi.mock('foxact/use-local-storage', () => ({
-  useSetLocalStorage: () => mockSetEducationVerifying,
+vi.mock('@/app/education-apply/storage', () => ({
+  useSetEducationVerifying: () => mockSetEducationVerifying,
 }))
 
 const mockUseProviderContext = vi.fn()
diff --git a/web/context/modal-context.ts b/web/context/modal-context.ts
index ed7289e6216..89c337a041c 100644
--- a/web/context/modal-context.ts
+++ b/web/context/modal-context.ts
@@ -26,6 +26,7 @@ import { createContext, useContext, useContextSelector } from 'use-context-selec
 
 export type ModalState<T> = {
   payload: T
+  source?: 'agent'
   onCancelCallback?: () => void
   onSaveCallback?: (newPayload?: T, formValues?: Record<string, unknown>) => void
   onRemoveCallback?: (newPayload?: T, formValues?: Record<string, unknown>) => void
diff --git a/web/context/provider-context-provider.tsx b/web/context/provider-context-provider.tsx
index 5d52abedf8f..fb9706cc521 100644
--- a/web/context/provider-context-provider.tsx
+++ b/web/context/provider-context-provider.tsx
@@ -5,7 +5,6 @@ import type { ProviderContextState } from './provider-context'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useQueryClient } from '@tanstack/react-query'
 import dayjs from 'dayjs'
-import { useLocalStorage } from 'foxact/use-local-storage'
 import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { setZendeskConversationFields } from '@/app/components/base/zendesk/utils'
@@ -25,6 +24,7 @@ import {
 } from '@/service/use-common'
 import { useEducationStatus } from '@/service/use-education'
 import { ProviderContext } from './provider-context'
+import { useAnthropicQuotaNotice } from './provider-storage'
 
 type ProviderContextProviderProps = {
   children: ReactNode
@@ -40,8 +40,6 @@ const unlimitedMemberInviteLimit: MemberInviteLimit = {
   limit: 0,
 }
 
-const ANTHROPIC_QUOTA_NOTICE_STORAGE_KEY = 'anthropic_quota_notice'
-
 const resolveMemberInviteLimit = (data: Awaited<ReturnType<typeof fetchCurrentPlanInfo>>): MemberInviteLimit => {
   if (!data)
     return unlimitedMemberInviteLimit
@@ -158,11 +156,7 @@ export const ProviderContextProvider = ({
   // #endregion Zendesk conversation fields
 
   const { t } = useTranslation()
-  const [anthropicQuotaNotice, setAnthropicQuotaNotice] = useLocalStorage<string>(
-    ANTHROPIC_QUOTA_NOTICE_STORAGE_KEY,
-    'false',
-    { raw: true },
-  )
+  const [anthropicQuotaNotice, setAnthropicQuotaNotice] = useAnthropicQuotaNotice()
 
   useEffect(() => {
     if (anthropicQuotaNotice === 'true')
diff --git a/web/context/provider-storage.ts b/web/context/provider-storage.ts
new file mode 100644
index 00000000000..7bd951d959a
--- /dev/null
+++ b/web/context/provider-storage.ts
@@ -0,0 +1,13 @@
+import { createLocalStorageState } from 'foxact/create-local-storage-state'
+
+const ANTHROPIC_QUOTA_NOTICE_STORAGE_KEY = 'anthropic_quota_notice'
+
+const [
+  useAnthropicQuotaNotice,
+  _useAnthropicQuotaNoticeValue,
+  _useSetAnthropicQuotaNotice,
+] = createLocalStorageState<string>(ANTHROPIC_QUOTA_NOTICE_STORAGE_KEY, 'false', { raw: true })
+
+export {
+  useAnthropicQuotaNotice,
+}
diff --git a/web/context/query-client.tsx b/web/context/query-client.tsx
index 2b95159396e..84e726c1c0e 100644
--- a/web/context/query-client.tsx
+++ b/web/context/query-client.tsx
@@ -2,6 +2,8 @@
 
 import type { QueryClient } from '@tanstack/react-query'
 import { QueryClientProvider } from '@tanstack/react-query'
+import { queryClientAtom } from 'jotai-tanstack-query'
+import { useHydrateAtoms } from 'jotai/react/utils'
 import { isServer } from '@/utils/client'
 import { makeQueryClient } from './query-client-server'
 
@@ -20,7 +22,21 @@ export const TanstackQueryInitializer = ({ children }: { children: React.ReactNo
   const queryClient = getQueryClient()
   return (
     <QueryClientProvider client={queryClient}>
-      {children}
+      <HydrateJotaiQueryClient queryClient={queryClient}>
+        {children}
+      </HydrateJotaiQueryClient>
     </QueryClientProvider>
   )
 }
+
+function HydrateJotaiQueryClient({
+  children,
+  queryClient,
+}: {
+  children: React.ReactNode
+  queryClient: QueryClient
+}) {
+  useHydrateAtoms(new Map([[queryClientAtom, queryClient]]))
+
+  return children
+}
diff --git a/web/context/web-app-context.tsx b/web/context/web-app-context.tsx
index 2adaf16f593..e04e0b5dc27 100644
--- a/web/context/web-app-context.tsx
+++ b/web/context/web-app-context.tsx
@@ -55,8 +55,13 @@ export const useWebAppStore = create<WebAppStore>(set => ({
 const getShareCodeFromRedirectUrl = (redirectUrl: string | null): string | null => {
   if (!redirectUrl || redirectUrl.length === 0)
     return null
-  const url = new URL(`${window.location.origin}${decodeURIComponent(redirectUrl)}`)
-  return url.pathname.split('/').pop() || null
+  try {
+    const url = new URL(decodeURIComponent(redirectUrl), 'https://dify.local')
+    return url.pathname.split('/').pop() || null
+  }
+  catch {
+    return null
+  }
 }
 const getShareCodeFromPathname = (pathname: string): string | null => {
   const code = pathname.split('/').pop() || null
diff --git a/web/contract/console/access-control.ts b/web/contract/console/access-control.ts
new file mode 100644
index 00000000000..d1fb8306ae2
--- /dev/null
+++ b/web/contract/console/access-control.ts
@@ -0,0 +1,182 @@
+import type { AccessControlTemplateLanguage } from '@/i18n-config/language'
+import type {
+  GetAccessPolicyDetailResponse,
+  GetAppAccessPolicyByAppIdResponse,
+  GetAppUserAccessSettingsResponse,
+  GetDatasetAccessPolicyByDatasetIdResponse,
+  GetDatasetUserAccessSettingsResponse,
+  ResourceOpenScope,
+} from '@/models/access-control'
+import { type } from '@orpc/contract'
+import { base } from '../base'
+
+const appAccessRulesContract = base
+  .route({
+    path: '/workspaces/current/rbac/apps/{appId}/access-policy',
+    method: 'GET',
+  })
+  .input(type<{
+    params: {
+      appId: string
+    }
+    query: {
+      language: AccessControlTemplateLanguage
+    }
+  }>())
+  .output(type<GetAppAccessPolicyByAppIdResponse>())
+
+const appUserAccessSettingsContract = base
+  .route({
+    path: '/workspaces/current/rbac/apps/{appId}/user-access-policies',
+    method: 'GET',
+  })
+  .input(type<{
+    params: {
+      appId: string
+    }
+    query: {
+      language: AccessControlTemplateLanguage
+    }
+  }>())
+  .output(type<GetAppUserAccessSettingsResponse>())
+
+const updateAppUserAccessSettingsContract = base
+  .route({
+    path: '/workspaces/current/rbac/apps/{appId}/users/{accountId}/access-policies',
+    method: 'PUT',
+  })
+  .input(type<{
+    params: {
+      appId: string
+      accountId: string
+    }
+    body: {
+      access_policy_ids: string[]
+    }
+  }>())
+  .output(type<GetAccessPolicyDetailResponse>())
+
+const removeAppAccessPolicyMemberBindingsContract = base
+  .route({
+    path: '/workspaces/current/rbac/apps/{appId}/access-policies/{policyId}/member-bindings',
+    method: 'DELETE',
+  })
+  .input(type<{
+    params: {
+      appId: string
+      policyId: string
+    }
+    body: {
+      account_ids: string[]
+    }
+  }>())
+  .output(type<unknown>())
+
+const updateAppOpenScopeContract = base
+  .route({
+    path: '/workspaces/current/rbac/apps/{appId}/whitelist',
+    method: 'PUT',
+  })
+  .input(type<{
+    params: {
+      appId: string
+    }
+    body: {
+      scope: ResourceOpenScope
+    }
+  }>())
+  .output(type<unknown>())
+
+const datasetAccessRulesContract = base
+  .route({
+    path: '/workspaces/current/rbac/datasets/{datasetId}/access-policy',
+    method: 'GET',
+  })
+  .input(type<{
+    params: {
+      datasetId: string
+    }
+    query: {
+      language: AccessControlTemplateLanguage
+    }
+  }>())
+  .output(type<GetDatasetAccessPolicyByDatasetIdResponse>())
+
+const datasetUserAccessSettingsContract = base
+  .route({
+    path: '/workspaces/current/rbac/datasets/{datasetId}/user-access-policies',
+    method: 'GET',
+  })
+  .input(type<{
+    params: {
+      datasetId: string
+    }
+    query: {
+      language: AccessControlTemplateLanguage
+    }
+  }>())
+  .output(type<GetDatasetUserAccessSettingsResponse>())
+
+const updateDatasetUserAccessSettingsContract = base
+  .route({
+    path: '/workspaces/current/rbac/datasets/{datasetId}/users/{accountId}/access-policies',
+    method: 'PUT',
+  })
+  .input(type<{
+    params: {
+      datasetId: string
+      accountId: string
+    }
+    body: {
+      access_policy_ids: string[]
+    }
+  }>())
+  .output(type<GetAccessPolicyDetailResponse>())
+
+const removeDatasetAccessPolicyMemberBindingsContract = base
+  .route({
+    path: '/workspaces/current/rbac/datasets/{datasetId}/access-policies/{policyId}/member-bindings',
+    method: 'DELETE',
+  })
+  .input(type<{
+    params: {
+      datasetId: string
+      policyId: string
+    }
+    body: {
+      account_ids: string[]
+    }
+  }>())
+  .output(type<unknown>())
+
+const updateDatasetOpenScopeContract = base
+  .route({
+    path: '/workspaces/current/rbac/datasets/{datasetId}/whitelist',
+    method: 'PUT',
+  })
+  .input(type<{
+    params: {
+      datasetId: string
+    }
+    body: {
+      scope: ResourceOpenScope
+    }
+  }>())
+  .output(type<unknown>())
+
+export const rbacAccessConfigContract = {
+  apps: {
+    accessRules: appAccessRulesContract,
+    userAccessSettings: appUserAccessSettingsContract,
+    updateUserAccessSettings: updateAppUserAccessSettingsContract,
+    removeMemberBindings: removeAppAccessPolicyMemberBindingsContract,
+    updateOpenScope: updateAppOpenScopeContract,
+  },
+  datasets: {
+    accessRules: datasetAccessRulesContract,
+    userAccessSettings: datasetUserAccessSettingsContract,
+    updateUserAccessSettings: updateDatasetUserAccessSettingsContract,
+    removeMemberBindings: removeDatasetAccessPolicyMemberBindingsContract,
+    updateOpenScope: updateDatasetOpenScopeContract,
+  },
+}
diff --git a/web/contract/console/explore.ts b/web/contract/console/explore.ts
index 977efab8a1e..0ff93471360 100644
--- a/web/contract/console/explore.ts
+++ b/web/contract/console/explore.ts
@@ -1,3 +1,4 @@
+import type { Subject } from '@dify/contracts/enterprise/types.gen'
 import type { ChatConfig } from '@/app/components/base/chat/types'
 import type { AccessMode } from '@/models/access-control'
 import type { Banner } from '@/models/app'
@@ -35,6 +36,12 @@ type AppAccessModeResponse = {
   accessMode: AccessMode
 }
 
+type UpdateAppAccessModeBody = {
+  appId: string
+  accessMode: AccessMode
+  subjects?: Pick<Subject, 'subjectId' | 'subjectType'>[]
+}
+
 export const exploreAppsContract = base
   .route({
     path: '/explore/apps',
@@ -96,6 +103,14 @@ export const exploreInstalledAppAccessModeContract = base
   .input(type<{ query: { appId: string } }>())
   .output(type<AppAccessModeResponse>())
 
+export const exploreInstalledAppAccessModeUpdateContract = base
+  .route({
+    path: '/enterprise/webapp/app/access-mode',
+    method: 'POST',
+  })
+  .input(type<{ body: UpdateAppAccessModeBody }>())
+  .output(type<unknown>())
+
 export const exploreInstalledAppParametersContract = base
   .route({
     path: '/installed-apps/{appId}/parameters',
diff --git a/web/contract/console/files.ts b/web/contract/console/files.ts
new file mode 100644
index 00000000000..fb7b97b8a38
--- /dev/null
+++ b/web/contract/console/files.ts
@@ -0,0 +1,16 @@
+import type { PostFilesUploadResponse } from '@dify/contracts/api/console/files/types.gen'
+import { type } from '@orpc/contract'
+import { base } from '../base'
+
+export const fileUploadContract = base
+  .route({
+    path: '/files/upload',
+    method: 'POST',
+    successStatus: 201,
+  })
+  .input(type<{
+    body: {
+      file: File
+    }
+  }>())
+  .output(type<PostFilesUploadResponse>())
diff --git a/web/contract/router.ts b/web/contract/router.ts
index 2933192304f..2f9b5de318d 100644
--- a/web/contract/router.ts
+++ b/web/contract/router.ts
@@ -1,6 +1,7 @@
 import type { InferContractRouterInputs } from '@orpc/contract'
 import { contract as communityContract } from '@dify/contracts/api/console/orpc.gen'
 import { contract as enterpriseContract } from '@dify/contracts/enterprise/orpc.gen'
+import { rbacAccessConfigContract } from './console/access-control'
 import {
   appDeleteContract,
   appListContract,
@@ -15,6 +16,7 @@ import {
   exploreAppsContract,
   exploreBannersContract,
   exploreInstalledAppAccessModeContract,
+  exploreInstalledAppAccessModeUpdateContract,
   exploreInstalledAppMetaContract,
   exploreInstalledAppParametersContract,
   exploreInstalledAppPinContract,
@@ -22,6 +24,7 @@ import {
   exploreInstalledAppUninstallContract,
   learnDifyAppsContract,
 } from './console/explore'
+import { fileUploadContract } from './console/files'
 import { changePreferredProviderTypeContract, modelProvidersModelsContract } from './console/model-providers'
 import { notificationContract, notificationDismissContract } from './console/notification'
 import { pluginCheckInstalledContract, pluginLatestVersionsContract } from './console/plugins'
@@ -98,11 +101,6 @@ export const marketplaceRouterContract = {
 
 export type MarketPlaceInputs = InferContractRouterInputs<typeof marketplaceRouterContract>
 
-// Hand-written console contracts below are temporary overrides for gaps in the
-// generated community contract. Prefer fixing backend OpenAPI annotations so
-// generated contracts include accurate method, path, input, and output types;
-// once generated contracts are correct, the matching hand-written contracts
-// should be removed instead of kept in parallel.
 export const consoleRouterContract = {
   enterprise: enterpriseContract,
   ...communityContract,
@@ -114,7 +112,11 @@ export const consoleRouterContract = {
     star: appStarContract,
     unstar: appUnstarContract,
     workflowOnlineUsers: workflowOnlineUsersContract,
+    byAppId: {
+      ...communityContract.apps.byAppId,
+    },
   },
+  agent: communityContract.agent,
   explore: {
     ...communityContract.explore,
     apps: exploreAppsContract,
@@ -124,6 +126,7 @@ export const consoleRouterContract = {
     uninstallInstalledApp: exploreInstalledAppUninstallContract,
     updateInstalledApp: exploreInstalledAppPinContract,
     appAccessMode: exploreInstalledAppAccessModeContract,
+    updateAppAccessMode: exploreInstalledAppAccessModeUpdateContract,
     installedAppParameters: exploreInstalledAppParametersContract,
     installedAppMeta: exploreInstalledAppMetaContract,
     banners: exploreBannersContract,
@@ -135,6 +138,13 @@ export const consoleRouterContract = {
     parameters: trialAppParametersContract,
     workflows: trialAppWorkflowsContract,
   },
+  files: {
+    ...communityContract.files,
+    upload: {
+      ...communityContract.files.upload,
+      post: fileUploadContract,
+    },
+  },
   modelProviders: {
     models: modelProvidersModelsContract,
     changePreferredProviderType: changePreferredProviderTypeContract,
@@ -143,6 +153,7 @@ export const consoleRouterContract = {
     checkInstalled: pluginCheckInstalledContract,
     latestVersions: pluginLatestVersionsContract,
   },
+  rbacAccessConfig: rbacAccessConfigContract,
   snippets: {
     list: listCustomizedSnippetsContract,
     create: createCustomizedSnippetContract,
diff --git a/web/docker/entrypoint.sh b/web/docker/entrypoint.sh
index 1ace4590655..31872154d70 100755
--- a/web/docker/entrypoint.sh
+++ b/web/docker/entrypoint.sh
@@ -56,6 +56,7 @@ export NEXT_PUBLIC_ENABLE_WEBSITE_FIRECRAWL=${ENABLE_WEBSITE_FIRECRAWL:-true}
 export NEXT_PUBLIC_ENABLE_WEBSITE_WATERCRAWL=${ENABLE_WEBSITE_WATERCRAWL:-true}
 export NEXT_PUBLIC_ENABLE_SINGLE_DOLLAR_LATEX=${NEXT_PUBLIC_ENABLE_SINGLE_DOLLAR_LATEX:-false}
 export NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW=${NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW:-false}
+export NEXT_PUBLIC_ENABLE_AGENT_V2=${NEXT_PUBLIC_ENABLE_AGENT_V2:-${ENABLE_AGENT_V2:-false}}
 export NEXT_PUBLIC_LOOP_NODE_MAX_COUNT=${LOOP_NODE_MAX_COUNT}
 export NEXT_PUBLIC_MAX_PARALLEL_LIMIT=${MAX_PARALLEL_LIMIT}
 export NEXT_PUBLIC_MAX_ITERATIONS_NUM=${MAX_ITERATIONS_NUM}
diff --git a/web/env.ts b/web/env.ts
index 0bf5d4c3132..01610267b6d 100644
--- a/web/env.ts
+++ b/web/env.ts
@@ -63,6 +63,7 @@ const clientSchema = {
    * The deployment edition, SELF_HOSTED
    */
   NEXT_PUBLIC_EDITION: z.enum(['SELF_HOSTED', 'CLOUD']).default('SELF_HOSTED'),
+  NEXT_PUBLIC_ENABLE_AGENT_V2: coercedBoolean.default(false),
   /**
    * Enable preview features that are still in development.
    * Currently gates the `/create` and `/refine` slash commands in the
@@ -196,6 +197,7 @@ export const env = createEnv({
     NEXT_PUBLIC_DEPLOY_ENV: isServer ? process.env.NEXT_PUBLIC_DEPLOY_ENV : getRuntimeEnvFromBody('deployEnv'),
     NEXT_PUBLIC_DISABLE_UPLOAD_IMAGE_AS_ICON: isServer ? process.env.NEXT_PUBLIC_DISABLE_UPLOAD_IMAGE_AS_ICON : getRuntimeEnvFromBody('disableUploadImageAsIcon'),
     NEXT_PUBLIC_EDITION: isServer ? process.env.NEXT_PUBLIC_EDITION : getRuntimeEnvFromBody('edition'),
+    NEXT_PUBLIC_ENABLE_AGENT_V2: isServer ? process.env.NEXT_PUBLIC_ENABLE_AGENT_V2 : getRuntimeEnvFromBody('enableAgentV2'),
     NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW: isServer ? process.env.NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW : getRuntimeEnvFromBody('enableFeaturePreview'),
 
     /**
@@ -252,6 +254,11 @@ export const env = createEnv({
 type ClientEnvKey = keyof typeof clientSchema
 type DatasetKey = CamelCase<Replace<ClientEnvKey, typeof CLIENT_ENV_PREFIX>>
 
+function getDatasetAttributeName(envKey: ClientEnvKey) {
+  const datasetName = kebabCase(slice(envKey, length(CLIENT_ENV_PREFIX))).replace(/-(\d)/g, '$1')
+  return concat('data-', datasetName)
+}
+
 /**
  * Browser-only function to get runtime env value from HTML body dataset.
  */
@@ -274,7 +281,7 @@ export function getDatasetMap() {
   return ObjectFromEntries(
     ObjectKeys(clientSchema)
       .map(envKey => [
-        concat('data-', kebabCase(slice(envKey, length(CLIENT_ENV_PREFIX)))),
+        getDatasetAttributeName(envKey),
         env[envKey],
       ]),
   )
diff --git a/web/eslint.config.mjs b/web/eslint.config.mjs
index 3a9af0fafcd..1b4afefef6e 100644
--- a/web/eslint.config.mjs
+++ b/web/eslint.config.mjs
@@ -197,7 +197,7 @@ export default antfu(
         'error',
         {
           name: 'localStorage',
-          message: 'Do not use localStorage directly. Use foxact/use-local-storage instead.',
+          message: 'Do not use localStorage directly. Use a foxact storage boundary instead; prefer feature-owned createLocalStorageState for shared storage.',
         },
       ],
       'no-restricted-properties': [
@@ -205,19 +205,19 @@ export default antfu(
         {
           object: 'window',
           property: 'localStorage',
-          message: 'Do not use window.localStorage directly. Use foxact/use-local-storage instead.',
+          message: 'Do not use window.localStorage directly. Use a foxact storage boundary instead; prefer feature-owned createLocalStorageState for shared storage.',
         },
         {
           object: 'globalThis',
           property: 'localStorage',
-          message: 'Do not use globalThis.localStorage directly. Use foxact/use-local-storage instead.',
+          message: 'Do not use globalThis.localStorage directly. Use a foxact storage boundary instead; prefer feature-owned createLocalStorageState for shared storage.',
         },
       ],
       'no-restricted-syntax': [
         'error',
         {
           selector: 'ImportDeclaration[source.value="ahooks"] ImportSpecifier[imported.name="useLocalStorageState"]',
-          message: 'Do not use ahooks useLocalStorageState. Use foxact/use-local-storage instead.',
+          message: 'Do not use ahooks useLocalStorageState. Use foxact storage hooks instead.',
         },
       ],
     },
diff --git a/web/eslint.constants.mjs b/web/eslint.constants.mjs
index 3a7b858ef90..b6180b932c6 100644
--- a/web/eslint.constants.mjs
+++ b/web/eslint.constants.mjs
@@ -1,6 +1,7 @@
 export const GENERATED_IGNORES = [
   'storybook-static/',
   '.next/',
+  '.vinext/',
   'next/',
   'next-env.d.ts',
   'dist/',
diff --git a/web/features/agent-v2/__tests__/feature-flag.spec.ts b/web/features/agent-v2/__tests__/feature-flag.spec.ts
new file mode 100644
index 00000000000..1789543cf7d
--- /dev/null
+++ b/web/features/agent-v2/__tests__/feature-flag.spec.ts
@@ -0,0 +1,18 @@
+describe('Agent v2 feature flags', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.resetModules()
+  })
+
+  it('reads the client-visible Agent v2 flag from NEXT_PUBLIC_ENABLE_AGENT_V2', async () => {
+    vi.doMock('@/env', () => ({
+      env: {
+        NEXT_PUBLIC_ENABLE_AGENT_V2: true,
+      },
+    }))
+
+    const { isAgentV2Enabled } = await import('../feature-flag')
+
+    expect(isAgentV2Enabled()).toBe(true)
+  })
+})
diff --git a/web/features/agent-v2/agent-composer/__tests__/store.spec.ts b/web/features/agent-v2/agent-composer/__tests__/store.spec.ts
new file mode 100644
index 00000000000..302d04c2888
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/__tests__/store.spec.ts
@@ -0,0 +1,470 @@
+import type { AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
+import { describe, expect, it } from 'vitest'
+import { agentSoulConfigToFormState, formStateToAgentSoulConfig } from '../conversions'
+import { defaultAgentSoulConfigFormState } from '../form-state'
+
+describe('agent composer store conversions', () => {
+  it('should hydrate editable form state from an AgentSoulConfig and preserve it in publish payload', () => {
+    const baseConfig: AgentSoulConfig = {
+      app_features: {
+        opening_statement: 'Hello',
+        suggested_questions: ['What changed?'],
+      },
+      env: {
+        variables: [
+          {
+            key: 'REGION',
+            value: 'us-east-1',
+          },
+        ],
+        secret_refs: [
+          {
+            id: 'secret-1',
+            key: 'OPENAI_API_KEY',
+            ref: 'credential-1',
+            value: 'credential-1',
+          },
+        ],
+      },
+      knowledge: {
+        datasets: [
+          {
+            id: 'dataset-1',
+            name: 'Product Docs',
+            description: 'Docs corpus',
+          },
+        ],
+        query_config: {
+          query: 'release notes',
+          score_threshold: 0.72,
+          score_threshold_enabled: true,
+          top_k: 8,
+        },
+        query_mode: 'user_query',
+      },
+      model: {
+        model: 'gpt-4.1',
+        model_provider: 'openai',
+        plugin_id: 'openai',
+      },
+      prompt: {
+        system_prompt: 'Be precise.',
+      },
+      skills_files: {
+        files: [
+          {
+            id: 'file-1',
+            name: 'guide.md',
+            type: 'markdown',
+          },
+        ],
+        skills: [
+          {
+            id: 'skill-1',
+            file_id: 'archive-file-1',
+            full_archive_file_id: 'archive-file-1',
+            full_archive_key: 'research-skill/.DIFY-SKILL-FULL.zip',
+            name: 'Research Skill',
+            path: 'research-skill',
+            skill_md_file_id: 'skill-md-file-1',
+            skill_md_key: 'research-skill/SKILL.md',
+          },
+        ],
+      },
+      tools: {
+        cli_tools: [
+          {
+            tool_name: 'run-tests',
+            name: 'Run Tests',
+            install_command: 'pnpm install',
+            pre_authorized: true,
+            env: {
+              variables: [
+                {
+                  key: 'NODE_ENV',
+                  value: 'test',
+                },
+              ],
+            },
+          },
+        ],
+        dify_tools: [
+          {
+            provider: 'DuckDuckGo',
+            provider_id: 'duckduckgo',
+            provider_type: 'builtin',
+            tool_name: 'ddg_search',
+            name: 'DuckDuckGo Search',
+            description: 'Search the web.',
+            runtime_parameters: {
+              query: 'latest docs',
+              used_in_agent_nodes: true,
+            },
+          },
+        ],
+      },
+    }
+
+    const formState = agentSoulConfigToFormState(baseConfig)
+    const publishConfig = formStateToAgentSoulConfig({
+      baseConfig,
+      formState,
+      currentModel: formState.model,
+    })
+
+    expect(formState).toMatchObject({
+      prompt: 'Be precise.',
+      model: {
+        model: 'gpt-4.1',
+        provider: 'openai',
+        plugin_id: 'openai',
+      },
+      skills: [
+        {
+          fileId: 'archive-file-1',
+          fullArchiveFileId: 'archive-file-1',
+          fullArchiveKey: 'research-skill/.DIFY-SKILL-FULL.zip',
+          id: 'skill-1',
+          name: 'Research Skill',
+          path: 'research-skill',
+          skillMdFileId: 'skill-md-file-1',
+          skillMdKey: 'research-skill/SKILL.md',
+        },
+      ],
+      files: [
+        {
+          id: 'file-1',
+          name: 'guide.md',
+          icon: 'markdown',
+        },
+      ],
+      knowledgeRetrievals: [
+        expect.objectContaining({
+          id: 'dataset-1',
+          name: 'Product Docs',
+          queryMode: 'custom',
+          customQuery: 'release notes',
+        }),
+      ],
+      envVariables: [
+        expect.objectContaining({
+          key: 'REGION',
+          scope: 'plain',
+          value: 'us-east-1',
+        }),
+        expect.objectContaining({
+          key: 'OPENAI_API_KEY',
+          masked: true,
+          scope: 'secret',
+          value: 'credential-1',
+        }),
+      ],
+    })
+    expect(formState.tools).toEqual(expect.arrayContaining([
+      expect.objectContaining({
+        id: 'duckduckgo',
+        kind: 'provider',
+        actions: [
+          expect.objectContaining({
+            toolName: 'ddg_search',
+          }),
+        ],
+      }),
+      expect.objectContaining({
+        id: 'run-tests',
+        kind: 'cli',
+        installCommand: 'pnpm install',
+      }),
+    ]))
+    expect(formState.toolSettings['duckduckgo:ddg_search']).toEqual({
+      query: 'latest docs',
+      used_in_agent_nodes: true,
+    })
+
+    expect(publishConfig.skills_files).toMatchObject(baseConfig.skills_files!)
+    expect(publishConfig.tools?.dify_tools).toEqual([
+      expect.objectContaining({
+        provider: 'DuckDuckGo',
+        provider_id: 'duckduckgo',
+        provider_type: 'builtin',
+        tool_name: 'ddg_search',
+        credential_type: 'unauthorized',
+        runtime_parameters: {
+          query: 'latest docs',
+          used_in_agent_nodes: true,
+        },
+      }),
+    ])
+    expect(publishConfig.tools?.dify_tools?.[0]).not.toHaveProperty('name')
+    expect(publishConfig.tools?.cli_tools).toEqual([
+      expect.objectContaining({
+        name: 'Run Tests',
+        tool_name: 'run-tests',
+        install_command: 'pnpm install',
+        enabled: false,
+        pre_authorized: false,
+      }),
+    ])
+    expect(publishConfig.knowledge).toMatchObject({
+      datasets: [
+        {
+          id: 'dataset-1',
+          name: 'Product Docs',
+          description: 'Docs corpus',
+        },
+      ],
+      query_config: {
+        query: 'release notes',
+        score_threshold: 0.72,
+        score_threshold_enabled: true,
+        top_k: 8,
+      },
+      query_mode: 'user_query',
+    })
+    expect(publishConfig.env).toMatchObject({
+      variables: [
+        expect.objectContaining({
+          key: 'REGION',
+          value: 'us-east-1',
+        }),
+      ],
+      secret_refs: [
+        expect.objectContaining({
+          key: 'OPENAI_API_KEY',
+          value: 'credential-1',
+        }),
+      ],
+    })
+  })
+
+  it('should hydrate legacy secret refs from ref when value is absent', () => {
+    const formState = agentSoulConfigToFormState({
+      env: {
+        secret_refs: [
+          {
+            id: 'secret-1',
+            key: 'OPENAI_API_KEY',
+            ref: 'credential-legacy',
+          },
+        ],
+      },
+    })
+
+    expect(formState.envVariables).toEqual([
+      {
+        id: 'secret-1',
+        key: 'OPENAI_API_KEY',
+        masked: true,
+        scope: 'secret',
+        value: 'credential-legacy',
+      },
+    ])
+  })
+
+  it('should keep unauthorized credential type when no-auth tool settings change', () => {
+    const publishConfig = formStateToAgentSoulConfig({
+      formState: {
+        ...defaultAgentSoulConfigFormState,
+        tools: [
+          {
+            id: 'duckduckgo',
+            kind: 'provider',
+            name: 'duckduckgo',
+            iconClassName: 'i-custom-public-other-default-tool-icon text-text-tertiary',
+            credentialVariant: 'none',
+            actions: [
+              {
+                id: 'duckduckgo:ddg_search',
+                name: 'DuckDuckGo Search',
+                toolName: 'ddg_search',
+                description: 'Search the web.',
+              },
+            ],
+          },
+        ],
+        toolSettings: {
+          'duckduckgo:ddg_search': {
+            query: 'updated query',
+          },
+        },
+      },
+    })
+
+    expect(publishConfig.tools?.dify_tools).toEqual([
+      expect.objectContaining({
+        provider_id: 'duckduckgo',
+        tool_name: 'ddg_search',
+        credential_type: 'unauthorized',
+        runtime_parameters: {
+          query: 'updated query',
+        },
+      }),
+    ])
+  })
+
+  it('should derive model plugin_id from the selected provider when publishing', () => {
+    const publishConfig = formStateToAgentSoulConfig({
+      baseConfig: {
+        model: {
+          model: 'gpt-4.1',
+          model_provider: 'langgenius/openai/openai',
+          plugin_id: 'langgenius/openai',
+        },
+      },
+      formState: defaultAgentSoulConfigFormState,
+      currentModel: {
+        provider: 'langgenius/anthropic/anthropic',
+        model: 'claude-sonnet-4',
+      },
+    })
+
+    expect(publishConfig.model).toMatchObject({
+      model: 'claude-sonnet-4',
+      model_provider: 'langgenius/anthropic/anthropic',
+      plugin_id: 'langgenius/anthropic',
+    })
+  })
+
+  it('should not hydrate a knowledge retrieval row when the config has no datasets', () => {
+    const formState = agentSoulConfigToFormState({
+      knowledge: {
+        datasets: [],
+        query_config: {
+          top_k: 4,
+        },
+        query_mode: 'generated_query',
+      },
+    })
+
+    expect(formState.knowledgeRetrievals).toEqual([])
+  })
+
+  it('should omit incomplete environment variables from the publish payload', () => {
+    const publishConfig = formStateToAgentSoulConfig({
+      formState: {
+        ...defaultAgentSoulConfigFormState,
+        envVariables: [
+          {
+            id: 'empty-env',
+            key: '',
+            value: '',
+            scope: 'plain',
+          },
+          {
+            id: 'empty-value-env',
+            key: 'EMPTY_VALUE',
+            value: '',
+            scope: 'plain',
+          },
+          {
+            id: 'empty-key-env',
+            key: '',
+            value: 'secret',
+            scope: 'plain',
+          },
+          {
+            id: 'invalid-key-env',
+            key: '1BAD',
+            value: 'secret',
+            scope: 'plain',
+          },
+          {
+            id: 'valid-env',
+            key: ' REGION ',
+            value: 'us-east-1',
+            scope: 'plain',
+          },
+          {
+            id: 'empty-secret',
+            key: '',
+            value: '',
+            scope: 'secret',
+          },
+          {
+            id: 'empty-secret-value',
+            key: 'EMPTY_SECRET_VALUE',
+            value: '',
+            scope: 'secret',
+          },
+          {
+            id: 'invalid-secret-key',
+            key: 'BAD-SECRET',
+            value: 'secret',
+            scope: 'secret',
+          },
+          {
+            id: 'valid-secret',
+            key: ' OPENAI_API_KEY ',
+            value: '********',
+            scope: 'secret',
+            masked: true,
+          },
+        ],
+        tools: [
+          {
+            id: 'run-tests',
+            name: 'Run Tests',
+            kind: 'cli',
+            envVariables: [
+              {
+                id: 'empty-cli-env',
+                key: '',
+                value: '',
+                scope: 'plain',
+              },
+              {
+                id: 'invalid-cli-env',
+                key: 'BAD-CLI',
+                value: 'test',
+                scope: 'plain',
+              },
+              {
+                id: 'valid-cli-env',
+                key: 'NODE_ENV',
+                value: 'test',
+                scope: 'plain',
+              },
+            ],
+          },
+        ],
+      },
+    })
+
+    expect(publishConfig.env).toEqual({
+      variables: [
+        {
+          id: 'valid-env',
+          key: 'REGION',
+          name: 'REGION',
+          value: 'us-east-1',
+          variable: 'REGION',
+        },
+      ],
+      secret_refs: [
+        {
+          id: 'valid-secret',
+          key: 'OPENAI_API_KEY',
+          name: 'OPENAI_API_KEY',
+          value: '********',
+          variable: 'OPENAI_API_KEY',
+        },
+      ],
+    })
+    expect(publishConfig.tools?.cli_tools?.[0]?.env).toEqual({
+      variables: [
+        {
+          id: 'valid-cli-env',
+          key: 'NODE_ENV',
+          name: 'NODE_ENV',
+          value: 'test',
+          variable: 'NODE_ENV',
+        },
+      ],
+      secret_refs: [],
+    })
+    expect(publishConfig.tools?.cli_tools?.[0]).toMatchObject({
+      enabled: false,
+      pre_authorized: false,
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-composer/conversions.ts b/web/features/agent-v2/agent-composer/conversions.ts
new file mode 100644
index 00000000000..3411bd6556c
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/conversions.ts
@@ -0,0 +1,501 @@
+import type { AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type {
+  AgentCliTool,
+  AgentFileNode,
+  AgentKnowledgeRetrievalItem,
+  AgentProviderTool,
+  AgentSkill,
+  AgentSoulConfigFormState,
+  AgentTool,
+  EnvVariable,
+} from './form-state'
+import type { DefaultModel } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { checkKey } from '@/utils/var'
+import { defaultAgentSoulConfigFormState } from './form-state'
+
+type AgentSoulDifyToolConfig = NonNullable<NonNullable<AgentSoulConfig['tools']>['dify_tools']>[number]
+type AgentSoulCliToolConfig = NonNullable<NonNullable<AgentSoulConfig['tools']>['cli_tools']>[number]
+type AgentSoulToolRuntimeParameterValue = NonNullable<AgentSoulDifyToolConfig['runtime_parameters']>[string]
+type AgentSoulFileRefConfig = NonNullable<NonNullable<AgentSoulConfig['skills_files']>['files']>[number]
+type AgentSoulEnvVariableConfig = NonNullable<NonNullable<AgentSoulConfig['env']>['variables']>[number]
+
+const flattenFileNodes = (files: AgentFileNode[]): AgentFileNode[] => files.flatMap(file => [
+  file,
+  ...flattenFileNodes(file.children ?? []),
+])
+
+const toSkillRefs = (skills: AgentSkill[]) => skills.map(skill => ({
+  description: skill.description,
+  file_id: skill.fileId,
+  full_archive_file_id: skill.fullArchiveFileId,
+  full_archive_key: skill.fullArchiveKey,
+  id: skill.id,
+  manifest_files: skill.files,
+  name: skill.name,
+  path: skill.path,
+  skill_md_file_id: skill.skillMdFileId,
+  skill_md_key: skill.skillMdKey,
+}))
+
+const toSkillFormState = (config?: AgentSoulConfig): AgentSkill[] => (
+  config?.skills_files?.skills ?? []
+).flatMap((skill) => {
+  const id = skill.id ?? skill.file_id ?? skill.path
+  if (!id)
+    return []
+
+  return [{
+    description: skill.description ?? undefined,
+    fileId: skill.file_id ?? undefined,
+    files: skill.manifest_files ?? undefined,
+    fullArchiveFileId: skill.full_archive_file_id ?? undefined,
+    fullArchiveKey: skill.full_archive_key ?? undefined,
+    id,
+    name: skill.name ?? id,
+    path: skill.path ?? undefined,
+    skillMdFileId: skill.skill_md_file_id ?? undefined,
+    skillMdKey: skill.skill_md_key ?? undefined,
+  }]
+})
+
+const toFileIcon = (file: AgentSoulFileRefConfig): AgentFileNode['icon'] => {
+  const type = file.type?.toLowerCase()
+
+  if (type === 'image' || type === 'pdf' || type === 'markdown' || type === 'json' || type === 'table' || type === 'archive' || type === 'code' || type === 'text' || type === 'folder')
+    return type
+
+  return 'file'
+}
+
+const toFileFormState = (config?: AgentSoulConfig): AgentFileNode[] => (
+  config?.skills_files?.files ?? []
+).flatMap((file) => {
+  const id = file.id ?? file.file_id ?? file.upload_file_id ?? file.reference ?? file.remote_url ?? file.url
+  if (!id)
+    return []
+
+  return [{
+    id,
+    name: file.name ?? id,
+    icon: toFileIcon(file),
+    driveKey: file.drive_key ?? undefined,
+  }]
+})
+
+const toFileRefs = (files: AgentFileNode[]) => flattenFileNodes(files).map(file => ({
+  ...(file.driveKey ? { drive_key: file.driveKey } : {}),
+  id: file.id,
+  name: file.name,
+  type: file.icon,
+}))
+
+const getKnowledgeRetrievalName = (item: AgentKnowledgeRetrievalItem) => item.name ?? item.nameKey ?? item.id
+
+const toKnowledgeDatasets = (knowledgeRetrievals: AgentKnowledgeRetrievalItem[]) => knowledgeRetrievals.flatMap((item) => {
+  if (item.selectedDatasets?.length) {
+    return item.selectedDatasets.map(dataset => ({
+      description: dataset.description,
+      id: dataset.id,
+      name: dataset.name,
+    }))
+  }
+  if (item.datasetRefs?.length)
+    return item.datasetRefs
+
+  return [{
+    id: item.id,
+    name: getKnowledgeRetrievalName(item),
+  }]
+})
+
+const toKnowledgeRetrievalFormState = (config?: AgentSoulConfig): AgentKnowledgeRetrievalItem[] => {
+  const knowledge = config?.knowledge
+  const datasets = knowledge?.datasets ?? []
+
+  if (datasets.length === 0)
+    return []
+
+  return [{
+    id: datasets[0]?.id ?? 'knowledge-retrieval',
+    name: datasets[0]?.name ?? 'Knowledge Retrieval',
+    queryMode: knowledge?.query_mode === 'user_query' ? 'custom' : 'agent',
+    customQuery: knowledge?.query_config?.query ?? undefined,
+    datasetRefs: datasets,
+    multipleRetrievalConfig: {
+      top_k: knowledge?.query_config?.top_k ?? 4,
+      score_threshold: knowledge?.query_config?.score_threshold ?? null,
+      reranking_enable: false,
+    },
+  }]
+}
+
+const toKnowledgeConfig = (
+  baseKnowledge: AgentSoulConfig['knowledge'],
+  knowledgeRetrievals: AgentKnowledgeRetrievalItem[],
+): AgentSoulConfig['knowledge'] => {
+  const primaryRetrieval = knowledgeRetrievals.find(retrieval =>
+    retrieval.queryMode === 'custom'
+    || retrieval.customQuery
+    || retrieval.multipleRetrievalConfig
+    || retrieval.selectedDatasets?.length,
+  ) ?? knowledgeRetrievals[0]
+  const multipleRetrievalConfig = primaryRetrieval?.multipleRetrievalConfig
+  const scoreThreshold = multipleRetrievalConfig?.score_threshold
+
+  return {
+    ...baseKnowledge,
+    datasets: toKnowledgeDatasets(knowledgeRetrievals),
+    query_mode: primaryRetrieval?.queryMode === 'custom' ? 'user_query' : 'generated_query',
+    query_config: {
+      ...baseKnowledge?.query_config,
+      query: primaryRetrieval?.queryMode === 'custom' ? primaryRetrieval.customQuery : null,
+      score_threshold: scoreThreshold,
+      score_threshold_enabled: scoreThreshold !== undefined && scoreThreshold !== null,
+      top_k: multipleRetrievalConfig?.top_k ?? baseKnowledge?.query_config?.top_k,
+    },
+  }
+}
+
+const isToolRuntimeParameterValue = (value: unknown): value is AgentSoulToolRuntimeParameterValue => {
+  if (value === null || typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean')
+    return true
+
+  if (!Array.isArray(value))
+    return false
+
+  return value.every(item => typeof item === 'string')
+    || value.every(item => typeof item === 'number')
+    || value.every(item => typeof item === 'boolean')
+}
+
+const toToolRuntimeParameters = (settings: Record<string, unknown> | undefined) => {
+  const runtimeParameters: Record<string, AgentSoulToolRuntimeParameterValue> = {}
+
+  Object.entries(settings ?? {}).forEach(([key, value]) => {
+    if (isToolRuntimeParameterValue(value))
+      runtimeParameters[key] = value
+  })
+
+  return runtimeParameters
+}
+
+const getDifyToolActionId = (tool: AgentSoulDifyToolConfig) => `${tool.provider_id ?? tool.provider ?? tool.plugin_id ?? 'provider'}:${tool.tool_name ?? tool.name ?? 'tool'}`
+
+const toCredentialVariant = (credentialType: AgentSoulDifyToolConfig['credential_type']) => {
+  if (credentialType === 'api-key')
+    return 'authorized' as const
+
+  if (credentialType === 'unauthorized')
+    return 'unauthorized' as const
+
+  return 'none' as const
+}
+
+const toProviderToolFormState = (config?: AgentSoulConfig): {
+  tools: AgentProviderTool[]
+  toolSettings: AgentSoulConfigFormState['toolSettings']
+} => {
+  const toolByProviderId = new Map<string, AgentProviderTool>()
+  const toolSettings: AgentSoulConfigFormState['toolSettings'] = {}
+
+  for (const tool of config?.tools?.dify_tools ?? []) {
+    const providerId = tool.provider_id ?? tool.provider ?? tool.plugin_id ?? ''
+    const toolName = tool.tool_name ?? tool.name ?? ''
+    if (!providerId || !toolName)
+      continue
+
+    const actionId = getDifyToolActionId(tool)
+    const existingTool = toolByProviderId.get(providerId)
+    const action = {
+      id: actionId,
+      name: tool.name ?? toolName,
+      toolName,
+      description: tool.description ?? '',
+    }
+
+    toolSettings[actionId] = tool.runtime_parameters ?? {}
+
+    if (existingTool) {
+      existingTool.actions.push(action)
+      continue
+    }
+
+    toolByProviderId.set(providerId, {
+      id: providerId,
+      name: tool.provider ?? providerId,
+      kind: 'provider',
+      iconClassName: 'i-custom-public-other-default-tool-icon text-text-tertiary',
+      providerType: tool.provider_type,
+      allowDelete: tool.credential_type === 'api-key' || tool.credential_type === 'unauthorized',
+      credentialId: tool.credential_ref?.id ?? undefined,
+      credentialKey: tool.credential_type === 'api-key'
+        ? 'agentDetail.configure.tools.credential.authOne'
+        : undefined,
+      credentialType: tool.credential_type,
+      credentialVariant: toCredentialVariant(tool.credential_type),
+      actions: [action],
+    })
+  }
+
+  return {
+    tools: Array.from(toolByProviderId.values()),
+    toolSettings,
+  }
+}
+
+const toDifyToolConfigs = (
+  tools: AgentTool[],
+  toolSettings: Record<string, Record<string, unknown>>,
+) => tools.flatMap((tool) => {
+  if (tool.kind !== 'provider')
+    return []
+
+  return tool.actions.map(action => ({
+    enabled: true,
+    provider: tool.name,
+    provider_id: tool.id,
+    provider_type: tool.providerType ?? 'builtin',
+    tool_name: action.toolName,
+    runtime_parameters: toToolRuntimeParameters(toolSettings[action.id]),
+    credential_type: tool.credentialType ?? (tool.credentialVariant === 'authorized' ? 'api-key' as const : 'unauthorized' as const),
+    credential_ref: tool.credentialId
+      ? {
+          id: tool.credentialId,
+          provider: tool.id,
+          type: 'provider' as const,
+        }
+      : undefined,
+  }))
+})
+
+const toEnvVariableValue = (variable: AgentSoulEnvVariableConfig) => {
+  const value = variable.value ?? variable.default ?? ''
+  if (value === null)
+    return ''
+
+  if (typeof value === 'string')
+    return value
+
+  return JSON.stringify(value)
+}
+
+const toCliEnvVariables = (tool: AgentSoulCliToolConfig): EnvVariable[] => [
+  ...(tool.env?.variables ?? []).map((variable): EnvVariable => {
+    const key = variable.key ?? variable.name ?? variable.variable ?? variable.env_name ?? ''
+    return {
+      id: variable.env_name ?? variable.key ?? variable.name ?? variable.variable ?? key,
+      key,
+      value: toEnvVariableValue(variable),
+      scope: 'plain',
+    }
+  }),
+  ...(tool.env?.secret_refs ?? []).map((secret): EnvVariable => {
+    const key = secret.key ?? secret.name ?? secret.variable ?? secret.env_name ?? ''
+    const value = secret.value ?? secret.ref ?? secret.credential_id ?? ''
+    return {
+      id: secret.id ?? secret.ref ?? secret.credential_id ?? key,
+      key,
+      value,
+      scope: 'secret',
+      masked: true,
+    }
+  }),
+].filter(variable => variable.key)
+
+const toCliToolFormState = (config?: AgentSoulConfig): AgentCliTool[] => (
+  config?.tools?.cli_tools ?? []
+).flatMap((tool) => {
+  const id = tool.tool_name ?? tool.id ?? tool.name
+  if (!id)
+    return []
+
+  return [{
+    id,
+    name: tool.name ?? tool.label ?? tool.tool_name ?? id,
+    kind: 'cli',
+    action: tool.pre_authorized ? 'preAuthorize' : undefined,
+    installCommand: tool.install_command ?? tool.install_commands?.[0] ?? tool.install ?? tool.setup_command ?? undefined,
+    envVariables: toCliEnvVariables(tool),
+  }]
+})
+
+const hasValidEnvKey = (variable: EnvVariable) => checkKey(variable.key.trim(), false) === true
+
+const hasEnvValue = (variable: EnvVariable) => variable.value.trim().length > 0
+
+const isPublishablePlainEnvVariable = (variable: EnvVariable) => (
+  variable.scope === 'plain' && hasValidEnvKey(variable) && hasEnvValue(variable)
+)
+
+const isPublishableSecretEnvVariable = (variable: EnvVariable) => (
+  variable.scope === 'secret' && hasValidEnvKey(variable) && hasEnvValue(variable)
+)
+
+const toCliToolConfigs = (tools: AgentTool[]) => tools.flatMap((tool) => {
+  if (tool.kind !== 'cli')
+    return []
+
+  const envVariables = tool.envVariables ?? []
+
+  return [{
+    enabled: false,
+    env: {
+      variables: envVariables
+        .filter(isPublishablePlainEnvVariable)
+        .map(variable => ({
+          id: variable.id,
+          key: variable.key.trim(),
+          name: variable.key.trim(),
+          value: variable.value,
+          variable: variable.key.trim(),
+        })),
+      secret_refs: envVariables
+        .filter(isPublishableSecretEnvVariable)
+        .map(variable => ({
+          id: variable.id,
+          key: variable.key.trim(),
+          name: variable.key.trim(),
+          value: variable.value,
+          variable: variable.key.trim(),
+        })),
+    },
+    install_command: tool.installCommand,
+    install_commands: tool.installCommand ? [tool.installCommand] : [],
+    name: tool.name,
+    tool_name: tool.id,
+    pre_authorized: false,
+  }]
+})
+
+const toEnvVariableFormState = (config?: AgentSoulConfig): EnvVariable[] => [
+  ...(config?.env?.variables ?? []).map((variable): EnvVariable => {
+    const key = variable.key ?? variable.name ?? variable.variable ?? variable.env_name ?? ''
+    return {
+      id: variable.env_name ?? variable.key ?? variable.name ?? variable.variable ?? key,
+      key,
+      value: toEnvVariableValue(variable),
+      scope: 'plain',
+    }
+  }),
+  ...(config?.env?.secret_refs ?? []).map((secret): EnvVariable => {
+    const key = secret.key ?? secret.name ?? secret.variable ?? secret.env_name ?? ''
+    const value = secret.value ?? secret.ref ?? secret.credential_id ?? ''
+    return {
+      id: secret.id ?? secret.ref ?? secret.credential_id ?? key,
+      key,
+      value,
+      scope: 'secret',
+      masked: true,
+    }
+  }),
+].filter(variable => variable.key)
+
+const toEnvConfig = (variables: EnvVariable[]): AgentSoulConfig['env'] => ({
+  variables: variables
+    .filter(isPublishablePlainEnvVariable)
+    .map(variable => ({
+      id: variable.id,
+      key: variable.key.trim(),
+      name: variable.key.trim(),
+      value: variable.value,
+      variable: variable.key.trim(),
+    })),
+  secret_refs: variables
+    .filter(isPublishableSecretEnvVariable)
+    .map(variable => ({
+      id: variable.id,
+      key: variable.key.trim(),
+      name: variable.key.trim(),
+      value: variable.value,
+      variable: variable.key.trim(),
+    })),
+})
+
+const toDraftModel = (config?: AgentSoulConfig): DefaultModel | undefined => {
+  const modelProvider = config?.model?.model_provider
+  const model = config?.model?.model
+
+  if (!modelProvider || !model)
+    return undefined
+
+  return {
+    provider: modelProvider,
+    model,
+    plugin_id: config?.model?.plugin_id,
+  }
+}
+
+const getModelProviderPluginId = (model: DefaultModel, baseModel?: AgentSoulConfig['model']) => {
+  if (model.plugin_id)
+    return model.plugin_id
+
+  if (baseModel?.model_provider === model.provider && baseModel.plugin_id)
+    return baseModel.plugin_id
+
+  const [organization, pluginName] = model.provider.split('/').filter(Boolean)
+
+  if (organization && pluginName)
+    return `${organization}/${pluginName}`
+
+  return model.provider ? `langgenius/${model.provider}` : ''
+}
+
+export const formStateToAgentSoulConfig = ({
+  baseConfig,
+  formState,
+  currentModel,
+}: {
+  baseConfig?: AgentSoulConfig
+  formState: AgentSoulConfigFormState
+  currentModel?: DefaultModel
+}): AgentSoulConfig => ({
+  ...baseConfig,
+  prompt: {
+    ...baseConfig?.prompt,
+    system_prompt: formState.prompt,
+  },
+  model: currentModel
+    ? {
+        ...baseConfig?.model,
+        model_provider: currentModel.provider,
+        model: currentModel.model,
+        plugin_id: getModelProviderPluginId(currentModel, baseConfig?.model),
+      }
+    : baseConfig?.model,
+  skills_files: {
+    ...baseConfig?.skills_files,
+    skills: toSkillRefs(formState.skills),
+    files: toFileRefs(formState.files),
+  },
+  tools: {
+    ...baseConfig?.tools,
+    dify_tools: toDifyToolConfigs(formState.tools, formState.toolSettings),
+    cli_tools: toCliToolConfigs(formState.tools),
+  },
+  app_features: formState.appFeatures ?? baseConfig?.app_features,
+  knowledge: toKnowledgeConfig(baseConfig?.knowledge, formState.knowledgeRetrievals),
+  env: toEnvConfig(formState.envVariables),
+})
+
+export const agentSoulConfigToFormState = (
+  config?: AgentSoulConfig,
+  baseDraft: AgentSoulConfigFormState = defaultAgentSoulConfigFormState,
+): AgentSoulConfigFormState => {
+  const providerToolState = toProviderToolFormState(config)
+
+  return {
+    ...baseDraft,
+    prompt: config?.prompt?.system_prompt ?? '',
+    model: toDraftModel(config),
+    appFeatures: config?.app_features,
+    skills: toSkillFormState(config),
+    files: toFileFormState(config),
+    tools: [
+      ...providerToolState.tools,
+      ...toCliToolFormState(config),
+    ],
+    knowledgeRetrievals: toKnowledgeRetrievalFormState(config),
+    envVariables: toEnvVariableFormState(config),
+    toolSettings: providerToolState.toolSettings,
+  }
+}
diff --git a/web/features/agent-v2/agent-composer/form-state.ts b/web/features/agent-v2/agent-composer/form-state.ts
new file mode 100644
index 00000000000..e75c3491f91
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/form-state.ts
@@ -0,0 +1,119 @@
+import type { AgentKnowledgeDatasetConfig, AgentSoulAppFeaturesConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { FileTreeIconType } from '@langgenius/dify-ui/file-tree'
+import type { DefaultModel } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import type { ToolDefaultValue } from '@/app/components/workflow/block-selector/types'
+import type {
+  MetadataFilteringConditions,
+  MetadataFilteringModeEnum,
+  MultipleRetrievalConfig,
+} from '@/app/components/workflow/nodes/knowledge-retrieval/types'
+import type { ModelConfig } from '@/app/components/workflow/types'
+import type { DataSet } from '@/models/datasets'
+import type { RETRIEVE_TYPE } from '@/types/app'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
+
+export type EnvScope = 'secret' | 'plain'
+
+export type EnvVariable = {
+  id: string
+  key: string
+  value: string
+  scope: EnvScope
+  masked?: boolean
+}
+
+export type AgentSkill = {
+  description?: string
+  files?: string[]
+  fileId?: string
+  fullArchiveFileId?: string
+  fullArchiveKey?: string
+  id: string
+  name: string
+  path?: string
+  skillMdFileId?: string
+  skillMdKey?: string
+}
+
+export type AgentFileNode = {
+  id: string
+  name: string
+  icon: FileTreeIconType
+  driveKey?: string
+  children?: AgentFileNode[]
+}
+
+export type AgentKnowledgeRetrievalItem = {
+  id: string
+  name?: string
+  nameKey?: I18nKeysWithPrefix<'agentV2', 'agentDetail.configure.knowledgeRetrieval.'>
+  queryMode?: 'agent' | 'custom'
+  customQuery?: string
+  datasetRefs?: AgentKnowledgeDatasetConfig[]
+  selectedDatasets?: DataSet[]
+  retrievalMode?: RETRIEVE_TYPE
+  multipleRetrievalConfig?: MultipleRetrievalConfig
+  metadataFilterMode?: MetadataFilteringModeEnum
+  metadataFilteringConditions?: MetadataFilteringConditions
+  metadataModelConfig?: ModelConfig
+}
+
+type AgentToolBase = {
+  id: string
+  name: string
+}
+
+export type AgentToolAction = {
+  id: string
+  name: string
+  toolName: string
+  description: string
+}
+
+type AgentProviderToolCredentialType = 'api-key' | 'oauth2' | 'unauthorized'
+
+export type AgentProviderTool = AgentToolBase & {
+  kind: 'provider'
+  displayName?: string
+  iconClassName: string
+  icon?: ToolDefaultValue['provider_icon']
+  iconDark?: ToolDefaultValue['provider_icon_dark']
+  providerType?: string
+  allowDelete?: boolean
+  credentialId?: string
+  credentialKey?: I18nKeysWithPrefix<'agentV2', 'agentDetail.configure.tools.'>
+  credentialType?: AgentProviderToolCredentialType
+  credentialVariant: 'authorized' | 'unauthorized' | 'none'
+  actions: AgentToolAction[]
+}
+
+export type AgentCliTool = AgentToolBase & {
+  kind: 'cli'
+  action?: 'preAuthorize'
+  installCommand?: string
+  envVariables?: EnvVariable[]
+}
+
+export type AgentTool = AgentProviderTool | AgentCliTool
+
+export type AgentSoulConfigFormState = {
+  prompt: string
+  model?: DefaultModel
+  appFeatures?: AgentSoulAppFeaturesConfig
+  skills: AgentSkill[]
+  files: AgentFileNode[]
+  tools: AgentTool[]
+  knowledgeRetrievals: AgentKnowledgeRetrievalItem[]
+  envVariables: EnvVariable[]
+  toolSettings: Record<string, Record<string, unknown>>
+}
+
+export const defaultAgentSoulConfigFormState: AgentSoulConfigFormState = {
+  prompt: '',
+  skills: [],
+  files: [],
+  tools: [],
+  knowledgeRetrievals: [],
+  envVariables: [],
+  toolSettings: {},
+}
diff --git a/web/features/agent-v2/agent-composer/provider.tsx b/web/features/agent-v2/agent-composer/provider.tsx
new file mode 100644
index 00000000000..189d828b45e
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/provider.tsx
@@ -0,0 +1,37 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { AgentSoulConfigFormState } from './form-state'
+import { createStore, Provider as JotaiProvider } from 'jotai'
+import { useRef } from 'react'
+import { agentComposerDraftAtom, agentComposerOriginalDraftAtom } from './store'
+
+function createAgentComposerStore(initialDraft?: AgentSoulConfigFormState) {
+  const store = createStore()
+
+  if (initialDraft)
+    store.set(agentComposerDraftAtom, initialDraft)
+  if (initialDraft)
+    store.set(agentComposerOriginalDraftAtom, initialDraft)
+
+  return store
+}
+
+export function AgentComposerProvider({
+  children,
+  initialDraft,
+}: {
+  children: ReactNode
+  initialDraft?: AgentSoulConfigFormState
+}) {
+  const storeRef = useRef<ReturnType<typeof createAgentComposerStore> | null>(null)
+  if (!storeRef.current)
+    storeRef.current = createAgentComposerStore(initialDraft)
+  const store = storeRef.current
+
+  return (
+    <JotaiProvider store={store}>
+      {children}
+    </JotaiProvider>
+  )
+}
diff --git a/web/features/agent-v2/agent-composer/reference-labels.ts b/web/features/agent-v2/agent-composer/reference-labels.ts
new file mode 100644
index 00000000000..25eaa9c7063
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/reference-labels.ts
@@ -0,0 +1,75 @@
+import type { AgentKnowledgeRetrievalItem, AgentTool } from './form-state'
+
+const getKnowledgeRetrievalName = (item: AgentKnowledgeRetrievalItem) => item.name ?? item.nameKey ?? item.id
+
+const escapeRegExp = (value: string) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+const createReferenceToken = (kind: string, id: string, label: string) => (
+  `[§${kind}:${id}${label ? `:${label}` : ''}§]`
+)
+
+const syncReferenceLabels = ({
+  prompt,
+  kind,
+  currentItems,
+  nextItems,
+}: {
+  prompt: string
+  kind: string
+  currentItems: Array<{ id: string, name: string }>
+  nextItems: Array<{ id: string, name: string }>
+}) => {
+  const currentItemById = new Map(currentItems.map(item => [item.id, item]))
+
+  return nextItems.reduce((nextPrompt, nextItem) => {
+    const currentItem = currentItemById.get(nextItem.id)
+    if (!currentItem)
+      return nextPrompt
+
+    if (currentItem.name === nextItem.name)
+      return nextPrompt
+
+    return nextPrompt.replace(
+      new RegExp(`\\[§${escapeRegExp(kind)}:${escapeRegExp(nextItem.id)}(?::[^§\\]]*)?§\\]`, 'g'),
+      createReferenceToken(kind, nextItem.id, nextItem.name),
+    )
+  }, prompt)
+}
+
+const toReferenceLabelItems = <Item extends { id: string }>(
+  items: Item[],
+  getName: (item: Item) => string,
+) => items.map(item => ({
+  id: item.id,
+  name: getName(item),
+}))
+
+export const syncKnowledgeReferenceLabels = ({
+  prompt,
+  currentRetrievals,
+  nextRetrievals,
+}: {
+  prompt: string
+  currentRetrievals: AgentKnowledgeRetrievalItem[]
+  nextRetrievals: AgentKnowledgeRetrievalItem[]
+}) => syncReferenceLabels({
+  prompt,
+  kind: 'knowledge',
+  currentItems: toReferenceLabelItems(currentRetrievals, getKnowledgeRetrievalName),
+  nextItems: toReferenceLabelItems(nextRetrievals, getKnowledgeRetrievalName),
+})
+
+export const syncCliToolReferenceLabels = ({
+  prompt,
+  currentTools,
+  nextTools,
+}: {
+  prompt: string
+  currentTools: AgentTool[]
+  nextTools: AgentTool[]
+}) => syncReferenceLabels({
+  prompt,
+  kind: 'cli_tool',
+  currentItems: toReferenceLabelItems(currentTools.filter(tool => tool.kind === 'cli'), tool => tool.name),
+  nextItems: toReferenceLabelItems(nextTools.filter(tool => tool.kind === 'cli'), tool => tool.name),
+})
diff --git a/web/features/agent-v2/agent-composer/store-modules/app-features.ts b/web/features/agent-v2/agent-composer/store-modules/app-features.ts
new file mode 100644
index 00000000000..27a037901cf
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/app-features.ts
@@ -0,0 +1,25 @@
+import type { AgentSoulAppFeaturesConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { DraftFieldUpdate } from './utils'
+import { atom, useAtomValue, useSetAtom } from 'jotai'
+import { agentComposerDraftAtom } from '../store'
+import { resolveDraftFieldUpdate } from './utils'
+
+export const agentComposerAppFeaturesAtom = atom(
+  get => get(agentComposerDraftAtom).appFeatures,
+  (get, set, appFeaturesUpdate: DraftFieldUpdate<AgentSoulAppFeaturesConfig | undefined>) => {
+    const draft = get(agentComposerDraftAtom)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      appFeatures: resolveDraftFieldUpdate(draft.appFeatures, appFeaturesUpdate),
+    })
+  },
+)
+
+export function useAppFeatures() {
+  return useAtomValue(agentComposerAppFeaturesAtom)
+}
+
+export function useSetAppFeatures() {
+  return useSetAtom(agentComposerAppFeaturesAtom)
+}
diff --git a/web/features/agent-v2/agent-composer/store-modules/env.ts b/web/features/agent-v2/agent-composer/store-modules/env.ts
new file mode 100644
index 00000000000..8fcdd75b499
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/env.ts
@@ -0,0 +1,17 @@
+import type { EnvVariable } from '../form-state'
+import type { DraftFieldUpdate } from './utils'
+import { atom } from 'jotai'
+import { agentComposerDraftAtom } from '../store'
+import { resolveDraftFieldUpdate } from './utils'
+
+export const agentComposerEnvVariablesAtom = atom(
+  get => get(agentComposerDraftAtom).envVariables,
+  (get, set, envVariablesUpdate: DraftFieldUpdate<EnvVariable[]>) => {
+    const draft = get(agentComposerDraftAtom)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      envVariables: resolveDraftFieldUpdate(draft.envVariables, envVariablesUpdate),
+    })
+  },
+)
diff --git a/web/features/agent-v2/agent-composer/store-modules/files.ts b/web/features/agent-v2/agent-composer/store-modules/files.ts
new file mode 100644
index 00000000000..b54f28f1c49
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/files.ts
@@ -0,0 +1,17 @@
+import type { AgentFileNode } from '../form-state'
+import type { DraftFieldUpdate } from './utils'
+import { atom } from 'jotai'
+import { agentComposerDraftAtom } from '../store'
+import { resolveDraftFieldUpdate } from './utils'
+
+export const agentComposerFilesAtom = atom(
+  get => get(agentComposerDraftAtom).files,
+  (get, set, filesUpdate: DraftFieldUpdate<AgentFileNode[]>) => {
+    const draft = get(agentComposerDraftAtom)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      files: resolveDraftFieldUpdate(draft.files, filesUpdate),
+    })
+  },
+)
diff --git a/web/features/agent-v2/agent-composer/store-modules/knowledge.ts b/web/features/agent-v2/agent-composer/store-modules/knowledge.ts
new file mode 100644
index 00000000000..b33b4f6e951
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/knowledge.ts
@@ -0,0 +1,24 @@
+import type { AgentKnowledgeRetrievalItem } from '../form-state'
+import type { DraftFieldUpdate } from './utils'
+import { atom } from 'jotai'
+import { syncKnowledgeReferenceLabels } from '../reference-labels'
+import { agentComposerDraftAtom } from '../store'
+import { resolveDraftFieldUpdate } from './utils'
+
+export const agentComposerKnowledgeRetrievalsAtom = atom(
+  get => get(agentComposerDraftAtom).knowledgeRetrievals,
+  (get, set, knowledgeRetrievalsUpdate: DraftFieldUpdate<AgentKnowledgeRetrievalItem[]>) => {
+    const draft = get(agentComposerDraftAtom)
+    const knowledgeRetrievals = resolveDraftFieldUpdate(draft.knowledgeRetrievals, knowledgeRetrievalsUpdate)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      prompt: syncKnowledgeReferenceLabels({
+        prompt: draft.prompt,
+        currentRetrievals: draft.knowledgeRetrievals,
+        nextRetrievals: knowledgeRetrievals,
+      }),
+      knowledgeRetrievals,
+    })
+  },
+)
diff --git a/web/features/agent-v2/agent-composer/store-modules/model.ts b/web/features/agent-v2/agent-composer/store-modules/model.ts
new file mode 100644
index 00000000000..c44359633a6
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/model.ts
@@ -0,0 +1,17 @@
+import type { DraftFieldUpdate } from './utils'
+import type { DefaultModel } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { atom } from 'jotai'
+import { agentComposerDraftAtom } from '../store'
+import { resolveDraftFieldUpdate } from './utils'
+
+export const agentComposerModelAtom = atom(
+  get => get(agentComposerDraftAtom).model,
+  (get, set, modelUpdate: DraftFieldUpdate<DefaultModel | undefined>) => {
+    const draft = get(agentComposerDraftAtom)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      model: resolveDraftFieldUpdate(draft.model, modelUpdate),
+    })
+  },
+)
diff --git a/web/features/agent-v2/agent-composer/store-modules/prompt.ts b/web/features/agent-v2/agent-composer/store-modules/prompt.ts
new file mode 100644
index 00000000000..3b4cb2b528c
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/prompt.ts
@@ -0,0 +1,16 @@
+import type { DraftFieldUpdate } from './utils'
+import { atom } from 'jotai'
+import { agentComposerDraftAtom } from '../store'
+import { resolveDraftFieldUpdate } from './utils'
+
+export const agentComposerPromptAtom = atom(
+  get => get(agentComposerDraftAtom).prompt,
+  (get, set, promptUpdate: DraftFieldUpdate<string>) => {
+    const draft = get(agentComposerDraftAtom)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      prompt: resolveDraftFieldUpdate(draft.prompt, promptUpdate),
+    })
+  },
+)
diff --git a/web/features/agent-v2/agent-composer/store-modules/skills.ts b/web/features/agent-v2/agent-composer/store-modules/skills.ts
new file mode 100644
index 00000000000..e35c03d3aec
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/skills.ts
@@ -0,0 +1,26 @@
+import type { AgentSkill } from '../form-state'
+import type { DraftFieldUpdate } from './utils'
+import { atom, useSetAtom } from 'jotai'
+import { useCallback } from 'react'
+import { agentComposerDraftAtom } from '../store'
+import { resolveDraftFieldUpdate } from './utils'
+
+export const agentComposerSkillsAtom = atom(
+  get => get(agentComposerDraftAtom).skills,
+  (get, set, skillsUpdate: DraftFieldUpdate<AgentSkill[]>) => {
+    const draft = get(agentComposerDraftAtom)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      skills: resolveDraftFieldUpdate(draft.skills, skillsUpdate),
+    })
+  },
+)
+
+export function useRemoveSkill() {
+  const setSkills = useSetAtom(agentComposerSkillsAtom)
+
+  return useCallback((skillId: string) => {
+    setSkills(skills => skills.filter(skill => skill.id !== skillId))
+  }, [setSkills])
+}
diff --git a/web/features/agent-v2/agent-composer/store-modules/tools.ts b/web/features/agent-v2/agent-composer/store-modules/tools.ts
new file mode 100644
index 00000000000..c1d8c64082c
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/tools.ts
@@ -0,0 +1,107 @@
+import type { AgentSoulConfigFormState, AgentTool } from '../form-state'
+import type { DraftFieldUpdate } from './utils'
+import { atom, useSetAtom } from 'jotai'
+import { useCallback } from 'react'
+import { syncCliToolReferenceLabels } from '../reference-labels'
+import { agentComposerDraftAtom } from '../store'
+import { resolveDraftFieldUpdate } from './utils'
+
+export const agentComposerToolsAtom = atom(
+  get => get(agentComposerDraftAtom).tools,
+  (get, set, toolsUpdate: DraftFieldUpdate<AgentTool[]>) => {
+    const draft = get(agentComposerDraftAtom)
+    const tools = resolveDraftFieldUpdate(draft.tools, toolsUpdate)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      prompt: syncCliToolReferenceLabels({
+        prompt: draft.prompt,
+        currentTools: draft.tools,
+        nextTools: tools,
+      }),
+      tools,
+    })
+  },
+)
+
+export const agentComposerToolSettingsAtom = atom(
+  get => get(agentComposerDraftAtom).toolSettings,
+  (get, set, toolSettingsUpdate: DraftFieldUpdate<Record<string, Record<string, unknown>>>) => {
+    const draft = get(agentComposerDraftAtom)
+
+    set(agentComposerDraftAtom, {
+      ...draft,
+      toolSettings: resolveDraftFieldUpdate(draft.toolSettings, toolSettingsUpdate),
+    })
+  },
+)
+
+const omitToolSettings = (
+  toolSettings: AgentSoulConfigFormState['toolSettings'],
+  actionIds: string[],
+) => {
+  const nextToolSettings = { ...toolSettings }
+
+  actionIds.forEach((actionId) => {
+    delete nextToolSettings[actionId]
+  })
+
+  return nextToolSettings
+}
+
+export function useRemoveProviderTool() {
+  const setDraft = useSetAtom(agentComposerDraftAtom)
+
+  return useCallback((toolId: string) => {
+    setDraft((draft) => {
+      const toolToRemove = draft.tools.find(tool => tool.kind === 'provider' && tool.id === toolId)
+      const actionIds = toolToRemove?.kind === 'provider'
+        ? toolToRemove.actions.map(action => action.id)
+        : []
+
+      return {
+        ...draft,
+        tools: draft.tools.filter(tool => tool.id !== toolId),
+        toolSettings: omitToolSettings(draft.toolSettings, actionIds),
+      }
+    })
+  }, [setDraft])
+}
+
+export function useRemoveProviderToolAction() {
+  const setDraft = useSetAtom(agentComposerDraftAtom)
+
+  return useCallback((toolId: string, actionId: string) => {
+    setDraft(draft => ({
+      ...draft,
+      tools: draft.tools.flatMap((tool) => {
+        if (tool.kind !== 'provider' || tool.id !== toolId)
+          return [tool]
+
+        const nextActions = tool.actions.filter(action => action.id !== actionId)
+        return nextActions.length > 0
+          ? [{ ...tool, actions: nextActions }]
+          : []
+      }),
+      toolSettings: omitToolSettings(draft.toolSettings, [actionId]),
+    }))
+  }, [setDraft])
+}
+
+export function useSetProviderToolCredential() {
+  const setTools = useSetAtom(agentComposerToolsAtom)
+
+  return useCallback((toolId: string, credentialId?: string) => {
+    setTools(tools => tools.map((tool) => {
+      if (tool.kind !== 'provider' || tool.id !== toolId)
+        return tool
+
+      return {
+        ...tool,
+        credentialId,
+        credentialType: 'api-key',
+        credentialVariant: 'authorized',
+      }
+    }))
+  }, [setTools])
+}
diff --git a/web/features/agent-v2/agent-composer/store-modules/utils.ts b/web/features/agent-v2/agent-composer/store-modules/utils.ts
new file mode 100644
index 00000000000..c5272001e3a
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store-modules/utils.ts
@@ -0,0 +1,10 @@
+export type DraftFieldUpdate<Value> = Value | ((currentValue: Value) => Value)
+
+export const resolveDraftFieldUpdate = <Value>(
+  currentValue: Value,
+  update: DraftFieldUpdate<Value>,
+) => (
+  typeof update === 'function'
+    ? (update as (currentValue: Value) => Value)(currentValue)
+    : update
+)
diff --git a/web/features/agent-v2/agent-composer/store.ts b/web/features/agent-v2/agent-composer/store.ts
new file mode 100644
index 00000000000..446529ba556
--- /dev/null
+++ b/web/features/agent-v2/agent-composer/store.ts
@@ -0,0 +1,132 @@
+import type { AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentSoulConfigFormState } from './form-state'
+import type { DefaultModel } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import isEqual from 'fast-deep-equal'
+import { atom, useAtomValue, useSetAtom } from 'jotai'
+import { useEffect, useMemo, useRef } from 'react'
+import { agentSoulConfigToFormState, formStateToAgentSoulConfig } from './conversions'
+import { defaultAgentSoulConfigFormState } from './form-state'
+
+export const agentComposerOriginalConfigAtom = atom<AgentSoulConfig | undefined>(undefined)
+export const agentComposerOriginalDraftAtom = atom<AgentSoulConfigFormState | undefined>(defaultAgentSoulConfigFormState)
+export const agentComposerPublishedDraftAtom = atom<AgentSoulConfigFormState | undefined>(defaultAgentSoulConfigFormState)
+export const agentComposerDraftAtom = atom<AgentSoulConfigFormState>(defaultAgentSoulConfigFormState)
+
+export const isAgentComposerDirtyAtom = atom((get) => {
+  const originalDraft = get(agentComposerOriginalDraftAtom)
+  const draft = get(agentComposerDraftAtom)
+
+  return !isEqual(draft, originalDraft ?? defaultAgentSoulConfigFormState)
+})
+
+const hasAgentComposerUnpublishedChangesAtom = atom((get) => {
+  const publishedDraft = get(agentComposerPublishedDraftAtom)
+  const draft = get(agentComposerDraftAtom)
+
+  return !isEqual(draft, publishedDraft ?? defaultAgentSoulConfigFormState)
+})
+
+function useHydrate({
+  defaultDraft = defaultAgentSoulConfigFormState,
+  instanceKey,
+  draft,
+  originalConfig,
+  waitForDraft,
+}: {
+  defaultDraft?: AgentSoulConfigFormState
+  instanceKey: string
+  draft?: AgentSoulConfigFormState
+  originalConfig?: AgentSoulConfig
+  waitForDraft?: boolean
+}) {
+  const setOriginalDraft = useSetAtom(agentComposerOriginalDraftAtom)
+  const setPublishedDraft = useSetAtom(agentComposerPublishedDraftAtom)
+  const setOriginalConfig = useSetAtom(agentComposerOriginalConfigAtom)
+  const setDraft = useSetAtom(agentComposerDraftAtom)
+  const resetKeyRef = useRef<string | undefined>(undefined)
+  const hydratedKeyRef = useRef<string | undefined>(undefined)
+
+  useEffect(() => {
+    if (resetKeyRef.current !== instanceKey) {
+      resetKeyRef.current = instanceKey
+      hydratedKeyRef.current = undefined
+      setOriginalConfig(undefined)
+      setOriginalDraft(defaultDraft)
+      setPublishedDraft(defaultDraft)
+      setDraft(defaultDraft)
+    }
+
+    if (waitForDraft && !draft)
+      return
+
+    if (hydratedKeyRef.current === instanceKey)
+      return
+
+    hydratedKeyRef.current = instanceKey
+    setOriginalConfig(originalConfig)
+    setOriginalDraft(draft ?? defaultDraft)
+    setPublishedDraft(draft ?? defaultDraft)
+    setDraft(draft ?? defaultDraft)
+  }, [defaultDraft, draft, instanceKey, originalConfig, setDraft, setOriginalConfig, setOriginalDraft, setPublishedDraft, waitForDraft])
+}
+
+export function useHydrateAgentSoulConfigDraft({
+  agentId,
+  activeVersionId,
+  baseDraft = defaultAgentSoulConfigFormState,
+  config,
+}: {
+  agentId: string
+  activeVersionId?: string | null
+  baseDraft?: AgentSoulConfigFormState
+  config?: AgentSoulConfig
+}) {
+  const routeKey = `${agentId}:${activeVersionId ?? 'draft'}`
+  useHydrate({
+    defaultDraft: baseDraft,
+    instanceKey: routeKey,
+    draft: agentSoulConfigToFormState(config, baseDraft),
+    originalConfig: config,
+    waitForDraft: !!activeVersionId && !config,
+  })
+}
+
+export function useHasAgentComposerUnpublishedChanges() {
+  return useAtomValue(hasAgentComposerUnpublishedChangesAtom)
+}
+
+export function useAgentComposerConfigSnapshot({
+  baseConfig,
+  currentModel,
+}: {
+  baseConfig?: AgentSoulConfig
+  currentModel?: DefaultModel
+}) {
+  const draft = useAtomValue(agentComposerDraftAtom)
+
+  return useMemo(() => formStateToAgentSoulConfig({
+    baseConfig,
+    formState: draft,
+    currentModel,
+  }), [baseConfig, currentModel, draft])
+}
+
+export function useConfigPublishPayload({
+  agentId,
+  baseConfig,
+  currentModel,
+}: {
+  agentId: string
+  baseConfig?: AgentSoulConfig
+  currentModel?: DefaultModel
+}) {
+  const configSnapshot = useAgentComposerConfigSnapshot({
+    baseConfig,
+    currentModel,
+  })
+
+  return useMemo(() => ({
+    agent_id: agentId,
+    config_snapshot: configSnapshot,
+  }), [agentId, configSnapshot])
+}
diff --git a/web/features/agent-v2/agent-detail/__tests__/navigation.spec.tsx b/web/features/agent-v2/agent-detail/__tests__/navigation.spec.tsx
new file mode 100644
index 00000000000..b5f3f48b6e1
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/__tests__/navigation.spec.tsx
@@ -0,0 +1,73 @@
+import type { AgentAppDetailWithSite } from '@dify/contracts/api/console/agent/types.gen'
+import { render, screen } from '@testing-library/react'
+import { AgentDetailSection } from '../navigation'
+
+const mocks = vi.hoisted(() => ({
+  pathname: '/roster/agent/agent-1/configure',
+  queryData: undefined as AgentAppDetailWithSite | undefined,
+}))
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+
+  return {
+    ...actual,
+    useQuery: () => ({
+      data: mocks.queryData,
+      isPending: !mocks.queryData,
+    }),
+  }
+})
+
+vi.mock('@/next/navigation', () => ({
+  usePathname: () => mocks.pathname,
+  useRouter: () => ({
+    back: vi.fn(),
+  }),
+}))
+
+vi.mock('@/app/components/app-sidebar/nav-link', () => ({
+  default: ({ href, name }: { href: string, name: string }) => <a href={href}>{name}</a>,
+}))
+
+vi.mock('@/app/components/base/divider', () => ({
+  default: () => <div data-testid="divider" />,
+}))
+
+const createAgent = (overrides: Partial<AgentAppDetailWithSite> = {}): AgentAppDetailWithSite => ({
+  description: 'Find and summarize market materials.',
+  enable_api: true,
+  enable_site: true,
+  icon: '🧪',
+  icon_background: '#E0F2FE',
+  icon_type: 'emoji',
+  id: 'agent-1',
+  icon_url: null,
+  mode: 'agent',
+  name: 'Research Agent',
+  role: 'Research Assistant',
+  ...overrides,
+})
+
+describe('AgentDetailSection', () => {
+  beforeEach(() => {
+    mocks.pathname = '/roster/agent/agent-1/configure'
+    mocks.queryData = createAgent()
+  })
+
+  it('renders the current agent avatar, name, and role', () => {
+    const { container } = render(<AgentDetailSection />)
+    const agentName = screen.getByText('Research Agent')
+    const agentAvatar = container.querySelector('em-emoji')?.parentElement
+
+    expect(agentName).toBeInTheDocument()
+    expect(screen.getByText('Research Assistant')).toBeInTheDocument()
+    expect(screen.queryByText('agent')).not.toBeInTheDocument()
+    expect(screen.queryByText('agentV2.agentDetail.title')).not.toBeInTheDocument()
+    expect(container.querySelector('em-emoji')).toHaveAttribute('id', '🧪')
+    expect(agentAvatar).toHaveClass('h-10', 'w-10', 'rounded-full')
+    expect(agentAvatar?.parentElement?.parentElement).toHaveClass('mr-2')
+    expect(agentName.parentElement).toHaveClass('h-10')
+    expect(agentName.parentElement?.parentElement).toHaveClass('h-13', 'py-1.5', 'pl-1.5', 'pr-2')
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/access/access-sources.ts b/web/features/agent-v2/agent-detail/access/access-sources.ts
new file mode 100644
index 00000000000..b3e758e4e10
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/access/access-sources.ts
@@ -0,0 +1,34 @@
+import type { AgentAppDetailWithSite } from '@dify/contracts/api/console/agent/types.gen'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
+
+export type AgentAccessSource = {
+  id: string
+  nameKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.access.entries.'>
+  descriptionKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.access.entries.'>
+  reference: string
+  status: 'enabled' | 'disabled'
+  icon: string
+}
+
+const getStatus = (agent: AgentAppDetailWithSite): AgentAccessSource['status'] =>
+  agent.id ? 'enabled' : 'disabled'
+
+export const getAgentAccessSources = (agent?: AgentAppDetailWithSite): AgentAccessSource[] => {
+  if (!agent)
+    return []
+
+  const sources: AgentAccessSource[] = []
+
+  if (agent.id) {
+    sources.push({
+      id: 'agent-app',
+      nameKey: 'agentDetail.access.entries.agentApp.name',
+      descriptionKey: 'agentDetail.access.entries.agentApp.description',
+      reference: agent.id,
+      status: getStatus(agent),
+      icon: 'i-ri-window-line',
+    })
+  }
+
+  return sources
+}
diff --git a/web/features/agent-v2/agent-detail/access/components/__tests__/workflow-references-table.spec.tsx b/web/features/agent-v2/agent-detail/access/components/__tests__/workflow-references-table.spec.tsx
new file mode 100644
index 00000000000..a201666c869
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/access/components/__tests__/workflow-references-table.spec.tsx
@@ -0,0 +1,138 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { WorkflowReferencesTable } from '../workflow-references-table'
+
+const mocks = vi.hoisted(() => ({
+  queryFn: vi.fn(),
+  queryOptions: vi.fn((input: unknown) => ({
+    queryKey: ['agent-referencing-workflows', input],
+    queryFn: () => mocks.queryFn(input),
+  })),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        referencingWorkflows: {
+          get: {
+            queryOptions: mocks.queryOptions,
+          },
+        },
+      },
+    },
+  },
+}))
+
+vi.mock('@/hooks/use-timestamp', () => ({
+  default: () => ({
+    formatTime: (value: number) => `formatted-${value}`,
+  }),
+}))
+
+const renderTable = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  render(
+    <QueryClientProvider client={queryClient}>
+      <WorkflowReferencesTable agentId="agent-1" />
+    </QueryClientProvider>,
+  )
+
+  return queryClient
+}
+
+describe('WorkflowReferencesTable', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('Query contract', () => {
+    it('should request workflow references for the current agent', async () => {
+      mocks.queryFn.mockResolvedValueOnce({ data: [] })
+
+      renderTable()
+
+      await waitFor(() => {
+        expect(mocks.queryOptions).toHaveBeenCalledWith({
+          input: {
+            params: {
+              agent_id: 'agent-1',
+            },
+          },
+        })
+      })
+    })
+  })
+
+  describe('Rendering', () => {
+    it('should render workflow reference rows from the generated contract response', async () => {
+      mocks.queryFn.mockResolvedValueOnce({
+        data: [
+          {
+            app_icon: 'A',
+            app_icon_background: '#E0F2FE',
+            app_icon_type: 'emoji',
+            app_id: 'workflow-app-id',
+            app_mode: 'workflow',
+            app_name: 'Support Workflow',
+            app_updated_at: 1781660000,
+            node_ids: ['agent-node-a', 'agent-node-b'],
+            workflow_id: 'workflow-id',
+            workflow_version: 'v3',
+          },
+        ],
+      })
+
+      renderTable()
+
+      expect(await screen.findByText('Support Workflow')).toBeInTheDocument()
+      expect(screen.getByText('v3')).toBeInTheDocument()
+      expect(screen.getByText('agentV2.agentDetail.access.workflow.nodeCount:{"count":2}')).toBeInTheDocument()
+      expect(screen.getByText('formatted-1781660000')).toBeInTheDocument()
+      expect(screen.getByRole('link', { name: 'agentV2.agentDetail.access.workflow.openInStudioFor:{"name":"Support Workflow"}' }))
+        .toHaveAttribute('href', '/app/workflow-app-id/workflow')
+    })
+
+    it('should render an empty state when the agent has no workflow references', async () => {
+      mocks.queryFn.mockResolvedValueOnce({ data: [] })
+
+      renderTable()
+
+      expect(await screen.findByText('agentV2.agentDetail.access.workflow.empty')).toBeInTheDocument()
+    })
+
+    it('should render a loading row while workflow references are pending', () => {
+      mocks.queryFn.mockReturnValueOnce(new Promise<never>(() => undefined))
+
+      renderTable()
+
+      expect(screen.getByText('agentV2.agentDetail.access.workflow.loading')).toBeInTheDocument()
+    })
+  })
+
+  describe('Error state', () => {
+    it('should render a retry action when loading workflow references fails', async () => {
+      const user = userEvent.setup()
+      mocks.queryFn
+        .mockRejectedValueOnce(new Error('failed'))
+        .mockResolvedValueOnce({ data: [] })
+
+      renderTable()
+
+      expect(await screen.findByText('agentV2.agentDetail.access.workflow.loadFailed')).toBeInTheDocument()
+      await user.click(screen.getByRole('button', { name: 'common.operation.retry' }))
+
+      await waitFor(() => {
+        expect(mocks.queryFn).toHaveBeenCalledTimes(2)
+      })
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/access/components/workflow-references-table.tsx b/web/features/agent-v2/agent-detail/access/components/workflow-references-table.tsx
new file mode 100644
index 00000000000..0113fd5e45b
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/access/components/workflow-references-table.tsx
@@ -0,0 +1,171 @@
+'use client'
+
+import type { AgentIconType, AgentReferencingWorkflowResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { ReactNode } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import useTimestamp from '@/hooks/use-timestamp'
+import Link from '@/next/link'
+import { consoleQuery } from '@/service/client'
+
+type WorkflowReferencesTableProps = {
+  agentId: string
+}
+
+const workflowTableColSpan = 5
+
+const getWorkflowReferenceHref = (reference: AgentReferencingWorkflowResponse) => `/app/${reference.app_id}/workflow`
+
+export function WorkflowReferencesTable({
+  agentId,
+}: WorkflowReferencesTableProps) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const workflowReferencesQuery = useQuery(consoleQuery.agent.byAgentId.referencingWorkflows.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  }))
+  const workflowReferences = workflowReferencesQuery.data?.data ?? []
+
+  return (
+    <div className="overflow-x-auto">
+      <table className="w-full min-w-[1212px] table-fixed border-collapse">
+        <colgroup>
+          <col className="w-[572px]" />
+          <col className="w-40" />
+          <col className="w-32" />
+          <col className="w-[204px]" />
+          <col className="w-36" />
+        </colgroup>
+        <thead>
+          <tr className="h-7 rounded-lg bg-background-section-burn text-left system-xs-semibold-uppercase text-text-tertiary">
+            <th scope="col" className="rounded-l-lg px-3 font-semibold">
+              {t('agentDetail.access.workflow.table.name')}
+            </th>
+            <th scope="col" className="px-3 font-semibold">
+              {t('agentDetail.access.workflow.table.version')}
+            </th>
+            <th scope="col" className="px-3 font-semibold">
+              {t('agentDetail.access.workflow.table.nodes')}
+            </th>
+            <th scope="col" className="px-3 font-semibold">
+              {t('agentDetail.access.workflow.table.lastUpdated')}
+            </th>
+            <th scope="col" className="rounded-r-lg px-3 font-semibold">
+              {t('agentDetail.access.workflow.table.actions')}
+            </th>
+          </tr>
+        </thead>
+        <tbody className="system-sm-regular text-text-secondary">
+          {workflowReferencesQuery.isPending && (
+            <WorkflowAccessStateRow>
+              {t('agentDetail.access.workflow.loading')}
+            </WorkflowAccessStateRow>
+          )}
+          {workflowReferencesQuery.isError && (
+            <WorkflowAccessStateRow>
+              <div className="flex items-center justify-center gap-2">
+                <span>{t('agentDetail.access.workflow.loadFailed')}</span>
+                <Button
+                  variant="secondary"
+                  size="small"
+                  onClick={() => {
+                    void workflowReferencesQuery.refetch()
+                  }}
+                >
+                  {tCommon('operation.retry')}
+                </Button>
+              </div>
+            </WorkflowAccessStateRow>
+          )}
+          {workflowReferencesQuery.isSuccess && workflowReferences.length === 0 && (
+            <WorkflowAccessStateRow>
+              {t('agentDetail.access.workflow.empty')}
+            </WorkflowAccessStateRow>
+          )}
+          {workflowReferencesQuery.isSuccess && workflowReferences.map(reference => (
+            <WorkflowAccessRow
+              key={`${reference.app_id}:${reference.workflow_id}`}
+              reference={reference}
+            />
+          ))}
+        </tbody>
+      </table>
+    </div>
+  )
+}
+
+function WorkflowAccessRow({
+  reference,
+}: {
+  reference: AgentReferencingWorkflowResponse
+}) {
+  const { t } = useTranslation('agentV2')
+  const { formatTime } = useTimestamp()
+  const imageUrl = (reference.app_icon_type === 'image' || reference.app_icon_type === 'link') ? reference.app_icon : undefined
+  const iconType = (imageUrl ? 'image' : reference.app_icon_type) as AgentIconType | null | undefined
+  const updatedAt = reference.app_updated_at != null
+    ? formatTime(reference.app_updated_at, t('roster.dateTimeFormat'))
+    : t('agentDetail.access.workflow.notAvailable')
+  const nodeCount = reference.node_ids?.length ?? 0
+
+  return (
+    <tr className="h-10 border-b border-divider-subtle hover:bg-background-default-hover">
+      <td className="px-3">
+        <div className="flex min-w-0 items-center gap-2.5">
+          <span aria-hidden className="shrink-0">
+            <AppIcon
+              size="small"
+              rounded
+              iconType={iconType}
+              icon={reference.app_icon ?? undefined}
+              background={reference.app_icon_background}
+              imageUrl={imageUrl}
+            />
+          </span>
+          <span className="truncate">
+            {reference.app_name}
+          </span>
+        </div>
+      </td>
+      <td className="truncate px-3" translate="no">
+        {reference.workflow_version}
+      </td>
+      <td className="px-3 tabular-nums">
+        {t('agentDetail.access.workflow.nodeCount', { count: nodeCount })}
+      </td>
+      <td className="px-3 tabular-nums" translate="no">
+        {updatedAt}
+      </td>
+      <td className="px-3">
+        <Link
+          href={getWorkflowReferenceHref(reference)}
+          aria-label={t('agentDetail.access.workflow.openInStudioFor', { name: reference.app_name })}
+          className="inline-flex items-center gap-0.5 rounded-sm text-text-secondary hover:text-text-accent hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+        >
+          {t('agentDetail.access.workflow.openInStudio')}
+          <span aria-hidden className="i-ri-external-link-line size-4" />
+        </Link>
+      </td>
+    </tr>
+  )
+}
+
+function WorkflowAccessStateRow({
+  children,
+}: {
+  children: ReactNode
+}) {
+  return (
+    <tr className="h-20 border-b border-divider-subtle">
+      <td colSpan={workflowTableColSpan} aria-live="polite" className="px-3 text-center text-text-tertiary">
+        {children}
+      </td>
+    </tr>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/access/page.tsx b/web/features/agent-v2/agent-detail/access/page.tsx
new file mode 100644
index 00000000000..6b3e2af6a06
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/access/page.tsx
@@ -0,0 +1,308 @@
+'use client'
+
+import type { AgentAppDetailWithSite } from '@dify/contracts/api/console/agent/types.gen'
+import type { ReactNode } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { StatusDot } from '@langgenius/dify-ui/status-dot'
+import { Switch } from '@langgenius/dify-ui/switch'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useQuery } from '@tanstack/react-query'
+import { useClipboard } from 'foxact/use-clipboard'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useDocLink } from '@/context/i18n'
+import { consoleQuery } from '@/service/client'
+import { WorkflowReferencesTable } from './components/workflow-references-table'
+
+type AgentAccessPageProps = {
+  agentId: string
+}
+
+const serviceApiEndpoint = 'https://api.dify.ai/v1'
+
+type AgentWebAppSite = NonNullable<AgentAppDetailWithSite['site']> & {
+  access_token?: string | null
+  app_base_url?: string | null
+  code?: string | null
+}
+
+type AccessSurfaceCardProps = {
+  title: string
+  icon: string
+  iconClassName: string
+  endpointLabel: string
+  endpoint: string
+  enabled: boolean
+  onEnabledChange: (enabled: boolean) => void
+  copyLabel: string
+  children: ReactNode
+  badge?: ReactNode
+  onUnavailableAction: () => void
+}
+
+const getAgentWebAppUrl = (agent?: AgentAppDetailWithSite) => {
+  const site = agent?.site as AgentWebAppSite | null | undefined
+  const token = site?.access_token ?? site?.code
+  if (!token)
+    return ''
+
+  const baseUrl = site?.app_base_url || (typeof window === 'undefined' ? '' : window.location.origin)
+  return `${baseUrl.replace(/\/$/, '')}/agent/${token}`
+}
+
+export function AgentAccessPage({
+  agentId,
+}: AgentAccessPageProps) {
+  const { t } = useTranslation('agentV2')
+  const docLink = useDocLink()
+  const agentQuery = useQuery(consoleQuery.agent.byAgentId.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  }))
+  const [isWebAppEnabled, setIsWebAppEnabled] = useState(true)
+  const [isServiceApiEnabled, setIsServiceApiEnabled] = useState(true)
+  const webAppUrl = getAgentWebAppUrl(agentQuery.data)
+  const handleUnavailableAction = () => {
+    toast.info(t('agentDetail.access.actionUnavailable'))
+  }
+
+  return (
+    <section
+      aria-label={t('agentDetail.sections.access')}
+      className="flex h-full min-w-0 flex-1 flex-col overflow-hidden bg-components-panel-bg-blur"
+    >
+      <header className="h-15.5 shrink-0 px-6 pt-3 pb-2">
+        <div className="min-w-0">
+          <h2 className="system-xl-semibold text-text-primary">
+            {t('agentDetail.access.title')}
+          </h2>
+          <p className="mt-1 flex min-w-0 flex-wrap items-center gap-x-0.5 system-xs-regular text-text-tertiary">
+            <span>{t('agentDetail.access.description')}</span>
+            <a
+              href={docLink('/use-dify/publish/webapp/web-app-access')}
+              target="_blank"
+              rel="noreferrer"
+              className="inline-flex shrink-0 items-center gap-0.5 rounded-sm text-text-accent hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            >
+              {t('agentDetail.access.learnMore')}
+              <span aria-hidden className="i-ri-external-link-line size-3" />
+            </a>
+          </p>
+        </div>
+      </header>
+
+      <ScrollArea
+        className="min-h-0 flex-1 overflow-hidden"
+        slotClassNames={{
+          content: 'px-6 pt-2 pb-8',
+        }}
+      >
+        <div className="w-full min-w-0 space-y-6">
+          <div className="grid w-full grid-cols-1 gap-3 xl:grid-cols-2">
+            <AccessSurfaceCard
+              title={t('agentDetail.access.webApp.title')}
+              icon="i-ri-window-line"
+              iconClassName="bg-state-accent-solid text-text-primary-on-surface"
+              endpointLabel={t('agentDetail.access.webApp.accessUrl')}
+              endpoint={webAppUrl}
+              enabled={isWebAppEnabled}
+              onEnabledChange={setIsWebAppEnabled}
+              copyLabel={t('agentDetail.access.copyAccessUrl')}
+              badge={<SsoBadge />}
+              onUnavailableAction={handleUnavailableAction}
+            >
+              <Button
+                variant="secondary"
+                size="medium"
+                nativeButton={false}
+                className="gap-1.5 px-3"
+                render={<a href={webAppUrl} target="_blank" rel="noreferrer" aria-label={t('agentDetail.access.webApp.actions.launch')} />}
+              >
+                <span aria-hidden className="i-ri-external-link-line size-4" />
+                {t('agentDetail.access.webApp.actions.launch')}
+              </Button>
+              <Button variant="secondary" size="medium" className="gap-1.5 px-3" onClick={handleUnavailableAction}>
+                <span aria-hidden className="i-ri-window-line size-4" />
+                {t('agentDetail.access.webApp.actions.embedded')}
+              </Button>
+              <Button variant="secondary" size="medium" className="gap-1.5 px-3" onClick={handleUnavailableAction}>
+                <span aria-hidden className="i-ri-paint-brush-line size-4" />
+                {t('agentDetail.access.webApp.actions.customize')}
+              </Button>
+              <Button variant="secondary" size="medium" className="gap-1.5 px-3" onClick={handleUnavailableAction}>
+                <span aria-hidden className="i-ri-equalizer-line size-4" />
+                {t('agentDetail.access.webApp.actions.settings')}
+              </Button>
+            </AccessSurfaceCard>
+
+            <AccessSurfaceCard
+              title={t('agentDetail.access.serviceApi.title')}
+              icon="i-ri-node-tree"
+              iconClassName="bg-state-accent-solid text-text-primary-on-surface"
+              endpointLabel={t('agentDetail.access.serviceApi.endpoint')}
+              endpoint={serviceApiEndpoint}
+              enabled={isServiceApiEnabled}
+              onEnabledChange={setIsServiceApiEnabled}
+              copyLabel={t('agentDetail.access.copyServiceEndpoint')}
+              onUnavailableAction={handleUnavailableAction}
+            >
+              <Button variant="secondary" size="medium" className="gap-1.5 px-3" onClick={handleUnavailableAction}>
+                <span aria-hidden className="i-ri-key-2-line size-4" />
+                {t('agentDetail.access.serviceApi.actions.apiKey')}
+                <span className="rounded-md bg-components-badge-bg-gray-soft px-1.5 code-xs-regular text-text-tertiary">
+                  21
+                </span>
+              </Button>
+              <Button
+                variant="secondary"
+                size="medium"
+                nativeButton={false}
+                className="gap-1.5 px-3"
+                render={<a href={docLink('/use-dify/publish/developing-with-apis')} target="_blank" rel="noreferrer" aria-label={t('agentDetail.access.serviceApi.actions.apiReference')} />}
+              >
+                <span aria-hidden className="i-ri-book-open-line size-4" />
+                {t('agentDetail.access.serviceApi.actions.apiReference')}
+              </Button>
+            </AccessSurfaceCard>
+          </div>
+
+          <section aria-labelledby="agent-workflow-access-title">
+            <div className="mb-3">
+              <h3 id="agent-workflow-access-title" className="system-md-semibold text-text-primary">
+                {t('agentDetail.access.workflow.title')}
+              </h3>
+              <p className="mt-0.5 system-xs-regular text-text-tertiary">
+                {t('agentDetail.access.workflow.description')}
+              </p>
+            </div>
+
+            <WorkflowReferencesTable agentId={agentId} />
+          </section>
+        </div>
+      </ScrollArea>
+    </section>
+  )
+}
+
+function AccessSurfaceCard({
+  title,
+  icon,
+  iconClassName,
+  endpointLabel,
+  endpoint,
+  enabled,
+  onEnabledChange,
+  copyLabel,
+  children,
+  badge,
+  onUnavailableAction,
+}: AccessSurfaceCardProps) {
+  const { t } = useTranslation('agentV2')
+  const { copy } = useClipboard({
+    onCopyError: () => {
+      toast.error(t('agentDetail.access.copyFailed'))
+    },
+  })
+
+  const handleCopyEndpoint = () => {
+    void copy(endpoint)
+  }
+
+  return (
+    <article className="overflow-hidden rounded-xl border border-components-panel-border bg-components-panel-bg shadow-xs">
+      <div className="px-4 pt-4 pb-4">
+        <div className="flex min-w-0 items-center gap-3">
+          <div className="flex min-w-0 flex-1 items-center gap-2">
+            <span className={cn('flex size-6 shrink-0 items-center justify-center rounded-lg', iconClassName)}>
+              <span aria-hidden className={cn(icon, 'size-4')} />
+            </span>
+            <h3 className="truncate system-md-semibold text-text-secondary">
+              {title}
+            </h3>
+            {badge}
+          </div>
+
+          <div className="flex shrink-0 items-center gap-3">
+            <span className={cn(
+              'inline-flex items-center gap-1 system-xs-semibold-uppercase',
+              enabled ? 'text-util-colors-green-green-700' : 'text-text-tertiary',
+            )}
+            >
+              <StatusDot status={enabled ? 'success' : 'disabled'} size="small" />
+              {t(enabled ? 'agentDetail.access.status.inService' : 'agentDetail.access.status.outOfService')}
+            </span>
+            <Switch
+              size="md"
+              checked={enabled}
+              aria-label={t('agentDetail.access.toggleSurface', { name: title })}
+              onCheckedChange={onEnabledChange}
+            />
+          </div>
+        </div>
+
+        <div className="mt-3">
+          <div className="system-xs-medium text-text-tertiary">
+            {endpointLabel}
+          </div>
+          <div className="mt-1 flex h-8 min-w-0 items-center rounded-lg bg-components-input-bg-normal px-2">
+            <span className="min-w-0 flex-1 truncate system-sm-regular text-text-secondary" translate="no">
+              {endpoint}
+            </span>
+            <Button
+              variant="ghost"
+              size="small"
+              className="size-6 shrink-0 px-0 text-text-tertiary hover:text-text-secondary"
+              aria-label={copyLabel}
+              onClick={handleCopyEndpoint}
+            >
+              <span aria-hidden className="i-ri-file-copy-line size-4" />
+            </Button>
+            {badge !== undefined && badge !== null && (
+              <>
+                <span className="mx-1.5 h-3.5 w-px shrink-0 bg-divider-regular" />
+                <Button
+                  variant="ghost"
+                  size="small"
+                  className="size-6 shrink-0 px-0 text-text-tertiary hover:text-text-secondary"
+                  aria-label={t('agentDetail.access.webApp.showQrCode')}
+                  onClick={onUnavailableAction}
+                >
+                  <span aria-hidden className="i-ri-qr-code-line size-4" />
+                </Button>
+                <Button
+                  variant="ghost"
+                  size="small"
+                  className="size-6 shrink-0 px-0 text-text-tertiary hover:text-text-secondary"
+                  aria-label={t('agentDetail.access.webApp.refreshUrl')}
+                  onClick={onUnavailableAction}
+                >
+                  <span aria-hidden className="i-ri-refresh-line size-4" />
+                </Button>
+              </>
+            )}
+          </div>
+        </div>
+      </div>
+
+      <div className="flex min-h-16 flex-wrap items-center gap-2 border-t border-divider-subtle px-4 py-4">
+        {children}
+      </div>
+    </article>
+  )
+}
+
+function SsoBadge() {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <span className="inline-flex h-4.5 shrink-0 items-center gap-1 rounded-sm border border-divider-deep px-1.5 system-2xs-semibold-uppercase text-text-tertiary">
+      <span aria-hidden className="i-ri-shield-check-line size-3" />
+      {t('agentDetail.access.webApp.ssoEnabled')}
+    </span>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/__tests__/page.spec.tsx b/web/features/agent-v2/agent-detail/configure/__tests__/page.spec.tsx
new file mode 100644
index 00000000000..1214f186497
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/__tests__/page.spec.tsx
@@ -0,0 +1,144 @@
+import { render, screen } from '@testing-library/react'
+import { AgentConfigurePage } from '../page'
+
+const mocks = vi.hoisted(() => ({
+  queryState: {
+    agent: {
+      data: {
+        icon: 'agent',
+        icon_background: '#E0F2FE',
+        icon_type: 'emoji',
+        name: 'Research Agent',
+      },
+      isFetching: false,
+      isPending: false,
+      isSuccess: true,
+    },
+    composer: {
+      data: undefined,
+      isFetching: true,
+      isPending: true,
+      isSuccess: false,
+    },
+    version: {
+      data: undefined,
+      isFetching: false,
+      isPending: false,
+      isSuccess: false,
+    },
+  },
+}))
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+
+  return {
+    ...actual,
+    useQuery: vi.fn((options: { queryKey?: readonly string[] }) => {
+      const queryKey = options.queryKey?.[0]
+
+      if (queryKey === 'agent')
+        return mocks.queryState.agent
+      if (queryKey === 'composer')
+        return mocks.queryState.composer
+      if (queryKey === 'version')
+        return mocks.queryState.version
+
+      return {
+        data: undefined,
+        isFetching: false,
+        isPending: false,
+        isSuccess: false,
+      }
+    }),
+  }
+})
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        get: {
+          queryOptions: () => ({ queryKey: ['agent'] }),
+        },
+        composer: {
+          get: {
+            queryOptions: () => ({ queryKey: ['composer'] }),
+          },
+        },
+        versions: {
+          byVersionId: {
+            get: {
+              queryOptions: () => ({ queryKey: ['version'] }),
+            },
+          },
+        },
+      },
+    },
+  },
+}))
+
+vi.mock('@/app/components/header/account-setting/model-provider-page/hooks', () => ({
+  useDefaultModel: () => ({ data: undefined }),
+  useTextGenerationCurrentProviderAndModelAndModelList: () => ({
+    textGenerationModelList: [],
+  }),
+}))
+
+vi.mock('../components/orchestrate', () => ({
+  AgentOrchestratePanel: () => <div role="region" aria-label="orchestrate-panel" />,
+}))
+
+vi.mock('../components/preview/chat', () => ({
+  AgentPreviewChat: () => <div role="region" aria-label="preview-chat" />,
+}))
+
+vi.mock('../components/preview/chat-features-panel', () => ({
+  AgentChatFeaturesPanel: () => null,
+}))
+
+vi.mock('../components/preview/header', () => ({
+  AgentPreviewHeader: () => <div role="banner" />,
+}))
+
+vi.mock('../components/preview/versions-panel', () => ({
+  AgentPreviewVersionsPanel: () => null,
+}))
+
+describe('AgentConfigurePage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.queryState.agent = {
+      data: {
+        icon: 'agent',
+        icon_background: '#E0F2FE',
+        icon_type: 'emoji',
+        name: 'Research Agent',
+      },
+      isFetching: false,
+      isPending: false,
+      isSuccess: true,
+    }
+    mocks.queryState.composer = {
+      data: undefined,
+      isFetching: true,
+      isPending: true,
+      isSuccess: false,
+    }
+    mocks.queryState.version = {
+      data: undefined,
+      isFetching: false,
+      isPending: false,
+      isSuccess: false,
+    }
+  })
+
+  describe('Loading state', () => {
+    it('should show loading instead of the configure panels while composer data is pending', () => {
+      render(<AgentConfigurePage agentId="agent-1" />)
+
+      expect(screen.getByRole('status', { name: 'appApi.loading' })).toBeInTheDocument()
+      expect(screen.queryByRole('region', { name: 'orchestrate-panel' })).not.toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/__tests__/use-agent-configure-sync.spec.tsx b/web/features/agent-v2/agent-detail/configure/__tests__/use-agent-configure-sync.spec.tsx
new file mode 100644
index 00000000000..cde113dda3d
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/__tests__/use-agent-configure-sync.spec.tsx
@@ -0,0 +1,216 @@
+import type { PropsWithChildren } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { act, renderHook } from '@testing-library/react'
+import { createStore, Provider as JotaiProvider } from 'jotai'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { agentComposerDraftAtom } from '@/features/agent-v2/agent-composer/store'
+import { useAgentConfigureSync } from '../use-agent-configure-sync'
+
+const composerPutMutationFn = vi.hoisted(() => vi.fn(async (variables: {
+  body: {
+    agent_soul: Record<string, unknown>
+  }
+}) => ({
+  agent_soul: variables.body.agent_soul,
+})))
+
+const composerPutMutationOptions = vi.hoisted(() => vi.fn((options?: {
+  onSuccess?: (data: { agent_soul: Record<string, unknown> }, variables: {
+    params: { agent_id: string }
+    body: {
+      agent_soul: Record<string, unknown>
+    }
+  }) => void
+}) => ({
+  mutationFn: async (variables: {
+    params: { agent_id: string }
+    body: {
+      agent_soul: Record<string, unknown>
+    }
+  }) => {
+    const data = await composerPutMutationFn(variables)
+    options?.onSuccess?.(data, variables)
+    return data
+  },
+})))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        get: {
+          queryKey: ({ input }: { input: { params: { agent_id: string } } }) => [
+            'agent-detail',
+            input.params.agent_id,
+          ],
+        },
+        composer: {
+          get: {
+            queryKey: ({ input }: { input: { params: { agent_id: string } } }) => [
+              'agent-composer',
+              input.params.agent_id,
+            ],
+          },
+          put: {
+            mutationOptions: composerPutMutationOptions,
+          },
+        },
+        versions: {
+          get: {
+            key: () => ['agent-versions'],
+          },
+        },
+      },
+    },
+  },
+}))
+
+function renderUseAgentConfigureSync() {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+  const store = createStore()
+  const wrapper = ({ children }: PropsWithChildren) => (
+    <QueryClientProvider client={queryClient}>
+      <JotaiProvider store={store}>
+        {children}
+      </JotaiProvider>
+    </QueryClientProvider>
+  )
+
+  return {
+    ...renderHook(() => useAgentConfigureSync({
+      agentId: 'agent-1',
+      enabled: true,
+    }), { wrapper }),
+    queryClient,
+    store,
+  }
+}
+
+describe('useAgentConfigureSync', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('should automatically save configure page changes to draft', async () => {
+    vi.setSystemTime(1710000100000)
+    const { queryClient, result, store } = renderUseAgentConfigureSync()
+
+    expect(result.current.draftSavedAt).toBeUndefined()
+
+    act(() => {
+      store.set(agentComposerDraftAtom, {
+        ...defaultAgentSoulConfigFormState,
+        prompt: 'Draft only prompt',
+      })
+    })
+
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(5000)
+    })
+
+    expect(composerPutMutationFn).toHaveBeenCalledWith(expect.objectContaining({
+      params: {
+        agent_id: 'agent-1',
+      },
+      body: expect.objectContaining({
+        variant: 'agent_app',
+        save_strategy: 'save_to_current_version',
+        agent_soul: expect.objectContaining({
+          prompt: expect.objectContaining({
+            system_prompt: 'Draft only prompt',
+          }),
+        }),
+      }),
+    }))
+    expect(queryClient.getQueryData(['agent-composer', 'agent-1'])).toBeUndefined()
+    expect(result.current.draftSavedAt).toBe(1710000105000)
+  })
+
+  it('should save the latest draft immediately when requested', async () => {
+    vi.setSystemTime(1710000200000)
+    const { result, store } = renderUseAgentConfigureSync()
+
+    act(() => {
+      store.set(agentComposerDraftAtom, {
+        ...defaultAgentSoulConfigFormState,
+        prompt: 'Run prompt',
+      })
+    })
+
+    await act(async () => {
+      await result.current.saveDraft()
+    })
+
+    expect(composerPutMutationFn).toHaveBeenCalledTimes(1)
+    expect(composerPutMutationFn).toHaveBeenCalledWith(expect.objectContaining({
+      params: {
+        agent_id: 'agent-1',
+      },
+      body: expect.objectContaining({
+        variant: 'agent_app',
+        save_strategy: 'save_to_current_version',
+        agent_soul: expect.objectContaining({
+          prompt: expect.objectContaining({
+            system_prompt: 'Run prompt',
+          }),
+        }),
+      }),
+    }))
+    expect(result.current.draftSavedAt).toBe(1710000200000)
+  })
+
+  it('should publish only when publishDraft is called explicitly', async () => {
+    const { queryClient, result } = renderUseAgentConfigureSync()
+    queryClient.setQueryData(['agent-detail', 'agent-1'], {
+      active_config_is_published: false,
+      name: 'Agent',
+    })
+
+    await act(async () => {
+      await result.current.publishDraft({
+        agent_id: 'agent-1',
+        config_snapshot: {
+          prompt: {
+            system_prompt: 'Published prompt',
+          },
+        },
+      })
+    })
+
+    expect(composerPutMutationFn).toHaveBeenCalledWith(expect.objectContaining({
+      params: {
+        agent_id: 'agent-1',
+      },
+      body: expect.objectContaining({
+        variant: 'agent_app',
+        save_strategy: 'save_as_new_version',
+        agent_soul: {
+          prompt: {
+            system_prompt: 'Published prompt',
+          },
+        },
+      }),
+    }))
+    expect(queryClient.getQueryData(['agent-composer', 'agent-1'])).toEqual({
+      agent_soul: {
+        prompt: {
+          system_prompt: 'Published prompt',
+        },
+      },
+    })
+    expect(queryClient.getQueryData(['agent-detail', 'agent-1'])).toEqual({
+      active_config_is_published: true,
+      name: 'Agent',
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/__tests__/agent-prompt-editor.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/__tests__/agent-prompt-editor.spec.tsx
new file mode 100644
index 00000000000..7043cda75f0
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/__tests__/agent-prompt-editor.spec.tsx
@@ -0,0 +1,445 @@
+import type { ReactNode } from 'react'
+import type { PromptEditorProps } from '@/app/components/base/prompt-editor'
+import type { AgentTool } from '@/features/agent-v2/agent-composer/form-state'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { createStore, Provider as JotaiProvider } from 'jotai'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { agentComposerDraftAtom } from '@/features/agent-v2/agent-composer/store'
+import { agentComposerKnowledgeRetrievalsAtom } from '@/features/agent-v2/agent-composer/store-modules/knowledge'
+import { agentComposerPromptAtom } from '@/features/agent-v2/agent-composer/store-modules/prompt'
+import { agentComposerToolsAtom } from '@/features/agent-v2/agent-composer/store-modules/tools'
+import { AgentPromptEditor } from '../orchestrate/prompt-editor'
+import { AgentPromptSlashMenu } from '../orchestrate/prompt-editor/slash'
+
+const mockPromptEditor = vi.hoisted(() => vi.fn())
+const mockCopy = vi.hoisted(() => vi.fn())
+const mockReset = vi.hoisted(() => vi.fn())
+const mockBuiltInTools = vi.hoisted(() => [
+  {
+    id: 'duckduckgo',
+    name: 'DuckDuckGo',
+    author: 'Dify',
+    description: { en_US: 'DuckDuckGo tools' },
+    icon: '/duckduckgo.svg',
+    label: { en_US: 'DuckDuckGo' },
+    type: 'builtin',
+    team_credentials: {},
+    is_team_authorization: true,
+    allow_delete: false,
+    labels: [],
+    meta: {},
+    tools: [
+      {
+        name: 'ddg_search',
+        author: 'Dify',
+        label: { en_US: 'DuckDuckGo Search' },
+        description: { en_US: 'Search the web.' },
+        parameters: [],
+        labels: [],
+        output_schema: {},
+      },
+      {
+        name: 'ddg_translate',
+        author: 'Dify',
+        label: { en_US: 'DuckDuckGo Translate' },
+        description: { en_US: 'Translate search results.' },
+        parameters: [],
+        labels: [],
+        output_schema: {},
+      },
+    ],
+  },
+])
+
+vi.mock('@/app/components/base/prompt-editor', () => ({
+  __esModule: true,
+  default: (props: PromptEditorProps) => {
+    mockPromptEditor(props)
+
+    return (
+      <div>
+        <div role="textbox" aria-label={String(props.placeholder)} />
+      </div>
+    )
+  },
+}))
+
+vi.mock('@/app/components/base/infotip', () => ({
+  Infotip: ({ children }: { children: ReactNode }) => <span>{children}</span>,
+}))
+
+vi.mock('foxact/use-clipboard', () => ({
+  useClipboard: () => ({
+    copied: false,
+    copy: mockCopy,
+    reset: mockReset,
+  }),
+}))
+
+vi.mock('@/context/i18n', () => ({
+  useGetLanguage: () => 'en_US',
+}))
+
+vi.mock('@/service/use-tools', () => ({
+  useAllBuiltInTools: () => ({ data: mockBuiltInTools }),
+  useAllCustomTools: () => ({ data: [] }),
+  useAllWorkflowTools: () => ({ data: [] }),
+  useAllMCPTools: () => ({ data: [] }),
+}))
+
+vi.mock('@/hooks/use-theme', () => ({
+  default: () => ({ theme: 'light' }),
+}))
+
+const duckDuckGoSearchAction = {
+  id: 'duckduckgo-search',
+  name: 'DuckDuckGo Search',
+  toolName: 'ddg_search',
+  description: 'Search the web.',
+}
+
+const duckDuckGoProviderTool: AgentTool = {
+  id: 'duckduckgo',
+  name: 'DuckDuckGo',
+  kind: 'provider',
+  iconClassName: 'i-simple-icons-duckduckgo',
+  credentialKey: 'agentDetail.configure.tools.credential.authOne',
+  credentialVariant: 'authorized',
+  actions: [
+    duckDuckGoSearchAction,
+  ],
+}
+
+const promptEditorDraft = {
+  ...defaultAgentSoulConfigFormState,
+  skills: [
+    {
+      id: 'playwright',
+      name: 'Playwright',
+    },
+  ],
+  tools: [duckDuckGoProviderTool],
+} satisfies typeof defaultAgentSoulConfigFormState
+
+const renderAgentPromptEditor = (
+  value: string,
+  draftOverrides: Partial<typeof defaultAgentSoulConfigFormState> = {},
+) => {
+  const store = createStore()
+  store.set(agentComposerDraftAtom, {
+    ...promptEditorDraft,
+    ...draftOverrides,
+    prompt: value,
+  })
+
+  const view = render(
+    <JotaiProvider store={store}>
+      <AgentPromptEditor />
+    </JotaiProvider>,
+  )
+
+  return {
+    store,
+    ...view,
+    rerenderWithValue: (nextValue: string) => {
+      store.set(agentComposerPromptAtom, nextValue)
+      view.rerender(
+        <JotaiProvider store={store}>
+          <AgentPromptEditor />
+        </JotaiProvider>,
+      )
+    },
+  }
+}
+
+describe('AgentPromptEditor', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  // Prompt actions should expose the designed copy control and copy the current draft prompt.
+  describe('Prompt Actions', () => {
+    it('should copy the current prompt when the copy button is clicked', () => {
+      renderAgentPromptEditor('Review these tenders')
+
+      fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.prompt\.copy/i }))
+
+      expect(mockCopy).toHaveBeenCalledWith('Review these tenders')
+    })
+
+    it('should update knowledge reference labels when the retrieval title changes', () => {
+      const store = createStore()
+      store.set(agentComposerDraftAtom, {
+        ...defaultAgentSoulConfigFormState,
+        prompt: 'Use [§knowledge:retrieval-1:Old Search§] and [§knowledge:retrieval-2:Keep Search§]',
+        knowledgeRetrievals: [
+          { id: 'retrieval-1', name: 'Old Search' },
+          { id: 'retrieval-2', name: 'Keep Search' },
+        ],
+      })
+
+      store.set(agentComposerKnowledgeRetrievalsAtom, [
+        { id: 'retrieval-1', name: 'Release Search' },
+        { id: 'retrieval-2', name: 'Keep Search' },
+      ])
+
+      expect(store.get(agentComposerPromptAtom)).toBe('Use [§knowledge:retrieval-1:Release Search§] and [§knowledge:retrieval-2:Keep Search§]')
+    })
+
+    it('should update CLI tool reference labels when the tool title changes', () => {
+      const store = createStore()
+      store.set(agentComposerDraftAtom, {
+        ...defaultAgentSoulConfigFormState,
+        prompt: 'Run [§cli_tool:cli-1:Old CLI§] and [§tool:duckduckgo/ddg_search:DuckDuckGo Search§]',
+        tools: [
+          { id: 'cli-1', kind: 'cli', name: 'Old CLI' },
+          duckDuckGoProviderTool,
+        ],
+      })
+
+      store.set(agentComposerToolsAtom, [
+        { id: 'cli-1', kind: 'cli', name: 'Release CLI' },
+        {
+          ...duckDuckGoProviderTool,
+          actions: [
+            {
+              ...duckDuckGoSearchAction,
+              name: 'Renamed Provider Action',
+            },
+          ],
+        },
+      ])
+
+      expect(store.get(agentComposerPromptAtom)).toBe('Run [§cli_tool:cli-1:Release CLI§] and [§tool:duckduckgo/ddg_search:DuckDuckGo Search§]')
+    })
+
+    it('should render selected tool reference icons from configured tools', () => {
+      renderAgentPromptEditor('Run tools')
+
+      const promptEditorProps = mockPromptEditor.mock.calls.at(-1)?.[0] as PromptEditorProps
+      const renderIcon = promptEditorProps.rosterReferenceBlock?.renderIcon
+      expect(renderIcon).toBeDefined()
+
+      const { container, rerender } = render(
+        <>
+          {renderIcon?.({
+            kind: 'tool',
+            id: 'duckduckgo/ddg_search',
+            label: 'DuckDuckGo Search',
+          })}
+        </>,
+      )
+
+      expect(container.querySelector('.i-simple-icons-duckduckgo')).toBeInTheDocument()
+
+      rerender(
+        <>
+          {renderIcon?.({
+            kind: 'cli_tool',
+            id: 'cli-1',
+            label: 'Lark CLI',
+          })}
+        </>,
+      )
+
+      expect(container.querySelector('.i-ri-terminal-box-line')).toBeInTheDocument()
+    })
+  })
+
+  // Prompt slash commands should use the Agent Roster category menu and replace it with submenus.
+  describe('Slash Commands', () => {
+    it('should open category menu, show skill submenu, and append the selected reference', async () => {
+      const { store, rerenderWithValue } = renderAgentPromptEditor('Review these tenders')
+
+      expect(mockPromptEditor).toHaveBeenCalledWith(expect.objectContaining({
+        disableBracePicker: true,
+        disableSlashPicker: true,
+        rosterReferenceBlock: expect.objectContaining({
+          show: true,
+        }),
+      }))
+
+      expect(fireEvent.keyDown(screen.getByRole('textbox'), { key: '/' })).toBe(true)
+      rerenderWithValue('Review these tenders/')
+      expect(screen.getByRole('button', { name: /agentDetail\.configure\.skills\.label/i })).toBeInTheDocument()
+
+      fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.skills\.label/i }))
+      expect(screen.queryByRole('button', { name: /agentDetail\.configure\.files\.label/i })).not.toBeInTheDocument()
+
+      fireEvent.click(screen.getByRole('button', { name: /Playwright/i }))
+
+      expect(store.get(agentComposerPromptAtom)).toBe('Review these tenders [§skill:playwright:Playwright§]')
+      await waitFor(() => {
+        expect(screen.queryByRole('button', { name: /Playwright/i })).not.toBeInTheDocument()
+      })
+    })
+
+    it('should insert slash from the focused footer insert action', () => {
+      const { store } = renderAgentPromptEditor('Review these tenders')
+
+      fireEvent.focus(screen.getByRole('textbox'))
+      const insertButton = screen.getByRole('button', { name: /agentDetail\.configure\.prompt\.insert\.label/i })
+      fireEvent.pointerDown(insertButton)
+      fireEvent.click(insertButton)
+      fireEvent.pointerUp(insertButton)
+
+      expect(store.get(agentComposerPromptAtom)).toBe('Review these tenders/')
+      expect(screen.getByRole('button', { name: /agentDetail\.configure\.skills\.label/i })).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: /agentDetail\.configure\.prompt\.mention\.label/i })).not.toBeInTheDocument()
+    })
+
+    it('should insert references after prompt add actions create skills, files, CLI tools, or knowledge retrievals', () => {
+      const onSelect = vi.fn()
+      const categories = [
+        { key: 'skills' as const, label: 'Skills', icon: 'i-ri-box-3-line' },
+        { key: 'files' as const, label: 'Files', icon: 'i-ri-file-line' },
+        { key: 'tools' as const, label: 'Tools', icon: 'i-ri-box-3-line' },
+        { key: 'knowledge' as const, label: 'Knowledge', icon: 'i-ri-book-open-line' },
+      ]
+
+      const { rerender } = render(
+        <AgentPromptSlashMenu
+          view="skills"
+          categories={categories}
+          skills={[]}
+          files={[]}
+          tools={[]}
+          onToolsChange={vi.fn()}
+          onAddSkill={options => options?.onAdded?.({ id: 'skill-1', name: 'Skill One' })}
+          retrievals={[]}
+          onBack={vi.fn()}
+          onOpenCategory={vi.fn()}
+          onSelect={onSelect}
+        />,
+      )
+      fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.skills\.add/i }))
+      expect(onSelect).toHaveBeenCalledWith('[§skill:skill-1:Skill One§]')
+
+      rerender(
+        <AgentPromptSlashMenu
+          view="files"
+          categories={categories}
+          skills={[]}
+          files={[]}
+          tools={[]}
+          onToolsChange={vi.fn()}
+          onAddFile={options => options?.onAdded?.({ id: 'file-1', name: 'Guide.md', icon: 'markdown' })}
+          retrievals={[]}
+          onBack={vi.fn()}
+          onOpenCategory={vi.fn()}
+          onSelect={onSelect}
+        />,
+      )
+      fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.files\.add/i }))
+      expect(onSelect).toHaveBeenCalledWith('[§file:file-1:Guide.md§]')
+
+      rerender(
+        <AgentPromptSlashMenu
+          view="knowledge"
+          categories={categories}
+          skills={[]}
+          files={[]}
+          tools={[]}
+          onToolsChange={vi.fn()}
+          onAddKnowledge={options => options?.onAdded?.({ id: 'retrieval-1', name: 'Retrieval One', queryMode: 'agent' })}
+          retrievals={[]}
+          onBack={vi.fn()}
+          onOpenCategory={vi.fn()}
+          onSelect={onSelect}
+        />,
+      )
+      fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.knowledgeRetrieval\.add/i }))
+      expect(onSelect).toHaveBeenCalledWith('[§knowledge:retrieval-1:Retrieval One§]')
+
+      rerender(
+        <AgentPromptSlashMenu
+          view="tools"
+          categories={categories}
+          skills={[]}
+          files={[]}
+          tools={[]}
+          onToolsChange={vi.fn()}
+          onAddCliTool={options => options?.onAdded?.({ id: 'cli-1', kind: 'cli', name: 'Lark CLI' })}
+          retrievals={[]}
+          onBack={vi.fn()}
+          onOpenCategory={vi.fn()}
+          onSelect={onSelect}
+        />,
+      )
+      fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.tools\.cliDialog\.title/i }))
+      expect(onSelect).toHaveBeenCalledWith('[§cli_tool:cli-1:Lark CLI§]')
+    })
+
+    it('should append available provider tool references and add missing tools to the configuration', () => {
+      const { store, rerenderWithValue } = renderAgentPromptEditor('Research/', { tools: [] })
+
+      fireEvent.keyDown(screen.getByRole('textbox'), { key: '/' })
+      fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.tools\.label/i }))
+      fireEvent.click(screen.getByRole('button', { name: 'DuckDuckGo' }))
+      fireEvent.click(screen.getByRole('button', { name: /DuckDuckGo Search/i }))
+
+      expect(store.get(agentComposerPromptAtom)).toBe('Research [§tool:duckduckgo/ddg_search:DuckDuckGo Search§]')
+      expect(store.get(agentComposerDraftAtom).tools).toEqual([
+        expect.objectContaining({
+          id: 'duckduckgo',
+          actions: [
+            expect.objectContaining({
+              name: 'DuckDuckGo Search',
+              toolName: 'ddg_search',
+            }),
+          ],
+        }),
+      ])
+
+      rerenderWithValue('Research/')
+      fireEvent.keyDown(screen.getByRole('textbox'), { key: '/' })
+      fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.tools\.label/i }))
+      fireEvent.click(screen.getByRole('button', { name: /DuckDuckGo.*agentDetail\.configure\.tools\.toolTabs\.plugins/i }))
+
+      expect(store.get(agentComposerPromptAtom)).toBe('Research [§tool:duckduckgo/*:DuckDuckGo§]')
+      expect(store.get(agentComposerDraftAtom).tools).toEqual([
+        expect.objectContaining({
+          id: 'duckduckgo',
+          actions: [
+            expect.objectContaining({ toolName: 'ddg_search' }),
+            expect.objectContaining({ toolName: 'ddg_translate' }),
+          ],
+        }),
+      ])
+    })
+
+    it('should close slash menu when slash is deleted or the user clicks outside', async () => {
+      const { rerenderWithValue } = renderAgentPromptEditor('Review/')
+
+      fireEvent.keyDown(screen.getByRole('textbox'), { key: '/' })
+      expect(screen.getByRole('button', { name: /agentDetail\.configure\.skills\.label/i })).toBeInTheDocument()
+
+      rerenderWithValue('Review')
+      fireEvent.keyUp(screen.getByRole('textbox'), { key: 'Backspace' })
+
+      await waitFor(() => {
+        expect(screen.queryByRole('button', { name: /agentDetail\.configure\.skills\.label/i })).not.toBeInTheDocument()
+      })
+
+      rerenderWithValue('Review/')
+      fireEvent.keyDown(screen.getByRole('textbox'), { key: '/' })
+      expect(screen.getByRole('button', { name: /agentDetail\.configure\.skills\.label/i })).toBeInTheDocument()
+
+      fireEvent.pointerDown(document.body)
+
+      await waitFor(() => {
+        expect(screen.queryByRole('button', { name: /agentDetail\.configure\.skills\.label/i })).not.toBeInTheDocument()
+      })
+    })
+
+    it('should reopen slash menu when the cursor is positioned after slash', async () => {
+      renderAgentPromptEditor('Review/')
+
+      fireEvent.keyUp(screen.getByRole('textbox'), { key: 'ArrowRight' })
+
+      await waitFor(() => {
+        expect(screen.getByRole('button', { name: /agentDetail\.configure\.skills\.label/i })).toBeInTheDocument()
+      })
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/add-actions.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/add-actions.spec.tsx
new file mode 100644
index 00000000000..9e168f3eeb2
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/add-actions.spec.tsx
@@ -0,0 +1,65 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentOrchestrateAddActionsProvider } from '../add-actions'
+import { useAgentOrchestrateAddActions, useRegisterAgentOrchestrateAddAction } from '../add-actions-context'
+
+function InlineActionRegisterer({
+  label,
+  onAction,
+}: {
+  label: string
+  onAction: (label: string) => void
+}) {
+  useRegisterAgentOrchestrateAddAction('knowledge', () => {
+    onAction(label)
+  })
+
+  return null
+}
+
+function RegisteredActionTrigger() {
+  const actions = useAgentOrchestrateAddActions()
+
+  return (
+    <button type="button" disabled={!actions.knowledge} onClick={() => actions.knowledge?.()}>
+      Run action
+    </button>
+  )
+}
+
+describe('AgentOrchestrateAddActionsProvider', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('Registration', () => {
+    it('should keep the registered action stable while calling the latest callback when the action prop changes every render', async () => {
+      const handleAction = vi.fn()
+
+      const { rerender } = render(
+        <AgentOrchestrateAddActionsProvider>
+          <InlineActionRegisterer label="first" onAction={handleAction} />
+          <RegisteredActionTrigger />
+        </AgentOrchestrateAddActionsProvider>,
+      )
+
+      await waitFor(() => {
+        expect(screen.getByRole('button', { name: 'Run action' })).toBeEnabled()
+      })
+
+      fireEvent.click(screen.getByRole('button', { name: 'Run action' }))
+
+      rerender(
+        <AgentOrchestrateAddActionsProvider>
+          <InlineActionRegisterer label="second" onAction={handleAction} />
+          <RegisteredActionTrigger />
+        </AgentOrchestrateAddActionsProvider>,
+      )
+
+      fireEvent.click(screen.getByRole('button', { name: 'Run action' }))
+
+      expect(handleAction).toHaveBeenNthCalledWith(1, 'first')
+      expect(handleAction).toHaveBeenNthCalledWith(2, 'second')
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/empty-sections.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/empty-sections.spec.tsx
new file mode 100644
index 00000000000..ef583288a07
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/empty-sections.spec.tsx
@@ -0,0 +1,52 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { AgentFiles } from '../files'
+import { AgentKnowledgeRetrieval } from '../knowledge'
+import { AgentSkills } from '../skills'
+import { AgentTools } from '../tools'
+
+function renderEmptySections() {
+  const queryClient = new QueryClient()
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentComposerProvider
+        initialDraft={{
+          ...defaultAgentSoulConfigFormState,
+          files: [],
+          knowledgeRetrievals: [],
+          skills: [],
+          tools: [],
+        }}
+      >
+        <AgentSkills agentId="agent-1" />
+        <AgentFiles agentId="agent-1" />
+        <AgentTools />
+        <AgentKnowledgeRetrieval />
+      </AgentComposerProvider>
+    </QueryClientProvider>,
+  )
+}
+
+describe('Agent configure empty sections', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  // Empty composer resources should still render scannable placeholders in each section.
+  it('should render placeholders when resources are empty', () => {
+    renderEmptySections()
+
+    expect(screen.getByText('agentV2.agentDetail.configure.skills.empty.title')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.skills.empty.description')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.files.empty.title')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.files.empty.description')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.tools.empty.title')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.tools.empty.description')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.knowledgeRetrieval.empty.title')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.knowledgeRetrieval.empty.description')).toBeInTheDocument()
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/publish-bar.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/publish-bar.spec.tsx
new file mode 100644
index 00000000000..5e4fe175882
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/publish-bar.spec.tsx
@@ -0,0 +1,417 @@
+import type { AgentConfigSnapshotSummaryResponse, AgentReferencingWorkflowResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { ComponentProps } from 'react'
+import type { Mock } from 'vitest'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { act, fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import { createStore, Provider as JotaiProvider } from 'jotai'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { agentComposerDraftAtom, agentComposerOriginalDraftAtom, agentComposerPublishedDraftAtom } from '@/features/agent-v2/agent-composer/store'
+import { agentComposerPromptAtom } from '@/features/agent-v2/agent-composer/store-modules/prompt'
+import { AgentConfigurePublishBar } from '../publish-bar'
+
+type PublishHandler = NonNullable<ComponentProps<typeof AgentConfigurePublishBar>['onPublish']>
+type PublishMock = Mock<PublishHandler>
+
+const hotkeyRegistrations = vi.hoisted(() => new Map<string, {
+  callback: (event: { preventDefault: () => void }) => void
+  options?: { enabled?: boolean, ignoreInputs?: boolean }
+}>())
+
+const mockFormatForDisplay = vi.hoisted(() => vi.fn((hotkey: string) => `display:${hotkey}`))
+const mockFormatTimeFromNow = vi.hoisted(() => vi.fn(() => 'just now'))
+const workflowReferences = vi.hoisted(() => ({
+  data: [] as AgentReferencingWorkflowResponse[],
+}))
+
+vi.mock('@tanstack/react-hotkeys', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-hotkeys')>()
+  return {
+    ...actual,
+    formatForDisplay: mockFormatForDisplay,
+    useHotkey: (hotkey: string, callback: (event: { preventDefault: () => void }) => void, options?: { enabled?: boolean, ignoreInputs?: boolean }) => {
+      hotkeyRegistrations.set(hotkey, { callback, options })
+    },
+  }
+})
+
+vi.mock('@/hooks/use-format-time-from-now', () => ({
+  useFormatTimeFromNow: () => ({
+    formatTimeFromNow: mockFormatTimeFromNow,
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        referencingWorkflows: {
+          get: {
+            queryOptions: ({ input }: { input: { params: { agent_id: string } } }) => ({
+              queryKey: ['agent-referencing-workflows', input],
+              queryFn: async () => ({
+                data: workflowReferences.data,
+              }),
+            }),
+          },
+        },
+      },
+    },
+  },
+}))
+
+vi.mock('@langgenius/dify-ui/popover', async () => {
+  const React = await import('react')
+  const ReactDOM = await import('react-dom')
+  const PopoverContext = React.createContext<{
+    open: boolean
+    onOpenChange?: (open: boolean) => void
+  }>({
+    open: false,
+  })
+
+  return {
+    Popover: ({
+      children,
+      open,
+      onOpenChange,
+    }: {
+      children: React.ReactNode
+      open?: boolean
+      onOpenChange?: (open: boolean) => void
+    }) => (
+      <PopoverContext value={{ open: !!open, onOpenChange }}>
+        {children}
+      </PopoverContext>
+    ),
+    PopoverContent: ({
+      children,
+    }: {
+      children: React.ReactNode
+    }) => {
+      const context = React.use(PopoverContext)
+      if (!context.open)
+        return null
+
+      return ReactDOM.createPortal(<div data-testid="publish-impact-popover">{children}</div>, document.body)
+    },
+    PopoverTrigger: ({
+      render: trigger,
+    }: {
+      render: React.ReactElement
+    }) => trigger,
+  }
+})
+
+const activeConfigSnapshot: AgentConfigSnapshotSummaryResponse = {
+  id: 'snapshot-1',
+  agent_id: 'agent-1',
+  version: 1,
+  created_at: 1710000000,
+}
+
+const originalDraftWithFile = {
+  ...defaultAgentSoulConfigFormState,
+  files: [
+    {
+      id: 'preview-image',
+      name: 'agent-roster-skill-detail-dialog-preview-image.png',
+      icon: 'image',
+    },
+  ],
+} satisfies typeof defaultAgentSoulConfigFormState
+
+const publishedReferences: AgentReferencingWorkflowResponse[] = [
+  {
+    app_id: 'app-python',
+    app_mode: 'workflow',
+    app_name: 'Python bug fixer',
+    workflow_id: 'workflow-python',
+    workflow_version: '1',
+    node_ids: ['node-python'],
+  },
+  {
+    app_id: 'app-translation',
+    app_icon: 'T',
+    app_icon_background: '#E0F2FE',
+    app_icon_type: 'emoji',
+    app_mode: 'workflow',
+    app_name: 'Translation Workflow',
+    workflow_id: 'workflow-translation',
+    workflow_version: '1',
+    node_ids: ['node-translation'],
+  },
+]
+
+function renderPublishBar({
+  activeConfigIsPublished,
+  activeConfigSnapshot,
+  draftSavedAt,
+  isPublishing,
+  onPublish = vi.fn<PublishHandler>(),
+  prompt = '',
+  setupStore,
+  usedByAppReferences = [],
+}: {
+  activeConfigIsPublished?: boolean
+  activeConfigSnapshot?: AgentConfigSnapshotSummaryResponse | null
+  draftSavedAt?: number
+  isPublishing?: boolean
+  onPublish?: PublishMock
+  prompt?: string
+  setupStore?: (store: ReturnType<typeof createStore>) => void
+  usedByAppReferences?: AgentReferencingWorkflowResponse[]
+} = {}) {
+  workflowReferences.data = usedByAppReferences
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+  const store = createStore()
+  store.set(agentComposerPromptAtom, prompt)
+  setupStore?.(store)
+
+  render(
+    <QueryClientProvider client={queryClient}>
+      <JotaiProvider store={store}>
+        <AgentConfigurePublishBar
+          agentId="agent-1"
+          activeConfigIsPublished={activeConfigIsPublished}
+          activeConfigSnapshot={activeConfigSnapshot}
+          draftSavedAt={draftSavedAt}
+          agentName="Iris"
+          isPublishing={isPublishing}
+          onPublish={onPublish}
+          onOpenVersions={vi.fn()}
+        />
+      </JotaiProvider>
+    </QueryClientProvider>,
+  )
+
+  return {
+    onPublish,
+  }
+}
+
+describe('AgentConfigurePublishBar', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    hotkeyRegistrations.clear()
+    workflowReferences.data = []
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('should render draft state with a formatted publish shortcut', () => {
+    renderPublishBar()
+
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.draft')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.saved')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /agentV2\.agentDetail\.publish/ })).toBeInTheDocument()
+    expect(screen.getByText('display:Mod')).toBeInTheDocument()
+    expect(screen.getByText('display:Shift')).toBeInTheDocument()
+    expect(screen.getByText('display:P')).toBeInTheDocument()
+    expect(mockFormatForDisplay).toHaveBeenCalledWith('Mod')
+    expect(hotkeyRegistrations.get('Mod+Shift+P')?.options).toEqual(
+      expect.objectContaining({ enabled: true, ignoreInputs: false }),
+    )
+  })
+
+  it('should render saved time from the latest draft save timestamp', () => {
+    renderPublishBar({ draftSavedAt: 1710000100000 })
+
+    expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishBar\.savedAt/)).toBeInTheDocument()
+    expect(mockFormatTimeFromNow).toHaveBeenCalledWith(1710000100000)
+  })
+
+  it('should render published state from the active snapshot and disable publish logic', () => {
+    const { onPublish } = renderPublishBar({
+      activeConfigIsPublished: true,
+      activeConfigSnapshot,
+    })
+
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.upToDate')).toBeInTheDocument()
+    expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishBar\.publishedAt/)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishBar.published' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.queryByText('display:Mod')).not.toBeInTheDocument()
+    expect(mockFormatTimeFromNow).toHaveBeenCalledWith(1710000000 * 1000)
+    expect(hotkeyRegistrations.get('Mod+Shift+P')?.options).toEqual(
+      expect.objectContaining({ enabled: false, ignoreInputs: false }),
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishBar.published' }))
+
+    expect(onPublish).not.toHaveBeenCalled()
+  })
+
+  it('should initialize unpublished state when active config is not published', async () => {
+    const { onPublish } = renderPublishBar({
+      activeConfigIsPublished: false,
+      activeConfigSnapshot,
+    })
+
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.unpublishedChanges')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ })).toBeInTheDocument()
+    expect(hotkeyRegistrations.get('Mod+Shift+P')?.options).toEqual(
+      expect.objectContaining({ enabled: true, ignoreInputs: false }),
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ }))
+
+    await waitFor(() => {
+      expect(onPublish).toHaveBeenCalledWith(expect.objectContaining({
+        agent_id: 'agent-1',
+      }))
+    })
+  })
+
+  it('should publish the current draft payload from the unpublished changes state', async () => {
+    const { onPublish } = renderPublishBar({
+      activeConfigSnapshot,
+      prompt: 'Updated system prompt',
+    })
+
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.unpublishedChanges')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ }))
+
+    await waitFor(() => {
+      expect(onPublish).toHaveBeenCalledWith(expect.objectContaining({
+        agent_id: 'agent-1',
+        config_snapshot: expect.objectContaining({
+          prompt: expect.objectContaining({
+            system_prompt: 'Updated system prompt',
+          }),
+        }),
+      }))
+    })
+  })
+
+  it('should mark non-prompt draft changes as unpublished', () => {
+    renderPublishBar({
+      activeConfigSnapshot,
+      setupStore: (store) => {
+        store.set(agentComposerPublishedDraftAtom, originalDraftWithFile)
+        store.set(agentComposerOriginalDraftAtom, originalDraftWithFile)
+        store.set(agentComposerDraftAtom, {
+          ...originalDraftWithFile,
+          files: [],
+        })
+      },
+    })
+
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.unpublishedChanges')).toBeInTheDocument()
+  })
+
+  it('should keep unpublished state after draft autosave updates the saved draft baseline', () => {
+    const publishedDraft = {
+      ...defaultAgentSoulConfigFormState,
+      prompt: 'Published prompt',
+    }
+    const savedDraft = {
+      ...defaultAgentSoulConfigFormState,
+      prompt: 'Autosaved draft prompt',
+    }
+
+    renderPublishBar({
+      activeConfigSnapshot,
+      setupStore: (store) => {
+        store.set(agentComposerPublishedDraftAtom, publishedDraft)
+        store.set(agentComposerOriginalDraftAtom, savedDraft)
+        store.set(agentComposerDraftAtom, savedDraft)
+      },
+    })
+
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.unpublishedChanges')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ })).toBeInTheDocument()
+  })
+
+  it('should render publishing as a single disabled action state', () => {
+    renderPublishBar({ isPublishing: true, prompt: 'Updated system prompt' })
+
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.publishing')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishBar.publishing' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.queryByText('display:Mod')).not.toBeInTheDocument()
+    expect(hotkeyRegistrations.get('Mod+Shift+P')?.options).toEqual(
+      expect.objectContaining({ enabled: false, ignoreInputs: false }),
+    )
+  })
+
+  it('should show affected workflow references when clicking a publishable agent in use', async () => {
+    const { onPublish } = renderPublishBar({
+      activeConfigSnapshot,
+      prompt: 'Updated system prompt',
+      usedByAppReferences: publishedReferences,
+    })
+
+    expect(screen.queryByTestId('publish-impact-popover')).not.toBeInTheDocument()
+    const publishBar = screen.getByText('agentV2.agentDetail.configure.publishBar.unpublishedChanges').closest('[aria-hidden]')
+    expect(publishBar).toHaveAttribute('aria-hidden', 'false')
+
+    fireEvent.click(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ }))
+
+    expect(onPublish).not.toHaveBeenCalled()
+    const impactPopover = await screen.findByTestId('publish-impact-popover')
+    expect(impactPopover).toBeInTheDocument()
+    expect(publishBar).toHaveAttribute('aria-hidden', 'false')
+    await waitFor(() => {
+      expect(publishBar).toHaveAttribute('aria-hidden', 'true')
+      expect(publishBar).toHaveClass('opacity-0')
+    })
+    expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishImpact\.title/)).toBeInTheDocument()
+    expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishImpact\.descriptionPrefix/)).toBeInTheDocument()
+    expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishImpact\.workflowCount/)).toBeInTheDocument()
+    expect(screen.getByText('Python bug fixer')).toBeInTheDocument()
+    expect(screen.getByText('Translation Workflow')).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: 'Python bug fixer' })).toHaveAttribute('target', '_blank')
+    expect(screen.getByRole('link', { name: 'Python bug fixer' })).toHaveAttribute('rel', 'noopener noreferrer')
+    expect(within(impactPopover).getByText('display:Mod')).toBeInTheDocument()
+    expect(within(impactPopover).getByText('display:Shift')).toBeInTheDocument()
+    expect(within(impactPopover).getByText('display:P')).toBeInTheDocument()
+  })
+
+  it('should publish from the affected workflow popover action', async () => {
+    const { onPublish } = renderPublishBar({
+      activeConfigSnapshot,
+      prompt: 'Updated system prompt',
+      usedByAppReferences: publishedReferences,
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ }))
+    fireEvent.click(within(await screen.findByTestId('publish-impact-popover')).getByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/,
+    }))
+
+    expect(onPublish).toHaveBeenCalledWith(expect.objectContaining({
+      agent_id: 'agent-1',
+    }))
+  })
+
+  it('should open the affected workflow popover from the publish shortcut before publishing', async () => {
+    const { onPublish } = renderPublishBar({
+      activeConfigSnapshot,
+      prompt: 'Updated system prompt',
+      usedByAppReferences: publishedReferences,
+    })
+    const publishShortcut = hotkeyRegistrations.get('Mod+Shift+P')
+
+    await act(async () => {
+      await publishShortcut?.callback({ preventDefault: vi.fn() })
+    })
+
+    expect(onPublish).not.toHaveBeenCalled()
+    expect(await screen.findByTestId('publish-impact-popover')).toBeInTheDocument()
+
+    await act(async () => {
+      await hotkeyRegistrations.get('Mod+Shift+P')?.callback({ preventDefault: vi.fn() })
+    })
+
+    expect(onPublish).toHaveBeenCalledWith(expect.objectContaining({
+      agent_id: 'agent-1',
+    }))
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/add-actions-context.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/add-actions-context.ts
new file mode 100644
index 00000000000..3017c2c5fa9
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/add-actions-context.ts
@@ -0,0 +1,51 @@
+import type { AgentCliTool, AgentFileNode, AgentKnowledgeRetrievalItem, AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
+import { createContext, use, useCallback, useEffect, useRef } from 'react'
+
+export type AgentOrchestrateAddActionKey = 'cli' | 'files' | 'knowledge' | 'skills'
+
+export type AgentOrchestrateAddedItem = AgentCliTool | AgentFileNode | AgentKnowledgeRetrievalItem | AgentSkill
+
+export type AgentOrchestrateAddActionOptions = {
+  onAdded?: (item: AgentOrchestrateAddedItem) => void
+}
+
+export type AgentOrchestrateAddAction = (options?: AgentOrchestrateAddActionOptions) => void
+
+export type AgentOrchestrateAddActions = Partial<Record<AgentOrchestrateAddActionKey, AgentOrchestrateAddAction>>
+
+export type AgentOrchestrateAddActionsContextValue = {
+  actions: AgentOrchestrateAddActions
+  registerAction: (key: AgentOrchestrateAddActionKey, action: AgentOrchestrateAddAction) => () => void
+}
+
+export const AgentOrchestrateAddActionsContext = createContext<AgentOrchestrateAddActionsContextValue | null>(null)
+
+export function useAgentOrchestrateAddActions() {
+  const context = use(AgentOrchestrateAddActionsContext)
+  if (!context)
+    return {}
+
+  return context.actions
+}
+
+export function useRegisterAgentOrchestrateAddAction(
+  key: AgentOrchestrateAddActionKey,
+  action: AgentOrchestrateAddAction,
+) {
+  const context = use(AgentOrchestrateAddActionsContext)
+  const registerAction = context?.registerAction
+  const actionRef = useRef(action)
+
+  actionRef.current = action
+
+  const stableAction = useCallback<AgentOrchestrateAddAction>((options) => {
+    actionRef.current(options)
+  }, [])
+
+  useEffect(() => {
+    if (!registerAction)
+      return
+
+    return registerAction(key, stableAction)
+  }, [key, registerAction, stableAction])
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/add-actions.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/add-actions.tsx
new file mode 100644
index 00000000000..2d2b952c3b6
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/add-actions.tsx
@@ -0,0 +1,53 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { AgentOrchestrateAddAction, AgentOrchestrateAddActionKey, AgentOrchestrateAddActions } from './add-actions-context'
+import { useCallback, useMemo, useState } from 'react'
+import { AgentOrchestrateAddActionsContext } from './add-actions-context'
+import { useAgentOrchestrateReadOnly } from './read-only-context'
+
+export function AgentOrchestrateAddActionsProvider({
+  children,
+}: {
+  children: ReactNode
+}) {
+  const readOnly = useAgentOrchestrateReadOnly()
+  const [actions, setActions] = useState<AgentOrchestrateAddActions>({})
+
+  const registerAction = useCallback((key: AgentOrchestrateAddActionKey, action: AgentOrchestrateAddAction) => {
+    if (readOnly)
+      return () => undefined
+
+    setActions((currentActions) => {
+      if (currentActions[key] === action)
+        return currentActions
+
+      return {
+        ...currentActions,
+        [key]: action,
+      }
+    })
+
+    return () => {
+      setActions((currentActions) => {
+        if (currentActions[key] !== action)
+          return currentActions
+
+        const nextActions = { ...currentActions }
+        delete nextActions[key]
+        return nextActions
+      })
+    }
+  }, [readOnly])
+
+  const value = useMemo(() => ({
+    actions: readOnly ? {} : actions,
+    registerAction,
+  }), [actions, readOnly, registerAction])
+
+  return (
+    <AgentOrchestrateAddActionsContext value={value}>
+      {children}
+    </AgentOrchestrateAddActionsContext>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/__tests__/env.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/__tests__/env.spec.tsx
new file mode 100644
index 00000000000..27d923f7379
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/__tests__/env.spec.tsx
@@ -0,0 +1,191 @@
+import { toast } from '@langgenius/dify-ui/toast'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { AgentOrchestrateReadOnlyContext } from '../../read-only-context'
+import { AgentEnvEditor, EnvVariablesTable } from '../env'
+import { getEnvImportPlatform, parseEnvVariables } from '../env-utils'
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    error: vi.fn(),
+  },
+}))
+
+const mockToastError = vi.mocked(toast.error)
+
+function renderAgentEnvEditor() {
+  return render(
+    <AgentComposerProvider initialDraft={defaultAgentSoulConfigFormState}>
+      <AgentEnvEditor />
+    </AgentComposerProvider>,
+  )
+}
+
+function renderReadonlyAgentEnvEditor() {
+  return render(
+    <AgentComposerProvider
+      initialDraft={{
+        ...defaultAgentSoulConfigFormState,
+        envVariables: [{
+          id: 'env-1',
+          key: 'API_KEY',
+          value: 'secret-value',
+          scope: 'secret',
+        }],
+      }}
+    >
+      <AgentOrchestrateReadOnlyContext value>
+        <AgentEnvEditor />
+      </AgentOrchestrateReadOnlyContext>
+    </AgentComposerProvider>,
+  )
+}
+
+describe('AgentEnvEditor', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('Env parsing', () => {
+    it('should parse dotenv entries from supported line formats', () => {
+      expect(parseEnvVariables([
+        '# ignored',
+        'API_KEY=abc123',
+        'export BASE_URL="https://example.com"',
+        'PASSWORD=secret # inline comment',
+        'MULTILINE="first\\nsecond"',
+        'INVALID_LINE',
+      ].join('\n'))).toEqual([
+        { key: 'API_KEY', value: 'abc123' },
+        { key: 'BASE_URL', value: 'https://example.com' },
+        { key: 'PASSWORD', value: 'secret' },
+        { key: 'MULTILINE', value: 'first\nsecond' },
+      ])
+    })
+  })
+
+  describe('Platform Detection', () => {
+    it('should detect the hidden-file help platform from browser values', () => {
+      expect(getEnvImportPlatform({ platform: 'MacIntel' })).toBe('mac')
+      expect(getEnvImportPlatform({ platform: 'Win32' })).toBe('windows')
+      expect(getEnvImportPlatform({ userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' })).toBe('windows')
+      expect(getEnvImportPlatform({ platform: 'Linux x86_64' })).toBe('other')
+    })
+  })
+
+  describe('User Interactions', () => {
+    it('should edit the initial environment variable row directly', async () => {
+      const user = userEvent.setup()
+      renderAgentEnvEditor()
+
+      const keyInput = screen.getByPlaceholderText('agentV2.agentDetail.configure.advancedSettings.envEditor.keyPlaceholder')
+      const valueInput = screen.getByPlaceholderText('agentV2.agentDetail.configure.advancedSettings.envEditor.valuePlaceholder')
+
+      await user.type(keyInput, 'API KEY')
+      await user.type(valueInput, 'secret-value')
+
+      expect(screen.getByDisplayValue('API_KEY')).toBeInTheDocument()
+      expect(screen.getByDisplayValue('secret-value')).toBeInTheDocument()
+    })
+
+    it('should reject environment variable keys that do not match workflow variable rules', () => {
+      renderAgentEnvEditor()
+
+      const keyInput = screen.getByPlaceholderText('agentV2.agentDetail.configure.advancedSettings.envEditor.keyPlaceholder')
+
+      fireEvent.change(keyInput, {
+        target: { value: '1BAD' },
+      })
+
+      expect(keyInput).toHaveValue('')
+      expect(mockToastError).toHaveBeenCalledWith('appDebug.varKeyError.notStartWithNumber:{"key":"agentV2.agentDetail.configure.advancedSettings.envEditor.keyColumn"}')
+    })
+
+    it('should add another editable variable row from the add button', async () => {
+      const user = userEvent.setup()
+      renderAgentEnvEditor()
+
+      await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.advancedSettings.envEditor.add' }))
+
+      const keyInputs = screen.getAllByPlaceholderText('agentV2.agentDetail.configure.advancedSettings.envEditor.keyPlaceholder')
+      expect(keyInputs).toHaveLength(2)
+      const newKeyInput = keyInputs[1]!
+      expect(newKeyInput).toHaveFocus()
+
+      await user.type(newKeyInput, 'SECOND_KEY')
+
+      expect(screen.getByDisplayValue('SECOND_KEY')).toBeInTheDocument()
+    })
+
+    it('should import dotenv variables into the env table when a file is selected', async () => {
+      const user = userEvent.setup()
+      const { container } = renderAgentEnvEditor()
+      const input = container.querySelector('input[type="file"]') as HTMLInputElement
+
+      expect(input).not.toHaveAttribute('accept')
+
+      const file = new File([
+        'API_KEY=abc123\n',
+        'export BASE_URL="https://example.com"\n',
+      ], '.env', { type: 'text/plain' })
+
+      await user.upload(
+        input,
+        file,
+      )
+
+      await waitFor(() => {
+        expect(screen.getByDisplayValue('API_KEY')).toBeInTheDocument()
+      })
+      expect(screen.getByDisplayValue('abc123')).toBeInTheDocument()
+      expect(screen.getByDisplayValue('BASE_URL')).toBeInTheDocument()
+      expect(screen.getByDisplayValue('https://example.com')).toBeInTheDocument()
+    })
+
+    it('should hide import, add, edit, and delete controls when readonly', () => {
+      renderReadonlyAgentEnvEditor()
+
+      expect(screen.getByText('API_KEY')).toBeInTheDocument()
+      expect(screen.getByText('secret-value')).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'agentV2.agentDetail.configure.advancedSettings.envEditor.importEnv' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'agentV2.agentDetail.configure.advancedSettings.envEditor.add' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.advancedSettings.envEditor.deleteVariable:{"key":"API_KEY"}',
+      })).not.toBeInTheDocument()
+      expect(screen.queryByDisplayValue('API_KEY')).not.toBeInTheDocument()
+    })
+
+    it('should reveal and hide masked variable values from the eye button', async () => {
+      const user = userEvent.setup()
+
+      render(
+        <EnvVariablesTable
+          editable
+          envVariables={[{
+            id: 'env-1',
+            key: 'API_KEY',
+            value: 'sk-original',
+            scope: 'secret',
+            masked: true,
+          }]}
+          onDelete={vi.fn()}
+          onScopeChange={vi.fn()}
+          showDraftRow={false}
+        />,
+      )
+
+      expect(screen.queryByDisplayValue('sk-original')).not.toBeInTheDocument()
+
+      await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.advancedSettings.envEditor.revealValue:{"key":"API_KEY"}' }))
+
+      expect(screen.getByDisplayValue('sk-original')).toBeInTheDocument()
+
+      await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.advancedSettings.envEditor.hideValue:{"key":"API_KEY"}' }))
+
+      expect(screen.queryByDisplayValue('sk-original')).not.toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/content-moderation.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/content-moderation.tsx
new file mode 100644
index 00000000000..532627f25dd
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/content-moderation.tsx
@@ -0,0 +1,184 @@
+'use client'
+
+import type { AgentSoulAppFeaturesConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { Features } from '@/app/components/base/features/types'
+import type { ModerationConfig } from '@/models/debug'
+import { Button } from '@langgenius/dify-ui/button'
+import { Switch } from '@langgenius/dify-ui/switch'
+import { useCallback, useMemo } from 'react'
+import { useTranslation } from 'react-i18next'
+import { FeaturesProvider } from '@/app/components/base/features'
+import { useFeatures, useFeaturesStore } from '@/app/components/base/features/hooks'
+import { useLocale } from '@/context/i18n'
+import { useModalContext } from '@/context/modal-context'
+import { useAppFeatures, useSetAppFeatures } from '@/features/agent-v2/agent-composer/store-modules/app-features'
+import { useCodeBasedExtensions } from '@/service/use-common'
+import { ConfigureSection } from '../common/section'
+
+const defaultModerationConfig: ModerationConfig = {
+  enabled: true,
+  type: 'openai_moderation',
+  config: {
+    inputs_config: {
+      enabled: true,
+      preset_response: '',
+    },
+  },
+}
+
+function AgentContentModerationSettingsContent() {
+  const { t } = useTranslation()
+  const locale = useLocale()
+  const featuresStore = useFeaturesStore()
+  const setAppFeatures = useSetAppFeatures()
+  const { setShowModerationSettingModal } = useModalContext()
+  const moderation = useFeatures(state => state.features.moderation)
+  const { data: codeBasedExtensionList } = useCodeBasedExtensions('moderation')
+  const panelId = 'agent-configure-content-moderation-panel'
+
+  const persistModeration = useCallback((nextModeration?: ModerationConfig) => {
+    if (!nextModeration)
+      return
+
+    const store = featuresStore?.getState()
+    if (!store)
+      return
+
+    store.setFeatures({
+      ...store.features,
+      moderation: nextModeration,
+    })
+    setAppFeatures(appFeatures => ({
+      ...appFeatures,
+      sensitive_word_avoidance: nextModeration as AgentSoulAppFeaturesConfig['sensitive_word_avoidance'],
+    }))
+  }, [featuresStore, setAppFeatures])
+
+  const openSettings = useCallback((payload: ModerationConfig = moderation as ModerationConfig) => {
+    setShowModerationSettingModal({
+      payload,
+      onSaveCallback: persistModeration,
+      onCancelCallback: () => {},
+    })
+  }, [moderation, persistModeration, setShowModerationSettingModal])
+
+  const handleEnabledChange = useCallback((enabled: boolean) => {
+    if (enabled) {
+      if (!moderation?.type) {
+        openSettings(defaultModerationConfig)
+        return
+      }
+
+      persistModeration({
+        ...(moderation as ModerationConfig),
+        enabled: true,
+      })
+      return
+    }
+
+    persistModeration({ enabled: false })
+  }, [moderation, openSettings, persistModeration])
+
+  const providerContent = useMemo(() => {
+    if (moderation?.type === 'openai_moderation')
+      return t('feature.moderation.modal.provider.openai', { ns: 'appDebug' })
+    if (moderation?.type === 'keywords')
+      return t('feature.moderation.modal.provider.keywords', { ns: 'appDebug' })
+    if (moderation?.type === 'api')
+      return t('apiBasedExtension.selector.title', { ns: 'common' })
+
+    return codeBasedExtensionList?.data.find(item => item.name === moderation?.type)?.label[locale] || '-'
+  }, [codeBasedExtensionList?.data, locale, moderation?.type, t])
+
+  const enabledContent = useMemo(() => {
+    if (moderation?.config?.inputs_config?.enabled && moderation.config?.outputs_config?.enabled)
+      return t('feature.moderation.allEnabled', { ns: 'appDebug' })
+    if (moderation?.config?.inputs_config?.enabled)
+      return t('feature.moderation.inputEnabled', { ns: 'appDebug' })
+    if (moderation?.config?.outputs_config?.enabled)
+      return t('feature.moderation.outputEnabled', { ns: 'appDebug' })
+
+    return '-'
+  }, [moderation?.config?.inputs_config?.enabled, moderation?.config?.outputs_config?.enabled, t])
+
+  return (
+    <ConfigureSection
+      label={t('feature.moderation.title', { ns: 'appDebug' })}
+      labelId="agent-configure-content-moderation-label"
+      headingLevel="h4"
+      panelId={panelId}
+      tip={t('feature.moderation.description', { ns: 'appDebug' })}
+      tipAriaLabel={t('feature.moderation.description', { ns: 'appDebug' })}
+      rootClassName="gap-1 border-t border-divider-subtle py-3"
+      headerClassName="mb-0 gap-1 px-3"
+      panelContentClassName="px-3 pt-1"
+      actions={(
+        <div className="flex shrink-0 items-center gap-2">
+          {!!moderation?.enabled && (
+            <Button
+              size="small"
+              variant="ghost"
+              className="h-6 gap-0.5 px-1.5 py-1 text-text-tertiary"
+              onClick={() => openSettings()}
+            >
+              <span className="i-ri-equalizer-2-line size-3.5" aria-hidden />
+              <span className="px-0.5 system-xs-medium">
+                {t('operation.settings', { ns: 'common' })}
+              </span>
+            </Button>
+          )}
+          <div className="h-3 w-px bg-divider-regular" />
+          <Switch checked={!!moderation?.enabled} onCheckedChange={handleEnabledChange} size="sm" />
+        </div>
+      )}
+    >
+      {moderation?.enabled
+        ? (
+            <div className="flex min-w-0 items-center gap-4">
+              <div className="min-w-0">
+                <div className="mb-0.5 truncate system-2xs-medium-uppercase text-text-tertiary">
+                  {t('feature.moderation.modal.provider.title', { ns: 'appDebug' })}
+                </div>
+                <div className="truncate system-xs-regular text-text-secondary">
+                  {providerContent}
+                </div>
+              </div>
+              <div className="h-[27px] w-px shrink-0 rotate-12 bg-divider-subtle" />
+              <div className="min-w-0">
+                <div className="mb-0.5 truncate system-2xs-medium-uppercase text-text-tertiary">
+                  {t('feature.moderation.contentEnableLabel', { ns: 'appDebug' })}
+                </div>
+                <div className="truncate system-xs-regular text-text-secondary">
+                  {enabledContent}
+                </div>
+              </div>
+            </div>
+          )
+        : (
+            <p className="system-xs-regular text-text-tertiary">
+              {t('feature.moderation.description', { ns: 'appDebug' })}
+            </p>
+          )}
+    </ConfigureSection>
+  )
+}
+
+export function AgentContentModerationSettings() {
+  const appFeatures = useAppFeatures()
+  const moderation = appFeatures?.sensitive_word_avoidance
+  const features = useMemo<Features>(() => ({
+    moderation: moderation
+      ? {
+          ...moderation,
+          type: moderation.type ?? undefined,
+        }
+      : { enabled: false },
+  }), [moderation])
+  const featuresKey = useMemo(() => JSON.stringify(moderation ?? {}), [moderation])
+
+  return (
+    <FeaturesProvider key={featuresKey} features={features}>
+      <AgentContentModerationSettingsContent />
+    </FeaturesProvider>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/env-utils.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/env-utils.ts
new file mode 100644
index 00000000000..4a6b0242e72
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/env-utils.ts
@@ -0,0 +1,80 @@
+const stripInlineComment = (value: string) => {
+  for (let index = 0; index < value.length; index++) {
+    const previousChar = value[index - 1] ?? ''
+
+    if (value[index] === '#' && (index === 0 || /\s/.test(previousChar)))
+      return value.slice(0, index).trimEnd()
+  }
+
+  return value
+}
+
+const parseEnvValue = (rawValue: string) => {
+  const value = rawValue.trim()
+  const quote = value[0]
+
+  if ((quote === '"' || quote === '\'') && value.endsWith(quote)) {
+    const unquotedValue = value.slice(1, -1)
+
+    if (quote === '"') {
+      return unquotedValue
+        .replaceAll('\\n', '\n')
+        .replaceAll('\\r', '\r')
+        .replaceAll('\\t', '\t')
+        .replaceAll('\\"', '"')
+        .replaceAll('\\\\', '\\')
+    }
+
+    return unquotedValue.replaceAll('\\\'', '\'')
+  }
+
+  return stripInlineComment(value).trim()
+}
+
+export const parseEnvVariables = (content: string) => {
+  return content.split(/\r?\n/).flatMap((line) => {
+    const trimmedLine = line.trim()
+
+    if (!trimmedLine || trimmedLine.startsWith('#'))
+      return []
+
+    const envLine = trimmedLine.startsWith('export ')
+      ? trimmedLine.slice('export '.length).trimStart()
+      : trimmedLine
+    const separatorIndex = envLine.indexOf('=')
+
+    if (separatorIndex <= 0)
+      return []
+
+    const key = envLine.slice(0, separatorIndex).trim()
+
+    if (!/^[\w.-]+$/.test(key))
+      return []
+
+    return [{
+      key,
+      value: parseEnvValue(envLine.slice(separatorIndex + 1)),
+    }]
+  })
+}
+
+export type EnvImportPlatform = 'mac' | 'windows' | 'other'
+
+export const getEnvImportPlatform = ({
+  platform,
+  userAgent,
+}: {
+  platform?: string
+  userAgent?: string
+}): EnvImportPlatform => {
+  const normalizedPlatform = platform?.toLowerCase() ?? ''
+  const normalizedUserAgent = userAgent?.toLowerCase() ?? ''
+
+  if (normalizedPlatform.includes('mac') || normalizedUserAgent.includes('mac os'))
+    return 'mac'
+
+  if (normalizedPlatform.includes('win') || normalizedUserAgent.includes('windows'))
+    return 'windows'
+
+  return 'other'
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/env.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/env.tsx
new file mode 100644
index 00000000000..cd8044c3030
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/env.tsx
@@ -0,0 +1,539 @@
+'use client'
+
+import type { EnvScope, EnvVariable } from '@/features/agent-v2/agent-composer/form-state'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Input } from '@langgenius/dify-ui/input'
+import { Select, SelectContent, SelectItem, SelectItemIndicator, SelectItemText, SelectTrigger } from '@langgenius/dify-ui/select'
+import { toast } from '@langgenius/dify-ui/toast'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
+import { useAtom } from 'jotai'
+import { useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { agentComposerEnvVariablesAtom } from '@/features/agent-v2/agent-composer/store-modules/env'
+import { checkKeys } from '@/utils/var'
+import { ConfigureSection } from '../common/section'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
+import { getEnvImportPlatform, parseEnvVariables } from './env-utils'
+
+const scopeLabelKeys: Record<EnvScope, I18nKeysWithPrefix<'agentV2', 'agentDetail.configure.advancedSettings.envEditor.'>> = {
+  plain: 'agentDetail.configure.advancedSettings.envEditor.scopePlain',
+  secret: 'agentDetail.configure.advancedSettings.envEditor.scopeSecret',
+}
+
+const envScopeOptions: EnvScope[] = ['secret', 'plain']
+
+const envImportTipKeys = {
+  mac: 'agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac',
+  windows: 'agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows',
+  other: 'agentDetail.configure.advancedSettings.envEditor.importEnvTip.other',
+} as const
+
+const maskedEnvValue = '••••••••••••'
+
+const getCurrentEnvImportPlatform = () => {
+  if (typeof navigator === 'undefined')
+    return 'other'
+
+  const userAgentData = (navigator as Navigator & { userAgentData?: { platform?: string } }).userAgentData
+
+  return getEnvImportPlatform({
+    platform: userAgentData?.platform ?? navigator.platform,
+    userAgent: navigator.userAgent,
+  })
+}
+
+const createEnvVariable = (): EnvVariable => ({
+  id: globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`,
+  key: '',
+  value: '',
+  scope: 'plain',
+})
+
+const createEnvVariableFromEntry = ({
+  key,
+  value,
+}: {
+  key: string
+  value: string
+}): EnvVariable => ({
+  ...createEnvVariable(),
+  key,
+  value,
+})
+
+function EnvEditorScope({
+  editable,
+  scope,
+  onChange,
+}: {
+  editable?: boolean
+  scope: EnvScope
+  onChange?: (scope: EnvScope) => void
+}) {
+  const { t } = useTranslation('agentV2')
+
+  if (!editable) {
+    return (
+      <span className="min-w-0 truncate px-3 system-xs-regular text-text-secondary">
+        {t(scopeLabelKeys[scope])}
+      </span>
+    )
+  }
+
+  return (
+    <Select
+      value={scope}
+      onValueChange={(nextValue) => {
+        if (!nextValue)
+          return
+
+        onChange?.(nextValue as EnvScope)
+      }}
+    >
+      <SelectTrigger
+        aria-label={t('agentDetail.configure.advancedSettings.envEditor.scopeSelector')}
+        className="h-full w-full max-w-none rounded-none bg-transparent px-3 py-0 system-xs-regular text-text-secondary hover:bg-state-base-hover focus-visible:bg-state-base-hover data-popup-open:bg-state-base-hover [&>*:last-child]:size-3.5"
+      >
+        {t(scopeLabelKeys[scope])}
+      </SelectTrigger>
+      <SelectContent placement="bottom-start" popupClassName="min-w-24">
+        {envScopeOptions.map(option => (
+          <SelectItem key={option} value={option} className="h-7 system-xs-regular">
+            <SelectItemText>{t(scopeLabelKeys[option])}</SelectItemText>
+            <SelectItemIndicator />
+          </SelectItem>
+        ))}
+      </SelectContent>
+    </Select>
+  )
+}
+
+function EnvEditorCell({
+  children,
+  className,
+}: {
+  children?: React.ReactNode
+  className?: string
+}) {
+  return (
+    <div className={cn('flex min-h-7 min-w-0 items-center border-r border-divider-subtle last:border-r-0', className)}>
+      {children}
+    </div>
+  )
+}
+
+function EnvEditorInput({
+  'aria-label': ariaLabel,
+  placeholder,
+  shouldFocus,
+  value,
+  onValueChange,
+}: {
+  'aria-label': string
+  'placeholder': string
+  'shouldFocus'?: boolean
+  'value': string
+  'onValueChange': (value: string) => void
+}) {
+  const inputRef = useRef<HTMLInputElement>(null)
+
+  useEffect(() => {
+    if (shouldFocus)
+      inputRef.current?.focus()
+  }, [shouldFocus])
+
+  return (
+    <Input
+      ref={inputRef}
+      aria-label={ariaLabel}
+      className="h-full rounded-none bg-transparent px-3 py-0 system-xs-regular text-text-secondary shadow-none hover:bg-state-base-hover focus-visible:bg-state-base-hover"
+      placeholder={placeholder}
+      value={value}
+      onValueChange={onValueChange}
+    />
+  )
+}
+
+function EnvEditorRow({
+  autoFocusField,
+  variable,
+  editable = false,
+  isHighlighted,
+  onDelete,
+  onKeyChange,
+  onScopeChange,
+  onValueChange,
+  showScope = true,
+}: {
+  autoFocusField?: 'key' | 'value'
+  variable: EnvVariable
+  editable?: boolean
+  isHighlighted?: boolean
+  onDelete: () => void
+  onKeyChange?: (key: string) => void
+  onScopeChange: (scope: EnvScope) => void
+  onValueChange?: (value: string) => void
+  showScope?: boolean
+}) {
+  const { t } = useTranslation('agentV2')
+  const [isValueRevealed, setIsValueRevealed] = useState(false)
+  const gridClassName = showScope
+    ? 'grid-cols-[minmax(76px,1fr)_minmax(84px,1.25fr)_72px_28px]'
+    : 'grid-cols-[minmax(120px,180px)_minmax(160px,1fr)_28px]'
+  const shouldMaskValue = variable.masked && !isValueRevealed
+  const displayedValue = shouldMaskValue ? maskedEnvValue : variable.value
+
+  return (
+    <div className={cn('grid min-h-7 border-t border-divider-subtle', gridClassName, isHighlighted && 'bg-background-default-hover')}>
+      <EnvEditorCell>
+        {editable
+          ? (
+              <EnvEditorInput
+                aria-label={t('agentDetail.configure.advancedSettings.envEditor.keyColumn')}
+                placeholder={t('agentDetail.configure.advancedSettings.envEditor.keyPlaceholder')}
+                shouldFocus={autoFocusField === 'key'}
+                value={variable.key}
+                onValueChange={onKeyChange ?? (() => {})}
+              />
+            )
+          : (
+              <span className={cn('min-w-0 truncate px-3 system-xs-regular text-text-secondary', isHighlighted && 'text-text-primary')}>
+                {variable.key}
+              </span>
+            )}
+      </EnvEditorCell>
+      <EnvEditorCell>
+        {editable && !shouldMaskValue
+          ? (
+              <EnvEditorInput
+                aria-label={t('agentDetail.configure.advancedSettings.envEditor.valueColumn')}
+                placeholder={t('agentDetail.configure.advancedSettings.envEditor.valuePlaceholder')}
+                shouldFocus={autoFocusField === 'value'}
+                value={displayedValue}
+                onValueChange={onValueChange ?? (() => {})}
+              />
+            )
+          : (
+              <span className="min-w-0 truncate px-3 system-xs-regular text-text-secondary">
+                {displayedValue}
+              </span>
+            )}
+        {variable.masked && (
+          <button
+            type="button"
+            aria-label={t(isValueRevealed ? 'agentDetail.configure.advancedSettings.envEditor.hideValue' : 'agentDetail.configure.advancedSettings.envEditor.revealValue', { key: variable.key })}
+            onClick={() => setIsValueRevealed(revealed => !revealed)}
+            className="mr-2 ml-auto flex size-5 shrink-0 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className={cn(isValueRevealed ? 'i-ri-eye-off-line' : 'i-ri-eye-line', 'size-4')} />
+          </button>
+        )}
+      </EnvEditorCell>
+      {showScope && (
+        <EnvEditorCell>
+          <EnvEditorScope editable={editable} scope={variable.scope} onChange={onScopeChange} />
+        </EnvEditorCell>
+      )}
+      <EnvEditorCell className="justify-center">
+        {editable && (
+          <button
+            type="button"
+            aria-label={t('agentDetail.configure.advancedSettings.envEditor.deleteVariable', { key: variable.key || t('agentDetail.configure.advancedSettings.envEditor.keyPlaceholder') })}
+            onClick={onDelete}
+            className="flex size-6 items-center justify-center rounded-md text-text-tertiary hover:bg-state-destructive-hover hover:text-text-destructive focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className="i-ri-delete-bin-line size-4" />
+          </button>
+        )}
+      </EnvEditorCell>
+    </div>
+  )
+}
+
+function EnvEditorDraftRow({
+  onAdd,
+  showScope = true,
+}: {
+  onAdd?: (options?: { focusField?: 'key' | 'value', scope?: EnvScope }) => void
+  showScope?: boolean
+}) {
+  const { t } = useTranslation('agentV2')
+  const gridClassName = showScope
+    ? 'grid-cols-[minmax(76px,1fr)_minmax(84px,1.25fr)_72px_28px]'
+    : 'grid-cols-[minmax(120px,180px)_minmax(160px,1fr)_28px]'
+  const keyPlaceholder = t('agentDetail.configure.advancedSettings.envEditor.keyPlaceholder')
+  const valuePlaceholder = t('agentDetail.configure.advancedSettings.envEditor.valuePlaceholder')
+
+  const renderDraftPlaceholder = (label: string) => (
+    <span className="min-w-0 truncate px-3 system-xs-regular text-components-input-text-placeholder">
+      {label}
+    </span>
+  )
+
+  const renderDraftValueCell = () => {
+    if (!onAdd)
+      return renderDraftPlaceholder(valuePlaceholder)
+
+    return (
+      <button
+        type="button"
+        aria-label={t('agentDetail.configure.advancedSettings.envEditor.add')}
+        onClick={() => onAdd({ focusField: 'value' })}
+        className="flex h-full w-full min-w-0 items-center px-3 text-left system-xs-regular text-components-input-text-placeholder hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+      >
+        {valuePlaceholder}
+      </button>
+    )
+  }
+
+  return (
+    <div className={cn('grid min-h-7 border-t border-divider-subtle', gridClassName)}>
+      <EnvEditorCell>
+        {renderDraftPlaceholder(keyPlaceholder)}
+      </EnvEditorCell>
+      <EnvEditorCell>
+        {renderDraftValueCell()}
+      </EnvEditorCell>
+      {showScope && (
+        <EnvEditorCell>
+          <EnvEditorScope scope="plain" />
+        </EnvEditorCell>
+      )}
+      <EnvEditorCell />
+    </div>
+  )
+}
+
+export function EnvVariablesTable({
+  editable = false,
+  envVariables,
+  focusedVariable,
+  highlightedIndex,
+  onAdd,
+  onDelete,
+  onKeyChange,
+  onScopeChange,
+  onValueChange,
+  showDraftRow = true,
+  showScope = true,
+}: {
+  editable?: boolean
+  envVariables: EnvVariable[]
+  focusedVariable?: { id: string, field: 'key' | 'value' }
+  highlightedIndex?: number
+  onAdd?: (options?: { focusField?: 'key' | 'value', scope?: EnvScope }) => void
+  onDelete: (id: string) => void
+  onKeyChange?: (id: string, key: string) => void
+  onScopeChange: (id: string, scope: EnvScope) => void
+  onValueChange?: (id: string, value: string) => void
+  showDraftRow?: boolean
+  showScope?: boolean
+}) {
+  const { t } = useTranslation('agentV2')
+  const gridClassName = showScope
+    ? 'grid-cols-[minmax(76px,1fr)_minmax(84px,1.25fr)_72px_28px]'
+    : 'grid-cols-[minmax(120px,180px)_minmax(160px,1fr)_28px]'
+  const checkEnvVariableKey = (key: string) => {
+    const { isValid, errorMessageKey } = checkKeys([key], false)
+    if (!isValid) {
+      toast.error(t(`varKeyError.${errorMessageKey}`, {
+        ns: 'appDebug',
+        key: t('agentDetail.configure.advancedSettings.envEditor.keyColumn'),
+      }))
+      return false
+    }
+
+    return true
+  }
+  const handleKeyChange = (id: string, key: string) => {
+    const normalizedKey = key.replaceAll(' ', '_')
+    if (normalizedKey && !checkEnvVariableKey(normalizedKey))
+      return
+
+    onKeyChange?.(id, normalizedKey)
+  }
+
+  return (
+    <div className="overflow-hidden rounded-lg border border-divider-regular bg-components-panel-on-panel-item-bg shadow-xs shadow-shadow-shadow-3">
+      <div className={cn('grid min-h-7 text-text-tertiary', gridClassName)}>
+        <EnvEditorCell>
+          <span className="px-3 system-xs-medium-uppercase">
+            {t('agentDetail.configure.advancedSettings.envEditor.keyColumn')}
+          </span>
+        </EnvEditorCell>
+        <EnvEditorCell>
+          <span className="px-3 system-xs-medium-uppercase">
+            {t('agentDetail.configure.advancedSettings.envEditor.valueColumn')}
+          </span>
+        </EnvEditorCell>
+        {showScope && (
+          <EnvEditorCell>
+            <span className="px-3 system-xs-medium-uppercase">
+              {t('agentDetail.configure.advancedSettings.envEditor.scopeColumn')}
+            </span>
+          </EnvEditorCell>
+        )}
+        <EnvEditorCell className="justify-center">
+          {onAdd && (
+            <button
+              type="button"
+              aria-label={t('agentDetail.configure.advancedSettings.envEditor.add')}
+              onClick={() => onAdd()}
+              className="flex size-6 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            >
+              <span aria-hidden className="i-ri-add-line size-4" />
+            </button>
+          )}
+        </EnvEditorCell>
+      </div>
+      {envVariables.map((variable, index) => (
+        <EnvEditorRow
+          key={variable.id}
+          autoFocusField={focusedVariable?.id === variable.id ? focusedVariable.field : undefined}
+          variable={variable}
+          editable={editable}
+          isHighlighted={index === highlightedIndex}
+          onDelete={() => onDelete(variable.id)}
+          onKeyChange={key => handleKeyChange(variable.id, key)}
+          onScopeChange={scope => onScopeChange(variable.id, scope)}
+          onValueChange={value => onValueChange?.(variable.id, value)}
+          showScope={showScope}
+        />
+      ))}
+      {showDraftRow && <EnvEditorDraftRow onAdd={onAdd} showScope={showScope} />}
+    </div>
+  )
+}
+
+export function AgentEnvEditor() {
+  const { t } = useTranslation('agentV2')
+  const readOnly = useAgentOrchestrateReadOnly()
+  const [envVariables, setEnvVariables] = useAtom(agentComposerEnvVariablesAtom)
+  const starterVariableRef = useRef<EnvVariable | undefined>(undefined)
+  if (!starterVariableRef.current)
+    starterVariableRef.current = createEnvVariable()
+  const starterVariable = starterVariableRef.current
+  const [focusedVariable, setFocusedVariable] = useState<{ id: string, field: 'key' | 'value' }>()
+  const envImportInputRef = useRef<HTMLInputElement>(null)
+  const envEditorTip = t('agentDetail.configure.advancedSettings.envEditor.tip')
+  const envImportTip = t(envImportTipKeys[getCurrentEnvImportPlatform()])
+  const envEditorTableId = 'agent-configure-env-editor-table'
+  const visibleEnvVariables = envVariables.length > 0 ? envVariables : [starterVariable]
+
+  const updateVariable = (id: string, updater: (variable: EnvVariable) => EnvVariable) => {
+    const existingVariable = envVariables.find(variable => variable.id === id)
+
+    if (existingVariable) {
+      setEnvVariables(envVariables.map(variable => (
+        variable.id === id ? updater(variable) : variable
+      )))
+      return
+    }
+
+    if (id === starterVariable.id)
+      setEnvVariables([updater(starterVariable)])
+  }
+
+  const addVariable = ({
+    focusField = 'key',
+    scope,
+  }: {
+    focusField?: 'key' | 'value'
+    scope?: EnvScope
+  } = {}) => {
+    const variable = {
+      ...createEnvVariable(),
+      ...(scope ? { scope } : {}),
+    }
+
+    setEnvVariables([
+      ...(envVariables.length > 0 ? envVariables : [starterVariable]),
+      variable,
+    ])
+    setFocusedVariable({ id: variable.id, field: focusField })
+  }
+  const importEnvVariables = async (file: File) => {
+    const importedVariables = parseEnvVariables(await file.text()).map(createEnvVariableFromEntry)
+
+    if (importedVariables.length === 0)
+      return
+
+    setEnvVariables([...envVariables, ...importedVariables])
+  }
+  const updateVariableKey = (id: string, key: string) => {
+    updateVariable(id, variable => ({ ...variable, key }))
+  }
+  const updateVariableScope = (id: string, scope: EnvScope) => {
+    updateVariable(id, variable => ({ ...variable, scope }))
+  }
+  const updateVariableValue = (id: string, value: string) => {
+    updateVariable(id, variable => ({ ...variable, value }))
+  }
+  const deleteVariable = (id: string) => {
+    setEnvVariables(envVariables.filter(variable => variable.id !== id))
+  }
+
+  return (
+    <ConfigureSection
+      label={t('agentDetail.configure.advancedSettings.envEditor.label')}
+      labelId="agent-configure-env-editor-label"
+      headingLevel="h4"
+      panelId={envEditorTableId}
+      tip={envEditorTip}
+      tipAriaLabel={envEditorTip}
+      rootClassName="gap-1 pt-3"
+      headerClassName="mb-0 gap-1 px-3"
+      panelContentClassName="px-3 pb-3"
+      actions={!readOnly
+        ? (
+            <>
+              <input
+                ref={envImportInputRef}
+                className="hidden"
+                type="file"
+                onChange={(event) => {
+                  const file = event.target.files?.[0]
+                  event.target.value = ''
+
+                  if (file)
+                    void importEnvVariables(file)
+                }}
+              />
+              <Tooltip>
+                <TooltipTrigger
+                  render={(
+                    <button
+                      type="button"
+                      aria-label={t('agentDetail.configure.advancedSettings.envEditor.importEnv')}
+                      onClick={() => envImportInputRef.current?.click()}
+                      className="flex h-6 shrink-0 items-center gap-1 rounded-md px-1.5 py-1 text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+                    >
+                      <span aria-hidden className="i-ri-file-upload-line size-3.5" />
+                      <span className="system-xs-medium">{t('agentDetail.configure.advancedSettings.envEditor.importEnv')}</span>
+                    </button>
+                  )}
+                />
+                <TooltipContent className="max-w-72">
+                  {envImportTip}
+                </TooltipContent>
+              </Tooltip>
+            </>
+          )
+        : undefined}
+    >
+      <EnvVariablesTable
+        editable={!readOnly}
+        envVariables={visibleEnvVariables}
+        focusedVariable={focusedVariable}
+        highlightedIndex={1}
+        onAdd={readOnly ? undefined : addVariable}
+        onDelete={deleteVariable}
+        onKeyChange={updateVariableKey}
+        onScopeChange={updateVariableScope}
+        onValueChange={updateVariableValue}
+        showDraftRow={false}
+      />
+    </ConfigureSection>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/index.tsx
new file mode 100644
index 00000000000..92b8950fdce
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/index.tsx
@@ -0,0 +1,27 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+import { ConfigureSection } from '../common/section'
+import { AgentContentModerationSettings } from './content-moderation'
+import { AgentEnvEditor } from './env'
+
+export function AgentAdvancedSettings() {
+  const { t } = useTranslation('agentV2')
+  const advancedSettingsPanelId = 'agent-configure-advanced-settings-panel'
+
+  return (
+    <ConfigureSection
+      label={t('agentDetail.configure.advancedSettings.label')}
+      labelId="agent-configure-advanced-settings-label"
+      panelId={advancedSettingsPanelId}
+      description={t('agentDetail.configure.advancedSettings.description')}
+      rootClassName="gap-2 pt-1 pb-3"
+      headerClassName="mb-0 pt-2"
+      titleRowClassName="min-h-6"
+      panelContentClassName="flex flex-col rounded-lg bg-background-section"
+    >
+      <AgentEnvEditor />
+      <AgentContentModerationSettings />
+    </ConfigureSection>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/add-button.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/add-button.tsx
new file mode 100644
index 00000000000..4d728e20044
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/add-button.tsx
@@ -0,0 +1,36 @@
+'use client'
+
+import type { ButtonProps } from '@langgenius/dify-ui/button'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
+
+type ConfigureSectionAddButtonProps = Omit<ButtonProps, 'aria-label' | 'children' | 'size' | 'variant'> & {
+  ariaLabel: string
+}
+
+export function ConfigureSectionAddButton({
+  ariaLabel,
+  className,
+  ...props
+}: ConfigureSectionAddButtonProps) {
+  const { t } = useTranslation('common')
+  const readOnly = useAgentOrchestrateReadOnly()
+
+  if (readOnly)
+    return null
+
+  return (
+    <Button
+      {...props}
+      aria-label={ariaLabel}
+      variant="ghost"
+      size="small"
+      className={cn('shrink-0 gap-1 px-2', className)}
+    >
+      <span aria-hidden className="i-ri-add-line size-3.5" />
+      <span>{t('operation.add')}</span>
+    </Button>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/configurable-item.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/configurable-item.tsx
new file mode 100644
index 00000000000..337d7be8e32
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/configurable-item.tsx
@@ -0,0 +1,61 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
+
+export function ConfigureSectionConfigurableItem({
+  badge,
+  editAriaLabel,
+  icon,
+  label,
+  removeAriaLabel,
+  onEdit,
+  onRemove,
+}: {
+  badge?: ReactNode
+  editAriaLabel: string
+  icon: ReactNode
+  label: ReactNode
+  removeAriaLabel: string
+  onEdit: () => void
+  onRemove: () => void
+}) {
+  const readOnly = useAgentOrchestrateReadOnly()
+  const hasBadge = badge !== undefined && badge !== null
+
+  return (
+    <div className="group flex min-h-8 items-center gap-1 overflow-hidden rounded-lg border-[0.5px] border-components-panel-border-subtle bg-components-panel-on-panel-item-bg py-1.5 pr-1.5 pl-2 shadow-xs shadow-shadow-shadow-3 focus-within:border-components-panel-border focus-within:bg-components-panel-on-panel-item-bg-hover focus-within:shadow-sm hover:border-components-panel-border hover:bg-components-panel-on-panel-item-bg-hover hover:shadow-sm">
+      <div className="flex min-w-0 flex-1 items-center gap-2 py-0.5 pr-1">
+        {icon}
+        <span className="min-w-0 truncate system-sm-medium text-text-primary">
+          {label}
+        </span>
+      </div>
+      {!readOnly && (
+        <div className="pointer-events-none flex shrink-0 items-center gap-1 opacity-0 transition-opacity group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100">
+          <button
+            type="button"
+            aria-label={editAriaLabel}
+            onClick={onEdit}
+            className="flex size-6 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:bg-state-base-hover focus-visible:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className="i-ri-equalizer-2-line size-4" />
+          </button>
+          <button
+            type="button"
+            aria-label={removeAriaLabel}
+            onClick={onRemove}
+            className="flex size-6 items-center justify-center rounded-md text-text-tertiary hover:bg-state-destructive-hover hover:text-text-destructive focus-visible:bg-state-destructive-hover focus-visible:text-text-destructive focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className="i-ri-delete-bin-line size-4" />
+          </button>
+        </div>
+      )}
+      {hasBadge && (
+        <span className="shrink-0 rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary transition-opacity group-focus-within:opacity-0 group-hover:opacity-0">
+          {badge}
+        </span>
+      )}
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/empty.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/empty.tsx
new file mode 100644
index 00000000000..8631c885be3
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/empty.tsx
@@ -0,0 +1,20 @@
+'use client'
+
+export function ConfigureSectionEmpty({
+  description,
+  title,
+}: {
+  description: string
+  title: string
+}) {
+  return (
+    <div className="flex w-full flex-col items-start gap-1 rounded-xl bg-background-section p-3 text-text-tertiary">
+      <p className="w-full system-xs-medium">
+        {title}
+      </p>
+      <p className="w-full system-xs-regular">
+        {description}
+      </p>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/section.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/section.tsx
new file mode 100644
index 00000000000..49b43817d82
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/section.tsx
@@ -0,0 +1,105 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  CollapsiblePanel,
+  CollapsibleRoot,
+  CollapsibleTrigger,
+} from '@langgenius/dify-ui/collapsible'
+import { Infotip } from '@/app/components/base/infotip'
+
+type ConfigureSectionBaseProps = {
+  label: ReactNode
+  labelId: string
+  children: ReactNode
+  actions?: ReactNode
+  description?: ReactNode
+  headingLevel?: 'h3' | 'h4'
+  panelId?: string
+  rootClassName?: string
+  headerClassName?: string
+  titleRowClassName?: string
+  panelContentClassName?: string
+}
+
+type ConfigureSectionProps = ConfigureSectionBaseProps & (
+  | {
+    tip: ReactNode
+    tipAriaLabel: string
+  }
+  | {
+    tip?: undefined
+    tipAriaLabel?: undefined
+  }
+)
+
+export function ConfigureSection({
+  label,
+  labelId,
+  children,
+  actions,
+  description,
+  headingLevel = 'h3',
+  panelId,
+  tip,
+  tipAriaLabel,
+  rootClassName,
+  headerClassName,
+  titleRowClassName,
+  panelContentClassName,
+}: ConfigureSectionProps) {
+  const Heading = headingLevel
+  const hasDescription = description !== undefined && description !== null
+  const hasTip = tip !== undefined && tip !== null
+
+  return (
+    <CollapsibleRoot
+      render={<section />}
+      defaultOpen
+      className={rootClassName}
+      aria-labelledby={labelId}
+    >
+      <div className={cn('mb-2 flex min-h-6 items-center gap-2', headerClassName)}>
+        <div className="min-w-0 flex-1">
+          <div className={cn('flex min-w-0 items-center', titleRowClassName)}>
+            <Heading id={labelId} className="min-w-0 shrink-0">
+              <CollapsibleTrigger
+                className="h-6 min-h-0 w-auto max-w-full justify-start gap-0 rounded-sm px-0 text-text-secondary hover:not-data-disabled:bg-transparent hover:not-data-disabled:text-text-secondary data-panel-open:text-text-secondary"
+              >
+                <span className="min-w-0 truncate system-sm-semibold-uppercase">
+                  {label}
+                </span>
+              </CollapsibleTrigger>
+            </Heading>
+            {hasTip && (
+              <Infotip aria-label={tipAriaLabel} className="ml-0.5 size-3.5" popupClassName="max-w-64">
+                {tip}
+              </Infotip>
+            )}
+            <CollapsibleTrigger
+              aria-labelledby={labelId}
+              className="group/collapse-icon size-3.5 min-h-0 shrink-0 justify-center rounded-sm p-0 text-text-quaternary hover:not-data-disabled:bg-transparent hover:not-data-disabled:text-text-secondary data-panel-open:text-text-quaternary"
+            >
+              <span
+                aria-hidden="true"
+                className="i-custom-vender-solid-general-arrow-down-round-fill size-3.5 rotate-270 transition-transform group-data-panel-open/collapse-icon:rotate-0 motion-reduce:transition-none"
+              />
+            </CollapsibleTrigger>
+          </div>
+          {hasDescription && (
+            <p className="system-xs-regular text-text-tertiary">
+              {description}
+            </p>
+          )}
+        </div>
+        {actions}
+      </div>
+      <CollapsiblePanel id={panelId}>
+        <div className={panelContentClassName}>
+          {children}
+        </div>
+      </CollapsiblePanel>
+    </CollapsibleRoot>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/file-icon.spec.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/file-icon.spec.ts
new file mode 100644
index 00000000000..28827f3c560
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/file-icon.spec.ts
@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest'
+import { getDriveFileIconType, getFileIconType } from '../file-icon'
+
+describe('agent file icon helpers', () => {
+  it('should infer supported icons for uploaded drive file pointer kinds', () => {
+    expect(getDriveFileIconType({
+      fileKind: 'upload_file',
+      fileName: 'report.md',
+      mimeType: 'text/markdown',
+    })).toBe('markdown')
+    expect(getDriveFileIconType({
+      fileKind: 'tool_file',
+      fileName: 'image.png',
+      mimeType: 'image/png',
+    })).toBe('image')
+  })
+
+  it('should keep supported drive file kinds and normalize directories', () => {
+    expect(getDriveFileIconType({
+      fileKind: 'directory',
+      fileName: 'files',
+    })).toBe('folder')
+    expect(getDriveFileIconType({
+      fileKind: 'pdf',
+      fileName: 'guide',
+    })).toBe('pdf')
+  })
+
+  it('should infer icons from file extension when mime type is not enough', () => {
+    expect(getFileIconType('data.csv')).toBe('table')
+    expect(getFileIconType('archive.zip')).toBe('archive')
+    expect(getFileIconType('script.ts')).toBe('code')
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..9961ba7d242
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/index.spec.tsx
@@ -0,0 +1,484 @@
+import type { AgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { AgentOrchestrateReadOnlyContext } from '../../read-only-context'
+import { AgentFiles } from '../index'
+
+const mocks = vi.hoisted(() => ({
+  agentDriveFilesQueryOptions: vi.fn(),
+  agentFileCommitMutationFn: vi.fn(),
+  agentFileDeleteMutationFn: vi.fn(),
+  agentFileDeleteMutationOptions: vi.fn(),
+  agentFileDownloadQueryOptions: vi.fn(),
+  agentFilePreviewQueryOptions: vi.fn(),
+  agentFileCommitMutationOptions: vi.fn(),
+  workflowAgentDriveFilesQueryOptions: vi.fn(),
+  workflowAgentFileCommitMutationFn: vi.fn(),
+  workflowAgentFileDeleteMutationFn: vi.fn(),
+  workflowAgentFileDeleteMutationOptions: vi.fn(),
+  workflowAgentFileDownloadQueryOptions: vi.fn(),
+  workflowAgentFilePreviewQueryOptions: vi.fn(),
+  workflowAgentFileCommitMutationOptions: vi.fn(),
+  uploadFileMutationFn: vi.fn(),
+  uploadFileMutationOptions: vi.fn(),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        drive: {
+          files: {
+            get: {
+              queryOptions: mocks.agentDriveFilesQueryOptions,
+            },
+            download: {
+              get: {
+                queryOptions: mocks.agentFileDownloadQueryOptions,
+              },
+            },
+            preview: {
+              get: {
+                queryOptions: mocks.agentFilePreviewQueryOptions,
+              },
+            },
+          },
+        },
+        files: {
+          delete: {
+            mutationOptions: mocks.agentFileDeleteMutationOptions,
+          },
+          post: {
+            mutationOptions: mocks.agentFileCommitMutationOptions,
+          },
+        },
+      },
+    },
+    apps: {
+      byAppId: {
+        agent: {
+          drive: {
+            files: {
+              get: {
+                queryOptions: mocks.workflowAgentDriveFilesQueryOptions,
+              },
+              download: {
+                get: {
+                  queryOptions: mocks.workflowAgentFileDownloadQueryOptions,
+                },
+              },
+              preview: {
+                get: {
+                  queryOptions: mocks.workflowAgentFilePreviewQueryOptions,
+                },
+              },
+            },
+          },
+          files: {
+            delete: {
+              mutationOptions: mocks.workflowAgentFileDeleteMutationOptions,
+            },
+            post: {
+              mutationOptions: mocks.workflowAgentFileCommitMutationOptions,
+            },
+          },
+        },
+      },
+    },
+    files: {
+      upload: {
+        post: {
+          mutationOptions: mocks.uploadFileMutationOptions,
+        },
+      },
+    },
+  },
+}))
+
+const agentFilesDraft = {
+  ...defaultAgentSoulConfigFormState,
+  files: [
+    {
+      id: 'preview-image',
+      name: 'agent-roster-skill-detail-dialog-preview-image.png',
+      icon: 'image',
+      driveKey: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+    },
+    {
+      id: 'brief',
+      name: 'brief.md',
+      icon: 'markdown',
+      driveKey: 'files/brief.md',
+    },
+  ],
+} satisfies AgentSoulConfigFormState
+
+const agentSkillFilesDraft = {
+  ...defaultAgentSoulConfigFormState,
+  files: [
+    {
+      id: 'script',
+      name: 'run.py',
+      icon: 'file',
+      driveKey: 'files/run.py',
+    },
+    {
+      id: 'skill-md',
+      name: 'SKILL.md',
+      icon: 'markdown',
+      driveKey: 'files/SKILL.md',
+    },
+  ],
+} satisfies AgentSoulConfigFormState
+
+function renderAgentFiles(initialDraft: AgentSoulConfigFormState = agentFilesDraft) {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentComposerProvider initialDraft={initialDraft}>
+        <AgentFiles agentId="agent-1" />
+      </AgentComposerProvider>
+    </QueryClientProvider>,
+  )
+}
+
+function renderReadonlyAgentFiles() {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentComposerProvider initialDraft={agentFilesDraft}>
+        <AgentOrchestrateReadOnlyContext value>
+          <AgentFiles agentId="agent-1" />
+        </AgentOrchestrateReadOnlyContext>
+      </AgentComposerProvider>
+    </QueryClientProvider>,
+  )
+}
+
+describe('AgentFiles', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.agentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-files', input],
+      queryFn: () => new Promise(() => {}),
+    }))
+    mocks.workflowAgentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['workflow-agent-drive-files', input],
+      queryFn: () => new Promise(() => {}),
+    }))
+    mocks.agentFilePreviewQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-file-preview', input],
+      queryFn: async () => ({
+        binary: false,
+        text: `Preview content for ${input.query.key}`,
+      }),
+    }))
+    mocks.workflowAgentFilePreviewQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['workflow-agent-file-preview', input],
+      queryFn: async () => ({
+        binary: false,
+        text: `Preview content for ${input.query.key}`,
+      }),
+    }))
+    mocks.agentFileDownloadQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-file-download', input],
+      queryFn: async () => ({
+        url: `https://signed.example/${input.query.key}`,
+      }),
+    }))
+    mocks.workflowAgentFileDownloadQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['workflow-agent-file-download', input],
+      queryFn: async () => ({
+        url: `https://signed.example/${input.query.key}`,
+      }),
+    }))
+    mocks.uploadFileMutationOptions.mockReturnValue({
+      mutationFn: mocks.uploadFileMutationFn.mockResolvedValue({
+        id: 'upload-file-1',
+        name: 'uploaded.md',
+        mime_type: 'text/markdown',
+      }),
+      mutationKey: ['upload-file'],
+    })
+    mocks.agentFileCommitMutationOptions.mockReturnValue({
+      mutationFn: mocks.agentFileCommitMutationFn.mockResolvedValue({
+        file: {
+          drive_key: 'files/uploaded.md',
+          file_id: 'drive-file-1',
+          mime_type: 'text/markdown',
+          name: 'uploaded.md',
+        },
+      }),
+      mutationKey: ['commit-agent-file'],
+    })
+    mocks.workflowAgentFileCommitMutationOptions.mockReturnValue({
+      mutationFn: mocks.workflowAgentFileCommitMutationFn.mockResolvedValue({
+        file: {
+          drive_key: 'files/uploaded.md',
+          file_id: 'drive-file-1',
+          mime_type: 'text/markdown',
+          name: 'uploaded.md',
+        },
+      }),
+      mutationKey: ['commit-workflow-agent-file'],
+    })
+    mocks.agentFileDeleteMutationOptions.mockReturnValue({
+      mutationFn: mocks.agentFileDeleteMutationFn.mockResolvedValue({ result: 'success' }),
+      mutationKey: ['delete-agent-file'],
+    })
+    mocks.workflowAgentFileDeleteMutationOptions.mockReturnValue({
+      mutationFn: mocks.workflowAgentFileDeleteMutationFn.mockResolvedValue({ result: 'success' }),
+      mutationKey: ['delete-workflow-agent-file'],
+    })
+  })
+
+  it('should list Agent App drive files under the files prefix', () => {
+    renderAgentFiles()
+
+    expect(mocks.agentDriveFilesQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          prefix: 'files/',
+        },
+      },
+    })
+  })
+
+  it('should keep the file preview trigger focus ring inside the row bounds', () => {
+    renderAgentFiles()
+
+    expect(screen.getByRole('button', { name: 'brief.md' })).toHaveClass(
+      'focus-visible:ring-2',
+      'focus-visible:ring-state-accent-solid',
+      'focus-visible:ring-inset',
+    )
+  })
+
+  it('should open the shared detail dialog with the full file tree when the file row is clicked', async () => {
+    renderAgentFiles()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'brief.md',
+    }))
+
+    const dialog = screen.getByRole('dialog')
+
+    expect(dialog).toBeInTheDocument()
+    expect(within(dialog).getByText('agent-roster-skill-detail-dialog-preview-image.png')).toBeInTheDocument()
+    expect(within(dialog).getAllByText('brief.md')).toHaveLength(2)
+    expect(mocks.agentFilePreviewQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          key: 'files/brief.md',
+        },
+      },
+    })
+    expect(await within(dialog).findByText('Preview content for files/brief.md')).toBeInTheDocument()
+  })
+
+  it('should preview the clicked file when SKILL.md also exists', async () => {
+    renderAgentFiles(agentSkillFilesDraft)
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'run.py',
+    }))
+
+    const dialog = screen.getByRole('dialog')
+
+    expect(await within(dialog).findByText('Preview content for files/run.py')).toBeInTheDocument()
+    expect(mocks.agentFilePreviewQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          key: 'files/run.py',
+        },
+      },
+    })
+  })
+
+  it('should preview the selected file from the detail file tree', async () => {
+    renderAgentFiles(agentSkillFilesDraft)
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'run.py',
+    }))
+
+    const dialog = screen.getByRole('dialog')
+    const skillFile = within(dialog).getByRole('button', { name: 'SKILL.md' })
+    fireEvent.click(skillFile)
+
+    expect(await within(dialog).findByText('Preview content for files/SKILL.md')).toBeInTheDocument()
+
+    const scriptFile = within(dialog).getAllByRole('button', { name: 'run.py' }).at(-1)
+    expect(scriptFile).toBeDefined()
+    fireEvent.click(scriptFile!)
+
+    expect(await within(dialog).findByText('Preview content for files/run.py')).toBeInTheDocument()
+    expect(mocks.agentFilePreviewQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          key: 'files/run.py',
+        },
+      },
+    })
+  })
+
+  it('should render image files directly from the drive download URL without a download link', async () => {
+    mocks.agentFilePreviewQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-file-preview', input],
+      queryFn: async () => ({
+        binary: false,
+        key: input.query.key,
+        size: 12345,
+        text: 'image preview should not render as text',
+        truncated: false,
+      }),
+    }))
+    renderAgentFiles()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'agent-roster-skill-detail-dialog-preview-image.png',
+    }))
+
+    const image = await screen.findByRole('img', {
+      name: 'agent-roster-skill-detail-dialog-preview-image.png',
+    })
+
+    expect(image).toHaveAttribute('src', 'https://signed.example/files/agent-roster-skill-detail-dialog-preview-image.png')
+    expect(screen.queryByRole('link', { name: /common\.operation\.download/ })).not.toBeInTheDocument()
+    expect(screen.queryByText('image preview should not render as text')).not.toBeInTheDocument()
+    expect(mocks.agentFileDownloadQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          key: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+        },
+      },
+    })
+  })
+
+  it('should render a download link for binary non-image files', async () => {
+    mocks.agentFilePreviewQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-file-preview', input],
+      queryFn: async () => ({
+        binary: true,
+        key: input.query.key,
+        size: 12345,
+        text: null,
+        truncated: false,
+      }),
+    }))
+    renderAgentFiles()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'brief.md',
+    }))
+
+    const link = await screen.findByRole('link', { name: 'common.operation.download' })
+
+    expect(screen.getByText('agentV2.agentDetail.configure.files.preview.unsupported')).toBeInTheDocument()
+    expect(link).toHaveAttribute('href', 'https://signed.example/files/brief.md')
+    expect(screen.queryByText('Preview content for files/brief.md')).not.toBeInTheDocument()
+  })
+
+  it('should commit an uploaded file to the Agent App drive before adding it to the composer draft', async () => {
+    renderAgentFiles({
+      ...defaultAgentSoulConfigFormState,
+      files: [],
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.files.add' }))
+    const input = document.querySelector('input[type="file"]')
+    expect(input).toBeInstanceOf(HTMLInputElement)
+
+    fireEvent.change(input!, {
+      target: {
+        files: [new File(['# Uploaded'], 'uploaded.md', { type: 'text/markdown' })],
+      },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.files.upload.action' }))
+
+    await waitFor(() => {
+      expect(mocks.agentFileCommitMutationFn).toHaveBeenCalledWith(
+        {
+          params: {
+            agent_id: 'agent-1',
+          },
+          body: {
+            upload_file_id: 'upload-file-1',
+          },
+        },
+        expect.anything(),
+      )
+    })
+  })
+
+  // File rows expose a hover/focus remove action that updates the composer draft.
+  it('should remove the file from the list when the remove action is clicked', () => {
+    renderAgentFiles()
+
+    expect(screen.getByText('agent-roster-skill-detail-dialog-preview-image.png')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.files\.remove.*agent-roster-skill-detail-dialog-preview-image\.png/,
+    }))
+
+    expect(screen.queryByText('agent-roster-skill-detail-dialog-preview-image.png')).not.toBeInTheDocument()
+    expect(screen.getByText('brief.md')).toBeInTheDocument()
+  })
+
+  it('should render the empty state after removing every file', () => {
+    renderAgentFiles()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.files\.remove.*agent-roster-skill-detail-dialog-preview-image\.png/,
+    }))
+    fireEvent.click(screen.getByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.files\.remove.*brief\.md/,
+    }))
+
+    expect(screen.getByText('agentV2.agentDetail.configure.files.empty.title')).toBeInTheDocument()
+  })
+
+  it('should hide add and remove actions when readonly', () => {
+    renderReadonlyAgentFiles()
+
+    expect(screen.getByRole('button', {
+      name: 'agent-roster-skill-detail-dialog-preview-image.png',
+    })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'agentV2.agentDetail.configure.files.add' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.files\.remove.*agent-roster-skill-detail-dialog-preview-image\.png/,
+    })).not.toBeInTheDocument()
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/api-context.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/api-context.ts
new file mode 100644
index 00000000000..886dd16841e
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/api-context.ts
@@ -0,0 +1,7 @@
+export type AgentFileApiContext = {
+  agentId: string
+  workflow?: {
+    appId: string
+    nodeId: string
+  }
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/file-icon.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/file-icon.ts
new file mode 100644
index 00000000000..cb462055058
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/file-icon.ts
@@ -0,0 +1,81 @@
+import type { FileTreeIconType } from '@langgenius/dify-ui/file-tree'
+
+const codeFileExtensions = new Set([
+  'css',
+  'go',
+  'html',
+  'js',
+  'jsx',
+  'py',
+  'rb',
+  'rs',
+  'scss',
+  'sh',
+  'ts',
+  'tsx',
+  'vue',
+  'yaml',
+  'yml',
+])
+const tableFileExtensions = new Set(['csv', 'xls', 'xlsx'])
+const archiveFileExtensions = new Set(['7z', 'gz', 'rar', 'tar', 'zip'])
+const driveFileIconTypes = new Set<FileTreeIconType>([
+  'archive',
+  'code',
+  'database',
+  'file',
+  'folder',
+  'image',
+  'json',
+  'markdown',
+  'pdf',
+  'table',
+  'text',
+])
+
+function getFileExtension(fileName: string) {
+  return fileName.split('.').pop()?.toLowerCase() ?? ''
+}
+
+export function getFileIconType(fileName: string, mimeType?: string | null): FileTreeIconType {
+  const extension = getFileExtension(fileName)
+
+  if (mimeType?.startsWith('image/'))
+    return 'image'
+  if (mimeType === 'application/pdf' || extension === 'pdf')
+    return 'pdf'
+  if (extension === 'md' || extension === 'markdown' || extension === 'mdx')
+    return 'markdown'
+  if (extension === 'json')
+    return 'json'
+  if (tableFileExtensions.has(extension))
+    return 'table'
+  if (archiveFileExtensions.has(extension))
+    return 'archive'
+  if (codeFileExtensions.has(extension))
+    return 'code'
+  if (mimeType?.startsWith('text/'))
+    return 'text'
+
+  return 'file'
+}
+
+export function getDriveFileIconType({
+  fileKind,
+  fileName,
+  mimeType,
+}: {
+  fileKind?: string | null
+  fileName: string
+  mimeType?: string | null
+}): FileTreeIconType {
+  const normalizedFileKind = fileKind?.toLowerCase()
+
+  if (normalizedFileKind === 'directory')
+    return 'folder'
+
+  if (normalizedFileKind && driveFileIconTypes.has(normalizedFileKind as FileTreeIconType))
+    return normalizedFileKind as FileTreeIconType
+
+  return getFileIconType(fileName, mimeType)
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/index.tsx
new file mode 100644
index 00000000000..4d61b51f9ec
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/index.tsx
@@ -0,0 +1,380 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { AgentOrchestrateAddActionOptions } from '../add-actions-context'
+import type { AgentFileApiContext } from './api-context'
+import type { AgentFileNode } from '@/features/agent-v2/agent-composer/form-state'
+import {
+  Dialog,
+  DialogTrigger,
+} from '@langgenius/dify-ui/dialog'
+import {
+  FileTreeGuide,
+} from '@langgenius/dify-ui/file-tree'
+import { useMutation, useQuery } from '@tanstack/react-query'
+import { useAtom } from 'jotai'
+import { useCallback, useMemo, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { agentComposerFilesAtom } from '@/features/agent-v2/agent-composer/store-modules/files'
+import { consoleQuery } from '@/service/client'
+import { useRegisterAgentOrchestrateAddAction } from '../add-actions-context'
+import { ConfigureSectionAddButton } from '../common/add-button'
+import { ConfigureSectionEmpty } from '../common/empty'
+import { ConfigureSection } from '../common/section'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
+import { AgentSkillDetailDialog } from '../skills/detail-dialog'
+import { getDriveFileIconType } from './file-icon'
+import { AgentFileTree } from './tree'
+import { AgentFileUploadDialog } from './upload-dialog'
+
+const removeFileNode = (files: AgentFileNode[], fileId: string): AgentFileNode[] => files
+  .filter(file => file.id !== fileId)
+  .map(file => ({
+    ...file,
+    children: file.children ? removeFileNode(file.children, fileId) : undefined,
+  }))
+
+const FILES_DRIVE_PREFIX = 'files/'
+
+const getAgentFilePreviewKey = (file: AgentFileNode) => file.driveKey ?? file.id
+
+const findAgentFileNode = (files: AgentFileNode[], fileId: string): AgentFileNode | undefined => {
+  for (const file of files) {
+    if (file.id === fileId)
+      return file
+
+    const child = file.children ? findAgentFileNode(file.children, fileId) : undefined
+    if (child)
+      return child
+  }
+}
+
+const getAgentDriveFileName = (key: string) => {
+  const normalizedKey = key.endsWith('/') ? key.slice(0, -1) : key
+  return normalizedKey.split('/').pop() || normalizedKey
+}
+
+const toAgentFileNodeFromDriveItem = (item: {
+  file_kind: string
+  key: string
+  mime_type?: string | null
+}): AgentFileNode => ({
+  id: item.key,
+  name: getAgentDriveFileName(item.key),
+  icon: getDriveFileIconType({
+    fileKind: item.file_kind,
+    fileName: getAgentDriveFileName(item.key),
+    mimeType: item.mime_type,
+  }),
+  driveKey: item.key,
+})
+
+function AgentFileItem({
+  children,
+  depth,
+  file,
+  files,
+  apiContext,
+  onRemove,
+  selected,
+}: {
+  children: ReactNode
+  depth: number
+  file: AgentFileNode
+  files: AgentFileNode[]
+  apiContext: AgentFileApiContext
+  onRemove: (fileId: string) => void
+  selected: boolean
+}) {
+  const { t } = useTranslation('agentV2')
+  const readOnly = useAgentOrchestrateReadOnly()
+  const [isPreviewOpen, setIsPreviewOpen] = useState(false)
+  const [selectedFileId, setSelectedFileId] = useState<string>()
+  const selectedFile = selectedFileId ? findAgentFileNode(files, selectedFileId) : undefined
+  const previewFileId = getAgentFilePreviewKey(selectedFile ?? file)
+  const agentPreviewQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.preview.get.queryOptions({
+      input: {
+        params: {
+          agent_id: apiContext.agentId,
+        },
+        query: {
+          key: previewFileId ?? '',
+        },
+      },
+    }),
+    enabled: isPreviewOpen && !!previewFileId && !apiContext.workflow,
+  })
+  const workflowPreviewQuery = useQuery({
+    ...consoleQuery.apps.byAppId.agent.drive.files.preview.get.queryOptions({
+      input: {
+        params: {
+          app_id: apiContext.workflow?.appId ?? '',
+        },
+        query: {
+          key: previewFileId ?? '',
+          node_id: apiContext.workflow?.nodeId,
+        },
+      },
+    }),
+    enabled: isPreviewOpen && !!previewFileId && !!apiContext.workflow,
+  })
+  const previewQuery = apiContext.workflow ? workflowPreviewQuery : agentPreviewQuery
+  const selectedPreviewFile = selectedFile ?? file
+  const isImagePreviewFile = selectedPreviewFile.icon === 'image'
+  const shouldDownloadPreviewFile = isPreviewOpen && !!previewFileId && (isImagePreviewFile || !!previewQuery.data?.binary)
+  const agentDownloadQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.download.get.queryOptions({
+      input: {
+        params: {
+          agent_id: apiContext.agentId,
+        },
+        query: {
+          key: previewFileId ?? '',
+        },
+      },
+    }),
+    enabled: shouldDownloadPreviewFile && !apiContext.workflow,
+  })
+  const workflowDownloadQuery = useQuery({
+    ...consoleQuery.apps.byAppId.agent.drive.files.download.get.queryOptions({
+      input: {
+        params: {
+          app_id: apiContext.workflow?.appId ?? '',
+        },
+        query: {
+          key: previewFileId ?? '',
+          node_id: apiContext.workflow?.nodeId,
+        },
+      },
+    }),
+    enabled: shouldDownloadPreviewFile && !!apiContext.workflow,
+  })
+  const downloadQuery = apiContext.workflow ? workflowDownloadQuery : agentDownloadQuery
+  const handleRemove = useCallback(() => {
+    onRemove(file.id)
+  }, [file.id, onRemove])
+  const handlePreviewOpenChange = useCallback((open: boolean) => {
+    if (open)
+      setSelectedFileId(file.id)
+    setIsPreviewOpen(open)
+  }, [file.id])
+
+  return (
+    <li className="group/file-row relative min-w-0">
+      <Dialog open={isPreviewOpen} onOpenChange={handlePreviewOpenChange}>
+        <DialogTrigger
+          render={(
+            <button
+              type="button"
+              data-selected={selected || undefined}
+              aria-current={selected ? 'true' : undefined}
+              className="group/file-tree-row relative flex h-6 w-full min-w-0 cursor-pointer items-center rounded-md pr-7 pl-2 text-left outline-hidden select-none hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:ring-inset data-[selected]:bg-state-base-active"
+            />
+          )}
+        >
+          {Array.from({ length: Math.max(depth - 1, 0) }, (_, index) => (
+            <FileTreeGuide key={index} />
+          ))}
+          <div className="flex min-w-0 flex-[1_0_0] items-center py-0.5">
+            {children}
+          </div>
+        </DialogTrigger>
+        <AgentSkillDetailDialog
+          skillName={file.name}
+          detail={{
+            description: t('agentDetail.configure.files.tip'),
+            files,
+            filePreview: {
+              binary: previewQuery.data?.binary,
+              content: previewQuery.data?.text ?? undefined,
+              downloadUrl: downloadQuery.data?.url,
+              fileName: selectedPreviewFile.name,
+              isDownloadError: downloadQuery.isError,
+              isDownloadLoading: shouldDownloadPreviewFile && downloadQuery.isPending,
+              isError: previewQuery.isError,
+              isImage: isImagePreviewFile,
+              isLoading: previewQuery.isPending,
+            },
+            onSelectFile: selectedFile => setSelectedFileId(selectedFile.id),
+            selectedFileId: selectedFileId ?? file.id,
+            sections: [],
+          }}
+        />
+      </Dialog>
+      {!readOnly && (
+        <button
+          type="button"
+          data-agent-file-remove-button
+          aria-label={t('agentDetail.configure.files.remove', { name: file.name })}
+          onClick={handleRemove}
+          className="pointer-events-none absolute top-1/2 right-1 z-10 flex size-5 -translate-y-1/2 items-center justify-center rounded-md text-text-tertiary opacity-0 group-focus-within/file-row:pointer-events-auto group-focus-within/file-row:opacity-100 group-hover/file-row:pointer-events-auto group-hover/file-row:opacity-100 hover:bg-state-destructive-hover hover:text-text-destructive focus-visible:bg-state-destructive-hover focus-visible:text-text-destructive focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+        >
+          <span aria-hidden className="i-ri-delete-bin-line size-4" />
+        </button>
+      )}
+    </li>
+  )
+}
+
+export function AgentFiles({
+  agentId,
+  appId,
+  nodeId,
+}: {
+  agentId: string
+  appId?: string
+  nodeId?: string
+}) {
+  const { t } = useTranslation('agentV2')
+  const [draftFiles, setDraftFiles] = useAtom(agentComposerFilesAtom)
+  const filesTip = t('agentDetail.configure.files.tip')
+  const filesTreeId = 'agent-configure-files-tree'
+  const [isUploadOpen, setIsUploadOpen] = useState(false)
+  const promptAddCallbackRef = useRef<AgentOrchestrateAddActionOptions['onAdded']>(undefined)
+  const apiContext: AgentFileApiContext = useMemo(() => appId && nodeId
+    ? {
+        agentId,
+        workflow: {
+          appId,
+          nodeId,
+        },
+      }
+    : { agentId }, [agentId, appId, nodeId])
+  const agentDriveFilesQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.get.queryOptions({
+      input: {
+        params: {
+          agent_id: agentId,
+        },
+        query: {
+          prefix: FILES_DRIVE_PREFIX,
+        },
+      },
+    }),
+    enabled: !apiContext.workflow,
+  })
+  const workflowDriveFilesQuery = useQuery({
+    ...consoleQuery.apps.byAppId.agent.drive.files.get.queryOptions({
+      input: {
+        params: {
+          app_id: appId ?? '',
+        },
+        query: {
+          node_id: nodeId,
+          prefix: FILES_DRIVE_PREFIX,
+        },
+      },
+    }),
+    enabled: !!apiContext.workflow,
+  })
+  const driveFilesQuery = apiContext.workflow ? workflowDriveFilesQuery : agentDriveFilesQuery
+  const { mutate: deleteAgentFile } = useMutation(consoleQuery.agent.byAgentId.files.delete.mutationOptions())
+  const { mutate: deleteWorkflowAgentFile } = useMutation(consoleQuery.apps.byAppId.agent.files.delete.mutationOptions())
+  const files = driveFilesQuery.isSuccess
+    ? (driveFilesQuery.data.items ?? []).map(toAgentFileNodeFromDriveItem)
+    : draftFiles
+  const removeFile = useCallback((fileId: string) => {
+    const file = findAgentFileNode(files, fileId)
+    const driveKey = file?.driveKey
+
+    setDraftFiles(removeFileNode(draftFiles, fileId))
+    if (!driveKey)
+      return
+
+    const onSuccess = () => {
+      void driveFilesQuery.refetch()
+    }
+    if (apiContext.workflow) {
+      deleteWorkflowAgentFile({
+        params: {
+          app_id: apiContext.workflow.appId,
+        },
+        query: {
+          key: driveKey,
+          node_id: apiContext.workflow.nodeId,
+        },
+      }, { onSuccess })
+      return
+    }
+
+    deleteAgentFile({
+      params: {
+        agent_id: apiContext.agentId,
+      },
+      query: {
+        key: driveKey,
+      },
+    }, { onSuccess })
+  }, [apiContext, deleteAgentFile, deleteWorkflowAgentFile, draftFiles, driveFilesQuery, files, setDraftFiles])
+  const handleOpenUpload = useCallback((options?: AgentOrchestrateAddActionOptions) => {
+    promptAddCallbackRef.current = options?.onAdded
+    setIsUploadOpen(true)
+  }, [])
+  useRegisterAgentOrchestrateAddAction('files', handleOpenUpload)
+  const handleUploaded = useCallback((file: AgentFileNode) => {
+    setDraftFiles([...draftFiles, file])
+    void driveFilesQuery.refetch()
+    promptAddCallbackRef.current?.(file)
+    promptAddCallbackRef.current = undefined
+  }, [draftFiles, driveFilesQuery, setDraftFiles])
+  const handleUploadOpenChange = useCallback((open: boolean) => {
+    if (!open)
+      promptAddCallbackRef.current = undefined
+    setIsUploadOpen(open)
+  }, [])
+
+  return (
+    <>
+      <ConfigureSection
+        label={t('agentDetail.configure.files.label')}
+        labelId="agent-configure-files-label"
+        tip={filesTip}
+        tipAriaLabel={filesTip}
+        rootClassName="border-b border-divider-subtle pt-4"
+        panelContentClassName="pb-4"
+        actions={(
+          <ConfigureSectionAddButton
+            ariaLabel={t('agentDetail.configure.files.add')}
+            onClick={() => handleOpenUpload()}
+          />
+        )}
+      >
+        {files.length === 0
+          ? (
+              <ConfigureSectionEmpty
+                title={t('agentDetail.configure.files.empty.title')}
+                description={t('agentDetail.configure.files.empty.description')}
+              />
+            )
+          : (
+              <AgentFileTree
+                id={filesTreeId}
+                files={files}
+                treeLabel={t('agentDetail.configure.files.treeLabel')}
+                className="rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg p-1 shadow-xs shadow-shadow-shadow-3"
+                scrollAreaClassName="max-h-[250px] flex-none"
+                renderFile={({ depth, file, selected, children }) => (
+                  <AgentFileItem
+                    depth={depth}
+                    file={file}
+                    files={files}
+                    apiContext={apiContext}
+                    selected={selected}
+                    onRemove={removeFile}
+                  >
+                    {children}
+                  </AgentFileItem>
+                )}
+              />
+            )}
+      </ConfigureSection>
+      <AgentFileUploadDialog
+        apiContext={apiContext}
+        open={isUploadOpen}
+        onOpenChange={handleUploadOpenChange}
+        onUploaded={handleUploaded}
+      />
+    </>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/tree.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/tree.tsx
new file mode 100644
index 00000000000..6732d5a180b
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/tree.tsx
@@ -0,0 +1,156 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { AgentFileNode } from '@/features/agent-v2/agent-composer/form-state'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  FileTreeFile,
+  FileTreeFolder,
+  FileTreeFolderPanel,
+  FileTreeFolderTrigger,
+  FileTreeIcon,
+  FileTreeLabel,
+  FileTreeList,
+  FileTreeRoot,
+} from '@langgenius/dify-ui/file-tree'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { Fragment } from 'react'
+
+type AgentFileTreeFolderOpenStrategy = (context: {
+  file: AgentFileNode
+  depth: number
+}) => boolean
+
+type AgentFileTreeRenderFile = (context: {
+  depth: number
+  file: AgentFileNode
+  selected: boolean
+  children: ReactNode
+}) => ReactNode
+
+const firstLevelFolderOpenStrategy: AgentFileTreeFolderOpenStrategy = ({ depth }) => depth === 1
+
+function AgentFileTreeRows({
+  files,
+  selectedFileId,
+  depth,
+  folderOpenStrategy,
+  renderFile,
+}: {
+  files: AgentFileNode[]
+  selectedFileId?: string
+  depth: number
+  folderOpenStrategy: AgentFileTreeFolderOpenStrategy
+  renderFile: AgentFileTreeRenderFile
+}) {
+  return files.map((file) => {
+    const children = (
+      <>
+        <FileTreeIcon type={file.icon} />
+        <FileTreeLabel className="max-w-full" title={file.name}>{file.name}</FileTreeLabel>
+      </>
+    )
+
+    if (file.children?.length) {
+      return (
+        <FileTreeFolder
+          key={file.id}
+          defaultOpen={folderOpenStrategy({ file, depth })}
+        >
+          <FileTreeFolderTrigger>
+            <FileTreeIcon type="folder" />
+            <FileTreeLabel className="max-w-full" title={file.name}>{file.name}</FileTreeLabel>
+          </FileTreeFolderTrigger>
+          <FileTreeFolderPanel>
+            <AgentFileTreeRows
+              files={file.children}
+              selectedFileId={selectedFileId}
+              depth={depth + 1}
+              folderOpenStrategy={folderOpenStrategy}
+              renderFile={renderFile}
+            />
+          </FileTreeFolderPanel>
+        </FileTreeFolder>
+      )
+    }
+
+    return (
+      <Fragment key={file.id}>
+        {renderFile({
+          depth,
+          file,
+          selected: file.id === selectedFileId,
+          children,
+        })}
+      </Fragment>
+    )
+  })
+}
+
+const defaultRenderFile: AgentFileTreeRenderFile = ({ selected, children }) => (
+  <FileTreeFile selected={selected}>
+    {children}
+  </FileTreeFile>
+)
+
+export function AgentFileTree({
+  files,
+  selectedFileId,
+  id,
+  treeLabel,
+  label,
+  labelledBy,
+  header,
+  className,
+  scrollAreaClassName,
+  rootClassName,
+  listClassName,
+  folderOpenStrategy = firstLevelFolderOpenStrategy,
+  renderFile = defaultRenderFile,
+}: {
+  files: AgentFileNode[]
+  selectedFileId?: string
+  id?: string
+  treeLabel?: string
+  label?: string
+  labelledBy?: string
+  header?: ReactNode
+  className?: string
+  scrollAreaClassName?: string
+  rootClassName?: string
+  listClassName?: string
+  folderOpenStrategy?: AgentFileTreeFolderOpenStrategy
+  renderFile?: AgentFileTreeRenderFile
+}) {
+  return (
+    <div className={cn('flex min-h-0 w-full max-w-full min-w-0 flex-col overflow-clip', className)}>
+      {header}
+      <ScrollArea
+        className={cn('min-h-0 w-full max-w-full flex-1 overflow-hidden', scrollAreaClassName)}
+        label={label}
+        labelledBy={labelledBy}
+        slotClassNames={{
+          viewport: 'max-h-[inherit] overscroll-contain',
+          content: 'w-full max-w-full min-w-0!',
+          scrollbar: 'hidden',
+        }}
+      >
+        <FileTreeRoot
+          id={id}
+          aria-label={treeLabel}
+          className={cn('w-full max-w-full min-w-0 p-0', rootClassName)}
+        >
+          <FileTreeList className={cn('w-full max-w-full min-w-0', listClassName)}>
+            <AgentFileTreeRows
+              files={files}
+              selectedFileId={selectedFileId}
+              depth={1}
+              folderOpenStrategy={folderOpenStrategy}
+              renderFile={renderFile}
+            />
+          </FileTreeList>
+        </FileTreeRoot>
+      </ScrollArea>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/upload-dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/upload-dialog.tsx
new file mode 100644
index 00000000000..ac25c742af9
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/upload-dialog.tsx
@@ -0,0 +1,253 @@
+'use client'
+
+import type { FileResponse } from '@dify/contracts/api/console/files/types.gen'
+import type { AgentFileApiContext } from './api-context'
+import type { AgentFileNode } from '@/features/agent-v2/agent-composer/form-state'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { FileTreeIcon } from '@langgenius/dify-ui/file-tree'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import ActionButton from '@/app/components/base/action-button'
+import { consoleQuery } from '@/service/client'
+import { formatFileSize } from '@/utils/format'
+import { getFileIconType } from './file-icon'
+
+type AgentDriveFileCommit = {
+  file: {
+    drive_key: string
+    file_id: string
+    mime_type?: string | null
+    name: string
+  }
+}
+
+function toAgentFileNode(committedFile: AgentDriveFileCommit['file']): AgentFileNode {
+  return {
+    id: committedFile.file_id,
+    name: committedFile.name,
+    icon: getFileIconType(committedFile.name, committedFile.mime_type),
+    driveKey: committedFile.drive_key,
+  }
+}
+
+function AgentFileUploader({
+  file,
+  onChange,
+}: {
+  file?: File
+  onChange: (file?: File) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const fileInputRef = useRef<HTMLInputElement>(null)
+  const [dragging, setDragging] = useState(false)
+
+  const setUploadFiles = (files: File[]) => {
+    const [uploadFile] = files
+    if (files.length !== 1 || !uploadFile) {
+      toast.error(t('agentDetail.configure.files.upload.invalidFile'))
+      return
+    }
+
+    onChange(uploadFile)
+  }
+
+  const handleFileChange = (event: React.ChangeEvent<HTMLInputElement>) => {
+    const files = Array.from(event.target.files ?? [])
+    event.target.value = ''
+    setUploadFiles(files)
+  }
+
+  const handleDrop = (event: React.DragEvent<HTMLDivElement>) => {
+    event.preventDefault()
+    event.stopPropagation()
+    setDragging(false)
+
+    setUploadFiles(Array.from(event.dataTransfer.files))
+  }
+
+  return (
+    <div className="mt-6">
+      <input
+        ref={fileInputRef}
+        className="hidden"
+        type="file"
+        onChange={handleFileChange}
+      />
+      {!file && (
+        <div
+          className={cn(
+            'relative flex h-16 items-center rounded-[10px] border border-dashed border-components-dropzone-border bg-components-dropzone-bg text-sm font-normal',
+            dragging && 'border-components-dropzone-border-accent bg-components-dropzone-bg-accent',
+          )}
+          onDragEnter={(event) => {
+            event.preventDefault()
+            setDragging(true)
+          }}
+          onDragOver={event => event.preventDefault()}
+          onDragLeave={() => setDragging(false)}
+          onDrop={handleDrop}
+        >
+          <div className="flex w-full items-center justify-center space-x-2">
+            <span aria-hidden className="i-ri-upload-cloud-2-line size-6 text-text-tertiary" />
+            <div className="text-text-tertiary">
+              {t('agentDetail.configure.files.upload.dropzone')}
+              <button
+                type="button"
+                className="inline cursor-pointer border-none bg-transparent p-0 pl-1 text-left text-text-accent focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
+                onClick={() => fileInputRef.current?.click()}
+              >
+                {t('agentDetail.configure.files.upload.browse')}
+              </button>
+            </div>
+          </div>
+          {dragging && <div className="absolute top-0 left-0 size-full" />}
+        </div>
+      )}
+      {file && (
+        <div className="group flex items-center rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg shadow-xs hover:bg-components-panel-on-panel-item-bg-hover">
+          <div className="flex items-center justify-center p-3">
+            <FileTreeIcon type={getFileIconType(file.name, file.type)} />
+          </div>
+          <div className="flex grow flex-col items-start gap-0.5 py-1 pr-2">
+            <span className="max-w-[calc(100%-30px)] overflow-hidden text-[12px] leading-4 font-medium text-ellipsis whitespace-nowrap text-text-secondary">{file.name}</span>
+            <div className="flex h-3 items-center gap-1 self-stretch text-[10px] leading-3 font-medium text-text-tertiary uppercase">
+              <span>{t('agentDetail.configure.files.upload.fileType')}</span>
+              <span className="text-text-quaternary">·</span>
+              <span>{formatFileSize(file.size)}</span>
+            </div>
+          </div>
+          <div className="hidden items-center pr-3 group-hover:flex">
+            <ActionButton onClick={() => onChange(undefined)}>
+              <span aria-hidden className="i-ri-delete-bin-line size-4 text-text-tertiary" />
+            </ActionButton>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
+
+export function AgentFileUploadDialog({
+  apiContext,
+  open,
+  onOpenChange,
+  onUploaded,
+}: {
+  apiContext: AgentFileApiContext
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  onUploaded: (file: AgentFileNode) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const [file, setFile] = useState<File>()
+  const uploadFileMutation = useMutation(consoleQuery.files.upload.post.mutationOptions())
+  const commitAgentFileMutation = useMutation(consoleQuery.agent.byAgentId.files.post.mutationOptions())
+  const commitWorkflowAgentFileMutation = useMutation(consoleQuery.apps.byAppId.agent.files.post.mutationOptions())
+  const isUploading = uploadFileMutation.isPending
+    || commitAgentFileMutation.isPending
+    || commitWorkflowAgentFileMutation.isPending
+
+  const commitUploadedFile = (uploadedFile: FileResponse, options: {
+    onSuccess: (committedFile: AgentDriveFileCommit) => void
+    onError: () => void
+  }) => {
+    const body = {
+      upload_file_id: uploadedFile.id,
+    }
+
+    if (apiContext.workflow) {
+      commitWorkflowAgentFileMutation.mutate({
+        params: {
+          app_id: apiContext.workflow.appId,
+        },
+        query: {
+          node_id: apiContext.workflow.nodeId,
+        },
+        body,
+      }, options)
+      return
+    }
+
+    commitAgentFileMutation.mutate({
+      params: {
+        agent_id: apiContext.agentId,
+      },
+      body,
+    }, options)
+  }
+
+  const handleUpload = () => {
+    if (!file || isUploading)
+      return
+
+    uploadFileMutation.mutate({
+      body: {
+        file,
+      },
+    }, {
+      onSuccess: (uploadedFile) => {
+        commitUploadedFile(uploadedFile, {
+          onSuccess: (committedFile) => {
+            toast.success(t('agentDetail.configure.files.upload.success'))
+            onUploaded(toAgentFileNode(committedFile.file))
+            setFile(undefined)
+            onOpenChange(false)
+          },
+          onError: () => {
+            toast.error(t('agentDetail.configure.files.upload.failed'))
+          },
+        })
+      },
+      onError: () => {
+        toast.error(t('agentDetail.configure.files.upload.failed'))
+      },
+    })
+  }
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    if (!nextOpen) {
+      uploadFileMutation.reset()
+      commitAgentFileMutation.reset()
+      commitWorkflowAgentFileMutation.reset()
+      setFile(undefined)
+    }
+    onOpenChange(nextOpen)
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent>
+        <DialogCloseButton />
+        <DialogTitle className="title-2xl-semi-bold text-text-primary">
+          {t('agentDetail.configure.files.upload.title')}
+        </DialogTitle>
+        <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+          {t('agentDetail.configure.files.upload.description')}
+        </DialogDescription>
+        <AgentFileUploader
+          file={file}
+          onChange={setFile}
+        />
+        <div className="flex justify-end gap-2 pt-6">
+          <Button type="button" onClick={() => handleOpenChange(false)} disabled={isUploading}>
+            {tCommon('operation.cancel')}
+          </Button>
+          <Button
+            type="button"
+            variant="primary"
+            disabled={!file}
+            loading={isUploading}
+            onClick={handleUpload}
+          >
+            {t('agentDetail.configure.files.upload.action')}
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/header.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/header.tsx
new file mode 100644
index 00000000000..36d11483928
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/header.tsx
@@ -0,0 +1,23 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+
+type AgentOrchestrateHeaderProps = {
+  headingId: string
+}
+
+export function AgentOrchestrateHeader({
+  headingId,
+}: AgentOrchestrateHeaderProps) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <div className="flex shrink-0 items-center gap-1 px-4 py-2">
+      <div className="flex min-w-0 flex-1 flex-col justify-center">
+        <h2 id={headingId} className="truncate title-xl-semi-bold text-text-primary">
+          {t('agentDetail.configure.orchestrate')}
+        </h2>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/index.tsx
new file mode 100644
index 00000000000..81c2653657a
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/index.tsx
@@ -0,0 +1,118 @@
+'use client'
+
+import type { AgentConfigSnapshotDetailResponse, AgentConfigSnapshotSummaryResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentConfigurePublishPayload } from './publish-bar'
+import type { DefaultModel, Model } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { cn } from '@langgenius/dify-ui/cn'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useTranslation } from 'react-i18next'
+import { AgentOrchestrateAddActionsProvider } from './add-actions'
+import { AgentAdvancedSettings } from './advanced'
+import { AgentFiles } from './files'
+import { AgentOrchestrateHeader } from './header'
+import { AgentKnowledgeRetrieval } from './knowledge'
+import { AgentModelField } from './model-config/field'
+import { AgentPromptEditor } from './prompt-editor'
+import { AgentConfigurePublishBar } from './publish-bar'
+import { AgentOrchestrateReadOnlyContext } from './read-only-context'
+import { AgentSkills } from './skills'
+import { AgentTools } from './tools'
+
+type AgentOrchestratePanelProps = {
+  agentId: string
+  appId?: string
+  activeConfigIsPublished?: boolean
+  activeConfigSnapshot?: AgentConfigSnapshotSummaryResponse | null
+  agentSoulConfig?: AgentConfigSnapshotDetailResponse['config_snapshot']
+  agentName?: string | null
+  currentModel?: DefaultModel
+  textGenerationModelList: Model[]
+  draftSavedAt?: number
+  isPublishing?: boolean
+  className?: string
+  readOnly?: boolean
+  showHeader?: boolean
+  showPublishBar?: boolean
+  onSelectModel: (model: DefaultModel) => void
+  onPublish: (payload: AgentConfigurePublishPayload) => void | Promise<void>
+  onOpenVersions: () => void
+}
+
+export function AgentOrchestratePanel({
+  agentId,
+  appId,
+  activeConfigIsPublished,
+  activeConfigSnapshot,
+  agentSoulConfig,
+  agentName,
+  currentModel,
+  textGenerationModelList,
+  draftSavedAt,
+  isPublishing,
+  className,
+  readOnly = false,
+  showHeader = true,
+  showPublishBar = true,
+  onSelectModel,
+  onPublish,
+  onOpenVersions,
+}: AgentOrchestratePanelProps) {
+  const { t } = useTranslation('agentV2')
+  const orchestrateHeadingId = 'agent-configure-orchestrate-heading'
+  const orchestrateLabel = t('agentDetail.configure.orchestrate')
+
+  return (
+    <div className={cn('flex max-w-140 min-w-90 flex-[0_0_min(41.08280255%,560px)] flex-col overflow-hidden rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-bg', className)}>
+      {showHeader && <AgentOrchestrateHeader headingId={orchestrateHeadingId} />}
+
+      <AgentOrchestrateReadOnlyContext value={readOnly}>
+        <div
+          aria-readonly={readOnly}
+          className="flex min-h-0 flex-1 flex-col"
+        >
+          <ScrollArea
+            className="min-h-0 flex-1 overflow-hidden"
+            label={showHeader ? undefined : orchestrateLabel}
+            labelledBy={showHeader ? orchestrateHeadingId : undefined}
+            slotClassNames={{
+              viewport: 'overscroll-contain',
+              content: 'min-h-full px-4 py-3',
+            }}
+          >
+            <AgentOrchestrateAddActionsProvider>
+              <AgentModelField
+                currentModel={currentModel}
+                textGenerationModelList={textGenerationModelList}
+                onSelect={onSelectModel}
+              />
+              <AgentPromptEditor />
+              <AgentSkills agentId={agentId} />
+              <AgentFiles
+                agentId={agentId}
+                appId={appId}
+              />
+              <AgentTools />
+              <AgentKnowledgeRetrieval />
+              <AgentAdvancedSettings />
+            </AgentOrchestrateAddActionsProvider>
+          </ScrollArea>
+        </div>
+      </AgentOrchestrateReadOnlyContext>
+
+      {showPublishBar && (
+        <AgentConfigurePublishBar
+          agentId={agentId}
+          activeConfigIsPublished={activeConfigIsPublished}
+          activeConfigSnapshot={activeConfigSnapshot}
+          agentSoulConfig={agentSoulConfig}
+          agentName={agentName}
+          currentModel={currentModel}
+          draftSavedAt={draftSavedAt}
+          isPublishing={isPublishing}
+          onPublish={onPublish}
+          onOpenVersions={onOpenVersions}
+        />
+      )}
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..cce4132779a
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/__tests__/index.spec.tsx
@@ -0,0 +1,324 @@
+import type { AgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { useConfigPublishPayload } from '@/features/agent-v2/agent-composer/store'
+import { AgentOrchestrateReadOnlyContext } from '../../read-only-context'
+import { AgentKnowledgeRetrieval } from '../index'
+
+const agentKnowledgeDraft = {
+  ...defaultAgentSoulConfigFormState,
+  knowledgeRetrievals: [
+    {
+      id: 'retrieval-1',
+      nameKey: 'agentDetail.configure.knowledgeRetrieval.retrievalOne',
+    },
+  ],
+} satisfies AgentSoulConfigFormState
+
+function PublishPayloadPreview() {
+  const payload = useConfigPublishPayload({ agentId: 'agent-1' })
+
+  return (
+    <output aria-label="publish payload">
+      {JSON.stringify(payload.config_snapshot.knowledge)}
+    </output>
+  )
+}
+
+function renderKnowledgeRetrieval({
+  initialDraft = agentKnowledgeDraft,
+  readOnly = false,
+  showPublishPayload = false,
+}: {
+  initialDraft?: AgentSoulConfigFormState
+  readOnly?: boolean
+  showPublishPayload?: boolean
+} = {}) {
+  const queryClient = new QueryClient()
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentComposerProvider initialDraft={initialDraft}>
+        <AgentOrchestrateReadOnlyContext value={readOnly}>
+          <AgentKnowledgeRetrieval />
+        </AgentOrchestrateReadOnlyContext>
+        {showPublishPayload && <PublishPayloadPreview />}
+      </AgentComposerProvider>
+    </QueryClientProvider>,
+  )
+}
+
+describe('AgentKnowledgeRetrieval', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('Rendering', () => {
+    it('should render configured retrieval rows', () => {
+      renderKnowledgeRetrieval()
+
+      expect(screen.getByText('agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne')).toBeInTheDocument()
+      expect(screen.queryByText('agentV2.agentDetail.configure.knowledgeRetrieval.retrievalTwo')).not.toBeInTheDocument()
+    })
+
+    it('should hide add, edit, and remove actions when readonly', () => {
+      renderKnowledgeRetrieval({ readOnly: true })
+
+      expect(screen.getByText('agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne')).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'agentV2.agentDetail.configure.knowledgeRetrieval.add' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.edit:{"name":"agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne"}',
+      })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.remove:{"name":"agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne"}',
+      })).not.toBeInTheDocument()
+    })
+
+    it('should keep row actions focusable while visually hidden until hover or focus', () => {
+      renderKnowledgeRetrieval()
+
+      const editButton = screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.edit:{"name":"agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne"}',
+      })
+      const removeButton = screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.remove:{"name":"agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne"}',
+      })
+      const actionGroup = editButton.parentElement
+
+      expect(actionGroup).toHaveClass('flex')
+      expect(actionGroup).not.toHaveClass('hidden')
+      expect(actionGroup).toHaveClass(
+        'opacity-0',
+        'group-focus-within:opacity-100',
+        'group-hover:opacity-100',
+      )
+      expect(removeButton).toHaveClass(
+        'hover:bg-state-destructive-hover',
+        'hover:text-text-destructive',
+        'focus-visible:bg-state-destructive-hover',
+        'focus-visible:text-text-destructive',
+      )
+    })
+  })
+
+  describe('User Interactions', () => {
+    it('should open the knowledge retrieval dialog from the add button', async () => {
+      const user = userEvent.setup()
+      renderKnowledgeRetrieval()
+
+      await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.knowledgeRetrieval.add' }))
+
+      const dialog = screen.getByRole('dialog', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.title',
+      })
+      const titleButton = within(dialog).getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.retrievalTwo',
+      })
+      expect(titleButton).toBeInTheDocument()
+      expect(within(dialog).queryByRole('textbox', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.nameLabel',
+      })).not.toBeInTheDocument()
+
+      await user.click(titleButton)
+
+      expect(within(dialog).getByRole('textbox', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.nameLabel',
+      })).toHaveValue('agentV2.agentDetail.configure.knowledgeRetrieval.retrievalTwo')
+      expect(within(dialog).getByText('appDebug.datasetConfig.knowledgeTip')).toBeInTheDocument()
+      expect(within(dialog).getByRole('button', {
+        name: 'common.operation.add workflow.nodes.knowledgeRetrieval.knowledge',
+      })).toBeInTheDocument()
+      expect(within(dialog).getByRole('button', {
+        name: 'workflow.nodes.knowledgeRetrieval.metadata.options.disabled.title',
+      })).toBeInTheDocument()
+    })
+
+    it('should show the custom query input when query mode changes', async () => {
+      const user = userEvent.setup()
+      renderKnowledgeRetrieval()
+
+      await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.knowledgeRetrieval.add' }))
+      const dialog = screen.getByRole('dialog', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.title',
+      })
+
+      await user.click(within(dialog).getByRole('radio', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.custom',
+      }))
+
+      const customQueryInput = within(dialog).getByRole('textbox', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel',
+      })
+      await user.type(customQueryInput, 'release notes')
+
+      expect(customQueryInput).toHaveValue('release notes')
+      expect(within(dialog).getByPlaceholderText('agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder')).toBeInTheDocument()
+      expect(within(dialog).getByText('agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription')).toBeInTheDocument()
+      expect(within(dialog).queryByText('agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription')).not.toBeInTheDocument()
+    })
+
+    it('should save newly added retrieval data into the publish config', async () => {
+      const user = userEvent.setup()
+      renderKnowledgeRetrieval({ showPublishPayload: true })
+
+      await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.knowledgeRetrieval.add' }))
+      const dialog = screen.getByRole('dialog', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.title',
+      })
+
+      expect(within(dialog).getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.retrievalTwo',
+      })).toBeInTheDocument()
+
+      await user.click(within(dialog).getByRole('radio', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.custom',
+      }))
+      await user.type(within(dialog).getByRole('textbox', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel',
+      }), 'new release notes')
+
+      const knowledgeConfig = JSON.parse(screen.getByLabelText('publish payload').textContent ?? '{}')
+      expect(knowledgeConfig.datasets).toEqual(expect.arrayContaining([
+        {
+          id: 'retrieval-1',
+          name: 'agentDetail.configure.knowledgeRetrieval.retrievalOne',
+        },
+        expect.objectContaining({
+          name: 'agentV2.agentDetail.configure.knowledgeRetrieval.retrievalTwo',
+        }),
+      ]))
+      expect(knowledgeConfig).toMatchObject({
+        query_config: {
+          query: 'new release notes',
+          top_k: 4,
+        },
+        query_mode: 'user_query',
+      })
+    })
+
+    it('should open the knowledge retrieval dialog from the edit button', async () => {
+      const user = userEvent.setup()
+      renderKnowledgeRetrieval()
+
+      await user.click(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.edit:{"name":"agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne"}',
+      }))
+
+      const dialog = screen.getByRole('dialog', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.title',
+      })
+      await user.click(within(dialog).getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne',
+      }))
+
+      expect(within(dialog).getByRole('textbox', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.nameLabel',
+      })).toHaveValue('agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne')
+    })
+
+    it('should show hydrated backend datasets in the edit dialog', async () => {
+      const user = userEvent.setup()
+      renderKnowledgeRetrieval({
+        initialDraft: {
+          ...defaultAgentSoulConfigFormState,
+          knowledgeRetrievals: [
+            {
+              id: 'dataset-1',
+              name: 'Search Docs',
+              datasetRefs: [
+                {
+                  id: 'dataset-1',
+                  name: 'Product Docs',
+                  description: 'Docs corpus',
+                },
+              ],
+            },
+          ],
+        },
+      })
+
+      await user.click(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.edit:{"name":"Search Docs"}',
+      }))
+
+      const dialog = screen.getByRole('dialog', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.title',
+      })
+
+      expect(within(dialog).getByText('Product Docs')).toBeInTheDocument()
+      expect(within(dialog).queryByText('appDebug.datasetConfig.knowledgeTip')).not.toBeInTheDocument()
+    })
+
+    it('should save edited retrieval data into the publish config', async () => {
+      const user = userEvent.setup()
+      renderKnowledgeRetrieval({ showPublishPayload: true })
+
+      await user.click(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.edit:{"name":"agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne"}',
+      }))
+      const dialog = screen.getByRole('dialog', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.title',
+      })
+
+      await user.click(within(dialog).getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne',
+      }))
+      const nameInput = within(dialog).getByRole('textbox', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.nameLabel',
+      })
+      await user.clear(nameInput)
+      await user.type(nameInput, 'Release Search')
+      await user.click(within(dialog).getByRole('radio', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.custom',
+      }))
+      await user.type(within(dialog).getByRole('textbox', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel',
+      }), 'release notes')
+
+      const knowledgeConfig = JSON.parse(screen.getByLabelText('publish payload').textContent ?? '{}')
+      expect(knowledgeConfig).toMatchObject({
+        datasets: [
+          {
+            id: 'retrieval-1',
+            name: 'Release Search',
+          },
+        ],
+        query_config: {
+          query: 'release notes',
+          top_k: 4,
+        },
+        query_mode: 'user_query',
+      })
+    })
+
+    it('should remove the knowledge retrieval row from the remove button', async () => {
+      const user = userEvent.setup()
+      renderKnowledgeRetrieval()
+
+      await user.click(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.remove:{"name":"agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne"}',
+      }))
+
+      expect(screen.queryByText('agentV2.agentDetail.configure.knowledgeRetrieval.retrievalOne')).not.toBeInTheDocument()
+      expect(screen.getByText('agentV2.agentDetail.configure.knowledgeRetrieval.empty.title')).toBeInTheDocument()
+    })
+  })
+
+  describe('Edge Cases', () => {
+    it('should close the dialog from the close button', async () => {
+      const user = userEvent.setup()
+      renderKnowledgeRetrieval()
+
+      await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.knowledgeRetrieval.add' }))
+      await user.click(screen.getByRole('button', { name: 'Close' }))
+
+      expect(screen.queryByRole('dialog', {
+        name: 'agentV2.agentDetail.configure.knowledgeRetrieval.dialog.title',
+      })).not.toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/dialog.tsx
new file mode 100644
index 00000000000..200313ca813
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/dialog.tsx
@@ -0,0 +1,472 @@
+'use client'
+
+import type { AgentKnowledgeDatasetConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { ReactNode } from 'react'
+import type {
+  MetadataFilteringCondition,
+  MetadataFilteringModeEnum,
+  MultipleRetrievalConfig,
+} from '@/app/components/workflow/nodes/knowledge-retrieval/types'
+import type { ModelConfig } from '@/app/components/workflow/types'
+import type { AgentKnowledgeRetrievalItem } from '@/features/agent-v2/agent-composer/form-state'
+import type { DataSet, MetadataInDoc } from '@/models/datasets'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Dialog, DialogCloseButton, DialogContent, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { Input } from '@langgenius/dify-ui/input'
+import { RadioRoot } from '@langgenius/dify-ui/radio'
+import { RadioGroup } from '@langgenius/dify-ui/radio-group'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { intersectionBy } from 'es-toolkit/compat'
+import { useEffect, useMemo, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { IndexingType } from '@/app/components/datasets/create/step-two/hooks/use-indexing-config'
+import Field from '@/app/components/workflow/nodes/_base/components/field'
+import AddKnowledge from '@/app/components/workflow/nodes/knowledge-retrieval/components/add-dataset'
+import DatasetList from '@/app/components/workflow/nodes/knowledge-retrieval/components/dataset-list'
+import MetadataFilter from '@/app/components/workflow/nodes/knowledge-retrieval/components/metadata/metadata-filter'
+import RetrievalConfig from '@/app/components/workflow/nodes/knowledge-retrieval/components/retrieval-config'
+import {
+  ComparisonOperator,
+  LogicalOperator,
+  MetadataFilteringVariableType,
+  MetadataFilteringModeEnum as WorkflowMetadataFilteringModeEnum,
+} from '@/app/components/workflow/nodes/knowledge-retrieval/types'
+import { DATASET_DEFAULT } from '@/config'
+import { useDocLink } from '@/context/i18n'
+import { ChunkingMode, DatasetPermission, DataSourceType } from '@/models/datasets'
+import { AppModeEnum, RETRIEVE_METHOD, RETRIEVE_TYPE } from '@/types/app'
+
+type KnowledgeRetrievalQueryMode = 'agent' | 'custom'
+
+const queryModeOptions: KnowledgeRetrievalQueryMode[] = ['agent', 'custom']
+
+const optionCardClassName = cn(
+  'flex h-8 flex-1 items-center justify-center rounded-lg border border-components-option-card-option-border bg-components-option-card-option-bg px-3 py-2 text-center system-sm-regular text-text-secondary transition-colors',
+  'hover:border-components-option-card-option-border-hover hover:bg-components-option-card-option-bg-hover',
+  'focus-visible:ring-1 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+  'data-checked:border-[1.5px] data-checked:border-components-option-card-option-selected-border data-checked:bg-components-option-card-option-selected-bg data-checked:font-medium data-checked:text-text-primary data-checked:shadow-xs data-checked:shadow-shadow-shadow-3',
+)
+
+function KnowledgeRetrievalDialogIcon() {
+  return (
+    <span className="flex size-6 shrink-0 items-center justify-center rounded-md border-[0.5px] border-divider-subtle bg-util-colors-green-green-500 p-1 text-text-primary-on-surface shadow-md shadow-shadow-shadow-5">
+      <span aria-hidden className="i-ri-book-open-line size-4" />
+    </span>
+  )
+}
+
+function DialogFormLabel({
+  children,
+  id,
+}: {
+  children: ReactNode
+  id?: string
+}) {
+  return (
+    <div id={id} className="flex min-h-6 items-center system-sm-semibold-uppercase text-text-secondary">
+      {children}
+    </div>
+  )
+}
+
+const createDefaultRetrievalConfig = (): MultipleRetrievalConfig => ({
+  top_k: DATASET_DEFAULT.top_k,
+  score_threshold: null,
+  reranking_enable: false,
+})
+
+const createDatasetFromRef = (dataset: AgentKnowledgeDatasetConfig, index: number): DataSet => {
+  const id = dataset.id ?? dataset.name ?? `dataset-${index}`
+  const name = dataset.name ?? id
+
+  return {
+    id,
+    name,
+    indexing_status: 'completed',
+    icon_info: {
+      icon: '📙',
+      icon_type: 'emoji',
+      icon_background: '#FFF4ED',
+      icon_url: '',
+    },
+    description: dataset.description ?? '',
+    permission: DatasetPermission.allTeamMembers,
+    data_source_type: DataSourceType.FILE,
+    indexing_technique: IndexingType.QUALIFIED,
+    created_by: '',
+    updated_by: '',
+    updated_at: 0,
+    app_count: 0,
+    doc_form: ChunkingMode.text,
+    document_count: 0,
+    total_document_count: 0,
+    word_count: 0,
+    provider: '',
+    embedding_model: '',
+    embedding_model_provider: '',
+    embedding_available: false,
+    retrieval_model_dict: {
+      search_method: RETRIEVE_METHOD.semantic,
+      reranking_enable: false,
+      reranking_model: {
+        reranking_provider_name: '',
+        reranking_model_name: '',
+      },
+      top_k: DATASET_DEFAULT.top_k,
+      score_threshold_enabled: false,
+      score_threshold: 0,
+    },
+    retrieval_model: {
+      search_method: RETRIEVE_METHOD.semantic,
+      reranking_enable: false,
+      reranking_model: {
+        reranking_provider_name: '',
+        reranking_model_name: '',
+      },
+      top_k: DATASET_DEFAULT.top_k,
+      score_threshold_enabled: false,
+      score_threshold: 0,
+    },
+    tags: [],
+    external_knowledge_info: {
+      external_knowledge_id: '',
+      external_knowledge_api_id: '',
+      external_knowledge_api_name: '',
+      external_knowledge_api_endpoint: '',
+    },
+    external_retrieval_model: {
+      top_k: DATASET_DEFAULT.top_k,
+      score_threshold: 0,
+      score_threshold_enabled: false,
+    },
+    built_in_field_enabled: false,
+    runtime_mode: 'general',
+    enable_api: false,
+    is_multimodal: false,
+  }
+}
+
+const getSelectedDatasets = (item?: AgentKnowledgeRetrievalItem) => (
+  item?.selectedDatasets ?? item?.datasetRefs?.map(createDatasetFromRef) ?? []
+)
+
+const createMetadataCondition = ({ id, name, type }: MetadataInDoc): MetadataFilteringCondition => ({
+  id: globalThis.crypto?.randomUUID?.() ?? `${Date.now()}`,
+  metadata_id: id,
+  name,
+  comparison_operator: type === MetadataFilteringVariableType.number
+    ? ComparisonOperator.equal
+    : ComparisonOperator.is,
+})
+
+export function AgentKnowledgeRetrievalDialog({
+  item,
+  initialName,
+  onItemChange,
+  open,
+  onOpenChange,
+}: {
+  item?: AgentKnowledgeRetrievalItem
+  initialName?: string
+  onItemChange?: (item: AgentKnowledgeRetrievalItem) => void
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const docLink = useDocLink()
+  const [name, setName] = useState(() => item?.name ?? initialName ?? t('agentDetail.configure.knowledgeRetrieval.retrievalOne'))
+  const [isEditingName, setIsEditingName] = useState(false)
+  const nameInputRef = useRef<HTMLInputElement>(null)
+  const [queryMode, setQueryMode] = useState<KnowledgeRetrievalQueryMode>(item?.queryMode ?? 'agent')
+  const [customQuery, setCustomQuery] = useState(item?.customQuery ?? '')
+  const [selectedDatasets, setSelectedDatasets] = useState<DataSet[]>(() => getSelectedDatasets(item))
+  const [retrievalMode, setRetrievalMode] = useState(item?.retrievalMode ?? RETRIEVE_TYPE.multiWay)
+  const [multipleRetrievalConfig, setMultipleRetrievalConfig] = useState(item?.multipleRetrievalConfig ?? createDefaultRetrievalConfig)
+  const [rerankModelOpen, setRerankModelOpen] = useState(false)
+  const [metadataFilterMode, setMetadataFilterMode] = useState<MetadataFilteringModeEnum>(item?.metadataFilterMode ?? WorkflowMetadataFilteringModeEnum.disabled)
+  const [metadataFilteringConditions, setMetadataFilteringConditions] = useState(item?.metadataFilteringConditions ?? {
+    logical_operator: LogicalOperator.and,
+    conditions: [] as MetadataFilteringCondition[],
+  })
+  const [metadataModelConfig, setMetadataModelConfig] = useState<ModelConfig | undefined>(item?.metadataModelConfig)
+  const queryModeLabelId = 'agent-knowledge-retrieval-query-mode-label'
+  const updateItem = (patch: Partial<AgentKnowledgeRetrievalItem>) => {
+    if (!item)
+      return
+
+    onItemChange?.({
+      ...item,
+      name,
+      queryMode,
+      customQuery,
+      selectedDatasets,
+      retrievalMode,
+      multipleRetrievalConfig,
+      metadataFilterMode,
+      metadataFilteringConditions,
+      metadataModelConfig,
+      ...patch,
+    })
+  }
+  const metadataList = useMemo(() => {
+    const datasetsWithMetadata = selectedDatasets.filter(dataset => !!dataset.doc_metadata)
+
+    if (datasetsWithMetadata.length === 0)
+      return []
+
+    return intersectionBy(...datasetsWithMetadata.map(dataset => dataset.doc_metadata!), 'name')
+  }, [selectedDatasets])
+
+  useEffect(() => {
+    if (!isEditingName)
+      return
+
+    nameInputRef.current?.focus()
+    nameInputRef.current?.select()
+  }, [isEditingName])
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="flex h-[520px] max-h-[calc(100dvh-2rem)] w-[400px] flex-col overflow-hidden p-0">
+        <DialogTitle className="sr-only">
+          {t('agentDetail.configure.knowledgeRetrieval.dialog.title')}
+        </DialogTitle>
+        <div className="flex items-center gap-2 px-4 pt-3">
+          <KnowledgeRetrievalDialogIcon />
+          {isEditingName
+            ? (
+                <Input
+                  ref={nameInputRef}
+                  aria-label={t('agentDetail.configure.knowledgeRetrieval.dialog.nameLabel')}
+                  className="h-7 min-w-0 flex-1 rounded-md px-1 py-0 system-xl-semibold text-text-primary"
+                  value={name}
+                  onBlur={() => setIsEditingName(false)}
+                  onChange={(event) => {
+                    const nextName = event.currentTarget.value
+                    setName(nextName)
+                    updateItem({ name: nextName })
+                  }}
+                  onKeyDown={(event) => {
+                    if (event.key === 'Enter')
+                      setIsEditingName(false)
+                  }}
+                />
+              )
+            : (
+                <button
+                  type="button"
+                  className="flex h-7 min-w-0 flex-1 items-center rounded-md px-1 py-0 text-left system-xl-semibold text-text-primary hover:bg-components-input-bg-hover focus-visible:border focus-visible:border-components-input-border-active focus-visible:bg-components-input-bg-active focus-visible:shadow-xs focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+                  onClick={() => setIsEditingName(true)}
+                >
+                  <span className="min-w-0 truncate">
+                    {name}
+                  </span>
+                </button>
+              )}
+          <DialogCloseButton className="static size-7 shrink-0 rounded-md" />
+        </div>
+
+        <div className="flex min-h-0 flex-1 flex-col gap-1 py-2">
+          <div className="flex flex-col gap-1 px-4 py-2">
+            <DialogFormLabel id={queryModeLabelId}>
+              {t('agentDetail.configure.knowledgeRetrieval.dialog.query.label')}
+            </DialogFormLabel>
+            <RadioGroup<KnowledgeRetrievalQueryMode>
+              aria-labelledby={queryModeLabelId}
+              className="w-full gap-2"
+              value={queryMode}
+              onValueChange={(nextMode) => {
+                if (nextMode) {
+                  setQueryMode(nextMode)
+                  updateItem({ queryMode: nextMode })
+                }
+              }}
+            >
+              {queryModeOptions.map(mode => (
+                <RadioRoot
+                  key={mode}
+                  value={mode}
+                  variant="unstyled"
+                  nativeButton
+                  render={<button type="button" className={optionCardClassName} />}
+                >
+                  <span className="min-w-0 truncate">
+                    {t(`agentDetail.configure.knowledgeRetrieval.dialog.query.${mode}`)}
+                  </span>
+                </RadioRoot>
+              ))}
+            </RadioGroup>
+            {queryMode === 'custom'
+              ? (
+                  <>
+                    <div className="pt-1">
+                      <Textarea
+                        aria-label={t('agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel')}
+                        className="h-20 resize-none rounded-lg px-3 py-2 system-sm-regular"
+                        placeholder={t('agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder')}
+                        value={customQuery}
+                        onValueChange={(nextQuery) => {
+                          setCustomQuery(nextQuery)
+                          updateItem({ customQuery: nextQuery })
+                        }}
+                      />
+                    </div>
+                    <p className="system-xs-regular text-text-tertiary">
+                      {t('agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription')}
+                    </p>
+                  </>
+                )
+              : (
+                  <p className="pt-1 system-xs-regular text-text-tertiary">
+                    {t('agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription')}
+                  </p>
+                )}
+          </div>
+
+          <div className="px-4 py-2">
+            <Field
+              title={t('agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label')}
+              required
+              operations={(
+                <div className="flex items-center space-x-1">
+                  <RetrievalConfig
+                    payload={{
+                      retrieval_mode: retrievalMode,
+                      multiple_retrieval_config: multipleRetrievalConfig,
+                    }}
+                    onRetrievalModeChange={(nextRetrievalMode) => {
+                      setRetrievalMode(nextRetrievalMode)
+                      updateItem({ retrievalMode: nextRetrievalMode })
+                    }}
+                    onMultipleRetrievalConfigChange={(nextMultipleRetrievalConfig) => {
+                      setMultipleRetrievalConfig(nextMultipleRetrievalConfig)
+                      updateItem({ multipleRetrievalConfig: nextMultipleRetrievalConfig })
+                    }}
+                    readonly={!selectedDatasets.length}
+                    modal
+                    rerankModalOpen={rerankModelOpen}
+                    onRerankModelOpenChange={setRerankModelOpen}
+                    selectedDatasets={selectedDatasets}
+                  />
+                  <div className="h-3 w-px bg-divider-regular" />
+                  <AddKnowledge
+                    selectedIds={selectedDatasets.map(dataset => dataset.id)}
+                    modal
+                    onChange={(nextDatasets) => {
+                      setSelectedDatasets(nextDatasets)
+                      updateItem({ selectedDatasets: nextDatasets })
+                    }}
+                  />
+                </div>
+              )}
+            >
+              <DatasetList
+                list={selectedDatasets}
+                onChange={setSelectedDatasets}
+                settingsDrawerBackdropClassName="bg-background-overlay"
+                settingsDrawerBackdropForceRender
+                settingsDrawerPopupClassName="data-[swipe-direction=right]:top-6 data-[swipe-direction=right]:bottom-6"
+                settingsModalHeight="100%"
+              />
+            </Field>
+          </div>
+
+          <div className="py-2">
+            <MetadataFilter
+              metadataList={metadataList}
+              selectedDatasetsLoaded
+              metadataFilterMode={metadataFilterMode}
+              metadataFilteringConditions={metadataFilteringConditions}
+              handleMetadataFilterModeChange={(nextMode) => {
+                setMetadataFilterMode(nextMode)
+                updateItem({ metadataFilterMode: nextMode })
+              }}
+              handleAddCondition={(metadataItem) => {
+                setMetadataFilteringConditions((current) => {
+                  const nextConditions = {
+                    ...current,
+                    conditions: [...current.conditions, createMetadataCondition(metadataItem)],
+                  }
+                  updateItem({ metadataFilteringConditions: nextConditions })
+                  return nextConditions
+                })
+              }}
+              handleRemoveCondition={(conditionId) => {
+                setMetadataFilteringConditions((current) => {
+                  const nextConditions = {
+                    ...current,
+                    conditions: current.conditions.filter(condition => condition.id !== conditionId),
+                  }
+                  updateItem({ metadataFilteringConditions: nextConditions })
+                  return nextConditions
+                })
+              }}
+              handleToggleConditionLogicalOperator={() => {
+                setMetadataFilteringConditions((current) => {
+                  const nextConditions = {
+                    ...current,
+                    logical_operator: current.logical_operator === LogicalOperator.and
+                      ? LogicalOperator.or
+                      : LogicalOperator.and,
+                  }
+                  updateItem({ metadataFilteringConditions: nextConditions })
+                  return nextConditions
+                })
+              }}
+              handleUpdateCondition={(conditionId, nextCondition) => {
+                setMetadataFilteringConditions((current) => {
+                  const nextConditions = {
+                    ...current,
+                    conditions: current.conditions.map(condition => condition.id === conditionId ? nextCondition : condition),
+                  }
+                  updateItem({ metadataFilteringConditions: nextConditions })
+                  return nextConditions
+                })
+              }}
+              metadataModelConfig={metadataModelConfig}
+              handleMetadataModelChange={(model) => {
+                setMetadataModelConfig((current) => {
+                  const nextMetadataModelConfig = {
+                    provider: model.provider,
+                    name: model.modelId,
+                    mode: model.mode ?? current?.mode ?? AppModeEnum.CHAT,
+                    completion_params: current?.completion_params ?? { temperature: 0.7 },
+                  }
+                  updateItem({ metadataModelConfig: nextMetadataModelConfig })
+                  return nextMetadataModelConfig
+                })
+              }}
+              handleMetadataCompletionParamsChange={(completionParams) => {
+                setMetadataModelConfig((current) => {
+                  const nextMetadataModelConfig = {
+                    provider: current?.provider ?? '',
+                    name: current?.name ?? '',
+                    mode: current?.mode ?? AppModeEnum.CHAT,
+                    completion_params: completionParams,
+                  }
+                  updateItem({ metadataModelConfig: nextMetadataModelConfig })
+                  return nextMetadataModelConfig
+                })
+              }}
+            />
+          </div>
+        </div>
+
+        <div className="flex flex-col gap-2 px-4 pb-4">
+          <div aria-hidden className="h-2 w-8 border-b border-divider-regular" />
+          <a
+            href={docLink('/use-dify/knowledge/create-knowledge/setting-indexing-methods')}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="inline-flex min-w-0 items-center gap-1 system-xs-regular text-text-tertiary hover:text-text-secondary hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className="i-ri-book-read-line size-3 shrink-0" />
+            <span className="min-w-0 truncate">
+              {t('form.retrievalSetting.learnMore', { ns: 'datasetSettings' })}
+            </span>
+          </a>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/index.tsx
new file mode 100644
index 00000000000..5f65302b23a
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/index.tsx
@@ -0,0 +1,129 @@
+'use client'
+
+import type { AgentOrchestrateAddActionOptions } from '../add-actions-context'
+import type { AgentKnowledgeRetrievalItem } from '@/features/agent-v2/agent-composer/form-state'
+import { useAtom } from 'jotai'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { agentComposerKnowledgeRetrievalsAtom } from '@/features/agent-v2/agent-composer/store-modules/knowledge'
+import { useRegisterAgentOrchestrateAddAction } from '../add-actions-context'
+import { ConfigureSectionAddButton } from '../common/add-button'
+import { ConfigureSectionConfigurableItem } from '../common/configurable-item'
+import { ConfigureSectionEmpty } from '../common/empty'
+import { ConfigureSection } from '../common/section'
+import { AgentKnowledgeRetrievalDialog } from './dialog'
+
+function KnowledgeRetrievalIcon() {
+  return (
+    <span className="flex size-5 shrink-0 items-center justify-center rounded-md border-[0.5px] border-divider-subtle bg-util-colors-green-green-500 p-[3px] text-text-primary-on-surface shadow-xs shadow-shadow-shadow-3">
+      <span aria-hidden className="i-ri-book-open-line size-3.5" />
+    </span>
+  )
+}
+
+function AgentKnowledgeRetrievalRow({
+  onDelete,
+  onEdit,
+  item,
+}: {
+  onDelete: () => void
+  onEdit: () => void
+  item: AgentKnowledgeRetrievalItem
+}) {
+  const { t } = useTranslation('agentV2')
+  const itemName = item.name ?? (item.nameKey ? t(item.nameKey) : item.id)
+
+  return (
+    <ConfigureSectionConfigurableItem
+      icon={<KnowledgeRetrievalIcon />}
+      label={itemName}
+      editAriaLabel={t('agentDetail.configure.knowledgeRetrieval.edit', { name: itemName })}
+      removeAriaLabel={t('agentDetail.configure.knowledgeRetrieval.remove', { name: itemName })}
+      onEdit={onEdit}
+      onRemove={onDelete}
+    />
+  )
+}
+
+export function AgentKnowledgeRetrieval() {
+  const { t } = useTranslation('agentV2')
+  const [retrievals, setRetrievals] = useAtom(agentComposerKnowledgeRetrievalsAtom)
+  const [isAddDialogOpen, setIsAddDialogOpen] = useState(false)
+  const [editingRetrieval, setEditingRetrieval] = useState<AgentKnowledgeRetrievalItem | null>(null)
+  const knowledgeRetrievalTip = t('agentDetail.configure.knowledgeRetrieval.tip')
+  const retrievalListId = 'agent-configure-knowledge-retrieval-list'
+  const isDialogOpen = isAddDialogOpen || !!editingRetrieval
+  const updateRetrieval = (nextRetrieval: AgentKnowledgeRetrievalItem) => {
+    setRetrievals(retrievals.map(retrieval => retrieval.id === nextRetrieval.id ? nextRetrieval : retrieval))
+    setEditingRetrieval(nextRetrieval)
+  }
+  const getDefaultRetrievalName = (index: number) => {
+    if (index === 1)
+      return t('agentDetail.configure.knowledgeRetrieval.retrievalOne')
+    if (index === 2)
+      return t('agentDetail.configure.knowledgeRetrieval.retrievalTwo')
+
+    return t('agentDetail.configure.knowledgeRetrieval.defaultName', { index })
+  }
+  const addRetrieval = (options?: AgentOrchestrateAddActionOptions) => {
+    const nextRetrieval: AgentKnowledgeRetrievalItem = {
+      id: globalThis.crypto?.randomUUID?.() ?? `retrieval-${Date.now()}`,
+      name: getDefaultRetrievalName(retrievals.length + 1),
+      queryMode: 'agent',
+    }
+
+    setRetrievals([...retrievals, nextRetrieval])
+    setEditingRetrieval(nextRetrieval)
+    setIsAddDialogOpen(true)
+    options?.onAdded?.(nextRetrieval)
+  }
+  useRegisterAgentOrchestrateAddAction('knowledge', addRetrieval)
+
+  return (
+    <>
+      <ConfigureSection
+        label={t('agentDetail.configure.knowledgeRetrieval.label')}
+        labelId="agent-configure-knowledge-retrieval-label"
+        panelId={retrievalListId}
+        tip={knowledgeRetrievalTip}
+        tipAriaLabel={knowledgeRetrievalTip}
+        rootClassName="border-b border-divider-subtle pt-4"
+        panelContentClassName="flex flex-col gap-1 pb-4"
+        actions={(
+          <ConfigureSectionAddButton
+            ariaLabel={t('agentDetail.configure.knowledgeRetrieval.add')}
+            onClick={() => addRetrieval()}
+          />
+        )}
+      >
+        {retrievals.length === 0
+          ? (
+              <ConfigureSectionEmpty
+                title={t('agentDetail.configure.knowledgeRetrieval.empty.title')}
+                description={t('agentDetail.configure.knowledgeRetrieval.empty.description')}
+              />
+            )
+          : retrievals.map(item => (
+              <AgentKnowledgeRetrievalRow
+                key={item.id}
+                item={item}
+                onDelete={() => setRetrievals(retrievals.filter(retrieval => retrieval.id !== item.id))}
+                onEdit={() => setEditingRetrieval(item)}
+              />
+            ))}
+      </ConfigureSection>
+      <AgentKnowledgeRetrievalDialog
+        key={editingRetrieval?.id ?? 'add'}
+        item={editingRetrieval ?? undefined}
+        initialName={editingRetrieval ? (editingRetrieval.name ?? (editingRetrieval.nameKey ? t(editingRetrieval.nameKey) : editingRetrieval.id)) : undefined}
+        onItemChange={updateRetrieval}
+        open={isDialogOpen}
+        onOpenChange={(open) => {
+          setIsAddDialogOpen(open)
+          if (!open)
+            setEditingRetrieval(null)
+        }}
+      />
+    </>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/memory.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/memory.tsx
new file mode 100644
index 00000000000..aeae40e23bb
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/memory.tsx
@@ -0,0 +1,125 @@
+'use client'
+
+import type { AgentSoulMemoryConfig } from '@dify/contracts/api/console/agent/types.gen'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+
+type MemorySettingsProps = {
+  isPending: boolean
+  memory?: AgentSoulMemoryConfig
+}
+
+const memoryConfigFields = [
+  {
+    key: 'budget',
+    icon: 'i-ri-scales-3-line',
+    labelKey: 'agentDetail.memorySettings.budgetLabel',
+  },
+  {
+    key: 'scope',
+    icon: 'i-ri-global-line',
+    labelKey: 'agentDetail.memorySettings.scopeLabel',
+  },
+] as const
+
+function MemoryConfigValue({
+  icon,
+  isPending,
+  label,
+  value,
+}: {
+  icon: string
+  isPending: boolean
+  label: string
+  value?: string | null
+}) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <div className="flex min-h-19 min-w-0 items-start gap-3 rounded-lg border border-divider-subtle bg-background-section-burn p-3">
+      <div className="flex size-8 shrink-0 items-center justify-center rounded-lg border border-divider-subtle bg-components-panel-bg text-text-tertiary">
+        <span aria-hidden className={`${icon} size-4`} />
+      </div>
+      <div className="min-w-0 flex-1">
+        <div className="system-xs-semibold-uppercase text-text-tertiary">
+          {label}
+        </div>
+        {isPending
+          ? <SkeletonRectangle className="mt-2 h-4 w-28 animate-pulse rounded-md" />
+          : (
+              <div
+                className={cn(
+                  'mt-1 truncate system-sm-semibold',
+                  value ? 'text-text-primary' : 'text-text-quaternary',
+                )}
+                translate={value ? 'no' : undefined}
+              >
+                {value || t('agentDetail.memorySettings.notConfigured')}
+              </div>
+            )}
+      </div>
+    </div>
+  )
+}
+
+export function MemorySettings({
+  isPending,
+  memory,
+}: MemorySettingsProps) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <div className="rounded-xl border border-components-panel-border bg-components-panel-bg p-4 shadow-xs">
+      <div className="mb-4 flex items-start gap-3">
+        <div className="flex size-10 shrink-0 items-center justify-center rounded-xl border bg-state-accent-hover text-text-accent-light-mode-only">
+          <span aria-hidden className="i-ri-brain-line size-5" />
+        </div>
+        <div className="min-w-0">
+          <h2 className="system-xl-semibold text-text-primary">
+            {t('agentDetail.memorySettings.title')}
+          </h2>
+          <p className="mt-1 system-sm-regular text-text-tertiary">
+            {t('agentDetail.memorySettings.description')}
+          </p>
+        </div>
+      </div>
+
+      <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+        {memoryConfigFields.map(field => (
+          <MemoryConfigValue
+            key={field.key}
+            icon={field.icon}
+            isPending={isPending}
+            label={t(field.labelKey)}
+            value={memory?.[field.key]}
+          />
+        ))}
+      </div>
+
+      <div className="mt-4 flex flex-wrap items-center justify-between gap-3 border-t border-divider-subtle pt-4">
+        <div className="min-w-0 flex-1">
+          <div className="flex min-w-0 flex-wrap items-center gap-1.5 system-xs-regular text-text-tertiary">
+            <span>{t('agentDetail.memorySettings.export.title')}</span>
+            <span className="inline-flex items-center gap-1 rounded-[5px] bg-components-badge-bg-dimm px-1.5 py-0.5 system-2xs-medium-uppercase text-text-tertiary">
+              {t('agentDetail.memorySettings.export.soon')}
+            </span>
+          </div>
+          <p className="mt-0.5 system-2xs-regular text-text-tertiary">
+            {t('agentDetail.memorySettings.export.description')}
+          </p>
+        </div>
+        <Button
+          variant="secondary"
+          size="small"
+          disabled
+          className="gap-1.5"
+        >
+          <span aria-hidden className="i-ri-download-line size-3.5" />
+          {t('agentDetail.memorySettings.export.download')}
+        </Button>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/model-config/field.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/model-config/field.tsx
new file mode 100644
index 00000000000..a8c7697930e
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/model-config/field.tsx
@@ -0,0 +1,54 @@
+'use client'
+
+import type { DefaultModel, Model } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import { useTranslation } from 'react-i18next'
+import ModelSelector from '@/app/components/header/account-setting/model-provider-page/model-selector'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
+
+type AgentModelFieldProps = {
+  currentModel?: DefaultModel
+  textGenerationModelList: Model[]
+  onSelect: (model: DefaultModel) => void
+}
+
+export function AgentModelField({
+  currentModel,
+  textGenerationModelList,
+  onSelect,
+}: AgentModelFieldProps) {
+  const { t } = useTranslation('agentV2')
+  const readOnly = useAgentOrchestrateReadOnly()
+
+  return (
+    <FieldRoot name="model" className="gap-1 pb-4">
+      <FieldLabel className="py-0 system-sm-semibold-uppercase! text-text-secondary">
+        {t('agentDetail.configure.model.label')}
+      </FieldLabel>
+      <div className="relative h-8 min-w-0">
+        {readOnly
+          ? (
+              <div className="flex h-8 w-full min-w-0 items-center rounded-lg bg-components-input-bg-disabled px-3 system-sm-regular text-components-input-text-filled">
+                <span className="truncate">{currentModel?.model}</span>
+              </div>
+            )
+          : (
+              <>
+                <ModelSelector
+                  defaultModel={currentModel}
+                  modelList={textGenerationModelList}
+                  triggerClassName="h-8! w-full rounded-lg! pr-10! [&_.i-ri-arrow-down-s-line]:hidden"
+                  popupClassName="w-(--anchor-width) max-w-[min(var(--anchor-width),var(--available-width),calc(100vw-32px))]"
+                  providerSettingsSource="agent"
+                  showModelMeta={false}
+                  onSelect={onSelect}
+                />
+                <div className="pointer-events-none absolute inset-y-0 right-0 flex w-8 items-center justify-center rounded-r-lg bg-components-button-tertiary-bg">
+                  <span aria-hidden="true" className="i-ri-equalizer-2-line size-4 text-text-tertiary" />
+                </div>
+              </>
+            )}
+      </div>
+    </FieldRoot>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/index.tsx
new file mode 100644
index 00000000000..8e0d8b66586
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/index.tsx
@@ -0,0 +1,425 @@
+'use client'
+
+import type { KeyboardEvent, MouseEvent, PointerEvent as ReactPointerEvent } from 'react'
+import type { SlashMenuCategory, SlashMenuView } from './slash'
+import type { RosterReferenceToken } from '@/app/components/base/prompt-editor/plugins/roster-reference-block/utils'
+import type { AgentTool } from '@/features/agent-v2/agent-composer/form-state'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Kbd } from '@langgenius/dify-ui/kbd'
+import { toast } from '@langgenius/dify-ui/toast'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
+import { useClipboard } from 'foxact/use-clipboard'
+import { useAtom, useAtomValue } from 'jotai'
+import { useCallback, useEffect, useRef, useState, useSyncExternalStore } from 'react'
+import { useTranslation } from 'react-i18next'
+import { Infotip } from '@/app/components/base/infotip'
+import PromptEditor from '@/app/components/base/prompt-editor'
+import BlockIcon from '@/app/components/workflow/block-icon'
+import { BlockEnum } from '@/app/components/workflow/types'
+import { agentComposerFilesAtom } from '@/features/agent-v2/agent-composer/store-modules/files'
+import { agentComposerKnowledgeRetrievalsAtom } from '@/features/agent-v2/agent-composer/store-modules/knowledge'
+import { agentComposerPromptAtom } from '@/features/agent-v2/agent-composer/store-modules/prompt'
+import { agentComposerSkillsAtom } from '@/features/agent-v2/agent-composer/store-modules/skills'
+import { agentComposerToolsAtom } from '@/features/agent-v2/agent-composer/store-modules/tools'
+import useTheme from '@/hooks/use-theme'
+import { Theme } from '@/types/app'
+import { useAgentOrchestrateAddActions } from '../add-actions-context'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
+import { replaceTrailingSlashWithToken } from './options'
+import { AgentPromptSlashMenu } from './slash'
+
+const subscribeHydrationState = () => () => {}
+
+const useIsHydrated = () => useSyncExternalStore(
+  subscribeHydrationState,
+  () => true,
+  () => false,
+)
+
+function AgentPromptPlaceholder({
+  insertLabel,
+  text,
+}: {
+  insertLabel: string
+  text: string
+}) {
+  return (
+    <span className="flex items-center gap-0.5 system-sm-regular whitespace-nowrap text-components-input-text-placeholder">
+      <span>{text}</span>
+      <Kbd className="text-text-placeholder">
+        /
+      </Kbd>
+      <span className="underline decoration-dotted underline-offset-2">
+        {insertLabel}
+      </span>
+    </span>
+  )
+}
+
+function getProviderToolFromToken(token: RosterReferenceToken, tools: AgentTool[]) {
+  if (token.kind !== 'tool' && token.kind !== 'tool-all')
+    return
+
+  return tools.find(tool =>
+    tool.kind === 'provider'
+    && (
+      token.id === `${tool.id}/*`
+      || tool.actions.some(action => token.id === `${tool.id}/${action.toolName}`)
+    ),
+  )
+}
+
+function AgentPromptRosterReferenceIcon({
+  token,
+  tools,
+}: {
+  token: RosterReferenceToken
+  tools: AgentTool[]
+}) {
+  const { theme } = useTheme()
+
+  if (token.kind === 'cli_tool') {
+    return (
+      <span
+        aria-hidden
+        className="i-ri-terminal-box-line size-3.5 shrink-0 text-text-primary-on-surface"
+      />
+    )
+  }
+
+  const providerTool = getProviderToolFromToken(token, tools)
+  if (!providerTool || providerTool.kind !== 'provider')
+    return null
+
+  const icon = theme === Theme.dark && providerTool.iconDark ? providerTool.iconDark : providerTool.icon
+
+  if (icon) {
+    return (
+      <BlockIcon
+        className="shrink-0"
+        type={BlockEnum.Tool}
+        size="xs"
+        toolIcon={icon}
+      />
+    )
+  }
+
+  return (
+    <span
+      aria-hidden
+      className={cn('size-3.5 shrink-0', providerTool.iconClassName)}
+    />
+  )
+}
+
+const getLastTextContent = (node: Node): string => {
+  if (node.nodeType === Node.TEXT_NODE)
+    return node.textContent ?? ''
+
+  const textParts: string[] = []
+  const walker = document.createTreeWalker(node, NodeFilter.SHOW_TEXT)
+  let current = walker.nextNode()
+  while (current) {
+    textParts.push(current.textContent ?? '')
+    current = walker.nextNode()
+  }
+
+  return textParts.join('')
+}
+
+const isSelectionAfterSlash = (rootElement: HTMLElement | null, fallbackValue: string) => {
+  if (!rootElement)
+    return fallbackValue.endsWith('/')
+
+  const selection = window.getSelection()
+  if (!selection || !selection.isCollapsed || selection.rangeCount === 0)
+    return fallbackValue.endsWith('/')
+
+  const anchorNode = selection.anchorNode
+  if (!anchorNode || !rootElement.contains(anchorNode))
+    return false
+
+  if (anchorNode.nodeType === Node.TEXT_NODE)
+    return (anchorNode.textContent ?? '').slice(0, selection.anchorOffset).endsWith('/')
+
+  const element = anchorNode as Element
+  const previousChild = element.childNodes.item(selection.anchorOffset - 1)
+  return previousChild ? getLastTextContent(previousChild).endsWith('/') : false
+}
+
+export function AgentPromptEditor() {
+  const { t } = useTranslation('agentV2')
+  const readOnly = useAgentOrchestrateReadOnly()
+  const [value, setValue] = useAtom(agentComposerPromptAtom)
+  const skills = useAtomValue(agentComposerSkillsAtom)
+  const files = useAtomValue(agentComposerFilesAtom)
+  const [tools, setTools] = useAtom(agentComposerToolsAtom)
+  const retrievals = useAtomValue(agentComposerKnowledgeRetrievalsAtom)
+  const addActions = useAgentOrchestrateAddActions()
+  const isHydrated = useIsHydrated()
+  const promptTip = t('agentDetail.configure.prompt.tip')
+  const promptPlaceholder = (
+    <AgentPromptPlaceholder
+      text={t('agentDetail.configure.prompt.placeholder')}
+      insertLabel={t('agentDetail.configure.prompt.insert.label').toLocaleLowerCase()}
+    />
+  )
+  const { copied, copy, reset } = useClipboard({
+    onCopyError: () => {
+      toast.error(t('agentDetail.configure.prompt.copyFailed'))
+    },
+  })
+  const [slashMenuView, setSlashMenuView] = useState<SlashMenuView>('main')
+  const [isSlashMenuOpen, setIsSlashMenuOpen] = useState(false)
+  const rootRef = useRef<HTMLDivElement>(null)
+  const editorRef = useRef<HTMLDivElement>(null)
+
+  const handleCopyPrompt = useCallback(() => {
+    void copy(value)
+  }, [copy, value])
+
+  const closeSlashMenu = () => {
+    setIsSlashMenuOpen(false)
+    setSlashMenuView('main')
+  }
+
+  const openSlashMenu = () => {
+    setSlashMenuView('main')
+    setIsSlashMenuOpen(true)
+  }
+
+  const syncSlashMenuWithSelection = useCallback(() => {
+    if (!isHydrated || readOnly)
+      return
+
+    if (isSelectionAfterSlash(editorRef.current, value))
+      openSlashMenu()
+    else
+      closeSlashMenu()
+  }, [isHydrated, readOnly, value])
+
+  const handleEditorKeyDown = (event: KeyboardEvent<HTMLDivElement>) => {
+    if (!isHydrated || readOnly)
+      return
+
+    if (event.key === 'Escape' && isSlashMenuOpen) {
+      event.preventDefault()
+      closeSlashMenu()
+      return
+    }
+
+    if (event.key !== '/' || event.metaKey || event.ctrlKey || event.altKey)
+      return
+
+    openSlashMenu()
+  }
+
+  const handleEditorKeyUp = () => {
+    window.requestAnimationFrame(syncSlashMenuWithSelection)
+  }
+
+  const handleEditorPointerUp = (event: ReactPointerEvent<HTMLDivElement>) => {
+    const target = event.target
+    if (
+      target instanceof Element
+      && target.closest('[data-agent-prompt-toolbar]')
+    ) {
+      return
+    }
+
+    window.requestAnimationFrame(syncSlashMenuWithSelection)
+  }
+
+  const handleRootPointerDown = (event: MouseEvent<HTMLDivElement>) => {
+    const target = event.target
+    if (!(target instanceof Node))
+      return
+
+    if (editorRef.current?.contains(target))
+      return
+
+    if (
+      target instanceof Element
+      && (
+        target.closest('[data-agent-prompt-slash-menu]')
+        || target.closest('[data-agent-prompt-toolbar]')
+      )
+    ) {
+      return
+    }
+
+    closeSlashMenu()
+  }
+
+  const handleSlashSelect = (token: string) => {
+    setValue(replaceTrailingSlashWithToken(value, token))
+    closeSlashMenu()
+  }
+
+  const handleInsertSlash = () => {
+    setValue(`${value}/`)
+    openSlashMenu()
+  }
+
+  const renderRosterReferenceIcon = useCallback((token: RosterReferenceToken) => {
+    if (token.kind !== 'tool' && token.kind !== 'tool-all' && token.kind !== 'cli_tool')
+      return null
+
+    return <AgentPromptRosterReferenceIcon token={token} tools={tools} />
+  }, [tools])
+
+  useEffect(() => {
+    if (!isSlashMenuOpen)
+      return
+
+    const handlePointerDown = (event: PointerEvent) => {
+      const target = event.target
+      if (!(target instanceof Node))
+        return
+
+      if (!rootRef.current?.contains(target))
+        closeSlashMenu()
+    }
+
+    document.addEventListener('pointerdown', handlePointerDown)
+    return () => {
+      document.removeEventListener('pointerdown', handlePointerDown)
+    }
+  }, [isSlashMenuOpen])
+
+  const slashMenuCategories: SlashMenuCategory[] = [
+    {
+      key: 'skills',
+      label: t('agentDetail.configure.skills.label'),
+      icon: 'i-ri-box-3-line',
+    },
+    {
+      key: 'files',
+      label: t('agentDetail.configure.files.label'),
+      icon: 'i-ri-file-line',
+    },
+    {
+      key: 'tools',
+      label: t('agentDetail.configure.tools.label'),
+      icon: 'i-ri-box-3-line',
+    },
+    {
+      key: 'knowledge',
+      label: t('agentDetail.configure.knowledgeRetrieval.label'),
+      icon: 'i-ri-book-open-line',
+    },
+  ]
+
+  return (
+    <section className="flex flex-col gap-1 px-0 py-0" aria-labelledby="agent-configure-prompt-label">
+      <div className="flex items-center gap-2">
+        <div className="flex min-h-6 min-w-0 flex-1 items-center gap-0.5">
+          <h3
+            id="agent-configure-prompt-label"
+            className="truncate system-sm-semibold-uppercase text-text-secondary"
+          >
+            {t('agentDetail.configure.prompt.label')}
+          </h3>
+          <Infotip aria-label={promptTip} popupClassName="max-w-64">
+            {promptTip}
+          </Infotip>
+        </div>
+        <Tooltip>
+          <TooltipTrigger
+            render={(
+              <button
+                type="button"
+                aria-label={copied ? t('agentDetail.configure.prompt.copied') : t('agentDetail.configure.prompt.copy')}
+                className="flex size-6 shrink-0 items-center justify-center rounded-md p-0.5 text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+                onClick={handleCopyPrompt}
+                onMouseLeave={reset}
+              >
+                <span aria-hidden className={copied ? 'i-ri-check-line size-4' : 'i-ri-clipboard-line size-4'} />
+              </button>
+            )}
+          />
+          <TooltipContent>
+            {copied ? t('agentDetail.configure.prompt.copied') : t('agentDetail.configure.prompt.copy')}
+          </TooltipContent>
+        </Tooltip>
+      </div>
+
+      <div
+        ref={rootRef}
+        className="relative"
+        onPointerDownCapture={handleRootPointerDown}
+      >
+        <div
+          className="group min-h-28 overflow-hidden rounded-[10px] border-[1.5px] border-transparent bg-components-input-bg-normal pt-1 focus-within:border-components-input-border-active-prompt-1 focus-within:bg-components-input-bg-active focus-within:shadow-xs focus-within:shadow-shadow-shadow-3"
+          onKeyDownCapture={handleEditorKeyDown}
+          onKeyUpCapture={handleEditorKeyUp}
+          onPointerUpCapture={handleEditorPointerUp}
+        >
+          <div ref={editorRef} className="min-h-[104px] overflow-y-auto px-3 pt-0.5">
+            <PromptEditor
+              instanceId="agent-configure-prompt-editor"
+              compact
+              wrapperClassName="min-h-[104px]"
+              className="min-h-[104px] text-text-primary"
+              placeholder={promptPlaceholder}
+              placeholderClassName="top-0!"
+              editable={!readOnly}
+              value={value}
+              onChange={setValue}
+              variableBlock={{
+                show: true,
+              }}
+              rosterReferenceBlock={{
+                show: true,
+                renderIcon: renderRosterReferenceIcon,
+              }}
+              disableSlashPicker
+              disableBracePicker
+            />
+          </div>
+          {!readOnly && (
+            <div
+              data-agent-prompt-toolbar
+              className="flex h-8 shrink-0 items-center justify-between px-3 text-text-tertiary opacity-0 transition-opacity group-focus-within:opacity-100"
+            >
+              <div className="flex min-w-0 items-center gap-3">
+                <button
+                  type="button"
+                  className="flex items-center gap-1 system-xs-medium hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+                  onClick={handleInsertSlash}
+                >
+                  <span aria-hidden className="i-ri-slash-commands-2 size-3.5" />
+                  {t('agentDetail.configure.prompt.insert.label')}
+                </button>
+              </div>
+              <div className="rounded-sm border border-divider-regular bg-background-default px-1 system-2xs-regular text-text-tertiary">
+                {value.length}
+              </div>
+            </div>
+          )}
+        </div>
+
+        {isHydrated && !readOnly && isSlashMenuOpen && (
+          <div data-agent-prompt-slash-menu className="absolute top-9 left-3 z-50">
+            <AgentPromptSlashMenu
+              view={slashMenuView}
+              categories={slashMenuCategories}
+              skills={skills}
+              files={files}
+              tools={tools}
+              onToolsChange={setTools}
+              onAddCliTool={addActions.cli}
+              onAddFile={addActions.files}
+              onAddKnowledge={addActions.knowledge}
+              onAddSkill={addActions.skills}
+              retrievals={retrievals}
+              onBack={() => setSlashMenuView('main')}
+              onOpenCategory={setSlashMenuView}
+              onSelect={handleSlashSelect}
+            />
+          </div>
+        )}
+      </div>
+    </section>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/option-menu.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/option-menu.tsx
new file mode 100644
index 00000000000..d352b86ff7e
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/option-menu.tsx
@@ -0,0 +1,59 @@
+'use client'
+
+import type { InsertOption } from './options'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { useTranslation } from 'react-i18next'
+
+type AgentPromptOptionMenuProps = {
+  label: string
+  icon: string
+  options: InsertOption[]
+  onInsert: (token: string) => void
+}
+
+export function AgentPromptOptionMenu({
+  label,
+  icon,
+  options,
+  onInsert,
+}: AgentPromptOptionMenuProps) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger
+        render={(
+          <button
+            type="button"
+            className="flex h-6 shrink-0 items-center gap-1 rounded-md px-1.5 py-1 text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className={`${icon} size-3.5`} />
+            <span className="system-xs-medium">{label}</span>
+          </button>
+        )}
+      />
+      <DropdownMenuContent
+        placement="bottom-start"
+        sideOffset={4}
+        popupClassName="w-60 p-1"
+      >
+        {options.map(option => (
+          <DropdownMenuItem
+            key={option.key}
+            className="gap-2"
+            onClick={() => onInsert(option.token)}
+          >
+            <span aria-hidden className={`${option.icon} size-4 text-text-tertiary`} />
+            <span className="min-w-0 flex-1 truncate">{t(option.labelKey)}</span>
+            <span className="code-xs-regular text-text-quaternary">{option.token}</span>
+          </DropdownMenuItem>
+        ))}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/options.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/options.ts
new file mode 100644
index 00000000000..bc4e0631f2f
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/options.ts
@@ -0,0 +1,83 @@
+/**
+ * @public
+ */
+// TODO: Remove this marker after prompt option menus are wired.
+export type AgentPromptOptionLabelKey
+  = | 'agentDetail.configure.prompt.insert.tenders'
+    | 'agentDetail.configure.prompt.insert.question'
+    | 'agentDetail.configure.prompt.insert.reportFile'
+    | 'agentDetail.configure.prompt.mention.davidHayes'
+    | 'agentDetail.configure.prompt.mention.priyaRamanathan'
+
+/**
+ * @public
+ */
+// TODO: Remove this marker after prompt option menus are wired.
+export type InsertOption = {
+  key: string
+  labelKey: AgentPromptOptionLabelKey
+  token: string
+  icon: string
+}
+
+/**
+ * @public
+ */
+// TODO: Remove this marker after prompt option menus are wired.
+export const insertOptions: InsertOption[] = [
+  {
+    key: 'tenders',
+    labelKey: 'agentDetail.configure.prompt.insert.tenders',
+    token: '{{tenders}}',
+    icon: 'i-ri-home-4-line',
+  },
+  {
+    key: 'question',
+    labelKey: 'agentDetail.configure.prompt.insert.question',
+    token: '{{question}}',
+    icon: 'i-ri-question-answer-line',
+  },
+  {
+    key: 'reportFile',
+    labelKey: 'agentDetail.configure.prompt.insert.reportFile',
+    token: '{{qna_report_pdf}}',
+    icon: 'i-ri-file-pdf-2-line',
+  },
+]
+
+/**
+ * @public
+ */
+// TODO: Remove this marker after prompt option menus are wired.
+export const mentionOptions: InsertOption[] = [
+  {
+    key: 'davidHayes',
+    labelKey: 'agentDetail.configure.prompt.mention.davidHayes',
+    token: '{{DavidHayes}}',
+    icon: 'i-ri-user-line',
+  },
+  {
+    key: 'priyaRamanathan',
+    labelKey: 'agentDetail.configure.prompt.mention.priyaRamanathan',
+    token: '{{PriyaRamanathan}}',
+    icon: 'i-ri-user-line',
+  },
+]
+
+const appendToken = (value: string, token: string) => {
+  if (!value)
+    return token
+
+  return `${value}${value.endsWith(' ') || value.endsWith('\n') ? '' : ' '}${token}`
+}
+
+export const replaceTrailingSlashWithToken = (value: string, token: string) => {
+  if (!value.endsWith('/'))
+    return appendToken(value, token)
+
+  const valueWithoutSlash = value.slice(0, -1)
+  if (!valueWithoutSlash)
+    return token
+
+  return `${valueWithoutSlash}${valueWithoutSlash.endsWith(' ') || valueWithoutSlash.endsWith('\n') ? '' : ' '}${token}`
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/slash.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/slash.tsx
new file mode 100644
index 00000000000..449ae6f7288
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/slash.tsx
@@ -0,0 +1,695 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { AgentOrchestrateAddAction, AgentOrchestrateAddedItem } from '../add-actions-context'
+import type { AgentProviderToolDefaultValue } from '../tools/types'
+import type { Tool } from '@/app/components/tools/types'
+import type { ToolTypeEnum, ToolValue } from '@/app/components/workflow/block-selector/types'
+import type { ToolWithProvider } from '@/app/components/workflow/types'
+import type { AgentFileNode, AgentKnowledgeRetrievalItem, AgentSkill, AgentTool } from '@/features/agent-v2/agent-composer/form-state'
+import { cn } from '@langgenius/dify-ui/cn'
+import { FileTreeIcon } from '@langgenius/dify-ui/file-tree'
+import { useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { getMarketplaceCategoryUrl } from '@/app/components/plugins/marketplace/utils'
+import { PluginCategoryEnum } from '@/app/components/plugins/types'
+import { CollectionType } from '@/app/components/tools/types'
+import { ToolTypeEnum as ToolTabEnum } from '@/app/components/workflow/block-selector/types'
+import { useGetLanguage } from '@/context/i18n'
+import {
+  useAllBuiltInTools,
+  useAllCustomTools,
+  useAllMCPTools,
+  useAllWorkflowTools,
+} from '@/service/use-tools'
+import { addProviderTools } from '../tools/hooks'
+
+export type SlashMenuView = 'main' | 'skills' | 'files' | 'tools' | 'knowledge'
+
+export type SlashMenuCategory = {
+  key: Exclude<SlashMenuView, 'main'>
+  label: string
+  icon: string
+}
+
+type AgentPromptSlashMenuProps = {
+  view: SlashMenuView
+  categories: SlashMenuCategory[]
+  skills: AgentSkill[]
+  files: AgentFileNode[]
+  tools: AgentTool[]
+  onToolsChange: (tools: AgentTool[]) => void
+  onAddCliTool?: AgentOrchestrateAddAction
+  onAddFile?: AgentOrchestrateAddAction
+  onAddKnowledge?: AgentOrchestrateAddAction
+  onAddSkill?: AgentOrchestrateAddAction
+  retrievals: AgentKnowledgeRetrievalItem[]
+  onBack: () => void
+  onOpenCategory: (view: Exclude<SlashMenuView, 'main'>) => void
+  onSelect: (token: string) => void
+}
+
+const createReferenceToken = (kind: string, id: string, label?: string) => (
+  `[§${kind}:${id}${label ? `:${label}` : ''}§]`
+)
+
+const isPromptReferenceItem = (item: AgentOrchestrateAddedItem): item is AgentFileNode | AgentSkill => (
+  'id' in item && 'name' in item
+)
+
+const isCliToolItem = (item: AgentOrchestrateAddedItem): item is Extract<AgentTool, { kind: 'cli' }> => (
+  'kind' in item && item.kind === 'cli'
+)
+
+const isKnowledgeRetrievalItem = (item: AgentOrchestrateAddedItem): item is AgentKnowledgeRetrievalItem => (
+  'queryMode' in item || 'customQuery' in item || 'selectedDatasets' in item || 'nameKey' in item
+)
+
+export function AgentPromptSlashMenu({
+  view,
+  categories,
+  skills,
+  files,
+  tools,
+  onToolsChange,
+  onAddCliTool,
+  onAddFile,
+  onAddKnowledge,
+  onAddSkill,
+  retrievals,
+  onBack,
+  onOpenCategory,
+  onSelect,
+}: AgentPromptSlashMenuProps) {
+  const { t } = useTranslation('agentV2')
+  const title = categories.find(category => category.key === view)?.label
+  const handleAddFromFooter = () => {
+    if (view === 'skills') {
+      onAddSkill?.({
+        onAdded: (item) => {
+          if (isPromptReferenceItem(item))
+            onSelect(createReferenceToken('skill', item.id, item.name))
+        },
+      })
+      return
+    }
+
+    if (view === 'files') {
+      onAddFile?.({
+        onAdded: (item) => {
+          if (isPromptReferenceItem(item))
+            onSelect(createReferenceToken('file', item.id, item.name))
+        },
+      })
+      return
+    }
+
+    if (view === 'knowledge') {
+      onAddKnowledge?.({
+        onAdded: (item) => {
+          if (isKnowledgeRetrievalItem(item))
+            onSelect(createReferenceToken('knowledge', item.id, getKnowledgeRetrievalName(item, t)))
+        },
+      })
+    }
+  }
+
+  if (view === 'main') {
+    return (
+      <AgentPromptSlashPanel className="w-[200px]">
+        <div className="flex flex-col gap-px p-1">
+          {categories.map(category => (
+            <button
+              key={category.key}
+              type="button"
+              className="flex h-6 w-full items-center gap-1 rounded-md pr-2 pl-3 text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+              onClick={() => onOpenCategory(category.key)}
+            >
+              <span aria-hidden className={`${category.icon} size-4 shrink-0 text-text-secondary`} />
+              <span className="min-w-0 flex-1 truncate system-sm-regular text-text-secondary">{category.label}</span>
+              <span aria-hidden className="i-ri-arrow-right-s-line size-3.5 shrink-0 text-text-tertiary" />
+            </button>
+          ))}
+        </div>
+      </AgentPromptSlashPanel>
+    )
+  }
+
+  return (
+    <AgentPromptSlashPanel className="w-[360px]">
+      <div className="flex flex-col p-1">
+        <button
+          type="button"
+          className="flex h-6 w-full items-center gap-1 rounded-md pr-2 pl-3 text-left text-text-tertiary hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+          onClick={onBack}
+        >
+          <span aria-hidden className="i-ri-arrow-left-line size-4 shrink-0" />
+          <span className="min-w-0 flex-1 truncate system-xs-medium-uppercase">{title}</span>
+        </button>
+        {view === 'skills' && (
+          <AgentPromptSkillRows skills={skills} onSelect={onSelect} />
+        )}
+        {view === 'files' && (
+          <AgentPromptFileRows files={files} onSelect={onSelect} />
+        )}
+        {view === 'tools' && (
+          <AgentPromptToolRows
+            configuredTools={tools}
+            onConfiguredToolsChange={onToolsChange}
+            onSelect={onSelect}
+          />
+        )}
+        {view === 'knowledge' && (
+          <AgentPromptKnowledgeRows retrievals={retrievals} onSelect={onSelect} />
+        )}
+      </div>
+      {view === 'tools'
+        ? (
+            <AgentPromptToolFooter
+              onAddCliTool={() => {
+                onAddCliTool?.({
+                  onAdded: (item) => {
+                    if (isCliToolItem(item))
+                      onSelect(createReferenceToken('cli_tool', item.id, item.name))
+                  },
+                })
+              }}
+            />
+          )
+        : (
+            <div className="border-t border-divider-subtle p-1">
+              <button
+                type="button"
+                className="flex h-6 w-full items-center gap-1 rounded-md pr-2 pl-3 text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+                onClick={handleAddFromFooter}
+              >
+                <span aria-hidden className="i-ri-add-line size-4 shrink-0 text-text-secondary" />
+                <span className="system-sm-regular text-text-secondary">
+                  {view === 'skills' && t('agentDetail.configure.skills.add')}
+                  {view === 'files' && t('agentDetail.configure.files.add')}
+                  {view === 'knowledge' && t('agentDetail.configure.knowledgeRetrieval.add')}
+                </span>
+              </button>
+            </div>
+          )}
+    </AgentPromptSlashPanel>
+  )
+}
+
+function AgentPromptSlashPanel({
+  className,
+  children,
+}: {
+  className: string
+  children: ReactNode
+}) {
+  return (
+    <div className={`${className} isolate overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg backdrop-blur-[5px]`}>
+      {children}
+    </div>
+  )
+}
+
+function AgentPromptSkillRows({
+  skills,
+  onSelect,
+}: {
+  skills: AgentSkill[]
+  onSelect: (token: string) => void
+}) {
+  return (
+    <>
+      {skills.map(skill => (
+        <AgentPromptSubmenuRow
+          key={skill.id}
+          icon="i-ri-box-3-line"
+          label={skill.name}
+          onClick={() => onSelect(createReferenceToken('skill', skill.id, skill.name))}
+        />
+      ))}
+    </>
+  )
+}
+
+function AgentPromptFileRows({
+  files,
+  depth = 0,
+  onSelect,
+}: {
+  files: AgentFileNode[]
+  depth?: number
+  onSelect: (token: string) => void
+}) {
+  return (
+    <>
+      {files.map(file => (
+        <div key={file.id}>
+          <AgentPromptSubmenuRow
+            icon={<FileTreeIcon type={file.children?.length ? 'folder' : file.icon} />}
+            label={file.name}
+            depth={depth}
+            hasChildren={!!file.children?.length}
+            onClick={() => onSelect(createReferenceToken('file', file.id, file.name))}
+          />
+          {!!file.children?.length && (
+            <AgentPromptFileRows files={file.children} depth={depth + 1} onSelect={onSelect} />
+          )}
+        </div>
+      ))}
+    </>
+  )
+}
+
+function AgentPromptToolRows({
+  configuredTools,
+  onConfiguredToolsChange,
+  onSelect,
+}: {
+  configuredTools: AgentTool[]
+  onConfiguredToolsChange: (tools: AgentTool[]) => void
+  onSelect: (token: string) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const language = useGetLanguage()
+  const [activeTab, setActiveTab] = useState<ToolPromptTab>('all')
+  const [expandedProviderIds, setExpandedProviderIds] = useState<Set<string>>(() => new Set())
+  const { data: builtInTools = [] } = useAllBuiltInTools()
+  const { data: customTools = [] } = useAllCustomTools()
+  const { data: workflowTools = [] } = useAllWorkflowTools()
+  const { data: mcpTools = [] } = useAllMCPTools()
+  const configuredCliTools = configuredTools.filter(tool => tool.kind === 'cli')
+  const availableProviders = useMemo(() => {
+    if (activeTab === 'all')
+      return [...builtInTools, ...workflowTools, ...customTools, ...mcpTools]
+    if (activeTab === ToolTabEnum.BuiltIn)
+      return builtInTools
+    if (activeTab === ToolTabEnum.Workflow)
+      return workflowTools
+    if (activeTab === ToolTabEnum.Custom)
+      return customTools
+    if (activeTab === ToolTabEnum.MCP)
+      return mcpTools
+
+    return []
+  }, [activeTab, builtInTools, customTools, mcpTools, workflowTools])
+
+  const selectedTools = useMemo(() => configuredTools.flatMap(toSelectedToolValue), [configuredTools])
+  const tabs = [
+    { key: 'all' as const, label: t('agentDetail.configure.tools.toolTabs.all') },
+    { key: ToolTabEnum.BuiltIn, label: t('agentDetail.configure.tools.toolTabs.plugins') },
+    { key: ToolTabEnum.Workflow, label: t('agentDetail.configure.tools.toolTabs.workflow') },
+    { key: ToolTabEnum.Custom, label: t('agentDetail.configure.tools.toolTabs.custom') },
+    { key: ToolTabEnum.MCP, label: t('agentDetail.configure.tools.toolTabs.mcp') },
+    { key: 'cli' as const, label: t('agentDetail.configure.tools.toolTabs.cli') },
+  ]
+
+  const selectTools = (tools: AgentProviderToolDefaultValue[]) => {
+    onConfiguredToolsChange(addProviderTools(configuredTools, tools))
+  }
+
+  const toggleProvider = (providerId: string) => {
+    setExpandedProviderIds((currentIds) => {
+      const nextIds = new Set(currentIds)
+      if (nextIds.has(providerId))
+        nextIds.delete(providerId)
+      else
+        nextIds.add(providerId)
+
+      return nextIds
+    })
+  }
+
+  const handleSelectProvider = (provider: ToolWithProvider) => {
+    selectTools(provider.tools.map(tool => toToolDefaultValue(provider, tool, language)))
+    onSelect(createReferenceToken('tool', `${provider.id}/*`, getProviderLabel(provider, language)))
+  }
+
+  const handleSelectTool = (provider: ToolWithProvider, tool: Tool) => {
+    const selectedTool = toToolDefaultValue(provider, tool, language)
+    selectTools([selectedTool])
+    onSelect(createReferenceToken('tool', `${provider.id}/${tool.name}`, selectedTool.tool_label))
+  }
+
+  return (
+    <div>
+      <div className="flex gap-1 px-2 py-1">
+        {tabs.map(tab => (
+          <button
+            key={tab.key}
+            type="button"
+            className={cn(
+              'flex h-6 shrink-0 items-center rounded-md px-2 system-xs-medium text-text-tertiary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+              activeTab === tab.key && 'bg-state-base-active system-xs-semibold text-text-primary',
+            )}
+            onClick={() => setActiveTab(tab.key)}
+          >
+            {tab.label}
+          </button>
+        ))}
+      </div>
+      <div className="max-h-[464px] overflow-y-auto px-1 pb-1">
+        {activeTab === 'cli'
+          ? configuredCliTools.map(tool => (
+              <AgentPromptCliToolRow
+                key={tool.id}
+                tool={tool}
+                onClick={() => onSelect(createReferenceToken('cli_tool', tool.id, tool.name))}
+              />
+            ))
+          : availableProviders.filter(provider => provider.tools.length > 0).map(provider => (
+              <div key={provider.id}>
+                <AgentPromptProviderToolRow
+                  provider={provider}
+                  typeLabel={getProviderTypeLabel(provider, t)}
+                  selectedTools={selectedTools}
+                  language={language}
+                  isExpanded={expandedProviderIds.has(provider.id)}
+                  onClick={() => handleSelectProvider(provider)}
+                  onToggle={() => toggleProvider(provider.id)}
+                />
+                {expandedProviderIds.has(provider.id) && provider.tools.map(tool => (
+                  <AgentPromptProviderToolActionRow
+                    key={tool.name}
+                    provider={provider}
+                    tool={tool}
+                    language={language}
+                    selectedTools={selectedTools}
+                    onClick={() => handleSelectTool(provider, tool)}
+                  />
+                ))}
+              </div>
+            ))}
+      </div>
+    </div>
+  )
+}
+
+type ToolPromptTab = ToolTypeEnum | 'all' | 'cli'
+
+function getLocalizedText(text: Record<string, string> | undefined | null, language: string) {
+  if (!text)
+    return ''
+
+  return text[language]
+    ?? text['en-US']
+    ?? text.en_US
+    ?? text.zh_Hans
+    ?? Object.values(text).find(Boolean)
+    ?? ''
+}
+
+function toSelectedToolValue(tool: AgentTool): ToolValue[] {
+  if (tool.kind !== 'provider')
+    return []
+
+  return tool.actions.map(action => ({
+    provider_name: tool.id,
+    tool_name: action.toolName,
+    tool_label: action.name,
+    tool_description: action.description,
+  }))
+}
+
+function toToolDefaultValue(
+  provider: ToolWithProvider,
+  tool: Tool,
+  language: string,
+): AgentProviderToolDefaultValue {
+  const params: Record<string, string> = {}
+  tool.parameters?.forEach((parameter) => {
+    params[parameter.name] = ''
+  })
+
+  const label = getLocalizedText(tool.label, language) || tool.name
+  const description = getLocalizedText(tool.description, language)
+  const providerLabel = getLocalizedText(provider.label, language) || provider.name
+
+  return {
+    provider_id: provider.id,
+    provider_type: provider.type,
+    provider_name: provider.name,
+    provider_show_name: providerLabel,
+    plugin_id: provider.plugin_id,
+    plugin_unique_identifier: provider.plugin_unique_identifier,
+    provider_icon: provider.icon,
+    provider_icon_dark: provider.icon_dark,
+    tool_name: tool.name,
+    tool_label: label,
+    tool_description: description,
+    title: label,
+    allowDelete: provider.allow_delete,
+    is_team_authorization: provider.is_team_authorization,
+    paramSchemas: tool.parameters,
+    params,
+    output_schema: tool.output_schema,
+    meta: provider.meta,
+  }
+}
+
+function isToolSelected(selectedTools: ToolValue[], provider: ToolWithProvider, tool: Tool) {
+  return selectedTools.some(selectedTool =>
+    (selectedTool.provider_name === provider.name || selectedTool.provider_name === provider.id)
+    && selectedTool.tool_name === tool.name,
+  )
+}
+
+function getProviderLabel(provider: ToolWithProvider, language: string) {
+  return getLocalizedText(provider.label, language) || provider.name
+}
+
+function getProviderTypeLabel(
+  provider: ToolWithProvider,
+  t: ReturnType<typeof useTranslation>['t'],
+) {
+  if (provider.type === CollectionType.workflow)
+    return t('agentDetail.configure.tools.toolTabs.workflow')
+  if (provider.type === CollectionType.custom)
+    return t('agentDetail.configure.tools.toolTabs.custom')
+  if (provider.type === CollectionType.mcp)
+    return t('agentDetail.configure.tools.toolTabs.mcp')
+
+  return t('agentDetail.configure.tools.toolTabs.plugins')
+}
+
+function AgentPromptProviderToolRow({
+  provider,
+  typeLabel,
+  selectedTools,
+  language,
+  isExpanded,
+  onClick,
+  onToggle,
+}: {
+  provider: ToolWithProvider
+  typeLabel: string
+  selectedTools: ToolValue[]
+  language: string
+  isExpanded: boolean
+  onClick: () => void
+  onToggle: () => void
+}) {
+  const selectedToolsCount = provider.tools.filter(tool => isToolSelected(selectedTools, provider, tool)).length
+  const providerLabel = getProviderLabel(provider, language)
+
+  return (
+    <div className="flex h-7 w-full items-center gap-px overflow-hidden rounded-md">
+      <button
+        type="button"
+        className="flex min-w-0 flex-1 items-center gap-1.5 rounded-l-md py-1 pr-1 pl-2 text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+        onClick={onClick}
+      >
+        <span className="flex size-5 shrink-0 items-center justify-center overflow-hidden rounded-md border-[0.5px] border-effects-icon-border bg-background-default-dodge">
+          <AgentPromptProviderIcon provider={provider} />
+        </span>
+        <span className="min-w-0 flex-1 truncate system-sm-regular text-text-secondary">{providerLabel}</span>
+        {selectedToolsCount > 0 && selectedToolsCount < provider.tools.length && (
+          <span className="shrink-0 rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary">
+            {selectedToolsCount}
+          </span>
+        )}
+        <span className="shrink-0 system-xs-regular text-text-quaternary">{typeLabel}</span>
+      </button>
+      <button
+        type="button"
+        aria-label={providerLabel}
+        className="flex size-7 shrink-0 items-center justify-center rounded-r-md text-text-tertiary hover:bg-state-base-hover-subtle focus-visible:bg-state-base-hover-subtle focus-visible:outline-hidden"
+        onClick={onToggle}
+      >
+        <span aria-hidden className={`${isExpanded ? 'i-ri-arrow-down-s-line' : 'i-ri-arrow-right-s-line'} size-4`} />
+      </button>
+    </div>
+  )
+}
+
+function AgentPromptProviderIcon({
+  provider,
+}: {
+  provider: ToolWithProvider
+}) {
+  if (typeof provider.icon === 'string') {
+    return provider.icon.startsWith('/') || provider.icon.startsWith('http')
+      ? <img src={provider.icon} alt="" className="size-full object-cover" />
+      : <span aria-hidden className="i-custom-public-other-default-tool-icon size-3.5 text-text-tertiary" />
+  }
+
+  return (
+    <span
+      aria-hidden
+      className="flex size-full items-center justify-center text-xs"
+      style={{ backgroundColor: provider.icon?.background }}
+    >
+      {provider.icon?.content}
+    </span>
+  )
+}
+
+function AgentPromptToolFooter({
+  onAddCliTool,
+}: {
+  onAddCliTool?: () => void
+}) {
+  const { t } = useTranslation()
+
+  return (
+    <div className="border-t border-divider-subtle p-1">
+      <a
+        href={getMarketplaceCategoryUrl(PluginCategoryEnum.tool)}
+        target="_blank"
+        rel="noreferrer"
+        className="flex h-7 w-full items-center gap-1.5 rounded-md px-2 text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+      >
+        <span aria-hidden className="i-ri-store-2-line size-4 shrink-0 text-text-secondary" />
+        <span className="system-sm-regular text-text-secondary">{t('findMoreInMarketplace', { ns: 'plugin' })}</span>
+      </a>
+      <button
+        type="button"
+        className="flex h-7 w-full items-center gap-1.5 rounded-md px-2 text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+        onClick={onAddCliTool}
+      >
+        <span aria-hidden className="i-ri-add-line size-4 shrink-0 text-text-secondary" />
+        <span className="system-sm-regular text-text-secondary">{t('agentDetail.configure.tools.cliDialog.title', { ns: 'agentV2' })}</span>
+      </button>
+    </div>
+  )
+}
+
+function AgentPromptProviderToolActionRow({
+  provider,
+  tool,
+  language,
+  selectedTools,
+  onClick,
+}: {
+  provider: ToolWithProvider
+  tool: Tool
+  language: string
+  selectedTools: ToolValue[]
+  onClick: () => void
+}) {
+  const selected = isToolSelected(selectedTools, provider, tool)
+
+  return (
+    <button
+      type="button"
+      className="flex h-6 w-full items-center gap-1 rounded-md text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+      onClick={onClick}
+    >
+      <span className="ml-4 h-full w-px shrink-0 bg-divider-subtle" />
+      <span className="flex min-w-0 flex-1 items-center gap-1 py-1 pr-2 pl-3">
+        <span className="min-w-0 flex-1 truncate system-sm-regular text-text-secondary">
+          {getLocalizedText(tool.label, language) || tool.name}
+        </span>
+        {selected && <span aria-hidden className="i-ri-check-line size-3.5 shrink-0 text-text-tertiary" />}
+      </span>
+    </button>
+  )
+}
+
+function AgentPromptCliToolRow({
+  tool,
+  onClick,
+}: {
+  tool: Extract<AgentTool, { kind: 'cli' }>
+  onClick: () => void
+}) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <button
+      type="button"
+      className="flex h-7 w-full items-center gap-1 rounded-md text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+      onClick={onClick}
+    >
+      <span className="flex min-w-0 flex-1 items-center gap-1.5 py-1 pr-8 pl-2">
+        <span className="flex size-5 shrink-0 items-center justify-center rounded-md border-[0.5px] border-effects-icon-border bg-background-default-dodge">
+          <span aria-hidden className="i-ri-terminal-box-line size-3.5 text-text-tertiary" />
+        </span>
+        <span className="min-w-0 flex-1 truncate system-sm-regular text-text-secondary">{tool.name}</span>
+        <span className="shrink-0 system-xs-regular text-text-quaternary">
+          {t('agentDetail.configure.tools.toolTabs.cli')}
+        </span>
+      </span>
+    </button>
+  )
+}
+
+function AgentPromptKnowledgeRows({
+  retrievals,
+  onSelect,
+}: {
+  retrievals: AgentKnowledgeRetrievalItem[]
+  onSelect: (token: string) => void
+}) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <>
+      {retrievals.map(retrieval => (
+        <AgentPromptSubmenuRow
+          key={retrieval.id}
+          icon="i-ri-book-open-line"
+          label={getKnowledgeRetrievalName(retrieval, t)}
+          onClick={() => onSelect(createReferenceToken('knowledge', retrieval.id, getKnowledgeRetrievalName(retrieval, t)))}
+        />
+      ))}
+    </>
+  )
+}
+
+function getKnowledgeRetrievalName(
+  retrieval: AgentKnowledgeRetrievalItem,
+  t: ReturnType<typeof useTranslation>['t'],
+) {
+  return retrieval.name ?? (retrieval.nameKey ? t(retrieval.nameKey) : retrieval.id)
+}
+
+function AgentPromptSubmenuRow({
+  icon,
+  label,
+  depth = 0,
+  hasChildren = false,
+  onClick,
+}: {
+  icon?: ReactNode
+  label: string
+  depth?: number
+  hasChildren?: boolean
+  onClick: () => void
+}) {
+  const indent = depth === 0 ? 'pl-3' : depth === 1 ? 'pl-8' : 'pl-12'
+
+  return (
+    <button
+      type="button"
+      className="flex h-6 w-full items-center gap-1 rounded-md text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:outline-hidden"
+      onClick={onClick}
+    >
+      <span className={`flex min-w-0 flex-1 items-center gap-1 ${indent} pr-2`}>
+        {typeof icon === 'string' && <span aria-hidden className={`${icon} size-4 shrink-0 text-text-secondary`} />}
+        {typeof icon !== 'string' && icon}
+        <span className="min-w-0 flex-1 truncate system-sm-regular text-text-secondary">{label}</span>
+      </span>
+      {hasChildren && <span aria-hidden className="mr-1.5 i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />}
+    </button>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/index.tsx
new file mode 100644
index 00000000000..8ab77ecda3f
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/index.tsx
@@ -0,0 +1,241 @@
+'use client'
+
+import type { AgentConfigSnapshotDetailResponse, AgentConfigSnapshotSummaryResponse, AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { RegisterableHotkey } from '@tanstack/react-hotkeys'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Kbd, KbdGroup } from '@langgenius/dify-ui/kbd'
+import { StatusDot } from '@langgenius/dify-ui/status-dot'
+import { formatForDisplay } from '@tanstack/react-hotkeys'
+import { useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useConfigPublishPayload, useHasAgentComposerUnpublishedChanges } from '@/features/agent-v2/agent-composer/store'
+import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
+import { AgentPublishImpactPopover } from './publish-impact-popover'
+
+const PUBLISH_AGENT_HOTKEY = 'Mod+Shift+P' satisfies RegisterableHotkey
+const PUBLISH_IMPACT_BAR_HIDE_DELAY = 160
+
+export type AgentConfigurePublishPayload = {
+  agent_id: string
+  config_snapshot: AgentSoulConfig
+}
+
+type AgentConfigurePublishState = 'draft' | 'publishing' | 'published' | 'unpublished'
+
+type AgentConfigurePublishBarProps = {
+  agentId: string
+  activeConfigIsPublished?: boolean
+  activeConfigSnapshot?: AgentConfigSnapshotSummaryResponse | null
+  agentSoulConfig?: AgentConfigSnapshotDetailResponse['config_snapshot']
+  agentName?: string | null
+  currentModel?: {
+    provider: string
+    model: string
+  }
+  draftSavedAt?: number
+  isPublishing?: boolean
+  onPublish?: (payload: AgentConfigurePublishPayload) => void | Promise<void>
+  onOpenVersions: () => void
+}
+
+function getPublishState({
+  activeConfigIsPublished,
+  activeConfigSnapshot,
+  isDirty,
+  isPublishing,
+}: {
+  activeConfigIsPublished?: boolean
+  activeConfigSnapshot?: AgentConfigSnapshotSummaryResponse | null
+  isDirty: boolean
+  isPublishing: boolean
+}): AgentConfigurePublishState {
+  if (isPublishing)
+    return 'publishing'
+
+  if (!activeConfigSnapshot)
+    return 'draft'
+
+  if (!activeConfigIsPublished || isDirty)
+    return 'unpublished'
+
+  return 'published'
+}
+
+function PublishShortcut() {
+  return (
+    <KbdGroup aria-hidden>
+      {PUBLISH_AGENT_HOTKEY.split('+').map(key => (
+        <Kbd key={key} color="white">{formatForDisplay(key)}</Kbd>
+      ))}
+    </KbdGroup>
+  )
+}
+
+export function AgentConfigurePublishBar({
+  agentId,
+  activeConfigIsPublished,
+  activeConfigSnapshot,
+  agentSoulConfig,
+  agentName,
+  currentModel,
+  draftSavedAt,
+  isPublishing = false,
+  onPublish,
+  onOpenVersions,
+}: AgentConfigurePublishBarProps) {
+  const { t } = useTranslation('agentV2')
+  const { formatTimeFromNow } = useFormatTimeFromNow()
+  const [shouldHidePublishBar, setShouldHidePublishBar] = useState(false)
+  const hidePublishBarTimerRef = useRef<ReturnType<typeof setTimeout> | undefined>(undefined)
+  const hasUnpublishedChanges = useHasAgentComposerUnpublishedChanges()
+  const publishPayload = useConfigPublishPayload({
+    agentId,
+    baseConfig: agentSoulConfig,
+    currentModel,
+  })
+  const publishState = getPublishState({
+    activeConfigIsPublished,
+    activeConfigSnapshot,
+    isDirty: hasUnpublishedChanges,
+    isPublishing,
+  })
+  const canPublish = publishState === 'draft' || publishState === 'unpublished'
+
+  const handleImpactPopoverOpenChange = (open: boolean) => {
+    if (hidePublishBarTimerRef.current)
+      clearTimeout(hidePublishBarTimerRef.current)
+
+    if (!open) {
+      setShouldHidePublishBar(false)
+      return
+    }
+
+    hidePublishBarTimerRef.current = setTimeout(() => {
+      setShouldHidePublishBar(true)
+    }, PUBLISH_IMPACT_BAR_HIDE_DELAY)
+  }
+
+  const handlePublish = () => {
+    if (!canPublish)
+      return
+
+    void onPublish?.(publishPayload)
+  }
+
+  useEffect(() => {
+    return () => {
+      if (hidePublishBarTimerRef.current)
+        clearTimeout(hidePublishBarTimerRef.current)
+    }
+  }, [])
+
+  const publishedMeta = activeConfigSnapshot?.created_at
+    ? t('agentDetail.configure.publishBar.publishedAt', {
+        time: formatTimeFromNow(activeConfigSnapshot.created_at * 1000),
+      })
+    : t('agentDetail.configure.publishBar.published')
+  const savedMeta = draftSavedAt
+    ? t('agentDetail.configure.publishBar.savedAt', {
+        time: formatTimeFromNow(draftSavedAt),
+      })
+    : t('agentDetail.configure.publishBar.saved')
+  const stateMeta = {
+    draft: {
+      actionIcon: null,
+      actionLabel: t('agentDetail.publish'),
+      dotStatus: 'disabled',
+      metaLabel: savedMeta,
+      showShortcut: true,
+      statusLabel: t('agentDetail.configure.publishBar.draft'),
+    },
+    publishing: {
+      actionIcon: 'i-ri-loader-2-line animate-spin motion-reduce:animate-none',
+      actionLabel: t('agentDetail.configure.publishBar.publishing'),
+      dotStatus: 'disabled',
+      metaLabel: savedMeta,
+      showShortcut: false,
+      statusLabel: t('agentDetail.configure.publishBar.draft'),
+    },
+    published: {
+      actionIcon: 'i-ri-check-line',
+      actionLabel: t('agentDetail.configure.publishBar.published'),
+      dotStatus: 'success',
+      metaLabel: publishedMeta,
+      showShortcut: false,
+      statusLabel: t('agentDetail.configure.publishBar.upToDate'),
+    },
+    unpublished: {
+      actionIcon: null,
+      actionLabel: t('agentDetail.configure.publishBar.publishUpdate'),
+      dotStatus: 'warning',
+      metaLabel: savedMeta,
+      showShortcut: true,
+      statusLabel: t('agentDetail.configure.publishBar.unpublishedChanges'),
+    },
+  } satisfies Record<AgentConfigurePublishState, {
+    actionIcon: string | null
+    actionLabel: string
+    dotStatus: 'disabled' | 'success' | 'warning'
+    metaLabel: string
+    showShortcut: boolean
+    statusLabel: string
+  }>
+  const currentStateMeta = stateMeta[publishState]
+
+  return (
+    <div className="flex h-16 shrink-0 items-center justify-center px-4 pt-2 pb-3">
+      <div
+        className={cn(
+          'flex max-w-full min-w-0 items-center gap-2 rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur p-2 shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]',
+          shouldHidePublishBar && 'pointer-events-none opacity-0',
+        )}
+        aria-hidden={shouldHidePublishBar}
+      >
+        <div className="flex min-w-0 items-center gap-1 px-2 system-xs-regular text-text-tertiary">
+          <span className="flex size-4 shrink-0 items-center justify-center">
+            <StatusDot size="small" status={currentStateMeta.dotStatus} />
+          </span>
+          <span className="shrink-0">{currentStateMeta.statusLabel}</span>
+          <span aria-hidden className="shrink-0">·</span>
+          <span className="min-w-0 truncate">
+            {currentStateMeta.metaLabel}
+          </span>
+        </div>
+        <button
+          type="button"
+          aria-label={t('agentDetail.configure.publishBar.versionHistory')}
+          className="flex size-8 shrink-0 items-center justify-center rounded-lg text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          onClick={onOpenVersions}
+        >
+          <span aria-hidden className="i-ri-history-line size-4" />
+        </button>
+        <AgentPublishImpactPopover
+          actionLabel={currentStateMeta.actionLabel}
+          actionShortcut={currentStateMeta.showShortcut ? <PublishShortcut /> : null}
+          hotkey={PUBLISH_AGENT_HOTKEY}
+          agentId={agentId}
+          agentName={agentName}
+          disabled={!canPublish}
+          onOpenChange={handleImpactPopoverOpenChange}
+          onPublish={handlePublish}
+          trigger={(
+            <Button
+              type="button"
+              variant="primary"
+              aria-disabled={!canPublish}
+              className="h-8 gap-1 rounded-lg px-3 aria-disabled:cursor-not-allowed"
+              onClick={handlePublish}
+            >
+              {currentStateMeta.actionIcon && (
+                <span aria-hidden className={cn('size-4 shrink-0', currentStateMeta.actionIcon)} />
+              )}
+              <span className="shrink-0">{currentStateMeta.actionLabel}</span>
+              {currentStateMeta.showShortcut && <PublishShortcut />}
+            </Button>
+          )}
+        />
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-popover.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-popover.tsx
new file mode 100644
index 00000000000..b4fa0896adf
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-popover.tsx
@@ -0,0 +1,203 @@
+'use client'
+
+import type { AgentIconType, AgentReferencingWorkflowResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { RegisterableHotkey } from '@tanstack/react-hotkeys'
+import type { MouseEvent, ReactElement, ReactNode } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
+import { useHotkey } from '@tanstack/react-hotkeys'
+import { useQuery } from '@tanstack/react-query'
+import { cloneElement, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import Link from '@/next/link'
+import { consoleQuery } from '@/service/client'
+
+type AgentPublishImpactPopoverProps = {
+  actionLabel: string
+  actionShortcut?: ReactNode
+  hotkey: RegisterableHotkey
+  agentId: string
+  agentName?: string | null
+  disabled?: boolean
+  trigger: ReactElement<{
+    onClick?: (event: MouseEvent<HTMLElement>) => void
+  }>
+  onOpenChange?: (open: boolean) => void
+  onPublish: () => void
+}
+
+const getWorkflowReferenceHref = (reference: AgentReferencingWorkflowResponse) => `/app/${reference.app_id}/workflow`
+
+export function AgentPublishImpactPopover({
+  actionLabel,
+  actionShortcut,
+  hotkey,
+  agentId,
+  agentName,
+  disabled = false,
+  trigger,
+  onOpenChange,
+  onPublish,
+}: AgentPublishImpactPopoverProps) {
+  const { t } = useTranslation('agentV2')
+  const [open, setOpen] = useState(false)
+  const [isCheckingReferences, setIsCheckingReferences] = useState(false)
+  const workflowReferencesQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.referencingWorkflows.get.queryOptions({
+      input: {
+        params: {
+          agent_id: agentId,
+        },
+      },
+    }),
+    enabled: false,
+  })
+  const publishedReferences = workflowReferencesQuery.data?.data ?? []
+
+  const updateOpen = (nextOpen: boolean) => {
+    setOpen(nextOpen)
+    onOpenChange?.(nextOpen)
+  }
+
+  const handlePublish = () => {
+    updateOpen(false)
+    onPublish()
+  }
+
+  const handlePublishRequest = async () => {
+    if (disabled || isCheckingReferences)
+      return
+
+    if (open) {
+      handlePublish()
+      return
+    }
+
+    setIsCheckingReferences(true)
+    try {
+      const result = await workflowReferencesQuery.refetch()
+      const references = result.data?.data ?? []
+      if (references.length > 0) {
+        updateOpen(true)
+        return
+      }
+
+      onPublish()
+    }
+    finally {
+      setIsCheckingReferences(false)
+    }
+  }
+
+  useHotkey(hotkey, (event) => {
+    event.preventDefault()
+    void handlePublishRequest()
+  }, {
+    enabled: !disabled,
+    ignoreInputs: false,
+  })
+
+  if (disabled)
+    return trigger
+
+  const triggerWithImpact = cloneElement(trigger, {
+    onClick: async (event: MouseEvent<HTMLElement>) => {
+      event.preventDefault()
+      await handlePublishRequest()
+    },
+  })
+
+  return (
+    <Popover open={open} onOpenChange={updateOpen}>
+      <PopoverTrigger
+        render={triggerWithImpact}
+      />
+      <PopoverContent
+        placement="top-end"
+        sideOffset={-32}
+        popupClassName="w-96 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur p-0 shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px] transition-[transform,scale,opacity] duration-150 ease-out data-starting-style:translate-y-5 data-ending-style:translate-y-5 motion-reduce:transition-none motion-reduce:data-starting-style:translate-y-0 motion-reduce:data-ending-style:translate-y-0"
+      >
+        <div className="flex flex-col gap-0">
+          <div className="flex flex-col gap-0.5 px-3 pt-3.5 pb-1">
+            <h2 className="px-1 system-xl-semibold text-text-primary">
+              {t('agentDetail.configure.publishImpact.title', {
+                action: actionLabel,
+                name: agentName || t('agentDetail.configure.publishImpact.fallbackAgentName'),
+              })}
+            </h2>
+            <p className="px-1 system-xs-regular text-text-warning">
+              {t('agentDetail.configure.publishImpact.descriptionPrefix')}
+              {' '}
+              <span className="system-xs-medium">
+                {t('agentDetail.configure.publishImpact.workflowCount', { count: publishedReferences.length })}
+              </span>
+              {t('agentDetail.configure.publishImpact.descriptionSuffix')}
+            </p>
+          </div>
+
+          <div className="flex w-full flex-col gap-1 px-4 py-2">
+            <div className="flex min-h-6 items-center system-sm-medium text-text-secondary">
+              {t('agentDetail.configure.publishImpact.affectedWorkflows')}
+            </div>
+            <div className="flex max-h-44 flex-col gap-px overflow-y-auto rounded-xl border border-components-panel-border p-1">
+              {publishedReferences.map(reference => (
+                <ReferenceLink key={`${reference.app_id}-${reference.workflow_id}`} reference={reference} />
+              ))}
+            </div>
+          </div>
+
+          <div className="flex justify-end gap-2 px-4 pt-2 pb-4">
+            <Button
+              type="button"
+              variant="secondary"
+              className="h-8 min-w-18 rounded-lg px-3"
+              onClick={() => updateOpen(false)}
+            >
+              {t('agentDetail.configure.publishImpact.cancel')}
+            </Button>
+            <Button
+              type="button"
+              variant="primary"
+              className="h-8 min-w-18 gap-1 rounded-lg px-3"
+              onClick={handlePublish}
+            >
+              <span className="shrink-0">{actionLabel}</span>
+              {actionShortcut}
+            </Button>
+          </div>
+        </div>
+      </PopoverContent>
+    </Popover>
+  )
+}
+
+function ReferenceLink({
+  reference,
+}: {
+  reference: AgentReferencingWorkflowResponse
+}) {
+  const imageUrl = (reference.app_icon_type === 'image' || reference.app_icon_type === 'link') ? reference.app_icon : undefined
+  const iconType = (imageUrl ? 'image' : reference.app_icon_type) as AgentIconType | null | undefined
+
+  return (
+    <Link
+      href={getWorkflowReferenceHref(reference)}
+      target="_blank"
+      rel="noopener noreferrer"
+      className="flex min-w-0 items-center gap-2 rounded-lg py-1 pr-2.5 pl-2 system-sm-regular text-text-secondary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+    >
+      <span aria-hidden className="shrink-0">
+        <AppIcon
+          size="tiny"
+          iconType={iconType}
+          icon={reference.app_icon ?? undefined}
+          background={reference.app_icon_background}
+          imageUrl={imageUrl}
+        />
+      </span>
+      <span className="min-w-0 flex-1 truncate">{reference.app_name}</span>
+      <span aria-hidden className="i-ri-external-link-line size-3 shrink-0 text-text-tertiary" />
+    </Link>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/read-only-context.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/read-only-context.ts
new file mode 100644
index 00000000000..fb62bd1a4a9
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/read-only-context.ts
@@ -0,0 +1,7 @@
+import { createContext, use } from 'react'
+
+export const AgentOrchestrateReadOnlyContext = createContext(false)
+
+export function useAgentOrchestrateReadOnly() {
+  return use(AgentOrchestrateReadOnlyContext)
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..c54d4c86d0f
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/__tests__/index.spec.tsx
@@ -0,0 +1,379 @@
+import { toast } from '@langgenius/dify-ui/toast'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { useAgentComposerConfigSnapshot } from '@/features/agent-v2/agent-composer/store'
+import { AgentOrchestrateReadOnlyContext } from '../../read-only-context'
+import { AgentSkills } from '../index'
+
+const mocks = vi.hoisted(() => ({
+  driveFilesQueryOptions: vi.fn(),
+  driveFileDownloadQueryOptions: vi.fn(),
+  driveFilePreviewQueryOptions: vi.fn(),
+  uploadSkillMutationOptions: vi.fn(),
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    success: vi.fn(),
+    error: vi.fn(),
+  },
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        drive: {
+          files: {
+            get: {
+              queryOptions: mocks.driveFilesQueryOptions,
+            },
+            download: {
+              get: {
+                queryOptions: mocks.driveFileDownloadQueryOptions,
+              },
+            },
+            preview: {
+              get: {
+                queryOptions: mocks.driveFilePreviewQueryOptions,
+              },
+            },
+          },
+        },
+        skills: {
+          upload: {
+            post: {
+              mutationOptions: mocks.uploadSkillMutationOptions,
+            },
+          },
+        },
+      },
+    },
+  },
+}))
+
+const agentSkillsDraft = {
+  ...defaultAgentSoulConfigFormState,
+  skills: [
+    {
+      id: 'tender-analyzer',
+      name: 'Tender Analyzer',
+      description: 'Extracts tender requirements and scoring criteria.',
+      files: ['__MACOSX/._hatch-pet', 'SKILL.md', 'schema.json'],
+      path: 'tender-analyzer',
+      skillMdKey: 'tender-analyzer/SKILL.md',
+    },
+    {
+      id: 'meeting-brief',
+      name: 'Meeting Brief',
+      path: 'meeting-brief',
+    },
+  ],
+} satisfies typeof defaultAgentSoulConfigFormState
+
+function renderAgentSkills() {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentComposerProvider initialDraft={agentSkillsDraft}>
+        <AgentSkills agentId="agent-1" />
+      </AgentComposerProvider>
+    </QueryClientProvider>,
+  )
+}
+
+function renderReadonlyAgentSkills() {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentComposerProvider initialDraft={agentSkillsDraft}>
+        <AgentOrchestrateReadOnlyContext value>
+          <AgentSkills agentId="agent-1" />
+        </AgentOrchestrateReadOnlyContext>
+      </AgentComposerProvider>
+    </QueryClientProvider>,
+  )
+}
+
+function ConfigSnapshotProbe() {
+  const configSnapshot = useAgentComposerConfigSnapshot({})
+
+  return (
+    <pre data-testid="config-snapshot-probe">
+      {JSON.stringify(configSnapshot.skills_files?.skills ?? [])}
+    </pre>
+  )
+}
+
+describe('AgentSkills', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.driveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-files', input],
+      queryFn: async () => ({
+        items: [
+          {
+            file_kind: 'file',
+            key: 'tender-analyzer/SKILL.md',
+          },
+          {
+            file_kind: 'file',
+            key: 'tender-analyzer/scripts/extract.py',
+          },
+        ],
+      }),
+    }))
+    mocks.driveFilePreviewQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-file-preview', input],
+      queryFn: async () => ({
+        text: `Preview content for ${input.query.key}`,
+      }),
+    }))
+    mocks.driveFileDownloadQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-file-download', input],
+      queryFn: async () => ({
+        url: `https://example.com/${input.query.key}`,
+      }),
+    }))
+    mocks.uploadSkillMutationOptions.mockReturnValue({
+      mutationFn: vi.fn(),
+      mutationKey: ['upload-skill'],
+    })
+  })
+
+  // Skill rows load their preview from the agent drive and render the shared detail dialog.
+  it('should fetch drive files and open the skill detail dialog when the skill row is clicked', async () => {
+    renderAgentSkills()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'Tender Analyzer',
+    }))
+
+    const dialog = screen.getByRole('dialog')
+
+    expect(dialog).toBeInTheDocument()
+    expect(mocks.driveFilesQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          prefix: 'tender-analyzer/',
+        },
+      },
+    })
+    expect(within(dialog).getByText('Tender Analyzer')).toBeInTheDocument()
+    expect(within(dialog).getByText('Extracts tender requirements and scoring criteria.')).toBeInTheDocument()
+    expect(within(dialog).queryByText('__MACOSX/._hatch-pet')).not.toBeInTheDocument()
+    expect(await within(dialog).findByText('scripts/extract.py')).toBeInTheDocument()
+    expect(within(dialog).getByText('SKILL.md')).toBeInTheDocument()
+    expect(await within(dialog).findByText('Preview content for tender-analyzer/SKILL.md')).toBeInTheDocument()
+    expect(mocks.driveFilePreviewQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          key: 'tender-analyzer/SKILL.md',
+        },
+      },
+    })
+    expect(mocks.driveFilePreviewQueryOptions).not.toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          key: 'tender-analyzer/__MACOSX/._hatch-pet',
+        },
+      },
+    })
+  })
+
+  it('should preview the selected skill file from the detail file tree', async () => {
+    renderAgentSkills()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'Tender Analyzer',
+    }))
+
+    const dialog = screen.getByRole('dialog')
+    const scriptFile = await within(dialog).findByRole('button', { name: 'scripts/extract.py' })
+    fireEvent.click(scriptFile)
+
+    expect(await within(dialog).findByText('Preview content for tender-analyzer/scripts/extract.py')).toBeInTheDocument()
+    expect(mocks.driveFilePreviewQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          key: 'tender-analyzer/scripts/extract.py',
+        },
+      },
+    })
+  })
+
+  // The hover/focus remove action updates the composer draft without opening preview.
+  it('should remove the skill without opening the detail dialog when the remove action is clicked', () => {
+    renderAgentSkills()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.skills\.remove.*Tender Analyzer/,
+    }))
+
+    expect(screen.queryByText('Tender Analyzer')).not.toBeInTheDocument()
+    expect(screen.getByText('Meeting Brief')).toBeInTheDocument()
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+  })
+
+  it('should hide add and remove actions when readonly', () => {
+    renderReadonlyAgentSkills()
+
+    expect(screen.getByRole('button', { name: 'Tender Analyzer' })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'agentV2.agentDetail.configure.skills.add' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.skills\.remove.*Tender Analyzer/,
+    })).not.toBeInTheDocument()
+  })
+
+  // Upload uses the drive-backed response so the added skill can be reloaded from agent drive paths.
+  it('should add an uploaded skill with drive-backed keys when the upload succeeds', async () => {
+    const user = userEvent.setup()
+    const uploadSkill = vi.fn().mockResolvedValue({
+      manifest: {
+        files: ['SKILL.md', 'scripts/run.py'],
+        name: 'Invoice Helper',
+      },
+      skill: {
+        id: 'skill-hash',
+        manifest_files: ['SKILL.md', 'scripts/run.py'],
+        name: 'Invoice Helper',
+        path: 'invoice-helper',
+        skill_md_key: 'invoice-helper/SKILL.md',
+      },
+    })
+    mocks.uploadSkillMutationOptions.mockReturnValue({
+      mutationFn: uploadSkill,
+      mutationKey: ['upload-skill'],
+    })
+
+    renderAgentSkills()
+
+    await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.skills.add' }))
+
+    const fileInput = document.querySelector('input[type="file"]') as HTMLInputElement
+    const file = new File(['skill'], 'invoice-helper.skill', { type: 'application/zip' })
+    await user.upload(fileInput, file)
+    await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.skills.upload.action' }))
+
+    await waitFor(() => {
+      expect(uploadSkill.mock.calls[0]?.[0]).toEqual({
+        body: {
+          file,
+        },
+        params: {
+          agent_id: 'agent-1',
+        },
+      })
+    })
+    expect(await screen.findByRole('button', { name: 'Invoice Helper' })).toBeInTheDocument()
+
+    await user.click(screen.getByRole('button', { name: 'Invoice Helper' }))
+
+    expect(mocks.driveFilesQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          prefix: 'invoice-helper/',
+        },
+      },
+    })
+    expect(vi.mocked(toast.success)).toHaveBeenCalledWith('agentV2.agentDetail.configure.skills.upload.success')
+  })
+
+  // Uploaded drive-backed refs must survive insertion into draft and serialization back to config.
+  it('should preserve archive and skill file ids from the upload response in the serialized draft', async () => {
+    const user = userEvent.setup()
+    const uploadSkill = vi.fn().mockResolvedValue({
+      manifest: {
+        files: ['SKILL.md', 'scripts/run.py'],
+        name: 'Invoice Helper',
+      },
+      skill: {
+        file_id: 'archive-upload-file-id',
+        full_archive_file_id: 'archive-tool-file-id',
+        full_archive_key: 'invoice-helper/.DIFY-SKILL-FULL.zip',
+        id: 'skill-hash',
+        manifest_files: ['SKILL.md', 'scripts/run.py'],
+        name: 'Invoice Helper',
+        path: 'invoice-helper',
+        skill_md_file_id: 'skill-md-tool-file-id',
+        skill_md_key: 'invoice-helper/SKILL.md',
+      },
+    })
+    mocks.uploadSkillMutationOptions.mockReturnValue({
+      mutationFn: uploadSkill,
+      mutationKey: ['upload-skill'],
+    })
+
+    const queryClient = new QueryClient({
+      defaultOptions: {
+        queries: {
+          retry: false,
+        },
+      },
+    })
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <AgentComposerProvider initialDraft={agentSkillsDraft}>
+          <AgentSkills agentId="agent-1" />
+          <ConfigSnapshotProbe />
+        </AgentComposerProvider>
+      </QueryClientProvider>,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.skills.add' }))
+
+    const fileInput = document.querySelector('input[type="file"]') as HTMLInputElement
+    const file = new File(['skill'], 'invoice-helper.skill', { type: 'application/zip' })
+    await user.upload(fileInput, file)
+    await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.skills.upload.action' }))
+
+    await waitFor(() => {
+      const serializedSkills = JSON.parse(screen.getByTestId('config-snapshot-probe').textContent ?? '[]')
+      expect(serializedSkills).toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          file_id: 'archive-upload-file-id',
+          full_archive_file_id: 'archive-tool-file-id',
+          full_archive_key: 'invoice-helper/.DIFY-SKILL-FULL.zip',
+          name: 'Invoice Helper',
+          path: 'invoice-helper',
+          skill_md_file_id: 'skill-md-tool-file-id',
+          skill_md_key: 'invoice-helper/SKILL.md',
+        }),
+      ]))
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/detail-dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/detail-dialog.tsx
new file mode 100644
index 00000000000..c7fd8c3f6ff
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/detail-dialog.tsx
@@ -0,0 +1,269 @@
+'use client'
+
+import type { AgentFileNode } from '@/features/agent-v2/agent-composer/form-state'
+import {
+  DialogCloseButton,
+  DialogContent,
+  DialogDescription,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { FileTreeFile } from '@langgenius/dify-ui/file-tree'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import { AgentFileTree } from '../files/tree'
+import { countAgentFileNodes } from '../utils'
+
+type AgentSkillFileNode = AgentFileNode
+
+type AgentSkillDetailSection = {
+  id: string
+  title: string
+  paragraphs?: string[]
+  items?: string[]
+}
+
+export type AgentSkillDetail = {
+  description: string
+  fileCount?: number
+  files: AgentSkillFileNode[]
+  filePreview?: {
+    binary?: boolean
+    content?: string
+    downloadUrl?: string
+    fileName?: string
+    isDownloadError?: boolean
+    isDownloadLoading?: boolean
+    isError?: boolean
+    isImage?: boolean
+    isLoading?: boolean
+  }
+  onSelectFile?: (file: AgentSkillFileNode) => void
+  selectedFileId?: string
+  sections: AgentSkillDetailSection[]
+}
+
+function AgentSkillFileList({
+  files,
+  fileCount,
+  onSelectFile,
+  selectedFileId,
+}: {
+  files: AgentSkillFileNode[]
+  fileCount: number
+  onSelectFile?: (file: AgentSkillFileNode) => void
+  selectedFileId?: string
+}) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <AgentFileTree
+      files={files}
+      selectedFileId={selectedFileId}
+      labelledBy="agent-skill-detail-files-heading"
+      className="h-[258px] rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg p-1 shadow-xs shadow-shadow-shadow-3"
+      renderFile={onSelectFile
+        ? ({ file, selected, children }) => (
+            <FileTreeFile selected={selected} onClick={() => onSelectFile(file)}>
+              {children}
+            </FileTreeFile>
+          )
+        : undefined}
+      header={(
+        <>
+          <h3 id="agent-skill-detail-files-heading" className="sr-only">
+            {t('agentDetail.configure.skills.detail.files')}
+          </h3>
+          <div
+            aria-hidden="true"
+            className="px-2 py-1 system-2xs-semibold-uppercase text-text-tertiary"
+          >
+            {t('agentDetail.configure.skills.detail.fileCount', { count: fileCount })}
+          </div>
+        </>
+      )}
+    />
+  )
+}
+
+function AgentSkillDetailSectionBlock({
+  section,
+}: {
+  section: AgentSkillDetailSection
+}) {
+  return (
+    <section className="clear-none">
+      <h3 className="system-sm-semibold text-text-primary">{section.title}</h3>
+      {section.paragraphs?.map(paragraph => (
+        <p key={paragraph} className="mt-1 system-xs-regular text-text-secondary">
+          {paragraph}
+        </p>
+      ))}
+      {!!section.items?.length && (
+        <ul className="mt-1 flex list-disc flex-col gap-0.5 pl-5 system-xs-regular text-text-secondary">
+          {section.items.map(item => (
+            <li key={item} className="pl-0.5">
+              {item}
+            </li>
+          ))}
+        </ul>
+      )}
+    </section>
+  )
+}
+
+function AgentFilePreviewContent({
+  binary,
+  content,
+  downloadUrl,
+  fileName,
+  isDownloadError,
+  isDownloadLoading,
+  isError,
+  isImage,
+  isLoading,
+}: {
+  binary?: boolean
+  content?: string
+  downloadUrl?: string
+  fileName?: string
+  isDownloadError?: boolean
+  isDownloadLoading?: boolean
+  isError?: boolean
+  isImage?: boolean
+  isLoading?: boolean
+}) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+
+  if (isLoading || isDownloadLoading) {
+    return (
+      <div className="flex min-h-40 items-center justify-center">
+        <Loading type="area" />
+      </div>
+    )
+  }
+
+  if (isError || isDownloadError) {
+    return (
+      <p className="system-sm-regular text-text-tertiary">
+        {t('agentDetail.configure.files.preview.failed')}
+      </p>
+    )
+  }
+
+  if (isImage && downloadUrl) {
+    return (
+      <div className="flex min-h-40 items-start justify-center">
+        <img
+          src={downloadUrl}
+          alt={fileName ?? ''}
+          className="max-h-[560px] max-w-full rounded-lg object-contain"
+        />
+      </div>
+    )
+  }
+
+  if (binary) {
+    if (downloadUrl) {
+      return (
+        <div className="flex min-w-0 flex-wrap items-center gap-2">
+          <span className="system-sm-regular text-text-tertiary">
+            {t('agentDetail.configure.files.preview.unsupported')}
+          </span>
+          <a
+            href={downloadUrl}
+            target="_blank"
+            rel="noreferrer"
+            className="inline-flex min-w-0 items-center gap-1 rounded-md px-2 py-1 system-sm-medium text-text-accent outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+          >
+            <span aria-hidden className="i-ri-download-2-line size-4 shrink-0" />
+            <span className="shrink-0">{tCommon('operation.download')}</span>
+          </a>
+        </div>
+      )
+    }
+
+    return (
+      <p className="system-sm-regular text-text-tertiary">
+        {t('agentDetail.configure.files.preview.empty')}
+      </p>
+    )
+  }
+
+  if (!content) {
+    return (
+      <p className="system-sm-regular text-text-tertiary">
+        {t('agentDetail.configure.files.preview.empty')}
+      </p>
+    )
+  }
+
+  return (
+    <pre className="m-0 font-mono text-xs leading-5 break-words whitespace-pre-wrap text-text-secondary">
+      {content}
+    </pre>
+  )
+}
+
+export function AgentSkillDetailDialog({
+  skillName,
+  detail,
+}: {
+  skillName: string
+  detail: AgentSkillDetail
+}) {
+  const { t } = useTranslation('agentV2')
+  const fileCount = detail.fileCount ?? countAgentFileNodes(detail.files)
+
+  return (
+    <DialogContent className="flex h-[min(720px,calc(100dvh-2rem))] max-h-none w-[min(960px,calc(100vw-2rem))] flex-col overflow-hidden rounded-2xl p-0">
+      <DialogCloseButton className="top-5 right-5" />
+      <div className="shrink-0 border-b-[0.5px] border-components-panel-border-subtle pt-6 pr-14 pb-3 pl-6">
+        <DialogTitle className="title-xl-semi-bold text-text-primary">
+          {skillName}
+        </DialogTitle>
+        <DialogDescription className="mt-1 system-xs-regular text-text-tertiary">
+          {detail.description}
+        </DialogDescription>
+      </div>
+
+      <div className="flex min-h-0 flex-1 items-start">
+        <ScrollArea
+          className="relative min-h-0 flex-1 self-stretch overflow-hidden has-[>_:first-child:focus-visible]:outline-2 has-[>_:first-child:focus-visible]:outline-offset-0 has-[>_:first-child:focus-visible]:outline-state-accent-solid"
+          label={t('agentDetail.configure.skills.detail.contentRegion')}
+          slotClassNames={{
+            viewport: 'overscroll-contain outline-none focus-visible:outline-none mask-linear-[to_bottom,transparent_0,black_min(40px,var(--scroll-area-overflow-y-start)),black_calc(100%_-_min(40px,var(--scroll-area-overflow-y-end,40px))),transparent_100%] mask-no-repeat',
+            content: 'flex min-h-full w-full max-w-full min-w-0 flex-col gap-2 px-6 pt-4 pb-0',
+            scrollbar: 'data-[orientation=vertical]:my-1 data-[orientation=vertical]:me-1',
+          }}
+        >
+          {detail.filePreview && (
+            <AgentFilePreviewContent
+              binary={detail.filePreview.binary}
+              content={detail.filePreview.content}
+              downloadUrl={detail.filePreview.downloadUrl}
+              fileName={detail.filePreview.fileName}
+              isDownloadError={detail.filePreview.isDownloadError}
+              isDownloadLoading={detail.filePreview.isDownloadLoading}
+              isError={detail.filePreview.isError}
+              isImage={detail.filePreview.isImage}
+              isLoading={detail.filePreview.isLoading}
+            />
+          )}
+          {detail.sections.map(section => (
+            <AgentSkillDetailSectionBlock key={section.id} section={section} />
+          ))}
+        </ScrollArea>
+        <div className="flex w-56 max-w-56 min-w-0 shrink-0 items-start justify-center p-4 pl-2">
+          <AgentSkillFileList
+            files={detail.files}
+            fileCount={fileCount}
+            selectedFileId={detail.selectedFileId}
+            onSelectFile={detail.onSelectFile}
+          />
+        </div>
+      </div>
+    </DialogContent>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/index.tsx
new file mode 100644
index 00000000000..5ecf687020a
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/index.tsx
@@ -0,0 +1,82 @@
+'use client'
+
+import type { AgentOrchestrateAddActionOptions } from '../add-actions-context'
+import type { AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
+import { useAtom } from 'jotai'
+import { useCallback, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { agentComposerSkillsAtom, useRemoveSkill } from '@/features/agent-v2/agent-composer/store-modules/skills'
+import { useRegisterAgentOrchestrateAddAction } from '../add-actions-context'
+import { ConfigureSectionAddButton } from '../common/add-button'
+import { ConfigureSectionEmpty } from '../common/empty'
+import { ConfigureSection } from '../common/section'
+import { AgentSkillItem } from './item'
+import { AgentSkillUploadDialog } from './upload-dialog'
+
+export function AgentSkills({
+  agentId,
+}: {
+  agentId: string
+}) {
+  const { t } = useTranslation('agentV2')
+  const [skills, setSkills] = useAtom(agentComposerSkillsAtom)
+  const removeSkill = useRemoveSkill()
+  const skillsTip = t('agentDetail.configure.skills.tip')
+  const skillsListId = 'agent-configure-skills-list'
+  const [isUploadOpen, setIsUploadOpen] = useState(false)
+  const promptAddCallbackRef = useRef<AgentOrchestrateAddActionOptions['onAdded']>(undefined)
+  const handleOpenUpload = useCallback((options?: AgentOrchestrateAddActionOptions) => {
+    promptAddCallbackRef.current = options?.onAdded
+    setIsUploadOpen(true)
+  }, [])
+  useRegisterAgentOrchestrateAddAction('skills', handleOpenUpload)
+  const handleUploaded = useCallback((skill: AgentSkill) => {
+    setSkills(skills.some(currentSkill => currentSkill.id === skill.id)
+      ? skills
+      : [...skills, skill])
+    promptAddCallbackRef.current?.(skill)
+    promptAddCallbackRef.current = undefined
+  }, [setSkills, skills])
+  const handleUploadOpenChange = useCallback((open: boolean) => {
+    if (!open)
+      promptAddCallbackRef.current = undefined
+    setIsUploadOpen(open)
+  }, [])
+
+  return (
+    <>
+      <ConfigureSection
+        label={t('agentDetail.configure.skills.label')}
+        labelId="agent-configure-skills-label"
+        panelId={skillsListId}
+        tip={skillsTip}
+        tipAriaLabel={skillsTip}
+        rootClassName="border-b border-divider-subtle pt-4"
+        panelContentClassName="flex flex-col gap-1 pb-4"
+        actions={(
+          <ConfigureSectionAddButton
+            ariaLabel={t('agentDetail.configure.skills.add')}
+            onClick={() => handleOpenUpload()}
+          />
+        )}
+      >
+        {skills.length === 0
+          ? (
+              <ConfigureSectionEmpty
+                title={t('agentDetail.configure.skills.empty.title')}
+                description={t('agentDetail.configure.skills.empty.description')}
+              />
+            )
+          : skills.map(skill => (
+              <AgentSkillItem key={skill.id} agentId={agentId} skill={skill} onRemove={removeSkill} />
+            ))}
+      </ConfigureSection>
+      <AgentSkillUploadDialog
+        agentId={agentId}
+        open={isUploadOpen}
+        onOpenChange={handleUploadOpenChange}
+        onUploaded={handleUploaded}
+      />
+    </>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/item.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/item.tsx
new file mode 100644
index 00000000000..d3160a470c6
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/item.tsx
@@ -0,0 +1,183 @@
+'use client'
+
+import type { AgentDriveItemResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentFileNode, AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
+import {
+  Dialog,
+} from '@langgenius/dify-ui/dialog'
+import { useQuery } from '@tanstack/react-query'
+import { useCallback, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { getDriveFileIconType } from '../files/file-icon'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
+import { AgentSkillDetailDialog } from './detail-dialog'
+
+const getSkillDrivePath = (skill: AgentSkill) => {
+  const skillMdKeySlug = skill.skillMdKey?.split('/', 1)[0]
+  return skill.path ?? skillMdKeySlug ?? skill.id
+}
+
+const getSkillFileName = (key: string, skillDrivePath: string) => key.startsWith(`${skillDrivePath}/`)
+  ? key.slice(skillDrivePath.length + 1)
+  : key
+
+const toSkillFileNode = (item: AgentDriveItemResponse, skillDrivePath: string) => ({
+  icon: getDriveFileIconType({
+    fileKind: item.file_kind,
+    fileName: getSkillFileName(item.key, skillDrivePath),
+    mimeType: item.mime_type,
+  }),
+  id: item.key,
+  name: getSkillFileName(item.key, skillDrivePath),
+})
+
+const getSkillMdFileId = (files: AgentFileNode[]): string | undefined => {
+  for (const file of files) {
+    if (file.icon !== 'folder' && file.name === 'SKILL.md')
+      return file.id
+
+    const childFileId = file.children ? getSkillMdFileId(file.children) : undefined
+    if (childFileId)
+      return childFileId
+  }
+}
+
+const getFirstSkillFileId = (files: AgentFileNode[]): string | undefined => {
+  for (const file of files) {
+    if (file.icon !== 'folder')
+      return file.id
+
+    const childFileId = file.children ? getFirstSkillFileId(file.children) : undefined
+    if (childFileId)
+      return childFileId
+  }
+}
+
+export function AgentSkillItem({
+  agentId,
+  skill,
+  onRemove,
+}: {
+  agentId: string
+  skill: AgentSkill
+  onRemove: (skillId: string) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const readOnly = useAgentOrchestrateReadOnly()
+  const [isPreviewOpen, setIsPreviewOpen] = useState(false)
+  const [selectedFileId, setSelectedFileId] = useState<string>()
+  const handleRemove = useCallback(() => {
+    onRemove(skill.id)
+  }, [onRemove, skill.id])
+  const handleOpenPreview = useCallback(() => {
+    setSelectedFileId(undefined)
+    setIsPreviewOpen(true)
+  }, [])
+  const skillDrivePath = getSkillDrivePath(skill)
+  const driveFilesQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.get.queryOptions({
+      input: {
+        params: {
+          agent_id: agentId,
+        },
+        query: {
+          prefix: `${skillDrivePath}/`,
+        },
+      },
+    }),
+    enabled: isPreviewOpen,
+  })
+  const detailFiles = driveFilesQuery.isSuccess
+    ? (driveFilesQuery.data.items ?? []).map(item => toSkillFileNode(item, skillDrivePath))
+    : []
+  const previewFileId = selectedFileId
+    ?? skill.skillMdKey
+    ?? (driveFilesQuery.isSuccess ? getSkillMdFileId(detailFiles) ?? getFirstSkillFileId(detailFiles) : undefined)
+  const previewQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.preview.get.queryOptions({
+      input: {
+        params: {
+          agent_id: agentId,
+        },
+        query: {
+          key: previewFileId ?? '',
+        },
+      },
+    }),
+    enabled: isPreviewOpen && !!previewFileId,
+  })
+  const selectedFile = detailFiles.find(file => file.id === previewFileId)
+  const isImagePreviewFile = selectedFile?.icon === 'image'
+  const downloadQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.download.get.queryOptions({
+      input: {
+        params: {
+          agent_id: agentId,
+        },
+        query: {
+          key: previewFileId ?? '',
+        },
+      },
+    }),
+    enabled: isPreviewOpen && !!previewFileId && (isImagePreviewFile || !!previewQuery.data?.binary),
+  })
+
+  return (
+    <Dialog open={isPreviewOpen} onOpenChange={setIsPreviewOpen}>
+      <div className="group flex h-8 items-center gap-1 overflow-hidden rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg py-1 pr-2.5 pl-2 shadow-xs shadow-shadow-shadow-3 focus-within:bg-components-panel-on-panel-item-bg-hover focus-within:shadow-sm hover:bg-components-panel-on-panel-item-bg-hover hover:pr-1 hover:shadow-sm has-[[data-agent-skill-remove-button]:focus-visible]:border-state-destructive-border! has-[[data-agent-skill-remove-button]:focus-visible]:bg-state-destructive-hover! has-[[data-agent-skill-remove-button]:focus-visible]:shadow-xs! has-[[data-agent-skill-remove-button]:hover]:border-state-destructive-border! has-[[data-agent-skill-remove-button]:hover]:bg-state-destructive-hover! has-[[data-agent-skill-remove-button]:hover]:shadow-xs!">
+        <button
+          type="button"
+          className="flex h-full min-w-0 flex-1 cursor-pointer items-center gap-1 rounded-md text-left outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+          onClick={handleOpenPreview}
+        >
+          <span aria-hidden className="i-custom-public-agent-building-blocks size-4 shrink-0" />
+          <span className="min-w-0 flex-1 truncate system-sm-medium text-text-secondary">
+            {skill.name}
+          </span>
+        </button>
+        {!readOnly && (
+          <div className="hidden shrink-0 items-center justify-center rounded-md p-0.5 group-focus-within:flex group-hover:flex">
+            <button
+              type="button"
+              data-agent-skill-remove-button
+              aria-label={t('agentDetail.configure.skills.remove', { name: skill.name })}
+              onClick={handleRemove}
+              className="flex size-5 items-center justify-center rounded-md text-text-tertiary hover:bg-state-destructive-hover hover:text-text-destructive focus-visible:bg-state-destructive-hover focus-visible:text-text-destructive focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            >
+              <span aria-hidden className="i-ri-delete-bin-line size-4" />
+            </button>
+          </div>
+        )}
+        <div className="flex shrink-0 items-center justify-center group-focus-within:hidden group-hover:hidden">
+          <span className="system-xs-regular text-text-tertiary">
+            {t('agentDetail.configure.skills.itemType')}
+          </span>
+        </div>
+      </div>
+      {isPreviewOpen && (
+        <AgentSkillDetailDialog
+          skillName={skill.name}
+          detail={{
+            description: skill.description ?? t('agentDetail.configure.skills.tip'),
+            files: detailFiles,
+            filePreview: {
+              binary: previewQuery.data?.binary,
+              content: previewQuery.data?.text ?? undefined,
+              downloadUrl: downloadQuery.data?.url,
+              fileName: selectedFile?.name,
+              isDownloadError: downloadQuery.isError,
+              isDownloadLoading: (isImagePreviewFile || !!previewQuery.data?.binary) && downloadQuery.isPending,
+              isError: previewQuery.isError,
+              isImage: isImagePreviewFile,
+              isLoading: previewQuery.isPending,
+            },
+            onSelectFile: file => setSelectedFileId(file.id),
+            selectedFileId: previewFileId,
+            sections: [],
+          }}
+        />
+      )}
+    </Dialog>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/upload-dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/upload-dialog.tsx
new file mode 100644
index 00000000000..d95bb162b3e
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/upload-dialog.tsx
@@ -0,0 +1,227 @@
+'use client'
+
+import type { PostAgentByAgentIdSkillsUploadResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import ActionButton from '@/app/components/base/action-button'
+import { consoleQuery } from '@/service/client'
+import { formatFileSize } from '@/utils/format'
+
+const skillPackageAccept = '.zip,.skill'
+const skillPackageExtensions = ['.zip', '.skill']
+
+const getSkillNameFromFile = (file: File) => file.name.replace(/\.(?:skill|zip)$/iu, '') || file.name
+
+const toUploadedSkill = (response: PostAgentByAgentIdSkillsUploadResponse, file: File): AgentSkill => {
+  const name = response.skill?.name
+    ?? response.manifest?.name
+    ?? getSkillNameFromFile(file)
+  const id = response.skill?.id
+    ?? response.skill?.skill_md_key
+    ?? response.skill?.path
+    ?? name
+
+  return {
+    description: response.skill?.description ?? response.manifest?.description,
+    files: response.skill?.manifest_files ?? response.manifest?.files,
+    fileId: response.skill?.file_id ?? undefined,
+    fullArchiveFileId: response.skill?.full_archive_file_id ?? undefined,
+    fullArchiveKey: response.skill?.full_archive_key ?? undefined,
+    id,
+    name,
+    path: response.skill?.path ?? undefined,
+    skillMdFileId: response.skill?.skill_md_file_id ?? undefined,
+    skillMdKey: response.skill?.skill_md_key ?? undefined,
+  }
+}
+
+function isSupportedSkillPackage(file: File) {
+  const fileName = file.name.toLowerCase()
+
+  return skillPackageExtensions.some(extension => fileName.endsWith(extension))
+}
+
+function AgentSkillPackageUploader({
+  file,
+  onChange,
+}: {
+  file?: File
+  onChange: (file?: File) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const fileInputRef = useRef<HTMLInputElement>(null)
+  const [dragging, setDragging] = useState(false)
+
+  const setUploadFiles = (files: File[]) => {
+    const [uploadFile] = files
+    if (files.length !== 1 || !uploadFile || !isSupportedSkillPackage(uploadFile)) {
+      toast.error(t('agentDetail.configure.skills.upload.invalidFile'))
+      return
+    }
+
+    onChange(uploadFile)
+  }
+
+  const handleFileChange = (event: React.ChangeEvent<HTMLInputElement>) => {
+    const files = Array.from(event.target.files ?? [])
+    event.target.value = ''
+    setUploadFiles(files)
+  }
+
+  const handleDrop = (event: React.DragEvent<HTMLDivElement>) => {
+    event.preventDefault()
+    event.stopPropagation()
+    setDragging(false)
+
+    setUploadFiles(Array.from(event.dataTransfer.files))
+  }
+
+  return (
+    <div className="mt-6">
+      <input
+        ref={fileInputRef}
+        className="hidden"
+        type="file"
+        accept={skillPackageAccept}
+        onChange={handleFileChange}
+      />
+      {!file && (
+        <div
+          className={cn(
+            'relative flex h-16 items-center rounded-[10px] border border-dashed border-components-dropzone-border bg-components-dropzone-bg text-sm font-normal',
+            dragging && 'border-components-dropzone-border-accent bg-components-dropzone-bg-accent',
+          )}
+          onDragEnter={(event) => {
+            event.preventDefault()
+            setDragging(true)
+          }}
+          onDragOver={event => event.preventDefault()}
+          onDragLeave={() => setDragging(false)}
+          onDrop={handleDrop}
+        >
+          <div className="flex w-full items-center justify-center space-x-2">
+            <span aria-hidden className="i-ri-upload-cloud-2-line size-6 text-text-tertiary" />
+            <div className="text-text-tertiary">
+              {t('agentDetail.configure.skills.upload.dropzone')}
+              <button
+                type="button"
+                className="inline cursor-pointer border-none bg-transparent p-0 pl-1 text-left text-text-accent focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
+                onClick={() => fileInputRef.current?.click()}
+              >
+                {t('agentDetail.configure.skills.upload.browse')}
+              </button>
+            </div>
+          </div>
+          {dragging && <div className="absolute top-0 left-0 size-full" />}
+        </div>
+      )}
+      {file && (
+        <div className="group flex items-center rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg shadow-xs hover:bg-components-panel-on-panel-item-bg-hover">
+          <div className="flex items-center justify-center p-3">
+            <span aria-hidden className="i-custom-public-files-yaml size-6 shrink-0" />
+          </div>
+          <div className="flex grow flex-col items-start gap-0.5 py-1 pr-2">
+            <span className="max-w-[calc(100%-30px)] overflow-hidden text-[12px] leading-4 font-medium text-ellipsis whitespace-nowrap text-text-secondary">{file.name}</span>
+            <div className="flex h-3 items-center gap-1 self-stretch text-[10px] leading-3 font-medium text-text-tertiary uppercase">
+              <span>{t('agentDetail.configure.skills.upload.fileType')}</span>
+              <span className="text-text-quaternary">·</span>
+              <span>{formatFileSize(file.size)}</span>
+            </div>
+          </div>
+          <div className="hidden items-center pr-3 group-hover:flex">
+            <ActionButton onClick={() => onChange(undefined)}>
+              <span aria-hidden className="i-ri-delete-bin-line size-4 text-text-tertiary" />
+            </ActionButton>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
+
+export function AgentSkillUploadDialog({
+  agentId,
+  onUploaded,
+  open,
+  onOpenChange,
+}: {
+  agentId: string
+  onUploaded?: (skill: AgentSkill) => void
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const [file, setFile] = useState<File>()
+  const uploadSkillMutation = useMutation(consoleQuery.agent.byAgentId.skills.upload.post.mutationOptions())
+
+  const handleUpload = () => {
+    if (!file || uploadSkillMutation.isPending)
+      return
+
+    uploadSkillMutation.mutate({
+      params: {
+        agent_id: agentId,
+      },
+      body: {
+        file,
+      },
+    }, {
+      onSuccess: (response) => {
+        toast.success(t('agentDetail.configure.skills.upload.success'))
+        onUploaded?.(toUploadedSkill(response, file))
+        setFile(undefined)
+        onOpenChange(false)
+      },
+      onError: () => {
+        toast.error(t('agentDetail.configure.skills.upload.failed'))
+      },
+    })
+  }
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    if (!nextOpen) {
+      uploadSkillMutation.reset()
+      setFile(undefined)
+    }
+    onOpenChange(nextOpen)
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent>
+        <DialogCloseButton />
+        <DialogTitle className="title-2xl-semi-bold text-text-primary">
+          {t('agentDetail.configure.skills.upload.title')}
+        </DialogTitle>
+        <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+          {t('agentDetail.configure.skills.upload.description')}
+        </DialogDescription>
+        <AgentSkillPackageUploader
+          file={file}
+          onChange={setFile}
+        />
+        <div className="flex justify-end gap-2 pt-6">
+          <Button type="button" onClick={() => handleOpenChange(false)} disabled={uploadSkillMutation.isPending}>
+            {tCommon('operation.cancel')}
+          </Button>
+          <Button
+            type="button"
+            variant="primary"
+            disabled={!file}
+            loading={uploadSkillMutation.isPending}
+            onClick={handleUpload}
+          >
+            {t('agentDetail.configure.skills.upload.action')}
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/hooks.spec.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/hooks.spec.ts
new file mode 100644
index 00000000000..5afbb2b2771
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/hooks.spec.ts
@@ -0,0 +1,56 @@
+import type { AgentProviderToolDefaultValue } from '../types'
+import { addProviderTools } from '../hooks'
+
+const noCredentialTool = {
+  provider_id: 'duckduckgo',
+  provider_type: 'builtin',
+  provider_name: 'DuckDuckGo',
+  provider_show_name: 'DuckDuckGo',
+  tool_name: 'ddg_search',
+  tool_label: 'DuckDuckGo Search',
+  tool_description: 'Search the web.',
+  title: 'DuckDuckGo Search',
+  is_team_authorization: true,
+  params: {},
+  paramSchemas: [],
+  allowDelete: false,
+  credentialRequired: false,
+} satisfies AgentProviderToolDefaultValue
+
+const unauthorizedCredentialTool = {
+  ...noCredentialTool,
+  provider_id: 'google',
+  provider_name: 'google',
+  provider_show_name: 'Google',
+  tool_name: 'search',
+  tool_label: 'Google Search',
+  title: 'Google Search',
+  is_team_authorization: false,
+  credentialRequired: true,
+} satisfies AgentProviderToolDefaultValue
+
+describe('addProviderTools', () => {
+  it('should not mark tools that do not need credentials as unauthorized', () => {
+    const nextTools = addProviderTools([], [noCredentialTool])
+
+    expect(nextTools).toEqual([
+      expect.objectContaining({
+        credentialId: undefined,
+        credentialType: undefined,
+        credentialVariant: 'none',
+      }),
+    ])
+  })
+
+  it('should mark credential-required tools without credentials as unauthorized', () => {
+    const nextTools = addProviderTools([], [unauthorizedCredentialTool])
+
+    expect(nextTools).toEqual([
+      expect.objectContaining({
+        credentialId: undefined,
+        credentialType: 'unauthorized',
+        credentialVariant: 'unauthorized',
+      }),
+    ])
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..0c14cb78117
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/index.spec.tsx
@@ -0,0 +1,389 @@
+import type { ToolWithProvider } from '@/app/components/workflow/types'
+import type { AgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { cleanup, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { CollectionType } from '@/app/components/tools/types'
+import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
+import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { AgentOrchestrateReadOnlyContext } from '../../read-only-context'
+import { AgentTools } from '../index'
+
+const toolProviderState = vi.hoisted(() => ({
+  builtInTools: [] as ToolWithProvider[],
+}))
+
+vi.mock('@/app/components/workflow/block-selector/tool-picker', () => ({
+  ToolPickerContent: () => (
+    <div>
+      Mock tool picker
+    </div>
+  ),
+}))
+
+vi.mock('@/app/components/workflow/block-icon', () => ({
+  default: ({ toolIcon }: { toolIcon?: string | { content: string, background: string } }) => (
+    <span aria-hidden data-testid="tool-icon">
+      {typeof toolIcon === 'string' ? toolIcon : toolIcon?.content}
+    </span>
+  ),
+}))
+
+vi.mock('@/app/components/header/account-setting/model-provider-page/model-modal/Form', () => ({
+  default: ({ formSchemas }: { formSchemas: Array<{ label?: Record<string, string>, variable?: string }> }) => (
+    <div data-testid="tool-setting-form">
+      {formSchemas.map(schema => (
+        <div key={schema.variable}>{schema.label?.en_US}</div>
+      ))}
+    </div>
+  ),
+}))
+
+vi.mock('@/service/use-tools', () => ({
+  useAllBuiltInTools: () => ({ data: toolProviderState.builtInTools }),
+  useAllCustomTools: () => ({ data: [] }),
+  useAllWorkflowTools: () => ({ data: [] }),
+  useAllMCPTools: () => ({ data: [] }),
+}))
+
+const agentToolsDraft = {
+  ...defaultAgentSoulConfigFormState,
+  tools: [
+    {
+      id: 'duckduckgo',
+      kind: 'provider',
+      name: 'DuckDuckGo',
+      iconClassName: 'i-simple-icons-duckduckgo',
+      credentialKey: 'agentDetail.configure.tools.credential.authOne',
+      credentialVariant: 'none',
+      actions: [
+        {
+          id: 'duckduckgo-search',
+          name: 'DuckDuckGo Search',
+          toolName: 'search',
+          description: 'Search the web.',
+        },
+        {
+          id: 'duckduckgo-image-search',
+          name: 'DuckDuckGo Image Search',
+          toolName: 'image_search',
+          description: 'Search images.',
+        },
+      ],
+    },
+    {
+      id: 'lark-cli',
+      kind: 'cli',
+      name: 'Lark CLI',
+    },
+  ],
+} satisfies AgentSoulConfigFormState
+
+const reflectedAgentToolsDraft = {
+  ...defaultAgentSoulConfigFormState,
+  tools: [
+    {
+      id: 'google',
+      kind: 'provider',
+      name: 'google',
+      iconClassName: 'i-custom-public-other-default-tool-icon',
+      credentialVariant: 'none',
+      actions: [
+        {
+          id: 'google-search',
+          name: 'search',
+          toolName: 'search',
+          description: '',
+        },
+      ],
+    },
+  ],
+} satisfies AgentSoulConfigFormState
+
+const reflectedUnauthorizedNoCredentialDraft = {
+  ...defaultAgentSoulConfigFormState,
+  tools: [
+    {
+      id: 'duckduckgo',
+      kind: 'provider',
+      name: 'duckduckgo',
+      iconClassName: 'i-custom-public-other-default-tool-icon',
+      credentialType: 'unauthorized',
+      credentialVariant: 'unauthorized',
+      actions: [
+        {
+          id: 'duckduckgo-search',
+          name: 'search',
+          toolName: 'search',
+          description: '',
+        },
+      ],
+    },
+  ],
+} satisfies AgentSoulConfigFormState
+
+const googleProvider = {
+  id: 'google',
+  name: 'google',
+  author: 'Google',
+  description: {
+    en_US: 'Google tools.',
+    zh_Hans: 'Google 工具。',
+  },
+  icon: 'https://example.com/google.svg',
+  icon_dark: 'https://example.com/google-dark.svg',
+  label: {
+    en_US: 'Google Tools',
+    zh_Hans: 'Google 工具',
+  },
+  type: CollectionType.builtIn,
+  team_credentials: {},
+  is_team_authorization: true,
+  allow_delete: true,
+  labels: [],
+  meta: {
+    version: '0.0.1',
+  },
+  tools: [
+    {
+      name: 'search',
+      author: 'Google',
+      label: {
+        en_US: 'Google Search',
+        zh_Hans: 'Google 搜索',
+      },
+      description: {
+        en_US: 'Search the web with Google.',
+        zh_Hans: '使用 Google 搜索网页。',
+      },
+      parameters: [],
+      labels: [],
+      output_schema: {},
+    },
+  ],
+} satisfies ToolWithProvider
+
+const duckDuckGoProvider = {
+  ...googleProvider,
+  id: 'duckduckgo',
+  name: 'duckduckgo',
+  author: 'DuckDuckGo',
+  icon: 'https://example.com/duckduckgo.svg',
+  icon_dark: 'https://example.com/duckduckgo-dark.svg',
+  label: {
+    en_US: 'DuckDuckGo',
+    zh_Hans: 'DuckDuckGo',
+  },
+  team_credentials: {},
+  is_team_authorization: true,
+  allow_delete: false,
+  tools: [
+    {
+      name: 'search',
+      author: 'DuckDuckGo',
+      label: {
+        en_US: 'DuckDuckGo Search',
+        zh_Hans: 'DuckDuckGo 搜索',
+      },
+      description: {
+        en_US: 'Search the web with DuckDuckGo.',
+        zh_Hans: '使用 DuckDuckGo 搜索网页。',
+      },
+      parameters: [
+        {
+          name: 'query',
+          label: {
+            en_US: 'Search Query',
+            zh_Hans: '搜索查询',
+          },
+          human_description: {
+            en_US: 'The query to search for.',
+            zh_Hans: '要搜索的查询。',
+          },
+          type: 'string',
+          form: 'form',
+          llm_description: '',
+          required: true,
+          multiple: false,
+          default: '',
+        },
+      ],
+      labels: [],
+      output_schema: {},
+    },
+  ],
+} satisfies ToolWithProvider
+
+function renderAgentTools(initialDraft: AgentSoulConfigFormState = agentToolsDraft) {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentComposerProvider initialDraft={initialDraft}>
+        <AgentTools />
+      </AgentComposerProvider>
+    </QueryClientProvider>,
+  )
+}
+
+function renderReadonlyAgentTools(initialDraft: AgentSoulConfigFormState = agentToolsDraft) {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentComposerProvider initialDraft={initialDraft}>
+        <AgentOrchestrateReadOnlyContext value>
+          <AgentTools />
+        </AgentOrchestrateReadOnlyContext>
+      </AgentComposerProvider>
+    </QueryClientProvider>,
+  )
+}
+
+describe('AgentTools', () => {
+  beforeEach(() => {
+    cleanup()
+    vi.clearAllMocks()
+    toolProviderState.builtInTools = []
+  })
+
+  describe('User Interactions', () => {
+    it('should remove a provider action when the remove button is clicked', async () => {
+      const user = userEvent.setup()
+      renderAgentTools()
+
+      await user.click(screen.getByRole('button', {
+        name: 'DuckDuckGo',
+      }))
+
+      await user.click(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.removeAction:{"name":"DuckDuckGo Image Search"}',
+      }))
+
+      expect(screen.queryByText('DuckDuckGo Image Search')).not.toBeInTheDocument()
+      expect(screen.getByText('DuckDuckGo Search')).toBeInTheDocument()
+      expect(screen.getByText('DuckDuckGo')).toBeInTheDocument()
+    })
+
+    it('should remove all provider tools from the provider more-actions menu', async () => {
+      const user = userEvent.setup()
+      renderAgentTools()
+
+      await user.click(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.moreActions:{"name":"DuckDuckGo"}',
+      }))
+      await user.click(screen.getByRole('menuitem', {
+        name: /agentV2\.agentDetail\.configure\.tools\.removeProvider/,
+      }))
+
+      expect(screen.queryByText('DuckDuckGo')).not.toBeInTheDocument()
+      expect(screen.queryByText('DuckDuckGo Search')).not.toBeInTheDocument()
+      expect(screen.getByText('Lark CLI')).toBeInTheDocument()
+    })
+
+    it('should keep the add trigger mounted while the tool picker is open', async () => {
+      const user = userEvent.setup()
+      renderAgentTools()
+
+      await user.click(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.add',
+      }))
+      await user.click(screen.getByRole('button', {
+        name: /agentV2\.agentDetail\.configure\.tools\.addMenu\.tool\.label/,
+      }))
+
+      expect(screen.getByText('Mock tool picker')).toBeInTheDocument()
+      expect(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.add',
+      })).toBeInTheDocument()
+    })
+
+    it('should hide add, edit, and remove actions when readonly', async () => {
+      const user = userEvent.setup()
+      renderReadonlyAgentTools()
+
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.add',
+      })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.moreActions:{"name":"DuckDuckGo"}',
+      })).not.toBeInTheDocument()
+
+      await user.click(screen.getByRole('button', {
+        name: 'DuckDuckGo',
+      }))
+
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.editAction:{"name":"DuckDuckGo Search"}',
+      })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.removeAction:{"name":"DuckDuckGo Image Search"}',
+      })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.editAction:{"name":"Lark CLI"}',
+      })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.removeAction:{"name":"Lark CLI"}',
+      })).not.toBeInTheDocument()
+    })
+  })
+
+  describe('Display Metadata', () => {
+    it('should enrich reflected provider tools with provider icon and localized names', async () => {
+      const user = userEvent.setup()
+      toolProviderState.builtInTools = [googleProvider]
+      renderAgentTools(reflectedAgentToolsDraft)
+
+      expect(screen.getByRole('button', {
+        name: 'Google Tools',
+      })).toBeInTheDocument()
+      expect(screen.getByText('https://example.com/google.svg')).toBeInTheDocument()
+
+      await user.click(screen.getByRole('button', {
+        name: 'Google Tools',
+      }))
+
+      expect(screen.getByText('Google Search')).toBeInTheDocument()
+    })
+
+    it('should hide unauthorized status when reflected provider tools do not require credentials', () => {
+      toolProviderState.builtInTools = [duckDuckGoProvider]
+      renderAgentTools(reflectedUnauthorizedNoCredentialDraft)
+
+      expect(screen.getByRole('button', {
+        name: 'DuckDuckGo',
+      })).toBeInTheDocument()
+      expect(screen.queryByText('tools.notAuthorized')).not.toBeInTheDocument()
+    })
+
+    it('should open provider tool settings with catalog icon and parameters', async () => {
+      const user = userEvent.setup()
+      toolProviderState.builtInTools = [duckDuckGoProvider]
+      const { baseElement } = renderAgentTools()
+
+      await user.click(screen.getByRole('button', {
+        name: 'DuckDuckGo',
+      }))
+      await user.click(screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.editAction:{"name":"DuckDuckGo Search"}',
+      }))
+
+      expect(baseElement.querySelector('[style*="duckduckgo.svg"]')).toBeInTheDocument()
+      expect(screen.getByTestId('tool-setting-form')).toBeInTheDocument()
+      expect(screen.getByText('Search Query')).toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/__tests__/dialog.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/__tests__/dialog.spec.tsx
new file mode 100644
index 00000000000..77910c149b7
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/__tests__/dialog.spec.tsx
@@ -0,0 +1,169 @@
+import { toast } from '@langgenius/dify-ui/toast'
+import { fireEvent, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { CliToolDialog } from '../dialog'
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    error: vi.fn(),
+  },
+}))
+
+type CliToolDialogProps = Parameters<typeof CliToolDialog>[0]
+
+function renderCliToolDialog(props?: Partial<CliToolDialogProps>) {
+  const onOpenChange = vi.fn()
+  const onSaveCliTool = vi.fn()
+
+  render(
+    <CliToolDialog
+      open
+      onOpenChange={onOpenChange}
+      onSaveCliTool={onSaveCliTool}
+      {...props}
+    />,
+  )
+
+  return {
+    onOpenChange,
+    onSaveCliTool,
+  }
+}
+
+describe('CliToolDialog', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('Form Validation', () => {
+    it('should show a toast error when install command is empty', async () => {
+      const user = userEvent.setup()
+      const { onOpenChange, onSaveCliTool } = renderCliToolDialog()
+
+      await user.click(screen.getByRole('button', {
+        name: 'common.operation.add',
+      }))
+
+      expect(onSaveCliTool).not.toHaveBeenCalled()
+      expect(onOpenChange).not.toHaveBeenCalledWith(false)
+      expect(toast.error).toHaveBeenCalledWith('agentV2.agentDetail.configure.tools.cliDialog.installCommand.required')
+      expect(screen.queryByText('agentV2.agentDetail.configure.tools.cliDialog.installCommand.required')).not.toBeInTheDocument()
+    })
+
+    it('should show a toast error when CLI tool name is empty', async () => {
+      const user = userEvent.setup()
+      const { onOpenChange, onSaveCliTool } = renderCliToolDialog()
+
+      await user.type(
+        screen.getByRole('textbox', {
+          name: /agentV2\.agentDetail\.configure\.tools\.cliDialog\.installCommand\.label/,
+        }),
+        'npm install -g @lark/cli',
+      )
+      await user.click(screen.getByRole('button', {
+        name: 'common.operation.add',
+      }))
+
+      expect(onSaveCliTool).not.toHaveBeenCalled()
+      expect(onOpenChange).not.toHaveBeenCalledWith(false)
+      expect(toast.error).toHaveBeenCalledWith('agentV2.agentDetail.configure.tools.cliDialog.name.required')
+      expect(screen.queryByText('agentV2.agentDetail.configure.tools.cliDialog.name.required')).not.toBeInTheDocument()
+    })
+
+    it('should save a CLI tool when required fields are filled', async () => {
+      const user = userEvent.setup()
+      const { onOpenChange, onSaveCliTool } = renderCliToolDialog()
+
+      await user.type(
+        screen.getByRole('textbox', {
+          name: /agentV2\.agentDetail\.configure\.tools\.cliDialog\.installCommand\.label/,
+        }),
+        'npm install -g @lark/cli',
+      )
+      await user.type(
+        screen.getByRole('textbox', {
+          name: /agentV2\.agentDetail\.configure\.tools\.cliDialog\.name\.label/,
+        }),
+        'Lark CLI',
+      )
+      await user.click(screen.getByRole('button', {
+        name: 'common.operation.add',
+      }))
+
+      expect(onSaveCliTool).toHaveBeenCalledWith(expect.objectContaining({
+        kind: 'cli',
+        name: 'Lark CLI',
+        installCommand: 'npm install -g @lark/cli',
+      }))
+      expect(onOpenChange).toHaveBeenCalledWith(false)
+    })
+
+    it('should reject environment variable keys using the shared env editor rules', () => {
+      renderCliToolDialog()
+
+      const keyInput = screen.getByPlaceholderText('agentV2.agentDetail.configure.advancedSettings.envEditor.keyPlaceholder')
+
+      fireEvent.change(keyInput, {
+        target: { value: '1BAD' },
+      })
+
+      expect(keyInput).toHaveValue('')
+      expect(toast.error).toHaveBeenCalledWith('appDebug.varKeyError.notStartWithNumber:{"key":"agentV2.agentDetail.configure.advancedSettings.envEditor.keyColumn"}')
+    })
+  })
+
+  describe('Actions', () => {
+    it('should show save action when editing a CLI tool', () => {
+      renderCliToolDialog({
+        mode: 'edit',
+        tool: {
+          id: 'lark-cli',
+          kind: 'cli',
+          name: 'Lark CLI',
+          installCommand: 'npm install -g @lark/cli',
+        },
+      })
+
+      expect(screen.getByRole('button', {
+        name: 'common.operation.save',
+      })).toBeInTheDocument()
+      expect(screen.queryByRole('button', {
+        name: 'common.operation.add',
+      })).not.toBeInTheDocument()
+    })
+
+    it('should remove a CLI tool from the edit footer', async () => {
+      const user = userEvent.setup()
+      const onDeleteCliTool = vi.fn()
+      const { onOpenChange, onSaveCliTool } = renderCliToolDialog({
+        mode: 'edit',
+        onDeleteCliTool,
+        tool: {
+          id: 'lark-cli',
+          kind: 'cli',
+          name: 'Lark CLI',
+          installCommand: 'npm install -g @lark/cli',
+        },
+      })
+
+      await user.click(screen.getByRole('button', {
+        name: 'common.operation.remove',
+      }))
+
+      expect(onDeleteCliTool).toHaveBeenCalledWith('lark-cli')
+      expect(onOpenChange).toHaveBeenCalledWith(false)
+      expect(onSaveCliTool).not.toHaveBeenCalled()
+    })
+
+    it('should hide remove action when adding a CLI tool', () => {
+      renderCliToolDialog({
+        onDeleteCliTool: vi.fn(),
+      })
+
+      expect(screen.queryByRole('button', {
+        name: 'common.operation.remove',
+      })).not.toBeInTheDocument()
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/dialog.tsx
new file mode 100644
index 00000000000..0d3cecb68dd
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/dialog.tsx
@@ -0,0 +1,236 @@
+'use client'
+
+import type { AgentCliTool, EnvScope, EnvVariable } from '@/features/agent-v2/agent-composer/form-state'
+import { Button } from '@langgenius/dify-ui/button'
+import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { FieldControl, FieldDescription, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import { Form } from '@langgenius/dify-ui/form'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useCallback, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { EnvVariablesTable } from '../../advanced/env'
+
+type CliToolFormValues = {
+  installCommand?: string
+  name?: string
+}
+
+const createCliToolId = () => `cli-tool-${globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`}`
+
+const createCliEnvVariable = (): EnvVariable => ({
+  id: globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`,
+  key: '',
+  value: '',
+  scope: 'plain',
+})
+
+export function CliToolDialog({
+  mode = 'add',
+  onDeleteCliTool,
+  onSaveCliTool,
+  open,
+  onOpenChange,
+  tool,
+}: {
+  mode?: 'add' | 'edit'
+  onDeleteCliTool?: (toolId: string) => void
+  onSaveCliTool: (tool: AgentCliTool) => void
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  tool?: AgentCliTool | null
+}) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const [installCommand, setInstallCommand] = useState(tool?.installCommand ?? '')
+  const [toolName, setToolName] = useState(tool?.name ?? '')
+  const [envVariables, setEnvVariables] = useState<EnvVariable[]>(() => tool?.envVariables?.length ? tool.envVariables : [createCliEnvVariable()])
+
+  const resetForm = useCallback(() => {
+    setInstallCommand(tool?.installCommand ?? '')
+    setToolName(tool?.name ?? '')
+    setEnvVariables(tool?.envVariables?.length ? tool.envVariables : [createCliEnvVariable()])
+  }, [tool])
+
+  const handleOpenChange = useCallback((nextOpen: boolean) => {
+    if (nextOpen)
+      resetForm()
+
+    onOpenChange(nextOpen)
+  }, [onOpenChange, resetForm])
+
+  const updateEnvVariable = useCallback((id: string, updater: (variable: EnvVariable) => EnvVariable) => {
+    setEnvVariables(currentVariables => currentVariables.map(variable => (
+      variable.id === id ? updater(variable) : variable
+    )))
+  }, [])
+
+  const addEnvVariable = useCallback(() => {
+    setEnvVariables(currentVariables => [...currentVariables, createCliEnvVariable()])
+  }, [])
+
+  const deleteEnvVariable = useCallback((id: string) => {
+    setEnvVariables(currentVariables => currentVariables.length > 1
+      ? currentVariables.filter(variable => variable.id !== id)
+      : [createCliEnvVariable()],
+    )
+  }, [])
+
+  const handleKeyChange = useCallback((id: string, key: string) => {
+    updateEnvVariable(id, variable => ({ ...variable, key }))
+  }, [updateEnvVariable])
+
+  const handleScopeChange = useCallback((id: string, scope: EnvScope) => {
+    updateEnvVariable(id, variable => ({ ...variable, scope }))
+  }, [updateEnvVariable])
+
+  const handleValueChange = useCallback((id: string, value: string) => {
+    updateEnvVariable(id, variable => ({ ...variable, value }))
+  }, [updateEnvVariable])
+
+  const handleSubmit = useCallback((formValues: CliToolFormValues) => {
+    const trimmedName = formValues.name?.trim() || toolName.trim()
+    const trimmedInstallCommand = formValues.installCommand?.trim() || installCommand.trim()
+
+    if (!trimmedInstallCommand) {
+      toast.error(t('agentDetail.configure.tools.cliDialog.installCommand.required'))
+      return
+    }
+    if (!trimmedName) {
+      toast.error(t('agentDetail.configure.tools.cliDialog.name.required'))
+      return
+    }
+
+    onSaveCliTool({
+      ...tool,
+      id: tool?.id ?? createCliToolId(),
+      kind: 'cli',
+      name: trimmedName,
+      installCommand: trimmedInstallCommand,
+      envVariables,
+    })
+    setInstallCommand('')
+    setToolName('')
+    setEnvVariables([createCliEnvVariable()])
+    onOpenChange(false)
+  }, [envVariables, installCommand, onOpenChange, onSaveCliTool, t, tool, toolName])
+
+  const handleCancel = useCallback(() => {
+    onOpenChange(false)
+  }, [onOpenChange])
+
+  const handleDelete = useCallback(() => {
+    if (!tool)
+      return
+
+    onDeleteCliTool?.(tool.id)
+    onOpenChange(false)
+  }, [onDeleteCliTool, onOpenChange, tool])
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent className="flex max-h-[calc(100dvh-2rem)] w-[640px] flex-col overflow-hidden p-0">
+        <div className="relative px-6 pt-6 pb-3">
+          <DialogCloseButton className="top-5 right-5" />
+          <DialogTitle className="title-2xl-semi-bold text-text-primary">
+            {t(mode === 'edit' ? 'agentDetail.configure.tools.cliDialog.editTitle' : 'agentDetail.configure.tools.cliDialog.title')}
+          </DialogTitle>
+          <DialogDescription className="mt-1 system-xs-regular text-text-tertiary">
+            {t('agentDetail.configure.tools.cliDialog.description')}
+          </DialogDescription>
+        </div>
+        <Form<CliToolFormValues>
+          className="min-h-0 flex-1 overflow-y-auto px-6 py-3"
+          onFormSubmit={handleSubmit}
+        >
+          <div className="flex flex-col gap-4">
+            <FieldRoot name="installCommand">
+              <FieldLabel>
+                {t('agentDetail.configure.tools.cliDialog.installCommand.label')}
+              </FieldLabel>
+              <FieldDescription>
+                {t('agentDetail.configure.tools.cliDialog.installCommand.description')}
+              </FieldDescription>
+              <FieldControl
+                autoComplete="off"
+                onValueChange={setInstallCommand}
+                placeholder={t('agentDetail.configure.tools.cliDialog.installCommand.placeholder')}
+                value={installCommand}
+              />
+            </FieldRoot>
+            <FieldRoot name="name">
+              <FieldLabel>
+                {t('agentDetail.configure.tools.cliDialog.name.label')}
+              </FieldLabel>
+              <FieldControl
+                autoComplete="off"
+                onValueChange={setToolName}
+                placeholder={t('agentDetail.configure.tools.cliDialog.name.placeholder')}
+                value={toolName}
+              />
+            </FieldRoot>
+            <div className="pt-1">
+              <div className="mb-3 h-px bg-divider-subtle" />
+              <div className="mb-1 flex min-h-6 items-center gap-1">
+                <span className="system-sm-medium text-text-secondary">
+                  {t('agentDetail.configure.tools.cliDialog.env.label')}
+                </span>
+                <span className="system-xs-regular text-text-tertiary">
+                  {t('agentDetail.configure.tools.cliDialog.env.optional')}
+                </span>
+              </div>
+              <p className="mb-2 body-xs-regular text-text-tertiary">
+                {t('agentDetail.configure.tools.cliDialog.env.description')}
+              </p>
+              <EnvVariablesTable
+                editable
+                envVariables={envVariables}
+                onAdd={addEnvVariable}
+                onDelete={deleteEnvVariable}
+                onKeyChange={handleKeyChange}
+                onScopeChange={handleScopeChange}
+                onValueChange={handleValueChange}
+                showDraftRow={false}
+                showScope={false}
+              />
+            </div>
+          </div>
+          <div className="flex items-center gap-3 py-8">
+            <a
+              href="https://docs.dify.ai/"
+              target="_blank"
+              rel="noreferrer"
+              className="inline-flex min-w-0 flex-1 items-center gap-1 system-xs-regular text-text-accent hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            >
+              <span>{t('agentDetail.configure.tools.cliDialog.learnMore')}</span>
+              <span aria-hidden className="i-ri-external-link-line size-3" />
+            </a>
+            <div className="flex shrink-0 items-center gap-3">
+              {mode === 'edit' && tool && onDeleteCliTool && (
+                <div className="flex items-center gap-3">
+                  <Button type="button" tone="destructive" onClick={handleDelete}>
+                    {tCommon('operation.remove')}
+                  </Button>
+                  <div className="h-4 w-px bg-divider-regular" aria-hidden />
+                </div>
+              )}
+              <div className="flex items-center gap-2">
+                <Button type="button" onClick={handleCancel}>
+                  {tCommon('operation.cancel')}
+                </Button>
+                <Button type="submit" variant="primary">
+                  {tCommon(mode === 'edit' ? 'operation.save' : 'operation.add')}
+                </Button>
+              </div>
+            </div>
+          </div>
+        </Form>
+        <div className="flex items-start justify-center gap-1 border-t-[0.5px] border-divider-subtle bg-background-soft px-2 py-3">
+          <span aria-hidden className="mt-0.5 i-ri-lock-2-fill size-3 text-text-tertiary" />
+          <p className="system-xs-regular text-text-tertiary">
+            {t('agentDetail.configure.tools.cliDialog.securityTip')}
+          </p>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/item.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/item.tsx
new file mode 100644
index 00000000000..21f7604a36e
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/item.tsx
@@ -0,0 +1,37 @@
+'use client'
+
+import type { AgentCliTool } from '@/features/agent-v2/agent-composer/form-state'
+import { useTranslation } from 'react-i18next'
+import { ConfigureSectionConfigurableItem } from '../../common/configurable-item'
+
+function CliIcon() {
+  return (
+    <span className="flex size-5 shrink-0 items-center justify-center rounded-md border border-divider-regular bg-text-tertiary p-1 text-text-primary-on-surface">
+      <span aria-hidden className="i-ri-terminal-box-line size-3.5" />
+    </span>
+  )
+}
+
+export function AgentCliToolItem({
+  onDelete,
+  onEdit,
+  tool,
+}: {
+  onDelete: () => void
+  onEdit: () => void
+  tool: AgentCliTool
+}) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <ConfigureSectionConfigurableItem
+      icon={<CliIcon />}
+      label={tool.name}
+      badge={t('agentDetail.configure.tools.cliTool')}
+      editAriaLabel={t('agentDetail.configure.tools.editAction', { name: tool.name })}
+      removeAriaLabel={t('agentDetail.configure.tools.removeAction', { name: tool.name })}
+      onEdit={onEdit}
+      onRemove={onDelete}
+    />
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/hooks.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/hooks.ts
new file mode 100644
index 00000000000..9be5cebfc91
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/hooks.ts
@@ -0,0 +1,211 @@
+'use client'
+
+import type { AgentProviderToolDefaultValue, ToolSettingTarget } from './types'
+import type { ToolValue } from '@/app/components/workflow/block-selector/types'
+import type { AgentCliTool, AgentTool } from '@/features/agent-v2/agent-composer/form-state'
+import { useAtom } from 'jotai'
+import { useCallback, useMemo, useState } from 'react'
+import { agentComposerToolsAtom, useRemoveProviderTool, useRemoveProviderToolAction } from '@/features/agent-v2/agent-composer/store-modules/tools'
+
+const toSelectedToolValue = (tool: AgentTool): ToolValue[] => {
+  if (tool.kind !== 'provider')
+    return []
+
+  return tool.actions.map(action => ({
+    provider_name: tool.id,
+    tool_name: action.toolName,
+    tool_label: action.name,
+    tool_description: action.description,
+  }))
+}
+
+const toProviderToolAction = (tool: AgentProviderToolDefaultValue) => ({
+  id: `${tool.provider_id}:${tool.tool_name}`,
+  name: tool.tool_label || tool.title || tool.tool_name,
+  toolName: tool.tool_name,
+  description: tool.tool_description || '',
+})
+
+const getCredentialVariant = (tool: AgentProviderToolDefaultValue) => {
+  if (!tool.credentialRequired)
+    return 'none' as const
+
+  if (!tool.allowDelete)
+    return tool.credential_id ? 'authorized' as const : 'unauthorized' as const
+
+  return tool.is_team_authorization ? 'authorized' as const : 'unauthorized' as const
+}
+
+const getCredentialType = (tool: AgentProviderToolDefaultValue) => {
+  if (!tool.credentialRequired)
+    return undefined
+
+  if (!tool.allowDelete)
+    return tool.credential_id ? 'api-key' as const : 'unauthorized' as const
+
+  return tool.is_team_authorization ? 'api-key' as const : 'unauthorized' as const
+}
+
+export const addProviderTools = (
+  currentTools: AgentTool[],
+  selectedTools: AgentProviderToolDefaultValue[],
+): AgentTool[] => {
+  if (selectedTools.length === 0)
+    return currentTools
+
+  const nextTools = [...currentTools]
+
+  selectedTools.forEach((selectedTool) => {
+    const action = toProviderToolAction(selectedTool)
+    const existingToolIndex = nextTools.findIndex(tool => tool.kind === 'provider' && tool.id === selectedTool.provider_id)
+    const existingTool = nextTools[existingToolIndex]
+
+    if (existingTool?.kind === 'provider') {
+      if (existingTool.actions.some(existingAction => existingAction.toolName === action.toolName))
+        return
+
+      nextTools[existingToolIndex] = {
+        ...existingTool,
+        displayName: existingTool.displayName ?? selectedTool.provider_show_name,
+        icon: existingTool.icon ?? selectedTool.provider_icon,
+        iconDark: existingTool.iconDark ?? selectedTool.provider_icon_dark,
+        allowDelete: existingTool.allowDelete ?? selectedTool.allowDelete,
+        actions: [...existingTool.actions, action],
+      }
+      return
+    }
+
+    nextTools.push({
+      id: selectedTool.provider_id,
+      name: selectedTool.provider_name,
+      kind: 'provider',
+      displayName: selectedTool.provider_show_name,
+      iconClassName: 'i-custom-public-other-default-tool-icon text-text-tertiary',
+      icon: selectedTool.provider_icon,
+      iconDark: selectedTool.provider_icon_dark,
+      providerType: selectedTool.provider_type,
+      allowDelete: selectedTool.allowDelete,
+      credentialId: selectedTool.credential_id,
+      credentialKey: selectedTool.is_team_authorization
+        ? 'agentDetail.configure.tools.credential.authOne'
+        : undefined,
+      credentialType: getCredentialType(selectedTool),
+      credentialVariant: getCredentialVariant(selectedTool),
+      actions: [action],
+    })
+  })
+
+  return nextTools
+}
+
+export function useAgentToolsOperations() {
+  const [tools, setTools] = useAtom(agentComposerToolsAtom)
+  const removeProviderTool = useRemoveProviderTool()
+  const removeProviderToolAction = useRemoveProviderToolAction()
+  const [expandedToolIds, setExpandedToolIds] = useState<Set<string>>(() => new Set())
+  const [settingTarget, setSettingTarget] = useState<ToolSettingTarget | null>(null)
+  const [isCliToolDialogOpen, setIsCliToolDialogOpen] = useState(false)
+  const [editingCliTool, setEditingCliTool] = useState<AgentCliTool | null>(null)
+
+  const setToolOpen = useCallback((tool: AgentTool, open: boolean) => {
+    if (tool.kind === 'cli')
+      return
+
+    setExpandedToolIds((currentIds) => {
+      const nextIds = new Set(currentIds)
+      if (open)
+        nextIds.add(tool.id)
+      else
+        nextIds.delete(tool.id)
+
+      return nextIds
+    })
+  }, [])
+
+  const addTools = useCallback((selectedTools: AgentProviderToolDefaultValue[]) => {
+    setTools(addProviderTools(tools, selectedTools))
+  }, [setTools, tools])
+
+  const deleteCliTool = useCallback((toolId: string) => {
+    setTools(tools.filter(tool => tool.id !== toolId))
+  }, [setTools, tools])
+
+  const openCliToolDialog = useCallback(() => {
+    setEditingCliTool(null)
+    setIsCliToolDialogOpen(true)
+  }, [])
+
+  const editCliTool = useCallback((tool: AgentCliTool) => {
+    setEditingCliTool(tool)
+    setIsCliToolDialogOpen(true)
+  }, [])
+
+  const handleCliDialogSave = useCallback((tool: AgentCliTool) => {
+    if (editingCliTool)
+      setTools(tools.map(currentTool => currentTool.id === tool.id ? tool : currentTool))
+    else
+      setTools([...tools, tool])
+
+    setEditingCliTool(null)
+  }, [editingCliTool, setTools, tools])
+
+  const handleCliDialogOpenChange = useCallback((open: boolean) => {
+    if (!open)
+      setEditingCliTool(null)
+
+    setIsCliToolDialogOpen(open)
+  }, [])
+
+  const closeSettingTargetIfRemoved = useCallback((toolId: string, actionId?: string) => {
+    setSettingTarget((target) => {
+      if (!target || target.tool.id !== toolId)
+        return target
+      if (actionId && target.action.id !== actionId)
+        return target
+
+      return null
+    })
+  }, [])
+
+  const deleteProviderTool = useCallback((toolId: string) => {
+    setExpandedToolIds((currentIds) => {
+      const nextIds = new Set(currentIds)
+      nextIds.delete(toolId)
+      return nextIds
+    })
+    closeSettingTargetIfRemoved(toolId)
+    removeProviderTool(toolId)
+  }, [closeSettingTargetIfRemoved, removeProviderTool])
+
+  const deleteProviderToolAction = useCallback((toolId: string, actionId: string) => {
+    closeSettingTargetIfRemoved(toolId, actionId)
+    removeProviderToolAction(toolId, actionId)
+  }, [closeSettingTargetIfRemoved, removeProviderToolAction])
+
+  const closeProviderSettingsDialog = useCallback(() => {
+    setSettingTarget(null)
+  }, [])
+
+  const selectedTools = useMemo(() => tools.flatMap(toSelectedToolValue), [tools])
+
+  return {
+    tools,
+    selectedTools,
+    expandedToolIds,
+    settingTarget,
+    isCliToolDialogOpen,
+    editingCliTool,
+    setTools,
+    setToolOpen,
+    setSettingTarget,
+    addTools,
+    deleteCliTool,
+    deleteProviderTool,
+    deleteProviderToolAction,
+    openCliToolDialog,
+    editCliTool,
+    handleCliDialogSave,
+    handleCliDialogOpenChange,
+    closeProviderSettingsDialog,
+  }
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/index.tsx
new file mode 100644
index 00000000000..7c8a12e8ca4
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/index.tsx
@@ -0,0 +1,469 @@
+'use client'
+
+import type { AgentOrchestrateAddActionOptions } from '../add-actions-context'
+import type { AgentProviderToolDefaultValue, ToolSettingTarget } from './types'
+import type { ToolDefaultValue, ToolValue } from '@/app/components/workflow/block-selector/types'
+import type { ToolWithProvider } from '@/app/components/workflow/types'
+import type { AgentCliTool, AgentProviderTool, AgentTool } from '@/features/agent-v2/agent-composer/form-state'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { ToolPickerContent } from '@/app/components/workflow/block-selector/tool-picker'
+import { useGetLanguage } from '@/context/i18n'
+import { useSetProviderToolCredential } from '@/features/agent-v2/agent-composer/store-modules/tools'
+import {
+  useAllBuiltInTools,
+  useAllCustomTools,
+  useAllMCPTools,
+  useAllWorkflowTools,
+} from '@/service/use-tools'
+import { useRegisterAgentOrchestrateAddAction } from '../add-actions-context'
+import { ConfigureSectionAddButton } from '../common/add-button'
+import { ConfigureSectionEmpty } from '../common/empty'
+import { ConfigureSection } from '../common/section'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
+import { CliToolDialog } from './cli-tool/dialog'
+import { AgentCliToolItem } from './cli-tool/item'
+import { useAgentToolsOperations } from './hooks'
+import { ProviderToolSettingsDialog } from './provider-tool/dialog'
+import { AgentProviderToolItem } from './provider-tool/item'
+
+function AgentToolItem({
+  tool,
+  isExpanded,
+  onOpenChange,
+  onConfigureAction,
+  onDeleteCliTool,
+  onDeleteProviderTool,
+  onDeleteProviderToolAction,
+  onEditCliTool,
+  onCredentialChange,
+}: {
+  tool: AgentTool
+  isExpanded: boolean
+  onOpenChange: (tool: AgentTool, open: boolean) => void
+  onConfigureAction: (target: ToolSettingTarget) => void
+  onDeleteCliTool: (toolId: string) => void
+  onDeleteProviderTool: (toolId: string) => void
+  onDeleteProviderToolAction: (toolId: string, actionId: string) => void
+  onEditCliTool: (tool: AgentCliTool) => void
+  onCredentialChange: (toolId: string, credentialId?: string) => void
+}) {
+  const handleOpenChange = useCallback((open: boolean) => {
+    onOpenChange(tool, open)
+  }, [onOpenChange, tool])
+
+  const handleRemoveProvider = useCallback(() => {
+    onDeleteProviderTool(tool.id)
+  }, [onDeleteProviderTool, tool.id])
+
+  const handleRemoveProviderAction = useCallback((actionId: string) => {
+    onDeleteProviderToolAction(tool.id, actionId)
+  }, [onDeleteProviderToolAction, tool.id])
+
+  const handleDeleteCliTool = useCallback(() => {
+    onDeleteCliTool(tool.id)
+  }, [onDeleteCliTool, tool.id])
+
+  const handleEditCliTool = useCallback(() => {
+    if (tool.kind === 'cli')
+      onEditCliTool(tool)
+  }, [onEditCliTool, tool])
+
+  const handleCredentialChange = useCallback((credentialId?: string) => {
+    onCredentialChange(tool.id, credentialId)
+  }, [onCredentialChange, tool.id])
+
+  if (tool.kind === 'provider') {
+    return (
+      <AgentProviderToolItem
+        tool={tool}
+        isExpanded={isExpanded}
+        onOpenChange={handleOpenChange}
+        onConfigureAction={onConfigureAction}
+        onRemoveAction={handleRemoveProviderAction}
+        onRemoveProvider={handleRemoveProvider}
+        onCredentialChange={handleCredentialChange}
+      />
+    )
+  }
+
+  return (
+    <AgentCliToolItem
+      tool={tool}
+      onDelete={handleDeleteCliTool}
+      onEdit={handleEditCliTool}
+    />
+  )
+}
+
+function useAgentToolProviderMap() {
+  const { data: buildInTools } = useAllBuiltInTools()
+  const { data: customTools } = useAllCustomTools()
+  const { data: workflowTools } = useAllWorkflowTools()
+  const { data: mcpTools } = useAllMCPTools()
+
+  return useMemo(() => {
+    const providers = new Map<string, ToolWithProvider>()
+    const buildInToolList = Array.isArray(buildInTools) ? buildInTools : []
+    const customToolList = Array.isArray(customTools) ? customTools : []
+    const workflowToolList = Array.isArray(workflowTools) ? workflowTools : []
+    const mcpToolList = Array.isArray(mcpTools) ? mcpTools : []
+    const allProviders = [
+      ...buildInToolList,
+      ...customToolList,
+      ...workflowToolList,
+      ...mcpToolList,
+    ]
+
+    allProviders.forEach((provider) => {
+      providers.set(provider.id, provider)
+      providers.set(provider.name, provider)
+      if (provider.plugin_id) {
+        providers.set(provider.plugin_id, provider)
+        providers.set(`${provider.plugin_id}/${provider.name}`, provider)
+      }
+    })
+
+    return providers
+  }, [buildInTools, customTools, workflowTools, mcpTools])
+}
+
+function getLocalizedText(
+  text: Record<string, string> | undefined,
+  language: string,
+) {
+  return text?.[language] ?? text?.en_US ?? text?.zh_Hans
+}
+
+function getProviderCredentialRequired(provider?: ToolWithProvider) {
+  return Object.keys(provider?.team_credentials ?? {}).length > 0
+}
+
+function useDisplayTools(
+  tools: AgentTool[],
+  providerById: Map<string, ToolWithProvider>,
+) {
+  const language = useGetLanguage()
+
+  return useMemo(() => {
+    return tools.map((tool) => {
+      if (tool.kind !== 'provider')
+        return tool
+
+      const provider = providerById.get(tool.id)
+        ?? providerById.get(tool.name)
+
+      if (!provider)
+        return tool
+
+      const providerToolByName = new Map(provider.tools.map(providerTool => [providerTool.name, providerTool]))
+      const credentialRequired = getProviderCredentialRequired(provider)
+
+      return {
+        ...tool,
+        displayName: tool.displayName ?? getLocalizedText(provider.label, language) ?? tool.name,
+        icon: tool.icon ?? provider.icon,
+        iconDark: tool.iconDark ?? provider.icon_dark,
+        providerType: tool.providerType ?? provider.type,
+        allowDelete: tool.allowDelete ?? provider.allow_delete,
+        credentialKey: credentialRequired ? tool.credentialKey : undefined,
+        credentialType: credentialRequired ? tool.credentialType : undefined,
+        credentialVariant: credentialRequired ? tool.credentialVariant : 'none',
+        actions: tool.actions.map((action) => {
+          const providerTool = providerToolByName.get(action.toolName)
+
+          if (!providerTool)
+            return action
+
+          return {
+            ...action,
+            name: action.name === action.toolName
+              ? getLocalizedText(providerTool.label, language) ?? action.name
+              : action.name,
+            description: action.description || getLocalizedText(providerTool.description, language) || '',
+          }
+        }),
+      } satisfies AgentProviderTool
+    })
+  }, [language, providerById, tools])
+}
+
+function AddToolMenuItem({
+  badge,
+  description,
+  iconClassName,
+  label,
+  onClick,
+}: {
+  badge?: string
+  description: string
+  iconClassName: string
+  label: string
+  onClick?: () => void
+}) {
+  return (
+    <button
+      type="button"
+      onClick={onClick}
+      className="flex w-full items-start gap-2 rounded-lg py-2 pr-3 pl-2 text-left hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+    >
+      <span aria-hidden className={cn('mt-0.5 size-4 shrink-0 text-text-secondary', iconClassName)} />
+      <span className="flex min-w-0 flex-1 flex-col gap-0.5">
+        <span className="flex min-w-0 items-center gap-1">
+          <span className="truncate system-sm-semibold text-text-secondary">
+            {label}
+          </span>
+          {badge && (
+            <span className="shrink-0 rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary">
+              {badge}
+            </span>
+          )}
+        </span>
+        <span className="system-xs-regular text-text-tertiary">
+          {description}
+        </span>
+      </span>
+    </button>
+  )
+}
+
+function AddToolMenu({
+  onAddCliTool,
+  onAddTools,
+  selectedTools,
+}: {
+  onAddCliTool: () => void
+  onAddTools: (tools: AgentProviderToolDefaultValue[]) => void
+  selectedTools: ToolValue[]
+}) {
+  const { t } = useTranslation('agentV2')
+  const [open, setOpen] = useState(false)
+  const [view, setView] = useState<'menu' | 'tool-picker'>('menu')
+  const providerById = useAgentToolProviderMap()
+
+  const openToolPicker = useCallback(() => {
+    setView('tool-picker')
+  }, [])
+
+  const openCliToolDialog = useCallback(() => {
+    setOpen(false)
+    onAddCliTool()
+  }, [onAddCliTool])
+
+  const handleOpenChange = useCallback((nextOpen: boolean) => {
+    setOpen(nextOpen)
+
+    if (nextOpen)
+      setView('menu')
+  }, [])
+
+  const toAgentToolDefaultValue = useCallback((tool: ToolDefaultValue): AgentProviderToolDefaultValue => ({
+    ...tool,
+    allowDelete: (providerById.get(tool.provider_id)
+      ?? providerById.get(tool.provider_name)
+      ?? (tool.plugin_id ? providerById.get(tool.plugin_id) : undefined))?.allow_delete,
+    credentialRequired: getProviderCredentialRequired(providerById.get(tool.provider_id)
+      ?? providerById.get(tool.provider_name)
+      ?? (tool.plugin_id ? providerById.get(tool.plugin_id) : undefined)),
+  }), [providerById])
+
+  const handleSelectTool = useCallback((tool: ToolDefaultValue) => {
+    onAddTools([toAgentToolDefaultValue(tool)])
+  }, [onAddTools, toAgentToolDefaultValue])
+
+  const handleSelectMultipleTools = useCallback((tools: ToolDefaultValue[]) => {
+    onAddTools(tools.map(toAgentToolDefaultValue))
+  }, [onAddTools, toAgentToolDefaultValue])
+
+  return (
+    <Popover open={open} onOpenChange={handleOpenChange}>
+      <PopoverTrigger
+        render={(
+          <ConfigureSectionAddButton ariaLabel={t('agentDetail.configure.tools.add')} />
+        )}
+      />
+      <PopoverContent
+        placement="bottom-end"
+        sideOffset={4}
+        popupClassName={view === 'menu'
+          ? 'w-[280px] bg-components-panel-bg-blur p-1 shadow-lg backdrop-blur-[5px]'
+          : 'w-[400px] overflow-hidden border-none bg-transparent p-0 shadow-none'}
+      >
+        {view === 'menu'
+          ? (
+              <>
+                <AddToolMenuItem
+                  iconClassName="i-ri-box-3-line"
+                  label={t('agentDetail.configure.tools.addMenu.tool.label')}
+                  description={t('agentDetail.configure.tools.addMenu.tool.description')}
+                  onClick={openToolPicker}
+                />
+                <AddToolMenuItem
+                  iconClassName="i-ri-terminal-box-line"
+                  label={t('agentDetail.configure.tools.addMenu.cliTool.label')}
+                  badge={t('agentDetail.configure.tools.addMenu.cliTool.badge')}
+                  description={t('agentDetail.configure.tools.addMenu.cliTool.description')}
+                  onClick={openCliToolDialog}
+                />
+              </>
+            )
+          : (
+              <ToolPickerContent
+                focusSearchOnMount
+                panelClassName="w-full"
+                supportAddCustomTool
+                selectedTools={selectedTools}
+                onSelect={handleSelectTool}
+                onSelectMultiple={handleSelectMultipleTools}
+              />
+            )}
+      </PopoverContent>
+    </Popover>
+  )
+}
+
+export function AgentTools() {
+  const { t } = useTranslation('agentV2')
+  const readOnly = useAgentOrchestrateReadOnly()
+  const setProviderToolCredential = useSetProviderToolCredential()
+  const providerById = useAgentToolProviderMap()
+  const {
+    tools,
+    selectedTools,
+    expandedToolIds,
+    settingTarget,
+    isCliToolDialogOpen,
+    editingCliTool,
+    setTools,
+    setToolOpen,
+    setSettingTarget,
+    addTools,
+    deleteCliTool,
+    deleteProviderTool,
+    deleteProviderToolAction,
+    openCliToolDialog,
+    editCliTool,
+    handleCliDialogSave,
+    handleCliDialogOpenChange,
+    closeProviderSettingsDialog,
+  } = useAgentToolsOperations()
+  const displayTools = useDisplayTools(tools, providerById)
+  useEffect(() => {
+    if (readOnly)
+      return
+
+    let shouldSyncCredentials = false
+    const nextTools = tools.map((tool, index) => {
+      const displayTool = displayTools[index]
+
+      if (tool.kind !== 'provider' || displayTool?.kind !== 'provider')
+        return tool
+
+      if (
+        tool.allowDelete === displayTool.allowDelete
+        && tool.credentialKey === displayTool.credentialKey
+        && tool.credentialType === displayTool.credentialType
+        && tool.credentialVariant === displayTool.credentialVariant
+      ) {
+        return tool
+      }
+
+      shouldSyncCredentials = true
+      return {
+        ...tool,
+        allowDelete: displayTool.allowDelete,
+        credentialKey: displayTool.credentialKey,
+        credentialType: displayTool.credentialType,
+        credentialVariant: displayTool.credentialVariant,
+      }
+    })
+
+    if (shouldSyncCredentials)
+      setTools(nextTools)
+  }, [displayTools, readOnly, setTools, tools])
+  const promptAddCallbackRef = useRef<AgentOrchestrateAddActionOptions['onAdded']>(undefined)
+  const openCliToolDialogFromPrompt = useCallback((options?: AgentOrchestrateAddActionOptions) => {
+    promptAddCallbackRef.current = options?.onAdded
+    openCliToolDialog()
+  }, [openCliToolDialog])
+  const handleCliDialogSaveWithPromptInsert = useCallback((tool: AgentCliTool) => {
+    handleCliDialogSave(tool)
+    if (!editingCliTool) {
+      promptAddCallbackRef.current?.(tool)
+      promptAddCallbackRef.current = undefined
+    }
+  }, [editingCliTool, handleCliDialogSave])
+  const handleCliDialogOpenChangeWithPromptInsert = useCallback((open: boolean) => {
+    if (!open)
+      promptAddCallbackRef.current = undefined
+    handleCliDialogOpenChange(open)
+  }, [handleCliDialogOpenChange])
+  useRegisterAgentOrchestrateAddAction('cli', openCliToolDialogFromPrompt)
+  const toolsTip = t('agentDetail.configure.tools.tip')
+  const toolsListId = 'agent-configure-tools-list'
+  const settingTargetCollection = settingTarget
+    ? providerById.get(settingTarget.tool.id)
+    ?? providerById.get(settingTarget.tool.name)
+    : undefined
+
+  return (
+    <>
+      <ConfigureSection
+        label={t('agentDetail.configure.tools.label')}
+        labelId="agent-configure-tools-label"
+        panelId={toolsListId}
+        tip={toolsTip}
+        tipAriaLabel={toolsTip}
+        rootClassName="border-b border-divider-subtle pt-4"
+        panelContentClassName="flex flex-col gap-1 pb-4"
+        actions={!readOnly
+          ? (
+              <AddToolMenu
+                onAddCliTool={openCliToolDialog}
+                onAddTools={addTools}
+                selectedTools={selectedTools}
+              />
+            )
+          : undefined}
+      >
+        {displayTools.length === 0
+          ? (
+              <ConfigureSectionEmpty
+                title={t('agentDetail.configure.tools.empty.title')}
+                description={t('agentDetail.configure.tools.empty.description')}
+              />
+            )
+          : displayTools.map(tool => (
+              <AgentToolItem
+                key={tool.id}
+                tool={tool}
+                isExpanded={tool.kind === 'provider' && expandedToolIds.has(tool.id)}
+                onOpenChange={setToolOpen}
+                onConfigureAction={setSettingTarget}
+                onDeleteCliTool={deleteCliTool}
+                onDeleteProviderTool={deleteProviderTool}
+                onDeleteProviderToolAction={deleteProviderToolAction}
+                onEditCliTool={editCliTool}
+                onCredentialChange={setProviderToolCredential}
+              />
+            ))}
+      </ConfigureSection>
+      <ProviderToolSettingsDialog
+        settingTarget={settingTarget}
+        collection={settingTargetCollection}
+        onClose={closeProviderSettingsDialog}
+      />
+      <CliToolDialog
+        key={`${editingCliTool?.id ?? 'add'}:${isCliToolDialogOpen ? 'open' : 'closed'}`}
+        mode={editingCliTool ? 'edit' : 'add'}
+        tool={editingCliTool}
+        onDeleteCliTool={deleteCliTool}
+        onSaveCliTool={handleCliDialogSaveWithPromptInsert}
+        open={isCliToolDialogOpen}
+        onOpenChange={handleCliDialogOpenChangeWithPromptInsert}
+      />
+    </>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/provider-tool/dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/provider-tool/dialog.tsx
new file mode 100644
index 00000000000..53673b384da
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/provider-tool/dialog.tsx
@@ -0,0 +1,86 @@
+'use client'
+
+import type { ToolSettingTarget } from '../types'
+import type { Tool } from '@/app/components/tools/types'
+import type { ToolWithProvider } from '@/app/components/workflow/types'
+import type { AgentProviderTool } from '@/features/agent-v2/agent-composer/form-state'
+import { useAtom } from 'jotai'
+import { useCallback, useMemo } from 'react'
+import SettingBuiltInTool from '@/app/components/app/configuration/config/agent/agent-tools/setting-built-in-tool'
+import { CollectionType } from '@/app/components/tools/types'
+import { agentComposerToolSettingsAtom } from '@/features/agent-v2/agent-composer/store-modules/tools'
+
+const localize = (value: string) => ({
+  en_US: value,
+  zh_Hans: value,
+})
+
+const createFallbackToolCollection = (tool: AgentProviderTool): ToolWithProvider => ({
+  id: tool.id,
+  name: tool.id,
+  author: tool.name,
+  description: localize(`${tool.name} tools`),
+  icon: tool.icon ?? '',
+  icon_dark: tool.iconDark,
+  label: localize(tool.displayName ?? tool.name),
+  type: (tool.providerType as CollectionType | undefined) ?? CollectionType.builtIn,
+  team_credentials: {},
+  is_team_authorization: true,
+  allow_delete: tool.allowDelete ?? false,
+  labels: [],
+  meta: {
+    version: '0.0.0',
+  },
+  tools: tool.actions.map<Tool>(action => ({
+    name: action.toolName,
+    author: tool.name,
+    label: localize(action.name),
+    description: localize(action.description),
+    parameters: [],
+    labels: [],
+    output_schema: {},
+  })),
+}) as ToolWithProvider
+
+export function ProviderToolSettingsDialog({
+  settingTarget,
+  collection,
+  onClose,
+}: {
+  settingTarget: ToolSettingTarget | null
+  collection?: ToolWithProvider
+  onClose: () => void
+}) {
+  const [toolSettings, setToolSettings] = useAtom(agentComposerToolSettingsAtom)
+  const toolCollection = useMemo(() => {
+    if (!settingTarget)
+      return null
+
+    return collection ?? createFallbackToolCollection(settingTarget.tool)
+  }, [collection, settingTarget])
+  const handleSave = useCallback((value: Record<string, unknown>) => {
+    if (!settingTarget)
+      return
+
+    setToolSettings({
+      ...toolSettings,
+      [settingTarget.action.id]: value,
+    })
+    onClose()
+  }, [onClose, setToolSettings, settingTarget, toolSettings])
+
+  if (!settingTarget || !toolCollection)
+    return null
+
+  return (
+    <SettingBuiltInTool
+      toolName={settingTarget.action.toolName}
+      setting={toolSettings[settingTarget.action.id]}
+      collection={toolCollection}
+      isModel={false}
+      credentialId={settingTarget.tool.credentialId}
+      onSave={handleSave}
+      onHide={onClose}
+    />
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/provider-tool/item.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/provider-tool/item.tsx
new file mode 100644
index 00000000000..8c15189c56b
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/provider-tool/item.tsx
@@ -0,0 +1,292 @@
+'use client'
+
+import type { ToolSettingTarget } from '../types'
+import type { AgentProviderTool, AgentToolAction } from '@/features/agent-v2/agent-composer/form-state'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  CollapsiblePanel,
+  CollapsibleRoot,
+  CollapsibleTrigger,
+} from '@langgenius/dify-ui/collapsible'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { StatusDot } from '@langgenius/dify-ui/status-dot'
+import { useCallback, useMemo, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import {
+  AuthCategory,
+} from '@/app/components/plugins/plugin-auth'
+import ApiKeyModal from '@/app/components/plugins/plugin-auth/authorize/api-key-modal'
+import AuthorizedInNode from '@/app/components/plugins/plugin-auth/authorized-in-node'
+import { useInvalidPluginCredentialInfoHook } from '@/app/components/plugins/plugin-auth/hooks/use-credential'
+import { CollectionType } from '@/app/components/tools/types'
+import BlockIcon from '@/app/components/workflow/block-icon'
+import { BlockEnum } from '@/app/components/workflow/types'
+import useTheme from '@/hooks/use-theme'
+import { Theme } from '@/types/app'
+import { useAgentOrchestrateReadOnly } from '../../read-only-context'
+
+function ProviderIcon({
+  icon,
+  iconClassName,
+}: {
+  icon?: AgentProviderTool['icon']
+  iconClassName: string
+}) {
+  if (icon) {
+    return (
+      <BlockIcon
+        className="shrink-0"
+        type={BlockEnum.Tool}
+        toolIcon={icon}
+      />
+    )
+  }
+
+  return (
+    <span className="flex size-5 shrink-0 items-center justify-center rounded-md border-[0.5px] border-effects-icon-border bg-background-default-dodge">
+      <span aria-hidden className={cn('size-3.5', iconClassName)} />
+    </span>
+  )
+}
+
+function UnauthorizedCredentialStatus({
+  tool,
+  onCredentialChange,
+}: {
+  tool: AgentProviderTool
+  onCredentialChange: (credentialId?: string) => void
+}) {
+  const { t } = useTranslation()
+  const [isApiKeyModalOpen, setIsApiKeyModalOpen] = useState(false)
+  const pluginPayload = useMemo(() => ({
+    provider: tool.id,
+    category: AuthCategory.tool,
+    providerType: tool.providerType ?? CollectionType.builtIn,
+  }), [tool.id, tool.providerType])
+  const invalidPluginCredentialInfo = useInvalidPluginCredentialInfoHook(pluginPayload)
+  const handleApiKeyModalOpen = useCallback(() => {
+    setIsApiKeyModalOpen(true)
+  }, [])
+  const handleApiKeyModalClose = useCallback(() => {
+    setIsApiKeyModalOpen(false)
+  }, [])
+  const handleCredentialUpdate = useCallback(() => {
+    invalidPluginCredentialInfo()
+    onCredentialChange()
+  }, [invalidPluginCredentialInfo, onCredentialChange])
+
+  return (
+    <>
+      <Button
+        variant="secondary"
+        size="small"
+        className="shrink-0"
+        onClick={handleApiKeyModalOpen}
+      >
+        {t('notAuthorized', { ns: 'tools' })}
+        <StatusDot className="ml-2" status="warning" />
+      </Button>
+      <ApiKeyModal
+        pluginPayload={pluginPayload}
+        open={isApiKeyModalOpen}
+        onOpenChange={setIsApiKeyModalOpen}
+        onClose={handleApiKeyModalClose}
+        onUpdate={handleCredentialUpdate}
+      />
+    </>
+  )
+}
+
+function CredentialStatus({
+  tool,
+  onCredentialChange,
+}: {
+  tool: AgentProviderTool
+  onCredentialChange: (credentialId?: string) => void
+}) {
+  const canSwitchCredential = (tool.providerType ?? CollectionType.builtIn) === CollectionType.builtIn && tool.allowDelete
+  const handleAuthorizationItemClick = useCallback((id: string) => {
+    onCredentialChange(id === '__workspace_default__' ? undefined : id || undefined)
+  }, [onCredentialChange])
+  const handleDefaultCredentialChange = useCallback((id?: string) => {
+    if (!tool.credentialId && id)
+      onCredentialChange(id)
+  }, [onCredentialChange, tool.credentialId])
+
+  if (tool.credentialVariant === 'none')
+    return null
+
+  if (tool.credentialVariant === 'unauthorized') {
+    return (
+      <UnauthorizedCredentialStatus
+        tool={tool}
+        onCredentialChange={onCredentialChange}
+      />
+    )
+  }
+
+  if (!canSwitchCredential)
+    return null
+
+  return (
+    <div className="shrink-0">
+      <AuthorizedInNode
+        pluginPayload={{
+          provider: tool.id,
+          category: AuthCategory.tool,
+          providerType: tool.providerType ?? CollectionType.builtIn,
+        }}
+        credentialId={tool.credentialId}
+        onAuthorizationItemClick={handleAuthorizationItemClick}
+        onDefaultCredentialChange={handleDefaultCredentialChange}
+      />
+    </div>
+  )
+}
+
+function ProviderToolActionItem({
+  action,
+  tool,
+  onConfigureAction,
+  onRemoveAction,
+}: {
+  action: AgentToolAction
+  tool: AgentProviderTool
+  onConfigureAction: (target: ToolSettingTarget) => void
+  onRemoveAction: (actionId: string) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const readOnly = useAgentOrchestrateReadOnly()
+  const handleConfigureAction = useCallback(() => {
+    onConfigureAction({ action, tool })
+  }, [action, onConfigureAction, tool])
+  const handleRemoveAction = useCallback(() => {
+    onRemoveAction(action.id)
+  }, [action.id, onRemoveAction])
+
+  return (
+    <div className="group relative flex min-h-7 items-center gap-1 rounded-md py-px pr-0 pl-1 hover:bg-state-base-hover">
+      <div className="absolute top-0 bottom-0 left-[13.5px] w-px bg-divider-regular" />
+      <div className="flex min-w-0 flex-1 items-center py-1 pl-7">
+        <span className="min-w-0 flex-1 truncate system-sm-regular text-text-secondary">
+          {action.name}
+        </span>
+      </div>
+      {!readOnly && (
+        <div className="hidden shrink-0 items-center gap-1 px-0.5 group-focus-within:flex group-hover:flex">
+          <button
+            type="button"
+            aria-label={t('agentDetail.configure.tools.editAction', { name: action.name })}
+            onClick={handleConfigureAction}
+            className="flex size-6 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className="i-ri-equalizer-2-line size-4" />
+          </button>
+          <button
+            type="button"
+            aria-label={t('agentDetail.configure.tools.removeAction', { name: action.name })}
+            onClick={handleRemoveAction}
+            className="flex size-6 items-center justify-center rounded-md text-text-tertiary hover:bg-state-destructive-hover hover:text-text-destructive focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className="i-ri-delete-bin-line size-4" />
+          </button>
+        </div>
+      )}
+    </div>
+  )
+}
+
+export function AgentProviderToolItem({
+  tool,
+  isExpanded,
+  onOpenChange,
+  onConfigureAction,
+  onRemoveAction,
+  onRemoveProvider,
+  onCredentialChange,
+}: {
+  tool: AgentProviderTool
+  isExpanded: boolean
+  onOpenChange: (open: boolean) => void
+  onConfigureAction: (target: ToolSettingTarget) => void
+  onRemoveAction: (actionId: string) => void
+  onRemoveProvider: () => void
+  onCredentialChange: (credentialId?: string) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const readOnly = useAgentOrchestrateReadOnly()
+  const { theme } = useTheme()
+  const icon = theme === Theme.dark && tool.iconDark ? tool.iconDark : tool.icon
+  const displayName = tool.displayName ?? tool.name
+
+  return (
+    <CollapsibleRoot
+      open={isExpanded}
+      onOpenChange={onOpenChange}
+      className="overflow-hidden rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg p-1 shadow-xs shadow-shadow-shadow-3"
+    >
+      <div className="flex min-h-7 items-center gap-1 rounded-lg py-0.5 pr-0.5 pl-1">
+        <CollapsibleTrigger
+          className="group min-h-0 min-w-0 flex-1 justify-start gap-2 rounded-md px-0 pr-1 text-left hover:not-data-disabled:bg-transparent hover:not-data-disabled:text-text-secondary data-panel-open:text-text-secondary"
+        >
+          <ProviderIcon icon={icon} iconClassName={tool.iconClassName} />
+          <span className="flex min-w-0 items-center">
+            <span className="min-w-0 truncate system-sm-medium text-text-primary">
+              {displayName}
+            </span>
+            <span
+              aria-hidden
+              className={cn(
+                'i-custom-vender-solid-arrows-arrow-down-round-fill size-4 shrink-0 -rotate-90 text-text-quaternary transition-transform group-data-panel-open:rotate-0 motion-reduce:transition-none',
+              )}
+            />
+          </span>
+        </CollapsibleTrigger>
+        {!readOnly && (
+          <>
+            <DropdownMenu modal={false}>
+              <DropdownMenuTrigger
+                aria-label={t('agentDetail.configure.tools.moreActions', { name: tool.name })}
+                className="flex size-6 shrink-0 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden data-popup-open:bg-state-base-hover"
+              >
+                <span className="sr-only">{t('agentDetail.configure.tools.moreActions', { name: tool.name })}</span>
+                <span aria-hidden className="i-ri-more-fill size-4" />
+              </DropdownMenuTrigger>
+              <DropdownMenuContent placement="bottom-end" sideOffset={4} popupClassName="w-44">
+                <DropdownMenuItem
+                  variant="destructive"
+                  className="gap-2"
+                  onClick={onRemoveProvider}
+                >
+                  <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
+                  <span>{t('agentDetail.configure.tools.removeProvider')}</span>
+                </DropdownMenuItem>
+              </DropdownMenuContent>
+            </DropdownMenu>
+            <CredentialStatus tool={tool} onCredentialChange={onCredentialChange} />
+          </>
+        )}
+      </div>
+
+      <CollapsiblePanel>
+        <div className="flex flex-col">
+          {tool.actions.map(action => (
+            <ProviderToolActionItem
+              key={action.id}
+              action={action}
+              tool={tool}
+              onConfigureAction={onConfigureAction}
+              onRemoveAction={onRemoveAction}
+            />
+          ))}
+        </div>
+      </CollapsiblePanel>
+    </CollapsibleRoot>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/types.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/types.ts
new file mode 100644
index 00000000000..4401994fa37
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/types.ts
@@ -0,0 +1,15 @@
+import type { ToolDefaultValue } from '@/app/components/workflow/block-selector/types'
+import type {
+  AgentProviderTool,
+  AgentToolAction,
+} from '@/features/agent-v2/agent-composer/form-state'
+
+export type AgentProviderToolDefaultValue = ToolDefaultValue & {
+  allowDelete?: boolean
+  credentialRequired?: boolean
+}
+
+export type ToolSettingTarget = {
+  action: AgentToolAction
+  tool: AgentProviderTool
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/utils.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/utils.ts
new file mode 100644
index 00000000000..4c6a473103b
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/utils.ts
@@ -0,0 +1,20 @@
+import type { AgentFileNode } from '@/features/agent-v2/agent-composer/form-state'
+
+export function countAgentFileNodes(files: AgentFileNode[]): number {
+  return files.reduce((count, file) => count + 1 + (file.children ? countAgentFileNodes(file.children) : 0), 0)
+}
+
+/**
+ * @public
+ */
+// TODO: Remove this marker after the first file selector is wired.
+export function getFirstAgentFileId(files: AgentFileNode[]): string | undefined {
+  for (const file of files) {
+    if (!file.children?.length)
+      return file.id
+
+    const childFileId = getFirstAgentFileId(file.children)
+    if (childFileId)
+      return childFileId
+  }
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/chat.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/chat.spec.tsx
new file mode 100644
index 00000000000..c95ce1c635e
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/chat.spec.tsx
@@ -0,0 +1,198 @@
+import type { ComponentProps } from 'react'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { createStore, Provider as JotaiProvider } from 'jotai'
+import { agentComposerModelAtom } from '@/features/agent-v2/agent-composer/store-modules/model'
+import { agentComposerPromptAtom } from '@/features/agent-v2/agent-composer/store-modules/prompt'
+import { AgentPreviewChat } from '../chat'
+
+const handleSendMock = vi.hoisted(() => vi.fn())
+const stopCallbackRef = vi.hoisted(() => ({
+  current: undefined as undefined | ((taskId: string) => void),
+}))
+const chatMessagesGetMock = vi.hoisted(() => vi.fn())
+const suggestedQuestionsGetMock = vi.hoisted(() => vi.fn())
+const stopPostMock = vi.hoisted(() => vi.fn())
+
+vi.mock('@/next/dynamic', () => ({
+  default: () => function MockChat(props: {
+    onSend: (message: string) => void
+    onStopResponding: () => void
+  }) {
+    return (
+      <div>
+        <button type="button" onClick={() => props.onSend('hello')}>
+          send
+        </button>
+        <button type="button" onClick={props.onStopResponding}>
+          stop
+        </button>
+      </div>
+    )
+  },
+}))
+
+vi.mock('@/app/components/base/chat/chat/hooks', () => ({
+  useChat: (
+    _config: unknown,
+    _formSettings: unknown,
+    _chatList: unknown[],
+    stopCallback: (taskId: string) => void,
+  ) => {
+    stopCallbackRef.current = stopCallback
+
+    return {
+      chatList: [],
+      setTargetMessageId: vi.fn(),
+      isResponding: false,
+      handleSend: handleSendMock,
+      suggestedQuestions: [],
+      handleStop: () => stopCallback('task-1'),
+      handleAnnotationAdded: vi.fn(),
+      handleAnnotationEdited: vi.fn(),
+      handleAnnotationRemoved: vi.fn(),
+    }
+  },
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useAppContext: () => ({
+    userProfile: {
+      avatar_url: '',
+      name: 'User',
+    },
+  }),
+}))
+
+vi.mock('@/app/components/header/account-setting/model-provider-page/hooks', () => ({
+  useTextGenerationCurrentProviderAndModelAndModelList: () => ({
+    textGenerationModelList: [
+      {
+        provider: 'openai',
+        models: [
+          {
+            model: 'gpt-4',
+            features: [],
+          },
+        ],
+      },
+    ],
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleClient: {
+    agent: {
+      byAgentId: {
+        chatMessages: {
+          get: chatMessagesGetMock,
+          byMessageId: {
+            suggestedQuestions: {
+              get: suggestedQuestionsGetMock,
+            },
+          },
+          byTaskId: {
+            stop: {
+              post: stopPostMock,
+            },
+          },
+        },
+      },
+    },
+  },
+}))
+
+function renderPreviewChat(props?: Partial<ComponentProps<typeof AgentPreviewChat>>) {
+  const store = createStore()
+  store.set(agentComposerModelAtom, {
+    provider: 'openai',
+    model: 'gpt-4',
+  })
+  store.set(agentComposerPromptAtom, 'You are helpful.')
+
+  return render(
+    <JotaiProvider store={store}>
+      <AgentPreviewChat
+        agentId="agent-1"
+        clearChatList={false}
+        onClearChatListChange={vi.fn()}
+        {...props}
+      />
+    </JotaiProvider>,
+  )
+}
+
+describe('AgentPreviewChat', () => {
+  beforeEach(() => {
+    handleSendMock.mockClear()
+    chatMessagesGetMock.mockResolvedValue({ data: [] })
+    suggestedQuestionsGetMock.mockResolvedValue({ data: [] })
+    stopPostMock.mockResolvedValue({ result: 'success' })
+    stopCallbackRef.current = undefined
+  })
+
+  it('should save draft before sending preview chat through the agent chat endpoints', async () => {
+    const saveDraftBeforeRun = vi.fn().mockResolvedValue(undefined)
+    renderPreviewChat({
+      onSaveDraftBeforeRun: saveDraftBeforeRun,
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'send' }))
+
+    await waitFor(() => expect(handleSendMock).toHaveBeenCalledTimes(1))
+    expect(saveDraftBeforeRun).toHaveBeenCalledTimes(1)
+    expect(saveDraftBeforeRun.mock.invocationCallOrder[0]).toBeLessThan(handleSendMock.mock.invocationCallOrder[0]!)
+    expect(handleSendMock).toHaveBeenCalledWith(
+      'agent/agent-1/chat-messages',
+      expect.not.objectContaining({
+        model_config: expect.anything(),
+      }),
+      expect.objectContaining({
+        onGetConversationMessages: expect.any(Function),
+        onGetSuggestedQuestions: expect.any(Function),
+      }),
+    )
+
+    const firstCall = handleSendMock.mock.calls.at(0)
+    expect(firstCall).toBeDefined()
+
+    const callbacks = firstCall![2]
+    await callbacks.onGetConversationMessages('conversation-1')
+    await callbacks.onGetSuggestedQuestions('message-1')
+
+    expect(chatMessagesGetMock).toHaveBeenCalledWith({
+      params: {
+        agent_id: 'agent-1',
+      },
+      query: {
+        conversation_id: 'conversation-1',
+      },
+    })
+    expect(suggestedQuestionsGetMock).toHaveBeenCalledWith({
+      params: {
+        agent_id: 'agent-1',
+        message_id: 'message-1',
+      },
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'stop' }))
+
+    expect(stopPostMock).toHaveBeenCalledWith({
+      params: {
+        agent_id: 'agent-1',
+        task_id: 'task-1',
+      },
+    })
+  })
+
+  it('should not send preview chat when draft save fails', async () => {
+    const saveDraftBeforeRun = vi.fn().mockRejectedValue(new Error('save failed'))
+    renderPreviewChat({
+      onSaveDraftBeforeRun: saveDraftBeforeRun,
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'send' }))
+
+    await waitFor(() => expect(saveDraftBeforeRun).toHaveBeenCalledTimes(1))
+    expect(handleSendMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/chat-features-panel.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/chat-features-panel.tsx
new file mode 100644
index 00000000000..490f58bdb28
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/chat-features-panel.tsx
@@ -0,0 +1,119 @@
+'use client'
+
+import type { AgentSoulAppFeaturesConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { Features } from '@/app/components/base/features/types'
+import { useCallback, useMemo } from 'react'
+import { useTranslation } from 'react-i18next'
+import { FeaturesProvider } from '@/app/components/base/features'
+import { useFeaturesStore } from '@/app/components/base/features/hooks'
+import NewFeaturePanel from '@/app/components/base/features/new-feature-panel'
+import { useSetAppFeatures } from '@/features/agent-v2/agent-composer/store-modules/app-features'
+import { Resolution, TransferMethod } from '@/types/app'
+
+type AgentChatFeaturesPanelProps = {
+  appFeatures?: AgentSoulAppFeaturesConfig
+  disabled?: boolean
+  show: boolean
+  onClose: () => void
+}
+
+const defaultFeatureState: Features = {
+  moreLikeThis: { enabled: false },
+  opening: { enabled: false },
+  suggested: { enabled: false },
+  text2speech: { enabled: false },
+  speech2text: { enabled: false },
+  citation: { enabled: false },
+  moderation: { enabled: false },
+  file: {
+    enabled: false,
+    image: {
+      enabled: false,
+      detail: Resolution.high,
+      number_limits: 3,
+      transfer_methods: [TransferMethod.local_file, TransferMethod.remote_url],
+    },
+  },
+  annotationReply: { enabled: false },
+}
+
+function toPanelFeatures(appFeatures?: AgentSoulAppFeaturesConfig): Features {
+  return {
+    ...defaultFeatureState,
+    opening: {
+      enabled: !!(appFeatures?.opening_statement || appFeatures?.suggested_questions?.length),
+      opening_statement: appFeatures?.opening_statement ?? '',
+      suggested_questions: appFeatures?.suggested_questions ?? [],
+    },
+    suggested: (appFeatures?.suggested_questions_after_answer as Features['suggested'] | undefined) ?? defaultFeatureState.suggested,
+    text2speech: (appFeatures?.text_to_speech as Features['text2speech'] | undefined) ?? defaultFeatureState.text2speech,
+    speech2text: appFeatures?.speech_to_text ?? defaultFeatureState.speech2text,
+    citation: appFeatures?.retriever_resource ?? defaultFeatureState.citation,
+    moderation: (appFeatures?.sensitive_word_avoidance as Features['moderation'] | undefined) ?? defaultFeatureState.moderation,
+    file: (appFeatures?.file_upload as Features['file'] | undefined) ?? defaultFeatureState.file,
+    annotationReply: (appFeatures?.annotation_reply as Features['annotationReply'] | undefined) ?? defaultFeatureState.annotationReply,
+  }
+}
+
+function toAppFeatures(features: Features, appFeatures?: AgentSoulAppFeaturesConfig): AgentSoulAppFeaturesConfig {
+  return {
+    ...appFeatures,
+    opening_statement: features.opening?.enabled ? (features.opening.opening_statement ?? '') : '',
+    suggested_questions: features.opening?.enabled ? (features.opening.suggested_questions ?? []) : [],
+    suggested_questions_after_answer: features.suggested as AgentSoulAppFeaturesConfig['suggested_questions_after_answer'],
+    text_to_speech: features.text2speech as AgentSoulAppFeaturesConfig['text_to_speech'],
+    speech_to_text: features.speech2text,
+    retriever_resource: features.citation,
+    sensitive_word_avoidance: features.moderation as AgentSoulAppFeaturesConfig['sensitive_word_avoidance'],
+    file_upload: features.file,
+    annotation_reply: features.annotationReply,
+  }
+}
+
+function AgentChatFeaturesPanelContent({
+  appFeatures,
+  disabled,
+  show,
+  onClose,
+}: AgentChatFeaturesPanelProps) {
+  const { t } = useTranslation('agentV2')
+  const featuresStore = useFeaturesStore()
+  const setAppFeatures = useSetAppFeatures()
+  const handleChange = useCallback(() => {
+    const features = featuresStore?.getState().features
+    if (!features)
+      return
+
+    setAppFeatures(currentAppFeatures => toAppFeatures(features, currentAppFeatures ?? appFeatures))
+  }, [appFeatures, featuresStore, setAppFeatures])
+
+  return (
+    <NewFeaturePanel
+      show={show}
+      isChatMode
+      disabled={!!disabled}
+      inWorkflow={false}
+      showModeration={false}
+      showAnnotationReply={false}
+      drawerClassName="bg-components-panel-bg! data-[swipe-direction=right]:top-1! data-[swipe-direction=right]:right-0! data-[swipe-direction=right]:bottom-1! data-[swipe-direction=right]:rounded-r-none!"
+      title={t('agentDetail.configure.chatFeatures.title')}
+      description={t('agentDetail.configure.chatFeatures.description')}
+      onChange={handleChange}
+      onClose={onClose}
+    />
+  )
+}
+
+export function AgentChatFeaturesPanel({
+  appFeatures,
+  ...props
+}: AgentChatFeaturesPanelProps) {
+  const features = useMemo(() => toPanelFeatures(appFeatures), [appFeatures])
+  const featuresKey = useMemo(() => JSON.stringify(appFeatures ?? {}), [appFeatures])
+
+  return (
+    <FeaturesProvider key={featuresKey} features={features}>
+      <AgentChatFeaturesPanelContent appFeatures={appFeatures} {...props} />
+    </FeaturesProvider>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/chat.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/chat.tsx
new file mode 100644
index 00000000000..764ba65f498
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/chat.tsx
@@ -0,0 +1,441 @@
+'use client'
+
+import type {
+  AgentCliToolConfig,
+  AgentIconType,
+  AgentSoulConfig,
+  AgentSoulDifyToolConfig,
+} from '@dify/contracts/api/console/agent/types.gen'
+import type { ChatConfig, ChatItem, OnSend } from '@/app/components/base/chat/types'
+import type { FileEntity } from '@/app/components/base/file-uploader/types'
+import type { DefaultModel } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import type { Inputs } from '@/models/debug'
+import { Avatar } from '@langgenius/dify-ui/avatar'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useAtomValue } from 'jotai'
+import { useCallback, useMemo } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import { useChat } from '@/app/components/base/chat/chat/hooks'
+import { getLastAnswer, isValidGeneratedAnswer } from '@/app/components/base/chat/utils'
+import { ModelFeatureEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { useTextGenerationCurrentProviderAndModelAndModelList } from '@/app/components/header/account-setting/model-provider-page/hooks'
+import { InputVarType } from '@/app/components/workflow/types'
+import { DEFAULT_CHAT_PROMPT_CONFIG, DEFAULT_COMPLETION_PROMPT_CONFIG } from '@/config'
+import { useAppContext } from '@/context/app-context'
+import { agentComposerModelAtom } from '@/features/agent-v2/agent-composer/store-modules/model'
+import { agentComposerPromptAtom } from '@/features/agent-v2/agent-composer/store-modules/prompt'
+import { PromptMode } from '@/models/debug'
+import dynamic from '@/next/dynamic'
+import { consoleClient } from '@/service/client'
+import { AgentStrategy, ModelModeType, RETRIEVE_TYPE, TransferMethod } from '@/types/app'
+
+const Chat = dynamic(() => import('@/app/components/base/chat/chat'), { ssr: false })
+
+type AgentPreviewChatConfig = ChatConfig & {
+  model: {
+    provider: string
+    name: string
+    mode: ModelModeType
+    completion_params: {
+      max_tokens: number
+      temperature: number
+      top_p: number
+      echo: boolean
+      stop: string[]
+      presence_penalty: number
+      frequency_penalty: number
+    }
+  }
+}
+
+const defaultSystemParameters: ChatConfig['system_parameters'] = {
+  audio_file_size_limit: 0,
+  file_size_limit: 0,
+  image_file_size_limit: 0,
+  video_file_size_limit: 0,
+  workflow_file_upload_limit: 0,
+}
+
+const disabledFileUploadConfig = {
+  allowed_file_upload_methods: [TransferMethod.local_file, TransferMethod.remote_url],
+  allowed_file_types: [],
+  fileUploadConfig: defaultSystemParameters,
+  image: {
+    enabled: false,
+    transfer_methods: [],
+    number_limits: 0,
+    image_file_size_limit: 0,
+    detail: 'low',
+  },
+  max_length: 0,
+  number_limits: 0,
+} as ChatConfig['file_upload'] & {
+  fileUploadConfig: ChatConfig['system_parameters']
+}
+
+const getModelSettings = (agentSoulConfig?: AgentSoulConfig) => agentSoulConfig?.model?.model_settings ?? {}
+
+const toEnabledConfig = (config?: { enabled?: boolean } | null) => ({
+  ...config,
+  enabled: config?.enabled ?? false,
+})
+
+const toInputType = (type: string): InputVarType => {
+  if (type === InputVarType.paragraph)
+    return InputVarType.paragraph
+  if (type === InputVarType.select)
+    return InputVarType.select
+  if (type === InputVarType.number)
+    return InputVarType.number
+  if (type === InputVarType.json || type === InputVarType.jsonObject)
+    return InputVarType.json
+
+  return InputVarType.textInput
+}
+
+const toInputForm = (variable: NonNullable<AgentSoulConfig['app_variables']>[number]) => {
+  const variableKey = String(variable.name)
+
+  return {
+    ...variable,
+    key: variableKey,
+    label: variableKey,
+    variable: variableKey,
+    type: toInputType(variable.type),
+    required: variable.required ?? true,
+    hide: false,
+  }
+}
+
+const toAgentTool = (tool: AgentSoulDifyToolConfig) => ({
+  provider_id: tool.provider_id ?? tool.provider ?? tool.plugin_id ?? '',
+  provider_type: tool.provider_type ?? 'builtin',
+  provider_name: tool.provider ?? '',
+  tool_name: tool.tool_name,
+  tool_label: tool.name ?? tool.tool_name,
+  tool_parameters: tool.runtime_parameters ?? {},
+  enabled: tool.enabled ?? true,
+  credential_id: tool.credential_ref?.id,
+})
+
+const toCliTool = (tool: AgentCliToolConfig) => ({
+  provider_id: 'agent-v2-cli',
+  provider_type: 'builtin',
+  provider_name: 'CLI',
+  tool_name: tool.tool_name ?? tool.name ?? '',
+  tool_label: tool.name ?? tool.tool_name ?? '',
+  tool_parameters: {
+    command: tool.command,
+  },
+  enabled: tool.enabled ?? true,
+})
+
+const stopAgentChatMessageResponding = (agentId: string, taskId: string) => {
+  return consoleClient.agent.byAgentId.chatMessages.byTaskId.stop.post({
+    params: {
+      agent_id: agentId,
+      task_id: taskId,
+    },
+  })
+}
+
+const fetchAgentConversationMessages = (agentId: string, conversationId: string) => {
+  return consoleClient.agent.byAgentId.chatMessages.get({
+    params: {
+      agent_id: agentId,
+    },
+    query: {
+      conversation_id: conversationId,
+    },
+  })
+}
+
+const fetchAgentSuggestedQuestions = (agentId: string, messageId: string) => {
+  return consoleClient.agent.byAgentId.chatMessages.byMessageId.suggestedQuestions.get({
+    params: {
+      agent_id: agentId,
+      message_id: messageId,
+    },
+  })
+}
+
+const buildChatConfig = ({
+  agentSoulConfig,
+  currentModel,
+  prompt,
+}: {
+  agentSoulConfig?: AgentSoulConfig
+  currentModel?: DefaultModel
+  prompt: string
+}): AgentPreviewChatConfig => {
+  const modelSettings = getModelSettings(agentSoulConfig)
+  const appFeatures = agentSoulConfig?.app_features ?? {}
+  const datasets = agentSoulConfig?.knowledge?.datasets ?? []
+  const difyTools = agentSoulConfig?.tools?.dify_tools ?? []
+  const cliTools = agentSoulConfig?.tools?.cli_tools ?? []
+
+  return {
+    pre_prompt: prompt || agentSoulConfig?.prompt?.system_prompt || '',
+    prompt_type: PromptMode.simple,
+    chat_prompt_config: DEFAULT_CHAT_PROMPT_CONFIG,
+    completion_prompt_config: DEFAULT_COMPLETION_PROMPT_CONFIG,
+    user_input_form: (agentSoulConfig?.app_variables ?? []).map(variable => ({
+      'text-input': {
+        default: String(variable.default ?? ''),
+        label: variable.name,
+        variable: variable.name,
+        required: variable.required ?? true,
+        max_length: 48,
+        hide: false,
+      },
+    })),
+    dataset_query_variable: '',
+    opening_statement: appFeatures.opening_statement ?? '',
+    suggested_questions: appFeatures.suggested_questions ?? [],
+    suggested_questions_after_answer: toEnabledConfig(appFeatures.suggested_questions_after_answer) as ChatConfig['suggested_questions_after_answer'],
+    more_like_this: { enabled: false },
+    text_to_speech: toEnabledConfig(appFeatures.text_to_speech) as ChatConfig['text_to_speech'],
+    speech_to_text: toEnabledConfig(appFeatures.speech_to_text),
+    retriever_resource: toEnabledConfig(appFeatures.retriever_resource),
+    sensitive_word_avoidance: toEnabledConfig(appFeatures.sensitive_word_avoidance),
+    annotation_reply: {
+      id: '',
+      enabled: false,
+      score_threshold: 0.9,
+      embedding_model: {
+        embedding_provider_name: '',
+        embedding_model_name: '',
+      },
+    },
+    agent_mode: {
+      enabled: difyTools.length > 0 || cliTools.length > 0,
+      strategy: AgentStrategy.functionCall,
+      tools: [
+        ...difyTools.map(toAgentTool),
+        ...cliTools.map(toCliTool),
+      ] as ChatConfig['agent_mode']['tools'],
+    },
+    model: {
+      provider: currentModel?.provider ?? agentSoulConfig?.model?.model_provider ?? '',
+      name: currentModel?.model ?? agentSoulConfig?.model?.model ?? '',
+      mode: ModelModeType.chat,
+      completion_params: {
+        temperature: modelSettings.temperature ?? 0.7,
+        top_p: modelSettings.top_p ?? 1,
+        max_tokens: modelSettings.max_tokens ?? 512,
+        presence_penalty: modelSettings.presence_penalty ?? 0,
+        frequency_penalty: modelSettings.frequency_penalty ?? 0,
+        stop: modelSettings.stop ?? [],
+        echo: false,
+      },
+    },
+    dataset_configs: {
+      retrieval_model: RETRIEVE_TYPE.multiWay,
+      reranking_model: {
+        reranking_provider_name: '',
+        reranking_model_name: '',
+      },
+      top_k: agentSoulConfig?.knowledge?.query_config?.top_k ?? 4,
+      score_threshold_enabled: agentSoulConfig?.knowledge?.query_config?.score_threshold_enabled ?? false,
+      score_threshold: agentSoulConfig?.knowledge?.query_config?.score_threshold ?? 0.8,
+      datasets: {
+        datasets: datasets.map(dataset => ({
+          enabled: true,
+          id: dataset.id ?? '',
+        })).filter(dataset => dataset.id),
+      },
+    },
+    file_upload: disabledFileUploadConfig,
+    system_parameters: defaultSystemParameters,
+    supportCitationHitInfo: true,
+  }
+}
+
+function AgentPreviewChatEmptyState({
+  agentIcon,
+  agentIconBackground,
+  agentIconType,
+  agentName,
+  hasInstructions,
+}: {
+  agentIcon?: string | null
+  agentIconBackground?: string | null
+  agentIconType?: AgentIconType | null
+  agentName?: string
+  hasInstructions: boolean
+}) {
+  const { t } = useTranslation('agentV2')
+  const imageUrl = (agentIconType === 'image' || agentIconType === 'link') ? agentIcon : undefined
+  const iconType = imageUrl ? 'image' : agentIconType
+
+  return (
+    <div className="pointer-events-none absolute inset-x-12 bottom-[calc(27%+84px)] flex flex-col items-center text-center">
+      <AppIcon
+        size="xxl"
+        rounded
+        iconType={iconType}
+        icon={agentIcon ?? undefined}
+        background={agentIconBackground}
+        imageUrl={imageUrl}
+        className="bg-background-default"
+      />
+      <div className="mt-3 max-w-full truncate system-md-semibold text-text-secondary">
+        {agentName || t('agentDetail.configure.preview.empty.defaultAgentName')}
+      </div>
+      <div className="mt-4 h-px w-73 max-w-full bg-divider-subtle" />
+      <div className="mt-5 max-w-91 body-md-regular text-text-tertiary">
+        <p>{t('agentDetail.configure.preview.empty.description')}</p>
+        {!hasInstructions && (
+          <p>{t('agentDetail.configure.preview.empty.noInstructionsDescription')}</p>
+        )}
+      </div>
+    </div>
+  )
+}
+
+export function AgentPreviewChat({
+  agentId,
+  agentIcon,
+  agentIconBackground,
+  agentIconType,
+  agentName,
+  agentSoulConfig,
+  clearChatList,
+  onClearChatListChange,
+  onSaveDraftBeforeRun,
+}: {
+  agentId: string
+  agentIcon?: string | null
+  agentIconBackground?: string | null
+  agentIconType?: AgentIconType | null
+  agentName?: string
+  agentSoulConfig?: AgentSoulConfig
+  clearChatList: boolean
+  onClearChatListChange: (clearChatList: boolean) => void
+  onSaveDraftBeforeRun?: () => Promise<void>
+}) {
+  const { userProfile } = useAppContext()
+  const prompt = useAtomValue(agentComposerPromptAtom)
+  const currentModel = useAtomValue(agentComposerModelAtom)
+  const config = useMemo(() => buildChatConfig({
+    agentSoulConfig,
+    currentModel,
+    prompt,
+  }), [agentSoulConfig, currentModel, prompt])
+  const inputsForm = useMemo(() => (agentSoulConfig?.app_variables ?? []).map(toInputForm), [agentSoulConfig?.app_variables])
+  const inputs = useMemo(() => {
+    return inputsForm.reduce<Inputs>((acc, input) => {
+      acc[input.variable] = (input.default ?? '') as Inputs[string]
+      return acc
+    }, {})
+  }, [inputsForm])
+  const {
+    textGenerationModelList,
+  } = useTextGenerationCurrentProviderAndModelAndModelList(currentModel)
+  const {
+    chatList,
+    setTargetMessageId,
+    isResponding,
+    handleSend,
+    suggestedQuestions,
+    handleStop,
+    handleAnnotationAdded,
+    handleAnnotationEdited,
+    handleAnnotationRemoved,
+  } = useChat(
+    config,
+    {
+      inputs,
+      inputsForm,
+    },
+    [],
+    (taskId) => {
+      void stopAgentChatMessageResponding(agentId, taskId)
+    },
+    clearChatList,
+    onClearChatListChange,
+  )
+
+  const doSend: OnSend = useCallback(async (message, files, isRegenerate = false, parentAnswer: ChatItem | null = null) => {
+    try {
+      await onSaveDraftBeforeRun?.()
+    }
+    catch {
+      return
+    }
+
+    const currentProvider = textGenerationModelList.find(item => item.provider === config.model.provider)
+    const selectedModel = currentProvider?.models.find(model => model.model === config.model.name)
+    const supportVision = selectedModel?.features?.includes(ModelFeatureEnum.vision)
+    const data: Record<string, unknown> = {
+      query: message,
+      inputs,
+      parent_message_id: (isRegenerate ? parentAnswer?.id : getLastAnswer(chatList)?.id) || null,
+    }
+
+    if (files?.length && supportVision)
+      data.files = files
+
+    handleSend(
+      `agent/${agentId}/chat-messages`,
+      data as Parameters<typeof handleSend>[1],
+      {
+        onGetConversationMessages: conversationId => fetchAgentConversationMessages(agentId, conversationId),
+        onGetSuggestedQuestions: responseItemId => fetchAgentSuggestedQuestions(agentId, responseItemId),
+      },
+    )
+  }, [agentId, chatList, config.model.name, config.model.provider, handleSend, inputs, onSaveDraftBeforeRun, textGenerationModelList])
+
+  const doRegenerate = useCallback((chatItem: ChatItem, editedQuestion?: { message: string, files?: FileEntity[] }) => {
+    const question = editedQuestion ? chatItem : chatList.find(item => item.id === chatItem.parentMessageId)
+    if (!question)
+      return
+
+    const parentAnswer = chatList.find(item => item.id === question.parentMessageId)
+    doSend(
+      editedQuestion ? editedQuestion.message : question.content,
+      editedQuestion ? editedQuestion.files : question.message_files,
+      true,
+      isValidGeneratedAnswer(parentAnswer) ? parentAnswer : null,
+    )
+  }, [chatList, doSend])
+  const isEmptyChat = chatList.length === 0
+  const hasInstructions = !!config.pre_prompt.trim()
+
+  return (
+    <Chat
+      config={config}
+      chatList={chatList}
+      isResponding={isResponding}
+      chatNode={isEmptyChat && (
+        <AgentPreviewChatEmptyState
+          agentIcon={agentIcon}
+          agentIconBackground={agentIconBackground}
+          agentIconType={agentIconType}
+          agentName={agentName}
+          hasInstructions={hasInstructions}
+        />
+      )}
+      chatContainerClassName={cn('pt-6', isEmptyChat ? 'px-12' : 'px-3')}
+      chatFooterClassName={cn(
+        'pb-0',
+        isEmptyChat ? '!bottom-[27%] px-12 pt-3' : 'px-3 pt-10',
+      )}
+      showFileUpload={false}
+      suggestedQuestions={suggestedQuestions}
+      onSend={doSend}
+      inputs={inputs}
+      inputsForm={inputsForm}
+      onRegenerate={doRegenerate}
+      switchSibling={siblingMessageId => setTargetMessageId(siblingMessageId)}
+      onStopResponding={handleStop}
+      showPromptLog
+      questionIcon={<Avatar avatar={userProfile.avatar_url} name={userProfile.name} size="xl" />}
+      onAnnotationEdited={handleAnnotationEdited}
+      onAnnotationAdded={handleAnnotationAdded}
+      onAnnotationRemoved={handleAnnotationRemoved}
+      noSpacing
+    />
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/header.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/header.tsx
new file mode 100644
index 00000000000..2598949ba21
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/header.tsx
@@ -0,0 +1,47 @@
+'use client'
+
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+
+export function AgentPreviewHeader({
+  isChatFeaturesOpen,
+  onToggleChatFeatures,
+  onRestart,
+}: {
+  isChatFeaturesOpen: boolean
+  onToggleChatFeatures: () => void
+  onRestart: () => void
+}) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <div className="flex h-12 shrink-0 items-center gap-3 py-3 pr-3 pl-6">
+      <h2 className="min-w-0 flex-1 truncate title-xl-semi-bold text-text-primary">
+        {t('agentDetail.configure.preview.title')}
+      </h2>
+      <div className="flex shrink-0 items-center gap-1">
+        <button
+          type="button"
+          onClick={onRestart}
+          className="flex size-6 items-center justify-center rounded-md p-0.5 text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          aria-label={t('agentDetail.configure.preview.restart')}
+        >
+          <span aria-hidden className="i-custom-vender-other-replay-line size-4" />
+        </button>
+        <button
+          type="button"
+          aria-pressed={isChatFeaturesOpen}
+          onClick={onToggleChatFeatures}
+          className={cn(
+            'flex h-8 items-center justify-center gap-0.5 rounded-lg px-3 py-2 text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+            isChatFeaturesOpen && 'bg-state-base-hover text-text-secondary',
+          )}
+          aria-label={t('agentDetail.configure.preview.chatFeatures')}
+        >
+          <span aria-hidden className="i-ri-apps-2-add-line size-4" />
+          <span className="px-0.5 system-sm-medium">{t('agentDetail.configure.preview.chatFeatures')}</span>
+        </button>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/versions-panel.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/versions-panel.tsx
new file mode 100644
index 00000000000..45a54f14394
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/versions-panel.tsx
@@ -0,0 +1,201 @@
+'use client'
+
+import type { AgentConfigSnapshotSummaryResponse } from '@dify/contracts/api/console/agent/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import useTimestamp from '@/hooks/use-timestamp'
+import { consoleQuery } from '@/service/client'
+
+type AgentPreviewVersionsPanelProps = {
+  agentId: string
+  activeVersionId?: string | null
+  onClose: () => void
+}
+
+function VersionTimelineDot({
+  isActive,
+  isFirst,
+  isLast,
+}: {
+  isActive: boolean
+  isFirst: boolean
+  isLast: boolean
+}) {
+  return (
+    <div className="relative flex w-[18px] shrink-0 justify-center pt-1.5">
+      {!isFirst && <div className="absolute top-0 h-2 w-0.5 bg-divider-subtle" />}
+      <span
+        aria-hidden
+        className={cn(
+          'relative z-1 size-2 rounded-full border-2 bg-components-panel-bg',
+          isActive ? 'border-text-accent' : 'border-text-quaternary',
+        )}
+      />
+      {!isLast && <div className="absolute top-3 bottom-[-18px] w-0.5 bg-divider-subtle" />}
+    </div>
+  )
+}
+
+function VersionMetadata({
+  version,
+}: {
+  version: AgentConfigSnapshotSummaryResponse
+}) {
+  const { t } = useTranslation('agentV2')
+  const { formatTime } = useTimestamp()
+
+  if (version.created_at == null && !version.created_by)
+    return null
+
+  return (
+    <p className="truncate system-xs-regular text-text-tertiary">
+      {version.created_at != null && formatTime(version.created_at, t('roster.dateTimeFormat'))}
+      {version.created_at != null && version.created_by && ' · '}
+      {version.created_by}
+    </p>
+  )
+}
+
+function VersionItem({
+  version,
+  activeVersionId,
+  isLatest,
+  isFirst,
+  isLast,
+}: {
+  version: AgentConfigSnapshotSummaryResponse
+  activeVersionId?: string | null
+  isLatest: boolean
+  isFirst: boolean
+  isLast: boolean
+}) {
+  const { t } = useTranslation('agentV2')
+  const { t: tWorkflow } = useTranslation('workflow')
+  const isActive = version.id === activeVersionId
+  const label = version.version_note || t('agentDetail.versionHistory.versionName', { version: version.version })
+
+  return (
+    <button
+      type="button"
+      className={cn(
+        'group relative flex w-full items-start gap-1 rounded-lg py-1 pr-1.5 pl-2 text-left focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+        isActive ? 'bg-state-accent-active' : 'hover:bg-state-base-hover',
+      )}
+    >
+      <VersionTimelineDot isActive={isActive} isFirst={isFirst} isLast={isLast} />
+      <div className="min-w-0 flex-1 py-0.5">
+        <div className="flex min-w-0 items-center gap-1">
+          <p className={cn('truncate system-sm-semibold', isActive ? 'text-text-accent' : 'text-text-secondary')}>
+            {label}
+          </p>
+          {isLatest && (
+            <span className="shrink-0 rounded-[5px] border border-text-accent-secondary bg-components-badge-bg-dimm px-[5px] py-[3px] system-2xs-medium-uppercase text-text-accent-secondary">
+              {tWorkflow('versionHistory.latest')}
+            </span>
+          )}
+        </div>
+        {isActive && version.summary && (
+          <p className="mt-0.5 line-clamp-4 system-xs-regular text-text-secondary">
+            {version.summary}
+          </p>
+        )}
+        <VersionMetadata version={version} />
+      </div>
+    </button>
+  )
+}
+
+function CurrentDraftItem({
+  isLast,
+}: {
+  isLast: boolean
+}) {
+  const { t: tWorkflow } = useTranslation('workflow')
+
+  return (
+    <div className="flex w-full items-start gap-1 rounded-lg py-1 pr-1.5 pl-2">
+      <VersionTimelineDot isActive={false} isFirst isLast={isLast} />
+      <div className="min-w-0 flex-1 py-1">
+        <p className="truncate system-sm-semibold text-text-secondary">
+          {tWorkflow('versionHistory.currentDraft')}
+        </p>
+      </div>
+    </div>
+  )
+}
+
+export function AgentPreviewVersionsPanel({
+  agentId,
+  activeVersionId,
+  onClose,
+}: AgentPreviewVersionsPanelProps) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const { t: tWorkflow } = useTranslation('workflow')
+  const versionsQuery = useQuery(consoleQuery.agent.byAgentId.versions.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  }))
+  const versions = versionsQuery.data?.data ?? []
+  const latestVersionId = versions[0]?.id
+
+  return (
+    <aside className="flex h-full w-[268px] shrink-0 flex-col rounded-l-lg bg-components-panel-bg shadow-xl shadow-shadow-shadow-5">
+      <div className="flex shrink-0 items-center gap-2 pt-3 pr-3 pl-4">
+        <h2 className="min-w-0 flex-1 truncate system-xl-semibold text-text-primary">
+          {tWorkflow('versionHistory.title')}
+        </h2>
+        <button
+          type="button"
+          aria-label={t('agentDetail.versionHistory.filter')}
+          className="flex size-6 shrink-0 items-center justify-center rounded-md p-0.5 text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+        >
+          <span aria-hidden className="i-ri-filter-3-line size-4" />
+        </button>
+        <div className="h-3.5 w-px shrink-0 bg-divider-regular" />
+        <button
+          type="button"
+          aria-label={tCommon('operation.close')}
+          onClick={onClose}
+          className="flex size-6 shrink-0 items-center justify-center rounded-md p-0.5 text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+        >
+          <span aria-hidden className="i-ri-close-line size-4" />
+        </button>
+      </div>
+
+      <div className="min-h-0 flex-1 overflow-y-auto px-3 py-2">
+        {versionsQuery.isPending && (
+          <div className="space-y-1">
+            <div className="h-10 animate-pulse rounded-lg bg-state-base-hover" />
+            <div className="h-18 animate-pulse rounded-lg bg-state-base-hover" />
+            <div className="h-10 animate-pulse rounded-lg bg-state-base-hover" />
+          </div>
+        )}
+        {!versionsQuery.isPending && versions.length === 0 && (
+          <div className="rounded-lg border border-components-panel-border bg-components-panel-on-panel-item-bg px-3 py-6 text-center system-sm-regular text-text-tertiary">
+            {t('agentDetail.versionHistory.empty')}
+          </div>
+        )}
+        {!versionsQuery.isPending && versions.length > 0 && (
+          <div className="flex flex-col gap-px">
+            <CurrentDraftItem isLast={versions.length === 0} />
+            {versions.map((version, index) => (
+              <VersionItem
+                key={version.id}
+                version={version}
+                activeVersionId={activeVersionId}
+                isLatest={version.id === latestVersionId}
+                isFirst={false}
+                isLast={index === versions.length - 1}
+              />
+            ))}
+          </div>
+        )}
+      </div>
+    </aside>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/page.tsx b/web/features/agent-v2/agent-detail/configure/page.tsx
new file mode 100644
index 00000000000..ee2f2f05d62
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/page.tsx
@@ -0,0 +1,264 @@
+'use client'
+
+import type { AgentConfigSnapshotDetailResponse, AgentIconType, AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
+import { skipToken, useQuery } from '@tanstack/react-query'
+import { useAtom, useAtomValue } from 'jotai'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import { ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { useDefaultModel, useTextGenerationCurrentProviderAndModelAndModelList } from '@/app/components/header/account-setting/model-provider-page/hooks'
+import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { useHydrateAgentSoulConfigDraft } from '@/features/agent-v2/agent-composer/store'
+import { agentComposerAppFeaturesAtom } from '@/features/agent-v2/agent-composer/store-modules/app-features'
+import { agentComposerModelAtom } from '@/features/agent-v2/agent-composer/store-modules/model'
+import { consoleQuery } from '@/service/client'
+import { AgentOrchestratePanel } from './components/orchestrate'
+import { AgentPreviewChat } from './components/preview/chat'
+import { AgentChatFeaturesPanel } from './components/preview/chat-features-panel'
+import { AgentPreviewHeader } from './components/preview/header'
+import { AgentPreviewVersionsPanel } from './components/preview/versions-panel'
+import { useAgentConfigureSync } from './use-agent-configure-sync'
+
+type AgentConfigurePageProps = {
+  agentId: string
+}
+
+export function AgentConfigurePage({
+  agentId,
+}: AgentConfigurePageProps) {
+  return (
+    <AgentComposerProvider>
+      <AgentConfigurePageContent agentId={agentId} />
+    </AgentComposerProvider>
+  )
+}
+
+function AgentConfigurePageContent({
+  agentId,
+}: AgentConfigurePageProps) {
+  const { t } = useTranslation('agentV2')
+  const configureData = useAgentConfigureData(agentId)
+  const isConfigureDataPending = configureData.agentQuery.isPending
+    || configureData.composerQuery.isPending
+    || (configureData.shouldLoadPublishedVersion && configureData.versionQuery.isPending)
+
+  if (isConfigureDataPending) {
+    return (
+      <section
+        aria-label={t('agentDetail.sections.configure')}
+        aria-busy
+        className="flex h-full min-w-0 flex-1 items-center justify-center p-1"
+      >
+        <Loading type="app" />
+      </section>
+    )
+  }
+
+  return (
+    <AgentConfigurePageLoadedContent
+      agentId={agentId}
+      configureData={configureData}
+    />
+  )
+}
+
+function AgentConfigurePageLoadedContent({
+  agentId,
+  configureData,
+}: AgentConfigurePageProps & {
+  configureData: ReturnType<typeof useAgentConfigureData>
+}) {
+  const { t } = useTranslation('agentV2')
+  const [showChatFeatures, setShowChatFeatures] = useState(false)
+  const [showPreviewVersions, setShowPreviewVersions] = useState(false)
+  const [clearPreviewChat, setClearPreviewChat] = useState(false)
+  const {
+    agentQuery,
+    composerQuery,
+    versionQuery,
+    activeVersionId,
+    activeConfigSnapshot,
+    agentSoulConfig,
+  } = configureData
+  const agentIconType = agentQuery.data?.icon_type as AgentIconType | null | undefined
+
+  useHydrateAgentSoulConfigDraft({
+    agentId,
+    activeVersionId,
+    config: agentSoulConfig,
+  })
+  const {
+    currentModel,
+    setConfigureModel,
+    textGenerationModelList,
+  } = useAgentConfigureModelOptions()
+  const {
+    draftSavedAt,
+    isPublishing,
+    publishDraft,
+    saveDraft,
+  } = useAgentConfigureSync({
+    agentId,
+    baseConfig: agentSoulConfig,
+    currentModel,
+    enabled: composerQuery.isSuccess,
+  })
+
+  return (
+    <section
+      aria-label={t('agentDetail.sections.configure')}
+      aria-busy={agentQuery.isFetching}
+      className="flex h-full min-w-0 flex-1 gap-1 overflow-hidden p-1"
+    >
+      <AgentOrchestratePanel
+        agentId={agentId}
+        activeConfigIsPublished={agentQuery.data?.active_config_is_published}
+        activeConfigSnapshot={activeConfigSnapshot}
+        agentSoulConfig={agentSoulConfig}
+        agentName={agentQuery.data?.name}
+        currentModel={currentModel}
+        textGenerationModelList={textGenerationModelList}
+        draftSavedAt={draftSavedAt}
+        isPublishing={isPublishing}
+        onSelectModel={setConfigureModel}
+        onPublish={publishDraft}
+        onOpenVersions={() => setShowPreviewVersions(true)}
+      />
+
+      {/* Preview area */}
+      <div className="flex min-w-105 flex-1 gap-1 overflow-hidden">
+        <div className="flex min-w-105 flex-1 flex-col overflow-hidden rounded-lg bg-background-gradient-bg-fill-chat-bg-2 shadow-xl shadow-shadow-shadow-5">
+          <AgentPreviewHeader
+            isChatFeaturesOpen={showChatFeatures}
+            onToggleChatFeatures={() => setShowChatFeatures(open => !open)}
+            onRestart={() => setClearPreviewChat(true)}
+          />
+
+          <div className="min-h-0 flex-1">
+            <AgentPreviewChatWithDraftConfig
+              agentId={agentId}
+              agentIcon={agentQuery.data?.icon}
+              agentIconBackground={agentQuery.data?.icon_background}
+              agentIconType={agentIconType}
+              agentName={agentQuery.data?.name}
+              agentSoulConfig={agentSoulConfig}
+              clearChatList={clearPreviewChat}
+              onClearChatListChange={setClearPreviewChat}
+              onSaveDraftBeforeRun={saveDraft}
+            />
+          </div>
+        </div>
+
+        {showPreviewVersions && (
+          <AgentPreviewVersionsPanel
+            agentId={agentId}
+            activeVersionId={activeVersionId}
+            onClose={() => setShowPreviewVersions(false)}
+          />
+        )}
+        <AgentChatFeaturesPanel
+          show={showChatFeatures}
+          appFeatures={agentSoulConfig?.app_features}
+          disabled={versionQuery.isPending}
+          onClose={() => setShowChatFeatures(false)}
+        />
+      </div>
+    </section>
+  )
+}
+
+function AgentPreviewChatWithDraftConfig({
+  agentSoulConfig,
+  ...props
+}: Omit<Parameters<typeof AgentPreviewChat>[0], 'agentSoulConfig'> & {
+  agentSoulConfig?: AgentSoulConfig
+}) {
+  const draftAppFeatures = useAtomValue(agentComposerAppFeaturesAtom)
+  const previewAgentSoulConfig = getPreviewAgentSoulConfig(agentSoulConfig, draftAppFeatures)
+
+  return (
+    <AgentPreviewChat
+      {...props}
+      agentSoulConfig={previewAgentSoulConfig}
+    />
+  )
+}
+
+function useAgentConfigureData(agentId: string) {
+  const agentQuery = useQuery(consoleQuery.agent.byAgentId.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  }))
+  const composerQuery = useQuery(consoleQuery.agent.byAgentId.composer.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  }))
+  const activeVersionId = composerQuery.data?.active_config_snapshot?.id
+  const shouldLoadPublishedVersion = !composerQuery.data?.agent_soul
+  const versionQuery = useQuery(consoleQuery.agent.byAgentId.versions.byVersionId.get.queryOptions({
+    input: activeVersionId && shouldLoadPublishedVersion
+      ? {
+          params: {
+            agent_id: agentId,
+            version_id: activeVersionId,
+          },
+        }
+      : skipToken,
+  }))
+  const versionDetail = versionQuery.data as AgentConfigSnapshotDetailResponse | undefined
+  const activeConfigSnapshot = composerQuery.data?.active_config_snapshot ?? versionDetail
+  const agentSoulConfig = composerQuery.data?.agent_soul ?? versionDetail?.config_snapshot
+
+  return {
+    agentQuery,
+    composerQuery,
+    versionQuery,
+    shouldLoadPublishedVersion,
+    activeVersionId,
+    activeConfigSnapshot,
+    agentSoulConfig,
+  }
+}
+
+function useAgentConfigureModelOptions() {
+  const [model, setModel] = useAtom(agentComposerModelAtom)
+  const {
+    data: defaultTextGenerationModel,
+  } = useDefaultModel(ModelTypeEnum.textGeneration)
+  const defaultModel = defaultTextGenerationModel
+    ? {
+        provider: defaultTextGenerationModel.provider.provider,
+        model: defaultTextGenerationModel.model,
+      }
+    : undefined
+  const currentModel = model ?? defaultModel
+  const {
+    textGenerationModelList,
+  } = useTextGenerationCurrentProviderAndModelAndModelList(currentModel)
+
+  return {
+    currentModel,
+    setConfigureModel: setModel,
+    textGenerationModelList,
+  }
+}
+
+function getPreviewAgentSoulConfig(
+  agentSoulConfig: AgentSoulConfig | undefined,
+  draftAppFeatures: AgentSoulConfig['app_features'] | undefined,
+) {
+  if (!agentSoulConfig || !draftAppFeatures)
+    return agentSoulConfig
+
+  return {
+    ...agentSoulConfig,
+    app_features: draftAppFeatures,
+  }
+}
diff --git a/web/features/agent-v2/agent-detail/configure/use-agent-configure-sync.ts b/web/features/agent-v2/agent-detail/configure/use-agent-configure-sync.ts
new file mode 100644
index 00000000000..f4410b20eb8
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/use-agent-configure-sync.ts
@@ -0,0 +1,173 @@
+'use client'
+
+import type { AgentSoulConfig, ComposerSaveStrategy } from '@dify/contracts/api/console/agent/types.gen'
+import type { DefaultModel } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { debounce } from 'es-toolkit/compat'
+import { useSetAtom, useStore } from 'jotai'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useSerialAsyncCallback } from '@/app/components/workflow/hooks/use-serial-async-callback'
+import { agentSoulConfigToFormState, formStateToAgentSoulConfig } from '@/features/agent-v2/agent-composer/conversions'
+import {
+  agentComposerDraftAtom,
+  agentComposerOriginalConfigAtom,
+  agentComposerOriginalDraftAtom,
+  agentComposerPublishedDraftAtom,
+  isAgentComposerDirtyAtom,
+} from '@/features/agent-v2/agent-composer/store'
+import { consoleQuery } from '@/service/client'
+
+const DRAFT_AUTOSAVE_WAIT = 5000
+
+type AgentConfigurePublishPayload = {
+  agent_id: string
+  config_snapshot: AgentSoulConfig
+}
+
+export function useAgentConfigureSync({
+  agentId,
+  baseConfig,
+  currentModel,
+  enabled,
+}: {
+  agentId: string
+  baseConfig?: AgentSoulConfig
+  currentModel?: DefaultModel
+  enabled: boolean
+}) {
+  const queryClient = useQueryClient()
+  const store = useStore()
+  const setOriginalConfig = useSetAtom(agentComposerOriginalConfigAtom)
+  const setOriginalDraft = useSetAtom(agentComposerOriginalDraftAtom)
+  const setPublishedDraft = useSetAtom(agentComposerPublishedDraftAtom)
+  const [isPublishing, setIsPublishing] = useState(false)
+  const [draftSavedAt, setDraftSavedAt] = useState<number | undefined>(undefined)
+  const baseConfigRef = useRef(baseConfig)
+  const currentModelRef = useRef(currentModel)
+  const enabledRef = useRef(enabled)
+  const lastAutosavedDraftKeyRef = useRef<string | undefined>(undefined)
+
+  baseConfigRef.current = baseConfig
+  currentModelRef.current = currentModel
+  enabledRef.current = enabled
+
+  const getAgentSoulDraft = useCallback(() => formStateToAgentSoulConfig({
+    baseConfig: baseConfigRef.current,
+    formState: store.get(agentComposerDraftAtom),
+    currentModel: currentModelRef.current,
+  }), [store])
+
+  const saveComposerMutation = useMutation(
+    consoleQuery.agent.byAgentId.composer.put.mutationOptions(),
+  )
+
+  const saveComposer = useSerialAsyncCallback(async (
+    saveStrategy: ComposerSaveStrategy,
+    configSnapshot: AgentSoulConfig,
+  ) => {
+    const savedDraftKey = JSON.stringify(configSnapshot)
+    const composerState = await saveComposerMutation.mutateAsync({
+      params: {
+        agent_id: agentId,
+      },
+      body: {
+        variant: 'agent_app',
+        save_strategy: saveStrategy,
+        agent_soul: configSnapshot,
+      },
+    })
+
+    if (saveStrategy === 'save_to_current_version') {
+      setOriginalDraft(agentSoulConfigToFormState(configSnapshot))
+      setDraftSavedAt(Date.now())
+      lastAutosavedDraftKeyRef.current = savedDraftKey
+      return
+    }
+
+    queryClient.setQueryData(
+      consoleQuery.agent.byAgentId.composer.get.queryKey({ input: { params: { agent_id: agentId } } }),
+      composerState,
+    )
+    queryClient.setQueryData(
+      consoleQuery.agent.byAgentId.get.queryKey({ input: { params: { agent_id: agentId } } }),
+      (agentDetail) => {
+        if (!agentDetail)
+          return agentDetail
+
+        return {
+          ...agentDetail,
+          active_config_is_published: true,
+        }
+      },
+    )
+    void queryClient.invalidateQueries({
+      queryKey: consoleQuery.agent.byAgentId.versions.get.key(),
+    })
+    setOriginalConfig(composerState.agent_soul)
+    const publishedDraft = agentSoulConfigToFormState(composerState.agent_soul)
+    setOriginalDraft(publishedDraft)
+    setPublishedDraft(publishedDraft)
+    lastAutosavedDraftKeyRef.current = savedDraftKey
+  })
+
+  const latestDraftSaveRef = useRef<() => void>(() => undefined)
+  latestDraftSaveRef.current = () => {
+    void saveComposer('save_to_current_version', getAgentSoulDraft())
+  }
+
+  const debouncedSaveDraft = useMemo(() => debounce(() => {
+    latestDraftSaveRef.current()
+  }, DRAFT_AUTOSAVE_WAIT), [])
+
+  const saveDraft = useCallback(async () => {
+    if (!enabledRef.current)
+      return
+
+    debouncedSaveDraft.cancel?.()
+    await saveComposer('save_to_current_version', getAgentSoulDraft())
+  }, [debouncedSaveDraft, getAgentSoulDraft, saveComposer])
+
+  useEffect(() => {
+    return store.sub(agentComposerDraftAtom, () => {
+      const agentSoulDraft = getAgentSoulDraft()
+      const agentSoulDraftKey = JSON.stringify(agentSoulDraft)
+
+      if (
+        !enabledRef.current
+        || !store.get(isAgentComposerDirtyAtom)
+        || lastAutosavedDraftKeyRef.current === agentSoulDraftKey
+      ) {
+        return
+      }
+
+      debouncedSaveDraft()
+    })
+  }, [debouncedSaveDraft, getAgentSoulDraft, store])
+
+  useEffect(() => {
+    return () => {
+      debouncedSaveDraft.flush?.()
+    }
+  }, [debouncedSaveDraft])
+
+  const publishDraft = useCallback(async (payload: AgentConfigurePublishPayload) => {
+    debouncedSaveDraft.cancel?.()
+    setIsPublishing(true)
+    try {
+      await saveComposer('save_as_new_version', payload.config_snapshot)
+    }
+    catch {
+      // Draft sync follows workflow autosave behavior: save failures are silent and keep the local draft intact.
+    }
+    finally {
+      setIsPublishing(false)
+    }
+  }, [debouncedSaveDraft, saveComposer])
+
+  return {
+    draftSavedAt,
+    isPublishing,
+    publishDraft,
+    saveDraft,
+  }
+}
diff --git a/web/features/agent-v2/agent-detail/layout.tsx b/web/features/agent-v2/agent-detail/layout.tsx
new file mode 100644
index 00000000000..7088732d9b0
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/layout.tsx
@@ -0,0 +1,36 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import useDocumentTitle from '@/hooks/use-document-title'
+import { consoleQuery } from '@/service/client'
+
+type AgentDetailLayoutProps = {
+  agentId: string
+  children: ReactNode
+}
+
+export function AgentDetailLayout({
+  agentId,
+  children,
+}: AgentDetailLayoutProps) {
+  const { t } = useTranslation('agentV2')
+  const agentQuery = useQuery(consoleQuery.agent.byAgentId.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  }))
+
+  useDocumentTitle(agentQuery.data?.name ?? t('agentDetail.documentTitle'))
+
+  return (
+    <div className="relative flex h-full min-w-0 flex-col overflow-hidden">
+      <div className="min-h-0 min-w-0 flex-1 overflow-auto">
+        {children}
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/logs/components/logs-table.tsx b/web/features/agent-v2/agent-detail/logs/components/logs-table.tsx
new file mode 100644
index 00000000000..ca5e6a6c03d
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/logs/components/logs-table.tsx
@@ -0,0 +1,303 @@
+import type { AgentLogConversationItemResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { ReactNode, TdHTMLAttributes, ThHTMLAttributes } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  ScrollAreaContent,
+  ScrollAreaRoot,
+  ScrollAreaScrollbar,
+  ScrollAreaThumb,
+  ScrollAreaViewport,
+} from '@langgenius/dify-ui/scroll-area'
+import { useTranslation } from 'react-i18next'
+import useTimestamp from '@/hooks/use-timestamp'
+import { LogSourceCell } from './source-cell'
+
+export function AgentLogsTable({
+  logs,
+  isPending,
+  isError,
+  isSuccess,
+  onRetry,
+}: {
+  logs: AgentLogConversationItemResponse[]
+  isPending: boolean
+  isError: boolean
+  isSuccess: boolean
+  onRetry: () => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const tableHeaderLabels = {
+    unread: t('agentDetail.logs.table.unread'),
+    title: t('agentDetail.logs.table.title'),
+    source: t('agentDetail.logs.table.source'),
+    endUser: t('agentDetail.logs.table.endUser'),
+    messageCount: t('agentDetail.logs.table.messageCount'),
+    userRate: t('agentDetail.logs.table.userRate'),
+    operationRate: t('agentDetail.logs.table.operationRate'),
+    updatedTime: t('agentDetail.logs.table.updatedTime'),
+    createdTime: t('agentDetail.logs.table.createdTime'),
+  }
+
+  return (
+    <div className="flex h-full min-w-0 flex-col overflow-hidden">
+      <div className="shrink-0">
+        <table aria-hidden="true" className="w-full table-fixed border-collapse">
+          <LogsTableColGroup />
+          <LogsTableHeader labels={tableHeaderLabels} />
+        </table>
+      </div>
+
+      <ScrollAreaRoot className="relative min-h-0 flex-1 overflow-hidden">
+        <ScrollAreaViewport
+          aria-label={t('agentDetail.logs.title')}
+          role="region"
+          tabIndex={-1}
+          className="overscroll-contain"
+        >
+          <ScrollAreaContent>
+            <table className="w-full table-fixed border-collapse">
+              <LogsTableColGroup />
+              <LogsTableHeader labels={tableHeaderLabels} rowClassName="sr-only" />
+              <AgentLogsTableBody
+                logs={logs}
+                isPending={isPending}
+                isError={isError}
+                isSuccess={isSuccess}
+                onRetry={onRetry}
+              />
+            </table>
+          </ScrollAreaContent>
+        </ScrollAreaViewport>
+        <ScrollAreaScrollbar className="data-[orientation=vertical]:translate-x-1">
+          <ScrollAreaThumb />
+        </ScrollAreaScrollbar>
+      </ScrollAreaRoot>
+    </div>
+  )
+}
+
+function AgentLogsTableBody({
+  logs,
+  isPending,
+  isError,
+  isSuccess,
+  onRetry,
+}: {
+  logs: AgentLogConversationItemResponse[]
+  isPending: boolean
+  isError: boolean
+  isSuccess: boolean
+  onRetry: () => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const { formatTime } = useTimestamp()
+  const notAvailable = t('agentDetail.logs.notAvailable')
+  const formatLogTime = (value?: number | null) =>
+    value == null ? notAvailable : formatTime(value, t('roster.dateTimeFormat'))
+
+  return (
+    <tbody className="system-sm-regular text-text-secondary">
+      {isPending && (
+        <LogsSkeletonRows />
+      )}
+      {isError && (
+        <LogsStateRow>
+          <div className="flex items-center justify-center gap-2">
+            <span>{t('agentDetail.logs.loadFailed')}</span>
+            <Button variant="secondary" size="small" onClick={onRetry}>
+              {tCommon('operation.retry')}
+            </Button>
+          </div>
+        </LogsStateRow>
+      )}
+      {isSuccess && logs.length === 0 && (
+        <LogsStateRow>
+          {t('agentDetail.logs.empty')}
+        </LogsStateRow>
+      )}
+      {isSuccess && logs.map(log => (
+        <tr
+          key={log.id}
+          className="h-10 border-b border-divider-subtle hover:bg-background-default-hover"
+        >
+          <td className="px-0">
+            <span className={cn(
+              'mx-auto block size-1.5 rounded-full',
+              log.unread ? 'bg-util-colors-blue-blue-500' : 'bg-transparent',
+            )}
+            />
+          </td>
+          <TableCell className="system-sm-medium text-text-secondary">
+            {log.title || notAvailable}
+          </TableCell>
+          <td className="px-3">
+            <LogSourceCell source={log.source} />
+          </td>
+          <TableCell translate="no">
+            {log.end_user_id || notAvailable}
+          </TableCell>
+          <TableCell className="tabular-nums">
+            {log.message_count}
+          </TableCell>
+          <TableCell className="text-text-quaternary">
+            {formatRate(log.user_rate, notAvailable)}
+          </TableCell>
+          <TableCell className="text-text-quaternary">
+            {formatRate(log.operation_rate, notAvailable)}
+          </TableCell>
+          <TableCell>
+            {formatLogTime(log.updated_at)}
+          </TableCell>
+          <TableCell>
+            {formatLogTime(log.created_at)}
+          </TableCell>
+        </tr>
+      ))}
+    </tbody>
+  )
+}
+
+function formatRate(value: number | null | undefined, fallback: string) {
+  return value == null ? fallback : `${Math.round(value * 100)}%`
+}
+
+type LogsTableHeaderLabels = {
+  unread: string
+  title: string
+  source: string
+  endUser: string
+  messageCount: string
+  userRate: string
+  operationRate: string
+  updatedTime: string
+  createdTime: string
+}
+
+function LogsTableHeader({
+  labels,
+  rowClassName,
+}: {
+  labels: LogsTableHeaderLabels
+  rowClassName?: string
+}) {
+  return (
+    <thead>
+      <tr className={cn('h-7 bg-background-section-burn text-left system-xs-medium-uppercase text-text-tertiary', rowClassName)}>
+        <th scope="col" className="rounded-l-lg px-0">
+          <span className="sr-only">{labels.unread}</span>
+        </th>
+        <TableHead>{labels.title}</TableHead>
+        <TableHead>{labels.source}</TableHead>
+        <TableHead>{labels.endUser}</TableHead>
+        <TableHead>{labels.messageCount}</TableHead>
+        <TableHead>{labels.userRate}</TableHead>
+        <TableHead>{labels.operationRate}</TableHead>
+        <TableHead>{labels.updatedTime}</TableHead>
+        <TableHead className="rounded-r-lg">{labels.createdTime}</TableHead>
+      </tr>
+    </thead>
+  )
+}
+
+function LogsTableColGroup() {
+  return (
+    <colgroup>
+      <col className="w-5" />
+      <col className="w-[28%]" />
+      <col className="w-[16%]" />
+      <col className="w-[15%]" />
+      <col className="w-[8%]" />
+      <col className="w-[7%]" />
+      <col className="w-[7%]" />
+      <col className="w-[10%]" />
+      <col className="w-[9%]" />
+    </colgroup>
+  )
+}
+
+function LogsStateRow({
+  children,
+}: {
+  children: ReactNode
+}) {
+  return (
+    <tr className="h-20 border-b border-divider-subtle">
+      <td colSpan={9} className="px-3 text-center text-text-tertiary">
+        {children}
+      </td>
+    </tr>
+  )
+}
+
+function LogsSkeletonRows() {
+  return (
+    <>
+      {Array.from({ length: 10 }, (_, index) => (
+        <tr key={index} className="h-10 border-b border-divider-subtle">
+          <td className="px-0">
+            <span className="mx-auto block size-1.5 rounded-full bg-text-quaternary opacity-20" />
+          </td>
+          <td className="px-3">
+            <div className="h-3 w-3/4 rounded-sm bg-text-quaternary opacity-20" />
+          </td>
+          <td className="px-3">
+            <div className="flex items-center gap-2">
+              <div className="size-5 rounded-full bg-text-quaternary opacity-20" />
+              <div className="h-3 w-24 rounded-sm bg-text-quaternary opacity-20" />
+            </div>
+          </td>
+          <td className="px-3">
+            <div className="h-3 w-28 rounded-sm bg-text-quaternary opacity-20" />
+          </td>
+          <td className="px-3">
+            <div className="h-3 w-8 rounded-sm bg-text-quaternary opacity-20" />
+          </td>
+          <td className="px-3">
+            <div className="h-3 w-8 rounded-sm bg-text-quaternary opacity-20" />
+          </td>
+          <td className="px-3">
+            <div className="h-3 w-8 rounded-sm bg-text-quaternary opacity-20" />
+          </td>
+          <td className="px-3">
+            <div className="h-3 w-24 rounded-sm bg-text-quaternary opacity-20" />
+          </td>
+          <td className="px-3">
+            <div className="h-3 w-24 rounded-sm bg-text-quaternary opacity-20" />
+          </td>
+        </tr>
+      ))}
+    </>
+  )
+}
+
+function TableHead({
+  className,
+  ...props
+}: ThHTMLAttributes<HTMLTableCellElement>) {
+  return (
+    <th
+      scope="col"
+      className={cn('px-3 text-left whitespace-nowrap', className)}
+      {...props}
+    />
+  )
+}
+
+function TableCell({
+  children,
+  className,
+  ...props
+}: TdHTMLAttributes<HTMLTableCellElement>) {
+  return (
+    <td
+      className={cn('min-w-0 px-3 whitespace-nowrap', className)}
+      {...props}
+    >
+      <div className="truncate">
+        {children}
+      </div>
+    </td>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/logs/components/source-cell.tsx b/web/features/agent-v2/agent-detail/logs/components/source-cell.tsx
new file mode 100644
index 00000000000..943dcc83578
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/logs/components/source-cell.tsx
@@ -0,0 +1,28 @@
+import type { AgentLogConversationItemResponse } from '@dify/contracts/api/console/agent/types.gen'
+import { useTranslation } from 'react-i18next'
+import { LogSourceIcon } from './source-icon'
+
+export function LogSourceCell({
+  source,
+}: {
+  source?: AgentLogConversationItemResponse['source']
+}) {
+  const { t } = useTranslation('agentV2')
+
+  if (!source) {
+    return (
+      <div className="truncate text-text-quaternary">
+        {t('agentDetail.logs.notAvailable')}
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex min-w-0 items-center gap-2">
+      <LogSourceIcon source={source} />
+      <div className="min-w-0 flex-1 truncate">
+        {source.app_name}
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/logs/components/source-icon.tsx b/web/features/agent-v2/agent-detail/logs/components/source-icon.tsx
new file mode 100644
index 00000000000..5af0c77ab70
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/logs/components/source-icon.tsx
@@ -0,0 +1,33 @@
+import type { AgentIconType, AgentLogSourceResponse } from '@dify/contracts/api/console/agent/types.gen'
+import AppIcon from '@/app/components/base/app-icon'
+
+const getLogSourceImageUrl = (source?: AgentLogSourceResponse | null) =>
+  (source?.app_icon_type === 'image' || source?.app_icon_type === 'link')
+    ? source.app_icon
+    : undefined
+
+const getLogSourceIconType = (source?: AgentLogSourceResponse | null) => {
+  const imageUrl = getLogSourceImageUrl(source)
+  return (imageUrl ? 'image' : source?.app_icon_type) as AgentIconType | null | undefined
+}
+
+export function LogSourceIcon({
+  source,
+}: {
+  source?: AgentLogSourceResponse | null
+}) {
+  if (!source)
+    return <span aria-hidden className="i-ri-apps-2-line size-5 shrink-0 text-text-quaternary" />
+
+  return (
+    <AppIcon
+      size="xs"
+      rounded
+      iconType={getLogSourceIconType(source)}
+      icon={source.app_icon ?? undefined}
+      background={source.app_icon_background}
+      imageUrl={getLogSourceImageUrl(source)}
+      className="size-5 text-sm"
+    />
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/logs/components/source-picker.tsx b/web/features/agent-v2/agent-detail/logs/components/source-picker.tsx
new file mode 100644
index 00000000000..6d04799ec87
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/logs/components/source-picker.tsx
@@ -0,0 +1,184 @@
+import type { AgentLogSourceGroupResponse, AgentLogSourceResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { TFunction } from 'i18next'
+import type { ReactNode } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  Combobox,
+  ComboboxClear,
+  ComboboxCollection,
+  ComboboxContent,
+  ComboboxEmpty,
+  ComboboxGroup,
+  ComboboxGroupLabel,
+  ComboboxInput,
+  ComboboxInputGroup,
+  ComboboxItem,
+  ComboboxItemText,
+  ComboboxList,
+  ComboboxTrigger,
+  ComboboxValue,
+} from '@langgenius/dify-ui/combobox'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { LogSourceIcon } from './source-icon'
+
+export type SourceFilterValue = AgentLogSourceResponse['id'][]
+
+const getSourceGroupLabel = (
+  group: AgentLogSourceGroupResponse,
+  t: TFunction<'agentV2'>,
+) => {
+  if (group.type === 'webapp')
+    return t('agentDetail.logs.filters.source.webapp')
+  if (group.type === 'workflow')
+    return t('agentDetail.logs.filters.source.workflow')
+  return group.label
+}
+
+const getSourceLabel = (source: AgentLogSourceResponse) => source.app_name
+
+export function AgentLogSourcePicker({
+  value,
+  groups,
+  isLoading,
+  isError,
+  onRetry,
+  onChange,
+}: {
+  value: SourceFilterValue
+  groups: AgentLogSourceGroupResponse[]
+  isLoading: boolean
+  isError: boolean
+  onRetry: () => void
+  onChange: (value: SourceFilterValue) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const [inputValue, setInputValue] = useState('')
+  const sources = groups.flatMap(group => group.sources ?? [])
+  const selectedSources = sources.filter(source => value.includes(source.id))
+
+  return (
+    <Combobox<AgentLogSourceResponse, true>
+      multiple
+      items={groups}
+      value={selectedSources}
+      itemToStringLabel={getSourceLabel}
+      onValueChange={(nextSources) => {
+        setInputValue('')
+        onChange(nextSources.map(source => source.id))
+      }}
+      inputValue={inputValue}
+      onInputValueChange={setInputValue}
+    >
+      <ComboboxTrigger
+        aria-label={t('agentDetail.logs.filters.source.label')}
+        className="mt-0 w-fit max-w-full min-w-22"
+      >
+        <ComboboxValue placeholder={t('agentDetail.logs.filters.source.all')}>
+          {(selectedValue: AgentLogSourceResponse[]) => {
+            if (selectedValue.length === 0)
+              return t('agentDetail.logs.filters.source.all')
+            if (selectedValue.length === 1)
+              return selectedValue[0]!.app_name
+            return tCommon('dynamicSelect.selected', { count: selectedValue.length })
+          }}
+        </ComboboxValue>
+      </ComboboxTrigger>
+      <ComboboxContent popupClassName="w-80 p-0">
+        <div className="p-2 pb-1">
+          <ComboboxInputGroup className="h-8 min-h-8 px-2">
+            <span aria-hidden className="mr-0.5 i-ri-search-line size-4 shrink-0 text-components-input-text-placeholder" />
+            <ComboboxInput
+              aria-label={t('agentDetail.logs.filters.source.searchLabel')}
+              placeholder={t('agentDetail.logs.filters.source.searchPlaceholder')}
+              className="block h-4.5 grow px-1 py-0 system-sm-regular text-components-input-text-filled"
+            />
+            <ComboboxClear className="mr-0" />
+          </ComboboxInputGroup>
+        </div>
+        {isLoading && (
+          <SourcePickerStatus>
+            {t('agentDetail.logs.filters.source.loading')}
+          </SourcePickerStatus>
+        )}
+        {isError && (
+          <SourcePickerStatus className="flex items-center justify-center gap-2">
+            <span>{t('agentDetail.logs.filters.source.loadFailed')}</span>
+            <Button variant="secondary" size="small" onClick={onRetry}>
+              {t('operation.retry', { ns: 'common' })}
+            </Button>
+          </SourcePickerStatus>
+        )}
+        {!isLoading && !isError && (
+          <>
+            <ComboboxList className="max-h-69 p-2 pt-1">
+              {groups.map(group => (
+                <ComboboxGroup key={group.type} items={group.sources ?? []}>
+                  <ComboboxGroupLabel className="px-1 pt-2 pb-1">
+                    {getSourceGroupLabel(group, t)}
+                  </ComboboxGroupLabel>
+                  <ComboboxCollection>
+                    {(source: AgentLogSourceResponse) => (
+                      <ComboboxItem
+                        key={source.id}
+                        value={source}
+                        className="min-h-7 grid-cols-[1fr] gap-0 px-1 py-1"
+                      >
+                        <ComboboxItemText className="flex min-w-0 items-center gap-2 px-0 system-sm-regular">
+                          <SourceCheckbox checked={value.includes(source.id)} />
+                          <LogSourceIcon source={source} />
+                          <span className="min-w-0 flex-1 truncate">
+                            {source.app_name}
+                          </span>
+                        </ComboboxItemText>
+                      </ComboboxItem>
+                    )}
+                  </ComboboxCollection>
+                </ComboboxGroup>
+              ))}
+            </ComboboxList>
+            <ComboboxEmpty className="px-3 py-3 text-center system-xs-regular">
+              {t('agentDetail.logs.filters.source.empty')}
+            </ComboboxEmpty>
+          </>
+        )}
+      </ComboboxContent>
+    </Combobox>
+  )
+}
+
+function SourcePickerStatus({
+  children,
+  className,
+}: {
+  children: ReactNode
+  className?: string
+}) {
+  return (
+    <div className={cn('px-3 py-3 text-center system-xs-regular text-text-tertiary', className)}>
+      {children}
+    </div>
+  )
+}
+
+function SourceCheckbox({
+  checked,
+}: {
+  checked: boolean
+}) {
+  return (
+    <span
+      aria-hidden
+      className={cn(
+        'flex size-4 shrink-0 items-center justify-center rounded-sm border shadow-xs shadow-shadow-shadow-3',
+        checked
+          ? 'border-transparent bg-components-checkbox-bg text-components-checkbox-icon'
+          : 'border-components-checkbox-border bg-components-checkbox-bg-unchecked',
+      )}
+    >
+      {checked && <span className="i-ri-check-line size-3" />}
+    </span>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/logs/page.tsx b/web/features/agent-v2/agent-detail/logs/page.tsx
new file mode 100644
index 00000000000..bd3a31bfe96
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/logs/page.tsx
@@ -0,0 +1,201 @@
+'use client'
+
+import type { SourceFilterValue } from './components/source-picker'
+import { Pagination } from '@langgenius/dify-ui/pagination'
+import { useQuery } from '@tanstack/react-query'
+import dayjs from 'dayjs'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import Chip from '@/app/components/base/chip'
+import { SearchInput } from '@/app/components/base/search-input'
+import Sort from '@/app/components/base/sort'
+import { useDocLink } from '@/context/i18n'
+import { consoleQuery } from '@/service/client'
+import { AgentLogsTable } from './components/logs-table'
+import { AgentLogSourcePicker } from './components/source-picker'
+
+type PeriodKey = 'last7days' | 'last30days' | 'allTime'
+
+type AgentLogsPageProps = {
+  agentId: string
+}
+
+const queryDateFormat = 'YYYY-MM-DD HH:mm'
+
+const periodOptions: Array<{
+  value: PeriodKey
+  labelKey: 'agentDetail.logs.filters.period.last7days' | 'agentDetail.logs.filters.period.last30days' | 'agentDetail.logs.filters.period.allTime'
+}> = [
+  { value: 'last7days', labelKey: 'agentDetail.logs.filters.period.last7days' },
+  { value: 'last30days', labelKey: 'agentDetail.logs.filters.period.last30days' },
+  { value: 'allTime', labelKey: 'agentDetail.logs.filters.period.allTime' },
+]
+
+const getPeriodQuery = (period: PeriodKey) => {
+  if (period === 'allTime')
+    return {}
+
+  const days = period === 'last7days' ? 7 : 30
+  return {
+    start: dayjs().subtract(days, 'day').format(queryDateFormat),
+    end: dayjs().add(1, 'minute').format(queryDateFormat),
+  }
+}
+
+export function AgentLogsPage({
+  agentId,
+}: AgentLogsPageProps) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const docLink = useDocLink()
+  const [period, setPeriod] = useState<PeriodKey>('last7days')
+  const [source, setSource] = useState<SourceFilterValue>([])
+  const [keyword, setKeyword] = useState('')
+  const [page, setPage] = useState(1)
+  const [limit, setLimit] = useState(25)
+  const periodItems = periodOptions.map(option => ({
+    value: option.value,
+    name: t(option.labelKey),
+  }))
+  const logSourcesQuery = useQuery(consoleQuery.agent.byAgentId.logSources.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  }))
+  const logsQuery = useQuery(consoleQuery.agent.byAgentId.logs.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+      query: {
+        ...getPeriodQuery(period),
+        page,
+        limit,
+        keyword: keyword.trim() || undefined,
+        // TODO: Send multiple source ids after the backend contract supports multi-source filtering.
+        source: source.length === 1 ? source[0] : undefined,
+      },
+    },
+  }))
+  const logs = logsQuery.data?.data ?? []
+  const totalPages = Math.max(Math.ceil((logsQuery.data?.total ?? 0) / limit), 1)
+  const currentPage = logsQuery.data?.page ?? page
+
+  return (
+    <section
+      aria-label={t('agentDetail.sections.logs')}
+      className="flex h-full min-w-0 flex-1 flex-col overflow-hidden bg-components-panel-bg-blur"
+    >
+      <header className="h-26.5 shrink-0 px-6 pt-3 pb-2">
+        <div className="min-w-0">
+          <h2 className="system-xl-semibold text-text-primary">
+            {t('agentDetail.logs.title')}
+          </h2>
+          <p className="mt-1 flex min-w-0 flex-wrap items-center gap-x-0.5 system-xs-regular text-text-tertiary">
+            <span>{t('agentDetail.logs.description')}</span>
+            <a
+              href={docLink('/use-dify/monitor/logs')}
+              target="_blank"
+              rel="noreferrer"
+              className="inline-flex shrink-0 items-center gap-0.5 rounded-sm text-text-accent hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            >
+              {t('agentDetail.logs.learnMore')}
+              <span aria-hidden className="i-ri-external-link-line size-3" />
+            </a>
+          </p>
+        </div>
+
+        <div className="mt-3 flex min-w-0 items-center justify-between gap-3">
+          <div className="flex min-w-0 flex-1 items-center gap-2">
+            <Chip
+              value={period}
+              items={periodItems}
+              leftIcon={<span aria-hidden className="i-ri-calendar-line block size-4 text-text-secondary" />}
+              className="min-w-32"
+              onSelect={(item) => {
+                setPage(1)
+                setPeriod(item.value)
+              }}
+              onClear={() => {
+                setPage(1)
+                setPeriod('allTime')
+              }}
+            />
+
+            <AgentLogSourcePicker
+              value={source}
+              groups={logSourcesQuery.data?.groups ?? []}
+              isLoading={logSourcesQuery.isPending}
+              isError={logSourcesQuery.isError}
+              onRetry={() => {
+                void logSourcesQuery.refetch()
+              }}
+              onChange={(nextSource) => {
+                setPage(1)
+                setSource(nextSource)
+              }}
+            />
+
+            <SearchInput
+              aria-label={t('agentDetail.logs.filters.search.label')}
+              value={keyword}
+              placeholder={t('agentDetail.logs.filters.search.placeholder')}
+              className="w-50 shrink-0"
+              onValueChange={(nextKeyword) => {
+                setPage(1)
+                setKeyword(nextKeyword)
+              }}
+            />
+          </div>
+
+          <Sort
+            order="desc"
+            value="updated_at"
+            items={[
+              { value: 'created_at', name: t('agentDetail.logs.filters.sort.lastCreatedTime') },
+              { value: 'updated_at', name: t('agentDetail.logs.filters.sort.lastUpdatedTime') },
+            ]}
+            onSelect={() => {}}
+          />
+        </div>
+      </header>
+
+      <div className="min-h-0 flex-1 px-6 pt-2 pb-3">
+        <AgentLogsTable
+          logs={logs}
+          isPending={logsQuery.isPending}
+          isError={logsQuery.isError}
+          isSuccess={logsQuery.isSuccess}
+          onRetry={() => {
+            void logsQuery.refetch()
+          }}
+        />
+      </div>
+
+      <Pagination
+        page={currentPage}
+        totalPages={totalPages}
+        onPageChange={setPage}
+        className="h-14 shrink-0 px-6 py-3"
+        labels={{
+          previous: tCommon('pagination.previous'),
+          next: tCommon('pagination.next'),
+          editPageNumber: (page, totalPages) => tCommon('pagination.editPageNumber', { page, totalPages }),
+          pageNumberInput: tCommon('pagination.pageNumber'),
+        }}
+        pageSize={{
+          value: limit,
+          options: [10, 25, 50],
+          onValueChange: (nextLimit) => {
+            setPage(1)
+            setLimit(nextLimit)
+          },
+          label: tCommon('pagination.perPage'),
+          ariaLabel: tCommon('pagination.perPage'),
+        }}
+      />
+    </section>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/monitoring/chart-utils.ts b/web/features/agent-v2/agent-detail/monitoring/chart-utils.ts
new file mode 100644
index 00000000000..2e34d74dd80
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/monitoring/chart-utils.ts
@@ -0,0 +1,252 @@
+import type { EChartsOption } from 'echarts'
+import dayjs from 'dayjs'
+import { formatNumber } from '@/utils/format'
+
+export type AgentMonitoringChartType = 'conversations' | 'endUsers' | 'tokenUsage'
+
+export type AgentMonitoringChartRow = {
+  date: string
+  total_price?: number | string
+} & Record<string, number | string | undefined>
+
+type ColorType = 'green' | 'orange' | 'blue'
+
+const colorTypeMap: Record<ColorType, { lineColor: string, bgColor: [string, string] }> = {
+  green: {
+    lineColor: 'rgba(6, 148, 162, 1)',
+    bgColor: ['rgba(6, 148, 162, 0.2)', 'rgba(67, 174, 185, 0.08)'],
+  },
+  orange: {
+    lineColor: 'rgba(255, 138, 76, 1)',
+    bgColor: ['rgba(254, 145, 87, 0.2)', 'rgba(255, 138, 76, 0.1)'],
+  },
+  blue: {
+    lineColor: 'rgba(28, 100, 242, 1)',
+    bgColor: ['rgba(28, 100, 242, 0.3)', 'rgba(28, 100, 242, 0.1)'],
+  },
+}
+
+const chartTypeColorMap: Record<AgentMonitoringChartType, ColorType> = {
+  conversations: 'blue',
+  endUsers: 'blue',
+  tokenUsage: 'blue',
+}
+
+const commonDateFormat = 'MMM D, YYYY'
+const axisDateFormat = 'MMM'
+
+const sumValues = (rows: AgentMonitoringChartRow[], field: string) => {
+  return rows.reduce((sum, row) => sum + Number(row[field] ?? 0), 0)
+}
+
+const getChartColors = (chartType: AgentMonitoringChartType) => colorTypeMap[chartTypeColorMap[chartType]]
+
+const getMarkLineSeedData = (statisticsLength: number) => {
+  const markLineLength = statisticsLength >= 2 ? statisticsLength - 2 : statisticsLength
+  return ['', ...Array.from({ length: markLineLength }, () => '1'), '']
+}
+
+const getTooltipContent = (
+  chartType: AgentMonitoringChartType,
+  yField: string,
+  params: { name: string, data?: AgentMonitoringChartRow },
+) => {
+  const row = params.data ?? { date: params.name }
+  const value = row[yField] ?? 0
+
+  if (chartType !== 'tokenUsage')
+    return `<div style='color:#6B7280;font-size:12px'>${params.name}</div><div style='font-size:14px;color:#1F2A37'>${value}</div>`
+
+  return `<div style='color:#6B7280;font-size:12px'>${params.name}</div>
+    <div style='font-size:14px;color:#1F2A37'>${value}
+      <span style='font-size:12px'>
+        <span style='margin-left:4px;color:#6B7280'>(</span>
+        <span style='color:#FF8A4C'>~$${row.total_price ?? 0}</span>
+        <span style='color:#6B7280'>)</span>
+      </span>
+    </div>`
+}
+
+export const getDefaultChartData = ({
+  key = 'count',
+}: {
+  start: string
+  end: string
+  key?: string
+}) => {
+  const values = [180, 198, 188, 286, 423, 345]
+
+  return values.map((value, index) => ({
+    date: dayjs('2024-01-01').add(index, 'month').format(commonDateFormat),
+    [key]: value,
+    total_price: '0.0000',
+  }))
+}
+
+export const getChartValueField = (
+  rows: AgentMonitoringChartRow[],
+  valueKey?: string,
+) => {
+  if (valueKey)
+    return valueKey
+
+  return Object.keys(rows[0] ?? {}).find(name => name.includes('count')) ?? 'count'
+}
+
+/**
+ * @public
+ */
+// TODO: Remove this marker after summary values are wired to monitoring cards.
+export const getSummaryValue = ({
+  chartType,
+  rows,
+  valueKey,
+  isAvg,
+  unit = '',
+}: {
+  chartType: AgentMonitoringChartType
+  rows: AgentMonitoringChartRow[]
+  valueKey: string
+  isAvg?: boolean
+  unit?: string
+}) => {
+  const value = sumValues(rows, valueKey)
+  const summary = isAvg ? value / (rows.length || 1) : value
+
+  if (chartType === 'tokenUsage') {
+    const formattedUsage = summary < 1000
+      ? summary
+      : `${formatNumber(Math.round(summary / 1000))}k`
+
+    return `${formattedUsage}`
+  }
+
+  return `${summary.toLocaleString()} ${unit}`.trim()
+}
+
+export const getTokenSummary = (rows: AgentMonitoringChartRow[]) => {
+  const totalPrice = rows.reduce((sum, row) => sum + Number.parseFloat(String(row.total_price ?? '0')), 0)
+
+  return totalPrice.toLocaleString('en-US', {
+    style: 'currency',
+    currency: 'USD',
+    minimumFractionDigits: 4,
+  })
+}
+
+export const buildChartOptions = ({
+  rows,
+  chartType,
+  valueKey,
+  yMax,
+}: {
+  rows: AgentMonitoringChartRow[]
+  chartType: AgentMonitoringChartType
+  valueKey: string
+  yMax?: number
+}): EChartsOption => {
+  const xData = rows.map(({ date }) => date)
+  const chartColors = getChartColors(chartType)
+  const markLineSeedData = getMarkLineSeedData(rows.length)
+
+  return {
+    dataset: {
+      dimensions: ['date', valueKey],
+      source: rows,
+    },
+    grid: { top: 8, right: 36, bottom: 10, left: 25, containLabel: true },
+    tooltip: {
+      trigger: 'item',
+      position: 'top',
+      borderWidth: 0,
+    },
+    xAxis: [{
+      type: 'category',
+      boundaryGap: false,
+      axisLabel: {
+        color: '#9CA3AF',
+        hideOverlap: true,
+        overflow: 'break',
+        formatter(value) {
+          return dayjs(value).format(axisDateFormat)
+        },
+      },
+      axisLine: { show: false },
+      axisTick: { show: false },
+      splitLine: {
+        show: true,
+        lineStyle: {
+          color: '#F3F4F6',
+          width: 1,
+          type: [10, 10],
+        },
+        interval(index) {
+          return index === 0 || index === xData.length - 1
+        },
+      },
+    }, {
+      position: 'bottom',
+      boundaryGap: false,
+      data: markLineSeedData,
+      axisLabel: { show: false },
+      axisLine: { show: false },
+      axisTick: { show: false },
+      splitLine: {
+        show: true,
+        lineStyle: {
+          color: '#E5E7EB',
+        },
+        interval(_index, value) {
+          return !!value
+        },
+      },
+    }],
+    yAxis: {
+      max: yMax ?? 'dataMax',
+      type: 'value',
+      axisLabel: { color: '#9CA3AF', hideOverlap: true },
+      splitLine: {
+        lineStyle: {
+          color: '#F3F4F6',
+        },
+      },
+    },
+    series: [
+      {
+        type: 'line',
+        showSymbol: true,
+        symbolSize: 4,
+        lineStyle: {
+          color: chartColors.lineColor,
+          width: 2,
+        },
+        itemStyle: {
+          color: chartColors.lineColor,
+        },
+        areaStyle: {
+          color: {
+            type: 'linear',
+            x: 0,
+            y: 0,
+            x2: 0,
+            y2: 1,
+            colorStops: [{
+              offset: 0,
+              color: chartColors.bgColor[0],
+            }, {
+              offset: 1,
+              color: chartColors.bgColor[1],
+            }],
+            global: false,
+          },
+        },
+        tooltip: {
+          padding: [8, 12, 8, 12],
+          formatter(params) {
+            return getTooltipContent(chartType, valueKey, params as { name: string, data?: AgentMonitoringChartRow })
+          },
+        },
+      },
+    ],
+  }
+}
diff --git a/web/features/agent-v2/agent-detail/monitoring/chart.tsx b/web/features/agent-v2/agent-detail/monitoring/chart.tsx
new file mode 100644
index 00000000000..a7ca45bae91
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/monitoring/chart.tsx
@@ -0,0 +1,84 @@
+'use client'
+
+import type { AgentMonitoringChartRow, AgentMonitoringChartType } from './chart-utils'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
+import ReactECharts from 'echarts-for-react'
+import { useTranslation } from 'react-i18next'
+import { Infotip } from '@/app/components/base/infotip'
+import {
+  buildChartOptions,
+  getChartValueField,
+  getTokenSummary,
+} from './chart-utils'
+
+type AgentMonitoringChartProps = {
+  titleKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  explanationKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  summaryValue: string
+  rows: AgentMonitoringChartRow[]
+  chartType: AgentMonitoringChartType
+  valueKey?: string
+  unitKey?: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  yMax?: number
+}
+
+export function AgentMonitoringChart({
+  titleKey,
+  explanationKey,
+  summaryValue,
+  rows,
+  chartType,
+  valueKey,
+  unitKey,
+  yMax,
+}: AgentMonitoringChartProps) {
+  const { t } = useTranslation('agentV2')
+  const yField = getChartValueField(rows, valueKey)
+  const tokenSummary = getTokenSummary(rows)
+  const options = buildChartOptions({
+    rows,
+    chartType,
+    valueKey: yField,
+    yMax,
+  })
+  const isEmptySummary = summaryValue === '0' || summaryValue.startsWith('0 ')
+
+  return (
+    <article className="flex min-h-79 w-full min-w-0 flex-col rounded-xl border border-components-panel-border bg-components-chart-bg px-6 pt-6 pb-4 shadow-xs">
+      <div className="min-w-0">
+        <div className="flex min-w-0 items-center gap-1">
+          <h3 className="truncate system-xs-semibold-uppercase text-text-secondary">
+            {t(titleKey)}
+          </h3>
+          <Infotip aria-label={t(explanationKey)}>
+            {t(explanationKey)}
+          </Infotip>
+        </div>
+      </div>
+
+      <div className="mt-2 mb-4 flex min-w-0 items-baseline gap-1">
+        <div className={`truncate text-2xl leading-8 font-semibold ${isEmptySummary ? 'text-text-quaternary' : 'text-text-primary'}`}>
+          {summaryValue}
+        </div>
+        {chartType !== 'tokenUsage' && unitKey && (
+          <div className="truncate system-sm-regular text-text-secondary">
+            {t(unitKey)}
+          </div>
+        )}
+        {chartType === 'tokenUsage' && (
+          <div className="truncate system-sm-regular text-text-secondary">
+            {t('agentDetail.monitoring.tokenUsageConsumed')}
+            {' '}
+            <span className="text-util-colors-orange-orange-600">
+              (~
+              {tokenSummary}
+              )
+            </span>
+          </div>
+        )}
+      </div>
+
+      <ReactECharts option={options} style={{ height: 240 }} />
+    </article>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/monitoring/mock-data.ts b/web/features/agent-v2/agent-detail/monitoring/mock-data.ts
new file mode 100644
index 00000000000..78a566fd6bf
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/monitoring/mock-data.ts
@@ -0,0 +1,85 @@
+import type { AgentMonitoringChartRow } from './chart-utils'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
+import { getDefaultChartData } from './chart-utils'
+
+type AgentMonitoringMetric = {
+  id: string
+  titleKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  explanationKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  chartType: 'conversations' | 'endUsers' | 'tokenUsage'
+  rows: AgentMonitoringChartRow[]
+  summaryValue: string
+  valueKey?: string
+  unitKey?: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  yMax: number
+}
+
+export const getAgentMonitoringMetrics = ({
+  start,
+  end,
+}: {
+  start: string
+  end: string
+}): AgentMonitoringMetric[] => [
+  {
+    id: 'total-messages',
+    titleKey: 'agentDetail.monitoring.metrics.totalMessages.title',
+    explanationKey: 'agentDetail.monitoring.metrics.totalMessages.explanation',
+    chartType: 'conversations',
+    rows: getDefaultChartData({ start, end, key: 'messages' }),
+    summaryValue: '250k',
+    valueKey: 'messages',
+    yMax: 500,
+  },
+  {
+    id: 'active-users',
+    titleKey: 'agentDetail.monitoring.metrics.activeUsers.title',
+    explanationKey: 'agentDetail.monitoring.metrics.activeUsers.explanation',
+    chartType: 'endUsers',
+    rows: getDefaultChartData({ start, end, key: 'users' }),
+    summaryValue: '20k',
+    valueKey: 'users',
+    yMax: 500,
+  },
+  {
+    id: 'avg-session-interactions',
+    titleKey: 'agentDetail.monitoring.metrics.avgSessionInteractions.title',
+    explanationKey: 'agentDetail.monitoring.metrics.avgSessionInteractions.explanation',
+    chartType: 'conversations',
+    rows: getDefaultChartData({ start, end, key: 'interactions' }),
+    summaryValue: '20k',
+    valueKey: 'interactions',
+    yMax: 500,
+  },
+  {
+    id: 'token-output-speed',
+    titleKey: 'agentDetail.monitoring.metrics.tokenOutputSpeed.title',
+    explanationKey: 'agentDetail.monitoring.metrics.tokenOutputSpeed.explanation',
+    chartType: 'conversations',
+    rows: getDefaultChartData({ start, end, key: 'tps' }),
+    summaryValue: '1087',
+    valueKey: 'tps',
+    unitKey: 'agentDetail.monitoring.units.tokenPerSecond',
+    yMax: 100,
+  },
+  {
+    id: 'user-satisfaction-rate',
+    titleKey: 'agentDetail.monitoring.metrics.userSatisfactionRate.title',
+    explanationKey: 'agentDetail.monitoring.metrics.userSatisfactionRate.explanation',
+    chartType: 'endUsers',
+    rows: getDefaultChartData({ start, end, key: 'rate' }),
+    summaryValue: '0',
+    valueKey: 'rate',
+    yMax: 1000,
+  },
+  {
+    id: 'token-usage',
+    titleKey: 'agentDetail.monitoring.metrics.tokenUsage.title',
+    explanationKey: 'agentDetail.monitoring.metrics.tokenUsage.explanation',
+    chartType: 'tokenUsage',
+    rows: getDefaultChartData({ start, end, key: 'tokens' }),
+    summaryValue: '1087',
+    valueKey: 'tokens',
+    yMax: 100,
+  },
+]
diff --git a/web/features/agent-v2/agent-detail/monitoring/page.tsx b/web/features/agent-v2/agent-detail/monitoring/page.tsx
new file mode 100644
index 00000000000..6dedc0de4bc
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/monitoring/page.tsx
@@ -0,0 +1,142 @@
+'use client'
+
+import type { AgentAccessSource } from '../access/access-sources'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useQuery } from '@tanstack/react-query'
+import dayjs from 'dayjs'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import Chip from '@/app/components/base/chip'
+import { useDocLink } from '@/context/i18n'
+import { consoleQuery } from '@/service/client'
+import { getAgentAccessSources } from '../access/access-sources'
+import { AgentMonitoringChart } from './chart'
+import { getAgentMonitoringMetrics } from './mock-data'
+import { AgentMonitoringTimeRangePicker } from './time-range-picker'
+
+type SourceFilterValue = 'all' | AgentAccessSource['id']
+type AgentMonitoringPageProps = {
+  agentId: string
+}
+
+const queryDateFormat = 'YYYY-MM-DD HH:mm'
+
+const getDefaultPeriodQuery = () => {
+  const start = dayjs().startOf('day')
+  const end = dayjs().endOf('day')
+
+  return {
+    start: start.format(queryDateFormat),
+    end: end.format(queryDateFormat),
+  }
+}
+
+const getSourceValue = (source: AgentAccessSource): SourceFilterValue => source.id
+
+export function AgentMonitoringPage({
+  agentId,
+}: AgentMonitoringPageProps) {
+  const { t } = useTranslation('agentV2')
+  const docLink = useDocLink()
+  const [period, setPeriod] = useState(() => ({
+    name: t('agentDetail.monitoring.timeRanges.today'),
+    query: getDefaultPeriodQuery(),
+  }))
+  const [sourceFilter, setSourceFilter] = useState<SourceFilterValue>('all')
+  const agentQuery = useQuery(consoleQuery.agent.byAgentId.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  }))
+  const accessSources = getAgentAccessSources(agentQuery.data)
+  const sourceItems = [
+    {
+      value: 'all' as const,
+      name: t('agentDetail.monitoring.sources.all'),
+      triggerName: t('agentDetail.monitoring.sourceTrigger', {
+        name: t('agentDetail.monitoring.sources.all'),
+      }),
+    },
+    ...accessSources.map(source => ({
+      value: getSourceValue(source),
+      name: t(source.nameKey),
+      triggerName: t('agentDetail.monitoring.sourceTrigger', {
+        name: t(source.nameKey),
+      }),
+    })),
+  ]
+  const metrics = getAgentMonitoringMetrics(period.query)
+
+  return (
+    <section
+      aria-label={t('agentDetail.sections.monitoring')}
+      className="flex h-full min-w-0 flex-1 flex-col overflow-hidden bg-components-panel-bg-blur"
+    >
+      <header className="h-26.5 shrink-0 px-6 pt-3 pb-2">
+        <div className="min-w-0">
+          <h2 className="system-xl-semibold text-text-primary">
+            {t('agentDetail.monitoring.title')}
+          </h2>
+          <p className="mt-1 flex min-w-0 flex-wrap items-center gap-x-0.5 system-xs-regular text-text-tertiary">
+            <span>{t('agentDetail.monitoring.description')}</span>
+            <a
+              href={docLink('/use-dify/monitor/logs')}
+              target="_blank"
+              rel="noreferrer"
+              className="inline-flex shrink-0 items-center gap-0.5 rounded-sm text-text-accent hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            >
+              {t('agentDetail.monitoring.learnMore')}
+              <span aria-hidden className="i-ri-external-link-line size-3" />
+            </a>
+          </p>
+        </div>
+
+        <div className="mt-3 flex min-w-0 flex-wrap items-center gap-2">
+          <AgentMonitoringTimeRangePicker
+            value={period}
+            onChange={setPeriod}
+          />
+
+          <Chip
+            showLeftIcon={false}
+            className="min-w-53"
+            panelClassName="w-61"
+            value={sourceFilter}
+            items={sourceItems}
+            onSelect={(item) => {
+              setSourceFilter(item.value)
+            }}
+            onClear={() => {
+              setSourceFilter('all')
+            }}
+          />
+        </div>
+      </header>
+
+      <ScrollArea
+        className="min-h-0 flex-1 overflow-hidden"
+        slotClassNames={{
+          content: 'px-6 pt-2 pb-3',
+        }}
+      >
+        <div className="grid w-full grid-cols-1 gap-3 xl:grid-cols-2">
+          {metrics.map(metric => (
+            <AgentMonitoringChart
+              key={metric.id}
+              titleKey={metric.titleKey}
+              explanationKey={metric.explanationKey}
+              summaryValue={metric.summaryValue}
+              rows={metric.rows}
+              chartType={metric.chartType}
+              valueKey={metric.valueKey}
+              unitKey={metric.unitKey}
+              yMax={metric.yMax}
+            />
+          ))}
+        </div>
+      </ScrollArea>
+    </section>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/monitoring/time-range-picker.tsx b/web/features/agent-v2/agent-detail/monitoring/time-range-picker.tsx
new file mode 100644
index 00000000000..9f23663ac5d
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/monitoring/time-range-picker.tsx
@@ -0,0 +1,228 @@
+'use client'
+
+import type { Dayjs } from 'dayjs'
+import type { TriggerProps } from '@/app/components/base/date-and-time-picker/types'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Select, SelectContent, SelectItem, SelectItemIndicator, SelectItemText, SelectTrigger } from '@langgenius/dify-ui/select'
+import dayjs from 'dayjs'
+import { noop } from 'es-toolkit/function'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import DatePicker from '@/app/components/base/date-and-time-picker/date-picker'
+import { useLocale } from '@/context/i18n'
+import { formatToLocalTime } from '@/utils/format'
+
+export type AgentMonitoringPeriod = {
+  name: string
+  query: {
+    start: string
+    end: string
+  }
+}
+
+type TimeRangeKey = 'today' | 'last7days' | 'last30days'
+
+type TimeRangeOption = {
+  value: TimeRangeKey
+  days: number
+  nameKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.timeRanges.'>
+}
+
+type AgentMonitoringTimeRangePickerProps = {
+  value: AgentMonitoringPeriod
+  onChange: (period: AgentMonitoringPeriod) => void
+}
+
+const today = dayjs()
+const queryDateFormat = 'YYYY-MM-DD HH:mm'
+
+const timeRangeOptions: TimeRangeOption[] = [
+  { value: 'today', days: 0, nameKey: 'agentDetail.monitoring.timeRanges.today' },
+  { value: 'last7days', days: 7, nameKey: 'agentDetail.monitoring.timeRanges.last7days' },
+  { value: 'last30days', days: 30, nameKey: 'agentDetail.monitoring.timeRanges.last30days' },
+]
+
+const getRangePeriod = (option: TimeRangeOption): AgentMonitoringPeriod => {
+  const end = today.endOf('day')
+  const start = option.days === 0
+    ? today.startOf('day')
+    : today.subtract(option.days, 'day').startOf('day')
+
+  return {
+    name: option.value,
+    query: {
+      start: start.format(queryDateFormat),
+      end: end.format(queryDateFormat),
+    },
+  }
+}
+
+function DateRangePart({
+  start,
+  end,
+  onStartChange,
+  onEndChange,
+}: {
+  start: Dayjs
+  end: Dayjs
+  onStartChange: (date?: Dayjs) => void
+  onEndChange: (date?: Dayjs) => void
+}) {
+  const locale = useLocale()
+
+  const renderDate = ({ value, handleClickTrigger, isOpen }: TriggerProps) => (
+    <div
+      role="button"
+      tabIndex={0}
+      data-open={isOpen ? 'true' : undefined}
+      className={cn(
+        'flex h-7 cursor-pointer items-center rounded-lg px-1 system-sm-regular text-components-input-text-filled hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden data-[open=true]:bg-state-base-hover',
+      )}
+      onClick={handleClickTrigger}
+      onKeyDown={(event) => {
+        if (event.key !== 'Enter' && event.key !== ' ')
+          return
+
+        event.preventDefault()
+        event.currentTarget.click()
+      }}
+    >
+      {value ? formatToLocalTime(value, locale, 'MMM D') : ''}
+    </div>
+  )
+
+  const availableStartDate = end.subtract(30, 'day')
+  const isStartDateDisabled = (date: Dayjs) => {
+    if (date.isAfter(today, 'date'))
+      return true
+
+    return !((date.isAfter(availableStartDate, 'date') || date.isSame(availableStartDate, 'date')) && (date.isBefore(end, 'date') || date.isSame(end, 'date')))
+  }
+
+  const availableEndDate = start.add(30, 'day')
+  const isEndDateDisabled = (date: Dayjs) => {
+    if (date.isAfter(today, 'date'))
+      return true
+
+    return !((date.isAfter(start, 'date') || date.isSame(start, 'date')) && (date.isBefore(availableEndDate, 'date') || date.isSame(availableEndDate, 'date')))
+  }
+
+  return (
+    <div className="flex h-8 items-center space-x-0.5 rounded-lg bg-components-input-bg-normal px-2">
+      <span aria-hidden className="i-ri-calendar-line size-3.5 text-text-tertiary" />
+      <DatePicker
+        value={start}
+        onChange={onStartChange}
+        renderTrigger={renderDate}
+        needTimePicker={false}
+        onClear={noop}
+        noConfirm
+        getIsDateDisabled={isStartDateDisabled}
+      />
+      <span className="system-sm-regular text-text-tertiary">-</span>
+      <DatePicker
+        value={end}
+        onChange={onEndChange}
+        renderTrigger={renderDate}
+        needTimePicker={false}
+        onClear={noop}
+        noConfirm
+        getIsDateDisabled={isEndDateDisabled}
+      />
+    </div>
+  )
+}
+
+export function AgentMonitoringTimeRangePicker({
+  value,
+  onChange,
+}: AgentMonitoringTimeRangePickerProps) {
+  const { t } = useTranslation('agentV2')
+  const locale = useLocale()
+  const [selectedRange, setSelectedRange] = useState<TimeRangeKey | 'custom'>('today')
+  const [start, setStart] = useState(() => dayjs(value.query.start))
+  const [end, setEnd] = useState(() => dayjs(value.query.end))
+
+  const selectedOption = timeRangeOptions.find(option => option.value === selectedRange)
+
+  const handleRangeChange = (nextValue: string | null) => {
+    if (!nextValue)
+      return
+
+    const option = timeRangeOptions.find(item => item.value === nextValue)
+    if (!option)
+      return
+
+    const nextPeriod = getRangePeriod(option)
+    setSelectedRange(option.value)
+    setStart(dayjs(nextPeriod.query.start))
+    setEnd(dayjs(nextPeriod.query.end))
+    onChange({
+      ...nextPeriod,
+      name: t(option.nameKey),
+    })
+  }
+
+  const handleDateChange = (type: 'start' | 'end') => (date?: Dayjs) => {
+    if (!date)
+      return
+
+    if (type === 'start' && date.isSame(start))
+      return
+
+    if (type === 'end' && date.isSame(end))
+      return
+
+    const nextStart = type === 'start' ? date : start
+    const nextEnd = type === 'end' ? date : end
+    const nextName = `${formatToLocalTime(nextStart, locale, 'MMM D')} - ${formatToLocalTime(nextEnd, locale, 'MMM D')}`
+
+    setSelectedRange('custom')
+    setStart(nextStart)
+    setEnd(nextEnd)
+    onChange({
+      name: nextName,
+      query: {
+        start: nextStart.format(queryDateFormat),
+        end: nextEnd.format(queryDateFormat),
+      },
+    })
+  }
+
+  return (
+    <div className="flex min-w-0 items-center">
+      <Select
+        value={selectedRange === 'custom' ? null : selectedRange}
+        onValueChange={handleRangeChange}
+      >
+        <SelectTrigger
+          aria-label={t('agentDetail.monitoring.timeRangeLabel')}
+          className="mt-0 h-auto w-20 shrink-0 border-0 bg-transparent p-0 hover:bg-transparent focus-visible:bg-transparent [&>*:last-child]:hidden"
+        >
+          <div className="flex h-8 w-full cursor-pointer items-center justify-between rounded-lg bg-components-input-bg-normal pr-2 pl-3 group-data-popup-open:bg-state-base-hover-alt">
+            <div className="system-sm-regular text-components-input-text-filled">
+              {selectedRange === 'custom' ? t('agentDetail.monitoring.timeRanges.custom') : selectedOption ? t(selectedOption.nameKey) : value.name}
+            </div>
+            <span aria-hidden className="i-ri-arrow-down-s-line size-4 text-text-quaternary group-data-popup-open:text-text-secondary" />
+          </div>
+        </SelectTrigger>
+        <SelectContent className="translate-x-[-24px]" popupClassName="w-50" listClassName="p-1">
+          {timeRangeOptions.map(option => (
+            <SelectItem key={option.value} value={option.value} className="h-8 py-0 pr-2 pl-7 system-md-regular">
+              <SelectItemText className="px-0">{t(option.nameKey)}</SelectItemText>
+              <SelectItemIndicator className="absolute top-2 left-2 ml-0" />
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+      <span aria-hidden className="i-custom-vender-other-hourglass-shape h-3.5 w-2 text-components-input-bg-normal" />
+      <DateRangePart
+        start={start}
+        end={end}
+        onStartChange={handleDateChange('start')}
+        onEndChange={handleDateChange('end')}
+      />
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/navigation.tsx b/web/features/agent-v2/agent-detail/navigation.tsx
new file mode 100644
index 00000000000..44295e2ff31
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/navigation.tsx
@@ -0,0 +1,263 @@
+'use client'
+
+import type { AgentIconType } from '@dify/contracts/api/console/agent/types.gen'
+import type { ComponentProps } from 'react'
+import type { AgentDetailSectionKey } from './section'
+import type { NavIcon } from '@/app/components/app-sidebar/nav-link'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Kbd, KbdGroup } from '@langgenius/dify-ui/kbd'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
+import { formatForDisplay } from '@tanstack/react-hotkeys'
+import { skipToken, useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import NavLink from '@/app/components/app-sidebar/nav-link'
+import ToggleButton from '@/app/components/app-sidebar/toggle-button'
+import AppIcon from '@/app/components/base/app-icon'
+import Divider from '@/app/components/base/divider'
+import SidebarLeftArrowIcon from '@/app/components/base/icons/src/vender/SidebarLeftArrowIcon'
+import { useSetGotoAnythingOpen } from '@/app/components/goto-anything/atoms'
+import Link from '@/next/link'
+import { usePathname, useRouter } from '@/next/navigation'
+import { consoleQuery } from '@/service/client'
+import { getAgentDetailPath, getAgentIdFromPathname } from './routes'
+
+type AgentDetailTopProps = {
+  expand?: boolean
+  onToggle?: () => void
+}
+
+type AgentDetailSectionProps = {
+  expand?: boolean
+}
+
+type AgentDetailNavItem = {
+  labelKey: `agentDetail.sections.${AgentDetailSectionKey}`
+  href: string
+  icon: NavIcon
+  activeIcon: NavIcon
+}
+
+const SEARCH_SHORTCUT = ['Mod', 'K']
+
+const createAgentNavIcon = (iconClassName: string) => {
+  function AgentNavIcon({ className }: ComponentProps<'svg'>) {
+    return <span aria-hidden className={cn(iconClassName, className)} />
+  }
+
+  return AgentNavIcon
+}
+
+const terminalWindowLineIcon = createAgentNavIcon('i-ri-terminal-window-line')
+const terminalWindowFillIcon = createAgentNavIcon('i-ri-terminal-window-fill')
+const accessPointIcon = createAgentNavIcon('i-custom-vender-agent-v2-access-point')
+const fileListLineIcon = createAgentNavIcon('i-ri-file-list-3-line')
+const fileListFillIcon = createAgentNavIcon('i-ri-file-list-3-fill')
+const dashboardLineIcon = createAgentNavIcon('i-ri-dashboard-2-line')
+const dashboardFillIcon = createAgentNavIcon('i-ri-dashboard-2-fill')
+
+const getAgentDetailNavigation = (agentId: string): AgentDetailNavItem[] => [
+  {
+    labelKey: 'agentDetail.sections.configure',
+    href: getAgentDetailPath(agentId, 'configure'),
+    icon: terminalWindowLineIcon,
+    activeIcon: terminalWindowFillIcon,
+  },
+  {
+    labelKey: 'agentDetail.sections.access',
+    href: getAgentDetailPath(agentId, 'access'),
+    icon: accessPointIcon,
+    activeIcon: accessPointIcon,
+  },
+  {
+    labelKey: 'agentDetail.sections.logs',
+    href: getAgentDetailPath(agentId, 'logs'),
+    icon: fileListLineIcon,
+    activeIcon: fileListFillIcon,
+  },
+  {
+    labelKey: 'agentDetail.sections.monitoring',
+    href: getAgentDetailPath(agentId, 'monitoring'),
+    icon: dashboardLineIcon,
+    activeIcon: dashboardFillIcon,
+  },
+]
+
+export function AgentDetailTop({
+  expand = true,
+  onToggle,
+}: AgentDetailTopProps) {
+  const { t: tApp } = useTranslation('app')
+  const { t: tCommon } = useTranslation('common')
+  const router = useRouter()
+  const setGotoAnythingOpen = useSetGotoAnythingOpen()
+
+  if (!expand) {
+    return (
+      <div className="flex w-full items-center justify-center px-3 pt-2 pb-1">
+        {onToggle && (
+          <ToggleButton
+            expand={expand}
+            handleToggle={onToggle}
+            icon={<SidebarLeftArrowIcon aria-hidden className="size-4" />}
+            className="size-8 rounded-[10px] border-0 bg-transparent px-0 text-text-tertiary shadow-none hover:border-0 hover:bg-state-base-hover hover:text-text-secondary"
+          />
+        )}
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex items-center py-2 pr-2 pl-1">
+      <div className="flex min-w-0 flex-1 items-center gap-px">
+        <div className="flex shrink-0 items-center rounded-lg py-2 pr-1.5 pl-0.5 transition-colors hover:bg-background-default-hover">
+          <button
+            type="button"
+            aria-label={tCommon('operation.back')}
+            className="flex size-4 items-center justify-center text-text-tertiary hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            onClick={() => router.back()}
+          >
+            <span aria-hidden className="i-ri-arrow-left-s-line size-4" />
+          </button>
+          <Link
+            href="/"
+            aria-label={tCommon('mainNav.home')}
+            className="flex size-4 items-center justify-center text-text-tertiary hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            <span aria-hidden className="i-custom-vender-main-nav-app-home size-4" />
+          </Link>
+        </div>
+        <span className="shrink-0 system-md-regular text-text-quaternary">
+          /
+        </span>
+        <Link href="/roster" className="shrink-0 truncate rounded-lg px-1.5 py-2 system-sm-semibold-uppercase text-text-secondary transition-colors hover:bg-background-default-hover hover:text-text-primary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden">
+          {tCommon('menus.roster')}
+        </Link>
+      </div>
+      <Tooltip>
+        <TooltipTrigger
+          render={(
+            <button
+              type="button"
+              aria-label={tApp('gotoAnything.searchTitle')}
+              className="flex size-8 shrink-0 items-center justify-center overflow-hidden rounded-[10px] text-text-tertiary transition-colors hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+              onClick={() => setGotoAnythingOpen(true)}
+            >
+              <span aria-hidden className="i-custom-vender-main-nav-quick-search size-4" />
+            </button>
+          )}
+        />
+        <TooltipContent placement="bottom" className="flex items-center gap-1 rounded-lg border-[0.5px] border-components-panel-border bg-components-tooltip-bg p-1.5 system-xs-medium text-text-secondary shadow-lg backdrop-blur-[5px]">
+          <span className="px-0.5">{tApp('gotoAnything.quickAction')}</span>
+          <KbdGroup>
+            {SEARCH_SHORTCUT.map(key => (
+              <Kbd key={key}>{formatForDisplay(key)}</Kbd>
+            ))}
+          </KbdGroup>
+        </TooltipContent>
+      </Tooltip>
+      {onToggle && (
+        <ToggleButton
+          expand={expand}
+          handleToggle={onToggle}
+          icon={<SidebarLeftArrowIcon aria-hidden className="size-4" />}
+          className="size-8 rounded-[10px] border-0 bg-transparent px-0 text-text-tertiary shadow-none hover:border-0 hover:bg-state-base-hover hover:text-text-secondary"
+        />
+      )}
+    </div>
+  )
+}
+
+export function AgentDetailSection({
+  expand = true,
+}: AgentDetailSectionProps) {
+  const { t } = useTranslation('agentV2')
+  const pathname = usePathname()
+  const agentId = getAgentIdFromPathname(pathname)
+  const agentQuery = useQuery(consoleQuery.agent.byAgentId.get.queryOptions({
+    input: agentId
+      ? {
+          params: {
+            agent_id: agentId,
+          },
+        }
+      : skipToken,
+  }))
+
+  if (!agentId)
+    return null
+
+  const navigation = getAgentDetailNavigation(agentId)
+  const agent = agentQuery.data
+  const imageUrl = (agent?.icon_type === 'image' || agent?.icon_type === 'link') ? agent.icon : undefined
+  const iconType = (imageUrl ? 'image' : agent?.icon_type) as AgentIconType | null | undefined
+
+  return (
+    <div className={cn('flex min-h-0 flex-1 flex-col', expand ? 'px-2 pb-2' : 'pb-2')}>
+      {!expand && (
+        <div className="flex w-full shrink-0 justify-center px-3.5 pt-0.5 pb-[3px]">
+          <Divider
+            type="horizontal"
+            bgStyle="solid"
+            className="my-0 h-px w-[27px] bg-divider-subtle"
+          />
+        </div>
+      )}
+      <div className={cn('py-2', expand && '-mx-1')}>
+        <div className={cn(
+          'flex h-13 items-center rounded-xl py-1.5 pr-2 pl-1.5',
+          !expand && 'justify-center',
+        )}
+        >
+          <div className={cn(
+            'shrink-0',
+            expand && 'mr-2',
+          )}
+          >
+            <span aria-hidden>
+              <AppIcon
+                size="large"
+                rounded
+                iconType={iconType}
+                icon={agent?.icon ?? undefined}
+                background={agent?.icon_background}
+                imageUrl={imageUrl}
+              />
+            </span>
+          </div>
+          <div className={cn('flex h-10 min-w-0 flex-1 flex-col justify-center', !expand && 'hidden')}>
+            <div className="truncate system-md-semibold text-text-secondary">
+              {agent?.name ?? t('agentDetail.title')}
+            </div>
+            <div className="truncate system-2xs-medium-uppercase text-text-tertiary">
+              {agent?.role ?? t('agentDetail.type')}
+            </div>
+          </div>
+        </div>
+      </div>
+      <div className={cn(expand ? 'px-3 py-0.5' : 'px-1 py-0.5')}>
+        <Divider
+          type="horizontal"
+          bgStyle={expand ? 'gradient' : 'solid'}
+          className={cn(
+            'my-0 h-px',
+            expand
+              ? 'bg-linear-to-r from-divider-subtle to-background-gradient-mask-transparent'
+              : 'bg-divider-subtle',
+          )}
+        />
+      </div>
+      <nav className={cn('flex flex-col gap-y-0.5 py-2', expand ? 'px-1' : 'px-3')} aria-label={t('agentDetail.navigationLabel')}>
+        {navigation.map(item => (
+          <NavLink
+            key={item.href}
+            mode={expand ? 'expand' : 'collapse'}
+            iconMap={{ selected: item.activeIcon, normal: item.icon }}
+            name={t(item.labelKey)}
+            href={item.href}
+            pathname={pathname}
+          />
+        ))}
+      </nav>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/page.tsx b/web/features/agent-v2/agent-detail/page.tsx
new file mode 100644
index 00000000000..61fcf03381a
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/page.tsx
@@ -0,0 +1,31 @@
+'use client'
+
+import type { AgentDetailSectionKey } from './section'
+import { AgentAccessPage } from './access/page'
+import { AgentConfigurePage } from './configure/page'
+import { AgentLogsPage } from './logs/page'
+import { AgentMonitoringPage } from './monitoring/page'
+
+type AgentDetailPageProps = {
+  agentId: string
+  section: AgentDetailSectionKey
+}
+
+export function AgentDetailPage({
+  agentId,
+  section,
+}: AgentDetailPageProps) {
+  if (section === 'monitoring')
+    return <AgentMonitoringPage agentId={agentId} />
+
+  if (section === 'logs')
+    return <AgentLogsPage agentId={agentId} />
+
+  if (section === 'access')
+    return <AgentAccessPage agentId={agentId} />
+
+  if (section === 'configure')
+    return <AgentConfigurePage agentId={agentId} />
+
+  return null
+}
diff --git a/web/features/agent-v2/agent-detail/routes.ts b/web/features/agent-v2/agent-detail/routes.ts
new file mode 100644
index 00000000000..313562f5c60
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/routes.ts
@@ -0,0 +1,15 @@
+import type { AgentDetailSectionKey } from './section'
+
+export const getAgentDetailPath = (
+  agentId: string,
+  section: AgentDetailSectionKey,
+) => `/roster/agent/${agentId}/${section}`
+
+export const getAgentIdFromPathname = (pathname: string) => {
+  const [section, type, agentId] = pathname.split('/').filter(Boolean)
+
+  if (section !== 'roster' || type !== 'agent')
+    return undefined
+
+  return agentId
+}
diff --git a/web/features/agent-v2/agent-detail/section.ts b/web/features/agent-v2/agent-detail/section.ts
new file mode 100644
index 00000000000..9e242c01372
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/section.ts
@@ -0,0 +1 @@
+export type AgentDetailSectionKey = 'configure' | 'access' | 'logs' | 'monitoring'
diff --git a/web/features/agent-v2/feature-flag.ts b/web/features/agent-v2/feature-flag.ts
new file mode 100644
index 00000000000..3b7e5589dc1
--- /dev/null
+++ b/web/features/agent-v2/feature-flag.ts
@@ -0,0 +1,3 @@
+import { env } from '@/env'
+
+export const isAgentV2Enabled = () => env.NEXT_PUBLIC_ENABLE_AGENT_V2
diff --git a/web/features/agent-v2/roster/components/__tests__/agent-roster-list.spec.tsx b/web/features/agent-v2/roster/components/__tests__/agent-roster-list.spec.tsx
new file mode 100644
index 00000000000..687133f25e7
--- /dev/null
+++ b/web/features/agent-v2/roster/components/__tests__/agent-roster-list.spec.tsx
@@ -0,0 +1,226 @@
+import type { ComponentProps } from 'react'
+import type { AgentRosterListItem } from '../agent-roster-list'
+import { toast } from '@langgenius/dify-ui/toast'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { AgentRosterList } from '../agent-roster-list'
+
+const { duplicateAgentMutationFn } = vi.hoisted(() => ({
+  duplicateAgentMutationFn: vi.fn(),
+}))
+
+vi.mock('@/hooks/use-timestamp', () => ({
+  default: () => ({
+    formatTime: () => '06/12/2026 12:00:00 PM',
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        copy: {
+          post: {
+            mutationOptions: () => ({
+              mutationFn: duplicateAgentMutationFn,
+            }),
+          },
+        },
+        delete: {
+          mutationOptions: () => ({
+            mutationFn: vi.fn(),
+          }),
+        },
+        put: {
+          mutationOptions: () => ({
+            mutationFn: vi.fn(),
+          }),
+        },
+      },
+    },
+  },
+}))
+
+const createAgent = (overrides: Partial<AgentRosterListItem> = {}): AgentRosterListItem => ({
+  active_config_is_published: false,
+  description: 'Find and summarize market materials.',
+  id: 'agent-1',
+  icon_url: null,
+  mode: 'agent',
+  name: 'Research Agent',
+  published_reference_count: 0,
+  published_references: [],
+  role: 'Research Assistant',
+  ...overrides,
+})
+
+const renderList = (
+  agents: AgentRosterListItem[],
+  overrides: Partial<ComponentProps<typeof AgentRosterList>> = {},
+) => {
+  const queryClient = new QueryClient()
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentRosterList
+        agents={agents}
+        hasMore={false}
+        isEmptySearch={false}
+        isError={false}
+        isFetching={false}
+        isFetchingNextPage={false}
+        isPending={false}
+        label="Agent roster list"
+        onLoadMore={vi.fn()}
+        {...overrides}
+      />
+    </QueryClientProvider>,
+  )
+}
+
+describe('AgentRosterList', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.spyOn(toast, 'error').mockReturnValue('toast-id')
+    vi.spyOn(toast, 'success').mockReturnValue('toast-id')
+    duplicateAgentMutationFn.mockResolvedValue(createAgent({
+      id: 'agent-copy',
+      name: 'Research Agent copy',
+    }))
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('renders role under the card title instead of the agent mode', () => {
+    renderList([createAgent()])
+
+    expect(screen.getByText('Research Assistant')).toBeInTheDocument()
+    expect(screen.queryByText('agent')).not.toBeInTheDocument()
+  })
+
+  it('uses the Figma-aligned card title and role typography', () => {
+    renderList([createAgent()])
+
+    expect(screen.getByRole('heading', { name: 'Research Agent' })).toHaveClass('system-md-semibold')
+    expect(screen.getByText('Research Assistant')).toHaveClass('system-xs-regular')
+    expect(screen.getByText('agentV2.roster.usageStatus.draft')).toHaveClass('system-2xs-medium-uppercase')
+  })
+
+  it('draws the primary link focus ring above the draft corner label without z-index', () => {
+    renderList([createAgent()])
+
+    const configureLink = screen.getByRole('link', { name: 'Research Agent' })
+    const draftLabel = screen.getByText('agentV2.roster.usageStatus.draft')
+    const draftCornerLabel = draftLabel.closest('.absolute')
+
+    expect(configureLink).toHaveClass(
+      'relative',
+      'focus-visible:after:ring-2',
+      'focus-visible:after:ring-state-accent-solid',
+      'focus-visible:after:ring-inset',
+    )
+    expect(configureLink).not.toHaveClass('peer/card-link')
+    expect(draftCornerLabel && configureLink.contains(draftCornerLabel)).toBe(true)
+    expect(draftCornerLabel).toHaveClass(
+      'top-[-0.5px]',
+      'right-0',
+    )
+    expect(draftCornerLabel).not.toHaveClass('z-10', 'z-20')
+  })
+
+  it('only renders the draft badge for unpublished agents', () => {
+    renderList([
+      createAgent({
+        active_config_is_published: true,
+        id: 'agent-published',
+        name: 'Published Agent',
+        published_reference_count: 1,
+      }),
+      createAgent({
+        id: 'agent-draft',
+        name: 'Draft Agent',
+        published_reference_count: 0,
+      }),
+    ])
+
+    expect(screen.getByText('agentV2.roster.usageStatus.draft')).toBeInTheDocument()
+    expect(screen.getByRole('heading', { name: 'Published Agent' })).toBeInTheDocument()
+    expect(screen.queryByText('agentV2.roster.usageStatus.inUse')).not.toBeInTheDocument()
+    expect(screen.queryByText('agentV2.roster.status.active')).not.toBeInTheDocument()
+  })
+
+  it('renders the Figma-aligned empty roster overlay', () => {
+    const { container } = renderList([])
+
+    expect(screen.getByRole('heading', { name: 'agentV2.roster.empty' })).toHaveClass('system-sm-regular', 'text-text-tertiary')
+    expect(container.querySelectorAll('.bg-background-default-lighter')).toHaveLength(16)
+    expect(container.querySelector('.bg-linear-to-b')).toBeInTheDocument()
+    expect(container.querySelector('.i-ri-robot-2-line')).toHaveClass('size-6', 'text-text-tertiary')
+  })
+
+  it('uses the same overlay treatment for empty search results', () => {
+    const { container } = renderList([], { isEmptySearch: true })
+
+    expect(screen.getByRole('heading', { name: 'agentV2.roster.emptySearch' })).toBeInTheDocument()
+    expect(container.querySelectorAll('.bg-background-default-lighter')).toHaveLength(16)
+    expect(screen.queryByText('agentV2.roster.emptySearchDescription')).not.toBeInTheDocument()
+  })
+
+  it('uses the same overlay treatment for loading errors', () => {
+    const { container } = renderList([], { isError: true })
+
+    expect(screen.getByRole('heading', { name: 'agentV2.roster.loadingError' })).toHaveClass('system-sm-regular', 'text-text-tertiary')
+    expect(container.querySelectorAll('.bg-background-default-lighter')).toHaveLength(16)
+    expect(container.querySelector('.bg-linear-to-b')).toBeInTheDocument()
+  })
+
+  it('opens published workflow references from the card reference trigger', async () => {
+    const user = userEvent.setup()
+    renderList([
+      createAgent({
+        published_reference_count: 1,
+        published_references: [
+          {
+            app_id: 'workflow-app-id',
+            app_icon: '🐍',
+            app_icon_background: '#E9F8D8',
+            app_icon_type: 'emoji',
+            app_name: 'RFP Review Flow',
+          },
+        ],
+      }),
+    ])
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.references\.trigger/ }))
+
+    const workflowLink = screen.getByRole('menuitem', { name: /RFP Review Flow/ })
+    expect(workflowLink).toHaveAttribute('href', '/app/workflow-app-id/workflow')
+    expect(screen.getByText(/agentV2\.roster\.references\.label/)).toBeInTheDocument()
+  })
+
+  it('duplicates an agent from the card action menu', async () => {
+    const user = userEvent.setup()
+    renderList([createAgent()])
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.moreActions/ }))
+    await user.click(screen.getByRole('menuitem', { name: /common\.operation\.duplicate/ }))
+
+    expect(duplicateAgentMutationFn).toHaveBeenCalledWith(
+      {
+        params: {
+          agent_id: 'agent-1',
+        },
+        body: {},
+      },
+      expect.objectContaining({
+        client: expect.any(QueryClient),
+      }),
+    )
+    await waitFor(() => {
+      expect(toast.success).toHaveBeenCalledWith('agentV2.roster.duplicateSuccess')
+    })
+  })
+})
diff --git a/web/features/agent-v2/roster/components/__tests__/create-agent-dialog.spec.tsx b/web/features/agent-v2/roster/components/__tests__/create-agent-dialog.spec.tsx
new file mode 100644
index 00000000000..57fb616246f
--- /dev/null
+++ b/web/features/agent-v2/roster/components/__tests__/create-agent-dialog.spec.tsx
@@ -0,0 +1,115 @@
+import { render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { CreateAgentDialog } from '../create-agent-dialog'
+
+const mutationMock = vi.hoisted(() => ({
+  isPending: false,
+  mutate: vi.fn(),
+}))
+
+const toastMock = vi.hoisted(() => ({
+  error: vi.fn(),
+  success: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useMutation: () => ({
+    isPending: mutationMock.isPending,
+    mutate: mutationMock.mutate,
+  }),
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: toastMock,
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      post: {
+        mutationOptions: vi.fn(() => ({})),
+      },
+    },
+  },
+}))
+
+describe('CreateAgentDialog', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mutationMock.isPending = false
+  })
+
+  it('submits agent app fields and default icon fields when creating an agent', async () => {
+    const user = userEvent.setup()
+    render(<CreateAgentDialog />)
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.createAgent/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.createDialog.title' })
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.nameLabel' }), ' Research Agent ')
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' }), ' Research Assistant ')
+    await user.type(within(dialog).getByPlaceholderText('agentV2.roster.createForm.descriptionPlaceholder'), ' Find and summarize market materials. ')
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.create' }))
+
+    expect(mutationMock.mutate).toHaveBeenCalledWith({
+      body: {
+        name: 'Research Agent',
+        description: 'Find and summarize market materials.',
+        role: 'Research Assistant',
+        icon_type: 'emoji',
+        icon: '🧸',
+        icon_background: '#F5F3FF',
+      },
+    }, expect.objectContaining({
+      onSuccess: expect.any(Function),
+    }))
+    const mutationOptions = mutationMock.mutate.mock.calls[0]?.[1]
+    expect(mutationOptions).not.toHaveProperty('onError')
+  })
+
+  it('shows a field error when creating with an empty name', async () => {
+    const user = userEvent.setup()
+    render(<CreateAgentDialog />)
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.createAgent/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.createDialog.title' })
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' }), 'Research Assistant')
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.create' }))
+
+    expect(await within(dialog).findByText('agentV2.roster.createForm.nameRequired')).toBeInTheDocument()
+    expect(toastMock.error).not.toHaveBeenCalled()
+    expect(mutationMock.mutate).not.toHaveBeenCalled()
+  })
+
+  it('shows a field error when creating with an empty role', async () => {
+    const user = userEvent.setup()
+    render(<CreateAgentDialog />)
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.createAgent/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.createDialog.title' })
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.nameLabel' }), 'Research Agent')
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.create' }))
+
+    expect(await within(dialog).findByText('agentV2.roster.createForm.roleRequired')).toBeInTheDocument()
+    expect(toastMock.error).not.toHaveBeenCalled()
+    expect(mutationMock.mutate).not.toHaveBeenCalled()
+  })
+
+  it('shows a field error when creating with a blank role', async () => {
+    const user = userEvent.setup()
+    render(<CreateAgentDialog />)
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.createAgent/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.createDialog.title' })
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.nameLabel' }), 'Research Agent')
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' }), '   ')
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.create' }))
+
+    expect(await within(dialog).findByText('agentV2.roster.createForm.roleRequired')).toBeInTheDocument()
+    expect(toastMock.error).not.toHaveBeenCalled()
+    expect(mutationMock.mutate).not.toHaveBeenCalled()
+  })
+})
diff --git a/web/features/agent-v2/roster/components/__tests__/edit-agent-dialog.spec.tsx b/web/features/agent-v2/roster/components/__tests__/edit-agent-dialog.spec.tsx
new file mode 100644
index 00000000000..be9d113c79f
--- /dev/null
+++ b/web/features/agent-v2/roster/components/__tests__/edit-agent-dialog.spec.tsx
@@ -0,0 +1,224 @@
+import type { AgentAppPartial } from '@dify/contracts/api/console/agent/types.gen'
+import { render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { EditAgentDialog } from '../edit-agent-dialog'
+
+const mutationMock = vi.hoisted(() => ({
+  isPending: false,
+  mutate: vi.fn(),
+}))
+
+const toastMock = vi.hoisted(() => ({
+  error: vi.fn(),
+  success: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-query', () => ({
+  useMutation: () => ({
+    isPending: mutationMock.isPending,
+    mutate: mutationMock.mutate,
+  }),
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: toastMock,
+}))
+
+vi.mock('@/app/components/base/app-icon-picker', () => ({
+  __esModule: true,
+  default: ({
+    onSelect,
+    open,
+  }: {
+    onSelect: (payload: { type: 'emoji', icon: string, background: string }) => void
+    open: boolean
+  }) => open
+    ? (
+        <button
+          type="button"
+          onClick={() => onSelect({ type: 'emoji', icon: '🧠', background: '#E0F2FE' })}
+        >
+          Select brain icon
+        </button>
+      )
+    : null,
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        put: {
+          mutationOptions: vi.fn(() => ({})),
+        },
+      },
+    },
+  },
+}))
+
+const createAgent = (overrides: Partial<AgentAppPartial> = {}): AgentAppPartial => ({
+  description: 'Find and summarize market materials.',
+  icon: '🧸',
+  icon_background: '#F5F3FF',
+  icon_type: 'emoji',
+  id: 'agent-1',
+  icon_url: null,
+  mode: 'agent',
+  name: 'Research Agent',
+  role: 'Research Assistant',
+  ...overrides,
+})
+
+const renderDialog = (agent = createAgent()) => {
+  const onOpenChange = vi.fn()
+
+  render(
+    <EditAgentDialog
+      agent={agent}
+      open
+      onOpenChange={onOpenChange}
+    />,
+  )
+
+  return { onOpenChange }
+}
+
+describe('EditAgentDialog', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mutationMock.isPending = false
+  })
+
+  it('submits the full agent payload when only the name changes', async () => {
+    const user = userEvent.setup()
+    renderDialog()
+
+    const dialog = screen.getByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    await user.clear(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.nameLabel' }))
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.nameLabel' }), ' Market Agent ')
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.save' }))
+
+    expect(mutationMock.mutate).toHaveBeenCalledWith({
+      params: {
+        agent_id: 'agent-1',
+      },
+      body: {
+        name: 'Market Agent',
+        description: 'Find and summarize market materials.',
+        role: 'Research Assistant',
+        icon_type: 'emoji',
+        icon: '🧸',
+        icon_background: '#F5F3FF',
+      },
+    }, expect.objectContaining({
+      onSuccess: expect.any(Function),
+    }))
+    const mutationOptions = mutationMock.mutate.mock.calls[0]?.[1]
+    expect(mutationOptions).not.toHaveProperty('onError')
+  })
+
+  it('submits the full agent payload when only the role changes', async () => {
+    const user = userEvent.setup()
+    renderDialog()
+
+    const dialog = screen.getByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    await user.clear(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' }))
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' }), ' Market Analyst ')
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.save' }))
+
+    expect(mutationMock.mutate).toHaveBeenCalledWith({
+      params: {
+        agent_id: 'agent-1',
+      },
+      body: {
+        name: 'Research Agent',
+        description: 'Find and summarize market materials.',
+        role: 'Market Analyst',
+        icon_type: 'emoji',
+        icon: '🧸',
+        icon_background: '#F5F3FF',
+      },
+    }, expect.objectContaining({
+      onSuccess: expect.any(Function),
+    }))
+    const mutationOptions = mutationMock.mutate.mock.calls[0]?.[1]
+    expect(mutationOptions).not.toHaveProperty('onError')
+  })
+
+  it('submits selected icon fields when the roster icon changes', async () => {
+    const user = userEvent.setup()
+    renderDialog()
+
+    const dialog = screen.getByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    await user.click(within(dialog).getByRole('button', { name: /agentV2\.roster\.editAgent/ }))
+    await user.click(screen.getByRole('button', { hidden: true, name: 'Select brain icon' }))
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.save' }))
+
+    expect(mutationMock.mutate).toHaveBeenCalledWith({
+      params: {
+        agent_id: 'agent-1',
+      },
+      body: {
+        name: 'Research Agent',
+        description: 'Find and summarize market materials.',
+        role: 'Research Assistant',
+        icon_type: 'emoji',
+        icon: '🧠',
+        icon_background: '#E0F2FE',
+      },
+    }, expect.objectContaining({
+      onSuccess: expect.any(Function),
+    }))
+    const mutationOptions = mutationMock.mutate.mock.calls[0]?.[1]
+    expect(mutationOptions).not.toHaveProperty('onError')
+  })
+
+  it('shows a field error when saving with an empty name', async () => {
+    const user = userEvent.setup()
+    renderDialog()
+
+    const dialog = screen.getByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    await user.clear(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.nameLabel' }))
+
+    const saveButton = within(dialog).getByRole('button', { name: 'common.operation.save' })
+    expect(saveButton).not.toBeDisabled()
+    await user.click(saveButton)
+
+    expect(await within(dialog).findByText('agentV2.roster.createForm.nameRequired')).toBeInTheDocument()
+    expect(toastMock.error).not.toHaveBeenCalled()
+    expect(mutationMock.mutate).not.toHaveBeenCalled()
+  })
+
+  it('shows a field error when saving with an empty role', async () => {
+    const user = userEvent.setup()
+    renderDialog()
+
+    const dialog = screen.getByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    await user.clear(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' }))
+
+    const saveButton = within(dialog).getByRole('button', { name: 'common.operation.save' })
+    expect(saveButton).not.toBeDisabled()
+    await user.click(saveButton)
+
+    expect(await within(dialog).findByText('agentV2.roster.createForm.roleRequired')).toBeInTheDocument()
+    expect(toastMock.error).not.toHaveBeenCalled()
+    expect(mutationMock.mutate).not.toHaveBeenCalled()
+  })
+
+  it('shows a field error when saving with a blank role', async () => {
+    const user = userEvent.setup()
+    renderDialog()
+
+    const dialog = screen.getByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    await user.clear(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' }))
+    await user.type(within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' }), '   ')
+
+    const saveButton = within(dialog).getByRole('button', { name: 'common.operation.save' })
+    expect(saveButton).not.toBeDisabled()
+    await user.click(saveButton)
+
+    expect(await within(dialog).findByText('agentV2.roster.createForm.roleRequired')).toBeInTheDocument()
+    expect(toastMock.error).not.toHaveBeenCalled()
+    expect(mutationMock.mutate).not.toHaveBeenCalled()
+  })
+})
diff --git a/web/features/agent-v2/roster/components/__tests__/roster-toolbar.spec.tsx b/web/features/agent-v2/roster/components/__tests__/roster-toolbar.spec.tsx
new file mode 100644
index 00000000000..6b215aa1b3c
--- /dev/null
+++ b/web/features/agent-v2/roster/components/__tests__/roster-toolbar.spec.tsx
@@ -0,0 +1,63 @@
+import type { RosterFilterValue } from '../roster-filter'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { RosterToolbar } from '../roster-toolbar'
+
+const renderToolbar = ({
+  filter = 'all',
+  onFilterChange = vi.fn(),
+}: {
+  filter?: RosterFilterValue
+  onFilterChange?: (value: RosterFilterValue) => void
+} = {}) => {
+  const queryClient = new QueryClient()
+
+  render(
+    <QueryClientProvider client={queryClient}>
+      <RosterToolbar
+        draftAgents={2}
+        filter={filter}
+        keyword=""
+        onFilterChange={onFilterChange}
+        onKeywordChange={vi.fn()}
+        publishedAgents={1}
+      />
+    </QueryClientProvider>,
+  )
+
+  return { onFilterChange }
+}
+
+describe('RosterToolbar', () => {
+  it('enables roster filters and emits the selected filter', async () => {
+    const user = userEvent.setup()
+    const { onFilterChange } = renderToolbar()
+
+    const publishedFilter = screen.getByRole('button', { name: /agentV2\.roster\.filters\.published/ })
+    const draftsFilter = screen.getByRole('button', { name: /agentV2\.roster\.filters\.drafts/ })
+
+    expect(publishedFilter).toBeEnabled()
+    expect(draftsFilter).toBeEnabled()
+
+    await user.click(publishedFilter)
+
+    expect(onFilterChange).toHaveBeenCalledWith('published')
+  })
+
+  it('renders stable filter count badges and omits the all count', () => {
+    renderToolbar()
+
+    expect(screen.getByRole('button', { name: /agentV2\.roster\.filters\.all/ })).not.toHaveTextContent('3')
+
+    expect(screen.getByText('1').parentElement).toHaveClass(
+      'min-w-4',
+      'shrink-0',
+      'border-divider-deep',
+      'py-0.5',
+      'system-2xs-medium-uppercase',
+      'tabular-nums',
+    )
+    expect(screen.getByText('1')).toHaveClass('min-w-px', 'flex-1', 'text-center')
+  })
+})
diff --git a/web/features/agent-v2/roster/components/agent-roster-list.tsx b/web/features/agent-v2/roster/components/agent-roster-list.tsx
new file mode 100644
index 00000000000..f59632791e2
--- /dev/null
+++ b/web/features/agent-v2/roster/components/agent-roster-list.tsx
@@ -0,0 +1,285 @@
+'use client'
+
+import type { AgentAppPartial, AgentIconType } from '@dify/contracts/api/console/agent/types.gen'
+import { Button } from '@langgenius/dify-ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useId, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+import useTimestamp from '@/hooks/use-timestamp'
+import Link from '@/next/link'
+import { consoleQuery } from '@/service/client'
+import { AgentWorkflowReferencesDropdown } from './agent-workflow-references-dropdown'
+import { DeleteAgentDialog } from './delete-agent-dialog'
+import { EditAgentDialog } from './edit-agent-dialog'
+
+type AgentRosterListProps = {
+  agents: AgentRosterListItem[]
+  hasMore: boolean
+  isEmptySearch: boolean
+  isError: boolean
+  isFetching: boolean
+  isFetchingNextPage: boolean
+  isPending: boolean
+  label: string
+  onLoadMore: () => void
+}
+
+export type AgentRosterListItem = AgentAppPartial
+
+const skeletonRows = ['primary', 'secondary', 'tertiary'] as const
+const emptyPlaceholderCardIds = Array.from({ length: 16 }, (_, index) => `agent-roster-placeholder-card-${index}`)
+
+function AgentRosterSkeleton() {
+  return (
+    <>
+      {skeletonRows.map(row => (
+        <div key={row} className="relative h-36.5 rounded-xl border-[0.5px] border-components-card-border bg-components-card-bg shadow-xs shadow-shadow-shadow-3">
+          <div className="flex items-center gap-3 pt-3.5 pr-4 pb-2 pl-3.5">
+            <SkeletonRectangle className="my-0 size-12 shrink-0 animate-pulse rounded-full" />
+            <div className="min-w-0 flex-1 space-y-2.5 py-px">
+              <SkeletonRectangle className="my-0 h-4 w-36 max-w-full animate-pulse rounded-md" />
+              <SkeletonRectangle className="my-0 h-3 w-20 max-w-full animate-pulse rounded-md" />
+            </div>
+          </div>
+          <div className="px-4 py-1">
+            <SkeletonRectangle className="my-0 h-3 w-full animate-pulse rounded-md" />
+            <SkeletonRectangle className="mt-2 mb-0 h-3 w-3/4 animate-pulse rounded-md" />
+          </div>
+          <div className="flex items-center pt-2 pr-3 pb-3 pl-4">
+            <SkeletonRectangle className="my-0 h-4 w-6 animate-pulse rounded-md" />
+            <SkeletonRectangle className="my-0 ml-2.5 h-4 w-28 animate-pulse rounded-md" />
+          </div>
+        </div>
+      ))}
+    </>
+  )
+}
+
+function AgentRosterPlaceholderState({ title }: { title: string }) {
+  return (
+    <section
+      aria-labelledby="agent-roster-placeholder-title"
+      className="relative col-span-full min-h-[calc(100vh-142px)] overflow-hidden"
+    >
+      <div className="pointer-events-none absolute inset-0 grid grid-cols-1 grid-rows-4 gap-3 sm:grid-cols-2 xl:grid-cols-4">
+        {emptyPlaceholderCardIds.map(id => (
+          <div key={id} className="rounded-xl bg-background-default-lighter opacity-75" />
+        ))}
+      </div>
+      <div className="pointer-events-none absolute inset-0 bg-linear-to-b from-background-body/0 to-background-body" />
+      <div className="absolute inset-0 flex items-center justify-center overflow-hidden p-2">
+        <div className="flex flex-col items-center gap-3">
+          <div className="flex size-14 items-center justify-center rounded-[10px]">
+            <div className="flex size-full min-w-px items-center justify-center overflow-hidden rounded-xl border border-dashed border-divider-regular bg-components-card-bg p-1 backdrop-blur-md">
+              <span aria-hidden className="i-ri-robot-2-line size-6 text-text-tertiary" />
+            </div>
+          </div>
+          <h2 id="agent-roster-placeholder-title" className="system-sm-regular whitespace-nowrap text-text-tertiary">
+            {title}
+          </h2>
+        </div>
+      </div>
+    </section>
+  )
+}
+
+function AgentRosterItem({
+  agent,
+}: {
+  agent: AgentRosterListItem
+}) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const { formatTime } = useTimestamp()
+  const nameId = useId()
+  const descriptionId = useId()
+  const [isEditOpen, setIsEditOpen] = useState(false)
+  const [isDeleteOpen, setIsDeleteOpen] = useState(false)
+  const duplicateAgentMutation = useMutation(consoleQuery.agent.byAgentId.copy.post.mutationOptions())
+  const updatedAt = agent.updated_at != null
+    ? formatTime(agent.updated_at, t('roster.dateTimeFormat'))
+    : null
+  const referenceCount = agent.published_reference_count ?? 0
+  const publishedReferences = agent.published_references ?? []
+  const hasPublishedReferences = publishedReferences.length > 0
+  const isDraft = agent.active_config_is_published !== true
+  const imageUrl = (agent.icon_type === 'image' || agent.icon_type === 'link') ? agent.icon : undefined
+  const iconType = (imageUrl ? 'image' : agent.icon_type) as AgentIconType | null | undefined
+  const handleDuplicate = () => {
+    if (duplicateAgentMutation.isPending)
+      return
+
+    duplicateAgentMutation.mutate({
+      params: {
+        agent_id: agent.id,
+      },
+      body: {},
+    }, {
+      onSuccess: () => {
+        toast.success(t('roster.duplicateSuccess'))
+      },
+      onError: () => {
+        toast.error(t('roster.duplicateFailed'))
+      },
+    })
+  }
+
+  return (
+    <article className="group relative col-span-1 h-36.5 min-w-0 overflow-hidden rounded-xl border-[0.5px] border-solid border-components-card-border bg-components-card-bg shadow-xs shadow-shadow-shadow-3 transition-shadow duration-200 ease-in-out hover:shadow-lg">
+      <div className="flex h-full min-w-0 flex-col">
+        <Link
+          href={`/roster/agent/${agent.id}/configure`}
+          aria-labelledby={nameId}
+          aria-describedby={agent.description ? descriptionId : undefined}
+          className="relative block shrink-0 cursor-pointer touch-manipulation rounded-xl outline-hidden after:pointer-events-none after:absolute after:inset-0 after:rounded-xl after:content-[''] focus-visible:after:ring-2 focus-visible:after:ring-state-accent-solid focus-visible:after:ring-inset"
+        >
+          <div className="flex items-center gap-3 pt-3.5 pr-4 pb-2 pl-3.5">
+            <span aria-hidden className="shrink-0">
+              <AppIcon
+                size="xl"
+                rounded
+                iconType={iconType}
+                icon={agent.icon ?? undefined}
+                background={agent.icon_background}
+                imageUrl={imageUrl}
+              />
+            </span>
+            <div className="flex min-w-0 flex-1 flex-col gap-0.5 py-px">
+              <h2 id={nameId} className="truncate system-md-semibold text-text-secondary">
+                {agent.name}
+              </h2>
+              <p className="truncate system-xs-regular text-text-tertiary">
+                {agent.role}
+              </p>
+            </div>
+          </div>
+          <div className="px-4 py-1 system-xs-regular text-text-tertiary">
+            <div id={descriptionId} className="line-clamp-2 min-h-8">
+              {agent.description}
+            </div>
+          </div>
+          {isDraft && (
+            <div className="absolute top-[-0.5px] right-0 flex h-5 items-start overflow-hidden">
+              <div className="h-5 w-3 bg-background-section-burn [clip-path:polygon(0_0,100%_0,100%_100%)]" />
+              <div className="flex h-5 items-center bg-background-section-burn pr-2 pl-0.5 system-2xs-medium-uppercase text-text-tertiary">
+                {t('roster.usageStatus.draft')}
+              </div>
+            </div>
+          )}
+        </Link>
+        <div className="flex min-w-0 shrink-0 items-center pt-2 pr-3 pb-3 pl-4 system-xs-regular text-text-tertiary">
+          <div className="flex min-w-0 flex-1 items-center gap-1.5">
+            {hasPublishedReferences
+              ? (
+                  <AgentWorkflowReferencesDropdown
+                    agentName={agent.name}
+                    publishedReferences={publishedReferences}
+                    referenceCount={referenceCount}
+                  />
+                )
+              : (
+                  <div className="flex shrink-0 items-center gap-1">
+                    <span aria-hidden className="i-custom-vender-agent-v2-plan size-3 shrink-0 text-text-tertiary" />
+                    <span className="system-xs-regular text-text-tertiary">{referenceCount}</span>
+                  </div>
+                )}
+            {updatedAt && (
+              <>
+                <span aria-hidden className="shrink-0 text-text-quaternary">·</span>
+                <span className="min-w-0 truncate">{updatedAt}</span>
+              </>
+            )}
+          </div>
+        </div>
+      </div>
+      <div
+        className="pointer-events-none absolute top-2 right-2 z-20 flex items-center overflow-hidden rounded-[10px] border-[0.5px] border-components-actionbar-border bg-components-actionbar-bg p-0.5 opacity-0 shadow-lg backdrop-blur-xs transition-opacity group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100 has-data-popup-open:pointer-events-auto has-data-popup-open:opacity-100"
+      >
+        <DropdownMenu modal={false}>
+          <DropdownMenuTrigger
+            aria-label={t('roster.moreActions', { name: agent.name })}
+            className="flex size-8 cursor-pointer items-center justify-center rounded-lg p-1.5 hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden data-popup-open:bg-state-base-hover"
+          >
+            <span className="sr-only">{t('roster.moreActions', { name: agent.name })}</span>
+            <span aria-hidden className="i-ri-more-fill size-4.5 text-text-tertiary" />
+          </DropdownMenuTrigger>
+          <DropdownMenuContent placement="bottom-end" sideOffset={4} popupClassName="w-40">
+            <DropdownMenuItem className="gap-2" onClick={() => setIsEditOpen(true)}>
+              <span aria-hidden className="i-ri-edit-line size-4 shrink-0 text-text-tertiary" />
+              <span>{t('roster.editInfo')}</span>
+            </DropdownMenuItem>
+            <DropdownMenuItem
+              disabled={duplicateAgentMutation.isPending}
+              className="gap-2"
+              onClick={handleDuplicate}
+            >
+              <span aria-hidden className="i-ri-file-copy-line size-4 shrink-0 text-text-tertiary" />
+              <span>{tCommon('operation.duplicate')}</span>
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem
+              variant="destructive"
+              className="gap-2"
+              onClick={() => setIsDeleteOpen(true)}
+            >
+              <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
+              <span>{tCommon('operation.delete')}</span>
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </div>
+      <EditAgentDialog agent={agent} open={isEditOpen} onOpenChange={setIsEditOpen} />
+      <DeleteAgentDialog agentId={agent.id} agentName={agent.name} open={isDeleteOpen} onOpenChange={setIsDeleteOpen} />
+    </article>
+  )
+}
+
+export function AgentRosterList({
+  agents,
+  hasMore,
+  isEmptySearch,
+  isError,
+  isFetching,
+  isFetchingNextPage,
+  isPending,
+  label,
+  onLoadMore,
+}: AgentRosterListProps) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <section aria-label={label} className="grid grid-cols-[repeat(auto-fill,minmax(min(100%,294px),1fr))] gap-2.5" aria-busy={isFetching || undefined}>
+      {isPending && <AgentRosterSkeleton />}
+      {!isPending && isError && (
+        <AgentRosterPlaceholderState title={t('roster.loadingError')} />
+      )}
+      {!isPending && !isError && agents.length === 0 && (
+        <AgentRosterPlaceholderState title={isEmptySearch ? t('roster.emptySearch') : t('roster.empty')} />
+      )}
+      {!isPending && !isError && agents.map(agent => (
+        <AgentRosterItem key={agent.id} agent={agent} />
+      ))}
+      {!isPending && !isError && hasMore && (
+        <div className="col-span-full flex justify-center pt-1">
+          <Button
+            loading={isFetchingNextPage}
+            disabled={isFetchingNextPage}
+            onClick={onLoadMore}
+          >
+            {t('roster.loadMore')}
+          </Button>
+        </div>
+      )}
+    </section>
+  )
+}
diff --git a/web/features/agent-v2/roster/components/agent-workflow-references-dropdown.tsx b/web/features/agent-v2/roster/components/agent-workflow-references-dropdown.tsx
new file mode 100644
index 00000000000..9974a30468c
--- /dev/null
+++ b/web/features/agent-v2/roster/components/agent-workflow-references-dropdown.tsx
@@ -0,0 +1,79 @@
+'use client'
+
+import type { AgentAppPublishedReferenceResponse, AgentIconType } from '@dify/contracts/api/console/agent/types.gen'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuLinkItem,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import Link from '@/next/link'
+
+const getWorkflowReferenceHref = (reference: AgentAppPublishedReferenceResponse) => `/app/${reference.app_id}/workflow`
+
+const getWorkflowReferenceIconType = (reference: AgentAppPublishedReferenceResponse): AgentIconType | undefined => {
+  if (reference.app_icon_type === 'image' || reference.app_icon_type === 'link')
+    return 'image'
+
+  if (reference.app_icon_type === 'emoji')
+    return 'emoji'
+
+  return undefined
+}
+
+const getWorkflowReferenceImageUrl = (reference: AgentAppPublishedReferenceResponse) => {
+  if (reference.app_icon_type === 'image' || reference.app_icon_type === 'link')
+    return reference.app_icon
+
+  return undefined
+}
+
+export function AgentWorkflowReferencesDropdown({
+  agentName,
+  publishedReferences,
+  referenceCount,
+}: {
+  agentName: string
+  publishedReferences: AgentAppPublishedReferenceResponse[]
+  referenceCount: number
+}) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <DropdownMenu modal={false}>
+      <DropdownMenuTrigger
+        aria-label={t('roster.references.trigger', { name: agentName, count: referenceCount })}
+        className="-ml-1 flex shrink-0 cursor-pointer items-center gap-1 rounded-md px-1 py-0.5 outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid data-popup-open:bg-state-base-hover"
+      >
+        <span aria-hidden className="i-custom-vender-agent-v2-plan size-3 shrink-0 text-text-tertiary" />
+        <span className="system-xs-regular text-text-tertiary">{referenceCount}</span>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent placement="bottom-start" sideOffset={4} popupClassName="w-[264px] p-1">
+        <div className="flex h-7.5 items-center px-2 system-xs-medium text-text-tertiary">
+          {t('roster.references.label', { name: agentName })}
+        </div>
+        {publishedReferences.map(reference => (
+          <DropdownMenuLinkItem
+            key={reference.app_id}
+            render={<Link href={getWorkflowReferenceHref(reference)} />}
+            className="mx-0 h-8 gap-2 px-2 py-1 pr-2.5 system-md-regular text-text-secondary"
+          >
+            <span aria-hidden className="shrink-0">
+              <AppIcon
+                size="tiny"
+                iconType={getWorkflowReferenceIconType(reference)}
+                icon={reference.app_icon ?? undefined}
+                background={reference.app_icon_background}
+                imageUrl={getWorkflowReferenceImageUrl(reference)}
+              />
+            </span>
+            <span className="min-w-0 flex-1 truncate">{reference.app_name}</span>
+            <span aria-hidden className="i-ri-external-link-line size-3 shrink-0 text-text-tertiary" />
+          </DropdownMenuLinkItem>
+        ))}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
diff --git a/web/features/agent-v2/roster/components/create-agent-dialog.tsx b/web/features/agent-v2/roster/components/create-agent-dialog.tsx
new file mode 100644
index 00000000000..abda2faa6af
--- /dev/null
+++ b/web/features/agent-v2/roster/components/create-agent-dialog.tsx
@@ -0,0 +1,216 @@
+'use client'
+
+import type { AgentAppCreatePayload } from '@dify/contracts/api/console/agent/types.gen'
+import type { AppIconSelection } from '@/app/components/base/app-icon-picker'
+import { Button } from '@langgenius/dify-ui/button'
+import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle, DialogTrigger } from '@langgenius/dify-ui/dialog'
+import { FieldControl, FieldError, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import { Form } from '@langgenius/dify-ui/form'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import AppIconPicker from '@/app/components/base/app-icon-picker'
+import { consoleQuery } from '@/service/client'
+
+type AgentFormValues = {
+  description?: string
+  name?: string
+  role?: string
+}
+
+const defaultAgentIcon = {
+  type: 'emoji',
+  icon: '🧸',
+  background: '#F5F3FF',
+} satisfies AppIconSelection
+
+export function CreateAgentDialog() {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const [open, setOpen] = useState(false)
+  const [formKey, setFormKey] = useState(0)
+  const [iconPickerOpen, setIconPickerOpen] = useState(false)
+  const [agentIcon, setAgentIcon] = useState<AppIconSelection>(defaultAgentIcon)
+  const createAgentMutation = useMutation(consoleQuery.agent.post.mutationOptions())
+
+  const resetForm = () => {
+    setFormKey(key => key + 1)
+    setAgentIcon(defaultAgentIcon)
+    setIconPickerOpen(false)
+  }
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    setOpen(nextOpen)
+    if (!nextOpen)
+      resetForm()
+  }
+
+  const handleSubmit = (formValues: AgentFormValues) => {
+    const trimmedName = formValues.name?.trim() ?? ''
+    const trimmedRole = formValues.role?.trim() ?? ''
+    if (createAgentMutation.isPending)
+      return
+
+    const body = {
+      name: trimmedName,
+      description: formValues.description?.trim() ?? '',
+      role: trimmedRole,
+      icon_type: agentIcon.type,
+      icon: agentIcon.type === 'image' ? agentIcon.fileId : agentIcon.icon,
+      icon_background: agentIcon.type === 'emoji' ? agentIcon.background : undefined,
+    } satisfies AgentAppCreatePayload
+
+    createAgentMutation.mutate({
+      body,
+    }, {
+      onSuccess: () => {
+        toast.success(t('roster.createSuccess'))
+        handleOpenChange(false)
+      },
+    })
+  }
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={handleOpenChange}>
+        <DialogTrigger
+          render={(
+            <Button
+              variant="primary"
+              className="h-8 gap-0.5 px-3"
+            />
+          )}
+        >
+          <span aria-hidden className="i-ri-add-line size-4" />
+          <span className="px-0.5 system-sm-medium">{t('roster.createAgent')}</span>
+        </DialogTrigger>
+        <DialogContent className="flex max-h-[calc(100dvh-2rem)] w-[520px] flex-col overflow-hidden! p-0!">
+          <DialogCloseButton className="top-5 right-5 size-8 rounded-lg" />
+          <div className="shrink-0 pt-6 pr-14 pb-3 pl-6">
+            <DialogTitle className="title-2xl-semi-bold text-text-primary">
+              {t('roster.createDialog.title')}
+            </DialogTitle>
+            <DialogDescription className="sr-only">
+              {t('roster.createDialog.description')}
+            </DialogDescription>
+          </div>
+          <Form<AgentFormValues>
+            key={formKey}
+            className="min-h-0 flex-1"
+            onFormSubmit={handleSubmit}
+          >
+            <div className="space-y-5 px-6 py-3">
+              <div className="flex items-end gap-4 pb-2">
+                <button
+                  type="button"
+                  aria-label={t('roster.createForm.changeIcon')}
+                  className="shrink-0 rounded-full outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+                  onClick={() => setIconPickerOpen(true)}
+                >
+                  <AppIcon
+                    size="xxl"
+                    rounded
+                    className="size-16 cursor-pointer"
+                    iconType={agentIcon.type}
+                    icon={agentIcon.type === 'image' ? agentIcon.fileId : agentIcon.icon}
+                    background={agentIcon.type === 'emoji' ? agentIcon.background : undefined}
+                    imageUrl={agentIcon.type === 'image' ? agentIcon.url : undefined}
+                  />
+                </button>
+                <div className="flex min-w-0 flex-1 gap-3 pb-1">
+                  <FieldRoot
+                    name="name"
+                    className="relative min-w-0 flex-1"
+                    validate={(value) => {
+                      if (typeof value === 'string' && value.length > 0 && !value.trim())
+                        return t('roster.createForm.nameRequired')
+
+                      return null
+                    }}
+                  >
+                    <FieldLabel>
+                      {t('roster.createForm.nameLabel')}
+                    </FieldLabel>
+                    <FieldControl
+                      autoComplete="off"
+                      // eslint-disable-next-line jsx-a11y/no-autofocus -- The create dialog opens from an explicit command, and the next expected action is naming the agent.
+                      autoFocus
+                      maxLength={255}
+                      placeholder={t('roster.createForm.namePlaceholder')}
+                      required
+                    />
+                    <div className="absolute top-full left-0 mt-1">
+                      <FieldError match="valueMissing">{t('roster.createForm.nameRequired')}</FieldError>
+                      <FieldError match="customError" />
+                    </div>
+                  </FieldRoot>
+                  <FieldRoot
+                    name="role"
+                    className="relative min-w-0 flex-1"
+                    validate={(value) => {
+                      if (typeof value === 'string' && value.length > 0 && !value.trim())
+                        return t('roster.createForm.roleRequired')
+
+                      return null
+                    }}
+                  >
+                    <FieldLabel>
+                      {t('roster.createForm.roleLabel')}
+                    </FieldLabel>
+                    <FieldControl
+                      autoComplete="off"
+                      maxLength={255}
+                      placeholder={t('roster.createForm.rolePlaceholder')}
+                      required
+                    />
+                    <div className="absolute top-full left-0 mt-1">
+                      <FieldError match="valueMissing">{t('roster.createForm.roleRequired')}</FieldError>
+                      <FieldError match="customError" />
+                    </div>
+                  </FieldRoot>
+                </div>
+              </div>
+              <FieldRoot name="description">
+                <FieldLabel>
+                  {t('roster.createForm.descriptionLabel')}
+                  <span className="ml-1 system-xs-regular text-text-tertiary">
+                    {t('roster.createForm.descriptionOptional')}
+                  </span>
+                </FieldLabel>
+                <Textarea
+                  autoComplete="off"
+                  className="h-20 resize-none"
+                  placeholder={t('roster.createForm.descriptionPlaceholder')}
+                />
+              </FieldRoot>
+            </div>
+            <div className="flex shrink-0 justify-end gap-2 px-6 pt-5 pb-6">
+              <Button type="button" className="min-w-18" onClick={() => handleOpenChange(false)} disabled={createAgentMutation.isPending}>
+                {tCommon('operation.cancel')}
+              </Button>
+              <Button
+                type="submit"
+                variant="primary"
+                className="min-w-18"
+                loading={createAgentMutation.isPending}
+              >
+                {tCommon('operation.create')}
+              </Button>
+            </div>
+          </Form>
+        </DialogContent>
+      </Dialog>
+      <AppIconPicker
+        open={iconPickerOpen}
+        initialEmoji={agentIcon.type === 'emoji'
+          ? { icon: agentIcon.icon, background: agentIcon.background }
+          : undefined}
+        onOpenChange={setIconPickerOpen}
+        onSelect={setAgentIcon}
+      />
+    </>
+  )
+}
diff --git a/web/features/agent-v2/roster/components/delete-agent-dialog.tsx b/web/features/agent-v2/roster/components/delete-agent-dialog.tsx
new file mode 100644
index 00000000000..e463cc76fb1
--- /dev/null
+++ b/web/features/agent-v2/roster/components/delete-agent-dialog.tsx
@@ -0,0 +1,77 @@
+'use client'
+
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+
+type DeleteAgentDialogProps = {
+  agentId: string
+  agentName: string
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}
+
+export function DeleteAgentDialog({
+  agentId,
+  agentName,
+  open,
+  onOpenChange,
+}: DeleteAgentDialogProps) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const deleteAgentMutation = useMutation(consoleQuery.agent.byAgentId.delete.mutationOptions())
+
+  const handleDelete = () => {
+    if (deleteAgentMutation.isPending)
+      return
+
+    deleteAgentMutation.mutate({
+      params: {
+        agent_id: agentId,
+      },
+    }, {
+      onSuccess: () => {
+        toast.success(t('roster.deleteSuccess'))
+        onOpenChange(false)
+      },
+      onError: () => {
+        toast.error(t('roster.deleteFailed'))
+      },
+    })
+  }
+
+  return (
+    <AlertDialog open={open} onOpenChange={onOpenChange}>
+      <AlertDialogContent className="p-6">
+        <AlertDialogTitle className="truncate title-2xl-semi-bold text-text-primary">
+          {t('roster.deleteDialog.title', { name: agentName })}
+        </AlertDialogTitle>
+        <AlertDialogDescription className="mt-2 system-md-regular wrap-break-word whitespace-pre-wrap text-text-tertiary">
+          {t('roster.deleteDialog.description')}
+        </AlertDialogDescription>
+        <AlertDialogActions className="p-0 pt-6">
+          <AlertDialogCancelButton disabled={deleteAgentMutation.isPending}>
+            {tCommon('operation.cancel')}
+          </AlertDialogCancelButton>
+          <AlertDialogConfirmButton
+            tone="destructive"
+            loading={deleteAgentMutation.isPending}
+            onClick={handleDelete}
+          >
+            {tCommon('operation.delete')}
+          </AlertDialogConfirmButton>
+        </AlertDialogActions>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}
diff --git a/web/features/agent-v2/roster/components/edit-agent-dialog.tsx b/web/features/agent-v2/roster/components/edit-agent-dialog.tsx
new file mode 100644
index 00000000000..3688476972a
--- /dev/null
+++ b/web/features/agent-v2/roster/components/edit-agent-dialog.tsx
@@ -0,0 +1,299 @@
+'use client'
+
+import type { AgentAppPartial, AgentAppUpdatePayload } from '@dify/contracts/api/console/agent/types.gen'
+import type { AppIconSelection } from '@/app/components/base/app-icon-picker'
+import { Button } from '@langgenius/dify-ui/button'
+import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { FieldControl, FieldError, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import { Form } from '@langgenius/dify-ui/form'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import AppIconPicker from '@/app/components/base/app-icon-picker'
+import { consoleQuery } from '@/service/client'
+
+type EditAgentDialogProps = {
+  agent: AgentAppPartial
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}
+
+type AgentFormValues = {
+  description?: string
+  name?: string
+  role?: string
+}
+
+type AgentIconSelection = AppIconSelection | {
+  type: 'link'
+  icon: string
+  url: string
+}
+
+const defaultAgentIcon = {
+  type: 'emoji',
+  icon: '🧸',
+  background: '#F5F3FF',
+} satisfies AppIconSelection
+
+const createAgentIconSelection = (agent: AgentAppPartial): AgentIconSelection => {
+  if (agent.icon_type === 'image' && agent.icon) {
+    return {
+      type: 'image',
+      fileId: agent.icon,
+      url: agent.icon,
+    }
+  }
+
+  if (agent.icon_type === 'link' && agent.icon) {
+    return {
+      type: 'link',
+      icon: agent.icon,
+      url: agent.icon,
+    }
+  }
+
+  return {
+    type: 'emoji',
+    icon: agent.icon || defaultAgentIcon.icon,
+    background: agent.icon_background || defaultAgentIcon.background,
+  }
+}
+
+const getAgentIconKey = (icon: AgentIconSelection) => {
+  if (icon.type === 'emoji')
+    return `${icon.type}:${icon.icon}:${icon.background}`
+
+  if (icon.type === 'image')
+    return `${icon.type}:${icon.fileId}`
+
+  return `${icon.type}:${icon.icon}`
+}
+
+const applyIconPayload = (body: AgentAppUpdatePayload, icon: AgentIconSelection) => {
+  if (icon.type === 'emoji') {
+    body.icon_type = icon.type
+    body.icon = icon.icon
+    body.icon_background = icon.background
+    return
+  }
+
+  body.icon_type = icon.type
+  body.icon = icon.type === 'image' ? icon.fileId : icon.icon
+  body.icon_background = undefined
+}
+
+export function EditAgentDialog({
+  agent,
+  open,
+  onOpenChange,
+}: EditAgentDialogProps) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const [name, setName] = useState(agent.name)
+  const [description, setDescription] = useState(agent.description ?? '')
+  const [role, setRole] = useState(agent.role ?? '')
+  const [iconPickerOpen, setIconPickerOpen] = useState(false)
+  const [agentIcon, setAgentIcon] = useState<AgentIconSelection>(() => createAgentIconSelection(agent))
+  const updateAgentMutation = useMutation(consoleQuery.agent.byAgentId.put.mutationOptions())
+
+  const handleSubmit = (formValues: AgentFormValues) => {
+    const trimmedName = formValues.name?.trim() ?? ''
+    const trimmedDescription = formValues.description?.trim() ?? ''
+    const trimmedRole = formValues.role?.trim() ?? ''
+    const hasIconChanges = getAgentIconKey(agentIcon) !== getAgentIconKey(createAgentIconSelection(agent))
+    const hasFormChanges = trimmedName !== agent.name.trim()
+      || trimmedDescription !== (agent.description?.trim() ?? '')
+      || trimmedRole !== (agent.role?.trim() ?? '')
+      || hasIconChanges
+
+    if (updateAgentMutation.isPending)
+      return
+
+    if (!hasFormChanges)
+      return
+
+    const body: AgentAppUpdatePayload = {
+      name: trimmedName,
+      description: trimmedDescription,
+      // Keep sending the trimmed role even when empty: omitting the field
+      // preserves the current backing-agent role, while "" intentionally clears it.
+      role: trimmedRole,
+    }
+
+    applyIconPayload(body, agentIcon)
+
+    updateAgentMutation.mutate({
+      params: {
+        agent_id: agent.id,
+      },
+      body,
+    }, {
+      onSuccess: () => {
+        toast.success(t('roster.updateSuccess'))
+        onOpenChange(false)
+      },
+    })
+  }
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    if (nextOpen) {
+      setName(agent.name)
+      setDescription(agent.description ?? '')
+      setRole(agent.role ?? '')
+      setAgentIcon(createAgentIconSelection(agent))
+    }
+    else {
+      setIconPickerOpen(false)
+    }
+    onOpenChange(nextOpen)
+  }
+
+  const trimmedName = name.trim()
+  const trimmedDescription = description.trim()
+  const trimmedRole = role.trim()
+  const hasIconChanges = getAgentIconKey(agentIcon) !== getAgentIconKey(createAgentIconSelection(agent))
+  const hasChanges = trimmedName !== agent.name.trim()
+    || trimmedDescription !== (agent.description?.trim() ?? '')
+    || trimmedRole !== (agent.role?.trim() ?? '')
+    || hasIconChanges
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={handleOpenChange}>
+        <DialogContent className="flex max-h-[calc(100dvh-2rem)] w-[520px] flex-col overflow-hidden! p-0!">
+          <DialogCloseButton className="top-5 right-5 size-8 rounded-lg" />
+          <div className="shrink-0 pt-6 pr-14 pb-3 pl-6">
+            <DialogTitle className="title-2xl-semi-bold text-text-primary">
+              {t('roster.editDialog.title')}
+            </DialogTitle>
+            <DialogDescription className="sr-only">
+              {t('roster.editDialog.description')}
+            </DialogDescription>
+          </div>
+          <Form<AgentFormValues>
+            className="min-h-0 flex-1"
+            onFormSubmit={handleSubmit}
+          >
+            <div className="space-y-5 px-6 py-3">
+              <div className="flex items-end gap-4 pb-2">
+                <button
+                  type="button"
+                  aria-label={t('roster.editAgent', { name: agent.name })}
+                  className="shrink-0 rounded-full outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+                  onClick={() => setIconPickerOpen(true)}
+                >
+                  <AppIcon
+                    size="xxl"
+                    rounded
+                    className="size-16 cursor-pointer"
+                    iconType={agentIcon.type === 'link' ? 'image' : agentIcon.type}
+                    icon={agentIcon.type === 'emoji' ? agentIcon.icon : undefined}
+                    background={agentIcon.type === 'emoji' ? agentIcon.background : undefined}
+                    imageUrl={agentIcon.type === 'emoji' ? undefined : agentIcon.url}
+                  />
+                </button>
+                <div className="flex min-w-0 flex-1 gap-3 pb-1">
+                  <FieldRoot
+                    name="name"
+                    className="relative min-w-0 flex-1"
+                    validate={(value) => {
+                      if (typeof value === 'string' && value.length > 0 && !value.trim())
+                        return t('roster.createForm.nameRequired')
+
+                      return null
+                    }}
+                  >
+                    <FieldLabel>
+                      {t('roster.createForm.nameLabel')}
+                    </FieldLabel>
+                    <FieldControl
+                      autoComplete="off"
+                      // eslint-disable-next-line jsx-a11y/no-autofocus -- The edit dialog opens from an explicit command, and the name field is the primary editable control.
+                      autoFocus
+                      maxLength={255}
+                      onValueChange={setName}
+                      placeholder={t('roster.createForm.namePlaceholder')}
+                      required
+                      value={name}
+                    />
+                    <div className="absolute top-full left-0 mt-1">
+                      <FieldError match="valueMissing">{t('roster.createForm.nameRequired')}</FieldError>
+                      <FieldError match="customError" />
+                    </div>
+                  </FieldRoot>
+                  <FieldRoot
+                    name="role"
+                    className="relative min-w-0 flex-1"
+                    validate={(value) => {
+                      if (typeof value === 'string' && value.length > 0 && !value.trim())
+                        return t('roster.createForm.roleRequired')
+
+                      return null
+                    }}
+                  >
+                    <FieldLabel>
+                      {t('roster.createForm.roleLabel')}
+                    </FieldLabel>
+                    <FieldControl
+                      autoComplete="off"
+                      maxLength={255}
+                      onValueChange={setRole}
+                      placeholder={t('roster.createForm.rolePlaceholder')}
+                      required
+                      value={role}
+                    />
+                    <div className="absolute top-full left-0 mt-1">
+                      <FieldError match="valueMissing">{t('roster.createForm.roleRequired')}</FieldError>
+                      <FieldError match="customError" />
+                    </div>
+                  </FieldRoot>
+                </div>
+              </div>
+              <FieldRoot name="description">
+                <FieldLabel>
+                  {t('roster.createForm.descriptionLabel')}
+                  <span className="ml-1 system-xs-regular text-text-tertiary">
+                    {t('roster.createForm.descriptionOptional')}
+                  </span>
+                </FieldLabel>
+                <Textarea
+                  autoComplete="off"
+                  className="h-20 resize-none"
+                  onValueChange={setDescription}
+                  placeholder={t('roster.createForm.descriptionPlaceholder')}
+                  value={description}
+                />
+              </FieldRoot>
+            </div>
+            <div className="flex shrink-0 justify-end gap-2 px-6 pt-5 pb-6">
+              <Button type="button" className="min-w-18" onClick={() => onOpenChange(false)} disabled={updateAgentMutation.isPending}>
+                {tCommon('operation.cancel')}
+              </Button>
+              <Button
+                type="submit"
+                variant="primary"
+                className="min-w-18"
+                disabled={!hasChanges}
+                loading={updateAgentMutation.isPending}
+              >
+                {tCommon('operation.save')}
+              </Button>
+            </div>
+          </Form>
+        </DialogContent>
+      </Dialog>
+      <AppIconPicker
+        open={iconPickerOpen}
+        initialEmoji={agentIcon.type === 'emoji'
+          ? { icon: agentIcon.icon, background: agentIcon.background }
+          : undefined}
+        onOpenChange={setIconPickerOpen}
+        onSelect={setAgentIcon}
+      />
+    </>
+  )
+}
diff --git a/web/features/agent-v2/roster/components/roster-filter.ts b/web/features/agent-v2/roster/components/roster-filter.ts
new file mode 100644
index 00000000000..a80025d6f65
--- /dev/null
+++ b/web/features/agent-v2/roster/components/roster-filter.ts
@@ -0,0 +1,2 @@
+export const ROSTER_FILTER_VALUES = ['all', 'published', 'drafts'] as const
+export type RosterFilterValue = typeof ROSTER_FILTER_VALUES[number]
diff --git a/web/features/agent-v2/roster/components/roster-toolbar.tsx b/web/features/agent-v2/roster/components/roster-toolbar.tsx
new file mode 100644
index 00000000000..690d3373c30
--- /dev/null
+++ b/web/features/agent-v2/roster/components/roster-toolbar.tsx
@@ -0,0 +1,95 @@
+'use client'
+
+import type { RosterFilterValue } from './roster-filter'
+import { SegmentedControl, SegmentedControlItem } from '@langgenius/dify-ui/segmented-control'
+import { useTranslation } from 'react-i18next'
+import { SearchInput } from '@/app/components/base/search-input'
+import { CreateAgentDialog } from './create-agent-dialog'
+
+type RosterToolbarProps = {
+  draftAgents: number
+  filter: RosterFilterValue
+  keyword: string
+  onFilterChange: (value: RosterFilterValue) => void
+  onKeywordChange: (value: string) => void
+  publishedAgents: number
+}
+
+type RosterFilterItemProps = {
+  count?: number
+  label: string
+  value: RosterFilterValue
+}
+
+function RosterFilterItem({
+  count,
+  label,
+  value,
+}: RosterFilterItemProps) {
+  return (
+    <SegmentedControlItem
+      value={value}
+      className="gap-1 data-pressed:text-text-secondary"
+    >
+      <span>{label}</span>
+      {count !== undefined && (
+        <span className="flex min-w-4 shrink-0 items-center justify-center rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary tabular-nums">
+          <span className="min-w-px flex-1 text-center">
+            {count}
+          </span>
+        </span>
+      )}
+    </SegmentedControlItem>
+  )
+}
+
+export function RosterToolbar({
+  draftAgents,
+  filter,
+  keyword,
+  onFilterChange,
+  onKeywordChange,
+  publishedAgents,
+}: RosterToolbarProps) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <div className="flex min-w-0 flex-wrap items-center gap-2">
+      <SegmentedControl
+        aria-label={t('roster.filters.label')}
+        value={[filter]}
+        onValueChange={(value) => {
+          const nextFilter = value[0]
+
+          if (nextFilter)
+            onFilterChange(nextFilter)
+        }}
+      >
+        <RosterFilterItem
+          value="all"
+          label={t('roster.filters.all')}
+        />
+        <RosterFilterItem
+          value="published"
+          label={t('roster.filters.published')}
+          count={publishedAgents}
+        />
+        <RosterFilterItem
+          value="drafts"
+          label={t('roster.filters.drafts')}
+          count={draftAgents}
+        />
+      </SegmentedControl>
+      <SearchInput
+        aria-label={t('roster.searchLabel')}
+        className="h-8 w-50 max-w-full"
+        placeholder={t('roster.searchPlaceholder')}
+        value={keyword}
+        onValueChange={onKeywordChange}
+      />
+      <div className="ml-auto flex min-w-0 items-center gap-2">
+        <CreateAgentDialog />
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/roster/page.tsx b/web/features/agent-v2/roster/page.tsx
new file mode 100644
index 00000000000..2527c0875b5
--- /dev/null
+++ b/web/features/agent-v2/roster/page.tsx
@@ -0,0 +1,150 @@
+'use client'
+
+import type { AgentRosterListItem } from './components/agent-roster-list'
+import type { RosterFilterValue } from './components/roster-filter'
+import {
+  ScrollAreaContent,
+  ScrollAreaRoot,
+  ScrollAreaScrollbar,
+  ScrollAreaThumb,
+  ScrollAreaViewport,
+} from '@langgenius/dify-ui/scroll-area'
+import { Tabs, TabsList, TabsPanel, TabsTab } from '@langgenius/dify-ui/tabs'
+import { keepPreviousData, useInfiniteQuery } from '@tanstack/react-query'
+import { useDebounce } from 'ahooks'
+import { debounce, parseAsString, parseAsStringLiteral, useQueryState } from 'nuqs'
+import { useTranslation } from 'react-i18next'
+import useDocumentTitle from '@/hooks/use-document-title'
+import { consoleQuery } from '@/service/client'
+import { AgentRosterList } from './components/agent-roster-list'
+import { ROSTER_FILTER_VALUES } from './components/roster-filter'
+import { RosterToolbar } from './components/roster-toolbar'
+
+const ROSTER_PAGE_SIZE = 30
+const isAgentPublished = (agent: AgentRosterListItem) => agent.active_config_is_published === true
+const rosterTabClassName = 'pt-0 pb-2 system-xl-semibold data-active:border-util-colors-blue-brand-blue-brand-500 data-disabled:opacity-100'
+
+const getFilteredRosterItems = (
+  agents: AgentRosterListItem[],
+  filter: RosterFilterValue,
+) => {
+  if (filter === 'published')
+    return agents.filter(isAgentPublished)
+
+  if (filter === 'drafts')
+    return agents.filter(agent => !isAgentPublished(agent))
+
+  return agents
+}
+
+export default function RosterPage() {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const [keyword, setKeyword] = useQueryState('keyword', parseAsString.withDefault('').withOptions({
+    limitUrlUpdates: debounce(300),
+  }))
+  const [rosterFilter, setRosterFilter] = useQueryState(
+    'filter',
+    parseAsStringLiteral(ROSTER_FILTER_VALUES).withDefault('all'),
+  )
+  const debouncedKeyword = useDebounce(keyword.trim(), { wait: 300 })
+
+  const rosterQueryInput = {
+    limit: ROSTER_PAGE_SIZE,
+    ...(debouncedKeyword ? { name: debouncedKeyword } : {}),
+  }
+
+  const {
+    data: rosterPages,
+    isPending,
+    isFetching,
+    isFetchingNextPage,
+    fetchNextPage,
+    hasNextPage,
+    error,
+  } = useInfiniteQuery({
+    ...consoleQuery.agent.get.infiniteOptions({
+      input: pageParam => ({
+        query: {
+          ...rosterQueryInput,
+          page: Number(pageParam),
+        },
+      }),
+      getNextPageParam: lastPage => lastPage.has_more ? lastPage.page + 1 : undefined,
+      initialPageParam: 1,
+      placeholderData: keepPreviousData,
+    }),
+  })
+
+  const rosterItems: AgentRosterListItem[] = rosterPages?.pages.flatMap(page => page.data) ?? []
+  const publishedAgents = rosterItems.filter(isAgentPublished).length
+  const draftAgents = Math.max(rosterItems.length - publishedAgents, 0)
+  const filteredRosterItems = getFilteredRosterItems(rosterItems, rosterFilter)
+
+  useDocumentTitle(tCommon('menus.roster'))
+
+  return (
+    <div className="flex h-0 min-w-0 grow flex-col overflow-hidden bg-background-body">
+      <Tabs defaultValue="agent" className="flex min-h-0 flex-1 flex-col">
+        <div className="h-25.5 shrink-0 bg-background-body px-8 pt-4 pb-4">
+          <div className="flex min-w-0 items-center justify-between gap-4">
+            <TabsList aria-label={t('roster.tabsLabel')}>
+              <TabsTab value="agent" className={rosterTabClassName}>
+                {t('roster.tabs.agent')}
+              </TabsTab>
+              <TabsTab value="human" disabled className={rosterTabClassName}>
+                {t('roster.tabs.human')}
+              </TabsTab>
+            </TabsList>
+            <a
+              href="https://docs.dify.ai/"
+              target="_blank"
+              rel="noreferrer"
+              className="hidden shrink-0 items-center gap-0.5 rounded-md system-xs-regular text-text-tertiary hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden sm:inline-flex"
+            >
+              {t('roster.learnMore')}
+              <span aria-hidden className="i-ri-external-link-line size-3" />
+            </a>
+          </div>
+          <div className="mt-3.5">
+            <RosterToolbar
+              draftAgents={draftAgents}
+              filter={rosterFilter}
+              keyword={keyword}
+              onFilterChange={(value) => {
+                void setRosterFilter(value)
+              }}
+              onKeywordChange={(value) => {
+                void setKeyword(value)
+              }}
+              publishedAgents={publishedAgents}
+            />
+          </div>
+        </div>
+
+        <TabsPanel value="agent" tabIndex={-1} className="min-h-0 flex-1">
+          <ScrollAreaRoot className="relative h-full min-h-0 min-w-0 overflow-hidden">
+            <ScrollAreaViewport tabIndex={-1} className="overscroll-contain">
+              <ScrollAreaContent className="min-h-full px-8 pt-2 pb-8">
+                <AgentRosterList
+                  agents={filteredRosterItems}
+                  hasMore={!!hasNextPage}
+                  isEmptySearch={!!debouncedKeyword || rosterFilter !== 'all'}
+                  isError={!!error}
+                  isFetching={isFetching}
+                  isFetchingNextPage={isFetchingNextPage}
+                  isPending={isPending}
+                  label={t('roster.listLabel')}
+                  onLoadMore={() => fetchNextPage()}
+                />
+              </ScrollAreaContent>
+            </ScrollAreaViewport>
+            <ScrollAreaScrollbar className="data-[orientation=vertical]:my-1 data-[orientation=vertical]:me-1">
+              <ScrollAreaThumb />
+            </ScrollAreaScrollbar>
+          </ScrollAreaRoot>
+        </TabsPanel>
+      </Tabs>
+    </div>
+  )
+}
diff --git a/web/features/deployments/components/__tests__/env-var-bindings-utils.spec.ts b/web/features/deployments/components/__tests__/env-var-bindings-utils.spec.ts
new file mode 100644
index 00000000000..4541f075e25
--- /dev/null
+++ b/web/features/deployments/components/__tests__/env-var-bindings-utils.spec.ts
@@ -0,0 +1,53 @@
+import type { EnvVarSlot } from '@dify/contracts/enterprise/types.gen'
+import { EnvVarValueType } from '@dify/contracts/enterprise/types.gen'
+import { describe, expect, it } from 'vitest'
+import {
+  envVarBindingSlotFromContract,
+  envVarBindingValueType,
+} from '../env-var-bindings-utils'
+
+function slot(overrides: Partial<EnvVarSlot>): EnvVarSlot {
+  return {
+    key: 'API_KEY',
+    valueType: EnvVarValueType.ENV_VAR_VALUE_TYPE_STRING,
+    description: '',
+    ...overrides,
+  }
+}
+
+describe('env var binding value type normalization', () => {
+  it('should normalize generated and DSL value types', () => {
+    expect(envVarBindingValueType(EnvVarValueType.ENV_VAR_VALUE_TYPE_NUMBER)).toBe('number')
+    expect(envVarBindingValueType('number')).toBe('number')
+    expect(envVarBindingValueType(EnvVarValueType.ENV_VAR_VALUE_TYPE_SECRET)).toBe('secret')
+    expect(envVarBindingValueType('secret')).toBe('secret')
+    expect(envVarBindingValueType(EnvVarValueType.ENV_VAR_VALUE_TYPE_STRING)).toBe('string')
+    expect(envVarBindingValueType()).toBe('string')
+  })
+})
+
+describe('env var contract slot conversion', () => {
+  it('should trim keys and preserve default and last value availability', () => {
+    expect(envVarBindingSlotFromContract(slot({
+      key: '  API_TOKEN  ',
+      valueType: EnvVarValueType.ENV_VAR_VALUE_TYPE_SECRET,
+      defaultValue: '',
+      lastValue: 'previous',
+    }))).toMatchObject({
+      key: 'API_TOKEN',
+      valueType: 'secret',
+      hasDefaultValue: true,
+      hasLastValue: true,
+    })
+  })
+
+  it('should ignore blank keys and mark absent values as unavailable', () => {
+    expect(envVarBindingSlotFromContract(slot({ key: '   ' }))).toBeUndefined()
+    expect(envVarBindingSlotFromContract(slot({ key: 'PORT', valueType: EnvVarValueType.ENV_VAR_VALUE_TYPE_NUMBER }))).toMatchObject({
+      key: 'PORT',
+      valueType: 'number',
+      hasDefaultValue: false,
+      hasLastValue: false,
+    })
+  })
+})
diff --git a/web/features/deployments/components/__tests__/runtime-credential-bindings-utils.spec.ts b/web/features/deployments/components/__tests__/runtime-credential-bindings-utils.spec.ts
new file mode 100644
index 00000000000..54b67adad22
--- /dev/null
+++ b/web/features/deployments/components/__tests__/runtime-credential-bindings-utils.spec.ts
@@ -0,0 +1,129 @@
+import type {
+  CredentialCandidate,
+  CredentialSlot,
+} from '@dify/contracts/enterprise/types.gen'
+import { PluginCategory } from '@dify/contracts/enterprise/types.gen'
+import { describe, expect, it } from 'vitest'
+import {
+  hasMissingRequiredRuntimeCredentialBinding,
+  runtimeCredentialCandidateOptions,
+  runtimeCredentialProviderName,
+  runtimeCredentialSlotKey,
+  selectedDeploymentRuntimeCredentials,
+  selectedRuntimeCredentialSelections,
+} from '../runtime-credential-bindings-utils'
+
+function candidate(overrides: Partial<CredentialCandidate>): CredentialCandidate {
+  return {
+    credentialId: 'credential-1',
+    providerId: 'langgenius/openai',
+    category: PluginCategory.PLUGIN_CATEGORY_MODEL,
+    displayName: 'OpenAI key',
+    fromEnterprise: false,
+    ...overrides,
+  }
+}
+
+function slot(overrides: Partial<CredentialSlot>): CredentialSlot {
+  return {
+    providerId: 'langgenius/openai',
+    category: PluginCategory.PLUGIN_CATEGORY_MODEL,
+    candidates: [
+      candidate({ credentialId: 'credential-1', displayName: 'Primary key' }),
+      candidate({ credentialId: 'credential-2', displayName: 'Backup key' }),
+    ],
+    lastCredentialId: '',
+    ...overrides,
+  }
+}
+
+describe('runtime credential provider names', () => {
+  it('should resolve known provider slugs and title-case custom slugs', () => {
+    expect(runtimeCredentialProviderName('langgenius/openai')).toBe('OpenAI')
+    expect(runtimeCredentialProviderName('langgenius/azure_openai')).toBe('Azure OpenAI')
+    expect(runtimeCredentialProviderName('custom/my-provider')).toBe('My Provider')
+    expect(runtimeCredentialProviderName('/')).toBeUndefined()
+  })
+})
+
+describe('runtime credential selection helpers', () => {
+  it('should build stable slot keys and candidate labels', () => {
+    const credentialSlot = slot({
+      candidates: [
+        candidate({
+          credentialId: 'credential-1',
+          providerId: 'langgenius/openai',
+          displayName: 'Production key · langgenius/openai',
+        }),
+        candidate({
+          credentialId: 'credential-2',
+          providerId: 'langgenius/openai',
+          displayName: 'Backup key (langgenius/openai)',
+        }),
+        candidate({
+          credentialId: 'credential-3',
+          providerId: 'langgenius/openai',
+          displayName: '',
+        }),
+      ],
+    })
+
+    expect(runtimeCredentialSlotKey(credentialSlot)).toBe('langgenius/openai:PLUGIN_CATEGORY_MODEL')
+    expect(runtimeCredentialCandidateOptions(credentialSlot)).toEqual([
+      { value: 'credential-1', label: 'Production key' },
+      { value: 'credential-2', label: 'Backup key' },
+      { value: 'credential-3', label: 'credential-3' },
+    ])
+  })
+
+  it('should prefer valid manual selections before last or only candidates', () => {
+    const firstSlot = slot({
+      providerId: 'langgenius/openai',
+      lastCredentialId: 'credential-2',
+    })
+    const secondSlot = slot({
+      providerId: 'langgenius/bedrock',
+      candidates: [candidate({ credentialId: 'bedrock-1', providerId: 'langgenius/bedrock' })],
+      lastCredentialId: '',
+    })
+    const thirdSlot = slot({
+      providerId: 'custom/empty',
+      candidates: [
+        candidate({ credentialId: 'empty-1', providerId: 'custom/empty' }),
+        candidate({ credentialId: 'empty-2', providerId: 'custom/empty' }),
+      ],
+      lastCredentialId: 'stale',
+    })
+
+    expect(selectedRuntimeCredentialSelections(
+      [firstSlot, secondSlot, thirdSlot],
+      {
+        [runtimeCredentialSlotKey(firstSlot)]: 'credential-1',
+        [runtimeCredentialSlotKey(secondSlot)]: 'stale',
+      },
+    )).toEqual({
+      [runtimeCredentialSlotKey(firstSlot)]: 'credential-1',
+      [runtimeCredentialSlotKey(secondSlot)]: 'bedrock-1',
+    })
+  })
+
+  it('should convert selected credentials into deployment payload inputs', () => {
+    const firstSlot = slot({ providerId: 'langgenius/openai' })
+    const secondSlot = slot({ providerId: 'langgenius/bedrock' })
+
+    expect(hasMissingRequiredRuntimeCredentialBinding(firstSlot)).toBe(true)
+    expect(hasMissingRequiredRuntimeCredentialBinding(firstSlot, 'credential-1')).toBe(false)
+    expect(selectedDeploymentRuntimeCredentials(
+      [firstSlot, secondSlot],
+      {
+        [runtimeCredentialSlotKey(firstSlot)]: 'credential-1',
+      },
+    )).toEqual([
+      {
+        providerId: 'langgenius/openai',
+        category: PluginCategory.PLUGIN_CATEGORY_MODEL,
+        credentialId: 'credential-1',
+      },
+    ])
+  })
+})
diff --git a/web/features/deployments/components/deployment-actions/delete-dialog.tsx b/web/features/deployments/components/deployment-actions/delete-dialog.tsx
new file mode 100644
index 00000000000..e2a79e060b6
--- /dev/null
+++ b/web/features/deployments/components/deployment-actions/delete-dialog.tsx
@@ -0,0 +1,88 @@
+'use client'
+
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import { useRouter } from '@/next/navigation'
+import { consoleQuery } from '@/service/client'
+
+export function DeleteDeploymentDialog({
+  appInstanceId,
+  appName,
+  open,
+  onOpenChange,
+}: {
+  appInstanceId: string
+  appName?: string
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}) {
+  const { t } = useTranslation('deployments')
+  const router = useRouter()
+  const deleteInstance = useMutation(consoleQuery.enterprise.appInstanceService.deleteAppInstance.mutationOptions())
+  const displayName = appName || appInstanceId
+
+  function handleDelete() {
+    deleteInstance.mutate(
+      {
+        params: {
+          appInstanceId,
+        },
+      },
+      {
+        onSuccess: () => {
+          toast.success(t('settings.deleted'))
+          router.push('/deployments')
+        },
+        onError: () => {
+          toast.error(t('settings.deleteFailed'))
+        },
+        onSettled: () => {
+          onOpenChange(false)
+        },
+      },
+    )
+  }
+
+  return (
+    <AlertDialog
+      open={open}
+      onOpenChange={(nextOpen) => {
+        if (!nextOpen && deleteInstance.isPending)
+          return
+        onOpenChange(nextOpen)
+      }}
+    >
+      <AlertDialogContent className="w-120">
+        <div className="flex flex-col gap-3 px-6 pt-6 pb-2">
+          <AlertDialogTitle className="title-2xl-semi-bold text-text-primary">
+            {t('settings.deleteConfirmTitle')}
+          </AlertDialogTitle>
+          <AlertDialogDescription className="system-sm-regular text-text-tertiary">
+            {t('settings.deleteConfirmDesc', { name: displayName })}
+          </AlertDialogDescription>
+        </div>
+        <AlertDialogActions className="pt-3">
+          <AlertDialogCancelButton variant="secondary" disabled={deleteInstance.isPending}>
+            {t('createModal.cancel')}
+          </AlertDialogCancelButton>
+          <AlertDialogConfirmButton
+            loading={deleteInstance.isPending}
+            onClick={handleDelete}
+          >
+            {t('settings.delete')}
+          </AlertDialogConfirmButton>
+        </AlertDialogActions>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}
diff --git a/web/features/deployments/components/deployment-actions/edit-dialog.tsx b/web/features/deployments/components/deployment-actions/edit-dialog.tsx
new file mode 100644
index 00000000000..a1a367022a1
--- /dev/null
+++ b/web/features/deployments/components/deployment-actions/edit-dialog.tsx
@@ -0,0 +1,206 @@
+'use client'
+
+import type { AppInstance } from '@dify/contracts/enterprise/types.gen'
+import type { FormEvent } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import {
+  Dialog,
+  DialogCloseButton,
+  DialogContent,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { Input } from '@langgenius/dify-ui/input'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation, useQuery } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import { consoleQuery } from '@/service/client'
+
+type EditDeploymentFormValues = {
+  name: string
+  description: string
+}
+
+function EditDeploymentFormSkeleton() {
+  return (
+    <div className="flex flex-col gap-4">
+      <div className="flex flex-col gap-2">
+        <SkeletonRectangle className="my-0 h-3 w-24 animate-pulse" />
+        <SkeletonRectangle className="my-0 h-8 w-full animate-pulse rounded-lg" />
+      </div>
+      <div className="flex flex-col gap-2">
+        <SkeletonRectangle className="my-0 h-3 w-28 animate-pulse" />
+        <SkeletonRectangle className="my-0 h-24 w-full animate-pulse rounded-lg" />
+      </div>
+      <SkeletonRow className="justify-end gap-2">
+        <SkeletonRectangle className="my-0 h-8 w-16 animate-pulse rounded-lg" />
+        <SkeletonRectangle className="my-0 h-8 w-24 animate-pulse rounded-lg" />
+      </SkeletonRow>
+    </div>
+  )
+}
+
+function EditDeploymentForm({
+  app,
+  isSaving,
+  onClose,
+  onSubmit,
+}: {
+  app: AppInstance
+  isSaving: boolean
+  onClose: () => void
+  onSubmit: (values: EditDeploymentFormValues) => void
+}) {
+  const { t } = useTranslation('deployments')
+  const initialName = app.displayName
+  const initialDescription = app.description
+  const [name, setName] = useState(initialName)
+  const [description, setDescription] = useState(initialDescription)
+  const normalizedName = name.trim()
+  const normalizedDescription = description.trim()
+  const canSave = Boolean(normalizedName && (normalizedName !== initialName || normalizedDescription !== initialDescription) && !isSaving)
+
+  function handleSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault()
+    if (!canSave)
+      return
+
+    onSubmit({
+      name: normalizedName,
+      description: normalizedDescription,
+    })
+  }
+
+  return (
+    <form className="flex flex-col gap-4" onSubmit={handleSubmit}>
+      <div className="flex flex-col gap-2">
+        <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="deployment-edit-name">
+          {t('settings.name')}
+        </label>
+        <Input
+          id="deployment-edit-name"
+          type="text"
+          value={name}
+          onChange={event => setName(event.target.value)}
+          className="h-8"
+        />
+      </div>
+      <div className="flex flex-col gap-2">
+        <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="deployment-edit-description">
+          {t('settings.description')}
+        </label>
+        <Textarea
+          id="deployment-edit-description"
+          value={description}
+          onValueChange={setDescription}
+          className="min-h-24"
+        />
+      </div>
+      <div className="flex justify-end gap-2 pt-2">
+        <Button
+          type="button"
+          variant="secondary"
+          disabled={isSaving}
+          onClick={onClose}
+        >
+          {t('createModal.cancel')}
+        </Button>
+        <Button
+          type="submit"
+          variant="primary"
+          disabled={!canSave}
+          loading={isSaving}
+        >
+          {t('settings.save')}
+        </Button>
+      </div>
+    </form>
+  )
+}
+
+export function EditDeploymentDialog({
+  appInstanceId,
+  open,
+  onOpenChange,
+}: {
+  appInstanceId: string
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}) {
+  const { t } = useTranslation('deployments')
+  const updateInstance = useMutation(consoleQuery.enterprise.appInstanceService.updateAppInstance.mutationOptions())
+  const instanceQuery = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+    enabled: open,
+  }))
+  const app = instanceQuery.data?.appInstance
+  const formKey = app ? `${app.id}-${app.displayName}-${app.description}` : 'loading'
+
+  function handleOpenChange(nextOpen: boolean) {
+    if (!nextOpen && updateInstance.isPending)
+      return
+    onOpenChange(nextOpen)
+  }
+
+  function handleClose() {
+    handleOpenChange(false)
+  }
+
+  function handleSubmit(values: EditDeploymentFormValues) {
+    updateInstance.mutate(
+      {
+        params: {
+          appInstanceId,
+        },
+        body: {
+          appInstanceId,
+          displayName: values.name,
+          description: values.description || undefined,
+        },
+      },
+      {
+        onSuccess: () => {
+          toast.success(t('settings.updated'))
+          onOpenChange(false)
+        },
+        onError: () => {
+          toast.error(t('settings.updateFailed'))
+        },
+      },
+    )
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent className="w-120 max-w-[calc(100vw-32px)] p-0">
+        <DialogCloseButton disabled={updateInstance.isPending} />
+        <div className="border-b border-divider-subtle px-6 py-5">
+          <DialogTitle className="title-xl-semi-bold text-text-primary">
+            {t('card.menu.editInfo')}
+          </DialogTitle>
+        </div>
+        <div className="px-6 py-5">
+          {instanceQuery.isLoading
+            ? <EditDeploymentFormSkeleton />
+            : instanceQuery.isError
+              ? <div className="system-sm-regular text-text-tertiary">{t('common.loadFailed')}</div>
+              : app
+                ? (
+                    <EditDeploymentForm
+                      key={formKey}
+                      app={app}
+                      isSaving={updateInstance.isPending}
+                      onClose={handleClose}
+                      onSubmit={handleSubmit}
+                    />
+                  )
+                : <div className="system-sm-regular text-text-tertiary">{t('detail.notFound')}</div>}
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/features/deployments/components/deployment-actions/index.spec.tsx b/web/features/deployments/components/deployment-actions/index.spec.tsx
new file mode 100644
index 00000000000..42229edd338
--- /dev/null
+++ b/web/features/deployments/components/deployment-actions/index.spec.tsx
@@ -0,0 +1,34 @@
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import { DeploymentActionsMenu } from './index'
+
+vi.mock('@langgenius/dify-ui/dropdown-menu', () => import('@/__mocks__/base-ui-dropdown-menu'))
+
+vi.mock('./edit-dialog', () => ({
+  EditDeploymentDialog: () => null,
+}))
+
+vi.mock('./delete-dialog', () => ({
+  DeleteDeploymentDialog: () => null,
+}))
+
+describe('DeploymentActionsMenu', () => {
+  it('keeps the trigger wrapper visible while the menu is open', () => {
+    const { container } = render(
+      <DeploymentActionsMenu
+        appInstanceId="app-instance-1"
+        placement="bottom-end"
+        className="pointer-events-none opacity-0"
+      />,
+    )
+
+    const wrapper = container.querySelector('[role="presentation"]') as HTMLElement
+    expect(wrapper).toHaveClass('pointer-events-none', 'opacity-0')
+
+    fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+
+    expect(screen.getByText('deployments.card.menu.editInfo')).toBeInTheDocument()
+    expect(wrapper).toHaveClass('pointer-events-auto', 'opacity-100')
+    expect(wrapper).not.toHaveClass('pointer-events-none', 'opacity-0')
+  })
+})
diff --git a/web/features/deployments/components/deployment-actions/index.tsx b/web/features/deployments/components/deployment-actions/index.tsx
new file mode 100644
index 00000000000..7db4e6c9db3
--- /dev/null
+++ b/web/features/deployments/components/deployment-actions/index.tsx
@@ -0,0 +1,101 @@
+'use client'
+
+import type { ComponentProps } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { DeleteDeploymentDialog } from './delete-dialog'
+import { EditDeploymentDialog } from './edit-dialog'
+
+const ACTION_TRIGGER_CLASS_NAME = cn(
+  'inline-flex size-8 items-center justify-center rounded-lg bg-components-panel-bg text-text-tertiary shadow-xs outline-hidden',
+  'hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid',
+  'data-popup-open:bg-state-base-hover data-popup-open:text-text-secondary',
+)
+
+type DeploymentActionsMenuProps = {
+  appInstanceId: string
+  appName?: string
+  className?: string
+  triggerClassName?: string
+  placement: ComponentProps<typeof DropdownMenuContent>['placement']
+  sideOffset?: ComponentProps<typeof DropdownMenuContent>['sideOffset']
+}
+
+export function DeploymentActionsMenu({
+  appInstanceId,
+  appName,
+  className,
+  triggerClassName,
+  placement,
+  sideOffset,
+}: DeploymentActionsMenuProps) {
+  const { t } = useTranslation('deployments')
+  const [menuOpen, setMenuOpen] = useState(false)
+  const [editOpen, setEditOpen] = useState(false)
+  const [deleteOpen, setDeleteOpen] = useState(false)
+
+  function openEditDialog() {
+    setMenuOpen(false)
+    setEditOpen(true)
+  }
+
+  function openDeleteDialog() {
+    setMenuOpen(false)
+    setDeleteOpen(true)
+  }
+
+  return (
+    <div
+      role="presentation"
+      className={cn(className, menuOpen && 'pointer-events-auto opacity-100')}
+      onClick={event => event.stopPropagation()}
+      onKeyDown={event => event.stopPropagation()}
+    >
+      <DropdownMenu modal={false} open={menuOpen} onOpenChange={setMenuOpen}>
+        <DropdownMenuTrigger
+          aria-label={t('card.moreActions')}
+          className={cn(ACTION_TRIGGER_CLASS_NAME, triggerClassName)}
+        >
+          <span aria-hidden className="i-ri-more-fill size-4" />
+        </DropdownMenuTrigger>
+        {menuOpen && (
+          <DropdownMenuContent placement={placement} sideOffset={sideOffset} popupClassName="min-w-44">
+            <DropdownMenuItem className="gap-2 px-3" onClick={openEditDialog}>
+              <span aria-hidden className="i-ri-edit-line size-4 shrink-0 text-text-tertiary" />
+              <span className="system-sm-regular text-text-secondary">{t('card.menu.editInfo')}</span>
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem
+              variant="destructive"
+              className="gap-2 px-3"
+              onClick={openDeleteDialog}
+            >
+              <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
+              <span className="system-sm-regular">{t('card.menu.delete')}</span>
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        )}
+      </DropdownMenu>
+
+      <EditDeploymentDialog
+        appInstanceId={appInstanceId}
+        open={editOpen}
+        onOpenChange={setEditOpen}
+      />
+      <DeleteDeploymentDialog
+        appInstanceId={appInstanceId}
+        appName={appName}
+        open={deleteOpen}
+        onOpenChange={setDeleteOpen}
+      />
+    </div>
+  )
+}
diff --git a/web/features/deployments/components/empty-state.tsx b/web/features/deployments/components/empty-state.tsx
new file mode 100644
index 00000000000..fe2fe2d3217
--- /dev/null
+++ b/web/features/deployments/components/empty-state.tsx
@@ -0,0 +1,143 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+
+type DeploymentEmptyStateVariant = 'page' | 'list' | 'section' | 'compact'
+type DeploymentStateMessageVariant = 'page' | 'list' | 'section' | 'compact' | 'embedded'
+type DeploymentEmptyStateAlign = 'center' | 'start'
+
+type DeploymentEmptyStateProps = {
+  icon?: string
+  title: ReactNode
+  description?: ReactNode
+  action?: ReactNode
+  variant?: DeploymentEmptyStateVariant
+  align?: DeploymentEmptyStateAlign
+  className?: string
+}
+
+type DeploymentStateMessageProps = {
+  children: ReactNode
+  variant?: DeploymentStateMessageVariant
+  className?: string
+}
+
+type DeploymentNoticeStateProps = {
+  children: ReactNode
+  icon?: string
+  className?: string
+}
+
+const emptyStateContainerClassNames: Record<DeploymentEmptyStateVariant, string> = {
+  page: 'col-span-full min-h-80 rounded-xl border border-divider-subtle bg-background-default-subtle px-6 py-12',
+  list: 'min-h-60 rounded-lg border border-divider-subtle bg-background-default-subtle px-6 py-12',
+  section: 'min-h-36 rounded-lg border border-divider-subtle bg-background-default-subtle px-6 py-8',
+  compact: 'min-h-14 rounded-lg border border-divider-subtle bg-background-default-subtle px-3 py-3',
+}
+
+const stateMessageClassNames: Record<DeploymentStateMessageVariant, string> = {
+  page: 'col-span-full flex min-h-80 items-center justify-center rounded-xl border border-dashed border-divider-subtle bg-background-default-subtle px-6 py-12 text-center system-sm-regular text-text-tertiary',
+  list: 'flex min-h-36 items-center justify-center rounded-lg border border-dashed border-divider-subtle bg-background-default-subtle px-6 py-12 text-center system-sm-regular text-text-tertiary',
+  section: 'flex min-h-24 items-center justify-center rounded-lg border border-dashed border-divider-subtle bg-background-default-subtle px-4 py-6 text-center system-sm-regular text-text-tertiary',
+  compact: 'rounded-lg border border-dashed border-divider-subtle bg-background-default-subtle px-3 py-3 system-sm-regular text-text-tertiary',
+  embedded: 'px-4 py-10 text-center system-sm-regular text-text-tertiary',
+}
+
+export function DeploymentEmptyState({
+  icon,
+  title,
+  description,
+  action,
+  variant = 'list',
+  align,
+  className,
+}: DeploymentEmptyStateProps) {
+  const effectiveAlign = align ?? (variant === 'compact' ? 'start' : 'center')
+  const isLarge = variant === 'page' || variant === 'list'
+  const hasDescription = Boolean(description)
+  const hasAction = Boolean(action)
+  const hasIcon = Boolean(icon)
+
+  return (
+    <div
+      data-slot="deployment-empty-state"
+      className={cn(
+        'flex flex-col justify-center border-dashed',
+        effectiveAlign === 'center' ? 'items-center text-center' : 'items-start text-left',
+        emptyStateContainerClassNames[variant],
+        className,
+      )}
+    >
+      {hasIcon && (
+        <span
+          className={cn(
+            'flex items-center justify-center border border-components-panel-border bg-background-default-subtle text-text-tertiary',
+            variant === 'compact' ? 'mb-2 size-8 rounded-lg' : 'mb-4',
+            isLarge && 'size-11 rounded-xl',
+            variant === 'section' && 'size-10 rounded-lg bg-background-section-burn',
+          )}
+        >
+          <span
+            className={cn(
+              icon,
+              isLarge ? 'size-5' : variant === 'section' ? 'size-4.5' : 'size-4',
+            )}
+            aria-hidden="true"
+          />
+        </span>
+      )}
+      <div
+        className={cn(
+          isLarge
+            ? 'system-md-semibold text-text-primary'
+            : variant === 'compact' && !hasIcon && !hasDescription
+              ? 'system-sm-regular text-text-tertiary'
+              : 'system-sm-medium text-text-secondary',
+        )}
+      >
+        {title}
+      </div>
+      {hasDescription && (
+        <p
+          className={cn(
+            'mt-1 max-w-120 text-text-tertiary',
+            isLarge ? 'system-sm-regular' : 'system-xs-regular',
+          )}
+        >
+          {description}
+        </p>
+      )}
+      {hasAction && (
+        <div className={isLarge ? 'mt-5' : variant === 'compact' ? 'mt-3' : 'mt-4'}>
+          {action}
+        </div>
+      )}
+    </div>
+  )
+}
+
+export function DeploymentStateMessage({
+  children,
+  variant = 'list',
+  className,
+}: DeploymentStateMessageProps) {
+  return (
+    <div className={cn(stateMessageClassNames[variant], className)}>
+      {children}
+    </div>
+  )
+}
+
+export function DeploymentNoticeState({
+  children,
+  icon = 'i-ri-information-line',
+  className,
+}: DeploymentNoticeStateProps) {
+  return (
+    <div className={cn('flex min-h-9 items-start gap-1.5 rounded-lg border border-divider-subtle bg-background-default-subtle px-3 py-2 system-xs-regular text-text-tertiary', className)}>
+      <span className={cn(icon, 'mt-0.5 size-3.5 shrink-0 text-text-quaternary')} aria-hidden="true" />
+      <span className="min-w-0">{children}</span>
+    </div>
+  )
+}
diff --git a/web/features/deployments/components/env-var-bindings-utils.ts b/web/features/deployments/components/env-var-bindings-utils.ts
new file mode 100644
index 00000000000..422fdfbca5f
--- /dev/null
+++ b/web/features/deployments/components/env-var-bindings-utils.ts
@@ -0,0 +1,29 @@
+import type { EnvVarSlot } from '@dify/contracts/enterprise/types.gen'
+import type { EnvVarBindingSlot } from './env-var-bindings'
+
+export function envVarBindingValueType(valueType?: EnvVarSlot['valueType'] | string): EnvVarBindingSlot['valueType'] {
+  switch (valueType) {
+    case 'ENV_VAR_VALUE_TYPE_NUMBER':
+    case 'number':
+      return 'number'
+    case 'ENV_VAR_VALUE_TYPE_SECRET':
+    case 'secret':
+      return 'secret'
+    default:
+      return 'string'
+  }
+}
+
+export function envVarBindingSlotFromContract(slot: EnvVarSlot): EnvVarBindingSlot | undefined {
+  const key = slot.key.trim()
+  if (!key)
+    return undefined
+
+  return {
+    ...slot,
+    key,
+    valueType: envVarBindingValueType(slot.valueType),
+    hasDefaultValue: slot.defaultValue !== undefined,
+    hasLastValue: slot.lastValue !== undefined,
+  }
+}
diff --git a/web/features/deployments/components/env-var-bindings.tsx b/web/features/deployments/components/env-var-bindings.tsx
new file mode 100644
index 00000000000..714e0c95623
--- /dev/null
+++ b/web/features/deployments/components/env-var-bindings.tsx
@@ -0,0 +1,245 @@
+'use client'
+
+import type { EnvVarInput, EnvVarSlot } from '@dify/contracts/enterprise/types.gen'
+import type {
+  InputHTMLAttributes,
+} from 'react'
+import { EnvVarValueSource as ApiEnvVarValueSource } from '@dify/contracts/enterprise/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Input } from '@langgenius/dify-ui/input'
+import {
+  SegmentedControl,
+  SegmentedControlItem,
+} from '@langgenius/dify-ui/segmented-control'
+import { TitleTooltip } from './title-tooltip'
+
+export type EnvVarValueSource = NonNullable<EnvVarInput['valueSource']>
+type EnvVarValueType = 'string' | 'number' | 'secret'
+// Contract EnvVarSlot carries an EnvVarValueType enum and signals default/last
+// presence via optional fields; binding slots keep the legacy lowercase value
+// type plus explicit has* flags because DSL-metadata slots share this shape.
+// Adapters live in env-var-bindings-utils.ts.
+export type EnvVarBindingSlot = Omit<EnvVarSlot, 'valueType'> & {
+  key: string
+  valueType: EnvVarValueType
+  hasDefaultValue?: boolean
+  hasLastValue?: boolean
+}
+export type EnvVarValueSelection = {
+  valueSource: EnvVarValueSource
+  value?: string
+}
+export type EnvVarValues = Record<string, EnvVarValueSelection>
+type EnvVarDefaultSourcePriority = 'dslDefault' | 'lastDeployment'
+
+type EnvVarValueSourceOption = {
+  value: EnvVarValueSource
+  label: string
+}
+
+type EnvVarBindingsPanelProps = {
+  slots: EnvVarBindingSlot[]
+  values: EnvVarValues
+  title: string
+  hint: string
+  envVarPlaceholder: string
+  literalSourceLabel: string
+  defaultSourceLabel: string
+  lastDeploymentSourceLabel: string
+  valueTypeLabels: Record<EnvVarValueType, string>
+  sourceAriaLabel: (key: string) => string
+  defaultSourcePriority?: EnvVarDefaultSourcePriority
+  envVarCountLabel?: string
+  missingRequiredLabel?: string
+  showMissingRequired?: boolean
+  listScrollable?: boolean
+  onChange: (key: string, value: EnvVarValueSelection) => void
+  className?: string
+  listClassName?: string
+}
+
+const ENV_VAR_INPUT_TYPES = {
+  string: 'text',
+  number: 'number',
+  secret: 'password',
+} satisfies Record<EnvVarValueType, InputHTMLAttributes<HTMLInputElement>['type']>
+
+function envVarInputId(index: number, key: string) {
+  const safeKey = key.replace(/[^\w-]/g, '-')
+
+  return `env-var-binding-${index}-${safeKey}`
+}
+
+function envVarValueSourceOptions(slot: EnvVarBindingSlot, labels: {
+  literal: string
+  defaultValue: string
+  lastDeployment: string
+}): EnvVarValueSourceOption[] {
+  const options: EnvVarValueSourceOption[] = [
+    {
+      value: ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL,
+      label: labels.literal,
+    },
+  ]
+
+  if (slot.hasDefaultValue) {
+    options.push({
+      value: ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT,
+      label: labels.defaultValue,
+    })
+  }
+
+  if (slot.hasLastValue) {
+    options.push({
+      value: ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT,
+      label: labels.lastDeployment,
+    })
+  }
+
+  return options
+}
+
+export function EnvVarBindingsPanel({
+  slots,
+  values,
+  title,
+  hint,
+  envVarPlaceholder,
+  literalSourceLabel,
+  defaultSourceLabel,
+  lastDeploymentSourceLabel,
+  valueTypeLabels,
+  sourceAriaLabel,
+  defaultSourcePriority,
+  envVarCountLabel,
+  missingRequiredLabel,
+  showMissingRequired = false,
+  listScrollable = true,
+  onChange,
+  className,
+  listClassName,
+}: EnvVarBindingsPanelProps) {
+  if (slots.length === 0)
+    return null
+
+  return (
+    <div className={cn('overflow-hidden rounded-xl border border-divider-subtle bg-background-default-subtle', className)}>
+      <div className="flex min-w-0 flex-col gap-0.5 px-3 py-2.5">
+        <div className="flex min-w-0 items-center gap-2">
+          <div className="system-xs-medium-uppercase text-text-tertiary">{title}</div>
+          <span className="shrink-0 rounded-md bg-background-default px-1.5 py-0.5 system-2xs-medium text-text-tertiary">
+            {envVarCountLabel ?? slots.length}
+          </span>
+        </div>
+        <span className="system-xs-regular text-text-tertiary">{hint}</span>
+      </div>
+      <div
+        className={cn(
+          'border-t border-divider-subtle',
+          listScrollable ? 'max-h-[min(360px,34dvh)] overflow-y-auto' : 'overflow-visible',
+          listClassName,
+        )}
+      >
+        {slots.map((slot, index) => {
+          const description = slot.description
+          const inputId = envVarInputId(index, slot.key)
+          const selection = values[slot.key]
+          const defaultValueSource = defaultSourcePriority === 'lastDeployment' && slot.hasLastValue
+            ? ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT
+            : slot.hasDefaultValue
+              ? ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT
+              : slot.hasLastValue
+                ? ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT
+                : ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL
+          const valueSource = selection?.valueSource ?? defaultValueSource
+          const invalidLiteralNumber = slot.valueType === 'number' && Number.isNaN(Number(selection?.value))
+          const missing = showMissingRequired
+            && valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL
+            && (!selection?.value || invalidLiteralNumber)
+          const sourceOptions = envVarValueSourceOptions(slot, {
+            literal: literalSourceLabel,
+            defaultValue: defaultSourceLabel,
+            lastDeployment: lastDeploymentSourceLabel,
+          })
+          const isLiteralValue = valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL
+          const displayValue = valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT
+            ? slot.defaultValue
+            : valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT
+              ? slot.lastValue
+              : selection?.value
+
+          return (
+            <div key={slot.key} className="flex min-w-0 flex-col gap-2 border-b border-divider-subtle px-3 py-3 last:border-b-0">
+              <div className="flex min-w-0 flex-col gap-2.5">
+                <div className="flex min-w-0 flex-wrap items-center justify-between gap-2">
+                  <div className="flex min-w-0 items-center gap-1.5">
+                    <span aria-hidden="true" className="i-custom-vender-line-others-env size-4 shrink-0 text-util-colors-violet-violet-600" />
+                    <TitleTooltip content={slot.key}>
+                      <label className="truncate font-mono system-sm-semibold text-text-primary" htmlFor={inputId}>
+                        {slot.key}
+                      </label>
+                    </TitleTooltip>
+                    <span className="shrink-0 system-sm-medium text-text-tertiary">
+                      {valueTypeLabels[slot.valueType]}
+                    </span>
+                    {slot.valueType === 'secret' && (
+                      <span aria-hidden="true" className="i-ri-lock-2-line size-3 shrink-0 text-text-tertiary" />
+                    )}
+                  </div>
+                  {sourceOptions.length > 1 && (
+                    <SegmentedControl<EnvVarValueSource>
+                      aria-label={sourceAriaLabel(slot.key)}
+                      value={[valueSource]}
+                      onValueChange={(value) => {
+                        const nextSource = value[0]
+                        if (!nextSource)
+                          return
+                        onChange(slot.key, {
+                          value: selection?.value,
+                          valueSource: nextSource,
+                        })
+                      }}
+                      className="shrink-0"
+                    >
+                      {sourceOptions.map(option => (
+                        <SegmentedControlItem key={option.value} value={option.value} className="px-2 system-xs-medium">
+                          {option.label}
+                        </SegmentedControlItem>
+                      ))}
+                    </SegmentedControl>
+                  )}
+                </div>
+                {description && (
+                  <TitleTooltip content={description}>
+                    <div className="line-clamp-2 system-xs-regular text-text-tertiary">
+                      {description}
+                    </div>
+                  </TitleTooltip>
+                )}
+                <Input
+                  id={inputId}
+                  type={ENV_VAR_INPUT_TYPES[slot.valueType]}
+                  value={displayValue ?? ''}
+                  onChange={event => onChange(slot.key, {
+                    value: event.target.value,
+                    valueSource: ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL,
+                  })}
+                  placeholder={envVarPlaceholder}
+                  autoComplete="off"
+                  disabled={!isLiteralValue}
+                  required
+                  className="h-8"
+                />
+              </div>
+              {missing && missingRequiredLabel && (
+                <div className="system-xs-regular text-text-destructive">
+                  {missingRequiredLabel}
+                </div>
+              )}
+            </div>
+          )
+        })}
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/deployments/components/runtime-credential-bindings-utils.ts b/web/features/deployments/components/runtime-credential-bindings-utils.ts
new file mode 100644
index 00000000000..d80dc0b53c9
--- /dev/null
+++ b/web/features/deployments/components/runtime-credential-bindings-utils.ts
@@ -0,0 +1,115 @@
+import type {
+  CredentialCandidate,
+  CredentialSelectionInput,
+  CredentialSlot,
+} from '@dify/contracts/enterprise/types.gen'
+
+export type RuntimeCredentialBindingSelections = Record<string, string>
+
+export type RuntimeCredentialSelectOption = {
+  value: string
+  label: string
+}
+
+const PROVIDER_DISPLAY_NAMES: Record<string, string> = {
+  azure_openai: 'Azure OpenAI',
+  bedrock: 'Amazon Bedrock',
+  gemini: 'Gemini',
+  google: 'Google',
+  openai: 'OpenAI',
+  vertex_ai: 'Vertex AI',
+  volcengine_maas: 'Volcengine',
+}
+
+function providerSlug(providerId: string) {
+  const parts = providerId.split('/').filter(Boolean)
+  return parts[parts.length - 1]
+}
+
+function titleCaseProviderName(value: string) {
+  return value
+    .split(/[-_]/)
+    .filter(Boolean)
+    .map(part => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
+    .join(' ')
+}
+
+export function runtimeCredentialSlotKey(slot: CredentialSlot) {
+  return [slot.providerId, slot.category].join(':')
+}
+
+export function runtimeCredentialProviderName(providerId: string) {
+  const slug = providerSlug(providerId)
+  if (!slug)
+    return undefined
+
+  return PROVIDER_DISPLAY_NAMES[slug.toLowerCase()] ?? titleCaseProviderName(slug)
+}
+
+function runtimeCredentialCandidateLabel(candidate: CredentialCandidate) {
+  const fallback = candidate.credentialId
+  const rawLabel = candidate.displayName.trim() || fallback
+  const providerId = candidate.providerId.trim()
+
+  const providerSuffixes = [
+    ` · ${providerId}`,
+    ` - ${providerId}`,
+    ` (${providerId})`,
+  ]
+  const label = providerSuffixes.reduce((nextLabel, suffix) => {
+    return nextLabel.endsWith(suffix)
+      ? nextLabel.slice(0, -suffix.length).trim()
+      : nextLabel
+  }, rawLabel)
+
+  return label || fallback
+}
+
+export function runtimeCredentialCandidateOptions(slot: CredentialSlot): RuntimeCredentialSelectOption[] {
+  return slot.candidates.map(candidate => ({
+    value: candidate.credentialId,
+    label: runtimeCredentialCandidateLabel(candidate),
+  }))
+}
+
+export function hasMissingRequiredRuntimeCredentialBinding(_slot: CredentialSlot, selectedValue?: string) {
+  return !selectedValue
+}
+
+export function selectedRuntimeCredentialSelections(
+  slots: CredentialSlot[],
+  manualBindings: RuntimeCredentialBindingSelections,
+): RuntimeCredentialBindingSelections {
+  const next: RuntimeCredentialBindingSelections = {}
+  for (const slot of slots) {
+    const slotKey = runtimeCredentialSlotKey(slot)
+    const candidates = runtimeCredentialCandidateOptions(slot)
+    const existing = manualBindings[slotKey]
+    if (existing && candidates.some(candidate => candidate.value === existing))
+      next[slotKey] = existing
+    else if (slot.lastCredentialId && candidates.some(candidate => candidate.value === slot.lastCredentialId))
+      next[slotKey] = slot.lastCredentialId
+    else if (candidates.length === 1 && candidates[0])
+      next[slotKey] = candidates[0].value
+  }
+  return next
+}
+
+export function selectedDeploymentRuntimeCredentials(
+  slots: CredentialSlot[],
+  selections: RuntimeCredentialBindingSelections,
+): CredentialSelectionInput[] {
+  return slots
+    .flatMap((slot): CredentialSelectionInput[] => {
+      const slotKey = runtimeCredentialSlotKey(slot)
+      const selectedValue = selections[slotKey]
+      if (!selectedValue)
+        return []
+
+      return [{
+        providerId: slot.providerId,
+        category: slot.category,
+        credentialId: selectedValue,
+      }]
+    })
+}
diff --git a/web/features/deployments/components/runtime-credential-bindings.tsx b/web/features/deployments/components/runtime-credential-bindings.tsx
new file mode 100644
index 00000000000..13e50eaf89e
--- /dev/null
+++ b/web/features/deployments/components/runtime-credential-bindings.tsx
@@ -0,0 +1,197 @@
+'use client'
+
+import type {
+  CredentialSlot,
+} from '@dify/contracts/enterprise/types.gen'
+import type {
+  RuntimeCredentialBindingSelections,
+  RuntimeCredentialSelectOption,
+} from './runtime-credential-bindings-utils'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectItemIndicator,
+  SelectItemText,
+  SelectTrigger,
+} from '@langgenius/dify-ui/select'
+import { useTranslation } from 'react-i18next'
+import {
+  hasMissingRequiredRuntimeCredentialBinding,
+  runtimeCredentialCandidateOptions,
+  runtimeCredentialProviderName,
+  runtimeCredentialSlotKey,
+} from './runtime-credential-bindings-utils'
+import { TitleTooltip } from './title-tooltip'
+
+type RuntimeCredentialBindingsPanelProps = {
+  slots: CredentialSlot[]
+  selections: RuntimeCredentialBindingSelections
+  title: string
+  hint: string
+  noBindingRequiredLabel: string
+  noCredentialCandidatesLabel: string
+  selectCredentialLabel: string
+  missingRequiredLabel: string
+  bindingCountLabel?: string
+  showMissingRequired?: boolean
+  listScrollable?: boolean
+  onChange: (slotKey: string, value: string) => void
+  className?: string
+  listClassName?: string
+}
+
+function RuntimeCredentialSelect({
+  ariaLabel,
+  value,
+  options,
+  placeholder,
+  onChange,
+}: {
+  ariaLabel: string
+  value?: string
+  options: RuntimeCredentialSelectOption[]
+  placeholder: string
+  onChange: (value: string) => void
+}) {
+  const selectedOption = options.find(option => option.value === value)
+
+  return (
+    <Select
+      value={value ?? null}
+      onValueChange={(next) => {
+        if (!next)
+          return
+        onChange(next)
+      }}
+      disabled={options.length === 0}
+    >
+      <SelectTrigger
+        aria-label={ariaLabel}
+        className={cn(
+          'h-8 min-w-0 px-2 text-left system-sm-medium',
+          !selectedOption && 'text-text-quaternary',
+        )}
+      >
+        {selectedOption?.label ?? placeholder}
+      </SelectTrigger>
+      <SelectContent popupClassName="w-(--anchor-width)">
+        {options.map(option => (
+          <SelectItem key={option.value} value={option.value}>
+            <TitleTooltip content={option.label}>
+              <SelectItemText>{option.label}</SelectItemText>
+            </TitleTooltip>
+            <SelectItemIndicator />
+          </SelectItem>
+        ))}
+      </SelectContent>
+    </Select>
+  )
+}
+
+export function RuntimeCredentialBindingsPanel({
+  slots,
+  selections,
+  title,
+  hint,
+  noBindingRequiredLabel,
+  noCredentialCandidatesLabel,
+  selectCredentialLabel,
+  missingRequiredLabel,
+  bindingCountLabel,
+  showMissingRequired = false,
+  listScrollable = true,
+  onChange,
+  className,
+  listClassName,
+}: RuntimeCredentialBindingsPanelProps) {
+  const { t } = useTranslation('plugin')
+
+  return (
+    <div className={cn('overflow-hidden rounded-xl border border-divider-subtle bg-background-default-subtle', className)}>
+      <div className="flex min-w-0 flex-col gap-0.5 px-3 py-2.5">
+        <div className="flex min-w-0 items-center gap-2">
+          <div className="system-xs-medium-uppercase text-text-tertiary">{title}</div>
+          {slots.length > 0 && (
+            <span className="shrink-0 rounded-md bg-background-default px-1.5 py-0.5 system-2xs-medium text-text-tertiary">
+              {bindingCountLabel ?? slots.length}
+            </span>
+          )}
+        </div>
+        <span className="system-xs-regular text-text-tertiary">{hint}</span>
+      </div>
+      {slots.length === 0
+        ? (
+            <div className="border-t border-divider-subtle px-3 py-3 system-sm-regular text-text-quaternary">
+              {noBindingRequiredLabel}
+            </div>
+          )
+        : (
+            <div
+              className={cn(
+                'border-t border-divider-subtle',
+                listScrollable ? 'max-h-[min(360px,34dvh)] overflow-y-auto' : 'overflow-visible',
+                listClassName,
+              )}
+            >
+              {slots.map((slot) => {
+                const slotKey = runtimeCredentialSlotKey(slot)
+                const candidates = runtimeCredentialCandidateOptions(slot)
+                const selectedValue = selections[slotKey]
+                const missing = showMissingRequired && hasMissingRequiredRuntimeCredentialBinding(slot, selectedValue)
+                const slotName = runtimeCredentialProviderName(slot.providerId) ?? slotKey
+                const categoryLabel = slot.category === 'PLUGIN_CATEGORY_MODEL'
+                  ? t('categorySingle.model')
+                  : slot.category === 'PLUGIN_CATEGORY_TOOL'
+                    ? t('categorySingle.tool')
+                    : undefined
+
+                return (
+                  <div key={slotKey} className="flex flex-col gap-2 border-b border-divider-subtle px-3 py-3 last:border-b-0">
+                    <div className="flex min-w-0 flex-col gap-2.5">
+                      <div className="flex min-w-0 flex-col gap-1.5">
+                        <div className="flex min-w-0 items-center gap-1.5">
+                          <TitleTooltip content={slotName}>
+                            <span className="truncate system-sm-semibold text-text-primary">
+                              {slotName}
+                            </span>
+                          </TitleTooltip>
+                        </div>
+                        <div className="flex flex-wrap items-center gap-1.5">
+                          {categoryLabel && (
+                            <span className="shrink-0 rounded-md bg-util-colors-blue-light-blue-light-50 px-1.5 py-0.5 system-2xs-medium-uppercase text-util-colors-blue-blue-600">
+                              {categoryLabel}
+                            </span>
+                          )}
+                        </div>
+                      </div>
+                      {candidates.length === 0
+                        ? (
+                            <div className="rounded-lg border border-divider-subtle bg-background-default px-2 py-1.5 system-sm-regular text-text-quaternary">
+                              {noCredentialCandidatesLabel}
+                            </div>
+                          )
+                        : (
+                            <RuntimeCredentialSelect
+                              ariaLabel={slotName}
+                              value={selectedValue}
+                              onChange={value => onChange(slotKey, value)}
+                              options={candidates}
+                              placeholder={selectCredentialLabel}
+                            />
+                          )}
+                    </div>
+                    {missing && (
+                      <div className="system-xs-regular text-text-destructive">
+                        {missingRequiredLabel}
+                      </div>
+                    )}
+                  </div>
+                )
+              })}
+            </div>
+          )}
+    </div>
+  )
+}
diff --git a/web/features/deployments/components/title-tooltip.spec.tsx b/web/features/deployments/components/title-tooltip.spec.tsx
new file mode 100644
index 00000000000..ccf92313079
--- /dev/null
+++ b/web/features/deployments/components/title-tooltip.spec.tsx
@@ -0,0 +1,71 @@
+import type { ReactNode } from 'react'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import { TitleTooltip } from './title-tooltip'
+
+vi.mock('@langgenius/dify-ui/tooltip', () => ({
+  Tooltip: ({ children }: { children: ReactNode }) => (
+    <div data-testid="tooltip">
+      {children}
+    </div>
+  ),
+  TooltipTrigger: ({ render }: { render: ReactNode }) => <>{render}</>,
+  TooltipContent: ({ children }: { children: ReactNode }) => (
+    <div role="tooltip">
+      {children}
+    </div>
+  ),
+}))
+
+function setElementSize(element: HTMLElement, {
+  clientWidth,
+  scrollWidth,
+}: {
+  clientWidth: number
+  scrollWidth: number
+}) {
+  Object.defineProperties(element, {
+    clientWidth: { configurable: true, value: clientWidth },
+    scrollWidth: { configurable: true, value: scrollWidth },
+  })
+}
+
+describe('TitleTooltip', () => {
+  it('does not show duplicate content when the trigger is not truncated', () => {
+    render(
+      <TitleTooltip content="11">
+        <p>11</p>
+      </TitleTooltip>,
+    )
+
+    fireEvent.pointerOver(screen.getByText('11'))
+
+    expect(screen.queryByRole('tooltip')).not.toBeInTheDocument()
+  })
+
+  it('shows duplicate content when the trigger is truncated', () => {
+    render(
+      <TitleTooltip content="Long deployment name">
+        <p>Long deployment name</p>
+      </TitleTooltip>,
+    )
+
+    const trigger = screen.getByText('Long deployment name')
+    setElementSize(trigger, { clientWidth: 80, scrollWidth: 160 })
+    fireEvent.pointerOver(trigger)
+
+    expect(screen.getByRole('tooltip')).toHaveTextContent('Long deployment name')
+  })
+
+  it('shows content that adds information beyond the trigger text', () => {
+    render(
+      <TitleTooltip content="Disabled until an initial release exists">
+        <button type="button">Deploy</button>
+      </TitleTooltip>,
+    )
+
+    fireEvent.pointerOver(screen.getByRole('button', { name: 'Deploy' }))
+
+    expect(screen.getByRole('tooltip')).toHaveTextContent('Disabled until an initial release exists')
+  })
+})
diff --git a/web/features/deployments/components/title-tooltip.tsx b/web/features/deployments/components/title-tooltip.tsx
new file mode 100644
index 00000000000..f10f2708b27
--- /dev/null
+++ b/web/features/deployments/components/title-tooltip.tsx
@@ -0,0 +1,74 @@
+'use client'
+
+import type { FocusEvent, PointerEvent, ReactElement, ReactNode } from 'react'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
+import { cloneElement, useState } from 'react'
+
+type TriggerProps = {
+  onFocusCapture?: (event: FocusEvent<HTMLElement>) => void
+  onPointerOverCapture?: (event: PointerEvent<HTMLElement>) => void
+}
+
+function normalizeText(value: string) {
+  return value.replace(/\s+/g, ' ').trim()
+}
+
+function contentText(content: ReactNode) {
+  if (typeof content === 'string' || typeof content === 'number')
+    return String(content)
+}
+
+function isOverflowing(element: HTMLElement) {
+  return element.scrollWidth > element.clientWidth || element.scrollHeight > element.clientHeight
+}
+
+function shouldShowTooltipContent(element: HTMLElement, content: ReactNode) {
+  const text = contentText(content)
+  if (text === undefined)
+    return true
+
+  if (normalizeText(text) !== normalizeText(element.textContent ?? ''))
+    return true
+
+  return isOverflowing(element)
+}
+
+export function TitleTooltip({
+  children,
+  content,
+}: {
+  children: ReactElement
+  content?: ReactNode
+}) {
+  const [shouldShowContent, setShouldShowContent] = useState(false)
+
+  if (!content)
+    return children
+
+  const childProps = children.props as TriggerProps
+
+  function updateShouldShowContent(element: HTMLElement) {
+    setShouldShowContent(shouldShowTooltipContent(element, content))
+  }
+
+  // eslint-disable-next-line react/no-clone-element -- Preserve the trigger element while adding overflow checks.
+  const trigger = cloneElement(children as ReactElement<TriggerProps>, {
+    onFocusCapture: (event) => {
+      childProps.onFocusCapture?.(event)
+      updateShouldShowContent(event.currentTarget)
+    },
+    onPointerOverCapture: (event) => {
+      childProps.onPointerOverCapture?.(event)
+      updateShouldShowContent(event.currentTarget)
+    },
+  })
+
+  return (
+    <Tooltip>
+      <TooltipTrigger render={trigger} />
+      {shouldShowContent && (
+        <TooltipContent>{content}</TooltipContent>
+      )}
+    </Tooltip>
+  )
+}
diff --git a/web/features/deployments/components/unsupported-dsl-nodes-alert.tsx b/web/features/deployments/components/unsupported-dsl-nodes-alert.tsx
new file mode 100644
index 00000000000..f252586ce64
--- /dev/null
+++ b/web/features/deployments/components/unsupported-dsl-nodes-alert.tsx
@@ -0,0 +1,69 @@
+'use client'
+
+import type { UnsupportedDslNode } from '../shared/domain/error'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+
+function translatedNodeType(type: string | undefined, t: ReturnType<typeof useTranslation>['t']) {
+  if (!type)
+    return t('unsupportedDslNodes.unknownType')
+
+  return t(`blocks.${type}`, {
+    defaultValue: type,
+    ns: 'workflow',
+  })
+}
+
+function unsupportedNodeTypeLabels(nodes: UnsupportedDslNode[], t: ReturnType<typeof useTranslation>['t']) {
+  return Array.from(new Set(nodes.map(node => translatedNodeType(node.type, t))))
+}
+
+function formattedNodeTypeList(labels: string[], language: string) {
+  if (labels.length === 0)
+    return ''
+
+  try {
+    return new Intl.ListFormat(language, { type: 'conjunction' }).format(labels)
+  }
+  catch {
+    return labels.join(', ')
+  }
+}
+
+export function UnsupportedDslNodesAlert({ nodes, className }: {
+  nodes: UnsupportedDslNode[]
+  className?: string
+}) {
+  const { i18n, t } = useTranslation('deployments')
+
+  if (nodes.length === 0)
+    return null
+
+  const nodeTypeLabels = unsupportedNodeTypeLabels(nodes, t)
+  const nodeTypes = formattedNodeTypeList(nodeTypeLabels, i18n.language)
+  const description = nodeTypes
+    ? t('unsupportedDslNodes.descriptionWithTypes', { nodeTypes })
+    : t('unsupportedDslNodes.description')
+
+  return (
+    <div
+      role="alert"
+      className={cn(
+        'rounded-lg border border-util-colors-red-red-200 bg-util-colors-red-red-50 p-3',
+        className,
+      )}
+    >
+      <div className="flex items-start gap-2">
+        <span aria-hidden className="mt-0.5 i-ri-error-warning-fill size-4 shrink-0 text-text-destructive" />
+        <div className="min-w-0 grow">
+          <div className="system-sm-semibold text-text-primary">
+            {t('unsupportedDslNodes.title')}
+          </div>
+          <p className="mt-0.5 system-xs-regular text-text-secondary">
+            {description}
+          </p>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/deployments/create-guide/index.tsx b/web/features/deployments/create-guide/index.tsx
new file mode 100644
index 00000000000..a1f71716c91
--- /dev/null
+++ b/web/features/deployments/create-guide/index.tsx
@@ -0,0 +1,35 @@
+'use client'
+
+import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
+import { useTranslation } from 'react-i18next'
+import Link from '@/next/link'
+import { useRouter } from '@/next/navigation'
+import { CreateDeploymentGuideProvider } from './state/provider'
+import { CreateDeploymentGuideShell } from './ui/shell'
+
+export function CreateDeploymentGuide() {
+  const { t } = useTranslation('deployments')
+  const router = useRouter()
+
+  return (
+    <Dialog open onOpenChange={open => !open && router.push('/deployments')}>
+      <DialogContent
+        backdropClassName="bg-background-overlay-backdrop backdrop-blur-[6px]"
+        className="top-4 bottom-4 h-auto max-h-none w-[min(calc(100vw-2rem),1120px)] max-w-none translate-y-0 overflow-hidden border-effects-highlight bg-background-default-subtle p-0"
+      >
+        <div className="relative flex h-full min-w-0 grow flex-col overflow-hidden">
+          <Link
+            href="/deployments"
+            aria-label={t('createGuide.nav.back')}
+            className="absolute top-3 right-3 z-50 flex h-9 w-9 cursor-pointer items-center justify-center rounded-[10px] bg-components-button-tertiary-bg hover:bg-components-button-tertiary-bg-hover"
+          >
+            <span aria-hidden="true" className="i-ri-close-large-line h-3.5 w-3.5 text-components-button-tertiary-text" />
+          </Link>
+          <CreateDeploymentGuideProvider>
+            <CreateDeploymentGuideShell />
+          </CreateDeploymentGuideProvider>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/features/deployments/create-guide/state/environment.ts b/web/features/deployments/create-guide/state/environment.ts
new file mode 100644
index 00000000000..9d7e27cb144
--- /dev/null
+++ b/web/features/deployments/create-guide/state/environment.ts
@@ -0,0 +1,9 @@
+import type { Environment } from '@dify/contracts/enterprise/types.gen'
+
+export function environmentMatchesIdentifier(environment: Environment, identifier: string) {
+  const normalizedIdentifier = identifier.trim()
+  if (!normalizedIdentifier)
+    return false
+
+  return environment.id === normalizedIdentifier || environment.displayName === normalizedIdentifier
+}
diff --git a/web/features/deployments/create-guide/state/index.ts b/web/features/deployments/create-guide/state/index.ts
new file mode 100644
index 00000000000..06dab290172
--- /dev/null
+++ b/web/features/deployments/create-guide/state/index.ts
@@ -0,0 +1,920 @@
+'use client'
+
+import type {
+  DeployRequest,
+  EnvVarInput,
+} from '@dify/contracts/enterprise/types.gen'
+import type { Getter } from 'jotai/vanilla'
+import type { EnvVarBindingSlot, EnvVarValues, EnvVarValueSelection } from '@/features/deployments/components/env-var-bindings'
+import type { RuntimeCredentialBindingSelections } from '@/features/deployments/components/runtime-credential-bindings-utils'
+import type { UnsupportedDslNode } from '@/features/deployments/shared/domain/error'
+import type { App } from '@/types/app'
+import { EnvVarValueSource as ApiEnvVarValueSource } from '@dify/contracts/enterprise/types.gen'
+import { keepPreviousData } from '@tanstack/react-query'
+import { atom } from 'jotai'
+import { atomWithInfiniteQuery, atomWithMutation, atomWithQuery } from 'jotai-tanstack-query'
+import { envVarBindingSlotFromContract, envVarBindingValueType } from '@/features/deployments/components/env-var-bindings-utils'
+import {
+  hasMissingRequiredRuntimeCredentialBinding,
+  runtimeCredentialSlotKey,
+  selectedDeploymentRuntimeCredentials,
+  selectedRuntimeCredentialSelections,
+} from '@/features/deployments/components/runtime-credential-bindings-utils'
+import {
+  dslAppName,
+  dslEnvVarSlots,
+  encodeDslContent,
+  isWorkflowDsl,
+} from '@/features/deployments/shared/domain/dsl'
+import { unsupportedDslNodeError } from '@/features/deployments/shared/domain/error'
+import { createDeploymentIdempotencyKey } from '@/features/deployments/shared/domain/idempotency'
+import {
+  DEPLOYMENT_PAGE_SIZE,
+  getNextPageParamFromPagination,
+  SOURCE_APPS_PAGE_SIZE,
+} from '@/features/deployments/shared/domain/pagination'
+import { consoleQuery } from '@/service/client'
+import { AppModeEnum } from '@/types/app'
+import { environmentMatchesIdentifier } from './environment'
+
+export type GuideMethod = 'bindApp' | 'importDsl'
+export type GuideStep = 'source' | 'release' | 'target'
+export type WorkflowSourceApp = App & { mode: Extract<AppModeEnum, 'workflow'> }
+
+const RANDOM_SUFFIX_ALPHABET = 'abcdefghijklmnopqrstuvwxyz'
+const RANDOM_SUFFIX_LENGTH = 4
+const RANDOM_SUFFIX_FALLBACK_LENGTH = 6
+const RANDOM_SUFFIX_MAX_ATTEMPTS = 16
+
+function randomLetterCombination(length: number) {
+  const randomValues = new Uint8Array(length)
+
+  if (globalThis.crypto) {
+    globalThis.crypto.getRandomValues(randomValues)
+  }
+  else {
+    randomValues.forEach((_, index) => {
+      randomValues[index] = Math.floor(Math.random() * 256)
+    })
+  }
+
+  return Array.from(randomValues, value => RANDOM_SUFFIX_ALPHABET[value % RANDOM_SUFFIX_ALPHABET.length]).join('')
+}
+
+function availableInstanceName(sourceName: string, existingNameSet: Set<string>) {
+  if (!existingNameSet.has(sourceName))
+    return sourceName
+
+  for (let attempt = 0; attempt < RANDOM_SUFFIX_MAX_ATTEMPTS; attempt++) {
+    const candidate = `${sourceName}-${randomLetterCombination(RANDOM_SUFFIX_LENGTH)}`
+    if (!existingNameSet.has(candidate))
+      return candidate
+  }
+
+  return `${sourceName}-${randomLetterCombination(RANDOM_SUFFIX_FALLBACK_LENGTH)}`
+}
+
+function envVarValueSource(slot: EnvVarBindingSlot, selection: EnvVarValueSelection | undefined) {
+  return selection?.valueSource
+    ?? (slot.hasDefaultValue
+      ? ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT
+      : slot.hasLastValue
+        ? ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT
+        : ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL)
+}
+
+function envVarSelectionReady(slot: EnvVarBindingSlot, selection: EnvVarValueSelection | undefined) {
+  const valueSource = envVarValueSource(slot, selection)
+
+  if (valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT)
+    return Boolean(slot.hasLastValue)
+  if (valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT)
+    return Boolean(slot.hasDefaultValue)
+  if (!selection?.value)
+    return false
+
+  return slot.valueType !== 'number' || !Number.isNaN(Number(selection.value))
+}
+
+function envVarInput(slot: EnvVarBindingSlot, selection: EnvVarValueSelection | undefined): EnvVarInput[] {
+  const valueSource = envVarValueSource(slot, selection)
+
+  if (valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT) {
+    return slot.hasLastValue
+      ? [{ key: slot.key, valueSource }]
+      : []
+  }
+
+  if (valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT) {
+    return slot.hasDefaultValue
+      ? [{ key: slot.key, valueSource }]
+      : []
+  }
+
+  if (!selection?.value || (slot.valueType === 'number' && Number.isNaN(Number(selection.value))))
+    return []
+
+  return [{
+    key: slot.key,
+    value: selection.value,
+    valueSource,
+  }]
+}
+
+// Workflow primitives
+export const stepAtom = atom<GuideStep>('source')
+export const methodAtom = atom<GuideMethod>('bindApp')
+
+// Source primitives
+export const sourceSearchTextAtom = atom('')
+export const selectedAppAtom = atom<WorkflowSourceApp | undefined>(undefined)
+
+// DSL primitives and derived state
+export const dslFileAtom = atom<File | undefined>(undefined)
+const dslContentAtom = atom('')
+export const isReadingDslAtom = atom(false)
+export const dslReadErrorAtom = atom(false)
+const dslReadTokenAtom = atom(0)
+
+export const dslDefaultAppNameAtom = atom((get) => {
+  const dslContent = get(dslContentAtom)
+
+  return dslContent ? dslAppName(dslContent) : ''
+})
+
+export const dslUnsupportedModeAtom = atom((get) => {
+  const dslContent = get(dslContentAtom)
+
+  return get(methodAtom) === 'importDsl'
+    && Boolean(dslContent.trim())
+    && !get(isReadingDslAtom)
+    && !get(dslReadErrorAtom)
+    && !isWorkflowDsl(dslContent)
+})
+
+const importDslReadyAtom = atom((get) => {
+  return Boolean(get(dslContentAtom).trim())
+    && !get(isReadingDslAtom)
+    && !get(dslReadErrorAtom)
+    && !get(dslUnsupportedModeAtom)
+})
+
+// Release primitives
+export const instanceNameAtom = atom('')
+export const instanceDescriptionAtom = atom('')
+export const releaseNameAtom = atom('')
+export const releaseDescriptionAtom = atom('')
+const autoFilledInstanceNameAtom = atom('')
+const autoFilledReleaseNameAtom = atom('')
+
+// Target primitives
+export const selectedEnvironmentIdAtom = atom('')
+const manualBindingSelectionsAtom = atom<RuntimeCredentialBindingSelections>({})
+export const envVarValuesAtom = atom<EnvVarValues>({})
+
+// Submission primitives
+const submissionUnsupportedDslNodesAtom = atom<UnsupportedDslNode[]>([])
+const isCreatingDeploymentAtom = atom(false)
+export const isCreatingReleaseOnlyAtom = atom(false)
+
+export const isSubmittingDeploymentGuideAtom = atom(get => (
+  get(isCreatingDeploymentAtom) || get(isCreatingReleaseOnlyAtom)
+))
+
+// Query and remote data
+export const sourceAppsQueryAtom = atomWithInfiniteQuery((get) => {
+  const sourceSearchText = get(sourceSearchTextAtom)
+
+  return {
+    ...consoleQuery.apps.list.infiniteOptions({
+      input: pageParam => ({
+        query: {
+          page: Number(pageParam),
+          limit: SOURCE_APPS_PAGE_SIZE,
+          name: sourceSearchText,
+          mode: AppModeEnum.WORKFLOW,
+        },
+      }),
+      getNextPageParam: lastPage => lastPage.has_more ? lastPage.page + 1 : undefined,
+      initialPageParam: 1,
+      placeholderData: keepPreviousData,
+    }),
+    enabled: get(methodAtom) === 'bindApp',
+  }
+})
+
+export const effectiveSelectedAppAtom = atom((get) => {
+  const selectedApp = get(selectedAppAtom)
+  if (selectedApp)
+    return selectedApp
+
+  const sourceAppsQuery = get(sourceAppsQueryAtom)
+  if (sourceAppsQuery.isPlaceholderData)
+    return undefined
+
+  const sourceApps = (sourceAppsQuery.data?.pages.flatMap(page => page.data) ?? []) as WorkflowSourceApp[]
+
+  return sourceApps[0]
+})
+
+function sourceReady(get: Getter) {
+  const method = get(methodAtom)
+
+  return method === 'importDsl'
+    ? get(importDslReadyAtom)
+    : Boolean(get(effectiveSelectedAppAtom)?.id)
+}
+
+const existingInstanceNamesQueryAtom = atomWithInfiniteQuery(() => ({
+  ...consoleQuery.enterprise.appInstanceService.listAppInstances.infiniteOptions({
+    input: pageParam => ({
+      query: {
+        pageNumber: Number(pageParam),
+        resultsPerPage: DEPLOYMENT_PAGE_SIZE,
+      },
+    }),
+    getNextPageParam: lastPage => getNextPageParamFromPagination(lastPage.pagination),
+    initialPageParam: 1,
+  }),
+  placeholderData: keepPreviousData,
+}))
+
+const instanceNameConflictQueryAtom = atomWithQuery((get) => {
+  const submittedInstanceName = get(instanceNameAtom).trim()
+
+  return consoleQuery.enterprise.appInstanceService.listAppInstances.queryOptions({
+    input: {
+      query: {
+        pageNumber: 1,
+        resultsPerPage: 1,
+        displayName: submittedInstanceName,
+      },
+    },
+    enabled: Boolean(submittedInstanceName),
+  })
+})
+
+export const deployableEnvironmentsQueryAtom = atomWithQuery((get) => {
+  return consoleQuery.enterprise.environmentService.listEnvironments.queryOptions({
+    input: {
+      query: {
+        // The guide offers every deployable environment at once; environment
+        // count is capped well below the 100-per-page maximum.
+        pageNumber: 1,
+        resultsPerPage: 100,
+      },
+    },
+    enabled: sourceReady(get),
+  })
+})
+
+const precheckReleaseQueryAtom = atomWithQuery((get) => {
+  const method = get(methodAtom)
+  const effectiveSelectedApp = get(effectiveSelectedAppAtom)
+  const dslContent = get(dslContentAtom)
+  const enabled = sourceReady(get)
+
+  // PrecheckRelease takes exactly one source arm (dsl | sourceAppId).
+  const precheckReleaseQueryOptions = method === 'importDsl'
+    ? consoleQuery.enterprise.releaseService.precheckRelease.queryOptions({
+        input: {
+          body: {
+            dsl: dslContent.trim() ? encodeDslContent(dslContent) : '',
+          },
+        },
+        enabled,
+      })
+    : consoleQuery.enterprise.releaseService.precheckRelease.queryOptions({
+        input: {
+          body: {
+            sourceAppId: effectiveSelectedApp?.id ?? '',
+          },
+        },
+        enabled: enabled && Boolean(effectiveSelectedApp?.id),
+      })
+
+  return {
+    ...precheckReleaseQueryOptions,
+    retry: false,
+  }
+})
+
+function precheckReleaseReady(get: Getter) {
+  const precheckReleaseQuery = get(precheckReleaseQueryAtom)
+
+  return sourceReady(get)
+    && precheckReleaseQuery.isSuccess
+    && Boolean(precheckReleaseQuery.data?.canCreate)
+    && (precheckReleaseQuery.data?.unsupportedNodes.length ?? 0) === 0
+    && get(submissionUnsupportedDslNodesAtom).length === 0
+}
+
+export const deploymentOptionsQueryAtom = atomWithQuery((get) => {
+  const method = get(methodAtom)
+  const effectiveSelectedApp = get(effectiveSelectedAppAtom)
+  const dslContent = get(dslContentAtom)
+  const enabled = precheckReleaseReady(get)
+
+  // ComputeDeploymentOptions takes exactly one source arm (dsl | sourceAppId | releaseId).
+  const deploymentOptionsQueryOptions = method === 'importDsl'
+    ? consoleQuery.enterprise.releaseService.computeDeploymentOptions.queryOptions({
+        input: {
+          body: {
+            dsl: dslContent.trim() ? encodeDslContent(dslContent) : '',
+          },
+        },
+        enabled,
+      })
+    : consoleQuery.enterprise.releaseService.computeDeploymentOptions.queryOptions({
+        input: {
+          body: {
+            sourceAppId: effectiveSelectedApp?.id ?? '',
+          },
+        },
+        enabled: enabled && Boolean(effectiveSelectedApp?.id),
+      })
+
+  // oRPC encodes input before TanStack can skip work, so keep a valid input shape and gate requests with enabled.
+  return {
+    ...deploymentOptionsQueryOptions,
+    retry: false,
+  }
+})
+
+// Unsupported DSL state
+export const unsupportedDslNodesAtom = atom((get): UnsupportedDslNode[] => {
+  const submissionUnsupportedDslNodes = get(submissionUnsupportedDslNodesAtom)
+  if (submissionUnsupportedDslNodes.length > 0)
+    return submissionUnsupportedDslNodes
+
+  if (!sourceReady(get))
+    return []
+
+  return get(precheckReleaseQueryAtom).data?.unsupportedNodes ?? []
+})
+
+const precheckReleaseReadyAtom = atom((get) => {
+  return precheckReleaseReady(get)
+})
+
+const deploymentOptionsReadyAtom = atom((get) => {
+  const deploymentOptionsQuery = get(deploymentOptionsQueryAtom)
+
+  return sourceReady(get)
+    && get(precheckReleaseReadyAtom)
+    && deploymentOptionsQuery.isSuccess
+})
+
+const deploymentOptionsContentCheckedAtom = atom((get) => {
+  const deploymentOptionsQuery = get(deploymentOptionsQueryAtom)
+  const precheckReleaseQuery = get(precheckReleaseQueryAtom)
+  const isLoadingOptions = deploymentOptionsQuery.isLoading || (deploymentOptionsQuery.isFetching && !deploymentOptionsQuery.data)
+  const isCheckingReleaseContent = precheckReleaseQuery.isLoading || (precheckReleaseQuery.isFetching && !precheckReleaseQuery.data)
+
+  if (!sourceReady(get) || isCheckingReleaseContent || isLoadingOptions)
+    return false
+
+  return get(precheckReleaseReadyAtom) && deploymentOptionsQuery.isSuccess
+})
+
+export const sourceCanGoNextAtom = atom((get) => {
+  const method = get(methodAtom)
+  const effectiveSelectedApp = get(effectiveSelectedAppAtom)
+  const importDslReady = method === 'importDsl' && get(importDslReadyAtom)
+  const bindAppReady = method === 'bindApp' && Boolean(effectiveSelectedApp?.id)
+
+  return (importDslReady || bindAppReady) && get(deploymentOptionsContentCheckedAtom)
+})
+
+export const setSourceSearchTextAtom = atom(null, (get, set, value: string) => {
+  if (get(sourceSearchTextAtom) === value)
+    return
+
+  set(sourceSearchTextAtom, value)
+  set(selectedAppAtom, undefined)
+  set(selectedEnvironmentIdAtom, '')
+  set(manualBindingSelectionsAtom, {})
+  set(envVarValuesAtom, {})
+  set(submissionUnsupportedDslNodesAtom, [])
+})
+
+export const selectSourceAppAtom = atom(null, (_get, set, app: WorkflowSourceApp) => {
+  set(selectedAppAtom, app)
+  set(selectedEnvironmentIdAtom, '')
+  set(manualBindingSelectionsAtom, {})
+  set(envVarValuesAtom, {})
+  set(submissionUnsupportedDslNodesAtom, [])
+})
+
+export const continueFromSourceAtom = atom(null, (get, set, {
+  defaultDslAppName,
+  defaultReleaseName,
+}: {
+  defaultDslAppName: string
+  defaultReleaseName: string
+}) => {
+  if (!get(sourceCanGoNextAtom))
+    return
+
+  const method = get(methodAtom)
+  const effectiveSelectedApp = get(effectiveSelectedAppAtom)
+  if (method === 'bindApp' && effectiveSelectedApp)
+    set(selectSourceAppAtom, effectiveSelectedApp)
+
+  const sourceName = method === 'importDsl'
+    ? get(dslDefaultAppNameAtom) || defaultDslAppName
+    : effectiveSelectedApp?.name
+  const nextInstanceName = sourceName?.trim()
+
+  if (nextInstanceName) {
+    const currentInstanceName = get(instanceNameAtom).trim()
+    const autoFilledInstanceName = get(autoFilledInstanceNameAtom)
+    const existingInstanceNamesQuery = get(existingInstanceNamesQueryAtom)
+    const existingNameSet = new Set(
+      existingInstanceNamesQuery.data?.pages.flatMap(page =>
+        page.appInstances.flatMap((appInstance) => {
+          const name = appInstance.displayName.trim()
+
+          return name ? [name] : []
+        }),
+      ) ?? [],
+    )
+
+    if (!currentInstanceName || currentInstanceName === autoFilledInstanceName) {
+      const nextAvailableInstanceName = availableInstanceName(nextInstanceName, existingNameSet)
+      set(instanceNameAtom, nextAvailableInstanceName)
+      set(autoFilledInstanceNameAtom, nextAvailableInstanceName)
+    }
+  }
+
+  const currentReleaseName = get(releaseNameAtom).trim()
+  const autoFilledReleaseName = get(autoFilledReleaseNameAtom)
+  if (!currentReleaseName || currentReleaseName === autoFilledReleaseName) {
+    set(releaseNameAtom, defaultReleaseName)
+    set(autoFilledReleaseNameAtom, defaultReleaseName)
+  }
+  set(stepAtom, 'release')
+})
+
+// DSL actions
+export const selectDslFileAtom = atom(null, async (get, set, dslFile?: File) => {
+  set(selectedEnvironmentIdAtom, '')
+  set(manualBindingSelectionsAtom, {})
+  set(envVarValuesAtom, {})
+  set(submissionUnsupportedDslNodesAtom, [])
+
+  // Token guard prevents a slow read from an older file from overwriting the newest selection.
+  const dslReadToken = get(dslReadTokenAtom) + 1
+  set(dslReadTokenAtom, dslReadToken)
+  set(dslFileAtom, dslFile)
+  set(dslContentAtom, '')
+  set(isReadingDslAtom, Boolean(dslFile))
+  set(dslReadErrorAtom, false)
+
+  if (!dslFile)
+    return
+
+  try {
+    const content = await dslFile.text()
+    if (get(dslReadTokenAtom) !== dslReadToken)
+      return
+
+    set(dslContentAtom, content)
+    set(dslReadErrorAtom, false)
+  }
+  catch {
+    if (get(dslReadTokenAtom) !== dslReadToken)
+      return
+
+    set(dslContentAtom, '')
+    set(dslReadErrorAtom, true)
+  }
+  finally {
+    if (get(dslReadTokenAtom) === dslReadToken)
+      set(isReadingDslAtom, false)
+  }
+})
+
+// Release derived state and actions
+export const hasInstanceNameConflictAtom = atom((get) => {
+  const submittedInstanceName = get(instanceNameAtom).trim()
+  const instanceNameConflictQuery = get(instanceNameConflictQueryAtom)
+  const existingInstanceNamesQuery = get(existingInstanceNamesQueryAtom)
+  const existingInstanceNames = existingInstanceNamesQuery.data?.pages.flatMap(page =>
+    page.appInstances.flatMap((appInstance) => {
+      const name = appInstance.displayName.trim()
+
+      return name ? [name] : []
+    }),
+  ) ?? []
+
+  return Boolean(
+    submittedInstanceName
+    && (
+      existingInstanceNames.includes(submittedInstanceName)
+      || (instanceNameConflictQuery.data?.appInstances.some(appInstance => appInstance.displayName.trim() === submittedInstanceName) ?? false)
+    ),
+  )
+})
+
+const submittedReleaseReadyAtom = atom((get) => {
+  return Boolean(sourceReady(get) && get(instanceNameAtom).trim() && get(releaseNameAtom).trim())
+})
+
+export const releaseCanGoNextAtom = atom((get) => {
+  const submittedInstanceName = get(instanceNameAtom).trim()
+  const instanceNameConflictQuery = get(instanceNameConflictQueryAtom)
+
+  return Boolean(get(submittedReleaseReadyAtom))
+    && !get(hasInstanceNameConflictAtom)
+    && !(Boolean(submittedInstanceName) && instanceNameConflictQuery.isLoading)
+    && get(deploymentOptionsContentCheckedAtom)
+})
+
+export const setInstanceNameAtom = atom(null, (_get, set, value: string) => {
+  set(instanceNameAtom, value)
+  set(autoFilledInstanceNameAtom, '')
+  set(stepAtom, 'release')
+})
+
+export const setInstanceDescriptionAtom = atom(null, (_get, set, value: string) => {
+  set(instanceDescriptionAtom, value)
+  set(stepAtom, 'release')
+})
+
+export const setReleaseNameAtom = atom(null, (_get, set, value: string) => {
+  set(releaseNameAtom, value)
+  set(autoFilledReleaseNameAtom, '')
+  set(stepAtom, 'release')
+})
+
+export const setReleaseDescriptionAtom = atom(null, (_get, set, value: string) => {
+  set(releaseDescriptionAtom, value)
+  set(stepAtom, 'release')
+})
+
+export const continueFromReleaseAtom = atom(null, (get, set) => {
+  if (!get(releaseCanGoNextAtom))
+    return
+
+  set(selectedEnvironmentIdAtom, '')
+  set(manualBindingSelectionsAtom, {})
+  set(envVarValuesAtom, {})
+  set(stepAtom, 'target')
+})
+
+// Target derived state and actions
+export const deployableEnvironmentsAtom = atom((get) => {
+  const deployableEnvironmentsQuery = get(deployableEnvironmentsQueryAtom)
+
+  return sourceReady(get)
+    ? deployableEnvironmentsQuery.data?.environments ?? []
+    : []
+})
+
+const deployableEnvironmentsReadyAtom = atom((get) => {
+  const deployableEnvironmentsQuery = get(deployableEnvironmentsQueryAtom)
+
+  return sourceReady(get) && deployableEnvironmentsQuery.isSuccess
+})
+
+export const effectiveSelectedEnvironmentIdAtom = atom((get) => {
+  return get(selectedEnvironmentIdAtom) || get(deployableEnvironmentsAtom)[0]?.id
+})
+
+export const deploymentTargetBindingSlotsAtom = atom((get) => {
+  const deploymentOptionsQuery = get(deploymentOptionsQueryAtom)
+
+  return sourceReady(get)
+    ? deploymentOptionsQuery.data?.options?.credentialSlots?.filter(slot => runtimeCredentialSlotKey(slot)) ?? []
+    : []
+})
+
+export const deploymentTargetBindingSelectionsAtom = atom((get) => {
+  return selectedRuntimeCredentialSelections(
+    get(deploymentTargetBindingSlotsAtom),
+    get(manualBindingSelectionsAtom),
+  )
+})
+
+const requiredBindingsReadyAtom = atom((get) => {
+  const bindingSelections = get(deploymentTargetBindingSelectionsAtom)
+
+  return get(deploymentTargetBindingSlotsAtom).every(slot =>
+    !hasMissingRequiredRuntimeCredentialBinding(slot, bindingSelections[runtimeCredentialSlotKey(slot)]),
+  )
+})
+
+export const deploymentTargetEnvVarSlotsAtom = atom((get) => {
+  const method = get(methodAtom)
+  const deploymentOptionsQuery = get(deploymentOptionsQueryAtom)
+  const slots = sourceReady(get) ? deploymentOptionsQuery.data?.options?.envVarSlots : undefined
+  const dslContent = get(dslContentAtom)
+
+  // Deployment options own the canonical slot list; DSL metadata only enriches import-DSL defaults.
+  const deploymentOptionEnvVarSlots = slots?.flatMap((slot): EnvVarBindingSlot[] => {
+    const bindingSlot = envVarBindingSlotFromContract(slot)
+    return bindingSlot ? [bindingSlot] : []
+  }) ?? []
+  const dslEnvVarMetadataSlots = method === 'importDsl' && dslContent
+    ? dslEnvVarSlots(dslContent).flatMap((slot) => {
+        const key = slot.key.trim()
+        if (!key)
+          return []
+
+        return [{
+          key,
+          ...(slot.description ? { description: slot.description } : {}),
+          ...(slot.defaultValue !== undefined ? { defaultValue: slot.defaultValue, hasDefaultValue: true } : {}),
+          ...(slot.valueType ? { valueType: envVarBindingValueType(slot.valueType) } : {}),
+        }]
+      })
+    : []
+
+  if (dslEnvVarMetadataSlots.length === 0)
+    return deploymentOptionEnvVarSlots
+
+  const metadataByKey = new Map(
+    dslEnvVarMetadataSlots.map(slot => [slot.key, slot] as const),
+  )
+
+  return deploymentOptionEnvVarSlots.map((slot) => {
+    const metadata = metadataByKey.get(slot.key)
+    if (!metadata)
+      return slot
+
+    const nextSlot = { ...slot }
+
+    if (!nextSlot.description && metadata.description)
+      nextSlot.description = metadata.description
+    if (!nextSlot.hasDefaultValue && metadata.defaultValue !== undefined) {
+      nextSlot.defaultValue = metadata.defaultValue
+      nextSlot.hasDefaultValue = true
+    }
+    if (nextSlot.valueType === 'string' && metadata.valueType)
+      nextSlot.valueType = metadata.valueType
+
+    return nextSlot
+  })
+})
+
+const requiredEnvVarsReadyAtom = atom((get) => {
+  const envVarValues = get(envVarValuesAtom)
+
+  return get(deploymentTargetEnvVarSlotsAtom).every(slot =>
+    envVarSelectionReady(slot, envVarValues[slot.key]),
+  )
+})
+
+export const canDeployAtom = atom((get) => {
+  const effectiveSelectedEnvironmentId = get(effectiveSelectedEnvironmentIdAtom)
+  const selectedEnvironment = effectiveSelectedEnvironmentId
+    ? get(deployableEnvironmentsAtom).find(env => environmentMatchesIdentifier(env, effectiveSelectedEnvironmentId))
+    : undefined
+
+  return Boolean(
+    selectedEnvironment?.id
+    && get(deployableEnvironmentsReadyAtom)
+    && get(deploymentOptionsReadyAtom)
+    && get(requiredBindingsReadyAtom)
+    && get(requiredEnvVarsReadyAtom)
+    && get(submittedReleaseReadyAtom),
+  )
+})
+
+export const canSkipDeploymentAtom = atom((get) => {
+  return get(submittedReleaseReadyAtom) && get(deploymentOptionsReadyAtom)
+})
+
+export const selectBindingAtom = atom(null, (get, set, slot: string, value: string) => {
+  set(manualBindingSelectionsAtom, {
+    ...get(manualBindingSelectionsAtom),
+    [slot]: value,
+  })
+})
+
+export const setEnvVarAtom = atom(null, (get, set, key: string, value: EnvVarValueSelection) => {
+  set(envVarValuesAtom, {
+    ...get(envVarValuesAtom),
+    [key]: value,
+  })
+})
+
+// Workflow actions
+export const selectMethodAtom = atom(null, (_get, set, method: GuideMethod) => {
+  set(methodAtom, method)
+  set(selectedEnvironmentIdAtom, '')
+  set(manualBindingSelectionsAtom, {})
+  set(envVarValuesAtom, {})
+  set(submissionUnsupportedDslNodesAtom, [])
+  set(stepAtom, 'source')
+})
+
+// Submission
+const createAppInstanceMutationAtom = atomWithMutation(() =>
+  consoleQuery.enterprise.appInstanceService.createAppInstance.mutationOptions(),
+)
+
+const createReleaseMutationAtom = atomWithMutation(() =>
+  consoleQuery.enterprise.releaseService.createRelease.mutationOptions(),
+)
+
+const createInitialDeploymentMutationAtom = atomWithMutation(() =>
+  consoleQuery.enterprise.deploymentService.deploy.mutationOptions(),
+)
+
+export class CreateDeploymentGuideSubmissionBlockedError extends Error {
+  reason: 'unsupportedDslMode' | 'deployFailed'
+
+  constructor(reason: 'unsupportedDslMode' | 'deployFailed') {
+    super(reason)
+    this.reason = reason
+    this.name = 'CreateDeploymentGuideSubmissionBlockedError'
+  }
+}
+
+export const createDeploymentGuideSubmissionAtom = atom(null, async (get, set, {
+  deployToEnvironment,
+}: {
+  deployToEnvironment: boolean
+}) => {
+  const method = get(methodAtom)
+  const dslContent = get(dslContentAtom)
+  const submittedInstanceName = get(instanceNameAtom).trim()
+  const submittedReleaseName = get(releaseNameAtom).trim()
+  const submittedReleaseDescription = get(releaseDescriptionAtom).trim()
+
+  if (get(isSubmittingDeploymentGuideAtom) || !get(submittedReleaseReadyAtom))
+    return undefined
+
+  const effectiveSelectedApp = get(effectiveSelectedAppAtom)
+  const deployableEnvironmentsQuery = get(deployableEnvironmentsQueryAtom)
+  const deploymentOptions = get(deploymentOptionsQueryAtom).data?.options
+  const envVarSlots = get(deploymentTargetEnvVarSlotsAtom)
+  const envVarValues = get(envVarValuesAtom)
+  const bindingSlots = get(deploymentTargetBindingSlotsAtom)
+  const bindingSelections = get(deploymentTargetBindingSelectionsAtom)
+  const selectedEnvironmentId = get(selectedEnvironmentIdAtom)
+  const effectiveSelectedEnvironmentId = selectedEnvironmentId || get(deployableEnvironmentsAtom)[0]?.id
+  const selectedEnvironment = effectiveSelectedEnvironmentId
+    ? get(deployableEnvironmentsAtom).find(env => environmentMatchesIdentifier(env, effectiveSelectedEnvironmentId))
+    : undefined
+
+  if (deployToEnvironment && !selectedEnvironment && !selectedEnvironmentId.trim())
+    return undefined
+  if (method === 'bindApp' && !effectiveSelectedApp?.id)
+    return undefined
+  if (method === 'importDsl' && !dslContent.trim())
+    return undefined
+  if (method === 'importDsl' && !isWorkflowDsl(dslContent))
+    throw new CreateDeploymentGuideSubmissionBlockedError('unsupportedDslMode')
+
+  set(submissionUnsupportedDslNodesAtom, [])
+
+  try {
+    if (!deployToEnvironment) {
+      if (!get(canSkipDeploymentAtom))
+        return undefined
+
+      set(isCreatingReleaseOnlyAtom, true)
+
+      try {
+        const createdAppInstance = await get(createAppInstanceMutationAtom).mutateAsync({
+          body: {
+            displayName: submittedInstanceName,
+            description: get(instanceDescriptionAtom).trim() || undefined,
+          },
+        })
+        const appInstanceId = createdAppInstance.appInstance.id
+
+        if (method === 'importDsl') {
+          await get(createReleaseMutationAtom).mutateAsync({
+            body: {
+              appInstanceId,
+              dsl: encodeDslContent(dslContent),
+              displayName: submittedReleaseName,
+              description: submittedReleaseDescription || undefined,
+              createAppInstance: false,
+            },
+          })
+
+          return appInstanceId
+        }
+
+        if (!effectiveSelectedApp?.id)
+          return undefined
+
+        await get(createReleaseMutationAtom).mutateAsync({
+          body: {
+            appInstanceId,
+            sourceAppId: effectiveSelectedApp.id,
+            displayName: submittedReleaseName,
+            description: submittedReleaseDescription || undefined,
+            createAppInstance: false,
+          },
+        })
+
+        return appInstanceId
+      }
+      finally {
+        set(isCreatingReleaseOnlyAtom, false)
+      }
+    }
+
+    if (!get(canDeployAtom))
+      return undefined
+
+    set(isCreatingDeploymentAtom, true)
+
+    try {
+      const selectedEnvironmentIdentifier = selectedEnvironmentId.trim()
+      const freshSelectedEnvironment = selectedEnvironment || (
+        selectedEnvironmentIdentifier
+          ? (await deployableEnvironmentsQuery.refetch()).data?.environments.find(environment =>
+              environmentMatchesIdentifier(environment, selectedEnvironmentIdentifier),
+            )
+          : undefined
+      )
+      const targetEnvironmentId = freshSelectedEnvironment?.id
+      if (!targetEnvironmentId)
+        throw new CreateDeploymentGuideSubmissionBlockedError('deployFailed')
+
+      if (!get(requiredBindingsReadyAtom))
+        throw new Error('Missing required deployment binding.')
+      if (!get(requiredEnvVarsReadyAtom))
+        throw new Error('Missing required deployment environment variable.')
+
+      const envVars = envVarSlots.flatMap(slot => envVarInput(slot, envVarValues[slot.key]))
+      const commonDeploymentRequest = {
+        newAppInstance: {
+          displayName: submittedInstanceName,
+          description: get(instanceDescriptionAtom).trim() || undefined,
+        },
+        environmentId: targetEnvironmentId,
+        releaseName: submittedReleaseName,
+        releaseDescription: submittedReleaseDescription || undefined,
+        credentials: selectedDeploymentRuntimeCredentials(bindingSlots, bindingSelections),
+        envVars,
+        idempotencyKey: createDeploymentIdempotencyKey(),
+        expectedDslDigest: deploymentOptions?.dslDigest,
+      } satisfies Omit<DeployRequest, 'dsl' | 'sourceAppId'>
+      const deploymentRequest = method === 'importDsl'
+        ? {
+            ...commonDeploymentRequest,
+            dsl: encodeDslContent(dslContent),
+          }
+        : effectiveSelectedApp?.id
+          ? {
+              ...commonDeploymentRequest,
+              sourceAppId: effectiveSelectedApp.id,
+            }
+          : undefined
+      if (!deploymentRequest)
+        return undefined
+
+      const response = await get(createInitialDeploymentMutationAtom).mutateAsync({
+        body: deploymentRequest,
+      })
+
+      return response.appInstance.id
+    }
+    finally {
+      set(isCreatingDeploymentAtom, false)
+    }
+  }
+  catch (error) {
+    const unsupportedError = await unsupportedDslNodeError(error)
+    if (unsupportedError?.nodes.length) {
+      set(submissionUnsupportedDslNodesAtom, unsupportedError.nodes)
+
+      return undefined
+    }
+
+    throw error
+  }
+})
+
+// Scoped local state
+export const createDeploymentGuideScopedAtoms = [
+  stepAtom,
+  methodAtom,
+  sourceSearchTextAtom,
+  selectedAppAtom,
+  dslFileAtom,
+  dslContentAtom,
+  isReadingDslAtom,
+  dslReadErrorAtom,
+  dslReadTokenAtom,
+  instanceNameAtom,
+  instanceDescriptionAtom,
+  releaseNameAtom,
+  releaseDescriptionAtom,
+  autoFilledInstanceNameAtom,
+  autoFilledReleaseNameAtom,
+  selectedEnvironmentIdAtom,
+  manualBindingSelectionsAtom,
+  envVarValuesAtom,
+  submissionUnsupportedDslNodesAtom,
+  isCreatingDeploymentAtom,
+  isCreatingReleaseOnlyAtom,
+]
diff --git a/web/features/deployments/create-guide/state/provider.tsx b/web/features/deployments/create-guide/state/provider.tsx
new file mode 100644
index 00000000000..5ebf3d8bd3a
--- /dev/null
+++ b/web/features/deployments/create-guide/state/provider.tsx
@@ -0,0 +1,15 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { ScopeProvider } from 'jotai-scope'
+import { createDeploymentGuideScopedAtoms } from './index'
+
+export function CreateDeploymentGuideProvider({ children }: {
+  children: ReactNode
+}) {
+  return (
+    <ScopeProvider atoms={createDeploymentGuideScopedAtoms}>
+      {children}
+    </ScopeProvider>
+  )
+}
diff --git a/web/features/deployments/create-guide/ui/layout.tsx b/web/features/deployments/create-guide/ui/layout.tsx
new file mode 100644
index 00000000000..e49e7654926
--- /dev/null
+++ b/web/features/deployments/create-guide/ui/layout.tsx
@@ -0,0 +1,215 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { GuideStep } from '@/features/deployments/create-guide/state'
+import { cn } from '@langgenius/dify-ui/cn'
+import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useTranslation } from 'react-i18next'
+import { TitleTooltip } from '@/features/deployments/components/title-tooltip'
+
+const GUIDE_PROGRESS_STEPS: GuideStep[] = ['source', 'release', 'target']
+
+function GuideStepIntro({ activeStep }: {
+  activeStep: GuideStep
+}) {
+  const { t } = useTranslation('deployments')
+
+  let title: string
+  let description: string
+
+  if (activeStep === 'source') {
+    title = t('createGuide.source.title')
+    description = t('createGuide.method.description')
+  }
+  else if (activeStep === 'release') {
+    title = t('createGuide.release.title')
+    description = t('createGuide.release.description')
+  }
+  else if (activeStep === 'target') {
+    title = t('createGuide.target.title')
+    description = t('createGuide.target.description')
+  }
+  else {
+    return null
+  }
+
+  return (
+    <div className="pb-4">
+      <h2 className="system-md-semibold text-text-primary">{title}</h2>
+      <p className="mt-1 max-w-150 system-sm-regular text-text-tertiary">{description}</p>
+    </div>
+  )
+}
+
+function GuideProgress({ activeStep }: {
+  activeStep: GuideStep
+}) {
+  const { t } = useTranslation('deployments')
+  const activeIndex = GUIDE_PROGRESS_STEPS.indexOf(activeStep)
+
+  return (
+    <ol className="grid grid-cols-3 gap-1.5">
+      {GUIDE_PROGRESS_STEPS.map((step, index) => {
+        const isActive = step === activeStep
+        const isComplete = index < activeIndex
+        const label = t(`createGuide.steps.${step}`)
+
+        return (
+          <TitleTooltip key={step} content={label}>
+            <li
+              aria-current={isActive ? 'step' : undefined}
+              className={cn(
+                'flex min-w-0 items-start gap-1.5 px-1 py-1.5 system-xs-medium sm:items-center sm:gap-2 sm:px-2',
+                isActive
+                  ? 'text-text-primary'
+                  : isComplete
+                    ? 'text-text-secondary'
+                    : 'text-text-quaternary',
+              )}
+            >
+              <span
+                aria-hidden
+                className={cn(
+                  'mt-1 size-2 shrink-0 rounded-full border-[1.5px] sm:mt-0',
+                  isActive
+                    ? 'border-text-primary bg-text-primary'
+                    : isComplete
+                      ? 'border-text-secondary bg-text-secondary'
+                      : 'border-text-quaternary bg-transparent',
+                )}
+              />
+              <span className="line-clamp-2 min-w-0 leading-4">{label}</span>
+            </li>
+          </TitleTooltip>
+        )
+      })}
+    </ol>
+  )
+}
+
+function GuideProgressSummary({ activeStep }: {
+  activeStep: GuideStep
+}) {
+  const { t } = useTranslation('deployments')
+  const activeIndex = GUIDE_PROGRESS_STEPS.indexOf(activeStep)
+  const activeStepNumber = activeIndex + 1
+
+  let activeStepLabel: string
+  if (activeStep === 'source')
+    activeStepLabel = t('createGuide.steps.source')
+  else if (activeStep === 'release')
+    activeStepLabel = t('createGuide.steps.release')
+  else if (activeStep === 'target')
+    activeStepLabel = t('createGuide.steps.target')
+  else
+    return null
+
+  if (activeIndex < 0)
+    return null
+
+  return (
+    <div className="flex w-full min-w-0 flex-col gap-2">
+      <div className="flex min-w-0 items-baseline justify-between gap-3">
+        <span className="truncate system-sm-medium text-text-secondary">{activeStepLabel}</span>
+        <span className="shrink-0 system-xs-regular text-text-quaternary">
+          {activeStepNumber}
+          /
+          {GUIDE_PROGRESS_STEPS.length}
+        </span>
+      </div>
+      <div className="grid grid-cols-3 gap-1" aria-hidden="true">
+        {GUIDE_PROGRESS_STEPS.map((step, index) => (
+          <span
+            key={step}
+            className={cn(
+              'h-1 rounded-full',
+              index <= activeIndex ? 'bg-text-primary' : 'bg-divider-subtle',
+            )}
+          />
+        ))}
+      </div>
+    </div>
+  )
+}
+
+export function StepShell({ title, description, descriptionClassName, hideHeader, className, children }: {
+  title: string
+  description: string
+  descriptionClassName?: string
+  hideHeader?: boolean
+  className?: string
+  children: ReactNode
+}) {
+  return (
+    <section aria-label={hideHeader ? title : undefined} className={cn('flex min-w-0 flex-col gap-4', className)}>
+      {!hideHeader && (
+        <div className="flex min-w-0 flex-col gap-0.5">
+          <h2 className="system-md-semibold text-text-primary">{title}</h2>
+          <p className={cn('system-sm-regular text-text-tertiary', descriptionClassName)}>{description}</p>
+        </div>
+      )}
+      {children}
+    </section>
+  )
+}
+
+export function GuideCard({ children, actions, contentScrollable = true }: {
+  children: ReactNode
+  actions: ReactNode
+  contentScrollable?: boolean
+}) {
+  return (
+    <div className="flex min-h-0 w-full min-w-0 flex-1 flex-col">
+      {contentScrollable
+        ? (
+            <ScrollArea
+              className="min-h-0 flex-1"
+              slotClassNames={{
+                viewport: 'overscroll-contain',
+                content: 'min-h-full pt-0.5 pb-6',
+                scrollbar: 'data-[orientation=vertical]:-me-5 data-[orientation=vertical]:my-1',
+              }}
+            >
+              {children}
+            </ScrollArea>
+          )
+        : (
+            <div className="min-h-0 flex-1 overflow-hidden pt-0.5 pb-6">
+              {children}
+            </div>
+          )}
+      {actions}
+    </div>
+  )
+}
+
+export function GuideFrame({ activeStep, children }: {
+  activeStep: GuideStep
+  children: ReactNode
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <div className="relative flex h-full min-h-0 overflow-hidden bg-background-default-subtle">
+      <div className="flex min-w-0 flex-1 shrink-0 justify-center overflow-hidden">
+        <section
+          aria-label={t('createGuide.title')}
+          className="flex h-full w-full max-w-[840px] flex-col px-5 sm:px-8 lg:px-10"
+        >
+          <div className="h-5 sm:h-8 lg:h-12" />
+          <div className="flex min-w-0 items-start justify-between gap-6 pt-1 pb-4">
+            <h1 className="title-2xl-semi-bold text-text-primary">{t('createGuide.title')}</h1>
+            <div className="hidden w-[184px] shrink-0 min-[1120px]:block">
+              <GuideProgressSummary activeStep={activeStep} />
+            </div>
+          </div>
+          <GuideStepIntro activeStep={activeStep} />
+          <div className="mb-6 min-[1120px]:hidden">
+            <GuideProgress activeStep={activeStep} />
+          </div>
+          {children}
+        </section>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/deployments/create-guide/ui/release-step.tsx b/web/features/deployments/create-guide/ui/release-step.tsx
new file mode 100644
index 00000000000..192351003ab
--- /dev/null
+++ b/web/features/deployments/create-guide/ui/release-step.tsx
@@ -0,0 +1,209 @@
+'use client'
+
+import { Button } from '@langgenius/dify-ui/button'
+import { Input } from '@langgenius/dify-ui/input'
+import { useAtomValue, useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import {
+  continueFromReleaseAtom,
+  dslDefaultAppNameAtom,
+  hasInstanceNameConflictAtom,
+  instanceDescriptionAtom,
+  instanceNameAtom,
+  methodAtom,
+  releaseCanGoNextAtom,
+  releaseDescriptionAtom,
+  releaseNameAtom,
+  selectedAppAtom,
+  setInstanceDescriptionAtom,
+  setInstanceNameAtom,
+  setReleaseDescriptionAtom,
+  setReleaseNameAtom,
+  stepAtom,
+} from '@/features/deployments/create-guide/state'
+import { StepShell } from './layout'
+
+const releaseTextareaClassName = 'min-h-16 w-full resize-none appearance-none rounded-md border border-transparent bg-components-input-bg-normal p-2 px-3 system-sm-regular text-components-input-text-filled caret-primary-600 outline-hidden placeholder:text-components-input-text-placeholder hover:border-components-input-border-hover hover:bg-components-input-bg-hover focus:border-components-input-border-active focus:bg-components-input-bg-active focus:shadow-xs'
+
+export function ReleaseStepContent() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <StepShell
+      title={t('createGuide.release.title')}
+      description={t('createGuide.release.description')}
+      hideHeader
+    >
+      <div className="flex flex-col gap-6">
+        <DeploymentInfoSection />
+        <InitialReleaseSection />
+      </div>
+    </StepShell>
+  )
+}
+
+function DeploymentInfoSection() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <div className="flex flex-col gap-4">
+      <h3 className="system-sm-semibold text-text-primary">
+        {t('createGuide.release.deployInfo')}
+      </h3>
+      <InstanceNameField />
+      <InstanceDescriptionField />
+    </div>
+  )
+}
+
+function InitialReleaseSection() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <div className="flex flex-col gap-4">
+      <h3 className="system-sm-semibold text-text-primary">
+        {t('createGuide.release.firstVersion')}
+      </h3>
+      <ReleaseNameField />
+      <ReleaseDescriptionField />
+    </div>
+  )
+}
+
+function InstanceNameField() {
+  const { t } = useTranslation('deployments')
+  const instanceName = useAtomValue(instanceNameAtom)
+  const setInstanceName = useSetAtom(setInstanceNameAtom)
+  const method = useAtomValue(methodAtom)
+  const selectedApp = useAtomValue(selectedAppAtom)
+  const dslDefaultAppName = useAtomValue(dslDefaultAppNameAtom)
+  const instanceNamePlaceholder = method === 'importDsl'
+    ? dslDefaultAppName || t('createGuide.dsl.defaultAppName')
+    : selectedApp?.name
+  const hasInstanceNameConflict = useAtomValue(hasInstanceNameConflictAtom)
+  const instanceNameError = hasInstanceNameConflict
+    ? t('createGuide.release.instanceNameConflict')
+    : undefined
+  const instanceNameErrorId = 'create-guide-instance-name-error'
+
+  return (
+    <div className="flex flex-col gap-2">
+      <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="create-guide-instance-name">
+        {t('createGuide.release.instanceName')}
+      </label>
+      <Input
+        id="create-guide-instance-name"
+        value={instanceName}
+        onChange={event => setInstanceName(event.target.value)}
+        placeholder={instanceNamePlaceholder}
+        required
+        aria-invalid={instanceNameError ? true : undefined}
+        aria-describedby={instanceNameError ? instanceNameErrorId : undefined}
+        className="h-9"
+      />
+      {instanceNameError && (
+        <div id={instanceNameErrorId} role="alert" className="system-xs-regular text-text-destructive">
+          {instanceNameError}
+        </div>
+      )}
+    </div>
+  )
+}
+
+function InstanceDescriptionField() {
+  const { t } = useTranslation('deployments')
+  const instanceDescription = useAtomValue(instanceDescriptionAtom)
+  const setInstanceDescription = useSetAtom(setInstanceDescriptionAtom)
+
+  return (
+    <div className="flex flex-col gap-2">
+      <OptionalFieldLabel htmlFor="create-guide-instance-description">
+        {t('createGuide.release.instanceDescription')}
+      </OptionalFieldLabel>
+      <textarea
+        id="create-guide-instance-description"
+        value={instanceDescription}
+        onChange={event => setInstanceDescription(event.target.value)}
+        placeholder={t('createGuide.release.instanceDescriptionPlaceholder')}
+        className={releaseTextareaClassName}
+      />
+    </div>
+  )
+}
+
+function ReleaseNameField() {
+  const { t } = useTranslation('deployments')
+  const releaseName = useAtomValue(releaseNameAtom)
+  const setReleaseName = useSetAtom(setReleaseNameAtom)
+
+  return (
+    <div className="flex flex-col gap-2">
+      <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="create-guide-release-name">
+        {t('createGuide.release.releaseName')}
+      </label>
+      <Input
+        id="create-guide-release-name"
+        value={releaseName}
+        onChange={event => setReleaseName(event.target.value)}
+        placeholder={t('createGuide.release.defaultName')}
+        required
+        className="h-9"
+      />
+    </div>
+  )
+}
+
+function ReleaseDescriptionField() {
+  const { t } = useTranslation('deployments')
+  const releaseDescription = useAtomValue(releaseDescriptionAtom)
+  const setReleaseDescription = useSetAtom(setReleaseDescriptionAtom)
+
+  return (
+    <div className="flex flex-col gap-2">
+      <OptionalFieldLabel htmlFor="create-guide-release-description">
+        {t('createGuide.release.releaseDescription')}
+      </OptionalFieldLabel>
+      <textarea
+        id="create-guide-release-description"
+        value={releaseDescription}
+        onChange={event => setReleaseDescription(event.target.value)}
+        placeholder={t('createGuide.release.releaseDescriptionPlaceholder')}
+        className={releaseTextareaClassName}
+      />
+    </div>
+  )
+}
+
+function OptionalFieldLabel({ children, htmlFor }: {
+  children: string
+  htmlFor: string
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <div className="flex items-center gap-1.5">
+      <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor={htmlFor}>
+        {children}
+      </label>
+      <span className="system-xs-regular text-text-quaternary">{t('versions.optional')}</span>
+    </div>
+  )
+}
+
+export function ReleaseActionButtons() {
+  const { t } = useTranslation('deployments')
+  const canGoNext = useAtomValue(releaseCanGoNextAtom)
+  const setStep = useSetAtom(stepAtom)
+  const continueFromRelease = useSetAtom(continueFromReleaseAtom)
+
+  return (
+    <>
+      <Button type="button" variant="secondary" onClick={() => setStep('source')}>
+        {t('createGuide.actions.back')}
+      </Button>
+      <Button type="button" variant="primary" disabled={!canGoNext} onClick={continueFromRelease}>
+        {t('createGuide.actions.next')}
+      </Button>
+    </>
+  )
+}
diff --git a/web/features/deployments/create-guide/ui/shell.tsx b/web/features/deployments/create-guide/ui/shell.tsx
new file mode 100644
index 00000000000..55496b65127
--- /dev/null
+++ b/web/features/deployments/create-guide/ui/shell.tsx
@@ -0,0 +1,78 @@
+'use client'
+
+import { useAtomValue } from 'jotai'
+import { stepAtom } from '@/features/deployments/create-guide/state'
+import { GuideCard, GuideFrame } from './layout'
+import {
+  ReleaseActionButtons,
+  ReleaseStepContent,
+} from './release-step'
+import {
+  SourceActionButtons,
+  SourceStepContent,
+} from './source-step'
+import {
+  TargetBackButton,
+  TargetDeployButton,
+  TargetSkipDeploymentButton,
+  TargetStepContent,
+} from './target-step'
+
+export function CreateDeploymentGuideShell() {
+  const step = useAtomValue(stepAtom)
+
+  return (
+    <GuideFrame activeStep={step}>
+      <GuideCard
+        contentScrollable={step !== 'source'}
+        actions={<CreateDeploymentGuideActionBar />}
+      >
+        <CreateDeploymentGuideStepContent />
+      </GuideCard>
+    </GuideFrame>
+  )
+}
+
+function CreateDeploymentGuideStepContent() {
+  const step = useAtomValue(stepAtom)
+
+  if (step === 'source') {
+    return (
+      <div className="flex h-full min-h-0 flex-col gap-7 pb-4">
+        <SourceStepContent />
+      </div>
+    )
+  }
+
+  if (step === 'release') {
+    return (
+      <div className="flex h-full min-h-0 flex-col gap-7 pb-4">
+        <ReleaseStepContent />
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex flex-col gap-7 pb-4">
+      <TargetStepContent />
+    </div>
+  )
+}
+
+function CreateDeploymentGuideActionBar() {
+  const step = useAtomValue(stepAtom)
+
+  return (
+    <div className="sticky bottom-0 z-10 -mx-5 mt-auto flex items-center justify-end gap-2 border-t border-divider-subtle bg-background-default-subtle/95 px-5 py-4 backdrop-blur-sm sm:-mx-8 sm:px-8 lg:-mx-10 lg:px-10">
+      {step === 'source' && <SourceActionButtons />}
+      {step === 'release' && <ReleaseActionButtons />}
+      {step === 'target' && (
+        <>
+          <TargetBackButton />
+          <TargetSkipDeploymentButton />
+          <TargetDeployButton />
+        </>
+      )}
+    </div>
+  )
+}
diff --git a/web/features/deployments/create-guide/ui/source-step.tsx b/web/features/deployments/create-guide/ui/source-step.tsx
new file mode 100644
index 00000000000..832219f1b18
--- /dev/null
+++ b/web/features/deployments/create-guide/ui/source-step.tsx
@@ -0,0 +1,360 @@
+'use client'
+
+import type { GuideMethod, WorkflowSourceApp } from '@/features/deployments/create-guide/state'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Input } from '@langgenius/dify-ui/input'
+import { RadioRoot } from '@langgenius/dify-ui/radio'
+import { RadioGroup } from '@langgenius/dify-ui/radio-group'
+import { useAtomValue, useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import Uploader from '@/app/components/app/create-from-dsl-modal/uploader'
+import AppIcon from '@/app/components/base/app-icon'
+import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import { DeploymentStateMessage } from '@/features/deployments/components/empty-state'
+import { TitleTooltip } from '@/features/deployments/components/title-tooltip'
+import { UnsupportedDslNodesAlert } from '@/features/deployments/components/unsupported-dsl-nodes-alert'
+import {
+  continueFromSourceAtom,
+  dslFileAtom,
+  dslReadErrorAtom,
+  dslUnsupportedModeAtom,
+  effectiveSelectedAppAtom,
+  isReadingDslAtom,
+  methodAtom,
+  selectDslFileAtom,
+  selectMethodAtom,
+  selectSourceAppAtom,
+  setSourceSearchTextAtom,
+  sourceAppsQueryAtom,
+  sourceCanGoNextAtom,
+  sourceSearchTextAtom,
+  unsupportedDslNodesAtom,
+} from '@/features/deployments/create-guide/state'
+import { StepShell } from './layout'
+
+const sourceAppSkeletonKeys = ['first-source-app', 'second-source-app', 'third-source-app']
+
+export function SourceStepContent() {
+  const method = useAtomValue(methodAtom)
+  const unsupportedDslNodes = useAtomValue(unsupportedDslNodesAtom)
+
+  return (
+    <div className="flex min-h-0 flex-1 flex-col gap-4">
+      <SourceMethodSection />
+      {method === 'bindApp' && (
+        <SourceAppSelectionSection />
+      )}
+      {method === 'importDsl' && (
+        <DslUploadSection />
+      )}
+      <UnsupportedDslNodesAlert nodes={unsupportedDslNodes} />
+    </div>
+  )
+}
+
+function SourceMethodSection() {
+  const { t } = useTranslation('deployments')
+  const method = useAtomValue(methodAtom)
+  const selectMethod = useSetAtom(selectMethodAtom)
+
+  return (
+    <StepShell
+      title={t('createGuide.steps.method')}
+      description={t('createGuide.method.description')}
+      descriptionClassName="lg:hidden"
+      hideHeader
+    >
+      <RadioGroup<GuideMethod>
+        value={method}
+        onValueChange={selectMethod}
+        className="flex flex-col items-stretch gap-2 sm:flex-row"
+      >
+        <SourceMethodCard
+          value="bindApp"
+          icon="i-ri-stack-line"
+          title={t('createGuide.methods.bindApp.title')}
+          description={t('createGuide.methods.bindApp.description')}
+        />
+        <SourceMethodCard
+          value="importDsl"
+          icon="i-ri-file-code-line"
+          title={t('createGuide.methods.importDsl.title')}
+          description={t('createGuide.methods.importDsl.description')}
+        />
+      </RadioGroup>
+    </StepShell>
+  )
+}
+
+function SourceMethodCard({ value, icon, title, description, badge }: {
+  value: GuideMethod
+  icon: string
+  title: string
+  description: string
+  badge?: string
+}) {
+  return (
+    <RadioRoot<GuideMethod>
+      value={value}
+      variant="unstyled"
+      className={cn(
+        `relative box-content h-[84px] w-full cursor-pointer rounded-xl border-[0.5px]
+        border-components-option-card-option-border bg-components-panel-on-panel-item-bg p-3
+        text-left shadow-xs outline-hidden hover:shadow-md focus-visible:ring-2
+        focus-visible:ring-state-accent-solid sm:w-[240px]`,
+        'data-checked:border-components-option-card-option-selected-border data-checked:bg-components-option-card-option-selected-bg data-checked:shadow-md data-checked:ring-[0.5px] data-checked:ring-components-option-card-option-selected-border data-checked:ring-inset',
+      )}
+    >
+      <span className="flex size-6 shrink-0 items-center justify-center rounded-md border border-divider-subtle bg-background-default-subtle">
+        <span className={cn('size-4 text-text-tertiary', icon)} aria-hidden="true" />
+      </span>
+      <span className="mt-2 mb-0.5 flex min-w-0 items-center gap-1">
+        <span className="truncate system-sm-semibold text-text-secondary">{title}</span>
+        {badge && (
+          <span className="shrink-0 rounded-md bg-background-default-subtle px-1.5 py-0.5 system-2xs-medium-uppercase text-text-tertiary">
+            {badge}
+          </span>
+        )}
+      </span>
+      <span className="flex min-w-0 items-start gap-1">
+        <TitleTooltip content={description}>
+          <span className="line-clamp-2 min-w-0 grow system-xs-regular text-text-tertiary">
+            {description}
+          </span>
+        </TitleTooltip>
+      </span>
+    </RadioRoot>
+  )
+}
+
+function SourceAppSelectionSection() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <StepShell
+      title={t('createGuide.source.title')}
+      description={t('createGuide.source.description')}
+      descriptionClassName="lg:hidden"
+      hideHeader
+      className="min-h-0 flex-1"
+    >
+      <div className="flex min-h-0 flex-1 flex-col gap-3">
+        <SourceSearchInput />
+        <SourceAppList />
+      </div>
+    </StepShell>
+  )
+}
+
+function SourceSearchInput() {
+  const { t } = useTranslation('deployments')
+  const sourceSearchText = useAtomValue(sourceSearchTextAtom)
+  const setSourceSearchText = useSetAtom(setSourceSearchTextAtom)
+
+  return (
+    <div className="relative">
+      <span className="pointer-events-none absolute top-1/2 left-2.5 i-ri-search-line size-4 -translate-y-1/2 text-text-tertiary" aria-hidden="true" />
+      <Input
+        id="create-guide-source-search"
+        aria-label={t('createGuide.source.sourceApp')}
+        value={sourceSearchText}
+        onChange={event => setSourceSearchText(event.target.value)}
+        placeholder={t('createGuide.source.searchPlaceholder')}
+        className="h-9 pr-8 pl-8"
+      />
+      {sourceSearchText && (
+        <button
+          type="button"
+          aria-label={t('createGuide.source.clearSearch')}
+          onClick={() => setSourceSearchText('')}
+          className="absolute top-1/2 right-2.5 flex size-4 -translate-y-1/2 items-center justify-center text-text-quaternary hover:text-text-secondary"
+        >
+          <span className="i-ri-close-circle-fill size-4" aria-hidden="true" />
+        </button>
+      )}
+    </div>
+  )
+}
+
+function SourceAppList() {
+  const { t } = useTranslation('deployments')
+  const selectSourceApp = useSetAtom(selectSourceAppAtom)
+  const effectiveSelectedApp = useAtomValue(effectiveSelectedAppAtom)
+  const sourceAppsQuery = useAtomValue(sourceAppsQueryAtom)
+  const sourceApps = (sourceAppsQuery.data?.pages.flatMap(page => page.data) ?? []) as WorkflowSourceApp[]
+  const sourceAppsLoading = sourceAppsQuery.isLoading || sourceAppsQuery.isPlaceholderData || (sourceAppsQuery.isFetching && sourceApps.length === 0)
+
+  return (
+    <div className="min-h-0 flex-1 overflow-y-auto rounded-lg border border-divider-subtle bg-background-default">
+      {sourceAppsLoading
+        ? <SourceAppSkeleton />
+        : sourceApps.length === 0
+          ? (
+              <DeploymentStateMessage variant="embedded">
+                {t('createGuide.source.empty')}
+              </DeploymentStateMessage>
+            )
+          : (
+              <div>
+                {sourceApps.map(app => (
+                  <SourceAppOption
+                    key={app.id}
+                    app={app}
+                    selected={effectiveSelectedApp?.id === app.id}
+                    onSelect={() => selectSourceApp(app)}
+                  />
+                ))}
+                {sourceAppsQuery.hasNextPage && (
+                  <div className="flex justify-center border-t border-divider-subtle px-3 py-2">
+                    <Button
+                      type="button"
+                      size="small"
+                      disabled={sourceAppsQuery.isFetchingNextPage}
+                      onClick={() => {
+                        void sourceAppsQuery.fetchNextPage()
+                      }}
+                    >
+                      {sourceAppsQuery.isFetchingNextPage ? t('createModal.loadingApps') : t('createModal.loadMoreApps')}
+                    </Button>
+                  </div>
+                )}
+              </div>
+            )}
+    </div>
+  )
+}
+
+function SourceAppSkeleton() {
+  return (
+    <div className="divide-y divide-divider-subtle">
+      {sourceAppSkeletonKeys.map(key => (
+        <SkeletonRow key={key} className="h-14 px-3 py-2">
+          <SkeletonRectangle className="my-0 size-7 animate-pulse rounded-lg" />
+          <div className="flex min-w-0 grow flex-col gap-1">
+            <SkeletonRectangle className="my-0 h-3.5 w-2/3 animate-pulse" />
+            <SkeletonRectangle className="my-0 h-2.5 w-1/3 animate-pulse" />
+          </div>
+        </SkeletonRow>
+      ))}
+    </div>
+  )
+}
+
+function SourceAppOption({ app, onSelect, selected }: {
+  app: WorkflowSourceApp
+  onSelect: () => void
+  selected: boolean
+}) {
+  return (
+    <label
+      className={cn(
+        'group flex min-h-14 cursor-pointer items-center gap-3 border-b border-b-divider-subtle px-3 py-2 transition-colors first:rounded-t-lg last:rounded-b-lg last:border-b-0',
+        selected
+          ? 'bg-state-accent-hover hover:bg-state-accent-hover'
+          : 'bg-background-default hover:bg-state-base-hover',
+      )}
+    >
+      <AppIcon
+        className="shrink-0"
+        size="xs"
+        iconType={app.icon_type}
+        icon={app.icon}
+        background={app.icon_background}
+        imageUrl={app.icon_url}
+      />
+      <span className="flex min-w-0 grow">
+        <span className={cn('truncate system-sm-medium', selected ? 'text-text-accent' : 'text-text-primary')}>{app.name}</span>
+      </span>
+      <input
+        type="radio"
+        name="source-app"
+        checked={selected}
+        onChange={onSelect}
+        className="sr-only"
+      />
+      <span
+        className={cn(
+          'flex size-5 shrink-0 items-center justify-center rounded-full',
+          selected ? 'bg-primary-600 text-text-primary-on-surface' : 'text-transparent',
+        )}
+        aria-hidden="true"
+      >
+        <span className="i-ri-check-line size-4" />
+      </span>
+    </label>
+  )
+}
+
+function DslUploadSection() {
+  const { t } = useTranslation('deployments')
+  const dslFile = useAtomValue(dslFileAtom)
+  const selectDslFile = useSetAtom(selectDslFileAtom)
+
+  return (
+    <StepShell title={t('createGuide.dsl.title')} description={t('createGuide.dsl.description')} hideHeader>
+      <div className="flex flex-col gap-4 rounded-xl border border-components-panel-border bg-components-panel-bg-blur p-5">
+        <div className="flex items-start gap-3">
+          <span className="mt-0.5 i-ri-upload-cloud-2-line size-5 shrink-0 text-text-tertiary" aria-hidden="true" />
+          <div className="flex min-w-0 flex-col gap-1">
+            <div className="system-sm-semibold text-text-primary">{t('createGuide.dsl.dropTitle')}</div>
+            <div className="system-sm-regular text-text-tertiary">{t('createGuide.dsl.dropDescription')}</div>
+          </div>
+        </div>
+        <Uploader
+          className="mt-0"
+          file={dslFile}
+          updateFile={selectDslFile}
+        />
+        <DslReadStatus />
+      </div>
+    </StepShell>
+  )
+}
+
+function DslReadStatus() {
+  const { t } = useTranslation('deployments')
+  const isReadingDsl = useAtomValue(isReadingDslAtom)
+  const dslReadError = useAtomValue(dslReadErrorAtom)
+  const dslUnsupportedMode = useAtomValue(dslUnsupportedModeAtom)
+
+  return (
+    <>
+      {isReadingDsl && (
+        <div className="system-xs-regular text-text-tertiary">
+          {t('createGuide.dsl.reading')}
+        </div>
+      )}
+      {dslReadError && (
+        <div className="system-xs-regular text-text-destructive">
+          {t('createGuide.dsl.readFailed')}
+        </div>
+      )}
+      {dslUnsupportedMode && (
+        <div role="alert" className="system-xs-regular text-text-destructive">
+          {t('createGuide.dsl.unsupportedMode')}
+        </div>
+      )}
+    </>
+  )
+}
+
+export function SourceActionButtons() {
+  const { t } = useTranslation('deployments')
+  const canGoNext = useAtomValue(sourceCanGoNextAtom)
+  const continueFromSource = useSetAtom(continueFromSourceAtom)
+
+  return (
+    <Button
+      type="button"
+      variant="primary"
+      disabled={!canGoNext}
+      onClick={() => continueFromSource({
+        defaultDslAppName: t('createGuide.dsl.defaultAppName'),
+        defaultReleaseName: t('createGuide.release.defaultName'),
+      })}
+    >
+      {t('createGuide.actions.next')}
+    </Button>
+  )
+}
diff --git a/web/features/deployments/create-guide/ui/target-step.tsx b/web/features/deployments/create-guide/ui/target-step.tsx
new file mode 100644
index 00000000000..690d5131290
--- /dev/null
+++ b/web/features/deployments/create-guide/ui/target-step.tsx
@@ -0,0 +1,356 @@
+'use client'
+
+import type { Environment } from '@dify/contracts/enterprise/types.gen'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { RadioControl, RadioRoot } from '@langgenius/dify-ui/radio'
+import { RadioGroup } from '@langgenius/dify-ui/radio-group'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useAtomValue, useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import {
+  EnvVarBindingsPanel,
+} from '@/features/deployments/components/env-var-bindings'
+import {
+  RuntimeCredentialBindingsPanel,
+} from '@/features/deployments/components/runtime-credential-bindings'
+import { TitleTooltip } from '@/features/deployments/components/title-tooltip'
+import { UnsupportedDslNodesAlert } from '@/features/deployments/components/unsupported-dsl-nodes-alert'
+import {
+  canDeployAtom,
+  canSkipDeploymentAtom,
+  createDeploymentGuideSubmissionAtom,
+  CreateDeploymentGuideSubmissionBlockedError,
+  deployableEnvironmentsAtom,
+  deployableEnvironmentsQueryAtom,
+  deploymentOptionsQueryAtom,
+  deploymentTargetBindingSelectionsAtom,
+  deploymentTargetBindingSlotsAtom,
+  deploymentTargetEnvVarSlotsAtom,
+  effectiveSelectedEnvironmentIdAtom,
+  envVarValuesAtom,
+  isCreatingReleaseOnlyAtom,
+  isSubmittingDeploymentGuideAtom,
+  selectBindingAtom,
+  selectedEnvironmentIdAtom,
+  setEnvVarAtom,
+  stepAtom,
+  unsupportedDslNodesAtom,
+} from '@/features/deployments/create-guide/state'
+import { deploymentErrorMessage } from '@/features/deployments/shared/domain/error'
+import { useRouter } from '@/next/navigation'
+import { StepShell } from './layout'
+
+const targetEnvironmentSkeletonKeys = ['first-target-environment', 'second-target-environment']
+const targetBindingSkeletonKeys = ['first-target-binding', 'second-target-binding']
+
+export function TargetStepContent() {
+  const { t } = useTranslation('deployments')
+  const unsupportedDslNodes = useAtomValue(unsupportedDslNodesAtom)
+
+  return (
+    <StepShell
+      title={t('createGuide.target.title')}
+      description={t('createGuide.target.description')}
+      hideHeader
+    >
+      <div className="flex flex-col gap-6">
+        <TargetEnvironmentSection />
+        <UnsupportedDslNodesAlert nodes={unsupportedDslNodes} />
+        <TargetBindingSection />
+        <TargetEnvVarSection />
+      </div>
+    </StepShell>
+  )
+}
+
+function TargetEnvironmentSection() {
+  const { t } = useTranslation('deployments')
+  const environmentsQuery = useAtomValue(deployableEnvironmentsQueryAtom)
+  const environments = useAtomValue(deployableEnvironmentsAtom)
+  const effectiveSelectedEnvironmentId = useAtomValue(effectiveSelectedEnvironmentIdAtom)
+  const isEnvironmentError = environmentsQuery.isError
+  const isEnvironmentLoading = environmentsQuery.isLoading || (environmentsQuery.isFetching && !environmentsQuery.data)
+  const selectEnvironment = useSetAtom(selectedEnvironmentIdAtom)
+  const hasEnvironmentOptions = environments.length > 0
+
+  return (
+    <div className="flex flex-col gap-3">
+      <div className="system-xs-medium-uppercase text-text-tertiary">{t('createGuide.target.environment')}</div>
+      {hasEnvironmentOptions
+        ? (
+            <RadioGroup<string>
+              value={effectiveSelectedEnvironmentId}
+              onValueChange={selectEnvironment}
+              className="grid grid-cols-1 items-stretch gap-3 lg:grid-cols-2"
+            >
+              {environments.map(environment => (
+                <EnvironmentOptionRow
+                  key={environment.id}
+                  environment={environment}
+                />
+              ))}
+            </RadioGroup>
+          )
+        : isEnvironmentLoading
+          ? <TargetEnvironmentSkeleton />
+          : (
+              <div className="rounded-lg border border-divider-subtle bg-background-default-subtle px-3 py-3 system-sm-regular text-text-quaternary">
+                {isEnvironmentError
+                  ? t('createGuide.target.loadEnvironmentsFailed')
+                  : t('createGuide.target.noEnvironmentOptions')}
+              </div>
+            )}
+    </div>
+  )
+}
+
+function EnvironmentOptionRow({ environment }: {
+  environment: Environment
+}) {
+  const { t } = useTranslation('deployments')
+  const summary = environment.description.trim() || `${t(`mode.${environment.mode}`)} · ${t(`backend.${environment.backend}`)}`
+
+  return (
+    <RadioRoot<string>
+      value={environment.id}
+      variant="unstyled"
+      className={cn(
+        'group flex cursor-pointer items-center gap-3 rounded-xl border p-3 outline-hidden',
+        'border-components-option-card-option-border bg-components-option-card-option-bg hover:border-components-option-card-option-border-hover hover:bg-components-option-card-option-bg-hover hover:shadow-xs',
+        'focus-visible:ring-2 focus-visible:ring-state-accent-solid',
+        'data-checked:border-state-accent-solid data-checked:bg-state-accent-hover data-checked:shadow-xs',
+      )}
+    >
+      <RadioControl />
+      <span className="flex min-w-0 grow flex-col gap-1">
+        <span className="truncate system-sm-semibold text-text-primary group-data-checked:text-text-accent">{environment.displayName}</span>
+        <TitleTooltip content={summary}>
+          <span className="line-clamp-1 system-xs-regular text-text-tertiary group-data-checked:text-text-secondary">
+            {summary}
+          </span>
+        </TitleTooltip>
+      </span>
+    </RadioRoot>
+  )
+}
+
+function TargetBindingSection() {
+  const { t } = useTranslation('deployments')
+  const deploymentOptionsQuery = useAtomValue(deploymentOptionsQueryAtom)
+  const bindingSlots = useAtomValue(deploymentTargetBindingSlotsAtom)
+  const bindingSelections = useAtomValue(deploymentTargetBindingSelectionsAtom)
+  const isBindingError = deploymentOptionsQuery.isError
+  const isBindingLoading = deploymentOptionsQuery.isLoading || (deploymentOptionsQuery.isFetching && !deploymentOptionsQuery.data)
+  const selectBinding = useSetAtom(selectBindingAtom)
+  const unsupportedDslNodes = useAtomValue(unsupportedDslNodesAtom)
+  const shouldRender = !(isBindingError && unsupportedDslNodes.length > 0)
+
+  if (!shouldRender)
+    return null
+
+  if (isBindingLoading || isBindingError) {
+    return (
+      <div className="overflow-hidden rounded-xl border border-components-option-card-option-border bg-components-option-card-option-bg">
+        <div className="flex min-w-0 flex-col gap-0.5 px-3 py-2.5">
+          <div className="system-xs-medium-uppercase text-text-tertiary">{t('createGuide.target.bindings')}</div>
+          <span className="system-xs-regular text-text-tertiary">{t('createGuide.target.bindingHint')}</span>
+        </div>
+        {isBindingLoading
+          ? <TargetBindingSkeleton />
+          : (
+              <div className="border-t border-divider-subtle px-3 py-3 system-sm-regular text-text-quaternary">
+                {t('createGuide.target.loadBindingsFailed')}
+              </div>
+            )}
+      </div>
+    )
+  }
+
+  return (
+    <RuntimeCredentialBindingsPanel
+      slots={bindingSlots}
+      selections={bindingSelections}
+      title={t('createGuide.target.bindings')}
+      hint={t('createGuide.target.bindingHint')}
+      noBindingRequiredLabel={t('createGuide.target.noBindingRequired')}
+      noCredentialCandidatesLabel={t('createGuide.target.noCredentialCandidates')}
+      selectCredentialLabel={t('createGuide.target.selectCredential')}
+      missingRequiredLabel={t('createGuide.target.missingRequiredBinding')}
+      bindingCountLabel={t('createGuide.target.bindingCount', { count: bindingSlots.length })}
+      onChange={selectBinding}
+      listScrollable={false}
+      className="border-components-option-card-option-border bg-components-option-card-option-bg"
+    />
+  )
+}
+
+function TargetEnvVarSection() {
+  const { t } = useTranslation('deployments')
+  const setEnvVar = useSetAtom(setEnvVarAtom)
+  const envVarValues = useAtomValue(envVarValuesAtom)
+  const deploymentOptionsQuery = useAtomValue(deploymentOptionsQueryAtom)
+  const envVarSlots = useAtomValue(deploymentTargetEnvVarSlotsAtom)
+  const isBindingError = deploymentOptionsQuery.isError
+  const isBindingLoading = deploymentOptionsQuery.isLoading || (deploymentOptionsQuery.isFetching && !deploymentOptionsQuery.data)
+
+  if (isBindingLoading || isBindingError)
+    return null
+
+  return (
+    <EnvVarBindingsPanel
+      slots={envVarSlots}
+      values={envVarValues}
+      title={t('createGuide.target.envVars')}
+      hint={t('createGuide.target.envVarHint')}
+      envVarPlaceholder={t('createGuide.target.envVarPlaceholder')}
+      literalSourceLabel={t('createGuide.target.envVarSource.literal')}
+      defaultSourceLabel={t('createGuide.target.envVarSource.default')}
+      lastDeploymentSourceLabel={t('createGuide.target.envVarSource.lastDeployment')}
+      valueTypeLabels={{
+        string: t('createGuide.target.envVarType.string'),
+        number: t('createGuide.target.envVarType.number'),
+        secret: t('createGuide.target.envVarType.secret'),
+      }}
+      sourceAriaLabel={key => t('createGuide.target.envVarSource.ariaLabel', { key })}
+      envVarCountLabel={t('createGuide.target.envVarCount', { count: envVarSlots.length })}
+      onChange={setEnvVar}
+      listScrollable={false}
+      className="border-components-option-card-option-border bg-components-option-card-option-bg"
+    />
+  )
+}
+
+function TargetEnvironmentSkeleton() {
+  return (
+    <div className="grid grid-cols-1 gap-3 lg:grid-cols-2">
+      {targetEnvironmentSkeletonKeys.map(key => (
+        <SkeletonRow key={key} className="h-17 rounded-xl border border-divider-subtle px-3 py-3">
+          <SkeletonRectangle className="my-0 size-4 animate-pulse rounded-full" />
+          <div className="flex min-w-0 grow flex-col gap-1.5">
+            <SkeletonRectangle className="my-0 h-3.5 w-1/2 animate-pulse" />
+            <SkeletonRectangle className="my-0 h-3 w-2/3 animate-pulse" />
+          </div>
+        </SkeletonRow>
+      ))}
+    </div>
+  )
+}
+
+function TargetBindingSkeleton() {
+  return (
+    <div className="border-t border-divider-subtle">
+      {targetBindingSkeletonKeys.map(key => (
+        <SkeletonRow key={key} className="h-15 px-3 py-3">
+          <div className="flex min-w-0 grow flex-col gap-1.5">
+            <SkeletonRectangle className="my-0 h-3.5 w-1/3 animate-pulse" />
+            <SkeletonRectangle className="my-0 h-3 w-1/2 animate-pulse" />
+          </div>
+          <SkeletonRectangle className="my-0 h-8 w-48 animate-pulse rounded-lg" />
+        </SkeletonRow>
+      ))}
+    </div>
+  )
+}
+
+export function TargetBackButton() {
+  const { t } = useTranslation('deployments')
+  const setStep = useSetAtom(stepAtom)
+  const isSubmitting = useAtomValue(isSubmittingDeploymentGuideAtom)
+
+  return (
+    <Button type="button" variant="secondary" onClick={() => setStep('release')} disabled={isSubmitting}>
+      {t('createGuide.actions.back')}
+    </Button>
+  )
+}
+
+export function TargetSkipDeploymentButton() {
+  const { t } = useTranslation('deployments')
+  const router = useRouter()
+  const canSkipDeployment = useAtomValue(canSkipDeploymentAtom)
+  const submitCreateDeploymentGuide = useSetAtom(createDeploymentGuideSubmissionAtom)
+  const isSubmitting = useAtomValue(isSubmittingDeploymentGuideAtom)
+  const isSkippingDeployment = useAtomValue(isCreatingReleaseOnlyAtom)
+  const label = isSkippingDeployment
+    ? t('createGuide.actions.creating')
+    : t('createGuide.actions.skipDeploy')
+
+  async function handleSkipDeployment() {
+    if (!canSkipDeployment)
+      return
+
+    try {
+      const appInstanceId = await submitCreateDeploymentGuide({ deployToEnvironment: false })
+      if (appInstanceId)
+        router.push(`/deployments/${appInstanceId}/overview`)
+    }
+    catch (error) {
+      await showSubmissionError({
+        error,
+        fallbackMessage: t('createGuide.errors.createReleaseFailed'),
+        unsupportedDslModeMessage: t('createGuide.dsl.unsupportedMode'),
+      })
+    }
+  }
+
+  return (
+    <Button type="button" variant="secondary" disabled={!canSkipDeployment || isSubmitting} onClick={handleSkipDeployment}>
+      {label}
+    </Button>
+  )
+}
+
+export function TargetDeployButton() {
+  const { t } = useTranslation('deployments')
+  const router = useRouter()
+  const canDeploy = useAtomValue(canDeployAtom)
+  const submitCreateDeploymentGuide = useSetAtom(createDeploymentGuideSubmissionAtom)
+  const isSubmitting = useAtomValue(isSubmittingDeploymentGuideAtom)
+  const isSkippingDeployment = useAtomValue(isCreatingReleaseOnlyAtom)
+  const label = isSubmitting && !isSkippingDeployment
+    ? t('createGuide.actions.deploying')
+    : t('createGuide.actions.createAndDeploy')
+
+  async function handleDeploy() {
+    if (!canDeploy)
+      return
+
+    try {
+      const appInstanceId = await submitCreateDeploymentGuide({ deployToEnvironment: true })
+      if (appInstanceId)
+        router.push(`/deployments/${appInstanceId}/overview`)
+    }
+    catch (error) {
+      await showSubmissionError({
+        error,
+        fallbackMessage: t('createGuide.errors.deployFailed'),
+        unsupportedDslModeMessage: t('createGuide.dsl.unsupportedMode'),
+      })
+    }
+  }
+
+  return (
+    <Button type="button" variant="primary" disabled={!canDeploy || isSubmitting} onClick={handleDeploy}>
+      {label}
+    </Button>
+  )
+}
+
+async function showSubmissionError({
+  error,
+  fallbackMessage,
+  unsupportedDslModeMessage,
+}: {
+  error: unknown
+  fallbackMessage: string
+  unsupportedDslModeMessage: string
+}) {
+  if (error instanceof CreateDeploymentGuideSubmissionBlockedError) {
+    toast.error(error.reason === 'unsupportedDslMode' ? unsupportedDslModeMessage : fallbackMessage)
+    return
+  }
+
+  toast.error(await deploymentErrorMessage(error) || fallbackMessage)
+}
diff --git a/web/features/deployments/create-release/index.tsx b/web/features/deployments/create-release/index.tsx
new file mode 100644
index 00000000000..3bfdde51bcd
--- /dev/null
+++ b/web/features/deployments/create-release/index.tsx
@@ -0,0 +1,72 @@
+'use client'
+
+import type { ButtonProps } from '@langgenius/dify-ui/button'
+import { Button } from '@langgenius/dify-ui/button'
+import { useSetAtom } from 'jotai'
+import { ScopeProvider } from 'jotai-scope'
+import { useTranslation } from 'react-i18next'
+import {
+  createReleaseConfigAtom,
+  createReleaseLocalAtoms,
+  openCreateReleaseDialogAtom,
+} from './state'
+import { CreateReleaseDialog } from './ui/dialog'
+
+function CreateReleaseTrigger({
+  variant,
+  size,
+  label,
+  className,
+}: {
+  variant: ButtonProps['variant']
+  size: ButtonProps['size']
+  label?: string
+  className?: string
+}) {
+  const { t } = useTranslation('deployments')
+  const openDialog = useSetAtom(openCreateReleaseDialogAtom)
+
+  return (
+    <Button
+      size={size}
+      variant={variant}
+      className={className}
+      onClick={openDialog}
+    >
+      {label ?? t('versions.createRelease')}
+    </Button>
+  )
+}
+
+export function CreateReleaseControl({
+  appInstanceId,
+  variant = 'primary',
+  size = 'small',
+  label,
+  className,
+}: {
+  appInstanceId: string
+  variant?: ButtonProps['variant']
+  size?: ButtonProps['size']
+  label?: string
+  className?: string
+}) {
+  return (
+    <ScopeProvider
+      key={appInstanceId}
+      atoms={[
+        [createReleaseConfigAtom, { appInstanceId }],
+        ...createReleaseLocalAtoms,
+      ]}
+      name="CreateRelease"
+    >
+      <CreateReleaseTrigger
+        variant={variant}
+        size={size}
+        label={label}
+        className={className}
+      />
+      <CreateReleaseDialog />
+    </ScopeProvider>
+  )
+}
diff --git a/web/features/deployments/create-release/state/index.ts b/web/features/deployments/create-release/state/index.ts
new file mode 100644
index 00000000000..ee6bcf9d28b
--- /dev/null
+++ b/web/features/deployments/create-release/state/index.ts
@@ -0,0 +1,122 @@
+'use client'
+
+import type { UnsupportedDslNode } from '../../shared/domain/error'
+import type { CreateReleaseForm } from './use-create-release-form'
+import { atom, useAtomValue } from 'jotai'
+import { encodeDslContent, isWorkflowDsl } from '../../shared/domain/dsl'
+
+type CreateReleaseConfig = {
+  appInstanceId: string
+}
+
+export type CreateReleaseDslState = {
+  dslContent: string
+  dslReadError: boolean
+  encodedDslContent: string
+  hasDslContent: boolean
+  isReadingDsl: boolean
+  isWorkflowDslContent: boolean
+}
+
+export const createReleaseConfigAtom = atom<CreateReleaseConfig | undefined>(undefined)
+export const createReleaseDialogOpenAtom = atom(false)
+export const createReleaseFormAtom = atom<CreateReleaseForm | undefined>(undefined)
+export const createReleaseSubmitUnsupportedDslNodesAtom = atom<UnsupportedDslNode[]>([])
+
+const createReleaseDslContentAtom = atom('')
+const createReleaseDslReadErrorAtom = atom(false)
+const createReleaseDslReadingAtom = atom(false)
+const createReleaseDslReadTokenAtom = atom(0)
+
+export const createReleaseLocalAtoms = [
+  createReleaseDialogOpenAtom,
+  createReleaseDslContentAtom,
+  createReleaseDslReadErrorAtom,
+  createReleaseDslReadingAtom,
+  createReleaseDslReadTokenAtom,
+  createReleaseSubmitUnsupportedDslNodesAtom,
+] as const
+
+export const clearCreateReleaseSubmissionErrorAtom = atom(null, (_get, set) => {
+  set(createReleaseSubmitUnsupportedDslNodesAtom, [])
+})
+
+export const resetCreateReleaseDslFileAtom = atom(null, (get, set) => {
+  set(createReleaseDslReadTokenAtom, get(createReleaseDslReadTokenAtom) + 1)
+  set(createReleaseDslContentAtom, '')
+  set(createReleaseDslReadingAtom, false)
+  set(createReleaseDslReadErrorAtom, false)
+})
+
+export const openCreateReleaseDialogAtom = atom(null, (_get, set) => {
+  set(clearCreateReleaseSubmissionErrorAtom)
+  set(resetCreateReleaseDslFileAtom)
+  set(createReleaseDialogOpenAtom, true)
+})
+
+export const closeCreateReleaseDialogAtom = atom(null, (_get, set) => {
+  set(createReleaseDialogOpenAtom, false)
+  set(clearCreateReleaseSubmissionErrorAtom)
+  set(resetCreateReleaseDslFileAtom)
+})
+
+export const selectCreateReleaseDslFileAtom = atom(null, async (get, set, file?: File) => {
+  const readToken = get(createReleaseDslReadTokenAtom) + 1
+  set(createReleaseDslReadTokenAtom, readToken)
+  set(createReleaseDslContentAtom, '')
+  set(createReleaseDslReadingAtom, false)
+  set(createReleaseDslReadErrorAtom, false)
+
+  if (!file)
+    return
+
+  set(createReleaseDslReadingAtom, true)
+  try {
+    const content = await file.text()
+    if (get(createReleaseDslReadTokenAtom) !== readToken)
+      return
+
+    set(createReleaseDslContentAtom, content)
+  }
+  catch {
+    if (get(createReleaseDslReadTokenAtom) !== readToken)
+      return
+
+    set(createReleaseDslReadErrorAtom, true)
+  }
+  finally {
+    if (get(createReleaseDslReadTokenAtom) === readToken)
+      set(createReleaseDslReadingAtom, false)
+  }
+})
+
+export const createReleaseDslStateAtom = atom((get): CreateReleaseDslState => {
+  const dslContent = get(createReleaseDslContentAtom)
+  const hasDslContent = Boolean(dslContent.trim())
+  const isWorkflowDslContent = hasDslContent ? isWorkflowDsl(dslContent) : false
+
+  return {
+    dslContent,
+    dslReadError: get(createReleaseDslReadErrorAtom),
+    encodedDslContent: hasDslContent && isWorkflowDslContent ? encodeDslContent(dslContent) : '',
+    hasDslContent,
+    isReadingDsl: get(createReleaseDslReadingAtom),
+    isWorkflowDslContent,
+  }
+})
+
+export function useCreateReleaseConfig() {
+  const config = useAtomValue(createReleaseConfigAtom)
+  if (!config)
+    throw new Error('Missing create release config.')
+
+  return config
+}
+
+export function useCreateReleaseFormApi() {
+  const form = useAtomValue(createReleaseFormAtom)
+  if (!form)
+    throw new Error('Missing create release form.')
+
+  return form
+}
diff --git a/web/features/deployments/create-release/state/types.ts b/web/features/deployments/create-release/state/types.ts
new file mode 100644
index 00000000000..0ebb291ed7c
--- /dev/null
+++ b/web/features/deployments/create-release/state/types.ts
@@ -0,0 +1,19 @@
+import type { SourceAppPickerValue } from '../ui/source-app-picker-value'
+
+export type ReleaseSourceMode = 'sourceApp' | 'dsl'
+
+export type CreateReleaseFormValues = {
+  releaseSourceMode: ReleaseSourceMode
+  sourceApp?: SourceAppPickerValue
+  dslFile?: File
+  releaseName: string
+  releaseDescription: string
+}
+
+export const DEFAULT_CREATE_RELEASE_FORM_VALUES: CreateReleaseFormValues = {
+  releaseSourceMode: 'sourceApp',
+  sourceApp: undefined,
+  dslFile: undefined,
+  releaseName: '',
+  releaseDescription: '',
+}
diff --git a/web/features/deployments/create-release/state/use-create-release-form.ts b/web/features/deployments/create-release/state/use-create-release-form.ts
new file mode 100644
index 00000000000..9e7c3b6e911
--- /dev/null
+++ b/web/features/deployments/create-release/state/use-create-release-form.ts
@@ -0,0 +1,24 @@
+'use client'
+
+import type { CreateReleaseFormValues } from './types'
+import { useForm } from '@tanstack/react-form'
+import { DEFAULT_CREATE_RELEASE_FORM_VALUES } from './types'
+
+export const RELEASE_NAME_REQUIRED_ERROR = 'releaseNameRequired'
+
+export function validateReleaseName({ value }: {
+  value: string
+}) {
+  return value.trim() ? undefined : RELEASE_NAME_REQUIRED_ERROR
+}
+
+export function useCreateReleaseForm({ onSubmit }: {
+  onSubmit: (value: CreateReleaseFormValues) => Promise<void> | void
+}) {
+  return useForm({
+    defaultValues: DEFAULT_CREATE_RELEASE_FORM_VALUES,
+    onSubmit: ({ value }) => onSubmit(value),
+  })
+}
+
+export type CreateReleaseForm = ReturnType<typeof useCreateReleaseForm>
diff --git a/web/features/deployments/create-release/ui/actions.tsx b/web/features/deployments/create-release/ui/actions.tsx
new file mode 100644
index 00000000000..cd2eee506ef
--- /dev/null
+++ b/web/features/deployments/create-release/ui/actions.tsx
@@ -0,0 +1,91 @@
+'use client'
+
+import type { CreateReleaseFormValues } from '../state/types'
+import { Button } from '@langgenius/dify-ui/button'
+import { useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import {
+  closeCreateReleaseDialogAtom,
+  useCreateReleaseFormApi,
+} from '../state'
+import {
+  createReleaseReadiness,
+  useCreateReleaseSourceSelection,
+  useReleaseContentCheck,
+} from './use-release-content-check'
+
+export function CreateReleaseActions() {
+  const form = useCreateReleaseFormApi()
+
+  return (
+    <form.Subscribe selector={state => ({
+      isSubmitting: state.isSubmitting,
+      values: state.values,
+    })}
+    >
+      {({ isSubmitting, values }) => (
+        <CreateReleaseActionsContent
+          formValues={values}
+          isSubmitting={isSubmitting}
+        />
+      )}
+    </form.Subscribe>
+  )
+}
+
+function CreateReleaseActionsContent({
+  formValues,
+  isSubmitting,
+}: {
+  formValues: CreateReleaseFormValues
+  isSubmitting: boolean
+}) {
+  const { t } = useTranslation('deployments')
+  const closeDialog = useSetAtom(closeCreateReleaseDialogAtom)
+  const sourceSelection = useCreateReleaseSourceSelection(formValues)
+  const releaseContent = useReleaseContentCheck(sourceSelection)
+  const { canCreate, isCheckingReleaseContent } = createReleaseReadiness({
+    formValues,
+    isSubmitting,
+    releaseContent,
+  })
+
+  function requestClose() {
+    if (isSubmitting)
+      return
+
+    closeDialog()
+  }
+
+  return (
+    <div className="flex items-center justify-end gap-4 border-t border-divider-subtle bg-background-default-subtle px-6 py-4">
+      <div className="flex shrink-0 justify-end gap-2">
+        <Button
+          type="button"
+          variant="secondary"
+          disabled={isSubmitting}
+          onPointerDown={(event) => {
+            event.preventDefault()
+            event.stopPropagation()
+            requestClose()
+          }}
+          onClick={(event) => {
+            event.preventDefault()
+            event.stopPropagation()
+            requestClose()
+          }}
+        >
+          {t('versions.cancelCreate')}
+        </Button>
+        <Button
+          type="submit"
+          variant="primary"
+          className="min-w-22"
+          disabled={!canCreate}
+        >
+          {isSubmitting ? t('versions.creating') : isCheckingReleaseContent ? t('versions.checkingReleaseContent') : t('versions.create')}
+        </Button>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/deployments/create-release/ui/content-feedback.tsx b/web/features/deployments/create-release/ui/content-feedback.tsx
new file mode 100644
index 00000000000..24e4a573744
--- /dev/null
+++ b/web/features/deployments/create-release/ui/content-feedback.tsx
@@ -0,0 +1,63 @@
+'use client'
+
+import type { CreateReleaseFormValues } from '../state/types'
+import { useAtomValue } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import { UnsupportedDslNodesAlert } from '../../components/unsupported-dsl-nodes-alert'
+import {
+  createReleaseSubmitUnsupportedDslNodesAtom,
+  useCreateReleaseFormApi,
+} from '../state'
+import {
+  useCreateReleaseSourceSelection,
+  useReleaseContentCheck,
+} from './use-release-content-check'
+
+export function ReleaseContentFeedback() {
+  const form = useCreateReleaseFormApi()
+
+  return (
+    <form.Subscribe selector={state => state.values}>
+      {formValues => <ReleaseContentFeedbackContent formValues={formValues} />}
+    </form.Subscribe>
+  )
+}
+
+function ReleaseContentFeedbackContent({ formValues }: {
+  formValues: CreateReleaseFormValues
+}) {
+  const { t } = useTranslation('deployments')
+  const sourceSelection = useCreateReleaseSourceSelection(formValues)
+  const releaseContent = useReleaseContentCheck(sourceSelection)
+  const submitUnsupportedDslNodes = useAtomValue(createReleaseSubmitUnsupportedDslNodesAtom)
+  // Precheck reports unsupported nodes at pick time; the post-submit atom stays
+  // as the TOCTOU fallback when the content changes server-side between
+  // precheck and create.
+  const unsupportedDslNodes = releaseContent.unsupportedNodes.length > 0
+    ? releaseContent.unsupportedNodes
+    : submitUnsupportedDslNodes
+
+  return (
+    <>
+      <UnsupportedDslNodesAlert nodes={unsupportedDslNodes} />
+
+      {releaseContent.isCheckingReleaseContent && (
+        <div className="rounded-lg border border-divider-subtle bg-background-default-subtle px-3 py-2 system-sm-regular text-text-tertiary">
+          {t('versions.checkingReleaseContent')}
+        </div>
+      )}
+
+      {releaseContent.matchedRelease && (
+        <div role="alert" className="rounded-lg border border-util-colors-warning-warning-200 bg-util-colors-warning-warning-50 px-3 py-2 system-sm-regular text-util-colors-warning-warning-700">
+          {t('versions.releaseAlreadyExists', { name: releaseContent.matchedRelease.displayName })}
+        </div>
+      )}
+
+      {releaseContent.releaseContentCheckFailed && (
+        <div role="alert" className="rounded-lg border border-util-colors-red-red-200 bg-util-colors-red-red-50 px-3 py-2 system-sm-regular text-util-colors-red-red-700">
+          {t('versions.releaseContentCheckFailed')}
+        </div>
+      )}
+    </>
+  )
+}
diff --git a/web/features/deployments/create-release/ui/dialog.tsx b/web/features/deployments/create-release/ui/dialog.tsx
new file mode 100644
index 00000000000..501600e73ac
--- /dev/null
+++ b/web/features/deployments/create-release/ui/dialog.tsx
@@ -0,0 +1,203 @@
+'use client'
+
+import type { CreateReleaseFormValues } from '../state/types'
+import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { skipToken, useQuery } from '@tanstack/react-query'
+import { useAtomValue, useSetAtom } from 'jotai'
+import { ScopeProvider } from 'jotai-scope'
+import { useEffect, useRef } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import {
+  closeCreateReleaseDialogAtom,
+  createReleaseDialogOpenAtom,
+  createReleaseFormAtom,
+  openCreateReleaseDialogAtom,
+  useCreateReleaseConfig,
+  useCreateReleaseFormApi,
+} from '../state'
+import { useCreateReleaseForm } from '../state/use-create-release-form'
+import { CreateReleaseActions } from './actions'
+import { ReleaseContentFeedback } from './content-feedback'
+import { ReleaseMetadataFields } from './metadata-fields'
+import { workflowSourceAppPickerValue } from './source-app-picker-value'
+import { ReleaseSourceSection } from './source-section'
+import { useCreateReleaseSubmission } from './use-create-release-submission'
+
+const DEFAULT_SOURCE_RELEASE_PAGE_SIZE = 1
+
+function CreateReleaseCloseButton({ isSubmitting }: {
+  isSubmitting: boolean
+}) {
+  const closeDialog = useSetAtom(closeCreateReleaseDialogAtom)
+
+  function requestClose() {
+    if (isSubmitting)
+      return
+
+    closeDialog()
+  }
+
+  return (
+    <DialogCloseButton
+      type="button"
+      disabled={isSubmitting}
+      onPointerDown={(event) => {
+        event.preventDefault()
+        event.stopPropagation()
+        requestClose()
+      }}
+      onClick={(event) => {
+        event.preventDefault()
+        event.stopPropagation()
+        requestClose()
+      }}
+    />
+  )
+}
+
+function CreateReleaseDefaultSourceApp({ formValues }: {
+  formValues: CreateReleaseFormValues
+}) {
+  const { appInstanceId } = useCreateReleaseConfig()
+  const form = useCreateReleaseFormApi()
+  const isDialogOpen = useAtomValue(createReleaseDialogOpenAtom)
+  const latestReleaseQuery = useQuery(consoleQuery.enterprise.releaseService.listReleases.queryOptions({
+    input: {
+      params: { appInstanceId },
+      query: {
+        pageNumber: 1,
+        resultsPerPage: DEFAULT_SOURCE_RELEASE_PAGE_SIZE,
+      },
+    },
+    enabled: isDialogOpen,
+  }))
+  const latestSourceAppId = latestReleaseQuery.data?.releases[0]?.sourceAppId
+  const defaultSourceAppInput = isDialogOpen && latestSourceAppId
+    ? { params: { app_id: latestSourceAppId } }
+    : undefined
+  const defaultSourceAppQuery = useQuery(defaultSourceAppInput
+    ? consoleQuery.apps.byAppId.get.queryOptions({
+        input: defaultSourceAppInput,
+      })
+    : {
+        queryFn: skipToken,
+        queryKey: ['create-release', 'default-source-app'],
+      })
+  const defaultSourceApp = latestSourceAppId
+    ? workflowSourceAppPickerValue(defaultSourceAppQuery.data, latestSourceAppId)
+    : undefined
+
+  useEffect(() => {
+    if (!isDialogOpen || formValues.releaseSourceMode !== 'sourceApp' || formValues.sourceApp || !defaultSourceApp)
+      return
+
+    form.setFieldValue('sourceApp', defaultSourceApp)
+  }, [defaultSourceApp, form, formValues.releaseSourceMode, formValues.sourceApp, isDialogOpen])
+
+  return null
+}
+
+function CreateReleaseDialogForm() {
+  const submitReleaseRef = useRef<(value: CreateReleaseFormValues) => Promise<void> | void>(() => undefined)
+  const form = useCreateReleaseForm({
+    onSubmit: value => submitReleaseRef.current(value),
+  })
+
+  return (
+    <ScopeProvider atoms={[[createReleaseFormAtom, form]]}>
+      <form.Subscribe selector={state => ({
+        isSubmitting: state.isSubmitting,
+        values: state.values,
+      })}
+      >
+        {({ isSubmitting, values }) => (
+          <CreateReleaseDialogSurface
+            formValues={values}
+            isSubmitting={isSubmitting}
+            submitReleaseRef={submitReleaseRef}
+          />
+        )}
+      </form.Subscribe>
+    </ScopeProvider>
+  )
+}
+
+function CreateReleaseDialogSurface({
+  formValues,
+  isSubmitting,
+  submitReleaseRef,
+}: {
+  formValues: CreateReleaseFormValues
+  isSubmitting: boolean
+  submitReleaseRef: {
+    current: (value: CreateReleaseFormValues) => Promise<void> | void
+  }
+}) {
+  const open = useAtomValue(createReleaseDialogOpenAtom)
+  const openDialog = useSetAtom(openCreateReleaseDialogAtom)
+  const closeDialog = useSetAtom(closeCreateReleaseDialogAtom)
+  const { t } = useTranslation('deployments')
+  const form = useCreateReleaseFormApi()
+  const submission = useCreateReleaseSubmission(formValues)
+  submitReleaseRef.current = submission.createRelease
+
+  function handleDialogOpenChange(nextOpen: boolean) {
+    if (nextOpen) {
+      openDialog()
+      return
+    }
+
+    if (!isSubmitting)
+      closeDialog()
+  }
+
+  return (
+    <Dialog
+      open={open}
+      onOpenChange={handleDialogOpenChange}
+    >
+      <DialogContent className="top-[18dvh] w-140 max-w-[calc(100vw-32px)] translate-y-0 overflow-hidden p-0">
+        <CreateReleaseDefaultSourceApp formValues={formValues} />
+        <CreateReleaseCloseButton isSubmitting={isSubmitting} />
+        <form
+          noValidate
+          autoComplete="off"
+          onSubmit={(event) => {
+            event.preventDefault()
+            event.stopPropagation()
+            void form.handleSubmit()
+          }}
+        >
+          <div className="border-b border-divider-subtle px-6 py-5 pr-14">
+            <div className="min-w-0">
+              <DialogTitle className="title-xl-semi-bold text-text-primary">
+                {t('versions.createRelease')}
+              </DialogTitle>
+              <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+                {t('versions.createReleaseDescription')}
+              </DialogDescription>
+            </div>
+          </div>
+
+          <div className="flex flex-col gap-5 px-6 py-5">
+            <ReleaseSourceSection />
+            <ReleaseContentFeedback />
+            <ReleaseMetadataFields />
+          </div>
+
+          <CreateReleaseActions />
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+export function CreateReleaseDialog() {
+  const open = useAtomValue(createReleaseDialogOpenAtom)
+
+  if (!open)
+    return null
+
+  return <CreateReleaseDialogForm />
+}
diff --git a/web/features/deployments/create-release/ui/metadata-fields.tsx b/web/features/deployments/create-release/ui/metadata-fields.tsx
new file mode 100644
index 00000000000..ee82c0bf18f
--- /dev/null
+++ b/web/features/deployments/create-release/ui/metadata-fields.tsx
@@ -0,0 +1,106 @@
+'use client'
+
+import { cn } from '@langgenius/dify-ui/cn'
+import { Input } from '@langgenius/dify-ui/input'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { useEffect, useRef } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useCreateReleaseFormApi } from '../state'
+import {
+  RELEASE_NAME_REQUIRED_ERROR,
+  validateReleaseName,
+} from '../state/use-create-release-form'
+
+const DESCRIPTION_MAX_LENGTH = 512
+const DESCRIPTION_WARN_THRESHOLD = 460
+
+function hasReleaseNameRequiredError(errors: unknown[]) {
+  return errors.includes(RELEASE_NAME_REQUIRED_ERROR)
+}
+
+export function ReleaseMetadataFields() {
+  const { t } = useTranslation('deployments')
+  const form = useCreateReleaseFormApi()
+  const releaseNameInputRef = useRef<HTMLInputElement>(null)
+
+  useEffect(() => {
+    releaseNameInputRef.current?.focus()
+  }, [])
+
+  return (
+    <>
+      <form.Field
+        name="releaseName"
+        validators={{
+          onBlur: validateReleaseName,
+          onChange: validateReleaseName,
+          onSubmit: validateReleaseName,
+        }}
+      >
+        {field => (
+          <div className="flex flex-col gap-2">
+            <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="release-name">
+              {t('versions.releaseNameLabel')}
+            </label>
+            <Input
+              ref={releaseNameInputRef}
+              id="release-name"
+              name="releaseName"
+              placeholder={t('versions.releaseNamePlaceholder')}
+              maxLength={128}
+              autoComplete="off"
+              value={field.state.value}
+              aria-invalid={hasReleaseNameRequiredError(field.state.meta.errors) || undefined}
+              aria-describedby={hasReleaseNameRequiredError(field.state.meta.errors) ? 'release-name-error' : undefined}
+              onBlur={field.handleBlur}
+              onChange={event => field.handleChange(event.target.value)}
+              className="h-9"
+            />
+            {hasReleaseNameRequiredError(field.state.meta.errors) && (
+              <div id="release-name-error" role="alert" className="system-xs-regular text-text-destructive">
+                {t('versions.releaseNameRequired')}
+              </div>
+            )}
+          </div>
+        )}
+      </form.Field>
+
+      <form.Field name="releaseDescription">
+        {field => (
+          <div className="flex flex-col gap-2">
+            <div className="flex items-center justify-between gap-3">
+              <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="release-description">
+                {t('versions.releaseDescriptionLabel')}
+              </label>
+              <div className="flex items-center gap-2">
+                <span className="system-xs-regular text-text-quaternary">
+                  {t('versions.optional')}
+                </span>
+                <span
+                  className={cn(
+                    'system-xs-regular tabular-nums',
+                    field.state.value.length >= DESCRIPTION_WARN_THRESHOLD ? 'text-util-colors-warning-warning-700' : 'text-text-quaternary',
+                  )}
+                >
+                  {field.state.value.length}
+                  /
+                  {DESCRIPTION_MAX_LENGTH}
+                </span>
+              </div>
+            </div>
+            <Textarea
+              id="release-description"
+              name="releaseDescription"
+              placeholder={t('versions.releaseDescriptionPlaceholder')}
+              maxLength={DESCRIPTION_MAX_LENGTH}
+              autoComplete="off"
+              value={field.state.value}
+              onValueChange={field.handleChange}
+              className="min-h-24 resize-none"
+            />
+          </div>
+        )}
+      </form.Field>
+    </>
+  )
+}
diff --git a/web/features/deployments/create-release/ui/source-app-mode.ts b/web/features/deployments/create-release/ui/source-app-mode.ts
new file mode 100644
index 00000000000..478417e92a3
--- /dev/null
+++ b/web/features/deployments/create-release/ui/source-app-mode.ts
@@ -0,0 +1,11 @@
+import { AppModeEnum } from '@/types/app'
+
+type WorkflowAppMode = Extract<AppModeEnum, 'workflow'>
+
+export function isWorkflowAppMode(mode?: string | null): mode is WorkflowAppMode {
+  return mode === AppModeEnum.WORKFLOW
+}
+
+export function isWorkflowApp<T extends { mode?: string | null }>(app?: T): app is T & { mode: WorkflowAppMode } {
+  return isWorkflowAppMode(app?.mode)
+}
diff --git a/web/features/deployments/create-release/ui/source-app-picker-value.ts b/web/features/deployments/create-release/ui/source-app-picker-value.ts
new file mode 100644
index 00000000000..dee3375d784
--- /dev/null
+++ b/web/features/deployments/create-release/ui/source-app-picker-value.ts
@@ -0,0 +1,23 @@
+import type { App } from '@/types/app'
+import { isWorkflowAppMode } from './source-app-mode'
+
+export type SourceAppPickerValue = Pick<App, 'id' | 'name'> & Partial<Pick<App, 'icon_type' | 'icon' | 'icon_background' | 'icon_url' | 'mode'>>
+
+export function workflowSourceAppPickerValue(value: unknown, fallbackId: string): SourceAppPickerValue | undefined {
+  if (!value || typeof value !== 'object')
+    return undefined
+
+  const record = value as Record<string, unknown>
+  const mode = typeof record.mode === 'string' ? record.mode : undefined
+  if (!isWorkflowAppMode(mode))
+    return undefined
+
+  const id = typeof record.id === 'string' && record.id ? record.id : fallbackId
+  const name = typeof record.name === 'string' && record.name ? record.name : id
+
+  return {
+    id,
+    name,
+    mode,
+  }
+}
diff --git a/web/features/deployments/create-release/ui/source-app-picker.tsx b/web/features/deployments/create-release/ui/source-app-picker.tsx
new file mode 100644
index 00000000000..93b99e7fac2
--- /dev/null
+++ b/web/features/deployments/create-release/ui/source-app-picker.tsx
@@ -0,0 +1,241 @@
+'use client'
+import type { SourceAppPickerValue } from './source-app-picker-value'
+import type { App } from '@/types/app'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  Combobox,
+  ComboboxContent,
+  ComboboxEmpty,
+  ComboboxInput,
+  ComboboxInputGroup,
+  ComboboxItem,
+  ComboboxItemText,
+  ComboboxList,
+  ComboboxTrigger,
+} from '@langgenius/dify-ui/combobox'
+import { keepPreviousData, useInfiniteQuery } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import { consoleQuery } from '@/service/client'
+import { AppModeEnum } from '@/types/app'
+import { TitleTooltip } from '../../components/title-tooltip'
+import { isWorkflowApp } from './source-app-mode'
+
+const SOURCE_APP_PAGE_SIZE = 20
+const SOURCE_APP_PICKER_SKELETON_KEYS = ['first-source-app', 'second-source-app', 'third-source-app']
+
+function sourceAppSearchText(app: App) {
+  return `${app.name} ${app.id}`.toLowerCase()
+}
+
+function SourceAppTrigger({ open, app }: {
+  open: boolean
+  app?: SourceAppPickerValue
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <span
+      className={cn(
+        'group flex h-10 cursor-pointer items-center gap-2 rounded-lg border border-transparent bg-components-input-bg-normal px-3 text-left hover:border-components-input-border-hover hover:bg-components-input-bg-hover',
+        open && 'border-components-input-border-active bg-components-input-bg-active shadow-xs',
+        app && 'pl-2',
+      )}
+    >
+      {app && (
+        <AppIcon
+          className="shrink-0"
+          size="xs"
+          iconType={app.icon_type}
+          icon={app.icon}
+          background={app.icon_background}
+          imageUrl={app.icon_url}
+        />
+      )}
+      <TitleTooltip content={app?.name}>
+        <span
+          className={cn(
+            'min-w-0 grow truncate',
+            app
+              ? 'system-sm-medium text-components-input-text-filled'
+              : 'system-sm-regular text-components-input-text-placeholder',
+          )}
+        >
+          {app?.name ?? t('createModal.appPickerPlaceholder')}
+        </span>
+      </TitleTooltip>
+      <span
+        className={cn(
+          'i-ri-arrow-down-s-line size-4 shrink-0 text-text-quaternary group-hover:text-text-secondary',
+          open && 'text-text-secondary',
+        )}
+        aria-hidden="true"
+      />
+    </span>
+  )
+}
+
+function SourceAppOption({ app }: {
+  app: App
+}) {
+  return (
+    <ComboboxItem
+      value={app}
+      className="mx-0 grid-cols-[minmax(0,1fr)] gap-3 py-1 pr-3 pl-2"
+    >
+      <ComboboxItemText className="flex min-w-0 items-center gap-3 px-0">
+        <AppIcon
+          className="shrink-0"
+          size="xs"
+          iconType={app.icon_type}
+          icon={app.icon}
+          background={app.icon_background}
+          imageUrl={app.icon_url}
+        />
+        <TitleTooltip content={`${app.name} (${app.id})`}>
+          <span className="flex min-w-0 grow items-center gap-1 truncate system-sm-medium text-components-input-text-filled">
+            <span className="truncate">{app.name}</span>
+            <span className="shrink-0 text-text-tertiary">
+              (
+              {app.id.slice(0, 8)}
+              )
+            </span>
+          </span>
+        </TitleTooltip>
+      </ComboboxItemText>
+    </ComboboxItem>
+  )
+}
+
+function SourceAppPickerSkeleton() {
+  return (
+    <div className="flex flex-col gap-2 px-3 py-3">
+      {SOURCE_APP_PICKER_SKELETON_KEYS.map(key => (
+        <SkeletonRow key={key} className="h-7 gap-3">
+          <SkeletonRectangle className="my-0 size-5 animate-pulse rounded-md" />
+          <SkeletonRectangle className="h-3 w-32 animate-pulse" />
+        </SkeletonRow>
+      ))}
+    </div>
+  )
+}
+
+export function SourceAppPicker({ value, onChange, ariaLabel }: {
+  value?: SourceAppPickerValue
+  onChange: (app: App) => void
+  ariaLabel?: string
+}) {
+  const { t } = useTranslation('deployments')
+  const [isShow, setIsShow] = useState(false)
+  const [searchText, setSearchText] = useState('')
+
+  const {
+    data,
+    isLoading,
+    isFetchingNextPage,
+    fetchNextPage,
+    hasNextPage,
+  } = useInfiniteQuery({
+    ...consoleQuery.apps.list.infiniteOptions({
+      input: pageParam => ({
+        query: {
+          page: Number(pageParam),
+          limit: SOURCE_APP_PAGE_SIZE,
+          name: searchText,
+          mode: AppModeEnum.WORKFLOW,
+        },
+      }),
+      getNextPageParam: lastPage => lastPage.has_more ? lastPage.page + 1 : undefined,
+      initialPageParam: 1,
+      placeholderData: keepPreviousData,
+    }),
+  })
+
+  const apps = data?.pages.flatMap(page => page.data).filter(isWorkflowApp) ?? []
+
+  return (
+    <Combobox<App>
+      items={apps}
+      open={isShow}
+      inputValue={searchText}
+      onOpenChange={setIsShow}
+      onInputValueChange={setSearchText}
+      onValueChange={(app) => {
+        if (!app)
+          return
+        onChange(app)
+        setIsShow(false)
+      }}
+      itemToStringLabel={(app) => {
+        if (!app)
+          return ''
+
+        return app.name
+      }}
+      itemToStringValue={(app) => {
+        if (!app)
+          return ''
+
+        return app.id
+      }}
+      filter={(app, query) => sourceAppSearchText(app).includes(query.toLowerCase())}
+      disabled={false}
+    >
+      <ComboboxTrigger
+        aria-label={ariaLabel ?? t('createModal.sourceApp')}
+        icon={false}
+        className="block h-auto w-full border-0 bg-transparent p-0 text-left hover:bg-transparent focus-visible:bg-transparent focus-visible:ring-0 data-open:bg-transparent"
+      >
+        <SourceAppTrigger open={isShow} app={value} />
+      </ComboboxTrigger>
+      <ComboboxContent
+        placement="bottom-start"
+        sideOffset={4}
+        popupClassName="border-0 bg-transparent p-0 shadow-none backdrop-blur-none"
+      >
+        <div className="relative flex max-h-100 min-h-20 w-89 flex-col rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg backdrop-blur-xs">
+          <div className="p-2 pb-1">
+            <ComboboxInputGroup className="h-8 min-h-8 px-2">
+              <span className="i-ri-search-line size-4 shrink-0 text-text-tertiary" aria-hidden="true" />
+              <ComboboxInput
+                aria-label={t('createModal.appSearchPlaceholder')}
+                placeholder={t('createModal.appSearchPlaceholder')}
+                className="block h-4.5 grow px-1 py-0 text-[13px] text-text-primary"
+              />
+            </ComboboxInputGroup>
+          </div>
+          <div className="min-h-0 flex-1 overflow-y-auto p-1">
+            {(isLoading || isFetchingNextPage) && apps.length === 0 && <SourceAppPickerSkeleton />}
+            <ComboboxList className="max-h-none p-0">
+              {(app: App) => (
+                <SourceAppOption key={app.id} app={app} />
+              )}
+            </ComboboxList>
+            {!(isLoading || isFetchingNextPage) && (
+              <ComboboxEmpty>
+                {t('createModal.appSearchEmpty')}
+              </ComboboxEmpty>
+            )}
+            {hasNextPage && (
+              <div className="flex justify-center px-3 py-2">
+                <Button
+                  type="button"
+                  size="small"
+                  disabled={isFetchingNextPage}
+                  onClick={() => {
+                    void fetchNextPage()
+                  }}
+                >
+                  {isFetchingNextPage ? t('createModal.loadingApps') : t('createModal.loadMoreApps')}
+                </Button>
+              </div>
+            )}
+          </div>
+        </div>
+      </ComboboxContent>
+    </Combobox>
+  )
+}
diff --git a/web/features/deployments/create-release/ui/source-section.tsx b/web/features/deployments/create-release/ui/source-section.tsx
new file mode 100644
index 00000000000..59d95a2f69e
--- /dev/null
+++ b/web/features/deployments/create-release/ui/source-section.tsx
@@ -0,0 +1,153 @@
+'use client'
+
+import type { ReleaseSourceMode } from '../state/types'
+import { SegmentedControl, SegmentedControlItem } from '@langgenius/dify-ui/segmented-control'
+import { useAtomValue, useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import Uploader from '@/app/components/app/create-from-dsl-modal/uploader'
+import {
+  clearCreateReleaseSubmissionErrorAtom,
+  createReleaseDslStateAtom,
+  resetCreateReleaseDslFileAtom,
+  selectCreateReleaseDslFileAtom,
+  useCreateReleaseFormApi,
+} from '../state'
+import { SourceAppPicker } from './source-app-picker'
+
+function selectedReleaseSourceMode(value: readonly ReleaseSourceMode[] | undefined) {
+  return value?.[0]
+}
+
+export function ReleaseSourceSection() {
+  const { t } = useTranslation('deployments')
+  const form = useCreateReleaseFormApi()
+  const resetDslFile = useSetAtom(resetCreateReleaseDslFileAtom)
+  const clearSubmissionError = useSetAtom(clearCreateReleaseSubmissionErrorAtom)
+
+  return (
+    <form.Field name="releaseSourceMode">
+      {modeField => (
+        <div className="flex flex-col gap-2">
+          <div className="flex flex-wrap items-center justify-between gap-3">
+            <label id="release-source-mode-label" className="system-xs-medium-uppercase text-text-tertiary">
+              {t('versions.releaseSourceLabel')}
+            </label>
+            <SegmentedControl<ReleaseSourceMode>
+              aria-labelledby="release-source-mode-label"
+              value={[modeField.state.value]}
+              onValueChange={(value) => {
+                const nextMode = selectedReleaseSourceMode(value)
+                if (!nextMode || nextMode === modeField.state.value)
+                  return
+
+                clearSubmissionError()
+                modeField.handleChange(nextMode)
+                if (nextMode === 'sourceApp') {
+                  form.setFieldValue('dslFile', undefined)
+                  resetDslFile()
+                }
+                else {
+                  form.setFieldValue('sourceApp', undefined)
+                }
+              }}
+              className="shrink-0"
+            >
+              <SegmentedControlItem value="sourceApp" className="gap-1.5">
+                <span className="i-ri-apps-2-line size-4 shrink-0" aria-hidden="true" />
+                <span>{t('versions.sourceAppOption')}</span>
+              </SegmentedControlItem>
+              <SegmentedControlItem value="dsl" className="gap-1.5">
+                <span className="i-ri-upload-cloud-2-line size-4 shrink-0" aria-hidden="true" />
+                <span>{t('versions.manualDslOption')}</span>
+              </SegmentedControlItem>
+            </SegmentedControl>
+          </div>
+
+          <div className="min-h-12">
+            {modeField.state.value === 'sourceApp'
+              ? <SourceAppField />
+              : <DslFileField />}
+          </div>
+        </div>
+      )}
+    </form.Field>
+  )
+}
+
+function SourceAppField() {
+  const { t } = useTranslation('deployments')
+  const form = useCreateReleaseFormApi()
+  const clearSubmissionError = useSetAtom(clearCreateReleaseSubmissionErrorAtom)
+
+  return (
+    <form.Field name="sourceApp">
+      {field => (
+        <div className="flex min-h-12 items-center">
+          <SourceAppPicker
+            value={field.state.value}
+            onChange={(app) => {
+              field.handleChange(app)
+              clearSubmissionError()
+            }}
+            ariaLabel={t('versions.sourceAppOption')}
+          />
+        </div>
+      )}
+    </form.Field>
+  )
+}
+
+function DslFileField() {
+  const { t } = useTranslation('deployments')
+  const form = useCreateReleaseFormApi()
+  const dslState = useAtomValue(createReleaseDslStateAtom)
+  const clearSubmissionError = useSetAtom(clearCreateReleaseSubmissionErrorAtom)
+  const selectDslFile = useSetAtom(selectCreateReleaseDslFileAtom)
+
+  return (
+    <form.Field name="dslFile">
+      {field => (
+        <div className="flex min-h-12 flex-col gap-2">
+          <Uploader
+            file={field.state.value}
+            updateFile={(file) => {
+              field.handleChange(file)
+              clearSubmissionError()
+              void selectDslFile(file)
+            }}
+            className="mt-0"
+          />
+          {dslState.isReadingDsl && (
+            <div className="system-xs-regular text-text-tertiary">
+              {t('versions.dslReading')}
+            </div>
+          )}
+          {dslState.dslReadError && (
+            <div role="alert" className="system-xs-regular text-util-colors-red-red-600">
+              {t('versions.dslReadFailed')}
+            </div>
+          )}
+          <DslUnsupportedModeError />
+        </div>
+      )}
+    </form.Field>
+  )
+}
+
+function DslUnsupportedModeError() {
+  const { t } = useTranslation('deployments')
+  const dslState = useAtomValue(createReleaseDslStateAtom)
+  const hasUnsupportedDslMode = dslState.hasDslContent
+    && !dslState.isReadingDsl
+    && !dslState.dslReadError
+    && !dslState.isWorkflowDslContent
+
+  if (!hasUnsupportedDslMode)
+    return null
+
+  return (
+    <div role="alert" className="system-xs-regular text-util-colors-red-red-600">
+      {t('versions.dslUnsupportedMode')}
+    </div>
+  )
+}
diff --git a/web/features/deployments/create-release/ui/use-create-release-submission.ts b/web/features/deployments/create-release/ui/use-create-release-submission.ts
new file mode 100644
index 00000000000..7c220255ef2
--- /dev/null
+++ b/web/features/deployments/create-release/ui/use-create-release-submission.ts
@@ -0,0 +1,109 @@
+'use client'
+
+import type { CreateReleaseResponse } from '@dify/contracts/enterprise/types.gen'
+import type { CreateReleaseFormValues } from '../state/types'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { deploymentErrorMessage, unsupportedDslNodeError } from '../../shared/domain/error'
+import {
+  clearCreateReleaseSubmissionErrorAtom,
+  closeCreateReleaseDialogAtom,
+  createReleaseSubmitUnsupportedDslNodesAtom,
+  useCreateReleaseConfig,
+} from '../state'
+import {
+  canCheckReleaseSourceContent,
+  useCreateReleaseSourceSelection,
+  useReleaseContentCheck,
+} from './use-release-content-check'
+
+export function useCreateReleaseSubmission(formValues: CreateReleaseFormValues) {
+  const { t } = useTranslation('deployments')
+  const { appInstanceId } = useCreateReleaseConfig()
+  const sourceSelection = useCreateReleaseSourceSelection(formValues)
+  const releaseContent = useReleaseContentCheck(sourceSelection)
+  const closeDialog = useSetAtom(closeCreateReleaseDialogAtom)
+  const createReleaseMutation = useMutation(consoleQuery.enterprise.releaseService.createRelease.mutationOptions())
+  const clearSubmitError = useSetAtom(clearCreateReleaseSubmissionErrorAtom)
+  const setUnsupportedDslNodes = useSetAtom(createReleaseSubmitUnsupportedDslNodesAtom)
+
+  function clearSubmissionError() {
+    createReleaseMutation.reset()
+    clearSubmitError()
+  }
+
+  function handleSuccess(response: CreateReleaseResponse) {
+    const createdName = response.release.displayName
+    toast.success(t('versions.createSuccess', { name: createdName }))
+    closeDialog()
+  }
+
+  async function handleError(error: unknown) {
+    const unsupportedError = await unsupportedDslNodeError(error)
+    if (unsupportedError?.nodes.length) {
+      setUnsupportedDslNodes(unsupportedError.nodes)
+      return
+    }
+
+    const message = await deploymentErrorMessage(error)
+    toast.error(message || t('versions.createFailed'))
+  }
+
+  async function createRelease(value: CreateReleaseFormValues) {
+    if (releaseContent.isCheckingReleaseContent)
+      return
+
+    const submittedReleaseName = value.releaseName.trim()
+    if (!submittedReleaseName)
+      return
+
+    clearSubmissionError()
+    try {
+      if (!canCheckReleaseSourceContent(sourceSelection) || !releaseContent.releaseContentReady)
+        return
+
+      if (value.releaseSourceMode === 'dsl') {
+        if (!sourceSelection.isWorkflowDslContent) {
+          toast.error(t('versions.dslUnsupportedMode'))
+          return
+        }
+
+        const response = await createReleaseMutation.mutateAsync({
+          body: {
+            appInstanceId,
+            dsl: sourceSelection.encodedDslContent,
+            displayName: submittedReleaseName,
+            description: value.releaseDescription.trim() || undefined,
+            createAppInstance: false,
+          },
+        })
+        handleSuccess(response)
+        return
+      }
+
+      if (!sourceSelection.selectedSourceAppId)
+        return
+
+      const response = await createReleaseMutation.mutateAsync({
+        body: {
+          appInstanceId,
+          sourceAppId: sourceSelection.selectedSourceAppId,
+          displayName: submittedReleaseName,
+          description: value.releaseDescription.trim() || undefined,
+          createAppInstance: false,
+        },
+      })
+      handleSuccess(response)
+    }
+    catch (error) {
+      await handleError(error)
+    }
+  }
+
+  return {
+    createRelease,
+  }
+}
diff --git a/web/features/deployments/create-release/ui/use-release-content-check.ts b/web/features/deployments/create-release/ui/use-release-content-check.ts
new file mode 100644
index 00000000000..a903daae143
--- /dev/null
+++ b/web/features/deployments/create-release/ui/use-release-content-check.ts
@@ -0,0 +1,124 @@
+'use client'
+
+import type { CreateReleaseDslState } from '../state'
+import type { CreateReleaseFormValues, ReleaseSourceMode } from '../state/types'
+import { skipToken, useQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
+import { consoleQuery } from '@/service/client'
+import {
+  createReleaseDialogOpenAtom,
+  createReleaseDslStateAtom,
+  useCreateReleaseConfig,
+} from '../state'
+
+export type CreateReleaseSourceSelection = CreateReleaseDslState & {
+  hasUnsupportedDslMode: boolean
+  releaseSourceMode: ReleaseSourceMode
+  selectedSourceAppId?: string
+}
+
+function createReleaseSourceSelection(
+  formValues: CreateReleaseFormValues,
+  dslState: CreateReleaseDslState,
+): CreateReleaseSourceSelection {
+  const hasUnsupportedDslMode = formValues.releaseSourceMode === 'dsl'
+    && dslState.hasDslContent
+    && !dslState.isReadingDsl
+    && !dslState.dslReadError
+    && !dslState.isWorkflowDslContent
+  const selectedSourceAppId = formValues.releaseSourceMode === 'sourceApp' ? formValues.sourceApp?.id : undefined
+
+  return {
+    ...dslState,
+    hasUnsupportedDslMode,
+    releaseSourceMode: formValues.releaseSourceMode,
+    selectedSourceAppId,
+  }
+}
+
+export function canCheckReleaseSourceContent(releaseSource: CreateReleaseSourceSelection) {
+  if (releaseSource.releaseSourceMode === 'sourceApp')
+    return Boolean(releaseSource.selectedSourceAppId)
+
+  return Boolean(
+    releaseSource.hasDslContent
+    && !releaseSource.isReadingDsl
+    && !releaseSource.dslReadError
+    && !releaseSource.hasUnsupportedDslMode,
+  )
+}
+
+export function useReleaseContentCheck(releaseSource: CreateReleaseSourceSelection) {
+  const { appInstanceId } = useCreateReleaseConfig()
+  const isDialogOpen = useAtomValue(createReleaseDialogOpenAtom)
+  const canCheckReleaseContent = isDialogOpen && canCheckReleaseSourceContent(releaseSource)
+  // PrecheckRelease takes exactly one source arm (dsl | sourceAppId).
+  const precheckSource = releaseSource.releaseSourceMode === 'sourceApp'
+    ? (releaseSource.selectedSourceAppId ? { sourceAppId: releaseSource.selectedSourceAppId } : undefined)
+    : { dsl: releaseSource.encodedDslContent }
+  const precheckInput = canCheckReleaseContent && precheckSource
+    ? {
+        body: {
+          appInstanceId,
+          ...precheckSource,
+        },
+      }
+    : undefined
+  const precheckQuery = useQuery({
+    ...(precheckInput
+      ? consoleQuery.enterprise.releaseService.precheckRelease.queryOptions({
+          input: precheckInput,
+        })
+      : {
+          queryFn: skipToken,
+          queryKey: ['create-release', 'release-precheck'],
+        }),
+    retry: false,
+  })
+  const matchedRelease = canCheckReleaseContent ? precheckQuery.data?.matchedRelease : undefined
+  const unsupportedNodes = (canCheckReleaseContent ? precheckQuery.data?.unsupportedNodes : undefined) ?? []
+  const isCheckingReleaseContent = canCheckReleaseContent && (precheckQuery.isLoading || precheckQuery.isFetching)
+  const releaseContentCheckFailed = canCheckReleaseContent && precheckQuery.isError
+  const releaseContentReady = canCheckReleaseContent
+    && precheckQuery.isSuccess
+    && !isCheckingReleaseContent
+    && !releaseContentCheckFailed
+    && Boolean(precheckQuery.data?.canCreate)
+
+  return {
+    isCheckingReleaseContent,
+    matchedRelease,
+    releaseContentCheckFailed,
+    releaseContentReady,
+    unsupportedNodes,
+  }
+}
+
+export type ReleaseContentCheck = ReturnType<typeof useReleaseContentCheck>
+
+export function useCreateReleaseSourceSelection(formValues: CreateReleaseFormValues) {
+  const dslState = useAtomValue(createReleaseDslStateAtom)
+
+  return createReleaseSourceSelection(formValues, dslState)
+}
+
+export function createReleaseReadiness({
+  formValues,
+  isSubmitting,
+  releaseContent,
+}: {
+  formValues: CreateReleaseFormValues
+  isSubmitting: boolean
+  releaseContent: ReleaseContentCheck
+}) {
+  const canCreate = Boolean(
+    formValues.releaseName.trim()
+    && releaseContent.releaseContentReady
+    && !isSubmitting,
+  )
+
+  return {
+    canCreate,
+    isCheckingReleaseContent: releaseContent.isCheckingReleaseContent,
+  }
+}
diff --git a/web/features/deployments/deploy-drawer/index.tsx b/web/features/deployments/deploy-drawer/index.tsx
new file mode 100644
index 00000000000..88d2bae02cc
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/index.tsx
@@ -0,0 +1,64 @@
+'use client'
+
+import {
+  Drawer,
+  DrawerBackdrop,
+  DrawerCloseButton,
+  DrawerContent,
+  DrawerPopup,
+  DrawerPortal,
+  DrawerViewport,
+} from '@langgenius/dify-ui/drawer'
+import { useAtomValue, useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import {
+  closeDeployDrawerAtom,
+  deployDrawerAppInstanceIdAtom,
+  deployDrawerEnvironmentIdAtom,
+  deployDrawerOpenAtom,
+  deployDrawerReleaseIdAtom,
+} from './state'
+import { DeployForm } from './ui/form'
+
+export function DeployDrawer() {
+  const { t } = useTranslation('deployments')
+  const open = useAtomValue(deployDrawerOpenAtom)
+  const drawerAppInstanceId = useAtomValue(deployDrawerAppInstanceIdAtom)
+  const drawerEnvironmentId = useAtomValue(deployDrawerEnvironmentIdAtom)
+  const drawerReleaseId = useAtomValue(deployDrawerReleaseIdAtom)
+  const closeDeployDrawer = useSetAtom(closeDeployDrawerAtom)
+  const formKey = `${drawerAppInstanceId ?? 'none'}-${drawerEnvironmentId ?? 'any'}-${drawerReleaseId ?? 'new'}-${open ? '1' : '0'}`
+
+  return (
+    <Drawer
+      open={open}
+      modal
+      swipeDirection="right"
+      onOpenChange={next => !next && closeDeployDrawer()}
+    >
+      <DrawerPortal>
+        <DrawerBackdrop />
+        <DrawerViewport>
+          <DrawerPopup className="data-[swipe-direction=right]:top-16 data-[swipe-direction=right]:right-2 data-[swipe-direction=right]:bottom-2 data-[swipe-direction=right]:h-auto data-[swipe-direction=right]:w-[640px] data-[swipe-direction=right]:max-w-[calc(100vw-1rem)] data-[swipe-direction=right]:rounded-xl data-[swipe-direction=right]:border-[0.5px]">
+            <DrawerCloseButton
+              aria-label={t('deployDrawer.close')}
+              className="absolute top-4 right-5 size-6 rounded-md"
+            />
+            <DrawerContent className="flex min-h-0 flex-1 flex-col bg-components-panel-bg p-0 pb-0">
+              {!drawerAppInstanceId
+                ? <div className="p-6 text-text-tertiary">{t('deployDrawer.notFound')}</div>
+                : (
+                    <DeployForm
+                      key={formKey}
+                      appInstanceId={drawerAppInstanceId}
+                      lockedEnvId={drawerEnvironmentId}
+                      presetReleaseId={drawerReleaseId}
+                    />
+                  )}
+            </DrawerContent>
+          </DrawerPopup>
+        </DrawerViewport>
+      </DrawerPortal>
+    </Drawer>
+  )
+}
diff --git a/web/features/deployments/deploy-drawer/state/__tests__/index.spec.ts b/web/features/deployments/deploy-drawer/state/__tests__/index.spec.ts
new file mode 100644
index 00000000000..394dd8d81b3
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/state/__tests__/index.spec.ts
@@ -0,0 +1,451 @@
+import type {
+  CredentialCandidate,
+  CredentialSlot,
+  Environment,
+  EnvironmentDeployment,
+  EnvVarSlot,
+  Release,
+} from '@dify/contracts/enterprise/types.gen'
+import type { Getter } from 'jotai'
+import {
+  EnvVarValueSource,
+  EnvVarValueType,
+  PluginCategory,
+  RuntimeInstanceStatus,
+} from '@dify/contracts/enterprise/types.gen'
+import { atom, createStore } from 'jotai'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+type QueryResult = {
+  data?: {
+    options: DeploymentOptions
+  }
+  isLoading: boolean
+  isFetching: boolean
+  isError: boolean
+}
+
+type DeploymentOptions = {
+  credentialSlots: CredentialSlot[]
+  envVarSlots: EnvVarSlot[]
+}
+
+type MutationOptions = {
+  mutationKey?: readonly string[]
+}
+
+type MutationResult = {
+  isPending: boolean
+  mutate: ReturnType<typeof vi.fn>
+}
+
+const mockDeploymentOptionsQuery = vi.hoisted<{ current: QueryResult }>(() => ({
+  current: {
+    isLoading: false,
+    isFetching: false,
+    isError: false,
+  },
+}))
+const mockPromoteMutate = vi.hoisted(() => vi.fn())
+const mockRollbackMutate = vi.hoisted(() => vi.fn())
+const mockPromoteMutation = vi.hoisted<{ current: MutationResult }>(() => ({
+  current: {
+    isPending: false,
+    mutate: mockPromoteMutate,
+  },
+}))
+const mockRollbackMutation = vi.hoisted<{ current: MutationResult }>(() => ({
+  current: {
+    isPending: false,
+    mutate: mockRollbackMutate,
+  },
+}))
+
+vi.mock('jotai-tanstack-query', () => ({
+  atomWithQuery: (createOptions: (get: Getter) => unknown) => atom((get) => {
+    createOptions(get)
+    return mockDeploymentOptionsQuery.current
+  }),
+  atomWithMutation: (createOptions: () => MutationOptions) => atom(() => {
+    const options = createOptions()
+    return options.mutationKey?.[0] === 'rollback'
+      ? mockRollbackMutation.current
+      : mockPromoteMutation.current
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    enterprise: {
+      releaseService: {
+        computeDeploymentOptions: {
+          queryOptions: ({ enabled, input }: { enabled: boolean, input: unknown }) => ({
+            enabled,
+            input,
+            queryKey: ['computeDeploymentOptions', input],
+          }),
+        },
+      },
+      deploymentService: {
+        promote: {
+          mutationOptions: () => ({ mutationKey: ['promote'] }),
+        },
+        rollback: {
+          mutationOptions: () => ({ mutationKey: ['rollback'] }),
+        },
+      },
+    },
+  },
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    error: vi.fn(),
+  },
+}))
+
+vi.mock('../../shared/domain/idempotency', () => ({
+  createDeploymentIdempotencyKey: () => 'deploy-idempotency-key',
+}))
+
+async function loadState() {
+  return await import('../index')
+}
+
+function environment(overrides: Partial<Environment> = {}): Environment {
+  return {
+    id: 'environment-1',
+    displayName: 'Production',
+    description: '',
+    mode: 'ENVIRONMENT_MODE_SHARED',
+    backend: 'RUNTIME_BACKEND_K8S',
+    status: 'ENVIRONMENT_STATUS_READY',
+    statusMessage: '',
+    cpuCount: 1,
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  } as Environment
+}
+
+function release(overrides: Partial<Release> = {}): Release {
+  return {
+    id: 'release-1',
+    appInstanceId: 'app-instance-1',
+    displayName: 'Release 1',
+    description: '',
+    sourceAppId: 'source-app-1',
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    createdBy: {
+      id: 'account-1',
+      displayName: 'Owner',
+    },
+    ...overrides,
+  } as Release
+}
+
+function credentialCandidate(overrides: Partial<CredentialCandidate> = {}): CredentialCandidate {
+  return {
+    credentialId: 'credential-1',
+    providerId: 'langgenius/openai',
+    category: PluginCategory.PLUGIN_CATEGORY_MODEL,
+    displayName: 'Primary key',
+    fromEnterprise: false,
+    ...overrides,
+  }
+}
+
+function credentialSlot(overrides: Partial<CredentialSlot> = {}): CredentialSlot {
+  return {
+    providerId: 'langgenius/openai',
+    category: PluginCategory.PLUGIN_CATEGORY_MODEL,
+    candidates: [
+      credentialCandidate({ credentialId: 'credential-1' }),
+      credentialCandidate({ credentialId: 'credential-2', displayName: 'Backup key' }),
+    ],
+    lastCredentialId: '',
+    ...overrides,
+  }
+}
+
+function envVarSlot(overrides: Partial<EnvVarSlot> = {}): EnvVarSlot {
+  return {
+    key: 'API_KEY',
+    valueType: EnvVarValueType.ENV_VAR_VALUE_TYPE_STRING,
+    description: '',
+    ...overrides,
+  }
+}
+
+function runtimeRow(overrides: Partial<EnvironmentDeployment> = {}): EnvironmentDeployment {
+  return {
+    environment: environment(),
+    status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY,
+    currentRelease: release({ id: 'release-1', createdAt: '2026-01-01T00:00:00.000Z' }),
+    desiredRelease: release({ id: 'release-1', createdAt: '2026-01-01T00:00:00.000Z' }),
+    ...overrides,
+  } as EnvironmentDeployment
+}
+
+function deployConfig() {
+  return {
+    appInstanceId: 'app-instance-1',
+    environments: [
+      environment({ id: 'environment-1', displayName: 'Production' }),
+      environment({ id: 'environment-2', displayName: 'Staging' }),
+    ],
+    releases: [
+      release({ id: 'release-2', displayName: 'Release 2', createdAt: '2026-01-02T00:00:00.000Z' }),
+      release({ id: 'release-1', displayName: 'Release 1', createdAt: '2026-01-01T00:00:00.000Z' }),
+    ],
+    runtimeRows: [runtimeRow()],
+    defaultReleaseId: 'release-2',
+  }
+}
+
+function setQueryOptions(options: DeploymentOptions) {
+  mockDeploymentOptionsQuery.current = {
+    data: {
+      options,
+    },
+    isLoading: false,
+    isFetching: false,
+    isError: false,
+  }
+}
+
+describe('deploy drawer state', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockDeploymentOptionsQuery.current = {
+      isLoading: false,
+      isFetching: false,
+      isError: false,
+    }
+    mockPromoteMutation.current = {
+      isPending: false,
+      mutate: mockPromoteMutate,
+    }
+    mockRollbackMutation.current = {
+      isPending: false,
+      mutate: mockRollbackMutate,
+    }
+  })
+
+  it('should open and close the deploy drawer with route identity', async () => {
+    const state = await loadState()
+    const store = createStore()
+
+    store.set(state.openDeployDrawerAtom, {
+      appInstanceId: 'app-instance-1',
+      environmentId: 'environment-1',
+      releaseId: 'release-2',
+    })
+
+    expect(store.get(state.deployDrawerOpenAtom)).toBe(true)
+    expect(store.get(state.deployDrawerAppInstanceIdAtom)).toBe('app-instance-1')
+    expect(store.get(state.deployDrawerEnvironmentIdAtom)).toBe('environment-1')
+    expect(store.get(state.deployDrawerReleaseIdAtom)).toBe('release-2')
+
+    store.set(state.closeDeployDrawerAtom)
+
+    expect(store.get(state.deployDrawerOpenAtom)).toBe(false)
+    expect(store.get(state.deployDrawerAppInstanceIdAtom)).toBeUndefined()
+    expect(store.get(state.deployDrawerEnvironmentIdAtom)).toBeUndefined()
+    expect(store.get(state.deployDrawerReleaseIdAtom)).toBeUndefined()
+  })
+
+  it('should derive default environment and release selections from config', async () => {
+    const state = await loadState()
+    const store = createStore()
+    store.set(state.deployReadyFormConfigAtom, {
+      ...deployConfig(),
+      lockedEnvId: 'environment-2',
+      presetReleaseId: 'release-1',
+      releaseEmptyLabel: 'No releases',
+    })
+
+    expect(store.get(state.deploySelectedEnvironmentIdAtom)).toBe('environment-2')
+    expect(store.get(state.deployLockedEnvironmentIdAtom)).toBe('environment-2')
+    expect(store.get(state.deployLockedEnvironmentAtom)?.displayName).toBe('Staging')
+    expect(store.get(state.deploySelectedReleaseIdAtom)).toBe('release-1')
+    expect(store.get(state.deployDisplayedReleaseAtom)?.id).toBe('release-1')
+    expect(store.get(state.deployIsExistingReleaseAtom)).toBe(true)
+    expect(store.get(state.deployReleaseRowsAtom)).toHaveLength(2)
+    expect(store.get(state.deployEnvironmentRowsAtom)).toHaveLength(2)
+    expect(store.get(state.deployReleaseEmptyLabelAtom)).toBe('No releases')
+    expect(store.get(state.deployHasSelectedEnvironmentAtom)).toBe(true)
+  })
+
+  it('should reset bindings, env vars, and validation state when target changes', async () => {
+    const state = await loadState()
+    const store = createStore()
+    const slot = credentialSlot()
+    store.set(state.deployReadyFormConfigAtom, deployConfig())
+    setQueryOptions({
+      credentialSlots: [slot],
+      envVarSlots: [envVarSlot()],
+    })
+
+    store.set(state.selectDeployBindingAtom, 'langgenius/openai:PLUGIN_CATEGORY_MODEL', 'credential-1')
+    store.set(state.setDeployEnvVarAtom, 'API_KEY', {
+      value: 'secret',
+      valueSource: EnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL,
+    })
+    store.set(state.showDeployValidationErrorsAtom)
+
+    expect(store.get(state.deploySelectedBindingsAtom)).toEqual({
+      'langgenius/openai:PLUGIN_CATEGORY_MODEL': 'credential-1',
+    })
+    expect(store.get(state.deployEnvVarValuesAtom)).toEqual({
+      API_KEY: {
+        value: 'secret',
+        valueSource: EnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL,
+      },
+    })
+    expect(store.get(state.deployShowValidationErrorsAtom)).toBe(true)
+
+    store.set(state.selectDeployEnvironmentAtom, 'environment-2')
+
+    expect(store.get(state.deploySelectedEnvironmentIdAtom)).toBe('environment-2')
+    expect(store.get(state.deploySelectedBindingsAtom)).toEqual({})
+    expect(store.get(state.deployEnvVarValuesAtom)).toEqual({})
+    expect(store.get(state.deployShowValidationErrorsAtom)).toBe(false)
+
+    store.set(state.selectDeployReleaseAtom, 'release-1')
+    expect(store.get(state.deploySelectedReleaseIdAtom)).toBe('release-1')
+  })
+
+  it('should derive binding and env var readiness from deployment options', async () => {
+    const state = await loadState()
+    const store = createStore()
+    const slot = credentialSlot({
+      lastCredentialId: 'credential-2',
+    })
+    store.set(state.deployReadyFormConfigAtom, deployConfig())
+    setQueryOptions({
+      credentialSlots: [slot],
+      envVarSlots: [
+        envVarSlot({
+          key: 'PORT',
+          valueType: EnvVarValueType.ENV_VAR_VALUE_TYPE_NUMBER,
+          defaultValue: '8080',
+        }),
+      ],
+    })
+
+    expect(store.get(state.deployBindingSlotsAtom)).toEqual([slot])
+    expect(store.get(state.deployEnvVarSlotsAtom)).toMatchObject([
+      {
+        key: 'PORT',
+        valueType: 'number',
+        hasDefaultValue: true,
+        hasLastValue: false,
+      },
+    ])
+    expect(store.get(state.deploySelectedBindingsAtom)).toEqual({
+      'langgenius/openai:PLUGIN_CATEGORY_MODEL': 'credential-2',
+    })
+    expect(store.get(state.canAttemptDeployAtom)).toBe(true)
+    expect(store.get(state.canSubmitDeployAtom)).toBe(true)
+  })
+
+  it('should block submit until required literal env vars are valid', async () => {
+    const state = await loadState()
+    const store = createStore()
+    store.set(state.deployReadyFormConfigAtom, deployConfig())
+    setQueryOptions({
+      credentialSlots: [
+        credentialSlot({
+          candidates: [credentialCandidate({ credentialId: 'credential-1' })],
+        }),
+      ],
+      envVarSlots: [
+        envVarSlot({
+          key: 'PORT',
+          valueType: EnvVarValueType.ENV_VAR_VALUE_TYPE_NUMBER,
+        }),
+      ],
+    })
+
+    expect(store.get(state.canAttemptDeployAtom)).toBe(true)
+    expect(store.get(state.canSubmitDeployAtom)).toBe(false)
+
+    store.set(state.setDeployEnvVarAtom, 'PORT', {
+      value: 'abc',
+      valueSource: EnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL,
+    })
+    expect(store.get(state.canSubmitDeployAtom)).toBe(false)
+
+    store.set(state.setDeployEnvVarAtom, 'PORT', {
+      value: '3000',
+      valueSource: EnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL,
+    })
+    expect(store.get(state.canSubmitDeployAtom)).toBe(true)
+  })
+
+  it('should submit a promote deployment with selected credentials and env vars', async () => {
+    const state = await loadState()
+    const store = createStore()
+    mockPromoteMutate.mockImplementation((_variables: unknown, options?: { onSuccess?: () => void }) => {
+      options?.onSuccess?.()
+    })
+    store.set(state.deployReadyFormConfigAtom, deployConfig())
+    setQueryOptions({
+      credentialSlots: [
+        credentialSlot({
+          candidates: [credentialCandidate({ credentialId: 'credential-1' })],
+        }),
+      ],
+      envVarSlots: [
+        envVarSlot({
+          key: 'API_KEY',
+          valueType: EnvVarValueType.ENV_VAR_VALUE_TYPE_SECRET,
+        }),
+      ],
+    })
+    store.set(state.setDeployEnvVarAtom, 'API_KEY', {
+      value: 'secret',
+      valueSource: EnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL,
+    })
+
+    store.set(state.deployReleaseSubmissionAtom, {
+      deployFailedMessage: 'Deploy failed',
+    })
+
+    expect(mockPromoteMutate).toHaveBeenCalledWith(
+      {
+        params: {
+          appInstanceId: 'app-instance-1',
+          environmentId: 'environment-1',
+        },
+        body: {
+          appInstanceId: 'app-instance-1',
+          environmentId: 'environment-1',
+          releaseId: 'release-2',
+          credentials: [
+            {
+              providerId: 'langgenius/openai',
+              category: PluginCategory.PLUGIN_CATEGORY_MODEL,
+              credentialId: 'credential-1',
+            },
+          ],
+          envVars: [
+            {
+              key: 'API_KEY',
+              value: 'secret',
+              valueSource: EnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL,
+            },
+          ],
+          idempotencyKey: expect.any(String),
+        },
+      },
+      expect.objectContaining({
+        onSuccess: expect.any(Function),
+        onError: expect.any(Function),
+      }),
+    )
+    expect(store.get(state.deployDrawerOpenAtom)).toBe(false)
+  })
+})
diff --git a/web/features/deployments/deploy-drawer/state/index.ts b/web/features/deployments/deploy-drawer/state/index.ts
new file mode 100644
index 00000000000..9d576a23ed9
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/state/index.ts
@@ -0,0 +1,442 @@
+'use client'
+
+import type {
+  Environment,
+  EnvironmentDeployment,
+  EnvVarInput,
+  Release,
+} from '@dify/contracts/enterprise/types.gen'
+import type { Getter } from 'jotai'
+import type {
+  EnvVarBindingSlot,
+  EnvVarValues,
+  EnvVarValueSelection,
+} from '../../components/env-var-bindings'
+import type { RuntimeCredentialBindingSelections } from '../../components/runtime-credential-bindings-utils'
+import { EnvVarValueSource as ApiEnvVarValueSource } from '@dify/contracts/enterprise/types.gen'
+import { toast } from '@langgenius/dify-ui/toast'
+import { atom } from 'jotai'
+import { atomWithMutation, atomWithQuery } from 'jotai-tanstack-query'
+import { consoleQuery } from '@/service/client'
+import { envVarBindingSlotFromContract } from '../../components/env-var-bindings-utils'
+import {
+  hasMissingRequiredRuntimeCredentialBinding,
+  runtimeCredentialSlotKey,
+  selectedDeploymentRuntimeCredentials,
+  selectedRuntimeCredentialSelections,
+} from '../../components/runtime-credential-bindings-utils'
+import { createDeploymentIdempotencyKey } from '../../shared/domain/idempotency'
+import { releaseDeploymentAction } from '../../shared/domain/release-action'
+
+type OpenDeployDrawerParams = {
+  appInstanceId: string
+  environmentId?: string
+  releaseId?: string
+}
+
+export const deployDrawerOpenAtom = atom(false)
+export const deployDrawerAppInstanceIdAtom = atom<string | undefined>(undefined)
+export const deployDrawerEnvironmentIdAtom = atom<string | undefined>(undefined)
+export const deployDrawerReleaseIdAtom = atom<string | undefined>(undefined)
+
+export const openDeployDrawerAtom = atom(null, (_get, set, params: OpenDeployDrawerParams) => {
+  set(deployDrawerAppInstanceIdAtom, params.appInstanceId)
+  set(deployDrawerEnvironmentIdAtom, params.environmentId)
+  set(deployDrawerReleaseIdAtom, params.releaseId)
+  set(deployDrawerOpenAtom, true)
+})
+
+export const closeDeployDrawerAtom = atom(null, (_get, set) => {
+  set(deployDrawerOpenAtom, false)
+  set(deployDrawerAppInstanceIdAtom, undefined)
+  set(deployDrawerEnvironmentIdAtom, undefined)
+  set(deployDrawerReleaseIdAtom, undefined)
+})
+
+export type DeployReadyFormConfig = {
+  appInstanceId: string
+  environments: Environment[]
+  releases: Release[]
+  runtimeRows: EnvironmentDeployment[]
+  defaultReleaseId?: string
+  lockedEnvId?: string
+  presetReleaseId?: string
+  releaseEmptyLabel?: string
+}
+
+export const deployReadyFormConfigAtom = atom<DeployReadyFormConfig | undefined>(undefined)
+
+const selectedEnvIdAtom = atom<string | undefined>(undefined)
+const selectedReleaseIdAtom = atom<string | undefined>(undefined)
+const manualBindingsAtom = atom<RuntimeCredentialBindingSelections>({})
+export const deployEnvVarValuesAtom = atom<EnvVarValues>({})
+const showValidationErrorsAtom = atom(false)
+export const deployReadyFormLocalAtoms = [
+  selectedEnvIdAtom,
+  selectedReleaseIdAtom,
+  manualBindingsAtom,
+  deployEnvVarValuesAtom,
+  showValidationErrorsAtom,
+] as const
+
+function formConfig(get: Getter) {
+  const config = get(deployReadyFormConfigAtom)
+  if (!config)
+    throw new Error('Missing deploy ready form config.')
+
+  return config
+}
+
+const resetDeployBindingsAtom = atom(null, (_get, set) => {
+  set(manualBindingsAtom, {})
+  set(deployEnvVarValuesAtom, {})
+  set(showValidationErrorsAtom, false)
+})
+
+export const selectDeployEnvironmentAtom = atom(null, (_get, set, environmentId: string) => {
+  set(selectedEnvIdAtom, environmentId)
+  set(resetDeployBindingsAtom)
+})
+
+export const selectDeployReleaseAtom = atom(null, (_get, set, releaseId: string) => {
+  set(selectedReleaseIdAtom, releaseId)
+  set(resetDeployBindingsAtom)
+})
+
+export const showDeployValidationErrorsAtom = atom(null, (_get, set) => {
+  set(showValidationErrorsAtom, true)
+})
+
+export const deployShowValidationErrorsAtom = atom((get) => {
+  return get(showValidationErrorsAtom)
+})
+
+const deployPresetReleaseAtom = atom((get) => {
+  const config = formConfig(get)
+  return config.presetReleaseId ? config.releases.find(r => r.id === config.presetReleaseId) : undefined
+})
+
+export const deployDisplayedReleaseAtom = atom((get): Release | undefined => {
+  return get(deployPresetReleaseAtom)
+})
+
+export const deployIsExistingReleaseAtom = atom((get) => {
+  const config = formConfig(get)
+  return Boolean(config.presetReleaseId)
+})
+
+export const deployReleaseRowsAtom = atom((get) => {
+  return formConfig(get).releases
+})
+
+export const deployReleaseEmptyLabelAtom = atom((get) => {
+  return formConfig(get).releaseEmptyLabel
+})
+
+export const deployEnvironmentRowsAtom = atom((get) => {
+  return formConfig(get).environments
+})
+
+export const deployLockedEnvironmentIdAtom = atom((get) => {
+  return formConfig(get).lockedEnvId
+})
+
+export const deploySelectedEnvironmentIdAtom = atom((get) => {
+  const config = formConfig(get)
+  return get(selectedEnvIdAtom) ?? config.lockedEnvId ?? config.environments[0]?.id
+})
+
+const deploySelectedEnvironmentAtom = atom((get) => {
+  const config = formConfig(get)
+  const selectedEnvironmentId = get(deploySelectedEnvironmentIdAtom)
+  return selectedEnvironmentId
+    ? config.environments.find(env => env.id === selectedEnvironmentId)
+    : undefined
+})
+
+export const deploySelectedReleaseIdAtom = atom((get) => {
+  const config = formConfig(get)
+  const displayedRelease = get(deployDisplayedReleaseAtom)
+  return get(selectedReleaseIdAtom) ?? displayedRelease?.id ?? config.defaultReleaseId
+})
+
+const deploySelectedReleaseAtom = atom((get) => {
+  const config = formConfig(get)
+  const selectedReleaseId = get(deploySelectedReleaseIdAtom)
+  return selectedReleaseId
+    ? config.releases.find(release => release.id === selectedReleaseId)
+    : undefined
+})
+
+const deployTargetReleaseAtom = atom((get) => {
+  return get(deployDisplayedReleaseAtom) ?? get(deploySelectedReleaseAtom)
+})
+
+export const deployLockedEnvironmentAtom = atom((get) => {
+  const config = formConfig(get)
+  return config.lockedEnvId
+    ? config.environments.find(environment => environment.id === config.lockedEnvId)
+    : undefined
+})
+
+export const deployTargetReleaseIdAtom = atom((get) => {
+  const targetRelease = get(deployTargetReleaseAtom)
+  return targetRelease?.id ?? get(deploySelectedReleaseIdAtom)
+})
+
+export const deployHasSelectedEnvironmentAtom = atom((get) => {
+  return Boolean(get(deploySelectedEnvironmentAtom))
+})
+
+const releaseDeploymentOptionsQueryAtom = atomWithQuery((get) => {
+  const hasSelectedEnvironment = get(deployHasSelectedEnvironmentAtom)
+  const releaseId = get(deployTargetReleaseIdAtom)
+  const selectedEnvironmentId = get(deploySelectedEnvironmentIdAtom)
+  const enabled = Boolean(releaseId && selectedEnvironmentId && hasSelectedEnvironment)
+
+  return {
+    ...consoleQuery.enterprise.releaseService.computeDeploymentOptions.queryOptions({
+      input: {
+        body: {
+          releaseId: releaseId ?? '',
+          environmentId: selectedEnvironmentId ?? '',
+        },
+      },
+      enabled,
+    }),
+    retry: false,
+  }
+})
+
+export const deployBindingSlotsAtom = atom((get) => {
+  const deploymentOptionsQuery = get(releaseDeploymentOptionsQueryAtom)
+
+  return deploymentOptionsQuery.data?.options.credentialSlots.filter(slot => runtimeCredentialSlotKey(slot)) ?? []
+})
+
+export const deployEnvVarSlotsAtom = atom((get): EnvVarBindingSlot[] => {
+  const deploymentOptionsQuery = get(releaseDeploymentOptionsQueryAtom)
+
+  return deploymentOptionsQuery.data?.options.envVarSlots.flatMap((slot): EnvVarBindingSlot[] => {
+    const bindingSlot = envVarBindingSlotFromContract(slot)
+    return bindingSlot ? [bindingSlot] : []
+  }) ?? []
+})
+
+export const deployIsBindingOptionsLoadingAtom = atom((get) => {
+  const deploymentOptionsQuery = get(releaseDeploymentOptionsQueryAtom)
+  const releaseId = get(deployTargetReleaseIdAtom)
+
+  return Boolean(
+    releaseId
+    && get(deployHasSelectedEnvironmentAtom)
+    && (deploymentOptionsQuery.isLoading || deploymentOptionsQuery.isFetching),
+  )
+})
+
+export const deployHasBindingOptionsErrorAtom = atom((get) => {
+  return get(releaseDeploymentOptionsQueryAtom).isError
+})
+
+const deployIsBindingOptionsReadyAtom = atom((get) => {
+  const deploymentOptionsQuery = get(releaseDeploymentOptionsQueryAtom)
+  const releaseId = get(deployTargetReleaseIdAtom)
+
+  return Boolean(
+    releaseId
+    && get(deployHasSelectedEnvironmentAtom)
+    && deploymentOptionsQuery.data
+    && !get(deployIsBindingOptionsLoadingAtom)
+    && !get(deployHasBindingOptionsErrorAtom),
+  )
+})
+
+function deployEnvVarValueSource(slot: EnvVarBindingSlot, selection: EnvVarValueSelection | undefined) {
+  return selection?.valueSource
+    ?? (slot.hasLastValue
+      ? ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT
+      : slot.hasDefaultValue
+        ? ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT
+        : ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LITERAL)
+}
+
+function deployEnvVarInput(slot: EnvVarBindingSlot, selection: EnvVarValueSelection | undefined): EnvVarInput[] {
+  const valueSource = deployEnvVarValueSource(slot, selection)
+
+  if (valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT) {
+    return slot.hasLastValue
+      ? [{ key: slot.key, valueSource }]
+      : []
+  }
+
+  if (valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT) {
+    return slot.hasDefaultValue
+      ? [{ key: slot.key, valueSource }]
+      : []
+  }
+
+  if (!selection?.value || (slot.valueType === 'number' && Number.isNaN(Number(selection.value))))
+    return []
+
+  return [{
+    key: slot.key,
+    value: selection.value,
+    valueSource,
+  }]
+}
+
+function deployEnvVarSelectionReady(slot: EnvVarBindingSlot, selection: EnvVarValueSelection | undefined) {
+  const valueSource = deployEnvVarValueSource(slot, selection)
+
+  if (valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_LAST_DEPLOYMENT)
+    return Boolean(slot.hasLastValue)
+  if (valueSource === ApiEnvVarValueSource.ENV_VAR_VALUE_SOURCE_DSL_DEFAULT)
+    return Boolean(slot.hasDefaultValue)
+  if (!selection?.value)
+    return false
+
+  return slot.valueType !== 'number' || !Number.isNaN(Number(selection.value))
+}
+
+export const deploySelectedBindingsAtom = atom((get) => {
+  return selectedRuntimeCredentialSelections(get(deployBindingSlotsAtom), get(manualBindingsAtom))
+})
+
+const deployDeploymentCredentialsAtom = atom((get) => {
+  return selectedDeploymentRuntimeCredentials(get(deployBindingSlotsAtom), get(deploySelectedBindingsAtom))
+})
+
+const deployDeploymentEnvVarsAtom = atom((get) => {
+  const envVarValues = get(deployEnvVarValuesAtom)
+
+  return get(deployEnvVarSlotsAtom).flatMap(slot => deployEnvVarInput(slot, envVarValues[slot.key]))
+})
+
+const deployRequiredBindingsReadyAtom = atom((get) => {
+  const selectedBindings = get(deploySelectedBindingsAtom)
+
+  return get(deployBindingSlotsAtom).every(slot =>
+    !hasMissingRequiredRuntimeCredentialBinding(slot, selectedBindings[runtimeCredentialSlotKey(slot)]),
+  )
+})
+
+const deployRequiredEnvVarsReadyAtom = atom((get) => {
+  const envVarValues = get(deployEnvVarValuesAtom)
+
+  return get(deployEnvVarSlotsAtom).every(slot =>
+    deployEnvVarSelectionReady(slot, envVarValues[slot.key]),
+  )
+})
+
+export const selectDeployBindingAtom = atom(null, (get, set, slot: string, value: string) => {
+  set(manualBindingsAtom, {
+    ...get(manualBindingsAtom),
+    [slot]: value,
+  })
+})
+
+export const setDeployEnvVarAtom = atom(null, (get, set, key: string, value: EnvVarValueSelection) => {
+  set(deployEnvVarValuesAtom, {
+    ...get(deployEnvVarValuesAtom),
+    [key]: value,
+  })
+})
+
+const promoteReleaseMutationAtom = atomWithMutation(() =>
+  consoleQuery.enterprise.deploymentService.promote.mutationOptions(),
+)
+
+const rollbackReleaseMutationAtom = atomWithMutation(() =>
+  consoleQuery.enterprise.deploymentService.rollback.mutationOptions(),
+)
+
+export const isDeployReleaseSubmittingAtom = atom((get) => {
+  return get(promoteReleaseMutationAtom).isPending || get(rollbackReleaseMutationAtom).isPending
+})
+
+export const canAttemptDeployAtom = atom((get) => {
+  return Boolean(
+    get(deploySelectedEnvironmentIdAtom)
+    && get(deploySelectedEnvironmentAtom)
+    && get(deployTargetReleaseIdAtom)
+    && get(deployIsBindingOptionsReadyAtom)
+    && !get(isDeployReleaseSubmittingAtom),
+  )
+})
+
+export const canSubmitDeployAtom = atom((get) => {
+  return Boolean(
+    get(canAttemptDeployAtom)
+    && get(deployRequiredBindingsReadyAtom)
+    && get(deployRequiredEnvVarsReadyAtom),
+  )
+})
+
+export const deployReleaseSubmissionAtom = atom(null, (get, set, {
+  deployFailedMessage,
+}: {
+  deployFailedMessage: string
+}) => {
+  const config = formConfig(get)
+  const selectedEnvironmentId = get(deploySelectedEnvironmentIdAtom)
+  const targetRelease = get(deployTargetReleaseAtom)
+  const targetReleaseId = get(deployTargetReleaseIdAtom)
+
+  if (!targetReleaseId || !selectedEnvironmentId)
+    return
+
+  const idempotencyKey = createDeploymentIdempotencyKey()
+  const currentRelease = config.runtimeRows.find(row => row.environment.id === selectedEnvironmentId)?.currentRelease
+  const action = releaseDeploymentAction({
+    targetRelease,
+    currentRelease,
+    releaseRows: config.releases,
+    isExistingRelease: true,
+  })
+  const mutationOptions = {
+    onSuccess: () => {
+      set(closeDeployDrawerAtom)
+    },
+    onError: () => {
+      toast.error(deployFailedMessage)
+    },
+  }
+
+  if (action === 'rollback') {
+    get(rollbackReleaseMutationAtom).mutate(
+      {
+        params: {
+          appInstanceId: config.appInstanceId,
+          environmentId: selectedEnvironmentId,
+        },
+        body: {
+          appInstanceId: config.appInstanceId,
+          environmentId: selectedEnvironmentId,
+          targetReleaseId,
+          idempotencyKey,
+        },
+      },
+      mutationOptions,
+    )
+    return
+  }
+
+  const deploymentEnvVars = get(deployDeploymentEnvVarsAtom)
+  get(promoteReleaseMutationAtom).mutate(
+    {
+      params: {
+        appInstanceId: config.appInstanceId,
+        environmentId: selectedEnvironmentId,
+      },
+      body: {
+        appInstanceId: config.appInstanceId,
+        environmentId: selectedEnvironmentId,
+        releaseId: targetReleaseId,
+        credentials: get(deployDeploymentCredentialsAtom),
+        envVars: deploymentEnvVars.length > 0 ? deploymentEnvVars : undefined,
+        idempotencyKey,
+      },
+    },
+    mutationOptions,
+  )
+})
diff --git a/web/features/deployments/deploy-drawer/state/release-options.ts b/web/features/deployments/deploy-drawer/state/release-options.ts
new file mode 100644
index 00000000000..5174f6e6204
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/state/release-options.ts
@@ -0,0 +1,25 @@
+import type { EnvironmentDeployment, Release } from '@dify/contracts/enterprise/types.gen'
+
+export function currentReleaseIdForEnvironment(rows: EnvironmentDeployment[], targetEnvironmentId?: string) {
+  if (!targetEnvironmentId)
+    return undefined
+
+  return rows.find(row => row.environment.id === targetEnvironmentId)?.currentRelease?.id
+}
+
+export function selectableDeployReleases({
+  releases,
+  lockedEnvId,
+  currentReleaseId,
+  presetReleaseId,
+}: {
+  releases: Release[]
+  lockedEnvId?: string
+  currentReleaseId?: string
+  presetReleaseId?: string
+}) {
+  if (!lockedEnvId || presetReleaseId || !currentReleaseId)
+    return releases
+
+  return releases.filter(release => release.id !== currentReleaseId)
+}
diff --git a/web/features/deployments/deploy-drawer/ui/form-sections.tsx b/web/features/deployments/deploy-drawer/ui/form-sections.tsx
new file mode 100644
index 00000000000..d7d70bd81da
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/ui/form-sections.tsx
@@ -0,0 +1,197 @@
+'use client'
+
+import type { CredentialSlot, Environment } from '@dify/contracts/enterprise/types.gen'
+import type { RuntimeCredentialBindingSelections } from '../../components/runtime-credential-bindings-utils'
+import { DrawerDescription, DrawerTitle } from '@langgenius/dify-ui/drawer'
+import { useAtomValue, useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import { SkeletonContainer, SkeletonRectangle } from '@/app/components/base/skeleton'
+import { DeploymentStateMessage } from '../../components/empty-state'
+import { RuntimeCredentialBindingsPanel } from '../../components/runtime-credential-bindings'
+import { formatDate, releaseCommit } from '../../shared/domain/release'
+import {
+  deployDisplayedReleaseAtom,
+  deployEnvironmentRowsAtom,
+  deployIsExistingReleaseAtom,
+  deployLockedEnvironmentAtom,
+  deployLockedEnvironmentIdAtom,
+  deployReleaseEmptyLabelAtom,
+  deployReleaseRowsAtom,
+  deploySelectedEnvironmentIdAtom,
+  deploySelectedReleaseIdAtom,
+  selectDeployEnvironmentAtom,
+  selectDeployReleaseAtom,
+} from '../state'
+import {
+  DeploymentSelect,
+  EnvironmentRow,
+  Field,
+} from './select'
+
+export const DEPLOY_DRAWER_BINDING_LIST_CLASS_NAME = 'max-h-none overflow-visible'
+
+function environmentOptionLabel(env: Environment, t: ReturnType<typeof useTranslation<'deployments'>>['t']) {
+  const description = env.description.trim()
+  if (description)
+    return `${env.displayName} · ${description}`
+
+  return `${env.displayName} · ${t(`mode.${env.mode}`)} · ${t(`backend.${env.backend}`)}`
+}
+
+export function BindingOptionsPanel({
+  slots,
+  selections,
+  isLoading,
+  hasError,
+  bindingCountLabel,
+  showMissingRequired,
+  onChange,
+}: {
+  slots: CredentialSlot[]
+  selections: RuntimeCredentialBindingSelections
+  isLoading: boolean
+  hasError: boolean
+  bindingCountLabel: string
+  showMissingRequired: boolean
+  onChange: (slot: string, value: string) => void
+}) {
+  const { t } = useTranslation('deployments')
+
+  if (isLoading) {
+    return (
+      <div className="rounded-xl border border-divider-subtle bg-background-default-subtle px-3 py-4">
+        <SkeletonContainer className="gap-2">
+          <SkeletonRectangle className="h-3 w-32 animate-pulse" />
+          <SkeletonRectangle className="h-3 w-2/3 animate-pulse" />
+          <SkeletonRectangle className="my-0 h-8 w-full animate-pulse rounded-lg" />
+        </SkeletonContainer>
+      </div>
+    )
+  }
+
+  if (hasError) {
+    return (
+      <div className="rounded-xl border border-divider-subtle bg-background-default-subtle px-3 py-4 system-sm-regular text-text-destructive">
+        {t('deployDrawer.bindingOptionsFailed')}
+      </div>
+    )
+  }
+
+  return (
+    <RuntimeCredentialBindingsPanel
+      slots={slots}
+      selections={selections}
+      title={t('deployDrawer.runtimeCredentials')}
+      hint={t('deployDrawer.bindingSelectionHint')}
+      noBindingRequiredLabel={t('deployDrawer.noBindingRequired')}
+      noCredentialCandidatesLabel={t('deployDrawer.noCredentialCandidates')}
+      selectCredentialLabel={t('deployDrawer.selectCredential')}
+      missingRequiredLabel={t('deployDrawer.missingRequiredBinding')}
+      bindingCountLabel={bindingCountLabel}
+      showMissingRequired={showMissingRequired}
+      listClassName={DEPLOY_DRAWER_BINDING_LIST_CLASS_NAME}
+      onChange={onChange}
+    />
+  )
+}
+
+export function DeployFormHeader() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <div className="shrink-0 border-b border-divider-subtle px-6 py-5 pr-14">
+      <DrawerTitle className="title-xl-semi-bold text-text-primary">
+        {t('deployDrawer.title')}
+      </DrawerTitle>
+      <DrawerDescription className="mt-1 system-sm-regular text-text-tertiary">
+        {t('deployDrawer.description')}
+      </DrawerDescription>
+    </div>
+  )
+}
+
+export function ReleaseField() {
+  const { t } = useTranslation('deployments')
+  const displayedRelease = useAtomValue(deployDisplayedReleaseAtom)
+  const emptyLabel = useAtomValue(deployReleaseEmptyLabelAtom)
+  const isExistingRelease = useAtomValue(deployIsExistingReleaseAtom)
+  const releases = useAtomValue(deployReleaseRowsAtom)
+  const selectedReleaseId = useAtomValue(deploySelectedReleaseIdAtom)
+  const selectRelease = useSetAtom(selectDeployReleaseAtom)
+
+  return (
+    <Field label={t('deployDrawer.releaseLabel')}>
+      {isExistingRelease && displayedRelease
+        ? (
+            <div className="flex flex-col gap-1">
+              <div className="flex items-center justify-between rounded-lg border border-components-panel-border bg-components-panel-bg-blur px-3 py-2">
+                <div className="flex min-w-0 items-center gap-2">
+                  <span className="shrink-0 font-mono system-sm-semibold text-text-primary">{displayedRelease.displayName}</span>
+                  <span className="shrink-0 system-xs-regular text-text-tertiary">·</span>
+                  <span className="shrink-0 font-mono system-xs-regular text-text-tertiary">{releaseCommit(displayedRelease)}</span>
+                </div>
+                <span className="shrink-0 system-xs-regular text-text-quaternary">{formatDate(displayedRelease.createdAt)}</span>
+              </div>
+              <span className="system-xs-regular text-text-tertiary">
+                {t('deployDrawer.existingReleaseHint')}
+              </span>
+            </div>
+          )
+        : releases.length === 0
+          ? (
+              <DeploymentStateMessage variant="compact">
+                {emptyLabel ?? t('deployDrawer.noReleaseAvailable')}
+              </DeploymentStateMessage>
+            )
+          : (
+              <DeploymentSelect
+                value={selectedReleaseId}
+                onChange={selectRelease}
+                options={releases.map(release => ({
+                  value: release.id,
+                  label: `${release.displayName} · ${releaseCommit(release)}`,
+                }))}
+                ariaLabel={t('deployDrawer.releaseLabel')}
+                placeholder={t('deployDrawer.selectRelease')}
+              />
+            )}
+    </Field>
+  )
+}
+
+export function EnvironmentField() {
+  const { t } = useTranslation('deployments')
+  const environments = useAtomValue(deployEnvironmentRowsAtom)
+  const lockedEnv = useAtomValue(deployLockedEnvironmentAtom)
+  const lockedEnvId = useAtomValue(deployLockedEnvironmentIdAtom)
+  const selectedEnvironmentId = useAtomValue(deploySelectedEnvironmentIdAtom)
+  const selectEnvironment = useSetAtom(selectDeployEnvironmentAtom)
+
+  return (
+    <Field
+      label={t('deployDrawer.targetEnv')}
+      hint={lockedEnvId ? t('deployDrawer.lockedHint') : undefined}
+    >
+      {lockedEnv
+        ? <EnvironmentRow env={lockedEnv} />
+        : environments.length === 0
+          ? (
+              <DeploymentStateMessage variant="compact">
+                {t('deployDrawer.noNewEnvironmentAvailable')}
+              </DeploymentStateMessage>
+            )
+          : (
+              <DeploymentSelect
+                value={selectedEnvironmentId}
+                onChange={selectEnvironment}
+                options={environments.map(env => ({
+                  value: env.id,
+                  label: environmentOptionLabel(env, t),
+                }))}
+                ariaLabel={t('deployDrawer.targetEnv')}
+                placeholder={t('deployDrawer.selectEnv')}
+              />
+            )}
+    </Field>
+  )
+}
diff --git a/web/features/deployments/deploy-drawer/ui/form-skeleton.tsx b/web/features/deployments/deploy-drawer/ui/form-skeleton.tsx
new file mode 100644
index 00000000000..05251b3b1f4
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/ui/form-skeleton.tsx
@@ -0,0 +1,42 @@
+'use client'
+
+import { SkeletonContainer, SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+
+const DEPLOY_FORM_FIELD_SKELETON_KEYS = ['environment', 'release']
+
+export function DeployFormSkeleton() {
+  return (
+    <div className="flex min-h-0 flex-1 flex-col">
+      <div className="shrink-0 border-b border-divider-subtle px-6 py-5 pr-14">
+        <SkeletonContainer className="gap-2">
+          <SkeletonRectangle className="h-5 w-44 animate-pulse" />
+          <SkeletonRectangle className="h-3 w-72 animate-pulse" />
+        </SkeletonContainer>
+      </div>
+
+      <div className="min-h-0 flex-1 overflow-y-auto px-6 py-5">
+        <div className="flex flex-col gap-5">
+          {DEPLOY_FORM_FIELD_SKELETON_KEYS.map(key => (
+            <SkeletonContainer key={key} className="gap-2">
+              <SkeletonRectangle className="h-3 w-24 animate-pulse" />
+              <SkeletonRectangle className="my-0 h-9 w-full animate-pulse rounded-lg" />
+            </SkeletonContainer>
+          ))}
+
+          <div className="rounded-xl border border-divider-subtle bg-background-default-subtle px-3 py-4">
+            <SkeletonContainer className="gap-2">
+              <SkeletonRectangle className="h-3 w-32 animate-pulse" />
+              <SkeletonRectangle className="h-3 w-2/3 animate-pulse" />
+              <SkeletonRectangle className="my-0 h-8 w-full animate-pulse rounded-lg" />
+            </SkeletonContainer>
+          </div>
+        </div>
+      </div>
+
+      <SkeletonRow className="shrink-0 justify-end border-t border-divider-subtle bg-background-default-subtle px-6 py-4">
+        <SkeletonRectangle className="my-0 h-8 w-18 animate-pulse rounded-lg" />
+        <SkeletonRectangle className="my-0 h-8 w-22 animate-pulse rounded-lg" />
+      </SkeletonRow>
+    </div>
+  )
+}
diff --git a/web/features/deployments/deploy-drawer/ui/form.tsx b/web/features/deployments/deploy-drawer/ui/form.tsx
new file mode 100644
index 00000000000..354116eb015
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/ui/form.tsx
@@ -0,0 +1,269 @@
+'use client'
+
+import type {
+  Environment,
+  EnvironmentDeployment,
+  Release,
+} from '@dify/contracts/enterprise/types.gen'
+import { Button } from '@langgenius/dify-ui/button'
+import { useQuery } from '@tanstack/react-query'
+import { useAtomValue, useSetAtom } from 'jotai'
+import { ScopeProvider } from 'jotai-scope'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { EnvVarBindingsPanel } from '../../components/env-var-bindings'
+import { isAvailableDeploymentTarget } from '../../shared/domain/runtime-status'
+import { canAttemptDeployAtom, canSubmitDeployAtom, closeDeployDrawerAtom, deployBindingSlotsAtom, deployEnvVarSlotsAtom, deployEnvVarValuesAtom, deployHasBindingOptionsErrorAtom, deployHasSelectedEnvironmentAtom, deployIsBindingOptionsLoadingAtom, deployReadyFormConfigAtom, deployReadyFormLocalAtoms, deployReleaseSubmissionAtom, deploySelectedBindingsAtom, deployShowValidationErrorsAtom, deployTargetReleaseIdAtom, isDeployReleaseSubmittingAtom, selectDeployBindingAtom, setDeployEnvVarAtom, showDeployValidationErrorsAtom } from '../state'
+import {
+  currentReleaseIdForEnvironment,
+  selectableDeployReleases,
+} from '../state/release-options'
+import {
+  BindingOptionsPanel,
+  DEPLOY_DRAWER_BINDING_LIST_CLASS_NAME,
+  DeployFormHeader,
+  EnvironmentField,
+  ReleaseField,
+} from './form-sections'
+import { DeployFormSkeleton } from './form-skeleton'
+
+type DeployFormProps = {
+  appInstanceId: string
+  lockedEnvId?: string
+  presetReleaseId?: string
+}
+
+type DeployReadyFormProps = DeployFormProps & {
+  environments: Environment[]
+  releases: Release[]
+  runtimeRows: EnvironmentDeployment[]
+  defaultReleaseId?: string
+  releaseEmptyLabel?: string
+}
+
+function DeployRuntimeCredentialBindingsSection() {
+  const { t } = useTranslation('deployments')
+  const bindingSlots = useAtomValue(deployBindingSlotsAtom)
+  const selectedBindings = useAtomValue(deploySelectedBindingsAtom)
+  const isBindingOptionsLoading = useAtomValue(deployIsBindingOptionsLoadingAtom)
+  const hasBindingOptionsError = useAtomValue(deployHasBindingOptionsErrorAtom)
+  const showValidationErrors = useAtomValue(deployShowValidationErrorsAtom)
+  const selectBinding = useSetAtom(selectDeployBindingAtom)
+
+  return (
+    <BindingOptionsPanel
+      slots={bindingSlots}
+      selections={selectedBindings}
+      isLoading={isBindingOptionsLoading}
+      hasError={hasBindingOptionsError}
+      bindingCountLabel={t('deployDrawer.bindingCount', { count: bindingSlots.length })}
+      showMissingRequired={showValidationErrors}
+      onChange={selectBinding}
+    />
+  )
+}
+
+function DeployEnvVarBindingsSection() {
+  const { t } = useTranslation('deployments')
+  const envVarSlots = useAtomValue(deployEnvVarSlotsAtom)
+  const envVarValues = useAtomValue(deployEnvVarValuesAtom)
+  const isBindingOptionsLoading = useAtomValue(deployIsBindingOptionsLoadingAtom)
+  const hasBindingOptionsError = useAtomValue(deployHasBindingOptionsErrorAtom)
+  const showValidationErrors = useAtomValue(deployShowValidationErrorsAtom)
+  const setDeployEnvVar = useSetAtom(setDeployEnvVarAtom)
+
+  if (isBindingOptionsLoading || hasBindingOptionsError)
+    return null
+
+  return (
+    <EnvVarBindingsPanel
+      slots={envVarSlots}
+      values={envVarValues}
+      title={t('deployDrawer.envVars')}
+      hint={t('deployDrawer.envVarHint')}
+      envVarPlaceholder={t('deployDrawer.envVarPlaceholder')}
+      literalSourceLabel={t('deployDrawer.envVarSource.literal')}
+      defaultSourceLabel={t('deployDrawer.envVarSource.default')}
+      lastDeploymentSourceLabel={t('deployDrawer.envVarSource.lastDeployment')}
+      valueTypeLabels={{
+        string: t('deployDrawer.envVarType.string'),
+        number: t('deployDrawer.envVarType.number'),
+        secret: t('deployDrawer.envVarType.secret'),
+      }}
+      sourceAriaLabel={key => t('deployDrawer.envVarSource.ariaLabel', { key })}
+      defaultSourcePriority="lastDeployment"
+      envVarCountLabel={t('deployDrawer.envVarCount', { count: envVarSlots.length })}
+      missingRequiredLabel={t('deployDrawer.missingRequiredEnvVar')}
+      listClassName={DEPLOY_DRAWER_BINDING_LIST_CLASS_NAME}
+      showMissingRequired={showValidationErrors}
+      onChange={setDeployEnvVar}
+    />
+  )
+}
+
+function DeployBindingsSection() {
+  const targetReleaseId = useAtomValue(deployTargetReleaseIdAtom)
+  const hasSelectedEnvironment = useAtomValue(deployHasSelectedEnvironmentAtom)
+
+  if (!targetReleaseId || !hasSelectedEnvironment)
+    return null
+
+  return (
+    <>
+      <DeployRuntimeCredentialBindingsSection />
+      <DeployEnvVarBindingsSection />
+    </>
+  )
+}
+
+function DeployFormBody() {
+  return (
+    <div className="min-h-0 flex-1 overflow-y-auto px-6 py-5">
+      <div className="flex flex-col gap-5">
+        <ReleaseField />
+        <EnvironmentField />
+        <DeployBindingsSection />
+      </div>
+    </div>
+  )
+}
+
+function DeployFooter() {
+  const { t } = useTranslation('deployments')
+  const closeDeployDrawer = useSetAtom(closeDeployDrawerAtom)
+  const showValidationErrors = useSetAtom(showDeployValidationErrorsAtom)
+  const submitDeployRelease = useSetAtom(deployReleaseSubmissionAtom)
+  const canAttemptDeploy = useAtomValue(canAttemptDeployAtom)
+  const canDeploy = useAtomValue(canSubmitDeployAtom)
+  const isSubmitting = useAtomValue(isDeployReleaseSubmittingAtom)
+  const submitLabel = isSubmitting ? t('deployDrawer.deploying') : t('deployDrawer.deploy')
+
+  function handleDeploy() {
+    showValidationErrors()
+
+    if (!canDeploy)
+      return
+
+    submitDeployRelease({
+      deployFailedMessage: t('deployDrawer.deployFailed'),
+    })
+  }
+
+  return (
+    <div className="flex shrink-0 justify-end gap-2 border-t border-divider-subtle bg-background-default-subtle px-6 py-4">
+      <Button type="button" variant="secondary" onClick={closeDeployDrawer}>
+        {t('deployDrawer.cancel')}
+      </Button>
+      <Button variant="primary" disabled={!canAttemptDeploy} onClick={handleDeploy}>
+        {submitLabel}
+      </Button>
+    </div>
+  )
+}
+
+function deployReadyFormStoreKey({
+  appInstanceId,
+  environments,
+  releases,
+  runtimeRows,
+  defaultReleaseId,
+  lockedEnvId,
+  presetReleaseId,
+}: DeployReadyFormProps) {
+  return [
+    appInstanceId,
+    lockedEnvId ?? 'any',
+    presetReleaseId ?? 'new',
+    defaultReleaseId ?? 'none',
+    environments.map(env => env.id).join(','),
+    releases.map(release => release.id).join(','),
+    runtimeRows.map(row => `${row.environment.id}:${row.currentRelease?.id ?? 'none'}`).join(','),
+  ].join('|')
+}
+
+function DeployReadyForm(config: DeployReadyFormProps) {
+  return (
+    <ScopeProvider
+      atoms={[
+        [deployReadyFormConfigAtom, config],
+        ...deployReadyFormLocalAtoms,
+      ]}
+      name="DeployReadyForm"
+    >
+      <div className="flex min-h-0 flex-1 flex-col">
+        <DeployFormHeader />
+        <DeployFormBody />
+        <DeployFooter />
+      </div>
+    </ScopeProvider>
+  )
+}
+
+export function DeployForm({
+  appInstanceId,
+  lockedEnvId,
+  presetReleaseId,
+}: DeployFormProps) {
+  const { t } = useTranslation('deployments')
+  const releaseDeploymentViewQuery = useQuery(consoleQuery.enterprise.releaseService.computeReleaseDeploymentView.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+  }))
+
+  if (releaseDeploymentViewQuery.isLoading) {
+    return <DeployFormSkeleton />
+  }
+
+  if (releaseDeploymentViewQuery.isError) {
+    return (
+      <div className="p-4 system-sm-regular text-text-destructive">
+        {t('common.loadFailed')}
+      </div>
+    )
+  }
+
+  const deploymentView = releaseDeploymentViewQuery.data
+  if (!deploymentView) {
+    return (
+      <div className="p-4 system-sm-regular text-text-destructive">
+        {t('common.loadFailed')}
+      </div>
+    )
+  }
+
+  const runtimeRows = deploymentView.environmentDeployments
+  const environments = runtimeRows
+    .filter(row => lockedEnvId || isAvailableDeploymentTarget(row))
+    .map(row => row.environment)
+  const releaseRows = deploymentView.releases
+  const currentReleaseId = currentReleaseIdForEnvironment(runtimeRows, lockedEnvId)
+  const releases = selectableDeployReleases({
+    releases: releaseRows,
+    lockedEnvId,
+    currentReleaseId,
+    presetReleaseId,
+  })
+  const defaultReleaseId = releases[0]?.id
+  const releaseEmptyLabel = lockedEnvId && !presetReleaseId && currentReleaseId
+    ? t('deployDrawer.noOtherReleaseAvailable')
+    : undefined
+  const readyFormConfig = {
+    appInstanceId,
+    environments,
+    releases,
+    runtimeRows,
+    defaultReleaseId,
+    releaseEmptyLabel,
+    lockedEnvId,
+    presetReleaseId,
+  }
+  const formKey = deployReadyFormStoreKey(readyFormConfig)
+
+  return (
+    <DeployReadyForm
+      key={formKey}
+      {...readyFormConfig}
+    />
+  )
+}
diff --git a/web/features/deployments/deploy-drawer/ui/select.tsx b/web/features/deployments/deploy-drawer/ui/select.tsx
new file mode 100644
index 00000000000..ec38d0e07f8
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/ui/select.tsx
@@ -0,0 +1,135 @@
+'use client'
+
+import type { Environment, EnvironmentStatus } from '@dify/contracts/enterprise/types.gen'
+import { EnvironmentStatus as EnvironmentStatusEnum } from '@dify/contracts/enterprise/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Select, SelectContent, SelectItem, SelectItemIndicator, SelectItemText, SelectTrigger } from '@langgenius/dify-ui/select'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
+import { useTranslation } from 'react-i18next'
+import { TitleTooltip } from '../../components/title-tooltip'
+import { ModeBadge } from './status-badge'
+
+export function Field({ label, hint, children }: {
+  label: string
+  hint?: string
+  children: React.ReactNode
+}) {
+  return (
+    <div className="flex flex-col gap-2">
+      <div className="flex items-center justify-between">
+        <div className="system-xs-medium-uppercase text-text-tertiary">{label}</div>
+        {hint && <span className="system-xs-regular text-text-quaternary">{hint}</span>}
+      </div>
+      {children}
+    </div>
+  )
+}
+
+type SelectOption = {
+  value?: string
+  label: string
+  disabled?: boolean
+  disabledReason?: string
+}
+
+type SelectProps = {
+  value?: string
+  onChange: (value: string) => void
+  options: SelectOption[]
+  ariaLabel?: string
+  placeholder?: string
+}
+
+export function DeploymentSelect({ value, onChange, options, ariaLabel, placeholder }: SelectProps) {
+  const { t } = useTranslation('deployments')
+  const selectedOption = options.find(option => option.value === value)
+
+  return (
+    <Select
+      value={value ?? null}
+      onValueChange={(next) => {
+        if (!next)
+          return
+        onChange(next)
+      }}
+      disabled={options.length === 0}
+    >
+      <SelectTrigger
+        aria-label={ariaLabel ?? placeholder ?? t('deployDrawer.defaultSelect')}
+        className={cn(
+          'h-8 min-w-0 px-2 text-left system-sm-medium',
+          !selectedOption && 'text-text-quaternary',
+        )}
+      >
+        {selectedOption?.label ?? placeholder ?? t('deployDrawer.defaultSelect')}
+      </SelectTrigger>
+      <SelectContent popupClassName="w-(--anchor-width)">
+        {options.map(opt => opt.value
+          ? (
+              <SelectItem
+                key={opt.value}
+                value={opt.value}
+                disabled={opt.disabled}
+              >
+                <TitleTooltip content={opt.disabled ? opt.disabledReason : undefined}>
+                  <SelectItemText>{opt.label}</SelectItemText>
+                </TitleTooltip>
+                <SelectItemIndicator />
+              </SelectItem>
+            )
+          : null)}
+      </SelectContent>
+    </Select>
+  )
+}
+
+function EnvironmentHealthDot({ status }: {
+  status: EnvironmentStatus
+}) {
+  const { t } = useTranslation('deployments')
+  const label = t(`health.${status}`)
+  const isReady = status === EnvironmentStatusEnum.ENVIRONMENT_STATUS_READY
+
+  return (
+    <Tooltip>
+      <TooltipTrigger
+        render={(
+          <span
+            aria-label={label}
+            className={cn(
+              'flex size-4 shrink-0 items-center justify-center rounded-full',
+              isReady ? 'bg-util-colors-green-green-50' : 'bg-util-colors-warning-warning-50',
+            )}
+          >
+            <span
+              aria-hidden
+              className={cn(
+                'size-1.5 rounded-full',
+                isReady ? 'bg-util-colors-green-green-500' : 'bg-util-colors-warning-warning-500',
+              )}
+            />
+          </span>
+        )}
+      />
+      <TooltipContent>{label}</TooltipContent>
+    </Tooltip>
+  )
+}
+
+export function EnvironmentRow({ env }: { env: Environment }) {
+  const { t } = useTranslation('deployments')
+  const summary = env.description.trim() || t(`backend.${env.backend}`)
+
+  return (
+    <div className="flex items-center justify-between gap-3 rounded-lg border border-components-panel-border bg-components-panel-bg-blur px-3 py-2">
+      <div className="flex min-w-0 flex-col gap-1">
+        <div className="flex min-w-0 items-center gap-2">
+          <EnvironmentHealthDot status={env.status} />
+          <span className="truncate system-sm-semibold text-text-primary">{env.displayName}</span>
+          <ModeBadge mode={env.mode} />
+        </div>
+        <span className="line-clamp-1 system-xs-regular text-text-tertiary">{summary}</span>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/deployments/deploy-drawer/ui/status-badge.tsx b/web/features/deployments/deploy-drawer/ui/status-badge.tsx
new file mode 100644
index 00000000000..a171ff3cdc6
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/ui/status-badge.tsx
@@ -0,0 +1,22 @@
+'use client'
+import type { EnvironmentMode } from '@dify/contracts/enterprise/types.gen'
+import { EnvironmentMode as EnvironmentModeEnum } from '@dify/contracts/enterprise/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+
+const baseBadge = 'inline-flex items-center gap-1 rounded-md border px-2 py-0.5 system-xs-medium whitespace-nowrap'
+
+export function ModeBadge({ mode, className }: {
+  mode: EnvironmentMode
+  className?: string
+}) {
+  const { t } = useTranslation('deployments')
+  const style = mode === EnvironmentModeEnum.ENVIRONMENT_MODE_SHARED
+    ? 'border-util-colors-green-green-200 bg-util-colors-green-green-50 text-util-colors-green-green-700'
+    : 'border-util-colors-blue-blue-200 bg-util-colors-blue-blue-50 text-util-colors-blue-blue-700'
+  return (
+    <span className={cn(baseBadge, style, className)}>
+      {t(`mode.${mode}`)}
+    </span>
+  )
+}
diff --git a/web/features/deployments/detail/access-tab.tsx b/web/features/deployments/detail/access-tab.tsx
new file mode 100644
index 00000000000..fde0499d538
--- /dev/null
+++ b/web/features/deployments/detail/access-tab.tsx
@@ -0,0 +1,35 @@
+'use client'
+
+import { useQuery } from '@tanstack/react-query'
+import { consoleQuery } from '@/service/client'
+import { AccessChannelsSection } from './settings-tab/access/channels-section'
+import { AccessPermissionsSection } from './settings-tab/access/permissions-section'
+
+export function AccessTab({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  const accessSettingsQuery = useQuery(consoleQuery.enterprise.accessService.getAccessSettings.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+  }))
+
+  return (
+    <div className="flex w-full max-w-[960px] min-w-0 flex-col gap-y-4 px-6 py-6 sm:px-20 sm:py-8">
+      <AccessChannelsSection
+        appInstanceId={appInstanceId}
+        accessChannels={accessSettingsQuery.data?.accessChannels}
+        webAppEndpoints={accessSettingsQuery.data?.webAppEndpoints}
+        cliEndpoint={accessSettingsQuery.data?.cliEndpoint}
+        isLoading={accessSettingsQuery.isLoading}
+        isError={accessSettingsQuery.isError}
+      />
+      <AccessPermissionsSection
+        appInstanceId={appInstanceId}
+        environmentPolicies={accessSettingsQuery.data?.environmentPolicies}
+        isLoading={accessSettingsQuery.isLoading}
+        isError={accessSettingsQuery.isError}
+      />
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/common.tsx b/web/features/deployments/detail/common.tsx
new file mode 100644
index 00000000000..a02feb9b2cb
--- /dev/null
+++ b/web/features/deployments/detail/common.tsx
@@ -0,0 +1,96 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+
+type SectionProps = {
+  title: string
+  description?: string
+  action?: ReactNode
+  children: ReactNode
+  layout?: 'block' | 'row'
+  tone?: 'default' | 'destructive'
+  showDivider?: boolean
+}
+
+export function Section({
+  title,
+  description,
+  action,
+  children,
+  layout = 'block',
+  tone = 'default',
+  showDivider = true,
+}: SectionProps) {
+  const hasAction = Boolean(action)
+  const titleClassName = cn(
+    'system-sm-semibold',
+    tone === 'destructive'
+      ? 'text-util-colors-red-red-700'
+      : layout === 'row'
+        ? 'text-text-secondary'
+        : 'text-text-primary',
+  )
+  const descriptionClassName = cn(
+    'mt-1 body-xs-regular',
+    tone === 'destructive' ? 'text-util-colors-red-red-600' : 'text-text-tertiary',
+  )
+
+  if (layout === 'row') {
+    return (
+      <section className={cn('py-4 first:pt-0 last:pb-0', showDivider && 'border-b border-divider-subtle last:border-b-0')}>
+        <div className="flex flex-col gap-3 sm:flex-row sm:gap-x-6">
+          <div className="flex min-w-0 shrink-0 flex-col sm:w-40 sm:pt-1">
+            <div className={titleClassName}>
+              {title}
+            </div>
+            {description && (
+              <p className={descriptionClassName}>
+                {description}
+              </p>
+            )}
+          </div>
+          <div className="min-w-0 grow">
+            {hasAction
+              ? (
+                  <div className="flex min-w-0 items-start gap-3">
+                    <div className="min-w-0 grow">
+                      {children}
+                    </div>
+                    <div className="shrink-0">
+                      {action}
+                    </div>
+                  </div>
+                )
+              : children}
+          </div>
+        </div>
+      </section>
+    )
+  }
+
+  return (
+    <section className={cn('py-6 first:pt-0 last:pb-0', showDivider && 'border-b border-divider-subtle last:border-b-0')}>
+      <div className="mb-3 flex min-w-0 flex-col">
+        <div className="flex min-w-0 flex-wrap items-center gap-x-3 gap-y-2">
+          <div className={titleClassName}>
+            {title}
+          </div>
+          {hasAction && (
+            <div className="shrink-0">
+              {action}
+            </div>
+          )}
+        </div>
+        {description && (
+          <p className={cn(descriptionClassName, 'max-w-150')}>
+            {description}
+          </p>
+        )}
+      </div>
+      <div className="min-w-0">
+        {children}
+      </div>
+    </section>
+  )
+}
diff --git a/web/features/deployments/detail/deploy-tab.tsx b/web/features/deployments/detail/deploy-tab.tsx
new file mode 100644
index 00000000000..17414e9712a
--- /dev/null
+++ b/web/features/deployments/detail/deploy-tab.tsx
@@ -0,0 +1,125 @@
+'use client'
+import { useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import { consoleQuery } from '@/service/client'
+import { DeploymentEmptyState, DeploymentStateMessage } from '../components/empty-state'
+import { deploymentStatusPollingInterval, hasRuntimeInstanceDeployment } from '../shared/domain/runtime-status'
+import { DeploymentEnvironmentList } from './deploy-tab/deployment-environment-list'
+import { NewDeploymentButton } from './deploy-tab/new-deployment-button'
+import {
+  DetailTable,
+  DetailTableBody,
+  DetailTableCard,
+  DetailTableCardList,
+  DetailTableCell,
+  DetailTableHead,
+  DetailTableHeader,
+  DetailTableRow,
+} from './table'
+import {
+  DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES,
+} from './table-styles'
+
+const DEPLOYMENT_TABLE_ROW_SKELETON_KEYS = ['production', 'staging']
+
+function DeploymentEnvironmentListSkeleton() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <>
+      <DetailTableCardList className="pc:hidden">
+        {DEPLOYMENT_TABLE_ROW_SKELETON_KEYS.map(key => (
+          <DetailTableCard key={key}>
+            <div className="flex flex-col gap-3 p-4">
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <SkeletonRectangle className="h-3 w-32 animate-pulse" />
+                <SkeletonRectangle className="my-0 h-4 w-18 animate-pulse rounded-md" />
+              </div>
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <SkeletonRectangle className="h-2.5 w-24 animate-pulse" />
+                <SkeletonRow className="gap-2">
+                  <SkeletonRectangle className="h-3 w-16 animate-pulse" />
+                  <SkeletonRectangle className="h-2.5 w-18 animate-pulse" />
+                </SkeletonRow>
+              </div>
+              <SkeletonRectangle className="my-0 size-8 animate-pulse rounded-md" />
+            </div>
+          </DetailTableCard>
+        ))}
+      </DetailTableCardList>
+      <div className="hidden pc:block">
+        <DetailTable>
+          <DetailTableHeader>
+            <DetailTableRow>
+              <DetailTableHead className={DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.environment}>{t('deployTab.col.environment')}</DetailTableHead>
+              <DetailTableHead className={DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.status}>{t('deployTab.col.status')}</DetailTableHead>
+              <DetailTableHead className={DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.currentRelease}>{t('deployTab.col.currentRelease')}</DetailTableHead>
+              <DetailTableHead className={`${DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.actions} text-right`}>{t('deployTab.col.actions')}</DetailTableHead>
+            </DetailTableRow>
+          </DetailTableHeader>
+          <DetailTableBody>
+            {DEPLOYMENT_TABLE_ROW_SKELETON_KEYS.map(key => (
+              <DetailTableRow key={key}>
+                <DetailTableCell>
+                  <SkeletonRectangle className="h-3 w-32 animate-pulse" />
+                </DetailTableCell>
+                <DetailTableCell>
+                  <SkeletonRectangle className="my-0 h-4 w-18 animate-pulse rounded-md" />
+                </DetailTableCell>
+                <DetailTableCell>
+                  <SkeletonRow className="gap-2">
+                    <SkeletonRectangle className="h-3 w-16 animate-pulse" />
+                    <SkeletonRectangle className="h-2.5 w-18 animate-pulse" />
+                  </SkeletonRow>
+                </DetailTableCell>
+                <DetailTableCell className={DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.actions}>
+                  <div className="flex justify-end">
+                    <SkeletonRectangle className="my-0 size-8 animate-pulse rounded-md" />
+                  </div>
+                </DetailTableCell>
+              </DetailTableRow>
+            ))}
+          </DetailTableBody>
+        </DetailTable>
+      </div>
+    </>
+  )
+}
+
+export function DeployTab({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  const { t } = useTranslation('deployments')
+  const environmentDeploymentsQuery = useQuery(consoleQuery.enterprise.deploymentService.listEnvironmentDeployments.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+    refetchInterval: query => deploymentStatusPollingInterval(query.state.data?.environmentDeployments),
+  }))
+  const environmentDeployments = environmentDeploymentsQuery.data
+  const rows = environmentDeployments?.environmentDeployments.filter(hasRuntimeInstanceDeployment) ?? []
+  const isLoading = environmentDeploymentsQuery.isLoading
+  const hasError = environmentDeploymentsQuery.isError
+
+  return (
+    <div className="flex w-full min-w-0 flex-col gap-4 px-6 py-6">
+      {isLoading
+        ? <DeploymentEnvironmentListSkeleton />
+        : hasError
+          ? <DeploymentStateMessage variant="list">{t('common.loadFailed')}</DeploymentStateMessage>
+          : rows.length === 0
+            ? (
+                <DeploymentEmptyState
+                  icon="i-ri-server-line"
+                  title={t('deployTab.emptyTitle')}
+                  description={t('deployTab.emptyDescription')}
+                  action={<NewDeploymentButton appInstanceId={appInstanceId} />}
+                />
+              )
+            : (
+                <DeploymentEnvironmentList appInstanceId={appInstanceId} rows={rows} />
+              )}
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/deploy-tab/deployment-environment-list.tsx b/web/features/deployments/detail/deploy-tab/deployment-environment-list.tsx
new file mode 100644
index 00000000000..d01d908aaaa
--- /dev/null
+++ b/web/features/deployments/detail/deploy-tab/deployment-environment-list.tsx
@@ -0,0 +1,163 @@
+'use client'
+
+import type { EnvironmentDeployment } from '@dify/contracts/enterprise/types.gen'
+import { useTranslation } from 'react-i18next'
+import { releaseCommit } from '../../shared/domain/release'
+import { isUndeployedDeploymentRow } from '../../shared/domain/runtime-status'
+import {
+  DetailTable,
+  DetailTableBody,
+  DetailTableCard,
+  DetailTableCardList,
+  DetailTableCell,
+  DetailTableHead,
+  DetailTableHeader,
+  DetailTableRow,
+} from '../table'
+import {
+  DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES,
+} from '../table-styles'
+import { DeploymentRowActions } from './deployment-row-actions'
+import { DeploymentStatusSummary } from './deployment-status-summary'
+
+function EnvironmentSummary({ environment }: {
+  environment: EnvironmentDeployment['environment']
+}) {
+  return (
+    <span className="block truncate text-text-primary">
+      {environment.displayName}
+    </span>
+  )
+}
+
+function CurrentReleaseSummary({ release }: {
+  release: EnvironmentDeployment['currentRelease']
+}) {
+  if (!release)
+    return <span className="text-text-quaternary">—</span>
+
+  const commit = releaseCommit(release)
+
+  return (
+    <div className="flex min-w-0 flex-col gap-1">
+      <div className="flex min-w-0 items-baseline gap-1.5">
+        <span className="truncate text-text-primary">
+          {release.displayName}
+        </span>
+        {commit !== '—' && (
+          <span className="shrink-0 font-mono system-xs-regular text-text-tertiary">
+            {commit}
+          </span>
+        )}
+      </div>
+    </div>
+  )
+}
+
+function CurrentReleaseMobileSummary({ release }: {
+  release: EnvironmentDeployment['currentRelease']
+}) {
+  const { t } = useTranslation('deployments')
+
+  if (!release)
+    return null
+
+  return (
+    <div className="flex min-w-0 flex-col gap-1">
+      <span className="system-2xs-medium-uppercase text-text-tertiary">
+        {t('deployTab.col.currentRelease')}
+      </span>
+      <CurrentReleaseSummary release={release} />
+    </div>
+  )
+}
+
+function DeploymentEnvironmentMobileRow({ appInstanceId, row }: {
+  appInstanceId: string
+  row: EnvironmentDeployment
+}) {
+  const envId = row.environment.id
+  const release = row.currentRelease
+
+  return (
+    <DetailTableCard>
+      <div className="flex flex-col gap-3 p-4 text-left">
+        <div className="flex min-w-0 flex-col gap-1">
+          <EnvironmentSummary environment={row.environment} />
+          <DeploymentStatusSummary row={row} />
+        </div>
+        {!isUndeployedDeploymentRow(row) && <CurrentReleaseMobileSummary release={release} />}
+        <div className="flex min-w-0 items-center justify-start gap-2">
+          <DeploymentRowActions appInstanceId={appInstanceId} envId={envId} row={row} />
+        </div>
+      </div>
+    </DetailTableCard>
+  )
+}
+
+function DeploymentEnvironmentDesktopRows({ appInstanceId, rows }: {
+  appInstanceId: string
+  rows: EnvironmentDeployment[]
+}) {
+  return (
+    <>
+      {rows.map((row) => {
+        const envId = row.environment.id
+        return (
+          <DetailTableRow key={envId}>
+            <DetailTableCell>
+              <EnvironmentSummary environment={row.environment} />
+            </DetailTableCell>
+            <DetailTableCell>
+              <DeploymentStatusSummary row={row} />
+            </DetailTableCell>
+            <DetailTableCell>
+              <CurrentReleaseSummary release={row.currentRelease} />
+            </DetailTableCell>
+            <DetailTableCell className={DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.actions}>
+              <div className="flex min-h-8 justify-end">
+                <DeploymentRowActions appInstanceId={appInstanceId} envId={envId} row={row} />
+              </div>
+            </DetailTableCell>
+          </DetailTableRow>
+        )
+      })}
+    </>
+  )
+}
+
+export function DeploymentEnvironmentList({ appInstanceId, rows }: {
+  appInstanceId: string
+  rows: EnvironmentDeployment[]
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <>
+      <DetailTableCardList className="pc:hidden">
+        {rows.map(row => (
+          <DeploymentEnvironmentMobileRow
+            key={row.environment.id}
+            appInstanceId={appInstanceId}
+            row={row}
+          />
+        ))}
+      </DetailTableCardList>
+      <div className="hidden pc:block">
+        <DetailTable>
+          <DetailTableHeader>
+            <DetailTableRow>
+              <DetailTableHead className={DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.environment}>{t('deployTab.col.environment')}</DetailTableHead>
+              <DetailTableHead className={DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.status}>{t('deployTab.col.status')}</DetailTableHead>
+              <DetailTableHead className={DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.currentRelease}>{t('deployTab.col.currentRelease')}</DetailTableHead>
+              <DetailTableHead className={`${DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES.actions} text-right`}>{t('deployTab.col.actions')}</DetailTableHead>
+            </DetailTableRow>
+          </DetailTableHeader>
+          <DetailTableBody>
+            <DeploymentEnvironmentDesktopRows appInstanceId={appInstanceId} rows={rows} />
+          </DetailTableBody>
+        </DetailTable>
+      </div>
+    </>
+  )
+}
diff --git a/web/features/deployments/detail/deploy-tab/deployment-error-dialog.tsx b/web/features/deployments/detail/deploy-tab/deployment-error-dialog.tsx
new file mode 100644
index 00000000000..343d0aab701
--- /dev/null
+++ b/web/features/deployments/detail/deploy-tab/deployment-error-dialog.tsx
@@ -0,0 +1,76 @@
+'use client'
+
+import type { EnvironmentDeployment } from '@dify/contracts/enterprise/types.gen'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { useTranslation } from 'react-i18next'
+
+function DeploymentErrorDetails({ error }: {
+  error?: EnvironmentDeployment['error']
+}) {
+  const { t } = useTranslation('deployments')
+  const message = error?.message?.trim() || t('deployTab.panel.unknownError')
+  const metadata = [
+    ...(error?.phase ? [{ label: t('deployTab.errorPhase'), value: error.phase }] : []),
+    ...(error?.code ? [{ label: t('deployTab.errorCode'), value: error.code }] : []),
+  ]
+
+  return (
+    <div className="rounded-xl border border-divider-subtle bg-background-default-subtle p-3">
+      <div className="system-xs-medium-uppercase text-text-tertiary">
+        {t('deployTab.errorMessage')}
+      </div>
+      <div className="mt-1 system-sm-regular break-words whitespace-pre-wrap text-text-secondary">
+        {message}
+      </div>
+      {metadata.length > 0 && (
+        <div className="mt-3 flex flex-wrap gap-2">
+          {metadata.map(item => (
+            <span
+              key={item.label}
+              className="inline-flex max-w-full items-center gap-1.5 rounded-md border border-divider-subtle bg-background-default px-2 py-1 system-xs-regular text-text-tertiary"
+            >
+              <span className="shrink-0 text-text-quaternary">{item.label}</span>
+              <span className="truncate font-mono text-text-secondary">{item.value}</span>
+            </span>
+          ))}
+        </div>
+      )}
+    </div>
+  )
+}
+
+export function DeploymentErrorDialog({ open, row, onOpenChange }: {
+  open: boolean
+  row: EnvironmentDeployment
+  onOpenChange: (open: boolean) => void
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <AlertDialog open={open} onOpenChange={onOpenChange}>
+      <AlertDialogContent className="w-120">
+        <div className="flex flex-col gap-3 px-6 pt-6 pb-2">
+          <AlertDialogTitle className="title-2xl-semi-bold text-text-primary">
+            {t('deployTab.errorDialogTitle', { name: row.environment.displayName })}
+          </AlertDialogTitle>
+          <AlertDialogDescription className="system-sm-regular text-text-tertiary">
+            {t('deployTab.errorDialogDesc')}
+          </AlertDialogDescription>
+          <DeploymentErrorDetails error={row.error} />
+        </div>
+        <AlertDialogActions className="pt-3">
+          <AlertDialogCancelButton variant="secondary">
+            {t('deployTab.closeError')}
+          </AlertDialogCancelButton>
+        </AlertDialogActions>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}
diff --git a/web/features/deployments/detail/deploy-tab/deployment-row-actions-menu.tsx b/web/features/deployments/detail/deploy-tab/deployment-row-actions-menu.tsx
new file mode 100644
index 00000000000..5561d2a3b2e
--- /dev/null
+++ b/web/features/deployments/detail/deploy-tab/deployment-row-actions-menu.tsx
@@ -0,0 +1,135 @@
+'use client'
+
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { DETAIL_TABLE_ACTION_TRIGGER_CLASS_NAME } from '../table-styles'
+
+export function DeploymentActionsDropdown({
+  currentReleaseId,
+  deployActionLabel,
+  failedReleaseId,
+  isDeployFailed,
+  isDeploymentInProgress,
+  isUndeployed,
+  undeployActionDisabled,
+  onDeploy,
+  onRequestUndeploy,
+  onViewError,
+}: {
+  currentReleaseId?: string
+  deployActionLabel: string
+  failedReleaseId?: string
+  isDeployFailed: boolean
+  isDeploymentInProgress: boolean
+  isUndeployed: boolean
+  undeployActionDisabled: boolean
+  onDeploy: (releaseId?: string) => void
+  onRequestUndeploy: () => void
+  onViewError: () => void
+}) {
+  const { t } = useTranslation('deployments')
+  const [open, setOpen] = useState(false)
+
+  if (isDeploymentInProgress)
+    return null
+
+  function handleDeployAction(releaseId?: string) {
+    onDeploy(releaseId)
+    setOpen(false)
+  }
+
+  function handleViewError() {
+    onViewError()
+    setOpen(false)
+  }
+
+  function handleRequestUndeploy() {
+    if (undeployActionDisabled)
+      return
+
+    onRequestUndeploy()
+    setOpen(false)
+  }
+
+  return (
+    <DropdownMenu modal={false} open={open} onOpenChange={setOpen}>
+      <DropdownMenuTrigger
+        aria-label={t('deployTab.moreActions')}
+        className={DETAIL_TABLE_ACTION_TRIGGER_CLASS_NAME}
+      >
+        <span aria-hidden className="i-ri-more-fill size-4" />
+      </DropdownMenuTrigger>
+      {open && (
+        <DropdownMenuContent placement="bottom-end" sideOffset={4} popupClassName="min-w-44">
+          {isDeployFailed
+            ? (
+                <>
+                  <DropdownMenuItem
+                    className="gap-2 px-3"
+                    onClick={handleViewError}
+                  >
+                    <span aria-hidden className="i-ri-error-warning-line size-4 shrink-0 text-text-tertiary" />
+                    <span className="system-sm-regular text-text-secondary">{t('deployTab.viewError')}</span>
+                  </DropdownMenuItem>
+                  <DropdownMenuItem
+                    className="gap-2 px-3"
+                    onClick={() => handleDeployAction(failedReleaseId)}
+                  >
+                    <span aria-hidden className="i-ri-refresh-line size-4 shrink-0 text-text-tertiary" />
+                    <span className="system-sm-regular text-text-secondary">
+                      {failedReleaseId ? t('deployTab.retry') : t('deployTab.deployOtherVersion')}
+                    </span>
+                  </DropdownMenuItem>
+                </>
+              )
+            : (
+                <>
+                  {!isUndeployed && currentReleaseId && (
+                    <DropdownMenuItem
+                      className="gap-2 px-3"
+                      onClick={() => handleDeployAction(currentReleaseId)}
+                    >
+                      <span aria-hidden className="i-ri-refresh-line size-4 shrink-0 text-text-tertiary" />
+                      <span className="system-sm-regular text-text-secondary">{t('deployTab.redeploy')}</span>
+                    </DropdownMenuItem>
+                  )}
+                  <DropdownMenuItem
+                    className="gap-2 px-3"
+                    onClick={() => handleDeployAction()}
+                  >
+                    <span aria-hidden className="i-ri-rocket-line size-4 shrink-0 text-text-tertiary" />
+                    <span className="system-sm-regular text-text-secondary">{deployActionLabel}</span>
+                  </DropdownMenuItem>
+                </>
+              )}
+          {!isUndeployed && (
+            <>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem
+                variant="destructive"
+                disabled={undeployActionDisabled}
+                aria-disabled={undeployActionDisabled}
+                className={cn(
+                  'gap-2 px-3',
+                  undeployActionDisabled && 'cursor-not-allowed opacity-60',
+                )}
+                onClick={handleRequestUndeploy}
+              >
+                <span aria-hidden className="i-ri-logout-box-line size-4 shrink-0" />
+                <span className="system-sm-regular">{t('deployTab.undeploy')}</span>
+              </DropdownMenuItem>
+            </>
+          )}
+        </DropdownMenuContent>
+      )}
+    </DropdownMenu>
+  )
+}
diff --git a/web/features/deployments/detail/deploy-tab/deployment-row-actions.tsx b/web/features/deployments/detail/deploy-tab/deployment-row-actions.tsx
new file mode 100644
index 00000000000..33af0ae3f2a
--- /dev/null
+++ b/web/features/deployments/detail/deploy-tab/deployment-row-actions.tsx
@@ -0,0 +1,109 @@
+'use client'
+
+import type { EnvironmentDeployment } from '@dify/contracts/enterprise/types.gen'
+import { RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+import { useMutation } from '@tanstack/react-query'
+import { useSetAtom } from 'jotai'
+import { useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { openDeployDrawerAtom } from '../../deploy-drawer/state'
+import { createDeploymentIdempotencyKey } from '../../shared/domain/idempotency'
+import { isRuntimeDeploymentInProgress, isUndeployedDeploymentRow } from '../../shared/domain/runtime-status'
+import { DeploymentErrorDialog } from './deployment-error-dialog'
+import { DeploymentActionsDropdown } from './deployment-row-actions-menu'
+import { UndeployDeploymentDialog } from './undeploy-deployment-dialog'
+
+export function DeploymentRowActions({ appInstanceId, envId, row }: {
+  appInstanceId: string
+  envId: string
+  row: EnvironmentDeployment
+}) {
+  const { t } = useTranslation('deployments')
+  const openDeployDrawer = useSetAtom(openDeployDrawerAtom)
+  const undeployDeployment = useMutation(consoleQuery.enterprise.deploymentService.undeploy.mutationOptions())
+  const isUndeployed = isUndeployedDeploymentRow(row)
+  const status = row.status
+  const [showUndeployConfirm, setShowUndeployConfirm] = useState(false)
+  const [showErrorDetail, setShowErrorDetail] = useState(false)
+  const [isUndeploying, setIsUndeploying] = useState(false)
+  const undeployInFlightRef = useRef(false)
+  const isUndeployRequesting = undeployDeployment.isPending || isUndeploying
+  const undeployActionDisabled = isUndeployRequesting
+  const isDeploymentInProgress = isRuntimeDeploymentInProgress(status)
+  const isDeployFailed = status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_FAILED
+  const currentReleaseId = row.currentRelease?.id
+  const failedReleaseId = row.desiredRelease?.id ?? row.currentRelease?.id
+  const deployActionLabel = isUndeployed
+    ? t('deployDrawer.deploy')
+    : t('deployTab.deployOtherVersion')
+
+  function handleDeployAction(releaseId?: string) {
+    openDeployDrawer({ appInstanceId, environmentId: envId, releaseId })
+  }
+
+  function handleUndeploy() {
+    if (undeployInFlightRef.current)
+      return
+    undeployInFlightRef.current = true
+    setIsUndeploying(true)
+    undeployDeployment.mutate(
+      {
+        params: { appInstanceId, environmentId: envId },
+        body: {
+          appInstanceId,
+          environmentId: envId,
+          idempotencyKey: createDeploymentIdempotencyKey(),
+        },
+      },
+      {
+        onSettled: () => {
+          undeployInFlightRef.current = false
+          setIsUndeploying(false)
+          setShowUndeployConfirm(false)
+        },
+      },
+    )
+  }
+
+  return (
+    <div
+      role="presentation"
+      className="flex shrink-0 items-center"
+      onClick={e => e.stopPropagation()}
+      onKeyDown={e => e.stopPropagation()}
+    >
+      <DeploymentActionsDropdown
+        currentReleaseId={currentReleaseId}
+        deployActionLabel={deployActionLabel}
+        failedReleaseId={failedReleaseId}
+        isDeployFailed={isDeployFailed}
+        isDeploymentInProgress={isDeploymentInProgress}
+        isUndeployed={isUndeployed}
+        undeployActionDisabled={undeployActionDisabled}
+        onDeploy={handleDeployAction}
+        onRequestUndeploy={() => setShowUndeployConfirm(true)}
+        onViewError={() => setShowErrorDetail(true)}
+      />
+
+      {isDeployFailed && (
+        <DeploymentErrorDialog
+          open={showErrorDetail}
+          row={row}
+          onOpenChange={setShowErrorDetail}
+        />
+      )}
+
+      {!isUndeployed && !isDeploymentInProgress && (
+        <UndeployDeploymentDialog
+          open={showUndeployConfirm}
+          row={row}
+          isRequesting={isUndeployRequesting}
+          disabled={undeployActionDisabled}
+          onConfirm={handleUndeploy}
+          onOpenChange={setShowUndeployConfirm}
+        />
+      )}
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/deploy-tab/deployment-status-summary.tsx b/web/features/deployments/detail/deploy-tab/deployment-status-summary.tsx
new file mode 100644
index 00000000000..e5b58e9051e
--- /dev/null
+++ b/web/features/deployments/detail/deploy-tab/deployment-status-summary.tsx
@@ -0,0 +1,107 @@
+'use client'
+
+import type { EnvironmentDeployment } from '@dify/contracts/enterprise/types.gen'
+import { RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+import { useTranslation } from 'react-i18next'
+import {
+  isUndeployedDeploymentRow,
+} from '../../shared/domain/runtime-status'
+import { DeploymentStatusBadge } from '../../shared/ui/deployment-status-badge'
+
+export function DeploymentStatusSummary({ row }: {
+  row: EnvironmentDeployment
+}) {
+  const { t } = useTranslation('deployments')
+  const status = row.status
+
+  if (status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING) {
+    return (
+      <DeploymentStatusBadge
+        status={status}
+        label={t(`status.${status}`)}
+        variant="status-dot"
+      />
+    )
+  }
+
+  if (isUndeployedDeploymentRow(row)) {
+    return (
+      <DeploymentStatusBadge
+        status={RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED}
+        label={t(`status.${RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED}`)}
+        variant="status-dot"
+      />
+    )
+  }
+
+  if (status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING) {
+    const targetRelease = row.desiredRelease ?? row.currentRelease
+    if (!targetRelease) {
+      return (
+        <DeploymentStatusBadge
+          status={RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING}
+          label={t(`status.${RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING}`)}
+          variant="status-dot"
+        />
+      )
+    }
+
+    return (
+      <DeploymentStatusBadge
+        status={status}
+        label={t('deployTab.status.deployingRelease', { release: targetRelease.displayName })}
+        variant="status-dot"
+      />
+    )
+  }
+
+  if (status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_FAILED) {
+    const hasRunningRelease = Boolean(row.currentRelease)
+    return (
+      <DeploymentStatusBadge
+        status={status}
+        label={t(hasRunningRelease ? 'deployTab.status.runningWithFailed' : 'deployTab.status.deployFailed')}
+        variant="status-dot"
+      />
+    )
+  }
+
+  if (status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DRIFTED) {
+    const hasRunningRelease = Boolean(row.currentRelease)
+    return (
+      <DeploymentStatusBadge
+        status={status}
+        label={t(hasRunningRelease ? 'deployTab.status.runningOutOfSync' : `status.${status}`)}
+        variant="status-dot"
+      />
+    )
+  }
+
+  if (status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_INVALID) {
+    return (
+      <DeploymentStatusBadge
+        status={status}
+        label={t(`status.${status}`)}
+        variant="status-dot"
+      />
+    )
+  }
+
+  if (status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED) {
+    return (
+      <DeploymentStatusBadge
+        status={status}
+        label={t(`status.${status}`)}
+        variant="status-dot"
+      />
+    )
+  }
+
+  return (
+    <DeploymentStatusBadge
+      status={RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY}
+      label={t(`status.${RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY}`)}
+      variant="status-dot"
+    />
+  )
+}
diff --git a/web/features/deployments/detail/deploy-tab/new-deployment-button.tsx b/web/features/deployments/detail/deploy-tab/new-deployment-button.tsx
new file mode 100644
index 00000000000..26b231dd6a8
--- /dev/null
+++ b/web/features/deployments/detail/deploy-tab/new-deployment-button.tsx
@@ -0,0 +1,45 @@
+'use client'
+
+import { Button } from '@langgenius/dify-ui/button'
+import { useQuery } from '@tanstack/react-query'
+import { useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { openDeployDrawerAtom } from '../../deploy-drawer/state'
+import { deploymentStatusPollingInterval, hasRuntimeInstanceDeployment } from '../../shared/domain/runtime-status'
+
+export function NewDeploymentButton({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  const { t } = useTranslation('deployments')
+  const openDeployDrawer = useSetAtom(openDeployDrawerAtom)
+
+  return (
+    <Button
+      size="medium"
+      variant="primary"
+      className="gap-1.5"
+      onClick={() => openDeployDrawer({ appInstanceId })}
+    >
+      <span className="i-ri-rocket-line size-4 shrink-0" aria-hidden="true" />
+      {t('deployTab.newDeployment')}
+    </Button>
+  )
+}
+
+export function NewDeploymentHeaderAction({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  const environmentDeploymentsQuery = useQuery(consoleQuery.enterprise.deploymentService.listEnvironmentDeployments.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+    refetchInterval: query => deploymentStatusPollingInterval(query.state.data?.environmentDeployments),
+  }))
+  const rows = environmentDeploymentsQuery.data?.environmentDeployments.filter(hasRuntimeInstanceDeployment) ?? []
+
+  if (environmentDeploymentsQuery.isLoading || environmentDeploymentsQuery.isError || rows.length === 0)
+    return null
+
+  return <NewDeploymentButton appInstanceId={appInstanceId} />
+}
diff --git a/web/features/deployments/detail/deploy-tab/undeploy-deployment-dialog.tsx b/web/features/deployments/detail/deploy-tab/undeploy-deployment-dialog.tsx
new file mode 100644
index 00000000000..a5ea48a0264
--- /dev/null
+++ b/web/features/deployments/detail/deploy-tab/undeploy-deployment-dialog.tsx
@@ -0,0 +1,65 @@
+'use client'
+
+import type { EnvironmentDeployment } from '@dify/contracts/enterprise/types.gen'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { useTranslation } from 'react-i18next'
+
+export function UndeployDeploymentDialog({
+  disabled,
+  isRequesting,
+  open,
+  row,
+  onConfirm,
+  onOpenChange,
+}: {
+  disabled: boolean
+  isRequesting: boolean
+  open: boolean
+  row: EnvironmentDeployment
+  onConfirm: () => void
+  onOpenChange: (open: boolean) => void
+}) {
+  const { t } = useTranslation('deployments')
+
+  function handleOpenChange(nextOpen: boolean) {
+    if (isRequesting)
+      return
+
+    onOpenChange(nextOpen)
+  }
+
+  return (
+    <AlertDialog open={open} onOpenChange={handleOpenChange}>
+      <AlertDialogContent className="w-120">
+        <div className="flex flex-col gap-3 px-6 pt-6 pb-2">
+          <AlertDialogTitle className="title-2xl-semi-bold text-text-primary">
+            {t('deployTab.undeployConfirmTitle', { name: row.environment.displayName })}
+          </AlertDialogTitle>
+          <AlertDialogDescription className="system-sm-regular text-text-tertiary">
+            {t('deployTab.undeployConfirmDesc')}
+          </AlertDialogDescription>
+        </div>
+        <AlertDialogActions className="pt-3">
+          <AlertDialogCancelButton variant="secondary" disabled={isRequesting}>
+            {t('deployDrawer.cancel')}
+          </AlertDialogCancelButton>
+          <AlertDialogConfirmButton
+            loading={isRequesting}
+            disabled={disabled}
+            onClick={onConfirm}
+          >
+            {t('deployTab.confirmUndeploy')}
+          </AlertDialogConfirmButton>
+        </AlertDialogActions>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}
diff --git a/web/features/deployments/detail/deployment-sidebar.tsx b/web/features/deployments/detail/deployment-sidebar.tsx
new file mode 100644
index 00000000000..efe86ba7b3d
--- /dev/null
+++ b/web/features/deployments/detail/deployment-sidebar.tsx
@@ -0,0 +1,321 @@
+'use client'
+
+import type { ComponentProps, PropsWithoutRef } from 'react'
+import type { InstanceDetailTabKey } from './tabs'
+import type { NavIcon } from '@/app/components/app-sidebar/nav-link'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Kbd, KbdGroup } from '@langgenius/dify-ui/kbd'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
+import { formatForDisplay } from '@tanstack/react-hotkeys'
+import { useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import NavLink from '@/app/components/app-sidebar/nav-link'
+import ToggleButton from '@/app/components/app-sidebar/toggle-button'
+import Divider from '@/app/components/base/divider'
+import SidebarLeftArrowIcon from '@/app/components/base/icons/src/vender/SidebarLeftArrowIcon'
+import { SkeletonContainer, SkeletonRectangle } from '@/app/components/base/skeleton'
+import { useSetGotoAnythingOpen } from '@/app/components/goto-anything/atoms'
+import Link from '@/next/link'
+import { usePathname, useRouter } from '@/next/navigation'
+import { consoleQuery } from '@/service/client'
+import { DeploymentActionsMenu } from '../components/deployment-actions'
+import { TitleTooltip } from '../components/title-tooltip'
+
+type TabDef = {
+  key: InstanceDetailTabKey
+  icon: NavIcon
+  selectedIcon: NavIcon
+}
+
+type TailwindNavIconProps = PropsWithoutRef<ComponentProps<'svg'>> & {
+  title?: string
+  titleId?: string
+}
+
+function OverviewIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-dashboard-2-line', className)} />
+}
+function OverviewSelectedIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-dashboard-2-fill', className)} />
+}
+function DeployIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-server-line', className)} />
+}
+function DeploySelectedIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-server-fill', className)} />
+}
+function VersionsIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-stack-line', className)} />
+}
+function VersionsSelectedIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-stack-fill', className)} />
+}
+function AccessIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-shield-user-line', className)} />
+}
+function AccessSelectedIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-shield-user-fill', className)} />
+}
+function ApiIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-code-s-slash-line', className)} />
+}
+function ApiSelectedIcon({ className }: TailwindNavIconProps) {
+  return <span aria-hidden className={cn('i-ri-code-s-slash-fill', className)} />
+}
+
+const DEPLOYMENT_TABS: TabDef[] = [
+  { key: 'overview', icon: OverviewIcon, selectedIcon: OverviewSelectedIcon },
+  { key: 'instances', icon: DeployIcon, selectedIcon: DeploySelectedIcon },
+  { key: 'releases', icon: VersionsIcon, selectedIcon: VersionsSelectedIcon },
+  { key: 'access', icon: AccessIcon, selectedIcon: AccessSelectedIcon },
+  { key: 'api-tokens', icon: ApiIcon, selectedIcon: ApiSelectedIcon },
+]
+
+const SEARCH_SHORTCUT = ['Mod', 'K']
+
+const getDeploymentIdFromPathname = (pathname: string) => {
+  const [section, appInstanceId] = pathname.split('/').filter(Boolean)
+  return section === 'deployments' ? appInstanceId : undefined
+}
+
+function DeploymentIcon({ expand }: {
+  expand: boolean
+}) {
+  return (
+    <div
+      className={cn(
+        'flex shrink-0 items-center justify-center rounded-lg bg-components-icon-bg-blue-solid text-text-primary-on-surface',
+        expand ? 'size-10' : 'size-8',
+      )}
+    >
+      <span aria-hidden className={cn('i-ri-rocket-fill', expand ? 'size-5' : 'size-4')} />
+    </div>
+  )
+}
+
+function DeploymentDetailInstanceInfo({ appInstanceId, expand }: {
+  appInstanceId: string
+  expand: boolean
+}) {
+  const { t } = useTranslation('deployments')
+  const overviewQuery = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+  }))
+  const app = overviewQuery.data?.appInstance
+  const isLoading = !app && overviewQuery.isLoading
+  const isUnavailable = !app || overviewQuery.isError
+  const instanceName = app ? app.displayName : appInstanceId
+
+  return (
+    <div
+      className={cn(
+        'rounded-xl hover:bg-state-base-hover',
+        expand ? 'flex items-start gap-2 p-2' : 'flex items-center justify-center px-1 py-1.5',
+      )}
+      aria-label={!expand ? instanceName : undefined}
+    >
+      {isLoading
+        ? (
+            <>
+              <SkeletonRectangle className={cn('my-0 animate-pulse rounded-lg', expand ? 'size-10' : 'size-8')} />
+              {expand && (
+                <SkeletonContainer className="min-w-0 flex-1 gap-1">
+                  <SkeletonRectangle className="my-0 h-5 w-32 animate-pulse" />
+                  <SkeletonRectangle className="my-0 h-3 w-20 animate-pulse" />
+                </SkeletonContainer>
+              )}
+            </>
+          )
+        : isUnavailable
+          ? (
+              <>
+                <div className="flex size-8 items-center justify-center rounded-lg bg-components-icon-bg-orange-solid text-text-primary-on-surface">
+                  <span className="i-ri-rocket-line size-4" />
+                </div>
+                {expand && (
+                  <div className="flex min-w-0 flex-1 flex-col items-start justify-center gap-0.5 self-stretch">
+                    <div className="w-full min-w-0 pr-1">
+                      <div className="truncate system-md-semibold whitespace-nowrap text-text-secondary">
+                        {t('detail.notFound')}
+                      </div>
+                    </div>
+                    <TitleTooltip content={appInstanceId}>
+                      <div className="max-w-full truncate font-mono system-2xs-regular text-text-tertiary">
+                        {appInstanceId}
+                      </div>
+                    </TitleTooltip>
+                  </div>
+                )}
+              </>
+            )
+          : (
+              <>
+                <DeploymentIcon expand={expand} />
+                {expand && (
+                  <>
+                    <div className="flex min-w-0 flex-1 flex-col items-start justify-center gap-0.5 self-stretch">
+                      <div className="w-full min-w-0 pr-1">
+                        <TitleTooltip content={instanceName}>
+                          <div className="truncate system-md-semibold whitespace-nowrap text-text-secondary">
+                            {instanceName}
+                          </div>
+                        </TitleTooltip>
+                      </div>
+                      {app.description && (
+                        <TitleTooltip content={app.description}>
+                          <div className="line-clamp-2 system-xs-regular text-text-tertiary">
+                            {app.description}
+                          </div>
+                        </TitleTooltip>
+                      )}
+                    </div>
+                    <DeploymentActionsMenu
+                      appInstanceId={appInstanceId}
+                      appName={instanceName}
+                      placement="bottom-end"
+                      sideOffset={4}
+                      className="shrink-0"
+                      triggerClassName="size-5 rounded-md bg-transparent p-0.5 shadow-none"
+                    />
+                  </>
+                )}
+              </>
+            )}
+    </div>
+  )
+}
+
+export function DeploymentDetailTop({
+  expand = true,
+  onToggle,
+}: {
+  expand?: boolean
+  onToggle?: () => void
+}) {
+  const { t } = useTranslation()
+  const router = useRouter()
+  const setGotoAnythingOpen = useSetGotoAnythingOpen()
+
+  if (!expand) {
+    return (
+      <div className="flex w-full items-center justify-center px-3 pt-2 pb-1">
+        {onToggle && (
+          <ToggleButton
+            expand={expand}
+            handleToggle={onToggle}
+            icon={<SidebarLeftArrowIcon aria-hidden className="size-4" />}
+            className="size-8 rounded-[10px] border-0 bg-transparent px-0 text-text-tertiary shadow-none hover:border-0 hover:bg-state-base-hover hover:text-text-secondary"
+          />
+        )}
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex items-center py-2 pr-2 pl-1">
+      <div className="flex min-w-0 flex-1 items-center gap-px">
+        <div className="flex shrink-0 items-center rounded-lg py-2 pr-1.5 pl-0.5 transition-colors hover:bg-background-default-hover">
+          <button
+            type="button"
+            aria-label={t('operation.back', { ns: 'common' })}
+            className="flex size-4 items-center justify-center text-text-tertiary hover:text-text-secondary"
+            onClick={() => router.back()}
+          >
+            <span aria-hidden className="i-ri-arrow-left-s-line size-4" />
+          </button>
+          <Link
+            href="/"
+            aria-label={t('mainNav.home', { ns: 'common' })}
+            className="flex size-4 items-center justify-center text-text-tertiary hover:text-text-secondary"
+          >
+            <span aria-hidden className="i-custom-vender-main-nav-app-home size-4" />
+          </Link>
+        </div>
+        <span className="shrink-0 system-md-regular text-text-quaternary">
+          /
+        </span>
+        <Link
+          href="/deployments"
+          className="shrink-0 truncate rounded-lg px-1.5 py-2 system-sm-semibold-uppercase text-text-secondary transition-colors hover:bg-background-default-hover hover:text-text-primary"
+        >
+          {t('menus.deployments', { ns: 'common' })}
+        </Link>
+      </div>
+      <Tooltip>
+        <TooltipTrigger
+          render={(
+            <button
+              type="button"
+              aria-label={t('gotoAnything.searchTitle', { ns: 'app' })}
+              className="flex size-8 shrink-0 items-center justify-center overflow-hidden rounded-[10px] text-text-tertiary transition-colors hover:bg-state-base-hover hover:text-text-secondary"
+              onClick={() => setGotoAnythingOpen(true)}
+            >
+              <span aria-hidden className="i-custom-vender-main-nav-quick-search size-4" />
+            </button>
+          )}
+        />
+        <TooltipContent placement="bottom" className="flex items-center gap-1 rounded-lg border-[0.5px] border-components-panel-border bg-components-tooltip-bg p-1.5 system-xs-medium text-text-secondary shadow-lg backdrop-blur-[5px]">
+          <span className="px-0.5">{t('gotoAnything.quickAction', { ns: 'app' })}</span>
+          <KbdGroup>
+            {SEARCH_SHORTCUT.map(key => (
+              <Kbd key={key}>{formatForDisplay(key)}</Kbd>
+            ))}
+          </KbdGroup>
+        </TooltipContent>
+      </Tooltip>
+      {onToggle && (
+        <ToggleButton
+          expand={expand}
+          handleToggle={onToggle}
+          icon={<SidebarLeftArrowIcon aria-hidden className="size-4" />}
+          className="size-8 rounded-[10px] border-0 bg-transparent px-0 text-text-tertiary shadow-none hover:border-0 hover:bg-state-base-hover hover:text-text-secondary"
+        />
+      )}
+    </div>
+  )
+}
+
+export function DeploymentDetailSection({
+  expand = true,
+}: {
+  expand?: boolean
+}) {
+  const { t } = useTranslation('deployments')
+  const pathname = usePathname()
+  const appInstanceId = getDeploymentIdFromPathname(pathname)
+
+  if (!appInstanceId)
+    return null
+
+  return (
+    <div className={cn('flex min-h-0 flex-1 flex-col', expand ? 'px-2 pb-2' : 'pb-2')}>
+      {!expand && (
+        <div className="flex w-full shrink-0 justify-center px-3.5 pt-0.5 pb-[3px]">
+          <Divider
+            type="horizontal"
+            bgStyle="solid"
+            className="my-0 h-px w-[27px] bg-divider-subtle"
+          />
+        </div>
+      )}
+      <div className="px-1 py-2">
+        <DeploymentDetailInstanceInfo appInstanceId={appInstanceId} expand={expand} />
+      </div>
+
+      <nav className={cn('flex flex-col gap-y-0.5 py-1', expand ? 'px-1' : 'px-3')}>
+        {DEPLOYMENT_TABS.map(tab => (
+          <NavLink
+            key={tab.key}
+            mode={expand ? 'expand' : 'collapse'}
+            iconMap={{ selected: tab.selectedIcon, normal: tab.icon }}
+            name={t(`tabs.${tab.key}.name`)}
+            href={`/deployments/${appInstanceId}/${tab.key}`}
+            pathname={pathname}
+          />
+        ))}
+      </nav>
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/developer-api-tab.tsx b/web/features/deployments/detail/developer-api-tab.tsx
new file mode 100644
index 00000000000..6ee0e0a88da
--- /dev/null
+++ b/web/features/deployments/detail/developer-api-tab.tsx
@@ -0,0 +1,13 @@
+'use client'
+
+import { DeveloperApiSection } from './settings-tab/access/developer-api-section'
+
+export function DeveloperApiTab({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  return (
+    <div className="flex w-full max-w-[960px] min-w-0 flex-col gap-y-4 px-6 py-6 sm:px-20 sm:py-8">
+      <DeveloperApiSection appInstanceId={appInstanceId} />
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/index.tsx b/web/features/deployments/detail/index.tsx
new file mode 100644
index 00000000000..5b1ec7a9f19
--- /dev/null
+++ b/web/features/deployments/detail/index.tsx
@@ -0,0 +1,89 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import type { InstanceDetailTabKey } from './tabs'
+import { useTranslation } from 'react-i18next'
+import useDocumentTitle from '@/hooks/use-document-title'
+import Link from '@/next/link'
+import { useSelectedLayoutSegment } from '@/next/navigation'
+import { CreateReleaseControl } from '../create-release'
+import { NewDeploymentHeaderAction } from './deploy-tab/new-deployment-button'
+import { DeveloperApiHeaderSwitch } from './settings-tab/access/developer-api-section'
+import { INSTANCE_DETAIL_TAB_KEYS, isInstanceDetailTabKey } from './tabs'
+
+function MobileDetailTabs({ appInstanceId, activeTab }: {
+  appInstanceId: string
+  activeTab: InstanceDetailTabKey
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <nav
+      aria-label={t('detail.mobileTabs')}
+      className="border-b border-divider-subtle bg-components-panel-bg px-4 pc:hidden"
+    >
+      <div className="flex min-w-0 scrollbar-none gap-1 overflow-x-auto py-2">
+        {INSTANCE_DETAIL_TAB_KEYS.map(tab => (
+          <Link
+            key={tab}
+            href={`/deployments/${appInstanceId}/${tab}`}
+            className={`inline-flex h-8 shrink-0 items-center rounded-lg px-3 system-sm-medium ${
+              activeTab === tab
+                ? 'bg-state-accent-hover text-text-accent'
+                : 'text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary'
+            }`}
+          >
+            {t(`tabs.${tab}.name`)}
+          </Link>
+        ))}
+      </div>
+    </nav>
+  )
+}
+
+export function InstanceDetail({ appInstanceId, children }: {
+  appInstanceId: string
+  children: ReactNode
+}) {
+  const { t } = useTranslation('deployments')
+  const selectedSegment = useSelectedLayoutSegment()
+  const selectedTab = selectedSegment ?? undefined
+  const activeTab: InstanceDetailTabKey = isInstanceDetailTabKey(selectedTab) ? selectedTab : 'overview'
+
+  useDocumentTitle(t('documentTitle.detail'))
+
+  return (
+    <div className="relative m-1 ml-0 flex min-h-0 flex-1 overflow-hidden rounded-lg shadow-xs">
+      <div className="min-w-0 grow overflow-hidden bg-components-panel-bg">
+        <div className="h-full min-w-0 overflow-y-auto">
+          <div className="flex min-h-full w-full flex-col">
+            <div className="flex w-full flex-col gap-y-0.5 px-4 pt-3 pb-2 sm:px-6">
+              <div className="flex min-w-0 flex-col gap-3 sm:flex-row sm:items-start sm:justify-between sm:gap-4">
+                <div className="min-w-0">
+                  <div className="flex min-w-0 flex-wrap items-center gap-x-3 gap-y-2">
+                    <div className="system-xl-semibold text-text-primary">{t(`tabs.${activeTab}.name`)}</div>
+                    {activeTab === 'api-tokens' && (
+                      <div className="shrink-0">
+                        <DeveloperApiHeaderSwitch appInstanceId={appInstanceId} />
+                      </div>
+                    )}
+                  </div>
+                  <div className="system-sm-regular text-text-tertiary">{t(`tabs.${activeTab}.description`)}</div>
+                </div>
+                {(activeTab === 'instances' || activeTab === 'releases') && (
+                  <div className="w-full shrink-0 pt-1 sm:w-auto sm:pt-1.5 [&_button]:w-full sm:[&_button]:w-auto">
+                    {activeTab === 'instances'
+                      ? <NewDeploymentHeaderAction appInstanceId={appInstanceId} />
+                      : <CreateReleaseControl appInstanceId={appInstanceId} size="medium" />}
+                  </div>
+                )}
+              </div>
+            </div>
+            <MobileDetailTabs appInstanceId={appInstanceId} activeTab={activeTab} />
+            {children}
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/overview-tab.tsx b/web/features/deployments/detail/overview-tab.tsx
new file mode 100644
index 00000000000..3c0ffab519b
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab.tsx
@@ -0,0 +1,122 @@
+'use client'
+
+import { useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import Link from '@/next/link'
+import { consoleQuery } from '@/service/client'
+import { DeploymentStateMessage } from '../components/empty-state'
+import { hasRuntimeInstanceDeployment } from '../shared/domain/runtime-status'
+import { AccessStatusSection, AccessStatusSectionSkeleton, ApiTokenSummarySection, ApiTokenSummarySectionSkeleton } from './overview-tab/access-status-section'
+import { EnvironmentStrip, EnvironmentStripSkeleton } from './overview-tab/environment-strip'
+import { ReleaseHero, ReleaseHeroSkeleton } from './overview-tab/release-hero'
+
+function OverviewLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <div className="flex w-full min-w-0 flex-col gap-6 px-6 py-6">
+      {children}
+    </div>
+  )
+}
+
+function LatestReleaseSection({ appInstanceId, children }: {
+  appInstanceId: string
+  children: React.ReactNode
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <section className="flex min-w-0 flex-col gap-3">
+      <div className="flex min-w-0 items-baseline justify-between gap-3">
+        <h3 className="system-sm-semibold text-text-primary">
+          {t('overview.latestReleaseTitle')}
+        </h3>
+        <Link
+          href={`/deployments/${appInstanceId}/releases`}
+          className="inline-flex shrink-0 items-center gap-1 system-xs-medium text-text-tertiary transition-colors hover:text-text-secondary"
+        >
+          {t('overview.previousReleases.viewAll')}
+          <span aria-hidden className="i-ri-arrow-right-line size-3.5" />
+        </Link>
+      </div>
+      <div className="flex min-w-0 flex-col gap-3">
+        {children}
+      </div>
+    </section>
+  )
+}
+
+function OverviewLoadingSkeleton({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  return (
+    <OverviewLayout>
+      <EnvironmentStripSkeleton />
+      <LatestReleaseSection appInstanceId={appInstanceId}>
+        <ReleaseHeroSkeleton />
+      </LatestReleaseSection>
+      <AccessStatusSectionSkeleton />
+      <ApiTokenSummarySectionSkeleton />
+    </OverviewLayout>
+  )
+}
+
+export function OverviewTab({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  const { t } = useTranslation('deployments')
+  const input = { params: { appInstanceId } }
+  const overviewQuery = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstanceOverview.queryOptions({ input }))
+  const overview = overviewQuery.data
+
+  if (overviewQuery.isLoading)
+    return <OverviewLoadingSkeleton appInstanceId={appInstanceId} />
+
+  if (overviewQuery.isError) {
+    return (
+      <OverviewLayout>
+        <DeploymentStateMessage variant="section">{t('common.loadFailed')}</DeploymentStateMessage>
+      </OverviewLayout>
+    )
+  }
+
+  if (!overview) {
+    return (
+      <OverviewLayout>
+        <DeploymentStateMessage variant="section">{t('detail.notFound')}</DeploymentStateMessage>
+      </OverviewLayout>
+    )
+  }
+
+  const releaseRows = overview.recentReleases
+  // recentReleases is a capped preview; totalReleaseCount is the true total.
+  const releaseCount = overview.totalReleaseCount
+  const runtimeRows = overview.environmentDeployments
+  const deployedEnvironmentCount = runtimeRows.filter(hasRuntimeInstanceDeployment).length
+  const latestRelease = releaseRows[0]
+  const accessChannels = overview.accessChannels
+  const apiKeySummary = overview.apiKeySummary
+
+  return (
+    <OverviewLayout>
+      <EnvironmentStrip
+        appInstanceId={appInstanceId}
+        rows={runtimeRows}
+        releaseRows={releaseRows}
+      />
+      <LatestReleaseSection appInstanceId={appInstanceId}>
+        <ReleaseHero
+          appInstanceId={appInstanceId}
+          latestRelease={latestRelease}
+          releaseCount={releaseCount}
+        />
+      </LatestReleaseSection>
+      <AccessStatusSection appInstanceId={appInstanceId} accessChannels={accessChannels} />
+      <ApiTokenSummarySection
+        appInstanceId={appInstanceId}
+        accessChannels={accessChannels}
+        apiKeySummary={apiKeySummary}
+        deployedEnvironmentCount={deployedEnvironmentCount}
+      />
+    </OverviewLayout>
+  )
+}
diff --git a/web/features/deployments/detail/overview-tab/access-status-section.tsx b/web/features/deployments/detail/overview-tab/access-status-section.tsx
new file mode 100644
index 00000000000..eb7aade343f
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab/access-status-section.tsx
@@ -0,0 +1,240 @@
+'use client'
+
+import type { AccessChannels, ApiKeySummary } from '@dify/contracts/enterprise/types.gen'
+import { RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+import Link from '@/next/link'
+import { DeploymentStatusBadge } from '../../shared/ui/deployment-status-badge'
+import { OVERVIEW_CARD_CLASS_NAME, OVERVIEW_ICON_CLASS_NAME, OVERVIEW_INTERACTIVE_CARD_CLASS_NAME } from './card-styles'
+
+type AccessStatusSectionProps = {
+  appInstanceId: string
+  accessChannels?: AccessChannels
+}
+
+type ApiTokenSummarySectionProps = {
+  appInstanceId: string
+  accessChannels?: AccessChannels
+  apiKeySummary?: ApiKeySummary
+  deployedEnvironmentCount: number
+}
+
+type AccessStatusItem = {
+  key: 'webapp' | 'cli'
+  href: string
+  icon: string
+  label: string
+  enabled: boolean
+  meta: string
+}
+
+const ACCESS_STATUS_SKELETON_KEYS = ['webapp', 'cli']
+
+export function AccessStatusSection({ appInstanceId, accessChannels }: AccessStatusSectionProps) {
+  const { t } = useTranslation('deployments')
+  const items: AccessStatusItem[] = [
+    {
+      key: 'webapp',
+      href: `/deployments/${appInstanceId}/access`,
+      icon: 'i-ri-global-line',
+      label: t('card.access.webApp'),
+      enabled: Boolean(accessChannels?.webAppEnabled),
+      meta: t('overview.accessMeta.webApp'),
+    },
+    {
+      key: 'cli',
+      href: `/deployments/${appInstanceId}/access`,
+      icon: 'i-ri-terminal-box-line',
+      label: t('card.access.cli'),
+      enabled: Boolean(accessChannels?.webAppEnabled),
+      meta: t('overview.accessMeta.cli'),
+    },
+  ]
+
+  return (
+    <section className="flex min-w-0 flex-col gap-3">
+      <h3 className="system-sm-semibold text-text-primary">
+        {t('overview.accessStatus')}
+      </h3>
+
+      <div className="grid grid-cols-[repeat(auto-fit,minmax(min(100%,220px),1fr))] gap-3">
+        {items.map(item => (
+          <Link
+            key={item.key}
+            href={item.href}
+            className={cn(
+              OVERVIEW_INTERACTIVE_CARD_CLASS_NAME,
+              'group flex min-h-18 min-w-0 items-start gap-3',
+            )}
+          >
+            <span
+              aria-hidden
+              className={OVERVIEW_ICON_CLASS_NAME}
+            >
+              <span className={cn('size-4', item.icon)} />
+            </span>
+            <span className="flex min-w-0 flex-1 flex-col gap-1">
+              <span className="flex min-w-0 items-center justify-between gap-3">
+                <span className="truncate system-sm-medium text-text-primary">
+                  {item.label}
+                </span>
+                <span className="flex shrink-0 items-center gap-2">
+                  <StatusBadge enabled={item.enabled} />
+                  <span
+                    aria-hidden
+                    className="i-ri-arrow-right-line size-4 text-text-quaternary opacity-60 transition group-hover:translate-x-0.5 group-hover:opacity-100 group-focus-visible:translate-x-0.5 group-focus-visible:opacity-100"
+                  />
+                </span>
+              </span>
+              <span className="truncate text-xs text-text-tertiary">
+                {item.meta}
+              </span>
+            </span>
+          </Link>
+        ))}
+      </div>
+    </section>
+  )
+}
+
+export function ApiTokenSummarySection({
+  appInstanceId,
+  accessChannels,
+  apiKeySummary,
+  deployedEnvironmentCount,
+}: ApiTokenSummarySectionProps) {
+  const { t } = useTranslation('deployments')
+  const apiEnabled = Boolean(accessChannels?.developerApiEnabled)
+  const apiKeyCount = apiKeySummary?.apiKeyCount ?? 0
+
+  return (
+    <section className="flex min-w-0 flex-col gap-3">
+      <h3 className="system-sm-semibold text-text-primary">
+        {t('overview.api')}
+      </h3>
+
+      <Link
+        href={`/deployments/${appInstanceId}/api-tokens`}
+        className={cn(
+          OVERVIEW_INTERACTIVE_CARD_CLASS_NAME,
+          'group flex min-h-18 min-w-0 items-start gap-3',
+        )}
+      >
+        <span aria-hidden className={OVERVIEW_ICON_CLASS_NAME}>
+          <span className="i-ri-code-s-slash-line size-4" />
+        </span>
+        <span className="flex min-w-0 flex-1 flex-col gap-2">
+          <span className="flex min-w-0 items-center justify-between gap-3">
+            <span className="truncate system-sm-medium text-text-primary">
+              {t('card.access.api')}
+            </span>
+            <span className="flex shrink-0 items-center gap-2">
+              <StatusBadge enabled={apiEnabled} />
+              <span
+                aria-hidden
+                className="i-ri-arrow-right-line size-4 text-text-quaternary opacity-60 transition group-hover:translate-x-0.5 group-hover:opacity-100 group-focus-visible:translate-x-0.5 group-focus-visible:opacity-100"
+              />
+            </span>
+          </span>
+          {apiEnabled
+            ? (
+                <span className="flex min-w-0 flex-wrap gap-2">
+                  <span className="inline-flex h-6 min-w-0 items-center rounded-md bg-background-section-burn px-2 system-xs-medium text-text-secondary">
+                    {t('overview.apiKeysCount', { count: apiKeyCount })}
+                  </span>
+                  {/* "deployed environments" = envs with a runtime deployment, not envs-with-keys */}
+                  <span className="inline-flex h-6 min-w-0 items-center rounded-md bg-background-section-burn px-2 system-xs-medium text-text-secondary">
+                    {t('overview.apiTokenSummary.environments', { count: deployedEnvironmentCount })}
+                  </span>
+                </span>
+              )
+            : (
+                <span className="truncate text-xs text-text-tertiary">
+                  {t('overview.accessMeta.apiTokens')}
+                </span>
+              )}
+        </span>
+      </Link>
+    </section>
+  )
+}
+
+function StatusBadge({ enabled }: {
+  enabled: boolean
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <DeploymentStatusBadge
+      status={enabled ? RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY : RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED}
+      label={enabled ? t('overview.enabled') : t('overview.disabled')}
+    />
+  )
+}
+
+export function ApiTokenSummarySectionSkeleton() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <section className="flex min-w-0 flex-col gap-3">
+      <h3 className="system-sm-semibold text-text-primary">
+        {t('overview.api')}
+      </h3>
+      <ApiTokenSummaryCardSkeleton />
+    </section>
+  )
+}
+
+function ApiTokenSummaryCardSkeleton() {
+  return (
+    <div
+      data-slot="deployment-overview-api-token-card-skeleton"
+      className={cn(OVERVIEW_CARD_CLASS_NAME, 'flex min-h-18 min-w-0 items-start gap-3')}
+    >
+      <SkeletonRectangle className="my-0 size-8 shrink-0 animate-pulse rounded-lg" />
+      <span className="flex min-w-0 flex-1 flex-col gap-2">
+        <span className="flex min-w-0 items-center justify-between gap-3">
+          <SkeletonRectangle className="my-0 h-3.5 w-20 animate-pulse" />
+          <SkeletonRectangle className="my-0 h-6 w-14 shrink-0 animate-pulse rounded-md" />
+        </span>
+        <span className="flex gap-2">
+          <SkeletonRectangle className="my-0 h-6 w-24 animate-pulse rounded-md" />
+          <SkeletonRectangle className="my-0 h-6 w-32 animate-pulse rounded-md" />
+        </span>
+      </span>
+    </div>
+  )
+}
+
+export function AccessStatusSectionSkeleton() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <section className="flex min-w-0 flex-col gap-3">
+      <h3 className="system-sm-semibold text-text-primary">
+        {t('overview.accessStatus')}
+      </h3>
+
+      <div className="grid grid-cols-[repeat(auto-fit,minmax(min(100%,220px),1fr))] gap-3">
+        {ACCESS_STATUS_SKELETON_KEYS.map(key => (
+          <div
+            key={key}
+            data-slot="deployment-overview-access-card-skeleton"
+            className={cn(OVERVIEW_CARD_CLASS_NAME, 'flex min-h-18 min-w-0 items-start gap-3')}
+          >
+            <SkeletonRectangle className="my-0 size-8 shrink-0 animate-pulse rounded-lg" />
+            <span className="flex min-w-0 flex-1 flex-col gap-2">
+              <span className="flex min-w-0 items-center justify-between gap-3">
+                <SkeletonRectangle className="my-0 h-3.5 w-20 animate-pulse" />
+                <SkeletonRectangle className="my-0 h-6 w-14 shrink-0 animate-pulse rounded-md" />
+              </span>
+              <SkeletonRectangle className="my-0 h-3 w-4/5 animate-pulse" />
+            </span>
+          </div>
+        ))}
+      </div>
+    </section>
+  )
+}
diff --git a/web/features/deployments/detail/overview-tab/card-styles.ts b/web/features/deployments/detail/overview-tab/card-styles.ts
new file mode 100644
index 00000000000..07afcf3d0c2
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab/card-styles.ts
@@ -0,0 +1,10 @@
+import { cn } from '@langgenius/dify-ui/cn'
+
+export const OVERVIEW_CARD_CLASS_NAME = 'rounded-xl border border-components-panel-border bg-components-panel-bg p-4'
+
+export const OVERVIEW_INTERACTIVE_CARD_CLASS_NAME = cn(
+  OVERVIEW_CARD_CLASS_NAME,
+  'transition-colors hover:border-components-panel-border-subtle hover:bg-components-panel-on-panel-item-bg-hover focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-components-button-primary-bg',
+)
+
+export const OVERVIEW_ICON_CLASS_NAME = 'flex size-8 shrink-0 items-center justify-center rounded-lg bg-background-section-burn text-text-tertiary'
diff --git a/web/features/deployments/detail/overview-tab/environment-strip.tsx b/web/features/deployments/detail/overview-tab/environment-strip.tsx
new file mode 100644
index 00000000000..1057458dfeb
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab/environment-strip.tsx
@@ -0,0 +1,148 @@
+'use client'
+
+import type { EnvironmentDeployment, Release } from '@dify/contracts/enterprise/types.gen'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import Link from '@/next/link'
+import { DeploymentEmptyState } from '../../components/empty-state'
+import { openDeployDrawerAtom } from '../../deploy-drawer/state'
+import { hasRuntimeInstanceDeployment } from '../../shared/domain/runtime-status'
+import { OVERVIEW_CARD_CLASS_NAME } from './card-styles'
+import { EnvironmentTile } from './environment-tile'
+
+const OVERVIEW_RUNTIME_INSTANCE_LIMIT = 4
+
+type EnvironmentStripProps = {
+  appInstanceId: string
+  rows: EnvironmentDeployment[]
+  releaseRows: Release[]
+}
+
+export function EnvironmentStrip({ appInstanceId, rows, releaseRows }: EnvironmentStripProps) {
+  const { t } = useTranslation('deployments')
+  const runtimeRows = rows.filter(hasRuntimeInstanceDeployment)
+  const previewRows = runtimeRows.slice(0, OVERVIEW_RUNTIME_INSTANCE_LIMIT)
+  const hasRuntimeRows = runtimeRows.length > 0
+  const hasRelease = releaseRows.length > 0
+
+  return (
+    <section className="flex flex-col gap-3">
+      <div className="flex min-w-0 items-baseline justify-between gap-3">
+        <h3 className="system-sm-semibold text-text-primary">{t('overview.strip.title')}</h3>
+        {hasRuntimeRows && (
+          <Link
+            href={`/deployments/${appInstanceId}/instances`}
+            className="inline-flex shrink-0 items-center gap-1 system-xs-medium text-text-tertiary transition-colors hover:text-text-secondary"
+          >
+            {t('overview.previousReleases.viewAll')}
+            <span aria-hidden className="i-ri-arrow-right-line size-3.5" />
+          </Link>
+        )}
+      </div>
+
+      {!hasRuntimeRows
+        ? <EnvironmentEmptyState appInstanceId={appInstanceId} canDeploy={hasRelease} />
+        : (
+            <div className="grid grid-cols-[repeat(auto-fit,minmax(min(100%,360px),1fr))] gap-3">
+              {previewRows.map(row => (
+                <EnvironmentTile
+                  key={row.environment.id}
+                  appInstanceId={appInstanceId}
+                  row={row}
+                  releaseRows={releaseRows}
+                />
+              ))}
+            </div>
+          )}
+    </section>
+  )
+}
+
+function EnvironmentEmptyState({ appInstanceId, canDeploy }: {
+  appInstanceId: string
+  canDeploy: boolean
+}) {
+  const { t } = useTranslation('deployments')
+  const openDeployDrawer = useSetAtom(openDeployDrawerAtom)
+
+  return (
+    <DeploymentEmptyState
+      variant="section"
+      icon="i-ri-server-line"
+      title={t('overview.strip.emptyTitle')}
+      description={canDeploy ? t('overview.strip.emptyDeployableDescription') : t('overview.strip.emptyDescription')}
+      className="min-h-44"
+      action={canDeploy
+        ? (
+            <Button
+              type="button"
+              variant="primary"
+              size="medium"
+              className="gap-1.5"
+              onClick={() => openDeployDrawer({ appInstanceId })}
+            >
+              <span className="i-ri-rocket-line size-4 shrink-0" aria-hidden="true" />
+              {t('overview.strip.deployToNewEnvironment')}
+            </Button>
+          )
+        : undefined}
+    />
+  )
+}
+
+const SKELETON_KEYS = ['a', 'b', 'c']
+
+function CardSkeletons() {
+  return (
+    <div className="grid grid-cols-[repeat(auto-fit,minmax(min(100%,360px),1fr))] gap-3">
+      {SKELETON_KEYS.map(key => (
+        <EnvironmentTileSkeleton key={key} />
+      ))}
+    </div>
+  )
+}
+
+function EnvironmentTileSkeleton() {
+  return (
+    <article
+      data-slot="deployment-overview-environment-tile-skeleton"
+      className={cn(OVERVIEW_CARD_CLASS_NAME, 'flex min-h-28 min-w-0 flex-col justify-between gap-4')}
+    >
+      <div className="flex min-w-0 items-center justify-between gap-3">
+        <div className="flex min-w-0 flex-1 items-center gap-3">
+          <SkeletonRectangle className="my-0 size-8 shrink-0 animate-pulse rounded-lg" />
+          <SkeletonRectangle className="my-0 h-3.5 w-28 animate-pulse" />
+        </div>
+        <SkeletonRow className="my-0 h-6 shrink-0 gap-1.5 rounded-md bg-background-section-burn px-2">
+          <span className="size-1.5 shrink-0 rounded-full bg-text-quaternary" />
+          <span className="h-2.5 w-8 rounded-xs bg-text-quaternary opacity-20" />
+        </SkeletonRow>
+      </div>
+
+      <div className="flex min-w-0 items-end justify-between gap-3">
+        <div className="min-w-0">
+          <SkeletonRectangle className="my-0 h-2.5 w-20 animate-pulse" />
+          <div className="mt-2 flex min-w-0 items-center gap-2">
+            <SkeletonRectangle className="my-0 h-3.5 w-24 animate-pulse" />
+            <SkeletonRectangle className="my-0 h-5 w-16 animate-pulse rounded" />
+          </div>
+        </div>
+        <SkeletonRectangle className="my-0 h-8 w-22 shrink-0 animate-pulse rounded-md" />
+      </div>
+    </article>
+  )
+}
+
+export function EnvironmentStripSkeleton() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <section className="flex flex-col gap-3">
+      <h3 className="system-sm-semibold text-text-primary">{t('overview.strip.title')}</h3>
+      <CardSkeletons />
+    </section>
+  )
+}
diff --git a/web/features/deployments/detail/overview-tab/environment-tile-utils.spec.ts b/web/features/deployments/detail/overview-tab/environment-tile-utils.spec.ts
new file mode 100644
index 00000000000..466862a5217
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab/environment-tile-utils.spec.ts
@@ -0,0 +1,143 @@
+import type { TFunction } from 'i18next'
+import { RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+import { describe, expect, it } from 'vitest'
+import {
+  renderActionLabel,
+  renderDriftTitle,
+  renderStatus,
+  resolveConfig,
+} from './environment-tile-utils'
+
+const t = ((key: string, options?: Record<string, unknown>) => {
+  return options ? `${key}:${JSON.stringify(options)}` : key
+}) as TFunction<'deployments'>
+
+describe('resolveConfig', () => {
+  it('treats undeploying environments as in progress', () => {
+    const config = resolveConfig({
+      drift: { kind: 'up-to-date' },
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING,
+      hasAnyRelease: true,
+      latestId: 'release-2',
+      currentReleaseId: 'release-1',
+    })
+
+    expect(config.kind).toBe('deploying')
+    expect(config.status).toBe(RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING)
+    expect(config.intent).toBe('navigate')
+  })
+
+  it('disables empty environments when no release exists', () => {
+    const config = resolveConfig({
+      drift: { kind: 'undeployed' },
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED,
+      hasAnyRelease: false,
+      latestId: undefined,
+      currentReleaseId: undefined,
+    })
+
+    expect(config.kind).toBe('empty')
+    expect(config.intent).toBe('disabled')
+    expect(config.showRelease).toBe(false)
+    expect(config.releaseId).toBeUndefined()
+  })
+
+  it('opens deploy drawer for undeployed environments when a release exists', () => {
+    const config = resolveConfig({
+      drift: { kind: 'undeployed' },
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED,
+      hasAnyRelease: true,
+      latestId: 'release-2',
+      currentReleaseId: undefined,
+    })
+
+    expect(config.kind).toBe('empty')
+    expect(config.intent).toBe('drawer')
+    expect(config.releaseId).toBe('release-2')
+  })
+
+  it('resolves failed environments to the current release first', () => {
+    const config = resolveConfig({
+      drift: { kind: 'behind', steps: 1 },
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_FAILED,
+      hasAnyRelease: true,
+      latestId: 'release-2',
+      currentReleaseId: 'release-1',
+    })
+
+    expect(config.kind).toBe('failed')
+    expect(config.intent).toBe('drawer')
+    expect(config.releaseId).toBe('release-1')
+  })
+
+  it('resolves up-to-date and behind environments to drawer actions', () => {
+    expect(resolveConfig({
+      drift: { kind: 'up-to-date' },
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY,
+      hasAnyRelease: true,
+      latestId: 'release-2',
+      currentReleaseId: 'release-2',
+    })).toMatchObject({
+      kind: 'latest',
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY,
+      intent: 'drawer',
+      releaseId: 'release-2',
+    })
+
+    expect(resolveConfig({
+      drift: { kind: 'behind', steps: 2 },
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY,
+      hasAnyRelease: true,
+      latestId: 'release-3',
+      currentReleaseId: 'release-1',
+    })).toMatchObject({
+      kind: 'behind',
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DRIFTED,
+      intent: 'drawer',
+      releaseId: 'release-3',
+    })
+  })
+
+  it('treats unknown drift as an older release state', () => {
+    const config = resolveConfig({
+      drift: { kind: 'unknown' },
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY,
+      hasAnyRelease: true,
+      latestId: 'release-3',
+      currentReleaseId: 'release-1',
+    })
+
+    expect(config.kind).toBe('older')
+    expect(config.status).toBe(RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED)
+    expect(config.intent).toBe('drawer')
+    expect(config.releaseId).toBe('release-3')
+  })
+})
+
+describe('environment tile copy helpers', () => {
+  it('renders action labels for deployment states', () => {
+    expect(renderActionLabel('empty', false, t)).toBe('overview.cardAction.deployLatest')
+    expect(renderActionLabel('older', true, t)).toBe('overview.cardAction.deployLatest')
+    expect(renderActionLabel('behind', true, t)).toBe('overview.cardAction.deployLatest')
+    expect(renderActionLabel('latest', true, t)).toBe('overview.cardAction.redeploy')
+    expect(renderActionLabel('deploying', true, t)).toBe('overview.cardAction.viewProgress')
+    expect(renderActionLabel('failed', true, t)).toBe('overview.cardAction.redeploy')
+    expect(renderActionLabel('failed', false, t)).toBe('overview.cardAction.deployLatest')
+  })
+
+  it('renders status labels and drift titles with counts when needed', () => {
+    expect(renderStatus('empty', { kind: 'undeployed' }, t)).toBe('overview.chip.empty')
+    expect(renderStatus('latest', { kind: 'up-to-date' }, t)).toBe('overview.chip.latest')
+    expect(renderStatus('older', { kind: 'unknown' }, t)).toBe('overview.chip.olderRelease')
+    expect(renderStatus('deploying', { kind: 'unknown' }, t)).toBe('overview.chip.deploying')
+    expect(renderStatus('failed', { kind: 'unknown' }, t)).toBe('overview.chip.failed')
+    expect(renderStatus('behind', { kind: 'behind', steps: 3 }, t)).toBe('overview.chip.behind:{"count":3}')
+
+    expect(renderDriftTitle('latest', { kind: 'up-to-date' }, t)).toBe('overview.chip.latestTooltip')
+    expect(renderDriftTitle('behind', { kind: 'behind', steps: 2 }, t)).toBe('overview.chip.behindTooltip:{"count":2}')
+    expect(renderDriftTitle('older', { kind: 'unknown' }, t)).toBe('overview.chip.olderReleaseTooltip')
+    expect(renderDriftTitle('empty', { kind: 'undeployed' }, t)).toBe('overview.chip.emptyTooltip')
+    expect(renderDriftTitle('deploying', { kind: 'unknown' }, t)).toBe('overview.chip.deployingTooltip')
+    expect(renderDriftTitle('failed', { kind: 'unknown' }, t)).toBe('overview.chip.failedTooltip')
+  })
+})
diff --git a/web/features/deployments/detail/overview-tab/environment-tile-utils.ts b/web/features/deployments/detail/overview-tab/environment-tile-utils.ts
new file mode 100644
index 00000000000..aba4ee23cdd
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab/environment-tile-utils.ts
@@ -0,0 +1,152 @@
+import type { RuntimeInstanceStatus as RuntimeInstanceStatusValue } from '@dify/contracts/enterprise/types.gen'
+import type { TFunction } from 'i18next'
+import type { computeDrift } from './overview-drift'
+import { RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+import { isRuntimeDeploymentInProgress } from '../../shared/domain/runtime-status'
+
+export type TileKind = 'empty' | 'latest' | 'behind' | 'older' | 'deploying' | 'failed'
+
+export type TileConfig = {
+  kind: TileKind
+  status: RuntimeInstanceStatusValue
+  actionClass: string
+  showRelease: boolean
+  intent: 'drawer' | 'navigate' | 'disabled'
+  releaseId?: string
+}
+
+export function resolveConfig({ drift, status, hasAnyRelease, latestId, currentReleaseId }: {
+  drift: ReturnType<typeof computeDrift>
+  status: RuntimeInstanceStatusValue
+  hasAnyRelease: boolean
+  latestId: string | undefined
+  currentReleaseId: string | undefined
+}): TileConfig {
+  if (isRuntimeDeploymentInProgress(status)) {
+    return {
+      kind: 'deploying',
+      status,
+      actionClass: 'text-text-secondary hover:bg-state-base-hover hover:text-text-primary',
+      showRelease: true,
+      intent: 'navigate',
+    }
+  }
+
+  if (status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_FAILED) {
+    return {
+      kind: 'failed',
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_FAILED,
+      actionClass: 'text-primary-600 hover:bg-state-accent-hover',
+      showRelease: true,
+      intent: 'drawer',
+      releaseId: currentReleaseId ?? latestId,
+    }
+  }
+
+  if (drift.kind === 'undeployed') {
+    return {
+      kind: 'empty',
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED,
+      actionClass: hasAnyRelease
+        ? 'text-primary-600 hover:bg-state-accent-hover'
+        : 'text-text-tertiary',
+      showRelease: false,
+      intent: hasAnyRelease ? 'drawer' : 'disabled',
+      releaseId: latestId,
+    }
+  }
+
+  if (drift.kind === 'up-to-date') {
+    return {
+      kind: 'latest',
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY,
+      actionClass: 'text-text-secondary hover:bg-state-base-hover hover:text-text-primary',
+      showRelease: true,
+      intent: 'drawer',
+      releaseId: currentReleaseId,
+    }
+  }
+
+  if (drift.kind === 'behind') {
+    return {
+      kind: 'behind',
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DRIFTED,
+      actionClass: 'text-primary-600 hover:bg-state-accent-hover',
+      showRelease: true,
+      intent: 'drawer',
+      releaseId: latestId,
+    }
+  }
+
+  return {
+    kind: 'older',
+    status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED,
+    actionClass: 'text-primary-600 hover:bg-state-accent-hover',
+    showRelease: true,
+    intent: 'drawer',
+    releaseId: latestId,
+  }
+}
+
+export function renderActionLabel(
+  kind: TileKind,
+  hasCurrentRelease: boolean,
+  t: TFunction<'deployments'>,
+): string {
+  switch (kind) {
+    case 'empty':
+    case 'older':
+    case 'behind':
+      return t('overview.cardAction.deployLatest')
+    case 'latest':
+      return t('overview.cardAction.redeploy')
+    case 'deploying':
+      return t('overview.cardAction.viewProgress')
+    case 'failed':
+      return hasCurrentRelease
+        ? t('overview.cardAction.redeploy')
+        : t('overview.cardAction.deployLatest')
+  }
+}
+
+export function renderStatus(
+  kind: TileKind,
+  drift: ReturnType<typeof computeDrift>,
+  t: TFunction<'deployments'>,
+): string {
+  switch (kind) {
+    case 'empty':
+      return t('overview.chip.empty')
+    case 'latest':
+      return t('overview.chip.latest')
+    case 'behind':
+      return t('overview.chip.behind', { count: drift.kind === 'behind' ? drift.steps : 0 })
+    case 'older':
+      return t('overview.chip.olderRelease')
+    case 'deploying':
+      return t('overview.chip.deploying')
+    case 'failed':
+      return t('overview.chip.failed')
+  }
+}
+
+export function renderDriftTitle(
+  kind: TileKind,
+  drift: ReturnType<typeof computeDrift>,
+  t: TFunction<'deployments'>,
+): string {
+  switch (kind) {
+    case 'latest':
+      return t('overview.chip.latestTooltip')
+    case 'behind':
+      return t('overview.chip.behindTooltip', { count: drift.kind === 'behind' ? drift.steps : 0 })
+    case 'older':
+      return t('overview.chip.olderReleaseTooltip')
+    case 'empty':
+      return t('overview.chip.emptyTooltip')
+    case 'deploying':
+      return t('overview.chip.deployingTooltip')
+    case 'failed':
+      return t('overview.chip.failedTooltip')
+  }
+}
diff --git a/web/features/deployments/detail/overview-tab/environment-tile.tsx b/web/features/deployments/detail/overview-tab/environment-tile.tsx
new file mode 100644
index 00000000000..ae35cc2c973
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab/environment-tile.tsx
@@ -0,0 +1,170 @@
+'use client'
+
+import type {
+  EnvironmentDeployment,
+  Release,
+  RuntimeInstanceStatus as RuntimeInstanceStatusValue,
+} from '@dify/contracts/enterprise/types.gen'
+import type { TileConfig } from './environment-tile-utils'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import Link from '@/next/link'
+import { TitleTooltip } from '../../components/title-tooltip'
+import { openDeployDrawerAtom } from '../../deploy-drawer/state'
+import { releaseCommit } from '../../shared/domain/release'
+import { DeploymentStatusBadge } from '../../shared/ui/deployment-status-badge'
+import {
+  deploymentStatusLabelKey,
+} from '../../shared/ui/deployment-status-style'
+import { OVERVIEW_ICON_CLASS_NAME, OVERVIEW_INTERACTIVE_CARD_CLASS_NAME } from './card-styles'
+import {
+  renderActionLabel,
+  renderDriftTitle,
+  renderStatus,
+  resolveConfig,
+} from './environment-tile-utils'
+import { computeDrift, latestReleaseId } from './overview-drift'
+
+type EnvironmentTileProps = {
+  appInstanceId: string
+  row: EnvironmentDeployment
+  releaseRows: Release[]
+}
+
+export function EnvironmentTile({ appInstanceId, row, releaseRows }: EnvironmentTileProps) {
+  const { t } = useTranslation('deployments')
+  const openDeployDrawer = useSetAtom(openDeployDrawerAtom)
+
+  const envId = row.environment.id
+  const drift = computeDrift(row)
+  const status = row.status
+  const latestId = latestReleaseId(releaseRows)
+  const hasAnyRelease = releaseRows.length > 0
+  const currentReleaseId = row.currentRelease?.id
+  const config = resolveConfig({ drift, status, hasAnyRelease, latestId, currentReleaseId })
+  const isDisabled = config.intent === 'disabled'
+  const showStatusSignal = config.kind !== 'deploying'
+  const release = row.currentRelease
+  const showRelease = config.showRelease && release
+  const commit = releaseCommit(release)
+  const tooltip = isDisabled
+    ? t('overview.chip.needsReleaseFirst')
+    : config.intent === 'navigate'
+      ? t('overview.chip.openInDeployTab')
+      : undefined
+
+  function handleDrawerAction() {
+    if (config.intent === 'disabled')
+      return
+    openDeployDrawer({ appInstanceId, environmentId: envId, releaseId: config.releaseId })
+  }
+
+  const actionClassName = cn(
+    'inline-flex h-8 max-w-full min-w-0 shrink-0 items-center justify-center rounded-md px-2.5 system-xs-medium transition-colors focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-components-button-primary-bg',
+    config.actionClass,
+    isDisabled && 'cursor-not-allowed opacity-60',
+  )
+  const actionLabel = renderActionLabel(config.kind, Boolean(currentReleaseId), t)
+  const actionControl = config.intent === 'navigate'
+    ? (
+        <Link
+          href={`/deployments/${appInstanceId}/instances`}
+          className={actionClassName}
+        >
+          <span className="whitespace-nowrap">{actionLabel}</span>
+        </Link>
+      )
+    : (
+        <button
+          type="button"
+          disabled={isDisabled}
+          onClick={handleDrawerAction}
+          className={actionClassName}
+        >
+          <span className="whitespace-nowrap">{actionLabel}</span>
+        </button>
+      )
+
+  return (
+    <article
+      data-slot="deployment-overview-environment-tile"
+      className={cn(OVERVIEW_INTERACTIVE_CARD_CLASS_NAME, 'flex min-h-28 min-w-0 flex-col justify-between gap-4')}
+    >
+      <div className="flex min-w-0 items-center justify-between gap-3">
+        <div className="flex min-w-0 flex-1 items-center gap-3">
+          <span aria-hidden className={OVERVIEW_ICON_CLASS_NAME}>
+            <span className="i-ri-server-line size-4" />
+          </span>
+          <h4 className="truncate system-sm-medium text-text-primary">
+            {row.environment.displayName}
+          </h4>
+        </div>
+        <div className="flex shrink-0 items-center gap-2">
+          <RuntimeStatusSignal status={status} t={t} />
+          {showStatusSignal && <StatusSignal config={config} drift={drift} t={t} />}
+        </div>
+      </div>
+
+      <div className="flex min-w-0 items-end justify-between gap-3">
+        <div className="min-w-0">
+          <div className="system-2xs-medium-uppercase text-text-tertiary">
+            {t('deployTab.col.currentRelease')}
+          </div>
+          <div className="mt-1 flex min-w-0 items-center gap-2">
+            <span className="min-w-0 truncate system-sm-semibold text-text-primary">
+              {showRelease ? showRelease.displayName : '—'}
+            </span>
+            {showRelease && commit !== '—' && (
+              <span className="shrink-0 rounded bg-background-section-burn px-1.5 py-0.5 font-mono system-xs-regular text-text-tertiary">
+                {commit}
+              </span>
+            )}
+          </div>
+        </div>
+
+        {tooltip
+          ? (
+              <TitleTooltip content={tooltip}>
+                <span className="inline-flex max-w-full min-w-0 shrink-0">
+                  {actionControl}
+                </span>
+              </TitleTooltip>
+            )
+          : actionControl}
+      </div>
+    </article>
+  )
+}
+
+function RuntimeStatusSignal({ status, t }: {
+  status: RuntimeInstanceStatusValue
+  t: ReturnType<typeof useTranslation<'deployments'>>['t']
+}) {
+  const label = t(deploymentStatusLabelKey(status))
+
+  return (
+    <TitleTooltip content={label}>
+      <DeploymentStatusBadge status={status} label={label} />
+    </TitleTooltip>
+  )
+}
+
+function StatusSignal({ className, config, drift, t }: {
+  className?: string
+  config: TileConfig
+  drift: ReturnType<typeof computeDrift>
+  t: ReturnType<typeof useTranslation<'deployments'>>['t']
+}) {
+  const title = renderDriftTitle(config.kind, drift, t)
+
+  return (
+    <TitleTooltip content={title}>
+      <DeploymentStatusBadge
+        status={config.status}
+        label={renderStatus(config.kind, drift, t)}
+        className={className}
+      />
+    </TitleTooltip>
+  )
+}
diff --git a/web/features/deployments/detail/overview-tab/overview-drift.ts b/web/features/deployments/detail/overview-tab/overview-drift.ts
new file mode 100644
index 00000000000..862b1fd553c
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab/overview-drift.ts
@@ -0,0 +1,29 @@
+import type { EnvironmentDeployment, Release } from '@dify/contracts/enterprise/types.gen'
+import { isUndeployedDeploymentRow } from '../../shared/domain/runtime-status'
+
+export type Drift
+  = | { kind: 'undeployed' }
+    | { kind: 'unknown' }
+    | { kind: 'up-to-date' }
+    | { kind: 'behind', steps: number }
+
+export function computeDrift(row: EnvironmentDeployment): Drift {
+  if (isUndeployedDeploymentRow(row))
+    return { kind: 'undeployed' }
+
+  if (!row.currentRelease)
+    return { kind: 'unknown' }
+
+  // releasesBehind is server-computed against the full release history (0 == up
+  // to date). It is absent only when undetermined, which renders as unknown.
+  const behind = row.releasesBehind
+  if (behind == null)
+    return { kind: 'unknown' }
+  if (behind === 0)
+    return { kind: 'up-to-date' }
+  return { kind: 'behind', steps: behind }
+}
+
+export function latestReleaseId(releaseRows: Release[]): string | undefined {
+  return releaseRows[0]?.id
+}
diff --git a/web/features/deployments/detail/overview-tab/release-hero.tsx b/web/features/deployments/detail/overview-tab/release-hero.tsx
new file mode 100644
index 00000000000..b275b4b48d4
--- /dev/null
+++ b/web/features/deployments/detail/overview-tab/release-hero.tsx
@@ -0,0 +1,168 @@
+'use client'
+
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import type { ReactNode } from 'react'
+import { ReleaseSource } from '@dify/contracts/enterprise/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
+import Link from '@/next/link'
+import { consoleQuery } from '@/service/client'
+import { DeploymentEmptyState } from '../../components/empty-state'
+import { TitleTooltip } from '../../components/title-tooltip'
+import { CreateReleaseControl } from '../../create-release'
+import { formatDate, releaseCommit } from '../../shared/domain/release'
+import { OVERVIEW_CARD_CLASS_NAME, OVERVIEW_ICON_CLASS_NAME } from './card-styles'
+
+type ReleaseHeroProps = {
+  appInstanceId: string
+  latestRelease?: Release
+  releaseCount: number
+}
+
+type ReleaseMetaItemProps = {
+  label?: string
+  showSeparator?: boolean
+  children: ReactNode
+}
+
+export function ReleaseHero({ appInstanceId, latestRelease, releaseCount }: ReleaseHeroProps) {
+  const { t } = useTranslation('deployments')
+  const { formatTimeFromNow } = useFormatTimeFromNow()
+
+  if (!latestRelease) {
+    return (
+      <DeploymentEmptyState
+        variant="section"
+        icon="i-ri-stack-line"
+        title={t('overview.hero.empty')}
+        description={t('overview.hero.emptyDescription')}
+        action={<CreateReleaseControl appInstanceId={appInstanceId} size="medium" />}
+        className="min-h-44"
+      />
+    )
+  }
+
+  const author = latestRelease.createdBy.displayName
+  const ago = formatTimeFromNow(new Date(latestRelease.createdAt).getTime())
+  const createdAtTitle = formatDate(latestRelease.createdAt)
+  const commit = releaseCommit(latestRelease)
+
+  return (
+    <div className={cn(OVERVIEW_CARD_CLASS_NAME, 'flex min-w-0 flex-col gap-4 sm:flex-row sm:items-center sm:justify-between sm:gap-6')}>
+      <div className="flex min-w-0 items-center gap-3">
+        <span aria-hidden className={OVERVIEW_ICON_CLASS_NAME}>
+          <span className="i-ri-stack-fill size-4" />
+        </span>
+        <div className="flex min-w-0 flex-col gap-1.5">
+          <div className="flex min-w-0 items-center gap-2">
+            <h4 className="truncate system-sm-semibold text-text-primary">
+              {latestRelease.displayName}
+            </h4>
+            {commit !== '—' && (
+              <TitleTooltip content={t('versions.commitTooltip', { commit })}>
+                <span className="shrink-0 rounded bg-background-section-burn px-1.5 py-0.5 font-mono system-xs-regular text-text-tertiary">
+                  {commit}
+                </span>
+              </TitleTooltip>
+            )}
+          </div>
+          <p className="flex min-w-0 flex-wrap items-center gap-x-1.5 gap-y-1 system-xs-regular text-text-tertiary">
+            <ReleaseMetaItem label={t('versions.col.sourceApp')} showSeparator={false}>
+              <LatestReleaseSource release={latestRelease} />
+            </ReleaseMetaItem>
+            {author && (
+              <ReleaseMetaItem>
+                {t('overview.hero.byName', { name: author })}
+              </ReleaseMetaItem>
+            )}
+            {ago && (
+              <ReleaseMetaItem>
+                <TitleTooltip content={createdAtTitle}>
+                  <span>
+                    {ago}
+                  </span>
+                </TitleTooltip>
+              </ReleaseMetaItem>
+            )}
+            <ReleaseMetaItem>
+              {t('overview.latestRelease.releaseCount', { count: releaseCount })}
+            </ReleaseMetaItem>
+          </p>
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function ReleaseMetaItem({ label, showSeparator = true, children }: ReleaseMetaItemProps) {
+  return (
+    <span className="inline-flex min-w-0 items-center gap-1.5">
+      {showSeparator && (
+        <span aria-hidden className="text-text-quaternary">·</span>
+      )}
+      {label && (
+        <span className="shrink-0 text-text-quaternary">{label}</span>
+      )}
+      <span className="min-w-0 truncate">{children}</span>
+    </span>
+  )
+}
+
+function LatestReleaseSource({ release }: {
+  release: Release
+}) {
+  const { t } = useTranslation('deployments')
+  const sourceAppId = release.sourceAppId
+  const sourceAppQuery = useQuery(consoleQuery.apps.byAppId.get.queryOptions({
+    input: { params: { app_id: sourceAppId ?? '' } },
+    enabled: Boolean(sourceAppId),
+  }))
+
+  if (!sourceAppId) {
+    return (
+      <span>
+        {release.source === ReleaseSource.RELEASE_SOURCE_UPLOAD ? t('versions.manualDslOption') : '—'}
+      </span>
+    )
+  }
+
+  const sourceAppName = sourceAppQuery.data?.name
+  const label = sourceAppName || sourceAppId
+  const title = sourceAppName ? `${sourceAppName} (${sourceAppId})` : sourceAppId
+
+  return (
+    <TitleTooltip content={title}>
+      <Link
+        href={`/app/${encodeURIComponent(sourceAppId)}/workflow`}
+        target="_blank"
+        rel="noreferrer"
+        className="inline-flex max-w-full min-w-0 items-center gap-1 text-text-secondary transition-colors hover:text-text-accent"
+      >
+        <span className="min-w-0 truncate">{label}</span>
+        <span className="i-ri-arrow-right-up-line size-3.5 shrink-0" aria-hidden="true" />
+      </Link>
+    </TitleTooltip>
+  )
+}
+
+export function ReleaseHeroSkeleton() {
+  return (
+    <div
+      data-slot="deployment-overview-release-hero-skeleton"
+      className={cn(OVERVIEW_CARD_CLASS_NAME, 'flex min-w-0 items-start gap-3')}
+    >
+      <SkeletonRectangle className="my-0 size-8 shrink-0 animate-pulse rounded-lg" />
+      <div className="flex min-w-0 flex-col gap-2">
+        <SkeletonRectangle className="my-0 h-4 w-40 animate-pulse" />
+        <div className="flex min-w-0 flex-wrap items-baseline gap-x-1.5 gap-y-1">
+          <SkeletonRectangle className="my-0 h-3 w-32 animate-pulse" />
+          <SkeletonRectangle className="my-0 h-3 w-14 animate-pulse" />
+          <SkeletonRectangle className="my-0 h-3 w-28 animate-pulse" />
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/__tests__/access-policy.spec.ts b/web/features/deployments/detail/settings-tab/access/__tests__/access-policy.spec.ts
new file mode 100644
index 00000000000..4a6bce99f87
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/__tests__/access-policy.spec.ts
@@ -0,0 +1,159 @@
+import type {
+  AccessPolicy,
+  Subject,
+} from '@dify/contracts/enterprise/types.gen'
+import { AccessMode, SubjectType } from '@dify/contracts/enterprise/types.gen'
+import { describe, expect, it } from 'vitest'
+import { AccessMode as AppAccessMode } from '@/models/access-control'
+import {
+  accessControlSelectionFromSubjects,
+  accessModeToPermissionKey,
+  appAccessModeToPermissionKey,
+  normalizeResolvedSubject,
+  permissionKeyToAccessMode,
+  permissionKeyToAppAccessMode,
+  policySubjects,
+  selectedSubjectsFromPolicy,
+  subjectsFromAccessControlSelection,
+} from '../access-policy'
+
+function policy(overrides: Partial<AccessPolicy>): AccessPolicy {
+  return {
+    id: 'policy-1',
+    appInstanceId: 'app-instance-1',
+    environmentId: 'environment-1',
+    mode: AccessMode.ACCESS_MODE_PRIVATE_ALL,
+    subjects: [],
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  }
+}
+
+describe('access policy mode mapping', () => {
+  it('should map API access modes to deployment permission keys', () => {
+    expect(accessModeToPermissionKey(AccessMode.ACCESS_MODE_PRIVATE)).toBe('specific')
+    expect(accessModeToPermissionKey(AccessMode.ACCESS_MODE_PUBLIC)).toBe('anyone')
+    expect(accessModeToPermissionKey(AccessMode.ACCESS_MODE_PRIVATE_ALL)).toBe('organization')
+    expect(accessModeToPermissionKey()).toBe('organization')
+  })
+
+  it('should map permission keys to API and app access modes', () => {
+    expect(permissionKeyToAccessMode('organization')).toBe(AccessMode.ACCESS_MODE_PRIVATE_ALL)
+    expect(permissionKeyToAccessMode('specific')).toBe(AccessMode.ACCESS_MODE_PRIVATE)
+    expect(permissionKeyToAccessMode('anyone')).toBe(AccessMode.ACCESS_MODE_PUBLIC)
+
+    expect(permissionKeyToAppAccessMode('organization')).toBe(AppAccessMode.ORGANIZATION)
+    expect(permissionKeyToAppAccessMode('specific')).toBe(AppAccessMode.SPECIFIC_GROUPS_MEMBERS)
+    expect(permissionKeyToAppAccessMode('anyone')).toBe(AppAccessMode.PUBLIC)
+
+    expect(appAccessModeToPermissionKey(AppAccessMode.SPECIFIC_GROUPS_MEMBERS)).toBe('specific')
+    expect(appAccessModeToPermissionKey(AppAccessMode.PUBLIC)).toBe('anyone')
+    expect(appAccessModeToPermissionKey(AppAccessMode.ORGANIZATION)).toBe('organization')
+  })
+})
+
+describe('access policy subject conversion', () => {
+  it('should normalize resolved group and account subjects', () => {
+    expect(normalizeResolvedSubject({
+      subjectType: SubjectType.SUBJECT_TYPE_GROUP,
+      groupData: {
+        id: 'group-1',
+        name: 'Admins',
+        groupSize: 3,
+      },
+    })).toEqual({
+      id: 'group-1',
+      subjectType: SubjectType.SUBJECT_TYPE_GROUP,
+      name: 'Admins',
+      memberCount: 3,
+    })
+
+    expect(normalizeResolvedSubject({
+      subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT,
+      accountData: {
+        id: 'account-1',
+        email: 'member@example.com',
+      },
+    })).toEqual({
+      id: 'account-1',
+      subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT,
+      name: 'member@example.com',
+    })
+  })
+
+  it('should ignore unsupported subjects and subjects without ids', () => {
+    expect(normalizeResolvedSubject({ subjectType: SubjectType.SUBJECT_TYPE_GROUP })).toBeUndefined()
+    expect(normalizeResolvedSubject({ subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT })).toBeUndefined()
+    expect(normalizeResolvedSubject({ subjectType: SubjectType.SUBJECT_TYPE_UNSPECIFIED } as Subject)).toBeUndefined()
+  })
+
+  it('should preserve labels when reading selected subjects from policy', () => {
+    expect(selectedSubjectsFromPolicy(policy({
+      subjects: [
+        { subjectId: 'group-1', subjectType: SubjectType.SUBJECT_TYPE_GROUP },
+        { subjectId: 'account-1', subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT },
+      ],
+    }), [
+      {
+        id: 'group-1',
+        subjectType: SubjectType.SUBJECT_TYPE_GROUP,
+        name: 'Admins',
+        memberCount: 3,
+      },
+    ])).toEqual([
+      {
+        id: 'group-1',
+        subjectType: SubjectType.SUBJECT_TYPE_GROUP,
+        name: 'Admins',
+        memberCount: 3,
+      },
+      {
+        id: 'account-1',
+        subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT,
+      },
+    ])
+
+    expect(selectedSubjectsFromPolicy()).toEqual([])
+  })
+
+  it('should convert between deployment subjects and access-control selections', () => {
+    const subjects = [
+      {
+        id: 'group-1',
+        subjectType: SubjectType.SUBJECT_TYPE_GROUP,
+        name: 'Admins',
+        memberCount: 3,
+      },
+      {
+        id: 'account-1',
+        subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT,
+        name: 'Member',
+      },
+    ]
+
+    expect(policySubjects(subjects)).toEqual([
+      { subjectId: 'group-1', subjectType: SubjectType.SUBJECT_TYPE_GROUP },
+      { subjectId: 'account-1', subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT },
+    ])
+
+    const selection = accessControlSelectionFromSubjects(subjects)
+    expect(selection.groups).toEqual([
+      {
+        id: 'group-1',
+        name: 'Admins',
+        groupSize: 3,
+      },
+    ])
+    expect(selection.members).toEqual([
+      {
+        id: 'account-1',
+        name: 'Member',
+        email: 'Member',
+        avatar: '',
+        avatarUrl: '',
+      },
+    ])
+    expect(subjectsFromAccessControlSelection(selection)).toEqual(subjects)
+  })
+})
diff --git a/web/features/deployments/detail/settings-tab/access/__tests__/api-key-generate-menu.spec.tsx b/web/features/deployments/detail/settings-tab/access/__tests__/api-key-generate-menu.spec.tsx
new file mode 100644
index 00000000000..6d7d03bc94c
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/__tests__/api-key-generate-menu.spec.tsx
@@ -0,0 +1,51 @@
+import type { Environment } from '@dify/contracts/enterprise/types.gen'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import { ApiKeyGenerateMenu } from '../api-key-generate-menu'
+
+const mockMutate = vi.fn()
+const mockUseMutation = vi.hoisted(() => vi.fn())
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useMutation: (...args: unknown[]) => mockUseMutation(...args),
+  }
+})
+
+function createEnvironment(): Environment {
+  return {
+    id: 'environment-1',
+    displayName: 'Production',
+  } as Environment
+}
+
+describe('ApiKeyGenerateMenu', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUseMutation.mockReturnValue({
+      isPending: false,
+      mutate: mockMutate,
+    })
+  })
+
+  it('should show the required name error when submitting an empty name', () => {
+    render(
+      <ApiKeyGenerateMenu
+        appInstanceId="app-instance-1"
+        environments={[createEnvironment()]}
+        onCreatedToken={vi.fn()}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'deployments.access.api.newKey' }))
+    fireEvent.change(screen.getByLabelText('deployments.access.api.nameLabel'), {
+      target: { value: '   ' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'deployments.access.api.createKey' }))
+
+    expect(screen.getByText('deployments.access.api.nameRequired')).toBeInTheDocument()
+    expect(mockMutate).not.toHaveBeenCalled()
+  })
+})
diff --git a/web/features/deployments/detail/settings-tab/access/__tests__/channels-section.spec.tsx b/web/features/deployments/detail/settings-tab/access/__tests__/channels-section.spec.tsx
new file mode 100644
index 00000000000..730380b4284
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/__tests__/channels-section.spec.tsx
@@ -0,0 +1,62 @@
+import type { AccessChannels, AccessEndpoint } from '@dify/contracts/enterprise/types.gen'
+import { render, screen } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { AccessChannelsSection } from '../channels-section'
+
+const mockUseMutation = vi.hoisted(() => vi.fn())
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useMutation: (...args: unknown[]) => mockUseMutation(...args),
+  }
+})
+
+function createAccessChannels(): AccessChannels {
+  return {
+    id: 'access-channels-1',
+    appInstanceId: 'app-instance-1',
+    webAppEnabled: true,
+    developerApiEnabled: false,
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+  } as AccessChannels
+}
+
+function createEndpoint(endpointUrl: string): AccessEndpoint {
+  return {
+    environment: {
+      id: 'environment-1',
+      displayName: 'Production',
+    },
+    endpointUrl,
+  } as AccessEndpoint
+}
+
+// Access channel rows keep their title, description, and endpoint content together.
+describe('AccessChannelsSection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUseMutation.mockReturnValue({
+      isPending: false,
+      mutate: vi.fn(),
+    })
+  })
+
+  it('should render channel descriptions when access channels are enabled', () => {
+    render(
+      <AccessChannelsSection
+        appInstanceId="app-instance-1"
+        accessChannels={createAccessChannels()}
+        webAppEndpoints={[createEndpoint('https://app.example.com/webapp')]}
+        cliEndpoint={createEndpoint('https://cli.example.com/entry')}
+        isLoading={false}
+        isError={false}
+      />,
+    )
+
+    expect(screen.getByText('deployments.access.runAccess.webappDesc')).toBeInTheDocument()
+    expect(screen.getByText('deployments.access.cli.description')).toBeInTheDocument()
+  })
+})
diff --git a/web/features/deployments/detail/settings-tab/access/__tests__/permissions.spec.tsx b/web/features/deployments/detail/settings-tab/access/__tests__/permissions.spec.tsx
new file mode 100644
index 00000000000..489550127b1
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/__tests__/permissions.spec.tsx
@@ -0,0 +1,134 @@
+import type { AccessPolicy, Environment, EnvironmentAccessPolicy } from '@dify/contracts/enterprise/types.gen'
+import { AccessMode, SubjectType } from '@dify/contracts/enterprise/types.gen'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import { EnvironmentPermissionRow } from '../permissions'
+import { AccessPermissionsSection } from '../permissions-section'
+
+const mockMutate = vi.fn()
+const mockUseMutation = vi.hoisted(() => vi.fn())
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useMutation: (...args: unknown[]) => mockUseMutation(...args),
+  }
+})
+
+function createEnvironment(overrides: Partial<Environment> = {}): Environment {
+  return {
+    id: 'environment-1',
+    displayName: 'Production',
+    ...overrides,
+  } as Environment
+}
+
+function createAccessPolicy(): AccessPolicy {
+  return {
+    id: 'policy-1',
+    appInstanceId: 'app-instance-1',
+    environmentId: 'environment-1',
+    mode: AccessMode.ACCESS_MODE_PRIVATE_ALL,
+    subjects: [],
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+  }
+}
+
+function createSpecificAccessPolicy(): AccessPolicy {
+  return {
+    ...createAccessPolicy(),
+    mode: AccessMode.ACCESS_MODE_PRIVATE,
+    subjects: [
+      {
+        subjectId: 'group-1',
+        subjectType: SubjectType.SUBJECT_TYPE_GROUP,
+      },
+      {
+        subjectId: 'member-1',
+        subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT,
+      },
+    ],
+  }
+}
+
+function createEnvironmentAccessPolicy(): EnvironmentAccessPolicy {
+  return {
+    environment: createEnvironment(),
+    policy: createAccessPolicy(),
+    resolvedSubjects: [],
+  }
+}
+
+describe('EnvironmentPermissionRow', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockMutate.mockImplementation((_variables: unknown, options?: { onError?: () => void }) => {
+      options?.onError?.()
+    })
+    mockUseMutation.mockReturnValue({
+      isPending: false,
+      mutate: mockMutate,
+    })
+  })
+
+  it('should keep the previous permission visible when updating the policy fails', () => {
+    render(
+      <EnvironmentPermissionRow
+        appInstanceId="app-instance-1"
+        environment={createEnvironment()}
+        summaryPolicy={createAccessPolicy()}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /deployments\.access\.permissions\.editAriaLabel/ }))
+    fireEvent.click(screen.getByRole('radio', { name: 'app.accessControlDialog.accessItems.anyone' }))
+    fireEvent.click(screen.getByRole('button', { name: 'common.operation.confirm' }))
+
+    expect(mockMutate).toHaveBeenCalled()
+    expect(screen.getByText('deployments.access.permission.organization')).toBeInTheDocument()
+  })
+
+  it('should show specific subject counts in the access summary', () => {
+    render(
+      <EnvironmentPermissionRow
+        appInstanceId="app-instance-1"
+        environment={createEnvironment()}
+        summaryPolicy={createSpecificAccessPolicy()}
+      />,
+    )
+
+    const editButton = screen.getByRole('button', { name: /deployments\.access\.permissions\.editAriaLabel/ })
+
+    expect(editButton).toHaveTextContent('deployments.access.permission.specific')
+    expect(editButton).toHaveTextContent('deployments.access.members.groupCount:{"count":1}')
+    expect(editButton).toHaveTextContent('deployments.access.members.memberCount:{"count":1}')
+  })
+})
+
+// Access permissions render as simple environment rows without a table header.
+describe('AccessPermissionsSection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUseMutation.mockReturnValue({
+      isPending: false,
+      mutate: mockMutate,
+    })
+  })
+
+  it('should render permission rows without column headers', () => {
+    render(
+      <AccessPermissionsSection
+        appInstanceId="app-instance-1"
+        environmentPolicies={[createEnvironmentAccessPolicy()]}
+        isLoading={false}
+        isError={false}
+      />,
+    )
+
+    expect(screen.getByText('Production')).toBeInTheDocument()
+    expect(screen.queryByText('deployments.access.permissions.col.environment')).not.toBeInTheDocument()
+    expect(screen.queryByText('deployments.access.permissions.col.permission')).not.toBeInTheDocument()
+  })
+})
diff --git a/web/features/deployments/detail/settings-tab/access/access-policy.ts b/web/features/deployments/detail/settings-tab/access/access-policy.ts
new file mode 100644
index 00000000000..d18707a1167
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/access-policy.ts
@@ -0,0 +1,169 @@
+import type {
+  AccessPolicy,
+  AccessMode as AccessPolicyMode,
+  AccessSubject,
+  SubjectType as AccessSubjectType,
+  Subject,
+} from '@dify/contracts/enterprise/types.gen'
+import type { AccessSubjectSelectionValue } from '@/app/components/app/app-access-control/access-subject-selector/types'
+import type {
+  AccessControlAccount,
+  AccessControlGroup,
+} from '@/models/access-control'
+import {
+  AccessMode,
+  SubjectType,
+} from '@dify/contracts/enterprise/types.gen'
+import { AccessMode as AppAccessMode } from '@/models/access-control'
+
+export type AccessPermissionKind = 'organization' | 'specific' | 'anyone'
+
+export const permissionIcon: Record<AccessPermissionKind, string> = {
+  organization: 'i-ri-building-line',
+  specific: 'i-ri-lock-line',
+  anyone: 'i-ri-global-line',
+}
+
+export type SelectableAccessSubject = {
+  id: string
+  subjectType: AccessSubjectType
+  name?: string
+  memberCount?: number
+}
+
+export function accessModeToPermissionKey(mode?: AccessPolicy['mode']): AccessPermissionKind {
+  if (mode === AccessMode.ACCESS_MODE_PRIVATE)
+    return 'specific'
+  if (mode === AccessMode.ACCESS_MODE_PUBLIC)
+    return 'anyone'
+  return 'organization'
+}
+
+export function permissionKeyToAccessMode(key: AccessPermissionKind): AccessPolicyMode {
+  if (key === 'organization')
+    return AccessMode.ACCESS_MODE_PRIVATE_ALL
+  if (key === 'specific')
+    return AccessMode.ACCESS_MODE_PRIVATE
+  return AccessMode.ACCESS_MODE_PUBLIC
+}
+
+export function permissionKeyToAppAccessMode(key: AccessPermissionKind): AppAccessMode {
+  if (key === 'organization')
+    return AppAccessMode.ORGANIZATION
+  if (key === 'specific')
+    return AppAccessMode.SPECIFIC_GROUPS_MEMBERS
+  return AppAccessMode.PUBLIC
+}
+
+export function appAccessModeToPermissionKey(mode: AppAccessMode): AccessPermissionKind {
+  if (mode === AppAccessMode.SPECIFIC_GROUPS_MEMBERS)
+    return 'specific'
+  if (mode === AppAccessMode.PUBLIC)
+    return 'anyone'
+  return 'organization'
+}
+
+export function normalizeResolvedSubject(subject: Subject): SelectableAccessSubject | undefined {
+  if (subject.subjectType === SubjectType.SUBJECT_TYPE_GROUP) {
+    const id = subject.subjectId || subject.groupData?.id
+    if (!id)
+      return undefined
+
+    return {
+      id,
+      subjectType: SubjectType.SUBJECT_TYPE_GROUP,
+      name: subject.groupData?.name,
+      memberCount: subject.groupData?.groupSize,
+    }
+  }
+
+  if (subject.subjectType === SubjectType.SUBJECT_TYPE_ACCOUNT) {
+    const id = subject.subjectId || subject.accountData?.id
+    if (!id)
+      return undefined
+
+    return {
+      id,
+      subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT,
+      name: subject.accountData?.name || subject.accountData?.email,
+    }
+  }
+
+  return undefined
+}
+
+function getSubjectLabel(subject: SelectableAccessSubject) {
+  return subject.name || subject.id
+}
+
+export function policySubjects(subjects: SelectableAccessSubject[]): AccessSubject[] {
+  return subjects.map(subject => ({
+    subjectId: subject.id,
+    subjectType: subject.subjectType,
+  }))
+}
+
+export function selectedSubjectsFromPolicy(policy?: AccessPolicy, labelSubjects: SelectableAccessSubject[] = []) {
+  if (!policy)
+    return []
+
+  return policy.subjects
+    .map((subject): SelectableAccessSubject => {
+      const matchedSubject = labelSubjects.find(labelSubject =>
+        labelSubject.id === subject.subjectId && labelSubject.subjectType === subject.subjectType,
+      )
+      return {
+        id: subject.subjectId,
+        subjectType: subject.subjectType,
+        name: matchedSubject?.name,
+        memberCount: matchedSubject?.memberCount,
+      }
+    })
+}
+
+function selectableSubjectToGroup(subject: SelectableAccessSubject): AccessControlGroup {
+  return {
+    id: subject.id,
+    name: getSubjectLabel(subject),
+    groupSize: subject.memberCount ?? 0,
+  }
+}
+
+function selectableSubjectToAccount(subject: SelectableAccessSubject): AccessControlAccount {
+  const label = getSubjectLabel(subject)
+
+  return {
+    id: subject.id,
+    name: label,
+    email: label,
+    avatar: '',
+    avatarUrl: '',
+  }
+}
+
+export function accessControlSelectionFromSubjects(subjects: SelectableAccessSubject[]): AccessSubjectSelectionValue {
+  return {
+    groups: subjects
+      .filter(subject => subject.subjectType === SubjectType.SUBJECT_TYPE_GROUP)
+      .map(selectableSubjectToGroup),
+    members: subjects
+      .filter(subject => subject.subjectType === SubjectType.SUBJECT_TYPE_ACCOUNT)
+      .map(selectableSubjectToAccount),
+  }
+}
+
+export function subjectsFromAccessControlSelection(value: AccessSubjectSelectionValue): SelectableAccessSubject[] {
+  return [
+    ...value.groups.map((group): SelectableAccessSubject => ({
+      id: group.id,
+      subjectType: SubjectType.SUBJECT_TYPE_GROUP,
+      name: group.name,
+      memberCount: group.groupSize,
+    })),
+    ...value.members.map((member): SelectableAccessSubject => ({
+      id: member.id,
+      subjectType: SubjectType.SUBJECT_TYPE_ACCOUNT,
+      name: member.name || member.email,
+    })),
+  ]
+}
diff --git a/web/features/deployments/detail/settings-tab/access/api-docs-drawer.tsx b/web/features/deployments/detail/settings-tab/access/api-docs-drawer.tsx
new file mode 100644
index 00000000000..fb88bf0c9cf
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/api-docs-drawer.tsx
@@ -0,0 +1,130 @@
+'use client'
+
+import type { App } from '@/types/app'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  Drawer,
+  DrawerBackdrop,
+  DrawerCloseButton,
+  DrawerContent,
+  DrawerDescription,
+  DrawerPopup,
+  DrawerPortal,
+  DrawerTitle,
+  DrawerViewport,
+} from '@langgenius/dify-ui/drawer'
+import { useTranslation } from 'react-i18next'
+import TemplateWorkflowEn from '@/app/components/develop/template/template_workflow.en.mdx'
+import TemplateWorkflowJa from '@/app/components/develop/template/template_workflow.ja.mdx'
+import TemplateWorkflowZh from '@/app/components/develop/template/template_workflow.zh.mdx'
+import { useLocale } from '@/context/i18n'
+import useTheme from '@/hooks/use-theme'
+import { getDocLanguage } from '@/i18n-config/language'
+import { AppModeEnum, Theme } from '@/types/app'
+
+type PromptVariable = { key: string, name: string }
+type WorkflowApiDocAppDetail = Pick<App, 'id' | 'mode' | 'api_base_url'>
+
+type WorkflowDocTemplateProps = {
+  appDetail: WorkflowApiDocAppDetail
+  variables: PromptVariable[]
+  inputs: Record<string, string>
+}
+
+const EMPTY_VARIABLES: PromptVariable[] = []
+const EMPTY_INPUTS: Record<string, string> = {}
+
+function WorkflowDocTemplate({ docLanguage, appDetail, variables, inputs }: WorkflowDocTemplateProps & {
+  docLanguage: string
+}) {
+  if (docLanguage === 'zh') {
+    return (
+      <TemplateWorkflowZh
+        appDetail={appDetail}
+        variables={variables}
+        inputs={inputs}
+      />
+    )
+  }
+  if (docLanguage === 'ja') {
+    return (
+      <TemplateWorkflowJa
+        appDetail={appDetail}
+        variables={variables}
+        inputs={inputs}
+      />
+    )
+  }
+
+  return (
+    <TemplateWorkflowEn
+      appDetail={appDetail}
+      variables={variables}
+      inputs={inputs}
+    />
+  )
+}
+
+export function DeveloperApiDocsDrawer({
+  open,
+  appInstanceId,
+  apiBaseUrl,
+  onOpenChange,
+}: {
+  open: boolean
+  appInstanceId: string
+  apiBaseUrl: string
+  onOpenChange: (open: boolean) => void
+}) {
+  const { t } = useTranslation('deployments')
+  const locale = useLocale()
+  const { theme } = useTheme()
+  const docLanguage = getDocLanguage(locale)
+  const appDetail: WorkflowApiDocAppDetail = {
+    id: appInstanceId,
+    mode: AppModeEnum.WORKFLOW,
+    api_base_url: apiBaseUrl,
+  }
+
+  return (
+    <Drawer
+      open={open}
+      modal
+      swipeDirection="right"
+      onOpenChange={onOpenChange}
+    >
+      <DrawerPortal>
+        <DrawerBackdrop />
+        <DrawerViewport>
+          <DrawerPopup className="data-[swipe-direction=right]:top-16 data-[swipe-direction=right]:right-2 data-[swipe-direction=right]:bottom-2 data-[swipe-direction=right]:h-auto data-[swipe-direction=right]:w-[840px] data-[swipe-direction=right]:max-w-[calc(100vw-1rem)] data-[swipe-direction=right]:rounded-xl data-[swipe-direction=right]:border-[0.5px]">
+            <DrawerCloseButton
+              aria-label={t('access.api.docsClose')}
+              className="absolute top-4 right-5 size-6 rounded-md"
+            />
+            <DrawerContent className="flex min-h-0 flex-1 flex-col bg-components-panel-bg p-0 pb-0">
+              <div className="shrink-0 border-b border-divider-subtle px-6 py-5 pr-14">
+                <DrawerTitle className="title-xl-semi-bold text-text-primary">
+                  {t('access.api.docsTitle')}
+                </DrawerTitle>
+                <DrawerDescription className="mt-1 system-sm-regular text-text-tertiary">
+                  {t('access.api.docsDescription')}
+                </DrawerDescription>
+              </div>
+
+              <div className="min-h-0 flex-1 overflow-x-hidden overflow-y-auto px-6 py-5">
+                <article className={cn('prose max-w-none', theme === Theme.dark && 'prose-invert')}>
+                  <WorkflowDocTemplate
+                    docLanguage={docLanguage}
+                    appDetail={appDetail}
+                    variables={EMPTY_VARIABLES}
+                    inputs={EMPTY_INPUTS}
+                  />
+                </article>
+              </div>
+            </DrawerContent>
+          </DrawerPopup>
+        </DrawerViewport>
+      </DrawerPortal>
+    </Drawer>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/api-key-generate-menu.tsx b/web/features/deployments/detail/settings-tab/access/api-key-generate-menu.tsx
new file mode 100644
index 00000000000..e004d36ff13
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/api-key-generate-menu.tsx
@@ -0,0 +1,237 @@
+'use client'
+
+import type { Environment } from '@dify/contracts/enterprise/types.gen'
+import type { ButtonProps } from '@langgenius/dify-ui/button'
+import type { FormEvent, ReactNode } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  Dialog,
+  DialogCloseButton,
+  DialogContent,
+  DialogDescription,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { Input } from '@langgenius/dify-ui/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectItemIndicator,
+  SelectItemText,
+  SelectLabel,
+  SelectTrigger,
+} from '@langgenius/dify-ui/select'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useEffect, useId, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { generateApiTokenName } from './api-token-name'
+
+export function ApiKeyGenerateMenu({
+  appInstanceId,
+  environments,
+  onCreatedToken,
+  triggerVariant = 'secondary',
+  triggerClassName,
+  children,
+}: {
+  appInstanceId: string
+  environments: Environment[]
+  onCreatedToken: (token: string) => void
+  triggerVariant?: ButtonProps['variant']
+  triggerClassName?: string
+  children?: (props: { trigger: ReactNode }) => ReactNode
+}) {
+  const { t } = useTranslation('deployments')
+  const nameInputId = useId()
+  const nameInputRef = useRef<HTMLInputElement>(null)
+  const [createDialogOpen, setCreateDialogOpen] = useState(false)
+  const [selectedEnvironmentId, setSelectedEnvironmentId] = useState<string>()
+  const [draftName, setDraftName] = useState('')
+  const [nameError, setNameError] = useState(false)
+  const generateApiKey = useMutation(consoleQuery.enterprise.accessService.createApiKey.mutationOptions())
+  const selectableEnvironments = environments
+  const selectedEnvironment = selectedEnvironmentId
+    ? selectableEnvironments.find(env => env.id === selectedEnvironmentId)
+    : undefined
+  const disabled = selectableEnvironments.length === 0
+  const isCreating = generateApiKey.isPending
+
+  useEffect(() => {
+    if (createDialogOpen)
+      nameInputRef.current?.focus()
+  }, [createDialogOpen])
+
+  function resetCreateDialog() {
+    setCreateDialogOpen(false)
+    setSelectedEnvironmentId(undefined)
+    setDraftName('')
+    setNameError(false)
+  }
+
+  function handleOpenCreateDialog() {
+    const firstEnvironment = selectableEnvironments[0]
+    if (!firstEnvironment)
+      return
+
+    setSelectedEnvironmentId(firstEnvironment.id)
+    setDraftName(generateApiTokenName())
+    setNameError(false)
+    setCreateDialogOpen(true)
+  }
+
+  function handleEnvironmentChange(environmentId: string) {
+    setSelectedEnvironmentId(environmentId)
+    setNameError(false)
+  }
+
+  function handleDialogOpenChange(nextOpen: boolean) {
+    if (nextOpen || isCreating)
+      return
+
+    resetCreateDialog()
+  }
+
+  function handleGenerateApiKey(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault()
+
+    const name = draftName.trim()
+
+    if (!selectedEnvironmentId || !name) {
+      setNameError(true)
+      return
+    }
+
+    generateApiKey.mutate(
+      {
+        params: {
+          appInstanceId,
+          environmentId: selectedEnvironmentId,
+        },
+        body: {
+          appInstanceId,
+          environmentId: selectedEnvironmentId,
+          displayName: name,
+        },
+      },
+      {
+        onSuccess: (response) => {
+          if (response.token)
+            onCreatedToken(response.token)
+          resetCreateDialog()
+        },
+        onError: () => {
+          toast.error(t('access.api.createFailed'))
+        },
+      },
+    )
+  }
+
+  const trigger = (
+    <Button
+      type="button"
+      variant={triggerVariant}
+      disabled={disabled}
+      onClick={handleOpenCreateDialog}
+      className={cn('gap-1.5', triggerClassName)}
+    >
+      <span className="i-ri-add-line size-4" aria-hidden="true" />
+      {t('access.api.newKey')}
+    </Button>
+  )
+
+  return (
+    <>
+      {children ? children({ trigger }) : trigger}
+      <Dialog open={createDialogOpen} onOpenChange={handleDialogOpenChange}>
+        <DialogContent className="w-120 max-w-[calc(100vw-32px)] overflow-hidden p-0">
+          <DialogCloseButton disabled={isCreating} />
+          <form onSubmit={handleGenerateApiKey}>
+            <div className="border-b border-divider-subtle px-6 py-5 pr-14">
+              <DialogTitle className="title-xl-semi-bold text-text-primary">
+                {t('access.api.createKeyTitle')}
+              </DialogTitle>
+              <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+                {t('access.api.description')}
+              </DialogDescription>
+            </div>
+
+            <div className="flex flex-col gap-4 px-6 py-5">
+              <div>
+                <label
+                  htmlFor={nameInputId}
+                  className="mb-1 block system-sm-medium text-text-secondary"
+                >
+                  {t('access.api.nameLabel')}
+                </label>
+                <Input
+                  ref={nameInputRef}
+                  id={nameInputId}
+                  value={draftName}
+                  disabled={isCreating}
+                  aria-invalid={nameError || undefined}
+                  aria-describedby={nameError ? `${nameInputId}-error` : undefined}
+                  placeholder={t('access.api.namePlaceholder')}
+                  onChange={(event) => {
+                    setDraftName(event.target.value)
+                    if (nameError && event.target.value.trim())
+                      setNameError(false)
+                  }}
+                />
+                {nameError && (
+                  <div id={`${nameInputId}-error`} className="mt-1 system-xs-regular text-text-destructive">
+                    {t('access.api.nameRequired')}
+                  </div>
+                )}
+              </div>
+
+              <div>
+                <Select
+                  value={selectedEnvironmentId ?? null}
+                  disabled={isCreating}
+                  onValueChange={value => value && handleEnvironmentChange(value)}
+                >
+                  <SelectLabel className="mb-1 block system-sm-medium text-text-secondary">
+                    {t('access.api.table.environment')}
+                  </SelectLabel>
+                  <SelectTrigger>
+                    {selectedEnvironment?.displayName ?? '—'}
+                  </SelectTrigger>
+                  <SelectContent>
+                    {selectableEnvironments.map(env => (
+                      <SelectItem key={env.id} value={env.id}>
+                        <SelectItemText>{env.displayName}</SelectItemText>
+                        <SelectItemIndicator />
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </div>
+            </div>
+
+            <div className="flex justify-end gap-2 border-t border-divider-subtle bg-background-default-subtle px-6 py-4">
+              <Button
+                type="button"
+                variant="secondary"
+                disabled={isCreating}
+                onClick={() => handleDialogOpenChange(false)}
+              >
+                {t('operation.cancel', { ns: 'common' })}
+              </Button>
+              <Button
+                type="submit"
+                variant="primary"
+                loading={isCreating}
+                disabled={isCreating || !selectedEnvironmentId}
+              >
+                {t('access.api.createKey')}
+              </Button>
+            </div>
+          </form>
+        </DialogContent>
+      </Dialog>
+    </>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/api-key-list.tsx b/web/features/deployments/detail/settings-tab/access/api-key-list.tsx
new file mode 100644
index 00000000000..cf2a8553aee
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/api-key-list.tsx
@@ -0,0 +1,253 @@
+'use client'
+
+import type {
+  ApiKey,
+  Environment,
+} from '@dify/contracts/enterprise/types.gen'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { cn } from '@langgenius/dify-ui/cn'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import {
+  DetailTable,
+  DetailTableBody,
+  DetailTableCard,
+  DetailTableCardList,
+  DetailTableCell,
+  DetailTableHead,
+  DetailTableHeader,
+  DetailTableRow,
+} from '../../table'
+import {
+  API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES,
+} from '../../table-styles'
+
+function ApiKeyName({ apiKey }: {
+  apiKey: ApiKey
+}) {
+  return (
+    <span className="block truncate text-text-primary">
+      {apiKey.displayName}
+    </span>
+  )
+}
+
+function EnvironmentBadge({ environment }: {
+  environment?: Environment
+}) {
+  return (
+    <span className="inline-flex h-5 max-w-36 items-center rounded-md bg-background-section-burn px-1.5 text-xs text-text-tertiary">
+      <span className="truncate">{environment?.displayName ?? '—'}</span>
+    </span>
+  )
+}
+
+function ApiKeyValue({ value }: {
+  value: string
+}) {
+  return (
+    <div className="flex h-8 min-w-0 items-center rounded-lg border border-components-input-border-active bg-components-input-bg-normal px-2">
+      <div className="min-w-0 flex-1 truncate font-mono system-sm-medium text-text-secondary">
+        {value}
+      </div>
+    </div>
+  )
+}
+
+function RevokeApiKeyButton({ apiKey }: {
+  apiKey: ApiKey
+}) {
+  const { t } = useTranslation('deployments')
+  const [showRevokeConfirm, setShowRevokeConfirm] = useState(false)
+  const revokeApiKey = useMutation(consoleQuery.enterprise.accessService.deleteApiKey.mutationOptions())
+  const isRevoking = revokeApiKey.isPending
+  const apiKeyName = apiKey.displayName
+
+  function handleRevoke() {
+    if (isRevoking)
+      return
+
+    revokeApiKey.mutate(
+      {
+        params: {
+          appInstanceId: apiKey.appInstanceId,
+          environmentId: apiKey.environmentId,
+          apiKeyId: apiKey.id,
+        },
+      },
+      {
+        onSuccess: () => {
+          setShowRevokeConfirm(false)
+          toast.success(t('access.api.revokeSuccess'))
+        },
+        onError: () => {
+          toast.error(t('access.api.revokeFailed'))
+        },
+      },
+    )
+  }
+
+  function handleRevokeConfirmOpenChange(open: boolean) {
+    if (isRevoking)
+      return
+
+    setShowRevokeConfirm(open)
+  }
+
+  return (
+    <>
+      <button
+        type="button"
+        onClick={() => setShowRevokeConfirm(true)}
+        aria-label={t('access.revoke')}
+        aria-busy={isRevoking}
+        disabled={isRevoking}
+        className={cn(
+          'inline-flex size-8 shrink-0 items-center justify-center rounded-md text-text-tertiary outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid',
+          isRevoking
+            ? 'cursor-not-allowed opacity-60'
+            : 'hover:bg-state-destructive-hover hover:text-text-destructive',
+        )}
+      >
+        <span className={cn(isRevoking ? 'i-ri-loader-2-line animate-spin' : 'i-ri-delete-bin-line', 'size-3.5')} />
+      </button>
+      <AlertDialog open={showRevokeConfirm} onOpenChange={handleRevokeConfirmOpenChange}>
+        <AlertDialogContent>
+          <div className="flex flex-col gap-2 px-6 pt-6 pb-4">
+            <AlertDialogTitle className="w-full truncate title-2xl-semi-bold text-text-primary">
+              {t('access.api.revokeConfirmTitle')}
+            </AlertDialogTitle>
+            <AlertDialogDescription className="w-full system-md-regular wrap-break-word whitespace-pre-wrap text-text-tertiary">
+              {t('access.api.revokeConfirmDescription', { name: apiKeyName })}
+            </AlertDialogDescription>
+          </div>
+          <AlertDialogActions>
+            <AlertDialogCancelButton disabled={isRevoking}>
+              {t('operation.cancel', { ns: 'common' })}
+            </AlertDialogCancelButton>
+            <AlertDialogConfirmButton loading={isRevoking} disabled={isRevoking} onClick={handleRevoke}>
+              {t('access.revoke')}
+            </AlertDialogConfirmButton>
+          </AlertDialogActions>
+        </AlertDialogContent>
+      </AlertDialog>
+    </>
+  )
+}
+
+function ApiKeyMobileRow({ apiKey, environment }: {
+  apiKey: ApiKey
+  environment?: Environment
+}) {
+  const { t } = useTranslation('deployments')
+  const displayValue = apiKey.maskedToken
+
+  return (
+    <DetailTableCard>
+      <div className="flex flex-col gap-3 p-4">
+        <div className="flex items-start justify-between gap-3">
+          <div className="min-w-0">
+            <ApiKeyName apiKey={apiKey} />
+            <div className="mt-1">
+              <EnvironmentBadge environment={environment} />
+            </div>
+          </div>
+          <RevokeApiKeyButton apiKey={apiKey} />
+        </div>
+        <div className="flex min-w-0 flex-col gap-1">
+          <span className="system-2xs-medium-uppercase text-text-tertiary">
+            {t('access.api.table.key')}
+          </span>
+          <ApiKeyValue value={displayValue} />
+        </div>
+      </div>
+    </DetailTableCard>
+  )
+}
+
+function ApiKeyDesktopRow({ apiKey, environment }: {
+  apiKey: ApiKey
+  environment?: Environment
+}) {
+  const displayValue = apiKey.maskedToken
+
+  return (
+    <DetailTableRow>
+      <DetailTableCell>
+        <ApiKeyName apiKey={apiKey} />
+      </DetailTableCell>
+      <DetailTableCell>
+        <EnvironmentBadge environment={environment} />
+      </DetailTableCell>
+      <DetailTableCell>
+        <ApiKeyValue value={displayValue} />
+      </DetailTableCell>
+      <DetailTableCell>
+        <div className="flex justify-end">
+          <RevokeApiKeyButton apiKey={apiKey} />
+        </div>
+      </DetailTableCell>
+    </DetailTableRow>
+  )
+}
+
+function ApiKeyTableHeader() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <DetailTableHeader>
+      <DetailTableRow>
+        <DetailTableHead className={API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES.name}>{t('access.api.table.name')}</DetailTableHead>
+        <DetailTableHead className={API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES.environment}>{t('access.api.table.environment')}</DetailTableHead>
+        <DetailTableHead className={API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES.key}>{t('access.api.table.key')}</DetailTableHead>
+        <DetailTableHead className={`${API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES.action} text-right`}>{t('access.api.table.action')}</DetailTableHead>
+      </DetailTableRow>
+    </DetailTableHeader>
+  )
+}
+
+export function ApiKeyList({ apiKeys, environments }: {
+  apiKeys: ApiKey[]
+  environments: Environment[]
+}) {
+  const environmentById = new Map(environments.map(environment => [environment.id, environment]))
+
+  return (
+    <>
+      <DetailTableCardList className={cn('pc:hidden')}>
+        {apiKeys.map(apiKey => (
+          <ApiKeyMobileRow
+            key={apiKey.id}
+            apiKey={apiKey}
+            environment={environmentById.get(apiKey.environmentId)}
+          />
+        ))}
+      </DetailTableCardList>
+      <div className="hidden pc:block">
+        <DetailTable>
+          <ApiKeyTableHeader />
+          <DetailTableBody>
+            {apiKeys.map(apiKey => (
+              <ApiKeyDesktopRow
+                key={apiKey.id}
+                apiKey={apiKey}
+                environment={environmentById.get(apiKey.environmentId)}
+              />
+            ))}
+          </DetailTableBody>
+        </DetailTable>
+      </div>
+    </>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/api-token-name.ts b/web/features/deployments/detail/settings-tab/access/api-token-name.ts
new file mode 100644
index 00000000000..0f494a7a733
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/api-token-name.ts
@@ -0,0 +1,39 @@
+const API_TOKEN_NAME_ADJECTIVES = [
+  'ancient',
+  'autumn',
+  'bright',
+  'calm',
+  'crystal',
+  'gentle',
+  'golden',
+  'hidden',
+  'holy',
+  'quiet',
+  'rapid',
+  'silver',
+]
+
+const API_TOKEN_NAME_NOUNS = [
+  'brook',
+  'cloud',
+  'field',
+  'forest',
+  'harbor',
+  'lake',
+  'meadow',
+  'moon',
+  'river',
+  'stone',
+  'valley',
+  'wave',
+]
+
+function randomListItem(items: string[]) {
+  return items[Math.floor(Math.random() * items.length)]!
+}
+
+export function generateApiTokenName() {
+  const suffix = Math.floor(1000 + Math.random() * 9000)
+
+  return `${randomListItem(API_TOKEN_NAME_ADJECTIVES)}-${randomListItem(API_TOKEN_NAME_NOUNS)}-${suffix}`
+}
diff --git a/web/features/deployments/detail/settings-tab/access/channels-section.tsx b/web/features/deployments/detail/settings-tab/access/channels-section.tsx
new file mode 100644
index 00000000000..d3dde7936a4
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/channels-section.tsx
@@ -0,0 +1,251 @@
+'use client'
+
+import type { AccessChannels, AccessEndpoint } from '@dify/contracts/enterprise/types.gen'
+import type { ReactNode } from 'react'
+import { Switch, SwitchSkeleton } from '@langgenius/dify-ui/switch'
+import { useMutation } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import { consoleQuery } from '@/service/client'
+import { DeploymentEmptyState, DeploymentNoticeState, DeploymentStateMessage } from '../../../components/empty-state'
+import { Section } from '../../common'
+import { CopyPill, EndpointRow } from './common'
+import { getUrlOrigin } from './url'
+
+const ACCESS_CHANNEL_SKELETON_SECTIONS = [
+  { key: 'webapp' },
+  { key: 'cli' },
+]
+
+function AccessChannelsSwitch({ appInstanceId, checked, accessChannels, disabled }: {
+  appInstanceId: string
+  checked: boolean
+  accessChannels?: AccessChannels
+  disabled?: boolean
+}) {
+  const { t } = useTranslation('deployments')
+  const toggleAccessChannel = useMutation(consoleQuery.enterprise.accessService.updateAccessChannels.mutationOptions())
+
+  return (
+    <Switch
+      aria-label={t('access.channels.title')}
+      checked={checked}
+      disabled={disabled}
+      loading={toggleAccessChannel.isPending}
+      onCheckedChange={(enabled) => {
+        toggleAccessChannel.mutate({
+          params: { appInstanceId },
+          body: {
+            appInstanceId,
+            webAppEnabled: enabled,
+            developerApiEnabled: accessChannels?.developerApiEnabled ?? false,
+          },
+        })
+      }}
+    />
+  )
+}
+
+function AccessChannelsSkeleton() {
+  return (
+    <div className="overflow-hidden rounded-lg border border-divider-subtle bg-components-panel-bg">
+      {ACCESS_CHANNEL_SKELETON_SECTIONS.map(section => (
+        <SkeletonRow
+          key={section.key}
+          className="flex flex-col gap-3 border-t border-divider-subtle px-4 py-4 first:border-t-0 lg:flex-row lg:items-start"
+        >
+          <div className="flex min-w-0 gap-2.5 lg:w-70">
+            <SkeletonRectangle className="my-0 size-7 shrink-0 animate-pulse rounded-lg" />
+            <div className="flex min-w-0 flex-col gap-1.5">
+              <SkeletonRectangle className="h-3.5 w-24 animate-pulse" />
+              <SkeletonRectangle className="h-3 w-40 animate-pulse" />
+            </div>
+          </div>
+          <SkeletonRectangle className="my-0 h-8 min-w-0 flex-1 animate-pulse rounded-lg" />
+        </SkeletonRow>
+      ))}
+    </div>
+  )
+}
+
+function ChannelInfo({ icon, title, description }: {
+  icon: ReactNode
+  title: string
+  description?: string
+}) {
+  return (
+    <div className="flex min-w-0 items-start gap-2.5">
+      <span className="mt-0.5 flex size-7 shrink-0 items-center justify-center rounded-lg bg-background-section-burn text-text-tertiary">
+        {icon}
+      </span>
+      <div className="min-w-0">
+        <div className="flex min-w-0 flex-wrap items-center gap-2">
+          <span className="system-sm-medium text-text-primary">{title}</span>
+        </div>
+        {description && (
+          <div className="system-xs-regular text-text-tertiary">{description}</div>
+        )}
+      </div>
+    </div>
+  )
+}
+
+function ChannelRow({ info, children }: {
+  info: ReactNode
+  children: ReactNode
+}) {
+  return (
+    <div className="flex flex-col gap-3 border-t border-divider-subtle px-4 py-4 first:border-t-0 lg:flex-row lg:items-start">
+      <div className="min-w-0 lg:w-70">
+        {info}
+      </div>
+      <div className="min-w-0 flex-1">
+        {children}
+      </div>
+    </div>
+  )
+}
+
+export function AccessChannelsSection({
+  appInstanceId,
+  accessChannels,
+  webAppEndpoints,
+  cliEndpoint,
+  isLoading,
+  isError,
+}: {
+  appInstanceId: string
+  accessChannels?: AccessChannels
+  webAppEndpoints?: AccessEndpoint[]
+  cliEndpoint?: AccessEndpoint
+  isLoading: boolean
+  isError: boolean
+}) {
+  const { t } = useTranslation('deployments')
+  const runEnabled = accessChannels?.webAppEnabled ?? false
+  const webappRows = webAppEndpoints?.flatMap((endpoint) => {
+    const endpointUrl = endpoint.endpointUrl
+    if (!endpointUrl)
+      return []
+
+    return [{
+      endpoint,
+      endpointUrl,
+    }]
+  }) ?? []
+  const cliDomain = getUrlOrigin(cliEndpoint?.endpointUrl)
+  const cliDocsUrl = cliDomain ? `${cliDomain}/cli` : undefined
+
+  return (
+    <Section
+      title={t('access.channels.title')}
+      action={(
+        isLoading
+          ? <SwitchSkeleton />
+          : (
+              <div className="flex items-center gap-2">
+                <span className="system-xs-medium text-text-tertiary">
+                  {runEnabled ? t('overview.enabled') : t('overview.disabled')}
+                </span>
+                <AccessChannelsSwitch
+                  appInstanceId={appInstanceId}
+                  checked={runEnabled}
+                  accessChannels={accessChannels}
+                  disabled={isError}
+                />
+              </div>
+            )
+      )}
+    >
+      {isLoading
+        ? <AccessChannelsSkeleton />
+        : isError
+          ? <DeploymentStateMessage variant="section">{t('common.loadFailed')}</DeploymentStateMessage>
+          : runEnabled
+            ? (
+                <div className="overflow-hidden rounded-lg border border-divider-subtle bg-components-panel-bg">
+                  <ChannelRow
+                    info={(
+                      <ChannelInfo
+                        icon={<span className="i-ri-global-line size-3.5" aria-hidden="true" />}
+                        title={t('access.runAccess.webapp')}
+                        description={t('access.runAccess.webappDesc')}
+                      />
+                    )}
+                  >
+                    {webappRows.length > 0
+                      ? (
+                          <div className="flex flex-col gap-1.5">
+                            {webappRows.map(({ endpoint, endpointUrl }) => (
+                              <EndpointRow
+                                key={`webapp-${endpoint.environment?.id ?? endpointUrl}`}
+                                envName={endpoint.environment?.displayName ?? '—'}
+                                label={t('access.runAccess.urlLabel')}
+                                value={endpointUrl}
+                                openLabel={t('access.runAccess.openWebapp')}
+                              />
+                            ))}
+                          </div>
+                        )
+                      : (
+                          <DeploymentNoticeState>
+                            {t('access.runAccess.webappEmpty')}
+                          </DeploymentNoticeState>
+                        )}
+                  </ChannelRow>
+                  <ChannelRow
+                    info={(
+                      <ChannelInfo
+                        icon={<span className="i-ri-terminal-box-line size-3.5" aria-hidden="true" />}
+                        title={t('access.cli.title')}
+                        description={t('access.cli.description')}
+                      />
+                    )}
+                  >
+                    {cliDomain
+                      ? (
+                          <div className="flex flex-wrap items-center gap-2">
+                            <CopyPill
+                              label={t('access.cli.domain')}
+                              value={cliDomain}
+                              className="min-w-0 flex-1"
+                            />
+                            <a
+                              href={cliDocsUrl}
+                              target="_blank"
+                              rel="noreferrer"
+                              className="inline-flex h-8 shrink-0 items-center gap-1.5 rounded-lg border border-components-button-secondary-border bg-components-button-secondary-bg px-3 system-sm-medium text-components-button-secondary-text hover:bg-components-button-secondary-bg-hover"
+                            >
+                              <span className="i-ri-download-cloud-2-line size-3.5" />
+                              {t('access.cli.install')}
+                            </a>
+                            <a
+                              href={cliDocsUrl}
+                              target="_blank"
+                              rel="noreferrer"
+                              className="inline-flex h-8 shrink-0 items-center gap-1.5 rounded-lg border border-components-button-secondary-border bg-components-button-secondary-bg px-3 system-sm-medium text-components-button-secondary-text hover:bg-components-button-secondary-bg-hover"
+                            >
+                              <span className="i-ri-book-open-line size-3.5" />
+                              {t('access.cli.docs')}
+                            </a>
+                          </div>
+                        )
+                      : (
+                          <DeploymentNoticeState>
+                            {t('access.cli.empty')}
+                          </DeploymentNoticeState>
+                        )}
+                  </ChannelRow>
+                </div>
+              )
+            : (
+                <DeploymentEmptyState
+                  variant="section"
+                  icon="i-ri-toggle-line"
+                  title={t('access.channels.disabled')}
+                  description={t('access.channels.disabledHint')}
+                />
+              )}
+    </Section>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/common.tsx b/web/features/deployments/detail/settings-tab/access/common.tsx
new file mode 100644
index 00000000000..ba1fd405aea
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/common.tsx
@@ -0,0 +1,78 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useClipboard } from 'foxact/use-clipboard'
+import { useTranslation } from 'react-i18next'
+
+type CopyPillProps = {
+  label: string
+  value: string
+  prefix?: ReactNode
+  className?: string
+}
+
+export function CopyPill({ label, value, prefix, className }: CopyPillProps) {
+  const { t } = useTranslation('deployments')
+  const { copied, copy } = useClipboard({
+    onCopyError: () => {
+      toast.error(t('access.copyFailed'))
+    },
+  })
+
+  return (
+    <div
+      className={cn(
+        'flex h-8 items-center gap-1 rounded-lg border border-components-input-border-active bg-components-input-bg-normal pr-1 pl-1.5',
+        className,
+      )}
+    >
+      <div className="flex h-5 shrink-0 items-center rounded-md border border-divider-subtle px-1.5 system-2xs-medium text-text-tertiary">
+        {label}
+      </div>
+      {prefix}
+      <div className="min-w-0 flex-1 truncate px-1 font-mono system-sm-medium text-text-secondary">
+        {value}
+      </div>
+      <div className="h-3.5 w-px shrink-0 bg-divider-regular" />
+      <button
+        type="button"
+        onClick={() => copy(value)}
+        aria-label={t('access.copy')}
+        className="flex size-6 shrink-0 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary"
+      >
+        <span className={cn(copied ? 'i-ri-check-line' : 'i-ri-file-copy-line', 'size-3.5')} />
+      </button>
+    </div>
+  )
+}
+
+type EndpointRowProps = {
+  envName: string
+  label: string
+  value: string
+  openLabel?: string
+}
+
+export function EndpointRow({ envName, label, value, openLabel }: EndpointRowProps) {
+  return (
+    <div className="grid items-center gap-x-3 gap-y-1.5 sm:grid-cols-[minmax(88px,108px)_minmax(0,1fr)_auto]">
+      <span className="min-w-0 truncate system-xs-regular text-text-tertiary">
+        {envName}
+      </span>
+      <CopyPill label={label} value={value} className="min-w-0" />
+      {openLabel && (
+        <a
+          href={value}
+          target="_blank"
+          rel="noreferrer"
+          className="inline-flex h-8 shrink-0 items-center gap-1.5 rounded-lg border border-components-button-secondary-border bg-components-button-secondary-bg px-3 system-sm-medium text-components-button-secondary-text hover:bg-components-button-secondary-bg-hover"
+        >
+          <span className="i-ri-external-link-line size-3.5" />
+          {openLabel}
+        </a>
+      )}
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/developer-api-created-token-dialog.tsx b/web/features/deployments/detail/settings-tab/access/developer-api-created-token-dialog.tsx
new file mode 100644
index 00000000000..3582e53bdcc
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/developer-api-created-token-dialog.tsx
@@ -0,0 +1,97 @@
+'use client'
+
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useClipboard } from 'foxact/use-clipboard'
+import { useTranslation } from 'react-i18next'
+import { CopyPill } from './common'
+
+function buildCurlExample(apiUrl: string, token: string) {
+  return `curl -X POST '${apiUrl}' \\
+--header 'Authorization: Bearer ${token}' \\
+--header 'Content-Type: application/json' \\
+--data-raw '{
+  "inputs": {},
+  "response_mode": "streaming",
+  "user": "abc-123"
+}'`
+}
+
+function CurlExample({ apiUrl, token }: {
+  apiUrl: string
+  token: string
+}) {
+  const { t } = useTranslation('deployments')
+  const curlExample = buildCurlExample(apiUrl, token)
+  const { copied, copy } = useClipboard({
+    onCopyError: () => {
+      toast.error(t('access.copyFailed'))
+    },
+  })
+
+  return (
+    <div className="min-w-0 overflow-hidden rounded-lg border border-components-input-border-active bg-components-input-bg-normal">
+      <div className="flex h-8 items-center justify-between gap-2 border-b border-divider-subtle pr-1.5 pl-3">
+        <div className="min-w-0 truncate system-xs-semibold-uppercase text-text-secondary">
+          {t('access.api.curlExampleTitle')}
+        </div>
+        <button
+          type="button"
+          onClick={() => copy(curlExample)}
+          aria-label={t('access.api.copyCurlExample')}
+          className="flex size-6 shrink-0 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary"
+        >
+          <span className={cn(copied ? 'i-ri-check-line' : 'i-ri-file-copy-line', 'size-3.5')} />
+        </button>
+      </div>
+      <pre className="max-h-40 overflow-auto px-3 py-3 font-mono system-xs-regular whitespace-pre text-text-secondary">
+        <code>{curlExample}</code>
+      </pre>
+    </div>
+  )
+}
+
+export function CreatedApiTokenDialog({ token, apiUrl, onDismiss }: {
+  token: string
+  apiUrl?: string
+  onDismiss: () => void
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <Dialog open={Boolean(token)} onOpenChange={open => !open && onDismiss()} disablePointerDismissal>
+      <DialogContent className="w-120 max-w-[calc(100vw-32px)] overflow-hidden p-0">
+        <DialogCloseButton />
+        <div className="border-b border-divider-subtle px-6 py-5 pr-14">
+          <DialogTitle className="title-xl-semi-bold text-text-primary">
+            {t('access.api.newTokenTitle')}
+          </DialogTitle>
+          <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+            {t('access.api.newTokenDescription')}
+          </DialogDescription>
+        </div>
+
+        <div className="flex flex-col gap-5 px-6 py-5">
+          <CopyPill
+            label={t('access.api.newTokenLabel')}
+            value={token}
+          />
+          {apiUrl && (
+            <CurlExample
+              apiUrl={apiUrl}
+              token={token}
+            />
+          )}
+        </div>
+
+        <div className="flex justify-end border-t border-divider-subtle bg-background-default-subtle px-6 py-4">
+          <Button variant="primary" onClick={onDismiss}>
+            {t('operation.confirm', { ns: 'common' })}
+          </Button>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/developer-api-section.tsx b/web/features/deployments/detail/settings-tab/access/developer-api-section.tsx
new file mode 100644
index 00000000000..23496dc76ad
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/developer-api-section.tsx
@@ -0,0 +1,268 @@
+'use client'
+
+import type {
+  AccessChannels,
+  ApiKey,
+  Environment,
+} from '@dify/contracts/enterprise/types.gen'
+import type { ReactNode } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { Switch, SwitchSkeleton } from '@langgenius/dify-ui/switch'
+import { useMutation, useQuery } from '@tanstack/react-query'
+import { atom, useAtom } from 'jotai'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { DeploymentEmptyState, DeploymentStateMessage } from '../../../components/empty-state'
+import { DeveloperApiDocsDrawer } from './api-docs-drawer'
+import { ApiKeyGenerateMenu } from './api-key-generate-menu'
+import { ApiKeyList } from './api-key-list'
+import { CopyPill } from './common'
+import { CreatedApiTokenDialog } from './developer-api-created-token-dialog'
+import { DeveloperApiSkeleton } from './developer-api-skeleton'
+
+type CreatedApiToken = {
+  appInstanceId: string
+  token: string
+}
+
+const createdApiTokenAtom = atom<CreatedApiToken | undefined>(undefined)
+
+function useDeveloperApiSettings(appInstanceId: string) {
+  const developerApiSettingsQuery = useQuery(consoleQuery.enterprise.accessService.getDeveloperApiSettings.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+  }))
+  const accessChannels = developerApiSettingsQuery.data?.accessChannels
+  const apiEnabled = accessChannels?.developerApiEnabled ?? false
+  const environments = developerApiSettingsQuery.data?.environments ?? []
+  const apiKeys: ApiKey[] = developerApiSettingsQuery.data?.apiKeys ?? []
+  const apiUrl = developerApiSettingsQuery.data?.developerApiUrl.apiUrl
+
+  return {
+    apiEnabled,
+    accessChannels,
+    apiUrl,
+    environments,
+    apiKeys,
+    isLoading: developerApiSettingsQuery.isLoading,
+    isError: developerApiSettingsQuery.isError,
+  }
+}
+
+function DeveloperApiSwitch({ appInstanceId, checked, accessChannels, disabled }: {
+  appInstanceId: string
+  checked: boolean
+  accessChannels?: AccessChannels
+  disabled?: boolean
+}) {
+  const { t } = useTranslation('deployments')
+  const toggleDeveloperAPI = useMutation(consoleQuery.enterprise.accessService.updateAccessChannels.mutationOptions())
+
+  return (
+    <Switch
+      aria-label={t('access.api.developerTitle')}
+      checked={checked}
+      disabled={disabled}
+      loading={toggleDeveloperAPI.isPending}
+      onCheckedChange={(enabled) => {
+        toggleDeveloperAPI.mutate({
+          params: { appInstanceId },
+          body: {
+            appInstanceId,
+            webAppEnabled: accessChannels?.webAppEnabled ?? false,
+            developerApiEnabled: enabled,
+          },
+        })
+      }}
+    />
+  )
+}
+
+export function DeveloperApiHeaderSwitch({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  const { t } = useTranslation('deployments')
+  const {
+    apiEnabled,
+    accessChannels,
+    isLoading,
+    isError,
+  } = useDeveloperApiSettings(appInstanceId)
+
+  if (isLoading)
+    return <SwitchSkeleton />
+
+  return (
+    <div className="flex items-center gap-2">
+      <span className="system-xs-medium text-text-tertiary">
+        {apiEnabled ? t('overview.enabled') : t('overview.disabled')}
+      </span>
+      <DeveloperApiSwitch
+        appInstanceId={appInstanceId}
+        checked={apiEnabled}
+        accessChannels={accessChannels}
+        disabled={isError}
+      />
+    </div>
+  )
+}
+
+function ApiKeyListSection({ apiKeys, environments, action }: {
+  apiKeys: ApiKey[]
+  environments: Environment[]
+  action?: ReactNode
+}) {
+  const { t } = useTranslation('deployments')
+  const hasAction = Boolean(action)
+
+  return (
+    <div className="flex flex-col gap-2">
+      <div className="flex min-w-0 flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
+        <div className="system-xs-semibold-uppercase text-text-tertiary">
+          {t('access.api.keyList')}
+        </div>
+        {hasAction && (
+          <div className="w-full shrink-0 sm:w-auto [&_button]:w-full sm:[&_button]:w-auto">
+            {action}
+          </div>
+        )}
+      </div>
+      <ApiKeyList
+        apiKeys={apiKeys}
+        environments={environments}
+      />
+    </div>
+  )
+}
+
+function DeveloperApiEndpoint({ appInstanceId, apiUrl }: {
+  appInstanceId: string
+  apiUrl: string
+}) {
+  const { t } = useTranslation('deployments')
+  const [apiDocsOpen, setApiDocsOpen] = useState(false)
+
+  return (
+    <div className="flex min-w-0 flex-col gap-2 sm:flex-row sm:items-center">
+      <CopyPill
+        label={t('access.api.endpoint')}
+        value={apiUrl}
+        className="min-w-0 flex-1"
+      />
+      <Button
+        variant="secondary"
+        className="shrink-0 gap-1.5"
+        onClick={() => setApiDocsOpen(true)}
+      >
+        <span className="i-ri-file-list-3-line size-3.5" />
+        {t('access.api.docs')}
+      </Button>
+      <DeveloperApiDocsDrawer
+        open={apiDocsOpen}
+        appInstanceId={appInstanceId}
+        apiBaseUrl={apiUrl}
+        onOpenChange={setApiDocsOpen}
+      />
+    </div>
+  )
+}
+
+export function DeveloperApiSection({
+  appInstanceId,
+}: {
+  appInstanceId: string
+}) {
+  const { t } = useTranslation('deployments')
+  const [createdApiToken, setCreatedApiToken] = useAtom(createdApiTokenAtom)
+  const {
+    apiEnabled,
+    apiUrl,
+    apiKeys,
+    environments,
+    isLoading,
+    isError,
+  } = useDeveloperApiSettings(appInstanceId)
+  const visibleCreatedApiToken = createdApiToken?.appInstanceId === appInstanceId
+    ? createdApiToken.token
+    : undefined
+  const hasSelectableEnvironment = environments.some(environment => Boolean(environment.id))
+
+  if (isLoading)
+    return <DeveloperApiSkeleton />
+
+  if (isError)
+    return <DeploymentStateMessage variant="section">{t('common.loadFailed')}</DeploymentStateMessage>
+
+  if (!apiEnabled) {
+    return (
+      <DeploymentEmptyState
+        variant="section"
+        icon="i-ri-toggle-line"
+        title={t('access.api.disabled')}
+        description={t('access.api.disabledHint')}
+      />
+    )
+  }
+
+  return (
+    <div className="flex flex-col gap-4">
+      {apiUrl && (
+        <DeveloperApiEndpoint
+          appInstanceId={appInstanceId}
+          apiUrl={apiUrl}
+        />
+      )}
+      {hasSelectableEnvironment
+        ? (
+            <ApiKeyGenerateMenu
+              appInstanceId={appInstanceId}
+              environments={environments}
+              triggerVariant="primary"
+              onCreatedToken={token => setCreatedApiToken({ appInstanceId, token })}
+            >
+              {({ trigger }) => apiKeys.length === 0
+                ? (
+                    <DeploymentEmptyState
+                      variant="section"
+                      icon="i-ri-key-2-line"
+                      title={t('access.api.noKeysTitle')}
+                      description={t('access.api.noKeys')}
+                      action={trigger}
+                    />
+                  )
+                : (
+                    <ApiKeyListSection
+                      apiKeys={apiKeys}
+                      environments={environments}
+                      action={trigger}
+                    />
+                  )}
+            </ApiKeyGenerateMenu>
+          )
+        : apiKeys.length === 0
+          ? (
+              <DeploymentEmptyState
+                variant="section"
+                icon="i-ri-rocket-line"
+                title={t('access.api.emptyTitle')}
+                description={t('access.api.empty')}
+              />
+            )
+          : (
+              <ApiKeyListSection
+                apiKeys={apiKeys}
+                environments={environments}
+              />
+            )}
+      {visibleCreatedApiToken && (
+        <CreatedApiTokenDialog
+          token={visibleCreatedApiToken}
+          apiUrl={apiUrl}
+          onDismiss={() => setCreatedApiToken(undefined)}
+        />
+      )}
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/developer-api-skeleton.tsx b/web/features/deployments/detail/settings-tab/access/developer-api-skeleton.tsx
new file mode 100644
index 00000000000..ab1b92ff63f
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/developer-api-skeleton.tsx
@@ -0,0 +1,112 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+import {
+  DetailTable,
+  DetailTableBody,
+  DetailTableCard,
+  DetailTableCardList,
+  DetailTableCell,
+  DetailTableHead,
+  DetailTableHeader,
+  DetailTableRow,
+} from '../../table'
+import { API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES } from '../../table-styles'
+
+const DEVELOPER_API_KEY_SKELETON_KEYS = ['primary-key', 'secondary-key']
+
+export function DeveloperApiSkeleton() {
+  return (
+    <div className="flex flex-col gap-4" data-slot="deployment-developer-api-skeleton">
+      <ApiUrlSkeleton />
+      <ApiKeyTableSkeleton />
+    </div>
+  )
+}
+
+function ApiUrlSkeleton() {
+  return (
+    <div
+      className="flex h-8 items-center gap-1 rounded-lg border border-components-input-border-active bg-components-input-bg-normal pr-1 pl-1.5"
+      data-slot="deployment-developer-api-url-skeleton"
+    >
+      <SkeletonRectangle className="my-0 h-5 w-16 shrink-0 animate-pulse rounded-md" />
+      <SkeletonRectangle className="my-0 h-4 min-w-0 flex-1 animate-pulse" />
+      <div className="h-3.5 w-px shrink-0 bg-divider-regular" />
+      <SkeletonRectangle className="my-0 size-6 shrink-0 animate-pulse rounded-md" />
+    </div>
+  )
+}
+
+function ApiKeyTableSkeleton() {
+  return (
+    <>
+      <DetailTableCardList className="pc:hidden">
+        {DEVELOPER_API_KEY_SKELETON_KEYS.map(key => (
+          <DetailTableCard key={key} data-slot="deployment-developer-api-mobile-row-skeleton">
+            <div className="flex flex-col gap-3 p-4">
+              <div className="flex items-start justify-between gap-3">
+                <div className="min-w-0">
+                  <SkeletonRectangle className="my-0 h-3.5 w-32 animate-pulse" />
+                  <SkeletonRectangle className="mt-2 h-5 w-20 animate-pulse rounded-md" />
+                </div>
+                <SkeletonRectangle className="my-0 size-8 shrink-0 animate-pulse rounded-md" />
+              </div>
+              <div className="flex min-w-0 flex-col gap-1">
+                <SkeletonRectangle className="my-0 h-2.5 w-14 animate-pulse" />
+                <SkeletonRectangle className="my-0 h-8 w-full animate-pulse rounded-lg" />
+              </div>
+            </div>
+          </DetailTableCard>
+        ))}
+      </DetailTableCardList>
+      <div className="hidden pc:block">
+        <DetailTable>
+          <ApiKeyTableHeaderSkeleton />
+          <DetailTableBody>
+            {DEVELOPER_API_KEY_SKELETON_KEYS.map(key => (
+              <ApiKeyDesktopRowSkeleton key={key} />
+            ))}
+          </DetailTableBody>
+        </DetailTable>
+      </div>
+    </>
+  )
+}
+
+function ApiKeyTableHeaderSkeleton() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <DetailTableHeader>
+      <DetailTableRow>
+        <DetailTableHead className={API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES.name}>{t('access.api.table.name')}</DetailTableHead>
+        <DetailTableHead className={API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES.environment}>{t('access.api.table.environment')}</DetailTableHead>
+        <DetailTableHead className={API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES.key}>{t('access.api.table.key')}</DetailTableHead>
+        <DetailTableHead className={`${API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES.action} text-right`}>{t('access.api.table.action')}</DetailTableHead>
+      </DetailTableRow>
+    </DetailTableHeader>
+  )
+}
+
+function ApiKeyDesktopRowSkeleton() {
+  return (
+    <DetailTableRow data-slot="deployment-developer-api-desktop-row-skeleton">
+      <DetailTableCell>
+        <SkeletonRectangle className="my-0 h-3.5 w-32 animate-pulse" />
+      </DetailTableCell>
+      <DetailTableCell>
+        <SkeletonRectangle className="my-0 h-5 w-20 animate-pulse rounded-md" />
+      </DetailTableCell>
+      <DetailTableCell>
+        <SkeletonRectangle className="my-0 h-8 w-full animate-pulse rounded-lg" />
+      </DetailTableCell>
+      <DetailTableCell>
+        <div className="flex justify-end">
+          <SkeletonRectangle className="my-0 size-8 animate-pulse rounded-md" />
+        </div>
+      </DetailTableCell>
+    </DetailTableRow>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/permission-row-components.tsx b/web/features/deployments/detail/settings-tab/access/permission-row-components.tsx
new file mode 100644
index 00000000000..25913c33543
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/permission-row-components.tsx
@@ -0,0 +1,163 @@
+'use client'
+
+import type {
+  AccessPermissionKind,
+  SelectableAccessSubject,
+} from './access-policy'
+import type { AccessSubjectSelectionValue } from '@/app/components/app/app-access-control/access-subject-selector/types'
+import type { AccessControlDraft } from '@/app/components/app/app-access-control/store'
+import { SubjectType } from '@dify/contracts/enterprise/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+import { AccessControlDialog } from '@/app/components/app/app-access-control/access-control-dialog'
+import { AccessControlDialogContent } from '@/app/components/app/app-access-control/access-control-dialog-content'
+import { useAccessControlStore } from '@/app/components/app/app-access-control/store'
+import { AccessControlDraftProvider } from '@/app/components/app/app-access-control/store-provider'
+import { AccessMode as AppAccessMode } from '@/models/access-control'
+import {
+  appAccessModeToPermissionKey,
+  permissionIcon,
+} from './access-policy'
+
+export function PermissionSummaryButton({
+  value,
+  subjects,
+  disabled,
+  loading,
+  environmentLabel,
+  onClick,
+}: {
+  value: AccessPermissionKind
+  subjects?: SelectableAccessSubject[]
+  disabled?: boolean
+  loading?: boolean
+  environmentLabel: string
+  onClick: () => void
+}) {
+  const { t } = useTranslation('deployments')
+  const groupCount = subjects?.filter(subject => subject.subjectType === SubjectType.SUBJECT_TYPE_GROUP).length ?? 0
+  const memberCount = (subjects?.length ?? 0) - groupCount
+  const countLabels = [
+    ...(groupCount > 0 ? [t('access.members.groupCount', { count: groupCount })] : []),
+    ...(memberCount > 0 ? [t('access.members.memberCount', { count: memberCount })] : []),
+  ]
+  const specificSubjectLabel = value === 'specific'
+    ? subjects && subjects.length > 0
+      ? countLabels.join(' · ')
+      : t('access.permission.specificDesc')
+    : undefined
+  const IconClassName = loading ? 'i-ri-loader-2-line animate-spin motion-reduce:animate-none' : permissionIcon[value]
+
+  return (
+    <button
+      type="button"
+      disabled={disabled}
+      aria-label={t('access.permissions.editAriaLabel', { environment: environmentLabel })}
+      onClick={onClick}
+      className={cn(
+        'flex h-9 w-full min-w-0 cursor-pointer items-center gap-x-0.5 rounded-lg bg-components-input-bg-normal py-1 pr-2 pl-2.5 outline-hidden hover:bg-state-base-hover-alt focus-visible:bg-state-base-hover-alt focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:ring-inset',
+        disabled && 'cursor-not-allowed opacity-50 hover:bg-components-input-bg-normal',
+      )}
+    >
+      <div className="flex min-w-0 grow items-center gap-x-1.5 pr-1">
+        <span
+          className={cn(IconClassName, 'size-4 shrink-0 text-text-secondary')}
+          aria-hidden="true"
+        />
+        <p className="min-w-0 truncate text-left system-sm-medium text-text-secondary">
+          {t(`access.permission.${value}`)}
+        </p>
+      </div>
+      {specificSubjectLabel && (
+        <p className="shrink-0 system-xs-regular text-text-tertiary">
+          {specificSubjectLabel}
+        </p>
+      )}
+      <div className="flex size-4 shrink-0 items-center justify-center">
+        <span className="i-ri-arrow-right-s-line size-4 text-text-quaternary" aria-hidden="true" />
+      </div>
+    </button>
+  )
+}
+
+export function DeploymentAccessControlDialog({
+  initialDraft,
+  subjectsLoading,
+  saving,
+  onClose,
+  onSubmit,
+}: {
+  initialDraft: AccessControlDraft
+  subjectsLoading?: boolean
+  saving?: boolean
+  onClose: () => void
+  onSubmit: (kind: AccessPermissionKind, subjects: AccessSubjectSelectionValue) => void
+}) {
+  const draftKey = [
+    initialDraft.currentMenu,
+    initialDraft.specificGroups ? initialDraft.specificGroups.map(group => group.id).join(',') : 'no-groups',
+    initialDraft.specificMembers ? initialDraft.specificMembers.map(member => member.id).join(',') : 'no-members',
+  ].join(':')
+
+  return (
+    <AccessControlDraftProvider draftKey={draftKey} initialDraft={initialDraft}>
+      <DeploymentAccessControlDialogBody
+        subjectsLoading={subjectsLoading}
+        saving={saving}
+        onClose={onClose}
+        onSubmit={onSubmit}
+      />
+    </AccessControlDraftProvider>
+  )
+}
+
+function DeploymentAccessControlDialogBody({
+  subjectsLoading,
+  saving,
+  onClose,
+  onSubmit,
+}: {
+  subjectsLoading?: boolean
+  saving?: boolean
+  onClose: () => void
+  onSubmit: (kind: AccessPermissionKind, subjects: AccessSubjectSelectionValue) => void
+}) {
+  const { t } = useTranslation('deployments')
+  const currentMenu = useAccessControlStore(s => s.currentMenu)
+  const specificGroups = useAccessControlStore(s => s.specificGroups)
+  const specificMembers = useAccessControlStore(s => s.specificMembers)
+  const specificSelected = currentMenu === AppAccessMode.SPECIFIC_GROUPS_MEMBERS
+  const selectedSubjectCount = specificGroups.length + specificMembers.length
+  const specificEmpty = specificSelected && selectedSubjectCount === 0
+  const confirmDisabled = saving || (specificSelected && (subjectsLoading || specificEmpty))
+
+  const handleConfirm = () => {
+    if (confirmDisabled)
+      return
+
+    onSubmit(
+      appAccessModeToPermissionKey(currentMenu),
+      specificSelected
+        ? { groups: specificGroups, members: specificMembers }
+        : { groups: [], members: [] },
+    )
+  }
+
+  return (
+    <AccessControlDialog show onClose={onClose}>
+      <AccessControlDialogContent
+        title={t('access.permissions.editTitle')}
+        description={t('access.permissions.editDescription')}
+        hideExternal
+        saving={saving}
+        controlsDisabled={saving || subjectsLoading}
+        confirmDisabled={confirmDisabled}
+        specificGroupsOrMembersProps={{
+          loading: subjectsLoading,
+        }}
+        onClose={onClose}
+        onConfirm={handleConfirm}
+      />
+    </AccessControlDialog>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/permissions-section.tsx b/web/features/deployments/detail/settings-tab/access/permissions-section.tsx
new file mode 100644
index 00000000000..52d83c55e63
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/permissions-section.tsx
@@ -0,0 +1,75 @@
+'use client'
+
+import type { EnvironmentAccessPolicy } from '@dify/contracts/enterprise/types.gen'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+import { DeploymentEmptyState, DeploymentStateMessage } from '../../../components/empty-state'
+import { Section } from '../../common'
+import { EnvironmentPermissionRow } from './permissions'
+
+const ACCESS_PERMISSIONS_SKELETON_KEYS = ['production', 'staging', 'development']
+
+function AccessPermissionsSkeleton() {
+  return (
+    <div className="flex min-w-0 flex-col">
+      {ACCESS_PERMISSIONS_SKELETON_KEYS.map(key => (
+        <div key={key} className="flex min-w-0 flex-col gap-2 border-b border-divider-subtle py-4 first:pt-0 last:border-b-0 last:pb-0">
+          <SkeletonRectangle className="h-4 w-32 animate-pulse" />
+          <SkeletonRectangle className="my-0 h-8 w-full animate-pulse rounded-lg" />
+        </div>
+      ))}
+    </div>
+  )
+}
+
+export function AccessPermissionsSection({
+  appInstanceId,
+  environmentPolicies,
+  isLoading,
+  isError,
+}: {
+  appInstanceId: string
+  environmentPolicies?: EnvironmentAccessPolicy[]
+  isLoading: boolean
+  isError: boolean
+}) {
+  const { t } = useTranslation('deployments')
+  const policyRows = environmentPolicies ?? []
+
+  return (
+    <Section
+      title={t('access.permissions.title')}
+      showDivider={false}
+    >
+      {isLoading
+        ? <AccessPermissionsSkeleton />
+        : isError
+          ? <DeploymentStateMessage variant="section">{t('common.loadFailed')}</DeploymentStateMessage>
+          : policyRows.length === 0
+            ? (
+                <DeploymentEmptyState
+                  variant="section"
+                  icon="i-ri-rocket-line"
+                  title={t('access.runAccess.noEnvsTitle')}
+                  description={t('access.runAccess.noEnvs')}
+                />
+              )
+            : (
+                <div className="flex min-w-0 flex-col">
+                  {policyRows.map((environmentPolicy) => {
+                    const environment = environmentPolicy.environment
+                    return (
+                      <EnvironmentPermissionRow
+                        key={environment.id}
+                        appInstanceId={appInstanceId}
+                        environment={environment}
+                        summaryPolicy={environmentPolicy.policy}
+                        resolvedSubjects={environmentPolicy.resolvedSubjects}
+                      />
+                    )
+                  })}
+                </div>
+              )}
+    </Section>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/permissions.tsx b/web/features/deployments/detail/settings-tab/access/permissions.tsx
new file mode 100644
index 00000000000..1ae3f4e0653
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/permissions.tsx
@@ -0,0 +1,205 @@
+'use client'
+
+import type {
+  AccessPolicy,
+  Environment,
+  Subject,
+} from '@dify/contracts/enterprise/types.gen'
+import type {
+  AccessPermissionKind,
+  SelectableAccessSubject,
+} from './access-policy'
+import type { AccessSubjectSelectionValue } from '@/app/components/app/app-access-control/access-subject-selector/types'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import {
+  accessControlSelectionFromSubjects,
+  accessModeToPermissionKey,
+  normalizeResolvedSubject,
+  permissionKeyToAccessMode,
+  permissionKeyToAppAccessMode,
+  policySubjects,
+  selectedSubjectsFromPolicy,
+  subjectsFromAccessControlSelection,
+} from './access-policy'
+import {
+  DeploymentAccessControlDialog,
+  PermissionSummaryButton,
+} from './permission-row-components'
+
+type EnvironmentPermissionRowProps = {
+  appInstanceId: string
+  disabled?: boolean
+  environment: Environment
+  summaryPolicy?: AccessPolicy
+  resolvedSubjects?: Subject[]
+}
+
+export function EnvironmentPermissionRow({
+  appInstanceId,
+  disabled,
+  environment,
+  summaryPolicy,
+  resolvedSubjects = [],
+}: EnvironmentPermissionRowProps) {
+  const { t } = useTranslation('deployments')
+  const environmentId = environment.id
+  const setEnvironmentAccessPolicy = useMutation(consoleQuery.enterprise.accessService.updateAccessPolicy.mutationOptions())
+  const policy = summaryPolicy
+  const policyKind = accessModeToPermissionKey(policy?.mode)
+  const policyFingerprint = policy
+    ? `${policy.mode}:${policy.subjects.map(subject => `${subject.subjectType}:${subject.subjectId}`).join(',')}`
+    : 'no-policy'
+  const [draft, setDraft] = useState<{
+    fingerprint?: string
+    kind?: AccessPermissionKind
+    subjects?: SelectableAccessSubject[]
+  }>({})
+  const subjectLabelCandidates = [
+    ...(draft.subjects ?? []),
+    ...resolvedSubjects
+      .flatMap((subject) => {
+        const normalizedSubject = normalizeResolvedSubject(subject)
+        return normalizedSubject ? [normalizedSubject] : []
+      }),
+  ]
+  const hasDraft = draft.fingerprint === policyFingerprint
+  const permissionKind = hasDraft && draft.kind ? draft.kind : policyKind
+  const policySelectedSubjects = policyKind === 'specific' ? selectedSubjectsFromPolicy(policy, subjectLabelCandidates) : []
+  const subjects = hasDraft && draft.subjects ? draft.subjects : policySelectedSubjects
+  const subjectSelection = accessControlSelectionFromSubjects(subjects)
+  const isSaving = setEnvironmentAccessPolicy.isPending
+  const controlsDisabled = disabled || isSaving
+  const envName = environment.displayName
+
+  const persistPolicy = (
+    nextKind: AccessPermissionKind,
+    nextSubjects: SelectableAccessSubject[],
+    options?: {
+      onSuccess?: () => void
+    },
+  ) => {
+    if (nextKind === 'specific' && nextSubjects.length === 0)
+      return false
+
+    setEnvironmentAccessPolicy.mutate(
+      {
+        params: {
+          appInstanceId,
+          environmentId,
+        },
+        body: {
+          appInstanceId,
+          environmentId,
+          mode: permissionKeyToAccessMode(nextKind),
+          subjects: nextKind === 'specific' ? policySubjects(nextSubjects) : [],
+        },
+      },
+      {
+        onSuccess: options?.onSuccess,
+        onError: () => {
+          toast.error(t('access.permission.updateFailed'))
+        },
+      },
+    )
+    return true
+  }
+
+  const handlePermissionSubmit = (
+    nextKind: AccessPermissionKind,
+    nextSelection: AccessSubjectSelectionValue,
+    options?: {
+      onSuccess?: () => void
+    },
+  ) => {
+    const normalizedSubjects = nextKind === 'specific' ? subjectsFromAccessControlSelection(nextSelection) : []
+    persistPolicy(nextKind, normalizedSubjects, {
+      onSuccess: () => {
+        setDraft({
+          fingerprint: policyFingerprint,
+          kind: nextKind,
+          subjects: normalizedSubjects,
+        })
+        options?.onSuccess?.()
+      },
+    })
+  }
+
+  return (
+    <div className="flex min-w-0 flex-col gap-2 border-b border-divider-subtle py-4 first:pt-0 last:border-b-0 last:pb-0">
+      <div className="flex min-w-0 items-center">
+        <span className="min-w-0 truncate system-sm-regular text-text-primary">
+          {envName}
+        </span>
+      </div>
+      <EnvironmentPermissionEditor
+        permissionKind={permissionKind}
+        subjectSelection={subjectSelection}
+        subjects={subjects}
+        disabled={controlsDisabled}
+        environmentLabel={envName}
+        saving={isSaving}
+        onSubmit={handlePermissionSubmit}
+      />
+    </div>
+  )
+}
+
+function EnvironmentPermissionEditor({
+  permissionKind,
+  subjectSelection,
+  subjects,
+  disabled,
+  environmentLabel,
+  saving,
+  onSubmit,
+}: {
+  permissionKind: AccessPermissionKind
+  subjectSelection: AccessSubjectSelectionValue
+  subjects: SelectableAccessSubject[]
+  disabled?: boolean
+  environmentLabel: string
+  saving?: boolean
+  onSubmit: (
+    nextKind: AccessPermissionKind,
+    nextSelection: AccessSubjectSelectionValue,
+    options?: { onSuccess?: () => void },
+  ) => void
+}) {
+  const [dialogOpen, setDialogOpen] = useState(false)
+
+  const handleSubmit = (nextKind: AccessPermissionKind, nextSelection: AccessSubjectSelectionValue) => {
+    onSubmit(nextKind, nextSelection, {
+      onSuccess: () => setDialogOpen(false),
+    })
+  }
+
+  return (
+    <>
+      <PermissionSummaryButton
+        value={permissionKind}
+        subjects={subjects}
+        disabled={disabled}
+        loading={saving}
+        environmentLabel={environmentLabel}
+        onClick={() => setDialogOpen(true)}
+      />
+      {dialogOpen && (
+        <DeploymentAccessControlDialog
+          initialDraft={{
+            currentMenu: permissionKeyToAppAccessMode(permissionKind),
+            specificGroups: subjectSelection.groups,
+            specificMembers: subjectSelection.members,
+            selectedGroupsForBreadcrumb: [],
+          }}
+          saving={saving}
+          onClose={() => setDialogOpen(false)}
+          onSubmit={handleSubmit}
+        />
+      )}
+    </>
+  )
+}
diff --git a/web/features/deployments/detail/settings-tab/access/url.ts b/web/features/deployments/detail/settings-tab/access/url.ts
new file mode 100644
index 00000000000..fe703043087
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/url.ts
@@ -0,0 +1,10 @@
+export function getUrlOrigin(url?: string) {
+  if (!url)
+    return undefined
+  try {
+    return new URL(url).origin
+  }
+  catch {
+    return url
+  }
+}
diff --git a/web/features/deployments/detail/table-styles.ts b/web/features/deployments/detail/table-styles.ts
new file mode 100644
index 00000000000..e9ca904168b
--- /dev/null
+++ b/web/features/deployments/detail/table-styles.ts
@@ -0,0 +1,31 @@
+import { cn } from '@langgenius/dify-ui/cn'
+
+export const DEPLOYMENT_DETAIL_TABLE_COLUMN_CLASS_NAMES = {
+  actions: 'w-14 py-1.5 whitespace-nowrap',
+  currentRelease: '',
+  environment: 'whitespace-nowrap',
+  status: 'whitespace-nowrap',
+}
+
+export const RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES = {
+  action: 'w-14 py-1.5 whitespace-nowrap',
+  author: 'whitespace-nowrap',
+  createdAt: 'whitespace-nowrap',
+  deployedTo: '',
+  release: 'whitespace-nowrap',
+  sourceApp: 'whitespace-nowrap',
+}
+
+export const API_KEY_DETAIL_TABLE_COLUMN_CLASS_NAMES = {
+  action: 'w-16 py-1.5 whitespace-nowrap',
+  environment: 'whitespace-nowrap',
+  key: '',
+  name: 'whitespace-nowrap',
+}
+
+export const DETAIL_TABLE_ACTION_TRIGGER_CLASS_NAME = cn(
+  'inline-flex size-8 items-center justify-center rounded-md text-text-tertiary outline-hidden',
+  'hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid',
+  'data-popup-open:bg-state-base-hover data-popup-open:text-text-secondary',
+  'disabled:cursor-not-allowed disabled:opacity-50',
+)
diff --git a/web/features/deployments/detail/table.tsx b/web/features/deployments/detail/table.tsx
new file mode 100644
index 00000000000..eef2e5ee80d
--- /dev/null
+++ b/web/features/deployments/detail/table.tsx
@@ -0,0 +1,91 @@
+import type { ComponentProps } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+
+type DetailTableProps = ComponentProps<'table'> & {
+  containerClassName?: string
+}
+
+export function DetailTable({ className, containerClassName, ...props }: DetailTableProps) {
+  return (
+    <div
+      data-slot="deployment-detail-table-container"
+      className={cn('relative w-full min-w-0 pc:overflow-x-auto', containerClassName)}
+    >
+      <table
+        data-slot="deployment-detail-table"
+        className={cn('w-full max-w-full min-w-[700px] border-collapse border-0 text-sm', className)}
+        {...props}
+      />
+    </div>
+  )
+}
+
+export function DetailTableHeader({ className, ...props }: ComponentProps<'thead'>) {
+  return (
+    <thead
+      data-slot="deployment-detail-table-header"
+      className={cn('h-8 border-b border-divider-subtle system-xs-medium-uppercase text-text-tertiary [&_tr]:border-b-0 [&_tr]:hover:bg-transparent', className)}
+      {...props}
+    />
+  )
+}
+
+export function DetailTableBody({ className, ...props }: ComponentProps<'tbody'>) {
+  return (
+    <tbody
+      data-slot="deployment-detail-table-body"
+      className={cn('system-sm-regular text-text-secondary', className)}
+      {...props}
+    />
+  )
+}
+
+export function DetailTableRow({ className, ...props }: ComponentProps<'tr'>) {
+  return (
+    <tr
+      data-slot="deployment-detail-table-row"
+      className={cn('h-8 border-b border-divider-subtle transition-colors hover:bg-background-default-hover', className)}
+      {...props}
+    />
+  )
+}
+
+export function DetailTableHead({ className, ...props }: ComponentProps<'th'>) {
+  return (
+    <th
+      data-slot="deployment-detail-table-head"
+      className={cn(className, 'box-border max-w-[200px] px-2.5 py-0 text-left align-middle font-medium whitespace-nowrap first:pl-3')}
+      {...props}
+    />
+  )
+}
+
+export function DetailTableCell({ className, ...props }: ComponentProps<'td'>) {
+  return (
+    <td
+      data-slot="deployment-detail-table-cell"
+      className={cn(className, 'box-border max-w-[200px] px-2.5 py-[5px] align-middle first:pl-3')}
+      {...props}
+    />
+  )
+}
+
+export function DetailTableCardList({ className, ...props }: ComponentProps<'div'>) {
+  return (
+    <div
+      data-slot="deployment-detail-table-card-list"
+      className={cn('overflow-hidden rounded-lg border border-divider-subtle bg-background-default', className)}
+      {...props}
+    />
+  )
+}
+
+export function DetailTableCard({ className, ...props }: ComponentProps<'div'>) {
+  return (
+    <div
+      data-slot="deployment-detail-table-card"
+      className={cn('border-b border-divider-subtle last:border-b-0 hover:bg-background-default-hover', className)}
+      {...props}
+    />
+  )
+}
diff --git a/web/features/deployments/detail/tabs.ts b/web/features/deployments/detail/tabs.ts
new file mode 100644
index 00000000000..59820e9ca39
--- /dev/null
+++ b/web/features/deployments/detail/tabs.ts
@@ -0,0 +1,9 @@
+export const INSTANCE_DETAIL_TAB_KEYS = ['overview', 'instances', 'releases', 'access', 'api-tokens'] as const
+
+export type InstanceDetailTabKey = typeof INSTANCE_DETAIL_TAB_KEYS[number]
+
+const INSTANCE_DETAIL_TAB_KEY_SET = new Set<string>(INSTANCE_DETAIL_TAB_KEYS)
+
+export function isInstanceDetailTabKey(value?: string): value is InstanceDetailTabKey {
+  return value != null && INSTANCE_DETAIL_TAB_KEY_SET.has(value)
+}
diff --git a/web/features/deployments/detail/versions-tab.tsx b/web/features/deployments/detail/versions-tab.tsx
new file mode 100644
index 00000000000..b58752711c4
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab.tsx
@@ -0,0 +1,12 @@
+'use client'
+import { ReleaseHistoryTable } from './versions-tab/release-history-table'
+
+export function VersionsTab({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  return (
+    <div className="flex w-full min-w-0 flex-col gap-4 px-6 py-6">
+      <ReleaseHistoryTable appInstanceId={appInstanceId} />
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/versions-tab/__tests__/deploy-release-menu.spec.tsx b/web/features/deployments/detail/versions-tab/__tests__/deploy-release-menu.spec.tsx
new file mode 100644
index 00000000000..7692cd3ad39
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/__tests__/deploy-release-menu.spec.tsx
@@ -0,0 +1,104 @@
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import { ReleaseSource } from '@dify/contracts/enterprise/types.gen'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import { DeployReleaseMenu } from '../deploy-release-menu'
+
+const mockUseQuery = vi.hoisted(() => vi.fn())
+const mockUseMutation = vi.hoisted(() => vi.fn())
+const mockDeleteRelease = vi.fn()
+
+vi.mock('@langgenius/dify-ui/dropdown-menu', () => import('@/__mocks__/base-ui-dropdown-menu'))
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useQuery: (...args: unknown[]) => mockUseQuery(...args),
+    useMutation: (...args: unknown[]) => mockUseMutation(...args),
+  }
+})
+
+vi.mock('../edit-release-dialog', () => ({
+  EditReleaseDialog: () => null,
+}))
+
+vi.mock('../delete-release-dialog', () => ({
+  DeleteReleaseDialog: ({ open }: { open: boolean }) => open ? <div role="dialog">delete confirm</div> : null,
+}))
+
+vi.mock('../release-dsl-export', () => ({
+  exportReleaseDsl: vi.fn(),
+}))
+
+function createRelease(): Release {
+  return {
+    id: 'release-1',
+    appInstanceId: 'app-instance-1',
+    displayName: 'Release 1',
+    description: '',
+    source: ReleaseSource.RELEASE_SOURCE_UPLOAD,
+    gateCommitId: 'commit-1',
+    requiredSlots: [],
+    createdBy: {
+      id: 'account-1',
+      displayName: 'Dify Admin',
+    },
+    createdAt: '2026-01-01T00:00:00.000Z',
+  }
+}
+
+function environmentDeploymentsErrorResult() {
+  return {
+    isError: true,
+    isLoading: false,
+    data: undefined,
+  }
+}
+
+function appInstanceResult() {
+  return {
+    data: {
+      appInstance: {
+        displayName: 'Deployment 1',
+      },
+    },
+  }
+}
+
+describe('DeployReleaseMenu', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUseQuery.mockImplementation(() => {
+      return mockUseQuery.mock.calls.length % 2 === 1
+        ? environmentDeploymentsErrorResult()
+        : appInstanceResult()
+    })
+    mockUseMutation.mockReturnValue({
+      isPending: false,
+      mutate: mockDeleteRelease,
+    })
+  })
+
+  it('should disable release deletion when deployment usage cannot be checked', () => {
+    const release = createRelease()
+
+    render(
+      <DeployReleaseMenu
+        appInstanceId="app-instance-1"
+        releaseId={release.id}
+        releaseRows={[release]}
+      />,
+    )
+
+    fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+    const deleteItem = screen.getByRole('menuitem', { name: 'deployments.versions.deleteRelease' })
+
+    expect(deleteItem).toHaveAttribute('aria-disabled', 'true')
+
+    fireEvent.click(deleteItem)
+
+    expect(screen.queryByText('delete confirm')).not.toBeInTheDocument()
+    expect(mockDeleteRelease).not.toHaveBeenCalled()
+  })
+})
diff --git a/web/features/deployments/detail/versions-tab/__tests__/release-history-rows.spec.tsx b/web/features/deployments/detail/versions-tab/__tests__/release-history-rows.spec.tsx
new file mode 100644
index 00000000000..30f71655110
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/__tests__/release-history-rows.spec.tsx
@@ -0,0 +1,85 @@
+import type { ReleaseWithSummaryDeployments } from '../release-deployments'
+import { ReleaseSource, RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+import { render, within } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import { ReleaseHistoryRows } from '../release-history-rows'
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useQuery: () => ({ data: undefined }),
+  }
+})
+
+vi.mock('../deploy-release-menu', () => ({
+  DeployReleaseMenu: () => <button type="button">Actions</button>,
+}))
+
+function createReleaseRow(overrides: Partial<ReleaseWithSummaryDeployments> = {}): ReleaseWithSummaryDeployments {
+  return {
+    id: 'release-1',
+    appInstanceId: 'app-instance-1',
+    displayName: 'Initial Release',
+    description: '',
+    source: ReleaseSource.RELEASE_SOURCE_UPLOAD,
+    gateCommitId: '2f414f18abcdef',
+    requiredSlots: [],
+    createdBy: {
+      id: 'account-1',
+      displayName: 'Dify Admin',
+    },
+    createdAt: '2026-01-01T00:00:00.000Z',
+    summaryDeployments: [],
+    ...overrides,
+  } as ReleaseWithSummaryDeployments
+}
+
+describe('ReleaseHistoryRows', () => {
+  it('should render the desktop release list with the knowledge table style', () => {
+    const { container } = render(
+      <ReleaseHistoryRows
+        appInstanceId="app-instance-1"
+        releaseRows={[createReleaseRow()]}
+      />,
+    )
+
+    const table = container.querySelector('table')
+    const tableScope = within(table!)
+    const header = table!.querySelector('thead')
+    const headerCell = table!.querySelector('th')
+    const bodyRow = table!.querySelector('tbody tr')
+
+    expect(table).toHaveClass('w-full', 'border-collapse', 'border-0', 'text-sm')
+    expect(header).toHaveClass('border-b', 'border-divider-subtle')
+    expect(headerCell).not.toHaveClass('bg-background-section-burn', 'rounded-l-lg')
+    expect(bodyRow).toHaveClass('h-8', 'border-b', 'border-divider-subtle', 'hover:bg-background-default-hover')
+    expect(tableScope.getByText('Initial Release')).toBeInTheDocument()
+  })
+
+  it('should render release deployments with the dot status style', () => {
+    const { container } = render(
+      <ReleaseHistoryRows
+        appInstanceId="app-instance-1"
+        releaseRows={[
+          createReleaseRow({
+            summaryDeployments: [{
+              environmentId: 'env-1',
+              environmentName: 'test-cpu',
+              status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY,
+            }],
+          }),
+        ]}
+      />,
+    )
+
+    const table = container.querySelector('table')
+    const deploymentLabel = table!.querySelector('.text-util-colors-green-green-600')
+
+    expect(deploymentLabel).toHaveTextContent('test-cpu')
+    expect(deploymentLabel).toHaveClass('text-util-colors-green-green-600', 'system-xs-medium')
+    expect(deploymentLabel).not.toHaveClass('border', 'rounded-md', 'bg-util-colors-green-green-50')
+    expect(deploymentLabel).not.toHaveAttribute('data-base-ui-tooltip-trigger')
+    expect(container.querySelector('.shadow-status-indicator-green-shadow')).toBeInTheDocument()
+  })
+})
diff --git a/web/features/deployments/detail/versions-tab/delete-release-dialog.tsx b/web/features/deployments/detail/versions-tab/delete-release-dialog.tsx
new file mode 100644
index 00000000000..5e60685f73c
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/delete-release-dialog.tsx
@@ -0,0 +1,63 @@
+'use client'
+
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { useTranslation } from 'react-i18next'
+
+export function DeleteReleaseDialog({
+  open,
+  release,
+  isDeleting,
+  onOpenChange,
+  onConfirm,
+}: {
+  open: boolean
+  release: Release
+  isDeleting: boolean
+  onOpenChange: (open: boolean) => void
+  onConfirm: () => void
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <AlertDialog
+      open={open}
+      onOpenChange={(nextOpen) => {
+        if (isDeleting)
+          return
+        onOpenChange(nextOpen)
+      }}
+    >
+      <AlertDialogContent className="w-120">
+        <div className="flex flex-col gap-3 px-6 pt-6 pb-2">
+          <AlertDialogTitle className="title-2xl-semi-bold text-text-primary">
+            {t('versions.deleteConfirmTitle')}
+          </AlertDialogTitle>
+          <AlertDialogDescription className="system-sm-regular text-text-tertiary">
+            {t('versions.deleteConfirmDesc', { name: release.displayName })}
+          </AlertDialogDescription>
+        </div>
+        <AlertDialogActions className="pt-3">
+          <AlertDialogCancelButton variant="secondary" disabled={isDeleting}>
+            {t('versions.cancelDelete')}
+          </AlertDialogCancelButton>
+          <AlertDialogConfirmButton
+            loading={isDeleting}
+            disabled={isDeleting}
+            onClick={onConfirm}
+          >
+            {t('versions.deleteRelease')}
+          </AlertDialogConfirmButton>
+        </AlertDialogActions>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}
diff --git a/web/features/deployments/detail/versions-tab/deploy-release-menu-utils.spec.ts b/web/features/deployments/detail/versions-tab/deploy-release-menu-utils.spec.ts
new file mode 100644
index 00000000000..0f5073bb102
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/deploy-release-menu-utils.spec.ts
@@ -0,0 +1,65 @@
+import type {
+  Environment,
+  EnvironmentDeployment,
+  Release,
+} from '@dify/contracts/enterprise/types.gen'
+import type { TFunction } from 'i18next'
+import { ReleaseSource, RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+import { describe, expect, it } from 'vitest'
+import { buildDeployMenuSections } from './deploy-release-menu-utils'
+
+const t = ((key: string, options?: { name?: string }) => {
+  return options?.name ? `${key}:${options.name}` : key
+}) as unknown as TFunction<'deployments'>
+
+function createRelease(id: string): Release {
+  return {
+    id,
+    appInstanceId: 'app-instance-1',
+    displayName: id,
+    description: '',
+    source: ReleaseSource.RELEASE_SOURCE_SOURCE_APP,
+    gateCommitId: id,
+    requiredSlots: [],
+    createdBy: {
+      id: 'account-1',
+      displayName: 'Dify Admin',
+    },
+    createdAt: '2026-01-01T00:00:00.000Z',
+  }
+}
+
+describe('buildDeployMenuSections', () => {
+  it('disables deploy actions while an environment is undeploying', () => {
+    const env = {
+      id: 'env-1',
+      displayName: 'Production',
+    } as Environment
+    const targetRelease = createRelease('release-1')
+    const deployment = {
+      appInstanceId: 'app-instance-1',
+      environment: env,
+      status: RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING,
+      currentRelease: createRelease('release-0'),
+      updatedAt: '2026-01-01T00:00:00.000Z',
+    } as EnvironmentDeployment
+
+    const sections = buildDeployMenuSections({
+      environments: [env],
+      environmentDeployments: [deployment],
+      releaseRows: [targetRelease],
+      releaseId: targetRelease.id,
+      targetRelease,
+      t,
+    })
+
+    expect(sections).toHaveLength(1)
+    expect(sections[0]?.group).toBe('unavailable')
+    expect(sections[0]?.rows[0]).toMatchObject({
+      environmentId: env.id,
+      state: 'deploying',
+      label: 'versions.deployingTo:Production',
+      disabledReason: 'versions.disabledReason.deploying',
+    })
+  })
+})
diff --git a/web/features/deployments/detail/versions-tab/deploy-release-menu-utils.ts b/web/features/deployments/detail/versions-tab/deploy-release-menu-utils.ts
new file mode 100644
index 00000000000..9498aab0024
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/deploy-release-menu-utils.ts
@@ -0,0 +1,150 @@
+import type {
+  Environment,
+  EnvironmentDeployment,
+  Release,
+} from '@dify/contracts/enterprise/types.gen'
+import type { TFunction } from 'i18next'
+import { releaseDeploymentAction } from '../../shared/domain/release-action'
+import { isRuntimeDeploymentInProgress, isUndeployedDeploymentRow } from '../../shared/domain/runtime-status'
+
+export type DeployMenuRowState = 'deploy' | 'rollback' | 'current' | 'deploying'
+
+export type DeployMenuRow = {
+  env?: Environment
+  environmentId: string
+  state: DeployMenuRowState
+  label: string
+  disabledReason?: string
+}
+
+export type DeployMenuGroup = 'deploy' | 'rollback' | 'unavailable'
+
+export type DeployMenuSection = {
+  group: DeployMenuGroup
+  rows: DeployMenuRow[]
+}
+
+const GROUP_ORDER: DeployMenuGroup[] = ['deploy', 'rollback', 'unavailable']
+
+function stateToGroup(state: DeployMenuRowState): DeployMenuGroup {
+  if (state === 'rollback')
+    return 'rollback'
+  if (state === 'deploy')
+    return 'deploy'
+  return 'unavailable'
+}
+
+export function releaseUsageCount(releaseId: string, deploymentRows: EnvironmentDeployment[]) {
+  const environmentIds = new Set<string>()
+
+  deploymentRows.forEach((row) => {
+    const usesRelease = row.currentRelease?.id === releaseId || row.desiredRelease?.id === releaseId
+    if (usesRelease)
+      environmentIds.add(row.environment.id)
+  })
+
+  return environmentIds.size
+}
+
+function buildDeployMenuRow({
+  env,
+  deploymentRows,
+  releaseRows,
+  releaseId,
+  targetRelease,
+  t,
+}: {
+  env: Environment
+  deploymentRows: EnvironmentDeployment[]
+  releaseRows: Release[]
+  releaseId: string
+  targetRelease: Release
+  t: TFunction<'deployments'>
+}): DeployMenuRow {
+  const envId = env.id
+  const envName = env.displayName
+  const row = deploymentRows.find(item => item.environment.id === envId)
+  const currentRelease = row?.currentRelease
+  const isCurrent = currentRelease?.id === releaseId
+  const isEnvironmentInProgress = isRuntimeDeploymentInProgress(row?.status)
+
+  if (isEnvironmentInProgress) {
+    return {
+      env,
+      environmentId: envId,
+      state: 'deploying',
+      label: t('versions.deployingTo', { name: envName }),
+      disabledReason: t('versions.disabledReason.deploying'),
+    }
+  }
+  if (isCurrent) {
+    return {
+      env,
+      environmentId: envId,
+      state: 'current',
+      label: t('versions.currentOn', { name: envName }),
+      disabledReason: t('versions.disabledReason.current', { name: envName }),
+    }
+  }
+
+  const action = releaseDeploymentAction({
+    targetRelease,
+    currentRelease,
+    releaseRows,
+    isExistingRelease: true,
+  })
+
+  if (!row) {
+    return {
+      env,
+      environmentId: envId,
+      state: 'deploy',
+      label: t('versions.deployTo', { name: envName }),
+    }
+  }
+  if (action === 'rollback') {
+    return {
+      env,
+      environmentId: envId,
+      state: 'rollback',
+      label: t('versions.rollbackTo', { name: envName }),
+    }
+  }
+  return {
+    env,
+    environmentId: envId,
+    state: 'deploy',
+    label: t('versions.deployTo', { name: envName }),
+  }
+}
+
+export function buildDeployMenuSections({
+  environments,
+  environmentDeployments,
+  releaseRows,
+  releaseId,
+  targetRelease,
+  t,
+}: {
+  environments: Environment[]
+  environmentDeployments: EnvironmentDeployment[]
+  releaseRows: Release[]
+  releaseId: string
+  targetRelease: Release
+  t: TFunction<'deployments'>
+}) {
+  const deploymentRows = environmentDeployments.filter(row => !isUndeployedDeploymentRow(row))
+  const menuRows = environments.map(env => buildDeployMenuRow({
+    env,
+    deploymentRows,
+    releaseRows,
+    releaseId,
+    targetRelease,
+    t,
+  }))
+
+  return GROUP_ORDER.map(group => ({
+    group,
+    rows: menuRows.filter(row => stateToGroup(row.state) === group),
+  })).filter((section): section is DeployMenuSection => section.rows.length > 0)
+}
diff --git a/web/features/deployments/detail/versions-tab/deploy-release-menu.tsx b/web/features/deployments/detail/versions-tab/deploy-release-menu.tsx
new file mode 100644
index 00000000000..f12a28ff896
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/deploy-release-menu.tsx
@@ -0,0 +1,239 @@
+'use client'
+
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation, useQuery } from '@tanstack/react-query'
+import { useSetAtom } from 'jotai'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { TitleTooltip } from '../../components/title-tooltip'
+import { openDeployDrawerAtom } from '../../deploy-drawer/state'
+import { isUndeployedDeploymentRow } from '../../shared/domain/runtime-status'
+import { DETAIL_TABLE_ACTION_TRIGGER_CLASS_NAME } from '../table-styles'
+import { DeleteReleaseDialog } from './delete-release-dialog'
+import {
+  buildDeployMenuSections,
+  releaseUsageCount,
+} from './deploy-release-menu-utils'
+import { EditReleaseDialog } from './edit-release-dialog'
+import { exportReleaseDsl } from './release-dsl-export'
+
+export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDeleted }: {
+  appInstanceId: string
+  releaseId: string
+  releaseRows: Release[]
+  onDeleted?: () => void
+}) {
+  const { t } = useTranslation('deployments')
+  const openDeployDrawer = useSetAtom(openDeployDrawerAtom)
+  const [open, setOpen] = useState(false)
+  const [showEditDialog, setShowEditDialog] = useState(false)
+  const [showDeleteConfirm, setShowDeleteConfirm] = useState(false)
+  const [isExportingDsl, setIsExportingDsl] = useState(false)
+  const environmentDeploymentsQuery = useQuery(consoleQuery.enterprise.deploymentService.listEnvironmentDeployments.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+    enabled: open,
+  }))
+  const { data: appInstanceData } = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+    enabled: open,
+  }))
+  const deleteRelease = useMutation(consoleQuery.enterprise.releaseService.deleteRelease.mutationOptions())
+
+  const environments = (environmentDeploymentsQuery.data?.environmentDeployments ?? [])
+    .map(row => row.environment)
+  const deploymentRows = environmentDeploymentsQuery.data?.environmentDeployments.filter(row => !isUndeployedDeploymentRow(row)) ?? []
+  const targetRelease = releaseRows.find(release => release.id === releaseId)
+  const appInstanceName = appInstanceData?.appInstance.displayName
+
+  if (!targetRelease)
+    return null
+
+  const targetReleaseName = targetRelease.displayName
+  const deleteUsageCount = releaseUsageCount(releaseId, deploymentRows)
+  const isCheckingDeleteUsage = open && environmentDeploymentsQuery.isLoading
+  const hasDeleteUsageCheckFailed = open && environmentDeploymentsQuery.isError
+  const isReleaseInUse = deleteUsageCount > 0
+  const isDeletingRelease = deleteRelease.isPending
+  const deleteDisabledReason = isCheckingDeleteUsage
+    ? t('versions.disabledReason.checkingDeployments')
+    : hasDeleteUsageCheckFailed
+      ? t('versions.disabledReason.checkDeploymentsFailed')
+      : isReleaseInUse
+        ? t('versions.disabledReason.releaseInUse', { count: deleteUsageCount })
+        : undefined
+  const deleteActionDisabled = isDeletingRelease || isCheckingDeleteUsage || hasDeleteUsageCheckFailed || isReleaseInUse
+
+  const handleExportDsl = async () => {
+    if (isExportingDsl)
+      return
+
+    setIsExportingDsl(true)
+    try {
+      await exportReleaseDsl({ release: targetRelease, releaseId, appInstanceName })
+      setOpen(false)
+    }
+    catch {
+      toast.error(t('versions.exportDslFailed'))
+    }
+    finally {
+      setIsExportingDsl(false)
+    }
+  }
+
+  function handleDeleteRelease() {
+    if (deleteActionDisabled)
+      return
+
+    deleteRelease.mutate(
+      {
+        params: {
+          releaseId,
+        },
+      },
+      {
+        onSuccess: () => {
+          setShowDeleteConfirm(false)
+          toast.success(t('versions.deleteSuccess', { name: targetReleaseName }))
+          onDeleted?.()
+        },
+        onError: () => {
+          toast.error(t('versions.deleteFailed'))
+        },
+      },
+    )
+  }
+
+  const groupedRows = buildDeployMenuSections({
+    environments,
+    environmentDeployments: environmentDeploymentsQuery.data?.environmentDeployments ?? [],
+    releaseRows,
+    releaseId,
+    targetRelease,
+    t,
+  })
+
+  return (
+    <>
+      <DropdownMenu modal={false} open={open} onOpenChange={setOpen}>
+        <DropdownMenuTrigger
+          aria-label={t('versions.moreActions')}
+          className={DETAIL_TABLE_ACTION_TRIGGER_CLASS_NAME}
+        >
+          <span aria-hidden className="i-ri-more-fill size-4" />
+        </DropdownMenuTrigger>
+        {open && (
+          <DropdownMenuContent placement="bottom-end" sideOffset={4} popupClassName="w-60">
+            <DropdownMenuItem
+              className="gap-2 px-3"
+              onClick={() => {
+                setOpen(false)
+                setShowEditDialog(true)
+              }}
+            >
+              <span aria-hidden className="i-ri-edit-line size-4 shrink-0 text-text-tertiary" />
+              <span className="system-sm-regular text-text-secondary">
+                {t('versions.editRelease')}
+              </span>
+            </DropdownMenuItem>
+            <DropdownMenuItem
+              disabled={isExportingDsl}
+              aria-disabled={isExportingDsl}
+              className={cn(
+                'gap-2 px-3',
+                isExportingDsl && 'cursor-not-allowed opacity-60',
+              )}
+              onClick={handleExportDsl}
+            >
+              <span aria-hidden className="i-ri-download-2-line size-4 shrink-0 text-text-tertiary" />
+              <span className="system-sm-regular text-text-secondary">
+                {isExportingDsl ? t('versions.exportingDsl') : t('versions.exportDsl')}
+              </span>
+            </DropdownMenuItem>
+            {groupedRows.length > 0 && <div className="my-1 border-t border-divider-subtle" aria-hidden />}
+            {groupedRows.map((section, sectionIndex) => (
+              <div key={section.group}>
+                {sectionIndex > 0 && <div className="my-1 border-t border-divider-subtle" aria-hidden />}
+                <div className="px-3 pt-1.5 pb-1 system-2xs-medium-uppercase text-text-quaternary">
+                  {t(`versions.groupHeader.${section.group}`)}
+                </div>
+                {section.rows.map((row) => {
+                  const isDisabled = row.state === 'current' || row.state === 'deploying'
+                  return (
+                    <TitleTooltip key={row.environmentId} content={isDisabled ? row.disabledReason : undefined}>
+                      <DropdownMenuItem
+                        disabled={isDisabled}
+                        aria-disabled={isDisabled}
+                        className={cn(
+                          'gap-2 px-3',
+                          isDisabled && 'cursor-not-allowed opacity-60',
+                        )}
+                        onClick={() => {
+                          if (isDisabled)
+                            return
+                          setOpen(false)
+                          openDeployDrawer({ appInstanceId, environmentId: row.environmentId, releaseId })
+                        }}
+                      >
+                        <span className="system-sm-regular text-text-secondary">
+                          {row.label}
+                        </span>
+                      </DropdownMenuItem>
+                    </TitleTooltip>
+                  )
+                })}
+              </div>
+            ))}
+            <div className="my-1 border-t border-divider-subtle" aria-hidden />
+            <TitleTooltip content={deleteDisabledReason}>
+              <DropdownMenuItem
+                variant="destructive"
+                disabled={deleteActionDisabled}
+                aria-disabled={deleteActionDisabled}
+                className={cn(
+                  'gap-2 px-3',
+                  deleteActionDisabled && 'cursor-not-allowed opacity-60',
+                )}
+                onClick={() => {
+                  if (deleteActionDisabled)
+                    return
+                  setOpen(false)
+                  setShowDeleteConfirm(true)
+                }}
+              >
+                <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
+                <span className="system-sm-regular">{t('versions.deleteRelease')}</span>
+              </DropdownMenuItem>
+            </TitleTooltip>
+          </DropdownMenuContent>
+        )}
+      </DropdownMenu>
+
+      <EditReleaseDialog
+        release={targetRelease}
+        open={showEditDialog}
+        onOpenChange={setShowEditDialog}
+      />
+
+      <DeleteReleaseDialog
+        open={showDeleteConfirm}
+        release={targetRelease}
+        isDeleting={isDeletingRelease}
+        onOpenChange={setShowDeleteConfirm}
+        onConfirm={handleDeleteRelease}
+      />
+    </>
+  )
+}
diff --git a/web/features/deployments/detail/versions-tab/deployed-to-badge.tsx b/web/features/deployments/detail/versions-tab/deployed-to-badge.tsx
new file mode 100644
index 00000000000..b0159043b78
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/deployed-to-badge.tsx
@@ -0,0 +1,41 @@
+'use client'
+
+import type { ReleaseDeployment } from './release-deployments'
+import { cn } from '@langgenius/dify-ui/cn'
+import { StatusDot } from '@langgenius/dify-ui/status-dot'
+import { useTranslation } from 'react-i18next'
+import { isRuntimeDeploymentInProgress } from '../../shared/domain/runtime-status'
+import {
+  deploymentStatusDotStatus,
+  deploymentStatusDotTextClassName,
+} from '../../shared/ui/deployment-status-style'
+
+export function DeployedToBadge({ item }: {
+  item: ReleaseDeployment
+}) {
+  const { t } = useTranslation('deployments')
+  const status = item.status
+  const statusLabel = t(`versions.deployedStatus.${status}`)
+  const dotStatus = deploymentStatusDotStatus(status)
+  const isInProgress = isRuntimeDeploymentInProgress(status)
+  const textClassName = deploymentStatusDotTextClassName(status)
+
+  return (
+    <span
+      className={cn(
+        'inline-flex max-w-full cursor-default items-center system-xs-medium',
+        textClassName,
+      )}
+    >
+      <StatusDot
+        status={dotStatus}
+        className={cn('mr-2 shrink-0', isInProgress && 'animate-pulse')}
+      />
+      <span className="truncate">
+        {item.environmentName}
+        {' · '}
+        {statusLabel}
+      </span>
+    </span>
+  )
+}
diff --git a/web/features/deployments/detail/versions-tab/edit-release-dialog.tsx b/web/features/deployments/detail/versions-tab/edit-release-dialog.tsx
new file mode 100644
index 00000000000..da57965ab3e
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/edit-release-dialog.tsx
@@ -0,0 +1,188 @@
+'use client'
+
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import type { FormEvent } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import {
+  Dialog,
+  DialogCloseButton,
+  DialogContent,
+  DialogDescription,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { Input } from '@langgenius/dify-ui/input'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+
+type EditReleaseFormValues = {
+  name: string
+  description: string
+}
+
+function EditReleaseForm({
+  release,
+  isSaving,
+  onClose,
+  onSubmit,
+}: {
+  release: Release
+  isSaving: boolean
+  onClose: () => void
+  onSubmit: (values: EditReleaseFormValues) => void
+}) {
+  const { t } = useTranslation('deployments')
+  const initialName = release.displayName
+  const initialDescription = release.description
+  const [name, setName] = useState(initialName)
+  const [description, setDescription] = useState(initialDescription)
+  const normalizedName = name.trim()
+  const normalizedDescription = description.trim()
+  const nameRequired = !normalizedName
+  const hasChanges = normalizedName !== initialName || normalizedDescription !== initialDescription
+  const canSave = Boolean(!nameRequired && hasChanges && !isSaving)
+
+  function handleSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault()
+    if (!canSave)
+      return
+
+    onSubmit({
+      name: normalizedName,
+      description: normalizedDescription,
+    })
+  }
+
+  return (
+    <form className="flex flex-col gap-4" noValidate autoComplete="off" onSubmit={handleSubmit}>
+      <div className="flex flex-col gap-2">
+        <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="release-edit-name">
+          {t('versions.releaseNameLabel')}
+        </label>
+        <Input
+          id="release-edit-name"
+          type="text"
+          value={name}
+          maxLength={128}
+          autoComplete="off"
+          aria-invalid={nameRequired || undefined}
+          aria-describedby={nameRequired ? 'release-edit-name-error' : undefined}
+          onChange={event => setName(event.target.value)}
+          className="h-8"
+        />
+        {nameRequired && (
+          <div id="release-edit-name-error" role="alert" className="system-xs-regular text-text-destructive">
+            {t('versions.releaseNameRequired')}
+          </div>
+        )}
+      </div>
+      <div className="flex flex-col gap-2">
+        <div className="flex items-center gap-1.5">
+          <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="release-edit-description">
+            {t('versions.releaseDescriptionLabel')}
+          </label>
+          <span className="system-xs-regular text-text-quaternary">{t('versions.optional')}</span>
+        </div>
+        <Textarea
+          id="release-edit-description"
+          value={description}
+          maxLength={512}
+          autoComplete="off"
+          onValueChange={setDescription}
+          className="min-h-24"
+        />
+      </div>
+      <div className="flex justify-end gap-2 pt-2">
+        <Button
+          type="button"
+          variant="secondary"
+          disabled={isSaving}
+          onClick={onClose}
+        >
+          {t('versions.cancelEdit')}
+        </Button>
+        <Button
+          type="submit"
+          variant="primary"
+          disabled={!canSave}
+          loading={isSaving}
+        >
+          {t('versions.saveEdit')}
+        </Button>
+      </div>
+    </form>
+  )
+}
+
+export function EditReleaseDialog({
+  release,
+  open,
+  onOpenChange,
+}: {
+  release: Release
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}) {
+  const { t } = useTranslation('deployments')
+  const updateRelease = useMutation(consoleQuery.enterprise.releaseService.updateRelease.mutationOptions())
+  const formKey = `${release.id}-${release.displayName}-${release.description}`
+
+  function handleOpenChange(nextOpen: boolean) {
+    if (!nextOpen && updateRelease.isPending)
+      return
+    onOpenChange(nextOpen)
+  }
+
+  function handleSubmit(values: EditReleaseFormValues) {
+    updateRelease.mutate(
+      {
+        params: {
+          releaseId: release.id,
+        },
+        body: {
+          releaseId: release.id,
+          displayName: values.name,
+          description: values.description,
+        },
+      },
+      {
+        onSuccess: (data) => {
+          const updatedName = data.release.displayName
+          toast.success(t('versions.editSuccess', { name: updatedName }))
+          onOpenChange(false)
+        },
+        onError: () => {
+          toast.error(t('versions.editFailed'))
+        },
+      },
+    )
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+      <DialogContent className="w-120 max-w-[calc(100vw-32px)] p-0">
+        <DialogCloseButton disabled={updateRelease.isPending} />
+        <div className="border-b border-divider-subtle px-6 py-5 pr-14">
+          <DialogTitle className="title-xl-semi-bold text-text-primary">
+            {t('versions.editRelease')}
+          </DialogTitle>
+          <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+            {t('versions.editReleaseDescription')}
+          </DialogDescription>
+        </div>
+        <div className="px-6 py-5">
+          <EditReleaseForm
+            key={formKey}
+            release={release}
+            isSaving={updateRelease.isPending}
+            onClose={() => handleOpenChange(false)}
+            onSubmit={handleSubmit}
+          />
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/features/deployments/detail/versions-tab/release-deployments.ts b/web/features/deployments/detail/versions-tab/release-deployments.ts
new file mode 100644
index 00000000000..cb6bfe77454
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/release-deployments.ts
@@ -0,0 +1,49 @@
+import type {
+  Environment,
+  Release,
+  ReleaseSummary,
+  RuntimeInstanceStatus as RuntimeInstanceStatusValue,
+} from '@dify/contracts/enterprise/types.gen'
+import {
+  ReleaseEnvironmentActionKind,
+  RuntimeInstanceStatus,
+} from '@dify/contracts/enterprise/types.gen'
+
+export type ReleaseDeployment = {
+  environmentId: string
+  environmentName: string
+  status: RuntimeInstanceStatusValue
+}
+
+export type ReleaseWithSummaryDeployments = Release & {
+  summaryDeployments: ReleaseDeployment[]
+}
+
+function dedupeReleaseDeployments(items: ReleaseDeployment[]) {
+  return items.filter((item, index) => {
+    return items.findIndex(candidate => candidate.environmentId === item.environmentId) === index
+  })
+}
+
+function releaseSummaryEnvironmentDeployment(environment: Environment, status: RuntimeInstanceStatusValue): ReleaseDeployment {
+  return {
+    environmentId: environment.id,
+    environmentName: environment.displayName,
+    status,
+  }
+}
+
+export function getReleaseSummaryDeployments(summary: ReleaseSummary) {
+  // Each deployed environment carries its runtime status so a failed deployment
+  // surfaces as failed instead of being assumed healthy.
+  const deployedItems = summary.deployedEnvironments
+    .map(deployment => releaseSummaryEnvironmentDeployment(deployment.environment, deployment.status))
+  const actionItems = summary.environmentActions
+    .filter(action => action.kind === ReleaseEnvironmentActionKind.RELEASE_ENVIRONMENT_ACTION_KIND_DEPLOYING)
+    .map(action => releaseSummaryEnvironmentDeployment(action.environment, RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING))
+
+  return dedupeReleaseDeployments([
+    ...deployedItems,
+    ...actionItems,
+  ])
+}
diff --git a/web/features/deployments/detail/versions-tab/release-dsl-export.ts b/web/features/deployments/detail/versions-tab/release-dsl-export.ts
new file mode 100644
index 00000000000..fa074bf5f87
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/release-dsl-export.ts
@@ -0,0 +1,44 @@
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import { downloadBlob } from '@/utils/download'
+import { fetchReleaseDsl } from './release-dsl'
+
+const YAML_EXTENSION_PATTERN = /\.ya?ml$/i
+const INVALID_FILENAME_CHARS_PATTERN = /[\\/:*?"<>|]+/g
+const FILENAME_SEPARATOR_PATTERN = /[\s-]+/g
+
+function sanitizeFileNamePart(value?: string) {
+  if (!value)
+    return ''
+
+  return value
+    .trim()
+    .replace(YAML_EXTENSION_PATTERN, '')
+    .replace(INVALID_FILENAME_CHARS_PATTERN, '-')
+    .replace(FILENAME_SEPARATOR_PATTERN, '-')
+    .replace(/^-+|-+$/g, '')
+}
+
+function releaseDslFileName({ release, appInstanceName }: {
+  release: Release
+  appInstanceName?: string
+}) {
+  const projectName = sanitizeFileNamePart(appInstanceName)
+  const releaseName = sanitizeFileNamePart(release.displayName) || 'release'
+  const baseName = [projectName, releaseName].filter(Boolean).join('-')
+
+  return `${baseName}.yaml`
+}
+
+export async function exportReleaseDsl({ release, releaseId, appInstanceName }: {
+  release: Release
+  releaseId: string
+  appInstanceName?: string
+}) {
+  const data = new Blob([await fetchReleaseDsl(releaseId)], {
+    type: 'application/x-yaml;charset=utf-8',
+  })
+  downloadBlob({
+    data,
+    fileName: releaseDslFileName({ release, appInstanceName }),
+  })
+}
diff --git a/web/features/deployments/detail/versions-tab/release-dsl.ts b/web/features/deployments/detail/versions-tab/release-dsl.ts
new file mode 100644
index 00000000000..488bbd5fb92
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/release-dsl.ts
@@ -0,0 +1,12 @@
+import { consoleClient } from '@/service/client'
+
+export async function fetchReleaseDsl(releaseId: string) {
+  const response = await consoleClient.enterprise.releaseService.exportReleaseDsl({
+    params: { releaseId },
+  })
+
+  if (!response.dsl)
+    throw new Error('Invalid release DSL response')
+
+  return response.dsl
+}
diff --git a/web/features/deployments/detail/versions-tab/release-history-deployments.tsx b/web/features/deployments/detail/versions-tab/release-history-deployments.tsx
new file mode 100644
index 00000000000..6ac979f2602
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/release-history-deployments.tsx
@@ -0,0 +1,20 @@
+'use client'
+
+import type { ReleaseDeployment } from './release-deployments'
+import { DeployedToBadge } from './deployed-to-badge'
+
+export function ReleaseDeploymentsContent({
+  items,
+}: {
+  items: ReleaseDeployment[]
+}) {
+  if (items.length === 0)
+    return <span className="text-text-quaternary">—</span>
+
+  return items.map(item => (
+    <DeployedToBadge
+      key={`${item.environmentId}-${item.status}`}
+      item={item}
+    />
+  ))
+}
diff --git a/web/features/deployments/detail/versions-tab/release-history-rows.tsx b/web/features/deployments/detail/versions-tab/release-history-rows.tsx
new file mode 100644
index 00000000000..f8bb8ce8673
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/release-history-rows.tsx
@@ -0,0 +1,241 @@
+'use client'
+
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import type { ReleaseWithSummaryDeployments } from './release-deployments'
+import { ReleaseSource } from '@dify/contracts/enterprise/types.gen'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
+import { useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
+import Link from '@/next/link'
+import { consoleQuery } from '@/service/client'
+import { TitleTooltip } from '../../components/title-tooltip'
+import {
+  formatDate,
+  releaseCommit,
+} from '../../shared/domain/release'
+import {
+  DetailTable,
+  DetailTableBody,
+  DetailTableCard,
+  DetailTableCardList,
+  DetailTableCell,
+  DetailTableHead,
+  DetailTableHeader,
+  DetailTableRow,
+} from '../table'
+import { RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES } from '../table-styles'
+import { DeployReleaseMenu } from './deploy-release-menu'
+import {
+  ReleaseDeploymentsContent,
+} from './release-history-deployments'
+
+function ReleaseTitleTooltip({ release }: {
+  release: Release
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <Tooltip>
+      <TooltipTrigger
+        render={(
+          <span className="inline-flex max-w-full cursor-default truncate text-text-primary">
+            {release.displayName}
+          </span>
+        )}
+      />
+      <TooltipContent>
+        {t('versions.commitTooltip', { commit: releaseCommit(release) })}
+      </TooltipContent>
+    </Tooltip>
+  )
+}
+
+function CreatedAtCell({ createdAt }: {
+  createdAt: string
+}) {
+  const { formatTimeFromNow } = useFormatTimeFromNow()
+  const ms = Date.parse(createdAt)
+  if (Number.isNaN(ms))
+    return <>{formatDate(createdAt)}</>
+  return (
+    <Tooltip>
+      <TooltipTrigger
+        render={(
+          <span className="cursor-default">
+            {formatTimeFromNow(ms)}
+          </span>
+        )}
+      />
+      <TooltipContent>{formatDate(createdAt)}</TooltipContent>
+    </Tooltip>
+  )
+}
+
+function ReleaseSourceCell({ release }: {
+  release: Release
+}) {
+  const { t } = useTranslation('deployments')
+  const sourceAppId = release.sourceAppId
+  const sourceAppQuery = useQuery(consoleQuery.apps.byAppId.get.queryOptions({
+    input: { params: { app_id: sourceAppId ?? '' } },
+    enabled: Boolean(sourceAppId),
+  }))
+
+  if (!sourceAppId) {
+    return (
+      <span className="text-text-tertiary">
+        {release.source === ReleaseSource.RELEASE_SOURCE_UPLOAD ? t('versions.manualDslOption') : '—'}
+      </span>
+    )
+  }
+
+  const sourceAppName = sourceAppQuery.data?.name
+  const label = sourceAppName || sourceAppId
+  const title = sourceAppName ? `${sourceAppName} (${sourceAppId})` : sourceAppId
+
+  return (
+    <TitleTooltip content={title}>
+      <Link
+        href={`/app/${encodeURIComponent(sourceAppId)}/workflow`}
+        target="_blank"
+        rel="noreferrer"
+        className="inline-flex max-w-full min-w-0 items-center gap-1 text-text-secondary transition-colors hover:text-text-accent"
+      >
+        <span className="min-w-0 truncate">{label}</span>
+        <span className="i-ri-arrow-right-up-line size-3.5 shrink-0" aria-hidden="true" />
+      </Link>
+    </TitleTooltip>
+  )
+}
+
+function ReleaseHistoryMobileRows({ appInstanceId, releaseRows, onReleaseDeleted }: {
+  appInstanceId: string
+  releaseRows: ReleaseWithSummaryDeployments[]
+  onReleaseDeleted?: () => void
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <DetailTableCardList className="pc:hidden">
+      {releaseRows.map((row) => {
+        const release = row
+        const releaseId = release.id
+        const hasDeployments = row.summaryDeployments.length > 0
+
+        return (
+          <DetailTableCard key={releaseId}>
+            <div className="flex flex-col gap-3 p-4">
+              <div className="flex items-start justify-between gap-3">
+                <div className="min-w-0">
+                  <ReleaseTitleTooltip release={release} />
+                  <div className="mt-1 flex flex-wrap items-center gap-x-2 gap-y-1 system-xs-regular text-text-secondary">
+                    <CreatedAtCell createdAt={release.createdAt} />
+                    <span aria-hidden>·</span>
+                    <span>{row.createdBy.displayName}</span>
+                    {(release.sourceAppId || release.source === ReleaseSource.RELEASE_SOURCE_UPLOAD) && (
+                      <>
+                        <span aria-hidden>·</span>
+                        <span className="inline-flex max-w-full min-w-0 items-baseline gap-1">
+                          <span className="shrink-0">{t('versions.col.sourceApp')}</span>
+                          <ReleaseSourceCell release={release} />
+                        </span>
+                      </>
+                    )}
+                  </div>
+                </div>
+                <div className="flex shrink-0 justify-end gap-1">
+                  <DeployReleaseMenu
+                    releaseId={releaseId}
+                    appInstanceId={appInstanceId}
+                    releaseRows={releaseRows}
+                    onDeleted={onReleaseDeleted}
+                  />
+                </div>
+              </div>
+              {hasDeployments && (
+                <div className="flex min-w-0 flex-wrap items-center gap-1">
+                  <ReleaseDeploymentsContent
+                    items={row.summaryDeployments}
+                  />
+                </div>
+              )}
+            </div>
+          </DetailTableCard>
+        )
+      })}
+    </DetailTableCardList>
+  )
+}
+
+export function ReleaseHistoryRows({ appInstanceId, releaseRows, onReleaseDeleted }: {
+  appInstanceId: string
+  releaseRows: ReleaseWithSummaryDeployments[]
+  onReleaseDeleted?: () => void
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <>
+      <ReleaseHistoryMobileRows
+        appInstanceId={appInstanceId}
+        releaseRows={releaseRows}
+        onReleaseDeleted={onReleaseDeleted}
+      />
+      <div className="hidden pc:block">
+        <DetailTable className="min-w-[840px]">
+          <DetailTableHeader>
+            <DetailTableRow>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.release}>{t('versions.col.release')}</DetailTableHead>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.sourceApp}>{t('versions.col.sourceApp')}</DetailTableHead>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.createdAt}>{t('versions.col.createdAt')}</DetailTableHead>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.author}>{t('versions.col.author')}</DetailTableHead>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.deployedTo}>{t('versions.col.deployedTo')}</DetailTableHead>
+              <DetailTableHead className={`${RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.action} text-right`}>{t('versions.col.action')}</DetailTableHead>
+            </DetailTableRow>
+          </DetailTableHeader>
+          <DetailTableBody>
+            {releaseRows.map((row) => {
+              const release = row
+              const releaseId = release.id
+
+              return (
+                <DetailTableRow key={releaseId}>
+                  <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.release}>
+                    <ReleaseTitleTooltip release={release} />
+                  </DetailTableCell>
+                  <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.sourceApp}>
+                    <ReleaseSourceCell release={release} />
+                  </DetailTableCell>
+                  <DetailTableCell className={`${RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.createdAt} text-text-secondary`}>
+                    <CreatedAtCell createdAt={release.createdAt} />
+                  </DetailTableCell>
+                  <DetailTableCell className={`${RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.author} truncate text-text-secondary`}>
+                    {row.createdBy.displayName}
+                  </DetailTableCell>
+                  <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.deployedTo}>
+                    <div className="flex flex-wrap gap-1">
+                      <ReleaseDeploymentsContent
+                        items={row.summaryDeployments}
+                      />
+                    </div>
+                  </DetailTableCell>
+                  <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.action}>
+                    <div className="flex justify-end">
+                      <DeployReleaseMenu
+                        releaseId={releaseId}
+                        appInstanceId={appInstanceId}
+                        releaseRows={releaseRows}
+                        onDeleted={onReleaseDeleted}
+                      />
+                    </div>
+                  </DetailTableCell>
+                </DetailTableRow>
+              )
+            })}
+          </DetailTableBody>
+        </DetailTable>
+      </div>
+    </>
+  )
+}
diff --git a/web/features/deployments/detail/versions-tab/release-history-table-skeleton.tsx b/web/features/deployments/detail/versions-tab/release-history-table-skeleton.tsx
new file mode 100644
index 00000000000..b2c11bcae22
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/release-history-table-skeleton.tsx
@@ -0,0 +1,96 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import {
+  DetailTable,
+  DetailTableBody,
+  DetailTableCard,
+  DetailTableCardList,
+  DetailTableCell,
+  DetailTableHead,
+  DetailTableHeader,
+  DetailTableRow,
+} from '../table'
+import { RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES } from '../table-styles'
+
+const RELEASE_TABLE_ROW_SKELETON_KEYS = ['latest', 'previous', 'older', 'archived', 'initial']
+
+function ReleaseDeploymentsSkeleton() {
+  return (
+    <SkeletonRow className="gap-1">
+      <SkeletonRectangle className="my-0 h-5 w-20 animate-pulse rounded-md" />
+      <SkeletonRectangle className="my-0 h-5 w-18 animate-pulse rounded-md" />
+    </SkeletonRow>
+  )
+}
+
+export function ReleaseHistoryTableSkeleton() {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <>
+      <DetailTableCardList className="pc:hidden">
+        {RELEASE_TABLE_ROW_SKELETON_KEYS.map(key => (
+          <DetailTableCard key={key}>
+            <div className="flex flex-col gap-3 p-4">
+              <div className="flex items-start justify-between gap-3">
+                <div className="min-w-0">
+                  <SkeletonRectangle className="h-3 w-24 animate-pulse" />
+                  <SkeletonRow className="mt-1 gap-2">
+                    <SkeletonRectangle className="h-3 w-28 animate-pulse" />
+                    <SkeletonRectangle className="h-3 w-20 animate-pulse" />
+                  </SkeletonRow>
+                </div>
+                <SkeletonRectangle className="my-0 h-7 w-8 animate-pulse rounded-lg" />
+              </div>
+              <div className="flex flex-wrap items-center gap-x-3 gap-y-2">
+                <ReleaseDeploymentsSkeleton />
+              </div>
+            </div>
+          </DetailTableCard>
+        ))}
+      </DetailTableCardList>
+      <div className="hidden pc:block">
+        <DetailTable className="min-w-[840px]">
+          <DetailTableHeader>
+            <DetailTableRow>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.release}>{t('versions.col.release')}</DetailTableHead>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.sourceApp}>{t('versions.col.sourceApp')}</DetailTableHead>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.createdAt}>{t('versions.col.createdAt')}</DetailTableHead>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.author}>{t('versions.col.author')}</DetailTableHead>
+              <DetailTableHead className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.deployedTo}>{t('versions.col.deployedTo')}</DetailTableHead>
+              <DetailTableHead className={`${RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.action} text-right`}>{t('versions.col.action')}</DetailTableHead>
+            </DetailTableRow>
+          </DetailTableHeader>
+          <DetailTableBody>
+            {RELEASE_TABLE_ROW_SKELETON_KEYS.map(key => (
+              <DetailTableRow key={key}>
+                <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.release}>
+                  <SkeletonRectangle className="h-3 w-24 animate-pulse" />
+                </DetailTableCell>
+                <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.sourceApp}>
+                  <SkeletonRectangle className="h-3 w-32 animate-pulse" />
+                </DetailTableCell>
+                <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.createdAt}>
+                  <SkeletonRectangle className="h-3 w-24 animate-pulse" />
+                </DetailTableCell>
+                <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.author}>
+                  <SkeletonRectangle className="h-3 w-24 animate-pulse" />
+                </DetailTableCell>
+                <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.deployedTo}>
+                  <ReleaseDeploymentsSkeleton />
+                </DetailTableCell>
+                <DetailTableCell className={RELEASE_DETAIL_TABLE_COLUMN_CLASS_NAMES.action}>
+                  <div className="flex justify-end">
+                    <SkeletonRectangle className="my-0 size-8 animate-pulse rounded-md" />
+                  </div>
+                </DetailTableCell>
+              </DetailTableRow>
+            ))}
+          </DetailTableBody>
+        </DetailTable>
+      </div>
+    </>
+  )
+}
diff --git a/web/features/deployments/detail/versions-tab/release-history-table.tsx b/web/features/deployments/detail/versions-tab/release-history-table.tsx
new file mode 100644
index 00000000000..9b402904d3a
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/release-history-table.tsx
@@ -0,0 +1,88 @@
+'use client'
+
+import { Pagination } from '@langgenius/dify-ui/pagination'
+import { keepPreviousData, useQuery } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/client'
+import { DeploymentEmptyState, DeploymentStateMessage } from '../../components/empty-state'
+import { RELEASE_HISTORY_PAGE_SIZE } from '../../shared/domain/pagination'
+import { ReleaseHistoryRows } from './release-history-rows'
+import { ReleaseHistoryTableSkeleton } from './release-history-table-skeleton'
+import { releaseRowFromSummary } from './release-history-types'
+
+export function ReleaseHistoryTable({ appInstanceId }: {
+  appInstanceId: string
+}) {
+  const { t } = useTranslation('deployments')
+  const [currentPage, setCurrentPage] = useState(0)
+  const releaseHistoryQuery = useQuery(consoleQuery.enterprise.releaseService.listReleaseSummaries.queryOptions({
+    input: {
+      params: { appInstanceId },
+      query: {
+        pageNumber: currentPage + 1,
+        resultsPerPage: RELEASE_HISTORY_PAGE_SIZE,
+      },
+    },
+    placeholderData: keepPreviousData,
+  }))
+  const isLoading = releaseHistoryQuery.isLoading
+  const hasError = releaseHistoryQuery.isError
+
+  if (isLoading)
+    return <ReleaseHistoryTableSkeleton />
+
+  if (hasError) {
+    return (
+      <DeploymentStateMessage variant="list">
+        {t('common.loadFailed')}
+      </DeploymentStateMessage>
+    )
+  }
+
+  const releaseHistory = releaseHistoryQuery.data
+  if (!releaseHistory) {
+    return (
+      <DeploymentStateMessage variant="list">
+        {t('common.loadFailed')}
+      </DeploymentStateMessage>
+    )
+  }
+
+  const releaseRows = releaseHistory.releaseSummaries.map(releaseRowFromSummary)
+  const totalReleases = releaseHistory.pagination.totalCount ?? releaseRows.length
+  const totalReleasePages = Math.ceil(totalReleases / RELEASE_HISTORY_PAGE_SIZE)
+
+  function handleReleaseDeleted() {
+    if (releaseRows.length === 1 && currentPage > 0)
+      setCurrentPage(page => Math.max(page - 1, 0))
+  }
+
+  if (releaseRows.length === 0) {
+    return (
+      <DeploymentEmptyState
+        icon="i-ri-stack-line"
+        title={t('versions.emptyTitle')}
+        description={t('versions.emptyDescription')}
+      />
+    )
+  }
+
+  return (
+    <div className="flex flex-col gap-3">
+      <ReleaseHistoryRows
+        appInstanceId={appInstanceId}
+        releaseRows={releaseRows}
+        onReleaseDeleted={handleReleaseDeleted}
+      />
+      {totalReleases > RELEASE_HISTORY_PAGE_SIZE && (
+        <Pagination
+          className="border-y border-divider-subtle"
+          page={currentPage + 1}
+          totalPages={totalReleasePages}
+          onPageChange={page => setCurrentPage(page - 1)}
+        />
+      )}
+    </div>
+  )
+}
diff --git a/web/features/deployments/detail/versions-tab/release-history-types.ts b/web/features/deployments/detail/versions-tab/release-history-types.ts
new file mode 100644
index 00000000000..72399a67e04
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/release-history-types.ts
@@ -0,0 +1,10 @@
+import type { ReleaseSummary } from '@dify/contracts/enterprise/types.gen'
+import type { ReleaseWithSummaryDeployments } from './release-deployments'
+import { getReleaseSummaryDeployments } from './release-deployments'
+
+export function releaseRowFromSummary(summary: ReleaseSummary): ReleaseWithSummaryDeployments {
+  return {
+    ...summary.release,
+    summaryDeployments: getReleaseSummaryDeployments(summary),
+  }
+}
diff --git a/web/features/deployments/list/index.tsx b/web/features/deployments/list/index.tsx
new file mode 100644
index 00000000000..af44215fe14
--- /dev/null
+++ b/web/features/deployments/list/index.tsx
@@ -0,0 +1,41 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { ScopeProvider } from 'jotai-scope'
+import { useQueryState } from 'nuqs'
+import {
+  deploymentsListEnvironmentIdAtom,
+  deploymentsListKeywordsAtom,
+  envFilterQueryState,
+  keywordsQueryState,
+} from './state'
+import { DeploymentsListShell } from './ui/shell'
+
+function DeploymentsListStateBoundary({ children }: {
+  children: ReactNode
+}) {
+  const [envFilter] = useQueryState('env', envFilterQueryState)
+  const [keywords] = useQueryState('keywords', keywordsQueryState)
+  const stateKey = `${envFilter ?? 'all'}:${keywords}`
+
+  return (
+    <ScopeProvider
+      key={stateKey}
+      atoms={[
+        [deploymentsListEnvironmentIdAtom, envFilter],
+        [deploymentsListKeywordsAtom, keywords],
+      ]}
+      name="DeploymentsList"
+    >
+      {children}
+    </ScopeProvider>
+  )
+}
+
+export function DeploymentsList() {
+  return (
+    <DeploymentsListStateBoundary>
+      <DeploymentsListShell />
+    </DeploymentsListStateBoundary>
+  )
+}
diff --git a/web/features/deployments/list/state/index.ts b/web/features/deployments/list/state/index.ts
new file mode 100644
index 00000000000..4853d131b62
--- /dev/null
+++ b/web/features/deployments/list/state/index.ts
@@ -0,0 +1,87 @@
+'use client'
+
+import type { ListAppInstanceSummariesResponse } from '@dify/contracts/enterprise/types.gen'
+import type { InfiniteData, QueryKey } from '@tanstack/react-query'
+import { keepPreviousData } from '@tanstack/react-query'
+import { atom } from 'jotai'
+import { atomWithInfiniteQuery, atomWithQuery } from 'jotai-tanstack-query'
+import { parseAsString } from 'nuqs'
+import { consoleQuery } from '@/service/client'
+import { getNextPageParamFromPagination, SOURCE_APPS_PAGE_SIZE } from '../../shared/domain/pagination'
+import { deploymentStatusPollingInterval } from '../../shared/domain/runtime-status'
+
+export const envFilterQueryState = parseAsString.withOptions({ history: 'push' })
+export const keywordsQueryState = parseAsString.withDefault('').withOptions({ history: 'push' })
+
+export const deploymentsListKeywordsAtom = atom('')
+export const deploymentsListEnvironmentIdAtom = atom<string | null>(null)
+
+function listDeploymentStatusPollingInterval(data?: InfiniteData<ListAppInstanceSummariesResponse>) {
+  const rows = data?.pages?.flatMap(page =>
+    page.appInstanceSummaries.flatMap(summary => summary.environmentDeployments),
+  ) ?? []
+
+  return deploymentStatusPollingInterval(rows)
+}
+
+export const deploymentsListQueryAtom = atomWithInfiniteQuery<
+  ListAppInstanceSummariesResponse,
+  Error,
+  InfiniteData<ListAppInstanceSummariesResponse>,
+  QueryKey,
+  number
+>((get) => {
+  const queryKeywords = get(deploymentsListKeywordsAtom).trim()
+  const queryEnvironmentId = get(deploymentsListEnvironmentIdAtom) ?? undefined
+
+  return {
+    ...consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.infiniteOptions({
+      input: pageParam => ({
+        query: {
+          pageNumber: Number(pageParam),
+          resultsPerPage: SOURCE_APPS_PAGE_SIZE,
+          ...(queryEnvironmentId ? { environmentId: queryEnvironmentId } : {}),
+          ...(queryKeywords ? { displayName: queryKeywords } : {}),
+        },
+      }),
+      getNextPageParam: lastPage => getNextPageParamFromPagination(lastPage.pagination),
+      initialPageParam: 1,
+      placeholderData: keepPreviousData,
+    }),
+    refetchInterval: query => listDeploymentStatusPollingInterval(query.state.data),
+  }
+})
+
+export const deploymentsListRowsAtom = atom((get) => {
+  return get(deploymentsListQueryAtom).data?.pages.flatMap(page => page.appInstanceSummaries) ?? []
+})
+
+export const deploymentsListShowSkeletonAtom = atom((get) => {
+  const deploymentsListQuery = get(deploymentsListQueryAtom)
+  const pages = deploymentsListQuery.data?.pages ?? []
+
+  return deploymentsListQuery.isLoading || (deploymentsListQuery.isFetching && pages.length === 0)
+})
+
+export const deploymentsListShowEmptyStateAtom = atom((get) => {
+  return !get(deploymentsListShowSkeletonAtom)
+    && !get(deploymentsListQueryAtom).isError
+    && get(deploymentsListRowsAtom).length === 0
+})
+
+export const deploymentsListHasFilterAtom = atom((get) => {
+  return Boolean(get(deploymentsListKeywordsAtom).trim() || get(deploymentsListEnvironmentIdAtom))
+})
+
+export const environmentsFilterQueryAtom = atomWithQuery(() =>
+  consoleQuery.enterprise.environmentService.listEnvironments.queryOptions({
+    input: {
+      query: {
+        // The filter lists every deployable environment; environment count is
+        // capped well below the 100-per-page maximum.
+        pageNumber: 1,
+        resultsPerPage: 100,
+      },
+    },
+  }),
+)
diff --git a/web/features/deployments/list/ui/create-deployment-button.tsx b/web/features/deployments/list/ui/create-deployment-button.tsx
new file mode 100644
index 00000000000..75918bfe445
--- /dev/null
+++ b/web/features/deployments/list/ui/create-deployment-button.tsx
@@ -0,0 +1,24 @@
+'use client'
+
+import { cn } from '@langgenius/dify-ui/cn'
+import { useTranslation } from 'react-i18next'
+import Link from '@/next/link'
+
+export function CreateDeploymentButton({ className }: {
+  className?: string
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <Link
+      href="/deployments/create"
+      className={cn(
+        'inline-flex h-8 items-center gap-1.5 rounded-lg bg-primary-600 px-3 system-sm-medium whitespace-nowrap text-text-primary-on-surface hover:bg-primary-700',
+        className,
+      )}
+    >
+      <span className="i-ri-add-line size-4 shrink-0" aria-hidden="true" />
+      <span>{t('list.createDeployment')}</span>
+    </Link>
+  )
+}
diff --git a/web/features/deployments/list/ui/environment-filter.tsx b/web/features/deployments/list/ui/environment-filter.tsx
new file mode 100644
index 00000000000..c8468eec57f
--- /dev/null
+++ b/web/features/deployments/list/ui/environment-filter.tsx
@@ -0,0 +1,111 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { useAtomValue } from 'jotai'
+import { useQueryState } from 'nuqs'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import {
+  envFilterQueryState,
+  environmentsFilterQueryAtom,
+} from '../state'
+
+type EnvironmentFilterOption = {
+  value: string | null
+  text: string
+  icon: ReactNode
+}
+
+function EnvironmentOptionIcon() {
+  return <span className="i-ri-server-line size-[14px]" />
+}
+
+export function EnvironmentFilter({ className }: {
+  className?: string
+}) {
+  const { t } = useTranslation('deployments')
+  const [open, setOpen] = useState(false)
+  const [envFilter, setEnvFilter] = useQueryState('env', envFilterQueryState)
+  const environmentsQuery = useAtomValue(environmentsFilterQueryAtom)
+  const environmentOptions: EnvironmentFilterOption[] = environmentsQuery.data?.environments
+    ?.map(environment => ({
+      value: environment.id,
+      text: environment.displayName,
+      icon: <EnvironmentOptionIcon />,
+    })) ?? []
+  const filterOptions: EnvironmentFilterOption[] = [
+    {
+      value: null,
+      text: t('filter.allEnvs'),
+      icon: <span className="i-ri-apps-2-line size-[14px]" />,
+    },
+    ...environmentOptions,
+  ]
+  const selectedOption = filterOptions.find(option => option.value === envFilter)
+    ?? (envFilter
+      ? {
+          value: envFilter,
+          text: envFilter,
+          icon: <EnvironmentOptionIcon />,
+        }
+      : filterOptions[0])
+  const activeFilter = selectedOption?.value ?? null
+
+  return (
+    <DropdownMenu modal={false} open={open} onOpenChange={setOpen}>
+      <DropdownMenuTrigger
+        className={cn(
+          'flex h-8 max-w-full cursor-pointer items-center gap-1 rounded-lg border border-transparent bg-components-input-bg-normal px-2 text-left select-none',
+          open && 'shadow-xs',
+          className,
+        )}
+      >
+        <div className="p-px text-text-tertiary">
+          {selectedOption?.icon}
+        </div>
+        <div className="max-w-40 min-w-0 truncate system-sm-regular text-text-secondary">
+          {selectedOption?.text}
+        </div>
+        <div className="shrink-0 p-px">
+          <span className={cn('i-ri-arrow-down-s-line size-3.5 text-text-tertiary transition-transform', open && 'rotate-180')} />
+        </div>
+      </DropdownMenuTrigger>
+      {open && (
+        <DropdownMenuContent
+          placement="bottom-start"
+          sideOffset={4}
+          popupClassName="w-60 rounded-lg border border-components-panel-border bg-components-panel-bg-blur shadow-lg backdrop-blur-xs"
+        >
+          <div className="max-h-72 overflow-auto p-1">
+            {filterOptions.map(option => (
+              <DropdownMenuItem
+                key={option.value ?? 'all'}
+                onClick={() => {
+                  void setEnvFilter(option.value)
+                  setOpen(false)
+                }}
+                className={cn(
+                  'flex items-center gap-2 rounded-lg py-1.5 pr-2 pl-3 select-none',
+                  'cursor-pointer hover:bg-state-base-hover',
+                )}
+              >
+                <span className="shrink-0 text-text-tertiary">{option.icon}</span>
+                <span className="grow truncate text-sm/5 text-text-tertiary">{option.text}</span>
+                {option.value === activeFilter && (
+                  <span className="i-custom-vender-line-general-check size-4 shrink-0 text-text-secondary" />
+                )}
+              </DropdownMenuItem>
+            ))}
+          </div>
+        </DropdownMenuContent>
+      )}
+    </DropdownMenu>
+  )
+}
diff --git a/web/features/deployments/list/ui/instance-card-sections.tsx b/web/features/deployments/list/ui/instance-card-sections.tsx
new file mode 100644
index 00000000000..821ebf63144
--- /dev/null
+++ b/web/features/deployments/list/ui/instance-card-sections.tsx
@@ -0,0 +1,236 @@
+'use client'
+
+import type {
+  AccessChannels,
+  EnvironmentDeployment,
+  Release,
+} from '@dify/contracts/enterprise/types.gen'
+import type { ReactElement } from 'react'
+import { ReleaseSource } from '@dify/contracts/enterprise/types.gen'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
+import { PreviewCard, PreviewCardContent, PreviewCardTrigger } from '@langgenius/dify-ui/preview-card'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
+import { useTranslation } from 'react-i18next'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+import Link from '@/next/link'
+import { formatDate } from '../../shared/domain/release'
+import { EnvironmentDeploymentBadge } from '../../shared/ui/deployment-status-badge'
+import { deploymentStatusLabelKey } from '../../shared/ui/deployment-status-style'
+import { getInstanceTabHref } from './instance-card-utils'
+
+const VISIBLE_ENVIRONMENT_COUNT = 3
+
+function releaseSourceLabel(release: Release | undefined, t: ReturnType<typeof useTranslation<'deployments'>>['t']) {
+  if (release?.source === ReleaseSource.RELEASE_SOURCE_SOURCE_APP || release?.sourceAppId)
+    return t('versions.sourceAppOption')
+  if (release?.source === ReleaseSource.RELEASE_SOURCE_UPLOAD)
+    return t('versions.manualDslOption')
+  return '—'
+}
+
+export function ReleaseMetaTooltip({ release, deployed, children }: {
+  release?: Release
+  deployed: boolean
+  children: ReactElement
+}) {
+  const { t } = useTranslation('deployments')
+
+  if (!release)
+    return children
+
+  const rows = [
+    { label: t('card.tooltip.releaseName'), value: release.displayName },
+    { label: t('card.tooltip.deploymentStatus'), value: deployed ? t('card.tooltip.deployed') : t('card.tooltip.notDeployedShort') },
+    { label: t('card.tooltip.source'), value: releaseSourceLabel(release, t) },
+    { label: t('card.tooltip.createdAt'), value: formatDate(release.createdAt) },
+  ]
+
+  return (
+    <PreviewCard>
+      <PreviewCardTrigger render={children} />
+      <PreviewCardContent popupClassName="px-3 py-2">
+        <div className="flex min-w-48 flex-col gap-1">
+          {rows.map(row => (
+            <div key={row.label} className="flex justify-between gap-4">
+              <span className="shrink-0 text-text-tertiary">{row.label}</span>
+              <span className="min-w-0 truncate text-right text-text-secondary">{row.value}</span>
+            </div>
+          ))}
+        </div>
+      </PreviewCardContent>
+    </PreviewCard>
+  )
+}
+
+function EnvironmentChip({ row }: {
+  row: EnvironmentDeployment
+}) {
+  const { t } = useTranslation('deployments')
+  const name = row.environment.displayName
+  const status = row.status
+  const statusLabel = t(deploymentStatusLabelKey(status))
+  const tooltipSummary = [
+    name,
+    row.currentRelease ? row.currentRelease.displayName : undefined,
+    statusLabel,
+  ].filter(Boolean).join(' · ')
+
+  return (
+    <Tooltip>
+      <TooltipTrigger
+        render={(
+          <EnvironmentDeploymentBadge
+            row={row}
+            showStatus={false}
+            summaryLabel={tooltipSummary}
+            className="max-w-44"
+          />
+        )}
+      />
+      <TooltipContent>
+        <span className="whitespace-nowrap text-text-secondary">{tooltipSummary}</span>
+      </TooltipContent>
+    </Tooltip>
+  )
+}
+
+function EnvironmentOverflow({ rows }: {
+  rows: EnvironmentDeployment[]
+}) {
+  const { t } = useTranslation('deployments')
+
+  return (
+    <Popover>
+      <PopoverTrigger
+        render={(
+          <button
+            type="button"
+            className="inline-flex h-5 cursor-pointer items-center rounded-md bg-background-section-burn px-1.5 system-xs-medium text-text-tertiary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          >
+            {t('card.envOverflow', { count: rows.length })}
+          </button>
+        )}
+      />
+      <PopoverContent popupClassName="px-3 py-2">
+        <div className="flex min-w-40 flex-col gap-1">
+          {rows.map((row) => {
+            const status = row.status
+            const summary = [
+              row.environment.displayName,
+              row.currentRelease ? row.currentRelease.displayName : undefined,
+              t(deploymentStatusLabelKey(status)),
+            ].filter(Boolean).join(' · ')
+
+            return (
+              <span key={row.environment.id} className="whitespace-nowrap text-text-secondary">{summary}</span>
+            )
+          })}
+        </div>
+      </PopoverContent>
+    </Popover>
+  )
+}
+
+export function DeploymentStatusContent({
+  rows,
+  emptyAction,
+}: {
+  rows: EnvironmentDeployment[]
+  emptyAction?: ReactElement
+}) {
+  const visibleRows = rows.slice(0, VISIBLE_ENVIRONMENT_COUNT)
+  const overflowRows = rows.slice(VISIBLE_ENVIRONMENT_COUNT)
+
+  if (rows.length > 0) {
+    return (
+      <div className="flex min-w-0 flex-wrap items-center gap-1.5">
+        {visibleRows.map(row => (
+          <EnvironmentChip key={row.environment.id} row={row} />
+        ))}
+        {overflowRows.length > 0 && <EnvironmentOverflow rows={overflowRows} />}
+      </div>
+    )
+  }
+
+  if (emptyAction)
+    return <div className="flex min-w-0 items-center">{emptyAction}</div>
+
+  return null
+}
+
+export function DeploymentAccessLinks({ appInstanceId, access, isLoading }: {
+  appInstanceId: string
+  access?: AccessChannels
+  isLoading?: boolean
+}) {
+  const { t } = useTranslation('deployments')
+
+  if (isLoading) {
+    return (
+      <div role="group" aria-label={t('overview.accessStatus')} className="flex min-w-0 grow items-center gap-2">
+        <SkeletonRectangle className="my-0 size-4 animate-pulse rounded-sm" />
+        <SkeletonRectangle className="my-0 size-4 animate-pulse rounded-sm" />
+      </div>
+    )
+  }
+
+  const links = [
+    ...(access?.webAppEnabled
+      ? [{
+          key: 'webapp',
+          href: getInstanceTabHref(appInstanceId, 'access'),
+          label: t('card.access.webApp'),
+          icon: 'i-ri-global-line',
+        }]
+      : []),
+    ...(access?.webAppEnabled
+      ? [{
+          key: 'cli',
+          href: getInstanceTabHref(appInstanceId, 'access'),
+          label: t('card.access.cli'),
+          icon: 'i-ri-terminal-box-line',
+        }]
+      : []),
+    ...(access?.developerApiEnabled
+      ? [{
+          key: 'api-tokens',
+          href: getInstanceTabHref(appInstanceId, 'api-tokens'),
+          label: t('card.access.api'),
+          icon: 'i-ri-code-s-slash-line',
+        }]
+      : []),
+  ]
+
+  if (links.length === 0) {
+    return (
+      <div role="group" aria-label={t('overview.accessStatus')} className="flex min-w-0 grow items-center gap-1.5 text-text-quaternary">
+        <span aria-hidden className="i-ri-link-unlink size-3.5 shrink-0" />
+        <span className="truncate system-xs-regular">{t('card.access.none')}</span>
+      </div>
+    )
+  }
+
+  return (
+    <div role="group" aria-label={t('overview.accessStatus')} className="flex min-w-0 grow items-center gap-2">
+      {links.map(link => (
+        <Tooltip key={link.key}>
+          <TooltipTrigger
+            render={(
+              <Link
+                href={link.href}
+                aria-label={link.label}
+                className={cn(
+                  'inline-flex h-5 min-w-5 items-center justify-center rounded-md text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary',
+                )}
+              >
+                <span aria-hidden className={cn('size-3.5', link.icon)} />
+              </Link>
+            )}
+          />
+          <TooltipContent>{link.label}</TooltipContent>
+        </Tooltip>
+      ))}
+    </div>
+  )
+}
diff --git a/web/features/deployments/list/ui/instance-card-utils.ts b/web/features/deployments/list/ui/instance-card-utils.ts
new file mode 100644
index 00000000000..dd1b3c40b3d
--- /dev/null
+++ b/web/features/deployments/list/ui/instance-card-utils.ts
@@ -0,0 +1,21 @@
+import type {
+  EnvironmentDeployment,
+  Release,
+} from '@dify/contracts/enterprise/types.gen'
+import type { InstanceDetailTabKey } from '../../detail/tabs'
+import { isUndeployedDeploymentRow } from '../../shared/domain/runtime-status'
+
+export function getInstanceTabHref(appInstanceId: string, tabKey: InstanceDetailTabKey) {
+  return `/deployments/${appInstanceId}/${tabKey}`
+}
+
+export function isActiveDeployment(row: EnvironmentDeployment) {
+  return !isUndeployedDeploymentRow(row)
+}
+
+export function isReleaseDeployed(release: Release | undefined, rows: EnvironmentDeployment[]) {
+  if (!release)
+    return false
+
+  return rows.some(row => row.currentRelease?.id === release.id)
+}
diff --git a/web/features/deployments/list/ui/instance-card.tsx b/web/features/deployments/list/ui/instance-card.tsx
new file mode 100644
index 00000000000..4f4649c134f
--- /dev/null
+++ b/web/features/deployments/list/ui/instance-card.tsx
@@ -0,0 +1,129 @@
+'use client'
+
+import type {
+  AppInstanceSummary,
+} from '@dify/contracts/enterprise/types.gen'
+import { Button } from '@langgenius/dify-ui/button'
+import { useSetAtom } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
+import Link from '@/next/link'
+import { DeploymentActionsMenu } from '../../components/deployment-actions'
+import { CreateReleaseControl } from '../../create-release'
+import { openDeployDrawerAtom } from '../../deploy-drawer/state'
+import {
+  DeploymentAccessLinks,
+  DeploymentStatusContent,
+  ReleaseMetaTooltip,
+} from './instance-card-sections'
+import {
+  getInstanceTabHref,
+  isActiveDeployment,
+  isReleaseDeployed,
+} from './instance-card-utils'
+
+export function InstanceCard({ summary }: {
+  summary: AppInstanceSummary
+}) {
+  const { t } = useTranslation('deployments')
+  const { formatTimeFromNow } = useFormatTimeFromNow()
+  const openDeployDrawer = useSetAtom(openDeployDrawerAtom)
+  const appInstance = summary.appInstance
+  const appInstanceId = appInstance.id
+  const appName = appInstance.displayName
+  const detailHref = getInstanceTabHref(appInstanceId, 'overview')
+  const description = appInstance.description.trim()
+  const access = summary.accessChannels
+  const releaseRows = summary.latestRelease ? [summary.latestRelease] : []
+  const hasRelease = releaseRows.length > 0
+  const activeDeploymentRows = summary.environmentDeployments.filter(isActiveDeployment)
+  const latestRelease = releaseRows[0]
+  const latestReleaseTime = latestRelease?.createdAt
+  const latestReleaseTimeMs = latestReleaseTime ? Date.parse(latestReleaseTime) : Number.NaN
+  const latestReleaseDeployed = isReleaseDeployed(latestRelease, activeDeploymentRows)
+  const releaseMeta = latestRelease
+    ? [
+        latestRelease.displayName,
+        Number.isNaN(latestReleaseTimeMs) ? undefined : formatTimeFromNow(latestReleaseTimeMs),
+      ].filter(Boolean).join(' · ')
+    : t('card.notDeployed')
+  const showDeployAction = hasRelease && activeDeploymentRows.length === 0
+  const showFooterCreateReleaseAction = !hasRelease
+
+  return (
+    <div
+      className="group relative col-span-1 inline-flex min-h-40 min-w-0 cursor-default flex-col rounded-xl border border-solid border-components-card-border bg-components-card-bg shadow-xs transition-[border-color,box-shadow] duration-200 ease-in-out hover:border-components-panel-border-subtle hover:shadow-md"
+    >
+      <DeploymentActionsMenu
+        appInstanceId={appInstanceId}
+        appName={appName}
+        placement="bottom-end"
+        sideOffset={4}
+        className="pointer-events-none absolute top-3 right-3 z-10 opacity-0 transition-opacity group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100"
+        triggerClassName="data-popup-open:pointer-events-auto data-popup-open:opacity-100"
+      />
+      <div className="flex min-h-0 flex-1 flex-col">
+        <Link
+          href={detailHref}
+          className="block min-w-0 rounded-t-xl px-4 pt-4 outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+        >
+          <h3 className="truncate title-md-semi-bold text-text-primary">
+            {appName}
+          </h3>
+          {description
+            ? (
+                <p className="mt-2 line-clamp-2 system-xs-regular text-text-tertiary">
+                  {description}
+                </p>
+              )
+            : (
+                <p className="mt-2 truncate system-xs-regular text-text-quaternary">
+                  {t('card.noDescription')}
+                </p>
+              )}
+        </Link>
+
+        <div role="group" aria-label={t('card.tooltip.deploymentStatus')} className="min-h-8 px-4 pt-4 pb-3">
+          <DeploymentStatusContent
+            rows={activeDeploymentRows}
+            emptyAction={showDeployAction
+              ? (
+                  <Button
+                    variant="secondary-accent"
+                    size="small"
+                    className="max-w-full"
+                    onClick={() => openDeployDrawer({ appInstanceId })}
+                  >
+                    <span className="truncate">{t('card.menu.deploy')}</span>
+                  </Button>
+                )
+              : undefined}
+          />
+        </div>
+
+        <div className="mt-auto flex min-h-11 min-w-0 items-center gap-3 border-t border-divider-subtle px-4 py-2">
+          {showFooterCreateReleaseAction
+            ? (
+                <div className="-ml-2 flex min-w-0 grow items-center">
+                  <CreateReleaseControl
+                    appInstanceId={appInstanceId}
+                    variant="secondary-accent"
+                    label={t('card.createFirstRelease')}
+                    className="max-w-full"
+                  />
+                </div>
+              )
+            : <DeploymentAccessLinks appInstanceId={appInstanceId} access={access} />}
+          <ReleaseMetaTooltip release={latestRelease} deployed={latestReleaseDeployed}>
+            <Link
+              href={latestRelease ? getInstanceTabHref(appInstanceId, 'releases') : getInstanceTabHref(appInstanceId, 'instances')}
+              className="min-w-0 shrink truncate text-right system-xs-medium text-text-secondary hover:text-text-primary"
+            >
+              {releaseMeta}
+            </Link>
+          </ReleaseMetaTooltip>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/deployments/list/ui/shell.tsx b/web/features/deployments/list/ui/shell.tsx
new file mode 100644
index 00000000000..d564fa0114e
--- /dev/null
+++ b/web/features/deployments/list/ui/shell.tsx
@@ -0,0 +1,224 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Input } from '@langgenius/dify-ui/input'
+import { useAtomValue } from 'jotai'
+import { debounce, useQueryState } from 'nuqs'
+import { useEffect, useRef } from 'react'
+import { useTranslation } from 'react-i18next'
+import { StudioListHeader } from '@/app/components/apps/studio-list-header'
+import { SkeletonRectangle } from '@/app/components/base/skeleton'
+import { DeploymentEmptyState, DeploymentStateMessage } from '../../components/empty-state'
+import {
+  deploymentsListHasFilterAtom,
+  deploymentsListQueryAtom,
+  deploymentsListRowsAtom,
+  deploymentsListShowEmptyStateAtom,
+  deploymentsListShowSkeletonAtom,
+  envFilterQueryState,
+  keywordsQueryState,
+} from '../state'
+import { CreateDeploymentButton } from './create-deployment-button'
+import { EnvironmentFilter } from './environment-filter'
+import { InstanceCard } from './instance-card'
+
+const INSTANCE_CARD_SKELETON_KEYS = ['first', 'second', 'third', 'fourth', 'fifth', 'sixth']
+
+function DeploymentsListState({ children }: {
+  children: ReactNode
+}) {
+  return <DeploymentStateMessage variant="page">{children}</DeploymentStateMessage>
+}
+
+function DeploymentsListEmpty() {
+  const { t } = useTranslation('deployments')
+  const hasAtomFilter = useAtomValue(deploymentsListHasFilterAtom)
+  const [keywords, setKeywords] = useQueryState('keywords', keywordsQueryState)
+  const [envFilter, setEnvFilter] = useQueryState('env', envFilterQueryState)
+  const hasFilter = hasAtomFilter || Boolean(keywords.trim()) || Boolean(envFilter)
+
+  function clearFilters() {
+    void setKeywords(null)
+    void setEnvFilter(null)
+  }
+
+  return (
+    <DeploymentEmptyState
+      variant="page"
+      icon={hasFilter ? 'i-ri-search-line' : 'i-ri-rocket-line'}
+      title={hasFilter ? t('list.emptyFilteredTitle') : t('list.emptyTitle')}
+      description={hasFilter ? t('list.emptyFilteredDescription') : t('list.emptyDescription')}
+      action={hasFilter
+        ? (
+            <Button variant="secondary" size="small" onClick={clearFilters}>
+              {t('list.clearFilters')}
+            </Button>
+          )
+        : <CreateDeploymentButton />}
+    />
+  )
+}
+
+function InstanceCardSkeleton() {
+  return (
+    <div className="col-span-1 inline-flex min-h-40 min-w-0 flex-col rounded-xl border border-solid border-components-card-border bg-components-card-bg shadow-xs">
+      <div className="flex min-h-0 flex-1 flex-col">
+        <div className="min-w-0 px-4 pt-4">
+          <SkeletonRectangle className="my-0 h-4 w-2/5 animate-pulse" />
+          <SkeletonRectangle className="mt-2 h-3 w-3/5 animate-pulse" />
+        </div>
+
+        <div className="min-h-8 px-4 pt-4">
+          <div className="flex min-w-0 items-center gap-1.5">
+            <SkeletonRectangle className="my-0 h-5 w-18 animate-pulse rounded-md" />
+            <SkeletonRectangle className="my-0 h-5 w-22 animate-pulse rounded-md" />
+          </div>
+        </div>
+
+        <div className="mt-auto flex h-11 min-w-0 items-center border-t border-divider-subtle px-4">
+          <div className="flex min-w-0 grow items-center gap-2">
+            <SkeletonRectangle className="my-0 size-3.5 animate-pulse rounded-sm" />
+            <SkeletonRectangle className="my-0 h-3 w-18 animate-pulse" />
+          </div>
+          <SkeletonRectangle className="my-0 h-3 w-24 animate-pulse" />
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function DeploymentsListSkeleton() {
+  return INSTANCE_CARD_SKELETON_KEYS.map(key => (
+    <InstanceCardSkeleton key={key} />
+  ))
+}
+
+function DeploymentsSearchInput({ className }: {
+  className?: string
+}) {
+  const { t } = useTranslation('deployments')
+  const [keywords, setKeywords] = useQueryState('keywords', keywordsQueryState)
+
+  function handleKeywordsChange(next: string) {
+    void setKeywords(next.trim() ? next : null, {
+      limitUrlUpdates: next.trim() ? debounce(300) : undefined,
+      shallow: false,
+    })
+  }
+
+  return (
+    <div className={cn('relative w-50', className)}>
+      <span aria-hidden className="pointer-events-none absolute top-1/2 left-2.5 i-ri-search-line size-4 -translate-y-1/2 text-text-tertiary" />
+      <Input
+        className="h-8 pr-8 pl-8"
+        aria-label={t('filter.searchPlaceholder')}
+        placeholder={t('filter.searchPlaceholder')}
+        value={keywords}
+        onChange={e => handleKeywordsChange(e.target.value)}
+      />
+      {keywords && (
+        <button
+          type="button"
+          aria-label={t('list.clearSearch')}
+          className="absolute top-1/2 right-2.5 flex size-4 -translate-y-1/2 items-center justify-center text-text-quaternary hover:text-text-secondary"
+          onClick={() => handleKeywordsChange('')}
+        >
+          <span aria-hidden className="i-ri-close-circle-fill size-4" />
+        </button>
+      )}
+    </div>
+  )
+}
+
+function DeploymentsListControls() {
+  const { t } = useTranslation()
+
+  return (
+    <StudioListHeader
+      title={(
+        <div className="flex items-center">
+          <h1 className="text-[18px]/[21.6px] font-semibold text-text-primary">{t('menus.deployments', { ns: 'common' })}</h1>
+        </div>
+      )}
+    >
+      <div className="flex min-w-0 flex-col gap-2 sm:flex-row sm:items-center sm:gap-3">
+        <div className="flex min-w-0 items-center justify-between gap-2 sm:justify-start">
+          <EnvironmentFilter className="min-w-0" />
+          <CreateDeploymentButton className="shrink-0 sm:hidden" />
+        </div>
+        <DeploymentsSearchInput className="w-full sm:w-50 sm:shrink-0" />
+        <CreateDeploymentButton className="hidden shrink-0 sm:ml-auto sm:inline-flex" />
+      </div>
+    </StudioListHeader>
+  )
+}
+
+export function DeploymentsListShell() {
+  const { t } = useTranslation('deployments')
+  const containerRef = useRef<HTMLDivElement>(null)
+  const anchorRef = useRef<HTMLDivElement>(null)
+  const deploymentsListQuery = useAtomValue(deploymentsListQueryAtom)
+  const appInstanceSummaries = useAtomValue(deploymentsListRowsAtom)
+  const showSkeleton = useAtomValue(deploymentsListShowSkeletonAtom)
+  const showEmptyState = useAtomValue(deploymentsListShowEmptyStateAtom)
+  const {
+    error,
+    fetchNextPage,
+    hasNextPage,
+    isError,
+    isFetchingNextPage,
+    isLoading,
+  } = deploymentsListQuery
+
+  useEffect(() => {
+    if (!hasNextPage || isLoading || isFetchingNextPage || error)
+      return
+
+    const anchor = anchorRef.current
+    const container = containerRef.current
+    if (!anchor || !container)
+      return
+
+    const observer = new IntersectionObserver((entries) => {
+      if (entries[0]?.isIntersecting)
+        void fetchNextPage()
+    }, {
+      root: container,
+      rootMargin: '160px',
+      threshold: 0.1,
+    })
+
+    observer.observe(anchor)
+    return () => observer.disconnect()
+  }, [error, fetchNextPage, hasNextPage, isFetchingNextPage, isLoading])
+
+  return (
+    <div ref={containerRef} className="relative flex h-0 shrink-0 grow flex-col overflow-y-auto bg-background-body">
+      <DeploymentsListControls />
+      <div className={cn(
+        'relative grid grow grid-cols-[repeat(auto-fill,minmax(min(100%,20rem),1fr))] content-start gap-4 px-8 pt-2',
+        showEmptyState && 'overflow-hidden',
+      )}
+      >
+        {showSkeleton
+          ? <DeploymentsListSkeleton />
+          : isError
+            ? <DeploymentsListState>{t('common.loadFailed')}</DeploymentsListState>
+            : appInstanceSummaries.length === 0
+              ? <DeploymentsListEmpty />
+              : appInstanceSummaries.map(summary => (
+                  <InstanceCard
+                    key={summary.appInstance.id}
+                    summary={summary}
+                  />
+                ))}
+        {isFetchingNextPage && <DeploymentsListSkeleton />}
+      </div>
+
+      <div ref={anchorRef} className="h-0" />
+      <div className="py-4" />
+    </div>
+  )
+}
diff --git a/web/features/deployments/nav/index.tsx b/web/features/deployments/nav/index.tsx
new file mode 100644
index 00000000000..ce5de6055d3
--- /dev/null
+++ b/web/features/deployments/nav/index.tsx
@@ -0,0 +1,114 @@
+'use client'
+
+import type { AppInstance } from '@dify/contracts/enterprise/types.gen'
+import type { NavItem } from '@/app/components/header/nav/nav-selector'
+import { keepPreviousData, useInfiniteQuery, useQuery } from '@tanstack/react-query'
+import { useTranslation } from 'react-i18next'
+import Nav from '@/app/components/header/nav'
+import { useParams, useRouter, useSelectedLayoutSegment } from '@/next/navigation'
+import { consoleQuery } from '@/service/client'
+import { getNextPageParamFromPagination, SOURCE_APPS_PAGE_SIZE } from '../shared/domain/pagination'
+
+function navItemFromListApp(app: AppInstance): NavItem {
+  const id = app.id
+
+  return {
+    id,
+    name: app.displayName,
+    link: `/deployments/${id}/overview`,
+    icon_type: 'emoji',
+    icon: '🚀',
+    icon_background: '#E0EAFF',
+    icon_url: null,
+  }
+}
+
+function navItemFromOverview(instance?: AppInstance, fallbackId?: string): NavItem | undefined {
+  const id = instance?.id ?? fallbackId
+  if (!id)
+    return undefined
+
+  return {
+    id,
+    name: instance ? instance.displayName : id,
+    link: `/deployments/${id}/overview`,
+    icon_type: 'emoji',
+    icon: '🚀',
+    icon_background: '#E0EAFF',
+    icon_url: null,
+  }
+}
+
+export function DeploymentsNav() {
+  const { t } = useTranslation()
+  const router = useRouter()
+  const selectedSegment = useSelectedLayoutSegment()
+  const isActive = selectedSegment === 'deployments'
+  const params = useParams<{ appInstanceId?: string }>()
+  const appInstanceId = params?.appInstanceId
+
+  const { data: currentInstance } = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
+    input: {
+      params: {
+        appInstanceId: appInstanceId ?? '',
+      },
+    },
+    enabled: isActive && Boolean(appInstanceId),
+    select: data => data.appInstance,
+  }))
+
+  const listQuery = useInfiniteQuery({
+    ...consoleQuery.enterprise.appInstanceService.listAppInstances.infiniteOptions({
+      input: pageParam => ({
+        query: {
+          pageNumber: Number(pageParam),
+          resultsPerPage: SOURCE_APPS_PAGE_SIZE,
+        },
+      }),
+      getNextPageParam: lastPage => getNextPageParamFromPagination(lastPage.pagination),
+      initialPageParam: 1,
+      placeholderData: keepPreviousData,
+    }),
+    enabled: isActive,
+  })
+  const appNavItems = listQuery.data?.pages.flatMap(page =>
+    page.appInstances.map(navItemFromListApp),
+  ) ?? []
+  const currentNavItem = navItemFromOverview(currentInstance, appInstanceId)
+
+  const navigationItems: NavItem[] = isActive
+    ? currentNavItem && !appNavItems.some(item => item.id === currentNavItem.id)
+      ? [...appNavItems, currentNavItem]
+      : appNavItems
+    : []
+
+  const curNav = appInstanceId
+    ? navigationItems.find(item => item.id === appInstanceId)
+    : undefined
+
+  function handleCreate() {
+    router.push('/deployments/create')
+  }
+
+  function handleLoadMore() {
+    if (listQuery.hasNextPage && !listQuery.isFetchingNextPage)
+      void listQuery.fetchNextPage()
+  }
+
+  return (
+    <Nav
+      isApp={false}
+      icon={<span aria-hidden className="i-ri-rocket-line size-4" />}
+      activeIcon={<span aria-hidden className="i-ri-rocket-fill size-4" />}
+      text={t('menus.deployments', { ns: 'common' })}
+      activeSegment="deployments"
+      link="/deployments"
+      curNav={curNav}
+      navigationItems={navigationItems}
+      createText={t('deployments:list.createDeployment')}
+      onCreate={handleCreate}
+      onLoadMore={handleLoadMore}
+      isLoadingMore={listQuery.isFetchingNextPage}
+    />
+  )
+}
diff --git a/web/features/deployments/shared/domain/dsl.ts b/web/features/deployments/shared/domain/dsl.ts
new file mode 100644
index 00000000000..5bfcd7c4178
--- /dev/null
+++ b/web/features/deployments/shared/domain/dsl.ts
@@ -0,0 +1,150 @@
+import { load as yamlLoad } from 'js-yaml'
+import { AppModeEnum } from '@/types/app'
+
+export type DslEnvVarSlot = {
+  key: string
+  description?: string
+  defaultValue?: string
+  hasDefaultValue?: boolean
+  valueType?: string
+}
+
+type DslMetadata = {
+  app?: {
+    mode?: unknown
+    name?: unknown
+  }
+  workflow?: {
+    environment_variables?: unknown
+  }
+}
+
+type DslEnvVarRecord = Record<string, unknown>
+
+const ENV_VAR_DEFAULT_VALUE_FIELDS = ['value', 'default_value', 'defaultValue', 'default'] as const
+const ENV_VAR_VALUE_TYPE_FIELDS = ['value_type', 'valueType', 'type'] as const
+const MASKED_SECRET_PLACEHOLDERS = new Set(['[__HIDDEN__]'])
+
+export function encodeDslContent(value: string) {
+  const bytes = new TextEncoder().encode(value)
+  const chunkSize = 0x8000
+  const chunks: string[] = []
+
+  for (let offset = 0; offset < bytes.length; offset += chunkSize)
+    chunks.push(String.fromCharCode(...bytes.subarray(offset, offset + chunkSize)))
+
+  return btoa(chunks.join(''))
+}
+
+function parseDsl(content: string) {
+  try {
+    return yamlLoad(content) as DslMetadata | undefined
+  }
+  catch {
+    return undefined
+  }
+}
+
+function isRecord(value: unknown): value is DslEnvVarRecord {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
+
+function stringValue(value: unknown) {
+  return typeof value === 'string' ? value.trim() : ''
+}
+
+function normalizeEnvVarDefaultValue(value: unknown) {
+  if (value === undefined || value === null)
+    return undefined
+
+  let normalizedValue: string | undefined
+  if (typeof value === 'string') {
+    normalizedValue = value
+  }
+  else if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {
+    normalizedValue = String(value)
+  }
+  else {
+    try {
+      normalizedValue = JSON.stringify(value)
+    }
+    catch {
+      normalizedValue = undefined
+    }
+  }
+
+  if (!normalizedValue?.trim())
+    return undefined
+  if (MASKED_SECRET_PLACEHOLDERS.has(normalizedValue))
+    return undefined
+
+  return normalizedValue
+}
+
+function envVarDefaultValue(record: DslEnvVarRecord) {
+  for (const field of ENV_VAR_DEFAULT_VALUE_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(record, field))
+      return normalizeEnvVarDefaultValue(record[field])
+  }
+
+  return undefined
+}
+
+function envVarValueType(record: DslEnvVarRecord) {
+  for (const field of ENV_VAR_VALUE_TYPE_FIELDS) {
+    const valueType = stringValue(record[field])
+    if (valueType)
+      return valueType
+  }
+
+  return undefined
+}
+
+export function dslAppName(content: string) {
+  const name = parseDsl(content)?.app?.name
+
+  return typeof name === 'string' ? name.trim() : ''
+}
+
+function dslAppMode(content: string) {
+  return stringValue(parseDsl(content)?.app?.mode)
+}
+
+export function isWorkflowDsl(content: string) {
+  return dslAppMode(content) === AppModeEnum.WORKFLOW
+}
+
+export function dslEnvVarSlots(content: string): DslEnvVarSlot[] {
+  const environmentVariables = parseDsl(content)?.workflow?.environment_variables
+  if (!Array.isArray(environmentVariables))
+    return []
+
+  const seenKeys = new Set<string>()
+
+  return environmentVariables
+    .flatMap((envVar): DslEnvVarSlot[] => {
+      if (!isRecord(envVar))
+        return []
+
+      const key = stringValue(envVar.name ?? envVar.key ?? envVar.variable)
+      if (!key || seenKeys.has(key))
+        return []
+
+      seenKeys.add(key)
+      const description = stringValue(envVar.description)
+      const defaultValue = envVarDefaultValue(envVar)
+      const valueType = envVarValueType(envVar)
+
+      return [{
+        key,
+        ...(description ? { description } : {}),
+        ...(valueType ? { valueType } : {}),
+        ...(defaultValue !== undefined
+          ? {
+              defaultValue,
+              hasDefaultValue: true,
+            }
+          : {}),
+      }]
+    })
+}
diff --git a/web/features/deployments/shared/domain/error.ts b/web/features/deployments/shared/domain/error.ts
new file mode 100644
index 00000000000..819f794ecb9
--- /dev/null
+++ b/web/features/deployments/shared/domain/error.ts
@@ -0,0 +1,137 @@
+type DeploymentErrorPayload = {
+  message?: unknown
+  error?: unknown
+  reason?: unknown
+  code?: unknown
+  metadata?: unknown
+  unsupported_nodes?: unknown
+}
+
+const APP_DEPLOY_UNSUPPORTED_DSL_NODE_TYPE = 'APPDEPLOY_UNSUPPORTED_DSL_NODE_TYPE'
+
+export type UnsupportedDslNode = {
+  id?: string
+  type?: string
+}
+
+export type UnsupportedDslNodeError = {
+  message?: string
+  nodes: UnsupportedDslNode[]
+}
+
+function nonEmptyString(value: unknown) {
+  if (typeof value !== 'string')
+    return undefined
+
+  const trimmedValue = value.trim()
+  return trimmedValue || undefined
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function formatDeploymentError(data: DeploymentErrorPayload) {
+  const message = nonEmptyString(data.message) ?? nonEmptyString(data.error)
+  const reason = nonEmptyString(data.reason) ?? nonEmptyString(data.code)
+
+  if (message && reason)
+    return `${message} (${reason})`
+
+  return message ?? reason
+}
+
+async function deploymentErrorData(error: unknown) {
+  if (error instanceof Response && !error.bodyUsed) {
+    try {
+      return await error.clone().json() as DeploymentErrorPayload
+    }
+    catch {}
+  }
+
+  return undefined
+}
+
+function deploymentErrorReason(data: DeploymentErrorPayload) {
+  return nonEmptyString(data.reason) ?? nonEmptyString(data.code)
+}
+
+function unsupportedNodesPayload(data: DeploymentErrorPayload) {
+  if (isRecord(data.metadata))
+    return data.metadata.unsupported_nodes
+
+  return data.unsupported_nodes
+}
+
+function parsedJsonValue(value: string) {
+  try {
+    return JSON.parse(value) as unknown
+  }
+  catch {
+    return undefined
+  }
+}
+
+function unsupportedDslNode(value: unknown) {
+  if (!isRecord(value))
+    return undefined
+
+  const id = nonEmptyString(value.id)
+  const type = nonEmptyString(value.type)
+  if (!id && !type)
+    return undefined
+
+  return {
+    ...(id ? { id } : {}),
+    ...(type ? { type } : {}),
+  } satisfies UnsupportedDslNode
+}
+
+function unsupportedDslNodes(value: unknown) {
+  const nodeList = typeof value === 'string' ? parsedJsonValue(value) : value
+  if (!Array.isArray(nodeList))
+    return []
+
+  const seen = new Set<string>()
+  const nodes: UnsupportedDslNode[] = []
+
+  nodeList.forEach((item) => {
+    const node = unsupportedDslNode(item)
+    if (!node)
+      return
+
+    const key = `${node.id}\u0000${node.type}`
+    if (seen.has(key))
+      return
+
+    seen.add(key)
+    nodes.push(node)
+  })
+
+  return nodes
+}
+
+export async function unsupportedDslNodeError(error: unknown): Promise<UnsupportedDslNodeError | undefined> {
+  const errorData = await deploymentErrorData(error)
+  if (!errorData)
+    return undefined
+
+  if (deploymentErrorReason(errorData) !== APP_DEPLOY_UNSUPPORTED_DSL_NODE_TYPE)
+    return undefined
+
+  return {
+    message: formatDeploymentError(errorData),
+    nodes: unsupportedDslNodes(unsupportedNodesPayload(errorData)),
+  }
+}
+
+export async function deploymentErrorMessage(error: unknown) {
+  const errorData = await deploymentErrorData(error)
+  if (errorData)
+    return formatDeploymentError(errorData)
+
+  if (error instanceof Error)
+    return nonEmptyString(error.message)
+
+  return undefined
+}
diff --git a/web/features/deployments/shared/domain/idempotency.ts b/web/features/deployments/shared/domain/idempotency.ts
new file mode 100644
index 00000000000..c9056c38648
--- /dev/null
+++ b/web/features/deployments/shared/domain/idempotency.ts
@@ -0,0 +1,6 @@
+export function createDeploymentIdempotencyKey() {
+  if (globalThis.crypto?.randomUUID)
+    return globalThis.crypto.randomUUID()
+
+  return `deployment-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`
+}
diff --git a/web/features/deployments/shared/domain/pagination.ts b/web/features/deployments/shared/domain/pagination.ts
new file mode 100644
index 00000000000..a474cddec06
--- /dev/null
+++ b/web/features/deployments/shared/domain/pagination.ts
@@ -0,0 +1,12 @@
+import type { Pagination } from '@dify/contracts/enterprise/types.gen'
+
+export const DEPLOYMENT_PAGE_SIZE = 100
+export const RELEASE_HISTORY_PAGE_SIZE = 20
+export const SOURCE_APPS_PAGE_SIZE = 100
+
+export function getNextPageParamFromPagination(pagination?: Pagination) {
+  const currentPage = pagination?.currentPage ?? 1
+  const totalPages = pagination?.totalPages ?? 1
+
+  return currentPage < totalPages ? currentPage + 1 : undefined
+}
diff --git a/web/features/deployments/shared/domain/release-action.ts b/web/features/deployments/shared/domain/release-action.ts
new file mode 100644
index 00000000000..3e499b547ba
--- /dev/null
+++ b/web/features/deployments/shared/domain/release-action.ts
@@ -0,0 +1,69 @@
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+
+export type ReleaseDeploymentAction = 'deploy' | 'deployExistingRelease' | 'promote' | 'rollback'
+
+function releaseCreatedAt(release: Release) {
+  const time = Date.parse(release.createdAt)
+  return Number.isFinite(time) ? time : undefined
+}
+
+function releaseById(releaseRows: Release[], releaseId?: string) {
+  return releaseRows.find(release => release.id === releaseId)
+}
+
+function releaseOrderIndex(releaseRows: Release[], releaseId?: string) {
+  return releaseRows.findIndex(release => release.id === releaseId)
+}
+
+function compareReleaseOrder(
+  targetRelease: Release | undefined,
+  currentRelease: Release,
+  releaseRows: Release[],
+) {
+  if (!targetRelease)
+    return undefined
+  if (targetRelease.id === currentRelease.id)
+    return 0
+
+  const normalizedTargetRelease = releaseById(releaseRows, targetRelease.id) ?? targetRelease
+  const normalizedCurrentRelease = releaseById(releaseRows, currentRelease.id) ?? currentRelease
+  const targetCreatedAt = releaseCreatedAt(normalizedTargetRelease)
+  const currentCreatedAt = releaseCreatedAt(normalizedCurrentRelease)
+
+  if (targetCreatedAt !== undefined && currentCreatedAt !== undefined && targetCreatedAt !== currentCreatedAt)
+    return targetCreatedAt > currentCreatedAt ? 1 : -1
+
+  const targetIndex = releaseOrderIndex(releaseRows, targetRelease.id)
+  const currentIndex = releaseOrderIndex(releaseRows, currentRelease.id)
+  if (targetIndex >= 0 && currentIndex >= 0 && targetIndex !== currentIndex)
+    return targetIndex < currentIndex ? 1 : -1
+
+  return undefined
+}
+
+export function releaseDeploymentAction({
+  targetRelease,
+  currentRelease,
+  releaseRows,
+  isExistingRelease,
+}: {
+  targetRelease?: Release
+  currentRelease?: Release
+  releaseRows: Release[]
+  isExistingRelease?: boolean
+}): ReleaseDeploymentAction {
+  if (!currentRelease)
+    return isExistingRelease ? 'deployExistingRelease' : 'deploy'
+
+  const order = compareReleaseOrder(targetRelease, currentRelease, releaseRows)
+  if (order === -1)
+    return 'rollback'
+  if (order === 1)
+    return 'promote'
+
+  return targetRelease && targetRelease.id !== currentRelease.id
+    ? 'promote'
+    : isExistingRelease
+      ? 'deployExistingRelease'
+      : 'deploy'
+}
diff --git a/web/features/deployments/shared/domain/release.ts b/web/features/deployments/shared/domain/release.ts
new file mode 100644
index 00000000000..c5bd71abe82
--- /dev/null
+++ b/web/features/deployments/shared/domain/release.ts
@@ -0,0 +1,17 @@
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import { formatTime } from '@/utils/time'
+
+export function formatDate(value?: string) {
+  if (!value)
+    return '—'
+
+  const date = new Date(value)
+  if (Number.isNaN(date.getTime()))
+    return value.replace('T', ' ').replace(/\.\d+Z?$/, '').replace(/Z$/, '').slice(0, 16)
+
+  return formatTime({ date, dateFormat: 'YYYY-MM-DD HH:mm' })
+}
+
+export function releaseCommit(release?: Release) {
+  return release?.gateCommitId ? release.gateCommitId.slice(0, 8) : '—'
+}
diff --git a/web/features/deployments/shared/domain/runtime-status.ts b/web/features/deployments/shared/domain/runtime-status.ts
new file mode 100644
index 00000000000..9a2540047c1
--- /dev/null
+++ b/web/features/deployments/shared/domain/runtime-status.ts
@@ -0,0 +1,30 @@
+import type { EnvironmentDeployment, RuntimeInstanceStatus as RuntimeInstanceStatusValue } from '@dify/contracts/enterprise/types.gen'
+import { RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+
+const DEPLOYMENT_STATUS_POLLING_INTERVAL = 3000
+
+export function isUndeployedDeploymentRow(row: EnvironmentDeployment) {
+  const status = row.status
+  return status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED
+    || (status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED
+      && !row.currentRelease
+      && !row.desiredRelease
+      && !row.currentDeployment)
+}
+
+export function hasRuntimeInstanceDeployment(row: EnvironmentDeployment) {
+  return !isUndeployedDeploymentRow(row)
+}
+
+export function isAvailableDeploymentTarget(row: EnvironmentDeployment) {
+  return isUndeployedDeploymentRow(row)
+}
+
+export function isRuntimeDeploymentInProgress(status?: RuntimeInstanceStatusValue) {
+  return status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING
+    || status === RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING
+}
+
+export function deploymentStatusPollingInterval(rows?: EnvironmentDeployment[]) {
+  return rows?.some(row => isRuntimeDeploymentInProgress(row.status)) ? DEPLOYMENT_STATUS_POLLING_INTERVAL : false
+}
diff --git a/web/features/deployments/shared/ui/__tests__/deployment-status-badge.spec.tsx b/web/features/deployments/shared/ui/__tests__/deployment-status-badge.spec.tsx
new file mode 100644
index 00000000000..57056eaa90c
--- /dev/null
+++ b/web/features/deployments/shared/ui/__tests__/deployment-status-badge.spec.tsx
@@ -0,0 +1,52 @@
+import { RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+import { render, screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+import { DeploymentStatusBadge } from '../deployment-status-badge'
+
+describe('DeploymentStatusBadge', () => {
+  it('should keep the original badge style by default', () => {
+    const { container } = render(
+      <DeploymentStatusBadge
+        status={RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY}
+        label="Running"
+      />,
+    )
+
+    const badge = screen.getByText('Running').parentElement
+
+    expect(badge).toHaveClass('border', 'rounded-md', 'bg-util-colors-green-green-50', 'system-2xs-medium-uppercase')
+    expect(container.querySelector('.bg-util-colors-green-green-500')).not.toBeInTheDocument()
+    expect(container.querySelector('.shadow-status-indicator-green-shadow')).toBeInTheDocument()
+  })
+
+  it('should render the status-dot variant like knowledge list status', () => {
+    const { container } = render(
+      <DeploymentStatusBadge
+        status={RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY}
+        label="Running"
+        variant="status-dot"
+      />,
+    )
+
+    const badge = screen.getByText('Running').parentElement
+
+    expect(badge).not.toHaveClass('border', 'rounded-md', 'bg-util-colors-green-green-50')
+    expect(badge).toHaveClass('system-2xs-medium-uppercase')
+    expect(screen.getByText('Running')).not.toHaveClass('text-sm')
+    expect(screen.getByText('Running')).toHaveClass('text-util-colors-green-green-600')
+    expect(container.querySelector('.shadow-status-indicator-green-shadow')).toBeInTheDocument()
+  })
+
+  it('should keep the status dot pulsing for in-progress statuses', () => {
+    const { container } = render(
+      <DeploymentStatusBadge
+        status={RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING}
+        label="Deploying"
+        variant="status-dot"
+      />,
+    )
+
+    expect(screen.getByText('Deploying')).toHaveClass('text-util-colors-blue-light-blue-light-600')
+    expect(container.querySelector('.shadow-status-indicator-blue-shadow')).toHaveClass('animate-pulse')
+  })
+})
diff --git a/web/features/deployments/shared/ui/deployment-status-badge.tsx b/web/features/deployments/shared/ui/deployment-status-badge.tsx
new file mode 100644
index 00000000000..dadb3953f4d
--- /dev/null
+++ b/web/features/deployments/shared/ui/deployment-status-badge.tsx
@@ -0,0 +1,123 @@
+'use client'
+
+import type {
+  EnvironmentDeployment,
+  RuntimeInstanceStatus as RuntimeInstanceStatusValue,
+} from '@dify/contracts/enterprise/types.gen'
+import type { ComponentPropsWithRef } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+import { StatusDot } from '@langgenius/dify-ui/status-dot'
+import { useTranslation } from 'react-i18next'
+import { isRuntimeDeploymentInProgress } from '../domain/runtime-status'
+import {
+  deploymentStatusDotStatus,
+  deploymentStatusDotTextClassName,
+  deploymentStatusLabelKey,
+  deploymentStatusToneClassNames,
+} from './deployment-status-style'
+
+type DeploymentStatusBadgeProps = Omit<ComponentPropsWithRef<'span'>, 'children'> & {
+  status: RuntimeInstanceStatusValue
+  label: string
+  variant?: 'badge' | 'status-dot'
+}
+
+export function DeploymentStatusBadge({
+  status,
+  label,
+  className,
+  variant = 'badge',
+  ref,
+  ...props
+}: DeploymentStatusBadgeProps) {
+  const isInProgress = isRuntimeDeploymentInProgress(status)
+
+  if (variant === 'status-dot') {
+    const dotStatus = deploymentStatusDotStatus(status)
+
+    return (
+      <span
+        ref={ref}
+        className={cn(
+          'inline-flex max-w-full cursor-default items-center system-2xs-medium-uppercase',
+          className,
+        )}
+        {...props}
+      >
+        <StatusDot
+          status={dotStatus}
+          className={cn('mr-2', isInProgress && 'animate-pulse')}
+        />
+        <span className={cn('truncate', deploymentStatusDotTextClassName(status))}>
+          {label}
+        </span>
+      </span>
+    )
+  }
+
+  const toneClassNames = deploymentStatusToneClassNames(status)
+  const dotStatus = deploymentStatusDotStatus(status)
+
+  return (
+    <span
+      ref={ref}
+      className={cn(
+        'inline-flex h-5 max-w-full cursor-default items-center gap-1 rounded-md border px-1.5 system-2xs-medium-uppercase',
+        toneClassNames.badge,
+        className,
+      )}
+      {...props}
+    >
+      <StatusDot
+        status={dotStatus}
+        className={cn('shrink-0', isInProgress && 'animate-pulse')}
+      />
+      <span className="truncate">{label}</span>
+    </span>
+  )
+}
+
+type EnvironmentDeploymentBadgeProps = Omit<ComponentPropsWithRef<'span'>, 'children' | 'title'> & {
+  row: EnvironmentDeployment
+  showStatus?: boolean
+  summaryLabel?: string
+}
+
+export function EnvironmentDeploymentBadge({
+  row,
+  className,
+  showStatus = true,
+  summaryLabel,
+  'aria-label': ariaLabel,
+  ref,
+  ...props
+}: EnvironmentDeploymentBadgeProps) {
+  const { t } = useTranslation('deployments')
+  const name = row.environment.displayName
+  const status = row.status
+  const toneClassNames = deploymentStatusToneClassNames(status)
+  const dotStatus = deploymentStatusDotStatus(status)
+  const isInProgress = isRuntimeDeploymentInProgress(status)
+  const statusLabel = t(deploymentStatusLabelKey(status))
+  const label = summaryLabel ?? `${name} · ${statusLabel}`
+  const visibleLabel = showStatus ? `${name} · ${statusLabel}` : name
+
+  return (
+    <span
+      ref={ref}
+      aria-label={ariaLabel ?? label}
+      className={cn(
+        'inline-flex h-5 max-w-full cursor-default items-center gap-1 rounded-md border px-1.5 system-xs-medium',
+        toneClassNames.badge,
+        className,
+      )}
+      {...props}
+    >
+      <StatusDot
+        status={dotStatus}
+        className={cn('shrink-0', isInProgress && 'animate-pulse')}
+      />
+      <span className="truncate">{visibleLabel}</span>
+    </span>
+  )
+}
diff --git a/web/features/deployments/shared/ui/deployment-status-style.ts b/web/features/deployments/shared/ui/deployment-status-style.ts
new file mode 100644
index 00000000000..0997d8e3112
--- /dev/null
+++ b/web/features/deployments/shared/ui/deployment-status-style.ts
@@ -0,0 +1,79 @@
+import type { RuntimeInstanceStatus as RuntimeInstanceStatusValue } from '@dify/contracts/enterprise/types.gen'
+import type { StatusDotStatus } from '@langgenius/dify-ui/status-dot'
+import { RuntimeInstanceStatus } from '@dify/contracts/enterprise/types.gen'
+
+type DeploymentStatusTone = 'neutral' | 'success' | 'warning' | 'danger' | 'info'
+type DeploymentStatusLabelKey = `status.${RuntimeInstanceStatusValue}`
+
+const STATUS_TONE: Record<RuntimeInstanceStatusValue, DeploymentStatusTone> = {
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED]: 'neutral',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED]: 'neutral',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING]: 'info',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY]: 'success',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_FAILED]: 'danger',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DRIFTED]: 'warning',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_INVALID]: 'danger',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING]: 'info',
+}
+
+const STATUS_DOT_STATUS: Record<RuntimeInstanceStatusValue, StatusDotStatus> = {
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED]: 'disabled',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED]: 'disabled',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING]: 'normal',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_READY]: 'success',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_FAILED]: 'error',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_DRIFTED]: 'warning',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_INVALID]: 'error',
+  [RuntimeInstanceStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING]: 'normal',
+}
+
+const STATUS_DOT_TEXT_CLASS_NAMES: Record<StatusDotStatus, string> = {
+  disabled: 'text-text-tertiary',
+  error: 'text-util-colors-red-red-600',
+  normal: 'text-util-colors-blue-light-blue-light-600',
+  success: 'text-util-colors-green-green-600',
+  warning: 'text-util-colors-warning-warning-600',
+}
+
+const TONE_CLASS_NAMES: Record<DeploymentStatusTone, { badge: string, dot: string }> = {
+  danger: {
+    badge: 'border-util-colors-red-red-200 bg-util-colors-red-red-50 text-util-colors-red-red-700',
+    dot: 'bg-util-colors-red-red-500',
+  },
+  info: {
+    badge: 'border-util-colors-blue-blue-200 bg-util-colors-blue-blue-50 text-util-colors-blue-blue-700',
+    dot: 'bg-util-colors-blue-blue-500',
+  },
+  neutral: {
+    badge: 'border-divider-subtle bg-background-section-burn text-text-tertiary',
+    dot: 'bg-text-quaternary',
+  },
+  success: {
+    badge: 'border-util-colors-green-green-200 bg-util-colors-green-green-50 text-util-colors-green-green-700',
+    dot: 'bg-util-colors-green-green-500',
+  },
+  warning: {
+    badge: 'border-util-colors-warning-warning-200 bg-util-colors-warning-warning-50 text-util-colors-warning-warning-700',
+    dot: 'bg-util-colors-warning-warning-500',
+  },
+}
+
+export function deploymentStatusLabelKey(status: RuntimeInstanceStatusValue): DeploymentStatusLabelKey {
+  return `status.${status}`
+}
+
+function deploymentStatusTone(status: RuntimeInstanceStatusValue) {
+  return STATUS_TONE[status]
+}
+
+export function deploymentStatusToneClassNames(status: RuntimeInstanceStatusValue) {
+  return TONE_CLASS_NAMES[deploymentStatusTone(status)]
+}
+
+export function deploymentStatusDotStatus(status: RuntimeInstanceStatusValue) {
+  return STATUS_DOT_STATUS[status]
+}
+
+export function deploymentStatusDotTextClassName(status: RuntimeInstanceStatusValue) {
+  return STATUS_DOT_TEXT_CLASS_NAMES[deploymentStatusDotStatus(status)]
+}
diff --git a/web/features/system-features/config.ts b/web/features/system-features/config.ts
index 3932259800d..1b0c88a9ea2 100644
--- a/web/features/system-features/config.ts
+++ b/web/features/system-features/config.ts
@@ -3,6 +3,7 @@ import { env } from '@/env'
 import { InstallationScope, LicenseStatus } from './constants'
 
 export const defaultSystemFeatures = {
+  enable_app_deploy: false,
   sso_enforced_for_signin: false,
   sso_enforced_for_signin_protocol: '',
   enable_marketplace: false,
@@ -47,6 +48,7 @@ export const defaultSystemFeatures = {
   plugin_manager: {
     enabled: false,
   },
+  rbac_enabled: false,
   enable_creators_platform: false,
   enable_trial_app: false,
   enable_explore_banner: false,
diff --git a/web/features/tag-management/__tests__/dataset-card-tags.spec.tsx b/web/features/tag-management/__tests__/dataset-card-tags.spec.tsx
index 59c26c64cd0..8b3cec572df 100644
--- a/web/features/tag-management/__tests__/dataset-card-tags.spec.tsx
+++ b/web/features/tag-management/__tests__/dataset-card-tags.spec.tsx
@@ -3,23 +3,29 @@ import { fireEvent, render, screen } from '@testing-library/react'
 import { describe, expect, it, vi } from 'vitest'
 import { DatasetCardTags } from '../components/dataset-card-tags'
 
+const renderTagSelector = vi.hoisted(() => vi.fn())
+
 vi.mock('@/features/tag-management/components/tag-selector', () => ({
-  TagSelector: ({ value, onOpenTagManagement }: {
+  TagSelector: (props: {
     value: Tag[]
     onOpenTagManagement?: () => void
-  }) => (
-    <div role="group" aria-label="Tag selector mock">
-      <div>{value.map(tag => tag.id).join(',')}</div>
-      <div>
-        {value.length}
-        {' '}
-        tags
+    canBindOrUnbindTags?: boolean
+  }) => {
+    renderTagSelector(props)
+    return (
+      <div role="group" aria-label="Tag selector mock">
+        <div>{props.value.map(tag => tag.id).join(',')}</div>
+        <div>
+          {props.value.length}
+          {' '}
+          tags
+        </div>
+        <button onClick={props.onOpenTagManagement}>
+          Open Management
+        </button>
       </div>
-      <button onClick={onOpenTagManagement}>
-        Open Management
-      </button>
-    </div>
-  ),
+    )
+  },
 }))
 
 describe('DatasetCardTags', () => {
@@ -62,6 +68,14 @@ describe('DatasetCardTags', () => {
       expect(screen.getByRole('group', { name: 'Tag selector mock' })).toBeInTheDocument()
     })
 
+    it('should pass tag binding permission to TagSelector', () => {
+      render(<DatasetCardTags {...defaultProps} canBindOrUnbindTags={true} />)
+
+      expect(renderTagSelector).toHaveBeenCalledWith(expect.objectContaining({
+        canBindOrUnbindTags: true,
+      }))
+    })
+
     it('should render with empty tags', () => {
       render(<DatasetCardTags {...defaultProps} tags={[]} />)
       expect(screen.getByText('0 tags')).toBeInTheDocument()
diff --git a/web/features/tag-management/__tests__/tag-filter.spec.tsx b/web/features/tag-management/__tests__/tag-filter.spec.tsx
index 9d6f8088e36..8660f412b1e 100644
--- a/web/features/tag-management/__tests__/tag-filter.spec.tsx
+++ b/web/features/tag-management/__tests__/tag-filter.spec.tsx
@@ -7,10 +7,20 @@ const { mockUseQueryData } = vi.hoisted(() => ({
   mockUseQueryData: { current: [] as Tag[] },
 }))
 
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['app.tag.manage', 'dataset.tag.manage'] as string[],
+}))
+
 vi.mock('@tanstack/react-query', () => ({
   useQuery: () => ({ data: mockUseQueryData.current }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
+
 const mockTags: Tag[] = [
   { id: 'tag-1', name: 'Frontend', type: 'app', binding_count: 3 },
   { id: 'tag-2', name: 'Backend', type: 'app', binding_count: 5 },
@@ -37,6 +47,7 @@ describe('TagFilter', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockUseQueryData.current = mockTags
+    mockWorkspacePermissionKeys.value = ['app.tag.manage', 'dataset.tag.manage']
   })
 
   describe('Rendering', () => {
@@ -204,6 +215,18 @@ describe('TagFilter', () => {
 
       expect(onOpenTagManagement).toHaveBeenCalledTimes(1)
     })
+
+    it('should hide tag management action without tag management permission', async () => {
+      const user = userEvent.setup()
+      mockWorkspacePermissionKeys.value = []
+
+      render(<TagFilter {...defaultProps} />)
+
+      await user.click(screen.getByText(i18n.placeholder))
+
+      expect(screen.queryByRole('button', { name: i18n.manageTags })).not.toBeInTheDocument()
+      expect(screen.getByRole('option', { name: /Frontend/i })).toBeInTheDocument()
+    })
   })
 
   describe('Search', () => {
diff --git a/web/features/tag-management/__tests__/tag-management-modal.spec.tsx b/web/features/tag-management/__tests__/tag-management-modal.spec.tsx
index d9afcca54f7..01c58082401 100644
--- a/web/features/tag-management/__tests__/tag-management-modal.spec.tsx
+++ b/web/features/tag-management/__tests__/tag-management-modal.spec.tsx
@@ -28,6 +28,10 @@ const { mockUseQueryData, createTag } = vi.hoisted(() => ({
   createTag: vi.fn(),
 }))
 
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['app.tag.manage', 'dataset.tag.manage', 'snippets.management'] as string[],
+}))
+
 vi.mock('@tanstack/react-query', () => ({
   useQuery: () => ({ data: mockUseQueryData.current }),
   useMutation: (mutationOptions: { mutationFn: (input: unknown) => Promise<unknown> }) => ({
@@ -40,6 +44,12 @@ vi.mock('@tanstack/react-query', () => ({
   }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
+
 vi.mock('@/service/client', () => ({
   consoleQuery: {
     tags: {
@@ -89,6 +99,7 @@ describe('TagManagementModal', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockUseQueryData.current = mockTags
+    mockWorkspacePermissionKeys.value = ['app.tag.manage', 'dataset.tag.manage', 'snippets.management']
     vi.mocked(createTag).mockResolvedValue({ id: 'new-tag', name: 'NewTag', type: 'app', binding_count: 0 })
   })
 
@@ -133,6 +144,15 @@ describe('TagManagementModal', () => {
       // The Modal component hides content when isShow is false
       expect(screen.queryByText(i18n.manageTags)).not.toBeInTheDocument()
     })
+
+    it('should not render content without tag management permission', () => {
+      mockWorkspacePermissionKeys.value = []
+
+      render(<TagManagementModal {...defaultProps} />)
+
+      expect(screen.queryByText(i18n.manageTags)).not.toBeInTheDocument()
+      expect(screen.queryByRole('textbox', { name: i18n.addNew })).not.toBeInTheDocument()
+    })
   })
 
   describe('User Interactions', () => {
diff --git a/web/features/tag-management/__tests__/tag-search-content.spec.tsx b/web/features/tag-management/__tests__/tag-search-content.spec.tsx
index 30b3cef8ad6..45aa3054c4e 100644
--- a/web/features/tag-management/__tests__/tag-search-content.spec.tsx
+++ b/web/features/tag-management/__tests__/tag-search-content.spec.tsx
@@ -11,6 +11,16 @@ const { onValueChangeSpy } = vi.hoisted(() => ({
   onValueChangeSpy: vi.fn(),
 }))
 
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['app.tag.manage', 'dataset.tag.manage'] as string[],
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
+
 const i18n = {
   selectorPlaceholder: 'common.tag.selectorPlaceholder',
   operationClear: 'common.operation.clear',
@@ -91,6 +101,7 @@ const PanelHarness = ({
 describe('TagSearchContent', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.value = ['app.tag.manage', 'dataset.tag.manage']
   })
 
   it('renders search, selected tags, unselected tags, and management action', () => {
@@ -191,8 +202,31 @@ describe('TagSearchContent', () => {
     expect(onOpenTagManagement).toHaveBeenCalledTimes(1)
   })
 
+  it('hides tag management action without tag management permission', () => {
+    mockWorkspacePermissionKeys.value = []
+
+    render(<PanelHarness />)
+
+    expect(screen.queryByRole('button', { name: i18n.manageTags })).not.toBeInTheDocument()
+    expect(screen.getByRole('option', { name: /Frontend/i })).toBeInTheDocument()
+  })
+
   it('renders knowledge tags when the panel type is knowledge', () => {
     render(<PanelHarness type="knowledge" value={[]} />)
     expect(screen.getByRole('option', { name: /KnowledgeDB/i })).toBeInTheDocument()
   })
+
+  it('renders snippet management action with snippets management permission', () => {
+    mockWorkspacePermissionKeys.value = ['snippets.management']
+
+    render(
+      <PanelHarness
+        type="snippet"
+        value={[]}
+        tagList={[{ id: 'snippet-tag-1', name: 'Reusable', type: 'snippet', binding_count: 1 }]}
+      />,
+    )
+
+    expect(screen.getByRole('button', { name: i18n.manageTags })).toBeInTheDocument()
+  })
 })
diff --git a/web/features/tag-management/__tests__/tag-selector.spec.tsx b/web/features/tag-management/__tests__/tag-selector.spec.tsx
index f33470825bc..190425b83df 100644
--- a/web/features/tag-management/__tests__/tag-selector.spec.tsx
+++ b/web/features/tag-management/__tests__/tag-selector.spec.tsx
@@ -29,6 +29,16 @@ const { mockUseQueryData, createTag, bindTag, unBindTag } = vi.hoisted(() => {
   }
 })
 
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['app.tag.manage', 'dataset.tag.manage', 'snippets.management'] as string[],
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
+  }),
+}))
+
 vi.mock('@tanstack/react-query', () => ({
   useQuery: () => ({ data: mockUseQueryData.current }),
   useMutation: (mutationOptions: { mutationFn: (input: unknown) => Promise<unknown> }) => ({
@@ -100,6 +110,7 @@ const defaultProps = {
 describe('TagSelector', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.value = ['app.tag.manage', 'dataset.tag.manage', 'snippets.management']
     mockUseQueryData.current = appTags
     vi.mocked(createTag).mockResolvedValue({ id: 'new-tag', name: 'NewTag', type: 'app', binding_count: 0 })
     vi.mocked(bindTag).mockResolvedValue(undefined)
@@ -240,4 +251,58 @@ describe('TagSelector', () => {
     })
     expect(bindTag).not.toHaveBeenCalled()
   })
+
+  it('does not open the tag selector when neither tag management nor binding capability is available', async () => {
+    const user = userEvent.setup()
+    mockWorkspacePermissionKeys.value = []
+
+    render(<TagSelector {...defaultProps} />)
+
+    await user.click(screen.getByRole('combobox', { name: /Frontend/i }))
+
+    expect(screen.queryByRole('combobox', { name: i18n.selectorPlaceholder })).not.toBeInTheDocument()
+  })
+
+  it('opens the tag selector with binding capability even without workspace tag management permission', async () => {
+    const user = userEvent.setup()
+    mockWorkspacePermissionKeys.value = []
+
+    render(<TagSelector {...defaultProps} canBindOrUnbindTags />)
+
+    await user.click(screen.getByRole('combobox', { name: /Frontend/i }))
+
+    expect(await screen.findByRole('combobox', { name: i18n.selectorPlaceholder })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: i18n.manageTags })).not.toBeInTheDocument()
+  })
+
+  it('does not create new tags when only binding capability is available', async () => {
+    const user = userEvent.setup()
+    mockWorkspacePermissionKeys.value = []
+
+    render(<TagSelector {...defaultProps} canBindOrUnbindTags />)
+
+    await user.click(screen.getByRole('combobox', { name: /Frontend/i }))
+    await user.type(await screen.findByRole('combobox', { name: i18n.selectorPlaceholder }), 'BrandNewTag')
+
+    expect(screen.queryByRole('option', { name: /BrandNewTag/i })).not.toBeInTheDocument()
+    expect(createTag).not.toHaveBeenCalled()
+  })
+
+  it('opens snippet tag selector with snippets management permission', async () => {
+    const user = userEvent.setup()
+    mockWorkspacePermissionKeys.value = ['snippets.management']
+    mockUseQueryData.current = [{ id: 'snippet-tag-1', name: 'Reusable', type: 'snippet', binding_count: 1 }]
+
+    render(
+      <TagSelector
+        targetId="snippet-1"
+        type="snippet"
+        value={[{ id: 'snippet-tag-1', name: 'Reusable', type: 'snippet', binding_count: 1 }]}
+      />,
+    )
+
+    await user.click(screen.getByRole('combobox', { name: /Reusable/i }))
+
+    expect(await screen.findByRole('combobox', { name: i18n.selectorPlaceholder })).toBeInTheDocument()
+  })
 })
diff --git a/web/features/tag-management/components/__tests__/app-card-tags.spec.tsx b/web/features/tag-management/components/__tests__/app-card-tags.spec.tsx
index d34224f2948..dd9ba09a88c 100644
--- a/web/features/tag-management/components/__tests__/app-card-tags.spec.tsx
+++ b/web/features/tag-management/components/__tests__/app-card-tags.spec.tsx
@@ -13,6 +13,7 @@ vi.mock('@/features/tag-management/components/tag-selector', () => ({
     targetId: string
     type: string
     value: Tag[]
+    canBindOrUnbindTags?: boolean
   }) => {
     renderTagSelector(props)
 
@@ -47,6 +48,7 @@ describe('AppCardTags', () => {
         targetId: 'app-1',
         type: 'app',
         value: tags,
+        canBindOrUnbindTags: undefined,
       }))
     })
 
@@ -91,5 +93,13 @@ describe('AppCardTags', () => {
         value: [],
       }))
     })
+
+    it('should forward app ACL tag binding capability', () => {
+      render(<AppCardTags appId="app-1" tags={tags} canBindOrUnbindTags={false} />)
+
+      expect(renderTagSelector).toHaveBeenCalledWith(expect.objectContaining({
+        canBindOrUnbindTags: false,
+      }))
+    })
   })
 })
diff --git a/web/features/tag-management/components/app-card-tags.tsx b/web/features/tag-management/components/app-card-tags.tsx
index 44b65bb8342..67a3ca81d83 100644
--- a/web/features/tag-management/components/app-card-tags.tsx
+++ b/web/features/tag-management/components/app-card-tags.tsx
@@ -4,6 +4,7 @@ import { TagSelector } from '@/features/tag-management/components/tag-selector'
 type AppCardTagsProps = {
   appId: string
   tags: Tag[]
+  canBindOrUnbindTags?: boolean
   onOpenTagManagement?: () => void
   onTagsChange?: () => void
 }
@@ -11,6 +12,7 @@ type AppCardTagsProps = {
 export const AppCardTags = ({
   appId,
   tags,
+  canBindOrUnbindTags,
   onOpenTagManagement = () => {},
   onTagsChange,
 }: AppCardTagsProps) => {
@@ -21,6 +23,7 @@ export const AppCardTags = ({
         type="app"
         targetId={appId}
         value={tags}
+        canBindOrUnbindTags={canBindOrUnbindTags}
         onOpenTagManagement={onOpenTagManagement}
         onTagsChange={onTagsChange}
       />
diff --git a/web/features/tag-management/components/dataset-card-tags.tsx b/web/features/tag-management/components/dataset-card-tags.tsx
index 53e605389c5..c33382b36bc 100644
--- a/web/features/tag-management/components/dataset-card-tags.tsx
+++ b/web/features/tag-management/components/dataset-card-tags.tsx
@@ -10,6 +10,7 @@ type DatasetCardTagsProps = {
   onClick: (e: MouseEvent) => void
   onOpenTagManagement?: () => void
   onTagsChange?: () => void
+  canBindOrUnbindTags?: boolean
 }
 
 export const DatasetCardTags = ({
@@ -19,6 +20,7 @@ export const DatasetCardTags = ({
   onClick,
   onOpenTagManagement = () => {},
   onTagsChange,
+  canBindOrUnbindTags,
 }: DatasetCardTagsProps) => (
   <div
     className={cn('group/tag-area w-full px-3', !embeddingAvailable && 'opacity-30')}
@@ -32,6 +34,10 @@ export const DatasetCardTags = ({
         value={tags}
         onOpenTagManagement={onOpenTagManagement}
         onTagsChange={onTagsChange}
+        canBindOrUnbindTags={canBindOrUnbindTags}
+      />
+      <div
+        className="pointer-events-none absolute top-0 right-0 h-full w-20 bg-tag-selector-mask-bg group-focus-within/tag-area:hidden group-hover/tag-area:hidden"
       />
       <div
         className="pointer-events-none absolute top-0 right-0 h-full w-20 bg-tag-selector-mask-bg group-focus-within/tag-area:hidden group-hover/tag-area:hidden"
diff --git a/web/features/tag-management/components/tag-management-modal.tsx b/web/features/tag-management/components/tag-management-modal.tsx
index 49d6b540d44..d21e26bca54 100644
--- a/web/features/tag-management/components/tag-management-modal.tsx
+++ b/web/features/tag-management/components/tag-management-modal.tsx
@@ -5,7 +5,10 @@ import { toast } from '@langgenius/dify-ui/toast'
 import { useMutation, useQuery } from '@tanstack/react-query'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { consoleQuery } from '@/service/client'
+import { hasPermission } from '@/utils/permission'
+import { getTagManagePermissionKey } from '../utils'
 import { TagItemEditor } from './tag-item-editor'
 
 type TagManagementModalProps = {
@@ -16,18 +19,22 @@ type TagManagementModalProps = {
 }
 export const TagManagementModal = ({ show, type, onClose, onTagsChange }: TagManagementModalProps) => {
   const { t } = useTranslation()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canManageTags = hasPermission(workspacePermissionKeys, getTagManagePermissionKey(type))
   const { data: tagList = [] } = useQuery(consoleQuery.tags.list.queryOptions({
     input: {
       query: {
         type,
       },
     },
-    enabled: show,
+    enabled: show && canManageTags,
   }))
   const createTagMutation = useMutation(consoleQuery.tags.create.mutationOptions())
   const [name, setName] = useState<string>('')
 
   const createNewTag = () => {
+    if (!canManageTags)
+      return
     if (!name)
       return
     if (createTagMutation.isPending)
@@ -53,6 +60,9 @@ export const TagManagementModal = ({ show, type, onClose, onTagsChange }: TagMan
     onClose()
   }
 
+  if (!canManageTags)
+    return null
+
   return (
     <Dialog open={show} onOpenChange={open => !open && handleClose()}>
       <DialogContent className="w-150 max-w-150 rounded-xl p-8">
diff --git a/web/features/tag-management/components/tag-search-content.tsx b/web/features/tag-management/components/tag-search-content.tsx
index 9811fca568e..ec7935acfe0 100644
--- a/web/features/tag-management/components/tag-search-content.tsx
+++ b/web/features/tag-management/components/tag-search-content.tsx
@@ -3,6 +3,9 @@ import type { TagType } from '@/contract/console/tags'
 import { ComboboxEmpty, ComboboxInput, ComboboxInputGroup, ComboboxItem, ComboboxItemIndicator, ComboboxItemText, ComboboxList, ComboboxSeparator, useComboboxFilteredItems } from '@langgenius/dify-ui/combobox'
 import { Fragment } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
+import { getTagManagePermissionKey } from '../utils'
 import { isCreateTagOption } from './tag-combobox-item'
 
 type TagSearchContentProps = {
@@ -21,6 +24,8 @@ export const TagSearchContent = ({
   onClose,
 }: TagSearchContentProps) => {
   const { t } = useTranslation()
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canManageTags = hasPermission(workspacePermissionKeys, getTagManagePermissionKey(type))
   const filteredItems = useComboboxFilteredItems<TagComboboxItem>()
   const realItemCount = filteredItems.filter(tag => !isCreateTagOption(tag)).length
   const placeholder = t('tag.selectorPlaceholder', { ns: 'common' }) || ''
@@ -84,22 +89,26 @@ export const TagSearchContent = ({
           <div className="system-xs-regular text-text-tertiary">{t('tag.noTag', { ns: 'common' })}</div>
         </div>
       </ComboboxEmpty>
-      <ComboboxSeparator />
-      <div className="p-1">
-        <button
-          type="button"
-          className="flex w-full cursor-pointer touch-manipulation items-center gap-x-1 rounded-lg px-2 py-1.5 text-left outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
-          onClick={() => {
-            onOpenTagManagement?.()
-            onClose?.()
-          }}
-        >
-          <span className="i-custom-vender-line-financeAndECommerce-tag-01 size-4 text-text-tertiary" aria-hidden="true" />
-          <span className="min-w-0 grow truncate px-1 system-md-regular text-text-secondary">
-            {t('tag.manageTags', { ns: 'common' })}
-          </span>
-        </button>
-      </div>
+      {canManageTags && (
+        <>
+          <ComboboxSeparator />
+          <div className="p-1">
+            <button
+              type="button"
+              className="flex w-full cursor-pointer touch-manipulation items-center gap-x-1 rounded-lg px-2 py-1.5 text-left outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+              onClick={() => {
+                onOpenTagManagement?.()
+                onClose?.()
+              }}
+            >
+              <span className="i-custom-vender-line-financeAndECommerce-tag-01 size-4 text-text-tertiary" aria-hidden="true" />
+              <span className="min-w-0 grow truncate px-1 system-md-regular text-text-secondary">
+                {t('tag.manageTags', { ns: 'common' })}
+              </span>
+            </button>
+          </div>
+        </>
+      )}
     </div>
   )
 }
diff --git a/web/features/tag-management/components/tag-selector.tsx b/web/features/tag-management/components/tag-selector.tsx
index 999596a363b..fc6210c2732 100644
--- a/web/features/tag-management/components/tag-selector.tsx
+++ b/web/features/tag-management/components/tag-selector.tsx
@@ -8,8 +8,11 @@ import { toast } from '@langgenius/dify-ui/toast'
 import { useMutation, useQuery } from '@tanstack/react-query'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { consoleQuery } from '@/service/client'
+import { hasPermission } from '@/utils/permission'
 import { useApplyTagBindingsMutation } from '../hooks/use-tag-mutations'
+import { getTagManagePermissionKey } from '../utils'
 import { isCreateTagOption } from './tag-combobox-item'
 import { TagSearchContent } from './tag-search-content'
 import { TagTrigger } from './tag-trigger'
@@ -43,6 +46,7 @@ type TagSelectorProps = TagSelectorRootProps & TagSelectorContentProps & {
   targetId: string
   type: TagType
   value: Tag[]
+  canBindOrUnbindTags?: boolean
   onOpenTagManagement?: () => void
   onTagsChange?: () => void
 }
@@ -51,6 +55,7 @@ export const TagSelector = ({
   targetId,
   type,
   value,
+  canBindOrUnbindTags,
   onOpenTagManagement = () => {},
   onTagsChange,
   placement = 'bottom-start',
@@ -66,6 +71,9 @@ export const TagSelector = ({
   const [open, setOpen] = useState(false)
   const [draftTags, setDraftTags] = useState<Tag[]>(value)
   const [inputValue, setInputValue] = useState('')
+  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const canManageTags = hasPermission(workspacePermissionKeys, getTagManagePermissionKey(type))
+
   const applyTagBindingsMutation = useApplyTagBindingsMutation()
   const {
     isPending: isCreatingTag,
@@ -109,7 +117,7 @@ export const TagSelector = ({
         nextItems.push(tag)
     }
 
-    if (inputValue && nextItems.every(tag => tag.name !== inputValue)) {
+    if (canManageTags && inputValue && nextItems.every(tag => tag.name !== inputValue)) {
       nextItems.push({
         id: `__create_tag__:${inputValue}`,
         name: inputValue,
@@ -120,7 +128,7 @@ export const TagSelector = ({
     }
 
     return nextItems
-  }, [inputValue, tagList, type, value])
+  }, [canManageTags, inputValue, tagList, type, value])
 
   const applyTagBindings = useCallback(() => {
     const draftTagIds = draftTags.map(tag => tag.id)
@@ -167,7 +175,7 @@ export const TagSelector = ({
   }, [applyTagBindings, value])
 
   const createNewTag = useCallback((name: string) => {
-    if (!name || isCreatingTag)
+    if (!canManageTags || !name || isCreatingTag)
       return
 
     createTag({
@@ -184,7 +192,7 @@ export const TagSelector = ({
         toast.error(t('tag.failed', { ns: 'common' }))
       },
     })
-  }, [createTag, isCreatingTag, t, type])
+  }, [canManageTags, createTag, isCreatingTag, t, type])
 
   const handleValueChange = useCallback((nextTags: TagComboboxItem[]) => {
     const createOption = nextTags.find(isCreateTagOption)
@@ -212,6 +220,7 @@ export const TagSelector = ({
       isItemEqualToValue={isSameTag}
     >
       <ComboboxTrigger
+        disabled={!canManageTags && !canBindOrUnbindTags}
         aria-label={triggerLabel}
         className={cn(
           'block h-auto w-full rounded-lg border-0 bg-transparent p-0 text-left hover:bg-transparent focus:outline-hidden focus-visible:bg-transparent focus-visible:ring-2 focus-visible:ring-state-accent-solid data-popup-open:bg-state-base-hover data-popup-open:hover:bg-state-base-hover',
diff --git a/web/features/tag-management/utils.ts b/web/features/tag-management/utils.ts
new file mode 100644
index 00000000000..bc88569ade9
--- /dev/null
+++ b/web/features/tag-management/utils.ts
@@ -0,0 +1,13 @@
+import type { TagType } from '@/contract/console/tags'
+import type { PermissionKey } from '@/models/access-control'
+import { SnippetPermission } from '@/app/components/snippets/utils/permission'
+
+export const getTagManagePermissionKey = (type: TagType): PermissionKey => {
+  if (type === 'app')
+    return 'app.tag.manage'
+
+  if (type === 'snippet')
+    return SnippetPermission.Management
+
+  return 'dataset.tag.manage'
+}
diff --git a/web/hooks/use-credential-permissions.ts b/web/hooks/use-credential-permissions.ts
new file mode 100644
index 00000000000..5766e7282b9
--- /dev/null
+++ b/web/hooks/use-credential-permissions.ts
@@ -0,0 +1,11 @@
+import { useSelector as useAppContextSelector } from '@/context/app-context'
+import { hasPermission } from '@/utils/permission'
+
+export const useCredentialPermissions = () => {
+  const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+
+  return {
+    canUseCredential: hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage']),
+    canManageCredential: hasPermission(workspacePermissionKeys, 'credential.manage'),
+  }
+}
diff --git a/web/hooks/use-import-dsl.ts b/web/hooks/use-import-dsl.ts
index 7fdb0255976..97a1f9e93f2 100644
--- a/web/hooks/use-import-dsl.ts
+++ b/web/hooks/use-import-dsl.ts
@@ -4,16 +4,14 @@ import type {
 } from '@/models/app'
 import type { AppIconType } from '@/types/app'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useSetLocalStorage } from 'foxact/use-local-storage'
 import {
   useCallback,
   useRef,
   useState,
 } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import { usePluginDependencies } from '@/app/components/workflow/plugin-dependency/hooks'
-import { NEED_REFRESH_APP_LIST_KEY } from '@/config'
-import { useSelector } from '@/context/app-context'
 import { DSLImportStatus } from '@/models/app'
 import { useRouter } from '@/next/navigation'
 import {
@@ -42,12 +40,11 @@ export const useImportDSL = () => {
   const { t } = useTranslation()
   const [isFetching, setIsFetching] = useState(false)
   const { handleCheckPluginDependencies } = usePluginDependencies()
-  const isCurrentWorkspaceEditor = useSelector(s => s.isCurrentWorkspaceEditor)
   const { push } = useRouter()
   const invalidateAppList = useInvalidateAppList()
   const [versions, setVersions] = useState<{ importedVersion: string, systemVersion: string }>()
   const importIdRef = useRef<string>('')
-  const setNeedRefresh = useSetLocalStorage<string>(NEED_REFRESH_APP_LIST_KEY, { raw: true })
+  const setNeedRefresh = useSetNeedRefreshAppList()
 
   const handleImportDSL = useCallback(async (
     payload: DSLPayload,
@@ -74,6 +71,7 @@ export const useImportDSL = () => {
         app_mode,
         imported_dsl_version,
         current_dsl_version,
+        permission_keys,
       } = response
 
       if (status === DSLImportStatus.COMPLETED || status === DSLImportStatus.COMPLETED_WITH_WARNINGS) {
@@ -93,7 +91,7 @@ export const useImportDSL = () => {
         setNeedRefresh('1')
         invalidateAppList()
         await handleCheckPluginDependencies(app_id)
-        getRedirection(isCurrentWorkspaceEditor, { id: app_id, mode: app_mode }, push)
+        getRedirection({ id: app_id, mode: app_mode, permission_keys }, push)
       }
       else if (status === DSLImportStatus.PENDING) {
         setVersions({
@@ -115,7 +113,7 @@ export const useImportDSL = () => {
     finally {
       setIsFetching(false)
     }
-  }, [t, handleCheckPluginDependencies, isCurrentWorkspaceEditor, push, isFetching, setNeedRefresh, invalidateAppList])
+  }, [isFetching, t, handleCheckPluginDependencies, push, setNeedRefresh, invalidateAppList])
 
   const handleImportDSLConfirm = useCallback(async (
     {
@@ -134,7 +132,7 @@ export const useImportDSL = () => {
         import_id: importIdRef.current,
       })
 
-      const { status, app_id, app_mode } = response
+      const { status, app_id, app_mode, permission_keys } = response
       if (!app_id)
         return
 
@@ -144,7 +142,7 @@ export const useImportDSL = () => {
         await handleCheckPluginDependencies(app_id)
         setNeedRefresh('1')
         invalidateAppList()
-        getRedirection(isCurrentWorkspaceEditor, { id: app_id!, mode: app_mode }, push)
+        getRedirection({ id: app_id, mode: app_mode, permission_keys }, push)
       }
       else if (status === DSLImportStatus.FAILED) {
         toast.error(t('newApp.appCreateFailed', { ns: 'app' }))
@@ -158,7 +156,7 @@ export const useImportDSL = () => {
     finally {
       setIsFetching(false)
     }
-  }, [t, handleCheckPluginDependencies, isCurrentWorkspaceEditor, push, isFetching, setNeedRefresh, invalidateAppList])
+  }, [isFetching, t, handleCheckPluginDependencies, setNeedRefresh, push, invalidateAppList])
 
   return {
     handleImportDSL,
diff --git a/web/i18n-config/language.ts b/web/i18n-config/language.ts
index 343a634abcd..f3b5062e3b2 100644
--- a/web/i18n-config/language.ts
+++ b/web/i18n-config/language.ts
@@ -23,6 +23,14 @@ const DOC_LANGUAGE: Record<string, DocLanguage | undefined> = {
   'en-US': 'en',
 }
 
+export type AccessControlTemplateLanguage = 'zh' | 'ja' | 'en'
+
+const ACCESS_CONTROL_TEMPLATE_LANGUAGE: Record<string, AccessControlTemplateLanguage> = {
+  'zh-Hans': 'zh',
+  'ja-JP': 'ja',
+  'en-US': 'en',
+}
+
 export const localeMap: Record<Locale, string> = {
   'en-US': 'en',
   'en_US': 'en',
@@ -64,6 +72,10 @@ export const getPricingPageLanguage = (locale: string) => {
   return PRICING_PAGE_LANGUAGE[locale] || ''
 }
 
+export const getAccessControlTemplateLanguage = (locale: string): AccessControlTemplateLanguage => {
+  return ACCESS_CONTROL_TEMPLATE_LANGUAGE[locale] || 'en'
+}
+
 export const NOTICE_I18N = {
   title: {
     en_US: 'Important Notice',
diff --git a/web/i18n-config/resources.ts b/web/i18n-config/resources.ts
index 6cca6e97cba..16c0ad39bee 100644
--- a/web/i18n-config/resources.ts
+++ b/web/i18n-config/resources.ts
@@ -1,3 +1,4 @@
+import type agentV2 from '../i18n/en-US/agent-v-2.json'
 import type appAnnotation from '../i18n/en-US/app-annotation.json'
 import type appApi from '../i18n/en-US/app-api.json'
 import type appDebug from '../i18n/en-US/app-debug.json'
@@ -13,11 +14,14 @@ import type datasetHitTesting from '../i18n/en-US/dataset-hit-testing.json'
 import type datasetPipeline from '../i18n/en-US/dataset-pipeline.json'
 import type datasetSettings from '../i18n/en-US/dataset-settings.json'
 import type dataset from '../i18n/en-US/dataset.json'
+import type deployments from '../i18n/en-US/deployments.json'
 import type education from '../i18n/en-US/education.json'
 import type explore from '../i18n/en-US/explore.json'
 import type layout from '../i18n/en-US/layout.json'
 import type login from '../i18n/en-US/login.json'
 import type oauth from '../i18n/en-US/oauth.json'
+import type permissionKeys from '../i18n/en-US/permission-keys.json'
+import type permission from '../i18n/en-US/permission.json'
 import type pipeline from '../i18n/en-US/pipeline.json'
 import type pluginTags from '../i18n/en-US/plugin-tags.json'
 import type pluginTrigger from '../i18n/en-US/plugin-trigger.json'
@@ -38,6 +42,7 @@ export type Resources = {
   appDebug: typeof appDebug
   appLog: typeof appLog
   appOverview: typeof appOverview
+  agentV2: typeof agentV2
   billing: typeof billing
   common: typeof common
   custom: typeof custom
@@ -47,11 +52,14 @@ export type Resources = {
   datasetHitTesting: typeof datasetHitTesting
   datasetPipeline: typeof datasetPipeline
   datasetSettings: typeof datasetSettings
+  deployments: typeof deployments
   education: typeof education
   explore: typeof explore
   layout: typeof layout
   login: typeof login
   oauth: typeof oauth
+  permission: typeof permission
+  permissionKeys: typeof permissionKeys
   pipeline: typeof pipeline
   plugin: typeof plugin
   pluginTags: typeof pluginTags
@@ -72,6 +80,7 @@ export const namespaces = [
   'appDebug',
   'appLog',
   'appOverview',
+  'agentV2',
   'billing',
   'common',
   'custom',
@@ -81,11 +90,14 @@ export const namespaces = [
   'datasetHitTesting',
   'datasetPipeline',
   'datasetSettings',
+  'deployments',
   'education',
   'explore',
   'layout',
   'login',
   'oauth',
+  'permission',
+  'permissionKeys',
   'pipeline',
   'plugin',
   'pluginTags',
diff --git a/web/i18n/ar-TN/agent-v-2.json b/web/i18n/ar-TN/agent-v-2.json
new file mode 100644
index 00000000000..0345d06d865
--- /dev/null
+++ b/web/i18n/ar-TN/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "هذا الإجراء غير متاح بعد.",
+  "agentDetail.access.actions.monitoring": "المراقبة",
+  "agentDetail.access.copyAccessUrl": "نسخ رابط الوصول",
+  "agentDetail.access.copyFailed": "فشل نسخ المرجع.",
+  "agentDetail.access.copyReference": "نسخ المرجع لـ {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "نسخ نقطة نهاية API الخدمة",
+  "agentDetail.access.description": "كل سطح يمكن الوصول إلى هذا الوكيل منه.",
+  "agentDetail.access.empty": "لا توجد نقاط وصول مرتبطة",
+  "agentDetail.access.emptyDescription": "هذا الوكيل في Roster ليس لديه بعد أي مراجع تطبيق أو سير عمل.",
+  "agentDetail.access.entries.agentApp.description": "تطبيق الوكيل المرتبط بهذا الوكيل في Roster.",
+  "agentDetail.access.entries.agentApp.name": "تطبيق الوكيل",
+  "agentDetail.access.entries.workflow.description": "مرجع سير العمل والعقدة المرتبط بهذا الوكيل في Roster.",
+  "agentDetail.access.entries.workflow.name": "عقدة سير العمل",
+  "agentDetail.access.entryCount_one": "{{count}} إدخال",
+  "agentDetail.access.entryCount_other": "{{count}} إدخالات",
+  "agentDetail.access.groups.references.heading": "المراجع",
+  "agentDetail.access.groups.references.label": "المراجع المرتبطة",
+  "agentDetail.access.learnMore": "اعرف المزيد",
+  "agentDetail.access.moreActions": "إجراءات أخرى لـ {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "نقطة نهاية API الخدمة",
+  "agentDetail.access.serviceApi.title": "API خدمة الواجهة الخلفية",
+  "agentDetail.access.status.disabled": "معطل",
+  "agentDetail.access.status.enabled": "ممكّن",
+  "agentDetail.access.status.inService": "في الخدمة",
+  "agentDetail.access.status.outOfService": "خارج الخدمة",
+  "agentDetail.access.title": "نقطة الوصول",
+  "agentDetail.access.toggleSurface": "تبديل وصول {{name}}",
+  "agentDetail.access.webApp.accessUrl": "رابط الوصول",
+  "agentDetail.access.webApp.actions.customize": "تخصيص",
+  "agentDetail.access.webApp.actions.embedded": "مضمّن",
+  "agentDetail.access.webApp.actions.launch": "تشغيل",
+  "agentDetail.access.webApp.actions.settings": "الإعدادات",
+  "agentDetail.access.webApp.refreshUrl": "تحديث رابط الوصول",
+  "agentDetail.access.webApp.showQrCode": "عرض رمز QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO ممكّن",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "يُستخدم كعقدة داخل سير العمل",
+  "agentDetail.access.workflow.empty": "لا توجد مراجع سير عمل بعد.",
+  "agentDetail.access.workflow.loadFailed": "فشل تحميل مراجع سير العمل.",
+  "agentDetail.access.workflow.loading": "جارٍ تحميل مراجع سير العمل…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} عقدة",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} عقد",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "افتح في Studio",
+  "agentDetail.access.workflow.openInStudioFor": "افتح {{name}} في Studio",
+  "agentDetail.access.workflow.table.actions": "الإجراءات",
+  "agentDetail.access.workflow.table.lastUpdated": "آخر تحديث",
+  "agentDetail.access.workflow.table.name": "الاسم",
+  "agentDetail.access.workflow.table.nodes": "العقد",
+  "agentDetail.access.workflow.table.version": "الإصدار",
+  "agentDetail.access.workflow.title": "وصول سير العمل",
+  "agentDetail.configure.advancedSettings.description": "للمستخدمين المتقدمين. متغيرات البيئة، sandbox والذاكرة.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "إضافة متغير بيئة",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "حذف {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "إخفاء قيمة {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "استيراد .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "لإظهار ملفات .env المخفية، اضغط Command + Shift + . في منتقي الملفات.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "إذا كان ملف .env مخفياً، فعّل الملفات المخفية في منتقي ملفات النظام.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "لإظهار ملفات .env المخفية، فعّل العناصر المخفية في File Explorer.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "إظهار قيمة {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "اختر نطاق متغير البيئة",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "متغيرات البيئة المتاحة لهذا الوكيل في وقت التشغيل.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "تبديل Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "الإعدادات المتقدمة",
+  "agentDetail.configure.advancedSettings.toggle": "تبديل الإعدادات المتقدمة",
+  "agentDetail.configure.chatFeatures.description": "شكّل تجربة الدردشة للمستخدم النهائي على Web app وأسطح الدردشة.",
+  "agentDetail.configure.chatFeatures.title": "ميزات الدردشة",
+  "agentDetail.configure.files.add": "إضافة ملف",
+  "agentDetail.configure.files.empty.description": "قم بتحميل المستندات التي يمكن للوكيل قراءتها، مثل المواصفات أو القوالب أو الإرشادات",
+  "agentDetail.configure.files.empty.title": "لا توجد ملفات بعد",
+  "agentDetail.configure.files.label": "الملفات",
+  "agentDetail.configure.files.preview.empty": "لا يوجد محتوى معاينة.",
+  "agentDetail.configure.files.preview.failed": "فشل تحميل المعاينة.",
+  "agentDetail.configure.files.preview.unsupported": "هذا الملف لا يدعم المعاينة.",
+  "agentDetail.configure.files.remove": "إزالة {{name}}",
+  "agentDetail.configure.files.tip": "الملفات التي يمكن لهذا الوكيل استخدامها أثناء تنسيق المهام.",
+  "agentDetail.configure.files.toggle": "تبديل الملفات",
+  "agentDetail.configure.files.treeLabel": "ملفات الوكيل",
+  "agentDetail.configure.files.upload.action": "تحميل",
+  "agentDetail.configure.files.upload.browse": "استعراض",
+  "agentDetail.configure.files.upload.description": "قم بتحميل ملف لهذا الوكيل.",
+  "agentDetail.configure.files.upload.dropzone": "أفلت ملفاً هنا، أو",
+  "agentDetail.configure.files.upload.failed": "فشل تحميل الملف.",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "قم بتحميل ملف واحد.",
+  "agentDetail.configure.files.upload.success": "تم تحميل الملف.",
+  "agentDetail.configure.files.upload.title": "تحميل ملف",
+  "agentDetail.configure.knowledgeRetrieval.add": "إضافة استرجاع معرفة",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "إضافة معرفة",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "انقر على زر “+” لإضافة معرفة",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "المعرفة",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "إعداد الاسترجاع",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "اعرف المزيد عن استرجاع المعرفة",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "تلقائي",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "الشروط",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "معطل",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "تصفية البيانات الوصفية",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "يدوي",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "حدد وضع تصفية البيانات الوصفية",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "اسم استرجاع المعرفة",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "الوكيل يقرر",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "يكتب الوكيل استعلامه الخاص من المطالبة والسياق المتاح. لا شيء للإعداد هنا.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "استعلام مخصص",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "اكتب استعلاماً ثابتاً لمصدر الاسترجاع هذا.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "نص الاستعلام المخصص",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "اكتب استعلام بحث",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "الاستعلام",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "استرجاع المعرفة · الوكيل يقرر",
+  "agentDetail.configure.knowledgeRetrieval.edit": "تعديل {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "اربط قاعدة معرفة يمكن للوكيل البحث فيها أثناء الإجابة",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "لا توجد معرفة بعد",
+  "agentDetail.configure.knowledgeRetrieval.label": "استرجاع المعرفة",
+  "agentDetail.configure.knowledgeRetrieval.remove": "إزالة {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "مصادر استرجاع المعرفة التي يمكن لهذا الوكيل استخدامها أثناء تنسيق المهام.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "تبديل استرجاع المعرفة",
+  "agentDetail.configure.model.label": "النموذج",
+  "agentDetail.configure.orchestrate": "تنسيق",
+  "agentDetail.configure.preview.chatFeatures": "ميزات الدردشة",
+  "agentDetail.configure.preview.empty.defaultAgentName": "وكيل",
+  "agentDetail.configure.preview.empty.description": "أرسل رسالة لاختبار المسودة الحالية.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "لا توجد تعليمات بعد، لذلك تأتي الردود من النموذج البسيط.",
+  "agentDetail.configure.preview.endUserAuth": "مصادقة المستخدم النهائي",
+  "agentDetail.configure.preview.restart": "إعادة تشغيل المعاينة",
+  "agentDetail.configure.preview.title": "معاينة",
+  "agentDetail.configure.prompt.copied": "تم نسخ المطالبة",
+  "agentDetail.configure.prompt.copy": "نسخ المطالبة",
+  "agentDetail.configure.prompt.copyFailed": "فشل نسخ المطالبة.",
+  "agentDetail.configure.prompt.insert.label": "إدراج",
+  "agentDetail.configure.prompt.insert.question": "بدء السؤال",
+  "agentDetail.configure.prompt.insert.reportFile": "ملف تقرير الإخراج",
+  "agentDetail.configure.prompt.insert.tenders": "بدء العطاءات",
+  "agentDetail.configure.prompt.label": "المطالبة",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "إشارة",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "اكتب التعليمات هنا،",
+  "agentDetail.configure.prompt.tip": "حدّد كيف يجب أن يفسر هذا الوكيل المدخلات، ويستدعي الأدوات، وينتج المخرجات.",
+  "agentDetail.configure.publishBar.draft": "مسودة",
+  "agentDetail.configure.publishBar.publishUpdate": "نشر التحديث",
+  "agentDetail.configure.publishBar.published": "تم النشر",
+  "agentDetail.configure.publishBar.publishedAt": "تم النشر {{time}}",
+  "agentDetail.configure.publishBar.publishing": "جارٍ النشر…",
+  "agentDetail.configure.publishBar.saved": "تم الحفظ قبل 5 دقائق",
+  "agentDetail.configure.publishBar.savedAt": "تم الحفظ {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "تغييرات غير منشورة",
+  "agentDetail.configure.publishBar.upToDate": "محدث",
+  "agentDetail.configure.publishBar.versionHistory": "فتح سجل الإصدارات",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "سير العمل المتأثر",
+  "agentDetail.configure.publishImpact.cancel": "إلغاء",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "يظهر وكيلك في",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". ستؤثر التغييرات عليها.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "هذا الوكيل",
+  "agentDetail.configure.publishImpact.title": "{{action}} إلى {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} سير عمل",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} سير عمل",
+  "agentDetail.configure.skills.add": "إضافة مهارة",
+  "agentDetail.configure.skills.detail.contentRegion": "محتوى تفاصيل المهارة",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} ملفات",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "ملفات المهارة",
+  "agentDetail.configure.skills.detail.files": "الملفات",
+  "agentDetail.configure.skills.empty.description": "تمنح المهارات الوكيل خبرة قابلة لإعادة الاستخدام يمكنه استدعاؤها أثناء العمل",
+  "agentDetail.configure.skills.empty.title": "لا توجد مهارات بعد",
+  "agentDetail.configure.skills.itemType": "مهارة",
+  "agentDetail.configure.skills.label": "المهارات",
+  "agentDetail.configure.skills.remove": "إزالة {{name}}",
+  "agentDetail.configure.skills.tip": "المهارات التي يمكن لهذا الوكيل استخدامها أثناء تنسيق المهام.",
+  "agentDetail.configure.skills.toggle": "تبديل المهارات",
+  "agentDetail.configure.skills.upload.action": "تحميل",
+  "agentDetail.configure.skills.upload.browse": "استعراض",
+  "agentDetail.configure.skills.upload.description": "قم بتحميل حزمة .zip أو .skill لهذا الوكيل.",
+  "agentDetail.configure.skills.upload.dropzone": "أفلت حزمة مهارة هنا، أو",
+  "agentDetail.configure.skills.upload.failed": "فشل تحميل المهارة.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "قم بتحميل ملف .zip أو .skill.",
+  "agentDetail.configure.skills.upload.success": "تم تحميل المهارة.",
+  "agentDetail.configure.skills.upload.title": "تحميل مهارة",
+  "agentDetail.configure.tools.add": "إضافة أداة",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "للمطورين",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "ثبّت برنامج سطر أوامر يقوم الوكيل بتشغيله في sandbox الخاص به. يحتاج إلى تثبيت وعادةً إلى API Key.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "أداة CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "اختر أداة موجودة بالفعل في مساحة العمل هذه، مثل بحث الويب أو التكاملات.",
+  "agentDetail.configure.tools.addMenu.tool.label": "أداة",
+  "agentDetail.configure.tools.cliDialog.description": "ثبّت أداة CLI من أي سجل حزم. يحصل الوكيل على وصول shell إلى الثنائي الذي يوفره.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "تعديل أداة CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "خزّن API Keys أو الرموز أو الأسرار التي تحتاجها أداة CLI هذه. يتم تشفير القيم في حالة التخزين وحقنها كمتغيرات بيئة عند استدعاء الوكيل للأداة.",
+  "agentDetail.configure.tools.cliDialog.env.label": "متغيرات البيئة",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(اختياري)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Sandboxed · يعمل مرة واحدة عند أول استدعاء",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "أمر التثبيت",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "الصق أمر التثبيت هنا، مثل npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "أمر التثبيت مطلوب.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "اعرف المزيد عن أداة CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "اسم أداة CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "قم بتسمية أداة CLI الخاصة بك",
+  "agentDetail.configure.tools.cliDialog.name.required": "اسم أداة CLI مطلوب.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "لا تظهر أبداً في مطالبة الوكيل؛ يتم حقنها فقط كـ $VAR في وقت التشغيل",
+  "agentDetail.configure.tools.cliDialog.title": "إضافة أداة CLI",
+  "agentDetail.configure.tools.cliTool": "أداة CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "المستخدم النهائي · OAuth",
+  "agentDetail.configure.tools.editAction": "تعديل {{name}}",
+  "agentDetail.configure.tools.empty.description": "تتيح الأدوات للوكيل التصرف، مثل البحث على الويب أو استدعاء تطبيقاتك",
+  "agentDetail.configure.tools.empty.title": "لا توجد أدوات بعد",
+  "agentDetail.configure.tools.label": "الأدوات",
+  "agentDetail.configure.tools.moreActions": "إجراءات أخرى لـ {{name}}",
+  "agentDetail.configure.tools.pluginType": "مكون إضافي",
+  "agentDetail.configure.tools.preAuthorize": "تفويض مسبق",
+  "agentDetail.configure.tools.removeAction": "إزالة {{name}}",
+  "agentDetail.configure.tools.removeProvider": "إزالة جميع الأدوات",
+  "agentDetail.configure.tools.tip": "الأدوات التي يمكن لهذا الوكيل استدعاؤها أثناء تنسيق المهام.",
+  "agentDetail.configure.tools.toggle": "تبديل الأدوات",
+  "agentDetail.configure.tools.toolTabs.all": "الكل",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "مخصص",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "المكونات الإضافية",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "وكيل",
+  "agentDetail.history": "السجل",
+  "agentDetail.logs.description": "تسجل السجلات الكاملة حالة تشغيل التطبيق، بما في ذلك مدخلات المستخدم وردود الوكيل والتخطيط واستخدامات الأدوات.",
+  "agentDetail.logs.empty": "لم يتم العثور على سجلات",
+  "agentDetail.logs.filters.period.allTime": "كل الأوقات",
+  "agentDetail.logs.filters.period.label": "فترة السجل",
+  "agentDetail.logs.filters.period.last30days": "آخر 30 يوماً",
+  "agentDetail.logs.filters.period.last7days": "آخر 7 أيام",
+  "agentDetail.logs.filters.search.label": "البحث في السجلات",
+  "agentDetail.logs.filters.search.placeholder": "بحث",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "آخر وقت إنشاء",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "آخر وقت تحديث",
+  "agentDetail.logs.filters.source.all": "المصدر",
+  "agentDetail.logs.filters.source.empty": "لم يتم العثور على مصادر",
+  "agentDetail.logs.filters.source.label": "مصدر السجل",
+  "agentDetail.logs.filters.source.loadFailed": "تعذر تحميل المصادر",
+  "agentDetail.logs.filters.source.loading": "جارٍ تحميل المصادر…",
+  "agentDetail.logs.filters.source.searchLabel": "البحث في المصادر",
+  "agentDetail.logs.filters.source.searchPlaceholder": "بحث",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "سير العمل",
+  "agentDetail.logs.learnMore": "اعرف المزيد",
+  "agentDetail.logs.loadFailed": "تعذر تحميل السجلات",
+  "agentDetail.logs.loading": "جارٍ تحميل السجلات…",
+  "agentDetail.logs.notAvailable": "غير متاح",
+  "agentDetail.logs.table.createdTime": "وقت الإنشاء",
+  "agentDetail.logs.table.endUser": "المستخدم النهائي",
+  "agentDetail.logs.table.messageCount": "عدد الرسائل",
+  "agentDetail.logs.table.operationRate": "معدل العمليات",
+  "agentDetail.logs.table.source": "المصدر",
+  "agentDetail.logs.table.title": "العنوان",
+  "agentDetail.logs.table.unread": "غير مقروء",
+  "agentDetail.logs.table.updatedTime": "وقت التحديث",
+  "agentDetail.logs.table.userRate": "معدل المستخدم",
+  "agentDetail.logs.title": "السجلات",
+  "agentDetail.memorySettings.budgetLabel": "ميزانية الذاكرة",
+  "agentDetail.memorySettings.description": "إعدادات الذاكرة من لقطة التكوين النشطة.",
+  "agentDetail.memorySettings.export.description": "تصدير الذاكرة مخطط له لإصدار لاحق.",
+  "agentDetail.memorySettings.export.download": "تنزيل",
+  "agentDetail.memorySettings.export.soon": "قريباً",
+  "agentDetail.memorySettings.export.title": "تصدير الذاكرة الحالية",
+  "agentDetail.memorySettings.notConfigured": "غير مكوّن",
+  "agentDetail.memorySettings.scopeLabel": "نطاق الذاكرة",
+  "agentDetail.memorySettings.title": "الذاكرة",
+  "agentDetail.metadata.activeVersionLabel": "الإصدار النشط",
+  "agentDetail.metadata.appIdLabel": "معرّف التطبيق",
+  "agentDetail.metadata.description": "حقول Roster للقراءة فقط التي تعيدها الواجهة الخلفية للوكيل.",
+  "agentDetail.metadata.emptyValue": "غير متاح",
+  "agentDetail.metadata.scopeLabel": "النطاق",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "سير العمل فقط",
+  "agentDetail.metadata.sourceLabel": "المصدر",
+  "agentDetail.metadata.statusLabel": "الحالة",
+  "agentDetail.metadata.title": "البيانات الوصفية",
+  "agentDetail.metadata.updatedAtLabel": "تاريخ التحديث",
+  "agentDetail.metadata.workflowIdLabel": "معرّف سير العمل",
+  "agentDetail.metadata.workflowNodeIdLabel": "معرّف عقدة سير العمل",
+  "agentDetail.monitoring.change": "{{value}} عن الفترة السابقة",
+  "agentDetail.monitoring.dateRangeLabel": "نطاق التاريخ",
+  "agentDetail.monitoring.description": "تتبّع نشاط وتكلفة وجودة تفاعل الوكيل القابل لإعادة الاستخدام عبر سير العمل.",
+  "agentDetail.monitoring.learnMore": "اعرف المزيد",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "المستخدمون النهائيون الفريدون الذين شغّلوا سير العمل باستخدام هذا الوكيل.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "المستخدمون النشطون",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "عدد التواصل المستمر بين المستخدم والوكيل لنقطة الوصول هذه.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "متوسط تفاعلات الجلسة",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "متوسط سرعة الإخراج من بداية الطلب حتى الاكتمال.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "سرعة إخراج التوكن",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "تكلفة التوكن المقدرة التي ينتجها هذا الوكيل عبر تشغيل سير العمل.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "استخدام التوكن",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "محادثات الذكاء الاصطناعي اليومية التي وصلت إلى هذا الوكيل من خلال نقطة الوصول المحددة.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "إجمالي المحادثات",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "عدد تفاعلات الوكيل اليومية.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "إجمالي الرسائل",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "عدد الإعجابات لكل 1000 رسالة لهذا الوكيل.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "معدل رضا المستخدم",
+  "agentDetail.monitoring.pickSource": "اختر تطبيقاً",
+  "agentDetail.monitoring.sourceLabel": "التطبيق",
+  "agentDetail.monitoring.sourceTrigger": "المصدر {{name}}",
+  "agentDetail.monitoring.sources.all": "الكل",
+  "agentDetail.monitoring.timeRangeLabel": "النطاق الزمني",
+  "agentDetail.monitoring.timeRanges.custom": "مخصص",
+  "agentDetail.monitoring.timeRanges.last30days": "آخر 30 يوماً",
+  "agentDetail.monitoring.timeRanges.last7days": "آخر 7 أيام",
+  "agentDetail.monitoring.timeRanges.today": "اليوم",
+  "agentDetail.monitoring.title": "المراقبة",
+  "agentDetail.monitoring.tokenUsageConsumed": "التوكنات المستهلكة",
+  "agentDetail.monitoring.units.tokenPerSecond": "توكن/ث",
+  "agentDetail.navigationLabel": "تنقّل الوكيل",
+  "agentDetail.publish": "نشر",
+  "agentDetail.publishSoon": "قريباً",
+  "agentDetail.sections.access": "نقطة الوصول",
+  "agentDetail.sections.configure": "تنسيق",
+  "agentDetail.sections.logs": "السجلات",
+  "agentDetail.sections.monitoring": "المراقبة",
+  "agentDetail.subtitle": "معرّف الوكيل: {{agentId}}",
+  "agentDetail.title": "وكيل",
+  "agentDetail.type": "وكيل",
+  "agentDetail.versionHistory.active": "نشط",
+  "agentDetail.versionHistory.empty": "لا توجد إصدارات بعد",
+  "agentDetail.versionHistory.filter": "تصفية الإصدارات",
+  "agentDetail.versionHistory.versionName": "الإصدار {{version}}",
+  "roster.createAgent": "إنشاء وكيل",
+  "roster.createAgentOptions": "خيارات إنشاء الوكيل",
+  "roster.createDialog.description": "أنشئ وكيلاً قابلاً لإعادة الاستخدام في Roster مساحة العمل هذه.",
+  "roster.createDialog.title": "إنشاء وكيل",
+  "roster.createForm.changeIcon": "تغيير أيقونة الوكيل",
+  "roster.createForm.descriptionLabel": "الوصف",
+  "roster.createForm.descriptionOptional": "(اختياري)",
+  "roster.createForm.descriptionPlaceholder": "مثلاً يجمع المصادر حول موضوع ويلخص النتائج الرئيسية",
+  "roster.createForm.nameLabel": "الاسم",
+  "roster.createForm.namePlaceholder": "مثلاً Max",
+  "roster.createForm.nameRequired": "الاسم مطلوب.",
+  "roster.createForm.roleLabel": "الدور",
+  "roster.createForm.rolePlaceholder": "مثلاً مساعد بحث",
+  "roster.createForm.roleRequired": "الدور مطلوب.",
+  "roster.createSuccess": "تم إنشاء الوكيل.",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "ستتم إزالة هذا الوكيل من قائمة Roster النشطة.",
+  "roster.deleteDialog.title": "حذف {{name}}؟",
+  "roster.deleteFailed": "فشل حذف الوكيل.",
+  "roster.deleteSuccess": "تم حذف الوكيل.",
+  "roster.duplicateFailed": "فشل نسخ الوكيل.",
+  "roster.duplicateSuccess": "تم نسخ الوكيل.",
+  "roster.editAgent": "تعديل {{name}}",
+  "roster.editDialog.description": "حدّث اسم Roster والوصف والدور لهذا الوكيل.",
+  "roster.editDialog.title": "تعديل الوكيل",
+  "roster.editInfo": "تعديل المعلومات",
+  "roster.empty": "لا يوجد وكيل بعد",
+  "roster.emptyDescription": "ستظهر الوكلاء المحفوظون في مساحة العمل هذه هنا.",
+  "roster.emptySearch": "لا يوجد وكلاء مطابقون",
+  "roster.emptySearchDescription": "جرّب اسم وكيل آخر.",
+  "roster.filters.all": "الكل",
+  "roster.filters.drafts": "مسودات",
+  "roster.filters.label": "مرشحات الوكيل",
+  "roster.filters.published": "منشور",
+  "roster.learnMore": "اعرف المزيد عن Agent Roster",
+  "roster.listLabel": "قائمة Roster الوكلاء",
+  "roster.loadMore": "تحميل المزيد",
+  "roster.loadingError": "فشل تحميل الوكلاء. قم بالتحديث وحاول مرة أخرى.",
+  "roster.moreActions": "إجراءات أخرى لـ {{name}}",
+  "roster.nodeSelector.createInlineFailed": "فشل إنشاء وكيل inline. قم بالتحديث وحاول مرة أخرى.",
+  "roster.nodeSelector.dialogLabel": "اختر وكيلاً",
+  "roster.nodeSelector.manageInAgentConsole": "إدارة في Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "بحث…",
+  "roster.nodeSelector.startFromScratch": "البدء من الصفر",
+  "roster.references.label": "سير العمل الذي يستخدم {{name}}",
+  "roster.references.trigger": "سير العمل الذي يستخدم {{name}}",
+  "roster.searchLabel": "البحث عن الوكلاء",
+  "roster.searchPlaceholder": "ابحث عن الوكلاء بالاسم…",
+  "roster.sources.agent_app": "تطبيق الوكيل",
+  "roster.sources.imported": "مستورد",
+  "roster.sources.system": "النظام",
+  "roster.sources.workflow": "سير العمل",
+  "roster.status.active": "نشط",
+  "roster.status.archived": "مؤرشف",
+  "roster.tabs.agent": "وكيل",
+  "roster.tabs.human": "إنسان",
+  "roster.tabsLabel": "نوع Roster",
+  "roster.updateSuccess": "تم تحديث الوكيل.",
+  "roster.usageStatus.draft": "مسودة"
+}
diff --git a/web/i18n/ar-TN/app-log.json b/web/i18n/ar-TN/app-log.json
index aeb817c620d..af2b6432650 100644
--- a/web/i18n/ar-TN/app-log.json
+++ b/web/i18n/ar-TN/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "اليوم",
   "filter.period.yearToDate": "السنة حتى الآن",
   "filter.sortBy": "رتب حسب:",
+  "monitoring.description": "يسجل الرصد حالة تشغيل التطبيق، بما في ذلك الأداء ونشاط المستخدمين والتكاليف.",
   "promptLog": "سجل المطالبة",
   "runDetail.fileListDetail": "تفاصيل",
   "runDetail.fileListLabel": "تفاصيل الملف",
diff --git a/web/i18n/ar-TN/app.json b/web/i18n/ar-TN/app.json
index d02064948c6..3a295fe102a 100644
--- a/web/i18n/ar-TN/app.json
+++ b/web/i18n/ar-TN/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "المخرجات الهيكلية هي ميزة تضمن أن يولد النموذج دائمًا استجابات تلتزم بـ JSON Schema الذي قدمته",
   "studio.allApps": "كل التطبيقات",
   "studio.apps": "تطبيقات",
-  "studio.filters.allCreators": "جميع المبدعين",
-  "studio.filters.creators": "المبدعين",
+  "studio.filters.allCreators": "جميع المنشئين",
+  "studio.filters.creators": "المنشئون",
   "studio.filters.reset": "إعادة تعيين",
   "studio.filters.searchCreators": "بحث عن المبدع...",
   "studio.filters.types": "أنواع",
diff --git a/web/i18n/ar-TN/billing.json b/web/i18n/ar-TN/billing.json
index 24bc5d2d589..98920cb4558 100644
--- a/web/i18n/ar-TN/billing.json
+++ b/web/i18n/ar-TN/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "قم بالترقية لفتح ميزة تحميل المستندات دفعة واحدة",
   "upgrade.uploadMultiplePages.description": "لقد وصلت إلى حد التحميل — يمكن اختيار ورفع مستند واحد فقط في كل مرة على الخطة الحالية الخاصة بك.",
   "upgrade.uploadMultiplePages.title": "قم بالترقية لتحميل عدة مستندات دفعة واحدة",
+  "upgrade.workflowRestore.description": "استعادة إصدارات سير العمل غير متاحة في خطتك الحالية.",
+  "upgrade.workflowRestore.title": "قم بالترقية لاستعادة إصدارات سير العمل",
   "upgradeBtn.encourage": "الترقية الآن",
   "upgradeBtn.encourageShort": "ترقية",
   "upgradeBtn.plain": "عرض الخطة",
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index a9b60e1e6d1..350d3b10788 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "تبديل مساحة العمل",
   "mcpPage.description": "اتصل بخوادم MCP وأدرها لمنح تطبيقاتك إمكانية الوصول إلى الأدوات والخدمات الخارجية.",
-  "members.admin": "المسؤول",
   "members.adminTip": "يمكنه بناء التطبيقات وإدارة إعدادات الفريق",
+  "members.alreadyInTeam": "موجود بالفعل في الفريق",
+  "members.alreadyInTeamTip": "هؤلاء المستخدمون لديهم بالفعل إمكانية الوصول إلى مساحة العمل هذه.",
   "members.builder": "باني",
   "members.builderTip": "يمكنه بناء وتعديل تطبيقاته الخاصة",
-  "members.datasetOperator": "مسؤول المعرفة",
   "members.datasetOperatorTip": "يمكنه إدارة قاعدة المعرفة فقط",
   "members.deleteMember": "حذف العضو",
   "members.disInvite": "إلغاء الدعوة",
-  "members.editor": "محرر",
   "members.editorTip": "يمكنه بناء وتعديل التطبيقات",
   "members.email": "البريد الإلكتروني",
   "members.emailInvalid": "تنسيق البريد الإلكتروني غير صالح",
@@ -270,13 +269,12 @@
   "members.invite": "إضافة",
   "members.inviteTeamMember": "إضافة عضو فريق",
   "members.inviteTeamMemberTip": "يمكنهم الوصول إلى بيانات فريقك مباشرة بعد تسجيل الدخول.",
-  "members.invitedAsRole": "تمت الدعوة كمستخدم {{role}}",
+  "members.invitedAsRole": "تمت الدعوة كـ {{role}}",
   "members.lastActive": "آخر نشاط",
   "members.name": "الاسم",
-  "members.normal": "عادي",
+  "members.noNewInvitationsSent": "لم يتم إرسال دعوات جديدة",
   "members.normalTip": "يمكنه استخدام التطبيقات فقط، ولا يمكنه بناء التطبيقات",
   "members.ok": "موافق",
-  "members.owner": "المالك",
   "members.pending": "قيد الانتظار...",
   "members.removeFromTeam": "إزالة من الفريق",
   "members.removeFromTeamTip": "سيتم إزالة وصول الفريق",
@@ -311,12 +309,14 @@
   "menus.apps": "الاستوديو",
   "menus.datasets": "المعرفة",
   "menus.datasetsTips": "قريباً: استيراد بيانات النص الخاصة بك أو كتابة البيانات في الوقت الفعلي عبر Webhook لتحسين سياق LLM.",
+  "menus.deployments": "عمليات النشر",
   "menus.explore": "استكشاف",
   "menus.exploreMarketplace": "استكشاف السوق",
   "menus.newApp": "تطبيق جديد",
   "menus.newDataset": "إنشاء معرفة",
   "menus.plugins": "الإضافات",
   "menus.pluginsTips": "ادمج الإضافات الخارجية أو أنشئ إضافات AI متوافقة مع ChatGPT.",
+  "menus.roster": "قائمة الوكلاء",
   "menus.status": "بيتا",
   "menus.tools": "الأدوات",
   "model.addMoreModel": "انتقل إلى الإعدادات لإضافة المزيد من النماذج",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "نموذج تحويل النص إلى كلام",
   "modelProvider.ttsModel.tip": "تعيين النموذج الافتراضي لإدخال تحويل النص إلى كلام في المحادثة.",
   "modelProvider.upgradeForLoadBalancing": "قم بترقية خطتك لتمكين موازنة التحميل.",
+  "navigation.skipToMain": "الانتقال إلى المحتوى الرئيسي",
   "noData": "لا توجد بيانات",
   "operation.add": "إضافة",
   "operation.added": "تمت الإضافة",
@@ -600,9 +601,6 @@
   "placeholder.input": "يرجى الإدخال",
   "placeholder.search": "بحث...",
   "placeholder.select": "يرجى التحديد",
-  "plugin.serpapi.apiKey": "مفتاح API",
-  "plugin.serpapi.apiKeyPlaceholder": "أدخل مفتاح API الخاص بك",
-  "plugin.serpapi.keyFrom": "احصل على مفتاح SerpAPI الخاص بك من صفحة حساب SerpAPI",
   "promptEditor.context.item.desc": "إدراج قالب السياق",
   "promptEditor.context.item.title": "السياق",
   "promptEditor.context.modal.add": "إضافة سياق ",
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
new file mode 100644
index 00000000000..f4185138d19
--- /dev/null
+++ b/web/i18n/ar-TN/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "واجهة برمجة تطبيقات الخدمة الخلفية",
+  "access.api.copyCurlExample": "نسخ مثال cURL",
+  "access.api.createFailed": "فشل في إنشاء رمز API.",
+  "access.api.createKey": "إنشاء رمز API",
+  "access.api.createKeyTitle": "إنشاء رمز API جديد",
+  "access.api.curlExampleTitle": "مثال cURL",
+  "access.api.description": "الوصول إلى هذا النشر عبر HTTP. كل رمز API مخصص لبيئة واحدة.",
+  "access.api.developerTitle": "واجهة API للمطورين",
+  "access.api.disabled": "الوصول إلى API معطل لهذا النشر.",
+  "access.api.disabledHint": "قم بتمكين الوصول إلى API لإنشاء رموز مخصصة للبيئة.",
+  "access.api.dismissToken": "إخفاء رمز API",
+  "access.api.docs": "وثائق API",
+  "access.api.docsClose": "إغلاق وثائق API",
+  "access.api.docsDescription": "عرض مرجع Workflow API لهذا النشر.",
+  "access.api.docsTitle": "وثائق Workflow API",
+  "access.api.empty": "قم بالنشر إلى بيئة أولاً لبدء إصدار رموز API.",
+  "access.api.emptyTitle": "لا توجد بيئات منشورة",
+  "access.api.endpoint": "عنوان URL للطلب",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "قائمة رموز API",
+  "access.api.nameLabel": "اسم رمز API",
+  "access.api.namePlaceholder": "أدخل اسم رمز API",
+  "access.api.nameRequired": "اسم رمز API مطلوب.",
+  "access.api.newKey": "إنشاء رمز API جديد",
+  "access.api.newTokenDescription": "يتم عرض رمز API هذا مرة واحدة فقط. انسخه قبل مغادرة هذه الصفحة.",
+  "access.api.newTokenLabel": "رمز API",
+  "access.api.newTokenTitle": "تم إنشاء رمز API",
+  "access.api.noKeys": "لا توجد رموز API بعد. أنشئ واحدًا لبدء استدعاء API.",
+  "access.api.noKeysTitle": "لا توجد رموز API بعد",
+  "access.api.revokeConfirmDescription": "سيتوقف رمز API \"{{name}}\" عن العمل فورًا. لا يمكن التراجع عن هذا الإجراء.",
+  "access.api.revokeConfirmTitle": "هل تريد إبطال رمز API؟",
+  "access.api.revokeFailed": "فشل في إبطال رمز API.",
+  "access.api.revokeSuccess": "تم إبطال رمز API",
+  "access.api.table.action": "الإجراء",
+  "access.api.table.environment": "البيئة",
+  "access.api.table.key": "رمز API",
+  "access.api.table.name": "الاسم",
+  "access.api.title": "API",
+  "access.channels.col.channel": "القناة",
+  "access.channels.col.endpoint": "نقطة الدخول",
+  "access.channels.col.status": "الحالة",
+  "access.channels.description": "تستخدم نقاط دخول WebApp وCLI أذونات الوصول الواردة أعلاه.",
+  "access.channels.disabled": "قنوات الوصول معطلة لهذا النشر.",
+  "access.channels.disabledHint": "قم بتمكين قنوات الوصول لعرض نقاط دخول WebApp وCLI.",
+  "access.channels.followPermission": "يتبع الأذونات",
+  "access.channels.title": "قنوات الوصول",
+  "access.cli.description": "استدعِ من الطرفية باستخدام difyctl، مناسب للسكربتات أو سير العمل الآلي أو تكاملات الوكلاء.",
+  "access.cli.docs": "دليل الاستخدام",
+  "access.cli.domain": "النطاق",
+  "access.cli.empty": "لم يتم تكوين نقطة نهاية CLI.",
+  "access.cli.install": "تثبيت CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "تم النسخ",
+  "access.copy": "نسخ",
+  "access.copyFailed": "فشل النسخ",
+  "access.copyToast": "تم النسخ إلى الحافظة",
+  "access.hide": "إخفاء",
+  "access.members.clearAll": "مسح الكل",
+  "access.members.empty": "لا توجد نتائج مطابقة.",
+  "access.members.groupCount_one": "{{count}} مجموعة",
+  "access.members.groupCount_other": "{{count}} مجموعات",
+  "access.members.groups": "المجموعات",
+  "access.members.individuals": "الأعضاء",
+  "access.members.memberCount_one": "{{count}} عضو",
+  "access.members.memberCount_other": "{{count}} أعضاء",
+  "access.members.pickPlaceholder": "اختر المجموعات أو الأعضاء",
+  "access.members.searchPlaceholder": "بحث عن المجموعات والأعضاء",
+  "access.members.selectedLabel": "المحدد",
+  "access.permission.anyone": "أي شخص لديه الرابط",
+  "access.permission.anyoneDesc": "يمكن لأي شخص الوصول إلى هذا النشر دون تسجيل الدخول.",
+  "access.permission.memberCount_one": "{{count}} عضو",
+  "access.permission.memberCount_other": "{{count}} أعضاء",
+  "access.permission.organization": "جميع الأعضاء في المنصة",
+  "access.permission.organizationDesc": "جميع الأعضاء في المنصة",
+  "access.permission.specific": "أعضاء محددون في المنصة",
+  "access.permission.specificDesc": "اختر مجموعات أو أعضاء محددين",
+  "access.permission.specificUnavailable": "تحديد الأعضاء المحددين معطل حتى يتم ربط الأعضاء والمجموعات الفعليين في المنصة.",
+  "access.permission.updateFailed": "فشل في تحديث سياسة الوصول.",
+  "access.permissions.col.environment": "البيئة",
+  "access.permissions.col.permission": "الوصول",
+  "access.permissions.description": "اضبط أذونات الوصول لنقاط دخول WebApp وCLI في كل بيئة.",
+  "access.permissions.editAriaLabel": "تكوين الوصول لـ {{environment}}",
+  "access.permissions.editDescription": "اضبط أذونات الوصول لنقاط دخول WebApp وCLI.",
+  "access.permissions.editTitle": "أذونات الوصول",
+  "access.permissions.title": "أذونات الوصول",
+  "access.revoke": "إبطال",
+  "access.runAccess.description": "إدارة كيفية تشغيل المستخدمين لهذا النشر ومن المسموح له بالوصول إليه في كل بيئة.",
+  "access.runAccess.disabled": "وصول التشغيل معطل لهذا النشر.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "اعرض هذا النشر كخادم Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "لم يتم تكوين نقطة نهاية MCP.",
+  "access.runAccess.noEnvs": "قم بالنشر إلى بيئة لتكوين أذونات الوصول.",
+  "access.runAccess.noEnvsTitle": "لا توجد بيئات منشورة",
+  "access.runAccess.openWebapp": "فتح WebApp",
+  "access.runAccess.permissions": "أذونات الوصول",
+  "access.runAccess.permissionsDesc": "من يمكنه الوصول إلى هذا النشر في كل بيئة.",
+  "access.runAccess.title": "وصول التشغيل",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "صفحة ويب مستضافة للمستخدمين النهائيين.",
+  "access.runAccess.webappEmpty": "قريبًا.",
+  "access.show": "إظهار",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "خارجي",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "غير معروف",
+  "card.access.api": "رموز API",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "لا يوجد وصول",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "إنشاء أول إصدار",
+  "card.deploy": "نشر",
+  "card.deploying": "{{count}} قيد النشر",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} فشل",
+  "card.fromApp": "من {{name}}",
+  "card.lastDeployed": "آخر نشر {{time}}",
+  "card.menu.delete": "حذف النشر",
+  "card.menu.deleteDisabled": "حذف النشر غير متاح بعد لعمليات النشر المُدارة من الخلفية.",
+  "card.menu.deploy": "النشر إلى البيئة",
+  "card.menu.editInfo": "تعديل المعلومات",
+  "card.menu.viewDetail": "عرض تفاصيل النشر",
+  "card.moreActions": "المزيد من الإجراءات",
+  "card.neverDeployed": "لم يتم النشر بعد",
+  "card.noDescription": "لم يتم تقديم وصف.",
+  "card.notDeployed": "غير منشور",
+  "card.ready": "{{count}} قيد التشغيل",
+  "card.tooltip.createdAt": "تم الإنشاء",
+  "card.tooltip.deployed": "تم النشر",
+  "card.tooltip.deploymentStatus": "النشر",
+  "card.tooltip.notDeployed": "لم يتم نشر هذا النشر إلى أي بيئة بعد.",
+  "card.tooltip.notDeployedShort": "غير منشور",
+  "card.tooltip.release": "الإصدار",
+  "card.tooltip.releaseName": "اسم الإصدار",
+  "card.tooltip.source": "المصدر",
+  "common.loadFailed": "فشل التحميل. حاول مرة أخرى لاحقًا.",
+  "common.loading": "جاري التحميل...",
+  "createGuide.actions.back": "رجوع",
+  "createGuide.actions.cancel": "إلغاء",
+  "createGuide.actions.continue": "متابعة",
+  "createGuide.actions.createAndDeploy": "إنشاء ونشر",
+  "createGuide.actions.creating": "جاري الإنشاء...",
+  "createGuide.actions.deploy": "نشر",
+  "createGuide.actions.deploying": "جاري الإنشاء والنشر...",
+  "createGuide.actions.next": "التالي",
+  "createGuide.actions.skipDeploy": "تخطي، النشر لاحقًا",
+  "createGuide.description": "أنشئ نشرًا من مصدر إصدار ومعلومات أساسية وبيئة مستهدفة.",
+  "createGuide.dsl.defaultAppName": "تطبيق DSL المستورد",
+  "createGuide.dsl.description": "قم بتحميل حزمة Workflow DSL لإنشاء النشر والإصدار الأول ونشر البيئة الاختياري.",
+  "createGuide.dsl.dropDescription": "قم بتحميل حزمة Workflow YAML DSL. يتم تحديد خيارات النشر من هذا الملف قبل النشر.",
+  "createGuide.dsl.dropTitle": "تحميل حزمة Workflow DSL",
+  "createGuide.dsl.readFailed": "فشل في قراءة ملف DSL. اختر ملفًا آخر وحاول مرة أخرى.",
+  "createGuide.dsl.reading": "جاري قراءة ملف DSL...",
+  "createGuide.dsl.title": "استيراد DSL",
+  "createGuide.dsl.unsupportedMode": "يمكن استخدام ملفات Workflow DSL فقط لعمليات النشر.",
+  "createGuide.errors.createReleaseFailed": "فشل في إنشاء النشر أو الإصدار.",
+  "createGuide.errors.deployFailed": "فشل في النشر إلى البيئة.",
+  "createGuide.method.description": "اختر المصدر المستخدم لإنشاء الإصدار الأول.",
+  "createGuide.methods.bindApp.description": "استخدم تطبيق Workflow موجود في Studio كمصدر للإصدار.",
+  "createGuide.methods.bindApp.title": "ربط تطبيق Workflow موجود",
+  "createGuide.methods.importDsl.description": "قم بتحميل حزمة Workflow YAML DSL ومتابعة عبر واجهة النشر.",
+  "createGuide.methods.importDsl.title": "استيراد DSL",
+  "createGuide.methods.mocked": "محاكاة",
+  "createGuide.nav.back": "عمليات النشر",
+  "createGuide.release.defaultName": "الإصدار الأولي",
+  "createGuide.release.deployInfo": "معلومات النشر",
+  "createGuide.release.description": "املأ معلومات النشر وتفاصيل الإصدار الأول.",
+  "createGuide.release.firstVersion": "الإصدار الأول",
+  "createGuide.release.instanceDescription": "وصف النشر",
+  "createGuide.release.instanceDescriptionPlaceholder": "صف الغرض من استخدام هذا النشر",
+  "createGuide.release.instanceName": "اسم النشر",
+  "createGuide.release.instanceNameConflict": "يوجد بالفعل نشر بهذا الاسم. اختر اسمًا آخر.",
+  "createGuide.release.releaseDescription": "وصف الإصدار",
+  "createGuide.release.releaseDescriptionPlaceholder": "صف هذا الإصدار",
+  "createGuide.release.releaseName": "اسم الإصدار",
+  "createGuide.release.releaseNote": "وصف الإصدار",
+  "createGuide.release.title": "المعلومات الأساسية",
+  "createGuide.source.availableApps_one": "{{count}} تطبيق",
+  "createGuide.source.availableApps_other": "{{count}} تطبيقات",
+  "createGuide.source.clearSearch": "مسح بحث التطبيقات",
+  "createGuide.source.description": "اختر المصدر المستخدم لإنشاء الإصدار الأول.",
+  "createGuide.source.empty": "لم يتم العثور على تطبيقات Workflow.",
+  "createGuide.source.searchPlaceholder": "بحث عن التطبيقات",
+  "createGuide.source.sourceApp": "تطبيق Workflow",
+  "createGuide.source.title": "مصدر الإصدار",
+  "createGuide.steps.method": "مصدر الإصدار",
+  "createGuide.steps.release": "المعلومات الأساسية",
+  "createGuide.steps.source": "مصدر الإصدار",
+  "createGuide.steps.target": "النشر إلى البيئة",
+  "createGuide.target.bindingCount_one": "{{count}} ربط",
+  "createGuide.target.bindingCount_other": "{{count}} روابط",
+  "createGuide.target.bindingHint": "اختر بيانات الاعتماد التي يستخدمها هذا الإصدار.",
+  "createGuide.target.bindings": "بيانات الاعتماد",
+  "createGuide.target.deferredBindingHint": "ستُحَل بيانات الاعتماد من خطة النشر الفعلية أثناء إجراء النشر النهائي.",
+  "createGuide.target.deferredEnvironmentHint": "تتم مطابقة الاسم مع البيئات الفعلية بعد إنشاء النشر والإصدار.",
+  "createGuide.target.description": "اختر بيئة مستهدفة وقدم إعدادات وقت التشغيل التي يحتاجها هذا الإصدار هناك. يمكن تخطي هذه الخطوة.",
+  "createGuide.target.envVarCount_one": "{{count}} متغير",
+  "createGuide.target.envVarCount_other": "{{count}} متغيرات",
+  "createGuide.target.envVarHint": "لكل متغير بيئة يحتاجه هذا الإصدار، أدخل قيمة مخصصة أو استخدم القيمة المحددة في التطبيق.",
+  "createGuide.target.envVarPlaceholder": "أدخل القيمة",
+  "createGuide.target.envVarSource.ariaLabel": "اختر مصدر قيمة المتغير لـ {{key}}",
+  "createGuide.target.envVarSource.default": "قيمة التطبيق",
+  "createGuide.target.envVarSource.lastDeployment": "آخر قيمة منشورة",
+  "createGuide.target.envVarSource.literal": "قيمة مخصصة",
+  "createGuide.target.envVarType.number": "رقم",
+  "createGuide.target.envVarType.secret": "سر",
+  "createGuide.target.envVarType.string": "نص",
+  "createGuide.target.envVars": "متغيرات البيئة",
+  "createGuide.target.environment": "البيئة المستهدفة",
+  "createGuide.target.environmentName": "اسم البيئة",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "فشل في تحميل بيانات الاعتماد.",
+  "createGuide.target.loadEnvironmentsFailed": "فشل في تحميل بيئات النشر.",
+  "createGuide.target.missingRequiredBinding": "اختر بيانات اعتماد لهذا الربط المطلوب.",
+  "createGuide.target.noBindingRequired": "لا يلزم بيانات اعتماد.",
+  "createGuide.target.noCredentialCandidates": "لا توجد بيانات اعتماد متاحة.",
+  "createGuide.target.noEnvironmentOptions": "لا توجد بيئات نشر متاحة.",
+  "createGuide.target.required": "مطلوب",
+  "createGuide.target.selectCredential": "اختر بيانات اعتماد",
+  "createGuide.target.title": "النشر إلى البيئة",
+  "createGuide.title": "نشر جديد",
+  "createModal.appPickerPlaceholder": "اختر تطبيق Workflow",
+  "createModal.appSearchEmpty": "لا توجد تطبيقات Workflow مطابقة",
+  "createModal.appSearchPlaceholder": "بحث عن تطبيقات Workflow…",
+  "createModal.cancel": "إلغاء",
+  "createModal.create": "إنشاء",
+  "createModal.createFailed": "فشل في إنشاء النشر.",
+  "createModal.description": "اختر تطبيق Workflow وأنشئ نشرًا.",
+  "createModal.descriptionLabel": "الوصف",
+  "createModal.descriptionPlaceholder": "صف الغرض من استخدام هذا النشر",
+  "createModal.loadMoreApps": "تحميل المزيد من التطبيقات",
+  "createModal.loadingApps": "جاري تحميل التطبيقات…",
+  "createModal.nameLabel": "اسم النشر",
+  "createModal.namePlaceholder": "اسم النشر",
+  "createModal.noApps": "لم يتم العثور على تطبيقات Workflow في مساحة العمل هذه. أنشئ واحدًا في Studio أولاً.",
+  "createModal.selected": "المحدد",
+  "createModal.sourceApp": "تطبيق Workflow (مطلوب)",
+  "createModal.title": "نشر جديد",
+  "deployDrawer.bindingCount_one": "{{count}} ربط",
+  "deployDrawer.bindingCount_other": "{{count}} روابط",
+  "deployDrawer.bindingOptionsFailed": "فشل في تحميل خيارات بيانات الاعتماد.",
+  "deployDrawer.bindingSelectionHint": "اختر بيانات الاعتماد التي يستخدمها هذا النشر.",
+  "deployDrawer.bindingsDisabled": "تم حلها من معاينة الإصدار. التحرير غير متاح بعد.",
+  "deployDrawer.cancel": "إلغاء",
+  "deployDrawer.close": "إغلاق درج النشر",
+  "deployDrawer.defaultSelect": "اختر...",
+  "deployDrawer.deploy": "النشر إلى البيئة",
+  "deployDrawer.deployExistingRelease": "النشر إلى البيئة",
+  "deployDrawer.deployExistingReleaseDescription": "اختر إصدارًا وبيئة مستهدفة للنشر.",
+  "deployDrawer.deployExistingReleaseTitle": "النشر إلى البيئة",
+  "deployDrawer.deployFailed": "فشل في بدء النشر.",
+  "deployDrawer.deploying": "جاري النشر...",
+  "deployDrawer.description": "اختر إصدارًا وبيئة مستهدفة للنشر.",
+  "deployDrawer.envVarCount_one": "{{count}} متغير",
+  "deployDrawer.envVarCount_other": "{{count}} متغيرات",
+  "deployDrawer.envVarHint": "لكل متغير بيئة يحتاجه هذا الإصدار، أدخل قيمة مخصصة أو استخدم القيمة المحددة في التطبيق.",
+  "deployDrawer.envVarPlaceholder": "أدخل القيمة",
+  "deployDrawer.envVarSource.ariaLabel": "اختر مصدر قيمة المتغير لـ {{key}}",
+  "deployDrawer.envVarSource.default": "قيمة التطبيق",
+  "deployDrawer.envVarSource.lastDeployment": "آخر قيمة منشورة",
+  "deployDrawer.envVarSource.literal": "قيمة مخصصة",
+  "deployDrawer.envVarType.number": "رقم",
+  "deployDrawer.envVarType.secret": "سر",
+  "deployDrawer.envVarType.string": "نص",
+  "deployDrawer.envVars": "متغيرات البيئة",
+  "deployDrawer.existingReleaseHint": "سيتم نشر هذا الإصدار كما هو. لن يتم إنشاء إصدار جديد.",
+  "deployDrawer.loadingBindings": "جاري الحل...",
+  "deployDrawer.lockedHint": "مقفل على البيئة الحالية",
+  "deployDrawer.missingRequiredBinding": "اختر بيانات اعتماد لهذا الربط المطلوب.",
+  "deployDrawer.missingRequiredEnvVar": "أدخل قيمة لمتغير البيئة المطلوب هذا.",
+  "deployDrawer.modelCreds": "بيانات اعتماد النموذج",
+  "deployDrawer.needsValidation": " (يحتاج إلى التحقق)",
+  "deployDrawer.newReleaseHint": "سيتم إنشاء إصدار جديد من YAML تطبيق Workflow المحدد.",
+  "deployDrawer.noBindingRequired": "غير مطلوب",
+  "deployDrawer.noCredentialCandidates": "لا توجد بيانات اعتماد متاحة.",
+  "deployDrawer.noNewEnvironmentAvailable": "جميع البيئات المتاحة لديها بالفعل نشر.",
+  "deployDrawer.noOtherReleaseAvailable": "لا توجد إصدارات أخرى متاحة لهذه البيئة.",
+  "deployDrawer.noReleaseAvailable": "أنشئ إصدارًا قبل النشر إلى بيئة.",
+  "deployDrawer.notFound": "لم يتم العثور على النشر.",
+  "deployDrawer.noteLabel": "وصف الإصدار (اختياري)",
+  "deployDrawer.notePlaceholder": "مثال: تعديل نسخة الإعداد",
+  "deployDrawer.pluginCreds": "بيانات اعتماد الإضافة",
+  "deployDrawer.promote": "نشر",
+  "deployDrawer.promoteDescription": "اختر إصدارًا وبيئة مستهدفة للنشر.",
+  "deployDrawer.promoteTitle": "النشر إلى البيئة",
+  "deployDrawer.readOnly": "للقراءة فقط",
+  "deployDrawer.redeploy": "النشر إلى البيئة",
+  "deployDrawer.redeployDescription": "اختر إصدارًا وبيئة مستهدفة للنشر.",
+  "deployDrawer.redeployExistingReleaseHint": "سيتم إعادة نشر الإصدار الحالي كما هو. لن يتم إنشاء إصدار جديد.",
+  "deployDrawer.redeployTitle": "النشر إلى البيئة",
+  "deployDrawer.releaseLabel": "الإصدار",
+  "deployDrawer.requiredBinding": "مطلوب",
+  "deployDrawer.rollback": "نشر",
+  "deployDrawer.rollbackDescription": "اختر إصدارًا وبيئة مستهدفة للنشر.",
+  "deployDrawer.rollbackTitle": "النشر إلى البيئة",
+  "deployDrawer.runtimeCredentials": "بيانات الاعتماد",
+  "deployDrawer.secretPlaceholder": "سر",
+  "deployDrawer.selectCredential": "اختر بيانات اعتماد",
+  "deployDrawer.selectEnv": "اختر بيئة",
+  "deployDrawer.selectProviderCred": "اختر بيانات اعتماد {{provider}}",
+  "deployDrawer.selectProviderKey": "اختر مفتاح {{provider}}",
+  "deployDrawer.selectRelease": "اختر إصدارًا",
+  "deployDrawer.targetEnv": "البيئة المستهدفة",
+  "deployDrawer.title": "النشر إلى البيئة",
+  "deployDrawer.valuePlaceholder": "القيمة",
+  "deployTab.cancelDeployment": "إلغاء النشر",
+  "deployTab.closeError": "إغلاق",
+  "deployTab.col.actions": "الإجراءات",
+  "deployTab.col.currentRelease": "الإصدار الحالي",
+  "deployTab.col.environment": "البيئة",
+  "deployTab.col.status": "الحالة",
+  "deployTab.col.updated": "تم التحديث",
+  "deployTab.collapseDetails": "طي تفاصيل النشر",
+  "deployTab.confirmUndeploy": "إلغاء النشر",
+  "deployTab.deployOtherVersion": "نشر إصدار آخر",
+  "deployTab.deployToEnv": "النشر إلى {{name}}",
+  "deployTab.deployToNewEnv": "النشر إلى بيئة جديدة...",
+  "deployTab.empty": "لا توجد مثيلات بعد. انشر إلى بيئة جديدة للبدء.",
+  "deployTab.emptyDescription": "اختر إصدارًا وبيئة مستهدفة لجعل هذا النشر متاحًا للمستخدمين.",
+  "deployTab.emptyTitle": "لا توجد بيئات قيد التشغيل بعد",
+  "deployTab.envCount": "البيئات",
+  "deployTab.errorCode": "الكود",
+  "deployTab.errorDialogDesc": "راجع آخر نشر فاشل قبل إعادة المحاولة أو نشر إصدار آخر.",
+  "deployTab.errorDialogTitle": "خطأ في النشر في {{name}}",
+  "deployTab.errorMessage": "الرسالة",
+  "deployTab.errorPhase": "المرحلة",
+  "deployTab.expandDetails": "توسيع تفاصيل النشر",
+  "deployTab.moreActions": "المزيد من الإجراءات",
+  "deployTab.newDeployment": "النشر إلى بيئة جديدة",
+  "deployTab.panel.commit": "معرف Commit",
+  "deployTab.panel.deploymentId": "معرف النشر",
+  "deployTab.panel.endpoints": "نقاط النهاية",
+  "deployTab.panel.envVars": "متغيرات البيئة",
+  "deployTab.panel.error": "الخطأ",
+  "deployTab.panel.failedRelease": "الإصدار الفاشل",
+  "deployTab.panel.health": "الصحة",
+  "deployTab.panel.instanceInfo": "معلومات المثيل",
+  "deployTab.panel.modelCreds": "بيانات اعتماد النموذج",
+  "deployTab.panel.pluginCreds": "بيانات اعتماد الإضافة",
+  "deployTab.panel.release": "الإصدار",
+  "deployTab.panel.releaseCreatedAt": "تم إنشاء الإصدار في",
+  "deployTab.panel.releaseInfo": "معلومات الإصدار",
+  "deployTab.panel.replicas": "النسخ المتماثلة",
+  "deployTab.panel.run": "تشغيل",
+  "deployTab.panel.runtimeBindings": "بيانات الاعتماد",
+  "deployTab.panel.runtimeInfo": "معلومات وقت التشغيل",
+  "deployTab.panel.runtimeMode": "وضع وقت التشغيل",
+  "deployTab.panel.runtimeNote": "ملاحظة وقت التشغيل",
+  "deployTab.panel.targetRelease": "الإصدار المستهدف",
+  "deployTab.panel.unknownError": "فشل النشر.",
+  "deployTab.promote": "نشر",
+  "deployTab.redeploy": "إعادة النشر",
+  "deployTab.releaseCreatedAt": "تم إنشاء الإصدار {{time}}",
+  "deployTab.retry": "إعادة المحاولة",
+  "deployTab.shortcut": "اختصار",
+  "deployTab.status.deployFailed": "فشل النشر",
+  "deployTab.status.deployingRelease": "جاري النشر ({{release}})",
+  "deployTab.status.runningOutOfSync": "قيد التشغيل (المزامنة معلقة)",
+  "deployTab.status.runningWithFailed": "قيد التشغيل (فشل آخر نشر)",
+  "deployTab.undeploy": "إلغاء النشر",
+  "deployTab.undeployConfirmDesc": "سيتوقف وصول المستخدم النهائي فورًا. يمكن إعادة نشر الإصدار لاحقًا.",
+  "deployTab.undeployConfirmTitle": "إلغاء النشر من {{name}}؟",
+  "deployTab.undeployFrom": "إلغاء النشر من {{name}}",
+  "deployTab.undeployImpactTitle": "المثيل المتأثر",
+  "deployTab.viewError": "عرض الخطأ",
+  "deployTab.viewLogs": "عرض السجلات",
+  "deployTab.viewProgress": "عرض التقدم",
+  "detail.backToInstances": "العودة إلى عمليات النشر",
+  "detail.deployingCount": "{{count}} قيد النشر",
+  "detail.envCount_one": "{{count}} بيئة",
+  "detail.envCount_other": "{{count}} بيئات",
+  "detail.failedCount": "{{count}} فشل",
+  "detail.mobileTabs": "أقسام النشر",
+  "detail.notFound": "لم يتم العثور على النشر",
+  "detail.openSourceApp": "فتح مصدر {{name}}",
+  "detail.sourceApp": "المصدر",
+  "detail.sourceAppLink": "المصدر",
+  "documentTitle.create": "نشر جديد · عمليات النشر",
+  "documentTitle.detail": "النشر · عمليات النشر",
+  "documentTitle.list": "عمليات النشر",
+  "filter.allEnvs": "جميع البيئات",
+  "filter.notDeployed": "غير منشور",
+  "filter.searchPlaceholder": "بحث عن عمليات النشر",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "القبول",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "التمهيد",
+  "health.ENVIRONMENT_STATUS_DELETING": "جاري الحذف",
+  "health.ENVIRONMENT_STATUS_FAILED": "غير متاح",
+  "health.ENVIRONMENT_STATUS_READY": "متاح",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "غير معروف",
+  "list.clearFilters": "مسح الفلاتر",
+  "list.clearSearch": "مسح بحث النشر",
+  "list.createDeployment": "جديد",
+  "list.empty": "لم يتم العثور على عمليات نشر.",
+  "list.emptyDescription": "أنشئ نشرًا من تطبيق Workflow أو حزمة Workflow DSL لإدارة الإصدارات والبيئات والوصول.",
+  "list.emptyFilteredDescription": "لا يوجد نشر يطابق البحث الحالي أو فلتر البيئة.",
+  "list.emptyFilteredTitle": "لا توجد عمليات نشر مطابقة",
+  "list.emptyTitle": "لا توجد عمليات نشر بعد",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "معزول",
+  "mode.ENVIRONMENT_MODE_SHARED": "مشترك",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "غير معروف",
+  "newInstance.comingSoon": "قريبًا",
+  "newInstance.fromStudio": "اختر من Studio",
+  "newInstance.importDSL": "استيراد DSL",
+  "newInstance.title": "نشر جديد",
+  "overview.accessEndpoints": "نقاط نهاية الوصول",
+  "overview.accessMeta.apiTokens": "إدارة رموز API",
+  "overview.accessMeta.cli": "عرض وصول CLI",
+  "overview.accessMeta.webApp": "إدارة وصول WebApp",
+  "overview.accessStatus": "الوصول",
+  "overview.api": "رموز API",
+  "overview.apiKeysCount_one": "{{count}} رمز API",
+  "overview.apiKeysCount_other": "{{count}} رموز API",
+  "overview.apiTokenSummary.environments_one": "{{count}} بيئة منشورة",
+  "overview.apiTokenSummary.environments_other": "{{count}} بيئات منشورة",
+  "overview.availableForDeployment": "متاح للنشر",
+  "overview.basicInfo": "المعلومات الأساسية",
+  "overview.cardAction.deployLatest": "نشر أحدث إصدار",
+  "overview.cardAction.redeploy": "إعادة النشر",
+  "overview.cardAction.viewProgress": "عرض النشر",
+  "overview.chip.behindTooltip_one": "إصدار واحد متأخر عن الأحدث. قم بنشر أحدث إصدار للتحديث.",
+  "overview.chip.behindTooltip_other": "{{count}} إصدارات متأخرة عن الأحدث. قم بنشر أحدث إصدار للتحديث.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "قيد النشر",
+  "overview.chip.deployingTooltip": "النشر قيد التقدم.",
+  "overview.chip.empty": "فارغ",
+  "overview.chip.emptyTooltip": "لم يتم نشر أي إصدار إلى هذه البيئة.",
+  "overview.chip.failed": "فشل",
+  "overview.chip.failedTooltip": "فشلت محاولة النشر الأخيرة.",
+  "overview.chip.latest": "الأحدث",
+  "overview.chip.latestTooltip": "هذه البيئة تشغل أحدث إصدار.",
+  "overview.chip.needsReleaseFirst": "أنشئ إصدارًا أولاً",
+  "overview.chip.olderRelease": "أقدم",
+  "overview.chip.olderReleaseTooltip": "هذه البيئة تشغل إصدارًا أقدم.",
+  "overview.chip.openInDeployTab": "عرض تقدم النشر",
+  "overview.cli": "CLI",
+  "overview.configured": "تم التكوين",
+  "overview.createRelease": "إنشاء إصدار",
+  "overview.created": "تم الإنشاء",
+  "overview.deploy": "نشر",
+  "overview.deployedEnvironments": "منشور",
+  "overview.deploymentOverview": "نظرة عامة على النشر",
+  "overview.deploymentStatus": "حالة النشر",
+  "overview.description": "الوصف",
+  "overview.developerApi": "واجهة API للمطورين",
+  "overview.disabled": "معطل",
+  "overview.emptyValue": "غير محدد",
+  "overview.enabled": "ممكّن",
+  "overview.enabledChannels": "تم تمكين الوصول",
+  "overview.endUserAccess": "وصول المستخدم النهائي",
+  "overview.environments": "البيئات",
+  "overview.hero.byName": "بواسطة {{name}}",
+  "overview.hero.empty": "لا توجد إصدارات بعد",
+  "overview.hero.emptyDescription": "أنشئ إصدارًا من المصدر الحالي قبل النشر.",
+  "overview.hero.propagation_one": "تم النشر إلى {{count}}/{{total}} بيئة",
+  "overview.hero.propagation_other": "تم النشر إلى {{count}}/{{total}} بيئات",
+  "overview.hero.untargeted": "لم يتم تكوين بيئات بعد",
+  "overview.instanceDetails": "تفاصيل النشر",
+  "overview.instanceId": "معرف النشر",
+  "overview.latestRelease.releaseCount_one": "{{count}} إصدار",
+  "overview.latestRelease.releaseCount_other": "{{count}} إصدارات",
+  "overview.latestReleaseTitle": "أحدث إصدار",
+  "overview.manageDeployments": "إدارة عمليات النشر",
+  "overview.name": "الاسم",
+  "overview.noAccessConfig": "لا يوجد تكوين للوصول.",
+  "overview.noReleaseYet": "أنشئ إصدارًا قبل النشر إلى بيئة.",
+  "overview.notConfigured": "لم يتم التكوين",
+  "overview.previousReleases.empty": "لا توجد إصدارات سابقة بعد.",
+  "overview.previousReleases.retired": "غير منشور حاليًا",
+  "overview.previousReleases.title": "الإصدارات السابقة",
+  "overview.previousReleases.viewAll": "عرض الكل",
+  "overview.ready": "قابل للنشر",
+  "overview.recentReleases": "الإصدارات الأخيرة",
+  "overview.releaseDeployedTitle": "{{release}} منشور",
+  "overview.releaseReadyTitle": "{{release}} جاهز للنشر",
+  "overview.serviceMap": "خريطة الخدمة",
+  "overview.servingRelease": "يخدم {{release}}",
+  "overview.servingReleaseDescription": "هذا النشر منشور إلى {{count}}/{{total}} بيئات.",
+  "overview.strip.deployToNewEnvironment": "النشر إلى بيئة جديدة",
+  "overview.strip.empty": "لم يتم تكوين بيئات.",
+  "overview.strip.emptyDeployableDescription": "انشر أحدث إصدار إلى بيئة عندما تكون جاهزًا.",
+  "overview.strip.emptyDeployed": "لا توجد مثيلات بعد.",
+  "overview.strip.emptyDescription": "أنشئ إصدارًا قبل النشر إلى بيئة.",
+  "overview.strip.emptyTitle": "لا توجد مثيلات بعد",
+  "overview.strip.summary_one": "1 من {{total}} على أحدث إصدار",
+  "overview.strip.summary_other": "{{count}} من {{total}} على أحدث إصدار",
+  "overview.strip.title": "المثيلات",
+  "overview.switchSourceApp": "تبديل المصدر",
+  "overview.switchSourceAppDescription": "اختر تطبيق Workflow المستخدم كمصدر للإصدارات المستقبلية.",
+  "overview.switchSourceAppHint": "بعد التبديل، تستخدم الإصدارات المنشأة حديثًا فقط المصدر الجديد. لا تتغير الإصدارات التاريخية وعمليات النشر الحالية.",
+  "overview.targetRelease": "الإصدار المستهدف",
+  "overview.webapp": "WebApp",
+  "settings.danger": "منطقة الخطر",
+  "settings.dangerDesc": "احذف هذا النشر نهائيًا وأوقف أي مثيلات قيد التشغيل. لا يمكن التراجع عن ذلك.",
+  "settings.delete": "حذف النشر",
+  "settings.deleteConfirmDesc": "هل تريد حذف {{name}}؟ سيتوقف كل مثيل عن العمل وستتم إزالته من جميع البيئات. لا يمكن التراجع عن ذلك.",
+  "settings.deleteConfirmTitle": "حذف النشر",
+  "settings.deleteFailed": "فشل في حذف النشر.",
+  "settings.deleteImpact": "التأثير",
+  "settings.deleteImpactInstance": "النشر",
+  "settings.deleteImpactTitle": "النشر المتأثر",
+  "settings.deleteImpactValue": "تتم إزالة النشر من قائمة عمليات النشر.",
+  "settings.deleted": "تم حذف النشر",
+  "settings.description": "الوصف",
+  "settings.descriptionHelp": "إدارة اسم هذا النشر ووصفه والإعدادات الأخرى.",
+  "settings.general": "عام",
+  "settings.name": "اسم النشر",
+  "settings.reset": "إعادة تعيين",
+  "settings.save": "حفظ التغييرات",
+  "settings.updateFailed": "فشل في تحديث النشر.",
+  "settings.updated": "تم تحديث النشر",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "جاري النشر",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "المزامنة معلقة",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "فشل النشر",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "غير صالح",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "قيد التشغيل",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "غير منشور",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "جاري إلغاء النشر",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "غير معروف",
+  "subtitle": "إدارة عمليات النشر عبر البيئات.",
+  "tabs.access.description": "إدارة قنوات الوصول وأذونات الوصول.",
+  "tabs.access.name": "الوصول",
+  "tabs.api-tokens.description": "إدارة رموز API واستدعاء المثيلات عبر HTTP.",
+  "tabs.api-tokens.name": "رموز API",
+  "tabs.instances.description": "عرض وإدارة المثيلات في البيئات المنشورة.",
+  "tabs.instances.name": "المثيلات",
+  "tabs.overview.description": "اطلع على حالة النشر عبر البيئات.",
+  "tabs.overview.name": "نظرة عامة",
+  "tabs.releases.description": "إنشاء ونشر وإدارة الإصدارات.",
+  "tabs.releases.name": "الإصدارات",
+  "tabs.settings.description": "إدارة اسم هذا النشر ووصفه والإعدادات الأخرى.",
+  "tabs.settings.name": "الإعدادات",
+  "title": "عمليات النشر",
+  "unsupportedDslNodes.description": "يحتوي هذا الإصدار على عقد لا يدعمها وقت تشغيل النشر بعد. قم بإزالتها أو استبدالها في Studio، ثم حاول مرة أخرى.",
+  "unsupportedDslNodes.descriptionWithTypes": "يحتوي هذا الإصدار على عقد لا يدعمها وقت تشغيل النشر بعد: {{nodeTypes}}. قم بإزالتها أو استبدالها في Studio، ثم حاول مرة أخرى.",
+  "unsupportedDslNodes.title": "عقد غير مدعومة",
+  "unsupportedDslNodes.unknownType": "نوع غير معروف",
+  "versions.cancelCreate": "إلغاء",
+  "versions.cancelDelete": "إلغاء",
+  "versions.cancelEdit": "إلغاء",
+  "versions.checkingReleaseContent": "جاري التحقق من محتوى الإصدار...",
+  "versions.col.action": "الإجراء",
+  "versions.col.author": "أنشئ بواسطة",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "تم الإنشاء في",
+  "versions.col.deployedTo": "تم النشر إلى",
+  "versions.col.release": "الإصدار",
+  "versions.col.sourceApp": "المصدر",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "إنشاء",
+  "versions.createFailed": "فشل في إنشاء الإصدار.",
+  "versions.createRelease": "إنشاء إصدار",
+  "versions.createReleaseDescription": "أنشئ إصدارًا قابلاً للنشر من تطبيق Workflow أو ملف Workflow DSL.",
+  "versions.createReleaseHint": "يمكن نشر الإصدارات الجديدة إلى أي بيئة.",
+  "versions.createSuccess": "تم إنشاء الإصدار \"{{name}}\".",
+  "versions.creating": "جاري الإنشاء...",
+  "versions.currentOn": "الإصدار الحالي على {{name}}",
+  "versions.deleteConfirmDesc": "سيتم حذف الإصدار \"{{name}}\" نهائيًا. لا يمكن التراجع عن ذلك.",
+  "versions.deleteConfirmTitle": "حذف الإصدار؟",
+  "versions.deleteFailed": "فشل في حذف الإصدار.",
+  "versions.deleteImpactDeployment": "حالة النشر",
+  "versions.deleteImpactNotDeployed": "غير منشور حاليًا",
+  "versions.deleteImpactRelease": "الإصدار",
+  "versions.deleteImpactTitle": "تأثير الحذف",
+  "versions.deleteRelease": "حذف الإصدار",
+  "versions.deleteSuccess": "تم حذف الإصدار \"{{name}}\".",
+  "versions.deploy": "نشر",
+  "versions.deployTo": "النشر إلى {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "جاري النشر",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "المزامنة معلقة",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "فشل",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "غير صالح",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "قيد التشغيل",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "غير منشور",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "جاري إلغاء النشر",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "غير معروف",
+  "versions.deployingTo": "{{name}} قيد النشر",
+  "versions.disabledReason.checkDeploymentsFailed": "تعذر التحقق من استخدام النشر. حاول مرة أخرى لاحقًا.",
+  "versions.disabledReason.checkingDeployments": "جاري التحقق من استخدام النشر",
+  "versions.disabledReason.current": "هذا الإصدار يعمل بالفعل على {{name}}",
+  "versions.disabledReason.deploying": "انتظر حتى ينتهي النشر النشط",
+  "versions.disabledReason.envDisabled": "هذه البيئة غير قابلة للنشر",
+  "versions.disabledReason.releaseInUse_one": "ألغِ نشر هذا الإصدار من {{count}} بيئة قبل حذفه",
+  "versions.disabledReason.releaseInUse_other": "ألغِ نشر هذا الإصدار من {{count}} بيئات قبل حذفه",
+  "versions.dslReadFailed": "فشل في قراءة ملف DSL. اختر ملفًا آخر وحاول مرة أخرى.",
+  "versions.dslReading": "جاري قراءة ملف DSL...",
+  "versions.dslUnsupportedMode": "يمكن استخدام ملفات Workflow DSL فقط لعمليات النشر.",
+  "versions.editFailed": "فشل في تحديث الإصدار.",
+  "versions.editRelease": "تعديل الإصدار",
+  "versions.editReleaseDescription": "تحديث اسم ووصف هذا الإصدار.",
+  "versions.editSuccess": "تم تحديث الإصدار \"{{name}}\".",
+  "versions.empty": "لا توجد إصدارات متاحة بعد.",
+  "versions.emptyDescription": "أنشئ الإصدار الأول قبل النشر إلى بيئة.",
+  "versions.emptyTitle": "لا توجد إصدارات بعد",
+  "versions.emptyWithCreate": "لا توجد إصدارات بعد. أنشئ أول إصدار قابل للنشر قبل النشر.",
+  "versions.exportDsl": "تصدير DSL",
+  "versions.exportDslFailed": "فشل في تصدير DSL.",
+  "versions.exportingDsl": "جاري التصدير...",
+  "versions.groupHeader.deploy": "نشر",
+  "versions.groupHeader.promote": "نشر",
+  "versions.groupHeader.rollback": "نشر الإصدار السابق",
+  "versions.groupHeader.unavailable": "غير متاح",
+  "versions.manualDslOption": "تحميل DSL",
+  "versions.moreActions": "المزيد من الإجراءات",
+  "versions.optional": "اختياري",
+  "versions.promote": "نشر",
+  "versions.promoteTo": "النشر إلى {{name}}",
+  "versions.releaseAlreadyExists": "يوجد بالفعل إصدار بنفس المحتوى: {{name}}.",
+  "versions.releaseContentCheckFailed": "فشل في التحقق من محتوى الإصدار.",
+  "versions.releaseDescriptionLabel": "الوصف",
+  "versions.releaseDescriptionPlaceholder": "صف هذا الإصدار",
+  "versions.releaseHistory": "سجل الإصدارات",
+  "versions.releaseNameLabel": "اسم الإصدار",
+  "versions.releaseNamePlaceholder": "اسم الإصدار",
+  "versions.releaseNameRequired": "أدخل اسم الإصدار.",
+  "versions.releaseSourceLabel": "مصدر الإصدار",
+  "versions.rollbackTo": "النشر إلى {{name}}",
+  "versions.saveEdit": "حفظ",
+  "versions.sourceAppOption": "تطبيق Workflow"
+}
diff --git a/web/i18n/ar-TN/workflow.json b/web/i18n/ar-TN/workflow.json
index bd525a065ac..6e97214e2d0 100644
--- a/web/i18n/ar-TN/workflow.json
+++ b/web/i18n/ar-TN/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "وكيل",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "إجابة",
   "blocks.assigner": "معين المتغيرات",
   "blocks.code": "كود",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "مجمع المتغيرات",
   "blocks.variable-assigner": "مجمع المتغيرات",
   "blocksAbout.agent": "استدعاء نماذج اللغة الكبيرة للإجابة على الأسئلة أو معالجة اللغة الطبيعية",
+  "blocksAbout.agent-v2": "استدعاء نماذج اللغة الكبيرة للإجابة على الأسئلة أو معالجة اللغة الطبيعية",
   "blocksAbout.answer": "تحديد محتوى الرد لمحادثة الدردشة",
   "blocksAbout.assigner": "تُستخدم عقدة تعيين المتغير لتعيين قيم للمتغيرات القابلة للكتابة (مثل متغيرات المحادثة).",
   "blocksAbout.code": "تنفيذ قطعة من كود Python أو NodeJS لتنفيذ منطق مخصص",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "معرف سير العمل",
   "globalVar.fieldsDescription.workflowRunId": "معرف تشغيل سير العمل",
   "globalVar.title": "متغيرات النظام",
+  "nodes.agent.advancedSetting": "الإعدادات المتقدمة",
   "nodes.agent.checkList.strategyNotSelected": "الاستراتيجية غير محددة",
   "nodes.agent.clickToViewParameterSchema": "انقر لعرض مخطط المعلمة",
   "nodes.agent.configureModel": "تكوين النموذج",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "نموذج غير مدعوم",
   "nodes.agent.modelSelectorTooltips.deprecated": "تم إهمال هذا النموذج",
   "nodes.agent.notAuthorized": "غير مخول",
+  "nodes.agent.outputVars.confirm": "تأكيد",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "أدخل مصفوفة JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "أدخل true أو false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "لا يمكن تكوين القيم الافتراضية للملف هنا بعد.",
+  "nodes.agent.outputVars.defaultValueLabel": "افتراضي",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "أدخل رقماً صالحاً.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "أدخل كائن JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "القيمة الافتراضية",
+  "nodes.agent.outputVars.delete": "حذف {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "الوصف",
+  "nodes.agent.outputVars.descriptionPlaceholder": "إضافة وصف",
+  "nodes.agent.outputVars.edit": "تعديل {{name}}",
+  "nodes.agent.outputVars.editorLabel": "محرر متغير الإخراج",
   "nodes.agent.outputVars.files.title": "ملفات تم إنشاؤها بواسطة الوكيل",
   "nodes.agent.outputVars.files.transfer_method": "طريقة النقل. القيمة هي remote_url أو local_file",
   "nodes.agent.outputVars.files.type": "نوع الدعم. الآن يدعم الصورة فقط",
   "nodes.agent.outputVars.files.upload_file_id": "معرف ملف التحميل",
   "nodes.agent.outputVars.files.url": "رابط الصورة",
   "nodes.agent.outputVars.json": "json تم إنشاؤه بواسطة الوكيل",
+  "nodes.agent.outputVars.nameDuplicate": "اسم الإخراج موجود بالفعل",
+  "nodes.agent.outputVars.nameInvalid": "استخدم الأحرف والأرقام والشرطات السفلية. ابدأ بحرف أو شرطة سفلية.",
+  "nodes.agent.outputVars.nameLabel": "اسم الحقل",
+  "nodes.agent.outputVars.namePlaceholder": "اسم الحقل",
+  "nodes.agent.outputVars.newOutput": "إخراج جديد",
+  "nodes.agent.outputVars.requiredLabel": "مطلوب",
+  "nodes.agent.outputVars.showAdvancedOptions": "إظهار الخيارات المتقدمة",
   "nodes.agent.outputVars.text": "محتوى تم إنشاؤه بواسطة الوكيل",
+  "nodes.agent.outputVars.typeLabel": "نوع الإخراج",
   "nodes.agent.outputVars.usage": "معلومات استخدام النموذج",
   "nodes.agent.parameterSchema": "مخطط المعلمة",
   "nodes.agent.pluginInstaller.install": "تثبيت",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "تم تثبيت هذا الملحق من GitHub. يرجى الانتقال إلى الملحقات لإعادة التثبيت",
   "nodes.agent.pluginNotInstalled": "هذا الملحق غير مثبت",
   "nodes.agent.pluginNotInstalledDesc": "تم تثبيت هذا الملحق من GitHub. يرجى الانتقال إلى الملحقات لإعادة التثبيت",
+  "nodes.agent.roster.change": "تغيير",
+  "nodes.agent.roster.editInConsole": "تعديل في Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "إعداد لمرة واحدة يبقى فقط في هذه العقدة",
+  "nodes.agent.roster.inlineSetup.name": "إعداد inline",
+  "nodes.agent.roster.inlineSetup.title": "إعداد الوكيل",
+  "nodes.agent.roster.inlineSetup.type": "فقط في هذه العقدة",
+  "nodes.agent.roster.label": "وكيل",
+  "nodes.agent.roster.makeCopy": "إنشاء نسخة",
+  "nodes.agent.roster.more": "إجراءات وكيل أخرى",
+  "nodes.agent.roster.openPanel": "فتح تفاصيل {{name}}",
+  "nodes.agent.roster.panelLabel": "تفاصيل {{name}}",
   "nodes.agent.strategy.configureTip": "يرجى تكوين استراتيجية الوكيل.",
   "nodes.agent.strategy.configureTipDesc": "بعد تكوين استراتيجية الوكيل، ستقوم هذه العقدة تلقائيًا بتحميل التكوينات المتبقية. ستؤثر الاستراتيجية على آلية التفكير في الأدوات متعددة الخطوات. ",
   "nodes.agent.strategy.label": "استراتيجية الوكيل",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "لا يوفر إصدار الملحق المثبت هذه الاستراتيجية. انقر لتبديل الإصدار.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} غير مثبتة",
   "nodes.agent.strategyNotSet": "لم يتم تعيين استراتيجية الوكيل",
+  "nodes.agent.task.insert": "إدراج",
+  "nodes.agent.task.label": "مهمة الوكيل",
+  "nodes.agent.task.mention": "إشارة",
+  "nodes.agent.task.placeholder": "صف ما يجب على هذا الوكيل القيام به...",
+  "nodes.agent.task.tooltip": "حدّد تعليمات المهمة التي يجب على هذا الوكيل اتباعها في سير العمل هذا.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} غير مخول",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} غير مثبت",
   "nodes.agent.toolbox": "صندوق الأدوات",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "بواسطة {{author}}",
   "tabs.question-understand": "فهم السؤال",
   "tabs.requestToCommunity": "طلبات للمجتمع",
-  "tabs.searchBlock": "بحث عن عقدة",
+  "tabs.searchBlock": "بحث عن عقدة، وكيل، إنسان، معرفة",
   "tabs.searchDataSource": "بحث في مصدر البيانات",
   "tabs.searchSnippets": "مقاطع البحث...",
   "tabs.searchTool": "أداة البحث",
diff --git a/web/i18n/de-DE/agent-v-2.json b/web/i18n/de-DE/agent-v-2.json
new file mode 100644
index 00000000000..6a346017576
--- /dev/null
+++ b/web/i18n/de-DE/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Diese Aktion ist noch nicht verfügbar.",
+  "agentDetail.access.actions.monitoring": "Monitoring",
+  "agentDetail.access.copyAccessUrl": "Zugriffs-URL kopieren",
+  "agentDetail.access.copyFailed": "Referenz konnte nicht kopiert werden.",
+  "agentDetail.access.copyReference": "Referenz für {{name}} kopieren",
+  "agentDetail.access.copyServiceEndpoint": "Service-API-Endpunkt kopieren",
+  "agentDetail.access.description": "Alle Oberflächen, über die dieser Agent erreichbar ist.",
+  "agentDetail.access.empty": "Keine verknüpften Zugangspunkte",
+  "agentDetail.access.emptyDescription": "Dieser Roster-Agent hat noch keine App- oder Workflow-Referenzen.",
+  "agentDetail.access.entries.agentApp.description": "Mit diesem Roster-Agent verknüpfte Agent-App.",
+  "agentDetail.access.entries.agentApp.name": "Agent-App",
+  "agentDetail.access.entries.workflow.description": "Mit diesem Roster-Agent verknüpfte Workflow- und Knotenreferenz.",
+  "agentDetail.access.entries.workflow.name": "Workflow-Knoten",
+  "agentDetail.access.entryCount_one": "{{count}} Eintrag",
+  "agentDetail.access.entryCount_other": "{{count}} Einträge",
+  "agentDetail.access.groups.references.heading": "Referenzen",
+  "agentDetail.access.groups.references.label": "Verknüpfte Referenzen",
+  "agentDetail.access.learnMore": "Mehr erfahren",
+  "agentDetail.access.moreActions": "Weitere Aktionen für {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Service-API-Endpunkt",
+  "agentDetail.access.serviceApi.title": "Backend-Service-API",
+  "agentDetail.access.status.disabled": "Deaktiviert",
+  "agentDetail.access.status.enabled": "Aktiviert",
+  "agentDetail.access.status.inService": "In Betrieb",
+  "agentDetail.access.status.outOfService": "Außer Betrieb",
+  "agentDetail.access.title": "Zugangspunkt",
+  "agentDetail.access.toggleSurface": "Zugriff von {{name}} umschalten",
+  "agentDetail.access.webApp.accessUrl": "Zugriffs-URL",
+  "agentDetail.access.webApp.actions.customize": "Anpassen",
+  "agentDetail.access.webApp.actions.embedded": "Eingebettet",
+  "agentDetail.access.webApp.actions.launch": "Starten",
+  "agentDetail.access.webApp.actions.settings": "Einstellungen",
+  "agentDetail.access.webApp.refreshUrl": "Zugriffs-URL aktualisieren",
+  "agentDetail.access.webApp.showQrCode": "QR-Code anzeigen",
+  "agentDetail.access.webApp.ssoEnabled": "SSO aktiviert",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Wird als Knoten innerhalb des Workflows verwendet",
+  "agentDetail.access.workflow.empty": "Noch keine Workflow-Referenzen.",
+  "agentDetail.access.workflow.loadFailed": "Workflow-Referenzen konnten nicht geladen werden.",
+  "agentDetail.access.workflow.loading": "Workflow-Referenzen werden geladen …",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} Knoten",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} Knoten",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "In Studio öffnen",
+  "agentDetail.access.workflow.openInStudioFor": "{{name}} in Studio öffnen",
+  "agentDetail.access.workflow.table.actions": "Aktionen",
+  "agentDetail.access.workflow.table.lastUpdated": "Zuletzt aktualisiert",
+  "agentDetail.access.workflow.table.name": "Name",
+  "agentDetail.access.workflow.table.nodes": "Knoten",
+  "agentDetail.access.workflow.table.version": "Version",
+  "agentDetail.access.workflow.title": "Workflow-Zugriff",
+  "agentDetail.configure.advancedSettings.description": "Für erfahrene Nutzer. Umgebungsvariablen, Sandbox und Speicher.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Umgebungsvariable hinzufügen",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "{{key}} löschen",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Wert von {{key}} verbergen",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": ".env importieren",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Um ausgeblendete .env-Dateien anzuzeigen, drücken Sie im Dateiauswahldialog Command + Shift + .",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Wenn Ihre .env-Datei ausgeblendet ist, aktivieren Sie ausgeblendete Dateien in Ihrem Systemdateidialog.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Um ausgeblendete .env-Dateien anzuzeigen, aktivieren Sie „Ausgeblendete Elemente“ im Datei-Explorer.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Wert von {{key}} anzeigen",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Geltungsbereich der Umgebungsvariable auswählen",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Umgebungsvariablen, die diesem Agenten zur Laufzeit zur Verfügung stehen.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Env Editor umschalten",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Erweiterte Einstellungen",
+  "agentDetail.configure.advancedSettings.toggle": "Erweiterte Einstellungen umschalten",
+  "agentDetail.configure.chatFeatures.description": "Gestalten Sie das Chat-Erlebnis für Endnutzer in Ihrer Webapp und in Chat-Oberflächen.",
+  "agentDetail.configure.chatFeatures.title": "Chat-Funktionen",
+  "agentDetail.configure.files.add": "Datei hinzufügen",
+  "agentDetail.configure.files.empty.description": "Laden Sie Dokumente hoch, die der Agent lesen kann, z. B. Spezifikationen, Vorlagen oder Richtlinien",
+  "agentDetail.configure.files.empty.title": "Noch keine Dateien",
+  "agentDetail.configure.files.label": "Dateien",
+  "agentDetail.configure.files.preview.empty": "Kein Vorschauinhalt.",
+  "agentDetail.configure.files.preview.failed": "Vorschau konnte nicht geladen werden.",
+  "agentDetail.configure.files.preview.unsupported": "Für diese Datei wird keine Vorschau unterstützt.",
+  "agentDetail.configure.files.remove": "{{name}} entfernen",
+  "agentDetail.configure.files.tip": "Dateien, die dieser Agent bei der Orchestrierung von Aufgaben verwenden kann.",
+  "agentDetail.configure.files.toggle": "Dateien umschalten",
+  "agentDetail.configure.files.treeLabel": "Agentendateien",
+  "agentDetail.configure.files.upload.action": "Hochladen",
+  "agentDetail.configure.files.upload.browse": "durchsuchen",
+  "agentDetail.configure.files.upload.description": "Laden Sie eine Datei für diesen Agenten hoch.",
+  "agentDetail.configure.files.upload.dropzone": "Datei hier ablegen oder",
+  "agentDetail.configure.files.upload.failed": "Datei konnte nicht hochgeladen werden.",
+  "agentDetail.configure.files.upload.fileType": "DATEI",
+  "agentDetail.configure.files.upload.invalidFile": "Bitte eine Datei hochladen.",
+  "agentDetail.configure.files.upload.success": "Datei hochgeladen.",
+  "agentDetail.configure.files.upload.title": "Datei hochladen",
+  "agentDetail.configure.knowledgeRetrieval.add": "Wissensabfrage hinzufügen",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Wissen hinzufügen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Klicken Sie auf die Schaltfläche „+“, um Wissen hinzuzufügen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Wissen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Abrufeinstellungen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Mehr über Wissensabfrage erfahren",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automatisch",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Bedingungen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Deaktiviert",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Metadaten-Filterung",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manuell",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Modus der Metadaten-Filterung auswählen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Name der Wissensabfrage",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Agent entscheidet",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Der Agent formuliert seine eigene Abfrage anhand des Prompts und des verfügbaren Kontexts. Hier ist nichts zu konfigurieren.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Benutzerdefinierte Abfrage",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Schreiben Sie eine feste Abfrage für diese Abfragequelle.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Benutzerdefinierter Abfragetext",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Geben Sie eine Suchabfrage ein",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Abfrage",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Wissensabfrage · Agent entscheidet",
+  "agentDetail.configure.knowledgeRetrieval.edit": "{{name}} bearbeiten",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Verbinden Sie eine Wissensdatenbank, die der Agent beim Antworten durchsuchen kann",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Noch kein Wissen",
+  "agentDetail.configure.knowledgeRetrieval.label": "Wissensabfrage",
+  "agentDetail.configure.knowledgeRetrieval.remove": "{{name}} entfernen",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Wissensabfragequellen, die dieser Agent bei der Orchestrierung von Aufgaben verwenden kann.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Wissensabfrage umschalten",
+  "agentDetail.configure.model.label": "Modell",
+  "agentDetail.configure.orchestrate": "Orchestrieren",
+  "agentDetail.configure.preview.chatFeatures": "Chat-Funktionen",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agent",
+  "agentDetail.configure.preview.empty.description": "Senden Sie eine Nachricht, um den aktuellen Entwurf zu testen.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Noch keine Anweisungen, daher kommen die Antworten vom reinen Modell.",
+  "agentDetail.configure.preview.endUserAuth": "Endbenutzer-Authentifizierung",
+  "agentDetail.configure.preview.restart": "Vorschau neu starten",
+  "agentDetail.configure.preview.title": "Vorschau",
+  "agentDetail.configure.prompt.copied": "Prompt kopiert",
+  "agentDetail.configure.prompt.copy": "Prompt kopieren",
+  "agentDetail.configure.prompt.copyFailed": "Prompt konnte nicht kopiert werden.",
+  "agentDetail.configure.prompt.insert.label": "Einfügen",
+  "agentDetail.configure.prompt.insert.question": "Startfrage",
+  "agentDetail.configure.prompt.insert.reportFile": "Ausgabebericht-Datei",
+  "agentDetail.configure.prompt.insert.tenders": "Ausschreibungen starten",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Erwähnen",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Anweisungen hier eintragen,",
+  "agentDetail.configure.prompt.tip": "Definieren Sie, wie dieser Agent Eingaben interpretiert, Tools aufruft und Ausgaben erzeugt.",
+  "agentDetail.configure.publishBar.draft": "Entwurf",
+  "agentDetail.configure.publishBar.publishUpdate": "Update veröffentlichen",
+  "agentDetail.configure.publishBar.published": "Veröffentlicht",
+  "agentDetail.configure.publishBar.publishedAt": "Veröffentlicht {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Wird veröffentlicht …",
+  "agentDetail.configure.publishBar.saved": "Vor 5 Min. gespeichert",
+  "agentDetail.configure.publishBar.savedAt": "Gespeichert {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Unveröffentlichte Änderungen",
+  "agentDetail.configure.publishBar.upToDate": "Aktuell",
+  "agentDetail.configure.publishBar.versionHistory": "Versionsverlauf öffnen",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Betroffene Workflows",
+  "agentDetail.configure.publishImpact.cancel": "Abbrechen",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Ihr Agent erscheint in",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Änderungen wirken sich auf sie aus.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "diesem Agenten",
+  "agentDetail.configure.publishImpact.title": "{{action}} für {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} Workflow",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} Workflows",
+  "agentDetail.configure.skills.add": "Skill hinzufügen",
+  "agentDetail.configure.skills.detail.contentRegion": "Skill-Detailinhalt",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} DATEIEN",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Skill-Dateien",
+  "agentDetail.configure.skills.detail.files": "Dateien",
+  "agentDetail.configure.skills.empty.description": "Skills geben dem Agenten wiederverwendbare Fachkenntnisse, die er bei der Arbeit nutzen kann",
+  "agentDetail.configure.skills.empty.title": "Noch keine Skills",
+  "agentDetail.configure.skills.itemType": "Skill",
+  "agentDetail.configure.skills.label": "Skills",
+  "agentDetail.configure.skills.remove": "{{name}} entfernen",
+  "agentDetail.configure.skills.tip": "Skills, die dieser Agent bei der Orchestrierung von Aufgaben verwenden kann.",
+  "agentDetail.configure.skills.toggle": "Skills umschalten",
+  "agentDetail.configure.skills.upload.action": "Hochladen",
+  "agentDetail.configure.skills.upload.browse": "durchsuchen",
+  "agentDetail.configure.skills.upload.description": "Laden Sie ein .zip- oder .skill-Paket für diesen Agenten hoch.",
+  "agentDetail.configure.skills.upload.dropzone": "Skill-Paket hier ablegen oder",
+  "agentDetail.configure.skills.upload.failed": "Skill konnte nicht hochgeladen werden.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Bitte eine .zip- oder .skill-Datei hochladen.",
+  "agentDetail.configure.skills.upload.success": "Skill hochgeladen.",
+  "agentDetail.configure.skills.upload.title": "Skill hochladen",
+  "agentDetail.configure.tools.add": "Tool hinzufügen",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Für Entwickler",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Installieren Sie ein Befehlszeilenprogramm, das der Agent in seiner Sandbox ausführt. Benötigt eine Installation und in der Regel API-Keys.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI-Tool",
+  "agentDetail.configure.tools.addMenu.tool.description": "Wählen Sie ein bereits in diesem Workspace verfügbares Tool, z. B. Websuche oder Integrationen.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Tool",
+  "agentDetail.configure.tools.cliDialog.description": "Installieren Sie ein CLI-Tool aus einer beliebigen Paketregistry. Der Agent erhält Shell-Zugriff auf die bereitgestellte Binärdatei.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "CLI-Tool bearbeiten",
+  "agentDetail.configure.tools.cliDialog.env.description": "Speichern Sie API-Keys, Tokens oder Secrets, die dieses CLI-Tool benötigt. Werte werden im Ruhezustand verschlüsselt und beim Aufruf des Tools als Umgebungsvariablen injiziert.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Umgebungsvariablen",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(optional)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "In der Sandbox · läuft einmal beim ersten Aufruf",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Installationsbefehl",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Fügen Sie hier Ihren Installationsbefehl ein, z. B. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Installationsbefehl ist erforderlich.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Mehr über CLI-Tool erfahren",
+  "agentDetail.configure.tools.cliDialog.name.label": "Name des CLI-Tools",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Benennen Sie Ihr CLI-Tool",
+  "agentDetail.configure.tools.cliDialog.name.required": "Name des CLI-Tools ist erforderlich.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Nie im Agenten-Prompt sichtbar; wird nur zur Laufzeit als $VAR injiziert",
+  "agentDetail.configure.tools.cliDialog.title": "CLI-Tool hinzufügen",
+  "agentDetail.configure.tools.cliTool": "CLI-Tool",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Endbenutzer · OAuth",
+  "agentDetail.configure.tools.editAction": "{{name}} bearbeiten",
+  "agentDetail.configure.tools.empty.description": "Tools ermöglichen es dem Agenten zu handeln, z. B. das Web zu durchsuchen oder Ihre Apps aufzurufen",
+  "agentDetail.configure.tools.empty.title": "Noch keine Tools",
+  "agentDetail.configure.tools.label": "Tools",
+  "agentDetail.configure.tools.moreActions": "Weitere Aktionen für {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Vorab autorisieren",
+  "agentDetail.configure.tools.removeAction": "{{name}} entfernen",
+  "agentDetail.configure.tools.removeProvider": "Alle Tools entfernen",
+  "agentDetail.configure.tools.tip": "Tools, die dieser Agent bei der Orchestrierung von Aufgaben aufrufen kann.",
+  "agentDetail.configure.tools.toggle": "Tools umschalten",
+  "agentDetail.configure.tools.toolTabs.all": "Alle",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Benutzerdefiniert",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugins",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agent",
+  "agentDetail.history": "Verlauf",
+  "agentDetail.logs.description": "Vollständige Logs zeichnen den Laufzeitstatus der Anwendung auf, einschließlich Benutzereingaben, Agentenantworten, Planung und Tool-Nutzung.",
+  "agentDetail.logs.empty": "Keine Logs gefunden",
+  "agentDetail.logs.filters.period.allTime": "Gesamter Zeitraum",
+  "agentDetail.logs.filters.period.label": "Log-Zeitraum",
+  "agentDetail.logs.filters.period.last30days": "Letzte 30 Tage",
+  "agentDetail.logs.filters.period.last7days": "Letzte 7 Tage",
+  "agentDetail.logs.filters.search.label": "Logs durchsuchen",
+  "agentDetail.logs.filters.search.placeholder": "Suchen",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Zuletzt erstellt",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Zuletzt aktualisiert",
+  "agentDetail.logs.filters.source.all": "Quelle",
+  "agentDetail.logs.filters.source.empty": "Keine Quellen gefunden",
+  "agentDetail.logs.filters.source.label": "Log-Quelle",
+  "agentDetail.logs.filters.source.loadFailed": "Quellen konnten nicht geladen werden",
+  "agentDetail.logs.filters.source.loading": "Quellen werden geladen…",
+  "agentDetail.logs.filters.source.searchLabel": "Quellen suchen",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Suchen",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Workflow",
+  "agentDetail.logs.learnMore": "Mehr erfahren",
+  "agentDetail.logs.loadFailed": "Logs konnten nicht geladen werden",
+  "agentDetail.logs.loading": "Logs werden geladen…",
+  "agentDetail.logs.notAvailable": "Nicht verfügbar",
+  "agentDetail.logs.table.createdTime": "Erstellungszeit",
+  "agentDetail.logs.table.endUser": "Endbenutzer",
+  "agentDetail.logs.table.messageCount": "Nachr. Anzahl",
+  "agentDetail.logs.table.operationRate": "Operationsrate",
+  "agentDetail.logs.table.source": "Quelle",
+  "agentDetail.logs.table.title": "Titel",
+  "agentDetail.logs.table.unread": "Ungelesen",
+  "agentDetail.logs.table.updatedTime": "Aktualisierungszeit",
+  "agentDetail.logs.table.userRate": "Benutzerbewertung",
+  "agentDetail.logs.title": "Logs",
+  "agentDetail.memorySettings.budgetLabel": "Speicherbudget",
+  "agentDetail.memorySettings.description": "Speichereinstellungen aus dem aktiven Konfigurations-Snapshot.",
+  "agentDetail.memorySettings.export.description": "Der Speicherexport ist für ein späteres Release geplant.",
+  "agentDetail.memorySettings.export.download": "Herunterladen",
+  "agentDetail.memorySettings.export.soon": "Demnächst",
+  "agentDetail.memorySettings.export.title": "Aktuellen Speicher exportieren",
+  "agentDetail.memorySettings.notConfigured": "Nicht konfiguriert",
+  "agentDetail.memorySettings.scopeLabel": "Speicherbereich",
+  "agentDetail.memorySettings.title": "Speicher",
+  "agentDetail.metadata.activeVersionLabel": "Aktive Version",
+  "agentDetail.metadata.appIdLabel": "App-ID",
+  "agentDetail.metadata.description": "Schreibgeschützte Roster-Felder, die vom Agenten-Backend zurückgegeben werden.",
+  "agentDetail.metadata.emptyValue": "Nicht verfügbar",
+  "agentDetail.metadata.scopeLabel": "Geltungsbereich",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Nur Workflow",
+  "agentDetail.metadata.sourceLabel": "Quelle",
+  "agentDetail.metadata.statusLabel": "Status",
+  "agentDetail.metadata.title": "Metadaten",
+  "agentDetail.metadata.updatedAtLabel": "Aktualisiert am",
+  "agentDetail.metadata.workflowIdLabel": "Workflow-ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "Workflow-Knoten-ID",
+  "agentDetail.monitoring.change": "{{value}} im Vergleich zum Vorzeitraum",
+  "agentDetail.monitoring.dateRangeLabel": "Datumsbereich",
+  "agentDetail.monitoring.description": "Verfolgen Sie Aktivität, Kosten und Interaktionsqualität des wiederverwendbaren Agenten über Workflows hinweg.",
+  "agentDetail.monitoring.learnMore": "Mehr erfahren",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Eindeutige Endbenutzer, die Workflows mit diesem Agenten ausgelöst haben.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Aktive Benutzer",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Anzahl der durchgehenden Benutzer-Agent-Kommunikationen für diesen Zugangspunkt.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Durchschn. Sitzungsinteraktionen",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Durchschnittliche Ausgabegeschwindigkeit vom Beginn der Anfrage bis zum Abschluss.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Token-Ausgabegeschwindigkeit",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Geschätzte Tokenkosten, die dieser Agent über Workflow-Ausführungen hinweg verursacht.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Token-Nutzung",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Tägliche KI-Konversationen, die diesen Agenten über den ausgewählten Zugangspunkt erreicht haben.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Gesamtzahl Konversationen",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Tägliche Anzahl der Agenteninteraktionen.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Gesamtzahl Nachrichten",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Anzahl der Likes pro 1.000 Nachrichten für diesen Agenten.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Benutzerzufriedenheitsrate",
+  "agentDetail.monitoring.pickSource": "Eine App auswählen",
+  "agentDetail.monitoring.sourceLabel": "App",
+  "agentDetail.monitoring.sourceTrigger": "Quelle {{name}}",
+  "agentDetail.monitoring.sources.all": "Alle",
+  "agentDetail.monitoring.timeRangeLabel": "Zeitbereich",
+  "agentDetail.monitoring.timeRanges.custom": "Benutzerdefiniert",
+  "agentDetail.monitoring.timeRanges.last30days": "Letzte 30 Tage",
+  "agentDetail.monitoring.timeRanges.last7days": "Letzte 7 Tage",
+  "agentDetail.monitoring.timeRanges.today": "Heute",
+  "agentDetail.monitoring.title": "Monitoring",
+  "agentDetail.monitoring.tokenUsageConsumed": "Verbrauchte Tokens",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Agenten-Navigation",
+  "agentDetail.publish": "Veröffentlichen",
+  "agentDetail.publishSoon": "Demnächst",
+  "agentDetail.sections.access": "Zugangspunkt",
+  "agentDetail.sections.configure": "Orchestrieren",
+  "agentDetail.sections.logs": "Logs",
+  "agentDetail.sections.monitoring": "Monitoring",
+  "agentDetail.subtitle": "Agent-ID: {{agentId}}",
+  "agentDetail.title": "Agent",
+  "agentDetail.type": "AGENT",
+  "agentDetail.versionHistory.active": "Aktiv",
+  "agentDetail.versionHistory.empty": "Noch keine Versionen",
+  "agentDetail.versionHistory.filter": "Versionen filtern",
+  "agentDetail.versionHistory.versionName": "Version {{version}}",
+  "roster.createAgent": "Agent erstellen",
+  "roster.createAgentOptions": "Optionen zum Erstellen eines Agenten",
+  "roster.createDialog.description": "Erstellen Sie einen wiederverwendbaren Agenten im Roster dieses Workspaces.",
+  "roster.createDialog.title": "Agent erstellen",
+  "roster.createForm.changeIcon": "Agenten-Symbol ändern",
+  "roster.createForm.descriptionLabel": "Beschreibung",
+  "roster.createForm.descriptionOptional": "(optional)",
+  "roster.createForm.descriptionPlaceholder": "z. B. Sammelt Quellen zu einem Thema und fasst die wichtigsten Erkenntnisse zusammen",
+  "roster.createForm.nameLabel": "Name",
+  "roster.createForm.namePlaceholder": "z. B. Max",
+  "roster.createForm.nameRequired": "Name ist erforderlich.",
+  "roster.createForm.roleLabel": "Rolle",
+  "roster.createForm.rolePlaceholder": "z. B. Research Assistant",
+  "roster.createForm.roleRequired": "Rolle ist erforderlich.",
+  "roster.createSuccess": "Agent erstellt.",
+  "roster.dateTimeFormat": "DD.MM.YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Dieser Agent wird aus der aktiven Roster-Liste entfernt.",
+  "roster.deleteDialog.title": "{{name}} löschen?",
+  "roster.deleteFailed": "Agent konnte nicht gelöscht werden.",
+  "roster.deleteSuccess": "Agent gelöscht.",
+  "roster.duplicateFailed": "Agent konnte nicht dupliziert werden.",
+  "roster.duplicateSuccess": "Agent dupliziert.",
+  "roster.editAgent": "{{name}} bearbeiten",
+  "roster.editDialog.description": "Aktualisieren Sie Roster-Name, Beschreibung und Rolle dieses Agenten.",
+  "roster.editDialog.title": "Agent bearbeiten",
+  "roster.editInfo": "Info bearbeiten",
+  "roster.empty": "Noch kein Agent",
+  "roster.emptyDescription": "In diesem Workspace gespeicherte Agenten erscheinen hier.",
+  "roster.emptySearch": "Keine passenden Agenten",
+  "roster.emptySearchDescription": "Versuchen Sie einen anderen Agentennamen.",
+  "roster.filters.all": "Alle",
+  "roster.filters.drafts": "Entwürfe",
+  "roster.filters.label": "Agentenfilter",
+  "roster.filters.published": "Veröffentlicht",
+  "roster.learnMore": "Mehr über Agent Roster erfahren",
+  "roster.listLabel": "Agent-Roster-Liste",
+  "roster.loadMore": "Mehr laden",
+  "roster.loadingError": "Agenten konnten nicht geladen werden. Bitte aktualisieren und erneut versuchen.",
+  "roster.moreActions": "Weitere Aktionen für {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Inline-Agent konnte nicht erstellt werden. Bitte aktualisieren und erneut versuchen.",
+  "roster.nodeSelector.dialogLabel": "Agent auswählen",
+  "roster.nodeSelector.manageInAgentConsole": "In Agent Console verwalten",
+  "roster.nodeSelector.searchPlaceholder": "Suchen…",
+  "roster.nodeSelector.startFromScratch": "Von Grund auf starten",
+  "roster.references.label": "Workflows, die {{name}} verwenden",
+  "roster.references.trigger": "Workflows, die {{name}} verwenden",
+  "roster.searchLabel": "Agenten suchen",
+  "roster.searchPlaceholder": "Agenten nach Namen suchen…",
+  "roster.sources.agent_app": "Agent-App",
+  "roster.sources.imported": "Importiert",
+  "roster.sources.system": "System",
+  "roster.sources.workflow": "Workflow",
+  "roster.status.active": "Aktiv",
+  "roster.status.archived": "Archiviert",
+  "roster.tabs.agent": "Agent",
+  "roster.tabs.human": "Mensch",
+  "roster.tabsLabel": "Roster-Typ",
+  "roster.updateSuccess": "Agent aktualisiert.",
+  "roster.usageStatus.draft": "Entwurf"
+}
diff --git a/web/i18n/de-DE/app-log.json b/web/i18n/de-DE/app-log.json
index 9be1ee948fb..f6055b4c006 100644
--- a/web/i18n/de-DE/app-log.json
+++ b/web/i18n/de-DE/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Heute",
   "filter.period.yearToDate": "Jahr bis heute",
   "filter.sortBy": "Sortieren nach:",
+  "monitoring.description": "Das Monitoring zeichnet den Betriebsstatus der Anwendung auf, einschließlich Leistung, Nutzeraktivität und Kosten.",
   "promptLog": "Prompt-Protokoll",
   "runDetail.fileListDetail": "Detail",
   "runDetail.fileListLabel": "Details zur Datei",
diff --git a/web/i18n/de-DE/app.json b/web/i18n/de-DE/app.json
index 5705010310f..08d7b86f085 100644
--- a/web/i18n/de-DE/app.json
+++ b/web/i18n/de-DE/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "Strukturierte Ausgaben ist eine Funktion, die sicherstellt, dass das Modell immer Antworten generiert, die Ihrem bereitgestellten JSON-Schema entsprechen.",
   "studio.allApps": "Alle Apps",
   "studio.apps": "Anwendungen",
-  "studio.filters.allCreators": "Alle Schöpfer",
-  "studio.filters.creators": "Schöpfer",
+  "studio.filters.allCreators": "Alle Ersteller",
+  "studio.filters.creators": "Ersteller",
   "studio.filters.reset": "Zurücksetzen",
   "studio.filters.searchCreators": "Suchersteller...",
   "studio.filters.types": "Typen",
diff --git a/web/i18n/de-DE/billing.json b/web/i18n/de-DE/billing.json
index 1aac6802c7f..9e485081ad2 100644
--- a/web/i18n/de-DE/billing.json
+++ b/web/i18n/de-DE/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Upgrade, um den Massen-Upload von Dokumenten freizuschalten",
   "upgrade.uploadMultiplePages.description": "Sie haben das Upload-Limit erreicht – in Ihrem aktuellen Tarif kann jeweils nur ein Dokument ausgewählt und hochgeladen werden.",
   "upgrade.uploadMultiplePages.title": "Upgrade, um mehrere Dokumente gleichzeitig hochzuladen",
+  "upgrade.workflowRestore.description": "Die Wiederherstellung von Workflow-Versionen ist in Ihrem aktuellen Tarif nicht verfügbar.",
+  "upgrade.workflowRestore.title": "Upgraden, um Workflow-Versionen wiederherzustellen",
   "upgradeBtn.encourage": "Jetzt Upgraden",
   "upgradeBtn.encourageShort": "Upgraden",
   "upgradeBtn.plain": "Tarif Upgraden",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 4643e6fb658..84c57d8523c 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Workspace wechseln",
   "mcpPage.description": "Verbinde und verwalte MCP-Server, damit deine Apps auf externe Tools und Dienste zugreifen können.",
-  "members.admin": "Admin",
   "members.adminTip": "Kann Apps erstellen & Team-Einstellungen verwalten",
+  "members.alreadyInTeam": "Bereits im Team",
+  "members.alreadyInTeamTip": "Diese Benutzer haben bereits Zugriff auf diesen Arbeitsbereich.",
   "members.builder": "Bauherr",
   "members.builderTip": "Kann eigene Apps erstellen und bearbeiten",
-  "members.datasetOperator": "Wissensadministrator",
   "members.datasetOperatorTip": "Kann die Wissensdatenbank nur verwalten",
   "members.deleteMember": "Mitglied löschen",
   "members.disInvite": "Einladung widerrufen",
-  "members.editor": "Editor",
   "members.editorTip": "Kann Apps erstellen & bearbeiten",
   "members.email": "E-Mail",
   "members.emailInvalid": "Ungültiges E-Mail-Format",
@@ -270,13 +269,12 @@
   "members.invite": "Hinzufügen",
   "members.inviteTeamMember": "Teammitglied hinzufügen",
   "members.inviteTeamMemberTip": "Sie können direkt nach der Anmeldung auf Ihre Teamdaten zugreifen.",
-  "members.invitedAsRole": "Eingeladen als {{role}}-Benutzer",
+  "members.invitedAsRole": "Eingeladen als {{role}}",
   "members.lastActive": "ZULETZT AKTIV",
   "members.name": "NAME",
-  "members.normal": "Normal",
+  "members.noNewInvitationsSent": "Keine neuen Einladungen gesendet",
   "members.normalTip": "Kann nur Apps verwenden, kann keine Apps erstellen",
   "members.ok": "OK",
-  "members.owner": "Eigentümer",
   "members.pending": "Ausstehend...",
   "members.removeFromTeam": "Vom Team entfernen",
   "members.removeFromTeamTip": "Wird den Teamzugang entfernen",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Wissen",
   "menus.datasetsTips": "BALD VERFÜGBAR: Importieren Sie Ihre eigenen Textdaten oder schreiben Sie Daten in Echtzeit über Webhook, um den LLM-Kontext zu verbessern.",
+  "menus.deployments": "Bereitstellungen",
   "menus.explore": "Erkunden",
   "menus.exploreMarketplace": "Marketplace erkunden",
   "menus.newApp": "Neue App",
   "menus.newDataset": "Wissen erstellen",
   "menus.plugins": "Integrationen",
   "menus.pluginsTips": "Integrieren Sie Integrationen von Drittanbietern oder erstellen Sie ChatGPT-kompatible KI-Integrationen.",
+  "menus.roster": "Agent-Verzeichnis",
   "menus.status": "Beta",
   "menus.tools": "Werkzeuge",
   "model.addMoreModel": "Gehen Sie zu den Einstellungen, um mehr Modelle hinzuzufügen",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Text-zu-Sprache-Modell",
   "modelProvider.ttsModel.tip": "Legen Sie das Standardmodell für die Text-zu-Sprache-Eingabe in Konversationen fest.",
   "modelProvider.upgradeForLoadBalancing": "Aktualisieren Sie Ihren Plan, um den Lastenausgleich zu aktivieren.",
+  "navigation.skipToMain": "Zum Hauptinhalt springen",
   "noData": "Keine Daten",
   "operation.add": "Hinzufügen",
   "operation.added": "Hinzugefügt",
@@ -600,9 +601,6 @@
   "placeholder.input": "Bitte eingeben",
   "placeholder.search": "Suchen...",
   "placeholder.select": "Bitte auswählen",
-  "plugin.serpapi.apiKey": "API-Schlüssel",
-  "plugin.serpapi.apiKeyPlaceholder": "Geben Sie Ihren API-Schlüssel ein",
-  "plugin.serpapi.keyFrom": "Holen Sie Ihren SerpAPI-Schlüssel von der SerpAPI-Kontoseite",
   "promptEditor.context.item.desc": "Kontextvorlage einfügen",
   "promptEditor.context.item.title": "Kontext",
   "promptEditor.context.modal.add": "Kontext hinzufügen",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
new file mode 100644
index 00000000000..57c49caba49
--- /dev/null
+++ b/web/i18n/de-DE/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "Backend-Dienst-API",
+  "access.api.copyCurlExample": "cURL-Beispiel kopieren",
+  "access.api.createFailed": "API-Token konnte nicht generiert werden.",
+  "access.api.createKey": "API-Token generieren",
+  "access.api.createKeyTitle": "Neuen API-Token generieren",
+  "access.api.curlExampleTitle": "cURL-Beispiel",
+  "access.api.description": "Zugriff auf diese Bereitstellung über HTTP. Jeder API-Token gilt für eine Umgebung.",
+  "access.api.developerTitle": "Entwickler-API",
+  "access.api.disabled": "Der API-Zugriff ist für diese Bereitstellung deaktiviert.",
+  "access.api.disabledHint": "Aktivieren Sie den API-Zugriff, um umgebungsspezifische Token zu generieren.",
+  "access.api.dismissToken": "API-Token schließen",
+  "access.api.docs": "API-Dokumentation",
+  "access.api.docsClose": "API-Dokumentation schließen",
+  "access.api.docsDescription": "Workflow-API-Referenz für diese Bereitstellung anzeigen.",
+  "access.api.docsTitle": "Workflow-API-Dokumentation",
+  "access.api.empty": "Stellen Sie zuerst in einer Umgebung bereit, um API-Token auszustellen.",
+  "access.api.emptyTitle": "Keine bereitgestellten Umgebungen",
+  "access.api.endpoint": "Anforderungs-URL",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "API-Token-Liste",
+  "access.api.nameLabel": "Name des API-Tokens",
+  "access.api.namePlaceholder": "Geben Sie einen Namen für den API-Token ein",
+  "access.api.nameRequired": "Der Name des API-Tokens ist erforderlich.",
+  "access.api.newKey": "Neuen API-Token generieren",
+  "access.api.newTokenDescription": "Dieser API-Token wird nur einmal angezeigt. Kopieren Sie ihn, bevor Sie diese Seite verlassen.",
+  "access.api.newTokenLabel": "API-Token",
+  "access.api.newTokenTitle": "API-Token generiert",
+  "access.api.noKeys": "Noch keine API-Token. Generieren Sie einen, um die API aufzurufen.",
+  "access.api.noKeysTitle": "Noch keine API-Token",
+  "access.api.revokeConfirmDescription": "Der API-Token \"{{name}}\" funktioniert sofort nicht mehr. Diese Aktion kann nicht rückgängig gemacht werden.",
+  "access.api.revokeConfirmTitle": "API-Token widerrufen?",
+  "access.api.revokeFailed": "API-Token konnte nicht widerrufen werden.",
+  "access.api.revokeSuccess": "API-Token widerrufen",
+  "access.api.table.action": "Aktion",
+  "access.api.table.environment": "Umgebung",
+  "access.api.table.key": "API-Token",
+  "access.api.table.name": "Name",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Kanal",
+  "access.channels.col.endpoint": "Einstiegspunkt",
+  "access.channels.col.status": "Status",
+  "access.channels.description": "WebApp- und CLI-Einstiegspunkte verwenden die oben festgelegten Zugriffsberechtigungen.",
+  "access.channels.disabled": "Zugriffskanäle sind für diese Bereitstellung deaktiviert.",
+  "access.channels.disabledHint": "Aktivieren Sie Zugriffskanäle, um WebApp- und CLI-Einstiegspunkte verfügbar zu machen.",
+  "access.channels.followPermission": "Folgt Berechtigungen",
+  "access.channels.title": "Zugriffskanäle",
+  "access.cli.description": "Über das Terminal mit difyctl aufrufen, geeignet für Skripte, automatisierte Workflows oder Agent-Integrationen.",
+  "access.cli.docs": "Anwendungsleitfaden",
+  "access.cli.domain": "Domain",
+  "access.cli.empty": "CLI-Endpunkt nicht konfiguriert.",
+  "access.cli.install": "CLI installieren",
+  "access.cli.title": "CLI",
+  "access.copied": "Kopiert",
+  "access.copy": "Kopieren",
+  "access.copyFailed": "Kopieren fehlgeschlagen",
+  "access.copyToast": "In die Zwischenablage kopiert",
+  "access.hide": "Ausblenden",
+  "access.members.clearAll": "Alle löschen",
+  "access.members.empty": "Keine Treffer gefunden.",
+  "access.members.groupCount_one": "{{count}} Gruppe",
+  "access.members.groupCount_other": "{{count}} Gruppen",
+  "access.members.groups": "Gruppen",
+  "access.members.individuals": "Mitglieder",
+  "access.members.memberCount_one": "{{count}} Mitglied",
+  "access.members.memberCount_other": "{{count}} Mitglieder",
+  "access.members.pickPlaceholder": "Gruppen oder Mitglieder auswählen",
+  "access.members.searchPlaceholder": "Gruppen und Mitglieder suchen",
+  "access.members.selectedLabel": "Ausgewählt",
+  "access.permission.anyone": "Jeder mit dem Link",
+  "access.permission.anyoneDesc": "Jeder kann ohne Anmeldung auf diese Bereitstellung zugreifen.",
+  "access.permission.memberCount_one": "{{count}} Mitglied",
+  "access.permission.memberCount_other": "{{count}} Mitglieder",
+  "access.permission.organization": "Alle Mitglieder innerhalb der Plattform",
+  "access.permission.organizationDesc": "Alle Mitglieder innerhalb der Plattform",
+  "access.permission.specific": "Bestimmte Mitglieder innerhalb der Plattform",
+  "access.permission.specificDesc": "Bestimmte Gruppen oder Mitglieder auswählen",
+  "access.permission.specificUnavailable": "Die Auswahl bestimmter Mitglieder ist deaktiviert, bis echte Plattformmitglieder und -gruppen verbunden sind.",
+  "access.permission.updateFailed": "Zugriffsrichtlinie konnte nicht aktualisiert werden.",
+  "access.permissions.col.environment": "Umgebung",
+  "access.permissions.col.permission": "Zugriff",
+  "access.permissions.description": "Legen Sie Zugriffsberechtigungen für WebApp- und CLI-Einstiegspunkte in jeder Umgebung fest.",
+  "access.permissions.editAriaLabel": "Zugriff für {{environment}} konfigurieren",
+  "access.permissions.editDescription": "Legen Sie Zugriffsberechtigungen für WebApp- und CLI-Einstiegspunkte fest.",
+  "access.permissions.editTitle": "Zugriffsberechtigungen",
+  "access.permissions.title": "Zugriffsberechtigungen",
+  "access.revoke": "Widerrufen",
+  "access.runAccess.description": "Verwalten Sie, wie Benutzer diese Bereitstellung ausführen können und wer pro Umgebung darauf zugreifen darf.",
+  "access.runAccess.disabled": "Der Ausführungszugriff ist für diese Bereitstellung deaktiviert.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Diese Bereitstellung als Model-Context-Protocol-Server bereitstellen.",
+  "access.runAccess.mcpEmpty": "MCP-Endpunkt nicht konfiguriert.",
+  "access.runAccess.noEnvs": "Stellen Sie in einer Umgebung bereit, um Zugriffsberechtigungen zu konfigurieren.",
+  "access.runAccess.noEnvsTitle": "Keine bereitgestellten Umgebungen",
+  "access.runAccess.openWebapp": "WebApp öffnen",
+  "access.runAccess.permissions": "Zugriffsberechtigungen",
+  "access.runAccess.permissionsDesc": "Wer in jeder Umgebung auf diese Bereitstellung zugreifen kann.",
+  "access.runAccess.title": "Ausführungszugriff",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Gehostete Webseite für Endbenutzer.",
+  "access.runAccess.webappEmpty": "Demnächst verfügbar.",
+  "access.show": "Anzeigen",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Extern",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Unbekannt",
+  "card.access.api": "API-Token",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Kein Zugriff",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Erstes Release erstellen",
+  "card.deploy": "Bereitstellen",
+  "card.deploying": "{{count}} werden bereitgestellt",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} fehlgeschlagen",
+  "card.fromApp": "Von {{name}}",
+  "card.lastDeployed": "Zuletzt bereitgestellt {{time}}",
+  "card.menu.delete": "Bereitstellung löschen",
+  "card.menu.deleteDisabled": "Das Löschen von Bereitstellungen ist für backendverwaltete Bereitstellungen noch nicht verfügbar.",
+  "card.menu.deploy": "In Umgebung bereitstellen",
+  "card.menu.editInfo": "Informationen bearbeiten",
+  "card.menu.viewDetail": "Bereitstellungsdetails anzeigen",
+  "card.moreActions": "Weitere Aktionen",
+  "card.neverDeployed": "Noch nicht bereitgestellt",
+  "card.noDescription": "Keine Beschreibung angegeben.",
+  "card.notDeployed": "Nicht bereitgestellt",
+  "card.ready": "{{count}} laufen",
+  "card.tooltip.createdAt": "Erstellt",
+  "card.tooltip.deployed": "Bereitgestellt",
+  "card.tooltip.deploymentStatus": "Bereitstellung",
+  "card.tooltip.notDeployed": "Diese Bereitstellung wurde noch in keiner Umgebung bereitgestellt.",
+  "card.tooltip.notDeployedShort": "Nicht bereitgestellt",
+  "card.tooltip.release": "Release",
+  "card.tooltip.releaseName": "Release-Name",
+  "card.tooltip.source": "Quelle",
+  "common.loadFailed": "Laden fehlgeschlagen. Versuchen Sie es später erneut.",
+  "common.loading": "Wird geladen...",
+  "createGuide.actions.back": "Zurück",
+  "createGuide.actions.cancel": "Abbrechen",
+  "createGuide.actions.continue": "Weiter",
+  "createGuide.actions.createAndDeploy": "Erstellen und bereitstellen",
+  "createGuide.actions.creating": "Wird erstellt...",
+  "createGuide.actions.deploy": "Bereitstellen",
+  "createGuide.actions.deploying": "Wird erstellt und bereitgestellt...",
+  "createGuide.actions.next": "Weiter",
+  "createGuide.actions.skipDeploy": "Überspringen, später bereitstellen",
+  "createGuide.description": "Erstellen Sie eine Bereitstellung aus einer Release-Quelle, Basisinformationen und einer Zielumgebung.",
+  "createGuide.dsl.defaultAppName": "Importierte DSL-App",
+  "createGuide.dsl.description": "Laden Sie ein Workflow-DSL-Paket hoch, um die Bereitstellung, das erste Release und die optionale Umgebungsbereitstellung zu erstellen.",
+  "createGuide.dsl.dropDescription": "Laden Sie ein Workflow-YAML-DSL-Paket hoch. Die Bereitstellungsoptionen werden vor der Bereitstellung aus dieser Datei aufgelöst.",
+  "createGuide.dsl.dropTitle": "Workflow-DSL-Paket hochladen",
+  "createGuide.dsl.readFailed": "Die DSL-Datei konnte nicht gelesen werden. Wählen Sie eine andere Datei und versuchen Sie es erneut.",
+  "createGuide.dsl.reading": "DSL-Datei wird gelesen...",
+  "createGuide.dsl.title": "DSL importieren",
+  "createGuide.dsl.unsupportedMode": "Nur Workflow-DSL-Dateien können für Bereitstellungen verwendet werden.",
+  "createGuide.errors.createReleaseFailed": "Bereitstellung oder Release konnte nicht erstellt werden.",
+  "createGuide.errors.deployFailed": "Bereitstellung in der Umgebung fehlgeschlagen.",
+  "createGuide.method.description": "Wählen Sie die Quelle, die zum Erstellen des ersten Releases verwendet wird.",
+  "createGuide.methods.bindApp.description": "Verwenden Sie eine bestehende Workflow-App in Studio als Release-Quelle.",
+  "createGuide.methods.bindApp.title": "Bestehende Workflow-App binden",
+  "createGuide.methods.importDsl.description": "Laden Sie ein Workflow-YAML-DSL-Paket hoch und fahren Sie über die Bereitstellungs-UI fort.",
+  "createGuide.methods.importDsl.title": "DSL importieren",
+  "createGuide.methods.mocked": "Simuliert",
+  "createGuide.nav.back": "Bereitstellungen",
+  "createGuide.release.defaultName": "initiales Release",
+  "createGuide.release.deployInfo": "Bereitstellungsinformationen",
+  "createGuide.release.description": "Geben Sie Bereitstellungsinformationen und Details zum ersten Release ein.",
+  "createGuide.release.firstVersion": "Erstes Release",
+  "createGuide.release.instanceDescription": "Bereitstellungsbeschreibung",
+  "createGuide.release.instanceDescriptionPlaceholder": "Beschreiben Sie, wofür diese Bereitstellung verwendet wird",
+  "createGuide.release.instanceName": "Bereitstellungsname",
+  "createGuide.release.instanceNameConflict": "Eine Bereitstellung mit diesem Namen existiert bereits. Wählen Sie einen anderen Namen.",
+  "createGuide.release.releaseDescription": "Release-Beschreibung",
+  "createGuide.release.releaseDescriptionPlaceholder": "Beschreiben Sie dieses Release",
+  "createGuide.release.releaseName": "Release-Name",
+  "createGuide.release.releaseNote": "Release-Beschreibung",
+  "createGuide.release.title": "Basisinformationen",
+  "createGuide.source.availableApps_one": "{{count}} App",
+  "createGuide.source.availableApps_other": "{{count}} Apps",
+  "createGuide.source.clearSearch": "App-Suche löschen",
+  "createGuide.source.description": "Wählen Sie die Quelle, die zum Erstellen des ersten Releases verwendet wird.",
+  "createGuide.source.empty": "Keine Workflow-Apps gefunden.",
+  "createGuide.source.searchPlaceholder": "Apps suchen",
+  "createGuide.source.sourceApp": "Workflow-App",
+  "createGuide.source.title": "Release-Quelle",
+  "createGuide.steps.method": "Release-Quelle",
+  "createGuide.steps.release": "Basisinformationen",
+  "createGuide.steps.source": "Release-Quelle",
+  "createGuide.steps.target": "In Umgebung bereitstellen",
+  "createGuide.target.bindingCount_one": "{{count}} Anmeldedaten",
+  "createGuide.target.bindingCount_other": "{{count}} Anmeldedaten",
+  "createGuide.target.bindingHint": "Wählen Sie die Anmeldedaten aus, die von diesem Release verwendet werden.",
+  "createGuide.target.bindings": "Anmeldedaten",
+  "createGuide.target.deferredBindingHint": "Die Anmeldedaten werden während der finalen Bereitstellungsaktion aus dem tatsächlichen Bereitstellungsplan aufgelöst.",
+  "createGuide.target.deferredEnvironmentHint": "Der Name wird mit den tatsächlichen Umgebungen abgeglichen, nachdem die Bereitstellung und das Release erstellt wurden.",
+  "createGuide.target.description": "Wählen Sie eine Zielumgebung und geben Sie die Laufzeiteinstellungen an, die dieses Release dort benötigt. Dieser Schritt kann übersprungen werden.",
+  "createGuide.target.envVarCount_one": "{{count}} Variable",
+  "createGuide.target.envVarCount_other": "{{count}} Variablen",
+  "createGuide.target.envVarHint": "Geben Sie für jede Umgebungsvariable, die dieses Release benötigt, einen benutzerdefinierten Wert ein oder verwenden Sie den in der App definierten Wert.",
+  "createGuide.target.envVarPlaceholder": "Wert eingeben",
+  "createGuide.target.envVarSource.ariaLabel": "Wertquelle für die Variable {{key}} auswählen",
+  "createGuide.target.envVarSource.default": "App-Wert",
+  "createGuide.target.envVarSource.lastDeployment": "Zuletzt bereitgestellter Wert",
+  "createGuide.target.envVarSource.literal": "Benutzerdefinierter Wert",
+  "createGuide.target.envVarType.number": "Zahl",
+  "createGuide.target.envVarType.secret": "Geheimnis",
+  "createGuide.target.envVarType.string": "Zeichenkette",
+  "createGuide.target.envVars": "Umgebungsvariablen",
+  "createGuide.target.environment": "Zielumgebung",
+  "createGuide.target.environmentName": "Umgebungsname",
+  "createGuide.target.environmentNamePlaceholder": "Produktion",
+  "createGuide.target.loadBindingsFailed": "Anmeldedaten konnten nicht geladen werden.",
+  "createGuide.target.loadEnvironmentsFailed": "Bereitstellungsumgebungen konnten nicht geladen werden.",
+  "createGuide.target.missingRequiredBinding": "Wählen Sie Anmeldedaten für diese erforderliche Bindung aus.",
+  "createGuide.target.noBindingRequired": "Keine Anmeldedaten erforderlich.",
+  "createGuide.target.noCredentialCandidates": "Keine verfügbaren Anmeldedaten.",
+  "createGuide.target.noEnvironmentOptions": "Keine Bereitstellungsumgebungen verfügbar.",
+  "createGuide.target.required": "Erforderlich",
+  "createGuide.target.selectCredential": "Anmeldedaten auswählen",
+  "createGuide.target.title": "In Umgebung bereitstellen",
+  "createGuide.title": "Neue Bereitstellung",
+  "createModal.appPickerPlaceholder": "Workflow-App auswählen",
+  "createModal.appSearchEmpty": "Keine passenden Workflow-Apps",
+  "createModal.appSearchPlaceholder": "Workflow-Apps suchen…",
+  "createModal.cancel": "Abbrechen",
+  "createModal.create": "Erstellen",
+  "createModal.createFailed": "Bereitstellung konnte nicht erstellt werden.",
+  "createModal.description": "Wählen Sie eine Workflow-App und erstellen Sie eine Bereitstellung.",
+  "createModal.descriptionLabel": "Beschreibung",
+  "createModal.descriptionPlaceholder": "Beschreiben Sie, wofür diese Bereitstellung verwendet wird",
+  "createModal.loadMoreApps": "Weitere Apps laden",
+  "createModal.loadingApps": "Apps werden geladen…",
+  "createModal.nameLabel": "Bereitstellungsname",
+  "createModal.namePlaceholder": "Bereitstellungsname",
+  "createModal.noApps": "In diesem Arbeitsbereich wurden keine Workflow-Apps gefunden. Erstellen Sie zuerst eine in Studio.",
+  "createModal.selected": "Ausgewählt",
+  "createModal.sourceApp": "Workflow-App (erforderlich)",
+  "createModal.title": "Neue Bereitstellung",
+  "deployDrawer.bindingCount_one": "{{count}} Anmeldedaten",
+  "deployDrawer.bindingCount_other": "{{count}} Anmeldedaten",
+  "deployDrawer.bindingOptionsFailed": "Anmeldedaten-Optionen konnten nicht geladen werden.",
+  "deployDrawer.bindingSelectionHint": "Wählen Sie die Anmeldedaten aus, die von dieser Bereitstellung verwendet werden.",
+  "deployDrawer.bindingsDisabled": "Aus der Release-Vorschau aufgelöst. Bearbeitung ist noch nicht verfügbar.",
+  "deployDrawer.cancel": "Abbrechen",
+  "deployDrawer.close": "Bereitstellungs-Drawer schließen",
+  "deployDrawer.defaultSelect": "Auswählen...",
+  "deployDrawer.deploy": "In Umgebung bereitstellen",
+  "deployDrawer.deployExistingRelease": "In Umgebung bereitstellen",
+  "deployDrawer.deployExistingReleaseDescription": "Wählen Sie ein Release und eine Zielumgebung zur Bereitstellung aus.",
+  "deployDrawer.deployExistingReleaseTitle": "In Umgebung bereitstellen",
+  "deployDrawer.deployFailed": "Bereitstellung konnte nicht gestartet werden.",
+  "deployDrawer.deploying": "Wird bereitgestellt...",
+  "deployDrawer.description": "Wählen Sie ein Release und eine Zielumgebung zur Bereitstellung aus.",
+  "deployDrawer.envVarCount_one": "{{count}} Variable",
+  "deployDrawer.envVarCount_other": "{{count}} Variablen",
+  "deployDrawer.envVarHint": "Geben Sie für jede Umgebungsvariable, die dieses Release benötigt, einen benutzerdefinierten Wert ein oder verwenden Sie den in der App definierten Wert.",
+  "deployDrawer.envVarPlaceholder": "Wert eingeben",
+  "deployDrawer.envVarSource.ariaLabel": "Wertquelle für die Variable {{key}} auswählen",
+  "deployDrawer.envVarSource.default": "App-Wert",
+  "deployDrawer.envVarSource.lastDeployment": "Zuletzt bereitgestellter Wert",
+  "deployDrawer.envVarSource.literal": "Benutzerdefinierter Wert",
+  "deployDrawer.envVarType.number": "Zahl",
+  "deployDrawer.envVarType.secret": "Geheimnis",
+  "deployDrawer.envVarType.string": "Zeichenkette",
+  "deployDrawer.envVars": "Umgebungsvariablen",
+  "deployDrawer.existingReleaseHint": "Dieses Release wird unverändert bereitgestellt. Es wird kein neues Release erstellt.",
+  "deployDrawer.loadingBindings": "Wird aufgelöst...",
+  "deployDrawer.lockedHint": "An aktuelle Umgebung gebunden",
+  "deployDrawer.missingRequiredBinding": "Wählen Sie Anmeldedaten für diese erforderliche Bindung aus.",
+  "deployDrawer.missingRequiredEnvVar": "Geben Sie einen Wert für diese erforderliche Umgebungsvariable ein.",
+  "deployDrawer.modelCreds": "Modell-Anmeldedaten",
+  "deployDrawer.needsValidation": " (Validierung erforderlich)",
+  "deployDrawer.newReleaseHint": "Aus dem ausgewählten Workflow-App-YAML wird ein neues Release erstellt.",
+  "deployDrawer.noBindingRequired": "Nicht erforderlich",
+  "deployDrawer.noCredentialCandidates": "Keine verfügbaren Anmeldedaten.",
+  "deployDrawer.noNewEnvironmentAvailable": "Alle verfügbaren Umgebungen haben bereits eine Bereitstellung.",
+  "deployDrawer.noOtherReleaseAvailable": "Es sind keine weiteren Releases für diese Umgebung verfügbar.",
+  "deployDrawer.noReleaseAvailable": "Erstellen Sie ein Release, bevor Sie in einer Umgebung bereitstellen.",
+  "deployDrawer.notFound": "Bereitstellung nicht gefunden.",
+  "deployDrawer.noteLabel": "Release-Beschreibung (optional)",
+  "deployDrawer.notePlaceholder": "z. B. Onboarding-Texte angepasst",
+  "deployDrawer.pluginCreds": "Plugin-Anmeldedaten",
+  "deployDrawer.promote": "Bereitstellen",
+  "deployDrawer.promoteDescription": "Wählen Sie ein Release und eine Zielumgebung zur Bereitstellung aus.",
+  "deployDrawer.promoteTitle": "In Umgebung bereitstellen",
+  "deployDrawer.readOnly": "Schreibgeschützt",
+  "deployDrawer.redeploy": "In Umgebung bereitstellen",
+  "deployDrawer.redeployDescription": "Wählen Sie ein Release und eine Zielumgebung zur Bereitstellung aus.",
+  "deployDrawer.redeployExistingReleaseHint": "Das aktuelle Release wird unverändert erneut bereitgestellt. Es wird kein neues Release erstellt.",
+  "deployDrawer.redeployTitle": "In Umgebung bereitstellen",
+  "deployDrawer.releaseLabel": "Release",
+  "deployDrawer.requiredBinding": "Erforderlich",
+  "deployDrawer.rollback": "Bereitstellen",
+  "deployDrawer.rollbackDescription": "Wählen Sie ein Release und eine Zielumgebung zur Bereitstellung aus.",
+  "deployDrawer.rollbackTitle": "In Umgebung bereitstellen",
+  "deployDrawer.runtimeCredentials": "Anmeldedaten",
+  "deployDrawer.secretPlaceholder": "Geheimnis",
+  "deployDrawer.selectCredential": "Anmeldedaten auswählen",
+  "deployDrawer.selectEnv": "Eine Umgebung auswählen",
+  "deployDrawer.selectProviderCred": "{{provider}}-Anmeldedaten auswählen",
+  "deployDrawer.selectProviderKey": "{{provider}}-Schlüssel auswählen",
+  "deployDrawer.selectRelease": "Ein Release auswählen",
+  "deployDrawer.targetEnv": "Zielumgebung",
+  "deployDrawer.title": "In Umgebung bereitstellen",
+  "deployDrawer.valuePlaceholder": "Wert",
+  "deployTab.cancelDeployment": "Bereitstellung abbrechen",
+  "deployTab.closeError": "Schließen",
+  "deployTab.col.actions": "Aktionen",
+  "deployTab.col.currentRelease": "Aktuelles Release",
+  "deployTab.col.environment": "Umgebung",
+  "deployTab.col.status": "Status",
+  "deployTab.col.updated": "Aktualisiert",
+  "deployTab.collapseDetails": "Bereitstellungsdetails einklappen",
+  "deployTab.confirmUndeploy": "Bereitstellung aufheben",
+  "deployTab.deployOtherVersion": "Anderes Release bereitstellen",
+  "deployTab.deployToEnv": "In {{name}} bereitstellen",
+  "deployTab.deployToNewEnv": "In neuer Umgebung bereitstellen...",
+  "deployTab.empty": "Noch keine Instanzen. Stellen Sie in einer neuen Umgebung bereit, um zu beginnen.",
+  "deployTab.emptyDescription": "Wählen Sie ein Release und eine Zielumgebung aus, um diese Bereitstellung Benutzern zur Verfügung zu stellen.",
+  "deployTab.emptyTitle": "Es werden noch keine Umgebungen ausgeführt",
+  "deployTab.envCount": "Umgebungen",
+  "deployTab.errorCode": "Code",
+  "deployTab.errorDialogDesc": "Überprüfen Sie die letzte fehlgeschlagene Bereitstellung, bevor Sie es erneut versuchen oder ein anderes Release bereitstellen.",
+  "deployTab.errorDialogTitle": "Bereitstellungsfehler in {{name}}",
+  "deployTab.errorMessage": "Meldung",
+  "deployTab.errorPhase": "Phase",
+  "deployTab.expandDetails": "Bereitstellungsdetails ausklappen",
+  "deployTab.moreActions": "Weitere Aktionen",
+  "deployTab.newDeployment": "In neuer Umgebung bereitstellen",
+  "deployTab.panel.commit": "Commit-ID",
+  "deployTab.panel.deploymentId": "Bereitstellungs-ID",
+  "deployTab.panel.endpoints": "Endpunkte",
+  "deployTab.panel.envVars": "Umgebungsvariablen",
+  "deployTab.panel.error": "Fehler",
+  "deployTab.panel.failedRelease": "Fehlgeschlagenes Release",
+  "deployTab.panel.health": "Zustand",
+  "deployTab.panel.instanceInfo": "Instanzinformationen",
+  "deployTab.panel.modelCreds": "Modell-Anmeldedaten",
+  "deployTab.panel.pluginCreds": "Plugin-Anmeldedaten",
+  "deployTab.panel.release": "Release",
+  "deployTab.panel.releaseCreatedAt": "Release erstellt am",
+  "deployTab.panel.releaseInfo": "Release-Informationen",
+  "deployTab.panel.replicas": "Replikate",
+  "deployTab.panel.run": "Ausführen",
+  "deployTab.panel.runtimeBindings": "Anmeldedaten",
+  "deployTab.panel.runtimeInfo": "Laufzeitinformationen",
+  "deployTab.panel.runtimeMode": "Laufzeitmodus",
+  "deployTab.panel.runtimeNote": "Laufzeit-Hinweis",
+  "deployTab.panel.targetRelease": "Ziel-Release",
+  "deployTab.panel.unknownError": "Bereitstellung fehlgeschlagen.",
+  "deployTab.promote": "Bereitstellen",
+  "deployTab.redeploy": "Erneut bereitstellen",
+  "deployTab.releaseCreatedAt": "Release erstellt {{time}}",
+  "deployTab.retry": "Erneut versuchen",
+  "deployTab.shortcut": "Kurzbefehl",
+  "deployTab.status.deployFailed": "Bereitstellung fehlgeschlagen",
+  "deployTab.status.deployingRelease": "Wird bereitgestellt ({{release}})",
+  "deployTab.status.runningOutOfSync": "Läuft (Synchronisierung ausstehend)",
+  "deployTab.status.runningWithFailed": "Läuft (letzte Bereitstellung fehlgeschlagen)",
+  "deployTab.undeploy": "Bereitstellung aufheben",
+  "deployTab.undeployConfirmDesc": "Der Endbenutzerzugriff wird sofort beendet. Das Release kann später erneut bereitgestellt werden.",
+  "deployTab.undeployConfirmTitle": "Bereitstellung aus {{name}} aufheben?",
+  "deployTab.undeployFrom": "Bereitstellung aus {{name}} aufheben",
+  "deployTab.undeployImpactTitle": "Betroffene Instanz",
+  "deployTab.viewError": "Fehler anzeigen",
+  "deployTab.viewLogs": "Logs anzeigen",
+  "deployTab.viewProgress": "Fortschritt anzeigen",
+  "detail.backToInstances": "Zurück zu Bereitstellungen",
+  "detail.deployingCount": "{{count}} werden bereitgestellt",
+  "detail.envCount_one": "{{count}} Umgebung",
+  "detail.envCount_other": "{{count}} Umgebungen",
+  "detail.failedCount": "{{count}} fehlgeschlagen",
+  "detail.mobileTabs": "Bereitstellungsbereiche",
+  "detail.notFound": "Bereitstellung nicht gefunden",
+  "detail.openSourceApp": "Quelle {{name}} öffnen",
+  "detail.sourceApp": "Quelle",
+  "detail.sourceAppLink": "Quelle",
+  "documentTitle.create": "Neue Bereitstellung · Bereitstellungen",
+  "documentTitle.detail": "Bereitstellung · Bereitstellungen",
+  "documentTitle.list": "Bereitstellungen",
+  "filter.allEnvs": "Alle Umgebungen",
+  "filter.notDeployed": "Nicht bereitgestellt",
+  "filter.searchPlaceholder": "Bereitstellungen suchen",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Zulassung",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Wird initialisiert",
+  "health.ENVIRONMENT_STATUS_DELETING": "Wird gelöscht",
+  "health.ENVIRONMENT_STATUS_FAILED": "Nicht verfügbar",
+  "health.ENVIRONMENT_STATUS_READY": "Verfügbar",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Unbekannt",
+  "list.clearFilters": "Filter löschen",
+  "list.clearSearch": "Bereitstellungssuche löschen",
+  "list.createDeployment": "Neu",
+  "list.empty": "Keine Bereitstellungen gefunden.",
+  "list.emptyDescription": "Erstellen Sie eine Bereitstellung aus einer Workflow-App oder einem Workflow-DSL-Paket, um Releases, Umgebungen und Zugriff zu verwalten.",
+  "list.emptyFilteredDescription": "Keine Bereitstellung entspricht der aktuellen Suche oder dem Umgebungsfilter.",
+  "list.emptyFilteredTitle": "Keine passenden Bereitstellungen",
+  "list.emptyTitle": "Noch keine Bereitstellungen",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Isoliert",
+  "mode.ENVIRONMENT_MODE_SHARED": "Geteilt",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Unbekannt",
+  "newInstance.comingSoon": "Demnächst verfügbar",
+  "newInstance.fromStudio": "Aus Studio auswählen",
+  "newInstance.importDSL": "DSL importieren",
+  "newInstance.title": "Neue Bereitstellung",
+  "overview.accessEndpoints": "Zugriffsendpunkte",
+  "overview.accessMeta.apiTokens": "API-Token verwalten",
+  "overview.accessMeta.cli": "CLI-Zugriff anzeigen",
+  "overview.accessMeta.webApp": "WebApp-Zugriff verwalten",
+  "overview.accessStatus": "Zugriff",
+  "overview.api": "API-Token",
+  "overview.apiKeysCount_one": "{{count}} API-Token",
+  "overview.apiKeysCount_other": "{{count}} API-Token",
+  "overview.apiTokenSummary.environments_one": "{{count}} bereitgestellte Umgebung",
+  "overview.apiTokenSummary.environments_other": "{{count}} bereitgestellte Umgebungen",
+  "overview.availableForDeployment": "Verfügbar für Bereitstellung",
+  "overview.basicInfo": "Basisinformationen",
+  "overview.cardAction.deployLatest": "Neuestes Release bereitstellen",
+  "overview.cardAction.redeploy": "Erneut bereitstellen",
+  "overview.cardAction.viewProgress": "Bereitstellung anzeigen",
+  "overview.chip.behindTooltip_one": "1 Release hinter dem neuesten. Stellen Sie das neueste Release bereit, um zu aktualisieren.",
+  "overview.chip.behindTooltip_other": "{{count}} Releases hinter dem neuesten. Stellen Sie das neueste Release bereit, um zu aktualisieren.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "wird bereitgestellt",
+  "overview.chip.deployingTooltip": "Die Bereitstellung läuft.",
+  "overview.chip.empty": "leer",
+  "overview.chip.emptyTooltip": "In dieser Umgebung ist kein Release bereitgestellt.",
+  "overview.chip.failed": "fehlgeschlagen",
+  "overview.chip.failedTooltip": "Der letzte Bereitstellungsversuch ist fehlgeschlagen.",
+  "overview.chip.latest": "neueste",
+  "overview.chip.latestTooltip": "In dieser Umgebung läuft das neueste Release.",
+  "overview.chip.needsReleaseFirst": "Zuerst ein Release erstellen",
+  "overview.chip.olderRelease": "älter",
+  "overview.chip.olderReleaseTooltip": "In dieser Umgebung läuft ein älteres Release.",
+  "overview.chip.openInDeployTab": "Bereitstellungsfortschritt anzeigen",
+  "overview.cli": "CLI",
+  "overview.configured": "Konfiguriert",
+  "overview.createRelease": "Release erstellen",
+  "overview.created": "Erstellt",
+  "overview.deploy": "Bereitstellen",
+  "overview.deployedEnvironments": "bereitgestellt",
+  "overview.deploymentOverview": "Bereitstellungsübersicht",
+  "overview.deploymentStatus": "Bereitstellungsstatus",
+  "overview.description": "Beschreibung",
+  "overview.developerApi": "Entwickler-API",
+  "overview.disabled": "Deaktiviert",
+  "overview.emptyValue": "Nicht festgelegt",
+  "overview.enabled": "Aktiviert",
+  "overview.enabledChannels": "Zugriff aktiviert",
+  "overview.endUserAccess": "Endbenutzerzugriff",
+  "overview.environments": "Umgebungen",
+  "overview.hero.byName": "von {{name}}",
+  "overview.hero.empty": "Noch keine Releases",
+  "overview.hero.emptyDescription": "Erstellen Sie ein Release aus der aktuellen Quelle, bevor Sie bereitstellen.",
+  "overview.hero.propagation_one": "in {{count}}/{{total}} Umgebung bereitgestellt",
+  "overview.hero.propagation_other": "in {{count}}/{{total}} Umgebungen bereitgestellt",
+  "overview.hero.untargeted": "noch keine Umgebungen konfiguriert",
+  "overview.instanceDetails": "Bereitstellungsdetails",
+  "overview.instanceId": "Bereitstellungs-ID",
+  "overview.latestRelease.releaseCount_one": "{{count}} Release",
+  "overview.latestRelease.releaseCount_other": "{{count}} Releases",
+  "overview.latestReleaseTitle": "Neuestes Release",
+  "overview.manageDeployments": "Bereitstellungen verwalten",
+  "overview.name": "Name",
+  "overview.noAccessConfig": "Keine Zugriffskonfiguration.",
+  "overview.noReleaseYet": "Erstellen Sie ein Release, bevor Sie in einer Umgebung bereitstellen.",
+  "overview.notConfigured": "Nicht konfiguriert",
+  "overview.previousReleases.empty": "Noch keine früheren Releases.",
+  "overview.previousReleases.retired": "Derzeit nicht bereitgestellt",
+  "overview.previousReleases.title": "Frühere Releases",
+  "overview.previousReleases.viewAll": "Alle anzeigen",
+  "overview.ready": "Bereitstellbar",
+  "overview.recentReleases": "Aktuelle Releases",
+  "overview.releaseDeployedTitle": "{{release}} ist bereitgestellt",
+  "overview.releaseReadyTitle": "{{release}} ist bereit zur Bereitstellung",
+  "overview.serviceMap": "Servicekarte",
+  "overview.servingRelease": "Bedient {{release}}",
+  "overview.servingReleaseDescription": "Diese Bereitstellung ist in {{count}}/{{total}} Umgebungen bereitgestellt.",
+  "overview.strip.deployToNewEnvironment": "In neuer Umgebung bereitstellen",
+  "overview.strip.empty": "Keine Umgebungen konfiguriert.",
+  "overview.strip.emptyDeployableDescription": "Stellen Sie das neueste Release in einer Umgebung bereit, sobald Sie bereit sind.",
+  "overview.strip.emptyDeployed": "Noch keine Instanzen.",
+  "overview.strip.emptyDescription": "Erstellen Sie ein Release, bevor Sie in einer Umgebung bereitstellen.",
+  "overview.strip.emptyTitle": "Noch keine Instanzen",
+  "overview.strip.summary_one": "1 von {{total}} auf dem neuesten Release",
+  "overview.strip.summary_other": "{{count}} von {{total}} auf dem neuesten Release",
+  "overview.strip.title": "Instanzen",
+  "overview.switchSourceApp": "Quelle wechseln",
+  "overview.switchSourceAppDescription": "Wählen Sie die Workflow-App, die als Quelle für zukünftige Releases verwendet wird.",
+  "overview.switchSourceAppHint": "Nach dem Wechsel verwenden nur neu erstellte Releases die neue Quelle. Historische Releases und bestehende Bereitstellungen werden nicht geändert.",
+  "overview.targetRelease": "Ziel-Release",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Gefahrenzone",
+  "settings.dangerDesc": "Löschen Sie diese Bereitstellung dauerhaft und beenden Sie alle laufenden Instanzen. Dies kann nicht rückgängig gemacht werden.",
+  "settings.delete": "Bereitstellung löschen",
+  "settings.deleteConfirmDesc": "{{name}} löschen? Jede Instanz wird gestoppt und in allen Umgebungen entfernt. Dies kann nicht rückgängig gemacht werden.",
+  "settings.deleteConfirmTitle": "Bereitstellung löschen",
+  "settings.deleteFailed": "Bereitstellung konnte nicht gelöscht werden.",
+  "settings.deleteImpact": "Auswirkung",
+  "settings.deleteImpactInstance": "Bereitstellung",
+  "settings.deleteImpactTitle": "Betroffene Bereitstellung",
+  "settings.deleteImpactValue": "Die Bereitstellung wird aus der Bereitstellungsliste entfernt.",
+  "settings.deleted": "Bereitstellung gelöscht",
+  "settings.description": "Beschreibung",
+  "settings.descriptionHelp": "Verwalten Sie den Namen, die Beschreibung und andere Einstellungen dieser Bereitstellung.",
+  "settings.general": "Allgemein",
+  "settings.name": "Bereitstellungsname",
+  "settings.reset": "Zurücksetzen",
+  "settings.save": "Änderungen speichern",
+  "settings.updateFailed": "Bereitstellung konnte nicht aktualisiert werden.",
+  "settings.updated": "Bereitstellung aktualisiert",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Wird bereitgestellt",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Synchronisierung ausstehend",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Bereitstellung fehlgeschlagen",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Ungültig",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Läuft",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nicht bereitgestellt",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Bereitstellung wird aufgehoben",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unbekannt",
+  "subtitle": "Verwalten Sie Bereitstellungen über Umgebungen hinweg.",
+  "tabs.access.description": "Verwalten Sie Zugriffskanäle und Zugriffsberechtigungen.",
+  "tabs.access.name": "Zugriff",
+  "tabs.api-tokens.description": "Verwalten Sie API-Token und rufen Sie Instanzen über HTTP auf.",
+  "tabs.api-tokens.name": "API-Token",
+  "tabs.instances.description": "Anzeigen und Verwalten von Instanzen in bereitgestellten Umgebungen.",
+  "tabs.instances.name": "Instanzen",
+  "tabs.overview.description": "Sehen Sie den Status der Bereitstellung über die Umgebungen hinweg.",
+  "tabs.overview.name": "Übersicht",
+  "tabs.releases.description": "Releases erstellen, bereitstellen und verwalten.",
+  "tabs.releases.name": "Releases",
+  "tabs.settings.description": "Verwalten Sie den Namen, die Beschreibung und andere Einstellungen dieser Bereitstellung.",
+  "tabs.settings.name": "Einstellungen",
+  "title": "Bereitstellungen",
+  "unsupportedDslNodes.description": "Dieses Release enthält Knoten, die die Bereitstellungslaufzeit noch nicht unterstützt. Entfernen oder ersetzen Sie sie in Studio und versuchen Sie es erneut.",
+  "unsupportedDslNodes.descriptionWithTypes": "Dieses Release enthält Knoten, die die Bereitstellungslaufzeit noch nicht unterstützt: {{nodeTypes}}. Entfernen oder ersetzen Sie sie in Studio und versuchen Sie es erneut.",
+  "unsupportedDslNodes.title": "Nicht unterstützte Knoten",
+  "unsupportedDslNodes.unknownType": "Unbekannter Typ",
+  "versions.cancelCreate": "Abbrechen",
+  "versions.cancelDelete": "Abbrechen",
+  "versions.cancelEdit": "Abbrechen",
+  "versions.checkingReleaseContent": "Release-Inhalt wird überprüft...",
+  "versions.col.action": "Aktion",
+  "versions.col.author": "Erstellt von",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Erstellt am",
+  "versions.col.deployedTo": "Bereitgestellt in",
+  "versions.col.release": "Release",
+  "versions.col.sourceApp": "Quelle",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Erstellen",
+  "versions.createFailed": "Release konnte nicht erstellt werden.",
+  "versions.createRelease": "Release erstellen",
+  "versions.createReleaseDescription": "Erstellen Sie ein bereitstellbares Release aus einer Workflow-App oder einer Workflow-DSL-Datei.",
+  "versions.createReleaseHint": "Neue Releases können in jeder Umgebung bereitgestellt werden.",
+  "versions.createSuccess": "Release \"{{name}}\" erstellt.",
+  "versions.creating": "Wird erstellt...",
+  "versions.currentOn": "Aktuelles Release in {{name}}",
+  "versions.deleteConfirmDesc": "Release \"{{name}}\" wird dauerhaft gelöscht. Dies kann nicht rückgängig gemacht werden.",
+  "versions.deleteConfirmTitle": "Release löschen?",
+  "versions.deleteFailed": "Release konnte nicht gelöscht werden.",
+  "versions.deleteImpactDeployment": "Bereitstellungsstatus",
+  "versions.deleteImpactNotDeployed": "Derzeit nicht bereitgestellt",
+  "versions.deleteImpactRelease": "Release",
+  "versions.deleteImpactTitle": "Auswirkung des Löschens",
+  "versions.deleteRelease": "Release löschen",
+  "versions.deleteSuccess": "Release \"{{name}}\" gelöscht.",
+  "versions.deploy": "Bereitstellen",
+  "versions.deployTo": "In {{name}} bereitstellen",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Wird bereitgestellt",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Synchronisierung ausstehend",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Fehlgeschlagen",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Ungültig",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Läuft",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nicht bereitgestellt",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Bereitstellung wird aufgehoben",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unbekannt",
+  "versions.deployingTo": "{{name}} wird bereitgestellt",
+  "versions.disabledReason.checkDeploymentsFailed": "Bereitstellungsnutzung konnte nicht überprüft werden. Versuchen Sie es später erneut.",
+  "versions.disabledReason.checkingDeployments": "Bereitstellungsnutzung wird überprüft",
+  "versions.disabledReason.current": "Dieses Release läuft bereits in {{name}}",
+  "versions.disabledReason.deploying": "Warten Sie, bis die aktive Bereitstellung abgeschlossen ist",
+  "versions.disabledReason.envDisabled": "Diese Umgebung ist nicht bereitstellbar",
+  "versions.disabledReason.releaseInUse_one": "Heben Sie die Bereitstellung dieses Releases aus {{count}} Umgebung auf, bevor Sie es löschen",
+  "versions.disabledReason.releaseInUse_other": "Heben Sie die Bereitstellung dieses Releases aus {{count}} Umgebungen auf, bevor Sie es löschen",
+  "versions.dslReadFailed": "Die DSL-Datei konnte nicht gelesen werden. Wählen Sie eine andere Datei und versuchen Sie es erneut.",
+  "versions.dslReading": "DSL-Datei wird gelesen...",
+  "versions.dslUnsupportedMode": "Nur Workflow-DSL-Dateien können für Bereitstellungen verwendet werden.",
+  "versions.editFailed": "Release konnte nicht aktualisiert werden.",
+  "versions.editRelease": "Release bearbeiten",
+  "versions.editReleaseDescription": "Aktualisieren Sie den Namen und die Beschreibung dieses Releases.",
+  "versions.editSuccess": "Release \"{{name}}\" aktualisiert.",
+  "versions.empty": "Noch keine Releases verfügbar.",
+  "versions.emptyDescription": "Erstellen Sie das erste Release, bevor Sie in einer Umgebung bereitstellen.",
+  "versions.emptyTitle": "Noch keine Releases",
+  "versions.emptyWithCreate": "Noch keine Releases. Erstellen Sie das erste bereitstellbare Release, bevor Sie bereitstellen.",
+  "versions.exportDsl": "DSL exportieren",
+  "versions.exportDslFailed": "DSL konnte nicht exportiert werden.",
+  "versions.exportingDsl": "Wird exportiert...",
+  "versions.groupHeader.deploy": "Bereitstellen",
+  "versions.groupHeader.promote": "Bereitstellen",
+  "versions.groupHeader.rollback": "Vorherige Version bereitstellen",
+  "versions.groupHeader.unavailable": "Nicht verfügbar",
+  "versions.manualDslOption": "DSL hochladen",
+  "versions.moreActions": "Weitere Aktionen",
+  "versions.optional": "Optional",
+  "versions.promote": "Bereitstellen",
+  "versions.promoteTo": "In {{name}} bereitstellen",
+  "versions.releaseAlreadyExists": "Ein Release mit demselben Inhalt existiert bereits: {{name}}.",
+  "versions.releaseContentCheckFailed": "Release-Inhalt konnte nicht überprüft werden.",
+  "versions.releaseDescriptionLabel": "Beschreibung",
+  "versions.releaseDescriptionPlaceholder": "Beschreiben Sie dieses Release",
+  "versions.releaseHistory": "Release-Historie",
+  "versions.releaseNameLabel": "Release-Name",
+  "versions.releaseNamePlaceholder": "Release-Name",
+  "versions.releaseNameRequired": "Geben Sie einen Release-Namen ein.",
+  "versions.releaseSourceLabel": "Release-Quelle",
+  "versions.rollbackTo": "In {{name}} bereitstellen",
+  "versions.saveEdit": "Speichern",
+  "versions.sourceAppOption": "Workflow-App"
+}
diff --git a/web/i18n/de-DE/workflow.json b/web/i18n/de-DE/workflow.json
index 75478d61c4d..8da99b5e473 100644
--- a/web/i18n/de-DE/workflow.json
+++ b/web/i18n/de-DE/workflow.json
@@ -1,5 +1,6 @@
 {
   "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Antwort",
   "blocks.assigner": "Variablenzuweiser",
   "blocks.code": "Code",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Variablen-Aggregator",
   "blocks.variable-assigner": "Variablen-Zuweiser",
   "blocksAbout.agent": "Aufruf großer Sprachmodelle zur Beantwortung von Fragen oder zur Verarbeitung natürlicher Sprache",
+  "blocksAbout.agent-v2": "Aufruf großer Sprachmodelle zur Beantwortung von Fragen oder zur Verarbeitung natürlicher Sprache",
   "blocksAbout.answer": "Definieren Sie den Antwortinhalt einer Chat-Konversation",
   "blocksAbout.assigner": "Der Variablenzuweisungsknoten wird verwendet, um beschreibbaren Variablen (wie Gesprächsvariablen) Werte zuzuweisen.",
   "blocksAbout.code": "Ein Stück Python- oder NodeJS-Code ausführen, um benutzerdefinierte Logik zu implementieren",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "Workflow-ID",
   "globalVar.fieldsDescription.workflowRunId": "Workflow-Ausführungs-ID",
   "globalVar.title": "Systemvariablen",
+  "nodes.agent.advancedSetting": "Erweiterte Einstellungen",
   "nodes.agent.checkList.strategyNotSelected": "Strategie nicht ausgewählt",
   "nodes.agent.clickToViewParameterSchema": "Klicken Sie hier, um das Parameterschema anzuzeigen.",
   "nodes.agent.configureModel": "Modell konfigurieren",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Nicht unterstütztes Modell",
   "nodes.agent.modelSelectorTooltips.deprecated": "Dieses Modell ist veraltet",
   "nodes.agent.notAuthorized": "Nicht autorisiert",
+  "nodes.agent.outputVars.confirm": "Bestätigen",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Geben Sie ein JSON-Array ein.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Geben Sie true oder false ein.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Standardwerte für Dateien sind hier noch nicht konfigurierbar.",
+  "nodes.agent.outputVars.defaultValueLabel": "Standard",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Geben Sie eine gültige Zahl ein.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Geben Sie ein JSON-Objekt ein.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Standardwert",
+  "nodes.agent.outputVars.delete": "{{name}} löschen",
+  "nodes.agent.outputVars.descriptionLabel": "Beschreibung",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Beschreibung hinzufügen",
+  "nodes.agent.outputVars.edit": "{{name}} bearbeiten",
+  "nodes.agent.outputVars.editorLabel": "Editor für Ausgabevariablen",
   "nodes.agent.outputVars.files.title": "Vom Agenten generierte Dateien",
   "nodes.agent.outputVars.files.transfer_method": "Übertragungsmethode. Wert ist remote_url oder local_file",
   "nodes.agent.outputVars.files.type": "Art der Unterstützung. Jetzt nur noch Image unterstützen",
   "nodes.agent.outputVars.files.upload_file_id": "Datei-ID hochladen",
   "nodes.agent.outputVars.files.url": "Bild-URL",
   "nodes.agent.outputVars.json": "Vom Agenten generiertes JSON",
+  "nodes.agent.outputVars.nameDuplicate": "Ausgabename existiert bereits",
+  "nodes.agent.outputVars.nameInvalid": "Verwenden Sie Buchstaben, Zahlen und Unterstriche. Beginnen Sie mit einem Buchstaben oder Unterstrich.",
+  "nodes.agent.outputVars.nameLabel": "Feldname",
+  "nodes.agent.outputVars.namePlaceholder": "Feldname",
+  "nodes.agent.outputVars.newOutput": "Neue Ausgabe",
+  "nodes.agent.outputVars.requiredLabel": "Erforderlich",
+  "nodes.agent.outputVars.showAdvancedOptions": "Erweiterte Optionen anzeigen",
   "nodes.agent.outputVars.text": "Von Agenten generierte Inhalte",
+  "nodes.agent.outputVars.typeLabel": "Ausgabetyp",
   "nodes.agent.outputVars.usage": "Nutzungsinformationen des Modells",
   "nodes.agent.parameterSchema": "Parameter-Schema",
   "nodes.agent.pluginInstaller.install": "Installieren",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Dieses Integration wird von GitHub installiert. Bitte gehen Sie zu Integrationen, um sie neu zu installieren",
   "nodes.agent.pluginNotInstalled": "Dieses Integration ist nicht installiert",
   "nodes.agent.pluginNotInstalledDesc": "Dieses Integration wird von GitHub installiert. Bitte gehen Sie zu Integrationen, um sie neu zu installieren",
+  "nodes.agent.roster.change": "Wechseln",
+  "nodes.agent.roster.editInConsole": "In Agent Console bearbeiten",
+  "nodes.agent.roster.inlineSetup.description": "Eine einmalige Einrichtung, die nur in diesem Knoten existiert",
+  "nodes.agent.roster.inlineSetup.name": "Inline-Einrichtung",
+  "nodes.agent.roster.inlineSetup.title": "Agent-Einrichtung",
+  "nodes.agent.roster.inlineSetup.type": "Nur in diesem Knoten",
+  "nodes.agent.roster.label": "Agent",
+  "nodes.agent.roster.makeCopy": "Kopie erstellen",
+  "nodes.agent.roster.more": "Weitere Agentenaktionen",
+  "nodes.agent.roster.openPanel": "Details zu {{name}} öffnen",
+  "nodes.agent.roster.panelLabel": "Details zu {{name}}",
   "nodes.agent.strategy.configureTip": "Bitte konfigurieren Sie die Agentenstrategie.",
   "nodes.agent.strategy.configureTipDesc": "Nach der Konfiguration der agentischen Strategie lädt dieser Knoten automatisch die verbleibenden Konfigurationen. Die Strategie wirkt sich auf den Mechanismus des mehrstufigen Tool-Reasoning aus.",
   "nodes.agent.strategy.label": "Agentische Strategie",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Die installierte Integration-Version bietet diese Strategie nicht. Klicken Sie hier, um die Version zu wechseln.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} ist nicht installiert",
   "nodes.agent.strategyNotSet": "Agentische Strategie nicht festgelegt",
+  "nodes.agent.task.insert": "Einfügen",
+  "nodes.agent.task.label": "Agentenaufgabe",
+  "nodes.agent.task.mention": "Erwähnen",
+  "nodes.agent.task.placeholder": "Beschreiben Sie, was dieser Agent tun soll...",
+  "nodes.agent.task.tooltip": "Definieren Sie die Aufgabenanweisungen, denen dieser Agent in diesem Workflow folgen soll.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Nicht autorisiert",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} ist nicht installiert",
   "nodes.agent.toolbox": "Werkzeugkasten",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Von {{author}}",
   "tabs.question-understand": "Fragen verstehen",
   "tabs.requestToCommunity": "Anfragen an die Community",
-  "tabs.searchBlock": "Suchknoten",
+  "tabs.searchBlock": "Knoten, Agent, Mensch, Wissen suchen",
   "tabs.searchDataSource": "Datenquelle durchsuchen",
   "tabs.searchSnippets": "Snippets durchsuchen...",
   "tabs.searchTool": "Suchwerkzeug",
diff --git a/web/i18n/en-US/agent-v-2.json b/web/i18n/en-US/agent-v-2.json
new file mode 100644
index 00000000000..6ce81aa591e
--- /dev/null
+++ b/web/i18n/en-US/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "This action is not available yet.",
+  "agentDetail.access.actions.monitoring": "Monitoring",
+  "agentDetail.access.copyAccessUrl": "Copy access URL",
+  "agentDetail.access.copyFailed": "Failed to copy reference.",
+  "agentDetail.access.copyReference": "Copy reference for {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Copy service API endpoint",
+  "agentDetail.access.description": "Every surface this agent is reachable from.",
+  "agentDetail.access.empty": "No linked access points",
+  "agentDetail.access.emptyDescription": "This roster agent has no app or workflow references yet.",
+  "agentDetail.access.entries.agentApp.description": "Agent app linked to this roster agent.",
+  "agentDetail.access.entries.agentApp.name": "Agent app",
+  "agentDetail.access.entries.workflow.description": "Workflow and node reference linked to this roster agent.",
+  "agentDetail.access.entries.workflow.name": "Workflow node",
+  "agentDetail.access.entryCount_one": "{{count}} entry",
+  "agentDetail.access.entryCount_other": "{{count}} entries",
+  "agentDetail.access.groups.references.heading": "References",
+  "agentDetail.access.groups.references.label": "Linked references",
+  "agentDetail.access.learnMore": "Learn more",
+  "agentDetail.access.moreActions": "More actions for {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Service API Endpoint",
+  "agentDetail.access.serviceApi.title": "Backend service API",
+  "agentDetail.access.status.disabled": "Disabled",
+  "agentDetail.access.status.enabled": "Enabled",
+  "agentDetail.access.status.inService": "In service",
+  "agentDetail.access.status.outOfService": "Out of service",
+  "agentDetail.access.title": "Access Point",
+  "agentDetail.access.toggleSurface": "Toggle {{name}} access",
+  "agentDetail.access.webApp.accessUrl": "Access URL",
+  "agentDetail.access.webApp.actions.customize": "Customize",
+  "agentDetail.access.webApp.actions.embedded": "Embedded",
+  "agentDetail.access.webApp.actions.launch": "Launch",
+  "agentDetail.access.webApp.actions.settings": "Settings",
+  "agentDetail.access.webApp.refreshUrl": "Refresh access URL",
+  "agentDetail.access.webApp.showQrCode": "Show QR code",
+  "agentDetail.access.webApp.ssoEnabled": "SSO Enabled",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "Used as a node inside the workflow",
+  "agentDetail.access.workflow.empty": "No workflow references yet.",
+  "agentDetail.access.workflow.loadFailed": "Failed to load workflow references.",
+  "agentDetail.access.workflow.loading": "Loading workflow references…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} node",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} nodes",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Open in Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Open {{name}} in Studio",
+  "agentDetail.access.workflow.table.actions": "Actions",
+  "agentDetail.access.workflow.table.lastUpdated": "Last updated",
+  "agentDetail.access.workflow.table.name": "Name",
+  "agentDetail.access.workflow.table.nodes": "Nodes",
+  "agentDetail.access.workflow.table.version": "Version",
+  "agentDetail.access.workflow.title": "Workflow access",
+  "agentDetail.configure.advancedSettings.description": "For power users. Env vars, sandbox & memory.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Add environment variable",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Delete {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Hide {{key}} value",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Import .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "To show hidden .env files, press Command + Shift + . in the file picker.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "If your .env file is hidden, enable hidden files in your system file picker.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "To show hidden .env files, enable Hidden items in File Explorer.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Reveal {{key}} value",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Select environment variable scope",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Environment variables available to this agent at runtime.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Toggle env editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Advanced Settings",
+  "agentDetail.configure.advancedSettings.toggle": "Toggle advanced settings",
+  "agentDetail.configure.chatFeatures.description": "Shape the end-user chat experience on your web app and chat surfaces.",
+  "agentDetail.configure.chatFeatures.title": "Chat Features",
+  "agentDetail.configure.files.add": "Add file",
+  "agentDetail.configure.files.empty.description": "Upload docs the agent can read, like specs, templates, or guidelines",
+  "agentDetail.configure.files.empty.title": "No files yet",
+  "agentDetail.configure.files.label": "Files",
+  "agentDetail.configure.files.preview.empty": "No preview content.",
+  "agentDetail.configure.files.preview.failed": "Failed to load preview.",
+  "agentDetail.configure.files.preview.unsupported": "Preview is not supported for this file.",
+  "agentDetail.configure.files.remove": "Remove {{name}}",
+  "agentDetail.configure.files.tip": "Files this agent can use while orchestrating tasks.",
+  "agentDetail.configure.files.toggle": "Toggle files",
+  "agentDetail.configure.files.treeLabel": "Agent files",
+  "agentDetail.configure.files.upload.action": "Upload",
+  "agentDetail.configure.files.upload.browse": "browse",
+  "agentDetail.configure.files.upload.description": "Upload a file for this agent.",
+  "agentDetail.configure.files.upload.dropzone": "Drop a file here, or",
+  "agentDetail.configure.files.upload.failed": "Failed to upload file.",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "Upload one file.",
+  "agentDetail.configure.files.upload.success": "File uploaded.",
+  "agentDetail.configure.files.upload.title": "Upload file",
+  "agentDetail.configure.knowledgeRetrieval.add": "Add knowledge retrieval",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Add knowledge",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Click the “+” button to add knowledge",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Knowledge",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Retrieval Setting",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Learn more about Knowledge retrieval",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automatic",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Conditions",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Disabled",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Metadata Filtering",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manual",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Select metadata filtering mode",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Knowledge retrieval name",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Agent decide",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "The agent writes its own query from the prompt and available context. Nothing to set up here.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Custom query",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Write a fixed query for this retrieval source.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Custom query text",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Type a search query",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Query",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Knowledge Retrieval · Agent decide",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Edit {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Connect a knowledge base the agent can search while answering",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "No knowledge yet",
+  "agentDetail.configure.knowledgeRetrieval.label": "Knowledge Retrieval",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Remove {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Knowledge retrieval sources this agent can use while orchestrating tasks.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Toggle knowledge retrieval",
+  "agentDetail.configure.model.label": "Model",
+  "agentDetail.configure.orchestrate": "Orchestrate",
+  "agentDetail.configure.preview.chatFeatures": "Chat Features",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agent",
+  "agentDetail.configure.preview.empty.description": "Send a message to test the current draft.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "No instructions yet, so replies come from the plain model.",
+  "agentDetail.configure.preview.endUserAuth": "End-user authentication",
+  "agentDetail.configure.preview.restart": "Restart preview",
+  "agentDetail.configure.preview.title": "Preview",
+  "agentDetail.configure.prompt.copied": "Prompt copied",
+  "agentDetail.configure.prompt.copy": "Copy prompt",
+  "agentDetail.configure.prompt.copyFailed": "Failed to copy prompt.",
+  "agentDetail.configure.prompt.insert.label": "Insert",
+  "agentDetail.configure.prompt.insert.question": "Start question",
+  "agentDetail.configure.prompt.insert.reportFile": "Output report file",
+  "agentDetail.configure.prompt.insert.tenders": "Start tenders",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Mention",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Write instructions here,",
+  "agentDetail.configure.prompt.tip": "Define how this agent should interpret inputs, call tools, and produce outputs.",
+  "agentDetail.configure.publishBar.draft": "Draft",
+  "agentDetail.configure.publishBar.publishUpdate": "Publish update",
+  "agentDetail.configure.publishBar.published": "Published",
+  "agentDetail.configure.publishBar.publishedAt": "Published {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Publishing…",
+  "agentDetail.configure.publishBar.saved": "Saved 5 min ago",
+  "agentDetail.configure.publishBar.savedAt": "Saved {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Unpublished changes",
+  "agentDetail.configure.publishBar.upToDate": "Up to date",
+  "agentDetail.configure.publishBar.versionHistory": "Open version history",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Affected Workflows",
+  "agentDetail.configure.publishImpact.cancel": "Cancel",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Your agent appears in",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Changes will impact them.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "this agent",
+  "agentDetail.configure.publishImpact.title": "{{action}} to {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} workflow",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} workflows",
+  "agentDetail.configure.skills.add": "Add skill",
+  "agentDetail.configure.skills.detail.contentRegion": "Skill detail content",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} FILES",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Skill files",
+  "agentDetail.configure.skills.detail.files": "Files",
+  "agentDetail.configure.skills.empty.description": "Skills give the agent reusable expertise it can call while working",
+  "agentDetail.configure.skills.empty.title": "No skills yet",
+  "agentDetail.configure.skills.itemType": "Skill",
+  "agentDetail.configure.skills.label": "Skills",
+  "agentDetail.configure.skills.remove": "Remove {{name}}",
+  "agentDetail.configure.skills.tip": "Skills this agent can use while orchestrating tasks.",
+  "agentDetail.configure.skills.toggle": "Toggle skills",
+  "agentDetail.configure.skills.upload.action": "Upload",
+  "agentDetail.configure.skills.upload.browse": "browse",
+  "agentDetail.configure.skills.upload.description": "Upload a .zip or .skill package for this agent.",
+  "agentDetail.configure.skills.upload.dropzone": "Drop a skill package here, or",
+  "agentDetail.configure.skills.upload.failed": "Failed to upload skill.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Upload a .zip or .skill file.",
+  "agentDetail.configure.skills.upload.success": "Skill uploaded.",
+  "agentDetail.configure.skills.upload.title": "Upload skill",
+  "agentDetail.configure.tools.add": "Add tool",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "For developers",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Install a command line program the agent runs in its sandbox. Needs install and usually API keys.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI tool",
+  "agentDetail.configure.tools.addMenu.tool.description": "Pick a tool already in this workspace, like web search or integrations.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Tool",
+  "agentDetail.configure.tools.cliDialog.description": "Install a CLI tool from any package registry. The agent gains shell access to the binary it provides.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Edit CLI Tool",
+  "agentDetail.configure.tools.cliDialog.env.description": "Store API keys, tokens, or secrets that this CLI tool needs. Values are encrypted at rest and injected as environment variables when the agent invokes the tool.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Environment Variables",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(optional)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Sandboxed · runs once on first invocation",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Install Command",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Paste your install command here, e.g. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Install command is required.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Learn more about CLI Tool",
+  "agentDetail.configure.tools.cliDialog.name.label": "CLI Tool Name",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Name your CLI tool",
+  "agentDetail.configure.tools.cliDialog.name.required": "CLI tool name is required.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Never visible to agent prompt; injected only as $VAR at runtime",
+  "agentDetail.configure.tools.cliDialog.title": "Add a CLI Tool",
+  "agentDetail.configure.tools.cliTool": "CLI Tool",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "End-user · OAuth",
+  "agentDetail.configure.tools.editAction": "Edit {{name}}",
+  "agentDetail.configure.tools.empty.description": "Tools let the agent act, like searching the web or calling your apps",
+  "agentDetail.configure.tools.empty.title": "No tools yet",
+  "agentDetail.configure.tools.label": "Tools",
+  "agentDetail.configure.tools.moreActions": "More actions for {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Pre-authorize",
+  "agentDetail.configure.tools.removeAction": "Remove {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Remove all tools",
+  "agentDetail.configure.tools.tip": "Tools this agent can call while orchestrating tasks.",
+  "agentDetail.configure.tools.toggle": "Toggle tools",
+  "agentDetail.configure.tools.toolTabs.all": "All",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Custom",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugins",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agent",
+  "agentDetail.history": "History",
+  "agentDetail.logs.description": "Full logs record the running status of the application, including user inputs, agent replies, planning and tool uses.",
+  "agentDetail.logs.empty": "No logs found",
+  "agentDetail.logs.filters.period.allTime": "All time",
+  "agentDetail.logs.filters.period.label": "Log period",
+  "agentDetail.logs.filters.period.last30days": "Last 30 days",
+  "agentDetail.logs.filters.period.last7days": "Last 7 days",
+  "agentDetail.logs.filters.search.label": "Search logs",
+  "agentDetail.logs.filters.search.placeholder": "Search",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Last Created time",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Last Updated time",
+  "agentDetail.logs.filters.source.all": "Source",
+  "agentDetail.logs.filters.source.empty": "No sources found",
+  "agentDetail.logs.filters.source.label": "Log source",
+  "agentDetail.logs.filters.source.loadFailed": "Failed to load sources",
+  "agentDetail.logs.filters.source.loading": "Loading sources…",
+  "agentDetail.logs.filters.source.searchLabel": "Search sources",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Search",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Workflow",
+  "agentDetail.logs.learnMore": "Learn more",
+  "agentDetail.logs.loadFailed": "Failed to load logs",
+  "agentDetail.logs.loading": "Loading logs…",
+  "agentDetail.logs.notAvailable": "N/A",
+  "agentDetail.logs.table.createdTime": "Created Time",
+  "agentDetail.logs.table.endUser": "End-user",
+  "agentDetail.logs.table.messageCount": "Msg. Count",
+  "agentDetail.logs.table.operationRate": "Op. Rate",
+  "agentDetail.logs.table.source": "Source",
+  "agentDetail.logs.table.title": "Title",
+  "agentDetail.logs.table.unread": "Unread",
+  "agentDetail.logs.table.updatedTime": "Updated Time",
+  "agentDetail.logs.table.userRate": "User Rate",
+  "agentDetail.logs.title": "Logs",
+  "agentDetail.memorySettings.budgetLabel": "Memory Budget",
+  "agentDetail.memorySettings.description": "Memory settings from the active configuration snapshot.",
+  "agentDetail.memorySettings.export.description": "Memory export is planned for a later release.",
+  "agentDetail.memorySettings.export.download": "Download",
+  "agentDetail.memorySettings.export.soon": "Soon",
+  "agentDetail.memorySettings.export.title": "Export current memory",
+  "agentDetail.memorySettings.notConfigured": "Not configured",
+  "agentDetail.memorySettings.scopeLabel": "Memory Scope",
+  "agentDetail.memorySettings.title": "Memory",
+  "agentDetail.metadata.activeVersionLabel": "Active Version",
+  "agentDetail.metadata.appIdLabel": "App ID",
+  "agentDetail.metadata.description": "Read-only roster fields returned by the agent backend.",
+  "agentDetail.metadata.emptyValue": "Not available",
+  "agentDetail.metadata.scopeLabel": "Scope",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Workflow only",
+  "agentDetail.metadata.sourceLabel": "Source",
+  "agentDetail.metadata.statusLabel": "Status",
+  "agentDetail.metadata.title": "Metadata",
+  "agentDetail.metadata.updatedAtLabel": "Updated At",
+  "agentDetail.metadata.workflowIdLabel": "Workflow ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "Workflow Node ID",
+  "agentDetail.monitoring.change": "{{value}} from previous period",
+  "agentDetail.monitoring.dateRangeLabel": "Date range",
+  "agentDetail.monitoring.description": "Track the reusable agent activity, cost, and interaction quality across workflows.",
+  "agentDetail.monitoring.learnMore": "Learn more",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Unique end users who triggered workflows using this agent.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Active Users",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Continuous user-agent communication count for this access point.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Avg. Session Interactions",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Average output speed from the beginning of the request to completion.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Token Output Speed",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Estimated token cost produced by this agent across workflow runs.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Token Usage",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Daily AI conversations that reached this agent through the selected access point.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Total Conversations",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Daily agent interaction count.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Total Messages",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "The number of likes per 1,000 messages for this agent.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "User Satisfaction Rate",
+  "agentDetail.monitoring.pickSource": "Pick an app",
+  "agentDetail.monitoring.sourceLabel": "App",
+  "agentDetail.monitoring.sourceTrigger": "Source {{name}}",
+  "agentDetail.monitoring.sources.all": "All",
+  "agentDetail.monitoring.timeRangeLabel": "Time range",
+  "agentDetail.monitoring.timeRanges.custom": "Custom",
+  "agentDetail.monitoring.timeRanges.last30days": "Last 30 days",
+  "agentDetail.monitoring.timeRanges.last7days": "Last 7 days",
+  "agentDetail.monitoring.timeRanges.today": "Today",
+  "agentDetail.monitoring.title": "Monitoring",
+  "agentDetail.monitoring.tokenUsageConsumed": "Consumed tokens",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Agent navigation",
+  "agentDetail.publish": "Publish",
+  "agentDetail.publishSoon": "Soon",
+  "agentDetail.sections.access": "Access Point",
+  "agentDetail.sections.configure": "Orchestrate",
+  "agentDetail.sections.logs": "Logs",
+  "agentDetail.sections.monitoring": "Monitoring",
+  "agentDetail.subtitle": "Agent ID: {{agentId}}",
+  "agentDetail.title": "Agent",
+  "agentDetail.type": "AGENT",
+  "agentDetail.versionHistory.active": "Active",
+  "agentDetail.versionHistory.empty": "No versions yet",
+  "agentDetail.versionHistory.filter": "Filter versions",
+  "agentDetail.versionHistory.versionName": "Version {{version}}",
+  "roster.createAgent": "Create agent",
+  "roster.createAgentOptions": "Create agent options",
+  "roster.createDialog.description": "Create a reusable agent in this workspace roster.",
+  "roster.createDialog.title": "Create agent",
+  "roster.createForm.changeIcon": "Change agent icon",
+  "roster.createForm.descriptionLabel": "Description",
+  "roster.createForm.descriptionOptional": "(optional)",
+  "roster.createForm.descriptionPlaceholder": "e.g. Gathers sources on a topic and summarizes the key findings",
+  "roster.createForm.nameLabel": "Name",
+  "roster.createForm.namePlaceholder": "e.g. Max",
+  "roster.createForm.nameRequired": "Name is required.",
+  "roster.createForm.roleLabel": "Role",
+  "roster.createForm.rolePlaceholder": "e.g. Research Assistant",
+  "roster.createForm.roleRequired": "Role is required.",
+  "roster.createSuccess": "Agent created.",
+  "roster.dateTimeFormat": "MM/DD/YYYY hh:mm:ss A",
+  "roster.deleteDialog.description": "This agent will be removed from the active roster list.",
+  "roster.deleteDialog.title": "Delete {{name}}?",
+  "roster.deleteFailed": "Failed to delete agent.",
+  "roster.deleteSuccess": "Agent deleted.",
+  "roster.duplicateFailed": "Failed to duplicate agent.",
+  "roster.duplicateSuccess": "Agent duplicated.",
+  "roster.editAgent": "Edit {{name}}",
+  "roster.editDialog.description": "Update the roster name, description, and role for this agent.",
+  "roster.editDialog.title": "Edit agent",
+  "roster.editInfo": "Edit Info",
+  "roster.empty": "No agent yet",
+  "roster.emptyDescription": "Agents saved to this workspace will appear here.",
+  "roster.emptySearch": "No matching agents",
+  "roster.emptySearchDescription": "Try another agent name.",
+  "roster.filters.all": "All",
+  "roster.filters.drafts": "Drafts",
+  "roster.filters.label": "Agent filters",
+  "roster.filters.published": "Published",
+  "roster.learnMore": "Learn more about Agent Roster",
+  "roster.listLabel": "Agent roster list",
+  "roster.loadMore": "Load more",
+  "roster.loadingError": "Failed to load agents. Refresh and try again.",
+  "roster.moreActions": "More actions for {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Failed to create inline agent. Refresh and try again.",
+  "roster.nodeSelector.dialogLabel": "Select an agent",
+  "roster.nodeSelector.manageInAgentConsole": "Manage in Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Search…",
+  "roster.nodeSelector.startFromScratch": "Start from Scratch",
+  "roster.references.label": "Workflows using {{name}}",
+  "roster.references.trigger": "Workflows using {{name}}",
+  "roster.searchLabel": "Search agents",
+  "roster.searchPlaceholder": "Search agents by name…",
+  "roster.sources.agent_app": "Agent app",
+  "roster.sources.imported": "Imported",
+  "roster.sources.system": "System",
+  "roster.sources.workflow": "Workflow",
+  "roster.status.active": "Active",
+  "roster.status.archived": "Archived",
+  "roster.tabs.agent": "Agent",
+  "roster.tabs.human": "Human",
+  "roster.tabsLabel": "Roster type",
+  "roster.updateSuccess": "Agent updated.",
+  "roster.usageStatus.draft": "Draft"
+}
diff --git a/web/i18n/en-US/app-log.json b/web/i18n/en-US/app-log.json
index c25d509d8a1..6d04d33aa74 100644
--- a/web/i18n/en-US/app-log.json
+++ b/web/i18n/en-US/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Today",
   "filter.period.yearToDate": "Year to date",
   "filter.sortBy": "Sort by:",
+  "monitoring.description": "Monitoring records the running status of the application, including performance, user activity, and costs.",
   "promptLog": "Prompt Log",
   "runDetail.fileListDetail": "Detail",
   "runDetail.fileListLabel": "File Details",
diff --git a/web/i18n/en-US/billing.json b/web/i18n/en-US/billing.json
index 29615e30f69..68a6f212f14 100644
--- a/web/i18n/en-US/billing.json
+++ b/web/i18n/en-US/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Upgrade to unlock batch document upload",
   "upgrade.uploadMultiplePages.description": "You’ve reached the upload limit — only one document can be selected and uploaded at a time on your current plan.",
   "upgrade.uploadMultiplePages.title": "Upgrade to upload multiple documents at once",
+  "upgrade.workflowRestore.description": "Workflow version restoration is not available on your current plan.",
+  "upgrade.workflowRestore.title": "Upgrade to restore workflow versions",
   "upgradeBtn.encourage": "Upgrade Now",
   "upgradeBtn.encourageShort": "Upgrade",
   "upgradeBtn.plain": "View Plan",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index cf2ee19ac04..ded6c07e1dc 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -249,15 +249,18 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Switch workspace",
   "mcpPage.description": "Connect and manage MCP servers to give your apps access to external tools and services.",
-  "members.admin": "Admin",
   "members.adminTip": "Can build apps & manage team settings",
+  "members.alreadyInTeam": "Already in team",
+  "members.alreadyInTeamTip": "These users already have access to this workspace.",
+  "members.assignRoles": "Assign Roles",
+  "members.assignRolesModal.description": "Select roles to assign to this member. All permissions from selected roles will be combined.",
+  "members.assignRolesModal.selectedCount": "{{count}} selected",
+  "members.assignRolesModal.title": "Assign Roles",
   "members.builder": "Builder",
   "members.builderTip": "Can build & edit own apps",
-  "members.datasetOperator": "Knowledge Admin",
   "members.datasetOperatorTip": "Only can manage the knowledge base",
   "members.deleteMember": "Delete Member",
   "members.disInvite": "Cancel the invitation",
-  "members.editor": "Editor",
   "members.editorTip": "Can build & edit apps",
   "members.email": "Email",
   "members.emailInvalid": "Invalid Email Format",
@@ -270,17 +273,41 @@
   "members.invite": "Add",
   "members.inviteTeamMember": "Add team member",
   "members.inviteTeamMemberTip": "They can access your team data directly after signing in.",
-  "members.invitedAsRole": "Invited as {{role}} user",
+  "members.invitedAsRole": "Invited as {{role}}",
   "members.lastActive": "LAST ACTIVE",
+  "members.memberActions": "Member actions",
+  "members.memberDetails.assign": "Assign",
+  "members.memberDetails.assignedRoles": "Assigned Roles",
+  "members.memberDetails.customGroup": "CUSTOMIZED",
+  "members.memberDetails.generalGroup": "GENERAL",
+  "members.memberDetails.openAria": "Open member details for {{name}}",
+  "members.memberDetails.permissions.assignRoles": "Assign roles",
+  "members.memberDetails.permissions.createApps": "Create apps",
+  "members.memberDetails.permissions.createDatasets": "Create knowledge",
+  "members.memberDetails.permissions.editApps": "Edit apps",
+  "members.memberDetails.permissions.editDatasets": "Edit knowledge",
+  "members.memberDetails.permissions.inviteMembers": "Invite members",
+  "members.memberDetails.permissions.manageBilling": "Manage billing",
+  "members.memberDetails.permissions.manageDatasets": "Manage knowledge",
+  "members.memberDetails.permissions.removeMembers": "Remove members",
+  "members.memberDetails.permissions.transferOwnership": "Transfer ownership",
+  "members.memberDetails.permissions.useApps": "Use apps",
+  "members.memberDetails.permissions.workspaceSettings": "Workspace settings",
+  "members.memberDetails.removeRoleAria": "Remove {{role}} role",
+  "members.memberDetails.roleActionsAria": "Open actions for {{role}} role",
+  "members.memberDetails.roleNoPermissionSummary": "Current role has no permissions.",
+  "members.memberDetails.rolePermissionSummary": "{{role}} can <permissionList>{{permissions}}</permissionList>",
+  "members.memberDetails.title": "Member Details",
   "members.name": "NAME",
+  "members.noNewInvitationsSent": "No new invitations sent",
   "members.normal": "Normal",
   "members.normalTip": "Only can use apps, can not build apps",
   "members.ok": "OK",
-  "members.owner": "Owner",
   "members.pending": "Pending...",
   "members.removeFromTeam": "Remove from team",
   "members.removeFromTeamTip": "Will remove team access",
   "members.role": "ROLES",
+  "members.selectRole": "Select a role",
   "members.sendInvite": "Send Invite",
   "members.setAdmin": "Set as administrator",
   "members.setBuilder": "Set as builder",
@@ -311,12 +338,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Knowledge",
   "menus.datasetsTips": "COMING SOON: Import your own text data or write data in real-time via Webhook for LLM context enhancement.",
+  "menus.deployments": "Deployments",
   "menus.explore": "Explore",
   "menus.exploreMarketplace": "Explore Marketplace",
   "menus.newApp": "New App",
   "menus.newDataset": "Create Knowledge",
   "menus.plugins": "Integrations",
   "menus.pluginsTips": "Integrate third-party services or create ChatGPT-compatible AI integrations.",
+  "menus.roster": "Roster",
   "menus.status": "beta",
   "menus.tools": "Tools",
   "model.addMoreModel": "Go to settings to add more models",
@@ -516,6 +545,7 @@
   "modelProvider.ttsModel.key": "Text-to-Speech Model",
   "modelProvider.ttsModel.tip": "Set the default model for text-to-speech input in conversation.",
   "modelProvider.upgradeForLoadBalancing": "Upgrade your plan to enable Load Balancing.",
+  "navigation.skipToMain": "Skip to main content",
   "noData": "No data",
   "operation.add": "Add",
   "operation.added": "Added",
@@ -552,6 +582,7 @@
   "operation.lineBreak": "Line break",
   "operation.log": "Log",
   "operation.more": "More",
+  "operation.moreActions": "More actions",
   "operation.no": "No",
   "operation.noSearchCount": "0 {{content}}",
   "operation.noSearchResults": "No {{content}} were found",
@@ -600,9 +631,6 @@
   "placeholder.input": "Please enter",
   "placeholder.search": "Search...",
   "placeholder.select": "Please select",
-  "plugin.serpapi.apiKey": "API Key",
-  "plugin.serpapi.apiKeyPlaceholder": "Enter your API key",
-  "plugin.serpapi.keyFrom": "Get your SerpAPI key from SerpAPI Account Page",
   "promptEditor.context.item.desc": "Insert context template",
   "promptEditor.context.item.title": "Context",
   "promptEditor.context.modal.add": "Add Context ",
@@ -665,6 +693,7 @@
   "provider.saveFailed": "Save api key failed",
   "provider.validatedError": "Validation failed: ",
   "provider.validating": "Validating key...",
+  "settings.ResourceAccess": "Resource Access",
   "settings.account": "My account",
   "settings.accountGroup": "GENERAL",
   "settings.agentStrategy": "Agent Strategy",
@@ -684,6 +713,9 @@
   "settings.plugin": "Integrations",
   "settings.preferences": "Preferences",
   "settings.provider": "Model Provider",
+  "settings.resourceAccess": "Resource Access",
+  "settings.resourceAccessDescription": "Configure permission rules that apps and knowledge bases can use. Permission rules can be assigned to members in specific resource access configurations.",
+  "settings.rolesAndPermissions": "Roles & Permissions",
   "settings.settings": "Settings",
   "settings.swaggerAPIAsTool": "Swagger API as Tool",
   "settings.trigger": "Trigger",
diff --git a/web/i18n/en-US/dataset-settings.json b/web/i18n/en-US/dataset-settings.json
index 053996e769e..d4a3ec361a7 100644
--- a/web/i18n/en-US/dataset-settings.json
+++ b/web/i18n/en-US/dataset-settings.json
@@ -27,6 +27,7 @@
   "form.numberOfKeywords": "Number of Keywords",
   "form.onSearchResults": "No members match your search query.\nTry your search again.",
   "form.permissions": "Permissions",
+  "form.permissionsAccessConfig": "Go to access configuration",
   "form.permissionsAllMember": "All team members",
   "form.permissionsInvitedMembers": "Partial team members",
   "form.permissionsOnlyMe": "Only me",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
new file mode 100644
index 00000000000..c557989ea42
--- /dev/null
+++ b/web/i18n/en-US/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "Backend service API",
+  "access.api.copyCurlExample": "Copy cURL example",
+  "access.api.createFailed": "Failed to generate API Token.",
+  "access.api.createKey": "Generate API Token",
+  "access.api.createKeyTitle": "Generate new API Token",
+  "access.api.curlExampleTitle": "cURL example",
+  "access.api.description": "Access this deployment over HTTP. Each API Token is scoped to one environment.",
+  "access.api.developerTitle": "Developer API",
+  "access.api.disabled": "API access is turned off for this deployment.",
+  "access.api.disabledHint": "Enable API access to generate environment-scoped tokens.",
+  "access.api.dismissToken": "Dismiss API Token",
+  "access.api.docs": "API Docs",
+  "access.api.docsClose": "Close API docs",
+  "access.api.docsDescription": "View the Workflow API reference for this deployment.",
+  "access.api.docsTitle": "Workflow API documentation",
+  "access.api.empty": "Deploy to an environment first to start issuing API Tokens.",
+  "access.api.emptyTitle": "No deployed environments",
+  "access.api.endpoint": "Request URL",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "API Token list",
+  "access.api.nameLabel": "API Token name",
+  "access.api.namePlaceholder": "Enter an API Token name",
+  "access.api.nameRequired": "API Token name is required.",
+  "access.api.newKey": "Generate New API Token",
+  "access.api.newTokenDescription": "This API Token is shown only once. Copy it before leaving this page.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token generated",
+  "access.api.noKeys": "No API Tokens yet. Generate one to start calling the API.",
+  "access.api.noKeysTitle": "No API Tokens yet",
+  "access.api.revokeConfirmDescription": "The API Token \"{{name}}\" will stop working immediately. This action cannot be undone.",
+  "access.api.revokeConfirmTitle": "Revoke API Token?",
+  "access.api.revokeFailed": "Failed to revoke API Token.",
+  "access.api.revokeSuccess": "API Token revoked",
+  "access.api.table.action": "Action",
+  "access.api.table.environment": "Environment",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Name",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Channel",
+  "access.channels.col.endpoint": "Entry point",
+  "access.channels.col.status": "Status",
+  "access.channels.description": "WebApp and CLI entry points use the access permissions above.",
+  "access.channels.disabled": "Access channels are turned off for this deployment.",
+  "access.channels.disabledHint": "Enable access channels to expose WebApp and CLI entry points.",
+  "access.channels.followPermission": "Follows permissions",
+  "access.channels.title": "Access channels",
+  "access.cli.description": "Invoke from the terminal with difyctl, suitable for scripts, automated workflows, or Agent integrations.",
+  "access.cli.docs": "Usage guide",
+  "access.cli.domain": "Domain",
+  "access.cli.empty": "CLI endpoint not configured.",
+  "access.cli.install": "Install CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Copied",
+  "access.copy": "Copy",
+  "access.copyFailed": "Copy failed",
+  "access.copyToast": "Copied to clipboard",
+  "access.hide": "Hide",
+  "access.members.clearAll": "Clear all",
+  "access.members.empty": "No matches found.",
+  "access.members.groupCount_one": "{{count}} group",
+  "access.members.groupCount_other": "{{count}} groups",
+  "access.members.groups": "Groups",
+  "access.members.individuals": "Members",
+  "access.members.memberCount_one": "{{count}} member",
+  "access.members.memberCount_other": "{{count}} members",
+  "access.members.pickPlaceholder": "Select groups or members",
+  "access.members.searchPlaceholder": "Search groups and members",
+  "access.members.selectedLabel": "Selected",
+  "access.permission.anyone": "Anyone with the link",
+  "access.permission.anyoneDesc": "Anyone can access this deployment without logging in.",
+  "access.permission.memberCount_one": "{{count}} member",
+  "access.permission.memberCount_other": "{{count}} members",
+  "access.permission.organization": "All members within the platform",
+  "access.permission.organizationDesc": "All members within the platform",
+  "access.permission.specific": "Specific members within the platform",
+  "access.permission.specificDesc": "Select specific groups or members",
+  "access.permission.specificUnavailable": "Specific member selection is disabled until real platform members and groups are connected.",
+  "access.permission.updateFailed": "Failed to update access policy.",
+  "access.permissions.col.environment": "Environment",
+  "access.permissions.col.permission": "Access",
+  "access.permissions.description": "Set access permissions for WebApp and CLI entry points in each environment.",
+  "access.permissions.editAriaLabel": "Configure access for {{environment}}",
+  "access.permissions.editDescription": "Set access permissions for WebApp and CLI entry points.",
+  "access.permissions.editTitle": "Access permissions",
+  "access.permissions.title": "Access permissions",
+  "access.revoke": "Revoke",
+  "access.runAccess.description": "Manage how users can run this deployment and who is allowed to access it per environment.",
+  "access.runAccess.disabled": "Run access is turned off for this deployment.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Expose this deployment as a Model Context Protocol server.",
+  "access.runAccess.mcpEmpty": "MCP endpoint not configured.",
+  "access.runAccess.noEnvs": "Deploy to an environment to configure access permissions.",
+  "access.runAccess.noEnvsTitle": "No deployed environments",
+  "access.runAccess.openWebapp": "Open WebApp",
+  "access.runAccess.permissions": "Access permissions",
+  "access.runAccess.permissionsDesc": "Who can access this deployment in each environment.",
+  "access.runAccess.title": "Run access",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Hosted web page for end users.",
+  "access.runAccess.webappEmpty": "Coming soon.",
+  "access.show": "Show",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "External",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Unknown",
+  "card.access.api": "API Tokens",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "No access",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Create First Release",
+  "card.deploy": "Deploy",
+  "card.deploying": "{{count}} deploying",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} failed",
+  "card.fromApp": "From {{name}}",
+  "card.lastDeployed": "Last deployed {{time}}",
+  "card.menu.delete": "Delete deployment",
+  "card.menu.deleteDisabled": "Deployment deletion is not available for backend-managed deployments yet.",
+  "card.menu.deploy": "Deploy to Environment",
+  "card.menu.editInfo": "Edit Info",
+  "card.menu.viewDetail": "View deployment detail",
+  "card.moreActions": "More actions",
+  "card.neverDeployed": "Not deployed yet",
+  "card.noDescription": "No description provided.",
+  "card.notDeployed": "Not deployed",
+  "card.ready": "{{count}} running",
+  "card.tooltip.createdAt": "Created",
+  "card.tooltip.deployed": "Deployed",
+  "card.tooltip.deploymentStatus": "Deployment",
+  "card.tooltip.notDeployed": "This deployment has not been deployed to any environment yet.",
+  "card.tooltip.notDeployedShort": "Not deployed",
+  "card.tooltip.release": "Release",
+  "card.tooltip.releaseName": "Release Name",
+  "card.tooltip.source": "Source",
+  "common.loadFailed": "Failed to load. Try again later.",
+  "common.loading": "Loading...",
+  "createGuide.actions.back": "Back",
+  "createGuide.actions.cancel": "Cancel",
+  "createGuide.actions.continue": "Continue",
+  "createGuide.actions.createAndDeploy": "Create & Deploy",
+  "createGuide.actions.creating": "Creating...",
+  "createGuide.actions.deploy": "Deploy",
+  "createGuide.actions.deploying": "Creating & deploying...",
+  "createGuide.actions.next": "Next",
+  "createGuide.actions.skipDeploy": "Skip, deploy later",
+  "createGuide.description": "Create a deployment from a release source, basic info, and target environment.",
+  "createGuide.dsl.defaultAppName": "Imported DSL app",
+  "createGuide.dsl.description": "Upload a Workflow DSL package to create the deployment, first release, and optional environment deployment.",
+  "createGuide.dsl.dropDescription": "Upload a Workflow YAML DSL package. Deployment options are resolved from this file before deploy.",
+  "createGuide.dsl.dropTitle": "Upload Workflow DSL package",
+  "createGuide.dsl.readFailed": "Failed to read the DSL file. Choose another file and try again.",
+  "createGuide.dsl.reading": "Reading DSL file...",
+  "createGuide.dsl.title": "Import DSL",
+  "createGuide.dsl.unsupportedMode": "Only Workflow DSL files can be used for deployments.",
+  "createGuide.errors.createReleaseFailed": "Failed to create the deployment or release.",
+  "createGuide.errors.deployFailed": "Failed to deploy to the environment.",
+  "createGuide.method.description": "Choose the source used to create the first release.",
+  "createGuide.methods.bindApp.description": "Use an existing Workflow App in Studio as the release source.",
+  "createGuide.methods.bindApp.title": "Bind existing Workflow App",
+  "createGuide.methods.importDsl.description": "Upload a Workflow YAML DSL package and continue through the deployment UI.",
+  "createGuide.methods.importDsl.title": "Import DSL",
+  "createGuide.methods.mocked": "Mocked",
+  "createGuide.nav.back": "Deployments",
+  "createGuide.release.defaultName": "initial release",
+  "createGuide.release.deployInfo": "Deployment Info",
+  "createGuide.release.description": "Fill in deployment info and first release details.",
+  "createGuide.release.firstVersion": "First Release",
+  "createGuide.release.instanceDescription": "Deployment Description",
+  "createGuide.release.instanceDescriptionPlaceholder": "Describe what this deployment is used for",
+  "createGuide.release.instanceName": "Deployment Name",
+  "createGuide.release.instanceNameConflict": "A deployment with this name already exists. Choose another name.",
+  "createGuide.release.releaseDescription": "Release Description",
+  "createGuide.release.releaseDescriptionPlaceholder": "Describe this release",
+  "createGuide.release.releaseName": "Release Name",
+  "createGuide.release.releaseNote": "Release Description",
+  "createGuide.release.title": "Basic Info",
+  "createGuide.source.availableApps_one": "{{count}} app",
+  "createGuide.source.availableApps_other": "{{count}} apps",
+  "createGuide.source.clearSearch": "Clear app search",
+  "createGuide.source.description": "Choose the source used to create the first release.",
+  "createGuide.source.empty": "No Workflow Apps found.",
+  "createGuide.source.searchPlaceholder": "Search apps",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "Release Source",
+  "createGuide.steps.method": "Release Source",
+  "createGuide.steps.release": "Basic Info",
+  "createGuide.steps.source": "Release Source",
+  "createGuide.steps.target": "Deploy to Environment",
+  "createGuide.target.bindingCount_one": "{{count}} binding",
+  "createGuide.target.bindingCount_other": "{{count}} bindings",
+  "createGuide.target.bindingHint": "Pick the credentials used by this release.",
+  "createGuide.target.bindings": "Credentials",
+  "createGuide.target.deferredBindingHint": "Credentials will be resolved from the real deployment plan during the final deploy action.",
+  "createGuide.target.deferredEnvironmentHint": "The name is matched against the real environments after the deployment and release are created.",
+  "createGuide.target.description": "Choose a target environment and provide the runtime settings this release needs there. This step can be skipped.",
+  "createGuide.target.envVarCount_one": "{{count}} variable",
+  "createGuide.target.envVarCount_other": "{{count}} variables",
+  "createGuide.target.envVarHint": "For each environment variable this release needs, enter a custom value or use the value defined in the app.",
+  "createGuide.target.envVarPlaceholder": "Enter value",
+  "createGuide.target.envVarSource.ariaLabel": "Select the variable value source for {{key}}",
+  "createGuide.target.envVarSource.default": "App value",
+  "createGuide.target.envVarSource.lastDeployment": "Last deployed value",
+  "createGuide.target.envVarSource.literal": "Custom value",
+  "createGuide.target.envVarType.number": "Number",
+  "createGuide.target.envVarType.secret": "Secret",
+  "createGuide.target.envVarType.string": "String",
+  "createGuide.target.envVars": "Environment Variables",
+  "createGuide.target.environment": "Target Environment",
+  "createGuide.target.environmentName": "Environment Name",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "Failed to load credentials.",
+  "createGuide.target.loadEnvironmentsFailed": "Failed to load deploy environments.",
+  "createGuide.target.missingRequiredBinding": "Select a credential for this required binding.",
+  "createGuide.target.noBindingRequired": "No credentials required.",
+  "createGuide.target.noCredentialCandidates": "No available credentials.",
+  "createGuide.target.noEnvironmentOptions": "No deploy environments available.",
+  "createGuide.target.required": "Required",
+  "createGuide.target.selectCredential": "Select a credential",
+  "createGuide.target.title": "Deploy to Environment",
+  "createGuide.title": "New Deployment",
+  "createModal.appPickerPlaceholder": "Select a Workflow App",
+  "createModal.appSearchEmpty": "No matching Workflow Apps",
+  "createModal.appSearchPlaceholder": "Search Workflow Apps…",
+  "createModal.cancel": "Cancel",
+  "createModal.create": "Create",
+  "createModal.createFailed": "Failed to create deployment.",
+  "createModal.description": "Pick a Workflow App and create a deployment.",
+  "createModal.descriptionLabel": "Description",
+  "createModal.descriptionPlaceholder": "Describe what this deployment is used for",
+  "createModal.loadMoreApps": "Load more apps",
+  "createModal.loadingApps": "Loading apps…",
+  "createModal.nameLabel": "Deployment Name",
+  "createModal.namePlaceholder": "Deployment Name",
+  "createModal.noApps": "No Workflow Apps found in this workspace. Create one in Studio first.",
+  "createModal.selected": "Selected",
+  "createModal.sourceApp": "Workflow App (required)",
+  "createModal.title": "New Deployment",
+  "deployDrawer.bindingCount_one": "{{count}} binding",
+  "deployDrawer.bindingCount_other": "{{count}} bindings",
+  "deployDrawer.bindingOptionsFailed": "Failed to load credential options.",
+  "deployDrawer.bindingSelectionHint": "Choose the credentials used by this deployment.",
+  "deployDrawer.bindingsDisabled": "Resolved from the release preview. Editing is not available yet.",
+  "deployDrawer.cancel": "Cancel",
+  "deployDrawer.close": "Close deployment drawer",
+  "deployDrawer.defaultSelect": "Select...",
+  "deployDrawer.deploy": "Deploy to Environment",
+  "deployDrawer.deployExistingRelease": "Deploy to Environment",
+  "deployDrawer.deployExistingReleaseDescription": "Select a release and target environment to deploy.",
+  "deployDrawer.deployExistingReleaseTitle": "Deploy to Environment",
+  "deployDrawer.deployFailed": "Failed to start deployment.",
+  "deployDrawer.deploying": "Deploying...",
+  "deployDrawer.description": "Select a release and target environment to deploy.",
+  "deployDrawer.envVarCount_one": "{{count}} variable",
+  "deployDrawer.envVarCount_other": "{{count}} variables",
+  "deployDrawer.envVarHint": "For each environment variable this release needs, enter a custom value or use the value defined in the app.",
+  "deployDrawer.envVarPlaceholder": "Enter value",
+  "deployDrawer.envVarSource.ariaLabel": "Select the variable value source for {{key}}",
+  "deployDrawer.envVarSource.default": "App value",
+  "deployDrawer.envVarSource.lastDeployment": "Last deployed value",
+  "deployDrawer.envVarSource.literal": "Custom value",
+  "deployDrawer.envVarType.number": "Number",
+  "deployDrawer.envVarType.secret": "Secret",
+  "deployDrawer.envVarType.string": "String",
+  "deployDrawer.envVars": "Environment Variables",
+  "deployDrawer.existingReleaseHint": "This release will be deployed as-is. No new release will be created.",
+  "deployDrawer.loadingBindings": "Resolving...",
+  "deployDrawer.lockedHint": "Locked to current environment",
+  "deployDrawer.missingRequiredBinding": "Select a credential for this required binding.",
+  "deployDrawer.missingRequiredEnvVar": "Enter a value for this required environment variable.",
+  "deployDrawer.modelCreds": "Model Credentials",
+  "deployDrawer.needsValidation": " (needs validation)",
+  "deployDrawer.newReleaseHint": "A new release will be created from the selected Workflow App YAML.",
+  "deployDrawer.noBindingRequired": "Not required",
+  "deployDrawer.noCredentialCandidates": "No available credentials.",
+  "deployDrawer.noNewEnvironmentAvailable": "All available environments already have a deployment.",
+  "deployDrawer.noOtherReleaseAvailable": "No other releases are available for this environment.",
+  "deployDrawer.noReleaseAvailable": "Create a release before deploying to an environment.",
+  "deployDrawer.notFound": "Deployment not found.",
+  "deployDrawer.noteLabel": "Release Description (optional)",
+  "deployDrawer.notePlaceholder": "e.g. Ship onboarding copy tweak",
+  "deployDrawer.pluginCreds": "Plugin Credentials",
+  "deployDrawer.promote": "Deploy",
+  "deployDrawer.promoteDescription": "Select a release and target environment to deploy.",
+  "deployDrawer.promoteTitle": "Deploy to Environment",
+  "deployDrawer.readOnly": "Read-only",
+  "deployDrawer.redeploy": "Deploy to Environment",
+  "deployDrawer.redeployDescription": "Select a release and target environment to deploy.",
+  "deployDrawer.redeployExistingReleaseHint": "The current release will be redeployed as-is. No new release will be created.",
+  "deployDrawer.redeployTitle": "Deploy to Environment",
+  "deployDrawer.releaseLabel": "Release",
+  "deployDrawer.requiredBinding": "Required",
+  "deployDrawer.rollback": "Deploy",
+  "deployDrawer.rollbackDescription": "Select a release and target environment to deploy.",
+  "deployDrawer.rollbackTitle": "Deploy to Environment",
+  "deployDrawer.runtimeCredentials": "Credentials",
+  "deployDrawer.secretPlaceholder": "secret",
+  "deployDrawer.selectCredential": "Select a credential",
+  "deployDrawer.selectEnv": "Select an environment",
+  "deployDrawer.selectProviderCred": "Select {{provider}} credential",
+  "deployDrawer.selectProviderKey": "Select {{provider}} key",
+  "deployDrawer.selectRelease": "Select a release",
+  "deployDrawer.targetEnv": "Target Environment",
+  "deployDrawer.title": "Deploy to Environment",
+  "deployDrawer.valuePlaceholder": "value",
+  "deployTab.cancelDeployment": "Cancel deployment",
+  "deployTab.closeError": "Close",
+  "deployTab.col.actions": "Actions",
+  "deployTab.col.currentRelease": "Current Release",
+  "deployTab.col.environment": "Environment",
+  "deployTab.col.status": "Status",
+  "deployTab.col.updated": "Updated",
+  "deployTab.collapseDetails": "Collapse deployment details",
+  "deployTab.confirmUndeploy": "Undeploy",
+  "deployTab.deployOtherVersion": "Deploy Another Release",
+  "deployTab.deployToEnv": "Deploy to {{name}}",
+  "deployTab.deployToNewEnv": "Deploy to New Environment...",
+  "deployTab.empty": "No instances yet. Deploy to a new environment to get started.",
+  "deployTab.emptyDescription": "Choose a release and target environment to make this deployment available to users.",
+  "deployTab.emptyTitle": "No environments are running yet",
+  "deployTab.envCount": "Environments",
+  "deployTab.errorCode": "Code",
+  "deployTab.errorDialogDesc": "Review the last failed deployment before retrying or deploying another release.",
+  "deployTab.errorDialogTitle": "Deployment error in {{name}}",
+  "deployTab.errorMessage": "Message",
+  "deployTab.errorPhase": "Phase",
+  "deployTab.expandDetails": "Expand deployment details",
+  "deployTab.moreActions": "More actions",
+  "deployTab.newDeployment": "Deploy to New Environment",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "Deployment ID",
+  "deployTab.panel.endpoints": "Endpoints",
+  "deployTab.panel.envVars": "Environment Variables",
+  "deployTab.panel.error": "Error",
+  "deployTab.panel.failedRelease": "Failed Release",
+  "deployTab.panel.health": "Health",
+  "deployTab.panel.instanceInfo": "Instance Info",
+  "deployTab.panel.modelCreds": "Model Credentials",
+  "deployTab.panel.pluginCreds": "Plugin Credentials",
+  "deployTab.panel.release": "Release",
+  "deployTab.panel.releaseCreatedAt": "Release Created At",
+  "deployTab.panel.releaseInfo": "Release Info",
+  "deployTab.panel.replicas": "Replicas",
+  "deployTab.panel.run": "Run",
+  "deployTab.panel.runtimeBindings": "Credentials",
+  "deployTab.panel.runtimeInfo": "Runtime Info",
+  "deployTab.panel.runtimeMode": "Runtime Mode",
+  "deployTab.panel.runtimeNote": "Runtime Note",
+  "deployTab.panel.targetRelease": "Target Release",
+  "deployTab.panel.unknownError": "Deployment failed.",
+  "deployTab.promote": "Deploy",
+  "deployTab.redeploy": "Redeploy",
+  "deployTab.releaseCreatedAt": "Release created {{time}}",
+  "deployTab.retry": "Retry",
+  "deployTab.shortcut": "Shortcut",
+  "deployTab.status.deployFailed": "Deploy failed",
+  "deployTab.status.deployingRelease": "Deploying ({{release}})",
+  "deployTab.status.runningOutOfSync": "Running (sync pending)",
+  "deployTab.status.runningWithFailed": "Running (last deployment failed)",
+  "deployTab.undeploy": "Undeploy",
+  "deployTab.undeployConfirmDesc": "End-user access will stop immediately. The release can be redeployed later.",
+  "deployTab.undeployConfirmTitle": "Undeploy from {{name}}?",
+  "deployTab.undeployFrom": "Undeploy from {{name}}",
+  "deployTab.undeployImpactTitle": "Affected instance",
+  "deployTab.viewError": "View error",
+  "deployTab.viewLogs": "View logs",
+  "deployTab.viewProgress": "View progress",
+  "detail.backToInstances": "Back to deployments",
+  "detail.deployingCount": "{{count}} deploying",
+  "detail.envCount_one": "{{count}} env",
+  "detail.envCount_other": "{{count}} envs",
+  "detail.failedCount": "{{count}} failed",
+  "detail.mobileTabs": "Deployment sections",
+  "detail.notFound": "Deployment not found",
+  "detail.openSourceApp": "Open source {{name}}",
+  "detail.sourceApp": "Source",
+  "detail.sourceAppLink": "Source",
+  "documentTitle.create": "New deployment · Deployments",
+  "documentTitle.detail": "Deployment · Deployments",
+  "documentTitle.list": "Deployments",
+  "filter.allEnvs": "All environments",
+  "filter.notDeployed": "Not deployed",
+  "filter.searchPlaceholder": "Search deployments",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Admission",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Bootstrapping",
+  "health.ENVIRONMENT_STATUS_DELETING": "Deleting",
+  "health.ENVIRONMENT_STATUS_FAILED": "Unavailable",
+  "health.ENVIRONMENT_STATUS_READY": "Available",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Unknown",
+  "list.clearFilters": "Clear filters",
+  "list.clearSearch": "Clear deployment search",
+  "list.createDeployment": "New",
+  "list.empty": "No deployments found.",
+  "list.emptyDescription": "Create a deployment from a Workflow App or Workflow DSL package to manage releases, environments, and access.",
+  "list.emptyFilteredDescription": "No deployment matches the current search or environment filter.",
+  "list.emptyFilteredTitle": "No matching deployments",
+  "list.emptyTitle": "No deployments yet",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Isolated",
+  "mode.ENVIRONMENT_MODE_SHARED": "Shared",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Unknown",
+  "newInstance.comingSoon": "Coming soon",
+  "newInstance.fromStudio": "Select from Studio",
+  "newInstance.importDSL": "Import DSL",
+  "newInstance.title": "New Deployment",
+  "overview.accessEndpoints": "Access endpoints",
+  "overview.accessMeta.apiTokens": "Manage API Tokens",
+  "overview.accessMeta.cli": "View CLI access",
+  "overview.accessMeta.webApp": "Manage WebApp access",
+  "overview.accessStatus": "Access",
+  "overview.api": "API Tokens",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Tokens",
+  "overview.apiTokenSummary.environments_one": "{{count}} deployed environment",
+  "overview.apiTokenSummary.environments_other": "{{count}} deployed environments",
+  "overview.availableForDeployment": "Available for deployment",
+  "overview.basicInfo": "Basic info",
+  "overview.cardAction.deployLatest": "Deploy Latest Release",
+  "overview.cardAction.redeploy": "Redeploy",
+  "overview.cardAction.viewProgress": "View deployment",
+  "overview.chip.behindTooltip_one": "1 release behind latest. Deploy the latest release to update.",
+  "overview.chip.behindTooltip_other": "{{count}} releases behind latest. Deploy the latest release to update.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "deploying",
+  "overview.chip.deployingTooltip": "Deployment is in progress.",
+  "overview.chip.empty": "empty",
+  "overview.chip.emptyTooltip": "No release is deployed to this environment.",
+  "overview.chip.failed": "failed",
+  "overview.chip.failedTooltip": "The latest deployment attempt failed.",
+  "overview.chip.latest": "latest",
+  "overview.chip.latestTooltip": "This environment is running the latest release.",
+  "overview.chip.needsReleaseFirst": "Create a Release first",
+  "overview.chip.olderRelease": "older",
+  "overview.chip.olderReleaseTooltip": "This environment is running an older release.",
+  "overview.chip.openInDeployTab": "View deployment progress",
+  "overview.cli": "CLI",
+  "overview.configured": "Configured",
+  "overview.createRelease": "Create Release",
+  "overview.created": "Created",
+  "overview.deploy": "Deploy",
+  "overview.deployedEnvironments": "deployed",
+  "overview.deploymentOverview": "Deployment overview",
+  "overview.deploymentStatus": "Deployment status",
+  "overview.description": "Description",
+  "overview.developerApi": "Developer API",
+  "overview.disabled": "Disabled",
+  "overview.emptyValue": "Not set",
+  "overview.enabled": "Enabled",
+  "overview.enabledChannels": "access enabled",
+  "overview.endUserAccess": "End-user access",
+  "overview.environments": "Environments",
+  "overview.hero.byName": "by {{name}}",
+  "overview.hero.empty": "No releases yet",
+  "overview.hero.emptyDescription": "Create a release from the current source before deploying.",
+  "overview.hero.propagation_one": "deployed to {{count}}/{{total}} environment",
+  "overview.hero.propagation_other": "deployed to {{count}}/{{total}} environments",
+  "overview.hero.untargeted": "no environments configured yet",
+  "overview.instanceDetails": "Deployment details",
+  "overview.instanceId": "Deployment ID",
+  "overview.latestRelease.releaseCount_one": "{{count}} release",
+  "overview.latestRelease.releaseCount_other": "{{count}} releases",
+  "overview.latestReleaseTitle": "Latest Release",
+  "overview.manageDeployments": "Manage deployments",
+  "overview.name": "Name",
+  "overview.noAccessConfig": "No access configuration.",
+  "overview.noReleaseYet": "Create a release before deploying to an environment.",
+  "overview.notConfigured": "Not configured",
+  "overview.previousReleases.empty": "No earlier releases yet.",
+  "overview.previousReleases.retired": "Not currently deployed",
+  "overview.previousReleases.title": "Previous releases",
+  "overview.previousReleases.viewAll": "View All",
+  "overview.ready": "Deployable",
+  "overview.recentReleases": "Recent releases",
+  "overview.releaseDeployedTitle": "{{release}} is deployed",
+  "overview.releaseReadyTitle": "{{release}} is ready to deploy",
+  "overview.serviceMap": "Service map",
+  "overview.servingRelease": "Serving {{release}}",
+  "overview.servingReleaseDescription": "This deployment is deployed to {{count}}/{{total}} environments.",
+  "overview.strip.deployToNewEnvironment": "Deploy to new environment",
+  "overview.strip.empty": "No environments configured.",
+  "overview.strip.emptyDeployableDescription": "Deploy the latest release to an environment when you're ready.",
+  "overview.strip.emptyDeployed": "No instances yet.",
+  "overview.strip.emptyDescription": "Create a release before deploying to an environment.",
+  "overview.strip.emptyTitle": "No instances yet",
+  "overview.strip.summary_one": "1 of {{total}} on latest release",
+  "overview.strip.summary_other": "{{count}} of {{total}} on latest release",
+  "overview.strip.title": "Instances",
+  "overview.switchSourceApp": "Switch source",
+  "overview.switchSourceAppDescription": "Choose the Workflow App used as the source for future releases.",
+  "overview.switchSourceAppHint": "After switching, only newly created releases use the new source. Historical releases and existing deployments are not changed.",
+  "overview.targetRelease": "Target Release",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Danger zone",
+  "settings.dangerDesc": "Permanently delete this deployment and stop any running instances. This can't be undone.",
+  "settings.delete": "Delete Deployment",
+  "settings.deleteConfirmDesc": "Delete {{name}}? Every instance will stop running and be removed across all environments. This can't be undone.",
+  "settings.deleteConfirmTitle": "Delete deployment",
+  "settings.deleteFailed": "Failed to delete deployment.",
+  "settings.deleteImpact": "Impact",
+  "settings.deleteImpactInstance": "Deployment",
+  "settings.deleteImpactTitle": "Affected deployment",
+  "settings.deleteImpactValue": "The deployment is removed from the deployment list.",
+  "settings.deleted": "Deployment deleted",
+  "settings.description": "Description",
+  "settings.descriptionHelp": "Manage this deployment's name, description, and other settings.",
+  "settings.general": "General",
+  "settings.name": "Deployment name",
+  "settings.reset": "Reset",
+  "settings.save": "Save Changes",
+  "settings.updateFailed": "Failed to update deployment.",
+  "settings.updated": "Deployment updated",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Deploying",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sync pending",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Deploy failed",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Invalid",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Running",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Not deployed",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Undeploying",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unknown",
+  "subtitle": "Manage deployments across environments.",
+  "tabs.access.description": "Manage access channels and access permissions.",
+  "tabs.access.name": "Access",
+  "tabs.api-tokens.description": "Manage API Tokens and invoke instances over HTTP.",
+  "tabs.api-tokens.name": "API Tokens",
+  "tabs.instances.description": "View and manage instances in deployed environments.",
+  "tabs.instances.name": "Instances",
+  "tabs.overview.description": "See the deployment's status across environments.",
+  "tabs.overview.name": "Overview",
+  "tabs.releases.description": "Create, deploy, and manage releases.",
+  "tabs.releases.name": "Releases",
+  "tabs.settings.description": "Manage this deployment's name, description, and other settings.",
+  "tabs.settings.name": "Settings",
+  "title": "Deployments",
+  "unsupportedDslNodes.description": "This release contains nodes that the deployment runtime does not support yet. Remove or replace them in Studio, then try again.",
+  "unsupportedDslNodes.descriptionWithTypes": "This release contains nodes that the deployment runtime does not support yet: {{nodeTypes}}. Remove or replace them in Studio, then try again.",
+  "unsupportedDslNodes.title": "Unsupported nodes",
+  "unsupportedDslNodes.unknownType": "Unknown type",
+  "versions.cancelCreate": "Cancel",
+  "versions.cancelDelete": "Cancel",
+  "versions.cancelEdit": "Cancel",
+  "versions.checkingReleaseContent": "Checking release content...",
+  "versions.col.action": "Action",
+  "versions.col.author": "Created by",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Created at",
+  "versions.col.deployedTo": "Deployed to",
+  "versions.col.release": "Release",
+  "versions.col.sourceApp": "Source",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Create",
+  "versions.createFailed": "Failed to create release.",
+  "versions.createRelease": "Create Release",
+  "versions.createReleaseDescription": "Create a deployable release from a Workflow App or Workflow DSL file.",
+  "versions.createReleaseHint": "New releases can be deployed to any environment.",
+  "versions.createSuccess": "Release \"{{name}}\" created.",
+  "versions.creating": "Creating...",
+  "versions.currentOn": "Current Release on {{name}}",
+  "versions.deleteConfirmDesc": "Release \"{{name}}\" will be permanently deleted. This can't be undone.",
+  "versions.deleteConfirmTitle": "Delete release?",
+  "versions.deleteFailed": "Failed to delete release.",
+  "versions.deleteImpactDeployment": "Deployment status",
+  "versions.deleteImpactNotDeployed": "Not currently deployed",
+  "versions.deleteImpactRelease": "Release",
+  "versions.deleteImpactTitle": "Delete impact",
+  "versions.deleteRelease": "Delete Release",
+  "versions.deleteSuccess": "Release \"{{name}}\" deleted.",
+  "versions.deploy": "Deploy",
+  "versions.deployTo": "Deploy to {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Deploying",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sync pending",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Failed",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Invalid",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Running",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Not deployed",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Undeploying",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unknown",
+  "versions.deployingTo": "{{name}} is deploying",
+  "versions.disabledReason.checkDeploymentsFailed": "Could not verify deployment usage. Try again later.",
+  "versions.disabledReason.checkingDeployments": "Checking deployment usage",
+  "versions.disabledReason.current": "This release is already running on {{name}}",
+  "versions.disabledReason.deploying": "Wait for the active deployment to finish",
+  "versions.disabledReason.envDisabled": "This environment isn't deployable",
+  "versions.disabledReason.releaseInUse_one": "Undeploy this release from {{count}} environment before deleting it",
+  "versions.disabledReason.releaseInUse_other": "Undeploy this release from {{count}} environments before deleting it",
+  "versions.dslReadFailed": "Failed to read the DSL file. Choose another file and try again.",
+  "versions.dslReading": "Reading DSL file...",
+  "versions.dslUnsupportedMode": "Only Workflow DSL files can be used for deployments.",
+  "versions.editFailed": "Failed to update release.",
+  "versions.editRelease": "Edit Release",
+  "versions.editReleaseDescription": "Update this release's name and description.",
+  "versions.editSuccess": "Release \"{{name}}\" updated.",
+  "versions.empty": "No releases available yet.",
+  "versions.emptyDescription": "Create the first release before deploying to an environment.",
+  "versions.emptyTitle": "No releases yet",
+  "versions.emptyWithCreate": "No releases yet. Create the first deployable release before deploying.",
+  "versions.exportDsl": "Export DSL",
+  "versions.exportDslFailed": "Failed to export DSL.",
+  "versions.exportingDsl": "Exporting...",
+  "versions.groupHeader.deploy": "Deploy",
+  "versions.groupHeader.promote": "Deploy",
+  "versions.groupHeader.rollback": "Deploy previous version",
+  "versions.groupHeader.unavailable": "Unavailable",
+  "versions.manualDslOption": "Upload DSL",
+  "versions.moreActions": "More actions",
+  "versions.optional": "Optional",
+  "versions.promote": "Deploy",
+  "versions.promoteTo": "Deploy to {{name}}",
+  "versions.releaseAlreadyExists": "A release with the same content already exists: {{name}}.",
+  "versions.releaseContentCheckFailed": "Failed to check release content.",
+  "versions.releaseDescriptionLabel": "Description",
+  "versions.releaseDescriptionPlaceholder": "Describe this release",
+  "versions.releaseHistory": "Release history",
+  "versions.releaseNameLabel": "Release Name",
+  "versions.releaseNamePlaceholder": "Release Name",
+  "versions.releaseNameRequired": "Enter a release name.",
+  "versions.releaseSourceLabel": "Release Source",
+  "versions.rollbackTo": "Deploy to {{name}}",
+  "versions.saveEdit": "Save",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/en-US/permission-keys.json b/web/i18n/en-US/permission-keys.json
new file mode 100644
index 00000000000..8bd6ac7fd15
--- /dev/null
+++ b/web/i18n/en-US/permission-keys.json
@@ -0,0 +1,50 @@
+{
+  "api_extension.manage": "Manage API extension configuration",
+  "app.access_config": "Configure app access permissions",
+  "app.acl.access_config": "Configure app access permissions",
+  "app.acl.delete": "Delete app",
+  "app.acl.edit": "Edit and orchestrate app",
+  "app.acl.import_export_dsl": "Import / export DSL",
+  "app.acl.monitor": "Monitoring and operations",
+  "app.acl.preview": "Preview app",
+  "app.acl.release_and_version": "App publishing and version management",
+  "app.acl.test_and_run": "Test and use app",
+  "app.acl.view_layout": "Read-only orchestration page",
+  "app.create_and_management": "Create apps and manage apps you created",
+  "app.tag.manage": "Manage app tags",
+  "app_library.access": "Access App Library",
+  "billing.manage": "Change subscription plans",
+  "billing.subscription.manage": "Manage billing and subscriptions in the billing portal",
+  "billing.view": "Access Billing settings",
+  "credential.manage": "Manage credentials",
+  "credential.use": "Use credentials",
+  "customization.manage": "Manage customization",
+  "data_source.manage": "Manage data source configuration",
+  "dataset.access_config": "Configure knowledge base access permissions",
+  "dataset.acl.access_config": "Configure knowledge base access permissions",
+  "dataset.acl.delete": "Delete knowledge base",
+  "dataset.acl.delete_file": "Delete knowledge base files",
+  "dataset.acl.document_download": "Download documents",
+  "dataset.acl.edit": "Edit knowledge base",
+  "dataset.acl.import_export_dsl": "Import / export knowledge pipeline DSL",
+  "dataset.acl.pipeline_release": "Knowledge pipeline publishing and version management",
+  "dataset.acl.pipeline_test": "Pipeline testing",
+  "dataset.acl.preview": "Preview knowledge base",
+  "dataset.acl.readonly": "Read-only knowledge base",
+  "dataset.acl.retrieval_recall": "Knowledge base retrieval",
+  "dataset.acl.use": "Add documents to knowledge base",
+  "dataset.api_key.manage": "Manage knowledge base API keys",
+  "dataset.create_and_management": "Create knowledge bases and manage knowledge bases you created",
+  "dataset.external.connect": "Connect external knowledge bases",
+  "dataset.tag.manage": "Manage knowledge base tags",
+  "mcp.manage": "Manage MCP",
+  "plugin.debug": "Debug plugins",
+  "plugin.install": "Install and update plugins",
+  "plugin.manage": "Manage plugins",
+  "plugin.plugin_preferences": "Manage plugin preferences",
+  "snippets.create_and_modify": "Create and modify snippets",
+  "snippets.management": "Manage snippets",
+  "tool.manage": "Manage tools",
+  "workspace.member.manage": "Manage members",
+  "workspace.role.manage": "Manage role permissions and resource access rules"
+}
diff --git a/web/i18n/en-US/permission.json b/web/i18n/en-US/permission.json
new file mode 100644
index 00000000000..fed93cc71b9
--- /dev/null
+++ b/web/i18n/en-US/permission.json
@@ -0,0 +1,104 @@
+{
+  "accessRule.actions": "Actions",
+  "accessRule.addMemberAria": "Add {{name}}",
+  "accessRule.addMembersTitle": "Add members",
+  "accessRule.allPermittedMembers": "All members with role permissions",
+  "accessRule.allPermittedMembersDescription": "Members with matching role permissions can access this resource.",
+  "accessRule.appDescription": "Control who this app is open to. Members still need role permissions to view or operate it.",
+  "accessRule.appTitle": "App Access Rules",
+  "accessRule.changeOpenScopeDescription": "Changing the open scope will reset all individual permission settings for this resource. You'll need to add member-specific permissions again after switching.",
+  "accessRule.changeOpenScopeTitle": "Change resource open scope?",
+  "accessRule.collapseSection": "Collapse {{title}}",
+  "accessRule.copied": "Access rule copied successfully",
+  "accessRule.created": "Access rule created successfully",
+  "accessRule.datasetDescription": "Control who this knowledge base is open to. Members still need role permissions to view or operate it.",
+  "accessRule.datasetTitle": "Knowledge Base Access Rules",
+  "accessRule.defaultPermission": "By role permissions",
+  "accessRule.deleteDescription": "This access rule will be permanently deleted and removed from the resource authorization list.",
+  "accessRule.deleteTitle": "Delete \"{{name}}\"?",
+  "accessRule.deleted": "Access rule deleted successfully",
+  "accessRule.exceptionPermissionFor": "Exception permission for {{name}}",
+  "accessRule.expandSection": "Expand {{title}}",
+  "accessRule.individualPermissionSettings": "Individual permission settings",
+  "accessRule.individualPermissionSettingsTip": "Set permission exceptions for specific collaborators or groups. These settings override the default access level.",
+  "accessRule.lockedSummary_one": "· {{count}} locked",
+  "accessRule.lockedSummary_other": "· {{count}} locked",
+  "accessRule.maintainer": "Maintainer",
+  "accessRule.member": "Member",
+  "accessRule.newPermissionSet": "New permission set",
+  "accessRule.noAvailableMembers": "No members available to add",
+  "accessRule.noDescription": "No description",
+  "accessRule.noRoles": "No roles",
+  "accessRule.noRules": "No access rules",
+  "accessRule.noUserAccessSettings": "No individual permission settings",
+  "accessRule.permission": "Permission",
+  "accessRule.resourceOpenScope": "Resource open scope",
+  "accessRule.resourceOpenScopeDescription": "Choose who this resource is open to. Role permissions still decide what each member can do.",
+  "accessRule.specificMembersOnly": "Specific members only",
+  "accessRule.specificMembersOnlyDescription": "Only selected members can access this resource.",
+  "accessRule.summary_one": "{{count}} permission set",
+  "accessRule.summary_other": "{{count}} permission sets",
+  "accessRule.updated": "Access rule updated successfully",
+  "common.duplicateAction": "Duplicate",
+  "group.app": "Applications",
+  "group.app_acl": "App access permissions",
+  "group.billing": "Billing",
+  "group.credential": "Credentials",
+  "group.dataset": "Knowledge bases",
+  "group.dataset_acl": "Knowledge base access permissions",
+  "group.plugin": "Plugins",
+  "group.tool_mcp": "Tools and MCP",
+  "group.workspace": "Workspace",
+  "permissionList.clearAll": "Clear all",
+  "permissionList.collapseGroup": "Collapse group",
+  "permissionList.expandGroup": "Expand group",
+  "permissionList.noPermissionsFound": "No permissions found",
+  "permissionList.selectAll": "Select all",
+  "permissionSet.descriptionLabel": "Description",
+  "permissionSet.descriptionPlaceholder": "Describe what this permission set grants",
+  "permissionSet.learnMore": "Learn more about permissions",
+  "permissionSet.modal.create.app.description": "Create an app permission set that can be referenced in access rules for quick authorization.",
+  "permissionSet.modal.create.app.title": "Create App permission set",
+  "permissionSet.modal.create.dataset.description": "Create a knowledge base permission set that can be referenced in access rules for quick authorization.",
+  "permissionSet.modal.create.dataset.title": "Create Knowledge Base permission set",
+  "permissionSet.modal.edit.app.description": "Modify the name, description, and permissions granted for this permission set.",
+  "permissionSet.modal.edit.app.title": "Edit App permission set",
+  "permissionSet.modal.edit.dataset.description": "Modify the name, description, and permissions granted for this permission set.",
+  "permissionSet.modal.edit.dataset.title": "Edit Knowledge Base permission set",
+  "permissionSet.modal.view.app.description": "View the name, description, and permissions granted for this permission set.",
+  "permissionSet.modal.view.app.title": "View App permission set",
+  "permissionSet.modal.view.dataset.description": "View the name, description, and permissions granted for this permission set.",
+  "permissionSet.modal.view.dataset.title": "View Knowledge Base permission set",
+  "permissionSet.nameLabel": "Permission set name",
+  "permissionSet.namePlaceholder": "e.g. Can export DSL",
+  "permissionSet.permissions": "Permissions",
+  "role.addRole": "Create roles",
+  "role.copyMembersDescription_one": "\"{{name}}\" is assigned to {{count}} member. Do you want the new role copy to include the same member?",
+  "role.copyMembersDescription_other": "\"{{name}}\" is assigned to {{count}} members. Do you want the new role copy to include the same members?",
+  "role.copyMembersLoading": "Loading member assignments...",
+  "role.copyMembersTitle": "Copy member assignments?",
+  "role.created": "Role created successfully",
+  "role.deleteDescription": "This role will be permanently deleted and removed from any members or access rules that use it.",
+  "role.deleteTitle": "Delete \"{{name}}\"?",
+  "role.deleted": "Role deleted successfully",
+  "role.duplicated": "Role duplicated successfully",
+  "role.groups.builtin": "System Roles",
+  "role.groups.custom": "Custom Roles",
+  "role.loading": "Loading roles...",
+  "role.modal.create.description": "Create a role and assign permissions",
+  "role.modal.create.title": "Create Role",
+  "role.modal.descriptionLabel": "Description",
+  "role.modal.descriptionPlaceholder": "Describe what this role is responsible for",
+  "role.modal.edit.description": "Edit role details and permissions",
+  "role.modal.edit.title": "Edit Role",
+  "role.modal.nameLabel": "Role name",
+  "role.modal.namePlaceholder": "e.g. Marketing Lead",
+  "role.modal.view.description": "View role details and permissions",
+  "role.modal.view.title": "View Role",
+  "role.noDescription": "No description",
+  "role.noMatchingRoles": "No matching roles",
+  "role.searchPlaceholder": "Search roles...",
+  "role.updated": "Role updated successfully",
+  "role.workspaceRoles.description": "Create roles and define what each role can do in this workspace.",
+  "role.workspaceRoles.title": "Workspace Roles"
+}
diff --git a/web/i18n/en-US/plugin.json b/web/i18n/en-US/plugin.json
index 398452ec85f..7cdcd08236e 100644
--- a/web/i18n/en-US/plugin.json
+++ b/web/i18n/en-US/plugin.json
@@ -245,6 +245,7 @@
   "pluginInfoModal.title": "Integration info",
   "pluginPublishGuide": "Integration publishing guide",
   "privilege.admins": "Admins",
+  "privilege.configurePermissionsInSettings": "Go to Settings > Roles & Permissions to configure plugin permissions.",
   "privilege.everyone": "Everyone",
   "privilege.noDebugPermissionTooltip": "You don't have permission to debug integrations",
   "privilege.noInstallPermissionTooltip": "You don't have permission to install and manage integrations",
diff --git a/web/i18n/en-US/workflow.json b/web/i18n/en-US/workflow.json
index a983c24e7cc..ea7845f63a2 100644
--- a/web/i18n/en-US/workflow.json
+++ b/web/i18n/en-US/workflow.json
@@ -1,5 +1,6 @@
 {
   "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Answer",
   "blocks.assigner": "Variable Assigner",
   "blocks.code": "Code",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Variable Aggregator",
   "blocks.variable-assigner": "Variable Aggregator",
   "blocksAbout.agent": "Invoking large language models to answer questions or process natural language",
+  "blocksAbout.agent-v2": "Invoking large language models to answer questions or process natural language",
   "blocksAbout.answer": "Define the reply content of a chat conversation",
   "blocksAbout.assigner": "The variable assignment node is used for assigning values to writable variables(like conversation variables).",
   "blocksAbout.code": "Execute a piece of Python or NodeJS code to implement custom logic",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "Workflow ID",
   "globalVar.fieldsDescription.workflowRunId": "Workflow run ID",
   "globalVar.title": "System Variables",
+  "nodes.agent.advancedSetting": "Advanced Settings",
   "nodes.agent.checkList.strategyNotSelected": "Strategy not selected",
   "nodes.agent.clickToViewParameterSchema": "Click to view parameter schema",
   "nodes.agent.configureModel": "Configure Model",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Unsupported Model",
   "nodes.agent.modelSelectorTooltips.deprecated": "This model is deprecated",
   "nodes.agent.notAuthorized": "Not Authorized",
+  "nodes.agent.outputVars.confirm": "Confirm",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Enter a JSON array.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Enter true or false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "File defaults are not configurable here yet.",
+  "nodes.agent.outputVars.defaultValueLabel": "Default",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Enter a valid number.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Enter a JSON object.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Default value",
+  "nodes.agent.outputVars.delete": "Delete {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Description",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Add description",
+  "nodes.agent.outputVars.edit": "Edit {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Output variable editor",
   "nodes.agent.outputVars.files.title": "agent generated files",
   "nodes.agent.outputVars.files.transfer_method": "Transfer method.Value is  remote_url or local_file",
   "nodes.agent.outputVars.files.type": "Support type. Now only support image",
   "nodes.agent.outputVars.files.upload_file_id": "Upload file id",
   "nodes.agent.outputVars.files.url": "Image url",
   "nodes.agent.outputVars.json": "agent generated json",
+  "nodes.agent.outputVars.nameDuplicate": "Output name already exists",
+  "nodes.agent.outputVars.nameInvalid": "Use letters, numbers, and underscores. Start with a letter or underscore.",
+  "nodes.agent.outputVars.nameLabel": "Field name",
+  "nodes.agent.outputVars.namePlaceholder": "Field Name",
+  "nodes.agent.outputVars.newOutput": "New output",
+  "nodes.agent.outputVars.requiredLabel": "Required",
+  "nodes.agent.outputVars.showAdvancedOptions": "Show advanced options",
   "nodes.agent.outputVars.text": "agent generated content",
+  "nodes.agent.outputVars.typeLabel": "Output type",
   "nodes.agent.outputVars.usage": "Model Usage Information",
   "nodes.agent.parameterSchema": "Parameter Schema",
   "nodes.agent.pluginInstaller.install": "Install",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "This integration is installed from GitHub. Please go to Integrations to reinstall",
   "nodes.agent.pluginNotInstalled": "This integration is not installed",
   "nodes.agent.pluginNotInstalledDesc": "This integration is installed from GitHub. Please go to Integrations to reinstall",
+  "nodes.agent.roster.change": "Change",
+  "nodes.agent.roster.editInConsole": "Edit in Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "A one-off setup that lives only in this node",
+  "nodes.agent.roster.inlineSetup.name": "Inline setup",
+  "nodes.agent.roster.inlineSetup.title": "Agent setup",
+  "nodes.agent.roster.inlineSetup.type": "Only in this node",
+  "nodes.agent.roster.label": "Agent",
+  "nodes.agent.roster.makeCopy": "Make a copy",
+  "nodes.agent.roster.more": "More agent actions",
+  "nodes.agent.roster.openPanel": "Open {{name}} details",
+  "nodes.agent.roster.panelLabel": "{{name}} details",
   "nodes.agent.strategy.configureTip": "Please configure agentic strategy.",
   "nodes.agent.strategy.configureTipDesc": "After configuring the agentic strategy, this node will automatically load the remaining configurations. The strategy will affect the mechanism of multi-step tool reasoning. ",
   "nodes.agent.strategy.label": "Agentic Strategy",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "The installed integration version does not provide this strategy. Click to switch version.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} is not installed",
   "nodes.agent.strategyNotSet": "Agentic strategy Not Set",
+  "nodes.agent.task.insert": "Insert",
+  "nodes.agent.task.label": "Agent task",
+  "nodes.agent.task.mention": "Mention",
+  "nodes.agent.task.placeholder": "Describe what this agent should do...",
+  "nodes.agent.task.tooltip": "Define the task instructions this agent should follow in this workflow.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Not Authorized",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} is not installed",
   "nodes.agent.toolbox": "toolbox",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "By {{author}}",
   "tabs.question-understand": "Question Understand",
   "tabs.requestToCommunity": "Requests to the community",
-  "tabs.searchBlock": "Search node",
+  "tabs.searchBlock": "Search nodes, agent, human, Knowledge",
   "tabs.searchDataSource": "Search Data Source",
   "tabs.searchSnippets": "Search snippets...",
   "tabs.searchTool": "Search integration",
diff --git a/web/i18n/es-ES/agent-v-2.json b/web/i18n/es-ES/agent-v-2.json
new file mode 100644
index 00000000000..fb23b2a523e
--- /dev/null
+++ b/web/i18n/es-ES/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Esta acción aún no está disponible.",
+  "agentDetail.access.actions.monitoring": "Monitoreo",
+  "agentDetail.access.copyAccessUrl": "Copiar URL de acceso",
+  "agentDetail.access.copyFailed": "No se pudo copiar la referencia.",
+  "agentDetail.access.copyReference": "Copiar referencia de {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Copiar endpoint de la API de servicio",
+  "agentDetail.access.description": "Todas las superficies desde las que se puede acceder a este agente.",
+  "agentDetail.access.empty": "No hay puntos de acceso vinculados",
+  "agentDetail.access.emptyDescription": "Este agente del roster aún no tiene referencias de aplicación o flujo de trabajo.",
+  "agentDetail.access.entries.agentApp.description": "Aplicación de agente vinculada a este agente del roster.",
+  "agentDetail.access.entries.agentApp.name": "Aplicación de agente",
+  "agentDetail.access.entries.workflow.description": "Flujo de trabajo y referencia de nodo vinculados a este agente del roster.",
+  "agentDetail.access.entries.workflow.name": "Nodo de flujo de trabajo",
+  "agentDetail.access.entryCount_one": "{{count}} entrada",
+  "agentDetail.access.entryCount_other": "{{count}} entradas",
+  "agentDetail.access.groups.references.heading": "Referencias",
+  "agentDetail.access.groups.references.label": "Referencias vinculadas",
+  "agentDetail.access.learnMore": "Más información",
+  "agentDetail.access.moreActions": "Más acciones para {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Endpoint de la API de servicio",
+  "agentDetail.access.serviceApi.title": "API de servicio backend",
+  "agentDetail.access.status.disabled": "Deshabilitado",
+  "agentDetail.access.status.enabled": "Habilitado",
+  "agentDetail.access.status.inService": "En servicio",
+  "agentDetail.access.status.outOfService": "Fuera de servicio",
+  "agentDetail.access.title": "Punto de acceso",
+  "agentDetail.access.toggleSurface": "Alternar acceso de {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL de acceso",
+  "agentDetail.access.webApp.actions.customize": "Personalizar",
+  "agentDetail.access.webApp.actions.embedded": "Incrustado",
+  "agentDetail.access.webApp.actions.launch": "Iniciar",
+  "agentDetail.access.webApp.actions.settings": "Configuración",
+  "agentDetail.access.webApp.refreshUrl": "Actualizar URL de acceso",
+  "agentDetail.access.webApp.showQrCode": "Mostrar código QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO habilitado",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Usado como un nodo dentro del flujo de trabajo",
+  "agentDetail.access.workflow.empty": "Aún no hay referencias de flujo de trabajo.",
+  "agentDetail.access.workflow.loadFailed": "Error al cargar las referencias del flujo de trabajo.",
+  "agentDetail.access.workflow.loading": "Cargando referencias de flujo de trabajo…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} nodo",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} nodos",
+  "agentDetail.access.workflow.notAvailable": "N/D",
+  "agentDetail.access.workflow.openInStudio": "Abrir en Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Abrir {{name}} en Studio",
+  "agentDetail.access.workflow.table.actions": "Acciones",
+  "agentDetail.access.workflow.table.lastUpdated": "Última actualización",
+  "agentDetail.access.workflow.table.name": "Nombre",
+  "agentDetail.access.workflow.table.nodes": "Nodos",
+  "agentDetail.access.workflow.table.version": "Versión",
+  "agentDetail.access.workflow.title": "Acceso por flujo de trabajo",
+  "agentDetail.configure.advancedSettings.description": "Para usuarios avanzados. Variables de entorno, sandbox y memoria.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Agregar variable de entorno",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Eliminar {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Ocultar valor de {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Importar .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Para mostrar archivos .env ocultos, presiona Command + Shift + . en el selector de archivos.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Si tu archivo .env está oculto, habilita los archivos ocultos en el selector de archivos del sistema.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Para mostrar los archivos .env ocultos, habilita Elementos ocultos en el Explorador de archivos.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Mostrar valor de {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Seleccionar alcance de la variable de entorno",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Variables de entorno disponibles para este agente en tiempo de ejecución.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Alternar Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Configuración avanzada",
+  "agentDetail.configure.advancedSettings.toggle": "Alternar configuración avanzada",
+  "agentDetail.configure.chatFeatures.description": "Da forma a la experiencia de chat del usuario final en tu webapp y superficies de chat.",
+  "agentDetail.configure.chatFeatures.title": "Funciones de chat",
+  "agentDetail.configure.files.add": "Agregar archivo",
+  "agentDetail.configure.files.empty.description": "Sube documentos que el agente pueda leer, como especificaciones, plantillas o guías",
+  "agentDetail.configure.files.empty.title": "Aún no hay archivos",
+  "agentDetail.configure.files.label": "Archivos",
+  "agentDetail.configure.files.preview.empty": "Sin contenido de vista previa.",
+  "agentDetail.configure.files.preview.failed": "Error al cargar la vista previa.",
+  "agentDetail.configure.files.preview.unsupported": "Este archivo no admite vista previa.",
+  "agentDetail.configure.files.remove": "Eliminar {{name}}",
+  "agentDetail.configure.files.tip": "Archivos que este agente puede usar al orquestar tareas.",
+  "agentDetail.configure.files.toggle": "Alternar archivos",
+  "agentDetail.configure.files.treeLabel": "Archivos del agente",
+  "agentDetail.configure.files.upload.action": "Subir",
+  "agentDetail.configure.files.upload.browse": "examinar",
+  "agentDetail.configure.files.upload.description": "Sube un archivo para este agente.",
+  "agentDetail.configure.files.upload.dropzone": "Suelta un archivo aquí, o",
+  "agentDetail.configure.files.upload.failed": "Error al subir el archivo.",
+  "agentDetail.configure.files.upload.fileType": "ARCHIVO",
+  "agentDetail.configure.files.upload.invalidFile": "Sube un archivo.",
+  "agentDetail.configure.files.upload.success": "Archivo subido.",
+  "agentDetail.configure.files.upload.title": "Subir archivo",
+  "agentDetail.configure.knowledgeRetrieval.add": "Agregar recuperación de conocimiento",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Agregar conocimiento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Haz clic en el botón “+” para agregar conocimiento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Conocimiento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Configuración de recuperación",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Más información sobre la recuperación de conocimiento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automático",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Condiciones",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Deshabilitado",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Filtrado de metadatos",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manual",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Seleccionar modo de filtrado de metadatos",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Nombre de recuperación de conocimiento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "El agente decide",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "El agente redacta su propia consulta a partir del prompt y el contexto disponible. Nada que configurar aquí.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Consulta personalizada",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Escribe una consulta fija para esta fuente de recuperación.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Texto de consulta personalizado",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Escribe una consulta de búsqueda",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Consulta",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Recuperación de conocimiento · El agente decide",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Editar {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Conecta una base de conocimiento que el agente pueda buscar al responder",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Aún no hay conocimiento",
+  "agentDetail.configure.knowledgeRetrieval.label": "Recuperación de conocimiento",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Eliminar {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Fuentes de recuperación de conocimiento que este agente puede usar al orquestar tareas.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Alternar recuperación de conocimiento",
+  "agentDetail.configure.model.label": "Modelo",
+  "agentDetail.configure.orchestrate": "Orquestar",
+  "agentDetail.configure.preview.chatFeatures": "Funciones de chat",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agente",
+  "agentDetail.configure.preview.empty.description": "Envía un mensaje para probar el borrador actual.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Aún no hay instrucciones, así que las respuestas vendrán del modelo sin configurar.",
+  "agentDetail.configure.preview.endUserAuth": "Autenticación de usuario final",
+  "agentDetail.configure.preview.restart": "Reiniciar vista previa",
+  "agentDetail.configure.preview.title": "Vista previa",
+  "agentDetail.configure.prompt.copied": "Prompt copiado",
+  "agentDetail.configure.prompt.copy": "Copiar prompt",
+  "agentDetail.configure.prompt.copyFailed": "Error al copiar el prompt.",
+  "agentDetail.configure.prompt.insert.label": "Insertar",
+  "agentDetail.configure.prompt.insert.question": "Pregunta inicial",
+  "agentDetail.configure.prompt.insert.reportFile": "Archivo de informe de salida",
+  "agentDetail.configure.prompt.insert.tenders": "Lista inicial de licitaciones",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Mencionar",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Escribe las instrucciones aquí,",
+  "agentDetail.configure.prompt.tip": "Define cómo este agente debe interpretar las entradas, invocar herramientas y producir salidas.",
+  "agentDetail.configure.publishBar.draft": "Borrador",
+  "agentDetail.configure.publishBar.publishUpdate": "Publicar actualización",
+  "agentDetail.configure.publishBar.published": "Publicado",
+  "agentDetail.configure.publishBar.publishedAt": "Publicado {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Publicando…",
+  "agentDetail.configure.publishBar.saved": "Guardado hace 5 min",
+  "agentDetail.configure.publishBar.savedAt": "Guardado {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Cambios sin publicar",
+  "agentDetail.configure.publishBar.upToDate": "Actualizado",
+  "agentDetail.configure.publishBar.versionHistory": "Abrir historial de versiones",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Flujos de trabajo afectados",
+  "agentDetail.configure.publishImpact.cancel": "Cancelar",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Tu agente aparece en",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Los cambios los afectarán.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "este agente",
+  "agentDetail.configure.publishImpact.title": "{{action}} en {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} flujo de trabajo",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} flujos de trabajo",
+  "agentDetail.configure.skills.add": "Agregar habilidad",
+  "agentDetail.configure.skills.detail.contentRegion": "Contenido de los detalles de la habilidad",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} ARCHIVOS",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Archivos de la habilidad",
+  "agentDetail.configure.skills.detail.files": "Archivos",
+  "agentDetail.configure.skills.empty.description": "Las habilidades le dan al agente experiencia reutilizable que puede invocar mientras trabaja",
+  "agentDetail.configure.skills.empty.title": "Aún no hay habilidades",
+  "agentDetail.configure.skills.itemType": "Habilidad",
+  "agentDetail.configure.skills.label": "Habilidades",
+  "agentDetail.configure.skills.remove": "Eliminar {{name}}",
+  "agentDetail.configure.skills.tip": "Habilidades que este agente puede usar al orquestar tareas.",
+  "agentDetail.configure.skills.toggle": "Alternar habilidades",
+  "agentDetail.configure.skills.upload.action": "Subir",
+  "agentDetail.configure.skills.upload.browse": "examinar",
+  "agentDetail.configure.skills.upload.description": "Sube un paquete .zip o .skill para este agente.",
+  "agentDetail.configure.skills.upload.dropzone": "Suelta un paquete de habilidad aquí, o",
+  "agentDetail.configure.skills.upload.failed": "Error al subir la habilidad.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Sube un archivo .zip o .skill.",
+  "agentDetail.configure.skills.upload.success": "Habilidad subida.",
+  "agentDetail.configure.skills.upload.title": "Subir habilidad",
+  "agentDetail.configure.tools.add": "Agregar herramienta",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Para desarrolladores",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Instala un programa de línea de comandos que el agente ejecuta en su sandbox. Requiere instalación y normalmente claves API.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Herramienta CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Elige una herramienta ya disponible en este workspace, como búsqueda web o integraciones.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Herramienta",
+  "agentDetail.configure.tools.cliDialog.description": "Instala una herramienta CLI desde cualquier registro de paquetes. El agente obtiene acceso de shell al binario que proporciona.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Editar herramienta CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Almacena claves API, tokens o secretos que esta herramienta CLI necesita. Los valores se cifran en reposo y se inyectan como variables de entorno cuando el agente invoca la herramienta.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Variables de entorno",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(opcional)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "En sandbox · se ejecuta una vez en la primera invocación",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Comando de instalación",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Pega tu comando de instalación aquí, p. ej. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "El comando de instalación es obligatorio.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Más información sobre la herramienta CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Nombre de la herramienta CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Nombra tu herramienta CLI",
+  "agentDetail.configure.tools.cliDialog.name.required": "El nombre de la herramienta CLI es obligatorio.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Nunca visible en el prompt del agente; se inyecta solo como $VAR en tiempo de ejecución",
+  "agentDetail.configure.tools.cliDialog.title": "Agregar una herramienta CLI",
+  "agentDetail.configure.tools.cliTool": "Herramienta CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Usuario final · OAuth",
+  "agentDetail.configure.tools.editAction": "Editar {{name}}",
+  "agentDetail.configure.tools.empty.description": "Las herramientas permiten al agente actuar, como buscar en la web o invocar tus aplicaciones",
+  "agentDetail.configure.tools.empty.title": "Aún no hay herramientas",
+  "agentDetail.configure.tools.label": "Herramientas",
+  "agentDetail.configure.tools.moreActions": "Más acciones para {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Preautorizar",
+  "agentDetail.configure.tools.removeAction": "Eliminar {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Eliminar todas las herramientas",
+  "agentDetail.configure.tools.tip": "Herramientas que este agente puede invocar al orquestar tareas.",
+  "agentDetail.configure.tools.toggle": "Alternar herramientas",
+  "agentDetail.configure.tools.toolTabs.all": "Todas",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Personalizado",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugins",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agente",
+  "agentDetail.history": "Historial",
+  "agentDetail.logs.description": "Los registros completos registran el estado de ejecución de la aplicación, incluidas las entradas del usuario, las respuestas del agente, la planificación y los usos de herramientas.",
+  "agentDetail.logs.empty": "No se encontraron registros",
+  "agentDetail.logs.filters.period.allTime": "Todo el tiempo",
+  "agentDetail.logs.filters.period.label": "Periodo del registro",
+  "agentDetail.logs.filters.period.last30days": "Últimos 30 días",
+  "agentDetail.logs.filters.period.last7days": "Últimos 7 días",
+  "agentDetail.logs.filters.search.label": "Buscar registros",
+  "agentDetail.logs.filters.search.placeholder": "Buscar",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Última fecha de creación",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Última fecha de actualización",
+  "agentDetail.logs.filters.source.all": "Fuente",
+  "agentDetail.logs.filters.source.empty": "No se encontraron fuentes",
+  "agentDetail.logs.filters.source.label": "Fuente del registro",
+  "agentDetail.logs.filters.source.loadFailed": "No se pudieron cargar las fuentes",
+  "agentDetail.logs.filters.source.loading": "Cargando fuentes…",
+  "agentDetail.logs.filters.source.searchLabel": "Buscar fuentes",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Buscar",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Flujo de trabajo",
+  "agentDetail.logs.learnMore": "Más información",
+  "agentDetail.logs.loadFailed": "No se pudieron cargar los registros",
+  "agentDetail.logs.loading": "Cargando registros…",
+  "agentDetail.logs.notAvailable": "N/D",
+  "agentDetail.logs.table.createdTime": "Fecha de creación",
+  "agentDetail.logs.table.endUser": "Usuario final",
+  "agentDetail.logs.table.messageCount": "Cant. mens.",
+  "agentDetail.logs.table.operationRate": "Tasa op.",
+  "agentDetail.logs.table.source": "Fuente",
+  "agentDetail.logs.table.title": "Título",
+  "agentDetail.logs.table.unread": "Sin leer",
+  "agentDetail.logs.table.updatedTime": "Fecha de actualización",
+  "agentDetail.logs.table.userRate": "Valoración del usuario",
+  "agentDetail.logs.title": "Registros",
+  "agentDetail.memorySettings.budgetLabel": "Presupuesto de memoria",
+  "agentDetail.memorySettings.description": "Configuración de memoria desde la instantánea de configuración activa.",
+  "agentDetail.memorySettings.export.description": "La exportación de memoria está prevista para una versión posterior.",
+  "agentDetail.memorySettings.export.download": "Descargar",
+  "agentDetail.memorySettings.export.soon": "Próximamente",
+  "agentDetail.memorySettings.export.title": "Exportar memoria actual",
+  "agentDetail.memorySettings.notConfigured": "No configurado",
+  "agentDetail.memorySettings.scopeLabel": "Alcance de memoria",
+  "agentDetail.memorySettings.title": "Memoria",
+  "agentDetail.metadata.activeVersionLabel": "Versión activa",
+  "agentDetail.metadata.appIdLabel": "ID de la aplicación",
+  "agentDetail.metadata.description": "Campos del roster de solo lectura devueltos por el backend del agente.",
+  "agentDetail.metadata.emptyValue": "No disponible",
+  "agentDetail.metadata.scopeLabel": "Alcance",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Solo flujo de trabajo",
+  "agentDetail.metadata.sourceLabel": "Fuente",
+  "agentDetail.metadata.statusLabel": "Estado",
+  "agentDetail.metadata.title": "Metadatos",
+  "agentDetail.metadata.updatedAtLabel": "Actualizado el",
+  "agentDetail.metadata.workflowIdLabel": "ID de flujo de trabajo",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID del nodo de flujo de trabajo",
+  "agentDetail.monitoring.change": "{{value}} respecto al periodo anterior",
+  "agentDetail.monitoring.dateRangeLabel": "Rango de fechas",
+  "agentDetail.monitoring.description": "Realiza un seguimiento de la actividad, el coste y la calidad de interacción del agente reutilizable en todos los flujos de trabajo.",
+  "agentDetail.monitoring.learnMore": "Más información",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Usuarios finales únicos que activaron flujos de trabajo usando este agente.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Usuarios activos",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Recuento continuo de comunicación entre usuario y agente para este punto de acceso.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Prom. interacciones por sesión",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Velocidad media de salida desde el inicio de la solicitud hasta la finalización.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Velocidad de salida de tokens",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Coste estimado de tokens producido por este agente en las ejecuciones de flujos de trabajo.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Uso de tokens",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Conversaciones de IA diarias que llegaron a este agente a través del punto de acceso seleccionado.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Conversaciones totales",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Recuento diario de interacciones del agente.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Mensajes totales",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "El número de me gusta por cada 1.000 mensajes para este agente.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Tasa de satisfacción del usuario",
+  "agentDetail.monitoring.pickSource": "Elige una aplicación",
+  "agentDetail.monitoring.sourceLabel": "Aplicación",
+  "agentDetail.monitoring.sourceTrigger": "Fuente {{name}}",
+  "agentDetail.monitoring.sources.all": "Todos",
+  "agentDetail.monitoring.timeRangeLabel": "Rango de tiempo",
+  "agentDetail.monitoring.timeRanges.custom": "Personalizado",
+  "agentDetail.monitoring.timeRanges.last30days": "Últimos 30 días",
+  "agentDetail.monitoring.timeRanges.last7days": "Últimos 7 días",
+  "agentDetail.monitoring.timeRanges.today": "Hoy",
+  "agentDetail.monitoring.title": "Monitoreo",
+  "agentDetail.monitoring.tokenUsageConsumed": "Tokens consumidos",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Navegación del agente",
+  "agentDetail.publish": "Publicar",
+  "agentDetail.publishSoon": "Próximamente",
+  "agentDetail.sections.access": "Punto de acceso",
+  "agentDetail.sections.configure": "Orquestar",
+  "agentDetail.sections.logs": "Registros",
+  "agentDetail.sections.monitoring": "Monitoreo",
+  "agentDetail.subtitle": "ID del agente: {{agentId}}",
+  "agentDetail.title": "Agente",
+  "agentDetail.type": "AGENTE",
+  "agentDetail.versionHistory.active": "Activa",
+  "agentDetail.versionHistory.empty": "Aún no hay versiones",
+  "agentDetail.versionHistory.filter": "Filtrar versiones",
+  "agentDetail.versionHistory.versionName": "Versión {{version}}",
+  "roster.createAgent": "Crear agente",
+  "roster.createAgentOptions": "Opciones para crear agente",
+  "roster.createDialog.description": "Crea un agente reutilizable en el roster de este workspace.",
+  "roster.createDialog.title": "Crear agente",
+  "roster.createForm.changeIcon": "Cambiar icono del agente",
+  "roster.createForm.descriptionLabel": "Descripción",
+  "roster.createForm.descriptionOptional": "(opcional)",
+  "roster.createForm.descriptionPlaceholder": "p. ej. Reúne fuentes sobre un tema y resume los hallazgos clave",
+  "roster.createForm.nameLabel": "Nombre",
+  "roster.createForm.namePlaceholder": "p. ej. Max",
+  "roster.createForm.nameRequired": "El nombre es obligatorio.",
+  "roster.createForm.roleLabel": "Rol",
+  "roster.createForm.rolePlaceholder": "p. ej. Asistente de investigación",
+  "roster.createForm.roleRequired": "El rol es obligatorio.",
+  "roster.createSuccess": "Agente creado.",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Este agente se eliminará de la lista del roster activo.",
+  "roster.deleteDialog.title": "¿Eliminar {{name}}?",
+  "roster.deleteFailed": "Error al eliminar el agente.",
+  "roster.deleteSuccess": "Agente eliminado.",
+  "roster.duplicateFailed": "Error al duplicar el agente.",
+  "roster.duplicateSuccess": "Agente duplicado.",
+  "roster.editAgent": "Editar {{name}}",
+  "roster.editDialog.description": "Actualiza el nombre, la descripción y el rol del roster para este agente.",
+  "roster.editDialog.title": "Editar agente",
+  "roster.editInfo": "Editar información",
+  "roster.empty": "Aún no hay agentes",
+  "roster.emptyDescription": "Los agentes guardados en este workspace aparecerán aquí.",
+  "roster.emptySearch": "No hay agentes coincidentes",
+  "roster.emptySearchDescription": "Prueba con otro nombre de agente.",
+  "roster.filters.all": "Todos",
+  "roster.filters.drafts": "Borradores",
+  "roster.filters.label": "Filtros de agente",
+  "roster.filters.published": "Publicados",
+  "roster.learnMore": "Más información sobre Agent Roster",
+  "roster.listLabel": "Lista del roster de agentes",
+  "roster.loadMore": "Cargar más",
+  "roster.loadingError": "Error al cargar los agentes. Actualiza y vuelve a intentarlo.",
+  "roster.moreActions": "Más acciones para {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Error al crear el agente inline. Actualiza y vuelve a intentarlo.",
+  "roster.nodeSelector.dialogLabel": "Selecciona un agente",
+  "roster.nodeSelector.manageInAgentConsole": "Gestionar en Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Buscar…",
+  "roster.nodeSelector.startFromScratch": "Empezar desde cero",
+  "roster.references.label": "Flujos de trabajo que usan {{name}}",
+  "roster.references.trigger": "Flujos de trabajo que usan {{name}}",
+  "roster.searchLabel": "Buscar agentes",
+  "roster.searchPlaceholder": "Buscar agentes por nombre…",
+  "roster.sources.agent_app": "Aplicación de agente",
+  "roster.sources.imported": "Importado",
+  "roster.sources.system": "Sistema",
+  "roster.sources.workflow": "Flujo de trabajo",
+  "roster.status.active": "Activo",
+  "roster.status.archived": "Archivado",
+  "roster.tabs.agent": "Agente",
+  "roster.tabs.human": "Humano",
+  "roster.tabsLabel": "Tipo de roster",
+  "roster.updateSuccess": "Agente actualizado.",
+  "roster.usageStatus.draft": "Borrador"
+}
diff --git a/web/i18n/es-ES/app-log.json b/web/i18n/es-ES/app-log.json
index ceb62524cd0..4f13700bc12 100644
--- a/web/i18n/es-ES/app-log.json
+++ b/web/i18n/es-ES/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Hoy",
   "filter.period.yearToDate": "Año hasta la fecha",
   "filter.sortBy": "Ordenar por:",
+  "monitoring.description": "La monitorización registra el estado de ejecución de la aplicación, incluyendo rendimiento, actividad de los usuarios y costes.",
   "promptLog": "Registro de Indicación",
   "runDetail.fileListDetail": "Detalle",
   "runDetail.fileListLabel": "Detalles del archivo",
diff --git a/web/i18n/es-ES/billing.json b/web/i18n/es-ES/billing.json
index 8bf9a64d8ff..fa79bd8d8d5 100644
--- a/web/i18n/es-ES/billing.json
+++ b/web/i18n/es-ES/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Actualiza para desbloquear la carga de documentos en lote",
   "upgrade.uploadMultiplePages.description": "Has alcanzado el límite de carga: solo se puede seleccionar y subir un documento a la vez en tu plan actual.",
   "upgrade.uploadMultiplePages.title": "Actualiza para subir varios documentos a la vez",
+  "upgrade.workflowRestore.description": "La restauración de versiones del flujo de trabajo no está disponible en tu plan actual.",
+  "upgrade.workflowRestore.title": "Actualiza para restaurar versiones del flujo de trabajo",
   "upgradeBtn.encourage": "Actualizar Ahora",
   "upgradeBtn.encourageShort": "Actualizar",
   "upgradeBtn.plain": "Actualizar Plan",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index 45eab79a9a9..6ce03dc555e 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Cambiar espacio de trabajo",
   "mcpPage.description": "Conecta y gestiona servidores MCP para dar a tus apps acceso a herramientas y servicios externos.",
-  "members.admin": "Administrador",
   "members.adminTip": "Puede crear aplicaciones y administrar configuraciones del equipo",
+  "members.alreadyInTeam": "Ya está en el equipo",
+  "members.alreadyInTeamTip": "Estos usuarios ya tienen acceso a este espacio de trabajo.",
   "members.builder": "Constructor",
   "members.builderTip": "Puede crear y editar sus propias aplicaciones",
-  "members.datasetOperator": "Administrador de Conocimiento",
   "members.datasetOperatorTip": "Solo puede administrar la base de conocimiento",
   "members.deleteMember": "Eliminar miembro",
   "members.disInvite": "Cancelar la invitación",
-  "members.editor": "Editor",
   "members.editorTip": "Puede crear y editar aplicaciones",
   "members.email": "Correo electrónico",
   "members.emailInvalid": "Formato de correo electrónico inválido",
@@ -270,13 +269,12 @@
   "members.invite": "Agregar",
   "members.inviteTeamMember": "Agregar miembro del equipo",
   "members.inviteTeamMemberTip": "Pueden acceder a tus datos del equipo directamente después de iniciar sesión.",
-  "members.invitedAsRole": "Invitado como usuario {{role}}",
+  "members.invitedAsRole": "Invitado como {{role}}",
   "members.lastActive": "ÚLTIMA ACTIVIDAD",
   "members.name": "NOMBRE",
-  "members.normal": "Normal",
+  "members.noNewInvitationsSent": "No se han enviado nuevas invitaciones",
   "members.normalTip": "Solo puede usar aplicaciones, no puede crear aplicaciones",
   "members.ok": "OK",
-  "members.owner": "Propietario",
   "members.pending": "Pendiente...",
   "members.removeFromTeam": "Eliminar del espacio de trabajo",
   "members.removeFromTeamTip": "Se eliminará el acceso al equipo",
@@ -311,12 +309,14 @@
   "menus.apps": "Estudio",
   "menus.datasets": "Conocimiento",
   "menus.datasetsTips": "PRÓXIMAMENTE: Importa tus propios datos de texto o escribe datos en tiempo real a través de Webhook para la mejora del contexto LLM.",
+  "menus.deployments": "Despliegues",
   "menus.explore": "Explorar",
   "menus.exploreMarketplace": "Explora el mercado",
   "menus.newApp": "Nueva App",
   "menus.newDataset": "Crear Conocimiento",
   "menus.plugins": "Integraciones",
   "menus.pluginsTips": "Integrar integraciones de terceros o crear Integraciones AI compatibles con ChatGPT.",
+  "menus.roster": "Directorio de agentes",
   "menus.status": "beta",
   "menus.tools": "Herramientas",
   "model.addMoreModel": "Ir a configuraciones para agregar más modelos",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Modelo de Texto a Voz",
   "modelProvider.ttsModel.tip": "Establece el modelo predeterminado para la entrada de texto a voz en la conversación.",
   "modelProvider.upgradeForLoadBalancing": "Actualiza tu plan para habilitar el Balanceo de Carga.",
+  "navigation.skipToMain": "Saltar al contenido principal",
   "noData": "Sin datos",
   "operation.add": "Agregar",
   "operation.added": "Agregado",
@@ -600,9 +601,6 @@
   "placeholder.input": "Por favor ingresa",
   "placeholder.search": "Buscar...",
   "placeholder.select": "Por favor selecciona",
-  "plugin.serpapi.apiKey": "Clave API",
-  "plugin.serpapi.apiKeyPlaceholder": "Ingresa tu clave API",
-  "plugin.serpapi.keyFrom": "Obtén tu clave API de SerpAPI en la página de cuenta de SerpAPI",
   "promptEditor.context.item.desc": "Insertar plantilla de contexto",
   "promptEditor.context.item.title": "Contexto",
   "promptEditor.context.modal.add": "Agregar Contexto ",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
new file mode 100644
index 00000000000..5ca6cec7121
--- /dev/null
+++ b/web/i18n/es-ES/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API del servicio backend",
+  "access.api.copyCurlExample": "Copiar ejemplo cURL",
+  "access.api.createFailed": "Error al generar el API Token.",
+  "access.api.createKey": "Generar API Token",
+  "access.api.createKeyTitle": "Generar nuevo API Token",
+  "access.api.curlExampleTitle": "Ejemplo cURL",
+  "access.api.description": "Accede a este despliegue mediante HTTP. Cada API Token está limitado a un único entorno.",
+  "access.api.developerTitle": "API de desarrollador",
+  "access.api.disabled": "El acceso a la API está desactivado para este despliegue.",
+  "access.api.disabledHint": "Activa el acceso a la API para generar tokens limitados a un entorno.",
+  "access.api.dismissToken": "Descartar API Token",
+  "access.api.docs": "Documentación de la API",
+  "access.api.docsClose": "Cerrar documentación de la API",
+  "access.api.docsDescription": "Consulta la referencia de la API de Workflow para este despliegue.",
+  "access.api.docsTitle": "Documentación de la API de Workflow",
+  "access.api.empty": "Despliega primero a un entorno para empezar a emitir API Tokens.",
+  "access.api.emptyTitle": "No hay entornos desplegados",
+  "access.api.endpoint": "URL de la solicitud",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Lista de API Tokens",
+  "access.api.nameLabel": "Nombre del API Token",
+  "access.api.namePlaceholder": "Introduce un nombre para el API Token",
+  "access.api.nameRequired": "El nombre del API Token es obligatorio.",
+  "access.api.newKey": "Generar nuevo API Token",
+  "access.api.newTokenDescription": "Este API Token se muestra solo una vez. Cópialo antes de salir de esta página.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token generado",
+  "access.api.noKeys": "Aún no hay API Tokens. Genera uno para empezar a llamar a la API.",
+  "access.api.noKeysTitle": "Aún no hay API Tokens",
+  "access.api.revokeConfirmDescription": "El API Token \"{{name}}\" dejará de funcionar inmediatamente. Esta acción no se puede deshacer.",
+  "access.api.revokeConfirmTitle": "¿Revocar API Token?",
+  "access.api.revokeFailed": "Error al revocar el API Token.",
+  "access.api.revokeSuccess": "API Token revocado",
+  "access.api.table.action": "Acción",
+  "access.api.table.environment": "Entorno",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Nombre",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Canal",
+  "access.channels.col.endpoint": "Punto de entrada",
+  "access.channels.col.status": "Estado",
+  "access.channels.description": "Los puntos de entrada de WebApp y CLI usan los permisos de acceso indicados arriba.",
+  "access.channels.disabled": "Los canales de acceso están desactivados para este despliegue.",
+  "access.channels.disabledHint": "Activa los canales de acceso para exponer los puntos de entrada de WebApp y CLI.",
+  "access.channels.followPermission": "Sigue los permisos",
+  "access.channels.title": "Canales de acceso",
+  "access.cli.description": "Invócalo desde la terminal con difyctl, adecuado para scripts, flujos automatizados o integraciones con Agentes.",
+  "access.cli.docs": "Guía de uso",
+  "access.cli.domain": "Dominio",
+  "access.cli.empty": "Endpoint de CLI no configurado.",
+  "access.cli.install": "Instalar CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Copiado",
+  "access.copy": "Copiar",
+  "access.copyFailed": "Error al copiar",
+  "access.copyToast": "Copiado al portapapeles",
+  "access.hide": "Ocultar",
+  "access.members.clearAll": "Borrar todo",
+  "access.members.empty": "No se encontraron coincidencias.",
+  "access.members.groupCount_one": "{{count}} grupo",
+  "access.members.groupCount_other": "{{count}} grupos",
+  "access.members.groups": "Grupos",
+  "access.members.individuals": "Miembros",
+  "access.members.memberCount_one": "{{count}} miembro",
+  "access.members.memberCount_other": "{{count}} miembros",
+  "access.members.pickPlaceholder": "Selecciona grupos o miembros",
+  "access.members.searchPlaceholder": "Buscar grupos y miembros",
+  "access.members.selectedLabel": "Seleccionado",
+  "access.permission.anyone": "Cualquiera con el enlace",
+  "access.permission.anyoneDesc": "Cualquiera puede acceder a este despliegue sin iniciar sesión.",
+  "access.permission.memberCount_one": "{{count}} miembro",
+  "access.permission.memberCount_other": "{{count}} miembros",
+  "access.permission.organization": "Todos los miembros de la plataforma",
+  "access.permission.organizationDesc": "Todos los miembros de la plataforma",
+  "access.permission.specific": "Miembros específicos de la plataforma",
+  "access.permission.specificDesc": "Selecciona grupos o miembros específicos",
+  "access.permission.specificUnavailable": "La selección de miembros específicos está desactivada hasta que se conecten miembros y grupos reales de la plataforma.",
+  "access.permission.updateFailed": "Error al actualizar la política de acceso.",
+  "access.permissions.col.environment": "Entorno",
+  "access.permissions.col.permission": "Acceso",
+  "access.permissions.description": "Define los permisos de acceso para los puntos de entrada de WebApp y CLI en cada entorno.",
+  "access.permissions.editAriaLabel": "Configurar acceso para {{environment}}",
+  "access.permissions.editDescription": "Define los permisos de acceso para los puntos de entrada de WebApp y CLI.",
+  "access.permissions.editTitle": "Permisos de acceso",
+  "access.permissions.title": "Permisos de acceso",
+  "access.revoke": "Revocar",
+  "access.runAccess.description": "Gestiona cómo los usuarios pueden ejecutar este despliegue y quién tiene permiso para acceder a él en cada entorno.",
+  "access.runAccess.disabled": "El acceso de ejecución está desactivado para este despliegue.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Expone este despliegue como un servidor MCP (Model Context Protocol).",
+  "access.runAccess.mcpEmpty": "Endpoint de MCP no configurado.",
+  "access.runAccess.noEnvs": "Despliega a un entorno para configurar los permisos de acceso.",
+  "access.runAccess.noEnvsTitle": "No hay entornos desplegados",
+  "access.runAccess.openWebapp": "Abrir WebApp",
+  "access.runAccess.permissions": "Permisos de acceso",
+  "access.runAccess.permissionsDesc": "Quién puede acceder a este despliegue en cada entorno.",
+  "access.runAccess.title": "Acceso de ejecución",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Página web alojada para usuarios finales.",
+  "access.runAccess.webappEmpty": "Próximamente.",
+  "access.show": "Mostrar",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Externo",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Desconocido",
+  "card.access.api": "API Tokens",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Sin acceso",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Crear primera versión",
+  "card.deploy": "Desplegar",
+  "card.deploying": "{{count}} desplegándose",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} con error",
+  "card.fromApp": "Desde {{name}}",
+  "card.lastDeployed": "Último despliegue {{time}}",
+  "card.menu.delete": "Eliminar despliegue",
+  "card.menu.deleteDisabled": "La eliminación de despliegues aún no está disponible para despliegues gestionados por el backend.",
+  "card.menu.deploy": "Desplegar a un entorno",
+  "card.menu.editInfo": "Editar información",
+  "card.menu.viewDetail": "Ver detalle del despliegue",
+  "card.moreActions": "Más acciones",
+  "card.neverDeployed": "Aún no desplegado",
+  "card.noDescription": "Sin descripción.",
+  "card.notDeployed": "No desplegado",
+  "card.ready": "{{count}} en ejecución",
+  "card.tooltip.createdAt": "Creado",
+  "card.tooltip.deployed": "Desplegado",
+  "card.tooltip.deploymentStatus": "Despliegue",
+  "card.tooltip.notDeployed": "Este despliegue aún no se ha desplegado en ningún entorno.",
+  "card.tooltip.notDeployedShort": "No desplegado",
+  "card.tooltip.release": "Versión",
+  "card.tooltip.releaseName": "Nombre de la versión",
+  "card.tooltip.source": "Origen",
+  "common.loadFailed": "Error al cargar. Inténtalo de nuevo más tarde.",
+  "common.loading": "Cargando...",
+  "createGuide.actions.back": "Atrás",
+  "createGuide.actions.cancel": "Cancelar",
+  "createGuide.actions.continue": "Continuar",
+  "createGuide.actions.createAndDeploy": "Crear y desplegar",
+  "createGuide.actions.creating": "Creando...",
+  "createGuide.actions.deploy": "Desplegar",
+  "createGuide.actions.deploying": "Creando y desplegando...",
+  "createGuide.actions.next": "Siguiente",
+  "createGuide.actions.skipDeploy": "Omitir, desplegar después",
+  "createGuide.description": "Crea un despliegue a partir de un origen de versión, información básica y un entorno de destino.",
+  "createGuide.dsl.defaultAppName": "App DSL importada",
+  "createGuide.dsl.description": "Sube un paquete DSL de Workflow para crear el despliegue, la primera versión y, opcionalmente, el despliegue al entorno.",
+  "createGuide.dsl.dropDescription": "Sube un paquete DSL YAML de Workflow. Las opciones de despliegue se resuelven a partir de este archivo antes de desplegar.",
+  "createGuide.dsl.dropTitle": "Subir paquete DSL de Workflow",
+  "createGuide.dsl.readFailed": "Error al leer el archivo DSL. Elige otro archivo e inténtalo de nuevo.",
+  "createGuide.dsl.reading": "Leyendo el archivo DSL...",
+  "createGuide.dsl.title": "Importar DSL",
+  "createGuide.dsl.unsupportedMode": "Solo se pueden usar archivos DSL de Workflow para los despliegues.",
+  "createGuide.errors.createReleaseFailed": "Error al crear el despliegue o la versión.",
+  "createGuide.errors.deployFailed": "Error al desplegar al entorno.",
+  "createGuide.method.description": "Elige el origen utilizado para crear la primera versión.",
+  "createGuide.methods.bindApp.description": "Usa una Workflow App existente en Studio como origen de la versión.",
+  "createGuide.methods.bindApp.title": "Vincular una Workflow App existente",
+  "createGuide.methods.importDsl.description": "Sube un paquete DSL YAML de Workflow y continúa por la interfaz de despliegue.",
+  "createGuide.methods.importDsl.title": "Importar DSL",
+  "createGuide.methods.mocked": "Simulado",
+  "createGuide.nav.back": "Despliegues",
+  "createGuide.release.defaultName": "versión inicial",
+  "createGuide.release.deployInfo": "Información del despliegue",
+  "createGuide.release.description": "Completa la información del despliegue y los detalles de la primera versión.",
+  "createGuide.release.firstVersion": "Primera versión",
+  "createGuide.release.instanceDescription": "Descripción del despliegue",
+  "createGuide.release.instanceDescriptionPlaceholder": "Describe para qué se usa este despliegue",
+  "createGuide.release.instanceName": "Nombre del despliegue",
+  "createGuide.release.instanceNameConflict": "Ya existe un despliegue con este nombre. Elige otro nombre.",
+  "createGuide.release.releaseDescription": "Descripción de la versión",
+  "createGuide.release.releaseDescriptionPlaceholder": "Describe esta versión",
+  "createGuide.release.releaseName": "Nombre de la versión",
+  "createGuide.release.releaseNote": "Descripción de la versión",
+  "createGuide.release.title": "Información básica",
+  "createGuide.source.availableApps_one": "{{count}} app",
+  "createGuide.source.availableApps_other": "{{count}} apps",
+  "createGuide.source.clearSearch": "Borrar búsqueda de apps",
+  "createGuide.source.description": "Elige el origen utilizado para crear la primera versión.",
+  "createGuide.source.empty": "No se encontraron Workflow Apps.",
+  "createGuide.source.searchPlaceholder": "Buscar apps",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "Origen de la versión",
+  "createGuide.steps.method": "Origen de la versión",
+  "createGuide.steps.release": "Información básica",
+  "createGuide.steps.source": "Origen de la versión",
+  "createGuide.steps.target": "Desplegar a un entorno",
+  "createGuide.target.bindingCount_one": "{{count}} credencial",
+  "createGuide.target.bindingCount_other": "{{count}} credenciales",
+  "createGuide.target.bindingHint": "Elige las credenciales que usará esta versión.",
+  "createGuide.target.bindings": "Credenciales",
+  "createGuide.target.deferredBindingHint": "Las credenciales se resolverán a partir del plan de despliegue real durante la acción final de despliegue.",
+  "createGuide.target.deferredEnvironmentHint": "El nombre se compara con los entornos reales después de crear el despliegue y la versión.",
+  "createGuide.target.description": "Elige un entorno de destino y proporciona los ajustes de ejecución que esta versión necesita allí. Este paso se puede omitir.",
+  "createGuide.target.envVarCount_one": "{{count}} variable",
+  "createGuide.target.envVarCount_other": "{{count}} variables",
+  "createGuide.target.envVarHint": "Para cada variable de entorno que necesite esta versión, introduce un valor personalizado o usa el valor definido en la app.",
+  "createGuide.target.envVarPlaceholder": "Introduce un valor",
+  "createGuide.target.envVarSource.ariaLabel": "Selecciona el origen del valor de la variable para {{key}}",
+  "createGuide.target.envVarSource.default": "Valor de la app",
+  "createGuide.target.envVarSource.lastDeployment": "Último valor desplegado",
+  "createGuide.target.envVarSource.literal": "Valor personalizado",
+  "createGuide.target.envVarType.number": "Número",
+  "createGuide.target.envVarType.secret": "Secreto",
+  "createGuide.target.envVarType.string": "Cadena",
+  "createGuide.target.envVars": "Variables de entorno",
+  "createGuide.target.environment": "Entorno de destino",
+  "createGuide.target.environmentName": "Nombre del entorno",
+  "createGuide.target.environmentNamePlaceholder": "Producción",
+  "createGuide.target.loadBindingsFailed": "Error al cargar las credenciales.",
+  "createGuide.target.loadEnvironmentsFailed": "Error al cargar los entornos de despliegue.",
+  "createGuide.target.missingRequiredBinding": "Selecciona una credencial para esta vinculación obligatoria.",
+  "createGuide.target.noBindingRequired": "No se requieren credenciales.",
+  "createGuide.target.noCredentialCandidates": "No hay credenciales disponibles.",
+  "createGuide.target.noEnvironmentOptions": "No hay entornos de despliegue disponibles.",
+  "createGuide.target.required": "Obligatorio",
+  "createGuide.target.selectCredential": "Selecciona una credencial",
+  "createGuide.target.title": "Desplegar a un entorno",
+  "createGuide.title": "Nuevo despliegue",
+  "createModal.appPickerPlaceholder": "Selecciona una Workflow App",
+  "createModal.appSearchEmpty": "No hay Workflow Apps coincidentes",
+  "createModal.appSearchPlaceholder": "Buscar Workflow Apps…",
+  "createModal.cancel": "Cancelar",
+  "createModal.create": "Crear",
+  "createModal.createFailed": "Error al crear el despliegue.",
+  "createModal.description": "Elige una Workflow App y crea un despliegue.",
+  "createModal.descriptionLabel": "Descripción",
+  "createModal.descriptionPlaceholder": "Describe para qué se usa este despliegue",
+  "createModal.loadMoreApps": "Cargar más apps",
+  "createModal.loadingApps": "Cargando apps…",
+  "createModal.nameLabel": "Nombre del despliegue",
+  "createModal.namePlaceholder": "Nombre del despliegue",
+  "createModal.noApps": "No se encontraron Workflow Apps en este espacio de trabajo. Crea una en Studio primero.",
+  "createModal.selected": "Seleccionado",
+  "createModal.sourceApp": "Workflow App (obligatorio)",
+  "createModal.title": "Nuevo despliegue",
+  "deployDrawer.bindingCount_one": "{{count}} credencial",
+  "deployDrawer.bindingCount_other": "{{count}} credenciales",
+  "deployDrawer.bindingOptionsFailed": "Error al cargar las opciones de credenciales.",
+  "deployDrawer.bindingSelectionHint": "Elige las credenciales utilizadas por este despliegue.",
+  "deployDrawer.bindingsDisabled": "Resuelto a partir de la vista previa de la versión. La edición aún no está disponible.",
+  "deployDrawer.cancel": "Cancelar",
+  "deployDrawer.close": "Cerrar panel de despliegue",
+  "deployDrawer.defaultSelect": "Seleccionar...",
+  "deployDrawer.deploy": "Desplegar a un entorno",
+  "deployDrawer.deployExistingRelease": "Desplegar a un entorno",
+  "deployDrawer.deployExistingReleaseDescription": "Selecciona una versión y un entorno de destino para desplegar.",
+  "deployDrawer.deployExistingReleaseTitle": "Desplegar a un entorno",
+  "deployDrawer.deployFailed": "Error al iniciar el despliegue.",
+  "deployDrawer.deploying": "Desplegando...",
+  "deployDrawer.description": "Selecciona una versión y un entorno de destino para desplegar.",
+  "deployDrawer.envVarCount_one": "{{count}} variable",
+  "deployDrawer.envVarCount_other": "{{count}} variables",
+  "deployDrawer.envVarHint": "Para cada variable de entorno que necesite esta versión, introduce un valor personalizado o usa el valor definido en la app.",
+  "deployDrawer.envVarPlaceholder": "Introduce un valor",
+  "deployDrawer.envVarSource.ariaLabel": "Selecciona el origen del valor de la variable para {{key}}",
+  "deployDrawer.envVarSource.default": "Valor de la app",
+  "deployDrawer.envVarSource.lastDeployment": "Último valor desplegado",
+  "deployDrawer.envVarSource.literal": "Valor personalizado",
+  "deployDrawer.envVarType.number": "Número",
+  "deployDrawer.envVarType.secret": "Secreto",
+  "deployDrawer.envVarType.string": "Cadena",
+  "deployDrawer.envVars": "Variables de entorno",
+  "deployDrawer.existingReleaseHint": "Esta versión se desplegará tal cual. No se creará una nueva versión.",
+  "deployDrawer.loadingBindings": "Resolviendo...",
+  "deployDrawer.lockedHint": "Bloqueado al entorno actual",
+  "deployDrawer.missingRequiredBinding": "Selecciona una credencial para esta vinculación obligatoria.",
+  "deployDrawer.missingRequiredEnvVar": "Introduce un valor para esta variable de entorno obligatoria.",
+  "deployDrawer.modelCreds": "Credenciales de modelo",
+  "deployDrawer.needsValidation": " (requiere validación)",
+  "deployDrawer.newReleaseHint": "Se creará una nueva versión a partir del YAML de la Workflow App seleccionada.",
+  "deployDrawer.noBindingRequired": "No obligatorio",
+  "deployDrawer.noCredentialCandidates": "No hay credenciales disponibles.",
+  "deployDrawer.noNewEnvironmentAvailable": "Todos los entornos disponibles ya tienen un despliegue.",
+  "deployDrawer.noOtherReleaseAvailable": "No hay otras versiones disponibles para este entorno.",
+  "deployDrawer.noReleaseAvailable": "Crea una versión antes de desplegar a un entorno.",
+  "deployDrawer.notFound": "Despliegue no encontrado.",
+  "deployDrawer.noteLabel": "Descripción de la versión (opcional)",
+  "deployDrawer.notePlaceholder": "p. ej., Publicar ajuste de texto de incorporación",
+  "deployDrawer.pluginCreds": "Credenciales de plugin",
+  "deployDrawer.promote": "Desplegar",
+  "deployDrawer.promoteDescription": "Selecciona una versión y un entorno de destino para desplegar.",
+  "deployDrawer.promoteTitle": "Desplegar a un entorno",
+  "deployDrawer.readOnly": "Solo lectura",
+  "deployDrawer.redeploy": "Desplegar a un entorno",
+  "deployDrawer.redeployDescription": "Selecciona una versión y un entorno de destino para desplegar.",
+  "deployDrawer.redeployExistingReleaseHint": "La versión actual se volverá a desplegar tal cual. No se creará una nueva versión.",
+  "deployDrawer.redeployTitle": "Desplegar a un entorno",
+  "deployDrawer.releaseLabel": "Versión",
+  "deployDrawer.requiredBinding": "Obligatorio",
+  "deployDrawer.rollback": "Desplegar",
+  "deployDrawer.rollbackDescription": "Selecciona una versión y un entorno de destino para desplegar.",
+  "deployDrawer.rollbackTitle": "Desplegar a un entorno",
+  "deployDrawer.runtimeCredentials": "Credenciales",
+  "deployDrawer.secretPlaceholder": "secreto",
+  "deployDrawer.selectCredential": "Selecciona una credencial",
+  "deployDrawer.selectEnv": "Selecciona un entorno",
+  "deployDrawer.selectProviderCred": "Selecciona credencial de {{provider}}",
+  "deployDrawer.selectProviderKey": "Selecciona la clave de {{provider}}",
+  "deployDrawer.selectRelease": "Selecciona una versión",
+  "deployDrawer.targetEnv": "Entorno de destino",
+  "deployDrawer.title": "Desplegar a un entorno",
+  "deployDrawer.valuePlaceholder": "valor",
+  "deployTab.cancelDeployment": "Cancelar despliegue",
+  "deployTab.closeError": "Cerrar",
+  "deployTab.col.actions": "Acciones",
+  "deployTab.col.currentRelease": "Versión actual",
+  "deployTab.col.environment": "Entorno",
+  "deployTab.col.status": "Estado",
+  "deployTab.col.updated": "Actualizado",
+  "deployTab.collapseDetails": "Contraer detalles del despliegue",
+  "deployTab.confirmUndeploy": "Retirar despliegue",
+  "deployTab.deployOtherVersion": "Desplegar otra versión",
+  "deployTab.deployToEnv": "Desplegar a {{name}}",
+  "deployTab.deployToNewEnv": "Desplegar a nuevo entorno...",
+  "deployTab.empty": "Aún no hay instancias. Despliega a un nuevo entorno para empezar.",
+  "deployTab.emptyDescription": "Elige una versión y un entorno de destino para poner este despliegue a disposición de los usuarios.",
+  "deployTab.emptyTitle": "Aún no hay entornos en ejecución",
+  "deployTab.envCount": "Entornos",
+  "deployTab.errorCode": "Código",
+  "deployTab.errorDialogDesc": "Revisa el último despliegue fallido antes de reintentar o desplegar otra versión.",
+  "deployTab.errorDialogTitle": "Error de despliegue en {{name}}",
+  "deployTab.errorMessage": "Mensaje",
+  "deployTab.errorPhase": "Fase",
+  "deployTab.expandDetails": "Expandir detalles del despliegue",
+  "deployTab.moreActions": "Más acciones",
+  "deployTab.newDeployment": "Desplegar a nuevo entorno",
+  "deployTab.panel.commit": "ID del commit",
+  "deployTab.panel.deploymentId": "ID del despliegue",
+  "deployTab.panel.endpoints": "Endpoints",
+  "deployTab.panel.envVars": "Variables de entorno",
+  "deployTab.panel.error": "Error",
+  "deployTab.panel.failedRelease": "Versión fallida",
+  "deployTab.panel.health": "Salud",
+  "deployTab.panel.instanceInfo": "Información de la instancia",
+  "deployTab.panel.modelCreds": "Credenciales de modelo",
+  "deployTab.panel.pluginCreds": "Credenciales de plugin",
+  "deployTab.panel.release": "Versión",
+  "deployTab.panel.releaseCreatedAt": "Versión creada el",
+  "deployTab.panel.releaseInfo": "Información de la versión",
+  "deployTab.panel.replicas": "Réplicas",
+  "deployTab.panel.run": "Ejecutar",
+  "deployTab.panel.runtimeBindings": "Credenciales",
+  "deployTab.panel.runtimeInfo": "Información de ejecución",
+  "deployTab.panel.runtimeMode": "Modo de ejecución",
+  "deployTab.panel.runtimeNote": "Nota de ejecución",
+  "deployTab.panel.targetRelease": "Versión de destino",
+  "deployTab.panel.unknownError": "El despliegue ha fallado.",
+  "deployTab.promote": "Desplegar",
+  "deployTab.redeploy": "Volver a desplegar",
+  "deployTab.releaseCreatedAt": "Versión creada {{time}}",
+  "deployTab.retry": "Reintentar",
+  "deployTab.shortcut": "Acceso directo",
+  "deployTab.status.deployFailed": "Despliegue fallido",
+  "deployTab.status.deployingRelease": "Desplegando ({{release}})",
+  "deployTab.status.runningOutOfSync": "En ejecución (sincronización pendiente)",
+  "deployTab.status.runningWithFailed": "En ejecución (último despliegue fallido)",
+  "deployTab.undeploy": "Retirar despliegue",
+  "deployTab.undeployConfirmDesc": "El acceso de los usuarios finales se detendrá inmediatamente. La versión se puede volver a desplegar más adelante.",
+  "deployTab.undeployConfirmTitle": "¿Retirar despliegue de {{name}}?",
+  "deployTab.undeployFrom": "Retirar despliegue de {{name}}",
+  "deployTab.undeployImpactTitle": "Instancia afectada",
+  "deployTab.viewError": "Ver error",
+  "deployTab.viewLogs": "Ver registros",
+  "deployTab.viewProgress": "Ver progreso",
+  "detail.backToInstances": "Volver a despliegues",
+  "detail.deployingCount": "{{count}} desplegándose",
+  "detail.envCount_one": "{{count}} entorno",
+  "detail.envCount_other": "{{count}} entornos",
+  "detail.failedCount": "{{count}} con error",
+  "detail.mobileTabs": "Secciones del despliegue",
+  "detail.notFound": "Despliegue no encontrado",
+  "detail.openSourceApp": "Abrir origen {{name}}",
+  "detail.sourceApp": "Origen",
+  "detail.sourceAppLink": "Origen",
+  "documentTitle.create": "Nuevo despliegue · Despliegues",
+  "documentTitle.detail": "Despliegue · Despliegues",
+  "documentTitle.list": "Despliegues",
+  "filter.allEnvs": "Todos los entornos",
+  "filter.notDeployed": "No desplegado",
+  "filter.searchPlaceholder": "Buscar despliegues",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Admisión",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Inicializando",
+  "health.ENVIRONMENT_STATUS_DELETING": "Eliminando",
+  "health.ENVIRONMENT_STATUS_FAILED": "No disponible",
+  "health.ENVIRONMENT_STATUS_READY": "Disponible",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Desconocido",
+  "list.clearFilters": "Borrar filtros",
+  "list.clearSearch": "Borrar búsqueda de despliegues",
+  "list.createDeployment": "Nuevo",
+  "list.empty": "No se encontraron despliegues.",
+  "list.emptyDescription": "Crea un despliegue a partir de una Workflow App o un paquete DSL de Workflow para gestionar versiones, entornos y acceso.",
+  "list.emptyFilteredDescription": "Ningún despliegue coincide con la búsqueda o el filtro de entorno actuales.",
+  "list.emptyFilteredTitle": "No hay despliegues coincidentes",
+  "list.emptyTitle": "Aún no hay despliegues",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Aislado",
+  "mode.ENVIRONMENT_MODE_SHARED": "Compartido",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Desconocido",
+  "newInstance.comingSoon": "Próximamente",
+  "newInstance.fromStudio": "Seleccionar desde Studio",
+  "newInstance.importDSL": "Importar DSL",
+  "newInstance.title": "Nuevo despliegue",
+  "overview.accessEndpoints": "Endpoints de acceso",
+  "overview.accessMeta.apiTokens": "Gestionar API Tokens",
+  "overview.accessMeta.cli": "Ver acceso CLI",
+  "overview.accessMeta.webApp": "Gestionar acceso WebApp",
+  "overview.accessStatus": "Acceso",
+  "overview.api": "API Tokens",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Tokens",
+  "overview.apiTokenSummary.environments_one": "{{count}} entorno desplegado",
+  "overview.apiTokenSummary.environments_other": "{{count}} entornos desplegados",
+  "overview.availableForDeployment": "Disponible para desplegar",
+  "overview.basicInfo": "Información básica",
+  "overview.cardAction.deployLatest": "Desplegar última versión",
+  "overview.cardAction.redeploy": "Volver a desplegar",
+  "overview.cardAction.viewProgress": "Ver despliegue",
+  "overview.chip.behindTooltip_one": "1 versión por detrás de la última. Despliega la última versión para actualizar.",
+  "overview.chip.behindTooltip_other": "{{count}} versiones por detrás de la última. Despliega la última versión para actualizar.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "desplegándose",
+  "overview.chip.deployingTooltip": "El despliegue está en curso.",
+  "overview.chip.empty": "vacío",
+  "overview.chip.emptyTooltip": "No hay ninguna versión desplegada en este entorno.",
+  "overview.chip.failed": "fallido",
+  "overview.chip.failedTooltip": "El último intento de despliegue ha fallado.",
+  "overview.chip.latest": "última",
+  "overview.chip.latestTooltip": "Este entorno está ejecutando la última versión.",
+  "overview.chip.needsReleaseFirst": "Crea primero una versión",
+  "overview.chip.olderRelease": "anterior",
+  "overview.chip.olderReleaseTooltip": "Este entorno está ejecutando una versión anterior.",
+  "overview.chip.openInDeployTab": "Ver progreso del despliegue",
+  "overview.cli": "CLI",
+  "overview.configured": "Configurado",
+  "overview.createRelease": "Crear versión",
+  "overview.created": "Creado",
+  "overview.deploy": "Desplegar",
+  "overview.deployedEnvironments": "desplegado",
+  "overview.deploymentOverview": "Resumen del despliegue",
+  "overview.deploymentStatus": "Estado del despliegue",
+  "overview.description": "Descripción",
+  "overview.developerApi": "API de desarrollador",
+  "overview.disabled": "Desactivado",
+  "overview.emptyValue": "Sin definir",
+  "overview.enabled": "Activado",
+  "overview.enabledChannels": "acceso activado",
+  "overview.endUserAccess": "Acceso para usuarios finales",
+  "overview.environments": "Entornos",
+  "overview.hero.byName": "por {{name}}",
+  "overview.hero.empty": "Aún no hay versiones",
+  "overview.hero.emptyDescription": "Crea una versión a partir del origen actual antes de desplegar.",
+  "overview.hero.propagation_one": "desplegado en {{count}}/{{total}} entorno",
+  "overview.hero.propagation_other": "desplegado en {{count}}/{{total}} entornos",
+  "overview.hero.untargeted": "aún no hay entornos configurados",
+  "overview.instanceDetails": "Detalles del despliegue",
+  "overview.instanceId": "ID del despliegue",
+  "overview.latestRelease.releaseCount_one": "{{count}} versión",
+  "overview.latestRelease.releaseCount_other": "{{count}} versiones",
+  "overview.latestReleaseTitle": "Última versión",
+  "overview.manageDeployments": "Gestionar despliegues",
+  "overview.name": "Nombre",
+  "overview.noAccessConfig": "Sin configuración de acceso.",
+  "overview.noReleaseYet": "Crea una versión antes de desplegar a un entorno.",
+  "overview.notConfigured": "No configurado",
+  "overview.previousReleases.empty": "Aún no hay versiones anteriores.",
+  "overview.previousReleases.retired": "No desplegada actualmente",
+  "overview.previousReleases.title": "Versiones anteriores",
+  "overview.previousReleases.viewAll": "Ver todas",
+  "overview.ready": "Desplegable",
+  "overview.recentReleases": "Versiones recientes",
+  "overview.releaseDeployedTitle": "{{release}} está desplegada",
+  "overview.releaseReadyTitle": "{{release}} lista para desplegar",
+  "overview.serviceMap": "Mapa de servicios",
+  "overview.servingRelease": "Sirviendo {{release}}",
+  "overview.servingReleaseDescription": "Este despliegue está desplegado en {{count}}/{{total}} entornos.",
+  "overview.strip.deployToNewEnvironment": "Desplegar a nuevo entorno",
+  "overview.strip.empty": "No hay entornos configurados.",
+  "overview.strip.emptyDeployableDescription": "Despliega la última versión a un entorno cuando estés listo.",
+  "overview.strip.emptyDeployed": "Aún no hay instancias.",
+  "overview.strip.emptyDescription": "Crea una versión antes de desplegar a un entorno.",
+  "overview.strip.emptyTitle": "Aún no hay instancias",
+  "overview.strip.summary_one": "1 de {{total}} en la última versión",
+  "overview.strip.summary_other": "{{count}} de {{total}} en la última versión",
+  "overview.strip.title": "Instancias",
+  "overview.switchSourceApp": "Cambiar origen",
+  "overview.switchSourceAppDescription": "Elige la Workflow App utilizada como origen para futuras versiones.",
+  "overview.switchSourceAppHint": "Después de cambiar, solo las versiones recién creadas usarán el nuevo origen. Las versiones históricas y los despliegues existentes no se modifican.",
+  "overview.targetRelease": "Versión de destino",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Zona de peligro",
+  "settings.dangerDesc": "Elimina permanentemente este despliegue y detén cualquier instancia en ejecución. Esta acción no se puede deshacer.",
+  "settings.delete": "Eliminar despliegue",
+  "settings.deleteConfirmDesc": "¿Eliminar {{name}}? Todas las instancias dejarán de ejecutarse y se eliminarán de todos los entornos. Esta acción no se puede deshacer.",
+  "settings.deleteConfirmTitle": "Eliminar despliegue",
+  "settings.deleteFailed": "Error al eliminar el despliegue.",
+  "settings.deleteImpact": "Impacto",
+  "settings.deleteImpactInstance": "Despliegue",
+  "settings.deleteImpactTitle": "Despliegue afectado",
+  "settings.deleteImpactValue": "El despliegue se elimina de la lista de despliegues.",
+  "settings.deleted": "Despliegue eliminado",
+  "settings.description": "Descripción",
+  "settings.descriptionHelp": "Gestiona el nombre, la descripción y otros ajustes de este despliegue.",
+  "settings.general": "General",
+  "settings.name": "Nombre del despliegue",
+  "settings.reset": "Restablecer",
+  "settings.save": "Guardar cambios",
+  "settings.updateFailed": "Error al actualizar el despliegue.",
+  "settings.updated": "Despliegue actualizado",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Desplegando",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sincronización pendiente",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Despliegue fallido",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "No válido",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "En ejecución",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "No desplegado",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Retirando despliegue",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconocido",
+  "subtitle": "Gestiona despliegues en distintos entornos.",
+  "tabs.access.description": "Gestiona los canales y permisos de acceso.",
+  "tabs.access.name": "Acceso",
+  "tabs.api-tokens.description": "Gestiona los API Tokens e invoca instancias mediante HTTP.",
+  "tabs.api-tokens.name": "API Tokens",
+  "tabs.instances.description": "Visualiza y gestiona las instancias en los entornos desplegados.",
+  "tabs.instances.name": "Instancias",
+  "tabs.overview.description": "Consulta el estado del despliegue en los distintos entornos.",
+  "tabs.overview.name": "Resumen",
+  "tabs.releases.description": "Crea, despliega y gestiona versiones.",
+  "tabs.releases.name": "Versiones",
+  "tabs.settings.description": "Gestiona el nombre, la descripción y otros ajustes de este despliegue.",
+  "tabs.settings.name": "Ajustes",
+  "title": "Despliegues",
+  "unsupportedDslNodes.description": "Esta versión contiene nodos que el entorno de ejecución del despliegue aún no admite. Quítalos o reemplázalos en Studio y vuelve a intentarlo.",
+  "unsupportedDslNodes.descriptionWithTypes": "Esta versión contiene nodos que el entorno de ejecución del despliegue aún no admite: {{nodeTypes}}. Quítalos o reemplázalos en Studio y vuelve a intentarlo.",
+  "unsupportedDslNodes.title": "Nodos no admitidos",
+  "unsupportedDslNodes.unknownType": "Tipo desconocido",
+  "versions.cancelCreate": "Cancelar",
+  "versions.cancelDelete": "Cancelar",
+  "versions.cancelEdit": "Cancelar",
+  "versions.checkingReleaseContent": "Comprobando el contenido de la versión...",
+  "versions.col.action": "Acción",
+  "versions.col.author": "Creado por",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Creado el",
+  "versions.col.deployedTo": "Desplegado en",
+  "versions.col.release": "Versión",
+  "versions.col.sourceApp": "Origen",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Crear",
+  "versions.createFailed": "Error al crear la versión.",
+  "versions.createRelease": "Crear versión",
+  "versions.createReleaseDescription": "Crea una versión desplegable a partir de una Workflow App o un archivo DSL de Workflow.",
+  "versions.createReleaseHint": "Las nuevas versiones se pueden desplegar en cualquier entorno.",
+  "versions.createSuccess": "Versión \"{{name}}\" creada.",
+  "versions.creating": "Creando...",
+  "versions.currentOn": "Versión actual en {{name}}",
+  "versions.deleteConfirmDesc": "La versión \"{{name}}\" se eliminará permanentemente. Esta acción no se puede deshacer.",
+  "versions.deleteConfirmTitle": "¿Eliminar versión?",
+  "versions.deleteFailed": "Error al eliminar la versión.",
+  "versions.deleteImpactDeployment": "Estado del despliegue",
+  "versions.deleteImpactNotDeployed": "No desplegada actualmente",
+  "versions.deleteImpactRelease": "Versión",
+  "versions.deleteImpactTitle": "Impacto de la eliminación",
+  "versions.deleteRelease": "Eliminar versión",
+  "versions.deleteSuccess": "Versión \"{{name}}\" eliminada.",
+  "versions.deploy": "Desplegar",
+  "versions.deployTo": "Desplegar a {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Desplegando",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sincronización pendiente",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Fallido",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "No válido",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "En ejecución",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "No desplegado",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Retirando despliegue",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconocido",
+  "versions.deployingTo": "{{name}} se está desplegando",
+  "versions.disabledReason.checkDeploymentsFailed": "No se pudo verificar el uso del despliegue. Inténtalo de nuevo más tarde.",
+  "versions.disabledReason.checkingDeployments": "Comprobando el uso del despliegue",
+  "versions.disabledReason.current": "Esta versión ya se está ejecutando en {{name}}",
+  "versions.disabledReason.deploying": "Espera a que finalice el despliegue activo",
+  "versions.disabledReason.envDisabled": "Este entorno no es desplegable",
+  "versions.disabledReason.releaseInUse_one": "Retira el despliegue de esta versión de {{count}} entorno antes de eliminarla",
+  "versions.disabledReason.releaseInUse_other": "Retira el despliegue de esta versión de {{count}} entornos antes de eliminarla",
+  "versions.dslReadFailed": "Error al leer el archivo DSL. Elige otro archivo e inténtalo de nuevo.",
+  "versions.dslReading": "Leyendo el archivo DSL...",
+  "versions.dslUnsupportedMode": "Solo se pueden usar archivos DSL de Workflow para los despliegues.",
+  "versions.editFailed": "Error al actualizar la versión.",
+  "versions.editRelease": "Editar versión",
+  "versions.editReleaseDescription": "Actualiza el nombre y la descripción de esta versión.",
+  "versions.editSuccess": "Versión \"{{name}}\" actualizada.",
+  "versions.empty": "Aún no hay versiones disponibles.",
+  "versions.emptyDescription": "Crea la primera versión antes de desplegar a un entorno.",
+  "versions.emptyTitle": "Aún no hay versiones",
+  "versions.emptyWithCreate": "Aún no hay versiones. Crea la primera versión desplegable antes de desplegar.",
+  "versions.exportDsl": "Exportar DSL",
+  "versions.exportDslFailed": "Error al exportar el DSL.",
+  "versions.exportingDsl": "Exportando...",
+  "versions.groupHeader.deploy": "Desplegar",
+  "versions.groupHeader.promote": "Desplegar",
+  "versions.groupHeader.rollback": "Desplegar versión anterior",
+  "versions.groupHeader.unavailable": "No disponible",
+  "versions.manualDslOption": "Subir DSL",
+  "versions.moreActions": "Más acciones",
+  "versions.optional": "Opcional",
+  "versions.promote": "Desplegar",
+  "versions.promoteTo": "Desplegar a {{name}}",
+  "versions.releaseAlreadyExists": "Ya existe una versión con el mismo contenido: {{name}}.",
+  "versions.releaseContentCheckFailed": "Error al comprobar el contenido de la versión.",
+  "versions.releaseDescriptionLabel": "Descripción",
+  "versions.releaseDescriptionPlaceholder": "Describe esta versión",
+  "versions.releaseHistory": "Historial de versiones",
+  "versions.releaseNameLabel": "Nombre de la versión",
+  "versions.releaseNamePlaceholder": "Nombre de la versión",
+  "versions.releaseNameRequired": "Introduce un nombre de versión.",
+  "versions.releaseSourceLabel": "Origen de la versión",
+  "versions.rollbackTo": "Desplegar a {{name}}",
+  "versions.saveEdit": "Guardar",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/es-ES/workflow.json b/web/i18n/es-ES/workflow.json
index ecd36f6f574..9b76c288493 100644
--- a/web/i18n/es-ES/workflow.json
+++ b/web/i18n/es-ES/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "Agente",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Respuesta",
   "blocks.assigner": "Asignador de Variables",
   "blocks.code": "Código",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Agregador de variables",
   "blocks.variable-assigner": "Asignador de variables",
   "blocksAbout.agent": "Invocar modelos de lenguaje de gran tamaño para responder preguntas o procesar el lenguaje natural",
+  "blocksAbout.agent-v2": "Invocar modelos de lenguaje de gran tamaño para responder preguntas o procesar el lenguaje natural",
   "blocksAbout.answer": "Define el contenido de respuesta de una conversación de chat",
   "blocksAbout.assigner": "El nodo de asignación de variables se utiliza para asignar valores a variables escribibles (como variables de conversación).",
   "blocksAbout.code": "Ejecuta un fragmento de código Python o NodeJS para implementar lógica personalizada",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID del flujo de trabajo",
   "globalVar.fieldsDescription.workflowRunId": "ID de ejecución del flujo de trabajo",
   "globalVar.title": "Variables del sistema",
+  "nodes.agent.advancedSetting": "Configuración avanzada",
   "nodes.agent.checkList.strategyNotSelected": "Estrategia no seleccionada",
   "nodes.agent.clickToViewParameterSchema": "Haga clic para ver el esquema de parámetros",
   "nodes.agent.configureModel": "Configurar modelo",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Modelo no compatible",
   "nodes.agent.modelSelectorTooltips.deprecated": "Este modelo está en desuso",
   "nodes.agent.notAuthorized": "No autorizado",
+  "nodes.agent.outputVars.confirm": "Confirmar",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Introduce un arreglo JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Introduce true o false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Los valores predeterminados de archivo aún no se pueden configurar aquí.",
+  "nodes.agent.outputVars.defaultValueLabel": "Predeterminado",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Introduce un número válido.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Introduce un objeto JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Valor predeterminado",
+  "nodes.agent.outputVars.delete": "Eliminar {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Descripción",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Añadir descripción",
+  "nodes.agent.outputVars.edit": "Editar {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Editor de variables de salida",
   "nodes.agent.outputVars.files.title": "Archivos generados por el agente",
   "nodes.agent.outputVars.files.transfer_method": "Método de transferencia. El valor es remote_url o local_file",
   "nodes.agent.outputVars.files.type": "Tipo de soporte. Ahora solo admite imagen",
   "nodes.agent.outputVars.files.upload_file_id": "Cargar ID de archivo",
   "nodes.agent.outputVars.files.url": "URL de la imagen",
   "nodes.agent.outputVars.json": "JSON generado por el agente",
+  "nodes.agent.outputVars.nameDuplicate": "El nombre de salida ya existe",
+  "nodes.agent.outputVars.nameInvalid": "Usa letras, números y guiones bajos. Comienza con una letra o guion bajo.",
+  "nodes.agent.outputVars.nameLabel": "Nombre del campo",
+  "nodes.agent.outputVars.namePlaceholder": "Nombre del campo",
+  "nodes.agent.outputVars.newOutput": "Nueva salida",
+  "nodes.agent.outputVars.requiredLabel": "Obligatorio",
+  "nodes.agent.outputVars.showAdvancedOptions": "Mostrar opciones avanzadas",
   "nodes.agent.outputVars.text": "Contenido generado por el agente",
+  "nodes.agent.outputVars.typeLabel": "Tipo de salida",
   "nodes.agent.outputVars.usage": "Información de uso del modelo",
   "nodes.agent.parameterSchema": "Esquema de Parámetros",
   "nodes.agent.pluginInstaller.install": "Instalar",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Este integración se instala desde GitHub. Por favor, vaya a Integraciones para reinstalar",
   "nodes.agent.pluginNotInstalled": "Este integración no está instalado",
   "nodes.agent.pluginNotInstalledDesc": "Este integración se instala desde GitHub. Por favor, vaya a Integraciones para reinstalar",
+  "nodes.agent.roster.change": "Cambiar",
+  "nodes.agent.roster.editInConsole": "Editar en Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Una configuración puntual que existe solo en este nodo",
+  "nodes.agent.roster.inlineSetup.name": "Configuración inline",
+  "nodes.agent.roster.inlineSetup.title": "Configuración del agente",
+  "nodes.agent.roster.inlineSetup.type": "Solo en este nodo",
+  "nodes.agent.roster.label": "Agente",
+  "nodes.agent.roster.makeCopy": "Hacer una copia",
+  "nodes.agent.roster.more": "Más acciones del agente",
+  "nodes.agent.roster.openPanel": "Abrir detalles de {{name}}",
+  "nodes.agent.roster.panelLabel": "Detalles de {{name}}",
   "nodes.agent.strategy.configureTip": "Configure la estrategia de agentes.",
   "nodes.agent.strategy.configureTipDesc": "Después de configurar la estrategia agentica, este nodo cargará automáticamente las configuraciones restantes. La estrategia afectará el mecanismo de razonamiento de herramientas de varios pasos.",
   "nodes.agent.strategy.label": "Estrategia Agentica",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "La versión del integración instalado no proporciona esta estrategia. Haga clic para cambiar de versión.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} no está instalado",
   "nodes.agent.strategyNotSet": "Estrategia agentica No establecida",
+  "nodes.agent.task.insert": "Insertar",
+  "nodes.agent.task.label": "Tarea del agente",
+  "nodes.agent.task.mention": "Mencionar",
+  "nodes.agent.task.placeholder": "Describe lo que este agente debe hacer...",
+  "nodes.agent.task.tooltip": "Define las instrucciones de la tarea que este agente debe seguir en este flujo de trabajo.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} No autorizado",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} no está instalada",
   "nodes.agent.toolbox": "caja de herramientas",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Por {{author}}",
   "tabs.question-understand": "Entender pregunta",
   "tabs.requestToCommunity": "Solicitudes a la comunidad",
-  "tabs.searchBlock": "Buscar nodo",
+  "tabs.searchBlock": "Buscar nodos, agente, humano, conocimiento",
   "tabs.searchDataSource": "Fuente de datos de búsqueda",
   "tabs.searchSnippets": "Buscar fragmentos...",
   "tabs.searchTool": "Herramienta de búsqueda",
diff --git a/web/i18n/fa-IR/agent-v-2.json b/web/i18n/fa-IR/agent-v-2.json
new file mode 100644
index 00000000000..45b5891dc26
--- /dev/null
+++ b/web/i18n/fa-IR/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "این عمل هنوز در دسترس نیست.",
+  "agentDetail.access.actions.monitoring": "نظارت",
+  "agentDetail.access.copyAccessUrl": "کپی URL دسترسی",
+  "agentDetail.access.copyFailed": "کپی مرجع ناموفق بود.",
+  "agentDetail.access.copyReference": "کپی مرجع برای {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "کپی نقطه پایانی API سرویس",
+  "agentDetail.access.description": "هر سطحی که این عامل از آن قابل دسترسی است.",
+  "agentDetail.access.empty": "هیچ نقطه دسترسی پیوندخورده‌ای وجود ندارد",
+  "agentDetail.access.emptyDescription": "این عامل Roster هنوز مرجع برنامه یا گردش کاری ندارد.",
+  "agentDetail.access.entries.agentApp.description": "برنامه عامل پیوندخورده به این عامل Roster.",
+  "agentDetail.access.entries.agentApp.name": "برنامه عامل",
+  "agentDetail.access.entries.workflow.description": "مرجع گردش کار و گره پیوندخورده به این عامل Roster.",
+  "agentDetail.access.entries.workflow.name": "گره گردش کار",
+  "agentDetail.access.entryCount_one": "{{count}} مورد",
+  "agentDetail.access.entryCount_other": "{{count}} مورد",
+  "agentDetail.access.groups.references.heading": "مراجع",
+  "agentDetail.access.groups.references.label": "مراجع پیوندخورده",
+  "agentDetail.access.learnMore": "اطلاعات بیشتر",
+  "agentDetail.access.moreActions": "اقدامات بیشتر برای {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "نقطه پایانی API سرویس",
+  "agentDetail.access.serviceApi.title": "API سرویس بک‌اند",
+  "agentDetail.access.status.disabled": "غیرفعال",
+  "agentDetail.access.status.enabled": "فعال",
+  "agentDetail.access.status.inService": "در حال سرویس‌دهی",
+  "agentDetail.access.status.outOfService": "خارج از سرویس",
+  "agentDetail.access.title": "نقطه دسترسی",
+  "agentDetail.access.toggleSurface": "تغییر دسترسی {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL دسترسی",
+  "agentDetail.access.webApp.actions.customize": "سفارشی‌سازی",
+  "agentDetail.access.webApp.actions.embedded": "تعبیه‌شده",
+  "agentDetail.access.webApp.actions.launch": "راه‌اندازی",
+  "agentDetail.access.webApp.actions.settings": "تنظیمات",
+  "agentDetail.access.webApp.refreshUrl": "تازه‌سازی URL دسترسی",
+  "agentDetail.access.webApp.showQrCode": "نمایش کد QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO فعال",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "به عنوان یک گره در داخل گردش کار استفاده می‌شود",
+  "agentDetail.access.workflow.empty": "هنوز مرجع گردش کاری وجود ندارد.",
+  "agentDetail.access.workflow.loadFailed": "بارگذاری مراجع گردش کار ناموفق بود.",
+  "agentDetail.access.workflow.loading": "در حال بارگذاری مراجع گردش کار…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} گره",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} گره",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "باز کردن در Studio",
+  "agentDetail.access.workflow.openInStudioFor": "باز کردن {{name}} در Studio",
+  "agentDetail.access.workflow.table.actions": "اقدامات",
+  "agentDetail.access.workflow.table.lastUpdated": "آخرین به‌روزرسانی",
+  "agentDetail.access.workflow.table.name": "نام",
+  "agentDetail.access.workflow.table.nodes": "گره‌ها",
+  "agentDetail.access.workflow.table.version": "نسخه",
+  "agentDetail.access.workflow.title": "دسترسی گردش کار",
+  "agentDetail.configure.advancedSettings.description": "برای کاربران حرفه‌ای. متغیرهای محیطی، sandbox و حافظه.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "افزودن متغیر محیطی",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "حذف {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "پنهان کردن مقدار {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "وارد کردن .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "برای نمایش فایل‌های .env پنهان، در انتخابگر فایل Command + Shift + . را فشار دهید.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "اگر فایل .env شما پنهان است، فایل‌های پنهان را در انتخابگر فایل سیستم خود فعال کنید.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "برای نمایش فایل‌های .env پنهان، Hidden items را در File Explorer فعال کنید.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "نمایش مقدار {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "انتخاب دامنه متغیر محیطی",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "متغیرهای محیطی در دسترس این عامل در زمان اجرا.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "تغییر Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "تنظیمات پیشرفته",
+  "agentDetail.configure.advancedSettings.toggle": "تغییر تنظیمات پیشرفته",
+  "agentDetail.configure.chatFeatures.description": "تجربه چت کاربر نهایی را در Web app و سطوح چت خود شکل دهید.",
+  "agentDetail.configure.chatFeatures.title": "ویژگی‌های چت",
+  "agentDetail.configure.files.add": "افزودن فایل",
+  "agentDetail.configure.files.empty.description": "اسنادی را که عامل می‌تواند بخواند بارگذاری کنید، مانند مشخصات، قالب‌ها یا دستورالعمل‌ها",
+  "agentDetail.configure.files.empty.title": "هنوز فایلی وجود ندارد",
+  "agentDetail.configure.files.label": "فایل‌ها",
+  "agentDetail.configure.files.preview.empty": "محتوای پیش‌نمایش وجود ندارد.",
+  "agentDetail.configure.files.preview.failed": "بارگذاری پیش‌نمایش ناموفق بود.",
+  "agentDetail.configure.files.preview.unsupported": "این فایل از پیش‌نمایش پشتیبانی نمی‌کند.",
+  "agentDetail.configure.files.remove": "حذف {{name}}",
+  "agentDetail.configure.files.tip": "فایل‌هایی که این عامل هنگام هماهنگی وظایف می‌تواند استفاده کند.",
+  "agentDetail.configure.files.toggle": "تغییر فایل‌ها",
+  "agentDetail.configure.files.treeLabel": "فایل‌های عامل",
+  "agentDetail.configure.files.upload.action": "بارگذاری",
+  "agentDetail.configure.files.upload.browse": "مرور",
+  "agentDetail.configure.files.upload.description": "یک فایل برای این عامل بارگذاری کنید.",
+  "agentDetail.configure.files.upload.dropzone": "یک فایل را اینجا رها کنید، یا",
+  "agentDetail.configure.files.upload.failed": "بارگذاری فایل ناموفق بود.",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "یک فایل بارگذاری کنید.",
+  "agentDetail.configure.files.upload.success": "فایل بارگذاری شد.",
+  "agentDetail.configure.files.upload.title": "بارگذاری فایل",
+  "agentDetail.configure.knowledgeRetrieval.add": "افزودن بازیابی دانش",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "افزودن دانش",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "برای افزودن دانش، دکمه “+” را کلیک کنید",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "دانش",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "تنظیمات بازیابی",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "اطلاعات بیشتر درباره بازیابی دانش",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "خودکار",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "شرایط",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "غیرفعال",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "فیلتر کردن فراداده",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "دستی",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "انتخاب حالت فیلتر فراداده",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "نام بازیابی دانش",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "عامل تصمیم می‌گیرد",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "عامل پرس‌وجوی خود را از پرامپت و متن در دسترس می‌نویسد. اینجا چیزی برای تنظیم وجود ندارد.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "پرس‌وجوی سفارشی",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "یک پرس‌وجوی ثابت برای این منبع بازیابی بنویسید.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "متن پرس‌وجوی سفارشی",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "یک پرس‌وجوی جستجو تایپ کنید",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "پرس‌وجو",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "بازیابی دانش · عامل تصمیم می‌گیرد",
+  "agentDetail.configure.knowledgeRetrieval.edit": "ویرایش {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "یک پایگاه دانش متصل کنید که عامل بتواند هنگام پاسخ‌دهی در آن جستجو کند",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "هنوز دانشی وجود ندارد",
+  "agentDetail.configure.knowledgeRetrieval.label": "بازیابی دانش",
+  "agentDetail.configure.knowledgeRetrieval.remove": "حذف {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "منابع بازیابی دانش که این عامل هنگام هماهنگی وظایف می‌تواند استفاده کند.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "تغییر بازیابی دانش",
+  "agentDetail.configure.model.label": "مدل",
+  "agentDetail.configure.orchestrate": "هماهنگ‌سازی",
+  "agentDetail.configure.preview.chatFeatures": "ویژگی‌های چت",
+  "agentDetail.configure.preview.empty.defaultAgentName": "عامل",
+  "agentDetail.configure.preview.empty.description": "برای آزمایش پیش‌نویس فعلی یک پیام ارسال کنید.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "هنوز دستورالعملی وجود ندارد، بنابراین پاسخ‌ها از مدل ساده می‌آیند.",
+  "agentDetail.configure.preview.endUserAuth": "احراز هویت کاربر نهایی",
+  "agentDetail.configure.preview.restart": "راه‌اندازی مجدد پیش‌نمایش",
+  "agentDetail.configure.preview.title": "پیش‌نمایش",
+  "agentDetail.configure.prompt.copied": "پرامپت کپی شد",
+  "agentDetail.configure.prompt.copy": "کپی پرامپت",
+  "agentDetail.configure.prompt.copyFailed": "کپی پرامپت ناموفق بود.",
+  "agentDetail.configure.prompt.insert.label": "درج",
+  "agentDetail.configure.prompt.insert.question": "شروع سؤال",
+  "agentDetail.configure.prompt.insert.reportFile": "فایل گزارش خروجی",
+  "agentDetail.configure.prompt.insert.tenders": "شروع مناقصه‌ها",
+  "agentDetail.configure.prompt.label": "پرامپت",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "اشاره",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "دستورالعمل‌ها را اینجا بنویسید،",
+  "agentDetail.configure.prompt.tip": "تعریف کنید این عامل چگونه ورودی‌ها را تفسیر کند، ابزارها را فراخوانی کند و خروجی تولید کند.",
+  "agentDetail.configure.publishBar.draft": "پیش‌نویس",
+  "agentDetail.configure.publishBar.publishUpdate": "انتشار به‌روزرسانی",
+  "agentDetail.configure.publishBar.published": "منتشر شد",
+  "agentDetail.configure.publishBar.publishedAt": "منتشر شد {{time}}",
+  "agentDetail.configure.publishBar.publishing": "در حال انتشار…",
+  "agentDetail.configure.publishBar.saved": "۵ دقیقه پیش ذخیره شد",
+  "agentDetail.configure.publishBar.savedAt": "ذخیره شد {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "تغییرات منتشرنشده",
+  "agentDetail.configure.publishBar.upToDate": "به‌روز",
+  "agentDetail.configure.publishBar.versionHistory": "باز کردن تاریخچه نسخه",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "گردش‌های کار تحت تأثیر",
+  "agentDetail.configure.publishImpact.cancel": "لغو",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "عامل شما در",
+  "agentDetail.configure.publishImpact.descriptionSuffix": " ظاهر می‌شود. تغییرات بر آن‌ها تأثیر می‌گذارد.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "این عامل",
+  "agentDetail.configure.publishImpact.title": "{{action}} به {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} گردش کار",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} گردش کار",
+  "agentDetail.configure.skills.add": "افزودن مهارت",
+  "agentDetail.configure.skills.detail.contentRegion": "محتوای جزئیات مهارت",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} فایل",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "فایل‌های مهارت",
+  "agentDetail.configure.skills.detail.files": "فایل‌ها",
+  "agentDetail.configure.skills.empty.description": "مهارت‌ها به عامل تخصص قابل استفاده مجدد می‌دهند که هنگام کار می‌تواند فراخوانی کند",
+  "agentDetail.configure.skills.empty.title": "هنوز مهارتی وجود ندارد",
+  "agentDetail.configure.skills.itemType": "مهارت",
+  "agentDetail.configure.skills.label": "مهارت‌ها",
+  "agentDetail.configure.skills.remove": "حذف {{name}}",
+  "agentDetail.configure.skills.tip": "مهارت‌هایی که این عامل هنگام هماهنگی وظایف می‌تواند استفاده کند.",
+  "agentDetail.configure.skills.toggle": "تغییر مهارت‌ها",
+  "agentDetail.configure.skills.upload.action": "بارگذاری",
+  "agentDetail.configure.skills.upload.browse": "مرور",
+  "agentDetail.configure.skills.upload.description": "یک بسته .zip یا .skill برای این عامل بارگذاری کنید.",
+  "agentDetail.configure.skills.upload.dropzone": "یک بسته مهارت را اینجا رها کنید، یا",
+  "agentDetail.configure.skills.upload.failed": "بارگذاری مهارت ناموفق بود.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "یک فایل .zip یا .skill بارگذاری کنید.",
+  "agentDetail.configure.skills.upload.success": "مهارت بارگذاری شد.",
+  "agentDetail.configure.skills.upload.title": "بارگذاری مهارت",
+  "agentDetail.configure.tools.add": "افزودن ابزار",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "برای توسعه‌دهندگان",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "یک برنامه خط فرمان نصب کنید که عامل آن را در sandbox خود اجرا می‌کند. به نصب و معمولاً API Key نیاز دارد.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "ابزار CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "ابزاری را که از قبل در این فضای کاری وجود دارد انتخاب کنید، مانند جستجوی وب یا یکپارچه‌سازی‌ها.",
+  "agentDetail.configure.tools.addMenu.tool.label": "ابزار",
+  "agentDetail.configure.tools.cliDialog.description": "یک ابزار CLI را از هر رجیستری بسته‌ای نصب کنید. عامل به shell باینری‌ای که فراهم می‌کند دسترسی پیدا می‌کند.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "ویرایش ابزار CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "API Keyها، توکن‌ها یا اسرار مورد نیاز این ابزار CLI را ذخیره کنید. مقادیر در حالت ذخیره‌سازی رمزگذاری می‌شوند و هنگام فراخوانی ابزار توسط عامل به عنوان متغیرهای محیطی تزریق می‌شوند.",
+  "agentDetail.configure.tools.cliDialog.env.label": "متغیرهای محیطی",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(اختیاری)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Sandboxed · در اولین فراخوانی یک بار اجرا می‌شود",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "فرمان نصب",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "فرمان نصب خود را اینجا بچسبانید، مثلاً npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "فرمان نصب الزامی است.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "اطلاعات بیشتر درباره ابزار CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "نام ابزار CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "نامی برای ابزار CLI خود بگذارید",
+  "agentDetail.configure.tools.cliDialog.name.required": "نام ابزار CLI الزامی است.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "هرگز در پرامپت عامل قابل مشاهده نیست؛ فقط در زمان اجرا به عنوان $VAR تزریق می‌شود",
+  "agentDetail.configure.tools.cliDialog.title": "افزودن یک ابزار CLI",
+  "agentDetail.configure.tools.cliTool": "ابزار CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "کاربر نهایی · OAuth",
+  "agentDetail.configure.tools.editAction": "ویرایش {{name}}",
+  "agentDetail.configure.tools.empty.description": "ابزارها به عامل اجازه می‌دهند عمل کند، مانند جستجوی وب یا فراخوانی برنامه‌های شما",
+  "agentDetail.configure.tools.empty.title": "هنوز ابزاری وجود ندارد",
+  "agentDetail.configure.tools.label": "ابزارها",
+  "agentDetail.configure.tools.moreActions": "اقدامات بیشتر برای {{name}}",
+  "agentDetail.configure.tools.pluginType": "افزونه",
+  "agentDetail.configure.tools.preAuthorize": "پیش‌مجوز",
+  "agentDetail.configure.tools.removeAction": "حذف {{name}}",
+  "agentDetail.configure.tools.removeProvider": "حذف همه ابزارها",
+  "agentDetail.configure.tools.tip": "ابزارهایی که این عامل هنگام هماهنگی وظایف می‌تواند فراخوانی کند.",
+  "agentDetail.configure.tools.toggle": "تغییر ابزارها",
+  "agentDetail.configure.tools.toolTabs.all": "همه",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "سفارشی",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "افزونه‌ها",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "عامل",
+  "agentDetail.history": "تاریخچه",
+  "agentDetail.logs.description": "گزارش‌های کامل وضعیت اجرای برنامه را ثبت می‌کنند، از جمله ورودی‌های کاربر، پاسخ‌های عامل، برنامه‌ریزی و استفاده از ابزار.",
+  "agentDetail.logs.empty": "هیچ گزارشی یافت نشد",
+  "agentDetail.logs.filters.period.allTime": "همه زمان‌ها",
+  "agentDetail.logs.filters.period.label": "دوره گزارش",
+  "agentDetail.logs.filters.period.last30days": "۳۰ روز گذشته",
+  "agentDetail.logs.filters.period.last7days": "۷ روز گذشته",
+  "agentDetail.logs.filters.search.label": "جستجوی گزارش‌ها",
+  "agentDetail.logs.filters.search.placeholder": "جستجو",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "آخرین زمان ایجاد",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "آخرین زمان به‌روزرسانی",
+  "agentDetail.logs.filters.source.all": "منبع",
+  "agentDetail.logs.filters.source.empty": "منبعی پیدا نشد",
+  "agentDetail.logs.filters.source.label": "منبع گزارش",
+  "agentDetail.logs.filters.source.loadFailed": "بارگیری منابع ناموفق بود",
+  "agentDetail.logs.filters.source.loading": "در حال بارگیری منابع…",
+  "agentDetail.logs.filters.source.searchLabel": "جستجوی منابع",
+  "agentDetail.logs.filters.source.searchPlaceholder": "جستجو",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "گردش کار",
+  "agentDetail.logs.learnMore": "اطلاعات بیشتر",
+  "agentDetail.logs.loadFailed": "بارگیری گزارش‌ها ناموفق بود",
+  "agentDetail.logs.loading": "در حال بارگیری گزارش‌ها…",
+  "agentDetail.logs.notAvailable": "ناموجود",
+  "agentDetail.logs.table.createdTime": "زمان ایجاد",
+  "agentDetail.logs.table.endUser": "کاربر نهایی",
+  "agentDetail.logs.table.messageCount": "تعداد پیام",
+  "agentDetail.logs.table.operationRate": "نرخ عملیات",
+  "agentDetail.logs.table.source": "منبع",
+  "agentDetail.logs.table.title": "عنوان",
+  "agentDetail.logs.table.unread": "خوانده‌نشده",
+  "agentDetail.logs.table.updatedTime": "زمان به‌روزرسانی",
+  "agentDetail.logs.table.userRate": "نرخ کاربر",
+  "agentDetail.logs.title": "گزارش‌ها",
+  "agentDetail.memorySettings.budgetLabel": "بودجه حافظه",
+  "agentDetail.memorySettings.description": "تنظیمات حافظه از عکس فوری پیکربندی فعال.",
+  "agentDetail.memorySettings.export.description": "صادرات حافظه برای انتشار بعدی برنامه‌ریزی شده است.",
+  "agentDetail.memorySettings.export.download": "دانلود",
+  "agentDetail.memorySettings.export.soon": "به‌زودی",
+  "agentDetail.memorySettings.export.title": "صادر کردن حافظه فعلی",
+  "agentDetail.memorySettings.notConfigured": "پیکربندی نشده",
+  "agentDetail.memorySettings.scopeLabel": "دامنه حافظه",
+  "agentDetail.memorySettings.title": "حافظه",
+  "agentDetail.metadata.activeVersionLabel": "نسخه فعال",
+  "agentDetail.metadata.appIdLabel": "شناسه برنامه",
+  "agentDetail.metadata.description": "فیلدهای Roster فقط‌خواندنی که توسط بک‌اند عامل برگردانده می‌شوند.",
+  "agentDetail.metadata.emptyValue": "در دسترس نیست",
+  "agentDetail.metadata.scopeLabel": "دامنه",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "فقط گردش کار",
+  "agentDetail.metadata.sourceLabel": "منبع",
+  "agentDetail.metadata.statusLabel": "وضعیت",
+  "agentDetail.metadata.title": "فراداده",
+  "agentDetail.metadata.updatedAtLabel": "به‌روزرسانی شده در",
+  "agentDetail.metadata.workflowIdLabel": "شناسه گردش کار",
+  "agentDetail.metadata.workflowNodeIdLabel": "شناسه گره گردش کار",
+  "agentDetail.monitoring.change": "{{value}} نسبت به دوره قبل",
+  "agentDetail.monitoring.dateRangeLabel": "بازه تاریخ",
+  "agentDetail.monitoring.description": "فعالیت، هزینه و کیفیت تعامل عامل قابل استفاده مجدد را در گردش‌های کار دنبال کنید.",
+  "agentDetail.monitoring.learnMore": "اطلاعات بیشتر",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "کاربران نهایی منحصربه‌فردی که با استفاده از این عامل گردش کارها را راه‌اندازی کرده‌اند.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "کاربران فعال",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "تعداد ارتباط مداوم کاربر-عامل برای این نقطه دسترسی.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "میانگین تعامل جلسه",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "میانگین سرعت خروجی از شروع درخواست تا تکمیل.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "سرعت خروجی توکن",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "هزینه تخمینی توکن تولیدشده توسط این عامل در اجرای گردش‌های کار.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "مصرف توکن",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "مکالمات روزانه AI که از طریق نقطه دسترسی انتخاب‌شده به این عامل رسیده‌اند.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "کل مکالمات",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "تعداد تعامل روزانه عامل.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "کل پیام‌ها",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "تعداد لایک‌ها به ازای ۱۰۰۰ پیام برای این عامل.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "نرخ رضایت کاربر",
+  "agentDetail.monitoring.pickSource": "یک برنامه انتخاب کنید",
+  "agentDetail.monitoring.sourceLabel": "برنامه",
+  "agentDetail.monitoring.sourceTrigger": "منبع {{name}}",
+  "agentDetail.monitoring.sources.all": "همه",
+  "agentDetail.monitoring.timeRangeLabel": "بازه زمانی",
+  "agentDetail.monitoring.timeRanges.custom": "سفارشی",
+  "agentDetail.monitoring.timeRanges.last30days": "۳۰ روز گذشته",
+  "agentDetail.monitoring.timeRanges.last7days": "۷ روز گذشته",
+  "agentDetail.monitoring.timeRanges.today": "امروز",
+  "agentDetail.monitoring.title": "نظارت",
+  "agentDetail.monitoring.tokenUsageConsumed": "توکن‌های مصرف‌شده",
+  "agentDetail.monitoring.units.tokenPerSecond": "توکن/ثانیه",
+  "agentDetail.navigationLabel": "ناوبری عامل",
+  "agentDetail.publish": "انتشار",
+  "agentDetail.publishSoon": "به‌زودی",
+  "agentDetail.sections.access": "نقطه دسترسی",
+  "agentDetail.sections.configure": "هماهنگ‌سازی",
+  "agentDetail.sections.logs": "گزارش‌ها",
+  "agentDetail.sections.monitoring": "نظارت",
+  "agentDetail.subtitle": "شناسه عامل: {{agentId}}",
+  "agentDetail.title": "عامل",
+  "agentDetail.type": "عامل",
+  "agentDetail.versionHistory.active": "فعال",
+  "agentDetail.versionHistory.empty": "هنوز نسخه‌ای وجود ندارد",
+  "agentDetail.versionHistory.filter": "فیلتر نسخه‌ها",
+  "agentDetail.versionHistory.versionName": "نسخه {{version}}",
+  "roster.createAgent": "ایجاد عامل",
+  "roster.createAgentOptions": "گزینه‌های ایجاد عامل",
+  "roster.createDialog.description": "یک عامل قابل استفاده مجدد در Roster این فضای کاری ایجاد کنید.",
+  "roster.createDialog.title": "ایجاد عامل",
+  "roster.createForm.changeIcon": "تغییر آیکون عامل",
+  "roster.createForm.descriptionLabel": "توضیحات",
+  "roster.createForm.descriptionOptional": "(اختیاری)",
+  "roster.createForm.descriptionPlaceholder": "مثلاً منابعی درباره یک موضوع جمع‌آوری می‌کند و یافته‌های کلیدی را خلاصه می‌کند",
+  "roster.createForm.nameLabel": "نام",
+  "roster.createForm.namePlaceholder": "مثلاً Max",
+  "roster.createForm.nameRequired": "نام الزامی است.",
+  "roster.createForm.roleLabel": "نقش",
+  "roster.createForm.rolePlaceholder": "مثلاً دستیار پژوهش",
+  "roster.createForm.roleRequired": "نقش الزامی است.",
+  "roster.createSuccess": "عامل ایجاد شد.",
+  "roster.dateTimeFormat": "YYYY/MM/DD HH:mm:ss",
+  "roster.deleteDialog.description": "این عامل از فهرست Roster فعال حذف خواهد شد.",
+  "roster.deleteDialog.title": "حذف {{name}}؟",
+  "roster.deleteFailed": "حذف عامل ناموفق بود.",
+  "roster.deleteSuccess": "عامل حذف شد.",
+  "roster.duplicateFailed": "تکثیر عامل ناموفق بود.",
+  "roster.duplicateSuccess": "عامل تکثیر شد.",
+  "roster.editAgent": "ویرایش {{name}}",
+  "roster.editDialog.description": "نام، توضیحات و نقش Roster این عامل را به‌روزرسانی کنید.",
+  "roster.editDialog.title": "ویرایش عامل",
+  "roster.editInfo": "ویرایش اطلاعات",
+  "roster.empty": "هنوز عاملی وجود ندارد",
+  "roster.emptyDescription": "عوامل ذخیره‌شده در این فضای کاری اینجا ظاهر می‌شوند.",
+  "roster.emptySearch": "هیچ عامل مطابقی نیست",
+  "roster.emptySearchDescription": "نام دیگری از عامل را امتحان کنید.",
+  "roster.filters.all": "همه",
+  "roster.filters.drafts": "پیش‌نویس‌ها",
+  "roster.filters.label": "فیلترهای عامل",
+  "roster.filters.published": "منتشر شده",
+  "roster.learnMore": "اطلاعات بیشتر درباره Agent Roster",
+  "roster.listLabel": "فهرست Roster عامل‌ها",
+  "roster.loadMore": "بارگذاری بیشتر",
+  "roster.loadingError": "بارگذاری عوامل ناموفق بود. تازه‌سازی کنید و دوباره امتحان کنید.",
+  "roster.moreActions": "اقدامات بیشتر برای {{name}}",
+  "roster.nodeSelector.createInlineFailed": "ایجاد عامل inline ناموفق بود. تازه‌سازی کنید و دوباره امتحان کنید.",
+  "roster.nodeSelector.dialogLabel": "یک عامل انتخاب کنید",
+  "roster.nodeSelector.manageInAgentConsole": "مدیریت در Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "جستجو…",
+  "roster.nodeSelector.startFromScratch": "از صفر شروع کنید",
+  "roster.references.label": "گردش‌های کار با استفاده از {{name}}",
+  "roster.references.trigger": "گردش‌های کار با استفاده از {{name}}",
+  "roster.searchLabel": "جستجوی عوامل",
+  "roster.searchPlaceholder": "جستجوی عوامل بر اساس نام…",
+  "roster.sources.agent_app": "برنامه عامل",
+  "roster.sources.imported": "وارد شده",
+  "roster.sources.system": "سیستم",
+  "roster.sources.workflow": "گردش کار",
+  "roster.status.active": "فعال",
+  "roster.status.archived": "بایگانی‌شده",
+  "roster.tabs.agent": "عامل",
+  "roster.tabs.human": "انسان",
+  "roster.tabsLabel": "نوع Roster",
+  "roster.updateSuccess": "عامل به‌روزرسانی شد.",
+  "roster.usageStatus.draft": "پیش‌نویس"
+}
diff --git a/web/i18n/fa-IR/app-log.json b/web/i18n/fa-IR/app-log.json
index d27a5b0cc41..4c6e6e1f2ce 100644
--- a/web/i18n/fa-IR/app-log.json
+++ b/web/i18n/fa-IR/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "امروز",
   "filter.period.yearToDate": "از ابتدای سال تاکنون",
   "filter.sortBy": "مرتب‌سازی بر اساس:",
+  "monitoring.description": "مانیتورینگ وضعیت اجرای برنامه را ثبت می‌کند، از جمله عملکرد، فعالیت کاربران و هزینه‌ها.",
   "promptLog": "لاگ درخواست",
   "runDetail.fileListDetail": "جزئیات",
   "runDetail.fileListLabel": "جزئیات فایل",
diff --git a/web/i18n/fa-IR/billing.json b/web/i18n/fa-IR/billing.json
index 42daee9bf84..6e81d5edef8 100644
--- a/web/i18n/fa-IR/billing.json
+++ b/web/i18n/fa-IR/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "ارتقا دهید تا امکان بارگذاری دسته‌ای اسناد فعال شود",
   "upgrade.uploadMultiplePages.description": "شما به حد آپلود رسیده‌اید — در طرح فعلی خود تنها می‌توانید یک سند را در هر بار انتخاب و آپلود کنید.",
   "upgrade.uploadMultiplePages.title": "ارتقا برای آپلود همزمان چندین سند",
+  "upgrade.workflowRestore.description": "بازیابی نسخه‌های گردش‌کار در طرح فعلی شما در دسترس نیست.",
+  "upgrade.workflowRestore.title": "برای بازیابی نسخه‌های گردش‌کار ارتقا دهید",
   "upgradeBtn.encourage": "هم اکنون ارتقاء دهید",
   "upgradeBtn.encourageShort": "ارتقاء دهید",
   "upgradeBtn.plain": "ارتقاء طرح",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index f4c4529206c..5ed801fe2a2 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "تغییر فضای کاری",
   "mcpPage.description": "سرورهای MCP را وصل و مدیریت کنید تا برنامه‌های شما به ابزارها و سرویس‌های خارجی دسترسی داشته باشند.",
-  "members.admin": "مدیر",
   "members.adminTip": "می‌تواند برنامه‌ها را بسازد و تنظیمات تیم را مدیریت کند",
+  "members.alreadyInTeam": "در حال حاضر در تیم است",
+  "members.alreadyInTeamTip": "این کاربران از قبل به این فضای کاری دسترسی دارند.",
   "members.builder": "سازنده",
   "members.builderTip": "می‌تواند برنامه‌های خود را بسازد و ویرایش کند",
-  "members.datasetOperator": "مدیر دانش",
   "members.datasetOperatorTip": "فقط می‌تواند پایگاه دانش را مدیریت کند",
   "members.deleteMember": "حذف عضو",
   "members.disInvite": "لغو دعوت",
-  "members.editor": "ویرایشگر",
   "members.editorTip": "می‌تواند برنامه‌ها را بسازد و ویرایش کند",
   "members.email": "ایمیل",
   "members.emailInvalid": "فرمت ایمیل نامعتبر است",
@@ -270,13 +269,12 @@
   "members.invite": "افزودن",
   "members.inviteTeamMember": "افزودن عضو تیم",
   "members.inviteTeamMemberTip": "آنها می‌توانند پس از ورود به سیستم، مستقیماً به داده‌های تیم شما دسترسی پیدا کنند.",
-  "members.invitedAsRole": "به عنوان کاربر {{role}} دعوت شده",
+  "members.invitedAsRole": "به عنوان {{role}} دعوت شده",
   "members.lastActive": "آخرین فعالیت",
   "members.name": "نام",
-  "members.normal": "عادی",
+  "members.noNewInvitationsSent": "هیچ دعوت‌نامه جدیدی ارسال نشد",
   "members.normalTip": "فقط می‌تواند از برنامه‌ها استفاده کند، نمی‌تواند برنامه بسازد",
   "members.ok": "تایید",
-  "members.owner": "مالک",
   "members.pending": "در انتظار...",
   "members.removeFromTeam": "حذف از تیم",
   "members.removeFromTeamTip": "دسترسی تیم را حذف می‌کند",
@@ -311,12 +309,14 @@
   "menus.apps": "استودیو",
   "menus.datasets": "دانش",
   "menus.datasetsTips": "به زودی: داده‌های متنی خود را وارد کنید یا از طریق Webhook داده‌ها را در زمان واقعی برای بهبود زمینه LLM بنویسید.",
+  "menus.deployments": "استقرارها",
   "menus.explore": "کاوش",
   "menus.exploreMarketplace": "بازار را کاوش کنید",
   "menus.newApp": "برنامه جدید",
   "menus.newDataset": "ایجاد دانش",
   "menus.plugins": "یکپارچه‌سازی‌ها",
   "menus.pluginsTips": "یکپارچه‌سازی‌های شخص ثالث را ادغام کنید یا یکپارچه‌سازی‌های هوش مصنوعی سازگار با ChatGPT ایجاد کنید.",
+  "menus.roster": "فهرست عامل‌ها",
   "menus.status": "بتا",
   "menus.tools": "ابزارها",
   "model.addMoreModel": "برای افزودن مدل‌های بیشتر به تنظیمات بروید",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "مدل تبدیل متن به گفتار",
   "modelProvider.ttsModel.tip": "مدل پیش‌فرض را برای ورودی متن به گفتار در مکالمه تنظیم کنید.",
   "modelProvider.upgradeForLoadBalancing": "برای فعال کردن تعادل بار، طرح خود را ارتقا دهید.",
+  "navigation.skipToMain": "پرش به محتوای اصلی",
   "noData": "بدون داده",
   "operation.add": "افزودن",
   "operation.added": "اضافه شد",
@@ -600,9 +601,6 @@
   "placeholder.input": "لطفا وارد کنید",
   "placeholder.search": "جستجو...",
   "placeholder.select": "لطفا انتخاب کنید",
-  "plugin.serpapi.apiKey": "کلید API",
-  "plugin.serpapi.apiKeyPlaceholder": "کلید API خود را وارد کنید",
-  "plugin.serpapi.keyFrom": "کلید SerpAPI خود را از صفحه حساب SerpAPI دریافت کنید",
   "promptEditor.context.item.desc": "درج الگوی زمینه",
   "promptEditor.context.item.title": "زمینه",
   "promptEditor.context.modal.add": "افزودن زمینه",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
new file mode 100644
index 00000000000..263949a3b49
--- /dev/null
+++ b/web/i18n/fa-IR/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API سرویس بک‌اند",
+  "access.api.copyCurlExample": "کپی نمونه cURL",
+  "access.api.createFailed": "تولید API Token ناموفق بود.",
+  "access.api.createKey": "تولید API Token",
+  "access.api.createKeyTitle": "تولید API Token جدید",
+  "access.api.curlExampleTitle": "نمونه cURL",
+  "access.api.description": "دسترسی به این استقرار از طریق HTTP. هر API Token محدود به یک محیط است.",
+  "access.api.developerTitle": "API توسعه‌دهنده",
+  "access.api.disabled": "دسترسی API برای این استقرار خاموش است.",
+  "access.api.disabledHint": "دسترسی API را فعال کنید تا توکن‌های محدود به محیط تولید شود.",
+  "access.api.dismissToken": "رد کردن API Token",
+  "access.api.docs": "مستندات API",
+  "access.api.docsClose": "بستن مستندات API",
+  "access.api.docsDescription": "مرجع Workflow API را برای این استقرار مشاهده کنید.",
+  "access.api.docsTitle": "مستندات Workflow API",
+  "access.api.empty": "ابتدا در یک محیط مستقر شوید تا شروع به صدور API Token کنید.",
+  "access.api.emptyTitle": "هیچ محیط مستقر شده‌ای وجود ندارد",
+  "access.api.endpoint": "URL درخواست",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "فهرست API Token",
+  "access.api.nameLabel": "نام API Token",
+  "access.api.namePlaceholder": "نام یک API Token را وارد کنید",
+  "access.api.nameRequired": "نام API Token الزامی است.",
+  "access.api.newKey": "تولید API Token جدید",
+  "access.api.newTokenDescription": "این API Token فقط یک بار نمایش داده می‌شود. قبل از ترک این صفحه آن را کپی کنید.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token تولید شد",
+  "access.api.noKeys": "هنوز API Token‌ای وجود ندارد. یکی تولید کنید تا شروع به فراخوانی API کنید.",
+  "access.api.noKeysTitle": "هنوز API Token‌ای وجود ندارد",
+  "access.api.revokeConfirmDescription": "API Token \"{{name}}\" بلافاصله از کار می‌افتد. این عمل قابل بازگشت نیست.",
+  "access.api.revokeConfirmTitle": "لغو API Token؟",
+  "access.api.revokeFailed": "لغو API Token ناموفق بود.",
+  "access.api.revokeSuccess": "API Token لغو شد",
+  "access.api.table.action": "عملیات",
+  "access.api.table.environment": "محیط",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "نام",
+  "access.api.title": "API",
+  "access.channels.col.channel": "کانال",
+  "access.channels.col.endpoint": "نقطه ورود",
+  "access.channels.col.status": "وضعیت",
+  "access.channels.description": "نقاط ورود WebApp و CLI از مجوزهای دسترسی بالا استفاده می‌کنند.",
+  "access.channels.disabled": "کانال‌های دسترسی برای این استقرار خاموش هستند.",
+  "access.channels.disabledHint": "کانال‌های دسترسی را فعال کنید تا نقاط ورود WebApp و CLI را در دسترس قرار دهید.",
+  "access.channels.followPermission": "از مجوزها پیروی می‌کند",
+  "access.channels.title": "کانال‌های دسترسی",
+  "access.cli.description": "از ترمینال با difyctl فراخوانی کنید، مناسب برای اسکریپت‌ها، Workflow‌های خودکار یا یکپارچه‌سازی‌های Agent.",
+  "access.cli.docs": "راهنمای استفاده",
+  "access.cli.domain": "دامنه",
+  "access.cli.empty": "نقطه پایانی CLI پیکربندی نشده است.",
+  "access.cli.install": "نصب CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "کپی شد",
+  "access.copy": "کپی",
+  "access.copyFailed": "کپی ناموفق بود",
+  "access.copyToast": "در کلیپ‌بورد کپی شد",
+  "access.hide": "پنهان کردن",
+  "access.members.clearAll": "پاک کردن همه",
+  "access.members.empty": "هیچ موردی یافت نشد.",
+  "access.members.groupCount_one": "{{count}} گروه",
+  "access.members.groupCount_other": "{{count}} گروه",
+  "access.members.groups": "گروه‌ها",
+  "access.members.individuals": "اعضا",
+  "access.members.memberCount_one": "{{count}} عضو",
+  "access.members.memberCount_other": "{{count}} عضو",
+  "access.members.pickPlaceholder": "گروه‌ها یا اعضا را انتخاب کنید",
+  "access.members.searchPlaceholder": "جستجوی گروه‌ها و اعضا",
+  "access.members.selectedLabel": "انتخاب شده",
+  "access.permission.anyone": "هر کسی که لینک را داشته باشد",
+  "access.permission.anyoneDesc": "هر کسی می‌تواند بدون ورود به این استقرار دسترسی داشته باشد.",
+  "access.permission.memberCount_one": "{{count}} عضو",
+  "access.permission.memberCount_other": "{{count}} عضو",
+  "access.permission.organization": "همه اعضای داخل پلتفرم",
+  "access.permission.organizationDesc": "همه اعضای داخل پلتفرم",
+  "access.permission.specific": "اعضای مشخص داخل پلتفرم",
+  "access.permission.specificDesc": "گروه‌ها یا اعضای مشخصی را انتخاب کنید",
+  "access.permission.specificUnavailable": "انتخاب اعضای مشخص تا زمانی که اعضا و گروه‌های واقعی پلتفرم متصل نشده‌اند غیرفعال است.",
+  "access.permission.updateFailed": "به‌روزرسانی سیاست دسترسی ناموفق بود.",
+  "access.permissions.col.environment": "محیط",
+  "access.permissions.col.permission": "دسترسی",
+  "access.permissions.description": "مجوزهای دسترسی را برای نقاط ورود WebApp و CLI در هر محیط تنظیم کنید.",
+  "access.permissions.editAriaLabel": "پیکربندی دسترسی برای {{environment}}",
+  "access.permissions.editDescription": "مجوزهای دسترسی را برای نقاط ورود WebApp و CLI تنظیم کنید.",
+  "access.permissions.editTitle": "مجوزهای دسترسی",
+  "access.permissions.title": "مجوزهای دسترسی",
+  "access.revoke": "لغو",
+  "access.runAccess.description": "نحوه اجرای این استقرار توسط کاربران و افراد مجاز برای دسترسی در هر محیط را مدیریت کنید.",
+  "access.runAccess.disabled": "دسترسی اجرا برای این استقرار خاموش است.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "این استقرار را به‌عنوان سرور Model Context Protocol در دسترس قرار دهید.",
+  "access.runAccess.mcpEmpty": "نقطه پایانی MCP پیکربندی نشده است.",
+  "access.runAccess.noEnvs": "برای پیکربندی مجوزهای دسترسی، در یک محیط مستقر شوید.",
+  "access.runAccess.noEnvsTitle": "هیچ محیط مستقر شده‌ای وجود ندارد",
+  "access.runAccess.openWebapp": "باز کردن WebApp",
+  "access.runAccess.permissions": "مجوزهای دسترسی",
+  "access.runAccess.permissionsDesc": "چه کسی می‌تواند در هر محیط به این استقرار دسترسی داشته باشد.",
+  "access.runAccess.title": "دسترسی اجرا",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "صفحه وب میزبانی شده برای کاربران نهایی.",
+  "access.runAccess.webappEmpty": "به زودی.",
+  "access.show": "نمایش",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "خارجی",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "ناشناخته",
+  "card.access.api": "API Token‌ها",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "بدون دسترسی",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "ایجاد اولین نسخه",
+  "card.deploy": "استقرار",
+  "card.deploying": "{{count}} در حال استقرار",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} ناموفق",
+  "card.fromApp": "از {{name}}",
+  "card.lastDeployed": "آخرین استقرار {{time}}",
+  "card.menu.delete": "حذف استقرار",
+  "card.menu.deleteDisabled": "حذف استقرار برای استقرارهای مدیریت‌شده توسط بک‌اند هنوز در دسترس نیست.",
+  "card.menu.deploy": "استقرار به محیط",
+  "card.menu.editInfo": "ویرایش اطلاعات",
+  "card.menu.viewDetail": "مشاهده جزئیات استقرار",
+  "card.moreActions": "اقدامات بیشتر",
+  "card.neverDeployed": "هنوز مستقر نشده",
+  "card.noDescription": "توضیحاتی ارائه نشده است.",
+  "card.notDeployed": "مستقر نشده",
+  "card.ready": "{{count}} در حال اجرا",
+  "card.tooltip.createdAt": "ایجاد شده",
+  "card.tooltip.deployed": "مستقر شده",
+  "card.tooltip.deploymentStatus": "استقرار",
+  "card.tooltip.notDeployed": "این استقرار هنوز در هیچ محیطی مستقر نشده است.",
+  "card.tooltip.notDeployedShort": "مستقر نشده",
+  "card.tooltip.release": "نسخه",
+  "card.tooltip.releaseName": "نام نسخه",
+  "card.tooltip.source": "منبع",
+  "common.loadFailed": "بارگذاری ناموفق بود. بعداً دوباره تلاش کنید.",
+  "common.loading": "در حال بارگذاری...",
+  "createGuide.actions.back": "بازگشت",
+  "createGuide.actions.cancel": "لغو",
+  "createGuide.actions.continue": "ادامه",
+  "createGuide.actions.createAndDeploy": "ایجاد و استقرار",
+  "createGuide.actions.creating": "در حال ایجاد...",
+  "createGuide.actions.deploy": "استقرار",
+  "createGuide.actions.deploying": "در حال ایجاد و استقرار...",
+  "createGuide.actions.next": "بعدی",
+  "createGuide.actions.skipDeploy": "رد کردن، بعداً مستقر شود",
+  "createGuide.description": "یک استقرار را از منبع نسخه، اطلاعات اولیه و محیط هدف ایجاد کنید.",
+  "createGuide.dsl.defaultAppName": "برنامه DSL وارد شده",
+  "createGuide.dsl.description": "یک بسته Workflow DSL را برای ایجاد استقرار، اولین نسخه و استقرار اختیاری محیط بارگذاری کنید.",
+  "createGuide.dsl.dropDescription": "یک بسته Workflow YAML DSL را بارگذاری کنید. گزینه‌های استقرار قبل از استقرار از این فایل حل می‌شوند.",
+  "createGuide.dsl.dropTitle": "بارگذاری بسته Workflow DSL",
+  "createGuide.dsl.readFailed": "خواندن فایل DSL ناموفق بود. فایل دیگری را انتخاب کرده و دوباره تلاش کنید.",
+  "createGuide.dsl.reading": "در حال خواندن فایل DSL...",
+  "createGuide.dsl.title": "وارد کردن DSL",
+  "createGuide.dsl.unsupportedMode": "فقط فایل‌های Workflow DSL می‌توانند برای استقرار استفاده شوند.",
+  "createGuide.errors.createReleaseFailed": "ایجاد استقرار یا نسخه ناموفق بود.",
+  "createGuide.errors.deployFailed": "استقرار در محیط ناموفق بود.",
+  "createGuide.method.description": "منبع مورد استفاده برای ایجاد اولین نسخه را انتخاب کنید.",
+  "createGuide.methods.bindApp.description": "از یک Workflow App موجود در Studio به‌عنوان منبع نسخه استفاده کنید.",
+  "createGuide.methods.bindApp.title": "اتصال Workflow App موجود",
+  "createGuide.methods.importDsl.description": "یک بسته Workflow YAML DSL را بارگذاری کنید و از طریق رابط کاربری استقرار ادامه دهید.",
+  "createGuide.methods.importDsl.title": "وارد کردن DSL",
+  "createGuide.methods.mocked": "شبیه‌سازی شده",
+  "createGuide.nav.back": "استقرارها",
+  "createGuide.release.defaultName": "نسخه اولیه",
+  "createGuide.release.deployInfo": "اطلاعات استقرار",
+  "createGuide.release.description": "اطلاعات استقرار و جزئیات اولین نسخه را پر کنید.",
+  "createGuide.release.firstVersion": "اولین نسخه",
+  "createGuide.release.instanceDescription": "توضیحات استقرار",
+  "createGuide.release.instanceDescriptionPlaceholder": "توضیح دهید این استقرار برای چه چیزی استفاده می‌شود",
+  "createGuide.release.instanceName": "نام استقرار",
+  "createGuide.release.instanceNameConflict": "یک استقرار با این نام در حال حاضر وجود دارد. نام دیگری انتخاب کنید.",
+  "createGuide.release.releaseDescription": "توضیحات نسخه",
+  "createGuide.release.releaseDescriptionPlaceholder": "این نسخه را توصیف کنید",
+  "createGuide.release.releaseName": "نام نسخه",
+  "createGuide.release.releaseNote": "توضیحات نسخه",
+  "createGuide.release.title": "اطلاعات اولیه",
+  "createGuide.source.availableApps_one": "{{count}} برنامه",
+  "createGuide.source.availableApps_other": "{{count}} برنامه",
+  "createGuide.source.clearSearch": "پاک کردن جستجوی برنامه",
+  "createGuide.source.description": "منبع مورد استفاده برای ایجاد اولین نسخه را انتخاب کنید.",
+  "createGuide.source.empty": "هیچ Workflow App یافت نشد.",
+  "createGuide.source.searchPlaceholder": "جستجوی برنامه‌ها",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "منبع نسخه",
+  "createGuide.steps.method": "منبع نسخه",
+  "createGuide.steps.release": "اطلاعات اولیه",
+  "createGuide.steps.source": "منبع نسخه",
+  "createGuide.steps.target": "استقرار به محیط",
+  "createGuide.target.bindingCount_one": "{{count}} اتصال",
+  "createGuide.target.bindingCount_other": "{{count}} اتصال",
+  "createGuide.target.bindingHint": "اعتبارنامه‌های مورد استفاده توسط این نسخه را انتخاب کنید.",
+  "createGuide.target.bindings": "اعتبارنامه‌ها",
+  "createGuide.target.deferredBindingHint": "اعتبارنامه‌ها در طول عملیات نهایی استقرار از طرح استقرار واقعی حل خواهند شد.",
+  "createGuide.target.deferredEnvironmentHint": "نام پس از ایجاد استقرار و نسخه با محیط‌های واقعی مطابقت داده می‌شود.",
+  "createGuide.target.description": "یک محیط هدف را انتخاب کنید و تنظیمات زمان اجرایی که این نسخه در آنجا نیاز دارد را ارائه دهید. این مرحله می‌تواند رد شود.",
+  "createGuide.target.envVarCount_one": "{{count}} متغیر",
+  "createGuide.target.envVarCount_other": "{{count}} متغیر",
+  "createGuide.target.envVarHint": "برای هر متغیر محیطی که این نسخه نیاز دارد، یک مقدار سفارشی وارد کنید یا از مقدار تعریف شده در برنامه استفاده کنید.",
+  "createGuide.target.envVarPlaceholder": "مقدار را وارد کنید",
+  "createGuide.target.envVarSource.ariaLabel": "منبع مقدار متغیر را برای {{key}} انتخاب کنید",
+  "createGuide.target.envVarSource.default": "مقدار برنامه",
+  "createGuide.target.envVarSource.lastDeployment": "آخرین مقدار مستقر شده",
+  "createGuide.target.envVarSource.literal": "مقدار سفارشی",
+  "createGuide.target.envVarType.number": "عدد",
+  "createGuide.target.envVarType.secret": "محرمانه",
+  "createGuide.target.envVarType.string": "رشته",
+  "createGuide.target.envVars": "متغیرهای محیطی",
+  "createGuide.target.environment": "محیط هدف",
+  "createGuide.target.environmentName": "نام محیط",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "بارگذاری اعتبارنامه‌ها ناموفق بود.",
+  "createGuide.target.loadEnvironmentsFailed": "بارگذاری محیط‌های استقرار ناموفق بود.",
+  "createGuide.target.missingRequiredBinding": "یک اعتبارنامه برای این اتصال الزامی انتخاب کنید.",
+  "createGuide.target.noBindingRequired": "اعتبارنامه‌ای لازم نیست.",
+  "createGuide.target.noCredentialCandidates": "اعتبارنامه‌ای در دسترس نیست.",
+  "createGuide.target.noEnvironmentOptions": "هیچ محیط استقراری در دسترس نیست.",
+  "createGuide.target.required": "الزامی",
+  "createGuide.target.selectCredential": "یک اعتبارنامه انتخاب کنید",
+  "createGuide.target.title": "استقرار به محیط",
+  "createGuide.title": "استقرار جدید",
+  "createModal.appPickerPlaceholder": "یک Workflow App انتخاب کنید",
+  "createModal.appSearchEmpty": "هیچ Workflow App منطبقی یافت نشد",
+  "createModal.appSearchPlaceholder": "جستجوی Workflow App‌ها…",
+  "createModal.cancel": "لغو",
+  "createModal.create": "ایجاد",
+  "createModal.createFailed": "ایجاد استقرار ناموفق بود.",
+  "createModal.description": "یک Workflow App را انتخاب کنید و استقرار ایجاد کنید.",
+  "createModal.descriptionLabel": "توضیحات",
+  "createModal.descriptionPlaceholder": "توضیح دهید این استقرار برای چه چیزی استفاده می‌شود",
+  "createModal.loadMoreApps": "بارگذاری برنامه‌های بیشتر",
+  "createModal.loadingApps": "در حال بارگذاری برنامه‌ها…",
+  "createModal.nameLabel": "نام استقرار",
+  "createModal.namePlaceholder": "نام استقرار",
+  "createModal.noApps": "هیچ Workflow App در این فضای کاری یافت نشد. ابتدا یکی در Studio ایجاد کنید.",
+  "createModal.selected": "انتخاب شده",
+  "createModal.sourceApp": "Workflow App (الزامی)",
+  "createModal.title": "استقرار جدید",
+  "deployDrawer.bindingCount_one": "{{count}} اتصال",
+  "deployDrawer.bindingCount_other": "{{count}} اتصال",
+  "deployDrawer.bindingOptionsFailed": "بارگذاری گزینه‌های اعتبارنامه ناموفق بود.",
+  "deployDrawer.bindingSelectionHint": "اعتبارنامه‌های مورد استفاده توسط این استقرار را انتخاب کنید.",
+  "deployDrawer.bindingsDisabled": "از پیش‌نمایش نسخه حل شده است. ویرایش هنوز در دسترس نیست.",
+  "deployDrawer.cancel": "لغو",
+  "deployDrawer.close": "بستن کشوی استقرار",
+  "deployDrawer.defaultSelect": "انتخاب...",
+  "deployDrawer.deploy": "استقرار به محیط",
+  "deployDrawer.deployExistingRelease": "استقرار به محیط",
+  "deployDrawer.deployExistingReleaseDescription": "یک نسخه و محیط هدف را برای استقرار انتخاب کنید.",
+  "deployDrawer.deployExistingReleaseTitle": "استقرار به محیط",
+  "deployDrawer.deployFailed": "شروع استقرار ناموفق بود.",
+  "deployDrawer.deploying": "در حال استقرار...",
+  "deployDrawer.description": "یک نسخه و محیط هدف را برای استقرار انتخاب کنید.",
+  "deployDrawer.envVarCount_one": "{{count}} متغیر",
+  "deployDrawer.envVarCount_other": "{{count}} متغیر",
+  "deployDrawer.envVarHint": "برای هر متغیر محیطی که این نسخه نیاز دارد، یک مقدار سفارشی وارد کنید یا از مقدار تعریف شده در برنامه استفاده کنید.",
+  "deployDrawer.envVarPlaceholder": "مقدار را وارد کنید",
+  "deployDrawer.envVarSource.ariaLabel": "منبع مقدار متغیر را برای {{key}} انتخاب کنید",
+  "deployDrawer.envVarSource.default": "مقدار برنامه",
+  "deployDrawer.envVarSource.lastDeployment": "آخرین مقدار مستقر شده",
+  "deployDrawer.envVarSource.literal": "مقدار سفارشی",
+  "deployDrawer.envVarType.number": "عدد",
+  "deployDrawer.envVarType.secret": "محرمانه",
+  "deployDrawer.envVarType.string": "رشته",
+  "deployDrawer.envVars": "متغیرهای محیطی",
+  "deployDrawer.existingReleaseHint": "این نسخه به همان شکل مستقر خواهد شد. نسخه جدیدی ایجاد نخواهد شد.",
+  "deployDrawer.loadingBindings": "در حال حل...",
+  "deployDrawer.lockedHint": "قفل شده به محیط فعلی",
+  "deployDrawer.missingRequiredBinding": "یک اعتبارنامه برای این اتصال الزامی انتخاب کنید.",
+  "deployDrawer.missingRequiredEnvVar": "یک مقدار برای این متغیر محیطی الزامی وارد کنید.",
+  "deployDrawer.modelCreds": "اعتبارنامه‌های مدل",
+  "deployDrawer.needsValidation": " (نیاز به اعتبارسنجی دارد)",
+  "deployDrawer.newReleaseHint": "یک نسخه جدید از YAML Workflow App انتخاب شده ایجاد خواهد شد.",
+  "deployDrawer.noBindingRequired": "الزامی نیست",
+  "deployDrawer.noCredentialCandidates": "اعتبارنامه‌ای در دسترس نیست.",
+  "deployDrawer.noNewEnvironmentAvailable": "همه محیط‌های در دسترس از قبل یک استقرار دارند.",
+  "deployDrawer.noOtherReleaseAvailable": "نسخه دیگری برای این محیط در دسترس نیست.",
+  "deployDrawer.noReleaseAvailable": "قبل از استقرار به یک محیط، یک نسخه ایجاد کنید.",
+  "deployDrawer.notFound": "استقرار یافت نشد.",
+  "deployDrawer.noteLabel": "توضیحات نسخه (اختیاری)",
+  "deployDrawer.notePlaceholder": "مثلاً ارسال تغییر متن آنبوردینگ",
+  "deployDrawer.pluginCreds": "اعتبارنامه‌های پلاگین",
+  "deployDrawer.promote": "استقرار",
+  "deployDrawer.promoteDescription": "یک نسخه و محیط هدف را برای استقرار انتخاب کنید.",
+  "deployDrawer.promoteTitle": "استقرار به محیط",
+  "deployDrawer.readOnly": "فقط خواندنی",
+  "deployDrawer.redeploy": "استقرار به محیط",
+  "deployDrawer.redeployDescription": "یک نسخه و محیط هدف را برای استقرار انتخاب کنید.",
+  "deployDrawer.redeployExistingReleaseHint": "نسخه فعلی به همان شکل مجدداً مستقر خواهد شد. نسخه جدیدی ایجاد نخواهد شد.",
+  "deployDrawer.redeployTitle": "استقرار به محیط",
+  "deployDrawer.releaseLabel": "نسخه",
+  "deployDrawer.requiredBinding": "الزامی",
+  "deployDrawer.rollback": "استقرار",
+  "deployDrawer.rollbackDescription": "یک نسخه و محیط هدف را برای استقرار انتخاب کنید.",
+  "deployDrawer.rollbackTitle": "استقرار به محیط",
+  "deployDrawer.runtimeCredentials": "اعتبارنامه‌ها",
+  "deployDrawer.secretPlaceholder": "محرمانه",
+  "deployDrawer.selectCredential": "یک اعتبارنامه انتخاب کنید",
+  "deployDrawer.selectEnv": "یک محیط انتخاب کنید",
+  "deployDrawer.selectProviderCred": "اعتبارنامه {{provider}} را انتخاب کنید",
+  "deployDrawer.selectProviderKey": "کلید {{provider}} را انتخاب کنید",
+  "deployDrawer.selectRelease": "یک نسخه انتخاب کنید",
+  "deployDrawer.targetEnv": "محیط هدف",
+  "deployDrawer.title": "استقرار به محیط",
+  "deployDrawer.valuePlaceholder": "مقدار",
+  "deployTab.cancelDeployment": "لغو استقرار",
+  "deployTab.closeError": "بستن",
+  "deployTab.col.actions": "عملیات",
+  "deployTab.col.currentRelease": "نسخه فعلی",
+  "deployTab.col.environment": "محیط",
+  "deployTab.col.status": "وضعیت",
+  "deployTab.col.updated": "به‌روزرسانی شده",
+  "deployTab.collapseDetails": "جمع کردن جزئیات استقرار",
+  "deployTab.confirmUndeploy": "لغو استقرار",
+  "deployTab.deployOtherVersion": "استقرار نسخه دیگر",
+  "deployTab.deployToEnv": "استقرار به {{name}}",
+  "deployTab.deployToNewEnv": "استقرار به محیط جدید...",
+  "deployTab.empty": "هنوز نمونه‌ای وجود ندارد. برای شروع در یک محیط جدید مستقر شوید.",
+  "deployTab.emptyDescription": "یک نسخه و محیط هدف انتخاب کنید تا این استقرار را در دسترس کاربران قرار دهید.",
+  "deployTab.emptyTitle": "هیچ محیطی هنوز در حال اجرا نیست",
+  "deployTab.envCount": "محیط‌ها",
+  "deployTab.errorCode": "کد",
+  "deployTab.errorDialogDesc": "قبل از تلاش مجدد یا استقرار نسخه دیگر، آخرین استقرار ناموفق را بررسی کنید.",
+  "deployTab.errorDialogTitle": "خطای استقرار در {{name}}",
+  "deployTab.errorMessage": "پیام",
+  "deployTab.errorPhase": "مرحله",
+  "deployTab.expandDetails": "گسترش جزئیات استقرار",
+  "deployTab.moreActions": "اقدامات بیشتر",
+  "deployTab.newDeployment": "استقرار به محیط جدید",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "شناسه استقرار",
+  "deployTab.panel.endpoints": "نقاط پایانی",
+  "deployTab.panel.envVars": "متغیرهای محیطی",
+  "deployTab.panel.error": "خطا",
+  "deployTab.panel.failedRelease": "نسخه ناموفق",
+  "deployTab.panel.health": "سلامت",
+  "deployTab.panel.instanceInfo": "اطلاعات نمونه",
+  "deployTab.panel.modelCreds": "اعتبارنامه‌های مدل",
+  "deployTab.panel.pluginCreds": "اعتبارنامه‌های پلاگین",
+  "deployTab.panel.release": "نسخه",
+  "deployTab.panel.releaseCreatedAt": "نسخه ایجاد شده در",
+  "deployTab.panel.releaseInfo": "اطلاعات نسخه",
+  "deployTab.panel.replicas": "نسخه‌های تکراری",
+  "deployTab.panel.run": "اجرا",
+  "deployTab.panel.runtimeBindings": "اعتبارنامه‌ها",
+  "deployTab.panel.runtimeInfo": "اطلاعات زمان اجرا",
+  "deployTab.panel.runtimeMode": "حالت زمان اجرا",
+  "deployTab.panel.runtimeNote": "یادداشت زمان اجرا",
+  "deployTab.panel.targetRelease": "نسخه هدف",
+  "deployTab.panel.unknownError": "استقرار ناموفق بود.",
+  "deployTab.promote": "استقرار",
+  "deployTab.redeploy": "استقرار مجدد",
+  "deployTab.releaseCreatedAt": "نسخه ایجاد شده {{time}}",
+  "deployTab.retry": "تلاش مجدد",
+  "deployTab.shortcut": "میانبر",
+  "deployTab.status.deployFailed": "استقرار ناموفق",
+  "deployTab.status.deployingRelease": "در حال استقرار ({{release}})",
+  "deployTab.status.runningOutOfSync": "در حال اجرا (همگام‌سازی در انتظار)",
+  "deployTab.status.runningWithFailed": "در حال اجرا (آخرین استقرار ناموفق بود)",
+  "deployTab.undeploy": "لغو استقرار",
+  "deployTab.undeployConfirmDesc": "دسترسی کاربر نهایی بلافاصله متوقف می‌شود. نسخه می‌تواند بعداً مجدداً مستقر شود.",
+  "deployTab.undeployConfirmTitle": "لغو استقرار از {{name}}؟",
+  "deployTab.undeployFrom": "لغو استقرار از {{name}}",
+  "deployTab.undeployImpactTitle": "نمونه تحت تأثیر",
+  "deployTab.viewError": "مشاهده خطا",
+  "deployTab.viewLogs": "مشاهده لاگ‌ها",
+  "deployTab.viewProgress": "مشاهده پیشرفت",
+  "detail.backToInstances": "بازگشت به استقرارها",
+  "detail.deployingCount": "{{count}} در حال استقرار",
+  "detail.envCount_one": "{{count}} محیط",
+  "detail.envCount_other": "{{count}} محیط",
+  "detail.failedCount": "{{count}} ناموفق",
+  "detail.mobileTabs": "بخش‌های استقرار",
+  "detail.notFound": "استقرار یافت نشد",
+  "detail.openSourceApp": "باز کردن منبع {{name}}",
+  "detail.sourceApp": "منبع",
+  "detail.sourceAppLink": "منبع",
+  "documentTitle.create": "استقرار جدید · استقرارها",
+  "documentTitle.detail": "استقرار · استقرارها",
+  "documentTitle.list": "استقرارها",
+  "filter.allEnvs": "همه محیط‌ها",
+  "filter.notDeployed": "مستقر نشده",
+  "filter.searchPlaceholder": "جستجوی استقرارها",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "پذیرش",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "در حال راه‌اندازی",
+  "health.ENVIRONMENT_STATUS_DELETING": "در حال حذف",
+  "health.ENVIRONMENT_STATUS_FAILED": "در دسترس نیست",
+  "health.ENVIRONMENT_STATUS_READY": "در دسترس",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "ناشناخته",
+  "list.clearFilters": "پاک کردن فیلترها",
+  "list.clearSearch": "پاک کردن جستجوی استقرار",
+  "list.createDeployment": "جدید",
+  "list.empty": "استقراری یافت نشد.",
+  "list.emptyDescription": "یک استقرار از Workflow App یا بسته Workflow DSL ایجاد کنید تا نسخه‌ها، محیط‌ها و دسترسی را مدیریت کنید.",
+  "list.emptyFilteredDescription": "هیچ استقراری با جستجو یا فیلتر محیط فعلی مطابقت ندارد.",
+  "list.emptyFilteredTitle": "هیچ استقرار منطبقی نیست",
+  "list.emptyTitle": "هنوز استقراری وجود ندارد",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "مجزا",
+  "mode.ENVIRONMENT_MODE_SHARED": "اشتراکی",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "ناشناخته",
+  "newInstance.comingSoon": "به زودی",
+  "newInstance.fromStudio": "انتخاب از Studio",
+  "newInstance.importDSL": "وارد کردن DSL",
+  "newInstance.title": "استقرار جدید",
+  "overview.accessEndpoints": "نقاط پایانی دسترسی",
+  "overview.accessMeta.apiTokens": "مدیریت API Token‌ها",
+  "overview.accessMeta.cli": "مشاهده دسترسی CLI",
+  "overview.accessMeta.webApp": "مدیریت دسترسی WebApp",
+  "overview.accessStatus": "دسترسی",
+  "overview.api": "API Token‌ها",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Token",
+  "overview.apiTokenSummary.environments_one": "{{count}} محیط مستقر شده",
+  "overview.apiTokenSummary.environments_other": "{{count}} محیط مستقر شده",
+  "overview.availableForDeployment": "در دسترس برای استقرار",
+  "overview.basicInfo": "اطلاعات اولیه",
+  "overview.cardAction.deployLatest": "استقرار آخرین نسخه",
+  "overview.cardAction.redeploy": "استقرار مجدد",
+  "overview.cardAction.viewProgress": "مشاهده استقرار",
+  "overview.chip.behindTooltip_one": "۱ نسخه عقب‌تر از آخرین. آخرین نسخه را برای به‌روزرسانی مستقر کنید.",
+  "overview.chip.behindTooltip_other": "{{count}} نسخه عقب‌تر از آخرین. آخرین نسخه را برای به‌روزرسانی مستقر کنید.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "در حال استقرار",
+  "overview.chip.deployingTooltip": "استقرار در حال انجام است.",
+  "overview.chip.empty": "خالی",
+  "overview.chip.emptyTooltip": "نسخه‌ای در این محیط مستقر نشده است.",
+  "overview.chip.failed": "ناموفق",
+  "overview.chip.failedTooltip": "آخرین تلاش استقرار ناموفق بود.",
+  "overview.chip.latest": "آخرین",
+  "overview.chip.latestTooltip": "این محیط آخرین نسخه را اجرا می‌کند.",
+  "overview.chip.needsReleaseFirst": "ابتدا یک نسخه ایجاد کنید",
+  "overview.chip.olderRelease": "قدیمی‌تر",
+  "overview.chip.olderReleaseTooltip": "این محیط نسخه قدیمی‌تری را اجرا می‌کند.",
+  "overview.chip.openInDeployTab": "مشاهده پیشرفت استقرار",
+  "overview.cli": "CLI",
+  "overview.configured": "پیکربندی شده",
+  "overview.createRelease": "ایجاد نسخه",
+  "overview.created": "ایجاد شده",
+  "overview.deploy": "استقرار",
+  "overview.deployedEnvironments": "مستقر شده",
+  "overview.deploymentOverview": "نمای کلی استقرار",
+  "overview.deploymentStatus": "وضعیت استقرار",
+  "overview.description": "توضیحات",
+  "overview.developerApi": "API توسعه‌دهنده",
+  "overview.disabled": "غیرفعال",
+  "overview.emptyValue": "تنظیم نشده",
+  "overview.enabled": "فعال",
+  "overview.enabledChannels": "دسترسی فعال شده",
+  "overview.endUserAccess": "دسترسی کاربر نهایی",
+  "overview.environments": "محیط‌ها",
+  "overview.hero.byName": "توسط {{name}}",
+  "overview.hero.empty": "هنوز نسخه‌ای وجود ندارد",
+  "overview.hero.emptyDescription": "قبل از استقرار، یک نسخه از منبع فعلی ایجاد کنید.",
+  "overview.hero.propagation_one": "مستقر شده در {{count}}/{{total}} محیط",
+  "overview.hero.propagation_other": "مستقر شده در {{count}}/{{total}} محیط",
+  "overview.hero.untargeted": "هنوز محیطی پیکربندی نشده است",
+  "overview.instanceDetails": "جزئیات استقرار",
+  "overview.instanceId": "شناسه استقرار",
+  "overview.latestRelease.releaseCount_one": "{{count}} نسخه",
+  "overview.latestRelease.releaseCount_other": "{{count}} نسخه",
+  "overview.latestReleaseTitle": "آخرین نسخه",
+  "overview.manageDeployments": "مدیریت استقرارها",
+  "overview.name": "نام",
+  "overview.noAccessConfig": "هیچ پیکربندی دسترسی وجود ندارد.",
+  "overview.noReleaseYet": "قبل از استقرار به یک محیط، یک نسخه ایجاد کنید.",
+  "overview.notConfigured": "پیکربندی نشده",
+  "overview.previousReleases.empty": "هنوز نسخه قبلی‌ای وجود ندارد.",
+  "overview.previousReleases.retired": "در حال حاضر مستقر نشده",
+  "overview.previousReleases.title": "نسخه‌های قبلی",
+  "overview.previousReleases.viewAll": "مشاهده همه",
+  "overview.ready": "قابل استقرار",
+  "overview.recentReleases": "نسخه‌های اخیر",
+  "overview.releaseDeployedTitle": "{{release}} مستقر شده است",
+  "overview.releaseReadyTitle": "{{release}} آماده استقرار است",
+  "overview.serviceMap": "نقشه سرویس",
+  "overview.servingRelease": "در حال ارائه {{release}}",
+  "overview.servingReleaseDescription": "این استقرار در {{count}}/{{total}} محیط مستقر شده است.",
+  "overview.strip.deployToNewEnvironment": "استقرار به محیط جدید",
+  "overview.strip.empty": "هیچ محیطی پیکربندی نشده است.",
+  "overview.strip.emptyDeployableDescription": "هنگامی که آماده شدید، آخرین نسخه را در یک محیط مستقر کنید.",
+  "overview.strip.emptyDeployed": "هنوز نمونه‌ای وجود ندارد.",
+  "overview.strip.emptyDescription": "قبل از استقرار به یک محیط، یک نسخه ایجاد کنید.",
+  "overview.strip.emptyTitle": "هنوز نمونه‌ای وجود ندارد",
+  "overview.strip.summary_one": "۱ از {{total}} در آخرین نسخه",
+  "overview.strip.summary_other": "{{count}} از {{total}} در آخرین نسخه",
+  "overview.strip.title": "نمونه‌ها",
+  "overview.switchSourceApp": "تغییر منبع",
+  "overview.switchSourceAppDescription": "Workflow App مورد استفاده به‌عنوان منبع برای نسخه‌های آینده را انتخاب کنید.",
+  "overview.switchSourceAppHint": "پس از تغییر، فقط نسخه‌های جدید ایجاد شده از منبع جدید استفاده می‌کنند. نسخه‌های تاریخی و استقرارهای موجود تغییر نمی‌کنند.",
+  "overview.targetRelease": "نسخه هدف",
+  "overview.webapp": "WebApp",
+  "settings.danger": "ناحیه خطر",
+  "settings.dangerDesc": "این استقرار را به‌طور دائمی حذف کرده و هر نمونه در حال اجرا را متوقف کنید. این عمل قابل بازگشت نیست.",
+  "settings.delete": "حذف استقرار",
+  "settings.deleteConfirmDesc": "حذف {{name}}؟ هر نمونه در همه محیط‌ها متوقف و حذف خواهد شد. این عمل قابل بازگشت نیست.",
+  "settings.deleteConfirmTitle": "حذف استقرار",
+  "settings.deleteFailed": "حذف استقرار ناموفق بود.",
+  "settings.deleteImpact": "تأثیر",
+  "settings.deleteImpactInstance": "استقرار",
+  "settings.deleteImpactTitle": "استقرار تحت تأثیر",
+  "settings.deleteImpactValue": "استقرار از فهرست استقرار حذف می‌شود.",
+  "settings.deleted": "استقرار حذف شد",
+  "settings.description": "توضیحات",
+  "settings.descriptionHelp": "نام، توضیحات و سایر تنظیمات این استقرار را مدیریت کنید.",
+  "settings.general": "عمومی",
+  "settings.name": "نام استقرار",
+  "settings.reset": "بازنشانی",
+  "settings.save": "ذخیره تغییرات",
+  "settings.updateFailed": "به‌روزرسانی استقرار ناموفق بود.",
+  "settings.updated": "استقرار به‌روزرسانی شد",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "در حال استقرار",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "همگام‌سازی در انتظار",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "استقرار ناموفق",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "نامعتبر",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "در حال اجرا",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "مستقر نشده",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "در حال لغو استقرار",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ناشناخته",
+  "subtitle": "مدیریت استقرارها در میان محیط‌ها.",
+  "tabs.access.description": "مدیریت کانال‌های دسترسی و مجوزهای دسترسی.",
+  "tabs.access.name": "دسترسی",
+  "tabs.api-tokens.description": "مدیریت API Token‌ها و فراخوانی نمونه‌ها از طریق HTTP.",
+  "tabs.api-tokens.name": "API Token‌ها",
+  "tabs.instances.description": "مشاهده و مدیریت نمونه‌ها در محیط‌های مستقر شده.",
+  "tabs.instances.name": "نمونه‌ها",
+  "tabs.overview.description": "وضعیت استقرار را در میان محیط‌ها مشاهده کنید.",
+  "tabs.overview.name": "نمای کلی",
+  "tabs.releases.description": "نسخه‌ها را ایجاد، مستقر و مدیریت کنید.",
+  "tabs.releases.name": "نسخه‌ها",
+  "tabs.settings.description": "نام، توضیحات و سایر تنظیمات این استقرار را مدیریت کنید.",
+  "tabs.settings.name": "تنظیمات",
+  "title": "استقرارها",
+  "unsupportedDslNodes.description": "این نسخه شامل گره‌هایی است که زمان اجرای استقرار هنوز از آنها پشتیبانی نمی‌کند. آنها را در Studio حذف یا جایگزین کرده و دوباره تلاش کنید.",
+  "unsupportedDslNodes.descriptionWithTypes": "این نسخه شامل گره‌هایی است که زمان اجرای استقرار هنوز از آنها پشتیبانی نمی‌کند: {{nodeTypes}}. آنها را در Studio حذف یا جایگزین کرده و دوباره تلاش کنید.",
+  "unsupportedDslNodes.title": "گره‌های پشتیبانی نشده",
+  "unsupportedDslNodes.unknownType": "نوع ناشناخته",
+  "versions.cancelCreate": "لغو",
+  "versions.cancelDelete": "لغو",
+  "versions.cancelEdit": "لغو",
+  "versions.checkingReleaseContent": "در حال بررسی محتوای نسخه...",
+  "versions.col.action": "عملیات",
+  "versions.col.author": "ایجاد شده توسط",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "ایجاد شده در",
+  "versions.col.deployedTo": "مستقر شده در",
+  "versions.col.release": "نسخه",
+  "versions.col.sourceApp": "منبع",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "ایجاد",
+  "versions.createFailed": "ایجاد نسخه ناموفق بود.",
+  "versions.createRelease": "ایجاد نسخه",
+  "versions.createReleaseDescription": "یک نسخه قابل استقرار از Workflow App یا فایل Workflow DSL ایجاد کنید.",
+  "versions.createReleaseHint": "نسخه‌های جدید می‌توانند در هر محیطی مستقر شوند.",
+  "versions.createSuccess": "نسخه \"{{name}}\" ایجاد شد.",
+  "versions.creating": "در حال ایجاد...",
+  "versions.currentOn": "نسخه فعلی در {{name}}",
+  "versions.deleteConfirmDesc": "نسخه \"{{name}}\" به‌طور دائمی حذف خواهد شد. این عمل قابل بازگشت نیست.",
+  "versions.deleteConfirmTitle": "حذف نسخه؟",
+  "versions.deleteFailed": "حذف نسخه ناموفق بود.",
+  "versions.deleteImpactDeployment": "وضعیت استقرار",
+  "versions.deleteImpactNotDeployed": "در حال حاضر مستقر نشده",
+  "versions.deleteImpactRelease": "نسخه",
+  "versions.deleteImpactTitle": "تأثیر حذف",
+  "versions.deleteRelease": "حذف نسخه",
+  "versions.deleteSuccess": "نسخه \"{{name}}\" حذف شد.",
+  "versions.deploy": "استقرار",
+  "versions.deployTo": "استقرار به {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "در حال استقرار",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "همگام‌سازی در انتظار",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "ناموفق",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "نامعتبر",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "در حال اجرا",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "مستقر نشده",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "در حال لغو استقرار",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ناشناخته",
+  "versions.deployingTo": "{{name}} در حال استقرار است",
+  "versions.disabledReason.checkDeploymentsFailed": "بررسی استفاده از استقرار ممکن نشد. بعداً دوباره تلاش کنید.",
+  "versions.disabledReason.checkingDeployments": "در حال بررسی استفاده از استقرار",
+  "versions.disabledReason.current": "این نسخه از قبل در {{name}} در حال اجرا است",
+  "versions.disabledReason.deploying": "منتظر بمانید تا استقرار فعال به پایان برسد",
+  "versions.disabledReason.envDisabled": "این محیط قابل استقرار نیست",
+  "versions.disabledReason.releaseInUse_one": "قبل از حذف، این نسخه را از {{count}} محیط لغو استقرار کنید",
+  "versions.disabledReason.releaseInUse_other": "قبل از حذف، این نسخه را از {{count}} محیط لغو استقرار کنید",
+  "versions.dslReadFailed": "خواندن فایل DSL ناموفق بود. فایل دیگری را انتخاب کرده و دوباره تلاش کنید.",
+  "versions.dslReading": "در حال خواندن فایل DSL...",
+  "versions.dslUnsupportedMode": "فقط فایل‌های Workflow DSL می‌توانند برای استقرار استفاده شوند.",
+  "versions.editFailed": "به‌روزرسانی نسخه ناموفق بود.",
+  "versions.editRelease": "ویرایش نسخه",
+  "versions.editReleaseDescription": "نام و توضیحات این نسخه را به‌روزرسانی کنید.",
+  "versions.editSuccess": "نسخه \"{{name}}\" به‌روزرسانی شد.",
+  "versions.empty": "هنوز نسخه‌ای در دسترس نیست.",
+  "versions.emptyDescription": "قبل از استقرار به یک محیط، اولین نسخه را ایجاد کنید.",
+  "versions.emptyTitle": "هنوز نسخه‌ای وجود ندارد",
+  "versions.emptyWithCreate": "هنوز نسخه‌ای وجود ندارد. قبل از استقرار، اولین نسخه قابل استقرار را ایجاد کنید.",
+  "versions.exportDsl": "صادر کردن DSL",
+  "versions.exportDslFailed": "صادر کردن DSL ناموفق بود.",
+  "versions.exportingDsl": "در حال صادر کردن...",
+  "versions.groupHeader.deploy": "استقرار",
+  "versions.groupHeader.promote": "استقرار",
+  "versions.groupHeader.rollback": "استقرار نسخه قبلی",
+  "versions.groupHeader.unavailable": "در دسترس نیست",
+  "versions.manualDslOption": "بارگذاری DSL",
+  "versions.moreActions": "اقدامات بیشتر",
+  "versions.optional": "اختیاری",
+  "versions.promote": "استقرار",
+  "versions.promoteTo": "استقرار به {{name}}",
+  "versions.releaseAlreadyExists": "نسخه‌ای با محتوای یکسان از قبل وجود دارد: {{name}}.",
+  "versions.releaseContentCheckFailed": "بررسی محتوای نسخه ناموفق بود.",
+  "versions.releaseDescriptionLabel": "توضیحات",
+  "versions.releaseDescriptionPlaceholder": "این نسخه را توصیف کنید",
+  "versions.releaseHistory": "تاریخچه نسخه",
+  "versions.releaseNameLabel": "نام نسخه",
+  "versions.releaseNamePlaceholder": "نام نسخه",
+  "versions.releaseNameRequired": "یک نام نسخه وارد کنید.",
+  "versions.releaseSourceLabel": "منبع نسخه",
+  "versions.rollbackTo": "استقرار به {{name}}",
+  "versions.saveEdit": "ذخیره",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/fa-IR/workflow.json b/web/i18n/fa-IR/workflow.json
index 43c479c3ffd..2676e5a08eb 100644
--- a/web/i18n/fa-IR/workflow.json
+++ b/web/i18n/fa-IR/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "عامل",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "پاسخ",
   "blocks.assigner": "تخصیص‌دهنده متغیر",
   "blocks.code": "کد",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "تجمیع‌کننده متغیر",
   "blocks.variable-assigner": "تخصیص‌دهنده متغیر",
   "blocksAbout.agent": "فراخوانی مدل‌های زبانی بزرگ برای پاسخ به سؤالات یا پردازش زبان طبیعی",
+  "blocksAbout.agent-v2": "فراخوانی مدل‌های زبانی بزرگ برای پاسخ به سؤالات یا پردازش زبان طبیعی",
   "blocksAbout.answer": "تعریف محتوای پاسخ در مکالمه چت",
   "blocksAbout.assigner": "گره تخصیص متغیر برای مقداردهی به متغیرهای قابل‌نوشتن (مانند متغیرهای مکالمه) استفاده می‌شود.",
   "blocksAbout.code": "اجرای کد Python یا NodeJS برای پیاده‌سازی منطق سفارشی",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "شناسه گردش کار",
   "globalVar.fieldsDescription.workflowRunId": "شناسه اجرای گردش کار",
   "globalVar.title": "متغیرهای سیستمی",
+  "nodes.agent.advancedSetting": "تنظیمات پیشرفته",
   "nodes.agent.checkList.strategyNotSelected": "استراتژی انتخاب نشده است",
   "nodes.agent.clickToViewParameterSchema": "برای مشاهده طرح پارامتر کلیک کنید",
   "nodes.agent.configureModel": "پیکربندی مدل",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "مدل پشتیبانی نمی‌شود",
   "nodes.agent.modelSelectorTooltips.deprecated": "این مدل منسوخ شده است",
   "nodes.agent.notAuthorized": "مجاز نیست",
+  "nodes.agent.outputVars.confirm": "تأیید",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "یک آرایه JSON وارد کنید.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "true یا false وارد کنید.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "مقادیر پیش‌فرض فایل هنوز در اینجا قابل تنظیم نیستند.",
+  "nodes.agent.outputVars.defaultValueLabel": "پیش‌فرض",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "یک عدد معتبر وارد کنید.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "یک شیء JSON وارد کنید.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "مقدار پیش‌فرض",
+  "nodes.agent.outputVars.delete": "حذف {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "توضیحات",
+  "nodes.agent.outputVars.descriptionPlaceholder": "افزودن توضیحات",
+  "nodes.agent.outputVars.edit": "ویرایش {{name}}",
+  "nodes.agent.outputVars.editorLabel": "ویرایشگر متغیر خروجی",
   "nodes.agent.outputVars.files.title": "فایل‌های تولیدشده توسط عامل",
   "nodes.agent.outputVars.files.transfer_method": "روش انتقال (remote_url یا local_file)",
   "nodes.agent.outputVars.files.type": "نوع پشتیبانی‌شده (فعلاً فقط تصویر)",
   "nodes.agent.outputVars.files.upload_file_id": "شناسه فایل آپلودشده",
   "nodes.agent.outputVars.files.url": "URL تصویر",
   "nodes.agent.outputVars.json": "JSON تولیدشده توسط عامل",
+  "nodes.agent.outputVars.nameDuplicate": "نام خروجی از قبل وجود دارد",
+  "nodes.agent.outputVars.nameInvalid": "از حروف، اعداد و زیرخط استفاده کنید. با یک حرف یا زیرخط شروع کنید.",
+  "nodes.agent.outputVars.nameLabel": "نام فیلد",
+  "nodes.agent.outputVars.namePlaceholder": "نام فیلد",
+  "nodes.agent.outputVars.newOutput": "خروجی جدید",
+  "nodes.agent.outputVars.requiredLabel": "الزامی",
+  "nodes.agent.outputVars.showAdvancedOptions": "نمایش گزینه‌های پیشرفته",
   "nodes.agent.outputVars.text": "محتوای متنی تولیدشده توسط عامل",
+  "nodes.agent.outputVars.typeLabel": "نوع خروجی",
   "nodes.agent.outputVars.usage": "اطلاعات مصرف مدل",
   "nodes.agent.parameterSchema": "طرح پارامتر",
   "nodes.agent.pluginInstaller.install": "نصب",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "این یکپارچه‌سازی از GitHub نصب شده. برای نصب مجدد به بخش یکپارچه‌سازی‌ها بروید.",
   "nodes.agent.pluginNotInstalled": "این یکپارچه‌سازی نصب نشده است",
   "nodes.agent.pluginNotInstalledDesc": "این یکپارچه‌سازی از GitHub نصب شده. برای نصب مجدد به بخش یکپارچه‌سازی‌ها بروید.",
+  "nodes.agent.roster.change": "تغییر",
+  "nodes.agent.roster.editInConsole": "ویرایش در Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "یک پیکربندی یک‌باره که فقط در این گره وجود دارد",
+  "nodes.agent.roster.inlineSetup.name": "پیکربندی inline",
+  "nodes.agent.roster.inlineSetup.title": "پیکربندی عامل",
+  "nodes.agent.roster.inlineSetup.type": "فقط در این گره",
+  "nodes.agent.roster.label": "عامل",
+  "nodes.agent.roster.makeCopy": "ایجاد کپی",
+  "nodes.agent.roster.more": "اقدامات بیشتر عامل",
+  "nodes.agent.roster.openPanel": "باز کردن جزئیات {{name}}",
+  "nodes.agent.roster.panelLabel": "جزئیات {{name}}",
   "nodes.agent.strategy.configureTip": "لطفاً استراتژی عامل را پیکربندی کنید.",
   "nodes.agent.strategy.configureTipDesc": "پس از انتخاب استراتژی عامل، تنظیمات مربوطه به‌طور خودکار بارگذاری می‌شوند. این استراتژی بر مکانیسم استدلال چندمرحله‌ای ابزار تأثیر می‌گذارد.",
   "nodes.agent.strategy.label": "استراتژی عامل",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "نسخه فعلی یکپارچه‌سازی این استراتژی را ارائه نمی‌دهد. برای تغییر نسخه کلیک کنید.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} نصب نشده است",
   "nodes.agent.strategyNotSet": "استراتژی عامل تنظیم نشده است",
+  "nodes.agent.task.insert": "درج",
+  "nodes.agent.task.label": "وظیفه عامل",
+  "nodes.agent.task.mention": "اشاره",
+  "nodes.agent.task.placeholder": "شرح دهید این عامل باید چه کاری انجام دهد...",
+  "nodes.agent.task.tooltip": "دستورالعمل‌های وظیفه‌ای را که این عامل باید در این گردش کار دنبال کند تعریف کنید.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} مجوز ندارد",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} نصب نشده است",
   "nodes.agent.toolbox": "جعبه ابزار",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "توسط {{author}}",
   "tabs.question-understand": "درک سؤال",
   "tabs.requestToCommunity": "درخواست از جامعه",
-  "tabs.searchBlock": "جستجوی گره",
+  "tabs.searchBlock": "جستجوی گره، عامل، انسان، دانش",
   "tabs.searchDataSource": "جستجوی منبع داده",
   "tabs.searchSnippets": "جستجوی قطعات...",
   "tabs.searchTool": "جستجوی ابزار",
diff --git a/web/i18n/fr-FR/agent-v-2.json b/web/i18n/fr-FR/agent-v-2.json
new file mode 100644
index 00000000000..804b2624f44
--- /dev/null
+++ b/web/i18n/fr-FR/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Cette action n’est pas encore disponible.",
+  "agentDetail.access.actions.monitoring": "Surveillance",
+  "agentDetail.access.copyAccessUrl": "Copier l’URL d’accès",
+  "agentDetail.access.copyFailed": "Échec de la copie de la référence.",
+  "agentDetail.access.copyReference": "Copier la référence de {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Copier le point de terminaison de l’API de service",
+  "agentDetail.access.description": "Toutes les surfaces depuis lesquelles cet agent est accessible.",
+  "agentDetail.access.empty": "Aucun point d’accès lié",
+  "agentDetail.access.emptyDescription": "Cet agent du roster n’a pas encore de références d’application ou de workflow.",
+  "agentDetail.access.entries.agentApp.description": "Application agent liée à cet agent du roster.",
+  "agentDetail.access.entries.agentApp.name": "Application agent",
+  "agentDetail.access.entries.workflow.description": "Workflow et référence de nœud liés à cet agent du roster.",
+  "agentDetail.access.entries.workflow.name": "Nœud de workflow",
+  "agentDetail.access.entryCount_one": "{{count}} entrée",
+  "agentDetail.access.entryCount_other": "{{count}} entrées",
+  "agentDetail.access.groups.references.heading": "Références",
+  "agentDetail.access.groups.references.label": "Références liées",
+  "agentDetail.access.learnMore": "En savoir plus",
+  "agentDetail.access.moreActions": "Plus d’actions pour {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Point de terminaison de l’API de service",
+  "agentDetail.access.serviceApi.title": "API de service backend",
+  "agentDetail.access.status.disabled": "Désactivé",
+  "agentDetail.access.status.enabled": "Activé",
+  "agentDetail.access.status.inService": "En service",
+  "agentDetail.access.status.outOfService": "Hors service",
+  "agentDetail.access.title": "Point d’accès",
+  "agentDetail.access.toggleSurface": "Basculer l’accès de {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL d’accès",
+  "agentDetail.access.webApp.actions.customize": "Personnaliser",
+  "agentDetail.access.webApp.actions.embedded": "Intégré",
+  "agentDetail.access.webApp.actions.launch": "Lancer",
+  "agentDetail.access.webApp.actions.settings": "Paramètres",
+  "agentDetail.access.webApp.refreshUrl": "Actualiser l’URL d’accès",
+  "agentDetail.access.webApp.showQrCode": "Afficher le code QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO activé",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Utilisé en tant que nœud à l’intérieur du workflow",
+  "agentDetail.access.workflow.empty": "Aucune référence de workflow pour l’instant.",
+  "agentDetail.access.workflow.loadFailed": "Échec du chargement des références de workflow.",
+  "agentDetail.access.workflow.loading": "Chargement des références de workflow…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} nœud",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} nœuds",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Ouvrir dans Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Ouvrir {{name}} dans Studio",
+  "agentDetail.access.workflow.table.actions": "Actions",
+  "agentDetail.access.workflow.table.lastUpdated": "Dernière mise à jour",
+  "agentDetail.access.workflow.table.name": "Nom",
+  "agentDetail.access.workflow.table.nodes": "Nœuds",
+  "agentDetail.access.workflow.table.version": "Version",
+  "agentDetail.access.workflow.title": "Accès par workflow",
+  "agentDetail.configure.advancedSettings.description": "Pour les utilisateurs avancés. Variables d’environnement, sandbox et mémoire.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Ajouter une variable d’environnement",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Supprimer {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Masquer la valeur de {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Importer .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Pour afficher les fichiers .env cachés, appuyez sur Command + Maj + . dans le sélecteur de fichiers.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Si votre fichier .env est masqué, activez les fichiers cachés dans le sélecteur de fichiers du système.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Pour afficher les fichiers .env cachés, activez Éléments masqués dans l’Explorateur de fichiers.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Afficher la valeur de {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Sélectionner la portée de la variable d’environnement",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Variables d’environnement disponibles pour cet agent au moment de l’exécution.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Basculer Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Paramètres avancés",
+  "agentDetail.configure.advancedSettings.toggle": "Basculer les paramètres avancés",
+  "agentDetail.configure.chatFeatures.description": "Façonnez l’expérience de chat de l’utilisateur final sur votre webapp et vos surfaces de chat.",
+  "agentDetail.configure.chatFeatures.title": "Fonctionnalités de chat",
+  "agentDetail.configure.files.add": "Ajouter un fichier",
+  "agentDetail.configure.files.empty.description": "Téléchargez des documents que l’agent peut lire, comme des spécifications, des modèles ou des directives",
+  "agentDetail.configure.files.empty.title": "Pas encore de fichiers",
+  "agentDetail.configure.files.label": "Fichiers",
+  "agentDetail.configure.files.preview.empty": "Aucun contenu d’aperçu.",
+  "agentDetail.configure.files.preview.failed": "Échec du chargement de l’aperçu.",
+  "agentDetail.configure.files.preview.unsupported": "Ce fichier ne prend pas en charge l’aperçu.",
+  "agentDetail.configure.files.remove": "Supprimer {{name}}",
+  "agentDetail.configure.files.tip": "Fichiers que cet agent peut utiliser lors de l’orchestration des tâches.",
+  "agentDetail.configure.files.toggle": "Basculer les fichiers",
+  "agentDetail.configure.files.treeLabel": "Fichiers de l’agent",
+  "agentDetail.configure.files.upload.action": "Téléverser",
+  "agentDetail.configure.files.upload.browse": "parcourir",
+  "agentDetail.configure.files.upload.description": "Téléverser un fichier pour cet agent.",
+  "agentDetail.configure.files.upload.dropzone": "Déposez un fichier ici, ou",
+  "agentDetail.configure.files.upload.failed": "Échec du téléversement du fichier.",
+  "agentDetail.configure.files.upload.fileType": "FICHIER",
+  "agentDetail.configure.files.upload.invalidFile": "Téléversez un fichier.",
+  "agentDetail.configure.files.upload.success": "Fichier téléversé.",
+  "agentDetail.configure.files.upload.title": "Téléverser un fichier",
+  "agentDetail.configure.knowledgeRetrieval.add": "Ajouter une récupération de connaissances",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Ajouter des connaissances",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Cliquez sur le bouton « + » pour ajouter des connaissances",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Connaissances",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Paramètre de récupération",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "En savoir plus sur la récupération de connaissances",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automatique",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Conditions",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Désactivé",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Filtrage des métadonnées",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manuel",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Sélectionner le mode de filtrage des métadonnées",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Nom de la récupération de connaissances",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "L’agent décide",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "L’agent rédige sa propre requête à partir du prompt et du contexte disponible. Rien à configurer ici.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Requête personnalisée",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Écrivez une requête fixe pour cette source de récupération.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Texte de requête personnalisé",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Tapez une requête de recherche",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Requête",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Récupération de connaissances · L’agent décide",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Modifier {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Connectez une base de connaissances que l’agent peut consulter en répondant",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Pas encore de connaissances",
+  "agentDetail.configure.knowledgeRetrieval.label": "Récupération de connaissances",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Supprimer {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Sources de récupération de connaissances que cet agent peut utiliser lors de l’orchestration des tâches.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Basculer la récupération de connaissances",
+  "agentDetail.configure.model.label": "Modèle",
+  "agentDetail.configure.orchestrate": "Orchestrer",
+  "agentDetail.configure.preview.chatFeatures": "Fonctionnalités de chat",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agent",
+  "agentDetail.configure.preview.empty.description": "Envoyez un message pour tester le brouillon actuel.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Pas encore d’instructions, donc les réponses proviennent du modèle brut.",
+  "agentDetail.configure.preview.endUserAuth": "Authentification de l’utilisateur final",
+  "agentDetail.configure.preview.restart": "Redémarrer l’aperçu",
+  "agentDetail.configure.preview.title": "Aperçu",
+  "agentDetail.configure.prompt.copied": "Prompt copié",
+  "agentDetail.configure.prompt.copy": "Copier le prompt",
+  "agentDetail.configure.prompt.copyFailed": "Échec de la copie du prompt.",
+  "agentDetail.configure.prompt.insert.label": "Insérer",
+  "agentDetail.configure.prompt.insert.question": "Question de départ",
+  "agentDetail.configure.prompt.insert.reportFile": "Fichier de rapport de sortie",
+  "agentDetail.configure.prompt.insert.tenders": "Liste d’appels d’offres de départ",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Mentionner",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Écrivez les instructions ici,",
+  "agentDetail.configure.prompt.tip": "Définissez comment cet agent doit interpréter les entrées, appeler les outils et produire les sorties.",
+  "agentDetail.configure.publishBar.draft": "Brouillon",
+  "agentDetail.configure.publishBar.publishUpdate": "Publier la mise à jour",
+  "agentDetail.configure.publishBar.published": "Publié",
+  "agentDetail.configure.publishBar.publishedAt": "Publié {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Publication…",
+  "agentDetail.configure.publishBar.saved": "Enregistré il y a 5 min",
+  "agentDetail.configure.publishBar.savedAt": "Enregistré {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Modifications non publiées",
+  "agentDetail.configure.publishBar.upToDate": "À jour",
+  "agentDetail.configure.publishBar.versionHistory": "Ouvrir l’historique des versions",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Workflows affectés",
+  "agentDetail.configure.publishImpact.cancel": "Annuler",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Votre agent apparaît dans",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Les modifications les affecteront.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "cet agent",
+  "agentDetail.configure.publishImpact.title": "{{action}} pour {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} workflow",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} workflows",
+  "agentDetail.configure.skills.add": "Ajouter une compétence",
+  "agentDetail.configure.skills.detail.contentRegion": "Contenu des détails de la compétence",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} FICHIERS",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Fichiers de la compétence",
+  "agentDetail.configure.skills.detail.files": "Fichiers",
+  "agentDetail.configure.skills.empty.description": "Les compétences offrent à l’agent une expertise réutilisable qu’il peut invoquer pendant son travail",
+  "agentDetail.configure.skills.empty.title": "Pas encore de compétences",
+  "agentDetail.configure.skills.itemType": "Compétence",
+  "agentDetail.configure.skills.label": "Compétences",
+  "agentDetail.configure.skills.remove": "Supprimer {{name}}",
+  "agentDetail.configure.skills.tip": "Compétences que cet agent peut utiliser lors de l’orchestration des tâches.",
+  "agentDetail.configure.skills.toggle": "Basculer les compétences",
+  "agentDetail.configure.skills.upload.action": "Téléverser",
+  "agentDetail.configure.skills.upload.browse": "parcourir",
+  "agentDetail.configure.skills.upload.description": "Téléversez un paquet .zip ou .skill pour cet agent.",
+  "agentDetail.configure.skills.upload.dropzone": "Déposez un paquet de compétence ici, ou",
+  "agentDetail.configure.skills.upload.failed": "Échec du téléversement de la compétence.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Téléversez un fichier .zip ou .skill.",
+  "agentDetail.configure.skills.upload.success": "Compétence téléversée.",
+  "agentDetail.configure.skills.upload.title": "Téléverser une compétence",
+  "agentDetail.configure.tools.add": "Ajouter un outil",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Pour les développeurs",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Installez un programme en ligne de commande que l’agent exécute dans son sandbox. Nécessite une installation et généralement des clés API.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Outil CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Choisissez un outil déjà présent dans cet espace de travail, comme la recherche web ou des intégrations.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Outil",
+  "agentDetail.configure.tools.cliDialog.description": "Installez un outil CLI depuis n’importe quel registre de paquets. L’agent obtient un accès shell au binaire fourni.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Modifier l’outil CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Stockez les clés API, jetons ou secrets dont cet outil CLI a besoin. Les valeurs sont chiffrées au repos et injectées en tant que variables d’environnement lorsque l’agent appelle l’outil.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Variables d’environnement",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(facultatif)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Sandboxé · s’exécute une fois lors du premier appel",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Commande d’installation",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Collez votre commande d’installation ici, p. ex. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "La commande d’installation est requise.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "En savoir plus sur l’outil CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Nom de l’outil CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Nommez votre outil CLI",
+  "agentDetail.configure.tools.cliDialog.name.required": "Le nom de l’outil CLI est requis.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Jamais visible dans le prompt de l’agent ; injecté uniquement en tant que $VAR à l’exécution",
+  "agentDetail.configure.tools.cliDialog.title": "Ajouter un outil CLI",
+  "agentDetail.configure.tools.cliTool": "Outil CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Utilisateur final · OAuth",
+  "agentDetail.configure.tools.editAction": "Modifier {{name}}",
+  "agentDetail.configure.tools.empty.description": "Les outils permettent à l’agent d’agir, comme effectuer des recherches sur le web ou appeler vos applications",
+  "agentDetail.configure.tools.empty.title": "Pas encore d’outils",
+  "agentDetail.configure.tools.label": "Outils",
+  "agentDetail.configure.tools.moreActions": "Plus d’actions pour {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Pré-autoriser",
+  "agentDetail.configure.tools.removeAction": "Supprimer {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Supprimer tous les outils",
+  "agentDetail.configure.tools.tip": "Outils que cet agent peut appeler lors de l’orchestration des tâches.",
+  "agentDetail.configure.tools.toggle": "Basculer les outils",
+  "agentDetail.configure.tools.toolTabs.all": "Tous",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Personnalisé",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugins",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agent",
+  "agentDetail.history": "Historique",
+  "agentDetail.logs.description": "Les journaux complets enregistrent l’état d’exécution de l’application, y compris les entrées des utilisateurs, les réponses de l’agent, la planification et l’utilisation des outils.",
+  "agentDetail.logs.empty": "Aucun journal trouvé",
+  "agentDetail.logs.filters.period.allTime": "Toute la période",
+  "agentDetail.logs.filters.period.label": "Période du journal",
+  "agentDetail.logs.filters.period.last30days": "30 derniers jours",
+  "agentDetail.logs.filters.period.last7days": "7 derniers jours",
+  "agentDetail.logs.filters.search.label": "Rechercher des journaux",
+  "agentDetail.logs.filters.search.placeholder": "Rechercher",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Dernière date de création",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Dernière date de mise à jour",
+  "agentDetail.logs.filters.source.all": "Source",
+  "agentDetail.logs.filters.source.empty": "Aucune source trouvée",
+  "agentDetail.logs.filters.source.label": "Source du journal",
+  "agentDetail.logs.filters.source.loadFailed": "Échec du chargement des sources",
+  "agentDetail.logs.filters.source.loading": "Chargement des sources…",
+  "agentDetail.logs.filters.source.searchLabel": "Rechercher des sources",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Rechercher",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Workflow",
+  "agentDetail.logs.learnMore": "En savoir plus",
+  "agentDetail.logs.loadFailed": "Échec du chargement des journaux",
+  "agentDetail.logs.loading": "Chargement des journaux…",
+  "agentDetail.logs.notAvailable": "N/D",
+  "agentDetail.logs.table.createdTime": "Date de création",
+  "agentDetail.logs.table.endUser": "Utilisateur final",
+  "agentDetail.logs.table.messageCount": "Nb. msg.",
+  "agentDetail.logs.table.operationRate": "Taux d’op.",
+  "agentDetail.logs.table.source": "Source",
+  "agentDetail.logs.table.title": "Titre",
+  "agentDetail.logs.table.unread": "Non lu",
+  "agentDetail.logs.table.updatedTime": "Date de mise à jour",
+  "agentDetail.logs.table.userRate": "Note de l’utilisateur",
+  "agentDetail.logs.title": "Journaux",
+  "agentDetail.memorySettings.budgetLabel": "Budget mémoire",
+  "agentDetail.memorySettings.description": "Paramètres de mémoire de l’instantané de configuration actif.",
+  "agentDetail.memorySettings.export.description": "L’exportation de la mémoire est prévue pour une version ultérieure.",
+  "agentDetail.memorySettings.export.download": "Télécharger",
+  "agentDetail.memorySettings.export.soon": "Bientôt",
+  "agentDetail.memorySettings.export.title": "Exporter la mémoire actuelle",
+  "agentDetail.memorySettings.notConfigured": "Non configuré",
+  "agentDetail.memorySettings.scopeLabel": "Portée de la mémoire",
+  "agentDetail.memorySettings.title": "Mémoire",
+  "agentDetail.metadata.activeVersionLabel": "Version active",
+  "agentDetail.metadata.appIdLabel": "ID de l’application",
+  "agentDetail.metadata.description": "Champs du roster en lecture seule renvoyés par le backend de l’agent.",
+  "agentDetail.metadata.emptyValue": "Non disponible",
+  "agentDetail.metadata.scopeLabel": "Portée",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Workflow uniquement",
+  "agentDetail.metadata.sourceLabel": "Source",
+  "agentDetail.metadata.statusLabel": "Statut",
+  "agentDetail.metadata.title": "Métadonnées",
+  "agentDetail.metadata.updatedAtLabel": "Mis à jour le",
+  "agentDetail.metadata.workflowIdLabel": "ID du workflow",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID du nœud du workflow",
+  "agentDetail.monitoring.change": "{{value}} par rapport à la période précédente",
+  "agentDetail.monitoring.dateRangeLabel": "Plage de dates",
+  "agentDetail.monitoring.description": "Suivez l’activité, le coût et la qualité d’interaction de l’agent réutilisable dans tous les workflows.",
+  "agentDetail.monitoring.learnMore": "En savoir plus",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Utilisateurs finaux uniques ayant déclenché des workflows utilisant cet agent.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Utilisateurs actifs",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Nombre de communications continues entre utilisateur et agent pour ce point d’accès.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Moy. interactions par session",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Vitesse de sortie moyenne du début de la requête jusqu’à son achèvement.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Vitesse de sortie des tokens",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Coût estimé en tokens produit par cet agent au cours des exécutions de workflows.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Utilisation des tokens",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Conversations IA quotidiennes ayant atteint cet agent via le point d’accès sélectionné.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Total des conversations",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Nombre quotidien d’interactions avec l’agent.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Total des messages",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Le nombre de mentions « J’aime » pour 1 000 messages pour cet agent.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Taux de satisfaction des utilisateurs",
+  "agentDetail.monitoring.pickSource": "Choisir une application",
+  "agentDetail.monitoring.sourceLabel": "Application",
+  "agentDetail.monitoring.sourceTrigger": "Source {{name}}",
+  "agentDetail.monitoring.sources.all": "Toutes",
+  "agentDetail.monitoring.timeRangeLabel": "Plage de temps",
+  "agentDetail.monitoring.timeRanges.custom": "Personnalisé",
+  "agentDetail.monitoring.timeRanges.last30days": "30 derniers jours",
+  "agentDetail.monitoring.timeRanges.last7days": "7 derniers jours",
+  "agentDetail.monitoring.timeRanges.today": "Aujourd’hui",
+  "agentDetail.monitoring.title": "Surveillance",
+  "agentDetail.monitoring.tokenUsageConsumed": "Tokens consommés",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Navigation de l’agent",
+  "agentDetail.publish": "Publier",
+  "agentDetail.publishSoon": "Bientôt",
+  "agentDetail.sections.access": "Point d’accès",
+  "agentDetail.sections.configure": "Orchestrer",
+  "agentDetail.sections.logs": "Journaux",
+  "agentDetail.sections.monitoring": "Surveillance",
+  "agentDetail.subtitle": "ID de l’agent : {{agentId}}",
+  "agentDetail.title": "Agent",
+  "agentDetail.type": "AGENT",
+  "agentDetail.versionHistory.active": "Actif",
+  "agentDetail.versionHistory.empty": "Pas encore de versions",
+  "agentDetail.versionHistory.filter": "Filtrer les versions",
+  "agentDetail.versionHistory.versionName": "Version {{version}}",
+  "roster.createAgent": "Créer un agent",
+  "roster.createAgentOptions": "Options de création d’agent",
+  "roster.createDialog.description": "Créez un agent réutilisable dans le roster de cet espace de travail.",
+  "roster.createDialog.title": "Créer un agent",
+  "roster.createForm.changeIcon": "Changer l’icône de l’agent",
+  "roster.createForm.descriptionLabel": "Description",
+  "roster.createForm.descriptionOptional": "(facultatif)",
+  "roster.createForm.descriptionPlaceholder": "p. ex. Rassemble des sources sur un sujet et résume les principales conclusions",
+  "roster.createForm.nameLabel": "Nom",
+  "roster.createForm.namePlaceholder": "p. ex. Max",
+  "roster.createForm.nameRequired": "Le nom est requis.",
+  "roster.createForm.roleLabel": "Rôle",
+  "roster.createForm.rolePlaceholder": "p. ex. Assistant de recherche",
+  "roster.createForm.roleRequired": "Le rôle est requis.",
+  "roster.createSuccess": "Agent créé.",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Cet agent sera supprimé de la liste du roster actif.",
+  "roster.deleteDialog.title": "Supprimer {{name}} ?",
+  "roster.deleteFailed": "Échec de la suppression de l’agent.",
+  "roster.deleteSuccess": "Agent supprimé.",
+  "roster.duplicateFailed": "Échec de la duplication de l’agent.",
+  "roster.duplicateSuccess": "Agent dupliqué.",
+  "roster.editAgent": "Modifier {{name}}",
+  "roster.editDialog.description": "Mettez à jour le nom, la description et le rôle de cet agent dans le roster.",
+  "roster.editDialog.title": "Modifier l’agent",
+  "roster.editInfo": "Modifier les informations",
+  "roster.empty": "Pas encore d’agent",
+  "roster.emptyDescription": "Les agents enregistrés dans cet espace de travail apparaîtront ici.",
+  "roster.emptySearch": "Aucun agent correspondant",
+  "roster.emptySearchDescription": "Essayez un autre nom d’agent.",
+  "roster.filters.all": "Tous",
+  "roster.filters.drafts": "Brouillons",
+  "roster.filters.label": "Filtres d’agent",
+  "roster.filters.published": "Publiés",
+  "roster.learnMore": "En savoir plus sur Agent Roster",
+  "roster.listLabel": "Liste du roster d’agents",
+  "roster.loadMore": "Charger plus",
+  "roster.loadingError": "Échec du chargement des agents. Actualisez et réessayez.",
+  "roster.moreActions": "Plus d’actions pour {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Échec de la création d’un agent inline. Actualisez et réessayez.",
+  "roster.nodeSelector.dialogLabel": "Sélectionner un agent",
+  "roster.nodeSelector.manageInAgentConsole": "Gérer dans Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Rechercher…",
+  "roster.nodeSelector.startFromScratch": "Partir de zéro",
+  "roster.references.label": "Workflows utilisant {{name}}",
+  "roster.references.trigger": "Workflows utilisant {{name}}",
+  "roster.searchLabel": "Rechercher des agents",
+  "roster.searchPlaceholder": "Rechercher des agents par nom…",
+  "roster.sources.agent_app": "Application agent",
+  "roster.sources.imported": "Importé",
+  "roster.sources.system": "Système",
+  "roster.sources.workflow": "Workflow",
+  "roster.status.active": "Actif",
+  "roster.status.archived": "Archivé",
+  "roster.tabs.agent": "Agent",
+  "roster.tabs.human": "Humain",
+  "roster.tabsLabel": "Type de roster",
+  "roster.updateSuccess": "Agent mis à jour.",
+  "roster.usageStatus.draft": "Brouillon"
+}
diff --git a/web/i18n/fr-FR/app-log.json b/web/i18n/fr-FR/app-log.json
index be16121b1cc..15fb81152bb 100644
--- a/web/i18n/fr-FR/app-log.json
+++ b/web/i18n/fr-FR/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Aujourd'hui",
   "filter.period.yearToDate": "Année à ce jour",
   "filter.sortBy": "Trier par :",
+  "monitoring.description": "Le monitoring enregistre l’état de fonctionnement de l’application, notamment les performances, l’activité des utilisateurs et les coûts.",
   "promptLog": "Journal de consigne",
   "runDetail.fileListDetail": "Détail",
   "runDetail.fileListLabel": "Détails du fichier",
diff --git a/web/i18n/fr-FR/billing.json b/web/i18n/fr-FR/billing.json
index 892a57c9940..724f26b69c8 100644
--- a/web/i18n/fr-FR/billing.json
+++ b/web/i18n/fr-FR/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Passez à la version supérieure pour débloquer le téléchargement de documents en lot",
   "upgrade.uploadMultiplePages.description": "Vous avez atteint la limite de téléchargement — un seul document peut être sélectionné et téléchargé à la fois avec votre abonnement actuel.",
   "upgrade.uploadMultiplePages.title": "Passez à la version supérieure pour télécharger plusieurs documents à la fois",
+  "upgrade.workflowRestore.description": "La restauration des versions du workflow n'est pas disponible avec votre plan actuel.",
+  "upgrade.workflowRestore.title": "Mettez à niveau pour restaurer les versions du workflow",
   "upgradeBtn.encourage": "Mettre à niveau maintenant",
   "upgradeBtn.encourageShort": "Mise à niveau",
   "upgradeBtn.plain": "Mettre à jour le plan",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index 9d91924916d..bec097fe0f7 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Changer d’espace de travail",
   "mcpPage.description": "Connectez et gérez des serveurs MCP pour donner à vos apps accès à des outils et services externes.",
-  "members.admin": "Administrateur",
   "members.adminTip": "Peut construire des applications & gérer les paramètres de l'équipe",
+  "members.alreadyInTeam": "Déjà dans l’équipe",
+  "members.alreadyInTeamTip": "Ces utilisateurs ont déjà accès à cet espace de travail.",
   "members.builder": "Constructeur",
   "members.builderTip": "Peut créer et modifier ses propres applications",
-  "members.datasetOperator": "Administrateur des connaissances",
   "members.datasetOperatorTip": "Seul peut gérer la base de connaissances",
   "members.deleteMember": "Supprimer Membre",
   "members.disInvite": "Annuler l'invitation",
-  "members.editor": "Éditeur",
   "members.editorTip": "Peut construire des applications, mais ne peut pas gérer les paramètres de l'équipe",
   "members.email": "Courrier électronique",
   "members.emailInvalid": "Format de courriel invalide",
@@ -270,13 +269,12 @@
   "members.invite": "Ajouter",
   "members.inviteTeamMember": "Ajouter un membre de l'équipe",
   "members.inviteTeamMemberTip": "Ils peuvent accéder directement à vos données d'équipe après s'être connectés.",
-  "members.invitedAsRole": "Invité en tant qu'utilisateur {{role}}",
+  "members.invitedAsRole": "Invité en tant que {{role}}",
   "members.lastActive": "DERNIÈRE ACTIVITÉ",
   "members.name": "NOM",
-  "members.normal": "Normal",
+  "members.noNewInvitationsSent": "Aucune nouvelle invitation envoyée",
   "members.normalTip": "Peut seulement utiliser des applications, ne peut pas construire des applications",
   "members.ok": "D'accord",
-  "members.owner": "Propriétaire",
   "members.pending": "En attente...",
   "members.removeFromTeam": "Retirer de l'équipe",
   "members.removeFromTeamTip": "Supprimera l'accès de l'équipe",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Connaissance",
   "menus.datasetsTips": "COMING SOON: Import your own text data or write data in real-time via Webhook for LLM context enhancement.",
+  "menus.deployments": "Déploiements",
   "menus.explore": "Explorer",
   "menus.exploreMarketplace": "Explorer Marketplace",
   "menus.newApp": "Nouvelle Application",
   "menus.newDataset": "Créer des Connaissances",
   "menus.plugins": "Intégrations",
   "menus.pluginsTips": "Intégrez des intégrations tiers ou créez des AI-Intégrations compatibles avec ChatGPT.",
+  "menus.roster": "Répertoire des agents",
   "menus.status": "bêta",
   "menus.tools": "Outils",
   "model.addMoreModel": "Allez dans les paramètres pour ajouter plus de modèles",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Modèle de Texte-à-Parole",
   "modelProvider.ttsModel.tip": "Définissez le modèle par défaut pour l'entrée de texte à la parole dans une conversation.",
   "modelProvider.upgradeForLoadBalancing": "Mettez à niveau votre plan pour activer l’équilibrage de charge.",
+  "navigation.skipToMain": "Aller au contenu principal",
   "noData": "Aucune donnée",
   "operation.add": "Ajouter",
   "operation.added": "Ajouté",
@@ -600,9 +601,6 @@
   "placeholder.input": "Veuillez entrer",
   "placeholder.search": "Rechercher...",
   "placeholder.select": "Veuillez sélectionner",
-  "plugin.serpapi.apiKey": "Clé API",
-  "plugin.serpapi.apiKeyPlaceholder": "Entrez votre clé API",
-  "plugin.serpapi.keyFrom": "Obtenez votre clé SerpAPI depuis la page de compte SerpAPI",
   "promptEditor.context.item.desc": "Insérez le modèle de contexte",
   "promptEditor.context.item.title": "Contexte",
   "promptEditor.context.modal.add": "Ajouter Contexte",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
new file mode 100644
index 00000000000..90dafb5dee7
--- /dev/null
+++ b/web/i18n/fr-FR/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API du service backend",
+  "access.api.copyCurlExample": "Copier l'exemple cURL",
+  "access.api.createFailed": "Échec de la génération du Token API.",
+  "access.api.createKey": "Générer un Token API",
+  "access.api.createKeyTitle": "Générer un nouveau Token API",
+  "access.api.curlExampleTitle": "Exemple cURL",
+  "access.api.description": "Accédez à ce déploiement via HTTP. Chaque Token API est limité à un seul environnement.",
+  "access.api.developerTitle": "API développeur",
+  "access.api.disabled": "L'accès API est désactivé pour ce déploiement.",
+  "access.api.disabledHint": "Activez l'accès API pour générer des tokens limités à un environnement.",
+  "access.api.dismissToken": "Fermer le Token API",
+  "access.api.docs": "Documentation API",
+  "access.api.docsClose": "Fermer la documentation API",
+  "access.api.docsDescription": "Consultez la référence de l'API Workflow pour ce déploiement.",
+  "access.api.docsTitle": "Documentation de l'API Workflow",
+  "access.api.empty": "Déployez d'abord dans un environnement pour commencer à émettre des Tokens API.",
+  "access.api.emptyTitle": "Aucun environnement déployé",
+  "access.api.endpoint": "URL de requête",
+  "access.api.envPrefix": "env : {{env}}",
+  "access.api.keyList": "Liste des Tokens API",
+  "access.api.nameLabel": "Nom du Token API",
+  "access.api.namePlaceholder": "Entrez un nom de Token API",
+  "access.api.nameRequired": "Le nom du Token API est requis.",
+  "access.api.newKey": "Générer un nouveau Token API",
+  "access.api.newTokenDescription": "Ce Token API n'est affiché qu'une seule fois. Copiez-le avant de quitter cette page.",
+  "access.api.newTokenLabel": "Token API",
+  "access.api.newTokenTitle": "Token API généré",
+  "access.api.noKeys": "Aucun Token API pour le moment. Générez-en un pour commencer à appeler l'API.",
+  "access.api.noKeysTitle": "Aucun Token API pour le moment",
+  "access.api.revokeConfirmDescription": "Le Token API « {{name}} » cessera immédiatement de fonctionner. Cette action est irréversible.",
+  "access.api.revokeConfirmTitle": "Révoquer le Token API ?",
+  "access.api.revokeFailed": "Échec de la révocation du Token API.",
+  "access.api.revokeSuccess": "Token API révoqué",
+  "access.api.table.action": "Action",
+  "access.api.table.environment": "Environnement",
+  "access.api.table.key": "Token API",
+  "access.api.table.name": "Nom",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Canal",
+  "access.channels.col.endpoint": "Point d'entrée",
+  "access.channels.col.status": "Statut",
+  "access.channels.description": "Les points d'entrée WebApp et CLI utilisent les autorisations d'accès ci-dessus.",
+  "access.channels.disabled": "Les canaux d'accès sont désactivés pour ce déploiement.",
+  "access.channels.disabledHint": "Activez les canaux d'accès pour exposer les points d'entrée WebApp et CLI.",
+  "access.channels.followPermission": "Suit les autorisations",
+  "access.channels.title": "Canaux d'accès",
+  "access.cli.description": "Invoquez depuis le terminal avec difyctl, adapté aux scripts, aux workflows automatisés ou aux intégrations d'Agent.",
+  "access.cli.docs": "Guide d'utilisation",
+  "access.cli.domain": "Domaine",
+  "access.cli.empty": "Point de terminaison CLI non configuré.",
+  "access.cli.install": "Installer CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Copié",
+  "access.copy": "Copier",
+  "access.copyFailed": "Échec de la copie",
+  "access.copyToast": "Copié dans le presse-papiers",
+  "access.hide": "Masquer",
+  "access.members.clearAll": "Tout effacer",
+  "access.members.empty": "Aucun résultat trouvé.",
+  "access.members.groupCount_one": "{{count}} groupe",
+  "access.members.groupCount_other": "{{count}} groupes",
+  "access.members.groups": "Groupes",
+  "access.members.individuals": "Membres",
+  "access.members.memberCount_one": "{{count}} membre",
+  "access.members.memberCount_other": "{{count}} membres",
+  "access.members.pickPlaceholder": "Sélectionnez des groupes ou des membres",
+  "access.members.searchPlaceholder": "Rechercher des groupes et des membres",
+  "access.members.selectedLabel": "Sélectionnés",
+  "access.permission.anyone": "Toute personne disposant du lien",
+  "access.permission.anyoneDesc": "Tout le monde peut accéder à ce déploiement sans se connecter.",
+  "access.permission.memberCount_one": "{{count}} membre",
+  "access.permission.memberCount_other": "{{count}} membres",
+  "access.permission.organization": "Tous les membres de la plateforme",
+  "access.permission.organizationDesc": "Tous les membres de la plateforme",
+  "access.permission.specific": "Membres spécifiques de la plateforme",
+  "access.permission.specificDesc": "Sélectionnez des groupes ou des membres spécifiques",
+  "access.permission.specificUnavailable": "La sélection de membres spécifiques est désactivée tant que des membres et groupes réels de la plateforme ne sont pas connectés.",
+  "access.permission.updateFailed": "Échec de la mise à jour de la politique d'accès.",
+  "access.permissions.col.environment": "Environnement",
+  "access.permissions.col.permission": "Accès",
+  "access.permissions.description": "Définissez les autorisations d'accès pour les points d'entrée WebApp et CLI dans chaque environnement.",
+  "access.permissions.editAriaLabel": "Configurer l'accès pour {{environment}}",
+  "access.permissions.editDescription": "Définissez les autorisations d'accès pour les points d'entrée WebApp et CLI.",
+  "access.permissions.editTitle": "Autorisations d'accès",
+  "access.permissions.title": "Autorisations d'accès",
+  "access.revoke": "Révoquer",
+  "access.runAccess.description": "Gérez comment les utilisateurs peuvent exécuter ce déploiement et qui est autorisé à y accéder par environnement.",
+  "access.runAccess.disabled": "L'accès d'exécution est désactivé pour ce déploiement.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Exposez ce déploiement en tant que serveur Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Point de terminaison MCP non configuré.",
+  "access.runAccess.noEnvs": "Déployez dans un environnement pour configurer les autorisations d'accès.",
+  "access.runAccess.noEnvsTitle": "Aucun environnement déployé",
+  "access.runAccess.openWebapp": "Ouvrir la WebApp",
+  "access.runAccess.permissions": "Autorisations d'accès",
+  "access.runAccess.permissionsDesc": "Qui peut accéder à ce déploiement dans chaque environnement.",
+  "access.runAccess.title": "Accès d'exécution",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Page web hébergée pour les utilisateurs finaux.",
+  "access.runAccess.webappEmpty": "Bientôt disponible.",
+  "access.show": "Afficher",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Externe",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Inconnu",
+  "card.access.api": "Tokens API",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Aucun accès",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Créer la première version",
+  "card.deploy": "Déployer",
+  "card.deploying": "{{count}} en cours de déploiement",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} en échec",
+  "card.fromApp": "Depuis {{name}}",
+  "card.lastDeployed": "Dernier déploiement {{time}}",
+  "card.menu.delete": "Supprimer le déploiement",
+  "card.menu.deleteDisabled": "La suppression de déploiement n'est pas encore disponible pour les déploiements gérés par le backend.",
+  "card.menu.deploy": "Déployer dans un environnement",
+  "card.menu.editInfo": "Modifier les informations",
+  "card.menu.viewDetail": "Voir les détails du déploiement",
+  "card.moreActions": "Plus d'actions",
+  "card.neverDeployed": "Pas encore déployé",
+  "card.noDescription": "Aucune description fournie.",
+  "card.notDeployed": "Non déployé",
+  "card.ready": "{{count}} en cours d'exécution",
+  "card.tooltip.createdAt": "Créé",
+  "card.tooltip.deployed": "Déployé",
+  "card.tooltip.deploymentStatus": "Déploiement",
+  "card.tooltip.notDeployed": "Ce déploiement n'a encore été déployé dans aucun environnement.",
+  "card.tooltip.notDeployedShort": "Non déployé",
+  "card.tooltip.release": "Version",
+  "card.tooltip.releaseName": "Nom de la version",
+  "card.tooltip.source": "Source",
+  "common.loadFailed": "Échec du chargement. Réessayez plus tard.",
+  "common.loading": "Chargement...",
+  "createGuide.actions.back": "Retour",
+  "createGuide.actions.cancel": "Annuler",
+  "createGuide.actions.continue": "Continuer",
+  "createGuide.actions.createAndDeploy": "Créer et déployer",
+  "createGuide.actions.creating": "Création en cours...",
+  "createGuide.actions.deploy": "Déployer",
+  "createGuide.actions.deploying": "Création et déploiement...",
+  "createGuide.actions.next": "Suivant",
+  "createGuide.actions.skipDeploy": "Ignorer, déployer plus tard",
+  "createGuide.description": "Créez un déploiement à partir d'une source de version, des informations de base et d'un environnement cible.",
+  "createGuide.dsl.defaultAppName": "Application DSL importée",
+  "createGuide.dsl.description": "Téléversez un package DSL Workflow pour créer le déploiement, la première version et le déploiement optionnel dans un environnement.",
+  "createGuide.dsl.dropDescription": "Téléversez un package DSL YAML Workflow. Les options de déploiement sont résolues à partir de ce fichier avant le déploiement.",
+  "createGuide.dsl.dropTitle": "Téléverser un package DSL Workflow",
+  "createGuide.dsl.readFailed": "Échec de la lecture du fichier DSL. Choisissez un autre fichier et réessayez.",
+  "createGuide.dsl.reading": "Lecture du fichier DSL...",
+  "createGuide.dsl.title": "Importer un DSL",
+  "createGuide.dsl.unsupportedMode": "Seuls les fichiers DSL Workflow peuvent être utilisés pour les déploiements.",
+  "createGuide.errors.createReleaseFailed": "Échec de la création du déploiement ou de la version.",
+  "createGuide.errors.deployFailed": "Échec du déploiement dans l'environnement.",
+  "createGuide.method.description": "Choisissez la source utilisée pour créer la première version.",
+  "createGuide.methods.bindApp.description": "Utilisez une application Workflow existante dans Studio comme source de version.",
+  "createGuide.methods.bindApp.title": "Lier une application Workflow existante",
+  "createGuide.methods.importDsl.description": "Téléversez un package DSL YAML Workflow et continuez dans l'interface de déploiement.",
+  "createGuide.methods.importDsl.title": "Importer un DSL",
+  "createGuide.methods.mocked": "Simulé",
+  "createGuide.nav.back": "Déploiements",
+  "createGuide.release.defaultName": "version initiale",
+  "createGuide.release.deployInfo": "Informations de déploiement",
+  "createGuide.release.description": "Renseignez les informations du déploiement et les détails de la première version.",
+  "createGuide.release.firstVersion": "Première version",
+  "createGuide.release.instanceDescription": "Description du déploiement",
+  "createGuide.release.instanceDescriptionPlaceholder": "Décrivez à quoi sert ce déploiement",
+  "createGuide.release.instanceName": "Nom du déploiement",
+  "createGuide.release.instanceNameConflict": "Un déploiement portant ce nom existe déjà. Choisissez un autre nom.",
+  "createGuide.release.releaseDescription": "Description de la version",
+  "createGuide.release.releaseDescriptionPlaceholder": "Décrivez cette version",
+  "createGuide.release.releaseName": "Nom de la version",
+  "createGuide.release.releaseNote": "Description de la version",
+  "createGuide.release.title": "Informations de base",
+  "createGuide.source.availableApps_one": "{{count}} application",
+  "createGuide.source.availableApps_other": "{{count}} applications",
+  "createGuide.source.clearSearch": "Effacer la recherche d'application",
+  "createGuide.source.description": "Choisissez la source utilisée pour créer la première version.",
+  "createGuide.source.empty": "Aucune application Workflow trouvée.",
+  "createGuide.source.searchPlaceholder": "Rechercher des applications",
+  "createGuide.source.sourceApp": "Application Workflow",
+  "createGuide.source.title": "Source de la version",
+  "createGuide.steps.method": "Source de la version",
+  "createGuide.steps.release": "Informations de base",
+  "createGuide.steps.source": "Source de la version",
+  "createGuide.steps.target": "Déployer dans un environnement",
+  "createGuide.target.bindingCount_one": "{{count}} liaison",
+  "createGuide.target.bindingCount_other": "{{count}} liaisons",
+  "createGuide.target.bindingHint": "Choisissez les identifiants utilisés par cette version.",
+  "createGuide.target.bindings": "Identifiants",
+  "createGuide.target.deferredBindingHint": "Les identifiants seront résolus à partir du plan de déploiement réel lors de l'action de déploiement finale.",
+  "createGuide.target.deferredEnvironmentHint": "Le nom est confronté aux environnements réels après la création du déploiement et de la version.",
+  "createGuide.target.description": "Choisissez un environnement cible et fournissez les paramètres d'exécution dont cette version a besoin. Cette étape peut être ignorée.",
+  "createGuide.target.envVarCount_one": "{{count}} variable",
+  "createGuide.target.envVarCount_other": "{{count}} variables",
+  "createGuide.target.envVarHint": "Pour chaque variable d'environnement requise par cette version, saisissez une valeur personnalisée ou utilisez la valeur définie dans l'application.",
+  "createGuide.target.envVarPlaceholder": "Entrez une valeur",
+  "createGuide.target.envVarSource.ariaLabel": "Sélectionnez la source de la valeur de la variable pour {{key}}",
+  "createGuide.target.envVarSource.default": "Valeur de l'application",
+  "createGuide.target.envVarSource.lastDeployment": "Valeur du dernier déploiement",
+  "createGuide.target.envVarSource.literal": "Valeur personnalisée",
+  "createGuide.target.envVarType.number": "Nombre",
+  "createGuide.target.envVarType.secret": "Secret",
+  "createGuide.target.envVarType.string": "Chaîne",
+  "createGuide.target.envVars": "Variables d'environnement",
+  "createGuide.target.environment": "Environnement cible",
+  "createGuide.target.environmentName": "Nom de l'environnement",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "Échec du chargement des identifiants.",
+  "createGuide.target.loadEnvironmentsFailed": "Échec du chargement des environnements de déploiement.",
+  "createGuide.target.missingRequiredBinding": "Sélectionnez un identifiant pour cette liaison requise.",
+  "createGuide.target.noBindingRequired": "Aucun identifiant requis.",
+  "createGuide.target.noCredentialCandidates": "Aucun identifiant disponible.",
+  "createGuide.target.noEnvironmentOptions": "Aucun environnement de déploiement disponible.",
+  "createGuide.target.required": "Requis",
+  "createGuide.target.selectCredential": "Sélectionnez un identifiant",
+  "createGuide.target.title": "Déployer dans un environnement",
+  "createGuide.title": "Nouveau déploiement",
+  "createModal.appPickerPlaceholder": "Sélectionnez une application Workflow",
+  "createModal.appSearchEmpty": "Aucune application Workflow correspondante",
+  "createModal.appSearchPlaceholder": "Rechercher des applications Workflow…",
+  "createModal.cancel": "Annuler",
+  "createModal.create": "Créer",
+  "createModal.createFailed": "Échec de la création du déploiement.",
+  "createModal.description": "Choisissez une application Workflow et créez un déploiement.",
+  "createModal.descriptionLabel": "Description",
+  "createModal.descriptionPlaceholder": "Décrivez à quoi sert ce déploiement",
+  "createModal.loadMoreApps": "Charger plus d'applications",
+  "createModal.loadingApps": "Chargement des applications…",
+  "createModal.nameLabel": "Nom du déploiement",
+  "createModal.namePlaceholder": "Nom du déploiement",
+  "createModal.noApps": "Aucune application Workflow trouvée dans cet espace de travail. Créez-en une d'abord dans Studio.",
+  "createModal.selected": "Sélectionnée",
+  "createModal.sourceApp": "Application Workflow (requise)",
+  "createModal.title": "Nouveau déploiement",
+  "deployDrawer.bindingCount_one": "{{count}} liaison",
+  "deployDrawer.bindingCount_other": "{{count}} liaisons",
+  "deployDrawer.bindingOptionsFailed": "Échec du chargement des options d'identifiants.",
+  "deployDrawer.bindingSelectionHint": "Choisissez les identifiants utilisés par ce déploiement.",
+  "deployDrawer.bindingsDisabled": "Résolu à partir de l'aperçu de la version. La modification n'est pas encore disponible.",
+  "deployDrawer.cancel": "Annuler",
+  "deployDrawer.close": "Fermer le panneau de déploiement",
+  "deployDrawer.defaultSelect": "Sélectionner...",
+  "deployDrawer.deploy": "Déployer dans un environnement",
+  "deployDrawer.deployExistingRelease": "Déployer dans un environnement",
+  "deployDrawer.deployExistingReleaseDescription": "Sélectionnez une version et un environnement cible à déployer.",
+  "deployDrawer.deployExistingReleaseTitle": "Déployer dans un environnement",
+  "deployDrawer.deployFailed": "Échec du démarrage du déploiement.",
+  "deployDrawer.deploying": "Déploiement en cours...",
+  "deployDrawer.description": "Sélectionnez une version et un environnement cible à déployer.",
+  "deployDrawer.envVarCount_one": "{{count}} variable",
+  "deployDrawer.envVarCount_other": "{{count}} variables",
+  "deployDrawer.envVarHint": "Pour chaque variable d'environnement requise par cette version, saisissez une valeur personnalisée ou utilisez la valeur définie dans l'application.",
+  "deployDrawer.envVarPlaceholder": "Entrez une valeur",
+  "deployDrawer.envVarSource.ariaLabel": "Sélectionnez la source de la valeur de la variable pour {{key}}",
+  "deployDrawer.envVarSource.default": "Valeur de l'application",
+  "deployDrawer.envVarSource.lastDeployment": "Valeur du dernier déploiement",
+  "deployDrawer.envVarSource.literal": "Valeur personnalisée",
+  "deployDrawer.envVarType.number": "Nombre",
+  "deployDrawer.envVarType.secret": "Secret",
+  "deployDrawer.envVarType.string": "Chaîne",
+  "deployDrawer.envVars": "Variables d'environnement",
+  "deployDrawer.existingReleaseHint": "Cette version sera déployée telle quelle. Aucune nouvelle version ne sera créée.",
+  "deployDrawer.loadingBindings": "Résolution en cours...",
+  "deployDrawer.lockedHint": "Verrouillé sur l'environnement actuel",
+  "deployDrawer.missingRequiredBinding": "Sélectionnez un identifiant pour cette liaison requise.",
+  "deployDrawer.missingRequiredEnvVar": "Entrez une valeur pour cette variable d'environnement requise.",
+  "deployDrawer.modelCreds": "Identifiants de modèle",
+  "deployDrawer.needsValidation": " (nécessite une validation)",
+  "deployDrawer.newReleaseHint": "Une nouvelle version sera créée à partir du YAML de l'application Workflow sélectionnée.",
+  "deployDrawer.noBindingRequired": "Non requis",
+  "deployDrawer.noCredentialCandidates": "Aucun identifiant disponible.",
+  "deployDrawer.noNewEnvironmentAvailable": "Tous les environnements disponibles ont déjà un déploiement.",
+  "deployDrawer.noOtherReleaseAvailable": "Aucune autre version n'est disponible pour cet environnement.",
+  "deployDrawer.noReleaseAvailable": "Créez une version avant de déployer dans un environnement.",
+  "deployDrawer.notFound": "Déploiement introuvable.",
+  "deployDrawer.noteLabel": "Description de la version (facultatif)",
+  "deployDrawer.notePlaceholder": "ex. Ajustement du texte d'onboarding",
+  "deployDrawer.pluginCreds": "Identifiants de plugin",
+  "deployDrawer.promote": "Déployer",
+  "deployDrawer.promoteDescription": "Sélectionnez une version et un environnement cible à déployer.",
+  "deployDrawer.promoteTitle": "Déployer dans un environnement",
+  "deployDrawer.readOnly": "Lecture seule",
+  "deployDrawer.redeploy": "Déployer dans un environnement",
+  "deployDrawer.redeployDescription": "Sélectionnez une version et un environnement cible à déployer.",
+  "deployDrawer.redeployExistingReleaseHint": "La version actuelle sera redéployée telle quelle. Aucune nouvelle version ne sera créée.",
+  "deployDrawer.redeployTitle": "Déployer dans un environnement",
+  "deployDrawer.releaseLabel": "Version",
+  "deployDrawer.requiredBinding": "Requis",
+  "deployDrawer.rollback": "Déployer",
+  "deployDrawer.rollbackDescription": "Sélectionnez une version et un environnement cible à déployer.",
+  "deployDrawer.rollbackTitle": "Déployer dans un environnement",
+  "deployDrawer.runtimeCredentials": "Identifiants",
+  "deployDrawer.secretPlaceholder": "secret",
+  "deployDrawer.selectCredential": "Sélectionnez un identifiant",
+  "deployDrawer.selectEnv": "Sélectionnez un environnement",
+  "deployDrawer.selectProviderCred": "Sélectionnez un identifiant {{provider}}",
+  "deployDrawer.selectProviderKey": "Sélectionnez une clé {{provider}}",
+  "deployDrawer.selectRelease": "Sélectionnez une version",
+  "deployDrawer.targetEnv": "Environnement cible",
+  "deployDrawer.title": "Déployer dans un environnement",
+  "deployDrawer.valuePlaceholder": "valeur",
+  "deployTab.cancelDeployment": "Annuler le déploiement",
+  "deployTab.closeError": "Fermer",
+  "deployTab.col.actions": "Actions",
+  "deployTab.col.currentRelease": "Version actuelle",
+  "deployTab.col.environment": "Environnement",
+  "deployTab.col.status": "Statut",
+  "deployTab.col.updated": "Mis à jour",
+  "deployTab.collapseDetails": "Réduire les détails du déploiement",
+  "deployTab.confirmUndeploy": "Annuler le déploiement",
+  "deployTab.deployOtherVersion": "Déployer une autre version",
+  "deployTab.deployToEnv": "Déployer dans {{name}}",
+  "deployTab.deployToNewEnv": "Déployer dans un nouvel environnement...",
+  "deployTab.empty": "Aucune instance pour le moment. Déployez dans un nouvel environnement pour commencer.",
+  "deployTab.emptyDescription": "Choisissez une version et un environnement cible pour mettre ce déploiement à la disposition des utilisateurs.",
+  "deployTab.emptyTitle": "Aucun environnement en cours d'exécution",
+  "deployTab.envCount": "Environnements",
+  "deployTab.errorCode": "Code",
+  "deployTab.errorDialogDesc": "Examinez le dernier déploiement en échec avant de réessayer ou de déployer une autre version.",
+  "deployTab.errorDialogTitle": "Erreur de déploiement dans {{name}}",
+  "deployTab.errorMessage": "Message",
+  "deployTab.errorPhase": "Phase",
+  "deployTab.expandDetails": "Développer les détails du déploiement",
+  "deployTab.moreActions": "Plus d'actions",
+  "deployTab.newDeployment": "Déployer dans un nouvel environnement",
+  "deployTab.panel.commit": "ID de commit",
+  "deployTab.panel.deploymentId": "ID de déploiement",
+  "deployTab.panel.endpoints": "Points de terminaison",
+  "deployTab.panel.envVars": "Variables d'environnement",
+  "deployTab.panel.error": "Erreur",
+  "deployTab.panel.failedRelease": "Version en échec",
+  "deployTab.panel.health": "Santé",
+  "deployTab.panel.instanceInfo": "Informations sur l'instance",
+  "deployTab.panel.modelCreds": "Identifiants de modèle",
+  "deployTab.panel.pluginCreds": "Identifiants de plugin",
+  "deployTab.panel.release": "Version",
+  "deployTab.panel.releaseCreatedAt": "Version créée le",
+  "deployTab.panel.releaseInfo": "Informations sur la version",
+  "deployTab.panel.replicas": "Répliques",
+  "deployTab.panel.run": "Exécuter",
+  "deployTab.panel.runtimeBindings": "Identifiants",
+  "deployTab.panel.runtimeInfo": "Informations d'exécution",
+  "deployTab.panel.runtimeMode": "Mode d'exécution",
+  "deployTab.panel.runtimeNote": "Note d'exécution",
+  "deployTab.panel.targetRelease": "Version cible",
+  "deployTab.panel.unknownError": "Échec du déploiement.",
+  "deployTab.promote": "Déployer",
+  "deployTab.redeploy": "Redéployer",
+  "deployTab.releaseCreatedAt": "Version créée {{time}}",
+  "deployTab.retry": "Réessayer",
+  "deployTab.shortcut": "Raccourci",
+  "deployTab.status.deployFailed": "Échec du déploiement",
+  "deployTab.status.deployingRelease": "Déploiement en cours ({{release}})",
+  "deployTab.status.runningOutOfSync": "En cours d'exécution (synchronisation en attente)",
+  "deployTab.status.runningWithFailed": "En cours d'exécution (dernier déploiement en échec)",
+  "deployTab.undeploy": "Annuler le déploiement",
+  "deployTab.undeployConfirmDesc": "L'accès des utilisateurs finaux s'arrêtera immédiatement. La version pourra être redéployée plus tard.",
+  "deployTab.undeployConfirmTitle": "Annuler le déploiement depuis {{name}} ?",
+  "deployTab.undeployFrom": "Annuler le déploiement depuis {{name}}",
+  "deployTab.undeployImpactTitle": "Instance affectée",
+  "deployTab.viewError": "Voir l'erreur",
+  "deployTab.viewLogs": "Voir les logs",
+  "deployTab.viewProgress": "Voir la progression",
+  "detail.backToInstances": "Retour aux déploiements",
+  "detail.deployingCount": "{{count}} en cours de déploiement",
+  "detail.envCount_one": "{{count}} env",
+  "detail.envCount_other": "{{count}} envs",
+  "detail.failedCount": "{{count}} en échec",
+  "detail.mobileTabs": "Sections du déploiement",
+  "detail.notFound": "Déploiement introuvable",
+  "detail.openSourceApp": "Ouvrir la source {{name}}",
+  "detail.sourceApp": "Source",
+  "detail.sourceAppLink": "Source",
+  "documentTitle.create": "Nouveau déploiement · Déploiements",
+  "documentTitle.detail": "Déploiement · Déploiements",
+  "documentTitle.list": "Déploiements",
+  "filter.allEnvs": "Tous les environnements",
+  "filter.notDeployed": "Non déployé",
+  "filter.searchPlaceholder": "Rechercher des déploiements",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Admission",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Initialisation",
+  "health.ENVIRONMENT_STATUS_DELETING": "Suppression",
+  "health.ENVIRONMENT_STATUS_FAILED": "Indisponible",
+  "health.ENVIRONMENT_STATUS_READY": "Disponible",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Inconnu",
+  "list.clearFilters": "Effacer les filtres",
+  "list.clearSearch": "Effacer la recherche de déploiement",
+  "list.createDeployment": "Nouveau",
+  "list.empty": "Aucun déploiement trouvé.",
+  "list.emptyDescription": "Créez un déploiement à partir d'une application Workflow ou d'un package DSL Workflow pour gérer les versions, les environnements et l'accès.",
+  "list.emptyFilteredDescription": "Aucun déploiement ne correspond à la recherche ou au filtre d'environnement actuel.",
+  "list.emptyFilteredTitle": "Aucun déploiement correspondant",
+  "list.emptyTitle": "Aucun déploiement pour le moment",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Isolé",
+  "mode.ENVIRONMENT_MODE_SHARED": "Partagé",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Inconnu",
+  "newInstance.comingSoon": "Bientôt disponible",
+  "newInstance.fromStudio": "Sélectionner depuis Studio",
+  "newInstance.importDSL": "Importer un DSL",
+  "newInstance.title": "Nouveau déploiement",
+  "overview.accessEndpoints": "Points de terminaison d'accès",
+  "overview.accessMeta.apiTokens": "Gérer les Tokens API",
+  "overview.accessMeta.cli": "Voir l'accès CLI",
+  "overview.accessMeta.webApp": "Gérer l'accès WebApp",
+  "overview.accessStatus": "Accès",
+  "overview.api": "Tokens API",
+  "overview.apiKeysCount_one": "{{count}} Token API",
+  "overview.apiKeysCount_other": "{{count}} Tokens API",
+  "overview.apiTokenSummary.environments_one": "{{count}} environnement déployé",
+  "overview.apiTokenSummary.environments_other": "{{count}} environnements déployés",
+  "overview.availableForDeployment": "Disponible pour le déploiement",
+  "overview.basicInfo": "Informations de base",
+  "overview.cardAction.deployLatest": "Déployer la dernière version",
+  "overview.cardAction.redeploy": "Redéployer",
+  "overview.cardAction.viewProgress": "Voir le déploiement",
+  "overview.chip.behindTooltip_one": "1 version en retard par rapport à la dernière. Déployez la dernière version pour mettre à jour.",
+  "overview.chip.behindTooltip_other": "{{count}} versions en retard par rapport à la dernière. Déployez la dernière version pour mettre à jour.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "déploiement en cours",
+  "overview.chip.deployingTooltip": "Un déploiement est en cours.",
+  "overview.chip.empty": "vide",
+  "overview.chip.emptyTooltip": "Aucune version n'est déployée dans cet environnement.",
+  "overview.chip.failed": "en échec",
+  "overview.chip.failedTooltip": "La dernière tentative de déploiement a échoué.",
+  "overview.chip.latest": "dernière",
+  "overview.chip.latestTooltip": "Cet environnement exécute la dernière version.",
+  "overview.chip.needsReleaseFirst": "Créez d'abord une version",
+  "overview.chip.olderRelease": "ancienne",
+  "overview.chip.olderReleaseTooltip": "Cet environnement exécute une version plus ancienne.",
+  "overview.chip.openInDeployTab": "Voir la progression du déploiement",
+  "overview.cli": "CLI",
+  "overview.configured": "Configuré",
+  "overview.createRelease": "Créer une version",
+  "overview.created": "Créé",
+  "overview.deploy": "Déployer",
+  "overview.deployedEnvironments": "déployés",
+  "overview.deploymentOverview": "Aperçu du déploiement",
+  "overview.deploymentStatus": "Statut du déploiement",
+  "overview.description": "Description",
+  "overview.developerApi": "API développeur",
+  "overview.disabled": "Désactivé",
+  "overview.emptyValue": "Non défini",
+  "overview.enabled": "Activé",
+  "overview.enabledChannels": "accès activé",
+  "overview.endUserAccess": "Accès des utilisateurs finaux",
+  "overview.environments": "Environnements",
+  "overview.hero.byName": "par {{name}}",
+  "overview.hero.empty": "Aucune version pour le moment",
+  "overview.hero.emptyDescription": "Créez une version à partir de la source actuelle avant de déployer.",
+  "overview.hero.propagation_one": "déployé dans {{count}}/{{total}} environnement",
+  "overview.hero.propagation_other": "déployé dans {{count}}/{{total}} environnements",
+  "overview.hero.untargeted": "aucun environnement configuré pour le moment",
+  "overview.instanceDetails": "Détails du déploiement",
+  "overview.instanceId": "ID de déploiement",
+  "overview.latestRelease.releaseCount_one": "{{count}} version",
+  "overview.latestRelease.releaseCount_other": "{{count}} versions",
+  "overview.latestReleaseTitle": "Dernière version",
+  "overview.manageDeployments": "Gérer les déploiements",
+  "overview.name": "Nom",
+  "overview.noAccessConfig": "Aucune configuration d'accès.",
+  "overview.noReleaseYet": "Créez une version avant de déployer dans un environnement.",
+  "overview.notConfigured": "Non configuré",
+  "overview.previousReleases.empty": "Aucune version antérieure pour le moment.",
+  "overview.previousReleases.retired": "Non déployée actuellement",
+  "overview.previousReleases.title": "Versions précédentes",
+  "overview.previousReleases.viewAll": "Tout voir",
+  "overview.ready": "Déployable",
+  "overview.recentReleases": "Versions récentes",
+  "overview.releaseDeployedTitle": "{{release}} est déployée",
+  "overview.releaseReadyTitle": "{{release}} est prête à être déployée",
+  "overview.serviceMap": "Carte des services",
+  "overview.servingRelease": "Diffuse {{release}}",
+  "overview.servingReleaseDescription": "Ce déploiement est déployé dans {{count}}/{{total}} environnements.",
+  "overview.strip.deployToNewEnvironment": "Déployer dans un nouvel environnement",
+  "overview.strip.empty": "Aucun environnement configuré.",
+  "overview.strip.emptyDeployableDescription": "Déployez la dernière version dans un environnement lorsque vous êtes prêt.",
+  "overview.strip.emptyDeployed": "Aucune instance pour le moment.",
+  "overview.strip.emptyDescription": "Créez une version avant de déployer dans un environnement.",
+  "overview.strip.emptyTitle": "Aucune instance pour le moment",
+  "overview.strip.summary_one": "1 sur {{total}} sur la dernière version",
+  "overview.strip.summary_other": "{{count}} sur {{total}} sur la dernière version",
+  "overview.strip.title": "Instances",
+  "overview.switchSourceApp": "Changer de source",
+  "overview.switchSourceAppDescription": "Choisissez l'application Workflow utilisée comme source pour les futures versions.",
+  "overview.switchSourceAppHint": "Après le changement, seules les nouvelles versions créées utilisent la nouvelle source. Les versions historiques et les déploiements existants ne sont pas modifiés.",
+  "overview.targetRelease": "Version cible",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Zone de danger",
+  "settings.dangerDesc": "Supprimez définitivement ce déploiement et arrêtez toutes les instances en cours d'exécution. Cette action est irréversible.",
+  "settings.delete": "Supprimer le déploiement",
+  "settings.deleteConfirmDesc": "Supprimer {{name}} ? Chaque instance s'arrêtera et sera supprimée de tous les environnements. Cette action est irréversible.",
+  "settings.deleteConfirmTitle": "Supprimer le déploiement",
+  "settings.deleteFailed": "Échec de la suppression du déploiement.",
+  "settings.deleteImpact": "Impact",
+  "settings.deleteImpactInstance": "Déploiement",
+  "settings.deleteImpactTitle": "Déploiement affecté",
+  "settings.deleteImpactValue": "Le déploiement est retiré de la liste des déploiements.",
+  "settings.deleted": "Déploiement supprimé",
+  "settings.description": "Description",
+  "settings.descriptionHelp": "Gérez le nom, la description et les autres paramètres de ce déploiement.",
+  "settings.general": "Général",
+  "settings.name": "Nom du déploiement",
+  "settings.reset": "Réinitialiser",
+  "settings.save": "Enregistrer les modifications",
+  "settings.updateFailed": "Échec de la mise à jour du déploiement.",
+  "settings.updated": "Déploiement mis à jour",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Déploiement en cours",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Synchronisation en attente",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Échec du déploiement",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Invalide",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "En cours d'exécution",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non déployé",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annulation du déploiement",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Inconnu",
+  "subtitle": "Gérez les déploiements dans tous les environnements.",
+  "tabs.access.description": "Gérez les canaux d'accès et les autorisations d'accès.",
+  "tabs.access.name": "Accès",
+  "tabs.api-tokens.description": "Gérez les Tokens API et invoquez les instances via HTTP.",
+  "tabs.api-tokens.name": "Tokens API",
+  "tabs.instances.description": "Visualisez et gérez les instances dans les environnements déployés.",
+  "tabs.instances.name": "Instances",
+  "tabs.overview.description": "Consultez le statut du déploiement dans tous les environnements.",
+  "tabs.overview.name": "Aperçu",
+  "tabs.releases.description": "Créez, déployez et gérez les versions.",
+  "tabs.releases.name": "Versions",
+  "tabs.settings.description": "Gérez le nom, la description et les autres paramètres de ce déploiement.",
+  "tabs.settings.name": "Paramètres",
+  "title": "Déploiements",
+  "unsupportedDslNodes.description": "Cette version contient des nœuds que le runtime de déploiement ne prend pas encore en charge. Supprimez-les ou remplacez-les dans Studio, puis réessayez.",
+  "unsupportedDslNodes.descriptionWithTypes": "Cette version contient des nœuds que le runtime de déploiement ne prend pas encore en charge : {{nodeTypes}}. Supprimez-les ou remplacez-les dans Studio, puis réessayez.",
+  "unsupportedDslNodes.title": "Nœuds non pris en charge",
+  "unsupportedDslNodes.unknownType": "Type inconnu",
+  "versions.cancelCreate": "Annuler",
+  "versions.cancelDelete": "Annuler",
+  "versions.cancelEdit": "Annuler",
+  "versions.checkingReleaseContent": "Vérification du contenu de la version...",
+  "versions.col.action": "Action",
+  "versions.col.author": "Créé par",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Créé le",
+  "versions.col.deployedTo": "Déployé dans",
+  "versions.col.release": "Version",
+  "versions.col.sourceApp": "Source",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Créer",
+  "versions.createFailed": "Échec de la création de la version.",
+  "versions.createRelease": "Créer une version",
+  "versions.createReleaseDescription": "Créez une version déployable à partir d'une application Workflow ou d'un fichier DSL Workflow.",
+  "versions.createReleaseHint": "Les nouvelles versions peuvent être déployées dans n'importe quel environnement.",
+  "versions.createSuccess": "Version « {{name}} » créée.",
+  "versions.creating": "Création en cours...",
+  "versions.currentOn": "Version actuelle sur {{name}}",
+  "versions.deleteConfirmDesc": "La version « {{name}} » sera définitivement supprimée. Cette action est irréversible.",
+  "versions.deleteConfirmTitle": "Supprimer la version ?",
+  "versions.deleteFailed": "Échec de la suppression de la version.",
+  "versions.deleteImpactDeployment": "Statut du déploiement",
+  "versions.deleteImpactNotDeployed": "Non déployée actuellement",
+  "versions.deleteImpactRelease": "Version",
+  "versions.deleteImpactTitle": "Impact de la suppression",
+  "versions.deleteRelease": "Supprimer la version",
+  "versions.deleteSuccess": "Version « {{name}} » supprimée.",
+  "versions.deploy": "Déployer",
+  "versions.deployTo": "Déployer dans {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Déploiement en cours",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Synchronisation en attente",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Échec",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Invalide",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "En cours d'exécution",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non déployé",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annulation du déploiement",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Inconnu",
+  "versions.deployingTo": "{{name}} est en cours de déploiement",
+  "versions.disabledReason.checkDeploymentsFailed": "Impossible de vérifier l'utilisation du déploiement. Réessayez plus tard.",
+  "versions.disabledReason.checkingDeployments": "Vérification de l'utilisation du déploiement",
+  "versions.disabledReason.current": "Cette version s'exécute déjà sur {{name}}",
+  "versions.disabledReason.deploying": "Attendez la fin du déploiement actif",
+  "versions.disabledReason.envDisabled": "Cet environnement n'est pas déployable",
+  "versions.disabledReason.releaseInUse_one": "Annulez le déploiement de cette version depuis {{count}} environnement avant de la supprimer",
+  "versions.disabledReason.releaseInUse_other": "Annulez le déploiement de cette version depuis {{count}} environnements avant de la supprimer",
+  "versions.dslReadFailed": "Échec de la lecture du fichier DSL. Choisissez un autre fichier et réessayez.",
+  "versions.dslReading": "Lecture du fichier DSL...",
+  "versions.dslUnsupportedMode": "Seuls les fichiers DSL Workflow peuvent être utilisés pour les déploiements.",
+  "versions.editFailed": "Échec de la mise à jour de la version.",
+  "versions.editRelease": "Modifier la version",
+  "versions.editReleaseDescription": "Mettez à jour le nom et la description de cette version.",
+  "versions.editSuccess": "Version « {{name}} » mise à jour.",
+  "versions.empty": "Aucune version disponible pour le moment.",
+  "versions.emptyDescription": "Créez la première version avant de déployer dans un environnement.",
+  "versions.emptyTitle": "Aucune version pour le moment",
+  "versions.emptyWithCreate": "Aucune version pour le moment. Créez la première version déployable avant de déployer.",
+  "versions.exportDsl": "Exporter le DSL",
+  "versions.exportDslFailed": "Échec de l'export du DSL.",
+  "versions.exportingDsl": "Export en cours...",
+  "versions.groupHeader.deploy": "Déployer",
+  "versions.groupHeader.promote": "Déployer",
+  "versions.groupHeader.rollback": "Déployer une version précédente",
+  "versions.groupHeader.unavailable": "Indisponible",
+  "versions.manualDslOption": "Téléverser le DSL",
+  "versions.moreActions": "Plus d'actions",
+  "versions.optional": "Facultatif",
+  "versions.promote": "Déployer",
+  "versions.promoteTo": "Déployer dans {{name}}",
+  "versions.releaseAlreadyExists": "Une version avec le même contenu existe déjà : {{name}}.",
+  "versions.releaseContentCheckFailed": "Échec de la vérification du contenu de la version.",
+  "versions.releaseDescriptionLabel": "Description",
+  "versions.releaseDescriptionPlaceholder": "Décrivez cette version",
+  "versions.releaseHistory": "Historique des versions",
+  "versions.releaseNameLabel": "Nom de la version",
+  "versions.releaseNamePlaceholder": "Nom de la version",
+  "versions.releaseNameRequired": "Entrez un nom de version.",
+  "versions.releaseSourceLabel": "Source de la version",
+  "versions.rollbackTo": "Déployer dans {{name}}",
+  "versions.saveEdit": "Enregistrer",
+  "versions.sourceAppOption": "Application Workflow"
+}
diff --git a/web/i18n/fr-FR/workflow.json b/web/i18n/fr-FR/workflow.json
index 6820df36460..19ea55eca76 100644
--- a/web/i18n/fr-FR/workflow.json
+++ b/web/i18n/fr-FR/workflow.json
@@ -1,5 +1,6 @@
 {
   "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Réponse",
   "blocks.assigner": "Assignateur de Variables",
   "blocks.code": "Code",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Agrégateur de variables",
   "blocks.variable-assigner": "Assigneur de variables",
   "blocksAbout.agent": "Appel de grands modèles de langage pour répondre à des questions ou traiter le langage naturel",
+  "blocksAbout.agent-v2": "Appel de grands modèles de langage pour répondre à des questions ou traiter le langage naturel",
   "blocksAbout.answer": "Définir le contenu de la réponse d'une conversation",
   "blocksAbout.assigner": "Le nœud d'assignation de variables est utilisé pour attribuer des valeurs aux variables modifiables (comme les variables de conversation).",
   "blocksAbout.code": "Exécuter un morceau de code Python ou NodeJS pour implémenter une logique personnalisée",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID du workflow",
   "globalVar.fieldsDescription.workflowRunId": "ID d'exécution du workflow",
   "globalVar.title": "Variables système",
+  "nodes.agent.advancedSetting": "Paramètres avancés",
   "nodes.agent.checkList.strategyNotSelected": "Stratégie non sélectionnée",
   "nodes.agent.clickToViewParameterSchema": "Cliquez pour voir le schéma des paramètres",
   "nodes.agent.configureModel": "Configurer le modèle",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Modèle non pris en charge",
   "nodes.agent.modelSelectorTooltips.deprecated": "Ce modèle est obsolète",
   "nodes.agent.notAuthorized": "Non autorisé",
+  "nodes.agent.outputVars.confirm": "Confirmer",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Saisissez un tableau JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Saisissez true ou false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Les valeurs par défaut de fichier ne sont pas encore configurables ici.",
+  "nodes.agent.outputVars.defaultValueLabel": "Par défaut",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Saisissez un nombre valide.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Saisissez un objet JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Valeur par défaut",
+  "nodes.agent.outputVars.delete": "Supprimer {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Description",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Ajouter une description",
+  "nodes.agent.outputVars.edit": "Modifier {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Éditeur de variables de sortie",
   "nodes.agent.outputVars.files.title": "Fichiers générés par l’agent",
   "nodes.agent.outputVars.files.transfer_method": "Méthode de transfert. La valeur est remote_url ou local_file",
   "nodes.agent.outputVars.files.type": "Type de support. Maintenant, seulement l’image de support",
   "nodes.agent.outputVars.files.upload_file_id": "Télécharger l’identifiant du fichier",
   "nodes.agent.outputVars.files.url": "URL de l’image",
   "nodes.agent.outputVars.json": "JSON généré par l’agent",
+  "nodes.agent.outputVars.nameDuplicate": "Le nom de sortie existe déjà",
+  "nodes.agent.outputVars.nameInvalid": "Utilisez des lettres, des chiffres et des traits de soulignement. Commencez par une lettre ou un trait de soulignement.",
+  "nodes.agent.outputVars.nameLabel": "Nom du champ",
+  "nodes.agent.outputVars.namePlaceholder": "Nom du champ",
+  "nodes.agent.outputVars.newOutput": "Nouvelle sortie",
+  "nodes.agent.outputVars.requiredLabel": "Requis",
+  "nodes.agent.outputVars.showAdvancedOptions": "Afficher les options avancées",
   "nodes.agent.outputVars.text": "Contenu généré par l’agent",
+  "nodes.agent.outputVars.typeLabel": "Type de sortie",
   "nodes.agent.outputVars.usage": "Informations sur l’utilisation du modèle",
   "nodes.agent.parameterSchema": "Schéma de Paramètres",
   "nodes.agent.pluginInstaller.install": "Installer",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Ce intégration est installé à partir de GitHub. Veuillez aller dans Intégrations pour réinstaller",
   "nodes.agent.pluginNotInstalled": "Ce intégration n’est pas installé",
   "nodes.agent.pluginNotInstalledDesc": "Ce intégration est installé à partir de GitHub. Veuillez aller dans Intégrations pour réinstaller",
+  "nodes.agent.roster.change": "Changer",
+  "nodes.agent.roster.editInConsole": "Modifier dans Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Une configuration ponctuelle qui n’existe que dans ce nœud",
+  "nodes.agent.roster.inlineSetup.name": "Configuration inline",
+  "nodes.agent.roster.inlineSetup.title": "Configuration de l’agent",
+  "nodes.agent.roster.inlineSetup.type": "Uniquement dans ce nœud",
+  "nodes.agent.roster.label": "Agent",
+  "nodes.agent.roster.makeCopy": "Faire une copie",
+  "nodes.agent.roster.more": "Plus d’actions pour l’agent",
+  "nodes.agent.roster.openPanel": "Ouvrir les détails de {{name}}",
+  "nodes.agent.roster.panelLabel": "Détails de {{name}}",
   "nodes.agent.strategy.configureTip": "Veuillez configurer la stratégie agentique.",
   "nodes.agent.strategy.configureTipDesc": "Après avoir configuré la stratégie agentique, ce nœud chargera automatiquement les configurations restantes. La stratégie affectera le mécanisme du raisonnement à l’outil en plusieurs étapes.",
   "nodes.agent.strategy.label": "Stratégie agentique",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "La version du intégration installée ne fournit pas cette stratégie. Cliquez pour changer de version.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} n’est pas installé",
   "nodes.agent.strategyNotSet": "Stratégie agentique non définie",
+  "nodes.agent.task.insert": "Insérer",
+  "nodes.agent.task.label": "Tâche de l’agent",
+  "nodes.agent.task.mention": "Mentionner",
+  "nodes.agent.task.placeholder": "Décrivez ce que cet agent doit faire...",
+  "nodes.agent.task.tooltip": "Définissez les instructions de tâche que cet agent doit suivre dans ce workflow.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Non autorisé",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} n’est pas installé",
   "nodes.agent.toolbox": "boîte à outils",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Par {{author}}",
   "tabs.question-understand": "Compréhension des questions",
   "tabs.requestToCommunity": "Demandes à la communauté",
-  "tabs.searchBlock": "Nœud de recherche",
+  "tabs.searchBlock": "Rechercher des nœuds, agent, humain, connaissances",
   "tabs.searchDataSource": "Source de données de recherche",
   "tabs.searchSnippets": "Rechercher des extraits...",
   "tabs.searchTool": "Outil de recherche",
diff --git a/web/i18n/hi-IN/agent-v-2.json b/web/i18n/hi-IN/agent-v-2.json
new file mode 100644
index 00000000000..ba5f7df6d58
--- /dev/null
+++ b/web/i18n/hi-IN/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "यह क्रिया अभी उपलब्ध नहीं है।",
+  "agentDetail.access.actions.monitoring": "निगरानी",
+  "agentDetail.access.copyAccessUrl": "एक्सेस URL कॉपी करें",
+  "agentDetail.access.copyFailed": "संदर्भ कॉपी करने में विफल।",
+  "agentDetail.access.copyReference": "{{name}} के लिए संदर्भ कॉपी करें",
+  "agentDetail.access.copyServiceEndpoint": "सेवा API एंडपॉइंट कॉपी करें",
+  "agentDetail.access.description": "हर सतह जहाँ से यह एजेंट पहुँचा जा सकता है।",
+  "agentDetail.access.empty": "कोई लिंक किए गए एक्सेस पॉइंट नहीं",
+  "agentDetail.access.emptyDescription": "इस Roster एजेंट का अभी तक कोई ऐप या वर्कफ़्लो संदर्भ नहीं है।",
+  "agentDetail.access.entries.agentApp.description": "इस Roster एजेंट से लिंक किया गया एजेंट ऐप।",
+  "agentDetail.access.entries.agentApp.name": "एजेंट ऐप",
+  "agentDetail.access.entries.workflow.description": "इस Roster एजेंट से लिंक किया गया वर्कफ़्लो और नोड संदर्भ।",
+  "agentDetail.access.entries.workflow.name": "वर्कफ़्लो नोड",
+  "agentDetail.access.entryCount_one": "{{count}} प्रविष्टि",
+  "agentDetail.access.entryCount_other": "{{count}} प्रविष्टियाँ",
+  "agentDetail.access.groups.references.heading": "संदर्भ",
+  "agentDetail.access.groups.references.label": "लिंक किए गए संदर्भ",
+  "agentDetail.access.learnMore": "और अधिक जानें",
+  "agentDetail.access.moreActions": "{{name}} के लिए और क्रियाएँ",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "सेवा API एंडपॉइंट",
+  "agentDetail.access.serviceApi.title": "बैकएंड सेवा API",
+  "agentDetail.access.status.disabled": "अक्षम",
+  "agentDetail.access.status.enabled": "सक्षम",
+  "agentDetail.access.status.inService": "सेवा में",
+  "agentDetail.access.status.outOfService": "सेवा से बाहर",
+  "agentDetail.access.title": "एक्सेस पॉइंट",
+  "agentDetail.access.toggleSurface": "{{name}} एक्सेस टॉगल करें",
+  "agentDetail.access.webApp.accessUrl": "एक्सेस URL",
+  "agentDetail.access.webApp.actions.customize": "अनुकूलित करें",
+  "agentDetail.access.webApp.actions.embedded": "एम्बेडेड",
+  "agentDetail.access.webApp.actions.launch": "लॉन्च करें",
+  "agentDetail.access.webApp.actions.settings": "सेटिंग्स",
+  "agentDetail.access.webApp.refreshUrl": "एक्सेस URL रीफ़्रेश करें",
+  "agentDetail.access.webApp.showQrCode": "QR कोड दिखाएँ",
+  "agentDetail.access.webApp.ssoEnabled": "SSO सक्षम",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "वर्कफ़्लो के अंदर एक नोड के रूप में उपयोग किया जाता है",
+  "agentDetail.access.workflow.empty": "अभी तक कोई वर्कफ़्लो संदर्भ नहीं।",
+  "agentDetail.access.workflow.loadFailed": "वर्कफ़्लो संदर्भ लोड करने में विफल।",
+  "agentDetail.access.workflow.loading": "वर्कफ़्लो संदर्भ लोड हो रहे हैं…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} नोड",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} नोड",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Studio में खोलें",
+  "agentDetail.access.workflow.openInStudioFor": "{{name}} को Studio में खोलें",
+  "agentDetail.access.workflow.table.actions": "क्रियाएँ",
+  "agentDetail.access.workflow.table.lastUpdated": "अंतिम अद्यतन",
+  "agentDetail.access.workflow.table.name": "नाम",
+  "agentDetail.access.workflow.table.nodes": "नोड",
+  "agentDetail.access.workflow.table.version": "संस्करण",
+  "agentDetail.access.workflow.title": "वर्कफ़्लो एक्सेस",
+  "agentDetail.configure.advancedSettings.description": "उन्नत उपयोगकर्ताओं के लिए। पर्यावरण चर, सैंडबॉक्स और मेमोरी।",
+  "agentDetail.configure.advancedSettings.envEditor.add": "पर्यावरण चर जोड़ें",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "{{key}} हटाएँ",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "{{key}} मान छुपाएँ",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": ".env आयात करें",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "छुपी हुई .env फ़ाइलें दिखाने के लिए, फ़ाइल पिकर में Command + Shift + . दबाएँ।",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "यदि आपकी .env फ़ाइल छुपी हुई है, तो अपने सिस्टम फ़ाइल पिकर में छुपी हुई फ़ाइलें सक्षम करें।",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "छुपी हुई .env फ़ाइलें दिखाने के लिए, File Explorer में “छिपे हुए आइटम” सक्षम करें।",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "{{key}} मान दिखाएँ",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "पर्यावरण चर का दायरा चुनें",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "रनटाइम पर इस एजेंट के लिए उपलब्ध पर्यावरण चर।",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Env Editor टॉगल करें",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "उन्नत सेटिंग्स",
+  "agentDetail.configure.advancedSettings.toggle": "उन्नत सेटिंग्स टॉगल करें",
+  "agentDetail.configure.chatFeatures.description": "अपने Web app और चैट सतहों पर अंतिम-उपयोगकर्ता चैट अनुभव को आकार दें।",
+  "agentDetail.configure.chatFeatures.title": "चैट सुविधाएँ",
+  "agentDetail.configure.files.add": "फ़ाइल जोड़ें",
+  "agentDetail.configure.files.empty.description": "ऐसे दस्तावेज़ अपलोड करें जिन्हें एजेंट पढ़ सके, जैसे विनिर्देश, टेम्पलेट या दिशानिर्देश",
+  "agentDetail.configure.files.empty.title": "अभी तक कोई फ़ाइल नहीं",
+  "agentDetail.configure.files.label": "फ़ाइलें",
+  "agentDetail.configure.files.preview.empty": "कोई पूर्वावलोकन सामग्री नहीं।",
+  "agentDetail.configure.files.preview.failed": "पूर्वावलोकन लोड करने में विफल।",
+  "agentDetail.configure.files.preview.unsupported": "यह फ़ाइल पूर्वावलोकन का समर्थन नहीं करती।",
+  "agentDetail.configure.files.remove": "{{name}} हटाएँ",
+  "agentDetail.configure.files.tip": "इस एजेंट द्वारा कार्यों को व्यवस्थित करते समय उपयोग की जा सकने वाली फ़ाइलें।",
+  "agentDetail.configure.files.toggle": "फ़ाइलें टॉगल करें",
+  "agentDetail.configure.files.treeLabel": "एजेंट फ़ाइलें",
+  "agentDetail.configure.files.upload.action": "अपलोड करें",
+  "agentDetail.configure.files.upload.browse": "ब्राउज़ करें",
+  "agentDetail.configure.files.upload.description": "इस एजेंट के लिए एक फ़ाइल अपलोड करें।",
+  "agentDetail.configure.files.upload.dropzone": "यहाँ एक फ़ाइल छोड़ें, या",
+  "agentDetail.configure.files.upload.failed": "फ़ाइल अपलोड करने में विफल।",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "एक फ़ाइल अपलोड करें।",
+  "agentDetail.configure.files.upload.success": "फ़ाइल अपलोड हो गई।",
+  "agentDetail.configure.files.upload.title": "फ़ाइल अपलोड करें",
+  "agentDetail.configure.knowledgeRetrieval.add": "ज्ञान पुनर्प्राप्ति जोड़ें",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "ज्ञान जोड़ें",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "ज्ञान जोड़ने के लिए “+” बटन पर क्लिक करें",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "ज्ञान",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "पुनर्प्राप्ति सेटिंग",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "ज्ञान पुनर्प्राप्ति के बारे में और जानें",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "स्वचालित",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "शर्तें",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "अक्षम",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "मेटाडेटा फ़िल्टरिंग",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "मैन्युअल",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "मेटाडेटा फ़िल्टरिंग मोड चुनें",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "ज्ञान पुनर्प्राप्ति का नाम",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "एजेंट तय करे",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "एजेंट प्रॉम्प्ट और उपलब्ध संदर्भ से अपनी क्वेरी स्वयं लिखता है। यहाँ कुछ भी सेट करने की आवश्यकता नहीं है।",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "कस्टम क्वेरी",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "इस पुनर्प्राप्ति स्रोत के लिए एक निश्चित क्वेरी लिखें।",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "कस्टम क्वेरी टेक्स्ट",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "एक खोज क्वेरी टाइप करें",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "क्वेरी",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "ज्ञान पुनर्प्राप्ति · एजेंट तय करे",
+  "agentDetail.configure.knowledgeRetrieval.edit": "{{name}} संपादित करें",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "एक ज्ञान आधार कनेक्ट करें जिसे एजेंट उत्तर देते समय खोज सके",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "अभी तक कोई ज्ञान नहीं",
+  "agentDetail.configure.knowledgeRetrieval.label": "ज्ञान पुनर्प्राप्ति",
+  "agentDetail.configure.knowledgeRetrieval.remove": "{{name}} हटाएँ",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "इस एजेंट द्वारा कार्यों को व्यवस्थित करते समय उपयोग किए जा सकने वाले ज्ञान पुनर्प्राप्ति स्रोत।",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "ज्ञान पुनर्प्राप्ति टॉगल करें",
+  "agentDetail.configure.model.label": "मॉडल",
+  "agentDetail.configure.orchestrate": "व्यवस्थित करें",
+  "agentDetail.configure.preview.chatFeatures": "चैट सुविधाएँ",
+  "agentDetail.configure.preview.empty.defaultAgentName": "एजेंट",
+  "agentDetail.configure.preview.empty.description": "वर्तमान ड्राफ्ट का परीक्षण करने के लिए एक संदेश भेजें।",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "अभी तक कोई निर्देश नहीं, इसलिए उत्तर सामान्य मॉडल से आते हैं।",
+  "agentDetail.configure.preview.endUserAuth": "अंतिम-उपयोगकर्ता प्रमाणीकरण",
+  "agentDetail.configure.preview.restart": "पूर्वावलोकन पुनः आरंभ करें",
+  "agentDetail.configure.preview.title": "पूर्वावलोकन",
+  "agentDetail.configure.prompt.copied": "प्रॉम्प्ट कॉपी हो गया",
+  "agentDetail.configure.prompt.copy": "प्रॉम्प्ट कॉपी करें",
+  "agentDetail.configure.prompt.copyFailed": "प्रॉम्प्ट कॉपी करने में विफल।",
+  "agentDetail.configure.prompt.insert.label": "सम्मिलित करें",
+  "agentDetail.configure.prompt.insert.question": "प्रश्न आरंभ करें",
+  "agentDetail.configure.prompt.insert.reportFile": "आउटपुट रिपोर्ट फ़ाइल",
+  "agentDetail.configure.prompt.insert.tenders": "निविदाएँ आरंभ करें",
+  "agentDetail.configure.prompt.label": "प्रॉम्प्ट",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "उल्लेख करें",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "यहाँ निर्देश लिखें,",
+  "agentDetail.configure.prompt.tip": "परिभाषित करें कि यह एजेंट इनपुट की व्याख्या कैसे करे, उपकरण कैसे कॉल करे और आउटपुट कैसे उत्पन्न करे।",
+  "agentDetail.configure.publishBar.draft": "ड्राफ्ट",
+  "agentDetail.configure.publishBar.publishUpdate": "अपडेट प्रकाशित करें",
+  "agentDetail.configure.publishBar.published": "प्रकाशित",
+  "agentDetail.configure.publishBar.publishedAt": "{{time}} प्रकाशित",
+  "agentDetail.configure.publishBar.publishing": "प्रकाशित हो रहा है…",
+  "agentDetail.configure.publishBar.saved": "5 मिनट पहले सहेजा गया",
+  "agentDetail.configure.publishBar.savedAt": "{{time}} सहेजा गया",
+  "agentDetail.configure.publishBar.unpublishedChanges": "अप्रकाशित परिवर्तन",
+  "agentDetail.configure.publishBar.upToDate": "अद्यतित",
+  "agentDetail.configure.publishBar.versionHistory": "संस्करण इतिहास खोलें",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "प्रभावित वर्कफ़्लो",
+  "agentDetail.configure.publishImpact.cancel": "रद्द करें",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "आपका एजेंट यहाँ दिखाई देता है",
+  "agentDetail.configure.publishImpact.descriptionSuffix": "। परिवर्तन उन पर असर डालेंगे।",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "यह एजेंट",
+  "agentDetail.configure.publishImpact.title": "{{name}} पर {{action}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} वर्कफ़्लो",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} वर्कफ़्लो",
+  "agentDetail.configure.skills.add": "कौशल जोड़ें",
+  "agentDetail.configure.skills.detail.contentRegion": "कौशल विवरण सामग्री",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} फ़ाइलें",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "कौशल फ़ाइलें",
+  "agentDetail.configure.skills.detail.files": "फ़ाइलें",
+  "agentDetail.configure.skills.empty.description": "कौशल एजेंट को पुनः उपयोग योग्य विशेषज्ञता देते हैं जिसे वह काम करते समय कॉल कर सकता है",
+  "agentDetail.configure.skills.empty.title": "अभी तक कोई कौशल नहीं",
+  "agentDetail.configure.skills.itemType": "कौशल",
+  "agentDetail.configure.skills.label": "कौशल",
+  "agentDetail.configure.skills.remove": "{{name}} हटाएँ",
+  "agentDetail.configure.skills.tip": "इस एजेंट द्वारा कार्यों को व्यवस्थित करते समय उपयोग किए जा सकने वाले कौशल।",
+  "agentDetail.configure.skills.toggle": "कौशल टॉगल करें",
+  "agentDetail.configure.skills.upload.action": "अपलोड करें",
+  "agentDetail.configure.skills.upload.browse": "ब्राउज़ करें",
+  "agentDetail.configure.skills.upload.description": "इस एजेंट के लिए .zip या .skill पैकेज अपलोड करें।",
+  "agentDetail.configure.skills.upload.dropzone": "यहाँ एक कौशल पैकेज छोड़ें, या",
+  "agentDetail.configure.skills.upload.failed": "कौशल अपलोड करने में विफल।",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "एक .zip या .skill फ़ाइल अपलोड करें।",
+  "agentDetail.configure.skills.upload.success": "कौशल अपलोड हो गया।",
+  "agentDetail.configure.skills.upload.title": "कौशल अपलोड करें",
+  "agentDetail.configure.tools.add": "उपकरण जोड़ें",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "डेवलपर्स के लिए",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "एक कमांड लाइन प्रोग्राम स्थापित करें जिसे एजेंट अपने सैंडबॉक्स में चलाता है। स्थापना और आमतौर पर API Key की आवश्यकता होती है।",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI उपकरण",
+  "agentDetail.configure.tools.addMenu.tool.description": "इस कार्यक्षेत्र में पहले से मौजूद एक उपकरण चुनें, जैसे वेब खोज या एकीकरण।",
+  "agentDetail.configure.tools.addMenu.tool.label": "उपकरण",
+  "agentDetail.configure.tools.cliDialog.description": "किसी भी पैकेज रजिस्ट्री से CLI उपकरण स्थापित करें। एजेंट को उसके द्वारा प्रदान की गई बाइनरी तक शेल एक्सेस मिलता है।",
+  "agentDetail.configure.tools.cliDialog.editTitle": "CLI उपकरण संपादित करें",
+  "agentDetail.configure.tools.cliDialog.env.description": "इस CLI उपकरण को आवश्यक API Key, टोकन या रहस्य संग्रहीत करें। मान विश्राम पर एन्क्रिप्ट किए जाते हैं और एजेंट द्वारा उपकरण को कॉल करते समय पर्यावरण चर के रूप में इंजेक्ट किए जाते हैं।",
+  "agentDetail.configure.tools.cliDialog.env.label": "पर्यावरण चर",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(वैकल्पिक)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "सैंडबॉक्स में · पहली कॉल पर एक बार चलता है",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "स्थापना कमांड",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "अपनी स्थापना कमांड यहाँ चिपकाएँ, उदा. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "स्थापना कमांड आवश्यक है।",
+  "agentDetail.configure.tools.cliDialog.learnMore": "CLI उपकरण के बारे में और जानें",
+  "agentDetail.configure.tools.cliDialog.name.label": "CLI उपकरण का नाम",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "अपने CLI उपकरण का नाम रखें",
+  "agentDetail.configure.tools.cliDialog.name.required": "CLI उपकरण का नाम आवश्यक है।",
+  "agentDetail.configure.tools.cliDialog.securityTip": "एजेंट प्रॉम्प्ट में कभी दिखाई नहीं देता; केवल रनटाइम पर $VAR के रूप में इंजेक्ट किया जाता है",
+  "agentDetail.configure.tools.cliDialog.title": "एक CLI उपकरण जोड़ें",
+  "agentDetail.configure.tools.cliTool": "CLI उपकरण",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "अंतिम-उपयोगकर्ता · OAuth",
+  "agentDetail.configure.tools.editAction": "{{name}} संपादित करें",
+  "agentDetail.configure.tools.empty.description": "उपकरण एजेंट को कार्य करने देते हैं, जैसे वेब खोजना या आपके ऐप्स को कॉल करना",
+  "agentDetail.configure.tools.empty.title": "अभी तक कोई उपकरण नहीं",
+  "agentDetail.configure.tools.label": "उपकरण",
+  "agentDetail.configure.tools.moreActions": "{{name}} के लिए और क्रियाएँ",
+  "agentDetail.configure.tools.pluginType": "एकीकरण",
+  "agentDetail.configure.tools.preAuthorize": "पूर्व-अधिकृत करें",
+  "agentDetail.configure.tools.removeAction": "{{name}} हटाएँ",
+  "agentDetail.configure.tools.removeProvider": "सभी उपकरण हटाएँ",
+  "agentDetail.configure.tools.tip": "इस एजेंट द्वारा कार्यों को व्यवस्थित करते समय कॉल किए जा सकने वाले उपकरण।",
+  "agentDetail.configure.tools.toggle": "उपकरण टॉगल करें",
+  "agentDetail.configure.tools.toolTabs.all": "सभी",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "कस्टम",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "एकीकरण",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "एजेंट",
+  "agentDetail.history": "इतिहास",
+  "agentDetail.logs.description": "पूर्ण लॉग एप्लिकेशन की चल रही स्थिति को रिकॉर्ड करते हैं, जिसमें उपयोगकर्ता इनपुट, एजेंट उत्तर, योजना और उपकरण उपयोग शामिल हैं।",
+  "agentDetail.logs.empty": "कोई लॉग नहीं मिला",
+  "agentDetail.logs.filters.period.allTime": "हर समय",
+  "agentDetail.logs.filters.period.label": "लॉग अवधि",
+  "agentDetail.logs.filters.period.last30days": "पिछले 30 दिन",
+  "agentDetail.logs.filters.period.last7days": "पिछले 7 दिन",
+  "agentDetail.logs.filters.search.label": "लॉग खोजें",
+  "agentDetail.logs.filters.search.placeholder": "खोजें",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "अंतिम निर्मित समय",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "अंतिम अद्यतन समय",
+  "agentDetail.logs.filters.source.all": "स्रोत",
+  "agentDetail.logs.filters.source.empty": "कोई स्रोत नहीं मिला",
+  "agentDetail.logs.filters.source.label": "लॉग स्रोत",
+  "agentDetail.logs.filters.source.loadFailed": "स्रोत लोड नहीं हो सके",
+  "agentDetail.logs.filters.source.loading": "स्रोत लोड हो रहे हैं…",
+  "agentDetail.logs.filters.source.searchLabel": "स्रोत खोजें",
+  "agentDetail.logs.filters.source.searchPlaceholder": "खोजें",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "वर्कफ़्लो",
+  "agentDetail.logs.learnMore": "और अधिक जानें",
+  "agentDetail.logs.loadFailed": "लॉग लोड नहीं हो सके",
+  "agentDetail.logs.loading": "लॉग लोड हो रहे हैं…",
+  "agentDetail.logs.notAvailable": "उपलब्ध नहीं",
+  "agentDetail.logs.table.createdTime": "निर्मित समय",
+  "agentDetail.logs.table.endUser": "अंतिम-उपयोगकर्ता",
+  "agentDetail.logs.table.messageCount": "संदेश संख्या",
+  "agentDetail.logs.table.operationRate": "ऑपरेशन दर",
+  "agentDetail.logs.table.source": "स्रोत",
+  "agentDetail.logs.table.title": "शीर्षक",
+  "agentDetail.logs.table.unread": "अपठित",
+  "agentDetail.logs.table.updatedTime": "अद्यतन समय",
+  "agentDetail.logs.table.userRate": "उपयोगकर्ता दर",
+  "agentDetail.logs.title": "लॉग",
+  "agentDetail.memorySettings.budgetLabel": "मेमोरी बजट",
+  "agentDetail.memorySettings.description": "सक्रिय कॉन्फ़िगरेशन स्नैपशॉट से मेमोरी सेटिंग्स।",
+  "agentDetail.memorySettings.export.description": "मेमोरी निर्यात बाद के रिलीज़ के लिए नियोजित है।",
+  "agentDetail.memorySettings.export.download": "डाउनलोड करें",
+  "agentDetail.memorySettings.export.soon": "जल्द ही",
+  "agentDetail.memorySettings.export.title": "वर्तमान मेमोरी निर्यात करें",
+  "agentDetail.memorySettings.notConfigured": "कॉन्फ़िगर नहीं किया गया",
+  "agentDetail.memorySettings.scopeLabel": "मेमोरी दायरा",
+  "agentDetail.memorySettings.title": "मेमोरी",
+  "agentDetail.metadata.activeVersionLabel": "सक्रिय संस्करण",
+  "agentDetail.metadata.appIdLabel": "ऐप ID",
+  "agentDetail.metadata.description": "एजेंट बैकएंड द्वारा लौटाए गए केवल-पठनीय Roster फ़ील्ड।",
+  "agentDetail.metadata.emptyValue": "उपलब्ध नहीं",
+  "agentDetail.metadata.scopeLabel": "दायरा",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "केवल वर्कफ़्लो",
+  "agentDetail.metadata.sourceLabel": "स्रोत",
+  "agentDetail.metadata.statusLabel": "स्थिति",
+  "agentDetail.metadata.title": "मेटाडेटा",
+  "agentDetail.metadata.updatedAtLabel": "अद्यतन समय",
+  "agentDetail.metadata.workflowIdLabel": "वर्कफ़्लो ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "वर्कफ़्लो नोड ID",
+  "agentDetail.monitoring.change": "पिछली अवधि से {{value}}",
+  "agentDetail.monitoring.dateRangeLabel": "दिनांक सीमा",
+  "agentDetail.monitoring.description": "वर्कफ़्लो में पुनः उपयोग योग्य एजेंट गतिविधि, लागत और इंटरैक्शन गुणवत्ता को ट्रैक करें।",
+  "agentDetail.monitoring.learnMore": "और अधिक जानें",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "अद्वितीय अंतिम-उपयोगकर्ता जिन्होंने इस एजेंट का उपयोग करके वर्कफ़्लो ट्रिगर किए।",
+  "agentDetail.monitoring.metrics.activeUsers.title": "सक्रिय उपयोगकर्ता",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "इस एक्सेस पॉइंट के लिए निरंतर उपयोगकर्ता-एजेंट संचार गणना।",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "औसत सत्र इंटरैक्शन",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "अनुरोध की शुरुआत से पूरा होने तक औसत आउटपुट गति।",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "टोकन आउटपुट गति",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "वर्कफ़्लो रन में इस एजेंट द्वारा उत्पन्न अनुमानित टोकन लागत।",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "टोकन उपयोग",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "चयनित एक्सेस पॉइंट के माध्यम से इस एजेंट तक पहुँचने वाली दैनिक AI वार्तालाप।",
+  "agentDetail.monitoring.metrics.totalConversations.title": "कुल वार्तालाप",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "दैनिक एजेंट इंटरैक्शन गणना।",
+  "agentDetail.monitoring.metrics.totalMessages.title": "कुल संदेश",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "इस एजेंट के लिए प्रति 1,000 संदेशों पर लाइक की संख्या।",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "उपयोगकर्ता संतुष्टि दर",
+  "agentDetail.monitoring.pickSource": "एक ऐप चुनें",
+  "agentDetail.monitoring.sourceLabel": "ऐप",
+  "agentDetail.monitoring.sourceTrigger": "स्रोत {{name}}",
+  "agentDetail.monitoring.sources.all": "सभी",
+  "agentDetail.monitoring.timeRangeLabel": "समय सीमा",
+  "agentDetail.monitoring.timeRanges.custom": "कस्टम",
+  "agentDetail.monitoring.timeRanges.last30days": "पिछले 30 दिन",
+  "agentDetail.monitoring.timeRanges.last7days": "पिछले 7 दिन",
+  "agentDetail.monitoring.timeRanges.today": "आज",
+  "agentDetail.monitoring.title": "निगरानी",
+  "agentDetail.monitoring.tokenUsageConsumed": "खपत किए गए टोकन",
+  "agentDetail.monitoring.units.tokenPerSecond": "टोकन/सेकंड",
+  "agentDetail.navigationLabel": "एजेंट नेविगेशन",
+  "agentDetail.publish": "प्रकाशित करें",
+  "agentDetail.publishSoon": "जल्द ही",
+  "agentDetail.sections.access": "एक्सेस पॉइंट",
+  "agentDetail.sections.configure": "व्यवस्थित करें",
+  "agentDetail.sections.logs": "लॉग",
+  "agentDetail.sections.monitoring": "निगरानी",
+  "agentDetail.subtitle": "एजेंट ID: {{agentId}}",
+  "agentDetail.title": "एजेंट",
+  "agentDetail.type": "एजेंट",
+  "agentDetail.versionHistory.active": "सक्रिय",
+  "agentDetail.versionHistory.empty": "अभी तक कोई संस्करण नहीं",
+  "agentDetail.versionHistory.filter": "संस्करण फ़िल्टर करें",
+  "agentDetail.versionHistory.versionName": "संस्करण {{version}}",
+  "roster.createAgent": "एजेंट बनाएँ",
+  "roster.createAgentOptions": "एजेंट बनाने के विकल्प",
+  "roster.createDialog.description": "इस कार्यक्षेत्र Roster में एक पुनः उपयोग योग्य एजेंट बनाएँ।",
+  "roster.createDialog.title": "एजेंट बनाएँ",
+  "roster.createForm.changeIcon": "एजेंट आइकन बदलें",
+  "roster.createForm.descriptionLabel": "विवरण",
+  "roster.createForm.descriptionOptional": "(वैकल्पिक)",
+  "roster.createForm.descriptionPlaceholder": "उदा. किसी विषय पर स्रोत एकत्र करता है और मुख्य निष्कर्षों का सारांश देता है",
+  "roster.createForm.nameLabel": "नाम",
+  "roster.createForm.namePlaceholder": "उदा. Max",
+  "roster.createForm.nameRequired": "नाम आवश्यक है।",
+  "roster.createForm.roleLabel": "भूमिका",
+  "roster.createForm.rolePlaceholder": "उदा. शोध सहायक",
+  "roster.createForm.roleRequired": "भूमिका आवश्यक है।",
+  "roster.createSuccess": "एजेंट बन गया।",
+  "roster.dateTimeFormat": "DD/MM/YYYY hh:mm:ss A",
+  "roster.deleteDialog.description": "इस एजेंट को सक्रिय Roster सूची से हटा दिया जाएगा।",
+  "roster.deleteDialog.title": "{{name}} हटाएँ?",
+  "roster.deleteFailed": "एजेंट हटाने में विफल।",
+  "roster.deleteSuccess": "एजेंट हटा दिया गया।",
+  "roster.duplicateFailed": "एजेंट डुप्लिकेट करने में विफल।",
+  "roster.duplicateSuccess": "एजेंट डुप्लिकेट किया गया।",
+  "roster.editAgent": "{{name}} संपादित करें",
+  "roster.editDialog.description": "इस एजेंट का Roster नाम, विवरण और भूमिका अपडेट करें।",
+  "roster.editDialog.title": "एजेंट संपादित करें",
+  "roster.editInfo": "जानकारी संपादित करें",
+  "roster.empty": "अभी तक कोई एजेंट नहीं",
+  "roster.emptyDescription": "इस कार्यक्षेत्र में सहेजे गए एजेंट यहाँ दिखाई देंगे।",
+  "roster.emptySearch": "कोई मेल खाते एजेंट नहीं",
+  "roster.emptySearchDescription": "किसी अन्य एजेंट नाम का प्रयास करें।",
+  "roster.filters.all": "सभी",
+  "roster.filters.drafts": "ड्राफ्ट",
+  "roster.filters.label": "एजेंट फ़िल्टर",
+  "roster.filters.published": "प्रकाशित",
+  "roster.learnMore": "Agent Roster के बारे में और जानें",
+  "roster.listLabel": "एजेंट Roster सूची",
+  "roster.loadMore": "और लोड करें",
+  "roster.loadingError": "एजेंट लोड करने में विफल। रीफ़्रेश करें और पुनः प्रयास करें।",
+  "roster.moreActions": "{{name}} के लिए और क्रियाएँ",
+  "roster.nodeSelector.createInlineFailed": "इनलाइन एजेंट बनाने में विफल। रीफ़्रेश करें और पुनः प्रयास करें।",
+  "roster.nodeSelector.dialogLabel": "एक एजेंट चुनें",
+  "roster.nodeSelector.manageInAgentConsole": "Agent Console में प्रबंधित करें",
+  "roster.nodeSelector.searchPlaceholder": "खोजें…",
+  "roster.nodeSelector.startFromScratch": "शुरुआत से आरंभ करें",
+  "roster.references.label": "{{name}} का उपयोग करने वाले वर्कफ़्लो",
+  "roster.references.trigger": "{{name}} का उपयोग करने वाले वर्कफ़्लो",
+  "roster.searchLabel": "एजेंट खोजें",
+  "roster.searchPlaceholder": "नाम से एजेंट खोजें…",
+  "roster.sources.agent_app": "एजेंट ऐप",
+  "roster.sources.imported": "आयातित",
+  "roster.sources.system": "सिस्टम",
+  "roster.sources.workflow": "वर्कफ़्लो",
+  "roster.status.active": "सक्रिय",
+  "roster.status.archived": "संग्रहीत",
+  "roster.tabs.agent": "एजेंट",
+  "roster.tabs.human": "मानव",
+  "roster.tabsLabel": "Roster प्रकार",
+  "roster.updateSuccess": "एजेंट अपडेट हो गया।",
+  "roster.usageStatus.draft": "ड्राफ्ट"
+}
diff --git a/web/i18n/hi-IN/app-log.json b/web/i18n/hi-IN/app-log.json
index 7ca4d40e48c..dc38f9b00db 100644
--- a/web/i18n/hi-IN/app-log.json
+++ b/web/i18n/hi-IN/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "आज",
   "filter.period.yearToDate": "वर्ष तक तिथि",
   "filter.sortBy": "इसके अनुसार क्रमबद्ध करें:",
+  "monitoring.description": "मॉनिटरिंग एप्लिकेशन की रनिंग स्थिति रिकॉर्ड करती है, जिसमें प्रदर्शन, उपयोगकर्ता गतिविधि और लागतें शामिल हैं।",
   "promptLog": "प्रॉम्प्ट लॉग",
   "runDetail.fileListDetail": "विस्तार",
   "runDetail.fileListLabel": "फ़ाइल विवरण",
diff --git a/web/i18n/hi-IN/app.json b/web/i18n/hi-IN/app.json
index 7d2bba9000e..ea4b2f070d4 100644
--- a/web/i18n/hi-IN/app.json
+++ b/web/i18n/hi-IN/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "संरचित आउटपुट एक विशेषता है जो यह सुनिश्चित करती है कि मॉडल हमेशा आपके प्रदान किए गए JSON स्कीमा के अनुसार प्रतिक्रियाएँ生成 करेगा।",
   "studio.allApps": "सभी ऐप्स",
   "studio.apps": "ऐप्स",
-  "studio.filters.allCreators": "सभी रचनाकार",
-  "studio.filters.creators": "रचनाकारों",
+  "studio.filters.allCreators": "सभी निर्माता",
+  "studio.filters.creators": "निर्माता",
   "studio.filters.reset": "रीसेट करें",
   "studio.filters.searchCreators": "निर्माता खोजें...",
   "studio.filters.types": "प्रकार",
diff --git a/web/i18n/hi-IN/billing.json b/web/i18n/hi-IN/billing.json
index 3acd3867070..db27c7cb954 100644
--- a/web/i18n/hi-IN/billing.json
+++ b/web/i18n/hi-IN/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "बैच दस्तावेज़ अपलोड अनलॉक करने के लिए अपग्रेड करें",
   "upgrade.uploadMultiplePages.description": "आपने अपलोड की सीमा तक पहुँच लिया है — आपके वर्तमान प्लान पर एक समय में केवल एक ही दस्तावेज़ चुना और अपलोड किया जा सकता है।",
   "upgrade.uploadMultiplePages.title": "एक बार में कई दस्तावेज़ अपलोड करने के लिए अपग्रेड करें",
+  "upgrade.workflowRestore.description": "आपकी वर्तमान योजना में वर्कफ़्लो संस्करण पुनर्स्थापना उपलब्ध नहीं है।",
+  "upgrade.workflowRestore.title": "वर्कफ़्लो संस्करणों को पुनर्स्थापित करने के लिए अपग्रेड करें",
   "upgradeBtn.encourage": "अभी अपग्रेड करें",
   "upgradeBtn.encourageShort": "अपग्रेड करें",
   "upgradeBtn.plain": "योजना अपग्रेड करें",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index 79017ff4f5b..d85b715e1cc 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "वर्कस्पेस बदलें",
   "mcpPage.description": "MCP सर्वर कनेक्ट और प्रबंधित करें ताकि आपके ऐप्स बाहरी टूल और सेवाओं तक पहुँच सकें।",
-  "members.admin": "प्रशासक",
   "members.adminTip": "ऐप्स बना सकते हैं और टीम सेटिंग्स का प्रबंधन कर सकते हैं",
+  "members.alreadyInTeam": "पहले से टीम में हैं",
+  "members.alreadyInTeamTip": "इन उपयोगकर्ताओं के पास पहले से इस वर्कस्पेस की पहुंच है।",
   "members.builder": "निर्माता",
   "members.builderTip": "अपने स्वयं के ऐप्स बना और संपादित कर सकते हैं",
-  "members.datasetOperator": "ज्ञान व्यवस्थापक",
   "members.datasetOperatorTip": "केवल नॉलेज बेस प्रबंधित कर सकते हैं",
   "members.deleteMember": "सदस्य को हटाएं",
   "members.disInvite": "आमंत्रण रद्द करें",
-  "members.editor": "संपादक",
   "members.editorTip": "ऐप्स बना और संपादित कर सकते हैं",
   "members.email": "ईमेल",
   "members.emailInvalid": "अवैध ईमेल प्रारूप",
@@ -270,13 +269,12 @@
   "members.invite": "जोड़ें",
   "members.inviteTeamMember": "टीम सदस्य जोड़ें",
   "members.inviteTeamMemberTip": "वे साइन इन करने के बाद सीधे आपकी टीम डेटा तक पहुंच सकते हैं।",
-  "members.invitedAsRole": "{{role}} उपयोगकर्ता के रूप में आमंत्रित किया गया",
+  "members.invitedAsRole": "{{role}} के रूप में आमंत्रित किया गया",
   "members.lastActive": "अंतिम सक्रियता",
   "members.name": "नाम",
-  "members.normal": "सामान्य",
+  "members.noNewInvitationsSent": "कोई नया आमंत्रण नहीं भेजा गया",
   "members.normalTip": "केवल ऐप्स का उपयोग कर सकते हैं, ऐप्स नहीं बना सकते",
   "members.ok": "ठीक है",
-  "members.owner": "मालिक",
   "members.pending": "लंबित...",
   "members.removeFromTeam": "टीम से हटाएं",
   "members.removeFromTeamTip": "टीम पहुंच को हटा देगा",
@@ -311,12 +309,14 @@
   "menus.apps": "स्टूडियो",
   "menus.datasets": "ज्ञान",
   "menus.datasetsTips": "जल्द आ रहा है: अपने स्वयं के टेक्स्ट डेटा आयात करें या LLM संदर्भ संवर्धन के लिए रियल-टाइम में वेबहुक के माध्यम से डेटा लिखें।",
+  "menus.deployments": "डिप्लॉयमेंट",
   "menus.explore": "अन्वेषण करें",
   "menus.exploreMarketplace": "मार्केटप्लेस का अन्वेषण करें",
   "menus.newApp": "नया ऐप",
   "menus.newDataset": "ज्ञान बनाएं",
   "menus.plugins": "एकीकरण",
   "menus.pluginsTips": "थर्ड-पार्टी एकीकरण को एकीकृत करें या ChatGPT-संगत AI-Integrations बनाएं।",
+  "menus.roster": "एजेंट सूची",
   "menus.status": "बीटा",
   "menus.tools": "उपकरण",
   "model.addMoreModel": "अधिक मॉडल जोड़ने के लिए सेटिंग्स पर जाएं",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "पाठ-से-भाषण मॉडल",
   "modelProvider.ttsModel.tip": "संवाद में पाठ-से-भाषण इनपुट के लिए डिफ़ॉल्ट मॉडल सेट करें।",
   "modelProvider.upgradeForLoadBalancing": "लोड बैलेंसिंग सक्षम करने के लिए अपनी योजना अपग्रेड करें।",
+  "navigation.skipToMain": "मुख्य सामग्री पर जाएं",
   "noData": "कोई डेटा नहीं",
   "operation.add": "जोड़ें",
   "operation.added": "जोड़ा गया",
@@ -600,9 +601,6 @@
   "placeholder.input": "कृपया दर्ज करें",
   "placeholder.search": "खोजें...",
   "placeholder.select": "कृपया चयन करें",
-  "plugin.serpapi.apiKey": "एपीआई कुंजी",
-  "plugin.serpapi.apiKeyPlaceholder": "अपनी एपीआई कुंजी दर्ज करें",
-  "plugin.serpapi.keyFrom": "SerpAPI खाता पृष्ठ से अपनी SerpAPI कुंजी प्राप्त करें",
   "promptEditor.context.item.desc": "संदर्भ टेम्पलेट डालें",
   "promptEditor.context.item.title": "संदर्भ",
   "promptEditor.context.modal.add": "संदर्भ जोड़ें",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
new file mode 100644
index 00000000000..89d4b6a49d3
--- /dev/null
+++ b/web/i18n/hi-IN/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "बैकएंड सेवा API",
+  "access.api.copyCurlExample": "cURL उदाहरण कॉपी करें",
+  "access.api.createFailed": "API टोकन उत्पन्न करने में विफल।",
+  "access.api.createKey": "API टोकन उत्पन्न करें",
+  "access.api.createKeyTitle": "नया API टोकन उत्पन्न करें",
+  "access.api.curlExampleTitle": "cURL उदाहरण",
+  "access.api.description": "इस डिप्लॉयमेंट को HTTP के माध्यम से एक्सेस करें। प्रत्येक API टोकन एक वातावरण तक सीमित होता है।",
+  "access.api.developerTitle": "डेवलपर API",
+  "access.api.disabled": "इस डिप्लॉयमेंट के लिए API एक्सेस बंद है।",
+  "access.api.disabledHint": "वातावरण-सीमित टोकन उत्पन्न करने के लिए API एक्सेस सक्षम करें।",
+  "access.api.dismissToken": "API टोकन खारिज करें",
+  "access.api.docs": "API दस्तावेज़",
+  "access.api.docsClose": "API दस्तावेज़ बंद करें",
+  "access.api.docsDescription": "इस डिप्लॉयमेंट के लिए वर्कफ़्लो API संदर्भ देखें।",
+  "access.api.docsTitle": "वर्कफ़्लो API दस्तावेज़ीकरण",
+  "access.api.empty": "API टोकन जारी करना शुरू करने के लिए पहले किसी वातावरण पर डिप्लॉय करें।",
+  "access.api.emptyTitle": "कोई डिप्लॉय किया गया वातावरण नहीं",
+  "access.api.endpoint": "अनुरोध URL",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "API टोकन सूची",
+  "access.api.nameLabel": "API टोकन नाम",
+  "access.api.namePlaceholder": "API टोकन नाम दर्ज करें",
+  "access.api.nameRequired": "API टोकन नाम आवश्यक है।",
+  "access.api.newKey": "नया API टोकन उत्पन्न करें",
+  "access.api.newTokenDescription": "यह API टोकन केवल एक बार दिखाया जाता है। इस पृष्ठ को छोड़ने से पहले इसे कॉपी कर लें।",
+  "access.api.newTokenLabel": "API टोकन",
+  "access.api.newTokenTitle": "API टोकन उत्पन्न हुआ",
+  "access.api.noKeys": "अभी तक कोई API टोकन नहीं। API को कॉल करना शुरू करने के लिए एक उत्पन्न करें।",
+  "access.api.noKeysTitle": "अभी तक कोई API टोकन नहीं",
+  "access.api.revokeConfirmDescription": "API टोकन \"{{name}}\" तुरंत काम करना बंद कर देगा। यह क्रिया वापस नहीं ली जा सकती।",
+  "access.api.revokeConfirmTitle": "API टोकन रद्द करें?",
+  "access.api.revokeFailed": "API टोकन रद्द करने में विफल।",
+  "access.api.revokeSuccess": "API टोकन रद्द किया गया",
+  "access.api.table.action": "क्रिया",
+  "access.api.table.environment": "वातावरण",
+  "access.api.table.key": "API टोकन",
+  "access.api.table.name": "नाम",
+  "access.api.title": "API",
+  "access.channels.col.channel": "चैनल",
+  "access.channels.col.endpoint": "प्रवेश बिंदु",
+  "access.channels.col.status": "स्थिति",
+  "access.channels.description": "WebApp और CLI प्रवेश बिंदु ऊपर दी गई एक्सेस अनुमतियों का उपयोग करते हैं।",
+  "access.channels.disabled": "इस डिप्लॉयमेंट के लिए एक्सेस चैनल बंद हैं।",
+  "access.channels.disabledHint": "WebApp और CLI प्रवेश बिंदुओं को प्रकट करने के लिए एक्सेस चैनल सक्षम करें।",
+  "access.channels.followPermission": "अनुमतियों का पालन करता है",
+  "access.channels.title": "एक्सेस चैनल",
+  "access.cli.description": "स्क्रिप्ट, स्वचालित वर्कफ़्लो या एजेंट एकीकरण के लिए उपयुक्त, टर्मिनल से difyctl के साथ इनवोक करें।",
+  "access.cli.docs": "उपयोग गाइड",
+  "access.cli.domain": "डोमेन",
+  "access.cli.empty": "CLI एंडपॉइंट कॉन्फ़िगर नहीं किया गया।",
+  "access.cli.install": "CLI इंस्टॉल करें",
+  "access.cli.title": "CLI",
+  "access.copied": "कॉपी किया गया",
+  "access.copy": "कॉपी करें",
+  "access.copyFailed": "कॉपी विफल",
+  "access.copyToast": "क्लिपबोर्ड पर कॉपी किया गया",
+  "access.hide": "छिपाएं",
+  "access.members.clearAll": "सब साफ़ करें",
+  "access.members.empty": "कोई मेल नहीं मिला।",
+  "access.members.groupCount_one": "{{count}} समूह",
+  "access.members.groupCount_other": "{{count}} समूह",
+  "access.members.groups": "समूह",
+  "access.members.individuals": "सदस्य",
+  "access.members.memberCount_one": "{{count}} सदस्य",
+  "access.members.memberCount_other": "{{count}} सदस्य",
+  "access.members.pickPlaceholder": "समूह या सदस्य चुनें",
+  "access.members.searchPlaceholder": "समूह और सदस्य खोजें",
+  "access.members.selectedLabel": "चयनित",
+  "access.permission.anyone": "लिंक वाला कोई भी",
+  "access.permission.anyoneDesc": "कोई भी बिना लॉग इन किए इस डिप्लॉयमेंट तक पहुँच सकता है।",
+  "access.permission.memberCount_one": "{{count}} सदस्य",
+  "access.permission.memberCount_other": "{{count}} सदस्य",
+  "access.permission.organization": "प्लेटफ़ॉर्म के सभी सदस्य",
+  "access.permission.organizationDesc": "प्लेटफ़ॉर्म के सभी सदस्य",
+  "access.permission.specific": "प्लेटफ़ॉर्म के विशिष्ट सदस्य",
+  "access.permission.specificDesc": "विशिष्ट समूह या सदस्य चुनें",
+  "access.permission.specificUnavailable": "जब तक वास्तविक प्लेटफ़ॉर्म सदस्य और समूह कनेक्ट नहीं होते, विशिष्ट सदस्य चयन अक्षम है।",
+  "access.permission.updateFailed": "एक्सेस नीति अपडेट करने में विफल।",
+  "access.permissions.col.environment": "वातावरण",
+  "access.permissions.col.permission": "एक्सेस",
+  "access.permissions.description": "प्रत्येक वातावरण में WebApp और CLI प्रवेश बिंदुओं के लिए एक्सेस अनुमतियाँ सेट करें।",
+  "access.permissions.editAriaLabel": "{{environment}} के लिए एक्सेस कॉन्फ़िगर करें",
+  "access.permissions.editDescription": "WebApp और CLI प्रवेश बिंदुओं के लिए एक्सेस अनुमतियाँ सेट करें।",
+  "access.permissions.editTitle": "एक्सेस अनुमतियाँ",
+  "access.permissions.title": "एक्सेस अनुमतियाँ",
+  "access.revoke": "रद्द करें",
+  "access.runAccess.description": "प्रबंधित करें कि उपयोगकर्ता इस डिप्लॉयमेंट को कैसे चला सकते हैं और प्रत्येक वातावरण में किसे एक्सेस की अनुमति है।",
+  "access.runAccess.disabled": "इस डिप्लॉयमेंट के लिए रन एक्सेस बंद है।",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "इस डिप्लॉयमेंट को एक MCP सर्वर के रूप में प्रकट करें।",
+  "access.runAccess.mcpEmpty": "MCP एंडपॉइंट कॉन्फ़िगर नहीं किया गया।",
+  "access.runAccess.noEnvs": "एक्सेस अनुमतियाँ कॉन्फ़िगर करने के लिए किसी वातावरण पर डिप्लॉय करें।",
+  "access.runAccess.noEnvsTitle": "कोई डिप्लॉय किया गया वातावरण नहीं",
+  "access.runAccess.openWebapp": "WebApp खोलें",
+  "access.runAccess.permissions": "एक्सेस अनुमतियाँ",
+  "access.runAccess.permissionsDesc": "प्रत्येक वातावरण में इस डिप्लॉयमेंट तक कौन पहुँच सकता है।",
+  "access.runAccess.title": "रन एक्सेस",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "अंतिम उपयोगकर्ताओं के लिए होस्ट किया गया वेब पेज।",
+  "access.runAccess.webappEmpty": "जल्द आ रहा है।",
+  "access.show": "दिखाएं",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "बाहरी",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "अज्ञात",
+  "card.access.api": "API टोकन",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "कोई एक्सेस नहीं",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "पहली रिलीज़ बनाएं",
+  "card.deploy": "डिप्लॉय करें",
+  "card.deploying": "{{count}} डिप्लॉय हो रहे हैं",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} विफल",
+  "card.fromApp": "{{name}} से",
+  "card.lastDeployed": "अंतिम डिप्लॉय {{time}}",
+  "card.menu.delete": "डिप्लॉयमेंट हटाएं",
+  "card.menu.deleteDisabled": "बैकएंड-प्रबंधित डिप्लॉयमेंट के लिए डिप्लॉयमेंट हटाना अभी उपलब्ध नहीं है।",
+  "card.menu.deploy": "वातावरण पर डिप्लॉय करें",
+  "card.menu.editInfo": "जानकारी संपादित करें",
+  "card.menu.viewDetail": "डिप्लॉयमेंट विवरण देखें",
+  "card.moreActions": "अधिक क्रियाएँ",
+  "card.neverDeployed": "अभी तक डिप्लॉय नहीं किया गया",
+  "card.noDescription": "कोई विवरण प्रदान नहीं किया गया।",
+  "card.notDeployed": "डिप्लॉय नहीं किया गया",
+  "card.ready": "{{count}} चल रहे हैं",
+  "card.tooltip.createdAt": "बनाया गया",
+  "card.tooltip.deployed": "डिप्लॉय किया गया",
+  "card.tooltip.deploymentStatus": "डिप्लॉयमेंट",
+  "card.tooltip.notDeployed": "यह डिप्लॉयमेंट अभी तक किसी भी वातावरण में डिप्लॉय नहीं किया गया है।",
+  "card.tooltip.notDeployedShort": "डिप्लॉय नहीं किया गया",
+  "card.tooltip.release": "रिलीज़",
+  "card.tooltip.releaseName": "रिलीज़ नाम",
+  "card.tooltip.source": "स्रोत",
+  "common.loadFailed": "लोड करने में विफल। बाद में पुनः प्रयास करें।",
+  "common.loading": "लोड हो रहा है...",
+  "createGuide.actions.back": "वापस",
+  "createGuide.actions.cancel": "रद्द करें",
+  "createGuide.actions.continue": "जारी रखें",
+  "createGuide.actions.createAndDeploy": "बनाएं और डिप्लॉय करें",
+  "createGuide.actions.creating": "बनाया जा रहा है...",
+  "createGuide.actions.deploy": "डिप्लॉय करें",
+  "createGuide.actions.deploying": "बनाया और डिप्लॉय किया जा रहा है...",
+  "createGuide.actions.next": "अगला",
+  "createGuide.actions.skipDeploy": "छोड़ें, बाद में डिप्लॉय करें",
+  "createGuide.description": "रिलीज़ स्रोत, बुनियादी जानकारी और लक्ष्य वातावरण से एक डिप्लॉयमेंट बनाएं।",
+  "createGuide.dsl.defaultAppName": "आयातित DSL ऐप",
+  "createGuide.dsl.description": "डिप्लॉयमेंट, पहली रिलीज़ और वैकल्पिक वातावरण डिप्लॉयमेंट बनाने के लिए एक वर्कफ़्लो DSL पैकेज अपलोड करें।",
+  "createGuide.dsl.dropDescription": "एक वर्कफ़्लो YAML DSL पैकेज अपलोड करें। डिप्लॉय से पहले इस फ़ाइल से डिप्लॉयमेंट विकल्प हल किए जाते हैं।",
+  "createGuide.dsl.dropTitle": "वर्कफ़्लो DSL पैकेज अपलोड करें",
+  "createGuide.dsl.readFailed": "DSL फ़ाइल पढ़ने में विफल। दूसरी फ़ाइल चुनें और पुनः प्रयास करें।",
+  "createGuide.dsl.reading": "DSL फ़ाइल पढ़ी जा रही है...",
+  "createGuide.dsl.title": "DSL आयात करें",
+  "createGuide.dsl.unsupportedMode": "डिप्लॉयमेंट के लिए केवल वर्कफ़्लो DSL फ़ाइलों का उपयोग किया जा सकता है।",
+  "createGuide.errors.createReleaseFailed": "डिप्लॉयमेंट या रिलीज़ बनाने में विफल।",
+  "createGuide.errors.deployFailed": "वातावरण पर डिप्लॉय करने में विफल।",
+  "createGuide.method.description": "पहली रिलीज़ बनाने के लिए उपयोग किया जाने वाला स्रोत चुनें।",
+  "createGuide.methods.bindApp.description": "रिलीज़ स्रोत के रूप में स्टूडियो में मौजूदा वर्कफ़्लो ऐप का उपयोग करें।",
+  "createGuide.methods.bindApp.title": "मौजूदा वर्कफ़्लो ऐप बाइंड करें",
+  "createGuide.methods.importDsl.description": "एक वर्कफ़्लो YAML DSL पैकेज अपलोड करें और डिप्लॉयमेंट UI के माध्यम से जारी रखें।",
+  "createGuide.methods.importDsl.title": "DSL आयात करें",
+  "createGuide.methods.mocked": "मॉक किया गया",
+  "createGuide.nav.back": "डिप्लॉयमेंट",
+  "createGuide.release.defaultName": "प्रारंभिक रिलीज़",
+  "createGuide.release.deployInfo": "डिप्लॉयमेंट जानकारी",
+  "createGuide.release.description": "डिप्लॉयमेंट जानकारी और पहली रिलीज़ का विवरण भरें।",
+  "createGuide.release.firstVersion": "पहली रिलीज़",
+  "createGuide.release.instanceDescription": "डिप्लॉयमेंट विवरण",
+  "createGuide.release.instanceDescriptionPlaceholder": "बताएं कि इस डिप्लॉयमेंट का उपयोग किस लिए किया जाता है",
+  "createGuide.release.instanceName": "डिप्लॉयमेंट नाम",
+  "createGuide.release.instanceNameConflict": "इस नाम वाला एक डिप्लॉयमेंट पहले से मौजूद है। दूसरा नाम चुनें।",
+  "createGuide.release.releaseDescription": "रिलीज़ विवरण",
+  "createGuide.release.releaseDescriptionPlaceholder": "इस रिलीज़ का वर्णन करें",
+  "createGuide.release.releaseName": "रिलीज़ नाम",
+  "createGuide.release.releaseNote": "रिलीज़ विवरण",
+  "createGuide.release.title": "बुनियादी जानकारी",
+  "createGuide.source.availableApps_one": "{{count}} ऐप",
+  "createGuide.source.availableApps_other": "{{count}} ऐप्स",
+  "createGuide.source.clearSearch": "ऐप खोज साफ़ करें",
+  "createGuide.source.description": "पहली रिलीज़ बनाने के लिए उपयोग किया जाने वाला स्रोत चुनें।",
+  "createGuide.source.empty": "कोई वर्कफ़्लो ऐप नहीं मिला।",
+  "createGuide.source.searchPlaceholder": "ऐप्स खोजें",
+  "createGuide.source.sourceApp": "वर्कफ़्लो ऐप",
+  "createGuide.source.title": "रिलीज़ स्रोत",
+  "createGuide.steps.method": "रिलीज़ स्रोत",
+  "createGuide.steps.release": "बुनियादी जानकारी",
+  "createGuide.steps.source": "रिलीज़ स्रोत",
+  "createGuide.steps.target": "वातावरण पर डिप्लॉय करें",
+  "createGuide.target.bindingCount_one": "{{count}} बाइंडिंग",
+  "createGuide.target.bindingCount_other": "{{count}} बाइंडिंग",
+  "createGuide.target.bindingHint": "इस रिलीज़ द्वारा उपयोग किए जाने वाले क्रेडेंशियल चुनें।",
+  "createGuide.target.bindings": "क्रेडेंशियल",
+  "createGuide.target.deferredBindingHint": "अंतिम डिप्लॉय क्रिया के दौरान वास्तविक डिप्लॉयमेंट योजना से क्रेडेंशियल हल किए जाएंगे।",
+  "createGuide.target.deferredEnvironmentHint": "डिप्लॉयमेंट और रिलीज़ बनने के बाद नाम का मिलान वास्तविक वातावरणों से किया जाता है।",
+  "createGuide.target.description": "एक लक्ष्य वातावरण चुनें और वहां इस रिलीज़ को आवश्यक रनटाइम सेटिंग्स प्रदान करें। यह चरण छोड़ा जा सकता है।",
+  "createGuide.target.envVarCount_one": "{{count}} वेरिएबल",
+  "createGuide.target.envVarCount_other": "{{count}} वेरिएबल",
+  "createGuide.target.envVarHint": "इस रिलीज़ को आवश्यक प्रत्येक वातावरण वेरिएबल के लिए, एक कस्टम मान दर्ज करें या ऐप में परिभाषित मान का उपयोग करें।",
+  "createGuide.target.envVarPlaceholder": "मान दर्ज करें",
+  "createGuide.target.envVarSource.ariaLabel": "{{key}} के लिए वेरिएबल मान स्रोत चुनें",
+  "createGuide.target.envVarSource.default": "ऐप मान",
+  "createGuide.target.envVarSource.lastDeployment": "अंतिम डिप्लॉय किया गया मान",
+  "createGuide.target.envVarSource.literal": "कस्टम मान",
+  "createGuide.target.envVarType.number": "संख्या",
+  "createGuide.target.envVarType.secret": "गोपनीय",
+  "createGuide.target.envVarType.string": "स्ट्रिंग",
+  "createGuide.target.envVars": "वातावरण वेरिएबल",
+  "createGuide.target.environment": "लक्ष्य वातावरण",
+  "createGuide.target.environmentName": "वातावरण नाम",
+  "createGuide.target.environmentNamePlaceholder": "उत्पादन",
+  "createGuide.target.loadBindingsFailed": "क्रेडेंशियल लोड करने में विफल।",
+  "createGuide.target.loadEnvironmentsFailed": "डिप्लॉय वातावरण लोड करने में विफल।",
+  "createGuide.target.missingRequiredBinding": "इस आवश्यक बाइंडिंग के लिए एक क्रेडेंशियल चुनें।",
+  "createGuide.target.noBindingRequired": "किसी क्रेडेंशियल की आवश्यकता नहीं।",
+  "createGuide.target.noCredentialCandidates": "कोई उपलब्ध क्रेडेंशियल नहीं।",
+  "createGuide.target.noEnvironmentOptions": "कोई डिप्लॉय वातावरण उपलब्ध नहीं।",
+  "createGuide.target.required": "आवश्यक",
+  "createGuide.target.selectCredential": "एक क्रेडेंशियल चुनें",
+  "createGuide.target.title": "वातावरण पर डिप्लॉय करें",
+  "createGuide.title": "नया डिप्लॉयमेंट",
+  "createModal.appPickerPlaceholder": "एक वर्कफ़्लो ऐप चुनें",
+  "createModal.appSearchEmpty": "कोई मेल खाने वाला वर्कफ़्लो ऐप नहीं",
+  "createModal.appSearchPlaceholder": "वर्कफ़्लो ऐप्स खोजें…",
+  "createModal.cancel": "रद्द करें",
+  "createModal.create": "बनाएं",
+  "createModal.createFailed": "डिप्लॉयमेंट बनाने में विफल।",
+  "createModal.description": "एक वर्कफ़्लो ऐप चुनें और एक डिप्लॉयमेंट बनाएं।",
+  "createModal.descriptionLabel": "विवरण",
+  "createModal.descriptionPlaceholder": "बताएं कि इस डिप्लॉयमेंट का उपयोग किस लिए किया जाता है",
+  "createModal.loadMoreApps": "अधिक ऐप्स लोड करें",
+  "createModal.loadingApps": "ऐप्स लोड हो रहे हैं…",
+  "createModal.nameLabel": "डिप्लॉयमेंट नाम",
+  "createModal.namePlaceholder": "डिप्लॉयमेंट नाम",
+  "createModal.noApps": "इस वर्कस्पेस में कोई वर्कफ़्लो ऐप नहीं मिला। पहले स्टूडियो में एक बनाएं।",
+  "createModal.selected": "चयनित",
+  "createModal.sourceApp": "वर्कफ़्लो ऐप (आवश्यक)",
+  "createModal.title": "नया डिप्लॉयमेंट",
+  "deployDrawer.bindingCount_one": "{{count}} बाइंडिंग",
+  "deployDrawer.bindingCount_other": "{{count}} बाइंडिंग",
+  "deployDrawer.bindingOptionsFailed": "क्रेडेंशियल विकल्प लोड करने में विफल।",
+  "deployDrawer.bindingSelectionHint": "इस डिप्लॉयमेंट द्वारा उपयोग किए जाने वाले क्रेडेंशियल चुनें।",
+  "deployDrawer.bindingsDisabled": "रिलीज़ पूर्वावलोकन से हल किया गया। संपादन अभी उपलब्ध नहीं है।",
+  "deployDrawer.cancel": "रद्द करें",
+  "deployDrawer.close": "डिप्लॉयमेंट ड्रॉवर बंद करें",
+  "deployDrawer.defaultSelect": "चुनें...",
+  "deployDrawer.deploy": "वातावरण पर डिप्लॉय करें",
+  "deployDrawer.deployExistingRelease": "वातावरण पर डिप्लॉय करें",
+  "deployDrawer.deployExistingReleaseDescription": "डिप्लॉय करने के लिए एक रिलीज़ और लक्ष्य वातावरण चुनें।",
+  "deployDrawer.deployExistingReleaseTitle": "वातावरण पर डिप्लॉय करें",
+  "deployDrawer.deployFailed": "डिप्लॉयमेंट शुरू करने में विफल।",
+  "deployDrawer.deploying": "डिप्लॉय हो रहा है...",
+  "deployDrawer.description": "डिप्लॉय करने के लिए एक रिलीज़ और लक्ष्य वातावरण चुनें।",
+  "deployDrawer.envVarCount_one": "{{count}} वेरिएबल",
+  "deployDrawer.envVarCount_other": "{{count}} वेरिएबल",
+  "deployDrawer.envVarHint": "इस रिलीज़ को आवश्यक प्रत्येक वातावरण वेरिएबल के लिए, एक कस्टम मान दर्ज करें या ऐप में परिभाषित मान का उपयोग करें।",
+  "deployDrawer.envVarPlaceholder": "मान दर्ज करें",
+  "deployDrawer.envVarSource.ariaLabel": "{{key}} के लिए वेरिएबल मान स्रोत चुनें",
+  "deployDrawer.envVarSource.default": "ऐप मान",
+  "deployDrawer.envVarSource.lastDeployment": "अंतिम डिप्लॉय किया गया मान",
+  "deployDrawer.envVarSource.literal": "कस्टम मान",
+  "deployDrawer.envVarType.number": "संख्या",
+  "deployDrawer.envVarType.secret": "गोपनीय",
+  "deployDrawer.envVarType.string": "स्ट्रिंग",
+  "deployDrawer.envVars": "वातावरण वेरिएबल",
+  "deployDrawer.existingReleaseHint": "यह रिलीज़ यथावत डिप्लॉय की जाएगी। कोई नई रिलीज़ नहीं बनाई जाएगी।",
+  "deployDrawer.loadingBindings": "हल किया जा रहा है...",
+  "deployDrawer.lockedHint": "वर्तमान वातावरण पर लॉक",
+  "deployDrawer.missingRequiredBinding": "इस आवश्यक बाइंडिंग के लिए एक क्रेडेंशियल चुनें।",
+  "deployDrawer.missingRequiredEnvVar": "इस आवश्यक वातावरण वेरिएबल के लिए एक मान दर्ज करें।",
+  "deployDrawer.modelCreds": "मॉडल क्रेडेंशियल",
+  "deployDrawer.needsValidation": " (सत्यापन की आवश्यकता है)",
+  "deployDrawer.newReleaseHint": "चयनित वर्कफ़्लो ऐप YAML से एक नई रिलीज़ बनाई जाएगी।",
+  "deployDrawer.noBindingRequired": "आवश्यक नहीं",
+  "deployDrawer.noCredentialCandidates": "कोई उपलब्ध क्रेडेंशियल नहीं।",
+  "deployDrawer.noNewEnvironmentAvailable": "सभी उपलब्ध वातावरणों में पहले से ही एक डिप्लॉयमेंट है।",
+  "deployDrawer.noOtherReleaseAvailable": "इस वातावरण के लिए कोई अन्य रिलीज़ उपलब्ध नहीं है।",
+  "deployDrawer.noReleaseAvailable": "किसी वातावरण पर डिप्लॉय करने से पहले एक रिलीज़ बनाएं।",
+  "deployDrawer.notFound": "डिप्लॉयमेंट नहीं मिला।",
+  "deployDrawer.noteLabel": "रिलीज़ विवरण (वैकल्पिक)",
+  "deployDrawer.notePlaceholder": "उदा. ऑनबोर्डिंग कॉपी ट्वीक शिप करें",
+  "deployDrawer.pluginCreds": "प्लगइन क्रेडेंशियल",
+  "deployDrawer.promote": "डिप्लॉय करें",
+  "deployDrawer.promoteDescription": "डिप्लॉय करने के लिए एक रिलीज़ और लक्ष्य वातावरण चुनें।",
+  "deployDrawer.promoteTitle": "वातावरण पर डिप्लॉय करें",
+  "deployDrawer.readOnly": "केवल-पढ़ने के लिए",
+  "deployDrawer.redeploy": "वातावरण पर डिप्लॉय करें",
+  "deployDrawer.redeployDescription": "डिप्लॉय करने के लिए एक रिलीज़ और लक्ष्य वातावरण चुनें।",
+  "deployDrawer.redeployExistingReleaseHint": "वर्तमान रिलीज़ यथावत पुनः डिप्लॉय की जाएगी। कोई नई रिलीज़ नहीं बनाई जाएगी।",
+  "deployDrawer.redeployTitle": "वातावरण पर डिप्लॉय करें",
+  "deployDrawer.releaseLabel": "रिलीज़",
+  "deployDrawer.requiredBinding": "आवश्यक",
+  "deployDrawer.rollback": "डिप्लॉय करें",
+  "deployDrawer.rollbackDescription": "डिप्लॉय करने के लिए एक रिलीज़ और लक्ष्य वातावरण चुनें।",
+  "deployDrawer.rollbackTitle": "वातावरण पर डिप्लॉय करें",
+  "deployDrawer.runtimeCredentials": "क्रेडेंशियल",
+  "deployDrawer.secretPlaceholder": "गोपनीय",
+  "deployDrawer.selectCredential": "एक क्रेडेंशियल चुनें",
+  "deployDrawer.selectEnv": "एक वातावरण चुनें",
+  "deployDrawer.selectProviderCred": "{{provider}} क्रेडेंशियल चुनें",
+  "deployDrawer.selectProviderKey": "{{provider}} कुंजी चुनें",
+  "deployDrawer.selectRelease": "एक रिलीज़ चुनें",
+  "deployDrawer.targetEnv": "लक्ष्य वातावरण",
+  "deployDrawer.title": "वातावरण पर डिप्लॉय करें",
+  "deployDrawer.valuePlaceholder": "मान",
+  "deployTab.cancelDeployment": "डिप्लॉयमेंट रद्द करें",
+  "deployTab.closeError": "बंद करें",
+  "deployTab.col.actions": "क्रियाएँ",
+  "deployTab.col.currentRelease": "वर्तमान रिलीज़",
+  "deployTab.col.environment": "वातावरण",
+  "deployTab.col.status": "स्थिति",
+  "deployTab.col.updated": "अपडेट किया गया",
+  "deployTab.collapseDetails": "डिप्लॉयमेंट विवरण संक्षिप्त करें",
+  "deployTab.confirmUndeploy": "अनडिप्लॉय करें",
+  "deployTab.deployOtherVersion": "अन्य रिलीज़ डिप्लॉय करें",
+  "deployTab.deployToEnv": "{{name}} पर डिप्लॉय करें",
+  "deployTab.deployToNewEnv": "नए वातावरण पर डिप्लॉय करें...",
+  "deployTab.empty": "अभी तक कोई इंस्टेंस नहीं। शुरू करने के लिए एक नए वातावरण पर डिप्लॉय करें।",
+  "deployTab.emptyDescription": "इस डिप्लॉयमेंट को उपयोगकर्ताओं के लिए उपलब्ध कराने हेतु एक रिलीज़ और लक्ष्य वातावरण चुनें।",
+  "deployTab.emptyTitle": "अभी तक कोई वातावरण नहीं चल रहा",
+  "deployTab.envCount": "वातावरण",
+  "deployTab.errorCode": "कोड",
+  "deployTab.errorDialogDesc": "पुनः प्रयास करने या अन्य रिलीज़ डिप्लॉय करने से पहले अंतिम विफल डिप्लॉयमेंट की समीक्षा करें।",
+  "deployTab.errorDialogTitle": "{{name}} में डिप्लॉयमेंट त्रुटि",
+  "deployTab.errorMessage": "संदेश",
+  "deployTab.errorPhase": "चरण",
+  "deployTab.expandDetails": "डिप्लॉयमेंट विवरण विस्तृत करें",
+  "deployTab.moreActions": "अधिक क्रियाएँ",
+  "deployTab.newDeployment": "नए वातावरण पर डिप्लॉय करें",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "डिप्लॉयमेंट ID",
+  "deployTab.panel.endpoints": "एंडपॉइंट",
+  "deployTab.panel.envVars": "वातावरण वेरिएबल",
+  "deployTab.panel.error": "त्रुटि",
+  "deployTab.panel.failedRelease": "विफल रिलीज़",
+  "deployTab.panel.health": "स्वास्थ्य",
+  "deployTab.panel.instanceInfo": "इंस्टेंस जानकारी",
+  "deployTab.panel.modelCreds": "मॉडल क्रेडेंशियल",
+  "deployTab.panel.pluginCreds": "प्लगइन क्रेडेंशियल",
+  "deployTab.panel.release": "रिलीज़",
+  "deployTab.panel.releaseCreatedAt": "रिलीज़ बनाई गई",
+  "deployTab.panel.releaseInfo": "रिलीज़ जानकारी",
+  "deployTab.panel.replicas": "प्रतिकृतियां",
+  "deployTab.panel.run": "चलाएं",
+  "deployTab.panel.runtimeBindings": "क्रेडेंशियल",
+  "deployTab.panel.runtimeInfo": "रनटाइम जानकारी",
+  "deployTab.panel.runtimeMode": "रनटाइम मोड",
+  "deployTab.panel.runtimeNote": "रनटाइम नोट",
+  "deployTab.panel.targetRelease": "लक्ष्य रिलीज़",
+  "deployTab.panel.unknownError": "डिप्लॉयमेंट विफल।",
+  "deployTab.promote": "डिप्लॉय करें",
+  "deployTab.redeploy": "पुनः डिप्लॉय करें",
+  "deployTab.releaseCreatedAt": "रिलीज़ बनाई गई {{time}}",
+  "deployTab.retry": "पुनः प्रयास करें",
+  "deployTab.shortcut": "शॉर्टकट",
+  "deployTab.status.deployFailed": "डिप्लॉय विफल",
+  "deployTab.status.deployingRelease": "डिप्लॉय हो रहा है ({{release}})",
+  "deployTab.status.runningOutOfSync": "चल रहा है (सिंक लंबित)",
+  "deployTab.status.runningWithFailed": "चल रहा है (अंतिम डिप्लॉयमेंट विफल)",
+  "deployTab.undeploy": "अनडिप्लॉय करें",
+  "deployTab.undeployConfirmDesc": "अंतिम-उपयोगकर्ता एक्सेस तुरंत रुक जाएगा। रिलीज़ को बाद में पुनः डिप्लॉय किया जा सकता है।",
+  "deployTab.undeployConfirmTitle": "{{name}} से अनडिप्लॉय करें?",
+  "deployTab.undeployFrom": "{{name}} से अनडिप्लॉय करें",
+  "deployTab.undeployImpactTitle": "प्रभावित इंस्टेंस",
+  "deployTab.viewError": "त्रुटि देखें",
+  "deployTab.viewLogs": "लॉग देखें",
+  "deployTab.viewProgress": "प्रगति देखें",
+  "detail.backToInstances": "डिप्लॉयमेंट पर वापस जाएं",
+  "detail.deployingCount": "{{count}} डिप्लॉय हो रहे हैं",
+  "detail.envCount_one": "{{count}} वातावरण",
+  "detail.envCount_other": "{{count}} वातावरण",
+  "detail.failedCount": "{{count}} विफल",
+  "detail.mobileTabs": "डिप्लॉयमेंट अनुभाग",
+  "detail.notFound": "डिप्लॉयमेंट नहीं मिला",
+  "detail.openSourceApp": "स्रोत {{name}} खोलें",
+  "detail.sourceApp": "स्रोत",
+  "detail.sourceAppLink": "स्रोत",
+  "documentTitle.create": "नया डिप्लॉयमेंट · डिप्लॉयमेंट",
+  "documentTitle.detail": "डिप्लॉयमेंट · डिप्लॉयमेंट",
+  "documentTitle.list": "डिप्लॉयमेंट",
+  "filter.allEnvs": "सभी वातावरण",
+  "filter.notDeployed": "डिप्लॉय नहीं किया गया",
+  "filter.searchPlaceholder": "डिप्लॉयमेंट खोजें",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "प्रवेश",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "बूटस्ट्रैपिंग",
+  "health.ENVIRONMENT_STATUS_DELETING": "हटाया जा रहा है",
+  "health.ENVIRONMENT_STATUS_FAILED": "अनुपलब्ध",
+  "health.ENVIRONMENT_STATUS_READY": "उपलब्ध",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "अज्ञात",
+  "list.clearFilters": "फ़िल्टर साफ़ करें",
+  "list.clearSearch": "डिप्लॉयमेंट खोज साफ़ करें",
+  "list.createDeployment": "नया",
+  "list.empty": "कोई डिप्लॉयमेंट नहीं मिला।",
+  "list.emptyDescription": "रिलीज़, वातावरण और एक्सेस का प्रबंधन करने के लिए वर्कफ़्लो ऐप या वर्कफ़्लो DSL पैकेज से एक डिप्लॉयमेंट बनाएं।",
+  "list.emptyFilteredDescription": "वर्तमान खोज या वातावरण फ़िल्टर से कोई डिप्लॉयमेंट मेल नहीं खाता।",
+  "list.emptyFilteredTitle": "कोई मेल खाने वाला डिप्लॉयमेंट नहीं",
+  "list.emptyTitle": "अभी तक कोई डिप्लॉयमेंट नहीं",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "पृथक",
+  "mode.ENVIRONMENT_MODE_SHARED": "साझा",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "अज्ञात",
+  "newInstance.comingSoon": "जल्द आ रहा है",
+  "newInstance.fromStudio": "स्टूडियो से चुनें",
+  "newInstance.importDSL": "DSL आयात करें",
+  "newInstance.title": "नया डिप्लॉयमेंट",
+  "overview.accessEndpoints": "एक्सेस एंडपॉइंट",
+  "overview.accessMeta.apiTokens": "API टोकन प्रबंधित करें",
+  "overview.accessMeta.cli": "CLI एक्सेस देखें",
+  "overview.accessMeta.webApp": "WebApp एक्सेस प्रबंधित करें",
+  "overview.accessStatus": "एक्सेस",
+  "overview.api": "API टोकन",
+  "overview.apiKeysCount_one": "{{count}} API टोकन",
+  "overview.apiKeysCount_other": "{{count}} API टोकन",
+  "overview.apiTokenSummary.environments_one": "{{count}} डिप्लॉय किया गया वातावरण",
+  "overview.apiTokenSummary.environments_other": "{{count}} डिप्लॉय किए गए वातावरण",
+  "overview.availableForDeployment": "डिप्लॉयमेंट के लिए उपलब्ध",
+  "overview.basicInfo": "बुनियादी जानकारी",
+  "overview.cardAction.deployLatest": "नवीनतम रिलीज़ डिप्लॉय करें",
+  "overview.cardAction.redeploy": "पुनः डिप्लॉय करें",
+  "overview.cardAction.viewProgress": "डिप्लॉयमेंट देखें",
+  "overview.chip.behindTooltip_one": "नवीनतम से 1 रिलीज़ पीछे। अपडेट करने के लिए नवीनतम रिलीज़ डिप्लॉय करें।",
+  "overview.chip.behindTooltip_other": "नवीनतम से {{count}} रिलीज़ पीछे। अपडेट करने के लिए नवीनतम रिलीज़ डिप्लॉय करें।",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "डिप्लॉय हो रहा है",
+  "overview.chip.deployingTooltip": "डिप्लॉयमेंट प्रगति पर है।",
+  "overview.chip.empty": "खाली",
+  "overview.chip.emptyTooltip": "इस वातावरण पर कोई रिलीज़ डिप्लॉय नहीं की गई है।",
+  "overview.chip.failed": "विफल",
+  "overview.chip.failedTooltip": "नवीनतम डिप्लॉयमेंट प्रयास विफल रहा।",
+  "overview.chip.latest": "नवीनतम",
+  "overview.chip.latestTooltip": "यह वातावरण नवीनतम रिलीज़ चला रहा है।",
+  "overview.chip.needsReleaseFirst": "पहले एक रिलीज़ बनाएं",
+  "overview.chip.olderRelease": "पुराना",
+  "overview.chip.olderReleaseTooltip": "यह वातावरण पुरानी रिलीज़ चला रहा है।",
+  "overview.chip.openInDeployTab": "डिप्लॉयमेंट प्रगति देखें",
+  "overview.cli": "CLI",
+  "overview.configured": "कॉन्फ़िगर किया गया",
+  "overview.createRelease": "रिलीज़ बनाएं",
+  "overview.created": "बनाया गया",
+  "overview.deploy": "डिप्लॉय करें",
+  "overview.deployedEnvironments": "डिप्लॉय किए गए",
+  "overview.deploymentOverview": "डिप्लॉयमेंट अवलोकन",
+  "overview.deploymentStatus": "डिप्लॉयमेंट स्थिति",
+  "overview.description": "विवरण",
+  "overview.developerApi": "डेवलपर API",
+  "overview.disabled": "अक्षम",
+  "overview.emptyValue": "सेट नहीं किया गया",
+  "overview.enabled": "सक्षम",
+  "overview.enabledChannels": "एक्सेस सक्षम",
+  "overview.endUserAccess": "अंतिम-उपयोगकर्ता एक्सेस",
+  "overview.environments": "वातावरण",
+  "overview.hero.byName": "{{name}} द्वारा",
+  "overview.hero.empty": "अभी तक कोई रिलीज़ नहीं",
+  "overview.hero.emptyDescription": "डिप्लॉय करने से पहले वर्तमान स्रोत से एक रिलीज़ बनाएं।",
+  "overview.hero.propagation_one": "{{count}}/{{total}} वातावरण पर डिप्लॉय किया गया",
+  "overview.hero.propagation_other": "{{count}}/{{total}} वातावरणों पर डिप्लॉय किया गया",
+  "overview.hero.untargeted": "अभी तक कोई वातावरण कॉन्फ़िगर नहीं किया गया",
+  "overview.instanceDetails": "डिप्लॉयमेंट विवरण",
+  "overview.instanceId": "डिप्लॉयमेंट ID",
+  "overview.latestRelease.releaseCount_one": "{{count}} रिलीज़",
+  "overview.latestRelease.releaseCount_other": "{{count}} रिलीज़",
+  "overview.latestReleaseTitle": "नवीनतम रिलीज़",
+  "overview.manageDeployments": "डिप्लॉयमेंट प्रबंधित करें",
+  "overview.name": "नाम",
+  "overview.noAccessConfig": "कोई एक्सेस कॉन्फ़िगरेशन नहीं।",
+  "overview.noReleaseYet": "किसी वातावरण पर डिप्लॉय करने से पहले एक रिलीज़ बनाएं।",
+  "overview.notConfigured": "कॉन्फ़िगर नहीं किया गया",
+  "overview.previousReleases.empty": "अभी तक कोई पुरानी रिलीज़ नहीं।",
+  "overview.previousReleases.retired": "वर्तमान में डिप्लॉय नहीं किया गया",
+  "overview.previousReleases.title": "पिछली रिलीज़",
+  "overview.previousReleases.viewAll": "सभी देखें",
+  "overview.ready": "डिप्लॉय करने योग्य",
+  "overview.recentReleases": "हाल की रिलीज़",
+  "overview.releaseDeployedTitle": "{{release}} डिप्लॉय की गई है",
+  "overview.releaseReadyTitle": "{{release}} डिप्लॉय करने के लिए तैयार है",
+  "overview.serviceMap": "सेवा मानचित्र",
+  "overview.servingRelease": "{{release}} सेवा कर रहा है",
+  "overview.servingReleaseDescription": "यह डिप्लॉयमेंट {{count}}/{{total}} वातावरणों पर डिप्लॉय किया गया है।",
+  "overview.strip.deployToNewEnvironment": "नए वातावरण पर डिप्लॉय करें",
+  "overview.strip.empty": "कोई वातावरण कॉन्फ़िगर नहीं किया गया।",
+  "overview.strip.emptyDeployableDescription": "जब आप तैयार हों तो नवीनतम रिलीज़ को किसी वातावरण पर डिप्लॉय करें।",
+  "overview.strip.emptyDeployed": "अभी तक कोई इंस्टेंस नहीं।",
+  "overview.strip.emptyDescription": "किसी वातावरण पर डिप्लॉय करने से पहले एक रिलीज़ बनाएं।",
+  "overview.strip.emptyTitle": "अभी तक कोई इंस्टेंस नहीं",
+  "overview.strip.summary_one": "{{total}} में से 1 नवीनतम रिलीज़ पर",
+  "overview.strip.summary_other": "{{total}} में से {{count}} नवीनतम रिलीज़ पर",
+  "overview.strip.title": "इंस्टेंस",
+  "overview.switchSourceApp": "स्रोत बदलें",
+  "overview.switchSourceAppDescription": "भविष्य की रिलीज़ के लिए स्रोत के रूप में उपयोग किया जाने वाला वर्कफ़्लो ऐप चुनें।",
+  "overview.switchSourceAppHint": "बदलने के बाद, केवल नई बनाई गई रिलीज़ नए स्रोत का उपयोग करती हैं। ऐतिहासिक रिलीज़ और मौजूदा डिप्लॉयमेंट नहीं बदले जाते।",
+  "overview.targetRelease": "लक्ष्य रिलीज़",
+  "overview.webapp": "WebApp",
+  "settings.danger": "खतरनाक क्षेत्र",
+  "settings.dangerDesc": "इस डिप्लॉयमेंट को स्थायी रूप से हटाएं और चल रहे किसी भी इंस्टेंस को रोकें। इसे वापस नहीं लिया जा सकता।",
+  "settings.delete": "डिप्लॉयमेंट हटाएं",
+  "settings.deleteConfirmDesc": "{{name}} हटाएं? प्रत्येक इंस्टेंस सभी वातावरणों में चलना बंद कर देगा और हटा दिया जाएगा। इसे वापस नहीं लिया जा सकता।",
+  "settings.deleteConfirmTitle": "डिप्लॉयमेंट हटाएं",
+  "settings.deleteFailed": "डिप्लॉयमेंट हटाने में विफल।",
+  "settings.deleteImpact": "प्रभाव",
+  "settings.deleteImpactInstance": "डिप्लॉयमेंट",
+  "settings.deleteImpactTitle": "प्रभावित डिप्लॉयमेंट",
+  "settings.deleteImpactValue": "डिप्लॉयमेंट को डिप्लॉयमेंट सूची से हटा दिया गया है।",
+  "settings.deleted": "डिप्लॉयमेंट हटाया गया",
+  "settings.description": "विवरण",
+  "settings.descriptionHelp": "इस डिप्लॉयमेंट का नाम, विवरण और अन्य सेटिंग्स प्रबंधित करें।",
+  "settings.general": "सामान्य",
+  "settings.name": "डिप्लॉयमेंट नाम",
+  "settings.reset": "रीसेट करें",
+  "settings.save": "परिवर्तन सहेजें",
+  "settings.updateFailed": "डिप्लॉयमेंट अपडेट करने में विफल।",
+  "settings.updated": "डिप्लॉयमेंट अपडेट किया गया",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "डिप्लॉय हो रहा है",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "सिंक लंबित",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "डिप्लॉय विफल",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "अमान्य",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "चल रहा है",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "डिप्लॉय नहीं किया गया",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "अनडिप्लॉय हो रहा है",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "अज्ञात",
+  "subtitle": "वातावरणों में डिप्लॉयमेंट प्रबंधित करें।",
+  "tabs.access.description": "एक्सेस चैनल और एक्सेस अनुमतियाँ प्रबंधित करें।",
+  "tabs.access.name": "एक्सेस",
+  "tabs.api-tokens.description": "API टोकन प्रबंधित करें और HTTP पर इंस्टेंस इनवोक करें।",
+  "tabs.api-tokens.name": "API टोकन",
+  "tabs.instances.description": "डिप्लॉय किए गए वातावरणों में इंस्टेंस देखें और प्रबंधित करें।",
+  "tabs.instances.name": "इंस्टेंस",
+  "tabs.overview.description": "वातावरणों में डिप्लॉयमेंट की स्थिति देखें।",
+  "tabs.overview.name": "अवलोकन",
+  "tabs.releases.description": "रिलीज़ बनाएं, डिप्लॉय करें और प्रबंधित करें।",
+  "tabs.releases.name": "रिलीज़",
+  "tabs.settings.description": "इस डिप्लॉयमेंट का नाम, विवरण और अन्य सेटिंग्स प्रबंधित करें।",
+  "tabs.settings.name": "सेटिंग्स",
+  "title": "डिप्लॉयमेंट",
+  "unsupportedDslNodes.description": "इस रिलीज़ में ऐसे नोड हैं जिनका डिप्लॉयमेंट रनटाइम अभी समर्थन नहीं करता है। उन्हें स्टूडियो में हटाएं या बदलें, फिर पुनः प्रयास करें।",
+  "unsupportedDslNodes.descriptionWithTypes": "इस रिलीज़ में ऐसे नोड हैं जिनका डिप्लॉयमेंट रनटाइम अभी समर्थन नहीं करता है: {{nodeTypes}}. उन्हें स्टूडियो में हटाएं या बदलें, फिर पुनः प्रयास करें।",
+  "unsupportedDslNodes.title": "असमर्थित नोड",
+  "unsupportedDslNodes.unknownType": "अज्ञात प्रकार",
+  "versions.cancelCreate": "रद्द करें",
+  "versions.cancelDelete": "रद्द करें",
+  "versions.cancelEdit": "रद्द करें",
+  "versions.checkingReleaseContent": "रिलीज़ सामग्री जांची जा रही है...",
+  "versions.col.action": "क्रिया",
+  "versions.col.author": "द्वारा बनाया गया",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "बनाया गया",
+  "versions.col.deployedTo": "डिप्लॉय किया गया",
+  "versions.col.release": "रिलीज़",
+  "versions.col.sourceApp": "स्रोत",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "बनाएं",
+  "versions.createFailed": "रिलीज़ बनाने में विफल।",
+  "versions.createRelease": "रिलीज़ बनाएं",
+  "versions.createReleaseDescription": "वर्कफ़्लो ऐप या वर्कफ़्लो DSL फ़ाइल से एक डिप्लॉय करने योग्य रिलीज़ बनाएं।",
+  "versions.createReleaseHint": "नई रिलीज़ किसी भी वातावरण पर डिप्लॉय की जा सकती हैं।",
+  "versions.createSuccess": "रिलीज़ \"{{name}}\" बनाई गई।",
+  "versions.creating": "बनाया जा रहा है...",
+  "versions.currentOn": "{{name}} पर वर्तमान रिलीज़",
+  "versions.deleteConfirmDesc": "रिलीज़ \"{{name}}\" स्थायी रूप से हटा दी जाएगी। इसे वापस नहीं लिया जा सकता।",
+  "versions.deleteConfirmTitle": "रिलीज़ हटाएं?",
+  "versions.deleteFailed": "रिलीज़ हटाने में विफल।",
+  "versions.deleteImpactDeployment": "डिप्लॉयमेंट स्थिति",
+  "versions.deleteImpactNotDeployed": "वर्तमान में डिप्लॉय नहीं किया गया",
+  "versions.deleteImpactRelease": "रिलीज़",
+  "versions.deleteImpactTitle": "हटाने का प्रभाव",
+  "versions.deleteRelease": "रिलीज़ हटाएं",
+  "versions.deleteSuccess": "रिलीज़ \"{{name}}\" हटाई गई।",
+  "versions.deploy": "डिप्लॉय करें",
+  "versions.deployTo": "{{name}} पर डिप्लॉय करें",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "डिप्लॉय हो रहा है",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "सिंक लंबित",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "विफल",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "अमान्य",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "चल रहा है",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "डिप्लॉय नहीं किया गया",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "अनडिप्लॉय हो रहा है",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "अज्ञात",
+  "versions.deployingTo": "{{name}} डिप्लॉय हो रहा है",
+  "versions.disabledReason.checkDeploymentsFailed": "डिप्लॉयमेंट उपयोग सत्यापित नहीं किया जा सका। बाद में पुनः प्रयास करें।",
+  "versions.disabledReason.checkingDeployments": "डिप्लॉयमेंट उपयोग जांचा जा रहा है",
+  "versions.disabledReason.current": "यह रिलीज़ पहले से ही {{name}} पर चल रही है",
+  "versions.disabledReason.deploying": "सक्रिय डिप्लॉयमेंट के पूर्ण होने की प्रतीक्षा करें",
+  "versions.disabledReason.envDisabled": "यह वातावरण डिप्लॉय करने योग्य नहीं है",
+  "versions.disabledReason.releaseInUse_one": "इसे हटाने से पहले इस रिलीज़ को {{count}} वातावरण से अनडिप्लॉय करें",
+  "versions.disabledReason.releaseInUse_other": "इसे हटाने से पहले इस रिलीज़ को {{count}} वातावरणों से अनडिप्लॉय करें",
+  "versions.dslReadFailed": "DSL फ़ाइल पढ़ने में विफल। दूसरी फ़ाइल चुनें और पुनः प्रयास करें।",
+  "versions.dslReading": "DSL फ़ाइल पढ़ी जा रही है...",
+  "versions.dslUnsupportedMode": "डिप्लॉयमेंट के लिए केवल वर्कफ़्लो DSL फ़ाइलों का उपयोग किया जा सकता है।",
+  "versions.editFailed": "रिलीज़ अपडेट करने में विफल।",
+  "versions.editRelease": "रिलीज़ संपादित करें",
+  "versions.editReleaseDescription": "इस रिलीज़ का नाम और विवरण अपडेट करें।",
+  "versions.editSuccess": "रिलीज़ \"{{name}}\" अपडेट की गई।",
+  "versions.empty": "अभी तक कोई रिलीज़ उपलब्ध नहीं।",
+  "versions.emptyDescription": "किसी वातावरण पर डिप्लॉय करने से पहले पहली रिलीज़ बनाएं।",
+  "versions.emptyTitle": "अभी तक कोई रिलीज़ नहीं",
+  "versions.emptyWithCreate": "अभी तक कोई रिलीज़ नहीं। डिप्लॉय करने से पहले पहली डिप्लॉय करने योग्य रिलीज़ बनाएं।",
+  "versions.exportDsl": "DSL निर्यात करें",
+  "versions.exportDslFailed": "DSL निर्यात करने में विफल।",
+  "versions.exportingDsl": "निर्यात किया जा रहा है...",
+  "versions.groupHeader.deploy": "डिप्लॉय करें",
+  "versions.groupHeader.promote": "डिप्लॉय करें",
+  "versions.groupHeader.rollback": "पिछला संस्करण डिप्लॉय करें",
+  "versions.groupHeader.unavailable": "अनुपलब्ध",
+  "versions.manualDslOption": "DSL अपलोड करें",
+  "versions.moreActions": "अधिक क्रियाएँ",
+  "versions.optional": "वैकल्पिक",
+  "versions.promote": "डिप्लॉय करें",
+  "versions.promoteTo": "{{name}} पर डिप्लॉय करें",
+  "versions.releaseAlreadyExists": "उसी सामग्री वाली एक रिलीज़ पहले से मौजूद है: {{name}}.",
+  "versions.releaseContentCheckFailed": "रिलीज़ सामग्री जांचने में विफल।",
+  "versions.releaseDescriptionLabel": "विवरण",
+  "versions.releaseDescriptionPlaceholder": "इस रिलीज़ का वर्णन करें",
+  "versions.releaseHistory": "रिलीज़ इतिहास",
+  "versions.releaseNameLabel": "रिलीज़ नाम",
+  "versions.releaseNamePlaceholder": "रिलीज़ नाम",
+  "versions.releaseNameRequired": "एक रिलीज़ नाम दर्ज करें।",
+  "versions.releaseSourceLabel": "रिलीज़ स्रोत",
+  "versions.rollbackTo": "{{name}} पर डिप्लॉय करें",
+  "versions.saveEdit": "सहेजें",
+  "versions.sourceAppOption": "वर्कफ़्लो ऐप"
+}
diff --git a/web/i18n/hi-IN/workflow.json b/web/i18n/hi-IN/workflow.json
index 8e89f0bd212..f009a7348ad 100644
--- a/web/i18n/hi-IN/workflow.json
+++ b/web/i18n/hi-IN/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "एजेंट",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "उत्तर",
   "blocks.assigner": "चर असाइनर",
   "blocks.code": "कोड",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "वेरिएबल एग्रीगेटर",
   "blocks.variable-assigner": "वेरिएबल एग्रीगेटर",
   "blocksAbout.agent": "प्रश्नों का उत्तर देने या प्राकृतिक भाषा को संसाधित करने के लिए बड़े भाषा मॉडलों को आमंत्रित करना",
+  "blocksAbout.agent-v2": "प्रश्नों का उत्तर देने या प्राकृतिक भाषा को संसाधित करने के लिए बड़े भाषा मॉडलों को आमंत्रित करना",
   "blocksAbout.answer": "चैट संवाद के उत्तर सामग्री को परिभाषित करें",
   "blocksAbout.assigner": "चर असाइनमेंट नोड का उपयोग लिखने योग्य चर (जैसे वार्तालाप चर) को मान असाइन करने के लिए किया जाता है।",
   "blocksAbout.code": "कस्टम लॉजिक को लागू करने के लिए एक टुकड़ा Python या NodeJS कोड निष्पादित करें",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "वर्कफ़्लो ID",
   "globalVar.fieldsDescription.workflowRunId": "वर्कफ़्लो रन ID",
   "globalVar.title": "सिस्टम वेरिएबल्स",
+  "nodes.agent.advancedSetting": "उन्नत सेटिंग्स",
   "nodes.agent.checkList.strategyNotSelected": "रणनीति का चयन नहीं किया गया",
   "nodes.agent.clickToViewParameterSchema": "पैरामीटर स्कीमा देखने के लिए क्लिक करें",
   "nodes.agent.configureModel": "मॉडल कॉन्फ़िगर करें",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "असमर्थित मॉडल",
   "nodes.agent.modelSelectorTooltips.deprecated": "यह मॉडल अप्रचलित है।",
   "nodes.agent.notAuthorized": "अधिकृत नहीं",
+  "nodes.agent.outputVars.confirm": "पुष्टि करें",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "एक JSON सरणी दर्ज करें।",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "true या false दर्ज करें।",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "फ़ाइल डिफ़ॉल्ट अभी यहाँ कॉन्फ़िगर करने योग्य नहीं हैं।",
+  "nodes.agent.outputVars.defaultValueLabel": "डिफ़ॉल्ट",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "एक मान्य संख्या दर्ज करें।",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "एक JSON ऑब्जेक्ट दर्ज करें।",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "डिफ़ॉल्ट मान",
+  "nodes.agent.outputVars.delete": "{{name}} हटाएँ",
+  "nodes.agent.outputVars.descriptionLabel": "विवरण",
+  "nodes.agent.outputVars.descriptionPlaceholder": "विवरण जोड़ें",
+  "nodes.agent.outputVars.edit": "{{name}} संपादित करें",
+  "nodes.agent.outputVars.editorLabel": "आउटपुट चर संपादक",
   "nodes.agent.outputVars.files.title": "एजेंट द्वारा उत्पन्न फ़ाइलें",
   "nodes.agent.outputVars.files.transfer_method": "स्थानांतरण विधि। मान या तो remote_url है या local_file।",
   "nodes.agent.outputVars.files.type": "समर्थन प्रकार। अब केवल समर्थन छवि",
   "nodes.agent.outputVars.files.upload_file_id": "फाइल आईडी अपलोड करें",
   "nodes.agent.outputVars.files.url": "छवि यूआरएल",
   "nodes.agent.outputVars.json": "एजेंट द्वारा उत्पन्न जेसन",
+  "nodes.agent.outputVars.nameDuplicate": "आउटपुट नाम पहले से मौजूद है",
+  "nodes.agent.outputVars.nameInvalid": "अक्षर, संख्याएँ और अंडरस्कोर का उपयोग करें। अक्षर या अंडरस्कोर से शुरू करें।",
+  "nodes.agent.outputVars.nameLabel": "फ़ील्ड का नाम",
+  "nodes.agent.outputVars.namePlaceholder": "फ़ील्ड का नाम",
+  "nodes.agent.outputVars.newOutput": "नया आउटपुट",
+  "nodes.agent.outputVars.requiredLabel": "आवश्यक",
+  "nodes.agent.outputVars.showAdvancedOptions": "उन्नत विकल्प दिखाएँ",
   "nodes.agent.outputVars.text": "एजेंट द्वारा उत्पन्न सामग्री",
+  "nodes.agent.outputVars.typeLabel": "आउटपुट प्रकार",
   "nodes.agent.outputVars.usage": "मॉडल उपयोग जानकारी",
   "nodes.agent.parameterSchema": "पैरामीटर स्कीमा",
   "nodes.agent.pluginInstaller.install": "स्थापित करें",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "यह एकीकरण गिटहब से स्थापित किया गया है। कृपया पुनः स्थापित करने के लिए एकीकरण पर जाएं।",
   "nodes.agent.pluginNotInstalled": "यह एकीकरण स्थापित नहीं है",
   "nodes.agent.pluginNotInstalledDesc": "यह एकीकरण गिटहब से स्थापित किया गया है। कृपया पुनः स्थापित करने के लिए एकीकरण पर जाएं।",
+  "nodes.agent.roster.change": "बदलें",
+  "nodes.agent.roster.editInConsole": "Agent Console में संपादित करें",
+  "nodes.agent.roster.inlineSetup.description": "एक एकल सेटअप जो केवल इस नोड में रहता है",
+  "nodes.agent.roster.inlineSetup.name": "इनलाइन सेटअप",
+  "nodes.agent.roster.inlineSetup.title": "एजेंट सेटअप",
+  "nodes.agent.roster.inlineSetup.type": "केवल इस नोड में",
+  "nodes.agent.roster.label": "एजेंट",
+  "nodes.agent.roster.makeCopy": "एक प्रति बनाएँ",
+  "nodes.agent.roster.more": "अधिक एजेंट क्रियाएँ",
+  "nodes.agent.roster.openPanel": "{{name}} विवरण खोलें",
+  "nodes.agent.roster.panelLabel": "{{name}} विवरण",
   "nodes.agent.strategy.configureTip": "कृपया एजेंटिक रणनीति को कॉन्फ़िगर करें।",
   "nodes.agent.strategy.configureTipDesc": "एजेंटिक रणनीति को कॉन्फ़िगर करने के बाद, यह नोड स्वचालित रूप से शेष कॉन्फ़िगरेशन लोड करेगा। यह रणनीति बहु-चरण उपकरण तर्क के तंत्र को प्रभावित करेगी।",
   "nodes.agent.strategy.label": "एजेंटिक रणनीति",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "स्थापित एकीकरण संस्करण इस रणनीति को प्रदान नहीं करता है। संस्करण बदलने के लिए क्लिक करें।",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} स्थापित नहीं है",
   "nodes.agent.strategyNotSet": "एजेंटिक रणनीति सेट नहीं की गई",
+  "nodes.agent.task.insert": "सम्मिलित करें",
+  "nodes.agent.task.label": "एजेंट कार्य",
+  "nodes.agent.task.mention": "उल्लेख करें",
+  "nodes.agent.task.placeholder": "वर्णन करें कि यह एजेंट क्या करे...",
+  "nodes.agent.task.tooltip": "इस वर्कफ़्लो में इस एजेंट द्वारा पालन किए जाने वाले कार्य निर्देश परिभाषित करें।",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} अधिकृत नहीं है",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} स्थापित नहीं है",
   "nodes.agent.toolbox": "टूलबॉक्स",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "{{author}} द्वारा",
   "tabs.question-understand": "प्रश्न समझ",
   "tabs.requestToCommunity": "समुदाय से अनुरोध",
-  "tabs.searchBlock": "खोज नोड",
+  "tabs.searchBlock": "नोड, एजेंट, मानव, ज्ञान खोजें",
   "tabs.searchDataSource": "डेटा स्रोत की खोज करें",
   "tabs.searchSnippets": "स्निपेट खोजें...",
   "tabs.searchTool": "खोज उपकरण",
diff --git a/web/i18n/id-ID/agent-v-2.json b/web/i18n/id-ID/agent-v-2.json
new file mode 100644
index 00000000000..f2827f73016
--- /dev/null
+++ b/web/i18n/id-ID/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Tindakan ini belum tersedia.",
+  "agentDetail.access.actions.monitoring": "Pemantauan",
+  "agentDetail.access.copyAccessUrl": "Salin URL akses",
+  "agentDetail.access.copyFailed": "Gagal menyalin referensi.",
+  "agentDetail.access.copyReference": "Salin referensi untuk {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Salin endpoint API layanan",
+  "agentDetail.access.description": "Setiap permukaan tempat agen ini dapat dijangkau.",
+  "agentDetail.access.empty": "Tidak ada titik akses tertaut",
+  "agentDetail.access.emptyDescription": "Agen Roster ini belum memiliki referensi aplikasi atau alur kerja.",
+  "agentDetail.access.entries.agentApp.description": "Aplikasi agen yang ditautkan ke agen Roster ini.",
+  "agentDetail.access.entries.agentApp.name": "Aplikasi agen",
+  "agentDetail.access.entries.workflow.description": "Referensi alur kerja dan simpul yang ditautkan ke agen Roster ini.",
+  "agentDetail.access.entries.workflow.name": "Simpul alur kerja",
+  "agentDetail.access.entryCount_one": "{{count}} entri",
+  "agentDetail.access.entryCount_other": "{{count}} entri",
+  "agentDetail.access.groups.references.heading": "Referensi",
+  "agentDetail.access.groups.references.label": "Referensi tertaut",
+  "agentDetail.access.learnMore": "Pelajari lebih lanjut",
+  "agentDetail.access.moreActions": "Tindakan lainnya untuk {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Endpoint API Layanan",
+  "agentDetail.access.serviceApi.title": "API layanan backend",
+  "agentDetail.access.status.disabled": "Dinonaktifkan",
+  "agentDetail.access.status.enabled": "Diaktifkan",
+  "agentDetail.access.status.inService": "Beroperasi",
+  "agentDetail.access.status.outOfService": "Tidak beroperasi",
+  "agentDetail.access.title": "Titik Akses",
+  "agentDetail.access.toggleSurface": "Alihkan akses {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL Akses",
+  "agentDetail.access.webApp.actions.customize": "Sesuaikan",
+  "agentDetail.access.webApp.actions.embedded": "Tertanam",
+  "agentDetail.access.webApp.actions.launch": "Luncurkan",
+  "agentDetail.access.webApp.actions.settings": "Pengaturan",
+  "agentDetail.access.webApp.refreshUrl": "Segarkan URL akses",
+  "agentDetail.access.webApp.showQrCode": "Tampilkan kode QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO Diaktifkan",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "Digunakan sebagai simpul di dalam alur kerja",
+  "agentDetail.access.workflow.empty": "Belum ada referensi alur kerja.",
+  "agentDetail.access.workflow.loadFailed": "Gagal memuat referensi alur kerja.",
+  "agentDetail.access.workflow.loading": "Memuat referensi alur kerja…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} simpul",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} simpul",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Buka di Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Buka {{name}} di Studio",
+  "agentDetail.access.workflow.table.actions": "Tindakan",
+  "agentDetail.access.workflow.table.lastUpdated": "Terakhir diperbarui",
+  "agentDetail.access.workflow.table.name": "Nama",
+  "agentDetail.access.workflow.table.nodes": "Simpul",
+  "agentDetail.access.workflow.table.version": "Versi",
+  "agentDetail.access.workflow.title": "Akses alur kerja",
+  "agentDetail.configure.advancedSettings.description": "Untuk pengguna mahir. Variabel lingkungan, sandbox & memori.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Tambahkan variabel lingkungan",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Hapus {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Sembunyikan nilai {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Impor .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Untuk menampilkan file .env tersembunyi, tekan Command + Shift + . di pemilih file.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Jika file .env Anda tersembunyi, aktifkan file tersembunyi di pemilih file sistem.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Untuk menampilkan file .env tersembunyi, aktifkan Item tersembunyi di File Explorer.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Tampilkan nilai {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Pilih cakupan variabel lingkungan",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Variabel lingkungan yang tersedia untuk agen ini saat dijalankan.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Alihkan Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Pengaturan Lanjutan",
+  "agentDetail.configure.advancedSettings.toggle": "Alihkan pengaturan lanjutan",
+  "agentDetail.configure.chatFeatures.description": "Bentuk pengalaman chat pengguna akhir di Web app dan permukaan chat Anda.",
+  "agentDetail.configure.chatFeatures.title": "Fitur Chat",
+  "agentDetail.configure.files.add": "Tambahkan file",
+  "agentDetail.configure.files.empty.description": "Unggah dokumen yang dapat dibaca agen, seperti spesifikasi, templat, atau pedoman",
+  "agentDetail.configure.files.empty.title": "Belum ada file",
+  "agentDetail.configure.files.label": "File",
+  "agentDetail.configure.files.preview.empty": "Tidak ada konten pratinjau.",
+  "agentDetail.configure.files.preview.failed": "Gagal memuat pratinjau.",
+  "agentDetail.configure.files.preview.unsupported": "File ini tidak mendukung pratinjau.",
+  "agentDetail.configure.files.remove": "Hapus {{name}}",
+  "agentDetail.configure.files.tip": "File yang dapat digunakan agen ini saat mengorkestrasi tugas.",
+  "agentDetail.configure.files.toggle": "Alihkan file",
+  "agentDetail.configure.files.treeLabel": "File agen",
+  "agentDetail.configure.files.upload.action": "Unggah",
+  "agentDetail.configure.files.upload.browse": "telusuri",
+  "agentDetail.configure.files.upload.description": "Unggah file untuk agen ini.",
+  "agentDetail.configure.files.upload.dropzone": "Letakkan file di sini, atau",
+  "agentDetail.configure.files.upload.failed": "Gagal mengunggah file.",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "Unggah satu file.",
+  "agentDetail.configure.files.upload.success": "File diunggah.",
+  "agentDetail.configure.files.upload.title": "Unggah file",
+  "agentDetail.configure.knowledgeRetrieval.add": "Tambahkan pengambilan pengetahuan",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Tambahkan pengetahuan",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Klik tombol “+” untuk menambahkan pengetahuan",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Pengetahuan",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Pengaturan Pengambilan",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Pelajari lebih lanjut tentang pengambilan Pengetahuan",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Otomatis",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Kondisi",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Dinonaktifkan",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Pemfilteran Metadata",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manual",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Pilih mode pemfilteran metadata",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Nama pengambilan pengetahuan",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Agen memutuskan",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Agen menulis kuerinya sendiri dari prompt dan konteks yang tersedia. Tidak ada yang perlu diatur di sini.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Kueri kustom",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Tulis kueri tetap untuk sumber pengambilan ini.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Teks kueri kustom",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Ketik kueri pencarian",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Kueri",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Pengambilan Pengetahuan · Agen memutuskan",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Edit {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Hubungkan basis pengetahuan yang dapat dicari agen saat menjawab",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Belum ada pengetahuan",
+  "agentDetail.configure.knowledgeRetrieval.label": "Pengambilan Pengetahuan",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Hapus {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Sumber pengambilan pengetahuan yang dapat digunakan agen ini saat mengorkestrasi tugas.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Alihkan pengambilan pengetahuan",
+  "agentDetail.configure.model.label": "Model",
+  "agentDetail.configure.orchestrate": "Orkestrasi",
+  "agentDetail.configure.preview.chatFeatures": "Fitur Chat",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agen",
+  "agentDetail.configure.preview.empty.description": "Kirim pesan untuk menguji draf saat ini.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Belum ada instruksi, jadi balasan datang dari model polos.",
+  "agentDetail.configure.preview.endUserAuth": "Autentikasi pengguna akhir",
+  "agentDetail.configure.preview.restart": "Mulai ulang pratinjau",
+  "agentDetail.configure.preview.title": "Pratinjau",
+  "agentDetail.configure.prompt.copied": "Prompt disalin",
+  "agentDetail.configure.prompt.copy": "Salin prompt",
+  "agentDetail.configure.prompt.copyFailed": "Gagal menyalin prompt.",
+  "agentDetail.configure.prompt.insert.label": "Sisipkan",
+  "agentDetail.configure.prompt.insert.question": "Mulai pertanyaan",
+  "agentDetail.configure.prompt.insert.reportFile": "File laporan keluaran",
+  "agentDetail.configure.prompt.insert.tenders": "Mulai tender",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Sebut",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Tulis instruksi di sini,",
+  "agentDetail.configure.prompt.tip": "Tentukan bagaimana agen ini harus menafsirkan input, memanggil alat, dan menghasilkan output.",
+  "agentDetail.configure.publishBar.draft": "Draf",
+  "agentDetail.configure.publishBar.publishUpdate": "Terbitkan pembaruan",
+  "agentDetail.configure.publishBar.published": "Diterbitkan",
+  "agentDetail.configure.publishBar.publishedAt": "Diterbitkan {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Menerbitkan…",
+  "agentDetail.configure.publishBar.saved": "Disimpan 5 menit lalu",
+  "agentDetail.configure.publishBar.savedAt": "Disimpan {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Perubahan belum diterbitkan",
+  "agentDetail.configure.publishBar.upToDate": "Terbaru",
+  "agentDetail.configure.publishBar.versionHistory": "Buka riwayat versi",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Alur Kerja yang Terpengaruh",
+  "agentDetail.configure.publishImpact.cancel": "Batal",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Agen Anda muncul di",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Perubahan akan memengaruhi mereka.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "agen ini",
+  "agentDetail.configure.publishImpact.title": "{{action}} ke {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} alur kerja",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} alur kerja",
+  "agentDetail.configure.skills.add": "Tambahkan keterampilan",
+  "agentDetail.configure.skills.detail.contentRegion": "Konten detail keterampilan",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} FILE",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "File keterampilan",
+  "agentDetail.configure.skills.detail.files": "File",
+  "agentDetail.configure.skills.empty.description": "Keterampilan memberi agen keahlian yang dapat digunakan kembali yang bisa dipanggil saat bekerja",
+  "agentDetail.configure.skills.empty.title": "Belum ada keterampilan",
+  "agentDetail.configure.skills.itemType": "Keterampilan",
+  "agentDetail.configure.skills.label": "Keterampilan",
+  "agentDetail.configure.skills.remove": "Hapus {{name}}",
+  "agentDetail.configure.skills.tip": "Keterampilan yang dapat digunakan agen ini saat mengorkestrasi tugas.",
+  "agentDetail.configure.skills.toggle": "Alihkan keterampilan",
+  "agentDetail.configure.skills.upload.action": "Unggah",
+  "agentDetail.configure.skills.upload.browse": "telusuri",
+  "agentDetail.configure.skills.upload.description": "Unggah paket .zip atau .skill untuk agen ini.",
+  "agentDetail.configure.skills.upload.dropzone": "Letakkan paket keterampilan di sini, atau",
+  "agentDetail.configure.skills.upload.failed": "Gagal mengunggah keterampilan.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Unggah file .zip atau .skill.",
+  "agentDetail.configure.skills.upload.success": "Keterampilan diunggah.",
+  "agentDetail.configure.skills.upload.title": "Unggah keterampilan",
+  "agentDetail.configure.tools.add": "Tambahkan alat",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Untuk pengembang",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Pasang program command line yang dijalankan agen di sandbox-nya. Memerlukan instalasi dan biasanya API Key.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Alat CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Pilih alat yang sudah ada di ruang kerja ini, seperti pencarian web atau integrasi.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Alat",
+  "agentDetail.configure.tools.cliDialog.description": "Pasang alat CLI dari registry paket mana pun. Agen mendapatkan akses shell ke binary yang disediakannya.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Edit Alat CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Simpan API Key, token, atau rahasia yang dibutuhkan alat CLI ini. Nilai dienkripsi saat disimpan dan diinjeksikan sebagai variabel lingkungan saat agen memanggil alat.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Variabel Lingkungan",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(opsional)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Sandbox · berjalan sekali pada pemanggilan pertama",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Perintah Instalasi",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Tempel perintah instalasi Anda di sini, misalnya npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Perintah instalasi diperlukan.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Pelajari lebih lanjut tentang Alat CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Nama Alat CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Beri nama alat CLI Anda",
+  "agentDetail.configure.tools.cliDialog.name.required": "Nama alat CLI diperlukan.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Tidak pernah terlihat oleh prompt agen; hanya diinjeksikan sebagai $VAR saat dijalankan",
+  "agentDetail.configure.tools.cliDialog.title": "Tambahkan Alat CLI",
+  "agentDetail.configure.tools.cliTool": "Alat CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Pengguna akhir · OAuth",
+  "agentDetail.configure.tools.editAction": "Edit {{name}}",
+  "agentDetail.configure.tools.empty.description": "Alat memungkinkan agen bertindak, seperti mencari di web atau memanggil aplikasi Anda",
+  "agentDetail.configure.tools.empty.title": "Belum ada alat",
+  "agentDetail.configure.tools.label": "Alat",
+  "agentDetail.configure.tools.moreActions": "Tindakan lainnya untuk {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Otorisasi sebelumnya",
+  "agentDetail.configure.tools.removeAction": "Hapus {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Hapus semua alat",
+  "agentDetail.configure.tools.tip": "Alat yang dapat dipanggil agen ini saat mengorkestrasi tugas.",
+  "agentDetail.configure.tools.toggle": "Alihkan alat",
+  "agentDetail.configure.tools.toolTabs.all": "Semua",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Kustom",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugin",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agen",
+  "agentDetail.history": "Riwayat",
+  "agentDetail.logs.description": "Log lengkap mencatat status berjalan aplikasi, termasuk input pengguna, balasan agen, perencanaan, dan penggunaan alat.",
+  "agentDetail.logs.empty": "Tidak ada log ditemukan",
+  "agentDetail.logs.filters.period.allTime": "Sepanjang waktu",
+  "agentDetail.logs.filters.period.label": "Periode log",
+  "agentDetail.logs.filters.period.last30days": "30 hari terakhir",
+  "agentDetail.logs.filters.period.last7days": "7 hari terakhir",
+  "agentDetail.logs.filters.search.label": "Cari log",
+  "agentDetail.logs.filters.search.placeholder": "Cari",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Waktu dibuat terakhir",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Waktu diperbarui terakhir",
+  "agentDetail.logs.filters.source.all": "Sumber",
+  "agentDetail.logs.filters.source.empty": "Tidak ada sumber ditemukan",
+  "agentDetail.logs.filters.source.label": "Sumber log",
+  "agentDetail.logs.filters.source.loadFailed": "Gagal memuat sumber",
+  "agentDetail.logs.filters.source.loading": "Memuat sumber…",
+  "agentDetail.logs.filters.source.searchLabel": "Cari sumber",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Cari",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Alur kerja",
+  "agentDetail.logs.learnMore": "Pelajari lebih lanjut",
+  "agentDetail.logs.loadFailed": "Gagal memuat log",
+  "agentDetail.logs.loading": "Memuat log…",
+  "agentDetail.logs.notAvailable": "Tidak tersedia",
+  "agentDetail.logs.table.createdTime": "Waktu Dibuat",
+  "agentDetail.logs.table.endUser": "Pengguna akhir",
+  "agentDetail.logs.table.messageCount": "Jumlah Pesan",
+  "agentDetail.logs.table.operationRate": "Tingkat Operasi",
+  "agentDetail.logs.table.source": "Sumber",
+  "agentDetail.logs.table.title": "Judul",
+  "agentDetail.logs.table.unread": "Belum dibaca",
+  "agentDetail.logs.table.updatedTime": "Waktu Diperbarui",
+  "agentDetail.logs.table.userRate": "Tingkat Pengguna",
+  "agentDetail.logs.title": "Log",
+  "agentDetail.memorySettings.budgetLabel": "Anggaran Memori",
+  "agentDetail.memorySettings.description": "Pengaturan memori dari snapshot konfigurasi aktif.",
+  "agentDetail.memorySettings.export.description": "Ekspor memori direncanakan untuk rilis berikutnya.",
+  "agentDetail.memorySettings.export.download": "Unduh",
+  "agentDetail.memorySettings.export.soon": "Segera",
+  "agentDetail.memorySettings.export.title": "Ekspor memori saat ini",
+  "agentDetail.memorySettings.notConfigured": "Belum dikonfigurasi",
+  "agentDetail.memorySettings.scopeLabel": "Cakupan Memori",
+  "agentDetail.memorySettings.title": "Memori",
+  "agentDetail.metadata.activeVersionLabel": "Versi Aktif",
+  "agentDetail.metadata.appIdLabel": "ID Aplikasi",
+  "agentDetail.metadata.description": "Field Roster hanya-baca yang dikembalikan oleh backend agen.",
+  "agentDetail.metadata.emptyValue": "Tidak tersedia",
+  "agentDetail.metadata.scopeLabel": "Cakupan",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Hanya alur kerja",
+  "agentDetail.metadata.sourceLabel": "Sumber",
+  "agentDetail.metadata.statusLabel": "Status",
+  "agentDetail.metadata.title": "Metadata",
+  "agentDetail.metadata.updatedAtLabel": "Diperbarui Pada",
+  "agentDetail.metadata.workflowIdLabel": "ID Alur Kerja",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID Simpul Alur Kerja",
+  "agentDetail.monitoring.change": "{{value}} dari periode sebelumnya",
+  "agentDetail.monitoring.dateRangeLabel": "Rentang tanggal",
+  "agentDetail.monitoring.description": "Lacak aktivitas, biaya, dan kualitas interaksi agen yang dapat digunakan kembali di seluruh alur kerja.",
+  "agentDetail.monitoring.learnMore": "Pelajari lebih lanjut",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Pengguna akhir unik yang memicu alur kerja menggunakan agen ini.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Pengguna Aktif",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Hitungan komunikasi pengguna-agen yang berkelanjutan untuk titik akses ini.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Rata-rata Interaksi Sesi",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Kecepatan output rata-rata dari awal permintaan hingga selesai.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Kecepatan Output Token",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Perkiraan biaya token yang dihasilkan oleh agen ini di seluruh eksekusi alur kerja.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Penggunaan Token",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Percakapan AI harian yang mencapai agen ini melalui titik akses yang dipilih.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Total Percakapan",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Hitungan interaksi agen harian.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Total Pesan",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Jumlah suka per 1.000 pesan untuk agen ini.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Tingkat Kepuasan Pengguna",
+  "agentDetail.monitoring.pickSource": "Pilih aplikasi",
+  "agentDetail.monitoring.sourceLabel": "Aplikasi",
+  "agentDetail.monitoring.sourceTrigger": "Sumber {{name}}",
+  "agentDetail.monitoring.sources.all": "Semua",
+  "agentDetail.monitoring.timeRangeLabel": "Rentang waktu",
+  "agentDetail.monitoring.timeRanges.custom": "Kustom",
+  "agentDetail.monitoring.timeRanges.last30days": "30 hari terakhir",
+  "agentDetail.monitoring.timeRanges.last7days": "7 hari terakhir",
+  "agentDetail.monitoring.timeRanges.today": "Hari ini",
+  "agentDetail.monitoring.title": "Pemantauan",
+  "agentDetail.monitoring.tokenUsageConsumed": "Token terpakai",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/dtk",
+  "agentDetail.navigationLabel": "Navigasi agen",
+  "agentDetail.publish": "Terbitkan",
+  "agentDetail.publishSoon": "Segera",
+  "agentDetail.sections.access": "Titik Akses",
+  "agentDetail.sections.configure": "Orkestrasi",
+  "agentDetail.sections.logs": "Log",
+  "agentDetail.sections.monitoring": "Pemantauan",
+  "agentDetail.subtitle": "ID Agen: {{agentId}}",
+  "agentDetail.title": "Agen",
+  "agentDetail.type": "AGEN",
+  "agentDetail.versionHistory.active": "Aktif",
+  "agentDetail.versionHistory.empty": "Belum ada versi",
+  "agentDetail.versionHistory.filter": "Filter versi",
+  "agentDetail.versionHistory.versionName": "Versi {{version}}",
+  "roster.createAgent": "Buat agen",
+  "roster.createAgentOptions": "Opsi buat agen",
+  "roster.createDialog.description": "Buat agen yang dapat digunakan kembali di Roster ruang kerja ini.",
+  "roster.createDialog.title": "Buat agen",
+  "roster.createForm.changeIcon": "Ubah ikon agen",
+  "roster.createForm.descriptionLabel": "Deskripsi",
+  "roster.createForm.descriptionOptional": "(opsional)",
+  "roster.createForm.descriptionPlaceholder": "mis. Mengumpulkan sumber tentang suatu topik dan merangkum temuan utama",
+  "roster.createForm.nameLabel": "Nama",
+  "roster.createForm.namePlaceholder": "mis. Max",
+  "roster.createForm.nameRequired": "Nama diperlukan.",
+  "roster.createForm.roleLabel": "Peran",
+  "roster.createForm.rolePlaceholder": "mis. Asisten Riset",
+  "roster.createForm.roleRequired": "Peran diperlukan.",
+  "roster.createSuccess": "Agen dibuat.",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Agen ini akan dihapus dari daftar Roster aktif.",
+  "roster.deleteDialog.title": "Hapus {{name}}?",
+  "roster.deleteFailed": "Gagal menghapus agen.",
+  "roster.deleteSuccess": "Agen dihapus.",
+  "roster.duplicateFailed": "Gagal menduplikasi agen.",
+  "roster.duplicateSuccess": "Agen diduplikasi.",
+  "roster.editAgent": "Edit {{name}}",
+  "roster.editDialog.description": "Perbarui nama, deskripsi, dan peran Roster untuk agen ini.",
+  "roster.editDialog.title": "Edit agen",
+  "roster.editInfo": "Edit Info",
+  "roster.empty": "Belum ada agen",
+  "roster.emptyDescription": "Agen yang disimpan di ruang kerja ini akan muncul di sini.",
+  "roster.emptySearch": "Tidak ada agen yang cocok",
+  "roster.emptySearchDescription": "Coba nama agen lain.",
+  "roster.filters.all": "Semua",
+  "roster.filters.drafts": "Draf",
+  "roster.filters.label": "Filter agen",
+  "roster.filters.published": "Diterbitkan",
+  "roster.learnMore": "Pelajari lebih lanjut tentang Agent Roster",
+  "roster.listLabel": "Daftar Roster agen",
+  "roster.loadMore": "Muat lebih banyak",
+  "roster.loadingError": "Gagal memuat agen. Segarkan dan coba lagi.",
+  "roster.moreActions": "Tindakan lainnya untuk {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Gagal membuat agen inline. Segarkan dan coba lagi.",
+  "roster.nodeSelector.dialogLabel": "Pilih agen",
+  "roster.nodeSelector.manageInAgentConsole": "Kelola di Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Cari…",
+  "roster.nodeSelector.startFromScratch": "Mulai dari Awal",
+  "roster.references.label": "Alur kerja yang menggunakan {{name}}",
+  "roster.references.trigger": "Alur kerja yang menggunakan {{name}}",
+  "roster.searchLabel": "Cari agen",
+  "roster.searchPlaceholder": "Cari agen berdasarkan nama…",
+  "roster.sources.agent_app": "Aplikasi agen",
+  "roster.sources.imported": "Diimpor",
+  "roster.sources.system": "Sistem",
+  "roster.sources.workflow": "Alur kerja",
+  "roster.status.active": "Aktif",
+  "roster.status.archived": "Diarsipkan",
+  "roster.tabs.agent": "Agen",
+  "roster.tabs.human": "Manusia",
+  "roster.tabsLabel": "Tipe Roster",
+  "roster.updateSuccess": "Agen diperbarui.",
+  "roster.usageStatus.draft": "Draf"
+}
diff --git a/web/i18n/id-ID/app-log.json b/web/i18n/id-ID/app-log.json
index 529b2e3f46c..aaddb004549 100644
--- a/web/i18n/id-ID/app-log.json
+++ b/web/i18n/id-ID/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Hari Ini",
   "filter.period.yearToDate": "Tahun hingga saat ini",
   "filter.sortBy": "Urutkan berdasarkan",
+  "monitoring.description": "Monitoring mencatat status berjalan aplikasi, termasuk performa, aktivitas pengguna, dan biaya.",
   "promptLog": "Prompt Log",
   "runDetail.fileListDetail": "Detail",
   "runDetail.fileListLabel": "Rincian File",
diff --git a/web/i18n/id-ID/app.json b/web/i18n/id-ID/app.json
index 64582d2c18a..f1a27e2f9c1 100644
--- a/web/i18n/id-ID/app.json
+++ b/web/i18n/id-ID/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "Output Terstruktur adalah fitur yang memastikan model akan selalu menghasilkan respons yang mematuhi Skema JSON yang Anda sediakan",
   "studio.allApps": "Semua Aplikasi",
   "studio.apps": "Aplikasi",
-  "studio.filters.allCreators": "Semua pencipta",
-  "studio.filters.creators": "Pencipta",
+  "studio.filters.allCreators": "Semua pembuat",
+  "studio.filters.creators": "Pembuat",
   "studio.filters.reset": "Setel ulang",
   "studio.filters.searchCreators": "Penelusuran pencipta...",
   "studio.filters.types": "Jenis",
diff --git a/web/i18n/id-ID/billing.json b/web/i18n/id-ID/billing.json
index f0bdacd63fd..f0b2b4a27a7 100644
--- a/web/i18n/id-ID/billing.json
+++ b/web/i18n/id-ID/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Tingkatkan untuk membuka unggahan dokumen batch",
   "upgrade.uploadMultiplePages.description": "Anda telah mencapai batas unggah — hanya satu dokumen yang dapat dipilih dan diunggah sekaligus dengan paket Anda saat ini.",
   "upgrade.uploadMultiplePages.title": "Tingkatkan untuk mengunggah beberapa dokumen sekaligus",
+  "upgrade.workflowRestore.description": "Pemulihan versi workflow tidak tersedia di paket Anda saat ini.",
+  "upgrade.workflowRestore.title": "Tingkatkan untuk memulihkan versi workflow",
   "upgradeBtn.encourage": "Tingkatkan Sekarang",
   "upgradeBtn.encourageShort": "Upgrade",
   "upgradeBtn.plain": "Lihat Paket",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index d5aa93906af..c11b0233b8f 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Ganti workspace",
   "mcpPage.description": "Hubungkan dan kelola server MCP agar aplikasi Anda dapat mengakses alat dan layanan eksternal.",
-  "members.admin": "Admin",
   "members.adminTip": "Dapat membangun aplikasi & mengelola pengaturan tim",
+  "members.alreadyInTeam": "Sudah ada di tim",
+  "members.alreadyInTeamTip": "Pengguna ini sudah memiliki akses ke ruang kerja ini.",
   "members.builder": "Pembangun",
   "members.builderTip": "Dapat membangun & mengedit aplikasi sendiri",
-  "members.datasetOperator": "Admin Pengetahuan",
   "members.datasetOperatorTip": "Hanya dapat mengelola basis pengetahuan",
   "members.deleteMember": "Hapus Anggota",
   "members.disInvite": "Batalkan undangan",
-  "members.editor": "Editor",
   "members.editorTip": "Dapat membangun & mengedit aplikasi",
   "members.email": "Email",
   "members.emailInvalid": "Format Email Tidak Valid",
@@ -270,13 +269,12 @@
   "members.invite": "Tambah",
   "members.inviteTeamMember": "Tambahkan anggota tim",
   "members.inviteTeamMemberTip": "Mereka dapat mengakses data tim Anda langsung setelah masuk.",
-  "members.invitedAsRole": "Diundang sebagai pengguna {{role}}",
+  "members.invitedAsRole": "Diundang sebagai {{role}}",
   "members.lastActive": "TERAKHIR AKTIF",
   "members.name": "NAMA",
-  "members.normal": "Biasa",
+  "members.noNewInvitationsSent": "Tidak ada undangan baru yang dikirim",
   "members.normalTip": "Hanya dapat menggunakan aplikasi, tidak dapat membuat aplikasi",
   "members.ok": "OKE",
-  "members.owner": "Pemilik",
   "members.pending": "Tertunda...",
   "members.removeFromTeam": "Hapus dari tim",
   "members.removeFromTeamTip": "Akan menghapus akses tim",
@@ -311,12 +309,14 @@
   "menus.apps": "Aplikasi",
   "menus.datasets": "Pengetahuan",
   "menus.datasetsTips": "SEGERA HADIR: Impor data teks Anda sendiri atau tulis data secara real-time melalui Webhook untuk peningkatan konteks LLM.",
+  "menus.deployments": "Penerapan",
   "menus.explore": "Menjelajahi",
   "menus.exploreMarketplace": "Jelajahi Marketplace",
   "menus.newApp": "Aplikasi Baru",
   "menus.newDataset": "Ciptakan Pengetahuan",
   "menus.plugins": "Integrasi",
   "menus.pluginsTips": "Integrasikan integrasi pihak ketiga atau buat AI-Integrasi yang kompatibel dengan ChatGPT.",
+  "menus.roster": "Daftar Agen",
   "menus.status": "beta",
   "menus.tools": "Perkakas",
   "model.addMoreModel": "Buka pengaturan untuk menambahkan lebih banyak model",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Model Teks-ke-Ucapan",
   "modelProvider.ttsModel.tip": "Atur model default untuk input teks-ke-ucapan dalam percakapan.",
   "modelProvider.upgradeForLoadBalancing": "Tingkatkan paket Anda untuk mengaktifkan Penyeimbangan Beban.",
+  "navigation.skipToMain": "Lewati ke konten utama",
   "noData": "Tidak ada data",
   "operation.add": "Tambah",
   "operation.added": "Ditambahkan",
@@ -600,9 +601,6 @@
   "placeholder.input": "Silakan masuk",
   "placeholder.search": "Cari...",
   "placeholder.select": "Silakan pilih",
-  "plugin.serpapi.apiKey": "Kunci API",
-  "plugin.serpapi.apiKeyPlaceholder": "Masukkan kunci API Anda",
-  "plugin.serpapi.keyFrom": "Dapatkan kunci SerpAPI Anda dari Halaman Akun SerpAPI",
   "promptEditor.context.item.desc": "Sisipkan templat konteks",
   "promptEditor.context.item.title": "Konteks",
   "promptEditor.context.modal.add": "Tambahkan Konteks",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
new file mode 100644
index 00000000000..068c3f9b031
--- /dev/null
+++ b/web/i18n/id-ID/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API layanan backend",
+  "access.api.copyCurlExample": "Salin contoh cURL",
+  "access.api.createFailed": "Gagal membuat API Token.",
+  "access.api.createKey": "Buat API Token",
+  "access.api.createKeyTitle": "Buat API Token baru",
+  "access.api.curlExampleTitle": "Contoh cURL",
+  "access.api.description": "Akses penerapan ini melalui HTTP. Setiap API Token dibatasi pada satu lingkungan.",
+  "access.api.developerTitle": "API Developer",
+  "access.api.disabled": "Akses API dimatikan untuk penerapan ini.",
+  "access.api.disabledHint": "Aktifkan akses API untuk membuat token yang dibatasi per lingkungan.",
+  "access.api.dismissToken": "Tutup API Token",
+  "access.api.docs": "Dokumentasi API",
+  "access.api.docsClose": "Tutup dokumentasi API",
+  "access.api.docsDescription": "Lihat referensi API Workflow untuk penerapan ini.",
+  "access.api.docsTitle": "Dokumentasi API Workflow",
+  "access.api.empty": "Terapkan ke lingkungan terlebih dahulu untuk mulai menerbitkan API Token.",
+  "access.api.emptyTitle": "Tidak ada lingkungan yang diterapkan",
+  "access.api.endpoint": "URL Permintaan",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Daftar API Token",
+  "access.api.nameLabel": "Nama API Token",
+  "access.api.namePlaceholder": "Masukkan nama API Token",
+  "access.api.nameRequired": "Nama API Token wajib diisi.",
+  "access.api.newKey": "Buat API Token Baru",
+  "access.api.newTokenDescription": "API Token ini hanya ditampilkan sekali. Salin sebelum meninggalkan halaman ini.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token berhasil dibuat",
+  "access.api.noKeys": "Belum ada API Token. Buat satu untuk mulai memanggil API.",
+  "access.api.noKeysTitle": "Belum ada API Token",
+  "access.api.revokeConfirmDescription": "API Token \"{{name}}\" akan segera berhenti berfungsi. Tindakan ini tidak dapat dibatalkan.",
+  "access.api.revokeConfirmTitle": "Cabut API Token?",
+  "access.api.revokeFailed": "Gagal mencabut API Token.",
+  "access.api.revokeSuccess": "API Token dicabut",
+  "access.api.table.action": "Aksi",
+  "access.api.table.environment": "Lingkungan",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Nama",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Saluran",
+  "access.channels.col.endpoint": "Titik masuk",
+  "access.channels.col.status": "Status",
+  "access.channels.description": "Titik masuk WebApp dan CLI menggunakan izin akses di atas.",
+  "access.channels.disabled": "Saluran akses dimatikan untuk penerapan ini.",
+  "access.channels.disabledHint": "Aktifkan saluran akses untuk menampilkan titik masuk WebApp dan CLI.",
+  "access.channels.followPermission": "Mengikuti izin",
+  "access.channels.title": "Saluran akses",
+  "access.cli.description": "Panggil dari terminal dengan difyctl, cocok untuk skrip, alur kerja otomatis, atau integrasi Agent.",
+  "access.cli.docs": "Panduan penggunaan",
+  "access.cli.domain": "Domain",
+  "access.cli.empty": "Endpoint CLI belum dikonfigurasi.",
+  "access.cli.install": "Instal CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Tersalin",
+  "access.copy": "Salin",
+  "access.copyFailed": "Gagal menyalin",
+  "access.copyToast": "Disalin ke clipboard",
+  "access.hide": "Sembunyikan",
+  "access.members.clearAll": "Hapus semua",
+  "access.members.empty": "Tidak ada hasil ditemukan.",
+  "access.members.groupCount_one": "{{count}} grup",
+  "access.members.groupCount_other": "{{count}} grup",
+  "access.members.groups": "Grup",
+  "access.members.individuals": "Anggota",
+  "access.members.memberCount_one": "{{count}} anggota",
+  "access.members.memberCount_other": "{{count}} anggota",
+  "access.members.pickPlaceholder": "Pilih grup atau anggota",
+  "access.members.searchPlaceholder": "Cari grup dan anggota",
+  "access.members.selectedLabel": "Dipilih",
+  "access.permission.anyone": "Siapa saja dengan tautan",
+  "access.permission.anyoneDesc": "Siapa saja dapat mengakses penerapan ini tanpa login.",
+  "access.permission.memberCount_one": "{{count}} anggota",
+  "access.permission.memberCount_other": "{{count}} anggota",
+  "access.permission.organization": "Semua anggota dalam platform",
+  "access.permission.organizationDesc": "Semua anggota dalam platform",
+  "access.permission.specific": "Anggota tertentu dalam platform",
+  "access.permission.specificDesc": "Pilih grup atau anggota tertentu",
+  "access.permission.specificUnavailable": "Pemilihan anggota tertentu dinonaktifkan sampai anggota dan grup platform nyata terhubung.",
+  "access.permission.updateFailed": "Gagal memperbarui kebijakan akses.",
+  "access.permissions.col.environment": "Lingkungan",
+  "access.permissions.col.permission": "Akses",
+  "access.permissions.description": "Atur izin akses untuk titik masuk WebApp dan CLI di setiap lingkungan.",
+  "access.permissions.editAriaLabel": "Konfigurasikan akses untuk {{environment}}",
+  "access.permissions.editDescription": "Atur izin akses untuk titik masuk WebApp dan CLI.",
+  "access.permissions.editTitle": "Izin akses",
+  "access.permissions.title": "Izin akses",
+  "access.revoke": "Cabut",
+  "access.runAccess.description": "Kelola bagaimana pengguna dapat menjalankan penerapan ini dan siapa yang diizinkan mengaksesnya per lingkungan.",
+  "access.runAccess.disabled": "Akses jalankan dimatikan untuk penerapan ini.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Ekspos penerapan ini sebagai server Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Endpoint MCP belum dikonfigurasi.",
+  "access.runAccess.noEnvs": "Terapkan ke lingkungan untuk mengonfigurasi izin akses.",
+  "access.runAccess.noEnvsTitle": "Tidak ada lingkungan yang diterapkan",
+  "access.runAccess.openWebapp": "Buka WebApp",
+  "access.runAccess.permissions": "Izin akses",
+  "access.runAccess.permissionsDesc": "Siapa yang dapat mengakses penerapan ini di setiap lingkungan.",
+  "access.runAccess.title": "Akses jalankan",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Halaman web yang dihosting untuk pengguna akhir.",
+  "access.runAccess.webappEmpty": "Segera hadir.",
+  "access.show": "Tampilkan",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Eksternal",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Tidak diketahui",
+  "card.access.api": "API Tokens",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Tidak ada akses",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Buat Rilis Pertama",
+  "card.deploy": "Terapkan",
+  "card.deploying": "{{count}} sedang diterapkan",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} gagal",
+  "card.fromApp": "Dari {{name}}",
+  "card.lastDeployed": "Terakhir diterapkan {{time}}",
+  "card.menu.delete": "Hapus penerapan",
+  "card.menu.deleteDisabled": "Penghapusan penerapan belum tersedia untuk penerapan yang dikelola backend.",
+  "card.menu.deploy": "Terapkan ke Lingkungan",
+  "card.menu.editInfo": "Edit Info",
+  "card.menu.viewDetail": "Lihat detail penerapan",
+  "card.moreActions": "Aksi lainnya",
+  "card.neverDeployed": "Belum diterapkan",
+  "card.noDescription": "Tidak ada deskripsi.",
+  "card.notDeployed": "Belum diterapkan",
+  "card.ready": "{{count}} berjalan",
+  "card.tooltip.createdAt": "Dibuat",
+  "card.tooltip.deployed": "Diterapkan",
+  "card.tooltip.deploymentStatus": "Penerapan",
+  "card.tooltip.notDeployed": "Penerapan ini belum diterapkan ke lingkungan manapun.",
+  "card.tooltip.notDeployedShort": "Belum diterapkan",
+  "card.tooltip.release": "Rilis",
+  "card.tooltip.releaseName": "Nama Rilis",
+  "card.tooltip.source": "Sumber",
+  "common.loadFailed": "Gagal memuat. Coba lagi nanti.",
+  "common.loading": "Memuat...",
+  "createGuide.actions.back": "Kembali",
+  "createGuide.actions.cancel": "Batal",
+  "createGuide.actions.continue": "Lanjutkan",
+  "createGuide.actions.createAndDeploy": "Buat & Terapkan",
+  "createGuide.actions.creating": "Membuat...",
+  "createGuide.actions.deploy": "Terapkan",
+  "createGuide.actions.deploying": "Membuat & menerapkan...",
+  "createGuide.actions.next": "Selanjutnya",
+  "createGuide.actions.skipDeploy": "Lewati, terapkan nanti",
+  "createGuide.description": "Buat penerapan dari sumber rilis, info dasar, dan lingkungan target.",
+  "createGuide.dsl.defaultAppName": "Aplikasi DSL yang diimpor",
+  "createGuide.dsl.description": "Unggah paket DSL Workflow untuk membuat penerapan, rilis pertama, dan penerapan lingkungan opsional.",
+  "createGuide.dsl.dropDescription": "Unggah paket YAML DSL Workflow. Opsi penerapan diselesaikan dari file ini sebelum penerapan.",
+  "createGuide.dsl.dropTitle": "Unggah paket DSL Workflow",
+  "createGuide.dsl.readFailed": "Gagal membaca file DSL. Pilih file lain dan coba lagi.",
+  "createGuide.dsl.reading": "Membaca file DSL...",
+  "createGuide.dsl.title": "Impor DSL",
+  "createGuide.dsl.unsupportedMode": "Hanya file DSL Workflow yang dapat digunakan untuk penerapan.",
+  "createGuide.errors.createReleaseFailed": "Gagal membuat penerapan atau rilis.",
+  "createGuide.errors.deployFailed": "Gagal menerapkan ke lingkungan.",
+  "createGuide.method.description": "Pilih sumber yang digunakan untuk membuat rilis pertama.",
+  "createGuide.methods.bindApp.description": "Gunakan Aplikasi Workflow yang ada di Studio sebagai sumber rilis.",
+  "createGuide.methods.bindApp.title": "Hubungkan Aplikasi Workflow yang ada",
+  "createGuide.methods.importDsl.description": "Unggah paket YAML DSL Workflow dan lanjutkan melalui UI penerapan.",
+  "createGuide.methods.importDsl.title": "Impor DSL",
+  "createGuide.methods.mocked": "Tiruan",
+  "createGuide.nav.back": "Penerapan",
+  "createGuide.release.defaultName": "rilis awal",
+  "createGuide.release.deployInfo": "Info Penerapan",
+  "createGuide.release.description": "Isi info penerapan dan detail rilis pertama.",
+  "createGuide.release.firstVersion": "Rilis Pertama",
+  "createGuide.release.instanceDescription": "Deskripsi Penerapan",
+  "createGuide.release.instanceDescriptionPlaceholder": "Jelaskan untuk apa penerapan ini digunakan",
+  "createGuide.release.instanceName": "Nama Penerapan",
+  "createGuide.release.instanceNameConflict": "Penerapan dengan nama ini sudah ada. Pilih nama lain.",
+  "createGuide.release.releaseDescription": "Deskripsi Rilis",
+  "createGuide.release.releaseDescriptionPlaceholder": "Jelaskan rilis ini",
+  "createGuide.release.releaseName": "Nama Rilis",
+  "createGuide.release.releaseNote": "Deskripsi Rilis",
+  "createGuide.release.title": "Info Dasar",
+  "createGuide.source.availableApps_one": "{{count}} aplikasi",
+  "createGuide.source.availableApps_other": "{{count}} aplikasi",
+  "createGuide.source.clearSearch": "Hapus pencarian aplikasi",
+  "createGuide.source.description": "Pilih sumber yang digunakan untuk membuat rilis pertama.",
+  "createGuide.source.empty": "Tidak ditemukan Aplikasi Workflow.",
+  "createGuide.source.searchPlaceholder": "Cari aplikasi",
+  "createGuide.source.sourceApp": "Aplikasi Workflow",
+  "createGuide.source.title": "Sumber Rilis",
+  "createGuide.steps.method": "Sumber Rilis",
+  "createGuide.steps.release": "Info Dasar",
+  "createGuide.steps.source": "Sumber Rilis",
+  "createGuide.steps.target": "Terapkan ke Lingkungan",
+  "createGuide.target.bindingCount_one": "{{count}} pengikatan",
+  "createGuide.target.bindingCount_other": "{{count}} pengikatan",
+  "createGuide.target.bindingHint": "Pilih kredensial yang digunakan oleh rilis ini.",
+  "createGuide.target.bindings": "Kredensial",
+  "createGuide.target.deferredBindingHint": "Kredensial akan diselesaikan dari rencana penerapan nyata selama aksi penerapan akhir.",
+  "createGuide.target.deferredEnvironmentHint": "Nama dicocokkan dengan lingkungan nyata setelah penerapan dan rilis dibuat.",
+  "createGuide.target.description": "Pilih lingkungan target dan berikan pengaturan runtime yang dibutuhkan rilis ini di sana. Langkah ini dapat dilewati.",
+  "createGuide.target.envVarCount_one": "{{count}} variabel",
+  "createGuide.target.envVarCount_other": "{{count}} variabel",
+  "createGuide.target.envVarHint": "Untuk setiap variabel lingkungan yang dibutuhkan rilis ini, masukkan nilai kustom atau gunakan nilai yang didefinisikan dalam aplikasi.",
+  "createGuide.target.envVarPlaceholder": "Masukkan nilai",
+  "createGuide.target.envVarSource.ariaLabel": "Pilih sumber nilai variabel untuk {{key}}",
+  "createGuide.target.envVarSource.default": "Nilai aplikasi",
+  "createGuide.target.envVarSource.lastDeployment": "Nilai terakhir diterapkan",
+  "createGuide.target.envVarSource.literal": "Nilai kustom",
+  "createGuide.target.envVarType.number": "Angka",
+  "createGuide.target.envVarType.secret": "Rahasia",
+  "createGuide.target.envVarType.string": "String",
+  "createGuide.target.envVars": "Variabel Lingkungan",
+  "createGuide.target.environment": "Lingkungan Target",
+  "createGuide.target.environmentName": "Nama Lingkungan",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "Gagal memuat kredensial.",
+  "createGuide.target.loadEnvironmentsFailed": "Gagal memuat lingkungan penerapan.",
+  "createGuide.target.missingRequiredBinding": "Pilih kredensial untuk pengikatan yang wajib ini.",
+  "createGuide.target.noBindingRequired": "Tidak ada kredensial yang diperlukan.",
+  "createGuide.target.noCredentialCandidates": "Tidak ada kredensial yang tersedia.",
+  "createGuide.target.noEnvironmentOptions": "Tidak ada lingkungan penerapan yang tersedia.",
+  "createGuide.target.required": "Wajib",
+  "createGuide.target.selectCredential": "Pilih kredensial",
+  "createGuide.target.title": "Terapkan ke Lingkungan",
+  "createGuide.title": "Penerapan Baru",
+  "createModal.appPickerPlaceholder": "Pilih Aplikasi Workflow",
+  "createModal.appSearchEmpty": "Tidak ada Aplikasi Workflow yang cocok",
+  "createModal.appSearchPlaceholder": "Cari Aplikasi Workflow…",
+  "createModal.cancel": "Batal",
+  "createModal.create": "Buat",
+  "createModal.createFailed": "Gagal membuat penerapan.",
+  "createModal.description": "Pilih Aplikasi Workflow dan buat penerapan.",
+  "createModal.descriptionLabel": "Deskripsi",
+  "createModal.descriptionPlaceholder": "Jelaskan untuk apa penerapan ini digunakan",
+  "createModal.loadMoreApps": "Muat lebih banyak aplikasi",
+  "createModal.loadingApps": "Memuat aplikasi…",
+  "createModal.nameLabel": "Nama Penerapan",
+  "createModal.namePlaceholder": "Nama Penerapan",
+  "createModal.noApps": "Tidak ditemukan Aplikasi Workflow di workspace ini. Buat satu di Studio terlebih dahulu.",
+  "createModal.selected": "Dipilih",
+  "createModal.sourceApp": "Aplikasi Workflow (wajib)",
+  "createModal.title": "Penerapan Baru",
+  "deployDrawer.bindingCount_one": "{{count}} pengikatan",
+  "deployDrawer.bindingCount_other": "{{count}} pengikatan",
+  "deployDrawer.bindingOptionsFailed": "Gagal memuat opsi kredensial.",
+  "deployDrawer.bindingSelectionHint": "Pilih kredensial yang digunakan oleh penerapan ini.",
+  "deployDrawer.bindingsDisabled": "Diselesaikan dari pratinjau rilis. Pengeditan belum tersedia.",
+  "deployDrawer.cancel": "Batal",
+  "deployDrawer.close": "Tutup drawer penerapan",
+  "deployDrawer.defaultSelect": "Pilih...",
+  "deployDrawer.deploy": "Terapkan ke Lingkungan",
+  "deployDrawer.deployExistingRelease": "Terapkan ke Lingkungan",
+  "deployDrawer.deployExistingReleaseDescription": "Pilih rilis dan lingkungan target untuk menerapkan.",
+  "deployDrawer.deployExistingReleaseTitle": "Terapkan ke Lingkungan",
+  "deployDrawer.deployFailed": "Gagal memulai penerapan.",
+  "deployDrawer.deploying": "Menerapkan...",
+  "deployDrawer.description": "Pilih rilis dan lingkungan target untuk menerapkan.",
+  "deployDrawer.envVarCount_one": "{{count}} variabel",
+  "deployDrawer.envVarCount_other": "{{count}} variabel",
+  "deployDrawer.envVarHint": "Untuk setiap variabel lingkungan yang dibutuhkan rilis ini, masukkan nilai kustom atau gunakan nilai yang didefinisikan dalam aplikasi.",
+  "deployDrawer.envVarPlaceholder": "Masukkan nilai",
+  "deployDrawer.envVarSource.ariaLabel": "Pilih sumber nilai variabel untuk {{key}}",
+  "deployDrawer.envVarSource.default": "Nilai aplikasi",
+  "deployDrawer.envVarSource.lastDeployment": "Nilai terakhir diterapkan",
+  "deployDrawer.envVarSource.literal": "Nilai kustom",
+  "deployDrawer.envVarType.number": "Angka",
+  "deployDrawer.envVarType.secret": "Rahasia",
+  "deployDrawer.envVarType.string": "String",
+  "deployDrawer.envVars": "Variabel Lingkungan",
+  "deployDrawer.existingReleaseHint": "Rilis ini akan diterapkan apa adanya. Tidak ada rilis baru yang akan dibuat.",
+  "deployDrawer.loadingBindings": "Menyelesaikan...",
+  "deployDrawer.lockedHint": "Terkunci pada lingkungan saat ini",
+  "deployDrawer.missingRequiredBinding": "Pilih kredensial untuk pengikatan yang wajib ini.",
+  "deployDrawer.missingRequiredEnvVar": "Masukkan nilai untuk variabel lingkungan yang wajib ini.",
+  "deployDrawer.modelCreds": "Kredensial Model",
+  "deployDrawer.needsValidation": " (perlu validasi)",
+  "deployDrawer.newReleaseHint": "Rilis baru akan dibuat dari YAML Aplikasi Workflow yang dipilih.",
+  "deployDrawer.noBindingRequired": "Tidak wajib",
+  "deployDrawer.noCredentialCandidates": "Tidak ada kredensial yang tersedia.",
+  "deployDrawer.noNewEnvironmentAvailable": "Semua lingkungan yang tersedia sudah memiliki penerapan.",
+  "deployDrawer.noOtherReleaseAvailable": "Tidak ada rilis lain yang tersedia untuk lingkungan ini.",
+  "deployDrawer.noReleaseAvailable": "Buat rilis sebelum menerapkan ke lingkungan.",
+  "deployDrawer.notFound": "Penerapan tidak ditemukan.",
+  "deployDrawer.noteLabel": "Deskripsi Rilis (opsional)",
+  "deployDrawer.notePlaceholder": "mis. Kirim perubahan teks onboarding",
+  "deployDrawer.pluginCreds": "Kredensial Plugin",
+  "deployDrawer.promote": "Terapkan",
+  "deployDrawer.promoteDescription": "Pilih rilis dan lingkungan target untuk menerapkan.",
+  "deployDrawer.promoteTitle": "Terapkan ke Lingkungan",
+  "deployDrawer.readOnly": "Hanya-baca",
+  "deployDrawer.redeploy": "Terapkan ke Lingkungan",
+  "deployDrawer.redeployDescription": "Pilih rilis dan lingkungan target untuk menerapkan.",
+  "deployDrawer.redeployExistingReleaseHint": "Rilis saat ini akan diterapkan ulang apa adanya. Tidak ada rilis baru yang akan dibuat.",
+  "deployDrawer.redeployTitle": "Terapkan ke Lingkungan",
+  "deployDrawer.releaseLabel": "Rilis",
+  "deployDrawer.requiredBinding": "Wajib",
+  "deployDrawer.rollback": "Terapkan",
+  "deployDrawer.rollbackDescription": "Pilih rilis dan lingkungan target untuk menerapkan.",
+  "deployDrawer.rollbackTitle": "Terapkan ke Lingkungan",
+  "deployDrawer.runtimeCredentials": "Kredensial",
+  "deployDrawer.secretPlaceholder": "rahasia",
+  "deployDrawer.selectCredential": "Pilih kredensial",
+  "deployDrawer.selectEnv": "Pilih lingkungan",
+  "deployDrawer.selectProviderCred": "Pilih kredensial {{provider}}",
+  "deployDrawer.selectProviderKey": "Pilih kunci {{provider}}",
+  "deployDrawer.selectRelease": "Pilih rilis",
+  "deployDrawer.targetEnv": "Lingkungan Target",
+  "deployDrawer.title": "Terapkan ke Lingkungan",
+  "deployDrawer.valuePlaceholder": "nilai",
+  "deployTab.cancelDeployment": "Batalkan penerapan",
+  "deployTab.closeError": "Tutup",
+  "deployTab.col.actions": "Aksi",
+  "deployTab.col.currentRelease": "Rilis Saat Ini",
+  "deployTab.col.environment": "Lingkungan",
+  "deployTab.col.status": "Status",
+  "deployTab.col.updated": "Diperbarui",
+  "deployTab.collapseDetails": "Tutup detail penerapan",
+  "deployTab.confirmUndeploy": "Batalkan Penerapan",
+  "deployTab.deployOtherVersion": "Terapkan Rilis Lain",
+  "deployTab.deployToEnv": "Terapkan ke {{name}}",
+  "deployTab.deployToNewEnv": "Terapkan ke Lingkungan Baru...",
+  "deployTab.empty": "Belum ada instansi. Terapkan ke lingkungan baru untuk memulai.",
+  "deployTab.emptyDescription": "Pilih rilis dan lingkungan target untuk membuat penerapan ini tersedia bagi pengguna.",
+  "deployTab.emptyTitle": "Belum ada lingkungan yang berjalan",
+  "deployTab.envCount": "Lingkungan",
+  "deployTab.errorCode": "Kode",
+  "deployTab.errorDialogDesc": "Tinjau penerapan terakhir yang gagal sebelum mencoba lagi atau menerapkan rilis lain.",
+  "deployTab.errorDialogTitle": "Kesalahan penerapan di {{name}}",
+  "deployTab.errorMessage": "Pesan",
+  "deployTab.errorPhase": "Fase",
+  "deployTab.expandDetails": "Perluas detail penerapan",
+  "deployTab.moreActions": "Aksi lainnya",
+  "deployTab.newDeployment": "Terapkan ke Lingkungan Baru",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "ID Penerapan",
+  "deployTab.panel.endpoints": "Endpoint",
+  "deployTab.panel.envVars": "Variabel Lingkungan",
+  "deployTab.panel.error": "Kesalahan",
+  "deployTab.panel.failedRelease": "Rilis Gagal",
+  "deployTab.panel.health": "Kesehatan",
+  "deployTab.panel.instanceInfo": "Info Instansi",
+  "deployTab.panel.modelCreds": "Kredensial Model",
+  "deployTab.panel.pluginCreds": "Kredensial Plugin",
+  "deployTab.panel.release": "Rilis",
+  "deployTab.panel.releaseCreatedAt": "Rilis Dibuat Pada",
+  "deployTab.panel.releaseInfo": "Info Rilis",
+  "deployTab.panel.replicas": "Replika",
+  "deployTab.panel.run": "Jalankan",
+  "deployTab.panel.runtimeBindings": "Kredensial",
+  "deployTab.panel.runtimeInfo": "Info Runtime",
+  "deployTab.panel.runtimeMode": "Mode Runtime",
+  "deployTab.panel.runtimeNote": "Catatan Runtime",
+  "deployTab.panel.targetRelease": "Rilis Target",
+  "deployTab.panel.unknownError": "Penerapan gagal.",
+  "deployTab.promote": "Terapkan",
+  "deployTab.redeploy": "Terapkan Ulang",
+  "deployTab.releaseCreatedAt": "Rilis dibuat {{time}}",
+  "deployTab.retry": "Coba lagi",
+  "deployTab.shortcut": "Pintasan",
+  "deployTab.status.deployFailed": "Penerapan gagal",
+  "deployTab.status.deployingRelease": "Menerapkan ({{release}})",
+  "deployTab.status.runningOutOfSync": "Berjalan (sinkronisasi tertunda)",
+  "deployTab.status.runningWithFailed": "Berjalan (penerapan terakhir gagal)",
+  "deployTab.undeploy": "Batalkan Penerapan",
+  "deployTab.undeployConfirmDesc": "Akses pengguna akhir akan segera berhenti. Rilis dapat diterapkan ulang nanti.",
+  "deployTab.undeployConfirmTitle": "Batalkan penerapan dari {{name}}?",
+  "deployTab.undeployFrom": "Batalkan penerapan dari {{name}}",
+  "deployTab.undeployImpactTitle": "Instansi yang terpengaruh",
+  "deployTab.viewError": "Lihat kesalahan",
+  "deployTab.viewLogs": "Lihat log",
+  "deployTab.viewProgress": "Lihat progres",
+  "detail.backToInstances": "Kembali ke penerapan",
+  "detail.deployingCount": "{{count}} sedang diterapkan",
+  "detail.envCount_one": "{{count}} lingkungan",
+  "detail.envCount_other": "{{count}} lingkungan",
+  "detail.failedCount": "{{count}} gagal",
+  "detail.mobileTabs": "Bagian penerapan",
+  "detail.notFound": "Penerapan tidak ditemukan",
+  "detail.openSourceApp": "Buka sumber {{name}}",
+  "detail.sourceApp": "Sumber",
+  "detail.sourceAppLink": "Sumber",
+  "documentTitle.create": "Penerapan baru · Penerapan",
+  "documentTitle.detail": "Penerapan · Penerapan",
+  "documentTitle.list": "Penerapan",
+  "filter.allEnvs": "Semua lingkungan",
+  "filter.notDeployed": "Belum diterapkan",
+  "filter.searchPlaceholder": "Cari penerapan",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Penerimaan",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Bootstrapping",
+  "health.ENVIRONMENT_STATUS_DELETING": "Menghapus",
+  "health.ENVIRONMENT_STATUS_FAILED": "Tidak tersedia",
+  "health.ENVIRONMENT_STATUS_READY": "Tersedia",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Tidak diketahui",
+  "list.clearFilters": "Hapus filter",
+  "list.clearSearch": "Hapus pencarian penerapan",
+  "list.createDeployment": "Baru",
+  "list.empty": "Tidak ditemukan penerapan.",
+  "list.emptyDescription": "Buat penerapan dari Aplikasi Workflow atau paket DSL Workflow untuk mengelola rilis, lingkungan, dan akses.",
+  "list.emptyFilteredDescription": "Tidak ada penerapan yang cocok dengan pencarian atau filter lingkungan saat ini.",
+  "list.emptyFilteredTitle": "Tidak ada penerapan yang cocok",
+  "list.emptyTitle": "Belum ada penerapan",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Terisolasi",
+  "mode.ENVIRONMENT_MODE_SHARED": "Bersama",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Tidak diketahui",
+  "newInstance.comingSoon": "Segera hadir",
+  "newInstance.fromStudio": "Pilih dari Studio",
+  "newInstance.importDSL": "Impor DSL",
+  "newInstance.title": "Penerapan Baru",
+  "overview.accessEndpoints": "Endpoint akses",
+  "overview.accessMeta.apiTokens": "Kelola API Tokens",
+  "overview.accessMeta.cli": "Lihat akses CLI",
+  "overview.accessMeta.webApp": "Kelola akses WebApp",
+  "overview.accessStatus": "Akses",
+  "overview.api": "API Tokens",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Tokens",
+  "overview.apiTokenSummary.environments_one": "{{count}} lingkungan yang diterapkan",
+  "overview.apiTokenSummary.environments_other": "{{count}} lingkungan yang diterapkan",
+  "overview.availableForDeployment": "Tersedia untuk penerapan",
+  "overview.basicInfo": "Info dasar",
+  "overview.cardAction.deployLatest": "Terapkan Rilis Terbaru",
+  "overview.cardAction.redeploy": "Terapkan Ulang",
+  "overview.cardAction.viewProgress": "Lihat penerapan",
+  "overview.chip.behindTooltip_one": "1 rilis di belakang yang terbaru. Terapkan rilis terbaru untuk memperbarui.",
+  "overview.chip.behindTooltip_other": "{{count}} rilis di belakang yang terbaru. Terapkan rilis terbaru untuk memperbarui.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "menerapkan",
+  "overview.chip.deployingTooltip": "Penerapan sedang berlangsung.",
+  "overview.chip.empty": "kosong",
+  "overview.chip.emptyTooltip": "Tidak ada rilis yang diterapkan ke lingkungan ini.",
+  "overview.chip.failed": "gagal",
+  "overview.chip.failedTooltip": "Upaya penerapan terakhir gagal.",
+  "overview.chip.latest": "terbaru",
+  "overview.chip.latestTooltip": "Lingkungan ini menjalankan rilis terbaru.",
+  "overview.chip.needsReleaseFirst": "Buat Rilis terlebih dahulu",
+  "overview.chip.olderRelease": "lebih lama",
+  "overview.chip.olderReleaseTooltip": "Lingkungan ini menjalankan rilis yang lebih lama.",
+  "overview.chip.openInDeployTab": "Lihat progres penerapan",
+  "overview.cli": "CLI",
+  "overview.configured": "Terkonfigurasi",
+  "overview.createRelease": "Buat Rilis",
+  "overview.created": "Dibuat",
+  "overview.deploy": "Terapkan",
+  "overview.deployedEnvironments": "diterapkan",
+  "overview.deploymentOverview": "Ikhtisar penerapan",
+  "overview.deploymentStatus": "Status penerapan",
+  "overview.description": "Deskripsi",
+  "overview.developerApi": "API Developer",
+  "overview.disabled": "Dinonaktifkan",
+  "overview.emptyValue": "Belum diatur",
+  "overview.enabled": "Diaktifkan",
+  "overview.enabledChannels": "akses diaktifkan",
+  "overview.endUserAccess": "Akses pengguna akhir",
+  "overview.environments": "Lingkungan",
+  "overview.hero.byName": "oleh {{name}}",
+  "overview.hero.empty": "Belum ada rilis",
+  "overview.hero.emptyDescription": "Buat rilis dari sumber saat ini sebelum menerapkan.",
+  "overview.hero.propagation_one": "diterapkan ke {{count}}/{{total}} lingkungan",
+  "overview.hero.propagation_other": "diterapkan ke {{count}}/{{total}} lingkungan",
+  "overview.hero.untargeted": "belum ada lingkungan yang dikonfigurasi",
+  "overview.instanceDetails": "Detail penerapan",
+  "overview.instanceId": "ID Penerapan",
+  "overview.latestRelease.releaseCount_one": "{{count}} rilis",
+  "overview.latestRelease.releaseCount_other": "{{count}} rilis",
+  "overview.latestReleaseTitle": "Rilis Terbaru",
+  "overview.manageDeployments": "Kelola penerapan",
+  "overview.name": "Nama",
+  "overview.noAccessConfig": "Tidak ada konfigurasi akses.",
+  "overview.noReleaseYet": "Buat rilis sebelum menerapkan ke lingkungan.",
+  "overview.notConfigured": "Belum dikonfigurasi",
+  "overview.previousReleases.empty": "Belum ada rilis sebelumnya.",
+  "overview.previousReleases.retired": "Saat ini tidak diterapkan",
+  "overview.previousReleases.title": "Rilis sebelumnya",
+  "overview.previousReleases.viewAll": "Lihat Semua",
+  "overview.ready": "Dapat diterapkan",
+  "overview.recentReleases": "Rilis terbaru",
+  "overview.releaseDeployedTitle": "{{release}} telah diterapkan",
+  "overview.releaseReadyTitle": "{{release}} siap diterapkan",
+  "overview.serviceMap": "Peta layanan",
+  "overview.servingRelease": "Melayani {{release}}",
+  "overview.servingReleaseDescription": "Penerapan ini diterapkan ke {{count}}/{{total}} lingkungan.",
+  "overview.strip.deployToNewEnvironment": "Terapkan ke lingkungan baru",
+  "overview.strip.empty": "Tidak ada lingkungan yang dikonfigurasi.",
+  "overview.strip.emptyDeployableDescription": "Terapkan rilis terbaru ke lingkungan saat Anda siap.",
+  "overview.strip.emptyDeployed": "Belum ada instansi.",
+  "overview.strip.emptyDescription": "Buat rilis sebelum menerapkan ke lingkungan.",
+  "overview.strip.emptyTitle": "Belum ada instansi",
+  "overview.strip.summary_one": "1 dari {{total}} pada rilis terbaru",
+  "overview.strip.summary_other": "{{count}} dari {{total}} pada rilis terbaru",
+  "overview.strip.title": "Instansi",
+  "overview.switchSourceApp": "Ganti sumber",
+  "overview.switchSourceAppDescription": "Pilih Aplikasi Workflow yang digunakan sebagai sumber untuk rilis mendatang.",
+  "overview.switchSourceAppHint": "Setelah beralih, hanya rilis yang baru dibuat yang menggunakan sumber baru. Rilis historis dan penerapan yang ada tidak diubah.",
+  "overview.targetRelease": "Rilis Target",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Zona bahaya",
+  "settings.dangerDesc": "Hapus penerapan ini secara permanen dan hentikan semua instansi yang berjalan. Ini tidak dapat dibatalkan.",
+  "settings.delete": "Hapus Penerapan",
+  "settings.deleteConfirmDesc": "Hapus {{name}}? Setiap instansi akan berhenti berjalan dan dihapus di semua lingkungan. Ini tidak dapat dibatalkan.",
+  "settings.deleteConfirmTitle": "Hapus penerapan",
+  "settings.deleteFailed": "Gagal menghapus penerapan.",
+  "settings.deleteImpact": "Dampak",
+  "settings.deleteImpactInstance": "Penerapan",
+  "settings.deleteImpactTitle": "Penerapan yang terpengaruh",
+  "settings.deleteImpactValue": "Penerapan dihapus dari daftar penerapan.",
+  "settings.deleted": "Penerapan dihapus",
+  "settings.description": "Deskripsi",
+  "settings.descriptionHelp": "Kelola nama, deskripsi, dan pengaturan lain dari penerapan ini.",
+  "settings.general": "Umum",
+  "settings.name": "Nama penerapan",
+  "settings.reset": "Reset",
+  "settings.save": "Simpan Perubahan",
+  "settings.updateFailed": "Gagal memperbarui penerapan.",
+  "settings.updated": "Penerapan diperbarui",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Menerapkan",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sinkronisasi tertunda",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Penerapan gagal",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Tidak valid",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Berjalan",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Belum diterapkan",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Membatalkan penerapan",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Tidak diketahui",
+  "subtitle": "Kelola penerapan di seluruh lingkungan.",
+  "tabs.access.description": "Kelola saluran akses dan izin akses.",
+  "tabs.access.name": "Akses",
+  "tabs.api-tokens.description": "Kelola API Tokens dan panggil instansi melalui HTTP.",
+  "tabs.api-tokens.name": "API Tokens",
+  "tabs.instances.description": "Lihat dan kelola instansi di lingkungan yang diterapkan.",
+  "tabs.instances.name": "Instansi",
+  "tabs.overview.description": "Lihat status penerapan di seluruh lingkungan.",
+  "tabs.overview.name": "Ikhtisar",
+  "tabs.releases.description": "Buat, terapkan, dan kelola rilis.",
+  "tabs.releases.name": "Rilis",
+  "tabs.settings.description": "Kelola nama, deskripsi, dan pengaturan lain dari penerapan ini.",
+  "tabs.settings.name": "Pengaturan",
+  "title": "Penerapan",
+  "unsupportedDslNodes.description": "Rilis ini berisi node yang belum didukung oleh runtime penerapan. Hapus atau ganti di Studio, lalu coba lagi.",
+  "unsupportedDslNodes.descriptionWithTypes": "Rilis ini berisi node yang belum didukung oleh runtime penerapan: {{nodeTypes}}. Hapus atau ganti di Studio, lalu coba lagi.",
+  "unsupportedDslNodes.title": "Node tidak didukung",
+  "unsupportedDslNodes.unknownType": "Tipe tidak diketahui",
+  "versions.cancelCreate": "Batal",
+  "versions.cancelDelete": "Batal",
+  "versions.cancelEdit": "Batal",
+  "versions.checkingReleaseContent": "Memeriksa konten rilis...",
+  "versions.col.action": "Aksi",
+  "versions.col.author": "Dibuat oleh",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Dibuat pada",
+  "versions.col.deployedTo": "Diterapkan ke",
+  "versions.col.release": "Rilis",
+  "versions.col.sourceApp": "Sumber",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Buat",
+  "versions.createFailed": "Gagal membuat rilis.",
+  "versions.createRelease": "Buat Rilis",
+  "versions.createReleaseDescription": "Buat rilis yang dapat diterapkan dari Aplikasi Workflow atau file DSL Workflow.",
+  "versions.createReleaseHint": "Rilis baru dapat diterapkan ke lingkungan apa pun.",
+  "versions.createSuccess": "Rilis \"{{name}}\" dibuat.",
+  "versions.creating": "Membuat...",
+  "versions.currentOn": "Rilis Saat Ini di {{name}}",
+  "versions.deleteConfirmDesc": "Rilis \"{{name}}\" akan dihapus secara permanen. Ini tidak dapat dibatalkan.",
+  "versions.deleteConfirmTitle": "Hapus rilis?",
+  "versions.deleteFailed": "Gagal menghapus rilis.",
+  "versions.deleteImpactDeployment": "Status penerapan",
+  "versions.deleteImpactNotDeployed": "Saat ini tidak diterapkan",
+  "versions.deleteImpactRelease": "Rilis",
+  "versions.deleteImpactTitle": "Dampak penghapusan",
+  "versions.deleteRelease": "Hapus Rilis",
+  "versions.deleteSuccess": "Rilis \"{{name}}\" dihapus.",
+  "versions.deploy": "Terapkan",
+  "versions.deployTo": "Terapkan ke {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Menerapkan",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sinkronisasi tertunda",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Gagal",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Tidak valid",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Berjalan",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Belum diterapkan",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Membatalkan penerapan",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Tidak diketahui",
+  "versions.deployingTo": "{{name}} sedang diterapkan",
+  "versions.disabledReason.checkDeploymentsFailed": "Tidak dapat memverifikasi penggunaan penerapan. Coba lagi nanti.",
+  "versions.disabledReason.checkingDeployments": "Memeriksa penggunaan penerapan",
+  "versions.disabledReason.current": "Rilis ini sudah berjalan di {{name}}",
+  "versions.disabledReason.deploying": "Tunggu penerapan aktif selesai",
+  "versions.disabledReason.envDisabled": "Lingkungan ini tidak dapat diterapkan",
+  "versions.disabledReason.releaseInUse_one": "Batalkan penerapan rilis ini dari {{count}} lingkungan sebelum menghapusnya",
+  "versions.disabledReason.releaseInUse_other": "Batalkan penerapan rilis ini dari {{count}} lingkungan sebelum menghapusnya",
+  "versions.dslReadFailed": "Gagal membaca file DSL. Pilih file lain dan coba lagi.",
+  "versions.dslReading": "Membaca file DSL...",
+  "versions.dslUnsupportedMode": "Hanya file DSL Workflow yang dapat digunakan untuk penerapan.",
+  "versions.editFailed": "Gagal memperbarui rilis.",
+  "versions.editRelease": "Edit Rilis",
+  "versions.editReleaseDescription": "Perbarui nama dan deskripsi rilis ini.",
+  "versions.editSuccess": "Rilis \"{{name}}\" diperbarui.",
+  "versions.empty": "Belum ada rilis yang tersedia.",
+  "versions.emptyDescription": "Buat rilis pertama sebelum menerapkan ke lingkungan.",
+  "versions.emptyTitle": "Belum ada rilis",
+  "versions.emptyWithCreate": "Belum ada rilis. Buat rilis pertama yang dapat diterapkan sebelum menerapkan.",
+  "versions.exportDsl": "Ekspor DSL",
+  "versions.exportDslFailed": "Gagal mengekspor DSL.",
+  "versions.exportingDsl": "Mengekspor...",
+  "versions.groupHeader.deploy": "Terapkan",
+  "versions.groupHeader.promote": "Terapkan",
+  "versions.groupHeader.rollback": "Terapkan versi sebelumnya",
+  "versions.groupHeader.unavailable": "Tidak tersedia",
+  "versions.manualDslOption": "Unggah DSL",
+  "versions.moreActions": "Aksi lainnya",
+  "versions.optional": "Opsional",
+  "versions.promote": "Terapkan",
+  "versions.promoteTo": "Terapkan ke {{name}}",
+  "versions.releaseAlreadyExists": "Rilis dengan konten yang sama sudah ada: {{name}}.",
+  "versions.releaseContentCheckFailed": "Gagal memeriksa konten rilis.",
+  "versions.releaseDescriptionLabel": "Deskripsi",
+  "versions.releaseDescriptionPlaceholder": "Jelaskan rilis ini",
+  "versions.releaseHistory": "Riwayat rilis",
+  "versions.releaseNameLabel": "Nama Rilis",
+  "versions.releaseNamePlaceholder": "Nama Rilis",
+  "versions.releaseNameRequired": "Masukkan nama rilis.",
+  "versions.releaseSourceLabel": "Sumber Rilis",
+  "versions.rollbackTo": "Terapkan ke {{name}}",
+  "versions.saveEdit": "Simpan",
+  "versions.sourceAppOption": "Aplikasi Workflow"
+}
diff --git a/web/i18n/id-ID/workflow.json b/web/i18n/id-ID/workflow.json
index 87202bf6698..39f1df2c5c7 100644
--- a/web/i18n/id-ID/workflow.json
+++ b/web/i18n/id-ID/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "Agen",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Jawaban",
   "blocks.assigner": "Penerima Variabel",
   "blocks.code": "Kode",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Agregator Variabel",
   "blocks.variable-assigner": "Agregator Variabel",
   "blocksAbout.agent": "Memanggil model bahasa besar untuk menjawab pertanyaan atau memproses bahasa alami",
+  "blocksAbout.agent-v2": "Memanggil model bahasa besar untuk menjawab pertanyaan atau memproses bahasa alami",
   "blocksAbout.answer": "Menentukan konten balasan percakapan obrolan",
   "blocksAbout.assigner": "Simpul penetapan variabel digunakan untuk menetapkan nilai ke variabel yang dapat ditulis (seperti variabel percakapan).",
   "blocksAbout.code": "Eksekusi sepotong kode Python atau NodeJS untuk mengimplementasikan logika kustom",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID alur kerja",
   "globalVar.fieldsDescription.workflowRunId": "ID eksekusi alur kerja",
   "globalVar.title": "Variabel Sistem",
+  "nodes.agent.advancedSetting": "Pengaturan Lanjutan",
   "nodes.agent.checkList.strategyNotSelected": "Strategi tidak dipilih",
   "nodes.agent.clickToViewParameterSchema": "Klik untuk melihat skema parameter",
   "nodes.agent.configureModel": "Mengonfigurasi Model",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Model yang Tidak Didukung",
   "nodes.agent.modelSelectorTooltips.deprecated": "Model ini tidak digunakan lagi",
   "nodes.agent.notAuthorized": "Tidak Berwenang",
+  "nodes.agent.outputVars.confirm": "Konfirmasi",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Masukkan array JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Masukkan true atau false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Default file belum dapat dikonfigurasi di sini.",
+  "nodes.agent.outputVars.defaultValueLabel": "Default",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Masukkan angka yang valid.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Masukkan objek JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Nilai default",
+  "nodes.agent.outputVars.delete": "Hapus {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Deskripsi",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Tambahkan deskripsi",
+  "nodes.agent.outputVars.edit": "Edit {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Editor variabel output",
   "nodes.agent.outputVars.files.title": "file yang dihasilkan agen",
   "nodes.agent.outputVars.files.transfer_method": "Metode transfer. Nilai adalah remote_url atau local_file",
   "nodes.agent.outputVars.files.type": "Jenis dukungan. Sekarang hanya mendukung gambar",
   "nodes.agent.outputVars.files.upload_file_id": "Unggah id file",
   "nodes.agent.outputVars.files.url": "URL gambar",
   "nodes.agent.outputVars.json": "JSON yang dihasilkan agen",
+  "nodes.agent.outputVars.nameDuplicate": "Nama output sudah ada",
+  "nodes.agent.outputVars.nameInvalid": "Gunakan huruf, angka, dan garis bawah. Mulai dengan huruf atau garis bawah.",
+  "nodes.agent.outputVars.nameLabel": "Nama field",
+  "nodes.agent.outputVars.namePlaceholder": "Nama Field",
+  "nodes.agent.outputVars.newOutput": "Output baru",
+  "nodes.agent.outputVars.requiredLabel": "Wajib",
+  "nodes.agent.outputVars.showAdvancedOptions": "Tampilkan opsi lanjutan",
   "nodes.agent.outputVars.text": "Konten yang dihasilkan agen",
+  "nodes.agent.outputVars.typeLabel": "Tipe output",
   "nodes.agent.outputVars.usage": "Informasi Penggunaan Model",
   "nodes.agent.parameterSchema": "Skema Parameter",
   "nodes.agent.pluginInstaller.install": "Pasang",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Integrasi ini diinstal dari GitHub. Silakan buka Integrasis untuk menginstal ulang",
   "nodes.agent.pluginNotInstalled": "Integrasi ini tidak diinstal",
   "nodes.agent.pluginNotInstalledDesc": "Integrasi ini diinstal dari GitHub. Silakan buka Integrasis untuk menginstal ulang",
+  "nodes.agent.roster.change": "Ubah",
+  "nodes.agent.roster.editInConsole": "Edit di Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Pengaturan sekali pakai yang hanya berada di simpul ini",
+  "nodes.agent.roster.inlineSetup.name": "Pengaturan inline",
+  "nodes.agent.roster.inlineSetup.title": "Pengaturan agen",
+  "nodes.agent.roster.inlineSetup.type": "Hanya di simpul ini",
+  "nodes.agent.roster.label": "Agen",
+  "nodes.agent.roster.makeCopy": "Buat salinan",
+  "nodes.agent.roster.more": "Tindakan agen lainnya",
+  "nodes.agent.roster.openPanel": "Buka detail {{name}}",
+  "nodes.agent.roster.panelLabel": "Detail {{name}}",
   "nodes.agent.strategy.configureTip": "Silakan konfigurasikan strategi agen.",
   "nodes.agent.strategy.configureTipDesc": "Setelah mengonfigurasi strategi agen, node ini akan secara otomatis memuat konfigurasi yang tersisa. Strategi tersebut akan mempengaruhi mekanisme penalaran alat multi-langkah.",
   "nodes.agent.strategy.label": "Strategi Agen",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Versi integrasi yang diinstal tidak menyediakan strategi ini. Klik untuk beralih versi.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} tidak terpasang",
   "nodes.agent.strategyNotSet": "Strategi agen tidak ditetapkan",
+  "nodes.agent.task.insert": "Sisipkan",
+  "nodes.agent.task.label": "Tugas agen",
+  "nodes.agent.task.mention": "Sebut",
+  "nodes.agent.task.placeholder": "Jelaskan apa yang harus dilakukan agen ini...",
+  "nodes.agent.task.tooltip": "Tentukan instruksi tugas yang harus diikuti agen ini dalam alur kerja ini.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Tidak Berwenang",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} tidak terpasang",
   "nodes.agent.toolbox": "Toolbox",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Oleh {{author}}",
   "tabs.question-understand": "Pertanyaan Pahami",
   "tabs.requestToCommunity": "Permintaan kepada komunitas",
-  "tabs.searchBlock": "Simpul pencarian",
+  "tabs.searchBlock": "Cari simpul, agen, manusia, Pengetahuan",
   "tabs.searchDataSource": "Cari Sumber Data",
   "tabs.searchSnippets": "Cuplikan penelusuran...",
   "tabs.searchTool": "Alat pencarian",
diff --git a/web/i18n/it-IT/agent-v-2.json b/web/i18n/it-IT/agent-v-2.json
new file mode 100644
index 00000000000..a38e2808ab7
--- /dev/null
+++ b/web/i18n/it-IT/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Questa azione non è ancora disponibile.",
+  "agentDetail.access.actions.monitoring": "Monitoraggio",
+  "agentDetail.access.copyAccessUrl": "Copia URL di accesso",
+  "agentDetail.access.copyFailed": "Impossibile copiare il riferimento.",
+  "agentDetail.access.copyReference": "Copia riferimento di {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Copia endpoint dell’API di servizio",
+  "agentDetail.access.description": "Ogni superficie da cui questo agente è raggiungibile.",
+  "agentDetail.access.empty": "Nessun punto di accesso collegato",
+  "agentDetail.access.emptyDescription": "Questo agente del roster non ha ancora riferimenti ad app o workflow.",
+  "agentDetail.access.entries.agentApp.description": "App agente collegata a questo agente del roster.",
+  "agentDetail.access.entries.agentApp.name": "App agente",
+  "agentDetail.access.entries.workflow.description": "Workflow e riferimento di nodo collegati a questo agente del roster.",
+  "agentDetail.access.entries.workflow.name": "Nodo workflow",
+  "agentDetail.access.entryCount_one": "{{count}} voce",
+  "agentDetail.access.entryCount_other": "{{count}} voci",
+  "agentDetail.access.groups.references.heading": "Riferimenti",
+  "agentDetail.access.groups.references.label": "Riferimenti collegati",
+  "agentDetail.access.learnMore": "Scopri di più",
+  "agentDetail.access.moreActions": "Altre azioni per {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Endpoint dell’API di servizio",
+  "agentDetail.access.serviceApi.title": "API di servizio backend",
+  "agentDetail.access.status.disabled": "Disabilitato",
+  "agentDetail.access.status.enabled": "Abilitato",
+  "agentDetail.access.status.inService": "In servizio",
+  "agentDetail.access.status.outOfService": "Fuori servizio",
+  "agentDetail.access.title": "Punto di accesso",
+  "agentDetail.access.toggleSurface": "Attiva/disattiva accesso di {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL di accesso",
+  "agentDetail.access.webApp.actions.customize": "Personalizza",
+  "agentDetail.access.webApp.actions.embedded": "Incorporato",
+  "agentDetail.access.webApp.actions.launch": "Avvia",
+  "agentDetail.access.webApp.actions.settings": "Impostazioni",
+  "agentDetail.access.webApp.refreshUrl": "Aggiorna URL di accesso",
+  "agentDetail.access.webApp.showQrCode": "Mostra codice QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO abilitato",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Usato come nodo all’interno del workflow",
+  "agentDetail.access.workflow.empty": "Nessun riferimento al workflow al momento.",
+  "agentDetail.access.workflow.loadFailed": "Impossibile caricare i riferimenti del workflow.",
+  "agentDetail.access.workflow.loading": "Caricamento dei riferimenti del workflow…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} nodo",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} nodi",
+  "agentDetail.access.workflow.notAvailable": "N/D",
+  "agentDetail.access.workflow.openInStudio": "Apri in Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Apri {{name}} in Studio",
+  "agentDetail.access.workflow.table.actions": "Azioni",
+  "agentDetail.access.workflow.table.lastUpdated": "Ultimo aggiornamento",
+  "agentDetail.access.workflow.table.name": "Nome",
+  "agentDetail.access.workflow.table.nodes": "Nodi",
+  "agentDetail.access.workflow.table.version": "Versione",
+  "agentDetail.access.workflow.title": "Accesso tramite workflow",
+  "agentDetail.configure.advancedSettings.description": "Per utenti avanzati. Variabili d’ambiente, sandbox e memoria.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Aggiungi variabile d’ambiente",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Elimina {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Nascondi valore di {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Importa .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Per mostrare i file .env nascosti, premi Command + Maiusc + . nel selettore dei file.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Se il tuo file .env è nascosto, abilita i file nascosti nel selettore dei file di sistema.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Per mostrare i file .env nascosti, abilita Elementi nascosti in Esplora file.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Mostra valore di {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Seleziona ambito della variabile d’ambiente",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Variabili d’ambiente disponibili per questo agente in fase di esecuzione.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Attiva/disattiva Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Impostazioni avanzate",
+  "agentDetail.configure.advancedSettings.toggle": "Attiva/disattiva impostazioni avanzate",
+  "agentDetail.configure.chatFeatures.description": "Definisci l’esperienza di chat per l’utente finale sulla tua webapp e sulle superfici di chat.",
+  "agentDetail.configure.chatFeatures.title": "Funzionalità chat",
+  "agentDetail.configure.files.add": "Aggiungi file",
+  "agentDetail.configure.files.empty.description": "Carica documenti che l’agente possa leggere, come specifiche, modelli o linee guida",
+  "agentDetail.configure.files.empty.title": "Nessun file al momento",
+  "agentDetail.configure.files.label": "File",
+  "agentDetail.configure.files.preview.empty": "Nessun contenuto in anteprima.",
+  "agentDetail.configure.files.preview.failed": "Impossibile caricare l’anteprima.",
+  "agentDetail.configure.files.preview.unsupported": "Questo file non supporta l’anteprima.",
+  "agentDetail.configure.files.remove": "Rimuovi {{name}}",
+  "agentDetail.configure.files.tip": "File che questo agente può utilizzare durante l’orchestrazione delle attività.",
+  "agentDetail.configure.files.toggle": "Attiva/disattiva file",
+  "agentDetail.configure.files.treeLabel": "File dell’agente",
+  "agentDetail.configure.files.upload.action": "Carica",
+  "agentDetail.configure.files.upload.browse": "sfoglia",
+  "agentDetail.configure.files.upload.description": "Carica un file per questo agente.",
+  "agentDetail.configure.files.upload.dropzone": "Trascina qui un file, oppure",
+  "agentDetail.configure.files.upload.failed": "Impossibile caricare il file.",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "Carica un solo file.",
+  "agentDetail.configure.files.upload.success": "File caricato.",
+  "agentDetail.configure.files.upload.title": "Carica file",
+  "agentDetail.configure.knowledgeRetrieval.add": "Aggiungi recupero della conoscenza",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Aggiungi conoscenza",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Fai clic sul pulsante “+” per aggiungere conoscenza",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Conoscenza",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Impostazione di recupero",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Scopri di più sul recupero della conoscenza",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automatico",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Condizioni",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Disabilitato",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Filtro metadati",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manuale",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Seleziona modalità di filtraggio dei metadati",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Nome del recupero della conoscenza",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Decide l’agente",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "L’agente scrive la propria query a partire dal prompt e dal contesto disponibile. Niente da configurare qui.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Query personalizzata",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Scrivi una query fissa per questa sorgente di recupero.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Testo della query personalizzata",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Digita una query di ricerca",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Query",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Recupero della conoscenza · Decide l’agente",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Modifica {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Collega una base di conoscenza che l’agente possa consultare mentre risponde",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Nessuna conoscenza al momento",
+  "agentDetail.configure.knowledgeRetrieval.label": "Recupero della conoscenza",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Rimuovi {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Sorgenti di recupero della conoscenza che questo agente può utilizzare durante l’orchestrazione delle attività.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Attiva/disattiva recupero della conoscenza",
+  "agentDetail.configure.model.label": "Modello",
+  "agentDetail.configure.orchestrate": "Orchestra",
+  "agentDetail.configure.preview.chatFeatures": "Funzionalità chat",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agente",
+  "agentDetail.configure.preview.empty.description": "Invia un messaggio per testare la bozza corrente.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Nessuna istruzione ancora, quindi le risposte arrivano dal modello puro.",
+  "agentDetail.configure.preview.endUserAuth": "Autenticazione utente finale",
+  "agentDetail.configure.preview.restart": "Riavvia anteprima",
+  "agentDetail.configure.preview.title": "Anteprima",
+  "agentDetail.configure.prompt.copied": "Prompt copiato",
+  "agentDetail.configure.prompt.copy": "Copia prompt",
+  "agentDetail.configure.prompt.copyFailed": "Impossibile copiare il prompt.",
+  "agentDetail.configure.prompt.insert.label": "Inserisci",
+  "agentDetail.configure.prompt.insert.question": "Domanda iniziale",
+  "agentDetail.configure.prompt.insert.reportFile": "File di report di output",
+  "agentDetail.configure.prompt.insert.tenders": "Elenco gare iniziale",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Menziona",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Scrivi le istruzioni qui,",
+  "agentDetail.configure.prompt.tip": "Definisci come questo agente deve interpretare gli input, chiamare gli strumenti e produrre output.",
+  "agentDetail.configure.publishBar.draft": "Bozza",
+  "agentDetail.configure.publishBar.publishUpdate": "Pubblica aggiornamento",
+  "agentDetail.configure.publishBar.published": "Pubblicato",
+  "agentDetail.configure.publishBar.publishedAt": "Pubblicato {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Pubblicazione…",
+  "agentDetail.configure.publishBar.saved": "Salvato 5 min fa",
+  "agentDetail.configure.publishBar.savedAt": "Salvato {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Modifiche non pubblicate",
+  "agentDetail.configure.publishBar.upToDate": "Aggiornato",
+  "agentDetail.configure.publishBar.versionHistory": "Apri cronologia versioni",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Workflow interessati",
+  "agentDetail.configure.publishImpact.cancel": "Annulla",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Il tuo agente compare in",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Le modifiche li influenzeranno.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "questo agente",
+  "agentDetail.configure.publishImpact.title": "{{action}} in {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} workflow",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} workflow",
+  "agentDetail.configure.skills.add": "Aggiungi abilità",
+  "agentDetail.configure.skills.detail.contentRegion": "Contenuto dei dettagli dell’abilità",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} FILE",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "File dell’abilità",
+  "agentDetail.configure.skills.detail.files": "File",
+  "agentDetail.configure.skills.empty.description": "Le abilità forniscono all’agente competenze riutilizzabili che può richiamare durante il lavoro",
+  "agentDetail.configure.skills.empty.title": "Nessuna abilità al momento",
+  "agentDetail.configure.skills.itemType": "Abilità",
+  "agentDetail.configure.skills.label": "Abilità",
+  "agentDetail.configure.skills.remove": "Rimuovi {{name}}",
+  "agentDetail.configure.skills.tip": "Abilità che questo agente può utilizzare durante l’orchestrazione delle attività.",
+  "agentDetail.configure.skills.toggle": "Attiva/disattiva abilità",
+  "agentDetail.configure.skills.upload.action": "Carica",
+  "agentDetail.configure.skills.upload.browse": "sfoglia",
+  "agentDetail.configure.skills.upload.description": "Carica un pacchetto .zip o .skill per questo agente.",
+  "agentDetail.configure.skills.upload.dropzone": "Trascina qui un pacchetto di abilità, oppure",
+  "agentDetail.configure.skills.upload.failed": "Impossibile caricare l’abilità.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Carica un file .zip o .skill.",
+  "agentDetail.configure.skills.upload.success": "Abilità caricata.",
+  "agentDetail.configure.skills.upload.title": "Carica abilità",
+  "agentDetail.configure.tools.add": "Aggiungi strumento",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Per sviluppatori",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Installa un programma a riga di comando che l’agente esegue nel suo sandbox. Richiede installazione e di solito chiavi API.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Strumento CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Scegli uno strumento già presente in questo workspace, come la ricerca web o le integrazioni.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Strumento",
+  "agentDetail.configure.tools.cliDialog.description": "Installa uno strumento CLI da qualsiasi registry di pacchetti. L’agente ottiene l’accesso shell al binario fornito.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Modifica strumento CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Memorizza chiavi API, token o segreti necessari a questo strumento CLI. I valori sono cifrati a riposo e inseriti come variabili d’ambiente quando l’agente invoca lo strumento.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Variabili d’ambiente",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(facoltativo)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "In sandbox · eseguito una sola volta alla prima invocazione",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Comando di installazione",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Incolla qui il tuo comando di installazione, ad esempio npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Il comando di installazione è obbligatorio.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Scopri di più sullo strumento CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Nome dello strumento CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Dai un nome al tuo strumento CLI",
+  "agentDetail.configure.tools.cliDialog.name.required": "Il nome dello strumento CLI è obbligatorio.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Mai visibile nel prompt dell’agente; inserito solo come $VAR a runtime",
+  "agentDetail.configure.tools.cliDialog.title": "Aggiungi uno strumento CLI",
+  "agentDetail.configure.tools.cliTool": "Strumento CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Utente finale · OAuth",
+  "agentDetail.configure.tools.editAction": "Modifica {{name}}",
+  "agentDetail.configure.tools.empty.description": "Gli strumenti consentono all’agente di agire, come cercare sul web o chiamare le tue app",
+  "agentDetail.configure.tools.empty.title": "Nessuno strumento al momento",
+  "agentDetail.configure.tools.label": "Strumenti",
+  "agentDetail.configure.tools.moreActions": "Altre azioni per {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Pre-autorizza",
+  "agentDetail.configure.tools.removeAction": "Rimuovi {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Rimuovi tutti gli strumenti",
+  "agentDetail.configure.tools.tip": "Strumenti che questo agente può chiamare durante l’orchestrazione delle attività.",
+  "agentDetail.configure.tools.toggle": "Attiva/disattiva strumenti",
+  "agentDetail.configure.tools.toolTabs.all": "Tutti",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Personalizzato",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugin",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agente",
+  "agentDetail.history": "Cronologia",
+  "agentDetail.logs.description": "I log completi registrano lo stato di esecuzione dell’applicazione, inclusi input degli utenti, risposte dell’agente, pianificazione e uso degli strumenti.",
+  "agentDetail.logs.empty": "Nessun log trovato",
+  "agentDetail.logs.filters.period.allTime": "Tutto il periodo",
+  "agentDetail.logs.filters.period.label": "Periodo del log",
+  "agentDetail.logs.filters.period.last30days": "Ultimi 30 giorni",
+  "agentDetail.logs.filters.period.last7days": "Ultimi 7 giorni",
+  "agentDetail.logs.filters.search.label": "Cerca log",
+  "agentDetail.logs.filters.search.placeholder": "Cerca",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Ultima ora di creazione",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Ultima ora di aggiornamento",
+  "agentDetail.logs.filters.source.all": "Origine",
+  "agentDetail.logs.filters.source.empty": "Nessuna fonte trovata",
+  "agentDetail.logs.filters.source.label": "Origine del log",
+  "agentDetail.logs.filters.source.loadFailed": "Impossibile caricare le fonti",
+  "agentDetail.logs.filters.source.loading": "Caricamento fonti…",
+  "agentDetail.logs.filters.source.searchLabel": "Cerca fonti",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Cerca",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Workflow",
+  "agentDetail.logs.learnMore": "Scopri di più",
+  "agentDetail.logs.loadFailed": "Impossibile caricare i log",
+  "agentDetail.logs.loading": "Caricamento log…",
+  "agentDetail.logs.notAvailable": "N/D",
+  "agentDetail.logs.table.createdTime": "Ora di creazione",
+  "agentDetail.logs.table.endUser": "Utente finale",
+  "agentDetail.logs.table.messageCount": "N. msg.",
+  "agentDetail.logs.table.operationRate": "Tasso op.",
+  "agentDetail.logs.table.source": "Fonte",
+  "agentDetail.logs.table.title": "Titolo",
+  "agentDetail.logs.table.unread": "Non letto",
+  "agentDetail.logs.table.updatedTime": "Ora di aggiornamento",
+  "agentDetail.logs.table.userRate": "Valutazione utente",
+  "agentDetail.logs.title": "Log",
+  "agentDetail.memorySettings.budgetLabel": "Budget di memoria",
+  "agentDetail.memorySettings.description": "Impostazioni di memoria dallo snapshot di configurazione attivo.",
+  "agentDetail.memorySettings.export.description": "L’esportazione della memoria è prevista per una versione successiva.",
+  "agentDetail.memorySettings.export.download": "Scarica",
+  "agentDetail.memorySettings.export.soon": "Presto",
+  "agentDetail.memorySettings.export.title": "Esporta la memoria corrente",
+  "agentDetail.memorySettings.notConfigured": "Non configurato",
+  "agentDetail.memorySettings.scopeLabel": "Ambito della memoria",
+  "agentDetail.memorySettings.title": "Memoria",
+  "agentDetail.metadata.activeVersionLabel": "Versione attiva",
+  "agentDetail.metadata.appIdLabel": "ID app",
+  "agentDetail.metadata.description": "Campi del roster di sola lettura restituiti dal backend dell’agente.",
+  "agentDetail.metadata.emptyValue": "Non disponibile",
+  "agentDetail.metadata.scopeLabel": "Ambito",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Solo workflow",
+  "agentDetail.metadata.sourceLabel": "Origine",
+  "agentDetail.metadata.statusLabel": "Stato",
+  "agentDetail.metadata.title": "Metadati",
+  "agentDetail.metadata.updatedAtLabel": "Aggiornato il",
+  "agentDetail.metadata.workflowIdLabel": "ID workflow",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID nodo workflow",
+  "agentDetail.monitoring.change": "{{value}} rispetto al periodo precedente",
+  "agentDetail.monitoring.dateRangeLabel": "Intervallo di date",
+  "agentDetail.monitoring.description": "Monitora l’attività, il costo e la qualità dell’interazione dell’agente riutilizzabile in tutti i workflow.",
+  "agentDetail.monitoring.learnMore": "Scopri di più",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Utenti finali unici che hanno attivato workflow utilizzando questo agente.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Utenti attivi",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Conteggio della comunicazione continua tra utente e agente per questo punto di accesso.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Interazioni medie per sessione",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Velocità media di output dall’inizio della richiesta al completamento.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Velocità di output dei token",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Costo stimato in token prodotto da questo agente nelle esecuzioni dei workflow.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Utilizzo dei token",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Conversazioni IA giornaliere che hanno raggiunto questo agente tramite il punto di accesso selezionato.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Conversazioni totali",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Conteggio giornaliero delle interazioni dell’agente.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Messaggi totali",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Il numero di mi piace per 1.000 messaggi per questo agente.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Tasso di soddisfazione utente",
+  "agentDetail.monitoring.pickSource": "Scegli un’app",
+  "agentDetail.monitoring.sourceLabel": "App",
+  "agentDetail.monitoring.sourceTrigger": "Origine {{name}}",
+  "agentDetail.monitoring.sources.all": "Tutte",
+  "agentDetail.monitoring.timeRangeLabel": "Intervallo di tempo",
+  "agentDetail.monitoring.timeRanges.custom": "Personalizzato",
+  "agentDetail.monitoring.timeRanges.last30days": "Ultimi 30 giorni",
+  "agentDetail.monitoring.timeRanges.last7days": "Ultimi 7 giorni",
+  "agentDetail.monitoring.timeRanges.today": "Oggi",
+  "agentDetail.monitoring.title": "Monitoraggio",
+  "agentDetail.monitoring.tokenUsageConsumed": "Token consumati",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Navigazione dell’agente",
+  "agentDetail.publish": "Pubblica",
+  "agentDetail.publishSoon": "Presto",
+  "agentDetail.sections.access": "Punto di accesso",
+  "agentDetail.sections.configure": "Orchestra",
+  "agentDetail.sections.logs": "Log",
+  "agentDetail.sections.monitoring": "Monitoraggio",
+  "agentDetail.subtitle": "ID agente: {{agentId}}",
+  "agentDetail.title": "Agente",
+  "agentDetail.type": "AGENTE",
+  "agentDetail.versionHistory.active": "Attiva",
+  "agentDetail.versionHistory.empty": "Nessuna versione al momento",
+  "agentDetail.versionHistory.filter": "Filtra versioni",
+  "agentDetail.versionHistory.versionName": "Versione {{version}}",
+  "roster.createAgent": "Crea agente",
+  "roster.createAgentOptions": "Opzioni di creazione agente",
+  "roster.createDialog.description": "Crea un agente riutilizzabile nel roster di questo workspace.",
+  "roster.createDialog.title": "Crea agente",
+  "roster.createForm.changeIcon": "Cambia icona dell’agente",
+  "roster.createForm.descriptionLabel": "Descrizione",
+  "roster.createForm.descriptionOptional": "(facoltativo)",
+  "roster.createForm.descriptionPlaceholder": "ad es. Raccoglie fonti su un argomento e riassume i risultati chiave",
+  "roster.createForm.nameLabel": "Nome",
+  "roster.createForm.namePlaceholder": "ad es. Max",
+  "roster.createForm.nameRequired": "Il nome è obbligatorio.",
+  "roster.createForm.roleLabel": "Ruolo",
+  "roster.createForm.rolePlaceholder": "ad es. Assistente di ricerca",
+  "roster.createForm.roleRequired": "Il ruolo è obbligatorio.",
+  "roster.createSuccess": "Agente creato.",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Questo agente verrà rimosso dall’elenco del roster attivo.",
+  "roster.deleteDialog.title": "Eliminare {{name}}?",
+  "roster.deleteFailed": "Impossibile eliminare l’agente.",
+  "roster.deleteSuccess": "Agente eliminato.",
+  "roster.duplicateFailed": "Impossibile duplicare l’agente.",
+  "roster.duplicateSuccess": "Agente duplicato.",
+  "roster.editAgent": "Modifica {{name}}",
+  "roster.editDialog.description": "Aggiorna il nome, la descrizione e il ruolo del roster per questo agente.",
+  "roster.editDialog.title": "Modifica agente",
+  "roster.editInfo": "Modifica informazioni",
+  "roster.empty": "Nessun agente al momento",
+  "roster.emptyDescription": "Gli agenti salvati in questo workspace compariranno qui.",
+  "roster.emptySearch": "Nessun agente corrispondente",
+  "roster.emptySearchDescription": "Prova con un altro nome di agente.",
+  "roster.filters.all": "Tutti",
+  "roster.filters.drafts": "Bozze",
+  "roster.filters.label": "Filtri agente",
+  "roster.filters.published": "Pubblicati",
+  "roster.learnMore": "Scopri di più su Agent Roster",
+  "roster.listLabel": "Elenco del roster degli agenti",
+  "roster.loadMore": "Carica altro",
+  "roster.loadingError": "Impossibile caricare gli agenti. Aggiorna e riprova.",
+  "roster.moreActions": "Altre azioni per {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Impossibile creare l’agente inline. Aggiorna e riprova.",
+  "roster.nodeSelector.dialogLabel": "Seleziona un agente",
+  "roster.nodeSelector.manageInAgentConsole": "Gestisci in Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Cerca…",
+  "roster.nodeSelector.startFromScratch": "Inizia da zero",
+  "roster.references.label": "Workflow che usano {{name}}",
+  "roster.references.trigger": "Workflow che usano {{name}}",
+  "roster.searchLabel": "Cerca agenti",
+  "roster.searchPlaceholder": "Cerca agenti per nome…",
+  "roster.sources.agent_app": "App agente",
+  "roster.sources.imported": "Importato",
+  "roster.sources.system": "Sistema",
+  "roster.sources.workflow": "Workflow",
+  "roster.status.active": "Attivo",
+  "roster.status.archived": "Archiviato",
+  "roster.tabs.agent": "Agente",
+  "roster.tabs.human": "Umano",
+  "roster.tabsLabel": "Tipo di roster",
+  "roster.updateSuccess": "Agente aggiornato.",
+  "roster.usageStatus.draft": "Bozza"
+}
diff --git a/web/i18n/it-IT/app-log.json b/web/i18n/it-IT/app-log.json
index 43b34d67dbd..0cc5da3dec4 100644
--- a/web/i18n/it-IT/app-log.json
+++ b/web/i18n/it-IT/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Oggi",
   "filter.period.yearToDate": "Anno corrente",
   "filter.sortBy": "Ordina per:",
+  "monitoring.description": "Il monitoraggio registra lo stato di esecuzione dell’applicazione, inclusi prestazioni, attività degli utenti e costi.",
   "promptLog": "Registro Prompt",
   "runDetail.fileListDetail": "Dettaglio",
   "runDetail.fileListLabel": "Dettagli del file",
diff --git a/web/i18n/it-IT/billing.json b/web/i18n/it-IT/billing.json
index b3a9f12dfef..d93a170ae2e 100644
--- a/web/i18n/it-IT/billing.json
+++ b/web/i18n/it-IT/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Aggiorna per sbloccare il caricamento di documenti in batch",
   "upgrade.uploadMultiplePages.description": "Hai raggiunto il limite di caricamento: sul tuo piano attuale può essere selezionato e caricato un solo documento alla volta.",
   "upgrade.uploadMultiplePages.title": "Aggiorna per caricare più documenti contemporaneamente",
+  "upgrade.workflowRestore.description": "Il ripristino delle versioni del workflow non è disponibile nel tuo piano attuale.",
+  "upgrade.workflowRestore.title": "Esegui l'upgrade per ripristinare le versioni del workflow",
   "upgradeBtn.encourage": "Aggiorna Ora",
   "upgradeBtn.encourageShort": "Aggiorna",
   "upgradeBtn.plain": "Aggiorna Piano",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index 3967d6a926b..8513ffd7c3d 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Cambia workspace",
   "mcpPage.description": "Connetti e gestisci server MCP per dare alle tue app accesso a strumenti e servizi esterni.",
-  "members.admin": "Admin",
   "members.adminTip": "Può creare app e gestire le impostazioni del team",
+  "members.alreadyInTeam": "Già nel team",
+  "members.alreadyInTeamTip": "Questi utenti hanno già accesso a questo spazio di lavoro.",
   "members.builder": "Builder",
   "members.builderTip": "Può creare e modificare le proprie app",
-  "members.datasetOperator": "Admin della Conoscenza",
   "members.datasetOperatorTip": "Può solo gestire la base di conoscenza",
   "members.deleteMember": "Elimina Membro",
   "members.disInvite": "Annulla l'invito",
-  "members.editor": "Editor",
   "members.editorTip": "Può creare e modificare app",
   "members.email": "Email",
   "members.emailInvalid": "Formato Email non valido",
@@ -270,13 +269,12 @@
   "members.invite": "Aggiungi",
   "members.inviteTeamMember": "Aggiungi membro del team",
   "members.inviteTeamMemberTip": "Potranno accedere ai dati del tuo team direttamente dopo aver effettuato l'accesso.",
-  "members.invitedAsRole": "Invitato come utente {{role}}",
+  "members.invitedAsRole": "Invitato come {{role}}",
   "members.lastActive": "ULTIMA ATTIVITÀ",
   "members.name": "NOME",
-  "members.normal": "Normale",
+  "members.noNewInvitationsSent": "Nessun nuovo invito inviato",
   "members.normalTip": "Può solo usare le app, non può crearle",
   "members.ok": "OK",
-  "members.owner": "Proprietario",
   "members.pending": "In attesa...",
   "members.removeFromTeam": "Rimuovi dal team",
   "members.removeFromTeamTip": "Rimuoverà l'accesso al team",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Conoscenza",
   "menus.datasetsTips": "PROSSIMAMENTE: Importa i tuoi dati testuali o scrivi dati in tempo reale tramite Webhook per migliorare il contesto LLM.",
+  "menus.deployments": "Distribuzioni",
   "menus.explore": "Esplora",
   "menus.exploreMarketplace": "Esplora il Marketplace",
   "menus.newApp": "Nuova App",
   "menus.newDataset": "Crea Conoscenza",
   "menus.plugins": "Integrazione",
   "menus.pluginsTips": "Integra integrazione di terze parti o crea integrazione AI compatibili con ChatGPT.",
+  "menus.roster": "Elenco agenti",
   "menus.status": "beta",
   "menus.tools": "Strumenti",
   "model.addMoreModel": "Vai alle impostazioni per aggiungere altri modelli",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Modello da Testo a Voce",
   "modelProvider.ttsModel.tip": "Imposta il modello predefinito per l'input da testo a voce nella conversazione.",
   "modelProvider.upgradeForLoadBalancing": "Aggiorna il tuo piano per abilitare il Bilanciamento del Carico.",
+  "navigation.skipToMain": "Vai al contenuto principale",
   "noData": "Nessun dato",
   "operation.add": "Aggiungi",
   "operation.added": "Aggiunto",
@@ -600,9 +601,6 @@
   "placeholder.input": "Per favore inserisci",
   "placeholder.search": "Cerca...",
   "placeholder.select": "Per favore seleziona",
-  "plugin.serpapi.apiKey": "API Key",
-  "plugin.serpapi.apiKeyPlaceholder": "Inserisci la tua API key",
-  "plugin.serpapi.keyFrom": "Ottieni la tua API key dalla pagina dell'account SerpAPI",
   "promptEditor.context.item.desc": "Inserisci modello di contesto",
   "promptEditor.context.item.title": "Contesto",
   "promptEditor.context.modal.add": "Aggiungi Contesto ",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
new file mode 100644
index 00000000000..867c3cfad4b
--- /dev/null
+++ b/web/i18n/it-IT/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API del servizio backend",
+  "access.api.copyCurlExample": "Copia esempio cURL",
+  "access.api.createFailed": "Impossibile generare l'API Token.",
+  "access.api.createKey": "Genera API Token",
+  "access.api.createKeyTitle": "Genera nuovo API Token",
+  "access.api.curlExampleTitle": "Esempio cURL",
+  "access.api.description": "Accedi a questa distribuzione tramite HTTP. Ogni API Token è limitato a un ambiente.",
+  "access.api.developerTitle": "API per sviluppatori",
+  "access.api.disabled": "L'accesso API è disattivato per questa distribuzione.",
+  "access.api.disabledHint": "Abilita l'accesso API per generare token limitati all'ambiente.",
+  "access.api.dismissToken": "Chiudi API Token",
+  "access.api.docs": "Documentazione API",
+  "access.api.docsClose": "Chiudi documentazione API",
+  "access.api.docsDescription": "Visualizza il riferimento dell'API Workflow per questa distribuzione.",
+  "access.api.docsTitle": "Documentazione dell'API Workflow",
+  "access.api.empty": "Distribuisci prima in un ambiente per iniziare a emettere API Token.",
+  "access.api.emptyTitle": "Nessun ambiente distribuito",
+  "access.api.endpoint": "URL della richiesta",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Elenco API Token",
+  "access.api.nameLabel": "Nome dell'API Token",
+  "access.api.namePlaceholder": "Inserisci un nome per l'API Token",
+  "access.api.nameRequired": "Il nome dell'API Token è obbligatorio.",
+  "access.api.newKey": "Genera nuovo API Token",
+  "access.api.newTokenDescription": "Questo API Token viene mostrato una sola volta. Copialo prima di lasciare questa pagina.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token generato",
+  "access.api.noKeys": "Ancora nessun API Token. Generane uno per iniziare a chiamare l'API.",
+  "access.api.noKeysTitle": "Ancora nessun API Token",
+  "access.api.revokeConfirmDescription": "L'API Token \"{{name}}\" smetterà di funzionare immediatamente. Questa azione non può essere annullata.",
+  "access.api.revokeConfirmTitle": "Revocare l'API Token?",
+  "access.api.revokeFailed": "Impossibile revocare l'API Token.",
+  "access.api.revokeSuccess": "API Token revocato",
+  "access.api.table.action": "Azione",
+  "access.api.table.environment": "Ambiente",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Nome",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Canale",
+  "access.channels.col.endpoint": "Punto di ingresso",
+  "access.channels.col.status": "Stato",
+  "access.channels.description": "I punti di ingresso WebApp e CLI utilizzano le autorizzazioni di accesso sopra.",
+  "access.channels.disabled": "I canali di accesso sono disattivati per questa distribuzione.",
+  "access.channels.disabledHint": "Abilita i canali di accesso per esporre i punti di ingresso WebApp e CLI.",
+  "access.channels.followPermission": "Segue le autorizzazioni",
+  "access.channels.title": "Canali di accesso",
+  "access.cli.description": "Esegui dal terminale con difyctl, adatto per script, flussi di lavoro automatizzati o integrazioni con Agent.",
+  "access.cli.docs": "Guida all'uso",
+  "access.cli.domain": "Dominio",
+  "access.cli.empty": "Endpoint CLI non configurato.",
+  "access.cli.install": "Installa CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Copiato",
+  "access.copy": "Copia",
+  "access.copyFailed": "Copia non riuscita",
+  "access.copyToast": "Copiato negli appunti",
+  "access.hide": "Nascondi",
+  "access.members.clearAll": "Cancella tutto",
+  "access.members.empty": "Nessuna corrispondenza trovata.",
+  "access.members.groupCount_one": "{{count}} gruppo",
+  "access.members.groupCount_other": "{{count}} gruppi",
+  "access.members.groups": "Gruppi",
+  "access.members.individuals": "Membri",
+  "access.members.memberCount_one": "{{count}} membro",
+  "access.members.memberCount_other": "{{count}} membri",
+  "access.members.pickPlaceholder": "Seleziona gruppi o membri",
+  "access.members.searchPlaceholder": "Cerca gruppi e membri",
+  "access.members.selectedLabel": "Selezionati",
+  "access.permission.anyone": "Chiunque abbia il link",
+  "access.permission.anyoneDesc": "Chiunque può accedere a questa distribuzione senza effettuare l'accesso.",
+  "access.permission.memberCount_one": "{{count}} membro",
+  "access.permission.memberCount_other": "{{count}} membri",
+  "access.permission.organization": "Tutti i membri della piattaforma",
+  "access.permission.organizationDesc": "Tutti i membri della piattaforma",
+  "access.permission.specific": "Membri specifici della piattaforma",
+  "access.permission.specificDesc": "Seleziona gruppi o membri specifici",
+  "access.permission.specificUnavailable": "La selezione di membri specifici è disabilitata finché non sono collegati membri e gruppi reali della piattaforma.",
+  "access.permission.updateFailed": "Impossibile aggiornare la policy di accesso.",
+  "access.permissions.col.environment": "Ambiente",
+  "access.permissions.col.permission": "Accesso",
+  "access.permissions.description": "Imposta le autorizzazioni di accesso per i punti di ingresso WebApp e CLI in ogni ambiente.",
+  "access.permissions.editAriaLabel": "Configura l'accesso per {{environment}}",
+  "access.permissions.editDescription": "Imposta le autorizzazioni di accesso per i punti di ingresso WebApp e CLI.",
+  "access.permissions.editTitle": "Autorizzazioni di accesso",
+  "access.permissions.title": "Autorizzazioni di accesso",
+  "access.revoke": "Revoca",
+  "access.runAccess.description": "Gestisci come gli utenti possono eseguire questa distribuzione e chi può accedervi per ogni ambiente.",
+  "access.runAccess.disabled": "L'accesso in esecuzione è disattivato per questa distribuzione.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Espone questa distribuzione come server Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Endpoint MCP non configurato.",
+  "access.runAccess.noEnvs": "Distribuisci in un ambiente per configurare le autorizzazioni di accesso.",
+  "access.runAccess.noEnvsTitle": "Nessun ambiente distribuito",
+  "access.runAccess.openWebapp": "Apri WebApp",
+  "access.runAccess.permissions": "Autorizzazioni di accesso",
+  "access.runAccess.permissionsDesc": "Chi può accedere a questa distribuzione in ogni ambiente.",
+  "access.runAccess.title": "Accesso in esecuzione",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Pagina web ospitata per gli utenti finali.",
+  "access.runAccess.webappEmpty": "Prossimamente.",
+  "access.show": "Mostra",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Esterno",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Sconosciuto",
+  "card.access.api": "API Token",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Nessun accesso",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Crea prima release",
+  "card.deploy": "Distribuisci",
+  "card.deploying": "{{count}} in distribuzione",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} non riuscite",
+  "card.fromApp": "Da {{name}}",
+  "card.lastDeployed": "Ultima distribuzione {{time}}",
+  "card.menu.delete": "Elimina distribuzione",
+  "card.menu.deleteDisabled": "L'eliminazione delle distribuzioni non è ancora disponibile per le distribuzioni gestite dal backend.",
+  "card.menu.deploy": "Distribuisci nell'ambiente",
+  "card.menu.editInfo": "Modifica informazioni",
+  "card.menu.viewDetail": "Visualizza dettagli distribuzione",
+  "card.moreActions": "Altre azioni",
+  "card.neverDeployed": "Non ancora distribuito",
+  "card.noDescription": "Nessuna descrizione fornita.",
+  "card.notDeployed": "Non distribuito",
+  "card.ready": "{{count}} in esecuzione",
+  "card.tooltip.createdAt": "Creato",
+  "card.tooltip.deployed": "Distribuito",
+  "card.tooltip.deploymentStatus": "Distribuzione",
+  "card.tooltip.notDeployed": "Questa distribuzione non è ancora stata distribuita in alcun ambiente.",
+  "card.tooltip.notDeployedShort": "Non distribuito",
+  "card.tooltip.release": "Release",
+  "card.tooltip.releaseName": "Nome release",
+  "card.tooltip.source": "Origine",
+  "common.loadFailed": "Caricamento non riuscito. Riprova più tardi.",
+  "common.loading": "Caricamento...",
+  "createGuide.actions.back": "Indietro",
+  "createGuide.actions.cancel": "Annulla",
+  "createGuide.actions.continue": "Continua",
+  "createGuide.actions.createAndDeploy": "Crea e distribuisci",
+  "createGuide.actions.creating": "Creazione in corso...",
+  "createGuide.actions.deploy": "Distribuisci",
+  "createGuide.actions.deploying": "Creazione e distribuzione in corso...",
+  "createGuide.actions.next": "Avanti",
+  "createGuide.actions.skipDeploy": "Salta, distribuisci più tardi",
+  "createGuide.description": "Crea una distribuzione da un'origine di release, informazioni di base e ambiente di destinazione.",
+  "createGuide.dsl.defaultAppName": "App DSL importata",
+  "createGuide.dsl.description": "Carica un pacchetto DSL Workflow per creare la distribuzione, la prima release e l'eventuale distribuzione nell'ambiente.",
+  "createGuide.dsl.dropDescription": "Carica un pacchetto DSL Workflow YAML. Le opzioni di distribuzione vengono risolte da questo file prima della distribuzione.",
+  "createGuide.dsl.dropTitle": "Carica pacchetto DSL Workflow",
+  "createGuide.dsl.readFailed": "Impossibile leggere il file DSL. Scegli un altro file e riprova.",
+  "createGuide.dsl.reading": "Lettura del file DSL in corso...",
+  "createGuide.dsl.title": "Importa DSL",
+  "createGuide.dsl.unsupportedMode": "Per le distribuzioni possono essere utilizzati solo file DSL Workflow.",
+  "createGuide.errors.createReleaseFailed": "Impossibile creare la distribuzione o la release.",
+  "createGuide.errors.deployFailed": "Impossibile distribuire nell'ambiente.",
+  "createGuide.method.description": "Scegli l'origine usata per creare la prima release.",
+  "createGuide.methods.bindApp.description": "Utilizza un'app Workflow esistente in Studio come origine della release.",
+  "createGuide.methods.bindApp.title": "Collega app Workflow esistente",
+  "createGuide.methods.importDsl.description": "Carica un pacchetto DSL Workflow YAML e procedi attraverso l'interfaccia di distribuzione.",
+  "createGuide.methods.importDsl.title": "Importa DSL",
+  "createGuide.methods.mocked": "Simulato",
+  "createGuide.nav.back": "Distribuzioni",
+  "createGuide.release.defaultName": "release iniziale",
+  "createGuide.release.deployInfo": "Informazioni distribuzione",
+  "createGuide.release.description": "Compila le informazioni sulla distribuzione e i dettagli della prima release.",
+  "createGuide.release.firstVersion": "Prima release",
+  "createGuide.release.instanceDescription": "Descrizione distribuzione",
+  "createGuide.release.instanceDescriptionPlaceholder": "Descrivi a cosa serve questa distribuzione",
+  "createGuide.release.instanceName": "Nome distribuzione",
+  "createGuide.release.instanceNameConflict": "Esiste già una distribuzione con questo nome. Scegli un altro nome.",
+  "createGuide.release.releaseDescription": "Descrizione release",
+  "createGuide.release.releaseDescriptionPlaceholder": "Descrivi questa release",
+  "createGuide.release.releaseName": "Nome release",
+  "createGuide.release.releaseNote": "Descrizione release",
+  "createGuide.release.title": "Informazioni di base",
+  "createGuide.source.availableApps_one": "{{count}} app",
+  "createGuide.source.availableApps_other": "{{count}} app",
+  "createGuide.source.clearSearch": "Cancella ricerca app",
+  "createGuide.source.description": "Scegli l'origine usata per creare la prima release.",
+  "createGuide.source.empty": "Nessuna app Workflow trovata.",
+  "createGuide.source.searchPlaceholder": "Cerca app",
+  "createGuide.source.sourceApp": "App Workflow",
+  "createGuide.source.title": "Origine release",
+  "createGuide.steps.method": "Origine release",
+  "createGuide.steps.release": "Informazioni di base",
+  "createGuide.steps.source": "Origine release",
+  "createGuide.steps.target": "Distribuisci nell'ambiente",
+  "createGuide.target.bindingCount_one": "{{count}} binding",
+  "createGuide.target.bindingCount_other": "{{count}} binding",
+  "createGuide.target.bindingHint": "Scegli le credenziali utilizzate da questa release.",
+  "createGuide.target.bindings": "Credenziali",
+  "createGuide.target.deferredBindingHint": "Le credenziali verranno risolte dal piano di distribuzione reale durante l'azione finale di distribuzione.",
+  "createGuide.target.deferredEnvironmentHint": "Il nome viene confrontato con gli ambienti reali dopo la creazione della distribuzione e della release.",
+  "createGuide.target.description": "Scegli un ambiente di destinazione e fornisci le impostazioni runtime di cui questa release ha bisogno. Questo passaggio può essere saltato.",
+  "createGuide.target.envVarCount_one": "{{count}} variabile",
+  "createGuide.target.envVarCount_other": "{{count}} variabili",
+  "createGuide.target.envVarHint": "Per ogni variabile d'ambiente di cui questa release ha bisogno, inserisci un valore personalizzato o usa il valore definito nell'app.",
+  "createGuide.target.envVarPlaceholder": "Inserisci valore",
+  "createGuide.target.envVarSource.ariaLabel": "Seleziona l'origine del valore della variabile per {{key}}",
+  "createGuide.target.envVarSource.default": "Valore dell'app",
+  "createGuide.target.envVarSource.lastDeployment": "Ultimo valore distribuito",
+  "createGuide.target.envVarSource.literal": "Valore personalizzato",
+  "createGuide.target.envVarType.number": "Numero",
+  "createGuide.target.envVarType.secret": "Segreto",
+  "createGuide.target.envVarType.string": "Stringa",
+  "createGuide.target.envVars": "Variabili d'ambiente",
+  "createGuide.target.environment": "Ambiente di destinazione",
+  "createGuide.target.environmentName": "Nome ambiente",
+  "createGuide.target.environmentNamePlaceholder": "Produzione",
+  "createGuide.target.loadBindingsFailed": "Impossibile caricare le credenziali.",
+  "createGuide.target.loadEnvironmentsFailed": "Impossibile caricare gli ambienti di distribuzione.",
+  "createGuide.target.missingRequiredBinding": "Seleziona una credenziale per questo binding obbligatorio.",
+  "createGuide.target.noBindingRequired": "Nessuna credenziale richiesta.",
+  "createGuide.target.noCredentialCandidates": "Nessuna credenziale disponibile.",
+  "createGuide.target.noEnvironmentOptions": "Nessun ambiente di distribuzione disponibile.",
+  "createGuide.target.required": "Obbligatorio",
+  "createGuide.target.selectCredential": "Seleziona una credenziale",
+  "createGuide.target.title": "Distribuisci nell'ambiente",
+  "createGuide.title": "Nuova distribuzione",
+  "createModal.appPickerPlaceholder": "Seleziona un'app Workflow",
+  "createModal.appSearchEmpty": "Nessuna app Workflow corrispondente",
+  "createModal.appSearchPlaceholder": "Cerca app Workflow…",
+  "createModal.cancel": "Annulla",
+  "createModal.create": "Crea",
+  "createModal.createFailed": "Impossibile creare la distribuzione.",
+  "createModal.description": "Scegli un'app Workflow e crea una distribuzione.",
+  "createModal.descriptionLabel": "Descrizione",
+  "createModal.descriptionPlaceholder": "Descrivi a cosa serve questa distribuzione",
+  "createModal.loadMoreApps": "Carica altre app",
+  "createModal.loadingApps": "Caricamento app…",
+  "createModal.nameLabel": "Nome distribuzione",
+  "createModal.namePlaceholder": "Nome distribuzione",
+  "createModal.noApps": "Nessuna app Workflow trovata in questo workspace. Creane prima una in Studio.",
+  "createModal.selected": "Selezionata",
+  "createModal.sourceApp": "App Workflow (obbligatorio)",
+  "createModal.title": "Nuova distribuzione",
+  "deployDrawer.bindingCount_one": "{{count}} binding",
+  "deployDrawer.bindingCount_other": "{{count}} binding",
+  "deployDrawer.bindingOptionsFailed": "Impossibile caricare le opzioni delle credenziali.",
+  "deployDrawer.bindingSelectionHint": "Scegli le credenziali utilizzate da questa distribuzione.",
+  "deployDrawer.bindingsDisabled": "Risolto dall'anteprima della release. La modifica non è ancora disponibile.",
+  "deployDrawer.cancel": "Annulla",
+  "deployDrawer.close": "Chiudi pannello distribuzione",
+  "deployDrawer.defaultSelect": "Seleziona...",
+  "deployDrawer.deploy": "Distribuisci nell'ambiente",
+  "deployDrawer.deployExistingRelease": "Distribuisci nell'ambiente",
+  "deployDrawer.deployExistingReleaseDescription": "Seleziona una release e un ambiente di destinazione da distribuire.",
+  "deployDrawer.deployExistingReleaseTitle": "Distribuisci nell'ambiente",
+  "deployDrawer.deployFailed": "Impossibile avviare la distribuzione.",
+  "deployDrawer.deploying": "Distribuzione in corso...",
+  "deployDrawer.description": "Seleziona una release e un ambiente di destinazione da distribuire.",
+  "deployDrawer.envVarCount_one": "{{count}} variabile",
+  "deployDrawer.envVarCount_other": "{{count}} variabili",
+  "deployDrawer.envVarHint": "Per ogni variabile d'ambiente di cui questa release ha bisogno, inserisci un valore personalizzato o usa il valore definito nell'app.",
+  "deployDrawer.envVarPlaceholder": "Inserisci valore",
+  "deployDrawer.envVarSource.ariaLabel": "Seleziona l'origine del valore della variabile per {{key}}",
+  "deployDrawer.envVarSource.default": "Valore dell'app",
+  "deployDrawer.envVarSource.lastDeployment": "Ultimo valore distribuito",
+  "deployDrawer.envVarSource.literal": "Valore personalizzato",
+  "deployDrawer.envVarType.number": "Numero",
+  "deployDrawer.envVarType.secret": "Segreto",
+  "deployDrawer.envVarType.string": "Stringa",
+  "deployDrawer.envVars": "Variabili d'ambiente",
+  "deployDrawer.existingReleaseHint": "Questa release verrà distribuita così com'è. Non verrà creata alcuna nuova release.",
+  "deployDrawer.loadingBindings": "Risoluzione in corso...",
+  "deployDrawer.lockedHint": "Bloccato all'ambiente corrente",
+  "deployDrawer.missingRequiredBinding": "Seleziona una credenziale per questo binding obbligatorio.",
+  "deployDrawer.missingRequiredEnvVar": "Inserisci un valore per questa variabile d'ambiente obbligatoria.",
+  "deployDrawer.modelCreds": "Credenziali del modello",
+  "deployDrawer.needsValidation": " (richiede convalida)",
+  "deployDrawer.newReleaseHint": "Verrà creata una nuova release dal YAML dell'app Workflow selezionata.",
+  "deployDrawer.noBindingRequired": "Non richiesto",
+  "deployDrawer.noCredentialCandidates": "Nessuna credenziale disponibile.",
+  "deployDrawer.noNewEnvironmentAvailable": "Tutti gli ambienti disponibili hanno già una distribuzione.",
+  "deployDrawer.noOtherReleaseAvailable": "Nessun'altra release disponibile per questo ambiente.",
+  "deployDrawer.noReleaseAvailable": "Crea una release prima di distribuire in un ambiente.",
+  "deployDrawer.notFound": "Distribuzione non trovata.",
+  "deployDrawer.noteLabel": "Descrizione release (opzionale)",
+  "deployDrawer.notePlaceholder": "es. Modifica testo di onboarding",
+  "deployDrawer.pluginCreds": "Credenziali plugin",
+  "deployDrawer.promote": "Distribuisci",
+  "deployDrawer.promoteDescription": "Seleziona una release e un ambiente di destinazione da distribuire.",
+  "deployDrawer.promoteTitle": "Distribuisci nell'ambiente",
+  "deployDrawer.readOnly": "Sola lettura",
+  "deployDrawer.redeploy": "Distribuisci nell'ambiente",
+  "deployDrawer.redeployDescription": "Seleziona una release e un ambiente di destinazione da distribuire.",
+  "deployDrawer.redeployExistingReleaseHint": "La release corrente verrà ridistribuita così com'è. Non verrà creata alcuna nuova release.",
+  "deployDrawer.redeployTitle": "Distribuisci nell'ambiente",
+  "deployDrawer.releaseLabel": "Release",
+  "deployDrawer.requiredBinding": "Obbligatorio",
+  "deployDrawer.rollback": "Distribuisci",
+  "deployDrawer.rollbackDescription": "Seleziona una release e un ambiente di destinazione da distribuire.",
+  "deployDrawer.rollbackTitle": "Distribuisci nell'ambiente",
+  "deployDrawer.runtimeCredentials": "Credenziali",
+  "deployDrawer.secretPlaceholder": "segreto",
+  "deployDrawer.selectCredential": "Seleziona una credenziale",
+  "deployDrawer.selectEnv": "Seleziona un ambiente",
+  "deployDrawer.selectProviderCred": "Seleziona credenziale {{provider}}",
+  "deployDrawer.selectProviderKey": "Seleziona chiave {{provider}}",
+  "deployDrawer.selectRelease": "Seleziona una release",
+  "deployDrawer.targetEnv": "Ambiente di destinazione",
+  "deployDrawer.title": "Distribuisci nell'ambiente",
+  "deployDrawer.valuePlaceholder": "valore",
+  "deployTab.cancelDeployment": "Annulla distribuzione",
+  "deployTab.closeError": "Chiudi",
+  "deployTab.col.actions": "Azioni",
+  "deployTab.col.currentRelease": "Release corrente",
+  "deployTab.col.environment": "Ambiente",
+  "deployTab.col.status": "Stato",
+  "deployTab.col.updated": "Aggiornato",
+  "deployTab.collapseDetails": "Comprimi dettagli distribuzione",
+  "deployTab.confirmUndeploy": "Annulla distribuzione",
+  "deployTab.deployOtherVersion": "Distribuisci un'altra release",
+  "deployTab.deployToEnv": "Distribuisci in {{name}}",
+  "deployTab.deployToNewEnv": "Distribuisci in un nuovo ambiente...",
+  "deployTab.empty": "Ancora nessuna istanza. Distribuisci in un nuovo ambiente per iniziare.",
+  "deployTab.emptyDescription": "Scegli una release e un ambiente di destinazione per rendere disponibile questa distribuzione agli utenti.",
+  "deployTab.emptyTitle": "Nessun ambiente ancora in esecuzione",
+  "deployTab.envCount": "Ambienti",
+  "deployTab.errorCode": "Codice",
+  "deployTab.errorDialogDesc": "Esamina l'ultima distribuzione non riuscita prima di riprovare o distribuire un'altra release.",
+  "deployTab.errorDialogTitle": "Errore di distribuzione in {{name}}",
+  "deployTab.errorMessage": "Messaggio",
+  "deployTab.errorPhase": "Fase",
+  "deployTab.expandDetails": "Espandi dettagli distribuzione",
+  "deployTab.moreActions": "Altre azioni",
+  "deployTab.newDeployment": "Distribuisci in un nuovo ambiente",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "ID distribuzione",
+  "deployTab.panel.endpoints": "Endpoint",
+  "deployTab.panel.envVars": "Variabili d'ambiente",
+  "deployTab.panel.error": "Errore",
+  "deployTab.panel.failedRelease": "Release non riuscita",
+  "deployTab.panel.health": "Integrità",
+  "deployTab.panel.instanceInfo": "Informazioni istanza",
+  "deployTab.panel.modelCreds": "Credenziali del modello",
+  "deployTab.panel.pluginCreds": "Credenziali plugin",
+  "deployTab.panel.release": "Release",
+  "deployTab.panel.releaseCreatedAt": "Release creata il",
+  "deployTab.panel.releaseInfo": "Informazioni release",
+  "deployTab.panel.replicas": "Repliche",
+  "deployTab.panel.run": "Esegui",
+  "deployTab.panel.runtimeBindings": "Credenziali",
+  "deployTab.panel.runtimeInfo": "Informazioni runtime",
+  "deployTab.panel.runtimeMode": "Modalità runtime",
+  "deployTab.panel.runtimeNote": "Nota runtime",
+  "deployTab.panel.targetRelease": "Release di destinazione",
+  "deployTab.panel.unknownError": "Distribuzione non riuscita.",
+  "deployTab.promote": "Distribuisci",
+  "deployTab.redeploy": "Ridistribuisci",
+  "deployTab.releaseCreatedAt": "Release creata {{time}}",
+  "deployTab.retry": "Riprova",
+  "deployTab.shortcut": "Scorciatoia",
+  "deployTab.status.deployFailed": "Distribuzione non riuscita",
+  "deployTab.status.deployingRelease": "Distribuzione in corso ({{release}})",
+  "deployTab.status.runningOutOfSync": "In esecuzione (sincronizzazione in sospeso)",
+  "deployTab.status.runningWithFailed": "In esecuzione (ultima distribuzione non riuscita)",
+  "deployTab.undeploy": "Annulla distribuzione",
+  "deployTab.undeployConfirmDesc": "L'accesso degli utenti finali verrà interrotto immediatamente. La release potrà essere ridistribuita successivamente.",
+  "deployTab.undeployConfirmTitle": "Annullare la distribuzione da {{name}}?",
+  "deployTab.undeployFrom": "Annulla distribuzione da {{name}}",
+  "deployTab.undeployImpactTitle": "Istanza interessata",
+  "deployTab.viewError": "Visualizza errore",
+  "deployTab.viewLogs": "Visualizza log",
+  "deployTab.viewProgress": "Visualizza avanzamento",
+  "detail.backToInstances": "Torna alle distribuzioni",
+  "detail.deployingCount": "{{count}} in distribuzione",
+  "detail.envCount_one": "{{count}} ambiente",
+  "detail.envCount_other": "{{count}} ambienti",
+  "detail.failedCount": "{{count}} non riuscite",
+  "detail.mobileTabs": "Sezioni distribuzione",
+  "detail.notFound": "Distribuzione non trovata",
+  "detail.openSourceApp": "Apri origine {{name}}",
+  "detail.sourceApp": "Origine",
+  "detail.sourceAppLink": "Origine",
+  "documentTitle.create": "Nuova distribuzione · Distribuzioni",
+  "documentTitle.detail": "Distribuzione · Distribuzioni",
+  "documentTitle.list": "Distribuzioni",
+  "filter.allEnvs": "Tutti gli ambienti",
+  "filter.notDeployed": "Non distribuito",
+  "filter.searchPlaceholder": "Cerca distribuzioni",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Ammissione",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Avvio",
+  "health.ENVIRONMENT_STATUS_DELETING": "Eliminazione",
+  "health.ENVIRONMENT_STATUS_FAILED": "Non disponibile",
+  "health.ENVIRONMENT_STATUS_READY": "Disponibile",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Sconosciuto",
+  "list.clearFilters": "Cancella filtri",
+  "list.clearSearch": "Cancella ricerca distribuzioni",
+  "list.createDeployment": "Nuova",
+  "list.empty": "Nessuna distribuzione trovata.",
+  "list.emptyDescription": "Crea una distribuzione da un'app Workflow o da un pacchetto DSL Workflow per gestire release, ambienti e accessi.",
+  "list.emptyFilteredDescription": "Nessuna distribuzione corrisponde alla ricerca o al filtro per ambiente correnti.",
+  "list.emptyFilteredTitle": "Nessuna distribuzione corrispondente",
+  "list.emptyTitle": "Ancora nessuna distribuzione",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Isolato",
+  "mode.ENVIRONMENT_MODE_SHARED": "Condiviso",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Sconosciuto",
+  "newInstance.comingSoon": "Prossimamente",
+  "newInstance.fromStudio": "Seleziona da Studio",
+  "newInstance.importDSL": "Importa DSL",
+  "newInstance.title": "Nuova distribuzione",
+  "overview.accessEndpoints": "Endpoint di accesso",
+  "overview.accessMeta.apiTokens": "Gestisci API Token",
+  "overview.accessMeta.cli": "Visualizza accesso CLI",
+  "overview.accessMeta.webApp": "Gestisci accesso WebApp",
+  "overview.accessStatus": "Accesso",
+  "overview.api": "API Token",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Token",
+  "overview.apiTokenSummary.environments_one": "{{count}} ambiente distribuito",
+  "overview.apiTokenSummary.environments_other": "{{count}} ambienti distribuiti",
+  "overview.availableForDeployment": "Disponibile per la distribuzione",
+  "overview.basicInfo": "Informazioni di base",
+  "overview.cardAction.deployLatest": "Distribuisci l'ultima release",
+  "overview.cardAction.redeploy": "Ridistribuisci",
+  "overview.cardAction.viewProgress": "Visualizza distribuzione",
+  "overview.chip.behindTooltip_one": "1 release indietro rispetto all'ultima. Distribuisci l'ultima release per aggiornare.",
+  "overview.chip.behindTooltip_other": "{{count}} release indietro rispetto all'ultima. Distribuisci l'ultima release per aggiornare.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "in distribuzione",
+  "overview.chip.deployingTooltip": "La distribuzione è in corso.",
+  "overview.chip.empty": "vuoto",
+  "overview.chip.emptyTooltip": "Nessuna release è distribuita in questo ambiente.",
+  "overview.chip.failed": "non riuscita",
+  "overview.chip.failedTooltip": "L'ultimo tentativo di distribuzione non è riuscito.",
+  "overview.chip.latest": "più recente",
+  "overview.chip.latestTooltip": "Questo ambiente sta eseguendo l'ultima release.",
+  "overview.chip.needsReleaseFirst": "Crea prima una release",
+  "overview.chip.olderRelease": "precedente",
+  "overview.chip.olderReleaseTooltip": "Questo ambiente sta eseguendo una release precedente.",
+  "overview.chip.openInDeployTab": "Visualizza avanzamento distribuzione",
+  "overview.cli": "CLI",
+  "overview.configured": "Configurato",
+  "overview.createRelease": "Crea release",
+  "overview.created": "Creato",
+  "overview.deploy": "Distribuisci",
+  "overview.deployedEnvironments": "distribuiti",
+  "overview.deploymentOverview": "Panoramica distribuzione",
+  "overview.deploymentStatus": "Stato distribuzione",
+  "overview.description": "Descrizione",
+  "overview.developerApi": "API per sviluppatori",
+  "overview.disabled": "Disabilitato",
+  "overview.emptyValue": "Non impostato",
+  "overview.enabled": "Abilitato",
+  "overview.enabledChannels": "accesso abilitato",
+  "overview.endUserAccess": "Accesso utente finale",
+  "overview.environments": "Ambienti",
+  "overview.hero.byName": "da {{name}}",
+  "overview.hero.empty": "Ancora nessuna release",
+  "overview.hero.emptyDescription": "Crea una release dall'origine corrente prima di distribuire.",
+  "overview.hero.propagation_one": "distribuito in {{count}}/{{total}} ambiente",
+  "overview.hero.propagation_other": "distribuito in {{count}}/{{total}} ambienti",
+  "overview.hero.untargeted": "nessun ambiente ancora configurato",
+  "overview.instanceDetails": "Dettagli distribuzione",
+  "overview.instanceId": "ID distribuzione",
+  "overview.latestRelease.releaseCount_one": "{{count}} release",
+  "overview.latestRelease.releaseCount_other": "{{count}} release",
+  "overview.latestReleaseTitle": "Ultima release",
+  "overview.manageDeployments": "Gestisci distribuzioni",
+  "overview.name": "Nome",
+  "overview.noAccessConfig": "Nessuna configurazione di accesso.",
+  "overview.noReleaseYet": "Crea una release prima di distribuire in un ambiente.",
+  "overview.notConfigured": "Non configurato",
+  "overview.previousReleases.empty": "Ancora nessuna release precedente.",
+  "overview.previousReleases.retired": "Non attualmente distribuita",
+  "overview.previousReleases.title": "Release precedenti",
+  "overview.previousReleases.viewAll": "Visualizza tutte",
+  "overview.ready": "Distribuibile",
+  "overview.recentReleases": "Release recenti",
+  "overview.releaseDeployedTitle": "{{release}} è distribuita",
+  "overview.releaseReadyTitle": "{{release}} è pronta per essere distribuita",
+  "overview.serviceMap": "Mappa servizi",
+  "overview.servingRelease": "Serve {{release}}",
+  "overview.servingReleaseDescription": "Questa distribuzione è distribuita in {{count}}/{{total}} ambienti.",
+  "overview.strip.deployToNewEnvironment": "Distribuisci in un nuovo ambiente",
+  "overview.strip.empty": "Nessun ambiente configurato.",
+  "overview.strip.emptyDeployableDescription": "Distribuisci l'ultima release in un ambiente quando sei pronto.",
+  "overview.strip.emptyDeployed": "Ancora nessuna istanza.",
+  "overview.strip.emptyDescription": "Crea una release prima di distribuire in un ambiente.",
+  "overview.strip.emptyTitle": "Ancora nessuna istanza",
+  "overview.strip.summary_one": "1 di {{total}} sull'ultima release",
+  "overview.strip.summary_other": "{{count}} di {{total}} sull'ultima release",
+  "overview.strip.title": "Istanze",
+  "overview.switchSourceApp": "Cambia origine",
+  "overview.switchSourceAppDescription": "Scegli l'app Workflow utilizzata come origine per le release future.",
+  "overview.switchSourceAppHint": "Dopo il cambio, solo le release create successivamente utilizzeranno la nuova origine. Le release storiche e le distribuzioni esistenti non vengono modificate.",
+  "overview.targetRelease": "Release di destinazione",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Zona pericolosa",
+  "settings.dangerDesc": "Elimina definitivamente questa distribuzione e interrompi tutte le istanze in esecuzione. Non può essere annullato.",
+  "settings.delete": "Elimina distribuzione",
+  "settings.deleteConfirmDesc": "Eliminare {{name}}? Ogni istanza smetterà di funzionare e verrà rimossa da tutti gli ambienti. Non può essere annullato.",
+  "settings.deleteConfirmTitle": "Elimina distribuzione",
+  "settings.deleteFailed": "Impossibile eliminare la distribuzione.",
+  "settings.deleteImpact": "Impatto",
+  "settings.deleteImpactInstance": "Distribuzione",
+  "settings.deleteImpactTitle": "Distribuzione interessata",
+  "settings.deleteImpactValue": "La distribuzione viene rimossa dall'elenco delle distribuzioni.",
+  "settings.deleted": "Distribuzione eliminata",
+  "settings.description": "Descrizione",
+  "settings.descriptionHelp": "Gestisci nome, descrizione e altre impostazioni di questa distribuzione.",
+  "settings.general": "Generale",
+  "settings.name": "Nome distribuzione",
+  "settings.reset": "Reimposta",
+  "settings.save": "Salva modifiche",
+  "settings.updateFailed": "Impossibile aggiornare la distribuzione.",
+  "settings.updated": "Distribuzione aggiornata",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "In distribuzione",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sincronizzazione in sospeso",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Distribuzione non riuscita",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Non valido",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "In esecuzione",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non distribuito",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annullamento distribuzione",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Sconosciuto",
+  "subtitle": "Gestisci le distribuzioni tra gli ambienti.",
+  "tabs.access.description": "Gestisci i canali e le autorizzazioni di accesso.",
+  "tabs.access.name": "Accesso",
+  "tabs.api-tokens.description": "Gestisci API Token e richiama le istanze tramite HTTP.",
+  "tabs.api-tokens.name": "API Token",
+  "tabs.instances.description": "Visualizza e gestisci le istanze negli ambienti distribuiti.",
+  "tabs.instances.name": "Istanze",
+  "tabs.overview.description": "Visualizza lo stato della distribuzione tra gli ambienti.",
+  "tabs.overview.name": "Panoramica",
+  "tabs.releases.description": "Crea, distribuisci e gestisci le release.",
+  "tabs.releases.name": "Release",
+  "tabs.settings.description": "Gestisci nome, descrizione e altre impostazioni di questa distribuzione.",
+  "tabs.settings.name": "Impostazioni",
+  "title": "Distribuzioni",
+  "unsupportedDslNodes.description": "Questa release contiene nodi non ancora supportati dal runtime di distribuzione. Rimuovili o sostituiscili in Studio, quindi riprova.",
+  "unsupportedDslNodes.descriptionWithTypes": "Questa release contiene nodi non ancora supportati dal runtime di distribuzione: {{nodeTypes}}. Rimuovili o sostituiscili in Studio, quindi riprova.",
+  "unsupportedDslNodes.title": "Nodi non supportati",
+  "unsupportedDslNodes.unknownType": "Tipo sconosciuto",
+  "versions.cancelCreate": "Annulla",
+  "versions.cancelDelete": "Annulla",
+  "versions.cancelEdit": "Annulla",
+  "versions.checkingReleaseContent": "Verifica del contenuto della release in corso...",
+  "versions.col.action": "Azione",
+  "versions.col.author": "Creato da",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Creato il",
+  "versions.col.deployedTo": "Distribuito in",
+  "versions.col.release": "Release",
+  "versions.col.sourceApp": "Origine",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Crea",
+  "versions.createFailed": "Impossibile creare la release.",
+  "versions.createRelease": "Crea release",
+  "versions.createReleaseDescription": "Crea una release distribuibile da un'app Workflow o da un file DSL Workflow.",
+  "versions.createReleaseHint": "Le nuove release possono essere distribuite in qualsiasi ambiente.",
+  "versions.createSuccess": "Release \"{{name}}\" creata.",
+  "versions.creating": "Creazione in corso...",
+  "versions.currentOn": "Release corrente su {{name}}",
+  "versions.deleteConfirmDesc": "La release \"{{name}}\" verrà eliminata definitivamente. Non può essere annullato.",
+  "versions.deleteConfirmTitle": "Eliminare la release?",
+  "versions.deleteFailed": "Impossibile eliminare la release.",
+  "versions.deleteImpactDeployment": "Stato distribuzione",
+  "versions.deleteImpactNotDeployed": "Non attualmente distribuita",
+  "versions.deleteImpactRelease": "Release",
+  "versions.deleteImpactTitle": "Impatto eliminazione",
+  "versions.deleteRelease": "Elimina release",
+  "versions.deleteSuccess": "Release \"{{name}}\" eliminata.",
+  "versions.deploy": "Distribuisci",
+  "versions.deployTo": "Distribuisci in {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "In distribuzione",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sincronizzazione in sospeso",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Non riuscita",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Non valido",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "In esecuzione",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non distribuito",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annullamento distribuzione",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Sconosciuto",
+  "versions.deployingTo": "{{name}} è in distribuzione",
+  "versions.disabledReason.checkDeploymentsFailed": "Impossibile verificare l'utilizzo della distribuzione. Riprova più tardi.",
+  "versions.disabledReason.checkingDeployments": "Verifica utilizzo distribuzione",
+  "versions.disabledReason.current": "Questa release è già in esecuzione su {{name}}",
+  "versions.disabledReason.deploying": "Attendi il completamento della distribuzione attiva",
+  "versions.disabledReason.envDisabled": "Questo ambiente non è distribuibile",
+  "versions.disabledReason.releaseInUse_one": "Annulla la distribuzione di questa release da {{count}} ambiente prima di eliminarla",
+  "versions.disabledReason.releaseInUse_other": "Annulla la distribuzione di questa release da {{count}} ambienti prima di eliminarla",
+  "versions.dslReadFailed": "Impossibile leggere il file DSL. Scegli un altro file e riprova.",
+  "versions.dslReading": "Lettura del file DSL in corso...",
+  "versions.dslUnsupportedMode": "Per le distribuzioni possono essere utilizzati solo file DSL Workflow.",
+  "versions.editFailed": "Impossibile aggiornare la release.",
+  "versions.editRelease": "Modifica release",
+  "versions.editReleaseDescription": "Aggiorna il nome e la descrizione di questa release.",
+  "versions.editSuccess": "Release \"{{name}}\" aggiornata.",
+  "versions.empty": "Ancora nessuna release disponibile.",
+  "versions.emptyDescription": "Crea la prima release prima di distribuire in un ambiente.",
+  "versions.emptyTitle": "Ancora nessuna release",
+  "versions.emptyWithCreate": "Ancora nessuna release. Crea la prima release distribuibile prima di distribuire.",
+  "versions.exportDsl": "Esporta DSL",
+  "versions.exportDslFailed": "Impossibile esportare il DSL.",
+  "versions.exportingDsl": "Esportazione in corso...",
+  "versions.groupHeader.deploy": "Distribuisci",
+  "versions.groupHeader.promote": "Distribuisci",
+  "versions.groupHeader.rollback": "Distribuisci versione precedente",
+  "versions.groupHeader.unavailable": "Non disponibile",
+  "versions.manualDslOption": "Carica DSL",
+  "versions.moreActions": "Altre azioni",
+  "versions.optional": "Opzionale",
+  "versions.promote": "Distribuisci",
+  "versions.promoteTo": "Distribuisci in {{name}}",
+  "versions.releaseAlreadyExists": "Esiste già una release con lo stesso contenuto: {{name}}.",
+  "versions.releaseContentCheckFailed": "Impossibile verificare il contenuto della release.",
+  "versions.releaseDescriptionLabel": "Descrizione",
+  "versions.releaseDescriptionPlaceholder": "Descrivi questa release",
+  "versions.releaseHistory": "Cronologia release",
+  "versions.releaseNameLabel": "Nome release",
+  "versions.releaseNamePlaceholder": "Nome release",
+  "versions.releaseNameRequired": "Inserisci un nome per la release.",
+  "versions.releaseSourceLabel": "Origine release",
+  "versions.rollbackTo": "Distribuisci in {{name}}",
+  "versions.saveEdit": "Salva",
+  "versions.sourceAppOption": "App Workflow"
+}
diff --git a/web/i18n/it-IT/workflow.json b/web/i18n/it-IT/workflow.json
index 052025b82e4..799dd96c967 100644
--- a/web/i18n/it-IT/workflow.json
+++ b/web/i18n/it-IT/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "Agente",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Risposta",
   "blocks.assigner": "Assegnatore di Variabili",
   "blocks.code": "Codice",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Aggregatore Variabili",
   "blocks.variable-assigner": "Assegnatore Variabili",
   "blocksAbout.agent": "Richiamo di modelli linguistici di grandi dimensioni per rispondere a domande o elaborare il linguaggio naturale",
+  "blocksAbout.agent-v2": "Richiamo di modelli linguistici di grandi dimensioni per rispondere a domande o elaborare il linguaggio naturale",
   "blocksAbout.answer": "Definisci il contenuto della risposta di una conversazione chat",
   "blocksAbout.assigner": "Il nodo di assegnazione delle variabili è utilizzato per assegnare valori a variabili scrivibili (come le variabili di conversazione).",
   "blocksAbout.code": "Esegui un pezzo di codice Python o NodeJS per implementare la logica personalizzata",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID workflow",
   "globalVar.fieldsDescription.workflowRunId": "ID esecuzione workflow",
   "globalVar.title": "Variabili di sistema",
+  "nodes.agent.advancedSetting": "Impostazioni avanzate",
   "nodes.agent.checkList.strategyNotSelected": "Strategia non selezionata",
   "nodes.agent.clickToViewParameterSchema": "Clicca per visualizzare lo schema dei parametri",
   "nodes.agent.configureModel": "Configura modello",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Modello non supportato",
   "nodes.agent.modelSelectorTooltips.deprecated": "Questo modello è deprecato",
   "nodes.agent.notAuthorized": "Non autorizzato",
+  "nodes.agent.outputVars.confirm": "Conferma",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Inserisci un array JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Inserisci true o false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "I valori predefiniti per i file non sono ancora configurabili qui.",
+  "nodes.agent.outputVars.defaultValueLabel": "Predefinito",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Inserisci un numero valido.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Inserisci un oggetto JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Valore predefinito",
+  "nodes.agent.outputVars.delete": "Elimina {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Descrizione",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Aggiungi descrizione",
+  "nodes.agent.outputVars.edit": "Modifica {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Editor variabili di output",
   "nodes.agent.outputVars.files.title": "File generati dall'agente",
   "nodes.agent.outputVars.files.transfer_method": "Metodo di trasferimento. Il valore è remote_url o local_file",
   "nodes.agent.outputVars.files.type": "Tipo di supporto. Ora supporta solo l'immagine",
   "nodes.agent.outputVars.files.upload_file_id": "Carica l'ID del file",
   "nodes.agent.outputVars.files.url": "URL immagine",
   "nodes.agent.outputVars.json": "JSON generato dall'agente",
+  "nodes.agent.outputVars.nameDuplicate": "Il nome di output esiste già",
+  "nodes.agent.outputVars.nameInvalid": "Usa lettere, numeri e trattini bassi. Inizia con una lettera o un trattino basso.",
+  "nodes.agent.outputVars.nameLabel": "Nome del campo",
+  "nodes.agent.outputVars.namePlaceholder": "Nome del campo",
+  "nodes.agent.outputVars.newOutput": "Nuovo output",
+  "nodes.agent.outputVars.requiredLabel": "Obbligatorio",
+  "nodes.agent.outputVars.showAdvancedOptions": "Mostra opzioni avanzate",
   "nodes.agent.outputVars.text": "Contenuto generato dall'agente",
+  "nodes.agent.outputVars.typeLabel": "Tipo di output",
   "nodes.agent.outputVars.usage": "Informazioni sull'utilizzo del modello",
   "nodes.agent.parameterSchema": "Schema dei parametri",
   "nodes.agent.pluginInstaller.install": "Installare",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Questo integrazione viene installato da GitHub. Vai su Integrazione per reinstallare",
   "nodes.agent.pluginNotInstalled": "Questo integrazione non è installato",
   "nodes.agent.pluginNotInstalledDesc": "Questo integrazione viene installato da GitHub. Vai su Integrazione per reinstallare",
+  "nodes.agent.roster.change": "Cambia",
+  "nodes.agent.roster.editInConsole": "Modifica in Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Una configurazione una tantum che vive solo in questo nodo",
+  "nodes.agent.roster.inlineSetup.name": "Configurazione inline",
+  "nodes.agent.roster.inlineSetup.title": "Configurazione dell’agente",
+  "nodes.agent.roster.inlineSetup.type": "Solo in questo nodo",
+  "nodes.agent.roster.label": "Agente",
+  "nodes.agent.roster.makeCopy": "Crea una copia",
+  "nodes.agent.roster.more": "Altre azioni dell’agente",
+  "nodes.agent.roster.openPanel": "Apri i dettagli di {{name}}",
+  "nodes.agent.roster.panelLabel": "Dettagli di {{name}}",
   "nodes.agent.strategy.configureTip": "Configurare la strategia agentic.",
   "nodes.agent.strategy.configureTipDesc": "Dopo aver configurato la strategia agentic, questo nodo caricherà automaticamente le configurazioni rimanenti. La strategia influenzerà il meccanismo del ragionamento con strumenti a più fasi.",
   "nodes.agent.strategy.label": "Strategia agentica",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "La versione del integrazione installata non fornisce questa strategia. Fare clic per cambiare versione.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} non è installato",
   "nodes.agent.strategyNotSet": "Strategia agentica non impostata",
+  "nodes.agent.task.insert": "Inserisci",
+  "nodes.agent.task.label": "Attività dell’agente",
+  "nodes.agent.task.mention": "Menziona",
+  "nodes.agent.task.placeholder": "Descrivi cosa deve fare questo agente...",
+  "nodes.agent.task.tooltip": "Definisci le istruzioni dell’attività che questo agente deve seguire in questo workflow.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Non autorizzato",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} non è installato",
   "nodes.agent.toolbox": "cassetta degli attrezzi",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Da {{author}}",
   "tabs.question-understand": "Comprensione Domanda",
   "tabs.requestToCommunity": "Richieste alla comunità",
-  "tabs.searchBlock": "Cerca nodo",
+  "tabs.searchBlock": "Cerca nodi, agente, umano, conoscenza",
   "tabs.searchDataSource": "Cerca origine dati",
   "tabs.searchSnippets": "Cerca snippet...",
   "tabs.searchTool": "Strumento di ricerca",
diff --git a/web/i18n/ja-JP/agent-v-2.json b/web/i18n/ja-JP/agent-v-2.json
new file mode 100644
index 00000000000..2fd910cdb64
--- /dev/null
+++ b/web/i18n/ja-JP/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "この操作は現在利用できません。",
+  "agentDetail.access.actions.monitoring": "モニタリング",
+  "agentDetail.access.copyAccessUrl": "アクセス URL をコピー",
+  "agentDetail.access.copyFailed": "参照のコピーに失敗しました。",
+  "agentDetail.access.copyReference": "{{name}} の参照をコピー",
+  "agentDetail.access.copyServiceEndpoint": "サービス API エンドポイントをコピー",
+  "agentDetail.access.description": "このエージェントに到達可能なすべての入口。",
+  "agentDetail.access.empty": "リンクされたアクセスポイントはありません",
+  "agentDetail.access.emptyDescription": "この Roster エージェントには、まだアプリやワークフローの参照がありません。",
+  "agentDetail.access.entries.agentApp.description": "この Roster エージェントにリンクされたエージェントアプリ。",
+  "agentDetail.access.entries.agentApp.name": "エージェントアプリ",
+  "agentDetail.access.entries.workflow.description": "この Roster エージェントにリンクされたワークフローとノード参照。",
+  "agentDetail.access.entries.workflow.name": "ワークフローノード",
+  "agentDetail.access.entryCount_one": "{{count}} 件のエントリ",
+  "agentDetail.access.entryCount_other": "{{count}} 件のエントリ",
+  "agentDetail.access.groups.references.heading": "参照",
+  "agentDetail.access.groups.references.label": "リンクされた参照",
+  "agentDetail.access.learnMore": "詳細を見る",
+  "agentDetail.access.moreActions": "{{name}} のその他の操作",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "サービス API エンドポイント",
+  "agentDetail.access.serviceApi.title": "バックエンドサービス API",
+  "agentDetail.access.status.disabled": "無効",
+  "agentDetail.access.status.enabled": "有効",
+  "agentDetail.access.status.inService": "稼働中",
+  "agentDetail.access.status.outOfService": "停止中",
+  "agentDetail.access.title": "アクセスポイント",
+  "agentDetail.access.toggleSurface": "{{name}} のアクセスを切り替え",
+  "agentDetail.access.webApp.accessUrl": "アクセス URL",
+  "agentDetail.access.webApp.actions.customize": "カスタマイズ",
+  "agentDetail.access.webApp.actions.embedded": "埋め込み",
+  "agentDetail.access.webApp.actions.launch": "起動",
+  "agentDetail.access.webApp.actions.settings": "設定",
+  "agentDetail.access.webApp.refreshUrl": "アクセス URL を更新",
+  "agentDetail.access.webApp.showQrCode": "QR コードを表示",
+  "agentDetail.access.webApp.ssoEnabled": "SSO 有効",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "ワークフロー内のノードとして使用",
+  "agentDetail.access.workflow.empty": "ワークフロー参照はまだありません。",
+  "agentDetail.access.workflow.loadFailed": "ワークフロー参照の読み込みに失敗しました。",
+  "agentDetail.access.workflow.loading": "ワークフロー参照を読み込み中…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} ノード",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} ノード",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Studio で開く",
+  "agentDetail.access.workflow.openInStudioFor": "{{name}} を Studio で開く",
+  "agentDetail.access.workflow.table.actions": "操作",
+  "agentDetail.access.workflow.table.lastUpdated": "最終更新",
+  "agentDetail.access.workflow.table.name": "名前",
+  "agentDetail.access.workflow.table.nodes": "ノード",
+  "agentDetail.access.workflow.table.version": "バージョン",
+  "agentDetail.access.workflow.title": "ワークフローアクセス",
+  "agentDetail.configure.advancedSettings.description": "上級ユーザー向け。環境変数、サンドボックスとメモリ。",
+  "agentDetail.configure.advancedSettings.envEditor.add": "環境変数を追加",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "{{key}} を削除",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "{{key}} の値を隠す",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": ".env をインポート",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "隠れた .env ファイルを表示するには、ファイル選択画面で Command + Shift + . を押します。",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": ".env ファイルが隠れている場合は、システムのファイル選択画面で隠しファイルを有効にしてください。",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "隠れた .env ファイルを表示するには、エクスプローラーで「隠しファイル」を有効にします。",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "{{key}} の値を表示",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "環境変数のスコープを選択",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "このエージェントが実行時に利用できる環境変数。",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Env Editor の表示を切り替え",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "詳細設定",
+  "agentDetail.configure.advancedSettings.toggle": "詳細設定の表示を切り替え",
+  "agentDetail.configure.chatFeatures.description": "Web app やチャット画面でのエンドユーザー向けチャット体験を設定します。",
+  "agentDetail.configure.chatFeatures.title": "チャット機能",
+  "agentDetail.configure.files.add": "ファイルを追加",
+  "agentDetail.configure.files.empty.description": "仕様、テンプレート、ガイドラインなど、エージェントが読めるドキュメントをアップロード",
+  "agentDetail.configure.files.empty.title": "ファイルはまだありません",
+  "agentDetail.configure.files.label": "ファイル",
+  "agentDetail.configure.files.preview.empty": "プレビュー内容はありません。",
+  "agentDetail.configure.files.preview.failed": "プレビューの読み込みに失敗しました。",
+  "agentDetail.configure.files.preview.unsupported": "ファイルはプレビューに対応していません。",
+  "agentDetail.configure.files.remove": "{{name}} を削除",
+  "agentDetail.configure.files.tip": "このエージェントがタスクのオーケストレーション中に利用できるファイル。",
+  "agentDetail.configure.files.toggle": "ファイルの表示を切り替え",
+  "agentDetail.configure.files.treeLabel": "エージェントファイル",
+  "agentDetail.configure.files.upload.action": "アップロード",
+  "agentDetail.configure.files.upload.browse": "選択",
+  "agentDetail.configure.files.upload.description": "このエージェント用のファイルをアップロードします。",
+  "agentDetail.configure.files.upload.dropzone": "ファイルをドロップ、または",
+  "agentDetail.configure.files.upload.failed": "ファイルのアップロードに失敗しました。",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "ファイルを 1 つアップロードしてください。",
+  "agentDetail.configure.files.upload.success": "ファイルをアップロードしました。",
+  "agentDetail.configure.files.upload.title": "ファイルをアップロード",
+  "agentDetail.configure.knowledgeRetrieval.add": "ナレッジ検索を追加",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "ナレッジを追加",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "「+」ボタンをクリックしてナレッジを追加",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "ナレッジ",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "検索設定",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "ナレッジ検索について詳しく見る",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "自動",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "条件",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "無効",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "メタデータフィルタリング",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "手動",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "メタデータフィルタリングモードを選択",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "ナレッジ検索の名前",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "エージェントが決定",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "エージェントがプロンプトと利用可能なコンテキストから自分でクエリを作成します。ここでの設定は不要です。",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "カスタムクエリ",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "この検索ソース用に固定クエリを記述します。",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "カスタムクエリテキスト",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "検索クエリを入力",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "クエリ",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "ナレッジ検索 · エージェントが決定",
+  "agentDetail.configure.knowledgeRetrieval.edit": "{{name}} を編集",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "エージェントが回答時に検索できるナレッジベースを接続",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "ナレッジはまだありません",
+  "agentDetail.configure.knowledgeRetrieval.label": "ナレッジ検索",
+  "agentDetail.configure.knowledgeRetrieval.remove": "{{name}} を削除",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "このエージェントがタスクのオーケストレーション中に利用できるナレッジ検索ソース。",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "ナレッジ検索の表示を切り替え",
+  "agentDetail.configure.model.label": "モデル",
+  "agentDetail.configure.orchestrate": "オーケストレーション",
+  "agentDetail.configure.preview.chatFeatures": "チャット機能",
+  "agentDetail.configure.preview.empty.defaultAgentName": "エージェント",
+  "agentDetail.configure.preview.empty.description": "メッセージを送信して現在のドラフトをテストします。",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "指示が設定されていないため、応答はプレーンなモデルから返ります。",
+  "agentDetail.configure.preview.endUserAuth": "エンドユーザー認証",
+  "agentDetail.configure.preview.restart": "プレビューを再開",
+  "agentDetail.configure.preview.title": "プレビュー",
+  "agentDetail.configure.prompt.copied": "プロンプトをコピーしました",
+  "agentDetail.configure.prompt.copy": "プロンプトをコピー",
+  "agentDetail.configure.prompt.copyFailed": "プロンプトのコピーに失敗しました。",
+  "agentDetail.configure.prompt.insert.label": "挿入",
+  "agentDetail.configure.prompt.insert.question": "質問を開始",
+  "agentDetail.configure.prompt.insert.reportFile": "レポートファイルを出力",
+  "agentDetail.configure.prompt.insert.tenders": "入札を開始",
+  "agentDetail.configure.prompt.label": "プロンプト",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "メンション",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "ここに指示を記述してください、",
+  "agentDetail.configure.prompt.tip": "このエージェントが入力をどう解釈し、ツールを呼び出し、出力を生成するかを定義します。",
+  "agentDetail.configure.publishBar.draft": "ドラフト",
+  "agentDetail.configure.publishBar.publishUpdate": "更新を公開",
+  "agentDetail.configure.publishBar.published": "公開済み",
+  "agentDetail.configure.publishBar.publishedAt": "{{time}} に公開",
+  "agentDetail.configure.publishBar.publishing": "公開中…",
+  "agentDetail.configure.publishBar.saved": "5 分前に保存しました",
+  "agentDetail.configure.publishBar.savedAt": "{{time}} に保存",
+  "agentDetail.configure.publishBar.unpublishedChanges": "未公開の変更",
+  "agentDetail.configure.publishBar.upToDate": "最新です",
+  "agentDetail.configure.publishBar.versionHistory": "バージョン履歴を開く",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "影響を受けるワークフロー",
+  "agentDetail.configure.publishImpact.cancel": "キャンセル",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "あなたのエージェントは",
+  "agentDetail.configure.publishImpact.descriptionSuffix": " で使用されています。変更はそれらに影響します。",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "このエージェント",
+  "agentDetail.configure.publishImpact.title": "{{name}} に{{action}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} 個のワークフロー",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} 個のワークフロー",
+  "agentDetail.configure.skills.add": "スキルを追加",
+  "agentDetail.configure.skills.detail.contentRegion": "スキル詳細コンテンツ",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} 個のファイル",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "スキルファイル",
+  "agentDetail.configure.skills.detail.files": "ファイル",
+  "agentDetail.configure.skills.empty.description": "スキルはエージェントが作業中に呼び出せる再利用可能な専門知識を提供します",
+  "agentDetail.configure.skills.empty.title": "スキルはまだありません",
+  "agentDetail.configure.skills.itemType": "スキル",
+  "agentDetail.configure.skills.label": "スキル",
+  "agentDetail.configure.skills.remove": "{{name}} を削除",
+  "agentDetail.configure.skills.tip": "このエージェントがタスクのオーケストレーション中に利用できるスキル。",
+  "agentDetail.configure.skills.toggle": "スキルの表示を切り替え",
+  "agentDetail.configure.skills.upload.action": "アップロード",
+  "agentDetail.configure.skills.upload.browse": "選択",
+  "agentDetail.configure.skills.upload.description": "このエージェント用の .zip または .skill パッケージをアップロードします。",
+  "agentDetail.configure.skills.upload.dropzone": "スキルパッケージをドロップ、または",
+  "agentDetail.configure.skills.upload.failed": "スキルのアップロードに失敗しました。",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": ".zip または .skill ファイルをアップロードしてください。",
+  "agentDetail.configure.skills.upload.success": "スキルをアップロードしました。",
+  "agentDetail.configure.skills.upload.title": "スキルをアップロード",
+  "agentDetail.configure.tools.add": "ツールを追加",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "開発者向け",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "エージェントがサンドボックス内で実行するコマンドラインプログラムをインストールします。インストールと通常 API Key が必要です。",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI ツール",
+  "agentDetail.configure.tools.addMenu.tool.description": "ウェブ検索や統合など、このワークスペースに既に存在するツールを選択します。",
+  "agentDetail.configure.tools.addMenu.tool.label": "ツール",
+  "agentDetail.configure.tools.cliDialog.description": "任意のパッケージレジストリから CLI ツールをインストールします。エージェントは提供されるバイナリへのシェルアクセスを得ます。",
+  "agentDetail.configure.tools.cliDialog.editTitle": "CLI ツールを編集",
+  "agentDetail.configure.tools.cliDialog.env.description": "この CLI ツールが必要とする API キー、トークン、シークレットを保存します。値は保存時に暗号化され、エージェントがツールを呼び出す際に環境変数として注入されます。",
+  "agentDetail.configure.tools.cliDialog.env.label": "環境変数",
+  "agentDetail.configure.tools.cliDialog.env.optional": "（任意）",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "サンドボックス内で実行 · 初回呼び出し時に一度だけ実行",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "インストールコマンド",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "インストールコマンドをここに貼り付け、例: npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "インストールコマンドを入力してください。",
+  "agentDetail.configure.tools.cliDialog.learnMore": "CLI ツールについて詳しく見る",
+  "agentDetail.configure.tools.cliDialog.name.label": "CLI ツール名",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "CLI ツールに名前を付ける",
+  "agentDetail.configure.tools.cliDialog.name.required": "CLI ツール名を入力してください。",
+  "agentDetail.configure.tools.cliDialog.securityTip": "エージェントのプロンプトには表示されず、実行時に $VAR としてのみ注入されます",
+  "agentDetail.configure.tools.cliDialog.title": "CLI ツールを追加",
+  "agentDetail.configure.tools.cliTool": "CLI ツール",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "エンドユーザー · OAuth",
+  "agentDetail.configure.tools.editAction": "{{name}} を編集",
+  "agentDetail.configure.tools.empty.description": "ツールはエージェントが行動できるようにします。例えばウェブを検索したりアプリを呼び出したりできます",
+  "agentDetail.configure.tools.empty.title": "ツールはまだありません",
+  "agentDetail.configure.tools.label": "ツール",
+  "agentDetail.configure.tools.moreActions": "{{name}} のその他の操作",
+  "agentDetail.configure.tools.pluginType": "プラグイン",
+  "agentDetail.configure.tools.preAuthorize": "事前認可",
+  "agentDetail.configure.tools.removeAction": "{{name}} を削除",
+  "agentDetail.configure.tools.removeProvider": "すべてのツールを削除",
+  "agentDetail.configure.tools.tip": "このエージェントがタスクのオーケストレーション中に呼び出せるツール。",
+  "agentDetail.configure.tools.toggle": "ツールの表示を切り替え",
+  "agentDetail.configure.tools.toolTabs.all": "すべて",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "カスタム",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "プラグイン",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "エージェント",
+  "agentDetail.history": "履歴",
+  "agentDetail.logs.description": "完全なログには、ユーザー入力、エージェントの応答、計画、ツールの使用など、アプリケーションの実行状況が記録されます。",
+  "agentDetail.logs.empty": "ログが見つかりません",
+  "agentDetail.logs.filters.period.allTime": "全期間",
+  "agentDetail.logs.filters.period.label": "ログ期間",
+  "agentDetail.logs.filters.period.last30days": "過去 30 日間",
+  "agentDetail.logs.filters.period.last7days": "過去 7 日間",
+  "agentDetail.logs.filters.search.label": "ログを検索",
+  "agentDetail.logs.filters.search.placeholder": "検索",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "最終作成日時",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "最終更新日時",
+  "agentDetail.logs.filters.source.all": "ソース",
+  "agentDetail.logs.filters.source.empty": "ソースが見つかりません",
+  "agentDetail.logs.filters.source.label": "ログソース",
+  "agentDetail.logs.filters.source.loadFailed": "ソースの読み込みに失敗しました",
+  "agentDetail.logs.filters.source.loading": "ソースを読み込み中…",
+  "agentDetail.logs.filters.source.searchLabel": "ソースを検索",
+  "agentDetail.logs.filters.source.searchPlaceholder": "検索",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "ワークフロー",
+  "agentDetail.logs.learnMore": "詳細を見る",
+  "agentDetail.logs.loadFailed": "ログの読み込みに失敗しました",
+  "agentDetail.logs.loading": "ログを読み込み中…",
+  "agentDetail.logs.notAvailable": "該当なし",
+  "agentDetail.logs.table.createdTime": "作成日時",
+  "agentDetail.logs.table.endUser": "エンドユーザー",
+  "agentDetail.logs.table.messageCount": "メッセージ数",
+  "agentDetail.logs.table.operationRate": "操作率",
+  "agentDetail.logs.table.source": "ソース",
+  "agentDetail.logs.table.title": "タイトル",
+  "agentDetail.logs.table.unread": "未読",
+  "agentDetail.logs.table.updatedTime": "更新日時",
+  "agentDetail.logs.table.userRate": "ユーザー評価",
+  "agentDetail.logs.title": "ログ",
+  "agentDetail.memorySettings.budgetLabel": "メモリ予算",
+  "agentDetail.memorySettings.description": "現在のアクティブな設定スナップショットのメモリ設定。",
+  "agentDetail.memorySettings.export.description": "メモリのエクスポートは今後のリリースで予定されています。",
+  "agentDetail.memorySettings.export.download": "ダウンロード",
+  "agentDetail.memorySettings.export.soon": "近日公開",
+  "agentDetail.memorySettings.export.title": "現在のメモリをエクスポート",
+  "agentDetail.memorySettings.notConfigured": "未設定",
+  "agentDetail.memorySettings.scopeLabel": "メモリ範囲",
+  "agentDetail.memorySettings.title": "メモリ",
+  "agentDetail.metadata.activeVersionLabel": "アクティブバージョン",
+  "agentDetail.metadata.appIdLabel": "App ID",
+  "agentDetail.metadata.description": "エージェントバックエンドから返される読み取り専用の Roster フィールド。",
+  "agentDetail.metadata.emptyValue": "利用不可",
+  "agentDetail.metadata.scopeLabel": "スコープ",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "ワークフローのみ",
+  "agentDetail.metadata.sourceLabel": "ソース",
+  "agentDetail.metadata.statusLabel": "ステータス",
+  "agentDetail.metadata.title": "メタデータ",
+  "agentDetail.metadata.updatedAtLabel": "更新日時",
+  "agentDetail.metadata.workflowIdLabel": "ワークフロー ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "ワークフローノード ID",
+  "agentDetail.monitoring.change": "前期間から {{value}}",
+  "agentDetail.monitoring.dateRangeLabel": "日付範囲",
+  "agentDetail.monitoring.description": "ワークフロー全体での再利用可能なエージェントのアクティビティ、コスト、対話品質を追跡します。",
+  "agentDetail.monitoring.learnMore": "詳細を見る",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "このエージェントを使ったワークフローをトリガーしたユニークエンドユーザー数。",
+  "agentDetail.monitoring.metrics.activeUsers.title": "アクティブユーザー",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "このアクセスポイントにおけるユーザーとエージェントの連続通信回数。",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "平均セッション対話数",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "リクエスト開始から完了までの平均出力速度。",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "トークン出力速度",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "ワークフロー実行を通じてこのエージェントが生成した推定トークンコスト。",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "トークン使用量",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "選択したアクセスポイントを通じてこのエージェントに到達した日次 AI 会話数。",
+  "agentDetail.monitoring.metrics.totalConversations.title": "総会話数",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "日次のエージェント対話数。",
+  "agentDetail.monitoring.metrics.totalMessages.title": "総メッセージ数",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "このエージェントの 1,000 メッセージあたりのいいね数。",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "ユーザー満足度",
+  "agentDetail.monitoring.pickSource": "アプリを選択",
+  "agentDetail.monitoring.sourceLabel": "アプリ",
+  "agentDetail.monitoring.sourceTrigger": "ソース {{name}}",
+  "agentDetail.monitoring.sources.all": "すべて",
+  "agentDetail.monitoring.timeRangeLabel": "時間範囲",
+  "agentDetail.monitoring.timeRanges.custom": "カスタム",
+  "agentDetail.monitoring.timeRanges.last30days": "過去 30 日間",
+  "agentDetail.monitoring.timeRanges.last7days": "過去 7 日間",
+  "agentDetail.monitoring.timeRanges.today": "今日",
+  "agentDetail.monitoring.title": "モニタリング",
+  "agentDetail.monitoring.tokenUsageConsumed": "消費トークン",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "エージェントナビゲーション",
+  "agentDetail.publish": "公開",
+  "agentDetail.publishSoon": "近日公開",
+  "agentDetail.sections.access": "アクセスポイント",
+  "agentDetail.sections.configure": "オーケストレーション",
+  "agentDetail.sections.logs": "ログ",
+  "agentDetail.sections.monitoring": "モニタリング",
+  "agentDetail.subtitle": "エージェント ID：{{agentId}}",
+  "agentDetail.title": "エージェント",
+  "agentDetail.type": "エージェント",
+  "agentDetail.versionHistory.active": "アクティブ",
+  "agentDetail.versionHistory.empty": "バージョンはまだありません",
+  "agentDetail.versionHistory.filter": "バージョンをフィルター",
+  "agentDetail.versionHistory.versionName": "バージョン {{version}}",
+  "roster.createAgent": "エージェントを作成",
+  "roster.createAgentOptions": "エージェント作成オプション",
+  "roster.createDialog.description": "このワークスペース Roster に再利用可能なエージェントを作成します。",
+  "roster.createDialog.title": "エージェントを作成",
+  "roster.createForm.changeIcon": "エージェントアイコンを変更",
+  "roster.createForm.descriptionLabel": "説明",
+  "roster.createForm.descriptionOptional": "（任意）",
+  "roster.createForm.descriptionPlaceholder": "例: トピックのソースを収集し、主要な発見を要約する",
+  "roster.createForm.nameLabel": "名前",
+  "roster.createForm.namePlaceholder": "例: Max",
+  "roster.createForm.nameRequired": "名前を入力してください。",
+  "roster.createForm.roleLabel": "ロール",
+  "roster.createForm.rolePlaceholder": "例: リサーチアシスタント",
+  "roster.createForm.roleRequired": "ロールを入力してください。",
+  "roster.createSuccess": "エージェントを作成しました。",
+  "roster.dateTimeFormat": "YYYY/MM/DD HH:mm:ss",
+  "roster.deleteDialog.description": "このエージェントはアクティブな Roster リストから削除されます。",
+  "roster.deleteDialog.title": "{{name}} を削除しますか？",
+  "roster.deleteFailed": "エージェントの削除に失敗しました。",
+  "roster.deleteSuccess": "エージェントを削除しました。",
+  "roster.duplicateFailed": "エージェントの複製に失敗しました。",
+  "roster.duplicateSuccess": "エージェントを複製しました。",
+  "roster.editAgent": "{{name}} を編集",
+  "roster.editDialog.description": "このエージェントの Roster 名、説明、ロールを更新します。",
+  "roster.editDialog.title": "エージェントを編集",
+  "roster.editInfo": "情報を編集",
+  "roster.empty": "エージェントはまだありません",
+  "roster.emptyDescription": "このワークスペースに保存されたエージェントがここに表示されます。",
+  "roster.emptySearch": "一致するエージェントがありません",
+  "roster.emptySearchDescription": "別のエージェント名で試してください。",
+  "roster.filters.all": "すべて",
+  "roster.filters.drafts": "ドラフト",
+  "roster.filters.label": "エージェントフィルター",
+  "roster.filters.published": "公開済み",
+  "roster.learnMore": "Agent Roster について詳しく見る",
+  "roster.listLabel": "エージェント Roster リスト",
+  "roster.loadMore": "さらに読み込む",
+  "roster.loadingError": "エージェントの読み込みに失敗しました。更新してもう一度お試しください。",
+  "roster.moreActions": "{{name}} のその他の操作",
+  "roster.nodeSelector.createInlineFailed": "インラインエージェントの作成に失敗しました。更新してもう一度お試しください。",
+  "roster.nodeSelector.dialogLabel": "エージェントを選択",
+  "roster.nodeSelector.manageInAgentConsole": "Agent Console で管理",
+  "roster.nodeSelector.searchPlaceholder": "検索…",
+  "roster.nodeSelector.startFromScratch": "ゼロから始める",
+  "roster.references.label": "{{name}} を使用するワークフロー",
+  "roster.references.trigger": "{{name}} を使用するワークフロー",
+  "roster.searchLabel": "エージェントを検索",
+  "roster.searchPlaceholder": "エージェントを名前で検索…",
+  "roster.sources.agent_app": "エージェントアプリ",
+  "roster.sources.imported": "インポート済み",
+  "roster.sources.system": "システム",
+  "roster.sources.workflow": "ワークフロー",
+  "roster.status.active": "アクティブ",
+  "roster.status.archived": "アーカイブ済み",
+  "roster.tabs.agent": "エージェント",
+  "roster.tabs.human": "人間",
+  "roster.tabsLabel": "Roster タイプ",
+  "roster.updateSuccess": "エージェントを更新しました。",
+  "roster.usageStatus.draft": "ドラフト"
+}
diff --git a/web/i18n/ja-JP/app-log.json b/web/i18n/ja-JP/app-log.json
index d6a93bcb08b..b197afb75f2 100644
--- a/web/i18n/ja-JP/app-log.json
+++ b/web/i18n/ja-JP/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "今日",
   "filter.period.yearToDate": "年初から今日まで",
   "filter.sortBy": "並べ替え",
+  "monitoring.description": "モニタリングは、パフォーマンス、ユーザー活動、コストを含むアプリケーションの実行状況を記録します。",
   "promptLog": "プロンプトログ",
   "runDetail.fileListDetail": "詳細",
   "runDetail.fileListLabel": "ファイルの詳細",
diff --git a/web/i18n/ja-JP/app.json b/web/i18n/ja-JP/app.json
index d1f608c287a..d2f338a84de 100644
--- a/web/i18n/ja-JP/app.json
+++ b/web/i18n/ja-JP/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "構造化出力は、モデルが常に指定された JSON スキーマに準拠した応答を生成することを保証する機能です。",
   "studio.allApps": "すべてのアプリ",
   "studio.apps": "アプリ",
-  "studio.filters.allCreators": "すべてのクリエイター",
-  "studio.filters.creators": "クリエイター",
+  "studio.filters.allCreators": "すべての作成者",
+  "studio.filters.creators": "作成者",
   "studio.filters.reset": "リセット",
   "studio.filters.searchCreators": "クリエイターを検索...",
   "studio.filters.types": "種類",
diff --git a/web/i18n/ja-JP/billing.json b/web/i18n/ja-JP/billing.json
index 3a79aa7ed10..fc41e988675 100644
--- a/web/i18n/ja-JP/billing.json
+++ b/web/i18n/ja-JP/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "一括ドキュメントアップロード機能を解放するにはアップグレードが必要です",
   "upgrade.uploadMultiplePages.description": "現在のプランではアップロード上限に達しています。1回の操作で選択・アップロードできるドキュメントは1つのみです。",
   "upgrade.uploadMultiplePages.title": "複数ドキュメントを一度にアップロードするにはアップグレード",
+  "upgrade.workflowRestore.description": "現在のプランでは、ワークフローバージョンの復元は利用できません。",
+  "upgrade.workflowRestore.title": "アップグレードしてワークフローバージョンを復元",
   "upgradeBtn.encourage": "今すぐアップグレード",
   "upgradeBtn.encourageShort": "アップグレード",
   "upgradeBtn.plain": "プランを見る",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index 9bc7da042ff..9922049861a 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -249,15 +249,18 @@
   "mainNav.workspace.sort.openMenu": "ワークスペースを並べ替え",
   "mainNav.workspace.switchWorkspace": "ワークスペースを切り替え",
   "mcpPage.description": "MCP サーバーを接続・管理して、アプリから外部ツールやサービスにアクセスできるようにします。",
-  "members.admin": "管理者",
   "members.adminTip": "アプリの構築およびチーム設定の管理ができます",
+  "members.alreadyInTeam": "すでにチームに参加済み",
+  "members.alreadyInTeamTip": "これらのユーザーはすでにこのワークスペースにアクセスできます。",
+  "members.assignRoles": "ロールを割り当て",
+  "members.assignRolesModal.description": "このメンバーに割り当てるロールを選択します。選択したロールのすべての権限が結合されます。",
+  "members.assignRolesModal.selectedCount": "{{count}} 件選択済み",
+  "members.assignRolesModal.title": "ロールを割り当て",
   "members.builder": "ビルダー",
   "members.builderTip": "独自のアプリを作成・編集できる",
-  "members.datasetOperator": "ナレッジ管理員",
   "members.datasetOperatorTip": "ナレッジベースのみを管理できる",
   "members.deleteMember": "メンバーを削除",
   "members.disInvite": "招待をキャンセル",
-  "members.editor": "エディター",
   "members.editorTip": "アプリの構築ができますが、チーム設定の管理はできません",
   "members.email": "メール",
   "members.emailInvalid": "無効なメール形式",
@@ -270,17 +273,40 @@
   "members.invite": "招待",
   "members.inviteTeamMember": "チームメンバーを招待する",
   "members.inviteTeamMemberTip": "彼らはサインイン後、直接あなたのチームデータにアクセスできます。",
-  "members.invitedAsRole": "{{role}}ユーザーとして招待されました",
+  "members.invitedAsRole": "{{role}}として招待されました",
   "members.lastActive": "最終アクティブ",
+  "members.memberActions": "メンバー操作",
+  "members.memberDetails.assign": "割り当て",
+  "members.memberDetails.assignedRoles": "割り当て済みロール",
+  "members.memberDetails.customGroup": "カスタム",
+  "members.memberDetails.generalGroup": "一般",
+  "members.memberDetails.openAria": "{{name}} のメンバー詳細を開く",
+  "members.memberDetails.permissions.assignRoles": "ロールを割り当て",
+  "members.memberDetails.permissions.createApps": "アプリを作成",
+  "members.memberDetails.permissions.createDatasets": "ナレッジを作成",
+  "members.memberDetails.permissions.editApps": "アプリを編集",
+  "members.memberDetails.permissions.editDatasets": "ナレッジを編集",
+  "members.memberDetails.permissions.inviteMembers": "メンバーを招待",
+  "members.memberDetails.permissions.manageBilling": "請求を管理",
+  "members.memberDetails.permissions.manageDatasets": "ナレッジを管理",
+  "members.memberDetails.permissions.removeMembers": "メンバーを削除",
+  "members.memberDetails.permissions.transferOwnership": "所有権を移転",
+  "members.memberDetails.permissions.useApps": "アプリを使用",
+  "members.memberDetails.permissions.workspaceSettings": "ワークスペース設定",
+  "members.memberDetails.removeRoleAria": "{{role}} ロールを削除",
+  "members.memberDetails.roleActionsAria": "{{role}} ロールの操作を開く",
+  "members.memberDetails.roleNoPermissionSummary": "現在のロールには権限がありません。",
+  "members.memberDetails.rolePermissionSummary": "{{role}} は <permissionList>{{permissions}}</permissionList> できます",
+  "members.memberDetails.title": "メンバー詳細",
   "members.name": "名前",
-  "members.normal": "通常",
+  "members.noNewInvitationsSent": "新しい招待は送信されませんでした",
   "members.normalTip": "アプリの使用のみが可能で、アプリの構築はできません",
   "members.ok": "OK",
-  "members.owner": "オーナー",
   "members.pending": "保留中...",
   "members.removeFromTeam": "チームから削除",
   "members.removeFromTeamTip": "チームへのアクセスが削除されます",
   "members.role": "ロール",
+  "members.selectRole": "ロールを選択してください",
   "members.sendInvite": "招待を送る",
   "members.setAdmin": "管理者に設定",
   "members.setBuilder": "ビルダーに設定",
@@ -311,12 +337,14 @@
   "menus.apps": "スタジオ",
   "menus.datasets": "ナレッジ",
   "menus.datasetsTips": "近日公開：独自のテキストデータをインポートするか、Webhook を介してリアルタイムにデータを記述して LLM コンテキストを強化します。",
+  "menus.deployments": "デプロイ",
   "menus.explore": "探索",
   "menus.exploreMarketplace": "マーケットプレイスを探索する",
   "menus.newApp": "新しいアプリ",
   "menus.newDataset": "ナレッジの作成",
   "menus.plugins": "インテグレーション",
   "menus.pluginsTips": "サードパーティのインテグレーションを統合するか、ChatGPT 互換の AI インテグレーションを作成します。",
+  "menus.roster": "エージェント名簿",
   "menus.status": "ベータ版",
   "menus.tools": "ツール",
   "model.addMoreModel": "設定画面から他のモデルを追加してください",
@@ -516,6 +544,7 @@
   "modelProvider.ttsModel.key": "テキスト-to-音声モデル",
   "modelProvider.ttsModel.tip": "会話でのテキスト-to-音声入力に使用するデフォルトモデルを設定します。",
   "modelProvider.upgradeForLoadBalancing": "負荷分散を利用するには、プランのアップグレードが必要です。",
+  "navigation.skipToMain": "メインコンテンツへスキップ",
   "noData": "データなし",
   "operation.add": "追加",
   "operation.added": "追加済み",
@@ -552,6 +581,7 @@
   "operation.lineBreak": "改行",
   "operation.log": "ログ",
   "operation.more": "もっと",
+  "operation.moreActions": "その他の操作",
   "operation.no": "いいえ",
   "operation.noSearchCount": "0件の{{content}}",
   "operation.noSearchResults": "{{content}}は見つかりませんでした",
@@ -600,9 +630,6 @@
   "placeholder.input": "入力してください",
   "placeholder.search": "検索...",
   "placeholder.select": "選択してください",
-  "plugin.serpapi.apiKey": "API キー",
-  "plugin.serpapi.apiKeyPlaceholder": "API キーを入力してください",
-  "plugin.serpapi.keyFrom": "SerpAPI アカウントページから SerpAPI キーを取得してください",
   "promptEditor.context.item.desc": "コンテキストテンプレートを挿入",
   "promptEditor.context.item.title": "コンテキスト",
   "promptEditor.context.modal.add": "コンテキストを追加",
@@ -665,6 +692,7 @@
   "provider.saveFailed": "API キーの保存に失敗しました",
   "provider.validatedError": "検証に失敗しました：",
   "provider.validating": "キーの検証中...",
+  "settings.ResourceAccess": "リソースアクセス",
   "settings.account": "マイアカウント",
   "settings.accountGroup": "アカウント",
   "settings.agentStrategy": "エージェント戦略",
@@ -684,6 +712,9 @@
   "settings.plugin": "インテグレーション",
   "settings.preferences": "ユーザー設定",
   "settings.provider": "モデルプロバイダー",
+  "settings.resourceAccess": "リソースアクセス",
+  "settings.resourceAccessDescription": "アプリとナレッジベースで使用できる権限ルールを設定します。権限ルールは、具体的なリソースアクセス設定でメンバーに割り当てられます。",
+  "settings.rolesAndPermissions": "ロールと権限",
   "settings.settings": "設定",
   "settings.swaggerAPIAsTool": "Swagger API をツールとして利用",
   "settings.trigger": "トリガー",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
new file mode 100644
index 00000000000..4e27e96a2c3
--- /dev/null
+++ b/web/i18n/ja-JP/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "バックエンドサービス API",
+  "access.api.copyCurlExample": "cURL の例をコピー",
+  "access.api.createFailed": "API トークンの生成に失敗しました。",
+  "access.api.createKey": "API トークンを生成",
+  "access.api.createKeyTitle": "新しい API トークンを生成",
+  "access.api.curlExampleTitle": "cURL の例",
+  "access.api.description": "HTTP 経由でこのデプロイにアクセスします。各 API トークンは 1 つの環境にスコープされます。",
+  "access.api.developerTitle": "開発者 API",
+  "access.api.disabled": "このデプロイでは API アクセスがオフになっています。",
+  "access.api.disabledHint": "API アクセスを有効にして、環境スコープのトークンを生成します。",
+  "access.api.dismissToken": "API トークンを閉じる",
+  "access.api.docs": "API ドキュメント",
+  "access.api.docsClose": "API ドキュメントを閉じる",
+  "access.api.docsDescription": "このデプロイのワークフロー API リファレンスを表示します。",
+  "access.api.docsTitle": "ワークフロー API ドキュメント",
+  "access.api.empty": "API トークンの発行を開始するには、まず環境にデプロイしてください。",
+  "access.api.emptyTitle": "デプロイされた環境がありません",
+  "access.api.endpoint": "リクエスト URL",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "API トークン一覧",
+  "access.api.nameLabel": "API トークン名",
+  "access.api.namePlaceholder": "API トークン名を入力",
+  "access.api.nameRequired": "API トークン名は必須です。",
+  "access.api.newKey": "新しい API トークンを生成",
+  "access.api.newTokenDescription": "この API トークンは一度しか表示されません。このページを離れる前にコピーしてください。",
+  "access.api.newTokenLabel": "API トークン",
+  "access.api.newTokenTitle": "API トークンが生成されました",
+  "access.api.noKeys": "API トークンはまだありません。生成して API の呼び出しを開始します。",
+  "access.api.noKeysTitle": "API トークンはまだありません",
+  "access.api.revokeConfirmDescription": "API トークン「{{name}}」はすぐに動作しなくなります。この操作は取り消せません。",
+  "access.api.revokeConfirmTitle": "API トークンを取り消しますか？",
+  "access.api.revokeFailed": "API トークンの取り消しに失敗しました。",
+  "access.api.revokeSuccess": "API トークンを取り消しました",
+  "access.api.table.action": "アクション",
+  "access.api.table.environment": "環境",
+  "access.api.table.key": "API トークン",
+  "access.api.table.name": "名前",
+  "access.api.title": "API",
+  "access.channels.col.channel": "チャネル",
+  "access.channels.col.endpoint": "エントリポイント",
+  "access.channels.col.status": "ステータス",
+  "access.channels.description": "WebApp と CLI のエントリポイントは、上記のアクセス権限を使用します。",
+  "access.channels.disabled": "このデプロイではアクセスチャネルがオフになっています。",
+  "access.channels.disabledHint": "アクセスチャネルを有効にして、WebApp と CLI のエントリポイントを公開します。",
+  "access.channels.followPermission": "権限に従う",
+  "access.channels.title": "アクセスチャネル",
+  "access.cli.description": "difyctl を使ってターミナルから呼び出します。スクリプト、自動化されたワークフロー、エージェント連携に適しています。",
+  "access.cli.docs": "使い方ガイド",
+  "access.cli.domain": "ドメイン",
+  "access.cli.empty": "CLI エンドポイントが設定されていません。",
+  "access.cli.install": "CLI をインストール",
+  "access.cli.title": "CLI",
+  "access.copied": "コピーしました",
+  "access.copy": "コピー",
+  "access.copyFailed": "コピーに失敗しました",
+  "access.copyToast": "クリップボードにコピーしました",
+  "access.hide": "非表示",
+  "access.members.clearAll": "すべてクリア",
+  "access.members.empty": "該当する項目が見つかりません。",
+  "access.members.groupCount_one": "{{count}} グループ",
+  "access.members.groupCount_other": "{{count}} グループ",
+  "access.members.groups": "グループ",
+  "access.members.individuals": "メンバー",
+  "access.members.memberCount_one": "{{count}} メンバー",
+  "access.members.memberCount_other": "{{count}} メンバー",
+  "access.members.pickPlaceholder": "グループまたはメンバーを選択",
+  "access.members.searchPlaceholder": "グループとメンバーを検索",
+  "access.members.selectedLabel": "選択済み",
+  "access.permission.anyone": "リンクを知っている全員",
+  "access.permission.anyoneDesc": "ログインせずに誰でもこのデプロイにアクセスできます。",
+  "access.permission.memberCount_one": "{{count}} メンバー",
+  "access.permission.memberCount_other": "{{count}} メンバー",
+  "access.permission.organization": "プラットフォーム内のすべてのメンバー",
+  "access.permission.organizationDesc": "プラットフォーム内のすべてのメンバー",
+  "access.permission.specific": "プラットフォーム内の特定のメンバー",
+  "access.permission.specificDesc": "特定のグループまたはメンバーを選択",
+  "access.permission.specificUnavailable": "実際のプラットフォームメンバーとグループが接続されるまで、特定メンバーの選択は無効です。",
+  "access.permission.updateFailed": "アクセスポリシーの更新に失敗しました。",
+  "access.permissions.col.environment": "環境",
+  "access.permissions.col.permission": "アクセス",
+  "access.permissions.description": "各環境で WebApp と CLI エントリポイントのアクセス権限を設定します。",
+  "access.permissions.editAriaLabel": "{{environment}} のアクセスを設定",
+  "access.permissions.editDescription": "WebApp と CLI エントリポイントのアクセス権限を設定します。",
+  "access.permissions.editTitle": "アクセス権限",
+  "access.permissions.title": "アクセス権限",
+  "access.revoke": "取り消す",
+  "access.runAccess.description": "ユーザーがこのデプロイを実行する方法と、環境ごとにアクセスできるユーザーを管理します。",
+  "access.runAccess.disabled": "このデプロイでは実行アクセスがオフになっています。",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "このデプロイを Model Context Protocol サーバーとして公開します。",
+  "access.runAccess.mcpEmpty": "MCP エンドポイントが設定されていません。",
+  "access.runAccess.noEnvs": "アクセス権限を設定するには、環境にデプロイしてください。",
+  "access.runAccess.noEnvsTitle": "デプロイされた環境がありません",
+  "access.runAccess.openWebapp": "WebApp を開く",
+  "access.runAccess.permissions": "アクセス権限",
+  "access.runAccess.permissionsDesc": "各環境でこのデプロイにアクセスできるユーザー。",
+  "access.runAccess.title": "実行アクセス",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "エンドユーザー向けのホストされた Web ページ。",
+  "access.runAccess.webappEmpty": "近日公開。",
+  "access.show": "表示",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "外部",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "不明",
+  "card.access.api": "API トークン",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "アクセスなし",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "最初のリリースを作成",
+  "card.deploy": "デプロイ",
+  "card.deploying": "{{count}} デプロイ中",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} 失敗",
+  "card.fromApp": "{{name}} から",
+  "card.lastDeployed": "最終デプロイ {{time}}",
+  "card.menu.delete": "デプロイを削除",
+  "card.menu.deleteDisabled": "バックエンド管理のデプロイでは、デプロイの削除はまだ利用できません。",
+  "card.menu.deploy": "環境にデプロイ",
+  "card.menu.editInfo": "情報を編集",
+  "card.menu.viewDetail": "デプロイ詳細を表示",
+  "card.moreActions": "その他のアクション",
+  "card.neverDeployed": "まだデプロイされていません",
+  "card.noDescription": "説明はありません。",
+  "card.notDeployed": "未デプロイ",
+  "card.ready": "{{count}} 実行中",
+  "card.tooltip.createdAt": "作成日",
+  "card.tooltip.deployed": "デプロイ済み",
+  "card.tooltip.deploymentStatus": "デプロイ",
+  "card.tooltip.notDeployed": "このデプロイはまだどの環境にもデプロイされていません。",
+  "card.tooltip.notDeployedShort": "未デプロイ",
+  "card.tooltip.release": "リリース",
+  "card.tooltip.releaseName": "リリース名",
+  "card.tooltip.source": "ソース",
+  "common.loadFailed": "読み込みに失敗しました。後でもう一度お試しください。",
+  "common.loading": "読み込み中...",
+  "createGuide.actions.back": "戻る",
+  "createGuide.actions.cancel": "キャンセル",
+  "createGuide.actions.continue": "続行",
+  "createGuide.actions.createAndDeploy": "作成してデプロイ",
+  "createGuide.actions.creating": "作成中...",
+  "createGuide.actions.deploy": "デプロイ",
+  "createGuide.actions.deploying": "作成してデプロイ中...",
+  "createGuide.actions.next": "次へ",
+  "createGuide.actions.skipDeploy": "スキップ、後でデプロイ",
+  "createGuide.description": "リリースソース、基本情報、ターゲット環境からデプロイを作成します。",
+  "createGuide.dsl.defaultAppName": "インポートされた DSL アプリ",
+  "createGuide.dsl.description": "ワークフロー DSL パッケージをアップロードして、デプロイ、最初のリリース、オプションの環境デプロイを作成します。",
+  "createGuide.dsl.dropDescription": "ワークフロー YAML DSL パッケージをアップロードします。デプロイ前にこのファイルからデプロイオプションが解決されます。",
+  "createGuide.dsl.dropTitle": "ワークフロー DSL パッケージをアップロード",
+  "createGuide.dsl.readFailed": "DSL ファイルの読み込みに失敗しました。別のファイルを選択してもう一度お試しください。",
+  "createGuide.dsl.reading": "DSL ファイルを読み込み中...",
+  "createGuide.dsl.title": "DSL をインポート",
+  "createGuide.dsl.unsupportedMode": "デプロイにはワークフロー DSL ファイルのみ使用できます。",
+  "createGuide.errors.createReleaseFailed": "デプロイまたはリリースの作成に失敗しました。",
+  "createGuide.errors.deployFailed": "環境へのデプロイに失敗しました。",
+  "createGuide.method.description": "最初のリリースの作成に使用するソースを選択します。",
+  "createGuide.methods.bindApp.description": "スタジオの既存のワークフローアプリをリリースソースとして使用します。",
+  "createGuide.methods.bindApp.title": "既存のワークフローアプリにバインド",
+  "createGuide.methods.importDsl.description": "ワークフロー YAML DSL パッケージをアップロードして、デプロイ UI を続行します。",
+  "createGuide.methods.importDsl.title": "DSL をインポート",
+  "createGuide.methods.mocked": "モック済み",
+  "createGuide.nav.back": "デプロイ",
+  "createGuide.release.defaultName": "初期リリース",
+  "createGuide.release.deployInfo": "デプロイ情報",
+  "createGuide.release.description": "デプロイ情報と最初のリリースの詳細を入力します。",
+  "createGuide.release.firstVersion": "最初のリリース",
+  "createGuide.release.instanceDescription": "デプロイの説明",
+  "createGuide.release.instanceDescriptionPlaceholder": "このデプロイの用途を説明してください",
+  "createGuide.release.instanceName": "デプロイ名",
+  "createGuide.release.instanceNameConflict": "この名前のデプロイは既に存在します。別の名前を選択してください。",
+  "createGuide.release.releaseDescription": "リリースの説明",
+  "createGuide.release.releaseDescriptionPlaceholder": "このリリースを説明してください",
+  "createGuide.release.releaseName": "リリース名",
+  "createGuide.release.releaseNote": "リリースの説明",
+  "createGuide.release.title": "基本情報",
+  "createGuide.source.availableApps_one": "{{count}} アプリ",
+  "createGuide.source.availableApps_other": "{{count}} アプリ",
+  "createGuide.source.clearSearch": "アプリ検索をクリア",
+  "createGuide.source.description": "最初のリリースの作成に使用するソースを選択します。",
+  "createGuide.source.empty": "ワークフローアプリが見つかりません。",
+  "createGuide.source.searchPlaceholder": "アプリを検索",
+  "createGuide.source.sourceApp": "ワークフローアプリ",
+  "createGuide.source.title": "リリースソース",
+  "createGuide.steps.method": "リリースソース",
+  "createGuide.steps.release": "基本情報",
+  "createGuide.steps.source": "リリースソース",
+  "createGuide.steps.target": "環境にデプロイ",
+  "createGuide.target.bindingCount_one": "{{count}} バインディング",
+  "createGuide.target.bindingCount_other": "{{count}} バインディング",
+  "createGuide.target.bindingHint": "このリリースで使用する認証情報を選択します。",
+  "createGuide.target.bindings": "認証情報",
+  "createGuide.target.deferredBindingHint": "認証情報は、最終的なデプロイアクション時に実際のデプロイプランから解決されます。",
+  "createGuide.target.deferredEnvironmentHint": "デプロイとリリースの作成後、名前は実際の環境と照合されます。",
+  "createGuide.target.description": "ターゲット環境を選択し、そこでこのリリースが必要とするランタイム設定を指定します。このステップはスキップできます。",
+  "createGuide.target.envVarCount_one": "{{count}} 変数",
+  "createGuide.target.envVarCount_other": "{{count}} 変数",
+  "createGuide.target.envVarHint": "このリリースに必要な各環境変数について、カスタム値を入力するか、アプリで定義された値を使用します。",
+  "createGuide.target.envVarPlaceholder": "値を入力",
+  "createGuide.target.envVarSource.ariaLabel": "{{key}} の変数値ソースを選択",
+  "createGuide.target.envVarSource.default": "アプリの値",
+  "createGuide.target.envVarSource.lastDeployment": "最後にデプロイされた値",
+  "createGuide.target.envVarSource.literal": "カスタム値",
+  "createGuide.target.envVarType.number": "数値",
+  "createGuide.target.envVarType.secret": "シークレット",
+  "createGuide.target.envVarType.string": "文字列",
+  "createGuide.target.envVars": "環境変数",
+  "createGuide.target.environment": "ターゲット環境",
+  "createGuide.target.environmentName": "環境名",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "認証情報の読み込みに失敗しました。",
+  "createGuide.target.loadEnvironmentsFailed": "デプロイ環境の読み込みに失敗しました。",
+  "createGuide.target.missingRequiredBinding": "この必須バインディングの認証情報を選択してください。",
+  "createGuide.target.noBindingRequired": "認証情報は不要です。",
+  "createGuide.target.noCredentialCandidates": "利用可能な認証情報がありません。",
+  "createGuide.target.noEnvironmentOptions": "利用可能なデプロイ環境がありません。",
+  "createGuide.target.required": "必須",
+  "createGuide.target.selectCredential": "認証情報を選択",
+  "createGuide.target.title": "環境にデプロイ",
+  "createGuide.title": "新しいデプロイ",
+  "createModal.appPickerPlaceholder": "ワークフローアプリを選択",
+  "createModal.appSearchEmpty": "一致するワークフローアプリがありません",
+  "createModal.appSearchPlaceholder": "ワークフローアプリを検索…",
+  "createModal.cancel": "キャンセル",
+  "createModal.create": "作成",
+  "createModal.createFailed": "デプロイの作成に失敗しました。",
+  "createModal.description": "ワークフローアプリを選択してデプロイを作成します。",
+  "createModal.descriptionLabel": "説明",
+  "createModal.descriptionPlaceholder": "このデプロイの用途を説明してください",
+  "createModal.loadMoreApps": "さらにアプリを読み込む",
+  "createModal.loadingApps": "アプリを読み込み中…",
+  "createModal.nameLabel": "デプロイ名",
+  "createModal.namePlaceholder": "デプロイ名",
+  "createModal.noApps": "このワークスペースにワークフローアプリが見つかりません。まずスタジオで作成してください。",
+  "createModal.selected": "選択済み",
+  "createModal.sourceApp": "ワークフローアプリ (必須)",
+  "createModal.title": "新しいデプロイ",
+  "deployDrawer.bindingCount_one": "{{count}} バインディング",
+  "deployDrawer.bindingCount_other": "{{count}} バインディング",
+  "deployDrawer.bindingOptionsFailed": "認証情報オプションの読み込みに失敗しました。",
+  "deployDrawer.bindingSelectionHint": "このデプロイで使用する認証情報を選択します。",
+  "deployDrawer.bindingsDisabled": "リリースプレビューから解決されました。編集はまだ利用できません。",
+  "deployDrawer.cancel": "キャンセル",
+  "deployDrawer.close": "デプロイドロワーを閉じる",
+  "deployDrawer.defaultSelect": "選択...",
+  "deployDrawer.deploy": "環境にデプロイ",
+  "deployDrawer.deployExistingRelease": "環境にデプロイ",
+  "deployDrawer.deployExistingReleaseDescription": "デプロイするリリースとターゲット環境を選択します。",
+  "deployDrawer.deployExistingReleaseTitle": "環境にデプロイ",
+  "deployDrawer.deployFailed": "デプロイの開始に失敗しました。",
+  "deployDrawer.deploying": "デプロイ中...",
+  "deployDrawer.description": "デプロイするリリースとターゲット環境を選択します。",
+  "deployDrawer.envVarCount_one": "{{count}} 変数",
+  "deployDrawer.envVarCount_other": "{{count}} 変数",
+  "deployDrawer.envVarHint": "このリリースに必要な各環境変数について、カスタム値を入力するか、アプリで定義された値を使用します。",
+  "deployDrawer.envVarPlaceholder": "値を入力",
+  "deployDrawer.envVarSource.ariaLabel": "{{key}} の変数値ソースを選択",
+  "deployDrawer.envVarSource.default": "アプリの値",
+  "deployDrawer.envVarSource.lastDeployment": "最後にデプロイされた値",
+  "deployDrawer.envVarSource.literal": "カスタム値",
+  "deployDrawer.envVarType.number": "数値",
+  "deployDrawer.envVarType.secret": "シークレット",
+  "deployDrawer.envVarType.string": "文字列",
+  "deployDrawer.envVars": "環境変数",
+  "deployDrawer.existingReleaseHint": "このリリースはそのままデプロイされます。新しいリリースは作成されません。",
+  "deployDrawer.loadingBindings": "解決中...",
+  "deployDrawer.lockedHint": "現在の環境にロックされています",
+  "deployDrawer.missingRequiredBinding": "この必須バインディングの認証情報を選択してください。",
+  "deployDrawer.missingRequiredEnvVar": "この必須環境変数の値を入力してください。",
+  "deployDrawer.modelCreds": "モデル認証情報",
+  "deployDrawer.needsValidation": " (検証が必要)",
+  "deployDrawer.newReleaseHint": "選択したワークフローアプリの YAML から新しいリリースが作成されます。",
+  "deployDrawer.noBindingRequired": "不要",
+  "deployDrawer.noCredentialCandidates": "利用可能な認証情報がありません。",
+  "deployDrawer.noNewEnvironmentAvailable": "利用可能なすべての環境には既にデプロイがあります。",
+  "deployDrawer.noOtherReleaseAvailable": "この環境で利用可能な他のリリースはありません。",
+  "deployDrawer.noReleaseAvailable": "環境にデプロイする前にリリースを作成してください。",
+  "deployDrawer.notFound": "デプロイが見つかりません。",
+  "deployDrawer.noteLabel": "リリースの説明 (任意)",
+  "deployDrawer.notePlaceholder": "例: オンボーディング文言の修正をリリース",
+  "deployDrawer.pluginCreds": "プラグイン認証情報",
+  "deployDrawer.promote": "デプロイ",
+  "deployDrawer.promoteDescription": "デプロイするリリースとターゲット環境を選択します。",
+  "deployDrawer.promoteTitle": "環境にデプロイ",
+  "deployDrawer.readOnly": "読み取り専用",
+  "deployDrawer.redeploy": "環境にデプロイ",
+  "deployDrawer.redeployDescription": "デプロイするリリースとターゲット環境を選択します。",
+  "deployDrawer.redeployExistingReleaseHint": "現在のリリースがそのまま再デプロイされます。新しいリリースは作成されません。",
+  "deployDrawer.redeployTitle": "環境にデプロイ",
+  "deployDrawer.releaseLabel": "リリース",
+  "deployDrawer.requiredBinding": "必須",
+  "deployDrawer.rollback": "デプロイ",
+  "deployDrawer.rollbackDescription": "デプロイするリリースとターゲット環境を選択します。",
+  "deployDrawer.rollbackTitle": "環境にデプロイ",
+  "deployDrawer.runtimeCredentials": "認証情報",
+  "deployDrawer.secretPlaceholder": "シークレット",
+  "deployDrawer.selectCredential": "認証情報を選択",
+  "deployDrawer.selectEnv": "環境を選択",
+  "deployDrawer.selectProviderCred": "{{provider}} の認証情報を選択",
+  "deployDrawer.selectProviderKey": "{{provider}} のキーを選択",
+  "deployDrawer.selectRelease": "リリースを選択",
+  "deployDrawer.targetEnv": "ターゲット環境",
+  "deployDrawer.title": "環境にデプロイ",
+  "deployDrawer.valuePlaceholder": "値",
+  "deployTab.cancelDeployment": "デプロイをキャンセル",
+  "deployTab.closeError": "閉じる",
+  "deployTab.col.actions": "アクション",
+  "deployTab.col.currentRelease": "現在のリリース",
+  "deployTab.col.environment": "環境",
+  "deployTab.col.status": "ステータス",
+  "deployTab.col.updated": "更新日",
+  "deployTab.collapseDetails": "デプロイ詳細を折りたたむ",
+  "deployTab.confirmUndeploy": "アンデプロイ",
+  "deployTab.deployOtherVersion": "別のリリースをデプロイ",
+  "deployTab.deployToEnv": "{{name}} にデプロイ",
+  "deployTab.deployToNewEnv": "新しい環境にデプロイ...",
+  "deployTab.empty": "インスタンスはまだありません。新しい環境にデプロイして開始してください。",
+  "deployTab.emptyDescription": "リリースとターゲット環境を選択して、このデプロイをユーザーが利用できるようにします。",
+  "deployTab.emptyTitle": "実行中の環境はまだありません",
+  "deployTab.envCount": "環境",
+  "deployTab.errorCode": "コード",
+  "deployTab.errorDialogDesc": "再試行する前、または別のリリースをデプロイする前に、最後に失敗したデプロイを確認してください。",
+  "deployTab.errorDialogTitle": "{{name}} でのデプロイエラー",
+  "deployTab.errorMessage": "メッセージ",
+  "deployTab.errorPhase": "フェーズ",
+  "deployTab.expandDetails": "デプロイ詳細を展開",
+  "deployTab.moreActions": "その他のアクション",
+  "deployTab.newDeployment": "新しい環境にデプロイ",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "デプロイ ID",
+  "deployTab.panel.endpoints": "エンドポイント",
+  "deployTab.panel.envVars": "環境変数",
+  "deployTab.panel.error": "エラー",
+  "deployTab.panel.failedRelease": "失敗したリリース",
+  "deployTab.panel.health": "ヘルス",
+  "deployTab.panel.instanceInfo": "インスタンス情報",
+  "deployTab.panel.modelCreds": "モデル認証情報",
+  "deployTab.panel.pluginCreds": "プラグイン認証情報",
+  "deployTab.panel.release": "リリース",
+  "deployTab.panel.releaseCreatedAt": "リリース作成日時",
+  "deployTab.panel.releaseInfo": "リリース情報",
+  "deployTab.panel.replicas": "レプリカ",
+  "deployTab.panel.run": "実行",
+  "deployTab.panel.runtimeBindings": "認証情報",
+  "deployTab.panel.runtimeInfo": "ランタイム情報",
+  "deployTab.panel.runtimeMode": "ランタイムモード",
+  "deployTab.panel.runtimeNote": "ランタイムメモ",
+  "deployTab.panel.targetRelease": "ターゲットリリース",
+  "deployTab.panel.unknownError": "デプロイに失敗しました。",
+  "deployTab.promote": "デプロイ",
+  "deployTab.redeploy": "再デプロイ",
+  "deployTab.releaseCreatedAt": "リリース作成 {{time}}",
+  "deployTab.retry": "再試行",
+  "deployTab.shortcut": "ショートカット",
+  "deployTab.status.deployFailed": "デプロイ失敗",
+  "deployTab.status.deployingRelease": "デプロイ中 ({{release}})",
+  "deployTab.status.runningOutOfSync": "実行中 (同期保留中)",
+  "deployTab.status.runningWithFailed": "実行中 (前回のデプロイは失敗)",
+  "deployTab.undeploy": "アンデプロイ",
+  "deployTab.undeployConfirmDesc": "エンドユーザーアクセスはすぐに停止します。リリースは後で再デプロイできます。",
+  "deployTab.undeployConfirmTitle": "{{name}} からアンデプロイしますか？",
+  "deployTab.undeployFrom": "{{name}} からアンデプロイ",
+  "deployTab.undeployImpactTitle": "影響を受けるインスタンス",
+  "deployTab.viewError": "エラーを表示",
+  "deployTab.viewLogs": "ログを表示",
+  "deployTab.viewProgress": "進捗を表示",
+  "detail.backToInstances": "デプロイ一覧に戻る",
+  "detail.deployingCount": "{{count}} デプロイ中",
+  "detail.envCount_one": "{{count}} 環境",
+  "detail.envCount_other": "{{count}} 環境",
+  "detail.failedCount": "{{count}} 失敗",
+  "detail.mobileTabs": "デプロイセクション",
+  "detail.notFound": "デプロイが見つかりません",
+  "detail.openSourceApp": "ソース {{name}} を開く",
+  "detail.sourceApp": "ソース",
+  "detail.sourceAppLink": "ソース",
+  "documentTitle.create": "新しいデプロイ · デプロイ",
+  "documentTitle.detail": "デプロイ · デプロイ",
+  "documentTitle.list": "デプロイ",
+  "filter.allEnvs": "すべての環境",
+  "filter.notDeployed": "未デプロイ",
+  "filter.searchPlaceholder": "デプロイを検索",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "アドミッション",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "ブートストラップ中",
+  "health.ENVIRONMENT_STATUS_DELETING": "削除中",
+  "health.ENVIRONMENT_STATUS_FAILED": "利用不可",
+  "health.ENVIRONMENT_STATUS_READY": "利用可能",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "不明",
+  "list.clearFilters": "フィルタをクリア",
+  "list.clearSearch": "デプロイ検索をクリア",
+  "list.createDeployment": "新規",
+  "list.empty": "デプロイが見つかりません。",
+  "list.emptyDescription": "ワークフローアプリまたはワークフロー DSL パッケージからデプロイを作成して、リリース、環境、アクセスを管理します。",
+  "list.emptyFilteredDescription": "現在の検索条件または環境フィルタに一致するデプロイがありません。",
+  "list.emptyFilteredTitle": "一致するデプロイがありません",
+  "list.emptyTitle": "デプロイはまだありません",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "分離",
+  "mode.ENVIRONMENT_MODE_SHARED": "共有",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "不明",
+  "newInstance.comingSoon": "近日公開",
+  "newInstance.fromStudio": "スタジオから選択",
+  "newInstance.importDSL": "DSL をインポート",
+  "newInstance.title": "新しいデプロイ",
+  "overview.accessEndpoints": "アクセスエンドポイント",
+  "overview.accessMeta.apiTokens": "API トークンを管理",
+  "overview.accessMeta.cli": "CLI アクセスを表示",
+  "overview.accessMeta.webApp": "WebApp アクセスを管理",
+  "overview.accessStatus": "アクセス",
+  "overview.api": "API トークン",
+  "overview.apiKeysCount_one": "{{count}} API トークン",
+  "overview.apiKeysCount_other": "{{count}} API トークン",
+  "overview.apiTokenSummary.environments_one": "{{count}} 個のデプロイ済み環境",
+  "overview.apiTokenSummary.environments_other": "{{count}} 個のデプロイ済み環境",
+  "overview.availableForDeployment": "デプロイ可能",
+  "overview.basicInfo": "基本情報",
+  "overview.cardAction.deployLatest": "最新リリースをデプロイ",
+  "overview.cardAction.redeploy": "再デプロイ",
+  "overview.cardAction.viewProgress": "デプロイを表示",
+  "overview.chip.behindTooltip_one": "最新より 1 リリース遅れています。最新リリースをデプロイして更新してください。",
+  "overview.chip.behindTooltip_other": "最新より {{count}} リリース遅れています。最新リリースをデプロイして更新してください。",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "デプロイ中",
+  "overview.chip.deployingTooltip": "デプロイが進行中です。",
+  "overview.chip.empty": "空",
+  "overview.chip.emptyTooltip": "この環境にデプロイされているリリースはありません。",
+  "overview.chip.failed": "失敗",
+  "overview.chip.failedTooltip": "最新のデプロイ試行は失敗しました。",
+  "overview.chip.latest": "最新",
+  "overview.chip.latestTooltip": "この環境は最新のリリースを実行しています。",
+  "overview.chip.needsReleaseFirst": "先にリリースを作成してください",
+  "overview.chip.olderRelease": "古い",
+  "overview.chip.olderReleaseTooltip": "この環境は古いリリースを実行しています。",
+  "overview.chip.openInDeployTab": "デプロイの進捗を表示",
+  "overview.cli": "CLI",
+  "overview.configured": "設定済み",
+  "overview.createRelease": "リリースを作成",
+  "overview.created": "作成日",
+  "overview.deploy": "デプロイ",
+  "overview.deployedEnvironments": "デプロイ済み",
+  "overview.deploymentOverview": "デプロイ概要",
+  "overview.deploymentStatus": "デプロイステータス",
+  "overview.description": "説明",
+  "overview.developerApi": "開発者 API",
+  "overview.disabled": "無効",
+  "overview.emptyValue": "未設定",
+  "overview.enabled": "有効",
+  "overview.enabledChannels": "アクセス有効",
+  "overview.endUserAccess": "エンドユーザーアクセス",
+  "overview.environments": "環境",
+  "overview.hero.byName": "{{name}} 作成",
+  "overview.hero.empty": "リリースはまだありません",
+  "overview.hero.emptyDescription": "デプロイ前に現在のソースからリリースを作成してください。",
+  "overview.hero.propagation_one": "{{count}}/{{total}} 環境にデプロイ済み",
+  "overview.hero.propagation_other": "{{count}}/{{total}} 環境にデプロイ済み",
+  "overview.hero.untargeted": "まだ環境が設定されていません",
+  "overview.instanceDetails": "デプロイ詳細",
+  "overview.instanceId": "デプロイ ID",
+  "overview.latestRelease.releaseCount_one": "{{count}} リリース",
+  "overview.latestRelease.releaseCount_other": "{{count}} リリース",
+  "overview.latestReleaseTitle": "最新リリース",
+  "overview.manageDeployments": "デプロイを管理",
+  "overview.name": "名前",
+  "overview.noAccessConfig": "アクセス設定はありません。",
+  "overview.noReleaseYet": "環境にデプロイする前にリリースを作成してください。",
+  "overview.notConfigured": "未設定",
+  "overview.previousReleases.empty": "以前のリリースはまだありません。",
+  "overview.previousReleases.retired": "現在デプロイされていません",
+  "overview.previousReleases.title": "以前のリリース",
+  "overview.previousReleases.viewAll": "すべて表示",
+  "overview.ready": "デプロイ可能",
+  "overview.recentReleases": "最近のリリース",
+  "overview.releaseDeployedTitle": "{{release}} がデプロイされました",
+  "overview.releaseReadyTitle": "{{release}} はデプロイの準備ができています",
+  "overview.serviceMap": "サービスマップ",
+  "overview.servingRelease": "{{release}} を提供中",
+  "overview.servingReleaseDescription": "このデプロイは {{count}}/{{total}} の環境にデプロイされています。",
+  "overview.strip.deployToNewEnvironment": "新しい環境にデプロイ",
+  "overview.strip.empty": "環境が設定されていません。",
+  "overview.strip.emptyDeployableDescription": "準備ができたら、最新リリースを環境にデプロイしてください。",
+  "overview.strip.emptyDeployed": "インスタンスはまだありません。",
+  "overview.strip.emptyDescription": "環境にデプロイする前にリリースを作成してください。",
+  "overview.strip.emptyTitle": "インスタンスはまだありません",
+  "overview.strip.summary_one": "{{total}} 中 1 が最新リリース",
+  "overview.strip.summary_other": "{{total}} 中 {{count}} が最新リリース",
+  "overview.strip.title": "インスタンス",
+  "overview.switchSourceApp": "ソースを切り替え",
+  "overview.switchSourceAppDescription": "今後のリリースのソースとして使用するワークフローアプリを選択します。",
+  "overview.switchSourceAppHint": "切り替え後、新規作成されるリリースのみが新しいソースを使用します。過去のリリースと既存のデプロイは変更されません。",
+  "overview.targetRelease": "ターゲットリリース",
+  "overview.webapp": "WebApp",
+  "settings.danger": "危険ゾーン",
+  "settings.dangerDesc": "このデプロイを永続的に削除し、実行中のインスタンスをすべて停止します。この操作は取り消せません。",
+  "settings.delete": "デプロイを削除",
+  "settings.deleteConfirmDesc": "{{name}} を削除しますか？すべてのインスタンスがすべての環境で停止し、削除されます。この操作は取り消せません。",
+  "settings.deleteConfirmTitle": "デプロイを削除",
+  "settings.deleteFailed": "デプロイの削除に失敗しました。",
+  "settings.deleteImpact": "影響",
+  "settings.deleteImpactInstance": "デプロイ",
+  "settings.deleteImpactTitle": "影響を受けるデプロイ",
+  "settings.deleteImpactValue": "このデプロイはデプロイ一覧から削除されます。",
+  "settings.deleted": "デプロイを削除しました",
+  "settings.description": "説明",
+  "settings.descriptionHelp": "このデプロイの名前、説明、その他の設定を管理します。",
+  "settings.general": "一般",
+  "settings.name": "デプロイ名",
+  "settings.reset": "リセット",
+  "settings.save": "変更を保存",
+  "settings.updateFailed": "デプロイの更新に失敗しました。",
+  "settings.updated": "デプロイを更新しました",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "デプロイ中",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "同期保留中",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "デプロイ失敗",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "無効",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "実行中",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未デプロイ",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "アンデプロイ中",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "不明",
+  "subtitle": "環境全体のデプロイを管理します。",
+  "tabs.access.description": "アクセスチャネルとアクセス権限を管理します。",
+  "tabs.access.name": "アクセス",
+  "tabs.api-tokens.description": "API トークンを管理し、HTTP 経由でインスタンスを呼び出します。",
+  "tabs.api-tokens.name": "API トークン",
+  "tabs.instances.description": "デプロイされた環境のインスタンスを表示および管理します。",
+  "tabs.instances.name": "インスタンス",
+  "tabs.overview.description": "環境全体でのデプロイのステータスを表示します。",
+  "tabs.overview.name": "概要",
+  "tabs.releases.description": "リリースを作成、デプロイ、管理します。",
+  "tabs.releases.name": "リリース",
+  "tabs.settings.description": "このデプロイの名前、説明、その他の設定を管理します。",
+  "tabs.settings.name": "設定",
+  "title": "デプロイ",
+  "unsupportedDslNodes.description": "このリリースには、デプロイランタイムがまだサポートしていないノードが含まれています。スタジオでそれらを削除または置き換えてから、もう一度お試しください。",
+  "unsupportedDslNodes.descriptionWithTypes": "このリリースには、デプロイランタイムがまだサポートしていないノードが含まれています: {{nodeTypes}}。スタジオでそれらを削除または置き換えてから、もう一度お試しください。",
+  "unsupportedDslNodes.title": "サポートされていないノード",
+  "unsupportedDslNodes.unknownType": "不明な型",
+  "versions.cancelCreate": "キャンセル",
+  "versions.cancelDelete": "キャンセル",
+  "versions.cancelEdit": "キャンセル",
+  "versions.checkingReleaseContent": "リリース内容を確認中...",
+  "versions.col.action": "アクション",
+  "versions.col.author": "作成者",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "作成日",
+  "versions.col.deployedTo": "デプロイ先",
+  "versions.col.release": "リリース",
+  "versions.col.sourceApp": "ソース",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "作成",
+  "versions.createFailed": "リリースの作成に失敗しました。",
+  "versions.createRelease": "リリースを作成",
+  "versions.createReleaseDescription": "ワークフローアプリまたはワークフロー DSL ファイルからデプロイ可能なリリースを作成します。",
+  "versions.createReleaseHint": "新しいリリースは任意の環境にデプロイできます。",
+  "versions.createSuccess": "リリース「{{name}}」を作成しました。",
+  "versions.creating": "作成中...",
+  "versions.currentOn": "{{name}} の現在のリリース",
+  "versions.deleteConfirmDesc": "リリース「{{name}}」は永続的に削除されます。この操作は取り消せません。",
+  "versions.deleteConfirmTitle": "リリースを削除しますか？",
+  "versions.deleteFailed": "リリースの削除に失敗しました。",
+  "versions.deleteImpactDeployment": "デプロイステータス",
+  "versions.deleteImpactNotDeployed": "現在デプロイされていません",
+  "versions.deleteImpactRelease": "リリース",
+  "versions.deleteImpactTitle": "削除の影響",
+  "versions.deleteRelease": "リリースを削除",
+  "versions.deleteSuccess": "リリース「{{name}}」を削除しました。",
+  "versions.deploy": "デプロイ",
+  "versions.deployTo": "{{name}} にデプロイ",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "デプロイ中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "同期保留中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "失敗",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "無効",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "実行中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未デプロイ",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "アンデプロイ中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "不明",
+  "versions.deployingTo": "{{name}} にデプロイ中",
+  "versions.disabledReason.checkDeploymentsFailed": "デプロイの使用状況を確認できませんでした。後でもう一度お試しください。",
+  "versions.disabledReason.checkingDeployments": "デプロイの使用状況を確認中",
+  "versions.disabledReason.current": "このリリースは既に {{name}} で実行されています",
+  "versions.disabledReason.deploying": "アクティブなデプロイが完了するまでお待ちください",
+  "versions.disabledReason.envDisabled": "この環境はデプロイできません",
+  "versions.disabledReason.releaseInUse_one": "削除する前に、このリリースを {{count}} 環境からアンデプロイしてください",
+  "versions.disabledReason.releaseInUse_other": "削除する前に、このリリースを {{count}} 環境からアンデプロイしてください",
+  "versions.dslReadFailed": "DSL ファイルの読み込みに失敗しました。別のファイルを選択してもう一度お試しください。",
+  "versions.dslReading": "DSL ファイルを読み込み中...",
+  "versions.dslUnsupportedMode": "デプロイにはワークフロー DSL ファイルのみ使用できます。",
+  "versions.editFailed": "リリースの更新に失敗しました。",
+  "versions.editRelease": "リリースを編集",
+  "versions.editReleaseDescription": "このリリースの名前と説明を更新します。",
+  "versions.editSuccess": "リリース「{{name}}」を更新しました。",
+  "versions.empty": "まだ利用可能なリリースはありません。",
+  "versions.emptyDescription": "環境にデプロイする前に、最初のリリースを作成してください。",
+  "versions.emptyTitle": "リリースはまだありません",
+  "versions.emptyWithCreate": "リリースはまだありません。デプロイ前に最初のデプロイ可能なリリースを作成してください。",
+  "versions.exportDsl": "DSL をエクスポート",
+  "versions.exportDslFailed": "DSL のエクスポートに失敗しました。",
+  "versions.exportingDsl": "エクスポート中...",
+  "versions.groupHeader.deploy": "デプロイ",
+  "versions.groupHeader.promote": "デプロイ",
+  "versions.groupHeader.rollback": "以前のバージョンをデプロイ",
+  "versions.groupHeader.unavailable": "利用不可",
+  "versions.manualDslOption": "DSL をアップロード",
+  "versions.moreActions": "その他のアクション",
+  "versions.optional": "任意",
+  "versions.promote": "デプロイ",
+  "versions.promoteTo": "{{name}} にデプロイ",
+  "versions.releaseAlreadyExists": "同じ内容のリリースが既に存在します: {{name}}。",
+  "versions.releaseContentCheckFailed": "リリース内容の確認に失敗しました。",
+  "versions.releaseDescriptionLabel": "説明",
+  "versions.releaseDescriptionPlaceholder": "このリリースを説明してください",
+  "versions.releaseHistory": "リリース履歴",
+  "versions.releaseNameLabel": "リリース名",
+  "versions.releaseNamePlaceholder": "リリース名",
+  "versions.releaseNameRequired": "リリース名を入力してください。",
+  "versions.releaseSourceLabel": "リリースソース",
+  "versions.rollbackTo": "{{name}} にデプロイ",
+  "versions.saveEdit": "保存",
+  "versions.sourceAppOption": "ワークフローアプリ"
+}
diff --git a/web/i18n/ja-JP/permission-keys.json b/web/i18n/ja-JP/permission-keys.json
new file mode 100644
index 00000000000..d91764df177
--- /dev/null
+++ b/web/i18n/ja-JP/permission-keys.json
@@ -0,0 +1,50 @@
+{
+  "api_extension.manage": "API拡張設定を管理",
+  "app.access_config": "アプリアクセス権限を設定",
+  "app.acl.access_config": "アプリアクセス権限を設定",
+  "app.acl.delete": "アプリを削除",
+  "app.acl.edit": "アプリの編集とオーケストレーション",
+  "app.acl.import_export_dsl": "DSLのインポート / エクスポート",
+  "app.acl.monitor": "監視と運用",
+  "app.acl.preview": "アプリをプレビュー",
+  "app.acl.release_and_version": "アプリ公開とバージョン管理",
+  "app.acl.test_and_run": "アプリのテストと使用",
+  "app.acl.view_layout": "オーケストレーションページの読み取り専用",
+  "app.create_and_management": "アプリの作成と、自分が作成したアプリの管理",
+  "app.tag.manage": "アプリタグを管理",
+  "app_library.access": "アプリライブラリにアクセス",
+  "billing.manage": "サブスクリプションプランを変更",
+  "billing.subscription.manage": "請求ポータルで請求とサブスクリプションを管理",
+  "billing.view": "設定の請求ページにアクセス",
+  "credential.manage": "認証情報を管理",
+  "credential.use": "認証情報を使用",
+  "customization.manage": "カスタマイズを管理",
+  "data_source.manage": "データソース設定を管理",
+  "dataset.access_config": "ナレッジベースのアクセス権限を設定",
+  "dataset.acl.access_config": "ナレッジベースのアクセス権限を設定",
+  "dataset.acl.delete": "ナレッジベースを削除",
+  "dataset.acl.delete_file": "ナレッジベースファイルを削除",
+  "dataset.acl.document_download": "ドキュメントをダウンロード",
+  "dataset.acl.edit": "ナレッジベースを編集",
+  "dataset.acl.import_export_dsl": "ナレッジパイプライン DSL のインポート / エクスポート",
+  "dataset.acl.pipeline_release": "ナレッジパイプライン公開とバージョン管理",
+  "dataset.acl.pipeline_test": "パイプラインテスト",
+  "dataset.acl.preview": "ナレッジベースをプレビュー",
+  "dataset.acl.readonly": "ナレッジベースの読み取り専用",
+  "dataset.acl.retrieval_recall": "ナレッジベース検索リコール",
+  "dataset.acl.use": "ナレッジベースにドキュメントを追加",
+  "dataset.api_key.manage": "ナレッジベース API キーを管理",
+  "dataset.create_and_management": "ナレッジベースの作成と、自分が作成したナレッジベースの管理",
+  "dataset.external.connect": "外部ナレッジベースに接続",
+  "dataset.tag.manage": "ナレッジベースタグを管理",
+  "mcp.manage": "MCPを管理",
+  "plugin.debug": "プラグインをデバッグ",
+  "plugin.install": "プラグインのインストールと更新",
+  "plugin.manage": "プラグインを管理",
+  "plugin.plugin_preferences": "プラグイン設定を管理",
+  "snippets.create_and_modify": "スニペットの作成と変更",
+  "snippets.management": "スニペットを管理",
+  "tool.manage": "ツールを管理",
+  "workspace.member.manage": "メンバーを管理",
+  "workspace.role.manage": "ロール権限とリソースアクセスルールを管理"
+}
diff --git a/web/i18n/ja-JP/permission.json b/web/i18n/ja-JP/permission.json
new file mode 100644
index 00000000000..5a30f5c4d2e
--- /dev/null
+++ b/web/i18n/ja-JP/permission.json
@@ -0,0 +1,104 @@
+{
+  "accessRule.actions": "アクション",
+  "accessRule.addMemberAria": "{{name}} を追加",
+  "accessRule.addMembersTitle": "メンバーを追加",
+  "accessRule.allPermittedMembers": "ロール権限を持つすべてのメンバー",
+  "accessRule.allPermittedMembersDescription": "一致するロール権限を持つメンバーは、このリソースにアクセスできます。",
+  "accessRule.appDescription": "このアプリを公開する対象を制御します。メンバーが表示または操作するには、引き続きロール権限が必要です。",
+  "accessRule.appTitle": "アプリアクセスルール",
+  "accessRule.changeOpenScopeDescription": "公開範囲を変更すると、このリソースのすべての個別権限設定がリセットされます。切り替え後、メンバー固有の権限を再度追加する必要があります。",
+  "accessRule.changeOpenScopeTitle": "リソースの公開範囲を変更しますか？",
+  "accessRule.collapseSection": "{{title}} を折りたたむ",
+  "accessRule.copied": "アクセスルールをコピーしました",
+  "accessRule.created": "アクセスルールを作成しました",
+  "accessRule.datasetDescription": "このナレッジベースを公開する対象を制御します。メンバーが表示または操作するには、引き続きロール権限が必要です。",
+  "accessRule.datasetTitle": "ナレッジベースアクセスルール",
+  "accessRule.defaultPermission": "ロール権限に従う",
+  "accessRule.deleteDescription": "このアクセスルールは完全に削除され、リソースの認可リストから削除されます。",
+  "accessRule.deleteTitle": "「{{name}}」を削除しますか？",
+  "accessRule.deleted": "アクセスルールを削除しました",
+  "accessRule.exceptionPermissionFor": "{{name}} の例外権限",
+  "accessRule.expandSection": "{{title}} を展開",
+  "accessRule.individualPermissionSettings": "個別権限設定",
+  "accessRule.individualPermissionSettingsTip": "特定の共同編集者またはグループに権限の例外を設定します。これらの設定はデフォルトのアクセスレベルを上書きします。",
+  "accessRule.lockedSummary_one": "· {{count}} 件ロック済み",
+  "accessRule.lockedSummary_other": "· {{count}} 件ロック済み",
+  "accessRule.maintainer": "メンテナー",
+  "accessRule.member": "メンバー",
+  "accessRule.newPermissionSet": "新しい権限セット",
+  "accessRule.noAvailableMembers": "追加できるメンバーがいません",
+  "accessRule.noDescription": "説明なし",
+  "accessRule.noRoles": "ロールなし",
+  "accessRule.noRules": "アクセスルールがありません",
+  "accessRule.noUserAccessSettings": "個別権限設定がありません",
+  "accessRule.permission": "権限",
+  "accessRule.resourceOpenScope": "リソース公開範囲",
+  "accessRule.resourceOpenScopeDescription": "このリソースを公開する対象を選択します。各メンバーが実行できる操作はロール権限で決まります。",
+  "accessRule.specificMembersOnly": "指定メンバーのみ",
+  "accessRule.specificMembersOnlyDescription": "選択されたメンバーのみがこのリソースにアクセスできます。",
+  "accessRule.summary_one": "{{count}} 件の権限セット",
+  "accessRule.summary_other": "{{count}} 件の権限セット",
+  "accessRule.updated": "アクセスルールを更新しました",
+  "common.duplicateAction": "複製",
+  "group.app": "アプリ",
+  "group.app_acl": "アプリアクセス権限",
+  "group.billing": "請求",
+  "group.credential": "認証情報",
+  "group.dataset": "ナレッジベース",
+  "group.dataset_acl": "ナレッジベースアクセス権限",
+  "group.plugin": "プラグイン",
+  "group.tool_mcp": "ツールとMCP",
+  "group.workspace": "ワークスペース",
+  "permissionList.clearAll": "すべてクリア",
+  "permissionList.collapseGroup": "グループを折りたたむ",
+  "permissionList.expandGroup": "グループを展開",
+  "permissionList.noPermissionsFound": "権限が見つかりません",
+  "permissionList.selectAll": "すべて選択",
+  "permissionSet.descriptionLabel": "説明",
+  "permissionSet.descriptionPlaceholder": "この権限セットが付与する内容を説明",
+  "permissionSet.learnMore": "権限について詳しく見る",
+  "permissionSet.modal.create.app.description": "アクセスルールで参照できるアプリ権限セットを作成し、すばやく認可します。",
+  "permissionSet.modal.create.app.title": "アプリ権限セットを作成",
+  "permissionSet.modal.create.dataset.description": "アクセスルールで参照できるナレッジベース権限セットを作成し、すばやく認可します。",
+  "permissionSet.modal.create.dataset.title": "ナレッジベース権限セットを作成",
+  "permissionSet.modal.edit.app.description": "この権限セットの名前、説明、付与される権限を変更します。",
+  "permissionSet.modal.edit.app.title": "アプリ権限セットを編集",
+  "permissionSet.modal.edit.dataset.description": "この権限セットの名前、説明、付与される権限を変更します。",
+  "permissionSet.modal.edit.dataset.title": "ナレッジベース権限セットを編集",
+  "permissionSet.modal.view.app.description": "この権限セットの名前、説明、付与される権限を表示します。",
+  "permissionSet.modal.view.app.title": "アプリ権限セットを表示",
+  "permissionSet.modal.view.dataset.description": "この権限セットの名前、説明、付与される権限を表示します。",
+  "permissionSet.modal.view.dataset.title": "ナレッジベース権限セットを表示",
+  "permissionSet.nameLabel": "権限セット名",
+  "permissionSet.namePlaceholder": "例: DSL をエクスポート可能",
+  "permissionSet.permissions": "権限",
+  "role.addRole": "ロールを作成",
+  "role.copyMembersDescription_one": "「{{name}}」は {{count}} 人のメンバーに割り当てられています。新しいロールのコピーに同じメンバーを含めますか？",
+  "role.copyMembersDescription_other": "「{{name}}」は {{count}} 人のメンバーに割り当てられています。新しいロールのコピーに同じメンバーを含めますか？",
+  "role.copyMembersLoading": "割り当て済みメンバーを読み込み中...",
+  "role.copyMembersTitle": "メンバーの割り当てもコピーしますか？",
+  "role.created": "ロールを作成しました",
+  "role.deleteDescription": "このロールは完全に削除され、それを使用するメンバーまたはアクセスルールから削除されます。",
+  "role.deleteTitle": "「{{name}}」を削除しますか？",
+  "role.deleted": "ロールを削除しました",
+  "role.duplicated": "ロールを複製しました",
+  "role.groups.builtin": "システムロール",
+  "role.groups.custom": "カスタムロール",
+  "role.loading": "ロールを読み込み中...",
+  "role.modal.create.description": "ロールを作成して権限を割り当てます",
+  "role.modal.create.title": "ロールを作成",
+  "role.modal.descriptionLabel": "説明",
+  "role.modal.descriptionPlaceholder": "このロールの責任範囲を説明",
+  "role.modal.edit.description": "ロールの詳細と権限を編集します",
+  "role.modal.edit.title": "ロールを編集",
+  "role.modal.nameLabel": "ロール名",
+  "role.modal.namePlaceholder": "例: マーケティング責任者",
+  "role.modal.view.description": "ロールの詳細と権限を表示します",
+  "role.modal.view.title": "ロールを表示",
+  "role.noDescription": "説明なし",
+  "role.noMatchingRoles": "一致するロールが見つかりません",
+  "role.searchPlaceholder": "ロールを検索...",
+  "role.updated": "ロールを更新しました",
+  "role.workspaceRoles.description": "ロールを作成し、このワークスペースで各ロールが実行できる操作を定義します。",
+  "role.workspaceRoles.title": "ワークスペースロール"
+}
diff --git a/web/i18n/ja-JP/workflow.json b/web/i18n/ja-JP/workflow.json
index 0ef5f9af860..ce74424f5fa 100644
--- a/web/i18n/ja-JP/workflow.json
+++ b/web/i18n/ja-JP/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "エージェント",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "回答",
   "blocks.assigner": "変数代入",
   "blocks.code": "コード実行",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "変数集約器",
   "blocks.variable-assigner": "変数代入器",
   "blocksAbout.agent": "大規模言語モデルを活用した質問応答や自然言語処理を実行します。",
+  "blocksAbout.agent-v2": "大規模言語モデルを活用した質問応答や自然言語処理を実行します。",
   "blocksAbout.answer": "チャットダイアログの返答内容を定義します。",
   "blocksAbout.assigner": "書き込み可能な変数（例：会話変数）への値の割り当てを行います。",
   "blocksAbout.code": "Python/NodeJS コードを実行してカスタムロジックを実装します。",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ワークフローID",
   "globalVar.fieldsDescription.workflowRunId": "ワークフロー実行ID",
   "globalVar.title": "システム変数",
+  "nodes.agent.advancedSetting": "詳細設定",
   "nodes.agent.checkList.strategyNotSelected": "戦略が選択されていません",
   "nodes.agent.clickToViewParameterSchema": "パラメータースキーマを見るにはクリックしてください",
   "nodes.agent.configureModel": "モデルを設定する",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "サポートされていないモデル",
   "nodes.agent.modelSelectorTooltips.deprecated": "このモデルは廃止されました",
   "nodes.agent.notAuthorized": "権限がありません",
+  "nodes.agent.outputVars.confirm": "確認",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "JSON 配列を入力してください。",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "true または false を入力してください。",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "ここではファイルの既定値はまだ設定できません。",
+  "nodes.agent.outputVars.defaultValueLabel": "既定値",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "有効な数値を入力してください。",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "JSON オブジェクトを入力してください。",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "既定値",
+  "nodes.agent.outputVars.delete": "{{name}} を削除",
+  "nodes.agent.outputVars.descriptionLabel": "説明",
+  "nodes.agent.outputVars.descriptionPlaceholder": "説明を追加",
+  "nodes.agent.outputVars.edit": "{{name}} を編集",
+  "nodes.agent.outputVars.editorLabel": "出力変数エディタ",
   "nodes.agent.outputVars.files.title": "エージェント生成ファイル",
   "nodes.agent.outputVars.files.transfer_method": "転送方法。値は remote_url または local_file です。",
   "nodes.agent.outputVars.files.type": "サポートタイプ。現在はサポート画像のみ",
   "nodes.agent.outputVars.files.upload_file_id": "ファイル ID をアップロード",
   "nodes.agent.outputVars.files.url": "画像の URL",
   "nodes.agent.outputVars.json": "エージェント生成の JSON",
+  "nodes.agent.outputVars.nameDuplicate": "出力名はすでに存在します",
+  "nodes.agent.outputVars.nameInvalid": "英字、数字、アンダースコアを使用してください。先頭は英字またはアンダースコアにしてください。",
+  "nodes.agent.outputVars.nameLabel": "フィールド名",
+  "nodes.agent.outputVars.namePlaceholder": "フィールド名",
+  "nodes.agent.outputVars.newOutput": "新しい出力",
+  "nodes.agent.outputVars.requiredLabel": "必須",
+  "nodes.agent.outputVars.showAdvancedOptions": "詳細オプションを表示",
   "nodes.agent.outputVars.text": "エージェント生成コンテンツ",
+  "nodes.agent.outputVars.typeLabel": "出力タイプ",
   "nodes.agent.outputVars.usage": "モデル使用量",
   "nodes.agent.parameterSchema": "パラメータスキーマ",
   "nodes.agent.pluginInstaller.install": "インストール",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "このインテグレーションは GitHub からインストールされています。再インストールするにはインテグレーションに移動してください。",
   "nodes.agent.pluginNotInstalled": "このインテグレーションはインストールされていません",
   "nodes.agent.pluginNotInstalledDesc": "このインテグレーションは GitHub からインストールされています。再インストールするにはインテグレーションに移動してください。",
+  "nodes.agent.roster.change": "変更",
+  "nodes.agent.roster.editInConsole": "Agent Console で編集",
+  "nodes.agent.roster.inlineSetup.description": "このノード内にのみ存在する一度きりのセットアップ",
+  "nodes.agent.roster.inlineSetup.name": "インラインセットアップ",
+  "nodes.agent.roster.inlineSetup.title": "Agent セットアップ",
+  "nodes.agent.roster.inlineSetup.type": "このノード内のみ",
+  "nodes.agent.roster.label": "エージェント",
+  "nodes.agent.roster.makeCopy": "コピーを作成",
+  "nodes.agent.roster.more": "Agent のその他の操作",
+  "nodes.agent.roster.openPanel": "{{name}} の詳細を開く",
+  "nodes.agent.roster.panelLabel": "{{name}} の詳細",
   "nodes.agent.strategy.configureTip": "エージェンティック戦略を設定してください。",
   "nodes.agent.strategy.configureTipDesc": "エージェント戦略を設定した後、このノードは残りの設定を自動的に読み込みます。この戦略は、マルチステップツール推論のメカニズムに影響を与えます。",
   "nodes.agent.strategy.label": "エージェンティック戦略",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "インストールされたインテグレーションのバージョンはこの戦略を提供していません。バージョンを切り替えるにはクリックしてください。",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}}はインストールされていません",
   "nodes.agent.strategyNotSet": "エージェンティック戦略は設定されていません",
+  "nodes.agent.task.insert": "挿入",
+  "nodes.agent.task.label": "Agent タスク",
+  "nodes.agent.task.mention": "メンション",
+  "nodes.agent.task.placeholder": "この Agent が行うべきことを記述してください...",
+  "nodes.agent.task.tooltip": "この Agent がこのワークフロー内で従うべきタスク指示を定義します。",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} 認可されていません",
   "nodes.agent.toolNotInstallTooltip": "{{tool}}はインストールされていません",
   "nodes.agent.toolbox": "ツールボックス",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "{{author}} によって",
   "tabs.question-understand": "問題理解",
   "tabs.requestToCommunity": "コミュニティにリクエスト",
-  "tabs.searchBlock": "ブロック検索",
+  "tabs.searchBlock": "ノード、Agent、人間、ナレッジを検索",
   "tabs.searchDataSource": "データソースを検索",
   "tabs.searchSnippets": "スニペットを検索...",
   "tabs.searchTool": "ツール検索",
diff --git a/web/i18n/ko-KR/agent-v-2.json b/web/i18n/ko-KR/agent-v-2.json
new file mode 100644
index 00000000000..2356cdcef67
--- /dev/null
+++ b/web/i18n/ko-KR/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "이 작업은 아직 사용할 수 없습니다.",
+  "agentDetail.access.actions.monitoring": "모니터링",
+  "agentDetail.access.copyAccessUrl": "액세스 URL 복사",
+  "agentDetail.access.copyFailed": "참조 복사에 실패했습니다.",
+  "agentDetail.access.copyReference": "{{name}}의 참조 복사",
+  "agentDetail.access.copyServiceEndpoint": "서비스 API 엔드포인트 복사",
+  "agentDetail.access.description": "이 에이전트에 도달할 수 있는 모든 진입점입니다.",
+  "agentDetail.access.empty": "연결된 액세스 지점이 없습니다",
+  "agentDetail.access.emptyDescription": "이 Roster 에이전트에는 아직 앱이나 워크플로 참조가 없습니다.",
+  "agentDetail.access.entries.agentApp.description": "이 Roster 에이전트에 연결된 에이전트 앱입니다.",
+  "agentDetail.access.entries.agentApp.name": "에이전트 앱",
+  "agentDetail.access.entries.workflow.description": "이 Roster 에이전트에 연결된 워크플로 및 노드 참조입니다.",
+  "agentDetail.access.entries.workflow.name": "워크플로 노드",
+  "agentDetail.access.entryCount_one": "항목 {{count}}개",
+  "agentDetail.access.entryCount_other": "항목 {{count}}개",
+  "agentDetail.access.groups.references.heading": "참조",
+  "agentDetail.access.groups.references.label": "연결된 참조",
+  "agentDetail.access.learnMore": "자세히 알아보기",
+  "agentDetail.access.moreActions": "{{name}}의 추가 작업",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "서비스 API 엔드포인트",
+  "agentDetail.access.serviceApi.title": "백엔드 서비스 API",
+  "agentDetail.access.status.disabled": "비활성화됨",
+  "agentDetail.access.status.enabled": "활성화됨",
+  "agentDetail.access.status.inService": "서비스 중",
+  "agentDetail.access.status.outOfService": "서비스 중지됨",
+  "agentDetail.access.title": "액세스 지점",
+  "agentDetail.access.toggleSurface": "{{name}} 액세스 전환",
+  "agentDetail.access.webApp.accessUrl": "액세스 URL",
+  "agentDetail.access.webApp.actions.customize": "사용자 지정",
+  "agentDetail.access.webApp.actions.embedded": "임베드",
+  "agentDetail.access.webApp.actions.launch": "실행",
+  "agentDetail.access.webApp.actions.settings": "설정",
+  "agentDetail.access.webApp.refreshUrl": "액세스 URL 새로 고침",
+  "agentDetail.access.webApp.showQrCode": "QR 코드 표시",
+  "agentDetail.access.webApp.ssoEnabled": "SSO 사용 가능",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "워크플로 내 노드로 사용",
+  "agentDetail.access.workflow.empty": "워크플로 참조가 없습니다.",
+  "agentDetail.access.workflow.loadFailed": "워크플로 참조를 불러오지 못했습니다.",
+  "agentDetail.access.workflow.loading": "워크플로 참조 불러오는 중…",
+  "agentDetail.access.workflow.nodeCount_one": "노드 {{count}}개",
+  "agentDetail.access.workflow.nodeCount_other": "노드 {{count}}개",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Studio에서 열기",
+  "agentDetail.access.workflow.openInStudioFor": "Studio에서 {{name}} 열기",
+  "agentDetail.access.workflow.table.actions": "작업",
+  "agentDetail.access.workflow.table.lastUpdated": "마지막 업데이트",
+  "agentDetail.access.workflow.table.name": "이름",
+  "agentDetail.access.workflow.table.nodes": "노드",
+  "agentDetail.access.workflow.table.version": "버전",
+  "agentDetail.access.workflow.title": "워크플로 액세스",
+  "agentDetail.configure.advancedSettings.description": "고급 사용자용. 환경 변수, 샌드박스 및 메모리.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "환경 변수 추가",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "{{key}} 삭제",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "{{key}} 값 숨기기",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": ".env 가져오기",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "숨겨진 .env 파일을 표시하려면 파일 선택기에서 Command + Shift + . 을 누르세요.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": ".env 파일이 숨겨져 있으면 시스템 파일 선택기에서 숨김 파일 표시를 활성화하세요.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "숨겨진 .env 파일을 표시하려면 파일 탐색기에서 '숨긴 항목'을 활성화하세요.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "{{key}} 값 표시",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "환경 변수 범위 선택",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "이 에이전트가 런타임에 사용할 수 있는 환경 변수입니다.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Env Editor 전환",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "고급 설정",
+  "agentDetail.configure.advancedSettings.toggle": "고급 설정 전환",
+  "agentDetail.configure.chatFeatures.description": "Web app 및 채팅 화면에서의 최종 사용자 채팅 경험을 구성합니다.",
+  "agentDetail.configure.chatFeatures.title": "채팅 기능",
+  "agentDetail.configure.files.add": "파일 추가",
+  "agentDetail.configure.files.empty.description": "사양, 템플릿, 가이드라인 등 에이전트가 읽을 수 있는 문서를 업로드하세요",
+  "agentDetail.configure.files.empty.title": "아직 파일이 없습니다",
+  "agentDetail.configure.files.label": "파일",
+  "agentDetail.configure.files.preview.empty": "미리보기 내용이 없습니다.",
+  "agentDetail.configure.files.preview.failed": "미리보기를 불러오지 못했습니다.",
+  "agentDetail.configure.files.preview.unsupported": "이 파일은 미리보기를 지원하지 않습니다.",
+  "agentDetail.configure.files.remove": "{{name}} 제거",
+  "agentDetail.configure.files.tip": "이 에이전트가 작업을 오케스트레이션할 때 사용할 수 있는 파일입니다.",
+  "agentDetail.configure.files.toggle": "파일 전환",
+  "agentDetail.configure.files.treeLabel": "에이전트 파일",
+  "agentDetail.configure.files.upload.action": "업로드",
+  "agentDetail.configure.files.upload.browse": "찾아보기",
+  "agentDetail.configure.files.upload.description": "이 에이전트의 파일을 업로드합니다.",
+  "agentDetail.configure.files.upload.dropzone": "파일을 여기에 놓거나",
+  "agentDetail.configure.files.upload.failed": "파일 업로드에 실패했습니다.",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "파일 하나를 업로드하세요.",
+  "agentDetail.configure.files.upload.success": "파일을 업로드했습니다.",
+  "agentDetail.configure.files.upload.title": "파일 업로드",
+  "agentDetail.configure.knowledgeRetrieval.add": "지식 검색 추가",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "지식 추가",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "「+」 버튼을 클릭하여 지식을 추가하세요",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "지식",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "검색 설정",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "지식 검색에 대해 자세히 알아보기",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "자동",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "조건",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "비활성화",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "메타데이터 필터링",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "수동",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "메타데이터 필터링 모드 선택",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "지식 검색 이름",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "에이전트가 결정",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "에이전트가 프롬프트와 사용 가능한 컨텍스트로 자체적으로 쿼리를 작성합니다. 여기서 설정할 것은 없습니다.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "사용자 지정 쿼리",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "이 검색 소스에 대한 고정 쿼리를 작성합니다.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "사용자 지정 쿼리 텍스트",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "검색 쿼리 입력",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "쿼리",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "지식 검색 · 에이전트가 결정",
+  "agentDetail.configure.knowledgeRetrieval.edit": "{{name}} 편집",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "에이전트가 답변하는 동안 검색할 수 있는 지식 베이스를 연결하세요",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "아직 지식이 없습니다",
+  "agentDetail.configure.knowledgeRetrieval.label": "지식 검색",
+  "agentDetail.configure.knowledgeRetrieval.remove": "{{name}} 제거",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "이 에이전트가 작업을 오케스트레이션할 때 사용할 수 있는 지식 검색 소스입니다.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "지식 검색 전환",
+  "agentDetail.configure.model.label": "모델",
+  "agentDetail.configure.orchestrate": "오케스트레이션",
+  "agentDetail.configure.preview.chatFeatures": "채팅 기능",
+  "agentDetail.configure.preview.empty.defaultAgentName": "에이전트",
+  "agentDetail.configure.preview.empty.description": "현재 초안을 테스트하려면 메시지를 보내세요.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "아직 지시 사항이 없어 답변은 기본 모델에서 제공됩니다.",
+  "agentDetail.configure.preview.endUserAuth": "최종 사용자 인증",
+  "agentDetail.configure.preview.restart": "미리보기 다시 시작",
+  "agentDetail.configure.preview.title": "미리보기",
+  "agentDetail.configure.prompt.copied": "프롬프트를 복사했습니다",
+  "agentDetail.configure.prompt.copy": "프롬프트 복사",
+  "agentDetail.configure.prompt.copyFailed": "프롬프트 복사에 실패했습니다.",
+  "agentDetail.configure.prompt.insert.label": "삽입",
+  "agentDetail.configure.prompt.insert.question": "질문 시작",
+  "agentDetail.configure.prompt.insert.reportFile": "보고서 파일 출력",
+  "agentDetail.configure.prompt.insert.tenders": "입찰 시작",
+  "agentDetail.configure.prompt.label": "프롬프트",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "멘션",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "여기에 지시 사항을 작성하세요,",
+  "agentDetail.configure.prompt.tip": "이 에이전트가 입력을 어떻게 해석하고, 도구를 호출하며, 출력을 생성할지 정의합니다.",
+  "agentDetail.configure.publishBar.draft": "초안",
+  "agentDetail.configure.publishBar.publishUpdate": "업데이트 게시",
+  "agentDetail.configure.publishBar.published": "게시됨",
+  "agentDetail.configure.publishBar.publishedAt": "{{time}}에 게시",
+  "agentDetail.configure.publishBar.publishing": "게시 중…",
+  "agentDetail.configure.publishBar.saved": "5 분 전에 저장됨",
+  "agentDetail.configure.publishBar.savedAt": "{{time}}에 저장",
+  "agentDetail.configure.publishBar.unpublishedChanges": "게시되지 않은 변경 사항",
+  "agentDetail.configure.publishBar.upToDate": "최신 상태입니다",
+  "agentDetail.configure.publishBar.versionHistory": "버전 기록 열기",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "영향을 받는 워크플로",
+  "agentDetail.configure.publishImpact.cancel": "취소",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "에이전트가",
+  "agentDetail.configure.publishImpact.descriptionSuffix": "에 표시됩니다. 변경 사항이 이에 영향을 미칩니다.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "이 에이전트",
+  "agentDetail.configure.publishImpact.title": "{{name}}에 {{action}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "워크플로 {{count}}개",
+  "agentDetail.configure.publishImpact.workflowCount_other": "워크플로 {{count}}개",
+  "agentDetail.configure.skills.add": "스킬 추가",
+  "agentDetail.configure.skills.detail.contentRegion": "스킬 상세 내용",
+  "agentDetail.configure.skills.detail.fileCount": "파일 {{count}}개",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "스킬 파일",
+  "agentDetail.configure.skills.detail.files": "파일",
+  "agentDetail.configure.skills.empty.description": "스킬은 에이전트가 작업하면서 호출할 수 있는 재사용 가능한 전문 능력을 제공합니다",
+  "agentDetail.configure.skills.empty.title": "아직 스킬이 없습니다",
+  "agentDetail.configure.skills.itemType": "스킬",
+  "agentDetail.configure.skills.label": "스킬",
+  "agentDetail.configure.skills.remove": "{{name}} 제거",
+  "agentDetail.configure.skills.tip": "이 에이전트가 작업을 오케스트레이션할 때 사용할 수 있는 스킬입니다.",
+  "agentDetail.configure.skills.toggle": "스킬 전환",
+  "agentDetail.configure.skills.upload.action": "업로드",
+  "agentDetail.configure.skills.upload.browse": "찾아보기",
+  "agentDetail.configure.skills.upload.description": "이 에이전트용 .zip 또는 .skill 패키지를 업로드합니다.",
+  "agentDetail.configure.skills.upload.dropzone": "스킬 패키지를 여기에 놓거나",
+  "agentDetail.configure.skills.upload.failed": "스킬 업로드에 실패했습니다.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": ".zip 또는 .skill 파일을 업로드하세요.",
+  "agentDetail.configure.skills.upload.success": "스킬을 업로드했습니다.",
+  "agentDetail.configure.skills.upload.title": "스킬 업로드",
+  "agentDetail.configure.tools.add": "도구 추가",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "개발자용",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "에이전트가 샌드박스에서 실행할 명령줄 프로그램을 설치합니다. 설치가 필요하며 일반적으로 API Key 가 필요합니다.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI 도구",
+  "agentDetail.configure.tools.addMenu.tool.description": "웹 검색이나 통합과 같이 이 워크스페이스에 이미 있는 도구를 선택하세요.",
+  "agentDetail.configure.tools.addMenu.tool.label": "도구",
+  "agentDetail.configure.tools.cliDialog.description": "임의의 패키지 레지스트리에서 CLI 도구를 설치합니다. 에이전트는 제공된 바이너리에 대한 셸 액세스 권한을 얻습니다.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "CLI 도구 편집",
+  "agentDetail.configure.tools.cliDialog.env.description": "이 CLI 도구에 필요한 API 키, 토큰 또는 시크릿을 저장합니다. 값은 저장 시 암호화되며 에이전트가 도구를 호출할 때 환경 변수로 주입됩니다.",
+  "agentDetail.configure.tools.cliDialog.env.label": "환경 변수",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(선택 사항)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "샌드박스 실행 · 최초 호출 시 한 번 실행",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "설치 명령",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "설치 명령을 여기에 붙여넣으세요. 예: npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "설치 명령을 입력하세요.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "CLI 도구에 대해 자세히 알아보기",
+  "agentDetail.configure.tools.cliDialog.name.label": "CLI 도구 이름",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "CLI 도구 이름 지정",
+  "agentDetail.configure.tools.cliDialog.name.required": "CLI 도구 이름을 입력하세요.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "에이전트 프롬프트에 표시되지 않으며, 런타임에 $VAR 로만 주입됩니다",
+  "agentDetail.configure.tools.cliDialog.title": "CLI 도구 추가",
+  "agentDetail.configure.tools.cliTool": "CLI 도구",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "최종 사용자 · OAuth",
+  "agentDetail.configure.tools.editAction": "{{name}} 편집",
+  "agentDetail.configure.tools.empty.description": "도구를 사용하면 에이전트가 웹 검색이나 앱 호출 등의 작업을 수행할 수 있습니다",
+  "agentDetail.configure.tools.empty.title": "아직 도구가 없습니다",
+  "agentDetail.configure.tools.label": "도구",
+  "agentDetail.configure.tools.moreActions": "{{name}}의 추가 작업",
+  "agentDetail.configure.tools.pluginType": "플러그인",
+  "agentDetail.configure.tools.preAuthorize": "사전 승인",
+  "agentDetail.configure.tools.removeAction": "{{name}} 제거",
+  "agentDetail.configure.tools.removeProvider": "모든 도구 제거",
+  "agentDetail.configure.tools.tip": "이 에이전트가 작업을 오케스트레이션할 때 호출할 수 있는 도구입니다.",
+  "agentDetail.configure.tools.toggle": "도구 전환",
+  "agentDetail.configure.tools.toolTabs.all": "전체",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "사용자 지정",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "플러그인",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "에이전트",
+  "agentDetail.history": "기록",
+  "agentDetail.logs.description": "전체 로그는 사용자 입력, 에이전트 응답, 계획 및 도구 사용을 포함한 애플리케이션의 실행 상태를 기록합니다.",
+  "agentDetail.logs.empty": "로그가 없습니다",
+  "agentDetail.logs.filters.period.allTime": "전체 기간",
+  "agentDetail.logs.filters.period.label": "로그 기간",
+  "agentDetail.logs.filters.period.last30days": "지난 30 일",
+  "agentDetail.logs.filters.period.last7days": "지난 7 일",
+  "agentDetail.logs.filters.search.label": "로그 검색",
+  "agentDetail.logs.filters.search.placeholder": "검색",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "마지막 생성 시간",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "마지막 업데이트 시간",
+  "agentDetail.logs.filters.source.all": "소스",
+  "agentDetail.logs.filters.source.empty": "소스를 찾을 수 없습니다",
+  "agentDetail.logs.filters.source.label": "로그 소스",
+  "agentDetail.logs.filters.source.loadFailed": "소스를 불러오지 못했습니다",
+  "agentDetail.logs.filters.source.loading": "소스를 불러오는 중…",
+  "agentDetail.logs.filters.source.searchLabel": "소스 검색",
+  "agentDetail.logs.filters.source.searchPlaceholder": "검색",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "워크플로",
+  "agentDetail.logs.learnMore": "자세히 알아보기",
+  "agentDetail.logs.loadFailed": "로그를 불러오지 못했습니다",
+  "agentDetail.logs.loading": "로그를 불러오는 중…",
+  "agentDetail.logs.notAvailable": "없음",
+  "agentDetail.logs.table.createdTime": "생성 시간",
+  "agentDetail.logs.table.endUser": "최종 사용자",
+  "agentDetail.logs.table.messageCount": "메시지 수",
+  "agentDetail.logs.table.operationRate": "작업률",
+  "agentDetail.logs.table.source": "소스",
+  "agentDetail.logs.table.title": "제목",
+  "agentDetail.logs.table.unread": "읽지 않음",
+  "agentDetail.logs.table.updatedTime": "업데이트 시간",
+  "agentDetail.logs.table.userRate": "사용자 평점",
+  "agentDetail.logs.title": "로그",
+  "agentDetail.memorySettings.budgetLabel": "메모리 예산",
+  "agentDetail.memorySettings.description": "현재 활성 구성 스냅샷의 메모리 설정입니다.",
+  "agentDetail.memorySettings.export.description": "메모리 내보내기는 향후 릴리스에서 제공될 예정입니다.",
+  "agentDetail.memorySettings.export.download": "다운로드",
+  "agentDetail.memorySettings.export.soon": "곧 제공",
+  "agentDetail.memorySettings.export.title": "현재 메모리 내보내기",
+  "agentDetail.memorySettings.notConfigured": "구성되지 않음",
+  "agentDetail.memorySettings.scopeLabel": "메모리 범위",
+  "agentDetail.memorySettings.title": "메모리",
+  "agentDetail.metadata.activeVersionLabel": "활성 버전",
+  "agentDetail.metadata.appIdLabel": "앱 ID",
+  "agentDetail.metadata.description": "에이전트 백엔드에서 반환된 읽기 전용 Roster 필드입니다.",
+  "agentDetail.metadata.emptyValue": "사용할 수 없음",
+  "agentDetail.metadata.scopeLabel": "범위",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "워크플로 전용",
+  "agentDetail.metadata.sourceLabel": "소스",
+  "agentDetail.metadata.statusLabel": "상태",
+  "agentDetail.metadata.title": "메타데이터",
+  "agentDetail.metadata.updatedAtLabel": "업데이트 시간",
+  "agentDetail.metadata.workflowIdLabel": "워크플로 ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "워크플로 노드 ID",
+  "agentDetail.monitoring.change": "이전 기간 대비 {{value}}",
+  "agentDetail.monitoring.dateRangeLabel": "날짜 범위",
+  "agentDetail.monitoring.description": "워크플로 전반에 걸친 재사용 가능한 에이전트의 활동, 비용 및 상호 작용 품질을 추적합니다.",
+  "agentDetail.monitoring.learnMore": "자세히 알아보기",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "이 에이전트를 사용하는 워크플로를 트리거한 고유 최종 사용자 수.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "활성 사용자",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "이 액세스 지점에서의 사용자-에이전트 연속 통신 횟수.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "평균 세션 상호 작용",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "요청 시작부터 완료까지의 평균 출력 속도.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "토큰 출력 속도",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "워크플로 실행 전반에서 이 에이전트가 생성한 예상 토큰 비용.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "토큰 사용량",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "선택한 액세스 지점을 통해 이 에이전트에 도달한 일일 AI 대화 수.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "총 대화 수",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "일일 에이전트 상호 작용 수.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "총 메시지 수",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "이 에이전트에 대한 메시지 1,000 개당 좋아요 수.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "사용자 만족도",
+  "agentDetail.monitoring.pickSource": "앱 선택",
+  "agentDetail.monitoring.sourceLabel": "앱",
+  "agentDetail.monitoring.sourceTrigger": "소스 {{name}}",
+  "agentDetail.monitoring.sources.all": "전체",
+  "agentDetail.monitoring.timeRangeLabel": "시간 범위",
+  "agentDetail.monitoring.timeRanges.custom": "사용자 지정",
+  "agentDetail.monitoring.timeRanges.last30days": "지난 30 일",
+  "agentDetail.monitoring.timeRanges.last7days": "지난 7 일",
+  "agentDetail.monitoring.timeRanges.today": "오늘",
+  "agentDetail.monitoring.title": "모니터링",
+  "agentDetail.monitoring.tokenUsageConsumed": "소비된 토큰",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "에이전트 탐색",
+  "agentDetail.publish": "게시",
+  "agentDetail.publishSoon": "곧 제공",
+  "agentDetail.sections.access": "액세스 지점",
+  "agentDetail.sections.configure": "오케스트레이션",
+  "agentDetail.sections.logs": "로그",
+  "agentDetail.sections.monitoring": "모니터링",
+  "agentDetail.subtitle": "에이전트 ID: {{agentId}}",
+  "agentDetail.title": "에이전트",
+  "agentDetail.type": "에이전트",
+  "agentDetail.versionHistory.active": "활성",
+  "agentDetail.versionHistory.empty": "아직 버전이 없습니다",
+  "agentDetail.versionHistory.filter": "버전 필터",
+  "agentDetail.versionHistory.versionName": "버전 {{version}}",
+  "roster.createAgent": "에이전트 만들기",
+  "roster.createAgentOptions": "에이전트 만들기 옵션",
+  "roster.createDialog.description": "이 워크스페이스 Roster 에 재사용 가능한 에이전트를 만듭니다.",
+  "roster.createDialog.title": "에이전트 만들기",
+  "roster.createForm.changeIcon": "에이전트 아이콘 변경",
+  "roster.createForm.descriptionLabel": "설명",
+  "roster.createForm.descriptionOptional": "(선택 사항)",
+  "roster.createForm.descriptionPlaceholder": "예: 주제에 대한 소스를 수집하고 핵심 결과를 요약",
+  "roster.createForm.nameLabel": "이름",
+  "roster.createForm.namePlaceholder": "예: Max",
+  "roster.createForm.nameRequired": "이름을 입력하세요.",
+  "roster.createForm.roleLabel": "역할",
+  "roster.createForm.rolePlaceholder": "예: 리서치 어시스턴트",
+  "roster.createForm.roleRequired": "역할을 입력하세요.",
+  "roster.createSuccess": "에이전트가 생성되었습니다.",
+  "roster.dateTimeFormat": "YYYY-MM-DD HH:mm:ss",
+  "roster.deleteDialog.description": "이 에이전트가 활성 Roster 목록에서 제거됩니다.",
+  "roster.deleteDialog.title": "{{name}}을(를) 삭제하시겠습니까?",
+  "roster.deleteFailed": "에이전트 삭제에 실패했습니다.",
+  "roster.deleteSuccess": "에이전트가 삭제되었습니다.",
+  "roster.duplicateFailed": "에이전트 복제에 실패했습니다.",
+  "roster.duplicateSuccess": "에이전트가 복제되었습니다.",
+  "roster.editAgent": "{{name}} 편집",
+  "roster.editDialog.description": "이 에이전트의 Roster 이름, 설명 및 역할을 업데이트합니다.",
+  "roster.editDialog.title": "에이전트 편집",
+  "roster.editInfo": "정보 편집",
+  "roster.empty": "아직 에이전트가 없습니다",
+  "roster.emptyDescription": "이 워크스페이스에 저장된 에이전트가 여기에 표시됩니다.",
+  "roster.emptySearch": "일치하는 에이전트가 없습니다",
+  "roster.emptySearchDescription": "다른 에이전트 이름으로 시도해 보세요.",
+  "roster.filters.all": "전체",
+  "roster.filters.drafts": "초안",
+  "roster.filters.label": "에이전트 필터",
+  "roster.filters.published": "게시됨",
+  "roster.learnMore": "Agent Roster에 대해 자세히 알아보기",
+  "roster.listLabel": "에이전트 Roster 목록",
+  "roster.loadMore": "더 보기",
+  "roster.loadingError": "에이전트 로딩에 실패했습니다. 새로 고침 후 다시 시도하세요.",
+  "roster.moreActions": "{{name}}의 추가 작업",
+  "roster.nodeSelector.createInlineFailed": "인라인 에이전트 생성에 실패했습니다. 새로 고침 후 다시 시도하세요.",
+  "roster.nodeSelector.dialogLabel": "에이전트 선택",
+  "roster.nodeSelector.manageInAgentConsole": "Agent Console에서 관리",
+  "roster.nodeSelector.searchPlaceholder": "검색…",
+  "roster.nodeSelector.startFromScratch": "처음부터 시작",
+  "roster.references.label": "{{name}}을(를) 사용하는 워크플로",
+  "roster.references.trigger": "{{name}}을(를) 사용하는 워크플로",
+  "roster.searchLabel": "에이전트 검색",
+  "roster.searchPlaceholder": "이름으로 에이전트 검색…",
+  "roster.sources.agent_app": "에이전트 앱",
+  "roster.sources.imported": "가져옴",
+  "roster.sources.system": "시스템",
+  "roster.sources.workflow": "워크플로",
+  "roster.status.active": "활성",
+  "roster.status.archived": "보관됨",
+  "roster.tabs.agent": "에이전트",
+  "roster.tabs.human": "사람",
+  "roster.tabsLabel": "Roster 유형",
+  "roster.updateSuccess": "에이전트가 업데이트되었습니다.",
+  "roster.usageStatus.draft": "초안"
+}
diff --git a/web/i18n/ko-KR/app-log.json b/web/i18n/ko-KR/app-log.json
index 8bb71864bbd..5a39f79eb58 100644
--- a/web/i18n/ko-KR/app-log.json
+++ b/web/i18n/ko-KR/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "오늘",
   "filter.period.yearToDate": "연 초부터 오늘까지",
   "filter.sortBy": "정렬 기준:",
+  "monitoring.description": "모니터링은 성능, 사용자 활동, 비용을 포함한 애플리케이션 실행 상태를 기록합니다.",
   "promptLog": "프롬프트 로그",
   "runDetail.fileListDetail": "세부",
   "runDetail.fileListLabel": "파일 세부 정보",
diff --git a/web/i18n/ko-KR/app.json b/web/i18n/ko-KR/app.json
index 9e79d569480..a1995c21b46 100644
--- a/web/i18n/ko-KR/app.json
+++ b/web/i18n/ko-KR/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "구조화된 출력은 모델이 제공한 JSON 스키마를 항상 준수하는 응답을 생성하도록 보장하는 기능입니다.",
   "studio.allApps": "모든 앱",
   "studio.apps": "앱",
-  "studio.filters.allCreators": "모든 크리에이터",
-  "studio.filters.creators": "크리에이터",
+  "studio.filters.allCreators": "모든 작성자",
+  "studio.filters.creators": "작성자",
   "studio.filters.reset": "초기화",
   "studio.filters.searchCreators": "작성자 검색...",
   "studio.filters.types": "형?",
diff --git a/web/i18n/ko-KR/billing.json b/web/i18n/ko-KR/billing.json
index 28942ca55ef..6e9ff09b177 100644
--- a/web/i18n/ko-KR/billing.json
+++ b/web/i18n/ko-KR/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "업그레이드하여 대량 문서 업로드 기능 잠금 해제",
   "upgrade.uploadMultiplePages.description": "업로드 한도에 도달했습니다 — 현재 요금제에서는 한 번에 한 개의 문서만 선택하고 업로드할 수 있습니다.",
   "upgrade.uploadMultiplePages.title": "한 번에 여러 문서를 업로드하려면 업그레이드하세요",
+  "upgrade.workflowRestore.description": "현재 플랜에서는 워크플로 버전 복원을 사용할 수 없습니다.",
+  "upgrade.workflowRestore.title": "워크플로 버전을 복원하려면 업그레이드하세요",
   "upgradeBtn.encourage": "지금 업그레이드",
   "upgradeBtn.encourageShort": "업그레이드",
   "upgradeBtn.plain": "요금제 업그레이드",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index 78b689d009d..88a95f576d5 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "워크스페이스 전환",
   "mcpPage.description": "MCP 서버를 연결하고 관리하여 앱이 외부 도구와 서비스에 접근할 수 있도록 하세요.",
-  "members.admin": "관리자",
   "members.adminTip": "앱 빌드 및 팀 설정 관리 가능",
+  "members.alreadyInTeam": "이미 팀에 있습니다",
+  "members.alreadyInTeamTip": "이 사용자들은 이미 이 작업 공간에 액세스할 수 있습니다.",
   "members.builder": "빌더",
   "members.builderTip": "자신의 앱을 구축 및 편집할 수 있습니다.",
-  "members.datasetOperator": "지식 관리자",
   "members.datasetOperatorTip": "기술 자료만 관리할 수 있습니다.",
   "members.deleteMember": "멤버 삭제",
   "members.disInvite": "초대 취소",
-  "members.editor": "편집자",
   "members.editorTip": "앱 빌드만 가능하고 팀 설정 관리 불가능",
   "members.email": "이메일",
   "members.emailInvalid": "유효하지 않은 이메일 형식",
@@ -270,13 +269,12 @@
   "members.invite": "초대",
   "members.inviteTeamMember": "팀 멤버 초대",
   "members.inviteTeamMemberTip": "로그인 후에 바로 팀 데이터에 액세스할 수 있습니다.",
-  "members.invitedAsRole": "{{role}} 사용자로 초대되었습니다",
+  "members.invitedAsRole": "{{role}}로 초대되었습니다",
   "members.lastActive": "최근 활동",
   "members.name": "이름",
-  "members.normal": "일반",
+  "members.noNewInvitationsSent": "새 초대가 전송되지 않았습니다",
   "members.normalTip": "앱 사용만 가능하고 앱 빌드는 불가능",
   "members.ok": "확인",
-  "members.owner": "소유자",
   "members.pending": "대기 중...",
   "members.removeFromTeam": "팀에서 제거",
   "members.removeFromTeamTip": "팀 액세스가 제거됩니다",
@@ -311,12 +309,14 @@
   "menus.apps": "스튜디오",
   "menus.datasets": "지식",
   "menus.datasetsTips": "곧 출시될 예정: 고유한 텍스트 데이터를 가져오거나 웹훅을 통해 실시간으로 데이터를 기록하여 LLM 컨텍스트를 강화합니다.",
+  "menus.deployments": "배포",
   "menus.explore": "탐색",
   "menus.exploreMarketplace": "Marketplace 둘러보기",
   "menus.newApp": "새로운 앱",
   "menus.newDataset": "지식 만들기",
   "menus.plugins": "통합",
   "menus.pluginsTips": "타사 통합을 통합하거나 ChatGPT 호환 AI 통합을 작성합니다.",
+  "menus.roster": "에이전트 명단",
   "menus.status": "베타 버전",
   "menus.tools": "도구",
   "model.addMoreModel": "설정에서 다른 모델을 추가하세요",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "텍스트-to-음성 모델",
   "modelProvider.ttsModel.tip": "대화에서의 텍스트-to-음성 입력에 사용되는 기본 모델을 설정합니다.",
   "modelProvider.upgradeForLoadBalancing": "로드 밸런싱을 사용하도록 계획을 업그레이드합니다.",
+  "navigation.skipToMain": "본문으로 건너뛰기",
   "noData": "데이터 없음",
   "operation.add": "추가",
   "operation.added": "추가됨",
@@ -600,9 +601,6 @@
   "placeholder.input": "입력해주세요",
   "placeholder.search": "검색...",
   "placeholder.select": "선택해주세요",
-  "plugin.serpapi.apiKey": "API 키",
-  "plugin.serpapi.apiKeyPlaceholder": "API 키를 입력하세요",
-  "plugin.serpapi.keyFrom": "SerpAPI 계정 페이지에서 SerpAPI 키를 가져오세요",
   "promptEditor.context.item.desc": "컨텍스트 템플릿을 삽입합니다.",
   "promptEditor.context.item.title": "컨텍스트",
   "promptEditor.context.modal.add": "컨텍스트 추가",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
new file mode 100644
index 00000000000..aa001e8e5e5
--- /dev/null
+++ b/web/i18n/ko-KR/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "백엔드 서비스 API",
+  "access.api.copyCurlExample": "cURL 예제 복사",
+  "access.api.createFailed": "API 토큰 생성에 실패했습니다.",
+  "access.api.createKey": "API 토큰 생성",
+  "access.api.createKeyTitle": "새 API 토큰 생성",
+  "access.api.curlExampleTitle": "cURL 예제",
+  "access.api.description": "이 배포에 HTTP로 액세스합니다. 각 API 토큰은 하나의 환경으로 범위가 지정됩니다.",
+  "access.api.developerTitle": "개발자 API",
+  "access.api.disabled": "이 배포에서 API 액세스가 비활성화되어 있습니다.",
+  "access.api.disabledHint": "환경별 범위 토큰을 생성하려면 API 액세스를 활성화하세요.",
+  "access.api.dismissToken": "API 토큰 닫기",
+  "access.api.docs": "API 문서",
+  "access.api.docsClose": "API 문서 닫기",
+  "access.api.docsDescription": "이 배포에 대한 워크플로우 API 레퍼런스를 확인합니다.",
+  "access.api.docsTitle": "워크플로우 API 문서",
+  "access.api.empty": "API 토큰을 발급하려면 먼저 환경에 배포하세요.",
+  "access.api.emptyTitle": "배포된 환경 없음",
+  "access.api.endpoint": "요청 URL",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "API 토큰 목록",
+  "access.api.nameLabel": "API 토큰 이름",
+  "access.api.namePlaceholder": "API 토큰 이름을 입력하세요",
+  "access.api.nameRequired": "API 토큰 이름은 필수입니다.",
+  "access.api.newKey": "새 API 토큰 생성",
+  "access.api.newTokenDescription": "이 API 토큰은 한 번만 표시됩니다. 이 페이지를 떠나기 전에 복사하세요.",
+  "access.api.newTokenLabel": "API 토큰",
+  "access.api.newTokenTitle": "API 토큰이 생성되었습니다",
+  "access.api.noKeys": "아직 API 토큰이 없습니다. API 호출을 시작하려면 토큰을 생성하세요.",
+  "access.api.noKeysTitle": "아직 API 토큰이 없습니다",
+  "access.api.revokeConfirmDescription": "API 토큰 \"{{name}}\"이(가) 즉시 작동을 중지합니다. 이 작업은 취소할 수 없습니다.",
+  "access.api.revokeConfirmTitle": "API 토큰을 폐기하시겠습니까?",
+  "access.api.revokeFailed": "API 토큰 폐기에 실패했습니다.",
+  "access.api.revokeSuccess": "API 토큰이 폐기되었습니다",
+  "access.api.table.action": "작업",
+  "access.api.table.environment": "환경",
+  "access.api.table.key": "API 토큰",
+  "access.api.table.name": "이름",
+  "access.api.title": "API",
+  "access.channels.col.channel": "채널",
+  "access.channels.col.endpoint": "진입점",
+  "access.channels.col.status": "상태",
+  "access.channels.description": "WebApp 및 CLI 진입점은 위의 액세스 권한을 사용합니다.",
+  "access.channels.disabled": "이 배포에서 액세스 채널이 비활성화되어 있습니다.",
+  "access.channels.disabledHint": "WebApp 및 CLI 진입점을 노출하려면 액세스 채널을 활성화하세요.",
+  "access.channels.followPermission": "권한을 따름",
+  "access.channels.title": "액세스 채널",
+  "access.cli.description": "터미널에서 difyctl로 호출합니다. 스크립트, 자동화된 워크플로우 또는 에이전트 통합에 적합합니다.",
+  "access.cli.docs": "사용 가이드",
+  "access.cli.domain": "도메인",
+  "access.cli.empty": "CLI 엔드포인트가 구성되지 않았습니다.",
+  "access.cli.install": "CLI 설치",
+  "access.cli.title": "CLI",
+  "access.copied": "복사됨",
+  "access.copy": "복사",
+  "access.copyFailed": "복사 실패",
+  "access.copyToast": "클립보드에 복사되었습니다",
+  "access.hide": "숨기기",
+  "access.members.clearAll": "모두 지우기",
+  "access.members.empty": "일치하는 항목이 없습니다.",
+  "access.members.groupCount_one": "{{count}}개 그룹",
+  "access.members.groupCount_other": "{{count}}개 그룹",
+  "access.members.groups": "그룹",
+  "access.members.individuals": "구성원",
+  "access.members.memberCount_one": "{{count}}명 구성원",
+  "access.members.memberCount_other": "{{count}}명 구성원",
+  "access.members.pickPlaceholder": "그룹 또는 구성원을 선택하세요",
+  "access.members.searchPlaceholder": "그룹 및 구성원 검색",
+  "access.members.selectedLabel": "선택됨",
+  "access.permission.anyone": "링크가 있는 모든 사람",
+  "access.permission.anyoneDesc": "누구나 로그인 없이 이 배포에 액세스할 수 있습니다.",
+  "access.permission.memberCount_one": "{{count}}명 구성원",
+  "access.permission.memberCount_other": "{{count}}명 구성원",
+  "access.permission.organization": "플랫폼 내 모든 구성원",
+  "access.permission.organizationDesc": "플랫폼 내 모든 구성원",
+  "access.permission.specific": "플랫폼 내 특정 구성원",
+  "access.permission.specificDesc": "특정 그룹 또는 구성원을 선택하세요",
+  "access.permission.specificUnavailable": "실제 플랫폼 구성원 및 그룹이 연결될 때까지 특정 구성원 선택은 비활성화됩니다.",
+  "access.permission.updateFailed": "액세스 정책 업데이트에 실패했습니다.",
+  "access.permissions.col.environment": "환경",
+  "access.permissions.col.permission": "액세스",
+  "access.permissions.description": "각 환경에서 WebApp 및 CLI 진입점에 대한 액세스 권한을 설정합니다.",
+  "access.permissions.editAriaLabel": "{{environment}}에 대한 액세스 구성",
+  "access.permissions.editDescription": "WebApp 및 CLI 진입점에 대한 액세스 권한을 설정합니다.",
+  "access.permissions.editTitle": "액세스 권한",
+  "access.permissions.title": "액세스 권한",
+  "access.revoke": "폐기",
+  "access.runAccess.description": "사용자가 이 배포를 실행할 수 있는 방법과 환경별로 액세스가 허용되는 사용자를 관리합니다.",
+  "access.runAccess.disabled": "이 배포에서 실행 액세스가 비활성화되어 있습니다.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "이 배포를 Model Context Protocol 서버로 노출합니다.",
+  "access.runAccess.mcpEmpty": "MCP 엔드포인트가 구성되지 않았습니다.",
+  "access.runAccess.noEnvs": "액세스 권한을 구성하려면 환경에 배포하세요.",
+  "access.runAccess.noEnvsTitle": "배포된 환경 없음",
+  "access.runAccess.openWebapp": "WebApp 열기",
+  "access.runAccess.permissions": "액세스 권한",
+  "access.runAccess.permissionsDesc": "각 환경에서 이 배포에 액세스할 수 있는 사용자입니다.",
+  "access.runAccess.title": "실행 액세스",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "최종 사용자를 위한 호스팅된 웹 페이지입니다.",
+  "access.runAccess.webappEmpty": "곧 제공됩니다.",
+  "access.show": "표시",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "외부",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "알 수 없음",
+  "card.access.api": "API 토큰",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "액세스 없음",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "첫 번째 릴리스 만들기",
+  "card.deploy": "배포",
+  "card.deploying": "{{count}}개 배포 중",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}}개 실패",
+  "card.fromApp": "{{name}}에서",
+  "card.lastDeployed": "마지막 배포 {{time}}",
+  "card.menu.delete": "배포 삭제",
+  "card.menu.deleteDisabled": "백엔드 관리 배포에는 아직 배포 삭제를 사용할 수 없습니다.",
+  "card.menu.deploy": "환경에 배포",
+  "card.menu.editInfo": "정보 편집",
+  "card.menu.viewDetail": "배포 세부 정보 보기",
+  "card.moreActions": "더 많은 작업",
+  "card.neverDeployed": "아직 배포되지 않음",
+  "card.noDescription": "제공된 설명이 없습니다.",
+  "card.notDeployed": "배포되지 않음",
+  "card.ready": "{{count}}개 실행 중",
+  "card.tooltip.createdAt": "생성됨",
+  "card.tooltip.deployed": "배포됨",
+  "card.tooltip.deploymentStatus": "배포",
+  "card.tooltip.notDeployed": "이 배포는 아직 어떤 환경에도 배포되지 않았습니다.",
+  "card.tooltip.notDeployedShort": "배포되지 않음",
+  "card.tooltip.release": "릴리스",
+  "card.tooltip.releaseName": "릴리스 이름",
+  "card.tooltip.source": "소스",
+  "common.loadFailed": "로드에 실패했습니다. 나중에 다시 시도해 주세요.",
+  "common.loading": "로딩 중...",
+  "createGuide.actions.back": "뒤로",
+  "createGuide.actions.cancel": "취소",
+  "createGuide.actions.continue": "계속",
+  "createGuide.actions.createAndDeploy": "생성 및 배포",
+  "createGuide.actions.creating": "생성 중...",
+  "createGuide.actions.deploy": "배포",
+  "createGuide.actions.deploying": "생성 및 배포 중...",
+  "createGuide.actions.next": "다음",
+  "createGuide.actions.skipDeploy": "건너뛰기, 나중에 배포",
+  "createGuide.description": "릴리스 소스, 기본 정보 및 대상 환경에서 배포를 생성합니다.",
+  "createGuide.dsl.defaultAppName": "가져온 DSL 앱",
+  "createGuide.dsl.description": "워크플로우 DSL 패키지를 업로드하여 배포, 첫 번째 릴리스 및 선택적 환경 배포를 생성합니다.",
+  "createGuide.dsl.dropDescription": "워크플로우 YAML DSL 패키지를 업로드하세요. 배포 옵션은 배포 전에 이 파일에서 확인됩니다.",
+  "createGuide.dsl.dropTitle": "워크플로우 DSL 패키지 업로드",
+  "createGuide.dsl.readFailed": "DSL 파일을 읽지 못했습니다. 다른 파일을 선택하고 다시 시도하세요.",
+  "createGuide.dsl.reading": "DSL 파일 읽는 중...",
+  "createGuide.dsl.title": "DSL 가져오기",
+  "createGuide.dsl.unsupportedMode": "워크플로우 DSL 파일만 배포에 사용할 수 있습니다.",
+  "createGuide.errors.createReleaseFailed": "배포 또는 릴리스 생성에 실패했습니다.",
+  "createGuide.errors.deployFailed": "환경에 배포하지 못했습니다.",
+  "createGuide.method.description": "첫 번째 릴리스를 생성하는 데 사용할 소스를 선택하세요.",
+  "createGuide.methods.bindApp.description": "스튜디오의 기존 워크플로우 앱을 릴리스 소스로 사용합니다.",
+  "createGuide.methods.bindApp.title": "기존 워크플로우 앱 바인딩",
+  "createGuide.methods.importDsl.description": "워크플로우 YAML DSL 패키지를 업로드하고 배포 UI를 통해 계속합니다.",
+  "createGuide.methods.importDsl.title": "DSL 가져오기",
+  "createGuide.methods.mocked": "모의",
+  "createGuide.nav.back": "배포",
+  "createGuide.release.defaultName": "최초 릴리스",
+  "createGuide.release.deployInfo": "배포 정보",
+  "createGuide.release.description": "배포 정보와 첫 번째 릴리스 세부 정보를 입력합니다.",
+  "createGuide.release.firstVersion": "첫 번째 릴리스",
+  "createGuide.release.instanceDescription": "배포 설명",
+  "createGuide.release.instanceDescriptionPlaceholder": "이 배포의 사용 목적을 설명하세요",
+  "createGuide.release.instanceName": "배포 이름",
+  "createGuide.release.instanceNameConflict": "이 이름의 배포가 이미 존재합니다. 다른 이름을 선택하세요.",
+  "createGuide.release.releaseDescription": "릴리스 설명",
+  "createGuide.release.releaseDescriptionPlaceholder": "이 릴리스를 설명하세요",
+  "createGuide.release.releaseName": "릴리스 이름",
+  "createGuide.release.releaseNote": "릴리스 설명",
+  "createGuide.release.title": "기본 정보",
+  "createGuide.source.availableApps_one": "{{count}}개 앱",
+  "createGuide.source.availableApps_other": "{{count}}개 앱",
+  "createGuide.source.clearSearch": "앱 검색 지우기",
+  "createGuide.source.description": "첫 번째 릴리스를 생성하는 데 사용할 소스를 선택하세요.",
+  "createGuide.source.empty": "워크플로우 앱이 없습니다.",
+  "createGuide.source.searchPlaceholder": "앱 검색",
+  "createGuide.source.sourceApp": "워크플로우 앱",
+  "createGuide.source.title": "릴리스 소스",
+  "createGuide.steps.method": "릴리스 소스",
+  "createGuide.steps.release": "기본 정보",
+  "createGuide.steps.source": "릴리스 소스",
+  "createGuide.steps.target": "환경에 배포",
+  "createGuide.target.bindingCount_one": "{{count}}개 바인딩",
+  "createGuide.target.bindingCount_other": "{{count}}개 바인딩",
+  "createGuide.target.bindingHint": "이 릴리스에서 사용할 자격 증명을 선택하세요.",
+  "createGuide.target.bindings": "자격 증명",
+  "createGuide.target.deferredBindingHint": "자격 증명은 최종 배포 작업 중 실제 배포 계획에서 확인됩니다.",
+  "createGuide.target.deferredEnvironmentHint": "이름은 배포 및 릴리스가 생성된 후 실제 환경과 매칭됩니다.",
+  "createGuide.target.description": "대상 환경을 선택하고 이 릴리스가 필요로 하는 런타임 설정을 제공하세요. 이 단계는 건너뛸 수 있습니다.",
+  "createGuide.target.envVarCount_one": "{{count}}개 변수",
+  "createGuide.target.envVarCount_other": "{{count}}개 변수",
+  "createGuide.target.envVarHint": "이 릴리스가 필요로 하는 각 환경 변수에 대해 사용자 지정 값을 입력하거나 앱에 정의된 값을 사용하세요.",
+  "createGuide.target.envVarPlaceholder": "값을 입력하세요",
+  "createGuide.target.envVarSource.ariaLabel": "{{key}}의 변수 값 소스 선택",
+  "createGuide.target.envVarSource.default": "앱 값",
+  "createGuide.target.envVarSource.lastDeployment": "마지막 배포 값",
+  "createGuide.target.envVarSource.literal": "사용자 지정 값",
+  "createGuide.target.envVarType.number": "숫자",
+  "createGuide.target.envVarType.secret": "시크릿",
+  "createGuide.target.envVarType.string": "문자열",
+  "createGuide.target.envVars": "환경 변수",
+  "createGuide.target.environment": "대상 환경",
+  "createGuide.target.environmentName": "환경 이름",
+  "createGuide.target.environmentNamePlaceholder": "프로덕션",
+  "createGuide.target.loadBindingsFailed": "자격 증명을 로드하지 못했습니다.",
+  "createGuide.target.loadEnvironmentsFailed": "배포 환경을 로드하지 못했습니다.",
+  "createGuide.target.missingRequiredBinding": "이 필수 바인딩에 대한 자격 증명을 선택하세요.",
+  "createGuide.target.noBindingRequired": "자격 증명이 필요하지 않습니다.",
+  "createGuide.target.noCredentialCandidates": "사용 가능한 자격 증명이 없습니다.",
+  "createGuide.target.noEnvironmentOptions": "사용 가능한 배포 환경이 없습니다.",
+  "createGuide.target.required": "필수",
+  "createGuide.target.selectCredential": "자격 증명을 선택하세요",
+  "createGuide.target.title": "환경에 배포",
+  "createGuide.title": "새 배포",
+  "createModal.appPickerPlaceholder": "워크플로우 앱을 선택하세요",
+  "createModal.appSearchEmpty": "일치하는 워크플로우 앱이 없습니다",
+  "createModal.appSearchPlaceholder": "워크플로우 앱 검색…",
+  "createModal.cancel": "취소",
+  "createModal.create": "생성",
+  "createModal.createFailed": "배포 생성에 실패했습니다.",
+  "createModal.description": "워크플로우 앱을 선택하고 배포를 생성합니다.",
+  "createModal.descriptionLabel": "설명",
+  "createModal.descriptionPlaceholder": "이 배포의 사용 목적을 설명하세요",
+  "createModal.loadMoreApps": "더 많은 앱 로드",
+  "createModal.loadingApps": "앱 로드 중…",
+  "createModal.nameLabel": "배포 이름",
+  "createModal.namePlaceholder": "배포 이름",
+  "createModal.noApps": "이 워크스페이스에서 워크플로우 앱을 찾을 수 없습니다. 먼저 스튜디오에서 만드세요.",
+  "createModal.selected": "선택됨",
+  "createModal.sourceApp": "워크플로우 앱 (필수)",
+  "createModal.title": "새 배포",
+  "deployDrawer.bindingCount_one": "{{count}}개 바인딩",
+  "deployDrawer.bindingCount_other": "{{count}}개 바인딩",
+  "deployDrawer.bindingOptionsFailed": "자격 증명 옵션을 로드하지 못했습니다.",
+  "deployDrawer.bindingSelectionHint": "이 배포에서 사용할 자격 증명을 선택하세요.",
+  "deployDrawer.bindingsDisabled": "릴리스 미리보기에서 확인됩니다. 편집은 아직 사용할 수 없습니다.",
+  "deployDrawer.cancel": "취소",
+  "deployDrawer.close": "배포 드로어 닫기",
+  "deployDrawer.defaultSelect": "선택...",
+  "deployDrawer.deploy": "환경에 배포",
+  "deployDrawer.deployExistingRelease": "환경에 배포",
+  "deployDrawer.deployExistingReleaseDescription": "배포할 릴리스와 대상 환경을 선택하세요.",
+  "deployDrawer.deployExistingReleaseTitle": "환경에 배포",
+  "deployDrawer.deployFailed": "배포 시작에 실패했습니다.",
+  "deployDrawer.deploying": "배포 중...",
+  "deployDrawer.description": "배포할 릴리스와 대상 환경을 선택하세요.",
+  "deployDrawer.envVarCount_one": "{{count}}개 변수",
+  "deployDrawer.envVarCount_other": "{{count}}개 변수",
+  "deployDrawer.envVarHint": "이 릴리스가 필요로 하는 각 환경 변수에 대해 사용자 지정 값을 입력하거나 앱에 정의된 값을 사용하세요.",
+  "deployDrawer.envVarPlaceholder": "값을 입력하세요",
+  "deployDrawer.envVarSource.ariaLabel": "{{key}}의 변수 값 소스 선택",
+  "deployDrawer.envVarSource.default": "앱 값",
+  "deployDrawer.envVarSource.lastDeployment": "마지막 배포 값",
+  "deployDrawer.envVarSource.literal": "사용자 지정 값",
+  "deployDrawer.envVarType.number": "숫자",
+  "deployDrawer.envVarType.secret": "시크릿",
+  "deployDrawer.envVarType.string": "문자열",
+  "deployDrawer.envVars": "환경 변수",
+  "deployDrawer.existingReleaseHint": "이 릴리스는 그대로 배포됩니다. 새 릴리스는 생성되지 않습니다.",
+  "deployDrawer.loadingBindings": "확인 중...",
+  "deployDrawer.lockedHint": "현재 환경에 잠김",
+  "deployDrawer.missingRequiredBinding": "이 필수 바인딩에 대한 자격 증명을 선택하세요.",
+  "deployDrawer.missingRequiredEnvVar": "이 필수 환경 변수의 값을 입력하세요.",
+  "deployDrawer.modelCreds": "모델 자격 증명",
+  "deployDrawer.needsValidation": " (검증 필요)",
+  "deployDrawer.newReleaseHint": "선택한 워크플로우 앱 YAML에서 새 릴리스가 생성됩니다.",
+  "deployDrawer.noBindingRequired": "필수 아님",
+  "deployDrawer.noCredentialCandidates": "사용 가능한 자격 증명이 없습니다.",
+  "deployDrawer.noNewEnvironmentAvailable": "사용 가능한 모든 환경에 이미 배포가 있습니다.",
+  "deployDrawer.noOtherReleaseAvailable": "이 환경에 사용할 수 있는 다른 릴리스가 없습니다.",
+  "deployDrawer.noReleaseAvailable": "환경에 배포하기 전에 릴리스를 생성하세요.",
+  "deployDrawer.notFound": "배포를 찾을 수 없습니다.",
+  "deployDrawer.noteLabel": "릴리스 설명 (선택 사항)",
+  "deployDrawer.notePlaceholder": "예: 온보딩 텍스트 수정 배포",
+  "deployDrawer.pluginCreds": "플러그인 자격 증명",
+  "deployDrawer.promote": "배포",
+  "deployDrawer.promoteDescription": "배포할 릴리스와 대상 환경을 선택하세요.",
+  "deployDrawer.promoteTitle": "환경에 배포",
+  "deployDrawer.readOnly": "읽기 전용",
+  "deployDrawer.redeploy": "환경에 배포",
+  "deployDrawer.redeployDescription": "배포할 릴리스와 대상 환경을 선택하세요.",
+  "deployDrawer.redeployExistingReleaseHint": "현재 릴리스가 그대로 재배포됩니다. 새 릴리스는 생성되지 않습니다.",
+  "deployDrawer.redeployTitle": "환경에 배포",
+  "deployDrawer.releaseLabel": "릴리스",
+  "deployDrawer.requiredBinding": "필수",
+  "deployDrawer.rollback": "배포",
+  "deployDrawer.rollbackDescription": "배포할 릴리스와 대상 환경을 선택하세요.",
+  "deployDrawer.rollbackTitle": "환경에 배포",
+  "deployDrawer.runtimeCredentials": "자격 증명",
+  "deployDrawer.secretPlaceholder": "시크릿",
+  "deployDrawer.selectCredential": "자격 증명을 선택하세요",
+  "deployDrawer.selectEnv": "환경을 선택하세요",
+  "deployDrawer.selectProviderCred": "{{provider}} 자격 증명 선택",
+  "deployDrawer.selectProviderKey": "{{provider}} 키 선택",
+  "deployDrawer.selectRelease": "릴리스를 선택하세요",
+  "deployDrawer.targetEnv": "대상 환경",
+  "deployDrawer.title": "환경에 배포",
+  "deployDrawer.valuePlaceholder": "값",
+  "deployTab.cancelDeployment": "배포 취소",
+  "deployTab.closeError": "닫기",
+  "deployTab.col.actions": "작업",
+  "deployTab.col.currentRelease": "현재 릴리스",
+  "deployTab.col.environment": "환경",
+  "deployTab.col.status": "상태",
+  "deployTab.col.updated": "업데이트됨",
+  "deployTab.collapseDetails": "배포 세부 정보 접기",
+  "deployTab.confirmUndeploy": "배포 취소",
+  "deployTab.deployOtherVersion": "다른 릴리스 배포",
+  "deployTab.deployToEnv": "{{name}}에 배포",
+  "deployTab.deployToNewEnv": "새 환경에 배포...",
+  "deployTab.empty": "아직 인스턴스가 없습니다. 시작하려면 새 환경에 배포하세요.",
+  "deployTab.emptyDescription": "이 배포를 사용자가 사용할 수 있도록 하려면 릴리스와 대상 환경을 선택하세요.",
+  "deployTab.emptyTitle": "아직 실행 중인 환경이 없습니다",
+  "deployTab.envCount": "환경",
+  "deployTab.errorCode": "코드",
+  "deployTab.errorDialogDesc": "재시도하거나 다른 릴리스를 배포하기 전에 마지막으로 실패한 배포를 검토하세요.",
+  "deployTab.errorDialogTitle": "{{name}}의 배포 오류",
+  "deployTab.errorMessage": "메시지",
+  "deployTab.errorPhase": "단계",
+  "deployTab.expandDetails": "배포 세부 정보 펼치기",
+  "deployTab.moreActions": "더 많은 작업",
+  "deployTab.newDeployment": "새 환경에 배포",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "배포 ID",
+  "deployTab.panel.endpoints": "엔드포인트",
+  "deployTab.panel.envVars": "환경 변수",
+  "deployTab.panel.error": "오류",
+  "deployTab.panel.failedRelease": "실패한 릴리스",
+  "deployTab.panel.health": "상태",
+  "deployTab.panel.instanceInfo": "인스턴스 정보",
+  "deployTab.panel.modelCreds": "모델 자격 증명",
+  "deployTab.panel.pluginCreds": "플러그인 자격 증명",
+  "deployTab.panel.release": "릴리스",
+  "deployTab.panel.releaseCreatedAt": "릴리스 생성 시각",
+  "deployTab.panel.releaseInfo": "릴리스 정보",
+  "deployTab.panel.replicas": "복제본",
+  "deployTab.panel.run": "실행",
+  "deployTab.panel.runtimeBindings": "자격 증명",
+  "deployTab.panel.runtimeInfo": "런타임 정보",
+  "deployTab.panel.runtimeMode": "런타임 모드",
+  "deployTab.panel.runtimeNote": "런타임 비고",
+  "deployTab.panel.targetRelease": "대상 릴리스",
+  "deployTab.panel.unknownError": "배포에 실패했습니다.",
+  "deployTab.promote": "배포",
+  "deployTab.redeploy": "재배포",
+  "deployTab.releaseCreatedAt": "릴리스 생성 {{time}}",
+  "deployTab.retry": "다시 시도",
+  "deployTab.shortcut": "단축키",
+  "deployTab.status.deployFailed": "배포 실패",
+  "deployTab.status.deployingRelease": "배포 중 ({{release}})",
+  "deployTab.status.runningOutOfSync": "실행 중 (동기화 대기 중)",
+  "deployTab.status.runningWithFailed": "실행 중 (마지막 배포 실패)",
+  "deployTab.undeploy": "배포 취소",
+  "deployTab.undeployConfirmDesc": "최종 사용자 액세스가 즉시 중지됩니다. 릴리스는 나중에 재배포할 수 있습니다.",
+  "deployTab.undeployConfirmTitle": "{{name}}에서 배포를 취소하시겠습니까?",
+  "deployTab.undeployFrom": "{{name}}에서 배포 취소",
+  "deployTab.undeployImpactTitle": "영향을 받는 인스턴스",
+  "deployTab.viewError": "오류 보기",
+  "deployTab.viewLogs": "로그 보기",
+  "deployTab.viewProgress": "진행 상황 보기",
+  "detail.backToInstances": "배포로 돌아가기",
+  "detail.deployingCount": "{{count}}개 배포 중",
+  "detail.envCount_one": "{{count}}개 환경",
+  "detail.envCount_other": "{{count}}개 환경",
+  "detail.failedCount": "{{count}}개 실패",
+  "detail.mobileTabs": "배포 섹션",
+  "detail.notFound": "배포를 찾을 수 없음",
+  "detail.openSourceApp": "{{name}} 소스 열기",
+  "detail.sourceApp": "소스",
+  "detail.sourceAppLink": "소스",
+  "documentTitle.create": "새 배포 · 배포",
+  "documentTitle.detail": "배포 · 배포",
+  "documentTitle.list": "배포",
+  "filter.allEnvs": "모든 환경",
+  "filter.notDeployed": "배포되지 않음",
+  "filter.searchPlaceholder": "배포 검색",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "승인",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "부트스트래핑",
+  "health.ENVIRONMENT_STATUS_DELETING": "삭제 중",
+  "health.ENVIRONMENT_STATUS_FAILED": "사용 불가",
+  "health.ENVIRONMENT_STATUS_READY": "사용 가능",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "알 수 없음",
+  "list.clearFilters": "필터 지우기",
+  "list.clearSearch": "배포 검색 지우기",
+  "list.createDeployment": "새로 만들기",
+  "list.empty": "배포를 찾을 수 없습니다.",
+  "list.emptyDescription": "워크플로우 앱 또는 워크플로우 DSL 패키지에서 배포를 생성하여 릴리스, 환경 및 액세스를 관리하세요.",
+  "list.emptyFilteredDescription": "현재 검색 또는 환경 필터와 일치하는 배포가 없습니다.",
+  "list.emptyFilteredTitle": "일치하는 배포 없음",
+  "list.emptyTitle": "아직 배포가 없습니다",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "격리됨",
+  "mode.ENVIRONMENT_MODE_SHARED": "공유됨",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "알 수 없음",
+  "newInstance.comingSoon": "곧 제공됩니다",
+  "newInstance.fromStudio": "스튜디오에서 선택",
+  "newInstance.importDSL": "DSL 가져오기",
+  "newInstance.title": "새 배포",
+  "overview.accessEndpoints": "액세스 엔드포인트",
+  "overview.accessMeta.apiTokens": "API 토큰 관리",
+  "overview.accessMeta.cli": "CLI 액세스 보기",
+  "overview.accessMeta.webApp": "WebApp 액세스 관리",
+  "overview.accessStatus": "액세스",
+  "overview.api": "API 토큰",
+  "overview.apiKeysCount_one": "{{count}}개 API 토큰",
+  "overview.apiKeysCount_other": "{{count}}개 API 토큰",
+  "overview.apiTokenSummary.environments_one": "{{count}}개 배포된 환경",
+  "overview.apiTokenSummary.environments_other": "{{count}}개 배포된 환경",
+  "overview.availableForDeployment": "배포 가능",
+  "overview.basicInfo": "기본 정보",
+  "overview.cardAction.deployLatest": "최신 릴리스 배포",
+  "overview.cardAction.redeploy": "재배포",
+  "overview.cardAction.viewProgress": "배포 보기",
+  "overview.chip.behindTooltip_one": "최신 릴리스보다 1개 뒤처져 있습니다. 업데이트하려면 최신 릴리스를 배포하세요.",
+  "overview.chip.behindTooltip_other": "최신 릴리스보다 {{count}}개 뒤처져 있습니다. 업데이트하려면 최신 릴리스를 배포하세요.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "배포 중",
+  "overview.chip.deployingTooltip": "배포가 진행 중입니다.",
+  "overview.chip.empty": "비어 있음",
+  "overview.chip.emptyTooltip": "이 환경에 배포된 릴리스가 없습니다.",
+  "overview.chip.failed": "실패",
+  "overview.chip.failedTooltip": "최근 배포 시도가 실패했습니다.",
+  "overview.chip.latest": "최신",
+  "overview.chip.latestTooltip": "이 환경은 최신 릴리스를 실행하고 있습니다.",
+  "overview.chip.needsReleaseFirst": "먼저 릴리스를 생성하세요",
+  "overview.chip.olderRelease": "이전",
+  "overview.chip.olderReleaseTooltip": "이 환경은 이전 릴리스를 실행하고 있습니다.",
+  "overview.chip.openInDeployTab": "배포 진행 상황 보기",
+  "overview.cli": "CLI",
+  "overview.configured": "구성됨",
+  "overview.createRelease": "릴리스 생성",
+  "overview.created": "생성됨",
+  "overview.deploy": "배포",
+  "overview.deployedEnvironments": "배포됨",
+  "overview.deploymentOverview": "배포 개요",
+  "overview.deploymentStatus": "배포 상태",
+  "overview.description": "설명",
+  "overview.developerApi": "개발자 API",
+  "overview.disabled": "비활성화됨",
+  "overview.emptyValue": "설정되지 않음",
+  "overview.enabled": "활성화됨",
+  "overview.enabledChannels": "액세스 활성화됨",
+  "overview.endUserAccess": "최종 사용자 액세스",
+  "overview.environments": "환경",
+  "overview.hero.byName": "{{name}} 작성",
+  "overview.hero.empty": "아직 릴리스가 없습니다",
+  "overview.hero.emptyDescription": "배포하기 전에 현재 소스에서 릴리스를 생성하세요.",
+  "overview.hero.propagation_one": "{{count}}/{{total}}개 환경에 배포됨",
+  "overview.hero.propagation_other": "{{count}}/{{total}}개 환경에 배포됨",
+  "overview.hero.untargeted": "아직 구성된 환경이 없습니다",
+  "overview.instanceDetails": "배포 세부 정보",
+  "overview.instanceId": "배포 ID",
+  "overview.latestRelease.releaseCount_one": "{{count}}개 릴리스",
+  "overview.latestRelease.releaseCount_other": "{{count}}개 릴리스",
+  "overview.latestReleaseTitle": "최신 릴리스",
+  "overview.manageDeployments": "배포 관리",
+  "overview.name": "이름",
+  "overview.noAccessConfig": "액세스 구성이 없습니다.",
+  "overview.noReleaseYet": "환경에 배포하기 전에 릴리스를 생성하세요.",
+  "overview.notConfigured": "구성되지 않음",
+  "overview.previousReleases.empty": "이전 릴리스가 아직 없습니다.",
+  "overview.previousReleases.retired": "현재 배포되지 않음",
+  "overview.previousReleases.title": "이전 릴리스",
+  "overview.previousReleases.viewAll": "모두 보기",
+  "overview.ready": "배포 가능",
+  "overview.recentReleases": "최근 릴리스",
+  "overview.releaseDeployedTitle": "{{release}}이(가) 배포되었습니다",
+  "overview.releaseReadyTitle": "{{release}}이(가) 배포 준비되었습니다",
+  "overview.serviceMap": "서비스 맵",
+  "overview.servingRelease": "{{release}} 제공 중",
+  "overview.servingReleaseDescription": "이 배포는 {{count}}/{{total}}개 환경에 배포되어 있습니다.",
+  "overview.strip.deployToNewEnvironment": "새 환경에 배포",
+  "overview.strip.empty": "구성된 환경이 없습니다.",
+  "overview.strip.emptyDeployableDescription": "준비되면 최신 릴리스를 환경에 배포하세요.",
+  "overview.strip.emptyDeployed": "아직 인스턴스가 없습니다.",
+  "overview.strip.emptyDescription": "환경에 배포하기 전에 릴리스를 생성하세요.",
+  "overview.strip.emptyTitle": "아직 인스턴스가 없습니다",
+  "overview.strip.summary_one": "{{total}}개 중 1개가 최신 릴리스에 있습니다",
+  "overview.strip.summary_other": "{{total}}개 중 {{count}}개가 최신 릴리스에 있습니다",
+  "overview.strip.title": "인스턴스",
+  "overview.switchSourceApp": "소스 전환",
+  "overview.switchSourceAppDescription": "향후 릴리스의 소스로 사용할 워크플로우 앱을 선택하세요.",
+  "overview.switchSourceAppHint": "전환 후에는 새로 생성된 릴리스만 새 소스를 사용합니다. 기존 릴리스 및 기존 배포는 변경되지 않습니다.",
+  "overview.targetRelease": "대상 릴리스",
+  "overview.webapp": "WebApp",
+  "settings.danger": "위험 영역",
+  "settings.dangerDesc": "이 배포를 영구적으로 삭제하고 실행 중인 모든 인스턴스를 중지합니다. 이 작업은 취소할 수 없습니다.",
+  "settings.delete": "배포 삭제",
+  "settings.deleteConfirmDesc": "{{name}}을(를) 삭제하시겠습니까? 모든 인스턴스가 실행을 중지하고 모든 환경에서 제거됩니다. 이 작업은 취소할 수 없습니다.",
+  "settings.deleteConfirmTitle": "배포 삭제",
+  "settings.deleteFailed": "배포 삭제에 실패했습니다.",
+  "settings.deleteImpact": "영향",
+  "settings.deleteImpactInstance": "배포",
+  "settings.deleteImpactTitle": "영향을 받는 배포",
+  "settings.deleteImpactValue": "배포가 배포 목록에서 제거됩니다.",
+  "settings.deleted": "배포가 삭제되었습니다",
+  "settings.description": "설명",
+  "settings.descriptionHelp": "이 배포의 이름, 설명 및 기타 설정을 관리합니다.",
+  "settings.general": "일반",
+  "settings.name": "배포 이름",
+  "settings.reset": "재설정",
+  "settings.save": "변경 사항 저장",
+  "settings.updateFailed": "배포 업데이트에 실패했습니다.",
+  "settings.updated": "배포가 업데이트되었습니다",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "배포 중",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "동기화 대기 중",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "배포 실패",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "유효하지 않음",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "실행 중",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "배포되지 않음",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "배포 취소 중",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "알 수 없음",
+  "subtitle": "환경 전반에 걸쳐 배포를 관리합니다.",
+  "tabs.access.description": "액세스 채널 및 액세스 권한을 관리합니다.",
+  "tabs.access.name": "액세스",
+  "tabs.api-tokens.description": "API 토큰을 관리하고 HTTP를 통해 인스턴스를 호출합니다.",
+  "tabs.api-tokens.name": "API 토큰",
+  "tabs.instances.description": "배포된 환경에서 인스턴스를 보고 관리합니다.",
+  "tabs.instances.name": "인스턴스",
+  "tabs.overview.description": "환경 전반에 걸친 배포 상태를 확인합니다.",
+  "tabs.overview.name": "개요",
+  "tabs.releases.description": "릴리스를 생성, 배포 및 관리합니다.",
+  "tabs.releases.name": "릴리스",
+  "tabs.settings.description": "이 배포의 이름, 설명 및 기타 설정을 관리합니다.",
+  "tabs.settings.name": "설정",
+  "title": "배포",
+  "unsupportedDslNodes.description": "이 릴리스에는 배포 런타임이 아직 지원하지 않는 노드가 포함되어 있습니다. 스튜디오에서 제거하거나 교체한 후 다시 시도하세요.",
+  "unsupportedDslNodes.descriptionWithTypes": "이 릴리스에는 배포 런타임이 아직 지원하지 않는 노드가 포함되어 있습니다: {{nodeTypes}}. 스튜디오에서 제거하거나 교체한 후 다시 시도하세요.",
+  "unsupportedDslNodes.title": "지원되지 않는 노드",
+  "unsupportedDslNodes.unknownType": "알 수 없는 유형",
+  "versions.cancelCreate": "취소",
+  "versions.cancelDelete": "취소",
+  "versions.cancelEdit": "취소",
+  "versions.checkingReleaseContent": "릴리스 콘텐츠 확인 중...",
+  "versions.col.action": "작업",
+  "versions.col.author": "작성자",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "생성 시각",
+  "versions.col.deployedTo": "배포 대상",
+  "versions.col.release": "릴리스",
+  "versions.col.sourceApp": "소스",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "생성",
+  "versions.createFailed": "릴리스 생성에 실패했습니다.",
+  "versions.createRelease": "릴리스 생성",
+  "versions.createReleaseDescription": "워크플로우 앱 또는 워크플로우 DSL 파일에서 배포 가능한 릴리스를 생성합니다.",
+  "versions.createReleaseHint": "새 릴리스는 모든 환경에 배포할 수 있습니다.",
+  "versions.createSuccess": "릴리스 \"{{name}}\"이(가) 생성되었습니다.",
+  "versions.creating": "생성 중...",
+  "versions.currentOn": "{{name}}의 현재 릴리스",
+  "versions.deleteConfirmDesc": "릴리스 \"{{name}}\"이(가) 영구적으로 삭제됩니다. 이 작업은 취소할 수 없습니다.",
+  "versions.deleteConfirmTitle": "릴리스를 삭제하시겠습니까?",
+  "versions.deleteFailed": "릴리스 삭제에 실패했습니다.",
+  "versions.deleteImpactDeployment": "배포 상태",
+  "versions.deleteImpactNotDeployed": "현재 배포되지 않음",
+  "versions.deleteImpactRelease": "릴리스",
+  "versions.deleteImpactTitle": "삭제 영향",
+  "versions.deleteRelease": "릴리스 삭제",
+  "versions.deleteSuccess": "릴리스 \"{{name}}\"이(가) 삭제되었습니다.",
+  "versions.deploy": "배포",
+  "versions.deployTo": "{{name}}에 배포",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "배포 중",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "동기화 대기 중",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "실패",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "유효하지 않음",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "실행 중",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "배포되지 않음",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "배포 취소 중",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "알 수 없음",
+  "versions.deployingTo": "{{name}}에 배포 중",
+  "versions.disabledReason.checkDeploymentsFailed": "배포 사용을 확인할 수 없습니다. 나중에 다시 시도하세요.",
+  "versions.disabledReason.checkingDeployments": "배포 사용 확인 중",
+  "versions.disabledReason.current": "이 릴리스는 이미 {{name}}에서 실행 중입니다",
+  "versions.disabledReason.deploying": "활성 배포가 완료될 때까지 기다리세요",
+  "versions.disabledReason.envDisabled": "이 환경은 배포할 수 없습니다",
+  "versions.disabledReason.releaseInUse_one": "삭제하기 전에 이 릴리스를 {{count}}개 환경에서 배포 취소하세요",
+  "versions.disabledReason.releaseInUse_other": "삭제하기 전에 이 릴리스를 {{count}}개 환경에서 배포 취소하세요",
+  "versions.dslReadFailed": "DSL 파일을 읽지 못했습니다. 다른 파일을 선택하고 다시 시도하세요.",
+  "versions.dslReading": "DSL 파일 읽는 중...",
+  "versions.dslUnsupportedMode": "워크플로우 DSL 파일만 배포에 사용할 수 있습니다.",
+  "versions.editFailed": "릴리스 업데이트에 실패했습니다.",
+  "versions.editRelease": "릴리스 편집",
+  "versions.editReleaseDescription": "이 릴리스의 이름과 설명을 업데이트합니다.",
+  "versions.editSuccess": "릴리스 \"{{name}}\"이(가) 업데이트되었습니다.",
+  "versions.empty": "아직 사용 가능한 릴리스가 없습니다.",
+  "versions.emptyDescription": "환경에 배포하기 전에 첫 번째 릴리스를 생성하세요.",
+  "versions.emptyTitle": "아직 릴리스가 없습니다",
+  "versions.emptyWithCreate": "아직 릴리스가 없습니다. 배포하기 전에 첫 번째 배포 가능한 릴리스를 생성하세요.",
+  "versions.exportDsl": "DSL 내보내기",
+  "versions.exportDslFailed": "DSL 내보내기에 실패했습니다.",
+  "versions.exportingDsl": "내보내는 중...",
+  "versions.groupHeader.deploy": "배포",
+  "versions.groupHeader.promote": "배포",
+  "versions.groupHeader.rollback": "이전 버전 배포",
+  "versions.groupHeader.unavailable": "사용 불가",
+  "versions.manualDslOption": "DSL 업로드",
+  "versions.moreActions": "더 많은 작업",
+  "versions.optional": "선택 사항",
+  "versions.promote": "배포",
+  "versions.promoteTo": "{{name}}에 배포",
+  "versions.releaseAlreadyExists": "같은 콘텐츠의 릴리스가 이미 존재합니다: {{name}}.",
+  "versions.releaseContentCheckFailed": "릴리스 콘텐츠 확인에 실패했습니다.",
+  "versions.releaseDescriptionLabel": "설명",
+  "versions.releaseDescriptionPlaceholder": "이 릴리스를 설명하세요",
+  "versions.releaseHistory": "릴리스 기록",
+  "versions.releaseNameLabel": "릴리스 이름",
+  "versions.releaseNamePlaceholder": "릴리스 이름",
+  "versions.releaseNameRequired": "릴리스 이름을 입력하세요.",
+  "versions.releaseSourceLabel": "릴리스 소스",
+  "versions.rollbackTo": "{{name}}에 배포",
+  "versions.saveEdit": "저장",
+  "versions.sourceAppOption": "워크플로우 앱"
+}
diff --git a/web/i18n/ko-KR/workflow.json b/web/i18n/ko-KR/workflow.json
index 1b139234d39..06125ae5836 100644
--- a/web/i18n/ko-KR/workflow.json
+++ b/web/i18n/ko-KR/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "에이전트",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "답변",
   "blocks.assigner": "변수 할당자",
   "blocks.code": "코드",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "변수 집계자",
   "blocks.variable-assigner": "변수 할당자",
   "blocksAbout.agent": "질문에 답하거나 자연어를 처리하기 위해 대규모 언어 모델을 호출하는 경우",
+  "blocksAbout.agent-v2": "질문에 답하거나 자연어를 처리하기 위해 대규모 언어 모델을 호출하는 경우",
   "blocksAbout.answer": "대화의 답변 내용을 정의합니다",
   "blocksAbout.assigner": "변수 할당 노드는 쓰기 가능한 변수 (대화 변수 등) 에 값을 할당하는 데 사용됩니다.",
   "blocksAbout.code": "사용자 정의 논리를 구현하기 위해 Python 또는 NodeJS 코드를 실행합니다",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "워크플로 ID",
   "globalVar.fieldsDescription.workflowRunId": "워크플로 실행 ID",
   "globalVar.title": "시스템 변수",
+  "nodes.agent.advancedSetting": "고급 설정",
   "nodes.agent.checkList.strategyNotSelected": "전략이 선택되지 않음",
   "nodes.agent.clickToViewParameterSchema": "매개변수 스키마 보려면 클릭하세요.",
   "nodes.agent.configureModel": "모델 구성",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "지원되지 않는 모델",
   "nodes.agent.modelSelectorTooltips.deprecated": "이 모델은 더 이상 사용되지 않습니다.",
   "nodes.agent.notAuthorized": "권한이 부여되지 않음",
+  "nodes.agent.outputVars.confirm": "확인",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "JSON 배열을 입력하세요.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "true 또는 false 를 입력하세요.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "여기서는 파일 기본값을 아직 구성할 수 없습니다.",
+  "nodes.agent.outputVars.defaultValueLabel": "기본값",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "유효한 숫자를 입력하세요.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "JSON 객체를 입력하세요.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "기본값",
+  "nodes.agent.outputVars.delete": "{{name}} 삭제",
+  "nodes.agent.outputVars.descriptionLabel": "설명",
+  "nodes.agent.outputVars.descriptionPlaceholder": "설명 추가",
+  "nodes.agent.outputVars.edit": "{{name}} 편집",
+  "nodes.agent.outputVars.editorLabel": "출력 변수 편집기",
   "nodes.agent.outputVars.files.title": "에이전트 생성 파일",
   "nodes.agent.outputVars.files.transfer_method": "전송 방법. 값이 remote_url 또는 local_file 입니다.",
   "nodes.agent.outputVars.files.type": "지원 유형. 이제 이미지만 지원합니다.",
   "nodes.agent.outputVars.files.upload_file_id": "파일 ID 업로드",
   "nodes.agent.outputVars.files.url": "이미지 URL",
   "nodes.agent.outputVars.json": "에이전트 생성 JSON",
+  "nodes.agent.outputVars.nameDuplicate": "출력 이름이 이미 존재합니다",
+  "nodes.agent.outputVars.nameInvalid": "문자, 숫자 및 밑줄을 사용하세요. 문자 또는 밑줄로 시작해야 합니다.",
+  "nodes.agent.outputVars.nameLabel": "필드 이름",
+  "nodes.agent.outputVars.namePlaceholder": "필드 이름",
+  "nodes.agent.outputVars.newOutput": "새 출력",
+  "nodes.agent.outputVars.requiredLabel": "필수",
+  "nodes.agent.outputVars.showAdvancedOptions": "고급 옵션 표시",
   "nodes.agent.outputVars.text": "상담원이 생성한 콘텐츠",
+  "nodes.agent.outputVars.typeLabel": "출력 유형",
   "nodes.agent.outputVars.usage": "모델 사용 정보",
   "nodes.agent.parameterSchema": "파라미터 스키마",
   "nodes.agent.pluginInstaller.install": "설치",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "이 통합은 GitHub 에서 설치됩니다. 통합으로 이동하여 다시 설치하십시오.",
   "nodes.agent.pluginNotInstalled": "이 통합은 설치되어 있지 않습니다.",
   "nodes.agent.pluginNotInstalledDesc": "이 통합은 GitHub 에서 설치됩니다. 통합으로 이동하여 다시 설치하십시오.",
+  "nodes.agent.roster.change": "변경",
+  "nodes.agent.roster.editInConsole": "Agent Console에서 편집",
+  "nodes.agent.roster.inlineSetup.description": "이 노드 내에만 존재하는 일회성 설정",
+  "nodes.agent.roster.inlineSetup.name": "인라인 설정",
+  "nodes.agent.roster.inlineSetup.title": "Agent 설정",
+  "nodes.agent.roster.inlineSetup.type": "이 노드에서만",
+  "nodes.agent.roster.label": "에이전트",
+  "nodes.agent.roster.makeCopy": "사본 만들기",
+  "nodes.agent.roster.more": "Agent 추가 작업",
+  "nodes.agent.roster.openPanel": "{{name}} 상세 열기",
+  "nodes.agent.roster.panelLabel": "{{name}} 상세",
   "nodes.agent.strategy.configureTip": "에이전트 전략을 구성하세요.",
   "nodes.agent.strategy.configureTipDesc": "에이전트 전략을 구성한 후 이 노드는 나머지 구성을 자동으로 로드합니다. 이 전략은 다단계 도구 추론의 메커니즘에 영향을 미칩니다.",
   "nodes.agent.strategy.label": "에이전트 전략",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "설치된 통합 버전은 이 전략을 제공하지 않습니다. 버전을 전환하려면 클릭합니다.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}}가 설치되지 않았습니다.",
   "nodes.agent.strategyNotSet": "에이전트 전략이 설정되지 않음",
+  "nodes.agent.task.insert": "삽입",
+  "nodes.agent.task.label": "Agent 작업",
+  "nodes.agent.task.mention": "멘션",
+  "nodes.agent.task.placeholder": "이 Agent가 수행해야 할 작업을 설명하세요...",
+  "nodes.agent.task.tooltip": "이 워크플로에서 이 Agent가 따라야 할 작업 지시 사항을 정의합니다.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} 권한이 부여되지 않음",
   "nodes.agent.toolNotInstallTooltip": "{{tool}}이 설치되지 않았습니다.",
   "nodes.agent.toolbox": "도구",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "{{author}} 작성",
   "tabs.question-understand": "질문 이해",
   "tabs.requestToCommunity": "커뮤니티에 대한 요청",
-  "tabs.searchBlock": "검색 노드",
+  "tabs.searchBlock": "노드, Agent, 사람, 지식 검색",
   "tabs.searchDataSource": "데이터 소스 검색",
   "tabs.searchSnippets": "스니펫 검색...",
   "tabs.searchTool": "검색 도구",
diff --git a/web/i18n/nl-NL/agent-v-2.json b/web/i18n/nl-NL/agent-v-2.json
new file mode 100644
index 00000000000..9209a7ed773
--- /dev/null
+++ b/web/i18n/nl-NL/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Deze actie is nog niet beschikbaar.",
+  "agentDetail.access.actions.monitoring": "Monitoring",
+  "agentDetail.access.copyAccessUrl": "Toegangs-URL kopiëren",
+  "agentDetail.access.copyFailed": "Kopiëren van referentie mislukt.",
+  "agentDetail.access.copyReference": "Referentie kopiëren voor {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Service-API-endpoint kopiëren",
+  "agentDetail.access.description": "Elk oppervlak waarop deze agent bereikbaar is.",
+  "agentDetail.access.empty": "Geen gekoppelde toegangspunten",
+  "agentDetail.access.emptyDescription": "Deze Roster-agent heeft nog geen app- of workflowreferenties.",
+  "agentDetail.access.entries.agentApp.description": "Agent-app gekoppeld aan deze Roster-agent.",
+  "agentDetail.access.entries.agentApp.name": "Agent-app",
+  "agentDetail.access.entries.workflow.description": "Workflow- en knooppuntreferentie gekoppeld aan deze Roster-agent.",
+  "agentDetail.access.entries.workflow.name": "Workflowknooppunt",
+  "agentDetail.access.entryCount_one": "{{count}} item",
+  "agentDetail.access.entryCount_other": "{{count}} items",
+  "agentDetail.access.groups.references.heading": "Referenties",
+  "agentDetail.access.groups.references.label": "Gekoppelde referenties",
+  "agentDetail.access.learnMore": "Meer informatie",
+  "agentDetail.access.moreActions": "Meer acties voor {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Service-API-endpoint",
+  "agentDetail.access.serviceApi.title": "Backend service-API",
+  "agentDetail.access.status.disabled": "Uitgeschakeld",
+  "agentDetail.access.status.enabled": "Ingeschakeld",
+  "agentDetail.access.status.inService": "In gebruik",
+  "agentDetail.access.status.outOfService": "Buiten gebruik",
+  "agentDetail.access.title": "Toegangspunt",
+  "agentDetail.access.toggleSurface": "Toegang van {{name}} schakelen",
+  "agentDetail.access.webApp.accessUrl": "Toegangs-URL",
+  "agentDetail.access.webApp.actions.customize": "Aanpassen",
+  "agentDetail.access.webApp.actions.embedded": "Ingesloten",
+  "agentDetail.access.webApp.actions.launch": "Starten",
+  "agentDetail.access.webApp.actions.settings": "Instellingen",
+  "agentDetail.access.webApp.refreshUrl": "Toegangs-URL vernieuwen",
+  "agentDetail.access.webApp.showQrCode": "QR-code tonen",
+  "agentDetail.access.webApp.ssoEnabled": "SSO ingeschakeld",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Gebruikt als knooppunt binnen de workflow",
+  "agentDetail.access.workflow.empty": "Nog geen workflowreferenties.",
+  "agentDetail.access.workflow.loadFailed": "Laden van workflowreferenties mislukt.",
+  "agentDetail.access.workflow.loading": "Workflowreferenties laden…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} knooppunt",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} knooppunten",
+  "agentDetail.access.workflow.notAvailable": "N/B",
+  "agentDetail.access.workflow.openInStudio": "Openen in Studio",
+  "agentDetail.access.workflow.openInStudioFor": "{{name}} openen in Studio",
+  "agentDetail.access.workflow.table.actions": "Acties",
+  "agentDetail.access.workflow.table.lastUpdated": "Laatst bijgewerkt",
+  "agentDetail.access.workflow.table.name": "Naam",
+  "agentDetail.access.workflow.table.nodes": "Knooppunten",
+  "agentDetail.access.workflow.table.version": "Versie",
+  "agentDetail.access.workflow.title": "Workflowtoegang",
+  "agentDetail.configure.advancedSettings.description": "Voor gevorderde gebruikers. Omgevingsvariabelen, sandbox en geheugen.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Omgevingsvariabele toevoegen",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "{{key}} verwijderen",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Waarde van {{key}} verbergen",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": ".env importeren",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Druk in het bestandsdialoogvenster op Command + Shift + . om verborgen .env-bestanden weer te geven.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Als je .env-bestand verborgen is, schakel verborgen bestanden in via het bestandsdialoogvenster van je systeem.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Schakel „Verborgen items” in Verkenner in om verborgen .env-bestanden weer te geven.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Waarde van {{key}} tonen",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Selecteer scope van omgevingsvariabele",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Omgevingsvariabelen die tijdens runtime beschikbaar zijn voor deze agent.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Env Editor in/uit",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Geavanceerde instellingen",
+  "agentDetail.configure.advancedSettings.toggle": "Geavanceerde instellingen in/uit",
+  "agentDetail.configure.chatFeatures.description": "Geef vorm aan de chatervaring voor eindgebruikers in je webapp en chatoppervlakken.",
+  "agentDetail.configure.chatFeatures.title": "Chatfuncties",
+  "agentDetail.configure.files.add": "Bestand toevoegen",
+  "agentDetail.configure.files.empty.description": "Upload documenten die de agent kan lezen, zoals specificaties, sjablonen of richtlijnen",
+  "agentDetail.configure.files.empty.title": "Nog geen bestanden",
+  "agentDetail.configure.files.label": "Bestanden",
+  "agentDetail.configure.files.preview.empty": "Geen voorbeeldinhoud.",
+  "agentDetail.configure.files.preview.failed": "Laden van voorbeeld mislukt.",
+  "agentDetail.configure.files.preview.unsupported": "Dit bestand ondersteunt geen voorbeeldweergave.",
+  "agentDetail.configure.files.remove": "{{name}} verwijderen",
+  "agentDetail.configure.files.tip": "Bestanden die deze agent kan gebruiken tijdens het orkestreren van taken.",
+  "agentDetail.configure.files.toggle": "Bestanden in/uit",
+  "agentDetail.configure.files.treeLabel": "Agentbestanden",
+  "agentDetail.configure.files.upload.action": "Uploaden",
+  "agentDetail.configure.files.upload.browse": "bladeren",
+  "agentDetail.configure.files.upload.description": "Upload een bestand voor deze agent.",
+  "agentDetail.configure.files.upload.dropzone": "Sleep een bestand hierheen, of",
+  "agentDetail.configure.files.upload.failed": "Bestand uploaden mislukt.",
+  "agentDetail.configure.files.upload.fileType": "BESTAND",
+  "agentDetail.configure.files.upload.invalidFile": "Upload één bestand.",
+  "agentDetail.configure.files.upload.success": "Bestand geüpload.",
+  "agentDetail.configure.files.upload.title": "Bestand uploaden",
+  "agentDetail.configure.knowledgeRetrieval.add": "Kennisophaling toevoegen",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Kennis toevoegen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Klik op de knop „+” om kennis toe te voegen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Kennis",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Ophalingsinstellingen",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Meer over kennisophaling",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automatisch",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Voorwaarden",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Uitgeschakeld",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Metadatafiltering",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Handmatig",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Selecteer modus voor metadatafiltering",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Naam van kennisophaling",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Agent beslist",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "De agent stelt zelf een query op uit de prompt en beschikbare context. Hier hoef je niets in te stellen.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Aangepaste query",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Schrijf een vaste query voor deze ophaalbron.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Aangepaste querytekst",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Typ een zoekquery",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Query",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Kennisophaling · Agent beslist",
+  "agentDetail.configure.knowledgeRetrieval.edit": "{{name}} bewerken",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Koppel een kennisbank die de agent kan doorzoeken bij het beantwoorden",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Nog geen kennis",
+  "agentDetail.configure.knowledgeRetrieval.label": "Kennisophaling",
+  "agentDetail.configure.knowledgeRetrieval.remove": "{{name}} verwijderen",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Kennisophalingsbronnen die deze agent kan gebruiken tijdens het orkestreren van taken.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Kennisophaling in/uit",
+  "agentDetail.configure.model.label": "Model",
+  "agentDetail.configure.orchestrate": "Orkestreren",
+  "agentDetail.configure.preview.chatFeatures": "Chatfuncties",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agent",
+  "agentDetail.configure.preview.empty.description": "Stuur een bericht om het huidige concept te testen.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Nog geen instructies, dus antwoorden komen van het kale model.",
+  "agentDetail.configure.preview.endUserAuth": "Authenticatie eindgebruiker",
+  "agentDetail.configure.preview.restart": "Voorbeeld opnieuw starten",
+  "agentDetail.configure.preview.title": "Voorbeeld",
+  "agentDetail.configure.prompt.copied": "Prompt gekopieerd",
+  "agentDetail.configure.prompt.copy": "Prompt kopiëren",
+  "agentDetail.configure.prompt.copyFailed": "Prompt kopiëren mislukt.",
+  "agentDetail.configure.prompt.insert.label": "Invoegen",
+  "agentDetail.configure.prompt.insert.question": "Startvraag",
+  "agentDetail.configure.prompt.insert.reportFile": "Uitvoerrapport-bestand",
+  "agentDetail.configure.prompt.insert.tenders": "Aanbestedingen starten",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Vermelden",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Schrijf hier instructies,",
+  "agentDetail.configure.prompt.tip": "Bepaal hoe deze agent invoer interpreteert, tools aanroept en uitvoer genereert.",
+  "agentDetail.configure.publishBar.draft": "Concept",
+  "agentDetail.configure.publishBar.publishUpdate": "Update publiceren",
+  "agentDetail.configure.publishBar.published": "Gepubliceerd",
+  "agentDetail.configure.publishBar.publishedAt": "Gepubliceerd {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Publiceren…",
+  "agentDetail.configure.publishBar.saved": "5 min geleden opgeslagen",
+  "agentDetail.configure.publishBar.savedAt": "Opgeslagen {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Niet-gepubliceerde wijzigingen",
+  "agentDetail.configure.publishBar.upToDate": "Up-to-date",
+  "agentDetail.configure.publishBar.versionHistory": "Versiegeschiedenis openen",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Beïnvloede workflows",
+  "agentDetail.configure.publishImpact.cancel": "Annuleren",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Je agent verschijnt in",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Wijzigingen hebben hierop invloed.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "deze agent",
+  "agentDetail.configure.publishImpact.title": "{{action}} naar {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} workflow",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} workflows",
+  "agentDetail.configure.skills.add": "Skill toevoegen",
+  "agentDetail.configure.skills.detail.contentRegion": "Skill-detailinhoud",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} BESTANDEN",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Skill-bestanden",
+  "agentDetail.configure.skills.detail.files": "Bestanden",
+  "agentDetail.configure.skills.empty.description": "Skills geven de agent herbruikbare expertise die hij tijdens het werken kan inzetten",
+  "agentDetail.configure.skills.empty.title": "Nog geen skills",
+  "agentDetail.configure.skills.itemType": "Skill",
+  "agentDetail.configure.skills.label": "Skills",
+  "agentDetail.configure.skills.remove": "{{name}} verwijderen",
+  "agentDetail.configure.skills.tip": "Skills die deze agent kan gebruiken tijdens het orkestreren van taken.",
+  "agentDetail.configure.skills.toggle": "Skills in/uit",
+  "agentDetail.configure.skills.upload.action": "Uploaden",
+  "agentDetail.configure.skills.upload.browse": "bladeren",
+  "agentDetail.configure.skills.upload.description": "Upload een .zip- of .skill-pakket voor deze agent.",
+  "agentDetail.configure.skills.upload.dropzone": "Sleep een skill-pakket hierheen, of",
+  "agentDetail.configure.skills.upload.failed": "Skill uploaden mislukt.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Upload een .zip- of .skill-bestand.",
+  "agentDetail.configure.skills.upload.success": "Skill geüpload.",
+  "agentDetail.configure.skills.upload.title": "Skill uploaden",
+  "agentDetail.configure.tools.add": "Tool toevoegen",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Voor ontwikkelaars",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Installeer een commandoregelprogramma dat de agent in zijn sandbox uitvoert. Vereist installatie en meestal API-keys.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI-tool",
+  "agentDetail.configure.tools.addMenu.tool.description": "Kies een tool die al in deze werkruimte beschikbaar is, zoals webzoekopdrachten of integraties.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Tool",
+  "agentDetail.configure.tools.cliDialog.description": "Installeer een CLI-tool vanuit een willekeurige pakketregistry. De agent krijgt shell-toegang tot de binary die hij levert.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "CLI-tool bewerken",
+  "agentDetail.configure.tools.cliDialog.env.description": "Sla API-keys, tokens of secrets op die deze CLI-tool nodig heeft. Waarden worden in rust versleuteld en worden tijdens runtime als omgevingsvariabelen geïnjecteerd wanneer de agent de tool aanroept.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Omgevingsvariabelen",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(optioneel)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Sandboxed · wordt eenmaal uitgevoerd bij de eerste aanroep",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Installatiecommando",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Plak hier je installatiecommando, bv. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Installatiecommando is verplicht.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Meer over CLI-tool",
+  "agentDetail.configure.tools.cliDialog.name.label": "Naam van CLI-tool",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Geef je CLI-tool een naam",
+  "agentDetail.configure.tools.cliDialog.name.required": "Naam van CLI-tool is verplicht.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Nooit zichtbaar in de prompt van de agent; alleen tijdens runtime geïnjecteerd als $VAR",
+  "agentDetail.configure.tools.cliDialog.title": "CLI-tool toevoegen",
+  "agentDetail.configure.tools.cliTool": "CLI-tool",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Eindgebruiker · OAuth",
+  "agentDetail.configure.tools.editAction": "{{name}} bewerken",
+  "agentDetail.configure.tools.empty.description": "Tools laten de agent handelen, zoals het web doorzoeken of je apps aanroepen",
+  "agentDetail.configure.tools.empty.title": "Nog geen tools",
+  "agentDetail.configure.tools.label": "Tools",
+  "agentDetail.configure.tools.moreActions": "Meer acties voor {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Vooraf autoriseren",
+  "agentDetail.configure.tools.removeAction": "{{name}} verwijderen",
+  "agentDetail.configure.tools.removeProvider": "Alle tools verwijderen",
+  "agentDetail.configure.tools.tip": "Tools die deze agent kan aanroepen tijdens het orkestreren van taken.",
+  "agentDetail.configure.tools.toggle": "Tools in/uit",
+  "agentDetail.configure.tools.toolTabs.all": "Alle",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Aangepast",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugins",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agent",
+  "agentDetail.history": "Geschiedenis",
+  "agentDetail.logs.description": "Volledige logs registreren de status van de applicatie tijdens het uitvoeren, inclusief gebruikersinvoer, antwoorden van de agent, planning en gebruik van tools.",
+  "agentDetail.logs.empty": "Geen logs gevonden",
+  "agentDetail.logs.filters.period.allTime": "Alle tijd",
+  "agentDetail.logs.filters.period.label": "Logperiode",
+  "agentDetail.logs.filters.period.last30days": "Laatste 30 dagen",
+  "agentDetail.logs.filters.period.last7days": "Laatste 7 dagen",
+  "agentDetail.logs.filters.search.label": "Logs doorzoeken",
+  "agentDetail.logs.filters.search.placeholder": "Zoeken",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Laatst aangemaakt",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Laatst bijgewerkt",
+  "agentDetail.logs.filters.source.all": "Bron",
+  "agentDetail.logs.filters.source.empty": "Geen bronnen gevonden",
+  "agentDetail.logs.filters.source.label": "Logbron",
+  "agentDetail.logs.filters.source.loadFailed": "Bronnen laden mislukt",
+  "agentDetail.logs.filters.source.loading": "Bronnen laden…",
+  "agentDetail.logs.filters.source.searchLabel": "Bronnen zoeken",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Zoeken",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Workflow",
+  "agentDetail.logs.learnMore": "Meer informatie",
+  "agentDetail.logs.loadFailed": "Logboeken laden mislukt",
+  "agentDetail.logs.loading": "Logboeken laden…",
+  "agentDetail.logs.notAvailable": "Niet beschikbaar",
+  "agentDetail.logs.table.createdTime": "Aanmaaktijd",
+  "agentDetail.logs.table.endUser": "Eindgebruiker",
+  "agentDetail.logs.table.messageCount": "Aantal ber.",
+  "agentDetail.logs.table.operationRate": "Actiefrequentie",
+  "agentDetail.logs.table.source": "Bron",
+  "agentDetail.logs.table.title": "Titel",
+  "agentDetail.logs.table.unread": "Ongelezen",
+  "agentDetail.logs.table.updatedTime": "Bijgewerkte tijd",
+  "agentDetail.logs.table.userRate": "Gebruikersbeoordeling",
+  "agentDetail.logs.title": "Logs",
+  "agentDetail.memorySettings.budgetLabel": "Geheugenbudget",
+  "agentDetail.memorySettings.description": "Geheugeninstellingen uit de actieve configuratiemomentopname.",
+  "agentDetail.memorySettings.export.description": "Geheugenexport is gepland voor een latere release.",
+  "agentDetail.memorySettings.export.download": "Downloaden",
+  "agentDetail.memorySettings.export.soon": "Binnenkort",
+  "agentDetail.memorySettings.export.title": "Huidig geheugen exporteren",
+  "agentDetail.memorySettings.notConfigured": "Niet geconfigureerd",
+  "agentDetail.memorySettings.scopeLabel": "Geheugenscope",
+  "agentDetail.memorySettings.title": "Geheugen",
+  "agentDetail.metadata.activeVersionLabel": "Actieve versie",
+  "agentDetail.metadata.appIdLabel": "App-ID",
+  "agentDetail.metadata.description": "Alleen-lezen Roster-velden geretourneerd door de agentbackend.",
+  "agentDetail.metadata.emptyValue": "Niet beschikbaar",
+  "agentDetail.metadata.scopeLabel": "Scope",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Alleen workflow",
+  "agentDetail.metadata.sourceLabel": "Bron",
+  "agentDetail.metadata.statusLabel": "Status",
+  "agentDetail.metadata.title": "Metadata",
+  "agentDetail.metadata.updatedAtLabel": "Bijgewerkt op",
+  "agentDetail.metadata.workflowIdLabel": "Workflow-ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "Workflowknooppunt-ID",
+  "agentDetail.monitoring.change": "{{value}} t.o.v. vorige periode",
+  "agentDetail.monitoring.dateRangeLabel": "Datumbereik",
+  "agentDetail.monitoring.description": "Volg de activiteit, kosten en interactiekwaliteit van de herbruikbare agent over workflows heen.",
+  "agentDetail.monitoring.learnMore": "Meer informatie",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Unieke eindgebruikers die workflows met deze agent hebben getriggerd.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Actieve gebruikers",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Aaneengesloten communicatie tussen gebruiker en agent voor dit toegangspunt.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Gem. sessie-interacties",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Gemiddelde uitvoersnelheid vanaf het begin van de aanvraag tot voltooiing.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Token-uitvoersnelheid",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Geschatte tokenkosten gegenereerd door deze agent in workflowuitvoeringen.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Tokengebruik",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Dagelijkse AI-gesprekken die deze agent hebben bereikt via het geselecteerde toegangspunt.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Totaal aantal gesprekken",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Dagelijks aantal agentinteracties.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Totaal aantal berichten",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Het aantal likes per 1.000 berichten voor deze agent.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Gebruikerstevredenheid",
+  "agentDetail.monitoring.pickSource": "Kies een app",
+  "agentDetail.monitoring.sourceLabel": "App",
+  "agentDetail.monitoring.sourceTrigger": "Bron {{name}}",
+  "agentDetail.monitoring.sources.all": "Alle",
+  "agentDetail.monitoring.timeRangeLabel": "Tijdsbereik",
+  "agentDetail.monitoring.timeRanges.custom": "Aangepast",
+  "agentDetail.monitoring.timeRanges.last30days": "Laatste 30 dagen",
+  "agentDetail.monitoring.timeRanges.last7days": "Laatste 7 dagen",
+  "agentDetail.monitoring.timeRanges.today": "Vandaag",
+  "agentDetail.monitoring.title": "Monitoring",
+  "agentDetail.monitoring.tokenUsageConsumed": "Verbruikte tokens",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Agentnavigatie",
+  "agentDetail.publish": "Publiceren",
+  "agentDetail.publishSoon": "Binnenkort",
+  "agentDetail.sections.access": "Toegangspunt",
+  "agentDetail.sections.configure": "Orkestreren",
+  "agentDetail.sections.logs": "Logs",
+  "agentDetail.sections.monitoring": "Monitoring",
+  "agentDetail.subtitle": "Agent-ID: {{agentId}}",
+  "agentDetail.title": "Agent",
+  "agentDetail.type": "AGENT",
+  "agentDetail.versionHistory.active": "Actief",
+  "agentDetail.versionHistory.empty": "Nog geen versies",
+  "agentDetail.versionHistory.filter": "Versies filteren",
+  "agentDetail.versionHistory.versionName": "Versie {{version}}",
+  "roster.createAgent": "Agent aanmaken",
+  "roster.createAgentOptions": "Opties voor agent aanmaken",
+  "roster.createDialog.description": "Maak een herbruikbare agent in het roster van deze werkruimte.",
+  "roster.createDialog.title": "Agent aanmaken",
+  "roster.createForm.changeIcon": "Agentpictogram wijzigen",
+  "roster.createForm.descriptionLabel": "Beschrijving",
+  "roster.createForm.descriptionOptional": "(optioneel)",
+  "roster.createForm.descriptionPlaceholder": "bv. Verzamelt bronnen over een onderwerp en vat de belangrijkste bevindingen samen",
+  "roster.createForm.nameLabel": "Naam",
+  "roster.createForm.namePlaceholder": "bv. Max",
+  "roster.createForm.nameRequired": "Naam is verplicht.",
+  "roster.createForm.roleLabel": "Rol",
+  "roster.createForm.rolePlaceholder": "bv. Research Assistant",
+  "roster.createForm.roleRequired": "Rol is verplicht.",
+  "roster.createSuccess": "Agent aangemaakt.",
+  "roster.dateTimeFormat": "DD-MM-YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Deze agent wordt uit de actieve rosterlijst verwijderd.",
+  "roster.deleteDialog.title": "{{name}} verwijderen?",
+  "roster.deleteFailed": "Verwijderen van agent mislukt.",
+  "roster.deleteSuccess": "Agent verwijderd.",
+  "roster.duplicateFailed": "Dupliceren van agent mislukt.",
+  "roster.duplicateSuccess": "Agent gedupliceerd.",
+  "roster.editAgent": "{{name}} bewerken",
+  "roster.editDialog.description": "Werk de rosternaam, beschrijving en rol van deze agent bij.",
+  "roster.editDialog.title": "Agent bewerken",
+  "roster.editInfo": "Info bewerken",
+  "roster.empty": "Nog geen agent",
+  "roster.emptyDescription": "Agents die in deze werkruimte zijn opgeslagen, verschijnen hier.",
+  "roster.emptySearch": "Geen overeenkomende agents",
+  "roster.emptySearchDescription": "Probeer een andere agentnaam.",
+  "roster.filters.all": "Alle",
+  "roster.filters.drafts": "Concepten",
+  "roster.filters.label": "Agentfilters",
+  "roster.filters.published": "Gepubliceerd",
+  "roster.learnMore": "Meer over Agent Roster",
+  "roster.listLabel": "Agent Roster-lijst",
+  "roster.loadMore": "Meer laden",
+  "roster.loadingError": "Laden van agents mislukt. Vernieuw en probeer het opnieuw.",
+  "roster.moreActions": "Meer acties voor {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Inline-agent aanmaken mislukt. Vernieuw en probeer het opnieuw.",
+  "roster.nodeSelector.dialogLabel": "Selecteer een agent",
+  "roster.nodeSelector.manageInAgentConsole": "Beheren in Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Zoeken…",
+  "roster.nodeSelector.startFromScratch": "Vanaf nul beginnen",
+  "roster.references.label": "Workflows die {{name}} gebruiken",
+  "roster.references.trigger": "Workflows die {{name}} gebruiken",
+  "roster.searchLabel": "Agents zoeken",
+  "roster.searchPlaceholder": "Agents op naam zoeken…",
+  "roster.sources.agent_app": "Agent-app",
+  "roster.sources.imported": "Geïmporteerd",
+  "roster.sources.system": "Systeem",
+  "roster.sources.workflow": "Workflow",
+  "roster.status.active": "Actief",
+  "roster.status.archived": "Gearchiveerd",
+  "roster.tabs.agent": "Agent",
+  "roster.tabs.human": "Mens",
+  "roster.tabsLabel": "Rostertype",
+  "roster.updateSuccess": "Agent bijgewerkt.",
+  "roster.usageStatus.draft": "Concept"
+}
diff --git a/web/i18n/nl-NL/app-log.json b/web/i18n/nl-NL/app-log.json
index a58e11e8091..0f30728e2ed 100644
--- a/web/i18n/nl-NL/app-log.json
+++ b/web/i18n/nl-NL/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Today",
   "filter.period.yearToDate": "Year to date",
   "filter.sortBy": "Sort by:",
+  "monitoring.description": "Monitoring registreert de actieve status van de applicatie, inclusief prestaties, gebruikersactiviteit en kosten.",
   "promptLog": "Prompt Log",
   "runDetail.fileListDetail": "Detail",
   "runDetail.fileListLabel": "File Details",
diff --git a/web/i18n/nl-NL/billing.json b/web/i18n/nl-NL/billing.json
index 348fa73574f..6fd899dd807 100644
--- a/web/i18n/nl-NL/billing.json
+++ b/web/i18n/nl-NL/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Upgrade to unlock batch document upload",
   "upgrade.uploadMultiplePages.description": "You’ve reached the upload limit — only one document can be selected and uploaded at a time on your current plan.",
   "upgrade.uploadMultiplePages.title": "Upgrade to upload multiple documents at once",
+  "upgrade.workflowRestore.description": "Het herstellen van workflowversies is niet beschikbaar in je huidige abonnement.",
+  "upgrade.workflowRestore.title": "Upgrade om workflowversies te herstellen",
   "upgradeBtn.encourage": "Upgrade Now",
   "upgradeBtn.encourageShort": "Upgrade",
   "upgradeBtn.plain": "View Plan",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 18fb43bab3d..48ac771291a 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Werkruimte wisselen",
   "mcpPage.description": "Verbind en beheer MCP-servers zodat je apps toegang krijgen tot externe tools en services.",
-  "members.admin": "Admin",
   "members.adminTip": "Can build apps & manage team settings",
+  "members.alreadyInTeam": "Al in het team",
+  "members.alreadyInTeamTip": "Deze gebruikers hebben al toegang tot deze werkruimte.",
   "members.builder": "Builder",
   "members.builderTip": "Can build & edit own apps",
-  "members.datasetOperator": "Knowledge Admin",
   "members.datasetOperatorTip": "Only can manage the knowledge base",
   "members.deleteMember": "Delete Member",
   "members.disInvite": "Cancel the invitation",
-  "members.editor": "Editor",
   "members.editorTip": "Can build & edit apps",
   "members.email": "Email",
   "members.emailInvalid": "Invalid Email Format",
@@ -270,13 +269,12 @@
   "members.invite": "Add",
   "members.inviteTeamMember": "Add team member",
   "members.inviteTeamMemberTip": "They can access your team data directly after signing in.",
-  "members.invitedAsRole": "Invited as {{role}} user",
+  "members.invitedAsRole": "Uitgenodigd als {{role}}",
   "members.lastActive": "LAST ACTIVE",
   "members.name": "NAME",
-  "members.normal": "Normal",
+  "members.noNewInvitationsSent": "Geen nieuwe uitnodigingen verzonden",
   "members.normalTip": "Only can use apps, can not build apps",
   "members.ok": "OK",
-  "members.owner": "Owner",
   "members.pending": "Pending...",
   "members.removeFromTeam": "Remove from team",
   "members.removeFromTeamTip": "Will remove team access",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Knowledge",
   "menus.datasetsTips": "COMING SOON: Import your own text data or write data in real-time via Webhook for LLM context enhancement.",
+  "menus.deployments": "Implementaties",
   "menus.explore": "Explore",
   "menus.exploreMarketplace": "Explore Marketplace",
   "menus.newApp": "New App",
   "menus.newDataset": "Create Knowledge",
   "menus.plugins": "Integraties",
   "menus.pluginsTips": "Integrate third-party integraties or create ChatGPT-compatible AI-Integraties.",
+  "menus.roster": "Agentenoverzicht",
   "menus.status": "beta",
   "menus.tools": "Tools",
   "model.addMoreModel": "Go to settings to add more models",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Text-to-Speech Model",
   "modelProvider.ttsModel.tip": "Set the default model for text-to-speech input in conversation.",
   "modelProvider.upgradeForLoadBalancing": "Upgrade your plan to enable Load Balancing.",
+  "navigation.skipToMain": "Naar hoofdinhoud springen",
   "noData": "No data",
   "operation.add": "Add",
   "operation.added": "Added",
@@ -600,9 +601,6 @@
   "placeholder.input": "Please enter",
   "placeholder.search": "Search...",
   "placeholder.select": "Please select",
-  "plugin.serpapi.apiKey": "API Key",
-  "plugin.serpapi.apiKeyPlaceholder": "Enter your API key",
-  "plugin.serpapi.keyFrom": "Get your SerpAPI key from SerpAPI Account Page",
   "promptEditor.context.item.desc": "Insert context template",
   "promptEditor.context.item.title": "Context",
   "promptEditor.context.modal.add": "Add Context ",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
new file mode 100644
index 00000000000..cee62004197
--- /dev/null
+++ b/web/i18n/nl-NL/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "Backend service API",
+  "access.api.copyCurlExample": "Kopieer cURL-voorbeeld",
+  "access.api.createFailed": "API-token kon niet worden gegenereerd.",
+  "access.api.createKey": "API-token genereren",
+  "access.api.createKeyTitle": "Nieuw API-token genereren",
+  "access.api.curlExampleTitle": "cURL-voorbeeld",
+  "access.api.description": "Toegang tot deze implementatie via HTTP. Elk API-token is gekoppeld aan één omgeving.",
+  "access.api.developerTitle": "Developer API",
+  "access.api.disabled": "API-toegang is uitgeschakeld voor deze implementatie.",
+  "access.api.disabledHint": "Schakel API-toegang in om omgevingsgebonden tokens te genereren.",
+  "access.api.dismissToken": "API-token sluiten",
+  "access.api.docs": "API-documentatie",
+  "access.api.docsClose": "API-documentatie sluiten",
+  "access.api.docsDescription": "Bekijk de Workflow API-referentie voor deze implementatie.",
+  "access.api.docsTitle": "Workflow API-documentatie",
+  "access.api.empty": "Implementeer eerst naar een omgeving om API-tokens uit te kunnen geven.",
+  "access.api.emptyTitle": "Geen geïmplementeerde omgevingen",
+  "access.api.endpoint": "Verzoek-URL",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "API-tokenlijst",
+  "access.api.nameLabel": "Naam API-token",
+  "access.api.namePlaceholder": "Voer een naam voor het API-token in",
+  "access.api.nameRequired": "Naam API-token is verplicht.",
+  "access.api.newKey": "Nieuw API-token genereren",
+  "access.api.newTokenDescription": "Dit API-token wordt slechts eenmaal getoond. Kopieer het voordat je deze pagina verlaat.",
+  "access.api.newTokenLabel": "API-token",
+  "access.api.newTokenTitle": "API-token gegenereerd",
+  "access.api.noKeys": "Nog geen API-tokens. Genereer er een om de API aan te roepen.",
+  "access.api.noKeysTitle": "Nog geen API-tokens",
+  "access.api.revokeConfirmDescription": "Het API-token \"{{name}}\" werkt direct niet meer. Deze actie kan niet ongedaan worden gemaakt.",
+  "access.api.revokeConfirmTitle": "API-token intrekken?",
+  "access.api.revokeFailed": "API-token kon niet worden ingetrokken.",
+  "access.api.revokeSuccess": "API-token ingetrokken",
+  "access.api.table.action": "Actie",
+  "access.api.table.environment": "Omgeving",
+  "access.api.table.key": "API-token",
+  "access.api.table.name": "Naam",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Kanaal",
+  "access.channels.col.endpoint": "Toegangspunt",
+  "access.channels.col.status": "Status",
+  "access.channels.description": "WebApp- en CLI-toegangspunten gebruiken de bovenstaande toegangsrechten.",
+  "access.channels.disabled": "Toegangskanalen zijn uitgeschakeld voor deze implementatie.",
+  "access.channels.disabledHint": "Schakel toegangskanalen in om WebApp- en CLI-toegangspunten beschikbaar te maken.",
+  "access.channels.followPermission": "Volgt rechten",
+  "access.channels.title": "Toegangskanalen",
+  "access.cli.description": "Roep aan vanuit de terminal met difyctl, geschikt voor scripts, geautomatiseerde workflows of Agent-integraties.",
+  "access.cli.docs": "Gebruikshandleiding",
+  "access.cli.domain": "Domein",
+  "access.cli.empty": "CLI-endpoint niet geconfigureerd.",
+  "access.cli.install": "CLI installeren",
+  "access.cli.title": "CLI",
+  "access.copied": "Gekopieerd",
+  "access.copy": "Kopiëren",
+  "access.copyFailed": "Kopiëren mislukt",
+  "access.copyToast": "Gekopieerd naar klembord",
+  "access.hide": "Verbergen",
+  "access.members.clearAll": "Alles wissen",
+  "access.members.empty": "Geen overeenkomsten gevonden.",
+  "access.members.groupCount_one": "{{count}} groep",
+  "access.members.groupCount_other": "{{count}} groepen",
+  "access.members.groups": "Groepen",
+  "access.members.individuals": "Leden",
+  "access.members.memberCount_one": "{{count}} lid",
+  "access.members.memberCount_other": "{{count}} leden",
+  "access.members.pickPlaceholder": "Selecteer groepen of leden",
+  "access.members.searchPlaceholder": "Zoek groepen en leden",
+  "access.members.selectedLabel": "Geselecteerd",
+  "access.permission.anyone": "Iedereen met de link",
+  "access.permission.anyoneDesc": "Iedereen kan deze implementatie benaderen zonder in te loggen.",
+  "access.permission.memberCount_one": "{{count}} lid",
+  "access.permission.memberCount_other": "{{count}} leden",
+  "access.permission.organization": "Alle leden binnen het platform",
+  "access.permission.organizationDesc": "Alle leden binnen het platform",
+  "access.permission.specific": "Specifieke leden binnen het platform",
+  "access.permission.specificDesc": "Selecteer specifieke groepen of leden",
+  "access.permission.specificUnavailable": "Selectie van specifieke leden is uitgeschakeld totdat echte platformleden en -groepen zijn gekoppeld.",
+  "access.permission.updateFailed": "Toegangsbeleid kon niet worden bijgewerkt.",
+  "access.permissions.col.environment": "Omgeving",
+  "access.permissions.col.permission": "Toegang",
+  "access.permissions.description": "Stel toegangsrechten in voor WebApp- en CLI-toegangspunten in elke omgeving.",
+  "access.permissions.editAriaLabel": "Toegang configureren voor {{environment}}",
+  "access.permissions.editDescription": "Stel toegangsrechten in voor WebApp- en CLI-toegangspunten.",
+  "access.permissions.editTitle": "Toegangsrechten",
+  "access.permissions.title": "Toegangsrechten",
+  "access.revoke": "Intrekken",
+  "access.runAccess.description": "Beheer hoe gebruikers deze implementatie kunnen uitvoeren en wie er toegang toe heeft per omgeving.",
+  "access.runAccess.disabled": "Uitvoertoegang is uitgeschakeld voor deze implementatie.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Stel deze implementatie beschikbaar als Model Context Protocol-server.",
+  "access.runAccess.mcpEmpty": "MCP-endpoint niet geconfigureerd.",
+  "access.runAccess.noEnvs": "Implementeer naar een omgeving om toegangsrechten te configureren.",
+  "access.runAccess.noEnvsTitle": "Geen geïmplementeerde omgevingen",
+  "access.runAccess.openWebapp": "WebApp openen",
+  "access.runAccess.permissions": "Toegangsrechten",
+  "access.runAccess.permissionsDesc": "Wie deze implementatie in elke omgeving kan benaderen.",
+  "access.runAccess.title": "Uitvoertoegang",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Gehoste webpagina voor eindgebruikers.",
+  "access.runAccess.webappEmpty": "Binnenkort beschikbaar.",
+  "access.show": "Tonen",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Extern",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Onbekend",
+  "card.access.api": "API-tokens",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Geen toegang",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Eerste release maken",
+  "card.deploy": "Implementeren",
+  "card.deploying": "{{count}} aan het implementeren",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} mislukt",
+  "card.fromApp": "Van {{name}}",
+  "card.lastDeployed": "Laatst geïmplementeerd {{time}}",
+  "card.menu.delete": "Implementatie verwijderen",
+  "card.menu.deleteDisabled": "Verwijderen van implementaties is nog niet beschikbaar voor backend-beheerde implementaties.",
+  "card.menu.deploy": "Implementeren naar omgeving",
+  "card.menu.editInfo": "Info bewerken",
+  "card.menu.viewDetail": "Implementatiedetails bekijken",
+  "card.moreActions": "Meer acties",
+  "card.neverDeployed": "Nog niet geïmplementeerd",
+  "card.noDescription": "Geen beschrijving opgegeven.",
+  "card.notDeployed": "Niet geïmplementeerd",
+  "card.ready": "{{count}} actief",
+  "card.tooltip.createdAt": "Aangemaakt",
+  "card.tooltip.deployed": "Geïmplementeerd",
+  "card.tooltip.deploymentStatus": "Implementatie",
+  "card.tooltip.notDeployed": "Deze implementatie is nog niet naar een omgeving geïmplementeerd.",
+  "card.tooltip.notDeployedShort": "Niet geïmplementeerd",
+  "card.tooltip.release": "Release",
+  "card.tooltip.releaseName": "Releasenaam",
+  "card.tooltip.source": "Bron",
+  "common.loadFailed": "Laden mislukt. Probeer het later opnieuw.",
+  "common.loading": "Laden...",
+  "createGuide.actions.back": "Terug",
+  "createGuide.actions.cancel": "Annuleren",
+  "createGuide.actions.continue": "Doorgaan",
+  "createGuide.actions.createAndDeploy": "Maken & implementeren",
+  "createGuide.actions.creating": "Aanmaken...",
+  "createGuide.actions.deploy": "Implementeren",
+  "createGuide.actions.deploying": "Aanmaken & implementeren...",
+  "createGuide.actions.next": "Volgende",
+  "createGuide.actions.skipDeploy": "Overslaan, later implementeren",
+  "createGuide.description": "Maak een implementatie aan op basis van een releasebron, basisgegevens en doelomgeving.",
+  "createGuide.dsl.defaultAppName": "Geïmporteerde DSL-app",
+  "createGuide.dsl.description": "Upload een Workflow DSL-pakket om de implementatie, eerste release en optionele omgevingsimplementatie aan te maken.",
+  "createGuide.dsl.dropDescription": "Upload een Workflow YAML DSL-pakket. Implementatieopties worden uit dit bestand opgehaald vóór het implementeren.",
+  "createGuide.dsl.dropTitle": "Workflow DSL-pakket uploaden",
+  "createGuide.dsl.readFailed": "Het DSL-bestand kon niet worden gelezen. Kies een ander bestand en probeer het opnieuw.",
+  "createGuide.dsl.reading": "DSL-bestand wordt gelezen...",
+  "createGuide.dsl.title": "DSL importeren",
+  "createGuide.dsl.unsupportedMode": "Alleen Workflow DSL-bestanden kunnen worden gebruikt voor implementaties.",
+  "createGuide.errors.createReleaseFailed": "Aanmaken van de implementatie of release mislukt.",
+  "createGuide.errors.deployFailed": "Implementeren naar de omgeving mislukt.",
+  "createGuide.method.description": "Kies de bron die wordt gebruikt om de eerste release aan te maken.",
+  "createGuide.methods.bindApp.description": "Gebruik een bestaande Workflow App in Studio als releasebron.",
+  "createGuide.methods.bindApp.title": "Bestaande Workflow App koppelen",
+  "createGuide.methods.importDsl.description": "Upload een Workflow YAML DSL-pakket en ga verder via de implementatie-interface.",
+  "createGuide.methods.importDsl.title": "DSL importeren",
+  "createGuide.methods.mocked": "Gesimuleerd",
+  "createGuide.nav.back": "Implementaties",
+  "createGuide.release.defaultName": "eerste release",
+  "createGuide.release.deployInfo": "Implementatiegegevens",
+  "createGuide.release.description": "Vul de implementatiegegevens en details van de eerste release in.",
+  "createGuide.release.firstVersion": "Eerste release",
+  "createGuide.release.instanceDescription": "Beschrijving implementatie",
+  "createGuide.release.instanceDescriptionPlaceholder": "Beschrijf waar deze implementatie voor wordt gebruikt",
+  "createGuide.release.instanceName": "Naam implementatie",
+  "createGuide.release.instanceNameConflict": "Er bestaat al een implementatie met deze naam. Kies een andere naam.",
+  "createGuide.release.releaseDescription": "Releasebeschrijving",
+  "createGuide.release.releaseDescriptionPlaceholder": "Beschrijf deze release",
+  "createGuide.release.releaseName": "Releasenaam",
+  "createGuide.release.releaseNote": "Releasebeschrijving",
+  "createGuide.release.title": "Basisinformatie",
+  "createGuide.source.availableApps_one": "{{count}} app",
+  "createGuide.source.availableApps_other": "{{count}} apps",
+  "createGuide.source.clearSearch": "App-zoekopdracht wissen",
+  "createGuide.source.description": "Kies de bron die wordt gebruikt om de eerste release aan te maken.",
+  "createGuide.source.empty": "Geen Workflow Apps gevonden.",
+  "createGuide.source.searchPlaceholder": "Apps zoeken",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "Releasebron",
+  "createGuide.steps.method": "Releasebron",
+  "createGuide.steps.release": "Basisinformatie",
+  "createGuide.steps.source": "Releasebron",
+  "createGuide.steps.target": "Implementeren naar omgeving",
+  "createGuide.target.bindingCount_one": "{{count}} koppeling",
+  "createGuide.target.bindingCount_other": "{{count}} koppelingen",
+  "createGuide.target.bindingHint": "Kies de inloggegevens die door deze release worden gebruikt.",
+  "createGuide.target.bindings": "Inloggegevens",
+  "createGuide.target.deferredBindingHint": "Inloggegevens worden tijdens de uiteindelijke implementatie-actie opgehaald uit het echte implementatieplan.",
+  "createGuide.target.deferredEnvironmentHint": "De naam wordt na het aanmaken van de implementatie en release gematcht met de echte omgevingen.",
+  "createGuide.target.description": "Kies een doelomgeving en geef de runtime-instellingen op die deze release daar nodig heeft. Deze stap kan worden overgeslagen.",
+  "createGuide.target.envVarCount_one": "{{count}} variabele",
+  "createGuide.target.envVarCount_other": "{{count}} variabelen",
+  "createGuide.target.envVarHint": "Voer voor elke omgevingsvariabele die deze release nodig heeft een aangepaste waarde in of gebruik de waarde die in de app is gedefinieerd.",
+  "createGuide.target.envVarPlaceholder": "Voer waarde in",
+  "createGuide.target.envVarSource.ariaLabel": "Selecteer de bron van de variabelewaarde voor {{key}}",
+  "createGuide.target.envVarSource.default": "App-waarde",
+  "createGuide.target.envVarSource.lastDeployment": "Laatst geïmplementeerde waarde",
+  "createGuide.target.envVarSource.literal": "Aangepaste waarde",
+  "createGuide.target.envVarType.number": "Getal",
+  "createGuide.target.envVarType.secret": "Geheim",
+  "createGuide.target.envVarType.string": "Tekenreeks",
+  "createGuide.target.envVars": "Omgevingsvariabelen",
+  "createGuide.target.environment": "Doelomgeving",
+  "createGuide.target.environmentName": "Omgevingsnaam",
+  "createGuide.target.environmentNamePlaceholder": "Productie",
+  "createGuide.target.loadBindingsFailed": "Inloggegevens konden niet worden geladen.",
+  "createGuide.target.loadEnvironmentsFailed": "Implementatieomgevingen konden niet worden geladen.",
+  "createGuide.target.missingRequiredBinding": "Selecteer een inloggegeven voor deze verplichte koppeling.",
+  "createGuide.target.noBindingRequired": "Geen inloggegevens vereist.",
+  "createGuide.target.noCredentialCandidates": "Geen beschikbare inloggegevens.",
+  "createGuide.target.noEnvironmentOptions": "Geen implementatieomgevingen beschikbaar.",
+  "createGuide.target.required": "Verplicht",
+  "createGuide.target.selectCredential": "Selecteer een inloggegeven",
+  "createGuide.target.title": "Implementeren naar omgeving",
+  "createGuide.title": "Nieuwe implementatie",
+  "createModal.appPickerPlaceholder": "Selecteer een Workflow App",
+  "createModal.appSearchEmpty": "Geen overeenkomende Workflow Apps",
+  "createModal.appSearchPlaceholder": "Workflow Apps zoeken…",
+  "createModal.cancel": "Annuleren",
+  "createModal.create": "Aanmaken",
+  "createModal.createFailed": "Aanmaken van implementatie mislukt.",
+  "createModal.description": "Kies een Workflow App en maak een implementatie aan.",
+  "createModal.descriptionLabel": "Beschrijving",
+  "createModal.descriptionPlaceholder": "Beschrijf waar deze implementatie voor wordt gebruikt",
+  "createModal.loadMoreApps": "Meer apps laden",
+  "createModal.loadingApps": "Apps laden…",
+  "createModal.nameLabel": "Naam implementatie",
+  "createModal.namePlaceholder": "Naam implementatie",
+  "createModal.noApps": "Geen Workflow Apps gevonden in deze werkruimte. Maak er eerst een aan in Studio.",
+  "createModal.selected": "Geselecteerd",
+  "createModal.sourceApp": "Workflow App (verplicht)",
+  "createModal.title": "Nieuwe implementatie",
+  "deployDrawer.bindingCount_one": "{{count}} koppeling",
+  "deployDrawer.bindingCount_other": "{{count}} koppelingen",
+  "deployDrawer.bindingOptionsFailed": "Opties voor inloggegevens konden niet worden geladen.",
+  "deployDrawer.bindingSelectionHint": "Kies de inloggegevens die door deze implementatie worden gebruikt.",
+  "deployDrawer.bindingsDisabled": "Opgehaald uit de releasevoorbeeldweergave. Bewerken is nog niet beschikbaar.",
+  "deployDrawer.cancel": "Annuleren",
+  "deployDrawer.close": "Implementatielade sluiten",
+  "deployDrawer.defaultSelect": "Selecteer...",
+  "deployDrawer.deploy": "Implementeren naar omgeving",
+  "deployDrawer.deployExistingRelease": "Implementeren naar omgeving",
+  "deployDrawer.deployExistingReleaseDescription": "Selecteer een release en doelomgeving om te implementeren.",
+  "deployDrawer.deployExistingReleaseTitle": "Implementeren naar omgeving",
+  "deployDrawer.deployFailed": "Starten van implementatie mislukt.",
+  "deployDrawer.deploying": "Implementeren...",
+  "deployDrawer.description": "Selecteer een release en doelomgeving om te implementeren.",
+  "deployDrawer.envVarCount_one": "{{count}} variabele",
+  "deployDrawer.envVarCount_other": "{{count}} variabelen",
+  "deployDrawer.envVarHint": "Voer voor elke omgevingsvariabele die deze release nodig heeft een aangepaste waarde in of gebruik de waarde die in de app is gedefinieerd.",
+  "deployDrawer.envVarPlaceholder": "Voer waarde in",
+  "deployDrawer.envVarSource.ariaLabel": "Selecteer de bron van de variabelewaarde voor {{key}}",
+  "deployDrawer.envVarSource.default": "App-waarde",
+  "deployDrawer.envVarSource.lastDeployment": "Laatst geïmplementeerde waarde",
+  "deployDrawer.envVarSource.literal": "Aangepaste waarde",
+  "deployDrawer.envVarType.number": "Getal",
+  "deployDrawer.envVarType.secret": "Geheim",
+  "deployDrawer.envVarType.string": "Tekenreeks",
+  "deployDrawer.envVars": "Omgevingsvariabelen",
+  "deployDrawer.existingReleaseHint": "Deze release wordt ongewijzigd geïmplementeerd. Er wordt geen nieuwe release aangemaakt.",
+  "deployDrawer.loadingBindings": "Ophalen...",
+  "deployDrawer.lockedHint": "Vergrendeld op huidige omgeving",
+  "deployDrawer.missingRequiredBinding": "Selecteer een inloggegeven voor deze verplichte koppeling.",
+  "deployDrawer.missingRequiredEnvVar": "Voer een waarde in voor deze verplichte omgevingsvariabele.",
+  "deployDrawer.modelCreds": "Model-inloggegevens",
+  "deployDrawer.needsValidation": " (validatie vereist)",
+  "deployDrawer.newReleaseHint": "Er wordt een nieuwe release aangemaakt uit de geselecteerde Workflow App YAML.",
+  "deployDrawer.noBindingRequired": "Niet vereist",
+  "deployDrawer.noCredentialCandidates": "Geen beschikbare inloggegevens.",
+  "deployDrawer.noNewEnvironmentAvailable": "Alle beschikbare omgevingen hebben al een implementatie.",
+  "deployDrawer.noOtherReleaseAvailable": "Er zijn geen andere releases beschikbaar voor deze omgeving.",
+  "deployDrawer.noReleaseAvailable": "Maak een release aan voordat je naar een omgeving implementeert.",
+  "deployDrawer.notFound": "Implementatie niet gevonden.",
+  "deployDrawer.noteLabel": "Releasebeschrijving (optioneel)",
+  "deployDrawer.notePlaceholder": "bijv. Aanpassing van onboarding-tekst uitleveren",
+  "deployDrawer.pluginCreds": "Plug-in-inloggegevens",
+  "deployDrawer.promote": "Implementeren",
+  "deployDrawer.promoteDescription": "Selecteer een release en doelomgeving om te implementeren.",
+  "deployDrawer.promoteTitle": "Implementeren naar omgeving",
+  "deployDrawer.readOnly": "Alleen-lezen",
+  "deployDrawer.redeploy": "Implementeren naar omgeving",
+  "deployDrawer.redeployDescription": "Selecteer een release en doelomgeving om te implementeren.",
+  "deployDrawer.redeployExistingReleaseHint": "De huidige release wordt ongewijzigd opnieuw geïmplementeerd. Er wordt geen nieuwe release aangemaakt.",
+  "deployDrawer.redeployTitle": "Implementeren naar omgeving",
+  "deployDrawer.releaseLabel": "Release",
+  "deployDrawer.requiredBinding": "Verplicht",
+  "deployDrawer.rollback": "Implementeren",
+  "deployDrawer.rollbackDescription": "Selecteer een release en doelomgeving om te implementeren.",
+  "deployDrawer.rollbackTitle": "Implementeren naar omgeving",
+  "deployDrawer.runtimeCredentials": "Inloggegevens",
+  "deployDrawer.secretPlaceholder": "geheim",
+  "deployDrawer.selectCredential": "Selecteer een inloggegeven",
+  "deployDrawer.selectEnv": "Selecteer een omgeving",
+  "deployDrawer.selectProviderCred": "Selecteer {{provider}}-inloggegeven",
+  "deployDrawer.selectProviderKey": "Selecteer {{provider}}-sleutel",
+  "deployDrawer.selectRelease": "Selecteer een release",
+  "deployDrawer.targetEnv": "Doelomgeving",
+  "deployDrawer.title": "Implementeren naar omgeving",
+  "deployDrawer.valuePlaceholder": "waarde",
+  "deployTab.cancelDeployment": "Implementatie annuleren",
+  "deployTab.closeError": "Sluiten",
+  "deployTab.col.actions": "Acties",
+  "deployTab.col.currentRelease": "Huidige release",
+  "deployTab.col.environment": "Omgeving",
+  "deployTab.col.status": "Status",
+  "deployTab.col.updated": "Bijgewerkt",
+  "deployTab.collapseDetails": "Implementatiedetails inklappen",
+  "deployTab.confirmUndeploy": "Implementatie ongedaan maken",
+  "deployTab.deployOtherVersion": "Andere release implementeren",
+  "deployTab.deployToEnv": "Implementeren naar {{name}}",
+  "deployTab.deployToNewEnv": "Implementeren naar nieuwe omgeving...",
+  "deployTab.empty": "Nog geen instanties. Implementeer naar een nieuwe omgeving om te beginnen.",
+  "deployTab.emptyDescription": "Kies een release en doelomgeving om deze implementatie beschikbaar te maken voor gebruikers.",
+  "deployTab.emptyTitle": "Er draaien nog geen omgevingen",
+  "deployTab.envCount": "Omgevingen",
+  "deployTab.errorCode": "Code",
+  "deployTab.errorDialogDesc": "Bekijk de laatst mislukte implementatie voordat je opnieuw probeert of een andere release implementeert.",
+  "deployTab.errorDialogTitle": "Implementatiefout in {{name}}",
+  "deployTab.errorMessage": "Bericht",
+  "deployTab.errorPhase": "Fase",
+  "deployTab.expandDetails": "Implementatiedetails uitklappen",
+  "deployTab.moreActions": "Meer acties",
+  "deployTab.newDeployment": "Implementeren naar nieuwe omgeving",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "Implementatie-ID",
+  "deployTab.panel.endpoints": "Endpoints",
+  "deployTab.panel.envVars": "Omgevingsvariabelen",
+  "deployTab.panel.error": "Fout",
+  "deployTab.panel.failedRelease": "Mislukte release",
+  "deployTab.panel.health": "Gezondheid",
+  "deployTab.panel.instanceInfo": "Instantiegegevens",
+  "deployTab.panel.modelCreds": "Model-inloggegevens",
+  "deployTab.panel.pluginCreds": "Plug-in-inloggegevens",
+  "deployTab.panel.release": "Release",
+  "deployTab.panel.releaseCreatedAt": "Release aangemaakt op",
+  "deployTab.panel.releaseInfo": "Release-informatie",
+  "deployTab.panel.replicas": "Replica's",
+  "deployTab.panel.run": "Uitvoeren",
+  "deployTab.panel.runtimeBindings": "Inloggegevens",
+  "deployTab.panel.runtimeInfo": "Runtime-informatie",
+  "deployTab.panel.runtimeMode": "Runtime-modus",
+  "deployTab.panel.runtimeNote": "Runtime-notitie",
+  "deployTab.panel.targetRelease": "Doelrelease",
+  "deployTab.panel.unknownError": "Implementatie mislukt.",
+  "deployTab.promote": "Implementeren",
+  "deployTab.redeploy": "Opnieuw implementeren",
+  "deployTab.releaseCreatedAt": "Release aangemaakt {{time}}",
+  "deployTab.retry": "Opnieuw proberen",
+  "deployTab.shortcut": "Snelkoppeling",
+  "deployTab.status.deployFailed": "Implementatie mislukt",
+  "deployTab.status.deployingRelease": "Implementeren ({{release}})",
+  "deployTab.status.runningOutOfSync": "Actief (synchronisatie in afwachting)",
+  "deployTab.status.runningWithFailed": "Actief (laatste implementatie mislukt)",
+  "deployTab.undeploy": "Implementatie ongedaan maken",
+  "deployTab.undeployConfirmDesc": "Eindgebruikertoegang stopt direct. De release kan later opnieuw worden geïmplementeerd.",
+  "deployTab.undeployConfirmTitle": "Implementatie van {{name}} ongedaan maken?",
+  "deployTab.undeployFrom": "Implementatie van {{name}} ongedaan maken",
+  "deployTab.undeployImpactTitle": "Getroffen instantie",
+  "deployTab.viewError": "Fout bekijken",
+  "deployTab.viewLogs": "Logboeken bekijken",
+  "deployTab.viewProgress": "Voortgang bekijken",
+  "detail.backToInstances": "Terug naar implementaties",
+  "detail.deployingCount": "{{count}} aan het implementeren",
+  "detail.envCount_one": "{{count}} omgeving",
+  "detail.envCount_other": "{{count}} omgevingen",
+  "detail.failedCount": "{{count}} mislukt",
+  "detail.mobileTabs": "Implementatiesecties",
+  "detail.notFound": "Implementatie niet gevonden",
+  "detail.openSourceApp": "Bron {{name}} openen",
+  "detail.sourceApp": "Bron",
+  "detail.sourceAppLink": "Bron",
+  "documentTitle.create": "Nieuwe implementatie · Implementaties",
+  "documentTitle.detail": "Implementatie · Implementaties",
+  "documentTitle.list": "Implementaties",
+  "filter.allEnvs": "Alle omgevingen",
+  "filter.notDeployed": "Niet geïmplementeerd",
+  "filter.searchPlaceholder": "Implementaties zoeken",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Toelating",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Initialiseren",
+  "health.ENVIRONMENT_STATUS_DELETING": "Verwijderen",
+  "health.ENVIRONMENT_STATUS_FAILED": "Niet beschikbaar",
+  "health.ENVIRONMENT_STATUS_READY": "Beschikbaar",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Onbekend",
+  "list.clearFilters": "Filters wissen",
+  "list.clearSearch": "Zoekopdracht implementaties wissen",
+  "list.createDeployment": "Nieuw",
+  "list.empty": "Geen implementaties gevonden.",
+  "list.emptyDescription": "Maak een implementatie aan op basis van een Workflow App of Workflow DSL-pakket om releases, omgevingen en toegang te beheren.",
+  "list.emptyFilteredDescription": "Geen implementatie komt overeen met het huidige zoek- of omgevingsfilter.",
+  "list.emptyFilteredTitle": "Geen overeenkomende implementaties",
+  "list.emptyTitle": "Nog geen implementaties",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Geïsoleerd",
+  "mode.ENVIRONMENT_MODE_SHARED": "Gedeeld",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Onbekend",
+  "newInstance.comingSoon": "Binnenkort beschikbaar",
+  "newInstance.fromStudio": "Selecteren uit Studio",
+  "newInstance.importDSL": "DSL importeren",
+  "newInstance.title": "Nieuwe implementatie",
+  "overview.accessEndpoints": "Toegangs-endpoints",
+  "overview.accessMeta.apiTokens": "API-tokens beheren",
+  "overview.accessMeta.cli": "CLI-toegang bekijken",
+  "overview.accessMeta.webApp": "WebApp-toegang beheren",
+  "overview.accessStatus": "Toegang",
+  "overview.api": "API-tokens",
+  "overview.apiKeysCount_one": "{{count}} API-token",
+  "overview.apiKeysCount_other": "{{count}} API-tokens",
+  "overview.apiTokenSummary.environments_one": "{{count}} geïmplementeerde omgeving",
+  "overview.apiTokenSummary.environments_other": "{{count}} geïmplementeerde omgevingen",
+  "overview.availableForDeployment": "Beschikbaar voor implementatie",
+  "overview.basicInfo": "Basisinformatie",
+  "overview.cardAction.deployLatest": "Nieuwste release implementeren",
+  "overview.cardAction.redeploy": "Opnieuw implementeren",
+  "overview.cardAction.viewProgress": "Implementatie bekijken",
+  "overview.chip.behindTooltip_one": "1 release achter op de nieuwste. Implementeer de nieuwste release om bij te werken.",
+  "overview.chip.behindTooltip_other": "{{count}} releases achter op de nieuwste. Implementeer de nieuwste release om bij te werken.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "aan het implementeren",
+  "overview.chip.deployingTooltip": "Implementatie is bezig.",
+  "overview.chip.empty": "leeg",
+  "overview.chip.emptyTooltip": "Er is geen release geïmplementeerd in deze omgeving.",
+  "overview.chip.failed": "mislukt",
+  "overview.chip.failedTooltip": "De laatste implementatiepoging is mislukt.",
+  "overview.chip.latest": "nieuwste",
+  "overview.chip.latestTooltip": "In deze omgeving draait de nieuwste release.",
+  "overview.chip.needsReleaseFirst": "Maak eerst een release aan",
+  "overview.chip.olderRelease": "ouder",
+  "overview.chip.olderReleaseTooltip": "In deze omgeving draait een oudere release.",
+  "overview.chip.openInDeployTab": "Implementatievoortgang bekijken",
+  "overview.cli": "CLI",
+  "overview.configured": "Geconfigureerd",
+  "overview.createRelease": "Release maken",
+  "overview.created": "Aangemaakt",
+  "overview.deploy": "Implementeren",
+  "overview.deployedEnvironments": "geïmplementeerd",
+  "overview.deploymentOverview": "Implementatieoverzicht",
+  "overview.deploymentStatus": "Implementatiestatus",
+  "overview.description": "Beschrijving",
+  "overview.developerApi": "Developer API",
+  "overview.disabled": "Uitgeschakeld",
+  "overview.emptyValue": "Niet ingesteld",
+  "overview.enabled": "Ingeschakeld",
+  "overview.enabledChannels": "toegang ingeschakeld",
+  "overview.endUserAccess": "Eindgebruikertoegang",
+  "overview.environments": "Omgevingen",
+  "overview.hero.byName": "door {{name}}",
+  "overview.hero.empty": "Nog geen releases",
+  "overview.hero.emptyDescription": "Maak een release aan vanuit de huidige bron voordat je implementeert.",
+  "overview.hero.propagation_one": "geïmplementeerd in {{count}}/{{total}} omgeving",
+  "overview.hero.propagation_other": "geïmplementeerd in {{count}}/{{total}} omgevingen",
+  "overview.hero.untargeted": "nog geen omgevingen geconfigureerd",
+  "overview.instanceDetails": "Implementatiedetails",
+  "overview.instanceId": "Implementatie-ID",
+  "overview.latestRelease.releaseCount_one": "{{count}} release",
+  "overview.latestRelease.releaseCount_other": "{{count}} releases",
+  "overview.latestReleaseTitle": "Nieuwste release",
+  "overview.manageDeployments": "Implementaties beheren",
+  "overview.name": "Naam",
+  "overview.noAccessConfig": "Geen toegangsconfiguratie.",
+  "overview.noReleaseYet": "Maak een release aan voordat je naar een omgeving implementeert.",
+  "overview.notConfigured": "Niet geconfigureerd",
+  "overview.previousReleases.empty": "Nog geen eerdere releases.",
+  "overview.previousReleases.retired": "Momenteel niet geïmplementeerd",
+  "overview.previousReleases.title": "Eerdere releases",
+  "overview.previousReleases.viewAll": "Alles bekijken",
+  "overview.ready": "Implementeerbaar",
+  "overview.recentReleases": "Recente releases",
+  "overview.releaseDeployedTitle": "{{release}} is geïmplementeerd",
+  "overview.releaseReadyTitle": "{{release}} is klaar om te implementeren",
+  "overview.serviceMap": "Servicekaart",
+  "overview.servingRelease": "Bedient {{release}}",
+  "overview.servingReleaseDescription": "Deze implementatie is geïmplementeerd in {{count}}/{{total}} omgevingen.",
+  "overview.strip.deployToNewEnvironment": "Implementeren naar nieuwe omgeving",
+  "overview.strip.empty": "Geen omgevingen geconfigureerd.",
+  "overview.strip.emptyDeployableDescription": "Implementeer de nieuwste release naar een omgeving wanneer je klaar bent.",
+  "overview.strip.emptyDeployed": "Nog geen instanties.",
+  "overview.strip.emptyDescription": "Maak een release aan voordat je naar een omgeving implementeert.",
+  "overview.strip.emptyTitle": "Nog geen instanties",
+  "overview.strip.summary_one": "1 van {{total}} op nieuwste release",
+  "overview.strip.summary_other": "{{count}} van {{total}} op nieuwste release",
+  "overview.strip.title": "Instanties",
+  "overview.switchSourceApp": "Bron wisselen",
+  "overview.switchSourceAppDescription": "Kies de Workflow App die als bron wordt gebruikt voor toekomstige releases.",
+  "overview.switchSourceAppHint": "Na het wisselen gebruiken alleen nieuw aangemaakte releases de nieuwe bron. Historische releases en bestaande implementaties worden niet gewijzigd.",
+  "overview.targetRelease": "Doelrelease",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Gevarenzone",
+  "settings.dangerDesc": "Verwijder deze implementatie permanent en stop alle actieve instanties. Dit kan niet ongedaan worden gemaakt.",
+  "settings.delete": "Implementatie verwijderen",
+  "settings.deleteConfirmDesc": "{{name}} verwijderen? Elke instantie stopt en wordt verwijderd in alle omgevingen. Dit kan niet ongedaan worden gemaakt.",
+  "settings.deleteConfirmTitle": "Implementatie verwijderen",
+  "settings.deleteFailed": "Verwijderen van implementatie mislukt.",
+  "settings.deleteImpact": "Impact",
+  "settings.deleteImpactInstance": "Implementatie",
+  "settings.deleteImpactTitle": "Getroffen implementatie",
+  "settings.deleteImpactValue": "De implementatie wordt verwijderd uit de implementatielijst.",
+  "settings.deleted": "Implementatie verwijderd",
+  "settings.description": "Beschrijving",
+  "settings.descriptionHelp": "Beheer de naam, beschrijving en andere instellingen van deze implementatie.",
+  "settings.general": "Algemeen",
+  "settings.name": "Naam implementatie",
+  "settings.reset": "Resetten",
+  "settings.save": "Wijzigingen opslaan",
+  "settings.updateFailed": "Bijwerken van implementatie mislukt.",
+  "settings.updated": "Implementatie bijgewerkt",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Implementeren",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Synchronisatie in afwachting",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Implementatie mislukt",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Ongeldig",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Actief",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Niet geïmplementeerd",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Implementatie ongedaan maken",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Onbekend",
+  "subtitle": "Beheer implementaties in verschillende omgevingen.",
+  "tabs.access.description": "Beheer toegangskanalen en toegangsrechten.",
+  "tabs.access.name": "Toegang",
+  "tabs.api-tokens.description": "Beheer API-tokens en roep instanties aan via HTTP.",
+  "tabs.api-tokens.name": "API-tokens",
+  "tabs.instances.description": "Bekijk en beheer instanties in geïmplementeerde omgevingen.",
+  "tabs.instances.name": "Instanties",
+  "tabs.overview.description": "Bekijk de status van de implementatie in alle omgevingen.",
+  "tabs.overview.name": "Overzicht",
+  "tabs.releases.description": "Maak, implementeer en beheer releases.",
+  "tabs.releases.name": "Releases",
+  "tabs.settings.description": "Beheer de naam, beschrijving en andere instellingen van deze implementatie.",
+  "tabs.settings.name": "Instellingen",
+  "title": "Implementaties",
+  "unsupportedDslNodes.description": "Deze release bevat nodes die de implementatie-runtime nog niet ondersteunt. Verwijder of vervang ze in Studio en probeer het opnieuw.",
+  "unsupportedDslNodes.descriptionWithTypes": "Deze release bevat nodes die de implementatie-runtime nog niet ondersteunt: {{nodeTypes}}. Verwijder of vervang ze in Studio en probeer het opnieuw.",
+  "unsupportedDslNodes.title": "Niet-ondersteunde nodes",
+  "unsupportedDslNodes.unknownType": "Onbekend type",
+  "versions.cancelCreate": "Annuleren",
+  "versions.cancelDelete": "Annuleren",
+  "versions.cancelEdit": "Annuleren",
+  "versions.checkingReleaseContent": "Release-inhoud controleren...",
+  "versions.col.action": "Actie",
+  "versions.col.author": "Aangemaakt door",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Aangemaakt op",
+  "versions.col.deployedTo": "Geïmplementeerd in",
+  "versions.col.release": "Release",
+  "versions.col.sourceApp": "Bron",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Aanmaken",
+  "versions.createFailed": "Aanmaken van release mislukt.",
+  "versions.createRelease": "Release maken",
+  "versions.createReleaseDescription": "Maak een implementeerbare release aan op basis van een Workflow App of Workflow DSL-bestand.",
+  "versions.createReleaseHint": "Nieuwe releases kunnen naar elke omgeving worden geïmplementeerd.",
+  "versions.createSuccess": "Release \"{{name}}\" aangemaakt.",
+  "versions.creating": "Aanmaken...",
+  "versions.currentOn": "Huidige release op {{name}}",
+  "versions.deleteConfirmDesc": "Release \"{{name}}\" wordt permanent verwijderd. Dit kan niet ongedaan worden gemaakt.",
+  "versions.deleteConfirmTitle": "Release verwijderen?",
+  "versions.deleteFailed": "Verwijderen van release mislukt.",
+  "versions.deleteImpactDeployment": "Implementatiestatus",
+  "versions.deleteImpactNotDeployed": "Momenteel niet geïmplementeerd",
+  "versions.deleteImpactRelease": "Release",
+  "versions.deleteImpactTitle": "Impact van verwijderen",
+  "versions.deleteRelease": "Release verwijderen",
+  "versions.deleteSuccess": "Release \"{{name}}\" verwijderd.",
+  "versions.deploy": "Implementeren",
+  "versions.deployTo": "Implementeren naar {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Implementeren",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Synchronisatie in afwachting",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Mislukt",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Ongeldig",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Actief",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Niet geïmplementeerd",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Implementatie ongedaan maken",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Onbekend",
+  "versions.deployingTo": "{{name}} wordt geïmplementeerd",
+  "versions.disabledReason.checkDeploymentsFailed": "Implementatiegebruik kon niet worden geverifieerd. Probeer het later opnieuw.",
+  "versions.disabledReason.checkingDeployments": "Implementatiegebruik controleren",
+  "versions.disabledReason.current": "Deze release draait al op {{name}}",
+  "versions.disabledReason.deploying": "Wacht tot de actieve implementatie is afgerond",
+  "versions.disabledReason.envDisabled": "Deze omgeving is niet implementeerbaar",
+  "versions.disabledReason.releaseInUse_one": "Maak de implementatie van deze release in {{count}} omgeving ongedaan voordat je hem verwijdert",
+  "versions.disabledReason.releaseInUse_other": "Maak de implementatie van deze release in {{count}} omgevingen ongedaan voordat je hem verwijdert",
+  "versions.dslReadFailed": "Het DSL-bestand kon niet worden gelezen. Kies een ander bestand en probeer het opnieuw.",
+  "versions.dslReading": "DSL-bestand wordt gelezen...",
+  "versions.dslUnsupportedMode": "Alleen Workflow DSL-bestanden kunnen worden gebruikt voor implementaties.",
+  "versions.editFailed": "Bijwerken van release mislukt.",
+  "versions.editRelease": "Release bewerken",
+  "versions.editReleaseDescription": "Werk de naam en beschrijving van deze release bij.",
+  "versions.editSuccess": "Release \"{{name}}\" bijgewerkt.",
+  "versions.empty": "Nog geen releases beschikbaar.",
+  "versions.emptyDescription": "Maak de eerste release aan voordat je naar een omgeving implementeert.",
+  "versions.emptyTitle": "Nog geen releases",
+  "versions.emptyWithCreate": "Nog geen releases. Maak de eerste implementeerbare release aan voordat je implementeert.",
+  "versions.exportDsl": "DSL exporteren",
+  "versions.exportDslFailed": "Exporteren van DSL mislukt.",
+  "versions.exportingDsl": "Exporteren...",
+  "versions.groupHeader.deploy": "Implementeren",
+  "versions.groupHeader.promote": "Implementeren",
+  "versions.groupHeader.rollback": "Vorige versie implementeren",
+  "versions.groupHeader.unavailable": "Niet beschikbaar",
+  "versions.manualDslOption": "DSL uploaden",
+  "versions.moreActions": "Meer acties",
+  "versions.optional": "Optioneel",
+  "versions.promote": "Implementeren",
+  "versions.promoteTo": "Implementeren naar {{name}}",
+  "versions.releaseAlreadyExists": "Er bestaat al een release met dezelfde inhoud: {{name}}.",
+  "versions.releaseContentCheckFailed": "Controleren van release-inhoud mislukt.",
+  "versions.releaseDescriptionLabel": "Beschrijving",
+  "versions.releaseDescriptionPlaceholder": "Beschrijf deze release",
+  "versions.releaseHistory": "Releasegeschiedenis",
+  "versions.releaseNameLabel": "Releasenaam",
+  "versions.releaseNamePlaceholder": "Releasenaam",
+  "versions.releaseNameRequired": "Voer een releasenaam in.",
+  "versions.releaseSourceLabel": "Releasebron",
+  "versions.rollbackTo": "Implementeren naar {{name}}",
+  "versions.saveEdit": "Opslaan",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/nl-NL/workflow.json b/web/i18n/nl-NL/workflow.json
index 08b8e69c463..5e747ccf943 100644
--- a/web/i18n/nl-NL/workflow.json
+++ b/web/i18n/nl-NL/workflow.json
@@ -1,5 +1,6 @@
 {
   "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Answer",
   "blocks.assigner": "Variable Assigner",
   "blocks.code": "Code",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Variable Aggregator",
   "blocks.variable-assigner": "Variable Aggregator",
   "blocksAbout.agent": "Invoking large language models to answer questions or process natural language",
+  "blocksAbout.agent-v2": "Invoking large language models to answer questions or process natural language",
   "blocksAbout.answer": "Define the reply content of a chat conversation",
   "blocksAbout.assigner": "The variable assignment node is used for assigning values to writable variables(like conversation variables).",
   "blocksAbout.code": "Execute a piece of Python or NodeJS code to implement custom logic",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "Workflow ID",
   "globalVar.fieldsDescription.workflowRunId": "Workflow run ID",
   "globalVar.title": "System Variables",
+  "nodes.agent.advancedSetting": "Geavanceerde instellingen",
   "nodes.agent.checkList.strategyNotSelected": "Strategy not selected",
   "nodes.agent.clickToViewParameterSchema": "Click to view parameter schema",
   "nodes.agent.configureModel": "Configure Model",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Unsupported Model",
   "nodes.agent.modelSelectorTooltips.deprecated": "This model is deprecated",
   "nodes.agent.notAuthorized": "Not Authorized",
+  "nodes.agent.outputVars.confirm": "Bevestigen",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Voer een JSON-array in.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Voer true of false in.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Standaardwaarden voor bestanden zijn hier nog niet configureerbaar.",
+  "nodes.agent.outputVars.defaultValueLabel": "Standaard",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Voer een geldig getal in.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Voer een JSON-object in.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Standaardwaarde",
+  "nodes.agent.outputVars.delete": "{{name}} verwijderen",
+  "nodes.agent.outputVars.descriptionLabel": "Beschrijving",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Beschrijving toevoegen",
+  "nodes.agent.outputVars.edit": "{{name}} bewerken",
+  "nodes.agent.outputVars.editorLabel": "Editor voor uitvoervariabelen",
   "nodes.agent.outputVars.files.title": "agent generated files",
   "nodes.agent.outputVars.files.transfer_method": "Transfer method.Value is  remote_url or local_file",
   "nodes.agent.outputVars.files.type": "Support type. Now only support image",
   "nodes.agent.outputVars.files.upload_file_id": "Upload file id",
   "nodes.agent.outputVars.files.url": "Image url",
   "nodes.agent.outputVars.json": "agent generated json",
+  "nodes.agent.outputVars.nameDuplicate": "Uitvoernaam bestaat al",
+  "nodes.agent.outputVars.nameInvalid": "Gebruik letters, cijfers en underscores. Begin met een letter of underscore.",
+  "nodes.agent.outputVars.nameLabel": "Veldnaam",
+  "nodes.agent.outputVars.namePlaceholder": "Veldnaam",
+  "nodes.agent.outputVars.newOutput": "Nieuwe uitvoer",
+  "nodes.agent.outputVars.requiredLabel": "Verplicht",
+  "nodes.agent.outputVars.showAdvancedOptions": "Geavanceerde opties tonen",
   "nodes.agent.outputVars.text": "agent generated content",
+  "nodes.agent.outputVars.typeLabel": "Uitvoertype",
   "nodes.agent.outputVars.usage": "Model Usage Information",
   "nodes.agent.parameterSchema": "Parameter Schema",
   "nodes.agent.pluginInstaller.install": "Install",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "This integratie is installed from GitHub. Please go to Integraties to reinstall",
   "nodes.agent.pluginNotInstalled": "This integratie is not installed",
   "nodes.agent.pluginNotInstalledDesc": "This integratie is installed from GitHub. Please go to Integraties to reinstall",
+  "nodes.agent.roster.change": "Wijzigen",
+  "nodes.agent.roster.editInConsole": "Bewerken in Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Een eenmalige setup die alleen in dit knooppunt bestaat",
+  "nodes.agent.roster.inlineSetup.name": "Inline-setup",
+  "nodes.agent.roster.inlineSetup.title": "Agent-setup",
+  "nodes.agent.roster.inlineSetup.type": "Alleen in dit knooppunt",
+  "nodes.agent.roster.label": "Agent",
+  "nodes.agent.roster.makeCopy": "Kopie maken",
+  "nodes.agent.roster.more": "Meer agentacties",
+  "nodes.agent.roster.openPanel": "Details van {{name}} openen",
+  "nodes.agent.roster.panelLabel": "Details van {{name}}",
   "nodes.agent.strategy.configureTip": "Please configure agentic strategy.",
   "nodes.agent.strategy.configureTipDesc": "After configuring the agentic strategy, this node will automatically load the remaining configurations. The strategy will affect the mechanism of multi-step tool reasoning. ",
   "nodes.agent.strategy.label": "Agentic Strategy",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "The installed integratie version does not provide this strategy. Click to switch version.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} is not installed",
   "nodes.agent.strategyNotSet": "Agentic strategy Not Set",
+  "nodes.agent.task.insert": "Invoegen",
+  "nodes.agent.task.label": "Agenttaak",
+  "nodes.agent.task.mention": "Vermelden",
+  "nodes.agent.task.placeholder": "Beschrijf wat deze agent moet doen...",
+  "nodes.agent.task.tooltip": "Bepaal de taakinstructies die deze agent in deze workflow moet volgen.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Not Authorized",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} is not installed",
   "nodes.agent.toolbox": "toolbox",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "By {{author}}",
   "tabs.question-understand": "Question Understand",
   "tabs.requestToCommunity": "Requests to the community",
-  "tabs.searchBlock": "Search node",
+  "tabs.searchBlock": "Knooppunten, agent, mens, kennis zoeken",
   "tabs.searchDataSource": "Search Data Source",
   "tabs.searchSnippets": "Fragmenten zoeken...",
   "tabs.searchTool": "Search tool",
diff --git a/web/i18n/pl-PL/agent-v-2.json b/web/i18n/pl-PL/agent-v-2.json
new file mode 100644
index 00000000000..077cb79e70c
--- /dev/null
+++ b/web/i18n/pl-PL/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Ta akcja nie jest jeszcze dostępna.",
+  "agentDetail.access.actions.monitoring": "Monitorowanie",
+  "agentDetail.access.copyAccessUrl": "Skopiuj URL dostępu",
+  "agentDetail.access.copyFailed": "Nie udało się skopiować odnośnika.",
+  "agentDetail.access.copyReference": "Skopiuj odnośnik do {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Skopiuj punkt końcowy API usługi",
+  "agentDetail.access.description": "Wszystkie powierzchnie, z których można dotrzeć do tego agenta.",
+  "agentDetail.access.empty": "Brak powiązanych punktów dostępu",
+  "agentDetail.access.emptyDescription": "Ten agent z Roster nie ma jeszcze powiązanych aplikacji ani odniesień do workflow.",
+  "agentDetail.access.entries.agentApp.description": "Aplikacja agenta powiązana z tym agentem z Roster.",
+  "agentDetail.access.entries.agentApp.name": "Aplikacja agenta",
+  "agentDetail.access.entries.workflow.description": "Workflow i odniesienie do węzła powiązane z tym agentem z Roster.",
+  "agentDetail.access.entries.workflow.name": "Węzeł workflow",
+  "agentDetail.access.entryCount_one": "{{count}} wpis",
+  "agentDetail.access.entryCount_other": "{{count}} wpisów",
+  "agentDetail.access.groups.references.heading": "Odniesienia",
+  "agentDetail.access.groups.references.label": "Powiązane odniesienia",
+  "agentDetail.access.learnMore": "Dowiedz się więcej",
+  "agentDetail.access.moreActions": "Więcej akcji dla {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Punkt końcowy API usługi",
+  "agentDetail.access.serviceApi.title": "Backendowe API usługi",
+  "agentDetail.access.status.disabled": "Wyłączone",
+  "agentDetail.access.status.enabled": "Włączone",
+  "agentDetail.access.status.inService": "W użyciu",
+  "agentDetail.access.status.outOfService": "Poza użyciem",
+  "agentDetail.access.title": "Punkt dostępu",
+  "agentDetail.access.toggleSurface": "Przełącz dostęp {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL dostępu",
+  "agentDetail.access.webApp.actions.customize": "Dostosuj",
+  "agentDetail.access.webApp.actions.embedded": "Osadzony",
+  "agentDetail.access.webApp.actions.launch": "Uruchom",
+  "agentDetail.access.webApp.actions.settings": "Ustawienia",
+  "agentDetail.access.webApp.refreshUrl": "Odśwież URL dostępu",
+  "agentDetail.access.webApp.showQrCode": "Pokaż kod QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO włączone",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Używany jako węzeł wewnątrz workflow",
+  "agentDetail.access.workflow.empty": "Brak jeszcze odniesień do workflow.",
+  "agentDetail.access.workflow.loadFailed": "Nie udało się załadować odniesień do workflow.",
+  "agentDetail.access.workflow.loading": "Ładowanie odniesień do workflow…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} węzeł",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} węzłów",
+  "agentDetail.access.workflow.notAvailable": "Nd.",
+  "agentDetail.access.workflow.openInStudio": "Otwórz w Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Otwórz {{name}} w Studio",
+  "agentDetail.access.workflow.table.actions": "Akcje",
+  "agentDetail.access.workflow.table.lastUpdated": "Ostatnia aktualizacja",
+  "agentDetail.access.workflow.table.name": "Nazwa",
+  "agentDetail.access.workflow.table.nodes": "Węzły",
+  "agentDetail.access.workflow.table.version": "Wersja",
+  "agentDetail.access.workflow.title": "Dostęp do workflow",
+  "agentDetail.configure.advancedSettings.description": "Dla zaawansowanych użytkowników. Zmienne środowiskowe, sandbox i pamięć.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Dodaj zmienną środowiskową",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Usuń {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Ukryj wartość {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Importuj .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Aby pokazać ukryte pliki .env, w oknie wyboru pliku naciśnij Command + Shift + .",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Jeśli plik .env jest ukryty, włącz wyświetlanie ukrytych plików w systemowym oknie wyboru plików.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Aby pokazać ukryte pliki .env, włącz opcję „Ukryte elementy” w Eksploratorze plików.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Pokaż wartość {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Wybierz zakres zmiennej środowiskowej",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Zmienne środowiskowe dostępne dla tego agenta w czasie wykonywania.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Przełącz Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Ustawienia zaawansowane",
+  "agentDetail.configure.advancedSettings.toggle": "Przełącz ustawienia zaawansowane",
+  "agentDetail.configure.chatFeatures.description": "Ukształtuj doświadczenie czatu użytkownika końcowego w aplikacji webowej i powierzchniach czatu.",
+  "agentDetail.configure.chatFeatures.title": "Funkcje czatu",
+  "agentDetail.configure.files.add": "Dodaj plik",
+  "agentDetail.configure.files.empty.description": "Prześlij dokumenty, które agent może czytać, np. specyfikacje, szablony lub wytyczne",
+  "agentDetail.configure.files.empty.title": "Brak plików",
+  "agentDetail.configure.files.label": "Pliki",
+  "agentDetail.configure.files.preview.empty": "Brak treści podglądu.",
+  "agentDetail.configure.files.preview.failed": "Nie udało się załadować podglądu.",
+  "agentDetail.configure.files.preview.unsupported": "Ten plik nie obsługuje podglądu.",
+  "agentDetail.configure.files.remove": "Usuń {{name}}",
+  "agentDetail.configure.files.tip": "Pliki, których ten agent może używać podczas wykonywania zadań.",
+  "agentDetail.configure.files.toggle": "Przełącz pliki",
+  "agentDetail.configure.files.treeLabel": "Pliki agenta",
+  "agentDetail.configure.files.upload.action": "Prześlij",
+  "agentDetail.configure.files.upload.browse": "przeglądaj",
+  "agentDetail.configure.files.upload.description": "Prześlij plik dla tego agenta.",
+  "agentDetail.configure.files.upload.dropzone": "Upuść plik tutaj lub",
+  "agentDetail.configure.files.upload.failed": "Nie udało się przesłać pliku.",
+  "agentDetail.configure.files.upload.fileType": "PLIK",
+  "agentDetail.configure.files.upload.invalidFile": "Prześlij jeden plik.",
+  "agentDetail.configure.files.upload.success": "Plik przesłany.",
+  "agentDetail.configure.files.upload.title": "Prześlij plik",
+  "agentDetail.configure.knowledgeRetrieval.add": "Dodaj wyszukiwanie wiedzy",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Dodaj wiedzę",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Kliknij przycisk „+”, aby dodać wiedzę",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Wiedza",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Ustawienia wyszukiwania",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Dowiedz się więcej o wyszukiwaniu wiedzy",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automatycznie",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Warunki",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Wyłączone",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Filtrowanie metadanych",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Ręcznie",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Wybierz tryb filtrowania metadanych",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Nazwa wyszukiwania wiedzy",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Decyduje agent",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Agent sam tworzy zapytanie na podstawie promptu i dostępnego kontekstu. Tutaj nic nie trzeba konfigurować.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Niestandardowe zapytanie",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Napisz stałe zapytanie dla tego źródła wyszukiwania.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Tekst niestandardowego zapytania",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Wpisz zapytanie wyszukiwania",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Zapytanie",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Wyszukiwanie wiedzy · Decyduje agent",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Edytuj {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Podłącz bazę wiedzy, którą agent może przeszukiwać podczas odpowiadania",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Brak wiedzy",
+  "agentDetail.configure.knowledgeRetrieval.label": "Wyszukiwanie wiedzy",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Usuń {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Źródła wyszukiwania wiedzy, których ten agent może używać podczas wykonywania zadań.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Przełącz wyszukiwanie wiedzy",
+  "agentDetail.configure.model.label": "Model",
+  "agentDetail.configure.orchestrate": "Orkiestracja",
+  "agentDetail.configure.preview.chatFeatures": "Funkcje czatu",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agent",
+  "agentDetail.configure.preview.empty.description": "Wyślij wiadomość, aby przetestować bieżącą wersję roboczą.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Brak instrukcji, więc odpowiedzi pochodzą z podstawowego modelu.",
+  "agentDetail.configure.preview.endUserAuth": "Uwierzytelnianie użytkownika końcowego",
+  "agentDetail.configure.preview.restart": "Uruchom podgląd ponownie",
+  "agentDetail.configure.preview.title": "Podgląd",
+  "agentDetail.configure.prompt.copied": "Prompt skopiowany",
+  "agentDetail.configure.prompt.copy": "Kopiuj prompt",
+  "agentDetail.configure.prompt.copyFailed": "Nie udało się skopiować promptu.",
+  "agentDetail.configure.prompt.insert.label": "Wstaw",
+  "agentDetail.configure.prompt.insert.question": "Pytanie początkowe",
+  "agentDetail.configure.prompt.insert.reportFile": "Wyjściowy plik raportu",
+  "agentDetail.configure.prompt.insert.tenders": "Rozpocznij przetargi",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Wzmianka",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Napisz tutaj instrukcje,",
+  "agentDetail.configure.prompt.tip": "Określ, jak ten agent ma interpretować dane wejściowe, wywoływać narzędzia i tworzyć dane wyjściowe.",
+  "agentDetail.configure.publishBar.draft": "Wersja robocza",
+  "agentDetail.configure.publishBar.publishUpdate": "Opublikuj aktualizację",
+  "agentDetail.configure.publishBar.published": "Opublikowane",
+  "agentDetail.configure.publishBar.publishedAt": "Opublikowano {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Publikowanie…",
+  "agentDetail.configure.publishBar.saved": "Zapisano 5 min temu",
+  "agentDetail.configure.publishBar.savedAt": "Zapisano {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Nieopublikowane zmiany",
+  "agentDetail.configure.publishBar.upToDate": "Aktualne",
+  "agentDetail.configure.publishBar.versionHistory": "Otwórz historię wersji",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Workflow, których to dotyczy",
+  "agentDetail.configure.publishImpact.cancel": "Anuluj",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Twój agent pojawia się w",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Zmiany na nie wpłyną.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "tego agenta",
+  "agentDetail.configure.publishImpact.title": "{{action}} do {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} workflow",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} workflow",
+  "agentDetail.configure.skills.add": "Dodaj umiejętność",
+  "agentDetail.configure.skills.detail.contentRegion": "Zawartość szczegółów umiejętności",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} PLIKÓW",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Pliki umiejętności",
+  "agentDetail.configure.skills.detail.files": "Pliki",
+  "agentDetail.configure.skills.empty.description": "Umiejętności dają agentowi reużywalną wiedzę, którą może wywołać podczas pracy",
+  "agentDetail.configure.skills.empty.title": "Brak umiejętności",
+  "agentDetail.configure.skills.itemType": "Umiejętność",
+  "agentDetail.configure.skills.label": "Umiejętności",
+  "agentDetail.configure.skills.remove": "Usuń {{name}}",
+  "agentDetail.configure.skills.tip": "Umiejętności, których ten agent może używać podczas wykonywania zadań.",
+  "agentDetail.configure.skills.toggle": "Przełącz umiejętności",
+  "agentDetail.configure.skills.upload.action": "Prześlij",
+  "agentDetail.configure.skills.upload.browse": "przeglądaj",
+  "agentDetail.configure.skills.upload.description": "Prześlij pakiet .zip lub .skill dla tego agenta.",
+  "agentDetail.configure.skills.upload.dropzone": "Upuść pakiet umiejętności tutaj lub",
+  "agentDetail.configure.skills.upload.failed": "Nie udało się przesłać umiejętności.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Prześlij plik .zip lub .skill.",
+  "agentDetail.configure.skills.upload.success": "Umiejętność przesłana.",
+  "agentDetail.configure.skills.upload.title": "Prześlij umiejętność",
+  "agentDetail.configure.tools.add": "Dodaj narzędzie",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Dla deweloperów",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Zainstaluj program wiersza poleceń, który agent uruchamia w sandboxie. Wymaga instalacji i zwykle API Key.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Narzędzie CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Wybierz narzędzie już dostępne w tym workspace, np. wyszukiwanie WWW lub integracje.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Narzędzie",
+  "agentDetail.configure.tools.cliDialog.description": "Zainstaluj narzędzie CLI z dowolnego rejestru pakietów. Agent uzyskuje dostęp powłoki do dostarczonego pliku binarnego.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Edytuj narzędzie CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Przechowuj klucze API, tokeny lub sekrety, których potrzebuje to narzędzie CLI. Wartości są szyfrowane w spoczynku i wstrzykiwane jako zmienne środowiskowe, gdy agent wywołuje narzędzie.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Zmienne środowiskowe",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(opcjonalnie)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "W sandboxie · uruchamia się raz przy pierwszym wywołaniu",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Polecenie instalacji",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Wklej tutaj polecenie instalacji, np. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Polecenie instalacji jest wymagane.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Dowiedz się więcej o narzędziu CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Nazwa narzędzia CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Nazwij swoje narzędzie CLI",
+  "agentDetail.configure.tools.cliDialog.name.required": "Nazwa narzędzia CLI jest wymagana.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Nigdy nie widoczne w prompcie agenta; wstrzykiwane tylko jako $VAR w czasie wykonywania",
+  "agentDetail.configure.tools.cliDialog.title": "Dodaj narzędzie CLI",
+  "agentDetail.configure.tools.cliTool": "Narzędzie CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Użytkownik końcowy · OAuth",
+  "agentDetail.configure.tools.editAction": "Edytuj {{name}}",
+  "agentDetail.configure.tools.empty.description": "Narzędzia pozwalają agentowi działać — np. przeszukiwać sieć lub wywoływać Twoje aplikacje",
+  "agentDetail.configure.tools.empty.title": "Brak narzędzi",
+  "agentDetail.configure.tools.label": "Narzędzia",
+  "agentDetail.configure.tools.moreActions": "Więcej akcji dla {{name}}",
+  "agentDetail.configure.tools.pluginType": "Integracja",
+  "agentDetail.configure.tools.preAuthorize": "Wstępna autoryzacja",
+  "agentDetail.configure.tools.removeAction": "Usuń {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Usuń wszystkie narzędzia",
+  "agentDetail.configure.tools.tip": "Narzędzia, które ten agent może wywoływać podczas wykonywania zadań.",
+  "agentDetail.configure.tools.toggle": "Przełącz narzędzia",
+  "agentDetail.configure.tools.toolTabs.all": "Wszystkie",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Niestandardowe",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Integracje",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agent",
+  "agentDetail.history": "Historia",
+  "agentDetail.logs.description": "Pełne logi rejestrują stan działania aplikacji, w tym dane wejściowe użytkownika, odpowiedzi agenta, planowanie i użycie narzędzi.",
+  "agentDetail.logs.empty": "Nie znaleziono logów",
+  "agentDetail.logs.filters.period.allTime": "Cały czas",
+  "agentDetail.logs.filters.period.label": "Okres logów",
+  "agentDetail.logs.filters.period.last30days": "Ostatnie 30 dni",
+  "agentDetail.logs.filters.period.last7days": "Ostatnie 7 dni",
+  "agentDetail.logs.filters.search.label": "Szukaj w logach",
+  "agentDetail.logs.filters.search.placeholder": "Szukaj",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Ostatnio utworzone",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Ostatnio zaktualizowane",
+  "agentDetail.logs.filters.source.all": "Źródło",
+  "agentDetail.logs.filters.source.empty": "Nie znaleziono źródeł",
+  "agentDetail.logs.filters.source.label": "Źródło logu",
+  "agentDetail.logs.filters.source.loadFailed": "Nie udało się wczytać źródeł",
+  "agentDetail.logs.filters.source.loading": "Wczytywanie źródeł…",
+  "agentDetail.logs.filters.source.searchLabel": "Szukaj źródeł",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Szukaj",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Workflow",
+  "agentDetail.logs.learnMore": "Dowiedz się więcej",
+  "agentDetail.logs.loadFailed": "Nie udało się wczytać logów",
+  "agentDetail.logs.loading": "Wczytywanie logów…",
+  "agentDetail.logs.notAvailable": "Brak danych",
+  "agentDetail.logs.table.createdTime": "Czas utworzenia",
+  "agentDetail.logs.table.endUser": "Użytkownik końcowy",
+  "agentDetail.logs.table.messageCount": "Liczba wiad.",
+  "agentDetail.logs.table.operationRate": "Współczynnik operacji",
+  "agentDetail.logs.table.source": "Źródło",
+  "agentDetail.logs.table.title": "Tytuł",
+  "agentDetail.logs.table.unread": "Nieprzeczytane",
+  "agentDetail.logs.table.updatedTime": "Czas aktualizacji",
+  "agentDetail.logs.table.userRate": "Ocena użytkownika",
+  "agentDetail.logs.title": "Logi",
+  "agentDetail.memorySettings.budgetLabel": "Budżet pamięci",
+  "agentDetail.memorySettings.description": "Ustawienia pamięci z aktywnej migawki konfiguracji.",
+  "agentDetail.memorySettings.export.description": "Eksport pamięci zaplanowano na późniejsze wydanie.",
+  "agentDetail.memorySettings.export.download": "Pobierz",
+  "agentDetail.memorySettings.export.soon": "Wkrótce",
+  "agentDetail.memorySettings.export.title": "Eksportuj bieżącą pamięć",
+  "agentDetail.memorySettings.notConfigured": "Nieskonfigurowane",
+  "agentDetail.memorySettings.scopeLabel": "Zakres pamięci",
+  "agentDetail.memorySettings.title": "Pamięć",
+  "agentDetail.metadata.activeVersionLabel": "Aktywna wersja",
+  "agentDetail.metadata.appIdLabel": "ID aplikacji",
+  "agentDetail.metadata.description": "Pola Roster tylko do odczytu zwracane przez backend agenta.",
+  "agentDetail.metadata.emptyValue": "Niedostępne",
+  "agentDetail.metadata.scopeLabel": "Zakres",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Tylko workflow",
+  "agentDetail.metadata.sourceLabel": "Źródło",
+  "agentDetail.metadata.statusLabel": "Status",
+  "agentDetail.metadata.title": "Metadane",
+  "agentDetail.metadata.updatedAtLabel": "Zaktualizowano",
+  "agentDetail.metadata.workflowIdLabel": "ID workflow",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID węzła workflow",
+  "agentDetail.monitoring.change": "{{value}} w porównaniu z poprzednim okresem",
+  "agentDetail.monitoring.dateRangeLabel": "Zakres dat",
+  "agentDetail.monitoring.description": "Śledź aktywność, koszt i jakość interakcji reużywalnego agenta w workflow.",
+  "agentDetail.monitoring.learnMore": "Dowiedz się więcej",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Unikalni użytkownicy końcowi, którzy uruchomili workflow z tym agentem.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Aktywni użytkownicy",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Liczba ciągłych interakcji użytkownik-agent dla tego punktu dostępu.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Śr. interakcje na sesję",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Średnia prędkość wyjścia od początku żądania do jego zakończenia.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Prędkość wyjścia tokenów",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Szacunkowy koszt tokenów wygenerowanych przez tego agenta w uruchomieniach workflow.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Użycie tokenów",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Dzienne rozmowy AI, które dotarły do tego agenta przez wybrany punkt dostępu.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Liczba rozmów",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Dzienna liczba interakcji z agentem.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Liczba wiadomości",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Liczba polubień na 1000 wiadomości dla tego agenta.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Wskaźnik zadowolenia użytkowników",
+  "agentDetail.monitoring.pickSource": "Wybierz aplikację",
+  "agentDetail.monitoring.sourceLabel": "Aplikacja",
+  "agentDetail.monitoring.sourceTrigger": "Źródło {{name}}",
+  "agentDetail.monitoring.sources.all": "Wszystkie",
+  "agentDetail.monitoring.timeRangeLabel": "Zakres czasu",
+  "agentDetail.monitoring.timeRanges.custom": "Niestandardowy",
+  "agentDetail.monitoring.timeRanges.last30days": "Ostatnie 30 dni",
+  "agentDetail.monitoring.timeRanges.last7days": "Ostatnie 7 dni",
+  "agentDetail.monitoring.timeRanges.today": "Dziś",
+  "agentDetail.monitoring.title": "Monitorowanie",
+  "agentDetail.monitoring.tokenUsageConsumed": "Zużyte tokeny",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Nawigacja agenta",
+  "agentDetail.publish": "Opublikuj",
+  "agentDetail.publishSoon": "Wkrótce",
+  "agentDetail.sections.access": "Punkt dostępu",
+  "agentDetail.sections.configure": "Orkiestracja",
+  "agentDetail.sections.logs": "Logi",
+  "agentDetail.sections.monitoring": "Monitorowanie",
+  "agentDetail.subtitle": "ID agenta: {{agentId}}",
+  "agentDetail.title": "Agent",
+  "agentDetail.type": "AGENT",
+  "agentDetail.versionHistory.active": "Aktywna",
+  "agentDetail.versionHistory.empty": "Brak wersji",
+  "agentDetail.versionHistory.filter": "Filtruj wersje",
+  "agentDetail.versionHistory.versionName": "Wersja {{version}}",
+  "roster.createAgent": "Utwórz agenta",
+  "roster.createAgentOptions": "Opcje tworzenia agenta",
+  "roster.createDialog.description": "Utwórz reużywalnego agenta w Roster tego workspace.",
+  "roster.createDialog.title": "Utwórz agenta",
+  "roster.createForm.changeIcon": "Zmień ikonę agenta",
+  "roster.createForm.descriptionLabel": "Opis",
+  "roster.createForm.descriptionOptional": "(opcjonalnie)",
+  "roster.createForm.descriptionPlaceholder": "np. Zbiera źródła na dany temat i podsumowuje kluczowe ustalenia",
+  "roster.createForm.nameLabel": "Nazwa",
+  "roster.createForm.namePlaceholder": "np. Max",
+  "roster.createForm.nameRequired": "Nazwa jest wymagana.",
+  "roster.createForm.roleLabel": "Rola",
+  "roster.createForm.rolePlaceholder": "np. Asystent badawczy",
+  "roster.createForm.roleRequired": "Rola jest wymagana.",
+  "roster.createSuccess": "Agent utworzony.",
+  "roster.dateTimeFormat": "DD.MM.YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Ten agent zostanie usunięty z aktywnej listy Roster.",
+  "roster.deleteDialog.title": "Usunąć {{name}}?",
+  "roster.deleteFailed": "Nie udało się usunąć agenta.",
+  "roster.deleteSuccess": "Agent usunięty.",
+  "roster.duplicateFailed": "Nie udało się zduplikować agenta.",
+  "roster.duplicateSuccess": "Agent zduplikowany.",
+  "roster.editAgent": "Edytuj {{name}}",
+  "roster.editDialog.description": "Zaktualizuj nazwę w Roster, opis i rolę tego agenta.",
+  "roster.editDialog.title": "Edytuj agenta",
+  "roster.editInfo": "Edytuj informacje",
+  "roster.empty": "Brak agentów",
+  "roster.emptyDescription": "Agenci zapisani w tym workspace pojawią się tutaj.",
+  "roster.emptySearch": "Brak pasujących agentów",
+  "roster.emptySearchDescription": "Spróbuj innej nazwy agenta.",
+  "roster.filters.all": "Wszyscy",
+  "roster.filters.drafts": "Wersje robocze",
+  "roster.filters.label": "Filtry agentów",
+  "roster.filters.published": "Opublikowani",
+  "roster.learnMore": "Dowiedz się więcej o Agent Roster",
+  "roster.listLabel": "Lista Roster agentów",
+  "roster.loadMore": "Załaduj więcej",
+  "roster.loadingError": "Nie udało się załadować agentów. Odśwież i spróbuj ponownie.",
+  "roster.moreActions": "Więcej akcji dla {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Nie udało się utworzyć inline agenta. Odśwież i spróbuj ponownie.",
+  "roster.nodeSelector.dialogLabel": "Wybierz agenta",
+  "roster.nodeSelector.manageInAgentConsole": "Zarządzaj w Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Szukaj…",
+  "roster.nodeSelector.startFromScratch": "Zacznij od zera",
+  "roster.references.label": "Workflow używające {{name}}",
+  "roster.references.trigger": "Workflow używające {{name}}",
+  "roster.searchLabel": "Szukaj agentów",
+  "roster.searchPlaceholder": "Wyszukaj agentów po nazwie…",
+  "roster.sources.agent_app": "Aplikacja agenta",
+  "roster.sources.imported": "Zaimportowane",
+  "roster.sources.system": "Systemowe",
+  "roster.sources.workflow": "Workflow",
+  "roster.status.active": "Aktywny",
+  "roster.status.archived": "Zarchiwizowany",
+  "roster.tabs.agent": "Agent",
+  "roster.tabs.human": "Człowiek",
+  "roster.tabsLabel": "Typ Roster",
+  "roster.updateSuccess": "Agent zaktualizowany.",
+  "roster.usageStatus.draft": "Wersja robocza"
+}
diff --git a/web/i18n/pl-PL/app-log.json b/web/i18n/pl-PL/app-log.json
index d78e58deeb4..6578b0754a3 100644
--- a/web/i18n/pl-PL/app-log.json
+++ b/web/i18n/pl-PL/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Dzisiaj",
   "filter.period.yearToDate": "Od początku roku",
   "filter.sortBy": "Sortuj według:",
+  "monitoring.description": "Monitoring rejestruje stan działania aplikacji, w tym wydajność, aktywność użytkowników i koszty.",
   "promptLog": "Dziennik monitów",
   "runDetail.fileListDetail": "Detal",
   "runDetail.fileListLabel": "Szczegóły pliku",
diff --git a/web/i18n/pl-PL/app.json b/web/i18n/pl-PL/app.json
index 26b910983d4..58156671cf7 100644
--- a/web/i18n/pl-PL/app.json
+++ b/web/i18n/pl-PL/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "Strukturalne wyniki to funkcja, która zapewnia, że model zawsze generuje odpowiedzi zgodne z dostarczonym schematem JSON.",
   "studio.allApps": "Wszystkie aplikacje",
   "studio.apps": "Aplikacje",
-  "studio.filters.allCreators": "Wszyscy twórcy",
-  "studio.filters.creators": "Twórcy",
+  "studio.filters.allCreators": "Wszyscy autorzy",
+  "studio.filters.creators": "Autorzy",
   "studio.filters.reset": "Zresetuj",
   "studio.filters.searchCreators": "Szukaj twórcy...",
   "studio.filters.types": "Typy",
diff --git a/web/i18n/pl-PL/billing.json b/web/i18n/pl-PL/billing.json
index 521f8685610..a90381921e2 100644
--- a/web/i18n/pl-PL/billing.json
+++ b/web/i18n/pl-PL/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Uaktualnij, aby odblokować przesyłanie dokumentów wsadowych",
   "upgrade.uploadMultiplePages.description": "Osiągnąłeś limit przesyłania — w ramach obecnego planu można wybrać i przesłać tylko jeden dokument naraz.",
   "upgrade.uploadMultiplePages.title": "Przejdź na wyższą wersję, aby przesyłać wiele dokumentów jednocześnie",
+  "upgrade.workflowRestore.description": "Przywracanie wersji przepływu pracy nie jest dostępne w obecnym planie.",
+  "upgrade.workflowRestore.title": "Ulepsz plan, aby przywracać wersje przepływu pracy",
   "upgradeBtn.encourage": "Ulepsz teraz",
   "upgradeBtn.encourageShort": "Ulepsz",
   "upgradeBtn.plain": "Ulepsz plan",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index 867df60c9a1..cd22faf232c 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Przełącz obszar roboczy",
   "mcpPage.description": "Łącz i zarządzaj serwerami MCP, aby aplikacje mogły korzystać z zewnętrznych narzędzi i usług.",
-  "members.admin": "Admin",
   "members.adminTip": "Może tworzyć aplikacje i zarządzać ustawieniami zespołu",
+  "members.alreadyInTeam": "Już w zespole",
+  "members.alreadyInTeamTip": "Ci użytkownicy mają już dostęp do tego obszaru roboczego.",
   "members.builder": "Budowniczy",
   "members.builderTip": "Może tworzyć i edytować własne aplikacje",
-  "members.datasetOperator": "Wiedza Admin",
   "members.datasetOperatorTip": "Może zarządzać tylko bazą wiedzy",
   "members.deleteMember": "Usuń członka",
   "members.disInvite": "Anuluj zaproszenie",
-  "members.editor": "Edytor",
   "members.editorTip": "Może tworzyć i edytować aplikacje, ale nie zarządzać ustawieniami zespołu",
   "members.email": "Email",
   "members.emailInvalid": "Nieprawidłowy format e-maila",
@@ -270,13 +269,12 @@
   "members.invite": "Dodaj",
   "members.inviteTeamMember": "Dodaj członka zespołu",
   "members.inviteTeamMemberTip": "Mogą uzyskać bezpośredni dostęp do danych Twojego zespołu po zalogowaniu.",
-  "members.invitedAsRole": "Zaproszony jako użytkownik typu {{role}}",
+  "members.invitedAsRole": "Zaproszony jako {{role}}",
   "members.lastActive": "OSTATNIA AKTYWNOŚĆ",
   "members.name": "NAZWA",
-  "members.normal": "Normalny",
+  "members.noNewInvitationsSent": "Nie wysłano nowych zaproszeń",
   "members.normalTip": "Może tylko korzystać z aplikacji, nie może tworzyć aplikacji",
   "members.ok": "OK",
-  "members.owner": "Właściciel",
   "members.pending": "Oczekujący...",
   "members.removeFromTeam": "Usuń z zespołu",
   "members.removeFromTeamTip": "Usunie dostęp do zespołu",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Wiedza",
   "menus.datasetsTips": "NADCHODZI: Importuj swoje własne dane tekstowe lub wpisuj dane w czasie rzeczywistym przez Webhook, aby wzmocnić kontekst LLM.",
+  "menus.deployments": "Wdrożenia",
   "menus.explore": "Eksploruj",
   "menus.exploreMarketplace": "Zapoznaj się z Marketplace",
   "menus.newApp": "Nowa aplikacja",
   "menus.newDataset": "Utwórz Wiedzę",
   "menus.plugins": "Integracjay",
   "menus.pluginsTips": "Integruj integracjay stron trzecich lub twórz integracjay AI kompatybilne z ChatGPT.",
+  "menus.roster": "Lista agentów",
   "menus.status": "beta",
   "menus.tools": "Narzędzia",
   "model.addMoreModel": "Przejdź do ustawień, aby dodać więcej modeli",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Model tekstu na mowę",
   "modelProvider.ttsModel.tip": "Ustaw domyślny model dla konwersji tekstu na mowę w rozmowach.",
   "modelProvider.upgradeForLoadBalancing": "Uaktualnij swój plan, aby włączyć równoważenie obciążenia.",
+  "navigation.skipToMain": "Przejdź do głównej treści",
   "noData": "Brak danych",
   "operation.add": "Dodaj",
   "operation.added": "Dodano",
@@ -600,9 +601,6 @@
   "placeholder.input": "Proszę wprowadzić",
   "placeholder.search": "Szukaj...",
   "placeholder.select": "Proszę wybrać",
-  "plugin.serpapi.apiKey": "Klucz API",
-  "plugin.serpapi.apiKeyPlaceholder": "Wprowadź swój klucz API",
-  "plugin.serpapi.keyFrom": "Pobierz swój klucz SerpAPI ze strony konta SerpAPI",
   "promptEditor.context.item.desc": "Wstaw szablon kontekstu",
   "promptEditor.context.item.title": "Kontekst",
   "promptEditor.context.modal.add": "Dodaj Kontekst ",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
new file mode 100644
index 00000000000..7d171fdca05
--- /dev/null
+++ b/web/i18n/pl-PL/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API usługi backendowej",
+  "access.api.copyCurlExample": "Skopiuj przykład cURL",
+  "access.api.createFailed": "Nie udało się wygenerować Tokenu API.",
+  "access.api.createKey": "Wygeneruj Token API",
+  "access.api.createKeyTitle": "Wygeneruj nowy Token API",
+  "access.api.curlExampleTitle": "Przykład cURL",
+  "access.api.description": "Uzyskaj dostęp do tego wdrożenia przez HTTP. Każdy Token API jest ograniczony do jednego środowiska.",
+  "access.api.developerTitle": "Developer API",
+  "access.api.disabled": "Dostęp przez API jest wyłączony dla tego wdrożenia.",
+  "access.api.disabledHint": "Włącz dostęp przez API, aby generować tokeny ograniczone do środowiska.",
+  "access.api.dismissToken": "Odrzuć Token API",
+  "access.api.docs": "Dokumentacja API",
+  "access.api.docsClose": "Zamknij dokumentację API",
+  "access.api.docsDescription": "Zobacz dokumentację Workflow API dla tego wdrożenia.",
+  "access.api.docsTitle": "Dokumentacja Workflow API",
+  "access.api.empty": "Najpierw wdróż do środowiska, aby zacząć wystawiać Tokeny API.",
+  "access.api.emptyTitle": "Brak wdrożonych środowisk",
+  "access.api.endpoint": "URL żądania",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Lista Tokenów API",
+  "access.api.nameLabel": "Nazwa Tokenu API",
+  "access.api.namePlaceholder": "Podaj nazwę Tokenu API",
+  "access.api.nameRequired": "Nazwa Tokenu API jest wymagana.",
+  "access.api.newKey": "Wygeneruj nowy Token API",
+  "access.api.newTokenDescription": "Ten Token API jest pokazywany tylko raz. Skopiuj go przed opuszczeniem tej strony.",
+  "access.api.newTokenLabel": "Token API",
+  "access.api.newTokenTitle": "Token API wygenerowany",
+  "access.api.noKeys": "Brak Tokenów API. Wygeneruj jeden, aby zacząć wywoływać API.",
+  "access.api.noKeysTitle": "Brak Tokenów API",
+  "access.api.revokeConfirmDescription": "Token API \"{{name}}\" przestanie działać natychmiast. Tej akcji nie można cofnąć.",
+  "access.api.revokeConfirmTitle": "Unieważnić Token API?",
+  "access.api.revokeFailed": "Nie udało się unieważnić Tokenu API.",
+  "access.api.revokeSuccess": "Token API unieważniony",
+  "access.api.table.action": "Akcja",
+  "access.api.table.environment": "Środowisko",
+  "access.api.table.key": "Token API",
+  "access.api.table.name": "Nazwa",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Kanał",
+  "access.channels.col.endpoint": "Punkt wejścia",
+  "access.channels.col.status": "Status",
+  "access.channels.description": "Punkty wejścia WebApp i CLI używają powyższych uprawnień dostępu.",
+  "access.channels.disabled": "Kanały dostępu są wyłączone dla tego wdrożenia.",
+  "access.channels.disabledHint": "Włącz kanały dostępu, aby udostępnić punkty wejścia WebApp i CLI.",
+  "access.channels.followPermission": "Stosuje się do uprawnień",
+  "access.channels.title": "Kanały dostępu",
+  "access.cli.description": "Wywołuj z terminala za pomocą difyctl, odpowiednie dla skryptów, zautomatyzowanych przepływów lub integracji z Agentem.",
+  "access.cli.docs": "Przewodnik użytkownika",
+  "access.cli.domain": "Domena",
+  "access.cli.empty": "Punkt końcowy CLI nie jest skonfigurowany.",
+  "access.cli.install": "Zainstaluj CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Skopiowano",
+  "access.copy": "Kopiuj",
+  "access.copyFailed": "Kopiowanie nie powiodło się",
+  "access.copyToast": "Skopiowano do schowka",
+  "access.hide": "Ukryj",
+  "access.members.clearAll": "Wyczyść wszystko",
+  "access.members.empty": "Nie znaleziono dopasowań.",
+  "access.members.groupCount_one": "{{count}} grupa",
+  "access.members.groupCount_other": "{{count}} grup",
+  "access.members.groups": "Grupy",
+  "access.members.individuals": "Członkowie",
+  "access.members.memberCount_one": "{{count}} członek",
+  "access.members.memberCount_other": "{{count}} członków",
+  "access.members.pickPlaceholder": "Wybierz grupy lub członków",
+  "access.members.searchPlaceholder": "Szukaj grup i członków",
+  "access.members.selectedLabel": "Wybrane",
+  "access.permission.anyone": "Każdy z linkiem",
+  "access.permission.anyoneDesc": "Każdy może uzyskać dostęp do tego wdrożenia bez logowania.",
+  "access.permission.memberCount_one": "{{count}} członek",
+  "access.permission.memberCount_other": "{{count}} członków",
+  "access.permission.organization": "Wszyscy członkowie platformy",
+  "access.permission.organizationDesc": "Wszyscy członkowie platformy",
+  "access.permission.specific": "Wybrani członkowie platformy",
+  "access.permission.specificDesc": "Wybierz określone grupy lub członków",
+  "access.permission.specificUnavailable": "Wybór konkretnych członków jest wyłączony, dopóki nie zostaną podłączeni rzeczywiści członkowie i grupy platformy.",
+  "access.permission.updateFailed": "Nie udało się zaktualizować zasad dostępu.",
+  "access.permissions.col.environment": "Środowisko",
+  "access.permissions.col.permission": "Dostęp",
+  "access.permissions.description": "Ustaw uprawnienia dostępu dla punktów wejścia WebApp i CLI w każdym środowisku.",
+  "access.permissions.editAriaLabel": "Skonfiguruj dostęp dla {{environment}}",
+  "access.permissions.editDescription": "Ustaw uprawnienia dostępu dla punktów wejścia WebApp i CLI.",
+  "access.permissions.editTitle": "Uprawnienia dostępu",
+  "access.permissions.title": "Uprawnienia dostępu",
+  "access.revoke": "Unieważnij",
+  "access.runAccess.description": "Zarządzaj tym, jak użytkownicy mogą uruchamiać to wdrożenie i kto ma do niego dostęp w każdym środowisku.",
+  "access.runAccess.disabled": "Dostęp uruchomieniowy jest wyłączony dla tego wdrożenia.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Udostępnij to wdrożenie jako serwer Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Punkt końcowy MCP nie jest skonfigurowany.",
+  "access.runAccess.noEnvs": "Wdróż do środowiska, aby skonfigurować uprawnienia dostępu.",
+  "access.runAccess.noEnvsTitle": "Brak wdrożonych środowisk",
+  "access.runAccess.openWebapp": "Otwórz WebApp",
+  "access.runAccess.permissions": "Uprawnienia dostępu",
+  "access.runAccess.permissionsDesc": "Kto ma dostęp do tego wdrożenia w każdym środowisku.",
+  "access.runAccess.title": "Dostęp uruchomieniowy",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Hostowana strona internetowa dla użytkowników końcowych.",
+  "access.runAccess.webappEmpty": "Wkrótce dostępne.",
+  "access.show": "Pokaż",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Zewnętrzny",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Nieznany",
+  "card.access.api": "Tokeny API",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Brak dostępu",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Utwórz pierwsze Wydanie",
+  "card.deploy": "Wdróż",
+  "card.deploying": "{{count}} wdrażanych",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} nieudanych",
+  "card.fromApp": "Z {{name}}",
+  "card.lastDeployed": "Ostatnio wdrożone {{time}}",
+  "card.menu.delete": "Usuń wdrożenie",
+  "card.menu.deleteDisabled": "Usuwanie wdrożenia nie jest jeszcze dostępne dla wdrożeń zarządzanych przez backend.",
+  "card.menu.deploy": "Wdróż do środowiska",
+  "card.menu.editInfo": "Edytuj informacje",
+  "card.menu.viewDetail": "Zobacz szczegóły wdrożenia",
+  "card.moreActions": "Więcej akcji",
+  "card.neverDeployed": "Jeszcze nie wdrożone",
+  "card.noDescription": "Nie podano opisu.",
+  "card.notDeployed": "Nie wdrożone",
+  "card.ready": "{{count}} uruchomionych",
+  "card.tooltip.createdAt": "Utworzono",
+  "card.tooltip.deployed": "Wdrożone",
+  "card.tooltip.deploymentStatus": "Wdrożenie",
+  "card.tooltip.notDeployed": "To wdrożenie nie zostało jeszcze wdrożone do żadnego środowiska.",
+  "card.tooltip.notDeployedShort": "Nie wdrożone",
+  "card.tooltip.release": "Wydanie",
+  "card.tooltip.releaseName": "Nazwa Wydania",
+  "card.tooltip.source": "Źródło",
+  "common.loadFailed": "Nie udało się załadować. Spróbuj ponownie później.",
+  "common.loading": "Ładowanie...",
+  "createGuide.actions.back": "Wstecz",
+  "createGuide.actions.cancel": "Anuluj",
+  "createGuide.actions.continue": "Kontynuuj",
+  "createGuide.actions.createAndDeploy": "Utwórz i wdróż",
+  "createGuide.actions.creating": "Tworzenie...",
+  "createGuide.actions.deploy": "Wdróż",
+  "createGuide.actions.deploying": "Tworzenie i wdrażanie...",
+  "createGuide.actions.next": "Dalej",
+  "createGuide.actions.skipDeploy": "Pomiń, wdróż później",
+  "createGuide.description": "Utwórz wdrożenie ze źródła wydania, podstawowych informacji i środowiska docelowego.",
+  "createGuide.dsl.defaultAppName": "Zaimportowana aplikacja DSL",
+  "createGuide.dsl.description": "Prześlij pakiet Workflow DSL, aby utworzyć wdrożenie, pierwsze wydanie i opcjonalne wdrożenie do środowiska.",
+  "createGuide.dsl.dropDescription": "Prześlij pakiet YAML DSL Workflow. Opcje wdrożenia są rozwiązywane z tego pliku przed wdrożeniem.",
+  "createGuide.dsl.dropTitle": "Prześlij pakiet Workflow DSL",
+  "createGuide.dsl.readFailed": "Nie udało się odczytać pliku DSL. Wybierz inny plik i spróbuj ponownie.",
+  "createGuide.dsl.reading": "Odczytywanie pliku DSL...",
+  "createGuide.dsl.title": "Importuj DSL",
+  "createGuide.dsl.unsupportedMode": "Tylko pliki Workflow DSL mogą być używane do wdrożeń.",
+  "createGuide.errors.createReleaseFailed": "Nie udało się utworzyć wdrożenia lub wydania.",
+  "createGuide.errors.deployFailed": "Nie udało się wdrożyć do środowiska.",
+  "createGuide.method.description": "Wybierz źródło użyte do utworzenia pierwszego wydania.",
+  "createGuide.methods.bindApp.description": "Użyj istniejącej aplikacji Workflow w Studio jako źródła wydania.",
+  "createGuide.methods.bindApp.title": "Podłącz istniejącą aplikację Workflow",
+  "createGuide.methods.importDsl.description": "Prześlij pakiet YAML DSL Workflow i kontynuuj przez UI wdrożenia.",
+  "createGuide.methods.importDsl.title": "Importuj DSL",
+  "createGuide.methods.mocked": "Symulowane",
+  "createGuide.nav.back": "Wdrożenia",
+  "createGuide.release.defaultName": "wydanie początkowe",
+  "createGuide.release.deployInfo": "Informacje o wdrożeniu",
+  "createGuide.release.description": "Wypełnij informacje o wdrożeniu i szczegóły pierwszego wydania.",
+  "createGuide.release.firstVersion": "Pierwsze Wydanie",
+  "createGuide.release.instanceDescription": "Opis wdrożenia",
+  "createGuide.release.instanceDescriptionPlaceholder": "Opisz, do czego służy to wdrożenie",
+  "createGuide.release.instanceName": "Nazwa wdrożenia",
+  "createGuide.release.instanceNameConflict": "Wdrożenie o tej nazwie już istnieje. Wybierz inną nazwę.",
+  "createGuide.release.releaseDescription": "Opis Wydania",
+  "createGuide.release.releaseDescriptionPlaceholder": "Opisz to wydanie",
+  "createGuide.release.releaseName": "Nazwa Wydania",
+  "createGuide.release.releaseNote": "Opis Wydania",
+  "createGuide.release.title": "Podstawowe informacje",
+  "createGuide.source.availableApps_one": "{{count}} aplikacja",
+  "createGuide.source.availableApps_other": "{{count}} aplikacji",
+  "createGuide.source.clearSearch": "Wyczyść wyszukiwanie aplikacji",
+  "createGuide.source.description": "Wybierz źródło użyte do utworzenia pierwszego wydania.",
+  "createGuide.source.empty": "Nie znaleziono aplikacji Workflow.",
+  "createGuide.source.searchPlaceholder": "Szukaj aplikacji",
+  "createGuide.source.sourceApp": "Aplikacja Workflow",
+  "createGuide.source.title": "Źródło Wydania",
+  "createGuide.steps.method": "Źródło Wydania",
+  "createGuide.steps.release": "Podstawowe informacje",
+  "createGuide.steps.source": "Źródło Wydania",
+  "createGuide.steps.target": "Wdróż do środowiska",
+  "createGuide.target.bindingCount_one": "{{count}} powiązanie",
+  "createGuide.target.bindingCount_other": "{{count}} powiązań",
+  "createGuide.target.bindingHint": "Wybierz poświadczenia używane przez to wydanie.",
+  "createGuide.target.bindings": "Poświadczenia",
+  "createGuide.target.deferredBindingHint": "Poświadczenia zostaną rozwiązane z rzeczywistego planu wdrożenia podczas końcowej akcji wdrożenia.",
+  "createGuide.target.deferredEnvironmentHint": "Nazwa jest dopasowywana do rzeczywistych środowisk po utworzeniu wdrożenia i wydania.",
+  "createGuide.target.description": "Wybierz docelowe środowisko i podaj ustawienia środowiska uruchomieniowego, których potrzebuje to wydanie. Ten krok można pominąć.",
+  "createGuide.target.envVarCount_one": "{{count}} zmienna",
+  "createGuide.target.envVarCount_other": "{{count}} zmiennych",
+  "createGuide.target.envVarHint": "Dla każdej zmiennej środowiskowej, której potrzebuje to wydanie, wprowadź wartość niestandardową lub użyj wartości zdefiniowanej w aplikacji.",
+  "createGuide.target.envVarPlaceholder": "Wprowadź wartość",
+  "createGuide.target.envVarSource.ariaLabel": "Wybierz źródło wartości zmiennej dla {{key}}",
+  "createGuide.target.envVarSource.default": "Wartość aplikacji",
+  "createGuide.target.envVarSource.lastDeployment": "Ostatnio wdrożona wartość",
+  "createGuide.target.envVarSource.literal": "Wartość niestandardowa",
+  "createGuide.target.envVarType.number": "Liczba",
+  "createGuide.target.envVarType.secret": "Sekret",
+  "createGuide.target.envVarType.string": "Ciąg znaków",
+  "createGuide.target.envVars": "Zmienne środowiskowe",
+  "createGuide.target.environment": "Środowisko docelowe",
+  "createGuide.target.environmentName": "Nazwa środowiska",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "Nie udało się załadować poświadczeń.",
+  "createGuide.target.loadEnvironmentsFailed": "Nie udało się załadować środowisk wdrożenia.",
+  "createGuide.target.missingRequiredBinding": "Wybierz poświadczenie dla tego wymaganego powiązania.",
+  "createGuide.target.noBindingRequired": "Nie są wymagane poświadczenia.",
+  "createGuide.target.noCredentialCandidates": "Brak dostępnych poświadczeń.",
+  "createGuide.target.noEnvironmentOptions": "Brak dostępnych środowisk wdrożenia.",
+  "createGuide.target.required": "Wymagane",
+  "createGuide.target.selectCredential": "Wybierz poświadczenie",
+  "createGuide.target.title": "Wdróż do środowiska",
+  "createGuide.title": "Nowe Wdrożenie",
+  "createModal.appPickerPlaceholder": "Wybierz aplikację Workflow",
+  "createModal.appSearchEmpty": "Brak pasujących aplikacji Workflow",
+  "createModal.appSearchPlaceholder": "Szukaj aplikacji Workflow…",
+  "createModal.cancel": "Anuluj",
+  "createModal.create": "Utwórz",
+  "createModal.createFailed": "Nie udało się utworzyć wdrożenia.",
+  "createModal.description": "Wybierz aplikację Workflow i utwórz wdrożenie.",
+  "createModal.descriptionLabel": "Opis",
+  "createModal.descriptionPlaceholder": "Opisz, do czego służy to wdrożenie",
+  "createModal.loadMoreApps": "Załaduj więcej aplikacji",
+  "createModal.loadingApps": "Ładowanie aplikacji…",
+  "createModal.nameLabel": "Nazwa wdrożenia",
+  "createModal.namePlaceholder": "Nazwa wdrożenia",
+  "createModal.noApps": "W tym obszarze roboczym nie znaleziono aplikacji Workflow. Najpierw utwórz jedną w Studio.",
+  "createModal.selected": "Wybrane",
+  "createModal.sourceApp": "Aplikacja Workflow (wymagana)",
+  "createModal.title": "Nowe Wdrożenie",
+  "deployDrawer.bindingCount_one": "{{count}} powiązanie",
+  "deployDrawer.bindingCount_other": "{{count}} powiązań",
+  "deployDrawer.bindingOptionsFailed": "Nie udało się załadować opcji poświadczeń.",
+  "deployDrawer.bindingSelectionHint": "Wybierz poświadczenia używane przez to wdrożenie.",
+  "deployDrawer.bindingsDisabled": "Rozwiązane z podglądu wydania. Edycja nie jest jeszcze dostępna.",
+  "deployDrawer.cancel": "Anuluj",
+  "deployDrawer.close": "Zamknij panel wdrożenia",
+  "deployDrawer.defaultSelect": "Wybierz...",
+  "deployDrawer.deploy": "Wdróż do środowiska",
+  "deployDrawer.deployExistingRelease": "Wdróż do środowiska",
+  "deployDrawer.deployExistingReleaseDescription": "Wybierz wydanie i środowisko docelowe do wdrożenia.",
+  "deployDrawer.deployExistingReleaseTitle": "Wdróż do środowiska",
+  "deployDrawer.deployFailed": "Nie udało się rozpocząć wdrożenia.",
+  "deployDrawer.deploying": "Wdrażanie...",
+  "deployDrawer.description": "Wybierz wydanie i środowisko docelowe do wdrożenia.",
+  "deployDrawer.envVarCount_one": "{{count}} zmienna",
+  "deployDrawer.envVarCount_other": "{{count}} zmiennych",
+  "deployDrawer.envVarHint": "Dla każdej zmiennej środowiskowej, której potrzebuje to wydanie, wprowadź wartość niestandardową lub użyj wartości zdefiniowanej w aplikacji.",
+  "deployDrawer.envVarPlaceholder": "Wprowadź wartość",
+  "deployDrawer.envVarSource.ariaLabel": "Wybierz źródło wartości zmiennej dla {{key}}",
+  "deployDrawer.envVarSource.default": "Wartość aplikacji",
+  "deployDrawer.envVarSource.lastDeployment": "Ostatnio wdrożona wartość",
+  "deployDrawer.envVarSource.literal": "Wartość niestandardowa",
+  "deployDrawer.envVarType.number": "Liczba",
+  "deployDrawer.envVarType.secret": "Sekret",
+  "deployDrawer.envVarType.string": "Ciąg znaków",
+  "deployDrawer.envVars": "Zmienne środowiskowe",
+  "deployDrawer.existingReleaseHint": "To wydanie zostanie wdrożone bez zmian. Nie zostanie utworzone żadne nowe wydanie.",
+  "deployDrawer.loadingBindings": "Rozwiązywanie...",
+  "deployDrawer.lockedHint": "Zablokowane do bieżącego środowiska",
+  "deployDrawer.missingRequiredBinding": "Wybierz poświadczenie dla tego wymaganego powiązania.",
+  "deployDrawer.missingRequiredEnvVar": "Wprowadź wartość dla tej wymaganej zmiennej środowiskowej.",
+  "deployDrawer.modelCreds": "Poświadczenia modelu",
+  "deployDrawer.needsValidation": " (wymaga weryfikacji)",
+  "deployDrawer.newReleaseHint": "Nowe wydanie zostanie utworzone z wybranego YAML aplikacji Workflow.",
+  "deployDrawer.noBindingRequired": "Nie wymagane",
+  "deployDrawer.noCredentialCandidates": "Brak dostępnych poświadczeń.",
+  "deployDrawer.noNewEnvironmentAvailable": "Wszystkie dostępne środowiska mają już wdrożenie.",
+  "deployDrawer.noOtherReleaseAvailable": "Brak innych dostępnych wydań dla tego środowiska.",
+  "deployDrawer.noReleaseAvailable": "Utwórz wydanie przed wdrożeniem do środowiska.",
+  "deployDrawer.notFound": "Nie znaleziono wdrożenia.",
+  "deployDrawer.noteLabel": "Opis Wydania (opcjonalny)",
+  "deployDrawer.notePlaceholder": "np. Wysyłka poprawki tekstu onboardingu",
+  "deployDrawer.pluginCreds": "Poświadczenia wtyczki",
+  "deployDrawer.promote": "Wdróż",
+  "deployDrawer.promoteDescription": "Wybierz wydanie i środowisko docelowe do wdrożenia.",
+  "deployDrawer.promoteTitle": "Wdróż do środowiska",
+  "deployDrawer.readOnly": "Tylko do odczytu",
+  "deployDrawer.redeploy": "Wdróż do środowiska",
+  "deployDrawer.redeployDescription": "Wybierz wydanie i środowisko docelowe do wdrożenia.",
+  "deployDrawer.redeployExistingReleaseHint": "Bieżące wydanie zostanie ponownie wdrożone bez zmian. Nie zostanie utworzone żadne nowe wydanie.",
+  "deployDrawer.redeployTitle": "Wdróż do środowiska",
+  "deployDrawer.releaseLabel": "Wydanie",
+  "deployDrawer.requiredBinding": "Wymagane",
+  "deployDrawer.rollback": "Wdróż",
+  "deployDrawer.rollbackDescription": "Wybierz wydanie i środowisko docelowe do wdrożenia.",
+  "deployDrawer.rollbackTitle": "Wdróż do środowiska",
+  "deployDrawer.runtimeCredentials": "Poświadczenia",
+  "deployDrawer.secretPlaceholder": "sekret",
+  "deployDrawer.selectCredential": "Wybierz poświadczenie",
+  "deployDrawer.selectEnv": "Wybierz środowisko",
+  "deployDrawer.selectProviderCred": "Wybierz poświadczenie {{provider}}",
+  "deployDrawer.selectProviderKey": "Wybierz klucz {{provider}}",
+  "deployDrawer.selectRelease": "Wybierz wydanie",
+  "deployDrawer.targetEnv": "Środowisko docelowe",
+  "deployDrawer.title": "Wdróż do środowiska",
+  "deployDrawer.valuePlaceholder": "wartość",
+  "deployTab.cancelDeployment": "Anuluj wdrożenie",
+  "deployTab.closeError": "Zamknij",
+  "deployTab.col.actions": "Akcje",
+  "deployTab.col.currentRelease": "Bieżące Wydanie",
+  "deployTab.col.environment": "Środowisko",
+  "deployTab.col.status": "Status",
+  "deployTab.col.updated": "Zaktualizowano",
+  "deployTab.collapseDetails": "Zwiń szczegóły wdrożenia",
+  "deployTab.confirmUndeploy": "Wycofaj wdrożenie",
+  "deployTab.deployOtherVersion": "Wdróż inne Wydanie",
+  "deployTab.deployToEnv": "Wdróż do {{name}}",
+  "deployTab.deployToNewEnv": "Wdróż do nowego środowiska...",
+  "deployTab.empty": "Brak instancji. Wdróż do nowego środowiska, aby zacząć.",
+  "deployTab.emptyDescription": "Wybierz wydanie i środowisko docelowe, aby udostępnić to wdrożenie użytkownikom.",
+  "deployTab.emptyTitle": "Żadne środowisko nie jest jeszcze uruchomione",
+  "deployTab.envCount": "Środowiska",
+  "deployTab.errorCode": "Kod",
+  "deployTab.errorDialogDesc": "Przejrzyj ostatnie nieudane wdrożenie przed ponowną próbą lub wdrożeniem innego wydania.",
+  "deployTab.errorDialogTitle": "Błąd wdrożenia w {{name}}",
+  "deployTab.errorMessage": "Wiadomość",
+  "deployTab.errorPhase": "Faza",
+  "deployTab.expandDetails": "Rozwiń szczegóły wdrożenia",
+  "deployTab.moreActions": "Więcej akcji",
+  "deployTab.newDeployment": "Wdróż do nowego środowiska",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "ID wdrożenia",
+  "deployTab.panel.endpoints": "Punkty końcowe",
+  "deployTab.panel.envVars": "Zmienne środowiskowe",
+  "deployTab.panel.error": "Błąd",
+  "deployTab.panel.failedRelease": "Nieudane Wydanie",
+  "deployTab.panel.health": "Stan",
+  "deployTab.panel.instanceInfo": "Informacje o instancji",
+  "deployTab.panel.modelCreds": "Poświadczenia modelu",
+  "deployTab.panel.pluginCreds": "Poświadczenia wtyczki",
+  "deployTab.panel.release": "Wydanie",
+  "deployTab.panel.releaseCreatedAt": "Wydanie utworzono",
+  "deployTab.panel.releaseInfo": "Informacje o wydaniu",
+  "deployTab.panel.replicas": "Repliki",
+  "deployTab.panel.run": "Uruchom",
+  "deployTab.panel.runtimeBindings": "Poświadczenia",
+  "deployTab.panel.runtimeInfo": "Informacje o środowisku uruchomieniowym",
+  "deployTab.panel.runtimeMode": "Tryb środowiska uruchomieniowego",
+  "deployTab.panel.runtimeNote": "Notatka środowiska uruchomieniowego",
+  "deployTab.panel.targetRelease": "Docelowe Wydanie",
+  "deployTab.panel.unknownError": "Wdrożenie nie powiodło się.",
+  "deployTab.promote": "Wdróż",
+  "deployTab.redeploy": "Ponownie wdróż",
+  "deployTab.releaseCreatedAt": "Wydanie utworzono {{time}}",
+  "deployTab.retry": "Ponów",
+  "deployTab.shortcut": "Skrót",
+  "deployTab.status.deployFailed": "Wdrożenie nie powiodło się",
+  "deployTab.status.deployingRelease": "Wdrażanie ({{release}})",
+  "deployTab.status.runningOutOfSync": "Uruchomione (oczekuje synchronizacja)",
+  "deployTab.status.runningWithFailed": "Uruchomione (ostatnie wdrożenie nie powiodło się)",
+  "deployTab.undeploy": "Wycofaj wdrożenie",
+  "deployTab.undeployConfirmDesc": "Dostęp dla użytkowników końcowych zostanie natychmiast zatrzymany. Wydanie można później ponownie wdrożyć.",
+  "deployTab.undeployConfirmTitle": "Wycofać wdrożenie z {{name}}?",
+  "deployTab.undeployFrom": "Wycofaj wdrożenie z {{name}}",
+  "deployTab.undeployImpactTitle": "Wpływ na instancję",
+  "deployTab.viewError": "Zobacz błąd",
+  "deployTab.viewLogs": "Zobacz logi",
+  "deployTab.viewProgress": "Zobacz postęp",
+  "detail.backToInstances": "Powrót do wdrożeń",
+  "detail.deployingCount": "{{count}} wdrażanych",
+  "detail.envCount_one": "{{count}} środowisko",
+  "detail.envCount_other": "{{count}} środowisk",
+  "detail.failedCount": "{{count}} nieudanych",
+  "detail.mobileTabs": "Sekcje wdrożenia",
+  "detail.notFound": "Nie znaleziono wdrożenia",
+  "detail.openSourceApp": "Otwórz źródło {{name}}",
+  "detail.sourceApp": "Źródło",
+  "detail.sourceAppLink": "Źródło",
+  "documentTitle.create": "Nowe wdrożenie · Wdrożenia",
+  "documentTitle.detail": "Wdrożenie · Wdrożenia",
+  "documentTitle.list": "Wdrożenia",
+  "filter.allEnvs": "Wszystkie środowiska",
+  "filter.notDeployed": "Nie wdrożone",
+  "filter.searchPlaceholder": "Szukaj wdrożeń",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Dopuszczenie",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Inicjalizacja",
+  "health.ENVIRONMENT_STATUS_DELETING": "Usuwanie",
+  "health.ENVIRONMENT_STATUS_FAILED": "Niedostępne",
+  "health.ENVIRONMENT_STATUS_READY": "Dostępne",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Nieznane",
+  "list.clearFilters": "Wyczyść filtry",
+  "list.clearSearch": "Wyczyść wyszukiwanie wdrożeń",
+  "list.createDeployment": "Nowe",
+  "list.empty": "Nie znaleziono wdrożeń.",
+  "list.emptyDescription": "Utwórz wdrożenie z aplikacji Workflow lub pakietu Workflow DSL, aby zarządzać wydaniami, środowiskami i dostępem.",
+  "list.emptyFilteredDescription": "Żadne wdrożenie nie pasuje do bieżącego wyszukiwania lub filtra środowiska.",
+  "list.emptyFilteredTitle": "Brak pasujących wdrożeń",
+  "list.emptyTitle": "Brak wdrożeń",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Izolowane",
+  "mode.ENVIRONMENT_MODE_SHARED": "Współdzielone",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Nieznane",
+  "newInstance.comingSoon": "Wkrótce dostępne",
+  "newInstance.fromStudio": "Wybierz ze Studio",
+  "newInstance.importDSL": "Importuj DSL",
+  "newInstance.title": "Nowe Wdrożenie",
+  "overview.accessEndpoints": "Punkty końcowe dostępu",
+  "overview.accessMeta.apiTokens": "Zarządzaj Tokenami API",
+  "overview.accessMeta.cli": "Zobacz dostęp przez CLI",
+  "overview.accessMeta.webApp": "Zarządzaj dostępem WebApp",
+  "overview.accessStatus": "Dostęp",
+  "overview.api": "Tokeny API",
+  "overview.apiKeysCount_one": "{{count}} Token API",
+  "overview.apiKeysCount_other": "{{count}} Tokenów API",
+  "overview.apiTokenSummary.environments_one": "{{count}} wdrożone środowisko",
+  "overview.apiTokenSummary.environments_other": "{{count}} wdrożonych środowisk",
+  "overview.availableForDeployment": "Dostępne do wdrożenia",
+  "overview.basicInfo": "Podstawowe informacje",
+  "overview.cardAction.deployLatest": "Wdróż najnowsze Wydanie",
+  "overview.cardAction.redeploy": "Ponownie wdróż",
+  "overview.cardAction.viewProgress": "Zobacz wdrożenie",
+  "overview.chip.behindTooltip_one": "1 wydanie za najnowszym. Wdróż najnowsze wydanie, aby zaktualizować.",
+  "overview.chip.behindTooltip_other": "{{count}} wydań za najnowszym. Wdróż najnowsze wydanie, aby zaktualizować.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "wdrażanie",
+  "overview.chip.deployingTooltip": "Wdrożenie jest w toku.",
+  "overview.chip.empty": "puste",
+  "overview.chip.emptyTooltip": "Żadne wydanie nie jest wdrożone w tym środowisku.",
+  "overview.chip.failed": "nieudane",
+  "overview.chip.failedTooltip": "Ostatnia próba wdrożenia nie powiodła się.",
+  "overview.chip.latest": "najnowsze",
+  "overview.chip.latestTooltip": "To środowisko uruchamia najnowsze wydanie.",
+  "overview.chip.needsReleaseFirst": "Najpierw utwórz Wydanie",
+  "overview.chip.olderRelease": "starsze",
+  "overview.chip.olderReleaseTooltip": "To środowisko uruchamia starsze wydanie.",
+  "overview.chip.openInDeployTab": "Zobacz postęp wdrożenia",
+  "overview.cli": "CLI",
+  "overview.configured": "Skonfigurowane",
+  "overview.createRelease": "Utwórz Wydanie",
+  "overview.created": "Utworzono",
+  "overview.deploy": "Wdróż",
+  "overview.deployedEnvironments": "wdrożone",
+  "overview.deploymentOverview": "Przegląd wdrożenia",
+  "overview.deploymentStatus": "Status wdrożenia",
+  "overview.description": "Opis",
+  "overview.developerApi": "Developer API",
+  "overview.disabled": "Wyłączone",
+  "overview.emptyValue": "Nie ustawiono",
+  "overview.enabled": "Włączone",
+  "overview.enabledChannels": "włączony dostęp",
+  "overview.endUserAccess": "Dostęp użytkownika końcowego",
+  "overview.environments": "Środowiska",
+  "overview.hero.byName": "przez {{name}}",
+  "overview.hero.empty": "Brak wydań",
+  "overview.hero.emptyDescription": "Utwórz wydanie z bieżącego źródła przed wdrożeniem.",
+  "overview.hero.propagation_one": "wdrożone do {{count}}/{{total}} środowiska",
+  "overview.hero.propagation_other": "wdrożone do {{count}}/{{total}} środowisk",
+  "overview.hero.untargeted": "nie skonfigurowano jeszcze żadnych środowisk",
+  "overview.instanceDetails": "Szczegóły wdrożenia",
+  "overview.instanceId": "ID wdrożenia",
+  "overview.latestRelease.releaseCount_one": "{{count}} wydanie",
+  "overview.latestRelease.releaseCount_other": "{{count}} wydań",
+  "overview.latestReleaseTitle": "Najnowsze Wydanie",
+  "overview.manageDeployments": "Zarządzaj wdrożeniami",
+  "overview.name": "Nazwa",
+  "overview.noAccessConfig": "Brak konfiguracji dostępu.",
+  "overview.noReleaseYet": "Utwórz wydanie przed wdrożeniem do środowiska.",
+  "overview.notConfigured": "Nie skonfigurowane",
+  "overview.previousReleases.empty": "Brak wcześniejszych wydań.",
+  "overview.previousReleases.retired": "Obecnie nie wdrożone",
+  "overview.previousReleases.title": "Poprzednie wydania",
+  "overview.previousReleases.viewAll": "Zobacz wszystkie",
+  "overview.ready": "Gotowe do wdrożenia",
+  "overview.recentReleases": "Ostatnie wydania",
+  "overview.releaseDeployedTitle": "{{release}} jest wdrożone",
+  "overview.releaseReadyTitle": "{{release}} jest gotowe do wdrożenia",
+  "overview.serviceMap": "Mapa usług",
+  "overview.servingRelease": "Obsługuje {{release}}",
+  "overview.servingReleaseDescription": "To wdrożenie jest wdrożone do {{count}}/{{total}} środowisk.",
+  "overview.strip.deployToNewEnvironment": "Wdróż do nowego środowiska",
+  "overview.strip.empty": "Nie skonfigurowano środowisk.",
+  "overview.strip.emptyDeployableDescription": "Wdróż najnowsze wydanie do środowiska, gdy będziesz gotów.",
+  "overview.strip.emptyDeployed": "Brak instancji.",
+  "overview.strip.emptyDescription": "Utwórz wydanie przed wdrożeniem do środowiska.",
+  "overview.strip.emptyTitle": "Brak instancji",
+  "overview.strip.summary_one": "1 z {{total}} na najnowszym wydaniu",
+  "overview.strip.summary_other": "{{count}} z {{total}} na najnowszym wydaniu",
+  "overview.strip.title": "Instancje",
+  "overview.switchSourceApp": "Zmień źródło",
+  "overview.switchSourceAppDescription": "Wybierz aplikację Workflow używaną jako źródło dla przyszłych wydań.",
+  "overview.switchSourceAppHint": "Po zmianie tylko nowo utworzone wydania używają nowego źródła. Historyczne wydania i istniejące wdrożenia nie są zmieniane.",
+  "overview.targetRelease": "Docelowe Wydanie",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Strefa zagrożenia",
+  "settings.dangerDesc": "Trwale usuń to wdrożenie i zatrzymaj wszystkie uruchomione instancje. Tej akcji nie można cofnąć.",
+  "settings.delete": "Usuń wdrożenie",
+  "settings.deleteConfirmDesc": "Usunąć {{name}}? Każda instancja przestanie działać i zostanie usunięta we wszystkich środowiskach. Tej akcji nie można cofnąć.",
+  "settings.deleteConfirmTitle": "Usuń wdrożenie",
+  "settings.deleteFailed": "Nie udało się usunąć wdrożenia.",
+  "settings.deleteImpact": "Wpływ",
+  "settings.deleteImpactInstance": "Wdrożenie",
+  "settings.deleteImpactTitle": "Wpływ na wdrożenie",
+  "settings.deleteImpactValue": "Wdrożenie jest usuwane z listy wdrożeń.",
+  "settings.deleted": "Wdrożenie usunięte",
+  "settings.description": "Opis",
+  "settings.descriptionHelp": "Zarządzaj nazwą, opisem i innymi ustawieniami tego wdrożenia.",
+  "settings.general": "Ogólne",
+  "settings.name": "Nazwa wdrożenia",
+  "settings.reset": "Resetuj",
+  "settings.save": "Zapisz zmiany",
+  "settings.updateFailed": "Nie udało się zaktualizować wdrożenia.",
+  "settings.updated": "Wdrożenie zaktualizowane",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Wdrażanie",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Oczekuje synchronizacja",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Wdrożenie nie powiodło się",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Nieprawidłowe",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Uruchomione",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nie wdrożone",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Wycofywanie wdrożenia",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Nieznane",
+  "subtitle": "Zarządzaj wdrożeniami w różnych środowiskach.",
+  "tabs.access.description": "Zarządzaj kanałami dostępu i uprawnieniami dostępu.",
+  "tabs.access.name": "Dostęp",
+  "tabs.api-tokens.description": "Zarządzaj Tokenami API i wywołuj instancje przez HTTP.",
+  "tabs.api-tokens.name": "Tokeny API",
+  "tabs.instances.description": "Wyświetlaj i zarządzaj instancjami we wdrożonych środowiskach.",
+  "tabs.instances.name": "Instancje",
+  "tabs.overview.description": "Zobacz status wdrożenia w różnych środowiskach.",
+  "tabs.overview.name": "Przegląd",
+  "tabs.releases.description": "Twórz, wdrażaj i zarządzaj wydaniami.",
+  "tabs.releases.name": "Wydania",
+  "tabs.settings.description": "Zarządzaj nazwą, opisem i innymi ustawieniami tego wdrożenia.",
+  "tabs.settings.name": "Ustawienia",
+  "title": "Wdrożenia",
+  "unsupportedDslNodes.description": "To wydanie zawiera węzły, których środowisko uruchomieniowe wdrożenia jeszcze nie obsługuje. Usuń je lub zastąp w Studio, a następnie spróbuj ponownie.",
+  "unsupportedDslNodes.descriptionWithTypes": "To wydanie zawiera węzły, których środowisko uruchomieniowe wdrożenia jeszcze nie obsługuje: {{nodeTypes}}. Usuń je lub zastąp w Studio, a następnie spróbuj ponownie.",
+  "unsupportedDslNodes.title": "Nieobsługiwane węzły",
+  "unsupportedDslNodes.unknownType": "Nieznany typ",
+  "versions.cancelCreate": "Anuluj",
+  "versions.cancelDelete": "Anuluj",
+  "versions.cancelEdit": "Anuluj",
+  "versions.checkingReleaseContent": "Sprawdzanie zawartości wydania...",
+  "versions.col.action": "Akcja",
+  "versions.col.author": "Utworzone przez",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Utworzono",
+  "versions.col.deployedTo": "Wdrożone do",
+  "versions.col.release": "Wydanie",
+  "versions.col.sourceApp": "Źródło",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Utwórz",
+  "versions.createFailed": "Nie udało się utworzyć wydania.",
+  "versions.createRelease": "Utwórz Wydanie",
+  "versions.createReleaseDescription": "Utwórz wdrażalne wydanie z aplikacji Workflow lub pliku Workflow DSL.",
+  "versions.createReleaseHint": "Nowe wydania można wdrożyć do dowolnego środowiska.",
+  "versions.createSuccess": "Wydanie \"{{name}}\" utworzone.",
+  "versions.creating": "Tworzenie...",
+  "versions.currentOn": "Bieżące Wydanie na {{name}}",
+  "versions.deleteConfirmDesc": "Wydanie \"{{name}}\" zostanie trwale usunięte. Tej akcji nie można cofnąć.",
+  "versions.deleteConfirmTitle": "Usunąć wydanie?",
+  "versions.deleteFailed": "Nie udało się usunąć wydania.",
+  "versions.deleteImpactDeployment": "Status wdrożenia",
+  "versions.deleteImpactNotDeployed": "Obecnie nie wdrożone",
+  "versions.deleteImpactRelease": "Wydanie",
+  "versions.deleteImpactTitle": "Wpływ usunięcia",
+  "versions.deleteRelease": "Usuń Wydanie",
+  "versions.deleteSuccess": "Wydanie \"{{name}}\" usunięte.",
+  "versions.deploy": "Wdróż",
+  "versions.deployTo": "Wdróż do {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Wdrażanie",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Oczekuje synchronizacja",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Nieudane",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Nieprawidłowe",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Uruchomione",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nie wdrożone",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Wycofywanie wdrożenia",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Nieznane",
+  "versions.deployingTo": "{{name}} jest wdrażane",
+  "versions.disabledReason.checkDeploymentsFailed": "Nie udało się zweryfikować użycia wdrożenia. Spróbuj ponownie później.",
+  "versions.disabledReason.checkingDeployments": "Sprawdzanie użycia wdrożenia",
+  "versions.disabledReason.current": "To wydanie już działa na {{name}}",
+  "versions.disabledReason.deploying": "Poczekaj na zakończenie aktywnego wdrożenia",
+  "versions.disabledReason.envDisabled": "To środowisko nie jest wdrażalne",
+  "versions.disabledReason.releaseInUse_one": "Wycofaj to wydanie z {{count}} środowiska przed jego usunięciem",
+  "versions.disabledReason.releaseInUse_other": "Wycofaj to wydanie z {{count}} środowisk przed jego usunięciem",
+  "versions.dslReadFailed": "Nie udało się odczytać pliku DSL. Wybierz inny plik i spróbuj ponownie.",
+  "versions.dslReading": "Odczytywanie pliku DSL...",
+  "versions.dslUnsupportedMode": "Tylko pliki Workflow DSL mogą być używane do wdrożeń.",
+  "versions.editFailed": "Nie udało się zaktualizować wydania.",
+  "versions.editRelease": "Edytuj Wydanie",
+  "versions.editReleaseDescription": "Zaktualizuj nazwę i opis tego wydania.",
+  "versions.editSuccess": "Wydanie \"{{name}}\" zaktualizowane.",
+  "versions.empty": "Brak dostępnych wydań.",
+  "versions.emptyDescription": "Utwórz pierwsze wydanie przed wdrożeniem do środowiska.",
+  "versions.emptyTitle": "Brak wydań",
+  "versions.emptyWithCreate": "Brak wydań. Utwórz pierwsze wdrażalne wydanie przed wdrożeniem.",
+  "versions.exportDsl": "Eksportuj DSL",
+  "versions.exportDslFailed": "Nie udało się wyeksportować DSL.",
+  "versions.exportingDsl": "Eksportowanie...",
+  "versions.groupHeader.deploy": "Wdróż",
+  "versions.groupHeader.promote": "Wdróż",
+  "versions.groupHeader.rollback": "Wdróż poprzednią wersję",
+  "versions.groupHeader.unavailable": "Niedostępne",
+  "versions.manualDslOption": "Prześlij DSL",
+  "versions.moreActions": "Więcej akcji",
+  "versions.optional": "Opcjonalne",
+  "versions.promote": "Wdróż",
+  "versions.promoteTo": "Wdróż do {{name}}",
+  "versions.releaseAlreadyExists": "Wydanie o tej samej zawartości już istnieje: {{name}}.",
+  "versions.releaseContentCheckFailed": "Nie udało się sprawdzić zawartości wydania.",
+  "versions.releaseDescriptionLabel": "Opis",
+  "versions.releaseDescriptionPlaceholder": "Opisz to wydanie",
+  "versions.releaseHistory": "Historia wydań",
+  "versions.releaseNameLabel": "Nazwa Wydania",
+  "versions.releaseNamePlaceholder": "Nazwa Wydania",
+  "versions.releaseNameRequired": "Wprowadź nazwę wydania.",
+  "versions.releaseSourceLabel": "Źródło Wydania",
+  "versions.rollbackTo": "Wdróż do {{name}}",
+  "versions.saveEdit": "Zapisz",
+  "versions.sourceAppOption": "Aplikacja Workflow"
+}
diff --git a/web/i18n/pl-PL/workflow.json b/web/i18n/pl-PL/workflow.json
index 63759d2b567..d24c9034268 100644
--- a/web/i18n/pl-PL/workflow.json
+++ b/web/i18n/pl-PL/workflow.json
@@ -1,5 +1,6 @@
 {
   "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Odpowiedź",
   "blocks.assigner": "Przypisywacz Zmiennych",
   "blocks.code": "Kod",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Agregator zmiennych",
   "blocks.variable-assigner": "Agregator zmiennych",
   "blocksAbout.agent": "Wywoływanie dużych modeli językowych w celu odpowiadania na pytania lub przetwarzania języka naturalnego",
+  "blocksAbout.agent-v2": "Wywoływanie dużych modeli językowych w celu odpowiadania na pytania lub przetwarzania języka naturalnego",
   "blocksAbout.answer": "Zdefiniuj treść odpowiedzi w rozmowie",
   "blocksAbout.assigner": "Węzeł przypisania zmiennych służy do przypisywania wartości do zmiennych zapisywalnych (takich jak zmienne konwersacji).",
   "blocksAbout.code": "Wykonaj fragment kodu Python lub NodeJS, aby wdrożyć niestandardową logikę",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID przepływu pracy",
   "globalVar.fieldsDescription.workflowRunId": "ID uruchomienia przepływu pracy",
   "globalVar.title": "Zmienne systemowe",
+  "nodes.agent.advancedSetting": "Ustawienia zaawansowane",
   "nodes.agent.checkList.strategyNotSelected": "Nie wybrano strategii",
   "nodes.agent.clickToViewParameterSchema": "Kliknij, aby zobaczyć schemat parametrów",
   "nodes.agent.configureModel": "Konfiguruj model",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Nieobsługiwany model",
   "nodes.agent.modelSelectorTooltips.deprecated": "Ten model jest przestarzały",
   "nodes.agent.notAuthorized": "Nieautoryzowany",
+  "nodes.agent.outputVars.confirm": "Potwierdź",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Wprowadź tablicę JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Wprowadź true lub false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Wartości domyślne dla plików nie są jeszcze konfigurowalne tutaj.",
+  "nodes.agent.outputVars.defaultValueLabel": "Domyślne",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Wprowadź prawidłową liczbę.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Wprowadź obiekt JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Wartość domyślna",
+  "nodes.agent.outputVars.delete": "Usuń {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Opis",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Dodaj opis",
+  "nodes.agent.outputVars.edit": "Edytuj {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Edytor zmiennych wyjściowych",
   "nodes.agent.outputVars.files.title": "Pliki generowane przez agenta",
   "nodes.agent.outputVars.files.transfer_method": "Metoda transferu. Wartość to remote_url lub local_file",
   "nodes.agent.outputVars.files.type": "Rodzaj wsparcia. Teraz obsługuje tylko obraz",
   "nodes.agent.outputVars.files.upload_file_id": "Identyfikator przesyłanego pliku",
   "nodes.agent.outputVars.files.url": "Adres URL obrazu",
   "nodes.agent.outputVars.json": "Kod JSON wygenerowany przez agenta",
+  "nodes.agent.outputVars.nameDuplicate": "Nazwa wyjścia już istnieje",
+  "nodes.agent.outputVars.nameInvalid": "Używaj liter, cyfr i podkreśleń. Zacznij od litery lub podkreślenia.",
+  "nodes.agent.outputVars.nameLabel": "Nazwa pola",
+  "nodes.agent.outputVars.namePlaceholder": "Nazwa pola",
+  "nodes.agent.outputVars.newOutput": "Nowe wyjście",
+  "nodes.agent.outputVars.requiredLabel": "Wymagane",
+  "nodes.agent.outputVars.showAdvancedOptions": "Pokaż opcje zaawansowane",
   "nodes.agent.outputVars.text": "Treści generowane przez agentów",
+  "nodes.agent.outputVars.typeLabel": "Typ wyjścia",
   "nodes.agent.outputVars.usage": "Informacje o użyciu modelu",
   "nodes.agent.parameterSchema": "Schemat parametrów",
   "nodes.agent.pluginInstaller.install": "Instalować",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Ta integracja jest instalowana z GitHub. Przejdź do Integracje, aby ponownie zainstalować",
   "nodes.agent.pluginNotInstalled": "Ta integracja nie jest zainstalowana",
   "nodes.agent.pluginNotInstalledDesc": "Ta integracja jest instalowana z GitHub. Przejdź do Integracje, aby ponownie zainstalować",
+  "nodes.agent.roster.change": "Zmień",
+  "nodes.agent.roster.editInConsole": "Edytuj w Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Jednorazowa konfiguracja istniejąca tylko w tym węźle",
+  "nodes.agent.roster.inlineSetup.name": "Konfiguracja inline",
+  "nodes.agent.roster.inlineSetup.title": "Konfiguracja agenta",
+  "nodes.agent.roster.inlineSetup.type": "Tylko w tym węźle",
+  "nodes.agent.roster.label": "Agent",
+  "nodes.agent.roster.makeCopy": "Utwórz kopię",
+  "nodes.agent.roster.more": "Więcej akcji agenta",
+  "nodes.agent.roster.openPanel": "Otwórz szczegóły {{name}}",
+  "nodes.agent.roster.panelLabel": "Szczegóły {{name}}",
   "nodes.agent.strategy.configureTip": "Skonfiguruj strategię agentyczną.",
   "nodes.agent.strategy.configureTipDesc": "Po skonfigurowaniu strategii agentycznej ten węzeł automatycznie załaduje pozostałe konfiguracje. Strategia będzie miała wpływ na mechanizm wieloetapowego rozumowania narzędziowego.",
   "nodes.agent.strategy.label": "Strategia agentyczna",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Zainstalowana wersja integracje nie zapewnia tej strategii. Kliknij, aby zmienić wersję.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} nie jest zainstalowany",
   "nodes.agent.strategyNotSet": "Nie ustawiono strategii agentalnej",
+  "nodes.agent.task.insert": "Wstaw",
+  "nodes.agent.task.label": "Zadanie agenta",
+  "nodes.agent.task.mention": "Wzmianka",
+  "nodes.agent.task.placeholder": "Opisz, co ma robić ten agent…",
+  "nodes.agent.task.tooltip": "Określ instrukcje zadania, które ten agent powinien wykonywać w tym workflow.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Nieautoryzowany",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} nie jest zainstalowany",
   "nodes.agent.toolbox": "skrzynka z narzędziami",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Przez {{author}}",
   "tabs.question-understand": "Zrozumienie pytania",
   "tabs.requestToCommunity": "Prośby do społeczności",
-  "tabs.searchBlock": "Wyszukaj węzeł",
+  "tabs.searchBlock": "Wyszukaj węzły, agenta, człowieka, wiedzę",
   "tabs.searchDataSource": "Wyszukiwanie w źródle danych",
   "tabs.searchSnippets": "Wyszukaj fragmenty...",
   "tabs.searchTool": "Wyszukiwarka",
diff --git a/web/i18n/pt-BR/agent-v-2.json b/web/i18n/pt-BR/agent-v-2.json
new file mode 100644
index 00000000000..4e65b52b3c6
--- /dev/null
+++ b/web/i18n/pt-BR/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Esta ação ainda não está disponível.",
+  "agentDetail.access.actions.monitoring": "Monitoramento",
+  "agentDetail.access.copyAccessUrl": "Copiar URL de acesso",
+  "agentDetail.access.copyFailed": "Falha ao copiar a referência.",
+  "agentDetail.access.copyReference": "Copiar referência de {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Copiar endpoint da API de serviço",
+  "agentDetail.access.description": "Todas as superfícies de onde este agente pode ser acessado.",
+  "agentDetail.access.empty": "Nenhum ponto de acesso vinculado",
+  "agentDetail.access.emptyDescription": "Este agente do roster ainda não tem referências de aplicativo ou workflow.",
+  "agentDetail.access.entries.agentApp.description": "Aplicativo agente vinculado a este agente do roster.",
+  "agentDetail.access.entries.agentApp.name": "Aplicativo agente",
+  "agentDetail.access.entries.workflow.description": "Workflow e referência de nó vinculados a este agente do roster.",
+  "agentDetail.access.entries.workflow.name": "Nó de workflow",
+  "agentDetail.access.entryCount_one": "{{count}} entrada",
+  "agentDetail.access.entryCount_other": "{{count}} entradas",
+  "agentDetail.access.groups.references.heading": "Referências",
+  "agentDetail.access.groups.references.label": "Referências vinculadas",
+  "agentDetail.access.learnMore": "Saiba mais",
+  "agentDetail.access.moreActions": "Mais ações para {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Endpoint da API de serviço",
+  "agentDetail.access.serviceApi.title": "API de serviço de backend",
+  "agentDetail.access.status.disabled": "Desativado",
+  "agentDetail.access.status.enabled": "Ativado",
+  "agentDetail.access.status.inService": "Em serviço",
+  "agentDetail.access.status.outOfService": "Fora de serviço",
+  "agentDetail.access.title": "Ponto de acesso",
+  "agentDetail.access.toggleSurface": "Alternar acesso de {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL de acesso",
+  "agentDetail.access.webApp.actions.customize": "Personalizar",
+  "agentDetail.access.webApp.actions.embedded": "Incorporado",
+  "agentDetail.access.webApp.actions.launch": "Iniciar",
+  "agentDetail.access.webApp.actions.settings": "Configurações",
+  "agentDetail.access.webApp.refreshUrl": "Atualizar URL de acesso",
+  "agentDetail.access.webApp.showQrCode": "Mostrar QR code",
+  "agentDetail.access.webApp.ssoEnabled": "SSO ativado",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Usado como um nó dentro do workflow",
+  "agentDetail.access.workflow.empty": "Ainda não há referências de workflow.",
+  "agentDetail.access.workflow.loadFailed": "Falha ao carregar as referências de workflow.",
+  "agentDetail.access.workflow.loading": "Carregando referências de workflow…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} nó",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} nós",
+  "agentDetail.access.workflow.notAvailable": "N/D",
+  "agentDetail.access.workflow.openInStudio": "Abrir no Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Abrir {{name}} no Studio",
+  "agentDetail.access.workflow.table.actions": "Ações",
+  "agentDetail.access.workflow.table.lastUpdated": "Última atualização",
+  "agentDetail.access.workflow.table.name": "Nome",
+  "agentDetail.access.workflow.table.nodes": "Nós",
+  "agentDetail.access.workflow.table.version": "Versão",
+  "agentDetail.access.workflow.title": "Acesso por workflow",
+  "agentDetail.configure.advancedSettings.description": "Para usuários avançados. Variáveis de ambiente, sandbox e memória.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Adicionar variável de ambiente",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Excluir {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Ocultar valor de {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Importar .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Para mostrar arquivos .env ocultos, pressione Command + Shift + . no seletor de arquivos.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Se o seu arquivo .env estiver oculto, ative os arquivos ocultos no seletor de arquivos do sistema.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Para mostrar arquivos .env ocultos, ative Itens ocultos no Explorador de Arquivos.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Revelar valor de {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Selecionar escopo da variável de ambiente",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Variáveis de ambiente disponíveis para este agente em tempo de execução.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Alternar Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Configurações avançadas",
+  "agentDetail.configure.advancedSettings.toggle": "Alternar configurações avançadas",
+  "agentDetail.configure.chatFeatures.description": "Modele a experiência de chat do usuário final no seu webapp e superfícies de chat.",
+  "agentDetail.configure.chatFeatures.title": "Recursos de chat",
+  "agentDetail.configure.files.add": "Adicionar arquivo",
+  "agentDetail.configure.files.empty.description": "Envie documentos que o agente possa ler, como especificações, modelos ou diretrizes",
+  "agentDetail.configure.files.empty.title": "Ainda não há arquivos",
+  "agentDetail.configure.files.label": "Arquivos",
+  "agentDetail.configure.files.preview.empty": "Sem conteúdo de pré-visualização.",
+  "agentDetail.configure.files.preview.failed": "Falha ao carregar a pré-visualização.",
+  "agentDetail.configure.files.preview.unsupported": "Este arquivo não oferece suporte à pré-visualização.",
+  "agentDetail.configure.files.remove": "Remover {{name}}",
+  "agentDetail.configure.files.tip": "Arquivos que este agente pode usar ao orquestrar tarefas.",
+  "agentDetail.configure.files.toggle": "Alternar arquivos",
+  "agentDetail.configure.files.treeLabel": "Arquivos do agente",
+  "agentDetail.configure.files.upload.action": "Enviar",
+  "agentDetail.configure.files.upload.browse": "procurar",
+  "agentDetail.configure.files.upload.description": "Envie um arquivo para este agente.",
+  "agentDetail.configure.files.upload.dropzone": "Solte um arquivo aqui, ou",
+  "agentDetail.configure.files.upload.failed": "Falha ao enviar o arquivo.",
+  "agentDetail.configure.files.upload.fileType": "ARQUIVO",
+  "agentDetail.configure.files.upload.invalidFile": "Envie um arquivo.",
+  "agentDetail.configure.files.upload.success": "Arquivo enviado.",
+  "agentDetail.configure.files.upload.title": "Enviar arquivo",
+  "agentDetail.configure.knowledgeRetrieval.add": "Adicionar recuperação de conhecimento",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Adicionar conhecimento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Clique no botão “+” para adicionar conhecimento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Conhecimento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Configuração de recuperação",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Saiba mais sobre a recuperação de conhecimento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automático",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Condições",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Desativado",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Filtro de metadados",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manual",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Selecionar modo de filtragem de metadados",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Nome da recuperação de conhecimento",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Agente decide",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "O agente escreve sua própria consulta a partir do prompt e do contexto disponível. Nada a configurar aqui.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Consulta personalizada",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Escreva uma consulta fixa para esta fonte de recuperação.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Texto da consulta personalizada",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Digite uma consulta de busca",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Consulta",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Recuperação de conhecimento · Agente decide",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Editar {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Conecte uma base de conhecimento que o agente possa pesquisar ao responder",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Ainda não há conhecimento",
+  "agentDetail.configure.knowledgeRetrieval.label": "Recuperação de conhecimento",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Remover {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Fontes de recuperação de conhecimento que este agente pode usar ao orquestrar tarefas.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Alternar recuperação de conhecimento",
+  "agentDetail.configure.model.label": "Modelo",
+  "agentDetail.configure.orchestrate": "Orquestrar",
+  "agentDetail.configure.preview.chatFeatures": "Recursos de chat",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agente",
+  "agentDetail.configure.preview.empty.description": "Envie uma mensagem para testar o rascunho atual.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Ainda não há instruções, então as respostas virão do modelo puro.",
+  "agentDetail.configure.preview.endUserAuth": "Autenticação do usuário final",
+  "agentDetail.configure.preview.restart": "Reiniciar pré-visualização",
+  "agentDetail.configure.preview.title": "Pré-visualização",
+  "agentDetail.configure.prompt.copied": "Prompt copiado",
+  "agentDetail.configure.prompt.copy": "Copiar prompt",
+  "agentDetail.configure.prompt.copyFailed": "Falha ao copiar o prompt.",
+  "agentDetail.configure.prompt.insert.label": "Inserir",
+  "agentDetail.configure.prompt.insert.question": "Pergunta inicial",
+  "agentDetail.configure.prompt.insert.reportFile": "Arquivo de relatório de saída",
+  "agentDetail.configure.prompt.insert.tenders": "Lista inicial de licitações",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Mencionar",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Escreva as instruções aqui,",
+  "agentDetail.configure.prompt.tip": "Defina como este agente deve interpretar entradas, chamar ferramentas e produzir saídas.",
+  "agentDetail.configure.publishBar.draft": "Rascunho",
+  "agentDetail.configure.publishBar.publishUpdate": "Publicar atualização",
+  "agentDetail.configure.publishBar.published": "Publicado",
+  "agentDetail.configure.publishBar.publishedAt": "Publicado em {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Publicando…",
+  "agentDetail.configure.publishBar.saved": "Salvo há 5 min",
+  "agentDetail.configure.publishBar.savedAt": "Salvo em {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Alterações não publicadas",
+  "agentDetail.configure.publishBar.upToDate": "Atualizado",
+  "agentDetail.configure.publishBar.versionHistory": "Abrir histórico de versões",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Workflows afetados",
+  "agentDetail.configure.publishImpact.cancel": "Cancelar",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Seu agente aparece em",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". As alterações irão impactá-los.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "este agente",
+  "agentDetail.configure.publishImpact.title": "{{action}} em {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} workflow",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} workflows",
+  "agentDetail.configure.skills.add": "Adicionar habilidade",
+  "agentDetail.configure.skills.detail.contentRegion": "Conteúdo dos detalhes da habilidade",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} ARQUIVOS",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Arquivos da habilidade",
+  "agentDetail.configure.skills.detail.files": "Arquivos",
+  "agentDetail.configure.skills.empty.description": "As habilidades dão ao agente expertise reutilizável que ele pode invocar enquanto trabalha",
+  "agentDetail.configure.skills.empty.title": "Ainda não há habilidades",
+  "agentDetail.configure.skills.itemType": "Habilidade",
+  "agentDetail.configure.skills.label": "Habilidades",
+  "agentDetail.configure.skills.remove": "Remover {{name}}",
+  "agentDetail.configure.skills.tip": "Habilidades que este agente pode usar ao orquestrar tarefas.",
+  "agentDetail.configure.skills.toggle": "Alternar habilidades",
+  "agentDetail.configure.skills.upload.action": "Enviar",
+  "agentDetail.configure.skills.upload.browse": "procurar",
+  "agentDetail.configure.skills.upload.description": "Envie um pacote .zip ou .skill para este agente.",
+  "agentDetail.configure.skills.upload.dropzone": "Solte um pacote de habilidade aqui, ou",
+  "agentDetail.configure.skills.upload.failed": "Falha ao enviar a habilidade.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Envie um arquivo .zip ou .skill.",
+  "agentDetail.configure.skills.upload.success": "Habilidade enviada.",
+  "agentDetail.configure.skills.upload.title": "Enviar habilidade",
+  "agentDetail.configure.tools.add": "Adicionar ferramenta",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Para desenvolvedores",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Instale um programa de linha de comando que o agente executa em seu sandbox. Requer instalação e geralmente chaves de API.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Ferramenta CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Escolha uma ferramenta já existente neste workspace, como busca na web ou integrações.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Ferramenta",
+  "agentDetail.configure.tools.cliDialog.description": "Instale uma ferramenta CLI a partir de qualquer registro de pacotes. O agente obtém acesso de shell ao binário fornecido.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Editar ferramenta CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Armazene chaves de API, tokens ou segredos que esta ferramenta CLI precisa. Os valores são criptografados em repouso e injetados como variáveis de ambiente quando o agente invoca a ferramenta.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Variáveis de ambiente",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(opcional)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Em sandbox · executado uma vez na primeira invocação",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Comando de instalação",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Cole seu comando de instalação aqui, ex.: npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Comando de instalação é obrigatório.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Saiba mais sobre ferramenta CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Nome da ferramenta CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Dê um nome à sua ferramenta CLI",
+  "agentDetail.configure.tools.cliDialog.name.required": "Nome da ferramenta CLI é obrigatório.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Nunca visível no prompt do agente; injetado apenas como $VAR em tempo de execução",
+  "agentDetail.configure.tools.cliDialog.title": "Adicionar uma ferramenta CLI",
+  "agentDetail.configure.tools.cliTool": "Ferramenta CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Usuário final · OAuth",
+  "agentDetail.configure.tools.editAction": "Editar {{name}}",
+  "agentDetail.configure.tools.empty.description": "As ferramentas permitem que o agente aja, como pesquisar na web ou chamar seus aplicativos",
+  "agentDetail.configure.tools.empty.title": "Ainda não há ferramentas",
+  "agentDetail.configure.tools.label": "Ferramentas",
+  "agentDetail.configure.tools.moreActions": "Mais ações para {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Pré-autorizar",
+  "agentDetail.configure.tools.removeAction": "Remover {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Remover todas as ferramentas",
+  "agentDetail.configure.tools.tip": "Ferramentas que este agente pode chamar ao orquestrar tarefas.",
+  "agentDetail.configure.tools.toggle": "Alternar ferramentas",
+  "agentDetail.configure.tools.toolTabs.all": "Todas",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Personalizado",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugins",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agente",
+  "agentDetail.history": "Histórico",
+  "agentDetail.logs.description": "Os logs completos registram o status de execução do aplicativo, incluindo entradas do usuário, respostas do agente, planejamento e uso de ferramentas.",
+  "agentDetail.logs.empty": "Nenhum log encontrado",
+  "agentDetail.logs.filters.period.allTime": "Todo o período",
+  "agentDetail.logs.filters.period.label": "Período do log",
+  "agentDetail.logs.filters.period.last30days": "Últimos 30 dias",
+  "agentDetail.logs.filters.period.last7days": "Últimos 7 dias",
+  "agentDetail.logs.filters.search.label": "Pesquisar logs",
+  "agentDetail.logs.filters.search.placeholder": "Pesquisar",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Última hora de criação",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Última hora de atualização",
+  "agentDetail.logs.filters.source.all": "Origem",
+  "agentDetail.logs.filters.source.empty": "Nenhuma fonte encontrada",
+  "agentDetail.logs.filters.source.label": "Origem do log",
+  "agentDetail.logs.filters.source.loadFailed": "Falha ao carregar fontes",
+  "agentDetail.logs.filters.source.loading": "Carregando fontes…",
+  "agentDetail.logs.filters.source.searchLabel": "Pesquisar fontes",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Pesquisar",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Workflow",
+  "agentDetail.logs.learnMore": "Saiba mais",
+  "agentDetail.logs.loadFailed": "Falha ao carregar logs",
+  "agentDetail.logs.loading": "Carregando logs…",
+  "agentDetail.logs.notAvailable": "N/D",
+  "agentDetail.logs.table.createdTime": "Hora de criação",
+  "agentDetail.logs.table.endUser": "Usuário final",
+  "agentDetail.logs.table.messageCount": "Qtd. msg.",
+  "agentDetail.logs.table.operationRate": "Taxa de op.",
+  "agentDetail.logs.table.source": "Fonte",
+  "agentDetail.logs.table.title": "Título",
+  "agentDetail.logs.table.unread": "Não lido",
+  "agentDetail.logs.table.updatedTime": "Hora de atualização",
+  "agentDetail.logs.table.userRate": "Avaliação do usuário",
+  "agentDetail.logs.title": "Logs",
+  "agentDetail.memorySettings.budgetLabel": "Orçamento de memória",
+  "agentDetail.memorySettings.description": "Configurações de memória do snapshot de configuração ativo.",
+  "agentDetail.memorySettings.export.description": "A exportação de memória está prevista para uma versão futura.",
+  "agentDetail.memorySettings.export.download": "Baixar",
+  "agentDetail.memorySettings.export.soon": "Em breve",
+  "agentDetail.memorySettings.export.title": "Exportar memória atual",
+  "agentDetail.memorySettings.notConfigured": "Não configurado",
+  "agentDetail.memorySettings.scopeLabel": "Escopo da memória",
+  "agentDetail.memorySettings.title": "Memória",
+  "agentDetail.metadata.activeVersionLabel": "Versão ativa",
+  "agentDetail.metadata.appIdLabel": "ID do aplicativo",
+  "agentDetail.metadata.description": "Campos do roster somente leitura retornados pelo backend do agente.",
+  "agentDetail.metadata.emptyValue": "Não disponível",
+  "agentDetail.metadata.scopeLabel": "Escopo",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Somente workflow",
+  "agentDetail.metadata.sourceLabel": "Origem",
+  "agentDetail.metadata.statusLabel": "Status",
+  "agentDetail.metadata.title": "Metadados",
+  "agentDetail.metadata.updatedAtLabel": "Atualizado em",
+  "agentDetail.metadata.workflowIdLabel": "ID do workflow",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID do nó do workflow",
+  "agentDetail.monitoring.change": "{{value}} em relação ao período anterior",
+  "agentDetail.monitoring.dateRangeLabel": "Intervalo de datas",
+  "agentDetail.monitoring.description": "Acompanhe a atividade, o custo e a qualidade de interação do agente reutilizável em todos os workflows.",
+  "agentDetail.monitoring.learnMore": "Saiba mais",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Usuários finais únicos que acionaram workflows usando este agente.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Usuários ativos",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Contagem de comunicação contínua entre usuário e agente para este ponto de acesso.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Méd. de interações por sessão",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Velocidade média de saída desde o início da solicitação até a conclusão.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Velocidade de saída de tokens",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Custo estimado em tokens produzido por este agente nas execuções de workflow.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Uso de tokens",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Conversas de IA diárias que alcançaram este agente através do ponto de acesso selecionado.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Total de conversas",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Contagem diária de interações do agente.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Total de mensagens",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "O número de curtidas por 1.000 mensagens para este agente.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Taxa de satisfação do usuário",
+  "agentDetail.monitoring.pickSource": "Escolha um aplicativo",
+  "agentDetail.monitoring.sourceLabel": "Aplicativo",
+  "agentDetail.monitoring.sourceTrigger": "Origem {{name}}",
+  "agentDetail.monitoring.sources.all": "Todos",
+  "agentDetail.monitoring.timeRangeLabel": "Intervalo de tempo",
+  "agentDetail.monitoring.timeRanges.custom": "Personalizado",
+  "agentDetail.monitoring.timeRanges.last30days": "Últimos 30 dias",
+  "agentDetail.monitoring.timeRanges.last7days": "Últimos 7 dias",
+  "agentDetail.monitoring.timeRanges.today": "Hoje",
+  "agentDetail.monitoring.title": "Monitoramento",
+  "agentDetail.monitoring.tokenUsageConsumed": "Tokens consumidos",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Navegação do agente",
+  "agentDetail.publish": "Publicar",
+  "agentDetail.publishSoon": "Em breve",
+  "agentDetail.sections.access": "Ponto de acesso",
+  "agentDetail.sections.configure": "Orquestrar",
+  "agentDetail.sections.logs": "Logs",
+  "agentDetail.sections.monitoring": "Monitoramento",
+  "agentDetail.subtitle": "ID do agente: {{agentId}}",
+  "agentDetail.title": "Agente",
+  "agentDetail.type": "AGENTE",
+  "agentDetail.versionHistory.active": "Ativa",
+  "agentDetail.versionHistory.empty": "Ainda não há versões",
+  "agentDetail.versionHistory.filter": "Filtrar versões",
+  "agentDetail.versionHistory.versionName": "Versão {{version}}",
+  "roster.createAgent": "Criar agente",
+  "roster.createAgentOptions": "Opções de criação de agente",
+  "roster.createDialog.description": "Crie um agente reutilizável no roster deste workspace.",
+  "roster.createDialog.title": "Criar agente",
+  "roster.createForm.changeIcon": "Alterar ícone do agente",
+  "roster.createForm.descriptionLabel": "Descrição",
+  "roster.createForm.descriptionOptional": "(opcional)",
+  "roster.createForm.descriptionPlaceholder": "ex.: Reúne fontes sobre um tópico e resume as principais descobertas",
+  "roster.createForm.nameLabel": "Nome",
+  "roster.createForm.namePlaceholder": "ex.: Max",
+  "roster.createForm.nameRequired": "Nome é obrigatório.",
+  "roster.createForm.roleLabel": "Função",
+  "roster.createForm.rolePlaceholder": "ex.: Assistente de pesquisa",
+  "roster.createForm.roleRequired": "Função é obrigatória.",
+  "roster.createSuccess": "Agente criado.",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Este agente será removido da lista do roster ativo.",
+  "roster.deleteDialog.title": "Excluir {{name}}?",
+  "roster.deleteFailed": "Falha ao excluir o agente.",
+  "roster.deleteSuccess": "Agente excluído.",
+  "roster.duplicateFailed": "Falha ao duplicar o agente.",
+  "roster.duplicateSuccess": "Agente duplicado.",
+  "roster.editAgent": "Editar {{name}}",
+  "roster.editDialog.description": "Atualize o nome, a descrição e a função deste agente no roster.",
+  "roster.editDialog.title": "Editar agente",
+  "roster.editInfo": "Editar informações",
+  "roster.empty": "Ainda não há agente",
+  "roster.emptyDescription": "Agentes salvos neste workspace aparecerão aqui.",
+  "roster.emptySearch": "Nenhum agente correspondente",
+  "roster.emptySearchDescription": "Tente outro nome de agente.",
+  "roster.filters.all": "Todos",
+  "roster.filters.drafts": "Rascunhos",
+  "roster.filters.label": "Filtros de agente",
+  "roster.filters.published": "Publicados",
+  "roster.learnMore": "Saiba mais sobre o Agent Roster",
+  "roster.listLabel": "Lista do roster de agentes",
+  "roster.loadMore": "Carregar mais",
+  "roster.loadingError": "Falha ao carregar agentes. Atualize e tente novamente.",
+  "roster.moreActions": "Mais ações para {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Falha ao criar agente inline. Atualize e tente novamente.",
+  "roster.nodeSelector.dialogLabel": "Selecione um agente",
+  "roster.nodeSelector.manageInAgentConsole": "Gerenciar no Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Pesquisar…",
+  "roster.nodeSelector.startFromScratch": "Começar do zero",
+  "roster.references.label": "Workflows que usam {{name}}",
+  "roster.references.trigger": "Workflows que usam {{name}}",
+  "roster.searchLabel": "Pesquisar agentes",
+  "roster.searchPlaceholder": "Pesquisar agentes pelo nome…",
+  "roster.sources.agent_app": "Aplicativo agente",
+  "roster.sources.imported": "Importado",
+  "roster.sources.system": "Sistema",
+  "roster.sources.workflow": "Workflow",
+  "roster.status.active": "Ativo",
+  "roster.status.archived": "Arquivado",
+  "roster.tabs.agent": "Agente",
+  "roster.tabs.human": "Humano",
+  "roster.tabsLabel": "Tipo de roster",
+  "roster.updateSuccess": "Agente atualizado.",
+  "roster.usageStatus.draft": "Rascunho"
+}
diff --git a/web/i18n/pt-BR/app-log.json b/web/i18n/pt-BR/app-log.json
index 34d28e3ff0f..fec79667f8c 100644
--- a/web/i18n/pt-BR/app-log.json
+++ b/web/i18n/pt-BR/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Hoje",
   "filter.period.yearToDate": "Ano até hoje",
   "filter.sortBy": "Ordenar por:",
+  "monitoring.description": "O monitoramento registra o status de execução do aplicativo, incluindo desempenho, atividade dos usuários e custos.",
   "promptLog": "Registro de Prompt",
   "runDetail.fileListDetail": "Detalhe",
   "runDetail.fileListLabel": "Detalhes do arquivo",
diff --git a/web/i18n/pt-BR/billing.json b/web/i18n/pt-BR/billing.json
index 95bf26362ec..26da124e8e7 100644
--- a/web/i18n/pt-BR/billing.json
+++ b/web/i18n/pt-BR/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Atualize para desbloquear o envio de documentos em lote",
   "upgrade.uploadMultiplePages.description": "Você atingiu o limite de upload — apenas um documento pode ser selecionado e enviado por vez no seu plano atual.",
   "upgrade.uploadMultiplePages.title": "Atualize para enviar vários documentos de uma vez",
+  "upgrade.workflowRestore.description": "A restauração de versões do fluxo de trabalho não está disponível no seu plano atual.",
+  "upgrade.workflowRestore.title": "Faça upgrade para restaurar versões do fluxo de trabalho",
   "upgradeBtn.encourage": "Fazer Upgrade Agora",
   "upgradeBtn.encourageShort": "Upgrade",
   "upgradeBtn.plain": "Fazer Upgrade do Plano",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index 22c36f6746c..5ff10fe8629 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Trocar workspace",
   "mcpPage.description": "Conecte e gerencie servidores MCP para dar aos seus apps acesso a ferramentas e serviços externos.",
-  "members.admin": "Admin",
   "members.adminTip": "Pode criar aplicativos e gerenciar configurações da equipe",
+  "members.alreadyInTeam": "Já está na equipe",
+  "members.alreadyInTeamTip": "Estes usuários já têm acesso a este espaço de trabalho.",
   "members.builder": "Construtor",
   "members.builderTip": "Pode criar e editar seus próprios aplicativos",
-  "members.datasetOperator": "Administrador de conhecimento",
   "members.datasetOperatorTip": "Só pode gerenciar a base de dados de conhecimento",
   "members.deleteMember": "Excluir Membro",
   "members.disInvite": "Cancelar o convite",
-  "members.editor": "Editor",
   "members.editorTip": "Pode editar aplicativos, mas não pode gerenciar configurações da equipe",
   "members.email": "E-mail",
   "members.emailInvalid": "Formato de e-mail inválido",
@@ -270,13 +269,12 @@
   "members.invite": "Adicionar",
   "members.inviteTeamMember": "Adicionar membro da equipe",
   "members.inviteTeamMemberTip": "Eles podem acessar os dados da sua equipe diretamente após fazer login.",
-  "members.invitedAsRole": "Convidado como usuário {{role}}",
+  "members.invitedAsRole": "Convidado como {{role}}",
   "members.lastActive": "ÚLTIMA ATIVIDADE",
   "members.name": "NOME",
-  "members.normal": "Normal",
+  "members.noNewInvitationsSent": "Nenhum novo convite enviado",
   "members.normalTip": "Só pode usar aplicativos, não pode criar aplicativos",
   "members.ok": "OK",
-  "members.owner": "Proprietário",
   "members.pending": "Pendente...",
   "members.removeFromTeam": "Remover da equipe",
   "members.removeFromTeamTip": "Removerá o acesso da equipe",
@@ -311,12 +309,14 @@
   "menus.apps": "Estúdio",
   "menus.datasets": "Conhecimento",
   "menus.datasetsTips": "EM BREVE: Importe seus próprios dados de texto ou escreva dados em tempo real via Webhook para aprimoramento do contexto LLM.",
+  "menus.deployments": "Implantações",
   "menus.explore": "Explorar",
   "menus.exploreMarketplace": "Explorar Mercado",
   "menus.newApp": "Novo App",
   "menus.newDataset": "Criar Conhecimento",
   "menus.plugins": "Integrações",
   "menus.pluginsTips": "Integre integrações de terceiros ou crie integrações de IA compatíveis com o ChatGPT.",
+  "menus.roster": "Lista de agentes",
   "menus.status": "beta",
   "menus.tools": "Ferramentas",
   "model.addMoreModel": "Vá para configurações para adicionar mais modelos",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Modelo de Texto para Fala",
   "modelProvider.ttsModel.tip": "Defina o modelo padrão para entrada de texto para fala na conversa.",
   "modelProvider.upgradeForLoadBalancing": "Atualize seu plano para habilitar o balanceamento de carga.",
+  "navigation.skipToMain": "Pular para o conteúdo principal",
   "noData": "Sem dados",
   "operation.add": "Adicionar",
   "operation.added": "Adicionado",
@@ -600,9 +601,6 @@
   "placeholder.input": "Por favor, insira",
   "placeholder.search": "Pesquisar...",
   "placeholder.select": "Por favor, selecione",
-  "plugin.serpapi.apiKey": "Chave da API",
-  "plugin.serpapi.apiKeyPlaceholder": "Insira sua chave da API",
-  "plugin.serpapi.keyFrom": "Obtenha sua chave da SerpAPI na página da conta da SerpAPI",
   "promptEditor.context.item.desc": "Inserir modelo de contexto",
   "promptEditor.context.item.title": "Contexto",
   "promptEditor.context.modal.add": "Adicionar Contexto",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
new file mode 100644
index 00000000000..b2e15f64cb9
--- /dev/null
+++ b/web/i18n/pt-BR/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API do serviço de backend",
+  "access.api.copyCurlExample": "Copiar exemplo cURL",
+  "access.api.createFailed": "Falha ao gerar o Token de API.",
+  "access.api.createKey": "Gerar Token de API",
+  "access.api.createKeyTitle": "Gerar novo Token de API",
+  "access.api.curlExampleTitle": "Exemplo cURL",
+  "access.api.description": "Acesse esta implantação por HTTP. Cada Token de API tem escopo de um ambiente.",
+  "access.api.developerTitle": "API do desenvolvedor",
+  "access.api.disabled": "O acesso à API está desativado para esta implantação.",
+  "access.api.disabledHint": "Ative o acesso à API para gerar tokens com escopo de ambiente.",
+  "access.api.dismissToken": "Dispensar Token de API",
+  "access.api.docs": "Documentação da API",
+  "access.api.docsClose": "Fechar documentação da API",
+  "access.api.docsDescription": "Veja a referência da API de Workflow para esta implantação.",
+  "access.api.docsTitle": "Documentação da API de Workflow",
+  "access.api.empty": "Implante em um ambiente primeiro para começar a emitir Tokens de API.",
+  "access.api.emptyTitle": "Nenhum ambiente implantado",
+  "access.api.endpoint": "URL da requisição",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Lista de Tokens de API",
+  "access.api.nameLabel": "Nome do Token de API",
+  "access.api.namePlaceholder": "Insira um nome para o Token de API",
+  "access.api.nameRequired": "O nome do Token de API é obrigatório.",
+  "access.api.newKey": "Gerar novo Token de API",
+  "access.api.newTokenDescription": "Este Token de API é exibido apenas uma vez. Copie-o antes de sair desta página.",
+  "access.api.newTokenLabel": "Token de API",
+  "access.api.newTokenTitle": "Token de API gerado",
+  "access.api.noKeys": "Nenhum Token de API ainda. Gere um para começar a chamar a API.",
+  "access.api.noKeysTitle": "Nenhum Token de API ainda",
+  "access.api.revokeConfirmDescription": "O Token de API \"{{name}}\" deixará de funcionar imediatamente. Esta ação não pode ser desfeita.",
+  "access.api.revokeConfirmTitle": "Revogar Token de API?",
+  "access.api.revokeFailed": "Falha ao revogar o Token de API.",
+  "access.api.revokeSuccess": "Token de API revogado",
+  "access.api.table.action": "Ação",
+  "access.api.table.environment": "Ambiente",
+  "access.api.table.key": "Token de API",
+  "access.api.table.name": "Nome",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Canal",
+  "access.channels.col.endpoint": "Ponto de entrada",
+  "access.channels.col.status": "Status",
+  "access.channels.description": "Os pontos de entrada do WebApp e da CLI usam as permissões de acesso acima.",
+  "access.channels.disabled": "Os canais de acesso estão desativados para esta implantação.",
+  "access.channels.disabledHint": "Ative os canais de acesso para expor os pontos de entrada do WebApp e da CLI.",
+  "access.channels.followPermission": "Segue as permissões",
+  "access.channels.title": "Canais de acesso",
+  "access.cli.description": "Invoque a partir do terminal com o difyctl, adequado para scripts, fluxos de trabalho automatizados ou integrações de Agente.",
+  "access.cli.docs": "Guia de uso",
+  "access.cli.domain": "Domínio",
+  "access.cli.empty": "Endpoint da CLI não configurado.",
+  "access.cli.install": "Instalar CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Copiado",
+  "access.copy": "Copiar",
+  "access.copyFailed": "Falha ao copiar",
+  "access.copyToast": "Copiado para a área de transferência",
+  "access.hide": "Ocultar",
+  "access.members.clearAll": "Limpar tudo",
+  "access.members.empty": "Nenhuma correspondência encontrada.",
+  "access.members.groupCount_one": "{{count}} grupo",
+  "access.members.groupCount_other": "{{count}} grupos",
+  "access.members.groups": "Grupos",
+  "access.members.individuals": "Membros",
+  "access.members.memberCount_one": "{{count}} membro",
+  "access.members.memberCount_other": "{{count}} membros",
+  "access.members.pickPlaceholder": "Selecione grupos ou membros",
+  "access.members.searchPlaceholder": "Pesquisar grupos e membros",
+  "access.members.selectedLabel": "Selecionados",
+  "access.permission.anyone": "Qualquer pessoa com o link",
+  "access.permission.anyoneDesc": "Qualquer pessoa pode acessar esta implantação sem fazer login.",
+  "access.permission.memberCount_one": "{{count}} membro",
+  "access.permission.memberCount_other": "{{count}} membros",
+  "access.permission.organization": "Todos os membros da plataforma",
+  "access.permission.organizationDesc": "Todos os membros da plataforma",
+  "access.permission.specific": "Membros específicos da plataforma",
+  "access.permission.specificDesc": "Selecione grupos ou membros específicos",
+  "access.permission.specificUnavailable": "A seleção de membros específicos está desativada até que membros e grupos reais da plataforma estejam conectados.",
+  "access.permission.updateFailed": "Falha ao atualizar a política de acesso.",
+  "access.permissions.col.environment": "Ambiente",
+  "access.permissions.col.permission": "Acesso",
+  "access.permissions.description": "Defina permissões de acesso para os pontos de entrada do WebApp e da CLI em cada ambiente.",
+  "access.permissions.editAriaLabel": "Configurar acesso para {{environment}}",
+  "access.permissions.editDescription": "Defina permissões de acesso para os pontos de entrada do WebApp e da CLI.",
+  "access.permissions.editTitle": "Permissões de acesso",
+  "access.permissions.title": "Permissões de acesso",
+  "access.revoke": "Revogar",
+  "access.runAccess.description": "Gerencie como os usuários podem executar esta implantação e quem tem permissão de acesso por ambiente.",
+  "access.runAccess.disabled": "O acesso de execução está desativado para esta implantação.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Exponha esta implantação como um servidor Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Endpoint MCP não configurado.",
+  "access.runAccess.noEnvs": "Implante em um ambiente para configurar as permissões de acesso.",
+  "access.runAccess.noEnvsTitle": "Nenhum ambiente implantado",
+  "access.runAccess.openWebapp": "Abrir WebApp",
+  "access.runAccess.permissions": "Permissões de acesso",
+  "access.runAccess.permissionsDesc": "Quem pode acessar esta implantação em cada ambiente.",
+  "access.runAccess.title": "Acesso de execução",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Página web hospedada para usuários finais.",
+  "access.runAccess.webappEmpty": "Em breve.",
+  "access.show": "Mostrar",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Externo",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Desconhecido",
+  "card.access.api": "Tokens de API",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Sem acesso",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Criar primeira versão",
+  "card.deploy": "Implantar",
+  "card.deploying": "{{count}} implantando",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} falharam",
+  "card.fromApp": "De {{name}}",
+  "card.lastDeployed": "Última implantação {{time}}",
+  "card.menu.delete": "Excluir implantação",
+  "card.menu.deleteDisabled": "A exclusão de implantação ainda não está disponível para implantações gerenciadas pelo backend.",
+  "card.menu.deploy": "Implantar no ambiente",
+  "card.menu.editInfo": "Editar informações",
+  "card.menu.viewDetail": "Ver detalhes da implantação",
+  "card.moreActions": "Mais ações",
+  "card.neverDeployed": "Ainda não implantado",
+  "card.noDescription": "Nenhuma descrição fornecida.",
+  "card.notDeployed": "Não implantado",
+  "card.ready": "{{count}} em execução",
+  "card.tooltip.createdAt": "Criado",
+  "card.tooltip.deployed": "Implantado",
+  "card.tooltip.deploymentStatus": "Implantação",
+  "card.tooltip.notDeployed": "Esta implantação ainda não foi implantada em nenhum ambiente.",
+  "card.tooltip.notDeployedShort": "Não implantado",
+  "card.tooltip.release": "Versão",
+  "card.tooltip.releaseName": "Nome da versão",
+  "card.tooltip.source": "Origem",
+  "common.loadFailed": "Falha ao carregar. Tente novamente mais tarde.",
+  "common.loading": "Carregando...",
+  "createGuide.actions.back": "Voltar",
+  "createGuide.actions.cancel": "Cancelar",
+  "createGuide.actions.continue": "Continuar",
+  "createGuide.actions.createAndDeploy": "Criar e implantar",
+  "createGuide.actions.creating": "Criando...",
+  "createGuide.actions.deploy": "Implantar",
+  "createGuide.actions.deploying": "Criando e implantando...",
+  "createGuide.actions.next": "Próximo",
+  "createGuide.actions.skipDeploy": "Pular, implantar depois",
+  "createGuide.description": "Crie uma implantação a partir de uma origem de versão, informações básicas e ambiente de destino.",
+  "createGuide.dsl.defaultAppName": "App DSL importado",
+  "createGuide.dsl.description": "Faça upload de um pacote DSL de Workflow para criar a implantação, a primeira versão e a implantação opcional no ambiente.",
+  "createGuide.dsl.dropDescription": "Faça upload de um pacote DSL YAML de Workflow. As opções de implantação são resolvidas a partir deste arquivo antes da implantação.",
+  "createGuide.dsl.dropTitle": "Carregar pacote DSL de Workflow",
+  "createGuide.dsl.readFailed": "Falha ao ler o arquivo DSL. Escolha outro arquivo e tente novamente.",
+  "createGuide.dsl.reading": "Lendo arquivo DSL...",
+  "createGuide.dsl.title": "Importar DSL",
+  "createGuide.dsl.unsupportedMode": "Apenas arquivos DSL de Workflow podem ser usados para implantações.",
+  "createGuide.errors.createReleaseFailed": "Falha ao criar a implantação ou a versão.",
+  "createGuide.errors.deployFailed": "Falha ao implantar no ambiente.",
+  "createGuide.method.description": "Escolha a origem usada para criar a primeira versão.",
+  "createGuide.methods.bindApp.description": "Use um Workflow App existente no Studio como origem da versão.",
+  "createGuide.methods.bindApp.title": "Vincular Workflow App existente",
+  "createGuide.methods.importDsl.description": "Faça upload de um pacote DSL YAML de Workflow e prossiga pela UI de implantação.",
+  "createGuide.methods.importDsl.title": "Importar DSL",
+  "createGuide.methods.mocked": "Simulado",
+  "createGuide.nav.back": "Implantações",
+  "createGuide.release.defaultName": "versão inicial",
+  "createGuide.release.deployInfo": "Informações da implantação",
+  "createGuide.release.description": "Preencha as informações da implantação e os detalhes da primeira versão.",
+  "createGuide.release.firstVersion": "Primeira versão",
+  "createGuide.release.instanceDescription": "Descrição da implantação",
+  "createGuide.release.instanceDescriptionPlaceholder": "Descreva para que esta implantação é usada",
+  "createGuide.release.instanceName": "Nome da implantação",
+  "createGuide.release.instanceNameConflict": "Já existe uma implantação com este nome. Escolha outro nome.",
+  "createGuide.release.releaseDescription": "Descrição da versão",
+  "createGuide.release.releaseDescriptionPlaceholder": "Descreva esta versão",
+  "createGuide.release.releaseName": "Nome da versão",
+  "createGuide.release.releaseNote": "Descrição da versão",
+  "createGuide.release.title": "Informações básicas",
+  "createGuide.source.availableApps_one": "{{count}} app",
+  "createGuide.source.availableApps_other": "{{count}} apps",
+  "createGuide.source.clearSearch": "Limpar busca de apps",
+  "createGuide.source.description": "Escolha a origem usada para criar a primeira versão.",
+  "createGuide.source.empty": "Nenhum Workflow App encontrado.",
+  "createGuide.source.searchPlaceholder": "Pesquisar apps",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "Origem da versão",
+  "createGuide.steps.method": "Origem da versão",
+  "createGuide.steps.release": "Informações básicas",
+  "createGuide.steps.source": "Origem da versão",
+  "createGuide.steps.target": "Implantar no ambiente",
+  "createGuide.target.bindingCount_one": "{{count}} vínculo",
+  "createGuide.target.bindingCount_other": "{{count}} vínculos",
+  "createGuide.target.bindingHint": "Escolha as credenciais usadas por esta versão.",
+  "createGuide.target.bindings": "Credenciais",
+  "createGuide.target.deferredBindingHint": "As credenciais serão resolvidas a partir do plano de implantação real durante a ação final de implantação.",
+  "createGuide.target.deferredEnvironmentHint": "O nome é comparado com os ambientes reais após a criação da implantação e da versão.",
+  "createGuide.target.description": "Escolha um ambiente de destino e forneça as configurações de runtime que esta versão precisa lá. Esta etapa pode ser pulada.",
+  "createGuide.target.envVarCount_one": "{{count}} variável",
+  "createGuide.target.envVarCount_other": "{{count}} variáveis",
+  "createGuide.target.envVarHint": "Para cada variável de ambiente que esta versão precisa, insira um valor personalizado ou use o valor definido no app.",
+  "createGuide.target.envVarPlaceholder": "Insira o valor",
+  "createGuide.target.envVarSource.ariaLabel": "Selecione a origem do valor da variável para {{key}}",
+  "createGuide.target.envVarSource.default": "Valor do app",
+  "createGuide.target.envVarSource.lastDeployment": "Último valor implantado",
+  "createGuide.target.envVarSource.literal": "Valor personalizado",
+  "createGuide.target.envVarType.number": "Número",
+  "createGuide.target.envVarType.secret": "Secreto",
+  "createGuide.target.envVarType.string": "Texto",
+  "createGuide.target.envVars": "Variáveis de ambiente",
+  "createGuide.target.environment": "Ambiente de destino",
+  "createGuide.target.environmentName": "Nome do ambiente",
+  "createGuide.target.environmentNamePlaceholder": "Produção",
+  "createGuide.target.loadBindingsFailed": "Falha ao carregar as credenciais.",
+  "createGuide.target.loadEnvironmentsFailed": "Falha ao carregar os ambientes de implantação.",
+  "createGuide.target.missingRequiredBinding": "Selecione uma credencial para este vínculo obrigatório.",
+  "createGuide.target.noBindingRequired": "Nenhuma credencial necessária.",
+  "createGuide.target.noCredentialCandidates": "Nenhuma credencial disponível.",
+  "createGuide.target.noEnvironmentOptions": "Nenhum ambiente de implantação disponível.",
+  "createGuide.target.required": "Obrigatório",
+  "createGuide.target.selectCredential": "Selecione uma credencial",
+  "createGuide.target.title": "Implantar no ambiente",
+  "createGuide.title": "Nova implantação",
+  "createModal.appPickerPlaceholder": "Selecione um Workflow App",
+  "createModal.appSearchEmpty": "Nenhum Workflow App correspondente",
+  "createModal.appSearchPlaceholder": "Pesquisar Workflow Apps…",
+  "createModal.cancel": "Cancelar",
+  "createModal.create": "Criar",
+  "createModal.createFailed": "Falha ao criar a implantação.",
+  "createModal.description": "Escolha um Workflow App e crie uma implantação.",
+  "createModal.descriptionLabel": "Descrição",
+  "createModal.descriptionPlaceholder": "Descreva para que esta implantação é usada",
+  "createModal.loadMoreApps": "Carregar mais apps",
+  "createModal.loadingApps": "Carregando apps…",
+  "createModal.nameLabel": "Nome da implantação",
+  "createModal.namePlaceholder": "Nome da implantação",
+  "createModal.noApps": "Nenhum Workflow App encontrado neste workspace. Crie um no Studio primeiro.",
+  "createModal.selected": "Selecionado",
+  "createModal.sourceApp": "Workflow App (obrigatório)",
+  "createModal.title": "Nova implantação",
+  "deployDrawer.bindingCount_one": "{{count}} vínculo",
+  "deployDrawer.bindingCount_other": "{{count}} vínculos",
+  "deployDrawer.bindingOptionsFailed": "Falha ao carregar as opções de credencial.",
+  "deployDrawer.bindingSelectionHint": "Escolha as credenciais usadas por esta implantação.",
+  "deployDrawer.bindingsDisabled": "Resolvido a partir da pré-visualização da versão. A edição ainda não está disponível.",
+  "deployDrawer.cancel": "Cancelar",
+  "deployDrawer.close": "Fechar painel de implantação",
+  "deployDrawer.defaultSelect": "Selecionar...",
+  "deployDrawer.deploy": "Implantar no ambiente",
+  "deployDrawer.deployExistingRelease": "Implantar no ambiente",
+  "deployDrawer.deployExistingReleaseDescription": "Selecione uma versão e um ambiente de destino para implantar.",
+  "deployDrawer.deployExistingReleaseTitle": "Implantar no ambiente",
+  "deployDrawer.deployFailed": "Falha ao iniciar a implantação.",
+  "deployDrawer.deploying": "Implantando...",
+  "deployDrawer.description": "Selecione uma versão e um ambiente de destino para implantar.",
+  "deployDrawer.envVarCount_one": "{{count}} variável",
+  "deployDrawer.envVarCount_other": "{{count}} variáveis",
+  "deployDrawer.envVarHint": "Para cada variável de ambiente que esta versão precisa, insira um valor personalizado ou use o valor definido no app.",
+  "deployDrawer.envVarPlaceholder": "Insira o valor",
+  "deployDrawer.envVarSource.ariaLabel": "Selecione a origem do valor da variável para {{key}}",
+  "deployDrawer.envVarSource.default": "Valor do app",
+  "deployDrawer.envVarSource.lastDeployment": "Último valor implantado",
+  "deployDrawer.envVarSource.literal": "Valor personalizado",
+  "deployDrawer.envVarType.number": "Número",
+  "deployDrawer.envVarType.secret": "Secreto",
+  "deployDrawer.envVarType.string": "Texto",
+  "deployDrawer.envVars": "Variáveis de ambiente",
+  "deployDrawer.existingReleaseHint": "Esta versão será implantada como está. Nenhuma nova versão será criada.",
+  "deployDrawer.loadingBindings": "Resolvendo...",
+  "deployDrawer.lockedHint": "Bloqueado no ambiente atual",
+  "deployDrawer.missingRequiredBinding": "Selecione uma credencial para este vínculo obrigatório.",
+  "deployDrawer.missingRequiredEnvVar": "Insira um valor para esta variável de ambiente obrigatória.",
+  "deployDrawer.modelCreds": "Credenciais de modelo",
+  "deployDrawer.needsValidation": " (precisa de validação)",
+  "deployDrawer.newReleaseHint": "Uma nova versão será criada a partir do YAML do Workflow App selecionado.",
+  "deployDrawer.noBindingRequired": "Não obrigatório",
+  "deployDrawer.noCredentialCandidates": "Nenhuma credencial disponível.",
+  "deployDrawer.noNewEnvironmentAvailable": "Todos os ambientes disponíveis já possuem uma implantação.",
+  "deployDrawer.noOtherReleaseAvailable": "Nenhuma outra versão está disponível para este ambiente.",
+  "deployDrawer.noReleaseAvailable": "Crie uma versão antes de implantar em um ambiente.",
+  "deployDrawer.notFound": "Implantação não encontrada.",
+  "deployDrawer.noteLabel": "Descrição da versão (opcional)",
+  "deployDrawer.notePlaceholder": "ex. Ajustar texto de onboarding",
+  "deployDrawer.pluginCreds": "Credenciais de plugin",
+  "deployDrawer.promote": "Implantar",
+  "deployDrawer.promoteDescription": "Selecione uma versão e um ambiente de destino para implantar.",
+  "deployDrawer.promoteTitle": "Implantar no ambiente",
+  "deployDrawer.readOnly": "Somente leitura",
+  "deployDrawer.redeploy": "Implantar no ambiente",
+  "deployDrawer.redeployDescription": "Selecione uma versão e um ambiente de destino para implantar.",
+  "deployDrawer.redeployExistingReleaseHint": "A versão atual será reimplantada como está. Nenhuma nova versão será criada.",
+  "deployDrawer.redeployTitle": "Implantar no ambiente",
+  "deployDrawer.releaseLabel": "Versão",
+  "deployDrawer.requiredBinding": "Obrigatório",
+  "deployDrawer.rollback": "Implantar",
+  "deployDrawer.rollbackDescription": "Selecione uma versão e um ambiente de destino para implantar.",
+  "deployDrawer.rollbackTitle": "Implantar no ambiente",
+  "deployDrawer.runtimeCredentials": "Credenciais",
+  "deployDrawer.secretPlaceholder": "secreto",
+  "deployDrawer.selectCredential": "Selecione uma credencial",
+  "deployDrawer.selectEnv": "Selecione um ambiente",
+  "deployDrawer.selectProviderCred": "Selecione a credencial de {{provider}}",
+  "deployDrawer.selectProviderKey": "Selecione a chave de {{provider}}",
+  "deployDrawer.selectRelease": "Selecione uma versão",
+  "deployDrawer.targetEnv": "Ambiente de destino",
+  "deployDrawer.title": "Implantar no ambiente",
+  "deployDrawer.valuePlaceholder": "valor",
+  "deployTab.cancelDeployment": "Cancelar implantação",
+  "deployTab.closeError": "Fechar",
+  "deployTab.col.actions": "Ações",
+  "deployTab.col.currentRelease": "Versão atual",
+  "deployTab.col.environment": "Ambiente",
+  "deployTab.col.status": "Status",
+  "deployTab.col.updated": "Atualizado",
+  "deployTab.collapseDetails": "Recolher detalhes da implantação",
+  "deployTab.confirmUndeploy": "Desimplantar",
+  "deployTab.deployOtherVersion": "Implantar outra versão",
+  "deployTab.deployToEnv": "Implantar em {{name}}",
+  "deployTab.deployToNewEnv": "Implantar em novo ambiente...",
+  "deployTab.empty": "Nenhuma instância ainda. Implante em um novo ambiente para começar.",
+  "deployTab.emptyDescription": "Escolha uma versão e um ambiente de destino para tornar esta implantação disponível aos usuários.",
+  "deployTab.emptyTitle": "Nenhum ambiente em execução ainda",
+  "deployTab.envCount": "Ambientes",
+  "deployTab.errorCode": "Código",
+  "deployTab.errorDialogDesc": "Revise a última implantação que falhou antes de tentar novamente ou implantar outra versão.",
+  "deployTab.errorDialogTitle": "Erro de implantação em {{name}}",
+  "deployTab.errorMessage": "Mensagem",
+  "deployTab.errorPhase": "Fase",
+  "deployTab.expandDetails": "Expandir detalhes da implantação",
+  "deployTab.moreActions": "Mais ações",
+  "deployTab.newDeployment": "Implantar em novo ambiente",
+  "deployTab.panel.commit": "ID do Commit",
+  "deployTab.panel.deploymentId": "ID da implantação",
+  "deployTab.panel.endpoints": "Endpoints",
+  "deployTab.panel.envVars": "Variáveis de ambiente",
+  "deployTab.panel.error": "Erro",
+  "deployTab.panel.failedRelease": "Versão com falha",
+  "deployTab.panel.health": "Saúde",
+  "deployTab.panel.instanceInfo": "Informações da instância",
+  "deployTab.panel.modelCreds": "Credenciais de modelo",
+  "deployTab.panel.pluginCreds": "Credenciais de plugin",
+  "deployTab.panel.release": "Versão",
+  "deployTab.panel.releaseCreatedAt": "Versão criada em",
+  "deployTab.panel.releaseInfo": "Informações da versão",
+  "deployTab.panel.replicas": "Réplicas",
+  "deployTab.panel.run": "Executar",
+  "deployTab.panel.runtimeBindings": "Credenciais",
+  "deployTab.panel.runtimeInfo": "Informações de runtime",
+  "deployTab.panel.runtimeMode": "Modo de runtime",
+  "deployTab.panel.runtimeNote": "Nota de runtime",
+  "deployTab.panel.targetRelease": "Versão de destino",
+  "deployTab.panel.unknownError": "A implantação falhou.",
+  "deployTab.promote": "Implantar",
+  "deployTab.redeploy": "Reimplantar",
+  "deployTab.releaseCreatedAt": "Versão criada {{time}}",
+  "deployTab.retry": "Tentar novamente",
+  "deployTab.shortcut": "Atalho",
+  "deployTab.status.deployFailed": "Falha na implantação",
+  "deployTab.status.deployingRelease": "Implantando ({{release}})",
+  "deployTab.status.runningOutOfSync": "Em execução (sincronização pendente)",
+  "deployTab.status.runningWithFailed": "Em execução (última implantação falhou)",
+  "deployTab.undeploy": "Desimplantar",
+  "deployTab.undeployConfirmDesc": "O acesso do usuário final será interrompido imediatamente. A versão pode ser reimplantada posteriormente.",
+  "deployTab.undeployConfirmTitle": "Desimplantar de {{name}}?",
+  "deployTab.undeployFrom": "Desimplantar de {{name}}",
+  "deployTab.undeployImpactTitle": "Instância afetada",
+  "deployTab.viewError": "Ver erro",
+  "deployTab.viewLogs": "Ver logs",
+  "deployTab.viewProgress": "Ver progresso",
+  "detail.backToInstances": "Voltar para implantações",
+  "detail.deployingCount": "{{count}} implantando",
+  "detail.envCount_one": "{{count}} ambiente",
+  "detail.envCount_other": "{{count}} ambientes",
+  "detail.failedCount": "{{count}} falharam",
+  "detail.mobileTabs": "Seções da implantação",
+  "detail.notFound": "Implantação não encontrada",
+  "detail.openSourceApp": "Abrir origem {{name}}",
+  "detail.sourceApp": "Origem",
+  "detail.sourceAppLink": "Origem",
+  "documentTitle.create": "Nova implantação · Implantações",
+  "documentTitle.detail": "Implantação · Implantações",
+  "documentTitle.list": "Implantações",
+  "filter.allEnvs": "Todos os ambientes",
+  "filter.notDeployed": "Não implantado",
+  "filter.searchPlaceholder": "Pesquisar implantações",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Admissão",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Inicializando",
+  "health.ENVIRONMENT_STATUS_DELETING": "Excluindo",
+  "health.ENVIRONMENT_STATUS_FAILED": "Indisponível",
+  "health.ENVIRONMENT_STATUS_READY": "Disponível",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Desconhecido",
+  "list.clearFilters": "Limpar filtros",
+  "list.clearSearch": "Limpar busca de implantação",
+  "list.createDeployment": "Nova",
+  "list.empty": "Nenhuma implantação encontrada.",
+  "list.emptyDescription": "Crie uma implantação a partir de um Workflow App ou pacote DSL de Workflow para gerenciar versões, ambientes e acesso.",
+  "list.emptyFilteredDescription": "Nenhuma implantação corresponde à busca atual ou ao filtro de ambiente.",
+  "list.emptyFilteredTitle": "Nenhuma implantação correspondente",
+  "list.emptyTitle": "Nenhuma implantação ainda",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Isolado",
+  "mode.ENVIRONMENT_MODE_SHARED": "Compartilhado",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Desconhecido",
+  "newInstance.comingSoon": "Em breve",
+  "newInstance.fromStudio": "Selecionar do Studio",
+  "newInstance.importDSL": "Importar DSL",
+  "newInstance.title": "Nova implantação",
+  "overview.accessEndpoints": "Endpoints de acesso",
+  "overview.accessMeta.apiTokens": "Gerenciar Tokens de API",
+  "overview.accessMeta.cli": "Ver acesso via CLI",
+  "overview.accessMeta.webApp": "Gerenciar acesso ao WebApp",
+  "overview.accessStatus": "Acesso",
+  "overview.api": "Tokens de API",
+  "overview.apiKeysCount_one": "{{count}} Token de API",
+  "overview.apiKeysCount_other": "{{count}} Tokens de API",
+  "overview.apiTokenSummary.environments_one": "{{count}} ambiente implantado",
+  "overview.apiTokenSummary.environments_other": "{{count}} ambientes implantados",
+  "overview.availableForDeployment": "Disponível para implantação",
+  "overview.basicInfo": "Informações básicas",
+  "overview.cardAction.deployLatest": "Implantar última versão",
+  "overview.cardAction.redeploy": "Reimplantar",
+  "overview.cardAction.viewProgress": "Ver implantação",
+  "overview.chip.behindTooltip_one": "1 versão atrás da mais recente. Implante a última versão para atualizar.",
+  "overview.chip.behindTooltip_other": "{{count}} versões atrás da mais recente. Implante a última versão para atualizar.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "implantando",
+  "overview.chip.deployingTooltip": "A implantação está em andamento.",
+  "overview.chip.empty": "vazio",
+  "overview.chip.emptyTooltip": "Nenhuma versão está implantada neste ambiente.",
+  "overview.chip.failed": "falhou",
+  "overview.chip.failedTooltip": "A última tentativa de implantação falhou.",
+  "overview.chip.latest": "mais recente",
+  "overview.chip.latestTooltip": "Este ambiente está executando a versão mais recente.",
+  "overview.chip.needsReleaseFirst": "Crie uma versão primeiro",
+  "overview.chip.olderRelease": "anterior",
+  "overview.chip.olderReleaseTooltip": "Este ambiente está executando uma versão mais antiga.",
+  "overview.chip.openInDeployTab": "Ver progresso da implantação",
+  "overview.cli": "CLI",
+  "overview.configured": "Configurado",
+  "overview.createRelease": "Criar versão",
+  "overview.created": "Criado",
+  "overview.deploy": "Implantar",
+  "overview.deployedEnvironments": "implantado",
+  "overview.deploymentOverview": "Visão geral da implantação",
+  "overview.deploymentStatus": "Status da implantação",
+  "overview.description": "Descrição",
+  "overview.developerApi": "API do desenvolvedor",
+  "overview.disabled": "Desativado",
+  "overview.emptyValue": "Não definido",
+  "overview.enabled": "Ativado",
+  "overview.enabledChannels": "acesso ativado",
+  "overview.endUserAccess": "Acesso do usuário final",
+  "overview.environments": "Ambientes",
+  "overview.hero.byName": "por {{name}}",
+  "overview.hero.empty": "Nenhuma versão ainda",
+  "overview.hero.emptyDescription": "Crie uma versão a partir da origem atual antes de implantar.",
+  "overview.hero.propagation_one": "implantado em {{count}}/{{total}} ambiente",
+  "overview.hero.propagation_other": "implantado em {{count}}/{{total}} ambientes",
+  "overview.hero.untargeted": "nenhum ambiente configurado ainda",
+  "overview.instanceDetails": "Detalhes da implantação",
+  "overview.instanceId": "ID da implantação",
+  "overview.latestRelease.releaseCount_one": "{{count}} versão",
+  "overview.latestRelease.releaseCount_other": "{{count}} versões",
+  "overview.latestReleaseTitle": "Última versão",
+  "overview.manageDeployments": "Gerenciar implantações",
+  "overview.name": "Nome",
+  "overview.noAccessConfig": "Nenhuma configuração de acesso.",
+  "overview.noReleaseYet": "Crie uma versão antes de implantar em um ambiente.",
+  "overview.notConfigured": "Não configurado",
+  "overview.previousReleases.empty": "Nenhuma versão anterior ainda.",
+  "overview.previousReleases.retired": "Atualmente não implantada",
+  "overview.previousReleases.title": "Versões anteriores",
+  "overview.previousReleases.viewAll": "Ver todas",
+  "overview.ready": "Pronto para implantar",
+  "overview.recentReleases": "Versões recentes",
+  "overview.releaseDeployedTitle": "{{release}} está implantada",
+  "overview.releaseReadyTitle": "{{release}} está pronta para implantar",
+  "overview.serviceMap": "Mapa de serviços",
+  "overview.servingRelease": "Servindo {{release}}",
+  "overview.servingReleaseDescription": "Esta implantação está implantada em {{count}}/{{total}} ambientes.",
+  "overview.strip.deployToNewEnvironment": "Implantar em novo ambiente",
+  "overview.strip.empty": "Nenhum ambiente configurado.",
+  "overview.strip.emptyDeployableDescription": "Implante a última versão em um ambiente quando estiver pronto.",
+  "overview.strip.emptyDeployed": "Nenhuma instância ainda.",
+  "overview.strip.emptyDescription": "Crie uma versão antes de implantar em um ambiente.",
+  "overview.strip.emptyTitle": "Nenhuma instância ainda",
+  "overview.strip.summary_one": "1 de {{total}} na versão mais recente",
+  "overview.strip.summary_other": "{{count}} de {{total}} na versão mais recente",
+  "overview.strip.title": "Instâncias",
+  "overview.switchSourceApp": "Trocar origem",
+  "overview.switchSourceAppDescription": "Escolha o Workflow App usado como origem para versões futuras.",
+  "overview.switchSourceAppHint": "Após a troca, apenas versões recém-criadas usam a nova origem. Versões históricas e implantações existentes não são alteradas.",
+  "overview.targetRelease": "Versão de destino",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Zona de perigo",
+  "settings.dangerDesc": "Exclua permanentemente esta implantação e interrompa todas as instâncias em execução. Isso não pode ser desfeito.",
+  "settings.delete": "Excluir implantação",
+  "settings.deleteConfirmDesc": "Excluir {{name}}? Todas as instâncias serão interrompidas e removidas em todos os ambientes. Isso não pode ser desfeito.",
+  "settings.deleteConfirmTitle": "Excluir implantação",
+  "settings.deleteFailed": "Falha ao excluir a implantação.",
+  "settings.deleteImpact": "Impacto",
+  "settings.deleteImpactInstance": "Implantação",
+  "settings.deleteImpactTitle": "Implantação afetada",
+  "settings.deleteImpactValue": "A implantação é removida da lista de implantações.",
+  "settings.deleted": "Implantação excluída",
+  "settings.description": "Descrição",
+  "settings.descriptionHelp": "Gerencie o nome, a descrição e outras configurações desta implantação.",
+  "settings.general": "Geral",
+  "settings.name": "Nome da implantação",
+  "settings.reset": "Redefinir",
+  "settings.save": "Salvar alterações",
+  "settings.updateFailed": "Falha ao atualizar a implantação.",
+  "settings.updated": "Implantação atualizada",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Implantando",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sincronização pendente",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Falha na implantação",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Inválido",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Em execução",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Não implantado",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Desimplantando",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconhecido",
+  "subtitle": "Gerencie implantações em todos os ambientes.",
+  "tabs.access.description": "Gerencie canais de acesso e permissões de acesso.",
+  "tabs.access.name": "Acesso",
+  "tabs.api-tokens.description": "Gerencie Tokens de API e invoque instâncias por HTTP.",
+  "tabs.api-tokens.name": "Tokens de API",
+  "tabs.instances.description": "Veja e gerencie instâncias em ambientes implantados.",
+  "tabs.instances.name": "Instâncias",
+  "tabs.overview.description": "Veja o status da implantação em todos os ambientes.",
+  "tabs.overview.name": "Visão geral",
+  "tabs.releases.description": "Crie, implante e gerencie versões.",
+  "tabs.releases.name": "Versões",
+  "tabs.settings.description": "Gerencie o nome, a descrição e outras configurações desta implantação.",
+  "tabs.settings.name": "Configurações",
+  "title": "Implantações",
+  "unsupportedDslNodes.description": "Esta versão contém nós que o runtime de implantação ainda não suporta. Remova-os ou substitua-os no Studio e tente novamente.",
+  "unsupportedDslNodes.descriptionWithTypes": "Esta versão contém nós que o runtime de implantação ainda não suporta: {{nodeTypes}}. Remova-os ou substitua-os no Studio e tente novamente.",
+  "unsupportedDslNodes.title": "Nós não suportados",
+  "unsupportedDslNodes.unknownType": "Tipo desconhecido",
+  "versions.cancelCreate": "Cancelar",
+  "versions.cancelDelete": "Cancelar",
+  "versions.cancelEdit": "Cancelar",
+  "versions.checkingReleaseContent": "Verificando o conteúdo da versão...",
+  "versions.col.action": "Ação",
+  "versions.col.author": "Criado por",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Criado em",
+  "versions.col.deployedTo": "Implantado em",
+  "versions.col.release": "Versão",
+  "versions.col.sourceApp": "Origem",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Criar",
+  "versions.createFailed": "Falha ao criar a versão.",
+  "versions.createRelease": "Criar versão",
+  "versions.createReleaseDescription": "Crie uma versão implantável a partir de um Workflow App ou de um arquivo DSL de Workflow.",
+  "versions.createReleaseHint": "Novas versões podem ser implantadas em qualquer ambiente.",
+  "versions.createSuccess": "Versão \"{{name}}\" criada.",
+  "versions.creating": "Criando...",
+  "versions.currentOn": "Versão atual em {{name}}",
+  "versions.deleteConfirmDesc": "A versão \"{{name}}\" será excluída permanentemente. Isso não pode ser desfeito.",
+  "versions.deleteConfirmTitle": "Excluir versão?",
+  "versions.deleteFailed": "Falha ao excluir a versão.",
+  "versions.deleteImpactDeployment": "Status da implantação",
+  "versions.deleteImpactNotDeployed": "Atualmente não implantada",
+  "versions.deleteImpactRelease": "Versão",
+  "versions.deleteImpactTitle": "Impacto da exclusão",
+  "versions.deleteRelease": "Excluir versão",
+  "versions.deleteSuccess": "Versão \"{{name}}\" excluída.",
+  "versions.deploy": "Implantar",
+  "versions.deployTo": "Implantar em {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Implantando",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sincronização pendente",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Falhou",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Inválido",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Em execução",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Não implantado",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Desimplantando",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconhecido",
+  "versions.deployingTo": "{{name}} está implantando",
+  "versions.disabledReason.checkDeploymentsFailed": "Não foi possível verificar o uso da implantação. Tente novamente mais tarde.",
+  "versions.disabledReason.checkingDeployments": "Verificando uso da implantação",
+  "versions.disabledReason.current": "Esta versão já está em execução em {{name}}",
+  "versions.disabledReason.deploying": "Aguarde a conclusão da implantação ativa",
+  "versions.disabledReason.envDisabled": "Este ambiente não é implantável",
+  "versions.disabledReason.releaseInUse_one": "Desimplante esta versão de {{count}} ambiente antes de excluí-la",
+  "versions.disabledReason.releaseInUse_other": "Desimplante esta versão de {{count}} ambientes antes de excluí-la",
+  "versions.dslReadFailed": "Falha ao ler o arquivo DSL. Escolha outro arquivo e tente novamente.",
+  "versions.dslReading": "Lendo arquivo DSL...",
+  "versions.dslUnsupportedMode": "Apenas arquivos DSL de Workflow podem ser usados para implantações.",
+  "versions.editFailed": "Falha ao atualizar a versão.",
+  "versions.editRelease": "Editar versão",
+  "versions.editReleaseDescription": "Atualize o nome e a descrição desta versão.",
+  "versions.editSuccess": "Versão \"{{name}}\" atualizada.",
+  "versions.empty": "Nenhuma versão disponível ainda.",
+  "versions.emptyDescription": "Crie a primeira versão antes de implantar em um ambiente.",
+  "versions.emptyTitle": "Nenhuma versão ainda",
+  "versions.emptyWithCreate": "Nenhuma versão ainda. Crie a primeira versão implantável antes de implantar.",
+  "versions.exportDsl": "Exportar DSL",
+  "versions.exportDslFailed": "Falha ao exportar DSL.",
+  "versions.exportingDsl": "Exportando...",
+  "versions.groupHeader.deploy": "Implantar",
+  "versions.groupHeader.promote": "Implantar",
+  "versions.groupHeader.rollback": "Implantar versão anterior",
+  "versions.groupHeader.unavailable": "Indisponível",
+  "versions.manualDslOption": "Carregar DSL",
+  "versions.moreActions": "Mais ações",
+  "versions.optional": "Opcional",
+  "versions.promote": "Implantar",
+  "versions.promoteTo": "Implantar em {{name}}",
+  "versions.releaseAlreadyExists": "Já existe uma versão com o mesmo conteúdo: {{name}}.",
+  "versions.releaseContentCheckFailed": "Falha ao verificar o conteúdo da versão.",
+  "versions.releaseDescriptionLabel": "Descrição",
+  "versions.releaseDescriptionPlaceholder": "Descreva esta versão",
+  "versions.releaseHistory": "Histórico de versões",
+  "versions.releaseNameLabel": "Nome da versão",
+  "versions.releaseNamePlaceholder": "Nome da versão",
+  "versions.releaseNameRequired": "Insira um nome de versão.",
+  "versions.releaseSourceLabel": "Origem da versão",
+  "versions.rollbackTo": "Implantar em {{name}}",
+  "versions.saveEdit": "Salvar",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/pt-BR/workflow.json b/web/i18n/pt-BR/workflow.json
index a4a12926612..eb35b5fd28e 100644
--- a/web/i18n/pt-BR/workflow.json
+++ b/web/i18n/pt-BR/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "Agente",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Resposta",
   "blocks.assigner": "Atribuidor de Variáveis",
   "blocks.code": "Código",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Agregador de variáveis",
   "blocks.variable-assigner": "Atribuidor de variáveis",
   "blocksAbout.agent": "Invocar grandes modelos de linguagem para responder a perguntas ou processar linguagem natural",
+  "blocksAbout.agent-v2": "Invocar grandes modelos de linguagem para responder a perguntas ou processar linguagem natural",
   "blocksAbout.answer": "Definir o conteúdo da resposta de uma conversa",
   "blocksAbout.assigner": "O nó de atribuição de variáveis é usado para atribuir valores a variáveis graváveis (como variáveis de conversação).",
   "blocksAbout.code": "Executar um pedaço de código Python ou NodeJS para implementar lógica personalizada",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID do fluxo de trabalho",
   "globalVar.fieldsDescription.workflowRunId": "ID da execução do fluxo de trabalho",
   "globalVar.title": "Variáveis do sistema",
+  "nodes.agent.advancedSetting": "Configurações avançadas",
   "nodes.agent.checkList.strategyNotSelected": "Estratégia não selecionada",
   "nodes.agent.clickToViewParameterSchema": "Clique para ver o esquema de parâmetros",
   "nodes.agent.configureModel": "Configurar modelo",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Modelo não suportado",
   "nodes.agent.modelSelectorTooltips.deprecated": "Este modelo está obsoleto",
   "nodes.agent.notAuthorized": "Não autorizado",
+  "nodes.agent.outputVars.confirm": "Confirmar",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Insira um array JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Insira true ou false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Os valores padrão de arquivo ainda não são configuráveis aqui.",
+  "nodes.agent.outputVars.defaultValueLabel": "Padrão",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Insira um número válido.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Insira um objeto JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Valor padrão",
+  "nodes.agent.outputVars.delete": "Excluir {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Descrição",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Adicionar descrição",
+  "nodes.agent.outputVars.edit": "Editar {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Editor de variáveis de saída",
   "nodes.agent.outputVars.files.title": "Arquivos gerados pelo agente",
   "nodes.agent.outputVars.files.transfer_method": "Método de transferência. O valor é remote_url ou local_file",
   "nodes.agent.outputVars.files.type": "Tipo de suporte. Agora suporta apenas imagem",
   "nodes.agent.outputVars.files.upload_file_id": "Carregar ID do arquivo",
   "nodes.agent.outputVars.files.url": "URL da imagem",
   "nodes.agent.outputVars.json": "JSON gerado pelo agente",
+  "nodes.agent.outputVars.nameDuplicate": "O nome de saída já existe",
+  "nodes.agent.outputVars.nameInvalid": "Use letras, números e sublinhados. Comece com uma letra ou sublinhado.",
+  "nodes.agent.outputVars.nameLabel": "Nome do campo",
+  "nodes.agent.outputVars.namePlaceholder": "Nome do campo",
+  "nodes.agent.outputVars.newOutput": "Nova saída",
+  "nodes.agent.outputVars.requiredLabel": "Obrigatório",
+  "nodes.agent.outputVars.showAdvancedOptions": "Mostrar opções avançadas",
   "nodes.agent.outputVars.text": "Conteúdo gerado pelo agente",
+  "nodes.agent.outputVars.typeLabel": "Tipo de saída",
   "nodes.agent.outputVars.usage": "Informações de uso do modelo",
   "nodes.agent.parameterSchema": "Esquema de Parâmetro",
   "nodes.agent.pluginInstaller.install": "Instalar",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Este integração é instalado a partir do GitHub. Por favor, vá para Integrações para reinstalar",
   "nodes.agent.pluginNotInstalled": "Este integração não está instalado",
   "nodes.agent.pluginNotInstalledDesc": "Este integração é instalado a partir do GitHub. Por favor, vá para Integrações para reinstalar",
+  "nodes.agent.roster.change": "Alterar",
+  "nodes.agent.roster.editInConsole": "Editar no Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Uma configuração pontual que existe apenas neste nó",
+  "nodes.agent.roster.inlineSetup.name": "Configuração inline",
+  "nodes.agent.roster.inlineSetup.title": "Configuração do agente",
+  "nodes.agent.roster.inlineSetup.type": "Apenas neste nó",
+  "nodes.agent.roster.label": "Agente",
+  "nodes.agent.roster.makeCopy": "Fazer uma cópia",
+  "nodes.agent.roster.more": "Mais ações do agente",
+  "nodes.agent.roster.openPanel": "Abrir detalhes de {{name}}",
+  "nodes.agent.roster.panelLabel": "Detalhes de {{name}}",
   "nodes.agent.strategy.configureTip": "Configure a estratégia agente.",
   "nodes.agent.strategy.configureTipDesc": "Depois de configurar a estratégia agêntica, esse nó carregará automaticamente as configurações restantes. A estratégia afetará o mecanismo de raciocínio da ferramenta de várias etapas.",
   "nodes.agent.strategy.label": "Estratégia Agêntica",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "A versão do plug-in instalada não fornece essa estratégia. Clique para mudar de versão.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} não está instalado",
   "nodes.agent.strategyNotSet": "Estratégia agêntica não definida",
+  "nodes.agent.task.insert": "Inserir",
+  "nodes.agent.task.label": "Tarefa do agente",
+  "nodes.agent.task.mention": "Mencionar",
+  "nodes.agent.task.placeholder": "Descreva o que este agente deve fazer...",
+  "nodes.agent.task.tooltip": "Defina as instruções da tarefa que este agente deve seguir neste workflow.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Não autorizado",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} não está instalado",
   "nodes.agent.toolbox": "caixa de ferramentas",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Por {{author}}",
   "tabs.question-understand": "Compreensão de perguntas",
   "tabs.requestToCommunity": "Solicitações à comunidade",
-  "tabs.searchBlock": "Nó de busca",
+  "tabs.searchBlock": "Buscar nós, agente, humano, conhecimento",
   "tabs.searchDataSource": "Fonte de dados de pesquisa",
   "tabs.searchSnippets": "Trechos de pesquisa...",
   "tabs.searchTool": "Ferramenta de pesquisa",
diff --git a/web/i18n/ro-RO/agent-v-2.json b/web/i18n/ro-RO/agent-v-2.json
new file mode 100644
index 00000000000..f53d4f4c201
--- /dev/null
+++ b/web/i18n/ro-RO/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Această acțiune nu este încă disponibilă.",
+  "agentDetail.access.actions.monitoring": "Monitorizare",
+  "agentDetail.access.copyAccessUrl": "Copiază URL-ul de acces",
+  "agentDetail.access.copyFailed": "Copierea referinței a eșuat.",
+  "agentDetail.access.copyReference": "Copiază referința pentru {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Copiază endpoint-ul API-ului de serviciu",
+  "agentDetail.access.description": "Toate suprafețele de la care acest agent poate fi accesat.",
+  "agentDetail.access.empty": "Niciun punct de acces asociat",
+  "agentDetail.access.emptyDescription": "Acest agent din roster nu are încă referințe către aplicații sau workflow-uri.",
+  "agentDetail.access.entries.agentApp.description": "Aplicație agent asociată acestui agent din roster.",
+  "agentDetail.access.entries.agentApp.name": "Aplicație agent",
+  "agentDetail.access.entries.workflow.description": "Workflow și referință de nod asociate acestui agent din roster.",
+  "agentDetail.access.entries.workflow.name": "Nod de workflow",
+  "agentDetail.access.entryCount_one": "{{count}} intrare",
+  "agentDetail.access.entryCount_other": "{{count}} intrări",
+  "agentDetail.access.groups.references.heading": "Referințe",
+  "agentDetail.access.groups.references.label": "Referințe asociate",
+  "agentDetail.access.learnMore": "Află mai multe",
+  "agentDetail.access.moreActions": "Mai multe acțiuni pentru {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Endpoint API serviciu",
+  "agentDetail.access.serviceApi.title": "API de serviciu backend",
+  "agentDetail.access.status.disabled": "Dezactivat",
+  "agentDetail.access.status.enabled": "Activat",
+  "agentDetail.access.status.inService": "În serviciu",
+  "agentDetail.access.status.outOfService": "Scos din serviciu",
+  "agentDetail.access.title": "Punct de acces",
+  "agentDetail.access.toggleSurface": "Comută accesul pentru {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL de acces",
+  "agentDetail.access.webApp.actions.customize": "Personalizează",
+  "agentDetail.access.webApp.actions.embedded": "Încorporat",
+  "agentDetail.access.webApp.actions.launch": "Lansează",
+  "agentDetail.access.webApp.actions.settings": "Setări",
+  "agentDetail.access.webApp.refreshUrl": "Reîmprospătează URL-ul de acces",
+  "agentDetail.access.webApp.showQrCode": "Afișează codul QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO activat",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Utilizat ca nod în cadrul workflow-ului",
+  "agentDetail.access.workflow.empty": "Nu există încă referințe de workflow.",
+  "agentDetail.access.workflow.loadFailed": "Încărcarea referințelor workflow-ului a eșuat.",
+  "agentDetail.access.workflow.loading": "Se încarcă referințele workflow-ului…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} nod",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} noduri",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Deschide în Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Deschide {{name}} în Studio",
+  "agentDetail.access.workflow.table.actions": "Acțiuni",
+  "agentDetail.access.workflow.table.lastUpdated": "Ultima actualizare",
+  "agentDetail.access.workflow.table.name": "Nume",
+  "agentDetail.access.workflow.table.nodes": "Noduri",
+  "agentDetail.access.workflow.table.version": "Versiune",
+  "agentDetail.access.workflow.title": "Acces prin workflow",
+  "agentDetail.configure.advancedSettings.description": "Pentru utilizatori avansați. Variabile de mediu, sandbox și memorie.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Adaugă variabilă de mediu",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Șterge {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Ascunde valoarea {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Importă .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Pentru a afișa fișierele .env ascunse, apăsați Command + Shift + . în selectorul de fișiere.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Dacă fișierul .env este ascuns, activați fișierele ascunse în selectorul de fișiere al sistemului.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Pentru a afișa fișierele .env ascunse, activați Elemente ascunse în File Explorer.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Dezvăluie valoarea {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Selectați domeniul variabilei de mediu",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Variabile de mediu disponibile pentru acest agent în timpul execuției.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Comută Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Setări avansate",
+  "agentDetail.configure.advancedSettings.toggle": "Comută setările avansate",
+  "agentDetail.configure.chatFeatures.description": "Modelează experiența de chat a utilizatorului final pe webapp-ul tău și pe suprafețele de chat.",
+  "agentDetail.configure.chatFeatures.title": "Funcții de chat",
+  "agentDetail.configure.files.add": "Adaugă fișier",
+  "agentDetail.configure.files.empty.description": "Încarcă documente pe care agentul le poate citi, precum specificații, șabloane sau ghiduri",
+  "agentDetail.configure.files.empty.title": "Niciun fișier încă",
+  "agentDetail.configure.files.label": "Fișiere",
+  "agentDetail.configure.files.preview.empty": "Niciun conținut de previzualizat.",
+  "agentDetail.configure.files.preview.failed": "Încărcarea previzualizării a eșuat.",
+  "agentDetail.configure.files.preview.unsupported": "Acest fișier nu acceptă previzualizarea.",
+  "agentDetail.configure.files.remove": "Elimină {{name}}",
+  "agentDetail.configure.files.tip": "Fișiere pe care acest agent le poate folosi în timpul orchestrării sarcinilor.",
+  "agentDetail.configure.files.toggle": "Comută fișierele",
+  "agentDetail.configure.files.treeLabel": "Fișierele agentului",
+  "agentDetail.configure.files.upload.action": "Încarcă",
+  "agentDetail.configure.files.upload.browse": "răsfoiește",
+  "agentDetail.configure.files.upload.description": "Încarcă un fișier pentru acest agent.",
+  "agentDetail.configure.files.upload.dropzone": "Plasează un fișier aici sau",
+  "agentDetail.configure.files.upload.failed": "Încărcarea fișierului a eșuat.",
+  "agentDetail.configure.files.upload.fileType": "FIȘIER",
+  "agentDetail.configure.files.upload.invalidFile": "Încărcați un singur fișier.",
+  "agentDetail.configure.files.upload.success": "Fișier încărcat.",
+  "agentDetail.configure.files.upload.title": "Încarcă fișier",
+  "agentDetail.configure.knowledgeRetrieval.add": "Adaugă recuperare de cunoștințe",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Adaugă cunoștințe",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Faceți clic pe butonul „+” pentru a adăuga cunoștințe",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Cunoștințe",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Setări de recuperare",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Aflați mai multe despre recuperarea cunoștințelor",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Automat",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Condiții",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Dezactivat",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Filtrare metadate",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manual",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Selectați modul de filtrare a metadatelor",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Nume recuperare de cunoștințe",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Agentul decide",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Agentul își scrie propria interogare pornind de la prompt și contextul disponibil. Nu este nimic de configurat aici.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Interogare personalizată",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Scrieți o interogare fixă pentru această sursă de recuperare.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Text interogare personalizată",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Introduceți o interogare de căutare",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Interogare",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Recuperare de cunoștințe · Agentul decide",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Editați {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Conectați o bază de cunoștințe pe care agentul o poate căuta atunci când răspunde",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Nicio cunoștință încă",
+  "agentDetail.configure.knowledgeRetrieval.label": "Recuperare de cunoștințe",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Elimină {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Sursele de recuperare de cunoștințe pe care acest agent le poate folosi în timpul orchestrării sarcinilor.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Comută recuperarea de cunoștințe",
+  "agentDetail.configure.model.label": "Model",
+  "agentDetail.configure.orchestrate": "Orchestrare",
+  "agentDetail.configure.preview.chatFeatures": "Funcții de chat",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agent",
+  "agentDetail.configure.preview.empty.description": "Trimiteți un mesaj pentru a testa ciorna curentă.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Nu există încă instrucțiuni, așa că răspunsurile vin de la modelul de bază.",
+  "agentDetail.configure.preview.endUserAuth": "Autentificare utilizator final",
+  "agentDetail.configure.preview.restart": "Reporniți previzualizarea",
+  "agentDetail.configure.preview.title": "Previzualizare",
+  "agentDetail.configure.prompt.copied": "Prompt copiat",
+  "agentDetail.configure.prompt.copy": "Copiază prompt-ul",
+  "agentDetail.configure.prompt.copyFailed": "Copierea prompt-ului a eșuat.",
+  "agentDetail.configure.prompt.insert.label": "Inserează",
+  "agentDetail.configure.prompt.insert.question": "Întrebare de start",
+  "agentDetail.configure.prompt.insert.reportFile": "Fișier de raport de ieșire",
+  "agentDetail.configure.prompt.insert.tenders": "Listă de licitații de start",
+  "agentDetail.configure.prompt.label": "Prompt",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Menționează",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Scrieți instrucțiunile aici,",
+  "agentDetail.configure.prompt.tip": "Definiți modul în care acest agent ar trebui să interpreteze intrările, să apeleze instrumentele și să producă ieșirile.",
+  "agentDetail.configure.publishBar.draft": "Ciornă",
+  "agentDetail.configure.publishBar.publishUpdate": "Publică actualizarea",
+  "agentDetail.configure.publishBar.published": "Publicat",
+  "agentDetail.configure.publishBar.publishedAt": "Publicat {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Se publică…",
+  "agentDetail.configure.publishBar.saved": "Salvat acum 5 min",
+  "agentDetail.configure.publishBar.savedAt": "Salvat {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Modificări nepublicate",
+  "agentDetail.configure.publishBar.upToDate": "La zi",
+  "agentDetail.configure.publishBar.versionHistory": "Deschide istoricul versiunilor",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Workflow-uri afectate",
+  "agentDetail.configure.publishImpact.cancel": "Anulează",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Agentul tău apare în",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Modificările le vor afecta.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "acest agent",
+  "agentDetail.configure.publishImpact.title": "{{action}} pentru {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} workflow",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} workflow-uri",
+  "agentDetail.configure.skills.add": "Adaugă abilitate",
+  "agentDetail.configure.skills.detail.contentRegion": "Conținutul detaliilor abilității",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} FIȘIERE",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Fișierele abilității",
+  "agentDetail.configure.skills.detail.files": "Fișiere",
+  "agentDetail.configure.skills.empty.description": "Abilitățile oferă agentului expertiză reutilizabilă pe care o poate apela în timpul lucrului",
+  "agentDetail.configure.skills.empty.title": "Nicio abilitate încă",
+  "agentDetail.configure.skills.itemType": "Abilitate",
+  "agentDetail.configure.skills.label": "Abilități",
+  "agentDetail.configure.skills.remove": "Elimină {{name}}",
+  "agentDetail.configure.skills.tip": "Abilități pe care acest agent le poate folosi în timpul orchestrării sarcinilor.",
+  "agentDetail.configure.skills.toggle": "Comută abilitățile",
+  "agentDetail.configure.skills.upload.action": "Încarcă",
+  "agentDetail.configure.skills.upload.browse": "răsfoiește",
+  "agentDetail.configure.skills.upload.description": "Încarcă un pachet .zip sau .skill pentru acest agent.",
+  "agentDetail.configure.skills.upload.dropzone": "Plasează un pachet de abilitate aici sau",
+  "agentDetail.configure.skills.upload.failed": "Încărcarea abilității a eșuat.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Încărcați un fișier .zip sau .skill.",
+  "agentDetail.configure.skills.upload.success": "Abilitate încărcată.",
+  "agentDetail.configure.skills.upload.title": "Încarcă abilitate",
+  "agentDetail.configure.tools.add": "Adaugă instrument",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Pentru dezvoltatori",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Instalați un program de linie de comandă pe care agentul îl rulează în sandbox-ul său. Necesită instalare și, de obicei, chei API.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Instrument CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Alegeți un instrument deja prezent în acest workspace, precum căutarea web sau integrări.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Instrument",
+  "agentDetail.configure.tools.cliDialog.description": "Instalați un instrument CLI dintr-un registru de pachete. Agentul obține acces shell la binarul furnizat.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Editați instrumentul CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Stocați cheile API, token-urile sau secretele de care are nevoie acest instrument CLI. Valorile sunt criptate în repaus și injectate ca variabile de mediu atunci când agentul apelează instrumentul.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Variabile de mediu",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(opțional)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "În sandbox · rulat o singură dată la prima invocare",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Comandă de instalare",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Lipiți comanda de instalare aici, de ex. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Comanda de instalare este obligatorie.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Aflați mai multe despre instrumentul CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Numele instrumentului CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Denumiți instrumentul CLI",
+  "agentDetail.configure.tools.cliDialog.name.required": "Numele instrumentului CLI este obligatoriu.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Nu este niciodată vizibil în prompt-ul agentului; injectat doar ca $VAR la execuție",
+  "agentDetail.configure.tools.cliDialog.title": "Adăugați un instrument CLI",
+  "agentDetail.configure.tools.cliTool": "Instrument CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Utilizator final · OAuth",
+  "agentDetail.configure.tools.editAction": "Editați {{name}}",
+  "agentDetail.configure.tools.empty.description": "Instrumentele permit agentului să acționeze, precum căutarea pe web sau apelarea aplicațiilor tale",
+  "agentDetail.configure.tools.empty.title": "Niciun instrument încă",
+  "agentDetail.configure.tools.label": "Instrumente",
+  "agentDetail.configure.tools.moreActions": "Mai multe acțiuni pentru {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Pre-autorizați",
+  "agentDetail.configure.tools.removeAction": "Eliminați {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Eliminați toate instrumentele",
+  "agentDetail.configure.tools.tip": "Instrumente pe care acest agent le poate apela în timpul orchestrării sarcinilor.",
+  "agentDetail.configure.tools.toggle": "Comută instrumentele",
+  "agentDetail.configure.tools.toolTabs.all": "Toate",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Personalizat",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugin-uri",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Agent",
+  "agentDetail.history": "Istoric",
+  "agentDetail.logs.description": "Jurnalele complete înregistrează starea de execuție a aplicației, inclusiv intrările utilizatorilor, răspunsurile agentului, planificarea și utilizarea instrumentelor.",
+  "agentDetail.logs.empty": "Niciun jurnal găsit",
+  "agentDetail.logs.filters.period.allTime": "Toată perioada",
+  "agentDetail.logs.filters.period.label": "Perioada jurnalului",
+  "agentDetail.logs.filters.period.last30days": "Ultimele 30 de zile",
+  "agentDetail.logs.filters.period.last7days": "Ultimele 7 zile",
+  "agentDetail.logs.filters.search.label": "Căutați jurnale",
+  "agentDetail.logs.filters.search.placeholder": "Căutați",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Ultima dată de creare",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Ultima dată de actualizare",
+  "agentDetail.logs.filters.source.all": "Sursă",
+  "agentDetail.logs.filters.source.empty": "Nu s-au găsit surse",
+  "agentDetail.logs.filters.source.label": "Sursa jurnalului",
+  "agentDetail.logs.filters.source.loadFailed": "Nu s-au putut încărca sursele",
+  "agentDetail.logs.filters.source.loading": "Se încarcă sursele…",
+  "agentDetail.logs.filters.source.searchLabel": "Caută surse",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Caută",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Workflow",
+  "agentDetail.logs.learnMore": "Aflați mai multe",
+  "agentDetail.logs.loadFailed": "Nu s-au putut încărca jurnalele",
+  "agentDetail.logs.loading": "Se încarcă jurnalele…",
+  "agentDetail.logs.notAvailable": "Indisponibil",
+  "agentDetail.logs.table.createdTime": "Data creării",
+  "agentDetail.logs.table.endUser": "Utilizator final",
+  "agentDetail.logs.table.messageCount": "Nr. mesaje",
+  "agentDetail.logs.table.operationRate": "Rată op.",
+  "agentDetail.logs.table.source": "Sursă",
+  "agentDetail.logs.table.title": "Titlu",
+  "agentDetail.logs.table.unread": "Necitit",
+  "agentDetail.logs.table.updatedTime": "Data actualizării",
+  "agentDetail.logs.table.userRate": "Rating utilizator",
+  "agentDetail.logs.title": "Jurnale",
+  "agentDetail.memorySettings.budgetLabel": "Buget de memorie",
+  "agentDetail.memorySettings.description": "Setări de memorie din instantaneul de configurare activ.",
+  "agentDetail.memorySettings.export.description": "Exportul memoriei este planificat pentru o versiune ulterioară.",
+  "agentDetail.memorySettings.export.download": "Descarcă",
+  "agentDetail.memorySettings.export.soon": "În curând",
+  "agentDetail.memorySettings.export.title": "Exportați memoria curentă",
+  "agentDetail.memorySettings.notConfigured": "Neconfigurat",
+  "agentDetail.memorySettings.scopeLabel": "Domeniul memoriei",
+  "agentDetail.memorySettings.title": "Memorie",
+  "agentDetail.metadata.activeVersionLabel": "Versiune activă",
+  "agentDetail.metadata.appIdLabel": "ID aplicație",
+  "agentDetail.metadata.description": "Câmpuri ale roster-ului doar pentru citire returnate de backend-ul agentului.",
+  "agentDetail.metadata.emptyValue": "Indisponibil",
+  "agentDetail.metadata.scopeLabel": "Domeniu",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Doar workflow",
+  "agentDetail.metadata.sourceLabel": "Sursă",
+  "agentDetail.metadata.statusLabel": "Stare",
+  "agentDetail.metadata.title": "Metadate",
+  "agentDetail.metadata.updatedAtLabel": "Actualizat la",
+  "agentDetail.metadata.workflowIdLabel": "ID workflow",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID nod workflow",
+  "agentDetail.monitoring.change": "{{value}} față de perioada anterioară",
+  "agentDetail.monitoring.dateRangeLabel": "Interval de date",
+  "agentDetail.monitoring.description": "Urmăriți activitatea, costul și calitatea interacțiunii agentului reutilizabil în toate workflow-urile.",
+  "agentDetail.monitoring.learnMore": "Aflați mai multe",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Utilizatori finali unici care au declanșat workflow-uri folosind acest agent.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Utilizatori activi",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Numărul de comunicări continue utilizator-agent pentru acest punct de acces.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Med. interacțiuni per sesiune",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Viteza medie de ieșire de la începutul cererii până la finalizare.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Viteza de ieșire token-uri",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Costul estimat al token-urilor produs de acest agent în execuțiile workflow-urilor.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Utilizarea token-urilor",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Conversații AI zilnice care au ajuns la acest agent prin punctul de acces selectat.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Total conversații",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Numărul zilnic de interacțiuni ale agentului.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Total mesaje",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Numărul de aprecieri la fiecare 1.000 de mesaje pentru acest agent.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Rata de satisfacție a utilizatorilor",
+  "agentDetail.monitoring.pickSource": "Alegeți o aplicație",
+  "agentDetail.monitoring.sourceLabel": "Aplicație",
+  "agentDetail.monitoring.sourceTrigger": "Sursă {{name}}",
+  "agentDetail.monitoring.sources.all": "Toate",
+  "agentDetail.monitoring.timeRangeLabel": "Interval de timp",
+  "agentDetail.monitoring.timeRanges.custom": "Personalizat",
+  "agentDetail.monitoring.timeRanges.last30days": "Ultimele 30 de zile",
+  "agentDetail.monitoring.timeRanges.last7days": "Ultimele 7 zile",
+  "agentDetail.monitoring.timeRanges.today": "Astăzi",
+  "agentDetail.monitoring.title": "Monitorizare",
+  "agentDetail.monitoring.tokenUsageConsumed": "Token-uri consumate",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Navigarea agentului",
+  "agentDetail.publish": "Publică",
+  "agentDetail.publishSoon": "În curând",
+  "agentDetail.sections.access": "Punct de acces",
+  "agentDetail.sections.configure": "Orchestrare",
+  "agentDetail.sections.logs": "Jurnale",
+  "agentDetail.sections.monitoring": "Monitorizare",
+  "agentDetail.subtitle": "ID agent: {{agentId}}",
+  "agentDetail.title": "Agent",
+  "agentDetail.type": "AGENT",
+  "agentDetail.versionHistory.active": "Activă",
+  "agentDetail.versionHistory.empty": "Nicio versiune încă",
+  "agentDetail.versionHistory.filter": "Filtrați versiunile",
+  "agentDetail.versionHistory.versionName": "Versiunea {{version}}",
+  "roster.createAgent": "Creează agent",
+  "roster.createAgentOptions": "Opțiuni de creare agent",
+  "roster.createDialog.description": "Creați un agent reutilizabil în roster-ul acestui workspace.",
+  "roster.createDialog.title": "Creează agent",
+  "roster.createForm.changeIcon": "Schimbă pictograma agentului",
+  "roster.createForm.descriptionLabel": "Descriere",
+  "roster.createForm.descriptionOptional": "(opțional)",
+  "roster.createForm.descriptionPlaceholder": "de ex. Adună surse pe o temă și rezumă principalele constatări",
+  "roster.createForm.nameLabel": "Nume",
+  "roster.createForm.namePlaceholder": "de ex. Max",
+  "roster.createForm.nameRequired": "Numele este obligatoriu.",
+  "roster.createForm.roleLabel": "Rol",
+  "roster.createForm.rolePlaceholder": "de ex. Asistent de cercetare",
+  "roster.createForm.roleRequired": "Rolul este obligatoriu.",
+  "roster.createSuccess": "Agent creat.",
+  "roster.dateTimeFormat": "DD.MM.YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Acest agent va fi eliminat din lista activă a roster-ului.",
+  "roster.deleteDialog.title": "Ștergeți {{name}}?",
+  "roster.deleteFailed": "Ștergerea agentului a eșuat.",
+  "roster.deleteSuccess": "Agent șters.",
+  "roster.duplicateFailed": "Duplicarea agentului a eșuat.",
+  "roster.duplicateSuccess": "Agent duplicat.",
+  "roster.editAgent": "Editați {{name}}",
+  "roster.editDialog.description": "Actualizați numele, descrierea și rolul din roster pentru acest agent.",
+  "roster.editDialog.title": "Editați agentul",
+  "roster.editInfo": "Editați informațiile",
+  "roster.empty": "Niciun agent încă",
+  "roster.emptyDescription": "Agenții salvați în acest workspace vor apărea aici.",
+  "roster.emptySearch": "Niciun agent corespunzător",
+  "roster.emptySearchDescription": "Încercați alt nume de agent.",
+  "roster.filters.all": "Toți",
+  "roster.filters.drafts": "Ciorne",
+  "roster.filters.label": "Filtre agent",
+  "roster.filters.published": "Publicați",
+  "roster.learnMore": "Aflați mai multe despre Agent Roster",
+  "roster.listLabel": "Listă roster de agenți",
+  "roster.loadMore": "Încarcă mai mult",
+  "roster.loadingError": "Încărcarea agenților a eșuat. Reîmprospătați și încercați din nou.",
+  "roster.moreActions": "Mai multe acțiuni pentru {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Crearea agentului inline a eșuat. Reîmprospătați și încercați din nou.",
+  "roster.nodeSelector.dialogLabel": "Selectați un agent",
+  "roster.nodeSelector.manageInAgentConsole": "Gestionați în Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Căutați…",
+  "roster.nodeSelector.startFromScratch": "Începeți de la zero",
+  "roster.references.label": "Workflow-uri care folosesc {{name}}",
+  "roster.references.trigger": "Workflow-uri care folosesc {{name}}",
+  "roster.searchLabel": "Căutați agenți",
+  "roster.searchPlaceholder": "Căutați agenți după nume…",
+  "roster.sources.agent_app": "Aplicație agent",
+  "roster.sources.imported": "Importat",
+  "roster.sources.system": "Sistem",
+  "roster.sources.workflow": "Workflow",
+  "roster.status.active": "Activ",
+  "roster.status.archived": "Arhivat",
+  "roster.tabs.agent": "Agent",
+  "roster.tabs.human": "Uman",
+  "roster.tabsLabel": "Tip de roster",
+  "roster.updateSuccess": "Agent actualizat.",
+  "roster.usageStatus.draft": "Ciornă"
+}
diff --git a/web/i18n/ro-RO/app-log.json b/web/i18n/ro-RO/app-log.json
index 9523cd1aecb..41f1251bb81 100644
--- a/web/i18n/ro-RO/app-log.json
+++ b/web/i18n/ro-RO/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Astăzi",
   "filter.period.yearToDate": "Anul curent",
   "filter.sortBy": "Sortează după:",
+  "monitoring.description": "Monitorizarea înregistrează starea de funcționare a aplicației, inclusiv performanța, activitatea utilizatorilor și costurile.",
   "promptLog": "Jurnal prompt",
   "runDetail.fileListDetail": "Amănunt",
   "runDetail.fileListLabel": "Detalii fișier",
diff --git a/web/i18n/ro-RO/billing.json b/web/i18n/ro-RO/billing.json
index 53f17229ff8..258a7d1741f 100644
--- a/web/i18n/ro-RO/billing.json
+++ b/web/i18n/ro-RO/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Fă upgrade pentru a debloca încărcarea documentelor în masă",
   "upgrade.uploadMultiplePages.description": "Ați atins limita de încărcare — poate fi selectat și încărcat doar un singur document odată în planul dvs. actual.",
   "upgrade.uploadMultiplePages.title": "Actualizează pentru a încărca mai multe documente odată",
+  "upgrade.workflowRestore.description": "Restaurarea versiunilor fluxului de lucru nu este disponibilă în planul tău actual.",
+  "upgrade.workflowRestore.title": "Fă upgrade pentru a restaura versiunile fluxului de lucru",
   "upgradeBtn.encourage": "Actualizează acum",
   "upgradeBtn.encourageShort": "Actualizează",
   "upgradeBtn.plain": "Actualizează planul",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index b4ea97fbeff..9f2c4269b91 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Schimbă spațiul de lucru",
   "mcpPage.description": "Conectează și administrează servere MCP pentru a oferi aplicațiilor acces la instrumente și servicii externe.",
-  "members.admin": "Administrator",
   "members.adminTip": "Poate construi aplicații și gestiona setările echipei",
+  "members.alreadyInTeam": "Deja în echipă",
+  "members.alreadyInTeamTip": "Acești utilizatori au deja acces la acest spațiu de lucru.",
   "members.builder": "Constructor",
   "members.builderTip": "Poate construi și edita propriile aplicații",
-  "members.datasetOperator": "Administrator de cunoștințe",
   "members.datasetOperatorTip": "Numai poate gestiona baza de cunoștințe",
   "members.deleteMember": "Șterge membru",
   "members.disInvite": "Anulează invitația",
-  "members.editor": "Editor",
   "members.editorTip": "Poate construi aplicații, dar nu poate gestiona setările echipei",
   "members.email": "Email",
   "members.emailInvalid": "Format de email invalid",
@@ -270,13 +269,12 @@
   "members.invite": "Adaugă",
   "members.inviteTeamMember": "Adaugă membru în echipă",
   "members.inviteTeamMemberTip": "Pot accesa direct datele echipei dvs. după autentificare.",
-  "members.invitedAsRole": "Invitat ca utilizator {{role}}",
+  "members.invitedAsRole": "Invitat ca {{role}}",
   "members.lastActive": "ULTIMA ACTIVITATE",
   "members.name": "NUME",
-  "members.normal": "Normal",
+  "members.noNewInvitationsSent": "Nu au fost trimise invitații noi",
   "members.normalTip": "Poate doar utiliza aplicații, nu poate construi aplicații",
   "members.ok": "OK",
-  "members.owner": "Proprietar",
   "members.pending": "În așteptare...",
   "members.removeFromTeam": "Elimină din echipă",
   "members.removeFromTeamTip": "Va elimina accesul la echipă",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Cunoștințe",
   "menus.datasetsTips": "CURÂND DISPONIBIL: Importați-vă propriile date text sau scrieți date în timp real prin Webhook pentru îmbunătățirea contextului LLM.",
+  "menus.deployments": "Implementări",
   "menus.explore": "Explorează",
   "menus.exploreMarketplace": "Explorați Marketplace",
   "menus.newApp": "Aplicație nouă",
   "menus.newDataset": "Creează Cunoștințe",
   "menus.plugins": "Integrare-uri",
   "menus.pluginsTips": "Integrați integrare-uri terțe părți sau creați AI-Integrare-uri compatibile cu ChatGPT.",
+  "menus.roster": "Listă agenți",
   "menus.status": "beta",
   "menus.tools": "Instrumente",
   "model.addMoreModel": "Mergeți la setări pentru a adăuga mai multe modele",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Model de conversie vorbire-la-text",
   "modelProvider.ttsModel.tip": "Setați modelul implicit pentru intrarea de conversie vorbire-la-text în conversație.",
   "modelProvider.upgradeForLoadBalancing": "Actualizați-vă planul pentru a activa Load Balancing.",
+  "navigation.skipToMain": "Sări la conținutul principal",
   "noData": "Fără date",
   "operation.add": "Adaugă",
   "operation.added": "Adăugat",
@@ -600,9 +601,6 @@
   "placeholder.input": "Vă rugăm să introduceți",
   "placeholder.search": "Caută...",
   "placeholder.select": "Vă rugăm să selectați",
-  "plugin.serpapi.apiKey": "Cheie API",
-  "plugin.serpapi.apiKeyPlaceholder": "Introduceți cheia dvs. API",
-  "plugin.serpapi.keyFrom": "Obțineți cheia dvs. SerpAPI din pagina contului SerpAPI",
   "promptEditor.context.item.desc": "Inserați șablon de context",
   "promptEditor.context.item.title": "Context",
   "promptEditor.context.modal.add": "Adăugați context ",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
new file mode 100644
index 00000000000..89561b59467
--- /dev/null
+++ b/web/i18n/ro-RO/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API serviciu backend",
+  "access.api.copyCurlExample": "Copiază exemplu cURL",
+  "access.api.createFailed": "Generarea API Token a eșuat.",
+  "access.api.createKey": "Generează API Token",
+  "access.api.createKeyTitle": "Generează un nou API Token",
+  "access.api.curlExampleTitle": "Exemplu cURL",
+  "access.api.description": "Accesează această implementare prin HTTP. Fiecare API Token este limitat la un singur mediu.",
+  "access.api.developerTitle": "API dezvoltator",
+  "access.api.disabled": "Accesul API este dezactivat pentru această implementare.",
+  "access.api.disabledHint": "Activează accesul API pentru a genera token-uri limitate la mediu.",
+  "access.api.dismissToken": "Închide API Token",
+  "access.api.docs": "Documentație API",
+  "access.api.docsClose": "Închide documentația API",
+  "access.api.docsDescription": "Vezi referința API Workflow pentru această implementare.",
+  "access.api.docsTitle": "Documentație API Workflow",
+  "access.api.empty": "Implementează într-un mediu mai întâi pentru a începe să emiți API Token-uri.",
+  "access.api.emptyTitle": "Niciun mediu implementat",
+  "access.api.endpoint": "URL cerere",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Lista API Token",
+  "access.api.nameLabel": "Nume API Token",
+  "access.api.namePlaceholder": "Introdu un nume pentru API Token",
+  "access.api.nameRequired": "Numele API Token este obligatoriu.",
+  "access.api.newKey": "Generează un nou API Token",
+  "access.api.newTokenDescription": "Acest API Token este afișat o singură dată. Copiază-l înainte de a părăsi această pagină.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token generat",
+  "access.api.noKeys": "Niciun API Token încă. Generează unul pentru a începe să apelezi API-ul.",
+  "access.api.noKeysTitle": "Niciun API Token încă",
+  "access.api.revokeConfirmDescription": "API Token \"{{name}}\" va înceta să funcționeze imediat. Această acțiune nu poate fi anulată.",
+  "access.api.revokeConfirmTitle": "Revoci API Token?",
+  "access.api.revokeFailed": "Revocarea API Token a eșuat.",
+  "access.api.revokeSuccess": "API Token revocat",
+  "access.api.table.action": "Acțiune",
+  "access.api.table.environment": "Mediu",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Nume",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Canal",
+  "access.channels.col.endpoint": "Punct de intrare",
+  "access.channels.col.status": "Stare",
+  "access.channels.description": "Punctele de intrare WebApp și CLI folosesc permisiunile de acces de mai sus.",
+  "access.channels.disabled": "Canalele de acces sunt dezactivate pentru această implementare.",
+  "access.channels.disabledHint": "Activează canalele de acces pentru a expune punctele de intrare WebApp și CLI.",
+  "access.channels.followPermission": "Urmează permisiunile",
+  "access.channels.title": "Canale de acces",
+  "access.cli.description": "Apelează din terminal cu difyctl, potrivit pentru scripturi, fluxuri automate sau integrări Agent.",
+  "access.cli.docs": "Ghid de utilizare",
+  "access.cli.domain": "Domeniu",
+  "access.cli.empty": "Endpoint CLI neconfigurat.",
+  "access.cli.install": "Instalează CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Copiat",
+  "access.copy": "Copiază",
+  "access.copyFailed": "Copiere eșuată",
+  "access.copyToast": "Copiat în clipboard",
+  "access.hide": "Ascunde",
+  "access.members.clearAll": "Șterge tot",
+  "access.members.empty": "Nu s-au găsit potriviri.",
+  "access.members.groupCount_one": "{{count}} grup",
+  "access.members.groupCount_other": "{{count}} grupuri",
+  "access.members.groups": "Grupuri",
+  "access.members.individuals": "Membri",
+  "access.members.memberCount_one": "{{count}} membru",
+  "access.members.memberCount_other": "{{count}} membri",
+  "access.members.pickPlaceholder": "Selectează grupuri sau membri",
+  "access.members.searchPlaceholder": "Caută grupuri și membri",
+  "access.members.selectedLabel": "Selectat",
+  "access.permission.anyone": "Oricine cu linkul",
+  "access.permission.anyoneDesc": "Oricine poate accesa această implementare fără autentificare.",
+  "access.permission.memberCount_one": "{{count}} membru",
+  "access.permission.memberCount_other": "{{count}} membri",
+  "access.permission.organization": "Toți membrii din cadrul platformei",
+  "access.permission.organizationDesc": "Toți membrii din cadrul platformei",
+  "access.permission.specific": "Membri specifici din cadrul platformei",
+  "access.permission.specificDesc": "Selectează grupuri sau membri specifici",
+  "access.permission.specificUnavailable": "Selectarea membrilor specifici este dezactivată până când membrii și grupurile reale ale platformei sunt conectate.",
+  "access.permission.updateFailed": "Actualizarea politicii de acces a eșuat.",
+  "access.permissions.col.environment": "Mediu",
+  "access.permissions.col.permission": "Acces",
+  "access.permissions.description": "Setează permisiunile de acces pentru punctele de intrare WebApp și CLI în fiecare mediu.",
+  "access.permissions.editAriaLabel": "Configurează accesul pentru {{environment}}",
+  "access.permissions.editDescription": "Setează permisiunile de acces pentru punctele de intrare WebApp și CLI.",
+  "access.permissions.editTitle": "Permisiuni de acces",
+  "access.permissions.title": "Permisiuni de acces",
+  "access.revoke": "Revocă",
+  "access.runAccess.description": "Gestionează modul în care utilizatorii pot rula această implementare și cine este autorizat să o acceseze în fiecare mediu.",
+  "access.runAccess.disabled": "Accesul de rulare este dezactivat pentru această implementare.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Expune această implementare ca server Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Endpoint MCP neconfigurat.",
+  "access.runAccess.noEnvs": "Implementează într-un mediu pentru a configura permisiunile de acces.",
+  "access.runAccess.noEnvsTitle": "Niciun mediu implementat",
+  "access.runAccess.openWebapp": "Deschide WebApp",
+  "access.runAccess.permissions": "Permisiuni de acces",
+  "access.runAccess.permissionsDesc": "Cine poate accesa această implementare în fiecare mediu.",
+  "access.runAccess.title": "Acces de rulare",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Pagină web găzduită pentru utilizatorii finali.",
+  "access.runAccess.webappEmpty": "În curând.",
+  "access.show": "Arată",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Extern",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Necunoscut",
+  "card.access.api": "API Token-uri",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Fără acces",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Creează prima versiune",
+  "card.deploy": "Implementează",
+  "card.deploying": "{{count}} în implementare",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} eșuate",
+  "card.fromApp": "De la {{name}}",
+  "card.lastDeployed": "Ultima implementare {{time}}",
+  "card.menu.delete": "Șterge implementarea",
+  "card.menu.deleteDisabled": "Ștergerea implementărilor nu este încă disponibilă pentru implementările gestionate de backend.",
+  "card.menu.deploy": "Implementează în mediu",
+  "card.menu.editInfo": "Editează informațiile",
+  "card.menu.viewDetail": "Vezi detaliile implementării",
+  "card.moreActions": "Mai multe acțiuni",
+  "card.neverDeployed": "Niciodată implementat",
+  "card.noDescription": "Nu a fost furnizată nicio descriere.",
+  "card.notDeployed": "Neimplementat",
+  "card.ready": "{{count}} în rulare",
+  "card.tooltip.createdAt": "Creat",
+  "card.tooltip.deployed": "Implementat",
+  "card.tooltip.deploymentStatus": "Implementare",
+  "card.tooltip.notDeployed": "Această implementare nu a fost încă implementată într-un mediu.",
+  "card.tooltip.notDeployedShort": "Neimplementat",
+  "card.tooltip.release": "Versiune",
+  "card.tooltip.releaseName": "Nume versiune",
+  "card.tooltip.source": "Sursă",
+  "common.loadFailed": "Încărcare eșuată. Încearcă din nou mai târziu.",
+  "common.loading": "Se încarcă...",
+  "createGuide.actions.back": "Înapoi",
+  "createGuide.actions.cancel": "Anulează",
+  "createGuide.actions.continue": "Continuă",
+  "createGuide.actions.createAndDeploy": "Creează și implementează",
+  "createGuide.actions.creating": "Se creează...",
+  "createGuide.actions.deploy": "Implementează",
+  "createGuide.actions.deploying": "Se creează și se implementează...",
+  "createGuide.actions.next": "Următorul",
+  "createGuide.actions.skipDeploy": "Omite, implementează mai târziu",
+  "createGuide.description": "Creează o implementare dintr-o sursă de versiune, informații de bază și mediu țintă.",
+  "createGuide.dsl.defaultAppName": "Aplicație DSL importată",
+  "createGuide.dsl.description": "Încarcă un pachet DSL Workflow pentru a crea implementarea, prima versiune și implementarea opțională în mediu.",
+  "createGuide.dsl.dropDescription": "Încarcă un pachet DSL Workflow YAML. Opțiunile de implementare sunt rezolvate din acest fișier înainte de implementare.",
+  "createGuide.dsl.dropTitle": "Încarcă pachetul DSL Workflow",
+  "createGuide.dsl.readFailed": "Citirea fișierului DSL a eșuat. Alege alt fișier și încearcă din nou.",
+  "createGuide.dsl.reading": "Se citește fișierul DSL...",
+  "createGuide.dsl.title": "Importă DSL",
+  "createGuide.dsl.unsupportedMode": "Doar fișierele DSL Workflow pot fi utilizate pentru implementări.",
+  "createGuide.errors.createReleaseFailed": "Crearea implementării sau a versiunii a eșuat.",
+  "createGuide.errors.deployFailed": "Implementarea în mediu a eșuat.",
+  "createGuide.method.description": "Alege sursa folosită pentru a crea prima versiune.",
+  "createGuide.methods.bindApp.description": "Folosește o aplicație Workflow existentă din Studio ca sursă pentru versiune.",
+  "createGuide.methods.bindApp.title": "Asociază aplicația Workflow existentă",
+  "createGuide.methods.importDsl.description": "Încarcă un pachet DSL Workflow YAML și continuă prin interfața de implementare.",
+  "createGuide.methods.importDsl.title": "Importă DSL",
+  "createGuide.methods.mocked": "Simulat",
+  "createGuide.nav.back": "Implementări",
+  "createGuide.release.defaultName": "versiune inițială",
+  "createGuide.release.deployInfo": "Informații implementare",
+  "createGuide.release.description": "Completează informațiile implementării și detaliile primei versiuni.",
+  "createGuide.release.firstVersion": "Prima versiune",
+  "createGuide.release.instanceDescription": "Descriere implementare",
+  "createGuide.release.instanceDescriptionPlaceholder": "Descrie pentru ce este folosită această implementare",
+  "createGuide.release.instanceName": "Nume implementare",
+  "createGuide.release.instanceNameConflict": "O implementare cu acest nume există deja. Alege un alt nume.",
+  "createGuide.release.releaseDescription": "Descriere versiune",
+  "createGuide.release.releaseDescriptionPlaceholder": "Descrie această versiune",
+  "createGuide.release.releaseName": "Nume versiune",
+  "createGuide.release.releaseNote": "Descriere versiune",
+  "createGuide.release.title": "Informații de bază",
+  "createGuide.source.availableApps_one": "{{count}} aplicație",
+  "createGuide.source.availableApps_other": "{{count}} aplicații",
+  "createGuide.source.clearSearch": "Șterge căutarea aplicațiilor",
+  "createGuide.source.description": "Alege sursa folosită pentru a crea prima versiune.",
+  "createGuide.source.empty": "Nu s-au găsit aplicații Workflow.",
+  "createGuide.source.searchPlaceholder": "Caută aplicații",
+  "createGuide.source.sourceApp": "Aplicație Workflow",
+  "createGuide.source.title": "Sursă versiune",
+  "createGuide.steps.method": "Sursă versiune",
+  "createGuide.steps.release": "Informații de bază",
+  "createGuide.steps.source": "Sursă versiune",
+  "createGuide.steps.target": "Implementează în mediu",
+  "createGuide.target.bindingCount_one": "{{count}} asociere",
+  "createGuide.target.bindingCount_other": "{{count}} asocieri",
+  "createGuide.target.bindingHint": "Alege acreditările folosite de această versiune.",
+  "createGuide.target.bindings": "Acreditări",
+  "createGuide.target.deferredBindingHint": "Acreditările vor fi rezolvate din planul real de implementare în timpul acțiunii finale de implementare.",
+  "createGuide.target.deferredEnvironmentHint": "Numele este verificat în raport cu mediile reale după crearea implementării și a versiunii.",
+  "createGuide.target.description": "Alege un mediu țintă și furnizează setările de runtime de care această versiune are nevoie acolo. Acest pas poate fi omis.",
+  "createGuide.target.envVarCount_one": "{{count}} variabilă",
+  "createGuide.target.envVarCount_other": "{{count}} variabile",
+  "createGuide.target.envVarHint": "Pentru fiecare variabilă de mediu de care această versiune are nevoie, introdu o valoare personalizată sau folosește valoarea definită în aplicație.",
+  "createGuide.target.envVarPlaceholder": "Introdu valoare",
+  "createGuide.target.envVarSource.ariaLabel": "Selectează sursa valorii variabilei pentru {{key}}",
+  "createGuide.target.envVarSource.default": "Valoare aplicație",
+  "createGuide.target.envVarSource.lastDeployment": "Valoare ultimă implementare",
+  "createGuide.target.envVarSource.literal": "Valoare personalizată",
+  "createGuide.target.envVarType.number": "Număr",
+  "createGuide.target.envVarType.secret": "Secret",
+  "createGuide.target.envVarType.string": "Șir",
+  "createGuide.target.envVars": "Variabile de mediu",
+  "createGuide.target.environment": "Mediu țintă",
+  "createGuide.target.environmentName": "Nume mediu",
+  "createGuide.target.environmentNamePlaceholder": "Producție",
+  "createGuide.target.loadBindingsFailed": "Încărcarea acreditărilor a eșuat.",
+  "createGuide.target.loadEnvironmentsFailed": "Încărcarea mediilor de implementare a eșuat.",
+  "createGuide.target.missingRequiredBinding": "Selectează o acreditare pentru această asociere obligatorie.",
+  "createGuide.target.noBindingRequired": "Nicio acreditare necesară.",
+  "createGuide.target.noCredentialCandidates": "Nicio acreditare disponibilă.",
+  "createGuide.target.noEnvironmentOptions": "Niciun mediu de implementare disponibil.",
+  "createGuide.target.required": "Obligatoriu",
+  "createGuide.target.selectCredential": "Selectează o acreditare",
+  "createGuide.target.title": "Implementează în mediu",
+  "createGuide.title": "Implementare nouă",
+  "createModal.appPickerPlaceholder": "Selectează o aplicație Workflow",
+  "createModal.appSearchEmpty": "Nicio aplicație Workflow potrivită",
+  "createModal.appSearchPlaceholder": "Caută aplicații Workflow…",
+  "createModal.cancel": "Anulează",
+  "createModal.create": "Creează",
+  "createModal.createFailed": "Crearea implementării a eșuat.",
+  "createModal.description": "Alege o aplicație Workflow și creează o implementare.",
+  "createModal.descriptionLabel": "Descriere",
+  "createModal.descriptionPlaceholder": "Descrie pentru ce este folosită această implementare",
+  "createModal.loadMoreApps": "Încarcă mai multe aplicații",
+  "createModal.loadingApps": "Se încarcă aplicațiile…",
+  "createModal.nameLabel": "Nume implementare",
+  "createModal.namePlaceholder": "Nume implementare",
+  "createModal.noApps": "Nu s-au găsit aplicații Workflow în acest spațiu de lucru. Creează una în Studio mai întâi.",
+  "createModal.selected": "Selectat",
+  "createModal.sourceApp": "Aplicație Workflow (obligatoriu)",
+  "createModal.title": "Implementare nouă",
+  "deployDrawer.bindingCount_one": "{{count}} asociere",
+  "deployDrawer.bindingCount_other": "{{count}} asocieri",
+  "deployDrawer.bindingOptionsFailed": "Încărcarea opțiunilor de acreditare a eșuat.",
+  "deployDrawer.bindingSelectionHint": "Alege acreditările folosite de această implementare.",
+  "deployDrawer.bindingsDisabled": "Rezolvat din previzualizarea versiunii. Editarea nu este încă disponibilă.",
+  "deployDrawer.cancel": "Anulează",
+  "deployDrawer.close": "Închide panoul de implementare",
+  "deployDrawer.defaultSelect": "Selectează...",
+  "deployDrawer.deploy": "Implementează în mediu",
+  "deployDrawer.deployExistingRelease": "Implementează în mediu",
+  "deployDrawer.deployExistingReleaseDescription": "Selectează o versiune și un mediu țintă pentru implementare.",
+  "deployDrawer.deployExistingReleaseTitle": "Implementează în mediu",
+  "deployDrawer.deployFailed": "Pornirea implementării a eșuat.",
+  "deployDrawer.deploying": "Se implementează...",
+  "deployDrawer.description": "Selectează o versiune și un mediu țintă pentru implementare.",
+  "deployDrawer.envVarCount_one": "{{count}} variabilă",
+  "deployDrawer.envVarCount_other": "{{count}} variabile",
+  "deployDrawer.envVarHint": "Pentru fiecare variabilă de mediu de care această versiune are nevoie, introdu o valoare personalizată sau folosește valoarea definită în aplicație.",
+  "deployDrawer.envVarPlaceholder": "Introdu valoare",
+  "deployDrawer.envVarSource.ariaLabel": "Selectează sursa valorii variabilei pentru {{key}}",
+  "deployDrawer.envVarSource.default": "Valoare aplicație",
+  "deployDrawer.envVarSource.lastDeployment": "Valoare ultimă implementare",
+  "deployDrawer.envVarSource.literal": "Valoare personalizată",
+  "deployDrawer.envVarType.number": "Număr",
+  "deployDrawer.envVarType.secret": "Secret",
+  "deployDrawer.envVarType.string": "Șir",
+  "deployDrawer.envVars": "Variabile de mediu",
+  "deployDrawer.existingReleaseHint": "Această versiune va fi implementată ca atare. Nu va fi creată o versiune nouă.",
+  "deployDrawer.loadingBindings": "Se rezolvă...",
+  "deployDrawer.lockedHint": "Blocat la mediul curent",
+  "deployDrawer.missingRequiredBinding": "Selectează o acreditare pentru această asociere obligatorie.",
+  "deployDrawer.missingRequiredEnvVar": "Introdu o valoare pentru această variabilă de mediu obligatorie.",
+  "deployDrawer.modelCreds": "Acreditări model",
+  "deployDrawer.needsValidation": " (necesită validare)",
+  "deployDrawer.newReleaseHint": "O nouă versiune va fi creată din YAML-ul aplicației Workflow selectate.",
+  "deployDrawer.noBindingRequired": "Nu este obligatoriu",
+  "deployDrawer.noCredentialCandidates": "Nicio acreditare disponibilă.",
+  "deployDrawer.noNewEnvironmentAvailable": "Toate mediile disponibile au deja o implementare.",
+  "deployDrawer.noOtherReleaseAvailable": "Nu există alte versiuni disponibile pentru acest mediu.",
+  "deployDrawer.noReleaseAvailable": "Creează o versiune înainte de a implementa într-un mediu.",
+  "deployDrawer.notFound": "Implementarea nu a fost găsită.",
+  "deployDrawer.noteLabel": "Descriere versiune (opțional)",
+  "deployDrawer.notePlaceholder": "ex. Ajustare text de onboarding",
+  "deployDrawer.pluginCreds": "Acreditări plugin",
+  "deployDrawer.promote": "Implementează",
+  "deployDrawer.promoteDescription": "Selectează o versiune și un mediu țintă pentru implementare.",
+  "deployDrawer.promoteTitle": "Implementează în mediu",
+  "deployDrawer.readOnly": "Doar citire",
+  "deployDrawer.redeploy": "Implementează în mediu",
+  "deployDrawer.redeployDescription": "Selectează o versiune și un mediu țintă pentru implementare.",
+  "deployDrawer.redeployExistingReleaseHint": "Versiunea curentă va fi reimplementată ca atare. Nu va fi creată o versiune nouă.",
+  "deployDrawer.redeployTitle": "Implementează în mediu",
+  "deployDrawer.releaseLabel": "Versiune",
+  "deployDrawer.requiredBinding": "Obligatoriu",
+  "deployDrawer.rollback": "Implementează",
+  "deployDrawer.rollbackDescription": "Selectează o versiune și un mediu țintă pentru implementare.",
+  "deployDrawer.rollbackTitle": "Implementează în mediu",
+  "deployDrawer.runtimeCredentials": "Acreditări",
+  "deployDrawer.secretPlaceholder": "secret",
+  "deployDrawer.selectCredential": "Selectează o acreditare",
+  "deployDrawer.selectEnv": "Selectează un mediu",
+  "deployDrawer.selectProviderCred": "Selectează acreditarea {{provider}}",
+  "deployDrawer.selectProviderKey": "Selectează cheia {{provider}}",
+  "deployDrawer.selectRelease": "Selectează o versiune",
+  "deployDrawer.targetEnv": "Mediu țintă",
+  "deployDrawer.title": "Implementează în mediu",
+  "deployDrawer.valuePlaceholder": "valoare",
+  "deployTab.cancelDeployment": "Anulează implementarea",
+  "deployTab.closeError": "Închide",
+  "deployTab.col.actions": "Acțiuni",
+  "deployTab.col.currentRelease": "Versiunea curentă",
+  "deployTab.col.environment": "Mediu",
+  "deployTab.col.status": "Stare",
+  "deployTab.col.updated": "Actualizat",
+  "deployTab.collapseDetails": "Restrânge detaliile implementării",
+  "deployTab.confirmUndeploy": "Anulează implementarea",
+  "deployTab.deployOtherVersion": "Implementează altă versiune",
+  "deployTab.deployToEnv": "Implementează în {{name}}",
+  "deployTab.deployToNewEnv": "Implementează într-un mediu nou...",
+  "deployTab.empty": "Nicio instanță încă. Implementează într-un mediu nou pentru a începe.",
+  "deployTab.emptyDescription": "Alege o versiune și un mediu țintă pentru a face această implementare disponibilă utilizatorilor.",
+  "deployTab.emptyTitle": "Niciun mediu nu rulează încă",
+  "deployTab.envCount": "Medii",
+  "deployTab.errorCode": "Cod",
+  "deployTab.errorDialogDesc": "Verifică ultima implementare eșuată înainte de a reîncerca sau de a implementa o altă versiune.",
+  "deployTab.errorDialogTitle": "Eroare de implementare în {{name}}",
+  "deployTab.errorMessage": "Mesaj",
+  "deployTab.errorPhase": "Fază",
+  "deployTab.expandDetails": "Extinde detaliile implementării",
+  "deployTab.moreActions": "Mai multe acțiuni",
+  "deployTab.newDeployment": "Implementează într-un mediu nou",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "ID implementare",
+  "deployTab.panel.endpoints": "Endpoint-uri",
+  "deployTab.panel.envVars": "Variabile de mediu",
+  "deployTab.panel.error": "Eroare",
+  "deployTab.panel.failedRelease": "Versiune eșuată",
+  "deployTab.panel.health": "Sănătate",
+  "deployTab.panel.instanceInfo": "Informații instanță",
+  "deployTab.panel.modelCreds": "Acreditări model",
+  "deployTab.panel.pluginCreds": "Acreditări plugin",
+  "deployTab.panel.release": "Versiune",
+  "deployTab.panel.releaseCreatedAt": "Versiune creată la",
+  "deployTab.panel.releaseInfo": "Informații versiune",
+  "deployTab.panel.replicas": "Replici",
+  "deployTab.panel.run": "Rulează",
+  "deployTab.panel.runtimeBindings": "Acreditări",
+  "deployTab.panel.runtimeInfo": "Informații runtime",
+  "deployTab.panel.runtimeMode": "Mod runtime",
+  "deployTab.panel.runtimeNote": "Notă runtime",
+  "deployTab.panel.targetRelease": "Versiune țintă",
+  "deployTab.panel.unknownError": "Implementarea a eșuat.",
+  "deployTab.promote": "Implementează",
+  "deployTab.redeploy": "Reimplementează",
+  "deployTab.releaseCreatedAt": "Versiune creată {{time}}",
+  "deployTab.retry": "Reîncearcă",
+  "deployTab.shortcut": "Scurtătură",
+  "deployTab.status.deployFailed": "Implementare eșuată",
+  "deployTab.status.deployingRelease": "Se implementează ({{release}})",
+  "deployTab.status.runningOutOfSync": "Rulează (sincronizare în așteptare)",
+  "deployTab.status.runningWithFailed": "Rulează (ultima implementare a eșuat)",
+  "deployTab.undeploy": "Anulează implementarea",
+  "deployTab.undeployConfirmDesc": "Accesul utilizatorilor finali se va opri imediat. Versiunea poate fi reimplementată mai târziu.",
+  "deployTab.undeployConfirmTitle": "Anulezi implementarea din {{name}}?",
+  "deployTab.undeployFrom": "Anulează implementarea din {{name}}",
+  "deployTab.undeployImpactTitle": "Instanță afectată",
+  "deployTab.viewError": "Vezi eroarea",
+  "deployTab.viewLogs": "Vezi jurnalele",
+  "deployTab.viewProgress": "Vezi progresul",
+  "detail.backToInstances": "Înapoi la implementări",
+  "detail.deployingCount": "{{count}} în implementare",
+  "detail.envCount_one": "{{count}} mediu",
+  "detail.envCount_other": "{{count}} medii",
+  "detail.failedCount": "{{count}} eșuate",
+  "detail.mobileTabs": "Secțiuni implementare",
+  "detail.notFound": "Implementarea nu a fost găsită",
+  "detail.openSourceApp": "Deschide sursa {{name}}",
+  "detail.sourceApp": "Sursă",
+  "detail.sourceAppLink": "Sursă",
+  "documentTitle.create": "Implementare nouă · Implementări",
+  "documentTitle.detail": "Implementare · Implementări",
+  "documentTitle.list": "Implementări",
+  "filter.allEnvs": "Toate mediile",
+  "filter.notDeployed": "Neimplementat",
+  "filter.searchPlaceholder": "Caută implementări",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Admitere",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Inițializare",
+  "health.ENVIRONMENT_STATUS_DELETING": "Se șterge",
+  "health.ENVIRONMENT_STATUS_FAILED": "Indisponibil",
+  "health.ENVIRONMENT_STATUS_READY": "Disponibil",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Necunoscut",
+  "list.clearFilters": "Șterge filtrele",
+  "list.clearSearch": "Șterge căutarea implementărilor",
+  "list.createDeployment": "Nou",
+  "list.empty": "Nu s-au găsit implementări.",
+  "list.emptyDescription": "Creează o implementare dintr-o aplicație Workflow sau dintr-un pachet DSL Workflow pentru a gestiona versiunile, mediile și accesul.",
+  "list.emptyFilteredDescription": "Nicio implementare nu corespunde căutării sau filtrului de mediu curent.",
+  "list.emptyFilteredTitle": "Nicio implementare corespunzătoare",
+  "list.emptyTitle": "Nicio implementare încă",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Izolat",
+  "mode.ENVIRONMENT_MODE_SHARED": "Partajat",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Necunoscut",
+  "newInstance.comingSoon": "În curând",
+  "newInstance.fromStudio": "Selectează din Studio",
+  "newInstance.importDSL": "Importă DSL",
+  "newInstance.title": "Implementare nouă",
+  "overview.accessEndpoints": "Endpoint-uri de acces",
+  "overview.accessMeta.apiTokens": "Gestionează API Token-uri",
+  "overview.accessMeta.cli": "Vezi accesul CLI",
+  "overview.accessMeta.webApp": "Gestionează accesul WebApp",
+  "overview.accessStatus": "Acces",
+  "overview.api": "API Token-uri",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Token-uri",
+  "overview.apiTokenSummary.environments_one": "{{count}} mediu implementat",
+  "overview.apiTokenSummary.environments_other": "{{count}} medii implementate",
+  "overview.availableForDeployment": "Disponibil pentru implementare",
+  "overview.basicInfo": "Informații de bază",
+  "overview.cardAction.deployLatest": "Implementează ultima versiune",
+  "overview.cardAction.redeploy": "Reimplementează",
+  "overview.cardAction.viewProgress": "Vezi implementarea",
+  "overview.chip.behindTooltip_one": "1 versiune în urmă față de cea mai recentă. Implementează ultima versiune pentru a actualiza.",
+  "overview.chip.behindTooltip_other": "{{count}} versiuni în urmă față de cea mai recentă. Implementează ultima versiune pentru a actualiza.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "se implementează",
+  "overview.chip.deployingTooltip": "Implementarea este în curs.",
+  "overview.chip.empty": "gol",
+  "overview.chip.emptyTooltip": "Nicio versiune nu este implementată în acest mediu.",
+  "overview.chip.failed": "eșuat",
+  "overview.chip.failedTooltip": "Ultima încercare de implementare a eșuat.",
+  "overview.chip.latest": "cea mai recentă",
+  "overview.chip.latestTooltip": "Acest mediu rulează cea mai recentă versiune.",
+  "overview.chip.needsReleaseFirst": "Creează mai întâi o versiune",
+  "overview.chip.olderRelease": "mai veche",
+  "overview.chip.olderReleaseTooltip": "Acest mediu rulează o versiune mai veche.",
+  "overview.chip.openInDeployTab": "Vezi progresul implementării",
+  "overview.cli": "CLI",
+  "overview.configured": "Configurat",
+  "overview.createRelease": "Creează versiune",
+  "overview.created": "Creat",
+  "overview.deploy": "Implementează",
+  "overview.deployedEnvironments": "implementat",
+  "overview.deploymentOverview": "Prezentare implementare",
+  "overview.deploymentStatus": "Stare implementare",
+  "overview.description": "Descriere",
+  "overview.developerApi": "API dezvoltator",
+  "overview.disabled": "Dezactivat",
+  "overview.emptyValue": "Nesetat",
+  "overview.enabled": "Activat",
+  "overview.enabledChannels": "acces activat",
+  "overview.endUserAccess": "Acces utilizator final",
+  "overview.environments": "Medii",
+  "overview.hero.byName": "de {{name}}",
+  "overview.hero.empty": "Nicio versiune încă",
+  "overview.hero.emptyDescription": "Creează o versiune din sursa curentă înainte de implementare.",
+  "overview.hero.propagation_one": "implementat în {{count}}/{{total}} mediu",
+  "overview.hero.propagation_other": "implementat în {{count}}/{{total}} medii",
+  "overview.hero.untargeted": "niciun mediu configurat încă",
+  "overview.instanceDetails": "Detalii implementare",
+  "overview.instanceId": "ID implementare",
+  "overview.latestRelease.releaseCount_one": "{{count}} versiune",
+  "overview.latestRelease.releaseCount_other": "{{count}} versiuni",
+  "overview.latestReleaseTitle": "Ultima versiune",
+  "overview.manageDeployments": "Gestionează implementările",
+  "overview.name": "Nume",
+  "overview.noAccessConfig": "Nicio configurație de acces.",
+  "overview.noReleaseYet": "Creează o versiune înainte de a implementa într-un mediu.",
+  "overview.notConfigured": "Neconfigurat",
+  "overview.previousReleases.empty": "Nicio versiune anterioară încă.",
+  "overview.previousReleases.retired": "Nu este implementat în prezent",
+  "overview.previousReleases.title": "Versiuni anterioare",
+  "overview.previousReleases.viewAll": "Vezi toate",
+  "overview.ready": "Pregătit de implementare",
+  "overview.recentReleases": "Versiuni recente",
+  "overview.releaseDeployedTitle": "{{release}} este implementată",
+  "overview.releaseReadyTitle": "{{release}} este pregătită de implementare",
+  "overview.serviceMap": "Hartă serviciu",
+  "overview.servingRelease": "Servește {{release}}",
+  "overview.servingReleaseDescription": "Această implementare este implementată în {{count}}/{{total}} medii.",
+  "overview.strip.deployToNewEnvironment": "Implementează în mediu nou",
+  "overview.strip.empty": "Niciun mediu configurat.",
+  "overview.strip.emptyDeployableDescription": "Implementează ultima versiune într-un mediu când ești gata.",
+  "overview.strip.emptyDeployed": "Nicio instanță încă.",
+  "overview.strip.emptyDescription": "Creează o versiune înainte de a implementa într-un mediu.",
+  "overview.strip.emptyTitle": "Nicio instanță încă",
+  "overview.strip.summary_one": "1 din {{total}} pe ultima versiune",
+  "overview.strip.summary_other": "{{count}} din {{total}} pe ultima versiune",
+  "overview.strip.title": "Instanțe",
+  "overview.switchSourceApp": "Schimbă sursa",
+  "overview.switchSourceAppDescription": "Alege aplicația Workflow folosită ca sursă pentru versiunile viitoare.",
+  "overview.switchSourceAppHint": "După schimbare, doar versiunile create ulterior vor folosi noua sursă. Versiunile istorice și implementările existente nu sunt modificate.",
+  "overview.targetRelease": "Versiune țintă",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Zonă periculoasă",
+  "settings.dangerDesc": "Șterge definitiv această implementare și oprește orice instanțe în rulare. Această acțiune nu poate fi anulată.",
+  "settings.delete": "Șterge implementarea",
+  "settings.deleteConfirmDesc": "Ștergi {{name}}? Fiecare instanță va înceta să ruleze și va fi eliminată din toate mediile. Această acțiune nu poate fi anulată.",
+  "settings.deleteConfirmTitle": "Șterge implementarea",
+  "settings.deleteFailed": "Ștergerea implementării a eșuat.",
+  "settings.deleteImpact": "Impact",
+  "settings.deleteImpactInstance": "Implementare",
+  "settings.deleteImpactTitle": "Implementare afectată",
+  "settings.deleteImpactValue": "Implementarea este eliminată din lista de implementări.",
+  "settings.deleted": "Implementare ștearsă",
+  "settings.description": "Descriere",
+  "settings.descriptionHelp": "Gestionează numele, descrierea și alte setări ale acestei implementări.",
+  "settings.general": "General",
+  "settings.name": "Nume implementare",
+  "settings.reset": "Resetează",
+  "settings.save": "Salvează modificările",
+  "settings.updateFailed": "Actualizarea implementării a eșuat.",
+  "settings.updated": "Implementare actualizată",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Se implementează",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sincronizare în așteptare",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Implementare eșuată",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Invalid",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Rulează",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Neimplementat",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Se anulează implementarea",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Necunoscut",
+  "subtitle": "Gestionează implementările între medii.",
+  "tabs.access.description": "Gestionează canalele de acces și permisiunile de acces.",
+  "tabs.access.name": "Acces",
+  "tabs.api-tokens.description": "Gestionează API Token-urile și apelează instanțele prin HTTP.",
+  "tabs.api-tokens.name": "API Token-uri",
+  "tabs.instances.description": "Vezi și gestionează instanțele din mediile implementate.",
+  "tabs.instances.name": "Instanțe",
+  "tabs.overview.description": "Vezi starea implementării între medii.",
+  "tabs.overview.name": "Prezentare generală",
+  "tabs.releases.description": "Creează, implementează și gestionează versiuni.",
+  "tabs.releases.name": "Versiuni",
+  "tabs.settings.description": "Gestionează numele, descrierea și alte setări ale acestei implementări.",
+  "tabs.settings.name": "Setări",
+  "title": "Implementări",
+  "unsupportedDslNodes.description": "Această versiune conține noduri pe care runtime-ul de implementare nu le suportă încă. Elimină-le sau înlocuiește-le în Studio, apoi încearcă din nou.",
+  "unsupportedDslNodes.descriptionWithTypes": "Această versiune conține noduri pe care runtime-ul de implementare nu le suportă încă: {{nodeTypes}}. Elimină-le sau înlocuiește-le în Studio, apoi încearcă din nou.",
+  "unsupportedDslNodes.title": "Noduri nesuportate",
+  "unsupportedDslNodes.unknownType": "Tip necunoscut",
+  "versions.cancelCreate": "Anulează",
+  "versions.cancelDelete": "Anulează",
+  "versions.cancelEdit": "Anulează",
+  "versions.checkingReleaseContent": "Se verifică conținutul versiunii...",
+  "versions.col.action": "Acțiune",
+  "versions.col.author": "Creat de",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Creat la",
+  "versions.col.deployedTo": "Implementat în",
+  "versions.col.release": "Versiune",
+  "versions.col.sourceApp": "Sursă",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Creează",
+  "versions.createFailed": "Crearea versiunii a eșuat.",
+  "versions.createRelease": "Creează versiune",
+  "versions.createReleaseDescription": "Creează o versiune implementabilă dintr-o aplicație Workflow sau dintr-un fișier DSL Workflow.",
+  "versions.createReleaseHint": "Versiunile noi pot fi implementate în orice mediu.",
+  "versions.createSuccess": "Versiunea \"{{name}}\" a fost creată.",
+  "versions.creating": "Se creează...",
+  "versions.currentOn": "Versiunea curentă pe {{name}}",
+  "versions.deleteConfirmDesc": "Versiunea \"{{name}}\" va fi ștearsă definitiv. Această acțiune nu poate fi anulată.",
+  "versions.deleteConfirmTitle": "Ștergi versiunea?",
+  "versions.deleteFailed": "Ștergerea versiunii a eșuat.",
+  "versions.deleteImpactDeployment": "Stare implementare",
+  "versions.deleteImpactNotDeployed": "Nu este implementat în prezent",
+  "versions.deleteImpactRelease": "Versiune",
+  "versions.deleteImpactTitle": "Impact ștergere",
+  "versions.deleteRelease": "Șterge versiunea",
+  "versions.deleteSuccess": "Versiunea \"{{name}}\" a fost ștearsă.",
+  "versions.deploy": "Implementează",
+  "versions.deployTo": "Implementează în {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Se implementează",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sincronizare în așteptare",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Eșuat",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Invalid",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Rulează",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Neimplementat",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Se anulează implementarea",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Necunoscut",
+  "versions.deployingTo": "{{name}} se implementează",
+  "versions.disabledReason.checkDeploymentsFailed": "Verificarea utilizării implementării nu a reușit. Încearcă din nou mai târziu.",
+  "versions.disabledReason.checkingDeployments": "Se verifică utilizarea implementării",
+  "versions.disabledReason.current": "Această versiune rulează deja pe {{name}}",
+  "versions.disabledReason.deploying": "Așteaptă finalizarea implementării active",
+  "versions.disabledReason.envDisabled": "Acest mediu nu este implementabil",
+  "versions.disabledReason.releaseInUse_one": "Anulează implementarea acestei versiuni din {{count}} mediu înainte de a o șterge",
+  "versions.disabledReason.releaseInUse_other": "Anulează implementarea acestei versiuni din {{count}} medii înainte de a o șterge",
+  "versions.dslReadFailed": "Citirea fișierului DSL a eșuat. Alege alt fișier și încearcă din nou.",
+  "versions.dslReading": "Se citește fișierul DSL...",
+  "versions.dslUnsupportedMode": "Doar fișierele DSL Workflow pot fi utilizate pentru implementări.",
+  "versions.editFailed": "Actualizarea versiunii a eșuat.",
+  "versions.editRelease": "Editează versiunea",
+  "versions.editReleaseDescription": "Actualizează numele și descrierea acestei versiuni.",
+  "versions.editSuccess": "Versiunea \"{{name}}\" a fost actualizată.",
+  "versions.empty": "Nicio versiune disponibilă încă.",
+  "versions.emptyDescription": "Creează prima versiune înainte de a implementa într-un mediu.",
+  "versions.emptyTitle": "Nicio versiune încă",
+  "versions.emptyWithCreate": "Nicio versiune încă. Creează prima versiune implementabilă înainte de implementare.",
+  "versions.exportDsl": "Exportă DSL",
+  "versions.exportDslFailed": "Exportul DSL a eșuat.",
+  "versions.exportingDsl": "Se exportă...",
+  "versions.groupHeader.deploy": "Implementează",
+  "versions.groupHeader.promote": "Implementează",
+  "versions.groupHeader.rollback": "Implementează versiunea anterioară",
+  "versions.groupHeader.unavailable": "Indisponibil",
+  "versions.manualDslOption": "Încarcă DSL",
+  "versions.moreActions": "Mai multe acțiuni",
+  "versions.optional": "Opțional",
+  "versions.promote": "Implementează",
+  "versions.promoteTo": "Implementează în {{name}}",
+  "versions.releaseAlreadyExists": "O versiune cu același conținut există deja: {{name}}.",
+  "versions.releaseContentCheckFailed": "Verificarea conținutului versiunii a eșuat.",
+  "versions.releaseDescriptionLabel": "Descriere",
+  "versions.releaseDescriptionPlaceholder": "Descrie această versiune",
+  "versions.releaseHistory": "Istoric versiuni",
+  "versions.releaseNameLabel": "Nume versiune",
+  "versions.releaseNamePlaceholder": "Nume versiune",
+  "versions.releaseNameRequired": "Introdu un nume pentru versiune.",
+  "versions.releaseSourceLabel": "Sursă versiune",
+  "versions.rollbackTo": "Implementează în {{name}}",
+  "versions.saveEdit": "Salvează",
+  "versions.sourceAppOption": "Aplicație Workflow"
+}
diff --git a/web/i18n/ro-RO/workflow.json b/web/i18n/ro-RO/workflow.json
index 5fd41b86b39..506d99765af 100644
--- a/web/i18n/ro-RO/workflow.json
+++ b/web/i18n/ro-RO/workflow.json
@@ -1,5 +1,6 @@
 {
   "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Răspuns",
   "blocks.assigner": "Asignator de Variabile",
   "blocks.code": "Cod",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Agregator de variabile",
   "blocks.variable-assigner": "Asignator de variabile",
   "blocksAbout.agent": "Invocarea modelelor lingvistice mari pentru a răspunde la întrebări sau pentru a procesa limbajul natural",
+  "blocksAbout.agent-v2": "Invocarea modelelor lingvistice mari pentru a răspunde la întrebări sau pentru a procesa limbajul natural",
   "blocksAbout.answer": "Definiți conținutul răspunsului unei conversații",
   "blocksAbout.assigner": "Nodul de atribuire a variabilelor este utilizat pentru a atribui valori variabilelor inscriptibile (precum variabilele de conversație).",
   "blocksAbout.code": "Executați un fragment de cod Python sau NodeJS pentru a implementa logică personalizată",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID flux de lucru",
   "globalVar.fieldsDescription.workflowRunId": "ID rulare flux de lucru",
   "globalVar.title": "Variabile de sistem",
+  "nodes.agent.advancedSetting": "Setări avansate",
   "nodes.agent.checkList.strategyNotSelected": "Strategia neselectată",
   "nodes.agent.clickToViewParameterSchema": "Click pentru a vizualiza schema parametrilor",
   "nodes.agent.configureModel": "Configurați modelul",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Model neacceptat",
   "nodes.agent.modelSelectorTooltips.deprecated": "Acest model este învechit",
   "nodes.agent.notAuthorized": "Neautorizat",
+  "nodes.agent.outputVars.confirm": "Confirmă",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Introduceți un array JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Introduceți true sau false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Valorile implicite pentru fișiere nu sunt încă configurabile aici.",
+  "nodes.agent.outputVars.defaultValueLabel": "Implicit",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Introduceți un număr valid.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Introduceți un obiect JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Valoare implicită",
+  "nodes.agent.outputVars.delete": "Șterge {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Descriere",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Adaugă descriere",
+  "nodes.agent.outputVars.edit": "Editează {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Editor de variabile de ieșire",
   "nodes.agent.outputVars.files.title": "Fișiere generate de agent",
   "nodes.agent.outputVars.files.transfer_method": "Metoda de transfer. Valoarea este remote_url sau local_file",
   "nodes.agent.outputVars.files.type": "Tip de suport. Acum acceptă doar imaginea",
   "nodes.agent.outputVars.files.upload_file_id": "Încărcați ID-ul fișierului",
   "nodes.agent.outputVars.files.url": "Adresa URL a imaginii",
   "nodes.agent.outputVars.json": "JSON generat de agent",
+  "nodes.agent.outputVars.nameDuplicate": "Numele de ieșire există deja",
+  "nodes.agent.outputVars.nameInvalid": "Utilizați litere, cifre și underscore. Începeți cu o literă sau un underscore.",
+  "nodes.agent.outputVars.nameLabel": "Nume câmp",
+  "nodes.agent.outputVars.namePlaceholder": "Nume câmp",
+  "nodes.agent.outputVars.newOutput": "Ieșire nouă",
+  "nodes.agent.outputVars.requiredLabel": "Obligatoriu",
+  "nodes.agent.outputVars.showAdvancedOptions": "Afișează opțiunile avansate",
   "nodes.agent.outputVars.text": "Conținut generat de agent",
+  "nodes.agent.outputVars.typeLabel": "Tip de ieșire",
   "nodes.agent.outputVars.usage": "Informații de utilizare a modelului",
   "nodes.agent.parameterSchema": "Schema parametrului",
   "nodes.agent.pluginInstaller.install": "Instala",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Acest integrare este instalat de pe GitHub. Vă rugăm să accesați Integrări pentru a reinstala",
   "nodes.agent.pluginNotInstalled": "Acest integrare nu este instalat",
   "nodes.agent.pluginNotInstalledDesc": "Acest integrare este instalat de pe GitHub. Vă rugăm să accesați Integrări pentru a reinstala",
+  "nodes.agent.roster.change": "Schimbă",
+  "nodes.agent.roster.editInConsole": "Editează în Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "O configurare unică ce există doar în acest nod",
+  "nodes.agent.roster.inlineSetup.name": "Configurare inline",
+  "nodes.agent.roster.inlineSetup.title": "Configurarea agentului",
+  "nodes.agent.roster.inlineSetup.type": "Doar în acest nod",
+  "nodes.agent.roster.label": "Agent",
+  "nodes.agent.roster.makeCopy": "Creează o copie",
+  "nodes.agent.roster.more": "Mai multe acțiuni pentru agent",
+  "nodes.agent.roster.openPanel": "Deschide detaliile {{name}}",
+  "nodes.agent.roster.panelLabel": "Detaliile {{name}}",
   "nodes.agent.strategy.configureTip": "Vă rugăm să configurați strategia agentică.",
   "nodes.agent.strategy.configureTipDesc": "După configurarea strategiei agentice, acest nod va încărca automat configurațiile rămase. Strategia va afecta mecanismul raționamentului instrumentelor în mai mulți pași.",
   "nodes.agent.strategy.label": "Strategia agentică",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Versiunea de integrare instalată nu oferă această strategie. Faceți clic pentru a comuta versiunea.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} nu este instalat",
   "nodes.agent.strategyNotSet": "Strategia agentică nu este setată",
+  "nodes.agent.task.insert": "Inserează",
+  "nodes.agent.task.label": "Sarcina agentului",
+  "nodes.agent.task.mention": "Menționează",
+  "nodes.agent.task.placeholder": "Descrieți ce ar trebui să facă acest agent...",
+  "nodes.agent.task.tooltip": "Definiți instrucțiunile sarcinii pe care acest agent trebuie să le urmeze în acest workflow.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Neautorizat",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} nu este instalat",
   "nodes.agent.toolbox": "cutie de scule",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "De {{author}}",
   "tabs.question-understand": "Înțelegerea întrebărilor",
   "tabs.requestToCommunity": "Cereri către comunitate",
-  "tabs.searchBlock": "Căutare nod",
+  "tabs.searchBlock": "Caută noduri, agent, uman, cunoștințe",
   "tabs.searchDataSource": "Sursa de date de căutare",
   "tabs.searchSnippets": "Căutați fragmente...",
   "tabs.searchTool": "Instrument de căutare",
diff --git a/web/i18n/ru-RU/agent-v-2.json b/web/i18n/ru-RU/agent-v-2.json
new file mode 100644
index 00000000000..aec1fc7d82a
--- /dev/null
+++ b/web/i18n/ru-RU/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Это действие пока недоступно.",
+  "agentDetail.access.actions.monitoring": "Мониторинг",
+  "agentDetail.access.copyAccessUrl": "Скопировать URL доступа",
+  "agentDetail.access.copyFailed": "Не удалось скопировать ссылку.",
+  "agentDetail.access.copyReference": "Скопировать ссылку для {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Скопировать конечную точку API сервиса",
+  "agentDetail.access.description": "Все точки доступа, через которые можно обратиться к этому агенту.",
+  "agentDetail.access.empty": "Нет связанных точек доступа",
+  "agentDetail.access.emptyDescription": "У этого агента из Roster пока нет ссылок на приложения или рабочие процессы.",
+  "agentDetail.access.entries.agentApp.description": "Агентское приложение, связанное с этим агентом из Roster.",
+  "agentDetail.access.entries.agentApp.name": "Агентское приложение",
+  "agentDetail.access.entries.workflow.description": "Рабочий процесс и узел, связанные с этим агентом из Roster.",
+  "agentDetail.access.entries.workflow.name": "Узел рабочего процесса",
+  "agentDetail.access.entryCount_one": "{{count}} запись",
+  "agentDetail.access.entryCount_other": "{{count}} записей",
+  "agentDetail.access.groups.references.heading": "Ссылки",
+  "agentDetail.access.groups.references.label": "Связанные ссылки",
+  "agentDetail.access.learnMore": "Подробнее",
+  "agentDetail.access.moreActions": "Дополнительные действия для {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Конечная точка API сервиса",
+  "agentDetail.access.serviceApi.title": "Бэкенд API сервиса",
+  "agentDetail.access.status.disabled": "Отключено",
+  "agentDetail.access.status.enabled": "Включено",
+  "agentDetail.access.status.inService": "В работе",
+  "agentDetail.access.status.outOfService": "Не в работе",
+  "agentDetail.access.title": "Точка доступа",
+  "agentDetail.access.toggleSurface": "Переключить доступ {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL доступа",
+  "agentDetail.access.webApp.actions.customize": "Настроить",
+  "agentDetail.access.webApp.actions.embedded": "Встроить",
+  "agentDetail.access.webApp.actions.launch": "Запустить",
+  "agentDetail.access.webApp.actions.settings": "Настройки",
+  "agentDetail.access.webApp.refreshUrl": "Обновить URL доступа",
+  "agentDetail.access.webApp.showQrCode": "Показать QR-код",
+  "agentDetail.access.webApp.ssoEnabled": "SSO включено",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Используется как узел внутри рабочего процесса",
+  "agentDetail.access.workflow.empty": "Пока нет ссылок на рабочие процессы.",
+  "agentDetail.access.workflow.loadFailed": "Не удалось загрузить ссылки на рабочие процессы.",
+  "agentDetail.access.workflow.loading": "Загрузка ссылок на рабочие процессы…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} узел",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} узлов",
+  "agentDetail.access.workflow.notAvailable": "Н/Д",
+  "agentDetail.access.workflow.openInStudio": "Открыть в Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Открыть {{name}} в Studio",
+  "agentDetail.access.workflow.table.actions": "Действия",
+  "agentDetail.access.workflow.table.lastUpdated": "Последнее обновление",
+  "agentDetail.access.workflow.table.name": "Имя",
+  "agentDetail.access.workflow.table.nodes": "Узлы",
+  "agentDetail.access.workflow.table.version": "Версия",
+  "agentDetail.access.workflow.title": "Доступ к рабочему процессу",
+  "agentDetail.configure.advancedSettings.description": "Для опытных пользователей. Переменные окружения, песочница и память.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Добавить переменную окружения",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Удалить {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Скрыть значение {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Импортировать .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Чтобы показать скрытые файлы .env, в окне выбора файла нажмите Command + Shift + .",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Если ваш файл .env скрыт, включите отображение скрытых файлов в системном диалоге выбора файлов.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Чтобы показать скрытые файлы .env, включите параметр «Скрытые элементы» в Проводнике.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Показать значение {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Выберите область переменной окружения",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Переменные окружения, доступные этому агенту во время выполнения.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Переключить Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Расширенные настройки",
+  "agentDetail.configure.advancedSettings.toggle": "Переключить расширенные настройки",
+  "agentDetail.configure.chatFeatures.description": "Настройте чат-опыт конечного пользователя в вашем веб-приложении и чат-поверхностях.",
+  "agentDetail.configure.chatFeatures.title": "Функции чата",
+  "agentDetail.configure.files.add": "Добавить файл",
+  "agentDetail.configure.files.empty.description": "Загрузите документы, которые может прочитать агент, например спецификации, шаблоны или руководства",
+  "agentDetail.configure.files.empty.title": "Пока нет файлов",
+  "agentDetail.configure.files.label": "Файлы",
+  "agentDetail.configure.files.preview.empty": "Нет содержимого для предпросмотра.",
+  "agentDetail.configure.files.preview.failed": "Не удалось загрузить предпросмотр.",
+  "agentDetail.configure.files.preview.unsupported": "Этот файл не поддерживает предварительный просмотр.",
+  "agentDetail.configure.files.remove": "Удалить {{name}}",
+  "agentDetail.configure.files.tip": "Файлы, которые этот агент может использовать при выполнении задач.",
+  "agentDetail.configure.files.toggle": "Переключить файлы",
+  "agentDetail.configure.files.treeLabel": "Файлы агента",
+  "agentDetail.configure.files.upload.action": "Загрузить",
+  "agentDetail.configure.files.upload.browse": "обзор",
+  "agentDetail.configure.files.upload.description": "Загрузите файл для этого агента.",
+  "agentDetail.configure.files.upload.dropzone": "Перетащите файл сюда или",
+  "agentDetail.configure.files.upload.failed": "Не удалось загрузить файл.",
+  "agentDetail.configure.files.upload.fileType": "ФАЙЛ",
+  "agentDetail.configure.files.upload.invalidFile": "Загрузите один файл.",
+  "agentDetail.configure.files.upload.success": "Файл загружен.",
+  "agentDetail.configure.files.upload.title": "Загрузить файл",
+  "agentDetail.configure.knowledgeRetrieval.add": "Добавить поиск по знаниям",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Добавить знания",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Нажмите кнопку «+», чтобы добавить знания",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Знания",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Настройки поиска",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Подробнее о поиске по знаниям",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Автоматически",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Условия",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Отключено",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Фильтрация по метаданным",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Вручную",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Выберите режим фильтрации по метаданным",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Имя поиска по знаниям",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Решает агент",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Агент сам формирует запрос на основе промпта и доступного контекста. Настраивать здесь ничего не нужно.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Пользовательский запрос",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Напишите фиксированный запрос для этого источника поиска.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Текст пользовательского запроса",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Введите поисковый запрос",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Запрос",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Поиск по знаниям · Решает агент",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Редактировать {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Подключите базу знаний, по которой агент сможет искать при ответе",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Пока нет знаний",
+  "agentDetail.configure.knowledgeRetrieval.label": "Поиск по знаниям",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Удалить {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Источники поиска по знаниям, которые этот агент может использовать при выполнении задач.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Переключить поиск по знаниям",
+  "agentDetail.configure.model.label": "Модель",
+  "agentDetail.configure.orchestrate": "Оркестрация",
+  "agentDetail.configure.preview.chatFeatures": "Функции чата",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Агент",
+  "agentDetail.configure.preview.empty.description": "Отправьте сообщение, чтобы протестировать текущий черновик.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Инструкций пока нет, поэтому ответы приходят от базовой модели.",
+  "agentDetail.configure.preview.endUserAuth": "Аутентификация конечного пользователя",
+  "agentDetail.configure.preview.restart": "Перезапустить предпросмотр",
+  "agentDetail.configure.preview.title": "Предпросмотр",
+  "agentDetail.configure.prompt.copied": "Промпт скопирован",
+  "agentDetail.configure.prompt.copy": "Копировать промпт",
+  "agentDetail.configure.prompt.copyFailed": "Не удалось скопировать промпт.",
+  "agentDetail.configure.prompt.insert.label": "Вставить",
+  "agentDetail.configure.prompt.insert.question": "Начальный вопрос",
+  "agentDetail.configure.prompt.insert.reportFile": "Файл выходного отчёта",
+  "agentDetail.configure.prompt.insert.tenders": "Начать тендеры",
+  "agentDetail.configure.prompt.label": "Промпт",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Упомянуть",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Напишите инструкции здесь,",
+  "agentDetail.configure.prompt.tip": "Определите, как этот агент должен интерпретировать входные данные, вызывать инструменты и формировать выходные данные.",
+  "agentDetail.configure.publishBar.draft": "Черновик",
+  "agentDetail.configure.publishBar.publishUpdate": "Опубликовать обновление",
+  "agentDetail.configure.publishBar.published": "Опубликовано",
+  "agentDetail.configure.publishBar.publishedAt": "Опубликовано {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Публикация…",
+  "agentDetail.configure.publishBar.saved": "Сохранено 5 мин назад",
+  "agentDetail.configure.publishBar.savedAt": "Сохранено {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Неопубликованные изменения",
+  "agentDetail.configure.publishBar.upToDate": "Актуально",
+  "agentDetail.configure.publishBar.versionHistory": "Открыть историю версий",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Затронутые рабочие процессы",
+  "agentDetail.configure.publishImpact.cancel": "Отмена",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Ваш агент используется в",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Изменения повлияют на них.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "этого агента",
+  "agentDetail.configure.publishImpact.title": "{{action}} в {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} рабочий процесс",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} рабочих процессов",
+  "agentDetail.configure.skills.add": "Добавить навык",
+  "agentDetail.configure.skills.detail.contentRegion": "Содержимое деталей навыка",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} ФАЙЛОВ",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Файлы навыка",
+  "agentDetail.configure.skills.detail.files": "Файлы",
+  "agentDetail.configure.skills.empty.description": "Навыки дают агенту переиспользуемую экспертизу, которую он может вызывать в работе",
+  "agentDetail.configure.skills.empty.title": "Пока нет навыков",
+  "agentDetail.configure.skills.itemType": "Навык",
+  "agentDetail.configure.skills.label": "Навыки",
+  "agentDetail.configure.skills.remove": "Удалить {{name}}",
+  "agentDetail.configure.skills.tip": "Навыки, которые этот агент может использовать при выполнении задач.",
+  "agentDetail.configure.skills.toggle": "Переключить навыки",
+  "agentDetail.configure.skills.upload.action": "Загрузить",
+  "agentDetail.configure.skills.upload.browse": "обзор",
+  "agentDetail.configure.skills.upload.description": "Загрузите пакет .zip или .skill для этого агента.",
+  "agentDetail.configure.skills.upload.dropzone": "Перетащите пакет навыка сюда или",
+  "agentDetail.configure.skills.upload.failed": "Не удалось загрузить навык.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Загрузите файл .zip или .skill.",
+  "agentDetail.configure.skills.upload.success": "Навык загружен.",
+  "agentDetail.configure.skills.upload.title": "Загрузить навык",
+  "agentDetail.configure.tools.add": "Добавить инструмент",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Для разработчиков",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Установите программу командной строки, которую агент запускает в песочнице. Требуется установка, обычно также API Key.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI-инструмент",
+  "agentDetail.configure.tools.addMenu.tool.description": "Выберите инструмент, уже доступный в этом рабочем пространстве, например веб-поиск или интеграции.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Инструмент",
+  "agentDetail.configure.tools.cliDialog.description": "Установите CLI-инструмент из любого реестра пакетов. Агент получит shell-доступ к предоставляемому им бинарному файлу.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Редактировать CLI-инструмент",
+  "agentDetail.configure.tools.cliDialog.env.description": "Хранение API Key, токенов или секретов, которые нужны этому CLI-инструменту. Значения шифруются в покое и внедряются как переменные окружения при вызове инструмента агентом.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Переменные окружения",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(необязательно)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "В песочнице · запускается один раз при первом вызове",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Команда установки",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Вставьте команду установки здесь, например npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Команда установки обязательна.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Подробнее о CLI-инструменте",
+  "agentDetail.configure.tools.cliDialog.name.label": "Имя CLI-инструмента",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Назовите свой CLI-инструмент",
+  "agentDetail.configure.tools.cliDialog.name.required": "Имя CLI-инструмента обязательно.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Никогда не виден в промпте агента; внедряется только как $VAR во время выполнения",
+  "agentDetail.configure.tools.cliDialog.title": "Добавить CLI-инструмент",
+  "agentDetail.configure.tools.cliTool": "CLI-инструмент",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Конечный пользователь · OAuth",
+  "agentDetail.configure.tools.editAction": "Редактировать {{name}}",
+  "agentDetail.configure.tools.empty.description": "Инструменты позволяют агенту действовать — например, искать в интернете или вызывать ваши приложения",
+  "agentDetail.configure.tools.empty.title": "Пока нет инструментов",
+  "agentDetail.configure.tools.label": "Инструменты",
+  "agentDetail.configure.tools.moreActions": "Дополнительные действия для {{name}}",
+  "agentDetail.configure.tools.pluginType": "Интеграция",
+  "agentDetail.configure.tools.preAuthorize": "Предварительная авторизация",
+  "agentDetail.configure.tools.removeAction": "Удалить {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Удалить все инструменты",
+  "agentDetail.configure.tools.tip": "Инструменты, которые этот агент может вызывать при выполнении задач.",
+  "agentDetail.configure.tools.toggle": "Переключить инструменты",
+  "agentDetail.configure.tools.toolTabs.all": "Все",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Пользовательские",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Интеграции",
+  "agentDetail.configure.tools.toolTabs.workflow": "Рабочий процесс",
+  "agentDetail.documentTitle": "Агент",
+  "agentDetail.history": "История",
+  "agentDetail.logs.description": "Полные журналы записывают статус работы приложения, включая ввод пользователя, ответы агента, планирование и использование инструментов.",
+  "agentDetail.logs.empty": "Журналы не найдены",
+  "agentDetail.logs.filters.period.allTime": "За всё время",
+  "agentDetail.logs.filters.period.label": "Период журнала",
+  "agentDetail.logs.filters.period.last30days": "Последние 30 дней",
+  "agentDetail.logs.filters.period.last7days": "Последние 7 дней",
+  "agentDetail.logs.filters.search.label": "Поиск по журналу",
+  "agentDetail.logs.filters.search.placeholder": "Поиск",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Время последнего создания",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Время последнего обновления",
+  "agentDetail.logs.filters.source.all": "Источник",
+  "agentDetail.logs.filters.source.empty": "Источники не найдены",
+  "agentDetail.logs.filters.source.label": "Источник журнала",
+  "agentDetail.logs.filters.source.loadFailed": "Не удалось загрузить источники",
+  "agentDetail.logs.filters.source.loading": "Загрузка источников…",
+  "agentDetail.logs.filters.source.searchLabel": "Поиск источников",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Поиск",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Рабочий процесс",
+  "agentDetail.logs.learnMore": "Подробнее",
+  "agentDetail.logs.loadFailed": "Не удалось загрузить журналы",
+  "agentDetail.logs.loading": "Загрузка журналов…",
+  "agentDetail.logs.notAvailable": "Н/Д",
+  "agentDetail.logs.table.createdTime": "Время создания",
+  "agentDetail.logs.table.endUser": "Конечный пользователь",
+  "agentDetail.logs.table.messageCount": "Кол-во сообщений",
+  "agentDetail.logs.table.operationRate": "Уровень операций",
+  "agentDetail.logs.table.source": "Источник",
+  "agentDetail.logs.table.title": "Заголовок",
+  "agentDetail.logs.table.unread": "Непрочитанные",
+  "agentDetail.logs.table.updatedTime": "Время обновления",
+  "agentDetail.logs.table.userRate": "Оценка пользователя",
+  "agentDetail.logs.title": "Журналы",
+  "agentDetail.memorySettings.budgetLabel": "Бюджет памяти",
+  "agentDetail.memorySettings.description": "Настройки памяти из активного снимка конфигурации.",
+  "agentDetail.memorySettings.export.description": "Экспорт памяти запланирован на более позднюю версию.",
+  "agentDetail.memorySettings.export.download": "Скачать",
+  "agentDetail.memorySettings.export.soon": "Скоро",
+  "agentDetail.memorySettings.export.title": "Экспортировать текущую память",
+  "agentDetail.memorySettings.notConfigured": "Не настроено",
+  "agentDetail.memorySettings.scopeLabel": "Область памяти",
+  "agentDetail.memorySettings.title": "Память",
+  "agentDetail.metadata.activeVersionLabel": "Активная версия",
+  "agentDetail.metadata.appIdLabel": "ID приложения",
+  "agentDetail.metadata.description": "Поля Roster только для чтения, возвращаемые бэкендом агента.",
+  "agentDetail.metadata.emptyValue": "Недоступно",
+  "agentDetail.metadata.scopeLabel": "Область",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Только рабочий процесс",
+  "agentDetail.metadata.sourceLabel": "Источник",
+  "agentDetail.metadata.statusLabel": "Статус",
+  "agentDetail.metadata.title": "Метаданные",
+  "agentDetail.metadata.updatedAtLabel": "Обновлено",
+  "agentDetail.metadata.workflowIdLabel": "ID рабочего процесса",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID узла рабочего процесса",
+  "agentDetail.monitoring.change": "{{value}} к предыдущему периоду",
+  "agentDetail.monitoring.dateRangeLabel": "Диапазон дат",
+  "agentDetail.monitoring.description": "Отслеживайте активность переиспользуемого агента, затраты и качество взаимодействия в рабочих процессах.",
+  "agentDetail.monitoring.learnMore": "Подробнее",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Уникальные конечные пользователи, запустившие рабочие процессы с этим агентом.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Активные пользователи",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Количество непрерывных взаимодействий пользователя с агентом для этой точки доступа.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Среднее число взаимодействий за сессию",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Средняя скорость вывода от начала запроса до завершения.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Скорость вывода токенов",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Оценочная стоимость токенов, производимых этим агентом в запусках рабочих процессов.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Использование токенов",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Ежедневное количество AI-разговоров, достигших этого агента через выбранную точку доступа.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Всего разговоров",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Ежедневное количество взаимодействий агента.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Всего сообщений",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Количество лайков на 1000 сообщений для этого агента.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Уровень удовлетворённости пользователей",
+  "agentDetail.monitoring.pickSource": "Выберите приложение",
+  "agentDetail.monitoring.sourceLabel": "Приложение",
+  "agentDetail.monitoring.sourceTrigger": "Источник {{name}}",
+  "agentDetail.monitoring.sources.all": "Все",
+  "agentDetail.monitoring.timeRangeLabel": "Временной диапазон",
+  "agentDetail.monitoring.timeRanges.custom": "Произвольный",
+  "agentDetail.monitoring.timeRanges.last30days": "Последние 30 дней",
+  "agentDetail.monitoring.timeRanges.last7days": "Последние 7 дней",
+  "agentDetail.monitoring.timeRanges.today": "Сегодня",
+  "agentDetail.monitoring.title": "Мониторинг",
+  "agentDetail.monitoring.tokenUsageConsumed": "Использованные токены",
+  "agentDetail.monitoring.units.tokenPerSecond": "Токен/с",
+  "agentDetail.navigationLabel": "Навигация агента",
+  "agentDetail.publish": "Опубликовать",
+  "agentDetail.publishSoon": "Скоро",
+  "agentDetail.sections.access": "Точка доступа",
+  "agentDetail.sections.configure": "Оркестрация",
+  "agentDetail.sections.logs": "Журналы",
+  "agentDetail.sections.monitoring": "Мониторинг",
+  "agentDetail.subtitle": "ID агента: {{agentId}}",
+  "agentDetail.title": "Агент",
+  "agentDetail.type": "АГЕНТ",
+  "agentDetail.versionHistory.active": "Активная",
+  "agentDetail.versionHistory.empty": "Версий пока нет",
+  "agentDetail.versionHistory.filter": "Фильтровать версии",
+  "agentDetail.versionHistory.versionName": "Версия {{version}}",
+  "roster.createAgent": "Создать агента",
+  "roster.createAgentOptions": "Варианты создания агента",
+  "roster.createDialog.description": "Создайте переиспользуемого агента в Roster этого рабочего пространства.",
+  "roster.createDialog.title": "Создать агента",
+  "roster.createForm.changeIcon": "Сменить иконку агента",
+  "roster.createForm.descriptionLabel": "Описание",
+  "roster.createForm.descriptionOptional": "(необязательно)",
+  "roster.createForm.descriptionPlaceholder": "напр. Собирает источники по теме и резюмирует ключевые выводы",
+  "roster.createForm.nameLabel": "Имя",
+  "roster.createForm.namePlaceholder": "напр. Max",
+  "roster.createForm.nameRequired": "Имя обязательно.",
+  "roster.createForm.roleLabel": "Роль",
+  "roster.createForm.rolePlaceholder": "напр. Помощник по исследованиям",
+  "roster.createForm.roleRequired": "Роль обязательна.",
+  "roster.createSuccess": "Агент создан.",
+  "roster.dateTimeFormat": "DD.MM.YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Этот агент будет удалён из активного списка Roster.",
+  "roster.deleteDialog.title": "Удалить {{name}}?",
+  "roster.deleteFailed": "Не удалось удалить агента.",
+  "roster.deleteSuccess": "Агент удалён.",
+  "roster.duplicateFailed": "Не удалось продублировать агента.",
+  "roster.duplicateSuccess": "Агент продублирован.",
+  "roster.editAgent": "Редактировать {{name}}",
+  "roster.editDialog.description": "Обновите имя в Roster, описание и роль этого агента.",
+  "roster.editDialog.title": "Редактировать агента",
+  "roster.editInfo": "Редактировать информацию",
+  "roster.empty": "Агентов пока нет",
+  "roster.emptyDescription": "Агенты, сохранённые в этом рабочем пространстве, будут отображаться здесь.",
+  "roster.emptySearch": "Подходящих агентов не найдено",
+  "roster.emptySearchDescription": "Попробуйте другое имя агента.",
+  "roster.filters.all": "Все",
+  "roster.filters.drafts": "Черновики",
+  "roster.filters.label": "Фильтры агентов",
+  "roster.filters.published": "Опубликованные",
+  "roster.learnMore": "Подробнее об Agent Roster",
+  "roster.listLabel": "Список Roster агентов",
+  "roster.loadMore": "Загрузить ещё",
+  "roster.loadingError": "Не удалось загрузить агентов. Обновите и попробуйте снова.",
+  "roster.moreActions": "Дополнительные действия для {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Не удалось создать встроенного агента. Обновите и попробуйте снова.",
+  "roster.nodeSelector.dialogLabel": "Выберите агента",
+  "roster.nodeSelector.manageInAgentConsole": "Управлять в Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Поиск…",
+  "roster.nodeSelector.startFromScratch": "Начать с нуля",
+  "roster.references.label": "Рабочие процессы, использующие {{name}}",
+  "roster.references.trigger": "Рабочие процессы, использующие {{name}}",
+  "roster.searchLabel": "Поиск агентов",
+  "roster.searchPlaceholder": "Поиск агентов по имени…",
+  "roster.sources.agent_app": "Агентское приложение",
+  "roster.sources.imported": "Импортированные",
+  "roster.sources.system": "Системные",
+  "roster.sources.workflow": "Рабочий процесс",
+  "roster.status.active": "Активный",
+  "roster.status.archived": "В архиве",
+  "roster.tabs.agent": "Агент",
+  "roster.tabs.human": "Человек",
+  "roster.tabsLabel": "Тип Roster",
+  "roster.updateSuccess": "Агент обновлён.",
+  "roster.usageStatus.draft": "Черновик"
+}
diff --git a/web/i18n/ru-RU/app-log.json b/web/i18n/ru-RU/app-log.json
index e4c0c338b58..ab2cdec984e 100644
--- a/web/i18n/ru-RU/app-log.json
+++ b/web/i18n/ru-RU/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Сегодня",
   "filter.period.yearToDate": "С начала года",
   "filter.sortBy": "Сортировать по:",
+  "monitoring.description": "Мониторинг записывает состояние работы приложения, включая производительность, активность пользователей и затраты.",
   "promptLog": "Журнал подсказок",
   "runDetail.fileListDetail": "Подробность",
   "runDetail.fileListLabel": "Сведения о файле",
diff --git a/web/i18n/ru-RU/billing.json b/web/i18n/ru-RU/billing.json
index d021f88aaf4..c607db5df4d 100644
--- a/web/i18n/ru-RU/billing.json
+++ b/web/i18n/ru-RU/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Обновите версию, чтобы включить массовую загрузку документов",
   "upgrade.uploadMultiplePages.description": "Вы достигли лимита загрузки — на вашем текущем тарифном плане можно выбрать и загрузить только один документ за раз.",
   "upgrade.uploadMultiplePages.title": "Обновите версию, чтобы загружать несколько документов одновременно",
+  "upgrade.workflowRestore.description": "Восстановление версий рабочего процесса недоступно в вашем текущем плане.",
+  "upgrade.workflowRestore.title": "Обновите план, чтобы восстанавливать версии рабочего процесса",
   "upgradeBtn.encourage": "Обновить сейчас",
   "upgradeBtn.encourageShort": "Обновить",
   "upgradeBtn.plain": "Обновить тарифный план",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 9f88570042a..c102589aa8e 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Переключить рабочую область",
   "mcpPage.description": "Подключайте и управляйте MCP-серверами, чтобы приложения могли обращаться к внешним инструментам и сервисам.",
-  "members.admin": "Администратор",
   "members.adminTip": "Может создавать приложения и управлять настройками команды",
+  "members.alreadyInTeam": "Уже в команде",
+  "members.alreadyInTeamTip": "Эти пользователи уже имеют доступ к этому рабочему пространству.",
   "members.builder": "Разработчик",
   "members.builderTip": "Может создавать и редактировать собственные приложения",
-  "members.datasetOperator": "Администратор знаний",
   "members.datasetOperatorTip": "Может управлять только базой знаний",
   "members.deleteMember": "Удалить участника",
   "members.disInvite": "Отменить приглашение",
-  "members.editor": "Редактор",
   "members.editorTip": "Может создавать и редактировать приложения",
   "members.email": "Электронная почта",
   "members.emailInvalid": "Неверный формат электронной почты",
@@ -270,13 +269,12 @@
   "members.invite": "Добавить",
   "members.inviteTeamMember": "Добавить участника команды",
   "members.inviteTeamMemberTip": "Они могут получить доступ к данным вашей команды сразу после входа в систему.",
-  "members.invitedAsRole": "Приглашен как пользователь с ролью {{role}}",
+  "members.invitedAsRole": "Приглашен как {{role}}",
   "members.lastActive": "ПОСЛЕДНЯЯ АКТИВНОСТЬ",
   "members.name": "ИМЯ",
-  "members.normal": "Обычный",
+  "members.noNewInvitationsSent": "Новые приглашения не отправлены",
   "members.normalTip": "Может только использовать приложения, не может создавать приложения",
   "members.ok": "ОК",
-  "members.owner": "Владелец",
   "members.pending": "Ожидание...",
   "members.removeFromTeam": "Удалить из команды",
   "members.removeFromTeamTip": "Удалить доступ к команде",
@@ -311,12 +309,14 @@
   "menus.apps": "Студия",
   "menus.datasets": "Знания",
   "menus.datasetsTips": "СКОРО: Импортируйте свои собственные текстовые данные или записывайте данные в режиме реального времени через Webhook для улучшения контекста LLM.",
+  "menus.deployments": "Развертывания",
   "menus.explore": "Исследовать",
   "menus.exploreMarketplace": "Подробнее о Marketplace",
   "menus.newApp": "Новое приложение",
   "menus.newDataset": "Создать знания",
   "menus.plugins": "Интеграции",
   "menus.pluginsTips": "Интегрируйте сторонние интеграции или создавайте совместимые с ChatGPT AI-интеграции.",
+  "menus.roster": "Список агентов",
   "menus.status": "бета",
   "menus.tools": "Инструменты",
   "model.addMoreModel": "Перейдите в настройки, чтобы добавить больше моделей",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Модель преобразования текста в речь",
   "modelProvider.ttsModel.tip": "Установите модель по умолчанию для ввода текста в речь в разговоре.",
   "modelProvider.upgradeForLoadBalancing": "Обновите свой тарифный план, чтобы включить балансировку нагрузки.",
+  "navigation.skipToMain": "Перейти к основному содержанию",
   "noData": "Нет данных",
   "operation.add": "Добавить",
   "operation.added": "Добавлено",
@@ -600,9 +601,6 @@
   "placeholder.input": "Пожалуйста, введите",
   "placeholder.search": "Поиск...",
   "placeholder.select": "Пожалуйста, выберите",
-  "plugin.serpapi.apiKey": "Ключ API",
-  "plugin.serpapi.apiKeyPlaceholder": "Введите свой ключ API",
-  "plugin.serpapi.keyFrom": "Получите свой ключ SerpAPI на странице учетной записи SerpAPI",
   "promptEditor.context.item.desc": "Вставить шаблон контекста",
   "promptEditor.context.item.title": "Контекст",
   "promptEditor.context.modal.add": "Добавить контекст ",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
new file mode 100644
index 00000000000..a894cdd9540
--- /dev/null
+++ b/web/i18n/ru-RU/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API бэкенд-сервиса",
+  "access.api.copyCurlExample": "Скопировать пример cURL",
+  "access.api.createFailed": "Не удалось сгенерировать API Token.",
+  "access.api.createKey": "Сгенерировать API Token",
+  "access.api.createKeyTitle": "Сгенерировать новый API Token",
+  "access.api.curlExampleTitle": "Пример cURL",
+  "access.api.description": "Доступ к этому развертыванию по HTTP. Каждый API Token действует в рамках одной среды.",
+  "access.api.developerTitle": "API для разработчиков",
+  "access.api.disabled": "Доступ по API для этого развертывания отключен.",
+  "access.api.disabledHint": "Включите доступ по API, чтобы генерировать токены в рамках сред.",
+  "access.api.dismissToken": "Закрыть API Token",
+  "access.api.docs": "Документация API",
+  "access.api.docsClose": "Закрыть документацию API",
+  "access.api.docsDescription": "Просмотрите справочник Workflow API для этого развертывания.",
+  "access.api.docsTitle": "Документация Workflow API",
+  "access.api.empty": "Сначала разверните в среду, чтобы начать выдавать API Tokens.",
+  "access.api.emptyTitle": "Нет развернутых сред",
+  "access.api.endpoint": "URL запроса",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Список API Tokens",
+  "access.api.nameLabel": "Имя API Token",
+  "access.api.namePlaceholder": "Введите имя API Token",
+  "access.api.nameRequired": "Имя API Token обязательно.",
+  "access.api.newKey": "Сгенерировать новый API Token",
+  "access.api.newTokenDescription": "Этот API Token отображается только один раз. Скопируйте его перед уходом с этой страницы.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token сгенерирован",
+  "access.api.noKeys": "Пока нет API Tokens. Сгенерируйте, чтобы начать вызывать API.",
+  "access.api.noKeysTitle": "Пока нет API Tokens",
+  "access.api.revokeConfirmDescription": "API Token \"{{name}}\" немедленно перестанет работать. Это действие нельзя отменить.",
+  "access.api.revokeConfirmTitle": "Отозвать API Token?",
+  "access.api.revokeFailed": "Не удалось отозвать API Token.",
+  "access.api.revokeSuccess": "API Token отозван",
+  "access.api.table.action": "Действие",
+  "access.api.table.environment": "Среда",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Имя",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Канал",
+  "access.channels.col.endpoint": "Точка входа",
+  "access.channels.col.status": "Статус",
+  "access.channels.description": "Точки входа WebApp и CLI используют указанные выше права доступа.",
+  "access.channels.disabled": "Каналы доступа для этого развертывания отключены.",
+  "access.channels.disabledHint": "Включите каналы доступа, чтобы открыть точки входа WebApp и CLI.",
+  "access.channels.followPermission": "Следует правам",
+  "access.channels.title": "Каналы доступа",
+  "access.cli.description": "Вызывайте из терминала с помощью difyctl, подходит для скриптов, автоматизированных Workflow или интеграций с агентом.",
+  "access.cli.docs": "Руководство по использованию",
+  "access.cli.domain": "Домен",
+  "access.cli.empty": "Конечная точка CLI не настроена.",
+  "access.cli.install": "Установить CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Скопировано",
+  "access.copy": "Копировать",
+  "access.copyFailed": "Не удалось скопировать",
+  "access.copyToast": "Скопировано в буфер обмена",
+  "access.hide": "Скрыть",
+  "access.members.clearAll": "Очистить все",
+  "access.members.empty": "Совпадений не найдено.",
+  "access.members.groupCount_one": "{{count}} группа",
+  "access.members.groupCount_other": "{{count}} групп",
+  "access.members.groups": "Группы",
+  "access.members.individuals": "Участники",
+  "access.members.memberCount_one": "{{count}} участник",
+  "access.members.memberCount_other": "{{count}} участников",
+  "access.members.pickPlaceholder": "Выберите группы или участников",
+  "access.members.searchPlaceholder": "Поиск групп и участников",
+  "access.members.selectedLabel": "Выбрано",
+  "access.permission.anyone": "Любой, у кого есть ссылка",
+  "access.permission.anyoneDesc": "Любой может получить доступ к этому развертыванию без входа.",
+  "access.permission.memberCount_one": "{{count}} участник",
+  "access.permission.memberCount_other": "{{count}} участников",
+  "access.permission.organization": "Все участники платформы",
+  "access.permission.organizationDesc": "Все участники платформы",
+  "access.permission.specific": "Определённые участники платформы",
+  "access.permission.specificDesc": "Выберите определённые группы или участников",
+  "access.permission.specificUnavailable": "Выбор конкретных участников недоступен, пока не будут подключены реальные участники и группы платформы.",
+  "access.permission.updateFailed": "Не удалось обновить политику доступа.",
+  "access.permissions.col.environment": "Среда",
+  "access.permissions.col.permission": "Доступ",
+  "access.permissions.description": "Настройте права доступа для точек входа WebApp и CLI в каждой среде.",
+  "access.permissions.editAriaLabel": "Настроить доступ для {{environment}}",
+  "access.permissions.editDescription": "Настройте права доступа для точек входа WebApp и CLI.",
+  "access.permissions.editTitle": "Права доступа",
+  "access.permissions.title": "Права доступа",
+  "access.revoke": "Отозвать",
+  "access.runAccess.description": "Управляйте тем, как пользователи могут запускать это развертывание и кому разрешён доступ в каждой среде.",
+  "access.runAccess.disabled": "Доступ к запуску этого развертывания отключен.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Опубликуйте это развертывание как сервер Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Конечная точка MCP не настроена.",
+  "access.runAccess.noEnvs": "Разверните в среду, чтобы настроить права доступа.",
+  "access.runAccess.noEnvsTitle": "Нет развернутых сред",
+  "access.runAccess.openWebapp": "Открыть WebApp",
+  "access.runAccess.permissions": "Права доступа",
+  "access.runAccess.permissionsDesc": "Кто может получить доступ к этому развертыванию в каждой среде.",
+  "access.runAccess.title": "Доступ к запуску",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Размещенная веб-страница для конечных пользователей.",
+  "access.runAccess.webappEmpty": "Скоро будет доступно.",
+  "access.show": "Показать",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Внешний",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Неизвестно",
+  "card.access.api": "API Tokens",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Нет доступа",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Создать первый Релиз",
+  "card.deploy": "Развернуть",
+  "card.deploying": "{{count}} разворачивается",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} с ошибкой",
+  "card.fromApp": "Из {{name}}",
+  "card.lastDeployed": "Последнее развертывание {{time}}",
+  "card.menu.delete": "Удалить развертывание",
+  "card.menu.deleteDisabled": "Удаление развертываний пока недоступно для развертываний, управляемых бэкендом.",
+  "card.menu.deploy": "Развернуть в Среду",
+  "card.menu.editInfo": "Изменить информацию",
+  "card.menu.viewDetail": "Просмотреть детали развертывания",
+  "card.moreActions": "Дополнительные действия",
+  "card.neverDeployed": "Ещё не развернуто",
+  "card.noDescription": "Описание не указано.",
+  "card.notDeployed": "Не развернуто",
+  "card.ready": "{{count}} запущено",
+  "card.tooltip.createdAt": "Создано",
+  "card.tooltip.deployed": "Развернуто",
+  "card.tooltip.deploymentStatus": "Развертывание",
+  "card.tooltip.notDeployed": "Это развертывание ещё не развернуто ни в одну Среду.",
+  "card.tooltip.notDeployedShort": "Не развернуто",
+  "card.tooltip.release": "Релиз",
+  "card.tooltip.releaseName": "Имя Релиза",
+  "card.tooltip.source": "Источник",
+  "common.loadFailed": "Не удалось загрузить. Повторите попытку позже.",
+  "common.loading": "Загрузка...",
+  "createGuide.actions.back": "Назад",
+  "createGuide.actions.cancel": "Отмена",
+  "createGuide.actions.continue": "Продолжить",
+  "createGuide.actions.createAndDeploy": "Создать и развернуть",
+  "createGuide.actions.creating": "Создание...",
+  "createGuide.actions.deploy": "Развернуть",
+  "createGuide.actions.deploying": "Создание и развертывание...",
+  "createGuide.actions.next": "Далее",
+  "createGuide.actions.skipDeploy": "Пропустить, развернуть позже",
+  "createGuide.description": "Создайте развертывание из источника Релиза, базовой информации и целевой Среды.",
+  "createGuide.dsl.defaultAppName": "Импортированное DSL-приложение",
+  "createGuide.dsl.description": "Загрузите пакет Workflow DSL, чтобы создать развертывание, первый Релиз и опциональное развертывание в Среду.",
+  "createGuide.dsl.dropDescription": "Загрузите пакет Workflow YAML DSL. Параметры развертывания будут определены из этого файла перед развертыванием.",
+  "createGuide.dsl.dropTitle": "Загрузить пакет Workflow DSL",
+  "createGuide.dsl.readFailed": "Не удалось прочитать файл DSL. Выберите другой файл и попробуйте снова.",
+  "createGuide.dsl.reading": "Чтение файла DSL...",
+  "createGuide.dsl.title": "Импорт DSL",
+  "createGuide.dsl.unsupportedMode": "Для развертываний можно использовать только файлы Workflow DSL.",
+  "createGuide.errors.createReleaseFailed": "Не удалось создать развертывание или Релиз.",
+  "createGuide.errors.deployFailed": "Не удалось выполнить развертывание в Среду.",
+  "createGuide.method.description": "Выберите источник для создания первого Релиза.",
+  "createGuide.methods.bindApp.description": "Используйте существующее Workflow-приложение из Studio как источник Релиза.",
+  "createGuide.methods.bindApp.title": "Привязать существующее Workflow-приложение",
+  "createGuide.methods.importDsl.description": "Загрузите пакет Workflow YAML DSL и продолжите через UI развертывания.",
+  "createGuide.methods.importDsl.title": "Импорт DSL",
+  "createGuide.methods.mocked": "Замокано",
+  "createGuide.nav.back": "Развертывания",
+  "createGuide.release.defaultName": "первоначальный релиз",
+  "createGuide.release.deployInfo": "Информация о развертывании",
+  "createGuide.release.description": "Заполните информацию о развертывании и детали первого Релиза.",
+  "createGuide.release.firstVersion": "Первый Релиз",
+  "createGuide.release.instanceDescription": "Описание развертывания",
+  "createGuide.release.instanceDescriptionPlaceholder": "Опишите, для чего используется это развертывание",
+  "createGuide.release.instanceName": "Имя развертывания",
+  "createGuide.release.instanceNameConflict": "Развертывание с таким именем уже существует. Выберите другое имя.",
+  "createGuide.release.releaseDescription": "Описание Релиза",
+  "createGuide.release.releaseDescriptionPlaceholder": "Опишите этот Релиз",
+  "createGuide.release.releaseName": "Имя Релиза",
+  "createGuide.release.releaseNote": "Описание Релиза",
+  "createGuide.release.title": "Базовая информация",
+  "createGuide.source.availableApps_one": "{{count}} приложение",
+  "createGuide.source.availableApps_other": "{{count}} приложений",
+  "createGuide.source.clearSearch": "Очистить поиск приложений",
+  "createGuide.source.description": "Выберите источник для создания первого Релиза.",
+  "createGuide.source.empty": "Workflow-приложения не найдены.",
+  "createGuide.source.searchPlaceholder": "Поиск приложений",
+  "createGuide.source.sourceApp": "Workflow-приложение",
+  "createGuide.source.title": "Источник Релиза",
+  "createGuide.steps.method": "Источник Релиза",
+  "createGuide.steps.release": "Базовая информация",
+  "createGuide.steps.source": "Источник Релиза",
+  "createGuide.steps.target": "Развернуть в Среду",
+  "createGuide.target.bindingCount_one": "{{count}} привязка",
+  "createGuide.target.bindingCount_other": "{{count}} привязок",
+  "createGuide.target.bindingHint": "Выберите Учётные данные, используемые этим Релизом.",
+  "createGuide.target.bindings": "Учётные данные",
+  "createGuide.target.deferredBindingHint": "Учётные данные будут разрешены из реального плана развертывания во время финального действия развертывания.",
+  "createGuide.target.deferredEnvironmentHint": "Имя сопоставляется с реальными Средами после того, как развертывание и Релиз созданы.",
+  "createGuide.target.description": "Выберите целевую Среду и укажите runtime-настройки, нужные этому Релизу. Этот шаг можно пропустить.",
+  "createGuide.target.envVarCount_one": "{{count}} переменная",
+  "createGuide.target.envVarCount_other": "{{count}} переменных",
+  "createGuide.target.envVarHint": "Для каждой переменной окружения, необходимой этому Релизу, введите пользовательское значение или используйте значение, заданное в приложении.",
+  "createGuide.target.envVarPlaceholder": "Введите значение",
+  "createGuide.target.envVarSource.ariaLabel": "Выберите источник значения переменной для {{key}}",
+  "createGuide.target.envVarSource.default": "Значение приложения",
+  "createGuide.target.envVarSource.lastDeployment": "Последнее развернутое значение",
+  "createGuide.target.envVarSource.literal": "Пользовательское значение",
+  "createGuide.target.envVarType.number": "Число",
+  "createGuide.target.envVarType.secret": "Секрет",
+  "createGuide.target.envVarType.string": "Строка",
+  "createGuide.target.envVars": "Переменные окружения",
+  "createGuide.target.environment": "Целевая Среда",
+  "createGuide.target.environmentName": "Имя Среды",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "Не удалось загрузить Учётные данные.",
+  "createGuide.target.loadEnvironmentsFailed": "Не удалось загрузить Среды для развертывания.",
+  "createGuide.target.missingRequiredBinding": "Выберите Учётные данные для этой обязательной привязки.",
+  "createGuide.target.noBindingRequired": "Учётные данные не требуются.",
+  "createGuide.target.noCredentialCandidates": "Нет доступных Учётных данных.",
+  "createGuide.target.noEnvironmentOptions": "Нет доступных Сред для развертывания.",
+  "createGuide.target.required": "Обязательно",
+  "createGuide.target.selectCredential": "Выберите Учётные данные",
+  "createGuide.target.title": "Развернуть в Среду",
+  "createGuide.title": "Новое развертывание",
+  "createModal.appPickerPlaceholder": "Выберите Workflow-приложение",
+  "createModal.appSearchEmpty": "Нет подходящих Workflow-приложений",
+  "createModal.appSearchPlaceholder": "Поиск Workflow-приложений…",
+  "createModal.cancel": "Отмена",
+  "createModal.create": "Создать",
+  "createModal.createFailed": "Не удалось создать развертывание.",
+  "createModal.description": "Выберите Workflow-приложение и создайте развертывание.",
+  "createModal.descriptionLabel": "Описание",
+  "createModal.descriptionPlaceholder": "Опишите, для чего используется это развертывание",
+  "createModal.loadMoreApps": "Загрузить ещё приложения",
+  "createModal.loadingApps": "Загрузка приложений…",
+  "createModal.nameLabel": "Имя развертывания",
+  "createModal.namePlaceholder": "Имя развертывания",
+  "createModal.noApps": "Workflow-приложения не найдены в этом рабочем пространстве. Сначала создайте его в Studio.",
+  "createModal.selected": "Выбрано",
+  "createModal.sourceApp": "Workflow-приложение (обязательно)",
+  "createModal.title": "Новое развертывание",
+  "deployDrawer.bindingCount_one": "{{count}} привязка",
+  "deployDrawer.bindingCount_other": "{{count}} привязок",
+  "deployDrawer.bindingOptionsFailed": "Не удалось загрузить варианты Учётных данных.",
+  "deployDrawer.bindingSelectionHint": "Выберите Учётные данные, используемые этим развертыванием.",
+  "deployDrawer.bindingsDisabled": "Определено из превью Релиза. Редактирование пока недоступно.",
+  "deployDrawer.cancel": "Отмена",
+  "deployDrawer.close": "Закрыть панель развертывания",
+  "deployDrawer.defaultSelect": "Выберите...",
+  "deployDrawer.deploy": "Развернуть в Среду",
+  "deployDrawer.deployExistingRelease": "Развернуть в Среду",
+  "deployDrawer.deployExistingReleaseDescription": "Выберите Релиз и целевую Среду для развертывания.",
+  "deployDrawer.deployExistingReleaseTitle": "Развернуть в Среду",
+  "deployDrawer.deployFailed": "Не удалось запустить развертывание.",
+  "deployDrawer.deploying": "Развертывание...",
+  "deployDrawer.description": "Выберите Релиз и целевую Среду для развертывания.",
+  "deployDrawer.envVarCount_one": "{{count}} переменная",
+  "deployDrawer.envVarCount_other": "{{count}} переменных",
+  "deployDrawer.envVarHint": "Для каждой переменной окружения, необходимой этому Релизу, введите пользовательское значение или используйте значение, заданное в приложении.",
+  "deployDrawer.envVarPlaceholder": "Введите значение",
+  "deployDrawer.envVarSource.ariaLabel": "Выберите источник значения переменной для {{key}}",
+  "deployDrawer.envVarSource.default": "Значение приложения",
+  "deployDrawer.envVarSource.lastDeployment": "Последнее развернутое значение",
+  "deployDrawer.envVarSource.literal": "Пользовательское значение",
+  "deployDrawer.envVarType.number": "Число",
+  "deployDrawer.envVarType.secret": "Секрет",
+  "deployDrawer.envVarType.string": "Строка",
+  "deployDrawer.envVars": "Переменные окружения",
+  "deployDrawer.existingReleaseHint": "Этот Релиз будет развернут как есть. Новый Релиз создан не будет.",
+  "deployDrawer.loadingBindings": "Разрешение...",
+  "deployDrawer.lockedHint": "Зафиксировано в текущей Среде",
+  "deployDrawer.missingRequiredBinding": "Выберите Учётные данные для этой обязательной привязки.",
+  "deployDrawer.missingRequiredEnvVar": "Введите значение для этой обязательной переменной окружения.",
+  "deployDrawer.modelCreds": "Учётные данные модели",
+  "deployDrawer.needsValidation": " (требуется валидация)",
+  "deployDrawer.newReleaseHint": "Будет создан новый Релиз из выбранного YAML Workflow-приложения.",
+  "deployDrawer.noBindingRequired": "Не требуется",
+  "deployDrawer.noCredentialCandidates": "Нет доступных Учётных данных.",
+  "deployDrawer.noNewEnvironmentAvailable": "Во всех доступных Средах уже есть развертывание.",
+  "deployDrawer.noOtherReleaseAvailable": "Других Релизов для этой Среды нет.",
+  "deployDrawer.noReleaseAvailable": "Создайте Релиз перед развертыванием в Среду.",
+  "deployDrawer.notFound": "Развертывание не найдено.",
+  "deployDrawer.noteLabel": "Описание Релиза (необязательно)",
+  "deployDrawer.notePlaceholder": "напр. Доставить правку текста онбординга",
+  "deployDrawer.pluginCreds": "Учётные данные плагина",
+  "deployDrawer.promote": "Развернуть",
+  "deployDrawer.promoteDescription": "Выберите Релиз и целевую Среду для развертывания.",
+  "deployDrawer.promoteTitle": "Развернуть в Среду",
+  "deployDrawer.readOnly": "Только чтение",
+  "deployDrawer.redeploy": "Развернуть в Среду",
+  "deployDrawer.redeployDescription": "Выберите Релиз и целевую Среду для развертывания.",
+  "deployDrawer.redeployExistingReleaseHint": "Текущий Релиз будет повторно развернут как есть. Новый Релиз создан не будет.",
+  "deployDrawer.redeployTitle": "Развернуть в Среду",
+  "deployDrawer.releaseLabel": "Релиз",
+  "deployDrawer.requiredBinding": "Обязательно",
+  "deployDrawer.rollback": "Развернуть",
+  "deployDrawer.rollbackDescription": "Выберите Релиз и целевую Среду для развертывания.",
+  "deployDrawer.rollbackTitle": "Развернуть в Среду",
+  "deployDrawer.runtimeCredentials": "Учётные данные",
+  "deployDrawer.secretPlaceholder": "секрет",
+  "deployDrawer.selectCredential": "Выберите Учётные данные",
+  "deployDrawer.selectEnv": "Выберите Среду",
+  "deployDrawer.selectProviderCred": "Выберите Учётные данные {{provider}}",
+  "deployDrawer.selectProviderKey": "Выберите ключ {{provider}}",
+  "deployDrawer.selectRelease": "Выберите Релиз",
+  "deployDrawer.targetEnv": "Целевая Среда",
+  "deployDrawer.title": "Развернуть в Среду",
+  "deployDrawer.valuePlaceholder": "значение",
+  "deployTab.cancelDeployment": "Отменить развертывание",
+  "deployTab.closeError": "Закрыть",
+  "deployTab.col.actions": "Действия",
+  "deployTab.col.currentRelease": "Текущий Релиз",
+  "deployTab.col.environment": "Среда",
+  "deployTab.col.status": "Статус",
+  "deployTab.col.updated": "Обновлено",
+  "deployTab.collapseDetails": "Свернуть детали развертывания",
+  "deployTab.confirmUndeploy": "Свернуть развертывание",
+  "deployTab.deployOtherVersion": "Развернуть другой Релиз",
+  "deployTab.deployToEnv": "Развернуть в {{name}}",
+  "deployTab.deployToNewEnv": "Развернуть в новую Среду...",
+  "deployTab.empty": "Экземпляров пока нет. Разверните в новую Среду, чтобы начать.",
+  "deployTab.emptyDescription": "Выберите Релиз и целевую Среду, чтобы сделать это развертывание доступным пользователям.",
+  "deployTab.emptyTitle": "Запущенных Сред пока нет",
+  "deployTab.envCount": "Среды",
+  "deployTab.errorCode": "Код",
+  "deployTab.errorDialogDesc": "Просмотрите последнее неудачное развертывание перед повторной попыткой или развертыванием другого Релиза.",
+  "deployTab.errorDialogTitle": "Ошибка развертывания в {{name}}",
+  "deployTab.errorMessage": "Сообщение",
+  "deployTab.errorPhase": "Фаза",
+  "deployTab.expandDetails": "Развернуть детали развертывания",
+  "deployTab.moreActions": "Дополнительные действия",
+  "deployTab.newDeployment": "Развернуть в новую Среду",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "ID развертывания",
+  "deployTab.panel.endpoints": "Конечные точки",
+  "deployTab.panel.envVars": "Переменные окружения",
+  "deployTab.panel.error": "Ошибка",
+  "deployTab.panel.failedRelease": "Неудачный Релиз",
+  "deployTab.panel.health": "Здоровье",
+  "deployTab.panel.instanceInfo": "Информация об экземпляре",
+  "deployTab.panel.modelCreds": "Учётные данные модели",
+  "deployTab.panel.pluginCreds": "Учётные данные плагина",
+  "deployTab.panel.release": "Релиз",
+  "deployTab.panel.releaseCreatedAt": "Релиз создан в",
+  "deployTab.panel.releaseInfo": "Информация о Релизе",
+  "deployTab.panel.replicas": "Реплики",
+  "deployTab.panel.run": "Запуск",
+  "deployTab.panel.runtimeBindings": "Учётные данные",
+  "deployTab.panel.runtimeInfo": "Информация о среде выполнения",
+  "deployTab.panel.runtimeMode": "Режим среды выполнения",
+  "deployTab.panel.runtimeNote": "Заметка о среде выполнения",
+  "deployTab.panel.targetRelease": "Целевой Релиз",
+  "deployTab.panel.unknownError": "Развертывание не удалось.",
+  "deployTab.promote": "Развернуть",
+  "deployTab.redeploy": "Повторно развернуть",
+  "deployTab.releaseCreatedAt": "Релиз создан {{time}}",
+  "deployTab.retry": "Повторить",
+  "deployTab.shortcut": "Ярлык",
+  "deployTab.status.deployFailed": "Ошибка развертывания",
+  "deployTab.status.deployingRelease": "Развертывание ({{release}})",
+  "deployTab.status.runningOutOfSync": "Запущено (ожидается синхронизация)",
+  "deployTab.status.runningWithFailed": "Запущено (последнее развертывание не удалось)",
+  "deployTab.undeploy": "Свернуть развертывание",
+  "deployTab.undeployConfirmDesc": "Доступ конечных пользователей будет немедленно прекращен. Релиз можно будет повторно развернуть позже.",
+  "deployTab.undeployConfirmTitle": "Свернуть развертывание из {{name}}?",
+  "deployTab.undeployFrom": "Свернуть развертывание из {{name}}",
+  "deployTab.undeployImpactTitle": "Затронутый экземпляр",
+  "deployTab.viewError": "Просмотр ошибки",
+  "deployTab.viewLogs": "Просмотр логов",
+  "deployTab.viewProgress": "Просмотр прогресса",
+  "detail.backToInstances": "Назад к развертываниям",
+  "detail.deployingCount": "{{count}} разворачивается",
+  "detail.envCount_one": "{{count}} среда",
+  "detail.envCount_other": "{{count}} сред",
+  "detail.failedCount": "{{count}} с ошибкой",
+  "detail.mobileTabs": "Разделы развертывания",
+  "detail.notFound": "Развертывание не найдено",
+  "detail.openSourceApp": "Открыть источник {{name}}",
+  "detail.sourceApp": "Источник",
+  "detail.sourceAppLink": "Источник",
+  "documentTitle.create": "Новое развертывание · Развертывания",
+  "documentTitle.detail": "Развертывание · Развертывания",
+  "documentTitle.list": "Развертывания",
+  "filter.allEnvs": "Все Среды",
+  "filter.notDeployed": "Не развернуто",
+  "filter.searchPlaceholder": "Поиск развертываний",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Допуск",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Загрузка",
+  "health.ENVIRONMENT_STATUS_DELETING": "Удаление",
+  "health.ENVIRONMENT_STATUS_FAILED": "Недоступно",
+  "health.ENVIRONMENT_STATUS_READY": "Доступно",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Неизвестно",
+  "list.clearFilters": "Очистить фильтры",
+  "list.clearSearch": "Очистить поиск развертываний",
+  "list.createDeployment": "Создать",
+  "list.empty": "Развертывания не найдены.",
+  "list.emptyDescription": "Создайте развертывание из Workflow-приложения или пакета Workflow DSL для управления Релизами, Средами и доступом.",
+  "list.emptyFilteredDescription": "Ни одно развертывание не соответствует текущему поиску или фильтру Среды.",
+  "list.emptyFilteredTitle": "Нет подходящих развертываний",
+  "list.emptyTitle": "Пока нет развертываний",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Изолированная",
+  "mode.ENVIRONMENT_MODE_SHARED": "Общая",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Неизвестно",
+  "newInstance.comingSoon": "Скоро будет доступно",
+  "newInstance.fromStudio": "Выбрать из Studio",
+  "newInstance.importDSL": "Импорт DSL",
+  "newInstance.title": "Новое развертывание",
+  "overview.accessEndpoints": "Конечные точки доступа",
+  "overview.accessMeta.apiTokens": "Управление API Tokens",
+  "overview.accessMeta.cli": "Просмотр доступа CLI",
+  "overview.accessMeta.webApp": "Управление доступом WebApp",
+  "overview.accessStatus": "Доступ",
+  "overview.api": "API Tokens",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Tokens",
+  "overview.apiTokenSummary.environments_one": "{{count}} развернутая Среда",
+  "overview.apiTokenSummary.environments_other": "{{count}} развернутых Сред",
+  "overview.availableForDeployment": "Доступно для развертывания",
+  "overview.basicInfo": "Базовая информация",
+  "overview.cardAction.deployLatest": "Развернуть последний Релиз",
+  "overview.cardAction.redeploy": "Повторно развернуть",
+  "overview.cardAction.viewProgress": "Просмотр развертывания",
+  "overview.chip.behindTooltip_one": "Отстаёт от последнего на 1 Релиз. Разверните последний Релиз для обновления.",
+  "overview.chip.behindTooltip_other": "Отстаёт от последнего на {{count}} Релизов. Разверните последний Релиз для обновления.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "разворачивается",
+  "overview.chip.deployingTooltip": "Развертывание выполняется.",
+  "overview.chip.empty": "пусто",
+  "overview.chip.emptyTooltip": "В эту Среду не развернут ни один Релиз.",
+  "overview.chip.failed": "ошибка",
+  "overview.chip.failedTooltip": "Последняя попытка развертывания не удалась.",
+  "overview.chip.latest": "последний",
+  "overview.chip.latestTooltip": "В этой Среде работает последний Релиз.",
+  "overview.chip.needsReleaseFirst": "Сначала создайте Релиз",
+  "overview.chip.olderRelease": "более старый",
+  "overview.chip.olderReleaseTooltip": "В этой Среде работает более старый Релиз.",
+  "overview.chip.openInDeployTab": "Просмотр прогресса развертывания",
+  "overview.cli": "CLI",
+  "overview.configured": "Настроено",
+  "overview.createRelease": "Создать Релиз",
+  "overview.created": "Создано",
+  "overview.deploy": "Развернуть",
+  "overview.deployedEnvironments": "развернуто",
+  "overview.deploymentOverview": "Обзор развертывания",
+  "overview.deploymentStatus": "Статус развертывания",
+  "overview.description": "Описание",
+  "overview.developerApi": "API для разработчиков",
+  "overview.disabled": "Отключено",
+  "overview.emptyValue": "Не задано",
+  "overview.enabled": "Включено",
+  "overview.enabledChannels": "доступ включен",
+  "overview.endUserAccess": "Доступ конечных пользователей",
+  "overview.environments": "Среды",
+  "overview.hero.byName": "от {{name}}",
+  "overview.hero.empty": "Пока нет Релизов",
+  "overview.hero.emptyDescription": "Создайте Релиз из текущего источника перед развертыванием.",
+  "overview.hero.propagation_one": "развернуто в {{count}}/{{total}} Среду",
+  "overview.hero.propagation_other": "развернуто в {{count}}/{{total}} Сред",
+  "overview.hero.untargeted": "ни одна Среда ещё не настроена",
+  "overview.instanceDetails": "Детали развертывания",
+  "overview.instanceId": "ID развертывания",
+  "overview.latestRelease.releaseCount_one": "{{count}} Релиз",
+  "overview.latestRelease.releaseCount_other": "{{count}} Релизов",
+  "overview.latestReleaseTitle": "Последний Релиз",
+  "overview.manageDeployments": "Управление развертываниями",
+  "overview.name": "Имя",
+  "overview.noAccessConfig": "Нет настройки доступа.",
+  "overview.noReleaseYet": "Создайте Релиз перед развертыванием в Среду.",
+  "overview.notConfigured": "Не настроено",
+  "overview.previousReleases.empty": "Более ранних Релизов пока нет.",
+  "overview.previousReleases.retired": "Сейчас не развернуто",
+  "overview.previousReleases.title": "Предыдущие Релизы",
+  "overview.previousReleases.viewAll": "Просмотреть все",
+  "overview.ready": "Готово к развертыванию",
+  "overview.recentReleases": "Недавние Релизы",
+  "overview.releaseDeployedTitle": "{{release}} развернут",
+  "overview.releaseReadyTitle": "{{release}} готов к развертыванию",
+  "overview.serviceMap": "Карта сервисов",
+  "overview.servingRelease": "Обслуживает {{release}}",
+  "overview.servingReleaseDescription": "Это развертывание развернуто в {{count}}/{{total}} Сред.",
+  "overview.strip.deployToNewEnvironment": "Развернуть в новую Среду",
+  "overview.strip.empty": "Среды не настроены.",
+  "overview.strip.emptyDeployableDescription": "Разверните последний Релиз в Среду, когда будете готовы.",
+  "overview.strip.emptyDeployed": "Экземпляров пока нет.",
+  "overview.strip.emptyDescription": "Создайте Релиз перед развертыванием в Среду.",
+  "overview.strip.emptyTitle": "Экземпляров пока нет",
+  "overview.strip.summary_one": "1 из {{total}} на последнем Релизе",
+  "overview.strip.summary_other": "{{count}} из {{total}} на последнем Релизе",
+  "overview.strip.title": "Экземпляры",
+  "overview.switchSourceApp": "Сменить источник",
+  "overview.switchSourceAppDescription": "Выберите Workflow-приложение, которое будет использоваться как источник для будущих Релизов.",
+  "overview.switchSourceAppHint": "После переключения только вновь созданные Релизы будут использовать новый источник. Исторические Релизы и существующие развертывания не изменяются.",
+  "overview.targetRelease": "Целевой Релиз",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Опасная зона",
+  "settings.dangerDesc": "Безвозвратно удалить это развертывание и остановить все запущенные экземпляры. Это нельзя отменить.",
+  "settings.delete": "Удалить развертывание",
+  "settings.deleteConfirmDesc": "Удалить {{name}}? Каждый экземпляр прекратит работу и будет удалён во всех Средах. Это нельзя отменить.",
+  "settings.deleteConfirmTitle": "Удалить развертывание",
+  "settings.deleteFailed": "Не удалось удалить развертывание.",
+  "settings.deleteImpact": "Влияние",
+  "settings.deleteImpactInstance": "Развертывание",
+  "settings.deleteImpactTitle": "Затронутое развертывание",
+  "settings.deleteImpactValue": "Развертывание будет удалено из списка развертываний.",
+  "settings.deleted": "Развертывание удалено",
+  "settings.description": "Описание",
+  "settings.descriptionHelp": "Управляйте именем, описанием и другими настройками этого развертывания.",
+  "settings.general": "Общие",
+  "settings.name": "Имя развертывания",
+  "settings.reset": "Сбросить",
+  "settings.save": "Сохранить изменения",
+  "settings.updateFailed": "Не удалось обновить развертывание.",
+  "settings.updated": "Развертывание обновлено",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Развертывание",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Ожидается синхронизация",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Ошибка развертывания",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Недействительный",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Запущено",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не развернуто",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Свертывание развертывания",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Неизвестно",
+  "subtitle": "Управляйте развертываниями в разных Средах.",
+  "tabs.access.description": "Управление каналами доступа и правами доступа.",
+  "tabs.access.name": "Доступ",
+  "tabs.api-tokens.description": "Управление API Tokens и вызов экземпляров по HTTP.",
+  "tabs.api-tokens.name": "API Tokens",
+  "tabs.instances.description": "Просмотр и управление экземплярами в развернутых Средах.",
+  "tabs.instances.name": "Экземпляры",
+  "tabs.overview.description": "Просмотр статуса развертывания по Средам.",
+  "tabs.overview.name": "Обзор",
+  "tabs.releases.description": "Создавайте, разворачивайте и управляйте Релизами.",
+  "tabs.releases.name": "Релизы",
+  "tabs.settings.description": "Управляйте именем, описанием и другими настройками этого развертывания.",
+  "tabs.settings.name": "Настройки",
+  "title": "Развертывания",
+  "unsupportedDslNodes.description": "Этот Релиз содержит узлы, которые среда выполнения развертывания пока не поддерживает. Удалите или замените их в Studio и попробуйте снова.",
+  "unsupportedDslNodes.descriptionWithTypes": "Этот Релиз содержит узлы, которые среда выполнения развертывания пока не поддерживает: {{nodeTypes}}. Удалите или замените их в Studio и попробуйте снова.",
+  "unsupportedDslNodes.title": "Неподдерживаемые узлы",
+  "unsupportedDslNodes.unknownType": "Неизвестный тип",
+  "versions.cancelCreate": "Отмена",
+  "versions.cancelDelete": "Отмена",
+  "versions.cancelEdit": "Отмена",
+  "versions.checkingReleaseContent": "Проверка содержимого Релиза...",
+  "versions.col.action": "Действие",
+  "versions.col.author": "Создано",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Создано в",
+  "versions.col.deployedTo": "Развернуто в",
+  "versions.col.release": "Релиз",
+  "versions.col.sourceApp": "Источник",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Создать",
+  "versions.createFailed": "Не удалось создать Релиз.",
+  "versions.createRelease": "Создать Релиз",
+  "versions.createReleaseDescription": "Создайте развертываемый Релиз из Workflow-приложения или файла Workflow DSL.",
+  "versions.createReleaseHint": "Новые Релизы могут быть развернуты в любую Среду.",
+  "versions.createSuccess": "Релиз \"{{name}}\" создан.",
+  "versions.creating": "Создание...",
+  "versions.currentOn": "Текущий Релиз на {{name}}",
+  "versions.deleteConfirmDesc": "Релиз \"{{name}}\" будет удалён безвозвратно. Это нельзя отменить.",
+  "versions.deleteConfirmTitle": "Удалить Релиз?",
+  "versions.deleteFailed": "Не удалось удалить Релиз.",
+  "versions.deleteImpactDeployment": "Статус развертывания",
+  "versions.deleteImpactNotDeployed": "Сейчас не развернуто",
+  "versions.deleteImpactRelease": "Релиз",
+  "versions.deleteImpactTitle": "Влияние удаления",
+  "versions.deleteRelease": "Удалить Релиз",
+  "versions.deleteSuccess": "Релиз \"{{name}}\" удалён.",
+  "versions.deploy": "Развернуть",
+  "versions.deployTo": "Развернуть в {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Развертывание",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Ожидается синхронизация",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Ошибка",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Недействительный",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Запущено",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не развернуто",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Свертывание развертывания",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Неизвестно",
+  "versions.deployingTo": "{{name}} разворачивается",
+  "versions.disabledReason.checkDeploymentsFailed": "Не удалось проверить использование развертывания. Повторите попытку позже.",
+  "versions.disabledReason.checkingDeployments": "Проверка использования развертывания",
+  "versions.disabledReason.current": "Этот Релиз уже запущен на {{name}}",
+  "versions.disabledReason.deploying": "Дождитесь завершения активного развертывания",
+  "versions.disabledReason.envDisabled": "Эта Среда недоступна для развертывания",
+  "versions.disabledReason.releaseInUse_one": "Сверните этот Релиз из {{count}} Среды перед его удалением",
+  "versions.disabledReason.releaseInUse_other": "Сверните этот Релиз из {{count}} Сред перед его удалением",
+  "versions.dslReadFailed": "Не удалось прочитать файл DSL. Выберите другой файл и попробуйте снова.",
+  "versions.dslReading": "Чтение файла DSL...",
+  "versions.dslUnsupportedMode": "Для развертываний можно использовать только файлы Workflow DSL.",
+  "versions.editFailed": "Не удалось обновить Релиз.",
+  "versions.editRelease": "Изменить Релиз",
+  "versions.editReleaseDescription": "Обновите имя и описание этого Релиза.",
+  "versions.editSuccess": "Релиз \"{{name}}\" обновлён.",
+  "versions.empty": "Доступных Релизов пока нет.",
+  "versions.emptyDescription": "Создайте первый Релиз перед развертыванием в Среду.",
+  "versions.emptyTitle": "Пока нет Релизов",
+  "versions.emptyWithCreate": "Пока нет Релизов. Создайте первый развертываемый Релиз перед развертыванием.",
+  "versions.exportDsl": "Экспортировать DSL",
+  "versions.exportDslFailed": "Не удалось экспортировать DSL.",
+  "versions.exportingDsl": "Экспорт...",
+  "versions.groupHeader.deploy": "Развернуть",
+  "versions.groupHeader.promote": "Развернуть",
+  "versions.groupHeader.rollback": "Развернуть предыдущую версию",
+  "versions.groupHeader.unavailable": "Недоступно",
+  "versions.manualDslOption": "Загрузить DSL",
+  "versions.moreActions": "Дополнительные действия",
+  "versions.optional": "Необязательно",
+  "versions.promote": "Развернуть",
+  "versions.promoteTo": "Развернуть в {{name}}",
+  "versions.releaseAlreadyExists": "Релиз с таким же содержимым уже существует: {{name}}.",
+  "versions.releaseContentCheckFailed": "Не удалось проверить содержимое Релиза.",
+  "versions.releaseDescriptionLabel": "Описание",
+  "versions.releaseDescriptionPlaceholder": "Опишите этот Релиз",
+  "versions.releaseHistory": "История Релизов",
+  "versions.releaseNameLabel": "Имя Релиза",
+  "versions.releaseNamePlaceholder": "Имя Релиза",
+  "versions.releaseNameRequired": "Введите имя Релиза.",
+  "versions.releaseSourceLabel": "Источник Релиза",
+  "versions.rollbackTo": "Развернуть в {{name}}",
+  "versions.saveEdit": "Сохранить",
+  "versions.sourceAppOption": "Workflow-приложение"
+}
diff --git a/web/i18n/ru-RU/workflow.json b/web/i18n/ru-RU/workflow.json
index fb878c2a729..3551d1f21ff 100644
--- a/web/i18n/ru-RU/workflow.json
+++ b/web/i18n/ru-RU/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "Агент",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Ответ",
   "blocks.assigner": "Назначение переменных",
   "blocks.code": "Код",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Агрегатор переменных",
   "blocks.variable-assigner": "Назначение переменных",
   "blocksAbout.agent": "Вызов больших языковых моделей для ответа на вопросы или обработки естественного языка",
+  "blocksAbout.agent-v2": "Вызов больших языковых моделей для ответа на вопросы или обработки естественного языка",
   "blocksAbout.answer": "Определите содержимое ответа в чате",
   "blocksAbout.assigner": "Узел назначения переменной используется для назначения значений записываемым переменным (например, переменным разговора).",
   "blocksAbout.code": "Выполните фрагмент кода Python или NodeJS для реализации пользовательской логики",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID рабочего процесса",
   "globalVar.fieldsDescription.workflowRunId": "ID запуска рабочего процесса",
   "globalVar.title": "Системные переменные",
+  "nodes.agent.advancedSetting": "Расширенные настройки",
   "nodes.agent.checkList.strategyNotSelected": "Стратегия не выбрана",
   "nodes.agent.clickToViewParameterSchema": "Нажмите, чтобы просмотреть схему параметров",
   "nodes.agent.configureModel": "Сконфигурировать модель",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Неподдерживаемая модель",
   "nodes.agent.modelSelectorTooltips.deprecated": "Эта модель устарела",
   "nodes.agent.notAuthorized": "Не авторизован",
+  "nodes.agent.outputVars.confirm": "Подтвердить",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Введите JSON-массив.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Введите true или false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Значения по умолчанию для файлов здесь пока нельзя настроить.",
+  "nodes.agent.outputVars.defaultValueLabel": "По умолчанию",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Введите корректное число.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Введите JSON-объект.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Значение по умолчанию",
+  "nodes.agent.outputVars.delete": "Удалить {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Описание",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Добавить описание",
+  "nodes.agent.outputVars.edit": "Редактировать {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Редактор выходных переменных",
   "nodes.agent.outputVars.files.title": "Файлы, созданные агентом",
   "nodes.agent.outputVars.files.transfer_method": "Способ переноса. Ценность составляет remote_url или local_file",
   "nodes.agent.outputVars.files.type": "Тип поддержки. Теперь только вспомогательное изображение",
   "nodes.agent.outputVars.files.upload_file_id": "Загрузить id файла",
   "nodes.agent.outputVars.files.url": "URL изображения",
   "nodes.agent.outputVars.json": "JSON, сгенерированный агентом",
+  "nodes.agent.outputVars.nameDuplicate": "Имя выхода уже существует",
+  "nodes.agent.outputVars.nameInvalid": "Используйте буквы, цифры и подчёркивания. Начинайте с буквы или подчёркивания.",
+  "nodes.agent.outputVars.nameLabel": "Имя поля",
+  "nodes.agent.outputVars.namePlaceholder": "Имя поля",
+  "nodes.agent.outputVars.newOutput": "Новый выход",
+  "nodes.agent.outputVars.requiredLabel": "Обязательное",
+  "nodes.agent.outputVars.showAdvancedOptions": "Показать расширенные параметры",
   "nodes.agent.outputVars.text": "Контент, генерируемый агентом",
+  "nodes.agent.outputVars.typeLabel": "Тип выхода",
   "nodes.agent.outputVars.usage": "Информация об использовании модели",
   "nodes.agent.parameterSchema": "Схема параметров",
   "nodes.agent.pluginInstaller.install": "Устанавливать",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Этот интеграция устанавливается с GitHub. Пожалуйста, перейдите в раздел Интеграции для переустановки",
   "nodes.agent.pluginNotInstalled": "Этот интеграция не установлен",
   "nodes.agent.pluginNotInstalledDesc": "Этот интеграция устанавливается с GitHub. Пожалуйста, перейдите в раздел Интеграции для переустановки",
+  "nodes.agent.roster.change": "Сменить",
+  "nodes.agent.roster.editInConsole": "Редактировать в Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Одноразовая настройка, существующая только в этом узле",
+  "nodes.agent.roster.inlineSetup.name": "Встроенная настройка",
+  "nodes.agent.roster.inlineSetup.title": "Настройка агента",
+  "nodes.agent.roster.inlineSetup.type": "Только в этом узле",
+  "nodes.agent.roster.label": "Агент",
+  "nodes.agent.roster.makeCopy": "Сделать копию",
+  "nodes.agent.roster.more": "Больше действий с агентом",
+  "nodes.agent.roster.openPanel": "Открыть подробности {{name}}",
+  "nodes.agent.roster.panelLabel": "Подробности {{name}}",
   "nodes.agent.strategy.configureTip": "Пожалуйста, настройте агентскую стратегию.",
   "nodes.agent.strategy.configureTipDesc": "После настройки агентской стратегии этот узел автоматически загрузит оставшиеся конфигурации. Стратегия будет влиять на механизм многоступенчатого мышления инструмента.",
   "nodes.agent.strategy.label": "Агентная стратегия",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Установленная версия интеграцияа не предусматривает такой стратегии. Нажмите, чтобы переключить версию.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} не установлен",
   "nodes.agent.strategyNotSet": "Агентская стратегия не задана",
+  "nodes.agent.task.insert": "Вставить",
+  "nodes.agent.task.label": "Задача агента",
+  "nodes.agent.task.mention": "Упомянуть",
+  "nodes.agent.task.placeholder": "Опишите, что должен делать этот агент…",
+  "nodes.agent.task.tooltip": "Определите инструкции задачи, которые этот агент должен выполнять в этом рабочем процессе.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Не авторизован",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} не установлен",
   "nodes.agent.toolbox": "ящик для инструментов",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "По {{author}}",
   "tabs.question-understand": "Понимание вопроса",
   "tabs.requestToCommunity": "Запросы к сообществу",
-  "tabs.searchBlock": "Поиск узла",
+  "tabs.searchBlock": "Поиск узлов, агентов, людей, знаний",
   "tabs.searchDataSource": "Поиск источника данных",
   "tabs.searchSnippets": "Поиск фрагментов...",
   "tabs.searchTool": "Поиск инструмента",
diff --git a/web/i18n/sl-SI/agent-v-2.json b/web/i18n/sl-SI/agent-v-2.json
new file mode 100644
index 00000000000..676c86c29df
--- /dev/null
+++ b/web/i18n/sl-SI/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "To dejanje še ni na voljo.",
+  "agentDetail.access.actions.monitoring": "Spremljanje",
+  "agentDetail.access.copyAccessUrl": "Kopiraj URL dostopa",
+  "agentDetail.access.copyFailed": "Sklica ni bilo mogoče kopirati.",
+  "agentDetail.access.copyReference": "Kopiraj sklic za {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Kopiraj končno točko storitvenega API",
+  "agentDetail.access.description": "Vse površine, prek katerih je ta agent dosegljiv.",
+  "agentDetail.access.empty": "Ni povezanih dostopnih točk",
+  "agentDetail.access.emptyDescription": "Ta agent v Roster nima še aplikacij ali sklicev na potek dela.",
+  "agentDetail.access.entries.agentApp.description": "Aplikacija agenta, povezana s tem agentom v Roster.",
+  "agentDetail.access.entries.agentApp.name": "Aplikacija agenta",
+  "agentDetail.access.entries.workflow.description": "Potek dela in sklic na vozlišče, povezana s tem agentom v Roster.",
+  "agentDetail.access.entries.workflow.name": "Vozlišče poteka dela",
+  "agentDetail.access.entryCount_one": "{{count}} vnos",
+  "agentDetail.access.entryCount_other": "{{count}} vnosov",
+  "agentDetail.access.groups.references.heading": "Sklici",
+  "agentDetail.access.groups.references.label": "Povezani sklici",
+  "agentDetail.access.learnMore": "Več informacij",
+  "agentDetail.access.moreActions": "Več dejanj za {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Končna točka storitvenega API",
+  "agentDetail.access.serviceApi.title": "Zaledni storitveni API",
+  "agentDetail.access.status.disabled": "Onemogočeno",
+  "agentDetail.access.status.enabled": "Omogočeno",
+  "agentDetail.access.status.inService": "V uporabi",
+  "agentDetail.access.status.outOfService": "Izven uporabe",
+  "agentDetail.access.title": "Dostopna točka",
+  "agentDetail.access.toggleSurface": "Preklopi dostop {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL dostopa",
+  "agentDetail.access.webApp.actions.customize": "Prilagodi",
+  "agentDetail.access.webApp.actions.embedded": "Vgrajeno",
+  "agentDetail.access.webApp.actions.launch": "Zaženi",
+  "agentDetail.access.webApp.actions.settings": "Nastavitve",
+  "agentDetail.access.webApp.refreshUrl": "Osveži URL dostopa",
+  "agentDetail.access.webApp.showQrCode": "Pokaži QR kodo",
+  "agentDetail.access.webApp.ssoEnabled": "SSO omogočeno",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Uporabljeno kot vozlišče znotraj poteka dela",
+  "agentDetail.access.workflow.empty": "Še ni sklicev na potek dela.",
+  "agentDetail.access.workflow.loadFailed": "Sklicev na potek dela ni bilo mogoče naložiti.",
+  "agentDetail.access.workflow.loading": "Nalaganje sklicev na potek dela…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} vozlišče",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} vozlišč",
+  "agentDetail.access.workflow.notAvailable": "Ni na voljo",
+  "agentDetail.access.workflow.openInStudio": "Odpri v Studiu",
+  "agentDetail.access.workflow.openInStudioFor": "Odpri {{name}} v Studiu",
+  "agentDetail.access.workflow.table.actions": "Dejanja",
+  "agentDetail.access.workflow.table.lastUpdated": "Zadnja posodobitev",
+  "agentDetail.access.workflow.table.name": "Ime",
+  "agentDetail.access.workflow.table.nodes": "Vozlišča",
+  "agentDetail.access.workflow.table.version": "Različica",
+  "agentDetail.access.workflow.title": "Dostop do poteka dela",
+  "agentDetail.configure.advancedSettings.description": "Za napredne uporabnike. Okoljske spremenljivke, sandbox in pomnilnik.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Dodaj okoljsko spremenljivko",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Izbriši {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Skrij vrednost {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Uvozi .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Za prikaz skritih datotek .env v izbirniku datotek pritisnite Command + Shift + .",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Če je datoteka .env skrita, v sistemskem izbirniku datotek omogočite prikaz skritih datotek.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Za prikaz skritih datotek .env v Raziskovalcu omogočite »Skriti elementi«.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Razkrij vrednost {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Izberite obseg okoljske spremenljivke",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Okoljske spremenljivke, ki so na voljo temu agentu med izvajanjem.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Preklopi Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Napredne nastavitve",
+  "agentDetail.configure.advancedSettings.toggle": "Preklopi napredne nastavitve",
+  "agentDetail.configure.chatFeatures.description": "Oblikujte uporabniško izkušnjo klepeta v vaši spletni aplikaciji in klepetalnih površinah.",
+  "agentDetail.configure.chatFeatures.title": "Funkcije klepeta",
+  "agentDetail.configure.files.add": "Dodaj datoteko",
+  "agentDetail.configure.files.empty.description": "Naložite dokumente, ki jih lahko agent bere, npr. specifikacije, predloge ali smernice",
+  "agentDetail.configure.files.empty.title": "Še ni datotek",
+  "agentDetail.configure.files.label": "Datoteke",
+  "agentDetail.configure.files.preview.empty": "Ni vsebine za predogled.",
+  "agentDetail.configure.files.preview.failed": "Predogleda ni bilo mogoče naložiti.",
+  "agentDetail.configure.files.preview.unsupported": "Ta datoteka ne podpira predogleda.",
+  "agentDetail.configure.files.remove": "Odstrani {{name}}",
+  "agentDetail.configure.files.tip": "Datoteke, ki jih ta agent lahko uporablja pri izvajanju opravil.",
+  "agentDetail.configure.files.toggle": "Preklopi datoteke",
+  "agentDetail.configure.files.treeLabel": "Datoteke agenta",
+  "agentDetail.configure.files.upload.action": "Naloži",
+  "agentDetail.configure.files.upload.browse": "prebrskaj",
+  "agentDetail.configure.files.upload.description": "Naložite datoteko za tega agenta.",
+  "agentDetail.configure.files.upload.dropzone": "Spustite datoteko sem ali",
+  "agentDetail.configure.files.upload.failed": "Datoteke ni bilo mogoče naložiti.",
+  "agentDetail.configure.files.upload.fileType": "DATOTEKA",
+  "agentDetail.configure.files.upload.invalidFile": "Naložite eno datoteko.",
+  "agentDetail.configure.files.upload.success": "Datoteka naložena.",
+  "agentDetail.configure.files.upload.title": "Naloži datoteko",
+  "agentDetail.configure.knowledgeRetrieval.add": "Dodaj iskanje znanja",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Dodaj znanje",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Kliknite gumb »+« za dodajanje znanja",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Znanje",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Nastavitve iskanja",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Več o iskanju znanja",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Samodejno",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Pogoji",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Onemogočeno",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Filtriranje metapodatkov",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Ročno",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Izberite način filtriranja metapodatkov",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Ime iskanja znanja",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Odloči agent",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Agent sam oblikuje poizvedbo na podlagi poziva in razpoložljivega konteksta. Tu ni treba ničesar nastaviti.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Poljubna poizvedba",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Napišite fiksno poizvedbo za ta vir iskanja.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Besedilo poljubne poizvedbe",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Vnesite iskalno poizvedbo",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Poizvedba",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Iskanje znanja · Odloči agent",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Uredi {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Povežite bazo znanja, po kateri lahko agent išče med odgovarjanjem",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Še ni znanja",
+  "agentDetail.configure.knowledgeRetrieval.label": "Iskanje znanja",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Odstrani {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Viri iskanja znanja, ki jih ta agent lahko uporablja pri izvajanju opravil.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Preklopi iskanje znanja",
+  "agentDetail.configure.model.label": "Model",
+  "agentDetail.configure.orchestrate": "Orkestracija",
+  "agentDetail.configure.preview.chatFeatures": "Funkcije klepeta",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Agent",
+  "agentDetail.configure.preview.empty.description": "Pošljite sporočilo, da preizkusite trenutni osnutek.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Ni še navodil, zato odgovori prihajajo iz osnovnega modela.",
+  "agentDetail.configure.preview.endUserAuth": "Preverjanje pristnosti končnega uporabnika",
+  "agentDetail.configure.preview.restart": "Znova zaženi predogled",
+  "agentDetail.configure.preview.title": "Predogled",
+  "agentDetail.configure.prompt.copied": "Poziv kopiran",
+  "agentDetail.configure.prompt.copy": "Kopiraj poziv",
+  "agentDetail.configure.prompt.copyFailed": "Poziva ni bilo mogoče kopirati.",
+  "agentDetail.configure.prompt.insert.label": "Vstavi",
+  "agentDetail.configure.prompt.insert.question": "Začetno vprašanje",
+  "agentDetail.configure.prompt.insert.reportFile": "Izhodna datoteka poročila",
+  "agentDetail.configure.prompt.insert.tenders": "Zaženi razpise",
+  "agentDetail.configure.prompt.label": "Poziv",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Omemba",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Tukaj napišite navodila,",
+  "agentDetail.configure.prompt.tip": "Določite, kako naj ta agent razume vhodne podatke, kliče orodja in ustvarja izhode.",
+  "agentDetail.configure.publishBar.draft": "Osnutek",
+  "agentDetail.configure.publishBar.publishUpdate": "Objavi posodobitev",
+  "agentDetail.configure.publishBar.published": "Objavljeno",
+  "agentDetail.configure.publishBar.publishedAt": "Objavljeno {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Objavljanje…",
+  "agentDetail.configure.publishBar.saved": "Shranjeno pred 5 min",
+  "agentDetail.configure.publishBar.savedAt": "Shranjeno {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Neobjavljene spremembe",
+  "agentDetail.configure.publishBar.upToDate": "Posodobljeno",
+  "agentDetail.configure.publishBar.versionHistory": "Odpri zgodovino različic",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Prizadeti poteki dela",
+  "agentDetail.configure.publishImpact.cancel": "Prekliči",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Vaš agent se pojavi v",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Spremembe bodo vplivale nanje.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "tega agenta",
+  "agentDetail.configure.publishImpact.title": "{{action}} v {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} potek dela",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} potekov dela",
+  "agentDetail.configure.skills.add": "Dodaj veščino",
+  "agentDetail.configure.skills.detail.contentRegion": "Vsebina podrobnosti veščine",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} DATOTEK",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Datoteke veščine",
+  "agentDetail.configure.skills.detail.files": "Datoteke",
+  "agentDetail.configure.skills.empty.description": "Veščine agentu dajejo ponovno uporabno strokovnost, ki jo lahko kliče med delom",
+  "agentDetail.configure.skills.empty.title": "Še ni veščin",
+  "agentDetail.configure.skills.itemType": "Veščina",
+  "agentDetail.configure.skills.label": "Veščine",
+  "agentDetail.configure.skills.remove": "Odstrani {{name}}",
+  "agentDetail.configure.skills.tip": "Veščine, ki jih ta agent lahko uporablja pri izvajanju opravil.",
+  "agentDetail.configure.skills.toggle": "Preklopi veščine",
+  "agentDetail.configure.skills.upload.action": "Naloži",
+  "agentDetail.configure.skills.upload.browse": "prebrskaj",
+  "agentDetail.configure.skills.upload.description": "Naložite paket .zip ali .skill za tega agenta.",
+  "agentDetail.configure.skills.upload.dropzone": "Spustite paket veščine sem ali",
+  "agentDetail.configure.skills.upload.failed": "Veščine ni bilo mogoče naložiti.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Naložite datoteko .zip ali .skill.",
+  "agentDetail.configure.skills.upload.success": "Veščina naložena.",
+  "agentDetail.configure.skills.upload.title": "Naloži veščino",
+  "agentDetail.configure.tools.add": "Dodaj orodje",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Za razvijalce",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Namestite program ukazne vrstice, ki ga agent zaganja v svojem sandboxu. Potrebuje namestitev in običajno tudi API Key.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Orodje CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Izberite orodje, ki je že v tem delovnem prostoru, npr. spletno iskanje ali integracije.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Orodje",
+  "agentDetail.configure.tools.cliDialog.description": "Namestite orodje CLI iz katerega koli registra paketov. Agent dobi dostop preko lupine do podane binarne datoteke.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Uredi orodje CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Shranite API Key, žetone ali skrivnosti, ki jih to orodje CLI potrebuje. Vrednosti so šifrirane v mirovanju in se vstavijo kot okoljske spremenljivke, ko agent kliče orodje.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Okoljske spremenljivke",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(neobvezno)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "V sandboxu · zažene se enkrat ob prvi uporabi",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Namestitveni ukaz",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Sem prilepite namestitveni ukaz, npr. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Namestitveni ukaz je obvezen.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Več o orodju CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Ime orodja CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Poimenujte svoje orodje CLI",
+  "agentDetail.configure.tools.cliDialog.name.required": "Ime orodja CLI je obvezno.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Nikoli ni vidno v pozivu agenta; vstavi se le kot $VAR med izvajanjem",
+  "agentDetail.configure.tools.cliDialog.title": "Dodaj orodje CLI",
+  "agentDetail.configure.tools.cliTool": "Orodje CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Končni uporabnik · OAuth",
+  "agentDetail.configure.tools.editAction": "Uredi {{name}}",
+  "agentDetail.configure.tools.empty.description": "Orodja omogočajo agentu, da deluje — npr. išče po spletu ali kliče vaše aplikacije",
+  "agentDetail.configure.tools.empty.title": "Še ni orodij",
+  "agentDetail.configure.tools.label": "Orodja",
+  "agentDetail.configure.tools.moreActions": "Več dejanj za {{name}}",
+  "agentDetail.configure.tools.pluginType": "Integracija",
+  "agentDetail.configure.tools.preAuthorize": "Predhodna avtorizacija",
+  "agentDetail.configure.tools.removeAction": "Odstrani {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Odstrani vsa orodja",
+  "agentDetail.configure.tools.tip": "Orodja, ki jih ta agent lahko kliče pri izvajanju opravil.",
+  "agentDetail.configure.tools.toggle": "Preklopi orodja",
+  "agentDetail.configure.tools.toolTabs.all": "Vse",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Po meri",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Integracije",
+  "agentDetail.configure.tools.toolTabs.workflow": "Potek dela",
+  "agentDetail.documentTitle": "Agent",
+  "agentDetail.history": "Zgodovina",
+  "agentDetail.logs.description": "Polni dnevniki beležijo stanje izvajanja aplikacije, vključno z uporabniškimi vnosi, odgovori agenta, načrtovanjem in uporabo orodij.",
+  "agentDetail.logs.empty": "Dnevnikov ni",
+  "agentDetail.logs.filters.period.allTime": "Ves čas",
+  "agentDetail.logs.filters.period.label": "Obdobje dnevnika",
+  "agentDetail.logs.filters.period.last30days": "Zadnjih 30 dni",
+  "agentDetail.logs.filters.period.last7days": "Zadnjih 7 dni",
+  "agentDetail.logs.filters.search.label": "Iskanje po dnevnikih",
+  "agentDetail.logs.filters.search.placeholder": "Išči",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Čas zadnje izdelave",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Čas zadnje posodobitve",
+  "agentDetail.logs.filters.source.all": "Vir",
+  "agentDetail.logs.filters.source.empty": "Ni najdenih virov",
+  "agentDetail.logs.filters.source.label": "Vir dnevnika",
+  "agentDetail.logs.filters.source.loadFailed": "Virov ni bilo mogoče naložiti",
+  "agentDetail.logs.filters.source.loading": "Nalaganje virov…",
+  "agentDetail.logs.filters.source.searchLabel": "Iskanje virov",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Iskanje",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Potek dela",
+  "agentDetail.logs.learnMore": "Več informacij",
+  "agentDetail.logs.loadFailed": "Dnevnikov ni bilo mogoče naložiti",
+  "agentDetail.logs.loading": "Nalaganje dnevnikov…",
+  "agentDetail.logs.notAvailable": "Ni na voljo",
+  "agentDetail.logs.table.createdTime": "Čas izdelave",
+  "agentDetail.logs.table.endUser": "Končni uporabnik",
+  "agentDetail.logs.table.messageCount": "Št. sporočil",
+  "agentDetail.logs.table.operationRate": "Stopnja operacij",
+  "agentDetail.logs.table.source": "Vir",
+  "agentDetail.logs.table.title": "Naslov",
+  "agentDetail.logs.table.unread": "Neprebrano",
+  "agentDetail.logs.table.updatedTime": "Čas posodobitve",
+  "agentDetail.logs.table.userRate": "Ocena uporabnika",
+  "agentDetail.logs.title": "Dnevniki",
+  "agentDetail.memorySettings.budgetLabel": "Proračun pomnilnika",
+  "agentDetail.memorySettings.description": "Nastavitve pomnilnika iz aktivnega posnetka konfiguracije.",
+  "agentDetail.memorySettings.export.description": "Izvoz pomnilnika je predviden za poznejšo izdajo.",
+  "agentDetail.memorySettings.export.download": "Prenesi",
+  "agentDetail.memorySettings.export.soon": "Kmalu",
+  "agentDetail.memorySettings.export.title": "Izvozi trenutni pomnilnik",
+  "agentDetail.memorySettings.notConfigured": "Ni nastavljeno",
+  "agentDetail.memorySettings.scopeLabel": "Obseg pomnilnika",
+  "agentDetail.memorySettings.title": "Pomnilnik",
+  "agentDetail.metadata.activeVersionLabel": "Aktivna različica",
+  "agentDetail.metadata.appIdLabel": "ID aplikacije",
+  "agentDetail.metadata.description": "Polja Roster samo za branje, ki jih vrne zaledje agenta.",
+  "agentDetail.metadata.emptyValue": "Ni na voljo",
+  "agentDetail.metadata.scopeLabel": "Obseg",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Samo potek dela",
+  "agentDetail.metadata.sourceLabel": "Vir",
+  "agentDetail.metadata.statusLabel": "Stanje",
+  "agentDetail.metadata.title": "Metapodatki",
+  "agentDetail.metadata.updatedAtLabel": "Posodobljeno",
+  "agentDetail.metadata.workflowIdLabel": "ID poteka dela",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID vozlišča poteka dela",
+  "agentDetail.monitoring.change": "{{value}} glede na prejšnje obdobje",
+  "agentDetail.monitoring.dateRangeLabel": "Datumsko obdobje",
+  "agentDetail.monitoring.description": "Sledite aktivnosti, stroškom in kakovosti interakcije ponovno uporabnega agenta v potekih dela.",
+  "agentDetail.monitoring.learnMore": "Več informacij",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Edinstveni končni uporabniki, ki so sprožili poteke dela s tem agentom.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Aktivni uporabniki",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Število neprekinjenih interakcij med uporabnikom in agentom za to dostopno točko.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Povp. interakcije na sejo",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Povprečna hitrost izhoda od začetka zahteve do dokončanja.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Hitrost izhoda žetonov",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Ocenjeni strošek žetonov, ki jih ta agent proizvede pri izvajanju potekov dela.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Poraba žetonov",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Dnevni AI pogovori, ki so prek izbrane dostopne točke prišli do tega agenta.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Skupaj pogovorov",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Dnevno število interakcij agenta.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Skupaj sporočil",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Število všečkov na 1000 sporočil za tega agenta.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Stopnja zadovoljstva uporabnikov",
+  "agentDetail.monitoring.pickSource": "Izberite aplikacijo",
+  "agentDetail.monitoring.sourceLabel": "Aplikacija",
+  "agentDetail.monitoring.sourceTrigger": "Vir {{name}}",
+  "agentDetail.monitoring.sources.all": "Vse",
+  "agentDetail.monitoring.timeRangeLabel": "Časovno obdobje",
+  "agentDetail.monitoring.timeRanges.custom": "Po meri",
+  "agentDetail.monitoring.timeRanges.last30days": "Zadnjih 30 dni",
+  "agentDetail.monitoring.timeRanges.last7days": "Zadnjih 7 dni",
+  "agentDetail.monitoring.timeRanges.today": "Danes",
+  "agentDetail.monitoring.title": "Spremljanje",
+  "agentDetail.monitoring.tokenUsageConsumed": "Porabljeni žetoni",
+  "agentDetail.monitoring.units.tokenPerSecond": "Žeton/s",
+  "agentDetail.navigationLabel": "Navigacija agenta",
+  "agentDetail.publish": "Objavi",
+  "agentDetail.publishSoon": "Kmalu",
+  "agentDetail.sections.access": "Dostopna točka",
+  "agentDetail.sections.configure": "Orkestracija",
+  "agentDetail.sections.logs": "Dnevniki",
+  "agentDetail.sections.monitoring": "Spremljanje",
+  "agentDetail.subtitle": "ID agenta: {{agentId}}",
+  "agentDetail.title": "Agent",
+  "agentDetail.type": "AGENT",
+  "agentDetail.versionHistory.active": "Aktivna",
+  "agentDetail.versionHistory.empty": "Še ni različic",
+  "agentDetail.versionHistory.filter": "Filtriraj različice",
+  "agentDetail.versionHistory.versionName": "Različica {{version}}",
+  "roster.createAgent": "Ustvari agenta",
+  "roster.createAgentOptions": "Možnosti ustvarjanja agenta",
+  "roster.createDialog.description": "Ustvarite ponovno uporabnega agenta v Roster tega delovnega prostora.",
+  "roster.createDialog.title": "Ustvari agenta",
+  "roster.createForm.changeIcon": "Spremeni ikono agenta",
+  "roster.createForm.descriptionLabel": "Opis",
+  "roster.createForm.descriptionOptional": "(neobvezno)",
+  "roster.createForm.descriptionPlaceholder": "npr. Zbira vire o določeni temi in povzame ključne ugotovitve",
+  "roster.createForm.nameLabel": "Ime",
+  "roster.createForm.namePlaceholder": "npr. Max",
+  "roster.createForm.nameRequired": "Ime je obvezno.",
+  "roster.createForm.roleLabel": "Vloga",
+  "roster.createForm.rolePlaceholder": "npr. Raziskovalni asistent",
+  "roster.createForm.roleRequired": "Vloga je obvezna.",
+  "roster.createSuccess": "Agent ustvarjen.",
+  "roster.dateTimeFormat": "DD. MM. YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Ta agent bo odstranjen iz aktivnega seznama Roster.",
+  "roster.deleteDialog.title": "Izbrišem {{name}}?",
+  "roster.deleteFailed": "Agenta ni bilo mogoče izbrisati.",
+  "roster.deleteSuccess": "Agent izbrisan.",
+  "roster.duplicateFailed": "Agenta ni bilo mogoče podvojiti.",
+  "roster.duplicateSuccess": "Agent podvojen.",
+  "roster.editAgent": "Uredi {{name}}",
+  "roster.editDialog.description": "Posodobite ime v Roster, opis in vlogo za tega agenta.",
+  "roster.editDialog.title": "Uredi agenta",
+  "roster.editInfo": "Uredi informacije",
+  "roster.empty": "Še ni agentov",
+  "roster.emptyDescription": "Agenti, shranjeni v tem delovnem prostoru, se prikažejo tukaj.",
+  "roster.emptySearch": "Ni ujemajočih se agentov",
+  "roster.emptySearchDescription": "Poskusite z drugim imenom agenta.",
+  "roster.filters.all": "Vsi",
+  "roster.filters.drafts": "Osnutki",
+  "roster.filters.label": "Filtri agentov",
+  "roster.filters.published": "Objavljeni",
+  "roster.learnMore": "Več o Agent Roster",
+  "roster.listLabel": "Seznam Roster agentov",
+  "roster.loadMore": "Naloži več",
+  "roster.loadingError": "Agentov ni bilo mogoče naložiti. Osvežite in poskusite znova.",
+  "roster.moreActions": "Več dejanj za {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Vgrajenega agenta ni bilo mogoče ustvariti. Osvežite in poskusite znova.",
+  "roster.nodeSelector.dialogLabel": "Izberite agenta",
+  "roster.nodeSelector.manageInAgentConsole": "Upravljaj v Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Išči…",
+  "roster.nodeSelector.startFromScratch": "Začni iz nič",
+  "roster.references.label": "Poteki dela, ki uporabljajo {{name}}",
+  "roster.references.trigger": "Poteki dela, ki uporabljajo {{name}}",
+  "roster.searchLabel": "Iskanje agentov",
+  "roster.searchPlaceholder": "Iskanje agentov po imenu…",
+  "roster.sources.agent_app": "Aplikacija agenta",
+  "roster.sources.imported": "Uvoženi",
+  "roster.sources.system": "Sistemski",
+  "roster.sources.workflow": "Potek dela",
+  "roster.status.active": "Aktiven",
+  "roster.status.archived": "Arhiviran",
+  "roster.tabs.agent": "Agent",
+  "roster.tabs.human": "Človek",
+  "roster.tabsLabel": "Tip Roster",
+  "roster.updateSuccess": "Agent posodobljen.",
+  "roster.usageStatus.draft": "Osnutek"
+}
diff --git a/web/i18n/sl-SI/app-log.json b/web/i18n/sl-SI/app-log.json
index cd359893457..8d47c89711c 100644
--- a/web/i18n/sl-SI/app-log.json
+++ b/web/i18n/sl-SI/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Danes",
   "filter.period.yearToDate": "Leto do danes",
   "filter.sortBy": "Razvrsti po:",
+  "monitoring.description": "Spremljanje beleži stanje delovanja aplikacije, vključno z zmogljivostjo, dejavnostjo uporabnikov in stroški.",
   "promptLog": "Dnevnik PROMPT-ov",
   "runDetail.fileListDetail": "Podrobnosti",
   "runDetail.fileListLabel": "Podrobnosti o datoteki",
diff --git a/web/i18n/sl-SI/billing.json b/web/i18n/sl-SI/billing.json
index 8836561277a..b94f44f5dd5 100644
--- a/web/i18n/sl-SI/billing.json
+++ b/web/i18n/sl-SI/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Nadgradite za odklep nalaganja dokumentov v skupkih",
   "upgrade.uploadMultiplePages.description": "Dosegli ste omejitev nalaganja — na vašem trenutnem načrtu je mogoče izbrati in naložiti le en dokument naenkrat.",
   "upgrade.uploadMultiplePages.title": "Nadgradite za nalaganje več dokumentov hkrati",
+  "upgrade.workflowRestore.description": "Obnovitev različic poteka dela v vašem trenutnem paketu ni na voljo.",
+  "upgrade.workflowRestore.title": "Nadgradite za obnovitev različic poteka dela",
   "upgradeBtn.encourage": "Nadgradi zdaj",
   "upgradeBtn.encourageShort": "Nadgradi",
   "upgradeBtn.plain": "Nadgradi načrt",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index 7d4a052f873..f0bf2b62e9c 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Preklopi delovni prostor",
   "mcpPage.description": "Povežite in upravljajte strežnike MCP, da aplikacijam omogočite dostop do zunanjih orodij in storitev.",
-  "members.admin": "Administrator",
   "members.adminTip": "Lahko ustvarja aplikacije in upravlja nastavitve ekipe",
+  "members.alreadyInTeam": "Že v ekipi",
+  "members.alreadyInTeamTip": "Ti uporabniki že imajo dostop do tega delovnega prostora.",
   "members.builder": "Graditelj",
   "members.builderTip": "Lahko ustvarja in ureja lastne aplikacije",
-  "members.datasetOperator": "Skrbnik znanja",
   "members.datasetOperatorTip": "Lahko upravlja samo bazo znanja",
   "members.deleteMember": "Izbriši člana",
   "members.disInvite": "Prekliči povabilo",
-  "members.editor": "Urednik",
   "members.editorTip": "Lahko ustvarja in ureja aplikacije",
   "members.email": "E-pošta",
   "members.emailInvalid": "Neveljaven format e-pošte",
@@ -270,13 +269,12 @@
   "members.invite": "Dodaj",
   "members.inviteTeamMember": "Dodaj člana ekipe",
   "members.inviteTeamMemberTip": "Do vaših podatkov bo lahko dostopal takoj po prijavi.",
-  "members.invitedAsRole": "Povabljen kot uporabnik {{role}}",
+  "members.invitedAsRole": "Povabljen kot {{role}}",
   "members.lastActive": "NAZADNJE AKTIVEN",
   "members.name": "IME",
-  "members.normal": "Običajni uporabnik",
+  "members.noNewInvitationsSent": "Nova povabila niso bila poslana",
   "members.normalTip": "Lahko uporablja samo aplikacije, ne more ustvarjati aplikacij",
   "members.ok": "V redu",
-  "members.owner": "Lastnik",
   "members.pending": "V teku...",
   "members.removeFromTeam": "Odstrani iz ekipe",
   "members.removeFromTeamTip": "Odstranjen bo dostop do ekipe",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Znanje",
   "menus.datasetsTips": "KMALU: Uvozite svoje besedilne podatke ali pišite podatke v realnem času preko spletnih kljuk za izboljšanje konteksta LLM.",
+  "menus.deployments": "Uvedbe",
   "menus.explore": "Raziskuj",
   "menus.exploreMarketplace": "Raziščite Marketplace",
   "menus.newApp": "Nova aplikacija",
   "menus.newDataset": "Ustvari znanje",
   "menus.plugins": "Integracije",
   "menus.pluginsTips": "Integrirajte integracijae tretjih oseb ali ustvarite integracijae, združljive s ChatGPT.",
+  "menus.roster": "Seznam agentov",
   "menus.status": "beta",
   "menus.tools": "Orodja",
   "model.addMoreModel": "Pojdite v nastavitve, da dodate več modelov",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Model za pretvorbo besedila v govor",
   "modelProvider.ttsModel.tip": "Nastavite privzeti model za pretvorbo besedila v govor v pogovoru.",
   "modelProvider.upgradeForLoadBalancing": "Nadgradite svoj načrt, da omogočite uravnoteženje obremenitev.",
+  "navigation.skipToMain": "Preskoči na glavno vsebino",
   "noData": "Ni podatkov",
   "operation.add": "Dodaj",
   "operation.added": "Dodano",
@@ -600,9 +601,6 @@
   "placeholder.input": "Vnesite prosim",
   "placeholder.search": "Išči...",
   "placeholder.select": "Izberite prosim",
-  "plugin.serpapi.apiKey": "API ključ",
-  "plugin.serpapi.apiKeyPlaceholder": "Vnesite ključ API",
-  "plugin.serpapi.keyFrom": "Pridobite svoj ključ SerpAPI na strani računa SerpAPI",
   "promptEditor.context.item.desc": "Vstavljanje predloge konteksta",
   "promptEditor.context.item.title": "Kontekstu",
   "promptEditor.context.modal.add": "Dodajanje konteksta",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
new file mode 100644
index 00000000000..772292ad84e
--- /dev/null
+++ b/web/i18n/sl-SI/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API zaledne storitve",
+  "access.api.copyCurlExample": "Kopiraj cURL primer",
+  "access.api.createFailed": "Ustvarjanje API žetona ni uspelo.",
+  "access.api.createKey": "Ustvari API žeton",
+  "access.api.createKeyTitle": "Ustvari nov API žeton",
+  "access.api.curlExampleTitle": "cURL primer",
+  "access.api.description": "Dostopajte do te uvedbe preko HTTP. Vsak API žeton je omejen na eno okolje.",
+  "access.api.developerTitle": "Razvijalski API",
+  "access.api.disabled": "Dostop do API je za to uvedbo izklopljen.",
+  "access.api.disabledHint": "Omogočite dostop do API za ustvarjanje žetonov, omejenih na okolje.",
+  "access.api.dismissToken": "Zapri API žeton",
+  "access.api.docs": "API dokumentacija",
+  "access.api.docsClose": "Zapri API dokumentacijo",
+  "access.api.docsDescription": "Oglejte si referenco Workflow API za to uvedbo.",
+  "access.api.docsTitle": "Dokumentacija Workflow API",
+  "access.api.empty": "Najprej uvedite v okolje, da začnete izdajati API žetone.",
+  "access.api.emptyTitle": "Ni uvedenih okolij",
+  "access.api.endpoint": "URL zahteve",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Seznam API žetonov",
+  "access.api.nameLabel": "Ime API žetona",
+  "access.api.namePlaceholder": "Vnesite ime API žetona",
+  "access.api.nameRequired": "Ime API žetona je obvezno.",
+  "access.api.newKey": "Ustvari nov API žeton",
+  "access.api.newTokenDescription": "Ta API žeton je prikazan samo enkrat. Kopirajte ga, preden zapustite to stran.",
+  "access.api.newTokenLabel": "API žeton",
+  "access.api.newTokenTitle": "API žeton ustvarjen",
+  "access.api.noKeys": "Še ni API žetonov. Ustvarite enega za začetek klicanja API.",
+  "access.api.noKeysTitle": "Še ni API žetonov",
+  "access.api.revokeConfirmDescription": "API žeton \"{{name}}\" bo takoj prenehal delovati. Tega dejanja ni mogoče razveljaviti.",
+  "access.api.revokeConfirmTitle": "Prekličete API žeton?",
+  "access.api.revokeFailed": "Preklic API žetona ni uspel.",
+  "access.api.revokeSuccess": "API žeton preklican",
+  "access.api.table.action": "Dejanje",
+  "access.api.table.environment": "Okolje",
+  "access.api.table.key": "API žeton",
+  "access.api.table.name": "Ime",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Kanal",
+  "access.channels.col.endpoint": "Vstopna točka",
+  "access.channels.col.status": "Status",
+  "access.channels.description": "Vstopni točki WebApp in CLI uporabljata zgornja dovoljenja za dostop.",
+  "access.channels.disabled": "Kanali dostopa so za to uvedbo izklopljeni.",
+  "access.channels.disabledHint": "Omogočite kanale dostopa za izpostavitev vstopnih točk WebApp in CLI.",
+  "access.channels.followPermission": "Sledi dovoljenjem",
+  "access.channels.title": "Kanali dostopa",
+  "access.cli.description": "Pokličite iz terminala z difyctl, primerno za skripte, avtomatizirane potekov dela ali integracije z agenti.",
+  "access.cli.docs": "Vodič za uporabo",
+  "access.cli.domain": "Domena",
+  "access.cli.empty": "Končna točka CLI ni konfigurirana.",
+  "access.cli.install": "Namesti CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Kopirano",
+  "access.copy": "Kopiraj",
+  "access.copyFailed": "Kopiranje ni uspelo",
+  "access.copyToast": "Kopirano v odložišče",
+  "access.hide": "Skrij",
+  "access.members.clearAll": "Počisti vse",
+  "access.members.empty": "Ni najdenih ujemanj.",
+  "access.members.groupCount_one": "{{count}} skupina",
+  "access.members.groupCount_other": "{{count}} skupin",
+  "access.members.groups": "Skupine",
+  "access.members.individuals": "Člani",
+  "access.members.memberCount_one": "{{count}} član",
+  "access.members.memberCount_other": "{{count}} članov",
+  "access.members.pickPlaceholder": "Izberite skupine ali člane",
+  "access.members.searchPlaceholder": "Iskanje skupin in članov",
+  "access.members.selectedLabel": "Izbrano",
+  "access.permission.anyone": "Vsi s povezavo",
+  "access.permission.anyoneDesc": "Vsakdo lahko dostopa do te uvedbe brez prijave.",
+  "access.permission.memberCount_one": "{{count}} član",
+  "access.permission.memberCount_other": "{{count}} članov",
+  "access.permission.organization": "Vsi člani znotraj platforme",
+  "access.permission.organizationDesc": "Vsi člani znotraj platforme",
+  "access.permission.specific": "Določeni člani znotraj platforme",
+  "access.permission.specificDesc": "Izberite določene skupine ali člane",
+  "access.permission.specificUnavailable": "Izbira določenih članov je onemogočena, dokler niso povezani pravi člani platforme in skupine.",
+  "access.permission.updateFailed": "Posodobitev pravilnika o dostopu ni uspela.",
+  "access.permissions.col.environment": "Okolje",
+  "access.permissions.col.permission": "Dostop",
+  "access.permissions.description": "Nastavite dovoljenja za dostop do vstopnih točk WebApp in CLI v vsakem okolju.",
+  "access.permissions.editAriaLabel": "Konfiguriraj dostop za {{environment}}",
+  "access.permissions.editDescription": "Nastavite dovoljenja za dostop do vstopnih točk WebApp in CLI.",
+  "access.permissions.editTitle": "Dovoljenja za dostop",
+  "access.permissions.title": "Dovoljenja za dostop",
+  "access.revoke": "Prekliči",
+  "access.runAccess.description": "Upravljajte, kako lahko uporabniki zaženejo to uvedbo in kdo ima dostop v posameznem okolju.",
+  "access.runAccess.disabled": "Dostop za izvajanje je za to uvedbo izklopljen.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Izpostavi to uvedbo kot strežnik Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Končna točka MCP ni konfigurirana.",
+  "access.runAccess.noEnvs": "Uvedite v okolje za konfiguracijo dovoljenj za dostop.",
+  "access.runAccess.noEnvsTitle": "Ni uvedenih okolij",
+  "access.runAccess.openWebapp": "Odpri WebApp",
+  "access.runAccess.permissions": "Dovoljenja za dostop",
+  "access.runAccess.permissionsDesc": "Kdo lahko dostopa do te uvedbe v vsakem okolju.",
+  "access.runAccess.title": "Dostop za izvajanje",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Gostujoča spletna stran za končne uporabnike.",
+  "access.runAccess.webappEmpty": "Kmalu na voljo.",
+  "access.show": "Pokaži",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Zunanji",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Neznano",
+  "card.access.api": "API žetoni",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Brez dostopa",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Ustvari prvo izdajo",
+  "card.deploy": "Uvedi",
+  "card.deploying": "{{count}} uvajanj",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} neuspelih",
+  "card.fromApp": "Iz {{name}}",
+  "card.lastDeployed": "Zadnja uvedba {{time}}",
+  "card.menu.delete": "Izbriši uvedbo",
+  "card.menu.deleteDisabled": "Brisanje uvedbe za uvedbe, ki jih upravlja zaledje, še ni na voljo.",
+  "card.menu.deploy": "Uvedi v okolje",
+  "card.menu.editInfo": "Uredi informacije",
+  "card.menu.viewDetail": "Oglej si podrobnosti uvedbe",
+  "card.moreActions": "Več dejanj",
+  "card.neverDeployed": "Še ni uvedeno",
+  "card.noDescription": "Opis ni naveden.",
+  "card.notDeployed": "Ni uvedeno",
+  "card.ready": "{{count}} se izvaja",
+  "card.tooltip.createdAt": "Ustvarjeno",
+  "card.tooltip.deployed": "Uvedeno",
+  "card.tooltip.deploymentStatus": "Uvedba",
+  "card.tooltip.notDeployed": "Ta uvedba še ni uvedena v nobeno okolje.",
+  "card.tooltip.notDeployedShort": "Ni uvedeno",
+  "card.tooltip.release": "Izdaja",
+  "card.tooltip.releaseName": "Ime izdaje",
+  "card.tooltip.source": "Vir",
+  "common.loadFailed": "Nalaganje ni uspelo. Poskusite znova kasneje.",
+  "common.loading": "Nalaganje...",
+  "createGuide.actions.back": "Nazaj",
+  "createGuide.actions.cancel": "Prekliči",
+  "createGuide.actions.continue": "Nadaljuj",
+  "createGuide.actions.createAndDeploy": "Ustvari in uvedi",
+  "createGuide.actions.creating": "Ustvarjanje...",
+  "createGuide.actions.deploy": "Uvedi",
+  "createGuide.actions.deploying": "Ustvarjanje in uvajanje...",
+  "createGuide.actions.next": "Naprej",
+  "createGuide.actions.skipDeploy": "Preskoči, uvedi kasneje",
+  "createGuide.description": "Ustvarite uvedbo iz vira izdaje, osnovnih informacij in ciljnega okolja.",
+  "createGuide.dsl.defaultAppName": "Uvožena DSL aplikacija",
+  "createGuide.dsl.description": "Naložite paket Workflow DSL za ustvarjanje uvedbe, prve izdaje in neobvezne uvedbe okolja.",
+  "createGuide.dsl.dropDescription": "Naložite paket Workflow YAML DSL. Možnosti uvedbe so razrešene iz te datoteke pred uvedbo.",
+  "createGuide.dsl.dropTitle": "Naložite paket Workflow DSL",
+  "createGuide.dsl.readFailed": "Branje datoteke DSL ni uspelo. Izberite drugo datoteko in poskusite znova.",
+  "createGuide.dsl.reading": "Branje datoteke DSL...",
+  "createGuide.dsl.title": "Uvozi DSL",
+  "createGuide.dsl.unsupportedMode": "Za uvedbe je mogoče uporabiti samo datoteke Workflow DSL.",
+  "createGuide.errors.createReleaseFailed": "Ustvarjanje uvedbe ali izdaje ni uspelo.",
+  "createGuide.errors.deployFailed": "Uvedba v okolje ni uspela.",
+  "createGuide.method.description": "Izberite vir, ki bo uporabljen za ustvarjanje prve izdaje.",
+  "createGuide.methods.bindApp.description": "Uporabite obstoječo Workflow aplikacijo v Studiu kot vir izdaje.",
+  "createGuide.methods.bindApp.title": "Poveži obstoječo Workflow aplikacijo",
+  "createGuide.methods.importDsl.description": "Naložite paket Workflow YAML DSL in nadaljujte preko vmesnika za uvedbo.",
+  "createGuide.methods.importDsl.title": "Uvozi DSL",
+  "createGuide.methods.mocked": "Mock",
+  "createGuide.nav.back": "Uvedbe",
+  "createGuide.release.defaultName": "začetna izdaja",
+  "createGuide.release.deployInfo": "Informacije o uvedbi",
+  "createGuide.release.description": "Izpolnite informacije o uvedbi in podrobnosti prve izdaje.",
+  "createGuide.release.firstVersion": "Prva izdaja",
+  "createGuide.release.instanceDescription": "Opis uvedbe",
+  "createGuide.release.instanceDescriptionPlaceholder": "Opišite, za kaj se ta uvedba uporablja",
+  "createGuide.release.instanceName": "Ime uvedbe",
+  "createGuide.release.instanceNameConflict": "Uvedba s tem imenom že obstaja. Izberite drugo ime.",
+  "createGuide.release.releaseDescription": "Opis izdaje",
+  "createGuide.release.releaseDescriptionPlaceholder": "Opišite to izdajo",
+  "createGuide.release.releaseName": "Ime izdaje",
+  "createGuide.release.releaseNote": "Opis izdaje",
+  "createGuide.release.title": "Osnovne informacije",
+  "createGuide.source.availableApps_one": "{{count}} aplikacija",
+  "createGuide.source.availableApps_other": "{{count}} aplikacij",
+  "createGuide.source.clearSearch": "Počisti iskanje aplikacij",
+  "createGuide.source.description": "Izberite vir, ki bo uporabljen za ustvarjanje prve izdaje.",
+  "createGuide.source.empty": "Ni najdenih Workflow aplikacij.",
+  "createGuide.source.searchPlaceholder": "Iskanje aplikacij",
+  "createGuide.source.sourceApp": "Workflow aplikacija",
+  "createGuide.source.title": "Vir izdaje",
+  "createGuide.steps.method": "Vir izdaje",
+  "createGuide.steps.release": "Osnovne informacije",
+  "createGuide.steps.source": "Vir izdaje",
+  "createGuide.steps.target": "Uvedi v okolje",
+  "createGuide.target.bindingCount_one": "{{count}} povezava",
+  "createGuide.target.bindingCount_other": "{{count}} povezav",
+  "createGuide.target.bindingHint": "Izberite poverilnice, ki jih uporablja ta izdaja.",
+  "createGuide.target.bindings": "Poverilnice",
+  "createGuide.target.deferredBindingHint": "Poverilnice bodo razrešene iz pravega načrta uvedbe med končnim dejanjem uvedbe.",
+  "createGuide.target.deferredEnvironmentHint": "Ime je usklajeno s pravimi okolji po ustvarjanju uvedbe in izdaje.",
+  "createGuide.target.description": "Izberite ciljno okolje in zagotovite nastavitve izvajanja, ki jih ta izdaja tam potrebuje. Ta korak je mogoče preskočiti.",
+  "createGuide.target.envVarCount_one": "{{count}} spremenljivka",
+  "createGuide.target.envVarCount_other": "{{count}} spremenljivk",
+  "createGuide.target.envVarHint": "Za vsako okoljsko spremenljivko, ki jo ta izdaja potrebuje, vnesite poljubno vrednost ali uporabite vrednost, določeno v aplikaciji.",
+  "createGuide.target.envVarPlaceholder": "Vnesite vrednost",
+  "createGuide.target.envVarSource.ariaLabel": "Izberite vir vrednosti spremenljivke za {{key}}",
+  "createGuide.target.envVarSource.default": "Vrednost aplikacije",
+  "createGuide.target.envVarSource.lastDeployment": "Zadnja uvedena vrednost",
+  "createGuide.target.envVarSource.literal": "Poljubna vrednost",
+  "createGuide.target.envVarType.number": "Število",
+  "createGuide.target.envVarType.secret": "Skrivnost",
+  "createGuide.target.envVarType.string": "Niz",
+  "createGuide.target.envVars": "Okoljske spremenljivke",
+  "createGuide.target.environment": "Ciljno okolje",
+  "createGuide.target.environmentName": "Ime okolja",
+  "createGuide.target.environmentNamePlaceholder": "Produkcija",
+  "createGuide.target.loadBindingsFailed": "Nalaganje poverilnic ni uspelo.",
+  "createGuide.target.loadEnvironmentsFailed": "Nalaganje okolij za uvedbo ni uspelo.",
+  "createGuide.target.missingRequiredBinding": "Izberite poverilnico za to obvezno povezavo.",
+  "createGuide.target.noBindingRequired": "Poverilnice niso potrebne.",
+  "createGuide.target.noCredentialCandidates": "Ni razpoložljivih poverilnic.",
+  "createGuide.target.noEnvironmentOptions": "Ni razpoložljivih okolij za uvedbo.",
+  "createGuide.target.required": "Obvezno",
+  "createGuide.target.selectCredential": "Izberite poverilnico",
+  "createGuide.target.title": "Uvedi v okolje",
+  "createGuide.title": "Nova uvedba",
+  "createModal.appPickerPlaceholder": "Izberite Workflow aplikacijo",
+  "createModal.appSearchEmpty": "Ni ustreznih Workflow aplikacij",
+  "createModal.appSearchPlaceholder": "Iskanje Workflow aplikacij…",
+  "createModal.cancel": "Prekliči",
+  "createModal.create": "Ustvari",
+  "createModal.createFailed": "Ustvarjanje uvedbe ni uspelo.",
+  "createModal.description": "Izberite Workflow aplikacijo in ustvarite uvedbo.",
+  "createModal.descriptionLabel": "Opis",
+  "createModal.descriptionPlaceholder": "Opišite, za kaj se ta uvedba uporablja",
+  "createModal.loadMoreApps": "Naloži več aplikacij",
+  "createModal.loadingApps": "Nalaganje aplikacij…",
+  "createModal.nameLabel": "Ime uvedbe",
+  "createModal.namePlaceholder": "Ime uvedbe",
+  "createModal.noApps": "V tem delovnem prostoru ni najdenih Workflow aplikacij. Najprej jo ustvarite v Studiu.",
+  "createModal.selected": "Izbrano",
+  "createModal.sourceApp": "Workflow aplikacija (obvezno)",
+  "createModal.title": "Nova uvedba",
+  "deployDrawer.bindingCount_one": "{{count}} povezava",
+  "deployDrawer.bindingCount_other": "{{count}} povezav",
+  "deployDrawer.bindingOptionsFailed": "Nalaganje možnosti poverilnic ni uspelo.",
+  "deployDrawer.bindingSelectionHint": "Izberite poverilnice, ki jih uporablja ta uvedba.",
+  "deployDrawer.bindingsDisabled": "Razrešeno iz predogleda izdaje. Urejanje še ni na voljo.",
+  "deployDrawer.cancel": "Prekliči",
+  "deployDrawer.close": "Zapri predal za uvedbo",
+  "deployDrawer.defaultSelect": "Izberite...",
+  "deployDrawer.deploy": "Uvedi v okolje",
+  "deployDrawer.deployExistingRelease": "Uvedi v okolje",
+  "deployDrawer.deployExistingReleaseDescription": "Izberite izdajo in ciljno okolje za uvedbo.",
+  "deployDrawer.deployExistingReleaseTitle": "Uvedi v okolje",
+  "deployDrawer.deployFailed": "Zagon uvedbe ni uspel.",
+  "deployDrawer.deploying": "Uvajanje...",
+  "deployDrawer.description": "Izberite izdajo in ciljno okolje za uvedbo.",
+  "deployDrawer.envVarCount_one": "{{count}} spremenljivka",
+  "deployDrawer.envVarCount_other": "{{count}} spremenljivk",
+  "deployDrawer.envVarHint": "Za vsako okoljsko spremenljivko, ki jo ta izdaja potrebuje, vnesite poljubno vrednost ali uporabite vrednost, določeno v aplikaciji.",
+  "deployDrawer.envVarPlaceholder": "Vnesite vrednost",
+  "deployDrawer.envVarSource.ariaLabel": "Izberite vir vrednosti spremenljivke za {{key}}",
+  "deployDrawer.envVarSource.default": "Vrednost aplikacije",
+  "deployDrawer.envVarSource.lastDeployment": "Zadnja uvedena vrednost",
+  "deployDrawer.envVarSource.literal": "Poljubna vrednost",
+  "deployDrawer.envVarType.number": "Število",
+  "deployDrawer.envVarType.secret": "Skrivnost",
+  "deployDrawer.envVarType.string": "Niz",
+  "deployDrawer.envVars": "Okoljske spremenljivke",
+  "deployDrawer.existingReleaseHint": "Ta izdaja bo uvedena takšna, kot je. Nova izdaja ne bo ustvarjena.",
+  "deployDrawer.loadingBindings": "Razreševanje...",
+  "deployDrawer.lockedHint": "Zaklenjeno na trenutno okolje",
+  "deployDrawer.missingRequiredBinding": "Izberite poverilnico za to obvezno povezavo.",
+  "deployDrawer.missingRequiredEnvVar": "Vnesite vrednost za to obvezno okoljsko spremenljivko.",
+  "deployDrawer.modelCreds": "Poverilnice modela",
+  "deployDrawer.needsValidation": " (potrebuje preverjanje)",
+  "deployDrawer.newReleaseHint": "Iz izbranega YAML-ja Workflow aplikacije bo ustvarjena nova izdaja.",
+  "deployDrawer.noBindingRequired": "Ni obvezno",
+  "deployDrawer.noCredentialCandidates": "Ni razpoložljivih poverilnic.",
+  "deployDrawer.noNewEnvironmentAvailable": "Vsa razpoložljiva okolja že imajo uvedbo.",
+  "deployDrawer.noOtherReleaseAvailable": "Za to okolje ni na voljo drugih izdaj.",
+  "deployDrawer.noReleaseAvailable": "Pred uvedbo v okolje ustvarite izdajo.",
+  "deployDrawer.notFound": "Uvedba ni najdena.",
+  "deployDrawer.noteLabel": "Opis izdaje (neobvezno)",
+  "deployDrawer.notePlaceholder": "npr. Popravek besedila uvajanja",
+  "deployDrawer.pluginCreds": "Poverilnice vtičnika",
+  "deployDrawer.promote": "Uvedi",
+  "deployDrawer.promoteDescription": "Izberite izdajo in ciljno okolje za uvedbo.",
+  "deployDrawer.promoteTitle": "Uvedi v okolje",
+  "deployDrawer.readOnly": "Samo za branje",
+  "deployDrawer.redeploy": "Uvedi v okolje",
+  "deployDrawer.redeployDescription": "Izberite izdajo in ciljno okolje za uvedbo.",
+  "deployDrawer.redeployExistingReleaseHint": "Trenutna izdaja bo ponovno uvedena takšna, kot je. Nova izdaja ne bo ustvarjena.",
+  "deployDrawer.redeployTitle": "Uvedi v okolje",
+  "deployDrawer.releaseLabel": "Izdaja",
+  "deployDrawer.requiredBinding": "Obvezno",
+  "deployDrawer.rollback": "Uvedi",
+  "deployDrawer.rollbackDescription": "Izberite izdajo in ciljno okolje za uvedbo.",
+  "deployDrawer.rollbackTitle": "Uvedi v okolje",
+  "deployDrawer.runtimeCredentials": "Poverilnice",
+  "deployDrawer.secretPlaceholder": "skrivnost",
+  "deployDrawer.selectCredential": "Izberite poverilnico",
+  "deployDrawer.selectEnv": "Izberite okolje",
+  "deployDrawer.selectProviderCred": "Izberite poverilnico za {{provider}}",
+  "deployDrawer.selectProviderKey": "Izberite ključ za {{provider}}",
+  "deployDrawer.selectRelease": "Izberite izdajo",
+  "deployDrawer.targetEnv": "Ciljno okolje",
+  "deployDrawer.title": "Uvedi v okolje",
+  "deployDrawer.valuePlaceholder": "vrednost",
+  "deployTab.cancelDeployment": "Prekliči uvedbo",
+  "deployTab.closeError": "Zapri",
+  "deployTab.col.actions": "Dejanja",
+  "deployTab.col.currentRelease": "Trenutna izdaja",
+  "deployTab.col.environment": "Okolje",
+  "deployTab.col.status": "Status",
+  "deployTab.col.updated": "Posodobljeno",
+  "deployTab.collapseDetails": "Strni podrobnosti uvedbe",
+  "deployTab.confirmUndeploy": "Razveljavi uvedbo",
+  "deployTab.deployOtherVersion": "Uvedi drugo izdajo",
+  "deployTab.deployToEnv": "Uvedi v {{name}}",
+  "deployTab.deployToNewEnv": "Uvedi v novo okolje...",
+  "deployTab.empty": "Še ni instanc. Za začetek uvedite v novo okolje.",
+  "deployTab.emptyDescription": "Izberite izdajo in ciljno okolje, da uporabnikom omogočite dostop do te uvedbe.",
+  "deployTab.emptyTitle": "Nobeno okolje se še ne izvaja",
+  "deployTab.envCount": "Okolja",
+  "deployTab.errorCode": "Koda",
+  "deployTab.errorDialogDesc": "Preglejte zadnjo neuspelo uvedbo pred ponovnim poskusom ali uvedbo druge izdaje.",
+  "deployTab.errorDialogTitle": "Napaka uvedbe v {{name}}",
+  "deployTab.errorMessage": "Sporočilo",
+  "deployTab.errorPhase": "Faza",
+  "deployTab.expandDetails": "Razširi podrobnosti uvedbe",
+  "deployTab.moreActions": "Več dejanj",
+  "deployTab.newDeployment": "Uvedi v novo okolje",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "ID uvedbe",
+  "deployTab.panel.endpoints": "Končne točke",
+  "deployTab.panel.envVars": "Okoljske spremenljivke",
+  "deployTab.panel.error": "Napaka",
+  "deployTab.panel.failedRelease": "Neuspela izdaja",
+  "deployTab.panel.health": "Zdravje",
+  "deployTab.panel.instanceInfo": "Informacije o instanci",
+  "deployTab.panel.modelCreds": "Poverilnice modela",
+  "deployTab.panel.pluginCreds": "Poverilnice vtičnika",
+  "deployTab.panel.release": "Izdaja",
+  "deployTab.panel.releaseCreatedAt": "Izdaja ustvarjena",
+  "deployTab.panel.releaseInfo": "Informacije o izdaji",
+  "deployTab.panel.replicas": "Replike",
+  "deployTab.panel.run": "Zaženi",
+  "deployTab.panel.runtimeBindings": "Poverilnice",
+  "deployTab.panel.runtimeInfo": "Informacije o izvajanju",
+  "deployTab.panel.runtimeMode": "Način izvajanja",
+  "deployTab.panel.runtimeNote": "Opomba izvajanja",
+  "deployTab.panel.targetRelease": "Ciljna izdaja",
+  "deployTab.panel.unknownError": "Uvedba ni uspela.",
+  "deployTab.promote": "Uvedi",
+  "deployTab.redeploy": "Ponovno uvedi",
+  "deployTab.releaseCreatedAt": "Izdaja ustvarjena {{time}}",
+  "deployTab.retry": "Poskusi znova",
+  "deployTab.shortcut": "Bližnjica",
+  "deployTab.status.deployFailed": "Uvedba ni uspela",
+  "deployTab.status.deployingRelease": "Uvajanje ({{release}})",
+  "deployTab.status.runningOutOfSync": "Se izvaja (sinhronizacija v teku)",
+  "deployTab.status.runningWithFailed": "Se izvaja (zadnja uvedba ni uspela)",
+  "deployTab.undeploy": "Razveljavi uvedbo",
+  "deployTab.undeployConfirmDesc": "Dostop končnih uporabnikov se bo takoj ustavil. Izdajo je mogoče ponovno uvesti kasneje.",
+  "deployTab.undeployConfirmTitle": "Razveljavite uvedbo iz {{name}}?",
+  "deployTab.undeployFrom": "Razveljavi uvedbo iz {{name}}",
+  "deployTab.undeployImpactTitle": "Prizadeta instanca",
+  "deployTab.viewError": "Oglej si napako",
+  "deployTab.viewLogs": "Oglej si dnevnike",
+  "deployTab.viewProgress": "Oglej si napredek",
+  "detail.backToInstances": "Nazaj na uvedbe",
+  "detail.deployingCount": "{{count}} uvajanj",
+  "detail.envCount_one": "{{count}} okolje",
+  "detail.envCount_other": "{{count}} okolij",
+  "detail.failedCount": "{{count}} neuspelih",
+  "detail.mobileTabs": "Razdelki uvedbe",
+  "detail.notFound": "Uvedba ni najdena",
+  "detail.openSourceApp": "Odpri izvor {{name}}",
+  "detail.sourceApp": "Vir",
+  "detail.sourceAppLink": "Vir",
+  "documentTitle.create": "Nova uvedba · Uvedbe",
+  "documentTitle.detail": "Uvedba · Uvedbe",
+  "documentTitle.list": "Uvedbe",
+  "filter.allEnvs": "Vsa okolja",
+  "filter.notDeployed": "Ni uvedeno",
+  "filter.searchPlaceholder": "Iskanje uvedb",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Sprejem",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Zagon",
+  "health.ENVIRONMENT_STATUS_DELETING": "Brisanje",
+  "health.ENVIRONMENT_STATUS_FAILED": "Nedosegljivo",
+  "health.ENVIRONMENT_STATUS_READY": "Na voljo",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Neznano",
+  "list.clearFilters": "Počisti filtre",
+  "list.clearSearch": "Počisti iskanje uvedb",
+  "list.createDeployment": "Novo",
+  "list.empty": "Ni najdenih uvedb.",
+  "list.emptyDescription": "Ustvarite uvedbo iz Workflow aplikacije ali paketa Workflow DSL za upravljanje izdaj, okolij in dostopa.",
+  "list.emptyFilteredDescription": "Nobena uvedba ne ustreza trenutnemu iskanju ali filtru okolja.",
+  "list.emptyFilteredTitle": "Ni ustreznih uvedb",
+  "list.emptyTitle": "Še ni uvedb",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Izolirano",
+  "mode.ENVIRONMENT_MODE_SHARED": "Skupno",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Neznano",
+  "newInstance.comingSoon": "Kmalu na voljo",
+  "newInstance.fromStudio": "Izberi iz Studia",
+  "newInstance.importDSL": "Uvozi DSL",
+  "newInstance.title": "Nova uvedba",
+  "overview.accessEndpoints": "Končne točke dostopa",
+  "overview.accessMeta.apiTokens": "Upravljaj API žetone",
+  "overview.accessMeta.cli": "Oglej si dostop CLI",
+  "overview.accessMeta.webApp": "Upravljaj dostop WebApp",
+  "overview.accessStatus": "Dostop",
+  "overview.api": "API žetoni",
+  "overview.apiKeysCount_one": "{{count}} API žeton",
+  "overview.apiKeysCount_other": "{{count}} API žetonov",
+  "overview.apiTokenSummary.environments_one": "{{count}} uvedeno okolje",
+  "overview.apiTokenSummary.environments_other": "{{count}} uvedenih okolij",
+  "overview.availableForDeployment": "Na voljo za uvedbo",
+  "overview.basicInfo": "Osnovne informacije",
+  "overview.cardAction.deployLatest": "Uvedi najnovejšo izdajo",
+  "overview.cardAction.redeploy": "Ponovno uvedi",
+  "overview.cardAction.viewProgress": "Oglej si uvedbo",
+  "overview.chip.behindTooltip_one": "1 izdaja za najnovejšo. Uvedite najnovejšo izdajo za posodobitev.",
+  "overview.chip.behindTooltip_other": "{{count}} izdaj za najnovejšo. Uvedite najnovejšo izdajo za posodobitev.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "uvajanje",
+  "overview.chip.deployingTooltip": "Uvajanje je v teku.",
+  "overview.chip.empty": "prazno",
+  "overview.chip.emptyTooltip": "V tem okolju ni uvedene nobene izdaje.",
+  "overview.chip.failed": "neuspelo",
+  "overview.chip.failedTooltip": "Zadnji poskus uvedbe ni uspel.",
+  "overview.chip.latest": "najnovejša",
+  "overview.chip.latestTooltip": "V tem okolju se izvaja najnovejša izdaja.",
+  "overview.chip.needsReleaseFirst": "Najprej ustvarite izdajo",
+  "overview.chip.olderRelease": "starejša",
+  "overview.chip.olderReleaseTooltip": "V tem okolju se izvaja starejša izdaja.",
+  "overview.chip.openInDeployTab": "Oglej si napredek uvedbe",
+  "overview.cli": "CLI",
+  "overview.configured": "Konfigurirano",
+  "overview.createRelease": "Ustvari izdajo",
+  "overview.created": "Ustvarjeno",
+  "overview.deploy": "Uvedi",
+  "overview.deployedEnvironments": "uvedeno",
+  "overview.deploymentOverview": "Pregled uvedbe",
+  "overview.deploymentStatus": "Status uvedbe",
+  "overview.description": "Opis",
+  "overview.developerApi": "Razvijalski API",
+  "overview.disabled": "Onemogočeno",
+  "overview.emptyValue": "Ni nastavljeno",
+  "overview.enabled": "Omogočeno",
+  "overview.enabledChannels": "dostop omogočen",
+  "overview.endUserAccess": "Dostop končnih uporabnikov",
+  "overview.environments": "Okolja",
+  "overview.hero.byName": "od {{name}}",
+  "overview.hero.empty": "Še ni izdaj",
+  "overview.hero.emptyDescription": "Pred uvedbo ustvarite izdajo iz trenutnega vira.",
+  "overview.hero.propagation_one": "uvedeno v {{count}}/{{total}} okolje",
+  "overview.hero.propagation_other": "uvedeno v {{count}}/{{total}} okolij",
+  "overview.hero.untargeted": "ni še konfiguriranih okolij",
+  "overview.instanceDetails": "Podrobnosti uvedbe",
+  "overview.instanceId": "ID uvedbe",
+  "overview.latestRelease.releaseCount_one": "{{count}} izdaja",
+  "overview.latestRelease.releaseCount_other": "{{count}} izdaj",
+  "overview.latestReleaseTitle": "Najnovejša izdaja",
+  "overview.manageDeployments": "Upravljaj uvedbe",
+  "overview.name": "Ime",
+  "overview.noAccessConfig": "Brez konfiguracije dostopa.",
+  "overview.noReleaseYet": "Pred uvedbo v okolje ustvarite izdajo.",
+  "overview.notConfigured": "Ni konfigurirano",
+  "overview.previousReleases.empty": "Še ni starejših izdaj.",
+  "overview.previousReleases.retired": "Trenutno ni uvedeno",
+  "overview.previousReleases.title": "Prejšnje izdaje",
+  "overview.previousReleases.viewAll": "Pokaži vse",
+  "overview.ready": "Uvedljivo",
+  "overview.recentReleases": "Nedavne izdaje",
+  "overview.releaseDeployedTitle": "{{release}} je uvedena",
+  "overview.releaseReadyTitle": "{{release}} je pripravljena za uvedbo",
+  "overview.serviceMap": "Zemljevid storitev",
+  "overview.servingRelease": "Streže {{release}}",
+  "overview.servingReleaseDescription": "Ta uvedba je uvedena v {{count}}/{{total}} okolij.",
+  "overview.strip.deployToNewEnvironment": "Uvedi v novo okolje",
+  "overview.strip.empty": "Ni konfiguriranih okolij.",
+  "overview.strip.emptyDeployableDescription": "Ko boste pripravljeni, uvedite najnovejšo izdajo v okolje.",
+  "overview.strip.emptyDeployed": "Še ni instanc.",
+  "overview.strip.emptyDescription": "Pred uvedbo v okolje ustvarite izdajo.",
+  "overview.strip.emptyTitle": "Še ni instanc",
+  "overview.strip.summary_one": "1 od {{total}} na najnovejši izdaji",
+  "overview.strip.summary_other": "{{count}} od {{total}} na najnovejši izdaji",
+  "overview.strip.title": "Instance",
+  "overview.switchSourceApp": "Zamenjaj vir",
+  "overview.switchSourceAppDescription": "Izberite Workflow aplikacijo, ki bo uporabljena kot vir za prihodnje izdaje.",
+  "overview.switchSourceAppHint": "Po zamenjavi samo na novo ustvarjene izdaje uporabljajo nov vir. Zgodovinske izdaje in obstoječe uvedbe se ne spremenijo.",
+  "overview.targetRelease": "Ciljna izdaja",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Nevarno območje",
+  "settings.dangerDesc": "Trajno izbrišite to uvedbo in ustavite vse izvajajoče se instance. Tega ni mogoče razveljaviti.",
+  "settings.delete": "Izbriši uvedbo",
+  "settings.deleteConfirmDesc": "Izbrišete {{name}}? Vsaka instanca se bo prenehala izvajati in bo odstranjena iz vseh okolij. Tega ni mogoče razveljaviti.",
+  "settings.deleteConfirmTitle": "Izbriši uvedbo",
+  "settings.deleteFailed": "Brisanje uvedbe ni uspelo.",
+  "settings.deleteImpact": "Vpliv",
+  "settings.deleteImpactInstance": "Uvedba",
+  "settings.deleteImpactTitle": "Prizadeta uvedba",
+  "settings.deleteImpactValue": "Uvedba je odstranjena s seznama uvedb.",
+  "settings.deleted": "Uvedba izbrisana",
+  "settings.description": "Opis",
+  "settings.descriptionHelp": "Upravljajte ime, opis in druge nastavitve te uvedbe.",
+  "settings.general": "Splošno",
+  "settings.name": "Ime uvedbe",
+  "settings.reset": "Ponastavi",
+  "settings.save": "Shrani spremembe",
+  "settings.updateFailed": "Posodobitev uvedbe ni uspela.",
+  "settings.updated": "Uvedba posodobljena",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Uvajanje",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sinhronizacija v teku",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Uvedba ni uspela",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Neveljavno",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Se izvaja",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Ni uvedeno",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Razveljavljanje uvedbe",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Neznano",
+  "subtitle": "Upravljajte uvedbe v različnih okoljih.",
+  "tabs.access.description": "Upravljajte kanale dostopa in dovoljenja za dostop.",
+  "tabs.access.name": "Dostop",
+  "tabs.api-tokens.description": "Upravljajte API žetone in kličite instance preko HTTP.",
+  "tabs.api-tokens.name": "API žetoni",
+  "tabs.instances.description": "Oglejte si in upravljajte instance v uvedenih okoljih.",
+  "tabs.instances.name": "Instance",
+  "tabs.overview.description": "Oglejte si status uvedbe v različnih okoljih.",
+  "tabs.overview.name": "Pregled",
+  "tabs.releases.description": "Ustvarjajte, uvajajte in upravljajte izdaje.",
+  "tabs.releases.name": "Izdaje",
+  "tabs.settings.description": "Upravljajte ime, opis in druge nastavitve te uvedbe.",
+  "tabs.settings.name": "Nastavitve",
+  "title": "Uvedbe",
+  "unsupportedDslNodes.description": "Ta izdaja vsebuje vozlišča, ki jih izvajalno okolje uvedbe še ne podpira. Odstranite ali zamenjajte jih v Studiu in poskusite znova.",
+  "unsupportedDslNodes.descriptionWithTypes": "Ta izdaja vsebuje vozlišča, ki jih izvajalno okolje uvedbe še ne podpira: {{nodeTypes}}. Odstranite ali zamenjajte jih v Studiu in poskusite znova.",
+  "unsupportedDslNodes.title": "Nepodprta vozlišča",
+  "unsupportedDslNodes.unknownType": "Neznan tip",
+  "versions.cancelCreate": "Prekliči",
+  "versions.cancelDelete": "Prekliči",
+  "versions.cancelEdit": "Prekliči",
+  "versions.checkingReleaseContent": "Preverjanje vsebine izdaje...",
+  "versions.col.action": "Dejanje",
+  "versions.col.author": "Ustvaril",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Ustvarjeno",
+  "versions.col.deployedTo": "Uvedeno v",
+  "versions.col.release": "Izdaja",
+  "versions.col.sourceApp": "Vir",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Ustvari",
+  "versions.createFailed": "Ustvarjanje izdaje ni uspelo.",
+  "versions.createRelease": "Ustvari izdajo",
+  "versions.createReleaseDescription": "Ustvarite uvedljivo izdajo iz Workflow aplikacije ali datoteke Workflow DSL.",
+  "versions.createReleaseHint": "Nove izdaje je mogoče uvesti v katero koli okolje.",
+  "versions.createSuccess": "Izdaja \"{{name}}\" ustvarjena.",
+  "versions.creating": "Ustvarjanje...",
+  "versions.currentOn": "Trenutna izdaja v {{name}}",
+  "versions.deleteConfirmDesc": "Izdaja \"{{name}}\" bo trajno izbrisana. Tega ni mogoče razveljaviti.",
+  "versions.deleteConfirmTitle": "Izbriši izdajo?",
+  "versions.deleteFailed": "Brisanje izdaje ni uspelo.",
+  "versions.deleteImpactDeployment": "Status uvedbe",
+  "versions.deleteImpactNotDeployed": "Trenutno ni uvedeno",
+  "versions.deleteImpactRelease": "Izdaja",
+  "versions.deleteImpactTitle": "Vpliv brisanja",
+  "versions.deleteRelease": "Izbriši izdajo",
+  "versions.deleteSuccess": "Izdaja \"{{name}}\" izbrisana.",
+  "versions.deploy": "Uvedi",
+  "versions.deployTo": "Uvedi v {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Uvajanje",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Sinhronizacija v teku",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Neuspelo",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Neveljavno",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Se izvaja",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Ni uvedeno",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Razveljavljanje uvedbe",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Neznano",
+  "versions.deployingTo": "{{name}} se uvaja",
+  "versions.disabledReason.checkDeploymentsFailed": "Preverjanje uporabe uvedbe ni uspelo. Poskusite znova kasneje.",
+  "versions.disabledReason.checkingDeployments": "Preverjanje uporabe uvedbe",
+  "versions.disabledReason.current": "Ta izdaja se že izvaja v {{name}}",
+  "versions.disabledReason.deploying": "Počakajte, da se aktivna uvedba zaključi",
+  "versions.disabledReason.envDisabled": "To okolje ni uvedljivo",
+  "versions.disabledReason.releaseInUse_one": "Pred brisanjem razveljavite uvedbo te izdaje iz {{count}} okolja",
+  "versions.disabledReason.releaseInUse_other": "Pred brisanjem razveljavite uvedbo te izdaje iz {{count}} okolij",
+  "versions.dslReadFailed": "Branje datoteke DSL ni uspelo. Izberite drugo datoteko in poskusite znova.",
+  "versions.dslReading": "Branje datoteke DSL...",
+  "versions.dslUnsupportedMode": "Za uvedbe je mogoče uporabiti samo datoteke Workflow DSL.",
+  "versions.editFailed": "Posodobitev izdaje ni uspela.",
+  "versions.editRelease": "Uredi izdajo",
+  "versions.editReleaseDescription": "Posodobite ime in opis te izdaje.",
+  "versions.editSuccess": "Izdaja \"{{name}}\" posodobljena.",
+  "versions.empty": "Še ni razpoložljivih izdaj.",
+  "versions.emptyDescription": "Pred uvedbo v okolje ustvarite prvo izdajo.",
+  "versions.emptyTitle": "Še ni izdaj",
+  "versions.emptyWithCreate": "Še ni izdaj. Pred uvedbo ustvarite prvo uvedljivo izdajo.",
+  "versions.exportDsl": "Izvozi DSL",
+  "versions.exportDslFailed": "Izvoz DSL ni uspel.",
+  "versions.exportingDsl": "Izvažanje...",
+  "versions.groupHeader.deploy": "Uvedi",
+  "versions.groupHeader.promote": "Uvedi",
+  "versions.groupHeader.rollback": "Uvedi prejšnjo različico",
+  "versions.groupHeader.unavailable": "Ni na voljo",
+  "versions.manualDslOption": "Naloži DSL",
+  "versions.moreActions": "Več dejanj",
+  "versions.optional": "Neobvezno",
+  "versions.promote": "Uvedi",
+  "versions.promoteTo": "Uvedi v {{name}}",
+  "versions.releaseAlreadyExists": "Izdaja z enako vsebino že obstaja: {{name}}.",
+  "versions.releaseContentCheckFailed": "Preverjanje vsebine izdaje ni uspelo.",
+  "versions.releaseDescriptionLabel": "Opis",
+  "versions.releaseDescriptionPlaceholder": "Opišite to izdajo",
+  "versions.releaseHistory": "Zgodovina izdaj",
+  "versions.releaseNameLabel": "Ime izdaje",
+  "versions.releaseNamePlaceholder": "Ime izdaje",
+  "versions.releaseNameRequired": "Vnesite ime izdaje.",
+  "versions.releaseSourceLabel": "Vir izdaje",
+  "versions.rollbackTo": "Uvedi v {{name}}",
+  "versions.saveEdit": "Shrani",
+  "versions.sourceAppOption": "Workflow aplikacija"
+}
diff --git a/web/i18n/sl-SI/workflow.json b/web/i18n/sl-SI/workflow.json
index 6a22dd642ea..27b73ada29b 100644
--- a/web/i18n/sl-SI/workflow.json
+++ b/web/i18n/sl-SI/workflow.json
@@ -1,5 +1,6 @@
 {
   "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Odgovor",
   "blocks.assigner": "Dodeljevalec spremenljivk",
   "blocks.code": "Koda",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Spremenljivka agregator",
   "blocks.variable-assigner": "Spremenljivka agregator",
   "blocksAbout.agent": "Uporaba velikih jezikovnih modelov za odgovarjanje na vprašanja ali obdelavo naravnega jezika",
+  "blocksAbout.agent-v2": "Uporaba velikih jezikovnih modelov za odgovarjanje na vprašanja ali obdelavo naravnega jezika",
   "blocksAbout.answer": "Določi vsebino odgovora v pogovoru.",
   "blocksAbout.assigner": "Vožnji vozlišča za dodelitev spremenljivk se uporablja za dodeljevanje vrednosti spremenljivkam, ki jih je mogoče zapisati (kot so spremenljivke za pogovor).",
   "blocksAbout.code": "Izvedite kos Python ali NodeJS kode za izvajanje prilagojene logike.",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID poteka dela",
   "globalVar.fieldsDescription.workflowRunId": "ID izvajanja poteka dela",
   "globalVar.title": "Sistemske spremenljivke",
+  "nodes.agent.advancedSetting": "Napredne nastavitve",
   "nodes.agent.checkList.strategyNotSelected": "Strategija ni izbrana",
   "nodes.agent.clickToViewParameterSchema": "Kliknite za prikaz sheme parametrov",
   "nodes.agent.configureModel": "Konfiguriraj Model",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Nepodprti model",
   "nodes.agent.modelSelectorTooltips.deprecated": "Ta model je zastarelo",
   "nodes.agent.notAuthorized": "Nimam dovoljenja",
+  "nodes.agent.outputVars.confirm": "Potrdi",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Vnesite niz JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Vnesite true ali false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Privzete vrednosti datotek tukaj še niso nastavljive.",
+  "nodes.agent.outputVars.defaultValueLabel": "Privzeto",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Vnesite veljavno število.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Vnesite objekt JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Privzeta vrednost",
+  "nodes.agent.outputVars.delete": "Izbriši {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Opis",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Dodaj opis",
+  "nodes.agent.outputVars.edit": "Uredi {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Urejevalnik izhodnih spremenljivk",
   "nodes.agent.outputVars.files.title": "datoteke, ki jih je ustvaril agent",
   "nodes.agent.outputVars.files.transfer_method": "Metoda prenosa. Vrednost je remote_url ali local_file.",
   "nodes.agent.outputVars.files.type": "Vrsta podpore. Zdaj podpiramo samo slike.",
   "nodes.agent.outputVars.files.upload_file_id": "Naložite ID datoteke",
   "nodes.agent.outputVars.files.url": "URL slike",
   "nodes.agent.outputVars.json": "agent generiran json",
+  "nodes.agent.outputVars.nameDuplicate": "Ime izhoda že obstaja",
+  "nodes.agent.outputVars.nameInvalid": "Uporabite črke, številke in podčrtaje. Začnite s črko ali podčrtajem.",
+  "nodes.agent.outputVars.nameLabel": "Ime polja",
+  "nodes.agent.outputVars.namePlaceholder": "Ime polja",
+  "nodes.agent.outputVars.newOutput": "Nov izhod",
+  "nodes.agent.outputVars.requiredLabel": "Obvezno",
+  "nodes.agent.outputVars.showAdvancedOptions": "Pokaži napredne možnosti",
   "nodes.agent.outputVars.text": "vsebina, ki jo je ustvaril agent",
+  "nodes.agent.outputVars.typeLabel": "Vrsta izhoda",
   "nodes.agent.outputVars.usage": "informacije o uporabi modela",
   "nodes.agent.parameterSchema": "Parametrska shema",
   "nodes.agent.pluginInstaller.install": "Namestite",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Ta integracija je nameščen iz GitHuba. Prosimo, da greste v integracijae in ga ponovo namestite.",
   "nodes.agent.pluginNotInstalled": "Ta integracija ni nameščen",
   "nodes.agent.pluginNotInstalledDesc": "Ta integracija je nameščen iz GitHuba. Prosimo, da greste v integracijae in ga ponovo namestite.",
+  "nodes.agent.roster.change": "Spremeni",
+  "nodes.agent.roster.editInConsole": "Uredi v Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Enkratna namestitev, ki obstaja le v tem vozlišču",
+  "nodes.agent.roster.inlineSetup.name": "Vgrajena nastavitev",
+  "nodes.agent.roster.inlineSetup.title": "Nastavitev agenta",
+  "nodes.agent.roster.inlineSetup.type": "Samo v tem vozlišču",
+  "nodes.agent.roster.label": "Agent",
+  "nodes.agent.roster.makeCopy": "Naredi kopijo",
+  "nodes.agent.roster.more": "Več dejanj agenta",
+  "nodes.agent.roster.openPanel": "Odpri podrobnosti {{name}}",
+  "nodes.agent.roster.panelLabel": "Podrobnosti {{name}}",
   "nodes.agent.strategy.configureTip": "Prosimo, konfigurirajte agentno strategijo.",
   "nodes.agent.strategy.configureTipDesc": "Po nastavitvi agentne strategije bo ta vozlišče samodejno naložilo preostale nastavitve. Strategija bo vplivala na mehanizem večstopenjskega razmišljanja o orodju.",
   "nodes.agent.strategy.label": "Agentična strategija",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Nameščena različica integracijaa ne podpira te strategije. Kliknite za preklop na drugo različico.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} ni nameščen",
   "nodes.agent.strategyNotSet": "Agentična strategija ni nastavljena",
+  "nodes.agent.task.insert": "Vstavi",
+  "nodes.agent.task.label": "Opravilo agenta",
+  "nodes.agent.task.mention": "Omemba",
+  "nodes.agent.task.placeholder": "Opišite, kaj naj ta agent počne…",
+  "nodes.agent.task.tooltip": "Določite navodila opravila, ki naj jih ta agent upošteva v tem poteku dela.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Ni pooblaščen",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} ni nameščen",
   "nodes.agent.toolbox": "delovna orodja",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Avtor: {{author}}",
   "tabs.question-understand": "Vprašanje Razumevanje",
   "tabs.requestToCommunity": "Zahteve skupnosti",
-  "tabs.searchBlock": "Išči vozlišče",
+  "tabs.searchBlock": "Iskanje vozlišč, agenta, človeka, znanja",
   "tabs.searchDataSource": "Iskanje vira podatkov",
   "tabs.searchSnippets": "Iskanje izrezkov ...",
   "tabs.searchTool": "Orodje za iskanje",
diff --git a/web/i18n/th-TH/agent-v-2.json b/web/i18n/th-TH/agent-v-2.json
new file mode 100644
index 00000000000..9f29760392a
--- /dev/null
+++ b/web/i18n/th-TH/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "ยังไม่สามารถใช้การกระทำนี้ได้",
+  "agentDetail.access.actions.monitoring": "การมอนิเตอร์",
+  "agentDetail.access.copyAccessUrl": "คัดลอก URL การเข้าถึง",
+  "agentDetail.access.copyFailed": "คัดลอกการอ้างอิงไม่สำเร็จ",
+  "agentDetail.access.copyReference": "คัดลอกการอ้างอิงสำหรับ {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "คัดลอกปลายทาง API ของบริการ",
+  "agentDetail.access.description": "ทุกช่องทางที่สามารถเข้าถึงตัวแทนนี้ได้",
+  "agentDetail.access.empty": "ไม่มีจุดเข้าถึงที่เชื่อมโยง",
+  "agentDetail.access.emptyDescription": "ตัวแทน Roster นี้ยังไม่มีการอ้างอิงแอปหรือเวิร์กโฟลว์",
+  "agentDetail.access.entries.agentApp.description": "แอปตัวแทนที่เชื่อมโยงกับตัวแทน Roster นี้",
+  "agentDetail.access.entries.agentApp.name": "แอปตัวแทน",
+  "agentDetail.access.entries.workflow.description": "เวิร์กโฟลว์และการอ้างอิงโหนดที่เชื่อมโยงกับตัวแทน Roster นี้",
+  "agentDetail.access.entries.workflow.name": "โหนดเวิร์กโฟลว์",
+  "agentDetail.access.entryCount_one": "{{count}} รายการ",
+  "agentDetail.access.entryCount_other": "{{count}} รายการ",
+  "agentDetail.access.groups.references.heading": "การอ้างอิง",
+  "agentDetail.access.groups.references.label": "การอ้างอิงที่เชื่อมโยง",
+  "agentDetail.access.learnMore": "เรียนรู้เพิ่มเติม",
+  "agentDetail.access.moreActions": "การกระทำเพิ่มเติมสำหรับ {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "ปลายทาง API ของบริการ",
+  "agentDetail.access.serviceApi.title": "API บริการแบ็กเอนด์",
+  "agentDetail.access.status.disabled": "ปิดใช้งาน",
+  "agentDetail.access.status.enabled": "เปิดใช้งาน",
+  "agentDetail.access.status.inService": "พร้อมให้บริการ",
+  "agentDetail.access.status.outOfService": "ไม่พร้อมให้บริการ",
+  "agentDetail.access.title": "จุดเข้าถึง",
+  "agentDetail.access.toggleSurface": "สลับการเข้าถึง {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL การเข้าถึง",
+  "agentDetail.access.webApp.actions.customize": "ปรับแต่ง",
+  "agentDetail.access.webApp.actions.embedded": "ฝัง",
+  "agentDetail.access.webApp.actions.launch": "เปิดใช้",
+  "agentDetail.access.webApp.actions.settings": "ตั้งค่า",
+  "agentDetail.access.webApp.refreshUrl": "รีเฟรช URL การเข้าถึง",
+  "agentDetail.access.webApp.showQrCode": "แสดง QR Code",
+  "agentDetail.access.webApp.ssoEnabled": "เปิดใช้งาน SSO",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "ใช้เป็นโหนดภายในเวิร์กโฟลว์",
+  "agentDetail.access.workflow.empty": "ยังไม่มีการอ้างอิงเวิร์กโฟลว์",
+  "agentDetail.access.workflow.loadFailed": "โหลดการอ้างอิงเวิร์กโฟลว์ไม่สำเร็จ",
+  "agentDetail.access.workflow.loading": "กำลังโหลดการอ้างอิงเวิร์กโฟลว์…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} โหนด",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} โหนด",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "เปิดใน Studio",
+  "agentDetail.access.workflow.openInStudioFor": "เปิด {{name}} ใน Studio",
+  "agentDetail.access.workflow.table.actions": "การกระทำ",
+  "agentDetail.access.workflow.table.lastUpdated": "อัปเดตล่าสุด",
+  "agentDetail.access.workflow.table.name": "ชื่อ",
+  "agentDetail.access.workflow.table.nodes": "โหนด",
+  "agentDetail.access.workflow.table.version": "เวอร์ชัน",
+  "agentDetail.access.workflow.title": "การเข้าถึงเวิร์กโฟลว์",
+  "agentDetail.configure.advancedSettings.description": "สำหรับผู้ใช้ขั้นสูง ตัวแปรสภาพแวดล้อม แซนด์บ็อกซ์ และหน่วยความจำ",
+  "agentDetail.configure.advancedSettings.envEditor.add": "เพิ่มตัวแปรสภาพแวดล้อม",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "ลบ {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "ซ่อนค่า {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "นำเข้า .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "ในการแสดงไฟล์ .env ที่ซ่อนอยู่ ให้กด Command + Shift + . ในตัวเลือกไฟล์",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "หากไฟล์ .env ของคุณถูกซ่อน ให้เปิดใช้งานไฟล์ที่ซ่อนในตัวเลือกไฟล์ของระบบ",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "ในการแสดงไฟล์ .env ที่ซ่อนอยู่ ให้เปิดใช้งาน Hidden items ใน File Explorer",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "แสดงค่า {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "เลือกขอบเขตตัวแปรสภาพแวดล้อม",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "ตัวแปรสภาพแวดล้อมที่ตัวแทนนี้สามารถใช้ได้ขณะรันไทม์",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "สลับ Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "การตั้งค่าขั้นสูง",
+  "agentDetail.configure.advancedSettings.toggle": "สลับการตั้งค่าขั้นสูง",
+  "agentDetail.configure.chatFeatures.description": "กำหนดประสบการณ์การแชทของผู้ใช้ปลายทางบน Web app และหน้าจอแชท",
+  "agentDetail.configure.chatFeatures.title": "ฟีเจอร์แชท",
+  "agentDetail.configure.files.add": "เพิ่มไฟล์",
+  "agentDetail.configure.files.empty.description": "อัปโหลดเอกสารที่ตัวแทนสามารถอ่านได้ เช่น ข้อกำหนด เทมเพลต หรือแนวทาง",
+  "agentDetail.configure.files.empty.title": "ยังไม่มีไฟล์",
+  "agentDetail.configure.files.label": "ไฟล์",
+  "agentDetail.configure.files.preview.empty": "ไม่มีเนื้อหาสำหรับแสดงตัวอย่าง",
+  "agentDetail.configure.files.preview.failed": "โหลดตัวอย่างไม่สำเร็จ",
+  "agentDetail.configure.files.preview.unsupported": "ไฟล์นี้ไม่รองรับการแสดงตัวอย่าง",
+  "agentDetail.configure.files.remove": "ลบ {{name}}",
+  "agentDetail.configure.files.tip": "ไฟล์ที่ตัวแทนนี้สามารถใช้ได้ขณะจัดการงาน",
+  "agentDetail.configure.files.toggle": "สลับไฟล์",
+  "agentDetail.configure.files.treeLabel": "ไฟล์ตัวแทน",
+  "agentDetail.configure.files.upload.action": "อัปโหลด",
+  "agentDetail.configure.files.upload.browse": "เรียกดู",
+  "agentDetail.configure.files.upload.description": "อัปโหลดไฟล์สำหรับตัวแทนนี้",
+  "agentDetail.configure.files.upload.dropzone": "วางไฟล์ที่นี่ หรือ",
+  "agentDetail.configure.files.upload.failed": "อัปโหลดไฟล์ไม่สำเร็จ",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "อัปโหลดไฟล์เดียว",
+  "agentDetail.configure.files.upload.success": "อัปโหลดไฟล์แล้ว",
+  "agentDetail.configure.files.upload.title": "อัปโหลดไฟล์",
+  "agentDetail.configure.knowledgeRetrieval.add": "เพิ่มการดึงความรู้",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "เพิ่มความรู้",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "คลิกปุ่ม “+” เพื่อเพิ่มความรู้",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "ความรู้",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "การตั้งค่าการดึงข้อมูล",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "เรียนรู้เพิ่มเติมเกี่ยวกับการดึงความรู้",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "อัตโนมัติ",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "เงื่อนไข",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "ปิดใช้งาน",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "การกรองข้อมูลเมตา",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "ด้วยตนเอง",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "เลือกโหมดการกรองข้อมูลเมตา",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "ชื่อการดึงความรู้",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "ตัวแทนเป็นผู้ตัดสินใจ",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "ตัวแทนจะเขียนคิวรีของตัวเองจากพรอมต์และบริบทที่มีอยู่ ไม่ต้องตั้งค่าใด ๆ ที่นี่",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "คิวรีกำหนดเอง",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "เขียนคิวรีคงที่สำหรับแหล่งดึงข้อมูลนี้",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "ข้อความคิวรีกำหนดเอง",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "พิมพ์คิวรีการค้นหา",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "คิวรี",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "การดึงความรู้ · ตัวแทนเป็นผู้ตัดสินใจ",
+  "agentDetail.configure.knowledgeRetrieval.edit": "แก้ไข {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "เชื่อมต่อฐานความรู้ที่ตัวแทนสามารถค้นหาได้ขณะตอบคำถาม",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "ยังไม่มีความรู้",
+  "agentDetail.configure.knowledgeRetrieval.label": "การดึงความรู้",
+  "agentDetail.configure.knowledgeRetrieval.remove": "ลบ {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "แหล่งดึงความรู้ที่ตัวแทนนี้สามารถใช้ได้ขณะจัดการงาน",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "สลับการดึงความรู้",
+  "agentDetail.configure.model.label": "โมเดล",
+  "agentDetail.configure.orchestrate": "การจัดการ",
+  "agentDetail.configure.preview.chatFeatures": "ฟีเจอร์แชท",
+  "agentDetail.configure.preview.empty.defaultAgentName": "ตัวแทน",
+  "agentDetail.configure.preview.empty.description": "ส่งข้อความเพื่อทดสอบฉบับร่างปัจจุบัน",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "ยังไม่มีคำสั่ง ดังนั้นการตอบกลับจะมาจากโมเดลพื้นฐาน",
+  "agentDetail.configure.preview.endUserAuth": "การยืนยันตัวตนของผู้ใช้ปลายทาง",
+  "agentDetail.configure.preview.restart": "เริ่มการแสดงตัวอย่างใหม่",
+  "agentDetail.configure.preview.title": "แสดงตัวอย่าง",
+  "agentDetail.configure.prompt.copied": "คัดลอกพรอมต์แล้ว",
+  "agentDetail.configure.prompt.copy": "คัดลอกพรอมต์",
+  "agentDetail.configure.prompt.copyFailed": "คัดลอกพรอมต์ไม่สำเร็จ",
+  "agentDetail.configure.prompt.insert.label": "แทรก",
+  "agentDetail.configure.prompt.insert.question": "เริ่มคำถาม",
+  "agentDetail.configure.prompt.insert.reportFile": "ไฟล์รายงานเอาต์พุต",
+  "agentDetail.configure.prompt.insert.tenders": "เริ่มการประมูล",
+  "agentDetail.configure.prompt.label": "พรอมต์",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "กล่าวถึง",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "เขียนคำสั่งที่นี่,",
+  "agentDetail.configure.prompt.tip": "กำหนดวิธีที่ตัวแทนนี้ตีความอินพุต เรียกใช้เครื่องมือ และสร้างเอาต์พุต",
+  "agentDetail.configure.publishBar.draft": "ฉบับร่าง",
+  "agentDetail.configure.publishBar.publishUpdate": "เผยแพร่อัปเดต",
+  "agentDetail.configure.publishBar.published": "เผยแพร่แล้ว",
+  "agentDetail.configure.publishBar.publishedAt": "เผยแพร่เมื่อ {{time}}",
+  "agentDetail.configure.publishBar.publishing": "กำลังเผยแพร่…",
+  "agentDetail.configure.publishBar.saved": "บันทึกเมื่อ 5 นาทีที่แล้ว",
+  "agentDetail.configure.publishBar.savedAt": "บันทึกเมื่อ {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "การเปลี่ยนแปลงที่ยังไม่ได้เผยแพร่",
+  "agentDetail.configure.publishBar.upToDate": "เป็นเวอร์ชันล่าสุด",
+  "agentDetail.configure.publishBar.versionHistory": "เปิดประวัติเวอร์ชัน",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "เวิร์กโฟลว์ที่ได้รับผลกระทบ",
+  "agentDetail.configure.publishImpact.cancel": "ยกเลิก",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "ตัวแทนของคุณปรากฏอยู่ใน",
+  "agentDetail.configure.publishImpact.descriptionSuffix": " การเปลี่ยนแปลงจะส่งผลกระทบต่อสิ่งเหล่านั้น",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "ตัวแทนนี้",
+  "agentDetail.configure.publishImpact.title": "{{action}}ไปยัง {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "เวิร์กโฟลว์ {{count}} รายการ",
+  "agentDetail.configure.publishImpact.workflowCount_other": "เวิร์กโฟลว์ {{count}} รายการ",
+  "agentDetail.configure.skills.add": "เพิ่มทักษะ",
+  "agentDetail.configure.skills.detail.contentRegion": "เนื้อหารายละเอียดทักษะ",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} ไฟล์",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "ไฟล์ทักษะ",
+  "agentDetail.configure.skills.detail.files": "ไฟล์",
+  "agentDetail.configure.skills.empty.description": "ทักษะให้ตัวแทนมีความเชี่ยวชาญที่นำกลับมาใช้ใหม่ได้ซึ่งสามารถเรียกใช้ได้ขณะทำงาน",
+  "agentDetail.configure.skills.empty.title": "ยังไม่มีทักษะ",
+  "agentDetail.configure.skills.itemType": "ทักษะ",
+  "agentDetail.configure.skills.label": "ทักษะ",
+  "agentDetail.configure.skills.remove": "ลบ {{name}}",
+  "agentDetail.configure.skills.tip": "ทักษะที่ตัวแทนนี้สามารถใช้ได้ขณะจัดการงาน",
+  "agentDetail.configure.skills.toggle": "สลับทักษะ",
+  "agentDetail.configure.skills.upload.action": "อัปโหลด",
+  "agentDetail.configure.skills.upload.browse": "เรียกดู",
+  "agentDetail.configure.skills.upload.description": "อัปโหลดแพ็กเกจ .zip หรือ .skill สำหรับตัวแทนนี้",
+  "agentDetail.configure.skills.upload.dropzone": "วางแพ็กเกจทักษะที่นี่ หรือ",
+  "agentDetail.configure.skills.upload.failed": "อัปโหลดทักษะไม่สำเร็จ",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "อัปโหลดไฟล์ .zip หรือ .skill",
+  "agentDetail.configure.skills.upload.success": "อัปโหลดทักษะแล้ว",
+  "agentDetail.configure.skills.upload.title": "อัปโหลดทักษะ",
+  "agentDetail.configure.tools.add": "เพิ่มเครื่องมือ",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "สำหรับนักพัฒนา",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "ติดตั้งโปรแกรมคำสั่งบรรทัดที่ตัวแทนรันในแซนด์บ็อกซ์ ต้องติดตั้งและมักต้องการ API Key",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "เครื่องมือ CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "เลือกเครื่องมือที่มีอยู่แล้วในเวิร์กสเปซนี้ เช่น การค้นหาเว็บหรือการผสานรวม",
+  "agentDetail.configure.tools.addMenu.tool.label": "เครื่องมือ",
+  "agentDetail.configure.tools.cliDialog.description": "ติดตั้งเครื่องมือ CLI จากแพ็กเกจรีจิสตรีใด ๆ ตัวแทนจะได้รับสิทธิ์เข้าถึงเชลล์ของไบนารีที่มีให้",
+  "agentDetail.configure.tools.cliDialog.editTitle": "แก้ไขเครื่องมือ CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "จัดเก็บคีย์ API โทเค็น หรือความลับที่เครื่องมือ CLI นี้ต้องการ ค่าจะถูกเข้ารหัสขณะจัดเก็บ และฉีดเป็นตัวแปรสภาพแวดล้อมเมื่อตัวแทนเรียกใช้เครื่องมือ",
+  "agentDetail.configure.tools.cliDialog.env.label": "ตัวแปรสภาพแวดล้อม",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(ตัวเลือก)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "รันในแซนด์บ็อกซ์ · รันหนึ่งครั้งเมื่อเรียกใช้ครั้งแรก",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "คำสั่งติดตั้ง",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "วางคำสั่งติดตั้งของคุณที่นี่ เช่น npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "ต้องระบุคำสั่งติดตั้ง",
+  "agentDetail.configure.tools.cliDialog.learnMore": "เรียนรู้เพิ่มเติมเกี่ยวกับเครื่องมือ CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "ชื่อเครื่องมือ CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "ตั้งชื่อเครื่องมือ CLI ของคุณ",
+  "agentDetail.configure.tools.cliDialog.name.required": "ต้องระบุชื่อเครื่องมือ CLI",
+  "agentDetail.configure.tools.cliDialog.securityTip": "ไม่ปรากฏในพรอมต์ของตัวแทน ฉีดเป็น $VAR ขณะรันไทม์เท่านั้น",
+  "agentDetail.configure.tools.cliDialog.title": "เพิ่มเครื่องมือ CLI",
+  "agentDetail.configure.tools.cliTool": "เครื่องมือ CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "ผู้ใช้ปลายทาง · OAuth",
+  "agentDetail.configure.tools.editAction": "แก้ไข {{name}}",
+  "agentDetail.configure.tools.empty.description": "เครื่องมือช่วยให้ตัวแทนสามารถดำเนินการได้ เช่น ค้นหาเว็บหรือเรียกใช้แอปของคุณ",
+  "agentDetail.configure.tools.empty.title": "ยังไม่มีเครื่องมือ",
+  "agentDetail.configure.tools.label": "เครื่องมือ",
+  "agentDetail.configure.tools.moreActions": "การกระทำเพิ่มเติมสำหรับ {{name}}",
+  "agentDetail.configure.tools.pluginType": "ปลั๊กอิน",
+  "agentDetail.configure.tools.preAuthorize": "อนุญาตล่วงหน้า",
+  "agentDetail.configure.tools.removeAction": "ลบ {{name}}",
+  "agentDetail.configure.tools.removeProvider": "ลบเครื่องมือทั้งหมด",
+  "agentDetail.configure.tools.tip": "เครื่องมือที่ตัวแทนนี้สามารถเรียกใช้ได้ขณะจัดการงาน",
+  "agentDetail.configure.tools.toggle": "สลับเครื่องมือ",
+  "agentDetail.configure.tools.toolTabs.all": "ทั้งหมด",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "กำหนดเอง",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "ปลั๊กอิน",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "ตัวแทน",
+  "agentDetail.history": "ประวัติ",
+  "agentDetail.logs.description": "บันทึกแบบเต็มจะบันทึกสถานะการทำงานของแอปพลิเคชัน รวมถึงอินพุตของผู้ใช้ การตอบกลับของตัวแทน การวางแผน และการใช้เครื่องมือ",
+  "agentDetail.logs.empty": "ไม่พบบันทึก",
+  "agentDetail.logs.filters.period.allTime": "ตลอดเวลา",
+  "agentDetail.logs.filters.period.label": "ช่วงเวลาบันทึก",
+  "agentDetail.logs.filters.period.last30days": "30 วันที่ผ่านมา",
+  "agentDetail.logs.filters.period.last7days": "7 วันที่ผ่านมา",
+  "agentDetail.logs.filters.search.label": "ค้นหาบันทึก",
+  "agentDetail.logs.filters.search.placeholder": "ค้นหา",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "เวลาสร้างล่าสุด",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "เวลาอัปเดตล่าสุด",
+  "agentDetail.logs.filters.source.all": "แหล่งที่มา",
+  "agentDetail.logs.filters.source.empty": "ไม่พบแหล่งที่มา",
+  "agentDetail.logs.filters.source.label": "แหล่งที่มาของบันทึก",
+  "agentDetail.logs.filters.source.loadFailed": "โหลดแหล่งที่มาไม่สำเร็จ",
+  "agentDetail.logs.filters.source.loading": "กำลังโหลดแหล่งที่มา…",
+  "agentDetail.logs.filters.source.searchLabel": "ค้นหาแหล่งที่มา",
+  "agentDetail.logs.filters.source.searchPlaceholder": "ค้นหา",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "เวิร์กโฟลว์",
+  "agentDetail.logs.learnMore": "เรียนรู้เพิ่มเติม",
+  "agentDetail.logs.loadFailed": "โหลดบันทึกไม่สำเร็จ",
+  "agentDetail.logs.loading": "กำลังโหลดบันทึก…",
+  "agentDetail.logs.notAvailable": "ไม่มีข้อมูล",
+  "agentDetail.logs.table.createdTime": "เวลาที่สร้าง",
+  "agentDetail.logs.table.endUser": "ผู้ใช้ปลายทาง",
+  "agentDetail.logs.table.messageCount": "จำนวนข้อความ",
+  "agentDetail.logs.table.operationRate": "อัตราการดำเนินการ",
+  "agentDetail.logs.table.source": "แหล่งที่มา",
+  "agentDetail.logs.table.title": "ชื่อเรื่อง",
+  "agentDetail.logs.table.unread": "ยังไม่ได้อ่าน",
+  "agentDetail.logs.table.updatedTime": "เวลาที่อัปเดต",
+  "agentDetail.logs.table.userRate": "อัตราผู้ใช้",
+  "agentDetail.logs.title": "บันทึก",
+  "agentDetail.memorySettings.budgetLabel": "งบประมาณหน่วยความจำ",
+  "agentDetail.memorySettings.description": "การตั้งค่าหน่วยความจำจากสแนปช็อตการกำหนดค่าที่ใช้งานอยู่",
+  "agentDetail.memorySettings.export.description": "การส่งออกหน่วยความจำมีกำหนดในรุ่นต่อ ๆ ไป",
+  "agentDetail.memorySettings.export.download": "ดาวน์โหลด",
+  "agentDetail.memorySettings.export.soon": "เร็ว ๆ นี้",
+  "agentDetail.memorySettings.export.title": "ส่งออกหน่วยความจำปัจจุบัน",
+  "agentDetail.memorySettings.notConfigured": "ไม่ได้กำหนดค่า",
+  "agentDetail.memorySettings.scopeLabel": "ขอบเขตหน่วยความจำ",
+  "agentDetail.memorySettings.title": "หน่วยความจำ",
+  "agentDetail.metadata.activeVersionLabel": "เวอร์ชันที่ใช้งานอยู่",
+  "agentDetail.metadata.appIdLabel": "App ID",
+  "agentDetail.metadata.description": "ฟิลด์ Roster แบบอ่านอย่างเดียวที่ส่งคืนโดยแบ็กเอนด์ของตัวแทน",
+  "agentDetail.metadata.emptyValue": "ไม่พร้อมใช้งาน",
+  "agentDetail.metadata.scopeLabel": "ขอบเขต",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "เฉพาะเวิร์กโฟลว์",
+  "agentDetail.metadata.sourceLabel": "แหล่งที่มา",
+  "agentDetail.metadata.statusLabel": "สถานะ",
+  "agentDetail.metadata.title": "ข้อมูลเมตา",
+  "agentDetail.metadata.updatedAtLabel": "อัปเดตเมื่อ",
+  "agentDetail.metadata.workflowIdLabel": "Workflow ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "Workflow Node ID",
+  "agentDetail.monitoring.change": "{{value}} จากช่วงก่อนหน้า",
+  "agentDetail.monitoring.dateRangeLabel": "ช่วงวันที่",
+  "agentDetail.monitoring.description": "ติดตามกิจกรรม ค่าใช้จ่าย และคุณภาพการโต้ตอบของตัวแทนที่นำกลับมาใช้ใหม่ในเวิร์กโฟลว์ต่าง ๆ",
+  "agentDetail.monitoring.learnMore": "เรียนรู้เพิ่มเติม",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "ผู้ใช้ปลายทางที่ไม่ซ้ำกันซึ่งทริกเกอร์เวิร์กโฟลว์โดยใช้ตัวแทนนี้",
+  "agentDetail.monitoring.metrics.activeUsers.title": "ผู้ใช้ที่ใช้งานอยู่",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "จำนวนการสื่อสารต่อเนื่องระหว่างผู้ใช้กับตัวแทนสำหรับจุดเข้าถึงนี้",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "การโต้ตอบต่อเซสชันเฉลี่ย",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "ความเร็วเอาต์พุตเฉลี่ยตั้งแต่เริ่มต้นคำขอจนถึงเสร็จสิ้น",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "ความเร็วเอาต์พุตโทเค็น",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "ค่าใช้จ่ายโทเค็นโดยประมาณที่สร้างโดยตัวแทนนี้ในการรันเวิร์กโฟลว์",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "การใช้โทเค็น",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "บทสนทนา AI รายวันที่ไปถึงตัวแทนนี้ผ่านจุดเข้าถึงที่เลือก",
+  "agentDetail.monitoring.metrics.totalConversations.title": "บทสนทนาทั้งหมด",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "จำนวนการโต้ตอบของตัวแทนรายวัน",
+  "agentDetail.monitoring.metrics.totalMessages.title": "ข้อความทั้งหมด",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "จำนวนไลก์ต่อ 1,000 ข้อความสำหรับตัวแทนนี้",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "อัตราความพึงพอใจของผู้ใช้",
+  "agentDetail.monitoring.pickSource": "เลือกแอป",
+  "agentDetail.monitoring.sourceLabel": "แอป",
+  "agentDetail.monitoring.sourceTrigger": "แหล่งที่มา {{name}}",
+  "agentDetail.monitoring.sources.all": "ทั้งหมด",
+  "agentDetail.monitoring.timeRangeLabel": "ช่วงเวลา",
+  "agentDetail.monitoring.timeRanges.custom": "กำหนดเอง",
+  "agentDetail.monitoring.timeRanges.last30days": "30 วันที่ผ่านมา",
+  "agentDetail.monitoring.timeRanges.last7days": "7 วันที่ผ่านมา",
+  "agentDetail.monitoring.timeRanges.today": "วันนี้",
+  "agentDetail.monitoring.title": "การมอนิเตอร์",
+  "agentDetail.monitoring.tokenUsageConsumed": "โทเค็นที่ใช้",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "การนำทางตัวแทน",
+  "agentDetail.publish": "เผยแพร่",
+  "agentDetail.publishSoon": "เร็ว ๆ นี้",
+  "agentDetail.sections.access": "จุดเข้าถึง",
+  "agentDetail.sections.configure": "การจัดการ",
+  "agentDetail.sections.logs": "บันทึก",
+  "agentDetail.sections.monitoring": "การมอนิเตอร์",
+  "agentDetail.subtitle": "ID ตัวแทน: {{agentId}}",
+  "agentDetail.title": "ตัวแทน",
+  "agentDetail.type": "ตัวแทน",
+  "agentDetail.versionHistory.active": "ใช้งานอยู่",
+  "agentDetail.versionHistory.empty": "ยังไม่มีเวอร์ชัน",
+  "agentDetail.versionHistory.filter": "กรองเวอร์ชัน",
+  "agentDetail.versionHistory.versionName": "เวอร์ชัน {{version}}",
+  "roster.createAgent": "สร้างตัวแทน",
+  "roster.createAgentOptions": "ตัวเลือกการสร้างตัวแทน",
+  "roster.createDialog.description": "สร้างตัวแทนที่นำกลับมาใช้ใหม่ได้ใน Roster ของเวิร์กสเปซนี้",
+  "roster.createDialog.title": "สร้างตัวแทน",
+  "roster.createForm.changeIcon": "เปลี่ยนไอคอนตัวแทน",
+  "roster.createForm.descriptionLabel": "คำอธิบาย",
+  "roster.createForm.descriptionOptional": "(ตัวเลือก)",
+  "roster.createForm.descriptionPlaceholder": "เช่น รวบรวมแหล่งข้อมูลในหัวข้อหนึ่งและสรุปผลสำคัญ",
+  "roster.createForm.nameLabel": "ชื่อ",
+  "roster.createForm.namePlaceholder": "เช่น Max",
+  "roster.createForm.nameRequired": "ต้องระบุชื่อ",
+  "roster.createForm.roleLabel": "บทบาท",
+  "roster.createForm.rolePlaceholder": "เช่น ผู้ช่วยวิจัย",
+  "roster.createForm.roleRequired": "ต้องระบุบทบาท",
+  "roster.createSuccess": "สร้างตัวแทนแล้ว",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "ตัวแทนนี้จะถูกลบออกจากรายการ Roster ที่ใช้งานอยู่",
+  "roster.deleteDialog.title": "ลบ {{name}} หรือไม่",
+  "roster.deleteFailed": "ลบตัวแทนไม่สำเร็จ",
+  "roster.deleteSuccess": "ลบตัวแทนแล้ว",
+  "roster.duplicateFailed": "ทำสำเนาตัวแทนไม่สำเร็จ",
+  "roster.duplicateSuccess": "ทำสำเนาตัวแทนแล้ว",
+  "roster.editAgent": "แก้ไข {{name}}",
+  "roster.editDialog.description": "อัปเดตชื่อ คำอธิบาย และบทบาทใน Roster สำหรับตัวแทนนี้",
+  "roster.editDialog.title": "แก้ไขตัวแทน",
+  "roster.editInfo": "แก้ไขข้อมูล",
+  "roster.empty": "ยังไม่มีตัวแทน",
+  "roster.emptyDescription": "ตัวแทนที่บันทึกไว้ในเวิร์กสเปซนี้จะปรากฏที่นี่",
+  "roster.emptySearch": "ไม่มีตัวแทนที่ตรงกัน",
+  "roster.emptySearchDescription": "ลองใช้ชื่อตัวแทนอื่น",
+  "roster.filters.all": "ทั้งหมด",
+  "roster.filters.drafts": "ฉบับร่าง",
+  "roster.filters.label": "ตัวกรองตัวแทน",
+  "roster.filters.published": "เผยแพร่แล้ว",
+  "roster.learnMore": "เรียนรู้เพิ่มเติมเกี่ยวกับ Agent Roster",
+  "roster.listLabel": "รายชื่อ Roster ตัวแทน",
+  "roster.loadMore": "โหลดเพิ่มเติม",
+  "roster.loadingError": "โหลดตัวแทนไม่สำเร็จ รีเฟรชและลองอีกครั้ง",
+  "roster.moreActions": "การกระทำเพิ่มเติมสำหรับ {{name}}",
+  "roster.nodeSelector.createInlineFailed": "สร้างตัวแทนแบบอินไลน์ไม่สำเร็จ รีเฟรชและลองอีกครั้ง",
+  "roster.nodeSelector.dialogLabel": "เลือกตัวแทน",
+  "roster.nodeSelector.manageInAgentConsole": "จัดการใน Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "ค้นหา…",
+  "roster.nodeSelector.startFromScratch": "เริ่มต้นจากศูนย์",
+  "roster.references.label": "เวิร์กโฟลว์ที่ใช้ {{name}}",
+  "roster.references.trigger": "เวิร์กโฟลว์ที่ใช้ {{name}}",
+  "roster.searchLabel": "ค้นหาตัวแทน",
+  "roster.searchPlaceholder": "ค้นหาตัวแทนตามชื่อ…",
+  "roster.sources.agent_app": "แอปตัวแทน",
+  "roster.sources.imported": "นำเข้า",
+  "roster.sources.system": "ระบบ",
+  "roster.sources.workflow": "เวิร์กโฟลว์",
+  "roster.status.active": "ใช้งานอยู่",
+  "roster.status.archived": "เก็บถาวรแล้ว",
+  "roster.tabs.agent": "ตัวแทน",
+  "roster.tabs.human": "บุคคล",
+  "roster.tabsLabel": "ประเภท Roster",
+  "roster.updateSuccess": "อัปเดตตัวแทนแล้ว",
+  "roster.usageStatus.draft": "ฉบับร่าง"
+}
diff --git a/web/i18n/th-TH/app-log.json b/web/i18n/th-TH/app-log.json
index b85e6d81fc8..3a099363ad3 100644
--- a/web/i18n/th-TH/app-log.json
+++ b/web/i18n/th-TH/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "วันนี้",
   "filter.period.yearToDate": "ปีจนถึงปัจจุบัน",
   "filter.sortBy": "เมืองสีดํา:",
+  "monitoring.description": "การมอนิเตอร์บันทึกสถานะการทำงานของแอปพลิเคชัน รวมถึงประสิทธิภาพ กิจกรรมผู้ใช้ และค่าใช้จ่าย",
   "promptLog": "บันทึกพร้อมท์",
   "runDetail.fileListDetail": "รายละเอียด",
   "runDetail.fileListLabel": "รายละเอียดไฟล์",
diff --git a/web/i18n/th-TH/billing.json b/web/i18n/th-TH/billing.json
index 98b54e2ef34..f33294b0f45 100644
--- a/web/i18n/th-TH/billing.json
+++ b/web/i18n/th-TH/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "อัปเกรดเพื่อปลดล็อกการอัปโหลดเอกสารเป็นชุด",
   "upgrade.uploadMultiplePages.description": "คุณได้ถึงขีดจำกัดการอัปโหลดแล้ว — สามารถเลือกและอัปโหลดเอกสารได้เพียงไฟล์เดียวต่อครั้งในแผนปัจจุบันของคุณ",
   "upgrade.uploadMultiplePages.title": "อัปเกรดเพื่ออัปโหลดเอกสารหลายฉบับพร้อมกัน",
+  "upgrade.workflowRestore.description": "การกู้คืนเวอร์ชันเวิร์กโฟลว์ไม่พร้อมใช้งานในแผนปัจจุบันของคุณ",
+  "upgrade.workflowRestore.title": "อัปเกรดเพื่อกู้คืนเวอร์ชันเวิร์กโฟลว์",
   "upgradeBtn.encourage": "อัปเกรดเดี๋ยวนี้",
   "upgradeBtn.encourageShort": "อัพ เกรด",
   "upgradeBtn.plain": "แผนการอัปเกรด",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index 0384ca8c4de..89776e7e116 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "สลับพื้นที่ทำงาน",
   "mcpPage.description": "เชื่อมต่อและจัดการเซิร์ฟเวอร์ MCP เพื่อให้แอปของคุณเข้าถึงเครื่องมือและบริการภายนอกได้",
-  "members.admin": "ผู้ดูแลระบบ",
   "members.adminTip": "สามารถสร้างแอพและจัดการการตั้งค่าทีมได้",
+  "members.alreadyInTeam": "อยู่ในทีมแล้ว",
+  "members.alreadyInTeamTip": "ผู้ใช้เหล่านี้มีสิทธิ์เข้าถึงพื้นที่ทำงานนี้อยู่แล้ว",
   "members.builder": "ผู้สร้าง",
   "members.builderTip": "สามารถสร้างและแก้ไขแอปของตัวเองได้",
-  "members.datasetOperator": "ผู้ดูแลระบบความรู้",
   "members.datasetOperatorTip": "สามารถจัดการฐานความรู้ได้เท่านั้น",
   "members.deleteMember": "ลบสมาชิก",
   "members.disInvite": "ยกเลิกคําเชิญ",
-  "members.editor": "บรรณาธิการ",
   "members.editorTip": "สามารถสร้างและแก้ไขแอปได้",
   "members.email": "อีเมล",
   "members.emailInvalid": "รูปแบบอีเมลไม่ถูกต้อง",
@@ -270,13 +269,12 @@
   "members.invite": "เพิ่ม",
   "members.inviteTeamMember": "เพิ่มสมาชิกในทีม",
   "members.inviteTeamMemberTip": "พวกเขาสามารถเข้าถึงข้อมูลทีมของคุณได้โดยตรงหลังจากลงชื่อเข้าใช้",
-  "members.invitedAsRole": "ได้รับเชิญให้เป็นผู้ใช้ {{role}}",
+  "members.invitedAsRole": "ได้รับเชิญให้เป็น {{role}}",
   "members.lastActive": "ใช้งานล่าสุด",
   "members.name": "ชื่อ",
-  "members.normal": "ปกติ",
+  "members.noNewInvitationsSent": "ไม่มีการส่งคำเชิญใหม่",
   "members.normalTip": "ใช้ได้เฉพาะแอพ สร้างแอพไม่ได้",
   "members.ok": "ตกลง, ได้",
-  "members.owner": "เจ้าของ",
   "members.pending": "รอ   ",
   "members.removeFromTeam": "ลบออกจากทีม",
   "members.removeFromTeamTip": "จะลบการเข้าถึงของทีม",
@@ -311,12 +309,14 @@
   "menus.apps": "สตูดิโอ",
   "menus.datasets": "ความรู้",
   "menus.datasetsTips": "เร็ว ๆ นี้: นําเข้าข้อมูลข้อความของคุณเองหรือเขียนข้อมูลแบบเรียลไทม์ผ่าน Webhook เพื่อปรับปรุงบริบท LLM",
+  "menus.deployments": "การปรับใช้",
   "menus.explore": "สํารวจ",
   "menus.exploreMarketplace": "สํารวจ Marketplace",
   "menus.newApp": "แอพใหม่",
   "menus.newDataset": "สร้างความรู้",
   "menus.plugins": "การผสานรวม",
   "menus.pluginsTips": "รวมการผสานรวมของบุคคลที่สามหรือสร้างการผสานรวม AI ที่เข้ากันได้กับ ChatGPT",
+  "menus.roster": "รายชื่อตัวแทน",
   "menus.status": "Beta",
   "menus.tools": "เครื่อง มือ",
   "model.addMoreModel": "ไปที่การตั้งค่าเพื่อเพิ่มรุ่นเพิ่มเติม",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "โมเดลการแปลงข้อความเป็นคําพูด",
   "modelProvider.ttsModel.tip": "ตั้งค่าโมเดลเริ่มต้นสําหรับการป้อนข้อมูลเป็นข้อความเป็นคําพูดในการสนทนา",
   "modelProvider.upgradeForLoadBalancing": "อัปเกรดแผนของคุณเพื่อเปิดใช้งานการปรับสมดุลโหลด",
+  "navigation.skipToMain": "ข้ามไปยังเนื้อหาหลัก",
   "noData": "ไม่มีข้อมูล",
   "operation.add": "เพิ่ม",
   "operation.added": "เพิ่ม",
@@ -600,9 +601,6 @@
   "placeholder.input": "กรุณากรอก",
   "placeholder.search": "ค้นหา...",
   "placeholder.select": "กรุณาเลือก",
-  "plugin.serpapi.apiKey": "คีย์ API",
-  "plugin.serpapi.apiKeyPlaceholder": "ป้อนคีย์ API ของคุณ",
-  "plugin.serpapi.keyFrom": "รับคีย์ SerpAPI ของคุณจากหน้าบัญชี SerpAPI",
   "promptEditor.context.item.desc": "แทรกเทมเพลตบริบท",
   "promptEditor.context.item.title": "บริบท",
   "promptEditor.context.modal.add": "เพิ่มบริบท",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
new file mode 100644
index 00000000000..0f3d06073df
--- /dev/null
+++ b/web/i18n/th-TH/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API บริการแบ็คเอนด์",
+  "access.api.copyCurlExample": "คัดลอกตัวอย่าง cURL",
+  "access.api.createFailed": "ไม่สามารถสร้าง API Token ได้",
+  "access.api.createKey": "สร้าง API Token",
+  "access.api.createKeyTitle": "สร้าง API Token ใหม่",
+  "access.api.curlExampleTitle": "ตัวอย่าง cURL",
+  "access.api.description": "เข้าถึงการปรับใช้นี้ผ่าน HTTP API Token แต่ละตัวจะถูกกำหนดขอบเขตให้กับสภาพแวดล้อมเดียว",
+  "access.api.developerTitle": "API สำหรับนักพัฒนา",
+  "access.api.disabled": "การเข้าถึง API ถูกปิดสำหรับการปรับใช้นี้",
+  "access.api.disabledHint": "เปิดใช้งานการเข้าถึง API เพื่อสร้างโทเค็นที่กำหนดขอบเขตตามสภาพแวดล้อม",
+  "access.api.dismissToken": "ปิด API Token",
+  "access.api.docs": "เอกสาร API",
+  "access.api.docsClose": "ปิดเอกสาร API",
+  "access.api.docsDescription": "ดูเอกสารอ้างอิง API ของ Workflow สำหรับการปรับใช้นี้",
+  "access.api.docsTitle": "เอกสาร API ของ Workflow",
+  "access.api.empty": "ปรับใช้กับสภาพแวดล้อมก่อนเพื่อเริ่มสร้าง API Token",
+  "access.api.emptyTitle": "ไม่มีสภาพแวดล้อมที่ปรับใช้แล้ว",
+  "access.api.endpoint": "URL ของคำขอ",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "รายการ API Token",
+  "access.api.nameLabel": "ชื่อ API Token",
+  "access.api.namePlaceholder": "ป้อนชื่อ API Token",
+  "access.api.nameRequired": "ต้องระบุชื่อ API Token",
+  "access.api.newKey": "สร้าง API Token ใหม่",
+  "access.api.newTokenDescription": "API Token นี้จะแสดงเพียงครั้งเดียวเท่านั้น คัดลอกก่อนออกจากหน้านี้",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "สร้าง API Token แล้ว",
+  "access.api.noKeys": "ยังไม่มี API Token สร้างขึ้นเพื่อเริ่มเรียกใช้ API",
+  "access.api.noKeysTitle": "ยังไม่มี API Token",
+  "access.api.revokeConfirmDescription": "API Token \"{{name}}\" จะหยุดทำงานทันที การดำเนินการนี้ไม่สามารถยกเลิกได้",
+  "access.api.revokeConfirmTitle": "เพิกถอน API Token?",
+  "access.api.revokeFailed": "ไม่สามารถเพิกถอน API Token ได้",
+  "access.api.revokeSuccess": "เพิกถอน API Token แล้ว",
+  "access.api.table.action": "การดำเนินการ",
+  "access.api.table.environment": "สภาพแวดล้อม",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "ชื่อ",
+  "access.api.title": "API",
+  "access.channels.col.channel": "ช่องทาง",
+  "access.channels.col.endpoint": "จุดเข้าใช้งาน",
+  "access.channels.col.status": "สถานะ",
+  "access.channels.description": "จุดเข้าใช้งาน WebApp และ CLI ใช้สิทธิ์การเข้าถึงด้านบน",
+  "access.channels.disabled": "ช่องทางการเข้าถึงถูกปิดสำหรับการปรับใช้นี้",
+  "access.channels.disabledHint": "เปิดใช้งานช่องทางการเข้าถึงเพื่อเปิดเผยจุดเข้าใช้งาน WebApp และ CLI",
+  "access.channels.followPermission": "ปฏิบัติตามสิทธิ์",
+  "access.channels.title": "ช่องทางการเข้าถึง",
+  "access.cli.description": "เรียกใช้จากเทอร์มินัลด้วย difyctl เหมาะสำหรับสคริปต์ เวิร์กโฟลว์อัตโนมัติ หรือการรวม Agent",
+  "access.cli.docs": "คู่มือการใช้งาน",
+  "access.cli.domain": "โดเมน",
+  "access.cli.empty": "ไม่ได้กำหนดค่าจุดเชื่อมต่อ CLI",
+  "access.cli.install": "ติดตั้ง CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "คัดลอกแล้ว",
+  "access.copy": "คัดลอก",
+  "access.copyFailed": "การคัดลอกล้มเหลว",
+  "access.copyToast": "คัดลอกไปยังคลิปบอร์ดแล้ว",
+  "access.hide": "ซ่อน",
+  "access.members.clearAll": "ล้างทั้งหมด",
+  "access.members.empty": "ไม่พบรายการที่ตรงกัน",
+  "access.members.groupCount_one": "{{count}} กลุ่ม",
+  "access.members.groupCount_other": "{{count}} กลุ่ม",
+  "access.members.groups": "กลุ่ม",
+  "access.members.individuals": "สมาชิก",
+  "access.members.memberCount_one": "{{count}} สมาชิก",
+  "access.members.memberCount_other": "{{count}} สมาชิก",
+  "access.members.pickPlaceholder": "เลือกกลุ่มหรือสมาชิก",
+  "access.members.searchPlaceholder": "ค้นหากลุ่มและสมาชิก",
+  "access.members.selectedLabel": "เลือกแล้ว",
+  "access.permission.anyone": "ใครก็ตามที่มีลิงก์",
+  "access.permission.anyoneDesc": "ใครก็ตามสามารถเข้าถึงการปรับใช้นี้ได้โดยไม่ต้องเข้าสู่ระบบ",
+  "access.permission.memberCount_one": "{{count}} สมาชิก",
+  "access.permission.memberCount_other": "{{count}} สมาชิก",
+  "access.permission.organization": "สมาชิกทั้งหมดในแพลตฟอร์ม",
+  "access.permission.organizationDesc": "สมาชิกทั้งหมดในแพลตฟอร์ม",
+  "access.permission.specific": "สมาชิกที่ระบุในแพลตฟอร์ม",
+  "access.permission.specificDesc": "เลือกกลุ่มหรือสมาชิกที่ระบุ",
+  "access.permission.specificUnavailable": "การเลือกสมาชิกแบบเฉพาะถูกปิดใช้งานจนกว่าจะมีการเชื่อมต่อสมาชิกและกลุ่มจริงในแพลตฟอร์ม",
+  "access.permission.updateFailed": "ไม่สามารถอัปเดตนโยบายการเข้าถึงได้",
+  "access.permissions.col.environment": "สภาพแวดล้อม",
+  "access.permissions.col.permission": "การเข้าถึง",
+  "access.permissions.description": "ตั้งค่าสิทธิ์การเข้าถึงสำหรับจุดเข้าใช้งาน WebApp และ CLI ในแต่ละสภาพแวดล้อม",
+  "access.permissions.editAriaLabel": "กำหนดค่าการเข้าถึงสำหรับ {{environment}}",
+  "access.permissions.editDescription": "ตั้งค่าสิทธิ์การเข้าถึงสำหรับจุดเข้าใช้งาน WebApp และ CLI",
+  "access.permissions.editTitle": "สิทธิ์การเข้าถึง",
+  "access.permissions.title": "สิทธิ์การเข้าถึง",
+  "access.revoke": "เพิกถอน",
+  "access.runAccess.description": "จัดการวิธีที่ผู้ใช้สามารถเรียกใช้การปรับใช้นี้และผู้ที่ได้รับอนุญาตให้เข้าถึงในแต่ละสภาพแวดล้อม",
+  "access.runAccess.disabled": "การเข้าถึงการเรียกใช้ถูกปิดสำหรับการปรับใช้นี้",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "เปิดเผยการปรับใช้นี้เป็นเซิร์ฟเวอร์ MCP",
+  "access.runAccess.mcpEmpty": "ไม่ได้กำหนดค่าจุดเชื่อมต่อ MCP",
+  "access.runAccess.noEnvs": "ปรับใช้กับสภาพแวดล้อมเพื่อกำหนดค่าสิทธิ์การเข้าถึง",
+  "access.runAccess.noEnvsTitle": "ไม่มีสภาพแวดล้อมที่ปรับใช้แล้ว",
+  "access.runAccess.openWebapp": "เปิด WebApp",
+  "access.runAccess.permissions": "สิทธิ์การเข้าถึง",
+  "access.runAccess.permissionsDesc": "ใครสามารถเข้าถึงการปรับใช้นี้ในแต่ละสภาพแวดล้อม",
+  "access.runAccess.title": "การเข้าถึงการเรียกใช้",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "หน้าเว็บที่โฮสต์สำหรับผู้ใช้ปลายทาง",
+  "access.runAccess.webappEmpty": "เร็ว ๆ นี้",
+  "access.show": "แสดง",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "ภายนอก",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "ไม่ทราบ",
+  "card.access.api": "API Tokens",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "ไม่มีการเข้าถึง",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "สร้างรีลีสแรก",
+  "card.deploy": "ปรับใช้",
+  "card.deploying": "{{count}} กำลังปรับใช้",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} ล้มเหลว",
+  "card.fromApp": "จาก {{name}}",
+  "card.lastDeployed": "ปรับใช้ครั้งล่าสุด {{time}}",
+  "card.menu.delete": "ลบการปรับใช้",
+  "card.menu.deleteDisabled": "การลบการปรับใช้ยังไม่สามารถใช้ได้สำหรับการปรับใช้ที่จัดการโดยแบ็คเอนด์",
+  "card.menu.deploy": "ปรับใช้กับสภาพแวดล้อม",
+  "card.menu.editInfo": "แก้ไขข้อมูล",
+  "card.menu.viewDetail": "ดูรายละเอียดการปรับใช้",
+  "card.moreActions": "การดำเนินการเพิ่มเติม",
+  "card.neverDeployed": "ยังไม่ได้ปรับใช้",
+  "card.noDescription": "ไม่มีคำอธิบาย",
+  "card.notDeployed": "ยังไม่ได้ปรับใช้",
+  "card.ready": "{{count}} กำลังทำงาน",
+  "card.tooltip.createdAt": "สร้างเมื่อ",
+  "card.tooltip.deployed": "ปรับใช้แล้ว",
+  "card.tooltip.deploymentStatus": "การปรับใช้",
+  "card.tooltip.notDeployed": "การปรับใช้นี้ยังไม่ได้ปรับใช้กับสภาพแวดล้อมใด ๆ",
+  "card.tooltip.notDeployedShort": "ยังไม่ได้ปรับใช้",
+  "card.tooltip.release": "รีลีส",
+  "card.tooltip.releaseName": "ชื่อรีลีส",
+  "card.tooltip.source": "แหล่งที่มา",
+  "common.loadFailed": "โหลดล้มเหลว ลองอีกครั้งในภายหลัง",
+  "common.loading": "กำลังโหลด...",
+  "createGuide.actions.back": "ย้อนกลับ",
+  "createGuide.actions.cancel": "ยกเลิก",
+  "createGuide.actions.continue": "ดำเนินการต่อ",
+  "createGuide.actions.createAndDeploy": "สร้างและปรับใช้",
+  "createGuide.actions.creating": "กำลังสร้าง...",
+  "createGuide.actions.deploy": "ปรับใช้",
+  "createGuide.actions.deploying": "กำลังสร้างและปรับใช้...",
+  "createGuide.actions.next": "ถัดไป",
+  "createGuide.actions.skipDeploy": "ข้าม ปรับใช้ภายหลัง",
+  "createGuide.description": "สร้างการปรับใช้จากแหล่งรีลีส ข้อมูลพื้นฐาน และสภาพแวดล้อมเป้าหมาย",
+  "createGuide.dsl.defaultAppName": "แอปที่นำเข้าจาก DSL",
+  "createGuide.dsl.description": "อัปโหลดแพ็คเกจ Workflow DSL เพื่อสร้างการปรับใช้ รีลีสแรก และการปรับใช้สภาพแวดล้อมเสริม",
+  "createGuide.dsl.dropDescription": "อัปโหลดแพ็คเกจ Workflow YAML DSL ตัวเลือกการปรับใช้จะถูกแก้ไขจากไฟล์นี้ก่อนการปรับใช้",
+  "createGuide.dsl.dropTitle": "อัปโหลดแพ็คเกจ Workflow DSL",
+  "createGuide.dsl.readFailed": "ไม่สามารถอ่านไฟล์ DSL ได้ เลือกไฟล์อื่นและลองอีกครั้ง",
+  "createGuide.dsl.reading": "กำลังอ่านไฟล์ DSL...",
+  "createGuide.dsl.title": "นำเข้า DSL",
+  "createGuide.dsl.unsupportedMode": "สามารถใช้เฉพาะไฟล์ Workflow DSL สำหรับการปรับใช้",
+  "createGuide.errors.createReleaseFailed": "ไม่สามารถสร้างการปรับใช้หรือรีลีสได้",
+  "createGuide.errors.deployFailed": "ไม่สามารถปรับใช้กับสภาพแวดล้อมได้",
+  "createGuide.method.description": "เลือกแหล่งที่ใช้สำหรับสร้างรีลีสแรก",
+  "createGuide.methods.bindApp.description": "ใช้ Workflow App ที่มีอยู่ใน Studio เป็นแหล่งรีลีส",
+  "createGuide.methods.bindApp.title": "ผูกกับ Workflow App ที่มีอยู่",
+  "createGuide.methods.importDsl.description": "อัปโหลดแพ็คเกจ Workflow YAML DSL และดำเนินการต่อผ่าน UI การปรับใช้",
+  "createGuide.methods.importDsl.title": "นำเข้า DSL",
+  "createGuide.methods.mocked": "จำลอง",
+  "createGuide.nav.back": "การปรับใช้",
+  "createGuide.release.defaultName": "รีลีสเริ่มต้น",
+  "createGuide.release.deployInfo": "ข้อมูลการปรับใช้",
+  "createGuide.release.description": "กรอกข้อมูลการปรับใช้และรายละเอียดของรีลีสแรก",
+  "createGuide.release.firstVersion": "รีลีสแรก",
+  "createGuide.release.instanceDescription": "คำอธิบายการปรับใช้",
+  "createGuide.release.instanceDescriptionPlaceholder": "อธิบายว่าการปรับใช้นี้ใช้สำหรับอะไร",
+  "createGuide.release.instanceName": "ชื่อการปรับใช้",
+  "createGuide.release.instanceNameConflict": "มีการปรับใช้ที่มีชื่อนี้อยู่แล้ว เลือกชื่ออื่น",
+  "createGuide.release.releaseDescription": "คำอธิบายรีลีส",
+  "createGuide.release.releaseDescriptionPlaceholder": "อธิบายรีลีสนี้",
+  "createGuide.release.releaseName": "ชื่อรีลีส",
+  "createGuide.release.releaseNote": "คำอธิบายรีลีส",
+  "createGuide.release.title": "ข้อมูลพื้นฐาน",
+  "createGuide.source.availableApps_one": "{{count}} แอป",
+  "createGuide.source.availableApps_other": "{{count}} แอป",
+  "createGuide.source.clearSearch": "ล้างการค้นหาแอป",
+  "createGuide.source.description": "เลือกแหล่งที่ใช้สำหรับสร้างรีลีสแรก",
+  "createGuide.source.empty": "ไม่พบ Workflow App",
+  "createGuide.source.searchPlaceholder": "ค้นหาแอป",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "แหล่งรีลีส",
+  "createGuide.steps.method": "แหล่งรีลีส",
+  "createGuide.steps.release": "ข้อมูลพื้นฐาน",
+  "createGuide.steps.source": "แหล่งรีลีส",
+  "createGuide.steps.target": "ปรับใช้กับสภาพแวดล้อม",
+  "createGuide.target.bindingCount_one": "{{count}} การผูก",
+  "createGuide.target.bindingCount_other": "{{count}} การผูก",
+  "createGuide.target.bindingHint": "เลือกข้อมูลรับรองที่รีลีสนี้ใช้",
+  "createGuide.target.bindings": "ข้อมูลรับรอง",
+  "createGuide.target.deferredBindingHint": "ข้อมูลรับรองจะถูกแก้ไขจากแผนการปรับใช้จริงในระหว่างการดำเนินการปรับใช้สุดท้าย",
+  "createGuide.target.deferredEnvironmentHint": "ชื่อนี้จะถูกจับคู่กับสภาพแวดล้อมจริงหลังจากสร้างการปรับใช้และรีลีสแล้ว",
+  "createGuide.target.description": "เลือกสภาพแวดล้อมเป้าหมายและระบุการตั้งค่ารันไทม์ที่รีลีสนี้ต้องการ ขั้นตอนนี้สามารถข้ามได้",
+  "createGuide.target.envVarCount_one": "{{count}} ตัวแปร",
+  "createGuide.target.envVarCount_other": "{{count}} ตัวแปร",
+  "createGuide.target.envVarHint": "สำหรับแต่ละตัวแปรสภาพแวดล้อมที่รีลีสนี้ต้องการ ป้อนค่าที่กำหนดเองหรือใช้ค่าที่กำหนดในแอป",
+  "createGuide.target.envVarPlaceholder": "ป้อนค่า",
+  "createGuide.target.envVarSource.ariaLabel": "เลือกแหล่งค่าของตัวแปรสำหรับ {{key}}",
+  "createGuide.target.envVarSource.default": "ค่าของแอป",
+  "createGuide.target.envVarSource.lastDeployment": "ค่าที่ปรับใช้ครั้งล่าสุด",
+  "createGuide.target.envVarSource.literal": "ค่าที่กำหนดเอง",
+  "createGuide.target.envVarType.number": "ตัวเลข",
+  "createGuide.target.envVarType.secret": "ความลับ",
+  "createGuide.target.envVarType.string": "ข้อความ",
+  "createGuide.target.envVars": "ตัวแปรสภาพแวดล้อม",
+  "createGuide.target.environment": "สภาพแวดล้อมเป้าหมาย",
+  "createGuide.target.environmentName": "ชื่อสภาพแวดล้อม",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "ไม่สามารถโหลดข้อมูลรับรองได้",
+  "createGuide.target.loadEnvironmentsFailed": "ไม่สามารถโหลดสภาพแวดล้อมการปรับใช้ได้",
+  "createGuide.target.missingRequiredBinding": "เลือกข้อมูลรับรองสำหรับการผูกที่จำเป็นนี้",
+  "createGuide.target.noBindingRequired": "ไม่จำเป็นต้องใช้ข้อมูลรับรอง",
+  "createGuide.target.noCredentialCandidates": "ไม่มีข้อมูลรับรองที่ใช้ได้",
+  "createGuide.target.noEnvironmentOptions": "ไม่มีสภาพแวดล้อมการปรับใช้",
+  "createGuide.target.required": "จำเป็น",
+  "createGuide.target.selectCredential": "เลือกข้อมูลรับรอง",
+  "createGuide.target.title": "ปรับใช้กับสภาพแวดล้อม",
+  "createGuide.title": "การปรับใช้ใหม่",
+  "createModal.appPickerPlaceholder": "เลือก Workflow App",
+  "createModal.appSearchEmpty": "ไม่พบ Workflow App ที่ตรงกัน",
+  "createModal.appSearchPlaceholder": "ค้นหา Workflow App…",
+  "createModal.cancel": "ยกเลิก",
+  "createModal.create": "สร้าง",
+  "createModal.createFailed": "ไม่สามารถสร้างการปรับใช้ได้",
+  "createModal.description": "เลือก Workflow App และสร้างการปรับใช้",
+  "createModal.descriptionLabel": "คำอธิบาย",
+  "createModal.descriptionPlaceholder": "อธิบายว่าการปรับใช้นี้ใช้สำหรับอะไร",
+  "createModal.loadMoreApps": "โหลดแอปเพิ่มเติม",
+  "createModal.loadingApps": "กำลังโหลดแอป…",
+  "createModal.nameLabel": "ชื่อการปรับใช้",
+  "createModal.namePlaceholder": "ชื่อการปรับใช้",
+  "createModal.noApps": "ไม่พบ Workflow App ในเวิร์กสเปซนี้ สร้างใน Studio ก่อน",
+  "createModal.selected": "เลือกแล้ว",
+  "createModal.sourceApp": "Workflow App (จำเป็น)",
+  "createModal.title": "การปรับใช้ใหม่",
+  "deployDrawer.bindingCount_one": "{{count}} การผูก",
+  "deployDrawer.bindingCount_other": "{{count}} การผูก",
+  "deployDrawer.bindingOptionsFailed": "ไม่สามารถโหลดตัวเลือกข้อมูลรับรองได้",
+  "deployDrawer.bindingSelectionHint": "เลือกข้อมูลรับรองที่ใช้โดยการปรับใช้นี้",
+  "deployDrawer.bindingsDisabled": "แก้ไขจากการแสดงตัวอย่างรีลีส ยังไม่สามารถแก้ไขได้",
+  "deployDrawer.cancel": "ยกเลิก",
+  "deployDrawer.close": "ปิดลิ้นชักการปรับใช้",
+  "deployDrawer.defaultSelect": "เลือก...",
+  "deployDrawer.deploy": "ปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.deployExistingRelease": "ปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.deployExistingReleaseDescription": "เลือกรีลีสและสภาพแวดล้อมเป้าหมายเพื่อปรับใช้",
+  "deployDrawer.deployExistingReleaseTitle": "ปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.deployFailed": "ไม่สามารถเริ่มการปรับใช้ได้",
+  "deployDrawer.deploying": "กำลังปรับใช้...",
+  "deployDrawer.description": "เลือกรีลีสและสภาพแวดล้อมเป้าหมายเพื่อปรับใช้",
+  "deployDrawer.envVarCount_one": "{{count}} ตัวแปร",
+  "deployDrawer.envVarCount_other": "{{count}} ตัวแปร",
+  "deployDrawer.envVarHint": "สำหรับแต่ละตัวแปรสภาพแวดล้อมที่รีลีสนี้ต้องการ ป้อนค่าที่กำหนดเองหรือใช้ค่าที่กำหนดในแอป",
+  "deployDrawer.envVarPlaceholder": "ป้อนค่า",
+  "deployDrawer.envVarSource.ariaLabel": "เลือกแหล่งค่าของตัวแปรสำหรับ {{key}}",
+  "deployDrawer.envVarSource.default": "ค่าของแอป",
+  "deployDrawer.envVarSource.lastDeployment": "ค่าที่ปรับใช้ครั้งล่าสุด",
+  "deployDrawer.envVarSource.literal": "ค่าที่กำหนดเอง",
+  "deployDrawer.envVarType.number": "ตัวเลข",
+  "deployDrawer.envVarType.secret": "ความลับ",
+  "deployDrawer.envVarType.string": "ข้อความ",
+  "deployDrawer.envVars": "ตัวแปรสภาพแวดล้อม",
+  "deployDrawer.existingReleaseHint": "รีลีสนี้จะถูกปรับใช้ตามที่เป็นอยู่ จะไม่มีการสร้างรีลีสใหม่",
+  "deployDrawer.loadingBindings": "กำลังแก้ไข...",
+  "deployDrawer.lockedHint": "ล็อกไว้ที่สภาพแวดล้อมปัจจุบัน",
+  "deployDrawer.missingRequiredBinding": "เลือกข้อมูลรับรองสำหรับการผูกที่จำเป็นนี้",
+  "deployDrawer.missingRequiredEnvVar": "ป้อนค่าสำหรับตัวแปรสภาพแวดล้อมที่จำเป็นนี้",
+  "deployDrawer.modelCreds": "ข้อมูลรับรองโมเดล",
+  "deployDrawer.needsValidation": " (ต้องตรวจสอบ)",
+  "deployDrawer.newReleaseHint": "จะมีการสร้างรีลีสใหม่จาก Workflow App YAML ที่เลือก",
+  "deployDrawer.noBindingRequired": "ไม่จำเป็น",
+  "deployDrawer.noCredentialCandidates": "ไม่มีข้อมูลรับรองที่ใช้ได้",
+  "deployDrawer.noNewEnvironmentAvailable": "สภาพแวดล้อมที่ใช้ได้ทั้งหมดมีการปรับใช้แล้ว",
+  "deployDrawer.noOtherReleaseAvailable": "ไม่มีรีลีสอื่นสำหรับสภาพแวดล้อมนี้",
+  "deployDrawer.noReleaseAvailable": "สร้างรีลีสก่อนปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.notFound": "ไม่พบการปรับใช้",
+  "deployDrawer.noteLabel": "คำอธิบายรีลีส (ไม่บังคับ)",
+  "deployDrawer.notePlaceholder": "เช่น ปรับปรุงข้อความ onboarding",
+  "deployDrawer.pluginCreds": "ข้อมูลรับรองปลั๊กอิน",
+  "deployDrawer.promote": "ปรับใช้",
+  "deployDrawer.promoteDescription": "เลือกรีลีสและสภาพแวดล้อมเป้าหมายเพื่อปรับใช้",
+  "deployDrawer.promoteTitle": "ปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.readOnly": "อ่านอย่างเดียว",
+  "deployDrawer.redeploy": "ปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.redeployDescription": "เลือกรีลีสและสภาพแวดล้อมเป้าหมายเพื่อปรับใช้",
+  "deployDrawer.redeployExistingReleaseHint": "รีลีสปัจจุบันจะถูกปรับใช้ใหม่ตามที่เป็นอยู่ จะไม่มีการสร้างรีลีสใหม่",
+  "deployDrawer.redeployTitle": "ปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.releaseLabel": "รีลีส",
+  "deployDrawer.requiredBinding": "จำเป็น",
+  "deployDrawer.rollback": "ปรับใช้",
+  "deployDrawer.rollbackDescription": "เลือกรีลีสและสภาพแวดล้อมเป้าหมายเพื่อปรับใช้",
+  "deployDrawer.rollbackTitle": "ปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.runtimeCredentials": "ข้อมูลรับรอง",
+  "deployDrawer.secretPlaceholder": "ความลับ",
+  "deployDrawer.selectCredential": "เลือกข้อมูลรับรอง",
+  "deployDrawer.selectEnv": "เลือกสภาพแวดล้อม",
+  "deployDrawer.selectProviderCred": "เลือกข้อมูลรับรอง {{provider}}",
+  "deployDrawer.selectProviderKey": "เลือกคีย์ {{provider}}",
+  "deployDrawer.selectRelease": "เลือกรีลีส",
+  "deployDrawer.targetEnv": "สภาพแวดล้อมเป้าหมาย",
+  "deployDrawer.title": "ปรับใช้กับสภาพแวดล้อม",
+  "deployDrawer.valuePlaceholder": "ค่า",
+  "deployTab.cancelDeployment": "ยกเลิกการปรับใช้",
+  "deployTab.closeError": "ปิด",
+  "deployTab.col.actions": "การดำเนินการ",
+  "deployTab.col.currentRelease": "รีลีสปัจจุบัน",
+  "deployTab.col.environment": "สภาพแวดล้อม",
+  "deployTab.col.status": "สถานะ",
+  "deployTab.col.updated": "อัปเดต",
+  "deployTab.collapseDetails": "ยุบรายละเอียดการปรับใช้",
+  "deployTab.confirmUndeploy": "ยกเลิกการปรับใช้",
+  "deployTab.deployOtherVersion": "ปรับใช้รีลีสอื่น",
+  "deployTab.deployToEnv": "ปรับใช้กับ {{name}}",
+  "deployTab.deployToNewEnv": "ปรับใช้กับสภาพแวดล้อมใหม่...",
+  "deployTab.empty": "ยังไม่มีอินสแตนซ์ ปรับใช้กับสภาพแวดล้อมใหม่เพื่อเริ่มต้น",
+  "deployTab.emptyDescription": "เลือกรีลีสและสภาพแวดล้อมเป้าหมายเพื่อทำให้การปรับใช้นี้พร้อมใช้งานสำหรับผู้ใช้",
+  "deployTab.emptyTitle": "ยังไม่มีสภาพแวดล้อมที่ทำงานอยู่",
+  "deployTab.envCount": "สภาพแวดล้อม",
+  "deployTab.errorCode": "รหัส",
+  "deployTab.errorDialogDesc": "ตรวจสอบการปรับใช้ที่ล้มเหลวล่าสุดก่อนลองใหม่หรือปรับใช้รีลีสอื่น",
+  "deployTab.errorDialogTitle": "ข้อผิดพลาดในการปรับใช้ใน {{name}}",
+  "deployTab.errorMessage": "ข้อความ",
+  "deployTab.errorPhase": "ระยะ",
+  "deployTab.expandDetails": "ขยายรายละเอียดการปรับใช้",
+  "deployTab.moreActions": "การดำเนินการเพิ่มเติม",
+  "deployTab.newDeployment": "ปรับใช้กับสภาพแวดล้อมใหม่",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "ID การปรับใช้",
+  "deployTab.panel.endpoints": "จุดเชื่อมต่อ",
+  "deployTab.panel.envVars": "ตัวแปรสภาพแวดล้อม",
+  "deployTab.panel.error": "ข้อผิดพลาด",
+  "deployTab.panel.failedRelease": "รีลีสที่ล้มเหลว",
+  "deployTab.panel.health": "สุขภาพ",
+  "deployTab.panel.instanceInfo": "ข้อมูลอินสแตนซ์",
+  "deployTab.panel.modelCreds": "ข้อมูลรับรองโมเดล",
+  "deployTab.panel.pluginCreds": "ข้อมูลรับรองปลั๊กอิน",
+  "deployTab.panel.release": "รีลีส",
+  "deployTab.panel.releaseCreatedAt": "รีลีสสร้างเมื่อ",
+  "deployTab.panel.releaseInfo": "ข้อมูลรีลีส",
+  "deployTab.panel.replicas": "เรพลิกา",
+  "deployTab.panel.run": "เรียกใช้",
+  "deployTab.panel.runtimeBindings": "ข้อมูลรับรอง",
+  "deployTab.panel.runtimeInfo": "ข้อมูลรันไทม์",
+  "deployTab.panel.runtimeMode": "โหมดรันไทม์",
+  "deployTab.panel.runtimeNote": "หมายเหตุรันไทม์",
+  "deployTab.panel.targetRelease": "รีลีสเป้าหมาย",
+  "deployTab.panel.unknownError": "การปรับใช้ล้มเหลว",
+  "deployTab.promote": "ปรับใช้",
+  "deployTab.redeploy": "ปรับใช้ใหม่",
+  "deployTab.releaseCreatedAt": "รีลีสสร้างเมื่อ {{time}}",
+  "deployTab.retry": "ลองอีกครั้ง",
+  "deployTab.shortcut": "ทางลัด",
+  "deployTab.status.deployFailed": "การปรับใช้ล้มเหลว",
+  "deployTab.status.deployingRelease": "กำลังปรับใช้ ({{release}})",
+  "deployTab.status.runningOutOfSync": "กำลังทำงาน (รอการซิงค์)",
+  "deployTab.status.runningWithFailed": "กำลังทำงาน (การปรับใช้ครั้งล่าสุดล้มเหลว)",
+  "deployTab.undeploy": "ยกเลิกการปรับใช้",
+  "deployTab.undeployConfirmDesc": "การเข้าถึงของผู้ใช้ปลายทางจะหยุดทันที สามารถปรับใช้รีลีสใหม่ได้ภายหลัง",
+  "deployTab.undeployConfirmTitle": "ยกเลิกการปรับใช้จาก {{name}}?",
+  "deployTab.undeployFrom": "ยกเลิกการปรับใช้จาก {{name}}",
+  "deployTab.undeployImpactTitle": "อินสแตนซ์ที่ได้รับผลกระทบ",
+  "deployTab.viewError": "ดูข้อผิดพลาด",
+  "deployTab.viewLogs": "ดูบันทึก",
+  "deployTab.viewProgress": "ดูความคืบหน้า",
+  "detail.backToInstances": "กลับไปยังการปรับใช้",
+  "detail.deployingCount": "{{count}} กำลังปรับใช้",
+  "detail.envCount_one": "{{count}} env",
+  "detail.envCount_other": "{{count}} env",
+  "detail.failedCount": "{{count}} ล้มเหลว",
+  "detail.mobileTabs": "ส่วนการปรับใช้",
+  "detail.notFound": "ไม่พบการปรับใช้",
+  "detail.openSourceApp": "เปิดแหล่งที่มา {{name}}",
+  "detail.sourceApp": "แหล่งที่มา",
+  "detail.sourceAppLink": "แหล่งที่มา",
+  "documentTitle.create": "การปรับใช้ใหม่ · การปรับใช้",
+  "documentTitle.detail": "การปรับใช้ · การปรับใช้",
+  "documentTitle.list": "การปรับใช้",
+  "filter.allEnvs": "สภาพแวดล้อมทั้งหมด",
+  "filter.notDeployed": "ยังไม่ได้ปรับใช้",
+  "filter.searchPlaceholder": "ค้นหาการปรับใช้",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "การรับเข้า",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "กำลังเริ่มต้น",
+  "health.ENVIRONMENT_STATUS_DELETING": "กำลังลบ",
+  "health.ENVIRONMENT_STATUS_FAILED": "ไม่พร้อมใช้งาน",
+  "health.ENVIRONMENT_STATUS_READY": "พร้อมใช้งาน",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "ไม่ทราบ",
+  "list.clearFilters": "ล้างตัวกรอง",
+  "list.clearSearch": "ล้างการค้นหาการปรับใช้",
+  "list.createDeployment": "ใหม่",
+  "list.empty": "ไม่พบการปรับใช้",
+  "list.emptyDescription": "สร้างการปรับใช้จาก Workflow App หรือแพ็คเกจ Workflow DSL เพื่อจัดการรีลีส สภาพแวดล้อม และการเข้าถึง",
+  "list.emptyFilteredDescription": "ไม่มีการปรับใช้ที่ตรงกับการค้นหาหรือตัวกรองสภาพแวดล้อมปัจจุบัน",
+  "list.emptyFilteredTitle": "ไม่มีการปรับใช้ที่ตรงกัน",
+  "list.emptyTitle": "ยังไม่มีการปรับใช้",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "แยก",
+  "mode.ENVIRONMENT_MODE_SHARED": "ใช้ร่วมกัน",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "ไม่ทราบ",
+  "newInstance.comingSoon": "เร็ว ๆ นี้",
+  "newInstance.fromStudio": "เลือกจาก Studio",
+  "newInstance.importDSL": "นำเข้า DSL",
+  "newInstance.title": "การปรับใช้ใหม่",
+  "overview.accessEndpoints": "จุดเชื่อมต่อการเข้าถึง",
+  "overview.accessMeta.apiTokens": "จัดการ API Tokens",
+  "overview.accessMeta.cli": "ดูการเข้าถึง CLI",
+  "overview.accessMeta.webApp": "จัดการการเข้าถึง WebApp",
+  "overview.accessStatus": "การเข้าถึง",
+  "overview.api": "API Tokens",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Tokens",
+  "overview.apiTokenSummary.environments_one": "{{count}} สภาพแวดล้อมที่ปรับใช้แล้ว",
+  "overview.apiTokenSummary.environments_other": "{{count}} สภาพแวดล้อมที่ปรับใช้แล้ว",
+  "overview.availableForDeployment": "พร้อมสำหรับการปรับใช้",
+  "overview.basicInfo": "ข้อมูลพื้นฐาน",
+  "overview.cardAction.deployLatest": "ปรับใช้รีลีสล่าสุด",
+  "overview.cardAction.redeploy": "ปรับใช้ใหม่",
+  "overview.cardAction.viewProgress": "ดูการปรับใช้",
+  "overview.chip.behindTooltip_one": "ล้าหลังรีลีสล่าสุด 1 รีลีส ปรับใช้รีลีสล่าสุดเพื่ออัปเดต",
+  "overview.chip.behindTooltip_other": "ล้าหลังรีลีสล่าสุด {{count}} รีลีส ปรับใช้รีลีสล่าสุดเพื่ออัปเดต",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "กำลังปรับใช้",
+  "overview.chip.deployingTooltip": "การปรับใช้กำลังดำเนินการ",
+  "overview.chip.empty": "ว่าง",
+  "overview.chip.emptyTooltip": "ไม่มีรีลีสที่ปรับใช้กับสภาพแวดล้อมนี้",
+  "overview.chip.failed": "ล้มเหลว",
+  "overview.chip.failedTooltip": "ความพยายามในการปรับใช้ล่าสุดล้มเหลว",
+  "overview.chip.latest": "ล่าสุด",
+  "overview.chip.latestTooltip": "สภาพแวดล้อมนี้กำลังใช้งานรีลีสล่าสุด",
+  "overview.chip.needsReleaseFirst": "สร้างรีลีสก่อน",
+  "overview.chip.olderRelease": "เก่ากว่า",
+  "overview.chip.olderReleaseTooltip": "สภาพแวดล้อมนี้กำลังใช้งานรีลีสที่เก่ากว่า",
+  "overview.chip.openInDeployTab": "ดูความคืบหน้าของการปรับใช้",
+  "overview.cli": "CLI",
+  "overview.configured": "กำหนดค่าแล้ว",
+  "overview.createRelease": "สร้างรีลีส",
+  "overview.created": "สร้างเมื่อ",
+  "overview.deploy": "ปรับใช้",
+  "overview.deployedEnvironments": "ปรับใช้แล้ว",
+  "overview.deploymentOverview": "ภาพรวมการปรับใช้",
+  "overview.deploymentStatus": "สถานะการปรับใช้",
+  "overview.description": "คำอธิบาย",
+  "overview.developerApi": "API สำหรับนักพัฒนา",
+  "overview.disabled": "ปิดใช้งาน",
+  "overview.emptyValue": "ไม่ได้ตั้งค่า",
+  "overview.enabled": "เปิดใช้งาน",
+  "overview.enabledChannels": "เปิดใช้งานการเข้าถึง",
+  "overview.endUserAccess": "การเข้าถึงของผู้ใช้ปลายทาง",
+  "overview.environments": "สภาพแวดล้อม",
+  "overview.hero.byName": "โดย {{name}}",
+  "overview.hero.empty": "ยังไม่มีรีลีส",
+  "overview.hero.emptyDescription": "สร้างรีลีสจากแหล่งที่มาปัจจุบันก่อนปรับใช้",
+  "overview.hero.propagation_one": "ปรับใช้กับ {{count}}/{{total}} สภาพแวดล้อม",
+  "overview.hero.propagation_other": "ปรับใช้กับ {{count}}/{{total}} สภาพแวดล้อม",
+  "overview.hero.untargeted": "ยังไม่มีการกำหนดค่าสภาพแวดล้อม",
+  "overview.instanceDetails": "รายละเอียดการปรับใช้",
+  "overview.instanceId": "ID การปรับใช้",
+  "overview.latestRelease.releaseCount_one": "{{count}} รีลีส",
+  "overview.latestRelease.releaseCount_other": "{{count}} รีลีส",
+  "overview.latestReleaseTitle": "รีลีสล่าสุด",
+  "overview.manageDeployments": "จัดการการปรับใช้",
+  "overview.name": "ชื่อ",
+  "overview.noAccessConfig": "ไม่มีการกำหนดค่าการเข้าถึง",
+  "overview.noReleaseYet": "สร้างรีลีสก่อนปรับใช้กับสภาพแวดล้อม",
+  "overview.notConfigured": "ยังไม่ได้กำหนดค่า",
+  "overview.previousReleases.empty": "ยังไม่มีรีลีสก่อนหน้า",
+  "overview.previousReleases.retired": "ไม่ได้ปรับใช้อยู่ในขณะนี้",
+  "overview.previousReleases.title": "รีลีสก่อนหน้า",
+  "overview.previousReleases.viewAll": "ดูทั้งหมด",
+  "overview.ready": "พร้อมปรับใช้",
+  "overview.recentReleases": "รีลีสล่าสุด",
+  "overview.releaseDeployedTitle": "{{release}} ถูกปรับใช้แล้ว",
+  "overview.releaseReadyTitle": "{{release}} พร้อมปรับใช้",
+  "overview.serviceMap": "แผนที่บริการ",
+  "overview.servingRelease": "ให้บริการ {{release}}",
+  "overview.servingReleaseDescription": "การปรับใช้นี้ถูกปรับใช้กับ {{count}}/{{total}} สภาพแวดล้อม",
+  "overview.strip.deployToNewEnvironment": "ปรับใช้กับสภาพแวดล้อมใหม่",
+  "overview.strip.empty": "ไม่มีสภาพแวดล้อมที่กำหนดค่า",
+  "overview.strip.emptyDeployableDescription": "ปรับใช้รีลีสล่าสุดกับสภาพแวดล้อมเมื่อคุณพร้อม",
+  "overview.strip.emptyDeployed": "ยังไม่มีอินสแตนซ์",
+  "overview.strip.emptyDescription": "สร้างรีลีสก่อนปรับใช้กับสภาพแวดล้อม",
+  "overview.strip.emptyTitle": "ยังไม่มีอินสแตนซ์",
+  "overview.strip.summary_one": "1 จาก {{total}} อยู่ในรีลีสล่าสุด",
+  "overview.strip.summary_other": "{{count}} จาก {{total}} อยู่ในรีลีสล่าสุด",
+  "overview.strip.title": "อินสแตนซ์",
+  "overview.switchSourceApp": "เปลี่ยนแหล่งที่มา",
+  "overview.switchSourceAppDescription": "เลือก Workflow App ที่ใช้เป็นแหล่งที่มาสำหรับรีลีสในอนาคต",
+  "overview.switchSourceAppHint": "หลังจากเปลี่ยนแล้ว เฉพาะรีลีสที่สร้างใหม่เท่านั้นที่ใช้แหล่งที่มาใหม่ รีลีสในอดีตและการปรับใช้ที่มีอยู่จะไม่ถูกเปลี่ยนแปลง",
+  "overview.targetRelease": "รีลีสเป้าหมาย",
+  "overview.webapp": "WebApp",
+  "settings.danger": "โซนอันตราย",
+  "settings.dangerDesc": "ลบการปรับใช้นี้อย่างถาวรและหยุดอินสแตนซ์ที่ทำงานอยู่ การดำเนินการนี้ไม่สามารถยกเลิกได้",
+  "settings.delete": "ลบการปรับใช้",
+  "settings.deleteConfirmDesc": "ลบ {{name}}? ทุกอินสแตนซ์จะหยุดทำงานและถูกลบในทุกสภาพแวดล้อม การดำเนินการนี้ไม่สามารถยกเลิกได้",
+  "settings.deleteConfirmTitle": "ลบการปรับใช้",
+  "settings.deleteFailed": "ไม่สามารถลบการปรับใช้ได้",
+  "settings.deleteImpact": "ผลกระทบ",
+  "settings.deleteImpactInstance": "การปรับใช้",
+  "settings.deleteImpactTitle": "การปรับใช้ที่ได้รับผลกระทบ",
+  "settings.deleteImpactValue": "การปรับใช้ถูกลบออกจากรายการการปรับใช้",
+  "settings.deleted": "ลบการปรับใช้แล้ว",
+  "settings.description": "คำอธิบาย",
+  "settings.descriptionHelp": "จัดการชื่อ คำอธิบาย และการตั้งค่าอื่น ๆ ของการปรับใช้นี้",
+  "settings.general": "ทั่วไป",
+  "settings.name": "ชื่อการปรับใช้",
+  "settings.reset": "รีเซ็ต",
+  "settings.save": "บันทึกการเปลี่ยนแปลง",
+  "settings.updateFailed": "ไม่สามารถอัปเดตการปรับใช้ได้",
+  "settings.updated": "อัปเดตการปรับใช้แล้ว",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "กำลังปรับใช้",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "รอการซิงค์",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "การปรับใช้ล้มเหลว",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "ไม่ถูกต้อง",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "กำลังทำงาน",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ยังไม่ได้ปรับใช้",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "กำลังยกเลิกการปรับใช้",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ไม่ทราบ",
+  "subtitle": "จัดการการปรับใช้ข้ามสภาพแวดล้อม",
+  "tabs.access.description": "จัดการช่องทางการเข้าถึงและสิทธิ์การเข้าถึง",
+  "tabs.access.name": "การเข้าถึง",
+  "tabs.api-tokens.description": "จัดการ API Tokens และเรียกใช้อินสแตนซ์ผ่าน HTTP",
+  "tabs.api-tokens.name": "API Tokens",
+  "tabs.instances.description": "ดูและจัดการอินสแตนซ์ในสภาพแวดล้อมที่ปรับใช้แล้ว",
+  "tabs.instances.name": "อินสแตนซ์",
+  "tabs.overview.description": "ดูสถานะการปรับใช้ข้ามสภาพแวดล้อม",
+  "tabs.overview.name": "ภาพรวม",
+  "tabs.releases.description": "สร้าง ปรับใช้ และจัดการรีลีส",
+  "tabs.releases.name": "รีลีส",
+  "tabs.settings.description": "จัดการชื่อ คำอธิบาย และการตั้งค่าอื่น ๆ ของการปรับใช้นี้",
+  "tabs.settings.name": "การตั้งค่า",
+  "title": "การปรับใช้",
+  "unsupportedDslNodes.description": "รีลีสนี้มีโหนดที่รันไทม์ของการปรับใช้ยังไม่รองรับ ลบหรือแทนที่ใน Studio แล้วลองอีกครั้ง",
+  "unsupportedDslNodes.descriptionWithTypes": "รีลีสนี้มีโหนดที่รันไทม์ของการปรับใช้ยังไม่รองรับ: {{nodeTypes}} ลบหรือแทนที่ใน Studio แล้วลองอีกครั้ง",
+  "unsupportedDslNodes.title": "โหนดที่ไม่รองรับ",
+  "unsupportedDslNodes.unknownType": "ประเภทที่ไม่ทราบ",
+  "versions.cancelCreate": "ยกเลิก",
+  "versions.cancelDelete": "ยกเลิก",
+  "versions.cancelEdit": "ยกเลิก",
+  "versions.checkingReleaseContent": "กำลังตรวจสอบเนื้อหารีลีส...",
+  "versions.col.action": "การดำเนินการ",
+  "versions.col.author": "สร้างโดย",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "สร้างเมื่อ",
+  "versions.col.deployedTo": "ปรับใช้กับ",
+  "versions.col.release": "รีลีส",
+  "versions.col.sourceApp": "แหล่งที่มา",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "สร้าง",
+  "versions.createFailed": "ไม่สามารถสร้างรีลีสได้",
+  "versions.createRelease": "สร้างรีลีส",
+  "versions.createReleaseDescription": "สร้างรีลีสที่ปรับใช้ได้จาก Workflow App หรือไฟล์ Workflow DSL",
+  "versions.createReleaseHint": "รีลีสใหม่สามารถปรับใช้กับสภาพแวดล้อมใดก็ได้",
+  "versions.createSuccess": "สร้างรีลีส \"{{name}}\" แล้ว",
+  "versions.creating": "กำลังสร้าง...",
+  "versions.currentOn": "รีลีสปัจจุบันใน {{name}}",
+  "versions.deleteConfirmDesc": "รีลีส \"{{name}}\" จะถูกลบอย่างถาวร การดำเนินการนี้ไม่สามารถยกเลิกได้",
+  "versions.deleteConfirmTitle": "ลบรีลีส?",
+  "versions.deleteFailed": "ไม่สามารถลบรีลีสได้",
+  "versions.deleteImpactDeployment": "สถานะการปรับใช้",
+  "versions.deleteImpactNotDeployed": "ไม่ได้ปรับใช้อยู่ในขณะนี้",
+  "versions.deleteImpactRelease": "รีลีส",
+  "versions.deleteImpactTitle": "ผลกระทบจากการลบ",
+  "versions.deleteRelease": "ลบรีลีส",
+  "versions.deleteSuccess": "ลบรีลีส \"{{name}}\" แล้ว",
+  "versions.deploy": "ปรับใช้",
+  "versions.deployTo": "ปรับใช้กับ {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "กำลังปรับใช้",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "รอการซิงค์",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "ล้มเหลว",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "ไม่ถูกต้อง",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "กำลังทำงาน",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ยังไม่ได้ปรับใช้",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "กำลังยกเลิกการปรับใช้",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ไม่ทราบ",
+  "versions.deployingTo": "{{name}} กำลังปรับใช้",
+  "versions.disabledReason.checkDeploymentsFailed": "ไม่สามารถตรวจสอบการใช้งานการปรับใช้ได้ ลองอีกครั้งในภายหลัง",
+  "versions.disabledReason.checkingDeployments": "กำลังตรวจสอบการใช้งานการปรับใช้",
+  "versions.disabledReason.current": "รีลีสนี้กำลังทำงานอยู่บน {{name}} แล้ว",
+  "versions.disabledReason.deploying": "รอให้การปรับใช้ที่กำลังดำเนินการเสร็จสิ้น",
+  "versions.disabledReason.envDisabled": "สภาพแวดล้อมนี้ไม่สามารถปรับใช้ได้",
+  "versions.disabledReason.releaseInUse_one": "ยกเลิกการปรับใช้รีลีสนี้จาก {{count}} สภาพแวดล้อมก่อนลบ",
+  "versions.disabledReason.releaseInUse_other": "ยกเลิกการปรับใช้รีลีสนี้จาก {{count}} สภาพแวดล้อมก่อนลบ",
+  "versions.dslReadFailed": "ไม่สามารถอ่านไฟล์ DSL ได้ เลือกไฟล์อื่นและลองอีกครั้ง",
+  "versions.dslReading": "กำลังอ่านไฟล์ DSL...",
+  "versions.dslUnsupportedMode": "สามารถใช้เฉพาะไฟล์ Workflow DSL สำหรับการปรับใช้",
+  "versions.editFailed": "ไม่สามารถอัปเดตรีลีสได้",
+  "versions.editRelease": "แก้ไขรีลีส",
+  "versions.editReleaseDescription": "อัปเดตชื่อและคำอธิบายของรีลีสนี้",
+  "versions.editSuccess": "อัปเดตรีลีส \"{{name}}\" แล้ว",
+  "versions.empty": "ยังไม่มีรีลีสที่ใช้งานได้",
+  "versions.emptyDescription": "สร้างรีลีสแรกก่อนปรับใช้กับสภาพแวดล้อม",
+  "versions.emptyTitle": "ยังไม่มีรีลีส",
+  "versions.emptyWithCreate": "ยังไม่มีรีลีส สร้างรีลีสที่ปรับใช้ได้รีลีสแรกก่อนปรับใช้",
+  "versions.exportDsl": "ส่งออก DSL",
+  "versions.exportDslFailed": "ไม่สามารถส่งออก DSL ได้",
+  "versions.exportingDsl": "กำลังส่งออก...",
+  "versions.groupHeader.deploy": "ปรับใช้",
+  "versions.groupHeader.promote": "ปรับใช้",
+  "versions.groupHeader.rollback": "ปรับใช้เวอร์ชันก่อนหน้า",
+  "versions.groupHeader.unavailable": "ไม่พร้อมใช้งาน",
+  "versions.manualDslOption": "อัปโหลด DSL",
+  "versions.moreActions": "การดำเนินการเพิ่มเติม",
+  "versions.optional": "ไม่บังคับ",
+  "versions.promote": "ปรับใช้",
+  "versions.promoteTo": "ปรับใช้กับ {{name}}",
+  "versions.releaseAlreadyExists": "มีรีลีสที่มีเนื้อหาเดียวกันอยู่แล้ว: {{name}}",
+  "versions.releaseContentCheckFailed": "ไม่สามารถตรวจสอบเนื้อหารีลีสได้",
+  "versions.releaseDescriptionLabel": "คำอธิบาย",
+  "versions.releaseDescriptionPlaceholder": "อธิบายรีลีสนี้",
+  "versions.releaseHistory": "ประวัติรีลีส",
+  "versions.releaseNameLabel": "ชื่อรีลีส",
+  "versions.releaseNamePlaceholder": "ชื่อรีลีส",
+  "versions.releaseNameRequired": "ป้อนชื่อรีลีส",
+  "versions.releaseSourceLabel": "แหล่งรีลีส",
+  "versions.rollbackTo": "ปรับใช้กับ {{name}}",
+  "versions.saveEdit": "บันทึก",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/th-TH/workflow.json b/web/i18n/th-TH/workflow.json
index bc9593ade00..5fc865471dc 100644
--- a/web/i18n/th-TH/workflow.json
+++ b/web/i18n/th-TH/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "ตัวแทน",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "ตอบ",
   "blocks.assigner": "ตัวกําหนดตัวแปร",
   "blocks.code": "รหัส",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "ตัวรวบรวมตัวแปร",
   "blocks.variable-assigner": "ตัวรวบรวมตัวแปร",
   "blocksAbout.agent": "การเรียกใช้โมเดลภาษาขนาดใหญ่เพื่อตอบคําถามหรือประมวลผลภาษาธรรมชาติ",
+  "blocksAbout.agent-v2": "การเรียกใช้โมเดลภาษาขนาดใหญ่เพื่อตอบคําถามหรือประมวลผลภาษาธรรมชาติ",
   "blocksAbout.answer": "กําหนดเนื้อหาการตอบกลับของการสนทนาแชท",
   "blocksAbout.assigner": "โหนดการกําหนดตัวแปรใช้สําหรับกําหนดค่าให้กับตัวแปรที่เขียนได้ (เช่นตัวแปรการสนทนา)",
   "blocksAbout.code": "เรียกใช้โค้ด Python หรือ NodeJS เพื่อใช้ตรรกะที่กําหนดเอง",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "รหัสเวิร์กโฟลว์",
   "globalVar.fieldsDescription.workflowRunId": "รหัสการรันเวิร์กโฟลว์",
   "globalVar.title": "ตัวแปรระบบ",
+  "nodes.agent.advancedSetting": "การตั้งค่าขั้นสูง",
   "nodes.agent.checkList.strategyNotSelected": "ไม่ได้เลือกกลยุทธ์",
   "nodes.agent.clickToViewParameterSchema": "คลิกเพื่อดูโครงร่างพารามิเตอร์",
   "nodes.agent.configureModel": "กําหนดค่าแบบจําลอง",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "รุ่นที่ไม่รองรับ",
   "nodes.agent.modelSelectorTooltips.deprecated": "โมเดลนี้เลิกใช้แล้ว",
   "nodes.agent.notAuthorized": "ไม่ได้รับอนุญาต",
+  "nodes.agent.outputVars.confirm": "ยืนยัน",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "กรอกอาร์เรย์ JSON",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "กรอก true หรือ false",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "ยังไม่สามารถกำหนดค่าเริ่มต้นของไฟล์ที่นี่ได้",
+  "nodes.agent.outputVars.defaultValueLabel": "ค่าเริ่มต้น",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "กรอกตัวเลขที่ถูกต้อง",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "กรอกอ็อบเจกต์ JSON",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "ค่าเริ่มต้น",
+  "nodes.agent.outputVars.delete": "ลบ {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "คำอธิบาย",
+  "nodes.agent.outputVars.descriptionPlaceholder": "เพิ่มคำอธิบาย",
+  "nodes.agent.outputVars.edit": "แก้ไข {{name}}",
+  "nodes.agent.outputVars.editorLabel": "ตัวแก้ไขตัวแปรเอาต์พุต",
   "nodes.agent.outputVars.files.title": "ไฟล์ที่สร้างตัวแทน",
   "nodes.agent.outputVars.files.transfer_method": "วิธีการโอน ค่าเป็น remote_url หรือ local_file",
   "nodes.agent.outputVars.files.type": "ประเภทการสนับสนุน ตอนนี้รองรับเฉพาะรูปภาพ",
   "nodes.agent.outputVars.files.upload_file_id": "อัปโหลดรหัสไฟล์",
   "nodes.agent.outputVars.files.url": "URL ของรูปภาพ",
   "nodes.agent.outputVars.json": "ตัวแทนสร้าง JSON",
+  "nodes.agent.outputVars.nameDuplicate": "ชื่อเอาต์พุตมีอยู่แล้ว",
+  "nodes.agent.outputVars.nameInvalid": "ใช้ตัวอักษร ตัวเลข และเครื่องหมายขีดล่าง เริ่มต้นด้วยตัวอักษรหรือเครื่องหมายขีดล่าง",
+  "nodes.agent.outputVars.nameLabel": "ชื่อฟิลด์",
+  "nodes.agent.outputVars.namePlaceholder": "ชื่อฟิลด์",
+  "nodes.agent.outputVars.newOutput": "เอาต์พุตใหม่",
+  "nodes.agent.outputVars.requiredLabel": "จำเป็น",
+  "nodes.agent.outputVars.showAdvancedOptions": "แสดงตัวเลือกขั้นสูง",
   "nodes.agent.outputVars.text": "เนื้อหาที่สร้างตัวแทน",
+  "nodes.agent.outputVars.typeLabel": "ประเภทเอาต์พุต",
   "nodes.agent.outputVars.usage": "ข้อมูลการใช้งานรุ่น",
   "nodes.agent.parameterSchema": "แบบจำลองพารามิเตอร์",
   "nodes.agent.pluginInstaller.install": "ติดตั้ง",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "การผสานรวมนี้ติดตั้งจาก GitHub โปรดไปที่การผสานรวมเพื่อติดตั้งใหม่",
   "nodes.agent.pluginNotInstalled": "ไม่ได้ติดตั้งการผสานรวมนี้",
   "nodes.agent.pluginNotInstalledDesc": "การผสานรวมนี้ติดตั้งจาก GitHub โปรดไปที่การผสานรวมเพื่อติดตั้งใหม่",
+  "nodes.agent.roster.change": "เปลี่ยน",
+  "nodes.agent.roster.editInConsole": "แก้ไขใน Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "การตั้งค่าครั้งเดียวที่อยู่เฉพาะในโหนดนี้",
+  "nodes.agent.roster.inlineSetup.name": "การตั้งค่าแบบอินไลน์",
+  "nodes.agent.roster.inlineSetup.title": "การตั้งค่า Agent",
+  "nodes.agent.roster.inlineSetup.type": "เฉพาะในโหนดนี้",
+  "nodes.agent.roster.label": "ตัวแทน",
+  "nodes.agent.roster.makeCopy": "สร้างสำเนา",
+  "nodes.agent.roster.more": "การกระทำเพิ่มเติมของ Agent",
+  "nodes.agent.roster.openPanel": "เปิดรายละเอียด {{name}}",
+  "nodes.agent.roster.panelLabel": "รายละเอียด {{name}}",
   "nodes.agent.strategy.configureTip": "โปรดกําหนดค่ากลยุทธ์เอเจนต์",
   "nodes.agent.strategy.configureTipDesc": "หลังจากกําหนดค่ากลยุทธ์ตัวแทนโหนดนี้จะโหลดการกําหนดค่าที่เหลือโดยอัตโนมัติ กลยุทธ์จะส่งผลต่อกลไกการให้เหตุผลของเครื่องมือหลายขั้นตอน",
   "nodes.agent.strategy.label": "กลยุทธ์ตัวแทน",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "เวอร์ชันการผสานรวมที่ติดตั้งไม่มีกลยุทธ์นี้ คลิกเพื่อเปลี่ยนเวอร์ชัน",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} ไม่ได้ติดตั้ง",
   "nodes.agent.strategyNotSet": "ไม่ได้ตั้งค่ากลยุทธ์ตัวแทน",
+  "nodes.agent.task.insert": "แทรก",
+  "nodes.agent.task.label": "งาน Agent",
+  "nodes.agent.task.mention": "กล่าวถึง",
+  "nodes.agent.task.placeholder": "อธิบายสิ่งที่ Agent นี้ควรทำ...",
+  "nodes.agent.task.tooltip": "กำหนดคำสั่งงานที่ Agent นี้ควรปฏิบัติตามในเวิร์กโฟลว์นี้",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} ไม่ได้รับอนุญาต",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} ไม่ได้ติดตั้ง",
   "nodes.agent.toolbox": "เครื่อง มือ",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "โดย {{author}}",
   "tabs.question-understand": "คําถาม: เข้าใจ",
   "tabs.requestToCommunity": "คำขอถึงชุมชน",
-  "tabs.searchBlock": "ค้นหาโหนด",
+  "tabs.searchBlock": "ค้นหาโหนด Agent บุคคล ความรู้",
   "tabs.searchDataSource": "ค้นหาแหล่งข้อมูล",
   "tabs.searchSnippets": "ตัวอย่างการค้นหา...",
   "tabs.searchTool": "เครื่องมือค้นหา",
diff --git a/web/i18n/tr-TR/agent-v-2.json b/web/i18n/tr-TR/agent-v-2.json
new file mode 100644
index 00000000000..6c307a360ef
--- /dev/null
+++ b/web/i18n/tr-TR/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Bu eylem henüz kullanılabilir değil.",
+  "agentDetail.access.actions.monitoring": "İzleme",
+  "agentDetail.access.copyAccessUrl": "Erişim URL'sini kopyala",
+  "agentDetail.access.copyFailed": "Referans kopyalanamadı.",
+  "agentDetail.access.copyReference": "{{name}} için referansı kopyala",
+  "agentDetail.access.copyServiceEndpoint": "Servis API uç noktasını kopyala",
+  "agentDetail.access.description": "Bu ajanın erişilebildiği her yüzey.",
+  "agentDetail.access.empty": "Bağlı erişim noktası yok",
+  "agentDetail.access.emptyDescription": "Bu Roster ajanının henüz bir uygulama veya iş akışı referansı yok.",
+  "agentDetail.access.entries.agentApp.description": "Bu Roster ajanına bağlı ajan uygulaması.",
+  "agentDetail.access.entries.agentApp.name": "Ajan uygulaması",
+  "agentDetail.access.entries.workflow.description": "Bu Roster ajanına bağlı iş akışı ve düğüm referansı.",
+  "agentDetail.access.entries.workflow.name": "İş akışı düğümü",
+  "agentDetail.access.entryCount_one": "{{count}} giriş",
+  "agentDetail.access.entryCount_other": "{{count}} giriş",
+  "agentDetail.access.groups.references.heading": "Referanslar",
+  "agentDetail.access.groups.references.label": "Bağlı referanslar",
+  "agentDetail.access.learnMore": "Daha fazla bilgi",
+  "agentDetail.access.moreActions": "{{name}} için daha fazla eylem",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Servis API Uç Noktası",
+  "agentDetail.access.serviceApi.title": "Arka uç servis API",
+  "agentDetail.access.status.disabled": "Devre Dışı",
+  "agentDetail.access.status.enabled": "Etkin",
+  "agentDetail.access.status.inService": "Hizmette",
+  "agentDetail.access.status.outOfService": "Hizmet Dışı",
+  "agentDetail.access.title": "Erişim Noktası",
+  "agentDetail.access.toggleSurface": "{{name}} erişimini değiştir",
+  "agentDetail.access.webApp.accessUrl": "Erişim URL'si",
+  "agentDetail.access.webApp.actions.customize": "Özelleştir",
+  "agentDetail.access.webApp.actions.embedded": "Gömülü",
+  "agentDetail.access.webApp.actions.launch": "Başlat",
+  "agentDetail.access.webApp.actions.settings": "Ayarlar",
+  "agentDetail.access.webApp.refreshUrl": "Erişim URL'sini yenile",
+  "agentDetail.access.webApp.showQrCode": "QR kodunu göster",
+  "agentDetail.access.webApp.ssoEnabled": "SSO Etkin",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "İş akışı içinde bir düğüm olarak kullanılır",
+  "agentDetail.access.workflow.empty": "Henüz iş akışı referansı yok.",
+  "agentDetail.access.workflow.loadFailed": "İş akışı referansları yüklenemedi.",
+  "agentDetail.access.workflow.loading": "İş akışı referansları yükleniyor…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} düğüm",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} düğüm",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Studio'da aç",
+  "agentDetail.access.workflow.openInStudioFor": "{{name}} öğesini Studio'da aç",
+  "agentDetail.access.workflow.table.actions": "Eylemler",
+  "agentDetail.access.workflow.table.lastUpdated": "Son güncelleme",
+  "agentDetail.access.workflow.table.name": "Ad",
+  "agentDetail.access.workflow.table.nodes": "Düğümler",
+  "agentDetail.access.workflow.table.version": "Sürüm",
+  "agentDetail.access.workflow.title": "İş akışı erişimi",
+  "agentDetail.configure.advancedSettings.description": "Güç kullanıcıları için. Çevre değişkenleri, sandbox ve bellek.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Çevre değişkeni ekle",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "{{key}} sil",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "{{key}} değerini gizle",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": ".env içe aktar",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Gizli .env dosyalarını göstermek için dosya seçicide Command + Shift + . tuşlarına basın.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": ".env dosyanız gizliyse, sisteminizin dosya seçicisinde gizli dosyaları etkinleştirin.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Gizli .env dosyalarını göstermek için Dosya Gezgini'nde Gizli öğeleri etkinleştirin.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "{{key}} değerini göster",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Çevre değişkeni kapsamını seç",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Bu ajan için çalışma zamanında kullanılabilen çevre değişkenleri.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Env Editor'ü değiştir",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Gelişmiş Ayarlar",
+  "agentDetail.configure.advancedSettings.toggle": "Gelişmiş ayarları değiştir",
+  "agentDetail.configure.chatFeatures.description": "Web app ve sohbet yüzeylerinizde son kullanıcı sohbet deneyimini şekillendirin.",
+  "agentDetail.configure.chatFeatures.title": "Sohbet Özellikleri",
+  "agentDetail.configure.files.add": "Dosya ekle",
+  "agentDetail.configure.files.empty.description": "Ajanın okuyabileceği belgeleri yükleyin, örneğin spesifikasyonlar, şablonlar veya yönergeler",
+  "agentDetail.configure.files.empty.title": "Henüz dosya yok",
+  "agentDetail.configure.files.label": "Dosyalar",
+  "agentDetail.configure.files.preview.empty": "Önizleme içeriği yok.",
+  "agentDetail.configure.files.preview.failed": "Önizleme yüklenemedi.",
+  "agentDetail.configure.files.preview.unsupported": "Bu dosya önizlemeyi desteklemiyor.",
+  "agentDetail.configure.files.remove": "{{name}} kaldır",
+  "agentDetail.configure.files.tip": "Bu ajanın görevleri koordine ederken kullanabileceği dosyalar.",
+  "agentDetail.configure.files.toggle": "Dosyaları değiştir",
+  "agentDetail.configure.files.treeLabel": "Ajan dosyaları",
+  "agentDetail.configure.files.upload.action": "Yükle",
+  "agentDetail.configure.files.upload.browse": "göz at",
+  "agentDetail.configure.files.upload.description": "Bu ajan için bir dosya yükleyin.",
+  "agentDetail.configure.files.upload.dropzone": "Buraya bir dosya bırakın veya",
+  "agentDetail.configure.files.upload.failed": "Dosya yüklenemedi.",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "Bir dosya yükleyin.",
+  "agentDetail.configure.files.upload.success": "Dosya yüklendi.",
+  "agentDetail.configure.files.upload.title": "Dosya yükle",
+  "agentDetail.configure.knowledgeRetrieval.add": "Bilgi geri alımı ekle",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Bilgi ekle",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Bilgi eklemek için “+” düğmesine tıklayın",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Bilgi",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Geri Alım Ayarı",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Bilgi geri alımı hakkında daha fazla bilgi",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Otomatik",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Koşullar",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Devre Dışı",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Metaveri Filtreleme",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Manuel",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Metaveri filtreleme modunu seç",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Bilgi geri alım adı",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Ajan karar versin",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Ajan, istemden ve mevcut bağlamdan kendi sorgusunu yazar. Burada ayarlanacak bir şey yok.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Özel sorgu",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Bu geri alım kaynağı için sabit bir sorgu yazın.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Özel sorgu metni",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Arama sorgusu yazın",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Sorgu",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Bilgi Geri Alımı · Ajan karar versin",
+  "agentDetail.configure.knowledgeRetrieval.edit": "{{name}} düzenle",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Ajanın yanıt verirken arayabileceği bir bilgi tabanı bağlayın",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Henüz bilgi yok",
+  "agentDetail.configure.knowledgeRetrieval.label": "Bilgi Geri Alımı",
+  "agentDetail.configure.knowledgeRetrieval.remove": "{{name}} kaldır",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Bu ajanın görevleri koordine ederken kullanabileceği bilgi geri alım kaynakları.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Bilgi geri alımını değiştir",
+  "agentDetail.configure.model.label": "Model",
+  "agentDetail.configure.orchestrate": "Koordine Et",
+  "agentDetail.configure.preview.chatFeatures": "Sohbet Özellikleri",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Ajan",
+  "agentDetail.configure.preview.empty.description": "Mevcut taslağı test etmek için bir mesaj gönderin.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Henüz talimat yok, bu yüzden yanıtlar düz modelden geliyor.",
+  "agentDetail.configure.preview.endUserAuth": "Son kullanıcı kimlik doğrulaması",
+  "agentDetail.configure.preview.restart": "Önizlemeyi yeniden başlat",
+  "agentDetail.configure.preview.title": "Önizleme",
+  "agentDetail.configure.prompt.copied": "İstem kopyalandı",
+  "agentDetail.configure.prompt.copy": "İstemi kopyala",
+  "agentDetail.configure.prompt.copyFailed": "İstem kopyalanamadı.",
+  "agentDetail.configure.prompt.insert.label": "Ekle",
+  "agentDetail.configure.prompt.insert.question": "Soruya başla",
+  "agentDetail.configure.prompt.insert.reportFile": "Çıktı rapor dosyası",
+  "agentDetail.configure.prompt.insert.tenders": "İhalelere başla",
+  "agentDetail.configure.prompt.label": "İstem",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Bahset",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Talimatları buraya yazın,",
+  "agentDetail.configure.prompt.tip": "Bu ajanın girdileri nasıl yorumlayacağını, araçları nasıl çağıracağını ve çıktıları nasıl üreteceğini tanımlayın.",
+  "agentDetail.configure.publishBar.draft": "Taslak",
+  "agentDetail.configure.publishBar.publishUpdate": "Güncellemeyi yayınla",
+  "agentDetail.configure.publishBar.published": "Yayınlandı",
+  "agentDetail.configure.publishBar.publishedAt": "{{time}} yayınlandı",
+  "agentDetail.configure.publishBar.publishing": "Yayınlanıyor…",
+  "agentDetail.configure.publishBar.saved": "5 dakika önce kaydedildi",
+  "agentDetail.configure.publishBar.savedAt": "{{time}} kaydedildi",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Yayınlanmamış değişiklikler",
+  "agentDetail.configure.publishBar.upToDate": "Güncel",
+  "agentDetail.configure.publishBar.versionHistory": "Sürüm geçmişini aç",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Etkilenen İş Akışları",
+  "agentDetail.configure.publishImpact.cancel": "İptal",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Ajanınız şurada görünüyor",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Değişiklikler onları etkileyecek.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "bu ajan",
+  "agentDetail.configure.publishImpact.title": "{{name}} için {{action}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} iş akışı",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} iş akışı",
+  "agentDetail.configure.skills.add": "Beceri ekle",
+  "agentDetail.configure.skills.detail.contentRegion": "Beceri detay içeriği",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} DOSYA",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Beceri dosyaları",
+  "agentDetail.configure.skills.detail.files": "Dosyalar",
+  "agentDetail.configure.skills.empty.description": "Beceriler, ajana çalışırken çağırabileceği yeniden kullanılabilir uzmanlık sağlar",
+  "agentDetail.configure.skills.empty.title": "Henüz beceri yok",
+  "agentDetail.configure.skills.itemType": "Beceri",
+  "agentDetail.configure.skills.label": "Beceriler",
+  "agentDetail.configure.skills.remove": "{{name}} kaldır",
+  "agentDetail.configure.skills.tip": "Bu ajanın görevleri koordine ederken kullanabileceği beceriler.",
+  "agentDetail.configure.skills.toggle": "Becerileri değiştir",
+  "agentDetail.configure.skills.upload.action": "Yükle",
+  "agentDetail.configure.skills.upload.browse": "göz at",
+  "agentDetail.configure.skills.upload.description": "Bu ajan için bir .zip veya .skill paketi yükleyin.",
+  "agentDetail.configure.skills.upload.dropzone": "Buraya bir beceri paketi bırakın veya",
+  "agentDetail.configure.skills.upload.failed": "Beceri yüklenemedi.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Bir .zip veya .skill dosyası yükleyin.",
+  "agentDetail.configure.skills.upload.success": "Beceri yüklendi.",
+  "agentDetail.configure.skills.upload.title": "Beceri yükle",
+  "agentDetail.configure.tools.add": "Araç ekle",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Geliştiriciler için",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Ajanın sandbox'ında çalıştırdığı bir komut satırı programı yükleyin. Kurulum ve genellikle API Key gerektirir.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI aracı",
+  "agentDetail.configure.tools.addMenu.tool.description": "Bu çalışma alanında zaten bulunan bir aracı seçin, örneğin web araması veya entegrasyonlar.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Araç",
+  "agentDetail.configure.tools.cliDialog.description": "Herhangi bir paket kayıt defterinden CLI aracı yükleyin. Ajan, sağladığı binary'ye shell erişimi kazanır.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "CLI Aracını Düzenle",
+  "agentDetail.configure.tools.cliDialog.env.description": "Bu CLI aracının ihtiyaç duyduğu API Key'leri, token'ları veya gizli bilgileri saklayın. Değerler depolanırken şifrelenir ve ajan aracı çağırdığında çevre değişkenleri olarak enjekte edilir.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Çevre Değişkenleri",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(isteğe bağlı)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Sandbox · ilk çağrıda bir kez çalışır",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Kurulum Komutu",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Kurulum komutunuzu buraya yapıştırın, örneğin npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Kurulum komutu gerekli.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "CLI Aracı hakkında daha fazla bilgi",
+  "agentDetail.configure.tools.cliDialog.name.label": "CLI Aracı Adı",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "CLI aracınıza ad verin",
+  "agentDetail.configure.tools.cliDialog.name.required": "CLI aracı adı gerekli.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Ajan istemine asla görünmez; yalnızca çalışma zamanında $VAR olarak enjekte edilir",
+  "agentDetail.configure.tools.cliDialog.title": "CLI Aracı Ekle",
+  "agentDetail.configure.tools.cliTool": "CLI Aracı",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Son kullanıcı · OAuth",
+  "agentDetail.configure.tools.editAction": "{{name}} düzenle",
+  "agentDetail.configure.tools.empty.description": "Araçlar, ajanın web aramak veya uygulamalarınızı çağırmak gibi eylemler gerçekleştirmesini sağlar",
+  "agentDetail.configure.tools.empty.title": "Henüz araç yok",
+  "agentDetail.configure.tools.label": "Araçlar",
+  "agentDetail.configure.tools.moreActions": "{{name}} için daha fazla eylem",
+  "agentDetail.configure.tools.pluginType": "Eklenti",
+  "agentDetail.configure.tools.preAuthorize": "Önceden yetkilendir",
+  "agentDetail.configure.tools.removeAction": "{{name}} kaldır",
+  "agentDetail.configure.tools.removeProvider": "Tüm araçları kaldır",
+  "agentDetail.configure.tools.tip": "Bu ajanın görevleri koordine ederken çağırabileceği araçlar.",
+  "agentDetail.configure.tools.toggle": "Araçları değiştir",
+  "agentDetail.configure.tools.toolTabs.all": "Tümü",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Özel",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Eklentiler",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Ajan",
+  "agentDetail.history": "Geçmiş",
+  "agentDetail.logs.description": "Tam günlükler, kullanıcı girişleri, ajan yanıtları, planlama ve araç kullanımları dahil olmak üzere uygulamanın çalışma durumunu kaydeder.",
+  "agentDetail.logs.empty": "Günlük bulunamadı",
+  "agentDetail.logs.filters.period.allTime": "Tüm zamanlar",
+  "agentDetail.logs.filters.period.label": "Günlük dönemi",
+  "agentDetail.logs.filters.period.last30days": "Son 30 gün",
+  "agentDetail.logs.filters.period.last7days": "Son 7 gün",
+  "agentDetail.logs.filters.search.label": "Günlüklerde ara",
+  "agentDetail.logs.filters.search.placeholder": "Ara",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Son Oluşturma zamanı",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Son Güncelleme zamanı",
+  "agentDetail.logs.filters.source.all": "Kaynak",
+  "agentDetail.logs.filters.source.empty": "Kaynak bulunamadı",
+  "agentDetail.logs.filters.source.label": "Günlük kaynağı",
+  "agentDetail.logs.filters.source.loadFailed": "Kaynaklar yüklenemedi",
+  "agentDetail.logs.filters.source.loading": "Kaynaklar yükleniyor…",
+  "agentDetail.logs.filters.source.searchLabel": "Kaynaklarda ara",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Ara",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "İş akışı",
+  "agentDetail.logs.learnMore": "Daha fazla bilgi",
+  "agentDetail.logs.loadFailed": "Günlükler yüklenemedi",
+  "agentDetail.logs.loading": "Günlükler yükleniyor…",
+  "agentDetail.logs.notAvailable": "Yok",
+  "agentDetail.logs.table.createdTime": "Oluşturulma Zamanı",
+  "agentDetail.logs.table.endUser": "Son kullanıcı",
+  "agentDetail.logs.table.messageCount": "Mesaj Sayısı",
+  "agentDetail.logs.table.operationRate": "İşlem Oranı",
+  "agentDetail.logs.table.source": "Kaynak",
+  "agentDetail.logs.table.title": "Başlık",
+  "agentDetail.logs.table.unread": "Okunmamış",
+  "agentDetail.logs.table.updatedTime": "Güncellenme Zamanı",
+  "agentDetail.logs.table.userRate": "Kullanıcı Oranı",
+  "agentDetail.logs.title": "Günlükler",
+  "agentDetail.memorySettings.budgetLabel": "Bellek Bütçesi",
+  "agentDetail.memorySettings.description": "Aktif yapılandırma anlık görüntüsünden bellek ayarları.",
+  "agentDetail.memorySettings.export.description": "Bellek dışa aktarımı sonraki bir sürüm için planlanmıştır.",
+  "agentDetail.memorySettings.export.download": "İndir",
+  "agentDetail.memorySettings.export.soon": "Yakında",
+  "agentDetail.memorySettings.export.title": "Mevcut belleği dışa aktar",
+  "agentDetail.memorySettings.notConfigured": "Yapılandırılmadı",
+  "agentDetail.memorySettings.scopeLabel": "Bellek Kapsamı",
+  "agentDetail.memorySettings.title": "Bellek",
+  "agentDetail.metadata.activeVersionLabel": "Aktif Sürüm",
+  "agentDetail.metadata.appIdLabel": "Uygulama ID",
+  "agentDetail.metadata.description": "Ajan arka ucu tarafından döndürülen salt okunur Roster alanları.",
+  "agentDetail.metadata.emptyValue": "Mevcut değil",
+  "agentDetail.metadata.scopeLabel": "Kapsam",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Yalnızca iş akışı",
+  "agentDetail.metadata.sourceLabel": "Kaynak",
+  "agentDetail.metadata.statusLabel": "Durum",
+  "agentDetail.metadata.title": "Metaveri",
+  "agentDetail.metadata.updatedAtLabel": "Güncelleme Tarihi",
+  "agentDetail.metadata.workflowIdLabel": "İş Akışı ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "İş Akışı Düğüm ID",
+  "agentDetail.monitoring.change": "Önceki döneme göre {{value}}",
+  "agentDetail.monitoring.dateRangeLabel": "Tarih aralığı",
+  "agentDetail.monitoring.description": "İş akışlarındaki yeniden kullanılabilir ajan etkinliğini, maliyetini ve etkileşim kalitesini izleyin.",
+  "agentDetail.monitoring.learnMore": "Daha fazla bilgi",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Bu ajanı kullanarak iş akışlarını tetikleyen benzersiz son kullanıcılar.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Aktif Kullanıcılar",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Bu erişim noktası için sürekli kullanıcı-ajan iletişim sayısı.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Ort. Oturum Etkileşimleri",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "İsteğin başlangıcından tamamlanmasına kadar ortalama çıktı hızı.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Token Çıktı Hızı",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Bu ajanın iş akışı çalıştırmalarında ürettiği tahmini token maliyeti.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Token Kullanımı",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Seçilen erişim noktası aracılığıyla bu ajana ulaşan günlük AI sohbetleri.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Toplam Sohbetler",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Günlük ajan etkileşim sayısı.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Toplam Mesajlar",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Bu ajan için 1.000 mesaj başına beğeni sayısı.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Kullanıcı Memnuniyet Oranı",
+  "agentDetail.monitoring.pickSource": "Bir uygulama seç",
+  "agentDetail.monitoring.sourceLabel": "Uygulama",
+  "agentDetail.monitoring.sourceTrigger": "Kaynak {{name}}",
+  "agentDetail.monitoring.sources.all": "Tümü",
+  "agentDetail.monitoring.timeRangeLabel": "Zaman aralığı",
+  "agentDetail.monitoring.timeRanges.custom": "Özel",
+  "agentDetail.monitoring.timeRanges.last30days": "Son 30 gün",
+  "agentDetail.monitoring.timeRanges.last7days": "Son 7 gün",
+  "agentDetail.monitoring.timeRanges.today": "Bugün",
+  "agentDetail.monitoring.title": "İzleme",
+  "agentDetail.monitoring.tokenUsageConsumed": "Tüketilen tokenlar",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/s",
+  "agentDetail.navigationLabel": "Ajan gezinmesi",
+  "agentDetail.publish": "Yayınla",
+  "agentDetail.publishSoon": "Yakında",
+  "agentDetail.sections.access": "Erişim Noktası",
+  "agentDetail.sections.configure": "Koordine Et",
+  "agentDetail.sections.logs": "Günlükler",
+  "agentDetail.sections.monitoring": "İzleme",
+  "agentDetail.subtitle": "Ajan ID: {{agentId}}",
+  "agentDetail.title": "Ajan",
+  "agentDetail.type": "AJAN",
+  "agentDetail.versionHistory.active": "Aktif",
+  "agentDetail.versionHistory.empty": "Henüz sürüm yok",
+  "agentDetail.versionHistory.filter": "Sürümleri filtrele",
+  "agentDetail.versionHistory.versionName": "Sürüm {{version}}",
+  "roster.createAgent": "Ajan oluştur",
+  "roster.createAgentOptions": "Ajan oluşturma seçenekleri",
+  "roster.createDialog.description": "Bu çalışma alanı Roster'ında yeniden kullanılabilir bir ajan oluşturun.",
+  "roster.createDialog.title": "Ajan oluştur",
+  "roster.createForm.changeIcon": "Ajan simgesini değiştir",
+  "roster.createForm.descriptionLabel": "Açıklama",
+  "roster.createForm.descriptionOptional": "(isteğe bağlı)",
+  "roster.createForm.descriptionPlaceholder": "örn. Bir konuda kaynak toplar ve temel bulguları özetler",
+  "roster.createForm.nameLabel": "Ad",
+  "roster.createForm.namePlaceholder": "örn. Max",
+  "roster.createForm.nameRequired": "Ad gereklidir.",
+  "roster.createForm.roleLabel": "Rol",
+  "roster.createForm.rolePlaceholder": "örn. Araştırma Asistanı",
+  "roster.createForm.roleRequired": "Rol gereklidir.",
+  "roster.createSuccess": "Ajan oluşturuldu.",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Bu ajan, aktif Roster listesinden kaldırılacak.",
+  "roster.deleteDialog.title": "{{name}} silinsin mi?",
+  "roster.deleteFailed": "Ajan silinemedi.",
+  "roster.deleteSuccess": "Ajan silindi.",
+  "roster.duplicateFailed": "Ajan çoğaltılamadı.",
+  "roster.duplicateSuccess": "Ajan çoğaltıldı.",
+  "roster.editAgent": "{{name}} düzenle",
+  "roster.editDialog.description": "Bu ajan için Roster adı, açıklaması ve rolünü güncelleyin.",
+  "roster.editDialog.title": "Ajanı düzenle",
+  "roster.editInfo": "Bilgileri Düzenle",
+  "roster.empty": "Henüz ajan yok",
+  "roster.emptyDescription": "Bu çalışma alanına kaydedilen ajanlar burada görünecek.",
+  "roster.emptySearch": "Eşleşen ajan yok",
+  "roster.emptySearchDescription": "Başka bir ajan adı deneyin.",
+  "roster.filters.all": "Tümü",
+  "roster.filters.drafts": "Taslaklar",
+  "roster.filters.label": "Ajan filtreleri",
+  "roster.filters.published": "Yayınlandı",
+  "roster.learnMore": "Agent Roster hakkında daha fazla bilgi",
+  "roster.listLabel": "Ajan Roster listesi",
+  "roster.loadMore": "Daha fazla yükle",
+  "roster.loadingError": "Ajanlar yüklenemedi. Yenileyip tekrar deneyin.",
+  "roster.moreActions": "{{name}} için daha fazla eylem",
+  "roster.nodeSelector.createInlineFailed": "Inline ajan oluşturulamadı. Yenileyip tekrar deneyin.",
+  "roster.nodeSelector.dialogLabel": "Bir ajan seç",
+  "roster.nodeSelector.manageInAgentConsole": "Agent Console'da yönet",
+  "roster.nodeSelector.searchPlaceholder": "Ara…",
+  "roster.nodeSelector.startFromScratch": "Sıfırdan Başla",
+  "roster.references.label": "{{name}} kullanan iş akışları",
+  "roster.references.trigger": "{{name}} kullanan iş akışları",
+  "roster.searchLabel": "Ajanları ara",
+  "roster.searchPlaceholder": "Ajanları ada göre ara…",
+  "roster.sources.agent_app": "Ajan uygulaması",
+  "roster.sources.imported": "İçe aktarılan",
+  "roster.sources.system": "Sistem",
+  "roster.sources.workflow": "İş akışı",
+  "roster.status.active": "Aktif",
+  "roster.status.archived": "Arşivlendi",
+  "roster.tabs.agent": "Ajan",
+  "roster.tabs.human": "İnsan",
+  "roster.tabsLabel": "Roster türü",
+  "roster.updateSuccess": "Ajan güncellendi.",
+  "roster.usageStatus.draft": "Taslak"
+}
diff --git a/web/i18n/tr-TR/app-log.json b/web/i18n/tr-TR/app-log.json
index 4bc1483c99d..8968c5ef0a4 100644
--- a/web/i18n/tr-TR/app-log.json
+++ b/web/i18n/tr-TR/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Bugün",
   "filter.period.yearToDate": "Yıl Başlangıcından İtibaren",
   "filter.sortBy": "Sıralama ölçütü:",
+  "monitoring.description": "İzleme, performans, kullanıcı etkinliği ve maliyetler dahil olmak üzere uygulamanın çalışma durumunu kaydeder.",
   "promptLog": "Prompt Günlüğü",
   "runDetail.fileListDetail": "Ayrıntı",
   "runDetail.fileListLabel": "Dosya Detayları",
diff --git a/web/i18n/tr-TR/app.json b/web/i18n/tr-TR/app.json
index 10263d5f22d..ffb77396d3c 100644
--- a/web/i18n/tr-TR/app.json
+++ b/web/i18n/tr-TR/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "Yapılandırılmış Çıktılar, modelin sağladığınız JSON Şemasına uyacak şekilde her zaman yanıtlar üretmesini sağlayan bir özelliktir.",
   "studio.allApps": "Tüm Uygulamalar",
   "studio.apps": "Uygulamalar",
-  "studio.filters.allCreators": "Tüm yaratıcılar",
-  "studio.filters.creators": "Yaratıcılar",
+  "studio.filters.allCreators": "Tüm oluşturanlar",
+  "studio.filters.creators": "Oluşturanlar",
   "studio.filters.reset": "Sıfırla",
   "studio.filters.searchCreators": "Yaratıcıyı ara...",
   "studio.filters.types": "Türler",
diff --git a/web/i18n/tr-TR/billing.json b/web/i18n/tr-TR/billing.json
index e5976ed1c25..8810a9a24b9 100644
--- a/web/i18n/tr-TR/billing.json
+++ b/web/i18n/tr-TR/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Toplu belge yüklemeyi açmak için yükseltin",
   "upgrade.uploadMultiplePages.description": "Yükleme sınırına ulaştınız — mevcut planınızda aynı anda yalnızca bir belge seçip yükleyebilirsiniz.",
   "upgrade.uploadMultiplePages.title": "Aynı anda birden fazla belge yüklemek için yükseltin",
+  "upgrade.workflowRestore.description": "İş akışı sürümü geri yükleme mevcut planınızda kullanılamaz.",
+  "upgrade.workflowRestore.title": "İş akışı sürümlerini geri yüklemek için yükseltin",
   "upgradeBtn.encourage": "Şimdi Yükselt",
   "upgradeBtn.encourageShort": "Yükselt",
   "upgradeBtn.plain": "Planı Yükselt",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 3f45cb422ec..e629e783b23 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Çalışma alanını değiştir",
   "mcpPage.description": "Uygulamalarınıza harici araç ve servislere erişim vermek için MCP sunucularını bağlayın ve yönetin.",
-  "members.admin": "Yönetici",
   "members.adminTip": "Uygulama oluşturabilir ve takım ayarlarını yönetebilir",
+  "members.alreadyInTeam": "Zaten ekipte",
+  "members.alreadyInTeamTip": "Bu kullanıcıların bu çalışma alanına zaten erişimi var.",
   "members.builder": "Oluşturucu",
   "members.builderTip": "Kendi uygulamalarını oluşturup düzenleyebilir",
-  "members.datasetOperator": "Bilgi Yöneticisi",
   "members.datasetOperatorTip": "Sadece bilgi tabanını yönetebilir",
   "members.deleteMember": "Üyeyi Sil",
   "members.disInvite": "Davetiyeyi iptal et",
-  "members.editor": "Editör",
   "members.editorTip": "Uygulama oluşturabilir ve düzenleyebilir",
   "members.email": "E-posta",
   "members.emailInvalid": "Geçersiz E-posta Formatı",
@@ -270,13 +269,12 @@
   "members.invite": "Ekle",
   "members.inviteTeamMember": "Takım Üyesi Ekle",
   "members.inviteTeamMemberTip": "Giriş yaptıktan sonra takım verilerinize doğrudan erişebilirler.",
-  "members.invitedAsRole": "{{role}} kullanıcısı olarak davet edildi",
+  "members.invitedAsRole": "{{role}} olarak davet edildi",
   "members.lastActive": "SON AKTİF",
   "members.name": "İSİM",
-  "members.normal": "Normal",
+  "members.noNewInvitationsSent": "Yeni davet gönderilmedi",
   "members.normalTip": "Sadece uygulamaları kullanabilir, uygulama oluşturamaz",
   "members.ok": "Tamam",
-  "members.owner": "Sahibi",
   "members.pending": "Beklemede...",
   "members.removeFromTeam": "Takımdan Kaldır",
   "members.removeFromTeamTip": "Takım erişimi kaldırılacak",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Bilgi",
   "menus.datasetsTips": "YAKINDA: Kendi metin verilerinizi içe aktarın veya LLM bağlamını geliştirmek için Webhook aracılığıyla gerçek zamanlı veri yazın.",
+  "menus.deployments": "Dağıtımlar",
   "menus.explore": "Keşfet",
   "menus.exploreMarketplace": "Pazar Yeri'ni Keşfedin",
   "menus.newApp": "Yeni Uygulama",
   "menus.newDataset": "Bilgi Oluştur",
   "menus.plugins": "Entegrasyonlar",
   "menus.pluginsTips": "Üçüncü taraf entegrasyonlari entegre edin veya ChatGPT uyumlu AI-Entegrasyonlari oluşturun.",
+  "menus.roster": "Ajan listesi",
   "menus.status": "beta",
   "menus.tools": "Araçlar",
   "model.addMoreModel": "Daha fazla model eklemek için ayarlara gidin",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Metinden Konuşmaya Modeli",
   "modelProvider.ttsModel.tip": "Konuşmada metinden konuşmaya giriş için varsayılan modeli ayarlayın.",
   "modelProvider.upgradeForLoadBalancing": "Yük Dengelemeyi etkinleştirmek için planınızı yükseltin.",
+  "navigation.skipToMain": "Ana içeriğe geç",
   "noData": "Veri yok",
   "operation.add": "Ekle",
   "operation.added": "Eklendi",
@@ -600,9 +601,6 @@
   "placeholder.input": "Lütfen girin",
   "placeholder.search": "Ara...",
   "placeholder.select": "Lütfen seçin",
-  "plugin.serpapi.apiKey": "API Anahtarı",
-  "plugin.serpapi.apiKeyPlaceholder": "API anahtarınızı girin",
-  "plugin.serpapi.keyFrom": "SerpAPI Hesap Sayfasından SerpAPI anahtarınızı alın",
   "promptEditor.context.item.desc": "Bağlam şablonunu ekle",
   "promptEditor.context.item.title": "Bağlam",
   "promptEditor.context.modal.add": "Bağlam Ekle",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
new file mode 100644
index 00000000000..644659f9dc9
--- /dev/null
+++ b/web/i18n/tr-TR/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "Arka uç servis API'si",
+  "access.api.copyCurlExample": "cURL örneğini kopyala",
+  "access.api.createFailed": "API Token oluşturulamadı.",
+  "access.api.createKey": "API Token Oluştur",
+  "access.api.createKeyTitle": "Yeni API Token oluştur",
+  "access.api.curlExampleTitle": "cURL örneği",
+  "access.api.description": "Bu dağıtıma HTTP üzerinden erişin. Her API Token tek bir ortamla sınırlıdır.",
+  "access.api.developerTitle": "Geliştirici API'si",
+  "access.api.disabled": "Bu dağıtım için API erişimi kapalı.",
+  "access.api.disabledHint": "Ortam kapsamlı tokenler oluşturmak için API erişimini etkinleştirin.",
+  "access.api.dismissToken": "API Token'ı kapat",
+  "access.api.docs": "API Dokümanları",
+  "access.api.docsClose": "API dokümanlarını kapat",
+  "access.api.docsDescription": "Bu dağıtım için Workflow API referansını görüntüleyin.",
+  "access.api.docsTitle": "Workflow API dokümantasyonu",
+  "access.api.empty": "API Token vermeye başlamak için önce bir ortama dağıtın.",
+  "access.api.emptyTitle": "Dağıtılmış ortam yok",
+  "access.api.endpoint": "İstek URL'si",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "API Token listesi",
+  "access.api.nameLabel": "API Token adı",
+  "access.api.namePlaceholder": "Bir API Token adı girin",
+  "access.api.nameRequired": "API Token adı zorunludur.",
+  "access.api.newKey": "Yeni API Token Oluştur",
+  "access.api.newTokenDescription": "Bu API Token yalnızca bir kez gösterilir. Bu sayfadan ayrılmadan önce kopyalayın.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token oluşturuldu",
+  "access.api.noKeys": "Henüz API Token yok. API'yi çağırmaya başlamak için bir tane oluşturun.",
+  "access.api.noKeysTitle": "Henüz API Token yok",
+  "access.api.revokeConfirmDescription": "\"{{name}}\" adlı API Token hemen çalışmayı durduracak. Bu işlem geri alınamaz.",
+  "access.api.revokeConfirmTitle": "API Token iptal edilsin mi?",
+  "access.api.revokeFailed": "API Token iptal edilemedi.",
+  "access.api.revokeSuccess": "API Token iptal edildi",
+  "access.api.table.action": "İşlem",
+  "access.api.table.environment": "Ortam",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Ad",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Kanal",
+  "access.channels.col.endpoint": "Giriş noktası",
+  "access.channels.col.status": "Durum",
+  "access.channels.description": "WebApp ve CLI giriş noktaları yukarıdaki erişim izinlerini kullanır.",
+  "access.channels.disabled": "Bu dağıtım için erişim kanalları kapalı.",
+  "access.channels.disabledHint": "WebApp ve CLI giriş noktalarını açmak için erişim kanallarını etkinleştirin.",
+  "access.channels.followPermission": "İzinleri takip eder",
+  "access.channels.title": "Erişim kanalları",
+  "access.cli.description": "Komut dosyaları, otomatik iş akışları veya Agent entegrasyonları için uygun olan difyctl ile terminalden çağırın.",
+  "access.cli.docs": "Kullanım kılavuzu",
+  "access.cli.domain": "Alan adı",
+  "access.cli.empty": "CLI uç noktası yapılandırılmamış.",
+  "access.cli.install": "CLI'yi yükle",
+  "access.cli.title": "CLI",
+  "access.copied": "Kopyalandı",
+  "access.copy": "Kopyala",
+  "access.copyFailed": "Kopyalama başarısız",
+  "access.copyToast": "Panoya kopyalandı",
+  "access.hide": "Gizle",
+  "access.members.clearAll": "Tümünü temizle",
+  "access.members.empty": "Eşleşme bulunamadı.",
+  "access.members.groupCount_one": "{{count}} grup",
+  "access.members.groupCount_other": "{{count}} grup",
+  "access.members.groups": "Gruplar",
+  "access.members.individuals": "Üyeler",
+  "access.members.memberCount_one": "{{count}} üye",
+  "access.members.memberCount_other": "{{count}} üye",
+  "access.members.pickPlaceholder": "Grupları veya üyeleri seçin",
+  "access.members.searchPlaceholder": "Grupları ve üyeleri ara",
+  "access.members.selectedLabel": "Seçilenler",
+  "access.permission.anyone": "Bağlantıya sahip herkes",
+  "access.permission.anyoneDesc": "Herkes giriş yapmadan bu dağıtıma erişebilir.",
+  "access.permission.memberCount_one": "{{count}} üye",
+  "access.permission.memberCount_other": "{{count}} üye",
+  "access.permission.organization": "Platformdaki tüm üyeler",
+  "access.permission.organizationDesc": "Platformdaki tüm üyeler",
+  "access.permission.specific": "Platformdaki belirli üyeler",
+  "access.permission.specificDesc": "Belirli grupları veya üyeleri seçin",
+  "access.permission.specificUnavailable": "Gerçek platform üyeleri ve grupları bağlanana kadar belirli üye seçimi devre dışıdır.",
+  "access.permission.updateFailed": "Erişim politikası güncellenemedi.",
+  "access.permissions.col.environment": "Ortam",
+  "access.permissions.col.permission": "Erişim",
+  "access.permissions.description": "Her ortamda WebApp ve CLI giriş noktaları için erişim izinlerini ayarlayın.",
+  "access.permissions.editAriaLabel": "{{environment}} için erişimi yapılandır",
+  "access.permissions.editDescription": "WebApp ve CLI giriş noktaları için erişim izinlerini ayarlayın.",
+  "access.permissions.editTitle": "Erişim izinleri",
+  "access.permissions.title": "Erişim izinleri",
+  "access.revoke": "İptal et",
+  "access.runAccess.description": "Kullanıcıların bu dağıtımı nasıl çalıştırabileceğini ve her ortamda kimlerin erişebileceğini yönetin.",
+  "access.runAccess.disabled": "Bu dağıtım için çalıştırma erişimi kapalı.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Bu dağıtımı bir Model Context Protocol sunucusu olarak yayınlayın.",
+  "access.runAccess.mcpEmpty": "MCP uç noktası yapılandırılmamış.",
+  "access.runAccess.noEnvs": "Erişim izinlerini yapılandırmak için bir ortama dağıtın.",
+  "access.runAccess.noEnvsTitle": "Dağıtılmış ortam yok",
+  "access.runAccess.openWebapp": "WebApp'i aç",
+  "access.runAccess.permissions": "Erişim izinleri",
+  "access.runAccess.permissionsDesc": "Her ortamda bu dağıtıma kimlerin erişebileceği.",
+  "access.runAccess.title": "Çalıştırma erişimi",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Son kullanıcılar için barındırılan web sayfası.",
+  "access.runAccess.webappEmpty": "Yakında.",
+  "access.show": "Göster",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Harici",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Bilinmiyor",
+  "card.access.api": "API Tokenleri",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Erişim yok",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "İlk Sürümü Oluştur",
+  "card.deploy": "Dağıt",
+  "card.deploying": "{{count}} dağıtılıyor",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} başarısız",
+  "card.fromApp": "{{name}} kaynağından",
+  "card.lastDeployed": "Son dağıtım {{time}}",
+  "card.menu.delete": "Dağıtımı sil",
+  "card.menu.deleteDisabled": "Arka uç tarafından yönetilen dağıtımlar için dağıtım silme henüz kullanılamıyor.",
+  "card.menu.deploy": "Ortama Dağıt",
+  "card.menu.editInfo": "Bilgileri Düzenle",
+  "card.menu.viewDetail": "Dağıtım detayını görüntüle",
+  "card.moreActions": "Daha fazla işlem",
+  "card.neverDeployed": "Henüz dağıtılmadı",
+  "card.noDescription": "Açıklama sağlanmadı.",
+  "card.notDeployed": "Dağıtılmadı",
+  "card.ready": "{{count}} çalışıyor",
+  "card.tooltip.createdAt": "Oluşturuldu",
+  "card.tooltip.deployed": "Dağıtıldı",
+  "card.tooltip.deploymentStatus": "Dağıtım",
+  "card.tooltip.notDeployed": "Bu dağıtım henüz hiçbir ortama dağıtılmadı.",
+  "card.tooltip.notDeployedShort": "Dağıtılmadı",
+  "card.tooltip.release": "Sürüm",
+  "card.tooltip.releaseName": "Sürüm Adı",
+  "card.tooltip.source": "Kaynak",
+  "common.loadFailed": "Yüklenemedi. Daha sonra tekrar deneyin.",
+  "common.loading": "Yükleniyor...",
+  "createGuide.actions.back": "Geri",
+  "createGuide.actions.cancel": "İptal",
+  "createGuide.actions.continue": "Devam",
+  "createGuide.actions.createAndDeploy": "Oluştur ve Dağıt",
+  "createGuide.actions.creating": "Oluşturuluyor...",
+  "createGuide.actions.deploy": "Dağıt",
+  "createGuide.actions.deploying": "Oluşturuluyor ve dağıtılıyor...",
+  "createGuide.actions.next": "İleri",
+  "createGuide.actions.skipDeploy": "Atla, sonra dağıt",
+  "createGuide.description": "Bir sürüm kaynağı, temel bilgiler ve hedef ortamdan bir dağıtım oluşturun.",
+  "createGuide.dsl.defaultAppName": "İçe aktarılmış DSL uygulaması",
+  "createGuide.dsl.description": "Dağıtımı, ilk sürümü ve isteğe bağlı ortam dağıtımını oluşturmak için bir Workflow DSL paketi yükleyin.",
+  "createGuide.dsl.dropDescription": "Bir Workflow YAML DSL paketi yükleyin. Dağıtım seçenekleri, dağıtımdan önce bu dosyadan çözümlenir.",
+  "createGuide.dsl.dropTitle": "Workflow DSL paketi yükle",
+  "createGuide.dsl.readFailed": "DSL dosyası okunamadı. Başka bir dosya seçip tekrar deneyin.",
+  "createGuide.dsl.reading": "DSL dosyası okunuyor...",
+  "createGuide.dsl.title": "DSL İçe Aktar",
+  "createGuide.dsl.unsupportedMode": "Dağıtımlar için yalnızca Workflow DSL dosyaları kullanılabilir.",
+  "createGuide.errors.createReleaseFailed": "Dağıtım veya sürüm oluşturulamadı.",
+  "createGuide.errors.deployFailed": "Ortama dağıtılamadı.",
+  "createGuide.method.description": "İlk sürümü oluşturmak için kullanılan kaynağı seçin.",
+  "createGuide.methods.bindApp.description": "Sürüm kaynağı olarak Studio'daki mevcut bir Workflow App'ı kullanın.",
+  "createGuide.methods.bindApp.title": "Mevcut Workflow App'ı bağla",
+  "createGuide.methods.importDsl.description": "Bir Workflow YAML DSL paketi yükleyin ve dağıtım arayüzünden devam edin.",
+  "createGuide.methods.importDsl.title": "DSL İçe Aktar",
+  "createGuide.methods.mocked": "Sahte",
+  "createGuide.nav.back": "Dağıtımlar",
+  "createGuide.release.defaultName": "ilk sürüm",
+  "createGuide.release.deployInfo": "Dağıtım Bilgileri",
+  "createGuide.release.description": "Dağıtım bilgilerini ve ilk sürüm ayrıntılarını doldurun.",
+  "createGuide.release.firstVersion": "İlk Sürüm",
+  "createGuide.release.instanceDescription": "Dağıtım Açıklaması",
+  "createGuide.release.instanceDescriptionPlaceholder": "Bu dağıtımın ne için kullanıldığını açıklayın",
+  "createGuide.release.instanceName": "Dağıtım Adı",
+  "createGuide.release.instanceNameConflict": "Bu ada sahip bir dağıtım zaten var. Başka bir ad seçin.",
+  "createGuide.release.releaseDescription": "Sürüm Açıklaması",
+  "createGuide.release.releaseDescriptionPlaceholder": "Bu sürümü açıklayın",
+  "createGuide.release.releaseName": "Sürüm Adı",
+  "createGuide.release.releaseNote": "Sürüm Açıklaması",
+  "createGuide.release.title": "Temel Bilgiler",
+  "createGuide.source.availableApps_one": "{{count}} uygulama",
+  "createGuide.source.availableApps_other": "{{count}} uygulama",
+  "createGuide.source.clearSearch": "Uygulama aramasını temizle",
+  "createGuide.source.description": "İlk sürümü oluşturmak için kullanılan kaynağı seçin.",
+  "createGuide.source.empty": "Workflow App bulunamadı.",
+  "createGuide.source.searchPlaceholder": "Uygulama ara",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "Sürüm Kaynağı",
+  "createGuide.steps.method": "Sürüm Kaynağı",
+  "createGuide.steps.release": "Temel Bilgiler",
+  "createGuide.steps.source": "Sürüm Kaynağı",
+  "createGuide.steps.target": "Ortama Dağıt",
+  "createGuide.target.bindingCount_one": "{{count}} bağlama",
+  "createGuide.target.bindingCount_other": "{{count}} bağlama",
+  "createGuide.target.bindingHint": "Bu sürüm tarafından kullanılan kimlik bilgilerini seçin.",
+  "createGuide.target.bindings": "Kimlik bilgileri",
+  "createGuide.target.deferredBindingHint": "Kimlik bilgileri, son dağıtım eylemi sırasında gerçek dağıtım planından çözümlenecek.",
+  "createGuide.target.deferredEnvironmentHint": "Ad, dağıtım ve sürüm oluşturulduktan sonra gerçek ortamlarla eşleştirilir.",
+  "createGuide.target.description": "Bir hedef ortam seçin ve bu sürümün orada ihtiyaç duyduğu çalışma zamanı ayarlarını sağlayın. Bu adım atlanabilir.",
+  "createGuide.target.envVarCount_one": "{{count}} değişken",
+  "createGuide.target.envVarCount_other": "{{count}} değişken",
+  "createGuide.target.envVarHint": "Bu sürümün ihtiyaç duyduğu her ortam değişkeni için özel bir değer girin veya uygulamada tanımlanan değeri kullanın.",
+  "createGuide.target.envVarPlaceholder": "Değer girin",
+  "createGuide.target.envVarSource.ariaLabel": "{{key}} için değişken değer kaynağını seçin",
+  "createGuide.target.envVarSource.default": "Uygulama değeri",
+  "createGuide.target.envVarSource.lastDeployment": "Son dağıtılan değer",
+  "createGuide.target.envVarSource.literal": "Özel değer",
+  "createGuide.target.envVarType.number": "Sayı",
+  "createGuide.target.envVarType.secret": "Gizli",
+  "createGuide.target.envVarType.string": "Metin",
+  "createGuide.target.envVars": "Ortam Değişkenleri",
+  "createGuide.target.environment": "Hedef Ortam",
+  "createGuide.target.environmentName": "Ortam Adı",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "Kimlik bilgileri yüklenemedi.",
+  "createGuide.target.loadEnvironmentsFailed": "Dağıtım ortamları yüklenemedi.",
+  "createGuide.target.missingRequiredBinding": "Bu zorunlu bağlama için bir kimlik bilgisi seçin.",
+  "createGuide.target.noBindingRequired": "Kimlik bilgisi gerekmiyor.",
+  "createGuide.target.noCredentialCandidates": "Kullanılabilir kimlik bilgisi yok.",
+  "createGuide.target.noEnvironmentOptions": "Kullanılabilir dağıtım ortamı yok.",
+  "createGuide.target.required": "Zorunlu",
+  "createGuide.target.selectCredential": "Bir kimlik bilgisi seçin",
+  "createGuide.target.title": "Ortama Dağıt",
+  "createGuide.title": "Yeni Dağıtım",
+  "createModal.appPickerPlaceholder": "Bir Workflow App seçin",
+  "createModal.appSearchEmpty": "Eşleşen Workflow App yok",
+  "createModal.appSearchPlaceholder": "Workflow App ara…",
+  "createModal.cancel": "İptal",
+  "createModal.create": "Oluştur",
+  "createModal.createFailed": "Dağıtım oluşturulamadı.",
+  "createModal.description": "Bir Workflow App seçin ve dağıtım oluşturun.",
+  "createModal.descriptionLabel": "Açıklama",
+  "createModal.descriptionPlaceholder": "Bu dağıtımın ne için kullanıldığını açıklayın",
+  "createModal.loadMoreApps": "Daha fazla uygulama yükle",
+  "createModal.loadingApps": "Uygulamalar yükleniyor…",
+  "createModal.nameLabel": "Dağıtım Adı",
+  "createModal.namePlaceholder": "Dağıtım Adı",
+  "createModal.noApps": "Bu çalışma alanında Workflow App bulunamadı. Önce Studio'da bir tane oluşturun.",
+  "createModal.selected": "Seçildi",
+  "createModal.sourceApp": "Workflow App (zorunlu)",
+  "createModal.title": "Yeni Dağıtım",
+  "deployDrawer.bindingCount_one": "{{count}} bağlama",
+  "deployDrawer.bindingCount_other": "{{count}} bağlama",
+  "deployDrawer.bindingOptionsFailed": "Kimlik bilgisi seçenekleri yüklenemedi.",
+  "deployDrawer.bindingSelectionHint": "Bu dağıtım tarafından kullanılan kimlik bilgilerini seçin.",
+  "deployDrawer.bindingsDisabled": "Sürüm önizlemesinden çözümlendi. Düzenleme henüz kullanılamıyor.",
+  "deployDrawer.cancel": "İptal",
+  "deployDrawer.close": "Dağıtım çekmecesini kapat",
+  "deployDrawer.defaultSelect": "Seçin...",
+  "deployDrawer.deploy": "Ortama Dağıt",
+  "deployDrawer.deployExistingRelease": "Ortama Dağıt",
+  "deployDrawer.deployExistingReleaseDescription": "Dağıtmak için bir sürüm ve hedef ortam seçin.",
+  "deployDrawer.deployExistingReleaseTitle": "Ortama Dağıt",
+  "deployDrawer.deployFailed": "Dağıtım başlatılamadı.",
+  "deployDrawer.deploying": "Dağıtılıyor...",
+  "deployDrawer.description": "Dağıtmak için bir sürüm ve hedef ortam seçin.",
+  "deployDrawer.envVarCount_one": "{{count}} değişken",
+  "deployDrawer.envVarCount_other": "{{count}} değişken",
+  "deployDrawer.envVarHint": "Bu sürümün ihtiyaç duyduğu her ortam değişkeni için özel bir değer girin veya uygulamada tanımlanan değeri kullanın.",
+  "deployDrawer.envVarPlaceholder": "Değer girin",
+  "deployDrawer.envVarSource.ariaLabel": "{{key}} için değişken değer kaynağını seçin",
+  "deployDrawer.envVarSource.default": "Uygulama değeri",
+  "deployDrawer.envVarSource.lastDeployment": "Son dağıtılan değer",
+  "deployDrawer.envVarSource.literal": "Özel değer",
+  "deployDrawer.envVarType.number": "Sayı",
+  "deployDrawer.envVarType.secret": "Gizli",
+  "deployDrawer.envVarType.string": "Metin",
+  "deployDrawer.envVars": "Ortam Değişkenleri",
+  "deployDrawer.existingReleaseHint": "Bu sürüm olduğu gibi dağıtılacak. Yeni bir sürüm oluşturulmayacak.",
+  "deployDrawer.loadingBindings": "Çözümleniyor...",
+  "deployDrawer.lockedHint": "Geçerli ortama kilitli",
+  "deployDrawer.missingRequiredBinding": "Bu zorunlu bağlama için bir kimlik bilgisi seçin.",
+  "deployDrawer.missingRequiredEnvVar": "Bu zorunlu ortam değişkeni için bir değer girin.",
+  "deployDrawer.modelCreds": "Model Kimlik bilgileri",
+  "deployDrawer.needsValidation": " (doğrulama gerekiyor)",
+  "deployDrawer.newReleaseHint": "Seçilen Workflow App YAML'sinden yeni bir sürüm oluşturulacak.",
+  "deployDrawer.noBindingRequired": "Gerekli değil",
+  "deployDrawer.noCredentialCandidates": "Kullanılabilir kimlik bilgisi yok.",
+  "deployDrawer.noNewEnvironmentAvailable": "Tüm kullanılabilir ortamların zaten bir dağıtımı var.",
+  "deployDrawer.noOtherReleaseAvailable": "Bu ortam için başka kullanılabilir sürüm yok.",
+  "deployDrawer.noReleaseAvailable": "Bir ortama dağıtmadan önce bir sürüm oluşturun.",
+  "deployDrawer.notFound": "Dağıtım bulunamadı.",
+  "deployDrawer.noteLabel": "Sürüm Açıklaması (isteğe bağlı)",
+  "deployDrawer.notePlaceholder": "ör. Karşılama metni düzenlemesini yayınla",
+  "deployDrawer.pluginCreds": "Eklenti Kimlik bilgileri",
+  "deployDrawer.promote": "Dağıt",
+  "deployDrawer.promoteDescription": "Dağıtmak için bir sürüm ve hedef ortam seçin.",
+  "deployDrawer.promoteTitle": "Ortama Dağıt",
+  "deployDrawer.readOnly": "Salt okunur",
+  "deployDrawer.redeploy": "Ortama Dağıt",
+  "deployDrawer.redeployDescription": "Dağıtmak için bir sürüm ve hedef ortam seçin.",
+  "deployDrawer.redeployExistingReleaseHint": "Mevcut sürüm olduğu gibi yeniden dağıtılacak. Yeni bir sürüm oluşturulmayacak.",
+  "deployDrawer.redeployTitle": "Ortama Dağıt",
+  "deployDrawer.releaseLabel": "Sürüm",
+  "deployDrawer.requiredBinding": "Zorunlu",
+  "deployDrawer.rollback": "Dağıt",
+  "deployDrawer.rollbackDescription": "Dağıtmak için bir sürüm ve hedef ortam seçin.",
+  "deployDrawer.rollbackTitle": "Ortama Dağıt",
+  "deployDrawer.runtimeCredentials": "Kimlik bilgileri",
+  "deployDrawer.secretPlaceholder": "gizli",
+  "deployDrawer.selectCredential": "Bir kimlik bilgisi seçin",
+  "deployDrawer.selectEnv": "Bir ortam seçin",
+  "deployDrawer.selectProviderCred": "{{provider}} kimlik bilgisini seçin",
+  "deployDrawer.selectProviderKey": "{{provider}} anahtarını seçin",
+  "deployDrawer.selectRelease": "Bir sürüm seçin",
+  "deployDrawer.targetEnv": "Hedef Ortam",
+  "deployDrawer.title": "Ortama Dağıt",
+  "deployDrawer.valuePlaceholder": "değer",
+  "deployTab.cancelDeployment": "Dağıtımı iptal et",
+  "deployTab.closeError": "Kapat",
+  "deployTab.col.actions": "İşlemler",
+  "deployTab.col.currentRelease": "Geçerli Sürüm",
+  "deployTab.col.environment": "Ortam",
+  "deployTab.col.status": "Durum",
+  "deployTab.col.updated": "Güncellendi",
+  "deployTab.collapseDetails": "Dağıtım detaylarını daralt",
+  "deployTab.confirmUndeploy": "Dağıtımı Geri Al",
+  "deployTab.deployOtherVersion": "Başka Bir Sürüm Dağıt",
+  "deployTab.deployToEnv": "{{name}} ortamına dağıt",
+  "deployTab.deployToNewEnv": "Yeni Ortama Dağıt...",
+  "deployTab.empty": "Henüz örnek yok. Başlamak için yeni bir ortama dağıtın.",
+  "deployTab.emptyDescription": "Bu dağıtımı kullanıcılara sunmak için bir sürüm ve hedef ortam seçin.",
+  "deployTab.emptyTitle": "Henüz çalışan ortam yok",
+  "deployTab.envCount": "Ortamlar",
+  "deployTab.errorCode": "Kod",
+  "deployTab.errorDialogDesc": "Tekrar denemeden veya başka bir sürüm dağıtmadan önce son başarısız dağıtımı inceleyin.",
+  "deployTab.errorDialogTitle": "{{name}} ortamında dağıtım hatası",
+  "deployTab.errorMessage": "Mesaj",
+  "deployTab.errorPhase": "Aşama",
+  "deployTab.expandDetails": "Dağıtım detaylarını genişlet",
+  "deployTab.moreActions": "Daha fazla işlem",
+  "deployTab.newDeployment": "Yeni Ortama Dağıt",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "Dağıtım ID",
+  "deployTab.panel.endpoints": "Uç noktalar",
+  "deployTab.panel.envVars": "Ortam Değişkenleri",
+  "deployTab.panel.error": "Hata",
+  "deployTab.panel.failedRelease": "Başarısız Sürüm",
+  "deployTab.panel.health": "Sağlık",
+  "deployTab.panel.instanceInfo": "Örnek Bilgisi",
+  "deployTab.panel.modelCreds": "Model Kimlik bilgileri",
+  "deployTab.panel.pluginCreds": "Eklenti Kimlik bilgileri",
+  "deployTab.panel.release": "Sürüm",
+  "deployTab.panel.releaseCreatedAt": "Sürüm Oluşturulma Tarihi",
+  "deployTab.panel.releaseInfo": "Sürüm Bilgisi",
+  "deployTab.panel.replicas": "Kopyalar",
+  "deployTab.panel.run": "Çalıştır",
+  "deployTab.panel.runtimeBindings": "Kimlik bilgileri",
+  "deployTab.panel.runtimeInfo": "Çalışma Zamanı Bilgisi",
+  "deployTab.panel.runtimeMode": "Çalışma Zamanı Modu",
+  "deployTab.panel.runtimeNote": "Çalışma Zamanı Notu",
+  "deployTab.panel.targetRelease": "Hedef Sürüm",
+  "deployTab.panel.unknownError": "Dağıtım başarısız oldu.",
+  "deployTab.promote": "Dağıt",
+  "deployTab.redeploy": "Yeniden Dağıt",
+  "deployTab.releaseCreatedAt": "Sürüm oluşturuldu {{time}}",
+  "deployTab.retry": "Tekrar Dene",
+  "deployTab.shortcut": "Kısayol",
+  "deployTab.status.deployFailed": "Dağıtım başarısız",
+  "deployTab.status.deployingRelease": "Dağıtılıyor ({{release}})",
+  "deployTab.status.runningOutOfSync": "Çalışıyor (eşitleme bekleniyor)",
+  "deployTab.status.runningWithFailed": "Çalışıyor (son dağıtım başarısız)",
+  "deployTab.undeploy": "Dağıtımı Geri Al",
+  "deployTab.undeployConfirmDesc": "Son kullanıcı erişimi hemen duracak. Sürüm daha sonra yeniden dağıtılabilir.",
+  "deployTab.undeployConfirmTitle": "{{name}} ortamından dağıtım geri alınsın mı?",
+  "deployTab.undeployFrom": "{{name}} ortamından dağıtımı geri al",
+  "deployTab.undeployImpactTitle": "Etkilenen örnek",
+  "deployTab.viewError": "Hatayı görüntüle",
+  "deployTab.viewLogs": "Günlükleri görüntüle",
+  "deployTab.viewProgress": "İlerlemeyi görüntüle",
+  "detail.backToInstances": "Dağıtımlara dön",
+  "detail.deployingCount": "{{count}} dağıtılıyor",
+  "detail.envCount_one": "{{count}} ortam",
+  "detail.envCount_other": "{{count}} ortam",
+  "detail.failedCount": "{{count}} başarısız",
+  "detail.mobileTabs": "Dağıtım bölümleri",
+  "detail.notFound": "Dağıtım bulunamadı",
+  "detail.openSourceApp": "Kaynak {{name}} aç",
+  "detail.sourceApp": "Kaynak",
+  "detail.sourceAppLink": "Kaynak",
+  "documentTitle.create": "Yeni dağıtım · Dağıtımlar",
+  "documentTitle.detail": "Dağıtım · Dağıtımlar",
+  "documentTitle.list": "Dağıtımlar",
+  "filter.allEnvs": "Tüm ortamlar",
+  "filter.notDeployed": "Dağıtılmadı",
+  "filter.searchPlaceholder": "Dağıtımları ara",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Kabul",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Başlatılıyor",
+  "health.ENVIRONMENT_STATUS_DELETING": "Siliniyor",
+  "health.ENVIRONMENT_STATUS_FAILED": "Kullanılamıyor",
+  "health.ENVIRONMENT_STATUS_READY": "Kullanılabilir",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Bilinmiyor",
+  "list.clearFilters": "Filtreleri temizle",
+  "list.clearSearch": "Dağıtım aramasını temizle",
+  "list.createDeployment": "Yeni",
+  "list.empty": "Dağıtım bulunamadı.",
+  "list.emptyDescription": "Sürümleri, ortamları ve erişimi yönetmek için bir Workflow App veya Workflow DSL paketinden bir dağıtım oluşturun.",
+  "list.emptyFilteredDescription": "Geçerli arama veya ortam filtresiyle eşleşen dağıtım yok.",
+  "list.emptyFilteredTitle": "Eşleşen dağıtım yok",
+  "list.emptyTitle": "Henüz dağıtım yok",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "İzole",
+  "mode.ENVIRONMENT_MODE_SHARED": "Paylaşılan",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Bilinmiyor",
+  "newInstance.comingSoon": "Yakında",
+  "newInstance.fromStudio": "Studio'dan seç",
+  "newInstance.importDSL": "DSL İçe Aktar",
+  "newInstance.title": "Yeni Dağıtım",
+  "overview.accessEndpoints": "Erişim uç noktaları",
+  "overview.accessMeta.apiTokens": "API Tokenlerini yönet",
+  "overview.accessMeta.cli": "CLI erişimini görüntüle",
+  "overview.accessMeta.webApp": "WebApp erişimini yönet",
+  "overview.accessStatus": "Erişim",
+  "overview.api": "API Tokenleri",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Token",
+  "overview.apiTokenSummary.environments_one": "{{count}} dağıtılmış ortam",
+  "overview.apiTokenSummary.environments_other": "{{count}} dağıtılmış ortam",
+  "overview.availableForDeployment": "Dağıtım için kullanılabilir",
+  "overview.basicInfo": "Temel bilgiler",
+  "overview.cardAction.deployLatest": "En Son Sürümü Dağıt",
+  "overview.cardAction.redeploy": "Yeniden Dağıt",
+  "overview.cardAction.viewProgress": "Dağıtımı görüntüle",
+  "overview.chip.behindTooltip_one": "En son sürümün 1 sürüm gerisinde. Güncellemek için en son sürümü dağıtın.",
+  "overview.chip.behindTooltip_other": "En son sürümün {{count}} sürüm gerisinde. Güncellemek için en son sürümü dağıtın.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "dağıtılıyor",
+  "overview.chip.deployingTooltip": "Dağıtım sürüyor.",
+  "overview.chip.empty": "boş",
+  "overview.chip.emptyTooltip": "Bu ortama hiçbir sürüm dağıtılmadı.",
+  "overview.chip.failed": "başarısız",
+  "overview.chip.failedTooltip": "Son dağıtım denemesi başarısız oldu.",
+  "overview.chip.latest": "en son",
+  "overview.chip.latestTooltip": "Bu ortam en son sürümü çalıştırıyor.",
+  "overview.chip.needsReleaseFirst": "Önce bir Sürüm oluşturun",
+  "overview.chip.olderRelease": "eski",
+  "overview.chip.olderReleaseTooltip": "Bu ortam daha eski bir sürümü çalıştırıyor.",
+  "overview.chip.openInDeployTab": "Dağıtım ilerlemesini görüntüle",
+  "overview.cli": "CLI",
+  "overview.configured": "Yapılandırıldı",
+  "overview.createRelease": "Sürüm Oluştur",
+  "overview.created": "Oluşturuldu",
+  "overview.deploy": "Dağıt",
+  "overview.deployedEnvironments": "dağıtıldı",
+  "overview.deploymentOverview": "Dağıtım genel bakış",
+  "overview.deploymentStatus": "Dağıtım durumu",
+  "overview.description": "Açıklama",
+  "overview.developerApi": "Geliştirici API",
+  "overview.disabled": "Devre dışı",
+  "overview.emptyValue": "Ayarlanmadı",
+  "overview.enabled": "Etkin",
+  "overview.enabledChannels": "erişim etkin",
+  "overview.endUserAccess": "Son kullanıcı erişimi",
+  "overview.environments": "Ortamlar",
+  "overview.hero.byName": "{{name}} tarafından",
+  "overview.hero.empty": "Henüz sürüm yok",
+  "overview.hero.emptyDescription": "Dağıtmadan önce mevcut kaynaktan bir sürüm oluşturun.",
+  "overview.hero.propagation_one": "{{count}}/{{total}} ortama dağıtıldı",
+  "overview.hero.propagation_other": "{{count}}/{{total}} ortama dağıtıldı",
+  "overview.hero.untargeted": "henüz yapılandırılmış ortam yok",
+  "overview.instanceDetails": "Dağıtım detayları",
+  "overview.instanceId": "Dağıtım ID",
+  "overview.latestRelease.releaseCount_one": "{{count}} sürüm",
+  "overview.latestRelease.releaseCount_other": "{{count}} sürüm",
+  "overview.latestReleaseTitle": "En Son Sürüm",
+  "overview.manageDeployments": "Dağıtımları yönet",
+  "overview.name": "Ad",
+  "overview.noAccessConfig": "Erişim yapılandırması yok.",
+  "overview.noReleaseYet": "Bir ortama dağıtmadan önce bir sürüm oluşturun.",
+  "overview.notConfigured": "Yapılandırılmadı",
+  "overview.previousReleases.empty": "Henüz daha eski sürüm yok.",
+  "overview.previousReleases.retired": "Şu anda dağıtılmadı",
+  "overview.previousReleases.title": "Önceki sürümler",
+  "overview.previousReleases.viewAll": "Tümünü Görüntüle",
+  "overview.ready": "Dağıtılabilir",
+  "overview.recentReleases": "Son sürümler",
+  "overview.releaseDeployedTitle": "{{release}} dağıtıldı",
+  "overview.releaseReadyTitle": "{{release}} dağıtıma hazır",
+  "overview.serviceMap": "Servis haritası",
+  "overview.servingRelease": "{{release}} sunuluyor",
+  "overview.servingReleaseDescription": "Bu dağıtım {{count}}/{{total}} ortama dağıtıldı.",
+  "overview.strip.deployToNewEnvironment": "Yeni ortama dağıt",
+  "overview.strip.empty": "Yapılandırılmış ortam yok.",
+  "overview.strip.emptyDeployableDescription": "Hazır olduğunuzda en son sürümü bir ortama dağıtın.",
+  "overview.strip.emptyDeployed": "Henüz örnek yok.",
+  "overview.strip.emptyDescription": "Bir ortama dağıtmadan önce bir sürüm oluşturun.",
+  "overview.strip.emptyTitle": "Henüz örnek yok",
+  "overview.strip.summary_one": "{{total}} örneğin 1 tanesi en son sürümde",
+  "overview.strip.summary_other": "{{total}} örneğin {{count}} tanesi en son sürümde",
+  "overview.strip.title": "Örnekler",
+  "overview.switchSourceApp": "Kaynağı değiştir",
+  "overview.switchSourceAppDescription": "Gelecekteki sürümler için kaynak olarak kullanılan Workflow App'ı seçin.",
+  "overview.switchSourceAppHint": "Geçişten sonra yalnızca yeni oluşturulan sürümler yeni kaynağı kullanır. Geçmiş sürümler ve mevcut dağıtımlar değişmez.",
+  "overview.targetRelease": "Hedef Sürüm",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Tehlike bölgesi",
+  "settings.dangerDesc": "Bu dağıtımı kalıcı olarak silin ve çalışan tüm örnekleri durdurun. Bu geri alınamaz.",
+  "settings.delete": "Dağıtımı Sil",
+  "settings.deleteConfirmDesc": "{{name}} silinsin mi? Her örnek tüm ortamlarda çalışmayı durduracak ve kaldırılacak. Bu geri alınamaz.",
+  "settings.deleteConfirmTitle": "Dağıtımı sil",
+  "settings.deleteFailed": "Dağıtım silinemedi.",
+  "settings.deleteImpact": "Etki",
+  "settings.deleteImpactInstance": "Dağıtım",
+  "settings.deleteImpactTitle": "Etkilenen dağıtım",
+  "settings.deleteImpactValue": "Dağıtım, dağıtım listesinden kaldırılır.",
+  "settings.deleted": "Dağıtım silindi",
+  "settings.description": "Açıklama",
+  "settings.descriptionHelp": "Bu dağıtımın adını, açıklamasını ve diğer ayarlarını yönetin.",
+  "settings.general": "Genel",
+  "settings.name": "Dağıtım adı",
+  "settings.reset": "Sıfırla",
+  "settings.save": "Değişiklikleri Kaydet",
+  "settings.updateFailed": "Dağıtım güncellenemedi.",
+  "settings.updated": "Dağıtım güncellendi",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Dağıtılıyor",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Eşitleme bekleniyor",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Dağıtım başarısız",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Geçersiz",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Çalışıyor",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Dağıtılmadı",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Dağıtım geri alınıyor",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Bilinmiyor",
+  "subtitle": "Ortamlar arasında dağıtımları yönetin.",
+  "tabs.access.description": "Erişim kanallarını ve erişim izinlerini yönetin.",
+  "tabs.access.name": "Erişim",
+  "tabs.api-tokens.description": "API Tokenlerini yönetin ve örnekleri HTTP üzerinden çağırın.",
+  "tabs.api-tokens.name": "API Tokenleri",
+  "tabs.instances.description": "Dağıtılmış ortamlardaki örnekleri görüntüleyin ve yönetin.",
+  "tabs.instances.name": "Örnekler",
+  "tabs.overview.description": "Dağıtımın ortamlar arasındaki durumunu görüntüleyin.",
+  "tabs.overview.name": "Genel Bakış",
+  "tabs.releases.description": "Sürümleri oluşturun, dağıtın ve yönetin.",
+  "tabs.releases.name": "Sürümler",
+  "tabs.settings.description": "Bu dağıtımın adını, açıklamasını ve diğer ayarlarını yönetin.",
+  "tabs.settings.name": "Ayarlar",
+  "title": "Dağıtımlar",
+  "unsupportedDslNodes.description": "Bu sürüm, dağıtım çalışma zamanının henüz desteklemediği düğümler içeriyor. Studio'da bunları kaldırın veya değiştirin, ardından tekrar deneyin.",
+  "unsupportedDslNodes.descriptionWithTypes": "Bu sürüm, dağıtım çalışma zamanının henüz desteklemediği düğümler içeriyor: {{nodeTypes}}. Studio'da bunları kaldırın veya değiştirin, ardından tekrar deneyin.",
+  "unsupportedDslNodes.title": "Desteklenmeyen düğümler",
+  "unsupportedDslNodes.unknownType": "Bilinmeyen tür",
+  "versions.cancelCreate": "İptal",
+  "versions.cancelDelete": "İptal",
+  "versions.cancelEdit": "İptal",
+  "versions.checkingReleaseContent": "Sürüm içeriği kontrol ediliyor...",
+  "versions.col.action": "İşlem",
+  "versions.col.author": "Oluşturan",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Oluşturulma tarihi",
+  "versions.col.deployedTo": "Dağıtıldığı yer",
+  "versions.col.release": "Sürüm",
+  "versions.col.sourceApp": "Kaynak",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Oluştur",
+  "versions.createFailed": "Sürüm oluşturulamadı.",
+  "versions.createRelease": "Sürüm Oluştur",
+  "versions.createReleaseDescription": "Bir Workflow App veya Workflow DSL dosyasından dağıtılabilir bir sürüm oluşturun.",
+  "versions.createReleaseHint": "Yeni sürümler herhangi bir ortama dağıtılabilir.",
+  "versions.createSuccess": "\"{{name}}\" sürümü oluşturuldu.",
+  "versions.creating": "Oluşturuluyor...",
+  "versions.currentOn": "{{name}} üzerindeki Geçerli Sürüm",
+  "versions.deleteConfirmDesc": "\"{{name}}\" sürümü kalıcı olarak silinecek. Bu geri alınamaz.",
+  "versions.deleteConfirmTitle": "Sürüm silinsin mi?",
+  "versions.deleteFailed": "Sürüm silinemedi.",
+  "versions.deleteImpactDeployment": "Dağıtım durumu",
+  "versions.deleteImpactNotDeployed": "Şu anda dağıtılmadı",
+  "versions.deleteImpactRelease": "Sürüm",
+  "versions.deleteImpactTitle": "Silme etkisi",
+  "versions.deleteRelease": "Sürümü Sil",
+  "versions.deleteSuccess": "\"{{name}}\" sürümü silindi.",
+  "versions.deploy": "Dağıt",
+  "versions.deployTo": "{{name}} ortamına dağıt",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Dağıtılıyor",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Eşitleme bekleniyor",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Başarısız",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Geçersiz",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Çalışıyor",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Dağıtılmadı",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Dağıtım geri alınıyor",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Bilinmiyor",
+  "versions.deployingTo": "{{name}} dağıtılıyor",
+  "versions.disabledReason.checkDeploymentsFailed": "Dağıtım kullanımı doğrulanamadı. Daha sonra tekrar deneyin.",
+  "versions.disabledReason.checkingDeployments": "Dağıtım kullanımı kontrol ediliyor",
+  "versions.disabledReason.current": "Bu sürüm zaten {{name}} üzerinde çalışıyor",
+  "versions.disabledReason.deploying": "Aktif dağıtımın bitmesini bekleyin",
+  "versions.disabledReason.envDisabled": "Bu ortam dağıtılabilir değil",
+  "versions.disabledReason.releaseInUse_one": "Silmeden önce bu sürümün {{count}} ortamdan dağıtımını geri alın",
+  "versions.disabledReason.releaseInUse_other": "Silmeden önce bu sürümün {{count}} ortamdan dağıtımını geri alın",
+  "versions.dslReadFailed": "DSL dosyası okunamadı. Başka bir dosya seçip tekrar deneyin.",
+  "versions.dslReading": "DSL dosyası okunuyor...",
+  "versions.dslUnsupportedMode": "Dağıtımlar için yalnızca Workflow DSL dosyaları kullanılabilir.",
+  "versions.editFailed": "Sürüm güncellenemedi.",
+  "versions.editRelease": "Sürümü Düzenle",
+  "versions.editReleaseDescription": "Bu sürümün adını ve açıklamasını güncelleyin.",
+  "versions.editSuccess": "\"{{name}}\" sürümü güncellendi.",
+  "versions.empty": "Henüz kullanılabilir sürüm yok.",
+  "versions.emptyDescription": "Bir ortama dağıtmadan önce ilk sürümü oluşturun.",
+  "versions.emptyTitle": "Henüz sürüm yok",
+  "versions.emptyWithCreate": "Henüz sürüm yok. Dağıtmadan önce ilk dağıtılabilir sürümü oluşturun.",
+  "versions.exportDsl": "DSL Dışa Aktar",
+  "versions.exportDslFailed": "DSL dışa aktarılamadı.",
+  "versions.exportingDsl": "Dışa aktarılıyor...",
+  "versions.groupHeader.deploy": "Dağıt",
+  "versions.groupHeader.promote": "Dağıt",
+  "versions.groupHeader.rollback": "Önceki sürümü dağıt",
+  "versions.groupHeader.unavailable": "Kullanılamıyor",
+  "versions.manualDslOption": "DSL Yükle",
+  "versions.moreActions": "Daha fazla işlem",
+  "versions.optional": "İsteğe bağlı",
+  "versions.promote": "Dağıt",
+  "versions.promoteTo": "{{name}} ortamına dağıt",
+  "versions.releaseAlreadyExists": "Aynı içeriğe sahip bir sürüm zaten var: {{name}}.",
+  "versions.releaseContentCheckFailed": "Sürüm içeriği kontrol edilemedi.",
+  "versions.releaseDescriptionLabel": "Açıklama",
+  "versions.releaseDescriptionPlaceholder": "Bu sürümü açıklayın",
+  "versions.releaseHistory": "Sürüm geçmişi",
+  "versions.releaseNameLabel": "Sürüm Adı",
+  "versions.releaseNamePlaceholder": "Sürüm Adı",
+  "versions.releaseNameRequired": "Bir sürüm adı girin.",
+  "versions.releaseSourceLabel": "Sürüm Kaynağı",
+  "versions.rollbackTo": "{{name}} ortamına dağıt",
+  "versions.saveEdit": "Kaydet",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/tr-TR/workflow.json b/web/i18n/tr-TR/workflow.json
index 8fb401c1c89..c1f21cb59bf 100644
--- a/web/i18n/tr-TR/workflow.json
+++ b/web/i18n/tr-TR/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "Aracı",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Yanıt",
   "blocks.assigner": "Değişken Atayıcı",
   "blocks.code": "Kod",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Değişken Toplayıcı",
   "blocks.variable-assigner": "Değişken Ata",
   "blocksAbout.agent": "Soruları yanıtlamak veya doğal dili işlemek için büyük dil modellerini çağırma",
+  "blocksAbout.agent-v2": "Soruları yanıtlamak veya doğal dili işlemek için büyük dil modellerini çağırma",
   "blocksAbout.answer": "Bir sohbet konuşmasının yanıt içeriğini tanımlayın",
   "blocksAbout.assigner": "Değişken atama düğümü, yazılabilir değişkenlere (konuşma değişkenleri gibi) değer atamak için kullanılır.",
   "blocksAbout.code": "Özel mantığı uygulamak için bir Python veya NodeJS kod parçası yürütün",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "İş Akışı Kimliği",
   "globalVar.fieldsDescription.workflowRunId": "İş akışı yürütme kimliği",
   "globalVar.title": "Sistem Değişkenleri",
+  "nodes.agent.advancedSetting": "Gelişmiş Ayarlar",
   "nodes.agent.checkList.strategyNotSelected": "Strateji seçilmedi",
   "nodes.agent.clickToViewParameterSchema": "Parametre şemasını görüntülemek için tıklayın",
   "nodes.agent.configureModel": "Modeli Yapılandır",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Desteklenmeyen Model",
   "nodes.agent.modelSelectorTooltips.deprecated": "Bu model kullanım dışıdır",
   "nodes.agent.notAuthorized": "Yetkili Değil",
+  "nodes.agent.outputVars.confirm": "Onayla",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Bir JSON dizisi girin.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "true veya false girin.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Dosya varsayılanları henüz burada yapılandırılamaz.",
+  "nodes.agent.outputVars.defaultValueLabel": "Varsayılan",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Geçerli bir sayı girin.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Bir JSON nesnesi girin.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Varsayılan değer",
+  "nodes.agent.outputVars.delete": "{{name}} sil",
+  "nodes.agent.outputVars.descriptionLabel": "Açıklama",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Açıklama ekle",
+  "nodes.agent.outputVars.edit": "{{name}} düzenle",
+  "nodes.agent.outputVars.editorLabel": "Çıktı değişkeni düzenleyici",
   "nodes.agent.outputVars.files.title": "Aracı Tarafından Oluşturulan Dosyalar",
   "nodes.agent.outputVars.files.transfer_method": "Transfer yöntemi. Değer remote_url veya local_file",
   "nodes.agent.outputVars.files.type": "Destek türü. Şimdi sadece görüntüyü destekleyin",
   "nodes.agent.outputVars.files.upload_file_id": "Dosya kimliğini karşıya yükle",
   "nodes.agent.outputVars.files.url": "Resim url'si",
   "nodes.agent.outputVars.json": "Aracı tarafından oluşturulan JSON",
+  "nodes.agent.outputVars.nameDuplicate": "Çıktı adı zaten mevcut",
+  "nodes.agent.outputVars.nameInvalid": "Harfler, sayılar ve alt çizgi kullanın. Bir harf veya alt çizgi ile başlayın.",
+  "nodes.agent.outputVars.nameLabel": "Alan adı",
+  "nodes.agent.outputVars.namePlaceholder": "Alan Adı",
+  "nodes.agent.outputVars.newOutput": "Yeni çıktı",
+  "nodes.agent.outputVars.requiredLabel": "Gerekli",
+  "nodes.agent.outputVars.showAdvancedOptions": "Gelişmiş seçenekleri göster",
   "nodes.agent.outputVars.text": "Temsilci Tarafından Oluşturulan İçerik",
+  "nodes.agent.outputVars.typeLabel": "Çıktı türü",
   "nodes.agent.outputVars.usage": "Model Kullanım Bilgileri",
   "nodes.agent.parameterSchema": "Parametre Şeması",
   "nodes.agent.pluginInstaller.install": "Yükle",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Bu entegrasyon GitHub'dan yüklenmiştir. Lütfen şuraya gidin: Entegrasyonlar yeniden yüklemek için",
   "nodes.agent.pluginNotInstalled": "Bu entegrasyon yüklü değil",
   "nodes.agent.pluginNotInstalledDesc": "Bu entegrasyon GitHub'dan yüklenmiştir. Lütfen şuraya gidin: Entegrasyonlar yeniden yüklemek için",
+  "nodes.agent.roster.change": "Değiştir",
+  "nodes.agent.roster.editInConsole": "Agent Console'da düzenle",
+  "nodes.agent.roster.inlineSetup.description": "Yalnızca bu düğümde yaşayan tek seferlik bir kurulum",
+  "nodes.agent.roster.inlineSetup.name": "Inline kurulum",
+  "nodes.agent.roster.inlineSetup.title": "Ajan kurulumu",
+  "nodes.agent.roster.inlineSetup.type": "Yalnızca bu düğümde",
+  "nodes.agent.roster.label": "Ajan",
+  "nodes.agent.roster.makeCopy": "Kopya oluştur",
+  "nodes.agent.roster.more": "Daha fazla ajan eylemi",
+  "nodes.agent.roster.openPanel": "{{name}} detaylarını aç",
+  "nodes.agent.roster.panelLabel": "{{name}} detayları",
   "nodes.agent.strategy.configureTip": "Lütfen ajan stratejisini yapılandırın.",
   "nodes.agent.strategy.configureTipDesc": "Aracı stratejiyi yapılandırdıktan sonra, bu düğüm kalan yapılandırmaları otomatik olarak yükleyecektir. Strateji, çok adımlı araç akıl yürütme mekanizmasını etkileyecektir.",
   "nodes.agent.strategy.label": "Ajan Stratejisi",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Yüklenen entegrasyon sürümü bu stratejiyi sağlamaz. Sürümü değiştirmek için tıklayın.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} yüklü değil",
   "nodes.agent.strategyNotSet": "Ajan stratejisi Belirlenmedi",
+  "nodes.agent.task.insert": "Ekle",
+  "nodes.agent.task.label": "Ajan görevi",
+  "nodes.agent.task.mention": "Bahset",
+  "nodes.agent.task.placeholder": "Bu ajanın ne yapması gerektiğini açıklayın...",
+  "nodes.agent.task.tooltip": "Bu ajanın bu iş akışında izlemesi gereken görev talimatlarını tanımlayın.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Yetkili Değil",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} yüklü değil",
   "nodes.agent.toolbox": "Araç",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "{{author}} tarafından",
   "tabs.question-understand": "Soruyu Anlama",
   "tabs.requestToCommunity": "Topluluğa yapılan talepler",
-  "tabs.searchBlock": "Arama düğümü",
+  "tabs.searchBlock": "Düğüm, ajan, insan, Bilgi ara",
   "tabs.searchDataSource": "Veri Kaynağında Arama Yapın",
   "tabs.searchSnippets": "Parçacıkları ara...",
   "tabs.searchTool": "Arama aracı",
diff --git a/web/i18n/uk-UA/agent-v-2.json b/web/i18n/uk-UA/agent-v-2.json
new file mode 100644
index 00000000000..09c78652bd0
--- /dev/null
+++ b/web/i18n/uk-UA/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Ця дія поки що недоступна.",
+  "agentDetail.access.actions.monitoring": "Моніторинг",
+  "agentDetail.access.copyAccessUrl": "Скопіювати URL доступу",
+  "agentDetail.access.copyFailed": "Не вдалося скопіювати посилання.",
+  "agentDetail.access.copyReference": "Скопіювати посилання для {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Скопіювати кінцеву точку API сервісу",
+  "agentDetail.access.description": "Усі поверхні, з яких можна звернутися до цього агента.",
+  "agentDetail.access.empty": "Немає пов'язаних точок доступу",
+  "agentDetail.access.emptyDescription": "У цього агента з Roster ще немає посилань на застосунки чи робочі процеси.",
+  "agentDetail.access.entries.agentApp.description": "Агентний застосунок, пов'язаний з цим агентом з Roster.",
+  "agentDetail.access.entries.agentApp.name": "Агентний застосунок",
+  "agentDetail.access.entries.workflow.description": "Робочий процес і посилання на вузол, пов'язані з цим агентом з Roster.",
+  "agentDetail.access.entries.workflow.name": "Вузол робочого процесу",
+  "agentDetail.access.entryCount_one": "{{count}} запис",
+  "agentDetail.access.entryCount_other": "{{count}} записів",
+  "agentDetail.access.groups.references.heading": "Посилання",
+  "agentDetail.access.groups.references.label": "Пов'язані посилання",
+  "agentDetail.access.learnMore": "Дізнатися більше",
+  "agentDetail.access.moreActions": "Більше дій для {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Кінцева точка API сервісу",
+  "agentDetail.access.serviceApi.title": "Бекенд API сервісу",
+  "agentDetail.access.status.disabled": "Вимкнено",
+  "agentDetail.access.status.enabled": "Увімкнено",
+  "agentDetail.access.status.inService": "В роботі",
+  "agentDetail.access.status.outOfService": "Не в роботі",
+  "agentDetail.access.title": "Точка доступу",
+  "agentDetail.access.toggleSurface": "Перемкнути доступ {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL доступу",
+  "agentDetail.access.webApp.actions.customize": "Налаштувати",
+  "agentDetail.access.webApp.actions.embedded": "Вбудувати",
+  "agentDetail.access.webApp.actions.launch": "Запустити",
+  "agentDetail.access.webApp.actions.settings": "Налаштування",
+  "agentDetail.access.webApp.refreshUrl": "Оновити URL доступу",
+  "agentDetail.access.webApp.showQrCode": "Показати QR-код",
+  "agentDetail.access.webApp.ssoEnabled": "SSO увімкнено",
+  "agentDetail.access.webApp.title": "Webapp",
+  "agentDetail.access.workflow.description": "Використовується як вузол у робочому процесі",
+  "agentDetail.access.workflow.empty": "Поки що немає посилань на робочі процеси.",
+  "agentDetail.access.workflow.loadFailed": "Не вдалося завантажити посилання на робочі процеси.",
+  "agentDetail.access.workflow.loading": "Завантаження посилань на робочі процеси…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} вузол",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} вузлів",
+  "agentDetail.access.workflow.notAvailable": "Н/Д",
+  "agentDetail.access.workflow.openInStudio": "Відкрити в Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Відкрити {{name}} в Studio",
+  "agentDetail.access.workflow.table.actions": "Дії",
+  "agentDetail.access.workflow.table.lastUpdated": "Останнє оновлення",
+  "agentDetail.access.workflow.table.name": "Назва",
+  "agentDetail.access.workflow.table.nodes": "Вузли",
+  "agentDetail.access.workflow.table.version": "Версія",
+  "agentDetail.access.workflow.title": "Доступ до робочого процесу",
+  "agentDetail.configure.advancedSettings.description": "Для досвідчених користувачів. Змінні середовища, пісочниця та пам'ять.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Додати змінну середовища",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Видалити {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Сховати значення {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Імпортувати .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Щоб показати приховані файли .env, у вікні вибору файла натисніть Command + Shift + .",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Якщо ваш файл .env прихований, увімкніть відображення прихованих файлів у системному діалозі вибору файлів.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Щоб показати приховані файли .env, увімкніть «Приховані елементи» в Провіднику.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Показати значення {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Виберіть область змінної середовища",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Змінні середовища, доступні цьому агенту під час виконання.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Перемкнути Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Розширені налаштування",
+  "agentDetail.configure.advancedSettings.toggle": "Перемкнути розширені налаштування",
+  "agentDetail.configure.chatFeatures.description": "Налаштуйте чат-досвід кінцевого користувача у вашому веб-застосунку та чат-поверхнях.",
+  "agentDetail.configure.chatFeatures.title": "Функції чату",
+  "agentDetail.configure.files.add": "Додати файл",
+  "agentDetail.configure.files.empty.description": "Завантажте документи, які може читати агент, наприклад специфікації, шаблони чи інструкції",
+  "agentDetail.configure.files.empty.title": "Файлів ще немає",
+  "agentDetail.configure.files.label": "Файли",
+  "agentDetail.configure.files.preview.empty": "Немає вмісту для перегляду.",
+  "agentDetail.configure.files.preview.failed": "Не вдалося завантажити перегляд.",
+  "agentDetail.configure.files.preview.unsupported": "Попередній перегляд цього файлу не підтримується.",
+  "agentDetail.configure.files.remove": "Видалити {{name}}",
+  "agentDetail.configure.files.tip": "Файли, які цей агент може використовувати під час оркестрації задач.",
+  "agentDetail.configure.files.toggle": "Перемкнути файли",
+  "agentDetail.configure.files.treeLabel": "Файли агента",
+  "agentDetail.configure.files.upload.action": "Завантажити",
+  "agentDetail.configure.files.upload.browse": "огляд",
+  "agentDetail.configure.files.upload.description": "Завантажте файл для цього агента.",
+  "agentDetail.configure.files.upload.dropzone": "Перетягніть файл сюди або",
+  "agentDetail.configure.files.upload.failed": "Не вдалося завантажити файл.",
+  "agentDetail.configure.files.upload.fileType": "ФАЙЛ",
+  "agentDetail.configure.files.upload.invalidFile": "Завантажте один файл.",
+  "agentDetail.configure.files.upload.success": "Файл завантажено.",
+  "agentDetail.configure.files.upload.title": "Завантажити файл",
+  "agentDetail.configure.knowledgeRetrieval.add": "Додати пошук по знаннях",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Додати знання",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Натисніть кнопку «+», щоб додати знання",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Знання",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Налаштування пошуку",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Докладніше про пошук по знаннях",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Автоматично",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Умови",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Вимкнено",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Фільтрація за метаданими",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Вручну",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Виберіть режим фільтрації за метаданими",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Назва пошуку по знаннях",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Вирішує агент",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Агент сам формує запит на основі промпта й доступного контексту. Тут нічого налаштовувати не потрібно.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Користувацький запит",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Напишіть фіксований запит для цього джерела пошуку.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Текст користувацького запиту",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Введіть пошуковий запит",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Запит",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Пошук по знаннях · Вирішує агент",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Редагувати {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Підключіть базу знань, по якій агент зможе шукати під час відповіді",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Поки що немає знань",
+  "agentDetail.configure.knowledgeRetrieval.label": "Пошук по знаннях",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Видалити {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Джерела пошуку по знаннях, які цей агент може використовувати під час оркестрації задач.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Перемкнути пошук по знаннях",
+  "agentDetail.configure.model.label": "Модель",
+  "agentDetail.configure.orchestrate": "Оркестрація",
+  "agentDetail.configure.preview.chatFeatures": "Функції чату",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Агент",
+  "agentDetail.configure.preview.empty.description": "Надішліть повідомлення, щоб протестувати поточний чернетку.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Інструкцій ще немає, тому відповіді надходять від базової моделі.",
+  "agentDetail.configure.preview.endUserAuth": "Автентифікація кінцевого користувача",
+  "agentDetail.configure.preview.restart": "Перезапустити перегляд",
+  "agentDetail.configure.preview.title": "Перегляд",
+  "agentDetail.configure.prompt.copied": "Промпт скопійовано",
+  "agentDetail.configure.prompt.copy": "Скопіювати промпт",
+  "agentDetail.configure.prompt.copyFailed": "Не вдалося скопіювати промпт.",
+  "agentDetail.configure.prompt.insert.label": "Вставити",
+  "agentDetail.configure.prompt.insert.question": "Початкове запитання",
+  "agentDetail.configure.prompt.insert.reportFile": "Файл вихідного звіту",
+  "agentDetail.configure.prompt.insert.tenders": "Розпочати тендери",
+  "agentDetail.configure.prompt.label": "Промпт",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Згадати",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Напишіть інструкції тут,",
+  "agentDetail.configure.prompt.tip": "Визначте, як цей агент має інтерпретувати вхідні дані, викликати інструменти та формувати вихідні дані.",
+  "agentDetail.configure.publishBar.draft": "Чернетка",
+  "agentDetail.configure.publishBar.publishUpdate": "Опублікувати оновлення",
+  "agentDetail.configure.publishBar.published": "Опубліковано",
+  "agentDetail.configure.publishBar.publishedAt": "Опубліковано {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Публікація…",
+  "agentDetail.configure.publishBar.saved": "Збережено 5 хв тому",
+  "agentDetail.configure.publishBar.savedAt": "Збережено {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Неопубліковані зміни",
+  "agentDetail.configure.publishBar.upToDate": "Актуально",
+  "agentDetail.configure.publishBar.versionHistory": "Відкрити історію версій",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Залучені робочі процеси",
+  "agentDetail.configure.publishImpact.cancel": "Скасувати",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Ваш агент використовується в",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Зміни вплинуть на них.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "цього агента",
+  "agentDetail.configure.publishImpact.title": "{{action}} до {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} робочий процес",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} робочих процесів",
+  "agentDetail.configure.skills.add": "Додати навичку",
+  "agentDetail.configure.skills.detail.contentRegion": "Вміст деталей навички",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} ФАЙЛІВ",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Файли навички",
+  "agentDetail.configure.skills.detail.files": "Файли",
+  "agentDetail.configure.skills.empty.description": "Навички дають агенту перевикористовну експертизу, яку він може викликати під час роботи",
+  "agentDetail.configure.skills.empty.title": "Поки що немає навичок",
+  "agentDetail.configure.skills.itemType": "Навичка",
+  "agentDetail.configure.skills.label": "Навички",
+  "agentDetail.configure.skills.remove": "Видалити {{name}}",
+  "agentDetail.configure.skills.tip": "Навички, які цей агент може використовувати під час оркестрації задач.",
+  "agentDetail.configure.skills.toggle": "Перемкнути навички",
+  "agentDetail.configure.skills.upload.action": "Завантажити",
+  "agentDetail.configure.skills.upload.browse": "огляд",
+  "agentDetail.configure.skills.upload.description": "Завантажте пакет .zip або .skill для цього агента.",
+  "agentDetail.configure.skills.upload.dropzone": "Перетягніть пакет навички сюди або",
+  "agentDetail.configure.skills.upload.failed": "Не вдалося завантажити навичку.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Завантажте файл .zip або .skill.",
+  "agentDetail.configure.skills.upload.success": "Навичку завантажено.",
+  "agentDetail.configure.skills.upload.title": "Завантажити навичку",
+  "agentDetail.configure.tools.add": "Додати інструмент",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Для розробників",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Встановіть програму командного рядка, яку агент запускає в пісочниці. Потрібне встановлення, зазвичай також API Key.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI-інструмент",
+  "agentDetail.configure.tools.addMenu.tool.description": "Виберіть інструмент, уже доступний у цьому робочому просторі, наприклад веб-пошук чи інтеграції.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Інструмент",
+  "agentDetail.configure.tools.cliDialog.description": "Встановіть CLI-інструмент з будь-якого реєстру пакетів. Агент отримає shell-доступ до наданого ним бінарного файлу.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Редагувати CLI-інструмент",
+  "agentDetail.configure.tools.cliDialog.env.description": "Зберігайте API Key, токени чи секрети, потрібні цьому CLI-інструменту. Значення шифруються у спокої та інжектуються як змінні середовища під час виклику інструмента агентом.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Змінні середовища",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(необов'язково)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "У пісочниці · виконується один раз при першому виклику",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Команда встановлення",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Вставте сюди команду встановлення, напр. npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Команда встановлення обов'язкова.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Докладніше про CLI-інструмент",
+  "agentDetail.configure.tools.cliDialog.name.label": "Назва CLI-інструмента",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Назвіть свій CLI-інструмент",
+  "agentDetail.configure.tools.cliDialog.name.required": "Назва CLI-інструмента обов'язкова.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Ніколи не видно в промпті агента; інжектується лише як $VAR під час виконання",
+  "agentDetail.configure.tools.cliDialog.title": "Додати CLI-інструмент",
+  "agentDetail.configure.tools.cliTool": "CLI-інструмент",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Кінцевий користувач · OAuth",
+  "agentDetail.configure.tools.editAction": "Редагувати {{name}}",
+  "agentDetail.configure.tools.empty.description": "Інструменти дозволяють агенту діяти — наприклад, шукати в інтернеті або викликати ваші застосунки",
+  "agentDetail.configure.tools.empty.title": "Поки що немає інструментів",
+  "agentDetail.configure.tools.label": "Інструменти",
+  "agentDetail.configure.tools.moreActions": "Більше дій для {{name}}",
+  "agentDetail.configure.tools.pluginType": "Інтеграція",
+  "agentDetail.configure.tools.preAuthorize": "Попередня авторизація",
+  "agentDetail.configure.tools.removeAction": "Видалити {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Видалити всі інструменти",
+  "agentDetail.configure.tools.tip": "Інструменти, які цей агент може викликати під час оркестрації задач.",
+  "agentDetail.configure.tools.toggle": "Перемкнути інструменти",
+  "agentDetail.configure.tools.toolTabs.all": "Усі",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Користувацькі",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Інтеграції",
+  "agentDetail.configure.tools.toolTabs.workflow": "Робочий процес",
+  "agentDetail.documentTitle": "Агент",
+  "agentDetail.history": "Історія",
+  "agentDetail.logs.description": "Повні журнали записують стан роботи застосунка, включаючи введення користувача, відповіді агента, планування та використання інструментів.",
+  "agentDetail.logs.empty": "Журнали не знайдено",
+  "agentDetail.logs.filters.period.allTime": "За весь час",
+  "agentDetail.logs.filters.period.label": "Період журналу",
+  "agentDetail.logs.filters.period.last30days": "Останні 30 днів",
+  "agentDetail.logs.filters.period.last7days": "Останні 7 днів",
+  "agentDetail.logs.filters.search.label": "Пошук у журналі",
+  "agentDetail.logs.filters.search.placeholder": "Пошук",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Час останнього створення",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Час останнього оновлення",
+  "agentDetail.logs.filters.source.all": "Джерело",
+  "agentDetail.logs.filters.source.empty": "Джерела не знайдено",
+  "agentDetail.logs.filters.source.label": "Джерело журналу",
+  "agentDetail.logs.filters.source.loadFailed": "Не вдалося завантажити джерела",
+  "agentDetail.logs.filters.source.loading": "Завантаження джерел…",
+  "agentDetail.logs.filters.source.searchLabel": "Пошук джерел",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Пошук",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Робочий процес",
+  "agentDetail.logs.learnMore": "Дізнатися більше",
+  "agentDetail.logs.loadFailed": "Не вдалося завантажити журнали",
+  "agentDetail.logs.loading": "Завантаження журналів…",
+  "agentDetail.logs.notAvailable": "Н/Д",
+  "agentDetail.logs.table.createdTime": "Час створення",
+  "agentDetail.logs.table.endUser": "Кінцевий користувач",
+  "agentDetail.logs.table.messageCount": "Кільк. повідомл.",
+  "agentDetail.logs.table.operationRate": "Рівень операцій",
+  "agentDetail.logs.table.source": "Джерело",
+  "agentDetail.logs.table.title": "Заголовок",
+  "agentDetail.logs.table.unread": "Непрочитані",
+  "agentDetail.logs.table.updatedTime": "Час оновлення",
+  "agentDetail.logs.table.userRate": "Оцінка користувача",
+  "agentDetail.logs.title": "Журнали",
+  "agentDetail.memorySettings.budgetLabel": "Бюджет пам'яті",
+  "agentDetail.memorySettings.description": "Налаштування пам'яті з активного знімка конфігурації.",
+  "agentDetail.memorySettings.export.description": "Експорт пам'яті заплановано на пізніший випуск.",
+  "agentDetail.memorySettings.export.download": "Завантажити",
+  "agentDetail.memorySettings.export.soon": "Скоро",
+  "agentDetail.memorySettings.export.title": "Експортувати поточну пам'ять",
+  "agentDetail.memorySettings.notConfigured": "Не налаштовано",
+  "agentDetail.memorySettings.scopeLabel": "Область пам'яті",
+  "agentDetail.memorySettings.title": "Пам'ять",
+  "agentDetail.metadata.activeVersionLabel": "Активна версія",
+  "agentDetail.metadata.appIdLabel": "ID застосунка",
+  "agentDetail.metadata.description": "Поля Roster тільки для читання, що повертаються бекендом агента.",
+  "agentDetail.metadata.emptyValue": "Недоступно",
+  "agentDetail.metadata.scopeLabel": "Область",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Лише робочий процес",
+  "agentDetail.metadata.sourceLabel": "Джерело",
+  "agentDetail.metadata.statusLabel": "Статус",
+  "agentDetail.metadata.title": "Метадані",
+  "agentDetail.metadata.updatedAtLabel": "Оновлено",
+  "agentDetail.metadata.workflowIdLabel": "ID робочого процесу",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID вузла робочого процесу",
+  "agentDetail.monitoring.change": "{{value}} порівняно з попереднім періодом",
+  "agentDetail.monitoring.dateRangeLabel": "Діапазон дат",
+  "agentDetail.monitoring.description": "Відстежуйте активність перевикористовного агента, вартість і якість взаємодії в робочих процесах.",
+  "agentDetail.monitoring.learnMore": "Дізнатися більше",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Унікальні кінцеві користувачі, що запускали робочі процеси з цим агентом.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Активні користувачі",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Кількість безперервних взаємодій користувача з агентом для цієї точки доступу.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Сер. кількість взаємодій за сесію",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Середня швидкість виведення від початку запиту до завершення.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Швидкість виведення токенів",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Оціночна вартість токенів, створених цим агентом під час запусків робочих процесів.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Використання токенів",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Щоденна кількість AI-розмов, що досягли цього агента через вибрану точку доступу.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Усього розмов",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Щоденна кількість взаємодій з агентом.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Усього повідомлень",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Кількість лайків на 1000 повідомлень для цього агента.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Рівень задоволеності користувачів",
+  "agentDetail.monitoring.pickSource": "Виберіть застосунок",
+  "agentDetail.monitoring.sourceLabel": "Застосунок",
+  "agentDetail.monitoring.sourceTrigger": "Джерело {{name}}",
+  "agentDetail.monitoring.sources.all": "Усі",
+  "agentDetail.monitoring.timeRangeLabel": "Часовий діапазон",
+  "agentDetail.monitoring.timeRanges.custom": "Власний",
+  "agentDetail.monitoring.timeRanges.last30days": "Останні 30 днів",
+  "agentDetail.monitoring.timeRanges.last7days": "Останні 7 днів",
+  "agentDetail.monitoring.timeRanges.today": "Сьогодні",
+  "agentDetail.monitoring.title": "Моніторинг",
+  "agentDetail.monitoring.tokenUsageConsumed": "Спожиті токени",
+  "agentDetail.monitoring.units.tokenPerSecond": "Токен/с",
+  "agentDetail.navigationLabel": "Навігація агента",
+  "agentDetail.publish": "Опублікувати",
+  "agentDetail.publishSoon": "Скоро",
+  "agentDetail.sections.access": "Точка доступу",
+  "agentDetail.sections.configure": "Оркестрація",
+  "agentDetail.sections.logs": "Журнали",
+  "agentDetail.sections.monitoring": "Моніторинг",
+  "agentDetail.subtitle": "ID агента: {{agentId}}",
+  "agentDetail.title": "Агент",
+  "agentDetail.type": "АГЕНТ",
+  "agentDetail.versionHistory.active": "Активна",
+  "agentDetail.versionHistory.empty": "Поки що немає версій",
+  "agentDetail.versionHistory.filter": "Фільтрувати версії",
+  "agentDetail.versionHistory.versionName": "Версія {{version}}",
+  "roster.createAgent": "Створити агента",
+  "roster.createAgentOptions": "Варіанти створення агента",
+  "roster.createDialog.description": "Створіть перевикористовного агента в Roster цього робочого простору.",
+  "roster.createDialog.title": "Створити агента",
+  "roster.createForm.changeIcon": "Змінити іконку агента",
+  "roster.createForm.descriptionLabel": "Опис",
+  "roster.createForm.descriptionOptional": "(необов'язково)",
+  "roster.createForm.descriptionPlaceholder": "напр. Збирає джерела за темою та підсумовує ключові висновки",
+  "roster.createForm.nameLabel": "Ім'я",
+  "roster.createForm.namePlaceholder": "напр. Max",
+  "roster.createForm.nameRequired": "Ім'я обов'язкове.",
+  "roster.createForm.roleLabel": "Роль",
+  "roster.createForm.rolePlaceholder": "напр. Помічник з досліджень",
+  "roster.createForm.roleRequired": "Роль обов'язкова.",
+  "roster.createSuccess": "Агента створено.",
+  "roster.dateTimeFormat": "DD.MM.YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Цього агента буде видалено з активного списку Roster.",
+  "roster.deleteDialog.title": "Видалити {{name}}?",
+  "roster.deleteFailed": "Не вдалося видалити агента.",
+  "roster.deleteSuccess": "Агента видалено.",
+  "roster.duplicateFailed": "Не вдалося продублювати агента.",
+  "roster.duplicateSuccess": "Агента продубльовано.",
+  "roster.editAgent": "Редагувати {{name}}",
+  "roster.editDialog.description": "Оновіть ім'я в Roster, опис і роль для цього агента.",
+  "roster.editDialog.title": "Редагувати агента",
+  "roster.editInfo": "Редагувати інформацію",
+  "roster.empty": "Поки що немає агентів",
+  "roster.emptyDescription": "Агенти, збережені в цьому робочому просторі, з'являться тут.",
+  "roster.emptySearch": "Немає відповідних агентів",
+  "roster.emptySearchDescription": "Спробуйте інше ім'я агента.",
+  "roster.filters.all": "Усі",
+  "roster.filters.drafts": "Чернетки",
+  "roster.filters.label": "Фільтри агентів",
+  "roster.filters.published": "Опубліковані",
+  "roster.learnMore": "Докладніше про Agent Roster",
+  "roster.listLabel": "Список Roster агентів",
+  "roster.loadMore": "Завантажити ще",
+  "roster.loadingError": "Не вдалося завантажити агентів. Оновіть і спробуйте ще раз.",
+  "roster.moreActions": "Більше дій для {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Не вдалося створити вбудованого агента. Оновіть і спробуйте ще раз.",
+  "roster.nodeSelector.dialogLabel": "Виберіть агента",
+  "roster.nodeSelector.manageInAgentConsole": "Керувати в Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Пошук…",
+  "roster.nodeSelector.startFromScratch": "Почати з нуля",
+  "roster.references.label": "Робочі процеси, що використовують {{name}}",
+  "roster.references.trigger": "Робочі процеси, що використовують {{name}}",
+  "roster.searchLabel": "Пошук агентів",
+  "roster.searchPlaceholder": "Пошук агентів за ім'ям…",
+  "roster.sources.agent_app": "Агентний застосунок",
+  "roster.sources.imported": "Імпортовані",
+  "roster.sources.system": "Системні",
+  "roster.sources.workflow": "Робочий процес",
+  "roster.status.active": "Активний",
+  "roster.status.archived": "Архівований",
+  "roster.tabs.agent": "Агент",
+  "roster.tabs.human": "Людина",
+  "roster.tabsLabel": "Тип Roster",
+  "roster.updateSuccess": "Агента оновлено.",
+  "roster.usageStatus.draft": "Чернетка"
+}
diff --git a/web/i18n/uk-UA/app-log.json b/web/i18n/uk-UA/app-log.json
index 1c5202f0fd0..5b3ff87fc60 100644
--- a/web/i18n/uk-UA/app-log.json
+++ b/web/i18n/uk-UA/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Сьогодні",
   "filter.period.yearToDate": "Рік до сьогодні",
   "filter.sortBy": "Сортувати за:",
+  "monitoring.description": "Моніторинг фіксує робочий стан застосунку, зокрема продуктивність, активність користувачів і витрати.",
   "promptLog": "Журнал Запитань",
   "runDetail.fileListDetail": "Деталь",
   "runDetail.fileListLabel": "Подробиці файлу",
diff --git a/web/i18n/uk-UA/app.json b/web/i18n/uk-UA/app.json
index c2673359135..2bdcb3b71bb 100644
--- a/web/i18n/uk-UA/app.json
+++ b/web/i18n/uk-UA/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "Структуровані виходи - це функція, яка забезпечує, що модель завжди генеруватиме відповіді, що відповідають наданій вами схемі JSON.",
   "studio.allApps": "Усі застосунки",
   "studio.apps": "програми",
-  "studio.filters.allCreators": "Всі творці",
-  "studio.filters.creators": "Творці",
+  "studio.filters.allCreators": "Усі автори",
+  "studio.filters.creators": "Автори",
   "studio.filters.reset": "Скинути",
   "studio.filters.searchCreators": "Творець пошуку...",
   "studio.filters.types": "Типи",
diff --git a/web/i18n/uk-UA/billing.json b/web/i18n/uk-UA/billing.json
index a4dcd680db0..20838f04c75 100644
--- a/web/i18n/uk-UA/billing.json
+++ b/web/i18n/uk-UA/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Оновіть, щоб розблокувати пакетне завантаження документів",
   "upgrade.uploadMultiplePages.description": "Ви досягли ліміту завантаження — на вашому поточному плані можна вибрати та завантажити лише один документ одночасно.",
   "upgrade.uploadMultiplePages.title": "Оновіть, щоб завантажувати кілька документів одночасно",
+  "upgrade.workflowRestore.description": "Відновлення версій робочого процесу недоступне у вашому поточному плані.",
+  "upgrade.workflowRestore.title": "Оновіть план, щоб відновлювати версії робочого процесу",
   "upgradeBtn.encourage": "Оновити зараз",
   "upgradeBtn.encourageShort": "Оновити",
   "upgradeBtn.plain": "Оновити план",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index 6a9adcf4868..c9876452149 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Перемкнути робочий простір",
   "mcpPage.description": "Підключайте й керуйте MCP-серверами, щоб ваші застосунки мали доступ до зовнішніх інструментів і сервісів.",
-  "members.admin": "Адміністратор",
   "members.adminTip": "Може створювати програми та керувати налаштуваннями команди",
+  "members.alreadyInTeam": "Уже в команді",
+  "members.alreadyInTeamTip": "Ці користувачі вже мають доступ до цього робочого простору.",
   "members.builder": "Будівник",
   "members.builderTip": "Може створювати та редагувати власні програми",
-  "members.datasetOperator": "Адміністратор знань",
   "members.datasetOperatorTip": "Тільки може управляти базою знань",
   "members.deleteMember": "Видалити учасника",
   "members.disInvite": "Скасувати запрошення",
-  "members.editor": "Редактор",
   "members.editorTip": "Може створювати програми, але не може керувати налаштуваннями команди",
   "members.email": "Електронна пошта",
   "members.emailInvalid": "Недійсний формат електронної пошти",
@@ -270,13 +269,12 @@
   "members.invite": "Додати",
   "members.inviteTeamMember": "Додати учасника команди",
   "members.inviteTeamMemberTip": "Вони зможуть отримати доступ до даних вашої команди безпосередньо після входу.",
-  "members.invitedAsRole": "Запрошено як користувача {{role}}",
+  "members.invitedAsRole": "Запрошено як {{role}}",
   "members.lastActive": "ОСТАННЯ АКТИВНІСТЬ",
   "members.name": "ІМ'Я",
-  "members.normal": "Звичайний",
+  "members.noNewInvitationsSent": "Нові запрошення не надіслано",
   "members.normalTip": "Може лише використовувати програми, не може створювати програми",
   "members.ok": "ОК",
-  "members.owner": "Власник",
   "members.pending": "В очікуванні...",
   "members.removeFromTeam": "Видалити з команди",
   "members.removeFromTeamTip": "Буде видалено доступ до команди",
@@ -311,12 +309,14 @@
   "menus.apps": "Студія",
   "menus.datasets": "Знання",
   "menus.datasetsTips": "СКОРО:  імпортуйте власні текстові дані або пишіть дані в реальному часі через Webhook для покращення контексту LLM.",
+  "menus.deployments": "Розгортання",
   "menus.explore": "Досліджувати",
   "menus.exploreMarketplace": "Дізнайтеся більше про Marketplace",
   "menus.newApp": "Нова програма",
   "menus.newDataset": "Створити знання",
   "menus.plugins": "Інтеграції",
   "menus.pluginsTips": "Інтегруйте сторонні інтеграції або створіть AI-сумісні інтеграції.",
+  "menus.roster": "Список агентів",
   "menus.status": "бета",
   "menus.tools": "Інструменти",
   "model.addMoreModel": "Перейдіть до налаштувань, щоб додати більше моделей",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Модель перетворення тексту в мовлення",
   "modelProvider.ttsModel.tip": "Встановіть модель за замовчуванням для введення тексту в мовлення в розмові.",
   "modelProvider.upgradeForLoadBalancing": "Оновіть свій план, щоб увімкнути балансування навантаження.",
+  "navigation.skipToMain": "Перейти до основного вмісту",
   "noData": "Немає даних",
   "operation.add": "Додати",
   "operation.added": "Додано",
@@ -600,9 +601,6 @@
   "placeholder.input": "Будь ласка, введіть текст",
   "placeholder.search": "Пошук...",
   "placeholder.select": "Будь ласка, оберіть параметр",
-  "plugin.serpapi.apiKey": "Ключ API",
-  "plugin.serpapi.apiKeyPlaceholder": "Введіть свій ключ API",
-  "plugin.serpapi.keyFrom": "Отримайте свій ключ SerpAPI зі сторінки облікового запису SerpAPI",
   "promptEditor.context.item.desc": "Вставити шаблон контексту",
   "promptEditor.context.item.title": "Контекст",
   "promptEditor.context.modal.add": "Додати контекст",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
new file mode 100644
index 00000000000..7742e37e0fa
--- /dev/null
+++ b/web/i18n/uk-UA/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API бекенд-сервісу",
+  "access.api.copyCurlExample": "Копіювати приклад cURL",
+  "access.api.createFailed": "Не вдалося згенерувати API Token.",
+  "access.api.createKey": "Згенерувати API Token",
+  "access.api.createKeyTitle": "Згенерувати новий API Token",
+  "access.api.curlExampleTitle": "Приклад cURL",
+  "access.api.description": "Доступ до цього розгортання через HTTP. Кожен API Token прив'язаний до одного середовища.",
+  "access.api.developerTitle": "API для розробників",
+  "access.api.disabled": "Доступ до API вимкнено для цього розгортання.",
+  "access.api.disabledHint": "Увімкніть доступ до API, щоб генерувати токени, прив'язані до середовища.",
+  "access.api.dismissToken": "Закрити API Token",
+  "access.api.docs": "Документація API",
+  "access.api.docsClose": "Закрити документацію API",
+  "access.api.docsDescription": "Перегляньте довідник Workflow API для цього розгортання.",
+  "access.api.docsTitle": "Документація Workflow API",
+  "access.api.empty": "Розгорніть у середовищі, щоб почати випускати API Tokens.",
+  "access.api.emptyTitle": "Немає розгорнутих середовищ",
+  "access.api.endpoint": "URL запиту",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Список API Tokens",
+  "access.api.nameLabel": "Назва API Token",
+  "access.api.namePlaceholder": "Введіть назву API Token",
+  "access.api.nameRequired": "Назва API Token є обов'язковою.",
+  "access.api.newKey": "Згенерувати новий API Token",
+  "access.api.newTokenDescription": "Цей API Token показується лише один раз. Скопіюйте його перед тим, як залишити цю сторінку.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token згенеровано",
+  "access.api.noKeys": "Поки що немає API Tokens. Згенеруйте один, щоб почати викликати API.",
+  "access.api.noKeysTitle": "Поки що немає API Tokens",
+  "access.api.revokeConfirmDescription": "API Token \"{{name}}\" негайно припинить роботу. Цю дію не можна скасувати.",
+  "access.api.revokeConfirmTitle": "Відкликати API Token?",
+  "access.api.revokeFailed": "Не вдалося відкликати API Token.",
+  "access.api.revokeSuccess": "API Token відкликано",
+  "access.api.table.action": "Дія",
+  "access.api.table.environment": "Середовище",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Назва",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Канал",
+  "access.channels.col.endpoint": "Точка входу",
+  "access.channels.col.status": "Статус",
+  "access.channels.description": "Точки входу WebApp та CLI використовують наведені вище дозволи доступу.",
+  "access.channels.disabled": "Канали доступу вимкнено для цього розгортання.",
+  "access.channels.disabledHint": "Увімкніть канали доступу, щоб надати точки входу WebApp та CLI.",
+  "access.channels.followPermission": "Слідує дозволам",
+  "access.channels.title": "Канали доступу",
+  "access.cli.description": "Викликайте з терміналу за допомогою difyctl, підходить для скриптів, автоматизованих процесів або інтеграцій з агентами.",
+  "access.cli.docs": "Посібник з використання",
+  "access.cli.domain": "Домен",
+  "access.cli.empty": "Точку входу CLI не налаштовано.",
+  "access.cli.install": "Встановити CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Скопійовано",
+  "access.copy": "Копіювати",
+  "access.copyFailed": "Не вдалося скопіювати",
+  "access.copyToast": "Скопійовано до буфера обміну",
+  "access.hide": "Сховати",
+  "access.members.clearAll": "Очистити все",
+  "access.members.empty": "Збігів не знайдено.",
+  "access.members.groupCount_one": "{{count}} група",
+  "access.members.groupCount_other": "{{count}} груп",
+  "access.members.groups": "Групи",
+  "access.members.individuals": "Учасники",
+  "access.members.memberCount_one": "{{count}} учасник",
+  "access.members.memberCount_other": "{{count}} учасників",
+  "access.members.pickPlaceholder": "Виберіть групи або учасників",
+  "access.members.searchPlaceholder": "Пошук груп і учасників",
+  "access.members.selectedLabel": "Вибрано",
+  "access.permission.anyone": "Будь-хто з посиланням",
+  "access.permission.anyoneDesc": "Будь-хто може отримати доступ до цього розгортання без входу.",
+  "access.permission.memberCount_one": "{{count}} учасник",
+  "access.permission.memberCount_other": "{{count}} учасників",
+  "access.permission.organization": "Усі учасники платформи",
+  "access.permission.organizationDesc": "Усі учасники платформи",
+  "access.permission.specific": "Певні учасники платформи",
+  "access.permission.specificDesc": "Виберіть певні групи або учасників",
+  "access.permission.specificUnavailable": "Вибір окремих учасників вимкнено, доки не будуть підключені реальні учасники та групи платформи.",
+  "access.permission.updateFailed": "Не вдалося оновити політику доступу.",
+  "access.permissions.col.environment": "Середовище",
+  "access.permissions.col.permission": "Доступ",
+  "access.permissions.description": "Налаштуйте дозволи доступу для точок входу WebApp та CLI у кожному середовищі.",
+  "access.permissions.editAriaLabel": "Налаштувати доступ для {{environment}}",
+  "access.permissions.editDescription": "Налаштуйте дозволи доступу для точок входу WebApp та CLI.",
+  "access.permissions.editTitle": "Дозволи доступу",
+  "access.permissions.title": "Дозволи доступу",
+  "access.revoke": "Відкликати",
+  "access.runAccess.description": "Керуйте тим, як користувачі можуть запускати це розгортання та кому дозволено доступ у кожному середовищі.",
+  "access.runAccess.disabled": "Доступ до запуску вимкнено для цього розгортання.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Надайте це розгортання як сервер Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Точку входу MCP не налаштовано.",
+  "access.runAccess.noEnvs": "Розгорніть у середовищі, щоб налаштувати дозволи доступу.",
+  "access.runAccess.noEnvsTitle": "Немає розгорнутих середовищ",
+  "access.runAccess.openWebapp": "Відкрити WebApp",
+  "access.runAccess.permissions": "Дозволи доступу",
+  "access.runAccess.permissionsDesc": "Хто може отримати доступ до цього розгортання в кожному середовищі.",
+  "access.runAccess.title": "Доступ до запуску",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Розміщена вебсторінка для кінцевих користувачів.",
+  "access.runAccess.webappEmpty": "Скоро.",
+  "access.show": "Показати",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Зовнішній",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Невідомо",
+  "card.access.api": "API Tokens",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Немає доступу",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Створити перший Реліз",
+  "card.deploy": "Розгорнути",
+  "card.deploying": "{{count}} розгортається",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} не вдалося",
+  "card.fromApp": "З {{name}}",
+  "card.lastDeployed": "Востаннє розгорнуто {{time}}",
+  "card.menu.delete": "Видалити розгортання",
+  "card.menu.deleteDisabled": "Видалення розгортань, керованих бекендом, поки що недоступне.",
+  "card.menu.deploy": "Розгорнути в Середовище",
+  "card.menu.editInfo": "Редагувати інформацію",
+  "card.menu.viewDetail": "Переглянути деталі розгортання",
+  "card.moreActions": "Більше дій",
+  "card.neverDeployed": "Ще не розгорнуто",
+  "card.noDescription": "Опис не надано.",
+  "card.notDeployed": "Не розгорнуто",
+  "card.ready": "{{count}} запущено",
+  "card.tooltip.createdAt": "Створено",
+  "card.tooltip.deployed": "Розгорнуто",
+  "card.tooltip.deploymentStatus": "Розгортання",
+  "card.tooltip.notDeployed": "Це розгортання ще не розгорнуто в жодному середовищі.",
+  "card.tooltip.notDeployedShort": "Не розгорнуто",
+  "card.tooltip.release": "Реліз",
+  "card.tooltip.releaseName": "Назва Релізу",
+  "card.tooltip.source": "Джерело",
+  "common.loadFailed": "Не вдалося завантажити. Спробуйте пізніше.",
+  "common.loading": "Завантаження...",
+  "createGuide.actions.back": "Назад",
+  "createGuide.actions.cancel": "Скасувати",
+  "createGuide.actions.continue": "Продовжити",
+  "createGuide.actions.createAndDeploy": "Створити й розгорнути",
+  "createGuide.actions.creating": "Створення...",
+  "createGuide.actions.deploy": "Розгорнути",
+  "createGuide.actions.deploying": "Створення та розгортання...",
+  "createGuide.actions.next": "Далі",
+  "createGuide.actions.skipDeploy": "Пропустити, розгорнути пізніше",
+  "createGuide.description": "Створіть розгортання з джерела релізу, базової інформації та цільового середовища.",
+  "createGuide.dsl.defaultAppName": "Імпортована DSL програма",
+  "createGuide.dsl.description": "Завантажте пакет Workflow DSL, щоб створити розгортання, перший реліз і необов'язкове розгортання середовища.",
+  "createGuide.dsl.dropDescription": "Завантажте пакет Workflow YAML DSL. Параметри розгортання визначаються з цього файлу перед розгортанням.",
+  "createGuide.dsl.dropTitle": "Завантажити пакет Workflow DSL",
+  "createGuide.dsl.readFailed": "Не вдалося прочитати файл DSL. Виберіть інший файл і спробуйте ще раз.",
+  "createGuide.dsl.reading": "Читання файлу DSL...",
+  "createGuide.dsl.title": "Імпортувати DSL",
+  "createGuide.dsl.unsupportedMode": "Для розгортань можна використовувати лише файли Workflow DSL.",
+  "createGuide.errors.createReleaseFailed": "Не вдалося створити розгортання або реліз.",
+  "createGuide.errors.deployFailed": "Не вдалося розгорнути у середовищі.",
+  "createGuide.method.description": "Виберіть джерело, яке використовуватиметься для створення першого релізу.",
+  "createGuide.methods.bindApp.description": "Використовуйте існуючу програму Workflow в Studio як джерело релізу.",
+  "createGuide.methods.bindApp.title": "Прив'язати існуючу програму Workflow",
+  "createGuide.methods.importDsl.description": "Завантажте пакет Workflow YAML DSL і продовжте через UI розгортання.",
+  "createGuide.methods.importDsl.title": "Імпортувати DSL",
+  "createGuide.methods.mocked": "Імітований",
+  "createGuide.nav.back": "Розгортання",
+  "createGuide.release.defaultName": "початковий реліз",
+  "createGuide.release.deployInfo": "Інформація про розгортання",
+  "createGuide.release.description": "Заповніть інформацію про розгортання та деталі першого релізу.",
+  "createGuide.release.firstVersion": "Перший Реліз",
+  "createGuide.release.instanceDescription": "Опис розгортання",
+  "createGuide.release.instanceDescriptionPlaceholder": "Опишіть, для чого використовується це розгортання",
+  "createGuide.release.instanceName": "Назва розгортання",
+  "createGuide.release.instanceNameConflict": "Розгортання з такою назвою вже існує. Виберіть іншу назву.",
+  "createGuide.release.releaseDescription": "Опис Релізу",
+  "createGuide.release.releaseDescriptionPlaceholder": "Опишіть цей реліз",
+  "createGuide.release.releaseName": "Назва Релізу",
+  "createGuide.release.releaseNote": "Опис Релізу",
+  "createGuide.release.title": "Базова інформація",
+  "createGuide.source.availableApps_one": "{{count}} програма",
+  "createGuide.source.availableApps_other": "{{count}} програм",
+  "createGuide.source.clearSearch": "Очистити пошук програм",
+  "createGuide.source.description": "Виберіть джерело, яке використовуватиметься для створення першого релізу.",
+  "createGuide.source.empty": "Програм Workflow не знайдено.",
+  "createGuide.source.searchPlaceholder": "Пошук програм",
+  "createGuide.source.sourceApp": "Workflow програма",
+  "createGuide.source.title": "Джерело Релізу",
+  "createGuide.steps.method": "Джерело Релізу",
+  "createGuide.steps.release": "Базова інформація",
+  "createGuide.steps.source": "Джерело Релізу",
+  "createGuide.steps.target": "Розгорнути в Середовище",
+  "createGuide.target.bindingCount_one": "{{count}} прив'язка",
+  "createGuide.target.bindingCount_other": "{{count}} прив'язок",
+  "createGuide.target.bindingHint": "Виберіть облікові дані, які використовуватиме цей реліз.",
+  "createGuide.target.bindings": "Облікові дані",
+  "createGuide.target.deferredBindingHint": "Облікові дані будуть визначені з реального плану розгортання під час фінальної дії розгортання.",
+  "createGuide.target.deferredEnvironmentHint": "Назва зіставляється з реальними середовищами після створення розгортання та релізу.",
+  "createGuide.target.description": "Виберіть цільове Середовище та надайте необхідні налаштування виконання, які потрібні цьому релізу. Цей крок можна пропустити.",
+  "createGuide.target.envVarCount_one": "{{count}} змінна",
+  "createGuide.target.envVarCount_other": "{{count}} змінних",
+  "createGuide.target.envVarHint": "Для кожної змінної середовища, необхідної цьому релізу, введіть власне значення або використовуйте значення, визначене у програмі.",
+  "createGuide.target.envVarPlaceholder": "Введіть значення",
+  "createGuide.target.envVarSource.ariaLabel": "Виберіть джерело значення змінної для {{key}}",
+  "createGuide.target.envVarSource.default": "Значення програми",
+  "createGuide.target.envVarSource.lastDeployment": "Останнє розгорнуте значення",
+  "createGuide.target.envVarSource.literal": "Власне значення",
+  "createGuide.target.envVarType.number": "Число",
+  "createGuide.target.envVarType.secret": "Секрет",
+  "createGuide.target.envVarType.string": "Рядок",
+  "createGuide.target.envVars": "Змінні середовища",
+  "createGuide.target.environment": "Цільове Середовище",
+  "createGuide.target.environmentName": "Назва Середовища",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "Не вдалося завантажити облікові дані.",
+  "createGuide.target.loadEnvironmentsFailed": "Не вдалося завантажити середовища розгортання.",
+  "createGuide.target.missingRequiredBinding": "Виберіть облікові дані для цієї обов'язкової прив'язки.",
+  "createGuide.target.noBindingRequired": "Облікові дані не потрібні.",
+  "createGuide.target.noCredentialCandidates": "Немає доступних облікових даних.",
+  "createGuide.target.noEnvironmentOptions": "Немає доступних середовищ розгортання.",
+  "createGuide.target.required": "Обов'язково",
+  "createGuide.target.selectCredential": "Виберіть облікові дані",
+  "createGuide.target.title": "Розгорнути в Середовище",
+  "createGuide.title": "Нове розгортання",
+  "createModal.appPickerPlaceholder": "Виберіть Workflow програму",
+  "createModal.appSearchEmpty": "Немає відповідних Workflow програм",
+  "createModal.appSearchPlaceholder": "Пошук Workflow програм…",
+  "createModal.cancel": "Скасувати",
+  "createModal.create": "Створити",
+  "createModal.createFailed": "Не вдалося створити розгортання.",
+  "createModal.description": "Виберіть Workflow програму та створіть розгортання.",
+  "createModal.descriptionLabel": "Опис",
+  "createModal.descriptionPlaceholder": "Опишіть, для чого використовується це розгортання",
+  "createModal.loadMoreApps": "Завантажити більше програм",
+  "createModal.loadingApps": "Завантаження програм…",
+  "createModal.nameLabel": "Назва розгортання",
+  "createModal.namePlaceholder": "Назва розгортання",
+  "createModal.noApps": "У цьому робочому просторі не знайдено Workflow програм. Створіть її в Studio спочатку.",
+  "createModal.selected": "Вибрано",
+  "createModal.sourceApp": "Workflow програма (обов'язково)",
+  "createModal.title": "Нове розгортання",
+  "deployDrawer.bindingCount_one": "{{count}} прив'язка",
+  "deployDrawer.bindingCount_other": "{{count}} прив'язок",
+  "deployDrawer.bindingOptionsFailed": "Не вдалося завантажити параметри облікових даних.",
+  "deployDrawer.bindingSelectionHint": "Виберіть облікові дані, які використовуватиме це розгортання.",
+  "deployDrawer.bindingsDisabled": "Визначається з попереднього перегляду релізу. Редагування поки що недоступне.",
+  "deployDrawer.cancel": "Скасувати",
+  "deployDrawer.close": "Закрити панель розгортання",
+  "deployDrawer.defaultSelect": "Виберіть...",
+  "deployDrawer.deploy": "Розгорнути в Середовище",
+  "deployDrawer.deployExistingRelease": "Розгорнути в Середовище",
+  "deployDrawer.deployExistingReleaseDescription": "Виберіть реліз та цільове середовище для розгортання.",
+  "deployDrawer.deployExistingReleaseTitle": "Розгорнути в Середовище",
+  "deployDrawer.deployFailed": "Не вдалося розпочати розгортання.",
+  "deployDrawer.deploying": "Розгортання...",
+  "deployDrawer.description": "Виберіть реліз та цільове середовище для розгортання.",
+  "deployDrawer.envVarCount_one": "{{count}} змінна",
+  "deployDrawer.envVarCount_other": "{{count}} змінних",
+  "deployDrawer.envVarHint": "Для кожної змінної середовища, необхідної цьому релізу, введіть власне значення або використовуйте значення, визначене у програмі.",
+  "deployDrawer.envVarPlaceholder": "Введіть значення",
+  "deployDrawer.envVarSource.ariaLabel": "Виберіть джерело значення змінної для {{key}}",
+  "deployDrawer.envVarSource.default": "Значення програми",
+  "deployDrawer.envVarSource.lastDeployment": "Останнє розгорнуте значення",
+  "deployDrawer.envVarSource.literal": "Власне значення",
+  "deployDrawer.envVarType.number": "Число",
+  "deployDrawer.envVarType.secret": "Секрет",
+  "deployDrawer.envVarType.string": "Рядок",
+  "deployDrawer.envVars": "Змінні середовища",
+  "deployDrawer.existingReleaseHint": "Цей реліз буде розгорнуто як є. Новий реліз не створюватиметься.",
+  "deployDrawer.loadingBindings": "Визначення...",
+  "deployDrawer.lockedHint": "Зафіксовано до поточного середовища",
+  "deployDrawer.missingRequiredBinding": "Виберіть облікові дані для цієї обов'язкової прив'язки.",
+  "deployDrawer.missingRequiredEnvVar": "Введіть значення для цієї обов'язкової змінної середовища.",
+  "deployDrawer.modelCreds": "Облікові дані моделі",
+  "deployDrawer.needsValidation": " (потребує перевірки)",
+  "deployDrawer.newReleaseHint": "З вибраного YAML Workflow програми буде створено новий реліз.",
+  "deployDrawer.noBindingRequired": "Не потрібно",
+  "deployDrawer.noCredentialCandidates": "Немає доступних облікових даних.",
+  "deployDrawer.noNewEnvironmentAvailable": "У всіх доступних середовищах вже є розгортання.",
+  "deployDrawer.noOtherReleaseAvailable": "Для цього середовища немає інших доступних релізів.",
+  "deployDrawer.noReleaseAvailable": "Створіть реліз перед розгортанням у середовищі.",
+  "deployDrawer.notFound": "Розгортання не знайдено.",
+  "deployDrawer.noteLabel": "Опис Релізу (необов'язково)",
+  "deployDrawer.notePlaceholder": "напр. Доопрацювання тексту онбордингу",
+  "deployDrawer.pluginCreds": "Облікові дані плагіна",
+  "deployDrawer.promote": "Розгорнути",
+  "deployDrawer.promoteDescription": "Виберіть реліз та цільове середовище для розгортання.",
+  "deployDrawer.promoteTitle": "Розгорнути в Середовище",
+  "deployDrawer.readOnly": "Лише для читання",
+  "deployDrawer.redeploy": "Розгорнути в Середовище",
+  "deployDrawer.redeployDescription": "Виберіть реліз та цільове середовище для розгортання.",
+  "deployDrawer.redeployExistingReleaseHint": "Поточний реліз буде перерозгорнуто як є. Новий реліз не створюватиметься.",
+  "deployDrawer.redeployTitle": "Розгорнути в Середовище",
+  "deployDrawer.releaseLabel": "Реліз",
+  "deployDrawer.requiredBinding": "Обов'язково",
+  "deployDrawer.rollback": "Розгорнути",
+  "deployDrawer.rollbackDescription": "Виберіть реліз та цільове середовище для розгортання.",
+  "deployDrawer.rollbackTitle": "Розгорнути в Середовище",
+  "deployDrawer.runtimeCredentials": "Облікові дані",
+  "deployDrawer.secretPlaceholder": "секрет",
+  "deployDrawer.selectCredential": "Виберіть облікові дані",
+  "deployDrawer.selectEnv": "Виберіть Середовище",
+  "deployDrawer.selectProviderCred": "Виберіть облікові дані {{provider}}",
+  "deployDrawer.selectProviderKey": "Виберіть ключ {{provider}}",
+  "deployDrawer.selectRelease": "Виберіть Реліз",
+  "deployDrawer.targetEnv": "Цільове Середовище",
+  "deployDrawer.title": "Розгорнути в Середовище",
+  "deployDrawer.valuePlaceholder": "значення",
+  "deployTab.cancelDeployment": "Скасувати розгортання",
+  "deployTab.closeError": "Закрити",
+  "deployTab.col.actions": "Дії",
+  "deployTab.col.currentRelease": "Поточний Реліз",
+  "deployTab.col.environment": "Середовище",
+  "deployTab.col.status": "Статус",
+  "deployTab.col.updated": "Оновлено",
+  "deployTab.collapseDetails": "Згорнути деталі розгортання",
+  "deployTab.confirmUndeploy": "Скасувати розгортання",
+  "deployTab.deployOtherVersion": "Розгорнути інший Реліз",
+  "deployTab.deployToEnv": "Розгорнути в {{name}}",
+  "deployTab.deployToNewEnv": "Розгорнути в нове Середовище...",
+  "deployTab.empty": "Поки що немає Екземплярів. Розгорніть у новому Середовищі, щоб почати.",
+  "deployTab.emptyDescription": "Виберіть реліз і цільове Середовище, щоб зробити це розгортання доступним для користувачів.",
+  "deployTab.emptyTitle": "Жодне Середовище ще не запущено",
+  "deployTab.envCount": "Середовища",
+  "deployTab.errorCode": "Код",
+  "deployTab.errorDialogDesc": "Перегляньте останнє невдале розгортання перед повторною спробою або розгортанням іншого релізу.",
+  "deployTab.errorDialogTitle": "Помилка розгортання в {{name}}",
+  "deployTab.errorMessage": "Повідомлення",
+  "deployTab.errorPhase": "Фаза",
+  "deployTab.expandDetails": "Розгорнути деталі розгортання",
+  "deployTab.moreActions": "Більше дій",
+  "deployTab.newDeployment": "Розгорнути в нове Середовище",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "ID розгортання",
+  "deployTab.panel.endpoints": "Точки доступу",
+  "deployTab.panel.envVars": "Змінні середовища",
+  "deployTab.panel.error": "Помилка",
+  "deployTab.panel.failedRelease": "Невдалий Реліз",
+  "deployTab.panel.health": "Стан",
+  "deployTab.panel.instanceInfo": "Інформація про Екземпляр",
+  "deployTab.panel.modelCreds": "Облікові дані моделі",
+  "deployTab.panel.pluginCreds": "Облікові дані плагіна",
+  "deployTab.panel.release": "Реліз",
+  "deployTab.panel.releaseCreatedAt": "Реліз створено",
+  "deployTab.panel.releaseInfo": "Інформація про Реліз",
+  "deployTab.panel.replicas": "Репліки",
+  "deployTab.panel.run": "Запустити",
+  "deployTab.panel.runtimeBindings": "Облікові дані",
+  "deployTab.panel.runtimeInfo": "Інформація про виконання",
+  "deployTab.panel.runtimeMode": "Режим виконання",
+  "deployTab.panel.runtimeNote": "Примітка виконання",
+  "deployTab.panel.targetRelease": "Цільовий Реліз",
+  "deployTab.panel.unknownError": "Розгортання не вдалося.",
+  "deployTab.promote": "Розгорнути",
+  "deployTab.redeploy": "Перерозгорнути",
+  "deployTab.releaseCreatedAt": "Реліз створено {{time}}",
+  "deployTab.retry": "Повторити",
+  "deployTab.shortcut": "Швидкий доступ",
+  "deployTab.status.deployFailed": "Розгортання не вдалося",
+  "deployTab.status.deployingRelease": "Розгортання ({{release}})",
+  "deployTab.status.runningOutOfSync": "Запущено (очікує синхронізації)",
+  "deployTab.status.runningWithFailed": "Запущено (останнє розгортання не вдалося)",
+  "deployTab.undeploy": "Скасувати розгортання",
+  "deployTab.undeployConfirmDesc": "Доступ кінцевих користувачів буде негайно припинено. Реліз можна буде перерозгорнути пізніше.",
+  "deployTab.undeployConfirmTitle": "Скасувати розгортання з {{name}}?",
+  "deployTab.undeployFrom": "Скасувати розгортання з {{name}}",
+  "deployTab.undeployImpactTitle": "Зачеплений Екземпляр",
+  "deployTab.viewError": "Переглянути помилку",
+  "deployTab.viewLogs": "Переглянути журнали",
+  "deployTab.viewProgress": "Переглянути прогрес",
+  "detail.backToInstances": "Назад до розгортань",
+  "detail.deployingCount": "{{count}} розгортається",
+  "detail.envCount_one": "{{count}} середовище",
+  "detail.envCount_other": "{{count}} середовищ",
+  "detail.failedCount": "{{count}} не вдалося",
+  "detail.mobileTabs": "Розділи розгортання",
+  "detail.notFound": "Розгортання не знайдено",
+  "detail.openSourceApp": "Відкрити джерело {{name}}",
+  "detail.sourceApp": "Джерело",
+  "detail.sourceAppLink": "Джерело",
+  "documentTitle.create": "Нове розгортання · Розгортання",
+  "documentTitle.detail": "Розгортання · Розгортання",
+  "documentTitle.list": "Розгортання",
+  "filter.allEnvs": "Усі Середовища",
+  "filter.notDeployed": "Не розгорнуто",
+  "filter.searchPlaceholder": "Пошук розгортань",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Прийняття",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Ініціалізація",
+  "health.ENVIRONMENT_STATUS_DELETING": "Видалення",
+  "health.ENVIRONMENT_STATUS_FAILED": "Недоступно",
+  "health.ENVIRONMENT_STATUS_READY": "Доступно",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Невідомо",
+  "list.clearFilters": "Очистити фільтри",
+  "list.clearSearch": "Очистити пошук розгортань",
+  "list.createDeployment": "Створити",
+  "list.empty": "Розгортань не знайдено.",
+  "list.emptyDescription": "Створіть розгортання з Workflow програми або пакета Workflow DSL, щоб керувати релізами, середовищами та доступом.",
+  "list.emptyFilteredDescription": "Жодне розгортання не відповідає поточному пошуку або фільтру Середовища.",
+  "list.emptyFilteredTitle": "Немає відповідних розгортань",
+  "list.emptyTitle": "Поки що немає розгортань",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Ізольований",
+  "mode.ENVIRONMENT_MODE_SHARED": "Спільний",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Невідомий",
+  "newInstance.comingSoon": "Скоро",
+  "newInstance.fromStudio": "Вибрати зі Studio",
+  "newInstance.importDSL": "Імпортувати DSL",
+  "newInstance.title": "Нове розгортання",
+  "overview.accessEndpoints": "Точки доступу",
+  "overview.accessMeta.apiTokens": "Керувати API Tokens",
+  "overview.accessMeta.cli": "Переглянути доступ CLI",
+  "overview.accessMeta.webApp": "Керувати доступом WebApp",
+  "overview.accessStatus": "Доступ",
+  "overview.api": "API Tokens",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Tokens",
+  "overview.apiTokenSummary.environments_one": "{{count}} розгорнуте Середовище",
+  "overview.apiTokenSummary.environments_other": "{{count}} розгорнутих Середовищ",
+  "overview.availableForDeployment": "Доступне для розгортання",
+  "overview.basicInfo": "Базова інформація",
+  "overview.cardAction.deployLatest": "Розгорнути останній Реліз",
+  "overview.cardAction.redeploy": "Перерозгорнути",
+  "overview.cardAction.viewProgress": "Переглянути розгортання",
+  "overview.chip.behindTooltip_one": "На 1 реліз позаду останнього. Розгорніть останній реліз для оновлення.",
+  "overview.chip.behindTooltip_other": "На {{count}} релізів позаду останнього. Розгорніть останній реліз для оновлення.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "розгортається",
+  "overview.chip.deployingTooltip": "Розгортання триває.",
+  "overview.chip.empty": "порожнє",
+  "overview.chip.emptyTooltip": "У цьому Середовищі не розгорнуто жодного релізу.",
+  "overview.chip.failed": "не вдалося",
+  "overview.chip.failedTooltip": "Остання спроба розгортання не вдалася.",
+  "overview.chip.latest": "останній",
+  "overview.chip.latestTooltip": "Це Середовище працює на останньому релізі.",
+  "overview.chip.needsReleaseFirst": "Створіть Реліз спочатку",
+  "overview.chip.olderRelease": "старіший",
+  "overview.chip.olderReleaseTooltip": "Це Середовище працює на старішому релізі.",
+  "overview.chip.openInDeployTab": "Переглянути прогрес розгортання",
+  "overview.cli": "CLI",
+  "overview.configured": "Налаштовано",
+  "overview.createRelease": "Створити Реліз",
+  "overview.created": "Створено",
+  "overview.deploy": "Розгорнути",
+  "overview.deployedEnvironments": "розгорнуто",
+  "overview.deploymentOverview": "Огляд розгортання",
+  "overview.deploymentStatus": "Статус розгортання",
+  "overview.description": "Опис",
+  "overview.developerApi": "API для розробників",
+  "overview.disabled": "Вимкнено",
+  "overview.emptyValue": "Не встановлено",
+  "overview.enabled": "Увімкнено",
+  "overview.enabledChannels": "доступ увімкнено",
+  "overview.endUserAccess": "Доступ кінцевих користувачів",
+  "overview.environments": "Середовища",
+  "overview.hero.byName": "автор: {{name}}",
+  "overview.hero.empty": "Поки що немає релізів",
+  "overview.hero.emptyDescription": "Створіть реліз з поточного джерела перед розгортанням.",
+  "overview.hero.propagation_one": "розгорнуто в {{count}}/{{total}} Середовище",
+  "overview.hero.propagation_other": "розгорнуто в {{count}}/{{total}} Середовищ",
+  "overview.hero.untargeted": "ще не налаштовано жодного Середовища",
+  "overview.instanceDetails": "Деталі розгортання",
+  "overview.instanceId": "ID розгортання",
+  "overview.latestRelease.releaseCount_one": "{{count}} реліз",
+  "overview.latestRelease.releaseCount_other": "{{count}} релізів",
+  "overview.latestReleaseTitle": "Останній Реліз",
+  "overview.manageDeployments": "Керувати розгортаннями",
+  "overview.name": "Назва",
+  "overview.noAccessConfig": "Немає конфігурації доступу.",
+  "overview.noReleaseYet": "Створіть реліз перед розгортанням у Середовищі.",
+  "overview.notConfigured": "Не налаштовано",
+  "overview.previousReleases.empty": "Поки що немає попередніх релізів.",
+  "overview.previousReleases.retired": "Наразі не розгорнуто",
+  "overview.previousReleases.title": "Попередні релізи",
+  "overview.previousReleases.viewAll": "Переглянути всі",
+  "overview.ready": "Готове до розгортання",
+  "overview.recentReleases": "Нещодавні релізи",
+  "overview.releaseDeployedTitle": "{{release}} розгорнуто",
+  "overview.releaseReadyTitle": "{{release}} готовий до розгортання",
+  "overview.serviceMap": "Карта сервісів",
+  "overview.servingRelease": "Обслуговує {{release}}",
+  "overview.servingReleaseDescription": "Це розгортання розгорнуто в {{count}}/{{total}} Середовищ.",
+  "overview.strip.deployToNewEnvironment": "Розгорнути в нове Середовище",
+  "overview.strip.empty": "Жодне Середовище не налаштовано.",
+  "overview.strip.emptyDeployableDescription": "Розгорніть останній реліз у Середовищі, коли будете готові.",
+  "overview.strip.emptyDeployed": "Поки що немає Екземплярів.",
+  "overview.strip.emptyDescription": "Створіть реліз перед розгортанням у Середовищі.",
+  "overview.strip.emptyTitle": "Поки що немає Екземплярів",
+  "overview.strip.summary_one": "1 з {{total}} на останньому релізі",
+  "overview.strip.summary_other": "{{count}} з {{total}} на останньому релізі",
+  "overview.strip.title": "Екземпляри",
+  "overview.switchSourceApp": "Змінити джерело",
+  "overview.switchSourceAppDescription": "Виберіть Workflow програму, яка використовуватиметься як джерело для майбутніх релізів.",
+  "overview.switchSourceAppHint": "Після перемикання лише новостворені релізи використовують нове джерело. Історичні релізи та існуючі розгортання не змінюються.",
+  "overview.targetRelease": "Цільовий Реліз",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Зона небезпеки",
+  "settings.dangerDesc": "Назавжди видалити це розгортання та зупинити всі запущені Екземпляри. Цю дію не можна скасувати.",
+  "settings.delete": "Видалити розгортання",
+  "settings.deleteConfirmDesc": "Видалити {{name}}? Кожен Екземпляр перестане працювати та буде видалений у всіх Середовищах. Цю дію не можна скасувати.",
+  "settings.deleteConfirmTitle": "Видалити розгортання",
+  "settings.deleteFailed": "Не вдалося видалити розгортання.",
+  "settings.deleteImpact": "Вплив",
+  "settings.deleteImpactInstance": "Розгортання",
+  "settings.deleteImpactTitle": "Зачеплене розгортання",
+  "settings.deleteImpactValue": "Розгортання видаляється зі списку розгортань.",
+  "settings.deleted": "Розгортання видалено",
+  "settings.description": "Опис",
+  "settings.descriptionHelp": "Керуйте назвою, описом та іншими налаштуваннями цього розгортання.",
+  "settings.general": "Загальне",
+  "settings.name": "Назва розгортання",
+  "settings.reset": "Скинути",
+  "settings.save": "Зберегти зміни",
+  "settings.updateFailed": "Не вдалося оновити розгортання.",
+  "settings.updated": "Розгортання оновлено",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Розгортається",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Очікує синхронізації",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Розгортання не вдалося",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Недійсний",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Запущено",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не розгорнуто",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Скасування розгортання",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Невідомо",
+  "subtitle": "Керуйте розгортаннями в різних Середовищах.",
+  "tabs.access.description": "Керуйте каналами доступу та дозволами доступу.",
+  "tabs.access.name": "Доступ",
+  "tabs.api-tokens.description": "Керуйте API Tokens та викликайте Екземпляри через HTTP.",
+  "tabs.api-tokens.name": "API Tokens",
+  "tabs.instances.description": "Переглядайте та керуйте Екземплярами в розгорнутих Середовищах.",
+  "tabs.instances.name": "Екземпляри",
+  "tabs.overview.description": "Перегляньте статус розгортання в різних Середовищах.",
+  "tabs.overview.name": "Огляд",
+  "tabs.releases.description": "Створюйте, розгортайте та керуйте релізами.",
+  "tabs.releases.name": "Релізи",
+  "tabs.settings.description": "Керуйте назвою, описом та іншими налаштуваннями цього розгортання.",
+  "tabs.settings.name": "Налаштування",
+  "title": "Розгортання",
+  "unsupportedDslNodes.description": "Цей реліз містить вузли, які ще не підтримуються середовищем виконання розгортання. Видаліть або замініть їх у Studio, потім спробуйте ще раз.",
+  "unsupportedDslNodes.descriptionWithTypes": "Цей реліз містить вузли, які ще не підтримуються середовищем виконання розгортання: {{nodeTypes}}. Видаліть або замініть їх у Studio, потім спробуйте ще раз.",
+  "unsupportedDslNodes.title": "Непідтримувані вузли",
+  "unsupportedDslNodes.unknownType": "Невідомий тип",
+  "versions.cancelCreate": "Скасувати",
+  "versions.cancelDelete": "Скасувати",
+  "versions.cancelEdit": "Скасувати",
+  "versions.checkingReleaseContent": "Перевірка вмісту релізу...",
+  "versions.col.action": "Дія",
+  "versions.col.author": "Створив",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Створено",
+  "versions.col.deployedTo": "Розгорнуто в",
+  "versions.col.release": "Реліз",
+  "versions.col.sourceApp": "Джерело",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Створити",
+  "versions.createFailed": "Не вдалося створити реліз.",
+  "versions.createRelease": "Створити Реліз",
+  "versions.createReleaseDescription": "Створіть розгортаний реліз з Workflow програми або файлу Workflow DSL.",
+  "versions.createReleaseHint": "Нові релізи можна розгортати в будь-якому Середовищі.",
+  "versions.createSuccess": "Реліз \"{{name}}\" створено.",
+  "versions.creating": "Створення...",
+  "versions.currentOn": "Поточний Реліз у {{name}}",
+  "versions.deleteConfirmDesc": "Реліз \"{{name}}\" буде назавжди видалено. Цю дію не можна скасувати.",
+  "versions.deleteConfirmTitle": "Видалити реліз?",
+  "versions.deleteFailed": "Не вдалося видалити реліз.",
+  "versions.deleteImpactDeployment": "Статус розгортання",
+  "versions.deleteImpactNotDeployed": "Наразі не розгорнуто",
+  "versions.deleteImpactRelease": "Реліз",
+  "versions.deleteImpactTitle": "Вплив видалення",
+  "versions.deleteRelease": "Видалити Реліз",
+  "versions.deleteSuccess": "Реліз \"{{name}}\" видалено.",
+  "versions.deploy": "Розгорнути",
+  "versions.deployTo": "Розгорнути в {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Розгортається",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Очікує синхронізації",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Не вдалося",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Недійсний",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Запущено",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не розгорнуто",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Скасування розгортання",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Невідомо",
+  "versions.deployingTo": "{{name}} розгортається",
+  "versions.disabledReason.checkDeploymentsFailed": "Не вдалося перевірити використання розгортання. Спробуйте пізніше.",
+  "versions.disabledReason.checkingDeployments": "Перевірка використання розгортання",
+  "versions.disabledReason.current": "Цей реліз уже запущено в {{name}}",
+  "versions.disabledReason.deploying": "Дочекайтеся завершення активного розгортання",
+  "versions.disabledReason.envDisabled": "Це Середовище не доступне для розгортання",
+  "versions.disabledReason.releaseInUse_one": "Скасуйте розгортання цього релізу з {{count}} Середовища перед його видаленням",
+  "versions.disabledReason.releaseInUse_other": "Скасуйте розгортання цього релізу з {{count}} Середовищ перед його видаленням",
+  "versions.dslReadFailed": "Не вдалося прочитати файл DSL. Виберіть інший файл і спробуйте ще раз.",
+  "versions.dslReading": "Читання файлу DSL...",
+  "versions.dslUnsupportedMode": "Для розгортань можна використовувати лише файли Workflow DSL.",
+  "versions.editFailed": "Не вдалося оновити реліз.",
+  "versions.editRelease": "Редагувати Реліз",
+  "versions.editReleaseDescription": "Оновіть назву та опис цього релізу.",
+  "versions.editSuccess": "Реліз \"{{name}}\" оновлено.",
+  "versions.empty": "Поки що немає доступних релізів.",
+  "versions.emptyDescription": "Створіть перший реліз перед розгортанням у Середовищі.",
+  "versions.emptyTitle": "Поки що немає релізів",
+  "versions.emptyWithCreate": "Поки що немає релізів. Створіть перший розгортаний реліз перед розгортанням.",
+  "versions.exportDsl": "Експортувати DSL",
+  "versions.exportDslFailed": "Не вдалося експортувати DSL.",
+  "versions.exportingDsl": "Експорт...",
+  "versions.groupHeader.deploy": "Розгорнути",
+  "versions.groupHeader.promote": "Розгорнути",
+  "versions.groupHeader.rollback": "Розгорнути попередню версію",
+  "versions.groupHeader.unavailable": "Недоступно",
+  "versions.manualDslOption": "Завантажити DSL",
+  "versions.moreActions": "Більше дій",
+  "versions.optional": "Необов'язково",
+  "versions.promote": "Розгорнути",
+  "versions.promoteTo": "Розгорнути в {{name}}",
+  "versions.releaseAlreadyExists": "Реліз з таким же вмістом уже існує: {{name}}.",
+  "versions.releaseContentCheckFailed": "Не вдалося перевірити вміст релізу.",
+  "versions.releaseDescriptionLabel": "Опис",
+  "versions.releaseDescriptionPlaceholder": "Опишіть цей реліз",
+  "versions.releaseHistory": "Історія релізів",
+  "versions.releaseNameLabel": "Назва Релізу",
+  "versions.releaseNamePlaceholder": "Назва Релізу",
+  "versions.releaseNameRequired": "Введіть назву релізу.",
+  "versions.releaseSourceLabel": "Джерело Релізу",
+  "versions.rollbackTo": "Розгорнути в {{name}}",
+  "versions.saveEdit": "Зберегти",
+  "versions.sourceAppOption": "Workflow програма"
+}
diff --git a/web/i18n/uk-UA/workflow.json b/web/i18n/uk-UA/workflow.json
index 50f56e584d0..c2d245d32e9 100644
--- a/web/i18n/uk-UA/workflow.json
+++ b/web/i18n/uk-UA/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "Агент",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Відповідь",
   "blocks.assigner": "Призначувач змінних",
   "blocks.code": "Код",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Агрегатор змінних",
   "blocks.variable-assigner": "Присвоювач змінних",
   "blocksAbout.agent": "Виклик великих мовних моделей для відповідей на запитання або обробки природної мови",
+  "blocksAbout.agent-v2": "Виклик великих мовних моделей для відповідей на запитання або обробки природної мови",
   "blocksAbout.answer": "Визначте зміст відповіді у чаті",
   "blocksAbout.assigner": "Вузол призначення змінних використовується для присвоєння значень записуваним змінним (таким як змінні розмови).",
   "blocksAbout.code": "Виконайте фрагмент коду Python або NodeJS для реалізації користувацької логіки",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID робочого процесу",
   "globalVar.fieldsDescription.workflowRunId": "ID запуску робочого процесу",
   "globalVar.title": "Системні змінні",
+  "nodes.agent.advancedSetting": "Розширені налаштування",
   "nodes.agent.checkList.strategyNotSelected": "Стратегію не обрано",
   "nodes.agent.clickToViewParameterSchema": "Натисніть, щоб переглянути схему параметрів",
   "nodes.agent.configureModel": "Налаштуйте модель",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Непідтримувана модель",
   "nodes.agent.modelSelectorTooltips.deprecated": "Ця модель вважається застарілою",
   "nodes.agent.notAuthorized": "Не авторизовано",
+  "nodes.agent.outputVars.confirm": "Підтвердити",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Введіть JSON-масив.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Введіть true або false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Значення за замовчуванням для файлів тут поки не можна налаштувати.",
+  "nodes.agent.outputVars.defaultValueLabel": "За замовчуванням",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Введіть коректне число.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Введіть JSON-об'єкт.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Значення за замовчуванням",
+  "nodes.agent.outputVars.delete": "Видалити {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Опис",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Додати опис",
+  "nodes.agent.outputVars.edit": "Редагувати {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Редактор вихідних змінних",
   "nodes.agent.outputVars.files.title": "Файли, створені агентом",
   "nodes.agent.outputVars.files.transfer_method": "Спосіб переказу. Цінність remote_url або local_file",
   "nodes.agent.outputVars.files.type": "Тип підтримки. Тепер підтримка тільки зображення",
   "nodes.agent.outputVars.files.upload_file_id": "Завантажити ідентифікатор файлу",
   "nodes.agent.outputVars.files.url": "URL-адреса зображення",
   "nodes.agent.outputVars.json": "Агент згенерував JSON",
+  "nodes.agent.outputVars.nameDuplicate": "Ім'я виходу вже існує",
+  "nodes.agent.outputVars.nameInvalid": "Використовуйте літери, цифри й підкреслення. Починайте з літери або підкреслення.",
+  "nodes.agent.outputVars.nameLabel": "Ім'я поля",
+  "nodes.agent.outputVars.namePlaceholder": "Ім'я поля",
+  "nodes.agent.outputVars.newOutput": "Новий вихід",
+  "nodes.agent.outputVars.requiredLabel": "Обов'язкове",
+  "nodes.agent.outputVars.showAdvancedOptions": "Показати розширені параметри",
   "nodes.agent.outputVars.text": "Контент, створений агентом",
+  "nodes.agent.outputVars.typeLabel": "Тип виходу",
   "nodes.agent.outputVars.usage": "Інформація про використання моделі",
   "nodes.agent.parameterSchema": "Схема параметрів",
   "nodes.agent.pluginInstaller.install": "Інсталювати",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Цей інтеграція встановлюється з GitHub. Будь ласка, перейдіть до Інтеграції для перевстановлення",
   "nodes.agent.pluginNotInstalled": "Цей інтеграція не встановлено",
   "nodes.agent.pluginNotInstalledDesc": "Цей інтеграція встановлюється з GitHub. Будь ласка, перейдіть до Інтеграції для перевстановлення",
+  "nodes.agent.roster.change": "Змінити",
+  "nodes.agent.roster.editInConsole": "Редагувати в Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Одноразове налаштування, що існує лише в цьому вузлі",
+  "nodes.agent.roster.inlineSetup.name": "Вбудоване налаштування",
+  "nodes.agent.roster.inlineSetup.title": "Налаштування агента",
+  "nodes.agent.roster.inlineSetup.type": "Лише в цьому вузлі",
+  "nodes.agent.roster.label": "Агент",
+  "nodes.agent.roster.makeCopy": "Зробити копію",
+  "nodes.agent.roster.more": "Більше дій з агентом",
+  "nodes.agent.roster.openPanel": "Відкрити деталі {{name}}",
+  "nodes.agent.roster.panelLabel": "Деталі {{name}}",
   "nodes.agent.strategy.configureTip": "Будь ласка, налаштуйте агентичну стратегію.",
   "nodes.agent.strategy.configureTipDesc": "Після налаштування агентної стратегії цей вузол автоматично завантажить решту конфігурацій. Стратегія вплине на механізм багатоступінчастого інструментального міркування.",
   "nodes.agent.strategy.label": "Агентична стратегія",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Встановлена версія інтеграціяа не забезпечує цю стратегію. Натисніть, щоб змінити версію.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} не встановлено",
   "nodes.agent.strategyNotSet": "Агентська стратегія Не встановлено",
+  "nodes.agent.task.insert": "Вставити",
+  "nodes.agent.task.label": "Задача агента",
+  "nodes.agent.task.mention": "Згадати",
+  "nodes.agent.task.placeholder": "Опишіть, що має робити цей агент…",
+  "nodes.agent.task.tooltip": "Визначте інструкції задачі, які цей агент має виконувати в цьому робочому процесі.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Не авторизовано",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} не встановлено",
   "nodes.agent.toolbox": "ящик для інструментів",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Автор: {{author}}",
   "tabs.question-understand": "Розуміння питань",
   "tabs.requestToCommunity": "Запити до спільноти",
-  "tabs.searchBlock": "Пошуковий вузол",
+  "tabs.searchBlock": "Шукати вузли, агентів, людей, знання",
   "tabs.searchDataSource": "Пошук у джерелі даних",
   "tabs.searchSnippets": "Пошук фрагментів...",
   "tabs.searchTool": "Інструмент пошуку",
diff --git a/web/i18n/vi-VN/agent-v-2.json b/web/i18n/vi-VN/agent-v-2.json
new file mode 100644
index 00000000000..e0cfb6a2112
--- /dev/null
+++ b/web/i18n/vi-VN/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "Hành động này chưa khả dụng.",
+  "agentDetail.access.actions.monitoring": "Giám sát",
+  "agentDetail.access.copyAccessUrl": "Sao chép URL truy cập",
+  "agentDetail.access.copyFailed": "Sao chép tham chiếu thất bại.",
+  "agentDetail.access.copyReference": "Sao chép tham chiếu cho {{name}}",
+  "agentDetail.access.copyServiceEndpoint": "Sao chép điểm cuối API dịch vụ",
+  "agentDetail.access.description": "Mọi bề mặt mà tác nhân này có thể truy cập.",
+  "agentDetail.access.empty": "Không có điểm truy cập nào được liên kết",
+  "agentDetail.access.emptyDescription": "Tác nhân Roster này chưa có tham chiếu ứng dụng hoặc quy trình làm việc nào.",
+  "agentDetail.access.entries.agentApp.description": "Ứng dụng tác nhân được liên kết với tác nhân Roster này.",
+  "agentDetail.access.entries.agentApp.name": "Ứng dụng tác nhân",
+  "agentDetail.access.entries.workflow.description": "Tham chiếu quy trình làm việc và nút được liên kết với tác nhân Roster này.",
+  "agentDetail.access.entries.workflow.name": "Nút quy trình làm việc",
+  "agentDetail.access.entryCount_one": "{{count}} mục",
+  "agentDetail.access.entryCount_other": "{{count}} mục",
+  "agentDetail.access.groups.references.heading": "Tham chiếu",
+  "agentDetail.access.groups.references.label": "Tham chiếu được liên kết",
+  "agentDetail.access.learnMore": "Tìm hiểu thêm",
+  "agentDetail.access.moreActions": "Thêm hành động cho {{name}}",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "Điểm cuối API dịch vụ",
+  "agentDetail.access.serviceApi.title": "API dịch vụ phía sau",
+  "agentDetail.access.status.disabled": "Đã tắt",
+  "agentDetail.access.status.enabled": "Đã bật",
+  "agentDetail.access.status.inService": "Đang hoạt động",
+  "agentDetail.access.status.outOfService": "Ngưng hoạt động",
+  "agentDetail.access.title": "Điểm truy cập",
+  "agentDetail.access.toggleSurface": "Bật/tắt truy cập {{name}}",
+  "agentDetail.access.webApp.accessUrl": "URL truy cập",
+  "agentDetail.access.webApp.actions.customize": "Tùy chỉnh",
+  "agentDetail.access.webApp.actions.embedded": "Nhúng",
+  "agentDetail.access.webApp.actions.launch": "Khởi chạy",
+  "agentDetail.access.webApp.actions.settings": "Cài đặt",
+  "agentDetail.access.webApp.refreshUrl": "Làm mới URL truy cập",
+  "agentDetail.access.webApp.showQrCode": "Hiển thị mã QR",
+  "agentDetail.access.webApp.ssoEnabled": "SSO đã bật",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "Được dùng như một nút bên trong quy trình làm việc",
+  "agentDetail.access.workflow.empty": "Chưa có tham chiếu quy trình làm việc nào.",
+  "agentDetail.access.workflow.loadFailed": "Tải tham chiếu quy trình làm việc thất bại.",
+  "agentDetail.access.workflow.loading": "Đang tải tham chiếu quy trình làm việc…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} nút",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} nút",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "Mở trong Studio",
+  "agentDetail.access.workflow.openInStudioFor": "Mở {{name}} trong Studio",
+  "agentDetail.access.workflow.table.actions": "Hành động",
+  "agentDetail.access.workflow.table.lastUpdated": "Cập nhật lần cuối",
+  "agentDetail.access.workflow.table.name": "Tên",
+  "agentDetail.access.workflow.table.nodes": "Nút",
+  "agentDetail.access.workflow.table.version": "Phiên bản",
+  "agentDetail.access.workflow.title": "Truy cập quy trình làm việc",
+  "agentDetail.configure.advancedSettings.description": "Dành cho người dùng nâng cao. Biến môi trường, sandbox và bộ nhớ.",
+  "agentDetail.configure.advancedSettings.envEditor.add": "Thêm biến môi trường",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "Xóa {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "Ẩn giá trị của {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "Nhập .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "Để hiển thị các tệp .env ẩn, nhấn Command + Shift + . trong cửa sổ chọn tệp.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "Nếu tệp .env của bạn bị ẩn, hãy bật hiển thị tệp ẩn trong cửa sổ chọn tệp hệ thống.",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "Để hiển thị các tệp .env ẩn, bật Mục ẩn trong File Explorer.",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "Hiện giá trị của {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "Chọn phạm vi biến môi trường",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "Các biến môi trường khả dụng cho tác nhân này khi chạy.",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "Bật/tắt Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "Cài đặt nâng cao",
+  "agentDetail.configure.advancedSettings.toggle": "Bật/tắt cài đặt nâng cao",
+  "agentDetail.configure.chatFeatures.description": "Định hình trải nghiệm trò chuyện cho người dùng cuối trên Web app và các bề mặt trò chuyện.",
+  "agentDetail.configure.chatFeatures.title": "Tính năng trò chuyện",
+  "agentDetail.configure.files.add": "Thêm tệp",
+  "agentDetail.configure.files.empty.description": "Tải lên tài liệu mà tác nhân có thể đọc, như đặc tả, mẫu hoặc hướng dẫn",
+  "agentDetail.configure.files.empty.title": "Chưa có tệp nào",
+  "agentDetail.configure.files.label": "Tệp",
+  "agentDetail.configure.files.preview.empty": "Không có nội dung xem trước.",
+  "agentDetail.configure.files.preview.failed": "Tải xem trước thất bại.",
+  "agentDetail.configure.files.preview.unsupported": "Tệp này không hỗ trợ xem trước.",
+  "agentDetail.configure.files.remove": "Xóa {{name}}",
+  "agentDetail.configure.files.tip": "Các tệp mà tác nhân này có thể sử dụng khi điều phối tác vụ.",
+  "agentDetail.configure.files.toggle": "Bật/tắt tệp",
+  "agentDetail.configure.files.treeLabel": "Tệp tác nhân",
+  "agentDetail.configure.files.upload.action": "Tải lên",
+  "agentDetail.configure.files.upload.browse": "duyệt",
+  "agentDetail.configure.files.upload.description": "Tải lên một tệp cho tác nhân này.",
+  "agentDetail.configure.files.upload.dropzone": "Thả một tệp vào đây, hoặc",
+  "agentDetail.configure.files.upload.failed": "Tải lên tệp thất bại.",
+  "agentDetail.configure.files.upload.fileType": "FILE",
+  "agentDetail.configure.files.upload.invalidFile": "Tải lên một tệp.",
+  "agentDetail.configure.files.upload.success": "Đã tải lên tệp.",
+  "agentDetail.configure.files.upload.title": "Tải lên tệp",
+  "agentDetail.configure.knowledgeRetrieval.add": "Thêm truy xuất kiến thức",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "Thêm kiến thức",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "Nhấn nút “+” để thêm kiến thức",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "Kiến thức",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "Cài đặt truy xuất",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "Tìm hiểu thêm về Truy xuất kiến thức",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "Tự động",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "Điều kiện",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "Tắt",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "Lọc siêu dữ liệu",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "Thủ công",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "Chọn chế độ lọc siêu dữ liệu",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "Tên truy xuất kiến thức",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "Tác nhân quyết định",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "Tác nhân tự viết truy vấn của nó từ lời nhắc và ngữ cảnh khả dụng. Không cần thiết lập gì ở đây.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "Truy vấn tùy chỉnh",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "Viết một truy vấn cố định cho nguồn truy xuất này.",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "Văn bản truy vấn tùy chỉnh",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "Nhập một truy vấn tìm kiếm",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "Truy vấn",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "Truy xuất kiến thức · Tác nhân quyết định",
+  "agentDetail.configure.knowledgeRetrieval.edit": "Chỉnh sửa {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "Kết nối một cơ sở kiến thức mà tác nhân có thể tìm kiếm khi trả lời",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "Chưa có kiến thức nào",
+  "agentDetail.configure.knowledgeRetrieval.label": "Truy xuất kiến thức",
+  "agentDetail.configure.knowledgeRetrieval.remove": "Xóa {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "Các nguồn truy xuất kiến thức mà tác nhân này có thể sử dụng khi điều phối tác vụ.",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "Bật/tắt truy xuất kiến thức",
+  "agentDetail.configure.model.label": "Mô hình",
+  "agentDetail.configure.orchestrate": "Điều phối",
+  "agentDetail.configure.preview.chatFeatures": "Tính năng trò chuyện",
+  "agentDetail.configure.preview.empty.defaultAgentName": "Tác nhân",
+  "agentDetail.configure.preview.empty.description": "Gửi một tin nhắn để thử nghiệm bản nháp hiện tại.",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "Chưa có hướng dẫn, vì vậy câu trả lời đến từ mô hình thuần.",
+  "agentDetail.configure.preview.endUserAuth": "Xác thực người dùng cuối",
+  "agentDetail.configure.preview.restart": "Khởi động lại bản xem trước",
+  "agentDetail.configure.preview.title": "Xem trước",
+  "agentDetail.configure.prompt.copied": "Đã sao chép lời nhắc",
+  "agentDetail.configure.prompt.copy": "Sao chép lời nhắc",
+  "agentDetail.configure.prompt.copyFailed": "Sao chép lời nhắc thất bại.",
+  "agentDetail.configure.prompt.insert.label": "Chèn",
+  "agentDetail.configure.prompt.insert.question": "Câu hỏi bắt đầu",
+  "agentDetail.configure.prompt.insert.reportFile": "Tệp báo cáo đầu ra",
+  "agentDetail.configure.prompt.insert.tenders": "Bắt đầu thầu",
+  "agentDetail.configure.prompt.label": "Lời nhắc",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "Đề cập",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "Viết hướng dẫn tại đây,",
+  "agentDetail.configure.prompt.tip": "Xác định cách tác nhân này nên hiểu đầu vào, gọi công cụ và tạo đầu ra.",
+  "agentDetail.configure.publishBar.draft": "Bản nháp",
+  "agentDetail.configure.publishBar.publishUpdate": "Xuất bản cập nhật",
+  "agentDetail.configure.publishBar.published": "Đã xuất bản",
+  "agentDetail.configure.publishBar.publishedAt": "Đã xuất bản {{time}}",
+  "agentDetail.configure.publishBar.publishing": "Đang xuất bản…",
+  "agentDetail.configure.publishBar.saved": "Đã lưu 5 phút trước",
+  "agentDetail.configure.publishBar.savedAt": "Đã lưu {{time}}",
+  "agentDetail.configure.publishBar.unpublishedChanges": "Thay đổi chưa xuất bản",
+  "agentDetail.configure.publishBar.upToDate": "Đã cập nhật",
+  "agentDetail.configure.publishBar.versionHistory": "Mở lịch sử phiên bản",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "Quy trình làm việc bị ảnh hưởng",
+  "agentDetail.configure.publishImpact.cancel": "Hủy",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "Tác nhân của bạn xuất hiện trong",
+  "agentDetail.configure.publishImpact.descriptionSuffix": ". Các thay đổi sẽ ảnh hưởng đến chúng.",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "tác nhân này",
+  "agentDetail.configure.publishImpact.title": "{{action}} đến {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} quy trình làm việc",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} quy trình làm việc",
+  "agentDetail.configure.skills.add": "Thêm kỹ năng",
+  "agentDetail.configure.skills.detail.contentRegion": "Nội dung chi tiết kỹ năng",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} TỆP",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "Tệp kỹ năng",
+  "agentDetail.configure.skills.detail.files": "Tệp",
+  "agentDetail.configure.skills.empty.description": "Kỹ năng mang đến cho tác nhân chuyên môn có thể tái sử dụng mà nó có thể gọi khi làm việc",
+  "agentDetail.configure.skills.empty.title": "Chưa có kỹ năng nào",
+  "agentDetail.configure.skills.itemType": "Kỹ năng",
+  "agentDetail.configure.skills.label": "Kỹ năng",
+  "agentDetail.configure.skills.remove": "Xóa {{name}}",
+  "agentDetail.configure.skills.tip": "Các kỹ năng mà tác nhân này có thể sử dụng khi điều phối tác vụ.",
+  "agentDetail.configure.skills.toggle": "Bật/tắt kỹ năng",
+  "agentDetail.configure.skills.upload.action": "Tải lên",
+  "agentDetail.configure.skills.upload.browse": "duyệt",
+  "agentDetail.configure.skills.upload.description": "Tải lên gói .zip hoặc .skill cho tác nhân này.",
+  "agentDetail.configure.skills.upload.dropzone": "Thả một gói kỹ năng vào đây, hoặc",
+  "agentDetail.configure.skills.upload.failed": "Tải lên kỹ năng thất bại.",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "Tải lên một tệp .zip hoặc .skill.",
+  "agentDetail.configure.skills.upload.success": "Đã tải lên kỹ năng.",
+  "agentDetail.configure.skills.upload.title": "Tải lên kỹ năng",
+  "agentDetail.configure.tools.add": "Thêm công cụ",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "Dành cho nhà phát triển",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "Cài đặt một chương trình dòng lệnh mà tác nhân chạy trong sandbox của nó. Cần cài đặt và thường cần API Key.",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "Công cụ CLI",
+  "agentDetail.configure.tools.addMenu.tool.description": "Chọn một công cụ đã có trong không gian làm việc này, như tìm kiếm web hoặc tích hợp.",
+  "agentDetail.configure.tools.addMenu.tool.label": "Công cụ",
+  "agentDetail.configure.tools.cliDialog.description": "Cài đặt công cụ CLI từ bất kỳ registry gói nào. Tác nhân nhận quyền truy cập shell vào binary mà nó cung cấp.",
+  "agentDetail.configure.tools.cliDialog.editTitle": "Chỉnh sửa công cụ CLI",
+  "agentDetail.configure.tools.cliDialog.env.description": "Lưu trữ API Key, token hoặc bí mật mà công cụ CLI này cần. Giá trị được mã hóa khi lưu và được tiêm vào dưới dạng biến môi trường khi tác nhân gọi công cụ.",
+  "agentDetail.configure.tools.cliDialog.env.label": "Biến môi trường",
+  "agentDetail.configure.tools.cliDialog.env.optional": "(tùy chọn)",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "Sandbox · chạy một lần khi gọi lần đầu",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "Lệnh cài đặt",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "Dán lệnh cài đặt của bạn vào đây, ví dụ npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "Cần lệnh cài đặt.",
+  "agentDetail.configure.tools.cliDialog.learnMore": "Tìm hiểu thêm về công cụ CLI",
+  "agentDetail.configure.tools.cliDialog.name.label": "Tên công cụ CLI",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "Đặt tên cho công cụ CLI của bạn",
+  "agentDetail.configure.tools.cliDialog.name.required": "Cần tên công cụ CLI.",
+  "agentDetail.configure.tools.cliDialog.securityTip": "Không bao giờ hiển thị trong lời nhắc tác nhân; chỉ được tiêm dưới dạng $VAR khi chạy",
+  "agentDetail.configure.tools.cliDialog.title": "Thêm một công cụ CLI",
+  "agentDetail.configure.tools.cliTool": "Công cụ CLI",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "Người dùng cuối · OAuth",
+  "agentDetail.configure.tools.editAction": "Chỉnh sửa {{name}}",
+  "agentDetail.configure.tools.empty.description": "Công cụ giúp tác nhân hành động, như tìm kiếm web hoặc gọi ứng dụng của bạn",
+  "agentDetail.configure.tools.empty.title": "Chưa có công cụ nào",
+  "agentDetail.configure.tools.label": "Công cụ",
+  "agentDetail.configure.tools.moreActions": "Thêm hành động cho {{name}}",
+  "agentDetail.configure.tools.pluginType": "Plugin",
+  "agentDetail.configure.tools.preAuthorize": "Cấp quyền trước",
+  "agentDetail.configure.tools.removeAction": "Xóa {{name}}",
+  "agentDetail.configure.tools.removeProvider": "Xóa tất cả công cụ",
+  "agentDetail.configure.tools.tip": "Các công cụ mà tác nhân này có thể gọi khi điều phối tác vụ.",
+  "agentDetail.configure.tools.toggle": "Bật/tắt công cụ",
+  "agentDetail.configure.tools.toolTabs.all": "Tất cả",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "Tùy chỉnh",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "Plugin",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "Tác nhân",
+  "agentDetail.history": "Lịch sử",
+  "agentDetail.logs.description": "Nhật ký đầy đủ ghi lại trạng thái chạy của ứng dụng, bao gồm đầu vào của người dùng, phản hồi của tác nhân, lập kế hoạch và sử dụng công cụ.",
+  "agentDetail.logs.empty": "Không tìm thấy nhật ký",
+  "agentDetail.logs.filters.period.allTime": "Mọi lúc",
+  "agentDetail.logs.filters.period.label": "Khoảng thời gian nhật ký",
+  "agentDetail.logs.filters.period.last30days": "30 ngày qua",
+  "agentDetail.logs.filters.period.last7days": "7 ngày qua",
+  "agentDetail.logs.filters.search.label": "Tìm kiếm nhật ký",
+  "agentDetail.logs.filters.search.placeholder": "Tìm kiếm",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "Thời gian tạo gần nhất",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "Thời gian cập nhật gần nhất",
+  "agentDetail.logs.filters.source.all": "Nguồn",
+  "agentDetail.logs.filters.source.empty": "Không tìm thấy nguồn",
+  "agentDetail.logs.filters.source.label": "Nguồn nhật ký",
+  "agentDetail.logs.filters.source.loadFailed": "Không tải được nguồn",
+  "agentDetail.logs.filters.source.loading": "Đang tải nguồn…",
+  "agentDetail.logs.filters.source.searchLabel": "Tìm kiếm nguồn",
+  "agentDetail.logs.filters.source.searchPlaceholder": "Tìm kiếm",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "Quy trình làm việc",
+  "agentDetail.logs.learnMore": "Tìm hiểu thêm",
+  "agentDetail.logs.loadFailed": "Không tải được nhật ký",
+  "agentDetail.logs.loading": "Đang tải nhật ký…",
+  "agentDetail.logs.notAvailable": "Không có",
+  "agentDetail.logs.table.createdTime": "Thời gian tạo",
+  "agentDetail.logs.table.endUser": "Người dùng cuối",
+  "agentDetail.logs.table.messageCount": "Số tin nhắn",
+  "agentDetail.logs.table.operationRate": "Tỷ lệ thao tác",
+  "agentDetail.logs.table.source": "Nguồn",
+  "agentDetail.logs.table.title": "Tiêu đề",
+  "agentDetail.logs.table.unread": "Chưa đọc",
+  "agentDetail.logs.table.updatedTime": "Thời gian cập nhật",
+  "agentDetail.logs.table.userRate": "Tỷ lệ người dùng",
+  "agentDetail.logs.title": "Nhật ký",
+  "agentDetail.memorySettings.budgetLabel": "Ngân sách bộ nhớ",
+  "agentDetail.memorySettings.description": "Cài đặt bộ nhớ từ snapshot cấu hình đang hoạt động.",
+  "agentDetail.memorySettings.export.description": "Xuất bộ nhớ được lên kế hoạch cho bản phát hành sau.",
+  "agentDetail.memorySettings.export.download": "Tải xuống",
+  "agentDetail.memorySettings.export.soon": "Sắp ra mắt",
+  "agentDetail.memorySettings.export.title": "Xuất bộ nhớ hiện tại",
+  "agentDetail.memorySettings.notConfigured": "Chưa cấu hình",
+  "agentDetail.memorySettings.scopeLabel": "Phạm vi bộ nhớ",
+  "agentDetail.memorySettings.title": "Bộ nhớ",
+  "agentDetail.metadata.activeVersionLabel": "Phiên bản đang hoạt động",
+  "agentDetail.metadata.appIdLabel": "ID ứng dụng",
+  "agentDetail.metadata.description": "Các trường Roster chỉ đọc được trả về bởi phía sau tác nhân.",
+  "agentDetail.metadata.emptyValue": "Không khả dụng",
+  "agentDetail.metadata.scopeLabel": "Phạm vi",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "Chỉ quy trình làm việc",
+  "agentDetail.metadata.sourceLabel": "Nguồn",
+  "agentDetail.metadata.statusLabel": "Trạng thái",
+  "agentDetail.metadata.title": "Siêu dữ liệu",
+  "agentDetail.metadata.updatedAtLabel": "Cập nhật lúc",
+  "agentDetail.metadata.workflowIdLabel": "ID quy trình làm việc",
+  "agentDetail.metadata.workflowNodeIdLabel": "ID nút quy trình làm việc",
+  "agentDetail.monitoring.change": "{{value}} so với kỳ trước",
+  "agentDetail.monitoring.dateRangeLabel": "Khoảng ngày",
+  "agentDetail.monitoring.description": "Theo dõi hoạt động, chi phí và chất lượng tương tác của tác nhân có thể tái sử dụng trên các quy trình làm việc.",
+  "agentDetail.monitoring.learnMore": "Tìm hiểu thêm",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "Số người dùng cuối duy nhất đã kích hoạt các quy trình làm việc sử dụng tác nhân này.",
+  "agentDetail.monitoring.metrics.activeUsers.title": "Người dùng đang hoạt động",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Số lần giao tiếp liên tục giữa người dùng và tác nhân cho điểm truy cập này.",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "Tương tác trung bình mỗi phiên",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "Tốc độ đầu ra trung bình từ khi bắt đầu yêu cầu đến khi hoàn thành.",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Tốc độ đầu ra token",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "Chi phí token ước tính được tạo ra bởi tác nhân này qua các lần chạy quy trình làm việc.",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Sử dụng token",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "Cuộc trò chuyện AI hàng ngày đến tác nhân này qua điểm truy cập đã chọn.",
+  "agentDetail.monitoring.metrics.totalConversations.title": "Tổng số cuộc trò chuyện",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "Số lần tương tác tác nhân hàng ngày.",
+  "agentDetail.monitoring.metrics.totalMessages.title": "Tổng số tin nhắn",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "Số lượt thích trên 1.000 tin nhắn cho tác nhân này.",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "Tỷ lệ hài lòng của người dùng",
+  "agentDetail.monitoring.pickSource": "Chọn một ứng dụng",
+  "agentDetail.monitoring.sourceLabel": "Ứng dụng",
+  "agentDetail.monitoring.sourceTrigger": "Nguồn {{name}}",
+  "agentDetail.monitoring.sources.all": "Tất cả",
+  "agentDetail.monitoring.timeRangeLabel": "Khoảng thời gian",
+  "agentDetail.monitoring.timeRanges.custom": "Tùy chỉnh",
+  "agentDetail.monitoring.timeRanges.last30days": "30 ngày qua",
+  "agentDetail.monitoring.timeRanges.last7days": "7 ngày qua",
+  "agentDetail.monitoring.timeRanges.today": "Hôm nay",
+  "agentDetail.monitoring.title": "Giám sát",
+  "agentDetail.monitoring.tokenUsageConsumed": "Token đã tiêu thụ",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/giây",
+  "agentDetail.navigationLabel": "Điều hướng tác nhân",
+  "agentDetail.publish": "Xuất bản",
+  "agentDetail.publishSoon": "Sắp ra mắt",
+  "agentDetail.sections.access": "Điểm truy cập",
+  "agentDetail.sections.configure": "Điều phối",
+  "agentDetail.sections.logs": "Nhật ký",
+  "agentDetail.sections.monitoring": "Giám sát",
+  "agentDetail.subtitle": "ID tác nhân: {{agentId}}",
+  "agentDetail.title": "Tác nhân",
+  "agentDetail.type": "TÁC NHÂN",
+  "agentDetail.versionHistory.active": "Đang hoạt động",
+  "agentDetail.versionHistory.empty": "Chưa có phiên bản nào",
+  "agentDetail.versionHistory.filter": "Lọc phiên bản",
+  "agentDetail.versionHistory.versionName": "Phiên bản {{version}}",
+  "roster.createAgent": "Tạo tác nhân",
+  "roster.createAgentOptions": "Tùy chọn tạo tác nhân",
+  "roster.createDialog.description": "Tạo một tác nhân có thể tái sử dụng trong Roster của không gian làm việc này.",
+  "roster.createDialog.title": "Tạo tác nhân",
+  "roster.createForm.changeIcon": "Đổi biểu tượng tác nhân",
+  "roster.createForm.descriptionLabel": "Mô tả",
+  "roster.createForm.descriptionOptional": "(tùy chọn)",
+  "roster.createForm.descriptionPlaceholder": "ví dụ: Thu thập nguồn về một chủ đề và tóm tắt các phát hiện chính",
+  "roster.createForm.nameLabel": "Tên",
+  "roster.createForm.namePlaceholder": "ví dụ: Max",
+  "roster.createForm.nameRequired": "Cần có tên.",
+  "roster.createForm.roleLabel": "Vai trò",
+  "roster.createForm.rolePlaceholder": "ví dụ: Trợ lý nghiên cứu",
+  "roster.createForm.roleRequired": "Cần có vai trò.",
+  "roster.createSuccess": "Đã tạo tác nhân.",
+  "roster.dateTimeFormat": "DD/MM/YYYY HH:mm:ss",
+  "roster.deleteDialog.description": "Tác nhân này sẽ bị xóa khỏi danh sách Roster đang hoạt động.",
+  "roster.deleteDialog.title": "Xóa {{name}}?",
+  "roster.deleteFailed": "Xóa tác nhân thất bại.",
+  "roster.deleteSuccess": "Đã xóa tác nhân.",
+  "roster.duplicateFailed": "Nhân bản tác nhân thất bại.",
+  "roster.duplicateSuccess": "Đã nhân bản tác nhân.",
+  "roster.editAgent": "Chỉnh sửa {{name}}",
+  "roster.editDialog.description": "Cập nhật tên, mô tả và vai trò Roster cho tác nhân này.",
+  "roster.editDialog.title": "Chỉnh sửa tác nhân",
+  "roster.editInfo": "Chỉnh sửa thông tin",
+  "roster.empty": "Chưa có tác nhân nào",
+  "roster.emptyDescription": "Các tác nhân được lưu trong không gian làm việc này sẽ xuất hiện ở đây.",
+  "roster.emptySearch": "Không có tác nhân phù hợp",
+  "roster.emptySearchDescription": "Thử một tên tác nhân khác.",
+  "roster.filters.all": "Tất cả",
+  "roster.filters.drafts": "Bản nháp",
+  "roster.filters.label": "Bộ lọc tác nhân",
+  "roster.filters.published": "Đã xuất bản",
+  "roster.learnMore": "Tìm hiểu thêm về Agent Roster",
+  "roster.listLabel": "Danh sách Roster tác nhân",
+  "roster.loadMore": "Tải thêm",
+  "roster.loadingError": "Tải tác nhân thất bại. Làm mới và thử lại.",
+  "roster.moreActions": "Thêm hành động cho {{name}}",
+  "roster.nodeSelector.createInlineFailed": "Tạo tác nhân inline thất bại. Làm mới và thử lại.",
+  "roster.nodeSelector.dialogLabel": "Chọn một tác nhân",
+  "roster.nodeSelector.manageInAgentConsole": "Quản lý trong Agent Console",
+  "roster.nodeSelector.searchPlaceholder": "Tìm kiếm…",
+  "roster.nodeSelector.startFromScratch": "Bắt đầu từ đầu",
+  "roster.references.label": "Quy trình làm việc đang dùng {{name}}",
+  "roster.references.trigger": "Quy trình làm việc đang dùng {{name}}",
+  "roster.searchLabel": "Tìm kiếm tác nhân",
+  "roster.searchPlaceholder": "Tìm kiếm tác nhân theo tên…",
+  "roster.sources.agent_app": "Ứng dụng tác nhân",
+  "roster.sources.imported": "Đã nhập",
+  "roster.sources.system": "Hệ thống",
+  "roster.sources.workflow": "Quy trình làm việc",
+  "roster.status.active": "Đang hoạt động",
+  "roster.status.archived": "Đã lưu trữ",
+  "roster.tabs.agent": "Tác nhân",
+  "roster.tabs.human": "Con người",
+  "roster.tabsLabel": "Loại Roster",
+  "roster.updateSuccess": "Đã cập nhật tác nhân.",
+  "roster.usageStatus.draft": "Bản nháp"
+}
diff --git a/web/i18n/vi-VN/app-log.json b/web/i18n/vi-VN/app-log.json
index baaf51f93d2..36cf9e1a456 100644
--- a/web/i18n/vi-VN/app-log.json
+++ b/web/i18n/vi-VN/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "Hôm nay",
   "filter.period.yearToDate": "Năm hiện tại",
   "filter.sortBy": "Sắp xếp theo:",
+  "monitoring.description": "Giám sát ghi lại trạng thái hoạt động của ứng dụng, bao gồm hiệu suất, hoạt động người dùng và chi phí.",
   "promptLog": "Nhật ký lời nhắc",
   "runDetail.fileListDetail": "Chi tiết",
   "runDetail.fileListLabel": "Chi tiết tệp",
diff --git a/web/i18n/vi-VN/app.json b/web/i18n/vi-VN/app.json
index d8f997069be..41ca574c10b 100644
--- a/web/i18n/vi-VN/app.json
+++ b/web/i18n/vi-VN/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "Đầu ra có cấu trúc là một tính năng đảm bảo rằng mô hình sẽ luôn tạo ra các phản hồi tuân theo sơ đồ JSON mà bạn cung cấp.",
   "studio.allApps": "Tất cả ứng dụng",
   "studio.apps": "Ứng dụng",
-  "studio.filters.allCreators": "Tất cả người sáng tạo",
-  "studio.filters.creators": "Người sáng tạo",
+  "studio.filters.allCreators": "Tất cả người tạo",
+  "studio.filters.creators": "Người tạo",
   "studio.filters.reset": "Đặt lại",
   "studio.filters.searchCreators": "Tìm kiếm người tạo...",
   "studio.filters.types": "Các loại",
diff --git a/web/i18n/vi-VN/billing.json b/web/i18n/vi-VN/billing.json
index b97a0468820..484e7ffcbf0 100644
--- a/web/i18n/vi-VN/billing.json
+++ b/web/i18n/vi-VN/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "Nâng cấp để mở khóa tải lên nhiều tài liệu",
   "upgrade.uploadMultiplePages.description": "Bạn đã đạt đến giới hạn tải lên — chỉ có thể chọn và tải lên một tài liệu trong một lần với gói hiện tại của bạn.",
   "upgrade.uploadMultiplePages.title": "Nâng cấp để tải lên nhiều tài liệu cùng lúc",
+  "upgrade.workflowRestore.description": "Tính năng khôi phục phiên bản quy trình không khả dụng trong gói hiện tại của bạn.",
+  "upgrade.workflowRestore.title": "Nâng cấp để khôi phục các phiên bản quy trình",
   "upgradeBtn.encourage": "Nâng cấp Ngay",
   "upgradeBtn.encourageShort": "Nâng cấp",
   "upgradeBtn.plain": "Nâng cấp Kế hoạch",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index 3cfd30e5574..2f2f3b1a5c4 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -249,15 +249,14 @@
   "mainNav.workspace.sort.openMenu": "Sort workspaces",
   "mainNav.workspace.switchWorkspace": "Chuyển workspace",
   "mcpPage.description": "Kết nối và quản lý máy chủ MCP để ứng dụng của bạn truy cập các công cụ và dịch vụ bên ngoài.",
-  "members.admin": "Quản trị viên",
   "members.adminTip": "Có thể xây dựng ứng dụng và quản lý cài đặt nhóm",
+  "members.alreadyInTeam": "Đã ở trong nhóm",
+  "members.alreadyInTeamTip": "Những người dùng này đã có quyền truy cập vào không gian làm việc này.",
   "members.builder": "Chủ thầu",
   "members.builderTip": "Có thể xây dựng và chỉnh sửa ứng dụng của riêng mình",
-  "members.datasetOperator": "Quản trị viên kiến thức",
   "members.datasetOperatorTip": "Chỉ có thể quản lý cơ sở kiến thức",
   "members.deleteMember": "Xóa thành viên",
   "members.disInvite": "Hủy lời mời",
-  "members.editor": "Biên tập viên",
   "members.editorTip": "Có thể xây dựng ứng dụng, không thể quản lý cài đặt nhóm",
   "members.email": "Email",
   "members.emailInvalid": "Định dạng Email không hợp lệ",
@@ -273,10 +272,9 @@
   "members.invitedAsRole": "Được mời với vai trò {{role}}",
   "members.lastActive": "HOẠT ĐỘNG GẦN ĐÂY",
   "members.name": "TÊN",
-  "members.normal": "Bình thường",
+  "members.noNewInvitationsSent": "Không có lời mời mới nào được gửi",
   "members.normalTip": "Chỉ có thể sử dụng ứng dụng, không thể xây dựng ứng dụng",
   "members.ok": "OK",
-  "members.owner": "Chủ sở hữu",
   "members.pending": "Đang chờ...",
   "members.removeFromTeam": "Xóa khỏi nhóm",
   "members.removeFromTeamTip": "Sẽ xóa quyền truy cập nhóm",
@@ -311,12 +309,14 @@
   "menus.apps": "Studio",
   "menus.datasets": "Kiến thức",
   "menus.datasetsTips": "SẮP RA MẮT: Nhập dữ liệu văn bản của bạn hoặc cập nhật dữ liệu theo thời gian thực thông qua Webhook để cải thiện ngữ cảnh LLM.",
+  "menus.deployments": "Triển khai",
   "menus.explore": "Khám phá",
   "menus.exploreMarketplace": "Khám phá Marketplace",
   "menus.newApp": "Ứng dụng mới",
   "menus.newDataset": "Tạo Kiến thức",
   "menus.plugins": "Tích hợp",
   "menus.pluginsTips": "Tích hợp các tích hợp bên thứ ba hoặc tạo ra các AI-Tích hợp tương thích với ChatGPT.",
+  "menus.roster": "Danh sách tác nhân",
   "menus.status": "beta",
   "menus.tools": "Công cụ",
   "model.addMoreModel": "Điều chỉnh cài đặt để thêm mô hình",
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Mô hình Văn bản thành Tiếng nói",
   "modelProvider.ttsModel.tip": "Thiết lập mô hình mặc định cho đầu vào văn bản thành tiếng nói trong cuộc trò chuyện.",
   "modelProvider.upgradeForLoadBalancing": "Nâng cấp gói của bạn để bật Cân bằng tải.",
+  "navigation.skipToMain": "Chuyển đến nội dung chính",
   "noData": "Không có dữ liệu",
   "operation.add": "Thêm",
   "operation.added": "Đã thêm",
@@ -600,9 +601,6 @@
   "placeholder.input": "Vui lòng nhập",
   "placeholder.search": "Tìm kiếm...",
   "placeholder.select": "Vui lòng chọn",
-  "plugin.serpapi.apiKey": "Khóa API",
-  "plugin.serpapi.apiKeyPlaceholder": "Nhập khóa API của bạn",
-  "plugin.serpapi.keyFrom": "Nhận khóa SerpAPI của bạn từ Trang tài khoản SerpAPI",
   "promptEditor.context.item.desc": "Chèn mẫu bối cảnh",
   "promptEditor.context.item.title": "Bối cảnh",
   "promptEditor.context.modal.add": "Thêm Bối cảnh",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
new file mode 100644
index 00000000000..30fa31f5605
--- /dev/null
+++ b/web/i18n/vi-VN/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "API dịch vụ backend",
+  "access.api.copyCurlExample": "Sao chép ví dụ cURL",
+  "access.api.createFailed": "Không thể tạo API Token.",
+  "access.api.createKey": "Tạo API Token",
+  "access.api.createKeyTitle": "Tạo API Token mới",
+  "access.api.curlExampleTitle": "Ví dụ cURL",
+  "access.api.description": "Truy cập triển khai này qua HTTP. Mỗi API Token chỉ áp dụng cho một môi trường.",
+  "access.api.developerTitle": "API Nhà phát triển",
+  "access.api.disabled": "Truy cập API đã tắt cho triển khai này.",
+  "access.api.disabledHint": "Bật truy cập API để tạo các token gắn với từng môi trường.",
+  "access.api.dismissToken": "Đóng API Token",
+  "access.api.docs": "Tài liệu API",
+  "access.api.docsClose": "Đóng tài liệu API",
+  "access.api.docsDescription": "Xem tài liệu tham khảo API Workflow cho triển khai này.",
+  "access.api.docsTitle": "Tài liệu API Workflow",
+  "access.api.empty": "Hãy triển khai đến một môi trường trước để bắt đầu phát hành API Token.",
+  "access.api.emptyTitle": "Chưa có môi trường nào được triển khai",
+  "access.api.endpoint": "URL yêu cầu",
+  "access.api.envPrefix": "env: {{env}}",
+  "access.api.keyList": "Danh sách API Token",
+  "access.api.nameLabel": "Tên API Token",
+  "access.api.namePlaceholder": "Nhập tên cho API Token",
+  "access.api.nameRequired": "Tên API Token là bắt buộc.",
+  "access.api.newKey": "Tạo API Token mới",
+  "access.api.newTokenDescription": "API Token này chỉ hiển thị một lần. Hãy sao chép trước khi rời khỏi trang này.",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "Đã tạo API Token",
+  "access.api.noKeys": "Chưa có API Token nào. Hãy tạo một token để bắt đầu gọi API.",
+  "access.api.noKeysTitle": "Chưa có API Token",
+  "access.api.revokeConfirmDescription": "API Token \"{{name}}\" sẽ ngừng hoạt động ngay lập tức. Hành động này không thể hoàn tác.",
+  "access.api.revokeConfirmTitle": "Thu hồi API Token?",
+  "access.api.revokeFailed": "Không thể thu hồi API Token.",
+  "access.api.revokeSuccess": "Đã thu hồi API Token",
+  "access.api.table.action": "Hành động",
+  "access.api.table.environment": "Môi trường",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "Tên",
+  "access.api.title": "API",
+  "access.channels.col.channel": "Kênh",
+  "access.channels.col.endpoint": "Điểm truy cập",
+  "access.channels.col.status": "Trạng thái",
+  "access.channels.description": "Các điểm truy cập WebApp và CLI sử dụng quyền truy cập ở trên.",
+  "access.channels.disabled": "Các kênh truy cập đã tắt cho triển khai này.",
+  "access.channels.disabledHint": "Bật các kênh truy cập để mở điểm truy cập WebApp và CLI.",
+  "access.channels.followPermission": "Tuân theo quyền truy cập",
+  "access.channels.title": "Kênh truy cập",
+  "access.cli.description": "Gọi từ terminal bằng difyctl, phù hợp với script, quy trình tự động hoặc tích hợp Agent.",
+  "access.cli.docs": "Hướng dẫn sử dụng",
+  "access.cli.domain": "Tên miền",
+  "access.cli.empty": "Chưa cấu hình điểm cuối CLI.",
+  "access.cli.install": "Cài đặt CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "Đã sao chép",
+  "access.copy": "Sao chép",
+  "access.copyFailed": "Sao chép thất bại",
+  "access.copyToast": "Đã sao chép vào clipboard",
+  "access.hide": "Ẩn",
+  "access.members.clearAll": "Xóa tất cả",
+  "access.members.empty": "Không tìm thấy kết quả phù hợp.",
+  "access.members.groupCount_one": "{{count}} nhóm",
+  "access.members.groupCount_other": "{{count}} nhóm",
+  "access.members.groups": "Nhóm",
+  "access.members.individuals": "Thành viên",
+  "access.members.memberCount_one": "{{count}} thành viên",
+  "access.members.memberCount_other": "{{count}} thành viên",
+  "access.members.pickPlaceholder": "Chọn nhóm hoặc thành viên",
+  "access.members.searchPlaceholder": "Tìm kiếm nhóm và thành viên",
+  "access.members.selectedLabel": "Đã chọn",
+  "access.permission.anyone": "Bất kỳ ai có liên kết",
+  "access.permission.anyoneDesc": "Bất kỳ ai cũng có thể truy cập triển khai này mà không cần đăng nhập.",
+  "access.permission.memberCount_one": "{{count}} thành viên",
+  "access.permission.memberCount_other": "{{count}} thành viên",
+  "access.permission.organization": "Tất cả thành viên trong nền tảng",
+  "access.permission.organizationDesc": "Tất cả thành viên trong nền tảng",
+  "access.permission.specific": "Thành viên cụ thể trong nền tảng",
+  "access.permission.specificDesc": "Chọn nhóm hoặc thành viên cụ thể",
+  "access.permission.specificUnavailable": "Tùy chọn chọn thành viên cụ thể bị vô hiệu hóa cho đến khi các thành viên và nhóm thực sự trên nền tảng được kết nối.",
+  "access.permission.updateFailed": "Không thể cập nhật chính sách truy cập.",
+  "access.permissions.col.environment": "Môi trường",
+  "access.permissions.col.permission": "Truy cập",
+  "access.permissions.description": "Thiết lập quyền truy cập cho các điểm truy cập WebApp và CLI trong mỗi môi trường.",
+  "access.permissions.editAriaLabel": "Cấu hình truy cập cho {{environment}}",
+  "access.permissions.editDescription": "Thiết lập quyền truy cập cho các điểm truy cập WebApp và CLI.",
+  "access.permissions.editTitle": "Quyền truy cập",
+  "access.permissions.title": "Quyền truy cập",
+  "access.revoke": "Thu hồi",
+  "access.runAccess.description": "Quản lý cách người dùng có thể chạy triển khai này và ai được phép truy cập theo từng môi trường.",
+  "access.runAccess.disabled": "Truy cập chạy đã tắt cho triển khai này.",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "Hiển thị triển khai này như một máy chủ Model Context Protocol.",
+  "access.runAccess.mcpEmpty": "Chưa cấu hình điểm cuối MCP.",
+  "access.runAccess.noEnvs": "Hãy triển khai đến một môi trường để cấu hình quyền truy cập.",
+  "access.runAccess.noEnvsTitle": "Chưa có môi trường nào được triển khai",
+  "access.runAccess.openWebapp": "Mở WebApp",
+  "access.runAccess.permissions": "Quyền truy cập",
+  "access.runAccess.permissionsDesc": "Ai có thể truy cập triển khai này trong từng môi trường.",
+  "access.runAccess.title": "Truy cập chạy",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "Trang web được lưu trữ dành cho người dùng cuối.",
+  "access.runAccess.webappEmpty": "Sắp ra mắt.",
+  "access.show": "Hiện",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "Bên ngoài",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "Không xác định",
+  "card.access.api": "API Tokens",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "Không có quyền truy cập",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "Tạo bản phát hành đầu tiên",
+  "card.deploy": "Triển khai",
+  "card.deploying": "{{count}} đang triển khai",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} thất bại",
+  "card.fromApp": "Từ {{name}}",
+  "card.lastDeployed": "Triển khai lần cuối {{time}}",
+  "card.menu.delete": "Xóa triển khai",
+  "card.menu.deleteDisabled": "Tính năng xóa triển khai chưa khả dụng cho các triển khai do backend quản lý.",
+  "card.menu.deploy": "Triển khai đến môi trường",
+  "card.menu.editInfo": "Chỉnh sửa thông tin",
+  "card.menu.viewDetail": "Xem chi tiết triển khai",
+  "card.moreActions": "Thêm thao tác",
+  "card.neverDeployed": "Chưa được triển khai",
+  "card.noDescription": "Không có mô tả.",
+  "card.notDeployed": "Chưa triển khai",
+  "card.ready": "{{count}} đang chạy",
+  "card.tooltip.createdAt": "Đã tạo",
+  "card.tooltip.deployed": "Đã triển khai",
+  "card.tooltip.deploymentStatus": "Triển khai",
+  "card.tooltip.notDeployed": "Triển khai này chưa được triển khai đến môi trường nào.",
+  "card.tooltip.notDeployedShort": "Chưa triển khai",
+  "card.tooltip.release": "Bản phát hành",
+  "card.tooltip.releaseName": "Tên bản phát hành",
+  "card.tooltip.source": "Nguồn",
+  "common.loadFailed": "Không thể tải. Vui lòng thử lại sau.",
+  "common.loading": "Đang tải...",
+  "createGuide.actions.back": "Quay lại",
+  "createGuide.actions.cancel": "Hủy",
+  "createGuide.actions.continue": "Tiếp tục",
+  "createGuide.actions.createAndDeploy": "Tạo & Triển khai",
+  "createGuide.actions.creating": "Đang tạo...",
+  "createGuide.actions.deploy": "Triển khai",
+  "createGuide.actions.deploying": "Đang tạo & triển khai...",
+  "createGuide.actions.next": "Tiếp theo",
+  "createGuide.actions.skipDeploy": "Bỏ qua, triển khai sau",
+  "createGuide.description": "Tạo một triển khai từ nguồn phát hành, thông tin cơ bản và môi trường đích.",
+  "createGuide.dsl.defaultAppName": "Ứng dụng DSL đã nhập",
+  "createGuide.dsl.description": "Tải lên gói Workflow DSL để tạo triển khai, bản phát hành đầu tiên và triển khai đến môi trường tùy chọn.",
+  "createGuide.dsl.dropDescription": "Tải lên gói Workflow YAML DSL. Các tùy chọn triển khai được xác định từ tệp này trước khi triển khai.",
+  "createGuide.dsl.dropTitle": "Tải lên gói Workflow DSL",
+  "createGuide.dsl.readFailed": "Không thể đọc tệp DSL. Vui lòng chọn tệp khác và thử lại.",
+  "createGuide.dsl.reading": "Đang đọc tệp DSL...",
+  "createGuide.dsl.title": "Nhập DSL",
+  "createGuide.dsl.unsupportedMode": "Chỉ tệp Workflow DSL có thể được sử dụng cho triển khai.",
+  "createGuide.errors.createReleaseFailed": "Không thể tạo triển khai hoặc bản phát hành.",
+  "createGuide.errors.deployFailed": "Không thể triển khai đến môi trường.",
+  "createGuide.method.description": "Chọn nguồn được sử dụng để tạo bản phát hành đầu tiên.",
+  "createGuide.methods.bindApp.description": "Sử dụng một Workflow App hiện có trong Studio làm nguồn phát hành.",
+  "createGuide.methods.bindApp.title": "Liên kết Workflow App hiện có",
+  "createGuide.methods.importDsl.description": "Tải lên gói Workflow YAML DSL và tiếp tục qua giao diện triển khai.",
+  "createGuide.methods.importDsl.title": "Nhập DSL",
+  "createGuide.methods.mocked": "Mô phỏng",
+  "createGuide.nav.back": "Triển khai",
+  "createGuide.release.defaultName": "bản phát hành ban đầu",
+  "createGuide.release.deployInfo": "Thông tin triển khai",
+  "createGuide.release.description": "Điền thông tin triển khai và chi tiết bản phát hành đầu tiên.",
+  "createGuide.release.firstVersion": "Bản phát hành đầu tiên",
+  "createGuide.release.instanceDescription": "Mô tả triển khai",
+  "createGuide.release.instanceDescriptionPlaceholder": "Mô tả mục đích sử dụng của triển khai này",
+  "createGuide.release.instanceName": "Tên triển khai",
+  "createGuide.release.instanceNameConflict": "Đã tồn tại một triển khai với tên này. Vui lòng chọn tên khác.",
+  "createGuide.release.releaseDescription": "Mô tả bản phát hành",
+  "createGuide.release.releaseDescriptionPlaceholder": "Mô tả bản phát hành này",
+  "createGuide.release.releaseName": "Tên bản phát hành",
+  "createGuide.release.releaseNote": "Mô tả bản phát hành",
+  "createGuide.release.title": "Thông tin cơ bản",
+  "createGuide.source.availableApps_one": "{{count}} ứng dụng",
+  "createGuide.source.availableApps_other": "{{count}} ứng dụng",
+  "createGuide.source.clearSearch": "Xóa tìm kiếm ứng dụng",
+  "createGuide.source.description": "Chọn nguồn được sử dụng để tạo bản phát hành đầu tiên.",
+  "createGuide.source.empty": "Không tìm thấy Workflow App nào.",
+  "createGuide.source.searchPlaceholder": "Tìm kiếm ứng dụng",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "Nguồn phát hành",
+  "createGuide.steps.method": "Nguồn phát hành",
+  "createGuide.steps.release": "Thông tin cơ bản",
+  "createGuide.steps.source": "Nguồn phát hành",
+  "createGuide.steps.target": "Triển khai đến môi trường",
+  "createGuide.target.bindingCount_one": "{{count}} liên kết",
+  "createGuide.target.bindingCount_other": "{{count}} liên kết",
+  "createGuide.target.bindingHint": "Chọn thông tin xác thực được sử dụng bởi bản phát hành này.",
+  "createGuide.target.bindings": "Thông tin xác thực",
+  "createGuide.target.deferredBindingHint": "Thông tin xác thực sẽ được xác định từ kế hoạch triển khai thực tế trong bước triển khai cuối cùng.",
+  "createGuide.target.deferredEnvironmentHint": "Tên sẽ được khớp với các môi trường thực sau khi triển khai và bản phát hành được tạo.",
+  "createGuide.target.description": "Chọn môi trường đích và cung cấp các thiết lập runtime mà bản phát hành này cần ở đó. Bước này có thể bỏ qua.",
+  "createGuide.target.envVarCount_one": "{{count}} biến",
+  "createGuide.target.envVarCount_other": "{{count}} biến",
+  "createGuide.target.envVarHint": "Với mỗi biến môi trường mà bản phát hành này cần, hãy nhập giá trị tùy chỉnh hoặc sử dụng giá trị được định nghĩa trong ứng dụng.",
+  "createGuide.target.envVarPlaceholder": "Nhập giá trị",
+  "createGuide.target.envVarSource.ariaLabel": "Chọn nguồn giá trị biến cho {{key}}",
+  "createGuide.target.envVarSource.default": "Giá trị ứng dụng",
+  "createGuide.target.envVarSource.lastDeployment": "Giá trị triển khai gần nhất",
+  "createGuide.target.envVarSource.literal": "Giá trị tùy chỉnh",
+  "createGuide.target.envVarType.number": "Số",
+  "createGuide.target.envVarType.secret": "Bí mật",
+  "createGuide.target.envVarType.string": "Chuỗi",
+  "createGuide.target.envVars": "Biến môi trường",
+  "createGuide.target.environment": "Môi trường đích",
+  "createGuide.target.environmentName": "Tên môi trường",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "Không thể tải thông tin xác thực.",
+  "createGuide.target.loadEnvironmentsFailed": "Không thể tải các môi trường triển khai.",
+  "createGuide.target.missingRequiredBinding": "Chọn thông tin xác thực cho liên kết bắt buộc này.",
+  "createGuide.target.noBindingRequired": "Không yêu cầu thông tin xác thực.",
+  "createGuide.target.noCredentialCandidates": "Không có thông tin xác thực khả dụng.",
+  "createGuide.target.noEnvironmentOptions": "Không có môi trường triển khai khả dụng.",
+  "createGuide.target.required": "Bắt buộc",
+  "createGuide.target.selectCredential": "Chọn thông tin xác thực",
+  "createGuide.target.title": "Triển khai đến môi trường",
+  "createGuide.title": "Triển khai mới",
+  "createModal.appPickerPlaceholder": "Chọn một Workflow App",
+  "createModal.appSearchEmpty": "Không có Workflow App nào phù hợp",
+  "createModal.appSearchPlaceholder": "Tìm kiếm Workflow Apps…",
+  "createModal.cancel": "Hủy",
+  "createModal.create": "Tạo",
+  "createModal.createFailed": "Không thể tạo triển khai.",
+  "createModal.description": "Chọn một Workflow App và tạo triển khai.",
+  "createModal.descriptionLabel": "Mô tả",
+  "createModal.descriptionPlaceholder": "Mô tả mục đích sử dụng của triển khai này",
+  "createModal.loadMoreApps": "Tải thêm ứng dụng",
+  "createModal.loadingApps": "Đang tải ứng dụng…",
+  "createModal.nameLabel": "Tên triển khai",
+  "createModal.namePlaceholder": "Tên triển khai",
+  "createModal.noApps": "Không tìm thấy Workflow App nào trong workspace này. Hãy tạo một ứng dụng trong Studio trước.",
+  "createModal.selected": "Đã chọn",
+  "createModal.sourceApp": "Workflow App (bắt buộc)",
+  "createModal.title": "Triển khai mới",
+  "deployDrawer.bindingCount_one": "{{count}} liên kết",
+  "deployDrawer.bindingCount_other": "{{count}} liên kết",
+  "deployDrawer.bindingOptionsFailed": "Không thể tải các tùy chọn thông tin xác thực.",
+  "deployDrawer.bindingSelectionHint": "Chọn thông tin xác thực được sử dụng bởi triển khai này.",
+  "deployDrawer.bindingsDisabled": "Đã được xác định từ bản xem trước. Chưa thể chỉnh sửa.",
+  "deployDrawer.cancel": "Hủy",
+  "deployDrawer.close": "Đóng ngăn triển khai",
+  "deployDrawer.defaultSelect": "Chọn...",
+  "deployDrawer.deploy": "Triển khai đến môi trường",
+  "deployDrawer.deployExistingRelease": "Triển khai đến môi trường",
+  "deployDrawer.deployExistingReleaseDescription": "Chọn một bản phát hành và môi trường đích để triển khai.",
+  "deployDrawer.deployExistingReleaseTitle": "Triển khai đến môi trường",
+  "deployDrawer.deployFailed": "Không thể bắt đầu triển khai.",
+  "deployDrawer.deploying": "Đang triển khai...",
+  "deployDrawer.description": "Chọn một bản phát hành và môi trường đích để triển khai.",
+  "deployDrawer.envVarCount_one": "{{count}} biến",
+  "deployDrawer.envVarCount_other": "{{count}} biến",
+  "deployDrawer.envVarHint": "Với mỗi biến môi trường mà bản phát hành này cần, hãy nhập giá trị tùy chỉnh hoặc sử dụng giá trị được định nghĩa trong ứng dụng.",
+  "deployDrawer.envVarPlaceholder": "Nhập giá trị",
+  "deployDrawer.envVarSource.ariaLabel": "Chọn nguồn giá trị biến cho {{key}}",
+  "deployDrawer.envVarSource.default": "Giá trị ứng dụng",
+  "deployDrawer.envVarSource.lastDeployment": "Giá trị triển khai gần nhất",
+  "deployDrawer.envVarSource.literal": "Giá trị tùy chỉnh",
+  "deployDrawer.envVarType.number": "Số",
+  "deployDrawer.envVarType.secret": "Bí mật",
+  "deployDrawer.envVarType.string": "Chuỗi",
+  "deployDrawer.envVars": "Biến môi trường",
+  "deployDrawer.existingReleaseHint": "Bản phát hành này sẽ được triển khai nguyên trạng. Không có bản phát hành mới nào được tạo.",
+  "deployDrawer.loadingBindings": "Đang xử lý...",
+  "deployDrawer.lockedHint": "Đã khóa với môi trường hiện tại",
+  "deployDrawer.missingRequiredBinding": "Chọn thông tin xác thực cho liên kết bắt buộc này.",
+  "deployDrawer.missingRequiredEnvVar": "Nhập giá trị cho biến môi trường bắt buộc này.",
+  "deployDrawer.modelCreds": "Thông tin xác thực mô hình",
+  "deployDrawer.needsValidation": " (cần xác thực)",
+  "deployDrawer.newReleaseHint": "Một bản phát hành mới sẽ được tạo từ YAML Workflow App đã chọn.",
+  "deployDrawer.noBindingRequired": "Không bắt buộc",
+  "deployDrawer.noCredentialCandidates": "Không có thông tin xác thực khả dụng.",
+  "deployDrawer.noNewEnvironmentAvailable": "Tất cả các môi trường khả dụng đã có triển khai.",
+  "deployDrawer.noOtherReleaseAvailable": "Không có bản phát hành nào khác khả dụng cho môi trường này.",
+  "deployDrawer.noReleaseAvailable": "Tạo một bản phát hành trước khi triển khai đến môi trường.",
+  "deployDrawer.notFound": "Không tìm thấy triển khai.",
+  "deployDrawer.noteLabel": "Mô tả bản phát hành (tùy chọn)",
+  "deployDrawer.notePlaceholder": "Ví dụ: Cập nhật nội dung onboarding",
+  "deployDrawer.pluginCreds": "Thông tin xác thực Plugin",
+  "deployDrawer.promote": "Triển khai",
+  "deployDrawer.promoteDescription": "Chọn một bản phát hành và môi trường đích để triển khai.",
+  "deployDrawer.promoteTitle": "Triển khai đến môi trường",
+  "deployDrawer.readOnly": "Chỉ đọc",
+  "deployDrawer.redeploy": "Triển khai đến môi trường",
+  "deployDrawer.redeployDescription": "Chọn một bản phát hành và môi trường đích để triển khai.",
+  "deployDrawer.redeployExistingReleaseHint": "Bản phát hành hiện tại sẽ được triển khai lại nguyên trạng. Không có bản phát hành mới nào được tạo.",
+  "deployDrawer.redeployTitle": "Triển khai đến môi trường",
+  "deployDrawer.releaseLabel": "Bản phát hành",
+  "deployDrawer.requiredBinding": "Bắt buộc",
+  "deployDrawer.rollback": "Triển khai",
+  "deployDrawer.rollbackDescription": "Chọn một bản phát hành và môi trường đích để triển khai.",
+  "deployDrawer.rollbackTitle": "Triển khai đến môi trường",
+  "deployDrawer.runtimeCredentials": "Thông tin xác thực",
+  "deployDrawer.secretPlaceholder": "bí mật",
+  "deployDrawer.selectCredential": "Chọn thông tin xác thực",
+  "deployDrawer.selectEnv": "Chọn một môi trường",
+  "deployDrawer.selectProviderCred": "Chọn thông tin xác thực {{provider}}",
+  "deployDrawer.selectProviderKey": "Chọn khóa {{provider}}",
+  "deployDrawer.selectRelease": "Chọn một bản phát hành",
+  "deployDrawer.targetEnv": "Môi trường đích",
+  "deployDrawer.title": "Triển khai đến môi trường",
+  "deployDrawer.valuePlaceholder": "giá trị",
+  "deployTab.cancelDeployment": "Hủy triển khai",
+  "deployTab.closeError": "Đóng",
+  "deployTab.col.actions": "Thao tác",
+  "deployTab.col.currentRelease": "Bản phát hành hiện tại",
+  "deployTab.col.environment": "Môi trường",
+  "deployTab.col.status": "Trạng thái",
+  "deployTab.col.updated": "Đã cập nhật",
+  "deployTab.collapseDetails": "Thu gọn chi tiết triển khai",
+  "deployTab.confirmUndeploy": "Hủy triển khai",
+  "deployTab.deployOtherVersion": "Triển khai bản phát hành khác",
+  "deployTab.deployToEnv": "Triển khai đến {{name}}",
+  "deployTab.deployToNewEnv": "Triển khai đến môi trường mới...",
+  "deployTab.empty": "Chưa có phiên bản nào. Hãy triển khai đến môi trường mới để bắt đầu.",
+  "deployTab.emptyDescription": "Chọn một bản phát hành và môi trường đích để cung cấp triển khai này cho người dùng.",
+  "deployTab.emptyTitle": "Chưa có môi trường nào đang chạy",
+  "deployTab.envCount": "Môi trường",
+  "deployTab.errorCode": "Mã",
+  "deployTab.errorDialogDesc": "Xem lại triển khai thất bại gần nhất trước khi thử lại hoặc triển khai bản phát hành khác.",
+  "deployTab.errorDialogTitle": "Lỗi triển khai ở {{name}}",
+  "deployTab.errorMessage": "Thông báo",
+  "deployTab.errorPhase": "Giai đoạn",
+  "deployTab.expandDetails": "Mở rộng chi tiết triển khai",
+  "deployTab.moreActions": "Thêm thao tác",
+  "deployTab.newDeployment": "Triển khai đến môi trường mới",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "Deployment ID",
+  "deployTab.panel.endpoints": "Điểm cuối",
+  "deployTab.panel.envVars": "Biến môi trường",
+  "deployTab.panel.error": "Lỗi",
+  "deployTab.panel.failedRelease": "Bản phát hành thất bại",
+  "deployTab.panel.health": "Sức khỏe",
+  "deployTab.panel.instanceInfo": "Thông tin phiên bản",
+  "deployTab.panel.modelCreds": "Thông tin xác thực mô hình",
+  "deployTab.panel.pluginCreds": "Thông tin xác thực Plugin",
+  "deployTab.panel.release": "Bản phát hành",
+  "deployTab.panel.releaseCreatedAt": "Bản phát hành được tạo lúc",
+  "deployTab.panel.releaseInfo": "Thông tin bản phát hành",
+  "deployTab.panel.replicas": "Bản sao",
+  "deployTab.panel.run": "Chạy",
+  "deployTab.panel.runtimeBindings": "Thông tin xác thực",
+  "deployTab.panel.runtimeInfo": "Thông tin runtime",
+  "deployTab.panel.runtimeMode": "Chế độ runtime",
+  "deployTab.panel.runtimeNote": "Ghi chú runtime",
+  "deployTab.panel.targetRelease": "Bản phát hành đích",
+  "deployTab.panel.unknownError": "Triển khai thất bại.",
+  "deployTab.promote": "Triển khai",
+  "deployTab.redeploy": "Triển khai lại",
+  "deployTab.releaseCreatedAt": "Bản phát hành đã tạo {{time}}",
+  "deployTab.retry": "Thử lại",
+  "deployTab.shortcut": "Phím tắt",
+  "deployTab.status.deployFailed": "Triển khai thất bại",
+  "deployTab.status.deployingRelease": "Đang triển khai ({{release}})",
+  "deployTab.status.runningOutOfSync": "Đang chạy (đang chờ đồng bộ)",
+  "deployTab.status.runningWithFailed": "Đang chạy (triển khai gần nhất thất bại)",
+  "deployTab.undeploy": "Hủy triển khai",
+  "deployTab.undeployConfirmDesc": "Quyền truy cập của người dùng cuối sẽ bị dừng ngay lập tức. Bản phát hành có thể được triển khai lại sau.",
+  "deployTab.undeployConfirmTitle": "Hủy triển khai khỏi {{name}}?",
+  "deployTab.undeployFrom": "Hủy triển khai khỏi {{name}}",
+  "deployTab.undeployImpactTitle": "Phiên bản bị ảnh hưởng",
+  "deployTab.viewError": "Xem lỗi",
+  "deployTab.viewLogs": "Xem nhật ký",
+  "deployTab.viewProgress": "Xem tiến trình",
+  "detail.backToInstances": "Quay lại danh sách triển khai",
+  "detail.deployingCount": "{{count}} đang triển khai",
+  "detail.envCount_one": "{{count}} môi trường",
+  "detail.envCount_other": "{{count}} môi trường",
+  "detail.failedCount": "{{count}} thất bại",
+  "detail.mobileTabs": "Các mục triển khai",
+  "detail.notFound": "Không tìm thấy triển khai",
+  "detail.openSourceApp": "Mở nguồn {{name}}",
+  "detail.sourceApp": "Nguồn",
+  "detail.sourceAppLink": "Nguồn",
+  "documentTitle.create": "Triển khai mới · Triển khai",
+  "documentTitle.detail": "Triển khai · Triển khai",
+  "documentTitle.list": "Triển khai",
+  "filter.allEnvs": "Tất cả môi trường",
+  "filter.notDeployed": "Chưa triển khai",
+  "filter.searchPlaceholder": "Tìm kiếm triển khai",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "Đang chấp nhận",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "Đang khởi động",
+  "health.ENVIRONMENT_STATUS_DELETING": "Đang xóa",
+  "health.ENVIRONMENT_STATUS_FAILED": "Không khả dụng",
+  "health.ENVIRONMENT_STATUS_READY": "Khả dụng",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "Không xác định",
+  "list.clearFilters": "Xóa bộ lọc",
+  "list.clearSearch": "Xóa tìm kiếm triển khai",
+  "list.createDeployment": "Mới",
+  "list.empty": "Không tìm thấy triển khai nào.",
+  "list.emptyDescription": "Tạo một triển khai từ Workflow App hoặc gói Workflow DSL để quản lý các bản phát hành, môi trường và quyền truy cập.",
+  "list.emptyFilteredDescription": "Không có triển khai nào khớp với tìm kiếm hoặc bộ lọc môi trường hiện tại.",
+  "list.emptyFilteredTitle": "Không có triển khai phù hợp",
+  "list.emptyTitle": "Chưa có triển khai nào",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "Cô lập",
+  "mode.ENVIRONMENT_MODE_SHARED": "Chia sẻ",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "Không xác định",
+  "newInstance.comingSoon": "Sắp ra mắt",
+  "newInstance.fromStudio": "Chọn từ Studio",
+  "newInstance.importDSL": "Nhập DSL",
+  "newInstance.title": "Triển khai mới",
+  "overview.accessEndpoints": "Điểm truy cập",
+  "overview.accessMeta.apiTokens": "Quản lý API Tokens",
+  "overview.accessMeta.cli": "Xem truy cập CLI",
+  "overview.accessMeta.webApp": "Quản lý truy cập WebApp",
+  "overview.accessStatus": "Truy cập",
+  "overview.api": "API Tokens",
+  "overview.apiKeysCount_one": "{{count}} API Token",
+  "overview.apiKeysCount_other": "{{count}} API Tokens",
+  "overview.apiTokenSummary.environments_one": "{{count}} môi trường đã triển khai",
+  "overview.apiTokenSummary.environments_other": "{{count}} môi trường đã triển khai",
+  "overview.availableForDeployment": "Sẵn sàng để triển khai",
+  "overview.basicInfo": "Thông tin cơ bản",
+  "overview.cardAction.deployLatest": "Triển khai bản phát hành mới nhất",
+  "overview.cardAction.redeploy": "Triển khai lại",
+  "overview.cardAction.viewProgress": "Xem triển khai",
+  "overview.chip.behindTooltip_one": "Trễ 1 bản phát hành so với mới nhất. Hãy triển khai bản phát hành mới nhất để cập nhật.",
+  "overview.chip.behindTooltip_other": "Trễ {{count}} bản phát hành so với mới nhất. Hãy triển khai bản phát hành mới nhất để cập nhật.",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "đang triển khai",
+  "overview.chip.deployingTooltip": "Triển khai đang được thực hiện.",
+  "overview.chip.empty": "trống",
+  "overview.chip.emptyTooltip": "Chưa có bản phát hành nào được triển khai đến môi trường này.",
+  "overview.chip.failed": "thất bại",
+  "overview.chip.failedTooltip": "Lần thử triển khai gần nhất đã thất bại.",
+  "overview.chip.latest": "mới nhất",
+  "overview.chip.latestTooltip": "Môi trường này đang chạy bản phát hành mới nhất.",
+  "overview.chip.needsReleaseFirst": "Tạo một bản phát hành trước",
+  "overview.chip.olderRelease": "cũ hơn",
+  "overview.chip.olderReleaseTooltip": "Môi trường này đang chạy bản phát hành cũ hơn.",
+  "overview.chip.openInDeployTab": "Xem tiến trình triển khai",
+  "overview.cli": "CLI",
+  "overview.configured": "Đã cấu hình",
+  "overview.createRelease": "Tạo bản phát hành",
+  "overview.created": "Đã tạo",
+  "overview.deploy": "Triển khai",
+  "overview.deployedEnvironments": "đã triển khai",
+  "overview.deploymentOverview": "Tổng quan triển khai",
+  "overview.deploymentStatus": "Trạng thái triển khai",
+  "overview.description": "Mô tả",
+  "overview.developerApi": "API Nhà phát triển",
+  "overview.disabled": "Đã tắt",
+  "overview.emptyValue": "Chưa thiết lập",
+  "overview.enabled": "Đã bật",
+  "overview.enabledChannels": "kênh truy cập đã bật",
+  "overview.endUserAccess": "Truy cập người dùng cuối",
+  "overview.environments": "Môi trường",
+  "overview.hero.byName": "bởi {{name}}",
+  "overview.hero.empty": "Chưa có bản phát hành nào",
+  "overview.hero.emptyDescription": "Hãy tạo một bản phát hành từ nguồn hiện tại trước khi triển khai.",
+  "overview.hero.propagation_one": "đã triển khai đến {{count}}/{{total}} môi trường",
+  "overview.hero.propagation_other": "đã triển khai đến {{count}}/{{total}} môi trường",
+  "overview.hero.untargeted": "chưa có môi trường nào được cấu hình",
+  "overview.instanceDetails": "Chi tiết triển khai",
+  "overview.instanceId": "Deployment ID",
+  "overview.latestRelease.releaseCount_one": "{{count}} bản phát hành",
+  "overview.latestRelease.releaseCount_other": "{{count}} bản phát hành",
+  "overview.latestReleaseTitle": "Bản phát hành mới nhất",
+  "overview.manageDeployments": "Quản lý triển khai",
+  "overview.name": "Tên",
+  "overview.noAccessConfig": "Không có cấu hình truy cập.",
+  "overview.noReleaseYet": "Tạo một bản phát hành trước khi triển khai đến môi trường.",
+  "overview.notConfigured": "Chưa cấu hình",
+  "overview.previousReleases.empty": "Chưa có bản phát hành trước đó.",
+  "overview.previousReleases.retired": "Hiện chưa được triển khai",
+  "overview.previousReleases.title": "Bản phát hành trước đó",
+  "overview.previousReleases.viewAll": "Xem tất cả",
+  "overview.ready": "Có thể triển khai",
+  "overview.recentReleases": "Bản phát hành gần đây",
+  "overview.releaseDeployedTitle": "{{release}} đã được triển khai",
+  "overview.releaseReadyTitle": "{{release}} sẵn sàng để triển khai",
+  "overview.serviceMap": "Bản đồ dịch vụ",
+  "overview.servingRelease": "Đang phục vụ {{release}}",
+  "overview.servingReleaseDescription": "Triển khai này được triển khai đến {{count}}/{{total}} môi trường.",
+  "overview.strip.deployToNewEnvironment": "Triển khai đến môi trường mới",
+  "overview.strip.empty": "Chưa có môi trường nào được cấu hình.",
+  "overview.strip.emptyDeployableDescription": "Triển khai bản phát hành mới nhất đến một môi trường khi bạn đã sẵn sàng.",
+  "overview.strip.emptyDeployed": "Chưa có phiên bản nào.",
+  "overview.strip.emptyDescription": "Tạo một bản phát hành trước khi triển khai đến môi trường.",
+  "overview.strip.emptyTitle": "Chưa có phiên bản nào",
+  "overview.strip.summary_one": "1 trong số {{total}} đang chạy bản phát hành mới nhất",
+  "overview.strip.summary_other": "{{count}} trong số {{total}} đang chạy bản phát hành mới nhất",
+  "overview.strip.title": "Phiên bản",
+  "overview.switchSourceApp": "Đổi nguồn",
+  "overview.switchSourceAppDescription": "Chọn Workflow App được sử dụng làm nguồn cho các bản phát hành trong tương lai.",
+  "overview.switchSourceAppHint": "Sau khi đổi, chỉ các bản phát hành mới được tạo mới sử dụng nguồn mới. Các bản phát hành cũ và triển khai hiện có sẽ không thay đổi.",
+  "overview.targetRelease": "Bản phát hành đích",
+  "overview.webapp": "WebApp",
+  "settings.danger": "Vùng nguy hiểm",
+  "settings.dangerDesc": "Xóa vĩnh viễn triển khai này và dừng mọi phiên bản đang chạy. Hành động này không thể hoàn tác.",
+  "settings.delete": "Xóa triển khai",
+  "settings.deleteConfirmDesc": "Xóa {{name}}? Mọi phiên bản sẽ ngừng chạy và bị xóa khỏi tất cả môi trường. Hành động này không thể hoàn tác.",
+  "settings.deleteConfirmTitle": "Xóa triển khai",
+  "settings.deleteFailed": "Không thể xóa triển khai.",
+  "settings.deleteImpact": "Ảnh hưởng",
+  "settings.deleteImpactInstance": "Triển khai",
+  "settings.deleteImpactTitle": "Triển khai bị ảnh hưởng",
+  "settings.deleteImpactValue": "Triển khai sẽ bị xóa khỏi danh sách triển khai.",
+  "settings.deleted": "Đã xóa triển khai",
+  "settings.description": "Mô tả",
+  "settings.descriptionHelp": "Quản lý tên, mô tả và các thiết lập khác của triển khai này.",
+  "settings.general": "Chung",
+  "settings.name": "Tên triển khai",
+  "settings.reset": "Đặt lại",
+  "settings.save": "Lưu thay đổi",
+  "settings.updateFailed": "Không thể cập nhật triển khai.",
+  "settings.updated": "Đã cập nhật triển khai",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Đang triển khai",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "Đang chờ đồng bộ",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "Triển khai thất bại",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "Không hợp lệ",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "Đang chạy",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Chưa triển khai",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Đang hủy triển khai",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Không xác định",
+  "subtitle": "Quản lý triển khai trên các môi trường.",
+  "tabs.access.description": "Quản lý các kênh truy cập và quyền truy cập.",
+  "tabs.access.name": "Truy cập",
+  "tabs.api-tokens.description": "Quản lý API Tokens và gọi các phiên bản qua HTTP.",
+  "tabs.api-tokens.name": "API Tokens",
+  "tabs.instances.description": "Xem và quản lý các phiên bản trong các môi trường đã triển khai.",
+  "tabs.instances.name": "Phiên bản",
+  "tabs.overview.description": "Xem trạng thái triển khai trên các môi trường.",
+  "tabs.overview.name": "Tổng quan",
+  "tabs.releases.description": "Tạo, triển khai và quản lý các bản phát hành.",
+  "tabs.releases.name": "Bản phát hành",
+  "tabs.settings.description": "Quản lý tên, mô tả và các thiết lập khác của triển khai này.",
+  "tabs.settings.name": "Cài đặt",
+  "title": "Triển khai",
+  "unsupportedDslNodes.description": "Bản phát hành này chứa các node mà runtime triển khai chưa hỗ trợ. Hãy xóa hoặc thay thế chúng trong Studio, sau đó thử lại.",
+  "unsupportedDslNodes.descriptionWithTypes": "Bản phát hành này chứa các node mà runtime triển khai chưa hỗ trợ: {{nodeTypes}}. Hãy xóa hoặc thay thế chúng trong Studio, sau đó thử lại.",
+  "unsupportedDslNodes.title": "Các node không được hỗ trợ",
+  "unsupportedDslNodes.unknownType": "Loại không xác định",
+  "versions.cancelCreate": "Hủy",
+  "versions.cancelDelete": "Hủy",
+  "versions.cancelEdit": "Hủy",
+  "versions.checkingReleaseContent": "Đang kiểm tra nội dung bản phát hành...",
+  "versions.col.action": "Hành động",
+  "versions.col.author": "Người tạo",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "Tạo lúc",
+  "versions.col.deployedTo": "Đã triển khai đến",
+  "versions.col.release": "Bản phát hành",
+  "versions.col.sourceApp": "Nguồn",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "Tạo",
+  "versions.createFailed": "Không thể tạo bản phát hành.",
+  "versions.createRelease": "Tạo bản phát hành",
+  "versions.createReleaseDescription": "Tạo một bản phát hành có thể triển khai từ Workflow App hoặc tệp Workflow DSL.",
+  "versions.createReleaseHint": "Bản phát hành mới có thể được triển khai đến bất kỳ môi trường nào.",
+  "versions.createSuccess": "Đã tạo bản phát hành \"{{name}}\".",
+  "versions.creating": "Đang tạo...",
+  "versions.currentOn": "Bản phát hành hiện tại trên {{name}}",
+  "versions.deleteConfirmDesc": "Bản phát hành \"{{name}}\" sẽ bị xóa vĩnh viễn. Hành động này không thể hoàn tác.",
+  "versions.deleteConfirmTitle": "Xóa bản phát hành?",
+  "versions.deleteFailed": "Không thể xóa bản phát hành.",
+  "versions.deleteImpactDeployment": "Trạng thái triển khai",
+  "versions.deleteImpactNotDeployed": "Hiện chưa được triển khai",
+  "versions.deleteImpactRelease": "Bản phát hành",
+  "versions.deleteImpactTitle": "Ảnh hưởng khi xóa",
+  "versions.deleteRelease": "Xóa bản phát hành",
+  "versions.deleteSuccess": "Đã xóa bản phát hành \"{{name}}\".",
+  "versions.deploy": "Triển khai",
+  "versions.deployTo": "Triển khai đến {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "Đang triển khai",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "Đang chờ đồng bộ",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "Thất bại",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "Không hợp lệ",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "Đang chạy",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Chưa triển khai",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Đang hủy triển khai",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Không xác định",
+  "versions.deployingTo": "{{name}} đang được triển khai",
+  "versions.disabledReason.checkDeploymentsFailed": "Không thể xác minh việc sử dụng triển khai. Vui lòng thử lại sau.",
+  "versions.disabledReason.checkingDeployments": "Đang kiểm tra việc sử dụng triển khai",
+  "versions.disabledReason.current": "Bản phát hành này đã đang chạy trên {{name}}",
+  "versions.disabledReason.deploying": "Vui lòng chờ triển khai hiện tại hoàn thành",
+  "versions.disabledReason.envDisabled": "Môi trường này không thể triển khai",
+  "versions.disabledReason.releaseInUse_one": "Hãy hủy triển khai bản phát hành này khỏi {{count}} môi trường trước khi xóa",
+  "versions.disabledReason.releaseInUse_other": "Hãy hủy triển khai bản phát hành này khỏi {{count}} môi trường trước khi xóa",
+  "versions.dslReadFailed": "Không thể đọc tệp DSL. Vui lòng chọn tệp khác và thử lại.",
+  "versions.dslReading": "Đang đọc tệp DSL...",
+  "versions.dslUnsupportedMode": "Chỉ tệp Workflow DSL có thể được sử dụng cho triển khai.",
+  "versions.editFailed": "Không thể cập nhật bản phát hành.",
+  "versions.editRelease": "Chỉnh sửa bản phát hành",
+  "versions.editReleaseDescription": "Cập nhật tên và mô tả của bản phát hành này.",
+  "versions.editSuccess": "Đã cập nhật bản phát hành \"{{name}}\".",
+  "versions.empty": "Chưa có bản phát hành nào.",
+  "versions.emptyDescription": "Tạo bản phát hành đầu tiên trước khi triển khai đến môi trường.",
+  "versions.emptyTitle": "Chưa có bản phát hành nào",
+  "versions.emptyWithCreate": "Chưa có bản phát hành nào. Tạo bản phát hành có thể triển khai đầu tiên trước khi triển khai.",
+  "versions.exportDsl": "Xuất DSL",
+  "versions.exportDslFailed": "Không thể xuất DSL.",
+  "versions.exportingDsl": "Đang xuất...",
+  "versions.groupHeader.deploy": "Triển khai",
+  "versions.groupHeader.promote": "Triển khai",
+  "versions.groupHeader.rollback": "Triển khai phiên bản trước",
+  "versions.groupHeader.unavailable": "Không khả dụng",
+  "versions.manualDslOption": "Tải lên DSL",
+  "versions.moreActions": "Thêm thao tác",
+  "versions.optional": "Tùy chọn",
+  "versions.promote": "Triển khai",
+  "versions.promoteTo": "Triển khai đến {{name}}",
+  "versions.releaseAlreadyExists": "Một bản phát hành với cùng nội dung đã tồn tại: {{name}}.",
+  "versions.releaseContentCheckFailed": "Không thể kiểm tra nội dung bản phát hành.",
+  "versions.releaseDescriptionLabel": "Mô tả",
+  "versions.releaseDescriptionPlaceholder": "Mô tả bản phát hành này",
+  "versions.releaseHistory": "Lịch sử bản phát hành",
+  "versions.releaseNameLabel": "Tên bản phát hành",
+  "versions.releaseNamePlaceholder": "Tên bản phát hành",
+  "versions.releaseNameRequired": "Vui lòng nhập tên bản phát hành.",
+  "versions.releaseSourceLabel": "Nguồn bản phát hành",
+  "versions.rollbackTo": "Triển khai đến {{name}}",
+  "versions.saveEdit": "Lưu",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/vi-VN/workflow.json b/web/i18n/vi-VN/workflow.json
index 7eb0ed55282..d87cb85560b 100644
--- a/web/i18n/vi-VN/workflow.json
+++ b/web/i18n/vi-VN/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "Người đại lý",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "Trả lời",
   "blocks.assigner": "Trình gán biến",
   "blocks.code": "Mã",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "Trình tổng hợp biến",
   "blocks.variable-assigner": "Trình gán biến",
   "blocksAbout.agent": "Gọi các mô hình ngôn ngữ lớn để trả lời câu hỏi hoặc xử lý ngôn ngữ tự nhiên",
+  "blocksAbout.agent-v2": "Gọi các mô hình ngôn ngữ lớn để trả lời câu hỏi hoặc xử lý ngôn ngữ tự nhiên",
   "blocksAbout.answer": "Định nghĩa nội dung trả lời của cuộc trò chuyện",
   "blocksAbout.assigner": "Nút gán biến được sử dụng để gán giá trị cho các biến có thể ghi (như các biến hội thoại).",
   "blocksAbout.code": "Thực thi một đoạn mã Python hoặc NodeJS để thực hiện logic tùy chỉnh",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "ID quy trình làm việc",
   "globalVar.fieldsDescription.workflowRunId": "ID lần chạy quy trình làm việc",
   "globalVar.title": "Biến hệ thống",
+  "nodes.agent.advancedSetting": "Cài đặt nâng cao",
   "nodes.agent.checkList.strategyNotSelected": "Chiến lược không được chọn",
   "nodes.agent.clickToViewParameterSchema": "Nhấp để xem sơ đồ tham số",
   "nodes.agent.configureModel": "Định cấu hình mô hình",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "Mô hình không được hỗ trợ",
   "nodes.agent.modelSelectorTooltips.deprecated": "Mô hình này không còn được dùng nữa",
   "nodes.agent.notAuthorized": "Không được ủy quyền",
+  "nodes.agent.outputVars.confirm": "Xác nhận",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "Nhập một mảng JSON.",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "Nhập true hoặc false.",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "Chưa thể cấu hình mặc định cho tệp tại đây.",
+  "nodes.agent.outputVars.defaultValueLabel": "Mặc định",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "Nhập một số hợp lệ.",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "Nhập một đối tượng JSON.",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "Giá trị mặc định",
+  "nodes.agent.outputVars.delete": "Xóa {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "Mô tả",
+  "nodes.agent.outputVars.descriptionPlaceholder": "Thêm mô tả",
+  "nodes.agent.outputVars.edit": "Chỉnh sửa {{name}}",
+  "nodes.agent.outputVars.editorLabel": "Trình chỉnh sửa biến đầu ra",
   "nodes.agent.outputVars.files.title": "Tệp do tác nhân tạo",
   "nodes.agent.outputVars.files.transfer_method": "Phương thức chuyển khoản. Giá trị là remote_url hoặc local_file",
   "nodes.agent.outputVars.files.type": "Loại hỗ trợ. Bây giờ chỉ hỗ trợ hình ảnh",
   "nodes.agent.outputVars.files.upload_file_id": "Tải lên id tệp",
   "nodes.agent.outputVars.files.url": "URL hình ảnh",
   "nodes.agent.outputVars.json": "JSON do tác nhân tạo",
+  "nodes.agent.outputVars.nameDuplicate": "Tên đầu ra đã tồn tại",
+  "nodes.agent.outputVars.nameInvalid": "Dùng chữ cái, số và dấu gạch dưới. Bắt đầu bằng chữ cái hoặc dấu gạch dưới.",
+  "nodes.agent.outputVars.nameLabel": "Tên trường",
+  "nodes.agent.outputVars.namePlaceholder": "Tên trường",
+  "nodes.agent.outputVars.newOutput": "Đầu ra mới",
+  "nodes.agent.outputVars.requiredLabel": "Bắt buộc",
+  "nodes.agent.outputVars.showAdvancedOptions": "Hiện tùy chọn nâng cao",
   "nodes.agent.outputVars.text": "Nội dung do tác nhân tạo",
+  "nodes.agent.outputVars.typeLabel": "Loại đầu ra",
   "nodes.agent.outputVars.usage": "Thông tin sử dụng mô hình",
   "nodes.agent.parameterSchema": "Sơ đồ Tham số",
   "nodes.agent.pluginInstaller.install": "Cài đặt",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "Tích hợp này được cài đặt từ GitHub. Vui lòng vào Tích hợp để cài đặt lại",
   "nodes.agent.pluginNotInstalled": "Tích hợp này chưa được cài đặt",
   "nodes.agent.pluginNotInstalledDesc": "Tích hợp này được cài đặt từ GitHub. Vui lòng vào Tích hợp để cài đặt lại",
+  "nodes.agent.roster.change": "Thay đổi",
+  "nodes.agent.roster.editInConsole": "Chỉnh sửa trong Agent Console",
+  "nodes.agent.roster.inlineSetup.description": "Một thiết lập một lần chỉ tồn tại trong nút này",
+  "nodes.agent.roster.inlineSetup.name": "Thiết lập inline",
+  "nodes.agent.roster.inlineSetup.title": "Thiết lập tác nhân",
+  "nodes.agent.roster.inlineSetup.type": "Chỉ trong nút này",
+  "nodes.agent.roster.label": "Tác nhân",
+  "nodes.agent.roster.makeCopy": "Tạo bản sao",
+  "nodes.agent.roster.more": "Thêm hành động tác nhân",
+  "nodes.agent.roster.openPanel": "Mở chi tiết {{name}}",
+  "nodes.agent.roster.panelLabel": "Chi tiết {{name}}",
   "nodes.agent.strategy.configureTip": "Vui lòng định cấu hình chiến lược tác nhân.",
   "nodes.agent.strategy.configureTipDesc": "Sau khi cấu hình chiến lược tác nhân, nút này sẽ tự động tải các cấu hình còn lại. Chiến lược sẽ ảnh hưởng đến cơ chế suy luận công cụ nhiều bước.",
   "nodes.agent.strategy.label": "Chiến lược đại lý",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "Phiên bản tích hợp đã cài đặt không cung cấp chiến lược này. Nhấp để chuyển đổi phiên bản.",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} không được cài đặt",
   "nodes.agent.strategyNotSet": "Chiến lược tác nhân không được thiết lập",
+  "nodes.agent.task.insert": "Chèn",
+  "nodes.agent.task.label": "Tác vụ tác nhân",
+  "nodes.agent.task.mention": "Đề cập",
+  "nodes.agent.task.placeholder": "Mô tả tác nhân này nên làm gì...",
+  "nodes.agent.task.tooltip": "Xác định các hướng dẫn tác vụ mà tác nhân này nên tuân theo trong quy trình làm việc này.",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} Không được ủy quyền",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} không được cài đặt",
   "nodes.agent.toolbox": "hộp công cụ",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "Bởi {{author}}",
   "tabs.question-understand": "Hiểu câu hỏi",
   "tabs.requestToCommunity": "Yêu cầu gửi đến cộng đồng",
-  "tabs.searchBlock": "Tìm kiếm nút",
+  "tabs.searchBlock": "Tìm kiếm nút, tác nhân, con người, Kiến thức",
   "tabs.searchDataSource": "Tìm kiếm nguồn dữ liệu",
   "tabs.searchSnippets": "Tìm kiếm đoạn trích...",
   "tabs.searchTool": "Công cụ tìm kiếm",
diff --git a/web/i18n/zh-Hans/agent-v-2.json b/web/i18n/zh-Hans/agent-v-2.json
new file mode 100644
index 00000000000..32a51de221d
--- /dev/null
+++ b/web/i18n/zh-Hans/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "此操作暂不可用。",
+  "agentDetail.access.actions.monitoring": "监控",
+  "agentDetail.access.copyAccessUrl": "复制访问 URL",
+  "agentDetail.access.copyFailed": "引用复制失败。",
+  "agentDetail.access.copyReference": "复制 {{name}} 的引用",
+  "agentDetail.access.copyServiceEndpoint": "复制服务 API 端点",
+  "agentDetail.access.description": "此智能体可被触达的所有入口。",
+  "agentDetail.access.empty": "暂无关联访问入口",
+  "agentDetail.access.emptyDescription": "当前 Roster 智能体还没有应用或工作流引用。",
+  "agentDetail.access.entries.agentApp.description": "关联到此 Roster 智能体的智能体应用。",
+  "agentDetail.access.entries.agentApp.name": "智能体应用",
+  "agentDetail.access.entries.workflow.description": "关联到此 Roster 智能体的工作流与节点引用。",
+  "agentDetail.access.entries.workflow.name": "工作流节点",
+  "agentDetail.access.entryCount_one": "{{count}} 个条目",
+  "agentDetail.access.entryCount_other": "{{count}} 个条目",
+  "agentDetail.access.groups.references.heading": "引用",
+  "agentDetail.access.groups.references.label": "关联引用",
+  "agentDetail.access.learnMore": "了解更多",
+  "agentDetail.access.moreActions": "{{name}} 的更多操作",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "服务 API 端点",
+  "agentDetail.access.serviceApi.title": "后端服务 API",
+  "agentDetail.access.status.disabled": "已禁用",
+  "agentDetail.access.status.enabled": "已启用",
+  "agentDetail.access.status.inService": "服务中",
+  "agentDetail.access.status.outOfService": "已停用",
+  "agentDetail.access.title": "访问点",
+  "agentDetail.access.toggleSurface": "切换 {{name}} 访问状态",
+  "agentDetail.access.webApp.accessUrl": "访问 URL",
+  "agentDetail.access.webApp.actions.customize": "自定义",
+  "agentDetail.access.webApp.actions.embedded": "嵌入",
+  "agentDetail.access.webApp.actions.launch": "启动",
+  "agentDetail.access.webApp.actions.settings": "设置",
+  "agentDetail.access.webApp.refreshUrl": "刷新访问 URL",
+  "agentDetail.access.webApp.showQrCode": "显示二维码",
+  "agentDetail.access.webApp.ssoEnabled": "已启用 SSO",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "作为工作流内的节点使用",
+  "agentDetail.access.workflow.empty": "暂无工作流引用。",
+  "agentDetail.access.workflow.loadFailed": "工作流引用加载失败。",
+  "agentDetail.access.workflow.loading": "正在加载工作流引用…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} 个节点",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} 个节点",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "在 Studio 中打开",
+  "agentDetail.access.workflow.openInStudioFor": "在 Studio 中打开 {{name}}",
+  "agentDetail.access.workflow.table.actions": "操作",
+  "agentDetail.access.workflow.table.lastUpdated": "最后更新",
+  "agentDetail.access.workflow.table.name": "名称",
+  "agentDetail.access.workflow.table.nodes": "节点",
+  "agentDetail.access.workflow.table.version": "版本",
+  "agentDetail.access.workflow.title": "工作流访问",
+  "agentDetail.configure.advancedSettings.description": "面向高级用户。环境变量、沙箱与记忆。",
+  "agentDetail.configure.advancedSettings.envEditor.add": "添加环境变量",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "删除 {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "隐藏 {{key}} 的值",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "导入 .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "如需显示隐藏的 .env 文件，请在文件选择器中按 Command + Shift + .。",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "如果 .env 文件被隐藏，请在系统文件选择器中开启隐藏文件显示。",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "如需显示隐藏的 .env 文件，请在文件资源管理器中开启“隐藏的项目”。",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "显示 {{key}} 的值",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "选择环境变量作用域",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "此智能体运行时可使用的环境变量。",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "展开或收起 Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "高级设置",
+  "agentDetail.configure.advancedSettings.toggle": "展开或收起高级设置",
+  "agentDetail.configure.chatFeatures.description": "配置 Web app 和聊天界面的终端用户聊天体验。",
+  "agentDetail.configure.chatFeatures.title": "Chat 功能",
+  "agentDetail.configure.files.add": "添加文件",
+  "agentDetail.configure.files.empty.description": "上传智能体可读取的文档，例如规格、模板或指南",
+  "agentDetail.configure.files.empty.title": "暂无文件",
+  "agentDetail.configure.files.label": "文件",
+  "agentDetail.configure.files.preview.empty": "暂无预览内容。",
+  "agentDetail.configure.files.preview.failed": "预览加载失败。",
+  "agentDetail.configure.files.preview.unsupported": "该文件不支持预览。",
+  "agentDetail.configure.files.remove": "移除 {{name}}",
+  "agentDetail.configure.files.tip": "此智能体在编排任务时可使用的文件。",
+  "agentDetail.configure.files.toggle": "展开或收起文件",
+  "agentDetail.configure.files.treeLabel": "智能体文件",
+  "agentDetail.configure.files.upload.action": "上传",
+  "agentDetail.configure.files.upload.browse": "选择",
+  "agentDetail.configure.files.upload.description": "为此智能体上传文件。",
+  "agentDetail.configure.files.upload.dropzone": "拖入文件，或",
+  "agentDetail.configure.files.upload.failed": "文件上传失败。",
+  "agentDetail.configure.files.upload.fileType": "文件",
+  "agentDetail.configure.files.upload.invalidFile": "请上传一个文件。",
+  "agentDetail.configure.files.upload.success": "文件已上传。",
+  "agentDetail.configure.files.upload.title": "上传文件",
+  "agentDetail.configure.knowledgeRetrieval.add": "添加知识检索",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "添加知识",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "点击“+”按钮添加知识",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "知识",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "检索设置",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "了解更多关于知识检索",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "自动",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "条件",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "禁用",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "元数据过滤",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "手动",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "选择元数据过滤模式",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "知识检索名称",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "智能体决定",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "智能体会根据提示词和可用上下文自行编写查询。无需在此设置。",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "自定义查询",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "为此检索来源编写固定查询。",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "自定义查询文本",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "输入搜索查询",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "查询",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "知识检索 · 智能体决定",
+  "agentDetail.configure.knowledgeRetrieval.edit": "编辑 {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "连接智能体回答时可搜索的知识库",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "暂无知识",
+  "agentDetail.configure.knowledgeRetrieval.label": "知识检索",
+  "agentDetail.configure.knowledgeRetrieval.remove": "删除 {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "此智能体在编排任务时可使用的知识检索来源。",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "展开或收起知识检索",
+  "agentDetail.configure.model.label": "模型",
+  "agentDetail.configure.orchestrate": "编排",
+  "agentDetail.configure.preview.chatFeatures": "Chat 功能",
+  "agentDetail.configure.preview.empty.defaultAgentName": "智能体",
+  "agentDetail.configure.preview.empty.description": "发送一条消息来测试当前草稿。",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "尚未设置指令，回复将来自基础模型。",
+  "agentDetail.configure.preview.endUserAuth": "终端用户认证",
+  "agentDetail.configure.preview.restart": "重新开始预览",
+  "agentDetail.configure.preview.title": "预览",
+  "agentDetail.configure.prompt.copied": "提示词已复制",
+  "agentDetail.configure.prompt.copy": "复制提示词",
+  "agentDetail.configure.prompt.copyFailed": "提示词复制失败。",
+  "agentDetail.configure.prompt.insert.label": "插入",
+  "agentDetail.configure.prompt.insert.question": "开始问题",
+  "agentDetail.configure.prompt.insert.reportFile": "输出报告文件",
+  "agentDetail.configure.prompt.insert.tenders": "开始招标列表",
+  "agentDetail.configure.prompt.label": "提示词",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "提及",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "在此编写指令，",
+  "agentDetail.configure.prompt.tip": "定义这个智能体如何理解输入、调用工具并生成输出。",
+  "agentDetail.configure.publishBar.draft": "草稿",
+  "agentDetail.configure.publishBar.publishUpdate": "发布更新",
+  "agentDetail.configure.publishBar.published": "已发布",
+  "agentDetail.configure.publishBar.publishedAt": "{{time}}发布",
+  "agentDetail.configure.publishBar.publishing": "发布中…",
+  "agentDetail.configure.publishBar.saved": "5 分钟前已保存",
+  "agentDetail.configure.publishBar.savedAt": "{{time}}已保存",
+  "agentDetail.configure.publishBar.unpublishedChanges": "有未发布的更改",
+  "agentDetail.configure.publishBar.upToDate": "已是最新",
+  "agentDetail.configure.publishBar.versionHistory": "打开版本历史",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "受影响的工作流",
+  "agentDetail.configure.publishImpact.cancel": "取消",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "你的智能体出现在",
+  "agentDetail.configure.publishImpact.descriptionSuffix": "中。更改会影响它们。",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "此智能体",
+  "agentDetail.configure.publishImpact.title": "{{action}}到 {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} 个工作流",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} 个工作流",
+  "agentDetail.configure.skills.add": "添加技能",
+  "agentDetail.configure.skills.detail.contentRegion": "技能详情内容",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} 个文件",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "技能文件",
+  "agentDetail.configure.skills.detail.files": "文件",
+  "agentDetail.configure.skills.empty.description": "技能为智能体提供工作时可调用的可复用专业能力",
+  "agentDetail.configure.skills.empty.title": "暂无技能",
+  "agentDetail.configure.skills.itemType": "技能",
+  "agentDetail.configure.skills.label": "技能",
+  "agentDetail.configure.skills.remove": "移除 {{name}}",
+  "agentDetail.configure.skills.tip": "此智能体在编排任务时可使用的技能。",
+  "agentDetail.configure.skills.toggle": "展开或收起技能",
+  "agentDetail.configure.skills.upload.action": "上传",
+  "agentDetail.configure.skills.upload.browse": "选择",
+  "agentDetail.configure.skills.upload.description": "为此智能体上传 .zip 或 .skill 技能包。",
+  "agentDetail.configure.skills.upload.dropzone": "拖入技能包，或",
+  "agentDetail.configure.skills.upload.failed": "技能上传失败。",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "请上传 .zip 或 .skill 文件。",
+  "agentDetail.configure.skills.upload.success": "技能已上传。",
+  "agentDetail.configure.skills.upload.title": "上传技能",
+  "agentDetail.configure.tools.add": "添加工具",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "开发者适用",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "安装智能体可在沙箱中运行的命令行程序。需要安装命令，通常还需要 API Key。",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI 工具",
+  "agentDetail.configure.tools.addMenu.tool.description": "选择工作区中已有的工具，例如 Web 搜索或集成。",
+  "agentDetail.configure.tools.addMenu.tool.label": "工具",
+  "agentDetail.configure.tools.cliDialog.description": "从任意包注册表安装 CLI 工具。智能体会获得运行该二进制文件的 shell 访问能力。",
+  "agentDetail.configure.tools.cliDialog.editTitle": "编辑 CLI 工具",
+  "agentDetail.configure.tools.cliDialog.env.description": "存储此 CLI 工具所需的 API Key、Token 或密钥。值会静态加密，并在智能体调用工具时作为环境变量注入。",
+  "agentDetail.configure.tools.cliDialog.env.label": "环境变量",
+  "agentDetail.configure.tools.cliDialog.env.optional": "（可选）",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "沙箱中执行 · 首次调用时运行一次",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "安装命令",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "粘贴安装命令，例如 npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "请输入安装命令。",
+  "agentDetail.configure.tools.cliDialog.learnMore": "了解 CLI 工具",
+  "agentDetail.configure.tools.cliDialog.name.label": "CLI 工具名称",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "为 CLI 工具命名",
+  "agentDetail.configure.tools.cliDialog.name.required": "请输入 CLI 工具名称。",
+  "agentDetail.configure.tools.cliDialog.securityTip": "不会出现在智能体提示词中；仅在运行时作为 $VAR 注入",
+  "agentDetail.configure.tools.cliDialog.title": "添加 CLI 工具",
+  "agentDetail.configure.tools.cliTool": "CLI 工具",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "终端用户 · OAuth",
+  "agentDetail.configure.tools.editAction": "编辑 {{name}}",
+  "agentDetail.configure.tools.empty.description": "工具让智能体可以执行操作，例如搜索网页或调用你的应用",
+  "agentDetail.configure.tools.empty.title": "暂无工具",
+  "agentDetail.configure.tools.label": "工具",
+  "agentDetail.configure.tools.moreActions": "{{name}} 的更多操作",
+  "agentDetail.configure.tools.pluginType": "插件",
+  "agentDetail.configure.tools.preAuthorize": "预授权",
+  "agentDetail.configure.tools.removeAction": "移除 {{name}}",
+  "agentDetail.configure.tools.removeProvider": "移除所有工具",
+  "agentDetail.configure.tools.tip": "此智能体在编排任务时可调用的工具。",
+  "agentDetail.configure.tools.toggle": "展开或收起工具",
+  "agentDetail.configure.tools.toolTabs.all": "全部",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "自定义",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "插件",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "智能体",
+  "agentDetail.history": "历史记录",
+  "agentDetail.logs.description": "完整日志记录应用运行状态，包括用户输入、智能体回复、规划和工具使用。",
+  "agentDetail.logs.empty": "暂无日志",
+  "agentDetail.logs.filters.period.allTime": "全部时间",
+  "agentDetail.logs.filters.period.label": "日志时间范围",
+  "agentDetail.logs.filters.period.last30days": "最近 30 天",
+  "agentDetail.logs.filters.period.last7days": "最近 7 天",
+  "agentDetail.logs.filters.search.label": "搜索日志",
+  "agentDetail.logs.filters.search.placeholder": "搜索",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "最近创建时间",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "最近更新时间",
+  "agentDetail.logs.filters.source.all": "来源",
+  "agentDetail.logs.filters.source.empty": "暂无来源",
+  "agentDetail.logs.filters.source.label": "日志来源",
+  "agentDetail.logs.filters.source.loadFailed": "来源加载失败",
+  "agentDetail.logs.filters.source.loading": "来源加载中…",
+  "agentDetail.logs.filters.source.searchLabel": "搜索来源",
+  "agentDetail.logs.filters.source.searchPlaceholder": "搜索",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "工作流",
+  "agentDetail.logs.learnMore": "了解更多",
+  "agentDetail.logs.loadFailed": "日志加载失败",
+  "agentDetail.logs.loading": "日志加载中…",
+  "agentDetail.logs.notAvailable": "暂无",
+  "agentDetail.logs.table.createdTime": "创建时间",
+  "agentDetail.logs.table.endUser": "终端用户",
+  "agentDetail.logs.table.messageCount": "消息数",
+  "agentDetail.logs.table.operationRate": "操作率",
+  "agentDetail.logs.table.source": "来源",
+  "agentDetail.logs.table.title": "标题",
+  "agentDetail.logs.table.unread": "未读",
+  "agentDetail.logs.table.updatedTime": "更新时间",
+  "agentDetail.logs.table.userRate": "用户评分",
+  "agentDetail.logs.title": "日志",
+  "agentDetail.memorySettings.budgetLabel": "记忆预算",
+  "agentDetail.memorySettings.description": "当前活跃配置快照中的记忆设置。",
+  "agentDetail.memorySettings.export.description": "记忆导出将在后续版本开放。",
+  "agentDetail.memorySettings.export.download": "下载",
+  "agentDetail.memorySettings.export.soon": "后续推出",
+  "agentDetail.memorySettings.export.title": "导出当前记忆",
+  "agentDetail.memorySettings.notConfigured": "未配置",
+  "agentDetail.memorySettings.scopeLabel": "记忆范围",
+  "agentDetail.memorySettings.title": "记忆",
+  "agentDetail.metadata.activeVersionLabel": "活跃版本",
+  "agentDetail.metadata.appIdLabel": "应用 ID",
+  "agentDetail.metadata.description": "智能体后端返回的只读 Roster 字段。",
+  "agentDetail.metadata.emptyValue": "暂无",
+  "agentDetail.metadata.scopeLabel": "范围",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "仅工作流",
+  "agentDetail.metadata.sourceLabel": "来源",
+  "agentDetail.metadata.statusLabel": "状态",
+  "agentDetail.metadata.title": "元数据",
+  "agentDetail.metadata.updatedAtLabel": "更新时间",
+  "agentDetail.metadata.workflowIdLabel": "工作流 ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "工作流节点 ID",
+  "agentDetail.monitoring.change": "较上一周期 {{value}}",
+  "agentDetail.monitoring.dateRangeLabel": "日期范围",
+  "agentDetail.monitoring.description": "跟踪可复用智能体在工作流中的活跃度、成本和交互质量。",
+  "agentDetail.monitoring.learnMore": "了解更多",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "触发过使用此智能体的工作流的独立终端用户数。",
+  "agentDetail.monitoring.metrics.activeUsers.title": "活跃用户",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "此访问入口下用户与智能体的连续沟通次数。",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "平均会话互动数",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "从请求开始到输出完成期间的平均输出速度。",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Token 输出速度",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "此智能体在工作流运行中产生的预估 token 成本。",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Token 用量",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "通过所选访问入口触达此智能体的每日 AI 会话数。",
+  "agentDetail.monitoring.metrics.totalConversations.title": "全部会话数",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "每日智能体互动总次数。",
+  "agentDetail.monitoring.metrics.totalMessages.title": "全部消息数",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "每 1000 条消息的点赞数，反映用户满意度。",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "用户满意度",
+  "agentDetail.monitoring.pickSource": "选择应用",
+  "agentDetail.monitoring.sourceLabel": "应用",
+  "agentDetail.monitoring.sourceTrigger": "来源 {{name}}",
+  "agentDetail.monitoring.sources.all": "全部",
+  "agentDetail.monitoring.timeRangeLabel": "时间范围",
+  "agentDetail.monitoring.timeRanges.custom": "自定义",
+  "agentDetail.monitoring.timeRanges.last30days": "最近 30 天",
+  "agentDetail.monitoring.timeRanges.last7days": "最近 7 天",
+  "agentDetail.monitoring.timeRanges.today": "今天",
+  "agentDetail.monitoring.title": "监控",
+  "agentDetail.monitoring.tokenUsageConsumed": "耗费 Tokens",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/秒",
+  "agentDetail.navigationLabel": "智能体导航",
+  "agentDetail.publish": "发布",
+  "agentDetail.publishSoon": "后续推出",
+  "agentDetail.sections.access": "访问点",
+  "agentDetail.sections.configure": "编排",
+  "agentDetail.sections.logs": "日志",
+  "agentDetail.sections.monitoring": "监控",
+  "agentDetail.subtitle": "智能体 ID：{{agentId}}",
+  "agentDetail.title": "智能体",
+  "agentDetail.type": "智能体",
+  "agentDetail.versionHistory.active": "当前",
+  "agentDetail.versionHistory.empty": "暂无版本",
+  "agentDetail.versionHistory.filter": "筛选版本",
+  "agentDetail.versionHistory.versionName": "版本 {{version}}",
+  "roster.createAgent": "创建智能体",
+  "roster.createAgentOptions": "创建智能体选项",
+  "roster.createDialog.description": "在当前工作区 Roster 中创建一个可复用智能体。",
+  "roster.createDialog.title": "创建智能体",
+  "roster.createForm.changeIcon": "更换智能体图标",
+  "roster.createForm.descriptionLabel": "描述",
+  "roster.createForm.descriptionOptional": "（可选）",
+  "roster.createForm.descriptionPlaceholder": "例如：收集某个主题的来源资料并总结关键发现",
+  "roster.createForm.nameLabel": "名称",
+  "roster.createForm.namePlaceholder": "例如：Max",
+  "roster.createForm.nameRequired": "请输入名称。",
+  "roster.createForm.roleLabel": "角色",
+  "roster.createForm.rolePlaceholder": "例如：研究助理",
+  "roster.createForm.roleRequired": "请输入角色。",
+  "roster.createSuccess": "智能体已创建。",
+  "roster.dateTimeFormat": "YYYY-MM-DD HH:mm:ss",
+  "roster.deleteDialog.description": "此智能体将从当前活跃 Roster 列表中移除。",
+  "roster.deleteDialog.title": "删除 {{name}}？",
+  "roster.deleteFailed": "智能体删除失败。",
+  "roster.deleteSuccess": "智能体已删除。",
+  "roster.duplicateFailed": "智能体复制失败。",
+  "roster.duplicateSuccess": "智能体已复制。",
+  "roster.editAgent": "编辑 {{name}}",
+  "roster.editDialog.description": "更新此智能体在 Roster 中的名称、描述和角色。",
+  "roster.editDialog.title": "编辑智能体",
+  "roster.editInfo": "编辑信息",
+  "roster.empty": "暂无智能体",
+  "roster.emptyDescription": "保存在此工作区的智能体会显示在这里。",
+  "roster.emptySearch": "没有匹配的智能体",
+  "roster.emptySearchDescription": "请尝试其他智能体名称。",
+  "roster.filters.all": "全部",
+  "roster.filters.drafts": "草稿",
+  "roster.filters.label": "智能体筛选",
+  "roster.filters.published": "已发布",
+  "roster.learnMore": "了解 Agent Roster",
+  "roster.listLabel": "智能体 Roster 列表",
+  "roster.loadMore": "加载更多",
+  "roster.loadingError": "智能体加载失败。请刷新后重试。",
+  "roster.moreActions": "{{name}} 的更多操作",
+  "roster.nodeSelector.createInlineFailed": "Inline 智能体创建失败。请刷新后重试。",
+  "roster.nodeSelector.dialogLabel": "选择智能体",
+  "roster.nodeSelector.manageInAgentConsole": "在智能体控制台管理",
+  "roster.nodeSelector.searchPlaceholder": "搜索…",
+  "roster.nodeSelector.startFromScratch": "从空白开始",
+  "roster.references.label": "使用 {{name}} 的工作流",
+  "roster.references.trigger": "使用 {{name}} 的工作流",
+  "roster.searchLabel": "搜索智能体",
+  "roster.searchPlaceholder": "按名称搜索智能体…",
+  "roster.sources.agent_app": "智能体应用",
+  "roster.sources.imported": "导入",
+  "roster.sources.system": "系统",
+  "roster.sources.workflow": "工作流",
+  "roster.status.active": "活跃",
+  "roster.status.archived": "已归档",
+  "roster.tabs.agent": "智能体",
+  "roster.tabs.human": "人工成员",
+  "roster.tabsLabel": "Roster 类型",
+  "roster.updateSuccess": "智能体已更新。",
+  "roster.usageStatus.draft": "草稿"
+}
diff --git a/web/i18n/zh-Hans/app-log.json b/web/i18n/zh-Hans/app-log.json
index 29788ebb79e..23da8cf6568 100644
--- a/web/i18n/zh-Hans/app-log.json
+++ b/web/i18n/zh-Hans/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "今天",
   "filter.period.yearToDate": "本年至今",
   "filter.sortBy": "排序：",
+  "monitoring.description": "监控记录应用的运行情况，包括性能、用户活动和成本。",
   "promptLog": "Prompt 日志",
   "runDetail.fileListDetail": "详情",
   "runDetail.fileListLabel": "文件详情",
diff --git a/web/i18n/zh-Hans/app.json b/web/i18n/zh-Hans/app.json
index efb8bb866aa..640b54e0987 100644
--- a/web/i18n/zh-Hans/app.json
+++ b/web/i18n/zh-Hans/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "结构化输出是一项功能，可确保模型始终生成符合您提供的 JSON 模式的响应",
   "studio.allApps": "所有应用",
   "studio.apps": "应用程序",
-  "studio.filters.allCreators": "所有创作者",
-  "studio.filters.creators": "创作者",
+  "studio.filters.allCreators": "所有创建者",
+  "studio.filters.creators": "创建者",
   "studio.filters.reset": "重置",
   "studio.filters.searchCreators": "搜索创作者...",
   "studio.filters.types": "类型",
diff --git a/web/i18n/zh-Hans/billing.json b/web/i18n/zh-Hans/billing.json
index def93510b9d..c5dc45eddaf 100644
--- a/web/i18n/zh-Hans/billing.json
+++ b/web/i18n/zh-Hans/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "升级以解锁批量文档上传功能",
   "upgrade.uploadMultiplePages.description": "您已达到当前套餐的上传限制 —— 该套餐每次只能选择并上传 1 个文档。",
   "upgrade.uploadMultiplePages.title": "升级以一次性上传多个文档",
+  "upgrade.workflowRestore.description": "当前套餐不支持恢复工作流版本。",
+  "upgrade.workflowRestore.title": "升级以恢复工作流版本",
   "upgradeBtn.encourage": "立即升级",
   "upgradeBtn.encourageShort": "升级",
   "upgradeBtn.plain": "查看套餐",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index 7bd28568e04..b7886a2c11b 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -249,15 +249,18 @@
   "mainNav.workspace.sort.openMenu": "排序工作空间",
   "mainNav.workspace.switchWorkspace": "切换工作空间",
   "mcpPage.description": "连接并管理 MCP 服务器，让你的应用可以访问外部工具与服务。",
-  "members.admin": "管理员",
   "members.adminTip": "能够建立应用程序和管理团队设置",
+  "members.alreadyInTeam": "已在团队中",
+  "members.alreadyInTeamTip": "以下用户已经可以访问此工作空间。",
+  "members.assignRoles": "分配角色",
+  "members.assignRolesModal.description": "为该成员选择要分配的角色，所选角色的权限将被合并。",
+  "members.assignRolesModal.selectedCount": "已选 {{count}} 项",
+  "members.assignRolesModal.title": "分配角色",
   "members.builder": "构建器",
   "members.builderTip": "可以构建和编辑自己的应用程序",
-  "members.datasetOperator": "知识库管理员",
   "members.datasetOperatorTip": "只能管理知识库",
   "members.deleteMember": "删除成员",
   "members.disInvite": "取消邀请",
-  "members.editor": "编辑",
   "members.editorTip": "能够建立并编辑应用程序，不能管理团队设置",
   "members.email": "邮箱",
   "members.emailInvalid": "邮箱格式无效",
@@ -270,17 +273,40 @@
   "members.invite": "添加",
   "members.inviteTeamMember": "添加团队成员",
   "members.inviteTeamMemberTip": "对方在登录后可以访问你的团队数据。",
-  "members.invitedAsRole": "邀请为{{role}}用户",
+  "members.invitedAsRole": "邀请为{{role}}",
   "members.lastActive": "上次活动时间",
+  "members.memberActions": "成员操作",
+  "members.memberDetails.assign": "分配",
+  "members.memberDetails.assignedRoles": "已分配角色",
+  "members.memberDetails.customGroup": "自定义",
+  "members.memberDetails.generalGroup": "通用",
+  "members.memberDetails.openAria": "打开 {{name}} 的成员详情",
+  "members.memberDetails.permissions.assignRoles": "分配角色",
+  "members.memberDetails.permissions.createApps": "创建应用",
+  "members.memberDetails.permissions.createDatasets": "创建知识库",
+  "members.memberDetails.permissions.editApps": "编辑应用",
+  "members.memberDetails.permissions.editDatasets": "编辑知识库",
+  "members.memberDetails.permissions.inviteMembers": "邀请成员",
+  "members.memberDetails.permissions.manageBilling": "管理订阅",
+  "members.memberDetails.permissions.manageDatasets": "管理知识库",
+  "members.memberDetails.permissions.removeMembers": "移除成员",
+  "members.memberDetails.permissions.transferOwnership": "转移所有权",
+  "members.memberDetails.permissions.useApps": "使用应用",
+  "members.memberDetails.permissions.workspaceSettings": "工作空间设置",
+  "members.memberDetails.removeRoleAria": "移除 {{role}} 角色",
+  "members.memberDetails.roleActionsAria": "打开 {{role}} 角色操作",
+  "members.memberDetails.roleNoPermissionSummary": "当前角色没有任何权限。",
+  "members.memberDetails.rolePermissionSummary": "{{role}} 可以<permissionList>{{permissions}}</permissionList>",
+  "members.memberDetails.title": "成员详情",
   "members.name": "姓名",
-  "members.normal": "成员",
+  "members.noNewInvitationsSent": "没有新的邀请发送",
   "members.normalTip": "只能使用应用程序，不能建立应用程序",
   "members.ok": "好的",
-  "members.owner": "所有者",
   "members.pending": "待定...",
   "members.removeFromTeam": "移出团队",
   "members.removeFromTeamTip": "将取消团队访问",
   "members.role": "角色",
+  "members.selectRole": "请选择角色",
   "members.sendInvite": "发送邀请",
   "members.setAdmin": "设为管理员",
   "members.setBuilder": "Set as builder（设置为构建器）",
@@ -311,12 +337,14 @@
   "menus.apps": "工作室",
   "menus.datasets": "知识库",
   "menus.datasetsTips": "即将到来：上传自己的长文本数据，或通过 Webhook 集成自己的数据源",
+  "menus.deployments": "部署",
   "menus.explore": "探索",
   "menus.exploreMarketplace": "探索 Marketplace",
   "menus.newApp": "创建应用",
   "menus.newDataset": "创建知识库",
   "menus.plugins": "集成",
   "menus.pluginsTips": "集成第三方服务或创建与 ChatGPT 兼容的 AI 集成。",
+  "menus.roster": "智能体名册",
   "menus.status": "beta",
   "menus.tools": "工具",
   "model.addMoreModel": "添加更多模型",
@@ -516,6 +544,7 @@
   "modelProvider.ttsModel.key": "文本转语音模型",
   "modelProvider.ttsModel.tip": "设置对话中文字转语音输出的默认使用模型。",
   "modelProvider.upgradeForLoadBalancing": "升级以解锁负载均衡功能",
+  "navigation.skipToMain": "跳转到主要内容",
   "noData": "暂无数据",
   "operation.add": "添加",
   "operation.added": "已添加",
@@ -552,6 +581,7 @@
   "operation.lineBreak": "换行",
   "operation.log": "日志",
   "operation.more": "更多",
+  "operation.moreActions": "更多操作",
   "operation.no": "否",
   "operation.noSearchCount": "0 个 {{content}}",
   "operation.noSearchResults": "没有找到{{content}}",
@@ -600,9 +630,6 @@
   "placeholder.input": "请输入",
   "placeholder.search": "搜索...",
   "placeholder.select": "请选择",
-  "plugin.serpapi.apiKey": "API Key",
-  "plugin.serpapi.apiKeyPlaceholder": "输入你的 API 密钥",
-  "plugin.serpapi.keyFrom": "从 SerpAPI 帐户页面获取您的 SerpAPI 密钥",
   "promptEditor.context.item.desc": "插入上下文模板",
   "promptEditor.context.item.title": "上下文",
   "promptEditor.context.modal.add": "添加上下文",
@@ -665,6 +692,7 @@
   "provider.saveFailed": "API 密钥保存失败",
   "provider.validatedError": "校验失败：",
   "provider.validating": "验证密钥中...",
+  "settings.ResourceAccess": "访问权限规则",
   "settings.account": "我的账户",
   "settings.accountGroup": "通用",
   "settings.agentStrategy": "Agent 策略",
@@ -684,6 +712,9 @@
   "settings.plugin": "集成",
   "settings.preferences": "偏好设置",
   "settings.provider": "模型供应商",
+  "settings.resourceAccess": "访问权限",
+  "settings.resourceAccessDescription": "配置应用和知识库可使用的权限规则。权限规则可在具体资源访问配置中分配给成员。",
+  "settings.rolesAndPermissions": "角色与权限",
   "settings.settings": "设置",
   "settings.swaggerAPIAsTool": "Swagger API 作为工具",
   "settings.trigger": "触发器",
diff --git a/web/i18n/zh-Hans/dataset-settings.json b/web/i18n/zh-Hans/dataset-settings.json
index 7c3698a9ffc..24028be1690 100644
--- a/web/i18n/zh-Hans/dataset-settings.json
+++ b/web/i18n/zh-Hans/dataset-settings.json
@@ -27,6 +27,7 @@
   "form.numberOfKeywords": "关键词数量",
   "form.onSearchResults": "没有成员匹配您的搜索查询。\n请尝试其他关键词。",
   "form.permissions": "可见权限",
+  "form.permissionsAccessConfig": "前往访问配置",
   "form.permissionsAllMember": "所有团队成员",
   "form.permissionsInvitedMembers": "部分团队成员",
   "form.permissionsOnlyMe": "只有我",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
new file mode 100644
index 00000000000..9d80044e6f8
--- /dev/null
+++ b/web/i18n/zh-Hans/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "后端服务 API",
+  "access.api.copyCurlExample": "复制 cURL 示例",
+  "access.api.createFailed": "生成 API 令牌失败。",
+  "access.api.createKey": "生成 API 令牌",
+  "access.api.createKeyTitle": "生成新 API 令牌",
+  "access.api.curlExampleTitle": "cURL 示例",
+  "access.api.description": "通过 HTTP 调用该部署。每个 API 令牌仅在一个环境中生效。",
+  "access.api.developerTitle": "开发者 API",
+  "access.api.disabled": "该部署的 API 接入已关闭。",
+  "access.api.disabledHint": "开启 API 接入后即可生成绑定环境的令牌。",
+  "access.api.dismissToken": "关闭 API 令牌",
+  "access.api.docs": "API 文档",
+  "access.api.docsClose": "关闭 API 文档",
+  "access.api.docsDescription": "查看该部署的工作流 API 参考。",
+  "access.api.docsTitle": "工作流 API 文档",
+  "access.api.empty": "请先部署到环境后再签发 API 令牌。",
+  "access.api.emptyTitle": "暂无已部署环境",
+  "access.api.endpoint": "请求地址",
+  "access.api.envPrefix": "env：{{env}}",
+  "access.api.keyList": "API 令牌列表",
+  "access.api.nameLabel": "API 令牌名称",
+  "access.api.namePlaceholder": "输入 API 令牌名称",
+  "access.api.nameRequired": "请输入 API 令牌名称。",
+  "access.api.newKey": "生成新 API 令牌",
+  "access.api.newTokenDescription": "该明文 API 令牌仅本次显示，请在离开页面前复制保存。",
+  "access.api.newTokenLabel": "API 令牌",
+  "access.api.newTokenTitle": "API 令牌已生成",
+  "access.api.noKeys": "尚无 API 令牌，生成一个即可调用 API。",
+  "access.api.noKeysTitle": "暂无 API 令牌",
+  "access.api.revokeConfirmDescription": "API 令牌「{{name}}」将立即失效，此操作无法撤销。",
+  "access.api.revokeConfirmTitle": "撤销 API 令牌？",
+  "access.api.revokeFailed": "撤销 API 令牌失败。",
+  "access.api.revokeSuccess": "API 令牌已撤销",
+  "access.api.table.action": "操作",
+  "access.api.table.environment": "环境",
+  "access.api.table.key": "API 令牌",
+  "access.api.table.name": "名称",
+  "access.api.title": "API",
+  "access.channels.col.channel": "渠道",
+  "access.channels.col.endpoint": "入口",
+  "access.channels.col.status": "状态",
+  "access.channels.description": "WebApp 与 CLI 入口遵循上方访问权限。",
+  "access.channels.disabled": "该部署的接入渠道已关闭。",
+  "access.channels.disabledHint": "开启接入渠道后即可开放 WebApp 和 CLI 入口。",
+  "access.channels.followPermission": "随权限开放",
+  "access.channels.title": "接入渠道",
+  "access.cli.description": "通过 difyctl 在终端中调用，适合脚本、自动化流程或 Agent 集成",
+  "access.cli.docs": "使用说明",
+  "access.cli.domain": "域名",
+  "access.cli.empty": "尚未配置 CLI 接入地址。",
+  "access.cli.install": "安装 CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "已复制",
+  "access.copy": "复制",
+  "access.copyFailed": "复制失败",
+  "access.copyToast": "已复制到剪贴板",
+  "access.hide": "隐藏",
+  "access.members.clearAll": "全部清除",
+  "access.members.empty": "未找到匹配结果。",
+  "access.members.groupCount_one": "{{count}} 个分组",
+  "access.members.groupCount_other": "{{count}} 个分组",
+  "access.members.groups": "分组",
+  "access.members.individuals": "成员",
+  "access.members.memberCount_one": "{{count}} 位成员",
+  "access.members.memberCount_other": "{{count}} 位成员",
+  "access.members.pickPlaceholder": "选择分组或成员",
+  "access.members.searchPlaceholder": "搜索分组和成员",
+  "access.members.selectedLabel": "已选择",
+  "access.permission.anyone": "任何人",
+  "access.permission.anyoneDesc": "任何人均可访问该部署，无需登录",
+  "access.permission.memberCount_one": "{{count}} 位成员",
+  "access.permission.memberCount_other": "{{count}} 位成员",
+  "access.permission.organization": "平台内所有成员",
+  "access.permission.organizationDesc": "平台内所有成员",
+  "access.permission.specific": "平台内指定成员",
+  "access.permission.specificDesc": "选择指定的分组或成员",
+  "access.permission.specificUnavailable": "特定成员暂未启用，需接入真实平台成员与分组后再开放。",
+  "access.permission.updateFailed": "更新访问策略失败。",
+  "access.permissions.col.environment": "环境",
+  "access.permissions.col.permission": "访问范围",
+  "access.permissions.description": "设置 WebApp 与 CLI 入口在每个环境中的访问权限。",
+  "access.permissions.editAriaLabel": "配置 {{environment}} 的访问权限",
+  "access.permissions.editDescription": "设置 WebApp 与 CLI 入口的访问权限。",
+  "access.permissions.editTitle": "访问权限",
+  "access.permissions.title": "访问权限",
+  "access.revoke": "撤销",
+  "access.runAccess.description": "管理用户如何运行该部署，以及在每个环境里谁可以访问。",
+  "access.runAccess.disabled": "该部署的接入已关闭。",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "将此部署作为 Model Context Protocol 服务器对外提供。",
+  "access.runAccess.mcpEmpty": "尚未配置 MCP 端点。",
+  "access.runAccess.noEnvs": "请先部署到环境后再配置访问权限。",
+  "access.runAccess.noEnvsTitle": "暂无已部署环境",
+  "access.runAccess.openWebapp": "打开 WebApp",
+  "access.runAccess.permissions": "访问权限",
+  "access.runAccess.permissionsDesc": "每个环境里可以访问该部署的人员。",
+  "access.runAccess.title": "运行访问",
+  "access.runAccess.urlLabel": "访问地址",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "面向终端用户的托管 Web 页面。",
+  "access.runAccess.webappEmpty": "即将支持。",
+  "access.show": "显示",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "外部",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "未知",
+  "card.access.api": "API 令牌",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "未开启接入",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "创建首个版本",
+  "card.deploy": "部署",
+  "card.deploying": "{{count}} 个部署中",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} 个失败",
+  "card.fromApp": "来自 {{name}}",
+  "card.lastDeployed": "上次部署于 {{time}}",
+  "card.menu.delete": "删除部署",
+  "card.menu.deleteDisabled": "后端托管的部署暂不支持删除。",
+  "card.menu.deploy": "部署到环境",
+  "card.menu.editInfo": "编辑信息",
+  "card.menu.viewDetail": "查看部署详情",
+  "card.moreActions": "更多操作",
+  "card.neverDeployed": "尚未部署",
+  "card.noDescription": "暂无描述",
+  "card.notDeployed": "未部署",
+  "card.ready": "{{count}} 个运行中",
+  "card.tooltip.createdAt": "创建时间",
+  "card.tooltip.deployed": "已部署",
+  "card.tooltip.deploymentStatus": "部署状态",
+  "card.tooltip.notDeployed": "该部署尚未部署到任何环境。",
+  "card.tooltip.notDeployedShort": "未部署",
+  "card.tooltip.release": "版本",
+  "card.tooltip.releaseName": "版本名称",
+  "card.tooltip.source": "来源",
+  "common.loadFailed": "加载失败，请稍后再试。",
+  "common.loading": "加载中…",
+  "createGuide.actions.back": "返回",
+  "createGuide.actions.cancel": "取消",
+  "createGuide.actions.continue": "继续",
+  "createGuide.actions.createAndDeploy": "创建并部署",
+  "createGuide.actions.creating": "创建中…",
+  "createGuide.actions.deploy": "部署",
+  "createGuide.actions.deploying": "创建并部署中…",
+  "createGuide.actions.next": "下一步",
+  "createGuide.actions.skipDeploy": "跳过，稍后部署",
+  "createGuide.description": "通过版本来源、基本信息和目标环境新建部署。",
+  "createGuide.dsl.defaultAppName": "导入的 DSL 应用",
+  "createGuide.dsl.description": "上传工作流 DSL 包来新建部署、首个版本，并可部署到环境。",
+  "createGuide.dsl.dropDescription": "上传工作流 YAML DSL 包。部署前会根据该文件解析部署选项。",
+  "createGuide.dsl.dropTitle": "上传工作流 DSL 包",
+  "createGuide.dsl.readFailed": "读取 DSL 文件失败。请选择其他文件后重试。",
+  "createGuide.dsl.reading": "正在读取 DSL 文件…",
+  "createGuide.dsl.title": "导入 DSL",
+  "createGuide.dsl.unsupportedMode": "仅支持使用工作流 DSL 新建部署。",
+  "createGuide.errors.createReleaseFailed": "新建部署或版本失败。",
+  "createGuide.errors.deployFailed": "部署到环境失败。",
+  "createGuide.method.description": "选择用于生成首个版本的来源。",
+  "createGuide.methods.bindApp.description": "使用 Studio 中已有的工作流应用作为版本来源。",
+  "createGuide.methods.bindApp.title": "绑定已有工作流应用",
+  "createGuide.methods.importDsl.description": "上传工作流 YAML DSL 包，并继续完成部署配置。",
+  "createGuide.methods.importDsl.title": "导入 DSL",
+  "createGuide.methods.mocked": "模拟",
+  "createGuide.nav.back": "部署",
+  "createGuide.release.defaultName": "初始版本",
+  "createGuide.release.deployInfo": "部署信息",
+  "createGuide.release.description": "填写部署信息和首个版本信息。",
+  "createGuide.release.firstVersion": "首个版本",
+  "createGuide.release.instanceDescription": "部署描述",
+  "createGuide.release.instanceDescriptionPlaceholder": "描述该部署的用途",
+  "createGuide.release.instanceName": "部署名称",
+  "createGuide.release.instanceNameConflict": "该部署名称已存在，请换一个名称。",
+  "createGuide.release.releaseDescription": "版本描述",
+  "createGuide.release.releaseDescriptionPlaceholder": "描述这个版本",
+  "createGuide.release.releaseName": "版本名称",
+  "createGuide.release.releaseNote": "版本描述",
+  "createGuide.release.title": "基本信息",
+  "createGuide.source.availableApps_one": "{{count}} 个应用",
+  "createGuide.source.availableApps_other": "{{count}} 个应用",
+  "createGuide.source.clearSearch": "清空应用搜索",
+  "createGuide.source.description": "选择用于生成首个版本的来源。",
+  "createGuide.source.empty": "未找到工作流应用。",
+  "createGuide.source.searchPlaceholder": "搜索应用",
+  "createGuide.source.sourceApp": "工作流应用",
+  "createGuide.source.title": "版本来源",
+  "createGuide.steps.method": "版本来源",
+  "createGuide.steps.release": "基本信息",
+  "createGuide.steps.source": "版本来源",
+  "createGuide.steps.target": "部署到环境",
+  "createGuide.target.bindingCount_one": "{{count}} 项",
+  "createGuide.target.bindingCount_other": "{{count}} 项",
+  "createGuide.target.bindingHint": "选择该版本使用的凭据。",
+  "createGuide.target.bindings": "凭据",
+  "createGuide.target.deferredBindingHint": "凭据会在最终部署时根据真实部署计划解析。",
+  "createGuide.target.deferredEnvironmentHint": "新建部署和版本后，会根据真实环境进行匹配。",
+  "createGuide.target.description": "选择目标环境，并提供此版本在该环境中所需的运行时设置。此步骤可跳过。",
+  "createGuide.target.envVarCount_one": "{{count}} 项",
+  "createGuide.target.envVarCount_other": "{{count}} 项",
+  "createGuide.target.envVarHint": "为该版本需要的每个环境变量输入自定义值，或使用应用中定义的值。",
+  "createGuide.target.envVarPlaceholder": "输入变量值",
+  "createGuide.target.envVarSource.ariaLabel": "选择 {{key}} 的变量值来源",
+  "createGuide.target.envVarSource.default": "应用中的值",
+  "createGuide.target.envVarSource.lastDeployment": "上次部署值",
+  "createGuide.target.envVarSource.literal": "自定义值",
+  "createGuide.target.envVarType.number": "数字",
+  "createGuide.target.envVarType.secret": "密钥",
+  "createGuide.target.envVarType.string": "字符串",
+  "createGuide.target.envVars": "环境变量",
+  "createGuide.target.environment": "目标环境",
+  "createGuide.target.environmentName": "环境名称",
+  "createGuide.target.environmentNamePlaceholder": "生产环境",
+  "createGuide.target.loadBindingsFailed": "加载凭据失败。",
+  "createGuide.target.loadEnvironmentsFailed": "加载部署环境失败。",
+  "createGuide.target.missingRequiredBinding": "请选择该必填绑定使用的凭据。",
+  "createGuide.target.noBindingRequired": "无需凭据。",
+  "createGuide.target.noCredentialCandidates": "没有可用凭据。",
+  "createGuide.target.noEnvironmentOptions": "没有可用部署环境。",
+  "createGuide.target.required": "必填",
+  "createGuide.target.selectCredential": "选择凭据",
+  "createGuide.target.title": "部署到环境",
+  "createGuide.title": "新建部署",
+  "createModal.appPickerPlaceholder": "选择工作流应用",
+  "createModal.appSearchEmpty": "没有匹配的工作流应用",
+  "createModal.appSearchPlaceholder": "搜索工作流应用…",
+  "createModal.cancel": "取消",
+  "createModal.create": "创建",
+  "createModal.createFailed": "新建部署失败。",
+  "createModal.description": "从 Studio 选择一个工作流应用并新建部署。",
+  "createModal.descriptionLabel": "描述",
+  "createModal.descriptionPlaceholder": "描述该部署的用途",
+  "createModal.loadMoreApps": "加载更多应用",
+  "createModal.loadingApps": "正在加载应用…",
+  "createModal.nameLabel": "部署名称",
+  "createModal.namePlaceholder": "部署名称",
+  "createModal.noApps": "当前工作区还没有工作流应用，请先在 Studio 创建一个。",
+  "createModal.selected": "已选择",
+  "createModal.sourceApp": "工作流应用（必选）",
+  "createModal.title": "新建部署",
+  "deployDrawer.bindingCount_one": "{{count}} 项",
+  "deployDrawer.bindingCount_other": "{{count}} 项",
+  "deployDrawer.bindingOptionsFailed": "加载凭据选项失败。",
+  "deployDrawer.bindingSelectionHint": "选择本次部署要使用的凭据。",
+  "deployDrawer.bindingsDisabled": "来自版本预览的解析结果，暂不支持在这里编辑。",
+  "deployDrawer.cancel": "取消",
+  "deployDrawer.close": "关闭部署抽屉",
+  "deployDrawer.defaultSelect": "选择…",
+  "deployDrawer.deploy": "部署到环境",
+  "deployDrawer.deployExistingRelease": "部署到环境",
+  "deployDrawer.deployExistingReleaseDescription": "选择版本和目标环境，完成部署。",
+  "deployDrawer.deployExistingReleaseTitle": "部署到环境",
+  "deployDrawer.deployFailed": "启动部署失败。",
+  "deployDrawer.deploying": "部署中…",
+  "deployDrawer.description": "选择版本和目标环境，完成部署。",
+  "deployDrawer.envVarCount_one": "{{count}} 项",
+  "deployDrawer.envVarCount_other": "{{count}} 项",
+  "deployDrawer.envVarHint": "为该版本需要的每个环境变量输入自定义值，或使用应用中定义的值。",
+  "deployDrawer.envVarPlaceholder": "输入变量值",
+  "deployDrawer.envVarSource.ariaLabel": "选择 {{key}} 的变量值来源",
+  "deployDrawer.envVarSource.default": "应用中的值",
+  "deployDrawer.envVarSource.lastDeployment": "上次部署值",
+  "deployDrawer.envVarSource.literal": "自定义值",
+  "deployDrawer.envVarType.number": "数字",
+  "deployDrawer.envVarType.secret": "密钥",
+  "deployDrawer.envVarType.string": "字符串",
+  "deployDrawer.envVars": "环境变量",
+  "deployDrawer.existingReleaseHint": "将直接部署该版本，不会创建新版本。",
+  "deployDrawer.loadingBindings": "解析中…",
+  "deployDrawer.lockedHint": "已锁定至当前环境",
+  "deployDrawer.missingRequiredBinding": "请选择该必填绑定使用的凭据。",
+  "deployDrawer.missingRequiredEnvVar": "请填写该必填环境变量。",
+  "deployDrawer.modelCreds": "模型凭据",
+  "deployDrawer.needsValidation": "（待验证）",
+  "deployDrawer.newReleaseHint": "将基于所选工作流应用 YAML 创建一个新版本。",
+  "deployDrawer.noBindingRequired": "无需配置",
+  "deployDrawer.noCredentialCandidates": "没有可用凭据。",
+  "deployDrawer.noNewEnvironmentAvailable": "所有可用环境都已有部署。",
+  "deployDrawer.noOtherReleaseAvailable": "此环境没有其他可用版本。",
+  "deployDrawer.noReleaseAvailable": "请先创建版本，再部署到环境。",
+  "deployDrawer.notFound": "未找到部署。",
+  "deployDrawer.noteLabel": "版本描述（可选）",
+  "deployDrawer.notePlaceholder": "例如：优化引导文案",
+  "deployDrawer.pluginCreds": "插件凭据",
+  "deployDrawer.promote": "部署",
+  "deployDrawer.promoteDescription": "选择版本和目标环境，完成部署。",
+  "deployDrawer.promoteTitle": "部署到环境",
+  "deployDrawer.readOnly": "只读",
+  "deployDrawer.redeploy": "部署到环境",
+  "deployDrawer.redeployDescription": "选择版本和目标环境，完成部署。",
+  "deployDrawer.redeployExistingReleaseHint": "将重新部署当前版本，不会创建新版本。",
+  "deployDrawer.redeployTitle": "部署到环境",
+  "deployDrawer.releaseLabel": "版本",
+  "deployDrawer.requiredBinding": "必填",
+  "deployDrawer.rollback": "部署",
+  "deployDrawer.rollbackDescription": "选择版本和目标环境，完成部署。",
+  "deployDrawer.rollbackTitle": "部署到环境",
+  "deployDrawer.runtimeCredentials": "凭据",
+  "deployDrawer.secretPlaceholder": "机密值",
+  "deployDrawer.selectCredential": "选择凭据",
+  "deployDrawer.selectEnv": "选择一个环境",
+  "deployDrawer.selectProviderCred": "选择 {{provider}} 凭据",
+  "deployDrawer.selectProviderKey": "选择 {{provider}} 密钥",
+  "deployDrawer.selectRelease": "选择一个版本",
+  "deployDrawer.targetEnv": "目标环境",
+  "deployDrawer.title": "部署到环境",
+  "deployDrawer.valuePlaceholder": "值",
+  "deployTab.cancelDeployment": "取消部署",
+  "deployTab.closeError": "关闭",
+  "deployTab.col.actions": "操作",
+  "deployTab.col.currentRelease": "当前版本",
+  "deployTab.col.environment": "环境",
+  "deployTab.col.status": "状态",
+  "deployTab.col.updated": "更新时间",
+  "deployTab.collapseDetails": "收起部署详情",
+  "deployTab.confirmUndeploy": "下线",
+  "deployTab.deployOtherVersion": "部署其他版本",
+  "deployTab.deployToEnv": "部署到 {{name}}",
+  "deployTab.deployToNewEnv": "部署到新环境…",
+  "deployTab.empty": "暂无实例。部署到新环境后即可开始使用。",
+  "deployTab.emptyDescription": "选择版本和目标环境，让该部署可以被用户访问。",
+  "deployTab.emptyTitle": "暂无运行中的环境",
+  "deployTab.envCount": "环境",
+  "deployTab.errorCode": "代码",
+  "deployTab.errorDialogDesc": "重试或部署其他版本前，先查看上一次失败的部署原因。",
+  "deployTab.errorDialogTitle": "{{name}} 的部署错误",
+  "deployTab.errorMessage": "消息",
+  "deployTab.errorPhase": "阶段",
+  "deployTab.expandDetails": "展开部署详情",
+  "deployTab.moreActions": "更多操作",
+  "deployTab.newDeployment": "部署到新环境",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "部署 ID",
+  "deployTab.panel.endpoints": "端点",
+  "deployTab.panel.envVars": "环境变量",
+  "deployTab.panel.error": "错误",
+  "deployTab.panel.failedRelease": "失败版本",
+  "deployTab.panel.health": "健康检查",
+  "deployTab.panel.instanceInfo": "实例信息",
+  "deployTab.panel.modelCreds": "模型凭据",
+  "deployTab.panel.pluginCreds": "插件凭据",
+  "deployTab.panel.release": "版本",
+  "deployTab.panel.releaseCreatedAt": "版本创建时间",
+  "deployTab.panel.releaseInfo": "版本信息",
+  "deployTab.panel.replicas": "副本数",
+  "deployTab.panel.run": "运行",
+  "deployTab.panel.runtimeBindings": "凭据",
+  "deployTab.panel.runtimeInfo": "运行信息",
+  "deployTab.panel.runtimeMode": "运行模式",
+  "deployTab.panel.runtimeNote": "运行备注",
+  "deployTab.panel.targetRelease": "目标版本",
+  "deployTab.panel.unknownError": "部署失败。",
+  "deployTab.promote": "部署",
+  "deployTab.redeploy": "重新部署",
+  "deployTab.releaseCreatedAt": "版本创建于 {{time}}",
+  "deployTab.retry": "重试",
+  "deployTab.shortcut": "快捷",
+  "deployTab.status.deployFailed": "部署失败",
+  "deployTab.status.deployingRelease": "部署中（{{release}}）",
+  "deployTab.status.runningOutOfSync": "运行中（待同步）",
+  "deployTab.status.runningWithFailed": "运行中（上次部署失败）",
+  "deployTab.undeploy": "下线",
+  "deployTab.undeployConfirmDesc": "用户访问将立即停止。该版本之后仍可重新部署。",
+  "deployTab.undeployConfirmTitle": "从 {{name}} 下线？",
+  "deployTab.undeployFrom": "从 {{name}} 下线",
+  "deployTab.undeployImpactTitle": "受影响的实例",
+  "deployTab.viewError": "查看错误",
+  "deployTab.viewLogs": "查看日志",
+  "deployTab.viewProgress": "查看进度",
+  "detail.backToInstances": "返回部署",
+  "detail.deployingCount": "{{count}} 个部署中",
+  "detail.envCount_one": "{{count}} 个环境",
+  "detail.envCount_other": "{{count}} 个环境",
+  "detail.failedCount": "{{count}} 个失败",
+  "detail.mobileTabs": "部署页面",
+  "detail.notFound": "未找到部署",
+  "detail.openSourceApp": "打开来源 {{name}}",
+  "detail.sourceApp": "来源",
+  "detail.sourceAppLink": "来源",
+  "documentTitle.create": "新建部署 · 部署",
+  "documentTitle.detail": "部署 · 部署",
+  "documentTitle.list": "部署",
+  "filter.allEnvs": "全部环境",
+  "filter.notDeployed": "未部署",
+  "filter.searchPlaceholder": "搜索部署",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "准入中",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "启动中",
+  "health.ENVIRONMENT_STATUS_DELETING": "删除中",
+  "health.ENVIRONMENT_STATUS_FAILED": "不可用",
+  "health.ENVIRONMENT_STATUS_READY": "可用",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "未知",
+  "list.clearFilters": "清空筛选",
+  "list.clearSearch": "清空部署搜索",
+  "list.createDeployment": "新建",
+  "list.empty": "未找到部署。",
+  "list.emptyDescription": "从工作流应用或工作流 DSL 包新建部署后，即可管理版本、环境和访问方式。",
+  "list.emptyFilteredDescription": "当前搜索或环境筛选下没有匹配的部署。",
+  "list.emptyFilteredTitle": "没有匹配的部署",
+  "list.emptyTitle": "暂无部署",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "独立",
+  "mode.ENVIRONMENT_MODE_SHARED": "共享",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "未知",
+  "newInstance.comingSoon": "即将支持",
+  "newInstance.fromStudio": "从 Studio 选择",
+  "newInstance.importDSL": "导入 DSL",
+  "newInstance.title": "新建部署",
+  "overview.accessEndpoints": "接入端点",
+  "overview.accessMeta.apiTokens": "管理 API 访问令牌",
+  "overview.accessMeta.cli": "查看 CLI 接入方式",
+  "overview.accessMeta.webApp": "管理 WebApp 接入",
+  "overview.accessStatus": "接入方式",
+  "overview.api": "API 令牌",
+  "overview.apiKeysCount_one": "{{count}} 个 API 令牌",
+  "overview.apiKeysCount_other": "{{count}} 个 API 令牌",
+  "overview.apiTokenSummary.environments_one": "{{count}} 个已部署环境",
+  "overview.apiTokenSummary.environments_other": "{{count}} 个已部署环境",
+  "overview.availableForDeployment": "可部署",
+  "overview.basicInfo": "基本信息",
+  "overview.cardAction.deployLatest": "部署最新版本",
+  "overview.cardAction.redeploy": "重新部署",
+  "overview.cardAction.viewProgress": "查看部署",
+  "overview.chip.behindTooltip_one": "落后最新版本 1 个，可部署最新版本更新。",
+  "overview.chip.behindTooltip_other": "落后最新版本 {{count}} 个，可部署最新版本更新。",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "部署中",
+  "overview.chip.deployingTooltip": "部署正在进行中。",
+  "overview.chip.empty": "空",
+  "overview.chip.emptyTooltip": "此环境尚未部署任何版本。",
+  "overview.chip.failed": "失败",
+  "overview.chip.failedTooltip": "最近一次部署失败。",
+  "overview.chip.latest": "最新",
+  "overview.chip.latestTooltip": "此环境正在运行最新版本。",
+  "overview.chip.needsReleaseFirst": "请先创建版本",
+  "overview.chip.olderRelease": "较旧",
+  "overview.chip.olderReleaseTooltip": "此环境正在运行较早的版本。",
+  "overview.chip.openInDeployTab": "查看部署进度",
+  "overview.cli": "CLI",
+  "overview.configured": "已配置",
+  "overview.createRelease": "创建版本",
+  "overview.created": "创建时间",
+  "overview.deploy": "部署",
+  "overview.deployedEnvironments": "已部署",
+  "overview.deploymentOverview": "部署概览",
+  "overview.deploymentStatus": "部署状态",
+  "overview.description": "描述",
+  "overview.developerApi": "开发者 API",
+  "overview.disabled": "未启用",
+  "overview.emptyValue": "未设置",
+  "overview.enabled": "已启用",
+  "overview.enabledChannels": "接入启用",
+  "overview.endUserAccess": "终端用户接入",
+  "overview.environments": "环境",
+  "overview.hero.byName": "由 {{name}} 创建",
+  "overview.hero.empty": "尚无版本",
+  "overview.hero.emptyDescription": "先从当前来源创建版本，再部署到环境。",
+  "overview.hero.propagation_one": "已部署到 {{total}} 个环境中的 {{count}} 个",
+  "overview.hero.propagation_other": "已部署到 {{total}} 个环境中的 {{count}} 个",
+  "overview.hero.untargeted": "尚未配置环境",
+  "overview.instanceDetails": "部署详情",
+  "overview.instanceId": "部署 ID",
+  "overview.latestRelease.releaseCount_one": "共 {{count}} 个版本",
+  "overview.latestRelease.releaseCount_other": "共 {{count}} 个版本",
+  "overview.latestReleaseTitle": "最新版本",
+  "overview.manageDeployments": "管理部署",
+  "overview.name": "名称",
+  "overview.noAccessConfig": "未配置接入方式。",
+  "overview.noReleaseYet": "请先创建版本，再部署到环境。",
+  "overview.notConfigured": "未配置",
+  "overview.previousReleases.empty": "暂无更早的版本。",
+  "overview.previousReleases.retired": "当前未部署",
+  "overview.previousReleases.title": "历史版本",
+  "overview.previousReleases.viewAll": "查看全部",
+  "overview.ready": "可部署",
+  "overview.recentReleases": "近期版本",
+  "overview.releaseDeployedTitle": "{{release}} 已部署",
+  "overview.releaseReadyTitle": "{{release}} 可以部署",
+  "overview.serviceMap": "服务图",
+  "overview.servingRelease": "正在运行 {{release}}",
+  "overview.servingReleaseDescription": "该部署已部署到 {{count}}/{{total}} 个环境。",
+  "overview.strip.deployToNewEnvironment": "部署到新环境",
+  "overview.strip.empty": "尚未配置任何环境。",
+  "overview.strip.emptyDeployableDescription": "已有版本后，可选择环境进行部署。",
+  "overview.strip.emptyDeployed": "暂无实例。",
+  "overview.strip.emptyDescription": "请先创建版本，再部署到环境。",
+  "overview.strip.emptyTitle": "暂无实例",
+  "overview.strip.summary_one": "{{total}} 个环境中 1 个已部署最新版本",
+  "overview.strip.summary_other": "{{total}} 个环境中 {{count}} 个已部署最新版本",
+  "overview.strip.title": "实例",
+  "overview.switchSourceApp": "切换来源",
+  "overview.switchSourceAppDescription": "选择后续新建版本使用的工作流应用来源。",
+  "overview.switchSourceAppHint": "切换后，仅新建版本会使用新的来源；历史版本和现有部署不受影响。",
+  "overview.targetRelease": "目标版本",
+  "overview.webapp": "WebApp",
+  "settings.danger": "危险区域",
+  "settings.dangerDesc": "永久删除此部署并停止所有运行中的实例。此操作无法撤销。",
+  "settings.delete": "删除部署",
+  "settings.deleteConfirmDesc": "确定删除 {{name}}？所有实例都将停止运行，并从所有环境中移除。此操作无法撤销。",
+  "settings.deleteConfirmTitle": "删除部署",
+  "settings.deleteFailed": "删除部署失败。",
+  "settings.deleteImpact": "影响",
+  "settings.deleteImpactInstance": "部署",
+  "settings.deleteImpactTitle": "受影响的部署",
+  "settings.deleteImpactValue": "该部署会从部署列表中移除。",
+  "settings.deleted": "部署已删除",
+  "settings.description": "描述",
+  "settings.descriptionHelp": "管理此部署的名称、描述和其他设置。",
+  "settings.general": "常规",
+  "settings.name": "部署名称",
+  "settings.reset": "重置",
+  "settings.save": "保存修改",
+  "settings.updateFailed": "更新部署失败。",
+  "settings.updated": "部署已更新",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "部署中",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "待同步",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "部署失败",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "异常",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "运行中",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下线中",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
+  "subtitle": "在不同环境中管理部署。",
+  "tabs.access.description": "管理接入渠道与访问权限。",
+  "tabs.access.name": "接入方式",
+  "tabs.api-tokens.description": "管理 API 令牌，通过 HTTP 调用各环境中的实例。",
+  "tabs.api-tokens.name": "API 令牌",
+  "tabs.instances.description": "查看和管理各环境中的实例。",
+  "tabs.instances.name": "实例",
+  "tabs.overview.description": "查看此部署在各环境中的状态。",
+  "tabs.overview.name": "概览",
+  "tabs.releases.description": "创建、部署和管理版本。",
+  "tabs.releases.name": "版本",
+  "tabs.settings.description": "管理此部署的名称、描述和其他设置。",
+  "tabs.settings.name": "设置",
+  "title": "部署",
+  "unsupportedDslNodes.description": "该版本包含当前部署运行时尚不支持的节点。请在 Studio 中移除或替换这些节点后重试。",
+  "unsupportedDslNodes.descriptionWithTypes": "该版本包含当前部署运行时尚不支持的节点：{{nodeTypes}}。请在 Studio 中移除或替换后重试。",
+  "unsupportedDslNodes.title": "不支持的节点",
+  "unsupportedDslNodes.unknownType": "未知类型",
+  "versions.cancelCreate": "取消",
+  "versions.cancelDelete": "取消",
+  "versions.cancelEdit": "取消",
+  "versions.checkingReleaseContent": "正在检查版本内容…",
+  "versions.col.action": "操作",
+  "versions.col.author": "创建者",
+  "versions.col.commit": "提交",
+  "versions.col.createdAt": "创建时间",
+  "versions.col.deployedTo": "已部署到",
+  "versions.col.release": "版本",
+  "versions.col.sourceApp": "来源",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "创建",
+  "versions.createFailed": "创建版本失败。",
+  "versions.createRelease": "创建版本",
+  "versions.createReleaseDescription": "从工作流应用或工作流 DSL 文件创建可部署版本。",
+  "versions.createReleaseHint": "新版本可部署到任意环境。",
+  "versions.createSuccess": "版本 \"{{name}}\" 已创建。",
+  "versions.creating": "创建中…",
+  "versions.currentOn": "{{name}} 当前版本",
+  "versions.deleteConfirmDesc": "版本 \"{{name}}\" 将被永久删除，此操作无法撤销。",
+  "versions.deleteConfirmTitle": "删除版本？",
+  "versions.deleteFailed": "删除版本失败。",
+  "versions.deleteImpactDeployment": "部署状态",
+  "versions.deleteImpactNotDeployed": "当前未部署",
+  "versions.deleteImpactRelease": "版本",
+  "versions.deleteImpactTitle": "删除影响",
+  "versions.deleteRelease": "删除版本",
+  "versions.deleteSuccess": "版本 \"{{name}}\" 已删除。",
+  "versions.deploy": "部署",
+  "versions.deployTo": "部署到 {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "部署中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "待同步",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "失败",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "异常",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "运行中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下线中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
+  "versions.deployingTo": "{{name}} 正在部署",
+  "versions.disabledReason.checkDeploymentsFailed": "无法确认部署使用情况，请稍后重试。",
+  "versions.disabledReason.checkingDeployments": "正在检查部署使用情况",
+  "versions.disabledReason.current": "{{name}} 已运行此版本",
+  "versions.disabledReason.deploying": "请等待当前部署完成",
+  "versions.disabledReason.envDisabled": "此环境不可部署",
+  "versions.disabledReason.releaseInUse_one": "请先从 {{count}} 个环境中取消部署此版本，再删除它",
+  "versions.disabledReason.releaseInUse_other": "请先从 {{count}} 个环境中取消部署此版本，再删除它",
+  "versions.dslReadFailed": "读取 DSL 文件失败。请选择其他文件后重试。",
+  "versions.dslReading": "正在读取 DSL 文件…",
+  "versions.dslUnsupportedMode": "仅支持使用工作流 DSL 创建部署版本。",
+  "versions.editFailed": "更新版本失败。",
+  "versions.editRelease": "编辑版本",
+  "versions.editReleaseDescription": "更新此版本的名称和描述。",
+  "versions.editSuccess": "版本 \"{{name}}\" 已更新。",
+  "versions.empty": "暂无可用版本。",
+  "versions.emptyDescription": "先创建第一个版本，再部署到目标环境。",
+  "versions.emptyTitle": "暂无版本",
+  "versions.emptyWithCreate": "暂无版本，请先创建第一个可部署版本。",
+  "versions.exportDsl": "导出 DSL",
+  "versions.exportDslFailed": "导出 DSL 失败。",
+  "versions.exportingDsl": "正在导出…",
+  "versions.groupHeader.deploy": "部署",
+  "versions.groupHeader.promote": "部署",
+  "versions.groupHeader.rollback": "部署历史版本",
+  "versions.groupHeader.unavailable": "不可用",
+  "versions.manualDslOption": "上传 DSL",
+  "versions.moreActions": "更多操作",
+  "versions.optional": "可选",
+  "versions.promote": "部署",
+  "versions.promoteTo": "部署到 {{name}}",
+  "versions.releaseAlreadyExists": "相同内容的版本已存在：{{name}}。",
+  "versions.releaseContentCheckFailed": "检查版本内容失败。",
+  "versions.releaseDescriptionLabel": "描述",
+  "versions.releaseDescriptionPlaceholder": "描述这个版本",
+  "versions.releaseHistory": "版本历史",
+  "versions.releaseNameLabel": "版本名称",
+  "versions.releaseNamePlaceholder": "版本名称",
+  "versions.releaseNameRequired": "请输入版本名称。",
+  "versions.releaseSourceLabel": "版本来源",
+  "versions.rollbackTo": "部署到 {{name}}",
+  "versions.saveEdit": "保存",
+  "versions.sourceAppOption": "工作流应用"
+}
diff --git a/web/i18n/zh-Hans/permission-keys.json b/web/i18n/zh-Hans/permission-keys.json
new file mode 100644
index 00000000000..08154da397a
--- /dev/null
+++ b/web/i18n/zh-Hans/permission-keys.json
@@ -0,0 +1,50 @@
+{
+  "api_extension.manage": "管理API扩展",
+  "app.access_config": "配置应用访问权限",
+  "app.acl.access_config": "配置应用访问权限",
+  "app.acl.delete": "删除应用",
+  "app.acl.edit": "编辑与编排应用",
+  "app.acl.import_export_dsl": "导入 / 导出 DSL",
+  "app.acl.monitor": "监测与运维",
+  "app.acl.preview": "预览应用",
+  "app.acl.release_and_version": "应用发布与版本管理",
+  "app.acl.test_and_run": "测试与使用应用",
+  "app.acl.view_layout": "编排页只读",
+  "app.create_and_management": "创建和管理自己创建的应用",
+  "app.tag.manage": "管理应用标签",
+  "app_library.access": "访问应用库",
+  "billing.manage": "更换订阅套餐",
+  "billing.subscription.manage": "在账单门户管理账单与订阅方案",
+  "billing.view": "在设置中访问账单页面",
+  "credential.manage": "管理凭据",
+  "credential.use": "使用凭据",
+  "customization.manage": "管理定制",
+  "data_source.manage": "管理数据来源",
+  "dataset.access_config": "配置知识库访问权限",
+  "dataset.acl.access_config": "配置知识库访问权限",
+  "dataset.acl.delete": "删除知识库",
+  "dataset.acl.delete_file": "删除知识库文件",
+  "dataset.acl.document_download": "文档下载",
+  "dataset.acl.edit": "知识库编辑",
+  "dataset.acl.import_export_dsl": "从 DSL 导入 / 导出知识流水线 DSL",
+  "dataset.acl.pipeline_release": "知识库流水线发布与版本管理",
+  "dataset.acl.pipeline_test": "流水线测试",
+  "dataset.acl.preview": "预览知识库",
+  "dataset.acl.readonly": "知识库只读",
+  "dataset.acl.retrieval_recall": "知识库检索召回",
+  "dataset.acl.use": "向知识库新增文件",
+  "dataset.api_key.manage": "管理知识库 API Key",
+  "dataset.create_and_management": "创建和管理自己创建的知识库",
+  "dataset.external.connect": "连接外部知识库",
+  "dataset.tag.manage": "管理知识库标签",
+  "mcp.manage": "管理MCP",
+  "plugin.debug": "调试插件",
+  "plugin.install": "安装与更新插件",
+  "plugin.manage": "管理插件",
+  "plugin.plugin_preferences": "管理插件偏好",
+  "snippets.create_and_modify": "创建和修改 Snippets",
+  "snippets.management": "管理 Snippets",
+  "tool.manage": "管理工具",
+  "workspace.member.manage": "管理成员",
+  "workspace.role.manage": "管理角色权限与访问权限规则"
+}
diff --git a/web/i18n/zh-Hans/permission.json b/web/i18n/zh-Hans/permission.json
new file mode 100644
index 00000000000..4229276f1ac
--- /dev/null
+++ b/web/i18n/zh-Hans/permission.json
@@ -0,0 +1,104 @@
+{
+  "accessRule.actions": "操作",
+  "accessRule.addMemberAria": "添加 {{name}}",
+  "accessRule.addMembersTitle": "添加成员",
+  "accessRule.allPermittedMembers": "全部成员",
+  "accessRule.allPermittedMembersDescription": "所有具备对应角色权限的成员均可访问",
+  "accessRule.appDescription": "设置谁可以访问此应用，以及个别成员的权限例外",
+  "accessRule.appTitle": "应用访问规则",
+  "accessRule.changeOpenScopeDescription": "更改开放范围会重置此资源的所有个人权限设置。切换后，你需要重新添加成员专属权限。",
+  "accessRule.changeOpenScopeTitle": "更改资源开放范围？",
+  "accessRule.collapseSection": "折叠 {{title}}",
+  "accessRule.copied": "访问规则已复制",
+  "accessRule.created": "访问规则已创建",
+  "accessRule.datasetDescription": "控制此知识库对哪些成员开放。成员仍需具备角色权限才能查看或操作此知识库。",
+  "accessRule.datasetTitle": "知识库访问规则",
+  "accessRule.defaultPermission": "按角色权限",
+  "accessRule.deleteDescription": "此访问规则将被永久删除，并从资源授权列表中移除。",
+  "accessRule.deleteTitle": "删除“{{name}}”？",
+  "accessRule.deleted": "访问规则已删除",
+  "accessRule.exceptionPermissionFor": "{{name}} 的例外权限",
+  "accessRule.expandSection": "展开 {{title}}",
+  "accessRule.individualPermissionSettings": "个人权限设置",
+  "accessRule.individualPermissionSettingsTip": "为指定协作者或群组设置权限例外。这些设置会覆盖默认访问级别。",
+  "accessRule.lockedSummary_one": "· {{count}} 个锁定",
+  "accessRule.lockedSummary_other": "· {{count}} 个锁定",
+  "accessRule.maintainer": "维护者",
+  "accessRule.member": "成员",
+  "accessRule.newPermissionSet": "新建权限集",
+  "accessRule.noAvailableMembers": "暂无可添加成员",
+  "accessRule.noDescription": "无描述",
+  "accessRule.noRoles": "暂无角色",
+  "accessRule.noRules": "暂无访问规则",
+  "accessRule.noUserAccessSettings": "暂无个人权限设置",
+  "accessRule.permission": "权限",
+  "accessRule.resourceOpenScope": "访问范围",
+  "accessRule.resourceOpenScopeDescription": "选择此资源对哪些成员开放。角色权限仍决定每位成员可执行的操作。",
+  "accessRule.specificMembersOnly": "指定成员",
+  "accessRule.specificMembersOnlyDescription": "仅被添加到下方列表的成员可访问",
+  "accessRule.summary_one": "{{count}} 个权限集",
+  "accessRule.summary_other": "{{count}} 个权限集",
+  "accessRule.updated": "访问规则已更新",
+  "common.duplicateAction": "创建副本",
+  "group.app": "应用",
+  "group.app_acl": "应用访问权限",
+  "group.billing": "账单",
+  "group.credential": "凭据",
+  "group.dataset": "知识库",
+  "group.dataset_acl": "知识库访问权限",
+  "group.plugin": "插件",
+  "group.tool_mcp": "工具与MCP",
+  "group.workspace": "工作空间",
+  "permissionList.clearAll": "清除全部",
+  "permissionList.collapseGroup": "折叠分组",
+  "permissionList.expandGroup": "展开分组",
+  "permissionList.noPermissionsFound": "未找到权限",
+  "permissionList.selectAll": "全选",
+  "permissionSet.descriptionLabel": "描述",
+  "permissionSet.descriptionPlaceholder": "描述此权限集授予的能力",
+  "permissionSet.learnMore": "了解更多权限说明",
+  "permissionSet.modal.create.app.description": "创建可在访问规则中引用的应用权限集，以便快速授权。",
+  "permissionSet.modal.create.app.title": "创建应用权限集",
+  "permissionSet.modal.create.dataset.description": "创建可在访问规则中引用的知识库权限集，以便快速授权。",
+  "permissionSet.modal.create.dataset.title": "创建知识库权限集",
+  "permissionSet.modal.edit.app.description": "修改此权限集的名称、描述和授予的权限。",
+  "permissionSet.modal.edit.app.title": "编辑应用权限集",
+  "permissionSet.modal.edit.dataset.description": "修改此权限集的名称、描述和授予的权限。",
+  "permissionSet.modal.edit.dataset.title": "编辑知识库权限集",
+  "permissionSet.modal.view.app.description": "查看此权限集的名称、描述和授予的权限。",
+  "permissionSet.modal.view.app.title": "查看应用权限集",
+  "permissionSet.modal.view.dataset.description": "查看此权限集的名称、描述和授予的权限。",
+  "permissionSet.modal.view.dataset.title": "查看知识库权限集",
+  "permissionSet.nameLabel": "权限集名称",
+  "permissionSet.namePlaceholder": "例如：可导出 DSL",
+  "permissionSet.permissions": "权限",
+  "role.addRole": "创建角色",
+  "role.copyMembersDescription_one": "“{{name}}”已分配给 {{count}} 个成员。是否让新角色副本包含相同成员？",
+  "role.copyMembersDescription_other": "“{{name}}”已分配给 {{count}} 个成员。是否让新角色副本包含相同成员？",
+  "role.copyMembersLoading": "正在查询已绑定成员...",
+  "role.copyMembersTitle": "复制成员绑定？",
+  "role.created": "角色已创建",
+  "role.deleteDescription": "此角色将被永久删除，并从使用它的成员或访问规则中移除。",
+  "role.deleteTitle": "删除“{{name}}”？",
+  "role.deleted": "角色已删除",
+  "role.duplicated": "角色已复制",
+  "role.groups.builtin": "系统角色",
+  "role.groups.custom": "自定义角色",
+  "role.loading": "角色加载中...",
+  "role.modal.create.description": "创建角色并分配权限",
+  "role.modal.create.title": "创建角色",
+  "role.modal.descriptionLabel": "描述",
+  "role.modal.descriptionPlaceholder": "描述该角色负责的事项",
+  "role.modal.edit.description": "编辑角色详情和权限",
+  "role.modal.edit.title": "编辑角色",
+  "role.modal.nameLabel": "角色名称",
+  "role.modal.namePlaceholder": "例如：市场负责人",
+  "role.modal.view.description": "查看角色详情和权限",
+  "role.modal.view.title": "查看角色",
+  "role.noDescription": "无描述",
+  "role.noMatchingRoles": "未找到匹配角色",
+  "role.searchPlaceholder": "搜索角色...",
+  "role.updated": "角色已更新",
+  "role.workspaceRoles.description": "创建角色并定义每个角色在此工作空间中可以执行的操作。",
+  "role.workspaceRoles.title": "工作空间角色"
+}
diff --git a/web/i18n/zh-Hans/plugin.json b/web/i18n/zh-Hans/plugin.json
index 131ea9e3a0f..504815bdb71 100644
--- a/web/i18n/zh-Hans/plugin.json
+++ b/web/i18n/zh-Hans/plugin.json
@@ -245,6 +245,7 @@
   "pluginInfoModal.title": "集成信息",
   "pluginPublishGuide": "集成发布指南",
   "privilege.admins": "管理员",
+  "privilege.configurePermissionsInSettings": "前往设置 > 角色与权限中配置插件权限。",
   "privilege.everyone": "所有人",
   "privilege.noDebugPermissionTooltip": "你没有调试集成的权限",
   "privilege.noInstallPermissionTooltip": "你没有安装和管理集成的权限",
diff --git a/web/i18n/zh-Hans/workflow.json b/web/i18n/zh-Hans/workflow.json
index 0bb422169d6..004b1d3b6bd 100644
--- a/web/i18n/zh-Hans/workflow.json
+++ b/web/i18n/zh-Hans/workflow.json
@@ -1,5 +1,6 @@
 {
   "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "直接回复",
   "blocks.assigner": "变量赋值",
   "blocks.code": "代码执行",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "变量聚合器",
   "blocks.variable-assigner": "变量赋值器",
   "blocksAbout.agent": "调用大型语言模型回答问题或处理自然语言",
+  "blocksAbout.agent-v2": "调用大型语言模型回答问题或处理自然语言",
   "blocksAbout.answer": "定义一个聊天对话的回复内容",
   "blocksAbout.assigner": "变量赋值节点用于向可写入变量（例如会话变量）进行变量赋值。",
   "blocksAbout.code": "执行一段 Python 或 NodeJS 代码实现自定义逻辑",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "工作流 ID",
   "globalVar.fieldsDescription.workflowRunId": "工作流运行 ID",
   "globalVar.title": "系统变量",
+  "nodes.agent.advancedSetting": "高级设置",
   "nodes.agent.checkList.strategyNotSelected": "未选择策略",
   "nodes.agent.clickToViewParameterSchema": "点击查看参数 schema",
   "nodes.agent.configureModel": "配置模型",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "不支持的模型",
   "nodes.agent.modelSelectorTooltips.deprecated": "此模型已弃用",
   "nodes.agent.notAuthorized": "未授权",
+  "nodes.agent.outputVars.confirm": "确认",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "请输入 JSON 数组。",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "请输入 true 或 false。",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "这里暂不支持配置文件默认值。",
+  "nodes.agent.outputVars.defaultValueLabel": "默认值",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "请输入有效数字。",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "请输入 JSON 对象。",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "默认值",
+  "nodes.agent.outputVars.delete": "删除 {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "描述",
+  "nodes.agent.outputVars.descriptionPlaceholder": "添加描述",
+  "nodes.agent.outputVars.edit": "编辑 {{name}}",
+  "nodes.agent.outputVars.editorLabel": "输出变量编辑器",
   "nodes.agent.outputVars.files.title": "agent 生成的文件",
   "nodes.agent.outputVars.files.transfer_method": "传输方式。值为 remote_url 或 local_file",
   "nodes.agent.outputVars.files.type": "支持类型。现在只支持图片",
   "nodes.agent.outputVars.files.upload_file_id": "上传文件 ID",
   "nodes.agent.outputVars.files.url": "图片链接",
   "nodes.agent.outputVars.json": "agent 生成的 json",
+  "nodes.agent.outputVars.nameDuplicate": "输出变量名称已存在",
+  "nodes.agent.outputVars.nameInvalid": "请使用字母、数字和下划线，并以字母或下划线开头。",
+  "nodes.agent.outputVars.nameLabel": "字段名称",
+  "nodes.agent.outputVars.namePlaceholder": "字段名称",
+  "nodes.agent.outputVars.newOutput": "新建输出",
+  "nodes.agent.outputVars.requiredLabel": "必填",
+  "nodes.agent.outputVars.showAdvancedOptions": "显示高级选项",
   "nodes.agent.outputVars.text": "agent 生成的内容",
+  "nodes.agent.outputVars.typeLabel": "输出类型",
   "nodes.agent.outputVars.usage": "模型用量信息",
   "nodes.agent.parameterSchema": "参数 Schema",
   "nodes.agent.pluginInstaller.install": "安装",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "此集成安装自 GitHub。请前往集成重新安装",
   "nodes.agent.pluginNotInstalled": "此集成未安装",
   "nodes.agent.pluginNotInstalledDesc": "此集成安装自 GitHub。请前往集成重新安装",
+  "nodes.agent.roster.change": "更换",
+  "nodes.agent.roster.editInConsole": "在 Agent Console 中编辑",
+  "nodes.agent.roster.inlineSetup.description": "仅存在于此节点的一次性设置",
+  "nodes.agent.roster.inlineSetup.name": "内联配置",
+  "nodes.agent.roster.inlineSetup.title": "Agent 设置",
+  "nodes.agent.roster.inlineSetup.type": "仅在此节点中",
+  "nodes.agent.roster.label": "Agent",
+  "nodes.agent.roster.makeCopy": "创建副本",
+  "nodes.agent.roster.more": "更多 Agent 操作",
+  "nodes.agent.roster.openPanel": "打开 {{name}} 详情",
+  "nodes.agent.roster.panelLabel": "{{name}} 详情",
   "nodes.agent.strategy.configureTip": "请配置 Agent 策略。",
   "nodes.agent.strategy.configureTipDesc": "配置完成后，此节点将自动加载剩余配置。策略将影响多步工具推理的机制。",
   "nodes.agent.strategy.label": "Agent 策略",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "已安装的集成版本不提供此策略。点击切换版本。",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} 未安装",
   "nodes.agent.strategyNotSet": "代理策略未设置",
+  "nodes.agent.task.insert": "插入",
+  "nodes.agent.task.label": "Agent 任务",
+  "nodes.agent.task.mention": "提及",
+  "nodes.agent.task.placeholder": "描述这个 Agent 要完成的任务...",
+  "nodes.agent.task.tooltip": "定义该 Agent 在当前工作流中需要遵循的任务指令。",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} 未授权",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} 未安装",
   "nodes.agent.toolbox": "工具箱",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "来自 {{author}}",
   "tabs.question-understand": "问题理解",
   "tabs.requestToCommunity": "向社区反馈",
-  "tabs.searchBlock": "搜索节点",
+  "tabs.searchBlock": "搜索节点、Agent、人工、知识库",
   "tabs.searchDataSource": "搜索数据源",
   "tabs.searchSnippets": "搜索 snippets...",
   "tabs.searchTool": "搜索集成",
diff --git a/web/i18n/zh-Hant/agent-v-2.json b/web/i18n/zh-Hant/agent-v-2.json
new file mode 100644
index 00000000000..4144843418c
--- /dev/null
+++ b/web/i18n/zh-Hant/agent-v-2.json
@@ -0,0 +1,392 @@
+{
+  "agentDetail.access.actionUnavailable": "此操作暫不可用。",
+  "agentDetail.access.actions.monitoring": "監控",
+  "agentDetail.access.copyAccessUrl": "複製存取 URL",
+  "agentDetail.access.copyFailed": "引用複製失敗。",
+  "agentDetail.access.copyReference": "複製 {{name}} 的引用",
+  "agentDetail.access.copyServiceEndpoint": "複製服務 API 端點",
+  "agentDetail.access.description": "此智能體可被觸達的所有入口。",
+  "agentDetail.access.empty": "暫無關聯存取入口",
+  "agentDetail.access.emptyDescription": "目前 Roster 智能體還沒有應用或工作流程引用。",
+  "agentDetail.access.entries.agentApp.description": "關聯到此 Roster 智能體的智能體應用。",
+  "agentDetail.access.entries.agentApp.name": "智能體應用",
+  "agentDetail.access.entries.workflow.description": "關聯到此 Roster 智能體的工作流程與節點引用。",
+  "agentDetail.access.entries.workflow.name": "工作流程節點",
+  "agentDetail.access.entryCount_one": "{{count}} 個條目",
+  "agentDetail.access.entryCount_other": "{{count}} 個條目",
+  "agentDetail.access.groups.references.heading": "引用",
+  "agentDetail.access.groups.references.label": "關聯引用",
+  "agentDetail.access.learnMore": "了解更多",
+  "agentDetail.access.moreActions": "{{name}} 的更多操作",
+  "agentDetail.access.serviceApi.actions.apiKey": "API Key",
+  "agentDetail.access.serviceApi.actions.apiReference": "API Reference",
+  "agentDetail.access.serviceApi.endpoint": "服務 API 端點",
+  "agentDetail.access.serviceApi.title": "後端服務 API",
+  "agentDetail.access.status.disabled": "已停用",
+  "agentDetail.access.status.enabled": "已啟用",
+  "agentDetail.access.status.inService": "服務中",
+  "agentDetail.access.status.outOfService": "已停止服務",
+  "agentDetail.access.title": "存取點",
+  "agentDetail.access.toggleSurface": "切換 {{name}} 存取狀態",
+  "agentDetail.access.webApp.accessUrl": "存取 URL",
+  "agentDetail.access.webApp.actions.customize": "自訂",
+  "agentDetail.access.webApp.actions.embedded": "嵌入",
+  "agentDetail.access.webApp.actions.launch": "啟動",
+  "agentDetail.access.webApp.actions.settings": "設定",
+  "agentDetail.access.webApp.refreshUrl": "重新整理存取 URL",
+  "agentDetail.access.webApp.showQrCode": "顯示 QR 碼",
+  "agentDetail.access.webApp.ssoEnabled": "已啟用 SSO",
+  "agentDetail.access.webApp.title": "Web app",
+  "agentDetail.access.workflow.description": "作為工作流程內的節點使用",
+  "agentDetail.access.workflow.empty": "暫無工作流程引用。",
+  "agentDetail.access.workflow.loadFailed": "工作流程引用載入失敗。",
+  "agentDetail.access.workflow.loading": "正在載入工作流程引用…",
+  "agentDetail.access.workflow.nodeCount_one": "{{count}} 個節點",
+  "agentDetail.access.workflow.nodeCount_other": "{{count}} 個節點",
+  "agentDetail.access.workflow.notAvailable": "N/A",
+  "agentDetail.access.workflow.openInStudio": "在 Studio 中開啟",
+  "agentDetail.access.workflow.openInStudioFor": "在 Studio 中開啟 {{name}}",
+  "agentDetail.access.workflow.table.actions": "操作",
+  "agentDetail.access.workflow.table.lastUpdated": "最後更新",
+  "agentDetail.access.workflow.table.name": "名稱",
+  "agentDetail.access.workflow.table.nodes": "節點",
+  "agentDetail.access.workflow.table.version": "版本",
+  "agentDetail.access.workflow.title": "工作流程存取",
+  "agentDetail.configure.advancedSettings.description": "面向進階使用者。環境變數、沙箱與記憶。",
+  "agentDetail.configure.advancedSettings.envEditor.add": "新增環境變數",
+  "agentDetail.configure.advancedSettings.envEditor.deleteVariable": "刪除 {{key}}",
+  "agentDetail.configure.advancedSettings.envEditor.hideValue": "隱藏 {{key}} 的值",
+  "agentDetail.configure.advancedSettings.envEditor.importEnv": "匯入 .env",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.mac": "如需顯示隱藏的 .env 檔案，請在檔案選擇器中按 Command + Shift + .。",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.other": "如果 .env 檔案被隱藏，請在系統檔案選擇器中啟用顯示隱藏檔案。",
+  "agentDetail.configure.advancedSettings.envEditor.importEnvTip.windows": "如需顯示隱藏的 .env 檔案，請在檔案總管中啟用「隱藏的項目」。",
+  "agentDetail.configure.advancedSettings.envEditor.keyColumn": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.keyPlaceholder": "Key",
+  "agentDetail.configure.advancedSettings.envEditor.label": "Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.revealValue": "顯示 {{key}} 的值",
+  "agentDetail.configure.advancedSettings.envEditor.scopeColumn": "Scope",
+  "agentDetail.configure.advancedSettings.envEditor.scopePlain": "Plain",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSecret": "Secret",
+  "agentDetail.configure.advancedSettings.envEditor.scopeSelector": "選擇環境變數作用域",
+  "agentDetail.configure.advancedSettings.envEditor.tip": "此智能體在執行時可用的環境變數。",
+  "agentDetail.configure.advancedSettings.envEditor.toggle": "展開或收合 Env Editor",
+  "agentDetail.configure.advancedSettings.envEditor.valueColumn": "Value",
+  "agentDetail.configure.advancedSettings.envEditor.valuePlaceholder": "Value",
+  "agentDetail.configure.advancedSettings.label": "進階設定",
+  "agentDetail.configure.advancedSettings.toggle": "展開或收合進階設定",
+  "agentDetail.configure.chatFeatures.description": "配置 Web app 和聊天介面的終端使用者聊天體驗。",
+  "agentDetail.configure.chatFeatures.title": "Chat 功能",
+  "agentDetail.configure.files.add": "新增檔案",
+  "agentDetail.configure.files.empty.description": "上傳智能體可讀取的文件，例如規格、範本或指南",
+  "agentDetail.configure.files.empty.title": "暫無檔案",
+  "agentDetail.configure.files.label": "檔案",
+  "agentDetail.configure.files.preview.empty": "暫無預覽內容。",
+  "agentDetail.configure.files.preview.failed": "預覽載入失敗。",
+  "agentDetail.configure.files.preview.unsupported": "此檔案不支援預覽。",
+  "agentDetail.configure.files.remove": "移除 {{name}}",
+  "agentDetail.configure.files.tip": "此智能體在編排任務時可使用的檔案。",
+  "agentDetail.configure.files.toggle": "展開或收合檔案",
+  "agentDetail.configure.files.treeLabel": "智能體檔案",
+  "agentDetail.configure.files.upload.action": "上傳",
+  "agentDetail.configure.files.upload.browse": "選擇",
+  "agentDetail.configure.files.upload.description": "為此智能體上傳檔案。",
+  "agentDetail.configure.files.upload.dropzone": "拖入檔案，或",
+  "agentDetail.configure.files.upload.failed": "檔案上傳失敗。",
+  "agentDetail.configure.files.upload.fileType": "檔案",
+  "agentDetail.configure.files.upload.invalidFile": "請上傳一個檔案。",
+  "agentDetail.configure.files.upload.success": "檔案已上傳。",
+  "agentDetail.configure.files.upload.title": "上傳檔案",
+  "agentDetail.configure.knowledgeRetrieval.add": "新增知識檢索",
+  "agentDetail.configure.knowledgeRetrieval.defaultName": "Retrieval {{index}}",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.add": "新增知識",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.empty": "點擊「+」按鈕新增知識",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.label": "知識",
+  "agentDetail.configure.knowledgeRetrieval.dialog.knowledge.retrievalSetting": "檢索設定",
+  "agentDetail.configure.knowledgeRetrieval.dialog.learnMore": "了解更多關於知識檢索",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.automatic": "自動",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.conditions": "條件",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.disabled": "停用",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.label": "中繼資料過濾",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.manual": "手動",
+  "agentDetail.configure.knowledgeRetrieval.dialog.metadata.modeLabel": "選擇中繼資料過濾模式",
+  "agentDetail.configure.knowledgeRetrieval.dialog.nameLabel": "知識檢索名稱",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agent": "智能體決定",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.agentDescription": "智能體會根據提示詞和可用上下文自行編寫查詢。無需在此設定。",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.custom": "自訂查詢",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customDescription": "為此檢索來源編寫固定查詢。",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customInputLabel": "自訂查詢文字",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.customPlaceholder": "輸入搜尋查詢",
+  "agentDetail.configure.knowledgeRetrieval.dialog.query.label": "查詢",
+  "agentDetail.configure.knowledgeRetrieval.dialog.title": "知識檢索 · 智能體決定",
+  "agentDetail.configure.knowledgeRetrieval.edit": "編輯 {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.empty.description": "連接智能體回答時可搜尋的知識庫",
+  "agentDetail.configure.knowledgeRetrieval.empty.title": "暫無知識",
+  "agentDetail.configure.knowledgeRetrieval.label": "知識檢索",
+  "agentDetail.configure.knowledgeRetrieval.remove": "刪除 {{name}}",
+  "agentDetail.configure.knowledgeRetrieval.retrievalOne": "Retrieval 1",
+  "agentDetail.configure.knowledgeRetrieval.retrievalTwo": "Retrieval 2",
+  "agentDetail.configure.knowledgeRetrieval.tip": "此智能體在編排任務時可使用的知識檢索來源。",
+  "agentDetail.configure.knowledgeRetrieval.toggle": "展開或收合知識檢索",
+  "agentDetail.configure.model.label": "模型",
+  "agentDetail.configure.orchestrate": "編排",
+  "agentDetail.configure.preview.chatFeatures": "Chat 功能",
+  "agentDetail.configure.preview.empty.defaultAgentName": "智能體",
+  "agentDetail.configure.preview.empty.description": "傳送一則訊息以測試目前草稿。",
+  "agentDetail.configure.preview.empty.noInstructionsDescription": "尚未設定指令，回覆將來自基礎模型。",
+  "agentDetail.configure.preview.endUserAuth": "終端使用者驗證",
+  "agentDetail.configure.preview.restart": "重新開始預覽",
+  "agentDetail.configure.preview.title": "預覽",
+  "agentDetail.configure.prompt.copied": "提示詞已複製",
+  "agentDetail.configure.prompt.copy": "複製提示詞",
+  "agentDetail.configure.prompt.copyFailed": "提示詞複製失敗。",
+  "agentDetail.configure.prompt.insert.label": "插入",
+  "agentDetail.configure.prompt.insert.question": "開始問題",
+  "agentDetail.configure.prompt.insert.reportFile": "輸出報告檔案",
+  "agentDetail.configure.prompt.insert.tenders": "開始招標清單",
+  "agentDetail.configure.prompt.label": "提示詞",
+  "agentDetail.configure.prompt.mention.davidHayes": "David Hayes",
+  "agentDetail.configure.prompt.mention.label": "提及",
+  "agentDetail.configure.prompt.mention.priyaRamanathan": "Priya Ramanathan",
+  "agentDetail.configure.prompt.placeholder": "在此編寫指令，",
+  "agentDetail.configure.prompt.tip": "定義此智能體如何理解輸入、呼叫工具並產生輸出。",
+  "agentDetail.configure.publishBar.draft": "草稿",
+  "agentDetail.configure.publishBar.publishUpdate": "發佈更新",
+  "agentDetail.configure.publishBar.published": "已發佈",
+  "agentDetail.configure.publishBar.publishedAt": "{{time}}發佈",
+  "agentDetail.configure.publishBar.publishing": "發佈中…",
+  "agentDetail.configure.publishBar.saved": "5 分鐘前已儲存",
+  "agentDetail.configure.publishBar.savedAt": "{{time}}已儲存",
+  "agentDetail.configure.publishBar.unpublishedChanges": "有未發佈的變更",
+  "agentDetail.configure.publishBar.upToDate": "已是最新",
+  "agentDetail.configure.publishBar.versionHistory": "開啟版本歷史",
+  "agentDetail.configure.publishImpact.affectedWorkflows": "受影響的工作流程",
+  "agentDetail.configure.publishImpact.cancel": "取消",
+  "agentDetail.configure.publishImpact.descriptionPrefix": "你的智能體出現在",
+  "agentDetail.configure.publishImpact.descriptionSuffix": "中。變更會影響它們。",
+  "agentDetail.configure.publishImpact.fallbackAgentName": "此智能體",
+  "agentDetail.configure.publishImpact.title": "{{action}}到 {{name}}",
+  "agentDetail.configure.publishImpact.workflowCount_one": "{{count}} 個工作流程",
+  "agentDetail.configure.publishImpact.workflowCount_other": "{{count}} 個工作流程",
+  "agentDetail.configure.skills.add": "新增技能",
+  "agentDetail.configure.skills.detail.contentRegion": "技能詳情內容",
+  "agentDetail.configure.skills.detail.fileCount": "{{count}} 個檔案",
+  "agentDetail.configure.skills.detail.fileTreeLabel": "技能檔案",
+  "agentDetail.configure.skills.detail.files": "檔案",
+  "agentDetail.configure.skills.empty.description": "技能為智能體提供工作時可呼叫的可複用專業能力",
+  "agentDetail.configure.skills.empty.title": "暫無技能",
+  "agentDetail.configure.skills.itemType": "技能",
+  "agentDetail.configure.skills.label": "技能",
+  "agentDetail.configure.skills.remove": "移除 {{name}}",
+  "agentDetail.configure.skills.tip": "此智能體在編排任務時可使用的技能。",
+  "agentDetail.configure.skills.toggle": "展開或收合技能",
+  "agentDetail.configure.skills.upload.action": "上傳",
+  "agentDetail.configure.skills.upload.browse": "選擇",
+  "agentDetail.configure.skills.upload.description": "為此智能體上傳 .zip 或 .skill 技能包。",
+  "agentDetail.configure.skills.upload.dropzone": "拖入技能包，或",
+  "agentDetail.configure.skills.upload.failed": "技能上傳失敗。",
+  "agentDetail.configure.skills.upload.fileType": "ZIP / SKILL",
+  "agentDetail.configure.skills.upload.invalidFile": "請上傳 .zip 或 .skill 檔案。",
+  "agentDetail.configure.skills.upload.success": "技能已上傳。",
+  "agentDetail.configure.skills.upload.title": "上傳技能",
+  "agentDetail.configure.tools.add": "新增工具",
+  "agentDetail.configure.tools.addMenu.cliTool.badge": "開發者適用",
+  "agentDetail.configure.tools.addMenu.cliTool.description": "安裝智能體可在沙箱中執行的命令列程式。需要安裝命令，通常還需要 API Key。",
+  "agentDetail.configure.tools.addMenu.cliTool.label": "CLI 工具",
+  "agentDetail.configure.tools.addMenu.tool.description": "選擇工作區中已有的工具，例如 Web 搜尋或整合。",
+  "agentDetail.configure.tools.addMenu.tool.label": "工具",
+  "agentDetail.configure.tools.cliDialog.description": "從任意套件登錄安裝 CLI 工具。智能體會獲得執行該二進位檔案的 shell 存取能力。",
+  "agentDetail.configure.tools.cliDialog.editTitle": "編輯 CLI 工具",
+  "agentDetail.configure.tools.cliDialog.env.description": "儲存此 CLI 工具所需的 API Key、Token 或密鑰。值會靜態加密，並在智能體呼叫工具時作為環境變數注入。",
+  "agentDetail.configure.tools.cliDialog.env.label": "環境變數",
+  "agentDetail.configure.tools.cliDialog.env.optional": "（選用）",
+  "agentDetail.configure.tools.cliDialog.installCommand.description": "沙箱中執行 · 首次呼叫時執行一次",
+  "agentDetail.configure.tools.cliDialog.installCommand.label": "安裝命令",
+  "agentDetail.configure.tools.cliDialog.installCommand.placeholder": "貼上安裝命令，例如 npm install -g @lark/cli  ·  brew install jq",
+  "agentDetail.configure.tools.cliDialog.installCommand.required": "請輸入安裝命令。",
+  "agentDetail.configure.tools.cliDialog.learnMore": "了解 CLI 工具",
+  "agentDetail.configure.tools.cliDialog.name.label": "CLI 工具名稱",
+  "agentDetail.configure.tools.cliDialog.name.placeholder": "為 CLI 工具命名",
+  "agentDetail.configure.tools.cliDialog.name.required": "請輸入 CLI 工具名稱。",
+  "agentDetail.configure.tools.cliDialog.securityTip": "不會出現在智能體提示詞中；僅在執行時作為 $VAR 注入",
+  "agentDetail.configure.tools.cliDialog.title": "新增 CLI 工具",
+  "agentDetail.configure.tools.cliTool": "CLI 工具",
+  "agentDetail.configure.tools.credential.authOne": "Auth 1",
+  "agentDetail.configure.tools.credential.endUserOAuth": "終端使用者 · OAuth",
+  "agentDetail.configure.tools.editAction": "編輯 {{name}}",
+  "agentDetail.configure.tools.empty.description": "工具讓智能體可以執行操作，例如搜尋網頁或呼叫你的應用程式",
+  "agentDetail.configure.tools.empty.title": "暫無工具",
+  "agentDetail.configure.tools.label": "工具",
+  "agentDetail.configure.tools.moreActions": "{{name}} 的更多操作",
+  "agentDetail.configure.tools.pluginType": "外掛",
+  "agentDetail.configure.tools.preAuthorize": "預先授權",
+  "agentDetail.configure.tools.removeAction": "移除 {{name}}",
+  "agentDetail.configure.tools.removeProvider": "移除所有工具",
+  "agentDetail.configure.tools.tip": "此智能體在編排任務時可呼叫的工具。",
+  "agentDetail.configure.tools.toggle": "展開或收合工具",
+  "agentDetail.configure.tools.toolTabs.all": "全部",
+  "agentDetail.configure.tools.toolTabs.cli": "CLI",
+  "agentDetail.configure.tools.toolTabs.custom": "自訂",
+  "agentDetail.configure.tools.toolTabs.mcp": "MCP",
+  "agentDetail.configure.tools.toolTabs.plugins": "外掛",
+  "agentDetail.configure.tools.toolTabs.workflow": "Workflow",
+  "agentDetail.documentTitle": "智能體",
+  "agentDetail.history": "歷史記錄",
+  "agentDetail.logs.description": "完整日誌記錄應用程式執行狀態，包括使用者輸入、智能體回覆、規劃和工具使用。",
+  "agentDetail.logs.empty": "暫無日誌",
+  "agentDetail.logs.filters.period.allTime": "全部時間",
+  "agentDetail.logs.filters.period.label": "日誌時間範圍",
+  "agentDetail.logs.filters.period.last30days": "最近 30 天",
+  "agentDetail.logs.filters.period.last7days": "最近 7 天",
+  "agentDetail.logs.filters.search.label": "搜尋日誌",
+  "agentDetail.logs.filters.search.placeholder": "搜尋",
+  "agentDetail.logs.filters.sort.lastCreatedTime": "最近建立時間",
+  "agentDetail.logs.filters.sort.lastUpdatedTime": "最近更新時間",
+  "agentDetail.logs.filters.source.all": "來源",
+  "agentDetail.logs.filters.source.empty": "沒有找到來源",
+  "agentDetail.logs.filters.source.label": "日誌來源",
+  "agentDetail.logs.filters.source.loadFailed": "來源載入失敗",
+  "agentDetail.logs.filters.source.loading": "來源載入中…",
+  "agentDetail.logs.filters.source.searchLabel": "搜尋來源",
+  "agentDetail.logs.filters.source.searchPlaceholder": "搜尋",
+  "agentDetail.logs.filters.source.webapp": "Webapp",
+  "agentDetail.logs.filters.source.workflow": "工作流程",
+  "agentDetail.logs.learnMore": "了解更多",
+  "agentDetail.logs.loadFailed": "日誌載入失敗",
+  "agentDetail.logs.loading": "日誌載入中…",
+  "agentDetail.logs.notAvailable": "無",
+  "agentDetail.logs.table.createdTime": "建立時間",
+  "agentDetail.logs.table.endUser": "終端使用者",
+  "agentDetail.logs.table.messageCount": "訊息數",
+  "agentDetail.logs.table.operationRate": "操作率",
+  "agentDetail.logs.table.source": "來源",
+  "agentDetail.logs.table.title": "標題",
+  "agentDetail.logs.table.unread": "未讀",
+  "agentDetail.logs.table.updatedTime": "更新時間",
+  "agentDetail.logs.table.userRate": "使用者評分",
+  "agentDetail.logs.title": "日誌",
+  "agentDetail.memorySettings.budgetLabel": "記憶預算",
+  "agentDetail.memorySettings.description": "目前活躍設定快照中的記憶設定。",
+  "agentDetail.memorySettings.export.description": "記憶匯出將在後續版本開放。",
+  "agentDetail.memorySettings.export.download": "下載",
+  "agentDetail.memorySettings.export.soon": "即將推出",
+  "agentDetail.memorySettings.export.title": "匯出目前記憶",
+  "agentDetail.memorySettings.notConfigured": "未設定",
+  "agentDetail.memorySettings.scopeLabel": "記憶範圍",
+  "agentDetail.memorySettings.title": "記憶",
+  "agentDetail.metadata.activeVersionLabel": "活躍版本",
+  "agentDetail.metadata.appIdLabel": "應用 ID",
+  "agentDetail.metadata.description": "智能體後端返回的唯讀 Roster 欄位。",
+  "agentDetail.metadata.emptyValue": "暫無",
+  "agentDetail.metadata.scopeLabel": "範圍",
+  "agentDetail.metadata.scopes.roster": "Roster",
+  "agentDetail.metadata.scopes.workflow_only": "僅工作流程",
+  "agentDetail.metadata.sourceLabel": "來源",
+  "agentDetail.metadata.statusLabel": "狀態",
+  "agentDetail.metadata.title": "中繼資料",
+  "agentDetail.metadata.updatedAtLabel": "更新時間",
+  "agentDetail.metadata.workflowIdLabel": "工作流程 ID",
+  "agentDetail.metadata.workflowNodeIdLabel": "工作流程節點 ID",
+  "agentDetail.monitoring.change": "較上一週期 {{value}}",
+  "agentDetail.monitoring.dateRangeLabel": "日期範圍",
+  "agentDetail.monitoring.description": "追蹤可複用智能體在工作流程中的活躍度、成本和互動品質。",
+  "agentDetail.monitoring.learnMore": "了解更多",
+  "agentDetail.monitoring.metrics.activeUsers.explanation": "觸發過使用此智能體的工作流程的獨立終端使用者數。",
+  "agentDetail.monitoring.metrics.activeUsers.title": "活躍使用者",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "此存取入口下使用者與智能體的連續溝通次數。",
+  "agentDetail.monitoring.metrics.avgSessionInteractions.title": "平均工作階段互動數",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.explanation": "從請求開始到輸出完成期間的平均輸出速度。",
+  "agentDetail.monitoring.metrics.tokenOutputSpeed.title": "Token 輸出速度",
+  "agentDetail.monitoring.metrics.tokenUsage.explanation": "此智能體在工作流程執行中產生的預估 token 成本。",
+  "agentDetail.monitoring.metrics.tokenUsage.title": "Token 用量",
+  "agentDetail.monitoring.metrics.totalConversations.explanation": "透過所選存取入口觸達此智能體的每日 AI 會話數。",
+  "agentDetail.monitoring.metrics.totalConversations.title": "全部會話數",
+  "agentDetail.monitoring.metrics.totalMessages.explanation": "每日智能體互動總次數。",
+  "agentDetail.monitoring.metrics.totalMessages.title": "全部訊息數",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.explanation": "每 1,000 條訊息的按讚數，反映使用者滿意度。",
+  "agentDetail.monitoring.metrics.userSatisfactionRate.title": "使用者滿意度",
+  "agentDetail.monitoring.pickSource": "選擇應用",
+  "agentDetail.monitoring.sourceLabel": "應用",
+  "agentDetail.monitoring.sourceTrigger": "來源 {{name}}",
+  "agentDetail.monitoring.sources.all": "全部",
+  "agentDetail.monitoring.timeRangeLabel": "時間範圍",
+  "agentDetail.monitoring.timeRanges.custom": "自訂",
+  "agentDetail.monitoring.timeRanges.last30days": "最近 30 天",
+  "agentDetail.monitoring.timeRanges.last7days": "最近 7 天",
+  "agentDetail.monitoring.timeRanges.today": "今天",
+  "agentDetail.monitoring.title": "監控",
+  "agentDetail.monitoring.tokenUsageConsumed": "消耗 Tokens",
+  "agentDetail.monitoring.units.tokenPerSecond": "Token/秒",
+  "agentDetail.navigationLabel": "智能體導覽",
+  "agentDetail.publish": "發佈",
+  "agentDetail.publishSoon": "即將推出",
+  "agentDetail.sections.access": "存取點",
+  "agentDetail.sections.configure": "編排",
+  "agentDetail.sections.logs": "日誌",
+  "agentDetail.sections.monitoring": "監控",
+  "agentDetail.subtitle": "智能體 ID：{{agentId}}",
+  "agentDetail.title": "智能體",
+  "agentDetail.type": "智能體",
+  "agentDetail.versionHistory.active": "目前",
+  "agentDetail.versionHistory.empty": "暫無版本",
+  "agentDetail.versionHistory.filter": "篩選版本",
+  "agentDetail.versionHistory.versionName": "版本 {{version}}",
+  "roster.createAgent": "建立智能體",
+  "roster.createAgentOptions": "建立智能體選項",
+  "roster.createDialog.description": "在目前工作區 Roster 中建立一個可複用智能體。",
+  "roster.createDialog.title": "建立智能體",
+  "roster.createForm.changeIcon": "更換智能體圖示",
+  "roster.createForm.descriptionLabel": "描述",
+  "roster.createForm.descriptionOptional": "（選用）",
+  "roster.createForm.descriptionPlaceholder": "例如：收集某個主題的來源資料並總結關鍵發現",
+  "roster.createForm.nameLabel": "名稱",
+  "roster.createForm.namePlaceholder": "例如：Max",
+  "roster.createForm.nameRequired": "請輸入名稱。",
+  "roster.createForm.roleLabel": "角色",
+  "roster.createForm.rolePlaceholder": "例如：研究助理",
+  "roster.createForm.roleRequired": "請輸入角色。",
+  "roster.createSuccess": "智能體已建立。",
+  "roster.dateTimeFormat": "YYYY-MM-DD HH:mm:ss",
+  "roster.deleteDialog.description": "此智能體將從目前活躍 Roster 清單中移除。",
+  "roster.deleteDialog.title": "刪除 {{name}}？",
+  "roster.deleteFailed": "智能體刪除失敗。",
+  "roster.deleteSuccess": "智能體已刪除。",
+  "roster.duplicateFailed": "智能體複製失敗。",
+  "roster.duplicateSuccess": "智能體已複製。",
+  "roster.editAgent": "編輯 {{name}}",
+  "roster.editDialog.description": "更新此智能體在 Roster 中的名稱、描述和角色。",
+  "roster.editDialog.title": "編輯智能體",
+  "roster.editInfo": "編輯資訊",
+  "roster.empty": "暫無智能體",
+  "roster.emptyDescription": "儲存在此工作區的智能體會顯示在這裡。",
+  "roster.emptySearch": "沒有符合的智能體",
+  "roster.emptySearchDescription": "請嘗試其他智能體名稱。",
+  "roster.filters.all": "全部",
+  "roster.filters.drafts": "草稿",
+  "roster.filters.label": "智能體篩選",
+  "roster.filters.published": "已發佈",
+  "roster.learnMore": "了解 Agent Roster",
+  "roster.listLabel": "智能體 Roster 清單",
+  "roster.loadMore": "載入更多",
+  "roster.loadingError": "智能體載入失敗。請重新整理後再試。",
+  "roster.moreActions": "{{name}} 的更多操作",
+  "roster.nodeSelector.createInlineFailed": "Inline 智能體建立失敗。請重新整理後再試。",
+  "roster.nodeSelector.dialogLabel": "選擇智能體",
+  "roster.nodeSelector.manageInAgentConsole": "在智能體控制台管理",
+  "roster.nodeSelector.searchPlaceholder": "搜尋…",
+  "roster.nodeSelector.startFromScratch": "從空白開始",
+  "roster.references.label": "使用 {{name}} 的工作流程",
+  "roster.references.trigger": "使用 {{name}} 的工作流程",
+  "roster.searchLabel": "搜尋智能體",
+  "roster.searchPlaceholder": "依名稱搜尋智能體…",
+  "roster.sources.agent_app": "智能體應用",
+  "roster.sources.imported": "已匯入",
+  "roster.sources.system": "系統",
+  "roster.sources.workflow": "工作流程",
+  "roster.status.active": "活躍",
+  "roster.status.archived": "已封存",
+  "roster.tabs.agent": "智能體",
+  "roster.tabs.human": "人工成員",
+  "roster.tabsLabel": "Roster 類型",
+  "roster.updateSuccess": "智能體已更新。",
+  "roster.usageStatus.draft": "草稿"
+}
diff --git a/web/i18n/zh-Hant/app-log.json b/web/i18n/zh-Hant/app-log.json
index 29b21567407..ca1336c9124 100644
--- a/web/i18n/zh-Hant/app-log.json
+++ b/web/i18n/zh-Hant/app-log.json
@@ -42,6 +42,7 @@
   "filter.period.today": "今天",
   "filter.period.yearToDate": "本年至今",
   "filter.sortBy": "排序：",
+  "monitoring.description": "監控記錄應用的執行情況，包括效能、使用者活動和成本。",
   "promptLog": "Prompt 日誌",
   "runDetail.fileListDetail": "細節",
   "runDetail.fileListLabel": "檔詳細資訊",
diff --git a/web/i18n/zh-Hant/app.json b/web/i18n/zh-Hant/app.json
index d2519f8d5e3..b989a327960 100644
--- a/web/i18n/zh-Hant/app.json
+++ b/web/i18n/zh-Hant/app.json
@@ -246,8 +246,8 @@
   "structOutput.structuredTip": "結構化輸出是一項功能，確保模型始終生成符合您提供的 JSON 架構的響應。",
   "studio.allApps": "所有應用",
   "studio.apps": "應用程式",
-  "studio.filters.allCreators": "所有創作者",
-  "studio.filters.creators": "創作者",
+  "studio.filters.allCreators": "所有創建者",
+  "studio.filters.creators": "創建者",
   "studio.filters.reset": "重置",
   "studio.filters.searchCreators": "搜尋創作者...",
   "studio.filters.types": "類型",
diff --git a/web/i18n/zh-Hant/billing.json b/web/i18n/zh-Hant/billing.json
index 75ef4b71172..3f7d579e681 100644
--- a/web/i18n/zh-Hant/billing.json
+++ b/web/i18n/zh-Hant/billing.json
@@ -164,6 +164,8 @@
   "upgrade.uploadMultipleFiles.title": "升級以解鎖批量上傳文件功能",
   "upgrade.uploadMultiplePages.description": "您已達到上傳限制 — 在您目前的方案下，每次只能選擇並上傳一個文件。",
   "upgrade.uploadMultiplePages.title": "升級以一次上傳多個文件",
+  "upgrade.workflowRestore.description": "目前方案不支援還原工作流程版本。",
+  "upgrade.workflowRestore.title": "升級以還原工作流程版本",
   "upgradeBtn.encourage": "立即升級",
   "upgradeBtn.encourageShort": "升級",
   "upgradeBtn.plain": "升級套餐",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 582fdb88de6..ec0a0c86c9c 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -249,15 +249,18 @@
   "mainNav.workspace.sort.openMenu": "排序工作區",
   "mainNav.workspace.switchWorkspace": "切換工作區",
   "mcpPage.description": "連接並管理 MCP 伺服器，讓你的應用可以存取外部工具和服務。",
-  "members.admin": "管理員",
   "members.adminTip": "能夠建立應用程式和管理團隊設定",
+  "members.alreadyInTeam": "已在團隊中",
+  "members.alreadyInTeamTip": "以下使用者已經可以存取此工作區。",
+  "members.assignRoles": "分配角色",
+  "members.assignRolesModal.description": "為該成員選擇要分配的角色，所選角色的權限將被合併。",
+  "members.assignRolesModal.selectedCount": "已選 {{count}} 項",
+  "members.assignRolesModal.title": "分配角色",
   "members.builder": "建築工人",
   "members.builderTip": "可以構建和編輯自己的應用程式",
-  "members.datasetOperator": "知識管理員",
   "members.datasetOperatorTip": "只能管理知識庫",
   "members.deleteMember": "刪除成員",
   "members.disInvite": "取消邀請",
-  "members.editor": "編輯",
   "members.editorTip": "能夠建立並編輯應用程式，不能管理團隊設定",
   "members.email": "郵箱",
   "members.emailInvalid": "郵箱格式無效",
@@ -270,17 +273,40 @@
   "members.invite": "新增",
   "members.inviteTeamMember": "新增團隊成員",
   "members.inviteTeamMemberTip": "對方在登入後可以訪問你的團隊資料。",
-  "members.invitedAsRole": "邀請為{{role}}使用者",
+  "members.invitedAsRole": "邀請為{{role}}",
   "members.lastActive": "上次活動時間",
+  "members.memberActions": "成員操作",
+  "members.memberDetails.assign": "分配",
+  "members.memberDetails.assignedRoles": "已分配角色",
+  "members.memberDetails.customGroup": "自訂",
+  "members.memberDetails.generalGroup": "通用",
+  "members.memberDetails.openAria": "開啟 {{name}} 的成員詳情",
+  "members.memberDetails.permissions.assignRoles": "分配角色",
+  "members.memberDetails.permissions.createApps": "建立應用",
+  "members.memberDetails.permissions.createDatasets": "建立知識庫",
+  "members.memberDetails.permissions.editApps": "編輯應用",
+  "members.memberDetails.permissions.editDatasets": "編輯知識庫",
+  "members.memberDetails.permissions.inviteMembers": "邀請成員",
+  "members.memberDetails.permissions.manageBilling": "管理訂閱",
+  "members.memberDetails.permissions.manageDatasets": "管理知識庫",
+  "members.memberDetails.permissions.removeMembers": "移除成員",
+  "members.memberDetails.permissions.transferOwnership": "轉移所有權",
+  "members.memberDetails.permissions.useApps": "使用應用",
+  "members.memberDetails.permissions.workspaceSettings": "工作空間設定",
+  "members.memberDetails.removeRoleAria": "移除 {{role}} 角色",
+  "members.memberDetails.roleActionsAria": "開啟 {{role}} 角色操作",
+  "members.memberDetails.roleNoPermissionSummary": "目前角色沒有任何權限。",
+  "members.memberDetails.rolePermissionSummary": "{{role}} 可以<permissionList>{{permissions}}</permissionList>",
+  "members.memberDetails.title": "成員詳情",
   "members.name": "姓名",
-  "members.normal": "成員",
+  "members.noNewInvitationsSent": "沒有新的邀請送出",
   "members.normalTip": "只能使用應用程式，不能建立應用程式",
   "members.ok": "好的",
-  "members.owner": "所有者",
   "members.pending": "待定...",
   "members.removeFromTeam": "移出團隊",
   "members.removeFromTeamTip": "將取消團隊訪問",
   "members.role": "角色",
+  "members.selectRole": "請選擇角色",
   "members.sendInvite": "傳送邀請",
   "members.setAdmin": "設為管理員",
   "members.setBuilder": "Set as builder（設置為建構器）",
@@ -311,12 +337,14 @@
   "menus.apps": "工作室",
   "menus.datasets": "知識庫",
   "menus.datasetsTips": "即將到來：上傳自己的長文字資料，或透過 Webhook 集成自己的資料來源",
+  "menus.deployments": "部署",
   "menus.explore": "探索",
   "menus.exploreMarketplace": "探索 Marketplace",
   "menus.newApp": "建立應用",
   "menus.newDataset": "建立知識庫",
   "menus.plugins": "集成",
   "menus.pluginsTips": "集成第三方服務或建立與 ChatGPT 相容的 AI 集成。",
+  "menus.roster": "智能體名冊",
   "menus.status": "beta",
   "menus.tools": "工具",
   "model.addMoreModel": "新增更多模型",
@@ -516,6 +544,7 @@
   "modelProvider.ttsModel.key": "文字轉語音模型",
   "modelProvider.ttsModel.tip": "設定對話中文字轉語音輸出的預設使用模型。",
   "modelProvider.upgradeForLoadBalancing": "升級您的計劃以啟用 Load Balancing。",
+  "navigation.skipToMain": "跳至主要內容",
   "noData": "無資料",
   "operation.add": "新增",
   "operation.added": "已新增",
@@ -552,6 +581,7 @@
   "operation.lineBreak": "換行",
   "operation.log": "日誌",
   "operation.more": "更多",
+  "operation.moreActions": "更多操作",
   "operation.no": "不",
   "operation.noSearchCount": "0 {{content}}",
   "operation.noSearchResults": "未找到 {{content}}",
@@ -600,9 +630,6 @@
   "placeholder.input": "請輸入",
   "placeholder.search": "搜尋...",
   "placeholder.select": "請選擇",
-  "plugin.serpapi.apiKey": "API Key",
-  "plugin.serpapi.apiKeyPlaceholder": "輸入你的 API 金鑰",
-  "plugin.serpapi.keyFrom": "從 SerpAPI 帳戶頁面獲取您的 SerpAPI 金鑰",
   "promptEditor.context.item.desc": "插入上下文模板",
   "promptEditor.context.item.title": "上下文",
   "promptEditor.context.modal.add": "新增上下文",
@@ -665,6 +692,7 @@
   "provider.saveFailed": "API 金鑰儲存失敗",
   "provider.validatedError": "校驗失敗：",
   "provider.validating": "驗證金鑰中...",
+  "settings.ResourceAccess": "訪問權限規則",
   "settings.account": "我的賬戶",
   "settings.accountGroup": "賬戶",
   "settings.agentStrategy": "Agent 策略",
@@ -684,6 +712,9 @@
   "settings.plugin": "集成",
   "settings.preferences": "偏好設定",
   "settings.provider": "模型供應商",
+  "settings.resourceAccess": "訪問權限",
+  "settings.resourceAccessDescription": "配置應用和知識庫可使用的權限規則。權限規則可在具體資源訪問配置中分配給成員。",
+  "settings.rolesAndPermissions": "角色與權限",
   "settings.settings": "設定",
   "settings.swaggerAPIAsTool": "Swagger API 作為工具",
   "settings.trigger": "觸發器",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
new file mode 100644
index 00000000000..a396b0dd230
--- /dev/null
+++ b/web/i18n/zh-Hant/deployments.json
@@ -0,0 +1,623 @@
+{
+  "access.api.backendTitle": "後端服務 API",
+  "access.api.copyCurlExample": "複製 cURL 範例",
+  "access.api.createFailed": "產生 API Token 失敗。",
+  "access.api.createKey": "產生 API Token",
+  "access.api.createKeyTitle": "產生新的 API Token",
+  "access.api.curlExampleTitle": "cURL 範例",
+  "access.api.description": "透過 HTTP 呼叫此部署。每個 API Token 僅對單一環境生效。",
+  "access.api.developerTitle": "開發者 API",
+  "access.api.disabled": "此部署的 API 存取已關閉。",
+  "access.api.disabledHint": "啟用 API 存取後即可產生繫結環境的 Token。",
+  "access.api.dismissToken": "關閉 API Token",
+  "access.api.docs": "API 文件",
+  "access.api.docsClose": "關閉 API 文件",
+  "access.api.docsDescription": "檢視此部署的 Workflow API 參考文件。",
+  "access.api.docsTitle": "Workflow API 文件",
+  "access.api.empty": "請先部署到環境，再簽發 API Token。",
+  "access.api.emptyTitle": "尚無已部署環境",
+  "access.api.endpoint": "請求 URL",
+  "access.api.envPrefix": "env：{{env}}",
+  "access.api.keyList": "API Token 清單",
+  "access.api.nameLabel": "API Token 名稱",
+  "access.api.namePlaceholder": "請輸入 API Token 名稱",
+  "access.api.nameRequired": "請輸入 API Token 名稱。",
+  "access.api.newKey": "產生新的 API Token",
+  "access.api.newTokenDescription": "此 API Token 僅顯示一次，請在離開此頁面前複製保存。",
+  "access.api.newTokenLabel": "API Token",
+  "access.api.newTokenTitle": "API Token 已產生",
+  "access.api.noKeys": "尚無 API Token，請產生一個以開始呼叫 API。",
+  "access.api.noKeysTitle": "尚無 API Token",
+  "access.api.revokeConfirmDescription": "API Token「{{name}}」將立即失效，此操作無法復原。",
+  "access.api.revokeConfirmTitle": "撤銷 API Token？",
+  "access.api.revokeFailed": "撤銷 API Token 失敗。",
+  "access.api.revokeSuccess": "API Token 已撤銷",
+  "access.api.table.action": "操作",
+  "access.api.table.environment": "環境",
+  "access.api.table.key": "API Token",
+  "access.api.table.name": "名稱",
+  "access.api.title": "API",
+  "access.channels.col.channel": "通道",
+  "access.channels.col.endpoint": "進入點",
+  "access.channels.col.status": "狀態",
+  "access.channels.description": "WebApp 與 CLI 進入點將遵循上方的存取權限。",
+  "access.channels.disabled": "此部署的存取通道已關閉。",
+  "access.channels.disabledHint": "啟用存取通道後即可開放 WebApp 與 CLI 進入點。",
+  "access.channels.followPermission": "依權限開放",
+  "access.channels.title": "存取通道",
+  "access.cli.description": "透過 difyctl 在終端機呼叫，適用於腳本、自動化流程或 Agent 整合。",
+  "access.cli.docs": "使用說明",
+  "access.cli.domain": "網域",
+  "access.cli.empty": "尚未設定 CLI 進入點。",
+  "access.cli.install": "安裝 CLI",
+  "access.cli.title": "CLI",
+  "access.copied": "已複製",
+  "access.copy": "複製",
+  "access.copyFailed": "複製失敗",
+  "access.copyToast": "已複製到剪貼簿",
+  "access.hide": "隱藏",
+  "access.members.clearAll": "全部清除",
+  "access.members.empty": "找不到符合的結果。",
+  "access.members.groupCount_one": "{{count}} 個群組",
+  "access.members.groupCount_other": "{{count}} 個群組",
+  "access.members.groups": "群組",
+  "access.members.individuals": "成員",
+  "access.members.memberCount_one": "{{count}} 位成員",
+  "access.members.memberCount_other": "{{count}} 位成員",
+  "access.members.pickPlaceholder": "選擇群組或成員",
+  "access.members.searchPlaceholder": "搜尋群組與成員",
+  "access.members.selectedLabel": "已選擇",
+  "access.permission.anyone": "擁有連結的任何人",
+  "access.permission.anyoneDesc": "任何人皆可存取此部署，無需登入。",
+  "access.permission.memberCount_one": "{{count}} 位成員",
+  "access.permission.memberCount_other": "{{count}} 位成員",
+  "access.permission.organization": "平台內所有成員",
+  "access.permission.organizationDesc": "平台內所有成員",
+  "access.permission.specific": "平台內指定成員",
+  "access.permission.specificDesc": "選擇指定的群組或成員",
+  "access.permission.specificUnavailable": "指定成員選擇暫未啟用，需接入實際平台成員與群組後才能開放。",
+  "access.permission.updateFailed": "更新存取策略失敗。",
+  "access.permissions.col.environment": "環境",
+  "access.permissions.col.permission": "存取範圍",
+  "access.permissions.description": "為各環境的 WebApp 與 CLI 進入點設定存取權限。",
+  "access.permissions.editAriaLabel": "設定 {{environment}} 的存取權限",
+  "access.permissions.editDescription": "設定 WebApp 與 CLI 進入點的存取權限。",
+  "access.permissions.editTitle": "存取權限",
+  "access.permissions.title": "存取權限",
+  "access.revoke": "撤銷",
+  "access.runAccess.description": "管理使用者如何執行此部署，以及在每個環境中誰可以存取。",
+  "access.runAccess.disabled": "此部署的執行存取已關閉。",
+  "access.runAccess.mcp": "MCP",
+  "access.runAccess.mcpDesc": "將此部署作為 Model Context Protocol 伺服器對外提供。",
+  "access.runAccess.mcpEmpty": "尚未設定 MCP 端點。",
+  "access.runAccess.noEnvs": "請先部署到環境後再設定存取權限。",
+  "access.runAccess.noEnvsTitle": "尚無已部署環境",
+  "access.runAccess.openWebapp": "開啟 WebApp",
+  "access.runAccess.permissions": "存取權限",
+  "access.runAccess.permissionsDesc": "每個環境中可以存取此部署的人員。",
+  "access.runAccess.title": "執行存取",
+  "access.runAccess.urlLabel": "URL",
+  "access.runAccess.webapp": "WebApp",
+  "access.runAccess.webappDesc": "面向終端使用者的託管網頁。",
+  "access.runAccess.webappEmpty": "即將推出。",
+  "access.show": "顯示",
+  "backend.RUNTIME_BACKEND_EXTERNAL": "外部",
+  "backend.RUNTIME_BACKEND_K8S": "K8S",
+  "backend.RUNTIME_BACKEND_UNSPECIFIED": "未知",
+  "card.access.api": "API Token",
+  "card.access.apiShort": "API",
+  "card.access.cli": "CLI",
+  "card.access.cliShort": "CLI",
+  "card.access.none": "未開啟存取",
+  "card.access.webApp": "WebApp",
+  "card.access.webAppShort": "Web",
+  "card.createFirstRelease": "建立首個版本",
+  "card.deploy": "部署",
+  "card.deploying": "{{count}} 個部署中",
+  "card.envOverflow": "+ {{count}}",
+  "card.failed": "{{count}} 個失敗",
+  "card.fromApp": "來自 {{name}}",
+  "card.lastDeployed": "上次部署於 {{time}}",
+  "card.menu.delete": "刪除部署",
+  "card.menu.deleteDisabled": "後端託管的部署暫不支援刪除。",
+  "card.menu.deploy": "部署到環境",
+  "card.menu.editInfo": "編輯資訊",
+  "card.menu.viewDetail": "檢視部署詳情",
+  "card.moreActions": "更多操作",
+  "card.neverDeployed": "尚未部署",
+  "card.noDescription": "未提供描述。",
+  "card.notDeployed": "未部署",
+  "card.ready": "{{count}} 個執行中",
+  "card.tooltip.createdAt": "建立時間",
+  "card.tooltip.deployed": "已部署",
+  "card.tooltip.deploymentStatus": "部署狀態",
+  "card.tooltip.notDeployed": "此部署尚未部署到任何環境。",
+  "card.tooltip.notDeployedShort": "未部署",
+  "card.tooltip.release": "版本",
+  "card.tooltip.releaseName": "版本名稱",
+  "card.tooltip.source": "來源",
+  "common.loadFailed": "載入失敗，請稍後再試。",
+  "common.loading": "載入中…",
+  "createGuide.actions.back": "返回",
+  "createGuide.actions.cancel": "取消",
+  "createGuide.actions.continue": "繼續",
+  "createGuide.actions.createAndDeploy": "建立並部署",
+  "createGuide.actions.creating": "建立中…",
+  "createGuide.actions.deploy": "部署",
+  "createGuide.actions.deploying": "建立並部署中…",
+  "createGuide.actions.next": "下一步",
+  "createGuide.actions.skipDeploy": "跳過，稍後再部署",
+  "createGuide.description": "從版本來源、基本資訊與目標環境建立部署。",
+  "createGuide.dsl.defaultAppName": "匯入的 DSL 應用",
+  "createGuide.dsl.description": "上傳 Workflow DSL 套件以建立部署、首個版本，以及選擇性地部署到環境。",
+  "createGuide.dsl.dropDescription": "上傳 Workflow YAML DSL 套件。部署前會從該檔案解析部署選項。",
+  "createGuide.dsl.dropTitle": "上傳 Workflow DSL 套件",
+  "createGuide.dsl.readFailed": "讀取 DSL 檔案失敗。請選擇其他檔案後重試。",
+  "createGuide.dsl.reading": "正在讀取 DSL 檔案…",
+  "createGuide.dsl.title": "匯入 DSL",
+  "createGuide.dsl.unsupportedMode": "僅支援使用 Workflow DSL 檔案建立部署。",
+  "createGuide.errors.createReleaseFailed": "建立部署或版本失敗。",
+  "createGuide.errors.deployFailed": "部署到環境失敗。",
+  "createGuide.method.description": "選擇用於建立首個版本的來源。",
+  "createGuide.methods.bindApp.description": "使用 Studio 中現有的 Workflow App 作為版本來源。",
+  "createGuide.methods.bindApp.title": "繫結現有的 Workflow App",
+  "createGuide.methods.importDsl.description": "上傳 Workflow YAML DSL 套件並繼續完成部署流程。",
+  "createGuide.methods.importDsl.title": "匯入 DSL",
+  "createGuide.methods.mocked": "模擬",
+  "createGuide.nav.back": "部署",
+  "createGuide.release.defaultName": "初始版本",
+  "createGuide.release.deployInfo": "部署資訊",
+  "createGuide.release.description": "填寫部署資訊及首個版本詳細資料。",
+  "createGuide.release.firstVersion": "首個版本",
+  "createGuide.release.instanceDescription": "部署描述",
+  "createGuide.release.instanceDescriptionPlaceholder": "描述此部署的用途",
+  "createGuide.release.instanceName": "部署名稱",
+  "createGuide.release.instanceNameConflict": "此部署名稱已存在，請另選名稱。",
+  "createGuide.release.releaseDescription": "版本描述",
+  "createGuide.release.releaseDescriptionPlaceholder": "描述此版本",
+  "createGuide.release.releaseName": "版本名稱",
+  "createGuide.release.releaseNote": "版本描述",
+  "createGuide.release.title": "基本資訊",
+  "createGuide.source.availableApps_one": "{{count}} 個應用",
+  "createGuide.source.availableApps_other": "{{count}} 個應用",
+  "createGuide.source.clearSearch": "清除應用搜尋",
+  "createGuide.source.description": "選擇用於建立首個版本的來源。",
+  "createGuide.source.empty": "找不到 Workflow App。",
+  "createGuide.source.searchPlaceholder": "搜尋應用",
+  "createGuide.source.sourceApp": "Workflow App",
+  "createGuide.source.title": "版本來源",
+  "createGuide.steps.method": "版本來源",
+  "createGuide.steps.release": "基本資訊",
+  "createGuide.steps.source": "版本來源",
+  "createGuide.steps.target": "部署到環境",
+  "createGuide.target.bindingCount_one": "{{count}} 項繫結",
+  "createGuide.target.bindingCount_other": "{{count}} 項繫結",
+  "createGuide.target.bindingHint": "選擇此版本要使用的憑證。",
+  "createGuide.target.bindings": "憑證",
+  "createGuide.target.deferredBindingHint": "憑證將在最終部署時依據實際部署計畫解析。",
+  "createGuide.target.deferredEnvironmentHint": "建立部署與版本之後，名稱會與實際環境進行比對。",
+  "createGuide.target.description": "選擇目標環境，並提供此版本在該環境所需的執行階段設定。此步驟可跳過。",
+  "createGuide.target.envVarCount_one": "{{count}} 項變數",
+  "createGuide.target.envVarCount_other": "{{count}} 項變數",
+  "createGuide.target.envVarHint": "為此版本所需的每個環境變數輸入自訂值，或使用應用中定義的值。",
+  "createGuide.target.envVarPlaceholder": "輸入值",
+  "createGuide.target.envVarSource.ariaLabel": "選擇 {{key}} 的變數值來源",
+  "createGuide.target.envVarSource.default": "應用中的值",
+  "createGuide.target.envVarSource.lastDeployment": "上次部署值",
+  "createGuide.target.envVarSource.literal": "自訂值",
+  "createGuide.target.envVarType.number": "數字",
+  "createGuide.target.envVarType.secret": "機密",
+  "createGuide.target.envVarType.string": "字串",
+  "createGuide.target.envVars": "環境變數",
+  "createGuide.target.environment": "目標環境",
+  "createGuide.target.environmentName": "環境名稱",
+  "createGuide.target.environmentNamePlaceholder": "Production",
+  "createGuide.target.loadBindingsFailed": "載入憑證失敗。",
+  "createGuide.target.loadEnvironmentsFailed": "載入部署環境失敗。",
+  "createGuide.target.missingRequiredBinding": "請為此必要繫結選擇憑證。",
+  "createGuide.target.noBindingRequired": "無需憑證。",
+  "createGuide.target.noCredentialCandidates": "沒有可用的憑證。",
+  "createGuide.target.noEnvironmentOptions": "沒有可用的部署環境。",
+  "createGuide.target.required": "必填",
+  "createGuide.target.selectCredential": "選擇憑證",
+  "createGuide.target.title": "部署到環境",
+  "createGuide.title": "新建部署",
+  "createModal.appPickerPlaceholder": "選擇 Workflow App",
+  "createModal.appSearchEmpty": "沒有符合的 Workflow App",
+  "createModal.appSearchPlaceholder": "搜尋 Workflow App…",
+  "createModal.cancel": "取消",
+  "createModal.create": "建立",
+  "createModal.createFailed": "建立部署失敗。",
+  "createModal.description": "選擇 Workflow App 並建立部署。",
+  "createModal.descriptionLabel": "描述",
+  "createModal.descriptionPlaceholder": "描述此部署的用途",
+  "createModal.loadMoreApps": "載入更多應用",
+  "createModal.loadingApps": "正在載入應用…",
+  "createModal.nameLabel": "部署名稱",
+  "createModal.namePlaceholder": "部署名稱",
+  "createModal.noApps": "此工作區中找不到 Workflow App，請先在 Studio 中建立。",
+  "createModal.selected": "已選擇",
+  "createModal.sourceApp": "Workflow App（必填）",
+  "createModal.title": "新建部署",
+  "deployDrawer.bindingCount_one": "{{count}} 項繫結",
+  "deployDrawer.bindingCount_other": "{{count}} 項繫結",
+  "deployDrawer.bindingOptionsFailed": "載入憑證選項失敗。",
+  "deployDrawer.bindingSelectionHint": "選擇此次部署要使用的憑證。",
+  "deployDrawer.bindingsDisabled": "由版本預覽解析而來，目前尚不支援編輯。",
+  "deployDrawer.cancel": "取消",
+  "deployDrawer.close": "關閉部署抽屜",
+  "deployDrawer.defaultSelect": "選擇…",
+  "deployDrawer.deploy": "部署到環境",
+  "deployDrawer.deployExistingRelease": "部署到環境",
+  "deployDrawer.deployExistingReleaseDescription": "選擇版本和目標環境以完成部署。",
+  "deployDrawer.deployExistingReleaseTitle": "部署到環境",
+  "deployDrawer.deployFailed": "啟動部署失敗。",
+  "deployDrawer.deploying": "部署中…",
+  "deployDrawer.description": "選擇版本和目標環境以完成部署。",
+  "deployDrawer.envVarCount_one": "{{count}} 項變數",
+  "deployDrawer.envVarCount_other": "{{count}} 項變數",
+  "deployDrawer.envVarHint": "為此版本所需的每個環境變數輸入自訂值，或使用應用中定義的值。",
+  "deployDrawer.envVarPlaceholder": "輸入值",
+  "deployDrawer.envVarSource.ariaLabel": "選擇 {{key}} 的變數值來源",
+  "deployDrawer.envVarSource.default": "應用中的值",
+  "deployDrawer.envVarSource.lastDeployment": "上次部署值",
+  "deployDrawer.envVarSource.literal": "自訂值",
+  "deployDrawer.envVarType.number": "數字",
+  "deployDrawer.envVarType.secret": "機密",
+  "deployDrawer.envVarType.string": "字串",
+  "deployDrawer.envVars": "環境變數",
+  "deployDrawer.existingReleaseHint": "此版本將原樣部署，不會建立新版本。",
+  "deployDrawer.loadingBindings": "解析中…",
+  "deployDrawer.lockedHint": "已鎖定至目前環境",
+  "deployDrawer.missingRequiredBinding": "請為此必要繫結選擇憑證。",
+  "deployDrawer.missingRequiredEnvVar": "請為此必填環境變數輸入值。",
+  "deployDrawer.modelCreds": "模型憑證",
+  "deployDrawer.needsValidation": "（需要驗證）",
+  "deployDrawer.newReleaseHint": "將會根據所選的 Workflow App YAML 建立新版本。",
+  "deployDrawer.noBindingRequired": "非必要",
+  "deployDrawer.noCredentialCandidates": "沒有可用的憑證。",
+  "deployDrawer.noNewEnvironmentAvailable": "所有可用的環境都已有部署。",
+  "deployDrawer.noOtherReleaseAvailable": "此環境沒有其他可用的版本。",
+  "deployDrawer.noReleaseAvailable": "請先建立版本，再部署到環境。",
+  "deployDrawer.notFound": "找不到部署。",
+  "deployDrawer.noteLabel": "版本描述（選填）",
+  "deployDrawer.notePlaceholder": "例如：優化引導文案",
+  "deployDrawer.pluginCreds": "外掛憑證",
+  "deployDrawer.promote": "部署",
+  "deployDrawer.promoteDescription": "選擇版本和目標環境以完成部署。",
+  "deployDrawer.promoteTitle": "部署到環境",
+  "deployDrawer.readOnly": "唯讀",
+  "deployDrawer.redeploy": "部署到環境",
+  "deployDrawer.redeployDescription": "選擇版本和目標環境以完成部署。",
+  "deployDrawer.redeployExistingReleaseHint": "將會重新部署目前版本，不會建立新版本。",
+  "deployDrawer.redeployTitle": "部署到環境",
+  "deployDrawer.releaseLabel": "版本",
+  "deployDrawer.requiredBinding": "必填",
+  "deployDrawer.rollback": "部署",
+  "deployDrawer.rollbackDescription": "選擇版本和目標環境以完成部署。",
+  "deployDrawer.rollbackTitle": "部署到環境",
+  "deployDrawer.runtimeCredentials": "憑證",
+  "deployDrawer.secretPlaceholder": "機密值",
+  "deployDrawer.selectCredential": "選擇憑證",
+  "deployDrawer.selectEnv": "選擇一個環境",
+  "deployDrawer.selectProviderCred": "選擇 {{provider}} 憑證",
+  "deployDrawer.selectProviderKey": "選擇 {{provider}} 金鑰",
+  "deployDrawer.selectRelease": "選擇一個版本",
+  "deployDrawer.targetEnv": "目標環境",
+  "deployDrawer.title": "部署到環境",
+  "deployDrawer.valuePlaceholder": "值",
+  "deployTab.cancelDeployment": "取消部署",
+  "deployTab.closeError": "關閉",
+  "deployTab.col.actions": "操作",
+  "deployTab.col.currentRelease": "目前版本",
+  "deployTab.col.environment": "環境",
+  "deployTab.col.status": "狀態",
+  "deployTab.col.updated": "更新時間",
+  "deployTab.collapseDetails": "收合部署詳情",
+  "deployTab.confirmUndeploy": "下線",
+  "deployTab.deployOtherVersion": "部署其他版本",
+  "deployTab.deployToEnv": "部署到 {{name}}",
+  "deployTab.deployToNewEnv": "部署到新環境…",
+  "deployTab.empty": "尚無實例。部署到新環境以開始使用。",
+  "deployTab.emptyDescription": "選擇版本和目標環境，讓使用者可以使用此部署。",
+  "deployTab.emptyTitle": "尚無執行中的環境",
+  "deployTab.envCount": "環境",
+  "deployTab.errorCode": "錯誤碼",
+  "deployTab.errorDialogDesc": "重試或部署其他版本前，請先檢視上次失敗的部署原因。",
+  "deployTab.errorDialogTitle": "{{name}} 的部署錯誤",
+  "deployTab.errorMessage": "訊息",
+  "deployTab.errorPhase": "階段",
+  "deployTab.expandDetails": "展開部署詳情",
+  "deployTab.moreActions": "更多操作",
+  "deployTab.newDeployment": "部署到新環境",
+  "deployTab.panel.commit": "Commit ID",
+  "deployTab.panel.deploymentId": "部署 ID",
+  "deployTab.panel.endpoints": "端點",
+  "deployTab.panel.envVars": "環境變數",
+  "deployTab.panel.error": "錯誤",
+  "deployTab.panel.failedRelease": "失敗版本",
+  "deployTab.panel.health": "健康狀態",
+  "deployTab.panel.instanceInfo": "實例資訊",
+  "deployTab.panel.modelCreds": "模型憑證",
+  "deployTab.panel.pluginCreds": "外掛憑證",
+  "deployTab.panel.release": "版本",
+  "deployTab.panel.releaseCreatedAt": "版本建立時間",
+  "deployTab.panel.releaseInfo": "版本資訊",
+  "deployTab.panel.replicas": "副本數",
+  "deployTab.panel.run": "執行",
+  "deployTab.panel.runtimeBindings": "憑證",
+  "deployTab.panel.runtimeInfo": "執行階段資訊",
+  "deployTab.panel.runtimeMode": "執行階段模式",
+  "deployTab.panel.runtimeNote": "執行階段備註",
+  "deployTab.panel.targetRelease": "目標版本",
+  "deployTab.panel.unknownError": "部署失敗。",
+  "deployTab.promote": "部署",
+  "deployTab.redeploy": "重新部署",
+  "deployTab.releaseCreatedAt": "版本建立於 {{time}}",
+  "deployTab.retry": "重試",
+  "deployTab.shortcut": "捷徑",
+  "deployTab.status.deployFailed": "部署失敗",
+  "deployTab.status.deployingRelease": "部署中（{{release}}）",
+  "deployTab.status.runningOutOfSync": "執行中（待同步）",
+  "deployTab.status.runningWithFailed": "執行中（上次部署失敗）",
+  "deployTab.undeploy": "下線",
+  "deployTab.undeployConfirmDesc": "終端使用者存取將立即停止。版本之後仍可重新部署。",
+  "deployTab.undeployConfirmTitle": "從 {{name}} 下線？",
+  "deployTab.undeployFrom": "從 {{name}} 下線",
+  "deployTab.undeployImpactTitle": "受影響的實例",
+  "deployTab.viewError": "檢視錯誤",
+  "deployTab.viewLogs": "檢視日誌",
+  "deployTab.viewProgress": "檢視進度",
+  "detail.backToInstances": "返回部署",
+  "detail.deployingCount": "{{count}} 個部署中",
+  "detail.envCount_one": "{{count}} 個環境",
+  "detail.envCount_other": "{{count}} 個環境",
+  "detail.failedCount": "{{count}} 個失敗",
+  "detail.mobileTabs": "部署頁面",
+  "detail.notFound": "找不到部署",
+  "detail.openSourceApp": "開啟來源 {{name}}",
+  "detail.sourceApp": "來源",
+  "detail.sourceAppLink": "來源",
+  "documentTitle.create": "新建部署 · 部署",
+  "documentTitle.detail": "部署 · 部署",
+  "documentTitle.list": "部署",
+  "filter.allEnvs": "所有環境",
+  "filter.notDeployed": "未部署",
+  "filter.searchPlaceholder": "搜尋部署",
+  "health.ENVIRONMENT_STATUS_ADMISSION": "准入中",
+  "health.ENVIRONMENT_STATUS_BOOTSTRAPPING": "啟動中",
+  "health.ENVIRONMENT_STATUS_DELETING": "刪除中",
+  "health.ENVIRONMENT_STATUS_FAILED": "不可用",
+  "health.ENVIRONMENT_STATUS_READY": "可用",
+  "health.ENVIRONMENT_STATUS_UNSPECIFIED": "未知",
+  "list.clearFilters": "清除篩選",
+  "list.clearSearch": "清除部署搜尋",
+  "list.createDeployment": "新建",
+  "list.empty": "找不到部署。",
+  "list.emptyDescription": "從 Workflow App 或 Workflow DSL 套件建立部署後，即可管理版本、環境與存取權限。",
+  "list.emptyFilteredDescription": "目前的搜尋或環境篩選下沒有符合的部署。",
+  "list.emptyFilteredTitle": "沒有符合的部署",
+  "list.emptyTitle": "尚無部署",
+  "mode.ENVIRONMENT_MODE_ISOLATED": "獨立",
+  "mode.ENVIRONMENT_MODE_SHARED": "共用",
+  "mode.ENVIRONMENT_MODE_UNSPECIFIED": "未知",
+  "newInstance.comingSoon": "即將推出",
+  "newInstance.fromStudio": "從 Studio 選擇",
+  "newInstance.importDSL": "匯入 DSL",
+  "newInstance.title": "新建部署",
+  "overview.accessEndpoints": "存取端點",
+  "overview.accessMeta.apiTokens": "管理 API Token",
+  "overview.accessMeta.cli": "檢視 CLI 存取方式",
+  "overview.accessMeta.webApp": "管理 WebApp 存取",
+  "overview.accessStatus": "存取",
+  "overview.api": "API Token",
+  "overview.apiKeysCount_one": "{{count}} 個 API Token",
+  "overview.apiKeysCount_other": "{{count}} 個 API Token",
+  "overview.apiTokenSummary.environments_one": "{{count}} 個已部署環境",
+  "overview.apiTokenSummary.environments_other": "{{count}} 個已部署環境",
+  "overview.availableForDeployment": "可部署",
+  "overview.basicInfo": "基本資訊",
+  "overview.cardAction.deployLatest": "部署最新版本",
+  "overview.cardAction.redeploy": "重新部署",
+  "overview.cardAction.viewProgress": "檢視部署",
+  "overview.chip.behindTooltip_one": "落後最新版本 1 個，請部署最新版本以更新。",
+  "overview.chip.behindTooltip_other": "落後最新版本 {{count}} 個，請部署最新版本以更新。",
+  "overview.chip.behind_one": "↑ 1",
+  "overview.chip.behind_other": "↑ {{count}}",
+  "overview.chip.deploying": "部署中",
+  "overview.chip.deployingTooltip": "部署正在進行中。",
+  "overview.chip.empty": "空",
+  "overview.chip.emptyTooltip": "此環境尚未部署任何版本。",
+  "overview.chip.failed": "失敗",
+  "overview.chip.failedTooltip": "最近一次部署嘗試失敗。",
+  "overview.chip.latest": "最新",
+  "overview.chip.latestTooltip": "此環境正在執行最新版本。",
+  "overview.chip.needsReleaseFirst": "請先建立版本",
+  "overview.chip.olderRelease": "較舊",
+  "overview.chip.olderReleaseTooltip": "此環境正在執行較舊的版本。",
+  "overview.chip.openInDeployTab": "檢視部署進度",
+  "overview.cli": "CLI",
+  "overview.configured": "已設定",
+  "overview.createRelease": "建立版本",
+  "overview.created": "建立時間",
+  "overview.deploy": "部署",
+  "overview.deployedEnvironments": "已部署",
+  "overview.deploymentOverview": "部署總覽",
+  "overview.deploymentStatus": "部署狀態",
+  "overview.description": "描述",
+  "overview.developerApi": "開發者 API",
+  "overview.disabled": "已停用",
+  "overview.emptyValue": "未設定",
+  "overview.enabled": "已啟用",
+  "overview.enabledChannels": "存取已啟用",
+  "overview.endUserAccess": "終端使用者存取",
+  "overview.environments": "環境",
+  "overview.hero.byName": "由 {{name}} 建立",
+  "overview.hero.empty": "尚無版本",
+  "overview.hero.emptyDescription": "請先從目前來源建立版本，再進行部署。",
+  "overview.hero.propagation_one": "已部署到 {{total}} 個環境中的 {{count}} 個",
+  "overview.hero.propagation_other": "已部署到 {{total}} 個環境中的 {{count}} 個",
+  "overview.hero.untargeted": "尚未設定環境",
+  "overview.instanceDetails": "部署詳情",
+  "overview.instanceId": "部署 ID",
+  "overview.latestRelease.releaseCount_one": "共 {{count}} 個版本",
+  "overview.latestRelease.releaseCount_other": "共 {{count}} 個版本",
+  "overview.latestReleaseTitle": "最新版本",
+  "overview.manageDeployments": "管理部署",
+  "overview.name": "名稱",
+  "overview.noAccessConfig": "未設定存取方式。",
+  "overview.noReleaseYet": "請先建立版本，再部署到環境。",
+  "overview.notConfigured": "未設定",
+  "overview.previousReleases.empty": "尚無更早的版本。",
+  "overview.previousReleases.retired": "目前未部署",
+  "overview.previousReleases.title": "歷史版本",
+  "overview.previousReleases.viewAll": "檢視全部",
+  "overview.ready": "可部署",
+  "overview.recentReleases": "近期版本",
+  "overview.releaseDeployedTitle": "{{release}} 已部署",
+  "overview.releaseReadyTitle": "{{release}} 已可部署",
+  "overview.serviceMap": "服務地圖",
+  "overview.servingRelease": "正在執行 {{release}}",
+  "overview.servingReleaseDescription": "此部署已部署到 {{count}}/{{total}} 個環境。",
+  "overview.strip.deployToNewEnvironment": "部署到新環境",
+  "overview.strip.empty": "尚未設定任何環境。",
+  "overview.strip.emptyDeployableDescription": "準備好之後，可將最新版本部署到環境。",
+  "overview.strip.emptyDeployed": "尚無實例。",
+  "overview.strip.emptyDescription": "請先建立版本，再部署到環境。",
+  "overview.strip.emptyTitle": "尚無實例",
+  "overview.strip.summary_one": "{{total}} 個環境中 1 個執行最新版本",
+  "overview.strip.summary_other": "{{total}} 個環境中 {{count}} 個執行最新版本",
+  "overview.strip.title": "實例",
+  "overview.switchSourceApp": "切換來源",
+  "overview.switchSourceAppDescription": "選擇後續新建版本使用的 Workflow App 來源。",
+  "overview.switchSourceAppHint": "切換後，僅新建立的版本會使用新來源；歷史版本和現有部署不受影響。",
+  "overview.targetRelease": "目標版本",
+  "overview.webapp": "WebApp",
+  "settings.danger": "危險區域",
+  "settings.dangerDesc": "永久刪除此部署並停止所有執行中的實例。此操作無法復原。",
+  "settings.delete": "刪除部署",
+  "settings.deleteConfirmDesc": "確定刪除 {{name}}？所有實例將停止執行，並從所有環境中移除。此操作無法復原。",
+  "settings.deleteConfirmTitle": "刪除部署",
+  "settings.deleteFailed": "刪除部署失敗。",
+  "settings.deleteImpact": "影響",
+  "settings.deleteImpactInstance": "部署",
+  "settings.deleteImpactTitle": "受影響的部署",
+  "settings.deleteImpactValue": "此部署會從部署清單中移除。",
+  "settings.deleted": "部署已刪除",
+  "settings.description": "描述",
+  "settings.descriptionHelp": "管理此部署的名稱、描述與其他設定。",
+  "settings.general": "一般",
+  "settings.name": "部署名稱",
+  "settings.reset": "重設",
+  "settings.save": "儲存變更",
+  "settings.updateFailed": "更新部署失敗。",
+  "settings.updated": "部署已更新",
+  "status.RUNTIME_INSTANCE_STATUS_DEPLOYING": "部署中",
+  "status.RUNTIME_INSTANCE_STATUS_DRIFTED": "待同步",
+  "status.RUNTIME_INSTANCE_STATUS_FAILED": "部署失敗",
+  "status.RUNTIME_INSTANCE_STATUS_INVALID": "異常",
+  "status.RUNTIME_INSTANCE_STATUS_READY": "執行中",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
+  "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下線中",
+  "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
+  "subtitle": "跨環境管理部署。",
+  "tabs.access.description": "管理存取通道與存取權限。",
+  "tabs.access.name": "存取",
+  "tabs.api-tokens.description": "管理 API Token，並透過 HTTP 呼叫各環境中的實例。",
+  "tabs.api-tokens.name": "API Token",
+  "tabs.instances.description": "檢視並管理各環境中的實例。",
+  "tabs.instances.name": "實例",
+  "tabs.overview.description": "檢視此部署在各環境中的狀態。",
+  "tabs.overview.name": "總覽",
+  "tabs.releases.description": "建立、部署與管理版本。",
+  "tabs.releases.name": "版本",
+  "tabs.settings.description": "管理此部署的名稱、描述與其他設定。",
+  "tabs.settings.name": "設定",
+  "title": "部署",
+  "unsupportedDslNodes.description": "此版本包含部署執行階段尚未支援的節點。請在 Studio 中移除或替換後重試。",
+  "unsupportedDslNodes.descriptionWithTypes": "此版本包含部署執行階段尚未支援的節點：{{nodeTypes}}。請在 Studio 中移除或替換後重試。",
+  "unsupportedDslNodes.title": "不支援的節點",
+  "unsupportedDslNodes.unknownType": "未知類型",
+  "versions.cancelCreate": "取消",
+  "versions.cancelDelete": "取消",
+  "versions.cancelEdit": "取消",
+  "versions.checkingReleaseContent": "正在檢查版本內容…",
+  "versions.col.action": "操作",
+  "versions.col.author": "建立者",
+  "versions.col.commit": "Commit",
+  "versions.col.createdAt": "建立時間",
+  "versions.col.deployedTo": "已部署到",
+  "versions.col.release": "版本",
+  "versions.col.sourceApp": "來源",
+  "versions.commitTooltip": "Commit {{commit}}",
+  "versions.create": "建立",
+  "versions.createFailed": "建立版本失敗。",
+  "versions.createRelease": "建立版本",
+  "versions.createReleaseDescription": "從 Workflow App 或 Workflow DSL 檔案建立可部署的版本。",
+  "versions.createReleaseHint": "新版本可部署到任意環境。",
+  "versions.createSuccess": "版本「{{name}}」已建立。",
+  "versions.creating": "建立中…",
+  "versions.currentOn": "{{name}} 的目前版本",
+  "versions.deleteConfirmDesc": "版本「{{name}}」將被永久刪除，此操作無法復原。",
+  "versions.deleteConfirmTitle": "刪除版本？",
+  "versions.deleteFailed": "刪除版本失敗。",
+  "versions.deleteImpactDeployment": "部署狀態",
+  "versions.deleteImpactNotDeployed": "目前未部署",
+  "versions.deleteImpactRelease": "版本",
+  "versions.deleteImpactTitle": "刪除影響",
+  "versions.deleteRelease": "刪除版本",
+  "versions.deleteSuccess": "版本「{{name}}」已刪除。",
+  "versions.deploy": "部署",
+  "versions.deployTo": "部署到 {{name}}",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DEPLOYING": "部署中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_DRIFTED": "待同步",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_FAILED": "失敗",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_INVALID": "異常",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_READY": "執行中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下線中",
+  "versions.deployedStatus.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
+  "versions.deployingTo": "{{name}} 正在部署中",
+  "versions.disabledReason.checkDeploymentsFailed": "無法確認部署使用情況，請稍後再試。",
+  "versions.disabledReason.checkingDeployments": "正在檢查部署使用情況",
+  "versions.disabledReason.current": "此版本已在 {{name}} 上執行",
+  "versions.disabledReason.deploying": "請等待目前部署完成",
+  "versions.disabledReason.envDisabled": "此環境不可部署",
+  "versions.disabledReason.releaseInUse_one": "請先從 {{count}} 個環境中取消部署此版本，再進行刪除",
+  "versions.disabledReason.releaseInUse_other": "請先從 {{count}} 個環境中取消部署此版本，再進行刪除",
+  "versions.dslReadFailed": "讀取 DSL 檔案失敗。請選擇其他檔案後重試。",
+  "versions.dslReading": "正在讀取 DSL 檔案…",
+  "versions.dslUnsupportedMode": "僅支援使用 Workflow DSL 檔案建立部署。",
+  "versions.editFailed": "更新版本失敗。",
+  "versions.editRelease": "編輯版本",
+  "versions.editReleaseDescription": "更新此版本的名稱與描述。",
+  "versions.editSuccess": "版本「{{name}}」已更新。",
+  "versions.empty": "尚無可用版本。",
+  "versions.emptyDescription": "請先建立第一個版本，再部署到環境。",
+  "versions.emptyTitle": "尚無版本",
+  "versions.emptyWithCreate": "尚無版本。請先建立第一個可部署版本。",
+  "versions.exportDsl": "匯出 DSL",
+  "versions.exportDslFailed": "匯出 DSL 失敗。",
+  "versions.exportingDsl": "正在匯出…",
+  "versions.groupHeader.deploy": "部署",
+  "versions.groupHeader.promote": "部署",
+  "versions.groupHeader.rollback": "部署歷史版本",
+  "versions.groupHeader.unavailable": "不可用",
+  "versions.manualDslOption": "上傳 DSL",
+  "versions.moreActions": "更多操作",
+  "versions.optional": "選填",
+  "versions.promote": "部署",
+  "versions.promoteTo": "部署到 {{name}}",
+  "versions.releaseAlreadyExists": "相同內容的版本已存在：{{name}}。",
+  "versions.releaseContentCheckFailed": "檢查版本內容失敗。",
+  "versions.releaseDescriptionLabel": "描述",
+  "versions.releaseDescriptionPlaceholder": "描述此版本",
+  "versions.releaseHistory": "版本歷史",
+  "versions.releaseNameLabel": "版本名稱",
+  "versions.releaseNamePlaceholder": "版本名稱",
+  "versions.releaseNameRequired": "請輸入版本名稱。",
+  "versions.releaseSourceLabel": "版本來源",
+  "versions.rollbackTo": "部署到 {{name}}",
+  "versions.saveEdit": "儲存",
+  "versions.sourceAppOption": "Workflow App"
+}
diff --git a/web/i18n/zh-Hant/permission-keys.json b/web/i18n/zh-Hant/permission-keys.json
new file mode 100644
index 00000000000..08830764bf1
--- /dev/null
+++ b/web/i18n/zh-Hant/permission-keys.json
@@ -0,0 +1,50 @@
+{
+  "api_extension.manage": "管理API擴充配置",
+  "app.access_config": "配置應用訪問權限",
+  "app.acl.access_config": "配置應用訪問權限",
+  "app.acl.delete": "刪除應用",
+  "app.acl.edit": "編輯與編排應用",
+  "app.acl.import_export_dsl": "匯入 / 匯出 DSL",
+  "app.acl.monitor": "監測與維運",
+  "app.acl.preview": "預覽應用",
+  "app.acl.release_and_version": "應用發布與版本管理",
+  "app.acl.test_and_run": "測試與使用應用",
+  "app.acl.view_layout": "編排頁唯讀",
+  "app.create_and_management": "建立與管理自己建立的應用",
+  "app.tag.manage": "管理應用標籤",
+  "app_library.access": "訪問應用庫",
+  "billing.manage": "更換訂閱套餐",
+  "billing.subscription.manage": "在帳單入口網站管理帳單與訂閱方案",
+  "billing.view": "在設定中訪問帳單頁面",
+  "credential.manage": "管理憑據",
+  "credential.use": "使用憑據",
+  "customization.manage": "管理自訂",
+  "data_source.manage": "管理資料來源配置",
+  "dataset.access_config": "配置知識庫訪問權限",
+  "dataset.acl.access_config": "配置知識庫訪問權限",
+  "dataset.acl.delete": "刪除知識庫",
+  "dataset.acl.delete_file": "刪除知識庫檔案",
+  "dataset.acl.document_download": "文件下載",
+  "dataset.acl.edit": "知識庫編輯",
+  "dataset.acl.import_export_dsl": "從 DSL 匯入 / 匯出知識流水線 DSL",
+  "dataset.acl.pipeline_release": "知識庫流水線發布與版本管理",
+  "dataset.acl.pipeline_test": "流水線測試",
+  "dataset.acl.preview": "預覽知識庫",
+  "dataset.acl.readonly": "知識庫唯讀",
+  "dataset.acl.retrieval_recall": "知識庫檢索召回",
+  "dataset.acl.use": "向知識庫新增檔案",
+  "dataset.api_key.manage": "管理知識庫 API Key",
+  "dataset.create_and_management": "建立與管理自己建立的知識庫",
+  "dataset.external.connect": "連接外部知識庫",
+  "dataset.tag.manage": "管理知識庫標籤",
+  "mcp.manage": "管理MCP",
+  "plugin.debug": "調試插件",
+  "plugin.install": "安裝與更新插件",
+  "plugin.manage": "管理插件",
+  "plugin.plugin_preferences": "管理插件偏好設定",
+  "snippets.create_and_modify": "建立和修改 Snippets",
+  "snippets.management": "管理 Snippets",
+  "tool.manage": "管理工具",
+  "workspace.member.manage": "管理成員",
+  "workspace.role.manage": "管理角色權限與訪問權限規則"
+}
diff --git a/web/i18n/zh-Hant/permission.json b/web/i18n/zh-Hant/permission.json
new file mode 100644
index 00000000000..098c432bd10
--- /dev/null
+++ b/web/i18n/zh-Hant/permission.json
@@ -0,0 +1,104 @@
+{
+  "accessRule.actions": "操作",
+  "accessRule.addMemberAria": "新增 {{name}}",
+  "accessRule.addMembersTitle": "新增成員",
+  "accessRule.allPermittedMembers": "全部成員",
+  "accessRule.allPermittedMembersDescription": "所有具備對應角色權限的成員均可訪問",
+  "accessRule.appDescription": "設定誰可以訪問此應用，以及個別成員的權限例外",
+  "accessRule.appTitle": "應用訪問規則",
+  "accessRule.changeOpenScopeDescription": "更改開放範圍會重置此資源的所有個人權限設定。切換後，你需要重新新增成員專屬權限。",
+  "accessRule.changeOpenScopeTitle": "更改資源開放範圍？",
+  "accessRule.collapseSection": "折疊 {{title}}",
+  "accessRule.copied": "訪問規則已複製",
+  "accessRule.created": "訪問規則已建立",
+  "accessRule.datasetDescription": "控制此知識庫對哪些成員開放。成員仍需具備角色權限才能查看或操作此知識庫。",
+  "accessRule.datasetTitle": "知識庫訪問規則",
+  "accessRule.defaultPermission": "按角色權限",
+  "accessRule.deleteDescription": "此訪問規則將被永久刪除，並從資源授權列表中移除。",
+  "accessRule.deleteTitle": "刪除「{{name}}」？",
+  "accessRule.deleted": "訪問規則已刪除",
+  "accessRule.exceptionPermissionFor": "{{name}} 的例外權限",
+  "accessRule.expandSection": "展開 {{title}}",
+  "accessRule.individualPermissionSettings": "個人權限設定",
+  "accessRule.individualPermissionSettingsTip": "為指定協作者或群組設定權限例外。這些設定會覆蓋預設存取層級。",
+  "accessRule.lockedSummary_one": "· {{count}} 個鎖定",
+  "accessRule.lockedSummary_other": "· {{count}} 個鎖定",
+  "accessRule.maintainer": "維護者",
+  "accessRule.member": "成員",
+  "accessRule.newPermissionSet": "新增權限集",
+  "accessRule.noAvailableMembers": "暫無可新增成員",
+  "accessRule.noDescription": "無描述",
+  "accessRule.noRoles": "暫無角色",
+  "accessRule.noRules": "暫無訪問規則",
+  "accessRule.noUserAccessSettings": "暫無個人權限設定",
+  "accessRule.permission": "權限",
+  "accessRule.resourceOpenScope": "訪問範圍",
+  "accessRule.resourceOpenScopeDescription": "選擇此資源對哪些成員開放。角色權限仍決定每位成員可執行的操作。",
+  "accessRule.specificMembersOnly": "指定成員",
+  "accessRule.specificMembersOnlyDescription": "僅被新增到下方列表的成員可訪問",
+  "accessRule.summary_one": "{{count}} 個權限集",
+  "accessRule.summary_other": "{{count}} 個權限集",
+  "accessRule.updated": "訪問規則已更新",
+  "common.duplicateAction": "建立副本",
+  "group.app": "應用",
+  "group.app_acl": "應用訪問權限",
+  "group.billing": "帳單",
+  "group.credential": "憑據",
+  "group.dataset": "知識庫",
+  "group.dataset_acl": "知識庫訪問權限",
+  "group.plugin": "插件",
+  "group.tool_mcp": "工具與MCP",
+  "group.workspace": "工作空間",
+  "permissionList.clearAll": "清除全部",
+  "permissionList.collapseGroup": "折疊分組",
+  "permissionList.expandGroup": "展開分組",
+  "permissionList.noPermissionsFound": "未找到權限",
+  "permissionList.selectAll": "全選",
+  "permissionSet.descriptionLabel": "描述",
+  "permissionSet.descriptionPlaceholder": "描述此權限集授予的能力",
+  "permissionSet.learnMore": "了解更多權限說明",
+  "permissionSet.modal.create.app.description": "建立可在訪問規則中引用的應用權限集，以便快速授權。",
+  "permissionSet.modal.create.app.title": "建立應用權限集",
+  "permissionSet.modal.create.dataset.description": "建立可在訪問規則中引用的知識庫權限集，以便快速授權。",
+  "permissionSet.modal.create.dataset.title": "建立知識庫權限集",
+  "permissionSet.modal.edit.app.description": "修改此權限集的名稱、描述和授予的權限。",
+  "permissionSet.modal.edit.app.title": "編輯應用權限集",
+  "permissionSet.modal.edit.dataset.description": "修改此權限集的名稱、描述和授予的權限。",
+  "permissionSet.modal.edit.dataset.title": "編輯知識庫權限集",
+  "permissionSet.modal.view.app.description": "查看此權限集的名稱、描述和授予的權限。",
+  "permissionSet.modal.view.app.title": "查看應用權限集",
+  "permissionSet.modal.view.dataset.description": "查看此權限集的名稱、描述和授予的權限。",
+  "permissionSet.modal.view.dataset.title": "查看知識庫權限集",
+  "permissionSet.nameLabel": "權限集名稱",
+  "permissionSet.namePlaceholder": "例如：可匯出 DSL",
+  "permissionSet.permissions": "權限",
+  "role.addRole": "建立角色",
+  "role.copyMembersDescription_one": "「{{name}}」已分配給 {{count}} 個成員。是否讓新角色副本包含相同成員？",
+  "role.copyMembersDescription_other": "「{{name}}」已分配給 {{count}} 個成員。是否讓新角色副本包含相同成員？",
+  "role.copyMembersLoading": "正在查詢已綁定成員...",
+  "role.copyMembersTitle": "複製成員綁定？",
+  "role.created": "角色已建立",
+  "role.deleteDescription": "此角色將被永久刪除，並從使用它的成員或訪問規則中移除。",
+  "role.deleteTitle": "刪除「{{name}}」？",
+  "role.deleted": "角色已刪除",
+  "role.duplicated": "角色已複製",
+  "role.groups.builtin": "系統角色",
+  "role.groups.custom": "自訂角色",
+  "role.loading": "角色載入中...",
+  "role.modal.create.description": "建立角色並分配權限",
+  "role.modal.create.title": "建立角色",
+  "role.modal.descriptionLabel": "描述",
+  "role.modal.descriptionPlaceholder": "描述該角色負責的事項",
+  "role.modal.edit.description": "編輯角色詳情和權限",
+  "role.modal.edit.title": "編輯角色",
+  "role.modal.nameLabel": "角色名稱",
+  "role.modal.namePlaceholder": "例如：市場負責人",
+  "role.modal.view.description": "查看角色詳情和權限",
+  "role.modal.view.title": "查看角色",
+  "role.noDescription": "無描述",
+  "role.noMatchingRoles": "未找到匹配角色",
+  "role.searchPlaceholder": "搜尋角色...",
+  "role.updated": "角色已更新",
+  "role.workspaceRoles.description": "建立角色並定義每個角色在此工作空間中可以執行的操作。",
+  "role.workspaceRoles.title": "工作空間角色"
+}
diff --git a/web/i18n/zh-Hant/workflow.json b/web/i18n/zh-Hant/workflow.json
index d0f0f804031..c68f0fb9570 100644
--- a/web/i18n/zh-Hant/workflow.json
+++ b/web/i18n/zh-Hant/workflow.json
@@ -1,5 +1,6 @@
 {
-  "blocks.agent": "代理",
+  "blocks.agent": "Agent",
+  "blocks.agent-v2": "Agent",
   "blocks.answer": "直接回覆",
   "blocks.assigner": "變數分配器",
   "blocks.code": "程式碼執行",
@@ -33,6 +34,7 @@
   "blocks.variable-aggregator": "變數聚合器",
   "blocks.variable-assigner": "變數聚合器",
   "blocksAbout.agent": "調用大型語言模型來回答問題或處理自然語言",
+  "blocksAbout.agent-v2": "調用大型語言模型來回答問題或處理自然語言",
   "blocksAbout.answer": "定義一個聊天對話的回覆內容",
   "blocksAbout.assigner": "變數分配節點用於為可寫入的變數（如對話變數）分配值。",
   "blocksAbout.code": "執行一段 Python 或 NodeJS 程式碼實現自定義邏輯",
@@ -378,6 +380,7 @@
   "globalVar.fieldsDescription.workflowId": "工作流程 ID",
   "globalVar.fieldsDescription.workflowRunId": "工作流程執行 ID",
   "globalVar.title": "系統變數",
+  "nodes.agent.advancedSetting": "進階設定",
   "nodes.agent.checkList.strategyNotSelected": "未選擇策略",
   "nodes.agent.clickToViewParameterSchema": "點擊查看參數架構",
   "nodes.agent.configureModel": "配置模型",
@@ -400,13 +403,34 @@
   "nodes.agent.modelNotSupport.title": "不支援的型號",
   "nodes.agent.modelSelectorTooltips.deprecated": "此模型已棄用",
   "nodes.agent.notAuthorized": "未授權",
+  "nodes.agent.outputVars.confirm": "確認",
+  "nodes.agent.outputVars.defaultValueArrayInvalid": "請輸入 JSON 陣列。",
+  "nodes.agent.outputVars.defaultValueBooleanInvalid": "請輸入 true 或 false。",
+  "nodes.agent.outputVars.defaultValueFileUnsupported": "此處暫不支援設定檔案預設值。",
+  "nodes.agent.outputVars.defaultValueLabel": "預設值",
+  "nodes.agent.outputVars.defaultValueNumberInvalid": "請輸入有效數字。",
+  "nodes.agent.outputVars.defaultValueObjectInvalid": "請輸入 JSON 物件。",
+  "nodes.agent.outputVars.defaultValuePlaceholder": "預設值",
+  "nodes.agent.outputVars.delete": "刪除 {{name}}",
+  "nodes.agent.outputVars.descriptionLabel": "描述",
+  "nodes.agent.outputVars.descriptionPlaceholder": "新增描述",
+  "nodes.agent.outputVars.edit": "編輯 {{name}}",
+  "nodes.agent.outputVars.editorLabel": "輸出變數編輯器",
   "nodes.agent.outputVars.files.title": "代理生成的檔",
   "nodes.agent.outputVars.files.transfer_method": "轉移方法。值為 remote_url 或 local_file",
   "nodes.agent.outputVars.files.type": "支撐類型。現在僅支援鏡像",
   "nodes.agent.outputVars.files.upload_file_id": "上傳檔 ID",
   "nodes.agent.outputVars.files.url": "圖片網址",
   "nodes.agent.outputVars.json": "代理生成的 JSON",
+  "nodes.agent.outputVars.nameDuplicate": "輸出變數名稱已存在",
+  "nodes.agent.outputVars.nameInvalid": "請使用字母、數字和底線，並以字母或底線開頭。",
+  "nodes.agent.outputVars.nameLabel": "欄位名稱",
+  "nodes.agent.outputVars.namePlaceholder": "欄位名稱",
+  "nodes.agent.outputVars.newOutput": "新增輸出",
+  "nodes.agent.outputVars.requiredLabel": "必填",
+  "nodes.agent.outputVars.showAdvancedOptions": "顯示進階選項",
   "nodes.agent.outputVars.text": "代理生成的內容",
+  "nodes.agent.outputVars.typeLabel": "輸出類型",
   "nodes.agent.outputVars.usage": "模型用量信息",
   "nodes.agent.parameterSchema": "參數架構",
   "nodes.agent.pluginInstaller.install": "安裝",
@@ -414,6 +438,17 @@
   "nodes.agent.pluginNotFoundDesc": "此集成安裝自 GitHub。請前往集成重新安裝",
   "nodes.agent.pluginNotInstalled": "此集成未安裝",
   "nodes.agent.pluginNotInstalledDesc": "此集成安裝自 GitHub。請前往集成重新安裝",
+  "nodes.agent.roster.change": "更換",
+  "nodes.agent.roster.editInConsole": "在 Agent Console 中編輯",
+  "nodes.agent.roster.inlineSetup.description": "僅存在於此節點的一次性設定",
+  "nodes.agent.roster.inlineSetup.name": "內聯設定",
+  "nodes.agent.roster.inlineSetup.title": "Agent 設定",
+  "nodes.agent.roster.inlineSetup.type": "僅在此節點中",
+  "nodes.agent.roster.label": "智能體",
+  "nodes.agent.roster.makeCopy": "建立副本",
+  "nodes.agent.roster.more": "更多 Agent 操作",
+  "nodes.agent.roster.openPanel": "開啟 {{name}} 詳情",
+  "nodes.agent.roster.panelLabel": "{{name}} 詳情",
   "nodes.agent.strategy.configureTip": "請配置 agentic 策略。",
   "nodes.agent.strategy.configureTipDesc": "配置代理策略后，該節點將自動載入剩餘的配置。該策略將影響多步驟工具推理的機制。",
   "nodes.agent.strategy.label": "代理策略",
@@ -425,6 +460,11 @@
   "nodes.agent.strategyNotFoundDescAndSwitchVersion": "已安裝的集成版本不提供此策略。點擊切換版本。",
   "nodes.agent.strategyNotInstallTooltip": "{{strategy}} 未安裝",
   "nodes.agent.strategyNotSet": "代理策略未設置",
+  "nodes.agent.task.insert": "插入",
+  "nodes.agent.task.label": "Agent 任務",
+  "nodes.agent.task.mention": "提及",
+  "nodes.agent.task.placeholder": "描述這個 Agent 要完成的任務...",
+  "nodes.agent.task.tooltip": "定義該 Agent 在目前工作流程中需要遵循的任務指令。",
   "nodes.agent.toolNotAuthorizedTooltip": "{{tool}} 未授權",
   "nodes.agent.toolNotInstallTooltip": "{{tool}} 未安裝",
   "nodes.agent.toolbox": "工具箱",
@@ -1210,7 +1250,7 @@
   "tabs.pluginByAuthor": "由 {{author}}",
   "tabs.question-understand": "問題理解",
   "tabs.requestToCommunity": "對社群的請求",
-  "tabs.searchBlock": "搜索節點",
+  "tabs.searchBlock": "搜尋節點、Agent、人工、知識庫",
   "tabs.searchDataSource": "搜尋資料來源",
   "tabs.searchSnippets": "搜尋片段...",
   "tabs.searchTool": "搜尋集成",
diff --git a/web/knip.config.ts b/web/knip.config.ts
index b18639e64f7..419bf825299 100644
--- a/web/knip.config.ts
+++ b/web/knip.config.ts
@@ -13,8 +13,14 @@ const config: KnipConfig = {
   ignore: [
     'public/**',
   ],
+  ignoreFiles: [
+    'features/agent-v2/agent-detail/configure/components/orchestrate/memory.tsx',
+    'features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/option-menu.tsx',
+  ],
   ignoreBinaries: [
     'only-allow',
+    'pbcopy',
+    'which',
   ],
   ignoreDependencies: [
     '@iconify-json/*',
diff --git a/web/models/access-control.ts b/web/models/access-control.ts
index d0e58d645b4..db13e9159e0 100644
--- a/web/models/access-control.ts
+++ b/web/models/access-control.ts
@@ -1,30 +1,270 @@
-export enum SubjectType {
-  GROUP = 'group',
-  ACCOUNT = 'account',
-}
+import type { AccessControlTemplateLanguage } from '@/i18n-config/language'
 
-export enum AccessMode {
-  PUBLIC = 'public',
-  SPECIFIC_GROUPS_MEMBERS = 'private',
-  ORGANIZATION = 'private_all',
-  EXTERNAL_MEMBERS = 'sso_verified',
-}
+export const SubjectType = {
+  GROUP: 'group',
+  ACCOUNT: 'account',
+} as const
+
+export type SubjectType = typeof SubjectType[keyof typeof SubjectType]
+
+export const AccessMode = {
+  PUBLIC: 'public',
+  SPECIFIC_GROUPS_MEMBERS: 'private',
+  ORGANIZATION: 'private_all',
+  EXTERNAL_MEMBERS: 'sso_verified',
+} as const
+
+export type AccessMode = typeof AccessMode[keyof typeof AccessMode]
 
 export type AccessControlGroup = {
-  id: 'string'
-  name: 'string'
-  groupSize: 5
+  id: string
+  name: string
+  groupSize: number
 }
 
 export type AccessControlAccount = {
-  id: 'string'
-  name: 'string'
-  email: 'string'
-  avatar: 'string'
-  avatarUrl: 'string'
+  id: string
+  name: string
+  email: string
+  avatar: string
+  avatarUrl: string
 }
 
 export type SubjectGroup = { subjectId: string, subjectType: SubjectType, groupData: AccessControlGroup }
 export type SubjectAccount = { subjectId: string, subjectType: SubjectType, accountData: AccessControlAccount }
 
 export type Subject = SubjectGroup | SubjectAccount
+
+type Permission = {
+  key: string
+  name: string
+  description: string
+}
+export type PermissionGroup = {
+  group_key: string
+  group_name: string
+  description: string
+  permissions: Permission[]
+}
+
+export type PermissionGroups = {
+  groups: PermissionGroup[]
+}
+
+export type PermissionKey = string
+
+type RoleType = 'workspace' | 'app' | 'dataset'
+
+export type RoleCategory = 'global_system_default' | 'global_custom'
+
+export type Role = {
+  id: string
+  tenant_id: string
+  type: RoleType
+  category: RoleCategory
+  name: string
+  description: string
+  is_builtin: boolean
+  permission_keys: PermissionKey[]
+  role_tag: 'owner' | '' // Used for identifying the unique owner role, which has some special handlings
+}
+
+type Pagination = {
+  total_count: number
+  per_page: number
+  current_page: number
+  total_pages: number
+}
+
+type PaginationParameters = {
+  page?: number
+  limit?: number
+  reverse?: boolean
+}
+
+export type RoleListRequest = PaginationParameters & {
+  include_owner?: 1 | 0
+  language?: AccessControlTemplateLanguage
+}
+
+export type RoleListResponse = {
+  data: Role[]
+  pagination: Pagination
+}
+
+export type CreateRoleRequest = {
+  name: string
+  description?: string
+  permission_keys?: PermissionKey[]
+}
+
+export type UpdateRolesRequest = {
+  id: string
+  name: string
+  description?: string
+  permission_keys?: PermissionKey[]
+}
+
+export type CopyWorkspaceRoleRequest = {
+  roleId: string
+  copy_member: boolean
+}
+
+export type WorkspaceAccessRulesRequest = {
+  language?: AccessControlTemplateLanguage
+} & PaginationParameters
+
+export type AccessPolicyResourceType = 'app' | 'dataset'
+
+type AccessPolicyCategory = 'global_system_default' | 'global_custom'
+
+export type AccessPolicy = {
+  id: string
+  tenant_id: string
+  resource_type: AccessPolicyResourceType
+  policy_key: string
+  name: string
+  description: string
+  permission_keys: PermissionKey[]
+  is_builtin: boolean
+  category: AccessPolicyCategory
+  created_at: string
+  updated_at: string
+}
+
+export type CreateAccessPolicyRequest = {
+  name: string
+  description?: string
+  permission_keys?: PermissionKey[]
+}
+
+export type UpdateAccessPolicyRequest = {
+  id: string
+  name: string
+  description?: string
+  permission_keys?: PermissionKey[]
+}
+
+type Bindings = {
+  roles: Array<{
+    role_id: string
+    role_name: string
+    binding_id: string
+    is_locked: boolean
+    role_tag: 'owner' | '' // Used for identifying the unique owner role, which has some special handlings
+  }>
+  accounts: Array<{
+    account_id: string
+    account_name: string
+    binding_id: string
+    is_locked: boolean
+    avatar?: string
+  }>
+}
+
+export type AccessPolicyWithBindings = {
+  policy: AccessPolicy
+} & Bindings
+
+export type GetAppAccessPolicyByAppIdResponse = {
+  app_id: string
+  items: AccessPolicyWithBindings[]
+}
+
+export type GetDatasetAccessPolicyByDatasetIdResponse = {
+  dataset_id: string
+  items: AccessPolicyWithBindings[]
+}
+
+export type GetAppAccessPoliciesResponse = {
+  items: AccessPolicyWithBindings[]
+  pagination: Pagination
+}
+
+export type GetDatasetAccessPoliciesResponse = {
+  items: AccessPolicyWithBindings[]
+  pagination: Pagination
+}
+
+export type RolesOfMemberResponse = {
+  account_id: string
+  roles: Role[]
+}
+
+export type UpdateRolesOfMemberRequest = {
+  memberId: string
+  roleIds: string[]
+}
+
+type WorkspacePermissionKeys = {
+  permission_keys: string[]
+}
+
+type ResourcePermissionKeys = {
+  default_permission_keys: string[]
+  overrides: Array<{
+    resource_id: string
+    permission_keys: string[]
+  }>
+}
+
+export type PermissionKeysResponse = {
+  workspace: WorkspacePermissionKeys
+  app: ResourcePermissionKeys
+  dataset: ResourcePermissionKeys
+}
+
+export type GetMembersOfRoleRequest = {
+  roleId: string
+} & PaginationParameters
+
+type Account = {
+  account_id: string
+  account_name: string
+  email?: string
+  avatar?: string
+}
+
+export type ResourceUserAccessSetting = {
+  account: Account
+  roles: Omit<Role, 'tenant_id' | 'description' | 'role_tag'>[]
+  access_policies: Omit<AccessPolicy, 'created_at' | 'updated_at'>[]
+}
+
+type ResourceUserAccessSettingsResponse = {
+  data: ResourceUserAccessSetting[]
+  scope: ResourceOpenScope
+}
+
+export type GetMembersOfRoleResponse = {
+  data: Account[]
+  pagination: Pagination
+}
+
+export type GetAppUserAccessSettingsResponse = ResourceUserAccessSettingsResponse
+
+export type GetDatasetUserAccessSettingsResponse = ResourceUserAccessSettingsResponse
+
+type UpdateResourceUserAccessSettingsRequest = {
+  accountId: string
+  accessPolicyIds: string[]
+}
+
+export type UpdateAppUserAccessSettingsRequest = UpdateResourceUserAccessSettingsRequest
+
+export type UpdateDatasetUserAccessSettingsRequest = UpdateResourceUserAccessSettingsRequest
+
+type RemoveResourceAccessPolicyMemberBindingsRequest = {
+  accessPolicyId: string
+  accountIds: string[]
+}
+
+export type RemoveAppAccessPolicyMemberBindingsRequest = RemoveResourceAccessPolicyMemberBindingsRequest
+
+export type RemoveDatasetAccessPolicyMemberBindingsRequest = RemoveResourceAccessPolicyMemberBindingsRequest
+
+export type GetAccessPolicyDetailResponse = {
+  access_policies: Pick<AccessPolicy, 'id' | 'name' | 'resource_type' | 'policy_key' | 'permission_keys'>[]
+}
+
+export type ResourceOpenScope = 'all' | 'specific'
diff --git a/web/models/app.ts b/web/models/app.ts
index d14dc1cd6cd..6f6b5a346b9 100644
--- a/web/models/app.ts
+++ b/web/models/app.ts
@@ -45,6 +45,7 @@ export type DSLImportResponse = {
   imported_dsl_version?: string
   error: string
   leaked_dependencies: Dependency[]
+  permission_keys: string[]
 }
 
 export type UpdateAppSiteCodeResponse = { app_id: string } & SiteConfig
diff --git a/web/models/common.ts b/web/models/common.ts
index efc4c11839c..5549fee8f48 100644
--- a/web/models/common.ts
+++ b/web/models/common.ts
@@ -1,4 +1,5 @@
 import type { GetAccountProfileResponse } from '@dify/contracts/api/console/account/types.gen'
+import type { Role } from './access-control'
 import type { I18nText } from '@/i18n-config/language'
 import type { Model } from '@/types/app'
 
@@ -42,6 +43,7 @@ export type Member = Pick<GetAccountProfileResponse, 'id' | 'name' | 'email' | '
   created_at?: string
   status: 'pending' | 'active' | 'banned' | 'closed'
   role: 'owner' | 'admin' | 'editor' | 'normal' | 'dataset_operator'
+  roles: Role[]
 }
 
 const ProviderName = {
@@ -171,6 +173,10 @@ export type InvitationResult = {
   status: 'success'
   email: string
   url: string
+} | {
+  status: 'already_member'
+  email: string
+  message?: string
 } | {
   status: 'failed'
   email: string
diff --git a/web/models/datasets.ts b/web/models/datasets.ts
index 7ca206864b5..a0ce36a0bdc 100644
--- a/web/models/datasets.ts
+++ b/web/models/datasets.ts
@@ -60,6 +60,7 @@ export type DataSet = {
   indexing_technique: IndexingType
   author_name?: string
   created_by: string
+  maintainer?: string
   updated_by: string
   updated_at: number
   app_count: number
@@ -96,6 +97,8 @@ export type DataSet = {
   enable_api: boolean // Indicates if the service API is enabled
   is_multimodal: boolean // Indicates if the dataset supports multimodal
   summary_index_setting?: SummaryIndexSetting
+  /** ACL permission keys */
+  permission_keys?: string[]
 }
 
 export type ExternalAPIItem = {
diff --git a/web/package.json b/web/package.json
index d1d581ad7bf..686bc5b04b1 100644
--- a/web/package.json
+++ b/web/package.json
@@ -73,6 +73,7 @@
     "@svgdotjs/svg.js": "catalog:",
     "@t3-oss/env-nextjs": "catalog:",
     "@tailwindcss/typography": "catalog:",
+    "@tanstack/query-core": "catalog:",
     "@tanstack/react-form": "catalog:",
     "@tanstack/react-hotkeys": "catalog:",
     "@tanstack/react-query": "catalog:",
@@ -104,6 +105,8 @@
     "i18next-resources-to-backend": "catalog:",
     "immer": "catalog:",
     "jotai": "catalog:",
+    "jotai-scope": "catalog:",
+    "jotai-tanstack-query": "catalog:",
     "js-audio-recorder": "catalog:",
     "js-cookie": "catalog:",
     "js-yaml": "catalog:",
diff --git a/web/plugins/eslint/namespaces.js b/web/plugins/eslint/namespaces.js
index 68d41d5a4f9..a968e1e74ab 100644
--- a/web/plugins/eslint/namespaces.js
+++ b/web/plugins/eslint/namespaces.js
@@ -23,6 +23,7 @@ const NAMESPACES = [
   'layout',
   'login',
   'oauth',
+  'permission',
   'pipeline',
   'plugin',
   'pluginTags',
diff --git a/web/service/__tests__/use-explore.spec.tsx b/web/service/__tests__/use-explore.spec.tsx
new file mode 100644
index 00000000000..6db3d634235
--- /dev/null
+++ b/web/service/__tests__/use-explore.spec.tsx
@@ -0,0 +1,87 @@
+import type { ReactNode } from 'react'
+import type { App } from '@/models/explore'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { renderHook, waitFor } from '@testing-library/react'
+import { AppModeEnum } from '@/types/app'
+import { fetchAppList } from '../explore'
+import { useExploreAppList } from '../use-explore'
+
+vi.mock('@/context/i18n', () => ({
+  useLocale: () => 'en-US',
+}))
+
+vi.mock('../explore', () => ({
+  fetchAppList: vi.fn(),
+}))
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+const createApp = (appId: string, position: number): App => ({
+  app: {
+    id: appId,
+    mode: AppModeEnum.CHAT,
+    icon_type: 'emoji',
+    icon: 'robot',
+    icon_background: '#fff',
+    icon_url: '',
+    name: appId,
+    description: '',
+    use_icon_as_answer_icon: false,
+  },
+  app_id: appId,
+  description: '',
+  copyright: '',
+  privacy_policy: null,
+  custom_disclaimer: null,
+  categories: [],
+  position,
+  is_listed: true,
+  install_count: 0,
+  installed: false,
+  editable: false,
+  is_agent: false,
+  can_trial: false,
+})
+
+describe('useExploreAppList', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(fetchAppList).mockResolvedValue({
+      categories: [],
+      recommended_apps: [
+        createApp('app-2', 2),
+        createApp('app-1', 1),
+      ],
+    })
+  })
+
+  // Explore app list can now be disabled by callers.
+  describe('Queries', () => {
+    it('should not fetch app list when disabled', () => {
+      renderHook(() => useExploreAppList({ enabled: false }), { wrapper: createWrapper() })
+
+      expect(fetchAppList).not.toHaveBeenCalled()
+    })
+
+    it('should fetch localized app list and sort recommended apps by position', async () => {
+      const { result } = renderHook(() => useExploreAppList({ enabled: true }), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(fetchAppList).toHaveBeenCalledWith('en-US')
+      })
+      await waitFor(() => {
+        expect(result.current.data?.allList.map(app => app.app_id)).toEqual(['app-1', 'app-2'])
+      })
+    })
+  })
+})
diff --git a/web/service/__tests__/use-plugins.spec.tsx b/web/service/__tests__/use-plugins.spec.tsx
index ce69fa4b958..015614c4a50 100644
--- a/web/service/__tests__/use-plugins.spec.tsx
+++ b/web/service/__tests__/use-plugins.spec.tsx
@@ -38,6 +38,7 @@ vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
     isCurrentWorkspaceManager: true,
     isCurrentWorkspaceOwner: false,
+    workspacePermissionKeys: ['plugin.install'],
   }),
 }))
 
diff --git a/web/service/__tests__/use-tools.spec.tsx b/web/service/__tests__/use-tools.spec.tsx
new file mode 100644
index 00000000000..f2c11f2ac97
--- /dev/null
+++ b/web/service/__tests__/use-tools.spec.tsx
@@ -0,0 +1,54 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { renderHook, waitFor } from '@testing-library/react'
+import { get } from '../base'
+import { useAppTriggers, useMCPServerDetail } from '../use-tools'
+
+vi.mock('../base', () => ({
+  get: vi.fn(),
+}))
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+describe('use-tools query options', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(get).mockResolvedValue({ data: [] })
+  })
+
+  // MCP server detail supports an explicit enabled flag.
+  describe('MCP Server Detail', () => {
+    it('should not fetch server detail when disabled', () => {
+      renderHook(() => useMCPServerDetail('app-1', false), { wrapper: createWrapper() })
+
+      expect(get).not.toHaveBeenCalled()
+    })
+
+    it('should fetch server detail when enabled', async () => {
+      renderHook(() => useMCPServerDetail('app-1'), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/apps/app-1/server')
+      })
+    })
+  })
+
+  // App trigger callers can override default query options such as enabled.
+  describe('App Triggers', () => {
+    it('should respect caller-provided enabled option', () => {
+      renderHook(() => useAppTriggers('app-1', { enabled: false }), { wrapper: createWrapper() })
+
+      expect(get).not.toHaveBeenCalled()
+    })
+  })
+})
diff --git a/web/service/access-control/__tests__/use-app-access-config.spec.tsx b/web/service/access-control/__tests__/use-app-access-config.spec.tsx
new file mode 100644
index 00000000000..879fba01e45
--- /dev/null
+++ b/web/service/access-control/__tests__/use-app-access-config.spec.tsx
@@ -0,0 +1,167 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { act, renderHook } from '@testing-library/react'
+import {
+  useAppAccessRules,
+  useAppUserAccessSettings,
+  useRemoveAppAccessPolicyMemberBindings,
+  useUpdateAppOpenScope,
+  useUpdateAppUserAccessSettings,
+} from '../use-app-access-config'
+
+const mocks = vi.hoisted(() => ({
+  accessRulesQueryOptions: vi.fn(() => ({
+    queryKey: ['rbac-access-config', 'apps', 'access-rules'],
+    queryFn: vi.fn().mockResolvedValue({ app_id: 'app-1', items: [] }),
+  })),
+  accessRulesKey: vi.fn(() => ['rbac-access-config', 'apps', 'access-rules']),
+  userAccessSettingsQueryOptions: vi.fn(() => ({
+    queryKey: ['rbac-access-config', 'apps', 'user-access-settings'],
+    queryFn: vi.fn().mockResolvedValue({ data: [], scope: 'specific' }),
+  })),
+  userAccessSettingsKey: vi.fn(() => ['rbac-access-config', 'apps', 'user-access-settings']),
+  userAccessSettingsQueryKey: vi.fn(() => ['rbac-access-config', 'apps', 'user-access-settings', 'app-1']),
+  updateOpenScope: vi.fn().mockResolvedValue({}),
+  updateUserAccessSettings: vi.fn().mockResolvedValue({}),
+  removeMemberBindings: vi.fn().mockResolvedValue({}),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleClient: {
+    rbacAccessConfig: {
+      apps: {
+        updateOpenScope: mocks.updateOpenScope,
+        updateUserAccessSettings: mocks.updateUserAccessSettings,
+        removeMemberBindings: mocks.removeMemberBindings,
+      },
+    },
+  },
+  consoleQuery: {
+    rbacAccessConfig: {
+      apps: {
+        accessRules: {
+          key: mocks.accessRulesKey,
+          queryOptions: mocks.accessRulesQueryOptions,
+        },
+        userAccessSettings: {
+          key: mocks.userAccessSettingsKey,
+          queryKey: mocks.userAccessSettingsQueryKey,
+          queryOptions: mocks.userAccessSettingsQueryOptions,
+        },
+      },
+    },
+  },
+}))
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+describe('use-app-access-config', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  // Queries load app-specific access policies from the RBAC app route.
+  describe('Queries', () => {
+    it('should fetch access rules for an app id', () => {
+      renderHook(() => useAppAccessRules('app-1', 'zh'), { wrapper: createWrapper() })
+
+      expect(mocks.accessRulesQueryOptions).toHaveBeenCalledWith({
+        input: {
+          params: {
+            appId: 'app-1',
+          },
+          query: {
+            language: 'zh',
+          },
+        },
+      })
+    })
+  })
+
+  // User access settings configure which access policies apply to app users.
+  describe('User Access Settings', () => {
+    it('should fetch user access settings for an app id', () => {
+      renderHook(() => useAppUserAccessSettings('app-1', 'en'), { wrapper: createWrapper() })
+
+      expect(mocks.userAccessSettingsQueryOptions).toHaveBeenCalledWith({
+        input: {
+          params: {
+            appId: 'app-1',
+          },
+          query: {
+            language: 'en',
+          },
+        },
+      })
+    })
+
+    it('should update user access settings for an app id', async () => {
+      const { result } = renderHook(() => useUpdateAppUserAccessSettings('app-1'), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync({ accountId: 'account-1', accessPolicyIds: ['policy-1', 'policy-2'] })
+      })
+
+      expect(mocks.updateUserAccessSettings).toHaveBeenCalledWith({
+        params: {
+          appId: 'app-1',
+          accountId: 'account-1',
+        },
+        body: {
+          access_policy_ids: ['policy-1', 'policy-2'],
+        },
+      })
+      expect(mocks.userAccessSettingsKey).toHaveBeenCalled()
+      expect(mocks.accessRulesKey).toHaveBeenCalled()
+    })
+
+    it('should remove app access policy member bindings for account ids', async () => {
+      const { result } = renderHook(() => useRemoveAppAccessPolicyMemberBindings('app-1'), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync({ accessPolicyId: 'policy-1', accountIds: ['account-1'] })
+      })
+
+      expect(mocks.removeMemberBindings).toHaveBeenCalledWith({
+        params: {
+          appId: 'app-1',
+          policyId: 'policy-1',
+        },
+        body: {
+          account_ids: ['account-1'],
+        },
+      })
+      expect(mocks.userAccessSettingsKey).toHaveBeenCalled()
+      expect(mocks.accessRulesKey).toHaveBeenCalled()
+    })
+
+    it('should update open scope for an app id', async () => {
+      const { result } = renderHook(() => useUpdateAppOpenScope('app-1'), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync('all')
+      })
+
+      expect(mocks.updateOpenScope).toHaveBeenCalledWith({
+        params: {
+          appId: 'app-1',
+        },
+        body: {
+          scope: 'all',
+        },
+      })
+      expect(mocks.userAccessSettingsKey).toHaveBeenCalled()
+    })
+  })
+})
diff --git a/web/service/access-control/__tests__/use-app-access-control.spec.tsx b/web/service/access-control/__tests__/use-app-access-control.spec.tsx
new file mode 100644
index 00000000000..bcf4ebcfaf2
--- /dev/null
+++ b/web/service/access-control/__tests__/use-app-access-control.spec.tsx
@@ -0,0 +1,108 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider, queryOptions } from '@tanstack/react-query'
+import { renderHook, waitFor } from '@testing-library/react'
+import { get } from '@/service/base'
+import { getUserCanAccess } from '@/service/share'
+import {
+  useAppWhiteListSubjects,
+  useGetUserCanAccessApp,
+  useSearchForWhiteListCandidates,
+} from '../use-app-access-control'
+
+const mockSystemFeatures = vi.hoisted(() => ({
+  webappAuthEnabled: false,
+}))
+
+vi.mock('@/service/base', () => ({
+  get: vi.fn(),
+  request: vi.fn(),
+}))
+
+vi.mock('@/service/share', () => ({
+  getUserCanAccess: vi.fn(),
+}))
+
+vi.mock('@/features/system-features/client', () => ({
+  systemFeaturesQueryOptions: () => queryOptions({
+    queryKey: ['system-features'],
+    queryFn: () => Promise.resolve({
+      webapp_auth: {
+        enabled: mockSystemFeatures.webappAuthEnabled,
+      },
+    }),
+  }),
+}))
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+describe('use-app-access-control', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockSystemFeatures.webappAuthEnabled = false
+    vi.mocked(get).mockResolvedValue({ groups: [], members: [] })
+    vi.mocked(getUserCanAccess).mockResolvedValue({ result: true })
+  })
+
+  // Queries build the enterprise whitelist endpoints from app and filter inputs.
+  describe('Queries', () => {
+    it('should fetch app whitelist subjects when enabled', async () => {
+      renderHook(() => useAppWhiteListSubjects('app-1', true), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/enterprise/webapp/app/subjects?appId=app-1')
+      })
+    })
+
+    it('should search whitelist candidates with encoded query params', async () => {
+      vi.mocked(get).mockResolvedValue({
+        currPage: 1,
+        totalPages: 1,
+        subjects: [],
+        hasMore: false,
+      })
+
+      renderHook(
+        () => useSearchForWhiteListCandidates({
+          keyword: 'team one',
+          groupId: 'group-1',
+          resultsPerPage: 20,
+        }, true),
+        { wrapper: createWrapper() },
+      )
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/enterprise/webapp/app/subject/search?keyword=team+one&groupId=group-1&resultsPerPage=20&pageNumber=1')
+      })
+    })
+
+    it('should return public access when webapp auth is disabled', async () => {
+      const { result } = renderHook(() => useGetUserCanAccessApp({ appId: 'app-1' }), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(result.current.data).toEqual({ result: true })
+      })
+      expect(getUserCanAccess).not.toHaveBeenCalled()
+    })
+
+    it('should call share access check when webapp auth is enabled', async () => {
+      mockSystemFeatures.webappAuthEnabled = true
+
+      renderHook(() => useGetUserCanAccessApp({ appId: 'app-1', isInstalledApp: false }), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(getUserCanAccess).toHaveBeenCalledWith('app-1', false)
+      })
+    })
+  })
+})
diff --git a/web/service/access-control/__tests__/use-dataset-access-config.spec.tsx b/web/service/access-control/__tests__/use-dataset-access-config.spec.tsx
new file mode 100644
index 00000000000..da9ab1b7b4e
--- /dev/null
+++ b/web/service/access-control/__tests__/use-dataset-access-config.spec.tsx
@@ -0,0 +1,167 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { act, renderHook } from '@testing-library/react'
+import {
+  useDatasetAccessRules,
+  useDatasetUserAccessSettings,
+  useRemoveDatasetAccessPolicyMemberBindings,
+  useUpdateDatasetOpenScope,
+  useUpdateDatasetUserAccessSettings,
+} from '../use-dataset-access-config'
+
+const mocks = vi.hoisted(() => ({
+  accessRulesQueryOptions: vi.fn(() => ({
+    queryKey: ['rbac-access-config', 'datasets', 'access-rules'],
+    queryFn: vi.fn().mockResolvedValue({ dataset_id: 'dataset-1', items: [] }),
+  })),
+  accessRulesKey: vi.fn(() => ['rbac-access-config', 'datasets', 'access-rules']),
+  userAccessSettingsQueryOptions: vi.fn(() => ({
+    queryKey: ['rbac-access-config', 'datasets', 'user-access-settings'],
+    queryFn: vi.fn().mockResolvedValue({ data: [], scope: 'specific' }),
+  })),
+  userAccessSettingsKey: vi.fn(() => ['rbac-access-config', 'datasets', 'user-access-settings']),
+  userAccessSettingsQueryKey: vi.fn(() => ['rbac-access-config', 'datasets', 'user-access-settings', 'dataset-1']),
+  updateOpenScope: vi.fn().mockResolvedValue({}),
+  updateUserAccessSettings: vi.fn().mockResolvedValue({}),
+  removeMemberBindings: vi.fn().mockResolvedValue({}),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleClient: {
+    rbacAccessConfig: {
+      datasets: {
+        updateOpenScope: mocks.updateOpenScope,
+        updateUserAccessSettings: mocks.updateUserAccessSettings,
+        removeMemberBindings: mocks.removeMemberBindings,
+      },
+    },
+  },
+  consoleQuery: {
+    rbacAccessConfig: {
+      datasets: {
+        accessRules: {
+          key: mocks.accessRulesKey,
+          queryOptions: mocks.accessRulesQueryOptions,
+        },
+        userAccessSettings: {
+          key: mocks.userAccessSettingsKey,
+          queryKey: mocks.userAccessSettingsQueryKey,
+          queryOptions: mocks.userAccessSettingsQueryOptions,
+        },
+      },
+    },
+  },
+}))
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+describe('use-dataset-access-config', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  // Queries load dataset-specific access policies from the RBAC dataset route.
+  describe('Queries', () => {
+    it('should fetch access rules for a dataset id', () => {
+      renderHook(() => useDatasetAccessRules('dataset-1', 'ja'), { wrapper: createWrapper() })
+
+      expect(mocks.accessRulesQueryOptions).toHaveBeenCalledWith({
+        input: {
+          params: {
+            datasetId: 'dataset-1',
+          },
+          query: {
+            language: 'ja',
+          },
+        },
+      })
+    })
+  })
+
+  // User access settings mirror the app access-config API shape for datasets.
+  describe('User Access Settings', () => {
+    it('should fetch user access settings for a dataset id', () => {
+      renderHook(() => useDatasetUserAccessSettings('dataset-1', 'zh'), { wrapper: createWrapper() })
+
+      expect(mocks.userAccessSettingsQueryOptions).toHaveBeenCalledWith({
+        input: {
+          params: {
+            datasetId: 'dataset-1',
+          },
+          query: {
+            language: 'zh',
+          },
+        },
+      })
+    })
+
+    it('should update user access settings for a dataset id', async () => {
+      const { result } = renderHook(() => useUpdateDatasetUserAccessSettings('dataset-1'), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync({ accountId: 'account-1', accessPolicyIds: ['policy-1', 'policy-2'] })
+      })
+
+      expect(mocks.updateUserAccessSettings).toHaveBeenCalledWith({
+        params: {
+          datasetId: 'dataset-1',
+          accountId: 'account-1',
+        },
+        body: {
+          access_policy_ids: ['policy-1', 'policy-2'],
+        },
+      })
+      expect(mocks.userAccessSettingsKey).toHaveBeenCalled()
+      expect(mocks.accessRulesKey).toHaveBeenCalled()
+    })
+
+    it('should remove dataset access policy member bindings for account ids', async () => {
+      const { result } = renderHook(() => useRemoveDatasetAccessPolicyMemberBindings('dataset-1'), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync({ accessPolicyId: 'policy-1', accountIds: ['account-1'] })
+      })
+
+      expect(mocks.removeMemberBindings).toHaveBeenCalledWith({
+        params: {
+          datasetId: 'dataset-1',
+          policyId: 'policy-1',
+        },
+        body: {
+          account_ids: ['account-1'],
+        },
+      })
+      expect(mocks.userAccessSettingsKey).toHaveBeenCalled()
+      expect(mocks.accessRulesKey).toHaveBeenCalled()
+    })
+
+    it('should update open scope for a dataset id', async () => {
+      const { result } = renderHook(() => useUpdateDatasetOpenScope('dataset-1'), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync('specific')
+      })
+
+      expect(mocks.updateOpenScope).toHaveBeenCalledWith({
+        params: {
+          datasetId: 'dataset-1',
+        },
+        body: {
+          scope: 'specific',
+        },
+      })
+      expect(mocks.userAccessSettingsKey).toHaveBeenCalled()
+    })
+  })
+})
diff --git a/web/service/access-control/__tests__/use-member-roles.spec.tsx b/web/service/access-control/__tests__/use-member-roles.spec.tsx
new file mode 100644
index 00000000000..57919ce919f
--- /dev/null
+++ b/web/service/access-control/__tests__/use-member-roles.spec.tsx
@@ -0,0 +1,79 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { act, renderHook, waitFor } from '@testing-library/react'
+import { get, put } from '@/service/base'
+import { commonQueryKeys } from '@/service/use-common'
+import { useRolesOfMember, useUpdateRolesOfMember } from '../use-member-roles'
+
+vi.mock('@/service/base', () => ({
+  get: vi.fn(),
+  put: vi.fn(),
+}))
+
+const createQueryClient = () => new QueryClient({
+  defaultOptions: {
+    queries: { retry: false },
+    mutations: { retry: false },
+  },
+})
+
+const createWrapper = (queryClient = createQueryClient()) => {
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+describe('use-member-roles', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(get).mockResolvedValue({ account_id: 'member-1', roles: [] })
+    vi.mocked(put).mockResolvedValue({})
+  })
+
+  // Queries load roles for one workspace member.
+  describe('Queries', () => {
+    it('should fetch roles for a member id', async () => {
+      renderHook(() => useRolesOfMember('member-1', 'en'), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/workspaces/current/rbac/members/member-1/rbac-roles', {
+          params: { language: 'en' },
+        })
+      })
+    })
+  })
+
+  // Mutations update role ids using the API contract body shape.
+  describe('Mutations', () => {
+    it('should update roles for a member id', async () => {
+      const { result } = renderHook(() => useUpdateRolesOfMember(), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync({
+          memberId: 'member-1',
+          roleIds: ['role-1'],
+        })
+      })
+
+      expect(put).toHaveBeenCalledWith('/workspaces/current/rbac/members/member-1/rbac-roles', {
+        body: { role_ids: ['role-1'] },
+      })
+    })
+
+    it('should invalidate members after updating roles', async () => {
+      const queryClient = createQueryClient()
+      const membersQueryKey = [...commonQueryKeys.members, 'en-US']
+      queryClient.setQueryData(membersQueryKey, { accounts: [] })
+      const { result } = renderHook(() => useUpdateRolesOfMember(), { wrapper: createWrapper(queryClient) })
+
+      await act(async () => {
+        await result.current.mutateAsync({
+          memberId: 'member-1',
+          roleIds: ['role-1'],
+        })
+      })
+
+      expect(queryClient.getQueryState(membersQueryKey)?.isInvalidated).toBe(true)
+    })
+  })
+})
diff --git a/web/service/access-control/__tests__/use-permission-catalog.spec.tsx b/web/service/access-control/__tests__/use-permission-catalog.spec.tsx
new file mode 100644
index 00000000000..5b32cfab300
--- /dev/null
+++ b/web/service/access-control/__tests__/use-permission-catalog.spec.tsx
@@ -0,0 +1,66 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { renderHook, waitFor } from '@testing-library/react'
+import { get } from '@/service/base'
+import {
+  useAppPermissionCatalog,
+  useDatasetPermissionCatalog,
+  useWorkspacePermissionCatalog,
+} from '../use-permission-catalog'
+
+vi.mock('@/service/base', () => ({
+  get: vi.fn(),
+}))
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+describe('use-permission-catalog', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(get).mockResolvedValue({ groups: [] })
+  })
+
+  // Permission catalogs use separate workspace/app/dataset endpoints.
+  describe('Queries', () => {
+    it('should fetch workspace permission catalog', async () => {
+      renderHook(() => useWorkspacePermissionCatalog(), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/workspaces/current/rbac/role-permissions/catalog')
+      })
+    })
+
+    it('should fetch app permission catalog when enabled', async () => {
+      renderHook(() => useAppPermissionCatalog(true), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/workspaces/current/rbac/role-permissions/catalog/app')
+      })
+    })
+
+    it('should fetch dataset permission catalog when enabled', async () => {
+      renderHook(() => useDatasetPermissionCatalog(true), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/workspaces/current/rbac/role-permissions/catalog/dataset')
+      })
+    })
+
+    it('should not fetch resource catalogs when disabled', () => {
+      renderHook(() => useAppPermissionCatalog(false), { wrapper: createWrapper() })
+      renderHook(() => useDatasetPermissionCatalog(false), { wrapper: createWrapper() })
+
+      expect(get).not.toHaveBeenCalled()
+    })
+  })
+})
diff --git a/web/service/access-control/__tests__/use-permission-keys.spec.tsx b/web/service/access-control/__tests__/use-permission-keys.spec.tsx
new file mode 100644
index 00000000000..1849a48a5ed
--- /dev/null
+++ b/web/service/access-control/__tests__/use-permission-keys.spec.tsx
@@ -0,0 +1,43 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { renderHook, waitFor } from '@testing-library/react'
+import { get } from '@/service/base'
+import { useWorkspacePermissionKeys } from '../use-permission-keys'
+
+vi.mock('@/service/base', () => ({
+  get: vi.fn(),
+}))
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+describe('useWorkspacePermissionKeys', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(get).mockResolvedValue({
+      workspace: { permission_keys: [] },
+      app: { default_permission_keys: [], overrides: [] },
+      dataset: { default_permission_keys: [], overrides: [] },
+    })
+  })
+
+  // Current-user permissions come from the my-permissions RBAC endpoint.
+  describe('Queries', () => {
+    it('should fetch workspace permission keys', async () => {
+      renderHook(() => useWorkspacePermissionKeys(), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/workspaces/current/rbac/my-permissions')
+      })
+    })
+  })
+})
diff --git a/web/service/access-control/__tests__/use-workspace-access-rules.spec.tsx b/web/service/access-control/__tests__/use-workspace-access-rules.spec.tsx
new file mode 100644
index 00000000000..e7b2ecdce33
--- /dev/null
+++ b/web/service/access-control/__tests__/use-workspace-access-rules.spec.tsx
@@ -0,0 +1,119 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { act, renderHook, waitFor } from '@testing-library/react'
+import { del, get, post, put } from '@/service/base'
+import {
+  useCopyAccessRule,
+  useCreateAccessRule,
+  useDeleteAccessRule,
+  useInfiniteWorkspaceAppAccessRules,
+  useInfiniteWorkspaceDatasetAccessRules,
+  useUpdateAccessRule,
+} from '../use-workspace-access-rules'
+
+vi.mock('@/service/base', () => ({
+  del: vi.fn(),
+  get: vi.fn(),
+  post: vi.fn(),
+  put: vi.fn(),
+}))
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+describe('use-workspace-access-rules', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(get).mockResolvedValue({ items: [], pagination: {} })
+    vi.mocked(post).mockResolvedValue({})
+    vi.mocked(put).mockResolvedValue({})
+    vi.mocked(del).mockResolvedValue({})
+  })
+
+  // Queries load workspace-level app and dataset access policies from separate endpoints.
+  describe('Queries', () => {
+    it('should fetch workspace app access rules', async () => {
+      renderHook(() => useInfiniteWorkspaceAppAccessRules({ page: 1, limit: 20, language: 'zh' }), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/workspaces/current/rbac/workspace/apps/access-policy', {
+          params: { page: 1, limit: 20, language: 'zh' },
+        })
+      })
+    })
+
+    it('should fetch workspace dataset access rules', async () => {
+      renderHook(() => useInfiniteWorkspaceDatasetAccessRules({ page: 1, limit: 20, language: 'ja' }), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(get).toHaveBeenCalledWith('/workspaces/current/rbac/workspace/datasets/access-policy', {
+          params: { page: 1, limit: 20, language: 'ja' },
+        })
+      })
+    })
+  })
+
+  // Rule mutations normalize form data to the API body expected by RBAC access policies.
+  describe('Rule Mutations', () => {
+    it('should create and update access rules', async () => {
+      const createHook = renderHook(() => useCreateAccessRule(), { wrapper: createWrapper() })
+      const updateHook = renderHook(() => useUpdateAccessRule(), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await createHook.result.current.mutateAsync({
+          resourceType: 'app',
+          name: 'App rule',
+          description: 'App access',
+          permission_keys: ['app.acl.edit'],
+        })
+        await updateHook.result.current.mutateAsync({
+          id: 'policy-1',
+          resourceType: 'dataset',
+          name: 'Dataset rule',
+          description: 'Dataset access',
+          permission_keys: ['dataset.acl.edit'],
+        })
+      })
+
+      expect(post).toHaveBeenCalledWith('/workspaces/current/rbac/access-policies', {
+        body: {
+          resource_type: 'app',
+          name: 'App rule',
+          description: 'App access',
+          permission_keys: ['app.acl.edit'],
+        },
+      })
+      expect(put).toHaveBeenCalledWith('/workspaces/current/rbac/access-policies/policy-1', {
+        body: {
+          id: 'policy-1',
+          name: 'Dataset rule',
+          description: 'Dataset access',
+          permission_keys: ['dataset.acl.edit'],
+        },
+      })
+    })
+
+    it('should copy and delete access rules by id', async () => {
+      const copyHook = renderHook(() => useCopyAccessRule('app'), { wrapper: createWrapper() })
+      const deleteHook = renderHook(() => useDeleteAccessRule('dataset'), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await copyHook.result.current.mutateAsync('policy-1')
+        await deleteHook.result.current.mutateAsync('policy-2')
+      })
+
+      expect(post).toHaveBeenCalledWith('/workspaces/current/rbac/access-policies/policy-1/copy', {})
+      expect(del).toHaveBeenCalledWith('/workspaces/current/rbac/access-policies/policy-2', {})
+    })
+  })
+})
diff --git a/web/service/access-control/__tests__/use-workspace-roles.spec.tsx b/web/service/access-control/__tests__/use-workspace-roles.spec.tsx
new file mode 100644
index 00000000000..866501da7c2
--- /dev/null
+++ b/web/service/access-control/__tests__/use-workspace-roles.spec.tsx
@@ -0,0 +1,192 @@
+import type { ReactNode } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { act, renderHook, waitFor } from '@testing-library/react'
+import { commonQueryKeys } from '../../use-common'
+import {
+  useCopyWorkspaceRole,
+  useCreateWorkspaceRole,
+  useDeleteWorkspaceRole,
+  useGetMembersOfRole,
+  useUpdateWorkspaceRole,
+  useWorkspaceRoleList,
+} from '../use-workspace-roles'
+
+const mockServiceBase = vi.hoisted(() => ({
+  del: vi.fn(),
+  get: vi.fn(),
+  post: vi.fn(),
+  put: vi.fn(),
+}))
+
+vi.mock('../../base', () => mockServiceBase)
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+}
+
+const createWrapperWithClient = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  })
+
+  const wrapper = ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  )
+
+  return {
+    queryClient,
+    wrapper,
+  }
+}
+
+const roleListResponse = {
+  data: [],
+  pagination: {
+    total_count: 0,
+    per_page: 20,
+    current_page: 1,
+    total_pages: 1,
+  },
+}
+
+describe('use-workspace-roles', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockServiceBase.get.mockResolvedValue(roleListResponse)
+    mockServiceBase.post.mockResolvedValue({})
+    mockServiceBase.put.mockResolvedValue({})
+    mockServiceBase.del.mockResolvedValue({})
+  })
+
+  // Role list pagination starts from the provided page and passes query params through.
+  describe('Queries', () => {
+    it('should fetch workspace roles with pagination params', async () => {
+      renderHook(() => useWorkspaceRoleList({ page: 2, limit: 20, language: 'zh' }), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(mockServiceBase.get).toHaveBeenCalledWith('/workspaces/current/rbac/roles', {
+          params: {
+            limit: 20,
+            language: 'zh',
+            page: 2,
+          },
+        })
+      })
+    })
+
+    it('should fetch members assigned to a workspace role with pagination params', async () => {
+      renderHook(() => useGetMembersOfRole({ roleId: 'role-1', page: 2, limit: 1 }), { wrapper: createWrapper() })
+
+      await waitFor(() => {
+        expect(mockServiceBase.get).toHaveBeenCalledWith('/workspaces/current/rbac/roles/role-1/members', {
+          params: {
+            page: 2,
+            limit: 1,
+          },
+        })
+      })
+    })
+  })
+
+  // Role mutations call the expected RBAC role management endpoints.
+  describe('Mutations', () => {
+    it('should create a workspace role', async () => {
+      const { result } = renderHook(() => useCreateWorkspaceRole(), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync({
+          name: 'Support',
+          description: 'Support role',
+          permission_keys: ['workspace.member.manage'],
+        })
+      })
+
+      expect(mockServiceBase.post).toHaveBeenCalledWith('/workspaces/current/rbac/roles', {
+        body: {
+          name: 'Support',
+          description: 'Support role',
+          permission_keys: ['workspace.member.manage'],
+        },
+      })
+    })
+
+    it('should update a workspace role', async () => {
+      const { result } = renderHook(() => useUpdateWorkspaceRole(), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await result.current.mutateAsync({
+          id: 'role-1',
+          name: 'Support',
+          description: 'Support role',
+          permission_keys: [],
+        })
+      })
+
+      expect(mockServiceBase.put).toHaveBeenCalledWith('/workspaces/current/rbac/roles/role-1', {
+        body: {
+          id: 'role-1',
+          name: 'Support',
+          description: 'Support role',
+          permission_keys: [],
+        },
+      })
+    })
+
+    it('should delete and copy workspace roles by id', async () => {
+      const deleteHook = renderHook(() => useDeleteWorkspaceRole(), { wrapper: createWrapper() })
+      const copyHook = renderHook(() => useCopyWorkspaceRole(), { wrapper: createWrapper() })
+
+      await act(async () => {
+        await deleteHook.result.current.mutateAsync('role-1')
+        await copyHook.result.current.mutateAsync({
+          roleId: 'role-2',
+          copy_member: false,
+        })
+      })
+
+      expect(mockServiceBase.del).toHaveBeenCalledWith('/workspaces/current/rbac/roles/role-1')
+      expect(mockServiceBase.post).toHaveBeenCalledWith('/workspaces/current/rbac/roles/role-2/copy', {
+        body: { copy_member: false },
+      })
+    })
+
+    it('should invalidate members after deleting a workspace role', async () => {
+      const { queryClient, wrapper } = createWrapperWithClient()
+      queryClient.setQueryData(commonQueryKeys.members, { accounts: [] })
+      const { result } = renderHook(() => useDeleteWorkspaceRole(), { wrapper })
+
+      await act(async () => {
+        await result.current.mutateAsync('role-1')
+      })
+
+      expect(queryClient.getQueryState(commonQueryKeys.members)?.isInvalidated).toBe(true)
+    })
+
+    it('should invalidate members after copying a workspace role with member assignments', async () => {
+      const { queryClient, wrapper } = createWrapperWithClient()
+      queryClient.setQueryData(commonQueryKeys.members, { accounts: [] })
+      const { result } = renderHook(() => useCopyWorkspaceRole(), { wrapper })
+
+      await act(async () => {
+        await result.current.mutateAsync({
+          roleId: 'role-1',
+          copy_member: true,
+        })
+      })
+
+      expect(queryClient.getQueryState(commonQueryKeys.members)?.isInvalidated).toBe(true)
+    })
+  })
+})
diff --git a/web/service/access-control/use-app-access-config.ts b/web/service/access-control/use-app-access-config.ts
new file mode 100644
index 00000000000..79f9426f279
--- /dev/null
+++ b/web/service/access-control/use-app-access-config.ts
@@ -0,0 +1,113 @@
+import type { AccessControlTemplateLanguage } from '@/i18n-config/language'
+import type {
+  RemoveAppAccessPolicyMemberBindingsRequest,
+  ResourceOpenScope,
+  UpdateAppUserAccessSettingsRequest,
+} from '@/models/access-control'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { consoleClient, consoleQuery } from '@/service/client'
+
+const NAME_SPACE = 'app-access-config'
+
+export const useAppAccessRules = (appId: string, language: AccessControlTemplateLanguage) => {
+  return useQuery(consoleQuery.rbacAccessConfig.apps.accessRules.queryOptions({
+    input: {
+      params: {
+        appId,
+      },
+      query: {
+        language,
+      },
+    },
+  }))
+}
+
+export const useAppUserAccessSettings = (appId: string, language: AccessControlTemplateLanguage) => {
+  return useQuery(consoleQuery.rbacAccessConfig.apps.userAccessSettings.queryOptions({
+    input: {
+      params: {
+        appId,
+      },
+      query: {
+        language,
+      },
+    },
+  }))
+}
+
+export const useUpdateAppUserAccessSettings = (appId: string) => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'update-app-user-access-settings', appId],
+    mutationFn: (payload: UpdateAppUserAccessSettingsRequest) => consoleClient.rbacAccessConfig.apps.updateUserAccessSettings({
+      params: {
+        appId,
+        accountId: payload.accountId,
+      },
+      body: {
+        access_policy_ids: payload.accessPolicyIds,
+      },
+    }),
+    onSuccess: async () => {
+      await Promise.all([
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.apps.userAccessSettings.key(),
+        }),
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.apps.accessRules.key(),
+        }),
+      ])
+    },
+  })
+}
+
+export const useRemoveAppAccessPolicyMemberBindings = (appId: string) => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'remove-app-access-policy-member-bindings', appId],
+    mutationFn: (payload: RemoveAppAccessPolicyMemberBindingsRequest) => consoleClient.rbacAccessConfig.apps.removeMemberBindings({
+      params: {
+        appId,
+        policyId: payload.accessPolicyId,
+      },
+      body: {
+        account_ids: payload.accountIds,
+      },
+    }),
+    onSuccess: async () => {
+      await Promise.all([
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.apps.userAccessSettings.key(),
+        }),
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.apps.accessRules.key(),
+        }),
+      ])
+    },
+  })
+}
+
+export const useUpdateAppOpenScope = (appId: string) => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'update-app-open-scope', appId],
+    mutationFn: (openScope: ResourceOpenScope) => consoleClient.rbacAccessConfig.apps.updateOpenScope({
+      params: {
+        appId,
+      },
+      body: {
+        scope: openScope,
+      },
+    }),
+    onSuccess: async () => {
+      await Promise.all([
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.apps.userAccessSettings.key(),
+        }),
+      ])
+    },
+  })
+}
diff --git a/web/service/access-control.ts b/web/service/access-control/use-app-access-control.ts
similarity index 60%
rename from web/service/access-control.ts
rename to web/service/access-control/use-app-access-control.ts
index 40ef1cfdea7..aafe53ec0f8 100644
--- a/web/service/access-control.ts
+++ b/web/service/access-control/use-app-access-control.ts
@@ -1,9 +1,8 @@
-import type { AccessControlAccount, AccessControlGroup, AccessMode, Subject } from '@/models/access-control'
-import type { App } from '@/types/app'
-import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import type { AccessControlAccount, AccessControlGroup, Subject } from '@/models/access-control'
+import { useInfiniteQuery, useQuery } from '@tanstack/react-query'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
-import { get, post } from './base'
-import { getUserCanAccess } from './share'
+import { get } from '../base'
+import { getUserCanAccess } from '../share'
 
 const NAME_SPACE = 'access-control'
 
@@ -24,16 +23,25 @@ type SearchResults = {
   hasMore: boolean
 }
 
-export const useSearchForWhiteListCandidates = (query: { keyword?: string, groupId?: AccessControlGroup['id'], resultsPerPage?: number }, enabled: boolean) => {
+type SearchForWhiteListCandidatesQuery = {
+  keyword?: string
+  groupId?: AccessControlGroup['id']
+  resultsPerPage?: number
+}
+
+export const useSearchForWhiteListCandidates = (query: SearchForWhiteListCandidatesQuery, enabled: boolean) => {
+  const { keyword, groupId, resultsPerPage } = query
+
   return useInfiniteQuery({
-    queryKey: [NAME_SPACE, 'app-whitelist-candidates', query],
+    queryKey: [NAME_SPACE, 'app-whitelist-candidates', keyword, groupId, resultsPerPage],
     queryFn: ({ pageParam }) => {
       const params = new URLSearchParams()
-      Object.keys(query).forEach((key) => {
-        const typedKey = key as keyof typeof query
-        if (query[typedKey])
-          params.append(key, `${query[typedKey]}`)
-      })
+      if (keyword)
+        params.append('keyword', keyword)
+      if (groupId)
+        params.append('groupId', groupId)
+      if (resultsPerPage)
+        params.append('resultsPerPage', `${resultsPerPage}`)
       params.append('pageNumber', `${pageParam}`)
       return get<SearchResults>(`/enterprise/webapp/app/subject/search?${new URLSearchParams(params).toString()}`)
     },
@@ -49,27 +57,6 @@ export const useSearchForWhiteListCandidates = (query: { keyword?: string, group
   })
 }
 
-type UpdateAccessModeParams = {
-  appId: App['id']
-  subjects?: Pick<Subject, 'subjectId' | 'subjectType'>[]
-  accessMode: AccessMode
-}
-
-export const useUpdateAccessMode = () => {
-  const queryClient = useQueryClient()
-  return useMutation({
-    mutationKey: [NAME_SPACE, 'update-access-mode'],
-    mutationFn: (params: UpdateAccessModeParams) => {
-      return post('/enterprise/webapp/app/access-mode', { body: params })
-    },
-    onSuccess: () => {
-      queryClient.invalidateQueries({
-        queryKey: [NAME_SPACE, 'app-whitelist-subjects'],
-      })
-    },
-  })
-}
-
 export const useGetUserCanAccessApp = ({ appId, isInstalledApp = true, enabled }: { appId?: string, isInstalledApp?: boolean, enabled?: boolean }) => {
   // useQuery (not useSuspenseQuery) to keep this service hook's call contract
   // unchanged from the zustand era: callers should not need a Suspense boundary.
diff --git a/web/service/access-control/use-dataset-access-config.ts b/web/service/access-control/use-dataset-access-config.ts
new file mode 100644
index 00000000000..36f3727daf9
--- /dev/null
+++ b/web/service/access-control/use-dataset-access-config.ts
@@ -0,0 +1,123 @@
+import type { AccessControlTemplateLanguage } from '@/i18n-config/language'
+import type {
+  RemoveDatasetAccessPolicyMemberBindingsRequest,
+  ResourceOpenScope,
+  UpdateDatasetUserAccessSettingsRequest,
+} from '@/models/access-control'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { consoleClient, consoleQuery } from '@/service/client'
+
+const NAME_SPACE = 'dataset-access-config'
+
+type DatasetAccessConfigQueryOptions = {
+  enabled?: boolean
+}
+
+export const useDatasetAccessRules = (datasetId: string, language: AccessControlTemplateLanguage, options?: DatasetAccessConfigQueryOptions) => {
+  return useQuery({
+    ...consoleQuery.rbacAccessConfig.datasets.accessRules.queryOptions({
+      input: {
+        params: {
+          datasetId,
+        },
+        query: {
+          language,
+        },
+      },
+    }),
+    enabled: options?.enabled ?? true,
+  })
+}
+
+export const useDatasetUserAccessSettings = (datasetId: string, language: AccessControlTemplateLanguage, options?: DatasetAccessConfigQueryOptions) => {
+  return useQuery({
+    ...consoleQuery.rbacAccessConfig.datasets.userAccessSettings.queryOptions({
+      input: {
+        params: {
+          datasetId,
+        },
+        query: {
+          language,
+        },
+      },
+    }),
+    enabled: options?.enabled ?? true,
+  })
+}
+
+export const useUpdateDatasetUserAccessSettings = (datasetId: string) => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'update-dataset-user-access-settings', datasetId],
+    mutationFn: (payload: UpdateDatasetUserAccessSettingsRequest) => consoleClient.rbacAccessConfig.datasets.updateUserAccessSettings({
+      params: {
+        datasetId,
+        accountId: payload.accountId,
+      },
+      body: {
+        access_policy_ids: payload.accessPolicyIds,
+      },
+    }),
+    onSuccess: async () => {
+      await Promise.all([
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.datasets.userAccessSettings.key(),
+        }),
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.datasets.accessRules.key(),
+        }),
+      ])
+    },
+  })
+}
+
+export const useRemoveDatasetAccessPolicyMemberBindings = (datasetId: string) => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'remove-dataset-access-policy-member-bindings', datasetId],
+    mutationFn: (payload: RemoveDatasetAccessPolicyMemberBindingsRequest) => consoleClient.rbacAccessConfig.datasets.removeMemberBindings({
+      params: {
+        datasetId,
+        policyId: payload.accessPolicyId,
+      },
+      body: {
+        account_ids: payload.accountIds,
+      },
+    }),
+    onSuccess: async () => {
+      await Promise.all([
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.datasets.userAccessSettings.key(),
+        }),
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.datasets.accessRules.key(),
+        }),
+      ])
+    },
+  })
+}
+
+export const useUpdateDatasetOpenScope = (datasetId: string) => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'update-dataset-open-scope', datasetId],
+    mutationFn: (openScope: ResourceOpenScope) => consoleClient.rbacAccessConfig.datasets.updateOpenScope({
+      params: {
+        datasetId,
+      },
+      body: {
+        scope: openScope,
+      },
+    }),
+    onSuccess: async () => {
+      await Promise.all([
+        queryClient.invalidateQueries({
+          queryKey: consoleQuery.rbacAccessConfig.datasets.userAccessSettings.key(),
+        }),
+      ])
+    },
+  })
+}
diff --git a/web/service/access-control/use-member-roles.ts b/web/service/access-control/use-member-roles.ts
new file mode 100644
index 00000000000..265db742b0e
--- /dev/null
+++ b/web/service/access-control/use-member-roles.ts
@@ -0,0 +1,36 @@
+import type { AccessControlTemplateLanguage } from '@/i18n-config/language'
+import type { RolesOfMemberResponse, UpdateRolesOfMemberRequest } from '@/models/access-control'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { get, put } from '../base'
+import { commonQueryKeys } from '../use-common'
+
+const NAME_SPACE = 'rbac-member-roles'
+
+export const useRolesOfMember = (memberId: string, language: AccessControlTemplateLanguage) => {
+  return useQuery({
+    queryKey: [NAME_SPACE, 'member-roles', memberId, language],
+    queryFn: () => get<RolesOfMemberResponse>(`/workspaces/current/rbac/members/${memberId}/rbac-roles`, {
+      params: {
+        language,
+      },
+    }),
+  })
+}
+
+export const useUpdateRolesOfMember = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'update-member-roles'],
+    mutationFn: (request: UpdateRolesOfMemberRequest) => {
+      const { memberId, roleIds } = request
+      return put<RolesOfMemberResponse>(`/workspaces/current/rbac/members/${memberId}/rbac-roles`, {
+        body: { role_ids: roleIds },
+      })
+    },
+    onSuccess: (_, { memberId }) => Promise.all([
+      queryClient.invalidateQueries({ queryKey: [NAME_SPACE, 'member-roles', memberId] }),
+      queryClient.invalidateQueries({ queryKey: commonQueryKeys.members }),
+    ]),
+  })
+}
diff --git a/web/service/access-control/use-permission-catalog.ts b/web/service/access-control/use-permission-catalog.ts
new file mode 100644
index 00000000000..f6b6602d0ee
--- /dev/null
+++ b/web/service/access-control/use-permission-catalog.ts
@@ -0,0 +1,30 @@
+import type {
+  PermissionGroups,
+} from '@/models/access-control'
+import { useQuery } from '@tanstack/react-query'
+import { get } from '../base'
+
+const NAME_SPACE = 'rbac-permission-catalog'
+
+export const useWorkspacePermissionCatalog = () => {
+  return useQuery({
+    queryKey: [NAME_SPACE, 'workspace'],
+    queryFn: () => get<PermissionGroups>('/workspaces/current/rbac/role-permissions/catalog'),
+  })
+}
+
+export const useAppPermissionCatalog = (enabled?: boolean) => {
+  return useQuery({
+    queryKey: [NAME_SPACE, 'app'],
+    queryFn: () => get<PermissionGroups>('/workspaces/current/rbac/role-permissions/catalog/app'),
+    enabled: enabled ?? true,
+  })
+}
+
+export const useDatasetPermissionCatalog = (enabled?: boolean) => {
+  return useQuery({
+    queryKey: [NAME_SPACE, 'dataset'],
+    queryFn: () => get<PermissionGroups>('/workspaces/current/rbac/role-permissions/catalog/dataset'),
+    enabled: enabled ?? true,
+  })
+}
diff --git a/web/service/access-control/use-permission-keys.ts b/web/service/access-control/use-permission-keys.ts
new file mode 100644
index 00000000000..af19cf3e840
--- /dev/null
+++ b/web/service/access-control/use-permission-keys.ts
@@ -0,0 +1,12 @@
+import type { PermissionKeysResponse } from '@/models/access-control'
+import { useQuery } from '@tanstack/react-query'
+import { get } from '../base'
+
+const NAME_SPACE = 'workspace-permission-keys'
+
+export const useWorkspacePermissionKeys = () => {
+  return useQuery({
+    queryKey: [NAME_SPACE],
+    queryFn: () => get<PermissionKeysResponse>('/workspaces/current/rbac/my-permissions'),
+  })
+}
diff --git a/web/service/access-control/use-workspace-access-rules.ts b/web/service/access-control/use-workspace-access-rules.ts
new file mode 100644
index 00000000000..8d07cd824f5
--- /dev/null
+++ b/web/service/access-control/use-workspace-access-rules.ts
@@ -0,0 +1,139 @@
+import type {
+  AccessPolicy,
+  AccessPolicyResourceType,
+  CreateAccessPolicyRequest,
+  GetAppAccessPoliciesResponse,
+  GetDatasetAccessPoliciesResponse,
+  UpdateAccessPolicyRequest,
+  WorkspaceAccessRulesRequest,
+} from '@/models/access-control'
+import type { CommonResponse } from '@/models/common'
+import { useInfiniteQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import { del, get, post, put } from '../base'
+
+const NAME_SPACE = 'workspace-access-rules'
+
+type WorkspaceAccessRulesQueryParams = Omit<WorkspaceAccessRulesRequest, 'page'>
+
+const workspaceAccessRulesQueryKeys = {
+  app: (params?: WorkspaceAccessRulesQueryParams) => params ? [NAME_SPACE, 'app', params] as const : [NAME_SPACE, 'app'] as const,
+  dataset: (params?: WorkspaceAccessRulesQueryParams) => params ? [NAME_SPACE, 'dataset', params] as const : [NAME_SPACE, 'dataset'] as const,
+}
+
+export const useInfiniteWorkspaceAppAccessRules = (params: WorkspaceAccessRulesRequest = {}) => {
+  const { page = 1, ...queryParams } = params
+
+  return useInfiniteQuery({
+    queryKey: workspaceAccessRulesQueryKeys.app(queryParams),
+    queryFn: ({ pageParam }) => get<GetAppAccessPoliciesResponse>('/workspaces/current/rbac/workspace/apps/access-policy', {
+      params: {
+        ...queryParams,
+        page: pageParam,
+      },
+    }),
+    initialPageParam: page,
+    getNextPageParam: (lastPage) => {
+      const { current_page, total_pages } = lastPage.pagination
+
+      if (current_page < total_pages)
+        return current_page + 1
+
+      return undefined
+    },
+  })
+}
+
+export const useInfiniteWorkspaceDatasetAccessRules = (params: WorkspaceAccessRulesRequest = {}) => {
+  const { page = 1, ...queryParams } = params
+
+  return useInfiniteQuery({
+    queryKey: workspaceAccessRulesQueryKeys.dataset(queryParams),
+    queryFn: ({ pageParam }) => get<GetDatasetAccessPoliciesResponse>('/workspaces/current/rbac/workspace/datasets/access-policy', {
+      params: {
+        ...queryParams,
+        page: pageParam,
+      },
+    }),
+    initialPageParam: page,
+    getNextPageParam: (lastPage) => {
+      const { current_page, total_pages } = lastPage.pagination
+
+      if (current_page < total_pages)
+        return current_page + 1
+
+      return undefined
+    },
+  })
+}
+
+export const useCreateAccessRule = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'create'],
+    mutationFn: (data: CreateAccessPolicyRequest & { resourceType: AccessPolicyResourceType }) => {
+      const { name, description, permission_keys, resourceType } = data
+      return post<AccessPolicy>('/workspaces/current/rbac/access-policies', {
+        body: {
+          resource_type: resourceType,
+          name,
+          description,
+          permission_keys,
+        },
+      })
+    },
+    onSuccess: (_, { resourceType }) => {
+      queryClient.invalidateQueries({ queryKey: resourceType === 'app' ? workspaceAccessRulesQueryKeys.app() : workspaceAccessRulesQueryKeys.dataset() })
+    },
+  })
+}
+
+export const useUpdateAccessRule = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'update'],
+    mutationFn: (data: UpdateAccessPolicyRequest & { resourceType: AccessPolicyResourceType }) => {
+      const { id, name, description, permission_keys } = data
+      return put<AccessPolicy>(`/workspaces/current/rbac/access-policies/${id}`, {
+        body: {
+          id,
+          name,
+          description,
+          permission_keys,
+        },
+      })
+    },
+    onSuccess: (_, { resourceType }) => {
+      queryClient.invalidateQueries({ queryKey: resourceType === 'app' ? workspaceAccessRulesQueryKeys.app() : workspaceAccessRulesQueryKeys.dataset() })
+    },
+  })
+}
+
+export const useCopyAccessRule = (resourceType: AccessPolicyResourceType) => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'copy', resourceType],
+    mutationFn: (id: string) => {
+      return post<AccessPolicy>(`/workspaces/current/rbac/access-policies/${id}/copy`, {})
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: resourceType === 'app' ? workspaceAccessRulesQueryKeys.app() : workspaceAccessRulesQueryKeys.dataset() })
+    },
+  })
+}
+
+export const useDeleteAccessRule = (resourceType: AccessPolicyResourceType) => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'delete', resourceType],
+    mutationFn: (id: string) => {
+      return del<CommonResponse>(`/workspaces/current/rbac/access-policies/${id}`, {})
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: resourceType === 'app' ? workspaceAccessRulesQueryKeys.app() : workspaceAccessRulesQueryKeys.dataset() })
+    },
+  })
+}
diff --git a/web/service/access-control/use-workspace-roles.ts b/web/service/access-control/use-workspace-roles.ts
new file mode 100644
index 00000000000..bff4a0d3101
--- /dev/null
+++ b/web/service/access-control/use-workspace-roles.ts
@@ -0,0 +1,118 @@
+import type {
+  CopyWorkspaceRoleRequest,
+  CreateRoleRequest,
+  GetMembersOfRoleRequest,
+  GetMembersOfRoleResponse,
+  Role,
+  RoleListRequest,
+  RoleListResponse,
+  UpdateRolesRequest,
+} from '@/models/access-control'
+import type { CommonResponse } from '@/models/common'
+import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { del, get, post, put } from '../base'
+import { commonQueryKeys } from '../use-common'
+
+const NAME_SPACE = 'rbac-role-management'
+
+export const useWorkspaceRoleList = (params: RoleListRequest) => {
+  const { page = 1, ...queryParams } = params
+
+  return useInfiniteQuery({
+    queryKey: [NAME_SPACE, 'workspace-role-list', queryParams],
+    queryFn: ({ pageParam }) => get<RoleListResponse>('/workspaces/current/rbac/roles', {
+      params: {
+        ...queryParams,
+        page: pageParam,
+      },
+    }),
+    initialPageParam: page,
+    getNextPageParam: (lastPage) => {
+      const { current_page, total_pages } = lastPage.pagination
+
+      if (current_page < total_pages)
+        return current_page + 1
+
+      return undefined
+    },
+  })
+}
+
+export const useCreateWorkspaceRole = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'create-workspace-role'],
+    mutationFn: (data: CreateRoleRequest) =>
+      post<Role>('/workspaces/current/rbac/roles', {
+        body: { ...data },
+      }),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: [NAME_SPACE, 'workspace-role-list'] })
+    },
+  })
+}
+
+export const useUpdateWorkspaceRole = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'update-workspace-role'],
+    mutationFn: (data: UpdateRolesRequest) =>
+      put<Role>(`/workspaces/current/rbac/roles/${data.id}`, {
+        body: { ...data },
+      }),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: [NAME_SPACE, 'workspace-role-list'] })
+    },
+  })
+}
+
+export const useDeleteWorkspaceRole = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'delete-workspace-role'],
+    mutationFn: (id: string) =>
+      del<CommonResponse>(`/workspaces/current/rbac/roles/${id}`),
+    onSuccess: () => Promise.all([
+      queryClient.invalidateQueries({ queryKey: [NAME_SPACE, 'workspace-role-list'] }),
+      queryClient.invalidateQueries({ queryKey: commonQueryKeys.members }),
+    ]),
+  })
+}
+
+export const useCopyWorkspaceRole = () => {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationKey: [NAME_SPACE, 'copy-workspace-role'],
+    mutationFn: ({ roleId, copy_member }: CopyWorkspaceRoleRequest) =>
+      post<Role>(`/workspaces/current/rbac/roles/${roleId}/copy`, {
+        body: { copy_member },
+      }),
+    onSuccess: (_role, variables) => {
+      const invalidations = [
+        queryClient.invalidateQueries({ queryKey: [NAME_SPACE, 'workspace-role-list'] }),
+      ]
+
+      if (variables.copy_member)
+        invalidations.push(queryClient.invalidateQueries({ queryKey: commonQueryKeys.members }))
+
+      return Promise.all(invalidations)
+    },
+  })
+}
+
+export const useGetMembersOfRole = (params: GetMembersOfRoleRequest) => {
+  const { roleId, ...paginationParams } = params
+  return useQuery({
+    queryKey: [NAME_SPACE, 'members-of-role', roleId, paginationParams],
+    queryFn: () => get<GetMembersOfRoleResponse>(`/workspaces/current/rbac/roles/${roleId}/members`, {
+      params: {
+        ...paginationParams,
+      },
+    }),
+    enabled: !!roleId,
+  })
+}
diff --git a/web/service/apps.ts b/web/service/apps.ts
index d8e5e2136bb..8b6ca176486 100644
--- a/web/service/apps.ts
+++ b/web/service/apps.ts
@@ -96,8 +96,8 @@ export const importDSLConfirm = ({ import_id }: { import_id: string }): Promise<
   return post<DSLImportResponse>(`apps/imports/${import_id}/confirm`, { body: {} })
 }
 
-export const switchApp = ({ appID, name, icon_type, icon, icon_background }: { appID: string, name: string, icon_type: AppIconType, icon: string, icon_background?: string | null }): Promise<{ new_app_id: string }> => {
-  return post<{ new_app_id: string }>(`apps/${appID}/convert-to-workflow`, { body: { name, icon_type, icon, icon_background } })
+export const switchApp = ({ appID, name, icon_type, icon, icon_background }: { appID: string, name: string, icon_type: AppIconType, icon: string, icon_background?: string | null }): Promise<{ new_app_id: string, permission_keys: string[] }> => {
+  return post<{ new_app_id: string, permission_keys: string[] }>(`apps/${appID}/convert-to-workflow`, { body: { name, icon_type, icon, icon_background } })
 }
 
 export const deleteApp = (appID: string): Promise<CommonResponse> => {
diff --git a/web/service/base.ts b/web/service/base.ts
index 9bd7be87042..9dd15d66ea4 100644
--- a/web/service/base.ts
+++ b/web/service/base.ts
@@ -509,6 +509,7 @@ export const ssePost = async (
       [PASSPORT_HEADER_NAME]: getWebAppPassport(shareCode!),
     }),
   } as RequestInit, fetchOptions)
+  options.headers = new Headers(options.headers)
 
   const contentType = (options.headers as Headers).get('Content-Type')
   if (!contentType)
@@ -660,6 +661,7 @@ export const sseGet = async (
       [PASSPORT_HEADER_NAME]: getWebAppPassport(shareCode!),
     }),
   } as RequestInit, fetchOptions)
+  options.headers = new Headers(options.headers)
 
   const contentType = (options.headers as Headers).get('Content-Type')
   if (!contentType)
diff --git a/web/service/client.spec.ts b/web/service/client.spec.ts
index de48850c86e..414cf37d325 100644
--- a/web/service/client.spec.ts
+++ b/web/service/client.spec.ts
@@ -1,5 +1,6 @@
 import type { ApiBasedExtensionResponse } from '@dify/contracts/api/console/api-based-extension/types.gen'
 import type { MutationFunctionContext } from '@tanstack/react-query'
+import type { consoleQuery as ConsoleQuery } from './client'
 import type { Tag } from '@/contract/console/tags'
 import { QueryClient } from '@tanstack/react-query'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -43,6 +44,43 @@ const createApiBasedExtension = (overrides: Partial<ApiBasedExtensionResponse> =
   ...overrides,
 })
 
+type AgentMutationResponse = Parameters<NonNullable<ReturnType<typeof ConsoleQuery.agent.post.mutationOptions>['onSuccess']>>[0]
+type AgentComposerMutationResponse = Parameters<NonNullable<ReturnType<typeof ConsoleQuery.agent.byAgentId.composer.put.mutationOptions>['onSuccess']>>[0]
+
+const createAgent = (overrides: Partial<AgentMutationResponse> = {}): AgentMutationResponse => ({
+  ...overrides,
+  active_config_is_published: overrides.active_config_is_published ?? false,
+  enable_api: overrides.enable_api ?? true,
+  enable_site: overrides.enable_site ?? true,
+  description: overrides.description ?? 'Agent description',
+  id: overrides.id ?? 'agent-1',
+  icon_url: overrides.icon_url ?? null,
+  mode: overrides.mode ?? 'agent',
+  name: overrides.name ?? 'Agent',
+  role: overrides.role ?? 'Assistant',
+})
+
+const createComposerState = (overrides: Partial<AgentComposerMutationResponse> = {}): AgentComposerMutationResponse => ({
+  active_config_snapshot: {
+    id: 'snapshot-1',
+    version: 1,
+  },
+  agent: {
+    active_config_snapshot_id: 'snapshot-1',
+    description: 'Agent description',
+    id: 'agent-1',
+    name: 'Agent',
+    scope: 'roster',
+    status: 'active',
+  },
+  agent_soul: {
+    schema_version: 1,
+  },
+  save_options: ['save_to_current_version', 'save_as_new_version'],
+  variant: 'agent_app',
+  ...overrides,
+})
+
 // Scenario: base URL selection and warnings.
 describe('getBaseURL', () => {
   beforeEach(() => {
@@ -112,6 +150,246 @@ describe('getBaseURL', () => {
   })
 })
 
+// Scenario: oRPC mutation defaults own shared Agent roster cache behavior.
+describe('consoleQuery agent mutation defaults', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('should invalidate roster and invite option lists after creating an agent', async () => {
+    const consoleQuery = await loadConsoleQuery()
+    const queryClient = new QueryClient()
+    const invalidateQueries = vi.spyOn(queryClient, 'invalidateQueries')
+    const createdAgent = createAgent()
+
+    const mutationOptions = consoleQuery.agent.post.mutationOptions()
+    await mutationOptions.onSuccess?.(
+      createdAgent,
+      {
+        body: {
+          name: createdAgent.name,
+          description: createdAgent.description,
+          role: createdAgent.role ?? 'Assistant',
+        },
+      },
+      undefined,
+      createMutationContext(queryClient),
+    )
+
+    expect(invalidateQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.get.key(),
+    })
+    expect(invalidateQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.inviteOptions.get.key(),
+    })
+  })
+
+  it('should cache copied agent detail and invalidate roster lists after copying an agent', async () => {
+    const consoleQuery = await loadConsoleQuery()
+    const queryClient = new QueryClient()
+    const invalidateQueries = vi.spyOn(queryClient, 'invalidateQueries')
+    const copiedAgent = createAgent({ id: 'copied-agent', name: 'Agent copy' })
+
+    const mutationOptions = consoleQuery.agent.byAgentId.copy.post.mutationOptions()
+    await mutationOptions.onSuccess?.(
+      copiedAgent,
+      {
+        params: {
+          agent_id: 'source-agent',
+        },
+        body: {},
+      },
+      undefined,
+      createMutationContext(queryClient),
+    )
+
+    expect(queryClient.getQueryData(consoleQuery.agent.byAgentId.get.queryKey({
+      input: {
+        params: {
+          agent_id: copiedAgent.id,
+        },
+      },
+    }))).toEqual(copiedAgent)
+    expect(invalidateQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.get.key(),
+    })
+    expect(invalidateQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.inviteOptions.get.key(),
+    })
+  })
+
+  it('should invalidate invite option lists after updating an agent', async () => {
+    const consoleQuery = await loadConsoleQuery()
+    const queryClient = new QueryClient()
+    const invalidateQueries = vi.spyOn(queryClient, 'invalidateQueries')
+    const updatedAgent = createAgent({ name: 'Updated Agent' })
+
+    const mutationOptions = consoleQuery.agent.byAgentId.put.mutationOptions()
+    await mutationOptions.onSuccess?.(
+      updatedAgent,
+      {
+        params: {
+          agent_id: updatedAgent.id,
+        },
+        body: {
+          name: updatedAgent.name,
+          role: updatedAgent.role ?? 'Assistant',
+        },
+      },
+      undefined,
+      createMutationContext(queryClient),
+    )
+
+    expect(invalidateQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.inviteOptions.get.key(),
+    })
+  })
+
+  it('should invalidate roster and invite option lists after publishing an agent config', async () => {
+    const consoleQuery = await loadConsoleQuery()
+    const queryClient = new QueryClient()
+    const invalidateQueries = vi.spyOn(queryClient, 'invalidateQueries')
+    const removeQueries = vi.spyOn(queryClient, 'removeQueries')
+    const inviteOptionsQueryKey = consoleQuery.agent.inviteOptions.get.queryKey({
+      input: {
+        query: {
+          app_id: 'app-1',
+          limit: 8,
+          page: 1,
+        },
+      },
+    })
+    queryClient.setQueryData(inviteOptionsQueryKey, {
+      data: [
+        {
+          active_config_is_published: true,
+          active_config_snapshot: null,
+          active_config_snapshot_id: 'snapshot-1',
+          agent_kind: 'dify_agent',
+          app_id: null,
+          archived_at: null,
+          archived_by: null,
+          created_at: 1,
+          created_by: null,
+          description: 'Agent description',
+          existing_node_ids: [],
+          icon: null,
+          icon_background: null,
+          icon_type: null,
+          id: 'agent-1',
+          in_current_workflow_count: 0,
+          is_in_current_workflow: false,
+          name: 'Agent',
+          published_node_reference_count: 0,
+          published_reference_count: 0,
+          published_references: [],
+          role: '',
+          scope: 'roster',
+          source: 'workflow',
+          status: 'active',
+          updated_at: 1,
+          updated_by: null,
+          workflow_id: null,
+          workflow_node_id: null,
+        },
+      ],
+      has_more: false,
+      limit: 8,
+      page: 1,
+      total: 1,
+    })
+
+    const mutationOptions = consoleQuery.agent.byAgentId.composer.put.mutationOptions()
+    await mutationOptions.onSuccess?.(
+      createComposerState(),
+      {
+        params: {
+          agent_id: 'agent-1',
+        },
+        body: {
+          variant: 'agent_app',
+          save_strategy: 'save_as_new_version',
+          agent_soul: {
+            schema_version: 1,
+          },
+        },
+      },
+      undefined,
+      createMutationContext(queryClient),
+    )
+
+    expect(invalidateQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.get.key(),
+    })
+    expect(invalidateQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.inviteOptions.get.key(),
+    })
+    expect(removeQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.inviteOptions.get.key(),
+    })
+    expect(queryClient.getQueryData(inviteOptionsQueryKey)).toBeUndefined()
+  })
+
+  it('should keep roster and invite option lists stable after saving an agent draft', async () => {
+    const consoleQuery = await loadConsoleQuery()
+    const queryClient = new QueryClient()
+    const invalidateQueries = vi.spyOn(queryClient, 'invalidateQueries')
+
+    const mutationOptions = consoleQuery.agent.byAgentId.composer.put.mutationOptions()
+    await mutationOptions.onSuccess?.(
+      createComposerState(),
+      {
+        params: {
+          agent_id: 'agent-1',
+        },
+        body: {
+          variant: 'agent_app',
+          save_strategy: 'save_to_current_version',
+          agent_soul: {
+            schema_version: 1,
+          },
+        },
+      },
+      undefined,
+      createMutationContext(queryClient),
+    )
+
+    expect(invalidateQueries).not.toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.get.key(),
+    })
+    expect(invalidateQueries).not.toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.inviteOptions.get.key(),
+    })
+  })
+
+  it('should invalidate invite option lists after deleting an agent', async () => {
+    const consoleQuery = await loadConsoleQuery()
+    const queryClient = new QueryClient()
+    const invalidateQueries = vi.spyOn(queryClient, 'invalidateQueries')
+    const deletedAgent = createAgent()
+
+    const mutationOptions = consoleQuery.agent.byAgentId.delete.mutationOptions()
+    await mutationOptions.onSuccess?.(
+      {},
+      {
+        params: {
+          agent_id: deletedAgent.id,
+        },
+      },
+      undefined,
+      createMutationContext(queryClient),
+    )
+
+    expect(invalidateQueries).toHaveBeenCalledWith({
+      queryKey: consoleQuery.agent.inviteOptions.get.key(),
+    })
+  })
+})
+
 // Scenario: oRPC mutation defaults own shared tag cache behavior.
 describe('consoleQuery tag mutation defaults', () => {
   beforeEach(() => {
diff --git a/web/service/client.ts b/web/service/client.ts
index 84a8c7a43df..73c23f60da8 100644
--- a/web/service/client.ts
+++ b/web/service/client.ts
@@ -1,6 +1,14 @@
+import type { AgentAppPagination } from '@dify/contracts/api/console/agent/types.gen'
 import type { ApiBasedExtensionResponse } from '@dify/contracts/api/console/api-based-extension/types.gen'
+import type {
+  GetReleaseResponse,
+  ListReleasesResponse,
+  PrecheckReleaseRequest,
+} from '@dify/contracts/enterprise/types.gen'
 import type { ContractRouterClient } from '@orpc/contract'
 import type { JsonifiedClient } from '@orpc/openapi-client'
+import type { RouterUtils } from '@orpc/tanstack-query'
+import type { InfiniteData, QueryClient, QueryKey } from '@tanstack/react-query'
 import type { Tag } from '@/contract/console/tags'
 import { createORPCClient, onError } from '@orpc/client'
 import { OpenAPILink } from '@orpc/openapi-client/fetch'
@@ -16,11 +24,14 @@ import {
   marketplaceRouterContract,
 } from '@/contract/router'
 import { isClient } from '@/utils/client'
+// eslint-disable-next-line no-restricted-imports
 import { request } from './base'
 
-const getMarketplaceHeaders = () => new Headers({
-  'X-Dify-Version': !IS_MARKETPLACE ? APP_VERSION : '999.0.0',
-})
+function getMarketplaceHeaders() {
+  return new Headers({
+    'X-Dify-Version': !IS_MARKETPLACE ? APP_VERSION : '999.0.0',
+  })
+}
 
 function isURL(path: string) {
   try {
@@ -66,6 +77,252 @@ const marketplaceLink = new OpenAPILink(marketplaceRouterContract, {
 export const marketplaceClient: JsonifiedClient<ContractRouterClient<typeof marketplaceRouterContract>> = createORPCClient(marketplaceLink)
 export const marketplaceQuery = createTanstackQueryUtils(marketplaceClient, { path: ['marketplace'] })
 
+const APP_DEPLOY_SOURCE_APPS_PAGE_SIZE = 100
+const APP_DEPLOY_READINESS_RETRY_DELAYS = [0, 300, 700, 1200]
+
+type AppDeployInvalidationOptions = {
+  appInstances?: boolean
+  appInstanceSummaries?: boolean
+  appInstance?: boolean
+  appInstanceOverview?: boolean
+  environmentDeployments?: boolean
+  releases?: boolean
+  releaseSummaries?: boolean
+  releaseDeploymentView?: boolean
+  accessChannels?: boolean
+  accessSettings?: boolean
+  developerApiSettings?: boolean
+}
+
+type ConsoleQueryUtils = RouterUtils<JsonifiedClient<ContractRouterClient<typeof consoleRouterContract>>>
+
+const defaultAppDeployInvalidationOptions = {
+  appInstances: true,
+  appInstanceSummaries: true,
+  appInstance: true,
+  appInstanceOverview: true,
+  environmentDeployments: true,
+  releases: true,
+  releaseSummaries: true,
+  releaseDeploymentView: true,
+  accessChannels: true,
+  accessSettings: true,
+  developerApiSettings: true,
+} satisfies Required<AppDeployInvalidationOptions>
+
+function invalidateQueryKeys(client: QueryClient, queryKeys: QueryKey[]) {
+  return Promise.all(queryKeys.map(queryKey => client.invalidateQueries({ queryKey })))
+}
+
+function appInstanceQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.appInstanceService.getAppInstance.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function appInstanceOverviewQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.appInstanceService.getAppInstanceOverview.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function environmentDeploymentsQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.deploymentService.listEnvironmentDeployments.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function releasesQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.releaseService.listReleases.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function releaseSummariesQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.releaseService.listReleaseSummaries.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function releaseDeploymentViewQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.releaseService.computeReleaseDeploymentView.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function releaseQueryKey(query: ConsoleQueryUtils, releaseId: string) {
+  return query.enterprise.releaseService.getRelease.key({
+    type: 'query',
+    input: { params: { releaseId } },
+  })
+}
+
+function cachedReleaseAppInstanceId(
+  query: ConsoleQueryUtils,
+  client: QueryClient,
+  releaseId: string,
+) {
+  const listQueries = client.getQueriesData<ListReleasesResponse>({
+    queryKey: query.enterprise.releaseService.listReleases.key({ type: 'query' }),
+  })
+  for (const [, data] of listQueries) {
+    const appInstanceId = data?.releases?.find(release => release.id === releaseId)?.appInstanceId
+    if (appInstanceId)
+      return appInstanceId
+  }
+
+  const releaseQueries = client.getQueriesData<GetReleaseResponse>({
+    queryKey: query.enterprise.releaseService.getRelease.key({ type: 'query' }),
+  })
+  for (const [, data] of releaseQueries) {
+    const release = data?.release
+    if (release?.id === releaseId && release.appInstanceId)
+      return release.appInstanceId
+  }
+}
+
+function precheckReleaseQueryKey(query: ConsoleQueryUtils, body: PrecheckReleaseRequest) {
+  return query.enterprise.releaseService.precheckRelease.key({
+    type: 'query',
+    input: { body },
+  })
+}
+
+function accessChannelsQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.accessService.getAccessChannels.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function accessSettingsQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.accessService.getAccessSettings.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function developerApiSettingsQueryKey(query: ConsoleQueryUtils, appInstanceId: string) {
+  return query.enterprise.accessService.getDeveloperApiSettings.key({
+    type: 'query',
+    input: { params: { appInstanceId } },
+  })
+}
+
+function apiKeysQueryKey(query: ConsoleQueryUtils, appInstanceId: string, environmentId: string) {
+  return query.enterprise.accessService.listApiKeys.key({
+    type: 'query',
+    input: { params: { appInstanceId, environmentId } },
+  })
+}
+
+function accessPolicyQueryKey(query: ConsoleQueryUtils, appInstanceId: string, environmentId: string) {
+  return query.enterprise.accessService.getAccessPolicy.key({
+    type: 'query',
+    input: { params: { appInstanceId, environmentId } },
+  })
+}
+
+function invalidateAppDeployQueries(
+  query: ConsoleQueryUtils,
+  client: QueryClient,
+  appInstanceId: string,
+  options: AppDeployInvalidationOptions = {},
+) {
+  const resolvedOptions = {
+    ...defaultAppDeployInvalidationOptions,
+    ...options,
+  }
+  const queryKeys: QueryKey[] = []
+
+  if (resolvedOptions.appInstances)
+    queryKeys.push(query.enterprise.appInstanceService.listAppInstances.key())
+  if (resolvedOptions.appInstanceSummaries)
+    queryKeys.push(query.enterprise.appInstanceService.listAppInstanceSummaries.key())
+  if (resolvedOptions.appInstance)
+    queryKeys.push(appInstanceQueryKey(query, appInstanceId))
+  if (resolvedOptions.appInstanceOverview)
+    queryKeys.push(appInstanceOverviewQueryKey(query, appInstanceId))
+  if (resolvedOptions.environmentDeployments)
+    queryKeys.push(environmentDeploymentsQueryKey(query, appInstanceId))
+  if (resolvedOptions.releases)
+    queryKeys.push(releasesQueryKey(query, appInstanceId))
+  if (resolvedOptions.releaseSummaries)
+    queryKeys.push(releaseSummariesQueryKey(query, appInstanceId))
+  if (resolvedOptions.releaseDeploymentView)
+    queryKeys.push(releaseDeploymentViewQueryKey(query, appInstanceId))
+  if (resolvedOptions.accessChannels)
+    queryKeys.push(accessChannelsQueryKey(query, appInstanceId))
+  if (resolvedOptions.accessSettings)
+    queryKeys.push(accessSettingsQueryKey(query, appInstanceId))
+  if (resolvedOptions.developerApiSettings)
+    queryKeys.push(developerApiSettingsQueryKey(query, appInstanceId))
+
+  return invalidateQueryKeys(client, queryKeys)
+}
+
+function removeAppDeployQueries(query: ConsoleQueryUtils, client: QueryClient, appInstanceId: string) {
+  const queryKeys = [
+    appInstanceQueryKey(query, appInstanceId),
+    appInstanceOverviewQueryKey(query, appInstanceId),
+    environmentDeploymentsQueryKey(query, appInstanceId),
+    releasesQueryKey(query, appInstanceId),
+    releaseSummariesQueryKey(query, appInstanceId),
+    releaseDeploymentViewQueryKey(query, appInstanceId),
+    accessChannelsQueryKey(query, appInstanceId),
+    accessSettingsQueryKey(query, appInstanceId),
+    developerApiSettingsQueryKey(query, appInstanceId),
+  ]
+
+  queryKeys.forEach(queryKey => client.removeQueries({ queryKey }))
+}
+
+async function invalidateReleaseMutationQueries(
+  query: ConsoleQueryUtils,
+  client: QueryClient,
+  releaseId: string,
+  appInstanceId?: string,
+  options: {
+    removeRelease?: boolean
+  } = {},
+) {
+  const releaseDetailQueryKey = releaseQueryKey(query, releaseId)
+  if (options.removeRelease) {
+    client.removeQueries({
+      queryKey: releaseDetailQueryKey,
+    })
+  }
+  else {
+    await client.invalidateQueries({
+      queryKey: releaseDetailQueryKey,
+    })
+  }
+
+  if (appInstanceId) {
+    return invalidateAppDeployQueries(query, client, appInstanceId, {
+      accessChannels: false,
+      accessSettings: false,
+      developerApiSettings: false,
+    })
+  }
+
+  return invalidateQueryKeys(client, [
+    query.enterprise.appInstanceService.listAppInstances.key(),
+    query.enterprise.appInstanceService.listAppInstanceSummaries.key(),
+    query.enterprise.releaseService.listReleases.key({ type: 'query' }),
+    query.enterprise.releaseService.listReleaseSummaries.key({ type: 'query' }),
+    query.enterprise.releaseService.computeReleaseDeploymentView.key({ type: 'query' }),
+    query.enterprise.appInstanceService.getAppInstance.key({ type: 'query' }),
+    query.enterprise.appInstanceService.getAppInstanceOverview.key({ type: 'query' }),
+  ])
+}
+
 const consoleLink = new OpenAPILink(consoleRouterContract, {
   url: getBaseURL(API_PREFIX),
   fetch: (input, init) => {
@@ -87,9 +344,185 @@ const consoleLink = new OpenAPILink(consoleRouterContract, {
 
 export const consoleClient: JsonifiedClient<ContractRouterClient<typeof consoleRouterContract>> = createORPCClient(consoleLink)
 
-export const consoleQuery = createTanstackQueryUtils(consoleClient, {
+export const consoleQuery: RouterUtils<typeof consoleClient> = createTanstackQueryUtils(consoleClient, {
   path: ['console'],
   experimental_defaults: {
+    agent: {
+      post: {
+        mutationOptions: {
+          onSuccess: (_createdAgent, _variables, _onMutateResult, context) => {
+            context.client.invalidateQueries({
+              queryKey: consoleQuery.agent.get.key(),
+            })
+            context.client.invalidateQueries({
+              queryKey: consoleQuery.agent.inviteOptions.get.key(),
+            })
+          },
+        },
+      },
+      byAgentId: {
+        copy: {
+          post: {
+            mutationOptions: {
+              onSuccess: (copiedAgent, _variables, _onMutateResult, context) => {
+                context.client.setQueryData(
+                  consoleQuery.agent.byAgentId.get.queryKey({
+                    input: {
+                      params: {
+                        agent_id: copiedAgent.id,
+                      },
+                    },
+                  }),
+                  copiedAgent,
+                )
+                context.client.invalidateQueries({
+                  queryKey: consoleQuery.agent.get.key(),
+                })
+                context.client.invalidateQueries({
+                  queryKey: consoleQuery.agent.inviteOptions.get.key(),
+                })
+              },
+            },
+          },
+        },
+        put: {
+          mutationOptions: {
+            onSuccess: (updatedAgent, variables, _onMutateResult, context) => {
+              context.client.setQueriesData(
+                {
+                  queryKey: consoleQuery.agent.get.key({ type: 'query' }),
+                },
+                (oldList: AgentAppPagination | undefined) => {
+                  if (!oldList?.data.some(item => item.id === updatedAgent.id))
+                    return oldList
+
+                  return {
+                    ...oldList,
+                    data: oldList.data.map(item => item.id === updatedAgent.id ? updatedAgent : item),
+                  }
+                },
+              )
+              context.client.setQueriesData(
+                {
+                  queryKey: consoleQuery.agent.get.key({ type: 'infinite' }),
+                },
+                (oldList: InfiniteData<AgentAppPagination, unknown> | undefined) => {
+                  if (!oldList?.pages.some(page => page.data.some(item => item.id === updatedAgent.id)))
+                    return oldList
+
+                  return {
+                    ...oldList,
+                    pages: oldList.pages.map(page => ({
+                      ...page,
+                      data: page.data.map(item => item.id === updatedAgent.id ? updatedAgent : item),
+                    })),
+                  }
+                },
+              )
+              context.client.setQueryData(
+                consoleQuery.agent.byAgentId.get.queryKey({
+                  input: {
+                    params: {
+                      agent_id: variables.params.agent_id,
+                    },
+                  },
+                }),
+                updatedAgent,
+              )
+              context.client.invalidateQueries({
+                queryKey: consoleQuery.agent.inviteOptions.get.key(),
+              })
+            },
+          },
+        },
+        composer: {
+          put: {
+            mutationOptions: {
+              onSuccess: (_composerState, variables, _onMutateResult, context) => {
+                if (variables.body.save_strategy !== 'save_as_new_version')
+                  return
+
+                context.client.invalidateQueries({
+                  queryKey: consoleQuery.agent.get.key(),
+                })
+                context.client.invalidateQueries({
+                  queryKey: consoleQuery.agent.inviteOptions.get.key(),
+                })
+                context.client.removeQueries({
+                  queryKey: consoleQuery.agent.inviteOptions.get.key(),
+                })
+              },
+            },
+          },
+        },
+        delete: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _onMutateResult, context) => {
+              context.client.setQueriesData(
+                {
+                  queryKey: consoleQuery.agent.get.key({ type: 'query' }),
+                },
+                (oldList: AgentAppPagination | undefined) => {
+                  if (!oldList?.data.some(item => item.id === variables.params.agent_id))
+                    return oldList
+
+                  return {
+                    ...oldList,
+                    data: oldList.data.filter(item => item.id !== variables.params.agent_id),
+                    total: Math.max(0, oldList.total - 1),
+                  }
+                },
+              )
+              context.client.setQueriesData(
+                {
+                  queryKey: consoleQuery.agent.get.key({ type: 'infinite' }),
+                },
+                (oldList: InfiniteData<AgentAppPagination, unknown> | undefined) => {
+                  if (!oldList?.pages.some(page => page.data.some(item => item.id === variables.params.agent_id)))
+                    return oldList
+
+                  return {
+                    ...oldList,
+                    pages: oldList.pages.map((page) => {
+                      const total = Math.max(0, page.total - 1)
+
+                      return {
+                        ...page,
+                        data: page.data.filter(item => item.id !== variables.params.agent_id),
+                        has_more: page.page * page.limit < total,
+                        total,
+                      }
+                    }),
+                  }
+                },
+              )
+              context.client.invalidateQueries({
+                queryKey: consoleQuery.agent.get.key(),
+              })
+              context.client.invalidateQueries({
+                queryKey: consoleQuery.agent.inviteOptions.get.key(),
+              })
+            },
+          },
+        },
+      },
+    },
+    explore: {
+      updateAppAccessMode: {
+        mutationOptions: {
+          onSuccess: (_data, _variables, _onMutateResult, context) => {
+            return Promise.all([
+              context.client.invalidateQueries({
+                queryKey: consoleQuery.explore.appAccessMode.key({ type: 'query' }),
+              }),
+              context.client.invalidateQueries({
+                queryKey: ['access-control', 'app-whitelist-subjects'],
+              }),
+            ])
+          },
+        },
+      },
+    },
     apiBasedExtension: {
       post: {
         mutationOptions: {
@@ -173,5 +606,239 @@ export const consoleQuery = createTanstackQueryUtils(consoleClient, {
         },
       },
     },
+    enterprise: {
+      appInstanceService: {
+        createAppInstance: {
+          mutationOptions: {
+            onSuccess: async (data, _variables, _result, context) => {
+              const appInstanceId = data.appInstance?.id
+              if (appInstanceId) {
+                for (const delay of APP_DEPLOY_READINESS_RETRY_DELAYS) {
+                  if (delay > 0)
+                    await new Promise(resolve => setTimeout(resolve, delay))
+
+                  const listResponse = await context.client
+                    .fetchQuery(consoleQuery.enterprise.appInstanceService.listAppInstances.queryOptions({
+                      input: {
+                        query: {
+                          pageNumber: 1,
+                          resultsPerPage: APP_DEPLOY_SOURCE_APPS_PAGE_SIZE,
+                        },
+                      },
+                    }))
+                    .catch(() => undefined)
+
+                  if (listResponse?.appInstances?.some(app => app.id === appInstanceId))
+                    break
+                }
+              }
+
+              await context.client.invalidateQueries({
+                queryKey: consoleQuery.enterprise.appInstanceService.listAppInstances.key(),
+              })
+              await context.client.invalidateQueries({
+                queryKey: consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.key(),
+              })
+            },
+          },
+        },
+        updateAppInstance: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const appInstanceId = variables.params.appInstanceId
+              return invalidateAppDeployQueries(consoleQuery, context.client, appInstanceId, {
+                environmentDeployments: false,
+                releases: false,
+                accessChannels: false,
+              })
+            },
+          },
+        },
+        deleteAppInstance: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const appInstanceId = variables.params.appInstanceId
+              removeAppDeployQueries(consoleQuery, context.client, appInstanceId)
+
+              return Promise.all([
+                context.client.invalidateQueries({
+                  queryKey: consoleQuery.enterprise.appInstanceService.listAppInstances.key(),
+                }),
+                context.client.invalidateQueries({
+                  queryKey: consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.key(),
+                }),
+              ])
+            },
+          },
+        },
+      },
+      releaseService: {
+        createRelease: {
+          mutationOptions: {
+            onSuccess: (data, variables, _result, context) => {
+              const appInstanceId = data.release?.appInstanceId ?? data.appInstance?.id ?? variables.body.appInstanceId
+              const { dsl, sourceAppId } = variables.body
+              if (!appInstanceId) {
+                return Promise.all([
+                  context.client.invalidateQueries({
+                    queryKey: consoleQuery.enterprise.appInstanceService.listAppInstances.key(),
+                  }),
+                  context.client.invalidateQueries({
+                    queryKey: consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.key(),
+                  }),
+                ])
+              }
+
+              const appDeployInvalidation = invalidateAppDeployQueries(consoleQuery, context.client, appInstanceId, {
+                environmentDeployments: false,
+                accessChannels: false,
+              })
+              if (!dsl && !sourceAppId)
+                return appDeployInvalidation
+
+              return Promise.all([
+                appDeployInvalidation,
+                context.client.invalidateQueries({
+                  queryKey: precheckReleaseQueryKey(consoleQuery, {
+                    appInstanceId,
+                    ...(dsl ? { dsl } : { sourceAppId }),
+                  }),
+                }),
+              ])
+            },
+          },
+        },
+        deleteRelease: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const releaseId = variables.params.releaseId
+              const appInstanceId = cachedReleaseAppInstanceId(consoleQuery, context.client, releaseId)
+
+              return invalidateReleaseMutationQueries(consoleQuery, context.client, releaseId, appInstanceId, {
+                removeRelease: true,
+              })
+            },
+          },
+        },
+        updateRelease: {
+          mutationOptions: {
+            onSuccess: (data, variables, _result, context) => {
+              const releaseId = variables.params.releaseId
+              const appInstanceId = data.release?.appInstanceId
+                ?? cachedReleaseAppInstanceId(consoleQuery, context.client, releaseId)
+
+              return invalidateReleaseMutationQueries(consoleQuery, context.client, releaseId, appInstanceId)
+            },
+          },
+        },
+      },
+      deploymentService: {
+        deploy: {
+          mutationOptions: {
+            onSuccess: (data, _variables, _result, context) => {
+              // Deploy always creates a new AppInstance, so the reply carries it.
+              const appInstanceId = data.appInstance?.id ?? data.release?.appInstanceId
+              if (!appInstanceId) {
+                return Promise.all([
+                  context.client.invalidateQueries({
+                    queryKey: consoleQuery.enterprise.appInstanceService.listAppInstances.key(),
+                  }),
+                  context.client.invalidateQueries({
+                    queryKey: consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.key(),
+                  }),
+                ])
+              }
+
+              return invalidateAppDeployQueries(consoleQuery, context.client, appInstanceId)
+            },
+          },
+        },
+        cancelDeployment: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const appInstanceId = variables.params.appInstanceId
+              return invalidateAppDeployQueries(consoleQuery, context.client, appInstanceId)
+            },
+          },
+        },
+        promote: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const appInstanceId = variables.params.appInstanceId
+              return invalidateAppDeployQueries(consoleQuery, context.client, appInstanceId)
+            },
+          },
+        },
+        rollback: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const appInstanceId = variables.params.appInstanceId
+              return invalidateAppDeployQueries(consoleQuery, context.client, appInstanceId)
+            },
+          },
+        },
+        undeploy: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const appInstanceId = variables.params.appInstanceId
+              return invalidateAppDeployQueries(consoleQuery, context.client, appInstanceId)
+            },
+          },
+        },
+      },
+      accessService: {
+        createApiKey: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const appInstanceId = variables.params.appInstanceId
+              const environmentId = variables.params.environmentId
+              return invalidateQueryKeys(context.client, [
+                appInstanceQueryKey(consoleQuery, appInstanceId),
+                appInstanceOverviewQueryKey(consoleQuery, appInstanceId),
+                consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.key(),
+                accessChannelsQueryKey(consoleQuery, appInstanceId),
+                developerApiSettingsQueryKey(consoleQuery, appInstanceId),
+                apiKeysQueryKey(consoleQuery, appInstanceId, environmentId),
+              ])
+            },
+          },
+        },
+        deleteApiKey: {
+          mutationOptions: {
+            onSuccess: (_data, _variables, _result, context) => {
+              return invalidateQueryKeys(context.client, [
+                consoleQuery.enterprise.accessService.listApiKeys.key({ type: 'query' }),
+                consoleQuery.enterprise.accessService.getDeveloperApiSettings.key({ type: 'query' }),
+                consoleQuery.enterprise.appInstanceService.getAppInstanceOverview.key({ type: 'query' }),
+                consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.key(),
+              ])
+            },
+          },
+        },
+        updateAccessChannels: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const appInstanceId = variables.params.appInstanceId
+              return invalidateAppDeployQueries(consoleQuery, context.client, appInstanceId, {
+                environmentDeployments: false,
+                releases: false,
+              })
+            },
+          },
+        },
+        updateAccessPolicy: {
+          mutationOptions: {
+            onSuccess: (_data, variables, _result, context) => {
+              const { appInstanceId, environmentId } = variables.params
+              return invalidateQueryKeys(context.client, [
+                accessPolicyQueryKey(consoleQuery, appInstanceId, environmentId),
+                accessChannelsQueryKey(consoleQuery, appInstanceId),
+                accessSettingsQueryKey(consoleQuery, appInstanceId),
+              ])
+            },
+          },
+        },
+      },
+    },
   },
 })
diff --git a/web/service/common.ts b/web/service/common.ts
index 3f9c707fd02..34216703012 100644
--- a/web/service/common.ts
+++ b/web/service/common.ts
@@ -167,11 +167,26 @@ export const updatePluginProviderAIKey = ({ url, body }: { url: string, body: {
   return post<UpdateOpenAIKeyResponse>(url, { body })
 }
 
-export const invitationCheck = ({ url, params }: { url: string, params: { workspace_id?: string, email?: string, token: string } }): Promise<CommonResponse & { is_valid: boolean, data: { workspace_name: string, email: string, workspace_id: string } }> => {
-  return get<CommonResponse & { is_valid: boolean, data: { workspace_name: string, email: string, workspace_id: string } }>(url, { params })
+type InvitationCheckData = {
+  workspace_name: string
+  email: string
+  workspace_id: string
+  account_status?: string
+  requires_setup?: boolean
 }
 
-export const activateMember = ({ url, body }: { url: string, body: any }): Promise<LoginResponse> => {
+type ActivateMemberBody = {
+  token: string
+  name?: string
+  interface_language?: string
+  timezone?: string
+}
+
+export const invitationCheck = ({ url, params }: { url: string, params: { workspace_id?: string, email?: string, token: string } }): Promise<CommonResponse & { is_valid: boolean, data: InvitationCheckData }> => {
+  return get<CommonResponse & { is_valid: boolean, data: InvitationCheckData }>(url, { params })
+}
+
+export const activateMember = ({ url, body }: { url: string, body: ActivateMemberBody }): Promise<LoginResponse> => {
   return post<LoginResponse>(url, { body })
 }
 
diff --git a/web/service/fetch.ts b/web/service/fetch.ts
index 5fa9c25e325..597e0be1bab 100644
--- a/web/service/fetch.ts
+++ b/web/service/fetch.ts
@@ -156,7 +156,6 @@ async function base<T>(url: string, options: FetchOptionType = {}, otherOptions:
         redirect: 'follow',
       } as const
   const { params, body, headers: headersFromProps, ...init } = { ...baseOptions, ...options }
-  const headers = new Headers(headersFromProps || {})
 
   const {
     isPublicAPI = false,
@@ -169,6 +168,8 @@ async function base<T>(url: string, options: FetchOptionType = {}, otherOptions:
     request,
   } = otherOptions
 
+  const headers = new Headers(headersFromProps || {})
+
   let base: string
   if (isMarketplaceAPI)
     base = MARKETPLACE_API_PREFIX
@@ -259,15 +260,15 @@ async function base<T>(url: string, options: FetchOptionType = {}, otherOptions:
  * standard `base()` fetch wrapper.
  */
 export function postWithKeepalive(url: string, body: Record<string, unknown>): void {
-  const headers: Record<string, string> = {
+  const headers = new Headers({
     'Content-Type': ContentType.json,
     [CSRF_HEADER_NAME]: Cookies.get(CSRF_COOKIE_NAME()) || '',
-  }
+  })
 
   // Add Authorization header if an access token is available
   const accessToken = getWebAppAccessToken()
   if (accessToken)
-    headers.Authorization = `Bearer ${accessToken}`
+    headers.set('Authorization', `Bearer ${accessToken}`)
 
   globalThis.fetch(url, {
     method: 'POST',
diff --git a/web/service/knowledge/use-dataset.ts b/web/service/knowledge/use-dataset.ts
index 152aea73e04..b606a4bfb95 100644
--- a/web/service/knowledge/use-dataset.ts
+++ b/web/service/knowledge/use-dataset.ts
@@ -198,11 +198,12 @@ export const useExternalKnowledgeApiList = (options?: { enabled?: boolean }) =>
 export const useDatasetTestingRecords = (
   datasetId?: string,
   params?: { page: number, limit: number },
+  options?: { enabled?: boolean },
 ) => {
   return useQuery<HitTestingRecordsResponse>({
     queryKey: [NAME_SPACE, 'testing-records', datasetId, params],
     queryFn: () => get<HitTestingRecordsResponse>(`/datasets/${datasetId}/queries`, { params }),
-    enabled: !!datasetId && !!params,
+    enabled: !!datasetId && !!params && (options?.enabled ?? true),
     placeholderData: keepPreviousData,
   })
 }
diff --git a/web/service/use-apps.ts b/web/service/use-apps.ts
index fcff50b9677..6a742d2a1fc 100644
--- a/web/service/use-apps.ts
+++ b/web/service/use-apps.ts
@@ -25,6 +25,7 @@ type DateRangeParams = {
   end?: string
 }
 
+export const appDetailQueryKeyPrefix = [NAME_SPACE, 'detail']
 const useAppFullListKey = [NAME_SPACE, 'full-list']
 
 export const useGenerateRuleTemplate = (type: GeneratorType, disabled?: boolean) => {
@@ -42,9 +43,10 @@ export const useGenerateRuleTemplate = (type: GeneratorType, disabled?: boolean)
 
 export const useAppDetail = (appID: string) => {
   return useQuery<App>({
-    queryKey: [NAME_SPACE, 'detail', appID],
+    queryKey: [...appDetailQueryKeyPrefix, appID],
     queryFn: () => get<App>(`/apps/${appID}`),
     enabled: !!appID,
+    gcTime: 0,
   })
 }
 
diff --git a/web/service/use-common.ts b/web/service/use-common.ts
index d315a876022..1ee2451ffad 100644
--- a/web/service/use-common.ts
+++ b/web/service/use-common.ts
@@ -5,6 +5,7 @@ import type {
   ModelProvider,
   ModelTypeEnum,
 } from '@/app/components/header/account-setting/model-provider-page/declarations'
+import type { AccessControlTemplateLanguage } from '@/i18n-config/language'
 import type {
   AccountIntegrate,
   CodeBasedExtension,
@@ -12,7 +13,6 @@ import type {
   FileUploadConfigResponse,
   LangGeniusVersionResponse,
   Member,
-  PluginProvider,
   StructuredOutputRulesRequestBody,
   StructuredOutputRulesResponse,
 } from '@/models/common'
@@ -32,7 +32,6 @@ export const commonQueryKeys = {
   defaultModel: (type: ModelTypeEnum) => [NAME_SPACE, 'default-model', type] as const,
   retrievalMethods: [NAME_SPACE, 'support-retrieval-methods'] as const,
   accountIntegrates: [NAME_SPACE, 'account-integrates'] as const,
-  pluginProviders: [NAME_SPACE, 'plugin-providers'] as const,
   notionConnection: [NAME_SPACE, 'notion-connection'] as const,
   codeBasedExtensions: (module?: string) => [NAME_SPACE, 'code-based-extensions', module] as const,
   invitationCheck: (params?: { workspace_id?: string, email?: string, token?: string }) => [
@@ -125,10 +124,14 @@ type MemberResponse = {
   accounts: Member[] | null
 }
 
-export const useMembers = () => {
+export const useMembers = (language?: AccessControlTemplateLanguage) => {
   return useQuery<MemberResponse>({
-    queryKey: commonQueryKeys.members,
-    queryFn: () => get<MemberResponse>('/workspaces/current/members', { params: {} }),
+    queryKey: [...commonQueryKeys.members, language],
+    queryFn: () => get<MemberResponse>('/workspaces/current/members', {
+      params: {
+        language,
+      },
+    }),
   })
 }
 
@@ -229,13 +232,6 @@ export const useAccountIntegrates = () => {
   })
 }
 
-export const usePluginProviders = () => {
-  return useQuery<PluginProvider[] | null>({
-    queryKey: commonQueryKeys.pluginProviders,
-    queryFn: () => get<PluginProvider[] | null>('/workspaces/current/tool-providers'),
-  })
-}
-
 export const useCodeBasedExtensions = (module: string) => {
   return useQuery<CodeBasedExtension>({
     queryKey: commonQueryKeys.codeBasedExtensions(module),
@@ -248,7 +244,7 @@ export const useInvitationCheck = (params?: { workspace_id?: string, email?: str
     queryKey: commonQueryKeys.invitationCheck(params),
     queryFn: () => get<{
       is_valid: boolean
-      data: { workspace_name: string, email: string, workspace_id: string }
+      data: { workspace_name: string, email: string, workspace_id: string, account_status?: string, requires_setup?: boolean }
       result: string
     }>('/activate/check', { params }),
     enabled: enabled ?? !!params?.token,
diff --git a/web/service/use-explore.ts b/web/service/use-explore.ts
index 9683376b2ff..9c568263c89 100644
--- a/web/service/use-explore.ts
+++ b/web/service/use-explore.ts
@@ -20,7 +20,7 @@ type ExploreAppListData = {
   allList: App[]
 }
 
-export const useExploreAppList = () => {
+export const useExploreAppList = (options: { enabled?: boolean } = {}) => {
   const locale = useLocale()
   const exploreAppsInput = locale
     ? { query: { language: locale } }
@@ -36,6 +36,7 @@ export const useExploreAppList = () => {
         allList: [...recommended_apps].sort((a, b) => a.position - b.position),
       }
     },
+    enabled: options.enabled,
   })
 }
 
diff --git a/web/service/use-plugins.ts b/web/service/use-plugins.ts
index d2ccc2b681a..38b36c89c11 100644
--- a/web/service/use-plugins.ts
+++ b/web/service/use-plugins.ts
@@ -38,10 +38,11 @@ import { cloneDeep } from 'es-toolkit/object'
 import { useCallback, useEffect, useRef } from 'react'
 import useRefreshPluginList from '@/app/components/plugins/install-plugin/hooks/use-refresh-plugin-list'
 import { getFormattedPlugin } from '@/app/components/plugins/marketplace/utils'
-import { PermissionType, PluginCategoryEnum, TaskStatus } from '@/app/components/plugins/types'
+import { PluginCategoryEnum, TaskStatus } from '@/app/components/plugins/types'
 import { useAppContext } from '@/context/app-context'
 import { fetchModelProviderModelList } from '@/service/common'
 import { fetchPluginInfoFromMarketPlace, uninstallPlugin } from '@/service/plugins'
+import { hasPermission } from '@/utils/permission'
 // eslint-disable-next-line no-restricted-imports
 import { get, getMarketplace, post, postMarketplace } from './base'
 import { consoleQuery } from './client'
@@ -565,18 +566,19 @@ const areAutoUpgradeSettingsEqual = (left: AutoUpdateConfig | undefined, right:
     && areStringArraysEqual(left?.include_plugins ?? [], right?.include_plugins ?? [])
 }
 
-export const hasPluginPermission = (permission: PermissionType | undefined, isAdmin: boolean) => {
-  if (!permission)
-    return false
+// legacy plugin permission
+// export const hasPluginPermission = (permission: PermissionType | undefined, isAdmin: boolean) => {
+//   if (!permission)
+//     return false
 
-  if (permission === PermissionType.noOne)
-    return false
+//   if (permission === PermissionType.noOne)
+//     return false
 
-  if (permission === PermissionType.everyone)
-    return true
+//   if (permission === PermissionType.everyone)
+//     return true
 
-  return isAdmin
-}
+//   return isAdmin
+// }
 
 export const usePluginPermissionSettings = () => {
   return useQuery({
@@ -811,12 +813,8 @@ export const useFetchPluginsInMarketPlaceByInfo = (infos: MarketplacePluginInfoR
 export const usePluginTaskList = (category?: PluginCategoryEnum | string) => {
   const initializedRef = useRef(false)
   const queryClient = useQueryClient()
-  const { isCurrentWorkspaceManager, isCurrentWorkspaceOwner } = useAppContext()
-  const { data: permissions } = usePluginPermissionSettings()
-  const canManagement = hasPluginPermission(
-    permissions?.install_permission,
-    isCurrentWorkspaceManager || isCurrentWorkspaceOwner,
-  )
+  const { workspacePermissionKeys } = useAppContext()
+  const canManagement = hasPermission(workspacePermissionKeys, 'plugin.install')
   const { refreshPluginList } = useRefreshPluginList()
   const query = useQuery<PluginTaskListResponse>({
     enabled: canManagement,
diff --git a/web/service/use-tools.ts b/web/service/use-tools.ts
index f05e2241e2c..b9eb7a8cabf 100644
--- a/web/service/use-tools.ts
+++ b/web/service/use-tools.ts
@@ -1,4 +1,4 @@
-import type { QueryKey } from '@tanstack/react-query'
+import type { QueryKey, UseQueryOptions } from '@tanstack/react-query'
 import type {
   Collection,
   MCPServerDetail,
@@ -199,10 +199,11 @@ export const useUpdateMCPTools = () => {
   })
 }
 
-export const useMCPServerDetail = (appID: string) => {
+export const useMCPServerDetail = (appID: string, enabled = true) => {
   return useQuery<MCPServerDetail>({
     queryKey: [NAME_SPACE, 'MCPServerDetail', appID],
     queryFn: () => get<MCPServerDetail>(`/apps/${appID}/server`),
+    enabled,
   })
 }
 
@@ -307,7 +308,10 @@ export type AppTrigger = {
   updated_at: string
 }
 
-export const useAppTriggers = (appId: string | undefined, options?: any) => {
+export const useAppTriggers = (
+  appId: string | undefined,
+  options?: Omit<UseQueryOptions<{ data: AppTrigger[] }>, 'queryKey' | 'queryFn'>,
+) => {
   return useQuery<{ data: AppTrigger[] }>({
     queryKey: [NAME_SPACE, 'app-triggers', appId],
     queryFn: () => get<{ data: AppTrigger[] }>(`/apps/${appId}/triggers`),
diff --git a/web/types/app.ts b/web/types/app.ts
index b051fc7f4fc..85d7f7824bc 100644
--- a/web/types/app.ts
+++ b/web/types/app.ts
@@ -360,6 +360,10 @@ export type App = {
   app_model_config: ModelConfig
   /** Timestamp of creation */
   created_at: number
+  /** Creator account ID */
+  created_by?: string
+  /** Resource maintainer account ID */
+  maintainer?: string
   /** Timestamp of update */
   updated_at: number
   /** Web Application Configuration */
@@ -382,6 +386,8 @@ export type App = {
   has_draft_trigger?: boolean
   /** Type */
   workflow_kind?: WorkflowKind | null
+  /** ACL permission keys */
+  permission_keys?: string[]
 }
 
 export type AppSSO = {
diff --git a/web/utils/app-redirection.spec.ts b/web/utils/app-redirection.spec.ts
index ab790b1acc3..d3d9cb02b9f 100644
--- a/web/utils/app-redirection.spec.ts
+++ b/web/utils/app-redirection.spec.ts
@@ -3,57 +3,81 @@
  * Tests navigation path generation based on user permissions and app modes
  */
 import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
 import { getRedirection, getRedirectionPath } from './app-redirection'
 
 describe('app-redirection', () => {
   /**
    * Tests getRedirectionPath which determines the correct path based on:
-   * - User's editor permissions
+   * - App ACL layout access permissions
+   * - App ACL monitor and access config permissions
    * - App mode (workflow, advanced-chat, chat, completion, agent-chat)
    */
   describe('getRedirectionPath', () => {
-    it('returns overview path when user is not editor', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.CHAT }
-      const result = getRedirectionPath(false, app)
-      expect(result).toBe('/app/app-123/overview')
+    it('returns develop path when app ACL cannot access guarded pages', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [] }
+      const result = getRedirectionPath(app)
+      expect(result).toBe('/app/app-123/develop')
     })
 
-    it('returns workflow path for workflow mode when user is editor', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.WORKFLOW }
-      const result = getRedirectionPath(true, app)
+    it('returns workflow path for workflow mode when app ACL can access layout', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.WORKFLOW, permission_keys: [AppACLPermission.ViewLayout] }
+      const result = getRedirectionPath(app)
       expect(result).toBe('/app/app-123/workflow')
     })
 
-    it('returns workflow path for advanced-chat mode when user is editor', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.ADVANCED_CHAT }
-      const result = getRedirectionPath(true, app)
+    it('returns workflow path for advanced-chat mode when app ACL can access layout', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.ADVANCED_CHAT, permission_keys: [AppACLPermission.TestAndRun] }
+      const result = getRedirectionPath(app)
       expect(result).toBe('/app/app-123/workflow')
     })
 
-    it('returns configuration path for chat mode when user is editor', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.CHAT }
-      const result = getRedirectionPath(true, app)
+    it('returns configuration path for chat mode when app ACL can access layout', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [AppACLPermission.Edit] }
+      const result = getRedirectionPath(app)
       expect(result).toBe('/app/app-123/configuration')
     })
 
-    it('returns configuration path for completion mode when user is editor', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.COMPLETION }
-      const result = getRedirectionPath(true, app)
+    it('returns configuration path for completion mode when app ACL can access layout', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.COMPLETION, permission_keys: [AppACLPermission.ViewLayout] }
+      const result = getRedirectionPath(app)
       expect(result).toBe('/app/app-123/configuration')
     })
 
-    it('returns configuration path for agent-chat mode when user is editor', () => {
-      const app = { id: 'app-456', mode: AppModeEnum.AGENT_CHAT }
-      const result = getRedirectionPath(true, app)
+    it('returns configuration path for agent-chat mode when app ACL can access layout', () => {
+      const app = { id: 'app-456', mode: AppModeEnum.AGENT_CHAT, permission_keys: [AppACLPermission.ViewLayout] }
+      const result = getRedirectionPath(app)
       expect(result).toBe('/app/app-456/configuration')
     })
 
     it('handles different app IDs', () => {
-      const app1 = { id: 'abc-123', mode: AppModeEnum.CHAT }
-      const app2 = { id: 'xyz-789', mode: AppModeEnum.WORKFLOW }
+      const app1 = { id: 'abc-123', mode: AppModeEnum.CHAT, permission_keys: [] }
+      const app2 = { id: 'xyz-789', mode: AppModeEnum.WORKFLOW, permission_keys: [AppACLPermission.ViewLayout] }
 
-      expect(getRedirectionPath(false, app1)).toBe('/app/abc-123/overview')
-      expect(getRedirectionPath(true, app2)).toBe('/app/xyz-789/workflow')
+      expect(getRedirectionPath(app1)).toBe('/app/abc-123/develop')
+      expect(getRedirectionPath(app2)).toBe('/app/xyz-789/workflow')
+    })
+
+    it('returns layout path when the app maintainer has app.create_and_management permission without app ACL keys', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [] }
+
+      expect(getRedirectionPath(app, {
+        currentUserId: 'user-1',
+        resourceMaintainer: 'user-1',
+        workspacePermissionKeys: ['app.create_and_management'],
+      })).toBe('/app/app-123/configuration')
+    })
+
+    it('returns access config path when app ACL can only configure access', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [AppACLPermission.AccessConfig] }
+
+      expect(getRedirectionPath(app)).toBe('/app/app-123/access-config')
+    })
+
+    it('returns overview path when app ACL can only monitor the app', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [AppACLPermission.Monitor] }
+
+      expect(getRedirectionPath(app)).toBe('/app/app-123/overview')
     })
   })
 
@@ -64,42 +88,42 @@ describe('app-redirection', () => {
     /**
      * Tests that the redirection function is called with the correct path
      */
-    it('calls redirection function with correct path for non-editor', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.CHAT }
+    it('calls redirection function with develop path when app ACL cannot access guarded pages', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [] }
       const mockRedirect = vi.fn()
 
-      getRedirection(false, app, mockRedirect)
+      getRedirection(app, mockRedirect)
 
-      expect(mockRedirect).toHaveBeenCalledWith('/app/app-123/overview')
+      expect(mockRedirect).toHaveBeenCalledWith('/app/app-123/develop')
       expect(mockRedirect).toHaveBeenCalledTimes(1)
     })
 
-    it('calls redirection function with workflow path for editor', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.WORKFLOW }
+    it('calls redirection function with workflow path when app ACL can access layout', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.WORKFLOW, permission_keys: [AppACLPermission.ViewLayout] }
       const mockRedirect = vi.fn()
 
-      getRedirection(true, app, mockRedirect)
+      getRedirection(app, mockRedirect)
 
       expect(mockRedirect).toHaveBeenCalledWith('/app/app-123/workflow')
       expect(mockRedirect).toHaveBeenCalledTimes(1)
     })
 
-    it('calls redirection function with configuration path for chat mode editor', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.CHAT }
+    it('calls redirection function with configuration path for chat mode with layout access', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [AppACLPermission.ViewLayout] }
       const mockRedirect = vi.fn()
 
-      getRedirection(true, app, mockRedirect)
+      getRedirection(app, mockRedirect)
 
       expect(mockRedirect).toHaveBeenCalledWith('/app/app-123/configuration')
       expect(mockRedirect).toHaveBeenCalledTimes(1)
     })
 
     it('works with different redirection functions', () => {
-      const app = { id: 'app-123', mode: AppModeEnum.WORKFLOW }
+      const app = { id: 'app-123', mode: AppModeEnum.WORKFLOW, permission_keys: [AppACLPermission.ViewLayout] }
       const paths: string[] = []
       const customRedirect = (path: string) => paths.push(path)
 
-      getRedirection(true, app, customRedirect)
+      getRedirection(app, customRedirect)
 
       expect(paths).toEqual(['/app/app-123/workflow'])
     })
diff --git a/web/utils/app-redirection.ts b/web/utils/app-redirection.ts
index 5ed8419e059..b7e02f936e3 100644
--- a/web/utils/app-redirection.ts
+++ b/web/utils/app-redirection.ts
@@ -1,25 +1,40 @@
+import type { ResourceMaintainerPermissionOptions } from '@/utils/permission'
 import { AppModeEnum } from '@/types/app'
+import { getAppACLCapabilities } from '@/utils/permission'
+
+type AppRedirectionTarget = {
+  id: string
+  mode: AppModeEnum
+  permission_keys?: string[]
+}
 
 export const getRedirectionPath = (
-  isCurrentWorkspaceEditor: boolean,
-  app: { id: string, mode: AppModeEnum },
+  app: AppRedirectionTarget,
+  maintainerPermissionOptions?: ResourceMaintainerPermissionOptions,
 ) => {
-  if (!isCurrentWorkspaceEditor) {
-    return `/app/${app.id}/overview`
-  }
-  else {
+  const appACLCapabilities = getAppACLCapabilities(app.permission_keys, maintainerPermissionOptions)
+
+  if (appACLCapabilities.canAccessLayout) {
     if (app.mode === AppModeEnum.WORKFLOW || app.mode === AppModeEnum.ADVANCED_CHAT)
       return `/app/${app.id}/workflow`
     else
       return `/app/${app.id}/configuration`
   }
+
+  if (appACLCapabilities.canMonitor)
+    return `/app/${app.id}/overview`
+
+  if (appACLCapabilities.canAccessConfig)
+    return `/app/${app.id}/access-config`
+
+  return `/app/${app.id}/develop`
 }
 
 export const getRedirection = (
-  isCurrentWorkspaceEditor: boolean,
-  app: { id: string, mode: AppModeEnum },
+  app: AppRedirectionTarget,
   redirectionFunc: (href: string) => void,
+  maintainerPermissionOptions?: ResourceMaintainerPermissionOptions,
 ) => {
-  const redirectionPath = getRedirectionPath(isCurrentWorkspaceEditor, app)
+  const redirectionPath = getRedirectionPath(app, maintainerPermissionOptions)
   redirectionFunc(redirectionPath)
 }
diff --git a/web/utils/clipboard.ts b/web/utils/clipboard.ts
index f2ce93c8fe8..41406d4540f 100644
--- a/web/utils/clipboard.ts
+++ b/web/utils/clipboard.ts
@@ -1,6 +1,13 @@
 export async function writeTextToClipboard(text: string): Promise<void> {
-  if (window.isSecureContext && navigator.clipboard && navigator.clipboard.writeText)
-    return navigator.clipboard.writeText(text)
+  if (window.isSecureContext && navigator.clipboard && navigator.clipboard.writeText) {
+    try {
+      await navigator.clipboard.writeText(text)
+      return
+    }
+    catch {
+      // Fall through to the legacy path when browsers deny Clipboard API access.
+    }
+  }
 
   return fallbackCopyTextToClipboard(text)
 }
@@ -27,7 +34,7 @@ async function fallbackCopyTextToClipboard(text: string): Promise<void> {
   }
 }
 
-function convertAnyToError(err: any): Error {
+function convertAnyToError(err: unknown): Error {
   if (err instanceof Error)
     return err
 
diff --git a/web/utils/permission.spec.ts b/web/utils/permission.spec.ts
index 42c6e9636e3..311796cc14c 100644
--- a/web/utils/permission.spec.ts
+++ b/web/utils/permission.spec.ts
@@ -3,7 +3,14 @@ import { DatasetPermission } from '@/models/datasets'
  * Test suite for permission utility functions
  * Tests dataset edit permission logic based on user roles and dataset settings
  */
-import { hasEditPermissionForDataset } from './permission'
+import {
+  AppACLPermission,
+  DatasetACLPermission,
+  getAppACLCapabilities,
+  getDatasetACLCapabilities,
+  hasEditPermissionForDataset,
+  hasPermission,
+} from './permission'
 
 describe('permission', () => {
   /**
@@ -92,4 +99,105 @@ describe('permission', () => {
       expect(hasEditPermissionForDataset(creatorId, config)).toBe(true)
     })
   })
+
+  describe('hasPermissionKey', () => {
+    const permissionKey = 'workspace.member.manage'
+
+    it('returns true when the permission key exists', () => {
+      expect(hasPermission(['workspace.role.manage', permissionKey], permissionKey)).toBe(true)
+    })
+
+    it('returns false when the permission key does not exist', () => {
+      expect(hasPermission(['workspace.role.manage'], permissionKey)).toBe(false)
+    })
+  })
+
+  describe('getAppACLCapabilities', () => {
+    it('allows test-and-run users to access layout without edit or comment', () => {
+      const capabilities = getAppACLCapabilities([AppACLPermission.TestAndRun])
+
+      expect(capabilities.canTestAndRun).toBe(true)
+      expect(capabilities.canAccessLayout).toBe(true)
+      expect(capabilities.canComment).toBe(false)
+      expect(capabilities.canEdit).toBe(false)
+    })
+
+    it('allows view-layout users to preview the app and comment but not run/debug', () => {
+      const capabilities = getAppACLCapabilities([AppACLPermission.ViewLayout])
+
+      expect(capabilities.canPreviewApp).toBe(true)
+      expect(capabilities.canAccessLayout).toBe(true)
+      expect(capabilities.canComment).toBe(true)
+      expect(capabilities.canTestAndRun).toBe(false)
+    })
+  })
+
+  describe('app maintainer capabilities', () => {
+    it('grants all app ACL capabilities without injecting app ACL permission keys', () => {
+      const permissionKeys: string[] = []
+      const capabilities = getAppACLCapabilities(permissionKeys, {
+        currentUserId: 'user-1',
+        resourceMaintainer: 'user-1',
+        workspacePermissionKeys: ['app.create_and_management'],
+      })
+
+      expect(capabilities.canViewLayout).toBe(true)
+      expect(capabilities.canTestAndRun).toBe(true)
+      expect(capabilities.canEdit).toBe(true)
+      expect(capabilities.canImportExportDSL).toBe(true)
+      expect(capabilities.canDelete).toBe(true)
+      expect(capabilities.canReleaseAndVersion).toBe(true)
+      expect(capabilities.canMonitor).toBe(true)
+      expect(capabilities.canAccessConfig).toBe(true)
+      expect(permissionKeys).toEqual([])
+    })
+
+    it('keeps app ACL capabilities unchanged when the maintainer lacks app.create_and_management permission', () => {
+      const capabilities = getAppACLCapabilities([AppACLPermission.ViewLayout], {
+        currentUserId: 'user-1',
+        resourceMaintainer: 'user-1',
+        workspacePermissionKeys: [],
+      })
+
+      expect(capabilities.canViewLayout).toBe(true)
+      expect(capabilities.canEdit).toBe(false)
+      expect(capabilities.canDelete).toBe(false)
+    })
+  })
+
+  describe('dataset maintainer capabilities', () => {
+    it('grants all dataset ACL capabilities without injecting dataset ACL permission keys', () => {
+      const permissionKeys: string[] = []
+      const capabilities = getDatasetACLCapabilities(permissionKeys, {
+        currentUserId: 'user-1',
+        resourceMaintainer: 'user-1',
+        workspacePermissionKeys: ['dataset.create_and_management'],
+      })
+
+      expect(capabilities.canReadonly).toBe(true)
+      expect(capabilities.canEdit).toBe(true)
+      expect(capabilities.canImportExportDSL).toBe(true)
+      expect(capabilities.canPipelineTest).toBe(true)
+      expect(capabilities.canDocumentDownload).toBe(true)
+      expect(capabilities.canRetrievalRecall).toBe(true)
+      expect(capabilities.canUse).toBe(true)
+      expect(capabilities.canDeleteFile).toBe(true)
+      expect(capabilities.canPipelineRelease).toBe(true)
+      expect(capabilities.canDelete).toBe(true)
+      expect(capabilities.canAccessConfig).toBe(true)
+      expect(permissionKeys).toEqual([])
+    })
+
+    it('keeps dataset ACL capabilities unchanged when the current user is not the maintainer', () => {
+      const capabilities = getDatasetACLCapabilities([DatasetACLPermission.Readonly], {
+        currentUserId: 'user-1',
+        resourceMaintainer: 'user-2',
+        workspacePermissionKeys: ['dataset.create_and_management'],
+      })
+
+      expect(capabilities.canReadonly).toBe(true)
+      expect(capabilities.canEdit).toBe(false)
+      expect(capabilities.canDelete).toBe(false)
+    })
+  })
 })
diff --git a/web/utils/permission.ts b/web/utils/permission.ts
index 8a7b9f5fa1a..733e58611ce 100644
--- a/web/utils/permission.ts
+++ b/web/utils/permission.ts
@@ -1,5 +1,71 @@
+import type { PermissionKey } from '@/models/access-control'
 import { DatasetPermission } from '@/models/datasets'
 
+export const AppACLPermission = {
+  ViewLayout: 'app.acl.view_layout',
+  TestAndRun: 'app.acl.test_and_run',
+  Edit: 'app.acl.edit',
+  ImportExportDSL: 'app.acl.import_export_dsl',
+  Delete: 'app.acl.delete',
+  ReleaseAndVersion: 'app.acl.release_and_version',
+  Monitor: 'app.acl.monitor',
+  AccessConfig: 'app.acl.access_config',
+} as const
+
+export const DatasetACLPermission = {
+  Readonly: 'dataset.acl.readonly',
+  Edit: 'dataset.acl.edit',
+  ImportExportDSL: 'dataset.acl.import_export_dsl',
+  PipelineTest: 'dataset.acl.pipeline_test',
+  DocumentDownload: 'dataset.acl.document_download',
+  RetrievalRecall: 'dataset.acl.retrieval_recall',
+  Use: 'dataset.acl.use',
+  DeleteFile: 'dataset.acl.delete_file',
+  PipelineRelease: 'dataset.acl.pipeline_release',
+  Delete: 'dataset.acl.delete',
+  AccessConfig: 'dataset.acl.access_config',
+} as const
+
+export const BillingPermission = {
+  View: 'billing.view',
+  Manage: 'billing.manage',
+  SubscriptionManage: 'billing.subscription.manage',
+} as const
+
+export type ResourceMaintainerPermissionOptions = {
+  currentUserId?: string | null
+  resourceMaintainer?: string | null
+  workspacePermissionKeys?: readonly PermissionKey[] | null
+}
+
+type AppACLCapabilities = {
+  canViewLayout: boolean
+  canTestAndRun: boolean
+  canEdit: boolean
+  canAccessLayout: boolean
+  canComment: boolean
+  canPreviewApp: boolean
+  canImportExportDSL: boolean
+  canDelete: boolean
+  canReleaseAndVersion: boolean
+  canMonitor: boolean
+  canAccessConfig: boolean
+}
+
+type DatasetACLCapabilities = {
+  canReadonly: boolean
+  canEdit: boolean
+  canImportExportDSL: boolean
+  canPipelineTest: boolean
+  canDocumentDownload: boolean
+  canRetrievalRecall: boolean
+  canUse: boolean
+  canDeleteFile: boolean
+  canPipelineRelease: boolean
+  canDelete: boolean
+  canAccessConfig: boolean
+}
+
 type DatasetConfig = {
   createdBy: string
   partialMemberList: string[]
@@ -16,3 +82,76 @@ export const hasEditPermissionForDataset = (userId: string, datasetConfig: Datas
     return partialMemberList.includes(userId)
   return false
 }
+
+export const hasPermission = (permissionKeys: readonly PermissionKey[] | null | undefined, permissionKeySet: PermissionKey | PermissionKey[]) => {
+  if (!permissionKeys)
+    return false
+
+  if (Array.isArray(permissionKeySet)) {
+    return permissionKeySet.some(key => permissionKeys.includes(key))
+  }
+  const singlePermissionKey = permissionKeySet
+  return permissionKeys.includes(singlePermissionKey)
+}
+
+const shouldGrantMaintainerPermissions = (
+  options: ResourceMaintainerPermissionOptions | undefined,
+  createPermissionKey: PermissionKey,
+) => {
+  if (!options?.currentUserId || !options?.resourceMaintainer)
+    return false
+
+  return options.currentUserId === options.resourceMaintainer
+    && hasPermission(options.workspacePermissionKeys, createPermissionKey)
+}
+
+const hasResourcePermission = (
+  permissionKeys: readonly PermissionKey[] | null | undefined,
+  permissionKey: PermissionKey,
+  hasMaintainerPermissions: boolean,
+) => hasMaintainerPermissions || hasPermission(permissionKeys, permissionKey)
+
+export const getAppACLCapabilities = (
+  permissionKeys: readonly PermissionKey[] | null | undefined,
+  options?: ResourceMaintainerPermissionOptions,
+): AppACLCapabilities => {
+  const hasMaintainerPermissions = shouldGrantMaintainerPermissions(options, 'app.create_and_management')
+  const canViewLayout = hasResourcePermission(permissionKeys, AppACLPermission.ViewLayout, hasMaintainerPermissions)
+  const canTestAndRun = hasResourcePermission(permissionKeys, AppACLPermission.TestAndRun, hasMaintainerPermissions)
+  const canEdit = hasResourcePermission(permissionKeys, AppACLPermission.Edit, hasMaintainerPermissions)
+
+  return {
+    canViewLayout,
+    canTestAndRun,
+    canEdit,
+    canAccessLayout: canViewLayout || canTestAndRun || canEdit,
+    canComment: canViewLayout || canEdit,
+    canPreviewApp: canViewLayout || canTestAndRun,
+    canImportExportDSL: hasResourcePermission(permissionKeys, AppACLPermission.ImportExportDSL, hasMaintainerPermissions),
+    canDelete: hasResourcePermission(permissionKeys, AppACLPermission.Delete, hasMaintainerPermissions),
+    canReleaseAndVersion: hasResourcePermission(permissionKeys, AppACLPermission.ReleaseAndVersion, hasMaintainerPermissions),
+    canMonitor: hasResourcePermission(permissionKeys, AppACLPermission.Monitor, hasMaintainerPermissions),
+    canAccessConfig: hasResourcePermission(permissionKeys, AppACLPermission.AccessConfig, hasMaintainerPermissions),
+  }
+}
+
+export const getDatasetACLCapabilities = (
+  permissionKeys: readonly PermissionKey[] | null | undefined,
+  options?: ResourceMaintainerPermissionOptions,
+): DatasetACLCapabilities => {
+  const hasMaintainerPermissions = shouldGrantMaintainerPermissions(options, 'dataset.create_and_management')
+
+  return {
+    canReadonly: hasResourcePermission(permissionKeys, DatasetACLPermission.Readonly, hasMaintainerPermissions),
+    canEdit: hasResourcePermission(permissionKeys, DatasetACLPermission.Edit, hasMaintainerPermissions),
+    canImportExportDSL: hasResourcePermission(permissionKeys, DatasetACLPermission.ImportExportDSL, hasMaintainerPermissions),
+    canPipelineTest: hasResourcePermission(permissionKeys, DatasetACLPermission.PipelineTest, hasMaintainerPermissions),
+    canDocumentDownload: hasResourcePermission(permissionKeys, DatasetACLPermission.DocumentDownload, hasMaintainerPermissions),
+    canRetrievalRecall: hasResourcePermission(permissionKeys, DatasetACLPermission.RetrievalRecall, hasMaintainerPermissions),
+    canUse: hasResourcePermission(permissionKeys, DatasetACLPermission.Use, hasMaintainerPermissions),
+    canDeleteFile: hasResourcePermission(permissionKeys, DatasetACLPermission.DeleteFile, hasMaintainerPermissions),
+    canPipelineRelease: hasResourcePermission(permissionKeys, DatasetACLPermission.PipelineRelease, hasMaintainerPermissions),
+    canDelete: hasResourcePermission(permissionKeys, DatasetACLPermission.Delete, hasMaintainerPermissions),
+    canAccessConfig: hasResourcePermission(permissionKeys, DatasetACLPermission.AccessConfig, hasMaintainerPermissions),
+  }
+}